|
| 1 | +// An example active scan rule script which uses a set of attack payloads and a set of regexes |
| 2 | +// in order to find potential issues. |
| 3 | +// Replace or extend the attacks and evidence regexes with you own values. |
| 4 | + |
| 5 | +// Note that new active scripts will initially be disabled |
| 6 | +// Right click the script in the Scripts tree and select "enable" |
| 7 | + |
| 8 | +// Replace or extend these with your own attacks |
| 9 | +// put the attacks you most want to run higher, unless you disable the attack strength check |
| 10 | +var attacks = [ |
| 11 | + '<>"\'%;)(&+', |
| 12 | + '\'', |
| 13 | + '\' --', |
| 14 | + '|', |
| 15 | + '!', |
| 16 | + '?', |
| 17 | + '/', |
| 18 | + '//', |
| 19 | + '//*', |
| 20 | + '(', |
| 21 | + ')', |
| 22 | + '*|', |
| 23 | + '*/*', |
| 24 | + '{', |
| 25 | + '}', |
| 26 | +] |
| 27 | + |
| 28 | +// Replace or extend these with your own evidence - regexes that indicate potential issues |
| 29 | +// The default ones are a subset of https://github.com/fuzzdb-project/fuzzdb/blob/master/regex/errors.txt |
| 30 | +var evidence = [ |
| 31 | + "A syntax error has occurred", |
| 32 | + "Active Server Pages error", |
| 33 | + "ADODB.Field error", |
| 34 | + "An illegal character has been found in the statement", |
| 35 | + "An unexpected token .* was found", |
| 36 | + "ASP\.NET is configured to show verbose error messages", |
| 37 | + "ASP\.NET_SessionId", |
| 38 | + "Custom Error Message", |
| 39 | + "database error", |
| 40 | + "DB2 Driver", |
| 41 | + "DB2 Error", |
| 42 | + "DB2 ODBC", |
| 43 | + "detected an internal error", |
| 44 | + "Error converting data type varchar to numeric", |
| 45 | + "Error Diagnostic Information", |
| 46 | + "Error Report", |
| 47 | + "Fatal error", |
| 48 | + "Incorrect syntax near", |
| 49 | + "Index of", |
| 50 | + "Internal Server Error", |
| 51 | + "Invalid Path Character", |
| 52 | + "Invalid procedure call or argument", |
| 53 | + "invalid query", |
| 54 | + "Invision Power Board Database Error", |
| 55 | + "is not allowed to access", |
| 56 | + "JDBC Driver", |
| 57 | + "JDBC Error", |
| 58 | + "JDBC MySQL", |
| 59 | + "JDBC Oracle", |
| 60 | + "JDBC SQL", |
| 61 | + "Microsoft OLE DB Provider for ODBC Drivers", |
| 62 | + "Microsoft VBScript compilation error", |
| 63 | + "Microsoft VBScript error", |
| 64 | + "MySQL Driver", |
| 65 | + "mysql error", |
| 66 | + "MySQL Error", |
| 67 | + "mySQL error with query", |
| 68 | + "MySQL ODBC", |
| 69 | + "ODBC DB2", |
| 70 | + "ODBC Driver", |
| 71 | + "ODBC Error", |
| 72 | + "ODBC Microsoft Access", |
| 73 | + "ODBC Oracle", |
| 74 | + "ODBC SQL", |
| 75 | + "OLE/DB provider returned message", |
| 76 | + "on line", |
| 77 | + "on MySQL result index", |
| 78 | + "Oracle DB2", |
| 79 | + "Oracle Driver", |
| 80 | + "Oracle Error", |
| 81 | + "Oracle ODBC", |
| 82 | + "Parent Directory", |
| 83 | + "PHP Error", |
| 84 | + "PHP Parse error", |
| 85 | + "PHP Warning", |
| 86 | + "PostgreSQL query failed", |
| 87 | + "server object error", |
| 88 | + "SQL command not properly ended", |
| 89 | + "SQL Server Driver", |
| 90 | + "SQLException", |
| 91 | + "supplied argument is not a valid", |
| 92 | + "Syntax error in query expression", |
| 93 | + "The error occurred in", |
| 94 | + "The script whose uid is", |
| 95 | + "Type mismatch", |
| 96 | + "Unable to jump to row", |
| 97 | + "Unclosed quotation mark before the character string", |
| 98 | + "unexpected end of SQL command", |
| 99 | + "unexpected error", |
| 100 | + "Unterminated string constant", |
| 101 | + "Warning: mysql_query", |
| 102 | + "Warning: pg_connect", |
| 103 | + "You have an error in your SQL syntax near", |
| 104 | +] |
| 105 | + |
| 106 | +/** |
| 107 | + * Scans a "node", i.e. an individual entry in the Sites Tree. |
| 108 | + * The scanNode function will typically be called once for every page. |
| 109 | + * |
| 110 | + * @param as - the ActiveScan parent object that will do all the core interface tasks |
| 111 | + * (i.e.: sending and receiving messages, providing access to Strength and Threshold settings, |
| 112 | + * raising alerts, etc.). This is an ScriptsActiveScanner object. |
| 113 | + * @param msg - the HTTP Message being scanned. This is an HttpMessage object. |
| 114 | + */ |
| 115 | +function scanNode(as, msg) { |
| 116 | + // Do nothing here - this script just attacks parameters rather than nodes |
| 117 | +} |
| 118 | + |
| 119 | +/** |
| 120 | + * Scans a specific parameter in an HTTP message. |
| 121 | + * The scan function will typically be called for every parameter in every URL and Form for every page. |
| 122 | + * |
| 123 | + * @param as - the ActiveScan parent object that will do all the core interface tasks |
| 124 | + * (i.e.: sending and receiving messages, providing access to Strength and Threshold settings, |
| 125 | + * raising alerts, etc.). This is an ScriptsActiveScanner object. |
| 126 | + * @param msg - the HTTP Message being scanned. This is an HttpMessage object. |
| 127 | + * @param {string} param - the name of the parameter being manipulated for this test/scan. |
| 128 | + * @param {string} value - the original parameter value. |
| 129 | + */ |
| 130 | +function scan(as, msg, param, value) { |
| 131 | + // Debugging can be done using print like this |
| 132 | + //print('scan called for url=' + msg.getRequestHeader().getURI().toString() + |
| 133 | + // ' param=' + param + ' value=' + value); |
| 134 | + |
| 135 | + var max_attacks = attacks.length // No limit for the "INSANE" level ;) |
| 136 | + |
| 137 | + if (as.getAttackStrength() == "LOW") { |
| 138 | + max_attacks = 6 |
| 139 | + } else if (as.getAttackStrength() == "MEDIUM") { |
| 140 | + max_attacks = 12 |
| 141 | + } else if (as.getAttackStrength() == "HIGH") { |
| 142 | + max_attacks = 24 |
| 143 | + } |
| 144 | + |
| 145 | + for (var i in attacks) { |
| 146 | + // Dont exceed recommended number of attacks for strength |
| 147 | + // feel free to disable this locally ;) |
| 148 | + if (i > max_attacks) { |
| 149 | + return |
| 150 | + } |
| 151 | + // Copy requests before reusing them |
| 152 | + msg = msg.cloneRequest(); |
| 153 | + |
| 154 | + // setParam (message, parameterName, newValue) |
| 155 | + as.setParam(msg, param, attacks[i]); |
| 156 | + |
| 157 | + // sendAndReceive(msg, followRedirect, handleAntiCSRFtoken) |
| 158 | + as.sendAndReceive(msg, false, false); |
| 159 | + |
| 160 | + // Add any generic checks here, eg |
| 161 | + var code = msg.getResponseHeader().getStatusCode() |
| 162 | + if (code >= 500 && code < 600) { |
| 163 | + raiseAlert(as, msg, param, attacks[i], code) |
| 164 | + // Only raise one alert per param |
| 165 | + return |
| 166 | + } |
| 167 | + |
| 168 | + var body = msg.getResponseBody().toString() |
| 169 | + var re = new RegExp(evidence.join("|"), "i") |
| 170 | + var found = body.match(re) |
| 171 | + if (found) { // Change to a test which detects the vulnerability |
| 172 | + raiseAlert(as, msg, param, attacks[i], found) |
| 173 | + // Only raise one alert per param |
| 174 | + return |
| 175 | + } |
| 176 | + |
| 177 | + // Check if the scan was stopped before performing lengthy tasks |
| 178 | + if (as.isStop()) { |
| 179 | + return |
| 180 | + } |
| 181 | + } |
| 182 | +} |
| 183 | + |
| 184 | +function raiseAlert(as, msg, param, attack, evidence) { |
| 185 | + // Replace with more suitable information |
| 186 | + // raiseAlert(risk, int confidence, String name, String description, String uri, |
| 187 | + // String param, String attack, String otherInfo, String solution, String evidence, |
| 188 | + // int cweId, int wascId, HttpMessage msg) |
| 189 | + // risk: 0: info, 1: low, 2: medium, 3: high |
| 190 | + // confidence: 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed |
| 191 | + as.raiseAlert(1, 1, 'Active Vulnerability Title', 'Full description', |
| 192 | + msg.getRequestHeader().getURI().toString(), |
| 193 | + param, attack, 'Any other info', 'The solution ', evidence, 0, 0, msg); |
| 194 | +} |
| 195 | + |
0 commit comments