Commit Graph

Select branches

Hide Pull Requests

gh-pages

master

#102

#102

#1029

#1033

#1037

#1053

#1053

#107

#107

#1112

#1186

#1206

#1227

#1227

#1244

#1244

#1246

#1246

#1300

#1300

#1306

#1306

#1323

#1323

#1328

#1330

#1342

#1342

#1351

#1378

#1378

#1402

#1403

#1403

#1414

#1449

#1449

#1469

#1469

#1500

#1535

#1543

#1565

#1565

#1611

#1611

#1614

#1637

#1678

#1681

#1681

#1700

#1700

#1710

#1727

#1727

#1728

#1732

#1733

#1735

#1740

#1762

#1762

#1763

#1763

#1776

#1776

#1795

#1795

#1805

#1805

#1843

#1843

#1856

#1856

#1898

#1922

#1922

#2011

#2086

#2089

#2134

#2138

#2169

#2169

#2170

#2240

#2250

#2289

#2289

#232

#232

#2323

#2347

#2347

#2350

#2350

#2359

#2369

#2369

#2374

#2378

#2389

#2389

#2397

#2397

#2401

#2410

#2411

#2417

#2417

#2418

#2420

#2420

#2439

#2480

#2481

#2481

#2506

#2506

#252

#252

#2537

#2555

#2590

#2597

#2613

#2613

#2616

#2616

#2618

#2620

#2663

#2663

#2666

#2666

#2667

#2667

#269

#269

#2690

#2690

#2692

#2692

#2695

#2728

#2731

#2732

#2732

#2733

#2733

#2734

#2734

#2742

#2742

#2751

#2751

#2752

#2752

#2756

#2756

#2761

#2782

#2791

#2807

#2807

#2817

#2817

#2823

#2823

#284

#284

#2883

#2883

#2903

#2903

#2904

#2904

#2905

#2905

#2906

#2906

#2931

#2933

#2933

#2951

#2967

#2992

#3009

#3009

#3087

#3087

#3116

#3153

#3153

#3174

#3174

#3188

#320

#320

#321

#321

#3231

#3233

#3233

#3236

#3267

#3267

#3274

#3274

#3316

#3322

#3323

#3326

#3349

#3350

#3351

#3352

#3372

#3376

#3383

#3396

#3398

#3407

#3414

#3416

#3418

#3423

#3432

#3437

#3442

#3443

#3445

#3458

#3472

#3479

#3482

#3488

#3527

#3536

#3573

#3574

#3575

#3579

#3590

#3609

#3645

#3684

#375

#375

#3802

#3855

#3856

#3881

#3896

#39

#39

#3917

#3952

#3955

#3958

#3959

#3965

#3966

#3969

#3970

#3992

#3996

#400

#400

#4007

#4022

#4032

#4033

#4034

#4039

#4041

#4058

#4059

#4077

#4092

#4098

#4099

#41

#41

#4121

#413

#413

#4145

#4146

#4184

#4192

#4198

#4205

#4216

#4218

#4219

#4229

#4243

#4266

#4267

#4279

#4291

#4305

#4323

#4326

#4327

#4344

#4347

#4365

#4374

#4378

#4379

#4385

#4387

#4427

#4429

#4431

#4460

#4501

#4506

#4509

#4573

#4586

#4619

#4620

#4632

#4632

#4633

#4635

#4635

#4643

#4644

#4656

#4657

#466

#466

#4663

#4687

#4691

#4692

#47

#47

#4701

#4732

#4740

#475

#475

#4750

#4815

#4832

#4833

#4833

#4852

#4878

#4918

#4937

#4964

#4975

#4983

#4992

#4998

#5006

#5013

#5021

#5032

#5038

#5055

#5059

#506

#506

#507

#507

#5070

#5095

#5109

#5111

#512

#512

#5127

#5128

#5143

#5156

#5172

#5175

#5175

#5176

#5189

#5198

#5206

#5215

#5229

#5235

#5253

#5260

#5266

#5273

#5288

#53

#53

#530

#530

#5300

#5302

#5305

#5311

#5345

#5354

#5354

#5355

#5356

#536

#536

#5361

#5366

#5377

#5384

#539

#539

#5393

#5395

#5410

#5436

#5436

#5439

#5439

#544

#544

#5443

#5443

#5459

#5475

#5478

#5478

#5490

#5497

#5501

#5507

#5551

#5552

#5553

#5554

#5555

#5556

#5569

#5580

#5586

#5588

#5590

#5592

#5597

#5598

#5599

#5603

#5604

#5609

#5617

#5621

#5625

#5649

#5658

#5665

#5667

#5677

#5679

#5685

#5685

#5687

#5688

#5690

#5692

#5693

#5699

#5702

#5706

#5715

#5721

#5736

#5750

#5751

#5760

#5764

#5765

#5777

#578

#5820

#5821

#5824

#5825

#5825

#583

#5840

#5841

#5842

#5842

#5845

#5849

#5849

#5852

#5859

#5860

#5864

#5869

#5871

#5873

#5874

#5877

#5878

#5881

#5883

#5890

#5893

#5910

#5913

#5923

#5923

#5930

#5931

#5932

#5940

#5944

#5945

#5945

#5952

#5953

#5957

#5959

#5963

#5963

#5965

#5967

#5970

#5973

#5973

#5980

#5984

#5985

#5995

#5999

#6000

#6001

#6004

#6004

#63

#672

#672

#682

#682

#684

#686

#701

#713

#713

#714

#73

#73

#74

#74

#744

#749

#756

#766

#766

#779

#803

#835

#848

#848

#855

#855

#86

#86

#952

#973

#977

#977

#98

#98

#99

#99

0.19

0.6.2

0.6.3

0.6.4

0.7

0.7-rc1

0.8

0.8-rc2

0.8-rc3

0.8-rc4

0.9

1.0

1.0.10

1.0.11

1.0.12

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.10

1.2

1.2.10

1.2.11

1.2.12

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3

1.3.10

1.3.11

1.3.12

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4

1.4.10

1.4.11

1.4.12

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5

1.5.10

1.5.11

1.5.12

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6

1.6.10

1.6.11

1.6.12

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.7

1.7.1

1.7.10

1.7.11

1.7.12

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8

1.8.1

1.8.10

1.8.11

1.8.12

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9

1.9.10

1.9.11

1.9.12

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

Mono Color

• 41e1b95c6c Minor code refactoring and finally make exploitation work also on OR boolean-based injections Bernardo Damele 2010-12-05 11:25:44 +00:00
• 7a5cd3b35f minor comment update Miroslav Stampar 2010-12-05 11:15:09 +00:00
• 191ba3118f Cosmetics Bernardo Damele 2010-12-05 11:08:52 +00:00
• 1b17bac494 Sorted out Bernardo Damele 2010-12-05 11:06:37 +00:00
• 618b3b0211 Cosmetics Bernardo Damele 2010-12-05 11:05:57 +00:00
• 8066610217 Minor improvements to OR based injections Bernardo Damele 2010-12-05 10:55:19 +00:00
• 2612615978 Major improvements Bernardo Damele 2010-12-04 16:40:08 +00:00
• 9e5f933ace some updates Miroslav Stampar 2010-12-04 15:47:02 +00:00
• 3f9450b9dc minor fix Miroslav Stampar 2010-12-04 14:43:35 +00:00
• 1f795622b3 some fine tuning of dynamicity removing engine Miroslav Stampar 2010-12-04 13:39:35 +00:00
• eeb199375b usage of compiled regexes in case of dynamic markings and other refactoring Miroslav Stampar 2010-12-04 13:23:28 +00:00
• 0fc7a8f9e8 code refactoring Miroslav Stampar 2010-12-04 10:13:18 +00:00
• 04714374f9 now you can use kb.pageTemplate to set a page which will be used as a template in comparison process (at least in '-[RANDNUM] OR' cases we'll need to use different template(s)) Miroslav Stampar 2010-12-04 10:05:18 +00:00
• 95a3f4b52f Rudimental OR boolean-based tests for login forms Bernardo Damele 2010-12-03 22:58:35 +00:00
• b3a094b9d6 fix for a bug reported by ToR (when resuming: queries[kb.dbms] -> KeyError: u'mysql') Miroslav Stampar 2010-12-03 22:44:29 +00:00
• 5764816891 minor cosmetics Miroslav Stampar 2010-12-03 22:28:09 +00:00
• 5d37df6104 Ugly code to set the cookies when got them from a 302 redirect too Bernardo Damele 2010-12-03 17:41:10 +00:00
• 9d55c4da87 Done with support for injection in ORDER BY and GROUP BY (hopefully) Bernardo Damele 2010-12-03 16:12:47 +00:00
• 91c3cf8fd0 Minor improvement Bernardo Damele 2010-12-03 16:11:57 +00:00
• 0e6359ab6e Minor layout adjustment Bernardo Damele 2010-12-03 16:11:35 +00:00
• 6e73adec47 Get rid of one useless attribute Bernardo Damele 2010-12-03 16:11:13 +00:00
• 126a1479d8 Bug fix for --union-test Bernardo Damele 2010-12-03 14:57:30 +00:00
• 072835e04b Removed for time being Bernardo Damele 2010-12-03 14:48:31 +00:00
• 11058667e4 Better naming Bernardo Damele 2010-12-03 14:45:13 +00:00
• b824826a89 Minor enhancement to prefix payload in ORDER BY and GROUP BY clauses Bernardo Damele 2010-12-03 14:39:51 +00:00
• bb40ab9fb0 Major bug fix for default boolean-based vector still work and minor adjustments Bernardo Damele 2010-12-03 14:31:11 +00:00
• 612ee08a0b added response time kb attribute Miroslav Stampar 2010-12-03 13:19:34 +00:00
• 73dfb69308 minor update for OR based time injection (Firebird) Miroslav Stampar 2010-12-03 12:15:41 +00:00
• 4dec049c22 Major bug fix for test on ORDER BY and GROUP BY clauses. Minor bug fix to skip following tests if they do not match any of the clause previously identified (injection.clause value). Bernardo Damele 2010-12-03 12:00:03 +00:00
• 827a0aea05 Minor bug fix Bernardo Damele 2010-12-03 11:15:11 +00:00
• 23a86ed612 minor bug fix related to Firebird time based test vectors Miroslav Stampar 2010-12-03 11:05:16 +00:00
• 7690aa85ce Added a comment needed to understand this hack when looking at the code in a month or so ;) Bernardo Damele 2010-12-03 11:00:41 +00:00
• 0069a21a0d Added also OR error-based checks, tweaked some TODOs and added some new boundaries for login forms (yet to test) Bernardo Damele 2010-12-03 10:52:24 +00:00
• a9d4b37987 Code cleanup and minor refactoring Bernardo Damele 2010-12-03 10:51:27 +00:00
• 22de82634a Important update to parse correctly the <where> tag during exploitation phase. Minor code cleanup. Bernardo Damele 2010-12-03 10:44:16 +00:00
• 7d6f51f758 Avoid blank space between prefix and test's payload if it's a stacked queries test Bernardo Damele 2010-12-03 10:42:46 +00:00
• b0928e02c6 Proper comment Bernardo Damele 2010-12-03 10:39:36 +00:00
• 2cc167a42e fix for a bug reported by ToR: "AttributeError: 'NoneType' object has no attribute 'isdigit'" Miroslav Stampar 2010-12-02 18:57:43 +00:00
• bf09b8a6d9 added Firebird error based (WHERE) attack vector Miroslav Stampar 2010-12-02 15:09:21 +00:00
• 283a04e29a On my way to properly parse test's <where> tag in exploitation phase Bernardo Damele 2010-12-01 23:32:58 +00:00
• 09b265a1ea Got rid of conf.logic for the moment, haven't decided yet what to do with parenthesis check Bernardo Damele 2010-12-01 23:32:02 +00:00
• df4cb1a601 On the way to get full support for injection on ORDER BY and GROUP BY clauses Bernardo Damele 2010-12-01 23:30:38 +00:00
• 47f2d22181 Minor bug fix Bernardo Damele 2010-12-01 17:18:31 +00:00
• 089c16a1b8 Added tag <epayload> to the payloads.xml's <test> tag to define which payload to use when exploiting the test type. Removed some useless tests. Moved <error> from queries.xml to payloads.xml as it makes more sense. Beeps at sql inj found only if --beep is provided. Minor fix in order to be able to pickle advancedDict() objects. Minor code refactoring. Removed useless folders. Bernardo Damele 2010-12-01 17:09:52 +00:00
• c00ea7f5e5 Store and resume also UNION char to session file (--union-char) Bernardo Damele 2010-12-01 10:59:58 +00:00
• 025361c970 Higher precedence to union query sql inj than error-based Bernardo Damele 2010-12-01 10:57:17 +00:00
• 56d2b2f322 Avoid storing to session file also payload delimiters Bernardo Damele 2010-12-01 10:55:59 +00:00
• 2708aad504 Unified start and stop delimiters accross errror-based (detection engine) and union query (--union-test) tests. Bernardo Damele 2010-12-01 10:31:50 +00:00
• 8d84dcc5dc More sense Bernardo Damele 2010-12-01 09:17:17 +00:00
• c8f943f5e4 Now, if the back-end dbms type has been identified by the detection engine, skips the fingerprint phase. Major code refactoring and commenting to detection engine. Ask user whether or not to proceed to test remaining parameters after an injection point has been identified. Restore beep at SQL injection find. Avoid reuse of same variable in DBMS handler code. Minor adjustment of payloads XML file. Bernardo Damele 2010-11-30 22:40:25 +00:00
• fcdebbd55f cosmeticados Miroslav Stampar 2010-11-30 14:48:13 +00:00
• 47a7708950 minor improvement of dynamic content detection/removal part Miroslav Stampar 2010-11-30 12:45:42 +00:00
• 8b9706656e Got rid of unreliable 'ORDER BY' technique to detect UNION query SQL injection, consequently switch --union-tech has gone now. Minor code refactoring too. Bernardo Damele 2010-11-29 17:18:38 +00:00
• e9291932e5 Apply --level also to User-Agent (level >= 4) and Cookie (level >= 3). GET and POST parameters are always tested. Bernardo Damele 2010-11-29 16:33:20 +00:00
• e735f2960a minor update Miroslav Stampar 2010-11-29 15:25:45 +00:00
• c76d740a25 just a precaution Bernardo Damele 2010-11-29 15:21:56 +00:00
• 70e87d959e update of dynamicity engine Miroslav Stampar 2010-11-29 15:14:49 +00:00
• ee4e04ebca Minor adjustment Bernardo Damele 2010-11-29 15:09:40 +00:00
• 2efb3b78ea Consider also --dbms value during the detection phase Bernardo Damele 2010-11-29 14:48:07 +00:00
• be6df7abd9 improvement of dynamicity engine Miroslav Stampar 2010-11-29 14:30:57 +00:00
• 76ce9cc888 Minor bug fix for --forms Bernardo Damele 2010-11-29 12:46:18 +00:00
• 6525e08d6b Minor adjustment to detect the proper parameter type based upon --prefix and --suffix values Bernardo Damele 2010-11-29 12:13:42 +00:00
• c22338ce90 Removed --error-test, --stacked-test and --time-test switches and adapted the code accordingly. This is due to the fact that the new XML based detection engine already supports all of those tests (and more). Bernardo Damele 2010-11-29 11:47:58 +00:00
• e8c6c01e27 precaution Bernardo Damele 2010-11-29 09:54:30 +00:00
• 9d7087e2ff Proper saving and resuming when more than a parameter are injectable. Minor bug fix to --stacked-test Minor code refactoring. Bernardo Damele 2010-11-29 01:04:42 +00:00
• 75f7df75b6 Minor fix Bernardo Damele 2010-11-28 23:33:51 +00:00
• 472f4465a6 Prioritize DBMS fingerprint based on DBMS (<dbms>) identified during the detection phase. Minor bug fix to properly handle the case that no injections are found. Nicer display of injection vulnerabilities detected. Minor code refactoring. Bernardo Damele 2010-11-28 21:27:47 +00:00
