sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-05-09 18:23:45 +03:00
Code Issues Packages Projects Releases Wiki Activity

added inference failsafe (like in for instance Firebirds SUBSTR always returns a string value, no matter which starting index you use)

Browse Source
This commit is contained in:
Miroslav Stampar 2010-12-11 10:52:04 +00:00
parent c17f444aab
commit f021548bd0
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/core/settings.py
View File

@ -48,8 +48,13 @@ DUMP_STOP_MARKER = "__STOP__"
PAYLOAD_DELIMITER = "\x00" PAYLOAD_DELIMITER = "\x00"
CHAR_INFERENCE_MARK = "%c" CHAR_INFERENCE_MARK = "%c"
# minimum time response set needed for time-comparison based on standard deviation
MIN_TIME_RESPONSES = 10 MIN_TIME_RESPONSES = 10
# after these number of blanks at the end inference should stop (just in case)
INFERENCE_BLANK_BREAK = 20
# System variables # System variables
IS_WIN = subprocess.mswindows IS_WIN = subprocess.mswindows
# The name of the operating system dependent module imported. The following # The name of the operating system dependent module imported. The following

4
lib/techniques/blind/inference.py
View File

@ -34,6 +34,7 @@ from lib.core.exception import sqlmapThreadException
from lib.core.exception import unhandledException from lib.core.exception import unhandledException
from lib.core.progress import ProgressBar from lib.core.progress import ProgressBar
from lib.core.settings import CHAR_INFERENCE_MARK from lib.core.settings import CHAR_INFERENCE_MARK
from lib.core.settings import INFERENCE_BLANK_BREAK
from lib.core.unescaper import unescaper from lib.core.unescaper import unescaper
from lib.request.connect import Connect as Request from lib.request.connect import Connect as Request
@ -506,6 +507,9 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
elif conf.verbose in (1, 2): elif conf.verbose in (1, 2):
dataToStdout(val) dataToStdout(val)
if len(finalValue) > INFERENCE_BLANK_BREAK and finalValue[-INFERENCE_BLANK_BREAK:].isspace():
break
if conf.verbose in (1, 2) or showEta: if conf.verbose in (1, 2) or showEta:
dataToStdout("\n") dataToStdout("\n")