Commit Graph

Select branches

Hide Pull Requests

gh-pages

master

#102

#102

#1029

#1033

#1037

#1053

#1053

#107

#107

#1112

#1186

#1206

#1227

#1227

#1244

#1244

#1246

#1246

#1300

#1300

#1306

#1306

#1323

#1323

#1328

#1330

#1342

#1342

#1351

#1378

#1378

#1402

#1403

#1403

#1414

#1449

#1449

#1469

#1469

#1500

#1535

#1543

#1565

#1565

#1611

#1611

#1614

#1637

#1678

#1681

#1681

#1700

#1700

#1710

#1727

#1727

#1728

#1732

#1733

#1735

#1740

#1762

#1762

#1763

#1763

#1776

#1776

#1795

#1795

#1805

#1805

#1843

#1843

#1856

#1856

#1898

#1922

#1922

#2011

#2086

#2089

#2134

#2138

#2169

#2169

#2170

#2240

#2250

#2289

#2289

#232

#232

#2323

#2347

#2347

#2350

#2350

#2359

#2369

#2369

#2374

#2378

#2389

#2389

#2397

#2397

#2401

#2410

#2411

#2417

#2417

#2418

#2420

#2420

#2439

#2480

#2481

#2481

#2506

#2506

#252

#252

#2537

#2555

#2590

#2597

#2613

#2613

#2616

#2616

#2618

#2620

#2663

#2663

#2666

#2666

#2667

#2667

#269

#269

#2690

#2690

#2692

#2692

#2695

#2728

#2731

#2732

#2732

#2733

#2733

#2734

#2734

#2742

#2742

#2751

#2751

#2752

#2752

#2756

#2756

#2761

#2782

#2791

#2807

#2807

#2817

#2817

#2823

#2823

#284

#284

#2883

#2883

#2903

#2903

#2904

#2904

#2905

#2905

#2906

#2906

#2931

#2933

#2933

#2951

#2967

#2992

#3009

#3009

#3087

#3087

#3116

#3153

#3153

#3174

#3174

#3188

#320

#320

#321

#321

#3231

#3233

#3233

#3236

#3267

#3267

#3274

#3274

#3316

#3322

#3323

#3326

#3349

#3350

#3351

#3352

#3372

#3376

#3383

#3396

#3398

#3407

#3414

#3416

#3418

#3423

#3432

#3437

#3442

#3443

#3445

#3458

#3472

#3479

#3482

#3488

#3527

#3536

#3573

#3574

#3575

#3579

#3590

#3609

#3645

#3684

#375

#375

#3802

#3855

#3856

#3881

#3896

#39

#39

#3917

#3952

#3955

#3958

#3959

#3965

#3966

#3969

#3970

#3992

#3996

#400

#400

#4007

#4022

#4032

#4033

#4034

#4039

#4041

#4058

#4059

#4077

#4092

#4098

#4099

#41

#41

#4121

#413

#413

#4145

#4146

#4184

#4192

#4198

#4205

#4216

#4218

#4219

#4229

#4243

#4266

#4267

#4279

#4291

#4305

#4323

#4326

#4327

#4344

#4347

#4365

#4374

#4378

#4379

#4385

#4387

#4427

#4429

#4431

#4460

#4501

#4506

#4509

#4573

#4586

#4619

#4620

#4632

#4632

#4633

#4635

#4635

#4643

#4644

#4656

#4657

#466

#466

#4663

#4687

#4691

#4692

#47

#47

#4701

#4732

#4740

#475

#475

#4750

#4815

#4832

#4833

#4833

#4852

#4878

#4918

#4937

#4964

#4975

#4983

#4992

#4998

#5006

#5013

#5021

#5032

#5038

#5055

#5059

#506

#506

#507

#507

#5070

#5095

#5109

#5111

#512

#512

#5127

#5128

#5143

#5156

#5172

#5175

#5175

#5176

#5189

#5198

#5206

#5215

#5229

#5235

#5253

#5260

#5266

#5273

#5288

#53

#53

#530

#530

#5300

#5302

#5305

#5311

#5345

#5354

#5354

#5355

#5356

#536

#536

#5361

#5366

#5377

#5384

#539

#539

#5393

#5395

#5410

#5436

#5436

#5439

