6834 commits

Author	SHA1	Message	Date
Miroslav Štampar	8eacffa226	Fix for --crawl dropping GET links having same parameter names as POST forms	2026-11-12 16:25:57 +01:00
Miroslav Štampar	4b8c39e424	Fix for --param-filter=POST not matching JSON/XML bodies	2026-11-12 16:25:57 +01:00
Miroslav Štampar	ca2e847ef6	Fix for -p Cookie also testing whole Cookie header (in case of --cookie)	2026-11-12 16:25:57 +01:00
Miroslav Štampar	d0fc7512df	Fix for -s with non-existent directory (traceback at the end of run)	2026-11-12 16:25:57 +01:00
Miroslav Štampar	d646b00ceb	Fix for --time-limit producing empty --har file	2026-11-12 16:25:24 +01:00
Miroslav Štampar	ca698bb7ec	Implementing -T for --graphql dumps (and using it in vuln-test to prevent CI timeouts)	2026-11-12 16:14:55 +01:00
Miroslav Štampar	2530de4c1f	Fix for -r request files with multiple Cookie headers and HTTP/2 pseudo-headers	2026-11-12 15:03:20 +01:00
Miroslav Štampar	71907c80fe	Fix for -c configuration values overriding explicit CLI zeros (e.g. --delay 0, -v 0)	2026-11-12 15:00:18 +01:00
Miroslav Štampar	563066e4f5	Fix for --common-tables/--common-columns false positive on oracle string words	2026-11-12 14:56:44 +01:00
Miroslav Štampar	76351cdbd5	Fix for --common-columns false positives (columns of injected query's table)	2026-11-12 14:56:44 +01:00
Miroslav Štampar	4df83fe737	Fix for user's LIMIT being ignored by UNION JSON aggregation (e.g. --sql-query)	2026-11-12 14:53:41 +01:00
Miroslav Štampar	057e614500	Fix for --safe-url carrying injected cookie payload and --safe-req getting target's GET parameters	2026-11-12 14:51:29 +01:00
Miroslav Štampar	3ab05cade0	Fix for anti-CSRF tokens in JSON (spaced), header names with dashes and header values with special chars	2026-11-12 14:50:11 +01:00
Miroslav Štampar	f1c718c01c	Fix for --oob-token being sent to public OOB servers	2026-11-12 14:48:17 +01:00
Miroslav Štampar	d4d2d1a315	Fix for --proxy-file without usable entries silently connecting directly	2026-11-12 14:46:39 +01:00
Miroslav Štampar	b85cd4cc15	Fix for SSTI --os-cmd reporting fabricated output on shell-less engines (e.g. Freemarker)	2026-11-12 14:46:02 +01:00
Miroslav Štampar	d1ceaf9365	Fix for --param-exclude partially matching place names (e.g. 'ge' vs GET)	2026-11-12 14:44:50 +01:00
Miroslav Štampar	445516b151	Fix for retried requests (e.g. timeout, 429, dead proxy) losing the response page	2026-11-12 14:44:08 +01:00
Miroslav Štampar	7944f0e7e8	Fix for -D/-T lists with spaces after commas (e.g. -T 'users, creds')	2026-11-12 14:35:49 +01:00
Miroslav Štampar	7827b2c389	Fix for --sql-file with comment lines	2026-11-12 14:32:41 +01:00
Miroslav Štampar	b48a14a63b	Fix for --sql-query splitting on ';' inside string literals	2026-11-12 14:32:41 +01:00
Miroslav Štampar	04db324b01	Fix for --search -T with multiple tables on SQLite/Firebird (blind)	2026-11-12 14:32:03 +01:00
Miroslav Štampar	d49202eaf1	Fix for SQLite --columns with multiple tables (-T a,b)	2026-11-12 14:31:18 +01:00
Miroslav Štampar	04e1162d5a	Fix for --procs crash on DBMSes without stored procedures support	2026-11-12 14:29:08 +01:00
Miroslav Štampar	fec03cf662	Fix for --param-del being URL encoded in GET requests	2026-11-12 14:28:47 +01:00
Miroslav Štampar	da5c2c66c6	Fix for Set-Cookie merge overwriting other cookies (e.g. id vs x-id)	2026-11-12 14:28:46 +01:00
