turkdevops · pull · Jul 24, 2026 · Jul 24, 2026 · Jul 24, 2026
diff --git a/data/txt/common-params.txt b/data/txt/common-params.txt
@@ -0,0 +1,243 @@
+# Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
+# See the file 'LICENSE' for copying permission
+
+id
+page
+q
+query
+search
+s
+keyword
+keywords
+name
+username
+user
+uid
+userid
+email
+mail
+pass
+password
+pwd
+token
+key
+apikey
+api_key
+access_token
+auth
+session
+sid
+sessionid
+lang
+language
+locale
+country
+region
+city
+zip
+sort
+order
+orderby
+dir
+direction
+filter
+category
+cat
+type
+kind
+class
+group
+tag
+tags
+status
+state
+action
+act
+cmd
+command
+op
+operation
+mode
+method
+func
+function
+callback
+jsonp
+format
+output
+view
+tab
+step
+stage
+debug
+test
+dev
+admin
+role
+level
+priv
+file
+filename
+path
+dir
+folder
+doc
+document
+url
+uri
+link
+href
+redirect
+redirect_uri
+return
+returnurl
+return_url
+next
+target
+dest
+destination
+goto
+continue
+ref
+referer
+referrer
+source
+src
+from
+to
+date
+year
+month
+day
+time
+timestamp
+start
+end
+begin
+finish
+limit
+offset
+count
+num
+number
+size
+length
+width
+height
+amount
+price
+qty
+quantity
+value
+val
+data
+input
+content
+text
+msg
+message
+body
+title
+subject
+description
+desc
+comment
+note
+code
+hash
+sig
+signature
+csrf
+csrf_token
+csrftoken
+nonce
+salt
+enc
+encrypt
+decrypt
+base64
+json
+xml
+raw
+echo
+reflect
+show
+hide
+display
+render
+template
+tpl
+theme
+skin
+style
+color
+font
+image
+img
+photo
+avatar
+icon
+banner
+video
+audio
+media
+attachment
+upload
+download
+export
+import
+backup
+restore
+sync
+refresh
+reload
+reset
+clear
+flush
+purge
+enable
+disable
+active
+enabled
+visible
+public
+private
+locked
+verified
+confirmed
+approved
+product
+item
+sku
+model
+brand
+vendor
+seller
+store
+shop
+cart
+basket
+checkout
+payment
+invoice
+receipt
+transaction
+account
+profile
+member
+customer
+client
+company
+organization
+org
+department
+team
+project
+task
+job
+event
+booking
+reservation
+appointment
+schedule
+calendar
diff --git a/extra/vulnserver/vulnserver.py b/extra/vulnserver/vulnserver.py
@@ -407,6 +407,10 @@ def _xpath_element_to_dict(el):
 _server = None
 _alive = False
 _csrf_token = None
+_ratelimit_hits = 0
+
+# number of initial hits to '/ratelimit' answered with 429 before it behaves normally
+RATELIMIT_INITIAL_429 = 1
 
 def init(quiet=False):
     global _conn
@@ -963,6 +967,22 @@ def do_REQUEST(self):
                 self.wfile.write(b"<html><body>Request blocked: security policy violation (WAF)</body></html>")
                 return
 
+        # rate-limit emulator ('/ratelimit'): the first hit(s) answer 429 with a 'Retry-After', then
+        # it behaves like the default SQLi endpoint - so a client that honors the backoff and retries
+        # eventually gets through (drives the adaptive rate-limit handling)
+        if self.url == "/ratelimit":
+            global _ratelimit_hits
+            _ratelimit_hits += 1
+            if _ratelimit_hits <= RATELIMIT_INITIAL_429:
+                self.send_response(429)
+                self.send_header("Retry-After", "0")
+                self.send_header("Content-type", "text/html; charset=%s" % UNICODE_ENCODING)
+                self.send_header("Connection", "close")
+                self.end_headers()
+                self.wfile.write(b"<html><body>Too Many Requests</body></html>")
+                return
+            self.url = "/"
+
         if self.url == "/xxe":
             self.send_response(OK)
             self.send_header("Content-type", "application/xml; charset=%s" % UNICODE_ENCODING)

diff --git a/lib/controller/controller.py b/lib/controller/controller.py
@@ -529,6 +529,10 @@ def start():
 
             checkWaf()
 
+            if conf.mineParams and not any((conf.graphql, conf.nosql, conf.ldap, conf.xpath, conf.ssti, conf.xxe, conf.hql)):
+                from lib.utils.paraminer import mineParameters
+                mineParameters()
+
             if any((conf.graphql, conf.nosql, conf.ldap, conf.xpath, conf.ssti, conf.xxe, conf.hql)) and (conf.reportJson or conf.resultsFile):
                 singleTimeWarnMessage("'--report-json'/'--results-file' do not (yet) capture non-SQL technique (--graphql/--nosql/--ldap/--xpath/--ssti/--xxe/--hql) findings; these are reported on the console only")
 

diff --git a/lib/core/common.py b/lib/core/common.py
@@ -1589,6 +1589,7 @@ def setPaths(rootPath):
     paths.COMMON_COLUMNS = os.path.join(paths.SQLMAP_TXT_PATH, "common-columns.txt")
     paths.COMMON_FILES = os.path.join(paths.SQLMAP_TXT_PATH, "common-files.txt")
     paths.COMMON_TABLES = os.path.join(paths.SQLMAP_TXT_PATH, "common-tables.txt")
+    paths.COMMON_PARAMETERS = os.path.join(paths.SQLMAP_TXT_PATH, "common-params.txt")
     paths.SQL_KEYWORDS = os.path.join(paths.SQLMAP_TXT_PATH, "keywords.txt")
     paths.SMALL_DICT = os.path.join(paths.SQLMAP_TXT_PATH, "smalldict.txt")
     paths.USER_AGENTS = os.path.join(paths.SQLMAP_TXT_PATH, "user-agents.txt")

diff --git a/lib/core/enums.py b/lib/core/enums.py
@@ -282,6 +282,7 @@ class HTTP_HEADER(object):
     RANGE = "Range"
     REFERER = "Referer"
     REFRESH = "Refresh"  # Reference: http://stackoverflow.com/a/283794
+    RETRY_AFTER = "Retry-After"
     SERVER = "Server"
     SET_COOKIE = "Set-Cookie"
     TRANSFER_ENCODING = "Transfer-Encoding"

diff --git a/lib/core/optiondict.py b/lib/core/optiondict.py
@@ -241,6 +241,7 @@
         "eta": "boolean",
         "flushSession": "boolean",
         "forms": "boolean",
+        "mineParams": "boolean",
         "freshQueries": "boolean",
         "googlePage": "integer",
         "harFile": "string",

diff --git a/lib/core/settings.py b/lib/core/settings.py
@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.180"
+VERSION = "1.10.7.182"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -58,6 +58,17 @@
 # false positive) rather than the back-end actually answering.
 WAF_BLOCK_HTTP_CODES = (403, 406, 429, 451, 501, 503)
 
+# HTTP status signalling that the client is being rate-limited (kept as a literal because Python 2's
+# httplib has no such constant)
+TOO_MANY_REQUESTS_HTTP_CODE = 429
+
+# Adaptive rate-limit handling: one-time backoff used when a rate-limited response carries no usable
+# 'Retry-After', the additive step by which the inter-request delay is raised on each hit, and the
+# ceiling for both the honored backoff and the auto-throttle (seconds)
+RATE_LIMIT_DEFAULT_DELAY = 1.0
+RATE_LIMIT_DELAY_STEP = 0.5
+RATE_LIMIT_MAX_DELAY = 60.0
+
 # Candidate tamper scripts for automatic WAF-bypass, ordered by empirical WAF-bypass value
 # (structural token-substitution first, camouflage last; per identYwaf data). The back-end DBMS
 # is not pre-filtered here: semantics-preservation is verified at runtime by re-running detection
@@ -92,6 +103,9 @@
 LOWER_RATIO_BOUND = 0.02
 UPPER_RATIO_BOUND = 0.98
 
+# Number of candidate names probed per request while mining for hidden parameters ('--mine-params')
+PARAMETER_MINING_BUCKET_SIZE = 25
+
 # For filling in case of dumb push updates
 DUMMY_JUNK = "Phah5jue"
 

diff --git a/lib/core/testing.py b/lib/core/testing.py
@@ -66,6 +66,8 @@ def vulnTest(tests=None, label="vuln"):
         ("-u <url> --data=\"security_level=4\" -p id --flush-session --technique=B --banner", ("random (non-scanner) User-Agent and browser-like headers to bypass the WAF/IPS", "Type: boolean-based blind", "banner: '3.")),   # automatic WAF-bypass against a libinjection-class WAF: tampers cannot help, only the non-scanner User-Agent does
         ("-u <url> --data=\"security_level=5\" -p id --flush-session --technique=B", ("unable to automatically bypass the WAF/IPS", "does not seem to be injectable")),   # automatic WAF-bypass honest bail: a libinjection-class WAF that no User-Agent or tamper can defeat
         ("-u <url> -p id --flush-session --technique=B --proof", ("sqlmap proved exploitation of the following injection point", "Parameter: id (GET)", "Technique: boolean-based blind", "TRUE (5/5)", "repeatably", "Retrieved: back-end DBMS banner '3.")),   # --proof: report-grade proof in the injection-point style - forces the boolean technique (so a multi-technique point still proves), and actively reads a value out as the strongest proof
+        ("-u <base> --mine-params --flush-session --technique=B", ("mining for hidden GET parameters", "found hidden parameter 'id'", "held back parameter(s) that break the base request", "Parameter: id (GET)", "Type: boolean-based blind")),   # --mine-params: discover an injectable parameter absent from a bare URL, hold back the raw-SQL sink that would shadow it, then confirm the injection on the mined 'id'
+        ("-u \"<base>ratelimit?id=1\" --flush-session --technique=B", ("target appears to be rate-limiting", "Parameter: id (GET)", "Type: boolean-based blind")),   # adaptive rate-limit handling: the endpoint answers 429 with 'Retry-After' first, so detection only succeeds if sqlmap honors the backoff, throttles, and retries rather than treating 429 as a hard block
         ("-r <request> --flush-session -v 5 --test-skip=\"heavy\" --save=<config>", ("CloudFlare", "web application technology: Express", "possible DBMS: 'SQLite'", "User-Agent: foobar", "~Type: time-based blind", "saved command line options to the configuration file")),
         ("-c <config>", ("CloudFlare", "possible DBMS: 'SQLite'", "User-Agent: foobar", "~Type: time-based blind")),
         ("-l <log> --flush-session --skip-waf -vvvvv --technique=U --union-from=users --banner --parse-errors", ("banner: '3.", "ORDER BY term out of range", "~xp_cmdshell", "Connection: keep-alive")),

diff --git a/lib/parse/cmdline.py b/lib/parse/cmdline.py
@@ -721,6 +721,9 @@ def cmdLineParser(argv=None):
         general.add_argument("--forms", dest="forms", action="store_true",
             help="Parse and test forms on target URL")
 
+        general.add_argument("--mine-params", dest="mineParams", action="store_true",
+            help="Mine for hidden (unlinked) GET parameters to test")
+
         general.add_argument("--fresh-queries", dest="freshQueries", action="store_true",
             help="Ignore query results stored in session file")