SQL Inject

#!/usr/bin/env python

####################################################################################

#

# sqlinject-finder.py

#

# Author: XGrats

# Date : 12/02/2010

# Description: Simple python script that parses through a pcap and looks at the

# GET and POST request data for suspicious and possible SQL injects.

#

####################################################################################

import dpkt, re, urllib, sys, getopt

tab = False

#removes inline comments that can sometimes be used for obfuscating the sql

def removeComments(val):

while True:

index = val.find("/*")

index2 = val.find("*/")

if index != -1 and index2 != -1:

#looks like there is some type of SQL obfuscation, let's remove the comments

remove = val[index:index2+2]

val = val.replace(remove, "")

else:

break

return val

#checks for common sql injection tactics using all the variables from post or get data

def analyzeRequest(vals, sIP, page, frameno):

var = vals[0] #the variable, i.e. in id=1, the var is id

val = vals[1] #the value, i.e. in id=1, the val is 1

val = val.decode('ascii') #not sure if this is really doing anything, but we need to deal with non ascii characters for analysis

val = urllib.unquote(val) #removes url encodings like %20 for space, etc

val = val.replace("+", " ") #sometimes in urls, instead of a space you can have a + . So, we want to remove those for analysis

#print val

display = [False, sIP, page, var, val]

##### Look for obfuscation techniques ######

index = val.find("/*")

if index != -1:

display[0] = True

display.append("Might be attempting to obfuscate a SQL statement with a comment")

val = removeComments(val)

##### Look for commenting out the end of a MSSQL statement ######

index = val.rfind("--")

if index != -1:

display[0] = True

display.append("Might be attempting to end a SQL statement by commenting out the remaining statement")

##### Look for commenting out the end of a MySQL statement #####

index = val.rfind("#")

if index != -1:

display[0] = True

display.append("Might be attempting to end a SQL statement by commenting out the remaining statement")

##### Look for common SQL syntax in the values of a param #####

sqlvals = ("cast(", "declare ", "select ", "union ", "varchar", "set(", "create ", " or ", " NULL,", " concat(")

for sql in sqlvals:

index = val.lower().find(sql)

if index != -1:

display[0] = True

display.append("Possible use of SQL syntax in variable")

break

if display[0] == True:

if tab:

line = str(display[1]) + "\t" + str(display[2]) + "\t" + str(display[3]) + "=" + str(display[4]) + "\t" + str(frameno)

for i in range(len(display)-5):

line = line + "\t" + str(display[i+5])

print line

else:

print "Source : " + str(display[1])

print "Page : " + str(display[2])

print "Value : " + str(display[3]) + "=" + str(display[4])

print "Frame : " + str(frameno)

for i in range(len(display)-5):

print "Reason : " + str(display[i+5])

print ""

def octetIP(sIP):

ip = ""

for s in sIP:

ip = ip + str(ord(s)) + "."

return ip[:-1]

#reads the pcap file and parses out get and post requests for analysis

def parsepcap(filename):

try:

f = open(filename, 'rb')

except:

print "Error reading file. Please make sure the file exists"

sys.exit()

try:

pcap = dpkt.pcap.Reader(f)

except:

print "Error reading file. Please make sure the file is a valid pcap file."

sys.exit()

sIP=""

page=""

frameno = 1

for ts, buf in pcap:

eth = dpkt.ethernet.Ethernet(buf)

ip = eth.data

#make sure we are dealing with ip (2048) and tcp (proto=6)

if eth.type ==2048 and ip.p == 6:

tcp = ip.data

#assuming http is running on port 80

if tcp.dport == 80 and len(tcp.data) > 0:

index = 1

getvals = ""

try:

http = dpkt.http.Request(tcp.data)

url = http.uri

#deal with post data

if http.method == "POST":

getvals=http.body

index = url.find("?")

if index != -1:

page = url[:index]

else:

page = url

#deal with GET data

elif http.method == "GET":

index = url.rfind("?")

if index != -1:

getvals = url[index+1:]

page = url[:index]

except:

data = tcp.data

index = str(data).find("POST")

if index == 0:

url = str(data).split(" ")

page = url[1] #POST is usually always the second value in the POST

index = str(data).count("\n") #need to look into this method a little more, basically, we want to get POST data out of other streams

if index == 0:

index = str(data).find("=")

if index != -1:

getvals = str(data)

#split up each variable and its cooresponding value

if getvals != "":

getvals = getvals.split("&")

for val in getvals:

i = val.find("=")

val = (val[:i], val[i+1:])

sIP = octetIP(ip.src)

analyzeRequest(val, sIP, page, frameno)

frameno += 1

f.close()

#usage stuff

def usage():

print ""

print "This tool parses through a pcap file and looks for potential SQL injection attempts."

print ""

print "usage: sqlinject-finder.py -f filename [-t]"

print "Options and arguments (and corresponding environment variables):"

print "-f, --filename : valid pcap file"

print "-t, --tab : prints output in tab delimited format"

print "-h, --help : shows this screen"

print ""

print "Example: #python sqlinject-finder.py -f capture.pcap"

print " #python sqlinject-finder.py -f capture.pcap -t > capture.tsv"

print ""

def main():

try:

opts, args = getopt.getopt(sys.argv[1:], "f:th", ["filename=", "tab", "help"])

except getopt.GetoptError, err:

print str(err)

usage()

sys.exit(2)

filename = ""

for o, a in opts:

if o in ("-f", "--filename"):

filename = a

elif o in ("-t", "--tab"):

global tab

tab = True

elif o in ("-h", "--help"):

usage()

sys.exit()

else:

usage()

sys.exit()

if (filename == ""):

print "please specify a filename"

sys.exit()

if tab:

print "Source\tPage\tValue\tFrame\tReason(s)"

parsepcap(filename)

if __name__ == "__main__":

main()