#5439

#544

#544

#5443

#5443

#5459

#5475

#5478

#5478

#5490

#5497

#5501

#5507

#5551

#5552

#5553

#5554

#5555

#5556

#5569

#5580

#5586

#5588

#5590

#5592

#5597

#5598

#5599

#5603

#5604

#5609

#5617

#5621

#5625

#5649

#5658

#5665

#5667

#5677

#5679

#5685

#5685

#5687

#5688

#5690

#5692

#5693

#5699

#5702

#5706

#5715

#5721

#5736

#5750

#5751

#5760

#5764

#5765

#5777

#578

#5820

#5821

#5824

#5825

#5825

#583

#5840

#5841

#5842

#5842

#5845

#5849

#5849

#5852

#5859

#5860

#5864

#5869

#5871

#5873

#5874

#5877

#5878

#5881

#5883

#5890

#5893

#5910

#5913

#5923

#5923

#5930

#5931

#5932

#5940

#5944

#5945

#5945

#5952

#5953

#5957

#5959

#5963

#5963

#5965

#5967

#5970

#5973

#5973

#5980

#5984

#5985

#5995

#5999

#6000

#6001

#6004

#6004

#6012

#6013

#6015

#6016

#6016

#6018

#6018

#6019

#6021

#6021

#6027

#6028

#6048

#6048

#63

#672

#672

#682

#682

#684

#686

#701

#713

#713

#714

#73

#73

#74

#74

#744

#749

#756

#766

#766

#779

#803

#835

#848

#848

#855

#855

#86

#86

#952

#973

#977

#977

#98

#98

#99

#99

0.19

0.6.2

0.6.3

0.6.4

0.7

0.7-rc1

0.8

0.8-rc2

0.8-rc3

0.8-rc4

0.9

1.0

1.0.10

1.0.11

1.0.12

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1

1.1.10

1.1.11

1.1.12

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.10

1.10.2

1.10.3

1.10.4

1.2

1.2.10

1.2.11

1.2.12

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3

1.3.10

1.3.11

1.3.12

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4

1.4.10

1.4.11

1.4.12

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5

1.5.10

1.5.11

1.5.12

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6

1.6.10

1.6.11

1.6.12

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.7

1.7.1

1.7.10

1.7.11

1.7.12

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8

1.8.1

1.8.10

1.8.11

1.8.12

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9

1.9.10

1.9.11

1.9.12

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

Mono Color

• 9c61adb21d Cosmetics Bernardo Damele 2010-12-09 00:26:06 +00:00
• b5c6527c72 Minor fix Bernardo Damele 2010-12-09 00:25:48 +00:00
• 3b293c4ea7 Added possible stacked queries time-based blind vector for MSSQL Bernardo Damele 2010-12-08 23:55:42 +00:00
• f5ce739bdf Added support for time-based blind SQL injection via stacked queries too. Need to add vectors for some DBMS yet. Bernardo Damele 2010-12-08 23:52:31 +00:00
• 10ef2b5de8 Minor bug fix Bernardo Damele 2010-12-08 23:09:42 +00:00
• 54f6673609 update Miroslav Stampar 2010-12-08 22:38:26 +00:00
• d6077273e0 update Miroslav Stampar 2010-12-08 22:14:42 +00:00
• 5aee1fd8e0 updated THANKS file Miroslav Stampar 2010-12-08 21:19:46 +00:00
• 258e9fb50e fix for a "bug" reported by Spencer J. McIntyre (os.makedirs(conf.outputPath, 0755) -> permission denied) Miroslav Stampar 2010-12-08 21:16:18 +00:00
• 69c4f94980 update Miroslav Stampar 2010-12-08 15:40:01 +00:00
