Commit Graph

Select branches

Hide Pull Requests

gh-pages

master

#102

#102

#1029

#1033

#1037

#1053

#1053

#107

#107

#1112

#1186

#1206

#1227

#1227

#1244

#1244

#1246

#1246

#1300

#1300

#1306

#1306

#1323

#1323

#1328

#1330

#1342

#1342

#1351

#1378

#1378

#1402

#1403

#1403

#1414

#1449

#1449

#1469

#1469

#1500

#1535

#1543

#1565

#1565

#1611

#1611

#1614

#1637

#1678

#1681

#1681

#1700

#1700

#1710

#1727

#1727

#1728

#1732

#1733

#1735

#1740

#1762

#1762

#1763

#1763

#1776

#1776

#1795

#1795

#1805

#1805

#1843

#1843

#1856

#1856

#1898

#1922

#1922

#2011

#2086

#2089

#2134

#2138

#2169

#2169

#2170

#2240

#2250

#2289

#2289

#232

#232

#2323

#2347

#2347

#2350

#2350

#2359

#2369

#2369

#2374

#2378

#2389

#2389

#2397

#2397

#2401

#2410

#2411

#2417

#2417

#2418

#2420

#2420

#2439

#2480

#2481

#2481

#2506

#2506

#252

#252

#2537

#2555

#2590

#2597

#2613

#2613

#2616

#2616

#2618

#2620

#2663

#2663

#2666

#2666

#2667

#2667

#269

#269

#2690

#2690

#2692

#2692

#2695

#2728

#2731

#2732

#2732

#2733

#2733

#2734

#2734

#2742

#2742

#2751

#2751

#2752

#2752

#2756

#2756

#2761

#2782

#2791

#2807

#2807

#2817

#2817

#2823

#2823

#284

#284

#2883

#2883

#2903

#2903

#2904

#2904

#2905

#2905

#2906

#2906

#2931

#2933

#2933

#2951

#2967

#2992

#3009

#3009

#3087

#3087

#3116

#3153

#3153

#3174

#3174

#3188

#320

#320

#321

#321

#3231

#3233

#3233

#3236

#3267

#3267

#3274

#3274

#3316

#3322

#3323

#3326

#3349

#3350

#3351

#3352

#3372

#3376

#3383

#3396

#3398

#3407

#3414

#3416

#3418

#3423

#3432

#3437

#3442

#3443

#3445

#3458

#3472

#3479

#3482

#3488

#3527

#3536

#3573

#3574

#3575

#3579

#3590

#3609

#3645

#3684

#375

#375

#3802

#3855

#3856

#3881

#3896

#39

#39

#3917

#3952

#3955

#3958

#3959

#3965

#3966

#3969

#3970

#3992

#3996

#400

#400

#4007

#4022

#4032

#4033

#4034

#4039

#4041

#4058

#4059

#4077

#4092

#4098

#4099

#41

#41

#4121

#413

#413

#4145

#4146

#4184

#4192

#4198

#4205

#4216

#4218

#4219

#4229

#4243

#4266

#4267

#4279

#4291

#4305

#4323

#4326

#4327

#4344

#4347

#4365

#4374

#4378

#4379

#4385

#4387

#4427

#4429

#4431

#4460

#4501

#4506

#4509

#4573

#4586

#4619

#4620

#4632

#4632

#4633

#4635

#4635

#4643

#4644

#4656

#4657

#466

#466

#4663

#4687

#4691

#4692

#47

#47

#4701

#4732

#4740

#475

#475

#4750

#4815

#4832

#4833

#4833

#4852

#4878

#4918

#4937

#4964

#4975

#4983

#4992

#4998

#5006

#5013

#5021

#5032

#5038

#5055

#5059

#506

#506

#507

#507

#5070

#5095

#5109

#5111

#512

#512

#5127

#5128

#5143

#5156

#5172

#5175

#5175

#5176

#5189

#5198

#5206

#5215

#5229

#5235

#5253

#5260

#5266

#5273

#5288

#53

#53

#530

#530

#5300

#5302

#5305

#5311

#5345

#5354

#5354

#5355

#5356

#536

#536

#5361

#5366

#5377

#5384

#539

#539

#5393

#5395

#5410

#5436

#5436

#5439

#5439

#544

#544

#5443

#5443

#5459

#5475

#5478

#5478

#5490

#5497

#5501

#5507

#5551

#5552

#5553

#5554

#5555

#5556

#5569

#5580

#5586

#5588

#5590

#5592

#5597

#5598

#5599

#5603

#5604

#5609

#5617

#5621

#5625

#5649

#5658

#5665

#5667

#5677

#5679

#5685

#5685

#5687

#5688

#5690

#5692

#5693

#5699

#5702

#5706

#5715

#5721

#5736

#5750

#5751

#5760

#5764

#5765

#5777

#578

#5820

#5821

#5824

#5825

#5825

#583

#5840

#5841

#5842

#5842

#5845

#5849

#5849

#5852

#5859

#5860

#5864

#5869

#5871

#5873

#5874

#5877

#5878

#5881

#5883

#5890

#5893

#5910

#5913

#5923

#5923

#5930

#5931

#5932

#5940

#5944

#5945

#5945

#5952

#5953

#5957

#5959

#5963

#5963

#5965

#5967

#5970

#5973

#5973

#5980

#5984

#5985

#5995

#5999

#6000

#6001

#6004

#6004

#6012

#6013

#6015

#6016

#6016

#6018

#6018

#6019

#6021

#6021

#6027

#6028

#6048

#6048

#63

#672

#672

#682

#682

#684

#686

#701

#713

#713

#714

#73

#73

#74

#74

#744

#749

#756

#766

#766

#779

#803

#835

#848

#848

#855

#855

#86

#86

#952

#973

#977

#977

#98

#98

#99

#99

0.19

0.6.2

0.6.3

0.6.4

0.7

0.7-rc1

0.8

0.8-rc2

0.8-rc3

0.8-rc4

0.9

1.0

1.0.10

1.0.11

1.0.12

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.10

1.10.2

1.10.3

1.10.4

1.2

1.2.10

1.2.11

1.2.12

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3

1.3.10

1.3.11

1.3.12

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4

1.4.10

1.4.11

1.4.12

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5

1.5.10

1.5.11

1.5.12

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6

1.6.10

1.6.11

1.6.12

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.7

1.7.1

1.7.10

1.7.11

1.7.12

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8

1.8.1

1.8.10

1.8.11

1.8.12

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9

1.9.10

1.9.11

1.9.12

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

Mono Color

• df58bcaf95 minor improvement Miroslav Stampar 2011-02-18 14:27:02 +00:00
• 3badf92ceb not doing "basic" filtering in default cases because of a bug reported by Kazim Miroslav Stampar 2011-02-18 07:38:13 +00:00
• 6cdf08b81c minor fix Miroslav Stampar 2011-02-17 21:51:40 +00:00
• 22cd49a217 --technique can now be something like 123 which includes both techniques 1, 2 and 3 Miroslav Stampar 2011-02-17 21:39:16 +00:00
• 7ebc1ab90a minor cosmetics Miroslav Stampar 2011-02-17 08:59:14 +00:00
• dcb398f916 Test 2 Bernardo Damele 2011-02-16 11:12:15 +00:00
• fc7414db7a Test Bernardo Damele 2011-02-16 11:09:58 +00:00
• 199f14df46 implementation of MySQL GROUP_CONCAT technique Miroslav Stampar 2011-02-15 00:28:27 +00:00
• 808b03fc3e Minor reordering Bernardo Damele 2011-02-14 02:08:11 +00:00
• 2ea828e416 Proper fix for r3307 (file-write on MySQL via UNION query tech) Bernardo Damele 2011-02-13 22:48:01 +00:00
• 417b311475 minor update Miroslav Stampar 2011-02-13 22:02:47 +00:00
• 50d25c3b4d update regarding explicit testing of ua and referer when using -p Miroslav Stampar 2011-02-13 21:58:48 +00:00
• 429ab631fe Minor refactoring Bernardo Damele 2011-02-13 21:25:01 +00:00
• 5fb11fd173 update regarding multiple DBMS payloads Miroslav Stampar 2011-02-13 21:20:21 +00:00
• 45a005737d Minor adjustment so that User-Agent and Referer headers are tests only when --level >= 3 and Cookie is tested only when --level >= 2 Bernardo Damele 2011-02-13 21:08:42 +00:00
• 83d7803ce7 other techniques use dataToStdout for retrieved string, hence this update (also, fixing ugly retrieved: 0 or 1 while doing fingerprinting --flush-session -f --technique=2) Miroslav Stampar 2011-02-12 20:03:28 +00:00
• 9f7d666451 removing --method per request of buawig Miroslav Stampar 2011-02-12 19:50:27 +00:00
• 1cd483f42f one more update Miroslav Stampar 2011-02-12 10:24:09 +00:00
• 25a3a64327 we need this because of one pesky little bug going around (when union is recognized and the dbmses are fingerprinted, for those who don't have proper unescaping false TRUE is recognized in form of retrieved: %27%2B%28SELECT%20CAST...). tested on all major DBMSes. Miroslav Stampar 2011-02-12 10:15:42 +00:00
• 521635c84d quick fix for UA and Referer Miroslav Stampar 2011-02-11 23:36:23 +00:00
• 7253362114 Minor bug fix so that --file-write on MySQL via UNION query now works again Bernardo Damele 2011-02-11 23:35:45 +00:00
• 535eb9f3eb implementation of referer feature Miroslav Stampar 2011-02-11 23:07:03 +00:00
• a6ab24e0b5 just a minor fix to stop nagging with "Do you want to skip test payloads specific for other DBMSes?" if n is pressed Miroslav Stampar 2011-02-10 22:47:43 +00:00
• 5f2fcd1eea minor adjustment regarding "file" switches Miroslav Stampar 2011-02-10 19:55:47 +00:00
• 4295a78c5f minor update Miroslav Stampar 2011-02-10 19:51:34 +00:00
• 394ccb5cc5 Added query for MSSQL/--privileges Bernardo Damele 2011-02-10 15:52:55 +00:00
• c078de894f Added support for --privileges on MSSQL to test wheter or not the DBMS users are DBA Bernardo Damele 2011-02-10 14:24:04 +00:00
• a2c20acf94 Minor fixes once more Bernardo Damele 2011-02-10 11:34:16 +00:00
• d0ddaee3c8 Minor bug fix Bernardo Damele 2011-02-10 11:28:24 +00:00
• 864eade744 Fixed store and resume of brute-forced tables/columns for MSSQL/Sybase Bernardo Damele 2011-02-10 11:14:05 +00:00
• aa0fb276ba More fixes for --common-columns to work against MSSQL too Bernardo Damele 2011-02-09 17:22:07 +00:00
• 917b2b0d6b one more commit related to the previous one Miroslav Stampar 2011-02-09 17:07:02 +00:00
• 6c582343fe .. fix Miroslav Stampar 2011-02-09 17:05:06 +00:00
• d9af01d73d imporant fix for boolean expression which return [None] Miroslav Stampar 2011-02-09 16:53:22 +00:00
• 7539881ffa fix for dump on Oracle but we still need to discuss some things around Miroslav Stampar 2011-02-09 14:52:07 +00:00
• 7d9be18789 added one comment Miroslav Stampar 2011-02-09 14:34:18 +00:00
• bafc8a1b0f another update Miroslav Stampar 2011-02-09 13:29:52 +00:00
• 600f729139 fix for a bug reported by skysbsb@gmail.com (double ORDER BY) Miroslav Stampar 2011-02-09 12:43:09 +00:00
• 5b57a69f3e fix Miroslav Stampar 2011-02-09 11:20:03 +00:00
• caf6220c53 done with implementation for retrieving table names via access system table(s) Miroslav Stampar 2011-02-09 10:50:38 +00:00
• 5050a76b59 update regarding reading of table names from access system tables Miroslav Stampar 2011-02-09 10:33:29 +00:00
