Commit Graph

Select branches

Hide Pull Requests

gh-pages

master

#102

#102

#1029

#1033

#1037

#1053

#1053

#107

#107

#1112

#1186

#1206

#1227

#1227

#1244

#1244

#1246

#1246

#1300

#1300

#1306

#1306

#1323

#1323

#1328

#1330

#1342

#1342

#1351

#1378

#1378

#1402

#1403

#1403

#1414

#1449

#1449

#1469

#1469

#1500

#1535

#1543

#1565

#1565

#1611

#1611

#1614

#1637

#1678

#1681

#1681

#1700

#1700

#1710

#1727

#1727

#1728

#1732

#1733

#1735

#1740

#1762

#1762

#1763

#1763

#1776

#1776

#1795

#1795

#1805

#1805

#1843

#1843

#1856

#1856

#1898

#1922

#1922

#2011

#2086

#2089

#2134

#2138

#2169

#2169

#2170

#2240

#2250

#2289

#2289

#232

#232

#2323

#2347

#2347

#2350

#2350

#2359

#2369

#2369

#2374

#2378

#2389

#2389

#2397

#2397

#2401

#2410

#2411

#2417

#2417

#2418

#2420

#2420

#2439

#2480

#2481

#2481

#2506

#2506

#252

#252

#2537

#2555

#2590

#2597

#2613

#2613

#2616

#2616

#2618

#2620

#2663

#2663

#2666

#2666

#2667

#2667

#269

#269

#2690

#2690

#2692

#2692

#2695

#2728

#2731

#2732

#2732

#2733

#2733

#2734

#2734

#2742

#2742

#2751

#2751

#2752

#2752

#2756

#2756

#2761

#2782

#2791

#2807

#2807

#2817

#2817

#2823

#2823

#284

#284

#2883

#2883

#2903

#2903

#2904

#2904

#2905

#2905

#2906

#2906

#2931

#2933

#2933

#2951

#2967

#2992

#3009

#3009

#3087

#3087

#3116

#3153

#3153

#3174

#3174

#3188

#320

#320

#321

#321

#3231

#3233

#3233

#3236

#3267

#3267

#3274

#3274

#3316

#3322

#3323

#3326

#3349

#3350

#3351

#3352

#3372

#3376

#3383

#3396

#3398

#3407

#3414

#3416

#3418

#3423

#3432

#3437

#3442

#3443

#3445

#3458

#3472

#3479

#3482

#3488

#3527

#3536

#3573

#3574

#3575

#3579

#3590

#3609

#3645

#3684

#375

#375

#3802

#3855

#3856

#3881

#3896

#39

#39

#3917

#3952

#3955

#3958

#3959

#3965

#3966

#3969

#3970

#3992

#3996

#400

#400

#4007

#4022

#4032

#4033

#4034

#4039

#4041

#4058

#4059

#4077

#4092

#4098

#4099

#41

#41

#4121

#413

#413

#4145

#4146

#4184

#4192

#4198

#4205

#4216

#4218

#4219

#4229

#4243

#4266

#4267

#4279

#4291

#4305

#4323

#4326

#4327

#4344

#4347

#4365

#4374

#4378

#4379

#4385

#4387

#4427

#4429

#4431

#4460

#4501

#4506

#4509

#4573

#4586

#4619

#4620

#4632

#4632

#4633

#4635

#4635

#4643

#4644

#4656

#4657

#466

#466

#4663

#4687

#4691

#4692

#47

#47

#4701

#4732

#4740

#475

#475

#4750

#4815

#4832

#4833

#4833

#4852

#4878

#4918

#4937

#4964

#4975

#4983

#4992

#4998

#5006

#5013

#5021

#5032

#5038

#5055

#5059

#506

#506

#507

#507

#5070

#5095

#5109

#5111

#512

#512

#5127

#5128

#5143

#5156

#5172

#5175

#5175

#5176

#5189

#5198

#5206

#5215

#5229

#5235

#5253

#5260

#5266

#5273

#5288

#53

#53

#530

#530

#5300

#5302

#5305

#5311

#5345

#5354

#5354

#5355

#5356

#536

#536

#5361

#5366

#5377

#5384

#539

#539

#5393

#5395

#5410

#5436

#5436

#5439

#5439

#544

#544

#5443

#5443

#5459

#5475

#5478

#5478

#5490

#5497

#5501

#5507

#5551

#5552

#5553

#5554

#5555

#5556

#5569

#5580

#5586

#5588

#5590

#5592

#5597

#5598

#5599

#5603

#5604

#5609

#5617

#5621

#5625

#5649

#5658

#5665

#5667

#5677

#5679

#5685

#5685

#5687

#5688

#5690

#5692

#5693

#5699

#5702

#5706

#5715

#5721

#5736

#5750

#5751

#5760

#5764

#5765

#5777

#578

#5820

#5821

#5824

#5825

#5825

#583

#5840

#5841

#5842

#5842

#5845

#5849

#5849

#5852

#5859

#5860

#5864

#5869

#5871

#5873

#5874

#5877

#5878

#5881

#5883

#5890

#5893

#5910

#5913

#5923

#5923

#5930

#5931

#5932

#63

#672

#672

#682

#682

#684

#686

#701

#713

#713

#714

#73

#73

#74

#74

#744

#749

#756

#766

#766

#779

#803

#835

#848

#848

#855

#855

#86

#86

#952

#973

#977

#977

#98

#98

#99

#99

0.19

0.6.2

0.6.3

0.6.4

0.7

0.7-rc1

0.8

0.8-rc2

0.8-rc3

0.8-rc4

0.9

1.0

1.0.10

1.0.11

1.0.12

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2

1.2.10

1.2.11

1.2.12

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3

1.3.10

1.3.11

1.3.12

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4

1.4.10

1.4.11

1.4.12

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5

1.5.10

1.5.11

1.5.12

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6

1.6.10

1.6.11

1.6.12

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.7

1.7.1

1.7.10

1.7.11

1.7.12

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8

1.8.1

1.8.10

1.8.11

1.8.12

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

Mono Color

• 0a81415f2f Minor code cleanup Bernardo Damele 2011-02-08 00:02:54 +0000
• 2c4f6d2e99 fix (lol. we were using same comparison payload through the all test. it's a nono :) p.s. this way we are dealing with "reflective" problem too Miroslav Stampar 2011-02-07 21:53:05 +0000
• a577d0e9a5 restraining "using unescaped version of the test because of zero knowledge of the back-end DBMS" once per test (before was once per boundary) Miroslav Stampar 2011-02-07 21:18:01 +0000
• 66adf23532 Unbiased approach for searching appropriate usable column Miroslav Stampar 2011-02-07 21:00:59 +0000
• f958b21613 there is a pretty strong chance that the columns from the beginning are the INTEGER ones, while we search for STRING ones (not related to that MSSQL union/error problem we discussed earlier today) Miroslav Stampar 2011-02-07 16:55:02 +0000
• 771020abd6 one more related commit Miroslav Stampar 2011-02-07 16:32:08 +0000
• 265e7ca272 fix for that MSSQL limit/top problem Miroslav Stampar 2011-02-07 16:24:23 +0000
• 71d1b72e0e minor adjustment Miroslav Stampar 2011-02-07 12:51:38 +0000
• b33ac19d39 Minor fix Bernardo Damele 2011-02-07 12:36:00 +0000
• 99e9412f74 minor update Miroslav Stampar 2011-02-07 12:34:23 +0000
• e023e0d233 proper fix Miroslav Stampar 2011-02-07 12:32:08 +0000
• 39decebe85 Minor fixes to checking/re-enabling of xp_cmdshell procedure Bernardo Damele 2011-02-07 12:17:19 +0000
• 1a5a66870e problem fixed Miroslav Stampar 2011-02-07 11:57:41 +0000
• c0233dcd4f preventing crashes for output=[] Miroslav Stampar 2011-02-07 10:24:15 +0000
• 096efea282 added BULK to EXCLUDE_UNESCAPE and preventing crashes when output=[] Miroslav Stampar 2011-02-07 10:22:43 +0000
• 008d434325 Important fix now that the file writing is unescaped too Bernardo Damele 2011-02-07 00:56:15 +0000
• f0f5d3d3e8 Began with the update of the user's manual for 0.9 Bernardo Damele 2011-02-07 00:55:10 +0000
• ba3a8a69d4 More statements to exclude from unescap'ing Bernardo Damele 2011-02-07 00:33:54 +0000
• 3719f085ae Added back-end dbms' OS based methods to Backend object - will be used for refactoring Bernardo Damele 2011-02-07 00:21:17 +0000
• 2e00656235 Minor fix Bernardo Damele 2011-02-07 00:20:23 +0000
• bf5ca4bd9a No point in unescaping the expression also in suffixQuery() also 'cause it will exit sqlmap if the parameter value is a string hence injection payload starts with single quote (') Bernardo Damele 2011-02-06 23:30:43 +0000
• 061f56daf9 More adjustments related to unescape() and cleanupPayload(). Minor code cleanup related to error-based payload. Bernardo Damele 2011-02-06 23:27:56 +0000
• 6a71629575 Converted from DOS format (\n\r to \n only) Bernardo Damele 2011-02-06 23:25:55 +0000
• 7dcfcca87f Tests' titles adjustments Bernardo Damele 2011-02-06 23:17:39 +0000
• 0800d9e49b Major bug fix for semi-centralize unescape() and cleanupPayload() into prefixQuery() and suffixQuery() Bernardo Damele 2011-02-06 22:58:12 +0000
• 9eac2339ca Bernardo Damele 2011-02-06 22:55:26 +0000
• db77f8b055 Code cleanup Bernardo Damele 2011-02-06 22:33:08 +0000
• f3d6be7868 Code cleanup Bernardo Damele 2011-02-06 22:32:44 +0000
• ecaf5729fd revert Miroslav Stampar 2011-02-06 22:14:18 +0000
• 078a2207cc few reverts Miroslav Stampar 2011-02-06 22:10:28 +0000
• b9b2fe0e7c little cleanup Miroslav Stampar 2011-02-06 21:52:39 +0000
• c4c2cf1d58 can't stay as it is right now. temporary disabling. Miroslav Stampar 2011-02-06 21:17:41 +0000
• d2b96a66a2 one more update regarding last few "unescape" related commits Miroslav Stampar 2011-02-06 20:23:23 +0000
• caaac72029 minor update regarding last commit Miroslav Stampar 2011-02-06 20:15:03 +0000
• 6191a7f26f Major fix for a silent bug Bernardo Damele 2011-02-06 15:53:43 +0000
• 1bc2ee2fbf Updated Bernardo Damele 2011-02-06 15:44:27 +0000
• 8980227d30 Minor bug fix Bernardo Damele 2011-02-06 15:32:16 +0000
• 2afc1e5021 Layout adjustments Bernardo Damele 2011-02-06 15:28:23 +0000
• a5a648f4fe Correctly handle --read-file and --write-file if neither stacked queries nor union query SQL injection has been detected. Support to read files on MySQL via error-based SQL injection technique will come as soon as we fix the MySQL/trim/error-based bug Bernardo Damele 2011-02-06 15:23:27 +0000
• c44978862e Minor reordering of what gets saved into the injection object Bernardo Damele 2011-02-06 15:20:44 +0000
• 5ecb75cc56 minor update Miroslav Stampar 2011-02-06 15:14:07 +0000
• f754953c4f reverting this one. spotted a major bug. dbms is not properly enforced at this moment, don't know why. if it was this would be properly encoded. Miroslav Stampar 2011-02-06 12:33:58 +0000
• 97f9c9d119 bug fix (playing with wavsep i've realized that we are sending in this payload quoted 'string' (causing problems), while MD5 also accepts integer values Miroslav Stampar 2011-02-06 12:24:50 +0000
• 412a97b7fe fix for a bug reported by ahmed@isecur1ty.org (TypeError: unsupported operand type(s) for -: 'float' and 'NoneType') Miroslav Stampar 2011-02-05 14:17:28 +0000
• 4df8a03c04 using OrderedDict to store parameters in order of appearance Miroslav Stampar 2011-02-04 18:07:21 +0000
• acb986ae80 minor refactoring Miroslav Stampar 2011-02-04 17:40:55 +0000
• fec88f6a6d Minor fix Bernardo Damele 2011-02-04 15:57:53 +0000
• 1e8eb27156 update of doc/THANKS Miroslav Stampar 2011-02-04 14:07:54 +0000
• 09e88cfb19 fix for a bug reported by zack.payton@executiveinstruments.com (object of type 'NoneType' has no len()) Miroslav Stampar 2011-02-04 14:05:47 +0000
• 14c87ec80d minor fix Miroslav Stampar 2011-02-04 13:29:02 +0000
• f83f1a1e06 minor just in case update Miroslav Stampar 2011-02-04 13:08:54 +0000
• c69b76776e minor refactoring Miroslav Stampar 2011-02-04 13:04:19 +0000
• accf4e6ce0 one important fix (URI injection parameter '*' now can go anywhere) Miroslav Stampar 2011-02-04 12:43:18 +0000
• c19d481bb1 little clean up Miroslav Stampar 2011-02-04 12:25:14 +0000
• 27601babb4 Minor adjustments to levels of boundaries Bernardo Damele 2011-02-04 11:57:47 +0000
• c229efba05 revert Miroslav Stampar 2011-02-04 11:33:21 +0000
• d211def899 minor adjustment (accepting strange new looking uri formats) Miroslav Stampar 2011-02-04 10:55:03 +0000
• 1af418d444 huge bug fix Miroslav Stampar 2011-02-04 10:18:26 +0000
• 76ab14f20f revert of r3203 Miroslav Stampar 2011-02-04 09:30:20 +0000
• e4933f0c92 refactoring Miroslav Stampar 2011-02-03 23:25:56 +0000
• 9a1a28c804 adding comments to filtering function Miroslav Stampar 2011-02-03 23:09:08 +0000
• 1aecbe6b08 minor refactoring (now at the most basic level at least junky <script> and <style> tags are removed for the sake of better blind based detection) Miroslav Stampar 2011-02-03 22:59:26 +0000
• 78d696fd4f i believe that this one should be the first level 1 boundary Miroslav Stampar 2011-02-03 21:27:03 +0000
• e5f54644f0 minor "statistical" update Miroslav Stampar 2011-02-03 16:59:49 +0000
• 3bd6e538f8 more appropriate Miroslav Stampar 2011-02-03 16:48:27 +0000
• 64f18724ad new default UNION test(s) ranges Miroslav Stampar 2011-02-03 16:26:35 +0000
• 3a13fd87fd new UNION column detection is going into wild Miroslav Stampar 2011-02-03 16:16:38 +0000
• b56a77e573 removing obsolete switches (--threshold, --excl-reg, --excl-str) Miroslav Stampar 2011-02-03 15:55:19 +0000
• 253a8d0679 Minor bug fix Bernardo Damele 2011-02-03 15:24:36 +0000
• a8fea8e4a8 fix for a bug noticed when using --keep-alive --threads on IIS/MSSQL Miroslav Stampar 2011-02-03 15:09:53 +0000
• b3859824d9 Updated MySQL/Linux 64-bit shared object Bernardo Damele 2011-02-03 15:03:00 +0000
