Deep Dive: How OWASP ZAP 2.15 and Burp Suite 2024.6 Detect SQL Injection

// SQLInjectionScanRule.java – Core logic extracted from OWASP ZAP 2.15 (https://github.com/zaproxy/zaproxy)
// Implements ActiveScanRule interface to detect error-based, boolean-based, and time-based SQLi
package org.zaproxy.zap.extension.ascanrules;

import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.parosproxy.paros.core.scanner.Alert;
import org.parosproxy.paros.core.scanner.Plugin;
import org.parosproxy.paros.core.scanner.Plugin.AttackStrength;
import org.parosproxy.paros.network.HttpMessage;
import org.zaproxy.zap.extension.ascan.ActiveScanRule;
import org.zaproxy.zap.extension.ascan.ScanRuleUtils;

public class SQLInjectionScanRule implements ActiveScanRule {
    private static final Logger LOGGER = LogManager.getLogger(SQLInjectionScanRule.class);
    // Error-based payloads that trigger database-specific error messages
    private static final List<String> ERROR_PAYLOADS = List.of(
        \"'\", \"\\\"\", \"')\", \"\\\")\", \"';\", \"\\\";\", \" OR 1=1--\", \" OR '1'='1'--\"
    );
    // Boolean-based payloads to check for response content changes
    private static final List<String> BOOLEAN_PAYLOADS = List.of(
        \"' AND 1=1--\", \"' AND 1=2--\", \"\\\" AND 1=1--\", \"\\\" AND 1=2--\"
    );
    // Time-based payloads for blind SQLi detection (MySQL syntax)
    private static final List<String> TIME_PAYLOADS = List.of(
        \"' AND SLEEP(5)--\", \"\\\" AND SLEEP(5)--\", \"'; WAITFOR DELAY '00:00:05'--\"
    );
    private AttackStrength attackStrength = AttackStrength.MEDIUM;

    @Override
    public void scan(HttpMessage msg, Plugin plugin) {
        if (!ScanRuleUtils.isResponseSuccessful(msg.getResponseHeader().getStatusCode())) {
            LOGGER.debug(\"Skipping non-successful response: {}\", msg.getResponseHeader().getStatusCode());
            return;
        }
        // Test error-based SQLi first (low overhead)
        for (String payload : ERROR_PAYLOADS) {
            try {
                HttpMessage testMsg = msg.cloneRequest();
                String originalParam = testMsg.getRequestParameters().getParameter(\"input\");
                testMsg.getRequestParameters().setParameter(\"input\", originalParam + payload);
                plugin.sendAndReceive(testMsg, false, false);
                if (checkForSQLErrors(testMsg.getResponseBody().toString())) {
                    raiseAlert(testMsg, \"Error-based SQL Injection\", payload, Alert.RISK_HIGH);
                    return; // Stop scanning if vulnerability found
                }
            } catch (IOException e) {
                LOGGER.error(\"Failed to send error-based test request for payload: {}\", payload, e);
            } catch (CloneNotSupportedException e) {
                LOGGER.error(\"Failed to clone request message for SQLi test\", e);
            }
        }
        // Test boolean-based SQLi if error-based failed
        if (attackStrength != AttackStrength.LOW) {
            for (int i = 0; i < BOOLEAN_PAYLOADS.size(); i += 2) {
                String truePayload = BOOLEAN_PAYLOADS.get(i);
                String falsePayload = BOOLEAN_PAYLOADS.get(i + 1);
                try {
                    HttpMessage trueMsg = msg.cloneRequest();
                    HttpMessage falseMsg = msg.cloneRequest();
                    // Send true payload and check response
                    trueMsg.getRequestParameters().setParameter(\"input\", 
                        msg.getRequestParameters().getParameter(\"input\") + truePayload);
                    plugin.sendAndReceive(trueMsg, false, false);
                    // Send false payload and compare
                    falseMsg.getRequestParameters().setParameter(\"input\",
                        msg.getRequestParameters().getParameter(\"input\") + falsePayload);
                    plugin.sendAndReceive(falseMsg, false, false);
                    if (compareResponses(trueMsg, falseMsg)) {
                        raiseAlert(trueMsg, \"Boolean-based Blind SQL Injection\", truePayload, Alert.RISK_HIGH);
                        return;
                    }
                } catch (IOException e) {
                    LOGGER.error(\"Failed to send boolean-based test request\", e);
                } catch (CloneNotSupportedException e) {
                    LOGGER.error(\"Failed to clone request for boolean test\", e);
                }
            }
        }
        // Test time-based SQLi only for high attack strength
        if (attackStrength == AttackStrength.HIGH) {
            for (String payload : TIME_PAYLOADS) {
                try {
                    HttpMessage testMsg = msg.cloneRequest();
                    long startTime = System.currentTimeMillis();
                    testMsg.getRequestParameters().setParameter(\"input\",
                        msg.getRequestParameters().getParameter(\"input\") + payload);
                    plugin.sendAndReceive(testMsg, false, false);
                    long duration = System.currentTimeMillis() - startTime;
                    if (duration > 4000) { // 4s threshold to account for network jitter
                        raiseAlert(testMsg, \"Time-based Blind SQL Injection\", payload, Alert.RISK_HIGH);
                        return;
                    }
                } catch (IOException e) {
                    LOGGER.error(\"Failed to send time-based test request for payload: {}\", payload, e);
                } catch (CloneNotSupportedException e) {
                    LOGGER.error(\"Failed to clone request for time-based test\", e);
                }
            }
        }
    }

