120b0d756e
unfix
2011-05-10 21:33:06 +00:00
1151af52bb
More fix for save/resume of --technique
2011-05-07 21:08:14 +00:00
e96a533a04
Bug fix to resume of --technique
2011-05-05 15:18:33 +00:00
955dbc85e7
Minor variable rename
2011-04-30 15:29:59 +00:00
f56d135438
Minor code restyling
2011-04-30 13:20:05 +00:00
d0dff82ce0
Minor code refactoring relating set/get back-end DBMS operating system and minor bug fix to properly enforce OS value with --os switch
2011-04-23 16:25:09 +00:00
b667c50588
store/resume info on xp_cmd available in session file
2011-04-21 14:25:04 +00:00
a313df4d37
Allow user to force temporary folder with --tmp-path even if it has been saved one in the session file
2011-04-21 14:05:37 +00:00
0387654166
update of copyright string (until year)
2011-04-15 12:33:18 +00:00
05d12790f1
closes #219 - unhidden switch --technique and adapted code accordingly (renamed conf.technique to conf.tech to fit properly in the -h help message)
2011-04-06 14:41:44 +00:00
ad2e4002ea
minor improvement
2011-03-01 10:38:27 +00:00
0f3cc153a3
fix for --technique
2011-03-01 09:54:06 +00:00
70449eb01b
minor bug fix
2011-02-20 21:35:28 +00:00
345df5968d
minor update
2011-02-20 21:27:38 +00:00
22cd49a217
--technique can now be something like 123 which includes both techniques 1, 2 and 3
2011-02-17 21:39:16 +00:00
864eade744
Fixed store and resume of brute-forced tables/columns for MSSQL/Sybase
2011-02-10 11:14:05 +00:00
aa0fb276ba
More fixes for --common-columns to work against MSSQL too
2011-02-09 17:22:07 +00:00
2619e4895f
Properly handle --technique at save/resume phase
2011-02-01 22:05:48 +00:00
367d0639f0
refactoring (class names should always be Capital cased)
2011-01-28 16:36:09 +00:00
a3e3387113
fix for proper Firebird resume of version
2011-01-24 11:04:32 +00:00
bade0e3124
Major code refactoring - centralized all kb.dbms* info for both retrieval and set.
2011-01-19 23:06:15 +00:00
d3a28124b1
More code cleanup
2011-01-15 23:11:36 +00:00
fb9d7cdfaa
refactoring, code clearing and removal of obsolete switch --longest-common
2011-01-14 14:37:03 +00:00
2ac8debea0
Major code refactoring - moved to one location only (getIdentifiedDBMS() in common.py) the retrieval of identified/fingerprinted DBMS.
...
Minor bug fixes thanks to previous refactoring too.
2011-01-13 17:36:54 +00:00
af9725214a
Properly deal with partial (single entry) UNION injections.
...
Got rid of kb.union*, now it's all stored/used from kb.injection.
Minor bug fix with where=2 detection phase.
2011-01-12 12:01:32 +00:00
8a67aea754
One more step to fully working UNION exploitation after merge into detection phase
2011-01-12 01:13:32 +00:00
8bdb7ec58c
Ahead with UNION exploitation after UNION test moved to detection phase - a lot to do yet.
2011-01-12 00:47:39 +00:00
300128042c
First big commit to move UNION query tests to detection phase - there are some improvements and tuning to do yet though.
...
Major refactoring to Agent.payload() method.
Minor bug fixes, some code refactoring and a lot of core adjustments here and there.
Added more checks for injection in GROUP BY and ORDER BY.
2011-01-11 22:18:47 +00:00
cc9ca802bf
minor update
2011-01-06 08:54:50 +00:00
dce9a762f1
important update regarding restoring of potentially changed switch values in multi-target mode and/or missing switch values in resume mode
2011-01-02 10:37:32 +00:00
6651ba05eb
another fix (OS was set to None at all previous sessions if there was no explicit OS testing done)
2011-01-02 08:08:38 +00:00
613242e298
bug fix (dynamic markings were not restored in program rerun which potentially led to no data retrieved)
2010-12-29 19:48:19 +00:00
9fb0e0fc85
resume of brute forced data is now available
2010-12-27 14:17:20 +00:00
09479c85dc
minor bug fix
2010-12-21 22:35:44 +00:00
aca074b769
Removed unused outdated code
2010-12-21 10:49:52 +00:00
fe67d3827c
code refactoring and some fixes
2010-12-18 09:51:34 +00:00
a19cb2c13a
code refactoring (added UNKNOWN_DBMS_VERSION instead of "Unknown")
2010-12-17 21:29:09 +00:00
07609bfb53
minor fix
2010-12-17 19:33:20 +00:00
f8a01ddaf8
minor update
2010-12-15 11:21:47 +00:00
2af8835a94
fix for a bug reported by ToR (origValue = paramDict[kb.injection.parameter] -> KeyError in resume with missing injection parameter)
2010-12-07 10:57:32 +00:00
17449754fe
Got rid of UNION false cond
2010-12-05 16:16:15 +00:00
b3a094b9d6
fix for a bug reported by ToR (when resuming: queries[kb.dbms] -> KeyError: u'mysql')
2010-12-03 22:44:29 +00:00
a9d4b37987
Code cleanup and minor refactoring
2010-12-03 10:51:27 +00:00
089c16a1b8
Added tag <epayload> to the payloads.xml's <test> tag to define which payload to use when exploiting the test type.
...
Removed some useless tests.
Moved <error> from queries.xml to payloads.xml as it makes more sense.
Beeps at sql inj found only if --beep is provided.
Minor fix in order to be able to pickle advancedDict() objects.
Minor code refactoring.
Removed useless folders.
2010-12-01 17:09:52 +00:00
c00ea7f5e5
Store and resume also UNION char to session file (--union-char)
2010-12-01 10:59:58 +00:00
c8f943f5e4
Now, if the back-end dbms type has been identified by the detection engine, skips the fingerprint phase.
...
Major code refactoring and commenting to detection engine.
Ask user whether or not to proceed to test remaining parameters after an injection point has been identified.
Restore beep at SQL injection find.
Avoid reuse of same variable in DBMS handler code.
Minor adjustment of payloads XML file.
2010-11-30 22:40:25 +00:00
9d7087e2ff
Proper saving and resuming when more than a parameter are injectable.
...
Minor bug fix to --stacked-test
Minor code refactoring.
2010-11-29 01:04:42 +00:00
7e3b24afe6
Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own.
...
All (hopefully) functionalities should still be working.
Added two switches, --level and --risk to specify which injection tests and boundaries to use.
The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work!
2010-11-28 18:10:54 +00:00
d97e97d884
minor update :)
2010-11-19 09:02:44 +00:00
4a9bd3a240
Finally a proper union query SQL injection test engine for --union-test. It does much more requests, but for god sake now it works well!
2010-11-18 17:55:43 +00:00
Miroslav Stampar