implemented parameter --skip

stamparm · stamparm · commit 9be89422dab1 · 2011-08-29T13:29:42.000Z
diff --git a/lib/controller/controller.py b/lib/controller/controller.py
@@ -419,14 +419,20 @@ def start():
                             infoMsg = "skipping previously processed %s parameter '%s'" % (place, parameter)
                             logger.info(infoMsg)
 
+                        elif parameter in conf.testParameter:
+                            pass
+
                         elif parameter == conf.rParam:
                             testSqlInj = False
 
                             infoMsg = "skipping randomizing %s parameter '%s'" % (place, parameter)
                             logger.info(infoMsg)
 
-                        elif parameter in conf.testParameter:
-                            pass
+                        elif parameter in conf.skip:
+                            testSqlInj = False
+
+                            infoMsg = "skipping %s parameter '%s'" % (place, parameter)
+                            logger.info(infoMsg)
 
                         # Ignore session-like parameters for --level < 4
                         elif conf.level < 4 and parameter.upper() in IGNORE_PARAMETERS:
diff --git a/lib/core/option.py b/lib/core/option.py
@@ -1290,6 +1290,12 @@ def __cleanupOptions():
     else:
         conf.rParam = []
 
+    if conf.skip:
+        conf.skip = conf.skip.replace(" ", "")
+        conf.skip = re.split(PARAMETER_SPLITTING_REGEX, conf.skip)
+    else:
+        conf.skip = []
+
     if conf.delay:
         conf.delay = float(conf.delay)
 
@@ -1768,6 +1774,10 @@ def __basicOptionValidation():
         errMsg = "switch --tor is incompatible with switch --proxy"
         raise sqlmapSyntaxException, errMsg
 
+    if conf.skip and conf.testParameter:
+        errMsg = "switch --skip is incompatible with switch -p"
+        raise sqlmapSyntaxException, errMsg
+
     if conf.mobile and conf.agent:
         errMsg = "switch --mobile is incompatible with switch --user-agent"
         raise sqlmapSyntaxException, errMsg
diff --git a/lib/core/optiondict.py b/lib/core/optiondict.py
@@ -61,6 +61,7 @@
                                "os":                "string",
                                "prefix":            "string",
                                "suffix":            "string",
+                               "skip":              "string",
                                "tamper":            "string"
                              },
 
diff --git a/lib/parse/cmdline.py b/lib/parse/cmdline.py
@@ -90,7 +90,7 @@ def cmdLineParser():
                            help="Use randomly selected HTTP User-Agent header")
 
         request.add_option("--randomize", dest="rParam",
-                           help="Randomly change value for the given parameter")
+                           help="Randomly change value for given parameter(s)")
 
         request.add_option("--referer", dest="referer",
                            help="HTTP Referer header")
@@ -184,6 +184,9 @@ def cmdLineParser():
         injection.add_option("--suffix", dest="suffix",
                              help="Injection payload suffix string")
 
+        injection.add_option("--skip", dest="skip",
+                           help="Skip testing for given parameter(s)")
+
         injection.add_option("--tamper", dest="tamper",
                              help="Use given script(s) for tampering injection data")
 
diff --git a/sqlmap.conf b/sqlmap.conf
@@ -185,6 +185,9 @@ prefix =
 # Injection payload suffix string
 suffix = 
 
+# Skip testing for given parameter(s)
+skip =
+
 # Use given script(s) for tampering injection data
 tamper = 
 