• f8556063c7 Updated MySQL/Linux 32-bit shared object Bernardo Damele 2011-02-03 15:02:30 +0000
• 06bb369da5 GCC 4.3 makes Linux/MySQL shared objects smaller Bernardo Damele 2011-02-03 14:59:31 +0000
• 12090a86bc Done with PostgreSQL/Linux 64bit shared objects too Bernardo Damele 2011-02-03 14:53:07 +0000
• 0edb4ee314 minor fix Miroslav Stampar 2011-02-03 13:28:10 +0000
• 4bb7ffcb3a minor update Miroslav Stampar 2011-02-03 13:18:43 +0000
• 8cf88dd0da Ready with PgSQL/Linux/32bit shared object too now Bernardo Damele 2011-02-03 12:28:00 +0000
• 1b9850b73a revert of last commit (conf dictionary has a method "update" which caused if conf.update to True always :) ) Miroslav Stampar 2011-02-03 12:21:29 +0000
• 5edba2ffbc minor change (conf.updateAll to conf.update) Miroslav Stampar 2011-02-03 11:13:39 +0000
• 402c1b622e removing urlencode from UA Miroslav Stampar 2011-02-02 15:18:06 +0000
• 5f49e20cc8 adding --random-agent and removing -a Miroslav Stampar 2011-02-02 14:51:12 +0000
• 2dae57a56d cosmetics Miroslav Stampar 2011-02-02 14:35:21 +0000
• 6c87bd1c63 added maskSensitiveData function Miroslav Stampar 2011-02-02 14:25:16 +0000
• 5f0114a2a8 Minor bug fix Bernardo Damele 2011-02-02 14:06:40 +0000
• 8134c2154a adding WHERE enum for payloads Miroslav Stampar 2011-02-02 13:34:09 +0000
• d6c9515f78 minor update Miroslav Stampar 2011-02-02 13:03:24 +0000
• 847b648e4a minor update Miroslav Stampar 2011-02-02 12:42:55 +0000
• e73a147fb5 minor update Miroslav Stampar 2011-02-02 11:49:59 +0000
• e33428b833 adding __findUnionCharCount function Miroslav Stampar 2011-02-02 11:22:35 +0000
• 99aa38b58f minor refactoring Miroslav Stampar 2011-02-02 10:10:28 +0000
• 23c95107ed we must do this because people tend to use ignorantly huge number threads resulting in lots of CRITICAL (timeout) connection messages (also, avoiding DoS) Miroslav Stampar 2011-02-02 09:24:37 +0000
• af99105c27 lol. sybase and maxdb were just ignored while fingerprinted because they weren't in dbmsDict screwing half of dbms related functions (most notably aliasToDbmsEnum) Miroslav Stampar 2011-02-01 22:45:38 +0000
• a37f5e05b9 Refactoring Bernardo Damele 2011-02-01 22:27:36 +0000
• 9b342a4c95 Bug fixes and proper packing/unpacking of custom statements and predefined queries for both error-based and UNION query techniques. Now it deals in UNION query also with --start and --stop and resume has been enhanced for both techniques too. Bernardo Damele 2011-02-01 22:07:42 +0000
• 2619e4895f Properly handle --technique at save/resume phase Bernardo Damele 2011-02-01 22:05:48 +0000
• 3d966bd569 You never know.. Bernardo Damele 2011-02-01 22:05:12 +0000
• d875d848ce Better sort Bernardo Damele 2011-02-01 22:04:48 +0000
• 705d45f4db minor cosmetics Miroslav Stampar 2011-02-01 11:10:23 +0000
• 196e2d35b2 maybe we could ask user "are you willing to import local data content into error report" and use this function respectably Miroslav Stampar 2011-02-01 11:06:56 +0000
• 6761933f75 Just.. cosmetics ;) Bernardo Damele 2011-01-31 22:51:14 +0000