Commit Graph

Select branches

Hide Pull Requests

gh-pages

master

#102

#102

#1029

#1033

#1037

#1053

#1053

#107

#107

#1112

#1186

#1206

#1227

#1227

#1244

#1244

#1246

#1246

#1300

#1300

#1306

#1306

#1323

#1323

#1328

#1330

#1342

#1342

#1351

#1378

#1378

#1402

#1403

#1403

#1414

#1449

#1449

#1469

#1469

#1500

#1535

#1543

#1565

#1565

#1611

#1611

#1614

#1637

#1678

#1681

#1681

#1700

#1700

#1710

#1727

#1727

#1728

#1732

#1733

#1735

#1740

#1762

#1762

#1763

#1763

#1776

#1776

#1795

#1795

#1805

#1805

#1843

#1843

#1856

#1856

#1898

#1922

#1922

#2011

#2086

#2089

#2134

#2138

#2169

#2169

#2170

#2240

#2250

#2289

#2289

#232

#232

#2323

#2347

#2347

#2350

#2350

#2359

#2369

#2369

#2374

#2378

#2389

#2389

#2397

#2397

#2401

#2410

#2411

#2417

#2417

#2418

#2420

#2420

#2439

#2480

#2481

#2481

#2506

#2506

#252

#252

#2537

#2555

#2590

#2597

#2613

#2613

#2616

#2616

#2618

#2620

#2663

#2663

#2666

#2666

#2667

#2667

#269

#269

#2690

#2690

#2692

#2692

#2695

#2728

#2731

#2732

#2732

#2733

#2733

#2734

#2734

#2742

#2742

#2751

#2751

#2752

#2752

#2756

#2756

#2761

#2782

#2791

#2807

#2807

#2817

#2817

#2823

#2823

#284

#284

#2883

#2883

#2903

#2903

#2904

#2904

#2905

#2905

#2906

#2906

#2931

#2933

#2933

#2951

#2967

#2992

#3009

#3009

#3087

#3087

#3116

#3153

#3153

#3174

#3174

#3188

#320

#320

#321

#321

#3231

#3233

#3233

#3236

#3267

#3267

#3274

#3274

#3316

#3322

#3323

#3326

#3349

#3350

#3351

#3352

#3372

#3376

#3383

#3396

#3398

#3407

#3414

#3416

#3418

#3423

#3432

#3437

#3442

#3443

#3445

#3458

#3472

#3479

#3482

#3488

#3527

#3536

#3573

#3574

#3575

#3579

#3590

#3609

#3645

#3684

#375

#375

#3802

#3855

#3856

#3881

#3896

#39

#39

#3917

#3952

#3955

#3958

#3959

#3965

#3966

#3969

#3970

#3992

#3996

#400

#400

#4007

#4022

#4032

#4033

#4034

#4039

#4041

#4058

#4059

#4077

#4092

#4098

#4099

#41

#41

#4121

#413

#413

#4145

#4146

#4184

#4192

#4198

#4205

#4216

#4218

#4219

#4229

#4243

#4266

#4267

#4279

#4291

#4305

#4323

#4326

#4327

#4344

#4347

#4365

#4374

#4378

#4379

#4385

#4387

#4427

#4429

#4431

#4460

#4501

#4506

#4509

#4573

#4586

#4619

#4620

#4632

#4632

#4633

#4635

#4635

#4643

#4644

#4656

#4657

#466

#466

#4663

#4687

#4691

#4692

#47

#47

#4701

#4732

#4740

#475

#475

#4750

#4815

#4832

#4833

#4833

#4852

#4878

#4918

#4937

#4964

#4975

#4983

#4992

#4998

#5006

#5013

#5021

#5032

#5038

#5055

#5059

#506

#506

#507

#507

#5070

#5095

#5109

#5111

#512

#512

#5127

#5128

#5143

#5156

#5172

#5175

#5175

#5176

#5189

#5198

#5206

#5215

#5229

#5235

#5253

#5260

#5266

#5273

#5288

#53

#53

#530

#530

#5300

#5302

#5305

#5311

#5345

#5354

#5354

#5355

#5356

#536

#536

#5361

#5366

#5377

#5384

#539

#539

#5393

#5395

#5410

#5436

#5436

#5439

#5439

#544

#544

#5443

#5443

#5459

#5475

#5478

#5478

#5490

#5497

#5501

#5507

#5551

#5552

#5553

#5554

#5555

#5556

#5569

#5580

#5586

#5588

#5590

#5592

#5597

#5598

#5599

#5603

#5604

#5609

#5617

#5621

#5625

#5649

#5658

#5665

#5667

#5677

#5679

#5685

#5685

#5687

#5688

#5690

#5692

#5693

#5699

#5702

#5706

#5715

#5721

#5736

#5750

#5751

#5760

#5764

#5765

#5777

#578

#5820

#5821

#5824

#5825

#5825

#583

#5840

#5841

#5842

#5842

#5845

#5849

#5849

#5852

#5859

#5860

#5864

#5869

#5871

#5873

#5874

#5877

#5878

#5881

#5883

#5890

#5893

#5910

#5913

#5923

#5923

#5930

#5931

#5932

#5940

#5944

#5945

#5945

#5952

#5953

#5957

#5959

#5963

#5963

#5965

#5967

#5970

#5973

#5973

#5980

#5984

#5985

#5995

#5999

#6000

#6001

#6004

#6004

#63

#672

#672

#682

#682

#684

#686

#701

#713

#713

#714

#73

#73

#74

#74

#744

#749

#756

#766

#766

#779

#803

#835

#848

#848

#855

#855

#86

#86

#952

#973

#977

#977

#98

#98

#99

#99

0.19

0.6.2

0.6.3

0.6.4

0.7

0.7-rc1

0.8

0.8-rc2

0.8-rc3

0.8-rc4

0.9

1.0

1.0.10

1.0.11

1.0.12

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.10

1.2

1.2.10

1.2.11

1.2.12

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3

1.3.10

1.3.11

1.3.12

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4

1.4.10

1.4.11

1.4.12

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5

1.5.10

1.5.11

1.5.12

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6

1.6.10

1.6.11

1.6.12

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.7

1.7.1

1.7.10

1.7.11

1.7.12

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8

1.8.1

1.8.10

1.8.11

1.8.12

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9

1.9.10

1.9.11

1.9.12

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

Mono Color

• c6545f5c9f we had a bug (nooooooooo!!!! :)) Miroslav Stampar 2010-11-19 10:36:47 +00:00
• df88280681 minor update of google regex (that * was a junky one) Miroslav Stampar 2010-11-19 10:04:29 +00:00
• e8bef28337 updating google parsing regex (for the better, of course) Miroslav Stampar 2010-11-19 10:00:29 +00:00
• d97e97d884 minor update :) Miroslav Stampar 2010-11-19 09:02:44 +00:00
• 4a9bd3a240 Finally a proper union query SQL injection test engine for --union-test. It does much more requests, but for god sake now it works well! Bernardo Damele 2010-11-18 17:55:43 +00:00
• 544327379f Little precaution Bernardo Damele 2010-11-18 14:32:52 +00:00
• f6a17cb1a8 Revert wrong fix Bernardo Damele 2010-11-18 10:41:06 +00:00
• 17486e472a Proper english (--postfix is now --suffix) and --string/--regexp does not necessarily need to match into the original response body, it might well be in the injected True condition only! Bernardo Damele 2010-11-17 22:00:09 +00:00
• ca5125bbe0 minor update related to r2401 Miroslav Stampar 2010-11-17 20:50:31 +00:00
• 360aff7a4d sqlite3 library is not part of Gentoo (perhaps others) Python packages or installation bundle Bernardo Damele 2010-11-17 17:20:32 +00:00
• a0df36beda when in multi target mode this should be done (another bug was reported by ToR for using "old" data - kb was not properly cleared) Miroslav Stampar 2010-11-17 15:33:07 +00:00
• 17f0609263 minor bug fix Miroslav Stampar 2010-11-17 13:29:57 +00:00
• 3d25071d06 another minor improvement regarding logging of http traffic Miroslav Stampar 2010-11-17 12:16:48 +00:00
• 3e569a1693 minor update Miroslav Stampar 2010-11-17 12:04:33 +00:00
• 2802923dbe some improvements regarding --os-shell web server application choice Miroslav Stampar 2010-11-17 11:45:52 +00:00
• 5abbea4a9f fix for a bug reported by nightman (unknown charset 'null') Miroslav Stampar 2010-11-17 09:57:32 +00:00
• d757e4ae1c bug fix (when user manually sets web root, that same directory should be used as one of potentionaly default dirs) Miroslav Stampar 2010-11-17 09:46:04 +00:00
• bec152609a minor cosmetics and bug fix for Windows machines ('\\' is interpreted as \ and inside the script it can screw things up as it's a marker for a special character - thus '\\\\' is interpreted as \\ which represents special character \) Miroslav Stampar 2010-11-17 09:33:05 +00:00
• af92c05930 removing 'MD5' referings Miroslav Stampar 2010-11-17 09:15:40 +00:00
• 76c3f5768b cosmetics Miroslav Stampar 2010-11-17 09:12:48 +00:00
• 2a8e270bef proper handling of carriage return character from Windows target machines Miroslav Stampar 2010-11-16 15:11:03 +00:00
• ab33651f96 minor bug fix for displaying text from windows machines (\r was interfering with normal dataToStdout behavior) Miroslav Stampar 2010-11-16 15:02:22 +00:00
• 3487429eac minor cosmetics Miroslav Stampar 2010-11-16 14:41:46 +00:00
• 3640dbf745 fix for --parse-errors (on IIS HTTP error is raised which need to be processed) Miroslav Stampar 2010-11-16 14:33:30 +00:00
• cccb565859 cosmetics Miroslav Stampar 2010-11-16 14:11:32 +00:00
• b9d9f18939 added General cmdline group Miroslav Stampar 2010-11-16 14:09:09 +00:00
• e7a66371f8 update regarding os shell-ing regarding JSP and ASPX Miroslav Stampar 2010-11-16 13:46:46 +00:00
• 6232397129 minor update Miroslav Stampar 2010-11-16 10:52:49 +00:00
• 6ef3846400 update regarding error parsing (and reporting) Miroslav Stampar 2010-11-16 10:42:42 +00:00
• 71cb982039 Another bug fix to --union-test Bernardo Damele 2010-11-15 21:42:56 +00:00
• b3ad63b71e major bug fix (haven't applied dynamic content removal to the original comparison (conf.seqMatcher.a) page) Miroslav Stampar 2010-11-15 14:59:37 +00:00
• ff310475c8 some reporting update for --forms Miroslav Stampar 2010-11-15 14:17:51 +00:00
• 20d6b9a5c1 minor fix Miroslav Stampar 2010-11-15 12:24:32 +00:00
• 39c6c9f386 minor update Miroslav Stampar 2010-11-15 12:19:22 +00:00
• 819085155e minor update/fix Miroslav Stampar 2010-11-15 12:07:13 +00:00
• c25c017c08 cosmetics regarding --forms Miroslav Stampar 2010-11-15 11:50:33 +00:00
• 36c544f440 update (--forms acts now more like -g switch) Miroslav Stampar 2010-11-15 11:34:57 +00:00
• 42d09d604e minor fix Miroslav Stampar 2010-11-15 09:48:58 +00:00
• a9152c6723 Updated doc Bernardo Damele 2010-11-14 22:36:54 +00:00
• 5f46a549ba Cosmetics for --forms Bernardo Damele 2010-11-14 21:59:35 +00:00
• 0bfc1b411a Another bug fix for --union-test Bernardo Damele 2010-11-14 15:39:57 +00:00
• a0fb96816f fix for a bug reported by ToR (value += actVer) Miroslav Stampar 2010-11-14 08:31:29 +00:00
• 5e41cd07a3 Updated doc Bernardo Damele 2010-11-13 23:31:18 +00:00
• 7da079fa32 More verbose comment for direct connection Bernardo Damele 2010-11-13 23:30:38 +00:00
