Improve MySQL JS fingerprint with native handshake parsing

internal/tests/integration/javascript_test.go

@@ -41,6 +41,7 @@ var jsTestcases = []integrationCase{
 	{Path: "protocols/javascript/vnc-pass-brute.yaml", TestCase: &javascriptVncPassBrute{}, DisableOn: javascriptDockerDisabled, Serial: true},
 	{Path: "protocols/javascript/postgres-pass-brute.yaml", TestCase: &javascriptPostgresPassBrute{}, DisableOn: javascriptDockerDisabled, Serial: true},
 	{Path: "protocols/javascript/mysql-connect.yaml", TestCase: &javascriptMySQLConnect{}, DisableOn: javascriptDockerDisabled, Serial: true},
+	{Path: "protocols/javascript/mysql-fingerprint.yaml", TestCase: &javascriptMySQLFingerprint{}, DisableOn: javascriptDockerDisabled, Serial: true},
 	{Path: "protocols/javascript/multi-ports.yaml", TestCase: &javascriptMultiPortsSSH{}},
 	{Path: "protocols/javascript/no-port-args.yaml", TestCase: &javascriptNoPortArgs{}},
 	{Path: "protocols/javascript/telnet-auth-test.yaml", TestCase: &javascriptTelnetAuthTest{}, DisableOn: javascriptDockerDisabled, Serial: true},
@@ -176,6 +177,57 @@ func (j *javascriptMySQLConnect) Execute(filePath string) error {
 	}, javascriptDatabaseReadyTimeout, 0, mysqlReadyCheck("root", "secret")))
 }
 
+type javascriptMySQLFingerprint struct{}
+
+// Execute fingerprints multiple MySQL/MariaDB server versions and asserts the
+// extended handshake fields (protocol, version, salt, capabilities, auth plugin).
+func (j *javascriptMySQLFingerprint) Execute(filePath string) error {
+	cases := []struct {
+		name       string
+		repository string
+		tag        string
+		env        []string
+	}{
+		{
+			name:       "mysql-5.7",
+			repository: "mysql",
+			tag:        "5.7",
+			env:        []string{"MYSQL_ROOT_PASSWORD=secret"},
+		},
+		{
+			name:       "mysql-8.0",
+			repository: "mysql",
+			tag:        "8.0",
+			env:        []string{"MYSQL_ROOT_PASSWORD=secret"},
+		},
+		{
+			name:       "mysql-8.4",
+			repository: "mysql",
+			tag:        "8.4",
+			env:        []string{"MYSQL_ROOT_PASSWORD=secret"},
+		},
+		{
+			name:       "mariadb-11.4",
+			repository: "mariadb",
+			tag:        "11.4",
+			env:        []string{"MARIADB_ROOT_PASSWORD=secret"},
+		},
+	}
+
+	var errs []error
+	for _, tc := range cases {
+		err := runJavascriptDockerCase(filePath, newJavascriptDockerSpec("3306/tcp", &dockertest.RunOptions{
+			Repository: tc.repository,
+			Tag:        tc.tag,
+			Env:        tc.env,
+		}, javascriptDatabaseReadyTimeout, 0, mysqlReadyCheck("root", "secret")))
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", tc.name, err))
+		}
+	}
+	return multierr.Combine(errs...)
+}
+
 type javascriptMultiPortsSSH struct{}
 
 func (j *javascriptMultiPortsSSH) Execute(filePath string) error {

internal/tests/integration/testdata/protocols/javascript/mysql-fingerprint.yaml

@@ -0,0 +1,45 @@
+id: mysql-fingerprint
+
+info:
+  name: MySQL Fingerprint Test
+  author: pdteam
+  severity: info
+
+javascript:
+  - pre-condition: |
+      isPortOpen(Host, Port)
+    code: |
+      const mysql = require('nuclei/mysql');
+      const client = new mysql.MySQLClient();
+      const isMySQL = client.IsMySQL(Host, Port);
+      const info = client.FingerprintMySQL(Host, Port);
+      const ok = isMySQL && info && info.ProtocolVersion === 10 && info.Version && info.Version.length > 0 && info.Salt && info.Salt.length > 0 && info.CapabilityFlags > 0 && info.Debug && info.Debug.PacketType === 'handshake';
+      Export({
+        ok: ok,
+        isMySQL: isMySQL,
+        packetType: info.Debug.PacketType,
+        protocolVersion: info.ProtocolVersion,
+        version: info.Version,
+        threadId: info.ThreadID,
+        authPluginName: info.AuthPluginName,
+        capabilityFlags: info.CapabilityFlags,
+        capabilities: info.Capabilities,
+        status: info.Status,
+        salt: info.Salt,
+      });
+    args:
+      Host: "{{Host}}"
+      Port: "3306"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "success == true"
+          - "ok == true"
+          - "isMySQL == true"
+          - 'packetType == "handshake"'
+          - "protocolVersion == 10"
+          - "len(version) > 0"
+          - "capabilityFlags > 0"
+          - "len(salt) > 0"
+          - "threadId > 0"

pkg/js/generated/go/libmysql/mysql.go

@@ -20,9 +20,10 @@ func init() {
 			// Var and consts
 
 			// Objects / Classes
-			"MySQLClient":  gojs.GetClassConstructor[lib_mysql.MySQLClient](&lib_mysql.MySQLClient{}),
-			"MySQLInfo":    gojs.GetClassConstructor[lib_mysql.MySQLInfo](&lib_mysql.MySQLInfo{}),
-			"MySQLOptions": gojs.GetClassConstructor[lib_mysql.MySQLOptions](&lib_mysql.MySQLOptions{}),
+			"HandshakeInfo": gojs.GetClassConstructor[lib_mysql.HandshakeInfo](&lib_mysql.HandshakeInfo{}),
+			"MySQLClient":   gojs.GetClassConstructor[lib_mysql.MySQLClient](&lib_mysql.MySQLClient{}),
+			"MySQLInfo":     gojs.GetClassConstructor[lib_mysql.MySQLInfo](&lib_mysql.MySQLInfo{}),
+			"MySQLOptions":  gojs.GetClassConstructor[lib_mysql.MySQLOptions](&lib_mysql.MySQLOptions{}),
 		},
 	).Register()
 }

pkg/js/generated/ts/mysql.ts

@@ -41,7 +41,7 @@ export class MySQLClient {
     * const isMySQL = mysql.IsMySQL('acme.com', 3306);
     * ```
     */
-    public IsMySQL(host: string, port: number): boolean | null {
+    public IsMySQL(ctx: any, host: string, port: number): boolean | null {
         return null;
     }
 
@@ -58,7 +58,7 @@ export class MySQLClient {
     * const connected = client.Connect('acme.com', 3306, 'username', 'password');
     * ```
     */
-    public Connect(host: string, port: number, username: string): boolean | null {
+    public Connect(ctx: any, host: string, port: number, username: string): boolean | null {
         return null;
     }
 
@@ -72,7 +72,7 @@ export class MySQLClient {
     * log(to_json(info));
     * ```
     */
-    public FingerprintMySQL(host: string, port: number): MySQLInfo | null {
+    public FingerprintMySQL(ctx: any, host: string, port: number): MySQLInfo | null {
         return null;
     }
 
@@ -88,7 +88,7 @@ export class MySQLClient {
     * const connected = client.ConnectWithDSN('username:password@tcp(acme.com:3306)/');
     * ```
     */
-    public ConnectWithDSN(dsn: string): boolean | null {
+    public ConnectWithDSN(ctx: any, dsn: string): boolean | null {
         return null;
     }
 
@@ -106,7 +106,7 @@ export class MySQLClient {
     * log(to_json(result));
     * ```
     */
-    public ExecuteQueryWithOpts(opts: MySQLOptions, query: string): SQLResult | null | null {
+    public ExecuteQueryWithOpts(ctx: any, opts: MySQLOptions, query: string): SQLResult | null | null {
         return null;
     }
 
@@ -121,7 +121,7 @@ export class MySQLClient {
     * log(to_json(result));
     * ```
     */
-    public ExecuteQuery(host: string, port: number, username: string): SQLResult | null | null {
+    public ExecuteQuery(ctx: any, host: string, port: number, username: string): SQLResult | null | null {
         return null;
     }
 
@@ -136,7 +136,7 @@ export class MySQLClient {
     * log(to_json(result));
     * ```
     */
-    public ExecuteQueryOnDB(host: string, port: number, username: string): SQLResult | null | null {
+    public ExecuteQueryOnDB(ctx: any, host: string, port: number, username: string): SQLResult | null | null {
         return null;
     }
 
@@ -145,6 +145,41 @@ export class MySQLClient {
 
 
 
+/**
+ */
+export interface HandshakeInfo {
+
+    PacketType?: string,
+
+    ProtocolVersion?: number,
+
+    Version?: string,
+
+    ThreadID?: number,
+
+    CapabilityFlags?: number,
+
+    Capabilities?: string[],
+
+    CharacterSet?: number,
+
+    StatusFlags?: number,
+
+    Status?: string[],
+
+    AuthPluginDataLen?: number,
+
+    Salt?: string,
+
+    AuthPluginName?: string,
+
+    ErrorMessage?: string,
+
+    ErrorCode?: number,
+}
+
+
+
 /**
  * MySQLInfo contains information about MySQL server.
  * this is returned when fingerprint is successful
@@ -165,7 +200,25 @@ export interface MySQLInfo {
 
     Version?: string,
 
-    Debug?: ServiceMySQL,
+    ProtocolVersion?: number,
+
+    ThreadID?: number,
+
+    CapabilityFlags?: number,
+
+    Capabilities?: string[],
+
+    CharacterSet?: number,
+
+    StatusFlags?: number,
+
+    Status?: string[],
+
+    Salt?: string,
+
+    AuthPluginName?: string,
+
+    Debug?: HandshakeInfo,
 
     Raw?: string,
 }
@@ -214,17 +267,3 @@ export interface SQLResult {
     Columns?: string[],
 }
 
-
-
-/**
- * ServiceMySQL Interface
- */
-export interface ServiceMySQL {
-
-    PacketType?: string,
-
-    ErrorMessage?: string,
-
-    ErrorCode?: number,
-}
-