You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
109 lines
4.0 KiB
109 lines
4.0 KiB
#!/usr/bin/env python
|
|
|
|
"""
|
|
Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
|
|
See the file 'LICENSE' for copying permission
|
|
"""
|
|
|
|
import re
|
|
|
|
from xml.sax.handler import ContentHandler
|
|
|
|
from lib.core.common import sanitizeStr
|
|
|
|
class FingerprintHandler(ContentHandler):
|
|
"""
|
|
这个类定义了解析和提取数据库管理系统(DBMS)横幅信息的方法
|
|
基于XML文件中的数据进行匹配和提取
|
|
"""
|
|
|
|
def __init__(self, banner, info):
|
|
"""
|
|
初始化方法
|
|
:param banner: DBMS的横幅信息字符串
|
|
:param info: 用于存储提取信息的字典
|
|
"""
|
|
ContentHandler.__init__(self)
|
|
|
|
self._banner = sanitizeStr(banner or "") # 清理并存储横幅信息
|
|
self._regexp = None # 存储当前正则表达式
|
|
self._match = None # 存储正则匹配结果
|
|
self._dbmsVersion = None # 存储数据库版本信息
|
|
self._techVersion = None # 存储技术版本信息
|
|
self._info = info # 存储所有提取的信息
|
|
|
|
def _feedInfo(self, key, value):
|
|
"""
|
|
将提取的信息存入info字典
|
|
:param key: 信息类型(键)
|
|
:param value: 信息内容(值)
|
|
"""
|
|
value = sanitizeStr(value) # 清理输入值
|
|
|
|
# 如果值为空则直接返回
|
|
if value in (None, "None", ""):
|
|
return
|
|
|
|
# 特殊处理数据库版本信息
|
|
if key == "dbmsVersion":
|
|
self._info[key] = value
|
|
else:
|
|
# 对于其他类型的信息,创建一个集合来存储
|
|
if key not in self._info:
|
|
self._info[key] = set()
|
|
|
|
# 处理可能包含多个值的情况(用|分隔)
|
|
for _ in value.split("|"):
|
|
self._info[key].add(_)
|
|
|
|
def startElement(self, name, attrs):
|
|
"""
|
|
处理XML元素开始标签
|
|
:param name: 元素名称
|
|
:param attrs: 元素属性字典
|
|
"""
|
|
# 处理regexp标签,用于匹配横幅信息
|
|
if name == "regexp":
|
|
self._regexp = sanitizeStr(attrs.get("value"))
|
|
# 优化技巧:通过快速检查避免编译大量正则表达式
|
|
_ = re.match(r"\A[A-Za-z0-9]+", self._regexp)
|
|
|
|
# 如果快速检查通过或无法快速检查,则进行完整的正则匹配
|
|
if _ and self._banner and _.group(0).lower() in self._banner.lower() or not _:
|
|
self._match = re.search(self._regexp, self._banner, re.I | re.M)
|
|
else:
|
|
self._match = None
|
|
|
|
# 处理info标签,提取各种版本和技术信息
|
|
if name == "info" and self._match:
|
|
# 提取基本信息
|
|
self._feedInfo("type", attrs.get("type")) # 类型信息
|
|
self._feedInfo("distrib", attrs.get("distrib")) # 发行版信息
|
|
self._feedInfo("release", attrs.get("release")) # 发布信息
|
|
self._feedInfo("codename", attrs.get("codename")) # 代号信息
|
|
|
|
# 获取版本相关信息
|
|
self._dbmsVersion = sanitizeStr(attrs.get("dbms_version"))
|
|
self._techVersion = sanitizeStr(attrs.get("tech_version"))
|
|
self._sp = sanitizeStr(attrs.get("sp"))
|
|
|
|
# 处理数据库版本信息
|
|
if self._dbmsVersion and self._dbmsVersion.isdigit():
|
|
self._feedInfo("dbmsVersion", self._match.group(int(self._dbmsVersion)))
|
|
|
|
# 处理技术版本信息
|
|
if self._techVersion and self._techVersion.isdigit():
|
|
self._feedInfo("technology", "%s %s" % (attrs.get("technology"), self._match.group(int(self._techVersion))))
|
|
else:
|
|
self._feedInfo("technology", attrs.get("technology"))
|
|
|
|
# 处理Service Pack信息
|
|
if self._sp.isdigit():
|
|
self._feedInfo("sp", "Service Pack %s" % int(self._sp))
|
|
|
|
# 重置所有临时变量
|
|
self._regexp = None
|
|
self._match = None
|
|
self._dbmsVersion = None
|
|
self._techVersion = None
|