Skip to content

Commit

Permalink
Adding CommandInjection Vulnerability levels
Browse files Browse the repository at this point in the history
  • Loading branch information
@preetkaran20
preetkaran20 committed Jul 28, 2020
1 parent ba21c84 commit e1a71b9
Show file tree
Hide file tree
Showing 6 changed files with 247 additions and 42 deletions.
2 changes: 2 additions & 0 deletions src/main/java/org/sasanlabs/internal/utility/LevelEnum.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ public enum LevelEnum {
LEVEL_8,
LEVEL_9,
LEVEL_10,
LEVEL_11,
LEVEL_12,
SECURE;

public static LevelEnum getLevelEnumByName(String name) throws ServiceApplicationException {
Expand Down
200 changes: 171 additions & 29 deletions ...a/org/sasanlabs/service/vulnerability/commandInjection/CommandInjectionVulnerability.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,8 @@
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.concurrent.TimeUnit;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import java.util.function.Supplier;
import java.util.regex.Pattern;
import org.sasanlabs.internal.utility.LevelEnum;
import org.sasanlabs.internal.utility.annotations.AttackVector;
import org.sasanlabs.internal.utility.annotations.VulnerabilityLevel;
Expand All @@ -19,46 +17,190 @@
import org.sasanlabs.vulnerability.types.VulnerabilitySubType;
import org.sasanlabs.vulnerability.types.VulnerabilityType;


/**
* This class contains vulnerabilities related to Command Injection.
* <a href="https://owasp.org/www-community/attacks/Command_Injection">For More information</a>
*
* This class contains vulnerabilities related to Command Injection. <a
* href="https://owasp.org/www-community/attacks/Command_Injection">For More information</a>
*
* @author KSASAN [email protected]
*/
@VulnerableServiceRestEndPoint(
descriptionLabel = "COMMAND_INJECTION_VULNERABILITY",
value = "CommandInjectionVulnerability",
type = {VulnerabilityType.COMMAND_INJECTION})
public class CommandInjectionVulnerability implements ICustomVulnerableEndPoint{
public class CommandInjectionVulnerability implements ICustomVulnerableEndPoint {

private static final String IP_ADDRESS = "ipaddr";
private static final Pattern SEMICOLON_SPACE_LOGICAL_AND_PATTERN = Pattern.compile("[;& ]");
private static final Pattern IP_ADDRESS_PATTERN =
Pattern.compile("\\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\\.|$)){4}\\b");

private static final String IP_ADDRESS = "ipaddr";
private static final transient Logger LOGGER = LogManager.getLogger(CommandInjectionVulnerability.class);
private StringBuilder getResponseFromPingCommand(String ipAddress, Supplier<Boolean> predicate)
throws IOException {
boolean isWindows = System.getProperty("os.name").toLowerCase().startsWith("windows");
StringBuilder stringBuilder = new StringBuilder();
if (predicate.get()) {
Process process;
if (!isWindows) {
process =
new ProcessBuilder(new String[] {"bash", "-c", "ping -c 2 " + ipAddress})
.redirectErrorStream(true)
.start();
} else {
process =
new ProcessBuilder(new String[] {"cmd", "/c", "ping -n 2 " + ipAddress})
.redirectErrorStream(true)
.start();
}
try (BufferedReader bufferedReader =
new BufferedReader(new InputStreamReader(process.getInputStream()))) {
bufferedReader.lines().forEach(val -> stringBuilder.append(val).append("\n"));
}
}
return stringBuilder;
}

@AttackVector(
@AttackVector(
vulnerabilityExposed = VulnerabilitySubType.COMMAND_INJECTION,
description = "JWT_URL_EXPOSING_SECURE_INFORMATION")
@VulnerabilityLevel(
value = LevelEnum.LEVEL_1,
descriptionLabel = "URL_CONTAINING_JWT_TOKEN",
//htmlTemplate = "LEVEL_1/JWT_Level1",
// htmlTemplate = "LEVEL_1/JWT_Level1",
parameterName = IP_ADDRESS,
sampleValues = {""})
public ResponseBean<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
ParameterBean parameterBean) throws ServiceApplicationException, IOException {
String ipAddress = parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS);
Supplier<Boolean> condition = () -> ipAddress != null;
return new ResponseBean<GenericVulnerabilityResponseBean<String>>(
new GenericVulnerabilityResponseBean<String>(
this.getResponseFromPingCommand(ipAddress, condition).toString(), true));
}

@AttackVector(
vulnerabilityExposed = VulnerabilitySubType.COMMAND_INJECTION,
description = "JWT_URL_EXPOSING_SECURE_INFORMATION")
@VulnerabilityLevel(
value = LevelEnum.LEVEL_2,
descriptionLabel = "URL_CONTAINING_JWT_TOKEN",
// htmlTemplate = "LEVEL_1/JWT_Level1",
parameterName = IP_ADDRESS,
sampleValues = {""})
public ResponseBean<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel2(
ParameterBean parameterBean) throws ServiceApplicationException, IOException {
String ipAddress = parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS);
Supplier<Boolean> condition =
() ->
ipAddress != null
&& !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
.matcher(parameterBean.getUrl())
.find();
return new ResponseBean<GenericVulnerabilityResponseBean<String>>(
new GenericVulnerabilityResponseBean<String>(
this.getResponseFromPingCommand(ipAddress, condition).toString(), true));
}

// Case Insensitive
@AttackVector(
vulnerabilityExposed = VulnerabilitySubType.COMMAND_INJECTION,
description = "JWT_URL_EXPOSING_SECURE_INFORMATION")
@VulnerabilityLevel(
value = LevelEnum.LEVEL_3,
descriptionLabel = "URL_CONTAINING_JWT_TOKEN",
// htmlTemplate = "LEVEL_1/JWT_Level1",
parameterName = IP_ADDRESS,
sampleValues = {""})
public ResponseBean<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel3(
ParameterBean parameterBean) throws ServiceApplicationException, IOException {
String ipAddress = parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS);
Supplier<Boolean> condition =
() ->
ipAddress != null
&& !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
.matcher(parameterBean.getUrl())
.find()
&& !parameterBean.getUrl().contains("%26")
&& !parameterBean.getUrl().contains("%3B");
return new ResponseBean<GenericVulnerabilityResponseBean<String>>(
new GenericVulnerabilityResponseBean<String>(
this.getResponseFromPingCommand(ipAddress, condition).toString(), true));
}

// e.g Attack
// http://localhost:9090/vulnerable/CommandInjectionVulnerability/LEVEL_3?ipaddr=192.168.0.1%20%7c%20cat%20/etc/passwd
@AttackVector(
vulnerabilityExposed = VulnerabilitySubType.COMMAND_INJECTION,
description = "JWT_URL_EXPOSING_SECURE_INFORMATION")
@VulnerabilityLevel(
value = LevelEnum.LEVEL_4,
descriptionLabel = "URL_CONTAINING_JWT_TOKEN",
// htmlTemplate = "LEVEL_1/JWT_Level1",
parameterName = IP_ADDRESS,
sampleValues = {""})
public ResponseBean<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel4(
ParameterBean parameterBean) throws ServiceApplicationException, IOException {
String ipAddress = parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS);
Supplier<Boolean> condition =
() ->
ipAddress != null
&& !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
.matcher(parameterBean.getUrl())
.find()
&& !parameterBean.getUrl().toUpperCase().contains("%26")
&& !parameterBean.getUrl().toUpperCase().contains("%3B");
return new ResponseBean<GenericVulnerabilityResponseBean<String>>(
new GenericVulnerabilityResponseBean<String>(
this.getResponseFromPingCommand(ipAddress, condition).toString(), true));
}

@AttackVector(
vulnerabilityExposed = VulnerabilitySubType.COMMAND_INJECTION,
description = "JWT_URL_EXPOSING_SECURE_INFORMATION")
@VulnerabilityLevel(
value = LevelEnum.LEVEL_5,
descriptionLabel = "URL_CONTAINING_JWT_TOKEN",
// htmlTemplate = "LEVEL_1/JWT_Level1",
parameterName = IP_ADDRESS,
sampleValues = {""})
public ResponseBean<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel5(
ParameterBean parameterBean) throws ServiceApplicationException, IOException {
String ipAddress = parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS);
Supplier<Boolean> condition =
() ->
ipAddress != null
&& !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
.matcher(parameterBean.getUrl())
.find()
&& !parameterBean.getUrl().toUpperCase().contains("%26")
&& !parameterBean.getUrl().toUpperCase().contains("%3B")
& !parameterBean.getUrl().toUpperCase().contains("%7C");
return new ResponseBean<GenericVulnerabilityResponseBean<String>>(
new GenericVulnerabilityResponseBean<String>(
this.getResponseFromPingCommand(ipAddress, condition).toString(), true));
}

@AttackVector(
vulnerabilityExposed = VulnerabilitySubType.COMMAND_INJECTION,
description = "JWT_URL_EXPOSING_SECURE_INFORMATION")
@VulnerabilityLevel(
value = LevelEnum.LEVEL_6,
descriptionLabel = "URL_CONTAINING_JWT_TOKEN",
// htmlTemplate = "LEVEL_1/JWT_Level1",
parameterName = IP_ADDRESS,
sampleValues = {""})
public ResponseBean<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevelUnsecure(
ParameterBean parameterBean)
throws ServiceApplicationException, IOException {
boolean isWindows = System.getProperty("os.name")
.toLowerCase().startsWith("windows");
Process process;
if(!isWindows) {
process = new ProcessBuilder(new String[] { "bash", "-c", "ping -c 2 " + parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS)}).redirectErrorStream(true).start();
} else {
process = new ProcessBuilder(new String[] { "cmd", "/c", "ping -n 2 " + parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS)}).redirectErrorStream(true).start();
}
StringBuilder response = new StringBuilder();
try(BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(process.getInputStream()))) {
bufferedReader.lines().forEach(val -> response.append(val).append("\n"));
}
return new ResponseBean<GenericVulnerabilityResponseBean<String>>(new GenericVulnerabilityResponseBean<String>(response.toString(), true));
public ResponseBean<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel6(
ParameterBean parameterBean) throws ServiceApplicationException, IOException {
String ipAddress = parameterBean.getQueryParamKeyValueMap().get(IP_ADDRESS);
return new ResponseBean<GenericVulnerabilityResponseBean<String>>(
new GenericVulnerabilityResponseBean<String>(
this.getResponseFromPingCommand(
ipAddress,
() ->
ipAddress != null
&& IP_ADDRESS_PATTERN
.matcher(ipAddress)
.matches())
.toString(),
true));
}
}
Loading

0 comments on commit e1a71b9

Please sign in to comment.