Examples with SpnegoHttpURLConnection net.sourceforge.spnego.SpnegoHttpURLConnection used on opensource projects

Example 1 with SpnegoHttpURLConnection

use of net.sourceforge.spnego.SpnegoHttpURLConnection in project jsql-injection by ron190.

the class InjectionModel method inject.

/**
 * Run a HTTP connection to the web server.
 * @param dataInjection SQL query
 * @param responseHeader unused
 * @return source code of current page
 */
@Override
public String inject(String newDataInjection, boolean isUsingIndex) {
    // Temporary url, we go from "select 1,2,3,4..." to "select 1,([complex query]),2...", but keep initial url
    String urlInjection = ConnectionUtil.getUrlBase();
    String dataInjection = " " + newDataInjection;
    urlInjection = this.buildURL(urlInjection, isUsingIndex, dataInjection);
    // TODO merge into function
    urlInjection = urlInjection.trim().replaceAll("(?s)/\\*.*?\\*/", "").replaceAll("([^\\s\\w])(\\s+)", "$1").replaceAll("(\\s+)([^\\s\\w])", "$2").replaceAll("\\s+", "+");
    URL urlObject = null;
    try {
        urlObject = new URL(urlInjection);
    } catch (MalformedURLException e) {
        LOGGER.warn("Incorrect Query Url: " + e.getMessage(), e);
        return "";
    }
    // TODO Extract in method
    if (!ParameterUtil.getQueryString().isEmpty()) {
        // new params from <form> parsing, in that case add the '?' to URL
        if (!urlInjection.contains("?")) {
            urlInjection += "?";
        }
        urlInjection += this.buildQuery(MethodInjection.QUERY, ParameterUtil.getQueryStringAsString(), isUsingIndex, dataInjection);
        if (ConnectionUtil.getTokenCsrf() != null) {
            urlInjection += "&" + ConnectionUtil.getTokenCsrf().getKey() + "=" + ConnectionUtil.getTokenCsrf().getValue();
        }
        try {
            // Evasion
            if (this.stepSecurity == 1) {
                // Replace character '+'
                urlInjection = urlInjection.replaceAll("--\\+", "--").replaceAll("7330%2b1", "7331");
            } else if (this.stepSecurity == 2) {
                // Change case
                urlInjection = urlInjection.replaceAll("union\\+", "uNiOn+").replaceAll("select\\+", "sElEcT+").replaceAll("from\\+", "FrOm+").replaceAll("from\\(", "FrOm(").replaceAll("where\\+", "wHeRe+").replaceAll("([AE])=0x", "$1+lIkE+0x");
            } else if (this.stepSecurity == 3) {
                // Change Case and Space
                urlInjection = urlInjection.replaceAll("union\\+", "uNiOn/**/").replaceAll("select\\+", "sElEcT/**/").replaceAll("from\\+", "FrOm/**/").replaceAll("from\\(", "FrOm(").replaceAll("where\\+", "wHeRe/**/").replaceAll("([AE])=0x", "$1/**/lIkE/**/0x");
                urlInjection = urlInjection.replaceAll("--\\+", "--").replaceAll("\\+", "/**/");
            }
            urlObject = new URL(urlInjection);
        } catch (MalformedURLException e) {
            LOGGER.warn("Incorrect Evasion Url: " + e.getMessage(), e);
        }
    } else {
        if (ConnectionUtil.getTokenCsrf() != null) {
            urlInjection += "?" + ConnectionUtil.getTokenCsrf().getKey() + "=" + ConnectionUtil.getTokenCsrf().getValue();
        }
    }
    HttpURLConnection connection;
    String pageSource = "";
    // Define the connection
    try {
        // Block Opening Connection
        if (AuthenticationUtil.isKerberos()) {
            String kerberosConfiguration = Pattern.compile("(?s)\\{.*").matcher(StringUtils.join(Files.readAllLines(Paths.get(AuthenticationUtil.getPathKerberosLogin()), Charset.defaultCharset()), "")).replaceAll("").trim();
            SpnegoHttpURLConnection spnego = new SpnegoHttpURLConnection(kerberosConfiguration);
            connection = spnego.connect(urlObject);
        } else {
            connection = (HttpURLConnection) urlObject.openConnection();
        }
        connection.setReadTimeout(ConnectionUtil.getTimeout());
        connection.setConnectTimeout(ConnectionUtil.getTimeout());
        connection.setDefaultUseCaches(false);
        connection.setRequestProperty("Pragma", "no-cache");
        connection.setRequestProperty("Cache-Control", "no-cache");
        connection.setRequestProperty("Expires", "-1");
        if (ConnectionUtil.getTokenCsrf() != null) {
            connection.setRequestProperty(ConnectionUtil.getTokenCsrf().getKey(), ConnectionUtil.getTokenCsrf().getValue());
        }
        ConnectionUtil.fixJcifsTimeout(connection);
        Map<Header, Object> msgHeader = new EnumMap<>(Header.class);
        msgHeader.put(Header.URL, urlInjection);
        // TODO Extract in method
        if (!ParameterUtil.getHeader().isEmpty()) {
            Stream.of(this.buildQuery(MethodInjection.HEADER, ParameterUtil.getHeaderAsString(), isUsingIndex, dataInjection).split("\\\\r\\\\n")).forEach(e -> {
                if (e.split(":").length == 2) {
                    HeaderUtil.sanitizeHeaders(connection, new SimpleEntry<String, String>(e.split(":")[0], e.split(":")[1]));
                }
            });
            msgHeader.put(Header.HEADER, this.buildQuery(MethodInjection.HEADER, ParameterUtil.getHeaderAsString(), isUsingIndex, dataInjection));
        }
        // TODO Extract in method
        if (!ParameterUtil.getRequest().isEmpty() || ConnectionUtil.getTokenCsrf() != null) {
            try {
                ConnectionUtil.fixCustomRequestMethod(connection, ConnectionUtil.getTypeRequest());
                connection.setDoOutput(true);
                connection.addRequestProperty("Content-Type", "application/x-www-form-urlencoded");
                DataOutputStream dataOut = new DataOutputStream(connection.getOutputStream());
                if (ConnectionUtil.getTokenCsrf() != null) {
                    dataOut.writeBytes(ConnectionUtil.getTokenCsrf().getKey() + "=" + ConnectionUtil.getTokenCsrf().getValue() + "&");
                }
                if (ConnectionUtil.getTypeRequest().matches("PUT|POST")) {
                    if (ParameterUtil.getRequestAsText().trim().matches("^<\\?xml.*")) {
                        dataOut.writeBytes(this.buildQuery(MethodInjection.REQUEST, ParameterUtil.getRequestAsText(), isUsingIndex, dataInjection));
                    } else {
                        dataOut.writeBytes(this.buildQuery(MethodInjection.REQUEST, ParameterUtil.getRequestAsString(), isUsingIndex, dataInjection));
                    }
                }
                dataOut.flush();
                dataOut.close();
                if (ParameterUtil.getRequestAsText().trim().matches("^<\\?xml.*")) {
                    msgHeader.put(Header.POST, this.buildQuery(MethodInjection.REQUEST, ParameterUtil.getRequestAsText(), isUsingIndex, dataInjection));
                } else {
                    msgHeader.put(Header.POST, this.buildQuery(MethodInjection.REQUEST, ParameterUtil.getRequestAsString(), isUsingIndex, dataInjection));
                }
            } catch (IOException e) {
                LOGGER.warn("Error during Request connection: " + e.getMessage(), e);
            }
        }
        msgHeader.put(Header.RESPONSE, HeaderUtil.getHttpHeaders(connection));
        try {
            pageSource = ConnectionUtil.getSource(connection);
        } catch (Exception e) {
            LOGGER.error(e, e);
        }
        // Calling connection.disconnect() is not required, further calls will follow
        msgHeader.put(Header.SOURCE, pageSource);
        // Inform the view about the log infos
        Request request = new Request();
        request.setMessage(Interaction.MESSAGE_HEADER);
        request.setParameters(msgHeader);
        this.sendToViews(request);
    } catch (// Exception for General and Spnego Opening Connection
    IOException | LoginException | GSSException | PrivilegedActionException e) {
        LOGGER.warn("Error during connection: " + e.getMessage(), e);
    }
    // return the source code of the page
    return pageSource;
}

