SQLTruncScanner.py

#
# BurpSQLTruncationScanner - Scan for potential SQL truncation attack vectors.
#
# Copyright (c) 2020 Frans Hendrik Botes (InitRoot)
# Verions 0.1
#
from burp import IBurpExtender, IScannerCheck, IScanIssue, ITab, IBurpExtenderCallbacks, IExtensionHelpers, IContextMenuFactory, IContextMenuInvocation, IHttpRequestResponse
from java.io import PrintWriter
from java.net import URL
from java.util import ArrayList, List
from java.util.regex import Matcher, Pattern
import binascii
from javax import swing
from java.awt import Font, Color
import sys
import time
import threading
import base64
import re
from array import array

import json

#Global Issue List
issueList = ArrayList()

class BurpExtender(IBurpExtender, IScannerCheck, IContextMenuFactory, IHttpRequestResponse, IBurpExtenderCallbacks):
 def registerExtenderCallbacks(self, callbacks):
 sys.stdout = callbacks.getStdout()
 self._callbacks = callbacks
 self._helpers = callbacks.getHelpers()
 callbacks.setExtensionName("SQLTruncScanner")
 callbacks.issueAlert("SQL Truncation Scanner Enabled")
 stdout = PrintWriter(callbacks.getStdout(), True)
 stderr = PrintWriter(callbacks.getStderr(), True)
 callbacks.registerContextMenuFactory(self) 
 print ("SQL Truncation Scanner loaded.")
 print ("Copyright (c) 2020 Frans Hendrik Botes (InitRoot)")
 self.httpTraffic = None
 self.resp = None
 
 #Set Parameters for Original Reqquest to Restruct
 self.orgHost = None
 self.orgPort = None
 self.orgProtoChoice = None
 self.orgHeaders = None
 self.orgParams = None
 self.orgMethod = None
 self.orgURLPath = None
 self.orgContType = None
 self.orgBaseline = None

 #Create context menu entry
 def createMenuItems(self, invocation):
 self.context = invocation

 itemContext = invocation.getSelectedMessages()

 if itemContext > 0:
 menuList = ArrayList()
 menuItem = swing.JMenuItem(
 "Scan with SQLTruncScanner", None, actionPerformed=self.start_scan)
 menuList.add(menuItem)
 return menuList
 return None

# We are ready to start a scan for the specific request 
 def start_scan(self, event): 
 try:
 #For later use lets get what user selected.
 #Let's get what the user selected, only compatible with one item at a time. ADD check for multiple items and throw error
 scanIssues = self._callbacks.getScanIssues(None)
 httpTraffic = self.context.getSelectedMessages()
 print (len(httpTraffic))
 httpRequest = [item.request.tostring()
 for item in httpTraffic]
 orignalRequest = ''.join(httpRequest)
 #Rebuild the request and fetch response to calculate baseline value
 self.buildRequest(orignalRequest, httpTraffic)
 #We have the baseline, time to start fuzzing
 paramFuzzer = fuzzParams(httpTraffic, self._helpers, self._callbacks)
 thread = threading.Thread(target=paramFuzzer.fuzzParams(self.orgHost, self.orgPort, self.orgProtoChoice,
 self.orgHeaders, self.orgParams, self.orgMethod, self.orgURLPath, self.orgContType, self.orgBaseline), args=())
 thread.daemon = True
 thread.start()
 print (str(len(issueList)))
 
 # issue = ScanIssue(httpTraffic[0], self._helpers)
 #self._callbacks.addScanIssue(issue)
 #paramFuzzer.fuzzParams(self.orgHost,self.orgPort,self.orgProtoChoice,self.orgHeaders,self.orgParams,self.orgMethod,self.orgURLPath,self.orgContType,self.orgBaseline)
 
 
 except UnicodeEncodeError:
 print("Error in URL decode.")
 return None

 def buildRequest(self, strRequest, httpTraffMsg):
 stdout = PrintWriter(self._callbacks.getStdout(), True)
 strorignalRequest = strRequest
 
