bbot 2.4.2.6677rc0__py3-none-any.whl → 2.5.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. bbot/__init__.py +1 -1
  2. bbot/core/helpers/async_helpers.py +29 -8
  3. bbot/defaults.yml +6 -0
  4. bbot/modules/apkpure.py +5 -3
  5. bbot/modules/base.py +86 -32
  6. bbot/modules/docker_pull.py +3 -3
  7. bbot/modules/filedownload.py +8 -4
  8. bbot/modules/git_clone.py +5 -2
  9. bbot/modules/gitdumper.py +14 -5
  10. bbot/modules/github_workflows.py +12 -5
  11. bbot/modules/lightfuzz/lightfuzz.py +1 -1
  12. bbot/modules/lightfuzz/submodules/serial.py +11 -1
  13. bbot/modules/lightfuzz/submodules/sqli.py +1 -0
  14. bbot/modules/lightfuzz/submodules/xss.py +4 -4
  15. bbot/modules/nuclei.py +4 -2
  16. bbot/modules/portscan.py +2 -0
  17. bbot/modules/postman_download.py +6 -3
  18. bbot/modules/trufflehog.py +1 -2
  19. bbot/presets/web/lightfuzz-heavy.yml +1 -1
  20. bbot/presets/web/lightfuzz-medium.yml +1 -1
  21. bbot/presets/web/lightfuzz-superheavy.yml +1 -1
  22. bbot/scanner/preset/args.py +10 -1
  23. bbot/scanner/preset/preset.py +0 -2
  24. bbot/scanner/scanner.py +1 -4
  25. bbot/scripts/docs.py +8 -0
  26. bbot/test/test_step_1/test_scan.py +57 -0
  27. bbot/test/test_step_2/module_tests/test_module_apkpure.py +2 -0
  28. bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py +8 -3
  29. bbot/test/test_step_2/module_tests/test_module_docker_pull.py +2 -0
  30. bbot/test/test_step_2/module_tests/test_module_filedownload.py +5 -1
  31. bbot/test/test_step_2/module_tests/test_module_git_clone.py +4 -1
  32. bbot/test/test_step_2/module_tests/test_module_gitdumper.py +2 -0
  33. bbot/test/test_step_2/module_tests/test_module_lightfuzz.py +2 -130
  34. bbot/test/test_step_2/module_tests/test_module_portscan.py +3 -3
  35. bbot/test/test_step_2/module_tests/test_module_postman_download.py +6 -1
  36. bbot/test/test_step_2/module_tests/test_module_trufflehog.py +38 -12
  37. {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.dist-info}/METADATA +1 -1
  38. {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.dist-info}/RECORD +41 -42
  39. bbot/modules/lightfuzz/submodules/nosqli.py +0 -183
  40. {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.dist-info}/LICENSE +0 -0
  41. {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.dist-info}/WHEEL +0 -0
  42. {bbot-2.4.2.6677rc0.dist-info → bbot-2.5.0.dist-info}/entry_points.txt +0 -0
@@ -1,4 +1,4 @@
1
- bbot/__init__.py,sha256=bmNeDHa64LphmNVvCdHjCmGtQexQBcOVguArCx7r5Dw,163
1
+ bbot/__init__.py,sha256=SrqIiLg5ckclQXuun2tnMceqVpyEDl8Sxplrxo3NIwc,156
2
2
  bbot/cli.py,sha256=1QJbANVw9Q3GFM92H2QRV2ds5756ulm08CDZwzwPpeI,11888
3
3
  bbot/core/__init__.py,sha256=l255GJE_DvUnWvrRb0J5lG-iMztJ8zVvoweDOfegGtI,46
4
4
  bbot/core/config/__init__.py,sha256=zYNw2Me6tsEr8hOOkLb4BQ97GB7Kis2k--G81S8vofU,342
@@ -11,7 +11,7 @@ bbot/core/event/base.py,sha256=1jUgd3I3TDITKoobh92ir_tIm38EN1ZbhoaX1W9fKts,67125
11
11
  bbot/core/event/helpers.py,sha256=MohOCVBjkn_K1p4Ipgx-MKliZtV6l4NJPq3YgagkvSM,6507
12
12
  bbot/core/flags.py,sha256=Ltvm8Bc4D65I55HuU5bzyjO1R3yMDNpVmreGU83ZBXE,1266
13
13
  bbot/core/helpers/__init__.py,sha256=cpOGLKIgA3vdHYqsOtx63BFO_qbtwCmez2amFPu6YTs,111
14
- bbot/core/helpers/async_helpers.py,sha256=3GVvRXEdRe3hAClTOSaIGb8Rn-_gM6l0IBQlaaNIsNA,3723
14
+ bbot/core/helpers/async_helpers.py,sha256=bVHEUIOZo8iCmuovLYb3oNLPdLFUoEyc6wZIIvtELVs,4399
15
15
  bbot/core/helpers/bloom.py,sha256=gk02rO6x3F5MICa7ZUDsinRudwoGAifsbiyiMCwd0Gs,2739
16
16
  bbot/core/helpers/cache.py,sha256=1aMr3HVD45cDtHEG5xlznDUCywRgO9oRFidscrs_5sA,1537
17
17
  bbot/core/helpers/command.py,sha256=UBJa2RInEJtGjZ5e24PUQxPu1aTCIFkcCrrB0ERLdGI,12810
@@ -50,20 +50,20 @@ bbot/core/modules.py,sha256=G4rRVF1bQzp62kwpgxwMa_FTV4-huWwtcd6HpW9jQf0,31970
50
50
  bbot/core/multiprocess.py,sha256=ocQHanskJ09gHwe7RZmwNdZyCOQyeyUoIHCtLbtvXUk,1771
51
51
  bbot/core/shared_deps.py,sha256=mCMZeKSt46trzVqQDPGfXfEWg0Zw5YjiJx4BnsIRgHM,7640
52
52
  bbot/db/sql/models.py,sha256=SrUdDOBCICzXJBY29p0VvILhMQ1JCuh725bqvIYogX0,4884