Miroslav Štampar	fe6f6c48c3	Fix for --ignore-proxy being unusable with environment proxy	2026-11-12 14:28:46 +01:00
Miroslav Štampar	dd6356c277	Fix for --load-cookies crash with session cookies (Python 3)	2026-11-12 14:28:46 +01:00
Miroslav Štampar	c129692040	Fix for --cookie-del (regression from d55d1633)	2026-11-12 14:23:22 +01:00
Miroslav Štampar	7b8e03ef3e	Fix for MSSQL row retrieval losing duplicates (OFFSET/FETCH for 2012+ and Azure)	2026-11-12 13:58:01 +01:00
Miroslav Štampar	e85b1bbd9d	Fix for leftover ASC/DESC when stripping ORDER BY in UNION technique	2026-11-12 12:57:40 +01:00
Miroslav Štampar	b6c4f880a5	Fix for multiple MIN()/MAX() fields in SQL queries (e.g. SELECT MAX(id),MIN(id))	2026-11-12 12:57:39 +01:00
Miroslav Štampar	167956b61c	Fix for LIMIT n OFFSET m being ignored in SQL queries (e.g. --sql-query)	2026-11-12 12:57:39 +01:00
Miroslav Štampar	3f7f87750a	Fix for tamper 'between' breaking function arguments (e.g. BENCHMARK)	2026-11-12 11:50:33 +01:00
Miroslav Štampar	eda9b00185	Fix for interrupted --first/--last corrupting stored value	2026-11-12 11:50:33 +01:00
Miroslav Štampar	6aa218f720	Fix for --dump-format=SQLITE with double quotes in names	2026-11-12 11:50:33 +01:00
Miroslav Štampar	77a31ee595	Fix for SQLite columns with special characters in name (e.g. 'my col')	2026-11-12 11:50:33 +01:00
Miroslav Štampar	c8422bf1f6	Fix for --hex with UNION JSON aggregation (SQLite, PgSQL, Oracle, MSSQL)	2026-11-12 11:50:33 +01:00
Miroslav Štampar	9fa2abb5dd	Fix for --sql-query dropping duplicate rows and query's ordering	2026-11-12 11:50:32 +01:00
Miroslav Štampar	d55d163352	Fix for -p matching inside other parameter names (e.g. id in x-id)	2026-11-12 11:50:32 +01:00
Miroslav Štampar	54c5a6582b	Fix for declined forcing of --dbms still restricting fingerprinting	2026-11-12 11:50:32 +01:00
Miroslav Štampar	a7a9d7a8fe	Fix for --eval dropping parameters after an empty one	2026-11-12 11:50:32 +01:00
Miroslav Štampar	f9e53443ed	Fix for anti-CSRF tokens containing '+' (and GET token not found with -p)	2026-11-12 11:50:32 +01:00
Miroslav Štampar	3c2384525c	Fix for --param-del being URL encoded in POST payload requests	2026-11-12 11:49:07 +01:00
Miroslav Štampar	161af41c9c	Fix for chained tamper hints (e.g. luanginx,space2comment)	2026-11-12 11:49:07 +01:00
Piyush satyarthi	cb5216564a	Close leaked sqlite3 connections (ResourceWarning on Python 3.13+) (#6181) ... Python 3.13+ reports sqlite3 connections that are garbage collected without being closed. The unit tests print a run of "ResourceWarning: unclosed database" lines on Linux/CPython 3.14: - SQLAlchemy.close() only returned its connection to the engine's pool, so the underlying DBAPI connection (e.g. sqlite3 for '-d sqlite://...') stayed open. Dispose the engine on close. - vulnTest() used "with sqlite3.connect(...)", which commits but does not close the connection. Use contextlib.closing(). - test_multibit and test_sqlalchemy never closed what they opened. Co-authored-by: PiyushSatyarthi <244159432+PiyushSatyarthi@users.noreply.github.com>	2026-11-12 09:46:10 +01:00
Miroslav Štampar	eca9ff2e13	Fixes #6180	2026-11-10 15:10:16 +01:00
Miroslav Štampar	397a3bde2e	Implements #6177	2026-11-06 15:31:35 +01:00
Miroslav Štampar	097f4d2c37	Fixes #6176	2026-11-06 15:03:08 +01:00
Miroslav Štampar	202d8cc1c4	Adding some more entries into common files list	2026-11-06 09:15:14 +01:00