diff --git a/lib/core/common.py b/lib/core/common.py index ee3a26e70..dcb60caad 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -5693,16 +5693,20 @@ def parseRequestFile(reqFile, checkParams=True): if re.search(BURP_XML_HISTORY_REGEX, content, re.I | re.S): reqResList = [] for match in re.finditer(BURP_XML_HISTORY_REGEX, content, re.I | re.S): - port, request = match.groups() + port, protocol, request = match.groups() + protocol = (protocol or "").lower() try: request = decodeBase64(request, binary=False) except (binascii.Error, TypeError): continue _ = re.search(r"%s:.+" % re.escape(HTTP_HEADER.HOST), request) if _: - host = _.group(0).strip() - if not re.search(r":\d+\Z", host) and int(port) != 80: - request = request.replace(host, "%s:%d" % (host, int(port))) + host = value = _.group(0).strip() + if not re.search(r":\d+\Z", host) and int(port) != (443 if protocol == "https" else 80): + value = "%s:%d" % (value, int(port)) + if protocol and "://" not in value: # Note: item's (as the port alone can't tell e.g. HTTPS on 8443) + value = re.sub(r"\A([^:]+:\s*)", r"\g<1>%s://" % protocol, value) + request = request.replace(host, value) reqResList.append(request) else: reqResList = [content] diff --git a/lib/core/settings.py b/lib/core/settings.py index 34df6df3a..b0243c81b 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -19,7 +19,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.10.28" +VERSION = "1.10.10.29" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) @@ -582,7 +582,7 @@ WEBSCARAB_SPLITTER = "### Conversation" BURP_REQUEST_REGEX = r"={10,}\s+([A-Z]{3,} .+?)\s+(={10,}|\Z)" # Regex used for parsing XML Burp saved history items -BURP_XML_HISTORY_REGEX = r'(\d+).*?(\d+)\s*(?:\s*(https?)\s*)?.*? decides the scheme (the port alone can't tell e.g. HTTPS on 8443 or HTTP on 443) + req = base64.b64encode(b"GET /vuln.php?id=1 HTTP/1.1\r\nHost: www.target.com\r\n\r\n").decode() + items = "".join('%s\n%s' % (port, protocol, req) for port, protocol in ((8443, "https"), (443, "http"), (443, "https"), (8080, ""))) + path = _write_temp("%s" % items, ".xml") + try: + targets = list(parseRequestFile(path)) + finally: + os.unlink(path) + + self.assertEqual([_[0] for _ in targets], ["https://www.target.com:8443/vuln.php?id=1", "http://www.target.com:443/vuln.php?id=1", "https://www.target.com:443/vuln.php?id=1", "http://www.target.com:8080/vuln.php?id=1"]) + self.assertTrue(all("://" not in value for _ in targets for key, value in _[4] if key == "Host")) + def test_post_body_captured(self): content = ( "======================================================\n"