Minor update for vuln testing

stamparm · stamparm · commit ba7ab2159663 · 2019-04-29T11:32:01.000+02:00
diff --git a/extra/vulnserver/vulnserver.py b/extra/vulnserver/vulnserver.py
@@ -16,6 +16,7 @@
 
 if sys.version_info >= (3, 0):
     from http.client import FOUND
+    from http.client import INTERNAL_SERVER_ERROR
     from http.client import NOT_FOUND
     from http.client import OK
     from http.server import BaseHTTPRequestHandler
@@ -27,6 +28,7 @@
     from BaseHTTPServer import BaseHTTPRequestHandler
     from BaseHTTPServer import HTTPServer
     from httplib import FOUND
+    from httplib import INTERNAL_SERVER_ERROR
     from httplib import NOT_FOUND
     from httplib import OK
     from SocketServer import ThreadingMixIn
@@ -85,6 +87,13 @@ def do_REQUEST(self):
         if query:
             params.update(parse_qs(query))
 
+            if "<script>" in unquote_plus(query):
+                self.send_response(INTERNAL_SERVER_ERROR)
+                self.send_header("Connection", "close")
+                self.end_headers()
+                self.wfile.write("CLOUDFLARE_ERROR_500S_BOX".encode("utf8"))
+                return
+
         if hasattr(self, "data"):
             params.update(parse_qs(self.data))
 
diff --git a/lib/core/settings.py b/lib/core/settings.py
@@ -17,7 +17,7 @@
 from lib.core.enums import OS
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.3.4.36"
+VERSION = "1.3.4.37"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
diff --git a/lib/core/testing.py b/lib/core/testing.py
@@ -64,7 +64,7 @@ def _thread():
     thread.start()
 
     for options, checks in (
-        ("--version", ("1.", "#")),
+        ("--identify-waf", ("CloudFlare",)),
         ("--flush-session", ("Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "back-end DBMS: SQLite", "3 columns")),
         ("--banner --schema --dump -T users --binary-fields=surname --where 'id>3'", ("banner: '3", "INTEGER", "TEXT", "id", "name", "surname", "2 entries", "6E616D6569736E756C6C")),
         ("--all", ("5 entries", "luther", "blisset", "fluffy", "ming", "NULL", "nameisnull")),
