Miroslav Stampar
|
2802923dbe
|
some improvements regarding --os-shell web server application choice
|
2010-11-17 11:45:52 +00:00 |
|
Miroslav Stampar
|
5abbea4a9f
|
fix for a bug reported by nightman (unknown charset 'null')
|
2010-11-17 09:57:32 +00:00 |
|
Miroslav Stampar
|
d757e4ae1c
|
bug fix (when user manually sets web root, that same directory should be used as one of potentionaly default dirs)
|
2010-11-17 09:46:04 +00:00 |
|
Miroslav Stampar
|
bec152609a
|
minor cosmetics and bug fix for Windows machines ('\\' is interpreted as \ and inside the script it can screw things up as it's a marker for a special character - thus '\\\\' is interpreted as \\ which represents special character \)
|
2010-11-17 09:33:05 +00:00 |
|
Miroslav Stampar
|
76c3f5768b
|
cosmetics
|
2010-11-17 09:12:48 +00:00 |
|
Miroslav Stampar
|
2a8e270bef
|
proper handling of carriage return character from Windows target machines
|
2010-11-16 15:11:03 +00:00 |
|
Miroslav Stampar
|
ab33651f96
|
minor bug fix for displaying text from windows machines (\r was interfering with normal dataToStdout behavior)
|
2010-11-16 15:02:22 +00:00 |
|
Miroslav Stampar
|
3487429eac
|
minor cosmetics
|
2010-11-16 14:41:46 +00:00 |
|
Miroslav Stampar
|
3640dbf745
|
fix for --parse-errors (on IIS HTTP error is raised which need to be processed)
|
2010-11-16 14:33:30 +00:00 |
|
Miroslav Stampar
|
cccb565859
|
cosmetics
|
2010-11-16 14:11:32 +00:00 |
|
Miroslav Stampar
|
b9d9f18939
|
added General cmdline group
|
2010-11-16 14:09:09 +00:00 |
|
Miroslav Stampar
|
e7a66371f8
|
update regarding os shell-ing regarding JSP and ASPX
|
2010-11-16 13:46:46 +00:00 |
|
Miroslav Stampar
|
6232397129
|
minor update
|
2010-11-16 10:52:49 +00:00 |
|
Miroslav Stampar
|
6ef3846400
|
update regarding error parsing (and reporting)
|
2010-11-16 10:42:42 +00:00 |
|
Bernardo Damele
|
71cb982039
|
Another bug fix to --union-test
|
2010-11-15 21:42:56 +00:00 |
|
Miroslav Stampar
|
b3ad63b71e
|
major bug fix (haven't applied dynamic content removal to the original comparison (conf.seqMatcher.a) page)
|
2010-11-15 14:59:37 +00:00 |
|
Miroslav Stampar
|
ff310475c8
|
some reporting update for --forms
|
2010-11-15 14:17:51 +00:00 |
|
Miroslav Stampar
|
20d6b9a5c1
|
minor fix
|
2010-11-15 12:24:32 +00:00 |
|
Miroslav Stampar
|
39c6c9f386
|
minor update
|
2010-11-15 12:19:22 +00:00 |
|
Miroslav Stampar
|
819085155e
|
minor update/fix
|
2010-11-15 12:07:13 +00:00 |
|
Miroslav Stampar
|
c25c017c08
|
cosmetics regarding --forms
|
2010-11-15 11:50:33 +00:00 |
|
Miroslav Stampar
|
36c544f440
|
update (--forms acts now more like -g switch)
|
2010-11-15 11:34:57 +00:00 |
|
Bernardo Damele
|
5f46a549ba
|
Cosmetics for --forms
|
2010-11-14 21:59:35 +00:00 |
|
Bernardo Damele
|
0bfc1b411a
|
Another bug fix for --union-test
|
2010-11-14 15:39:57 +00:00 |
|
Miroslav Stampar
|
a0fb96816f
|
fix for a bug reported by ToR (value += actVer)
|
2010-11-14 08:31:29 +00:00 |
|
Bernardo Damele
|
8d07272c82
|
Added --union-cols switch to specify the max number of columns to test for UNION query sql injection.
Now stores/resumes also the exact UNION payload to session file.
|
2010-11-13 23:24:41 +00:00 |
|
Bernardo Damele
|
df5dc10111
|
Major enhancement to --union-test check
|
2010-11-13 22:47:37 +00:00 |
|
Miroslav Stampar
|
84849316b3
|
improvement of heuristic check (now original value is included too)
|
2010-11-12 23:06:01 +00:00 |
|
Miroslav Stampar
|
06a872fc99
|
update/fix for an issue reported by nightman (IncompleteRead: IncompleteRead(1284 bytes read))
|
2010-11-12 22:57:33 +00:00 |
|
Miroslav Stampar
|
27735b14df
|
update (--string and --regex should be done regardless of wasLastRequestError)
|
2010-11-12 22:44:15 +00:00 |
|
Miroslav Stampar
|
0d66f101da
|
fix for a bug reported by Bugtrace (--string "pengcheng_cui" and "Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource" on False pages)
|
2010-11-12 22:29:33 +00:00 |
|
Bernardo Damele
|
a777d59870
|
Minor bug fix
|
2010-11-12 15:17:12 +00:00 |
|
Bernardo Damele
|
0a83a830d9
|
Properly handle both HTTPS and HTTP requests through proxy
|
2010-11-12 14:21:46 +00:00 |
|
Bernardo Damele
|
e1ef27f592
|
work-around to be able to pass in the -r request file the Host header, the ending string ":443" and so sqlmap will go over https
|
2010-11-12 12:25:02 +00:00 |
|
Bernardo Damele
|
9f53048ff4
|
Put a space always between the user's provided prefix and sqlmap payload
|
2010-11-12 11:48:26 +00:00 |
|
Miroslav Stampar
|
697b32554c
|
fix for a bug "ordinal not in range(128)" reported by bugtrace
|
2010-11-12 11:48:25 +00:00 |
|
Bernardo Damele
|
f83dd2251b
|
Properly save error-based enumerated data in session file, able to be resumed like with other techniques
|
2010-11-12 11:40:37 +00:00 |
|
Bernardo Damele
|
a34c1b287c
|
Bug fix related to properly identify and parse the version from the banner (used for --stacked-test and other matters on MySQL/PgSQL)
|
2010-11-12 11:33:11 +00:00 |
|
Bernardo Damele
|
8cec75656c
|
Bug fix to properly save the match ratio only if numeric (to avoid also tracebacks when match is based on --string or --regexp)
|
2010-11-12 10:31:42 +00:00 |
|
Bernardo Damele
|
a14e4d9668
|
Referer does not have to be static, it's already a switch (--referer) so that user can specify it manually.
|
2010-11-12 10:16:39 +00:00 |
|
Bernardo Damele
|
66c82d72e4
|
Typo fix
|
2010-11-12 10:02:02 +00:00 |
|
Miroslav Stampar
|
42272ca78c
|
minor update
|
2010-11-11 22:26:36 +00:00 |
|
Miroslav Stampar
|
8aefd0bbf7
|
improvement of --common-tables and --common-columns
|
2010-11-11 20:37:25 +00:00 |
|
Miroslav Stampar
|
2d872f850a
|
quick fix
|
2010-11-11 19:54:54 +00:00 |
|
Miroslav Stampar
|
24238ccd0b
|
re-renaming of brute force switches. this way is better.
