Fixes #6080

Author: stamparm

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.50"
+VERSION = "1.10.7.51"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

lib/request/redirecthandler.py

@@ -82,14 +82,20 @@ def http_error_302(self, req, fp, code, msg, headers):
         redurl = self._get_header_redirect(headers) if not conf.ignoreRedirects else None
 
         try:
-            content = fp.fp.read(MAX_CONNECTION_TOTAL_SIZE)
-            fp.fp = io.BytesIO(content)
+            # Note: drain via the length-aware response (honors Content-Length/chunked), NOT the raw
+            # socket 'fp.fp' - the latter has no HTTP framing, so on a Keep-Alive connection (no EOF)
+            # it blocks for the whole '--timeout' on every redirect (Issue #6080)
+            content = fp.read(MAX_CONNECTION_TOTAL_SIZE)
         except _http_client.IncompleteRead as ex:
             content = ex.partial
-            fp.fp = io.BytesIO(content)
         except:
             content = b""
 
+        # back 'fp' with the captured body so it stays re-readable downstream (Issue #5985); the
+        # length-aware read above has consumed the response, so restore both the buffer and read()
+        fp.fp = io.BytesIO(content)
+        fp.read = fp.fp.read
+
         content = decodePage(content, headers.get(HTTP_HEADER.CONTENT_ENCODING), headers.get(HTTP_HEADER.CONTENT_TYPE))
 
         threadData = getCurrentThreadData()