sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-02-02 20:54:13 +03:00
Code Issues Packages Projects Releases Wiki Activity

Another minor update

Browse Source
This commit is contained in:
Miroslav Stampar 2014-08-20 01:59:30 +02:00
parent d08c1b7c04
commit 6795b51c7e
1 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
lib/controller/checks.py
View File

@ -741,18 +741,22 @@ def checkFilteredChars(injection):
kb.injection = injection kb.injection = injection
randInt = randomInt() randInt = randomInt()
if not checkBooleanExpression("(%d)=%d" % (randInt, randInt)): # all other techniques are already using parentheses in tests
warnMsg = "it appears that some non-alphanumeric characters (i.e. ()) are " if len(injection.data) == 1 and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data:
warnMsg += "filtered by the back-end server. There is a strong " if not checkBooleanExpression("(%d)=%d" % (randInt, randInt)):
warnMsg += "possibility that sqlmap won't be able to properly " warnMsg = "it appears that some non-alphanumeric characters (i.e. ()) are "
warnMsg += "exploit this vulnerability" warnMsg += "filtered by the back-end server. There is a strong "
logger.critical(warnMsg) warnMsg += "possibility that sqlmap won't be able to properly "
warnMsg += "exploit this vulnerability"
logger.critical(warnMsg)
if not checkBooleanExpression("%d>%d" % (randInt+1, randInt)): # inference techniques depend on character '>'
warnMsg = "it appears that the character '>' is " if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)):
warnMsg += "filtered by the back-end server. You are strongly " if not checkBooleanExpression("%d>%d" % (randInt+1, randInt)):
warnMsg += "advised to rerun with the '--tamper=between'" warnMsg = "it appears that the character '>' is "
logger.warn(warnMsg) warnMsg += "filtered by the back-end server. You are strongly "
warnMsg += "advised to rerun with the '--tamper=between'"
logger.warn(warnMsg)
kb.injection = popValue() kb.injection = popValue()