minor adjustment of a time based char retrievals (no more infinite increasing of timeSec value for problematic characters)

stamparm · stamparm · commit 7cc5743c5d86 · 2011-08-16T06:50:20.000Z
diff --git a/doc/THANKS b/doc/THANKS
@@ -586,6 +586,13 @@ fufuh <fufuh@users.sourceforge.net>
 james <james@ev6.net>
     for reporting a bug
 
+Joe "Pragmatk" <pragmatk@gmail.com>
+    for reporting a few bugs
+
+John Smith <tixos@live.com>
+    for reporting several bugs
+    for suggesting some features
+
 m4l1c3 <malice.anon@gmail.com>
     for reporting considerable amount of bugs
 
@@ -598,26 +605,22 @@ mitchell <mitchell@tufala.net>
 nightman <nightman@email.de>
     for reporting considerable amount of bugs
 
+Oso Dog osodog123@yahoo.com
+    for reporting a minor bug
+
 pacman730 <pacman730@users.sourceforge.net>
     for reporting a bug
 
+pentestmonkey <pentestmonkey@pentestmonkey.net>
+    for reporting several bugs
+    for suggesting a few minor enhancements
+
 Phat R. <phatthanaphol@gmail.com>
     for reporting a few bugs
 
 Phil P <@superevr>
     for suggesting a minor enhancement
 
-Joe "Pragmatk" <pragmatk@gmail.com>
-    for reporting a few bugs
-
-John Smith <tixos@live.com>
-    for reporting several bugs
-    for suggesting some features
-
-pentestmonkey <pentestmonkey@pentestmonkey.net>
-    for reporting several bugs
-    for suggesting a few minor enhancements
-
 ragos <ragos@joker.ms>
     for reporting a minor bug
 
diff --git a/lib/core/option.py b/lib/core/option.py
@@ -1432,6 +1432,7 @@ def __setKnowledgeBaseAttributes(flushAll=True):
     kb.pageTemplates = dict()
     kb.orderByColumns = None
     kb.originalPage = None
+    kb.originalTimeDelay = None
 
     # Back-end DBMS underlying operating system fingerprint via banner (-b)
     # parsing
diff --git a/lib/core/settings.py b/lib/core/settings.py
@@ -391,3 +391,6 @@
 
 # Step used in ORDER BY technique used for finding the right number of columns in UNION query injections
 ORDER_BY_STEP = 10
+
+# Maximum number of times for revalidation of a character in time-based injections
+MAX_TIME_REVALIDATION_STEPS = 5
diff --git a/lib/techniques/blind/inference.py b/lib/techniques/blind/inference.py
@@ -44,6 +44,7 @@
 from lib.core.settings import INFERENCE_GREATER_CHAR
 from lib.core.settings import INFERENCE_EQUALS_CHAR
 from lib.core.settings import INFERENCE_NOT_EQUALS_CHAR
+from lib.core.settings import MAX_TIME_REVALIDATION_STEPS
 from lib.core.settings import PYVERSION
 from lib.core.threads import getCurrentThreadData
 from lib.core.threads import runThreads
@@ -259,16 +260,23 @@ def getChar(idx, charTbl=asciiTbl, continuousOrder=True, expand=charsetType is N
                                 errMsg = "invalid character detected. retrying.."
                                 logger.error(errMsg)
 
+                                if not kb.originalTimeDelay:
+                                    kb.originalTimeDelay = conf.timeSec
+
                                 conf.timeSec += 1
-                                warnMsg = "increasing time delay to %d second%s " % (conf.timeSec, 's' if conf.timeSec > 1 else '')
-                                warnMsg += "(due to invalid char)"
-                                logger.warn(warnMsg)
-
-                                if kb.adjustTimeDelay:
-                                    dbgMsg = "turning off auto-adjustment mechanism"
-                                    logger.debug(dbgMsg)
-                                    kb.adjustTimeDelay = False
-                                return getChar(idx, originalTbl, continuousOrder, expand)
+                                if (conf.timeSec - kb.originalTimeDelay) <= MAX_TIME_REVALIDATION_STEPS:
+                                    warnMsg = "increasing time delay to %d second%s " % (conf.timeSec, 's' if conf.timeSec > 1 else '')
+                                    warnMsg += "(due to invalid char)"
+                                    logger.warn(warnMsg)
+
+                                    if kb.adjustTimeDelay:
+                                        dbgMsg = "turning off auto-adjustment mechanism"
+                                        logger.debug(dbgMsg)
+                                        kb.adjustTimeDelay = False
+                                    return getChar(idx, originalTbl, continuousOrder, expand)
+                                else:
+                                    conf.timeSec = kb.originalTimeDelay
+                                    return None
                             else:
                                 return decodeIntToUnicode(retVal)
                         else:
