Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bb6b89f

Browse files
stamparmstamparm
committed
Patch for an Issue #360 
1 parent 11e27f0 commit bb6b89f

4 files changed

Lines changed: 25 additions & 15 deletions

File tree

‎lib/core/common.py‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1959,7 +1959,7 @@ def findMultipartPostBoundary(post):
19591959

19601960
return retVal
19611961

1962-
def urldecode(value, encoding=None, unsafe="%%&=;+%s" % CUSTOM_INJECTION_MARK_CHAR, convall=False):
1962+
def urldecode(value, encoding=None, unsafe="%%&=;+%s" % CUSTOM_INJECTION_MARK_CHAR, convall=False, plusspace=True):
19631963
result = value
19641964

19651965
if value:
@@ -1977,14 +1977,16 @@ def _(match):
19771977
char = chr(ord(match.group(1).decode("hex")))
19781978
return char if char in charset else match.group(0)
19791979
result = re.sub("%([0-9a-fA-F]{2})", _, value)
1980-
result = result.replace("+", " ") # plus sign has a special meaning in url encoded data (hence the usage of urllib.unquote_plus in convall case)
1980+
1981+
if plusspace:
1982+
result = result.replace("+", " ") # plus sign has a special meaning in url encoded data (hence the usage of urllib.unquote_plus in convall case)
19811983

19821984
if isinstance(result, str):
19831985
result = unicode(result, encoding or UNICODE_ENCODING, "replace")
19841986

19851987
return result
19861988

1987-
def urlencode(value, safe="%&=", convall=False, limit=False):
1989+
def urlencode(value, safe="%&=", convall=False, limit=False, spaceplus=False):
19881990
if conf.direct:
19891991
return value
19901992

@@ -2016,6 +2018,9 @@ def urlencode(value, safe="%&=", convall=False, limit=False):
20162018
else:
20172019
break
20182020

2021+
if spaceplus:
2022+
result = result.replace(urllib.quote(' '), '+')
2023+
20192024
return result
20202025

20212026
def runningAsAdmin():
@@ -2996,7 +3001,7 @@ def geturl(self):
29963001
url = urldecode(request.get_full_url(), kb.pageEncoding)
29973002
method = request.get_method()
29983003
data = request.get_data() if request.has_data() else None
2999-
data = urldecode(data, kb.pageEncoding) if data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in data else data
3004+
data = urldecode(data, kb.pageEncoding, plusspace=False)
30003005

30013006
if not data and method and method.upper() == HTTPMETHOD.POST:
30023007
debugMsg = "invalid POST form with blank data detected"

‎lib/core/option.py‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,7 @@ def _parseBurpLog(content):
328328

329329
if not(conf.scope and not re.search(conf.scope, url, re.I)):
330330
if not kb.targets or url not in addedTargetUrls:
331-
kb.targets.add((url, method, urldecode(data) if data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in data else data, cookie))
331+
kb.targets.add((url, method, data, cookie))
332332
addedTargetUrls.add(url)
333333

334334
fp = openFile(reqFile, "rb")
@@ -1361,15 +1361,6 @@ def _cleanupOptions():
13611361
if conf.data:
13621362
conf.data = re.sub(INJECT_HERE_MARK.replace(" ", r"[^A-Za-z]*"), CUSTOM_INJECTION_MARK_CHAR, conf.data, re.I)
13631363

1364-
if re.search(r'%[0-9a-f]{2}', conf.data, re.I):
1365-
class _(unicode):
1366-
pass
1367-
original = conf.data
1368-
conf.data = _(urldecode(conf.data))
1369-
setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original)
1370-
else:
1371-
conf.data = urldecode(conf.data)
1372-
13731364
if conf.url:
13741365
conf.url = re.sub(INJECT_HERE_MARK.replace(" ", r"[^A-Za-z]*"), CUSTOM_INJECTION_MARK_CHAR, conf.url, re.I)
13751366

@@ -1591,6 +1582,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
15911582
kb.safeCharEncode = False
15921583
kb.singleLogFlags = set()
15931584
kb.skipOthersDbms = None
1585+
kb.postSpaceToPlus = False
15941586
kb.stickyDBMS = False
15951587
kb.stickyLevel = None
15961588
kb.suppressResumeInfo = False

‎lib/core/target.py‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
from lib.core.settings import RESULTS_FILE_FORMAT
4848
from lib.core.settings import SOAP_RECOGNITION_REGEX
4949
from lib.core.settings import SUPPORTED_DBMS
50+
from lib.core.settings import UNENCODED_ORIGINAL_VALUE
5051
from lib.core.settings import UNICODE_ENCODING
5152
from lib.core.settings import UNKNOWN_DBMS_VERSION
5253
from lib.core.settings import URI_INJECTABLE_REGEX
@@ -504,6 +505,18 @@ def initTargetEnv():
504505
_restoreCmdLineOptions()
505506
_setDBMS()
506507

508+
if conf.data:
509+
kb.postSpaceToPlus = '+' in conf.data
510+
511+
if re.search(r'%[0-9a-f]{2}', conf.data, re.I):
512+
class _(unicode):
513+
pass
514+
original = conf.data
515+
conf.data = _(urldecode(conf.data))
516+
setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original)
517+
else:
518+
conf.data = urldecode(conf.data)
519+
507520
def setupTargetEnv():
508521
_createTargetDirs()
509522
_setRequestParams()

‎lib/request/connect.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -745,7 +745,7 @@ def _randomizeParameter(paramString, randomParameter):
745745
if place not in (PLACE.POST, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE):
746746
post = getattr(post, UNENCODED_ORIGINAL_VALUE)
747747
elif not skipUrlEncode and kb.postHint not in POST_HINT_CONTENT_TYPES.keys():
748-
post = urlencode(post)
748+
post = urlencode(post, spaceplus=kb.postSpaceToPlus)
749749

750750
if timeBasedCompare:
751751
if len(kb.responseTimes) < MIN_TIME_RESPONSES:

0 commit comments

Comments
 (0)