Skip to content

Commit c7e476b

Browse files
EndikaEndika
committed
Merge pull request #16 from sqlmapproject/master
Merge
2 parents edecc5e + 6a1b389 commit c7e476b

2 files changed

Lines changed: 61 additions & 44 deletions

File tree

‎lib/controller/checks.py‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -386,9 +386,12 @@ def checkSqlInjection(place, parameter, value):
386386
# Forge request payload by prepending with boundary's
387387
# prefix and appending the boundary's suffix to the
388388
# test's ' <payload><comment> ' string
389-
boundPayload = agent.prefixQuery(fstPayload, prefix, where, clause)
390-
boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where)
391-
reqPayload = agent.payload(place, parameter, newValue=boundPayload, where=where)
389+
if fstPayload:
390+
boundPayload = agent.prefixQuery(fstPayload, prefix, where, clause)
391+
boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where)
392+
reqPayload = agent.payload(place, parameter, newValue=boundPayload, where=where)
393+
else:
394+
reqPayload = None
392395

393396
# Perform the test's request and check whether or not the
394397
# payload was successful

‎lib/core/target.py‎

Lines changed: 55 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ def _setRequestParams():
8080
return
8181

8282
testableParameters = False
83+
skipHeaders = False
8384

8485
# Perform checks on GET parameters
8586
if conf.parameters.get(PLACE.GET):
@@ -123,11 +124,17 @@ def process(match, repl):
123124
else:
124125
kb.processUserMarks = not test or test[0] not in ("n", "N")
125126

126-
if kb.processUserMarks and "=%s" % CUSTOM_INJECTION_MARK_CHAR in conf.data:
127-
warnMsg = "it seems that you've provided empty parameter value(s) "
128-
warnMsg += "for testing. Please, always use only valid parameter values "
129-
warnMsg += "so sqlmap could be able to run properly"
130-
logger.warn(warnMsg)
127+
if kb.processUserMarks:
128+
skipHeaders = True
129+
130+
conf.parameters.clear()
131+
conf.paramDict.clear()
132+
133+
if "=%s" % CUSTOM_INJECTION_MARK_CHAR in conf.data:
134+
warnMsg = "it seems that you've provided empty parameter value(s) "
135+
warnMsg += "for testing. Please, always use only valid parameter values "
136+
warnMsg += "so sqlmap could be able to run properly"
137+
logger.warn(warnMsg)
131138

132139
if not (kb.processUserMarks and CUSTOM_INJECTION_MARK_CHAR in conf.data):
133140
if re.search(JSON_RECOGNITION_REGEX, conf.data):
@@ -241,11 +248,17 @@ def process(match, repl):
241248
else:
242249
kb.processUserMarks = not test or test[0] not in ("n", "N")
243250

244-
if kb.processUserMarks and "=%s" % CUSTOM_INJECTION_MARK_CHAR in _:
245-
warnMsg = "it seems that you've provided empty parameter value(s) "
246-
warnMsg += "for testing. Please, always use only valid parameter values "
247-
warnMsg += "so sqlmap could be able to run properly"
248-
logger.warn(warnMsg)
251+
if kb.processUserMarks:
252+
skipHeaders = True
253+
254+
conf.parameters.clear()
255+
conf.paramDict.clear()
256+
257+
if "=%s" % CUSTOM_INJECTION_MARK_CHAR in _:
258+
warnMsg = "it seems that you've provided empty parameter value(s) "
259+
warnMsg += "for testing. Please, always use only valid parameter values "
260+
warnMsg += "so sqlmap could be able to run properly"
261+
logger.warn(warnMsg)
249262

250263
if not kb.processUserMarks:
251264
if place == PLACE.URI:
@@ -304,49 +317,50 @@ def process(match, repl):
304317
if conf.get(item):
305318
conf[item] = conf[item].replace(CUSTOM_INJECTION_MARK_CHAR, "")
306319

307-
# Perform checks on Cookie parameters
308-
if conf.cookie:
309-
conf.parameters[PLACE.COOKIE] = conf.cookie
310-
paramDict = paramToDict(PLACE.COOKIE, conf.cookie)
320+
if not skipHeaders:
321+
# Perform checks on Cookie parameters
322+
if conf.cookie:
323+
conf.parameters[PLACE.COOKIE] = conf.cookie
324+
paramDict = paramToDict(PLACE.COOKIE, conf.cookie)
311325

312-
if paramDict:
313-
conf.paramDict[PLACE.COOKIE] = paramDict
314-
testableParameters = True
326+
if paramDict:
327+
conf.paramDict[PLACE.COOKIE] = paramDict
328+
testableParameters = True
315329

316-
# Perform checks on header values
317-
if conf.httpHeaders:
318-
for httpHeader, headerValue in conf.httpHeaders:
319-
# Url encoding of the header values should be avoided
320-
# Reference: http://stackoverflow.com/questions/5085904/is-ok-to-urlencode-the-value-in-headerlocation-value
330+
# Perform checks on header values
331+
if conf.httpHeaders:
332+
for httpHeader, headerValue in conf.httpHeaders:
333+
# Url encoding of the header values should be avoided
334+
# Reference: http://stackoverflow.com/questions/5085904/is-ok-to-urlencode-the-value-in-headerlocation-value
321335

322-
httpHeader = httpHeader.title()
336+
httpHeader = httpHeader.title()
323337

324-
if httpHeader == HTTP_HEADER.USER_AGENT:
325-
conf.parameters[PLACE.USER_AGENT] = urldecode(headerValue)
338+
if httpHeader == HTTP_HEADER.USER_AGENT:
339+
conf.parameters[PLACE.USER_AGENT] = urldecode(headerValue)
326340

327-
condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES)))
341+
condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES)))
328342

329-
if condition:
330-
conf.paramDict[PLACE.USER_AGENT] = {PLACE.USER_AGENT: headerValue}
331-
testableParameters = True
343+
if condition:
344+
conf.paramDict[PLACE.USER_AGENT] = {PLACE.USER_AGENT: headerValue}
345+
testableParameters = True
332346

333-
elif httpHeader == HTTP_HEADER.REFERER:
334-
conf.parameters[PLACE.REFERER] = urldecode(headerValue)
347+
elif httpHeader == HTTP_HEADER.REFERER:
348+
conf.parameters[PLACE.REFERER] = urldecode(headerValue)
335349

336-
condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES)))
350+
condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES)))
337351

338-
if condition:
339-
conf.paramDict[PLACE.REFERER] = {PLACE.REFERER: headerValue}
340-
testableParameters = True
352+
if condition:
353+
conf.paramDict[PLACE.REFERER] = {PLACE.REFERER: headerValue}
354+
testableParameters = True
341355

342-
elif httpHeader == HTTP_HEADER.HOST:
343-
conf.parameters[PLACE.HOST] = urldecode(headerValue)
356+
elif httpHeader == HTTP_HEADER.HOST:
357+
conf.parameters[PLACE.HOST] = urldecode(headerValue)
344358

345-
condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES)))
359+
condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES)))
346360

347-
if condition:
348-
conf.paramDict[PLACE.HOST] = {PLACE.HOST: headerValue}
349-
testableParameters = True
361+
if condition:
362+
conf.paramDict[PLACE.HOST] = {PLACE.HOST: headerValue}
363+
testableParameters = True
350364

351365
if not conf.parameters:
352366
errMsg = "you did not provide any GET, POST and Cookie "

0 commit comments

Comments
 (0)