diff --git a/lib/controller/checks.py b/lib/controller/checks.py index f18b9fbb0..c5bd8436f 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -554,7 +554,8 @@ def checkSqlInjection(place, parameter, value): trueRawResponse = "%s%s" % (trueHeaders, truePage) if conf.lengths: - kb.trueLength = len(truePage) + # under NULL connection the body is absent, so take the length HEAD/Range reported + kb.trueLength = threadData.lastComparisonPageLength if kb.nullConnection else len(truePage) trueResult = True if trueResult and not (truePage == falsePage and not any((kb.nullConnection, conf.code))): diff --git a/lib/core/settings.py b/lib/core/settings.py index e16bd71ce..863d0ebaa 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.210" +VERSION = "1.10.7.211" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/core/threads.py b/lib/core/threads.py index 47e8e10ab..a16be6042 100644 --- a/lib/core/threads.py +++ b/lib/core/threads.py @@ -51,6 +51,7 @@ class _ThreadData(threading.local): self.lastComparisonHeaders = None self.lastComparisonCode = None self.lastComparisonRatio = None + self.lastComparisonPageLength = None self.lastPageTemplateCleaned = None self.lastPageTemplateJsonMinimized = None self.lastPageTemplateStructural = None diff --git a/lib/request/comparison.py b/lib/request/comparison.py index 891338353..cb49bc179 100644 --- a/lib/request/comparison.py +++ b/lib/request/comparison.py @@ -85,6 +85,7 @@ def _comparison(page, headers, code, getRatioValue, pageLength): threadData.lastComparisonHeaders = listToStrValue(_ for _ in headers.headers if not _.startswith("%s:" % URI_HTTP_HEADER)) if headers else "" threadData.lastComparisonPage = page threadData.lastComparisonCode = code + threadData.lastComparisonPageLength = pageLength # NULL connection carries the length here (no body) if page is None and pageLength is None: return None @@ -114,9 +115,10 @@ def _comparison(page, headers, code, getRatioValue, pageLength): if conf.code: return conf.code == code - # Response content length to match when the query is True + # Response content length to match when the query is True (NULL connection supplies the length via + # pageLength with no body, so fall back to it rather than len(None)=0 which would stall the oracle) if conf.lengths: - return len(page or "") == kb.trueLength + return (pageLength if page is None else len(page)) == kb.trueLength seqMatcher = threadData.seqMatcher seqMatcher.set_seq1(kb.pageTemplate)