AttackCheckEngine/read_mysql.py at master · luyg24/AttackCheckEngine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# !/usr/bin/env python
# -*- coding:utf-8 -*-
"""
read from mysql
"""

import update_msyql_vul
import check_fileread_attack
import mysql.connector
import record_err
import base64


filename = 'ids_mysql.conf'


def catfileread(id, hostname, url, method, status, postdata):
    # unicode change to str
    hostname = str(hostname)
    url = str(url)
    method = str(method)
    postdata = str(postdata)
    if status == 200:
        check_fileread_attack.check(id, hostname, url, method, status, postdata)
        # status is 200 check or no check!
    elif status != 200:
        print status
        vul = 'N'
        update_msyql_vul.updatevul(id, vul)

    else:
        print 'what?'


def readfile(startid = 1):
    try:
        id = startid
        config = getinfo(filename)
        conn = mysql.connector.connect(**config)
        cur = conn.cursor()
        readsql = 'select  attack_type, hostname, url, method, status, postdata from  ids_info where id = %d' % startid
        cur.execute(readsql)
        # get info
        result = cur.fetchall()
        if len(result) > 0:
            attack_type = result[0][0]
            hostname = result[0][1]
            url = result[0][2]
            method = result[0][3]
            status = result[0][4]
            postdata = result[0][5]
        else:
            print 'mysql info error'
        if attack_type == u'文件读取':
            catfileread(id, hostname, url, method, status, postdata)
        else:
            # process other attack_type
            pass


    except Exception as e:
        record_err.logrecord()

def getinfo(filename):
    try:
        file = open(filename, 'r')
        config = {}
        content = file.readlines()
        for i in range(len(content)):
            tmp = content[i].split(':')
            key = tmp[0]
            value = tmp[1].split('\n')[0]
            config[key] = value
        return config
    except Exception as e:
        record_err.logrecord()

def getcount():
    try:
        # get msyql line number
        config = getinfo(filename)
        conn = mysql.connector.connect(**config)
        cur = conn.cursor()
        linecount = 'select count(id) from ids_info '
        cur.execute(linecount)
        result = cur.fetchall()
        return int(result[0][0])
        cur.close()
        conn.close()
    except Exception as e:
        record_err.logrecord()


def getuntestline():
    try:
        # get the untest id
        count = getcount()
        for i in range(count):
            config = getinfo(filename)
            conn = mysql.connector.connect(**config)
            cur = conn.cursor()
            readsql = 'select id from ids_info where vul is NULL limit %d,1' % i
            cur.execute(readsql)
            result = cur.fetchall()
            id = result[0][0]
            # return id
            cur.close()
            conn.close()
            readfile(id)
    except Exception as e:
        record_err.logrecord()


if __name__ == '__main__':
    # print __name__
    getuntestline()
    # print startid