fcdebbd55f
cosmeticados
2010-11-30 14:48:13 +00:00
47a7708950
minor improvement of dynamic content detection/removal part
2010-11-30 12:45:42 +00:00
8b9706656e
Got rid of unreliable 'ORDER BY' technique to detect UNION query SQL injection, consequently switch --union-tech has gone now.
...
Minor code refactoring too.
2010-11-29 17:18:38 +00:00
e9291932e5
Apply --level also to User-Agent (level >= 4) and Cookie (level >= 3).
...
GET and POST parameters are always tested.
2010-11-29 16:33:20 +00:00
e735f2960a
minor update
2010-11-29 15:25:45 +00:00
c76d740a25
just a precaution
2010-11-29 15:21:56 +00:00
70e87d959e
update of dynamicity engine
2010-11-29 15:14:49 +00:00
ee4e04ebca
Minor adjustment
2010-11-29 15:09:40 +00:00
2efb3b78ea
Consider also --dbms value during the detection phase
2010-11-29 14:48:07 +00:00
be6df7abd9
improvement of dynamicity engine
2010-11-29 14:30:57 +00:00
76ce9cc888
Minor bug fix for --forms
2010-11-29 12:46:18 +00:00
6525e08d6b
Minor adjustment to detect the proper parameter type based upon --prefix and --suffix values
2010-11-29 12:13:42 +00:00
c22338ce90
Removed --error-test, --stacked-test and --time-test switches and adapted the code accordingly. This is due to the fact that the new XML based detection engine already supports all of those tests (and more).
2010-11-29 11:47:58 +00:00
e8c6c01e27
precaution
2010-11-29 09:54:30 +00:00
9d7087e2ff
Proper saving and resuming when more than a parameter are injectable.
...
Minor bug fix to --stacked-test
Minor code refactoring.
2010-11-29 01:04:42 +00:00
75f7df75b6
Minor fix
2010-11-28 23:33:51 +00:00
472f4465a6
Prioritize DBMS fingerprint based on DBMS (<dbms>) identified during the detection phase.
...
Minor bug fix to properly handle the case that no injections are found.
Nicer display of injection vulnerabilities detected.
Minor code refactoring.
2010-11-28 21:27:47 +00:00
7e3b24afe6
Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own.
...
All (hopefully) functionalities should still be working.
Added two switches, --level and --risk to specify which injection tests and boundaries to use.
The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work!
2010-11-28 18:10:54 +00:00
a8b38ba76b
removed a trailer blank like (cosmetics)
2010-11-24 14:25:16 +00:00
6712f4da55
some refactoring and one less request for aspx maintanance during --os-shell
2010-11-24 14:20:43 +00:00
253eafb643
paranoid cosmetics
2010-11-24 12:03:01 +00:00
b2b521fc8a
gready regex bastard :)
2010-11-24 12:01:36 +00:00
9579a97039
now ASPX works too for --os-shell
2010-11-24 11:38:27 +00:00
ca58bdbc66
minor update
2010-11-24 10:54:15 +00:00
c54c9ee5d1
minor update
2010-11-23 22:33:00 +00:00
57ad59206b
cosmetics as it's best
2010-11-23 22:09:10 +00:00
7a147041c4
cosmetics
2010-11-23 21:44:58 +00:00
f4f0bc9db3
minor fix
2010-11-23 21:17:01 +00:00
f9f076ba97
code refactoring
2010-11-23 21:00:42 +00:00
7877a931d5
more cosmetics regarding dictionary attack
2010-11-23 20:54:40 +00:00
e3b3e05748
minor update
2010-11-23 19:21:30 +00:00
0d24a15182
more cosmetics
2010-11-23 19:10:34 +00:00
836a1c214a
los cosmeticados (of hash dictionary attack)
2010-11-23 18:57:00 +00:00
c4414df594
minor update
2010-11-23 15:33:13 +00:00
78024eafe0
little precaution
2010-11-23 15:31:23 +00:00
4af000e699
minor language update (in testing phase "used" is more preferable than "provided")
2010-11-23 15:11:15 +00:00
e32be2b4e7
Minor adjustment
2010-11-23 15:06:40 +00:00
b41ee8d0d0
minor refactoring
2010-11-23 14:57:36 +00:00
aa5d038f18
more code refactoring
2010-11-23 14:50:47 +00:00
3cae76627c
code refactoring regarding dictionary attack
2010-11-23 13:58:01 +00:00
ba4ea32603
first working version of dictionary attack
2010-11-23 13:24:02 +00:00
c471b815cc
fix for a bug reported by BugTrace (IndexError: list index out of range)
2010-11-22 10:58:08 +00:00
bfc9378542
sorry, even more proper naming should be like this (passwd is a standard naming for this kind of function(s))
2010-11-20 13:22:59 +00:00
db59faedb9
more proper naming
2010-11-20 13:20:28 +00:00
52c722dab5
renaming of dicts.zip to wordlists.zip (more proper name)
2010-11-20 13:17:13 +00:00
1f8a9fe033
foundations for dictionary attack support combined with the sqlmap's password/hash retrieval functionality (--password switch)
2010-11-20 13:14:13 +00:00
71107e4e9e
quick fix for google searches
2010-11-19 21:38:20 +00:00
99a23e23cf
Extra check on --union-cols value
2010-11-19 16:39:26 +00:00
da7eb329bb
removing file
2010-11-19 16:04:07 +00:00
1fa567e14d
new file added (dictionary attack on password hashes - MySQL, MSSQL, Oracle and Posgres - is soon going to be a part of sqlmap)
2010-11-19 15:51:56 +00:00
Miroslav Stampar