sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-26 19:43:48 +03:00
Code Issues Packages Projects Releases Wiki Activity
4,010 Commits 4 Branches 117 Tags 97 MiB
738073105e
Commit Graph

2857 Commits

Author SHA1 Message Date
Miroslav Stampar
5469186540 minor comment update 2012-03-29 14:35:47 +00:00
Miroslav Stampar
637a8d8273 improvement toward proper implementation of OR-based injection by usage of "negative logic" mechanism 2012-03-29 14:33:27 +00:00
Miroslav Stampar
ce4c697bbd disabling "negative logic" as it's not half done (it was "luckily" working for --string/--regex/--code but it was a sheer luck); removing "dirty fix" from checks.py; proof that this was not ready for the release is that there was not check for negative logic anywhere for anything more then --string/--regex/--code 2012-03-29 13:39:12 +00:00
Miroslav Stampar
772ead8d03 fixed support for error-based injection on MySQL 4.1 (help table a needs more than 2 items inside); also, fixed some border issues with reflective values 2012-03-29 12:44:20 +00:00
Miroslav Stampar
c9cac957bb adding one more case for false positive check (Generic tests without any DBMS knowledge) 2012-03-29 09:56:09 +00:00
Miroslav Stampar
60146481af bug fix(es) (flags were used in place of count parameter in re.sub() calls) 2012-03-28 19:33:00 +00:00
Miroslav Stampar
9433bbe26d memory optimization for reflective removal mechanism (there was no need for \n\r in the first place as there was no re.S flag used - also, one re.sub "flags <-> count" bug fixed) 2012-03-28 19:27:12 +00:00
Miroslav Stampar
7d131d1fb1 minor update 2012-03-28 13:46:31 +00:00
Miroslav Stampar
7fd64df167 minor code cleaning 2012-03-28 13:31:07 +00:00
Miroslav Stampar
769b0d0ae7 more minor updates regarding data retrieval through DNS channel 2012-03-27 19:29:24 +00:00
Miroslav Stampar
1b072f6415 laying foundation for DNS based data retrieval 2012-03-27 18:59:12 +00:00
Miroslav Stampar
3abcd6910a strange combination of "Set-Cookie" and interleaved pattern of True/False like responses can result in bypassing of the ABAB test 2012-03-22 00:06:50 +00:00
Miroslav Stampar
e88687b1f0 revert of last commit (it would be faster for sure, but not sure if it's clever to do it by default regarding SQLi detection) 2012-03-21 23:15:59 +00:00
Miroslav Stampar
524c1d38ad making default redirect choice to NO (making fewer requests by default and in lots of cases clearer pages for comparison - original page vs redirect message) 2012-03-21 23:03:57 +00:00
Miroslav Stampar
11132ba993 fix for a bug in reflection removal mechanism 2012-03-19 14:28:18 +00:00
Miroslav Stampar
8e7d360ea2 cleaner refactoring regarding last commit 2012-03-19 12:03:25 +00:00
Miroslav Stampar
401763b6f8 minor fix (it has to be level 1 array like it was with the previous re.findall mechanism) 2012-03-19 12:00:22 +00:00
Miroslav Stampar
037db9b3b8 minor removal of older stuff 2012-03-19 09:38:27 +00:00
Miroslav Stampar
da7f4eeffd removing left over 2012-03-18 17:33:14 +00:00
Miroslav Stampar
0fc4288a7c modifying redirection code for only two choices 2012-03-18 17:27:08 +00:00
Bernardo Damele
c03d0e24fb it must stay as is 2012-03-16 17:42:00 +00:00
Bernardo Damele
