• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

NathanGibbs3 / BASE / 587

pending completion
587

push

travis-ci-com

NathanGibbs3
Merge branch 'devel'

504 of 504 new or added lines in 21 files covered. (100.0%)

2594 of 16816 relevant lines covered (15.43%)

20.97 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/base_qry_sqlcalls.php
1
<?php
2
/*******************************************************************************
3
** Basic Analysis and Security Engine (BASE)
4
** Copyright (C) 2004 BASE Project Team
5
** Copyright (C) 2000 Carnegie Mellon University
6
**
7
** (see the file 'base_main.php' for license details)
8
**
9
** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
10
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
11
**
12
** Purpose: executes and prints the query results
13
********************************************************************************
14
** Authors:
15
********************************************************************************
16
** Kevin Johnson <kjohnson@secureideas.net
17
**
18
********************************************************************************
19
*/
20

21
if ( isset($join_sql) || $printing_ag ){ // Issue #5
×
22
global $colored_alerts, $debug_mode;
23
  /* **************** Run the Query ************************************************** */
24

25
  /* base_ag_main.php will include this file 
26
   *  - imported variables: $sql, $cnt_sql
27
   */
28

29
  if ( $printing_ag )
×
30
  {
31
     ProcessCriteria();
×
32
     $page = "base_ag_main.php";
×
33
     $tmp_page_get = "&amp;ag_action=view&amp;ag_id=$ag_id&amp;submit=x";
×
34
     $sql = $save_sql;
×
35
  }
36
  else
×
37
  {
38
     $page = "base_qry_main.php";
×
39
     $cnt_sql = "SELECT COUNT(acid_event.cid) FROM acid_event ".$join_sql.$where_sql.$criteria_sql;
×
40
     $tmp_page_get = "";
×
41
     $sql .= $join_sql.$where_sql.$criteria_sql;
×
42
  }
43

44
  /* Run the query to determine the number of rows (No LIMIT)*/
45
  $qs->GetNumResultRows($cnt_sql, $db);
×
46
  $et->Mark("Counting Result size");
×
47
                // Setup the Query Results Table.
48
                // Common SQL Strings
49
                $OB = ' ORDER BY';
×
50
                $qro = new QueryResultsOutput(
×
51
                        "$page".$qs->SaveStateGET().$tmp_page_get
×
52
                );
53
                if ( !is_null($qro->JavaScript) ){ // Issue #109 Check
×
54
                        $qro->AddTitle(qroReturnSelectALLCheck());
×
55
                }else{
×
56
                        $qro->AddTitle('');
×
57
                }
58
        $qro->AddTitle('ID');
×
59
        $qro->AddTitle($CPSig,
×
60
                "sig_a", " ", "$OB sig_name ASC",
×
61
                "sig_d", " ", "$OB sig_name DESC"
×
62
        );
63
        $qro->AddTitle($CPTs,
×
64
                "time_a", " ", "$OB timestamp ASC ",
×
65
                "time_d", " ", "$OB timestamp DESC "
×
66
        );
67
        $qro->AddTitle($CPSA,
×
68
                "sip_a", " ", "$OB ip_src ASC",
×
69
                "sip_d", " ", "$OB ip_src DESC"
×
70
        );
71
        $qro->AddTitle($CPDA,
×
72
                "dip_a", " ", "$OB ip_dst ASC",
×
73
                "dip_d", " ", "$OB ip_dst DESC"
×
74
        );
75
        $qro->AddTitle(_NBLAYER4,
×
76
                "proto_a", " ", "$OB ip_proto ASC",
×
77
                "proto_d", " ", "$OB ip_proto DESC"
×
78
);
79

