sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-22 17:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity
2,772 Commits 4 Branches 117 Tags 97 MiB
6e784e766b
Commit Graph

513 Commits

Author SHA1 Message Date
Bernardo Damele
f4745a95ea Possible fix for bug reported by David 2011-04-11 21:45:25 +00:00
Miroslav Stampar
941daa1645 just in case to prevent "object of type 'NoneType' has no len()" error reports 2011-04-11 11:59:02 +00:00
Miroslav Stampar
e20848c711 first commit toward v1.0 (it's smarter to start testing for pivot point from shorter column names as they tend to be some kind of identifiers) 2011-04-11 09:40:52 +00:00
Bernardo Damele
ea3ebafba1 Removed outdated sentence 2011-04-10 23:59:49 +00:00
Bernardo Damele
572708f184 More version adjustment 2011-04-10 23:28:24 +00:00
Bernardo Damele
fbf8e7f32d Minor bug fix to --file-read 2011-04-10 19:53:42 +00:00
Bernardo Damele
7dd5bd9d59 Minor fix for --cleanup on MSSQL 2011-04-10 13:48:29 +00:00
Bernardo Damele
6d165861c8 Minor version increase 2011-04-10 13:30:27 +00:00
Miroslav Stampar
c714ac6421 added support for handling binary data values (no more garbish chars) 2011-04-09 23:13:16 +00:00
Miroslav Stampar
6fa2fd139c implemented support for __pivotDumpTable on MSSQL as normal tables tend to not play well with normal TOP 1 ..NOT IN..ORDER BY mechanism if the argument for ORDER BY is not the unique one (returns only number of rows equal to the number of distinct values for that field) 2011-04-08 15:17:57 +00:00
Bernardo Damele
d5fb1378cc Gone unnoticed for way too long 2011-04-08 11:15:19 +00:00
Miroslav Stampar
e8259a7665 minor update (now --dump also supports only -D parameter) 2011-04-07 22:38:13 +00:00
Bernardo Damele
bac53eeef1 Allow --dump-all to accept -D switch in order to dump all tables' entries for only one (or more, comma-separated) specified database(s) 2011-04-07 22:08:10 +00:00
Miroslav Stampar
60102209f6 quick fix for a bug reported by Kirill (AttributeError: 'NoneType' object has no attribute 'split') 2011-04-01 11:14:24 +00:00
Miroslav Stampar
b6af80bab3 refactoring, cleanup and improvement 2011-03-29 21:54:15 +00:00
Miroslav Stampar
4312a42b5d another minor fix 2011-03-28 12:04:39 +00:00
Miroslav Stampar
3173adbf6b minor update 2011-03-28 12:02:31 +00:00
Miroslav Stampar
73e5d20ade bulk commit for safe/unsafe identificator naming (done and tested for all 4 major DBMSes) and one bug fix for --search-column on MSSQL (inside queries) 2011-03-28 11:01:55 +00:00
Miroslav Stampar
76b7e3517d minor update 2011-03-27 07:58:15 +00:00
Miroslav Stampar
04c4578df7 minor fix 2011-03-26 05:55:49 +00:00
Miroslav Stampar
58f8703ecd minor update before bedtime 2011-03-25 22:59:18 +00:00
Miroslav Stampar
ae12dee990 minor update 2011-03-25 22:08:54 +00:00
Miroslav Stampar
c9baa0094b going global for protection of non-standard identificator naming 2011-03-25 22:02:28 +00:00
Miroslav Stampar
5a1f733a43 minor update (_ is part of normal identificator naming) 2011-03-25 21:49:20 +00:00
Miroslav Stampar
1a98095a93 minor improvement for that MySQL identification naming 2011-03-25 21:46:49 +00:00
Miroslav Stampar
48c4460e2c bug fixed (there was a huge problem with space containing identifiers - fixed and tested for MySQL) 2011-03-25 21:22:06 +00:00
Miroslav Stampar
af39a441fa minor improvement when --dbs returns no database names (like in many cases with MySQL 4) 2011-03-25 19:50:06 +00:00
Miroslav Stampar
f3858a5fcf another fix related to the bug reported by Alone Shell 2011-03-24 17:08:14 +00:00
Miroslav Stampar
02379c01a2 minor update (will do "schema update" for sybase some other time; that COUNT(*) blew my mind) 2011-03-23 11:42:36 +00:00
Miroslav Stampar
0f7bce5c66 fixing a huge mess going on because of counting on error and union techniques 2011-03-23 11:36:40 +00:00
Miroslav Stampar
7ea45e9032 minor update for Sybase regarding last commit 2011-03-23 11:04:15 +00:00
Miroslav Stampar
b72cdfe9e6 fix for mssql regarding usage of schema names reported by jabra@spl0it.org 2011-03-23 10:40:34 +00:00
Miroslav Stampar
4889764114 minor update regarding last commit 2011-03-21 11:40:27 +00:00
Miroslav Stampar
5291fe35c9 proper implementation of --dbs on Oracle (we are using now schema names as a counterpart to dbs in other DBMSes) 2011-03-21 11:29:43 +00:00
Bernardo Damele
74ef1e53c7 Minor bug fixes to --privileges for PostgreSQL query (corner case) 2011-03-11 14:54:41 +00:00
Miroslav Stampar
eb1cda7065 minor refactoring (more consistent) 2011-03-09 12:06:32 +00:00
Miroslav Stampar
62e3510387 minor refactoring 2011-03-09 11:37:37 +00:00
Miroslav Stampar
68c7247ee4 bug fix (pgsql drop function requires input arguments - at cleanup() in plugins/generic/misc.py it's already fixed before) 2011-03-08 10:46:23 +00:00
Miroslav Stampar
16b286982d fix for a bug reported by nightman (AttributeError: 'list' object has no attribute 'split') 2011-03-07 09:50:43 +00:00
Bernardo Damele
7524a0c0cf Proper error message 2011-03-04 11:59:09 +00:00
Bernardo Damele
60605b6e7c Major bug fix to make --first and --last apply only to --dump's entries dump phase (in either of the blind SQL injection techs only) 2011-02-27 12:14:13 +00:00
Miroslav Stampar
13f0d5ce00 minor bug fix 2011-02-22 14:51:42 +00:00
Miroslav Stampar
640ba5d744 minor refactoring 2011-02-22 14:19:39 +00:00
Bernardo Damele
3e8c204121 Major bug fix to properly prepare UNION technique statement for --os-pwn and --is-dba 2011-02-21 16:00:56 +00:00
Miroslav Stampar
68a95fd1b1 minor update 2011-02-20 22:45:23 +00:00
Miroslav Stampar
aac817935a further improvement of MaxDB support 2011-02-20 22:41:42 +00:00
Miroslav Stampar
a3ba8b6928 --dump now works on MaxDB too 2011-02-20 22:07:12 +00:00
Miroslav Stampar
0e512d3c09 minor update for MaxDB 2011-02-20 21:17:16 +00:00
Miroslav Stampar
59e666d16e --is-dba (related) update for Sybase 2011-02-20 17:28:06 +00:00
Miroslav Stampar
4d52f7fc6e minor fix regarding --dump-table on Sybase for --technique=23 2011-02-20 16:58:01 +00:00
Miroslav Stampar
67ec691eb1 more updates regarding Sybase 2011-02-20 16:28:48 +00:00
Miroslav Stampar
cc47737c44 minor update 2011-02-20 16:00:13 +00:00
Miroslav Stampar
2f9227bcce Sybase update (--passwords) 2011-02-20 12:07:32 +00:00
Miroslav Stampar
f30dea74f3 more Sybase updates 2011-02-19 18:36:26 +00:00
Miroslav Stampar
b71bb321dd some more Sybase updates 2011-02-19 18:04:27 +00:00
Miroslav Stampar
cec7694aac some progress regarding SYBASE 2011-02-19 14:56:58 +00:00
Miroslav Stampar
e0efe453ab minor update regarding Sybase support 2011-02-19 14:07:08 +00:00
Miroslav Stampar
de7ca5a27c minor update 2011-02-19 09:40:41 +00:00
Miroslav Stampar
72fc0a0565 minor refactoring 2011-02-19 09:36:57 +00:00
Miroslav Stampar
5f4ffc9287 update regarding Sybase dumping 2011-02-19 00:36:47 +00:00
Miroslav Stampar
199f14df46 implementation of MySQL GROUP_CONCAT technique 2011-02-15 00:28:27 +00:00
Bernardo Damele
7253362114 Minor bug fix so that --file-write on MySQL via UNION query now works again 2011-02-11 23:35:45 +00:00
Bernardo Damele
c078de894f Added support for --privileges on MSSQL to test wheter or not the DBMS users are DBA 2011-02-10 14:24:04 +00:00
Bernardo Damele
a2c20acf94 Minor fixes once more 2011-02-10 11:34:16 +00:00
Bernardo Damele
d0ddaee3c8 Minor bug fix 2011-02-10 11:28:24 +00:00
Miroslav Stampar
7539881ffa fix for dump on Oracle but we still need to discuss some things around 2011-02-09 14:52:07 +00:00
Miroslav Stampar
caf6220c53 done with implementation for retrieving table names via access system table(s) 2011-02-09 10:50:38 +00:00
Miroslav Stampar
5050a76b59 update regarding reading of table names from access system tables 2011-02-09 10:33:29 +00:00
Bernardo Damele
b48213783a Removed senseless debug messsage 2011-02-08 17:09:35 +00:00
Bernardo Damele
e16bab7117 re-enabled --read-file for MySQL with all techniques 2011-02-08 17:03:57 +00:00
Bernardo Damele
008d434325 Important fix now that the file writing is unescaped too 2011-02-07 00:56:15 +00:00
Bernardo Damele
db77f8b055 Code cleanup 2011-02-06 22:33:08 +00:00
Miroslav Stampar
ecaf5729fd revert 2011-02-06 22:14:18 +00:00
Miroslav Stampar
caaac72029 minor update regarding last commit 2011-02-06 20:15:03 +00:00
Bernardo Damele
8980227d30 Minor bug fix 2011-02-06 15:32:16 +00:00
Bernardo Damele
2afc1e5021 Layout adjustments 2011-02-06 15:28:23 +00:00
Bernardo Damele
a5a648f4fe Correctly handle --read-file and --write-file if neither stacked queries nor union query SQL injection has been detected. 
