(
&self,
client: &reqwest::Client,
url: &Url,
payload: &str,
param_index: usize,
pb: &ProgressBar,
)
| 202 | self.rate_limiter.wait().await; |
| 203 | let start = Instant::now(); |
| 204 | let ok = self.send_get_request(client, url).await.is_some(); |
| 205 | let elapsed = start.elapsed(); |
| 206 | ok.then_some(elapsed) |
| 207 | } |
| 208 | |
| 209 | async fn test_time_based( |
| 210 | &self, |
| 211 | client: &reqwest::Client, |
| 212 | url: &Url, |
| 213 | payload: &str, |
| 214 | param_index: usize, |
| 215 | baseline: Option<Duration>, |
| 216 | pb: &ProgressBar, |
| 217 | ) -> Result<bool, reqwest::Error> { |
| 218 | let query_pairs: Vec<(String, String)> = url.query_pairs().into_owned().collect(); |
| 219 | let tested_param = query_pairs[param_index].0.clone(); |
| 220 | let new_url = inject_query_param(url, param_index, |value| format!("{}{}", value, payload)); |
| 221 | |
| 222 | self.rate_limiter.wait().await; |
| 223 | let start = Instant::now(); |
| 224 | let got_response = self.send_get_request(client, &new_url).await.is_some(); |
| 225 | let duration = start.elapsed(); |
| 226 | |
| 227 | if got_response && is_time_based_delta(duration, baseline) { |
| 228 | let vuln = SqlInjectionVulnerability { |
| 229 | url: url.clone(), |
| 230 | parameter: tested_param.clone(), |
| 231 | payload: payload.to_string(), |
| 232 | vuln_type: "Time-Based".to_string(), |
| 233 | }; |
| 234 | return Ok(report_found("SQL Injection", &vuln.payload, &vuln.parameter, || { |
| 235 | self.reporter.report_sql_injection(&vuln); |
| 236 | })); |
| 237 | } |
| 238 | pb.inc(1); |
| 239 | Ok(false) |
| 240 | } |
| 241 | |
| 242 | async fn scan_forms(&self, pb: &ProgressBar) -> Result<(), reqwest::Error> { |
| 243 | let client = crate::http_client(); |
| 244 | |
| 245 | for form in &self.forms { |
| 246 | for i in 0..form.inputs.len() { |
| 247 | let mut vulnerable = false; |
| 248 | for payload in &self.error_based_payloads { |
| 249 | if self |
| 250 | .test_form_error_based(&client, form, payload, i, pb) |
| 251 | .await? |
| 252 | { |
| 253 | vulnerable = true; |
| 254 | break; |
no test coverage detected