The punching bag server is designed to capture the output of security scanners.

To start:

~/gopath/bin/punchingbag-server -template-directory=`pwd`/punchingbag-server

Note: If probably does not need to use templates, and could hardwire a fixed page. However, I suspect we'll want to make variations.

JSON Format

The JSON format is an array of

[
  {
      "Request": { key / value pairs of the incoming http request },
      "Response": {
        "Status":  http code, 200, 404, etc...
        "Signals":  An array of signal detected or NULL if none found
      }
  },
  ...
]

See the section for "sample echo" below for a complete record.

• note this is not "one entry per line" JSON, but one big array)
• note, there can be more than one signal per request

Commands

• /reset resets the state
• /dump dumps the json
• /echo produces a nice human-friendly display of the request

sample

Using SQLMAP

cd ~/gopath/src/github.com/signalsciences/sigsci && make
~/gopath/bin/punchingbag-server -template-directory=`pwd`/punchingbag-server
curl 127.0.0.1:8085/reset
git clone https://github.com/sqlmapproject/sqlmap.git
cd sqlmap-dev
./sqlmap --url='127.0.0.1:8085/punchme?name=foo'
curl 127.0.0.1:8085/dump
# go do something with the data

A more interesting sqlmap example would use --level=5 --risk=3

sample analysis

A sample analyzer is check-libinjection which checks that the each request was detected by libinjection correctly. Its pretty crappy, but demonstrates how it could work.

curl -s localhost:8085/dump | ./check-libinjection.py

echo example

curl -v '127.0.0.1:8085/echo?foo=bar&1+UNION+SELECT+1;'

The output from /dump is an array of this:

{
  "Request": {
    "ServerVersion": "go1.4",
    "ServerFlavor": "",
    "Timestamp": 1404912808,
    "RemoteIP": "127.0.0.1:40761",
    "RequestLine": "",
    "Method": "GET",
    "Uri": "/echo?foo=bar\u00261+UNION+SELECT+1;",
    "Path": "/echo",
    "Query": "foo=bar\u00261+UNION+SELECT+1;",
    "Protocol": "HTTP/1.1",
    "UserAgent": "curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3",
    "HeadersIn": [
      [
        "Accept",
        "*/*"
      ],
      [
        "User-Agent",
        "curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3"
      ]
    ],
    "QueryArgs": [
      [
        "foo",
        "bar"
      ],
      [
        "1 UNION SELECT 1",
        ""
      ]
    ]
  },
  "Response": {
    "Status": 200,
    "SignalList": [
      {
        "Type": "SQLI",
        "Location": "QUERYSTRING",
        "Value": "1 UNION ALL SELECT 1",
        "Detector": "LIBINJECTION"
      }
    ]
  }
}