Class: Watobo::Modules::Active::Sqlinjection::Sql_boolean
- Inherits:
-
ActiveCheck
- Object
- Session
- ActiveCheck
- Watobo::Modules::Active::Sqlinjection::Sql_boolean
- Defined in:
- modules/active/sqlinjection/sql_boolean.rb
Constant Summary
Constants included from Constants
Constants::AC_GROUP_APACHE, Constants::AC_GROUP_DOMINO, Constants::AC_GROUP_ENUMERATION, Constants::AC_GROUP_FILE_INCLUSION, Constants::AC_GROUP_FLASH, Constants::AC_GROUP_GENERIC, Constants::AC_GROUP_JBOSS, Constants::AC_GROUP_JOOMLA, Constants::AC_GROUP_SAP, Constants::AC_GROUP_SQL, Constants::AC_GROUP_TYPO3, Constants::AC_GROUP_XSS, Constants::AUTH_TYPE_BASIC, Constants::AUTH_TYPE_DIGEST, Constants::AUTH_TYPE_NONE, Constants::AUTH_TYPE_NTLM, Constants::AUTH_TYPE_UNKNOWN, Constants::CHAT_SOURCE_AUTO_SCAN, Constants::CHAT_SOURCE_FUZZER, Constants::CHAT_SOURCE_INTERCEPT, Constants::CHAT_SOURCE_MANUAL, Constants::CHAT_SOURCE_MANUAL_SCAN, Constants::CHAT_SOURCE_PROXY, Constants::CHAT_SOURCE_UNDEF, Constants::DEFAULT_PORT_HTTP, Constants::DEFAULT_PORT_HTTPS, Constants::FINDING_TYPE_HINT, Constants::FINDING_TYPE_INFO, Constants::FINDING_TYPE_UNDEFINED, Constants::FINDING_TYPE_VULN, Constants::FIRST_TIME_FILE, Constants::GUI_REGULAR_FONT_SIZE, Constants::GUI_SMALL_FONT_SIZE, Constants::ICON_PATH, Constants::LOG_DEBUG, Constants::LOG_INFO, Constants::SCAN_CANCELED, Constants::SCAN_FINISHED, Constants::SCAN_PAUSED, Constants::SCAN_STARTED, Constants::TE_CHUNKED, Constants::TE_COMPRESS, Constants::TE_DEFLATE, Constants::TE_GZIP, Constants::TE_IDENTITY, Constants::TE_NONE, Constants::VULN_RATING_CRITICAL, Constants::VULN_RATING_HIGH, Constants::VULN_RATING_INFO, Constants::VULN_RATING_LOW, Constants::VULN_RATING_MEDIUM, Constants::VULN_RATING_UNDEFINED
Instance Method Summary collapse
- #generateChecks(chat) ⇒ Object
-
#initialize(project, prefs = {}) ⇒ Sql_boolean
constructor
A new instance of Sql_boolean.
Methods included from CheckInfoMixin::InfoMethods
Constructor Details
#initialize(project, prefs = {}) ⇒ Sql_boolean
Returns a new instance of Sql_boolean.
66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 |
# File 'modules/active/sqlinjection/sql_boolean.rb', line 66 def initialize(project, prefs={}) super(project, prefs) @boolean_checks = [ [ '\'--', '\''], [ ' or 1=1', ' and 1=2'], [ '\' or \'1\'=\'1', '\' and \'1\'=\'2'], [ '\') or \'1\'=\'1\'(\'', '\') and \'1\'=\'2\'(\'' ], [ '\')) or \'1\'=\'1\'((\'', '\')) and \'1\'=\'2\'((\'' ], [ '\'))) or \'1\'=\'1\'(((\'', '\'))) and \'1\'=\'2\'(((\'' ], [ ') or \'1\'=\'1\'(', ') and \'1\'=\'2\'(' ], [ ')) or \'1\'=\'1\'((', ')) and \'1\'=\'2\'((' ], [ '))) or \'1\'=\'1\'(((', '))) and \'1\'=\'2\'(((' ], [ ' and 1=1', ' and 1=2'], [ '\' and \'1\'=\'1', '\' and \'1\'=\'2'], [ '\') and \'1\'=\'1\'(\'', '\') and \'1\'=\'2\'(\'' ], [ '\')) and \'1\'=\'1\'((\'', '\')) and \'1\'=\'2\'((\'' ], [ '\'))) and \'1\'=\'1\'(((\'', '\'))) and \'1\'=\'2\'(((\'' ], [ ') and \'1\'=\'1\'(', ') and \'1\'=\'2\'(' ], [ ')) and \'1\'=\'1\'((', ')) and \'1\'=\'2\'((' ], [ '))) and \'1\'=\'1\'(((', '))) and \'1\'=\'2\'(((' ], ] @prefs = [ '', '%'] @fins = [ '', '--', ';--'] end |
Instance Method Details
#generateChecks(chat) ⇒ Object
94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 |
# File 'modules/active/sqlinjection/sql_boolean.rb', line 94 def generateChecks(chat) # # Check GET-Parameters # begin chat.request.parameters(:url, :wwwform, :xml) do |param| checks = [] @prefs.each do |p| @fins.each do |f| @boolean_checks.each do |c| checks << [ p + c[0] + f, p + c[1] +f ] end end end checks.each do |check_true, check_false| checker = proc { begin check_t = CGI::escape(check_true) check_f = CGI::escape(check_false) test_request = nil test_response = nil orig_value = "#{param.value}" # first do request double time to check if hashes are the same test = chat.request.copy test_request,test_response = doRequest(test, :default => true) text_1, hash_1 = Watobo::Utils.smartHash(chat.request, test_request, test_response) test_request,test_response = doRequest(test, :default => true) text_2, hash_2 = Watobo::Utils.smartHash(chat.request, test_request, test_response) #puts "=== SQL BOOLEAN (#{parm}) ====" #puts "=TEXT_1 (#{parm})\r\n#{text_1}\r\n=HASH_1\r\n#{hash_1}" if parm =~ /button/ #puts "=TEXT_2 (#{parm})\r\n#{text_2}\r\n=HASH_2\r\n#{hash_2}" if parm =~ /button/ if hash_1 == hash_2 then val = "#{orig_value}" # val << "AB" if val.empty? val << check_t param.value = val test.set param true_request,true_response = doRequest(test, :default => true) text_true, hash_true = Watobo::Utils.smartHash(chat.request, true_request, true_response) val = "#{orig_value}" val = (1..8).inject(""){|x,v| x << rand(16).to_s(16) } if val.empty? val.reverse! val += check_t param.value = val test.set param random_request,random_response = doRequest(test, :default => true) text_random, hash_random = Watobo::Utils.smartHash(chat.request, random_request, random_response) val = "#{orig_value}" val += check_f param.value = val test.set param false_request,false_response = doRequest(test, :default => true) text_false, hash_false = Watobo::Utils.smartHash(chat.request, false_request, false_response) unless (hash_true == hash_false) and (hash_true == hash_random) then val = "#{orig_value}" val += check_t param.value = val test.set param test_request,test_response = doRequest(test, :default => true) text_true, hash_true = Watobo::Utils.smartHash(chat.request, test_request, test_response) if hash_true == hash_1 or hash_false == hash_1 or hash_true == hash_random or hash_false == hash_random then path = "/" + test_request.path # test_chat = Chat.new(test,test_response,chat.id) # puts "MATCH !!! #{self.to_s.gsub(/.*::/,'')}" addFinding(test_request,test_response, :test_item => param.name, :check_pattern => "#{param.name}", :chat => chat, :title => "[#{param.name}] - #{path}", :debug => true ) end else #puts "\n! Boolean check not possible on chat #{chat.id}. URL parmeter #{parm} is imune :(" #puts "--- Hashes are equal!" #puts text_true #puts "---" #puts text_false #puts "---" #puts text_random #puts "===" end else puts "\n! Boolean check not possible on chat #{chat.id}. Response differs too much :(" if $DEBUG end rescue => bang puts bang raise end [ test_request, test_response ] } yield checker end end rescue => bang puts bang end end |