(idx)
| 209 | dataToStdout("\r[%s] [INFO] retrieved: " % time.strftime("%X")) |
| 210 | |
| 211 | def tryHint(idx): |
| 212 | with kb.locks.hint: |
| 213 | hintValue = kb.hintValue |
| 214 | |
| 215 | if payload is not None and len(hintValue or "") > 0 and len(hintValue) >= idx: |
| 216 | if "'%s'" % CHAR_INFERENCE_MARK in payload: |
| 217 | posValue = hintValue[idx - 1] |
| 218 | else: |
| 219 | posValue = ord(hintValue[idx - 1]) |
| 220 | |
| 221 | markingValue = "'%s'" % CHAR_INFERENCE_MARK |
| 222 | unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(posValue)) |
| 223 | forgedPayload = agent.extractPayload(payload) or "" |
| 224 | forgedPayload = forgedPayload.replace(markingValue, unescapedCharValue) |
| 225 | forgedPayload = safeStringFormat(forgedPayload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, posValue)) |
| 226 | result = Request.queryPage(agent.replacePayload(payload, forgedPayload), timeBasedCompare=timeBasedCompare, raise404=False) |
| 227 | incrementCounter(getTechnique()) |
| 228 | |
| 229 | if result: |
| 230 | return hintValue[idx - 1] |
| 231 | |
| 232 | with kb.locks.hint: |
| 233 | kb.hintValue = "" |
| 234 | |
| 235 | return None |
| 236 | |
| 237 | def validateChar(idx, value): |
| 238 | """ |
no test coverage detected
searching dependent graphs…