Support to read files on MySQL via error-based SQL injection technique will come as soon as we fix the MySQL/trim/error-based bug
 2011-02-06 15:23:27 +00:00
Miroslav Stampar
14c87ec80d minor fix 2011-02-04 13:29:02 +00:00
Bernardo Damele
a37f5e05b9 Refactoring 2011-02-01 22:27:36 +00:00
Bernardo Damele
e3a3ae11cc Proper return from error-based technique enumeration 2011-01-31 21:13:29 +00:00
Bernardo Damele
9fc0bedea8 Minor bug fixes 2011-01-30 21:01:57 +00:00
Miroslav Stampar
ddf23ba7cc refactoring 2011-01-30 11:36:03 +00:00
Miroslav Stampar
367d0639f0 refactoring (class names should always be Capital cased) 2011-01-28 16:36:09 +00:00
Miroslav Stampar
50969d238b minor update 2011-01-24 17:51:56 +00:00
Miroslav Stampar
0eea5665b2 minor update 2011-01-24 17:41:36 +00:00
Miroslav Stampar
a3e3387113 fix for proper Firebird resume of version 2011-01-24 11:04:32 +00:00
Miroslav Stampar
eb33612736 fix 2011-01-24 10:20:17 +00:00
Bernardo Damele
77999fb39d Allow in --sql-shell to always ('a') retrieve query output. 
Minor bug fix in case with --columns it is not possible to retrieve a column datatype.
 2011-01-20 21:49:06 +00:00
Bernardo Damele
b1d6040a48 Minor bug fix so that --search also works when the technique is error-based (which always return a list with lists inside) 2011-01-20 21:46:56 +00:00
Bernardo Damele
50c02fbb37 Done with previous refactoring 2011-01-20 00:01:06 +00:00
Bernardo Damele
bade0e3124 Major code refactoring - centralized all kb.dbms* info for both retrieval and set. 2011-01-19 23:06:15 +00:00
Bernardo Damele
daebb0010b Major bug fix to properly process custom queries (--sql-query/--sql-shell) when technique in use is error-based. 
Alignment of SQL statement payload packing/unpacking between all of the techniques.
Minor bug fix to use the proper charset (2, numbers) when dealing with COUNT() in custom queries too.
Minor code cleanup.
 2011-01-18 23:02:11 +00:00
Bernardo Damele
47565f9459 Minor code refactoring 2011-01-17 21:13:59 +00:00
Bernardo Damele
02b333e30b Minor improvement 2011-01-15 23:54:03 +00:00
Miroslav Stampar
1fa8f0cba7 code reviewing part 2 2011-01-15 12:53:40 +00:00
Bernardo Damele
2d9b151883 Minor bug fix 2011-01-15 10:14:05 +00:00
Bernardo Damele
e4e9b11b79 Minor code refactoring and adjustments - kb.dbms is needed in fingerprint.py, not getIdentifiedDBMS because when checkDbms() method is called, it's within the fingerprint phase and at that stage, getIdentifiedDBMS() would always return kb.misc.fpDbms. 2011-01-14 12:47:07 +00:00
Bernardo Damele
3c95d71ea5 Minor bug fix - restored of so called kb.misc.testedDbms (now kb.misc.fpDbms) to force the DBMS (only) during the fingerprint phase 2011-01-14 11:55:20 +00:00
Bernardo Damele
2ac8debea0 Major code refactoring - moved to one location only (getIdentifiedDBMS() in common.py) the retrieval of identified/fingerprinted DBMS. 
Minor bug fixes thanks to previous refactoring too.
 2011-01-13 17:36:54 +00:00
Bernardo Damele
8a67aea754 One more step to fully working UNION exploitation after merge into detection phase 2011-01-12 01:13:32 +00:00