• 8d07272c82 Added --union-cols switch to specify the max number of columns to test for UNION query sql injection. Now stores/resumes also the exact UNION payload to session file. Bernardo Damele 2010-11-13 23:24:41 +00:00
• df5dc10111 Major enhancement to --union-test check Bernardo Damele 2010-11-13 22:47:37 +00:00
• 84849316b3 improvement of heuristic check (now original value is included too) Miroslav Stampar 2010-11-12 23:06:01 +00:00
• 06a872fc99 update/fix for an issue reported by nightman (IncompleteRead: IncompleteRead(1284 bytes read)) Miroslav Stampar 2010-11-12 22:57:33 +00:00
• 27735b14df update (--string and --regex should be done regardless of wasLastRequestError) Miroslav Stampar 2010-11-12 22:44:15 +00:00
• 0d66f101da fix for a bug reported by Bugtrace (--string "pengcheng_cui" and "Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource" on False pages) Miroslav Stampar 2010-11-12 22:29:33 +00:00
• a777d59870 Minor bug fix Bernardo Damele 2010-11-12 15:17:12 +00:00
• 0a83a830d9 Properly handle both HTTPS and HTTP requests through proxy Bernardo Damele 2010-11-12 14:21:46 +00:00
• e1ef27f592 work-around to be able to pass in the -r request file the Host header, the ending string ":443" and so sqlmap will go over https Bernardo Damele 2010-11-12 12:25:02 +00:00
• 9f53048ff4 Put a space always between the user's provided prefix and sqlmap payload Bernardo Damele 2010-11-12 11:48:26 +00:00
• 697b32554c fix for a bug "ordinal not in range(128)" reported by bugtrace Miroslav Stampar 2010-11-12 11:48:25 +00:00
• f83dd2251b Properly save error-based enumerated data in session file, able to be resumed like with other techniques Bernardo Damele 2010-11-12 11:40:37 +00:00
• a34c1b287c Bug fix related to properly identify and parse the version from the banner (used for --stacked-test and other matters on MySQL/PgSQL) Bernardo Damele 2010-11-12 11:33:11 +00:00
• 8cec75656c Bug fix to properly save the match ratio only if numeric (to avoid also tracebacks when match is based on --string or --regexp) Bernardo Damele 2010-11-12 10:31:42 +00:00
• a14e4d9668 Referer does not have to be static, it's already a switch (--referer) so that user can specify it manually. Bernardo Damele 2010-11-12 10:16:39 +00:00
• 64b5de44a0 Converted to new XML object format Bernardo Damele 2010-11-12 10:11:13 +00:00
• 66c82d72e4 Typo fix Bernardo Damele 2010-11-12 10:02:02 +00:00
• 306e96331d Updated doc Bernardo Damele 2010-11-12 10:00:49 +00:00
• 42272ca78c minor update Miroslav Stampar 2010-11-11 22:26:36 +00:00
• 8aefd0bbf7 improvement of --common-tables and --common-columns Miroslav Stampar 2010-11-11 20:37:25 +00:00
• 2d872f850a quick fix Miroslav Stampar 2010-11-11 19:54:54 +00:00
• be992b4471 update regarding common columns existance check Miroslav Stampar 2010-11-11 17:09:31 +00:00
• 3b996c3ed8 adding JSP stager Miroslav Stampar 2010-11-11 16:42:01 +00:00
• 2d361cb359 some minor updates of stager.asp and backdoor.asp, and completely rewritten stager.aspx Miroslav Stampar 2010-11-11 10:33:29 +00:00
• 24238ccd0b re-renaming of brute force switches. this way is better. Miroslav Stampar 2010-11-11 07:57:44 +00:00
• ca06db8f28 now, this is the real deal Miroslav Stampar 2010-11-11 00:20:47 +00:00
• 5034868b36 cleaning up of common tables and new common columns Miroslav Stampar 2010-11-10 23:31:23 +00:00
• 96d88877ba bug fix (reported by ToR) Miroslav Stampar 2010-11-10 19:44:51 +00:00
• f3fe19c4e5 backdoor for ASP revisited Miroslav Stampar 2010-11-10 15:40:17 +00:00
• 09836dc568 backdoor for ASPX revisited Miroslav Stampar 2010-11-10 15:35:22 +00:00
• 61b6ad64e3 JSP backdoor revisited, and in PHP removed trailing spaces from a blank line Miroslav Stampar 2010-11-10 15:13:36 +00:00
• 19c1bfa368 just a precaution (now i really need to go for a sleep) Miroslav Stampar 2010-11-09 23:38:29 +00:00
• 88c00e61d3 another update Miroslav Stampar 2010-11-09 23:35:37 +00:00
• 47720a43dd minor fix (while we've calculated conf.matchRation for stable pages, we've put a constant value (0.900) for dynamic ones - so putting (ratio - conf.matchRatio) > DIFF_TOLERANCE for dynamic pages too would just effectively increase it's value to 0.900 + DIFF_TOLERANCE (in our case to 0.950) which is too narrow space for True result) Miroslav Stampar 2010-11-09 23:21:21 +00:00
• 5ebd5d935c another name change Miroslav Stampar 2010-11-09 22:49:31 +00:00
• 06f00cf8c1 name change Miroslav Stampar 2010-11-09 22:48:22 +00:00
• 6807fb04cc minor update Miroslav Stampar 2010-11-09 22:44:23 +00:00
• fef60d5cb7 some fixes :) Miroslav Stampar 2010-11-09 22:32:05 +00:00
• 1cc99e2247 Possible quick fix for missing of True/False comparison of stable-but-not-really pages Bernardo Damele 2010-11-09 21:39:58 +00:00
• 2205099a5e Python stylish Bernardo Damele 2010-11-09 21:39:05 +00:00
• cee888b613 tuning detection engine (None results from queryPage/comparison should not be treated as False in checkSqlInjection routine - None is returned when error is detected) Miroslav Stampar 2010-11-09 19:14:55 +00:00
• 726825ca70 minor update Miroslav Stampar 2010-11-09 16:59:36 +00:00
• 759433f0f1 fix of my mistake Miroslav Stampar 2010-11-09 16:54:40 +00:00
• b43334165d update regarding brute forcing Miroslav Stampar 2010-11-09 16:53:33 +00:00
• a7fa8d4975 update regarding brute force retrieval of table names and table column names Miroslav Stampar 2010-11-09 16:15:55 +00:00
• 45f2d8f5d2 trival update Miroslav Stampar 2010-11-09 15:46:09 +00:00
• 7752b5efe9 minor update Miroslav Stampar 2010-11-09 09:51:54 +00:00
• 4be0631161 refactoring of brute force techniques Miroslav Stampar 2010-11-09 09:42:43 +00:00
• 221f976fbd minor update Miroslav Stampar 2010-11-09 01:23:54 +00:00
• 45ec8c169a Consistency between --*-test switches/output Bernardo Damele 2010-11-08 16:46:25 +00:00
• dac7436edf Fix inconsistence with -b --error-test Bernardo Damele 2010-11-08 15:36:07 +00:00
• fda8752dca revert of some HTTP headers handling Miroslav Stampar 2010-11-08 13:26:45 +00:00
• 0c8918bf07 Minor bug fix, thanks Alex Bernardo Damele 2010-11-08 12:45:23 +00:00
• 78d7b17483 More replacements for refactoring. Minor layout adjustments. Alignment of conffile/optiondict/cmdline parameters. Bernardo Damele 2010-11-08 12:36:48 +00:00
• eb999de0f1 added Range handler (dealing with 206 HTTP messages) Miroslav Stampar 2010-11-08 12:26:13 +00:00
• 875781bf97 another minor fix Miroslav Stampar 2010-11-08 11:55:56 +00:00