|
2010-11-11 07:57:44 +00:00 |
|
Miroslav Stampar
|
96d88877ba
|
bug fix (reported by ToR)
|
2010-11-10 19:44:51 +00:00 |
|
Miroslav Stampar
|
19c1bfa368
|
just a precaution (now i really need to go for a sleep)
|
2010-11-09 23:38:29 +00:00 |
|
Miroslav Stampar
|
88c00e61d3
|
another update
|
2010-11-09 23:35:37 +00:00 |
|
Miroslav Stampar
|
47720a43dd
|
minor fix (while we've calculated conf.matchRation for stable pages, we've put a constant value (0.900) for dynamic ones - so putting (ratio - conf.matchRatio) > DIFF_TOLERANCE for dynamic pages too would just effectively increase it's value to 0.900 + DIFF_TOLERANCE (in our case to 0.950) which is too narrow space for True result)
|
2010-11-09 23:21:21 +00:00 |
|
Miroslav Stampar
|
5ebd5d935c
|
another name change
|
2010-11-09 22:49:31 +00:00 |
|
Miroslav Stampar
|
06f00cf8c1
|
name change
|
2010-11-09 22:48:22 +00:00 |
|
Miroslav Stampar
|
6807fb04cc
|
minor update
|
2010-11-09 22:44:23 +00:00 |
|
Miroslav Stampar
|
fef60d5cb7
|
some fixes :)
|
2010-11-09 22:32:05 +00:00 |
|
Bernardo Damele
|
1cc99e2247
|
Possible quick fix for missing of True/False comparison of stable-but-not-really pages
|
2010-11-09 21:39:58 +00:00 |
|
Bernardo Damele
|
2205099a5e
|
Python stylish
|
2010-11-09 21:39:05 +00:00 |
|
Miroslav Stampar
|
cee888b613
|
tuning detection engine (None results from queryPage/comparison should not be treated as False in checkSqlInjection routine - None is returned when error is detected)
|
2010-11-09 19:14:55 +00:00 |
|
Miroslav Stampar
|
726825ca70
|
minor update
|
2010-11-09 16:59:36 +00:00 |
|
Miroslav Stampar
|
b43334165d
|
update regarding brute forcing
|
2010-11-09 16:53:33 +00:00 |
|
Miroslav Stampar
|
a7fa8d4975
|
update regarding brute force retrieval of table names and table column names
|
2010-11-09 16:15:55 +00:00 |
|
Miroslav Stampar
|
7752b5efe9
|
minor update
|
2010-11-09 09:51:54 +00:00 |
|
Miroslav Stampar
|
4be0631161
|
refactoring of brute force techniques
|
2010-11-09 09:42:43 +00:00 |
|
Miroslav Stampar
|
221f976fbd
|
minor update
|
2010-11-09 01:23:54 +00:00 |
|
Bernardo Damele
|
45ec8c169a
|
Consistency between --*-test switches/output
|
2010-11-08 16:46:25 +00:00 |
|
Miroslav Stampar
|
fda8752dca
|
revert of some HTTP headers handling
|
2010-11-08 13:26:45 +00:00 |
|
Bernardo Damele
|
78d7b17483
|
More replacements for refactoring.
Minor layout adjustments.
Alignment of conffile/optiondict/cmdline parameters.
|
2010-11-08 12:36:48 +00:00 |
|
Miroslav Stampar
|
eb999de0f1
|
added Range handler (dealing with 206 HTTP messages)
|
2010-11-08 12:26:13 +00:00 |
|
Miroslav Stampar
|
875781bf97
|
another minor fix
|
2010-11-08 11:55:56 +00:00 |
|
Miroslav Stampar
|
4a4a3051e5
|
fix
|
2010-11-08 11:39:07 +00:00 |
|
Miroslav Stampar
|
a3de10e3a2
|
new option -t
|
2010-11-08 11:22:47 +00:00 |
|
Miroslav Stampar
|
4e6d1b5118
|
added "Detection" part in help listing
|
2010-11-08 10:11:43 +00:00 |
|
Miroslav Stampar
|
0d0e2a2228
|
minor update
|
2010-11-08 09:49:57 +00:00 |
|
Miroslav Stampar
|
d551423379
|
further enum refactoring
|
2010-11-08 09:44:32 +00:00 |
|
Miroslav Stampar
|
862395ced1
|
further refactoring (all enumerations are now put into enums.py)
|
2010-11-08 09:20:02 +00:00 |
|
Miroslav Stampar
|
8e44aa605a
|
refactoring regarding injection place (more left)
|
2010-11-08 08:02:36 +00:00 |
|
Miroslav Stampar
|
0482e02c37
|
minor optimization
|
2010-11-07 23:37:15 +00:00 |
|
Miroslav Stampar
|
4f346eab33
|
fix for resume from session
|
2010-11-07 23:25:53 +00:00 |
|
Bernardo Damele
|
ea1b0d31be
|
Avoid displaying single retrieved character when --verbose > 2
|
2010-11-07 22:42:56 +00:00 |
|
Bernardo Damele
|
b6da946883
|
Added one new verbose level, -v 3 now shows the full injected payload.
