diff --git a/lib/controller/checks.py b/lib/controller/checks.py index d415367c1..1539b35b6 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -1379,7 +1379,6 @@ def checkWaf(): pushValue(kb.resendPostOnRedirect) pushValue(conf.timeout) - kb.identYwaf = True kb.redirectChoice = REDIRECTION.YES kb.resendPostOnRedirect = False conf.timeout = IDS_WAF_CHECK_TIMEOUT @@ -1389,7 +1388,6 @@ def checkWaf(): except SqlmapConnectionException: retVal = True finally: - kb.identYwaf = False kb.matchRatio = None conf.timeout = popValue() diff --git a/lib/core/option.py b/lib/core/option.py index fb0a50652..4b0087a6a 100644 --- a/lib/core/option.py +++ b/lib/core/option.py @@ -1886,7 +1886,6 @@ def _setKnowledgeBaseAttributes(flushAll=True): kb.hintValue = None kb.htmlFp = [] kb.httpErrorCodes = {} - kb.identYwaf = False kb.inferenceMode = False kb.ignoreCasted = None kb.ignoreNotFound = False diff --git a/lib/core/settings.py b/lib/core/settings.py index e2513b120..a5cc4fbee 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.3.5.149" +VERSION = "1.3.5.150" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) @@ -102,6 +102,9 @@ PRECONNECT_CANDIDATE_TIMEOUT = 10 # Servers known to cause issue with pre-connection mechanism (because of lack of multi-threaded support) PRECONNECT_INCOMPATIBLE_SERVERS = ("SimpleHTTP", "BaseHTTP") +# Identify WAF/IPS inside limited number of responses (Note: for optimization purposes) +IDENTYWAF_PARSE_LIMIT = 10 + # Maximum sleep time in "Murphy" (testing) mode MAX_MURPHY_SLEEP_TIME = 3 diff --git a/lib/request/basic.py b/lib/request/basic.py index 6421d3f4d..0ea5614b8 100644 --- a/lib/request/basic.py +++ b/lib/request/basic.py @@ -41,6 +41,7 @@ from lib.core.exception import SqlmapCompressionException from lib.core.settings import BLOCKED_IP_REGEX from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import EVENTVALIDATION_REGEX +from lib.core.settings import IDENTYWAF_PARSE_LIMIT from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE from lib.core.settings import META_CHARSET_REGEX from lib.core.settings import PARSE_HEADERS_LIMIT @@ -385,7 +386,7 @@ def processResponse(page, responseHeaders, code=None, status=None): if msg: logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.')) - if kb.identYwaf: + if kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT: rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", getUnicode("".join(responseHeaders.headers if responseHeaders else [])), page) identYwaf.non_blind.clear()