53
- bbot/defaults.yml,sha256=CQLKUpvLJMAOf0ukc9orvBCdvFm0u3lL-9bei4_UPdU,7517
53
+ bbot/defaults.yml,sha256=TTxtlnyE9vPihXjkGMDbBpNRlGa48GhRXS23iFsKUAg,7830
54
54
  bbot/errors.py,sha256=xwQcD26nU9oc7-o0kv5jmEDTInmi8_W8eKAgQZZxdVM,953
55
55
  bbot/logger.py,sha256=wE-532v5FyKuSSoTdyW1xSfaOnLZB1axAJnB-uW2xrI,2745
56
56
  bbot/modules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
57
57
  bbot/modules/ajaxpro.py,sha256=daE1yQoCsSI5c4dh3YKwRSggTISNjWgrK7qTPidk7cU,3764
58
58
  bbot/modules/anubisdb.py,sha256=JCy2YCfa0e_VawpzNmcPXAosKUthmYGutireJ0gMDws,1916
59
- bbot/modules/apkpure.py,sha256=V-bGIFV7b91kXo24OitACip8Rx5qaoI1p6iHwbICxwk,2434
59
+ bbot/modules/apkpure.py,sha256=a_VRujUOIk7SVWyI9-N-nJVqfMApciIRdXVc-y_Ebuw,2558
60
60
  bbot/modules/azure_realm.py,sha256=pP2PUlLy0K9KKaE8aNcznWjDW3PKHvnMejdOSc-o4ms,1612
61
61
  bbot/modules/azure_tenant.py,sha256=qBn7CUA_hth2PqW55XZVjYxIw20xLYrMntXc6mYpmKU,5366
62
62
  bbot/modules/baddns.py,sha256=ubO3KDfcIMJnMjyZX5FWZ4GWxLSekV_JQV7QvsPjtD0,6693
63
63
  bbot/modules/baddns_direct.py,sha256=hWThpkXP87nnCRTlUh5qBJ1t4eo4l9kUmKNNxVNJI8A,3819
64
64
  bbot/modules/baddns_zone.py,sha256=y1XaBUfFPnRbR2qaTqRyUsPgEL73722v2B8aS5YoGN4,1035
65
65
  bbot/modules/badsecrets.py,sha256=LG37p48Rlxsfc3BmACMpkypsbuFTVvXqNhlP1IEsx0k,5109
66
- bbot/modules/base.py,sha256=2P-cCiFCBm9ov7z2WE7kWC_fncRiooD5604E_uOUYNE,75356
66
+ bbot/modules/base.py,sha256=qH5nmYRP3Gc9z8ddr0iY1DR7b68tatv4M0IB-SjDobU,78162
67
67
  bbot/modules/bevigil.py,sha256=0VLIxmeXRUI2-EoR6IzuHJMcX8KCHNNta-WYa3gVlDg,2862
68
68
  bbot/modules/binaryedge.py,sha256=5F9LnZwRM_rZnzTv29hLJLI2GEQdzOwSpahPFC1kJC0,1397
69
69
  bbot/modules/bucket_amazon.py,sha256=mwjYeEAcdfOpjbOa1sD8U9KBMMVY_c8FoHjSGR9GQbg,730
@@ -93,24 +93,24 @@ bbot/modules/dnscaa.py,sha256=pyaLqHrdsVhqtd1JBZVjKKcuYT_ywUbFYkrnfXcGD5s,5014
93
93
  bbot/modules/dnscommonsrv.py,sha256=gEErfSur7Odkaif4CbXYx3OZ3FQrQESyiMGPbcDKSIg,1538
94
94
  bbot/modules/dnsdumpster.py,sha256=bqUqyvRJVtoTXbDxTZ-kgPNq4dCE9xv_msBIn_Nj5IM,3251
95
95
  bbot/modules/dnstlsrpt.py,sha256=ntNKVDXDgDVWr1A20ShNT5HFBhXsVEM5aUIEU_0c9HU,6427
96
- bbot/modules/docker_pull.py,sha256=N0wOGPasrqiBt7z1Y89t6E0ldZd8a2pw_kabPEwyzb4,9072
96
+ bbot/modules/docker_pull.py,sha256=3Ui5z3pNfZDgX8q25h-LwKvUM7FDPST2dz1vk_I8gDc,9192
97
97
  bbot/modules/dockerhub.py,sha256=JQkujjqvQRzQuvHjQ7JbFs_VlJj8dLRPRObAkBgUQhc,3493
98
98
  bbot/modules/dotnetnuke.py,sha256=zipcHyNYr2FEecStb1Yrm938ps01RvHV8NnyqAvnGGc,10537
99
99
  bbot/modules/emailformat.py,sha256=RLPJW-xitYB-VT4Lp08qVzFkXx_kMyV_035JT_Yf4fM,1082
100
100
  bbot/modules/extractous.py,sha256=VSGKmHPAA_4r62jaN8Yqi3JcjehjxpI2lhe8i2j786s,4648
101
101
  bbot/modules/ffuf.py,sha256=94TJ5xvqKwH0JaWmC_t1dLTpRsO8HEy4lnbsu8LF_HY,14965
102
102
  bbot/modules/ffuf_shortnames.py,sha256=y5vnypLPN-KrjpmoG5zlqcX8VwfcLBpNg1yQI7bP9Hg,18737
103
- bbot/modules/filedownload.py,sha256=TOxftfxguaRSEKI8oG79XVRQqUGg1_IhYDYl_Jw9eYc,8694
103
+ bbot/modules/filedownload.py,sha256=ZQZQCkXYb0lUP4DnEfL__8vc9KRi0m9hfBhClTKwy2U,8906
104
104
  bbot/modules/fingerprintx.py,sha256=rdlR9d64AntAhbS_eJzh8bZCeLPTJPSKdkdKdhH_qAo,3269
105
105
  bbot/modules/fullhunt.py,sha256=zeehQb9akBSbHW9dF4icH8Vfd8LqoTrpIvnQEEMWes8,1311
106
106
  bbot/modules/generic_ssrf.py,sha256=KFdcHpUV9-Z7oN7emzbirimsNc2xZ_1IFqnsfIkEbcM,9196
107
107
  bbot/modules/git.py,sha256=zmHeI0bn181T1P8C55HSebkdVGLTpzGxPc-LRqiHrbc,1723
108
- bbot/modules/git_clone.py,sha256=XFZXx0k97EMY3E5PZzdNvqQzZddOfRMaVp5ol2gk11s,2468
109
- bbot/modules/gitdumper.py,sha256=XBYt6oSXm09FJVdH37zrn9T1Nhqc0zK4KLugMevedOw,11531
108
+ bbot/modules/git_clone.py,sha256=w-s3O6rZL_I8_BuPKotnAzXKnn7saw159jcQ_R1xtKw,2602
109
+ bbot/modules/gitdumper.py,sha256=d2FnSAraWftkQ9ENmkBk3_kUbuw4G3eKpsi0FXLzBss,12042
110
110
  bbot/modules/github_codesearch.py,sha256=a-r2vE9N9WyBpFUiKCsg0TK4Qn7DaEGyVRTUKzkDLWA,3641
111
111
  bbot/modules/github_org.py,sha256=WM18vJCHuOHJJ5rPzQzQ3Pmp7XPPuaMeVgNfW-FlO0k,8938
112
112
