diff --git a/data/xml/errors.xml b/data/xml/errors.xml index 99af38203..29bb39a2d 100644 --- a/data/xml/errors.xml +++ b/data/xml/errors.xml @@ -42,7 +42,7 @@ - + @@ -55,6 +55,7 @@ + diff --git a/lib/controller/checks.py b/lib/controller/checks.py index a435917c0..2bc73f90c 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -157,6 +157,7 @@ def checkSqlInjection(place, parameter, value): # error message, simple heuristic check or via DBMS-specific # payload), ask the user to limit the tests to the fingerprinted # DBMS + if kb.reduceTests is None and not conf.testFilter and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms): msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or joinValue(injection.dbms, '/')) msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]" @@ -1041,11 +1042,6 @@ def heuristicCheckSqlInjection(place, parameter): if conf.skipHeuristics: return None - if kb.heavilyDynamic: - debugMsg = "heuristic check skipped because of heavy dynamicity" - logger.debug(debugMsg) - return None - origValue = conf.paramDict[place][parameter] paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place @@ -1082,7 +1078,7 @@ def heuristicCheckSqlInjection(place, parameter): casting = _(page) and not _(kb.originalPage) - if not casting and not result and kb.dynamicParameter and origValue.isdigit(): + if not casting and not result and kb.dynamicParameter and origValue.isdigit() and not kb.heavilyDynamic: randInt = int(randomInt()) payload = "%s%s%s" % (prefix, "%d-%d" % (int(origValue) + randInt, randInt), suffix) payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) @@ -1096,6 +1092,11 @@ def heuristicCheckSqlInjection(place, parameter): kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE + if kb.heavilyDynamic: + debugMsg = "heuristic check stopped because of heavy dynamicity" + logger.debug(debugMsg) + return kb.heuristicTest + if casting: errMsg = "possible %s casting detected (e.g. '" % ("integer" if origValue.isdigit() else "type") diff --git a/lib/core/settings.py b/lib/core/settings.py index 6883d3c03..54f820865 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.5.1.28" +VERSION = "1.5.1.29" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)