Commit Graph

7828 Commits

Author SHA1 Message Date
Dirk Wetter
dd7f5252ce Merge 8adc8bdd39 into 591a60bbde 2017-07-17 17:09:30 +00:00
Dirk
8adc8bdd39 Merge branch 'master' of github.com:drwetter/sqlmap 2017-07-17 19:06:39 +02:00
Dirk
0f4272fabe Add --ignore-400
I encountered a situation where the console - I am running usally at debug level 2 or 3
is flooded with HTTP 400 (which are kind of annoying):

```
[15:02:41] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:41] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:42] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:42] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:42] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:43] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:43] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:44] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:44] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:44] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:45] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:45] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:46] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:46] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:46] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:47] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:47] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:48] [DEBUG] got HTTP error code: 400 (Bad Request)
[15:02:52] [DEBUG] got HTTP error code: 400 (Bad Request)
```

as this is triggered by almost every request.

This is a workaround for the above scenario so that on the console I see only what I wanted
to, like:

```
[18:51:18] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Generic comment)'
[18:51:41] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Generic comment) (NOT)'
[18:52:06] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'
[18:52:06] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL) (original value)'
[18:52:07] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'
[18:52:08] [INFO] testing 'Boolean-based blind - Parameter replace (CASE) (original value)'
[18:52:08] [INFO] testing 'Oracle AND boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[18:52:34] [INFO] testing 'Oracle OR boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[18:52:57] [INFO] testing 'Oracle boolean-based blind - Parameter replace'
[18:52:57] [INFO] testing 'Oracle boolean-based blind - Parameter replace (original value)'
[18:52:58] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause'
[18:52:59] [INFO] testing 'Oracle boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[18:53:00] [INFO] testing 'Oracle boolean-based blind - Stacked queries'
[18:53:23] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[18:53:41] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)'
[18:53:57] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
[18:54:13] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
[18:54:26] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[18:54:43] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[18:54:57] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'
[18:55:13] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)'
[18:55:27] [INFO] testing 'Oracle error-based - Parameter replace'
[18:55:27] [INFO] testing 'Oracle error-based - ORDER BY, GROUP BY clause'
```

