sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-29 13:03:50 +03:00
Code Issues Packages Projects Releases Wiki Activity

added support for automatic filtering of badly formed HTML in --forms mode

Browse Source
This commit is contained in:
Miroslav Stampar 2011-10-28 21:28:03 +00:00
parent 1b45c5b56a
commit d7866ac78d
1 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lib/core/option.py
View File

@ -15,6 +15,7 @@ import logging
import os import os
import re import re
import socket import socket
import StringIO
import sys import sys
import threading import threading
import urllib2 import urllib2
@ -523,6 +524,13 @@ def __setBulkMultipleTargets():
f.close() f.close()
def __findPageForms(): def __findPageForms():
class _(StringIO.StringIO):
def __init__(self, content, url):
StringIO.StringIO.__init__(self, content)
self._url = url
def geturl(self):
return self._url
if not conf.forms: if not conf.forms:
return return
@ -532,7 +540,7 @@ def __findPageForms():
infoMsg = "searching for forms" infoMsg = "searching for forms"
logger.info(infoMsg) logger.info(infoMsg)
response, _ = Request.queryPage(response=True) response, headers = Request.queryPage(response=True)
if response is None or isinstance(response, basestring): if response is None or isinstance(response, basestring):
errMsg = "can't do form parsing as no valid response " errMsg = "can't do form parsing as no valid response "
@ -540,11 +548,18 @@ def __findPageForms():
errMsg += "for connection issues" errMsg += "for connection issues"
raise sqlmapGenericException, errMsg raise sqlmapGenericException, errMsg
response = _(response.read(), response.geturl())
try: try:
forms = ParseResponse(response, backwards_compat=False) forms = ParseResponse(response, backwards_compat=False)
except ParseError: except ParseError:
errMsg = "badly formed HTML at the target url. can't parse forms" errMsg = "badly formed HTML at the target url. will try to filter it"
raise sqlmapGenericException, errMsg logger.error(errMsg)
response.seek(0)
filtered = _("".join(re.findall(r'<form.+?</form>', response.read(), re.I | re.S)), response.geturl())
try:
forms = ParseResponse(filtered, backwards_compat=False)
except ParseError:
raise sqlmapGenericException, "no success"
if forms: if forms:
for form in forms: for form in forms: