View Javadoc
1   /*******************************************************************************
2    * Copyhacked (H) 2012-2025.
3    * This program and the accompanying materials
4    * are made available under no term at all, use it like
5    * you want, but share and discuss it
6    * every time possible with every body.
7    *
8    * Contributors:
9    *      ron190 at ymail dot com - initial implementation
10   *******************************************************************************/
11  package com.jsql.model.injection.strategy;
12  
13  import com.jsql.model.InjectionModel;
14  import com.jsql.model.bean.util.Interaction;
15  import com.jsql.model.bean.util.Request;
16  import com.jsql.model.exception.StoppedByUserSlidingException;
17  import com.jsql.model.injection.strategy.blind.AbstractInjectionBit.BlindOperator;
18  import com.jsql.model.injection.strategy.blind.InjectionTime;
19  import com.jsql.model.injection.vendor.model.VendorYaml;
20  import com.jsql.model.suspendable.AbstractSuspendable;
21  import com.jsql.util.I18nUtil;
22  import com.jsql.util.LogLevelUtil;
23  import com.jsql.util.StringUtil;
24  import org.apache.commons.lang3.StringUtils;
25  import org.apache.logging.log4j.LogManager;
26  import org.apache.logging.log4j.Logger;
27  
28  public class StrategyTime extends AbstractStrategy {
29  
30      private static final Logger LOGGER = LogManager.getRootLogger();
31  
32      private InjectionTime injection;
33  
34      public StrategyTime(InjectionModel injectionModel) {
35          super(injectionModel);
36      }
37  
38      @Override
39      public void checkApplicability() throws StoppedByUserSlidingException {
40          if (this.injectionModel.getMediatorUtils().getPreferencesUtil().isStrategyTimeDisabled()) {
41              LOGGER.log(LogLevelUtil.CONSOLE_INFORM, AbstractStrategy.FORMAT_SKIP_STRATEGY_DISABLED, this.getName());
42              return;
43          } else if (StringUtils.isEmpty(
44              this.injectionModel.getMediatorVendor().getVendor().instance().getModelYaml().getStrategy().getBinary().getTime()
45          )) {
46              LOGGER.log(
47                  LogLevelUtil.CONSOLE_INFORM,
48                  AbstractStrategy.FORMAT_STRATEGY_NOT_IMPLEMENTED,
49                  this.getName(),
50                  this.injectionModel.getMediatorVendor().getVendor()
51              );
52              return;
53          }
54  
55          this.checkInjection(BlindOperator.OR);
56          this.checkInjection(BlindOperator.AND);
57          this.checkInjection(BlindOperator.STACK);
58          this.checkInjection(BlindOperator.NO_MODE);
59  
60          if (this.isApplicable) {
61              this.allow();
62              var requestMessageBinary = new Request();
63              requestMessageBinary.setMessage(Interaction.MESSAGE_BINARY);
64              requestMessageBinary.setParameters(this.injection.getInfoMessage());
65              this.injectionModel.sendToViews(requestMessageBinary);
66          } else {
67              this.unallow();
68          }
69      }
70  
71      private void checkInjection(BlindOperator blindOperator) throws StoppedByUserSlidingException {
72          if (this.isApplicable) {
73              return;
74          }
75          LOGGER.log(
76              LogLevelUtil.CONSOLE_DEFAULT,
77              "{} [{}] with [{}]...",
78              () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_CHECKING_STRATEGY),
79              this::getName,
80              () -> blindOperator
81          );
82          this.injection = new InjectionTime(this.injectionModel, blindOperator);
83          this.isApplicable = this.injection.isInjectable();
84          if (this.isApplicable) {
85              LOGGER.log(
86                  LogLevelUtil.CONSOLE_SUCCESS,
87                  "{} [{}] injection with [{}]",
88                  () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_VULNERABLE),
89                  this::getName,
90                  () -> blindOperator
91              );
92          }
93      }
94  
95      @Override
96      public void allow(int... i) {
97          this.injectionModel.appendAnalysisReport(
98              StringUtil.formatReport(LogLevelUtil.COLOR_BLU, "### Strategy: " + this.getName())
99              + this.injectionModel.getReportWithoutIndex(
100                 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTestTimeWithOperator(
101                     this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime(StringUtil.formatReport(LogLevelUtil.COLOR_GREEN, "<query>"), "0", true),
102                     this.injection.getBlindOperator()
103                 ),
104                 "metadataInjectionProcess",
105                 null
106             )
107         );
108         this.markVulnerability(Interaction.MARK_TIME_VULNERABLE);
109     }
110 
111     @Override
112     public void unallow(int... i) {
113         this.markVulnerability(Interaction.MARK_TIME_INVULNERABLE);
114     }
115 
116     @Override
117     public String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) throws StoppedByUserSlidingException {
118         return this.injection.inject(
119             this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime(sqlQuery, startPosition, false),
120             stoppable
121         );
122     }
123 
124     @Override
125     public void activateWhenApplicable() {
126         if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) {
127             LOGGER.log(
128                 LogLevelUtil.CONSOLE_INFORM,
129                 "{} [{}] with [{}]",
130                 () -> I18nUtil.valueByKey("LOG_USING_STRATEGY"),
131                 this::getName,
132                 () -> this.injection.getBlindOperator().name()
133             );
134             this.injectionModel.getMediatorStrategy().setStrategy(this);
135 
136             var request = new Request();
137             request.setMessage(Interaction.MARK_TIME_STRATEGY);
138             this.injectionModel.sendToViews(request);
139         }
140     }
141     
142     @Override
143     public String getPerformanceLength() {
144         return VendorYaml.DEFAULT_CAPACITY;
145     }
146     
147     @Override
148     public String getName() {
149         return "Time";
150     }
151 }