<commit_before>=begin
  $Id$

                  Arachni
  Copyright (c) 2010 <NAME> <<EMAIL>>

  This is free software; you can copy and distribute and modify
  this program under the term of the GPL v2.0 License
  (See LINCENSE file for details)

=end

module Arachni

module Modules

#
# SQL Injection recon module.
# It audits links, forms and cookies.
#
#
# @author: Zapotek <<EMAIL>> <br/>
# @version: $Rev$
#
class SQLInjection < Arachni::Module

    include Arachni::ModuleRegistrar
    include Arachni::UI::Output

    def initialize( page_data, structure )
        super( page_data, structure )

        @__id = @__injection_strs = []
        
        @results = Hash.new
        @results['links'] = []
        @results['forms'] = []
        @results['cookies'] = []
    end

    def prepare( )
        @__id = [
            'System.Data.OleDb.OleDbException',
            '[SQL Server]',
            '[Microsoft][ODBC SQL Server Driver]',
            '[SQLServer JDBC Driver]',
            '[SqlException',
            'System.Data.SqlClient.SqlException',
            'Unclosed quotation mark after the character string',
            "'80040e14'",
            'mssql_query()',
            'odbc_exec()',
            'Microsoft OLE DB Provider for ODBC Drivers',
            'Microsoft OLE DB Provider for SQL Server',
            'Incorrect syntax near',
            'Sintaxis incorrecta cerca de',
            'Syntax error in string in query expression',
            'ADODB.Field (0x800A0BCD)<br>',
            "Procedure '[^']+' requires parameter '[^']+'",
            "ADODB.Recordset'",
            "Unclosed quotation mark before the character string",
            'SQLCODE',
            'DB2 SQL error:',
            'SQLSTATE',
            '[IBM][CLI Driver][DB2/6000]',
            '[CLI Driver]',
            '[DB2/6000]',
            "Sybase message:",
            'Syntax error in query expression',
            'Data type mismatch in criteria expression.',
            'Microsoft JET Database Engine',
            '[Microsoft][ODBC Microsoft Access Driver]',
            '(PLS|ORA)-[0-9][0-9][0-9][0-9]',
            'PostgreSQL query failed:',
            'supplied argument is not a valid PostgreSQL result',
            'pg_query() [:',
            'pg_exec() [:',
            'supplied argument is not a valid MySQL',
            'Column count doesn\'t match value count at row',
            'mysql_fetch_array()',
            'mysql_',
            'on MySQL result index',
            'You have an error in your SQL syntax;',
            'You have an error in your SQL syntax near',
            'MySQL server version for the right syntax to use',
            '[MySQL][ODBC',
            "Column count doesn't match",
            "the used select statements have different number of columns",
            "Table '[^']+' doesn't exist",
            'com.informix.jdbc',
            'Dynamic Page Generation Error:',
            'An illegal character has been found in the statement',
            '<b>Warning</b>: ibase_',
            'Dynamic SQL Error',
            '[DM_QUERY_E_SYNTAX]',
            'has occurred in the vicinity of:',
            'A Parser Error (syntax error)',
            'java.sql.SQLException',
            'Unexpected end of command in statement',
            '[Macromedia][SQLServer JDBC Driver]',
            'SELECT .*? FROM .*?',
            'UPDATE .*? SET .*?',
            'INSERT INTO .*?',
            'Unknown column',
            'where clause',
            'SqlServer'
        ]
        
        @__injection_strs = [
            '\'',
            '--',
            ';'
        ]
        
    end
    
    def run( )
        
        @__injection_strs.each {
            |str|
            
            audit_forms( str ) {
                |var, res|
                __log_results( 'forms', var, res )<commit_msg>prepare(): added another bad SQL char in the list<commit_after>=begin
  $Id$

                  Arachni
  Copyright (c) 2010 <NAME> <<EMAIL>>

  This is free software; you can copy and distribute and modify
  this program under the term of the GPL v2.0 License
  (See LINCENSE file for details)

