PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-09 22:21:30 +00:00
Code Issues Projects Releases Wiki Activity

Update for an #161 (preventing further skipping of non-heuristic parameters in ignore casted case)

Browse Source
This commit is contained in:
Miroslav Stampar
2012-08-22 11:56:30 +02:00
parent 7d0662da23
commit 8a5042b6a4
4 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
lib/controller/checks.py
View File

@@ -41,6 +41,7 @@ from lib.core.data import kb
from lib.core.data import logger
from lib.core.datatype import AttribDict
from lib.core.datatype import InjectionDict
from lib.core.enums import HEURISTIC_TEST
from lib.core.enums import HTTPHEADER
from lib.core.enums import HTTPMETHOD
from lib.core.enums import NULLCONNECTION
@@ -648,8 +649,6 @@ def heuristicCheckSqlInjection(place, parameter):
payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE)
casting = Request.queryPage(payload, place, raise404=False)
kb.heuristicTest = result
if result:
infoMsg += "be injectable (possible DBMS: %s)" % (Format.getErrorParsedDBMSes() or UNKNOWN_DBMS_VERSION)
logger.info(infoMsg)
@@ -666,7 +665,9 @@ def heuristicCheckSqlInjection(place, parameter):
message = "do you want to skip those kind of cases (and save scanning time)? [Y/n] "
kb.ignoreCasted = readInput(message, default='Y').upper() != 'N'
return result
kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE
return kb.heuristicTest
def checkDynParam(place, parameter, value):
"""

7
lib/controller/controller.py
View File

@@ -36,6 +36,7 @@ from lib.core.data import conf
from lib.core.data import kb
from lib.core.data import logger
from lib.core.enums import HASHDB_KEYS
from lib.core.enums import HEURISTIC_TEST
from lib.core.enums import HTTPHEADER
from lib.core.enums import HTTPMETHOD
from lib.core.enums import PAYLOAD
@@ -453,8 +454,8 @@ def start():
if testSqlInj:
check = heuristicCheckSqlInjection(place, parameter)
if not check:
if conf.smart or kb.ignoreCasted:
if check != HEURISTIC_TEST.POSITIVE:
if conf.smart or (kb.ignoreCasted and check == HEURISTIC_TEST.CASTED):
infoMsg = "skipping %s parameter '%s'" % (place, parameter)
logger.info(infoMsg)
continue
@@ -517,7 +518,7 @@ def start():
errMsg += "of comparison engine to detect at least "
errMsg += "one dynamic parameter)."
if kb.heuristicTest:
if kb.heuristicTest == HEURISTIC_TEST.POSITIVE:
errMsg += " As heuristic test turned out positive you are "
errMsg += "strongly advised to continue on with the tests. "
errMsg += "Please, consider usage of tampering scripts as "