diff --git a/doc/THANKS b/doc/THANKS index 0b929b93e..4e982487b 100644 --- a/doc/THANKS +++ b/doc/THANKS @@ -220,7 +220,7 @@ Enrico Milanese for providing me with some ideas for the PHP backdoor Anton Mogilin - for reporting a minor bug + for reporting couple of bugs Alejo Murillo Moya for suggesting a feature diff --git a/lib/parse/cmdline.py b/lib/parse/cmdline.py index 8b6c20ec2..147a940b2 100644 --- a/lib/parse/cmdline.py +++ b/lib/parse/cmdline.py @@ -212,6 +212,10 @@ def cmdLineParser(): help="Test for stacked queries (multiple " "statements) support") + techniques.add_option("--error-test", dest="errorTest", + action="store_true", default=False, + help="Test for error based SQL injection support (beta)") + techniques.add_option("--time-test", dest="timeTest", action="store_true", default=False, help="Test for time based blind SQL injection") @@ -492,10 +496,6 @@ def cmdLineParser(): parser.add_option("--profile", dest="profile", action="store_true", default=False, help=SUPPRESS_HELP) - parser.add_option("--error-test", dest="errorTest", - action="store_true", default=False, - help=SUPPRESS_HELP) - parser.add_option("--cpu-throttle", dest="cpuThrottle", type="int", default=10, help=SUPPRESS_HELP) diff --git a/lib/techniques/error/use.py b/lib/techniques/error/use.py index c6fd70bbb..abe4c568a 100644 --- a/lib/techniques/error/use.py +++ b/lib/techniques/error/use.py @@ -51,7 +51,7 @@ def errorUse(expression): nulledCastedField = agent.nullAndCastField(fieldToCastStr) if kb.dbms == "MySQL": - nulledCastedField = nulledCastedField.replace("CHAR(10000)", "CHAR(255)") #fix for that 'Subquery returns more than 1 row' + nulledCastedField = nulledCastedField.replace("AS CHAR)", "AS CHAR(255))") #fix for that 'Subquery returns more than 1 row' expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1) expressionUnescaped = unescaper.unescape(expressionReplaced) diff --git a/xml/queries.xml b/xml/queries.xml index a38acf6a0..22f638c01 100644 --- a/xml/queries.xml +++ b/xml/queries.xml @@ -3,7 +3,7 @@ - + @@ -26,9 +26,9 @@ - - - + + +