View Javadoc
1   /*******************************************************************************
2    * Copyhacked (H) 2012-2025.
3    * This program and the accompanying materials
4    * are made available under no term at all, use it like
5    * you want, but share and discuss it
6    * every time possible with every body.
7    *
8    * Contributors:
9    *      ron190 at ymail dot com - initial implementation
10   *******************************************************************************/
11  package com.jsql.model.injection.strategy;
12  
13  import com.jsql.model.InjectionModel;
14  import com.jsql.model.bean.util.Interaction;
15  import com.jsql.model.bean.util.Request;
16  import com.jsql.model.exception.StoppedByUserSlidingException;
17  import com.jsql.model.injection.strategy.blind.AbstractInjectionBinary.BinaryMode;
18  import com.jsql.model.injection.strategy.blind.InjectionTime;
19  import com.jsql.model.injection.vendor.model.VendorYaml;
20  import com.jsql.model.suspendable.AbstractSuspendable;
21  import com.jsql.util.I18nUtil;
22  import com.jsql.util.LogLevelUtil;
23  import com.jsql.util.StringUtil;
24  import org.apache.commons.lang3.StringUtils;
25  import org.apache.logging.log4j.LogManager;
26  import org.apache.logging.log4j.Logger;
27  
28  public class StrategyInjectionTime extends AbstractStrategy {
29      
30      /**
31       * Log4j logger sent to view.
32       */
33      private static final Logger LOGGER = LogManager.getRootLogger();
34  
35      private InjectionTime injectionTime;
36      
37      public StrategyInjectionTime(InjectionModel injectionModel) {
38          super(injectionModel);
39      }
40  
41      @Override
42      public void checkApplicability() throws StoppedByUserSlidingException {
43          if (this.injectionModel.getMediatorUtils().getPreferencesUtil().isStrategyTimeDisabled()) {
44              LOGGER.log(LogLevelUtil.CONSOLE_INFORM, AbstractStrategy.FORMAT_SKIP_STRATEGY_DISABLED, this.getName());
45              return;
46          } else if (StringUtils.isEmpty(this.injectionModel.getMediatorVendor().getVendor().instance().sqlBinaryTime())) {
47              LOGGER.log(
48                  LogLevelUtil.CONSOLE_ERROR,
49                  AbstractStrategy.FORMAT_STRATEGY_NOT_IMPLEMENTED,
50                  this.getName(),
51                  this.injectionModel.getMediatorVendor().getVendor()
52              );
53              return;
54          }
55  
56          this.checkInjection(BinaryMode.OR);
57          this.checkInjection(BinaryMode.AND);
58          this.checkInjection(BinaryMode.STACK);
59          this.checkInjection(BinaryMode.NO_MODE);
60  
61          if (this.isApplicable) {
62              this.allow();
63              var requestMessageBinary = new Request();
64              requestMessageBinary.setMessage(Interaction.MESSAGE_BINARY);
65              requestMessageBinary.setParameters(this.injectionTime.getInfoMessage());
66              this.injectionModel.sendToViews(requestMessageBinary);
67          } else {
68              this.unallow();
69          }
70      }
71  
72      private void checkInjection(BinaryMode binaryMode) throws StoppedByUserSlidingException {
73          if (this.isApplicable) {
74              return;
75          }
76  
77          LOGGER.log(
78              LogLevelUtil.CONSOLE_DEFAULT,
79              "{} [{}] with [{}]...",
80              () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_CHECKING_STRATEGY),
81              this::getName,
82              () -> binaryMode
83          );
84          this.injectionTime = new InjectionTime(this.injectionModel, binaryMode);
85          this.isApplicable = this.injectionTime.isInjectable();
86  
87          if (this.isApplicable) {
88              LOGGER.log(
89                  LogLevelUtil.CONSOLE_SUCCESS,
90                  "{} [{}] injection with [{}]",
91                  () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_VULNERABLE),
92                  this::getName,
93                  () -> binaryMode
94              );
95          }
96      }
97      
98      @Override
99      public void allow(int... i) {
100         this.injectionModel.appendAnalysisReport(
101             StringUtil.formatReport(LogLevelUtil.COLOR_BLU, "### Strategy: " + this.getName())
102             + this.injectionModel.getReportWithoutIndex(
103                 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTimeTest(
104                     this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime(StringUtil.formatReport(LogLevelUtil.COLOR_GREEN, "<query>"), "0", true),
105                     this.injectionTime.getBooleanMode()
106                 ),
107                 "metadataInjectionProcess",
108                 null
109             )
110         );
111         this.markVulnerability(Interaction.MARK_TIME_VULNERABLE);
112     }
113 
114     @Override
115     public void unallow(int... i) {
116         this.markVulnerability(Interaction.MARK_TIME_INVULNERABLE);
117     }
118 
119     @Override
120     public String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) throws StoppedByUserSlidingException {
121         return this.injectionTime.inject(
122             this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime(sqlQuery, startPosition, false),
123             stoppable
124         );
125     }
126 
127     @Override
128     public void activateWhenApplicable() {
129         if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) {
130             LOGGER.log(
131                 LogLevelUtil.CONSOLE_INFORM,
132                 "{} [{}] with [{}]",
133                 () -> I18nUtil.valueByKey("LOG_USING_STRATEGY"),
134                 this::getName,
135                 () -> this.injectionTime.getBooleanMode().name()
136             );
137             this.injectionModel.getMediatorStrategy().setStrategy(this.injectionModel.getMediatorStrategy().getTime());
138 
139             var requestMarkTimeStrategy = new Request();
140             requestMarkTimeStrategy.setMessage(Interaction.MARK_TIME_STRATEGY);
141             this.injectionModel.sendToViews(requestMarkTimeStrategy);
142         }
143     }
144     
145     @Override
146     public String getPerformanceLength() {
147         return VendorYaml.DEFAULT_CAPACITY;
148     }
149     
150     @Override
151     public String getName() {
152         return "Time";
153     }
154 }