<s> """<STR_LIT>""" <EOL> import sys <EOL> from grabber import getContent_POST , getContent_GET <EOL> from grabber import getContentDirectURL_GET , getContentDirectURL_POST <EOL> from grabber import single_urlencode <EOL> orderBSQL = { '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] } <EOL> overflowStr = "<STR_LIT>" <EOL> for k in range ( <NUM_LIT:0> , <NUM_LIT> ) : <EOL> overflowStr += '<STR_LIT>' <EOL> def detect_sql ( output , ) : <EOL> listWords = [ "<STR_LIT>" , "<STR_LIT>" , "<STR_LIT>" , "<STR_LIT>" ] <EOL> for wrd in listWords : <EOL> if output . count ( wrd ) > <NUM_LIT:0> : <EOL> return True <EOL> return False <EOL> def equal ( h1 , h2 ) : <EOL> if h1 == h2 : <EOL> return True <EOL> return False <EOL> def generateOutput ( url , gParam , instance , method , type ) : <EOL> astr = "<STR_LIT>" % ( method , url , gParam , str ( instance ) , type ) <EOL> if method in ( "<STR_LIT>" , "<STR_LIT:GET>" ) : <EOL> p = ( url + "<STR_LIT:?>" + gParam + "<STR_LIT:=>" + single_urlencode ( str ( instance ) ) ) <EOL> astr += "<STR_LIT>" % p <EOL> astr += "<STR_LIT>" <EOL> return astr <EOL> def generateOutputLong ( url , urlString , method , type , allParams = { } ) : <EOL> astr = "<STR_LIT>" % ( method , url , type ) <EOL> if method in ( "<STR_LIT>" , "<STR_LIT:GET>" ) : <EOL> p = ( url + "<STR_LIT:?>" + urlString ) <EOL> astr += "<STR_LIT>" % ( p ) <EOL> else : <EOL> astr += "<STR_LIT>" <EOL> for k in allParams : <EOL> astr += "<STR_LIT>" % ( k , allParams [ k ] ) <EOL> astr += "<STR_LIT>" <EOL> astr += "<STR_LIT>" <EOL> return astr <EOL> def permutations ( L ) : <EOL> if len ( L ) == <NUM_LIT:1> : <EOL> yield [ L [ <NUM_LIT:0> ] ] <EOL> elif len ( L ) >= <NUM_LIT:2> : <EOL> ( a , b ) = ( L [ <NUM_LIT:0> : <NUM_LIT:1> ] , L [ <NUM_LIT:1> : ] ) <EOL> for p in permutations ( b ) : <EOL> for i in range ( len ( p ) + <NUM_LIT:1> ) : <EOL> yield b [ : i ] + a + b [ i : ] <EOL> def process ( url , database , attack_list ) : <EOL> plop = open ( '<STR_LIT>' , '<STR_LIT:w>' ) <EOL> plop . write ( "<STR_LIT>" ) <EOL> for u in database . keys ( ) : <EOL> if len ( database [ u ] [ '<STR_LIT:GET>' ] ) : <EOL> print "<STR_LIT>" , u <EOL> for gParam in database [ u ] [ '<STR_LIT:GET>' ] : <EOL> defaultValue = database [ u ] [ '<STR_LIT:GET>' ] [ gParam ] <EOL> defaultReturn = getContent_GET ( u , gParam , defaultValue ) <EOL> if defaultReturn == None : <EOL> continue <EOL> for andSQL in attack_list [ '<STR_LIT>' ] : <EOL> tmpError = getContent_GET ( u , gParam , andSQL ) <EOL> if tmpError == None : <EOL> continue <EOL> if equal ( defaultReturn . read ( ) , tmpError . read ( ) ) : <EOL> basicError = getContent_GET ( u , gParam , '<STR_LIT>' ) <EOL> overflowErS = getContent_GET ( u , gParam , overflowStr ) <EOL> if basicError == None or overflowErS == None : <EOL> continue <EOL> if equal ( basicError . read ( ) , overflowErS . read ( ) ) : <EOL> for key in orderBSQL [ orderBSQL [ '<STR_LIT>' ] ] : <EOL> for instance in attack_list [ key ] : <EOL> tmpError = getContent_GET ( u , gParam , instance ) <EOL> if tmpError == None : <EOL> continue <EOL> if equal ( basicError . read ( ) , tmpError . read ( ) ) : <EOL> plop . write ( generateOutput ( u , gParam , instance , "<STR_LIT:GET>" , key ) ) <EOL> else : <EOL> plop . write ( generateOutput ( u , gParam , "<STR_LIT>" , "<STR_LIT:GET>" , "<STR_LIT>" ) ) <EOL> """<STR_LIT>""" <EOL> if len ( database [ u ] [ '<STR_LIT:POST>' ] ) : <EOL> print "<STR_LIT>" , u <EOL> for gParam in database [ u ] [ '<STR_LIT:POST>' ] : <EOL> defaultValue = database [ u ] [ '<STR_LIT:POST>' ] [ gParam ] <EOL> defaultReturn = getContent_POST ( u , gParam , defaultValue ) <EOL> if defaultReturn == None : <EOL> continue <EOL> for andSQL in attack_list [ '<STR_LIT>' ] : <EOL> tmpError = getContent_POST ( u , gParam , andSQL ) <EOL> if tmpError == None : <EOL> continue <EOL> if equal ( defaultReturn . read ( ) , tmpError . read ( ) ) : <EOL> basicError = getContent_POST ( u , gParam , '<STR_LIT>' ) <EOL> overflowErS = getContent_POST ( u , gParam , overflowStr ) <EOL> if basicError == None or overflowErS == None : <EOL> continue <EOL> if equal ( basicError . read ( ) , overflowErS . read ( ) ) : <EOL> for key in orderBSQL [ orderBSQL [ '<STR_LIT>' ] ] : <EOL> for instance in attack_list [ key ] : <EOL> tmpError = getContent_POST ( u , gParam , instance ) <EOL> if tmpError == None : <EOL> continue <EOL> if equal ( basicError . read ( ) , tmpError . read ( ) ) : <EOL> plop . write ( generateOutput ( u , gParam , instance , "<STR_LIT:POST>" , key ) ) <EOL> else : <EOL> plop . write ( generateOutput ( u , gParam , "<STR_LIT>" , "<STR_LIT:POST>" , "<STR_LIT>" ) ) <EOL> plop . write ( "<STR_LIT>" ) <EOL> plop . close ( ) <EOL> return "<STR_LIT>" </s>
