296 Commits

Author	SHA1	Message	Date
Bernardo Damele	0e78fbef56	correctly format SQLi payload for inline query technique	2013-01-19 00:28:03 +00:00
Bernardo Damele	1ad9e26a21	bug fix for ORDER BY users provided statements (issue #354)	2013-01-18 21:40:50 +00:00
Miroslav Stampar	601eb1e49a	Unescaping is renamed to escaping	2013-01-18 15:40:37 +01:00
Bernardo Damele	a43202f3c0	updated copyright	2013-01-18 14:07:51 +00:00
Bernardo Damele	3464a70ac2	bug fix: without this generic concatenation of strings in concatQuery(), detection of UNION query SQLi only (--technique U) when the page did not disclose any DBMS error message and it was not MySQL (for which there are UNION SQLi specific payloads) was not detected	2013-01-16 01:53:33 +00:00
Bernardo Damele	2a751e075d	more work on #342	2013-01-15 17:14:44 +00:00
Miroslav Stampar	7a1d484115	Implementation for an Issue #340	2013-01-15 16:05:33 +01:00
Miroslav Stampar	fc560f2b75	Minor revert and proper fix	2013-01-14 00:47:29 +01:00
Bernardo Damele	fdd6075859	temporary patch to fix UNION query enumeration	2013-01-13 23:08:23 +00:00
Miroslav Stampar	03dd958d96	Implementation for an Issue #48	2013-01-13 16:22:43 +01:00
Miroslav Stampar	bc4d8d3e02	Implementation for an Issue #332	2013-01-11 11:17:41 +01:00
Miroslav Stampar	934d41dac2	Minor style update (PEP8)	2013-01-10 15:02:28 +01:00
Miroslav Stampar	ca3d35a878	Some PEP8 related style cleaning	2013-01-10 13:18:44 +01:00
Miroslav Stampar	ca1c0c2a1d	Minor style update	2013-01-10 11:54:07 +01:00
Miroslav Stampar	25f01a419f	Minor style update (for the sake of consistency over the code and our PEP8 adaptation)	2013-01-09 15:38:41 +01:00
Miroslav Stampar	55a552ddc4	Update for an Issue #24	2013-01-08 10:55:25 +01:00
Miroslav Stampar	e4a3c015e5	Replacing old and deprecated raise Exception style (PEP8)	2013-01-03 23:20:55 +01:00
Miroslav Stampar	6ae4590edc	Removing problematic per-MySQL LIMIT prefix	2012-12-26 19:48:01 +01:00
Miroslav Stampar	77625e5af7	Minor revert	2012-12-21 19:31:05 +01:00
Miroslav Stampar	8b3e17ed4d	Minor update (better approach for those old NOT IN cases in MsSQL - instead of standard pivot dump table)	2012-12-21 14:52:47 +01:00
Bernardo Damele	86872956d5	minor bug fix (for PostgreSQL)	2012-12-19 22:55:31 +00:00
Bernardo Damele	77843f44fb	minor bug fix (issue #314)	2012-12-19 22:49:02 +00:00
Bernardo Damele	b91c829103	minor bug fix (issue #310)	2012-12-19 12:42:31 +00:00
Bernardo Damele	9149d77cc8	removed duplicate code - fixes issue #310	2012-12-19 12:17:56 +00:00
Miroslav Stampar	9e2f0131b9	Update lib/core/agent.py	2012-12-18 20:25:00 +01:00
Bernardo Damele	58656bbeb5	minor bug fix, union query has to be limited 0, 0	2012-12-18 16:36:30 +00:00
Miroslav Stampar	974407396e	Doing some more style updating (capitalization of exception classes; using _ is enough for private members - __ is used in Python specific methods)	2012-12-06 14:14:19 +01:00
Miroslav Stampar	ab67344448	Removed unused imports and variables (pyflake-ing)	2012-12-06 11:15:05 +01:00
Miroslav Stampar	b6650add46	Introducing 'new style classes' (idea from Pull request #284)	2012-12-06 10:42:53 +01:00
Miroslav Stampar	a7e1e856d4	Fix for an Issue #260	2012-11-28 17:00:26 +01:00
Miroslav Stampar	d490ffb163	Fix for an Issue #259	2012-11-27 11:45:22 +01:00
Miroslav Stampar	d37be5f97b	Fix for an Issue #248	2012-11-14 15:54:24 +01:00
Miroslav Stampar	c1eb803ef5	Bug fix for MsSQL --hex --technique=E (NOT IN based queries were not working properly)	2012-10-28 21:16:51 +01:00
Miroslav Stampar	c1b8226329	Massive renaming (proper naming is inband = union & error techniques! - query naming stays as they are/in code things like forgeInbandQuery are renamed to forgeUnionQuery)	2012-10-28 00:36:09 +02:00
Miroslav Stampar	12fc9442b9	Tamper function(s) refactoring (really no need for returning headers as they are passed by reference)	2012-10-25 10:10:23 +02:00
Miroslav Stampar	b82eb3a1ae	Fix for an Issue #210	2012-10-23 13:58:25 +02:00
Miroslav Stampar	f11a640e99	Undo of a previous commit (pdb left inside)	2012-10-22 14:39:35 +02:00
Miroslav Stampar	b913e2123d	Displaying hex-decoded resulting output in --hex mode	2012-10-22 14:39:11 +02:00
Miroslav Stampar	e440b096c5	Fix for an Issue #202	2012-10-15 12:24:30 +02:00
Miroslav Stampar	d464678e10	Minor update for an Issue #49	2012-10-04 18:01:42 +02:00
Miroslav Stampar	84b05e2d18	Better treating of numeric values (Issue #49)	2012-10-04 16:08:37 +02:00
Miroslav Stampar	9129dac77b	Minor fix for an Issue #134	2012-10-04 15:33:26 +02:00
Miroslav Stampar	461e5ebc5f	Work for Issue #197 and Issue #49	2012-10-04 11:25:44 +02:00
Miroslav Stampar	bcbf0571a5	Implementation for an Issue #49	2012-10-02 14:23:58 +02:00
Miroslav Stampar	687f3991de	Cleaning/refactoring of bunch of stacked/suffix/comment stuff (e.g.	2012-09-26 11:27:43 +02:00
Miroslav Stampar	efe4c13ed1	Update regarding suffixQuery (user supplied --suffix should nullify any eventual payload comments)	2012-09-25 14:36:15 +02:00
Miroslav Stampar	f26ea04e38	Fix for an Issue #175	2012-09-07 17:06:38 +02:00
Miroslav Stampar	cea5127ffd	Update for an Issue #6	2012-09-06 15:51:38 +02:00
Miroslav Stampar	2c66ca39f1	Wrong limit number has been used (MySQL LIMIT/OFFSET starts with 0)	2012-08-22 09:53:53 +02:00
Miroslav Stampar	01f481c332	Minor refactoring of dictionaries	2012-08-21 11:19:15 +02:00