Skip to content

Report dialect in case of sql injection #362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 8, 2025
Merged

Report dialect in case of sql injection #362

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d44da6c
Update test cases to include dialect
bitterpanda63 May 7, 2025
0f3e4bd
Report back dialect as well in case of sql injection
bitterpanda63 May 7, 2025
ff15ad8
"postgresql" -> "postgres" for dialect check
bitterpanda63 May 8, 2025
7eb99b0
Update end2end tests to check for dialect
bitterpanda63 May 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions aikido_zen/vulnerabilities/init_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ def test_sql_injection_with_comms(caplog, get_context, monkeypatch):
call_args[1][0]["metadata"]["sql"]
== "INSERT * INTO VALUES ('doggoss2', TRUE);"
)
assert call_args[1][0]["metadata"]["dialect"] == "mysql"


def test_ssrf_with_comms_hostnames_add(caplog, get_context, monkeypatch):
Expand Down
5 changes: 4 additions & 1 deletion aikido_zen/vulnerabilities/sql_injection/context_contains_sql_injection.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,10 @@ def context_contains_sql_injection(sql, operation, context, dialect):
"kind": "sql_injection",
"source": source,
"pathToPayload": path,
"metadata": {"sql": sql},
"metadata": {
"sql": sql,
"dialect": dialect,
},
"payload": user_input,
}
return {}
5 changes: 4 additions & 1 deletion end2end/django_mysql_gunicorn_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,10 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': 'INSERT INTO sample_app_dogs (dog_name, dog_boss) VALUES ("Dangerous bobby", 1); -- ", "N/A")'},
'metadata': {
'dialect': 'mysql',
'sql': 'INSERT INTO sample_app_dogs (dog_name, dog_boss) VALUES ("Dangerous bobby", 1); -- ", "N/A")'
},
'operation': 'MySQLdb.Cursor.execute',
'pathToPayload': '.dog_name',
'payload': '"Dangerous bobby\\", 1); -- "',
Expand Down
5 changes: 4 additions & 1 deletion end2end/django_mysql_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,10 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': 'INSERT INTO sample_app_dogs (dog_name, dog_boss) VALUES ("Dangerous bobby", 1); -- ", "N/A")'},
'metadata': {
'dialect': 'mysql',
'sql': 'INSERT INTO sample_app_dogs (dog_name, dog_boss) VALUES ("Dangerous bobby", 1); -- ", "N/A")'
},
'operation': 'MySQLdb.Cursor.execute',
'pathToPayload': '.dog_name',
'payload': '"Dangerous bobby\\", 1); -- "',
Expand Down
5 changes: 4 additions & 1 deletion end2end/django_postgres_gunicorn_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,10 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': "INSERT INTO sample_app_Dogs (dog_name, is_admin) VALUES ('Dangerous bobby', TRUE); -- ', FALSE)"},
'metadata': {
'dialect': "postgres",
'sql': "INSERT INTO sample_app_Dogs (dog_name, is_admin) VALUES ('Dangerous bobby', TRUE); -- ', FALSE)"
},
'operation': "psycopg2.Connection.Cursor.execute",
'pathToPayload': '.dog_name',
'payload': "\"Dangerous bobby', TRUE); -- \"",
Expand Down
1 change: 1 addition & 0 deletions end2end/flask_mysql_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"]["blocked"] == True
assert attacks[0]["attack"]["kind"] == "sql_injection"
assert attacks[0]["attack"]["metadata"]["sql"] == 'INSERT INTO dogs (dog_name, isAdmin) VALUES ("Dangerous bobby", 1); -- ", 0)'
assert attacks[0]["attack"]["metadata"]["dialect"] == 'mysql'
assert attacks[0]["attack"]["operation"] == 'pymysql.Cursor.execute'
assert attacks[0]["attack"]["pathToPayload"] == '.dog_name'
assert attacks[0]["attack"]["payload"] == '"Dangerous bobby\\", 1); -- "'
Expand Down
5 changes: 4 additions & 1 deletion end2end/flask_mysql_uwsgi_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,10 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': 'INSERT INTO dogs (dog_name, isAdmin) VALUES ("Dangerous bobby", 1); -- ", 0)'},
'metadata': {
'dialect': 'mysql',
'sql': 'INSERT INTO dogs (dog_name, isAdmin) VALUES ("Dangerous bobby", 1); -- ", 0)'
},
'operation': 'pymysql.Cursor.execute',
'pathToPayload': '.dog_name',
'payload': '"Dangerous bobby\\", 1); -- "',
Expand Down
10 changes: 8 additions & 2 deletions end2end/flask_postgres_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,10 @@ def test_attacks_detected():
assert attacks[0]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Dangerous Bobby', TRUE); -- ', FALSE)"},
'metadata': {
'dialect': "postgres",
'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Dangerous Bobby', TRUE); -- ', FALSE)"
},
'operation': "psycopg2.Connection.Cursor.execute",
'pathToPayload': '.dog_name',
'payload': '"Dangerous Bobby\', TRUE); -- "',
Expand All @@ -95,7 +98,10 @@ def test_attacks_detected():
assert attacks[1]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Bobby', TRUE) --', FALSE)"},
'metadata': {
'dialect': "postgres",
'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Bobby', TRUE) --', FALSE)"
},
'operation': "psycopg2.Connection.Cursor.execute",
'pathToPayload': '.dog_name',
'payload': "\"Bobby', TRUE) --\"",
Expand Down
5 changes: 4 additions & 1 deletion end2end/flask_postgres_xml_lxml_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,10 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Malicious dog', TRUE); -- ', FALSE)"},
'metadata': {
'dialect': "postgres",
'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Malicious dog', TRUE); -- ', FALSE)"
},
'operation': "psycopg2.Connection.Cursor.execute",
'pathToPayload': ".dog_name.[0]",
'payload': "\"Malicious dog', TRUE); -- \"",
Expand Down
5 changes: 4 additions & 1 deletion end2end/flask_postgres_xml_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,10 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"] == {
"blocked": True,
"kind": "sql_injection",
'metadata': {'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Malicious dog', TRUE); -- ', FALSE)"},
'metadata': {
'dialect': "postgres",
'sql': "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Malicious dog', TRUE); -- ', FALSE)"
},
'operation': "psycopg2.Connection.Cursor.execute",
'pathToPayload': ".dog_name.[0]",
'payload': "\"Malicious dog', TRUE); -- \"",
Expand Down
1 change: 1 addition & 0 deletions end2end/quart_postgres_uvicorn_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"]["blocked"] == True
assert attacks[0]["attack"]["kind"] == "sql_injection"
assert attacks[0]["attack"]["metadata"]["sql"] == "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Dangerous Bobby', TRUE); -- ', FALSE)"
assert attacks[0]["attack"]["metadata"]["dialect"] == "postgres"
assert attacks[0]["attack"]["operation"] == "asyncpg.connection.Connection.execute"
assert attacks[0]["attack"]["pathToPayload"] == '.dog_name'
assert attacks[0]["attack"]["payload"] == "\"Dangerous Bobby', TRUE); -- \""
Expand Down
1 change: 1 addition & 0 deletions end2end/starlette_postgres_uvicorn_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ def test_dangerous_response_with_firewall():
assert attacks[0]["attack"]["blocked"] == True
assert attacks[0]["attack"]["kind"] == "sql_injection"
assert attacks[0]["attack"]["metadata"]["sql"] == "INSERT INTO dogs (dog_name, isAdmin) VALUES ('Dangerous Bobby', TRUE); -- ', FALSE)"
assert attacks[0]["attack"]["metadata"]["dialect"] == "postgres"
assert attacks[0]["attack"]["operation"] == "asyncpg.connection.Connection.execute"
assert attacks[0]["attack"]["pathToPayload"] == ".dog_name"
assert attacks[0]["attack"]["payload"] == "\"Dangerous Bobby', TRUE); -- \""
Expand Down
Loading