From 4ba8edef1d321f23642bb0b7f97c33cf595a1895 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Mon, 22 Jun 2026 22:28:30 +0200 Subject: [PATCH] Minor update --- data/txt/sha256sums.txt | 4 +-- lib/core/settings.py | 2 +- lib/request/dns.py | 66 ++++++++++++++++++++++++++++++----------- 3 files changed, 52 insertions(+), 20 deletions(-) diff --git a/data/txt/sha256sums.txt b/data/txt/sha256sums.txt index 85fb9356e..9a8211888 100644 --- a/data/txt/sha256sums.txt +++ b/data/txt/sha256sums.txt @@ -189,7 +189,7 @@ ccc4a717e887652b1fcce073d9409d9c59a3b28548c703a9e453d15845f90cd7 lib/core/patch 9bf174058f15d14e24e94f9aaf42df045119d3617c6c54bd2f3af79b462f331d lib/core/replication.py 0b8c38a01bb01f843d94a6c5f2075ee47520d0c4aa799cecea9c3e2c5a4a23a6 lib/core/revision.py 888daba83fd4a34e9503fe21f01fef4cc730e5cde871b1d40e15d4cbc847d56c lib/core/session.py -c041ad865180b79c4b3e798530638d00ca1f9fa14e4c9e1506a2bf7c8c811b9f lib/core/settings.py +4df19d4b5ce21922573c387d9f4a2a228a44a4f7c07c9a0d4c38048b04e1912b lib/core/settings.py c7804223319e18eb0b8e2cbf0a8b6896d1cefb7b0b1a2e9f1cf826a8a3b56750 lib/core/shell.py a2e98a94b231432736d6b304fc75525c8b5fdb4768c418387c5b4c1a610dad64 lib/core/subprocessng.py 19f1e3c5e3ba703d28d510cd7a9ab8284d5fbe9df5ce7e77c86e5931571364b7 lib/core/target.py @@ -214,7 +214,7 @@ bc61bc944b81a7670884f82231033a6ac703324b34b071c9834886a92e249d0e lib/request/ch d4bb0869b03602a0c8f9e0e0fd217753f14ddadf848fc9f3c65a74d03feb9958 lib/request/comparison.py b9e2db44d265909792f6cc821ff910727b14aa2d5063c74b0f2ea6d40c4f3d9d lib/request/connect.py 8e06682280fce062eef6174351bfebcb6040e19976acff9dc7b3699779783498 lib/request/direct.py -05198477dbdeb6c405059eb21cbbcf9cb6804cc54a0f2a1d11741bfc6cbb7ca2 lib/request/dns.py +676d59c53de4d119f79a8b32c4d9282c1e48833dca688f743d8a0c06433aa502 lib/request/dns.py 92c81cc31ff4a396723242058fb2152c9e9745f8412d01ea74480b048a53af6c lib/request/httpshandler.py 1966ca704961fb987ab757f0a4afddbf841d1a880631b701487c75cef63d60c3 lib/request/__init__.py 7a0ac2522213e756348fd871a7af74cc963bdc82f9d7ade57be5de42b5bf7cab lib/request/inject.py diff --git a/lib/core/settings.py b/lib/core/settings.py index 4c57af444..8261a846a 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.6.145" +VERSION = "1.10.6.146" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/request/dns.py b/lib/request/dns.py index ffd389a4d..0b0d6d291 100644 --- a/lib/request/dns.py +++ b/lib/request/dns.py @@ -34,18 +34,42 @@ class DNSQuery(object): self._query = b"" try: + # Minimum DNS header length is 12 bytes, followed by at least a + # root label terminator. Shorter packets are malformed/no-op. + if len(raw) <= 12: + return + type_ = (ord(raw[2:3]) >> 3) & 15 # Opcode bits if type_ == 0: # Standard query i = 12 - j = ord(raw[i:i + 1]) + parts = [] - while j != 0: - self._query += raw[i + 1:i + j + 1] + b'.' - i = i + j + 1 + while i < len(raw): j = ord(raw[i:i + 1]) - except TypeError: - pass + + if j == 0: + break + + # Compression pointers are not expected in the question name + # here. Treat them as malformed instead of walking arbitrary + # offsets or creating a partial query. + if j & 0xc0: + parts = [] + break + + i = i + 1 + if i + j > len(raw): + parts = [] + break + + parts.append(raw[i:i + j]) + i = i + j + + if parts: + self._query = b".".join(parts) + b'.' + except Exception: + self._query = b"" def response(self, resolution): """ @@ -55,16 +79,19 @@ class DNSQuery(object): retVal = b"" if self._query: - retVal += self._raw[:2] # Transaction ID - retVal += b"\x85\x80" # Flags (Standard query response, No error) - retVal += self._raw[4:6] + self._raw[4:6] + b"\x00\x00\x00\x00" # Questions and Answers Counts - retVal += self._raw[12:(12 + self._raw[12:].find(b"\x00") + 5)] # Original Domain Name Query - retVal += b"\xc0\x0c" # Pointer to domain name - retVal += b"\x00\x01" # Type A - retVal += b"\x00\x01" # Class IN - retVal += b"\x00\x00\x00\x20" # TTL (32 seconds) - retVal += b"\x00\x04" # Data length - retVal += b"".join(struct.pack('B', int(_)) for _ in resolution.split('.')) # 4 bytes of IP + offset = self._raw[12:].find(b"\x00") + + if offset >= 0: + retVal += self._raw[:2] # Transaction ID + retVal += b"\x85\x80" # Flags (Standard query response, No error) + retVal += self._raw[4:6] + self._raw[4:6] + b"\x00\x00\x00\x00" # Questions and Answers Counts + retVal += self._raw[12:(12 + offset + 5)] # Original Domain Name Query + retVal += b"\xc0\x0c" # Pointer to domain name + retVal += b"\x00\x01" # Type A + retVal += b"\x00\x01" # Class IN + retVal += b"\x00\x00\x00\x20" # TTL (32 seconds) + retVal += b"\x00\x04" # Data length + retVal += b"".join(struct.pack('B', int(_)) for _ in resolution.split('.')) # 4 bytes of IP return retVal @@ -160,10 +187,15 @@ class DNSServer(object): try: _ = DNSQuery(data) + if not _._query: + continue + with self._lock: self._requests.append(_._query) - self._socket.sendto(_.response("127.0.0.1"), addr) + response = _.response("127.0.0.1") + if response: + self._socket.sendto(response, addr) except KeyboardInterrupt: raise except Exception: