From ba7ab215966353068472358e8c085110fe338c7f Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Mon, 29 Apr 2019 11:32:01 +0200
Subject: [PATCH] Minor update for vuln testing

---
 extra/vulnserver/vulnserver.py | 9 +++++++++
 lib/core/settings.py           | 2 +-
 lib/core/testing.py            | 2 +-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/extra/vulnserver/vulnserver.py b/extra/vulnserver/vulnserver.py
index bb730b665..379df0979 100644
--- a/extra/vulnserver/vulnserver.py
+++ b/extra/vulnserver/vulnserver.py
@@ -16,6 +16,7 @@ import traceback
 
 if sys.version_info >= (3, 0):
     from http.client import FOUND
+    from http.client import INTERNAL_SERVER_ERROR
     from http.client import NOT_FOUND
     from http.client import OK
     from http.server import BaseHTTPRequestHandler
@@ -27,6 +28,7 @@ else:
     from BaseHTTPServer import BaseHTTPRequestHandler
     from BaseHTTPServer import HTTPServer
     from httplib import FOUND
+    from httplib import INTERNAL_SERVER_ERROR
     from httplib import NOT_FOUND
     from httplib import OK
     from SocketServer import ThreadingMixIn
@@ -85,6 +87,13 @@ class ReqHandler(BaseHTTPRequestHandler):
         if query:
             params.update(parse_qs(query))
 
+            if "<script>" in unquote_plus(query):
+                self.send_response(INTERNAL_SERVER_ERROR)
+                self.send_header("Connection", "close")
+                self.end_headers()
+                self.wfile.write("CLOUDFLARE_ERROR_500S_BOX".encode("utf8"))
+                return
+
         if hasattr(self, "data"):
             params.update(parse_qs(self.data))
 
diff --git a/lib/core/settings.py b/lib/core/settings.py
index be7462dc6..f21edee10 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -17,7 +17,7 @@ from lib.core.enums import DBMS_DIRECTORY_NAME
 from lib.core.enums import OS
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.3.4.36"
+VERSION = "1.3.4.37"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
diff --git a/lib/core/testing.py b/lib/core/testing.py
index 0e13bb1ee..ae2ec5d84 100644
--- a/lib/core/testing.py
+++ b/lib/core/testing.py
@@ -64,7 +64,7 @@ def vulnTest():
     thread.start()
 
     for options, checks in (
-        ("--version", ("1.", "#")),
+        ("--identify-waf", ("CloudFlare",)),
         ("--flush-session", ("Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "back-end DBMS: SQLite", "3 columns")),
         ("--banner --schema --dump -T users --binary-fields=surname --where 'id>3'", ("banner: '3", "INTEGER", "TEXT", "id", "name", "surname", "2 entries", "6E616D6569736E756C6C")),
         ("--all", ("5 entries", "luther", "blisset", "fluffy", "ming", "NULL", "nameisnull")),