80
        if ( $qs->isCannedQuery() ){ // Apply sort criteria.
×
81
                $sort_sql = "$OB timestamp DESC ";
×
82
        }else{
×
83
                $sort_sql = $qro->GetSortSQL($qs->GetCurrentSort(), $qs->GetCurrentCannedQuerySort());
×
84
                if ( !is_null($sort_sql) ){ // Issue #168
×
85
                        $sort_sql = $sort_sql[1]; // Issue #133 fix.
×
86
                }
87
                if (!isset($sort_order)) {
×
88
                        $sort_order = NULL;
×
89
                }
90
                ExportHTTPVar("prev_sort_order", $sort_order);
×
91
        }
92
        $sql .= $sort_sql;
×
93
        if ( $debug_mode > 0 ){
×
94
                $TK = array ( 'SUBMIT', 'sort_order', 'SQL (save_sql)', 'SQL (sort_sql)' );
×
95
                $DI = array($submit, $sort_order, $sql, $sort_sql );
×
96
                $DD = array();
×
97
                foreach ( $TK as $val ){
×
98
                        array_push($DD, $val);
×
99
                }
100
                if ( $printing_ag ){
×
101
                        $ttmp = 'Alert Group';
×
102
                }else{
×
103
                        $ttmp = 'Query';
×
104
                }
105
                DDT($DI,$DD, "$ttmp Debug", '', '',1);
×
106
        }
107
        // Run the Query again for the actual data (with the LIMIT), if any.
108
        $result = $qs->ExecuteOutputQuery($sql, $db);
×
109
        $et->Mark("Retrieve Query Data");
×
110
        if ( $debug_mode > 0 ){
×
111
                if ( $qs->isCannedQuery() ){
×
112
                        $CCF = 'Yes';
×
113
                        $qs->PrintCannedQueryList();
×
114
                }else{
×
115
                        $CCF = 'No';
×
116
                }
117
                print "Canned Query: $CCF <br/>";
×
118
                $qs->DumpState();
×
119
                print "SQL Executed: $sql <br/>";
×
120
        }
121
        if ( !$printing_ag ){
×
122
                // Generate and print the criteria in human readable form.
123
                // Issue #114 fix
124
                NLIO ("<div style='overflow:hidden'>",2);
×
125
                NLIO ("<div style='float: left; width: 60%;'>",3);
×
126
                PrintCriteria($caller);
×
127
                NLIO ('</div>',3);
×
128
                NLIO ("<div style='float: right; width: 40%;'>",3);
×
129
                PrintFramedBoxHeader(_QSCSUMM, '#669999', 0, 4);
×
130
                NLIO ('<td>',6);
×
131
                PrintGeneralStats(
×
132
                        $db, 1, $show_summary_stats, "$join_sql ",
×
133
                        "$where_sql $criteria_sql"
×
134
                );
135
                echo('<BR><LI><A HREF="base_stat_time.php">'._QSCTIMEPROF.'</A> '._QSCOFALERTS . "</LI>");
×
136
                PrintFramedBoxFooter(1,4);
×
137
                NLIO ('</div>',3);
×
138
                NLIO ('</div>',2);
×
139
        }
140
    /* Clear the old checked positions */
141
    for ( $i = 0; $i < $show_rows; $i++)  
×
142
    { 
143
        $action_lst[$i] = "";  
×
144
        $action_chk_lst[$i] = ""; 
×
145
    }
146

147
  /* Print the current view number and # of rows */
148
  $qs->PrintResultCnt();
×
149
  $qro->PrintHeader();
×
150

151
    $i = 0;
×
152
    while ( ($myrow = $result->baseFetchRow()) && ($i < $qs->GetDisplayRowCnt() ) )
×
153
    {
154
      $current_sip32 = $myrow[4];
×
155
      $current_sip = baseLong2IP($current_sip32);
×
156
      $current_dip32 = $myrow[5];
×
157
      $current_dip = baseLong2IP($current_dip32); 
×
158
      $current_proto = $myrow[6];
×
159
      if ($debug_mode > 1)
×
160
      {
161
        SQLTraceLog("\n\n");
×
162
        SQLTraceLog(__FILE__ . ":" . __LINE__ . ":\n############## <calls to BuildSigByID> ##################");
×
163
      }
164
      $current_sig = BuildSigByID($myrow[2], $db);
×
165
      $current_sig_txt = BuildSigByID($myrow[2], $db, 2);
×
166
      if ($debug_mode > 1)
×
167
      {
168
        SQLTraceLog(__FILE__ . ":" . __LINE__ . ":\n################ </calls to BuildSigByID> ###############");
×
169
        SQLTraceLog("\n\n");
×
170
      }
171
      $current_sport = $current_dport = "";
×
172

173
      if ($portscan_payload_in_signature == 1) {
×
174
                /* fetch from payload portscan open port number */
175
                if (stristr($current_sig_txt, "(portscan) Open Port")) {
×
176
                          $sql2 = "SELECT data_payload FROM data WHERE sid='".$myrow[0]."' AND cid='".$myrow[1]."'";
×
177
                          $result2 = $db->baseExecute($sql2);
×
178
                          $myrow_payload = $result2->baseFetchRow();
×
179
                          $result2->baseFreeRows();
×
180
                          $myrow_payload = PrintCleanHexPacketPayload($myrow_payload[0], 2);
×
181
                          $current_sig = $current_sig . str_replace("Open Port", "", $myrow_payload);
×
182
                }
183
                /* fetch from payload portscan port range */
184
                else if ( stristr($current_sig_txt, "(portscan) TCP Portscan") || 
×
185
                          stristr($current_sig_txt, "(portscan) UDP Portscan")) {
×
186
                          $sql2 = "SELECT data_payload FROM data WHERE sid='".$myrow[0]."' AND cid='".$myrow[1]."'";
×
187
                          $result2 = $db->baseExecute($sql2);
×
188
                          $myrow_payload = $result2->baseFetchRow();
×
189
                          $result2->baseFreeRows();
×
190
                          $myrow_payload = PrintCleanHexPacketPayload($myrow_payload[0], 2);
×
191
                          $current_sig = $current_sig . stristr(stristr($myrow_payload, "Port/Proto Range"), ": ");
×
192
                }
193
      }
194

195
      $current_sig = GetTagTriger($current_sig, $db, $myrow[0], $myrow[1]);
×
196

197
      qroPrintEntryHeader( (($colored_alerts == 1) ?
×
198
                GetSignaturePriority($myrow[2], $db) : $i),
×
199
                $colored_alerts);
200

201
        $tmp_rowid = XSSPrintSafe (
×
202
                '#' . (( $qs->GetCurrentView() * $show_rows ) + $i ). '-(' .
×
203
                $myrow[0] . '-' . $myrow[1] . ')'
×
204
        );
205
        $tmp = '_lst['.$i.']';
×
206
        qroPrintEntry(
×
207
                "<input type='checkbox' name='action_chk$tmp' " .
×
208
                "value='" . $tmp_rowid . "'>" .
209
                returnExportHTTPVar ( "action$tmp", $tmp_rowid, 4 )
×
210
        );
211
        $tmp = '';
×
212
        /** Fix for bug #1116034 -- Input by Tim Rupp, original solution and code by Alejandro Flores **/
213
        $temp = "<A HREF='base_qry_alert.php?submit=".rawurlencode($tmp_rowid)."&amp;sort_order=";
×
214
        $temp .= ($qs->isCannedQuery()) ? $qs->getCurrentCannedQuerySort() : $qs->getCurrentSort();
×
215
        $temp .= "'>".$tmp_rowid."</a>";
×
216
        qroPrintEntry($temp);
×
217
        $temp = '';
×
218

219
      qroPrintEntry($current_sig, "left");
×
220
      qroPrintEntry($myrow[3]);
×
221

222
      $tmp_iplookup = 'base_qry_main.php?sig%5B0%5D=%3D'.
×
223
                          '&amp;num_result_rows=-1'.
224
                          '&amp;time%5B0%5D%5B0%5D=+&amp;time%5B0%5D%5B1%5D=+'.
225
                          '&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=2';
226

227
      /* TCP or UDP show the associated port # */ 
228
      if ( ($current_proto == TCP) || ($current_proto == UDP) )
×
229
         $result4 = $db->baseExecute("SELECT layer4_sport, layer4_dport FROM acid_event ".
×
230
                                     "WHERE sid='".$myrow[0]."' AND cid='".$myrow[1]."'");
×
231
      
232
      if ( ($current_proto == TCP) || ($current_proto == UDP) )
×
233
      {
234
         $myrow4 = $result4->baseFetchRow();
×
235

236
         if ( $myrow4[0] != "" )  $current_sport = ":".$myrow4[0];
×
237
         if ( $myrow4[1] != "" )  $current_dport = ":".$myrow4[1];
×
238
      }
239
      
240
      if ( $current_sip32 != "" )
×
241
      {
242
         qroPrintEntry('<A HREF="base_stat_ipaddr.php?ip='.$current_sip.'&amp;netmask=32">'.
×
243
                       $current_sip.
244
                       '</A><FONT SIZE="-1">'.$current_sport.'</FONT>');
245
      }
246
      else
×
247
      {
248
        /* if no IP address was found check if this is a spp_portscan message
249
         * and try to extract a source IP
250
         * - contrib: Michael Bell <michael.bell@web.de>
251
         */
252
        if ( stristr($current_sig_txt, "portscan") )
×
253
        {
254
           $line = split (" ", $current_sig_txt);
×
255
           foreach ($line as $ps_element) 
×
256
           {
257
                        if ( preg_match("/[0-9]*\.[0-9]*\.[0-9]*\.[0-9]/", $ps_element) )
×
258
                        {
259
                                $ps_element = preg_replace ("/:/", "", $ps_element);
×
260
                qroPrintEntry("<A HREF=\"base_stat_ipaddr.php?ip=".$ps_element."&amp;netmask=32\">".
×
261
                              $ps_element."</A>");
262
             }
263
           }
264
        }
265
        else
×
266
           qroPrintEntry('<A HREF="'.$BASE_urlpath.'/help/base_app_faq.php#1">'._UNKNOWN.'</A>');
×
267
      }
268

269
      if ( $current_dip32 != "" )
×
270
         qroPrintEntry('<A HREF="base_stat_ipaddr.php?ip='.$current_dip.'&amp;netmask32">'.
×
271
                       $current_dip.
272
                       '</A><FONT SIZE="-1">'.$current_dport.'</FONT>');
273
       else
×
274
         qroPrintEntry('<A HREF="'.$BASE_urlpath.'/help/base_app_faq.php#1">'._UNKNOWN.'</A>');    
×
275

276
      qroPrintEntry('<FONT>'.IPProto2str($current_proto).'</FONT>');
×
277

278
      qroPrintEntryFooter();
×
279

280
      $i++;
×
281
      if ( ($current_proto == 6) || ($current_proto == 17) )
×
282
      {
283
         $result4->baseFreeRows();
×
284
         $myrow4[0] = $myrow4[1] = "";
×
285
      }
286
    }
287
    $result->baseFreeRows();
×
288

289
  $qro->PrintFooter();
×
290

291
  $qs->PrintBrowseButtons();
×
292
  $qs->PrintAlertActionButtons();
×
293
}
294
?>
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc