Implementing support for 429 (rate limit)

stamparm · stamparm · commit 2d9e9ed959d2 · 2026-07-24T15:17:05.000+02:00
diff --git a/extra/vulnserver/vulnserver.py b/extra/vulnserver/vulnserver.py
@@ -407,6 +407,10 @@ def _xpath_element_to_dict(el):
 _server = None
 _alive = False
 _csrf_token = None
+_ratelimit_hits = 0
+
+# number of initial hits to '/ratelimit' answered with 429 before it behaves normally
+RATELIMIT_INITIAL_429 = 1
 
 def init(quiet=False):
     global _conn
@@ -963,6 +967,22 @@ def do_REQUEST(self):
                 self.wfile.write(b"<html><body>Request blocked: security policy violation (WAF)</body></html>")
                 return
 
+        # rate-limit emulator ('/ratelimit'): the first hit(s) answer 429 with a 'Retry-After', then
+        # it behaves like the default SQLi endpoint - so a client that honors the backoff and retries
+        # eventually gets through (drives the adaptive rate-limit handling)
+        if self.url == "/ratelimit":
+            global _ratelimit_hits
+            _ratelimit_hits += 1
+            if _ratelimit_hits <= RATELIMIT_INITIAL_429:
+                self.send_response(429)
+                self.send_header("Retry-After", "0")
+                self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
+                self.send_header("Connection", "close")
+                self.end_headers()
+                self.wfile.write(b"<html><body>Too Many Requests</body></html>")
+                return
+            self.url = "/"
+
         if self.url == "/xxe":
             self.send_response(OK)
             self.send_header("Content-type", "application/xml; charset=%s" % UNICODE_ENCODING)
diff --git a/lib/core/enums.py b/lib/core/enums.py
@@ -282,6 +282,7 @@ class HTTP_HEADER(object):
     RANGE = "Range"
     REFERER = "Referer"
     REFRESH = "Refresh"  # Reference: http://stackoverflow.com/a/283794
+    RETRY_AFTER = "Retry-After"
     SERVER = "Server"
     SET_COOKIE = "Set-Cookie"
     TRANSFER_ENCODING = "Transfer-Encoding"
diff --git a/lib/core/settings.py b/lib/core/settings.py
@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.181"
+VERSION = "1.10.7.182"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -58,6 +58,17 @@
 # false positive) rather than the back-end actually answering.
 WAF_BLOCK_HTTP_CODES = (403, 406, 429, 451, 501, 503)
 
+# HTTP status signalling that the client is being rate-limited (kept as a literal because Python 2's
+# httplib has no such constant)
+TOO_MANY_REQUESTS_HTTP_CODE = 429
+
+# Adaptive rate-limit handling: one-time backoff used when a rate-limited response carries no usable
+# 'Retry-After', the additive step by which the inter-request delay is raised on each hit, and the
+# ceiling for both the honored backoff and the auto-throttle (seconds)
+RATE_LIMIT_DEFAULT_DELAY = 1.0
+RATE_LIMIT_DELAY_STEP = 0.5
+RATE_LIMIT_MAX_DELAY = 60.0
+
 # Candidate tamper scripts for automatic WAF-bypass, ordered by empirical WAF-bypass value
 # (structural token-substitution first, camouflage last; per identYwaf data). The back-end DBMS
 # is not pre-filtered here: semantics-preservation is verified at runtime by re-running detection
diff --git a/lib/core/testing.py b/lib/core/testing.py
@@ -67,6 +67,7 @@ def vulnTest(tests=None, label="vuln"):
         ("-u <url> --data=\"security_level=5\" -p id --flush-session --technique=B", ("unable to automatically bypass the WAF/IPS", "does not seem to be injectable")),   # automatic WAF-bypass honest bail: a libinjection-class WAF that no User-Agent or tamper can defeat
         ("-u <url> -p id --flush-session --technique=B --proof", ("sqlmap proved exploitation of the following injection point", "Parameter: id (GET)", "Technique: boolean-based blind", "TRUE (5/5)", "repeatably", "Retrieved: back-end DBMS banner '3.")),   # --proof: report-grade proof in the injection-point style - forces the boolean technique (so a multi-technique point still proves), and actively reads a value out as the strongest proof
         ("-u <base> --mine-params --flush-session --technique=B", ("mining for hidden GET parameters", "found hidden parameter 'id'", "held back parameter(s) that break the base request", "Parameter: id (GET)", "Type: boolean-based blind")),   # --mine-params: discover an injectable parameter absent from a bare URL, hold back the raw-SQL sink that would shadow it, then confirm the injection on the mined 'id'
+        ("-u \"<base>ratelimit?id=1\" --flush-session --technique=B", ("target appears to be rate-limiting", "Parameter: id (GET)", "Type: boolean-based blind")),   # adaptive rate-limit handling: the endpoint answers 429 with 'Retry-After' first, so detection only succeeds if sqlmap honors the backoff, throttles, and retries rather than treating 429 as a hard block
         ("-r <request> --flush-session -v 5 --test-skip=\"heavy\" --save=<config>", ("CloudFlare", "web application technology: Express", "possible DBMS: 'SQLite'", "User-Agent: foobar", "~Type: time-based blind", "saved command line options to the configuration file")),
         ("-c <config>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-Agent: foobar", "~Type: time-based blind")),
         ("-l <log> --flush-session --skip-waf -vvvvv --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),
diff --git a/lib/request/connect.py b/lib/request/connect.py
@@ -6,6 +6,8 @@
 """
 
