added IDS payload testing

lib/parse/cmdline.py

@@ -488,6 +488,10 @@ def cmdLineParser():
                                  action="store_true", default=False,
                                  help="Replicate dumped data into a sqlite3 database")
 
+        miscellaneous.add_option("--check-payload", dest="checkPayload",
+                                 action="store_true", default=False,
+                                 help="IDS detection testing of injection payload")
+
         miscellaneous.add_option("--beep", dest="beep",
                                  action="store_true", default=False,
                                  help="Alert with audio beep when sql injection found")

lib/request/connect.py

@@ -30,6 +30,7 @@ from lib.request.basic import parseResponse
 from lib.request.direct import direct
 from lib.request.comparison import comparison
 from lib.request.methodrequest import MethodRequest
+from lib.utils.detection import checkPayload
 
 
 class Connect:
@@ -309,6 +310,9 @@ class Connect:
             for function in kb.tamperFunctions:
                 value = function(place, value)
 
+        if conf.checkPayload:
+            checkPayload(value)
+
         if "GET" in conf.parameters:
             get = conf.parameters["GET"] if place != "GET" or not value else value
 

lib/utils/detection.py

@@ -12,10 +12,12 @@ import sre_constants
 
 from lib.core.common import getCompiledRegex
 from lib.core.common import readXmlFile
+from lib.core.convert import urldecode
 from lib.core.data import conf
 from lib.core.data import paths
 from lib.core.data import logger
 
+
 rules = None
 
 def __adjustGrammar(string):
@@ -27,7 +29,7 @@ def __adjustGrammar(string):
 
     return string
 
-def checkPayload(string):
+def checkPayload(payload):
     """
     This method checks if the generated payload is detectable by the
     PHPIDS filter rules
@@ -35,20 +37,22 @@ def checkPayload(string):
 
     global rules
 
+    payload = urldecode(payload)
+
     if not rules:
         xmlrules = readXmlFile(paths.DETECTION_RULES_XML)
         rules = []
 
         for xmlrule in xmlrules.getElementsByTagName("filter"):
-            try:
-                rule = "(?i)%s" % xmlrule.getElementsByTagName('rule')[0].childNodes[0].nodeValue
-                desc = __adjustGrammar(xmlrule.getElementsByTagName('description')[0].childNodes[0].nodeValue)
-                rules.append((rule, desc))
-            except sre_constants.error: # Some issues with some regex expressions in Python 2.5
-                pass
-    
-    for rule, desc in rules:
-        regObj = getCompiledRegex(rule)
+            rule = "(?i)%s" % xmlrule.getElementsByTagName('rule')[0].childNodes[0].nodeValue
+            desc = __adjustGrammar(xmlrule.getElementsByTagName('description')[0].childNodes[0].nodeValue)
+            rules.append((rule, desc))
 
-        if regObj.search(string):
-            logger.warn("highly probable IDS/IPS detection: '%s'" % desc)
+    if payload:
+        for rule, desc in rules:
+            try:
+                regObj = getCompiledRegex(rule)
+                if regObj.search(payload):
+                    logger.warn("highly probable IDS/IPS detection: '%s: %s'" % (desc, payload))
+            except: # Some issues with some regex expressions in Python 2.5
+                pass