Minor update

stamparm · stamparm · commit 7143e61619e1 · 2014-10-23T14:00:53.000+02:00
diff --git a/lib/core/settings.py b/lib/core/settings.py
@@ -603,6 +603,9 @@
 # Reference: http://www.cookiecentral.com/faq/#3.5
 NETSCAPE_FORMAT_HEADER_COOKIES = "# Netscape HTTP Cookie File."
 
+# Prefixes used for automatic recognition of parameters carrying CSRF protection tokens
+CSRF_TOKEN_PARAMETER_PREFIXES = ("csrf", "xsrf")
+
 # Prefixes used in brute force search for web server document root
 BRUTE_DOC_ROOT_PREFIXES = {
     OS.LINUX: ("/var/www", "/usr/local/apache", "/usr/local/apache2", "/usr/local/www/apache22", "/usr/local/www/apache24", "/usr/local/httpd", "/var/www/nginx-default", "/srv/www", "/var/www/%TARGET%", "/var/www/vhosts/%TARGET%", "/var/www/virtual/%TARGET%", "/var/www/clients/vhosts/%TARGET%", "/var/www/clients/virtual/%TARGET%"),
diff --git a/lib/core/target.py b/lib/core/target.py
@@ -43,6 +43,7 @@
 from lib.core.option import _setKnowledgeBaseAttributes
 from lib.core.option import _setAuthCred
 from lib.core.settings import ASTERISK_MARKER
+from lib.core.settings import CSRF_TOKEN_PARAMETER_PREFIXES
 from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR
 from lib.core.settings import DEFAULT_GET_POST_DELIMITER
 from lib.core.settings import HOST_ALIASES
@@ -352,7 +353,7 @@ def process(match, repl):
     else:
         for place in (PLACE.GET, PLACE.POST):
             for parameter in conf.paramDict.get(place, {}):
-                if parameter.lower().startswith("csrf"):
+                if any(parameter.lower().startswith(_) for _ in CSRF_TOKEN_PARAMETER_PREFIXES):
                     message = "%s parameter '%s' appears to hold CSRF protection token. " % (place, parameter)
                     message += "Do you want sqlmap to automatically update it in further requests? [y/N] "
                     test = readInput(message, default="N")