  bbot/modules/github_usersearch.py,sha256=G8knkQBJsn7EKcMhcEaFPiB_Y5S96e2VaseBubsqOyk,3407
113
- bbot/modules/github_workflows.py,sha256=RDtzR0DC2sqiWzMtiqlrCSwtZHWL2MoIJBKd6LVTAdI,9720
113
+ bbot/modules/github_workflows.py,sha256=xKntAFDeGuE4MqbEmhJyYXKbzoSh9tWYlHNlnF37PYA,10040
114
114
  bbot/modules/gitlab.py,sha256=9oWWpBijeHCjuFBfWW4HvNqt7bvJvrBgBjaaz_UPPnE,5964
115
115
  bbot/modules/google_playstore.py,sha256=N4QjzQag_bgDXfX17rytBiiWA-SQtYI2N0J_ZNEOdv0,3701
116
116
  bbot/modules/gowitness.py,sha256=vcyZl87xJVHWTuRY032d2dORg3ykVKPIBwD2HzSxvYA,11784
@@ -133,21 +133,20 @@ bbot/modules/ipneighbor.py,sha256=b_0IhorihFLtXJZEz57EGXjXW30gIOEzzVgz2GFvM3A,15
133
133
  bbot/modules/ipstack.py,sha256=j_S8WMNqQuSQgBT7AX4tO70fgbWuRYrpsS3tVsu_hn4,2200
134
134
  bbot/modules/jadx.py,sha256=8ncbK5i3B6i253qJ5tuD3-cPl4S8qqRvnTVINFTjtvQ,3084
135
135
  bbot/modules/leakix.py,sha256=4sKghkId5cX_eVqTSFsqdNzX5JmUemr-U7gs8PfKVVA,1561
136
- bbot/modules/lightfuzz/lightfuzz.py,sha256=ZKk2wLaVUrZzr4pH_1k0xtf8LrxssAyh4Y61dY0zGS4,8921
136
+ bbot/modules/lightfuzz/lightfuzz.py,sha256=REs0wkwpvrL4bZAg8V1Ui3KFyvgWVtDSk8jP_fFcaCQ,8911
137
137
  bbot/modules/lightfuzz/submodules/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
138
138
  bbot/modules/lightfuzz/submodules/base.py,sha256=PvMEoEqrgAmp63JufaPe9GhOn7ay3oBvvZCuFIzuwaI,12619
139
139
  bbot/modules/lightfuzz/submodules/cmdi.py,sha256=-9pL7Yh7VVCObxuS6Qu2cKEJBstfk0oXIkMyntg8xDk,5043
140
140
  bbot/modules/lightfuzz/submodules/crypto.py,sha256=mLWsMbcox9oruNjfdOaLmT7ePMH15K8JN9K5AIB8f8o,22560
141
- bbot/modules/lightfuzz/submodules/nosqli.py,sha256=K0TlBtpfeBH72q01a3TCQnt9OsznA9kfRYVTe7Vmers,9399
142
141
  bbot/modules/lightfuzz/submodules/path.py,sha256=cvfna9P5Cicmc3p3BrzlY0PG1slcvJkeMzZu4i2nwO0,7744
143
- bbot/modules/lightfuzz/submodules/serial.py,sha256=i3TdGV7M0G5thn1SFyKrod9nrm9UPV8kN3sd2-tvmEc,8528
144
- bbot/modules/lightfuzz/submodules/sqli.py,sha256=42TTB3UglMqnlxl7p2lUx14GWjbY9b6X7K9jWB5Mf9I,8486
142
+ bbot/modules/lightfuzz/submodules/serial.py,sha256=Vry3J0Bs3QJqgVPzxhDFmEZQt4FYzLmpOYUHr9tCgR4,9118
143
+ bbot/modules/lightfuzz/submodules/sqli.py,sha256=HX0wP-aVn02zzBDujpLgzXPos7w_eiSiALTNCN2O_Bo,8597
145
144
  bbot/modules/lightfuzz/submodules/ssti.py,sha256=Pib49rXFuf567msnlec-A1Tnvolw4aILjqn7INLWQTY,1413
146
- bbot/modules/lightfuzz/submodules/xss.py,sha256=VP15TBeRjglIRjLvwmHJaOCNQOWS7R4WVAZ-VRNe198,9503
145
+ bbot/modules/lightfuzz/submodules/xss.py,sha256=BZz1_nqzV8dqJptpoqZEMdVBdtZHmRae3HWo3S9yzIc,9507
147
146
  bbot/modules/myssl.py,sha256=DoMF7o6MxIrcglCrC-W3nM-GPcyJRM4PlGdKfnOlIvs,942
148
147
  bbot/modules/newsletters.py,sha256=1Q4JjShPsxHJ-by2CbGfCvEt80blUGPX0hxQIzB_a9M,2630
149
148
  bbot/modules/ntlm.py,sha256=EGmb4k3YC_ZuHIU3mGUZ4yaMjE35wVQQSv8HwTsQJzY,4391
150
- bbot/modules/nuclei.py,sha256=m1Y1lp3suDT173dxmMNLGNjwu-o7Ahi0cX6W1LNyZSY,17875
149
+ bbot/modules/nuclei.py,sha256=65-tgre6a738Z2s3Bo0nxhNcvQ1OuYX8zQS5x7fFk7g,17983
151
150
  bbot/modules/oauth.py,sha256=s-Q6PYJl1OLncGgHzCV0QAzbkewT5zzKCRaa8GidBqc,6720
152
151
  bbot/modules/otx.py,sha256=GYi5GFLKlKuRHPYMqtq42bSulerkSpAWHM6ex5eK7ww,913
153
152
  bbot/modules/output/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -179,9 +178,9 @@ bbot/modules/paramminer_headers.py,sha256=GMErLmTO0w7JRIpJE2VFvRTrjmoux_-jTx3Efa
179
178
  bbot/modules/passivetotal.py,sha256=uGT6c_CUxBNInmClsTg8afIYA2ZykKYYCgjkyzujfHg,1653
180
179
  bbot/modules/pgp.py,sha256=Xu2M9WEIlwTm5-Lv29g7BblI05tD9Dl0XsYSeY6UURs,2065
181
180
  bbot/modules/portfilter.py,sha256=3iu4xqCsHafhVMbA32Mw6K_7Yn576Rz6GxXMevZQEpM,1752
182
- bbot/modules/portscan.py,sha256=AhPsPGD7CdVuw01JurpcmhpxR0Tp_M995k3DRP7wuTw,12944
181
+ bbot/modules/portscan.py,sha256=dmR2H3Wag6vLLIXrwyU_7bvYuLIv3zdJZ2japogwFUU,13076
183
182
  bbot/modules/postman.py,sha256=vo761Nzu3kPBzfCY3KJcvsGEsjImaa7iA2z-LyASBDc,4589
184
- bbot/modules/postman_download.py,sha256=LUB9cP-otkB1HaNACGS5YPwsxnwp1uSo28SpGvmQ60A,3467
183
+ bbot/modules/postman_download.py,sha256=4pvF1ePRqxPxXL1jhI0gMf1CasfVFl-xjwU-U22SFXA,3607
185
184
  bbot/modules/rapiddns.py,sha256=uONESr0B5pv9cSAr7lF4WWV31APUhXyHexvI04rUcyk,787
186
185
  bbot/modules/reflected_parameters.py,sha256=RjS-4C-XC9U-jC9J7AYNqwn6I-O2y3LvTRhB68dpgKI,3281
187
186
  bbot/modules/report/affiliates.py,sha256=vvus8LylqOfP-lfGid0z4FS6MwOpNuRTcSJ9aSnybp4,1713
@@ -208,7 +207,7 @@ bbot/modules/templates/sql.py,sha256=o-CdyyoJvHJdJBKkj3CIGXYxUta4w2AB_2Vr-k7cDDU
208
207
  bbot/modules/templates/subdomain_enum.py,sha256=epyKSly08jqaINV_AMMWbNafIeQjJqvd3aj63KD0Mck,8402
209
208
  bbot/modules/templates/webhook.py,sha256=uGFmcJ81GzGN1UI2k2O7nQF_fyh4ehLDEg2NSXaPnhk,3373
210
209
  bbot/modules/trickest.py,sha256=MRgLW0YiDWzlWdAjyqfPPLFb-a51r-Ffn_dphiJI_gA,1550
211
- bbot/modules/trufflehog.py,sha256=bMO30pE9HAYeSgEQ00xH3kvtKbUoiULeTkT33BiCdR8,8743
210
+ bbot/modules/trufflehog.py,sha256=TA8TVj9he12I9TtVvHdH_WJwDqLK97mATwtkuSi3l2g,8703
212
211
  bbot/modules/url_manipulation.py,sha256=4J3oFkqTSJPPmbKEKAHJg2Q2w4QNKtQhiN03ZJq5VtI,4326
213
212
  bbot/modules/urlscan.py,sha256=-w_3Bm6smyG2GLQyIbnMUkKmeQVauo-V6F4_kJDYG7s,3740
214
213
  bbot/modules/vhost.py,sha256=cirOe0HR4M0TEBN8JdXo2l0s2flc8ZSdxggGm79blT8,5459
@@ -237,10 +236,10 @@ bbot/presets/web/dirbust-heavy.yml,sha256=NDqu7p0Hx1RsZCVnaEWRgI_iL9O0io-tvWerxJ
237
236
  bbot/presets/web/dirbust-light.yml,sha256=5zSANdjKfYh49kFlsElYY2G6acVrZFzDCEkyqwU6oOQ,203
238
237
  bbot/presets/web/dotnet-audit.yml,sha256=FViiccDXG08P3INNe06bLPeatejbw8Kb1HW5xgdUJNU,520
239
238
  bbot/presets/web/iis-shortnames.yml,sha256=EcYKMpl-cI8Xb79_u4wQS42yFXxDpLH9OqINcFUXoTE,176
240
- bbot/presets/web/lightfuzz-heavy.yml,sha256=a-f11tSUj5NhVQJNm2NJb4OqXV8oPnwnd1kbwepDxHY,466
239
+ bbot/presets/web/lightfuzz-heavy.yml,sha256=zb7DPT-tf5MxTXkVpHn8cx2YwpbaGwZOST8vbhAOWZ0,459
241
240
  bbot/presets/web/lightfuzz-light.yml,sha256=pkjTa5ULeOhCgRYPAoJR-cVfyhErT3I1aqmWGHTIgBk,899
242
- bbot/presets/web/lightfuzz-medium.yml,sha256=e5dKHkiGbLMIw1fTC6lKGH4UpnWit1XtvVdIuFS8dY4,497
243
- bbot/presets/web/lightfuzz-superheavy.yml,sha256=c5x-EpK-xbg-qWxPXLLp3ysKFl1LRhJyl_SlkPVowxQ,857
241
+ bbot/presets/web/lightfuzz-medium.yml,sha256=LUB1Em4EQnIB387E3EiUw4AOIW9kzz3ItMb3xBBYnzE,490
242
+ bbot/presets/web/lightfuzz-superheavy.yml,sha256=3EaiNUCxsRqcrkhMcB70pMkMGT8BplikzSxfosprWTk,850
244
243
  bbot/presets/web/lightfuzz-xss.yml,sha256=LMe968_iKyQhnm1nPh6zXDeNyDum2_MPkLg7ukqr93A,680
245
244
  bbot/presets/web/paramminer.yml,sha256=8n-aDzufrZdtIlZwI0yh4-rQiwU1FPODYwmyra3l-1M,393
246
245
  bbot/presets/web-basic.yml,sha256=6YWSYclbuf9yr8-gILDpLvOUj5QjP4rlarm5_d5iBFw,79
@@ -250,15 +249,15 @@ bbot/scanner/__init__.py,sha256=sJ7FoLQ1vwLscH8hju2PEUyGTZ_OwMVvW9b11CrCWdI,89
250
249
  bbot/scanner/dispatcher.py,sha256=_hsIegfUDrt8CUdXqgRvp1J0UwwzqVSDxjQmiviO41c,793
251
250
  bbot/scanner/manager.py,sha256=eyd_0IjnPH3e-tJSOwY-rxauVI6L9Ltr3pWmpPSO5Jc,11019
252
251
  bbot/scanner/preset/__init__.py,sha256=If_YqKILIxjlaJvf8lFc5zQTHDkounLdC8x_72N-V10,49
253
- bbot/scanner/preset/args.py,sha256=yADXhmmLWBODsEqw1NbEBh8UWltUEoB--2S7myHTwAQ,19212
252
+ bbot/scanner/preset/args.py,sha256=Oto4sO8E9hKeQn6Fp8ua_WB3xvYI97GgnBFg5f4jh0Y,19547
254
253
  bbot/scanner/preset/conditions.py,sha256=hFL9cSIWGEsv2TfM5UGurf0c91cyaM8egb5IngBmIjA,1569
255
254
  bbot/scanner/preset/environ.py,sha256=9KbEOLWkUdoAf5Ez_2A1NNm6QduQElbnNnrPi6VDhZs,4731
256
255
  bbot/scanner/preset/path.py,sha256=X32-ZUmL7taIv37VKF1KfmeiK9fjuQOE7pWUTEbPK8c,2483
257
- bbot/scanner/preset/preset.py,sha256=t9Aa3n3mpGVZ274z2hXaGsdpRZe0BSGuF3WTM6Dinj8,40817
258
- bbot/scanner/scanner.py,sha256=2slrxEfcBjSZgZ1jmQ34a4X6aMli80K85_eY8ti7zZQ,55471
256
+ bbot/scanner/preset/preset.py,sha256=G_aMMI33d2OlzNUwjfi5ddJdxa8nK0oF5HrYAsuregU,40708
257
+ bbot/scanner/scanner.py,sha256=6TgnGMa_Zl4Wm6fKxujGDHGrNC6ad1pexUDCZ7xRy5I,55320
259
258
  bbot/scanner/stats.py,sha256=re93sArKXZSiD0Owgqk2J3Kdvfm3RL4Y9Qy_VOcaVk8,3623
260
259
  bbot/scanner/target.py,sha256=lI0Tn5prQiPiJE3WW-ZLx_l6EFqzAVabtyL-nfXJ8cE,10636
261
- bbot/scripts/docs.py,sha256=JYdn9jLnnxmHM3hQc1C3tjxGs6hgFhqouUS3WtYN0q0,11004
260
+ bbot/scripts/docs.py,sha256=aYAHlcHtMAhM-XGTDiSpzccnX1dh0Xi_WxmC2bgylQ4,11373
262
261
  bbot/test/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
263
262
  bbot/test/bbot_fixtures.py,sha256=XrCQDLVe80BG3QTUDnXb0y-cWnBpJJoRh2Z3J3xJn_w,9961
264
263
  bbot/test/conftest.py,sha256=OacpJ98g00HqCoHpEnuzzMK47LkbZdJWr25Pm0SbTM0,11783
@@ -289,7 +288,7 @@ bbot/test/test_step_1/test_modules_basic.py,sha256=ELpGlsthSq8HaxB5My8-ESVHqMxqd
289
288
  bbot/test/test_step_1/test_presets.py,sha256=HnJhKwDnVh9Y6adgxqe85677rWpnFil_WS5GjX21ZvM,40959
290
289
  bbot/test/test_step_1/test_python_api.py,sha256=Fk5bxEsPSjsMZ_CcRMTJft8I48EizwHJivG9Fy4jIu0,5502
291
290
  bbot/test/test_step_1/test_regexes.py,sha256=wSx_e6hgHuBh95igL_fauWKK4a1xXujs9TtyLBaMwRM,14636
292
- bbot/test/test_step_1/test_scan.py,sha256=yZs-bZVLd7Ao5uoNzoOI_F8gBEbGdeVXIAjyoGoNhe0,8875
291
+ bbot/test/test_step_1/test_scan.py,sha256=jGySAMGb0gXirJpDniX6SSm4TbpHYrkGHcDPpJRGHQg,10676
293
292
  bbot/test/test_step_1/test_scope.py,sha256=S2nssENKJKCvgXUMyU8MFQmXHeUIz0C_sbWGkdYti2A,3063
294
293
  bbot/test/test_step_1/test_target.py,sha256=4Xz6Fns_6wa2O3AXDBvd7W04LCfZSCiit2lezQJicTI,19472
295
294
  bbot/test/test_step_1/test_web.py,sha256=qzMb5v_1l6fK6SvJZoHpBI3Zb7iaHU_VnenQ8UQIK-4,19637
@@ -301,7 +300,7 @@ bbot/test/test_step_2/module_tests/test_module_affiliates.py,sha256=d6uAzb_MF4oN
301
300
  bbot/test/test_step_2/module_tests/test_module_aggregate.py,sha256=hjxbMxAEFhS7W8RamBrM1t6T-tsLHq95MmQVfrYsock,487
302
301
  bbot/test/test_step_2/module_tests/test_module_ajaxpro.py,sha256=S2pFV0TgOJ01SMHnIxcoBkGZ8SAaQVY9o32DOFoZ1u4,3857
303
302
  bbot/test/test_step_2/module_tests/test_module_anubisdb.py,sha256=y_GMm20Fy4z9L0fN2dYOExaSsi8Z9PwMKnAjSsYhBk8,545
304
- bbot/test/test_step_2/module_tests/test_module_apkpure.py,sha256=8KM-JCir0doUupwN3JwV5OPaPE_Jq_hz2-96-ZKGpRI,2823
303
+ bbot/test/test_step_2/module_tests/test_module_apkpure.py,sha256=-G4hoRPFhNH-rj6MvuhqlwiXHqBqHgfFGYxbzoyKz2s,2983
305
304
  bbot/test/test_step_2/module_tests/test_module_asn.py,sha256=qIbitSAEAmYyxhpxvdFDsQrHaaxfgKsFox9Q3jTmvgI,10616
306
305
  bbot/test/test_step_2/module_tests/test_module_asset_inventory.py,sha256=NEMSPBlczpA5NbQpIcRBpRXpVnfS9lmSS1U7eJmIXAU,3878
307
306
  bbot/test/test_step_2/module_tests/test_module_azure_realm.py,sha256=gPRvGA9RHsAcYlHxQG0lHZOYolyzbe6L-ALGIvW-Mg0,1288
@@ -315,7 +314,7 @@ bbot/test/test_step_2/module_tests/test_module_binaryedge.py,sha256=tK1fv4o2JOxa
315
314
  bbot/test/test_step_2/module_tests/test_module_bucket_amazon.py,sha256=bKTnrR3FfCaAXZTWJh2m4bm-Pa1xiJV9lY2N_waaq2s,4002
316
315
  bbot/test/test_step_2/module_tests/test_module_bucket_azure.py,sha256=CUK1OHGhA-piIzPG15UNiMdaK1oSSCwCv_WPcCvC4VQ,2112
317
316
  bbot/test/test_step_2/module_tests/test_module_bucket_digitalocean.py,sha256=EFzScFloY6DQVD7MbvQOfsSp_8tApV4epKFm9OP1_ZM,907
318
- bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py,sha256=aOgtrsb32nnTZBvX1tf6Fvfjc-GvuxA8Tu7LGq2oDJo,2301
317
+ bbot/test/test_step_2/module_tests/test_module_bucket_file_enum.py,sha256=7n7eFWQJanZjyammwBDM9Jmt5kJ8AXn9eS4fmKEBqm4,2463
319
318
  bbot/test/test_step_2/module_tests/test_module_bucket_firebase.py,sha256=gM3h1staY3tEHF2l9cYgRhaVwEg7ykfo4E0mvhqTA0g,506
320
319
  bbot/test/test_step_2/module_tests/test_module_bucket_google.py,sha256=wXROpF9TSQVOa8cGTOo8k9uDEj7H5pNAcppj4WR3qnY,1312
321
320
  bbot/test/test_step_2/module_tests/test_module_bufferoverrun.py,sha256=6pyJ0dbx8u0BPVXyiqdDPgECLGfIGkWPHZ35tbBzoPg,1582
@@ -342,7 +341,7 @@ bbot/test/test_step_2/module_tests/test_module_dnscommonsrv.py,sha256=_dqcgVQAc1
342
341
  bbot/test/test_step_2/module_tests/test_module_dnsdumpster.py,sha256=p--1JaDb7PjiAYRQiAQ_qYBQAQgkBzB1iLnDp6B0UCk,59745
343
342
  bbot/test/test_step_2/module_tests/test_module_dnsresolve.py,sha256=15LEcggP_eVYFQdMO1zHTvoGc6n8IaUjsQDmX0sZS4o,2077
344
343
  bbot/test/test_step_2/module_tests/test_module_dnstlsrpt.py,sha256=8xXSFo0vwKfehIqgF41tbEkL1vbp6RIB8kiO8TSH4NU,2648
