CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-15 12:29:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Minor patch

Browse source
This commit is contained in:
Miroslav Štampar 2026-08-08 01:07:07 +02:00
parent aa8d9b9841
commit 7d2c33cd32
6 changed files with 252 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/techniques/xpath/inject.py
View file

@ -24,6 +24,7 @@ from lib.utils.nonsql import INCONCLUSIVE_MARK
from lib.utils.nonsql import userDecision
from lib.utils.nonsql import InconclusiveError
from lib.utils.nonsql import resolveBit
from lib.utils.nonsql import stripReflection
from lib.utils.nonsql import sqlErrorPresent
from lib.utils.nonsql import blockedStatus
from lib.utils.nonsql import ratio as _ratio
@ -165,7 +166,9 @@ def _send(place, parameter, value):
# true/false differential, and even the XPath-only confirm battery, without a single expression
# ever being evaluated. That reported XSLT (and plain reflective) endpoints as XPath-injectable.
# On a genuinely blind target the payload is not in the page, so this is a no-op.
page = removeReflectiveValues(page, value, suppressWarning=True)
# Two layers on purpose: sqlmap's scan-wide heuristic (which can switch itself off) AND a plain
# deterministic strip that cannot. See stripReflection().
page = stripReflection(removeReflectiveValues(page, value, suppressWarning=True), value)
# A transport failure or a BLOCKED/ERROR status (5xx, 403/429 WAF/rate-limit) is NOT a usable
# oracle sample: returning "" for it would let a one-sided failure fake a true/false divergence
# (an empty body cannot be told apart from a dead connection). Signal it as None -> the boolean