mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-11-13 19:34:43 +00:00
5e2a6aeec8
While looking into #6009 I noticed the Bing fallback in -g never returns anything, even when Bing itself serves a normal results page. Two things changed on Bing's side. The result anchor now carries target="_blank" before href, so '<h2><a href="..." h=' no longer matches at all. And the href is no longer the target URL but a tracking redirect (https://www.bing.com/ck/a?...&u=a1<base64url>), where the real link sits base64url-encoded after the "a1" prefix in the u parameter. The regex now allows extra attributes on both tags and captures either the u payload of a ck/a redirect or a plain href. The payload is decoded with decodeBase64(), which already deals with the URL-safe alphabet and the missing padding. Plain hrefs still work the same as before (with & unescaped), in case Bing serves the old markup to some clients. Checked against a saved live results page (0 -> 10 links) and the old markup, and --smoke-test passes. Google still can't be scraped since it only serves a JS page now, so this doesn't fully close #6009, but Bing is usable again as a fallback when DuckDuckGo blocks the IP. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| api.py | ||
| bcrypt.py | ||
| brotli.py | ||
| brute.py | ||
| crawler.py | ||
| dbwire.py | ||
| deps.py | ||
| dialect.py | ||
| getch.py | ||
| grpcweb.py | ||
| gui.py | ||
| har.py | ||
| hash.py | ||
| hashdb.py | ||
| jwt.py | ||
| keysetdump.py | ||
| library.py | ||
| nonsql.py | ||
| paraminer.py | ||
| pivotdumptable.py | ||
| progress.py | ||
| prove.py | ||
| purge.py | ||
| safe2bin.py | ||
| search.py | ||
| sgmllib.py | ||
| sqlalchemy.py | ||
| sqllint.py | ||
| timeout.py | ||
| tui.py | ||
| versioncheck.py | ||
| wafbypass.py | ||
| xrange.py | ||