CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-03 22:31:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Minor patches

Browse source
This commit is contained in:
Miroslav Štampar 2026-06-28 01:59:58 +02:00
parent e8162d314a
commit c51b4c072f
6 changed files with 34 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/techniques/graphql/inject.py
View file

@ -13,11 +13,13 @@ import time
from collections import namedtuple
from collections import OrderedDict
from lib.core.common import beep
from lib.core.common import randomStr
from lib.core.convert import getUnicode
from lib.core.data import conf
from lib.core.data import kb
from lib.core.data import logger
from lib.core.enums import CUSTOM_LOGGING
from lib.core.enums import POST_HINT
from lib.core.settings import ERROR_PARSING_REGEXES
from lib.core.settings import GRAPHQL_ENDPOINT_PATHS
@ -234,6 +236,13 @@ def _gqlSend(endpoint, query, variables=None):
body = {"query": query}
if variables:
body["variables"] = variables
if conf.delay:
time.sleep(conf.delay)
if conf.verbose >= 3:
logger.log(CUSTOM_LOGGING.PAYLOAD, query[:200])
oldPostHint = getattr(kb, "postHint", None)
try:
kb.postHint = POST_HINT.JSON
@ -974,6 +983,8 @@ def _testSlot(slot, endpoint):
report = "---\nParameter: %s.%s(%s:) (%s)\n Type: GraphQL injection\n Title: %s\n Payload: %s\n---" % (
slot.parentType, slot.fieldName, slot.targetArg, slot.strategy, title, _escapeGraphQLString(payload))
conf.dumper.singleString(report)
if conf.beep:
beep()
# In-band exposure: the always-true payload reflecting extra records directly
if kind == "boolean" and templatePage: