Skip to content

Commit edb9a15

Browse files
stamparmstamparm
committed
Fixes #5761 
1 parent 8b55644 commit edb9a15

File tree

3 files changed

+24
-24
lines changed

3 files changed

+24
-24
lines changed

‎data/txt/sha256sums.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ bf77f9fc4296f239687297aee1fd6113b34f855965a6f690b52e26bd348cb353 lib/core/profi
187187
4eff81c639a72b261c8ba1c876a01246e718e6626e8e77ae9cc6298b20a39355 lib/core/replication.py
188188
bbd1dcda835934728efc6d68686e9b0da72b09b3ee38f3c0ab78e8c18b0ba726 lib/core/revision.py
189189
eed6b0a21b3e69c5583133346b0639dc89937bd588887968ee85f8389d7c3c96 lib/core/session.py
190-
6bcf5bb000afdaa376b24553dfacdd195fe38063ab2b53c1bb17692277328298 lib/core/settings.py
190+
5b992bce2d09db97df8261e99c03022c5ebd57d9bf33e0fbf602c00420ce8239 lib/core/settings.py
191191
2bec97d8a950f7b884e31dfe9410467f00d24f21b35672b95f8d68ed59685fd4 lib/core/shell.py
192192
e90a359b37a55c446c60e70ccd533f87276714d0b09e34f69b0740fd729ddbf8 lib/core/subprocessng.py
193193
54f7c70b4c7a9931f7ff3c1c12030180bde38e35a306d5e343ad6052919974cd lib/core/target.py
@@ -210,7 +210,7 @@ b48edf3f30db127b18419f607894d5de46fc949d14c65fdc85ece524207d6dfd lib/parse/html
210210
2395d6d28d6a1e342fccd56bb741080468a777b9b2a5ddd5634df65fe9785cef lib/request/basic.py
211211
ead55e936dfc8941e512c8e8a4f644689387f331f4eed97854c558be3e227a91 lib/request/chunkedhandler.py
212212
06128c4e3e0e1fe34618de9d1fd5ee21292953dce4a3416567e200d2dfda79f2 lib/request/comparison.py
213-
45f365239c48f2f6b8adc605b2f33b3522bda6e3248589dae909380434aaa0ad lib/request/connect.py
213+
cfccda9e0e9d0121079ab47e9885071a852a428eaa09c13258923b00438d0b78 lib/request/connect.py
214214
470e96857a7037a2d74b2c4b1c8c5d8379b76ea8cbdb1d8dd4367a7a852fa93c lib/request/direct.py
215215
e802cc9099282764da0280172623600b6b9bb9fe1c87f352ade8be7a3f622585 lib/request/dns.py
216216
9922275d3ca79f00f9b9301f4e4d9f1c444dc7ac38de6d50ef253122abae4833 lib/request/httpshandler.py

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from thirdparty import six
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.8.8.0"
22+
VERSION = "1.8.8.1"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/request/connect.py‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1367,18 +1367,18 @@ def _randomizeParameter(paramString, randomParameter):
13671367

13681368
for variable in list(variables.keys()):
13691369
if unsafeVariableNaming(variable) != variable:
1370-
value = variables[variable]
1370+
entry = variables[variable]
13711371
del variables[variable]
1372-
variables[unsafeVariableNaming(variable)] = value
1372+
variables[unsafeVariableNaming(variable)] = entry
13731373

13741374
uri = variables["uri"]
13751375
cookie = variables["cookie"]
13761376

1377-
for name, value in variables.items():
1378-
if name != "__builtins__" and originals.get(name, "") != value:
1379-
if isinstance(value, (int, float, six.string_types, six.binary_type)):
1377+
for name, entry in variables.items():
1378+
if name != "__builtins__" and originals.get(name, "") != entry:
1379+
if isinstance(entry, (int, float, six.string_types, six.binary_type)):
13801380
found = False
1381-
value = getUnicode(value, UNICODE_ENCODING)
1381+
entry = getUnicode(entry, UNICODE_ENCODING)
13821382

13831383
if kb.postHint == POST_HINT.MULTIPART:
13841384
boundary = "--%s" % re.search(r"boundary=([^\s]+)", contentType).group(1)
@@ -1396,18 +1396,18 @@ def _randomizeParameter(paramString, randomParameter):
13961396
found = True
13971397
first = match.group(0)
13981398
second = part[len(first):]
1399-
second = re.sub(r"(?s).+?(\r?\n?\-*\Z)", r"%s\g<1>" % re.escape(value), second)
1399+
second = re.sub(r"(?s).+?(\r?\n?\-*\Z)", r"%s\g<1>" % re.escape(entry), second)
14001400
parts[i] = "%s%s" % (first, second)
14011401
post = boundary.join(parts)
14021402

14031403
elif kb.postHint and re.search(r"\b%s\b" % re.escape(name), post or ""):
14041404
if kb.postHint in (POST_HINT.XML, POST_HINT.SOAP):
14051405
if re.search(r"<%s\b" % re.escape(name), post):
14061406
found = True
1407-
post = re.sub(r"(?s)(<%s\b[^>]*>)(.*?)(</%s)" % (re.escape(name), re.escape(name)), r"\g<1>%s\g<3>" % value.replace('\\', r'\\'), post)
1407+
post = re.sub(r"(?s)(<%s\b[^>]*>)(.*?)(</%s)" % (re.escape(name), re.escape(name)), r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), post)
14081408
elif re.search(r"\b%s>" % re.escape(name), post):
14091409
found = True
1410-
post = re.sub(r"(?s)(\b%s>)(.*?)(</[^<]*\b%s>)" % (re.escape(name), re.escape(name)), r"\g<1>%s\g<3>" % value.replace('\\', r'\\'), post)
1410+
post = re.sub(r"(?s)(\b%s>)(.*?)(</[^<]*\b%s>)" % (re.escape(name), re.escape(name)), r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), post)
14111411

