Commit c324ff7

authored

Merge pull request #81 from alexdetrano/master

fixed injectSize type error for Post attacks

2 parents ba39e50 + a86d230 commit c324ff7Copy full SHA for c324ff7

File tree

2 files changed

+50

-45

lines changed

nosqlmap.py
nsmweb.py

2 files changed

+50

-45

lines changed

`‎nosqlmap.py`

Lines changed: 49 additions & 45 deletions

Original file line number	Diff line number	Diff line change
`@@ -400,46 +400,51 @@ def options():`
`400`	`400`
`401`	`401`	`elif select == "0":`
`402`	`402`	`loadPath = raw_input("Enter file name to load: ")`
	`403`	`+ cvsOpt = []`
`403`	`404`	`try:`
`404`		`- fo = open(loadPath,"r" )`
`405`		`- csvOpt = fo.readlines()`
`406`		`- fo.close()`
`407`		`- optList = csvOpt[0].split(",")`
`408`		`- victim = optList[0]`
`409`		`- webPort = optList[1]`
`410`		`- uri = optList[2]`
`411`		`- httpMethod = optList[3]`
`412`		`- myIP = optList[4]`
`413`		`- myPort = optList[5]`
`414`		`- verb = optList[6]`
`415`		`- https = optList[7]`
	`405`	`+ with open(loadPath,"r") as fo:`
	`406`	`+ for line in fo:`
	`407`	`+ cvsOpt.append(line.rstrip())`
	`408`	`+ except IOError as e:`
	`409`	`+ print "I/O error({0}): {1}".format(e.errno, e.strerror)`
	`410`	`+ raw_input("error reading file. Press enter to continue...")`
	`411`	`+ return`
	`412`	`+`
	`413`	`+ optList = csvOpt[0].split(",")`
	`414`	`+ victim = optList[0]`
	`415`	`+ webPort = optList[1]`
	`416`	`+ uri = optList[2]`
	`417`	`+ httpMethod = optList[3]`
	`418`	`+ myIP = optList[4]`
	`419`	`+ myPort = optList[5]`
	`420`	`+ verb = optList[6]`
	`421`	`+ https = optList[7]`
	`422`	`+`
	`423`	`+ # saved headers position will depend of the request verb`
	`424`	`+ headersPos= 1`
	`425`	`+`
	`426`	`+ if httpMethod == "POST":`
	`427`	`+ postData = ast.literal_eval(csvOpt[1])`
	`428`	`+ headersPos = 2`
`416`	`429`
`417`		`- # saved headers position will depend of the request verb`
`418`		`- headersPos= 1`
`419`		`-`
`420`		`- if httpMethod == "POST":`
`421`		`- postData = ast.literal_eval(csvOpt[1])`
`422`		`- headersPos = 2`
`423`		`-`
`424`		`- requestHeaders = ast.literal_eval(csvOpt[headersPos])`
`425`		`-`
`426`		`- # Set option checking array based on what was loaded`
`427`		`- x = 0`
`428`		`- for item in optList:`
`429`		`- if item != "Not Set":`
`430`		`- optionSet[x] = True`
`431`		`- x += 1`
`432`		`- except:`
`433`		`- print "Couldn't load options file!"`
	`430`	`+ requestHeaders = ast.literal_eval(csvOpt[headersPos])`
	`431`	`+`
	`432`	`+ # Set option checking array based on what was loaded`
	`433`	`+ x = 0`
	`434`	`+ for item in optList:`
	`435`	`+ if item != "Not Set":`
	`436`	`+ optionSet[x] = True`
	`437`	`+ x += 1`
`434`	`438`
`435`	`439`	`elif select == "a":`
`436`	`440`	`loadPath = raw_input("Enter path to Burp request file: ")`
`437`		`-`
	`441`	`+reqData= []`
`438`	`442`	`try:`
`439`		`- fo = open(loadPath,"r")`
`440`		`- reqData = fo.readlines()`
`441`		`-`
`442`		`- except:`
	`443`	`+ with open(loadPath,"r") as fo:`
	`444`	`+ for line in fo:`
	`445`	`+ reqData.append(line.rstrip())`
	`446`	`+ except IOError as e:`
	`447`	`+ print "I/O error({0}): {1}".format(e.errno, e.strerror)`
`443`	`448`	`raw_input("error reading file. Press enter to continue...")`
`444`	`449`	`return`
`445`	`450`
`@@ -473,23 +478,22 @@ def options():`
`473`	`478`	`header = line.split(": ");`
`474`	`479`	`requestHeaders[header[0]] = header[1].strip()`
`475`	`480`
`476`		`- victim = reqData[1].split( " ")[1].replace("\r\n","")`
	`481`	`+ victim = reqData[1].split( " ")[1]`
`477`	`482`	`optionSet[0] = True`
`478`		`- uri = methodPath[1].replace("\r\n","")`
	`483`	`+ uri = methodPath[1]`
`479`	`484`	`optionSet[2] = True`
`480`	`485`
`481`	`486`	`elif select == "b":`
`482`	`487`	`savePath = raw_input("Enter file name to save: ")`
`483`	`488`	`try:`
`484`		`- fo = open(savePath, "wb")`
`485`		`- fo.write(str(victim) + "," + str(webPort) + "," + str(uri) + "," + str(httpMethod) + "," + str(myIP) + "," + str(myPort) + "," + verb + "," + https)`
`486`		`-`
`487`		`- if httpMethod == "POST":`
`488`		`- fo.write(",\n"+ str(postData))`
`489`		`- fo.write(",\n" + str(requestHeaders) )`
`490`		`- fo.close()`
`491`		`- print "Options file saved!"`
`492`		`- except:`
	`489`	`+ with open(savePath, "wb") as fo:`
	`490`	`+ fo.write(str(victim) + "," + str(webPort) + "," + str(uri) + "," + str(httpMethod) + "," + str(myIP) + "," + str(myPort) + "," + verb + "," + https)`
	`491`	`+`
	`492`	`+ if httpMethod == "POST":`
	`493`	`+ fo.write(",\n"+ str(postData))`
	`494`	`+ fo.write(",\n" + str(requestHeaders) )`
	`495`	`+ print "Options file saved!"`
	`496`	`+ except IOError:`
`493`	`497`	`print "Couldn't save options file."`
`494`	`498`
`495`	`499`	`elif select == "h":`

`‎nsmweb.py`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -483,6 +483,7 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders, args = None)`
`483`	`483`	`injectSize = int(args.injectSize)`
`484`	`484`	`format = args.injectFormat`
`485`	`485`
	`486`	`+ injectSize = int(injectSize)`
`486`	`487`	`injectString = build_random_string(format, injectSize)`
`487`	`488`
`488`	`489`	`print "Using " + injectString + " for injection testing.\n"`

0 commit comments

Comments

(0)

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Commit c324ff7

File tree

2 files changed

2 files changed

`‎nosqlmap.py`

`‎nsmweb.py`

0 commit comments