sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-01-24 00:04:23 +03:00
Code Issues Packages Projects Releases Wiki Activity

Avoid blank space between prefix and test's payload if it's a stacked queries test

Browse Source
This commit is contained in:
Bernardo Damele 2010-12-03 10:42:46 +00:00
parent b0928e02c6
commit 7d6f51f758
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/controller/checks.py
View File

@ -54,7 +54,6 @@ from plugins.dbms.sybase.syntax import Syntax as Sybase
from plugins.dbms.sqlite.syntax import Syntax as SQLite from plugins.dbms.sqlite.syntax import Syntax as SQLite
from plugins.dbms.maxdb.syntax import Syntax as MaxDB from plugins.dbms.maxdb.syntax import Syntax as MaxDB
def unescape(string, dbms): def unescape(string, dbms):
unescaper = { unescaper = {
"Access": Access.unescape, "Access": Access.unescape,
@ -244,7 +243,7 @@ def checkSqlInjection(place, parameter, value):
# Forge request payload by prepending with boundary's # Forge request payload by prepending with boundary's
# prefix and appending the boundary's suffix to the # prefix and appending the boundary's suffix to the
# test's ' <payload><comment> ' string # test's ' <payload><comment> ' string
boundPayload = "%s%s %s %s" % (origValue, prefix, fstPayload, suffix) boundPayload = "%s%s%s%s %s" % (origValue, prefix, (" " if stype != 4 else ""), fstPayload, suffix)
boundPayload = boundPayload.strip() boundPayload = boundPayload.strip()
boundPayload = agent.cleanupPayload(boundPayload, value) boundPayload = agent.cleanupPayload(boundPayload, value)
reqPayload = agent.payload(place, parameter, value, boundPayload) reqPayload = agent.payload(place, parameter, value, boundPayload)
@ -265,7 +264,7 @@ def checkSqlInjection(place, parameter, value):
# boundary's prefix and appending the boundary's # boundary's prefix and appending the boundary's
# suffix to the test's ' <payload><comment> ' # suffix to the test's ' <payload><comment> '
# string # string
boundPayload = "%s%s %s %s" % (origValue, prefix, sndPayload, suffix) boundPayload = "%s%s%s%s %s" % (origValue, prefix, (" " if stype != 4 else ""), sndPayload, suffix)
boundPayload = boundPayload.strip() boundPayload = boundPayload.strip()
boundPayload = agent.cleanupPayload(boundPayload, value) boundPayload = agent.cleanupPayload(boundPayload, value)
cmpPayload = agent.payload(place, parameter, value, boundPayload) cmpPayload = agent.payload(place, parameter, value, boundPayload)