sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-25 11:03:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

Less requests in case of non-injectable parameters

Browse Source
This commit is contained in:
Miroslav Stampar 2019-05-20 15:13:52 +02:00
parent 0302a781b4
commit dd450b53f4
3 changed files with 30 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
lib/controller/checks.py
View File

@ -345,15 +345,16 @@ def checkSqlInjection(place, parameter, value):
match = re.search(r"(\d+)-(\d+)", test.request.columns) match = re.search(r"(\d+)-(\d+)", test.request.columns)
if match and not injection.data: if match and not injection.data:
_ = test.request.columns.split('-')[-1] _ = test.request.columns.split('-')[-1]
if conf.uCols is None and _.isdigit() and int(_) > 10: if conf.uCols is None and _.isdigit():
if kb.futileUnion is None: if kb.futileUnion is None:
msg = "it is not recommended to perform " msg = "it is recommended to perform "
msg += "extended UNION tests if there is not " msg += "only basic UNION tests if there is not "
msg += "at least one other (potential) " msg += "at least one other (potential) "
msg += "technique found. Do you want to skip? [Y/n] " msg += "technique found. Do you want to reduce "
kb.futileUnion = not readInput(msg, default='Y', boolean=True) msg +="the number of requests? [Y/n] "
kb.futileUnion = readInput(msg, default='Y', boolean=True)
if kb.futileUnion is False: if kb.futileUnion and int(_) > 10:
debugMsg = "skipping test '%s'" % title debugMsg = "skipping test '%s'" % title
logger.debug(debugMsg) logger.debug(debugMsg)
continue continue
@ -499,14 +500,31 @@ def checkSqlInjection(place, parameter, value):
return cmpPayload return cmpPayload
# Useful to set kb.matchRatio at first based on # Useful to set kb.matchRatio at first based on False response content
# the False response content
kb.matchRatio = None kb.matchRatio = None
kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE) kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
Request.queryPage(genCmpPayload(), place, raise404=False) Request.queryPage(genCmpPayload(), place, raise404=False)
falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
falseRawResponse = "%s%s" % (falseHeaders, falsePage) falseRawResponse = "%s%s" % (falseHeaders, falsePage)
# Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
if not kb.negativeLogic:
try:
ratio = 1.0
seqMatcher = getCurrentThreadData().seqMatcher
for current in (kb.originalPage, kb.heuristicPage):
seqMatcher.set_seq1(current)
seqMatcher.set_seq2(falsePage)
ratio *= seqMatcher.quick_ratio()
if ratio == 1.0:
continue
except MemoryError:
pass
kb.prevFalsePage = falsePage
# Perform the test's True request # Perform the test's True request
trueResult = Request.queryPage(reqPayload, place, raise404=False) trueResult = Request.queryPage(reqPayload, place, raise404=False)
truePage, trueHeaders, trueCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode truePage, trueHeaders, trueCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode

2
lib/core/settings.py
View File

@ -18,7 +18,7 @@ from lib.core.enums import OS
from thirdparty.six import unichr as _unichr from thirdparty.six import unichr as _unichr
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.3.5.117" VERSION = "1.3.5.118"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

4
lib/techniques/union/test.py
View File

@ -91,13 +91,15 @@ def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=
kb.errorIsNone = False kb.errorIsNone = False
lowerCount, upperCount = conf.uColsStart, conf.uColsStop lowerCount, upperCount = conf.uColsStart, conf.uColsStop
if kb.orderByColumns is None and (lowerCount == 1 or conf.uCols): # ORDER BY is not bullet-proof if kb.orderByColumns is None and (lowerCount == 1 or conf.uCols): # Note: ORDER BY is not bullet-proof
found = _orderByTechnique(lowerCount, upperCount) if conf.uCols else _orderByTechnique() found = _orderByTechnique(lowerCount, upperCount) if conf.uCols else _orderByTechnique()
if found: if found:
kb.orderByColumns = found kb.orderByColumns = found
infoMsg = "target URL appears to have %d column%s in query" % (found, 's' if found > 1 else "") infoMsg = "target URL appears to have %d column%s in query" % (found, 's' if found > 1 else "")
singleTimeLogMessage(infoMsg) singleTimeLogMessage(infoMsg)
return found return found
elif kb.futileUnion:
return None
if abs(upperCount - lowerCount) < MIN_UNION_RESPONSES: if abs(upperCount - lowerCount) < MIN_UNION_RESPONSES:
upperCount = lowerCount + MIN_UNION_RESPONSES upperCount = lowerCount + MIN_UNION_RESPONSES