sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-07-28 09:00:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

skipping csrf parameter injection try

Browse Source
This commit is contained in:
Marcel Gregoriadis 2018-12-09 17:52:18 +01:00
parent f745a0b1d0
commit faedc45399
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/controller/controller.py
View File

@ -470,7 +470,19 @@ def start():
paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place
csrfTokenPattern = r""
strings = conf.csrfToken.split("*")
for index, string in enumerate(strings):
csrfTokenPattern += re.escape(string)
if index < len(strings) - 1:
csrfTokenPattern += ".*"
for parameter, value in paramDict.items(): for parameter, value in paramDict.items():
if (re.match(csrfTokenPattern, parameter)):
infoMsg = "skipping csrf parameter '%s'" % parameter
logger.info(infoMsg)
continue
if not proceed: if not proceed:
break break

6
lib/request/connect.py
View File

@ -249,7 +249,6 @@ class Connect(object):
url = kwargs.get("url", None) or conf.url url = kwargs.get("url", None) or conf.url
get = kwargs.get("get", None) get = kwargs.get("get", None)
print get
post = kwargs.get("post", None) post = kwargs.get("post", None)
method = kwargs.get("method", None) method = kwargs.get("method", None)
cookie = kwargs.get("cookie", None) cookie = kwargs.get("cookie", None)
@ -773,11 +772,6 @@ class Connect(object):
if not multipart: if not multipart:
logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg)
#if "Invalid csrf token." in page:
# print "Invalid CSRF Token!"
#else:
# print "Valid CSRF Token!"
return page, responseHeaders, code return page, responseHeaders, code
@staticmethod @staticmethod