14121412
elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE):
14131413
match = re.search(r"['\"]%s['\"]:" % re.escape(name), post)
@@ -1417,45 +1417,45 @@ def _randomizeParameter(paramString, randomParameter):
14171417
match = re.search(r"(%s%s%s:\s*)(\d+|%s[^%s]*%s)" % (quote, re.escape(name), quote, quote, quote, quote), post)
14181418
if match:
14191419
found = True
1420-
post = post.replace(match.group(0), "%s%s" % (match.group(1), value if value.isdigit() else "%s%s%s" % (match.group(0)[0], value, match.group(0)[0])))
1420+
post = post.replace(match.group(0), "%s%s" % (match.group(1), entry if entry.isdigit() else "%s%s%s" % (match.group(0)[0], entry, match.group(0)[0])))
14211421
post = post.replace(BOUNDARY_BACKSLASH_MARKER, "\\%s" % quote)
14221422

14231423
regex = r"\b(%s)\b([^\w]+)(\w+)" % re.escape(name)
14241424
if not found and re.search(regex, (post or "")):
14251425
found = True
1426-
post = re.sub(regex, r"\g<1>\g<2>%s" % value.replace('\\', r'\\'), post)
1426+
post = re.sub(regex, r"\g<1>\g<2>%s" % entry.replace('\\', r'\\'), post)
14271427

14281428
regex = r"((\A|%s)%s=).+?(%s|\Z)" % (re.escape(delimiter), re.escape(name), re.escape(delimiter))
14291429
if not found and re.search(regex, (post or "")):
14301430
found = True
1431-
post = re.sub(regex, r"\g<1>%s\g<3>" % value.replace('\\', r'\\'), post)
1431+
post = re.sub(regex, r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), post)
14321432

14331433
if re.search(regex, (get or "")):
14341434
found = True
1435-
get = re.sub(regex, r"\g<1>%s\g<3>" % value.replace('\\', r'\\'), get)
1435+
get = re.sub(regex, r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), get)
14361436

14371437
if re.search(regex, (query or "")):
14381438
found = True
1439-
uri = re.sub(regex.replace(r"\A", r"\?"), r"\g<1>%s\g<3>" % value.replace('\\', r'\\'), uri)
1439+
uri = re.sub(regex.replace(r"\A", r"\?"), r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), uri)
14401440

14411441
regex = r"((\A|%s\s*)%s=).+?(%s|\Z)" % (re.escape(conf.cookieDel or DEFAULT_COOKIE_DELIMITER), re.escape(name), re.escape(conf.cookieDel or DEFAULT_COOKIE_DELIMITER))
14421442
if re.search(regex, (cookie or "")):
14431443
found = True
1444-
cookie = re.sub(regex, r"\g<1>%s\g<3>" % value.replace('\\', r'\\'), cookie)
1444+
cookie = re.sub(regex, r"\g<1>%s\g<3>" % entry.replace('\\', r'\\'), cookie)
14451445

14461446
if not found:
14471447
if post is not None:
14481448
if kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE):
14491449
match = re.search(r"['\"]", post)
14501450
if match:
14511451
quote = match.group(0)
1452-
post = re.sub(r"\}\Z", "%s%s}" % (',' if re.search(r"\w", post) else "", "%s%s%s:%s" % (quote, name, quote, value if value.isdigit() else "%s%s%s" % (quote, value, quote))), post)
1452+
post = re.sub(r"\}\Z", "%s%s}" % (',' if re.search(r"\w", post) else "", "%s%s%s:%s" % (quote, name, quote, entry if entry.isdigit() else "%s%s%s" % (quote, entry, quote))), post)
14531453
else:
1454-
post += "%s%s=%s" % (delimiter, name, value)
1454+
post += "%s%s=%s" % (delimiter, name, entry)
14551455
elif get is not None:
1456-
get += "%s%s=%s" % (delimiter, name, value)
1456+
get += "%s%s=%s" % (delimiter, name, entry)
14571457
elif cookie is not None:
1458-
cookie += "%s%s=%s" % (conf.cookieDel or DEFAULT_COOKIE_DELIMITER, name, value)
1458+
cookie += "%s%s=%s" % (conf.cookieDel or DEFAULT_COOKIE_DELIMITER, name, entry)
14591459

14601460
if not conf.skipUrlEncode:
14611461
get = urlencode(get, limit=True)
@@ -1482,8 +1482,8 @@ def _randomizeParameter(paramString, randomParameter):
14821482
dataToStdout(warnMsg)
14831483

14841484
while len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES:
1485-
value = kb.responseTimePayload.replace(RANDOM_INTEGER_MARKER, str(randomInt(6))).replace(RANDOM_STRING_MARKER, randomStr()) if kb.responseTimePayload else kb.responseTimePayload
1486-
Connect.queryPage(value=value, content=True, raise404=False)
1485+
_ = kb.responseTimePayload.replace(RANDOM_INTEGER_MARKER, str(randomInt(6))).replace(RANDOM_STRING_MARKER, randomStr()) if kb.responseTimePayload else kb.responseTimePayload
1486+
Connect.queryPage(value=_, content=True, raise404=False)
14871487
dataToStdout('.')
14881488

14891489
dataToStdout(" (done)\n")

0 commit comments

Comments
 (0)