Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7151df1

Browse files
stamparmstamparm
committed
Adding extra validation step in case of boolean-based blind (e.g. if unexpected 500 occurs)
1 parent 8994bf2 commit 7151df1

5 files changed

Lines changed: 34 additions & 27 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ def checkSqlInjection(place, parameter, value):
157157
kb.testType = stype = test.stype
158158
clause = test.clause
159159
unionExtended = False
160-
trueCode = None
160+
trueCode, falseCode = None, None
161161

162162
if stype == PAYLOAD.TECHNIQUE.UNION:
163163
configUnion(test.request.char)
@@ -561,7 +561,7 @@ def genCmpPayload():
561561
trueCode = threadData.lastCode
562562

563563
if trueResult:
564-
# Just extra validation step (e.g. to check for dropping protection mechanisms)
564+
# Extra validation step (e.g. to check for DROP protection mechanisms)
565565
if SLEEP_TIME_MARKER in reqPayload:
566566
falseResult = Request.queryPage(reqPayload.replace(SLEEP_TIME_MARKER, "0"), place, timeBasedCompare=True, raise404=False)
567567
if falseResult:
@@ -678,6 +678,7 @@ def genCmpPayload():
678678
injection.data[stype].templatePayload = templatePayload
679679
injection.data[stype].matchRatio = kb.matchRatio
680680
injection.data[stype].trueCode = trueCode
681+
injection.data[stype].falseCode = falseCode
681682

682683
injection.conf.textOnly = conf.textOnly
683684
injection.conf.titles = conf.titles

‎lib/core/option.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1983,7 +1983,6 @@ def _setKnowledgeBaseAttributes(flushAll=True):
19831983
kb.threadContinue = True
19841984
kb.threadException = False
19851985
kb.tableExistsChoice = None
1986-
kb.timeValidCharsRun = 0
19871986
kb.uChar = NULL
19881987
kb.unionDuplicates = False
19891988
kb.xpCmdshellAvailable = False

‎lib/core/settings.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.revision import getRevisionNumber
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.0.9.37"
22+
VERSION = "1.0.9.38"
2323
REVISION = getRevisionNumber()
2424
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2525
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
@@ -510,8 +510,8 @@
510510
# Step used in ORDER BY technique used for finding the right number of columns in UNION query injections
511511
ORDER_BY_STEP = 10
512512

513-
# Maximum number of times for revalidation of a character in time-based injections
514-
MAX_TIME_REVALIDATION_STEPS = 5
513+
# Maximum number of times for revalidation of a character in inference (as required)
514+
MAX_REVALIDATION_STEPS = 5
515515

516516
# Characters that can be used to split parameter values in provided command line (e.g. in --tamper)
517517
PARAMETER_SPLITTING_REGEX = r'[,|;]'
@@ -547,7 +547,7 @@
547547
HASHDB_END_TRANSACTION_RETRIES = 3
548548

549549
# Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism)
550-
HASHDB_MILESTONE_VALUE = "QWdDkLzhxH" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
550+
HASHDB_MILESTONE_VALUE = "BkfRWrtCYK" # python -c 'import random, string; print "".join(random.sample(string.ascii_letters, 10))'
551551

552552
# Warn user of possible delay due to large page dump in full UNION query injections
553553
LARGE_OUTPUT_THRESHOLD = 1024 ** 2

‎lib/techniques/blind/inference.py‎

Lines changed: 23 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
from lib.core.settings import INFERENCE_EQUALS_CHAR
4242
from lib.core.settings import INFERENCE_NOT_EQUALS_CHAR
4343
from lib.core.settings import MAX_BISECTION_LENGTH
44-
from lib.core.settings import MAX_TIME_REVALIDATION_STEPS
44+
from lib.core.settings import MAX_REVALIDATION_STEPS
4545
from lib.core.settings import NULL
4646
from lib.core.settings import PARTIAL_HEX_VALUE_MARKER
4747
from lib.core.settings import PARTIAL_VALUE_MARKER
@@ -198,8 +198,7 @@ def tryHint(idx):
198198

199199
def validateChar(idx, value):
200200
"""
201-
Used in time-based inference (in case that original and retrieved
202-
value are not equal there will be a deliberate delay).
201+
Used in inference - in time-based SQLi if original and retrieved value are not equal there will be a deliberate delay
203202
"""
204203

205204
if "'%s'" % CHAR_INFERENCE_MARK not in payload:
@@ -264,6 +263,7 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None,
264263
minChar = minValue = charTbl[0]
265264
firstCheck = False
266265
lastCheck = False
266+
unexpectedCode = False
267267

268268
while len(charTbl) != 1:
269269
position = None
@@ -321,6 +321,12 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None,
321321
result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False)
322322
incrementCounter(kb.technique)
323323

324+
if not timeBasedCompare:
325+
unexpectedCode |= threadData.lastCode not in (kb.injection.data[kb.technique].falseCode, kb.injection.data[kb.technique].trueCode)
326+
if unexpectedCode:
327+
warnMsg = "unexpected HTTP code '%d' detected. Will use (extra) validation step in similar cases" % threadData.lastCode
328+
singleTimeWarnMessage(warnMsg)
329+
324330
if result:
325331
minValue = posValue
326332

@@ -360,24 +366,25 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None,
360366
retVal = minValue + 1
361367

362368
if retVal in originalTbl or (retVal == ord('\n') and CHAR_INFERENCE_MARK in payload):
363-
if timeBasedCompare and not validateChar(idx, retVal):
369+
if (timeBasedCompare or unexpectedCode) and not validateChar(idx, retVal):
364370
if not kb.originalTimeDelay:
365371
kb.originalTimeDelay = conf.timeSec
366372

367-
kb.timeValidCharsRun = 0
368-
if retried < MAX_TIME_REVALIDATION_STEPS:
373+
threadData.validationRun = 0
374+
if retried < MAX_REVALIDATION_STEPS:
369375
errMsg = "invalid character detected. retrying.."
370376
logger.error(errMsg)
371377

372-
if kb.adjustTimeDelay is not ADJUST_TIME_DELAY.DISABLE:
373-
conf.timeSec += 1
374-
warnMsg = "increasing time delay to %d second%s " % (conf.timeSec, 's' if conf.timeSec > 1 else '')
375-
logger.warn(warnMsg)
378+
if timeBasedCompare:
379+
if kb.adjustTimeDelay is not ADJUST_TIME_DELAY.DISABLE:
380+
conf.timeSec += 1
381+
warnMsg = "increasing time delay to %d second%s " % (conf.timeSec, 's' if conf.timeSec > 1 else '')
382+
logger.warn(warnMsg)
376383

377-
if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES:
378-
dbgMsg = "turning off time auto-adjustment mechanism"
379-
logger.debug(dbgMsg)
380-
kb.adjustTimeDelay = ADJUST_TIME_DELAY.NO
384+
if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES:
385+
dbgMsg = "turning off time auto-adjustment mechanism"
386+
logger.debug(dbgMsg)
387+
kb.adjustTimeDelay = ADJUST_TIME_DELAY.NO
381388

382389
return getChar(idx, originalTbl, continuousOrder, expand, shiftTable, (retried or 0) + 1)
383390
else:
@@ -387,8 +394,8 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None,
387394
return decodeIntToUnicode(retVal)
388395
else:
389396
if timeBasedCompare:
390-
kb.timeValidCharsRun += 1
391-
if kb.adjustTimeDelay is ADJUST_TIME_DELAY.NO and kb.timeValidCharsRun > VALID_TIME_CHARS_RUN_THRESHOLD:
397+
threadData.validationRun += 1
398+
if kb.adjustTimeDelay is ADJUST_TIME_DELAY.NO and threadData.validationRun > VALID_TIME_CHARS_RUN_THRESHOLD:
392399
dbgMsg = "turning back on time auto-adjustment mechanism"
393400
logger.debug(dbgMsg)
394401
kb.adjustTimeDelay = ADJUST_TIME_DELAY.YES

‎txt/checksum.md5‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ b46521e29ea3d813bab5aeb16cac6498 extra/shutils/duplicates.py
2020
cc9c82cfffd8ee9b25ba3af6284f057e extra/sqlharvest/__init__.py
2121
4f2f817596540d82f9fcc0c5b2228beb extra/sqlharvest/sqlharvest.py
2222
2daa39e4d59526acb4772b6c47eb315f lib/controller/action.py
23-
e2be5a4d5fd7587a78fa15a52fa58f32 lib/controller/checks.py
23+
1caf7c1bad475d3e1276edffc6da8a8c lib/controller/checks.py
2424
7c5ba631796f12d6de9b667e4cc7812b lib/controller/controller.py
2525
0a64305c3b3a01a2fc3a5e6204f442f1 lib/controller/handler.py
2626
cc9c82cfffd8ee9b25ba3af6284f057e lib/controller/__init__.py
@@ -39,13 +39,13 @@ e4aec2b11c1ad6039d0c3dbbfbc5eb1a lib/core/exception.py
3939
cc9c82cfffd8ee9b25ba3af6284f057e lib/core/__init__.py
4040
91c514013daa796e2cdd940389354eac lib/core/log.py
4141
b9779615206791e6ebbaa84947842b49 lib/core/optiondict.py
42-
fc390372373b5471b75145f6af4f11bd lib/core/option.py
42+
74d826338a2cd66a4724d8486a648d93 lib/core/option.py
4343
1e8948dddbd12def5c2af52530738059 lib/core/profiling.py
4444
e60456db5380840a586654344003d4e6 lib/core/readlineng.py
4545
5ef56abb8671c2ca6ceecb208258e360 lib/core/replication.py
4646
99a2b496b9d5b546b335653ca801153f lib/core/revision.py
4747
7c15dd2777af4dac2c89cab6df17462e lib/core/session.py
48-
5ea71214107e2dc870a14ca2f90e9b49 lib/core/settings.py
48+
db111838c5ffb6dfc66a260733952460 lib/core/settings.py
4949
7af83e4f18cab6dff5e67840eb65be80 lib/core/shell.py
5050
23657cd7d924e3c6d225719865855827 lib/core/subprocessng.py
5151
0bc2fae1dec18cdd11954b22358293f2 lib/core/target.py
@@ -87,7 +87,7 @@ cc9c82cfffd8ee9b25ba3af6284f057e lib/takeover/__init__.py
8787
7d6cd7bdfc8f4bc4e8aed60c84cdf87f lib/takeover/udf.py
8888
f6e3084abd506925a8be3d1c0a6d058c lib/takeover/web.py
8989
9af83a62de360184f1c14e69b8a95cfe lib/takeover/xp_cmdshell.py
90-
004c45c172d549e098a5fd5285a54cb3 lib/techniques/blind/inference.py
90+
9e4ae2df75cab68ea297f0db50b574c7 lib/techniques/blind/inference.py
9191
cc9c82cfffd8ee9b25ba3af6284f057e lib/techniques/blind/__init__.py
9292
cc9c82cfffd8ee9b25ba3af6284f057e lib/techniques/brute/__init__.py
9393
d36effffe64e63ef9b3be490f850e2cc lib/techniques/brute/use.py

0 commit comments

Comments
 (0)