Minor patch for integer casting heuristics (circumvent auto-casting by DBMS itself)

stamparm · stamparm · commit aa21550712bc · 2016-04-15T13:47:19.000+02:00
diff --git a/lib/controller/checks.py b/lib/controller/checks.py
@@ -7,6 +7,7 @@
 
 import copy
 import httplib
+import random
 import re
 import socket
 import time
@@ -906,7 +907,7 @@ def _(page):
 
         if not result:
             randStr = randomStr()
-            payload = "%s%s%s" % (prefix, "%s%s" % (origValue, randStr), suffix)
+            payload = "%s%s%s" % (prefix, "%s.%d%s" % (origValue, random.randint(1, 9), randStr), suffix)
             payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE)
             casting = Request.queryPage(payload, place, raise404=False)
 
diff --git a/lib/core/settings.py b/lib/core/settings.py
@@ -20,7 +20,7 @@
 from lib.core.revision import getRevisionNumber
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.0.4.18"
+VERSION = "1.0.4.19"
 REVISION = getRevisionNumber()
 STABLE = VERSION.count('.') <= 2
 VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev")