• 3de6117253 revert of the r3247 (output always has to be appended to the outputs - no matter of it's value) Miroslav Stampar 2011-02-09 09:53:59 +00:00
• b48213783a Removed senseless debug messsage Bernardo Damele 2011-02-08 17:09:35 +00:00
• e16bab7117 re-enabled --read-file for MySQL with all techniques Bernardo Damele 2011-02-08 17:03:57 +00:00
• 98ca1702ae los cosmeticado Miroslav Stampar 2011-02-08 16:30:32 +00:00
• 87e36796c6 just to not cause confusion Miroslav Stampar 2011-02-08 16:29:42 +00:00
• dcb9c93328 minor cleanup Miroslav Stampar 2011-02-08 16:27:58 +00:00
• 37f7001143 first commit with mysql/error/substringing Miroslav Stampar 2011-02-08 16:23:33 +00:00
• c3eb82e60b Proper fix Bernardo Damele 2011-02-08 10:08:48 +00:00
• dba2f74588 revert of r3274 Miroslav Stampar 2011-02-08 09:44:34 +00:00
• 156d8cd99b Directory restyling Bernardo Damele 2011-02-08 00:15:02 +00:00
• cfe2da0195 Minor fix Bernardo Damele 2011-02-08 00:13:39 +00:00
• 0a81415f2f Minor code cleanup Bernardo Damele 2011-02-08 00:02:54 +00:00
• 2c4f6d2e99 fix (lol. we were using same comparison payload through the all test. it's a nono :) p.s. this way we are dealing with "reflective" problem too Miroslav Stampar 2011-02-07 21:53:05 +00:00
• a577d0e9a5 restraining "using unescaped version of the test because of zero knowledge of the back-end DBMS" once per test (before was once per boundary) Miroslav Stampar 2011-02-07 21:18:01 +00:00
• 66adf23532 Unbiased approach for searching appropriate usable column Miroslav Stampar 2011-02-07 21:00:59 +00:00
• f958b21613 there is a pretty strong chance that the columns from the beginning are the INTEGER ones, while we search for STRING ones (not related to that MSSQL union/error problem we discussed earlier today) Miroslav Stampar 2011-02-07 16:55:02 +00:00
• 771020abd6 one more related commit Miroslav Stampar 2011-02-07 16:32:08 +00:00
• 265e7ca272 fix for that MSSQL limit/top problem Miroslav Stampar 2011-02-07 16:24:23 +00:00
• 71d1b72e0e minor adjustment Miroslav Stampar 2011-02-07 12:51:38 +00:00
• b33ac19d39 Minor fix Bernardo Damele 2011-02-07 12:36:00 +00:00
• 99e9412f74 minor update Miroslav Stampar 2011-02-07 12:34:23 +00:00
• e023e0d233 proper fix Miroslav Stampar 2011-02-07 12:32:08 +00:00
• 39decebe85 Minor fixes to checking/re-enabling of xp_cmdshell procedure Bernardo Damele 2011-02-07 12:17:19 +00:00
• 1a5a66870e problem fixed Miroslav Stampar 2011-02-07 11:57:41 +00:00
• c0233dcd4f preventing crashes for output=[] Miroslav Stampar 2011-02-07 10:24:15 +00:00
• 096efea282 added BULK to EXCLUDE_UNESCAPE and preventing crashes when output=[] Miroslav Stampar 2011-02-07 10:22:43 +00:00
• 008d434325 Important fix now that the file writing is unescaped too Bernardo Damele 2011-02-07 00:56:15 +00:00
• f0f5d3d3e8 Began with the update of the user's manual for 0.9 Bernardo Damele 2011-02-07 00:55:10 +00:00
• ba3a8a69d4 More statements to exclude from unescap'ing Bernardo Damele 2011-02-07 00:33:54 +00:00
• 3719f085ae Added back-end dbms' OS based methods to Backend object - will be used for refactoring Bernardo Damele 2011-02-07 00:21:17 +00:00
• 2e00656235 Minor fix Bernardo Damele 2011-02-07 00:20:23 +00:00
