Minor patch

lib/core/settings.py

@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.68"
+VERSION = "1.10.7.69"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

lib/core/testing.py

@@ -97,6 +97,7 @@ def vulnTest(tests=None, label="vuln"):
         ("-u \"<base>xpath/search?q=x\" --xpath --flush-session --disable-hashing", ("is vulnerable to XPath injection", "Title: XPath boolean-based blind", "XPath: GET parameter 'q' XML tree", "extracted", "XPath scan complete")),   # XPath: error-based detection + boolean oracle + blind XML tree-walking via starts-with character extraction
         ("-u \"<base>ssti/search?q=x\" --ssti --flush-session --disable-hashing", ("is vulnerable to SSTI", "Title: SSTI Jinja2 injection", "back-end template engine: 'Jinja2'", "in-band arithmetic proof confirmed", "SSTI scan complete")),   # SSTI: Jinja2 detection via arithmetic control-pair + boolean oracle + distinguishing probe
         ("-u \"<base>hql/search?name=admin\" -p name --hql --flush-session --disable-hashing", ("is vulnerable to HQL injection", "back-end: 'Hibernate'", "entity 'Users'", "s3cr3t", "HQL scan complete")),   # HQL: error-based Hibernate fingerprint + boolean oracle + error-leaked entity + blind attribute enumeration and substring value extraction
+        ("-u \"<base>xxe\" --data=\"<root><q>x</q></root>\" --xxe --file-read=\"%s\" --flush-session" % vulnserver.XXE_READ_FILE, ("the XML body processes DTD/internal entities", "in-band XXE file-read impact confirmed", "Type: XXE injection", "XXE scan complete")),   # XXE: in-band internal-entity reflection (real libxml2/lxml parser) + external file:// entity file read
         ("-u \"<url>&query=*\" --flush-session --technique=Q --banner", ("Title: SQLite inline queries", "banner: '3.")),
         ("-d \"<direct>\" --flush-session --dump -T creds --dump-format=SQLITE --binary-fields=password_hash --where \"user_id=5\"", ("3137396164343563366365326362393763663130323965323132303436653831", "dumped to SQLITE database")),
         ("-d \"<direct>\" --flush-session --banner --schema --sql-query=\"UPDATE users SET name='foobar' WHERE id=4; SELECT * FROM users; SELECT 987654321\"", ("banner: '3.", "INTEGER", "TEXT", "id", "name", "surname", "4,foobar,nameisnull", "'987654321'",)),
@@ -104,14 +105,14 @@ def vulnTest(tests=None, label="vuln"):
         ("--purge -v 3", ("~ERROR", "~CRITICAL", "deleting the whole directory tree")),
     )
 
-    # The vulnserver's XPath endpoint renders with lxml and its SSTI endpoint with jinja2; where those
-    # optional third-party engines are not importable (e.g. PyPy 2.7, which has no lxml wheel), skip
+    # The vulnserver's XPath and XXE endpoints render with lxml and its SSTI endpoint with jinja2; where
+    # those optional third-party engines are not importable (e.g. PyPy 2.7, which has no lxml wheel), skip
     # just those entries instead of failing the whole run - the rest of the suite is unaffected.
     try:
         __import__("lxml")
     except ImportError:
-        TESTS = tuple(_ for _ in TESTS if "--xpath" not in _[0])
-        logger.warning("skipping the XPath vuln-test entry ('lxml' not available)")
+        TESTS = tuple(_ for _ in TESTS if "--xpath" not in _[0] and "--xxe" not in _[0])
+        logger.warning("skipping the XPath and XXE vuln-test entries ('lxml' not available)")
     try:
         __import__("jinja2")
     except ImportError:

lib/techniques/graphql/inject.py

@@ -709,12 +709,18 @@ def _detectBoolean(slot, endpoint):
         return None, None
 
     truePage, _ = _gqlSend(endpoint, trueQuery)
+    truePage2, _ = _gqlSend(endpoint, trueQuery)
     falsePage, _ = _gqlSend(endpoint, falseQuery)
 
     trueVal = _slotValue(truePage)
+    trueVal2 = _slotValue(truePage2)
     falseVal = _slotValue(falsePage)
 
-    if _ratio(trueVal, falseVal) < (1.0 - _MIN_RATIO_DIFF):
+    # Require the true response to be REPRODUCIBLE (trueVal ~= trueVal2) and to diverge
+    # from the false response. A single true-vs-false compare turns page jitter into a
+    # false positive; a reproducibility guard (like the other non-SQL engines' _boolean)
+    # rejects it, since a jittery page also fails to reproduce against itself.
+    if _ratio(trueVal, trueVal2) >= (1.0 - _MIN_RATIO_DIFF) and _ratio(trueVal, falseVal) < (1.0 - _MIN_RATIO_DIFF):
         return "boolean-based blind (string)", truePage
 
     return None, None
@@ -731,21 +737,29 @@ def _detectTime(slot, endpoint):
     if not baseQuery:
         return None, None, None
 
-    start = time.time()
-    _gqlSend(endpoint, baseQuery)
-    baseline = time.time() - start
+    def elapsed(query):
+        start = time.time()
+        _gqlSend(endpoint, query)
+        return time.time() - start
 
+    baseline = elapsed(baseQuery)
     delay = conf.timeSec
+    cutoff = baseline + delay * 0.5
+
     for dbms, dialect in DIALECTS.items():
         if not dialect.delay:
             continue
-        query = _buildQuery(slot, "%s' OR %s-- " % (SENTINEL, dialect.delay("1=1", delay)))
-        if not query:
+        sleepQuery = _buildQuery(slot, "%s' OR %s-- " % (SENTINEL, dialect.delay("1=1", delay)))
+        if not sleepQuery or elapsed(sleepQuery) <= cutoff:
             continue
-        start = time.time()
-        _gqlSend(endpoint, query)
-        if (time.time() - start) > baseline + delay * 0.5:
-            return "time-based blind", baseline + delay * 0.5, dbms
+
+        # Confirm before attributing: the delay must REPRODUCE and a false-condition
+        # control must stay fast. A single sample turns jitter/a uniformly-slow endpoint
+        # into a false positive and can pin the wrong dialect; requiring the delay to
+        # track the condition rules both out.
+        controlQuery = _buildQuery(slot, "%s' OR %s-- " % (SENTINEL, dialect.delay("1=2", delay)))
+        if elapsed(sleepQuery) > cutoff and (controlQuery is None or elapsed(controlQuery) <= cutoff):
+            return "time-based blind", cutoff, dbms
 
     return None, None, None