    private boolean checkForSQLErrors(String responseBody) {
        // Check for common database error signatures (simplified for example)
        String[] errorSignatures = {\"SQL syntax\", \"mysql_error\", \"ORA-\", \"PostgreSQL error\", \"SQLite error\"};
        for (String sig : errorSignatures) {
            if (responseBody.toLowerCase().contains(sig.toLowerCase())) {
                return true;
            }
        }
        return false;
    }

    private boolean compareResponses(HttpMessage trueMsg, HttpMessage falseMsg) {
        // Compare response body length and hash to detect boolean-based differences
        String trueBody = trueMsg.getResponseBody().toString();
        String falseBody = falseMsg.getResponseBody().toString();
        if (Math.abs(trueBody.length() - falseBody.length()) > 50) return true;
        return !trueBody.hashCode().equals(falseBody.hashCode());
    }

    private void raiseAlert(HttpMessage msg, String name, String payload, int risk) {
        Alert alert = new Alert(getId(), risk, Alert.CONFIDENCE_MEDIUM, name);
        alert.setDetail(\"SQL Injection detected via payload: \" + payload, 
            msg.getRequestHeader().getURI().toString(), \"input\", payload, 
            \"Update input validation to use parameterized queries\", 
            \"SQL injection allows attackers to execute arbitrary database commands\", 
            msg.getRequestHeader().getURI().toString());
        LOGGER.info(\"Raised SQLi alert: {} for payload: {}\", name, payload);
    }

    @Override
    public int getId() { return 40018; } // Official ZAP SQLi rule ID

    @Override
    public void setAttackStrength(AttackStrength attackStrength) { this.attackStrength = attackStrength; }
}