Fixed also -d verbose output.
|
2010-11-07 22:34:29 +00:00 |
|
Bernardo Damele
|
a96467b3e2
|
Refactoring
|
2010-11-07 21:55:24 +00:00 |
|
Miroslav Stampar
|
7a6c086a27
|
setting direct query info output to same level as payload info (logger.DEBUG)
|
2010-11-07 21:42:36 +00:00 |
|
Miroslav Stampar
|
d3e7e89e60
|
major improvement with display of payloads (all payloads are displayed now) and removal of "pesky" spaces
|
2010-11-07 21:18:09 +00:00 |
|
Miroslav Stampar
|
620fa1c8fb
|
trust me, i know what i am doing :)
|
2010-11-07 20:33:33 +00:00 |
|
Bernardo Damele
|
73e85bfc75
|
Minor bug fix: the --tamper scripts have to be provided from the highest to the lowest priority, if not, sqlmap will reverse-sort them automatically as per user's choice. Tested, works now
|
2010-11-07 16:24:44 +00:00 |
|
Bernardo Damele
|
4d81da6bc8
|
Cosmetics
|
2010-11-07 16:23:03 +00:00 |
|
Bernardo Damele
|
6716315a76
|
Minor bug fix to properly set the ratio just before the check for injection, not before the check for dynamicity
|
2010-11-07 15:45:26 +00:00 |
|
Bernardo Damele
|
9669dbdae1
|
Minor cosmetics and adjustments
|
2010-11-07 15:34:52 +00:00 |
|
Miroslav Stampar
|
afba26a53f
|
tiny winy update
|
2010-11-07 09:00:45 +00:00 |
|
Miroslav Stampar
|
2b8c942b4a
|
more update
|
2010-11-07 08:58:24 +00:00 |
|
Miroslav Stampar
|
00dfd55830
|
added powerful switch --longest-common for dealing with heavy dynamicity
|
2010-11-07 08:52:09 +00:00 |
|
Miroslav Stampar
|
16f52ab7ba
|
cosmetic fix
|
2010-11-07 08:13:20 +00:00 |
|
Miroslav Stampar
|
8d93bdfa4b
|
minor update (optimization) regarding -a switch
|
2010-11-07 08:11:56 +00:00 |
|
Miroslav Stampar
|
508b9cc763
|
dynamicity engine update
|
2010-11-07 00:12:00 +00:00 |
|
Miroslav Stampar
|
3619fc5127
|
minor update
|
2010-11-06 08:31:11 +00:00 |
|
Miroslav Stampar
|
06760182f1
|
cosmetics
|
2010-11-05 16:08:42 +00:00 |
|
Miroslav Stampar
|
9bc9302e58
|
minor fix
|
2010-11-05 16:03:12 +00:00 |
|
Miroslav Stampar
|
44435adc4a
|
added some fancy Ctrl+C when having multiple targets
|
2010-11-05 15:59:25 +00:00 |
|
Miroslav Stampar
|
0e895fa512
|
update of dynamicity testing and few misc fixes
|
2010-11-05 13:14:12 +00:00 |
|
Miroslav Stampar
|
ef1809464d
|
bug fix for that BadStatusLine (http://bugs.python.org/issue8450)
