Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3f84cef

Browse files
bdamelebdamele
committed
Merge branch 'master' of github.com:sqlmapproject/sqlmap
2 parents 1cafe60 + 04aa39f commit 3f84cef

6 files changed

Lines changed: 26 additions & 36 deletions

File tree

‎lib/request/connect.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -736,7 +736,9 @@ def _randomizeParameter(paramString, randomParameter):
736736
else:
737737
get += "%s%s=%s" % (delimiter, name, value)
738738

739-
get = urlencode(get, limit=True)
739+
if not skipUrlEncode:
740+
get = urlencode(get, limit=True)
741+
740742
if post is not None:
741743
if place not in (PLACE.POST, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE):
742744
post = getattr(post, UNENCODED_ORIGINAL_VALUE)

‎lib/techniques/error/use.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,8 @@ def _oneShotErrorUse(expression, field=None):
119119
threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE)
120120

121121
if trimmed:
122-
warnMsg = "possible server trimmed output detected (due to its length): "
122+
warnMsg = "possible server trimmed output detected "
123+
warnMsg += "(due to its length and/or content): "
123124
warnMsg += safecharencode(trimmed)
124125
logger.warn(warnMsg)
125126

‎lib/techniques/union/use.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,8 @@ def _(regex):
102102
trimmed = _("%s(?P<result>.*?)<" % (kb.chars.start))
103103

104104
if trimmed:
105-
warnMsg = "possible server trimmed output detected (probably due to its length): "
105+
warnMsg = "possible server trimmed output detected "
106+
warnMsg += "(probably due to its length and/or content): "
106107
warnMsg += safecharencode(trimmed)
107108
logger.warn(warnMsg)
108109

‎lib/utils/xrange.py‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,18 @@
77

88
class xrange(object):
99
"""
10-
Advanced implementation of xrange (supports slice/copy/etc.)
10+
Advanced (re)implementation of xrange (supports slice/copy/etc.)
1111
Reference: http://code.activestate.com/recipes/521885-a-pythonic-implementation-of-xrange/
1212
"""
1313

1414
__slots__ = ['_slice']
1515

1616
def __init__(self, *args):
17-
if args and isinstance(args[0], xrange):
17+
if args and isinstance(args[0], type(self)):
1818
self._slice = slice(args[0].start, args[0].stop, args[0].step)
1919
else:
2020
self._slice = slice(*args)
2121
if self._slice.stop is None:
22-
# slice(*args) will never put None in stop unless it was
23-
# given as None explicitly.
2422
raise TypeError("xrange stop must not be None")
2523

2624
@property
@@ -47,7 +45,7 @@ def __cmp__(self, other):
4745
cmp(self._slice, other._slice))
4846

4947
def __repr__(self):
50-
return '%s(%r, %r, %r)' % (self.__class__.__name__,
48+
return '%s(%r, %r, %r)' % (type(self).__name__,
5149
self.start, self.stop, self.step)
5250

5351
def __len__(self):

‎xml/livetests.xml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2003,8 +2003,8 @@
20032003
</case>
20042004
<!-- End of operating system access switches -->
20052005

