630 Commits

Author	SHA1	Message	Date
Miroslav Stampar	d5e7a8d305	update	2010-12-10 10:54:17 +00:00
Bernardo Damele	b6dcbcef5b	Minor fix	2010-12-10 10:52:55 +00:00
Miroslav Stampar	bbffea2cbc	bug fix	2010-12-09 17:10:22 +00:00
Miroslav Stampar	0eb2c408a9	code refactoring	2010-12-09 16:49:02 +00:00
Bernardo Damele	5fb04515d3	Added hidden (for the moment) switch --technique	2010-12-09 13:47:17 +00:00
Miroslav Stampar	ec5c08ca7a	cosmetics	2010-12-09 09:24:20 +00:00
Miroslav Stampar	db39dc32fc	minor update	2010-12-09 00:59:39 +00:00
Bernardo Damele	9c61adb21d	Cosmetics	2010-12-09 00:26:06 +00:00
Miroslav Stampar	258e9fb50e	fix for a "bug" reported by Spencer J. McIntyre (os.makedirs(conf.outputPath, 0755) -> permission denied)	2010-12-08 21:16:18 +00:00
Miroslav Stampar	81c16926c1	code refactoring some more	2010-12-08 14:46:07 +00:00
Miroslav Stampar	95b48746a6	cosmetics	2010-12-08 14:29:09 +00:00
Miroslav Stampar	01cf1394a4	code refactoring	2010-12-08 14:26:40 +00:00
Miroslav Stampar	af22679605	minor update	2010-12-08 13:09:27 +00:00
Miroslav Stampar	6223f25dd9	code beautification	2010-12-08 13:04:48 +00:00
Miroslav Stampar	64cc2588f1	now resume is available for time-based blinds too	2010-12-08 12:49:26 +00:00
Miroslav Stampar	293ce18fed	two major bug fixes regarding time calculation (previously comparison was also a part of "delta", which screwed results in cases with large pages; other was a standard distribution based one)	2010-12-07 23:32:33 +00:00
Miroslav Stampar	b21eb88905	minor update	2010-12-07 22:45:38 +00:00
Miroslav Stampar	dc651d59ec	little mathematics here and there (used "Rules for normally distributed data")	2010-12-07 19:19:12 +00:00
Bernardo Damele	5f97312f29	Minor fix	2010-12-07 17:17:38 +00:00
Miroslav Stampar	ecd4a5a532	added standard deviation check in time based tests	2010-12-07 16:39:31 +00:00
Miroslav Stampar	294119d2ec	more advanced time technique(s)	2010-12-07 16:04:53 +00:00
Miroslav Stampar	add6235b16	removed pageTemplate from injection(s), it's not longer stored in session, and it's reloaded when resuming from session	2010-12-07 14:06:54 +00:00
Miroslav Stampar	0dc630203f	code refactoring	2010-12-07 13:34:06 +00:00
Bernardo Damele	8e78057ac8	Added counter of total HTTP(s) requests done during detection phase	2010-12-07 12:33:47 +00:00
Bernardo Damele	effd2ca0e3	Cosmetics	2010-12-07 12:32:58 +00:00
Miroslav Stampar	2af8835a94	fix for a bug reported by ToR (origValue = paramDict[kb.injection.parameter] -> KeyError in resume with missing injection parameter)	2010-12-07 10:57:32 +00:00
Miroslav Stampar	3d87489de5	minor update	2010-12-07 08:05:03 +00:00
Miroslav Stampar	61f82fd274	introducing [DELAYED] for heavy query time based payloads when response time is non-deterministic	2010-12-07 00:27:26 +00:00
Miroslav Stampar	2735848ab6	removed ERROR_SPACE	2010-12-06 22:40:07 +00:00
Miroslav Stampar	d77ddbee47	OR based inference works for the first time in history and fingerprint of 4 major DBMSes is now injection based (instead of AND)	2010-12-06 18:20:57 +00:00
Miroslav Stampar	27ee9a5ccf	minor refactoring	2010-12-06 15:50:19 +00:00
Miroslav Stampar	a43d252ae9	minor update	2010-12-06 00:14:08 +00:00
Bernardo Damele	17449754fe	Got rid of UNION false cond	2010-12-05 16:16:15 +00:00
Bernardo Damele	41e1b95c6c	Minor code refactoring and finally make exploitation work also on OR boolean-based injections	2010-12-05 11:25:44 +00:00
Miroslav Stampar	9e5f933ace	some updates	2010-12-04 15:47:02 +00:00
Miroslav Stampar	3f9450b9dc	minor fix	2010-12-04 14:43:35 +00:00
Miroslav Stampar	1f795622b3	some fine tuning of dynamicity removing engine	2010-12-04 13:39:35 +00:00
Miroslav Stampar	eeb199375b	usage of compiled regexes in case of dynamic markings and other refactoring	2010-12-04 13:23:28 +00:00
Miroslav Stampar	0fc7a8f9e8	code refactoring	2010-12-04 10:13:18 +00:00
Miroslav Stampar	04714374f9	now you can use kb.pageTemplate to set a page which will be used as a template in comparison process (at least in '-[RANDNUM] OR' cases we'll need to use different template(s))	2010-12-04 10:05:18 +00:00
Miroslav Stampar	b3a094b9d6	fix for a bug reported by ToR (when resuming: queries[kb.dbms] -> KeyError: u'mysql')	2010-12-03 22:44:29 +00:00
Miroslav Stampar	5764816891	minor cosmetics	2010-12-03 22:28:09 +00:00
Bernardo Damele	5d37df6104	Ugly code to set the cookies when got them from a 302 redirect too	2010-12-03 17:41:10 +00:00
Bernardo Damele	9d55c4da87	Done with support for injection in ORDER BY and GROUP BY (hopefully)	2010-12-03 16:12:47 +00:00
Bernardo Damele	91c3cf8fd0	Minor improvement	2010-12-03 16:11:57 +00:00
Bernardo Damele	126a1479d8	Bug fix for --union-test	2010-12-03 14:57:30 +00:00
Bernardo Damele	b824826a89	Minor enhancement to prefix payload in ORDER BY and GROUP BY clauses	2010-12-03 14:39:51 +00:00
Miroslav Stampar	612ee08a0b	added response time kb attribute	2010-12-03 13:19:34 +00:00
Bernardo Damele	4dec049c22	Major bug fix for test on ORDER BY and GROUP BY clauses. ... Minor bug fix to skip following tests if they do not match any of the clause previously identified (injection.clause value).	2010-12-03 12:00:03 +00:00
Bernardo Damele	827a0aea05	Minor bug fix	2010-12-03 11:15:11 +00:00