sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-02-03 05:04:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

minor improvement for reflective values (when missing first part of payload like in error reports)

Browse Source
This commit is contained in:
Miroslav Stampar 2012-04-11 15:01:28 +00:00
parent 01bd5d0ab2
commit 8b130f6497
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/core/common.py
View File

@ -2646,14 +2646,17 @@ def removeReflectiveValues(content, payload, suppressWarning=False):
regex = _(filterStringValue(payload, r'[A-Za-z0-9]', REFLECTED_REPLACEMENT_REGEX.encode("string-escape"))) regex = _(filterStringValue(payload, r'[A-Za-z0-9]', REFLECTED_REPLACEMENT_REGEX.encode("string-escape")))
if regex != payload: if regex != payload:
if all(part.lower() in content.lower() for part in regex.split(REFLECTED_REPLACEMENT_REGEX)): # fast optimization check if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check
parts = regex.split(REFLECTED_REPLACEMENT_REGEX) parts = regex.split(REFLECTED_REPLACEMENT_REGEX)
if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs
parts = parts[:REFLECTED_MAX_REGEX_PARTS / 2] + parts[-REFLECTED_MAX_REGEX_PARTS / 2:] parts = parts[:REFLECTED_MAX_REGEX_PARTS / 2] + parts[-REFLECTED_MAX_REGEX_PARTS / 2:]
parts = filter(None, parts) parts = filter(None, parts)
regex = r"(?i)\b%s\b" % REFLECTED_REPLACEMENT_REGEX.join(parts)
retVal = re.sub(regex, REFLECTED_VALUE_MARKER, content) for _ in xrange(2):
if parts:
regex = r"(?i)\b%s\b" % REFLECTED_REPLACEMENT_REGEX.join(parts)
retVal = re.sub(regex, REFLECTED_VALUE_MARKER, retVal)
parts = parts[1:]
if retVal != content: if retVal != content:
kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1 kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1