From f3dd7c567bd0f0730ebcf12381b499ae82499c7c Mon Sep 17 00:00:00 2001 From: ekultek Date: Tue, 28 Nov 2017 13:07:23 -0600 Subject: [PATCH] will now save potential SQLi vulnerable websites to a log file during the header check (if the check throws a dbms error) --- lib/header_check/__init__.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/header_check/__init__.py b/lib/header_check/__init__.py index 9800330..00598fb 100644 --- a/lib/header_check/__init__.py +++ b/lib/header_check/__init__.py @@ -30,7 +30,9 @@ from lib.core.settings import ( UNKNOWN_FIREWALL_FINGERPRINT_PATH, UNKNOWN_FIREWALL_FILENAME, COOKIE_FILENAME, - HEADERS_FILENAME + HEADERS_FILENAME, + SQLI_FOUND_FILENAME, + SQLI_SITES_FILEPATH ) @@ -77,8 +79,10 @@ def detect_protection(url, **kwargs): if re.compile(regex).search(html) is not None: logger.warning(set_color( "it appears that the WAF/IDS/IPS check threw a DBMS error and may be vulnerable " - "to SQL injection attacks. it appears the backend DBMS is '{}'...".format(dbms), level=30 + "to SQL injection attacks. it appears the backend DBMS is '{}', site will be " + "saved for further processing...".format(dbms), level=30 )) + write_to_log_file(url, SQLI_SITES_FILEPATH, SQLI_FOUND_FILENAME) return None retval = []