projectdiscovery / nuclei

Fast and customizable vulnerability scanner based on simple YAML based DSL.
https://docs.projectdiscovery.io/tools/nuclei
MIT License
20.26k stars 2.48k forks source link

Add/Improve Fingerprint data in Mysql Module #4789

Open tarunKoyalwar opened 7 months ago

tarunKoyalwar commented 7 months ago

Please describe your feature request:

Current Fingerprint data obtained using FingerprintMySQL in mysql javascript module is limited and is missing lot of other info that is available in Wireshark Response packet . this is due to limited observability of fingerprintx function in mysql .we can try to implement a custom fingerprint for mysql at network layer using fastdialer ( see: fingerprintx mysql plugin for reference )

If possible we should explore a way to add a generic packet module in javascript which is similar to fingerprintx plugin functionality to allow writing logic in js templates

Describe the use case of this feature:

Required data for writing template image

Anything else

reach out to @pussycat0x for reference / validation

tarunKoyalwar commented 7 months ago

Nmap Result

3306/tcp open  mysql
| mysql-info: 
|   Protocol: 10
|   Version: 8.3.0
|   Thread ID: 1632
|   Capabilities flags: 65535
|   Some Capabilities: InteractiveClient, SwitchToSSLAfterHandshake, LongColumnFlag, IgnoreSpaceBeforeParenthesis, FoundRows, ODBCClient, Speaks41ProtocolOld, LongPassword, SupportsLoadDataLocal, SupportsTransactions, Speaks41ProtocolNew, DontAllowDatabaseTableColumn, Support41Auth, IgnoreSigpipes, ConnectWithDatabase, SupportsCompression, SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults
|   Status: Autocommit
|   Salt: O\x1F&\x06J   .;#\x1A~\x01pY+V\x1B    >4
|_  Auth Plugin Name: caching_sha2_password

Nuclei Engine Result

{
  "Host": "35.200.188.83",
  "IP": "invalid IP",
  "Port": 0,
  "Protocol": "mysql",
  "TLS": false,
  "Transport": "tcp",
  "Version": "8.3.0",
  "Debug": {
    "PacketType": "handshake",
    "ErrorMessage": "",
    "ErrorCode": 0
  },
  "Raw": "{\"packetType\":\"handshake\",\"errorMsg\":\"\",\"errorCode\":0}"
}