sqlmapproject/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-12 02:22:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
11,070 Commits 2 Branches 142 Tags
1ee368f78a73ccc1c193af32d4e70c1244be5865
Commit Graph
11070 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Miroslav Štampar 1ee368f78a Fixes #6105 2026-09-04 09:47:33 +02:00
Miroslav Štampar e10092efcd Fixes #6104 2026-09-04 09:03:25 +02:00
Miroslav Štampar 691d2fa7ca Update of docus 2026-09-02 15:51:19 +02:00
Miroslav Štampar 3fc41ca370 Salvaging (verified) what's useful from #6103 2026-09-02 07:53:32 +02:00
Ramachandran Thamarai Semmenianandchan770 3b8a8d3d09 Do not crash on a JWT with a non-base64url signature (fixes #6101) (#6102) 
JWT_REGEX accepts a signature segment of any length and parseJWT only
validates the header/payload, so a value that matches the JWT pattern but
carries a malformed/truncated signature (e.g. 41 base64url characters,
which is length % 4 == 1 and thus impossible base64) reached crackHMAC.
There decodeBase64(signature) let binascii.Error propagate, aborting the
whole run with an unhandled exception during checkJWT().

Guard the signature decode: a signature that is not valid base64url cannot
be an HMAC we could verify, so crackHMAC now treats it as not crackable
(returns None) instead of raising. The other auditJWT findings are
unaffected. Added a regression doctest.

Co-authored-by: chan770 <[email protected]>
 2026-09-01 10:24:58 +02:00
Miroslav Štampar 1192d266c8 Update related to the #6099 2026-08-28 09:44:22 +02:00
Miroslav Štampar 0a35b20e39 Update related to the #6098 2026-08-26 13:46:08 +02:00
Miroslav Štampar a184c89a6b Minor patch for multiple-dbms tags 2026-08-23 17:35:54 +02:00
Miroslav Štampar 91239a3c10 Minor patch 2026-08-23 17:12:19 +02:00
Miroslav Štampar 0ee19bdf3d Minor patch 2026-08-22 23:02:58 +02:00
Miroslav Štampar cef41c7fa2 Adding semicolon-less MSSQL stacked-query detection payloads 2026-08-18 14:49:23 +02:00
Miroslav Štampar 973ab5ab88 Probe actual gadget executability instead of extension presence (avoids false success as non-superuser) 2026-08-18 12:04:51 +02:00
Miroslav Štampar d424016742 Update of CHANGELOG 2026-08-18 11:53:51 +02:00
Miroslav Štampar bec4dedbc9 Enabling PostgreSQL file write over a gadget when stacked queries are unavailable 2026-08-18 11:45:44 +02:00
Miroslav Štampar 529fc7aebb Adding gadget fallback for non-query statement execution without stacked queries (PostgreSQL dblink) 2026-08-18 11:35:54 +02:00
Miroslav Štampar 8a3b312950 Implementing file read/write support for SQLite (fileio extension) 2026-08-18 11:07:00 +02:00
Miroslav Štampar 774c044519 Extending --procs with routine data-access and security type 2026-08-18 10:50:44 +02:00
Miroslav Štampar 848ba68ccf Couple of fixes 2026-08-17 22:20:42 +02:00
Miroslav Štampar 77ee160875 Fixing CI/CD errors 2026-08-17 16:52:00 +02:00
Miroslav Štampar 49a774035f Fixing some of WAF bypass bugs 2026-08-17 16:41:49 +02:00
Miroslav Štampar dc42edc19f Improving the auto WAF bypass feature 2026-08-17 15:24:18 +02:00
Miroslav Štampar 0ba9df2589 Adding new tamper scripts 2026-08-17 14:28:48 +02:00
Miroslav Štampar cbe892410c Adding more WAF friendly fingerprinting payloads 2026-08-17 14:25:46 +02:00
Miroslav Štampar 76ddd7a1b9 Fixes #6097 2026-08-16 23:52:22 +02:00
Miroslav Štampar 9f798873c4 Fixing CI/CD errors 2026-08-16 23:16:16 +02:00
Miroslav Štampar bdf3e09315 Adding support for multi-bit boolean extraction 2026-08-16 23:11:49 +02:00
Miroslav Štampar 99367454c5 Adding a research link to READMEs 2026-08-16 00:17:28 +02:00
Miroslav Štampar 6770b2847b Refresh of tamper docu 2026-08-14 23:21:00 +02:00
Miroslav Štampar 319910ccd8 Adding two new tamper scripts 2026-08-14 22:56:50 +02:00
Miroslav Štampar ebf4b48337 Fixing CI/CD errors 2026-08-13 19:27:32 +02:00
Miroslav Štampar 92c2ee47ea Adding support for Sybase into dbwire 2026-08-13 14:41:00 +02:00
Miroslav Štampar 58d6f740b7 Some more patching of dbwire 2026-08-13 13:26:55 +02:00
Miroslav Štampar e9f8180614 Some patching of dbwire 2026-08-13 13:01:43 +02:00
Miroslav Štampar d8dbaee0df Fixing CI/CD errors 2026-08-12 00:17:57 +02:00
Miroslav Štampar b154f084e0 Minor update 2026-08-11 23:37:53 +02:00
Miroslav Štampar e11ea65230 Minor patch 2026-08-11 23:13:20 +02:00
Miroslav Štampar 90b14df46c Minor update 2026-08-11 23:07:22 +02:00
Miroslav Štampar 53411f6fd8 Minor patch 2026-08-11 22:56:35 +02:00
Miroslav Štampar 08b986d40c Faster --odata 2026-08-11 22:43:40 +02:00
Miroslav Štampar d6370a681b Fixes #6096 2026-08-11 13:40:57 +02:00
Miroslav Štampar f9a45c6755 Patch related to #6093 2026-08-10 13:42:38 +02:00
Miroslav Štampar 3d1258d57d Patch related to #6092 2026-08-10 11:17:04 +02:00
Miroslav Štampar dd57fd91e2 Adding switches --odata and --sparql 2026-08-09 11:04:44 +02:00
Miroslav Štampar fb5339d783 Fixing CI/CD errors 2026-08-08 08:27:00 +02:00
Miroslav Štampar bbe164a7f3 Better heuristics for non-SQLi techniques 2026-08-08 02:14:34 +02:00
Miroslav Štampar a8b1bb371d Bug fix (kb.chars generation collision) 2026-08-08 01:27:24 +02:00
Miroslav Štampar 7d2c33cd32 Minor patch 2026-08-08 01:07:07 +02:00
Miroslav Štampar aa8d9b9841 Patching non-SQLi techniques regarding reflective values 2026-08-08 00:55:37 +02:00
Miroslav Štampar 61ffadb487 Minor update 2026-08-08 00:46:19 +02:00
Miroslav Štampar 881d2e8f90 Adding switch --xslt 2026-08-08 00:37:32 +02:00