If there's front-end hijacking, the browser will execute the corresponding JS scripts, so we can detect the corresponding JS scripts by packet capture. We can use tools such as Burp Suite, Fiddler, and Wireshark to capture packets for analysis and detection. Additionally, we can open the corresponding page to analyze its source code to make a judgment. By examining the source code, we can identify all the loaded JS scripts and then analyze them.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
The MyBatis solution in the second section was abandoned, but we can reuse it to accelerate SQL injection detection under the MyBatis framework. Other ORM frameworks should also be able to utilize this approach.
SQL fragments containing ${..} will only be stored in TextSqlNode. We continue to hook TextSqlNode. If the hook point is triggered, we consider this SQL as non-ignorable.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
SQL fragments containing ${..} will only be stored in TextSqlNode. We continue to hook TextSqlNode. If the hook point is triggered, we consider this SQL as non-ignorable.
Additionally, we hook MappedStatement. At the beginning of the entire MyBatis mapping process, we first assume that this SQL is ignorable.
Finally, when performing SQL injection detection, we determine whether CanIgnoreSql is true. If it is true, we do not need to perform SQL injection detection on this SQL, thereby accelerating our RASP's SQL injection detection.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
For the configuration of SQL Wall, the SQL Wall objects of different databases need to be maintained separately with a wall config:
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
The wall config contains general switch configurations and differentiated configurations (deny-function.txt, deny-schema.txt, deny-variant.txt, permit-funtion, permit-variant, etc.), and the data types of the differentiated configurations are quite complex. Therefore, at present, only these general configurations are cloud-based, and the differentiated configurations will be completed later.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
The SQL parameterization solution in this section is compatible with more databases, and the performance of the RASP side will be better. However, the downside is that it occupies network resources and is not easy to implement local interception, which is prone to false alarms.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
Initially, we thought that the RASP side didn't need to do too much detection work. We could port the Druid parameterization syntax engine and then write rules in the cloud to perform SQL detection. But as the RASP side's functionality became more and more perfect, we wanted to do a better job of SQL injection detection and ported WallVisitor in. Therefore, the solution in this section may not be used temporarily for now. Instead, we will use WallVisitor for alarm interception and then report it.
The implementation logic of the entire code is very simple. We obtain the parameterized SQL statements and then determine whether the merged SQL has appeared within a unit time. If it has appeared, we will not report it to the cloud;
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
Com.alibaba.druid.wall.WallProvider#checkInternal: The code under this method is the core function of WallFilter. First, it intercepts SQL statements with annotations and stacked queries according to the configuration. Then it creates WallVisitor, which has various check items, including prohibiting variable access or variable blacklists, prohibiting eternal statements, prohibiting blacklisted functions, and prohibiting access to blacklisted tables (database system tables). Some complex cases are set as configuration options, such as prohibiting file writing. If the detection fails, the SQL statement will be added to the blacklist. If the detection succeeds, both the SQL statement and the parameterized SQL statement will be added to the blacklist.
We can configure the blacklists of functions, tables, and variables in the syntax firewall:
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg