240 Commits

Author	SHA1	Message	Date
Miroslav Stampar	0eabca9fd4	update for a previous update (putting conf.dataEncoding in getUnicode wherever we know that data won't be 'touched' or 'used' in anyway related to the current web page - if not sure, just leave it as it is)	2011-01-03 22:31:29 +00:00
Miroslav Stampar	08ccbf2c1e	important fix for a bug reported by x <deep_freeze@mail.ru> (along with normal fixes, getUnicode now uses kb.pageEncoding)	2011-01-03 22:02:58 +00:00
Miroslav Stampar	da138c46c1	added support for displaying HTTP error codes (particularly interesting ones are 403 and 406 which screw up data retrieval and DBMS fingerprinting badly)	2011-01-02 07:37:47 +00:00
Miroslav Stampar	212035e64d	user can now choose if he wants to skip non-heuristic based DBMS tests	2011-01-01 23:38:11 +00:00
Miroslav Stampar	9fb0e0fc85	resume of brute forced data is now available	2010-12-27 14:17:20 +00:00
Miroslav Stampar	51a492e17d	pretty important commit (now dumped tables are prone to dictionary attack)	2010-12-27 10:56:28 +00:00
Miroslav Stampar	269d6bde24	this one is pretty complicated (authentication handler tries to call keep alive module, while keep alive module tries to call authentication handler, leading to an infinite recursion)	2010-12-27 00:14:29 +00:00
Miroslav Stampar	562a6440d1	fix for a bug reported by nightman (same as http://bugs.python.org/issue8797)	2010-12-26 09:33:04 +00:00
Miroslav Stampar	2c23a59ba5	fix for one of those more complex bugs (comparison was returning None while original page and/or page template were already had already DBMS error inside)	2010-12-24 12:13:48 +00:00
Miroslav Stampar	aab14fa2d3	minor refactoring/cosmetics	2010-12-24 11:06:57 +00:00
Miroslav Stampar	d9f08e4aa3	randomization of user agents	2010-12-24 10:04:27 +00:00
Miroslav Stampar	017ea9e686	update	2010-12-23 14:06:22 +00:00
Miroslav Stampar	73f33c1999	bug fix of re-introduced bug (in multiple target mode sites with similar URI weren't skipped)	2010-12-23 11:28:13 +00:00
Miroslav Stampar	d974a966b8	minor fix for end phase (Ctrl+C)	2010-12-21 23:55:55 +00:00
Miroslav Stampar	fb75d0636b	minor update	2010-12-21 23:42:59 +00:00
Miroslav Stampar	385e208f38	code refactoring regarding standard output suppression and some threading issues	2010-12-21 14:21:24 +00:00
Miroslav Stampar	8fd3e7ba1f	thread based data added	2010-12-20 22:45:01 +00:00
Miroslav Stampar	5852bad963	some refactoring	2010-12-20 18:56:06 +00:00
Miroslav Stampar	19d8733e9a	this is strictly for educational purposes	2010-12-20 17:30:47 +00:00
Miroslav Stampar	13d5b2c0ff	code refactoring	2010-12-20 09:44:21 +00:00
Miroslav Stampar	36862e2efa	update	2010-12-18 15:57:47 +00:00
Miroslav Stampar	e355f92f22	bug fix	2010-12-18 10:02:01 +00:00
Miroslav Stampar	fe67d3827c	code refactoring and some fixes	2010-12-18 09:51:34 +00:00
Miroslav Stampar	a19cb2c13a	code refactoring (added UNKNOWN_DBMS_VERSION instead of "Unknown")	2010-12-17 21:29:09 +00:00
Miroslav Stampar	de54219571	code refactoring	2010-12-15 12:50:56 +00:00
Miroslav Stampar	c1c525aaea	quick fix of a fix	2010-12-15 12:10:33 +00:00
Miroslav Stampar	7cfeb5447b	minor update	2010-12-15 11:46:28 +00:00
Miroslav Stampar	4dec24d056	quick fix for a bug reported by Andreas Constantinides (KeyError: 5)	2010-12-15 11:30:29 +00:00
Miroslav Stampar	c3d0295d21	minor update (checking for --time-sec value)	2010-12-14 12:37:21 +00:00
Miroslav Stampar	b75d7fa348	minor cache based optimization	2010-12-14 12:22:17 +00:00
Bernardo Damele	4b79227b5a	Minor bug fix to properly merge options from .conf file (-c) with command line switches	2010-12-13 21:36:23 +00:00
Bernardo Damele	5fb04515d3	Added hidden (for the moment) switch --technique	2010-12-09 13:47:17 +00:00
Miroslav Stampar	293ce18fed	two major bug fixes regarding time calculation (previously comparison was also a part of "delta", which screwed results in cases with large pages; other was a standard distribution based one)	2010-12-07 23:32:33 +00:00
Miroslav Stampar	dc651d59ec	little mathematics here and there (used "Rules for normally distributed data")	2010-12-07 19:19:12 +00:00
Miroslav Stampar	ecd4a5a532	added standard deviation check in time based tests	2010-12-07 16:39:31 +00:00
Miroslav Stampar	294119d2ec	more advanced time technique(s)	2010-12-07 16:04:53 +00:00
Miroslav Stampar	add6235b16	removed pageTemplate from injection(s), it's not longer stored in session, and it's reloaded when resuming from session	2010-12-07 14:06:54 +00:00
Miroslav Stampar	0dc630203f	code refactoring	2010-12-07 13:34:06 +00:00
Bernardo Damele	8e78057ac8	Added counter of total HTTP(s) requests done during detection phase	2010-12-07 12:33:47 +00:00
Miroslav Stampar	d77ddbee47	OR based inference works for the first time in history and fingerprint of 4 major DBMSes is now injection based (instead of AND)	2010-12-06 18:20:57 +00:00
Bernardo Damele	17449754fe	Got rid of UNION false cond	2010-12-05 16:16:15 +00:00
Miroslav Stampar	9e5f933ace	some updates	2010-12-04 15:47:02 +00:00
Miroslav Stampar	1f795622b3	some fine tuning of dynamicity removing engine	2010-12-04 13:39:35 +00:00
Miroslav Stampar	04714374f9	now you can use kb.pageTemplate to set a page which will be used as a template in comparison process (at least in '-[RANDNUM] OR' cases we'll need to use different template(s))	2010-12-04 10:05:18 +00:00
Bernardo Damele	5d37df6104	Ugly code to set the cookies when got them from a 302 redirect too	2010-12-03 17:41:10 +00:00
Miroslav Stampar	612ee08a0b	added response time kb attribute	2010-12-03 13:19:34 +00:00
Bernardo Damele	22de82634a	Important update to parse correctly the <where> tag during exploitation phase. ... Minor code cleanup.	2010-12-03 10:44:16 +00:00
Bernardo Damele	09b265a1ea	Got rid of conf.logic for the moment, haven't decided yet what to do with parenthesis check	2010-12-01 23:32:02 +00:00
Bernardo Damele	8b9706656e	Got rid of unreliable 'ORDER BY' technique to detect UNION query SQL injection, consequently switch --union-tech has gone now. ... Minor code refactoring too.	2010-11-29 17:18:38 +00:00
Miroslav Stampar	e735f2960a	minor update	2010-11-29 15:25:45 +00:00