(
&self,
client: &reqwest::Client,
url: &Url,
payload: &str,
param_index: usize,
pb: &ProgressBar,
)
| 491 | |
| 492 | self.rate_limiter.wait().await; |
| 493 | if let Some(response) = self.send_get_request(client, &new_url).await { |
| 494 | if let Ok(body) = response.text().await { |
| 495 | if self.is_error_based_vulnerable(&body) { |
| 496 | let vuln = SqlInjectionVulnerability { |
| 497 | url: url.clone(), |
| 498 | parameter: tested_param.clone(), |
| 499 | payload: payload.to_string(), |
| 500 | vuln_type: "Error-Based".to_string(), |
| 501 | }; |
| 502 | println!( |
| 503 | "[+] SQL Injection Found: {} in {}", |
| 504 | vuln.payload, vuln.parameter |
| 505 | ); |
| 506 | self.reporter.report_sql_injection(&vuln); |
| 507 | return Ok(true); |
| 508 | } |
| 509 | } |
| 510 | } |
| 511 | pb.inc(1); |
| 512 | Ok(false) |
| 513 | } |
| 514 | |
| 515 | async fn send_get_request( |
| 516 | &self, |
| 517 | client: &reqwest::Client, |
| 518 | url: &Url, |
| 519 | ) -> Option<reqwest::Response> { |
| 520 | match client.get(url.clone()).send().await { |
| 521 | Ok(response) => { |
| 522 | if response.status() == reqwest::StatusCode::NOT_FOUND { |
| 523 | return None; |
| 524 | } |
| 525 | Some(response) |
| 526 | } |
| 527 | Err(e) => { |
| 528 | eprintln!("[!] Error sending GET request to {}: {}", url, e); |
| 529 | None |
| 530 | } |
| 531 | } |
| 532 | } |
| 533 | |
| 534 | fn is_error_based_vulnerable(&self, body: &str) -> bool { |
| 535 | let error_patterns = [ |
| 536 | // MySQL |
| 537 | "You have an error in your SQL syntax", |
| 538 | "Warning: mysql_fetch_array()", |
| 539 | // MSSQL |
| 540 | "Unclosed quotation mark after the character string", |
| 541 | "Incorrect syntax near", |
| 542 | "Microsoft OLE DB Provider for SQL Server", |
| 543 | "ODBC SQL Server Driver", |
no test coverage detected