3505503a08 no need to return here 2012-03-16 17:30:16 +00:00
Bernardo Damele
942d9e4fa8 code cleanup 2012-03-16 17:27:24 +00:00
Bernardo Damele
a1c943fc79 Major bug fix to comparison algorithm with OR based boolean-based injections 2012-03-16 17:22:55 +00:00
Miroslav Stampar
d66056fe39 one more related commit 2012-03-16 13:16:53 +00:00
Miroslav Stampar
ac02a2d92c minor fix 2012-03-16 13:14:14 +00:00
Miroslav Stampar
cbdcbdd786 minor minor update 2012-03-16 11:18:18 +00:00
Miroslav Stampar
b130a9e14e minor fix (writing to HashDB on any interrupt) 2012-03-16 10:15:43 +00:00
Miroslav Stampar
577caac4de putting kb.negativeLogic setting to the safe place 2012-03-16 09:17:11 +00:00
Miroslav Stampar
209e795369 minor just in case update 2012-03-16 09:02:17 +00:00
Miroslav Stampar
adb5fff6b2 one more update related to the redirection mechanism 2012-03-15 20:17:40 +00:00
Miroslav Stampar
7d313ac911 few more fixes for proper redirecting mechanism 2012-03-15 19:47:59 +00:00
Bernardo Damele
86c4650058 Minor bug fix - revert 2012-03-15 17:12:24 +00:00
Bernardo Damele
cc15373769 More explicit function name also getRatioValue parameter has nothing to do with comparison at this stage as far as I can see (that might have fixed another "bug", to be checked later) 2012-03-15 16:29:28 +00:00
Bernardo Damele
4520744b4d second step toward negative logic support (ported to detection phase too) - works well with --string, --regexp and --code now 2012-03-15 16:25:26 +00:00
Miroslav Stampar
ddd92476a8 minor fix 2012-03-15 15:58:25 +00:00
Miroslav Stampar
19beb912fa first step toward negative logic support 2012-03-15 15:52:12 +00:00
Miroslav Stampar
8dd570057b minor fix (double traffic log for -t in case of HTTP error) 2012-03-15 14:51:16 +00:00
Miroslav Stampar
f7df755f37 minor update 2012-03-15 12:55:22 +00:00
Miroslav Stampar
3d39c6cb3b some fixes here and there 2012-03-15 12:14:50 +00:00
Miroslav Stampar
3d9b1599d1 minor update 2012-03-15 11:45:32 +00:00
Miroslav Stampar
91f1d6141f minor fix 2012-03-15 11:24:55 +00:00
Miroslav Stampar
a8c9a47092 redirect logic rewritten from scratch 2012-03-15 11:10:58 +00:00
Bernardo Damele
890bf708bc Minor fixes to make --os-* switch work again against MySQL/Windows/ASP.NET (where stacked queries are supported) 2012-03-15 00:19:57 +00:00
Bernardo Damele
1e71b24dca More info messages to prove xp_cmdshell (and temporary directory choosen) worked 2012-03-14 22:41:53 +00:00
Miroslav Stampar
52a8b25ff4 minor fix 2012-03-14 14:31:41 +00:00
Miroslav Stampar
ca0d068575 distinguishing NULL from BLANK 2012-03-14 13:52:23 +00:00
Miroslav Stampar
e38b59a2ae minor update 2012-03-14 13:16:49 +00:00
Miroslav Stampar
cee9ff7885 proper parsing of content in partial union technique 2012-03-14 11:23:30 +00:00
Miroslav Stampar
61ad3b999a fix for a crash with partial union and --hex 2012-03-14 10:31:24 +00:00
Miroslav Stampar
a7fbc55748 grammar fix 2012-03-13 22:03:23 +00:00
Miroslav Stampar
edfcddd3c3 minor fix for logging only cookies used by request (e.g. --load-cookies case) 2012-03-13 10:58:15 +00:00
Miroslav Stampar
34b0935cb3 refactoring "echo 1" quick test for xp_cmdshell console output 2012-03-13 10:36:49 +00:00
Miroslav Stampar
e827f41cdb using pickle HIGHEST_PROTOCOL just in case 2012-03-13 09:35:37 +00:00
Miroslav Stampar
e6c610abab minor fix 2012-03-13 09:14:56 +00:00
Miroslav Stampar
cda8815634 introducing safe deprecation mechanism for HashDB versioning 2012-03-12 22:55:57 +00:00
Miroslav Stampar
48bcde478e more general update 2012-03-12 15:29:55 +00:00
Miroslav Stampar
1d0c8a7f44 minor update 2012-03-12 15:19:02 +00:00
Miroslav Stampar
6ed1b04bbe minor update 2012-03-12 13:27:07 +00:00
Miroslav Stampar
c878dd3e5a doing a dummy test for --os-shell in case of xp_cmdshell 2012-03-09 14:21:41 +00:00
Miroslav Stampar
a0b46963cb minor fix for some special "unusable" cases (seen on Access/ODBC/Linux setup) 2012-03-09 10:28:19 +00:00
Miroslav Stampar
5a83f1c5f7 minor update 2012-03-08 15:43:22 +00:00
Bernardo Damele
c79807f5fb Minor layout adjustments 2012-03-08 15:11:24 +00:00
Miroslav Stampar
775e424bf2 bug fix for using --no-cast and --hex switches together 2012-03-08 15:04:52 +00:00
Miroslav Stampar
11c7cc5224 minor temporary fix 2012-03-08 11:08:43 +00:00
Miroslav Stampar
98a3e43f53 bug fix for writing raw pickled data into SQLite HashDB 2012-03-08 10:57:47 +00:00
Miroslav Stampar
cd28eb6544 minor update regarding --load-cookies 2012-03-08 10:19:34 +00:00
Miroslav Stampar
2c87d061e9 minor update 2012-03-08 10:03:59 +00:00
Miroslav Stampar
9ca8bc4d51 minor bug fix 2012-03-08 09:52:33 +00:00
Miroslav Stampar
b4cf8b05b3 added switch --load-cookies 2012-03-07 14:48:45 +00:00
Miroslav Stampar
4cfea96471 minor update 2012-03-05 09:56:48 +00:00
Miroslav Stampar
0ead1fd87e minor update 2012-03-05 09:42:52 +00:00
Miroslav Stampar
ac5a752b12 Oracle's XMLType doesn't like '#' char too 2012-03-01 11:59:37 +00:00
Miroslav Stampar
f4e410db16 minor fix 2012-03-01 10:17:39 +00:00
Miroslav Stampar
1ec56f93ec minor update 2012-03-01 10:10:19 +00:00
Miroslav Stampar
2d3c12d2d0 shorter single line info 2012-03-01 09:10:24 +00:00
Miroslav Stampar
37db27b720 turning back on automatic adjusting of delays in time based queries 2012-02-29 15:51:23 +00:00
Miroslav Stampar
0205d96d7b minor fix 2012-02-29 15:38:01 +00:00
Miroslav Stampar
1bdc07c279 minor update 2012-02-29 15:02:24 +00:00
Miroslav Stampar
8b9c5c66cc code refactoring regarding charsetType inside inference/bisection 2012-02-29 14:36:23 +00:00
Miroslav Stampar
f6f98f1b41 minor improvement 2012-02-29 14:19:59 +00:00
Miroslav Stampar
d06182347f fixing few potential problems 2012-02-29 13:56:40 +00:00
Miroslav Stampar
f142c0f782 minor update 2012-02-28 14:04:13 +00:00
Miroslav Stampar
22b3fa0749 minor update 2012-02-27 15:28:36 +00:00
Miroslav Stampar
a9bf0297f6 moving injection data to HashDB 2012-02-27 13:44:07 +00:00
Miroslav Stampar
68e08d2749 minor fix for not displaying 'None' but None in enumeration when data unavailable 2012-02-27 13:15:10 +00:00
Miroslav Stampar
a424de3102 minor fix 2012-02-27 12:55:28 +00:00
Miroslav Stampar
1e82405bb9 HashDB is now supported in -d too 2012-02-27 12:14:01 +00:00
Miroslav Stampar
3909658fc2 few minor just in case updates 2012-02-27 11:15:53 +00:00
Miroslav Stampar
85125018a1 minor bug fix 2012-02-25 22:54:32 +00:00
Miroslav Stampar
5d307cf886 minor update 2012-02-25 10:54:39 +00:00
Miroslav Stampar
06ab3fa134 minor update 2012-02-25 10:53:38 +00:00
Miroslav Stampar
74b19a0386 minor update 2012-02-25 10:43:10 +00:00
Miroslav Stampar
5b67af3b20 minor update 2012-02-24 15:03:39 +00:00
Miroslav Stampar
8a203ef79d making session data strictly dependent on url through HashDB helper functions 2012-02-24 14:58:24 +00:00
Miroslav Stampar
c36cbbb3ae minor fix 2012-02-24 14:54:10 +00:00
Miroslav Stampar
9d6fd2e507 bug fix for --schema --technique=BST 2012-02-24 14:12:19 +00:00
Miroslav Stampar
f94b91ad87 added helper function for HashDB data storing/retrieval 2012-02-24 13:07:20 +00:00
Miroslav Stampar
b481c0352f minor update 2012-02-24 11:25:56 +00:00
Miroslav Stampar
1f6ce265b9 minor fix 2012-02-24 11:05:04 +00:00
Miroslav Stampar
5afbd52b61 more update related to last commits 2012-02-24 10:57:23 +00:00
Miroslav Stampar
570d3a19c2 more general fix 2012-02-24 10:53:28 +00:00
Miroslav Stampar
e8352e504f fixing problems with chars deletition by logging messages in inference mode 2012-02-24 10:48:19 +00:00
Miroslav Stampar
71028a81f5 fix for proper retrieval of columns in SQLite 2012-02-24 09:55:13 +00:00
Miroslav Stampar
7941504c3a minor update 2012-02-23 15:32:36 +00:00
Miroslav Stampar
0478e4166a minor justin case fix 2012-02-23 15:19:20 +00:00
Miroslav Stampar
086c3a3662 minor fix 2012-02-23 13:31:50 +00:00
Miroslav Stampar
6e54cb171f minor code restyling 2012-02-22 15:53:36 +00:00
Miroslav Stampar
61a25418a9 minor update 2012-02-22 10:45:10 +00:00
Miroslav Stampar
b3bd4144f5 removing of unused imports together with some general code refactoring 2012-02-22 10:40:11 +00:00
Miroslav Stampar
386e98a0e3 using UNION SELECT for where=..NEGATIVE 2012-02-22 09:41:58 +00:00
Miroslav Stampar
c9d570c83b minor update 2012-02-21 13:49:30 +00:00
Miroslav Stampar
686eacda9a minor update regarding --hex 2012-02-21 13:38:18 +00:00
Miroslav Stampar
bcf3255fe1 implementation of switch --hex for 4 major DBMSes 2012-02-21 11:44:48 +00:00
Miroslav Stampar
3e4db6d140 minor fix for Python v2.6 2012-02-20 19:35:57 +00:00
Miroslav Stampar
bc4dd7c0dd fix for -g 2012-02-20 10:02:19 +00:00
Bernardo Damele
121148f27f There was no point relying on a support table (sqlmapoutput) to get the stdout of executed OS commands when using direct connection (-d) and it saves also number of requests. 
Also, BULK INSERT apparently does not work on MSSQL when running as Network Service (at least on Windows XP) so one more reason to avoid using support table.
Minor fix also to threat MSSQL's EXEC statements as SELECT ones
 2012-02-17 15:54:49 +00:00
Miroslav Stampar
aee269cc14 gazillion changes, nothing will work, muhahaha 2012-02-17 14:22:48 +00:00
Miroslav Stampar
dcf7277a0f some more refactorings 2012-02-16 14:42:28 +00:00
Miroslav Stampar
6632aa7308 some more refactoring 2012-02-16 13:46:01 +00:00
Miroslav Stampar
844fc8addb minor cleanup 2012-02-16 10:19:36 +00:00
Miroslav Stampar
0e23521adc some more refactoring 2012-02-16 09:54:29 +00:00
Miroslav Stampar
e1f86c97c4 minor refactoring 2012-02-16 09:46:41 +00:00
Miroslav Stampar
bcf9fc6c6f minor refactoring 2012-02-16 09:32:47 +00:00
Miroslav Stampar
8d7912ad34 minor update and refactoring 2012-02-15 14:05:50 +00:00
Miroslav Stampar
bf923a97df minor update 2012-02-15 13:45:10 +00:00
Miroslav Stampar
122db6e164 minor update 2012-02-15 13:24:02 +00:00
Miroslav Stampar
9059d30312 adding first code example for SPL snippets 2012-02-15 13:17:01 +00:00
Miroslav Stampar
edeb4b6113 bug fix for --os-shell on Windows (echo ... > requires double quotes if the piped filename contains whitespace, otherwise doesn't hurt) 2012-02-15 11:14:01 +00:00
Miroslav Stampar
35fa214a1e minor update (it was working before too, but this is cleaner) 2012-02-15 10:14:29 +00:00
Bernardo Damele
1c44d6d3c7 Fixed annoying bug that prevented proper checkBooleanExpression() function to work with direct connection (-d). Now DBMS fingerprint should work properly with -d 2012-02-14 17:29:00 +00:00
Miroslav Stampar
23cc8b6974 minor fix for special cases when parameter value contains html encoded characters 2012-02-14 14:08:10 +00:00
Miroslav Stampar
c1ab02494c minor grammar and cosmetics 2012-02-14 13:18:37 +00:00
Miroslav Stampar
bb5113980b minor update 2012-02-14 10:27:56 +00:00
Miroslav Stampar
3f15c52188 minor change in workflow for "tainted" parameter values 2012-02-14 09:26:52 +00:00
Miroslav Stampar
2604e73d88 minor change in workflow 2012-02-13 11:18:47 +00:00
Miroslav Stampar
96f589fc89 minor fix 2012-02-12 19:22:33 +00:00
Miroslav Stampar
8a2bd3897d minor output fix 2012-02-12 19:11:54 +00:00
Miroslav Stampar
c1368053e5 minor fix 2012-02-12 18:46:25 +00:00
Miroslav Stampar
249cb48b0b minor fix 2012-02-10 15:59:11 +00:00
Miroslav Stampar
6be95194a7 matter of concision 2012-02-10 15:37:43 +00:00
Miroslav Stampar
eab7a54e03 cosmetics 2012-02-10 15:34:04 +00:00
Miroslav Stampar
92590d0d59 minor fix 2012-02-10 15:26:55 +00:00
Miroslav Stampar
e36e9de57e minor update by request 2012-02-10 15:12:23 +00:00
Miroslav Stampar
b140ef4a14 minor update (preparing for switching to HashDB from old sessionFile) 2012-02-10 10:24:48 +00:00
Miroslav Stampar
980367b7b2 minor update 2012-02-09 09:48:47 +00:00
Miroslav Stampar
7e9e582eca minor update 2012-02-08 14:23:57 +00:00
Miroslav Stampar
2662fe84f7 minor update 2012-02-08 12:02:50 +00:00
Miroslav Stampar
85a4ef6593 minor update 2012-02-08 12:00:03 +00:00
Miroslav Stampar
93d7d6c355 minor patch 2012-02-08 10:38:58 +00:00
Miroslav Stampar
6bedb80ffa adding --force-ssl switch (most useful in combination with -r) 2012-02-08 09:11:57 +00:00
Miroslav Stampar
e50d64546f minor fix 2012-02-07 14:57:48 +00:00
Miroslav Stampar
2b05ded9c3 just a makeup 2012-02-07 12:05:23 +00:00
Miroslav Stampar
b4f4a982e4 minor update 2012-02-07 11:37:54 +00:00
Miroslav Stampar
11af0b1bbc minor fix 2012-02-07 11:16:03 +00:00
Miroslav Stampar
f7bf1fbe94 upgrade/fixes for direct DBMS access 2012-02-07 10:46:55 +00:00
Miroslav Stampar
af71e3c563 minor update 2012-02-06 09:48:44 +00:00
Miroslav Stampar
8c45ff0d57 bug fix 2012-02-03 10:38:04 +00:00
Bernardo Damele
c0f4b4632d Minor fix 2012-02-02 12:55:39 +00:00
Miroslav Stampar
a7970d094a minor update 2012-02-01 15:10:06 +00:00
Miroslav Stampar
e56309f3b1 minor makeup update 2012-02-01 15:04:56 +00:00
Miroslav Stampar
8405ef59ac some estetic updates 2012-02-01 14:49:42 +00:00
Miroslav Stampar
f4e7bf1d51 minor update regarding support for Unicode characters in Oracle 2012-02-01 14:17:27 +00:00