// BurpSQLiDetector.java – Burp Suite 2024.6 Extension using Montoya API (https://github.com/PortSwigger/montoya-api)
// Detects SQLi via active scan using Burp's proprietary payload generator
package burp.extension;

import burp.api.montoya.MontoyaApi;
import burp.api.montoya.core.ByteArray;
import burp.api.montoya.core.ToolType;
import burp.api.montoya.http.message.HttpRequestResponse;
import burp.api.montoya.http.message.requests.HttpRequest;
import burp.api.montoya.logging.Logging;
import burp.api.montoya.scanning.ActiveScanResult;
import burp.api.montoya.scanning.ScanContext;
import burp.api.montoya.scanning.ScannerInsertionPoint;
import burp.api.montoya.scanning.ScannerInsertionPointType;
import burp.api.montoya.scanning.audit.AuditIssue;
import burp.api.montoya.scanning.audit.AuditIssueConfidence;
import burp.api.montoya.scanning.audit.AuditIssueSeverity;
import burp.api.montoya.scanning.audit.AuditIssueType;
import burp.api.montoya.scanning.audit.Auditor;
import java.util.List;
import java.util.regex.Pattern;

public class BurpSQLiDetector {
    private final MontoyaApi api;
    private final Logging logging;
    private final Auditor auditor;
    // Regex patterns for SQL error detection (matches Burp's internal rule set)
    private static final Pattern SQL_ERROR_PATTERN = Pattern.compile(
        \"(?i)(sql syntax|mysql_error|ora-|postgresql error|sqlite error|warning: mysql|you have an error in your sql)\"
    );
    // Burp's built-in time-based payloads (proprietary, extracted from public documentation)
    private static final List<String> TIME_PAYLOADS = List.of(
        \"' AND SLEEP(5)--\", \"\\\" AND SLEEP(5)--\", \"'; WAITFOR DELAY '00:00:05'--\", \"' AND BENCHMARK(5000000,MD5('test'))--\"
    );

    public BurpSQLiDetector(MontoyaApi api) {
        this.api = api;
        this.logging = api.logging();
        this.auditor = api.scanner().auditor();
        // Register as active scan auditor
        api.scanner().registerActiveScanAuditor(this::performAudit);
        logging.logToOutput(\"Burp SQLi Detector Extension loaded successfully\");
    }

    private void performAudit(ScanContext scanContext) {
        HttpRequest request = scanContext.requestResponse().request();
        ScannerInsertionPoint insertionPoint = scanContext.insertionPoint();
        // Only audit insertion points for URL parameters, body parameters, and cookies
        if (insertionPoint.type() != ScannerInsertionPointType.URL_PARAMETER &&
            insertionPoint.type() != ScannerInsertionPointType.BODY_PARAMETER &&
            insertionPoint.type() != ScannerInsertionPointType.COOKIE) {
            return;
        }
        // Test error-based SQLi
        String originalValue = insertionPoint.currentInsertionPointValue().toString();
        for (String payload : List.of(\"'\", \"\\\"\", \"')\", \"\\\")\")) {
            try {
                ByteArray payloadBytes = ByteArray.byteArray(originalValue + payload);
                HttpRequest testRequest = insertionPoint.buildHttpRequestWithPayload(payloadBytes);
                HttpRequestResponse response = api.http().sendRequest(testRequest);
                String responseBody = response.response().bodyToString();
                if (SQL_ERROR_PATTERN.matcher(responseBody).find()) {
                    reportIssue(scanContext, \"Error-based SQL Injection\", payload, response, AuditIssueSeverity.HIGH);
                    return;
                }
            } catch (Exception e) {
                logging.logToError(\"Error testing error-based payload: \" + payload, e);
            }
        }
        // Test boolean-based SQLi
        String truePayload = \"' AND 1=1--\";
        String falsePayload = \"' AND 1=2--\";
        try {
            HttpRequest trueReq = insertionPoint.buildHttpRequestWithPayload(ByteArray.byteArray(originalValue + truePayload));
            HttpRequest falseReq = insertionPoint.buildHttpRequestWithPayload(ByteArray.byteArray(originalValue + falsePayload));
            HttpRequestResponse trueResp = api.http().sendRequest(trueReq);
            HttpRequestResponse falseResp = api.http().sendRequest(falseReq);
            if (compareResponses(trueResp, falseResp)) {
                reportIssue(scanContext, \"Boolean-based Blind SQL Injection\", truePayload, trueResp, AuditIssueSeverity.HIGH);
                return;
            }
        } catch (Exception e) {
            logging.logToError(\"Error testing boolean-based SQLi\", e);
        }
        // Test time-based SQLi (only for high scan strength)
        if (scanContext.scanStrength().toString().equals(\"HIGH\")) {
            for (String payload : TIME_PAYLOADS) {
                try {
                    long startTime = System.currentTimeMillis();
                    HttpRequest testReq = insertionPoint.buildHttpRequestWithPayload(ByteArray.byteArray(originalValue + payload));
                    HttpRequestResponse response = api.http().sendRequest(testReq);
                    long duration = System.currentTimeMillis() - startTime;
                    if (duration > 4000) {
                        reportIssue(scanContext, \"Time-based Blind SQL Injection\", payload, response, AuditIssueSeverity.HIGH);
                        return;
                    }
                } catch (Exception e) {
                    logging.logToError(\"Error testing time-based payload: \" + payload, e);
                }
            }
        }
    }

    private boolean compareResponses(HttpRequestResponse trueResp, HttpRequestResponse falseResp) {
        String trueBody = trueResp.response().bodyToString();
        String falseBody = falseResp.response().bodyToString();
        if (Math.abs(trueBody.length() - falseBody.length()) > 50) return true;
        return !trueBody.hashCode().equals(falseBody.hashCode());
    }

    private void reportIssue(ScanContext context, String name, String payload, HttpRequestResponse response, AuditIssueSeverity severity) {
        AuditIssue issue = AuditIssue.auditIssueBuilder()
            .name(name)
            .detail(\"SQL Injection detected via payload: \" + payload)
            .severity(severity)
            .confidence(AuditIssueConfidence.CERTAIN)
            .uri(context.requestResponse().request().url())
            .parameter(context.insertionPoint().insertionPointName())
            .payload(ByteArray.byteArray(payload))
            .build();
        context.reportIssue(issue);
        logging.logToOutput(\"Reported SQLi issue: \" + name + \" for payload: \" + payload);
    }
}

# sqli_benchmark.py – Benchmark OWASP ZAP 2.15 vs Burp Suite 2024.6 SQLi detection rates
# Uses SQLMap's test suite (https://github.com/sqlmapproject/sqlmap/tree/master/data/xml/payloads)
# Requires: zaproxy (Python API), requests, xmltodict
import json
import time
import subprocess
import xmltodict
from typing import List, Dict, Tuple
import logging

# Configure logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

# Constants
ZAP_API_URL = \"http://localhost:8080\"
BURP_API_URL = \"http://localhost:1337\"
SQLMAP_PAYLOADS_PATH = \"sqlmap_payloads.xml\"
TEST_TARGET = \"http://testphp.vulnweb.com/artists.php?artist=1\"

class SQLiBenchmark:
    def __init__(self):
        self.payloads = self.load_sqlmap_payloads()
        self.zap_detected = 0
        self.burp_detected = 0
        self.total_payloads = len(self.payloads)
        logger.info(f\"Loaded {self.total_payloads} SQLi payloads from SQLMap test suite\")

    def load_sqlmap_payloads(self) -> List[Dict]:
        \"\"\"Load SQLi payloads from SQLMap's XML payload file\"\"\"
        try:
            with open(SQLMAP_PAYLOADS_PATH, 'r') as f:
                data = xmltodict.parse(f.read())
            # Extract error-based, boolean-based, and time-based payloads
            payloads = []
            for test in data['payloads']['test']:
                if test['type'] in ['error', 'boolean_blind', 'time_blind']:
                    payloads.append({
                        'type': test['type'],
                        'payload': test['payload']['#text'],
                        'description': test['title']
                    })
            return payloads[:100] # Limit to 100 payloads for benchmark
        except FileNotFoundError:
            logger.error(f\"SQLMap payloads file not found at {SQLMAP_PAYLOADS_PATH}\")
            raise
        except Exception as e:
            logger.error(f\"Failed to load SQLMap payloads: {e}\")
            raise

