From a603002acdb0ffadb4c77cc19ccd6c7a50433e2a Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Tue, 20 Jan 2015 09:38:18 +0100 Subject: [PATCH] Adding a choice to automatically turn on --identify-waf if protection has been detected --- lib/controller/checks.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 9a5f147c3..8681cc229 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -1119,9 +1119,17 @@ def checkWaf(): conf.parameters = dict(backup) if retVal: - warnMsg = "it appears that the target is protected. Please " - warnMsg += "consider usage of tamper scripts (option '--tamper')" + warnMsg = "it appears that the target " + warnMsg += "is protected" logger.critical(warnMsg) + + if not conf.identifyWaf: + message = "do you want sqlmap to try to detect backend " + message += "WAF/IPS/IDS? [y/N] " + output = readInput(message, default="N") + + if output and output[0] in ("Y", "y"): + conf.identifyWaf = True else: infoMsg = "it appears that the target is not protected" logger.info(infoMsg) @@ -1184,8 +1192,8 @@ def identifyWaf(): if output and output[0] not in ("Y", "y"): raise SqlmapUserQuitException else: - infoMsg = "no WAF/IDS/IPS product has been identified" - logger.info(infoMsg) + warnMsg = "no WAF/IDS/IPS product has been identified" + logger.warn(warnMsg) kb.testType = None kb.testMode = False