• 7e3b24afe6 Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own. All (hopefully) functionalities should still be working. Added two switches, --level and --risk to specify which injection tests and boundaries to use. The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work! Bernardo Damele 2010-11-28 18:10:54 +00:00
• a8b38ba76b removed a trailer blank like (cosmetics) Miroslav Stampar 2010-11-24 14:25:16 +00:00
• 6712f4da55 some refactoring and one less request for aspx maintanance during --os-shell Miroslav Stampar 2010-11-24 14:20:43 +00:00
• 253eafb643 paranoid cosmetics Bernardo Damele 2010-11-24 12:03:01 +00:00
• b2b521fc8a gready regex bastard :) Miroslav Stampar 2010-11-24 12:01:36 +00:00
• 9579a97039 now ASPX works too for --os-shell Miroslav Stampar 2010-11-24 11:38:27 +00:00
• ca58bdbc66 minor update Miroslav Stampar 2010-11-24 10:54:15 +00:00
• c54c9ee5d1 minor update Miroslav Stampar 2010-11-23 22:33:00 +00:00
• 57ad59206b cosmetics as it's best Miroslav Stampar 2010-11-23 22:09:10 +00:00
• 7a147041c4 cosmetics Miroslav Stampar 2010-11-23 21:44:58 +00:00
• f4f0bc9db3 minor fix Miroslav Stampar 2010-11-23 21:17:01 +00:00
• f9f076ba97 code refactoring Miroslav Stampar 2010-11-23 21:00:42 +00:00
• 7877a931d5 more cosmetics regarding dictionary attack Miroslav Stampar 2010-11-23 20:54:40 +00:00
• e3b3e05748 minor update Miroslav Stampar 2010-11-23 19:21:30 +00:00
• 0d24a15182 more cosmetics Miroslav Stampar 2010-11-23 19:10:34 +00:00
• 836a1c214a los cosmeticados (of hash dictionary attack) Miroslav Stampar 2010-11-23 18:57:00 +00:00
• c4414df594 minor update Miroslav Stampar 2010-11-23 15:33:13 +00:00
• 78024eafe0 little precaution Miroslav Stampar 2010-11-23 15:31:23 +00:00
• 4af000e699 minor language update (in testing phase "used" is more preferable than "provided") Miroslav Stampar 2010-11-23 15:11:15 +00:00
• e32be2b4e7 Minor adjustment Bernardo Damele 2010-11-23 15:06:40 +00:00
• b41ee8d0d0 minor refactoring Miroslav Stampar 2010-11-23 14:57:36 +00:00
• aa5d038f18 more code refactoring Miroslav Stampar 2010-11-23 14:50:47 +00:00
• 3cae76627c code refactoring regarding dictionary attack Miroslav Stampar 2010-11-23 13:58:01 +00:00
• ba4ea32603 first working version of dictionary attack Miroslav Stampar 2010-11-23 13:24:02 +00:00
• c471b815cc fix for a bug reported by BugTrace (IndexError: list index out of range) Miroslav Stampar 2010-11-22 10:58:08 +00:00
• bfc9378542 sorry, even more proper naming should be like this (passwd is a standard naming for this kind of function(s)) Miroslav Stampar 2010-11-20 13:22:59 +00:00
• db59faedb9 more proper naming Miroslav Stampar 2010-11-20 13:20:28 +00:00
• 52c722dab5 renaming of dicts.zip to wordlists.zip (more proper name) Miroslav Stampar 2010-11-20 13:17:13 +00:00
• 1f8a9fe033 foundations for dictionary attack support combined with the sqlmap's password/hash retrieval functionality (--password switch) Miroslav Stampar 2010-11-20 13:14:13 +00:00
• 71107e4e9e quick fix for google searches Miroslav Stampar 2010-11-19 21:38:20 +00:00
• 99a23e23cf Extra check on --union-cols value Bernardo Damele 2010-11-19 16:39:26 +00:00
• da7eb329bb removing file Miroslav Stampar 2010-11-19 16:04:07 +00:00
• 1fa567e14d new file added (dictionary attack on password hashes - MySQL, MSSQL, Oracle and Posgres - is soon going to be a part of sqlmap) Miroslav Stampar 2010-11-19 15:51:56 +00:00