CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reducing number of requests for --hex in --technique=E

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-28 11:43:24 +02:00
parent cd911acb24
commit 0ab84074f7
3 changed files with 88 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/techniques/error/use.py
View file

@ -87,7 +87,9 @@ def _oneShotErrorUse(expression, field=None, chunkTest=False):
testQuery = "RPAD('%s',%d,'%s')" % (testChar, current, testChar)
else:
testQuery = "%s('%s',%d)" % ("REPEAT" if Backend.isDbms(DBMS.MYSQL) else "REPLICATE", testChar, current)
testQuery = "SELECT %s" % (agent.hexConvertField(testQuery) if conf.hexConvert else testQuery)
# chunk length is the channel's CHAR capacity (hex-independent); a hex-wrapped probe doubles
# the length and mis-detects (pins to the minimum), so probe plain even under --hex
testQuery = "SELECT %s" % testQuery
result = unArrayizeValue(_oneShotErrorUse(testQuery, chunkTest=True))
seen.add(current)
@ -206,7 +208,7 @@ def _oneShotErrorUse(expression, field=None, chunkTest=False):
hashDBWrite(expression, "%s%s" % (retVal, PARTIAL_VALUE_MARKER))
raise
retVal = decodeDbmsHexValue(retVal) if conf.hexConvert else retVal
retVal = decodeDbmsHexValue(retVal) if conf.hexConvert and not chunkTest else retVal
if isinstance(retVal, six.string_types):
retVal = htmlUnescape(retVal).replace("<br>", "\n")