library/src/exploitation/WebExploitation/BlindSQLiDetection/BP-WebExploitationBlindSQLiDetection.cc
char * BP_WebAssessmentGenerateBlindSQLiFormTestSet
(
	P_BP_WEB_BLIND_SQLINJ_TEST  test,
	P_BP_HTML_FORM_LIST         form,
	P_BP_HTML_ANCHOR_DELIMITERS delims,
	char *                      asciiXSSPayload,
	size_t                      subAtPosition
)
{

	// NULL Checks
	if (!form || !delims)
		return NULL;

	// form must have inputs (return null otherwise)
	if (!form->inputs)
		return NULL;

	// Length calculation variable
	size_t setSize = 0;

	// Add the length of the test
	if(test->testFront)
		setSize += bpstrlen(test->testFront);
	if(test->testTail)
		setSize += bpstrlen(test->testTail);

	// Append size of start delimiter
	setSize += delims->sLen;
	if(asciiXSSPayload)
		setSize += bpstrlen(asciiXSSPayload);

	// used in the loop below for form input calculations (not allocated)
	P_BP_HTML_INPUT_PROPERTY_LIST tmpName   = NULL;
	P_BP_HTML_INPUT_PROPERTY_LIST tmpValue  = NULL;

	// Save first pointer
	P_BP_HTML_INPUT_LIST inputsFirst = form->inputs->first;

	// walk the list and grow buffer to an appropriate size
	P_BP_HTML_INPUT_LIST inputs = form->inputs->first;


	// walk inputs and generate the correct size for our buffer
	for
	(
		inputs = inputsFirst;
		inputs;
		inputs = inputs->next
	)
	{

		tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
		if (!tmpName)
			continue;

		setSize += tmpName->nLen;
		setSize += tmpName->cLen;

		// value does not have to be set arbitrarily by the developer, if not set
		// add an arbitrary 1024 bytes to the buffer.
		tmpValue = HTMLGetInputPropertyByNameI(inputs->properties, "value");
		if (!tmpValue)
		{
			setSize += 1024;
		}
		else
		{
			setSize += tmpValue->nLen;
			setSize += tmpValue->cLen;
		}

		setSize += delims->vLen;
		setSize += delims->nLen;

	}

	// reset pointer
	inputs = inputsFirst;

	// allocate space for the test
	char *embedStr = (char *) bpcalloc(setSize + 4096, 1);
	if (!embedStr)
		return NULL;

	// variable position counter
	size_t posCounter = 0;

	// Walk the input list and generate buffer
	for
	(
		inputs = inputs->first;
		inputs;
		inputs = inputs->next
	)
	{

		// if were at the position of substitution, go ahead and perform the substitution
		if (posCounter == subAtPosition)
		{

			// retrieve the property name
			tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
			if (!tmpName)
				break;

			// generate the substitution
			snprintf
			(
					&embedStr[bpstrlen(embedStr)],
					setSize,
					"%s%s%s%s%s",
					tmpName->content ? tmpName->content :  "",
					delims->valueDelimiter,
					test->testFront,
					asciiXSSPayload ? asciiXSSPayload :    "",
					test->testTail ? test->testTail :      ""
			);

		}
		else
		{

			// gather the input property
			tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
			if (!tmpName)
				break;

			// Value does not have to be set, if its not set use the string ABC
			tmpValue = HTMLGetInputPropertyByNameI(inputs->properties, "value");

			// if no name, just embed
			if (!tmpValue)
			{
				snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s", tmpName->content, delims->valueDelimiter, "ABC");
			}
			else // embed with name
			{
				snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s", tmpName->content, delims->valueDelimiter, tmpValue->content);
			}

		}

		// append next delimiter
		strncat(embedStr, delims->nextDelimiter, delims->nLen);

		// increments to determine proper replacements
		posCounter++;

	}

	// remove last next delimiter
	if (embedStr[bpstrlen(embedStr) - 1] == (char) delims->nextDelimiter[0])
		embedStr[bpstrlen(embedStr) - 1] = '\0';

	// return allocated string
	return embedStr;
}
// Generates a form input string suitable for blind sql injection testing.
Generates a form input string suitable for blind sql injection testing.
Generates a form input string suitable for blind sql injection testing .
char * BP_WebAssessmentGenerateBlindSQLiFormTestSet
(
	P_BP_WEB_BLIND_SQLINJ_TEST  test,
	P_BP_HTML_FORM_LIST         form,
	P_BP_HTML_ANCHOR_DELIMITERS delims,
	char *                      asciiXSSPayload,
	size_t                      subAtPosition
)
{
	if (!form || !delims)
		return NULL;
	if (!form->inputs)
		return NULL;
	size_t setSize = 0;
	if(test->testFront)
		setSize += bpstrlen(test->testFront);
	if(test->testTail)
		setSize += bpstrlen(test->testTail);
	setSize += delims->sLen;
	if(asciiXSSPayload)
		setSize += bpstrlen(asciiXSSPayload);
	P_BP_HTML_INPUT_PROPERTY_LIST tmpName   = NULL;
	P_BP_HTML_INPUT_PROPERTY_LIST tmpValue  = NULL;
	P_BP_HTML_INPUT_LIST inputsFirst = form->inputs->first;
	P_BP_HTML_INPUT_LIST inputs = form->inputs->first;
	for
	(
		inputs = inputsFirst;
		inputs;
		inputs = inputs->next
	)
	{
		tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
		if (!tmpName)
			continue;
		setSize += tmpName->nLen;
		setSize += tmpName->cLen;
		tmpValue = HTMLGetInputPropertyByNameI(inputs->properties, "value");
		if (!tmpValue)
		{
			setSize += 1024;
		}
		else
		{
			setSize += tmpValue->nLen;
			setSize += tmpValue->cLen;
		}
		setSize += delims->vLen;
		setSize += delims->nLen;
	}
	inputs = inputsFirst;
	char *embedStr = (char *) bpcalloc(setSize + 4096, 1);
	if (!embedStr)
		return NULL;
	size_t posCounter = 0;
	for
	(
		inputs = inputs->first;
		inputs;
		inputs = inputs->next
	)
	{
		if (posCounter == subAtPosition)
		{
			tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
			if (!tmpName)
				break;
			snprintf
			(
					&embedStr[bpstrlen(embedStr)],
					setSize,
					"%s%s%s%s%s",
					tmpName->content ? tmpName->content :  "",
					delims->valueDelimiter,
					test->testFront,
					asciiXSSPayload ? asciiXSSPayload :    "",
					test->testTail ? test->testTail :      ""
			);
		}
		else
		{
			tmpName = HTMLGetInputPropertyByNameI(inputs->properties, "name");
			if (!tmpName)
				break;
			tmpValue = HTMLGetInputPropertyByNameI(inputs->properties, "value");
			if (!tmpValue)
			{
				snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s", tmpName->content, delims->valueDelimiter, "ABC");
			}
			else 
			{
				snprintf(&embedStr[bpstrlen(embedStr)], setSize, "%s%s%s", tmpName->content, delims->valueDelimiter, tmpValue->content);
			}
		}
		strncat(embedStr, delims->nextDelimiter, delims->nLen);
		posCounter++;
	}
	if (embedStr[bpstrlen(embedStr) - 1] == (char) delims->nextDelimiter[0])
		embedStr[bpstrlen(embedStr) - 1] = '\0';
	return embedStr;
}
char * BP_WebAssessmentGenerateBlindSQLiFormTestSet ( P_BP_WEB_BLIND_SQLINJ_TEST test , P_BP_HTML_FORM_LIST form , P_BP_HTML_ANCHOR_DELIMITERS delims , char * asciiXSSPayload , size_t subAtPosition ) { if ( ! form || ! delims ) return NULL ; if ( ! form -> inputs ) return NULL ; size_t setSize = 0 ; if ( test -> testFront ) setSize += bpstrlen ( test -> testFront ) ; if ( test -> testTail ) setSize += bpstrlen ( test -> testTail ) ; setSize += delims -> sLen ; if ( asciiXSSPayload ) setSize += bpstrlen ( asciiXSSPayload ) ; P_BP_HTML_INPUT_PROPERTY_LIST tmpName = NULL ; P_BP_HTML_INPUT_PROPERTY_LIST tmpValue = NULL ; P_BP_HTML_INPUT_LIST inputsFirst = form -> inputs -> first ; P_BP_HTML_INPUT_LIST inputs = form -> inputs -> first ; for ( inputs = inputsFirst ; inputs ; inputs = inputs -> next ) { tmpName = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpName ) continue ; setSize += tmpName -> nLen ; setSize += tmpName -> cLen ; tmpValue = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpValue ) { setSize += 1024 ; } else { setSize += tmpValue -> nLen ; setSize += tmpValue -> cLen ; } setSize += delims -> vLen ; setSize += delims -> nLen ; } inputs = inputsFirst ; char * embedStr = ( char * ) bpcalloc ( setSize + 4096 , 1 ) ; if ( ! embedStr ) return NULL ; size_t posCounter = 0 ; for ( inputs = inputs -> first ; inputs ; inputs = inputs -> next ) { if ( posCounter == subAtPosition ) { tmpName = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpName ) break ; snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , tmpName -> content ? tmpName -> content : " " , delims -> valueDelimiter , test -> testFront , asciiXSSPayload ? asciiXSSPayload : " " , test -> testTail ? test -> testTail : " " ) ; } else { tmpName = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpName ) break ; tmpValue = HTMLGetInputPropertyByNameI ( inputs -> properties , " " ) ; if ( ! tmpValue ) { snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , tmpName -> content , delims -> valueDelimiter , " " ) ; } else { snprintf ( & embedStr [ bpstrlen ( embedStr ) ] , setSize , " " , tmpName -> content , delims -> valueDelimiter , tmpValue -> content ) ; } } strncat ( embedStr , delims -> nextDelimiter , delims -> nLen ) ; posCounter ++ ; } if ( embedStr [ bpstrlen ( embedStr ) - 1 ] == ( char ) delims -> nextDelimiter [ 0 ] ) embedStr [ bpstrlen ( embedStr ) - 1 ] = ' \0 ' ; return embedStr ; }
Generates a form input string suitable for blind sql injection testing.
Generates a form input string suitable for blind sql injection testing .
// NULL Checks // form must have inputs (return null otherwise) // Length calculation variable // Add the length of the test // Append size of start delimiter // used in the loop below for form input calculations (not allocated) // Save first pointer // walk the list and grow buffer to an appropriate size // walk inputs and generate the correct size for our buffer // value does not have to be set arbitrarily by the developer, if not set // add an arbitrary 1024 bytes to the buffer. // reset pointer // allocate space for the test // variable position counter // Walk the input list and generate buffer // if were at the position of substitution, go ahead and perform the substitution // retrieve the property name // generate the substitution // gather the input property // Value does not have to be set, if its not set use the string ABC // if no name, just embed // embed with name // append next delimiter // increments to determine proper replacements // remove last next delimiter // return allocated string