From b42b62ae3813eb65d646b0505f8e9c3588d54e0b Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Fri, 4 Sep 2020 13:16:50 +0200 Subject: [PATCH] Major improvement in Base64 handling (late-binding) --- lib/core/agent.py | 7 ++++++- lib/core/settings.py | 3 ++- lib/core/testing.py | 3 ++- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/lib/core/agent.py b/lib/core/agent.py index e11afe200..246eaa03c 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -42,6 +42,7 @@ from lib.core.enums import PAYLOAD from lib.core.enums import PLACE from lib.core.enums import POST_HINT from lib.core.exception import SqlmapNoneDataException +from lib.core.settings import BOUNDED_BASE64_MARKER from lib.core.settings import BOUNDARY_BACKSLASH_MARKER from lib.core.settings import BOUNDED_INJECTION_MARKER from lib.core.settings import DEFAULT_COOKIE_DELIMITER @@ -183,7 +184,7 @@ class Agent(object): newValue = self.adjustLateValues(newValue) # TODO: support for POST_HINT - newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe) + newValue = "%s%s%s" % (BOUNDED_BASE64_MARKER, newValue, BOUNDED_BASE64_MARKER) if parameter in kb.base64Originals: origValue = kb.base64Originals[parameter] @@ -397,6 +398,10 @@ class Agent(object): """ if payload: + for match in re.finditer(r"%s(.*?)%s" % (BOUNDED_BASE64_MARKER, BOUNDED_BASE64_MARKER), payload): + _ = encodeBase64(match.group(1), binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe) + payload = payload.replace(match.group(0), _) + payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec)) payload = payload.replace(SINGLE_QUOTE_MARKER, "'") diff --git a/lib/core/settings.py b/lib/core/settings.py index fdad3128e..16605f611 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.4.9.2" +VERSION = "1.4.9.3" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) @@ -66,6 +66,7 @@ PARTIAL_HEX_VALUE_MARKER = "__PARTIAL_HEX_VALUE__" URI_QUESTION_MARKER = "__QUESTION_MARK__" ASTERISK_MARKER = "__ASTERISK_MARK__" REPLACEMENT_MARKER = "__REPLACEMENT_MARK__" +BOUNDED_BASE64_MARKER = "__BOUNDED_BASE64_MARK__" BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__" SAFE_VARIABLE_MARKER = "__SAFE__" SAFE_HEX_MARKER = "__SAFE_HEX__" diff --git a/lib/core/testing.py b/lib/core/testing.py index 0704a2da5..9c4e874bd 100644 --- a/lib/core/testing.py +++ b/lib/core/testing.py @@ -39,7 +39,6 @@ def vulnTest(): TESTS = ( ("-h", ("to see full list of options run with '-hh'",)), - ("-u -p id --base64=id -v 6 --data='base64=true' --flush-session --banner --technique=BEU", ("banner: '3.",)), ("--dependencies", ("sqlmap requires", "third-party library")), ("-u --flush-session --wizard", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")), (u"-c --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")), @@ -49,6 +48,8 @@ def vulnTest(): ("-r --flush-session -v 5 --test-skip='heavy' --save=", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")), ("-l --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")), ("-l --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")), + ("-u -p id --base64=id --data='base64=true' --flush-session --banner --technique=B", ("banner: '3.",)), + ("-u -p id --base64=id --data='base64=true' --flush-session --tables --technique=U", (" users ",)), ("-u --flush-session --banner --technique=B --not-string 'no results'", ("banner: '3.",)), ("-u --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)), ("-u --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),