171 Commits

Author	SHA1	Message	Date
Miroslav Stampar	96a06351a1	minor fix (in testing phase raise404 should be set to False)	2010-12-24 12:36:00 +00:00
Miroslav Stampar	2c23a59ba5	fix for one of those more complex bugs (comparison was returning None while original page and/or page template were already had already DBMS error inside)	2010-12-24 12:13:48 +00:00
Miroslav Stampar	aab14fa2d3	minor refactoring/cosmetics	2010-12-24 11:06:57 +00:00
Miroslav Stampar	23dc408901	prioritization of tests based on DBMS error messages and some comments in common.py	2010-12-24 10:55:41 +00:00
Miroslav Stampar	017ea9e686	update	2010-12-23 14:06:22 +00:00
Miroslav Stampar	8fc60215ed	lol. this was a pesky bug. heuristic wasn't working on one mssql test site and i couldn't find why. at end the problem was that when the HTTP code was raised (like 500) no parseResponse was called.	2010-12-22 19:12:46 +00:00
Miroslav Stampar	08c88495d0	removed that ugly hack	2010-12-22 13:09:04 +00:00
Miroslav Stampar	d974a966b8	minor fix for end phase (Ctrl+C)	2010-12-21 23:55:55 +00:00
Miroslav Stampar	0e68248f60	minor update of heuristic check	2010-12-21 12:56:18 +00:00
Miroslav Stampar	16f1f4e13e	when doing dynamic checks there are cases when 404 can be raised (perfectly normal)	2010-12-21 11:04:49 +00:00
Bernardo Damele	ad6b528b33	Bit more verbose comment	2010-12-21 10:47:39 +00:00
Miroslav Stampar	e10670d9ac	added end detection phase choice into Ctrl+C list	2010-12-20 23:34:00 +00:00
Miroslav Stampar	b34fe5c334	no more need for such a huge timeout because any timeout exceptions will now be considered as a successful time-based attack (previously we wanted to get back to the program, hence there was such a huge timeout)	2010-12-20 22:49:48 +00:00
Miroslav Stampar	eaf8929085	more minor updates	2010-12-20 10:48:53 +00:00
Miroslav Stampar	e9f1ecb9e7	minor update	2010-12-20 10:32:58 +00:00
Miroslav Stampar	10a7a2dfb2	kids, don't use this at home	2010-12-20 10:13:14 +00:00
Miroslav Stampar	4cb83654dc	minor update	2010-12-18 16:28:21 +00:00
Miroslav Stampar	05c6d661e8	cosmetics	2010-12-18 10:49:49 +00:00
Miroslav Stampar	03220d34ba	added Ctrl+C check in detection phase	2010-12-18 10:42:09 +00:00
Miroslav Stampar	fe67d3827c	code refactoring and some fixes	2010-12-18 09:51:34 +00:00
Miroslav Stampar	323af45ce4	added one more time request payload to confirm test results	2010-12-17 07:53:58 +00:00
Miroslav Stampar	d5fb921154	removed debug print	2010-12-09 20:08:59 +00:00
Miroslav Stampar	0eb2c408a9	code refactoring	2010-12-09 16:49:02 +00:00
Bernardo Damele	df5f6bc1b7	Little precaution	2010-12-09 14:06:43 +00:00
Bernardo Damele	5fb04515d3	Added hidden (for the moment) switch --technique	2010-12-09 13:47:17 +00:00
Bernardo Damele	0c01be0eeb	Ugly work-around to avoid unescaping WAITFOR DELAY time between single quotes (unescaped CHAR(..) value does not work).	2010-12-09 00:34:02 +00:00
Bernardo Damele	9c61adb21d	Cosmetics	2010-12-09 00:26:06 +00:00
Bernardo Damele	10ef2b5de8	Minor bug fix	2010-12-08 23:09:42 +00:00
Miroslav Stampar	81c16926c1	code refactoring some more	2010-12-08 14:46:07 +00:00
Miroslav Stampar	ed09c53ee4	minor minor update	2010-12-08 14:27:37 +00:00
Miroslav Stampar	1ae2fa7f1a	update regarding time based payloads	2010-12-08 11:26:54 +00:00
Miroslav Stampar	a4a63f5b1e	minor update	2010-12-07 23:49:00 +00:00
Miroslav Stampar	293ce18fed	two major bug fixes regarding time calculation (previously comparison was also a part of "delta", which screwed results in cases with large pages; other was a standard distribution based one)	2010-12-07 23:32:33 +00:00
Miroslav Stampar	575e50673b	minor update	2010-12-07 19:27:01 +00:00
Miroslav Stampar	398b82644a	little explanation	2010-12-07 19:25:26 +00:00
Miroslav Stampar	dc651d59ec	little mathematics here and there (used "Rules for normally distributed data")	2010-12-07 19:19:12 +00:00
Bernardo Damele	ee72838231	Removed debug print	2010-12-07 17:19:29 +00:00
Bernardo Damele	5f97312f29	Minor fix	2010-12-07 17:17:38 +00:00
Miroslav Stampar	ecd4a5a532	added standard deviation check in time based tests	2010-12-07 16:39:31 +00:00
Miroslav Stampar	294119d2ec	more advanced time technique(s)	2010-12-07 16:04:53 +00:00
Miroslav Stampar	4959da3ce6	it's a must to double check time based payloads	2010-12-07 14:59:11 +00:00
Miroslav Stampar	e53fef546e	update regarding session page templates	2010-12-07 14:35:31 +00:00
Miroslav Stampar	add6235b16	removed pageTemplate from injection(s), it's not longer stored in session, and it's reloaded when resuming from session	2010-12-07 14:06:54 +00:00
Miroslav Stampar	0dc630203f	code refactoring	2010-12-07 13:34:06 +00:00
Bernardo Damele	8e78057ac8	Added counter of total HTTP(s) requests done during detection phase	2010-12-07 12:33:47 +00:00
Miroslav Stampar	3d87489de5	minor update	2010-12-07 08:05:03 +00:00
Miroslav Stampar	0da1ebde7d	introducing PostgreSQL time based blind	2010-12-07 00:51:14 +00:00
Miroslav Stampar	61f82fd274	introducing [DELAYED] for heavy query time based payloads when response time is non-deterministic	2010-12-07 00:27:26 +00:00
Miroslav Stampar	2735848ab6	removed ERROR_SPACE	2010-12-06 22:40:07 +00:00
Miroslav Stampar	9ccc8f90a3	minor cosmetic update ("heuristics shows" is not grammatically correct)	2010-12-06 18:47:22 +00:00