CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adding some guard blocks when people fool around with their environment

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-20 22:19:57 +02:00
parent 37771f0d25
commit e589936982
3 changed files with 22 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.154" VERSION = "1.10.7.155"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

23
lib/parse/banner.py
View file

@ -12,6 +12,7 @@ from xml.sax.handler import ContentHandler
from lib.core.common import Backend from lib.core.common import Backend
from lib.core.common import parseXmlFile from lib.core.common import parseXmlFile
from lib.core.common import sanitizeStr from lib.core.common import sanitizeStr
from lib.core.common import singleTimeWarnMessage
from lib.core.data import kb from lib.core.data import kb
from lib.core.data import paths from lib.core.data import paths
from lib.core.enums import DBMS from lib.core.enums import DBMS
@ -103,13 +104,17 @@ def bannerParser(banner):
if not xmlfile: if not xmlfile:
return return
if Backend.isDbms(DBMS.MSSQL): try:
handler = MSSQLBannerHandler(banner, kb.bannerFp) if Backend.isDbms(DBMS.MSSQL):
parseXmlFile(xmlfile, handler) handler = MSSQLBannerHandler(banner, kb.bannerFp)
parseXmlFile(xmlfile, handler)
handler = FingerprintHandler(banner, kb.bannerFp) handler = FingerprintHandler(banner, kb.bannerFp)
parseXmlFile(paths.GENERIC_XML, handler) parseXmlFile(paths.GENERIC_XML, handler)
else: else:
handler = FingerprintHandler(banner, kb.bannerFp) handler = FingerprintHandler(banner, kb.bannerFp)
parseXmlFile(xmlfile, handler) parseXmlFile(xmlfile, handler)
parseXmlFile(paths.GENERIC_XML, handler) parseXmlFile(paths.GENERIC_XML, handler)
except Exception:
# best-effort banner fingerprinting - a broken/patched xml.sax must not abort the scan (see #6086)
singleTimeWarnMessage("unable to parse the DBMS banner for version fingerprinting")

9
lib/parse/headers.py
View file

@ -8,6 +8,7 @@ See the file 'LICENSE' for copying permission
import os import os
from lib.core.common import parseXmlFile from lib.core.common import parseXmlFile
from lib.core.common import singleTimeWarnMessage
from lib.core.data import kb from lib.core.data import kb
from lib.core.data import paths from lib.core.data import paths
from lib.parse.handler import FingerprintHandler from lib.parse.handler import FingerprintHandler
@ -32,5 +33,9 @@ def headersParser(headers):
for header, xmlfile in kb.headerPaths.items(): for header, xmlfile in kb.headerPaths.items():
if header in headers: if header in headers:
handler = FingerprintHandler(headers[header], kb.headersFp) handler = FingerprintHandler(headers[header], kb.headersFp)
parseXmlFile(xmlfile, handler) try:
parseXmlFile(paths.GENERIC_XML, handler) parseXmlFile(xmlfile, handler)
parseXmlFile(paths.GENERIC_XML, handler)
except Exception:
# best-effort header fingerprinting - a broken/patched xml.sax must not abort the scan (see #6086)
singleTimeWarnMessage("unable to parse the response headers for technology fingerprinting")