<commit_before>=begin
  $Id$

                  Arachni
  Copyright (c) 2010 Tasos "Zapotek" Laskos <<EMAIL>>

  This is free software; you can copy and distribute and modify
  this program under the term of the GPL v2.0 License
  (See LICENSE file for details)

=end

module Arachni

module Modules

#
# SQL Injection audit module.<br/>
# It audits links, forms and cookies.
#
#
# @author: Tasos "Zapotek" Laskos
#                                      <<EMAIL>>
#                                      <<EMAIL>>
# @version: 0.1.4
#
# @see http://cwe.mitre.org/data/definitions/89.html
# @see http://unixwiz.net/techtips/sql-injection.html
# @see http://en.wikipedia.org/wiki/SQL_injection
# @see http://www.securiteam.com/securityreviews/5DP0N1P76E.html
# @see http://www.owasp.org/index.php/SQL_Injection
#
class SQLInjection < Arachni::Module::Base

    include Arachni::Module::Utilities

    def initialize( page )
        super( page )
    end

    def prepare( )

        #
        # it's better to save big arrays to a file
        # a big array is ugly, messy and can't be updated as easily
        #
        # but don't open the file yourself, use get_data_file( filename )
        # with a block and read each line
        #
        # keep your files under modules/<modtype>/<modname>/
        #

        #
        # we make this a class variable and populate it only once
        # to reduce file IO
        #
        @@__regexps ||= []

        if @@__regexps.empty?
            read_file( 'regexp_ids.txt' ) { |regexp| @@__regexps << regexp }
        end

        # prepare the string that will hopefully cause the webapp
        # to output SQL error messages
        @__injection_str = '\'--`'

        @__opts = {
            :format => [ Format::APPEND ],
            :regexp => @@__regexps
        }

    end

    def run( )
        # send the bad characters in @__injection_strs via the page forms
        # and pass a block that will check for a positive result
        audit( @__injection_str, @__opts )<commit_msg>injection stings has been converted to an array since the \")\" char needs to be injected individually<commit_after>=begin
  $Id$

                  Arachni
  Copyright (c) 2010 Tasos "Zapotek" Laskos <<EMAIL>>

  This is free software; you can copy and distribute and modify
  this program under the term of the GPL v2.0 License
  (See LICENSE file for details)

=end

module Arachni

module Modules

#
# SQL Injection audit module.<br/>
# It audits links, forms and cookies.
#
#
# @author: Tasos "Zapotek" Laskos
#                                      <<EMAIL>>
#                                      <<EMAIL>>
# @version: 0.1.4
#
# @see http://cwe.mitre.org/data/definitions/89.html
# @see http://unixwiz.net/techtips/sql-injection.html
# @see http://en.wikipedia.org/wiki/SQL_injection
# @see http://www.securiteam.com/securityreviews/5DP0N1P76E.html
# @see http://www.owasp.org/index.php/SQL_Injection
#
class SQLInjection < Arachni::Module::Base

    include Arachni::Module::Utilities

    def initialize( page )
        super( page )
    end

    def prepare( )

        #
        # it's better to save big arrays to a file
        # a big array is ugly, messy and can't be updated as easily
        #
        # but don't open the file yourself, use get_data_file( filename )
        # with a block and read each line
        #
        # keep your files under modules/<modtype>/<modname>/
        #

        #
        # we make this a class variable and populate it only once
        # to reduce file IO
        #
        @@__regexps ||= []

        if @@__regexps.empty?
            read_file( 'regexp_ids.txt' ) { |regexp| @@__regexps << regexp }
        end

        # prepare the string that will hopefully cause the webapp
        # to output SQL error messages
        @__injection_str = [
            '\'`--',
            ')'
            ]

        @__opts = {
            :format => [ Format::APPEND ],
            :regexp => @@__regexps
        }

    end

    def run( )
        @__injection_str.each { |str| audit( str, @__opts ) }
{'fraction_non_alphanumeric': 0.10401370533529124, 'fraction_numerical': 0.00783162016642193, 'mean_word_length': 1.970203488372093, 'pattern_counts': {'":': 0, '<': 27, '<?xml version=': 0, '>': 25, 'https://': 0, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6472589', 'n_tokens_mistral': 1305, 'n_tokens_neox': 1228, 'n_words': 386}