=end

module Arachni

module Modules

#
# SQL Injection recon module.
# It audits links, forms and cookies.
#
#
# @author: Zapotek <<EMAIL>> <br/>
# @version: $Rev$
#
class SQLInjection < Arachni::Module

    include Arachni::ModuleRegistrar
    include Arachni::UI::Output

    def initialize( page_data, structure )
        super( page_data, structure )

        @__id = @__injection_strs = []
        
        @results = Hash.new
        @results['links'] = []
        @results['forms'] = []
        @results['cookies'] = []
    end

    def prepare( )
        @__id = [
            'System.Data.OleDb.OleDbException',
            '[SQL Server]',
            '[Microsoft][ODBC SQL Server Driver]',
            '[SQLServer JDBC Driver]',
            '[SqlException',
            'System.Data.SqlClient.SqlException',
            'Unclosed quotation mark after the character string',
            "'80040e14'",
            'mssql_query()',
            'odbc_exec()',
            'Microsoft OLE DB Provider for ODBC Drivers',
            'Microsoft OLE DB Provider for SQL Server',
            'Incorrect syntax near',
            'Sintaxis incorrecta cerca de',
            'Syntax error in string in query expression',
            'ADODB.Field (0x800A0BCD)<br>',
            "Procedure '[^']+' requires parameter '[^']+'",
            "ADODB.Recordset'",
            "Unclosed quotation mark before the character string",
            'SQLCODE',
            'DB2 SQL error:',
            'SQLSTATE',
            '[IBM][CLI Driver][DB2/6000]',
            '[CLI Driver]',
            '[DB2/6000]',
            "Sybase message:",
            'Syntax error in query expression',
            'Data type mismatch in criteria expression.',
            'Microsoft JET Database Engine',
            '[Microsoft][ODBC Microsoft Access Driver]',
            '(PLS|ORA)-[0-9][0-9][0-9][0-9]',
            'PostgreSQL query failed:',
            'supplied argument is not a valid PostgreSQL result',
            'pg_query() [:',
            'pg_exec() [:',
            'supplied argument is not a valid MySQL',
            'Column count doesn\'t match value count at row',
            'mysql_fetch_array()',
            'mysql_',
            'on MySQL result index',
            'You have an error in your SQL syntax;',
            'You have an error in your SQL syntax near',
            'MySQL server version for the right syntax to use',
            '[MySQL][ODBC',
            "Column count doesn't match",
            "the used select statements have different number of columns",
            "Table '[^']+' doesn't exist",
            'com.informix.jdbc',
            'Dynamic Page Generation Error:',
            'An illegal character has been found in the statement',
            '<b>Warning</b>: ibase_',
            'Dynamic SQL Error',
            '[DM_QUERY_E_SYNTAX]',
            'has occurred in the vicinity of:',
            'A Parser Error (syntax error)',
            'java.sql.SQLException',
            'Unexpected end of command in statement',
            '[Macromedia][SQLServer JDBC Driver]',
            'SELECT .*? FROM .*?',
            'UPDATE .*? SET .*?',
            'INSERT INTO .*?',
            'Unknown column',
            'where clause',
            'SqlServer'
        ]
        
        @__injection_strs = [
            '\'',
            '--',
            ';',
            '`'
        ]
        
    end
    
    def run( )
        
        @__injection_strs.each {
            |str|
            
            audit_forms( str ) {
                |var, res|
                __log_results( 'forms', var, res )
{'fraction_non_alphanumeric': 0.1192214111922141, 'fraction_numerical': 0.009476245357920349, 'mean_word_length': 1.642083897158322, 'pattern_counts': {'":': 0, '<': 23, '<?xml version=': 0, '>': 21, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2589789', 'n_tokens_mistral': 2223, 'n_tokens_neox': 2158, 'n_words': 644}