CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 06:50:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

added checking of header values for GREP (error); still UNION to do

Browse source
This commit is contained in:
Miroslav Stampar 2011-01-31 12:21:17 +00:00
parent a6f2cd56ff
commit 8ef47307db
3 changed files with 22 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/techniques/error/use.py
View file

@ -11,12 +11,13 @@ import re
import time
from lib.core.agent import agent
from lib.core.common import Backend
from lib.core.common import calculateDeltaSeconds
from lib.core.common import dataToSessionFile
from lib.core.common import extractRegexResult
from lib.core.common import Backend
from lib.core.common import initTechnique
from lib.core.common import isNumPosStrValue
from lib.core.common import listToStrValue
from lib.core.common import randomInt
from lib.core.common import replaceNewlineTabs
from lib.core.common import safeStringFormat
@ -55,12 +56,13 @@ def __oneShotErrorUse(expression, field):
payload = agent.payload(newValue=injExpression)
# Perform the request
page, _ = Request.queryPage(payload, content=True)
page, headers = Request.queryPage(payload, content=True)
reqCount += 1
# Parse the returned page to get the exact error-based
# sql injection output
output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE)
output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE)\
or extractRegexResult(check, listToStrValue(headers.headers if headers else None), re.DOTALL | re.IGNORECASE)
dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.url, kb.injection.place, conf.parameters[kb.injection.place], expression, replaceNewlineTabs(output)))