Miroslav Stampar
df43157284 minor patch 2012-02-01 12:28:06 +00:00
Miroslav Stampar
2ee198a381 minor "patch" 2012-02-01 11:00:01 +00:00
Miroslav Stampar
2589521ecf fix of a wrong assumption (e.g. decodeIntToUnicode(12345) has been returning a "09" instead of a single unicode character) 2012-02-01 10:38:43 +00:00
Miroslav Stampar
4d9dcbf5db minor fix 2012-02-01 10:14:23 +00:00
Miroslav Stampar
46f42f2fe4 minor fix 2012-01-30 13:10:35 +00:00
Miroslav Stampar
f2857e38ba minor update 2012-01-30 10:19:03 +00:00
Miroslav Stampar
594579bef4 fix for a bug regarding --cookie and --crawl 2012-01-30 09:17:22 +00:00
Miroslav Stampar
2094c715db minor update 2012-01-23 09:44:17 +00:00
Miroslav Stampar
9e5cf70a5a minor fix 2012-01-20 11:13:25 +00:00
Miroslav Stampar
9eee6c252d minor update for --scope 2012-01-16 10:28:21 +00:00
Miroslav Stampar
527ce070a3 minor fix 2012-01-16 10:04:18 +00:00
Miroslav Stampar
b2dad63000 some more refactoring 2012-01-13 22:00:34 +00:00
Miroslav Stampar
e5fe029a78 minor beautification 2012-01-13 21:03:50 +00:00
Miroslav Stampar
6634c4ac20 minor update 2012-01-13 21:01:58 +00:00
Miroslav Stampar
23117e72ca minor improvement 2012-01-13 20:56:06 +00:00
Bernardo Damele
0043336620 Minor fix and removed leftover debug message 2012-01-13 17:04:59 +00:00
Bernardo Damele
e59ace5409 minor bug fix 2012-01-13 16:57:45 +00:00
Bernardo Damele
b03f91437b Minor code refactoring 2012-01-13 16:49:52 +00:00
Miroslav Stampar
337973df77 reverting last 2 commits (better solution was the original one) 2012-01-13 15:58:47 +00:00
Miroslav Stampar
1f53ff0633 minor update regarding last commit 2012-01-13 15:56:50 +00:00
Miroslav Stampar
ff96c537a9 minor update for multithreaded mode 2012-01-13 15:50:38 +00:00
Bernardo Damele
7e560eec1f Minor fix 2012-01-13 12:54:45 +00:00
Miroslav Stampar
dd295bbd4a minor update regarding -d and time based injections 2012-01-13 12:45:02 +00:00
Miroslav Stampar
04686b83e3 minor update 2012-01-13 11:16:26 +00:00
Miroslav Stampar
305371b7a9 minor update 2012-01-12 14:58:23 +00:00
Miroslav Stampar
95f89ab63a updating copyright date 2012-01-11 14:59:46 +00:00
Miroslav Stampar
1d0b43b1a2 implemented mechanism for merging cookies by request 2012-01-11 14:28:08 +00:00
Miroslav Stampar
ff52931140 some refactoring (skipping duplicate messages in case that UNION/ERROR techniques failed and BOOLEAN/TIMED/STACKED are not available) 2012-01-07 19:30:35 +00:00
Miroslav Stampar
18930539cd more concise language 2012-01-07 17:45:45 +00:00
Miroslav Stampar
2b5e429dc2 one more level of defense against user himself 2012-01-07 17:16:14 +00:00
Miroslav Stampar
a675c88894 minor check added for invalid urls (e.g. deliberately too long) 2012-01-07 16:06:18 +00:00
Miroslav Stampar
164c8a4020 better message in case of update error 2012-01-07 15:47:38 +00:00
Miroslav Stampar
5a8fc44119 minor update 2012-01-07 15:26:54 +00:00
Miroslav Stampar
3f4afdf251 minor fix (crashing if no : in value) 2012-01-07 14:54:56 +00:00
Miroslav Stampar
759465bde5 minor fix 2012-01-06 00:06:38 +00:00
Miroslav Stampar
40398f358c minor update 2012-01-05 14:55:23 +00:00
Miroslav Stampar
1f085a0241 now [SLEEPTIME] is changeable properly in vivo 2012-01-05 14:45:05 +00:00