#!/usr/bin/perl5.8.4
#***********************************************************************
#
# inject.sara - frontend for SQLiX SQL injection
#
#***********************************************************************
require 'perllib/getopts.pl';
require 'perl/misc.pl';
require 'config/paths.pl';
$sid_file = "rules/sid.def";

Getopts("v");
$target = "$ARGV[0]";
$service="http";
$sql_inject         = "$ENV{SQL_INJECT}";
$sql_inject_timeout = "$ENV{SQL_INJECT_TIMEOUT}";
$sql_inject_dump    = "$ENV{SQL_INJECT_DUMP}";
if ($sql_inject eq "0") {
  $status         = "u";
  $service_output = "";
  $trusted        = "";
  $trustee        = "";
  $text           = "SQL injection module not activated";
  &sara_print;
  exit;
}

if (! $target) {
  print "Usage: bin/inject.sara [-v] target\n\n";
  exit;
}
$_target = "http://$target";
@candidates = "";
@methods    = "";
$args  = "\-method_taggy";
$args .= " \-method_error";
$args .= " \-method_blind_integer";
$args .= " \-method_blind_statement";
$args .= " \-exploit \-v=10";
$c = 1;
open (DUMP, ">.dump/$target.inject") if ($sql_inject_dump =~ /yes/i);
$sql_inject_timeout = 900 if (! $sql_inject_timeout); 
print "bin/timeout $sql_inject_timeout $SQLIX \-crawl\=\"$_target\" $args\n" if $opt_v;
open (CRAWL, "bin/timeout $sql_inject_timeout $SQLIX \-crawl\=\"$_target\" $args|");
while (<CRAWL>) {
   print if $opt_v;
   print DUMP "$_" if ($sql_inject_dump =~ /yes/i);
#}
#close (CRAWL);
#open(CRAWL, "zap");
#while (<CRAWL>) {
  chomp;
  $current_url = $_ if (/^\s+http/);
  $current_url =~ s/\s+//g;
  $method_test = $_ if (/Method\: /);
  if (/\[FOUND\]/ && ($current_url ne $candidates[$c-1])) {
    $candidates[$c++] = $current_url; 
    $methods[$c]      = $method_test;
  }
}
if ($opt_v) {
   print "Candidates FOUND\n";
    for (@candidates) {
      print "   uri  =  $_\n";
    }
    print "\n\n";
}
  $cc = 1;
  for $c (@candidates) {
    $method = $methods[$cc++];
    $printed = 0;
    if ($c =~ /$target/) {
    print "$SQLIX \-url\=\"$c\" $args\n" if $opt_v; 
    print DUMP "$SQLIX \-url\=\"$c\" $args\n";
    open(SQL, "$SQLIX \-url\=\"$c\" $args|");
    while(<SQL>) {
       print if $opt_v;
       print DUMP "$_"  if ($sql_inject_dump =~ /yes/i);
        $output = $_;
       if ($printed == 1) {
         ($d0,$arg1,$arg2,$arg3) = split(/\[/, $output);
         ($arg1, $d0)      = split(/\]/, $arg1);
         ($arg2, $d0)      = split(/\]/, $arg2);
         ($arg3, $d0)      = split(/\]/, $arg3);
         ($d0, $arg3)      = split(/\-/, $arg3);
         $arg2 =~ s/$target//;
         $arg2 =~ s/http:\/\///;
         $arg3 =~ s/\s+//;
         $sid = "HTTP-401";
         $sid = "HTTP-400" if $arg3;
         ($severity,$service_output,$text, $cve) = &get_sid($sid);
         $status  = "a";
         $trustee = "ANY\@ANY";
         $trusted = "ANY\@ANY";
         $text   =~ s/\;/$arg1/;
         $text   =~ s/\;/$arg2/;
         
         &sara_print;
       }
       $printed = 1 if /^RESULTS/;
    }
   close(SQL);
   } 
  }
  close (DUMP);
