1
2
3
4
5
6
7
8
9
10
11 package com.jsql.model.injection.strategy;
12
13 import com.jsql.model.InjectionModel;
14 import com.jsql.model.bean.util.Interaction;
15 import com.jsql.model.bean.util.Request;
16 import com.jsql.model.exception.StoppedByUserSlidingException;
17 import com.jsql.model.injection.strategy.blind.AbstractInjectionBinary.BinaryMode;
18 import com.jsql.model.injection.strategy.blind.InjectionTime;
19 import com.jsql.model.injection.vendor.model.VendorYaml;
20 import com.jsql.model.suspendable.AbstractSuspendable;
21 import com.jsql.util.I18nUtil;
22 import com.jsql.util.LogLevelUtil;
23 import com.jsql.util.StringUtil;
24 import org.apache.commons.lang3.StringUtils;
25 import org.apache.logging.log4j.LogManager;
26 import org.apache.logging.log4j.Logger;
27
28 public class StrategyInjectionTime extends AbstractStrategy {
29
30
31
32
33 private static final Logger LOGGER = LogManager.getRootLogger();
34
35 private InjectionTime injectionTime;
36
37 public StrategyInjectionTime(InjectionModel injectionModel) {
38 super(injectionModel);
39 }
40
41 @Override
42 public void checkApplicability() throws StoppedByUserSlidingException {
43 if (this.injectionModel.getMediatorUtils().getPreferencesUtil().isStrategyTimeDisabled()) {
44 LOGGER.log(LogLevelUtil.CONSOLE_INFORM, AbstractStrategy.FORMAT_SKIP_STRATEGY_DISABLED, this.getName());
45 return;
46 } else if (StringUtils.isEmpty(this.injectionModel.getMediatorVendor().getVendor().instance().sqlBinaryTime())) {
47 LOGGER.log(
48 LogLevelUtil.CONSOLE_ERROR,
49 AbstractStrategy.FORMAT_STRATEGY_NOT_IMPLEMENTED,
50 this.getName(),
51 this.injectionModel.getMediatorVendor().getVendor()
52 );
53 return;
54 }
55
56 this.checkInjection(BinaryMode.OR);
57 this.checkInjection(BinaryMode.AND);
58 this.checkInjection(BinaryMode.STACK);
59 this.checkInjection(BinaryMode.NO_MODE);
60
61 if (this.isApplicable) {
62 this.allow();
63 var requestMessageBinary = new Request();
64 requestMessageBinary.setMessage(Interaction.MESSAGE_BINARY);
65 requestMessageBinary.setParameters(this.injectionTime.getInfoMessage());
66 this.injectionModel.sendToViews(requestMessageBinary);
67 } else {
68 this.unallow();
69 }
70 }
71
72 private void checkInjection(BinaryMode binaryMode) throws StoppedByUserSlidingException {
73 if (this.isApplicable) {
74 return;
75 }
76
77 LOGGER.log(
78 LogLevelUtil.CONSOLE_DEFAULT,
79 "{} [{}] with [{}]...",
80 () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_CHECKING_STRATEGY),
81 this::getName,
82 () -> binaryMode
83 );
84 this.injectionTime = new InjectionTime(this.injectionModel, binaryMode);
85 this.isApplicable = this.injectionTime.isInjectable();
86
87 if (this.isApplicable) {
88 LOGGER.log(
89 LogLevelUtil.CONSOLE_SUCCESS,
90 "{} [{}] injection with [{}]",
91 () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_VULNERABLE),
92 this::getName,
93 () -> binaryMode
94 );
95 }
96 }
97
98 @Override
99 public void allow(int... i) {
100 this.injectionModel.appendAnalysisReport(
101 StringUtil.formatReport(LogLevelUtil.COLOR_BLU, "### Strategy: " + this.getName())
102 + this.injectionModel.getReportWithoutIndex(
103 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTimeTest(
104 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime(StringUtil.formatReport(LogLevelUtil.COLOR_GREEN, "<query>"), "0", true),
105 this.injectionTime.getBooleanMode()
106 ),
107 "metadataInjectionProcess",
108 null
109 )
110 );
111 this.markVulnerability(Interaction.MARK_TIME_VULNERABLE);
112 }
113
114 @Override
115 public void unallow(int... i) {
116 this.markVulnerability(Interaction.MARK_TIME_INVULNERABLE);
117 }
118
119 @Override
120 public String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) throws StoppedByUserSlidingException {
121 return this.injectionTime.inject(
122 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime(sqlQuery, startPosition, false),
123 stoppable
124 );
125 }
126
127 @Override
128 public void activateWhenApplicable() {
129 if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) {
130 LOGGER.log(
131 LogLevelUtil.CONSOLE_INFORM,
132 "{} [{}] with [{}]",
133 () -> I18nUtil.valueByKey("LOG_USING_STRATEGY"),
134 this::getName,
135 () -> this.injectionTime.getBooleanMode().name()
136 );
137 this.injectionModel.getMediatorStrategy().setStrategy(this.injectionModel.getMediatorStrategy().getTime());
138
139 var requestMarkTimeStrategy = new Request();
140 requestMarkTimeStrategy.setMessage(Interaction.MARK_TIME_STRATEGY);
141 this.injectionModel.sendToViews(requestMarkTimeStrategy);
142 }
143 }
144
145 @Override
146 public String getPerformanceLength() {
147 return VendorYaml.DEFAULT_CAPACITY;
148 }
149
150 @Override
151 public String getName() {
152 return "Time";
153 }
154 }