Bernardo Damele
|
d0dff82ce0
|
Minor code refactoring relating set/get back-end DBMS operating system and minor bug fix to properly enforce OS value with --os switch
|
2011-04-23 16:25:09 +00:00 |
|
Miroslav Stampar
|
148fb26301
|
quick fix
|
2011-04-21 17:34:26 +00:00 |
|
Miroslav Stampar
|
e181d5412e
|
fix for a bug reported by aboynes@gmail.com (@@datadir not available on MySQL 4)
|
2011-04-21 17:33:07 +00:00 |
|
Miroslav Stampar
|
bd4fbb3251
|
fix for a bug reported by l0rda@l0rda.biz (TypeError: cannot concatenate 'str' and 'NoneType' objects)
|
2011-04-21 14:53:02 +00:00 |
|
Miroslav Stampar
|
5052013ffa
|
minor update
|
2011-04-20 14:48:23 +00:00 |
|
Miroslav Stampar
|
f909ecb369
|
bug fix for mssqlserver escape
|
2011-04-20 13:41:01 +00:00 |
|
Miroslav Stampar
|
88c76147e1
|
removed few trailing whitespace lines
|
2011-04-15 20:52:08 +00:00 |
|
Miroslav Stampar
|
c16b74ce1a
|
covering __pivotDumpTable for keyboard and connection exceptions too
|
2011-04-15 14:21:13 +00:00 |
|
Miroslav Stampar
|
0387654166
|
update of copyright string (until year)
|
2011-04-15 12:33:18 +00:00 |
|
Miroslav Stampar
|
aed994192e
|
disabling safecharencode for --banner
|
2011-04-15 08:15:21 +00:00 |
|
Miroslav Stampar
|
8ddac7fe5a
|
minor fix and speedup when pivoting empty table
|
2011-04-14 21:11:20 +00:00 |
|
Miroslav Stampar
|
384ca98ded
|
don't let sqlmapNoneDataException for one table to break whole dumpAll()
|
2011-04-14 20:56:12 +00:00 |
|
Miroslav Stampar
|
dbbaefa79d
|
minor update (pivot value should be safechardecoded)
|
2011-04-14 20:38:03 +00:00 |
|
Miroslav Stampar
|
d06ae9cd47
|
implemented retrieved items info for partial union too
|
2011-04-13 14:33:15 +00:00 |
|
Bernardo Damele
|
1c51e11c5c
|
Minor adjustments to PgSQL fingerprint
|
2011-04-12 10:35:33 +00:00 |
|
Miroslav Stampar
|
7324d53997
|
reference (http://www.enterprisedb.com/docs/en/9.0/pg/release-9-0.html)
|
2011-04-12 10:30:33 +00:00 |
|
Miroslav Stampar
|
bc4c2f320c
|
cosmetics
|
2011-04-12 10:24:09 +00:00 |
|
Miroslav Stampar
|
2f1786e65f
|
added active fingerprint for pgsql >= 9.0.3 (reference: http://www.postgresql.org/docs/9.0/static/release-9-0.html)
|
2011-04-12 10:22:54 +00:00 |
|
Bernardo Damele
|
fdbd8bfe37
|
initial support for PostgreSQL 9.0 - #223
|
2011-04-11 22:02:00 +00:00 |
|
Bernardo Damele
|
f4745a95ea
|
Possible fix for bug reported by David
|
2011-04-11 21:45:25 +00:00 |
|
Miroslav Stampar
|
941daa1645
|
just in case to prevent "object of type 'NoneType' has no len()" error reports
|
2011-04-11 11:59:02 +00:00 |
|
Miroslav Stampar
|
e20848c711
|
first commit toward v1.0 (it's smarter to start testing for pivot point from shorter column names as they tend to be some kind of identifiers)
|
2011-04-11 09:40:52 +00:00 |
|
Bernardo Damele
|
ea3ebafba1
|
Removed outdated sentence
|
2011-04-10 23:59:49 +00:00 |
|
Bernardo Damele
|
572708f184
|
More version adjustment
|
2011-04-10 23:28:24 +00:00 |
|
Bernardo Damele
|
fbf8e7f32d
|
Minor bug fix to --file-read
|
2011-04-10 19:53:42 +00:00 |
|
Bernardo Damele
|
7dd5bd9d59
|
Minor fix for --cleanup on MSSQL
|
2011-04-10 13:48:29 +00:00 |
|
Bernardo Damele
|
6d165861c8
|
Minor version increase
|
2011-04-10 13:30:27 +00:00 |
|
Miroslav Stampar
|
c714ac6421
|
added support for handling binary data values (no more garbish chars)
|
2011-04-09 23:13:16 +00:00 |
|
Miroslav Stampar
|
6fa2fd139c
|
implemented support for __pivotDumpTable on MSSQL as normal tables tend to not play well with normal TOP 1 ..NOT IN..ORDER BY mechanism if the argument for ORDER BY is not the unique one (returns only number of rows equal to the number of distinct values for that field)
|
2011-04-08 15:17:57 +00:00 |
|
Bernardo Damele
|
d5fb1378cc
|
Gone unnoticed for way too long
|
2011-04-08 11:15:19 +00:00 |
|
Miroslav Stampar
|
e8259a7665
|
minor update (now --dump also supports only -D parameter)
|
2011-04-07 22:38:13 +00:00 |
|
Bernardo Damele
|
bac53eeef1
|
Allow --dump-all to accept -D switch in order to dump all tables' entries for only one (or more, comma-separated) specified database(s)
|
2011-04-07 22:08:10 +00:00 |
|
Miroslav Stampar
|
60102209f6
|
quick fix for a bug reported by Kirill (AttributeError: 'NoneType' object has no attribute 'split')
|
2011-04-01 11:14:24 +00:00 |
|
Miroslav Stampar
|
b6af80bab3
|
refactoring, cleanup and improvement
|
2011-03-29 21:54:15 +00:00 |
|
Miroslav Stampar
|
4312a42b5d
|
another minor fix
|
2011-03-28 12:04:39 +00:00 |
|
Miroslav Stampar
|
3173adbf6b
|
minor update
|
2011-03-28 12:02:31 +00:00 |
|
Miroslav Stampar
|
73e5d20ade
|
bulk commit for safe/unsafe identificator naming (done and tested for all 4 major DBMSes) and one bug fix for --search-column on MSSQL (inside queries)
|
2011-03-28 11:01:55 +00:00 |
|
Miroslav Stampar
|
76b7e3517d
|
minor update
|
2011-03-27 07:58:15 +00:00 |
|
Miroslav Stampar
|
04c4578df7
|
minor fix
|
2011-03-26 05:55:49 +00:00 |
|
Miroslav Stampar
|
58f8703ecd
|
minor update before bedtime
|
2011-03-25 22:59:18 +00:00 |
|
Miroslav Stampar
|
ae12dee990
|
minor update
|
2011-03-25 22:08:54 +00:00 |
|
Miroslav Stampar
|
c9baa0094b
|
going global for protection of non-standard identificator naming
|
2011-03-25 22:02:28 +00:00 |
|
Miroslav Stampar
|
5a1f733a43
|
minor update (_ is part of normal identificator naming)
|
2011-03-25 21:49:20 +00:00 |
|
Miroslav Stampar
|
1a98095a93
|
minor improvement for that MySQL identification naming
|
2011-03-25 21:46:49 +00:00 |
|
Miroslav Stampar
|
48c4460e2c
|
bug fixed (there was a huge problem with space containing identifiers - fixed and tested for MySQL)
|
2011-03-25 21:22:06 +00:00 |
|
Miroslav Stampar
|
af39a441fa
|
minor improvement when --dbs returns no database names (like in many cases with MySQL 4)
|
2011-03-25 19:50:06 +00:00 |
|
Miroslav Stampar
|
f3858a5fcf
|
another fix related to the bug reported by Alone Shell
|
2011-03-24 17:08:14 +00:00 |
|
Miroslav Stampar
|
02379c01a2
|
minor update (will do "schema update" for sybase some other time; that COUNT(*) blew my mind)
|
2011-03-23 11:42:36 +00:00 |
|
Miroslav Stampar
|
0f7bce5c66
|
fixing a huge mess going on because of counting on error and union techniques
|
2011-03-23 11:36:40 +00:00 |
|
Miroslav Stampar
|
7ea45e9032
|
minor update for Sybase regarding last commit
|
2011-03-23 11:04:15 +00:00 |
|
Miroslav Stampar
|
b72cdfe9e6
|
fix for mssql regarding usage of schema names reported by jabra@spl0it.org
|
2011-03-23 10:40:34 +00:00 |
|
Miroslav Stampar
|
4889764114
|
minor update regarding last commit
|
2011-03-21 11:40:27 +00:00 |
|
Miroslav Stampar
|
5291fe35c9
|
proper implementation of --dbs on Oracle (we are using now schema names as a counterpart to dbs in other DBMSes)
|
2011-03-21 11:29:43 +00:00 |
|
Bernardo Damele
|
74ef1e53c7
|
Minor bug fixes to --privileges for PostgreSQL query (corner case)
|
2011-03-11 14:54:41 +00:00 |
|
Miroslav Stampar
|
eb1cda7065
|
minor refactoring (more consistent)
|
2011-03-09 12:06:32 +00:00 |
|
Miroslav Stampar
|
62e3510387
|
minor refactoring
|
2011-03-09 11:37:37 +00:00 |
|
Miroslav Stampar
|
68c7247ee4
|
bug fix (pgsql drop function requires input arguments - at cleanup() in plugins/generic/misc.py it's already fixed before)
|
2011-03-08 10:46:23 +00:00 |
|
Miroslav Stampar
|
16b286982d
|
fix for a bug reported by nightman (AttributeError: 'list' object has no attribute 'split')
|
2011-03-07 09:50:43 +00:00 |
|
Bernardo Damele
|
7524a0c0cf
|
Proper error message
|
2011-03-04 11:59:09 +00:00 |
|
Bernardo Damele
|
60605b6e7c
|
Major bug fix to make --first and --last apply only to --dump's entries dump phase (in either of the blind SQL injection techs only)
|
2011-02-27 12:14:13 +00:00 |
|
Miroslav Stampar
|
13f0d5ce00
|
minor bug fix
|
2011-02-22 14:51:42 +00:00 |
|
Miroslav Stampar
|
640ba5d744
|
minor refactoring
|
2011-02-22 14:19:39 +00:00 |
|
Bernardo Damele
|
3e8c204121
|
Major bug fix to properly prepare UNION technique statement for --os-pwn and --is-dba
|
2011-02-21 16:00:56 +00:00 |
|
Miroslav Stampar
|
68a95fd1b1
|
minor update
|
2011-02-20 22:45:23 +00:00 |
|
Miroslav Stampar
|
aac817935a
|
further improvement of MaxDB support
|
2011-02-20 22:41:42 +00:00 |
|
Miroslav Stampar
|
a3ba8b6928
|
--dump now works on MaxDB too
|
2011-02-20 22:07:12 +00:00 |
|
Miroslav Stampar
|
0e512d3c09
|
minor update for MaxDB
|
2011-02-20 21:17:16 +00:00 |
|
Miroslav Stampar
|
59e666d16e
|
--is-dba (related) update for Sybase
|
2011-02-20 17:28:06 +00:00 |
|
Miroslav Stampar
|
4d52f7fc6e
|
minor fix regarding --dump-table on Sybase for --technique=23
|
2011-02-20 16:58:01 +00:00 |
|
Miroslav Stampar
|
67ec691eb1
|
more updates regarding Sybase
|
2011-02-20 16:28:48 +00:00 |
|
Miroslav Stampar
|
cc47737c44
|
minor update
|
2011-02-20 16:00:13 +00:00 |
|
Miroslav Stampar
|
2f9227bcce
|
Sybase update (--passwords)
|
2011-02-20 12:07:32 +00:00 |
|
Miroslav Stampar
|
f30dea74f3
|
more Sybase updates
|
2011-02-19 18:36:26 +00:00 |
|
Miroslav Stampar
|
b71bb321dd
|
some more Sybase updates
|
2011-02-19 18:04:27 +00:00 |
|
Miroslav Stampar
|
cec7694aac
|
some progress regarding SYBASE
|
2011-02-19 14:56:58 +00:00 |
|
Miroslav Stampar
|
e0efe453ab
|
minor update regarding Sybase support
|
2011-02-19 14:07:08 +00:00 |
|
Miroslav Stampar
|
de7ca5a27c
|
minor update
|
2011-02-19 09:40:41 +00:00 |
|
Miroslav Stampar
|
72fc0a0565
|
minor refactoring
|
2011-02-19 09:36:57 +00:00 |
|
Miroslav Stampar
|
5f4ffc9287
|
update regarding Sybase dumping
|
2011-02-19 00:36:47 +00:00 |
|
Miroslav Stampar
|
199f14df46
|
implementation of MySQL GROUP_CONCAT technique
|
2011-02-15 00:28:27 +00:00 |
|
Bernardo Damele
|
7253362114
|
Minor bug fix so that --file-write on MySQL via UNION query now works again
|
2011-02-11 23:35:45 +00:00 |
|
Bernardo Damele
|
c078de894f
|
Added support for --privileges on MSSQL to test wheter or not the DBMS users are DBA
|
2011-02-10 14:24:04 +00:00 |
|
Bernardo Damele
|
a2c20acf94
|
Minor fixes once more
|
2011-02-10 11:34:16 +00:00 |
|
Bernardo Damele
|
d0ddaee3c8
|
Minor bug fix
|
2011-02-10 11:28:24 +00:00 |
|
Miroslav Stampar
|
7539881ffa
|
fix for dump on Oracle but we still need to discuss some things around
|
2011-02-09 14:52:07 +00:00 |
|
Miroslav Stampar
|
caf6220c53
|
done with implementation for retrieving table names via access system table(s)
|
2011-02-09 10:50:38 +00:00 |
|
Miroslav Stampar
|
5050a76b59
|
update regarding reading of table names from access system tables
|
2011-02-09 10:33:29 +00:00 |
|
Bernardo Damele
|
b48213783a
|
Removed senseless debug messsage
|
2011-02-08 17:09:35 +00:00 |
|
Bernardo Damele
|
e16bab7117
|
re-enabled --read-file for MySQL with all techniques
|
2011-02-08 17:03:57 +00:00 |
|
Bernardo Damele
|
008d434325
|
Important fix now that the file writing is unescaped too
|
2011-02-07 00:56:15 +00:00 |
|
Bernardo Damele
|
db77f8b055
|
Code cleanup
|
2011-02-06 22:33:08 +00:00 |
|
Miroslav Stampar
|
ecaf5729fd
|
revert
|
2011-02-06 22:14:18 +00:00 |
|
Miroslav Stampar
|
caaac72029
|
minor update regarding last commit
|
2011-02-06 20:15:03 +00:00 |
|
Bernardo Damele
|
8980227d30
|
Minor bug fix
|
2011-02-06 15:32:16 +00:00 |
|
Bernardo Damele
|
2afc1e5021
|
Layout adjustments
|
2011-02-06 15:28:23 +00:00 |
|
Bernardo Damele
|
a5a648f4fe
|
Correctly handle --read-file and --write-file if neither stacked queries nor union query SQL injection has been detected.
Support to read files on MySQL via error-based SQL injection technique will come as soon as we fix the MySQL/trim/error-based bug
|
2011-02-06 15:23:27 +00:00 |
|
Miroslav Stampar
|
14c87ec80d
|
minor fix
|
2011-02-04 13:29:02 +00:00 |
|
Bernardo Damele
|
a37f5e05b9
|
Refactoring
|
2011-02-01 22:27:36 +00:00 |
|
Bernardo Damele
|
e3a3ae11cc
|
Proper return from error-based technique enumeration
|
2011-01-31 21:13:29 +00:00 |
|
Bernardo Damele
|
9fc0bedea8
|
Minor bug fixes
|
2011-01-30 21:01:57 +00:00 |
|