Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 71d0b1b

Browse files
stamparmstamparm
committed
several bug fixes
1 parent 043b189 commit 71d0b1b

4 files changed

Lines changed: 56 additions & 46 deletions

File tree

‎doc/THANKS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -423,7 +423,7 @@ Sylphid <[email protected]>
423423
for suggesting some features
424424

425425
ToR <[email protected]>
426-
for reporting a minor bug
426+
for reporting several bugs
427427

428428
== Organizations ==
429429

‎lib/controller/checks.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ def heuristicCheckSqlInjection(place, parameter, value):
104104

105105
payload = "%s%s%s" % (prefix, randomStr(length=10, alphabet=['"', '\'', ')', '(']), postfix)
106106
payload = agent.payload(place, parameter, value, payload)
107-
Request.queryPage(payload, place)
107+
Request.queryPage(payload, place, raise404=False)
108108
result = wasLastRequestError()
109109

110110
infoMsg = "(error based) heuristics shows that %s " % place
@@ -153,6 +153,9 @@ def checkDynamicContent(firstPage, secondPage):
153153
This function checks if the provided pages have dynamic content. If they
154154
are dynamic, proper markings will be made.
155155
"""
156+
157+
if kb.nullConnection:
158+
return
156159

157160
infoMsg = "searching for dynamic content"
158161
logger.info(infoMsg)
@@ -245,6 +248,7 @@ def checkStability():
245248

246249
if test:
247250
conf.string = test
251+
kb.nullConnection = None
248252
else:
249253
raise sqlmapSilentQuitException
250254

@@ -254,6 +258,7 @@ def checkStability():
254258

255259
if test:
256260
conf.regex = test
261+
kb.nullConnection = None
257262
else:
258263
raise sqlmapSilentQuitException
259264
else:

‎lib/request/comparison.py‎

Lines changed: 45 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -18,48 +18,53 @@
1818
from lib.core.session import setMatchRatio
1919

2020
def comparison(page, headers=None, getSeqMatcher=False, pageLength=None):
21+
if page is None and pageLength is None:
22+
return None
23+
2124
regExpResults = None
2225

23-
# String to be excluded before calculating page hash
24-
if conf.eString and conf.eString in page:
25-
index = page.index(conf.eString)
26-
length = len(conf.eString)
27-
pageWithoutString = page[:index]
28-
pageWithoutString += page[index+length:]
29-
page = pageWithoutString
30-
31-
# Regular expression matches to be excluded before calculating page hash
32-
if conf.eRegexp:
33-
regExpResults = re.findall(conf.eRegexp, page, re.I | re.M)
34-
35-
if regExpResults:
36-
for regExpResult in regExpResults:
37-
index = page.index(regExpResult)
38-
length = len(regExpResult)
39-
pageWithoutRegExp = page[:index]
40-
pageWithoutRegExp += page[index+length:]
41-
page = pageWithoutRegExp
42-
43-
# String to match in page when the query is valid
44-
if conf.string:
45-
return conf.string in page
46-
47-
# Regular expression to match in page when the query is valid
48-
if conf.regexp:
49-
return re.search(conf.regexp, page, re.I | re.M) is not None
50-
51-
# Dynamic content lines to be excluded before calculating page hash
52-
for item in kb.dynamicMarkings:
53-
prefix, postfix = item
54-
if prefix is None:
55-
page = re.sub('(?s)^.+%s' % postfix, postfix, page)
56-
elif postfix is None:
57-
page = re.sub('(?s)%s.+$' % prefix, prefix, page)
58-
else:
59-
page = re.sub('(?s)%s.+%s' % (prefix, postfix), '%s%s' % (prefix, postfix), page)
60-
61-
if not pageLength and page:
62-
pageLength = len(page)
26+
if page:
27+
# String to be excluded before calculating page hash
28+
if conf.eString and conf.eString in page:
29+
index = page.index(conf.eString)
30+
length = len(conf.eString)
31+
pageWithoutString = page[:index]
32+
pageWithoutString += page[index+length:]
33+
page = pageWithoutString
34+
35+
# Regular expression matches to be excluded before calculating page hash
36+
if conf.eRegexp:
37+
regExpResults = re.findall(conf.eRegexp, page, re.I | re.M)
38+
39+
if regExpResults:
40+
for regExpResult in regExpResults:
41+
index = page.index(regExpResult)
42+
length = len(regExpResult)
43+
pageWithoutRegExp = page[:index]
44+
pageWithoutRegExp += page[index+length:]
45+
page = pageWithoutRegExp
46+
47+
# String to match in page when the query is valid
48+
if conf.string:
49+
return conf.string in page
50+
51+
# Regular expression to match in page when the query is valid
52+
if conf.regexp:
53+
return re.search(conf.regexp, page, re.I | re.M) is not None
54+
55+
# Dynamic content lines to be excluded before calculating page hash
56+
if not kb.nullConnection:
57+
for item in kb.dynamicMarkings:
58+
prefix, postfix = item
59+
if prefix is None:
60+
page = re.sub('(?s)^.+%s' % postfix, postfix, page)
61+
elif postfix is None:
62+
page = re.sub('(?s)%s.+$' % prefix, prefix, page)
63+
else:
64+
page = re.sub('(?s)%s.+%s' % (prefix, postfix), '%s%s' % (prefix, postfix), page)
65+
66+
if not pageLength:
67+
pageLength = len(page)
6368

6469
if kb.locks.seqLock:
6570
kb.locks.seqLock.acquire()

‎lib/request/connect.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -214,10 +214,10 @@ def getPage(**kwargs):
214214
except urllib2.HTTPError, e:
215215
if e.code == 401:
216216
errMsg = "not authorized, try to provide right HTTP "
217-
errMsg += "authentication type and valid credentials"
217+
errMsg += "authentication type and valid credentials (%d)" % e.code
218218
raise sqlmapConnectionException, errMsg
219219
elif e.code == 404 and raise404:
220-
errMsg = "page not found"
220+
errMsg = "page not found (%d)" % e.code
221221
raise sqlmapConnectionException, errMsg
222222
else:
223223
try:
@@ -285,7 +285,7 @@ def getPage(**kwargs):
285285
return page, responseHeaders
286286

287287
@staticmethod
288-
def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent=False, method=None, auxHeaders=None, response=False):
288+
def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent=False, method=None, auxHeaders=None, response=False, raise404 = None):
289289
"""
290290
This method calls a function to get the target url page content
291291
and returns its page MD5 hash or a boolean value in case of
@@ -302,7 +302,7 @@ def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent
302302
page = None
303303
pageLength = None
304304
uri = None
305-
raise404 = place != "URI"
305+
raise404 = place != "URI" if raise404 is None else raise404
306306
toUrlencode = { "GET": True, "POST": True, "Cookie": conf.cookieUrlencode, "User-Agent": True, "URI": False }
307307

308308
if not place:

0 commit comments

Comments
 (0)