 Miroslav Stampar
|
ec5c08ca7a
|
cosmetics
|
2010-12-09 09:24:20 +00:00 |
|
|
Miroslav Stampar
|
db39dc32fc
|
minor update
|
2010-12-09 00:59:39 +00:00 |
|
|
Bernardo Damele
|
9c61adb21d
|
Cosmetics
|
2010-12-09 00:26:06 +00:00 |
|
|
Miroslav Stampar
|
258e9fb50e
|
fix for a "bug" reported by Spencer J. McIntyre (os.makedirs(conf.outputPath, 0755) -> permission denied)
|
2010-12-08 21:16:18 +00:00 |
|
|
Miroslav Stampar
|
81c16926c1
|
code refactoring some more
|
2010-12-08 14:46:07 +00:00 |
|
|
Miroslav Stampar
|
95b48746a6
|
cosmetics
|
2010-12-08 14:29:09 +00:00 |
|
|
Miroslav Stampar
|
01cf1394a4
|
code refactoring
|
2010-12-08 14:26:40 +00:00 |
|
|
Miroslav Stampar
|
af22679605
|
minor update
|
2010-12-08 13:09:27 +00:00 |
|
|
Miroslav Stampar
|
6223f25dd9
|
code beautification
|
2010-12-08 13:04:48 +00:00 |
|
|
Miroslav Stampar
|
64cc2588f1
|
now resume is available for time-based blinds too
|
2010-12-08 12:49:26 +00:00 |
|
|
Miroslav Stampar
|
293ce18fed
|
two major bug fixes regarding time calculation (previously comparison was also a part of "delta", which screwed results in cases with large pages; other was a standard distribution based one)
|
2010-12-07 23:32:33 +00:00 |
|
|
Miroslav Stampar
|
b21eb88905
|
minor update
|
2010-12-07 22:45:38 +00:00 |
|
|
Miroslav Stampar
|
dc651d59ec
|
little mathematics here and there (used "Rules for normally distributed data")
|
2010-12-07 19:19:12 +00:00 |
|
|
Bernardo Damele
|
5f97312f29
|
Minor fix
|
2010-12-07 17:17:38 +00:00 |
|
|
Miroslav Stampar
|
ecd4a5a532
|
added standard deviation check in time based tests
|
2010-12-07 16:39:31 +00:00 |
|
|
Miroslav Stampar
|
294119d2ec
|
more advanced time technique(s)
|
2010-12-07 16:04:53 +00:00 |
|
|
Miroslav Stampar
|
add6235b16
|
removed pageTemplate from injection(s), it's not longer stored in session, and it's reloaded when resuming from session
|
2010-12-07 14:06:54 +00:00 |
|
|
Miroslav Stampar
|
0dc630203f
|
code refactoring
|
2010-12-07 13:34:06 +00:00 |
|
|
Bernardo Damele
|
8e78057ac8
|
Added counter of total HTTP(s) requests done during detection phase
|
2010-12-07 12:33:47 +00:00 |
|
|
Bernardo Damele
|
effd2ca0e3
|
Cosmetics
|
2010-12-07 12:32:58 +00:00 |
|
|
Miroslav Stampar
|
2af8835a94
|
fix for a bug reported by ToR (origValue = paramDict[kb.injection.parameter] -> KeyError in resume with missing injection parameter)
|
2010-12-07 10:57:32 +00:00 |
|
|
Miroslav Stampar
|
3d87489de5
|
minor update
|
2010-12-07 08:05:03 +00:00 |
|
|
Miroslav Stampar
|
61f82fd274
|
introducing [DELAYED] for heavy query time based payloads when response time is non-deterministic
|
2010-12-07 00:27:26 +00:00 |
|
|
Miroslav Stampar
|
2735848ab6
|
removed ERROR_SPACE
|
2010-12-06 22:40:07 +00:00 |
|
|
Miroslav Stampar
|
d77ddbee47
|
OR based inference works for the first time in history and fingerprint of 4 major DBMSes is now injection based (instead of AND)
|
2010-12-06 18:20:57 +00:00 |
|
|
Miroslav Stampar
|
27ee9a5ccf
|
minor refactoring
|
2010-12-06 15:50:19 +00:00 |
|
|
