From 360d89cecc7a00d12b7704762593a298c22dd783 Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Thu, 7 Nov 2019 16:23:52 +0100
Subject: [PATCH] Critical bug patch for --crawl/--forms (introduced last week)

---
 lib/core/settings.py   |  5 ++++-
 lib/request/connect.py |  9 ++++++++-
 lib/utils/crawler.py   | 18 +++++++++++-------
 3 files changed, 23 insertions(+), 9 deletions(-)
diff --git a/lib/core/settings.py b/lib/core/settings.py
index 21e722f38..d97c81ace 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -18,7 +18,7 @@ from lib.core.enums import OS
 from thirdparty.six import unichr as _unichr
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.3.11.16"
+VERSION = "1.3.11.17"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -362,6 +362,9 @@ META_CHARSET_REGEX = r'(?si)<head>.*<meta[^>]+charset="?(?P<result>[^"> ]+).*</h
 # Regular expression used for parsing refresh info from meta html headers
 META_REFRESH_REGEX = r'(?si)<head>(?!.*?<noscript.*?</head).*?<meta http-equiv="?refresh"?[^>]+content="?[^">]+url=["\']?(?P<result>[^\'">]+).*</head>'
 
+# Regular expression used for parsing Javascript redirect request
+JAVASCRIPT_HREF_REGEX = r'<script>\s*(\w+\.)?location\.href\s*=["\'](?P<result>[^"\']+)'
+
 # Regular expression used for parsing empty fields in tested form data
 EMPTY_FORM_FIELDS_REGEX = r'(&|\A)(?P<result>[^=]+=(&|\Z))'
 
diff --git a/lib/request/connect.py b/lib/request/connect.py
index fc70f82c4..a0cf0f5e0 100644
--- a/lib/request/connect.py
+++ b/lib/request/connect.py
@@ -98,6 +98,7 @@ from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE
 from lib.core.settings import HTTP_ACCEPT_HEADER_VALUE
 from lib.core.settings import IPS_WAF_CHECK_PAYLOAD
 from lib.core.settings import IS_WIN
+from lib.core.settings import JAVASCRIPT_HREF_REGEX
 from lib.core.settings import LARGE_READ_TRIM_MARKER
 from lib.core.settings import MAX_CONNECTION_READ_SIZE
 from lib.core.settings import MAX_CONNECTIONS_REGEX
@@ -563,10 +564,16 @@ class Connect(object):
                     debugMsg = "got HTML meta refresh header"
                     logger.debug(debugMsg)
 
+                if not refresh:
+                    refresh = extractRegexResult(JAVASCRIPT_HREF_REGEX, page)
+
+                    debugMsg = "got Javascript redirect request"
+                    logger.debug(debugMsg)
+
                 if refresh:
                     if kb.alwaysRefresh is None:
                         msg = "got a refresh request "
-                        msg += "(redirect like response common to login pages). "
+                        msg += "(redirect like response common to login pages) to '%s'. " % refresh
                         msg += "Do you want to apply the refresh "
                         msg += "from now on (or stay on the original page)? [Y/n]"
 
diff --git a/lib/utils/crawler.py b/lib/utils/crawler.py
index 877040462..266da8caf 100644
--- a/lib/utils/crawler.py
+++ b/lib/utils/crawler.py
@@ -28,6 +28,7 @@ from lib.core.data import conf
 from lib.core.data import kb
 from lib.core.data import logger
 from lib.core.datatype import OrderedSet
+from lib.core.enums import HTTPMETHOD
 from lib.core.enums import MKSTEMP_PREFIX
 from lib.core.exception import SqlmapConnectionException
 from lib.core.exception import SqlmapSyntaxException
@@ -116,7 +117,7 @@ def crawl(target):
                                 if (extractRegexResult(r"\A[^?]+\.(?P<result>\w+)(\?|\Z)", url) or "").lower() not in CRAWL_EXCLUDE_EXTENSIONS:
                                     with kb.locks.value:
                                         threadData.shared.deeper.add(url)
-                                        if re.search(r"(.*?)\?(.+)", url):
+                                        if re.search(r"(.*?)\?(.+)", url) and not re.search(r"\?\d+\Z", url):
                                             threadData.shared.value.add(url)
                     except UnicodeEncodeError:  # for non-HTML files
                         pass
@@ -211,12 +212,15 @@ def crawl(target):
                 results = OrderedSet()
 
                 for target in kb.targets:
-                    match = re.search(r"/[^/?]*\?.*\Z", target[0])
-                    if match:
-                        key = re.sub(r"=[^=&]*", "=", match.group(0))
-                        if key not in seen:
-                            results.add(target)
-                            seen.add(key)
+                    if target[1] == HTTPMETHOD.GET:
+                        match = re.search(r"/[^/?]*\?.*\Z", target[0])
+                        if match:
+                            key = re.sub(r"=[^=&]*", "=", match.group(0))
+                            if key not in seen:
+                                results.add(target)
+                                seen.add(key)
+                    else:
+                        results.add(target)
 
                 kb.targets = results
 
