From 03413bd5e07f2b64230a90fa77975d1771c7f040 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Thu, 27 Jan 2011 16:55:58 +0000 Subject: [PATCH] minor refactoring before a huge bug fix reported by Ahmed Shawky (we are falsely urlencoding ORIGINAL part of the injection payload) --- lib/core/settings.py | 4 ++++ lib/request/connect.py | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index 28b4ce821..4a78157dd 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -13,6 +13,7 @@ import subprocess import sys from lib.core.enums import DBMS +from lib.core.enums import PLACE from lib.core.revision import getRevisionNumber # sqlmap version and site @@ -204,3 +205,6 @@ WEBSCARAB_SPLITTER = "### Conversation" # Splitter used between requests in BURP log files BURP_SPLITTER = "======================================================" + +# Do the url-encoding based on parameter place +URL_ENCODE_PAYLOAD = { PLACE.GET: True, PLACE.POST: True, PLACE.COOKIE: False, PLACE.UA: True, PLACE.URI: False } diff --git a/lib/request/connect.py b/lib/request/connect.py index 1371be9eb..d381a2314 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -40,6 +40,7 @@ from lib.core.enums import PLACE from lib.core.exception import sqlmapConnectionException from lib.core.exception import sqlmapSyntaxException from lib.core.settings import MIN_TIME_RESPONSES +from lib.core.settings import URL_ENCODE_PAYLOAD from lib.core.threads import getCurrentThreadData from lib.request.basic import decodePage from lib.request.basic import forgeHeaders @@ -382,7 +383,6 @@ class Connect: pageLength = None uri = None raise404 = place != PLACE.URI if raise404 is None else raise404 - toUrlencode = { PLACE.GET: True, PLACE.POST: True, PLACE.COOKIE: conf.cookieUrlencode, PLACE.UA: True, PLACE.URI: False } if not place: place = kb.injection.place @@ -403,7 +403,7 @@ class Connect: value = agent.removePayloadDelimiters(value, False) value = urlEncodeCookieValues(value) elif place: - value = agent.removePayloadDelimiters(value, toUrlencode[place]) + value = agent.removePayloadDelimiters(value, URL_ENCODE_PAYLOAD[place]) if conf.checkPayload: checkPayload(value)