CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Implementing support for 429 (rate limit)
Some checks are pending
/ build (macos-latest, 3.8) (push) Waiting to run
Details
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
Details
/ build (windows-latest, 3.14) (push) Waiting to run
Details

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-24 15:17:05 +02:00
parent 075d009bb7
commit 2d9e9ed959
6 changed files with 94 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

20
extra/vulnserver/vulnserver.py
View file

@ -407,6 +407,10 @@ _lock = None
_server = None
_alive = False
_csrf_token = None
_ratelimit_hits = 0
# number of initial hits to '/ratelimit' answered with 429 before it behaves normally
RATELIMIT_INITIAL_429 = 1
def init(quiet=False):
global _conn
@ -963,6 +967,22 @@ class ReqHandler(BaseHTTPRequestHandler):
self.wfile.write(b"<html><body>Request blocked: security policy violation (WAF)</body></html>")
return
# rate-limit emulator ('/ratelimit'): the first hit(s) answer 429 with a 'Retry-After', then
# it behaves like the default SQLi endpoint - so a client that honors the backoff and retries
# eventually gets through (drives the adaptive rate-limit handling)
if self.url == "/ratelimit":
global _ratelimit_hits
_ratelimit_hits += 1
if _ratelimit_hits <= RATELIMIT_INITIAL_429:
self.send_response(429)
self.send_header("Retry-After", "0")
self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
self.send_header("Connection", "close")
self.end_headers()
self.wfile.write(b"<html><body>Too Many Requests</body></html>")
return
self.url = "/"
if self.url == "/xxe":
self.send_response(OK)
self.send_header("Content-type", "application/xml; charset=%s" % UNICODE_ENCODING)