mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2025-12-08 13:41:29 +00:00
Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
2b3af64649 | ||
|
|
58c6ca3a60 | ||
|
|
59b3b973c7 | ||
|
|
e3669c0926 | ||
|
|
507c719bef | ||
|
|
3cc19816cc | ||
|
|
74ca0eda56 | ||
|
|
514a1291e4 |
5
.github/workflows/tests.yml
vendored
5
.github/workflows/tests.yml
vendored
@@ -10,7 +10,10 @@ jobs:
|
|||||||
strategy:
|
strategy:
|
||||||
matrix:
|
matrix:
|
||||||
os: [ubuntu-latest, macos-latest, windows-latest]
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
||||||
python-version: [ '3.11', 'pypy-2.7', 'pypy-3.9' ]
|
python-version: [ 'pypy-2.7', '3.12' ]
|
||||||
|
exclude:
|
||||||
|
- os: macos-latest
|
||||||
|
python-version: 'pypy-2.7'
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v2
|
- uses: actions/checkout@v2
|
||||||
- name: Set up Python
|
- name: Set up Python
|
||||||
|
|||||||
@@ -126,7 +126,7 @@ a87035e5923f5b56077dfbd18cda5aa5e2542f0707b7b55f7bbeb1960ae3cc9a extra/icmpsh/i
|
|||||||
12014ddddc09c58ef344659c02fd1614157cfb315575378f2c8cb90843222733 extra/icmpsh/icmpsh_m.py
|
12014ddddc09c58ef344659c02fd1614157cfb315575378f2c8cb90843222733 extra/icmpsh/icmpsh_m.py
|
||||||
1589e5edeaf80590d4d0ce1fd12aa176730d5eba3bfd72a9f28d3a1a9353a9db extra/icmpsh/icmpsh-s.c
|
1589e5edeaf80590d4d0ce1fd12aa176730d5eba3bfd72a9f28d3a1a9353a9db extra/icmpsh/icmpsh-s.c
|
||||||
ab6ee3ee9f8600e39faecfdaa11eaa3bed6f15ccef974bb904b96bf95e980c40 extra/icmpsh/__init__.py
|
ab6ee3ee9f8600e39faecfdaa11eaa3bed6f15ccef974bb904b96bf95e980c40 extra/icmpsh/__init__.py
|
||||||
ce1dd60916a926081ac7e7c57bd3c6856b80c029c4e8687528b18ce47dbec5b4 extra/icmpsh/README.txt
|
27af6b7ec0f689e148875cb62c3acb4399d3814ba79908220b29e354a8eed4b8 extra/icmpsh/README.txt
|
||||||
99d0e94dd5fe60137abf48bfa051129fb251f5c40f0f7a270c89fbcb07323730 extra/__init__.py
|
99d0e94dd5fe60137abf48bfa051129fb251f5c40f0f7a270c89fbcb07323730 extra/__init__.py
|
||||||
191e3e397b83294082022de178f977f2c59fa99c96e5053375f6c16114d6777e extra/runcmd/README.txt
|
191e3e397b83294082022de178f977f2c59fa99c96e5053375f6c16114d6777e extra/runcmd/README.txt
|
||||||
25be5af53911f8c4816c0c8996b5b4932543efd6be247f5e18ce936679e7d1cd extra/runcmd/runcmd.exe_
|
25be5af53911f8c4816c0c8996b5b4932543efd6be247f5e18ce936679e7d1cd extra/runcmd/runcmd.exe_
|
||||||
@@ -165,7 +165,7 @@ f9c96cd3fe99578bed9d49a8bdf8d76836d320a7c48c56eb0469f48b36775c35 lib/controller
|
|||||||
99d0e94dd5fe60137abf48bfa051129fb251f5c40f0f7a270c89fbcb07323730 lib/controller/__init__.py
|
99d0e94dd5fe60137abf48bfa051129fb251f5c40f0f7a270c89fbcb07323730 lib/controller/__init__.py
|
||||||
826c33f1105be4c0985e1bbe1d75bdb009c17815ad6552fc8d9bf39090d3c40f lib/core/agent.py
|
826c33f1105be4c0985e1bbe1d75bdb009c17815ad6552fc8d9bf39090d3c40f lib/core/agent.py
