Commit Graph

1424 Commits

Author SHA1 Message Date
Bernardo Damele
c76d740a25 just a precaution 2010-11-29 15:21:56 +00:00
Miroslav Stampar
70e87d959e update of dynamicity engine 2010-11-29 15:14:49 +00:00
Bernardo Damele
ee4e04ebca Minor adjustment 2010-11-29 15:09:40 +00:00
Bernardo Damele
2efb3b78ea Consider also --dbms value during the detection phase 2010-11-29 14:48:07 +00:00
Miroslav Stampar
be6df7abd9 improvement of dynamicity engine 2010-11-29 14:30:57 +00:00
Bernardo Damele
76ce9cc888 Minor bug fix for --forms 2010-11-29 12:46:18 +00:00
Bernardo Damele
6525e08d6b Minor adjustment to detect the proper parameter type based upon --prefix and --suffix values 2010-11-29 12:13:42 +00:00
Bernardo Damele
c22338ce90 Removed --error-test, --stacked-test and --time-test switches and adapted the code accordingly. This is due to the fact that the new XML based detection engine already supports all of those tests (and more). 2010-11-29 11:47:58 +00:00
Bernardo Damele
e8c6c01e27 precaution 2010-11-29 09:54:30 +00:00
Bernardo Damele
9d7087e2ff Proper saving and resuming when more than a parameter are injectable.
Minor bug fix to --stacked-test
Minor code refactoring.
2010-11-29 01:04:42 +00:00
Bernardo Damele
75f7df75b6 Minor fix 2010-11-28 23:33:51 +00:00
Bernardo Damele
472f4465a6 Prioritize DBMS fingerprint based on DBMS (<dbms>) identified during the detection phase.
Minor bug fix to properly handle the case that no injections are found.
Nicer display of injection vulnerabilities detected.
Minor code refactoring.
2010-11-28 21:27:47 +00:00
Bernardo Damele
7e3b24afe6 Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own.
All (hopefully) functionalities should still be working.
Added two switches, --level and --risk to specify which injection tests and boundaries to use.
The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work!
2010-11-28 18:10:54 +00:00
Miroslav Stampar
a8b38ba76b removed a trailer blank like (cosmetics) 2010-11-24 14:25:16 +00:00
Miroslav Stampar
6712f4da55 some refactoring and one less request for aspx maintanance during --os-shell 2010-11-24 14:20:43 +00:00
Bernardo Damele
253eafb643 paranoid cosmetics 2010-11-24 12:03:01 +00:00
Miroslav Stampar
b2b521fc8a gready regex bastard :) 2010-11-24 12:01:36 +00:00
Miroslav Stampar
9579a97039 now ASPX works too for --os-shell 2010-11-24 11:38:27 +00:00
Miroslav Stampar
ca58bdbc66 minor update 2010-11-24 10:54:15 +00:00
Miroslav Stampar
c54c9ee5d1 minor update 2010-11-23 22:33:00 +00:00
Miroslav Stampar
57ad59206b cosmetics as it's best 2010-11-23 22:09:10 +00:00
Miroslav Stampar
7a147041c4 cosmetics 2010-11-23 21:44:58 +00:00
Miroslav Stampar
f4f0bc9db3 minor fix 2010-11-23 21:17:01 +00:00
Miroslav Stampar
f9f076ba97 code refactoring 2010-11-23 21:00:42 +00:00
Miroslav Stampar
7877a931d5 more cosmetics regarding dictionary attack 2010-11-23 20:54:40 +00:00
Miroslav Stampar
e3b3e05748 minor update 2010-11-23 19:21:30 +00:00
Miroslav Stampar
0d24a15182 more cosmetics 2010-11-23 19:10:34 +00:00
Miroslav Stampar
836a1c214a los cosmeticados (of hash dictionary attack) 2010-11-23 18:57:00 +00:00
Miroslav Stampar
c4414df594 minor update 2010-11-23 15:33:13 +00:00
Miroslav Stampar
78024eafe0 little precaution 2010-11-23 15:31:23 +00:00
Miroslav Stampar
4af000e699 minor language update (in testing phase "used" is more preferable than "provided") 2010-11-23 15:11:15 +00:00
Bernardo Damele
e32be2b4e7 Minor adjustment 2010-11-23 15:06:40 +00:00
Miroslav Stampar
b41ee8d0d0 minor refactoring 2010-11-23 14:57:36 +00:00
Miroslav Stampar
aa5d038f18 more code refactoring 2010-11-23 14:50:47 +00:00
Miroslav Stampar
3cae76627c code refactoring regarding dictionary attack 2010-11-23 13:58:01 +00:00
Miroslav Stampar
ba4ea32603 first working version of dictionary attack 2010-11-23 13:24:02 +00:00
Miroslav Stampar
c471b815cc fix for a bug reported by BugTrace (IndexError: list index out of range) 2010-11-22 10:58:08 +00:00
Miroslav Stampar
bfc9378542 sorry, even more proper naming should be like this (passwd is a standard naming for this kind of function(s)) 2010-11-20 13:22:59 +00:00
Miroslav Stampar
db59faedb9 more proper naming 2010-11-20 13:20:28 +00:00
Miroslav Stampar
52c722dab5 renaming of dicts.zip to wordlists.zip (more proper name) 2010-11-20 13:17:13 +00:00
Miroslav Stampar
1f8a9fe033 foundations for dictionary attack support combined with the sqlmap's password/hash retrieval functionality (--password switch) 2010-11-20 13:14:13 +00:00
Miroslav Stampar
71107e4e9e quick fix for google searches 2010-11-19 21:38:20 +00:00
Bernardo Damele
99a23e23cf Extra check on --union-cols value 2010-11-19 16:39:26 +00:00
Miroslav Stampar
da7eb329bb removing file 2010-11-19 16:04:07 +00:00
Miroslav Stampar
1fa567e14d new file added (dictionary attack on password hashes - MySQL, MSSQL, Oracle and Posgres - is soon going to be a part of sqlmap) 2010-11-19 15:51:56 +00:00
Bernardo Damele
c23126547e Improved --union-cols to accept a range to test for union SQL injection. By default it is 1-20. 2010-11-19 15:48:24 +00:00
Bernardo Damele
ad17e9ed2a Added new switch --union-char to be able to provide the character used in union-test and exploit (default is still NULL, but can be any) 2010-11-19 14:56:20 +00:00
Miroslav Stampar
c6545f5c9f we had a bug (nooooooooo!!!! :)) 2010-11-19 10:36:47 +00:00
Miroslav Stampar
df88280681 minor update of google regex (that * was a junky one) 2010-11-19 10:04:29 +00:00
Miroslav Stampar
e8bef28337 updating google parsing regex (for the better, of course) 2010-11-19 10:00:29 +00:00