Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

response code=404 handle modify and https with -r handle modify #2663

Closed
wants to merge 4 commits into from

Conversation

3xp10it
Copy link

@3xp10it 3xp10it commented Aug 20, 2017

detail:
sqlmap 404 handle bug

When sqlmap got 404 code from the server,sqlmap will raise a exit exception and will not scan the url's sqli anymore,but some 404 code may not be a real 404 code,dvwa is an example,and some waf may return 404 http response code,but the body content in the page of the url is not 404 type content,so I add a handle to recgnize whether the code 404 is a real 404 or not,if the 404 is not a real 404,sqlmap will not raise the exception and go on with latter tests.

@3xp10it
Copy link
Author

3xp10it commented Aug 23, 2017

another bug on https type sqli scan:
detail:
https type sqli scan bug on param -r

@3xp10it 3xp10it changed the title code=404 handle modify response code=404 handle modify and https with -r handle modify Aug 23, 2017
@stamparm
Copy link
Member

Your issue request doesn't make any sense and the code quality is really poor. When you start sqlmap against the page that issues 404 code, you are being asked whether you want to proceed. From your comments I couldn't understand where sqlmap fails in the whole workflow to suite your needs.

Also, it doesn't make any sense to distinguish chinese 404 from the rest of the world 404 (as could be seen from your pull request). Closing this down as invalid

@stamparm stamparm closed this Aug 23, 2017
stamparm added a commit that referenced this pull request Aug 23, 2017
@stamparm
Copy link
Member

With the latest commit there is a new option (--ignore-code):

$ python sqlmap.py -hh | grep "error code"
    --ignore-code=IG..  Ignore HTTP error code (e.g. 401)

Just use --ignore-code=404 in your kind of cases. As said, poor quality code won't go into the repository, especially in cases like 20daabd

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants