<commit_before>=begin
  $Id$

                  Arachni
  Copyright (c) 2010 Tasos "Zapotek" Laskos <<EMAIL>>

  This is free software; you can copy and distribute and modify
  this program under the term of the GPL v2.0 License
  (See LICENSE file for details)

=end

module Arachni

module Modules

#
# Blind SQL Injection module using timing attacks.
#
# @author: Tasos "Zapotek" Laskos
#                                      <<EMAIL>>
#                                      <<EMAIL>>
# @version: 0.1
#
# @see http://cwe.mitre.org/data/definitions/89.html
# @see http://capec.mitre.org/data/definitions/7.html
# @see http://www.owasp.org/index.php/Blind_SQL_Injection
#
class BlindTimingSQLInjection < Arachni::Module::Base

    include Arachni::Module::Utilities

    TIME = 6

    def initialize( page )
        super( page )
    end

    def prepare( )

        @@__injection_str ||= []

        if @@__injection_str.empty?
            read_file( 'payloads.txt' ) {
                |str|
                @@__injection_str << str.gsub( '__TIME__', TIME.to_s )
            }
        end

        @__opts = {
            :format => [ Format::STRAIGHT, Format::APPEND ]
        }

    end

    def run( )
        @@__injection_str.each {
            |str|
            audit( str, @__opts ) {
                |res, altered, opts|
                _log( res, altered, opts ) if res.time > TIME
            }
        }
    end

    def _log( res, altered, opts )

        elem = opts[:element]
        url  = res.effective_url
        print_ok( "In #{elem} var '#{altered}' " + ' ( ' + url + ' )' )

        injected = opts[:combo][altered] ? opts[:combo][altered] : '<n/a>'
        print_verbose( "Injected string:\t" + injected )
        print_debug( 'Request ID: ' + res.request.id.to_s )
        print_verbose( '---------' ) if only_positives?
<commit_msg>blind_timing_sqli disabled until i work out a kink with Typhoeus<commit_after>=begin
  $Id$

                  Arachni
  Copyright (c) 2010 Tasos "Zapotek" Laskos <<EMAIL>>

  This is free software; you can copy and distribute and modify
  this program under the term of the GPL v2.0 License
  (See LICENSE file for details)

=end

module Arachni

module Modules

#
# Blind SQL Injection module using timing attacks.
#
# @author: Tasos "Zapotek" Laskos
#                                      <<EMAIL>>
#                                      <<EMAIL>>
# @version: 0.1
#
# @see http://cwe.mitre.org/data/definitions/89.html
# @see http://capec.mitre.org/data/definitions/7.html
# @see http://www.owasp.org/index.php/Blind_SQL_Injection
#
class BlindTimingSQLInjection < Arachni::Module::Base

    include Arachni::Module::Utilities

    TIME = 6

    def initialize( page )
        super( page )
    end

    def prepare( )

        @@__injection_str ||= []

        if @@__injection_str.empty?
            read_file( 'payloads.txt' ) {
                |str|
                @@__injection_str << str.gsub( '__TIME__', TIME.to_s )
            }
        end

        @__opts = {
            :format => [ Format::STRAIGHT, Format::APPEND ]
        }

    end

    def run( )
        return

        @@__injection_str.each {
            |str|
            audit( str, @__opts ) {
                |res, altered, opts|
                _log( res, altered, opts ) if res.time > TIME
            }
        }
    end

    def _log( res, altered, opts )

        elem = opts[:element]
        url  = res.effective_url
        print_ok( "In #{elem} var '#{altered}' " + ' ( ' + url + ' )' )

        injected = opts[:combo][altered] ? opts[:combo][altered] : '<n/a>'
        print_verbose( "Injected string:\t" + injected )
        print_debug( 'Request ID: ' + res.request.id.to_s )
        print_verbose( '---------' ) if only_positives?

{'fraction_non_alphanumeric': 0.12741210679355008, 'fraction_numerical': 0.006344171292624901, 'mean_word_length': 1.8154761904761905, 'pattern_counts': {'":': 0, '<': 23, '<?xml version=': 0, '>': 21, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '801127', 'n_tokens_mistral': 1279, 'n_tokens_neox': 1192, 'n_words': 292}