Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 95cd9e2

Browse files
stamparmstamparm
committed
adding support for scanning Host header values (-p host)
1 parent bdc724c commit 95cd9e2

11 files changed

Lines changed: 58 additions & 18 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -437,7 +437,7 @@ def genCmpPayload():
437437
# Feed with the boundaries details only the first time a
438438
# test has been successful
439439
if injection.place is None or injection.parameter is None:
440-
if place in (PLACE.UA, PLACE.REFERER):
440+
if place in (PLACE.UA, PLACE.REFERER, PLACE.HOST):
441441
injection.parameter = place
442442
else:
443443
injection.parameter = parameter

‎lib/controller/controller.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
from lib.core.settings import EMPTY_FORM_FIELDS_REGEX
5555
from lib.core.settings import IGNORE_PARAMETERS
5656
from lib.core.settings import LOW_TEXT_PERCENT
57+
from lib.core.settings import HOST_ALIASES
5758
from lib.core.settings import REFERER_ALIASES
5859
from lib.core.settings import USER_AGENT_ALIASES
5960
from lib.core.target import initTargetEnv
@@ -395,6 +396,10 @@ def start():
395396
skip = (place == PLACE.UA and conf.level < 3)
396397
skip |= (place == PLACE.REFERER and conf.level < 3)
397398

399+
# Test Host header only if
400+
# --level >= 5
401+
skip |= (place == PLACE.HOST and conf.level < 5)
402+
398403
# Test Cookie header only if --level >= 2
399404
skip |= (place == PLACE.COOKIE and conf.level < 2)
400405

@@ -404,6 +409,7 @@ def start():
404409

405410
skip &= not (place == PLACE.UA and intersect(USER_AGENT_ALIASES, conf.testParameter, True))
406411
skip &= not (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.testParameter, True))
412+
skip &= not (place == PLACE.HOST and intersect(HOST_ALIASES, conf.testParameter, True))
407413

408414
if skip:
409415
continue

‎lib/core/agent.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ def payload(self, place=None, parameter=None, value=None, newValue=None, where=N
116116
retValue = ET.tostring(root)
117117
elif place == PLACE.URI:
118118
retValue = paramString.replace("%s%s" % (origValue, URI_INJECTION_MARK_CHAR), self.addPayloadDelimiters(newValue))
119-
elif place in (PLACE.UA, PLACE.REFERER):
119+
elif place in (PLACE.UA, PLACE.REFERER, PLACE.HOST):
120120
retValue = paramString.replace(origValue, self.addPayloadDelimiters(newValue))
121121
else:
122122
retValue = paramString.replace("%s=%s" % (parameter, origValue),

‎lib/core/common.py‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@
8888
from lib.core.settings import REVISION
8989
from lib.core.settings import VERSION_STRING
9090
from lib.core.settings import SITE
91+
from lib.core.settings import HOST_ALIASES
92+
from lib.core.settings import REFERER_ALIASES
93+
from lib.core.settings import USER_AGENT_ALIASES
9194
from lib.core.settings import ERROR_PARSING_REGEXES
9295
from lib.core.settings import PRINTABLE_CHAR_REGEX
9396
from lib.core.settings import SQL_STATEMENTS
@@ -706,13 +709,14 @@ def paramToDict(place, parameters=None):
706709
if len(conf.testParameter) > 1:
707710
warnMsg = "provided parameters '%s' " % paramStr
708711
warnMsg += "are not inside the %s" % place
712+
logger.warn(warnMsg)
709713
else:
710714
parameter = conf.testParameter[0]
711715

712-
warnMsg = "provided parameter '%s' " % paramStr
713-
warnMsg += "is not inside the %s" % place
714-
715-
logger.warn(warnMsg)
716+
if not intersect(USER_AGENT_ALIASES + REFERER_ALIASES + HOST_ALIASES, parameter, True):
717+
warnMsg = "provided parameter '%s' " % paramStr
718+
warnMsg += "is not inside the %s" % place
719+
logger.warn(warnMsg)
716720

717721
elif len(conf.testParameter) != len(testableParameters.keys()):
718722
for parameter in conf.testParameter:
@@ -1277,12 +1281,18 @@ def parseTargetUrl():
12771281
conf.url = "%s://%s:%d%s" % (conf.scheme, conf.hostname, conf.port, conf.path)
12781282
conf.url = conf.url.replace(URI_QUESTION_MARKER, '?')
12791283

1280-
if not conf.referer and conf.level >= 3:
1284+
if not conf.referer and (conf.level >= 3 or intersect(REFERER_ALIASES, conf.testParameter, True)):
12811285
debugMsg = "setting the HTTP Referer header to the target url"
12821286
logger.debug(debugMsg)
12831287
conf.httpHeaders = filter(lambda (key, value): key != HTTPHEADER.REFERER, conf.httpHeaders)
12841288
conf.httpHeaders.append((HTTPHEADER.REFERER, conf.url))
12851289

1290+
if not conf.host and (conf.level >= 5 or intersect(HOST_ALIASES, conf.testParameter, True)):
1291+
debugMsg = "setting the HTTP Host header to the target url"
1292+
logger.debug(debugMsg)
1293+
conf.httpHeaders = filter(lambda (key, value): key != HTTPHEADER.HOST, conf.httpHeaders)
1294+
conf.httpHeaders.append((HTTPHEADER.HOST, getHostHeader(conf.url)))
1295+
12861296
def expandAsteriskForColumns(expression):
12871297
# If the user provided an asterisk rather than the column(s)
12881298
# name, sqlmap will retrieve the columns itself and reprocess

‎lib/core/enums.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ class PLACE:
4848
COOKIE = "Cookie"
4949
UA = "User-Agent"
5050
REFERER = "Referer"
51+
HOST = "Host"
5152

5253
class HTTPMETHOD:
5354
GET = "GET"

‎lib/core/optiondict.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"agent": "string",
3232
"randomAgent": "boolean",
3333
"rParam": "string",
34+
"host": "string",
3435
"referer": "string",
3536
"headers": "string",
3637
"aType": "string",

‎lib/core/settings.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,8 +178,9 @@
178178
DBMS.DB2: (DB2_ALIASES, "python ibm-db", "http://code.google.com/p/ibm-db/")
179179
}
180180

181-
REFERER_ALIASES = ( "ref", "referer", "referrer" )
182181
USER_AGENT_ALIASES = ( "ua", "useragent", "user-agent" )
182+
REFERER_ALIASES = ( "ref", "referer", "referrer" )
183+
HOST_ALIASES = ( "host", )
183184

184185
FROM_TABLE = {
185186
DBMS.ORACLE: " FROM DUAL",

‎lib/core/target.py‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
from lib.core.option import __setDBMS
3535
from lib.core.option import __setKnowledgeBaseAttributes
3636
from lib.core.session import resumeConfKb
37+
from lib.core.settings import HOST_ALIASES
3738
from lib.core.settings import REFERER_ALIASES
3839
from lib.core.settings import RESULTS_FILE_FORMAT
3940
from lib.core.settings import SOAP_REGEX
@@ -141,7 +142,7 @@ def __setRequestParams():
141142
conf.paramDict[PLACE.COOKIE] = __paramDict
142143
__testableParameters = True
143144

144-
# Perform checks on User-Agent header value
145+
# Perform checks on header values
145146
if conf.httpHeaders:
146147
for httpHeader, headerValue in conf.httpHeaders:
147148
if httpHeader == PLACE.UA:
@@ -164,9 +165,19 @@ def __setRequestParams():
164165
conf.paramDict[PLACE.REFERER] = { PLACE.REFERER: headerValue }
165166
__testableParameters = True
166167

168+
elif httpHeader == PLACE.HOST:
169+
# No need for url encoding/decoding the host
170+
conf.parameters[PLACE.HOST] = urldecode(headerValue)
171+
172+
condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES)))
173+
174+
if condition:
175+
conf.paramDict[PLACE.HOST] = { PLACE.HOST: headerValue }
176+
__testableParameters = True
177+
167178
if not conf.parameters:
168179
errMsg = "you did not provide any GET, POST and Cookie "
169-
errMsg += "parameter, neither an User-Agent or Referer header"
180+
errMsg += "parameter, neither an User-Agent, Referer or Host header value"
170181
raise sqlmapGenericException, errMsg
171182

172183
elif not __testableParameters:

‎lib/parse/cmdline.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,9 @@ def cmdLineParser():
9292
request.add_option("--randomize", dest="rParam",
9393
help="Randomly change value for given parameter(s)")
9494

95+
request.add_option("--host", dest="host",
96+
help="HTTP Host header")
97+
9598
request.add_option("--referer", dest="referer",
9699
help="HTTP Referer header")
97100

‎lib/request/connect.py‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ def getPage(**kwargs):
142142
cookie = kwargs.get('cookie', None)
143143
ua = kwargs.get('ua', None)
144144
referer = kwargs.get('referer', None)
145+
host = kwargs.get('host', conf.host)
145146
direct = kwargs.get('direct', False)
146147
multipart = kwargs.get('multipart', False)
147148
silent = kwargs.get('silent', False)
@@ -237,7 +238,7 @@ def getPage(**kwargs):
237238

238239
requestMsg += " %s" % httplib.HTTPConnection._http_vsn_str
239240

240-
# Perform HTTP request
241+
# Prepare HTTP headers
241242
headers = forgeHeaders(cookie, ua, referer)
242243

243244
if conf.realTest:
@@ -251,7 +252,7 @@ def getPage(**kwargs):
251252

252253
headers[HTTPHEADER.ACCEPT] = HTTP_ACCEPT_HEADER_VALUE
253254

254-
headers[HTTPHEADER.HOST] = getHostHeader(url)
255+
headers[HTTPHEADER.HOST] = host or getHostHeader(url)
255256

256257
if auxHeaders:
257258
for key, item in auxHeaders.items():
@@ -533,6 +534,7 @@ def queryPage(value=None, place=None, content=False, getRatioValue=False, silent
533534
cookie = None
534535
ua = None
535536
referer = None
537+
host = None
536538
page = None
537539
pageLength = None
538540
uri = None
@@ -596,6 +598,9 @@ def queryPage(value=None, place=None, content=False, getRatioValue=False, silent
596598
if PLACE.REFERER in conf.parameters:
597599
referer = conf.parameters[PLACE.REFERER] if place != PLACE.REFERER or not value else value
598600

601+
if PLACE.HOST in conf.parameters:
602+
host = conf.parameters[PLACE.HOST] if place != PLACE.HOST or not value else value
603+
599604
if PLACE.URI in conf.parameters:
600605
uri = conf.url if place != PLACE.URI or not value else value
601606
else:
@@ -688,7 +693,7 @@ def _randomizeParameter(paramString, randomParameter):
688693
if conf.safUrl and conf.saFreq > 0:
689694
kb.queryCounter += 1
690695
if kb.queryCounter % conf.saFreq == 0:
691-
Connect.getPage(url=conf.safUrl, cookie=cookie, direct=True, silent=True, ua=ua, referer=referer)
696+
Connect.getPage(url=conf.safUrl, cookie=cookie, direct=True, silent=True, ua=ua, referer=referer, host=host)
692697

693698
start = time.time()
694699

@@ -701,7 +706,7 @@ def _randomizeParameter(paramString, randomParameter):
701706

702707
auxHeaders[HTTPHEADER.RANGE] = "bytes=-1"
703708

704-
_, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, silent=silent, method=method, auxHeaders=auxHeaders, raise404=raise404)
709+
_, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, method=method, auxHeaders=auxHeaders, raise404=raise404)
705710

706711
if headers:
707712
if kb.nullConnection == NULLCONNECTION.HEAD and HTTPHEADER.CONTENT_LENGTH in headers:
@@ -710,7 +715,7 @@ def _randomizeParameter(paramString, randomParameter):
710715
pageLength = int(headers[HTTPHEADER.CONTENT_RANGE][headers[HTTPHEADER.CONTENT_RANGE].find('/') + 1:])
711716

712717
if not pageLength:
713-
page, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, silent=silent, method=method, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCompare)
718+
page, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, method=method, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCompare)
714719

715720
threadData.lastQueryDuration = calculateDeltaSeconds(start)
716721

0 commit comments

Comments
 (0)