345
- bbot/test/test_step_2/module_tests/test_module_docker_pull.py,sha256=-JSAo51dS3Ie9RaLBcWK0kfbg8bCPr7mohpFGAwOKPQ,27988
344
+ bbot/test/test_step_2/module_tests/test_module_docker_pull.py,sha256=SKc43IKzwoi74qaY8felJXnrgNVXrXRQlg6BtrSjyAc,28151
346
345
  bbot/test/test_step_2/module_tests/test_module_dockerhub.py,sha256=9T8CFcFP32MOppUmSVNBUSifnk2kMONqzW_7vvvKdpk,3907
347
346
  bbot/test/test_step_2/module_tests/test_module_dotnetnuke.py,sha256=Q7M3hrbEwOuORZXPS-pIGFTRzB2-g4cEvGtsEcTp7t8,8049
348
347
  bbot/test/test_step_2/module_tests/test_module_emailformat.py,sha256=cKxBPnEQ4AiRKV_-hSYEE6756ypst3hi6MN0L5RTukY,461
@@ -351,13 +350,13 @@ bbot/test/test_step_2/module_tests/test_module_excavate.py,sha256=hoVQnZYb_tI1Fl
351
350
  bbot/test/test_step_2/module_tests/test_module_extractous.py,sha256=PuTE5rkEIFPwU9lhCYpTgNSkrVjcXm8PClbfOkfRS84,17973
352
351
  bbot/test/test_step_2/module_tests/test_module_ffuf.py,sha256=z8ihAM1WYss7QGXIjbi67cekg8iOemDjaM8YR9_qSEs,4100
353
352
  bbot/test/test_step_2/module_tests/test_module_ffuf_shortnames.py,sha256=0-a9J-gq8bUtmxl_-QPVidwZ9KkCvgvoG30Ot3a8lqM,8406
354
- bbot/test/test_step_2/module_tests/test_module_filedownload.py,sha256=ZLPlBVs8CMWofLZAl63zdYMryVdYXykoaxE4jBGED8I,4304
353
+ bbot/test/test_step_2/module_tests/test_module_filedownload.py,sha256=Fd_5DKA0VaHyCR6qS5WPS9CoyPKFeBTswhAwM5RsU-c,4473
355
354
  bbot/test/test_step_2/module_tests/test_module_fingerprintx.py,sha256=nU3jxbkGcmPYiSzc6thJhNvjAFb4qVxcR7rkOAvjB18,445
356
355
  bbot/test/test_step_2/module_tests/test_module_fullhunt.py,sha256=NblfNHQrE82j-cESvm66hpN-ooKZwR1kEwJDTk_BXac,1946
357
356
  bbot/test/test_step_2/module_tests/test_module_generic_ssrf.py,sha256=ZhfZpH0QTl6_YftGoZzZk6_2x0ZDnWjZ7vNZMTibBHw,3228
358
357
  bbot/test/test_step_2/module_tests/test_module_git.py,sha256=gyBS3vZUWAyatGlcY26mGOYeqXSqJA5pbhJWgTmLqNo,1656
359
- bbot/test/test_step_2/module_tests/test_module_git_clone.py,sha256=Mo0Q7bCXcrkGWJc3-u5y4sdfC13ei-qj79aKvEbnkk4,13198
360
- bbot/test/test_step_2/module_tests/test_module_gitdumper.py,sha256=ya_eQUQk0344G7iqBYMls2z5H-bYM87rydbz-ACR2Ng,17461
358
+ bbot/test/test_step_2/module_tests/test_module_git_clone.py,sha256=z97IZLTVaa3aJ9O3NDP3MaOnmDocL-kT8kT-1rMAqn0,13318
359
+ bbot/test/test_step_2/module_tests/test_module_gitdumper.py,sha256=bsSly-OOyDuFffVmwJpm7aEafrSHgLAk_VsJ69S3LUo,17616
361
360
  bbot/test/test_step_2/module_tests/test_module_github_codesearch.py,sha256=M50xBiGG2EuPGXDJU6uFsSUE-fhqZl3CzYtNdszW7LM,4735
362
361
  bbot/test/test_step_2/module_tests/test_module_github_org.py,sha256=5tKO6NH4TPBeIdeTf7Bz9PUZ1pcvKsjrG0nFhc3YgT0,25458
363
362
  bbot/test/test_step_2/module_tests/test_module_github_usersearch.py,sha256=IIQ0tYZjQN8_L8u_N4m8Nz3kbB4IyBp95tYCPcQeScg,5264
@@ -378,7 +377,7 @@ bbot/test/test_step_2/module_tests/test_module_ipstack.py,sha256=C0Le03UqvShpATo
378
377
  bbot/test/test_step_2/module_tests/test_module_jadx.py,sha256=qTBfDc_Iv03n8iGdyLm6kBaKeEdSxFYeKj5xL1PmyF0,2391
379
378
  bbot/test/test_step_2/module_tests/test_module_json.py,sha256=gmlqge5ZJpjVMGs7OLZBsNlSFTTrKnKjIZMIU23o8VQ,3350
380
379
  bbot/test/test_step_2/module_tests/test_module_leakix.py,sha256=DQaQsL4ewpuYeygp-sgcvdeOSzvHq77_eYjKcgebS7A,1817
381
- bbot/test/test_step_2/module_tests/test_module_lightfuzz.py,sha256=g8rPTtjPe90ZkjCEMlNUC2fraqzZu4XK_0GaA7sGI9A,77463
380
+ bbot/test/test_step_2/module_tests/test_module_lightfuzz.py,sha256=W8IrU5WEBESR8xZUNVHWzLqjDVuVj2m_5q0xiGZwYAo,72050
382
381
  bbot/test/test_step_2/module_tests/test_module_medusa.py,sha256=vYoAyMf0LbIXCoUzLycOISZtF7M58E30WjuLuqxDiCg,1671
383
382
  bbot/test/test_step_2/module_tests/test_module_mysql.py,sha256=4wAPjbjhlxmOkEhQnIQIBC2BLEaE57TX6lChGZ3zLsU,2630
384
383
  bbot/test/test_step_2/module_tests/test_module_myssl.py,sha256=zRJ1sOEespWtBx2jA07bW5sHD1XQ9pV0PtHtGogo7Gs,1531
@@ -395,10 +394,10 @@ bbot/test/test_step_2/module_tests/test_module_paramminer_headers.py,sha256=8hRU
395
394
  bbot/test/test_step_2/module_tests/test_module_passivetotal.py,sha256=fTGQECQ0OzcwiH64-0igFRKO-rs3kXScivZord_oWWU,1120
396
395
  bbot/test/test_step_2/module_tests/test_module_pgp.py,sha256=_T-kmpr5F0cJHl4_mpfhxK3aj0hH3UxDLeV1iByanJk,1607
397
396
  bbot/test/test_step_2/module_tests/test_module_portfilter.py,sha256=gOEy1XYtTJNGvTH6o3NNSOXXPdste462BdQvayOwzVs,2012
398
- bbot/test/test_step_2/module_tests/test_module_portscan.py,sha256=TJtutIORCNu-3Wm1zCqtzPVC0OXUICnY4YL1toJ57yk,7539
397
+ bbot/test/test_step_2/module_tests/test_module_portscan.py,sha256=I42EhBN736JShaek5TvE-NHD8X3hcVxXLHhlJcqquYQ,7539
399
398
  bbot/test/test_step_2/module_tests/test_module_postgres.py,sha256=bNHzDvPs5AkoA_ho7s50bFaF5qzV7KL3DplhOA1ZYa4,2688
400
399
  bbot/test/test_step_2/module_tests/test_module_postman.py,sha256=7SxZi39dJhnwyg4IVf5M8VNdQU_zaPAufTEw60rgCkg,22311
401
- bbot/test/test_step_2/module_tests/test_module_postman_download.py,sha256=0mevxk5AMrBmQ2vvWzokc15fdzxOxMM5Rqw-CDIZLKs,14079
400
+ bbot/test/test_step_2/module_tests/test_module_postman_download.py,sha256=u3lF7Uve8riHNCj9XEFrRBONQHUzccsfq-qEkwQ51wE,14225
402
401
  bbot/test/test_step_2/module_tests/test_module_python.py,sha256=6UQVXGJ1ugfNbt9l_nN0q5FVxNWlpq6j0sZcB0Nh_Pg,184
403
402
  bbot/test/test_step_2/module_tests/test_module_rapiddns.py,sha256=zXHNLnUjLO22yRwrDFCZ40sRTmFVZEj9q_dyK8w1TYM,4441
404
403
  bbot/test/test_step_2/module_tests/test_module_reflected_parameters.py,sha256=4cY8yK9iImB1O68pi1lACcPEtNQ9-sud9Xl16fYB8cU,9003
@@ -423,7 +422,7 @@ bbot/test/test_step_2/module_tests/test_module_subdomains.py,sha256=r1zCmw5ZZ_0w
423
422
  bbot/test/test_step_2/module_tests/test_module_teams.py,sha256=r91ZZxhj3pEhKnjr1jGwhcqOPXTqNJNupC1CDKccfH8,1638
424
423
  bbot/test/test_step_2/module_tests/test_module_telerik.py,sha256=vGORDSRU1S1hkLlHO3KOdoAYLqWcrPpvVGxadTGl5y8,11099
425
424
  bbot/test/test_step_2/module_tests/test_module_trickest.py,sha256=6mTYH6fIah-WbKnFI-_WZBwRdKFi-oeWyVtl1n0nVAU,1630
426
- bbot/test/test_step_2/module_tests/test_module_trufflehog.py,sha256=y4TyPSrsQ9al4RG_F1y8zttX-nUtfGEy5L7zCnX37XU,95785
425
+ bbot/test/test_step_2/module_tests/test_module_trufflehog.py,sha256=lXX2KYh5s1FVpivth43Nj3MLfMkiksrooEne_DAL_qg,96796
427
426
  bbot/test/test_step_2/module_tests/test_module_txt.py,sha256=R-EBfEZM0jwY2yuVyfYhoccDOl0Y2uQZSkXQ1HyinUA,247
428
427
  bbot/test/test_step_2/module_tests/test_module_unarchive.py,sha256=--p2kpnyfbABuJI5qmDbD-K_D5e4Icvq5VzEyp6AWVE,10676
429
428
  bbot/test/test_step_2/module_tests/test_module_url_manipulation.py,sha256=aP3nK2TQQOjk0ZeuHhHYfZm_e37qrrXbnufd7m-QeJU,1144
@@ -452,8 +451,8 @@ bbot/wordlists/raft-small-extensions-lowercase_CLEANED.txt,sha256=ZSIVebs7ptMvHx
452
451
  bbot/wordlists/top_open_ports_nmap.txt,sha256=LmdFYkfapSxn1pVuQC2LkOIY2hMLgG-Xts7DVtYzweM,42727
453
452
  bbot/wordlists/valid_url_schemes.txt,sha256=0B_VAr9Dv7aYhwi6JSBDU-3M76vNtzN0qEC_RNLo7HE,3310
454
453
  bbot/wordlists/wordninja_dns.txt.gz,sha256=DYHvvfW0TvzrVwyprqODAk4tGOxv5ezNmCPSdPuDUnQ,570241
455
- bbot-2.4.2.6677rc0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
456
- bbot-2.4.2.6677rc0.dist-info/METADATA,sha256=C1S2EK8cW4u3b8k4fsrQGrMW-12R47Oa4yNzgqUHncg,18308
457
- bbot-2.4.2.6677rc0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
458
- bbot-2.4.2.6677rc0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
459
- bbot-2.4.2.6677rc0.dist-info/RECORD,,
454
+ bbot-2.5.0.dist-info/LICENSE,sha256=GzeCzK17hhQQDNow0_r0L8OfLpeTKQjFQwBQU7ZUymg,32473
455
+ bbot-2.5.0.dist-info/METADATA,sha256=NS1-p2NetSDnkPKMctrurxHQrq8LeW1yUuz8ljoYVCM,18300
456
+ bbot-2.5.0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
457
+ bbot-2.5.0.dist-info/entry_points.txt,sha256=cWjvcU_lLrzzJgjcjF7yeGuRA_eDS8pQ-kmPUAyOBfo,38
458
+ bbot-2.5.0.dist-info/RECORD,,
@@ -1,183 +0,0 @@
1
- from .base import BaseLightfuzz
2
- from bbot.errors import HttpCompareError
3
- import urllib.parse
4
-
5
-
6
- class nosqli(BaseLightfuzz):
7
- """
8
- Detects NoSQL injection vulnerabilities.