|
2010-11-05 11:58:20 +00:00 |
|
Miroslav Stampar
|
6295a59a30
|
minor update/fix
|
2010-11-05 11:39:35 +00:00 |
|
Miroslav Stampar
|
f3e3420677
|
fix for a bug reported by Marcos Mateos Garcia (ValueError)
|
2010-11-05 11:34:09 +00:00 |
|
Miroslav Stampar
|
5f7f4bf15b
|
minor debug update (probably temporary)
|
2010-11-05 11:04:00 +00:00 |
|
Miroslav Stampar
|
3f0a443b83
|
some updates
|
2010-11-04 23:08:59 +00:00 |
|
Miroslav Stampar
|
29b7c5366c
|
cosmetics
|
2010-11-04 17:22:33 +00:00 |
|
Miroslav Stampar
|
ad6b2e9c21
|
minor fix
|
2010-11-04 16:47:18 +00:00 |
|
Miroslav Stampar
|
e1cec8c02b
|
fix for all that stable, dynamic mambo jambo :)
|
2010-11-04 16:44:34 +00:00 |
|
Miroslav Stampar
|
f1f7e0bfe0
|
fix for "unknown charset 'en_us'" (reported by ToR)
|
2010-11-04 13:56:01 +00:00 |
|
Miroslav Stampar
|
3aba0b1bec
|
minor update
|
2010-11-04 12:51:04 +00:00 |
|
Miroslav Stampar
|
63af5444fd
|
fix (NameError: global name 'DBMS' is not defined)
|
2010-11-04 12:47:34 +00:00 |
|
Bernardo Damele
|
91a3a582e8
|
Minor bug fix to avoid crash when running sqlmap behind a proxy server
|
2010-11-04 12:22:04 +00:00 |
|
Bernardo Damele
|
0e9515c540
|
Cosmetics
|
2010-11-04 12:21:06 +00:00 |
|
Miroslav Stampar
|
18aea251b3
|
added concept of tamper script priority
|
2010-11-04 10:29:40 +00:00 |
|
Miroslav Stampar
|
303359e8b1
|
refix
|
2010-11-04 09:34:04 +00:00 |
|
Miroslav Stampar
|
efe75aa8a3
|
added some debug messages
|
2010-11-04 09:18:32 +00:00 |
|
Bernardo Damele
|
b152b1a04d
|
Cosmetics
|
2010-11-03 22:07:13 +00:00 |
|
Miroslav Stampar
|
71d0b1bcd7
|
several bug fixes
|
2010-11-03 21:51:36 +00:00 |
|
Miroslav Stampar
|
44678fa320
|
fix for a bug reported by ToR (TypeError: unsupported operand type(s) for *: 'float' and 'NoneType')
|
2010-11-03 12:40:11 +00:00 |
|
Miroslav Stampar
|
6adee3792a
|
removed all trailing spaces from blank lines
|
2010-11-03 10:08:27 +00:00 |
|
Miroslav Stampar
|
cd0d4135ac
|
implemented --banner for MaxDB and some minor fixes
|
2010-11-02 20:51:55 +00:00 |
|
Miroslav Stampar
|
861706fb31
|
fix for bug reported by ToR (unknown charset 'utf-8, text/html')
|
2010-11-02 18:01:10 +00:00 |
|
Bernardo Damele
|
c7c84c3089
|
Closes #111 (DECLARE/CHAR encode xp_cmdshell parameter in MSSQL).
|
2010-11-02 15:31:51 +00:00 |
|
Miroslav Stampar
|
70f6eab715
|
minor update
|
2010-11-02 12:08:28 +00:00 |
|
Miroslav Stampar
|
685a8e7d2c
|
refactoring of hard coded dbms names
|
2010-11-02 11:59:24 +00:00 |
|
Miroslav Stampar
|
5269cb8c08
|
some code refactoring and beautification
|
2010-11-02 09:06:38 +00:00 |
|
Miroslav Stampar
|
13e93f564a
|
one bug fix in dynamic content engine and some code refactoring
|
2010-11-02 07:32:08 +00:00 |
|
Miroslav Stampar
|
73b33ed765
|
fix for a bug reported by Ulisses Castro (Too many open files) - also, added an important caching mechanism with thread safe logic
|
2010-11-01 20:56:13 +00:00 |
|
Bernardo Damele
|
486a113560
|
Consolidate logger messages for --*-test switches
|
2010-10-31 16:58:38 +00:00 |
|
Bernardo Damele
|
46be570463
|
Proper HTTP version display
|
2010-10-31 15:41:28 +00:00 |
|
Bernardo Damele
|
f3cc41601c
|
Added check on --first and --last values
|
2010-10-31 14:42:13 +00:00 |
|
Bernardo Damele
|
0ffffef088
|
Implemented --tamper for direct connection too (-d)
|
2010-10-31 14:22:32 +00:00 |
|
Bernardo Damele
|
65a0a8d285
|
Delegate urlencoding to agent.py only
|
2010-10-31 13:28:05 +00:00 |
|
Bernardo Damele
|
c7b374534b
|
Minor cosmetics
|
2010-10-31 12:29:00 +00:00 |
|
Bernardo Damele
|
617edf7fc2
|
Minor bug fix
|
2010-10-31 12:24:19 +00:00 |
|
Bernardo Damele
|
fcada4df0f
|
Removed debug print
|
2010-10-31 12:21:22 +00:00 |
|
Bernardo Damele
|
2a2f949275
|
Minor bug fix
|
2010-10-31 12:20:38 +00:00 |
|
Bernardo Damele
|
264247d318
|
revert of a stupid commit
|
2010-10-31 12:09:55 +00:00 |
|
Bernardo Damele
|
2fb059a644
|
Bug fix
|
2010-10-31 12:02:20 +00:00 |
|
Bernardo Damele
|
9d08cb3a6f
|
Revert r2209 and minor code refactoring
|
2010-10-31 11:51:45 +00:00 |
|
Bernardo Damele
|
3eda4510e2
|
Properly encode the cookie
|
2010-10-31 11:26:33 +00:00 |
|
Bernardo Damele
|
3869ccebe8
|
Minor code refactoring
|
2010-10-31 11:17:51 +00:00 |
|
Bernardo Damele
|
6afc9bffaa
|
Minor bug fix: there will always be only one pair of delimiters as we add it for each place
|
2010-10-31 11:09:29 +00:00 |
|
Bernardo Damele
|
3a48bee9b0
|
Minor code refactoring
|
2010-10-31 11:03:59 +00:00 |
|
Bernardo Damele
|
8cf0ebde1e
|
Cosmetics
|
2010-10-29 23:00:48 +00:00 |
|
Miroslav Stampar
|
0125198210
|
minor fix
|
2010-10-29 21:19:28 +00:00 |
|
Miroslav Stampar
|
cbf38436f2
|
minor update
|
2010-10-29 16:15:23 +00:00 |
|
Miroslav Stampar
|
5a38ac7ea9
|
important update regarding (Bug #209) - probably more will be needed
|
2010-10-29 16:11:50 +00:00 |
|
Bernardo Damele
|
a0df231aa4
|
Avoid waiting 30 seconds when cleaning up the dbms and file system from sqlmap data
|
2010-10-29 13:09:53 +00:00 |
|
Miroslav Stampar
|
f7d42af046
|
some fixes regarding --check-payload
|
2010-10-29 11:00:23 +00:00 |
|
Bernardo Damele
|
b3b2c3864a
|
Minor code refactoring
|
2010-10-29 10:51:09 +00:00 |
|
Miroslav Stampar
|
d75578c81f
|
some update regarding common tables
|
2010-10-29 09:00:51 +00:00 |
|
Miroslav Stampar
|
895efd28a6
|
one more update regarding Bug #205
|
2010-10-28 23:22:13 +00:00 |
|