sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-22 17:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

implementation of request from Santiago (look for error based responses in redirects)

Browse Source
This commit is contained in:
Miroslav Stampar 2011-03-17 09:12:28 +00:00
parent 847ce863e3
commit beba69faa9
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/techniques/error/use.py
View File

@ -31,6 +31,7 @@ from lib.core.enums import EXPECTED
from lib.core.enums import PAYLOAD from lib.core.enums import PAYLOAD
from lib.core.settings import FROM_TABLE from lib.core.settings import FROM_TABLE
from lib.core.settings import MYSQL_ERROR_CHUNK_LENGTH from lib.core.settings import MYSQL_ERROR_CHUNK_LENGTH
from lib.core.threads import getCurrentThreadData
from lib.core.unescaper import unescaper from lib.core.unescaper import unescaper
from lib.request.connect import Connect as Request from lib.request.connect import Connect as Request
from lib.utils.resume import resume from lib.utils.resume import resume
@ -40,6 +41,8 @@ reqCount = 0
def __oneShotErrorUse(expression, field): def __oneShotErrorUse(expression, field):
global reqCount global reqCount
threadData = getCurrentThreadData()
retVal = None retVal = None
offset = 1 offset = 1
@ -61,13 +64,17 @@ def __oneShotErrorUse(expression, field):
# Perform the request # Perform the request
page, headers = Request.queryPage(payload, content=True) page, headers = Request.queryPage(payload, content=True)
reqCount += 1 reqCount += 1
# Parse the returned page to get the exact error-based # Parse the returned page to get the exact error-based
# sql injection output # sql injection output
output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE) \ output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE) \
or extractRegexResult(check, listToStrValue(headers.headers \ or extractRegexResult(check, listToStrValue(headers.headers \
if headers else None), re.DOTALL | re.IGNORECASE) if headers else None), re.DOTALL | re.IGNORECASE) \
or extractRegexResult(check, threadData.lastRedirectMsg[1] \
if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == \
threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE)
if Backend.getIdentifiedDbms() == DBMS.MYSQL: if Backend.getIdentifiedDbms() == DBMS.MYSQL:
if offset == 1: if offset == 1: