Move time based attacks to their own scan rules #4316

wapmon · 2022-12-19T23:34:01Z

Fix zaproxy/zaproxy#7341
Breaking out time based attack from list in issue into their own rules. Most of the RDBMS specific SqlInjection rules were already exclusively performing time based attacks, so these simply got renamed, with the exception of the SqlLite rule, which was split up and the new timing rule was given its own new plugin ID. Most other rules were also split up in this manner to create a new timing based version with its own plugin ID. There is mention in the issue of modifying the Alert tags that correspond to these rules, so I would appreciate some feedback on what to do around that.

...rules/src/main/java/org/zaproxy/zap/extension/ascanrules/CommandInjectionScanRuleTiming.java

thc202 · 2022-12-22T13:11:09Z

The help and changelogs should be updated.

wapmon · 2022-12-27T17:48:03Z

I've addressed the renaming and the changelog. As for the help section, I'm not so familiar with this part. Do I just need to make an update the Message.properties files for both packages as well? If so what updates are you looking for? Just name updates?

kingthorin · 2022-12-27T18:59:51Z

The help content, for example for ascanrules: https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrules/src/main/javahelp/org/zaproxy/zap/extension/ascanrules/resources/help/contents/ascanrules.html

Should be similar for alpha and beta add-ons as well.

kingthorin · 2022-12-27T19:02:34Z

@psiinon @thc202 should we be reserving new scan rule IDs for these?

kingthorin · 2022-12-27T19:03:05Z

The changes need a spotlessApply

wapmon · 2022-12-28T17:51:50Z

I've updated the help.html of both packages and fixed some merge conflicts. Let me know if this doesn't look right. Thanks!

...c/main/javahelp/org/zaproxy/zap/extension/ascanrules/resources/help/contents/ascanrules.html

kingthorin · 2022-12-28T19:15:11Z

...test/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionSQLiteScanRuleTimingUnitTest.java

+ *
+ * ZAP is an HTTP/HTTPS proxy for assessing web application security.
+ *
+ * Copyright 2020 The ZAP Development Team


I guess this applies to all of the "new" Timing classes? Though I guess addressing it can wait till and be dependant on whether or not we're adding plugin IDs.

wapmon · 2023-01-10T16:25:55Z

Hello. Just wanted to check in and see if there's anything else you want me to address on this PR. Thanks!

kingthorin

@psiinon or @thc202 please confirm that new scan rule IDs should be reserved for these and that having duplicate IDs will be an issue in the UI/policies.

...les/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionSqLiteTimingScanRule.java

addOns/ascanrules/CHANGELOG.md

addOns/ascanrulesAlpha/CHANGELOG.md

...sAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/MongoDbInjectionScanRule.java

thc202 · 2023-01-10T22:47:43Z

New rules should have new IDs.

kingthorin · 2023-01-10T23:54:21Z

@wapmon Scan rule IDs for the timing rules can be reserved via a PR against: https://github.com/zaproxy/zaproxy/blob/main/docs/scanners.md

wapmon · 2023-01-11T18:21:00Z

zaproxy/zaproxy#7687

kingthorin · 2023-04-13T13:30:05Z

@wapmon are you able to finish this and address the conflict?

FiveOFive · 2023-04-20T16:53:10Z

@wapmon - I could pick up finishing this, if you don't have time right now. Would that be helpful?

I'm looking forward to this change. Thanks for all the work getting it going!

thc202 · 2023-04-20T20:42:46Z

This will be handled by the core team as discussed in the last team meeting.

...rules/src/main/java/org/zaproxy/zap/extension/ascanrules/CommandInjectionTimingScanRule.java

...les/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionSqLiteTimingScanRule.java

thc202 · 2023-04-22T16:32:25Z

addOns/ascanrules/CHANGELOG.md

@@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ## Unreleased
 ### Changed
 - Maintenance changes.
+- Move time based attacks to their own scan rules (Issue 7341).


We should be more explicit and mention the new rules/IDs.

Most of the RDMS-specific SQL injection rules were already only doing Time Based, so I simply renamed those. The SqlLite Rule was broken into 2 rules, but the original rule has the union based attack deactivated due to a bug, so it now will not do anything. Signed-off-by: wapmon <[email protected]>

...n/javahelp/org/zaproxy/zap/extension/ascanrulesAlpha/resources/help/contents/ascanalpha.html

.../src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/MongoDbInjectionTimingScanRule.java

thc202 · 2024-01-18T10:19:54Z

Review that the new rules:

thc202 · 2024-01-18T16:18:11Z

I'm going to split rules that can already be merged into other PRs, starting with MongoDbInjectionScanRule.

kingthorin · 2024-01-18T16:24:04Z

Sounds great!

thc202 changed the title ~~Break out timing based attacks~~ Move time based attacks to their own scan rules Dec 20, 2022

thc202 reviewed Dec 22, 2022

View reviewed changes

...rules/src/main/java/org/zaproxy/zap/extension/ascanrules/CommandInjectionScanRuleTiming.java Outdated Show resolved Hide resolved

kingthorin reviewed Dec 28, 2022

View reviewed changes

kingthorin reviewed Jan 10, 2023

View reviewed changes

thc202 reviewed Jan 10, 2023

View reviewed changes

...sAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/MongoDbInjectionScanRule.java Outdated Show resolved Hide resolved

This was referenced Mar 22, 2023

Adding new ID's for timing based scan rules zaproxy/zaproxy#7687

Merged

Clarify SQLi scan rules which focus on timing based injections zaproxy/zaproxy#7796

Merged

FiveOFive mentioned this pull request Apr 13, 2023

Break out Blind/Timing Based Injections To Separate Rules zaproxy/zaproxy#7341

Open

10 tasks

thc202 force-pushed the break-out-timing-based-attacks branch 2 times, most recently from f4bb7b6 to bff9ea8 Compare April 22, 2023 16:23

thc202 reviewed Apr 22, 2023

View reviewed changes

...rules/src/main/java/org/zaproxy/zap/extension/ascanrules/CommandInjectionTimingScanRule.java Outdated Show resolved Hide resolved

thc202 reviewed Apr 22, 2023

View reviewed changes

...les/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionSqLiteTimingScanRule.java Outdated Show resolved Hide resolved

thc202 reviewed Apr 22, 2023

View reviewed changes

thc202 force-pushed the break-out-timing-based-attacks branch from 94ca253 to e749a3d Compare April 23, 2023 17:12

thc202 force-pushed the break-out-timing-based-attacks branch from e749a3d to 31898a9 Compare June 9, 2023 13:21

thc202 reviewed Jun 9, 2023

View reviewed changes

...n/javahelp/org/zaproxy/zap/extension/ascanrulesAlpha/resources/help/contents/ascanalpha.html Show resolved Hide resolved

thc202 reviewed Jun 9, 2023

View reviewed changes

.../src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/MongoDbInjectionTimingScanRule.java Show resolved Hide resolved

kingthorin mentioned this pull request Jun 16, 2023

ascanrulesAlpha: FP fixes for time based NoSQL #4679

Merged

kingthorin mentioned this pull request Oct 31, 2023

Customizable thresholds for time-based blind injection tests zaproxy/zaproxy#8112

Open

1 task

thc202 mentioned this pull request Jan 19, 2024

ascanrulesAlpha: add rule for MongoDB time tests #5228

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Move time based attacks to their own scan rules #4316

Move time based attacks to their own scan rules #4316

wapmon commented Dec 19, 2022 •

edited by thc202

Loading

thc202 commented Dec 22, 2022

wapmon commented Dec 27, 2022

kingthorin commented Dec 27, 2022

kingthorin commented Dec 27, 2022

kingthorin commented Dec 27, 2022

wapmon commented Dec 28, 2022

kingthorin Dec 28, 2022

kingthorin Dec 28, 2022

wapmon commented Jan 10, 2023

kingthorin left a comment

thc202 commented Jan 10, 2023

kingthorin commented Jan 10, 2023

wapmon commented Jan 11, 2023

kingthorin commented Apr 13, 2023

FiveOFive commented Apr 20, 2023

thc202 commented Apr 20, 2023

thc202 Apr 22, 2023

thc202 commented Jan 18, 2024 •

edited

Loading

thc202 commented Jan 18, 2024

kingthorin commented Jan 18, 2024

Move time based attacks to their own scan rules #4316

Are you sure you want to change the base?

Move time based attacks to their own scan rules #4316

Conversation

wapmon commented Dec 19, 2022 • edited by thc202 Loading

thc202 commented Dec 22, 2022

wapmon commented Dec 27, 2022

kingthorin commented Dec 27, 2022

kingthorin commented Dec 27, 2022

kingthorin commented Dec 27, 2022

wapmon commented Dec 28, 2022

kingthorin Dec 28, 2022

Choose a reason for hiding this comment

kingthorin Dec 28, 2022

Choose a reason for hiding this comment

wapmon commented Jan 10, 2023

kingthorin left a comment

Choose a reason for hiding this comment

thc202 commented Jan 10, 2023

kingthorin commented Jan 10, 2023

wapmon commented Jan 11, 2023

kingthorin commented Apr 13, 2023

FiveOFive commented Apr 20, 2023

thc202 commented Apr 20, 2023

thc202 Apr 22, 2023

Choose a reason for hiding this comment

thc202 commented Jan 18, 2024 • edited Loading

thc202 commented Jan 18, 2024

kingthorin commented Jan 18, 2024

wapmon commented Dec 19, 2022 •

edited by thc202

Loading

thc202 commented Jan 18, 2024 •

edited

Loading