sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-02-16 19:40:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

minor revisit of tampering script(s) functionality (urlencode one is removed as it's currently obsolete regarding the whole process of automatic urlencoding)

Browse Source
This commit is contained in:
Miroslav Stampar 2011-04-04 08:04:47 +00:00
parent 305115a68b
commit e957c4400c
2 changed files with 4 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/request/connect.py
View File

@ -449,8 +449,10 @@ class Connect:
elif place: elif place:
if place in (PLACE.GET, PLACE.POST): if place in (PLACE.GET, PLACE.POST):
# payloads in GET and/or POST need to be urlencoded # payloads in GET and/or POST need to be urlencoded
# throughly without safe chars (especially &, = and %) # throughly without safe chars (especially & and =)
payload = urlencode(payload, None, True, True) # addendum: as we support url encoding in tampering
# functions therefore we need to use % as a safe char
payload = urlencode(payload, "%", False, True)
value = agent.replacePayload(value, payload) value = agent.replacePayload(value, payload)
value = agent.removePayloadDelimiters(value) value = agent.removePayloadDelimiters(value)

25
tamper/urlencode.py
View File

@ -1,25 +0,0 @@
#!/usr/bin/env python
"""
$Id$
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
See the file 'doc/COPYING' for copying permission
"""
from lib.core.convert import urlencode
from lib.core.enums import PRIORITY
from lib.core.exception import sqlmapUnsupportedFeatureException
__priority__ = PRIORITY.LOWER
def tamper(value):
"""
Replaces value with urlencode(value)
Example: 'SELECT FIELD FROM TABLE' becomes 'SELECT%20FIELD%20FROM%20TABLE'
"""
if value:
value = urlencode(value, convall=True)
return value