Miroslav Stampar
|
a43d252ae9
|
minor update
|
2010-12-06 00:14:08 +00:00 |
|
|
Bernardo Damele
|
17449754fe
|
Got rid of UNION false cond
|
2010-12-05 16:16:15 +00:00 |
|
|
Bernardo Damele
|
41e1b95c6c
|
Minor code refactoring and finally make exploitation work also on OR boolean-based injections
|
2010-12-05 11:25:44 +00:00 |
|
|
Miroslav Stampar
|
9e5f933ace
|
some updates
|
2010-12-04 15:47:02 +00:00 |
|
|
Miroslav Stampar
|
3f9450b9dc
|
minor fix
|
2010-12-04 14:43:35 +00:00 |
|
|
Miroslav Stampar
|
1f795622b3
|
some fine tuning of dynamicity removing engine
|
2010-12-04 13:39:35 +00:00 |
|
|
Miroslav Stampar
|
eeb199375b
|
usage of compiled regexes in case of dynamic markings and other refactoring
|
2010-12-04 13:23:28 +00:00 |
|
|
Miroslav Stampar
|
0fc7a8f9e8
|
code refactoring
|
2010-12-04 10:13:18 +00:00 |
|
|
Miroslav Stampar
|
04714374f9
|
now you can use kb.pageTemplate to set a page which will be used as a template in comparison process (at least in '-[RANDNUM] OR' cases we'll need to use different template(s))
|
2010-12-04 10:05:18 +00:00 |
|
|
Miroslav Stampar
|
b3a094b9d6
|
fix for a bug reported by ToR (when resuming: queries[kb.dbms] -> KeyError: u'mysql')
|
2010-12-03 22:44:29 +00:00 |
|
|
Miroslav Stampar
|
5764816891
|
minor cosmetics
|
2010-12-03 22:28:09 +00:00 |
|
|
Bernardo Damele
|
5d37df6104
|
Ugly code to set the cookies when got them from a 302 redirect too
|
2010-12-03 17:41:10 +00:00 |
|
|
Bernardo Damele
|
9d55c4da87
|
Done with support for injection in ORDER BY and GROUP BY (hopefully)
|
2010-12-03 16:12:47 +00:00 |
|
|
Bernardo Damele
|
91c3cf8fd0
|
Minor improvement
|
2010-12-03 16:11:57 +00:00 |
|
|
Bernardo Damele
|
126a1479d8
|
Bug fix for --union-test
|
2010-12-03 14:57:30 +00:00 |
|
|
Bernardo Damele
|
b824826a89
|
Minor enhancement to prefix payload in ORDER BY and GROUP BY clauses
|
2010-12-03 14:39:51 +00:00 |
|
|
Miroslav Stampar
|
612ee08a0b
|
added response time kb attribute
|
2010-12-03 13:19:34 +00:00 |
|
|
Bernardo Damele
|
4dec049c22
|
Major bug fix for test on ORDER BY and GROUP BY clauses.
Minor bug fix to skip following tests if they do not match any of the clause previously identified (injection.clause value).
|
2010-12-03 12:00:03 +00:00 |
|
|
Bernardo Damele
|
827a0aea05
|
Minor bug fix
|
2010-12-03 11:15:11 +00:00 |
|
|
Bernardo Damele
|
7690aa85ce
|
Added a comment needed to understand this hack when looking at the code in a month or so ;)
|
2010-12-03 11:00:41 +00:00 |
|
|
Bernardo Damele
|
a9d4b37987
|
Code cleanup and minor refactoring
|
2010-12-03 10:51:27 +00:00 |
|
|
Bernardo Damele
|
22de82634a
|
Important update to parse correctly the <where> tag during exploitation phase.
Minor code cleanup.
|
2010-12-03 10:44:16 +00:00 |
|
|
Miroslav Stampar
|
2cc167a42e
|
fix for a bug reported by ToR: "AttributeError: 'NoneType' object has no attribute 'isdigit'"
|
2010-12-02 18:57:43 +00:00 |
|
|
Bernardo Damele
|
283a04e29a
|
On my way to properly parse test's <where> tag in exploitation phase
|
2010-12-01 23:32:58 +00:00 |
|