mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-11-14 11:56:17 +00:00
While looking into #6009 I noticed the Bing fallback in -g never returns anything, even when Bing itself serves a normal results page. Two things changed on Bing's side. The result anchor now carries target="_blank" before href, so '<h2><a href="..." h=' no longer matches at all. And the href is no longer the target URL but a tracking redirect (https://www.bing.com/ck/a?...&u=a1<base64url>), where the real link sits base64url-encoded after the "a1" prefix in the u parameter. The regex now allows extra attributes on both tags and captures either the u payload of a ck/a redirect or a plain href. The payload is decoded with decodeBase64(), which already deals with the URL-safe alphabet and the missing padding. Plain hrefs still work the same as before (with & unescaped), in case Bing serves the old markup to some clients. Checked against a saved live results page (0 -> 10 links) and the old markup, and --smoke-test passes. Google still can't be scraped since it only serves a JS page now, so this doesn't fully close #6009, but Bing is usable again as a fallback when DuckDuckGo blocks the IP. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| agent.py | ||
| bigarray.py | ||
| common.py | ||
| compat.py | ||
| convert.py | ||
| data.py | ||
| datatype.py | ||
| decorators.py | ||
| defaults.py | ||
| dicts.py | ||
| dump.py | ||
| enums.py | ||
| exception.py | ||
| log.py | ||
| option.py | ||
| optiondict.py | ||
| patch.py | ||
| profiling.py | ||
| readlineng.py | ||
| replication.py | ||
| revision.py | ||
| session.py | ||
| settings.py | ||
| shell.py | ||
| subprocessng.py | ||
| target.py | ||
| testing.py | ||
| threads.py | ||
| unescaper.py | ||
| update.py | ||
| wordlist.py | ||