Fixes #6164

lib/core/common.py

@@ -5693,16 +5693,20 @@ def parseRequestFile(reqFile, checkParams=True):
             if re.search(BURP_XML_HISTORY_REGEX, content, re.I | re.S):
                 reqResList = []
                 for match in re.finditer(BURP_XML_HISTORY_REGEX, content, re.I | re.S):
-                    port, request = match.groups()
+                    port, protocol, request = match.groups()
+                    protocol = (protocol or "").lower()
                     try:
                         request = decodeBase64(request, binary=False)
                     except (binascii.Error, TypeError):
                         continue
                     _ = re.search(r"%s:.+" % re.escape(HTTP_HEADER.HOST), request)
                     if _:
-                        host = _.group(0).strip()
-                        if not re.search(r":\d+\Z", host) and int(port) != 80:
-                            request = request.replace(host, "%s:%d" % (host, int(port)))
+                        host = value = _.group(0).strip()
+                        if not re.search(r":\d+\Z", host) and int(port) != (443 if protocol == "https" else 80):
+                            value = "%s:%d" % (value, int(port))
+                        if protocol and "://" not in value:  # Note: item's <protocol> (as the port alone can't tell e.g. HTTPS on 8443)
+                            value = re.sub(r"\A([^:]+:\s*)", r"\g<1>%s://" % protocol, value)
+                        request = request.replace(host, value)
                     reqResList.append(request)
             else:
                 reqResList = [content]

lib/core/settings.py

@@ -19,7 +19,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.10.28"
+VERSION = "1.10.10.29"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -582,7 +582,7 @@ WEBSCARAB_SPLITTER = "### Conversation"
 BURP_REQUEST_REGEX = r"={10,}\s+([A-Z]{3,} .+?)\s+(={10,}|\Z)"
 
 # Regex used for parsing XML Burp saved history items
-BURP_XML_HISTORY_REGEX = r'<port>(\d+)</port>.*?<request base64="true"><!\[CDATA\[([^]]+)'
+BURP_XML_HISTORY_REGEX = r'<port>(\d+)</port>\s*(?:<protocol>\s*(https?)\s*</protocol>)?.*?<request base64="true"><!\[CDATA\[([^]]+)'
 
 # Encoding used for Unicode data
 UNICODE_ENCODING = "utf8"

tests/test_common.py

@@ -524,6 +524,19 @@ class TestParseRequestFileBurp(unittest.TestCase):
         self.assertEqual(method, HTTPMETHOD.GET)
         self.assertEqual(cookie, "SID=xyz")
 
+    def test_burp_xml_history_protocol(self):
+        # Note: item's <protocol> decides the scheme (the port alone can't tell e.g. HTTPS on 8443 or HTTP on 443)
+        req = base64.b64encode(b"GET /vuln.php?id=1 HTTP/1.1\r\nHost: www.target.com\r\n\r\n").decode()
+        items = "".join('<item><port>%s</port>\n<protocol>%s</protocol><request base64="true"><![CDATA[%s]]></request></item>' % (port, protocol, req) for port, protocol in ((8443, "https"), (443, "http"), (443, "https"), (8080, "")))
+        path = _write_temp("<items>%s</items>" % items, ".xml")
+        try:
+            targets = list(parseRequestFile(path))
+        finally:
+            os.unlink(path)
+
+        self.assertEqual([_[0] for _ in targets], ["https://www.target.com:8443/vuln.php?id=1", "http://www.target.com:443/vuln.php?id=1", "https://www.target.com:443/vuln.php?id=1", "http://www.target.com:8080/vuln.php?id=1"])
+        self.assertTrue(all("://" not in value for _ in targets for key, value in _[4] if key == "Host"))
+
     def test_post_body_captured(self):
         content = (
             "======================================================\n"