Adding switch --jwt

lib/core/option.py

@@ -2244,6 +2244,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
     kb.heuristicPage = False
     kb.heuristicTest = None
     kb.hintValue = ""
+    kb.jwtChecked = False
     kb.htmlFp = []
     kb.huffmanModel = {}
     kb.respTruncated = False

lib/core/optiondict.py

@@ -127,6 +127,7 @@ optDict = {
         "ssti": "boolean",
         "xxe": "boolean",
         "hql": "boolean",
+        "jwt": "boolean",
         "oobServer": "string",
         "oobToken": "string",
         "timeSec": "integer",

lib/core/settings.py

@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.188"
+VERSION = "1.10.7.189"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -1230,6 +1230,17 @@ HQL_ERROR_SIGNATURES = (
 
 HQL_ERROR_REGEX = r"(?i)(?:%s)" % '|'.join(regex for _, regex in HQL_ERROR_SIGNATURES)
 
+# Small, fast dictionary the always-on JWT heuristic tries against an HS* signature (the full
+# '--jwt' audit streams the shipped wordlist instead); these are the secrets seen over and over in
+# tutorials, framework defaults and CTFs
+JWT_COMMON_SECRETS = ("secret", "password", "changeme", "admin", "test", "jwt", "key", "private",
+    "your-256-bit-secret", "your_jwt_secret", "supersecret", "secretkey", "s3cr3t", "1234567890",
+    "qwerty", "root", "token", "default", "example", "mysecret", "jwtsecret", "signingkey")
+
+# Upper bound on candidate secrets tried during the offline '--jwt' HMAC crack (keeps a huge custom
+# wordlist from turning an audit into an unbounded brute-force)
+JWT_MAX_CRACK_WORDS = 2000000
+
 # Regexes that pull the mapped entity/root name out of a Hibernate diagnostic (the
 # ORM equivalent of a leaked table name; HQL has no information_schema so error-based
 # leakage is the native way to learn the entity model). First capture group = name.

lib/core/testing.py

@@ -99,6 +99,7 @@ def vulnTest(tests=None, label="vuln"):
         ("-u \"<base>xpath/search?q=x\" --xpath --flush-session --disable-hashing", ("is vulnerable to XPath injection", "Title: XPath boolean-based blind", "XPath: GET parameter 'q' XML tree", "extracted", "XPath scan complete")),   # XPath: error-based detection + boolean oracle + blind XML tree-walking via starts-with character extraction
         ("-u \"<base>ssti/search?q=x\" --ssti --flush-session --disable-hashing", ("is vulnerable to SSTI", "Title: SSTI Jinja2 injection", "back-end template engine: 'Jinja2'", "in-band arithmetic proof confirmed", "SSTI scan complete")),   # SSTI: Jinja2 detection via arithmetic control-pair + boolean oracle + distinguishing probe
         ("-u \"<base>hql/search?name=admin\" -p name --hql --flush-session --disable-hashing", ("is vulnerable to HQL injection", "back-end: 'Hibernate'", "entity 'Users'", "s3cr3t", "HQL scan complete")),   # HQL: error-based Hibernate fingerprint + boolean oracle + error-leaked entity + blind attribute enumeration and substring value extraction
+        ("-u \"<base>jwt?x=1\" --cookie=\"session=%s\" --jwt --flush-session" % vulnserver.JWT_TOKEN, ("found a JSON Web Token", "HMAC secret recovered ('secret')", "server accepts an unsigned", "vulnerable to error-based SQL injection")),   # JWT: offline weak-secret crack + active oracle confirming alg:none acceptance + 'kid' error-based SQL injection
         ("-u <url> --flush-session --esperanto --technique=B --banner", ("using the DBMS-agnostic 'Esperanto' engine", "Esperanto dialect verdict: SQLite", "banner: '3.")),   # Esperanto: DBMS-agnostic boolean-oracle engine drives --banner end-to-end through the real sqlmap handler (fingerprinting skipped, dialect discovered from scratch, banner blind-extracted)
         ("-u \"<base>xxe\" --data=\"<root><q>x</q></root>\" --xxe --file-read=\"%s\" --flush-session" % vulnserver.XXE_READ_FILE, ("the XML body processes DTD/internal entities", "in-band XXE file-read impact confirmed", "Type: XXE injection", "XXE scan complete")),   # XXE: in-band internal-entity reflection (real libxml2/lxml parser) + external file:// entity file read
         ("-u \"<url>&query=*\" --flush-session --technique=Q --banner", ("Title: SQLite inline queries", "banner: '3.")),