CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adding some more boundaries

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-20 12:37:16 +02:00
parent fc9b3c9b67
commit 6ce5d7d7e4
4 changed files with 62 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

58
data/xml/boundaries.xml
View file

@ -55,6 +55,8 @@ Tag: <boundary>
4: Double quoted string
5: LIKE double quoted string
6: Identifier (e.g. column name)
7: Block comment
8: Alternative quoted string (e.g. PostgreSQL $$...$$, Oracle q'[...]')
Sub-tag: <prefix>
A string to prepend to the payload.
@ -517,6 +519,18 @@ Formats:
</boundary>
<!-- End of pre-WHERE derived table boundaries -->
<!-- Block-comment escape: injection point sits INSIDE /* ... */ (e.g. a query tag / trace / tenant
annotation). '*/' terminates the app comment, the test runs, '/*' re-opens a comment that the
app's original '*/' closes. Inert (stays inside the literal) when the value is not in a comment. -->
<boundary>
<level>4</level>
<clause>1,2,3</clause>
<where>1,2</where>
<ptype>7</ptype>
<prefix>*/</prefix>
<suffix>/*</suffix>
</boundary>
<!-- Escaped column name (e.g. SELECT `...` FROM table) boundaries -->
<boundary>
<level>4</level>
@ -565,4 +579,48 @@ Formats:
<suffix>#</suffix>
</boundary>
<!-- End of AGAINST boolean full-text search boundaries -->
<!-- Alternative quoted string delimiters where ' and " have no terminating effect:
PostgreSQL $$...$$ dollar quoting, Oracle q'[...]' / q'{...}' / q'(...)' / q'<...>'. -->
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>8</ptype>
<prefix>$$</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>8</ptype>
<prefix>]'</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>8</ptype>
<prefix>}'</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>8</ptype>
<prefix>)'</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<boundary>
<level>5</level>
<clause>1</clause>
<where>1,2</where>
<ptype>8</ptype>
<prefix>&gt;'</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
<!-- End of alternative quoted string boundaries -->
</root>

2
lib/core/enums.py
View file

@ -339,6 +339,8 @@ class PAYLOAD(object):
4: "Double quoted string",
5: "LIKE double quoted string",
6: "Identifier (e.g. column name)",
7: "Block comment",
8: "Alternative quoted string",
}
RISK = {

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.148"
VERSION = "1.10.7.149"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

2
tests/test_payloads_structure.py
View file

@ -109,7 +109,7 @@ class TestBoundaryEntries(unittest.TestCase):
# ptype feeds the recorded injection identity (report label, (place,parameter,ptype) dedup
# key, session hash) - an out-of-range value silently corrupts all three
for b in conf.boundaries:
self.assertIn(b.ptype, (1, 2, 3, 4, 5, 6), msg="boundary %r bad ptype %r" % (b.prefix, b.ptype))
self.assertIn(b.ptype, (1, 2, 3, 4, 5, 6, 7, 8), msg="boundary %r bad ptype %r" % (b.prefix, b.ptype))
def test_ptype_matches_prefix_quote(self):
# The lexical quote a prefix opens with must agree with ptype (else the injection is recorded