|
||||||
b2d69c99632da5c2acd0c0934e70d55862f1380a3f602cbe7456d617fb9c1fc9 lib/core/bigarray.py
|
b2d69c99632da5c2acd0c0934e70d55862f1380a3f602cbe7456d617fb9c1fc9 lib/core/bigarray.py
|
||||||
a4863238aba3a2d203c26127a4a7a6df873bd0c6f1cd798d4a7abcdc71a07cb6 lib/core/common.py
|
fb40e269d4ef74653bb42897f3da00462a843e5623b30bc1169cd9b83946208c lib/core/common.py
|
||||||
5c26b0f308266bc3a9679ef837439e38d1dc7a69eac6bd3422280f49aaf114d2 lib/core/compat.py
|
5c26b0f308266bc3a9679ef837439e38d1dc7a69eac6bd3422280f49aaf114d2 lib/core/compat.py
|
||||||
b60c96780cad4a257f91a0611b08cfcc52f242908c5d5ab2bf9034ef07869602 lib/core/convert.py
|
b60c96780cad4a257f91a0611b08cfcc52f242908c5d5ab2bf9034ef07869602 lib/core/convert.py
|
||||||
5e381515873e71c395c77df00bf1dd8c4592afc6210a2f75cbc20daf384e539f lib/core/data.py
|
5e381515873e71c395c77df00bf1dd8c4592afc6210a2f75cbc20daf384e539f lib/core/data.py
|
||||||
@@ -181,13 +181,13 @@ e8f6f1df8814b7b03c3eba22901837555083f66c99ee93b943911de785736bfa lib/core/dicts
|
|||||||
fce3fd4b161ec1c6e9d5bf1dca5bc4083e07d616ed2c14b798e96b60ec67c2b2 lib/core/log.py
|
fce3fd4b161ec1c6e9d5bf1dca5bc4083e07d616ed2c14b798e96b60ec67c2b2 lib/core/log.py
|
||||||
4caebf27d203673b8ad32394937397319f606c4e1f1e1a2a221402d39c644b40 lib/core/optiondict.py
|
4caebf27d203673b8ad32394937397319f606c4e1f1e1a2a221402d39c644b40 lib/core/optiondict.py
|
||||||
33e0ec9ed38ae1ac74f1e2e3a1a246dee44c167723c9df69635793bfdbd971df lib/core/option.py
|
33e0ec9ed38ae1ac74f1e2e3a1a246dee44c167723c9df69635793bfdbd971df lib/core/option.py
|
||||||
fdce95c552a097bf0dd44e5d6be2204c4c458d490e62c4d9d68fca5e2dc37c48 lib/core/patch.py
|
a6f059ed73855c527472758b611e6355f92d6c431a84c069eb52dfcd4bfdc882 lib/core/patch.py
|
||||||
bf77f9fc4296f239687297aee1fd6113b34f855965a6f690b52e26bd348cb353 lib/core/profiling.py
|
bf77f9fc4296f239687297aee1fd6113b34f855965a6f690b52e26bd348cb353 lib/core/profiling.py
|
||||||
4ccce0d53f467166d4084c9ef53a07f54cc352e75f785454a31c8a820511a84e lib/core/readlineng.py
|
4ccce0d53f467166d4084c9ef53a07f54cc352e75f785454a31c8a820511a84e lib/core/readlineng.py
|
||||||
4eff81c639a72b261c8ba1c876a01246e718e6626e8e77ae9cc6298b20a39355 lib/core/replication.py
|
4eff81c639a72b261c8ba1c876a01246e718e6626e8e77ae9cc6298b20a39355 lib/core/replication.py
|
||||||
bbd1dcda835934728efc6d68686e9b0da72b09b3ee38f3c0ab78e8c18b0ba726 lib/core/revision.py
|
bbd1dcda835934728efc6d68686e9b0da72b09b3ee38f3c0ab78e8c18b0ba726 lib/core/revision.py
|
||||||
eed6b0a21b3e69c5583133346b0639dc89937bd588887968ee85f8389d7c3c96 lib/core/session.py
|
eed6b0a21b3e69c5583133346b0639dc89937bd588887968ee85f8389d7c3c96 lib/core/session.py
|
||||||
3f14500213dde69e2833c7f1e3c6c81695605f72ecc3ef0ebcc5df66a562231e lib/core/settings.py
|
c34e1e3058999c8bc709341c63d669d2f804df06404a6bec1b01520f64418dff lib/core/settings.py
|
||||||
2bec97d8a950f7b884e31dfe9410467f00d24f21b35672b95f8d68ed59685fd4 lib/core/shell.py
|
2bec97d8a950f7b884e31dfe9410467f00d24f21b35672b95f8d68ed59685fd4 lib/core/shell.py
|
||||||
e90a359b37a55c446c60e70ccd533f87276714d0b09e34f69b0740fd729ddbf8 lib/core/subprocessng.py
|
e90a359b37a55c446c60e70ccd533f87276714d0b09e34f69b0740fd729ddbf8 lib/core/subprocessng.py
|
||||||
54f7c70b4c7a9931f7ff3c1c12030180bde38e35a306d5e343ad6052919974cd lib/core/target.py
|
54f7c70b4c7a9931f7ff3c1c12030180bde38e35a306d5e343ad6052919974cd lib/core/target.py
|
||||||
|
|||||||
@@ -1,45 +1,45 @@
|
|||||||
icmpsh - simple reverse ICMP shell
|
icmpsh - simple reverse ICMP shell
|
||||||
|
|
||||||
icmpsh is a simple reverse ICMP shell with a win32 slave and a POSIX compatible master in C or Perl.
|
icmpsh is a simple reverse ICMP shell with a win32 slave and a POSIX compatible master in C or Perl.
|
||||||
|
|
||||||
|
|
||||||
--- Running the Master ---
|
--- Running the Master ---
|
||||||
|
|
||||||
The master is straight forward to use. There are no extra libraries required for the C version.
|
The master is straight forward to use. There are no extra libraries required for the C version.
|
||||||
The Perl master however has the following dependencies:
|
The Perl master however has the following dependencies:
|
||||||
|
|
||||||
* IO::Socket
|
* IO::Socket
|
||||||
* NetPacket::IP
|
* NetPacket::IP
|
||||||
* NetPacket::ICMP
|
* NetPacket::ICMP
|
||||||
|
|
||||||
|
|
||||||
When running the master, don't forget to disable ICMP replies by the OS. For example:
|
When running the master, don't forget to disable ICMP replies by the OS. For example:
|
||||||
|
|
||||||
sysctl -w net.ipv4.icmp_echo_ignore_all=1
|
sysctl -w net.ipv4.icmp_echo_ignore_all=1
|
||||||
|
|
||||||
If you miss doing that, you will receive information from the slave, but the slave is unlikely to receive
|
If you miss doing that, you will receive information from the slave, but the slave is unlikely to receive
|
||||||
commands send from the master.
|
commands send from the master.
|
||||||
|
|
||||||
|
|
||||||
--- Running the Slave ---
|
--- Running the Slave ---
|
||||||
|
|
||||||
The slave comes with a few command line options as outlined below:
|
The slave comes with a few command line options as outlined below:
|
||||||
|
|
||||||
|
|
||||||
-t host host ip address to send ping requests to. This option is mandatory!
|
-t host host ip address to send ping requests to. This option is mandatory!
|
||||||
|
|
||||||
-r send a single test icmp request containing the string "Test1234" and then quit.
|
-r send a single test icmp request containing the string "Test1234" and then quit.
|
||||||
This is for testing the connection.
|
This is for testing the connection.
|
||||||
|
|
||||||
-d milliseconds delay between requests in milliseconds
|
-d milliseconds delay between requests in milliseconds
|
||||||
|
|
||||||
-o milliseconds timeout of responses in milliseconds. If a response has not received in time,
|
-o milliseconds timeout of responses in milliseconds. If a response has not received in time,
|
||||||
the slave will increase a counter of blanks. If that counter reaches a limit, the slave will quit.
|
the slave will increase a counter of blanks. If that counter reaches a limit, the slave will quit.
|
||||||
The counter is set back to 0 if a response was received.
|
The counter is set back to 0 if a response was received.
|
||||||
|
|
||||||
-b num limit of blanks (unanswered icmp requests before quitting
|
-b num limit of blanks (unanswered icmp requests before quitting
|
||||||
|
|
||||||
-s bytes maximal data buffer size in bytes
|
-s bytes maximal data buffer size in bytes
|
||||||
|
|
||||||
|
|
||||||
In order to improve the speed, lower the delay (-d) between requests or increase the size (-s) of the data buffer.
|
In order to improve the speed, lower the delay (-d) between requests or increase the size (-s) of the data buffer.
|
||||||
|
|||||||
@@ -5601,7 +5601,8 @@ def checkSums():
|
|||||||
with open(filepath, "rb") as f:
|
with open(filepath, "rb") as f:
|
||||||
content = f.read()
|
content = f.read()
|
||||||
if not hashlib.sha256(content).hexdigest() == expected:
|
if not hashlib.sha256(content).hexdigest() == expected:
|
||||||
|
print(entry)
|
||||||
retVal &= False
|
retVal &= False
|
||||||
break
|
# break
|
||||||
|
|
||||||
return retVal
|
return retVal
|
||||||
|
|||||||
@@ -37,9 +37,12 @@ from lib.core.data import conf
|
|||||||
from lib.core.enums import PLACE
|
from lib.core.enums import PLACE
|
||||||
from lib.core.option import _setHTTPHandlers
|
from lib.core.option import _setHTTPHandlers
|
||||||
from lib.core.option import setVerbosity
|
from lib.core.option import setVerbosity
|
||||||
|
from lib.core.settings import INVALID_UNICODE_PRIVATE_AREA
|
||||||
|
from lib.core.settings import INVALID_UNICODE_CHAR_FORMAT
|
||||||
from lib.core.settings import IS_WIN
|
from lib.core.settings import IS_WIN
|
||||||
from lib.request.templates import getPageTemplate
|
from lib.request.templates import getPageTemplate
|
||||||
from thirdparty import six
|
from thirdparty import six
|
||||||
|
from thirdparty.six import unichr as _unichr
|
||||||
from thirdparty.six.moves import http_client as _http_client
|
from thirdparty.six.moves import http_client as _http_client
|
||||||
|
|
||||||
_rand = 0
|
_rand = 0
|
||||||
@@ -86,7 +89,7 @@ def dirtyPatches():
|
|||||||
if match and match.group(1).upper() != PLACE.POST:
|
if match and match.group(1).upper() != PLACE.POST:
|
||||||
PLACE.CUSTOM_POST = PLACE.CUSTOM_POST.replace("POST", "%s (body)" % match.group(1))
|
PLACE.CUSTOM_POST = PLACE.CUSTOM_POST.replace("POST", "%s (body)" % match.group(1))
|
||||||
|
|
||||||
# https://github.com/sqlmapproject/sqlmap/issues/4314
|
# Reference: https://github.com/sqlmapproject/sqlmap/issues/4314
|
||||||
try:
|
try:
|
||||||
os.urandom(1)
|
os.urandom(1)
|
||||||
except NotImplementedError:
|
except NotImplementedError:
|
||||||
@@ -95,6 +98,14 @@ def dirtyPatches():
|
|||||||
else:
|
else:
|
||||||
os.urandom = lambda size: "".join(chr(random.randint(0, 255)) for _ in xrange(size))
