1054 Commits

Author	SHA1	Message	Date
Miroslav Stampar	b5e45939e3	sqlmap premiere of blind time based query/bisection	2010-12-08 12:28:54 +00:00
Miroslav Stampar	47bb31fb47	code refactoring	2010-12-08 11:30:25 +00:00
Miroslav Stampar	1ae2fa7f1a	update regarding time based payloads	2010-12-08 11:26:54 +00:00
Miroslav Stampar	bdff4aba6a	switching to quick_ratio	2010-12-07 23:57:43 +00:00
Miroslav Stampar	c1b82cf09c	ratio() gives a considerable lag on real life cases, as real_quick_ratio() gives almost as good results	2010-12-07 23:53:44 +00:00
Miroslav Stampar	a4a63f5b1e	minor update	2010-12-07 23:49:00 +00:00
Miroslav Stampar	293ce18fed	two major bug fixes regarding time calculation (previously comparison was also a part of "delta", which screwed results in cases with large pages; other was a standard distribution based one)	2010-12-07 23:32:33 +00:00
Miroslav Stampar	b21eb88905	minor update	2010-12-07 22:45:38 +00:00
Miroslav Stampar	575e50673b	minor update	2010-12-07 19:27:01 +00:00
Miroslav Stampar	398b82644a	little explanation	2010-12-07 19:25:26 +00:00
Miroslav Stampar	dc651d59ec	little mathematics here and there (used "Rules for normally distributed data")	2010-12-07 19:19:12 +00:00
Bernardo Damele	ee72838231	Removed debug print	2010-12-07 17:19:29 +00:00
Bernardo Damele	5f97312f29	Minor fix	2010-12-07 17:17:38 +00:00
Bernardo Damele	81e7465ed2	Cosmetics	2010-12-07 17:16:21 +00:00
Miroslav Stampar	ecd4a5a532	added standard deviation check in time based tests	2010-12-07 16:39:31 +00:00
Miroslav Stampar	294119d2ec	more advanced time technique(s)	2010-12-07 16:04:53 +00:00
Miroslav Stampar	4959da3ce6	it's a must to double check time based payloads	2010-12-07 14:59:11 +00:00
Miroslav Stampar	e53fef546e	update regarding session page templates	2010-12-07 14:35:31 +00:00
Miroslav Stampar	add6235b16	removed pageTemplate from injection(s), it's not longer stored in session, and it's reloaded when resuming from session	2010-12-07 14:06:54 +00:00
Miroslav Stampar	0dc630203f	code refactoring	2010-12-07 13:34:06 +00:00
Bernardo Damele	8e78057ac8	Added counter of total HTTP(s) requests done during detection phase	2010-12-07 12:33:47 +00:00
Bernardo Damele	effd2ca0e3	Cosmetics	2010-12-07 12:32:58 +00:00
Miroslav Stampar	2af8835a94	fix for a bug reported by ToR (origValue = paramDict[kb.injection.parameter] -> KeyError in resume with missing injection parameter)	2010-12-07 10:57:32 +00:00
Miroslav Stampar	3d87489de5	minor update	2010-12-07 08:05:03 +00:00
Miroslav Stampar	0da1ebde7d	introducing PostgreSQL time based blind	2010-12-07 00:51:14 +00:00
Miroslav Stampar	61f82fd274	introducing [DELAYED] for heavy query time based payloads when response time is non-deterministic	2010-12-07 00:27:26 +00:00
Miroslav Stampar	2735848ab6	removed ERROR_SPACE	2010-12-06 22:40:07 +00:00
Miroslav Stampar	9ccc8f90a3	minor cosmetic update ("heuristics shows" is not grammatically correct)	2010-12-06 18:47:22 +00:00
Miroslav Stampar	d336f1df23	minor update	2010-12-06 18:44:42 +00:00
Miroslav Stampar	d77ddbee47	OR based inference works for the first time in history and fingerprint of 4 major DBMSes is now injection based (instead of AND)	2010-12-06 18:20:57 +00:00
Miroslav Stampar	27ee9a5ccf	minor refactoring	2010-12-06 15:50:19 +00:00
Miroslav Stampar	e8be14e00a	minor refactoring	2010-12-06 07:48:14 +00:00
Miroslav Stampar	a43d252ae9	minor update	2010-12-06 00:14:08 +00:00
Miroslav Stampar	5189f138d7	increasing socket timeout in case of time based checks	2010-12-05 23:18:16 +00:00
Bernardo Damele	17449754fe	Got rid of UNION false cond	2010-12-05 16:16:15 +00:00
Bernardo Damele	da3fd17fc3	Adjustment to make it work also in OR based injection	2010-12-05 12:24:23 +00:00
Bernardo Damele	41e1b95c6c	Minor code refactoring and finally make exploitation work also on OR boolean-based injections	2010-12-05 11:25:44 +00:00
Miroslav Stampar	7a5cd3b35f	minor comment update	2010-12-05 11:15:09 +00:00
Bernardo Damele	618b3b0211	Cosmetics	2010-12-05 11:05:57 +00:00
Miroslav Stampar	9e5f933ace	some updates	2010-12-04 15:47:02 +00:00
Miroslav Stampar	3f9450b9dc	minor fix	2010-12-04 14:43:35 +00:00
Miroslav Stampar	1f795622b3	some fine tuning of dynamicity removing engine	2010-12-04 13:39:35 +00:00
Miroslav Stampar	eeb199375b	usage of compiled regexes in case of dynamic markings and other refactoring	2010-12-04 13:23:28 +00:00
Miroslav Stampar	0fc7a8f9e8	code refactoring	2010-12-04 10:13:18 +00:00
Miroslav Stampar	04714374f9	now you can use kb.pageTemplate to set a page which will be used as a template in comparison process (at least in '-[RANDNUM] OR' cases we'll need to use different template(s))	2010-12-04 10:05:18 +00:00
Miroslav Stampar	b3a094b9d6	fix for a bug reported by ToR (when resuming: queries[kb.dbms] -> KeyError: u'mysql')	2010-12-03 22:44:29 +00:00
Miroslav Stampar	5764816891	minor cosmetics	2010-12-03 22:28:09 +00:00
Bernardo Damele	5d37df6104	Ugly code to set the cookies when got them from a 302 redirect too	2010-12-03 17:41:10 +00:00
Bernardo Damele	9d55c4da87	Done with support for injection in ORDER BY and GROUP BY (hopefully)	2010-12-03 16:12:47 +00:00
Bernardo Damele	91c3cf8fd0	Minor improvement	2010-12-03 16:11:57 +00:00