PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-24 08:29:07 +00:00
Code Issues Projects Releases Wiki Activity

Fixes #2253

Browse Source
This commit is contained in:
Miroslav Stampar
2016-10-29 00:13:04 +02:00
parent f4e36fc049
commit 10097dd124
4 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
lib/core/convert.py Normal file → Executable file
View File

@@ -6,9 +6,11 @@ See the file 'doc/COPYING' for copying permission
"""
try:
import cPickle as pickle
import cPickle as pickle
except:
import pickle
import pickle
finally:
import pickle as picklePy
import base64
import json
@@ -45,7 +47,7 @@ def base64pickle(value):
Serializes (with pickle) and encodes to Base64 format supplied (binary) value
>>> base64pickle('foobar')
'gAJVBmZvb2JhcnEALg=='
'gAJVBmZvb2JhcnEBLg=='
"""
retVal = None
@@ -64,11 +66,11 @@ def base64pickle(value):
return retVal
def base64unpickle(value):
def base64unpickle(value, unsafe=False):
"""
Decodes value from Base64 to plain format and deserializes (with pickle) its content
>>> base64unpickle('gAJVBmZvb2JhcnEALg==')
>>> base64unpickle('gAJVBmZvb2JhcnEBLg==')
'foobar'
"""
@@ -82,9 +84,12 @@ def base64unpickle(value):
self.load_reduce()
def loads(str):
file = StringIO.StringIO(str)
unpickler = pickle.Unpickler(file)
unpickler.dispatch[pickle.REDUCE] = _
f = StringIO.StringIO(str)
if unsafe:
unpickler = picklePy.Unpickler(f)
unpickler.dispatch[pickle.REDUCE] = _
else:
unpickler = pickle.Unpickler(f)
return unpickler.load()
try:

2
lib/core/option.py Normal file → Executable file
View File

@@ -2222,7 +2222,7 @@ def _mergeOptions(inputOptions, overrideOptions):
if inputOptions.pickledOptions:
try:
inputOptions = base64unpickle(inputOptions.pickledOptions)
inputOptions = base64unpickle(inputOptions.pickledOptions, unsafe=True)
if type(inputOptions) == dict:
inputOptions = AttribDict(inputOptions)
_normalizeOptions(inputOptions)

4
lib/core/settings.py Normal file → Executable file
View File

@@ -19,7 +19,7 @@ from lib.core.enums import DBMS_DIRECTORY_NAME
from lib.core.enums import OS
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.0.10.59"
VERSION = "1.0.10.60"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -551,7 +551,7 @@ HASHDB_RETRIEVE_RETRIES = 3
HASHDB_END_TRANSACTION_RETRIES = 3
# Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism)
HASHDB_MILESTONE_VALUE = "BkfRWrtCYK" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
HASHDB_MILESTONE_VALUE = "dPHoJRQYvs" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
# Warn user of possible delay due to large page dump in full UNION query injections
LARGE_OUTPUT_THRESHOLD = 1024 ** 2