• 81c16926c1 code refactoring some more Miroslav Stampar 2010-12-08 14:46:07 +00:00
• 40fadf2f35 minor update Miroslav Stampar 2010-12-08 14:33:10 +00:00
• 95b48746a6 cosmetics Miroslav Stampar 2010-12-08 14:29:09 +00:00
• ed09c53ee4 minor minor update Miroslav Stampar 2010-12-08 14:27:37 +00:00
• 01cf1394a4 code refactoring Miroslav Stampar 2010-12-08 14:26:40 +00:00
• af22679605 minor update Miroslav Stampar 2010-12-08 13:09:27 +00:00
• 6223f25dd9 code beautification Miroslav Stampar 2010-12-08 13:04:48 +00:00
• 64cc2588f1 now resume is available for time-based blinds too Miroslav Stampar 2010-12-08 12:49:26 +00:00
• 537b619165 removing junk Miroslav Stampar 2010-12-08 12:30:25 +00:00
• b5e45939e3 sqlmap premiere of blind time based query/bisection Miroslav Stampar 2010-12-08 12:28:54 +00:00
• ad00fe13c1 another fix for MySQL time based payloads Miroslav Stampar 2010-12-08 12:00:27 +00:00
• 8227e6d3cf bug fix for BENCHMARK time-based vectors Miroslav Stampar 2010-12-08 11:49:55 +00:00
• 47bb31fb47 code refactoring Miroslav Stampar 2010-12-08 11:30:25 +00:00
• 1ae2fa7f1a update regarding time based payloads Miroslav Stampar 2010-12-08 11:26:54 +00:00
• bdff4aba6a switching to quick_ratio Miroslav Stampar 2010-12-07 23:57:43 +00:00
• c1b82cf09c ratio() gives a considerable lag on real life cases, as real_quick_ratio() gives almost as good results Miroslav Stampar 2010-12-07 23:53:44 +00:00
• a4a63f5b1e minor update Miroslav Stampar 2010-12-07 23:49:00 +00:00
• 293ce18fed two major bug fixes regarding time calculation (previously comparison was also a part of "delta", which screwed results in cases with large pages; other was a standard distribution based one) Miroslav Stampar 2010-12-07 23:32:33 +00:00
• b21eb88905 minor update Miroslav Stampar 2010-12-07 22:45:38 +00:00
• 575e50673b minor update Miroslav Stampar 2010-12-07 19:27:01 +00:00
• 398b82644a little explanation Miroslav Stampar 2010-12-07 19:25:26 +00:00
• dc651d59ec little mathematics here and there (used "Rules for normally distributed data") Miroslav Stampar 2010-12-07 19:19:12 +00:00
• ee72838231 Removed debug print Bernardo Damele 2010-12-07 17:19:29 +00:00
• 5f97312f29 Minor fix Bernardo Damele 2010-12-07 17:17:38 +00:00
• 8ff7c9a5a1 Works on Oracle's GROUP BY too Bernardo Damele 2010-12-07 17:17:01 +00:00
• 81e7465ed2 Cosmetics Bernardo Damele 2010-12-07 17:16:21 +00:00
• ecd4a5a532 added standard deviation check in time based tests Miroslav Stampar 2010-12-07 16:39:31 +00:00
• 294119d2ec more advanced time technique(s) Miroslav Stampar 2010-12-07 16:04:53 +00:00
• 4959da3ce6 it's a must to double check time based payloads Miroslav Stampar 2010-12-07 14:59:11 +00:00
• e53fef546e update regarding session page templates Miroslav Stampar 2010-12-07 14:35:31 +00:00
• add6235b16 removed pageTemplate from injection(s), it's not longer stored in session, and it's reloaded when resuming from session Miroslav Stampar 2010-12-07 14:06:54 +00:00
• 0dc630203f code refactoring Miroslav Stampar 2010-12-07 13:34:06 +00:00
• 4f01d4c109 number crunching based time payloads are now affected by conf.timeSec Miroslav Stampar 2010-12-07 13:24:18 +00:00
• d0936bc8ed adding vectors for SQLite time-based payloads Miroslav Stampar 2010-12-07 13:14:56 +00:00
• 54b8cb76a1 Messed up with my last merge, all fixed now Bernardo Damele 2010-12-07 12:59:53 +00:00
• b38a634d95 bug fix Miroslav Stampar 2010-12-07 12:55:31 +00:00
• 7c32db6e9d Forgot when merged with my last commit Bernardo Damele 2010-12-07 12:52:09 +00:00
• acac0d346f Minor bug fixes and adjustments Bernardo Damele 2010-12-07 12:45:45 +00:00
• 8e78057ac8 Added counter of total HTTP(s) requests done during detection phase Bernardo Damele 2010-12-07 12:33:47 +00:00
• effd2ca0e3 Cosmetics Bernardo Damele 2010-12-07 12:32:58 +00:00
• 2b2b7dc3a6 added vectors for time-based Firebird payloads Miroslav Stampar 2010-12-07 12:20:48 +00:00
• 36a7fca8d5 added time-based payload vector for MSSQL Miroslav Stampar 2010-12-07 12:06:25 +00:00
• 485981c619 added vectors for PostgresSQL time-based payloads Miroslav Stampar 2010-12-07 11:57:33 +00:00
• f9085e01e7 added vectors for Oracle time-based payloads Miroslav Stampar 2010-12-07 11:47:29 +00:00
• 2af8835a94 fix for a bug reported by ToR (origValue = paramDict[kb.injection.parameter] -> KeyError in resume with missing injection parameter) Miroslav Stampar 2010-12-07 10:57:32 +00:00
• 3d87489de5 minor update Miroslav Stampar 2010-12-07 08:05:03 +00:00
• 90b776c1a2 update Miroslav Stampar 2010-12-07 00:58:54 +00:00
• 0da1ebde7d introducing PostgreSQL time based blind Miroslav Stampar 2010-12-07 00:51:14 +00:00
• 1ba98dc9ec found a fix for a OR time-based MySQL payload :) Miroslav Stampar 2010-12-07 00:31:46 +00:00
• 61f82fd274 introducing [DELAYED] for heavy query time based payloads when response time is non-deterministic Miroslav Stampar 2010-12-07 00:27:26 +00:00
• 32f1909131 Some more "advanced" boundaries Bernardo Damele 2010-12-06 23:15:41 +00:00
• 84a038d0a3 added one more subtag Miroslav Stampar 2010-12-06 23:10:38 +00:00
• 1031723c89 added one more time based blind for Oracle Miroslav Stampar 2010-12-06 23:05:53 +00:00
• 7697d19292 space replace is not needed in other two Oracle error based payloads; removing incorrect dbms_version for ctxsys.drithsx.sn as it also works on 10g Miroslav Stampar 2010-12-06 22:52:18 +00:00
• 2735848ab6 removed ERROR_SPACE Miroslav Stampar 2010-12-06 22:40:07 +00:00
• f516c18a2a minor update Miroslav Stampar 2010-12-06 21:39:57 +00:00
• 0c5c2aa807 adding one more error based payload for Oracle Miroslav Stampar 2010-12-06 21:20:26 +00:00
• 956a155377 adding one more error based payload for Oracle Miroslav Stampar 2010-12-06 20:43:23 +00:00
• ff43a4a955 minor update to preserve consistency of payload naming Miroslav Stampar 2010-12-06 20:28:26 +00:00
• c0e05d6869 update Miroslav Stampar 2010-12-06 19:11:05 +00:00
• 9ccc8f90a3 minor cosmetic update ("heuristics shows" is not grammatically correct) Miroslav Stampar 2010-12-06 18:47:22 +00:00
• d336f1df23 minor update Miroslav Stampar 2010-12-06 18:44:42 +00:00
• d77ddbee47 OR based inference works for the first time in history and fingerprint of 4 major DBMSes is now injection based (instead of AND) Miroslav Stampar 2010-12-06 18:20:57 +00:00
• e4b51dd549 proper way of handling OR based injections (completely compatible with current AND based inference engine) Miroslav Stampar 2010-12-06 17:23:21 +00:00
• 27ee9a5ccf minor refactoring Miroslav Stampar 2010-12-06 15:50:19 +00:00
• e8be14e00a minor refactoring Miroslav Stampar 2010-12-06 07:48:14 +00:00
• a43d252ae9 minor update Miroslav Stampar 2010-12-06 00:14:08 +00:00
• 5189f138d7 increasing socket timeout in case of time based checks Miroslav Stampar 2010-12-05 23:18:16 +00:00
• 17449754fe Got rid of UNION false cond Bernardo Damele 2010-12-05 16:16:15 +00:00
• a1e89d3e94 Minor tweak Bernardo Damele 2010-12-05 13:12:12 +00:00
• da3fd17fc3 Adjustment to make it work also in OR based injection Bernardo Damele 2010-12-05 12:24:23 +00:00
• bf425d90bc More tweaking Bernardo Damele 2010-12-05 12:23:18 +00:00
• 41e1b95c6c Minor code refactoring and finally make exploitation work also on OR boolean-based injections Bernardo Damele 2010-12-05 11:25:44 +00:00
• 7a5cd3b35f minor comment update Miroslav Stampar 2010-12-05 11:15:09 +00:00
• 191ba3118f Cosmetics Bernardo Damele 2010-12-05 11:08:52 +00:00
• 1b17bac494 Sorted out Bernardo Damele 2010-12-05 11:06:37 +00:00
• 618b3b0211 Cosmetics Bernardo Damele 2010-12-05 11:05:57 +00:00
• 8066610217 Minor improvements to OR based injections Bernardo Damele 2010-12-05 10:55:19 +00:00
• 2612615978 Major improvements Bernardo Damele 2010-12-04 16:40:08 +00:00
• 9e5f933ace some updates Miroslav Stampar 2010-12-04 15:47:02 +00:00
• 3f9450b9dc minor fix Miroslav Stampar 2010-12-04 14:43:35 +00:00
• 1f795622b3 some fine tuning of dynamicity removing engine Miroslav Stampar 2010-12-04 13:39:35 +00:00
• eeb199375b usage of compiled regexes in case of dynamic markings and other refactoring Miroslav Stampar 2010-12-04 13:23:28 +00:00
• 0fc7a8f9e8 code refactoring Miroslav Stampar 2010-12-04 10:13:18 +00:00
• 04714374f9 now you can use kb.pageTemplate to set a page which will be used as a template in comparison process (at least in '-[RANDNUM] OR' cases we'll need to use different template(s)) Miroslav Stampar 2010-12-04 10:05:18 +00:00
• 95a3f4b52f Rudimental OR boolean-based tests for login forms Bernardo Damele 2010-12-03 22:58:35 +00:00
• b3a094b9d6 fix for a bug reported by ToR (when resuming: queries[kb.dbms] -> KeyError: u'mysql') Miroslav Stampar 2010-12-03 22:44:29 +00:00
• 5764816891 minor cosmetics Miroslav Stampar 2010-12-03 22:28:09 +00:00
• 5d37df6104 Ugly code to set the cookies when got them from a 302 redirect too Bernardo Damele 2010-12-03 17:41:10 +00:00
• 9d55c4da87 Done with support for injection in ORDER BY and GROUP BY (hopefully) Bernardo Damele 2010-12-03 16:12:47 +00:00