Skip to content

Commit ad01aa7

Browse files
stamparmstamparm
committed
Further integration of identYwaf
1 parent 0c79504 commit ad01aa7

File tree

7 files changed

+36
-50
lines changed

7 files changed

+36
-50
lines changed

‎lib/controller/checks.py‎

Lines changed: 15 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,6 @@
108108
from lib.techniques.union.test import unionTest
109109
from lib.techniques.union.use import configUnion
110110
from thirdparty import six
111-
from thirdparty.identywaf import identYwaf
112111
from thirdparty.six.moves import http_client as _http_client
113112

114113
def checkSqlInjection(place, parameter, value):
@@ -1403,49 +1402,22 @@ def checkWaf():
14031402
kb.resendPostOnRedirect = popValue()
14041403
kb.redirectChoice = popValue()
14051404

1406-
# TODO: today
14071405
if retVal:
1408-
pass
1409-
# identYwaf
1410-
#if conf.timeout == defaults.timeout:
1411-
#logger.warning("dropping timeout to %d seconds (i.e. '--timeout=%d')" % (IDS_WAF_CHECK_TIMEOUT, IDS_WAF_CHECK_TIMEOUT))
1412-
#conf.timeout = IDS_WAF_CHECK_TIMEOUT
1413-
1414-
# identYwaf
1415-
1416-
#def _(*args, **kwargs):
1417-
#page, headers, code = None, None, None
1418-
#try:
1419-
#pushValue(kb.redirectChoice)
1420-
#pushValue(kb.resendPostOnRedirect)
1421-
1422-
#kb.redirectChoice = REDIRECTION.YES
1423-
#kb.resendPostOnRedirect = True
1424-
1425-
#if kwargs.get("get"):
1426-
#kwargs["get"] = urlencode(kwargs["get"])
1427-
#kwargs["raise404"] = False
1428-
#kwargs["silent"] = True
1429-
#kwargs["finalCode"] = True
1430-
1431-
#page, headers, code = Request.getPage(*args, **kwargs)
1432-
#except Exception:
1433-
#pass
1434-
#finally:
1435-
#kb.resendPostOnRedirect = popValue()
1436-
#kb.redirectChoice = popValue()
1437-
1438-
1439-
#message = "are you sure that you want to "
1440-
#message += "continue with further target testing? [y/N] "
1441-
#choice = readInput(message, default='N', boolean=True)
1442-
1443-
#if not conf.tamper:
1444-
#warnMsg = "please consider usage of tamper scripts (option '--tamper')"
1445-
#singleTimeWarnMessage(warnMsg)
1446-
1447-
#if not choice:
1448-
#raise SqlmapUserQuitException
1406+
if not kb.identifiedWafs:
1407+
warnMsg = "heuristics detected that the target "
1408+
warnMsg += "is protected by some kind of WAF/IPS"
1409+
logger.critical(warnMsg)
1410+
1411+
message = "are you sure that you want to "
1412+
message += "continue with further target testing? [y/N] "
1413+
choice = readInput(message, default='N', boolean=True)
1414+
1415+
if not conf.tamper:
1416+
warnMsg = "please consider usage of tamper scripts (option '--tamper')"
1417+
singleTimeWarnMessage(warnMsg)
1418+
1419+
if not choice:
1420+
raise SqlmapUserQuitException
14491421

14501422
hashDBWrite(HASHDB_KEYS.CHECK_WAF_RESULT, retVal, True)
14511423

‎lib/core/dicts.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,7 @@
290290
"--purge-output": "use '--purge' instead",
291291
"--check-payload": None,
292292
"--check-waf": None,
293+
"--identify-waf": None,
293294
"--pickled-options": "use '--api -c ...' instead",
294295
}
295296

‎lib/core/option.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1890,6 +1890,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
18901890
kb.ignoreCasted = None
18911891
kb.ignoreNotFound = False
18921892
kb.ignoreTimeout = False
1893+
kb.identifiedWafs = set()
18931894
kb.injection = InjectionDict()
18941895
kb.injections = []
18951896
kb.laggingChecked = False
@@ -1970,7 +1971,6 @@ def _setKnowledgeBaseAttributes(flushAll=True):
19701971
kb.tableExistsChoice = None
19711972
kb.uChar = NULL
19721973
kb.unionDuplicates = False
1973-
kb.wafSpecificResponse = None
19741974
kb.wizardMode = False
19751975
kb.xpCmdshellAvailable = False
19761976

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
from thirdparty.six import unichr as _unichr
1919

2020
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
21-
VERSION = "1.3.5.131"
21+
VERSION = "1.3.5.132"
2222
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2323
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2424
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/request/basic.py‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,10 @@
5151
from lib.utils.htmlentities import htmlEntities
5252
from thirdparty import six
5353
from thirdparty.chardet import detect
54+
from thirdparty.identywaf import identYwaf
5455
from thirdparty.odict import OrderedDict
5556
from thirdparty.six import unichr as _unichr
57+
from thirdparty.six.moves import http_client as _http_client
5658

5759
def forgeHeaders(items=None, base=None):
5860
"""
@@ -365,7 +367,7 @@ def _(match):
365367

366368
return page
367369

368-
def processResponse(page, responseHeaders, status=None):
370+
def processResponse(page, responseHeaders, code=None, status=None):
369371
kb.processResponseCounter += 1
370372

371373
page = page or ""
@@ -383,6 +385,16 @@ def processResponse(page, responseHeaders, status=None):
383385
if msg:
384386
logger.warning("parsed DBMS error message: '%s'" % msg.rstrip('.'))
385387

388+
rawResponse = "%s %s %s\n%s\n%s" % (_http_client.HTTPConnection._http_vsn_str, code or "", status or "", "".join(responseHeaders.headers), page)
389+
390+
identYwaf.non_blind.clear()
391+
if identYwaf.non_blind_check(rawResponse, silent=True):
392+
for waf in identYwaf.non_blind:
393+
if waf not in kb.identifiedWafs:
394+
kb.identifiedWafs.add(waf)
395+
errMsg = "WAF/IPS identified as '%s'" % identYwaf.format_name(waf)
396+
singleTimeLogMessage(errMsg, logging.CRITICAL)
397+
386398
if kb.originalPage is None:
387399
for regex in (EVENTVALIDATION_REGEX, VIEWSTATE_REGEX):
388400
match = re.search(regex, page)

‎lib/request/connect.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -795,7 +795,7 @@ class _(dict):
795795

796796
socket.setdefaulttimeout(conf.timeout)
797797

798-
processResponse(page, responseHeaders, status)
798+
processResponse(page, responseHeaders, code, status)
799799

800800
if not skipLogTraffic:
801801
if conn and getattr(conn, "redurl", None):

‎thirdparty/identywaf/identYwaf.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
sys.stdout = codecs.getwriter(locale.getpreferredencoding())(sys.stdout)
6767

6868
NAME = "identYwaf"
69-
VERSION = "1.0.108"
69+
VERSION = "1.0.110"
7070
BANNER = """
7171
` __ __ `
7272
____ ___ ___ ____ ______ `| T T` __ __ ____ _____
@@ -396,7 +396,7 @@ def init():
396396
def format_name(waf):
397397
return "%s%s" % (DATA_JSON["wafs"][waf]["name"], (" (%s)" % DATA_JSON["wafs"][waf]["company"]) if DATA_JSON["wafs"][waf]["name"] != DATA_JSON["wafs"][waf]["company"] else "")
398398

399-
def non_blind_check(raw):
399+
def non_blind_check(raw, silent=False):
400400
retval = False
401401
match = re.search(WAF_RECOGNITION_REGEX, raw or "")
402402
if match:
@@ -405,7 +405,8 @@ def non_blind_check(raw):
405405
if match.group(_):
406406
waf = re.sub(r"\Awaf_", "", _)
407407
non_blind.add(waf)
408-
single_print(colorize("[+] non-blind match: '%s'%s" % (format_name(waf), 20 * ' ')))
408+
if not silent:
409+
single_print(colorize("[+] non-blind match: '%s'%s" % (format_name(waf), 20 * ' ')))
409410
return retval
410411

411412
def run():

0 commit comments

Comments
 (0)