From 45eaf9309975b5e1d514ce581974f0c418a48fa2 Mon Sep 17 00:00:00 2001 From: r0oth3x49 Date: Wed, 5 Jun 2024 06:41:55 +0500 Subject: [PATCH] fixed issue with post data properly encoding in ASP based targets, bumped version 1.3.4 --- README.md | 2 +- ghauri/__init__.py | 2 +- ghauri/common/utils.py | 3 +++ setup.py | 2 +- 4 files changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 42b60ea..10c5ca1 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![GitHub release](https://img.shields.io/badge/release-v1.3.3-brightgreen?style=flat-square)](https://github.com/r0oth3x49/ghauri/releases/tag/1.3.3) +[![GitHub release](https://img.shields.io/badge/release-v1.3.4-brightgreen?style=flat-square)](https://github.com/r0oth3x49/ghauri/releases/tag/1.3.4) [![GitHub stars](https://img.shields.io/github/stars/r0oth3x49/ghauri?style=flat-square)](https://github.com/r0oth3x49/ghauri/stargazers) [![GitHub forks](https://img.shields.io/github/forks/r0oth3x49/ghauri?style=flat-square)](https://github.com/r0oth3x49/ghauri/network) [![GitHub issues](https://img.shields.io/github/issues/r0oth3x49/ghauri?style=flat-square)](https://github.com/r0oth3x49/ghauri/issues) diff --git a/ghauri/__init__.py b/ghauri/__init__.py index ee5ca74..07577d7 100644 --- a/ghauri/__init__.py +++ b/ghauri/__init__.py @@ -24,7 +24,7 @@ """ -__version__ = "1.3.3" +__version__ = "1.3.4" __author__ = "Nasir Khan (r0ot h3x49)" __license__ = "MIT" __copyright__ = "Copyright (c) 2016-2025 Nasir Khan (r0ot h3x49)" diff --git a/ghauri/common/utils.py b/ghauri/common/utils.py index 349efd6..5eb0388 100644 --- a/ghauri/common/utils.py +++ b/ghauri/common/utils.py @@ -944,6 +944,9 @@ def urlencode( value = urldecode(value) if conf.safe_chars: safe = f"{safe}{conf.safe_chars}" + is_aspdotnet = bool("%2b" in value.lower()) + if is_aspdotnet: + safe += "%" if injection_type and injection_type not in ["HEADER"] and not is_multipart: if injection_type == "COOKIE": if value_type == "payload": diff --git a/setup.py b/setup.py index af7b990..76d83e9 100644 --- a/setup.py +++ b/setup.py @@ -5,7 +5,7 @@ setup( name="ghauri", - version="1.3.3", + version="1.3.4", description="An advanced SQL injection detection & exploitation tool.", classifiers=["Programming Language :: Python3"], author="Nasir Khan",