diff --git a/lib/core/settings.py b/lib/core/settings.py index 4164e6cce..51dfa4669 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -33,6 +33,10 @@ LOGGER_HANDLER.setFormatter(FORMATTER) LOGGER.addHandler(LOGGER_HANDLER) LOGGER.setLevel(logging.WARN) +# error based injection +ERROR_SPACE = "%c%c%c" % (58, 95, 58) +ERROR_EMPTY_CHAR = "%c%c%c" % (58, 120, 58) + # System variables IS_WIN = subprocess.mswindows # The name of the operating system dependent module imported. The following diff --git a/lib/request/inject.py b/lib/request/inject.py index 4d1dc2a4d..6bcd67838 100644 --- a/lib/request/inject.py +++ b/lib/request/inject.py @@ -27,6 +27,8 @@ from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries +from lib.core.settings import ERROR_SPACE +from lib.core.settings import ERROR_EMPTY_CHAR from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request from lib.request.direct import direct @@ -359,7 +361,7 @@ def __goError(expression, resumeValue=True): if match: output = match.group('result') if output: - output = output.replace("%c%c%c" % (58, 95, 58), " ").replace("%c%c%c" % (58, 120, 58), "") #':_:' -> EMPTY CHAR, ':x:' -> SPACE CHAR + output = output.replace(ERROR_SPACE, " ").replace(ERROR_EMPTY_CHAR, "") if kb.misc.testedDbms == 'MySQL': output = output[:-1]