diff --git a/src/sqlmap-master/lib/techniques/dns/test.py b/src/sqlmap-master/lib/techniques/dns/test.py index 1a8fe6a..baf23ab 100644 --- a/src/sqlmap-master/lib/techniques/dns/test.py +++ b/src/sqlmap-master/lib/techniques/dns/test.py @@ -5,6 +5,7 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/) See the file 'LICENSE' for copying permission """ +# 导入Backend、randomInt、conf、kb、logger、FROM_DUMMY_TABLE、SqlmapNotVulnerableException、dnsUse模块 from lib.core.common import Backend from lib.core.common import randomInt from lib.core.data import conf @@ -14,19 +15,31 @@ from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.exception import SqlmapNotVulnerableException from lib.techniques.dns.use import dnsUse +# 定义dnsTest函数,用于测试通过DNS通道获取数据 + # 打印日志,表示正在测试通过DNS通道获取数据 + # 打印信息,表示正在测试通过DNS通道获取数据 def dnsTest(payload): logger.info("testing for data retrieval through DNS channel") + # 生成一个随机整数 + # 将kb.dnsTest设置为通过dnsUse函数获取的数据是否等于randInt randInt = randomInt() kb.dnsTest = dnsUse(payload, "SELECT %d%s" % (randInt, FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), ""))) == str(randInt) + # 如果kb.dnsTest为False,表示通过DNS通道获取数据失败 + # 构造错误信息 if not kb.dnsTest: + # 如果没有强制使用DNS通道 errMsg = "data retrieval through DNS channel failed" + # 将conf.dnsDomain设置为None if not conf.forceDns: + # 构造错误信息 conf.dnsDomain = None errMsg += ". Turning off DNS exfiltration support" logger.error(errMsg) + # 如果强制使用DNS通道 else: + # 抛出SqlmapNotVulnerableException异常 raise SqlmapNotVulnerableException(errMsg) else: infoMsg = "data retrieval through DNS channel was successful" diff --git a/src/sqlmap-master/lib/techniques/dns/use.py b/src/sqlmap-master/lib/techniques/dns/use.py index 4592d73..5bf872e 100644 --- a/src/sqlmap-master/lib/techniques/dns/use.py +++ b/src/sqlmap-master/lib/techniques/dns/use.py @@ -46,9 +46,12 @@ def dnsUse(payload, expression): count = 0 offset = 1 + # 如果配置了dnsDomain,并且数据库类型为MSSQL、ORACLE、MYSQL、PGSQL if conf.dnsDomain and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL): + # 使用hashDBRetrieve函数获取SQL查询的输出 output = hashDBRetrieve(expression, checkConf=True) + # 如果输出中包含PARTIAL_VALUE_MARKER,或者kb.dnsTest为None,则将输出置为None if output and PARTIAL_VALUE_MARKER in output or kb.dnsTest is None: output = None @@ -98,10 +101,15 @@ def dnsUse(payload, expression): kb.dnsMode = False + # 如果output不为None + # 如果output不为None if output is not None: + # 将output赋值给retVal retVal = output + # 如果kb.dnsTest不为None if kb.dnsTest is not None: + # 将output输出到标准输出 dataToStdout("[%s] [INFO] %s: %s\n" % (time.strftime("%X"), "retrieved" if count > 0 else "resumed", safecharencode(output))) if count > 0: