Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8e49872

Browse files
stamparmstamparm
committed
Finalizing implementation for an Issue #290 
1 parent 6a21292 commit 8e49872

22 files changed

Lines changed: 344 additions & 25 deletions

‎lib/controller/checks.py‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,13 +36,15 @@
3636
from lib.core.common import showStaticWords
3737
from lib.core.common import singleTimeLogMessage
3838
from lib.core.common import singleTimeWarnMessage
39+
from lib.core.common import urlencode
3940
from lib.core.common import wasLastResponseDBMSError
4041
from lib.core.common import wasLastResponseHTTPError
4142
from lib.core.data import conf
4243
from lib.core.data import kb
4344
from lib.core.data import logger
4445
from lib.core.datatype import AttribDict
4546
from lib.core.datatype import InjectionDict
47+
from lib.core.decorators import cachedmethod
4648
from lib.core.dicts import FROM_DUMMY_TABLE
4749
from lib.core.enums import DBMS
4850
from lib.core.enums import HEURISTIC_TEST
@@ -1045,15 +1047,26 @@ def identifyWaf():
10451047
infoMsg += "backend WAF/IPS/IDS protection"
10461048
logger.info(infoMsg)
10471049

1050+
@cachedmethod
1051+
def _(*args, **kwargs):
1052+
try:
1053+
if kwargs.get("get"):
1054+
kwargs["get"] = urlencode(kwargs["get"])
1055+
kwargs["raise404"] = False
1056+
return Request.getPage(*args, **kwargs)
1057+
except Exception, ex:
1058+
return None, None, None
1059+
10481060
retVal = False
1049-
page, headers, code = Request.getPage()
10501061

10511062
for function, product, request in kb.wafFunctions:
10521063
found = False
1064+
10531065
if not request:
1054-
found = function(page or "", headers or {}, code)
1066+
found = function(_)
10551067
else:
10561068
pass
1069+
10571070
if found:
10581071
retVal = product
10591072
break
@@ -1063,7 +1076,7 @@ def identifyWaf():
10631076
warnMsg += "consider usage of tamper scripts (option '--tamper')"
10641077
logger.critical(warnMsg)
10651078
else:
1066-
warnMsg = "no WAF/IDS/IPS were identified"
1079+
warnMsg = "WAF/IDS/IPS product not identified"
10671080
logger.warn(warnMsg)
10681081

10691082
return retVal

‎lib/core/enums.py‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -150,13 +150,9 @@ class HTTPHEADER:
150150
PROXY_CONNECTION = "Proxy-Connection"
151151
RANGE = "Range"
152152
REFERER = "Referer"
153+
SERVER = "Server"
153154
USER_AGENT = "User-Agent"
154155

155-
class WAF_REQUEST:
156-
GET = 1
157-
POST = 2
158-
HEADERS = 3
159-
160156
class EXPECTED:
161157
BOOL = "bool"
162158
INT = "int"

‎lib/core/option.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -905,6 +905,9 @@ def _setWafFunctions():
905905
dirname, filename = os.path.split(found)
906906
dirname = os.path.abspath(dirname)
907907

908+
if filename == "__init__.py":
909+
continue
910+
908911
debugMsg = "loading WAF script '%s'" % filename[:-3]
909912
logger.debug(debugMsg)
910913

‎lib/core/settings.py‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,15 @@
380380
BRUTE_COLUMN_EXISTS_TEMPLATE = "EXISTS(SELECT %s FROM %s)"
381381

382382
# Payload used for checking of existence of IDS/WAF (dummier the better)
383-
IDS_WAF_CHECK_PAYLOAD = "AND 1=1 UNION ALL SELECT 1,2,3,table_name FROM information_schema.tables"
383+
IDS_WAF_CHECK_PAYLOAD = "AND 1=1 UNION ALL SELECT 1,2,3,table_name FROM information_schema.tables WHERE 2>1"
384+
385+
# Vectors used for provoking specific WAF/IDS/IPS behavior(s)
386+
WAF_ATTACK_VECTORS = (
387+
"search=<script>alert(1)</script>",
388+
"file=../../../../etc/passwd",
389+
"q=<invalid>foobar",
390+
"id=1 %s" % IDS_WAF_CHECK_PAYLOAD
391+
)
384392

385393
# Used for status representation in dictionary attack phase
386394
ROTATING_CHARS = ('\\', '|', '|', '/', '-')

‎waf/__init__.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
5+
See the file 'doc/COPYING' for copying permission
6+
"""
7+
8+
pass

‎waf/airlock.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
5+
See the file 'doc/COPYING' for copying permission
6+
"""
7+
8+
import re
9+
10+
from lib.core.enums import HTTPHEADER
11+
12+
__product__ = "Airlock (Phion/Ergon)"
13+
14+
def detect(get_page):
15+
page, headers, code = get_page()
16+
return re.search(r"\AAL[_-]?(SESS|LB)=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None

‎waf/barracuda.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
5+
See the file 'doc/COPYING' for copying permission
6+
"""
7+
8+
import re
9+
10+
from lib.core.enums import HTTPHEADER
11+
12+
__product__ = "Barracuda Web Application Firewall (Barracuda Networks)"
13+
14+
def detect(get_page):
15+
page, headers, code = get_page()
16+
return re.search(r"\Abarra_counter_session=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None

‎waf/bigip.py‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
5+
See the file 'doc/COPYING' for copying permission
6+
"""
7+
8+
import re
9+
10+
from lib.core.enums import HTTPHEADER
11+
from lib.core.settings import WAF_ATTACK_VECTORS
12+
13+
__product__ = "BIG-IP Application Security Manager (F5 Networks)"
14+
15+
def detect(get_page):
16+
page, headers, code = get_page()
17+
retval = re.search(r"\ATS[a-zA-Z0-9]{3,6}=", headers.get(HTTPHEADER.SET_COOKIE, ""), re.I) is not None
18+
19+
if not retval:
20+
for vector in WAF_ATTACK_VECTORS:
21+
page, headers, code = get_page(get=vector)
22+
retval = headers.get("X-Cnection", "").lower() == "close"
23+
if retval:
24+
break
25+
26+
return retval

‎waf/binarysec.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
5+
See the file 'doc/COPYING' for copying permission
6+
"""
7+
8+
import re
9+
10+
from lib.core.enums import HTTPHEADER
11+
12+
__product__ = "BinarySEC Web Application Firewall (BinarySEC)"
13+
14+
def detect(get_page):
15+
page, headers, code = get_page()
16+
return re.search(r"BinarySec", headers.get(HTTPHEADER.SERVER, ""), re.I) is not None

‎waf/datapower.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
5+
See the file 'doc/COPYING' for copying permission
6+
"""
7+
8+
import re
9+
10+
__product__ = "IBM WebSphere DataPower (IBM)"
11+
12+
def detect(get_page):
13+
page, headers, code = get_page()
14+
return re.search(r"\A(OK|FAIL)", headers.get("X-Backside-Transport", ""), re.I) is not None

0 commit comments

Comments
 (0)