diff --git a/lib/core/agent.py b/lib/core/agent.py index 0ac48fd7b..5ef865b54 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -24,9 +24,9 @@ from lib.core.enums import DBMS from lib.core.enums import PAYLOAD from lib.core.enums import PLACE from lib.core.exception import sqlmapNoneDataException +from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import FROM_DUMMY_TABLE from lib.core.settings import PAYLOAD_DELIMITER -from lib.core.settings import URI_INJECTION_MARK_CHAR from lib.core.unescaper import unescaper class Agent: @@ -76,7 +76,7 @@ class Agent: origValue = paramDict[parameter] if place == PLACE.URI: - origValue = origValue.split(URI_INJECTION_MARK_CHAR)[0] + origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0] origValue = origValue[origValue.rfind('/') + 1:] for char in ('?', '=', ':'): if char in origValue: @@ -113,7 +113,7 @@ class Agent: retValue = ET.tostring(root) elif place == PLACE.URI: - retValue = paramString.replace("%s%s" % (origValue, URI_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue)) + retValue = paramString.replace("%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue)) elif place in (PLACE.UA, PLACE.REFERER, PLACE.HOST): retValue = paramString.replace(origValue, self.addPayloadDelimiters(newValue)) else: diff --git a/lib/core/common.py b/lib/core/common.py index 2099c69f8..2c425fab5 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -78,6 +78,7 @@ from lib.core.exception import sqlmapMissingDependence from lib.core.exception import sqlmapSilentQuitException from lib.core.exception import sqlmapSyntaxException from lib.core.optiondict import optDict +from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import DUMMY_USER_INJECTION @@ -126,7 +127,6 @@ from lib.core.settings import REFLECTIVE_MISS_THRESHOLD from lib.core.settings import SENSITIVE_DATA_REGEX from lib.core.settings import TEXT_TAG_REGEX from lib.core.settings import UNION_UNIQUE_FIFO_LENGTH -from lib.core.settings import URI_INJECTION_MARK_CHAR from lib.core.settings import URI_QUESTION_MARKER from lib.core.threads import getCurrentThreadData @@ -1072,7 +1072,7 @@ def parseTargetUrl(): else: conf.url = "http://" + conf.url - if URI_INJECTION_MARK_CHAR in conf.url: + if CUSTOM_INJECTION_MARK_CHAR in conf.url: conf.url = conf.url.replace('?', URI_QUESTION_MARKER) __urlSplit = urlparse.urlsplit(conf.url) diff --git a/lib/core/settings.py b/lib/core/settings.py index 111bd17d9..f6601e16e 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -317,8 +317,8 @@ MIN_RATIO = 0.0 # Maximum value for comparison ratio MAX_RATIO = 1.0 -# Character used for marking injectable position inside URI -URI_INJECTION_MARK_CHAR = '*' +# Character used for marking injectable position inside provided data +CUSTOM_INJECTION_MARK_CHAR = '*' # Maximum length used for retrieving data over MySQL error based payload due to "known" problems with longer result strings MYSQL_ERROR_CHUNK_LENGTH = 50 diff --git a/lib/core/target.py b/lib/core/target.py index 090c83918..f9f73839b 100644 --- a/lib/core/target.py +++ b/lib/core/target.py @@ -37,6 +37,7 @@ from lib.core.exception import sqlmapUserQuitException from lib.core.option import __setDBMS from lib.core.option import __setKnowledgeBaseAttributes from lib.core.session import resumeConfKb +from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import HOST_ALIASES from lib.core.settings import REFERER_ALIASES from lib.core.settings import RESULTS_FILE_FORMAT @@ -44,7 +45,6 @@ from lib.core.settings import SOAP_REGEX from lib.core.settings import UNENCODED_ORIGINAL_VALUE from lib.core.settings import UNICODE_ENCODING from lib.core.settings import URI_INJECTABLE_REGEX -from lib.core.settings import URI_INJECTION_MARK_CHAR from lib.core.settings import USER_AGENT_ALIASES from lib.utils.hashdb import HashDB from lib.core.xmldump import dumper as xmldumper @@ -110,16 +110,16 @@ def __setRequestParams(): test = readInput(message, default="Y") if not test or test[0] in ("y", "Y"): - conf.url = "%s%s" % (conf.url, URI_INJECTION_MARK_CHAR) + conf.url = "%s%s" % (conf.url, CUSTOM_INJECTION_MARK_CHAR) elif test[0] in ("n", "N"): pass elif test[0] in ("q", "Q"): raise sqlmapUserQuitException - if URI_INJECTION_MARK_CHAR in conf.url: + if CUSTOM_INJECTION_MARK_CHAR in conf.url: conf.parameters[PLACE.URI] = conf.url conf.paramDict[PLACE.URI] = {} - parts = conf.url.split(URI_INJECTION_MARK_CHAR) + parts = conf.url.split(CUSTOM_INJECTION_MARK_CHAR) for i in xrange(len(parts)-1): result = str() @@ -128,11 +128,11 @@ def __setRequestParams(): result += parts[j] if i == j: - result += URI_INJECTION_MARK_CHAR + result += CUSTOM_INJECTION_MARK_CHAR - conf.paramDict[PLACE.URI]["#%d%s" % (i+1, URI_INJECTION_MARK_CHAR)] = result + conf.paramDict[PLACE.URI]["#%d%s" % (i+1, CUSTOM_INJECTION_MARK_CHAR)] = result - conf.url = conf.url.replace(URI_INJECTION_MARK_CHAR, str()) + conf.url = conf.url.replace(CUSTOM_INJECTION_MARK_CHAR, str()) __testableParameters = True # Perform checks on Cookie parameters