bbot 2.4.2.6677rc0__py3-none-any.whl → 2.5.0.6715rc0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of bbot might be problematic. Click here for more details.
- bbot/__init__.py +1 -1
- bbot/core/helpers/async_helpers.py +29 -8
- bbot/defaults.yml +6 -0
- bbot/modules/apkpure.py +5 -3
- bbot/modules/base.py +86 -32
- bbot/modules/docker_pull.py +3 -3
- bbot/modules/filedownload.py +8 -4
- bbot/modules/git_clone.py +5 -2
- bbot/modules/gitdumper.py +14 -5
- bbot/modules/github_workflows.py +12 -5
- bbot/modules/lightfuzz/lightfuzz.py +1 -1
- bbot/modules/lightfuzz/submodules/serial.py +11 -1
- bbot/modules/lightfuzz/submodules/sqli.py +1 -0
- bbot/modules/lightfuzz/submodules/xss.py +4 -4
- bbot/modules/nuclei.py +4 -2
- bbot/modules/portscan.py +2 -0
- bbot/modules/postman_download.py +6 -3
- bbot/modules/trufflehog.py +1 -2
- bbot/presets/web/lightfuzz-heavy.yml +1 -1
- bbot/presets/web/lightfuzz-medium.yml +1 -1
- bbot/presets/web/lightfuzz-superheavy.yml +1 -1
- bbot/scanner/preset/args.py +10 -1
- bbot/scanner/preset/preset.py +0 -2
- bbot/scanner/scanner.py +1 -4
- bbot/scripts/docs.py +8 -0
- bbot/test/test_step_1/test_scan.py +57 -0
- bbot/test/test_step_2/module_tests/test_module_apkpure.py +2 -0
- bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py +8 -3
- bbot/test/test_step_2/module_tests/test_module_docker_pull.py +2 -0
- bbot/test/test_step_2/module_tests/test_module_filedownload.py +5 -1
- bbot/test/test_step_2/module_tests/test_module_git_clone.py +4 -1
- bbot/test/test_step_2/module_tests/test_module_gitdumper.py +2 -0
- bbot/test/test_step_2/module_tests/test_module_lightfuzz.py +2 -130
- bbot/test/test_step_2/module_tests/test_module_portscan.py +3 -3
- bbot/test/test_step_2/module_tests/test_module_postman_download.py +6 -1
- bbot/test/test_step_2/module_tests/test_module_trufflehog.py +38 -12
- {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.6715rc0.dist-info}/METADATA +1 -1
- {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.6715rc0.dist-info}/RECORD +41 -42
- bbot/modules/lightfuzz/submodules/nosqli.py +0 -183
- {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.6715rc0.dist-info}/LICENSE +0 -0
- {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.6715rc0.dist-info}/WHEEL +0 -0
- {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.6715rc0.dist-info}/entry_points.txt +0 -0
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
bbot/__init__.py,sha256=
|
|
1
|
+
bbot/__init__.py,sha256=yccQ2-fVLMX5ykoO0zFuYDxnjbewc43wdlTr_8NF3yw,163
|
|
2
2
|
bbot/cli.py,sha256=1QJbANVw9Q3GFM92H2QRV2ds5756ulm08CDZwzwPpeI,11888
|
|
3
3
|
bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
|
|
4
4
|
bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
|
|
@@ -11,7 +11,7 @@ bbot/core/event/base.py,sha256=1jUgd3I3TDITKoobh92ir_tIm38EN1ZbhoaX1W9fKts,67125
|
|
|
11
11
|
bbot/core/event/helpers.py,sha256=MohOCVBjkn_K1p4Ipgx-MKliZtV6l4NJPq3YgagkvSM,6507
|
|
12
12
|
bbot/core/flags.py,sha256=Ltvm8Bc4D65I55HuU5bzyjO1R3yMDNpVmreGU83ZBXE,1266
|
|
13
13
|
bbot/core/helpers/__init__.py,sha256=cpOGLKIgA3vdHYqsOtx63BFO_qbtwCmez2amFPu6YTs,111
|
|
14
|
-
bbot/core/helpers/async_helpers.py,sha256=
|
|
14
|
+
bbot/core/helpers/async_helpers.py,sha256=bVHEUIOZo8iCmuovLYb3oNLPdLFUoEyc6wZIIvtELVs,4399
|
|
15
15
|
bbot/core/helpers/bloom.py,sha256=gk02rO6x3F5MICa7ZUDsinRudwoGAifsbiyiMCwd0Gs,2739
|
|
16
16
|
bbot/core/helpers/cache.py,sha256=1aMr3HVD45cDtHEG5xlznDUCywRgO9oRFidscrs_5sA,1537
|
|
17
17
|
bbot/core/helpers/command.py,sha256=UBJa2RInEJtGjZ5e24PUQxPu1aTCIFkcCrrB0ERLdGI,12810
|
|
@@ -50,20 +50,20 @@ bbot/core/modules.py,sha256=G4rRVF1bQzp62kwpgxwMa_FTV4-huWwtcd6HpW9jQf0,31970
|
|
|
50
50
|
bbot/core/multiprocess.py,sha256=ocQHanskJ09gHwe7RZmwNdZyCOQyeyUoIHCtLbtvXUk,1771
|
|
51
51
|
bbot/core/shared_deps.py,sha256=mCMZeKSt46trzVqQDPGfXfEWg0Zw5YjiJx4BnsIRgHM,7640
|
|
52
52
|
bbot/db/sql/models.py,sha256=SrUdDOBCICzXJBY29p0VvILhMQ1JCuh725bqvIYogX0,4884
|
|
53
|
-
bbot/defaults.yml,sha256=
|
|
53
|
+
bbot/defaults.yml,sha256=TTxtlnyE9vPihXjkGMDbBpNRlGa48GhRXS23iFsKUAg,7830
|
|
54
54
|
bbot/errors.py,sha256=xwQcD26nU9oc7-o0kv5jmEDTInmi8_W8eKAgQZZxdVM,953
|
|
55
55
|
bbot/logger.py,sha256=wE-532v5FyKuSSoTdyW1xSfaOnLZB1axAJnB-uW2xrI,2745
|
|
56
56
|
bbot/modules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
57
57
|
bbot/modules/ajaxpro.py,sha256=daE1yQoCsSI5c4dh3YKwRSggTISNjWgrK7qTPidk7cU,3764
|
|
58
58
|
bbot/modules/anubisdb.py,sha256=JCy2YCfa0e_VawpzNmcPXAosKUthmYGutireJ0gMDws,1916
|
|
59
|
-
bbot/modules/apkpure.py,sha256=
|
|
59
|
+
bbot/modules/apkpure.py,sha256=a_VRujUOIk7SVWyI9-N-nJVqfMApciIRdXVc-y_Ebuw,2558
|
|
60
60
|
bbot/modules/azure_realm.py,sha256=pP2PUlLy0K9KKaE8aNcznWjDW3PKHvnMejdOSc-o4ms,1612
|
|
61
61
|
bbot/modules/azure_tenant.py,sha256=qBn7CUA_hth2PqW55XZVjYxIw20xLYrMntXc6mYpmKU,5366
|
|
62
62
|
bbot/modules/baddns.py,sha256=ubO3KDfcIMJnMjyZX5FWZ4GWxLSekV_JQV7QvsPjtD0,6693
|
|
63
63
|
bbot/modules/baddns_direct.py,sha256=hWThpkXP87nnCRTlUh5qBJ1t4eo4l9kUmKNNxVNJI8A,3819
|
|
64
64
|
bbot/modules/baddns_zone.py,sha256=y1XaBUfFPnRbR2qaTqRyUsPgEL73722v2B8aS5YoGN4,1035
|
|
65
65
|
bbot/modules/badsecrets.py,sha256=LG37p48Rlxsfc3BmACMpkypsbuFTVvXqNhlP1IEsx0k,5109
|
|
66
|
-
bbot/modules/base.py,sha256=
|
|
66
|
+
bbot/modules/base.py,sha256=qH5nmYRP3Gc9z8ddr0iY1DR7b68tatv4M0IB-SjDobU,78162
|
|
67
67
|
bbot/modules/bevigil.py,sha256=0VLIxmeXRUI2-EoR6IzuHJMcX8KCHNNta-WYa3gVlDg,2862
|
|
68
68
|
bbot/modules/binaryedge.py,sha256=5F9LnZwRM_rZnzTv29hLJLI2GEQdzOwSpahPFC1kJC0,1397
|
|
69
69
|
bbot/modules/bucket_amazon.py,sha256=mwjYeEAcdfOpjbOa1sD8U9KBMMVY_c8FoHjSGR9GQbg,730
|
|
@@ -93,24 +93,24 @@ bbot/modules/dnscaa.py,sha256=pyaLqHrdsVhqtd1JBZVjKKcuYT_ywUbFYkrnfXcGD5s,5014
|
|
|
93
93
|
bbot/modules/dnscommonsrv.py,sha256=gEErfSur7Odkaif4CbXYx3OZ3FQrQESyiMGPbcDKSIg,1538
|
|
94
94
|
bbot/modules/dnsdumpster.py,sha256=bqUqyvRJVtoTXbDxTZ-kgPNq4dCE9xv_msBIn_Nj5IM,3251
|
|
95
95
|
bbot/modules/dnstlsrpt.py,sha256=ntNKVDXDgDVWr1A20ShNT5HFBhXsVEM5aUIEU_0c9HU,6427
|
|
96
|
-
bbot/modules/docker_pull.py,sha256=
|
|
96
|
+
bbot/modules/docker_pull.py,sha256=3Ui5z3pNfZDgX8q25h-LwKvUM7FDPST2dz1vk_I8gDc,9192
|
|
97
97
|
bbot/modules/dockerhub.py,sha256=JQkujjqvQRzQuvHjQ7JbFs_VlJj8dLRPRObAkBgUQhc,3493
|
|
98
98
|
bbot/modules/dotnetnuke.py,sha256=zipcHyNYr2FEecStb1Yrm938ps01RvHV8NnyqAvnGGc,10537
|
|
99
99
|
bbot/modules/emailformat.py,sha256=RLPJW-xitYB-VT4Lp08qVzFkXx_kMyV_035JT_Yf4fM,1082
|
|
100
100
|
bbot/modules/extractous.py,sha256=VSGKmHPAA_4r62jaN8Yqi3JcjehjxpI2lhe8i2j786s,4648
|
|
101
101
|
bbot/modules/ffuf.py,sha256=94TJ5xvqKwH0JaWmC_t1dLTpRsO8HEy4lnbsu8LF_HY,14965
|
|
102
102
|
bbot/modules/ffuf_shortnames.py,sha256=y5vnypLPN-KrjpmoG5zlqcX8VwfcLBpNg1yQI7bP9Hg,18737
|
|
103
|
-
bbot/modules/filedownload.py,sha256=
|
|
103
|
+
bbot/modules/filedownload.py,sha256=ZQZQCkXYb0lUP4DnEfL__8vc9KRi0m9hfBhClTKwy2U,8906
|
|
104
104
|
bbot/modules/fingerprintx.py,sha256=rdlR9d64AntAhbS_eJzh8bZCeLPTJPSKdkdKdhH_qAo,3269
|
|
105
105
|
bbot/modules/fullhunt.py,sha256=zeehQb9akBSbHW9dF4icH8Vfd8LqoTrpIvnQEEMWes8,1311
|
|
106
106
|
bbot/modules/generic_ssrf.py,sha256=KFdcHpUV9-Z7oN7emzbirimsNc2xZ_1IFqnsfIkEbcM,9196
|
|
107
107
|
bbot/modules/git.py,sha256=zmHeI0bn181T1P8C55HSebkdVGLTpzGxPc-LRqiHrbc,1723
|
|
108
|
-
bbot/modules/git_clone.py,sha256=
|
|
109
|
-
bbot/modules/gitdumper.py,sha256=
|
|
108
|
+
bbot/modules/git_clone.py,sha256=w-s3O6rZL_I8_BuPKotnAzXKnn7saw159jcQ_R1xtKw,2602
|
|
109
|
+
bbot/modules/gitdumper.py,sha256=d2FnSAraWftkQ9ENmkBk3_kUbuw4G3eKpsi0FXLzBss,12042
|
|
110
110
|
bbot/modules/github_codesearch.py,sha256=a-r2vE9N9WyBpFUiKCsg0TK4Qn7DaEGyVRTUKzkDLWA,3641
|
|
111
111
|
bbot/modules/github_org.py,sha256=WM18vJCHuOHJJ5rPzQzQ3Pmp7XPPuaMeVgNfW-FlO0k,8938
|
|
112
112
|
bbot/modules/github_usersearch.py,sha256=G8knkQBJsn7EKcMhcEaFPiB_Y5S96e2VaseBubsqOyk,3407
|
|
113
|
-
bbot/modules/github_workflows.py,sha256=
|
|
113
|
+
bbot/modules/github_workflows.py,sha256=xKntAFDeGuE4MqbEmhJyYXKbzoSh9tWYlHNlnF37PYA,10040
|
|
114
114
|
bbot/modules/gitlab.py,sha256=9oWWpBijeHCjuFBfWW4HvNqt7bvJvrBgBjaaz_UPPnE,5964
|
|
115
115
|
bbot/modules/google_playstore.py,sha256=N4QjzQag_bgDXfX17rytBiiWA-SQtYI2N0J_ZNEOdv0,3701
|
|
116
116
|
bbot/modules/gowitness.py,sha256=vcyZl87xJVHWTuRY032d2dORg3ykVKPIBwD2HzSxvYA,11784
|
|
@@ -133,21 +133,20 @@ bbot/modules/ipneighbor.py,sha256=b_0IhorihFLtXJZEz57EGXjXW30gIOEzzVgz2GFvM3A,15
|
|
|
133
133
|
bbot/modules/ipstack.py,sha256=j_S8WMNqQuSQgBT7AX4tO70fgbWuRYrpsS3tVsu_hn4,2200
|
|
134
134
|
bbot/modules/jadx.py,sha256=8ncbK5i3B6i253qJ5tuD3-cPl4S8qqRvnTVINFTjtvQ,3084
|
|
135
135
|
bbot/modules/leakix.py,sha256=4sKghkId5cX_eVqTSFsqdNzX5JmUemr-U7gs8PfKVVA,1561
|
|
136
|
-
bbot/modules/lightfuzz/lightfuzz.py,sha256=
|
|
136
|
+
bbot/modules/lightfuzz/lightfuzz.py,sha256=REs0wkwpvrL4bZAg8V1Ui3KFyvgWVtDSk8jP_fFcaCQ,8911
|
|
137
137
|
bbot/modules/lightfuzz/submodules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
138
138
|
bbot/modules/lightfuzz/submodules/base.py,sha256=PvMEoEqrgAmp63JufaPe9GhOn7ay3oBvvZCuFIzuwaI,12619
|
|
139
139
|
bbot/modules/lightfuzz/submodules/cmdi.py,sha256=-9pL7Yh7VVCObxuS6Qu2cKEJBstfk0oXIkMyntg8xDk,5043
|
|
140
140
|
bbot/modules/lightfuzz/submodules/crypto.py,sha256=mLWsMbcox9oruNjfdOaLmT7ePMH15K8JN9K5AIB8f8o,22560
|
|
141
|
-
bbot/modules/lightfuzz/submodules/nosqli.py,sha256=K0TlBtpfeBH72q01a3TCQnt9OsznA9kfRYVTe7Vmers,9399
|
|
142
141
|
bbot/modules/lightfuzz/submodules/path.py,sha256=cvfna9P5Cicmc3p3BrzlY0PG1slcvJkeMzZu4i2nwO0,7744
|
|
143
|
-
bbot/modules/lightfuzz/submodules/serial.py,sha256=
|
|
144
|
-
bbot/modules/lightfuzz/submodules/sqli.py,sha256=
|
|
142
|
+
bbot/modules/lightfuzz/submodules/serial.py,sha256=Vry3J0Bs3QJqgVPzxhDFmEZQt4FYzLmpOYUHr9tCgR4,9118
|
|
143
|
+
bbot/modules/lightfuzz/submodules/sqli.py,sha256=HX0wP-aVn02zzBDujpLgzXPos7w_eiSiALTNCN2O_Bo,8597
|
|
145
144
|
bbot/modules/lightfuzz/submodules/ssti.py,sha256=Pib49rXFuf567msnlec-A1Tnvolw4aILjqn7INLWQTY,1413
|
|
146
|
-
bbot/modules/lightfuzz/submodules/xss.py,sha256=
|
|
145
|
+
bbot/modules/lightfuzz/submodules/xss.py,sha256=BZz1_nqzV8dqJptpoqZEMdVBdtZHmRae3HWo3S9yzIc,9507
|
|
147
146
|
bbot/modules/myssl.py,sha256=DoMF7o6MxIrcglCrC-W3nM-GPcyJRM4PlGdKfnOlIvs,942
|
|
148
147
|
bbot/modules/newsletters.py,sha256=1Q4JjShPsxHJ-by2CbGfCvEt80blUGPX0hxQIzB_a9M,2630
|
|
149
148
|
bbot/modules/ntlm.py,sha256=EGmb4k3YC_ZuHIU3mGUZ4yaMjE35wVQQSv8HwTsQJzY,4391
|
|
150
|
-
bbot/modules/nuclei.py,sha256=
|
|
149
|
+
bbot/modules/nuclei.py,sha256=65-tgre6a738Z2s3Bo0nxhNcvQ1OuYX8zQS5x7fFk7g,17983
|
|
151
150
|
bbot/modules/oauth.py,sha256=s-Q6PYJl1OLncGgHzCV0QAzbkewT5zzKCRaa8GidBqc,6720
|
|
152
151
|
bbot/modules/otx.py,sha256=GYi5GFLKlKuRHPYMqtq42bSulerkSpAWHM6ex5eK7ww,913
|
|
153
152
|
bbot/modules/output/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
@@ -179,9 +178,9 @@ bbot/modules/paramminer_headers.py,sha256=GMErLmTO0w7JRIpJE2VFvRTrjmoux_-jTx3Efa
|
|
|
179
178
|
bbot/modules/passivetotal.py,sha256=uGT6c_CUxBNInmClsTg8afIYA2ZykKYYCgjkyzujfHg,1653
|
|
180
179
|
bbot/modules/pgp.py,sha256=Xu2M9WEIlwTm5-Lv29g7BblI05tD9Dl0XsYSeY6UURs,2065
|
|
181
180
|
bbot/modules/portfilter.py,sha256=3iu4xqCsHafhVMbA32Mw6K_7Yn576Rz6GxXMevZQEpM,1752
|
|
182
|
-
bbot/modules/portscan.py,sha256=
|
|
181
|
+
bbot/modules/portscan.py,sha256=dmR2H3Wag6vLLIXrwyU_7bvYuLIv3zdJZ2japogwFUU,13076
|
|
183
182
|
bbot/modules/postman.py,sha256=vo761Nzu3kPBzfCY3KJcvsGEsjImaa7iA2z-LyASBDc,4589
|
|
184
|
-
bbot/modules/postman_download.py,sha256=
|
|
183
|
+
bbot/modules/postman_download.py,sha256=4pvF1ePRqxPxXL1jhI0gMf1CasfVFl-xjwU-U22SFXA,3607
|
|
185
184
|
bbot/modules/rapiddns.py,sha256=uONESr0B5pv9cSAr7lF4WWV31APUhXyHexvI04rUcyk,787
|
|
186
185
|
bbot/modules/reflected_parameters.py,sha256=RjS-4C-XC9U-jC9J7AYNqwn6I-O2y3LvTRhB68dpgKI,3281
|
|
187
186
|
bbot/modules/report/affiliates.py,sha256=vvus8LylqOfP-lfGid0z4FS6MwOpNuRTcSJ9aSnybp4,1713
|
|
@@ -208,7 +207,7 @@ bbot/modules/templates/sql.py,sha256=o-CdyyoJvHJdJBKkj3CIGXYxUta4w2AB_2Vr-k7cDDU
|
|
|
208
207
|
bbot/modules/templates/subdomain_enum.py,sha256=epyKSly08jqaINV_AMMWbNafIeQjJqvd3aj63KD0Mck,8402
|
|
209
208
|
bbot/modules/templates/webhook.py,sha256=uGFmcJ81GzGN1UI2k2O7nQF_fyh4ehLDEg2NSXaPnhk,3373
|
|
210
209
|
bbot/modules/trickest.py,sha256=MRgLW0YiDWzlWdAjyqfPPLFb-a51r-Ffn_dphiJI_gA,1550
|
|
211
|
-
bbot/modules/trufflehog.py,sha256=
|
|
210
|
+
bbot/modules/trufflehog.py,sha256=TA8TVj9he12I9TtVvHdH_WJwDqLK97mATwtkuSi3l2g,8703
|
|
212
211
|
bbot/modules/url_manipulation.py,sha256=4J3oFkqTSJPPmbKEKAHJg2Q2w4QNKtQhiN03ZJq5VtI,4326
|
|
213
212
|
bbot/modules/urlscan.py,sha256=-w_3Bm6smyG2GLQyIbnMUkKmeQVauo-V6F4_kJDYG7s,3740
|
|
214
213
|
bbot/modules/vhost.py,sha256=cirOe0HR4M0TEBN8JdXo2l0s2flc8ZSdxggGm79blT8,5459
|
|
@@ -237,10 +236,10 @@ bbot/presets/web/dirbust-heavy.yml,sha256=NDqu7p0Hx1RsZCVnaEWRgI_iL9O0io-tvWerxJ
|
|
|
237
236
|
bbot/presets/web/dirbust-light.yml,sha256=5zSANdjKfYh49kFlsElYY2G6acVrZFzDCEkyqwU6oOQ,203
|
|
238
237
|
bbot/presets/web/dotnet-audit.yml,sha256=FViiccDXG08P3INNe06bLPeatejbw8Kb1HW5xgdUJNU,520
|
|
239
238
|
bbot/presets/web/iis-shortnames.yml,sha256=EcYKMpl-cI8Xb79_u4wQS42yFXxDpLH9OqINcFUXoTE,176
|
|
240
|
-
bbot/presets/web/lightfuzz-heavy.yml,sha256=
|
|
239
|
+
bbot/presets/web/lightfuzz-heavy.yml,sha256=zb7DPT-tf5MxTXkVpHn8cx2YwpbaGwZOST8vbhAOWZ0,459
|
|
241
240
|
bbot/presets/web/lightfuzz-light.yml,sha256=pkjTa5ULeOhCgRYPAoJR-cVfyhErT3I1aqmWGHTIgBk,899
|
|
242
|
-
bbot/presets/web/lightfuzz-medium.yml,sha256=
|
|
243
|
-
bbot/presets/web/lightfuzz-superheavy.yml,sha256=
|
|
241
|
+
bbot/presets/web/lightfuzz-medium.yml,sha256=LUB1Em4EQnIB387E3EiUw4AOIW9kzz3ItMb3xBBYnzE,490
|
|
242
|
+
bbot/presets/web/lightfuzz-superheavy.yml,sha256=3EaiNUCxsRqcrkhMcB70pMkMGT8BplikzSxfosprWTk,850
|
|
244
243
|
bbot/presets/web/lightfuzz-xss.yml,sha256=LMe968_iKyQhnm1nPh6zXDeNyDum2_MPkLg7ukqr93A,680
|
|
245
244
|
bbot/presets/web/paramminer.yml,sha256=8n-aDzufrZdtIlZwI0yh4-rQiwU1FPODYwmyra3l-1M,393
|
|
246
245
|
bbot/presets/web-basic.yml,sha256=6YWSYclbuf9yr8-gILDpLvOUj5QjP4rlarm5_d5iBFw,79
|
|
@@ -250,15 +249,15 @@ bbot/scanner/__init__.py,sha256=sJ7FoLQ1vwLscH8hju2PEUyGTZ_OwMVvW9b11CrCWdI,89
|
|
|
250
249
|
bbot/scanner/dispatcher.py,sha256=_hsIegfUDrt8CUdXqgRvp1J0UwwzqVSDxjQmiviO41c,793
|
|
251
250
|
bbot/scanner/manager.py,sha256=eyd_0IjnPH3e-tJSOwY-rxauVI6L9Ltr3pWmpPSO5Jc,11019
|
|
252
251
|
bbot/scanner/preset/__init__.py,sha256=If_YqKILIxjlaJvf8lFc5zQTHDkounLdC8x_72N-V10,49
|
|
253
|
-
bbot/scanner/preset/args.py,sha256=
|
|
252
|
+
bbot/scanner/preset/args.py,sha256=Oto4sO8E9hKeQn6Fp8ua_WB3xvYI97GgnBFg5f4jh0Y,19547
|
|
254
253
|
bbot/scanner/preset/conditions.py,sha256=hFL9cSIWGEsv2TfM5UGurf0c91cyaM8egb5IngBmIjA,1569
|
|
255
254
|
bbot/scanner/preset/environ.py,sha256=9KbEOLWkUdoAf5Ez_2A1NNm6QduQElbnNnrPi6VDhZs,4731
|
|
256
255
|
bbot/scanner/preset/path.py,sha256=X32-ZUmL7taIv37VKF1KfmeiK9fjuQOE7pWUTEbPK8c,2483
|
|
257
|
-
bbot/scanner/preset/preset.py,sha256=
|
|
258
|
-
bbot/scanner/scanner.py,sha256=
|
|
256
|
+
bbot/scanner/preset/preset.py,sha256=G_aMMI33d2OlzNUwjfi5ddJdxa8nK0oF5HrYAsuregU,40708
|
|
257
|
+
bbot/scanner/scanner.py,sha256=6TgnGMa_Zl4Wm6fKxujGDHGrNC6ad1pexUDCZ7xRy5I,55320
|
|
259
258
|
bbot/scanner/stats.py,sha256=re93sArKXZSiD0Owgqk2J3Kdvfm3RL4Y9Qy_VOcaVk8,3623
|
|
260
259
|
bbot/scanner/target.py,sha256=lI0Tn5prQiPiJE3WW-ZLx_l6EFqzAVabtyL-nfXJ8cE,10636
|
|
261
|
-
bbot/scripts/docs.py,sha256=
|
|
260
|
+
bbot/scripts/docs.py,sha256=aYAHlcHtMAhM-XGTDiSpzccnX1dh0Xi_WxmC2bgylQ4,11373
|
|
262
261
|
bbot/test/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
263
262
|
bbot/test/bbot_fixtures.py,sha256=XrCQDLVe80BG3QTUDnXb0y-cWnBpJJoRh2Z3J3xJn_w,9961
|
|
264
263
|
bbot/test/conftest.py,sha256=OacpJ98g00HqCoHpEnuzzMK47LkbZdJWr25Pm0SbTM0,11783
|
|
@@ -289,7 +288,7 @@ bbot/test/test_step_1/test_modules_basic.py,sha256=ELpGlsthSq8HaxB5My8-ESVHqMxqd
|
|
|
289
288
|
bbot/test/test_step_1/test_presets.py,sha256=HnJhKwDnVh9Y6adgxqe85677rWpnFil_WS5GjX21ZvM,40959
|
|
290
289
|
bbot/test/test_step_1/test_python_api.py,sha256=Fk5bxEsPSjsMZ_CcRMTJft8I48EizwHJivG9Fy4jIu0,5502
|
|
291
290
|
bbot/test/test_step_1/test_regexes.py,sha256=wSx_e6hgHuBh95igL_fauWKK4a1xXujs9TtyLBaMwRM,14636
|
|
292
|
-
bbot/test/test_step_1/test_scan.py,sha256=
|
|
291
|
+
bbot/test/test_step_1/test_scan.py,sha256=jGySAMGb0gXirJpDniX6SSm4TbpHYrkGHcDPpJRGHQg,10676
|
|
293
292
|
bbot/test/test_step_1/test_scope.py,sha256=S2nssENKJKCvgXUMyU8MFQmXHeUIz0C_sbWGkdYti2A,3063
|
|
294
293
|
bbot/test/test_step_1/test_target.py,sha256=4Xz6Fns_6wa2O3AXDBvd7W04LCfZSCiit2lezQJicTI,19472
|
|
295
294
|
bbot/test/test_step_1/test_web.py,sha256=qzMb5v_1l6fK6SvJZoHpBI3Zb7iaHU_VnenQ8UQIK-4,19637
|
|
@@ -301,7 +300,7 @@ bbot/test/test_step_2/module_tests/test_module_affiliates.py,sha256=d6uAzb_MF4oN
|
|
|
301
300
|
bbot/test/test_step_2/module_tests/test_module_aggregate.py,sha256=hjxbMxAEFhS7W8RamBrM1t6T-tsLHq95MmQVfrYsock,487
|
|
302
301
|
bbot/test/test_step_2/module_tests/test_module_ajaxpro.py,sha256=S2pFV0TgOJ01SMHnIxcoBkGZ8SAaQVY9o32DOFoZ1u4,3857
|
|
303
302
|
bbot/test/test_step_2/module_tests/test_module_anubisdb.py,sha256=y_GMm20Fy4z9L0fN2dYOExaSsi8Z9PwMKnAjSsYhBk8,545
|
|
304
|
-
bbot/test/test_step_2/module_tests/test_module_apkpure.py,sha256
|
|
303
|
+
bbot/test/test_step_2/module_tests/test_module_apkpure.py,sha256=-G4hoRPFhNH-rj6MvuhqlwiXHqBqHgfFGYxbzoyKz2s,2983
|
|
305
304
|
bbot/test/test_step_2/module_tests/test_module_asn.py,sha256=qIbitSAEAmYyxhpxvdFDsQrHaaxfgKsFox9Q3jTmvgI,10616
|
|
306
305
|
bbot/test/test_step_2/module_tests/test_module_asset_inventory.py,sha256=NEMSPBlczpA5NbQpIcRBpRXpVnfS9lmSS1U7eJmIXAU,3878
|
|
307
306
|
bbot/test/test_step_2/module_tests/test_module_azure_realm.py,sha256=gPRvGA9RHsAcYlHxQG0lHZOYolyzbe6L-ALGIvW-Mg0,1288
|
|
@@ -315,7 +314,7 @@ bbot/test/test_step_2/module_tests/test_module_binaryedge.py,sha256=tK1fv4o2JOxa
|
|
|
315
314
|
bbot/test/test_step_2/module_tests/test_module_bucket_amazon.py,sha256=bKTnrR3FfCaAXZTWJh2m4bm-Pa1xiJV9lY2N_waaq2s,4002
|
|
316
315
|
bbot/test/test_step_2/module_tests/test_module_bucket_azure.py,sha256=CUK1OHGhA-piIzPG15UNiMdaK1oSSCwCv_WPcCvC4VQ,2112
|
|
317
316
|
bbot/test/test_step_2/module_tests/test_module_bucket_digitalocean.py,sha256=EFzScFloY6DQVD7MbvQOfsSp_8tApV4epKFm9OP1_ZM,907
|
|
318
|
-
bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py,sha256=
|
|
317
|
+
bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py,sha256=7n7eFWQJanZjyammwBDM9Jmt5kJ8AXn9eS4fmKEBqm4,2463
|
|
319
318
|
bbot/test/test_step_2/module_tests/test_module_bucket_firebase.py,sha256=gM3h1staY3tEHF2l9cYgRhaVwEg7ykfo4E0mvhqTA0g,506
|
|
320
319
|
bbot/test/test_step_2/module_tests/test_module_bucket_google.py,sha256=wXROpF9TSQVOa8cGTOo8k9uDEj7H5pNAcppj4WR3qnY,1312
|
|
321
320
|
bbot/test/test_step_2/module_tests/test_module_bufferoverrun.py,sha256=6pyJ0dbx8u0BPVXyiqdDPgECLGfIGkWPHZ35tbBzoPg,1582
|
|
@@ -342,7 +341,7 @@ bbot/test/test_step_2/module_tests/test_module_dnscommonsrv.py,sha256=_dqcgVQAc1
|
|
|
342
341
|
bbot/test/test_step_2/module_tests/test_module_dnsdumpster.py,sha256=p--1JaDb7PjiAYRQiAQ_qYBQAQgkBzB1iLnDp6B0UCk,59745
|
|
343
342
|
bbot/test/test_step_2/module_tests/test_module_dnsresolve.py,sha256=15LEcggP_eVYFQdMO1zHTvoGc6n8IaUjsQDmX0sZS4o,2077
|
|
344
343
|
bbot/test/test_step_2/module_tests/test_module_dnstlsrpt.py,sha256=8xXSFo0vwKfehIqgF41tbEkL1vbp6RIB8kiO8TSH4NU,2648
|
|
345
|
-
bbot/test/test_step_2/module_tests/test_module_docker_pull.py,sha256
|
|
344
|
+
bbot/test/test_step_2/module_tests/test_module_docker_pull.py,sha256=SKc43IKzwoi74qaY8felJXnrgNVXrXRQlg6BtrSjyAc,28151
|
|
346
345
|
bbot/test/test_step_2/module_tests/test_module_dockerhub.py,sha256=9T8CFcFP32MOppUmSVNBUSifnk2kMONqzW_7vvvKdpk,3907
|
|
347
346
|
bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py,sha256=Q7M3hrbEwOuORZXPS-pIGFTRzB2-g4cEvGtsEcTp7t8,8049
|
|
348
347
|
bbot/test/test_step_2/module_tests/test_module_emailformat.py,sha256=cKxBPnEQ4AiRKV_-hSYEE6756ypst3hi6MN0L5RTukY,461
|
|
@@ -351,13 +350,13 @@ bbot/test/test_step_2/module_tests/test_module_excavate.py,sha256=hoVQnZYb_tI1Fl
|
|
|
351
350
|
bbot/test/test_step_2/module_tests/test_module_extractous.py,sha256=PuTE5rkEIFPwU9lhCYpTgNSkrVjcXm8PClbfOkfRS84,17973
|
|
352
351
|
bbot/test/test_step_2/module_tests/test_module_ffuf.py,sha256=z8ihAM1WYss7QGXIjbi67cekg8iOemDjaM8YR9_qSEs,4100
|
|
353
352
|
bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py,sha256=0-a9J-gq8bUtmxl_-QPVidwZ9KkCvgvoG30Ot3a8lqM,8406
|
|
354
|
-
bbot/test/test_step_2/module_tests/test_module_filedownload.py,sha256=
|
|
353
|
+
bbot/test/test_step_2/module_tests/test_module_filedownload.py,sha256=Fd_5DKA0VaHyCR6qS5WPS9CoyPKFeBTswhAwM5RsU-c,4473
|
|
355
354
|
bbot/test/test_step_2/module_tests/test_module_fingerprintx.py,sha256=nU3jxbkGcmPYiSzc6thJhNvjAFb4qVxcR7rkOAvjB18,445
|
|
356
355
|
bbot/test/test_step_2/module_tests/test_module_fullhunt.py,sha256=NblfNHQrE82j-cESvm66hpN-ooKZwR1kEwJDTk_BXac,1946
|
|
357
356
|
bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py,sha256=ZhfZpH0QTl6_YftGoZzZk6_2x0ZDnWjZ7vNZMTibBHw,3228
|
|
358
357
|
bbot/test/test_step_2/module_tests/test_module_git.py,sha256=gyBS3vZUWAyatGlcY26mGOYeqXSqJA5pbhJWgTmLqNo,1656
|
|
359
|
-
bbot/test/test_step_2/module_tests/test_module_git_clone.py,sha256=
|
|
360
|
-
bbot/test/test_step_2/module_tests/test_module_gitdumper.py,sha256=
|
|
358
|
+
bbot/test/test_step_2/module_tests/test_module_git_clone.py,sha256=z97IZLTVaa3aJ9O3NDP3MaOnmDocL-kT8kT-1rMAqn0,13318
|
|
359
|
+
bbot/test/test_step_2/module_tests/test_module_gitdumper.py,sha256=bsSly-OOyDuFffVmwJpm7aEafrSHgLAk_VsJ69S3LUo,17616
|
|
361
360
|
bbot/test/test_step_2/module_tests/test_module_github_codesearch.py,sha256=M50xBiGG2EuPGXDJU6uFsSUE-fhqZl3CzYtNdszW7LM,4735
|
|
362
361
|
bbot/test/test_step_2/module_tests/test_module_github_org.py,sha256=5tKO6NH4TPBeIdeTf7Bz9PUZ1pcvKsjrG0nFhc3YgT0,25458
|
|
363
362
|
bbot/test/test_step_2/module_tests/test_module_github_usersearch.py,sha256=IIQ0tYZjQN8_L8u_N4m8Nz3kbB4IyBp95tYCPcQeScg,5264
|
|
@@ -378,7 +377,7 @@ bbot/test/test_step_2/module_tests/test_module_ipstack.py,sha256=C0Le03UqvShpATo
|
|
|
378
377
|
bbot/test/test_step_2/module_tests/test_module_jadx.py,sha256=qTBfDc_Iv03n8iGdyLm6kBaKeEdSxFYeKj5xL1PmyF0,2391
|
|
379
378
|
bbot/test/test_step_2/module_tests/test_module_json.py,sha256=gmlqge5ZJpjVMGs7OLZBsNlSFTTrKnKjIZMIU23o8VQ,3350
|
|
380
379
|
bbot/test/test_step_2/module_tests/test_module_leakix.py,sha256=DQaQsL4ewpuYeygp-sgcvdeOSzvHq77_eYjKcgebS7A,1817
|
|
381
|
-
bbot/test/test_step_2/module_tests/test_module_lightfuzz.py,sha256=
|
|
380
|
+
bbot/test/test_step_2/module_tests/test_module_lightfuzz.py,sha256=W8IrU5WEBESR8xZUNVHWzLqjDVuVj2m_5q0xiGZwYAo,72050
|
|
382
381
|
bbot/test/test_step_2/module_tests/test_module_medusa.py,sha256=vYoAyMf0LbIXCoUzLycOISZtF7M58E30WjuLuqxDiCg,1671
|
|
383
382
|
bbot/test/test_step_2/module_tests/test_module_mysql.py,sha256=4wAPjbjhlxmOkEhQnIQIBC2BLEaE57TX6lChGZ3zLsU,2630
|
|
384
383
|
bbot/test/test_step_2/module_tests/test_module_myssl.py,sha256=zRJ1sOEespWtBx2jA07bW5sHD1XQ9pV0PtHtGogo7Gs,1531
|
|
@@ -395,10 +394,10 @@ bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py,sha256=8hRU
|
|
|
395
394
|
bbot/test/test_step_2/module_tests/test_module_passivetotal.py,sha256=fTGQECQ0OzcwiH64-0igFRKO-rs3kXScivZord_oWWU,1120
|
|
396
395
|
bbot/test/test_step_2/module_tests/test_module_pgp.py,sha256=_T-kmpr5F0cJHl4_mpfhxK3aj0hH3UxDLeV1iByanJk,1607
|
|
397
396
|
bbot/test/test_step_2/module_tests/test_module_portfilter.py,sha256=gOEy1XYtTJNGvTH6o3NNSOXXPdste462BdQvayOwzVs,2012
|
|
398
|
-
bbot/test/test_step_2/module_tests/test_module_portscan.py,sha256=
|
|
397
|
+
bbot/test/test_step_2/module_tests/test_module_portscan.py,sha256=I42EhBN736JShaek5TvE-NHD8X3hcVxXLHhlJcqquYQ,7539
|
|
399
398
|
bbot/test/test_step_2/module_tests/test_module_postgres.py,sha256=bNHzDvPs5AkoA_ho7s50bFaF5qzV7KL3DplhOA1ZYa4,2688
|
|
400
399
|
bbot/test/test_step_2/module_tests/test_module_postman.py,sha256=7SxZi39dJhnwyg4IVf5M8VNdQU_zaPAufTEw60rgCkg,22311
|
|
401
|
-
bbot/test/test_step_2/module_tests/test_module_postman_download.py,sha256=
|
|
400
|
+
bbot/test/test_step_2/module_tests/test_module_postman_download.py,sha256=u3lF7Uve8riHNCj9XEFrRBONQHUzccsfq-qEkwQ51wE,14225
|
|
402
401
|
bbot/test/test_step_2/module_tests/test_module_python.py,sha256=6UQVXGJ1ugfNbt9l_nN0q5FVxNWlpq6j0sZcB0Nh_Pg,184
|
|
403
402
|
bbot/test/test_step_2/module_tests/test_module_rapiddns.py,sha256=zXHNLnUjLO22yRwrDFCZ40sRTmFVZEj9q_dyK8w1TYM,4441
|
|
404
403
|
bbot/test/test_step_2/module_tests/test_module_reflected_parameters.py,sha256=4cY8yK9iImB1O68pi1lACcPEtNQ9-sud9Xl16fYB8cU,9003
|
|
@@ -423,7 +422,7 @@ bbot/test/test_step_2/module_tests/test_module_subdomains.py,sha256=r1zCmw5ZZ_0w
|
|
|
423
422
|
bbot/test/test_step_2/module_tests/test_module_teams.py,sha256=r91ZZxhj3pEhKnjr1jGwhcqOPXTqNJNupC1CDKccfH8,1638
|
|
424
423
|
bbot/test/test_step_2/module_tests/test_module_telerik.py,sha256=vGORDSRU1S1hkLlHO3KOdoAYLqWcrPpvVGxadTGl5y8,11099
|
|
425
424
|
bbot/test/test_step_2/module_tests/test_module_trickest.py,sha256=6mTYH6fIah-WbKnFI-_WZBwRdKFi-oeWyVtl1n0nVAU,1630
|
|
426
|
-
bbot/test/test_step_2/module_tests/test_module_trufflehog.py,sha256=
|
|
425
|
+
bbot/test/test_step_2/module_tests/test_module_trufflehog.py,sha256=lXX2KYh5s1FVpivth43Nj3MLfMkiksrooEne_DAL_qg,96796
|
|
427
426
|
bbot/test/test_step_2/module_tests/test_module_txt.py,sha256=R-EBfEZM0jwY2yuVyfYhoccDOl0Y2uQZSkXQ1HyinUA,247
|
|
428
427
|
bbot/test/test_step_2/module_tests/test_module_unarchive.py,sha256=--p2kpnyfbABuJI5qmDbD-K_D5e4Icvq5VzEyp6AWVE,10676
|
|
429
428
|
bbot/test/test_step_2/module_tests/test_module_url_manipulation.py,sha256=aP3nK2TQQOjk0ZeuHhHYfZm_e37qrrXbnufd7m-QeJU,1144
|
|
@@ -452,8 +451,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ZSIVebs7ptMvHx
|
|
|
452
451
|
bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
|
|
453
452
|
bbot/wordlists/valid_url_schemes.txt,sha256=0B_VAr9Dv7aYhwi6JSBDU-3M76vNtzN0qEC_RNLo7HE,3310
|
|
454
453
|
bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
|
|
455
|
-
bbot-2.
|
|
456
|
-
bbot-2.
|
|
457
|
-
bbot-2.
|
|
458
|
-
bbot-2.
|
|
459
|
-
bbot-2.
|
|
454
|
+
bbot-2.5.0.6715rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
|
|
455
|
+
bbot-2.5.0.6715rc0.dist-info/METADATA,sha256=RwysEf_RUW3X7xCtPJoRvVHFtoZBYaKOfg6Rs2XMkUI,18308
|
|
456
|
+
bbot-2.5.0.6715rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
|
|
457
|
+
bbot-2.5.0.6715rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
|
|
458
|
+
bbot-2.5.0.6715rc0.dist-info/RECORD,,
|
|
@@ -1,183 +0,0 @@
|
|
|
1
|
-
from .base import BaseLightfuzz
|
|
2
|
-
from bbot.errors import HttpCompareError
|
|
3
|
-
import urllib.parse
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
class nosqli(BaseLightfuzz):
|
|
7
|
-
"""
|
|
8
|
-
Detects NoSQL injection vulnerabilities.
|
|
9
|
-
|
|
10
|
-
Techniques:
|
|
11
|
-
|
|
12
|
-
* Quote Injection Analysis:
|
|
13
|
-
- Injects single quotes and escaped single quotes into parameters
|
|
14
|
-
- Compares response differences between the two to detect NoSQL parsing
|
|
15
|
-
- Uses baseline comparison to validate findings and reduce false positives
|
|
16
|
-
|
|
17
|
-
* Operator Injection:
|
|
18
|
-
- Tests MongoDB-style operator injection using [$eq] and [$ne]
|
|
19
|
-
- Modifies parameter names to include operators
|
|
20
|
-
- Detects behavioral changes in application responses
|
|
21
|
-
|
|
22
|
-
Validation of findings is achieved using confirmation probes to rule out unstable endpoints
|
|
23
|
-
"""
|
|
24
|
-
|
|
25
|
-
friendly_name = "NoSQL Injection"
|
|
26
|
-
|
|
27
|
-
async def fuzz(self):
|
|
28
|
-
cookies = self.event.data.get("assigned_cookies", {})
|
|
29
|
-
probe_value = self.incoming_probe_value(populate_empty=True)
|
|
30
|
-
quote_probe_baseline = None
|
|
31
|
-
try:
|
|
32
|
-
quote_probe_baseline = self.compare_baseline(
|
|
33
|
-
self.event.data["type"], probe_value, cookies, additional_params_populate_empty=True
|
|
34
|
-
)
|
|
35
|
-
except HttpCompareError as e:
|
|
36
|
-
self.verbose(f"Encountered HttpCompareError Sending Compare Baseline: {e}")
|
|
37
|
-
|
|
38
|
-
if quote_probe_baseline:
|
|
39
|
-
try:
|
|
40
|
-
# send the with a single quote, and then another with an escaped single quote
|
|
41
|
-
(
|
|
42
|
-
single_quote_comparison,
|
|
43
|
-
single_quote_diff_reasons,
|
|
44
|
-
single_quote_reflection,
|
|
45
|
-
single_quote_response,
|
|
46
|
-
) = await self.compare_probe(
|
|
47
|
-
quote_probe_baseline,
|
|
48
|
-
self.event.data["type"],
|
|
49
|
-
f"{probe_value}'",
|
|
50
|
-
cookies,
|
|
51
|
-
additional_params_populate_empty=True,
|
|
52
|
-
)
|
|
53
|
-
(
|
|
54
|
-
escaped_single_quote_comparison,
|
|
55
|
-
escaped_single_quote_diff_reasons,
|
|
56
|
-
escaped_single_quote_reflection,
|
|
57
|
-
escaped_single_quote_response,
|
|
58
|
-
) = await self.compare_probe(
|
|
59
|
-
quote_probe_baseline,
|
|
60
|
-
self.event.data["type"],
|
|
61
|
-
rf"{probe_value}\'",
|
|
62
|
-
cookies,
|
|
63
|
-
additional_params_populate_empty=True,
|
|
64
|
-
)
|
|
65
|
-
if not single_quote_comparison and single_quote_response and escaped_single_quote_response:
|
|
66
|
-
# if the single quote probe changed the code or body, and the escaped single quote probe did not cause the same change, injection is possible
|
|
67
|
-
if ("code" in single_quote_diff_reasons or "body" in single_quote_diff_reasons) and (
|
|
68
|
-
single_quote_diff_reasons != escaped_single_quote_diff_reasons
|
|
69
|
-
):
|
|
70
|
-
self.verbose(
|
|
71
|
-
"Initial heuristic indicates possible NoSQL Injection, sending confirmation probes"
|
|
72
|
-
)
|
|
73
|
-
confirm_baseline = self.compare_baseline(
|
|
74
|
-
self.event.data["type"],
|
|
75
|
-
urllib.parse.quote(f"{probe_value}' && 0 && 'x", safe=""),
|
|
76
|
-
cookies,
|
|
77
|
-
additional_params_populate_empty=True,
|
|
78
|
-
skip_urlencoding=True,
|
|
79
|
-
)
|
|
80
|
-
(
|
|
81
|
-
confirmation_probe_false_comparison,
|
|
82
|
-
confirmation_probe_false_diff_reasons,
|
|
83
|
-
confirmation_probe_false_reflection,
|
|
84
|
-
confirmation_probe_false_response,
|
|
85
|
-
) = await self.compare_probe(
|
|
86
|
-
confirm_baseline,
|
|
87
|
-
self.event.data["type"],
|
|
88
|
-
urllib.parse.quote(f"{probe_value}' && 1 && 'x", safe=""),
|
|
89
|
-
cookies,
|
|
90
|
-
additional_params_populate_empty=True,
|
|
91
|
-
skip_urlencoding=True,
|
|
92
|
-
)
|
|
93
|
-
if confirmation_probe_false_response:
|
|
94
|
-
if not confirmation_probe_false_comparison and confirmation_probe_false_diff_reasons != [
|
|
95
|
-
"header"
|
|
96
|
-
]:
|
|
97
|
-
(
|
|
98
|
-
final_confirm_comparison,
|
|
99
|
-
final_confirm_diff_reasons,
|
|
100
|
-
final_confirm_reflection,
|
|
101
|
-
final_confirm_response,
|
|
102
|
-
) = await self.compare_probe(
|
|
103
|
-
confirm_baseline,
|
|
104
|
-
self.event.data["type"],
|
|
105
|
-
urllib.parse.quote(f"{probe_value}' && 0 && 'x", safe=""),
|
|
106
|
-
cookies,
|
|
107
|
-
additional_params_populate_empty=True,
|
|
108
|
-
skip_urlencoding=True,
|
|
109
|
-
)
|
|
110
|
-
|
|
111
|
-
if final_confirm_response and final_confirm_comparison:
|
|
112
|
-
self.results.append(
|
|
113
|
-
{
|
|
114
|
-
"type": "FINDING",
|
|
115
|
-
"description": f"Possible NoSQL Injection. {self.metadata()} Detection Method: [Quote/Escaped Quote + Conditional Affect] Differences: [{'.'.join(confirmation_probe_false_diff_reasons)}]",
|
|
116
|
-
}
|
|
117
|
-
)
|
|
118
|
-
else:
|
|
119
|
-
self.verbose(
|
|
120
|
-
"Aborted reporting Possible NoSQL Injection, due to unstable/inconsistent responses"
|
|
121
|
-
)
|
|
122
|
-
|
|
123
|
-
except HttpCompareError as e:
|
|
124
|
-
self.verbose(f"Encountered HttpCompareError Sending Compare Probe: {e}")
|
|
125
|
-
|
|
126
|
-
# Comparison operator injection
|
|
127
|
-
if self.event.data["type"] in ["POSTPARAM", "GETPARAM"]:
|
|
128
|
-
nosqli_negation_baseline = None
|
|
129
|
-
|
|
130
|
-
try:
|
|
131
|
-
nosqli_negation_baseline = self.compare_baseline(
|
|
132
|
-
self.event.data["type"],
|
|
133
|
-
f"{probe_value}'",
|
|
134
|
-
cookies,
|
|
135
|
-
additional_params_populate_empty=True,
|
|
136
|
-
parameter_name_suffix="[$eq]",
|
|
137
|
-
parameter_name_suffix_additional_params="[$eq]",
|
|
138
|
-
)
|
|
139
|
-
except HttpCompareError as e:
|
|
140
|
-
self.verbose(f"Encountered HttpCompareError Sending Compare Baseline: {e}")
|
|
141
|
-
|
|
142
|
-
if nosqli_negation_baseline:
|
|
143
|
-
try:
|
|
144
|
-
(
|
|
145
|
-
nosqli_negate_comparison,
|
|
146
|
-
nosqli_negate_diff_reasons,
|
|
147
|
-
nosqli_negate_reflection,
|
|
148
|
-
nosqli_negate_response,
|
|
149
|
-
) = await self.compare_probe(
|
|
150
|
-
nosqli_negation_baseline,
|
|
151
|
-
self.event.data["type"],
|
|
152
|
-
f"{probe_value}'",
|
|
153
|
-
cookies,
|
|
154
|
-
additional_params_populate_empty=True,
|
|
155
|
-
parameter_name_suffix="[$ne]",
|
|
156
|
-
parameter_name_suffix_additional_params="[$ne]",
|
|
157
|
-
)
|
|
158
|
-
if nosqli_negate_response:
|
|
159
|
-
if not nosqli_negate_comparison and nosqli_negate_diff_reasons != ["header"]:
|
|
160
|
-
# If we are about to report a finding, rule out a false positive from unstable URL by sending another probe with the baseline values, and ensure those dont also come back as different
|
|
161
|
-
(
|
|
162
|
-
nosqli_negate_comfirm_comparison,
|
|
163
|
-
nosqli_negate_confirm_diff_reasons,
|
|
164
|
-
nosqli_negate_confirm_reflection,
|
|
165
|
-
nosqli_negate_confirm_response,
|
|
166
|
-
) = await self.compare_probe(
|
|
167
|
-
nosqli_negation_baseline,
|
|
168
|
-
self.event.data["type"],
|
|
169
|
-
f"{probe_value}'",
|
|
170
|
-
cookies,
|
|
171
|
-
additional_params_populate_empty=True,
|
|
172
|
-
parameter_name_suffix="[$eq]",
|
|
173
|
-
parameter_name_suffix_additional_params="[$eq]",
|
|
174
|
-
)
|
|
175
|
-
if nosqli_negate_comfirm_comparison:
|
|
176
|
-
self.results.append(
|
|
177
|
-
{
|
|
178
|
-
"type": "FINDING",
|
|
179
|
-
"description": f"Possible NoSQL Injection. {self.metadata()} Detection Method: [Parameter Name Operator Injection - Negation ([$ne])] Differences: [{'.'.join(nosqli_negate_diff_reasons)}]",
|
|
180
|
-
}
|
|
181
|
-
)
|
|
182
|
-
except HttpCompareError as e:
|
|
183
|
-
self.verbose(f"Encountered HttpCompareError Sending Compare Probe: {e}")
|
|
File without changes
|
|
File without changes
|
|
File without changes
|