466d61ee85
minor fix
2010-12-21 14:29:47 +00:00
385e208f38
code refactoring regarding standard output suppression and some threading issues
2010-12-21 14:21:24 +00:00
6b37ddada4
removed some blank trailing spaces (with extra/shutils/blanks.sh)
2010-12-21 10:31:56 +00:00
29001a4fce
minor update
2010-12-20 23:21:01 +00:00
5852bad963
some refactoring
2010-12-20 18:56:06 +00:00
36862e2efa
update
2010-12-18 15:57:47 +00:00
fe67d3827c
code refactoring and some fixes
2010-12-18 09:51:34 +00:00
f8a01ddaf8
minor update
2010-12-15 11:21:47 +00:00
86690682c7
Minor bug fix to respect -v value in --common-tables and --common-columns
2010-12-13 21:37:12 +00:00
db844c1785
No point in showing the error-based inject payload, it's same as the one showed in -v3
2010-12-13 21:35:20 +00:00
c93634b6c7
blind dumping of tables in sqlite implemented
2010-12-11 22:13:19 +00:00
6a24048aa6
urllib2 doesn't play well with '\n' when non unescaped chars used
2010-12-11 21:17:54 +00:00
f021548bd0
added inference failsafe (like in for instance Firebirds SUBSTR always returns a string value, no matter which starting index you use)
2010-12-11 10:52:04 +00:00
c17f444aab
minor fix
2010-12-11 10:22:18 +00:00
ac9080c07b
update
2010-12-11 08:24:29 +00:00
fe2039f5ba
coollyy little commits
2010-12-10 11:32:46 +00:00
cdff29ada7
update
2010-12-09 11:23:44 +00:00
9c61adb21d
Cosmetics
2010-12-09 00:26:06 +00:00
f5ce739bdf
Added support for time-based blind SQL injection via stacked queries too. Need to add vectors for some DBMS yet.
2010-12-08 23:52:31 +00:00
54f6673609
update
2010-12-08 22:38:26 +00:00
d6077273e0
update
2010-12-08 22:14:42 +00:00
01cf1394a4
code refactoring
2010-12-08 14:26:40 +00:00
af22679605
minor update
2010-12-08 13:09:27 +00:00
6223f25dd9
code beautification
2010-12-08 13:04:48 +00:00
b5e45939e3
sqlmap premiere of blind time based query/bisection
2010-12-08 12:28:54 +00:00
2735848ab6
removed ERROR_SPACE
2010-12-06 22:40:07 +00:00
e8be14e00a
minor refactoring
2010-12-06 07:48:14 +00:00
17449754fe
Got rid of UNION false cond
2010-12-05 16:16:15 +00:00
5764816891
minor cosmetics
2010-12-03 22:28:09 +00:00
126a1479d8
Bug fix for --union-test
2010-12-03 14:57:30 +00:00
11058667e4
Better naming
2010-12-03 14:45:13 +00:00
a9d4b37987
Code cleanup and minor refactoring
2010-12-03 10:51:27 +00:00
283a04e29a
On my way to properly parse test's <where> tag in exploitation phase
2010-12-01 23:32:58 +00:00
47f2d22181
Minor bug fix
2010-12-01 17:18:31 +00:00
089c16a1b8
Added tag <epayload> to the payloads.xml's <test> tag to define which payload to use when exploiting the test type.
...
Removed some useless tests.
Moved <error> from queries.xml to payloads.xml as it makes more sense.
Beeps at sql inj found only if --beep is provided.
Minor fix in order to be able to pickle advancedDict() objects.
Minor code refactoring.
Removed useless folders.
2010-12-01 17:09:52 +00:00
c00ea7f5e5
Store and resume also UNION char to session file (--union-char)
2010-12-01 10:59:58 +00:00
2708aad504
Unified start and stop delimiters accross errror-based (detection engine) and union query (--union-test) tests.
2010-12-01 10:31:50 +00:00
8b9706656e
Got rid of unreliable 'ORDER BY' technique to detect UNION query SQL injection, consequently switch --union-tech has gone now.
...
Minor code refactoring too.
2010-11-29 17:18:38 +00:00
c22338ce90
Removed --error-test, --stacked-test and --time-test switches and adapted the code accordingly. This is due to the fact that the new XML based detection engine already supports all of those tests (and more).
2010-11-29 11:47:58 +00:00
9d7087e2ff
Proper saving and resuming when more than a parameter are injectable.
...
Minor bug fix to --stacked-test
Minor code refactoring.
2010-11-29 01:04:42 +00:00
7e3b24afe6
Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own.
...
All (hopefully) functionalities should still be working.
Added two switches, --level and --risk to specify which injection tests and boundaries to use.
The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work!
2010-11-28 18:10:54 +00:00
f9f076ba97
code refactoring
2010-11-23 21:00:42 +00:00
4af000e699
minor language update (in testing phase "used" is more preferable than "provided")
2010-11-23 15:11:15 +00:00
c23126547e
Improved --union-cols to accept a range to test for union SQL injection. By default it is 1-20.
2010-11-19 15:48:24 +00:00
ad17e9ed2a
Added new switch --union-char to be able to provide the character used in union-test and exploit (default is still NULL, but can be any)
2010-11-19 14:56:20 +00:00
4a9bd3a240
Finally a proper union query SQL injection test engine for --union-test. It does much more requests, but for god sake now it works well!
2010-11-18 17:55:43 +00:00
17486e472a
Proper english (--postfix is now --suffix) and --string/--regexp does not necessarily need to match into the original response body, it might well be in the injected True condition only!
2010-11-17 22:00:09 +00:00
71cb982039
Another bug fix to --union-test
2010-11-15 21:42:56 +00:00
0bfc1b411a
Another bug fix for --union-test
2010-11-14 15:39:57 +00:00
8d07272c82
Added --union-cols switch to specify the max number of columns to test for UNION query sql injection.
...
Now stores/resumes also the exact UNION payload to session file.
2010-11-13 23:24:41 +00:00
Miroslav Stampar