Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 38f16de

Browse files
stamparmstamparm
committed
Update for an Issue #2384 
1 parent 15f86e8 commit 38f16de

6 files changed

Lines changed: 40 additions & 11 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
from lib.core.common import extractTextTagContent
2121
from lib.core.common import findDynamicContent
2222
from lib.core.common import Format
23+
from lib.core.common import getFilteredPageContent
2324
from lib.core.common import getLastRequestHTTPError
2425
from lib.core.common import getPublicTypeMembers
2526
from lib.core.common import getSafeExString
@@ -63,6 +64,7 @@
6364
from lib.core.exception import SqlmapNoneDataException
6465
from lib.core.exception import SqlmapSilentQuitException
6566
from lib.core.exception import SqlmapUserQuitException
67+
from lib.core.settings import CANDIDATE_SENTENCE_MIN_LENGTH
6668
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
6769
from lib.core.settings import DUMMY_NON_SQLI_CHECK_APPENDIX
6870
from lib.core.settings import FI_ERROR_REGEX
@@ -478,6 +480,26 @@ def genCmpPayload():
478480

479481
injectable = True
480482

483+
elif threadData.lastComparisonRatio > UPPER_RATIO_BOUND and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
484+
originalSet = set(getFilteredPageContent(kb.pageTemplate, True, "\n").split("\n"))
485+
trueSet = set(getFilteredPageContent(truePage, True, "\n").split("\n"))
486+
falseSet = set(getFilteredPageContent(falsePage, True, "\n").split("\n"))
487+
488+
if originalSet == trueSet != falseSet:
489+
candidates = trueSet - falseSet
490+
491+
if candidates:
492+
candidates = sorted(candidates, key=lambda _: len(_))
493+
for candidate in candidates:
494+
if re.match(r"\A[\w.,! ]+\Z", candidate) and ' ' in candidate and len(candidate) > CANDIDATE_SENTENCE_MIN_LENGTH:
495+
conf.string = candidate
496+
injectable = True
497+
498+
infoMsg = "%s parameter '%s' appears to be '%s' injectable (with --string=\"%s\")" % (paramType, parameter, title, repr(conf.string).lstrip('u').strip("'"))
499+
logger.info(infoMsg)
500+
501+
break
502+
481503
if injectable:
482504
if kb.pageStable and not any((conf.string, conf.notString, conf.regexp, conf.code, kb.nullConnection)):
483505
if all((falseCode, trueCode)) and falseCode != trueCode:

‎lib/core/common.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1755,7 +1755,7 @@ def safeStringFormat(format_, params):
17551755
break
17561756
return retVal
17571757

1758-
def getFilteredPageContent(page, onlyText=True):
1758+
def getFilteredPageContent(page, onlyText=True, split=" "):
17591759
"""
17601760
Returns filtered page content without script, style and/or comments
17611761
or all HTML tags
@@ -1768,10 +1768,10 @@ def getFilteredPageContent(page, onlyText=True):
17681768

17691769
# only if the page's charset has been successfully identified
17701770
if isinstance(page, unicode):
1771-
retVal = re.sub(r"(?si)<script.+?</script>|<!--.+?-->|<style.+?</style>%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), " ", page)
1772-
while retVal.find(" ") != -1:
1773-
retVal = retVal.replace(" ", " ")
1774-
retVal = htmlunescape(retVal.strip())
1771+
retVal = re.sub(r"(?si)<script.+?</script>|<!--.+?-->|<style.+?</style>%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), split, page)
1772+
while retVal.find(2 * split) != -1:
1773+
retVal = retVal.replace(2 * split, split)
1774+
retVal = htmlunescape(retVal.strip().strip(split))
17751775

17761776
return retVal
17771777

‎lib/core/settings.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.1.2.3"
22+
VERSION = "1.1.2.4"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -359,6 +359,9 @@
359359
# Maximum value for comparison ratio
360360
MAX_RATIO = 1.0
361361

362+
# Minimum length of sentence for automatic choosing of --string (in case of high matching ratio)
363+
CANDIDATE_SENTENCE_MIN_LENGTH = 10
364+
362365
# Character used for marking injectable position inside provided data
363366
CUSTOM_INJECTION_MARK_CHAR = '*'
364367

‎lib/core/threads.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ def reset(self):
4646
self.lastComparisonPage = None
4747
self.lastComparisonHeaders = None
4848
self.lastComparisonCode = None
49+
self.lastComparisonRatio = None
4950
self.lastErrorPage = None
5051
self.lastHTTPError = None
5152
self.lastRedirectMsg = None

