Miroslav Stampar
789dd6c66f
more quick fixes
2010-05-04 08:43:14 +00:00
Miroslav Stampar
af701cdaa2
better way to handle that last commit problem
2010-05-04 08:36:35 +00:00
Miroslav Stampar
5bc07426e0
added exception handler around block reported by Thierry Zoller
2010-05-04 08:03:48 +00:00
Bernardo Damele
90d9900371
Minor bug fix to consider --start and --stop also in partial UNION query SQL injection
2010-04-30 15:48:40 +00:00
Bernardo Damele
4d46f997a7
Minor bug fix
2010-04-29 13:34:03 +00:00
Miroslav Stampar
d8e5585c66
fixed a bug reported by Mosk Dmitri (infoMsg UnboundLocalError)
2010-04-29 08:30:29 +00:00
Bernardo Damele
fa48d26f95
Minor cosmetic fix
2010-04-26 12:34:21 +00:00
Miroslav Stampar
7eef76f1b0
added basic option validation for start/stop values regarding David Guimaraes mail
2010-04-26 11:23:12 +00:00
Bernardo Damele
a1b1f960cc
Finally fixed and adapted all code around to the new isWindowsDriveLetterPath() function
2010-04-23 16:34:20 +00:00
Bernardo Damele
0f80768e66
Reverted
2010-04-22 16:35:22 +00:00
Bernardo Damele
7b070acd17
Reimported needed imports!
2010-04-22 16:13:22 +00:00
Miroslav Stampar
1bcec80e95
fix for that takeover bug Ethan Robish posted (Windows/PHP)
2010-04-22 10:31:33 +00:00
Miroslav Stampar
7d3a200ab8
fix for Bug #183
2010-04-19 15:25:52 +00:00
Bernardo Damele
2840f20605
Minor bug fix
2010-04-17 15:43:08 +00:00
Miroslav Stampar
915d3441e9
some code refactoring
2010-04-16 19:57:00 +00:00
Miroslav Stampar
1bdf94f236
fix for Bug #164 (Proper usage of special characters in paths)
2010-04-16 15:46:31 +00:00
Miroslav Stampar
bece99908c
fix regarding Bug #164 (Proper usage of special characters in paths) - not clear if that's all
2010-04-16 15:12:42 +00:00
Miroslav Stampar
938a3ab0b9
fix for Bug #183 (--threads dot output)
2010-04-16 13:40:02 +00:00
Miroslav Stampar
1aeaa5db47
implementation of Feature #176 (Safe URL: avoid being kicked out after N unsuccessful requests)
2010-04-16 12:44:47 +00:00
Bernardo Damele
a0c8adc266
Minor bug fix to add the "hinted" request to the total number of requests performed
...
Minor layout adjustments.
2010-04-15 10:08:27 +00:00
Bernardo Damele
5e86087cb1
Minor bug fix for -d to avoid resuming queries when they're SELECT on sqlmap own tables, aligned to same resume of -u now.
2010-04-15 10:06:38 +00:00
Miroslav Stampar
17554759b7
implemented feature request from Ole Rasmussen regarding table name retrieval speedup
2010-04-15 09:36:13 +00:00
Bernardo Damele
1ab78ce60e
Added support to directly connect also to SQLite 2 db file
2010-04-13 22:43:38 +00:00
Bernardo Damele
fee062781f
Minor adjustment
2010-04-13 11:13:01 +00:00
Miroslav Stampar
da1ea48947
added some nagging for connection details
2010-04-13 11:00:15 +00:00
Bernardo Damele
eecee3b274
Added resume functionality to -d and fixed logging with -d
2010-04-12 09:35:20 +00:00
Bernardo Damele
b72ddb6f1e
Fixes non-deterministic unsorted results for most of the DBMSes - see #185
2010-04-09 15:48:53 +00:00
Miroslav Stampar
fcceceed45
fix for bug reported by shiftzwei@gmail.com regarding formatDBMSfp with unknown DBMS version
2010-04-09 10:40:08 +00:00
Miroslav Stampar
63c70018ca
fix for that update (conf.cj) problem mentioned by shiftzwei@gmail.com
2010-04-09 10:16:15 +00:00
Bernardo Damele
effc7dc41c
Minor adjustment to notify the user that the --auth-cred format for NTLM authentication is "DOMAIN\user:password"
2010-04-07 09:47:14 +00:00
Bernardo Damele
758a858785
Minor adjustments
2010-04-06 20:40:14 +00:00
Miroslav Stampar
6e7be5edb0
another fix
2010-04-06 15:51:36 +00:00
Miroslav Stampar
3fe9f9cac9
another fix
2010-04-06 15:28:34 +00:00
Miroslav Stampar
a6a2e993cc
minor update
2010-04-06 15:24:56 +00:00
Miroslav Stampar
c303feab17
fix
2010-04-06 15:14:32 +00:00
Miroslav Stampar
e2810003ae
more update
2010-04-06 15:12:52 +00:00
Miroslav Stampar
c24f1cc07c
some update
2010-04-06 14:59:31 +00:00
Miroslav Stampar
60f04f0a41
new module for interruptable threads
2010-04-06 14:33:57 +00:00
Bernardo Damele
2d55ec19a3
Minor code restyling
2010-04-06 10:15:19 +00:00
Miroslav Stampar
e29e8f82f9
fix for "Problem with --dbms set" reported by David Guimaraes
2010-04-05 23:09:35 +00:00
Miroslav Stampar
0a363d3f2b
fix for not properly clearing cookies when in multiple targets scanning mode spotted by Kasper Fons
2010-04-04 14:38:48 +00:00
Miroslav Stampar
4129cb22a7
update regarding bug reported by Ole Rasmussen
2010-04-03 19:41:47 +00:00
Bernardo Damele
cad8f61d55
Force pymssql to version >= 1.0.2
2010-03-31 15:31:11 +00:00
Bernardo Damele
b19de015c5
Minor bugs fixes
2010-03-31 13:52:51 +00:00
Bernardo Damele
5fdebb5d5b
Added support to directly connect also to Microsoft SQL Server database.
...
Fixed direct connection to always use the same query as of UNION query SQL injection (= one query with multiple columns/entries output).
Minor fixes to Firebird/Access/SQLite connectors to use connector's execute()/fetchall() as wrapper for third-party libraries' methods.
Forced conf.timeout to 10 seconds when directly connecting to database.
Slightly improved regular expression to parse -d parameter.
Added import check for all connectors' third-party libraries.
Code refactoring:
* Moved conf.direct request to direct() function in lib/request/direct.py (code reused where needed).
* Back-delegated to generic connector close() and other methods.
2010-03-31 10:50:47 +00:00
Miroslav Stampar
8702cce760
fix
2010-03-30 13:23:20 +00:00
Miroslav Stampar
c2a6f21095
refactoring regarding usage of conf.dbmsConnector.connect()
2010-03-30 13:03:19 +00:00
Miroslav Stampar
a02ec29c15
too
2010-03-30 11:52:45 +00:00
Miroslav Stampar
c9c9c1fb2f
replace only first occurrence
2010-03-30 11:52:01 +00:00
Miroslav Stampar
bfc12e93c5
ms access returns -1 for True
2010-03-30 11:33:51 +00:00
Miroslav Stampar
ae3455a0c2
more update
2010-03-30 11:28:14 +00:00
Miroslav Stampar
738c210075
update
2010-03-30 11:21:26 +00:00
Miroslav Stampar
87d8c6719e
updates, fixes and stuff
2010-03-30 11:06:30 +00:00
Bernardo Damele
a0290a257b
Added support to connect directly also to Oracle - see #158
2010-03-27 21:50:19 +00:00
Bernardo Damele
1416cd0d86
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158 . This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module).
...
Minor layout adjustments.
2010-03-26 23:23:25 +00:00
Miroslav Stampar
4ca1adba2c
update
2010-03-26 21:30:36 +00:00
Miroslav Stampar
1ec5221d82
minor update
2010-03-26 20:51:55 +00:00
Miroslav Stampar
0aa8f7309b
added copyright notice and keywords
2010-03-26 20:23:08 +00:00
Miroslav Stampar
2e05e1c54d
new module for Feature #61
2010-03-26 20:19:18 +00:00
Miroslav Stampar
8bab94de64
added two new functions: isBase64EncodedString and isHexEncodedString for Feature #71
2010-03-26 17:18:02 +00:00
Miroslav Stampar
5a6a01f24c
added socket timeout exception handling regarding that timeout message from Fahad Al Shunaiber
2010-03-26 11:51:23 +00:00
Bernardo Damele
be81c20298
Minor layout adjustment
2010-03-25 16:26:50 +00:00
Bernardo Damele
2aadc5c939
Added support for --roles (for Oracle ROLE_PRIVS). Enhanced Oracle --privileges to fall-back to USER_SYS_PRIVS if DBA_SYS_PRIVS is not accessible (so session user is not DBA) - Fixes ticket #180 .
...
Minor enhancement to Firebird to determine if a DB user is a DBA.
Minor code refactoring.
2010-03-25 15:46:06 +00:00
Bernardo Damele
f4f68218bc
Minor layout adjustment for --threads and --eta output
2010-03-25 11:47:18 +00:00
Bernardo Damele
8e57767c48
Fixes #180 - properly url encode sqlmap payload in POST/Cookie too, like for GET
2010-03-23 10:27:39 +00:00
Bernardo Damele
f9a135e232
Minor bug fix and layout adjustment regarding --threading and standard output
2010-03-22 17:38:19 +00:00
Bernardo Damele
d13ad8b2d7
fixes #181 - proper save/resume information about single entry UNION SQL injection
2010-03-22 15:39:29 +00:00
Bernardo Damele
d00e4a458a
Code cleanup
2010-03-21 00:39:44 +00:00
Bernardo Damele
72f3674844
Minor bug fix
2010-03-18 17:36:58 +00:00
Bernardo Damele
0d559d14df
Initial support for SQLite (90% approx).
...
Initial support for Firebird (30% approx).
Initial support for Access (10% approx).
Shared libraries code/installation scripts ported to 64bit, directory structure adapted.
Minor code adjustments.
2010-03-18 17:20:54 +00:00
Bernardo Damele
d2f86fb0a5
Fixes #172 - also cookies are parsed from burp/webscarab logs (-l) and request file (-r) now
2010-03-16 15:21:42 +00:00
Bernardo Damele
466df89c4a
Fixes #178 and #179 - proper handling of custom redirects
2010-03-16 14:30:57 +00:00
Bernardo Damele
3b3353e05b
Revert last commit
2010-03-16 13:56:36 +00:00
Miroslav Stampar
1dfe558d3d
Fix for Issue #177
2010-03-16 13:11:44 +00:00
Bernardo Damele
323cf2b7f2
Fixes #177 - Don't exit at exception if in "multiple targets" mode (-l or -g)
2010-03-16 12:14:02 +00:00
Bernardo Damele
6d0ea86414
Fixes #59 - proper customizable redirect (302 and 301)
2010-03-15 14:24:43 +00:00
Miroslav Stampar
417f7fae00
Fix for "bug: -g uses wrong session file"
2010-03-15 12:02:04 +00:00
Miroslav Stampar
8af7d6c58b
minor cosmetic update
2010-03-15 11:55:13 +00:00
Miroslav Stampar
a0ec447b7d
fix for Issue #170
2010-03-15 11:33:34 +00:00
Bernardo Damele
7f5bc5e3fe
Increased version to 0.9-dev
2010-03-15 11:04:57 +00:00
Bernardo Damele
5063401130
Minor bug fix, fixes #170
2010-03-15 11:00:14 +00:00
Bernardo Damele
572b6fd920
sqlmap 0.8 stable!
2010-03-15 01:17:27 +00:00
Miroslav Stampar
a6ab42c873
new file with getch() method which we'll use for good samaritan feature
2010-03-13 17:28:23 +00:00
Miroslav Stampar
4c6c91a80b
another --reg-read fix
2010-03-12 23:12:06 +00:00
Bernardo Damele
7d8cc1a482
Get rid of Churrasco (Token kidnapping technique to --priv-esc). Reasons why:
...
1. there's kitrap0d (MS10-015) which is far more reliable, just recently fixed
2. works only to priv esc basically on MSSQL when it runs as NETWORK SERVICE and the machine is not patched against MS09-012 which is "rare" (hopefully) nowadays.
Now sqlmap relies on kitrap0d and incognito to privilege escalate the database process' user privileges to SYSTEM, both via Meterpreter.
Minor layout adjustments.
2010-03-12 22:43:35 +00:00
Miroslav Stampar
6b1ae62753
final fix for reading registry keys (now both parse and non-parse reads work fine)
2010-03-12 22:26:06 +00:00
Miroslav Stampar
0a2fe651ab
some fixes regarding registry reading
2010-03-12 22:09:58 +00:00
Bernardo Damele
25f8a72414
Minor layout adjustment
2010-03-12 14:48:33 +00:00
Miroslav Stampar
17d0b82fee
two dots instead of three
2010-03-12 14:31:14 +00:00
Bernardo Damele
e8d76994ba
Minor bug fix to avoid resuming data filled into the sqlmap support tables
2010-03-12 14:30:21 +00:00
Miroslav Stampar
15c638ac52
some beautification
2010-03-12 13:07:07 +00:00
Miroslav Stampar
7ec04281dd
minor adjustments
2010-03-12 12:46:26 +00:00
Miroslav Stampar
fffda32f76
fix for Bug #167
2010-03-12 12:38:19 +00:00
Bernardo Damele
f6adb431e6
Minor layout adjustment and typo fix
2010-03-12 12:23:05 +00:00
Bernardo Damele
b50a2288f4
Minor layout adjustments
2010-03-11 23:54:07 +00:00
Miroslav Stampar
ec43419ad1
minor makeup fix
2010-03-11 11:20:52 +00:00
Miroslav Stampar
2c053d5cfb
fix for Bug #166 (Keyboard interrupt in Python threading)
2010-03-11 11:14:20 +00:00
Bernardo Damele
fdf417f57e
Minor adjustment and bug fix
2010-03-10 22:08:11 +00:00
Miroslav Stampar
91dd609e26
fixed threading bug (difflib :)
2010-03-10 14:14:27 +00:00
Bernardo Damele
cc611c0010
Minor layout adjustments
2010-03-09 22:14:26 +00:00
