Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 09617c8

Browse files
stamparmstamparm
committed
Introducing extra validation property in case of time-based SQLi (HTTP code) - Issue #1973 
1 parent 556b4d2 commit 09617c8

6 files changed

Lines changed: 21 additions & 9 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ def checkSqlInjection(place, parameter, value):
156156
kb.testType = stype = test.stype
157157
clause = test.clause
158158
unionExtended = False
159+
trueCode = None
159160

160161
if stype == PAYLOAD.TECHNIQUE.UNION:
161162
configUnion(test.request.char)
@@ -556,6 +557,7 @@ def genCmpPayload():
556557
elif method == PAYLOAD.METHOD.TIME:
557558
# Perform the test's request
558559
trueResult = Request.queryPage(reqPayload, place, timeBasedCompare=True, raise404=False)
560+
trueCode = threadData.lastCode
559561

560562
if trueResult:
561563
# Confirm test's results
@@ -668,6 +670,7 @@ def genCmpPayload():
668670
injection.data[stype].comment = comment
669671
injection.data[stype].templatePayload = templatePayload
670672
injection.data[stype].matchRatio = kb.matchRatio
673+
injection.data[stype].trueCode = trueCode
671674

672675
injection.conf.textOnly = conf.textOnly
673676
injection.conf.titles = conf.titles

‎lib/core/settings.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.revision import getRevisionNumber
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.0.9.35"
22+
VERSION = "1.0.9.36"
2323
REVISION = getRevisionNumber()
2424
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2525
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
@@ -546,7 +546,7 @@
546546
HASHDB_END_TRANSACTION_RETRIES = 3
547547

548548
# Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism)
549-
HASHDB_MILESTONE_VALUE = "baFJusZrel" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
549+
HASHDB_MILESTONE_VALUE = "QWdDkLzhxH" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
550550

551551
# Warn user of possible delay due to large page dump in full UNION query injections
552552
LARGE_OUTPUT_THRESHOLD = 1024 ** 2

‎lib/core/threads.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ def reset(self):
4242
self.disableStdOut = False
4343
self.hashDBCursor = None
4444
self.inTransaction = False
45+
self.lastCode = None
4546
self.lastComparisonPage = None
4647
self.lastComparisonHeaders = None
4748
self.lastComparisonCode = None

‎lib/request/connect.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1140,6 +1140,7 @@ def _randomizeParameter(paramString, randomParameter):
11401140

11411141
threadData.lastQueryDuration = calculateDeltaSeconds(start)
11421142
threadData.lastPage = page
1143+
threadData.lastCode = code
11431144

11441145
kb.originalCode = kb.originalCode or code
11451146

‎lib/techniques/blind/inference.py‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -210,10 +210,17 @@ def validateChar(idx, value):
210210
unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(value))
211211
forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_NOT_EQUALS_CHAR), (expressionUnescaped, idx)).replace(markingValue, unescapedCharValue)
212212

213-
result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False)
213+
result = not Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False)
214+
215+
if result and timeBasedCompare:
216+
result = threadData.lastCode == kb.injection.data[kb.technique].trueCode
217+
if not result:
218+
warnMsg = "detected HTTP code '%d' in validation phase is differing from expected '%d'" % (threadData.lastCode, kb.injection.data[kb.technique].trueCode)
219+
singleTimeWarnMessage(warnMsg)
220+
214221
incrementCounter(kb.technique)
215222

216-
return not result
223+
return result
217224

218225
def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None, shiftTable=None, retried=None):
219226
"""

‎txt/checksum.md5‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ b46521e29ea3d813bab5aeb16cac6498 extra/shutils/duplicates.py
2020
cc9c82cfffd8ee9b25ba3af6284f057e extra/sqlharvest/__init__.py
2121
4f2f817596540d82f9fcc0c5b2228beb extra/sqlharvest/sqlharvest.py
2222
2daa39e4d59526acb4772b6c47eb315f lib/controller/action.py
23-
0b7074043c7ea07002e0ab4803811c9f lib/controller/checks.py
23+
af33b6f729a33235d0230e7b9af6b9cb lib/controller/checks.py
2424
7c5ba631796f12d6de9b667e4cc7812b lib/controller/controller.py
2525
0a64305c3b3a01a2fc3a5e6204f442f1 lib/controller/handler.py
2626
cc9c82cfffd8ee9b25ba3af6284f057e lib/controller/__init__.py
@@ -45,12 +45,12 @@ e60456db5380840a586654344003d4e6 lib/core/readlineng.py
4545
5ef56abb8671c2ca6ceecb208258e360 lib/core/replication.py
4646
99a2b496b9d5b546b335653ca801153f lib/core/revision.py
4747
7c15dd2777af4dac2c89cab6df17462e lib/core/session.py
48-
434f63a6f4943d675125459d54616653 lib/core/settings.py
48+
c007f8f0c5f3d8f7b801f33d0ec58448 lib/core/settings.py
4949
7af83e4f18cab6dff5e67840eb65be80 lib/core/shell.py
5050
23657cd7d924e3c6d225719865855827 lib/core/subprocessng.py
5151
0bc2fae1dec18cdd11954b22358293f2 lib/core/target.py
5252
d43f059747ffd48952922c94152e2a07 lib/core/testing.py
53-
424a6cf9bdfaf7182657ed7929d7df5a lib/core/threads.py
53+
7ec80da7d7fa8ceaf2ff606cfa578c15 lib/core/threads.py
5454
53c15b78e0288274f52410db25406432 lib/core/unescaper.py
5555
6bdc53e2ca152ff8cd35ad671e48a96b lib/core/update.py
5656
8485a3cd94c0a5af2718bad60c5f1ae5 lib/core/wordlist.py
@@ -68,7 +68,7 @@ b40a4c5d91770d347df36d3065b63798 lib/parse/sitemap.py
6868
9299f21804033f099681525bb9bf51c0 lib/request/basicauthhandler.py
6969
ca9879ea9277810c5fce0f0d8d2f8e03 lib/request/basic.py
7070
c48285682a61d49982cb508351013cb4 lib/request/comparison.py
71-
20fe3d96ae45cf46d19504415cebd819 lib/request/connect.py
71+
29148e4412209526b18acbd8a942fe03 lib/request/connect.py
7272
49b4c583af68689de5f9acb162de2939 lib/request/direct.py
7373
1a46f7bb26b23ec0c0d9d9c95828241b lib/request/dns.py
7474
70ceefe39980611494d4f99afb96f652 lib/request/httpshandler.py
@@ -87,7 +87,7 @@ cc9c82cfffd8ee9b25ba3af6284f057e lib/takeover/__init__.py
8787
7d6cd7bdfc8f4bc4e8aed60c84cdf87f lib/takeover/udf.py
8888
f6e3084abd506925a8be3d1c0a6d058c lib/takeover/web.py
8989
9af83a62de360184f1c14e69b8a95cfe lib/takeover/xp_cmdshell.py
90-
03b8c2028e996c471e45308fa518d79a lib/techniques/blind/inference.py
90+
004c45c172d549e098a5fd5285a54cb3 lib/techniques/blind/inference.py
9191
cc9c82cfffd8ee9b25ba3af6284f057e lib/techniques/blind/__init__.py
9292
cc9c82cfffd8ee9b25ba3af6284f057e lib/techniques/brute/__init__.py
9393
d36effffe64e63ef9b3be490f850e2cc lib/techniques/brute/use.py

0 commit comments

Comments
 (0)