‎lib/request/comparison.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,9 @@ def _comparison(page, headers, code, getRatioValue, pageLength):
144144
kb.matchRatio = ratio
145145
logger.debug("setting match ratio for current parameter to %.3f" % kb.matchRatio)
146146

147+
if kb.testMode:
148+
threadData.lastComparisonRatio = ratio
149+
147150
# If it has been requested to return the ratio and not a comparison
148151
# response
149152
if getRatioValue:

‎txt/checksum.md5‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ c55b400b72acc43e0e59c87dd8bb8d75 extra/shellcodeexec/windows/shellcodeexec.x32.
2020
310efc965c862cfbd7b0da5150a5ad36 extra/sqlharvest/__init__.py
2121
7713aa366c983cdf1f3dbaa7383ea9e1 extra/sqlharvest/sqlharvest.py
2222
5df358defc488bee9b40084892e3d1cb lib/controller/action.py
23-
699fd4757390aedb5ad17f4316d17972 lib/controller/checks.py
23+
9cb94acd4c59822a5e1a258c4d1a4860 lib/controller/checks.py
2424
fa72e4d6eda241725d90738d61e7d55d lib/controller/controller.py
2525
b3eec7f44bcc5d784d171a187b7fe8cb lib/controller/handler.py
2626
310efc965c862cfbd7b0da5150a5ad36 lib/controller/__init__.py
2727
19905ecb4437b94512cf21d5f1720091 lib/core/agent.py
2828
6cc95a117fbd34ef31b9aa25520f0e31 lib/core/bigarray.py
29-
9ca4206c06f8a2a859b076ab7520c3ea lib/core/common.py
29+
15c19630897cff73744fb2866719d1e9 lib/core/common.py
3030
5065a4242a8cccf72f91e22e1007ae63 lib/core/convert.py
3131
a8143dab9d3a27490f7d49b6b29ea530 lib/core/data.py
3232
7936d78b1a7f1f008ff92bf2f88574ba lib/core/datatype.py
@@ -45,12 +45,12 @@ e544108e2238d756c94a240e8a1ce061 lib/core/optiondict.py
4545
d8e9250f3775119df07e9070eddccd16 lib/core/replication.py
4646
785f86e3f963fa3798f84286a4e83ff2 lib/core/revision.py
4747
40c80b28b3a5819b737a5a17d4565ae9 lib/core/session.py
48-
38927d9aadc879d0ee2493813ee288b7 lib/core/settings.py
48+
bb7501fea707b51516519ea84f42de7d lib/core/settings.py
4949
d91291997d2bd2f6028aaf371bf1d3b6 lib/core/shell.py
5050
2ad85c130cc5f2b3701ea85c2f6bbf20 lib/core/subprocessng.py
5151
afd0636d2e93c23f4f0a5c9b6023ea17 lib/core/target.py
5252
8970b88627902239d695280b1160e16c lib/core/testing.py
53-
1504e8c6bdd69edc17b5f240eaa73fb2 lib/core/threads.py
53+
5521241c750855a4e44747fbac7771c6 lib/core/threads.py
5454
ad74fc58fc7214802fd27067bce18dd2 lib/core/unescaper.py
5555
1f1fa616b5b19308d78c610ec8046399 lib/core/update.py
5656
4d13ed693401a498b6d073a2a494bd83 lib/core/wordlist.py
@@ -66,7 +66,7 @@ ad74fc58fc7214802fd27067bce18dd2 lib/core/unescaper.py
6666
a0444cc351cd6d29015ad16d9eb46ff4 lib/parse/sitemap.py
6767
403d873f1d2fd0c7f73d83f104e41850 lib/request/basicauthhandler.py
6868
6d04ee525e75bf0082e9f1f6d8506546 lib/request/basic.py
69-
4e89d0e13de2eb3576f5412b21e9b648 lib/request/comparison.py
69+
ef48de622b0a6b4a71df64b0d2785ef8 lib/request/comparison.py
7070
1d4955fa22ca6ba17ce4fc2e0d93f1e2 lib/request/connect.py
7171
fb6b788d0016ab4ec5e5f661f0f702ad lib/request/direct.py
7272
cc1163d38e9b7ee5db2adac6784c02bb lib/request/dns.py

0 commit comments

Comments
 (0)