Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8abae02

Browse files
stamparmstamparm
committed
Improvement of anti-CSRF token extraction
1 parent dd9bfd1 commit 8abae02

4 files changed

Lines changed: 20 additions & 8 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.9.29"
22+
VERSION = "1.2.9.30"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -755,7 +755,7 @@
755755
NETSCAPE_FORMAT_HEADER_COOKIES = "# Netscape HTTP Cookie File."
756756

757757
# Infixes used for automatic recognition of parameters carrying anti-CSRF tokens
758-
CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf")
758+
CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf", "token")
759759

760760
# Prefixes used in brute force search for web server document root
761761
BRUTE_DOC_ROOT_PREFIXES = {

‎lib/parse/cmdline.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ def cmdLineParser(argv=None):
207207
help="Parameter used to hold anti-CSRF token")
208208

209209
request.add_option("--csrf-url", dest="csrfUrl",
210-
help="URL address to visit to extract anti-CSRF token")
210+
help="URL address to visit for extraction of anti-CSRF token")
211211

212212
request.add_option("--force-ssl", dest="forceSSL", action="store_true",
213213
help="Force usage of SSL/HTTPS")

‎lib/request/connect.py‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -948,15 +948,27 @@ def _adjustParameter(paramString, parameter, newValue):
948948
return retVal
949949

950950
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.method if conf.csrfUrl == conf.url else None, cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
951-
token = extractRegexResult(r"(?i)<input[^>]+\bname=[\"']?%s[\"']?[^>]*\bvalue=(?P<result>(\"([^\"]+)|'([^']+)|([^ >]+)))" % re.escape(conf.csrfToken), page or "")
951+
token = extractRegexResult(r"(?i)<input[^>]+\bname=[\"']?%s\b[^>]*\bvalue=[\"']?(?P<result>[^>'\"]*)" % re.escape(conf.csrfToken), page or "")
952952

953953
if not token:
954-
token = extractRegexResult(r"(?i)<input[^>]+\bvalue=(?P<result>(\"([^\"]+)|'([^']+)|([^ >]+)))[^>]+\bname=[\"']?%s[\"']?" % re.escape(conf.csrfToken), page or "")
954+
token = extractRegexResult(r"(?i)<input[^>]+\bvalue=[\"']?(?P<result>[^>'\"]*)[\"']?[^>]*\bname=[\"']?%s\b" % re.escape(conf.csrfToken), page or "")
955955

956956
if not token:
957957
match = re.search(r"%s[\"']:[\"']([^\"']+)" % re.escape(conf.csrfToken), page or "")
958958
token = match.group(1) if match else None
959959

960+
if not token:
961+
token = extractRegexResult(r"\b%s\s*[:=]\s*(?P<result>\w+)" % re.escape(conf.csrfToken), str(headers))
962+
963+
if not token:
964+
token = extractRegexResult(r"\b%s\s*=\s*['\"]?(?P<result>[^;'\"]+)" % re.escape(conf.csrfToken), page or "")
965+
966+
if token:
967+
match = re.search(r"String\.fromCharCode\(([\d+, ]+)\)", token)
968+
969+
if match:
970+
token = "".join(chr(int(_)) for _ in match.group(1).replace(' ', "").split(','))
971+
960972
if not token:
961973
if conf.csrfUrl != conf.url and code == httplib.OK:
962974
if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""):

‎txt/checksum.md5‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ c8c386d644d57c659d74542f5f57f632 lib/core/patch.py
5050
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
5151
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
5252
fcb74fcc9577523524659ec49e2e964b lib/core/session.py
53-
c4de3786929e1e0fcf2a614a58679588 lib/core/settings.py
53+
64ae44f8e2b61c49354f3866ba40a926 lib/core/settings.py
5454
dd68a9d02fccb4fa1428b20e15b0db5d lib/core/shell.py
5555
a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py
5656
248bd121e0565318e1efaff54aa427bc lib/core/target.py
@@ -61,7 +61,7 @@ b35636650cfe721f5cc47fb91737c061 lib/core/update.py
6161
e772deb63270375e685fa5a7b775c382 lib/core/wordlist.py
6262
1e5532ede194ac9c083891c2f02bca93 lib/__init__.py
6363
7620f1f4b8791e13c7184c06b5421754 lib/parse/banner.py
64-
fc5a42940327dd3f40a780c865b6b136 lib/parse/cmdline.py
64+
134bbbf67bb30c188b8409c0b3bfbc2a lib/parse/cmdline.py
6565
fb2e2f05dde98caeac6ccf3e67192177 lib/parse/configfile.py
6666
3794ff139869f5ae8e81cfdbe5714f56 lib/parse/handler.py
6767
6bab53ea9d75bc9bb8169d3e8f3f149f lib/parse/headers.py
@@ -72,7 +72,7 @@ f6b5957bf2103c3999891e4f45180bce lib/parse/payloads.py
7272
30eed3a92a04ed2c29770e1b10d39dc0 lib/request/basicauthhandler.py
7373
2b81435f5a7519298c15c724e3194a0d lib/request/basic.py
7474
859b6ad583e0ffba154f17ee179b5b89 lib/request/comparison.py
75-
b744d840de253c05e808a72d6d11dc5d lib/request/connect.py
75+
35db2a1779b9c71dfa183ac1f8995a5b lib/request/connect.py
7676
dd4598675027fae99f2e2475b05986da lib/request/direct.py
7777
2044fce3f4ffa268fcfaaf63241b1e64 lib/request/dns.py
7878
98535d0efca5551e712fcc4b34a3f772 lib/request/httpshandler.py

0 commit comments

Comments
 (0)