1 | package com.jsql.model.injection.strategy.blind; | |
2 | ||
3 | import com.jsql.model.InjectionModel; | |
4 | import com.jsql.model.exception.InjectionFailureException; | |
5 | import com.jsql.model.exception.StoppedByUserSlidingException; | |
6 | import com.jsql.model.injection.strategy.blind.callable.CallableBlindBin; | |
7 | import com.jsql.util.LogLevelUtil; | |
8 | import org.apache.commons.lang3.StringUtils; | |
9 | import org.apache.logging.log4j.LogManager; | |
10 | import org.apache.logging.log4j.Logger; | |
11 | ||
12 | import java.util.ArrayList; | |
13 | import java.util.Collection; | |
14 | import java.util.List; | |
15 | import java.util.concurrent.CompletionService; | |
16 | import java.util.concurrent.ExecutionException; | |
17 | import java.util.concurrent.ExecutorService; | |
18 | import java.util.concurrent.Future; | |
19 | import java.util.concurrent.atomic.AtomicInteger; | |
20 | ||
21 | import static name.fraser.neil.plaintext.diff_match_patch.Diff; | |
22 | import static name.fraser.neil.plaintext.diff_match_patch.Operation; | |
23 | ||
24 | /** | |
25 | * A blind attack class using concurrent threads. | |
26 | */ | |
27 | public class InjectionBlindBin extends AbstractInjectionMonobit<CallableBlindBin> { | |
28 | ||
29 | private static final Logger LOGGER = LogManager.getRootLogger(); | |
30 | private static final int LOW = 0; | |
31 | private static final int HIGH = 127; | |
32 | ||
33 | private String sourceReferencePage; // Source code of the TRUE web page (usually ?id=1) | |
34 | ||
35 | /** | |
36 | * List of string differences found in all the FALSE queries, compared | |
37 | * to the reference page. Each FALSE pages should contain | |
38 | * at least one same string, which shouldn't be present in all | |
39 | * the TRUE queries. | |
40 | */ | |
41 | private List<Diff> falseDiffs = new ArrayList<>(); | |
42 | private List<Diff> trueDiffs = new ArrayList<>(); | |
43 | ||
44 | /** | |
45 | * Create blind attack initialization. | |
46 | * If every false diffs are not in true diffs and every true diffs are in | |
47 | * true diffs, then Blind attack is confirmed. | |
48 | */ | |
49 | public InjectionBlindBin(InjectionModel injectionModel, BlindOperator blindOperator) { | |
50 | super(injectionModel, blindOperator); | |
51 | ||
52 | List<String> falsys = this.injectionModel.getMediatorVendor().getVendor().instance().getFalsyBin(); | |
53 |
2
1. <init> : negated conditional → NO_COVERAGE 2. <init> : negated conditional → NO_COVERAGE |
if (falsys.isEmpty() || this.injectionModel.isStoppedByUser()) { |
54 | return; | |
55 | } | |
56 | | |
57 | // Call the SQL request which must be TRUE (usually ?id=1) | |
58 | this.sourceReferencePage = this.callUrl(StringUtils.EMPTY, "bin#ref:"+ blindOperator.toString().toLowerCase()); | |
59 | ||
60 | // Concurrent calls to the FALSE statements, | |
61 | // it will use inject() from the model | |
62 | ExecutorService taskExecutor = this.injectionModel.getMediatorUtils().getThreadUtil().getExecutor("CallableGetBlindBinTagFalse"); | |
63 | Collection<CallableBlindBin> callablesFalsys = new ArrayList<>(); | |
64 | for (String falsy: falsys) { | |
65 | callablesFalsys.add(new CallableBlindBin( | |
66 | falsy, | |
67 | injectionModel, | |
68 | this, | |
69 | blindOperator, | |
70 | -1, -1, -1, | |
71 | "bin#falsy" | |
72 | )); | |
73 | } | |
74 | | |
75 | // Delete junk from the results of FALSE statements, | |
76 | // keep only diffs found in each and every FALSE pages. | |
77 | // Allow the user to stop the loop | |
78 | try { | |
79 | List<Future<CallableBlindBin>> futuresFalsys = taskExecutor.invokeAll(callablesFalsys); | |
80 |
1
1. <init> : removed call to com/jsql/util/ThreadUtil::shutdown → NO_COVERAGE |
this.injectionModel.getMediatorUtils().getThreadUtil().shutdown(taskExecutor); |
81 | for (Future<CallableBlindBin> futureFalsy: futuresFalsys) { | |
82 |
1
1. <init> : negated conditional → NO_COVERAGE |
if (this.injectionModel.isStoppedByUser()) { |
83 | return; | |
84 | } | |
85 |
1
1. <init> : negated conditional → NO_COVERAGE |
if (this.falseDiffs.isEmpty()) { |
86 | this.falseDiffs = futureFalsy.get().getDiffsWithReference(); // Init diffs | |
87 | } else { | |
88 | this.falseDiffs.retainAll(futureFalsy.get().getDiffsWithReference()); // Clean un-matching diffs | |
89 | } | |
90 | } | |
91 | } catch (ExecutionException e) { | |
92 | LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e); | |
93 | } catch (InterruptedException e) { | |
94 | LOGGER.log(LogLevelUtil.IGNORE, e, e); | |
95 |
1
1. <init> : removed call to java/lang/Thread::interrupt → NO_COVERAGE |
Thread.currentThread().interrupt(); |
96 | } | |
97 | ||
98 |
1
1. <init> : negated conditional → NO_COVERAGE |
if (this.injectionModel.isStoppedByUser()) { |
99 | return; | |
100 | } | |
101 | | |
102 |
1
1. <init> : removed call to com/jsql/model/injection/strategy/blind/InjectionBlindBin::cleanTrueDiffs → NO_COVERAGE |
this.cleanTrueDiffs(injectionModel, blindOperator); |
103 | } | |
104 | ||
105 | private void cleanTrueDiffs(InjectionModel injectionModel, BlindOperator blindOperator) { | |
106 | ExecutorService taskExecutor = this.injectionModel.getMediatorUtils().getThreadUtil().getExecutor("CallableGetBlindBinTagTrue"); | |
107 | Collection<CallableBlindBin> callablesTruthys = new ArrayList<>(); | |
108 | List<String> truthys = this.injectionModel.getMediatorVendor().getVendor().instance().getTruthyBin(); | |
109 | for (String truthy: truthys) { | |
110 | callablesTruthys.add(new CallableBlindBin( | |
111 | truthy, | |
112 | injectionModel, | |
113 | this, | |
114 | blindOperator, | |
115 | -1, -1, -1, | |
116 | "bin#truthy" | |
117 | )); | |
118 | } | |
119 | | |
120 | // Remove TRUE diffs in the FALSE diffs as FALSE statement shouldn't contain any TRUE diff. | |
121 | try { | |
122 | List<Future<CallableBlindBin>> futuresTruthys = taskExecutor.invokeAll(callablesTruthys); | |
123 |
1
1. cleanTrueDiffs : removed call to com/jsql/util/ThreadUtil::shutdown → NO_COVERAGE |
this.injectionModel.getMediatorUtils().getThreadUtil().shutdown(taskExecutor); |
124 | for (Future<CallableBlindBin> futureTruthy: futuresTruthys) { | |
125 |
1
1. cleanTrueDiffs : negated conditional → NO_COVERAGE |
if (this.injectionModel.isStoppedByUser()) { |
126 | return; | |
127 | } | |
128 |
1
1. cleanTrueDiffs : negated conditional → NO_COVERAGE |
if (this.trueDiffs.isEmpty()) { |
129 | this.trueDiffs = futureTruthy.get().getDiffsWithReference(); // Init diffs | |
130 | } else { | |
131 | this.trueDiffs.retainAll(futureTruthy.get().getDiffsWithReference()); // Clean un-matching diffs | |
132 | } | |
133 | this.falseDiffs.removeAll(futureTruthy.get().getDiffsWithReference()); | |
134 | } | |
135 | } catch (ExecutionException e) { | |
136 | LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e); | |
137 | } catch (InterruptedException e) { | |
138 | LOGGER.log(LogLevelUtil.IGNORE, e, e); | |
139 |
1
1. cleanTrueDiffs : removed call to java/lang/Thread::interrupt → NO_COVERAGE |
Thread.currentThread().interrupt(); |
140 | } | |
141 | } | |
142 | ||
143 | @Override | |
144 | public CallableBlindBin getCallableBitTest(String sqlQuery, int indexChar, int bit) { | |
145 | return null; // unused | |
146 | } | |
147 | ||
148 | @Override | |
149 | public boolean isInjectable() throws StoppedByUserSlidingException { | |
150 |
1
1. isInjectable : negated conditional → NO_COVERAGE |
if (this.injectionModel.isStoppedByUser()) { |
151 | throw new StoppedByUserSlidingException(); | |
152 | } | |
153 | var blindTest = new CallableBlindBin( | |
154 | this.injectionModel.getMediatorVendor().getVendor().instance().sqlBlindConfirm(), | |
155 | this.injectionModel, | |
156 | this, | |
157 | this.blindOperator, | |
158 | -1, -1, -1, | |
159 | "bin#confirm" | |
160 | ); | |
161 | try { | |
162 | blindTest.call(); | |
163 | } catch (Exception e) { | |
164 | LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e); | |
165 | } | |
166 |
2
1. isInjectable : negated conditional → NO_COVERAGE 2. isInjectable : replaced boolean return with true for com/jsql/model/injection/strategy/blind/InjectionBlindBin::isInjectable → NO_COVERAGE |
return blindTest.isTrue() |
167 | // when insertionChar = true then pages ref == truthy == falsy == confirm => falsy cleaned empty, truthy with opcode EQUAL not reliable | |
168 |
3
1. lambda$isInjectable$0 : negated conditional → NO_COVERAGE 2. isInjectable : negated conditional → NO_COVERAGE 3. lambda$isInjectable$0 : replaced boolean return with true for com/jsql/model/injection/strategy/blind/InjectionBlindBin::lambda$isInjectable$0 → NO_COVERAGE |
&& this.trueDiffs.stream().anyMatch(diff -> !Operation.EQUAL.equals(diff.operation)) |
169 |
3
1. lambda$isInjectable$1 : negated conditional → NO_COVERAGE 2. lambda$isInjectable$1 : replaced boolean return with true for com/jsql/model/injection/strategy/blind/InjectionBlindBin::lambda$isInjectable$1 → NO_COVERAGE 3. isInjectable : negated conditional → NO_COVERAGE |
|| this.falseDiffs.stream().anyMatch(diff -> !Operation.EQUAL.equals(diff.operation)); |
170 | } | |
171 | ||
172 | @Override | |
173 | public void initNextChar( | |
174 | String sqlQuery, | |
175 | List<char[]> bytes, | |
176 | AtomicInteger indexChar, | |
177 | CompletionService<CallableBlindBin> taskCompletionService, | |
178 | AtomicInteger countTasksSubmitted, | |
179 | AtomicInteger countBadAsciiCode, | |
180 | CallableBlindBin currentCallable | |
181 | ) { | |
182 | int low; | |
183 | int mid; | |
184 | int high; | |
185 | ||
186 |
1
1. initNextChar : negated conditional → NO_COVERAGE |
if (currentCallable != null) { |
187 | low = currentCallable.getLow(); | |
188 | mid = currentCallable.getMid(); | |
189 | high = currentCallable.getHigh(); | |
190 | ||
191 |
2
1. initNextChar : negated conditional → NO_COVERAGE 2. initNextChar : changed conditional boundary → NO_COVERAGE |
if (low >= high) { // char found |
192 |
1
1. initNextChar : negated conditional → NO_COVERAGE |
if (this.isCorruptOrElseNextChar(bytes, indexChar, countBadAsciiCode, currentCallable, low)) { |
193 | return; // too many errors | |
194 | } | |
195 | low = InjectionBlindBin.LOW; | |
196 | high = InjectionBlindBin.HIGH; | |
197 |
1
1. initNextChar : negated conditional → NO_COVERAGE |
} else if (currentCallable.isTrue()) { // current >= mid |
198 |
1
1. initNextChar : Replaced integer addition with subtraction → NO_COVERAGE |
low = mid + 1; |
199 | } else { // current < mid | |
200 |
1
1. initNextChar : Replaced integer subtraction with addition → NO_COVERAGE |
high = mid - 1; |
201 | } | |
202 | } else { | |
203 | low = InjectionBlindBin.LOW; | |
204 | high = InjectionBlindBin.HIGH; | |
205 | bytes.add(AbstractInjectionBit.getBitsUnset()); | |
206 | indexChar.incrementAndGet(); | |
207 | } | |
208 | ||
209 |
3
1. initNextChar : Replaced integer division with multiplication → NO_COVERAGE 2. initNextChar : Replaced integer addition with subtraction → NO_COVERAGE 3. initNextChar : Replaced integer subtraction with addition → NO_COVERAGE |
mid = low + (high - low) / 2; |
210 | taskCompletionService.submit( | |
211 | new CallableBlindBin( | |
212 | sqlQuery, | |
213 | indexChar.get(), | |
214 | this.injectionModel, | |
215 | this, | |
216 | this.blindOperator, | |
217 | low, mid, high, | |
218 | String.format("bin#%s~%s<%s<%s", indexChar, low, mid, high) | |
219 | ) | |
220 | ); | |
221 | countTasksSubmitted.addAndGet(1); | |
222 | } | |
223 | ||
224 | private boolean isCorruptOrElseNextChar(List<char[]> bytes, AtomicInteger indexChar, AtomicInteger countBadAsciiCode, CallableBlindBin currentCallable, int low) { | |
225 |
2
1. isCorruptOrElseNextChar : negated conditional → NO_COVERAGE 2. isCorruptOrElseNextChar : negated conditional → NO_COVERAGE |
if (low == 0 || low == 127) { |
226 | countBadAsciiCode.incrementAndGet(); | |
227 | } else { | |
228 |
2
1. isCorruptOrElseNextChar : Replaced integer subtraction with addition → NO_COVERAGE 2. isCorruptOrElseNextChar : negated conditional → NO_COVERAGE |
low = currentCallable.isTrue() ? low : low - 1; |
229 | } | |
230 |
1
1. isCorruptOrElseNextChar : Replaced integer subtraction with addition → NO_COVERAGE |
char[] asciiCodeMask = bytes.get(currentCallable.getCurrentIndex() - 1); // bits for current url |
231 |
1
1. isCorruptOrElseNextChar : removed call to com/jsql/model/injection/strategy/blind/InjectionBlindBin::setAsciiCodeMask → NO_COVERAGE |
this.setAsciiCodeMask(asciiCodeMask, low); |
232 | ||
233 | try { | |
234 | this.isCharCompleteWithCorruptCheck(bytes, countBadAsciiCode, currentCallable); | |
235 | } catch (InjectionFailureException e) { | |
236 |
1
1. isCorruptOrElseNextChar : replaced boolean return with false for com/jsql/model/injection/strategy/blind/InjectionBlindBin::isCorruptOrElseNextChar → NO_COVERAGE |
return true; |
237 | } | |
238 | ||
239 | bytes.add(AbstractInjectionBit.getBitsUnset()); | |
240 | indexChar.incrementAndGet(); | |
241 |
1
1. isCorruptOrElseNextChar : replaced boolean return with true for com/jsql/model/injection/strategy/blind/InjectionBlindBin::isCorruptOrElseNextChar → NO_COVERAGE |
return false; |
242 | } | |
243 | ||
244 | private void setAsciiCodeMask(char[] asciiCodeMask, int value) { | |
245 | String binary = StringUtils.leftPad(Integer.toBinaryString((char) value), 8, "0"); | |
246 |
2
1. setAsciiCodeMask : negated conditional → NO_COVERAGE 2. setAsciiCodeMask : changed conditional boundary → NO_COVERAGE |
for (int i = 0; i <= 7; i++) { |
247 | asciiCodeMask[i] = binary.charAt(i); | |
248 | } | |
249 | } | |
250 | ||
251 | @Override | |
252 | public char[] initMaskAsciiChar(List<char[]> bytes, CallableBlindBin currentCallable) { | |
253 |
2
1. initMaskAsciiChar : Replaced integer subtraction with addition → NO_COVERAGE 2. initMaskAsciiChar : replaced return value with null for com/jsql/model/injection/strategy/blind/InjectionBlindBin::initMaskAsciiChar → NO_COVERAGE |
return bytes.get(currentCallable.getCurrentIndex() - 1); |
254 | } | |
255 | ||
256 | @Override | |
257 | public String getInfoMessage() { | |
258 |
1
1. getInfoMessage : replaced return value with "" for com/jsql/model/injection/strategy/blind/InjectionBlindBin::getInfoMessage → NO_COVERAGE |
return "- Strategy Blind bin: query True when Diffs are matching " + this.falseDiffs + "\n\n"; |
259 | } | |
260 | | |
261 | | |
262 | // Getter and setter | |
263 | ||
264 | public String getSourceReferencePage() { | |
265 |
1
1. getSourceReferencePage : replaced return value with "" for com/jsql/model/injection/strategy/blind/InjectionBlindBin::getSourceReferencePage → NO_COVERAGE |
return this.sourceReferencePage; |
266 | } | |
267 | | |
268 | public List<Diff> getFalseDiffs() { | |
269 |
1
1. getFalseDiffs : replaced return value with Collections.emptyList for com/jsql/model/injection/strategy/blind/InjectionBlindBin::getFalseDiffs → NO_COVERAGE |
return this.falseDiffs; |
270 | } | |
271 | ||
272 | public List<Diff> getTrueDiffs() { | |
273 |
1
1. getTrueDiffs : replaced return value with Collections.emptyList for com/jsql/model/injection/strategy/blind/InjectionBlindBin::getTrueDiffs → NO_COVERAGE |
return this.trueDiffs; |
274 | } | |
275 | } | |
Mutations | ||
53 |
1.1 2.2 |
|
80 |
1.1 |
|
82 |
1.1 |
|
85 |
1.1 |
|
95 |
1.1 |
|
98 |
1.1 |
|
102 |
1.1 |
|
123 |
1.1 |
|
125 |
1.1 |
|
128 |
1.1 |
|
139 |
1.1 |
|
150 |
1.1 |
|
166 |
1.1 2.2 |
|
168 |
1.1 2.2 3.3 |
|
169 |
1.1 2.2 3.3 |
|
186 |
1.1 |
|
191 |
1.1 2.2 |
|
192 |
1.1 |
|
197 |
1.1 |
|
198 |
1.1 |
|
200 |
1.1 |
|
209 |
1.1 2.2 3.3 |
|
225 |
1.1 2.2 |
|
228 |
1.1 2.2 |
|
230 |
1.1 |
|
231 |
1.1 |
|
236 |
1.1 |
|
241 |
1.1 |
|
246 |
1.1 2.2 |
|
253 |
1.1 2.2 |
|
258 |
1.1 |
|
265 |
1.1 |
|
269 |
1.1 |
|
273 |
1.1 |