Skip to content

Commit 130bcd4

Browse files
stamparmstamparm
committed
Minor update
1 parent ad01aa7 commit 130bcd4

File tree

9 files changed

+33
-36
lines changed

9 files changed

+33
-36
lines changed

‎lib/controller/checks.py‎

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,11 @@
77

88
import copy
99
import logging
10-
import os
1110
import random
1211
import re
1312
import socket
1413
import subprocess
1514
import sys
16-
import tempfile
1715
import time
1816

1917
from extra.beep.beep import beep
@@ -33,7 +31,6 @@
3331
from lib.core.common import hashDBWrite
3432
from lib.core.common import intersect
3533
from lib.core.common import listToStrValue
36-
from lib.core.common import openFile
3734
from lib.core.common import parseFilePaths
3835
from lib.core.common import popValue
3936
from lib.core.common import pushValue
@@ -44,26 +41,22 @@
4441
from lib.core.common import singleTimeLogMessage
4542
from lib.core.common import singleTimeWarnMessage
4643
from lib.core.common import unArrayizeValue
47-
from lib.core.common import urlencode
4844
from lib.core.common import wasLastResponseDBMSError
4945
from lib.core.common import wasLastResponseHTTPError
5046
from lib.core.compat import xrange
5147
from lib.core.convert import getUnicode
52-
from lib.core.defaults import defaults
5348
from lib.core.data import conf
5449
from lib.core.data import kb
5550
from lib.core.data import logger
5651
from lib.core.datatype import AttribDict
5752
from lib.core.datatype import InjectionDict
58-
from lib.core.decorators import cachedmethod
5953
from lib.core.decorators import stackedmethod
6054
from lib.core.dicts import FROM_DUMMY_TABLE
6155
from lib.core.enums import DBMS
6256
from lib.core.enums import HASHDB_KEYS
6357
from lib.core.enums import HEURISTIC_TEST
6458
from lib.core.enums import HTTP_HEADER
6559
from lib.core.enums import HTTPMETHOD
66-
from lib.core.enums import MKSTEMP_PREFIX
6760
from lib.core.enums import NOTE
6861
from lib.core.enums import NULLCONNECTION
6962
from lib.core.enums import PAYLOAD
@@ -81,7 +74,6 @@
8174
from lib.core.settings import CHECK_INTERNET_ADDRESS
8275
from lib.core.settings import CHECK_INTERNET_VALUE
8376
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
84-
from lib.core.settings import DEV_EMAIL_ADDRESS
8577
from lib.core.settings import DUMMY_NON_SQLI_CHECK_APPENDIX
8678
from lib.core.settings import FI_ERROR_REGEX
8779
from lib.core.settings import FORMAT_EXCEPTION_STRINGS
@@ -1387,6 +1379,7 @@ def checkWaf():
13871379
pushValue(kb.resendPostOnRedirect)
13881380
pushValue(conf.timeout)
13891381

1382+
kb.identYwaf = True
13901383
kb.redirectChoice = REDIRECTION.YES
13911384
kb.resendPostOnRedirect = False
13921385
conf.timeout = IDS_WAF_CHECK_TIMEOUT
@@ -1396,30 +1389,31 @@ def checkWaf():
13961389
except SqlmapConnectionException:
13971390
retVal = True
13981391
finally:
1392+
kb.identYwaf = False
13991393
kb.matchRatio = None
14001394

14011395
conf.timeout = popValue()
14021396
kb.resendPostOnRedirect = popValue()
14031397
kb.redirectChoice = popValue()
14041398

1399+
hashDBWrite(HASHDB_KEYS.CHECK_WAF_RESULT, retVal, True)
1400+
14051401
if retVal:
14061402
if not kb.identifiedWafs:
14071403
warnMsg = "heuristics detected that the target "
14081404
warnMsg += "is protected by some kind of WAF/IPS"
14091405
logger.critical(warnMsg)
14101406

14111407
message = "are you sure that you want to "
1412-
message += "continue with further target testing? [y/N] "
1413-
choice = readInput(message, default='N', boolean=True)
1414-
1415-
if not conf.tamper:
1416-
warnMsg = "please consider usage of tamper scripts (option '--tamper')"
1417-
singleTimeWarnMessage(warnMsg)
1408+
message += "continue with further target testing? [Y/n] "
1409+
choice = readInput(message, default='Y', boolean=True)
14181410

14191411
if not choice:
14201412
raise SqlmapUserQuitException
1421-
1422-
hashDBWrite(HASHDB_KEYS.CHECK_WAF_RESULT, retVal, True)
1413+
else:
1414+
if not conf.tamper:
1415+
warnMsg = "please consider usage of tamper scripts (option '--tamper')"
1416+
singleTimeWarnMessage(warnMsg)
14231417

14241418
return retVal
14251419

‎lib/core/common.py‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@
6868
from lib.core.defaults import defaults
6969
from lib.core.dicts import DBMS_DICT
7070
from lib.core.dicts import DEFAULT_DOC_ROOTS
71-
from lib.core.dicts import DEPRECATED_OPTIONS
71+
from lib.core.dicts import OLD_OPTIONS
7272
from lib.core.dicts import SQL_STATEMENTS
7373
from lib.core.enums import ADJUST_TIME_DELAY
7474
from lib.core.enums import CONTENT_STATUS
@@ -4457,17 +4457,19 @@ def getHostHeader(url):
44574457

44584458
return retVal
44594459

4460-
def checkDeprecatedOptions(args):
4460+
def checkOldOptions(args):
44614461
"""
4462-
Checks for deprecated options
4462+
Checks for deprecated/obsolete options
44634463
"""
44644464

44654465
for _ in args:
44664466
_ = _.split('=')[0].strip()
4467-
if _ in DEPRECATED_OPTIONS:
4468-
errMsg = "switch/option '%s' is deprecated" % _
4469-
if DEPRECATED_OPTIONS[_]:
4470-
errMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_]
4467+
if _ in OLD_OPTIONS:
4468+
if OLD_OPTIONS[_]:
4469+
errMsg = "switch/option '%s' is deprecated" % _
4470+
errMsg += " (hint: %s)" % OLD_OPTIONS[_]
4471+
else:
4472+
errMsg = "switch/option '%s' is obsolete" % _
44714473
raise SqlmapSyntaxException(errMsg)
44724474

44734475
def checkSystemEncoding():

‎lib/core/dicts.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@
280280
POST_HINT.ARRAY_LIKE: "application/x-www-form-urlencoded; charset=utf-8",
281281
}
282282

283-
DEPRECATED_OPTIONS = {
283+
OLD_OPTIONS = {
284284
"--replicate": "use '--dump-format=SQLITE' instead",
285285
"--no-unescape": "use '--no-escape' instead",
286286
"--binary": "use '--binary-fields' instead",

‎lib/core/option.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1886,6 +1886,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
18861886
kb.hintValue = None
18871887
kb.htmlFp = []
18881888
kb.httpErrorCodes = {}
1889+
kb.identYwaf = False
18891890
kb.inferenceMode = False
18901891
kb.ignoreCasted = None
18911892
kb.ignoreNotFound = False

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
from thirdparty.six import unichr as _unichr
1919

2020
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
21-
VERSION = "1.3.5.132"
21+
VERSION = "1.3.5.133"
2222
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2323
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2424
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/core/testing.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ def _thread():
7171
thread.start()
7272

7373
for options, checks in (
74-
("--flush-session --identify-waf", ("CloudFlare",)),
74+
("--flush-session", ("CloudFlare",)),
7575
("--flush-session --parse-errors --eval=\"id2=2\" --referer=\"localhost\" --cookie=\"PHPSESSID=d41d8cd98f00b204e9800998ecf8427e\"", (": syntax error", "Type: boolean-based blind", "Type: time-based blind", "Type: UNION query", "back-end DBMS: SQLite", "3 columns")),
7676
("--banner --schema --dump -T users --binary-fields=surname --where \"id>3\"", ("banner: '3", "INTEGER", "TEXT", "id", "name", "surname", "2 entries", "6E616D6569736E756C6C")),
7777
("--all --tamper=between,randomcase", ("5 entries", "luther", "blisset", "fluffy", "179ad45c6ce2cb97cf1029e212046e81", "NULL", "nameisnull", "testpass")),

‎lib/core/wordlist.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
See the file 'LICENSE' for copying permission
66
"""
77

8-
import os
98
import zipfile
109

1110
from lib.core.common import getSafeExString

‎lib/parse/cmdline.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
from optparse import OptionParser
1818
from optparse import SUPPRESS_HELP
1919

20-
from lib.core.common import checkDeprecatedOptions
20+
from lib.core.common import checkOldOptions
2121
from lib.core.common import checkSystemEncoding
2222
from lib.core.common import dataToStdout
2323
from lib.core.common import expandMnemonics
@@ -789,7 +789,7 @@ def _(self, *args):
789789
_.append(getUnicode(arg, encoding=sys.stdin.encoding))
790790

791791
argv = _
792-
checkDeprecatedOptions(argv)
792+
checkOldOptions(argv)
793793

794794
prompt = "--sqlmap-shell" in argv
795795

‎lib/request/basic.py‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -387,13 +387,14 @@ def processResponse(page, responseHeaders, code=None, status=None):
387387

388388
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", "".join(responseHeaders.headers), page)
389389

390-
identYwaf.non_blind.clear()
391-
if identYwaf.non_blind_check(rawResponse, silent=True):
392-
for waf in identYwaf.non_blind:
393-
if waf not in kb.identifiedWafs:
394-
kb.identifiedWafs.add(waf)
395-
errMsg = "WAF/IPS identified as '%s'" % identYwaf.format_name(waf)
396-
singleTimeLogMessage(errMsg, logging.CRITICAL)
390+
if kb.identYwaf:
391+
identYwaf.non_blind.clear()
392+
if identYwaf.non_blind_check(rawResponse, silent=True):
393+
for waf in identYwaf.non_blind:
394+
if waf not in kb.identifiedWafs:
395+
kb.identifiedWafs.add(waf)
396+
errMsg = "WAF/IPS identified as '%s'" % identYwaf.format_name(waf)
397+
singleTimeLogMessage(errMsg, logging.CRITICAL)
397398

398399
if kb.originalPage is None:
399400
for regex in (EVENTVALIDATION_REGEX, VIEWSTATE_REGEX):

0 commit comments

Comments
 (0)