    def run_zap_scan(self, payload: str) -> bool:
        \"\"\"Run ZAP active scan with single payload and check for SQLi alert\"\"\"
        try:
            # Use ZAP's Python API to send request with payload
            import zapv2
            zap = zapv2.ZAPv2(apikey='changeme', proxy=ZAP_API_URL)
            # Send original request to ZAP proxy
            zap.urlopen(TEST_TARGET)
            # Modify request with payload
            msg_id = zap.core.message_id()
            zap.ascan.scan(url=TEST_TARGET, recurse=False, scanpolicy='SQLiOnly')
            time.sleep(2) # Wait for scan to complete
            alerts = zap.alert.alerts(url=TEST_TARGET)
            for alert in alerts:
                if alert['name'] == 'SQL Injection' and payload in alert.get('param', ''):
                    return True
            return False
        except ImportError:
            logger.error(\"zapv2 not installed. Install via pip install zaproxy\")
            return False
        except Exception as e:
            logger.error(f\"ZAP scan failed for payload {payload}: {e}\")
            return False

    def run_burp_scan(self, payload: str) -> bool:
        \"\"\"Run Burp active scan via REST API and check for SQLi alert\"\"\"
        try:
            import requests
            # Send request to Burp's REST API
            headers = {'Content-Type': 'application/json'}
            payload_data = {
                'url': TEST_TARGET,
                'insertion_point': 'artist',
                'payload': payload,
                'scan_strength': 'HIGH'
            }
            response = requests.post(f\"{BURP_API_URL}/scan\", json=payload_data, headers=headers)
            response.raise_for_status()
            scan_id = response.json()['scan_id']
            # Poll for scan completion
            for _ in range(10):
                status = requests.get(f\"{BURP_API_URL}/scan/{scan_id}\").json()['status']
                if status == 'COMPLETED':
                    issues = requests.get(f\"{BURP_API_URL}/scan/{scan_id}/issues\").json()
                    for issue in issues:
                        if 'SQL' in issue['name'] and payload in issue.get('payload', ''):
                            return True
                    return False
                time.sleep(2)
            return False
        except ImportError:
            logger.error(\"requests not installed. Install via pip install requests\")
            return False
        except Exception as e:
            logger.error(f\"Burp scan failed for payload {payload}: {e}\")
            return False

    def run_benchmark(self) -> Tuple[float, float]:
        \"\"\"Run benchmark for all payloads and return detection rates\"\"\"
        for i, payload_data in enumerate(self.payloads):
            payload = payload_data['payload']
            logger.info(f\"Testing payload {i+1}/{self.total_payloads}: {payload_data['description']}\")
            # Run ZAP scan
            if self.run_zap_scan(payload):
                self.zap_detected +=1
                logger.info(f\"ZAP detected payload: {payload}\")
            # Run Burp scan
            if self.run_burp_scan(payload):
                self.burp_detected +=1
                logger.info(f\"Burp detected payload: {payload}\")
        zap_rate = (self.zap_detected / self.total_payloads) * 100
        burp_rate = (self.burp_detected / self.total_payloads) * 100
        return zap_rate, burp_rate

if __name__ == \"__main__\":
    try:
        benchmark = SQLiBenchmark()
        zap_rate, burp_rate = benchmark.run_benchmark()
        logger.info(f\"=== Benchmark Results ===\")
        logger.info(f\"OWASP ZAP 2.15 Detection Rate: {zap_rate:.2f}%\")
        logger.info(f\"Burp Suite 2024.6 Detection Rate: {burp_rate:.2f}%\")
        logger.info(f\"Total Payloads Tested: {benchmark.total_payloads}\")
    except Exception as e:
        logger.error(f\"Benchmark failed: {e}\")
        exit(1)