diff --git a/lib/core/settings.py b/lib/core/settings.py index 409e5d11f..fb91c66fb 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -66,6 +66,9 @@ CONCAT_VALUE_DELIMITER = '|' # coefficient used for a time-based query delay checking (must be >= 7) TIME_STDEV_COEFF = 10 +# standard deviation after which a warning message should be displayed about connection lags +WARN_TIME_STDEV = 0.5 + # minimum length of usable union injected response (quick defense against substr fields) UNION_MIN_RESPONSE_CHARS = 10 diff --git a/lib/request/connect.py b/lib/request/connect.py index 0236386b3..664be1212 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -46,6 +46,7 @@ from lib.core.exception import sqlmapSyntaxException from lib.core.settings import HTTP_SILENT_TIMEOUT from lib.core.settings import META_REFRESH_REGEX from lib.core.settings import MIN_TIME_RESPONSES +from lib.core.settings import WARN_TIME_STDEV from lib.core.settings import URI_HTTP_HEADER from lib.core.threads import getCurrentThreadData from lib.request.basic import decodePage @@ -501,6 +502,12 @@ class Connect: while len(kb.responseTimes) < MIN_TIME_RESPONSES: Connect.queryPage(content=True) + if stdev(kb.responseTimes) > WARN_TIME_STDEV: + warnMsg = "there are considerable lags in connection " + warnMsg += "response(s). please use as high value for " + warnMsg += "--time-sec option as possible (e.g. 10)" + logger.critical(warnMsg) + if conf.safUrl and conf.saFreq > 0: kb.queryCounter += 1 if kb.queryCounter % conf.saFreq == 0: