[pull] master from sqlmapproject:master

extra/vulnserver/vulnserver.py

@@ -266,6 +266,10 @@ def _hql_atom(atom):
     if match:
         return match.group(1) == match.group(2)
 
+    match = re.match(r"^(\d+)\s*=\s*(\d+)$", atom)                               # numeric literal 1=1 / 1=2
+    if match:
+        return match.group(1) == match.group(2)
+
     match = re.match(r"^\w+\s*=\s*'([^']*)'$", atom)                             # outer: name = 'X'
     if match:
         return HQL_RECORD["name"] == match.group(1)

lib/core/option.py

@@ -2726,6 +2726,14 @@ def _checkTor():
         logger.info(infoMsg)
 
 def _basicOptionValidation():
+    _nonSqlTechniques = [name for name, enabled in (
+        ("--graphql", conf.graphql), ("--nosql", conf.nosql), ("--ldap", conf.ldap),
+        ("--xpath", conf.xpath), ("--ssti", conf.ssti), ("--xxe", conf.xxe), ("--hql", conf.hql)) if enabled]
+    if len(_nonSqlTechniques) > 1:
+        errMsg = "only one non-SQL technique switch may be used at a time (found: %s). " % ", ".join(_nonSqlTechniques)
+        errMsg += "each is a self-contained scan for a different back-end class - pick one"
+        raise SqlmapSyntaxException(errMsg)
+
     if conf.limitStart is not None and not (isinstance(conf.limitStart, int) and conf.limitStart > 0):
         errMsg = "value for option '--start' (limitStart) must be an integer value greater than zero (>0)"
         raise SqlmapSyntaxException(errMsg)

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.176"
+VERSION = "1.10.7.180"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -1169,6 +1169,11 @@
 XXE_BLACKHOLE_HOST = "192.0.2.1"
 XXE_TIME_THRESHOLD = 5
 
+# maximum number of distinct leaf text-node locations the in-band reflection probe sweeps to find a
+# working injection point (a schema-validated or non-reflected first node otherwise hides the finding);
+# bounds the request cost on documents with many text nodes
+XXE_LOCATION_SWEEP_MAX = 12
+
 # HQL/JPQL (Hibernate, EclipseLink) injection error signatures for error-based
 # detection and ORM fingerprinting. Each tuple is (backend_name, regex_fragment).
 # A match means the injection reached the ORM query parser (not the SQL layer),

lib/core/testing.py

@@ -92,7 +92,7 @@ def vulnTest(tests=None, label="vuln"):
         ("-u <url> -z \"tec=B\" --hex --fresh-queries --threads=4 --sql-query=\"SELECT * FROM users\"", ("SELECT * FROM users [30]", "nameisnull")),
         ("-u \"<url>&echo=foobar*\" --flush-session", ("might be vulnerable to cross-site scripting",)),
         ("-u \"<base>nosql?name=luther&password=x\" -p password --nosql --flush-session", ("is vulnerable to NoSQL injection", "back-end: 'MongoDB'", "NoSQL: GET parameter 'password'", "s3cr3t")),   # NoSQL (MongoDB) operator-injection detection + blind regexp extraction
-        ("-u \"<base>graphql\" --graphql --flush-session --disable-hashing", ("found GraphQL endpoint", "introspection returned", "skipping 2 mutation slot", "GraphQL boolean-based blind", "in-band data exposure", "back-end DBMS: 'SQLite'", "banner: '3.", "GraphQL database tables", "fetched 30 entries from table 'creds'", "db3a16990a0008a3b04707fdef6584a0", "GraphQL scan complete")),   # GraphQL: endpoint detection + introspection + mutation-skip + boolean-blind/in-band + back-end fingerprint + batched blind dump of an injection-only table (SQLite-backed)
+        ("-u \"<base>graphql\" --graphql --flush-session --disable-hashing", ("found GraphQL endpoint", "introspection returned", "enumerated 6 injectable argument slot(s): 4 query, 2 mutation", "SQL injection via GraphQL (boolean-based)", "in-band data exposure", "back-end DBMS: 'SQLite'", "banner: '3.", "GraphQL database tables", "fetched 30 entries from table 'creds'", "db3a16990a0008a3b04707fdef6584a0", "GraphQL scan complete")),   # GraphQL: endpoint detection + introspection + query-slots-first (mutations only as fallback) + boolean-blind/in-band + back-end fingerprint + batched blind dump of an injection-only table (SQLite-backed)
         ("-u \"<base>ldap/search?q=x\" --ldap --flush-session --disable-hashing", ("is vulnerable to LDAP injection", "Title: LDAP in-band data exposure", "LDAP: GET parameter 'q' in-band entries", "in-band data exposure", "LDAP scan complete")),   # LDAP: error-based detection (unbalanced paren) + boolean oracle + directory attribute extraction via blind substring probing
         ("-u \"<base>xpath/search?q=x\" --xpath --flush-session --disable-hashing", ("is vulnerable to XPath injection", "Title: XPath boolean-based blind", "XPath: GET parameter 'q' XML tree", "extracted", "XPath scan complete")),   # XPath: error-based detection + boolean oracle + blind XML tree-walking via starts-with character extraction
         ("-u \"<base>ssti/search?q=x\" --ssti --flush-session --disable-hashing", ("is vulnerable to SSTI", "Title: SSTI Jinja2 injection", "back-end template engine: 'Jinja2'", "in-band arithmetic proof confirmed", "SSTI scan complete")),   # SSTI: Jinja2 detection via arithmetic control-pair + boolean oracle + distinguishing probe