From f9e53443ed0e261854a382d71124435537d41d96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Thu, 12 Nov 2026 11:50:32 +0100 Subject: [PATCH] Fix for anti-CSRF tokens containing '+' (and GET token not found with -p) --- lib/core/settings.py | 2 +- lib/core/target.py | 2 +- lib/request/connect.py | 11 +++++++---- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index 2d3c6b130..ea85937cc 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -19,7 +19,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.11.11" +VERSION = "1.10.11.12" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/core/target.py b/lib/core/target.py index 87feb4d2a..bdd1501a1 100644 --- a/lib/core/target.py +++ b/lib/core/target.py @@ -457,7 +457,7 @@ def _setRequestParams(): raise SqlmapGenericException(errMsg) if conf.csrfToken: - if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, conf.data or "") and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}) and not any(re.search(conf.csrfToken, _, re.I) for _ in conf.paramDict.get(PLACE.URI, {}).values()): + if not any(re.search(conf.csrfToken, ' '.join(_), re.I) for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}), conf.paramDict.get(PLACE.COOKIE, {}))) and not re.search(r"\b%s\b" % conf.csrfToken, "%s %s" % (conf.data or "", conf.parameters.get(PLACE.GET) or "")) and conf.csrfToken not in set(_[0].lower() for _ in conf.httpHeaders) and conf.csrfToken not in conf.paramDict.get(PLACE.COOKIE, {}) and not any(re.search(conf.csrfToken, _, re.I) for _ in conf.paramDict.get(PLACE.URI, {}).values()): errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken._original errMsg += "found in provided GET, POST, Cookie or header values" raise SqlmapGenericException(errMsg) diff --git a/lib/request/connect.py b/lib/request/connect.py index bde7336a6..8c0f05088 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -1412,7 +1412,7 @@ class Connect(object): logger.warning(warnMsg) page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, post=conf.csrfData or (conf.data if conf.csrfUrl == conf.url and (conf.csrfMethod or "").upper() == HTTPMETHOD.POST else None), method=conf.csrfMethod or (conf.method if conf.csrfUrl == conf.url else None), cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST)) - page = urldecode(page) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...') + page = urldecode(page, spaceplus=False) # for anti-CSRF tokens with special characters in their name (e.g. 'foo:bar=...') - Note: '+' is a legitimate (e.g. Base64) token value character match = re.search(r"(?i)]+\bname=[\"']?(?P%s)\b[^>]*\bvalue=[\"']?(?P[^>'\"]*)" % conf.csrfToken, page or "", re.I) @@ -1467,14 +1467,17 @@ class Connect(object): if token: token.value = token.value.strip("'\"") + # Note: (decoded) token value has to be URL encoded for (URL encoded) places (e.g. Base64 token 'ab+cd/ef==' -> 'ab%2Bcd%2Fef%3D%3D') + encoded = urlencode(token.value, convall=True) + for candidate in (PLACE.GET, PLACE.POST, PLACE.CUSTOM_POST, PLACE.URI): if candidate in conf.parameters: if candidate == PLACE.URI and uri: - uri = _adjustParameter(uri, token.name, token.value) + uri = _adjustParameter(uri, token.name, encoded) elif candidate == PLACE.GET and get: - get = _adjustParameter(get, token.name, token.value) + get = _adjustParameter(get, token.name, encoded) elif candidate in (PLACE.POST, PLACE.CUSTOM_POST) and post: - post = _adjustParameter(post, token.name, token.value) + post = _adjustParameter(post, token.name, encoded if candidate == PLACE.POST else token.value) for i in xrange(len(conf.httpHeaders)): if conf.httpHeaders[i][0].lower() == token.name.lower():