CPD Results
The following document contains the results of PMD's CPD 7.7.0.
Duplications
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 59 |
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 60 |
nameTable, bodyExploit.replace("'", "''"), nameTable, pathExploit + nameExploit ), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { String result = this.injectionModel.getResourceAccess().callCommand( urlSuccess +"?c="+ ResourceAccess.WEB_CONFIRM_CMD ); if (!result.contains(ResourceAccess.WEB_CONFIRM_RESULT)) { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Exploit body not found"); return StringUtils.EMPTY; } var request = new Request(); request.setMessage(Interaction.ADD_TAB_EXPLOIT_WEB); request.setParameters(urlSuccess); this.injectionModel.sendToViews(request); return urlSuccess; }; return this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public void createUpload(String pathExploit, String urlExploit, File fileToUpload) { String bodyExploit = StringUtil.base64Decode( this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_UPL) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); var nameExploit = RandomStringUtils.secure().nextAlphabetic(8) +".php"; this.injectionModel.injectWithoutIndex(String.format( this.modelYaml.getFile().getWrite(), nameTable, nameTable, bodyExploit.replace("'", "''"), |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 94 |
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 94 |
nameTable, bodyExploit.replace("'", "''"), nameTable, pathExploit + nameExploit ), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { try (InputStream streamToUpload = new FileInputStream(fileToUpload)) { HttpResponse<String> result = this.injectionModel.getResourceAccess().upload(fileToUpload, urlSuccess, streamToUpload); if (result.body().contains(DataAccess.LEAD +"y")) { LOGGER.log(LogLevelUtil.CONSOLE_SUCCESS, ResourceAccess.UPLOAD_SUCCESSFUL, pathExploit, fileToUpload.getName()); } else { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.UPLOAD_FAILURE, pathExploit, fileToUpload.getName()); } } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } catch (IOException | JSqlException e) { throw new JSqlRuntimeException(e); } return urlSuccess; }; this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public String getRead(String pathFile) throws AbstractSlidingException { LOGGER.log(LogLevelUtil.CONSOLE_INFORM, CallableFile.REQUIRE_STACK); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); this.injectionModel.injectWithoutIndex(String.format( this.injectionModel.getResourceAccess().getExploitDerby().getModelYaml().getFile().getCreateTable(), |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 97 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 128 |
), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { try (InputStream streamToUpload = new FileInputStream(fileToUpload)) { HttpResponse<String> result = this.injectionModel.getResourceAccess().upload(fileToUpload, urlSuccess, streamToUpload); if (result.body().contains(DataAccess.LEAD +"y")) { LOGGER.log(LogLevelUtil.CONSOLE_SUCCESS, ResourceAccess.UPLOAD_SUCCESSFUL, pathExploit, fileToUpload.getName()); } else { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.UPLOAD_FAILURE, pathExploit, fileToUpload.getName()); } } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } catch (IOException | JSqlException e) { throw new JSqlRuntimeException(e); } return urlSuccess; }; this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public String getRead(String pathFile) throws AbstractSlidingException { LOGGER.log(LogLevelUtil.CONSOLE_INFORM, CallableFile.REQUIRE_STACK); |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitH2.java | 138 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 128 |