2006-
<!-- Technique switches and corner cases -->
2007-
<case name="MySQL 4 time-based against unresponsive page">
2006+
<!-- Corner cases -->
2007+
<case name="Time-based (heavy query)">
20082008
<switches>
20092009
<url value="http://debiandev/sqlmap/mysql/get_int_benchmark.php?id=1"/>
20102010
<tech value="T"/>
@@ -2017,7 +2017,7 @@
20172017
<item value="Title: MySQL &lt; 5.0.12 AND time-based blind (heavy query)"/>
20182018
</parse>
20192019
</case>
2020-
<case name="MySQL OR boolean-based multi-threaded enumeration">
2020+
<case name="OR boolean-based">
20212021
<switches>
20222022
<url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
20232023
<threads value="4"/>
@@ -2032,7 +2032,7 @@
20322032
<item value="current user is DBA: True"/>
20332033
</parse>
20342034
</case>
2035-
<case name="MySQL against page protected by custom weak filter">
2035+
<case name="Page protected by custom (weak) filter">
20362036
<switches>
20372037
<url value="http://debiandev/sqlmap/mysql/get_int_filtered.php?id=1"/>
20382038
<tech value="BE"/>
@@ -2043,7 +2043,7 @@
20432043
<item value="Title: MySQL &gt;= 5.1 error-based - Parameter replace (EXTRACTVALUE)"/>
20442044
</parse>
20452045
</case>
2046-
<case name="MySQL injection in GROUP BY clause">
2046+
<case name="GROUP BY clause">
20472047
<switches>
20482048
<url value="http://debiandev/sqlmap/mysql/get_int_groupby.php?id=1"/>
20492049
<tech value="B"/>
@@ -2053,7 +2053,7 @@
20532053
<item value="MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)"/>
20542054
</parse>
20552055
</case>
2056-
<case name="MySQL boolean-based multi-threaded enumeration - international data">
2056+
<case name="International data">
20572057
<switches>
20582058
<url value="http://debiandev/sqlmap/mysql/get_int_international.php?id=1"/>
20592059
<threads value="4"/>
@@ -2068,7 +2068,7 @@
20682068
<item value="r'Database: testdb.+Table: international.+3 entries.+šućuraj.+река Москва'"/>
20692069
</parse>
20702070
</case>
2071-
<case name="MySQL against highly dynamic page">
2071+
<case name="Highly dynamic page">
20722072
<switches>
20732073
<url value="http://debiandev/sqlmap/mysql/get_int_rand.php?id=1"/>
20742074
<timeSec value="2"/>
@@ -2080,7 +2080,7 @@
20802080
<item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
20812081
</parse>
20822082
</case>
2083-
<case name="MySQL against a page that returns a 302 redirect page when SQL statement return no output">
2083+
<case name="302 redirect page when SQL statement return no output">
20842084
<switches>
20852085
<url value="http://debiandev/sqlmap/mysql/get_int_redirected.php?id=1"/>
20862086
<timeSec value="2"/>
@@ -2091,7 +2091,7 @@
20912091
<item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
20922092
</parse>
20932093
</case>
2094-
<case name="MySQL against a page that returns an image">
2094+
<case name="Page that returns an image">
20952095
<switches>
20962096
<url value="http://debiandev/sqlmap/mysql/get_int_img.php?id=1"/>
20972097
<tech value="BT"/>
@@ -2102,7 +2102,7 @@
21022102
<item value="Title: MySQL &gt; 5.0.11 AND time-based blind"/>
21032103
</parse>
21042104
</case>
2105-
<case name="MySQL against a page that returns a 302 redirect page when SQL statement returns output">
2105+
<case name="302 redirect page when SQL statement returns output">
21062106
<switches>
21072107
<url value="http://debiandev/sqlmap/mysql/get_int_redirected_true.php?id=1"/>
21082108
<tech value="E"/>
@@ -2111,7 +2111,7 @@
21112111
<item value="Title: MySQL &gt;= 5.0 AND error-based - WHERE or HAVING clause"/>
21122112
</parse>
21132113
</case>
2114-
<case name="MySQL partial UNION query multi-threaded enumeration - invalid bignum">
2114+
<case name="Invalid bignum">
21152115
<switches>
21162116
<url value="http://debiandev/sqlmap/mysql/get_int_partialunion.php?id=1"/>
21172117
<tech value="U"/>
@@ -2126,7 +2126,7 @@
21262126
<item value="current user is DBA: True"/>
21272127
</parse>
21282128
</case>
2129-
<case name="MySQL partial UNION query multi-threaded enumeration - invalid logical">
2129+
<case name="Invalid logical">
21302130
<switches>
21312131
<url value="http://debiandev/sqlmap/mysql/get_int_partialunion.php?id=1"/>
21322132
<tech value="U"/>
@@ -2141,10 +2141,10 @@
21412141
<item value="current user is DBA: True"/>
21422142
</parse>
21432143
</case>
2144-
<!-- End of technique switches -->
2144+
<!-- End of corner cases -->
21452145

21462146
<!-- Other switches -->
2147-
<case name="MySQL error-based HTTP basic authentication">
2147+
<case name="HTTP basic authentication">
21482148
<switches>
21492149
<url value="http://debiandev/sqlmap/mysql/basic/get_int.php?id=1"/>
21502150
<tech value="E"/>
@@ -2156,7 +2156,7 @@
21562156
<item value="banner: '5.1.66-0+squeeze1'"/>
21572157
</parse>
21582158
</case>
2159-
<case name="MySQL error-based HTTP digest authentication">
2159+
<case name="HTTP digest authentication">
21602160
<switches>
21612161
<url value="http://debiandev/sqlmap/mysql/digest/get_int.php?id=1"/>
21622162
<tech value="E"/>
@@ -2168,7 +2168,7 @@
21682168
<item value="banner: '5.1.66-0+squeeze1'"/>
21692169
</parse>
21702170
</case>
2171-
<case name="MySQL boolean-based predict output enumeration">
2171+
<case name="Predict output enumeration">
21722172
<switches>
21732173
<verbose value="2"/>
21742174
<url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>

‎xml/queries.xml‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,6 @@
1515
<order query="ORDER BY %s ASC"/>
1616
<count query="COUNT(%s)"/>
1717
<comment query="-- " query2="/*" query3="#"/>
18-
<!--
19-
NOTE: MySQL 5.0.12 introduced SLEEP() function
20-
References:
21-
* http://dev.mysql.com/doc/refman/5.0/en/news-5-0-12.html
22-
* http://dev.mysql.com/doc/refman/5.1/en/miscellaneous-functions.html#function_sleep
23-
-->
2418
<substring query="MID((%s),%d,%d)"/>
2519
<concatenate query="CONCAT(%s,%s)"/>
2620
<case query="SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)"/>
@@ -89,12 +83,6 @@
8983
<order query="ORDER BY %s ASC"/>
9084
<count query="COUNT(%s)"/>
9185
<comment query="--" query2="/*"/>
92-
<!--
93-
NOTE: PostgreSQL 8.2 introduced PG_SLEEP() function
94-
References:
95-
* http://www.postgresql.org/docs/8.3/interactive/release-8-2.html
96-
* http://www.postgresql.org/docs/8.3/interactive/functions-datetime.html#FUNCTIONS-DATETIME-DELAY
97-
-->
9886
<substring query="SUBSTR((%s)::text,%d,%d)"/>
9987
<concatenate query="%s||%s"/>
10088
<case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>

0 commit comments

Comments
 (0)