{"action":"created","issue":{"url":"https://api.github.com/repos/andresriancho/w3af/issues/16232","repository_url":"https://api.github.com/repos/andresriancho/w3af","labels_url":"https://api.github.com/repos/andresriancho/w3af/issues/16232/labels{/name}","comments_url":"https://api.github.com/repos/andresriancho/w3af/issues/16232/comments","events_url":"https://api.github.com/repos/andresriancho/w3af/issues/16232/events","html_url":"https://github.com/andresriancho/w3af/issues/16232","id":277864337,"number":16232,"title":"Slow string comparison in blind SQL injection plugin","user":{"login":"andresriancho","id":865200,"avatar_url":"https://avatars0.githubusercontent.com/u/865200?v=4","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"labels":[{"id":25254088,"url":"https://api.github.com/repos/andresriancho/w3af/labels/bug","name":"bug","color":"e10c02","default":true},{"id":25254354,"url":"https://api.github.com/repos/andresriancho/w3af/labels/core","name":"core","color":"0b02e1","default":false},{"id":26959783,"url":"https://api.github.com/repos/andresriancho/w3af/labels/priority:high","name":"priority:high","color":"e10c02","default":false}],"state":"open","locked":false,"assignee":{"login":"andresriancho","id":865200,"avatar_url":"https://avatars0.githubusercontent.com/u/865200?v=4","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"assignees":[{"login":"andresriancho","id":865200,"avatar_url":"https://avatars0.githubusercontent.com/u/865200?v=4","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/andresriancho/w3af/milestones/8","html_url":"https://github.com/andresriancho/w3af/milestone/8","labels_url":"https://api.github.com/repos/andresriancho/w3af/milestones/8/labels","id":591375,"number":8,"title":"1.7 - REST API","description":" * Create a REST API wrapper around w3afCore\r\n * Expose the API with w3af_api command line tool which will start a daemon\r\n","creator":{"login":"andresriancho","id":865200,"avatar_url":"https://avatars0.githubusercontent.com/u/865200?v=4","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"open_issues":82,"closed_issues":118,"state":"open","created_at":"2014-03-08T15:20:13Z","updated_at":"2018-05-04T20:08:59Z","due_on":null,"closed_at":null},"comments":11,"created_at":"2017-11-29T18:45:32Z","updated_at":"2018-05-08T11:41:35Z","closed_at":null,"author_association":"OWNER","body":"## Case 1\r\nLog file reads:\r\n\r\n```\r\n[Wed Nov 29 09:30:34 2017 - debug] [blind_sqli_debug] [id: 139981316092880] [param: txtName] [numeric] Comparing body_true_response and body_false_response.\r\n[Wed Nov 29 09:31:03 2017 - debug] [blind_sqli_debug] [id: 139981316092880] [param: txtName] Setting compare_diff to True\r\n```\r\n\r\nAssociated source code:\r\n\r\n```python\r\n        self.debug('[%s] Comparing body_true_response and'\r\n                   ' body_false_response.' % statement_type, mutant)\r\n        if self.equal_with_limit(body_true_response,\r\n                                 body_false_response,\r\n                                 compare_diff):\r\n            #\r\n            # They might be equal because of various reasons, in the best\r\n            # case scenario there IS a blind SQL injection but the % of the\r\n            # HTTP response body controlled by it is so small that the equal\r\n            # ratio is not catching it.\r\n            #\r\n            self.debug('Setting compare_diff to True', mutant)\r\n            compare_diff = True\r\n```\r\n\r\nCall to `equal_with_limit` took ~30 seconds\r\n\r\n## Case 2\r\n\r\nLog file reads:\r\n```\r\n[Wed Nov 29 09:31:07 2017 - debug] [blind_sqli_debug] [id: 139981316092880] [param: txtName] [numeric] Comparing body_true_response and body_syntax_error_response.\r\n[Wed Nov 29 13:29:58 2017 - debug] [blind_sqli_debug] [id: 139981316092880] [param: txtName] [numeric] Comparing body_true_response and body_search_response.\r\n```\r\n\r\nAssociated code:\r\n\r\n```python\r\n        self.debug('[%s] Comparing body_true_response and'\r\n                   ' body_syntax_error_response.' % statement_type, mutant)\r\n        if self.equal_with_limit(body_true_response,\r\n                                 body_syntax_error_response,\r\n                                 compare_diff):\r\n            return None\r\n\r\n        # Check if its a search engine before we dig any deeper...\r\n        search_disambiguator = self._remove_all_special_chars(true_statement)\r\n        mutant.set_token_value(search_disambiguator)\r\n        _, body_search_response = send_clean(mutant, debugging_id=debugging_id)\r\n\r\n        # If they are equal then we have a search engine\r\n        self.debug('[%s] Comparing body_true_response and'\r\n                   ' body_search_response.' % statement_type, mutant)\r\n        if self.equal_with_limit(body_true_response,\r\n                                 body_search_response,\r\n                                 compare_diff):\r\n            return None\r\n```\r\n\r\nIt took several hours to run the code between the different calls to `debug`\r\n"},"comment":{"url":"https://api.github.com/repos/andresriancho/w3af/issues/comments/387375059","html_url":"https://github.com/andresriancho/w3af/issues/16232#issuecomment-387375059","issue_url":"https://api.github.com/repos/andresriancho/w3af/issues/16232","id":387375059,"user":{"login":"andresriancho","id":865200,"avatar_url":"https://avatars0.githubusercontent.com/u/865200?v=4","gravatar_id":"","url":"https://api.github.com/users/andresriancho","html_url":"https://github.com/andresriancho","followers_url":"https://api.github.com/users/andresriancho/followers","following_url":"https://api.github.com/users/andresriancho/following{/other_user}","gists_url":"https://api.github.com/users/andresriancho/gists{/gist_id}","starred_url":"https://api.github.com/users/andresriancho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresriancho/subscriptions","organizations_url":"https://api.github.com/users/andresriancho/orgs","repos_url":"https://api.github.com/users/andresriancho/repos","events_url":"https://api.github.com/users/andresriancho/events{/privacy}","received_events_url":"https://api.github.com/users/andresriancho/received_events","type":"User","site_admin":false},"created_at":"2018-05-08T11:41:35Z","updated_at":"2018-05-08T11:41:35Z","author_association":"OWNER","body":"https://github.com/andresriancho/w3af/commit/360f62f2d1e95fb5aec4963ca9d122117256f4ec"}}
{"actor":{"display_login":"andresriancho"}}