sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-26 03:23:48 +03:00
Code Issues Packages Projects Releases Wiki Activity

Removing arithmetic operations from false positive checking to minimize affect of character filtering ('>' and '=' have to stay because those are minimal requirements)

Browse Source
This commit is contained in:
stamparm 2013-06-26 10:55:34 +02:00
parent 0355e29b7c
commit fd5b665f7d
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/controller/checks.py
View File

@ -651,11 +651,16 @@ def checkFalsePositives(injection):
for i in xrange(1 + conf.level / 2):
randInt1, randInt2, randInt3 = (_() for j in xrange(3))
# Just in case (also, they have to be different than 0 because of the last test)
while randInt1 == randInt2:
randInt1 = min(randInt1, randInt2, randInt3)
randInt3 = max(randInt1, randInt2, randInt3)
while randInt1 >= randInt2:
randInt2 = _()
if not checkBooleanExpression("(%d+%d)=%d" % (randInt1, randInt2, randInt1 + randInt2)):
while randInt2 >= randInt3:
randInt3 = _()
if not checkBooleanExpression("%d=%d" % (randInt1, randInt1)):
retVal = None
break
@ -663,13 +668,15 @@ def checkFalsePositives(injection):
if PAYLOAD.TECHNIQUE.BOOLEAN not in injection.data:
checkBooleanExpression("%d=%d" % (randInt1, randInt2))
if checkBooleanExpression("%d>(%d+%d)" % (min(randInt1, randInt2), randInt3, max(randInt1, randInt2))):
if checkBooleanExpression("%d>%d" % (randInt1, randInt2)):
retVal = None
break
elif checkBooleanExpression("(%d+%d)>%d" % (randInt3, min(randInt1, randInt2), randInt1 + randInt2 + randInt3)):
elif checkBooleanExpression("%d>%d" % (randInt2, randInt3)):
retVal = None
break
elif not checkBooleanExpression("%d=(%d+%d)" % (randInt1 + randInt2, randInt1, randInt2)):
elif not checkBooleanExpression("%d>%d" % (randInt3, randInt1)):
retVal = None
break