sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-03-03 19:55:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

more general approach

Browse Source
This commit is contained in:
Miroslav Stampar 2011-07-08 10:03:14 +00:00
parent 5443e06430
commit 02bfd05b20
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/core/convert.py
View File

@ -24,6 +24,7 @@ import urllib
from extra.safe2bin.safe2bin import safecharencode from extra.safe2bin.safe2bin import safecharencode
from extra.safe2bin.safe2bin import safechardecode from extra.safe2bin.safe2bin import safechardecode
from lib.core.data import conf from lib.core.data import conf
from lib.core.data import kb
from lib.core.data import logger from lib.core.data import logger
from lib.core.enums import PLACE from lib.core.enums import PLACE
from lib.core.settings import UNICODE_ENCODING from lib.core.settings import UNICODE_ENCODING
@ -89,7 +90,7 @@ def urldecode(value, encoding=None):
return result return result
def urlencode(value, safe="%&=", convall=False, limit=False, failsafe=True): def urlencode(value, safe="%&=", convall=False, limit=False):
if conf.direct or PLACE.SOAP in conf.paramDict: if conf.direct or PLACE.SOAP in conf.paramDict:
return value return value
@ -104,7 +105,8 @@ def urlencode(value, safe="%&=", convall=False, limit=False, failsafe=True):
# corner case when character % really needs to be # corner case when character % really needs to be
# encoded (when not representing url encoded char) # encoded (when not representing url encoded char)
if failsafe and all(map(lambda x: '%' in x, [safe, value])): # except in cases when tampering scripts are used
if all(map(lambda x: '%' in x, [safe, value])) and not kb.tamperFunctions:
value = re.sub("%(?![0-9a-fA-F]{2})", "%25", value, re.DOTALL | re.IGNORECASE) value = re.sub("%(?![0-9a-fA-F]{2})", "%25", value, re.DOTALL | re.IGNORECASE)
while True: while True:

2
lib/request/connect.py
View File

@ -529,7 +529,7 @@ class Connect:
# throughly without safe chars (especially & and =) # throughly without safe chars (especially & and =)
# addendum: as we support url encoding in tampering # addendum: as we support url encoding in tampering
# functions therefore we need to use % as a safe char # functions therefore we need to use % as a safe char
payload = urlencode(payload, "%", False, True, not kb.tamperFunctions) payload = urlencode(payload, "%", False, True)
value = agent.replacePayload(value, payload) value = agent.replacePayload(value, payload)
elif place == PLACE.SOAP: elif place == PLACE.SOAP:
# payloads in SOAP should have chars > and < replaced # payloads in SOAP should have chars > and < replaced