 #Get data about the request that was right clicked
 for item in httpTraffMsg:
 try:

 httpService = item.getHttpService()
 self.httpTraffic = httpService
 host = httpService.host
 port = httpService.port
 protocol = httpService.protocol
 protoChoice = True if protocol.lower() == 'https' else False
 #Parse the text area that should contain an HTTP request.
 requestInfo = self._helpers.analyzeRequest(strorignalRequest)
 #Request data
 headers = requestInfo.getHeaders()
 bodyOffset = requestInfo.bodyOffset
 body = strorignalRequest[bodyOffset:]

 for (i, header) in enumerate(headers):
 if header.lower().startswith("content-type:"):
 content_type = header.split(":")[1].lower().strip()

 method = headers[0].split(" ")[0]
 urlpath = headers[0].split(" ")[1]

 #Debugging area for output and parsing
 #stdout.println(str(body))
 #stdout.println(str(headers))
 #stdout.println(str(method))
 #stdout.println(str(content_type))
 #stdout.println(str(urlpath))

 #Identify and parse parameters in the request
 if method == "GET":
 stdout.println("[!] GET REQUEST IDENTIFIED")
 body = urlpath.split("?")[1]
 #print(body)
 params = dict(x.split('=') for x in body.split('&'))

 else:
 #Add logic here for the handling parameters in body and JSON content
 if "json" in str(content_type) or "JSON" in str(content_type):
 stdout.println("[!] JSON REQUEST IDENTIFIED")
 #print(body)
 #print("[!] BODY DONE")
 params = json.loads(body)
 #print(body)
 #print(params)

 else:
 stdout.println("[!] POST REQUEST IDENTIFIED")
 #print(body)
 params = dict(x.split('=') for x in body.split('&'))
 #print(params)

 stdout.println("[!] PARAMETERS IDENTIFIED!")
 stdout.println(params)
 stdout.println("[!] DETERMINING BASELINE")
 baselineInt = self.baseline(host, port, protoChoice, headers, params, method, urlpath, content_type)
 #Assign Parameters for Fuzzing
 self.orgHost = host
 self.orgPort = port
 self.orgProtoChoice = protoChoice
 self.orgHeaders = headers
 self.orgParams = params
 self.orgMethod = method
 self.orgURLPath = urlpath
 self.orgContType = content_type
 self.orgBaseline = baselineInt
 except Exception as ex:
 stdout.println("Problem parsing the request data" + "\n")
 stdout.println(ex)

 return 

 def consolidateDuplicateIssues(self, existingIssue, newIssue):
 if (existingIssue.getIssueName() == newIssue.getIssueName()):
 return -1
 else:
 return 0

 def extensionUnloaded(self):
 print "SQL Truncation Scanner unloaded"
 return

 def postRequest(self, headers, body, args_):
 #Needed: args=[host,port,protoChoice,request]
 stdout = PrintWriter(self._callbacks.getStdout(), True)
 request = self._helpers.buildHttpMessage(headers, body)
 args_.append(request)
 t = threading.Thread(target=self.makeRequest, args=args_)
 t.daemon = True
 t.start()
 t.join()

 def makeRequest(self, host, port, protoChoice, request):
 stdout = PrintWriter(self._callbacks.getStdout(), True)
 try:
 self.resp = self._callbacks.makeHttpRequest(
 host,
 port,
 protoChoice,
 request
 )

 except Exception as ex:
 stdout.println(ex)

 def baseline(self, host, port, protoChoice, headers, body, method, urlpath, content_type):
 if "json" not in content_type.lower():
 new_body = ""
 new_body += '&'.join("%s=%s" % (key, str(val)) for (key, val) in body.iteritems())
 #print(new_body)
 
 if method == "GET":
 url1 = urlpath.split("?")[0]
 url2 = "?" + str(new_body)
 headers[0] = "GET " + str(url1) + str(url2) + " HTTP/1.1"
 self.getRequest(headers, [host, port, protoChoice])
 else:
 self.postRequest(headers, new_body, [host, port, protoChoice])

 #Here we take the lengh and status code of the body returned as a baseline
 originalReq = self._helpers.analyzeRequest(self.resp)
 reqResponse = self._helpers.analyzeResponse(self.resp)
 reqRespTxt = self.resp.tostring()
 respStatusCode = reqResponse.getStatusCode()
 resbodyOffset = reqResponse.getBodyOffset()
 respbodyLen = len(reqRespTxt[resbodyOffset:])
 baselineData = str(respStatusCode) + str(respbodyLen)
 print(baselineData)
 return baselineData


class fuzzParams():

 def __init__(self, reqres, helpers, callbacks):
 self.helpers = helpers
 self.reqres = reqres
 self.callbacks = callbacks
 
 def postRequest(self, headers, body, args_):
 #Needed: args=[host,port,protoChoice,request]
 stdout = PrintWriter(self.callbacks.getStdout(), True)
 request = self.helpers.buildHttpMessage(headers, body)
 args_.append(request)
 t = threading.Thread(target=self.makeRequest, args=args_)
 t.daemon = True
 t.start()
 t.join()

 def makeRequest(self, host, port, protoChoice, request):
 stdout = PrintWriter(self.callbacks.getStdout(), True)
 try:
 self.resp = self.callbacks.makeHttpRequest(
 host,
 port,
 protoChoice,
 request
 )

 except Exception as ex:
 stdout.println(ex)

 def fuzzParams(self, host, port, protoChoice, headers, body, method, urlpath, content_type, baseline):
 stdout = PrintWriter(self.callbacks.getStdout(), True)
 stdout.println("[!] FUZZING "+ str(len(body)) + " PARAMETERS")
 issueList.clear()
 payloadSet = {"5": ' 00', "10": ' 00', "15": ' 00', "20": ' 00', "30": ' 00', "40": ' 00'}
 #Let's loop through each parameter
 for param in body:
 stdout.println(" [-] FUZZING: " + str(param)) 
 fuzzParameter = str(param)
 for payLSD in payloadSet:
 stdout.println(" [-] PAYLOAD: " + payLSD)
 payload = payloadSet[payLSD]
 bodd = body
 bodd[fuzzParameter] = bodd[fuzzParameter] + payload
 if "json" not in content_type.lower():
 new_body = ""
 new_body += '&'.join("%s=%s" % (key, str(val))
 for (key, val) in bodd.iteritems())
 #print(" " + new_body)
 if method == "GET":
 url1 = urlpath.split("?")[0]
 url2 = "?" + str(new_body)
 headers[0] = "GET " + str(url1) + str(url2) + " HTTP/1.1"
 self.getRequest(headers, [host, port, protoChoice])
 else:
 self.postRequest(headers, new_body, [host, port, protoChoice])
 #Here we take the lengh and status code of the body returned as a baseline
 reqFuzzResponse = self.helpers.analyzeResponse(self.resp)
 reqFuzzReq = self.helpers.analyzeRequest(self.resp)
 reqFuzzRespTxt = self.resp.tostring()
 respFuzzStatusCode = reqFuzzResponse.getStatusCode()
 resFuzzbodyOffset = reqFuzzResponse.getBodyOffset()
 respFuzzbodyLen = len(reqFuzzRespTxt[resFuzzbodyOffset:])
 fuzzResponseData = str(respFuzzStatusCode) + str(respFuzzbodyLen) 
 print(" " + fuzzResponseData)
 if fuzzResponseData != baseline:
 stdout.println(" [+] POSSIBLE INJECTION DETECTED")
 issue = ScanIssue(
 self.reqres[0], reqFuzzReq, "SQL Truncation Scanner", fuzzParameter + " | " + payLSD, "High")
 self.callbacks.addScanIssue(issue)

 return

## Implement the IScanIssue interface
class ScanIssue(IScanIssue):
 def __init__(self, httpService, httpMessages, name, detail, severity):
 self._httpService = httpService
 self._httpMessages = httpMessages
 self._name = name
 self._detail = detail + '<br/><br/><div style="font-size:8px">'\
 'This issue was reported by SQL '\
 'Truncation Scanner</div>'
 self._severity = severity

 def getUrl(self):
 return self._httpService.getUrl()

 def getIssueName(self):
 return self._name

 def getIssueType(self):
 return 0x08000000 # See http:#portswigger.net/burp/help/scanner_issuetypes.html

 def getSeverity(self):
 return self._severity

 def getConfidence(self):
 return "Certain"

 def getIssueBackground(self):
 return ("SQL Truncation can occur with mySQL databases whenever the parameter received exceeds the column length in the database. The scanner initiates a baseline scan which is then compared to a fuzzing scanner for each parameter. Each time the length of overflow is extented up until 40 characters.")

 def getRemediationBackground(self):
 pass

 def getIssueDetail(self):
 return self._detail

 def getRemediationDetail(self):
 pass

 def getHttpMessages(self):
 #print ("................raising issue................")
 rra = [self._httpService]
 return rra

 def getHttpService(self):
 return self._httpService.getHttpService()