diff --git a/doc/THANKS b/doc/THANKS index 217fcfa61..28e8e109c 100644 --- a/doc/THANKS +++ b/doc/THANKS @@ -521,6 +521,9 @@ Kyprianos Vasilopoulos Carlos Gabriel Vergara for suggesting couple of good features +Ed Williams + for suggesting a minor enhancement + Anthony Zboralski for providing with detailed feedback for reporting a few minor bugs diff --git a/lib/utils/hash.py b/lib/utils/hash.py index d489936ce..4151b7ad8 100644 --- a/lib/utils/hash.py +++ b/lib/utils/hash.py @@ -260,6 +260,7 @@ def attackDumpedTable(): count = table["__infos__"]["count"] colUser = '' + colPasswords = set() attack_dict = {} for column in columns: @@ -286,8 +287,11 @@ def attackDumpedTable(): else: attack_dict['%s%d' % (DUMMY_USER_PREFIX, i)] = [value] + colPasswords.add(column) + if attack_dict: - message = "recognized possible password hashes. Do you want to " + message = "recognized possible password hashes in column%s " % ("s" if len(colPasswords) > 1 else "") + message += "%s. Do you want to " % ", ".join(col for col in colPasswords) message += "crack them via a dictionary-based attack? [Y/n/q]" test = readInput(message, default="Y") @@ -595,7 +599,7 @@ def dictionaryAttack(attack_dict): except KeyboardInterrupt: print processException = True - warnMsg = "user aborted during dictionary attack phase" + warnMsg = "user aborted during dictionary-based attack phase" logger.warn(warnMsg) while not retVal.empty(): @@ -662,7 +666,7 @@ def dictionaryAttack(attack_dict): except KeyboardInterrupt: print processException = True - warnMsg = "user aborted during dictionary attack phase" + warnMsg = "user aborted during dictionary-based attack phase" logger.warn(warnMsg) while not retVal.empty(): diff --git a/plugins/generic/enumeration.py b/plugins/generic/enumeration.py index e22aa595a..31e37c764 100644 --- a/plugins/generic/enumeration.py +++ b/plugins/generic/enumeration.py @@ -386,7 +386,8 @@ class Enumeration: errMsg += "system database table)" raise sqlmapNoneDataException, errMsg - message = "do you want to use dictionary attack on retrieved password hashes? [Y/n/q]" + message = "do you want to perform a dictionary-based attack " + message += "against retrieved password hashes? [Y/n/q]" test = readInput(message, default="Y") if test[0] in ("n", "N"):