diff --git a/data/txt/sha256sums.txt b/data/txt/sha256sums.txt index 1f91198ab0..9204a51a7e 100644 --- a/data/txt/sha256sums.txt +++ b/data/txt/sha256sums.txt @@ -167,7 +167,7 @@ d69e84f1648cdb907f5d2dd454f03874a4613752b07867510145d51d84b3c56f lib/controller 1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/controller/__init__.py 9e694e4864d865c5da745aaf9d35da885eff697a9a0f7b37c3e85d47b4378f64 lib/core/agent.py b13462712ec5ac07541dba98631ddcda279d210b838f363d15ac97a1413b67a2 lib/core/bigarray.py -c265eb478d912aba53ebd1d93de2646a7738b7a0e621a2c38a35f0ba897d3db6 lib/core/common.py +9abf4df5ef34cfaf188249483a3e95a486212fd4504eb322dcb07a17b2fff16b lib/core/common.py a6397b10de7ae7c56ed6b0fa3b3c58eb7a9dbede61bf93d786e73258175c981e lib/core/compat.py 461f2666d500f9a91210fec558e6ee68af61c752de5498490bc96c11b32a6b0a lib/core/convert.py c03dc585f89642cfd81b087ac2723e3e1bb3bfa8c60e6f5fe58ef3b0113ebfe6 lib/core/data.py @@ -188,7 +188,7 @@ d197388e8e2aabe19f2529bfcac780e18e22a905d01319080d7afe4cb2b1c4c9 lib/core/optio 48797d6c34dd9bb8a53f7f3794c85f4288d82a9a1d6be7fcf317d388cb20d4b3 lib/core/replication.py 0b8c38a01bb01f843d94a6c5f2075ee47520d0c4aa799cecea9c3e2c5a4a23a6 lib/core/revision.py 888daba83fd4a34e9503fe21f01fef4cc730e5cde871b1d40e15d4cbc847d56c lib/core/session.py -d372fb2cbdd8b54c0696a5927d73d6924c458f03f4db81d856d0338ddfa27fa6 lib/core/settings.py +3fea7262bc40f5a7cf31ae81c1f2d1a12361d7b7e1d45411d6617475bd691608 lib/core/settings.py cd5a66deee8963ba8e7e9af3dd36eb5e8127d4d68698811c29e789655f507f82 lib/core/shell.py bcb5d8090d5e3e0ef2a586ba09ba80eef0c6d51feb0f611ed25299fbb254f725 lib/core/subprocessng.py 70ea3768f1b3062b22d20644df41c86238157ec80dd43da40545c620714273c6 lib/core/target.py @@ -211,7 +211,7 @@ d2e771cdacef25ee3fdc0e0355b92e7cd1b68f5edc2756ffc19f75d183ba2c73 lib/parse/payl 132abf563aeaaf0108b7e3932cfcc9680c8f445e992de4ee71ceed1ddf60bc29 lib/request/basic.py bc61bc944b81a7670884f82231033a6ac703324b34b071c9834886a92e249d0e lib/request/chunkedhandler.py 09c2d8786fb5280f5f14a7b4345ecb2e7c2ca836ee06a6cf9b51770df923d94c lib/request/comparison.py -02bd85b09ab346309c596eb067dd97c3c6be101c7557e79709fe9e405ca05c88 lib/request/connect.py +5a93943509a0de21322fab8df15ea56df9d5ee12363aadc1dd171622eafc8fcd lib/request/connect.py 8e06682280fce062eef6174351bfebcb6040e19976acff9dc7b3699779783498 lib/request/direct.py cf019248253a5d7edb7bc474aa020b9e8625d73008a463c56ba2b539d7f2d8ec lib/request/dns.py 92c81cc31ff4a396723242058fb2152c9e9745f8412d01ea74480b048a53af6c lib/request/httpshandler.py diff --git a/lib/core/common.py b/lib/core/common.py index a28abcb4f0..4baadd4da9 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -107,7 +107,6 @@ from lib.core.optiondict import optDict from lib.core.settings import BANNER from lib.core.settings import BOLD_PATTERNS_REGEX -from lib.core.settings import BOUNDARY_BACKSLASH_MARKER from lib.core.settings import BOUNDED_INJECTION_MARKER from lib.core.settings import BRUTE_DOC_ROOT_PREFIXES from lib.core.settings import BRUTE_DOC_ROOT_SUFFIXES @@ -1019,7 +1018,7 @@ def clearColors(message): retVal = message - if isinstance(message, str): + if isinstance(message, six.string_types): retVal = re.sub(r"\x1b\[[\d;]+m", "", message) return retVal @@ -1148,8 +1147,11 @@ def readInput(message, default=None, checkBatch=True, boolean=False): return conf.answers for item in conf.answers.split(','): - question = item.split('=')[0].strip() - answer = item.split('=')[1] if len(item.split('=')) > 1 else None + if '=' in item: + question, answer = item.split('=', 1) + question = question.strip() + else: + question, answer = item.strip(), None if answer and question.lower() in message.lower(): retVal = getUnicode(answer, UNICODE_ENCODING) elif answer is None and retVal: @@ -1630,7 +1632,7 @@ def parseTargetDirect(): conf.dbmsPass = details.group("pass").strip("'\"") else: if conf.dbmsCred: - conf.dbmsUser, conf.dbmsPass = conf.dbmsCred.split(':') + conf.dbmsUser, conf.dbmsPass = conf.dbmsCred.split(':', 1) else: conf.dbmsUser = "" conf.dbmsPass = "" @@ -1794,7 +1796,8 @@ def parseTargetUrl(): errMsg = "invalid target URL port (%d)" % conf.port raise SqlmapSyntaxException(errMsg) - conf.url = getUnicode("%s://%s%s%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, (":%d" % conf.port) if not (conf.port == 80 and conf.scheme == "http" or conf.port == 443 and conf.scheme == "https") else "", conf.path)) + defaultPort = conf.port == 80 and conf.scheme in ("http", "ws") or conf.port == 443 and conf.scheme in ("https", "wss") + conf.url = getUnicode("%s://%s%s%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, (":%d" % conf.port) if not defaultPort else "", conf.path)) conf.url = conf.url.replace(URI_QUESTION_MARKER, '?') if urlSplit.query: diff --git a/lib/core/settings.py b/lib/core/settings.py index 2887d709ed..62b7a4d680 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from thirdparty import six # sqlmap version (...) -VERSION = "1.10.6.0" +VERSION = "1.10.6.12" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/request/connect.py b/lib/request/connect.py index 930d5bb11f..f293b97059 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -287,6 +287,7 @@ def getPage(**kwargs): cookie = kwargs.get("cookie", None) ua = kwargs.get("ua", None) or conf.agent referer = kwargs.get("referer", None) or conf.referer + host = kwargs.get("host", None) direct_ = kwargs.get("direct", False) multipart = kwargs.get("multipart", None) silent = kwargs.get("silent", False) @@ -421,7 +422,7 @@ def getPage(**kwargs): elif target: if conf.forceSSL: url = re.sub(r"(?i)\A(http|ws):", r"\g<1>s:", url) - url = re.sub(r"(?i):80/", ":443/", url) + url = re.sub(r"(?i):80(?=[/?#]|\Z)", ":443", url) if PLACE.GET in conf.parameters and not get: get = conf.parameters[PLACE.GET] @@ -447,7 +448,7 @@ def getPage(**kwargs): requestMsg += " %s" % _http_client.HTTPConnection._http_vsn_str # Prepare HTTP headers - headers = forgeHeaders({HTTP_HEADER.COOKIE: cookie, HTTP_HEADER.USER_AGENT: ua, HTTP_HEADER.REFERER: referer, HTTP_HEADER.HOST: getHeader(dict(conf.httpHeaders), HTTP_HEADER.HOST) or getHostHeader(url)}, base=None if target else {}) + headers = forgeHeaders({HTTP_HEADER.COOKIE: cookie, HTTP_HEADER.USER_AGENT: ua, HTTP_HEADER.REFERER: referer, HTTP_HEADER.HOST: host or getHeader(dict(conf.httpHeaders), HTTP_HEADER.HOST) or getHostHeader(url)}, base=None if target else {}) if HTTP_HEADER.COOKIE in headers: cookie = headers[HTTP_HEADER.COOKIE] @@ -505,7 +506,7 @@ def getPage(**kwargs): for key, value in list(headers.items()): if key.upper() == HTTP_HEADER.ACCEPT_ENCODING.upper(): - value = re.sub(r"(?i)(,)br(,)?", lambda match: ',' if match.group(1) and match.group(2) else "", value) or "identity" + value = ','.join(_ for _ in re.split(r"\s*,\s*", value) if _.split(';', 1)[0].lower() != "br") or "identity" del headers[key] if isinstance(value, six.string_types): @@ -519,7 +520,7 @@ def getPage(**kwargs): if webSocket: ws = websocket.WebSocket() ws.settimeout(WEBSOCKET_INITIAL_TIMEOUT if kb.webSocketRecvCount is None else timeout) - wsHeaders = tuple("%s: %s" % _ for _ in headers.items() if _[0] not in ("Host",)) + wsHeaders = tuple("%s: %s" % (getUnicode(key), getUnicode(value)) for key, value in headers.items() if getUnicode(key).upper() != HTTP_HEADER.HOST.upper()) ws.connect(url, header=wsHeaders, cookie=cookie) # WebSocket will add Host field of headers automatically ws.send(urldecode(post or "")) @@ -540,7 +541,7 @@ def getPage(**kwargs): ws.close() code = ws.status - status = _http_client.responses[code] + status = _http_client.responses.get(code, "") class _(dict): pass @@ -994,7 +995,7 @@ def _read(count=None): # Dirty patch for Python3.11.0a7 (e.g. https://github.com/sqlmapproject/sqlmap/issues/5091) if not sys.version.startswith("3.11."): - if conf.retryOn and re.search(conf.retryOn, page, re.I): + if conf.retryOn and re.search(conf.retryOn, page or "", re.I): if threadData.retriesCount < conf.retries: warnMsg = "forced retry of the request because of undesired page content" logger.warning(warnMsg) @@ -1370,7 +1371,8 @@ def _randomizeParameter(paramString, randomParameter): variables[name] = value if post and kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE): - for name, value in (parseJson(post) or {}).items(): + json_ = parseJson(post) + for name, value in (json_ if isinstance(json_, dict) else {}).items(): if safeVariableNaming(name) != name: conf.evalCode = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), conf.evalCode) name = safeVariableNaming(name)