PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-06 12:41:30 +00:00
Code Issues Projects Releases Wiki Activity

little mathematics here and there (used "Rules for normally distributed data")

Browse Source
This commit is contained in:
Miroslav Stampar
2010-12-07 19:19:12 +00:00
parent ee72838231
commit dc651d59ec
4 changed files with 21 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
lib/controller/checks.py
View File

@@ -47,9 +47,6 @@ from lib.core.exception import sqlmapSiteTooDynamic
from lib.core.exception import sqlmapUserQuitException
from lib.core.session import setString
from lib.core.session import setRegexp
from lib.core.settings import MIN_DURATION_RATIO
from lib.core.settings import MAX_TIME_STDEV
from lib.core.settings import TIME_TOLERANCE
from lib.request.connect import Connect as Request
from lib.request.templates import getPageTemplate
from plugins.dbms.firebird.syntax import Syntax as Firebird
@@ -345,42 +342,31 @@ def checkSqlInjection(place, parameter, value):
# In case of time-based blind or stacked queries
# SQL injections
elif method == PAYLOAD.METHOD.TIME and kb.timeTests:
if stdev(kb.responseTimes) > MAX_TIME_STDEV:
# the standard deviation tells us how far from the mean
# the data points tend to be. It will have the same units
# as the data points themselves
warnMsg = "loading time(s) of the target url is too "
warnMsg += "chaotic. skipping further time-based tests."
logger.critical(warnMsg)
elif method == PAYLOAD.METHOD.TIME:
# Store old value of socket timeout
pushValue(socket.getdefaulttimeout())
kb.timeTests = False
else:
# Store old value of socket timeout
pushValue(socket.getdefaulttimeout())
# Set socket timeout to 2 minutes as some
# time based checks can take awhile
socket.setdefaulttimeout(120)
# Set socket timeout to 2 minutes as some
# time based checks can take awhile
socket.setdefaulttimeout(120)
# Perform the test's request and check how long
# it takes to get the response back
start = time.time()
_ = Request.queryPage(reqPayload, place, noteResponseTime = False)
duration = calculateDeltaSeconds(start)
# Perform the test's request and check how long
# it takes to get the response back
start = time.time()
_ = Request.queryPage(reqPayload, place, noteResponseTime = False)
duration = calculateDeltaSeconds(start)
trueResult = duration > max(kb.responseTimes) and ((check.isdigit()\
and abs(duration - int(check) - average(kb.responseTimes)) < TIME_TOLERANCE)\
or (check == "[DELAYED]" and duration >= MIN_DURATION_RATIO * max(kb.responseTimes)))
# Reference: http://www.answers.com/topic/standard-deviation
trueResult = (duration >= 7 * stdev(kb.responseTimes))
if trueResult:
infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title)
logger.info(infoMsg)
if trueResult:
infoMsg = "%s parameter '%s' is '%s' injectable " % (place, parameter, title)
logger.info(infoMsg)
injectable = True
injectable = True
# Restore value of socket timeout
socket.setdefaulttimeout(popValue())
# Restore value of socket timeout
socket.setdefaulttimeout(popValue())
# If the injection test was successful feed the injection
# object with the test's details