Example 2 with SpnegoHttpURLConnection

use of net.sourceforge.spnego.SpnegoHttpURLConnection in project jsql-injection by ron190.

the class ConnectionUtil method testConnection.

/**
 * Check that the connection to the website is working correctly.
 * It uses authentication defined by user, with fixed timeout, and warn
 * user in case of authentication detected.
 * @throws InjectionFailureException when any error occurs during the connection
 */
public static void testConnection() throws InjectionFailureException {
    if (PreferencesUtil.isProcessingCookies()) {
        CookieManager cookieManager = new CookieManager();
        CookieHandler.setDefault(cookieManager);
    } else {
        CookieHandler.setDefault(null);
    }
    // Test the HTTP connection
    HttpURLConnection connection = null;
    try {
        if (AuthenticationUtil.isKerberos()) {
            String loginKerberos = Pattern.compile("(?s)\\{.*").matcher(StringUtils.join(Files.readAllLines(Paths.get(AuthenticationUtil.getPathKerberosLogin()), Charset.defaultCharset()), "")).replaceAll("").trim();
            SpnegoHttpURLConnection spnego = new SpnegoHttpURLConnection(loginKerberos);
            connection = spnego.connect(new URL(ConnectionUtil.getUrlByUser()));
        } else {
            connection = (HttpURLConnection) new URL(ConnectionUtil.getUrlByUser().replace(InjectionModel.STAR, "")).openConnection();
        }
        connection.setReadTimeout(ConnectionUtil.getTimeout());
        connection.setConnectTimeout(ConnectionUtil.getTimeout());
        connection.setDefaultUseCaches(false);
        connection.setRequestProperty("Pragma", "no-cache");
        connection.setRequestProperty("Cache-Control", "no-cache");
        connection.setRequestProperty("Expires", "-1");
        ConnectionUtil.fixJcifsTimeout(connection);
        // Add headers if exists (Authorization:Basic, etc)
        for (SimpleEntry<String, String> header : ParameterUtil.getHeader()) {
            HeaderUtil.sanitizeHeaders(connection, header);
        }
        HeaderUtil.checkResponseHeader(connection, ConnectionUtil.getUrlByUser().replace(InjectionModel.STAR, ""));
    // Calling connection.disconnect() is not required, further calls will follow
    } catch (Exception e) {
        String message = Optional.ofNullable(e.getMessage()).orElse("");
        throw new InjectionFailureException("Connection failed: " + message.replace(e.getClass().getName() + ": ", ""), e);
    }
}