If there's front-end hijacking, the browser will execute the corresponding JS scripts, so we can detect the corresponding JS scripts by packet capture. We can use tools such as Burp Suite, Fiddler, and Wireshark to capture packets for analysis and detection. Additionally, we can open the corresponding page to analyze its source code to make a judgment. By examining the source code, we can identify all the loaded JS scripts and then analyze them.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
The MyBatis solution in the second section was abandoned, but we can reuse it to accelerate SQL injection detection under the MyBatis framework. Other ORM frameworks should also be able to utilize this approach.
SQL fragments containing ${..} will only be stored in TextSqlNode. We continue to hook TextSqlNode. If the hook point is triggered, we consider this SQL as non-ignorable.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
SQL fragments containing ${..} will only be stored in TextSqlNode. We continue to hook TextSqlNode. If the hook point is triggered, we consider this SQL as non-ignorable.
Additionally, we hook MappedStatement. At the beginning of the entire MyBatis mapping process, we first assume that this SQL is ignorable.
Finally, when performing SQL injection detection, we determine whether CanIgnoreSql is true. If it is true, we do not need to perform SQL injection detection on this SQL, thereby accelerating our RASP's SQL injection detection.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
For the configuration of SQL Wall, the SQL Wall objects of different databases need to be maintained separately with a wall config:
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
The wall config contains general switch configurations and differentiated configurations (deny-function.txt, deny-schema.txt, deny-variant.txt, permit-funtion, permit-variant, etc.), and the data types of the differentiated configurations are quite complex. Therefore, at present, only these general configurations are cloud-based, and the differentiated configurations will be completed later.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
The SQL parameterization solution in this section is compatible with more databases, and the performance of the RASP side will be better. However, the downside is that it occupies network resources and is not easy to implement local interception, which is prone to false alarms.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
Initially, we thought that the RASP side didn't need to do too much detection work. We could port the Druid parameterization syntax engine and then write rules in the cloud to perform SQL detection. But as the RASP side's functionality became more and more perfect, we wanted to do a better job of SQL injection detection and ported WallVisitor in. Therefore, the solution in this section may not be used temporarily for now. Instead, we will use WallVisitor for alarm interception and then report it.
The implementation logic of the entire code is very simple. We obtain the parameterized SQL statements and then determine whether the merged SQL has appeared within a unit time. If it has appeared, we will not report it to the cloud;
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
Com.alibaba.druid.wall.WallProvider#checkInternal: The code under this method is the core function of WallFilter. First, it intercepts SQL statements with annotations and stacked queries according to the configuration. Then it creates WallVisitor, which has various check items, including prohibiting variable access or variable blacklists, prohibiting eternal statements, prohibiting blacklisted functions, and prohibiting access to blacklisted tables (database system tables). Some complex cases are set as configuration options, such as prohibiting file writing. If the detection fails, the SQL statement will be added to the blacklist. If the detection succeeds, both the SQL statement and the parameterized SQL statement will be added to the blacklist.
We can configure the blacklists of functions, tables, and variables in the syntax firewall:
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
WallFilter首先会判断当前的sql语句，是否在黑名单、白名单内，如果在黑名单内则直接拦截，如在白名单内则直接放行，这一步骤可大量减少正常业务的SQL语句经过WallVisitor，提升了性能。
判断黑名单的方法getBlackSql只是将整条SQL语句取哈希后查看是否在blackList LRUCache 中；getWhiteSql则还会将SQL语句参数化，之后查看是否在 whiteList LRUCache 中，LRUCache默认最大数量1000，空间不足时覆盖旧的数据。
参数化前SQL语句：
select * from user where user='root' and 1=1 order by 1
参数化后的SQL语句：
SELECT *
FROM user
WHERE user = ?
AND 1 = 1
ORDER BY 1
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
Between dollar tokens, and between dollar tokens and the end, we can call this a gap. Through raw SQL, we can obtain the length of these gaps, and the gap length will be used to help determine whether the parsed SQL structure has changed.
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg
parsed sql 这块的解析，针对替换后的dollar token，需要考虑其是否在引号包裹内，如果是，则需要考虑忽略被转义的引号，笔者认为的合法字符集为(Character.isDigit(c)Character.isLetter(c) c=='_'c=='$' c=='-'|| c>='\u0080')。
如果raw sql 与 parsed sql的 gap 数量或内容不一致，则认为SQL发生变化。
demo展示，运行结果显示第 1 组、第 4 组未发生SQL结构变化
Hacker Job Offers/Hacker Services/Grade and Order Manipulation/Reverse Cracking/Cheats/Penetration Consulting: @heiksg