9
-
10
- Techniques:
11
-
12
- * Quote Injection Analysis:
13
- - Injects single quotes and escaped single quotes into parameters
14
- - Compares response differences between the two to detect NoSQL parsing
15
- - Uses baseline comparison to validate findings and reduce false positives
16
-
17
- * Operator Injection:
18
- - Tests MongoDB-style operator injection using [$eq] and [$ne]
19
- - Modifies parameter names to include operators
20
- - Detects behavioral changes in application responses
21
-
22
- Validation of findings is achieved using confirmation probes to rule out unstable endpoints
23
- """
24
-
25
- friendly_name = "NoSQL Injection"
26
-
27
- async def fuzz(self):
28
- cookies = self.event.data.get("assigned_cookies", {})
29
- probe_value = self.incoming_probe_value(populate_empty=True)
30
- quote_probe_baseline = None
31
- try:
32
- quote_probe_baseline = self.compare_baseline(
33
- self.event.data["type"], probe_value, cookies, additional_params_populate_empty=True
34
- )
35
- except HttpCompareError as e:
36
- self.verbose(f"Encountered HttpCompareError Sending Compare Baseline: {e}")
37
-
38
- if quote_probe_baseline:
39
- try:
40
- # send the with a single quote, and then another with an escaped single quote
41
- (
42
- single_quote_comparison,
43
- single_quote_diff_reasons,
44
- single_quote_reflection,
45
- single_quote_response,
46
- ) = await self.compare_probe(
47
- quote_probe_baseline,
48
- self.event.data["type"],
49
- f"{probe_value}'",
50
- cookies,
51
- additional_params_populate_empty=True,
52
- )
53
- (
54
- escaped_single_quote_comparison,
55
- escaped_single_quote_diff_reasons,
56
- escaped_single_quote_reflection,
57
- escaped_single_quote_response,
58
- ) = await self.compare_probe(
59
- quote_probe_baseline,
60
- self.event.data["type"],
61
- rf"{probe_value}\'",
62
- cookies,
63
- additional_params_populate_empty=True,
64
- )
65
- if not single_quote_comparison and single_quote_response and escaped_single_quote_response:
66
- # if the single quote probe changed the code or body, and the escaped single quote probe did not cause the same change, injection is possible
67
- if ("code" in single_quote_diff_reasons or "body" in single_quote_diff_reasons) and (
68
- single_quote_diff_reasons != escaped_single_quote_diff_reasons
69
- ):
70
- self.verbose(
71
- "Initial heuristic indicates possible NoSQL Injection, sending confirmation probes"
72
- )
73
- confirm_baseline = self.compare_baseline(
74
- self.event.data["type"],
75
- urllib.parse.quote(f"{probe_value}' && 0 && 'x", safe=""),
76
- cookies,
77
- additional_params_populate_empty=True,
78
- skip_urlencoding=True,
79
- )
80
- (
81
- confirmation_probe_false_comparison,
82
- confirmation_probe_false_diff_reasons,
83
- confirmation_probe_false_reflection,
84
- confirmation_probe_false_response,
85
- ) = await self.compare_probe(
86
- confirm_baseline,
87
- self.event.data["type"],
88
- urllib.parse.quote(f"{probe_value}' && 1 && 'x", safe=""),
89
- cookies,
90
- additional_params_populate_empty=True,
91
- skip_urlencoding=True,
92
- )
93
- if confirmation_probe_false_response:
94
- if not confirmation_probe_false_comparison and confirmation_probe_false_diff_reasons != [
95
- "header"
96
- ]:
97
- (
98
- final_confirm_comparison,
99
- final_confirm_diff_reasons,
100
- final_confirm_reflection,
101
- final_confirm_response,
102
- ) = await self.compare_probe(
103
- confirm_baseline,
104
- self.event.data["type"],
105
- urllib.parse.quote(f"{probe_value}' && 0 && 'x", safe=""),
106
- cookies,
107
- additional_params_populate_empty=True,
108
- skip_urlencoding=True,
109
- )
110
-
111
- if final_confirm_response and final_confirm_comparison:
112
- self.results.append(
113
- {
114
- "type": "FINDING",
115
- "description": f"Possible NoSQL Injection. {self.metadata()} Detection Method: [Quote/Escaped Quote + Conditional Affect] Differences: [{'.'.join(confirmation_probe_false_diff_reasons)}]",
116
- }
117
- )
118
- else:
119
- self.verbose(
120
- "Aborted reporting Possible NoSQL Injection, due to unstable/inconsistent responses"
121
- )
122
-
123
- except HttpCompareError as e:
124
- self.verbose(f"Encountered HttpCompareError Sending Compare Probe: {e}")
125
-
126
- # Comparison operator injection
127
- if self.event.data["type"] in ["POSTPARAM", "GETPARAM"]:
128
- nosqli_negation_baseline = None
129
-
130
- try:
131
- nosqli_negation_baseline = self.compare_baseline(
132
- self.event.data["type"],
133
- f"{probe_value}'",
134
- cookies,
135
- additional_params_populate_empty=True,
136
- parameter_name_suffix="[$eq]",
137
- parameter_name_suffix_additional_params="[$eq]",
138
- )
139
- except HttpCompareError as e:
140
- self.verbose(f"Encountered HttpCompareError Sending Compare Baseline: {e}")
141
-
142
- if nosqli_negation_baseline:
143
- try:
144
- (
145
- nosqli_negate_comparison,
146
- nosqli_negate_diff_reasons,
147
- nosqli_negate_reflection,
148
- nosqli_negate_response,
149
- ) = await self.compare_probe(
150
- nosqli_negation_baseline,
151
- self.event.data["type"],
152
- f"{probe_value}'",
153
- cookies,
154
- additional_params_populate_empty=True,
155
- parameter_name_suffix="[$ne]",
156
- parameter_name_suffix_additional_params="[$ne]",
157
- )
158
- if nosqli_negate_response:
159
- if not nosqli_negate_comparison and nosqli_negate_diff_reasons != ["header"]:
160
- # If we are about to report a finding, rule out a false positive from unstable URL by sending another probe with the baseline values, and ensure those dont also come back as different
161
- (
162
- nosqli_negate_comfirm_comparison,
163
- nosqli_negate_confirm_diff_reasons,
164
- nosqli_negate_confirm_reflection,
165
- nosqli_negate_confirm_response,
166
- ) = await self.compare_probe(
167
- nosqli_negation_baseline,
168
- self.event.data["type"],
169
- f"{probe_value}'",
170
- cookies,
171
- additional_params_populate_empty=True,
172
- parameter_name_suffix="[$eq]",
173
- parameter_name_suffix_additional_params="[$eq]",
174
- )
175
- if nosqli_negate_comfirm_comparison:
176
- self.results.append(
177
- {
178
- "type": "FINDING",
179
- "description": f"Possible NoSQL Injection. {self.metadata()} Detection Method: [Parameter Name Operator Injection - Negation ([$ne])] Differences: [{'.'.join(nosqli_negate_diff_reasons)}]",
180
- }
181
- )
182
- except HttpCompareError as e:
183
- self.verbose(f"Encountered HttpCompareError Sending Compare Probe: {e}")