 import binascii
+import calendar
+import email.utils
 import inspect
 import io
 import logging
@@ -119,9 +121,13 @@
 from lib.core.settings import PLAIN_TEXT_CONTENT_TYPE
 from lib.core.settings import RANDOM_INTEGER_MARKER
 from lib.core.settings import RANDOM_STRING_MARKER
+from lib.core.settings import RATE_LIMIT_DEFAULT_DELAY
+from lib.core.settings import RATE_LIMIT_DELAY_STEP
+from lib.core.settings import RATE_LIMIT_MAX_DELAY
 from lib.core.settings import REPLACEMENT_MARKER
 from lib.core.settings import SAFE_HEX_MARKER
 from lib.core.settings import TEXT_CONTENT_TYPE_REGEX
+from lib.core.settings import TOO_MANY_REQUESTS_HTTP_CODE
 from lib.core.settings import UNENCODED_ORIGINAL_VALUE
 from lib.core.settings import UNICODE_ENCODING
 from lib.core.settings import URI_HTTP_HEADER
@@ -223,6 +229,49 @@ def _retryProxy(**kwargs):
         kwargs['retrying'] = True
         return Connect._getPageProxy(**kwargs)
 
+    @staticmethod
+    def _parseRetryAfter(responseHeaders):
+        """
+        Parses a 'Retry-After' response header (RFC 7231 delta-seconds or an HTTP-date) into a number
+        of seconds to wait, or None when it is absent or unparseable.
+        """
+
+        value = (responseHeaders.get(HTTP_HEADER.RETRY_AFTER) if responseHeaders else None) or ""
+        value = value.strip()
+
+        if value.isdigit():
+            return float(value)
+
+        parsed = email.utils.parsedate(value)
+        return max(0.0, calendar.timegm(parsed) - time.time()) if parsed else None
+
+    @staticmethod
+    def _rateLimitRetry(responseHeaders, code, **kwargs):
+        """
+        Handles a rate-limited response by honoring its 'Retry-After' (capped), adaptively raising the
+        inter-request delay so subsequent requests self-throttle under the limit, then re-issuing the
+        request. Returns the retried (page, headers, code) or None when the retry budget is exhausted,
+        so the caller can surface the rate-limited response as-is.
+        """
+
+        threadData = getCurrentThreadData()
+        if threadData.retriesCount >= conf.retries or kb.threadException:
+            return None
+
+        retryAfter = Connect._parseRetryAfter(responseHeaders)
+        backoff = min(retryAfter if retryAfter is not None else RATE_LIMIT_DEFAULT_DELAY, RATE_LIMIT_MAX_DELAY)
+
+        # additive-increase throttle: nudge the inter-request delay up toward a sustainable pace. The
+        # auto-throttle is capped, but a larger user-set '--delay' is never lowered. It is monotonic,
+        # so a lost concurrent update across threads self-heals on the next hit.
+        conf.delay = max(conf.delay or 0, min(RATE_LIMIT_MAX_DELAY, (conf.delay or 0) + RATE_LIMIT_DELAY_STEP))
+
+        singleTimeWarnMessage("target appears to be rate-limiting requests; sqlmap is backing off and throttling accordingly (consider raising '--delay' or lowering '--threads')")
+        logger.debug("rate-limited (HTTP %d)%s; sleeping %.1f second(s), inter-request delay now %.1f second(s)" % (code, " honoring 'Retry-After'" if retryAfter is not None else "", backoff, conf.delay))
+
+        time.sleep(backoff)
+        return Connect._retryProxy(**kwargs)
+
     @staticmethod
     def _connReadProxy(conn):
         parts = []
@@ -844,7 +893,13 @@ class _(dict):
                 raise SystemExit
 
             if ex.code not in (conf.ignoreCode or []):
-                if ex.code == _http_client.UNAUTHORIZED:
+                if ex.code == TOO_MANY_REQUESTS_HTTP_CODE or (ex.code == _http_client.SERVICE_UNAVAILABLE and Connect._parseRetryAfter(responseHeaders) is not None):
+                    retried = Connect._rateLimitRetry(responseHeaders, ex.code, **kwargs)
+                    if retried is not None:
+                        return retried
+                    debugMsg = "target kept rate-limiting after %d retries (%d)" % (conf.retries, code)
+                    logger.debug(debugMsg)
+                elif ex.code == _http_client.UNAUTHORIZED:
                     errMsg = "not authorized, try to provide right HTTP "
                     errMsg += "authentication type and valid credentials (%d). " % code
                     errMsg += "If this is intended, try to rerun by providing "
diff --git a/tests/test_brute.py b/tests/test_brute.py
@@ -161,8 +161,10 @@ def test_column_exists_collects_and_types(self):
 
         def _cbe(expression, expectingNone=True):
             calls["n"] += 1
-            # initial sanity probe uses two random strings (no real column name)
-            if "id" not in expression and "name" not in expression:
+            # initial sanity probe queries a random table, not the real 'users' one - so keying on the
+            # table name is collision-proof (unlike a column-name substring, which a random probe value
+            # can incidentally contain, e.g. 'id')
+            if "users" not in expression:
                 return False
             # MySQL numeric-type follow-up: `not checkBooleanExpression(... REGEXP '[^0-9]')`.
             # 'id' is numeric (no non-digit chars => probe False => numeric);
