CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-15 12:29:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
11067 commits 2 branches 143 tags 140 MiB
Commit graph

8802 commits

Author SHA1 Message Date
Miroslav Štampar
3fc41ca370 Salvaging (verified) what's useful from #6103
Some checks are pending
/ build (macos-latest, 3.8) (push) Waiting to run
Details
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
Details
/ build (windows-latest, 3.14) (push) Waiting to run
Details
2026-09-02 07:53:32 +02:00
Ramachandran Thamarai Semmenian
3b8a8d3d09
Do not crash on a JWT with a non-base64url signature (fixes #6101) (#6102)
Some checks are pending
/ build (macos-latest, 3.8) (push) Waiting to run
Details
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
Details
/ build (windows-latest, 3.14) (push) Waiting to run
Details 
JWT_REGEX accepts a signature segment of any length and parseJWT only
validates the header/payload, so a value that matches the JWT pattern but
carries a malformed/truncated signature (e.g. 41 base64url characters,
which is length % 4 == 1 and thus impossible base64) reached crackHMAC.
There decodeBase64(signature) let binascii.Error propagate, aborting the
whole run with an unhandled exception during checkJWT().

Guard the signature decode: a signature that is not valid base64url cannot
be an HMAC we could verify, so crackHMAC now treats it as not crackable
(returns None) instead of raising. The other auditJWT findings are
unaffected. Added a regression doctest.

Co-authored-by: chan770 <tsramachandran770@gmail.com>
 2026-09-01 10:24:58 +02:00
Miroslav Štampar
1192d266c8 Update related to the #6099
Some checks failed
/ build (macos-latest, 3.8) (push) Has been cancelled
Details
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
Details
/ build (windows-latest, 3.14) (push) Has been cancelled
Details
2026-08-28 09:44:22 +02:00
Miroslav Štampar
0a35b20e39 Update related to the #6098
Some checks failed
/ build (macos-latest, 3.8) (push) Has been cancelled
Details
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
Details
/ build (windows-latest, 3.14) (push) Has been cancelled
Details
2026-08-26 13:46:08 +02:00
Miroslav Štampar
a184c89a6b Minor patch for multiple-dbms tags 2026-08-23 17:35:54 +02:00
Miroslav Štampar
91239a3c10 Minor patch 2026-08-23 17:12:19 +02:00
Miroslav Štampar
0ee19bdf3d Minor patch 2026-08-22 23:02:58 +02:00
Miroslav Štampar
cef41c7fa2 Adding semicolon-less MSSQL stacked-query detection payloads 2026-08-18 14:49:23 +02:00
Miroslav Štampar
973ab5ab88 Probe actual gadget executability instead of extension presence (avoids false success as non-superuser) 2026-08-18 12:04:51 +02:00
Miroslav Štampar
d424016742 Update of CHANGELOG 2026-08-18 11:53:51 +02:00
Miroslav Štampar
bec4dedbc9 Enabling PostgreSQL file write over a gadget when stacked queries are unavailable 2026-08-18 11:45:44 +02:00
Miroslav Štampar
529fc7aebb Adding gadget fallback for non-query statement execution without stacked queries (PostgreSQL dblink) 2026-08-18 11:35:54 +02:00
Miroslav Štampar
8a3b312950 Implementing file read/write support for SQLite (fileio extension) 2026-08-18 11:07:00 +02:00
Miroslav Štampar
774c044519 Extending --procs with routine data-access and security type 2026-08-18 10:50:44 +02:00
Miroslav Štampar
848ba68ccf Couple of fixes 2026-08-17 22:20:42 +02:00
Miroslav Štampar
77ee160875 Fixing CI/CD errors 2026-08-17 16:52:00 +02:00
Miroslav Štampar
49a774035f Fixing some of WAF bypass bugs 2026-08-17 16:41:49 +02:00
Miroslav Štampar
dc42edc19f Improving the auto WAF bypass feature 2026-08-17 15:24:18 +02:00
Miroslav Štampar
0ba9df2589 Adding new tamper scripts 2026-08-17 14:28:48 +02:00
Miroslav Štampar
cbe892410c Adding more WAF friendly fingerprinting payloads 2026-08-17 14:25:46 +02:00
Miroslav Štampar
76ddd7a1b9 Fixes #6097 2026-08-16 23:52:22 +02:00
Miroslav Štampar
9f798873c4 Fixing CI/CD errors 2026-08-16 23:16:16 +02:00
Miroslav Štampar
bdf3e09315 Adding support for multi-bit boolean extraction 2026-08-16 23:11:49 +02:00
Miroslav Štampar
99367454c5 Adding a research link to READMEs 2026-08-16 00:17:28 +02:00
Miroslav Štampar
6770b2847b Refresh of tamper docu 2026-08-14 23:21:00 +02:00
Miroslav Štampar
319910ccd8 Adding two new tamper scripts 2026-08-14 22:56:50 +02:00
Miroslav Štampar
ebf4b48337 Fixing CI/CD errors 2026-08-13 19:27:32 +02:00
Miroslav Štampar
92c2ee47ea Adding support for Sybase into dbwire 2026-08-13 14:41:00 +02:00
Miroslav Štampar
58d6f740b7 Some more patching of dbwire 2026-08-13 13:26:55 +02:00
Miroslav Štampar
e9f8180614 Some patching of dbwire 2026-08-13 13:01:43 +02:00
Miroslav Štampar
d8dbaee0df Fixing CI/CD errors 2026-08-12 00:17:57 +02:00
Miroslav Štampar
b154f084e0 Minor update 2026-08-11 23:37:53 +02:00
Miroslav Štampar
e11ea65230 Minor patch 2026-08-11 23:13:20 +02:00
Miroslav Štampar
90b14df46c Minor update 2026-08-11 23:07:22 +02:00
Miroslav Štampar
53411f6fd8 Minor patch 2026-08-11 22:56:35 +02:00
Miroslav Štampar
08b986d40c Faster --odata 2026-08-11 22:43:40 +02:00
Miroslav Štampar
d6370a681b Fixes #6096 2026-08-11 13:40:57 +02:00
Miroslav Štampar
f9a45c6755 Patch related to #6093 2026-08-10 13:42:38 +02:00
Miroslav Štampar
3d1258d57d Patch related to #6092 2026-08-10 11:17:04 +02:00
Miroslav Štampar
dd57fd91e2 Adding switches --odata and --sparql 2026-08-09 11:04:44 +02:00
Miroslav Štampar
fb5339d783 Fixing CI/CD errors 2026-08-08 08:27:00 +02:00
Miroslav Štampar
bbe164a7f3 Better heuristics for non-SQLi techniques 2026-08-08 02:14:34 +02:00
Miroslav Štampar
a8b1bb371d Bug fix (kb.chars generation collision) 2026-08-08 01:27:24 +02:00
Miroslav Štampar
7d2c33cd32 Minor patch 2026-08-08 01:07:07 +02:00
Miroslav Štampar
aa8d9b9841 Patching non-SQLi techniques regarding reflective values 2026-08-08 00:55:37 +02:00
Miroslav Štampar
61ffadb487 Minor update 2026-08-08 00:46:19 +02:00
Miroslav Štampar
881d2e8f90 Adding switch --xslt 2026-08-08 00:37:32 +02:00
Miroslav Štampar
2726807871 Adding tests for dbwire 2026-08-07 18:34:07 +02:00
Miroslav Štampar
be881ea65e Stabilization of dbwire 2026-08-07 18:33:51 +02:00
Miroslav Štampar
6acc970801 Improved mechanism for --proof 2026-08-07 17:04:32 +02:00