DuckDuckGo Dork Issue

[greenchili]

sqlmap version: 1.3.1.50#dev

After specifying a Dork while using Tor, Google usually rejects the request as expected. Selecting Bing as an alternative works but DuckDuckGo is broken. It only ever brings back 1 URL with the value of "http://www.google.com/search?q=".

[15:41:25] [CRITICAL] Google has detected 'unusual' traffic from used IP address disabling further searches
no usable links found. What do you want to do?
[1] (re)try with DuckDuckGo (default)
[2] (re)try with Bing
[3] quit
> 1
[15:41:35] [INFO] sqlmap got 1 results for your search dork expression, all of them are testable targets
URL 1:
GET http://www.google.com/search?q=
do you want to test this URL? [Y/n/q]

[greenchili]

In /lib/utils/search.php where it builds the url variable(line 125):

        else:
            url = "https://duckduckgo.com/d.js?"
            url += "q=%s&p=%d&s=100" % (urlencode(dork, convall=True), gpage)
            regex = DUCKDUCKGO_REGEX

If you print out the url variable and test:
It prints as :
https://duckduckgo.com/d.js?q=php%2Fevent.php%3Fid%3D&p=1&s=100
But if you then go to this URL it ends up as:
https://duckduckgo.com/506-01.js?q=php%2Fevent.php%3Fid%3D
With the following output in a browser:

if(DDG.deep){DDG.deep.is506=1;DDG.deep.bn={ivc:0,ibc:1};}var q=window.location.href.indexOf('?q');if (q!=-1) q=window.location.href.replace(/^[^\?]+\?q=\??/,''); else {q=window.location.href.replace(/^http:\/\/[^\/]+\/?/,'');q=q.replace(/\_/g,' ');};q=q.replace(/\&.*$/,'');var dnd0=[{"c":"http://www.google.com/search?q="+q,"u":"http://www.google.com/search?q="+q,"a":"","d":"google.com search","t":"EOF","i":"www.google.com"}];if (nrn) nrn('d',dnd0);

Maybe they have recently changed their URL format.

[greenchili]

I got this working by changing DUCKDUCKGO_REGEX in /lib/core/settings.py:

# Regular expression used for extracting results from DuckDuckGo search
#DUCKDUCKGO_REGEX = r'"u":"([^"]+)'
DUCKDUCKGO_REGEX = r'<a class="result__url" href="/l/\?kh=-1&uddg=([^"]+)"'

And then in /lib/utils/search.py(line 126):

url = "https://duckduckgo.com/html/?q=%s" % (urlencode(dork, convall=True))

[stamparm]

Thank you for your report. It seems that they're making automation harder. Original URL is the default one used by the search web page, though, they've included additional token value vqd to prevent tools like sqlmap to use it in automated manner.

Now, as you've noticed, there is also option for https://duckduckgo.com/html/?q=, though, it seems a little stripped version of the previous one. I've made a "patch", will push it in a second. Please check the functionality at your side as I've used completely different DUCKDUCKGO_REGEX <- I haven't found usage of ...result__url" href="/l/... inside DuckDuckGo responses at my side

[greenchili]

Thanks, that is working as expected now.