Thanks to visit codestin.com
Credit goes to github.com

Skip to content

support for URLs containing credentials#5032

Closed
the-rend wants to merge 1 commit intosqlmapproject:masterfrom
the-rend:master
Closed

support for URLs containing credentials#5032
the-rend wants to merge 1 commit intosqlmapproject:masterfrom
the-rend:master

Conversation

@the-rend
Copy link
Copy Markdown

@the-rend the-rend commented Mar 15, 2022 •
edited
Loading

URLs containing credentials are not supported and using them as target URLs doesn't work as expected:

sqlmap -u 'http://[email protected]:80/dashboard/?id=123' --batch    

[CRITICAL] host '[email protected]' does not exist

sqlmap -u 'http://user:[email protected]:80/dashboard/?id=123' --batch

[CRITICAL] host 'user' does not exist

@stamparm
Copy link
Copy Markdown
Member

stamparm commented Mar 15, 2022

conf.hostname = conf.hostname.strip("[]").replace(kb.customInjectionMark, "") is for proper dealing with IPv6 addresses

@stamparm
Copy link
Copy Markdown
Member

stamparm commented Mar 15, 2022

also, you haven't done anything with provided username:password. what's the use of stripping those credentials?

@stamparm stamparm closed this in e91b1a0 Mar 15, 2022
@stamparm stamparm self-assigned this Mar 15, 2022
@the-rend
Copy link
Copy Markdown
Author

the-rend commented Mar 16, 2022

for proper dealing with IPv6 addresses
urlibe supports ipv6 properly and you don't need to extract the hostname manually by splitting using : or striping out [] which results in a bug in this case.

you haven't done anything with provided username:password
modern browsers don't process this type of passing credentials BUT this kind of URLs are still valid and also you don't like adding a lot of code in one PR so I didn't implement any thing new and just patched the bug

@the-rend
Copy link
Copy Markdown
Author

the-rend commented Mar 16, 2022

so maybe I should have chosen a title like: patch for URLs containing credentials

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@stamparm stamparm

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@the-rend @stamparm