Admittedly this is may seem a bit hackish as it only addresses HTTP 400 and doesn't cover other
app specific errors which can happen in other scenarios. It could also be that ``--suppress-400``
would sound better as it would describe better what it does but as there's
``--ignore-401`` so I settled for ``--ignore-400``.
2017-07-17 18:54:03 +02:00
Miroslav Stampar
591a60bbde Fixes #2606 2017-07-11 14:48:22 +02:00
Miroslav Stampar
3f40bf1101 Fixes #2387 2017-07-06 11:44:18 +02:00
Miroslav Stampar
d248317b89 Update for people that just download 'sqlmap.py' <- they exist 2017-07-05 16:42:54 +02:00
Miroslav Stampar
75fd878242 Minor patch 2017-07-05 15:41:53 +02:00
Miroslav Stampar
30378c8ae3 Minor patch 2017-07-05 15:27:29 +02:00
Miroslav Stampar
c9b3b47d6f Minor update 2017-07-05 14:07:21 +02:00
Miroslav Stampar
d038d027f9 Minor updates 2017-07-05 13:51:48 +02:00
Miroslav Stampar
c6577b80d9 Minor update 2017-07-05 13:35:02 +02:00
Miroslav Stampar
4a4fa07bdd Minor update 2017-07-05 12:35:48 +02:00
Miroslav Stampar
a4ebd5418f Patch for an Issue reported privately via email 2017-07-05 12:15:14 +02:00
Miroslav Stampar
ba369b73d3 Fixes #2601 2017-07-05 11:31:42 +02:00
Miroslav Stampar
614f290217 Update for #2597 2017-07-04 12:14:17 +02:00
Miroslav Stampar
1678b606a2 Update for #2597 2017-07-03 16:55:24 +02:00
Miroslav Stampar
aef5d6667f Merge pull request #2597 from delvelabs/generate-har
Generate HAR
2017-07-03 15:27:00 +02:00
Miroslav Stampar
b622c25f9d Fixes #2598 2017-07-03 14:17:11 +02:00
Miroslav Stampar
e07ff7168b Fixes #2599 2017-07-02 00:03:34 +02:00
Miroslav Stampar
ce48217ada Minor update 2017-07-01 23:46:28 +02:00
Louis-Philippe Huberdeau
b6969df52a Add missing httpVersion in request render, avoid encoding to base64 unless binary data is included 2017-06-29 10:14:20 -04:00
Miroslav Stampar
0e728aa73e Changing default encoding of sys.argv 2017-06-29 15:33:34 +02:00
Miroslav Stampar
f93c19ba9d Fixes #2596 2017-06-29 15:29:54 +02:00
Louis-Philippe Huberdeau
dd19527e9c Remove debug _raw entry from output 2017-06-29 09:00:02 -04:00
Miroslav Stampar
a42ddad9c1 Implements #2583 2017-06-29 14:57:35 +02:00
Miroslav Stampar
a2973296a2 Fixes #2595 2017-06-29 14:26:25 +02:00
Miroslav Stampar
0961f6a5e9 Fixes #2592 2017-06-23 23:46:25 +02:00
Louis-Philippe Huberdeau
fae965f8b6 Parse and build the response block 2017-06-23 13:28:22 -04:00
Louis-Philippe Huberdeau
0d756a8823 Parse request data and convert to HAR, include in injection data 2017-06-23 11:50:21 -04:00
Louis-Philippe Huberdeau
8df4cc3983 Adding initial hook to receive the request/response pairs 2017-06-23 09:44:33 -04:00
Miroslav Stampar
5ec44b8346 Minor refactoring 2017-06-19 23:06:05 +02:00
Miroslav Stampar
d577c57a11 Merge pull request #2590 from neargle/master
append %A0 to the blanks set of tamper/space2mysqlblank
2017-06-19 22:51:21 +02:00
neargle
ca24509e19 append %A0 to space2mysqlblank 2017-06-19 22:39:09 +08:00
Miroslav Stampar
e2d3187a78 Fixes #2576 2017-06-18 15:00:12 +02:00
Miroslav Stampar
b4980778dd Fixes #2577 2017-06-18 14:07:48 +02:00
Miroslav Stampar
71457fea0e Fixes #2585 2017-06-18 13:19:11 +02:00
Miroslav Stampar
34281af3f6 Minor cleaning 2017-06-14 08:13:41 -04:00
Miroslav Stampar
7dbbf3ecf5 Fixes 'codewatchorg/sqlipy/issues/12' 2017-06-07 23:19:19 +02:00
Miroslav Stampar
c41c93a404 Fixes #2568 2017-06-07 22:43:28 +02:00
Miroslav Stampar
9a7343e9f7 Fixes #2566 2017-06-07 16:07:27 +02:00
Miroslav Stampar
e0401104f2 Minor update 2017-06-07 12:55:14 +02:00
Miroslav Stampar
9da8d55128 Implements #2557 2017-06-07 11:22:06 +02:00
Miroslav Stampar
864711b434 Minor improvement 2017-06-05 16:48:14 +02:00
Miroslav Stampar
996ad59126 Minor patch 2017-06-05 16:28:19 +02:00
Miroslav Stampar
6d48df2454 Fixes #2562 2017-06-05 10:38:05 +02:00
Miroslav Stampar
55a43a837b Minor update 2017-06-02 00:50:00 +02:00
Miroslav Stampar
455d41c6a0 Merge pull request #2555 from SValkanov/master
Bulgarian translation
2017-06-02 00:49:01 +02:00
Miroslav Stampar
eb26dd8984 Fixes #2556 2017-06-02 00:44:01 +02:00
SValkanov
0f34300221 Edit Bulgarian translation 2017-06-01 16:51:00 +03:00
SValkanov
93a875ec71 Edit bulgarian translation 2017-06-01 16:07:47 +03:00