), ResourceAccess.TBL_DUMP); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { try (InputStream streamToUpload = new FileInputStream(fileToUpload)) { HttpResponse<String> result = this.injectionModel.getResourceAccess().upload(fileToUpload, urlSuccess, streamToUpload); if (result.body().contains(DataAccess.LEAD +"y")) { LOGGER.log(LogLevelUtil.CONSOLE_SUCCESS, ResourceAccess.UPLOAD_SUCCESSFUL, pathExploit, fileToUpload.getName()); } else { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.UPLOAD_FAILURE, pathExploit, fileToUpload.getName()); } } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } catch (IOException | JSqlException e) { throw new JSqlRuntimeException(e); } return urlSuccess; }; this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public String getRead(String pathFile) throws AbstractSlidingException { |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 62 |
com/jsql/model/accessible/vendor/ExploitH2.java | 100 |
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 62 |
), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { String result = this.injectionModel.getResourceAccess().callCommand( urlSuccess +"?c="+ ResourceAccess.WEB_CONFIRM_CMD ); if (!result.contains(ResourceAccess.WEB_CONFIRM_RESULT)) { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Exploit body not found"); return StringUtils.EMPTY; } var request = new Request(); request.setMessage(Interaction.ADD_TAB_EXPLOIT_WEB); request.setParameters(urlSuccess); this.injectionModel.sendToViews(request); return urlSuccess; }; return this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public void createUpload(String pathExploit, String urlExploit, File fileToUpload) { String bodyExploit = StringUtil.base64Decode( this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_UPL) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); |
File | Line |
---|---|
com/jsql/util/bruter/Base16.java | 62 |
com/jsql/util/bruter/Base16.java | 85 |
private static final byte[] UPPER_CASE_DECODE_TABLE = { // 0 1 2 3 4 5 6 7 8 9 A B C D E F -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 00-0f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 10-1f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 20-2f 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, -1, -1, -1, -1, -1, -1, // 30-3f 0-9 -1, 10, 11, 12, 13, 14, 15 // 40-46 A-F |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 97 |
com/jsql/model/accessible/vendor/ExploitH2.java | 138 |
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 96 |
com/jsql/model/accessible/vendor/ExploitPostgres.java | 511 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 128 |
), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { try (InputStream streamToUpload = new FileInputStream(fileToUpload)) { HttpResponse<String> result = this.injectionModel.getResourceAccess().upload(fileToUpload, urlSuccess, streamToUpload); if (result.body().contains(DataAccess.LEAD +"y")) { LOGGER.log(LogLevelUtil.CONSOLE_SUCCESS, ResourceAccess.UPLOAD_SUCCESSFUL, pathExploit, fileToUpload.getName()); } else { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.UPLOAD_FAILURE, pathExploit, fileToUpload.getName()); } } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } catch (IOException | JSqlException e) { throw new JSqlRuntimeException(e); } return urlSuccess; }; this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public String getRead(String pathFile) throws AbstractSlidingException { |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitH2.java | 100 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 93 |
), ResourceAccess.TBL_DUMP); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { String result = this.injectionModel.getResourceAccess().callCommand( urlSuccess +"?c="+ ResourceAccess.WEB_CONFIRM_CMD ); if (!result.contains(ResourceAccess.WEB_CONFIRM_RESULT)) { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Exploit body not found"); return StringUtils.EMPTY; } var request = new Request(); request.setMessage(Interaction.ADD_TAB_EXPLOIT_WEB); request.setParameters(urlSuccess); this.injectionModel.sendToViews(request); return urlSuccess; }; return this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public void createUpload(String pathExploit, String urlExploit, File fileToUpload) { String bodyExploit = StringUtil.base64Decode( this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_UPL) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); |
File | Line |
---|---|
com/jsql/model/injection/strategy/StrategyBlindBin.java | 44 |
com/jsql/model/injection/strategy/StrategyBlindBit.java | 44 |
com/jsql/model/injection/strategy/StrategyTime.java | 44 |
this.injectionModel.getMediatorVendor().getVendor().instance().getModelYaml().getStrategy().getBinary().getTest().getBin() )) { LOGGER.log( LogLevelUtil.CONSOLE_INFORM, AbstractStrategy.FORMAT_STRATEGY_NOT_IMPLEMENTED, this.getName(), this.injectionModel.getMediatorVendor().getVendor() ); return; } this.checkInjection(BlindOperator.OR); this.checkInjection(BlindOperator.AND); this.checkInjection(BlindOperator.STACK); this.checkInjection(BlindOperator.NO_MODE); if (this.isApplicable) { this.allow(); var requestMessageBinary = new Request(); requestMessageBinary.setMessage(Interaction.MESSAGE_BINARY); requestMessageBinary.setParameters(this.injection.getInfoMessage()); this.injectionModel.sendToViews(requestMessageBinary); } else { this.unallow(); } } private void checkInjection(BlindOperator blindOperator) throws StoppedByUserSlidingException { if (this.isApplicable) { return; } LOGGER.log( LogLevelUtil.CONSOLE_DEFAULT, "{} [{}] with [{}]...", () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_CHECKING_STRATEGY), this::getName, () -> blindOperator ); this.injection = new InjectionBlindBin(this.injectionModel, blindOperator); |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 62 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 93 |
), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { String result = this.injectionModel.getResourceAccess().callCommand( urlSuccess +"?c="+ ResourceAccess.WEB_CONFIRM_CMD ); if (!result.contains(ResourceAccess.WEB_CONFIRM_RESULT)) { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Exploit body not found"); return StringUtils.EMPTY; } var request = new Request(); request.setMessage(Interaction.ADD_TAB_EXPLOIT_WEB); request.setParameters(urlSuccess); this.injectionModel.sendToViews(request); return urlSuccess; }; return this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public void createUpload(String pathExploit, String urlExploit, File fileToUpload) { String bodyExploit = StringUtil.base64Decode( this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_UPL) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); |
File | Line |
---|---|
com/jsql/model/injection/strategy/StrategyBlindBin.java | 82 |
com/jsql/model/injection/strategy/StrategyBlindBit.java | 82 |
this.injection = new InjectionBlindBin(this.injectionModel, blindOperator); this.isApplicable = this.injection.isInjectable(); if (this.isApplicable) { LOGGER.log( LogLevelUtil.CONSOLE_SUCCESS, "{} [{}] injection with [{}]", () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_VULNERABLE), this::getName, () -> blindOperator ); } } @Override public void allow(int... i) { this.injectionModel.appendAnalysisReport( StringUtil.formatReport(LogLevelUtil.COLOR_BLU, "### Strategy: " + this.getName()) + this.injectionModel.getReportWithoutIndex( this.injectionModel.getMediatorVendor().getVendor().instance().sqlTestBlindWithOperator( this.injectionModel.getMediatorVendor().getVendor().instance().sqlBlind(StringUtil.formatReport(LogLevelUtil.COLOR_GREEN, "<query>"), "0", true), this.injection.getBlindOperator() ), "metadataInjectionProcess", null ) ); this.markVulnerability(Interaction.MARK_BLIND_BIN_VULNERABLE); |
File | Line |
---|---|
com/jsql/model/injection/strategy/blind/InjectionCharInsertion.java | 95 |
com/jsql/model/injection/strategy/blind/InjectionVendor.java | 70 |
List<Future<CallableCharInsertion>> listTagTrue = taskExecutor.invokeAll(listCallableTagTrue); this.injectionModel.getMediatorUtils().getThreadUtil().shutdown(taskExecutor); for (var i = 1 ; i < listTagTrue.size() ; i++) { if (this.injectionModel.isStoppedByUser()) { return; } if (this.constantTrueMark.isEmpty()) { this.constantTrueMark = listTagTrue.get(i).get().getOpcodes(); } else { this.constantTrueMark.retainAll(listTagTrue.get(i).get().getOpcodes()); } } } catch (ExecutionException e) { LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e); } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } this.initFalseMarks(); |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitPostgres.java | 409 |
com/jsql/model/accessible/vendor/ExploitPostgres.java | 468 |
this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_WEB) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var loid = this.injectionModel.getResourceAccess().getResultWithCatch(String.format( this.modelYaml.getFile().getWrite().getLargeObject().getFromText(), bodyExploit.replace("'", "\"") ), ResourceAccess.ADD_LOID); if (StringUtils.isEmpty(loid)) { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.LOID_NOT_FOUND); return StringUtils.EMPTY; } var nameExploit = RandomStringUtils.secure().nextAlphabetic(8) +".php"; this.injectionModel.getResourceAccess().getResultWithCatch(String.format( this.modelYaml.getFile().getWrite().getLargeObject().getToFile(), loid, pathExploit + nameExploit ), ResourceAccess.WRITE_LOID); |
File | Line |
---|---|
com/jsql/model/injection/strategy/blind/InjectionBlindBin.java | 81 |
com/jsql/model/injection/strategy/blind/InjectionBlindBit.java | 75 |
for (Future<CallableBlindBin> futureFalsy: futuresFalsys) { if (this.injectionModel.isStoppedByUser()) { return; } if (this.falseDiffs.isEmpty()) { this.falseDiffs = futureFalsy.get().getDiffsWithReference(); // Init diffs } else { this.falseDiffs.retainAll(futureFalsy.get().getDiffsWithReference()); // Clean un-matching diffs } } } catch (ExecutionException e) { LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e); } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } if (this.injectionModel.isStoppedByUser()) { return; } this.cleanTrueDiffs(injectionModel, blindOperator); } private void cleanTrueDiffs(InjectionModel injectionModel, BlindOperator blindOperator) { ExecutorService taskExecutor = this.injectionModel.getMediatorUtils().getThreadUtil().getExecutor("CallableGetBlindBinTagTrue"); |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 99 |
com/jsql/model/accessible/vendor/ExploitMysql.java | 102 |
com/jsql/model/accessible/vendor/ExploitPostgres.java | 513 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 130 |
BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { try (InputStream streamToUpload = new FileInputStream(fileToUpload)) { HttpResponse<String> result = this.injectionModel.getResourceAccess().upload(fileToUpload, urlSuccess, streamToUpload); if (result.body().contains(DataAccess.LEAD +"y")) { LOGGER.log(LogLevelUtil.CONSOLE_SUCCESS, ResourceAccess.UPLOAD_SUCCESSFUL, pathExploit, fileToUpload.getName()); } else { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.UPLOAD_FAILURE, pathExploit, fileToUpload.getName()); } } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } catch (IOException | JSqlException e) { throw new JSqlRuntimeException(e); } return urlSuccess; }; this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitH2.java | 140 |
com/jsql/model/accessible/vendor/ExploitMysql.java | 102 |
BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { try (InputStream streamToUpload = new FileInputStream(fileToUpload)) { HttpResponse<String> result = this.injectionModel.getResourceAccess().upload(fileToUpload, urlSuccess, streamToUpload); if (result.body().contains(DataAccess.LEAD +"y")) { LOGGER.log(LogLevelUtil.CONSOLE_SUCCESS, ResourceAccess.UPLOAD_SUCCESSFUL, pathExploit, fileToUpload.getName()); } else { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.UPLOAD_FAILURE, pathExploit, fileToUpload.getName()); } } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } catch (IOException | JSqlException e) { throw new JSqlRuntimeException(e); } return urlSuccess; }; this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 98 |
com/jsql/model/accessible/vendor/ExploitMysql.java | 102 |
BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { try (InputStream streamToUpload = new FileInputStream(fileToUpload)) { HttpResponse<String> result = this.injectionModel.getResourceAccess().upload(fileToUpload, urlSuccess, streamToUpload); if (result.body().contains(DataAccess.LEAD +"y")) { LOGGER.log(LogLevelUtil.CONSOLE_SUCCESS, ResourceAccess.UPLOAD_SUCCESSFUL, pathExploit, fileToUpload.getName()); } else { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, ResourceAccess.UPLOAD_FAILURE, pathExploit, fileToUpload.getName()); } } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } catch (IOException | JSqlException e) { throw new JSqlRuntimeException(e); } return urlSuccess; }; this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); |
File | Line |
---|---|
com/jsql/model/injection/strategy/StrategyBlindBin.java | 113 |
com/jsql/model/injection/strategy/StrategyBlindBit.java | 113 |
this.markVulnerability(Interaction.MARK_BLIND_BIN_INVULNERABLE); } @Override public String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) throws StoppedByUserSlidingException { return this.injection.inject( this.injectionModel.getMediatorVendor().getVendor().instance().sqlBlind(sqlQuery, startPosition, false), stoppable ); } @Override public void activateWhenApplicable() { if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) { LOGGER.log( LogLevelUtil.CONSOLE_INFORM, "{} [{}] with [{}]", () -> I18nUtil.valueByKey("LOG_USING_STRATEGY"), this::getName, () -> this.injection.getBlindOperator().name() ); this.injectionModel.getMediatorStrategy().setStrategy(this); var request = new Request(); request.setMessage(Interaction.MARK_BLIND_BIN_STRATEGY); |
File | Line |
---|---|
com/jsql/util/bruter/Base16.java | 64 |
com/jsql/util/bruter/Base16.java | 87 |
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 00-0f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 10-1f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 20-2f |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitH2.java | 84 |
com/jsql/model/accessible/vendor/ExploitH2.java | 122 |
this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_WEB) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); this.injectionModel.injectWithoutIndex(String.format( this.modelYaml.getRce().getCreateTable(), nameTable, nameTable, bodyExploit.replace("'", "\"") ), ResourceAccess.TBL_CREATE); var nameExploit = RandomStringUtils.secure().nextAlphabetic(8) +".php"; this.injectionModel.injectWithoutIndex(String.format( this.modelYaml.getRce().getScriptSimple(), pathExploit + nameExploit, nameTable ), ResourceAccess.TBL_DUMP); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 41 |
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 42 |
ModelYamlDerby.class ); } public String createWeb(String pathExploit, String urlExploit) { LOGGER.log(LogLevelUtil.CONSOLE_DEFAULT, "RCE Web target requirements: stack query, web+db on same machine, jdbc bridge"); String bodyExploit = StringUtil.base64Decode( this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_WEB) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); var nameExploit = RandomStringUtils.secure().nextAlphabetic(8) +".php"; this.injectionModel.injectWithoutIndex(String.format( this.modelYaml.getFile().getWrite(), nameTable, nameTable, bodyExploit.replace("'", "''"), |
File | Line |
---|---|
com/jsql/model/injection/strategy/blind/InjectionBlindBin.java | 124 |
com/jsql/model/injection/strategy/blind/InjectionBlindBit.java | 117 |
for (Future<CallableBlindBin> futureTruthy: futuresTruthys) { if (this.injectionModel.isStoppedByUser()) { return; } if (this.trueDiffs.isEmpty()) { this.trueDiffs = futureTruthy.get().getDiffsWithReference(); // Init diffs } else { this.trueDiffs.retainAll(futureTruthy.get().getDiffsWithReference()); // Clean un-matching diffs } this.falseDiffs.removeAll(futureTruthy.get().getDiffsWithReference()); } } catch (ExecutionException e) { LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e); } catch (InterruptedException e) { LOGGER.log(LogLevelUtil.IGNORE, e, e); Thread.currentThread().interrupt(); } } @Override public CallableBlindBin getCallableBitTest(String sqlQuery, int indexChar, int bit) { |
File | Line |
---|---|
com/jsql/model/injection/strategy/blind/InjectionCharInsertion.java | 173 |
com/jsql/model/injection/strategy/blind/InjectionVendor.java | 137 |
); try { blindTest.call(); } catch (Exception e) { LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e); } return blindTest.isTrue() && !this.constantTrueMark.isEmpty(); } public String callUrl(String urlString, String metadataInjectionProcess) { return this.injectionModel.injectWithoutIndex(urlString, metadataInjectionProcess); } public String callUrl(String urlString, String metadataInjectionProcess, AbstractCallableBit<?> callableBoolean) { return this.injectionModel.injectWithoutIndex(urlString, metadataInjectionProcess, callableBoolean); } // Getter public String getBlankFalseMark() { return this.blankFalseMark; } public List<Diff> getConstantTrueMark() { return this.constantTrueMark; } } |
File | Line |
---|---|
com/jsql/util/bruter/Base16.java | 64 |
com/jsql/util/bruter/Base16.java | 90 |
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 00-0f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 10-1f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 20-2f |
File | Line |
---|---|
com/jsql/util/bruter/Base16.java | 87 |
com/jsql/util/bruter/Base16.java | 90 |
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 00-0f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 10-1f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 20-2f |
File | Line |
---|---|
com/jsql/util/bruter/Base16.java | 64 |
com/jsql/util/bruter/Base16.java | 90 |
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 00-0f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 10-1f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 20-2f |
File | Line |
---|---|
com/jsql/util/bruter/Base16.java | 87 |
com/jsql/util/bruter/Base16.java | 90 |
-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 00-0f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 10-1f -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, // 20-2f |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 62 |
com/jsql/model/accessible/vendor/ExploitPostgres.java | 427 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 93 |
), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { String result = this.injectionModel.getResourceAccess().callCommand( urlSuccess +"?c="+ ResourceAccess.WEB_CONFIRM_CMD ); if (!result.contains(ResourceAccess.WEB_CONFIRM_RESULT)) { LOGGER.log(LogLevelUtil.CONSOLE_ERROR, "Exploit body not found"); return StringUtils.EMPTY; } var request = new Request(); request.setMessage(Interaction.ADD_TAB_EXPLOIT_WEB); request.setParameters(urlSuccess); this.injectionModel.sendToViews(request); return urlSuccess; }; return this.injectionModel.getResourceAccess().checkUrls(urlExploit, nameExploit, biFuncGetRequest); } public void createUpload(String pathExploit, String urlExploit, File fileToUpload) { |
File | Line |
---|---|
com/jsql/model/injection/strategy/StrategyBlindBin.java | 82 |
com/jsql/model/injection/strategy/StrategyTime.java | 82 |
this.injection = new InjectionBlindBin(this.injectionModel, blindOperator); this.isApplicable = this.injection.isInjectable(); if (this.isApplicable) { LOGGER.log( LogLevelUtil.CONSOLE_SUCCESS, "{} [{}] injection with [{}]", () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_VULNERABLE), this::getName, () -> blindOperator ); } } @Override public void allow(int... i) { this.injectionModel.appendAnalysisReport( StringUtil.formatReport(LogLevelUtil.COLOR_BLU, "### Strategy: " + this.getName()) + this.injectionModel.getReportWithoutIndex( this.injectionModel.getMediatorVendor().getVendor().instance().sqlTestBlindWithOperator( |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitDerby.java | 49 |
com/jsql/model/accessible/vendor/ExploitDerby.java | 84 |
this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_WEB) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); var nameExploit = RandomStringUtils.secure().nextAlphabetic(8) +".php"; this.injectionModel.injectWithoutIndex(String.format( this.modelYaml.getFile().getWrite(), nameTable, nameTable, bodyExploit.replace("'", "''"), nameTable, pathExploit + nameExploit ), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 50 |
com/jsql/model/accessible/vendor/ExploitHsqldb.java | 84 |
this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty(ResourceAccess.EXPLOIT_DOT_WEB) ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameTable = RandomStringUtils.secure().nextAlphabetic(8); var nameExploit = RandomStringUtils.secure().nextAlphabetic(8) +".php"; this.injectionModel.injectWithoutIndex(String.format( this.modelYaml.getFile().getWrite(), nameTable, nameTable, bodyExploit.replace("'", "\""), nameTable, pathExploit + nameExploit ), ResourceAccess.TBL_CREATE); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitSqlite.java | 81 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 116 |
this.injectionModel.getMediatorUtils().getPropertiesUtil().getProperty("exploit.web") ) .replace(DataAccess.SHELL_LEAD, DataAccess.LEAD) .replace(DataAccess.SHELL_TRAIL, DataAccess.TRAIL); var nameDbRandom = RandomStringUtils.secure().nextAlphabetic(8); var nameTableRandom = RandomStringUtils.secure().nextAlphabetic(8); var nameExploit = nameDbRandom + nameTableRandom +".php"; this.injectionModel.injectWithoutIndex(String.format( this.modelYaml.getWriteFile(), pathExploit + nameExploit, nameDbRandom, nameDbRandom, nameTableRandom, nameDbRandom, nameTableRandom, bodyExploit ), ResourceAccess.TBL_DUMP); BinaryOperator<String> biFuncGetRequest = (String pathExploitFixed, String urlSuccess) -> { |
File | Line |
---|---|
com/jsql/model/injection/strategy/StrategyBlindBin.java | 119 |
com/jsql/model/injection/strategy/StrategyTime.java | 119 |
this.injectionModel.getMediatorVendor().getVendor().instance().sqlBlind(sqlQuery, startPosition, false), stoppable ); } @Override public void activateWhenApplicable() { if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) { LOGGER.log( LogLevelUtil.CONSOLE_INFORM, "{} [{}] with [{}]", () -> I18nUtil.valueByKey("LOG_USING_STRATEGY"), this::getName, () -> this.injection.getBlindOperator().name() ); this.injectionModel.getMediatorStrategy().setStrategy(this); var request = new Request(); request.setMessage(Interaction.MARK_BLIND_BIN_STRATEGY); |
File | Line |
---|---|
com/jsql/model/injection/strategy/StrategyBlindBit.java | 119 |
com/jsql/model/injection/strategy/StrategyTime.java | 119 |
this.injectionModel.getMediatorVendor().getVendor().instance().sqlBlind(sqlQuery, startPosition, false), stoppable ); } @Override public void activateWhenApplicable() { if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) { LOGGER.log( LogLevelUtil.CONSOLE_INFORM, "{} [{}] with [{}]", () -> I18nUtil.valueByKey("LOG_USING_STRATEGY"), this::getName, () -> this.injection.getBlindOperator().name() ); this.injectionModel.getMediatorStrategy().setStrategy(this); var request = new Request(); request.setMessage(Interaction.MARK_BLIND_BIT_STRATEGY); |
File | Line |
---|---|
com/jsql/model/accessible/vendor/ExploitH2.java | 67 |
com/jsql/model/accessible/vendor/ExploitSqlite.java | 64 |
this.modelYaml.getRce().getRunCmd(), command.replace(StringUtils.SPACE, "%20") ), ResourceAccess.RUN_FUNC); } catch (JSqlException e) { result = String.format(ResourceAccess.TEMPLATE_ERROR, e.getMessage(), command); } var request = new Request(); request.setMessage(Interaction.GET_TERMINAL_RESULT); request.setParameters(uuidShell, result.trim() +"\n"); // missing newline on some extensions this.injectionModel.sendToViews(request); return result; } public String createWeb(String pathExploit, String urlExploit) { LOGGER.log(LogLevelUtil.CONSOLE_DEFAULT, "RCE Web target requirements: stack query, web+db on same machine, jdbc bridge"); |
File | Line |
---|---|
com/jsql/model/injection/strategy/blind/callable/CallableBlindBin.java | 65 |
com/jsql/model/injection/strategy/blind/callable/CallableBlindBit.java | 53 |
} /** * Check if a result page means the SQL query is true, * confirm that nothing in the resulting page is also defined * in the pages from every FALSE SQL queries. * @return true if the current SQL query is true */ @Override public boolean isTrue() { // Fix #95426: ConcurrentModificationException on iterator.next() List<Diff> falseDiffs = new CopyOnWriteArrayList<>(this.injectionBlind.getFalseDiffs()); for (Diff falseDiff: falseDiffs) { // ignored when false OR false => falsy empty // Fix #4386: NullPointerException on contains(), diffsWithReference initialized to new LinkedList<>() if (this.diffsWithReference.contains(falseDiff)) { return false; } } List<Diff> trueDiffs = new CopyOnWriteArrayList<>(this.injectionBlind.getTrueDiffs()); for (Diff trueDiff: trueDiffs) { if (!this.diffsWithReference.contains(trueDiff)) { // required, set to false when empty falseDiffs return false; } } return true; // not in falseDiffs and in trueDiffs } /** * Process the URL HTTP call, use function inject() from the model. * Build the list of differences found between TRUE and the current page. * @return Functional Blind Callable */ @Override public CallableBlindBin call() { |