• bf5ca4bd9a No point in unescaping the expression also in suffixQuery() also 'cause it will exit sqlmap if the parameter value is a string hence injection payload starts with single quote (') Bernardo Damele 2011-02-06 23:30:43 +00:00
• 061f56daf9 More adjustments related to unescape() and cleanupPayload(). Minor code cleanup related to error-based payload. Bernardo Damele 2011-02-06 23:27:56 +00:00
• 6a71629575 Converted from DOS format (\n\r to \n only) Bernardo Damele 2011-02-06 23:25:55 +00:00
• 7dcfcca87f Tests' titles adjustments Bernardo Damele 2011-02-06 23:17:39 +00:00
• 0800d9e49b Major bug fix for semi-centralize unescape() and cleanupPayload() into prefixQuery() and suffixQuery() Bernardo Damele 2011-02-06 22:58:12 +00:00
• 9eac2339ca Bernardo Damele 2011-02-06 22:55:26 +00:00
• db77f8b055 Code cleanup Bernardo Damele 2011-02-06 22:33:08 +00:00
• f3d6be7868 Code cleanup Bernardo Damele 2011-02-06 22:32:44 +00:00
• ecaf5729fd revert Miroslav Stampar 2011-02-06 22:14:18 +00:00
• 078a2207cc few reverts Miroslav Stampar 2011-02-06 22:10:28 +00:00
• b9b2fe0e7c little cleanup Miroslav Stampar 2011-02-06 21:52:39 +00:00
• c4c2cf1d58 can't stay as it is right now. temporary disabling. Miroslav Stampar 2011-02-06 21:17:41 +00:00
• d2b96a66a2 one more update regarding last few "unescape" related commits Miroslav Stampar 2011-02-06 20:23:23 +00:00
• caaac72029 minor update regarding last commit Miroslav Stampar 2011-02-06 20:15:03 +00:00
• 6191a7f26f Major fix for a silent bug Bernardo Damele 2011-02-06 15:53:43 +00:00
• 1bc2ee2fbf Updated Bernardo Damele 2011-02-06 15:44:27 +00:00
• 8980227d30 Minor bug fix Bernardo Damele 2011-02-06 15:32:16 +00:00
• 2afc1e5021 Layout adjustments Bernardo Damele 2011-02-06 15:28:23 +00:00
• a5a648f4fe Correctly handle --read-file and --write-file if neither stacked queries nor union query SQL injection has been detected. Support to read files on MySQL via error-based SQL injection technique will come as soon as we fix the MySQL/trim/error-based bug Bernardo Damele 2011-02-06 15:23:27 +00:00
• c44978862e Minor reordering of what gets saved into the injection object Bernardo Damele 2011-02-06 15:20:44 +00:00
• 5ecb75cc56 minor update Miroslav Stampar 2011-02-06 15:14:07 +00:00
• f754953c4f reverting this one. spotted a major bug. dbms is not properly enforced at this moment, don't know why. if it was this would be properly encoded. Miroslav Stampar 2011-02-06 12:33:58 +00:00
• 97f9c9d119 bug fix (playing with wavsep i've realized that we are sending in this payload quoted 'string' (causing problems), while MD5 also accepts integer values Miroslav Stampar 2011-02-06 12:24:50 +00:00
• 412a97b7fe fix for a bug reported by ahmed@isecur1ty.org (TypeError: unsupported operand type(s) for -: 'float' and 'NoneType') Miroslav Stampar 2011-02-05 14:17:28 +00:00
• 4df8a03c04 using OrderedDict to store parameters in order of appearance Miroslav Stampar 2011-02-04 18:07:21 +00:00
• acb986ae80 minor refactoring Miroslav Stampar 2011-02-04 17:40:55 +00:00
• fec88f6a6d Minor fix Bernardo Damele 2011-02-04 15:57:53 +00:00
• 1e8eb27156 update of doc/THANKS Miroslav Stampar 2011-02-04 14:07:54 +00:00