diff --git a/detection.py b/detection.py index afe0c0a..bfa5a16 100644 --- a/detection.py +++ b/detection.py @@ -9,6 +9,7 @@ from functions import * # Analyse the source code of a single page def analysis(path): with open(path, 'r') as content_file: + false_positive = False # Clean source for a better detection content = content_file.read() @@ -26,12 +27,14 @@ def analysis(path): # No declaration for $_GET, $_POST ... if check_exception(vuln[1]) == False: + # Look for the declaration of $something = xxxxx - declaration_text, line_declaration = check_declaration(content, vuln[1]) + false_positive, declaration_text, line_declaration = check_declaration(content, vuln[1], path) # Display all the informations line_vuln = find_line_vuln(path, payload, vuln, content) - display(path, payload, vuln, line_vuln, declaration_text, line_declaration) + if not false_positive: + display(path, payload, vuln, line_vuln, declaration_text, line_declaration) # Run thru every files and subdirectories diff --git a/functions.py b/functions.py index dc378a0..764078b 100644 --- a/functions.py +++ b/functions.py @@ -81,14 +81,29 @@ def check_exception(match): return False # Check declaration -# TODO: should follow any include and add its content -# TODO: should handle constant variable -def check_declaration(content, vuln): - # Parse include and content = include_content + content +def check_declaration(content, vuln, path): + # Follow and parse include, then add it's content + regex_declaration = re.compile("(include.*?|require.*?)\([\"\'](.*?)[\"\']\)") + includes = regex_declaration.findall(content) + # Path is the path of the current scanned file, we can use it to compute the relative include + for include in includes: + relative_include = os.path.dirname(path)+"/" + path_include = relative_include + include[1] + with open(path_include, 'r') as f: + content = f.read() + content + + # Extract declaration regex_declaration = re.compile("\$"+vuln[1:]+"([\t ]*)=(?!=)(.*)") declaration = regex_declaration.findall(content) if len(declaration)>0: - declaration_text = "$"+vuln[1:] +declaration[0][0]+"="+declaration[0][1] - line_declaration = find_line_declaration(declaration_text, content) - return (declaration_text,line_declaration) - return ("","") + + # TODO: Check constant then return True if constant because it's false positive + declaration_text = "$"+vuln[1:] +declaration[0][0]+"="+declaration[0][1] + line_declaration = find_line_declaration(declaration_text, content) + #regex_constant = re.compile("\$"+vuln[1:]+"([\t ]*)=[\t ]*([\"\'][a-zA-Z0-9]*?[\"\']);") + #false_positive = regex_constant.match(declaration_text) + #if false_positive: + # return (True, "","") + return (False, declaration_text,line_declaration) + + return (False, "","") diff --git a/index.py b/index.py index 1fbe024..c784b95 100644 --- a/index.py +++ b/index.py @@ -5,12 +5,13 @@ # How to use : python index.py --dir test # Educational purpose only ! -# TODO remonter les includes (parse include/require xxx , chercher son contenu et l'ajouter au debut du content actuel) # TODO afficher toutes les modifications de la variable - # TODO enlever les faux positifs : constantes # BUG variable multiple (check en recursif dans vuln) # BUG color var['something'] # BUG detection include +# BUG SQLi 2 ligne 17 not found +# TODO print help if no dir in arg import sys import argparse @@ -23,20 +24,20 @@ if __name__ == "__main__": results = parser.parse_args() if results.dir != None: - print " ██▒ █▓ █ ██ ██▓ ███▄ █▓██ ██▓" - print "▓██░ █▒ ██ ▓██▒▓██▒ ██ ▀█ █ ▒██ ██▒" - print " ▓██ █▒░▓██ ▒██░▒██░ ▓██ ▀█ ██▒ ▒██ ██░" - print " ▒██ █░░▓▓█ ░██░▒██░ ▓██▒ ▐▌██▒ ░ ▐██▓░" - print " ▒▀█░ ▒▒█████▓ ░██████▒▒██░ ▓██░ ░ ██▒▓░" - print " ░ ▐░ ░▒▓▒ ▒ ▒ ░ ▒░▓ ░░ ▒░ ▒ ▒ ██▒▒▒ " - print " ░ ░░ ░░▒░ ░ ░ ░ ░ ▒ ░░ ░░ ░ ▒░▓██ ░▒░ " - print " ░░ ░░░ ░ ░ ░ ░ ░ ░ ░ ▒ ▒ ░░ " - print " ░ ░ ░ ░ ░ ░ ░ " - print " ░ ░ ░ " - print " ░ Copyright @pentest_swissky " + print " (`-') <-. (`-')_ _(`-') (`-') _" + print " _(OO ) .-> <-. \( OO) ) .-> _ .-> ( (OO ).-> ( OO).-/" + print ",--.(_/,-.\,--.(,--. ,--. ) ,--./ ,--/ ,--.' ,-.\-,-----.(`-')----. \ .'_ (,------." + print "\ \ / (_/| | |(`-') | (`-')| \ | | (`-')'.' / | .--./( OO).-. ''`'-..__) | .---'" + print " \ / / | | |(OO ) | |OO )| . '| |)(OO \ / /_) (`-')( _) | | || | ' |(| '--." + print "_ \ /_)| | | | \(| '__ || |\ | | / /) || |OO ) \| |)| || | / : | .--'" + print "\-'\ / \ '-'(_ .' | |'| | \ | `-/ /` (_' '--'\ ' '-' '| '-' / | `---." + print " `-' `-----' `-----' `--' `--' `--' `-----' `-----' `------' `------'" + print " Copyright @pentest_swissky " print "\n\033[1mAnalyzing '"+results.dir+"' source code\033[0m" if os.path.isfile(results.dir): analysis(results.dir) else: recursive(results.dir,0) + + # else print help diff --git a/test/configuration.php b/test/configuration.php new file mode 100644 index 0000000..9ffc527 --- /dev/null +++ b/test/configuration.php @@ -0,0 +1,9 @@ + diff --git a/test/sqli.php b/test/sqli.php index 6e1f354..677a4cc 100755 --- a/test/sqli.php +++ b/test/sqli.php @@ -11,7 +11,7 @@
0){ $data = mysql_fetch_assoc($sql); echo "Welcome ".$data['username']."
"; @@ -23,13 +23,13 @@ } else{ echo "

Congratulation, you're graduated !

"; - } - echo "Log Out"; - } + } + echo "Log Out"; + } else{ echo "Error
"; echo "Unknown username or password

"; - echo "Retry"; + echo "Retry"; } } else{ @@ -39,13 +39,13 @@
- + ?>
- \ No newline at end of file +