| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
1 parent b35122a commit 4cb378c
38 files changed
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -736,7 +736,7 @@ def singleTimeLogMessage(message, level=logging.INFO, flag=None): | |||
| 736 | 736 | if flag is None: | |
| 737 | 737 | flag = hash(message) | |
| 738 | 738 | ||
| 739 | - if flag not in kb.singleLogFlags: | ||
| 739 | + if not conf.smokeTest and flag not in kb.singleLogFlags: | ||
| 740 | 740 | kb.singleLogFlags.add(flag) | |
| 741 | 741 | logger.log(level, message) | |
| 742 | 742 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -41,8 +41,9 @@ | |||
| 41 | 41 | ||
| 42 | 42 | def smokeTest(): | |
| 43 | 43 | """ | |
| 44 | - This will run the basic smoke testing of a program | ||
| 44 | + Runs the basic smoke testing of a program | ||
| 45 | 45 | """ | |
| 46 | + | ||
| 46 | 47 | retVal = True | |
| 47 | 48 | count, length = 0, 0 | |
| 48 | 49 | ||
@@ -106,8 +107,9 @@ def adjustValueType(tagName, value): | |||
| 106 | 107 | ||
| 107 | 108 | def liveTest(): | |
| 108 | 109 | """ | |
| 109 | - This will run the test of a program against the live testing environment | ||
| 110 | + Runs the test of a program against the live testing environment | ||
| 110 | 111 | """ | |
| 112 | + | ||
| 111 | 113 | global failedItem | |
| 112 | 114 | global failedParseOn | |
| 113 | 115 | global failedTraceBack | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -16,15 +16,14 @@ def tamper(payload, **kwargs): | |||
| 16 | 16 | """ | |
| 17 | 17 | Replaces apostrophe character with its UTF-8 full width counterpart | |
| 18 | 18 | ||
| 19 | - Example: | ||
| 20 | - * Input: AND '1'='1' | ||
| 21 | - * Output: AND %EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87 | ||
| 22 | - | ||
| 23 | 19 | References: | |
| 24 | 20 | * http://www.utf8-chartable.de/unicode-utf8-table.pl?start=65280&number=128 | |
| 25 | 21 | * http://lukasz.pilorz.net/testy/unicode_conversion/ | |
| 26 | 22 | * http://sla.ckers.org/forum/read.php?13,11562,11850 | |
| 27 | 23 | * http://lukasz.pilorz.net/testy/full_width_utf/index.phps | |
| 24 | + | ||
| 25 | + >>> tamper("1 AND '1'='1") | ||
| 26 | + '1 AND %EF%BC%871%EF%BC%87=%EF%BC%871' | ||
| 28 | 27 | """ | |
| 29 | 28 | ||
| 30 | 29 | return payload.replace('\'', "%EF%BC%87") if payload else payload | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -16,9 +16,8 @@ def tamper(payload, **kwargs): | |||
| 16 | 16 | """ | |
| 17 | 17 | Replaces apostrophe character with its illegal double unicode counterpart | |
| 18 | 18 | ||
| 19 | - Example: | ||
| 20 | - * Input: AND '1'='1' | ||
| 21 | - * Output: AND %00%271%00%27=%00%271%00%27 | ||
| 19 | + >>> tamper("1 AND '1'='1") | ||
| 20 | + '1 AND %00%271%00%27=%00%271' | ||
| 22 | 21 | """ | |
| 23 | 22 | ||
| 24 | 23 | return payload.replace('\'', "%00%27") if payload else payload | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -16,10 +16,6 @@ def tamper(payload, **kwargs): | |||
| 16 | 16 | """ | |
| 17 | 17 | Appends encoded NULL byte character at the end of payload | |
| 18 | 18 | ||
| 19 | - Example: | ||
| 20 | - * Input: AND 1=1 | ||
| 21 | - * Output: AND 1=1%00 | ||
| 22 | - | ||
| 23 | 19 | Requirement: | |
| 24 | 20 | * Microsoft Access | |
| 25 | 21 | ||
@@ -29,6 +25,9 @@ def tamper(payload, **kwargs): | |||
| 29 | 25 | also possible | |
| 30 | 26 | ||
| 31 | 27 | Reference: http://projects.webappsec.org/w/page/13246949/Null-Byte-Injection | |
| 28 | + | ||
| 29 | + >>> tamper('1 AND 1=1') | ||
| 30 | + '1 AND 1=1%00' | ||
| 32 | 31 | """ | |
| 33 | 32 | ||
| 34 | 33 | return "%s%%00" % payload if payload else payload | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -18,9 +18,8 @@ def tamper(payload, **kwargs): | |||
| 18 | 18 | """ | |
| 19 | 19 | Base64 all characters in a given payload | |
| 20 | 20 | ||
| 21 | - Example: | ||
| 22 | - * Input: 1' AND SLEEP(5)# | ||
| 23 | - * Output: MScgQU5EIFNMRUVQKDUpIw== | ||
| 21 | + >>> tamper("1' AND SLEEP(5)#") | ||
| 22 | + 'MScgQU5EIFNMRUVQKDUpIw==' | ||
| 24 | 23 | """ | |
| 25 | 24 | ||
| 26 | 25 | return base64.b64encode(payload) if payload else payload | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -18,10 +18,6 @@ def tamper(payload, **kwargs): | |||
| 18 | 18 | """ | |
| 19 | 19 | Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' | |
| 20 | 20 | ||
| 21 | - Example: | ||
| 22 | - * Input: 'A > B' | ||
| 23 | - * Output: 'A NOT BETWEEN 0 AND B' | ||
| 24 | - | ||
| 25 | 21 | Tested against: | |
| 26 | 22 | * Microsoft SQL Server 2005 | |
| 27 | 23 | * MySQL 4, 5.0 and 5.5 | |
@@ -33,6 +29,9 @@ def tamper(payload, **kwargs): | |||
| 33 | 29 | filter the greater than character | |
| 34 | 30 | * The BETWEEN clause is SQL standard. Hence, this tamper script | |
| 35 | 31 | should work against all (?) databases | |
| 32 | + | ||
| 33 | + >>> tamper('1 AND A > B--') | ||
| 34 | + '1 AND A NOT BETWEEN 0 AND B--' | ||
| 36 | 35 | """ | |
| 37 | 36 | ||
| 38 | 37 | retVal = payload | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -19,10 +19,6 @@ def tamper(payload, **kwargs): | |||
| 19 | 19 | Replaces space character after SQL statement with a valid random blank character. | |
| 20 | 20 | Afterwards replace character = with LIKE operator | |
| 21 | 21 | ||
| 22 | - Example: | ||
| 23 | - * Input: SELECT id FROM users where id = 1 | ||
| 24 | - * Output: SELECT%09id FROM users where id LIKE 1 | ||
| 25 | - | ||
| 26 | 22 | Requirement: | |
| 27 | 23 | * Blue Coat SGOS with WAF activated as documented in | |
| 28 | 24 | https://kb.bluecoat.com/index?page=content&id=FAQ2147 | |
@@ -32,12 +28,15 @@ def tamper(payload, **kwargs): | |||
| 32 | 28 | ||
| 33 | 29 | Notes: | |
| 34 | 30 | * Useful to bypass Blue Coat's recommended WAF rule configuration | |
| 31 | + | ||
| 32 | + >>> tamper('SELECT id FROM users where id = 1') | ||
| 33 | + 'SELECT%09id FROM users where id LIKE 1' | ||
| 35 | 34 | """ | |
| 36 | 35 | ||
| 37 | 36 | retVal = payload | |
| 38 | 37 | ||
| 39 | 38 | if payload: | |
| 40 | - retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)\s+", r"\g<1>\t", payload) | ||
| 39 | + retVal = re.sub(r"(?i)(SELECT|UPDATE|INSERT|DELETE)\s+", r"\g<1>%09", payload) | ||
| 41 | 40 | retVal = re.sub(r"\s*=\s*", " LIKE ", retVal) | |
| 42 | 41 | ||
| 43 | 42 | return retVal | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -19,14 +19,13 @@ def tamper(payload, **kwargs): | |||
| 19 | 19 | Double url-encodes all characters in a given payload (not processing | |
| 20 | 20 | already encoded) | |
| 21 | 21 | ||
| 22 | - Example: | ||
| 23 | - * Input: SELECT FIELD FROM%20TABLE | ||
| 24 | - * Output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545 | ||
| 25 | - | ||
| 26 | 22 | Notes: | |
| 27 | 23 | * Useful to bypass some weak web application firewalls that do not | |
| 28 | 24 | double url-decode the request before processing it through their | |
| 29 | 25 | ruleset | |
| 26 | + | ||
| 27 | + >>> tamper('SELECT FIELD FROM%20TABLE') | ||
| 28 | + '%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545' | ||
| 30 | 29 | """ | |
| 31 | 30 | ||
| 32 | 31 | retVal = payload | |
@@ -37,7 +36,7 @@ def tamper(payload, **kwargs): | |||
| 37 | 36 | ||
| 38 | 37 | while i < len(payload): | |
| 39 | 38 | if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: | |
| 40 | - retVal += payload[i:i + 3] | ||
| 39 | + retVal += '%%25%s' % payload[i + 1:i + 3] | ||
| 41 | 40 | i += 3 | |
| 42 | 41 | else: | |
| 43 | 42 | retVal += '%%25%.2X' % ord(payload[i]) | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -19,10 +19,6 @@ def tamper(payload, **kwargs): | |||
| 19 | 19 | Url-encodes all characters in a given payload (not processing already | |
| 20 | 20 | encoded) | |
| 21 | 21 | ||
| 22 | - Example: | ||
| 23 | - * Input: SELECT FIELD FROM%20TABLE | ||
| 24 | - * Output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45 | ||
| 25 | - | ||
| 26 | 22 | Tested against: | |
| 27 | 23 | * Microsoft SQL Server 2005 | |
| 28 | 24 | * MySQL 4, 5.0 and 5.5 | |
@@ -34,6 +30,9 @@ def tamper(payload, **kwargs): | |||
| 34 | 30 | url-decode the request before processing it through their ruleset | |
| 35 | 31 | * The web server will anyway pass the url-decoded version behind, | |
| 36 | 32 | hence it should work against any DBMS | |
| 33 | + | ||
| 34 | + >>> tamper('SELECT FIELD FROM%20TABLE') | ||
| 35 | + '%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45' | ||
| 37 | 36 | """ | |
| 38 | 37 | ||
| 39 | 38 | retVal = payload | |
| Back | FazBrowse Home | New Git URL |
0 commit comments