|
os.urandom = lambda size: "".join(chr(random.randint(0, 255)) for _ in xrange(size))
|
||||||
|
|
||||||
|
# Reference: https://github.com/sqlmapproject/sqlmap/issues/5727
|
||||||
|
# Reference: https://stackoverflow.com/a/14076841
|
||||||
|
try:
|
||||||
|
import pymysql
|
||||||
|
pymysql.install_as_MySQLdb()
|
||||||
|
except (ImportError, AttributeError):
|
||||||
|
pass
|
||||||
|
|
||||||
# Reference: https://github.com/bottlepy/bottle/blob/df67999584a0e51ec5b691146c7fa4f3c87f5aac/bottle.py
|
# Reference: https://github.com/bottlepy/bottle/blob/df67999584a0e51ec5b691146c7fa4f3c87f5aac/bottle.py
|
||||||
# Reference: https://python.readthedocs.io/en/v2.7.2/library/inspect.html#inspect.getargspec
|
# Reference: https://python.readthedocs.io/en/v2.7.2/library/inspect.html#inspect.getargspec
|
||||||
if not hasattr(inspect, "getargspec") and hasattr(inspect, "getfullargspec"):
|
if not hasattr(inspect, "getargspec") and hasattr(inspect, "getfullargspec"):
|
||||||
@@ -115,6 +126,15 @@ def dirtyPatches():
|
|||||||
|
|
||||||
inspect.getargspec = getargspec
|
inspect.getargspec = getargspec
|
||||||
|
|
||||||
|
# Installing "reversible" unicode (decoding) error handler
|
||||||
|
def _reversible(ex):
|
||||||
|
if INVALID_UNICODE_PRIVATE_AREA:
|
||||||
|
return (u"".join(_unichr(int('000f00%2x' % (_ if isinstance(_, int) else ord(_)), 16)) for _ in ex.object[ex.start:ex.end]), ex.end)
|
||||||
|
else:
|
||||||
|
return (u"".join(INVALID_UNICODE_CHAR_FORMAT % (_ if isinstance(_, int) else ord(_)) for _ in ex.object[ex.start:ex.end]), ex.end)
|
||||||
|
|
||||||
|
codecs.register_error("reversible", _reversible)
|
||||||
|
|
||||||
def resolveCrossReferences():
|
def resolveCrossReferences():
|
||||||
"""
|
"""
|
||||||
Place for cross-reference resolution
|
Place for cross-reference resolution
|
||||||
|
|||||||
@@ -17,10 +17,9 @@ from lib.core.enums import DBMS
|
|||||||
from lib.core.enums import DBMS_DIRECTORY_NAME
|
from lib.core.enums import DBMS_DIRECTORY_NAME
|
||||||
from lib.core.enums import OS
|
from lib.core.enums import OS
|
||||||
from thirdparty import six
|
from thirdparty import six
|
||||||
from thirdparty.six import unichr as _unichr
|
|
||||||
|
|
||||||
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
|
||||||
VERSION = "1.8.5.0"
|
VERSION = "1.8.6.3"
|
||||||
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
|
||||||
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
|
||||||
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
|
||||||
@@ -956,12 +955,3 @@ for key, value in os.environ.items():
|
|||||||
globals()[_] = [__.strip() for __ in _.split(',')]
|
globals()[_] = [__.strip() for __ in _.split(',')]
|
||||||
else:
|
else:
|
||||||
globals()[_] = value
|
globals()[_] = value
|
||||||
|
|
||||||
# Installing "reversible" unicode (decoding) error handler
|
|
||||||
def _reversible(ex):
|
|
||||||
if INVALID_UNICODE_PRIVATE_AREA:
|
|
||||||
return (u"".join(_unichr(int('000f00%2x' % (_ if isinstance(_, int) else ord(_)), 16)) for _ in ex.object[ex.start:ex.end]), ex.end)
|
|
||||||
else:
|
|
||||||
return (u"".join(INVALID_UNICODE_CHAR_FORMAT % (_ if isinstance(_, int) else ord(_)) for _ in ex.object[ex.start:ex.end]), ex.end)
|
|
||||||
|
|
||||||
codecs.register_error("reversible", _reversible)
|
|
||||||
|
|||||||
Reference in New Issue
Block a user