• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

NathanGibbs3 / BASE / 627

pending completion
627

push

travis-ci-com

NathanGibbs3
Merge branch 'documentation' into devel

1766 of 6437 relevant lines covered (27.44%)

105.91 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

/base_qry_sqlcalls.php
1
<?php
2
/*******************************************************************************
3
** Basic Analysis and Security Engine (BASE)
4
** Copyright (C) 2004 BASE Project Team
5
** Copyright (C) 2000 Carnegie Mellon University
6
**
7
** (see the file 'base_main.php' for license details)
8
**
9
** Project Leads: Kevin Johnson <kjohnson@secureideas.net>
10
** Built upon work by Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
11
**
12
** Purpose: executes and prints the query results
13
********************************************************************************
14
** Authors:
15
********************************************************************************
16
** Kevin Johnson <kjohnson@secureideas.net
17
**
18
********************************************************************************
19
*/
20

21
if ( isset($join_sql) || $printing_ag ){ // Issue #5
×
22
global $colored_alerts, $debug_mode;
23
  /* **************** Run the Query ************************************************** */
24

25
  /* base_ag_main.php will include this file 
26
   *  - imported variables: $sql, $cnt_sql
27
   */
28

29
  if ( $printing_ag )
×
30
  {
31
     ProcessCriteria();
×
32
     $page = "base_ag_main.php";
×
33
     $tmp_page_get = "&amp;ag_action=view&amp;ag_id=$ag_id&amp;submit=x";
×
34
     $sql = $save_sql;
×
35
  }
36
  else
×
37
  {
38
     $page = "base_qry_main.php";
×
39
     $cnt_sql = "SELECT COUNT(acid_event.cid) FROM acid_event ".$join_sql.$where_sql.$criteria_sql;
×
40
     $tmp_page_get = "";
×
41
     $sql .= $join_sql.$where_sql.$criteria_sql;
×
42
  }
43

44
  /* Run the query to determine the number of rows (No LIMIT)*/
45
  $qs->GetNumResultRows($cnt_sql, $db);
×
46
  $et->Mark("Counting Result size");
×
47
                // Setup the Query Results Table.
48
                // Common SQL Strings
49
                $OB = ' ORDER BY';
×
50
                $qro = new QueryResultsOutput(
×
51
                        $page . $qs->SaveStateGET() . $tmp_page_get
×
52
                );
53
                if ( !is_null($qro->JavaScript) ){ // Issue #109 Check
×
54
                        $qro->AddTitle(qroReturnSelectALLCheck());
×
55
                }else{
×
56
                        $qro->AddTitle('');
×
57
                }
58
        $qro->AddTitle('ID');
×
59
        $qro->AddTitle($CPSig,
×
60
                "sig_a", " ", "$OB sig_name ASC",
×
61
                "sig_d", " ", "$OB sig_name DESC"
×
62
        );
63
        $qro->AddTitle($CPTs,
×
64
                "time_a", " ", "$OB timestamp ASC ",
×
65
                "time_d", " ", "$OB timestamp DESC "
×
66
        );
67
        $qro->AddTitle($CPSA,
×
68
                "sip_a", " ", "$OB ip_src ASC",
×
69
                "sip_d", " ", "$OB ip_src DESC"
×
70
        );
71
        $qro->AddTitle($CPDA,
×
72
                "dip_a", " ", "$OB ip_dst ASC",
×
73
                "dip_d", " ", "$OB ip_dst DESC"
×
74
        );
75
        $qro->AddTitle(_NBLAYER4,
×
76
                "proto_a", " ", "$OB ip_proto ASC",
×
77
                "proto_d", " ", "$OB ip_proto DESC"
×
78
);
79

80
        if ( $qs->isCannedQuery() ){ // Apply sort criteria.
×
81
                $sort_sql = "$OB timestamp DESC ";
×
82
        }else{
×
83
                $sort_sql = $qro->GetSortSQL($qs->GetCurrentSort(), $qs->GetCurrentCannedQuerySort());
×
84
                if ( !is_null($sort_sql) ){ // Issue #168
×
85
                        $sort_sql = $sort_sql[1]; // Issue #133 fix.
×
86
                }
87
                if (!isset($sort_order)) {
×
88
                        $sort_order = NULL;
×
89
                }
90
                ExportHTTPVar("prev_sort_order", $sort_order);
×
91
        }
92
        $sql .= $sort_sql;
×
93
        if ( $debug_mode > 0 ){
×
94
                $TK = array ( 'SUBMIT', 'sort_order', 'SQL (save_sql)', 'SQL (sort_sql)' );
×
95
                $DI = array($submit, $sort_order, $sql, $sort_sql );
×
96
                $DD = array();
×
97
                foreach ( $TK as $val ){
×
98
                        array_push($DD, $val);
×
99
                }
100
                if ( $printing_ag ){
×
101
                        $ttmp = 'Alert Group';
×
102
                }else{
×
103
                        $ttmp = 'Query';
×
104
                }
105
                DDT($DI,$DD, "$ttmp Debug", '', '',1);
×
106
        }
107
        // Run the Query again for the actual data (with the LIMIT), if any.
108
        $result = $qs->ExecuteOutputQuery($sql, $db);
×
109
        $et->Mark("Retrieve Query Data");
×
110
        if ( $debug_mode > 0 ){
×
111
                if ( $qs->isCannedQuery() ){
×
112
                        $CCF = 'Yes';
×
113
                        $qs->PrintCannedQueryList();
×
114
                }else{
×
115
                        $CCF = 'No';
×
116
                }
117
                print "Canned Query: $CCF <br/>";
×
118
                $qs->DumpState();
×
119
                print "SQL Executed: $sql <br/>";
×
120
        }
121
        if ( !$printing_ag ){
×
122
                // Generate and print the criteria in human readable form.
123
                // Issue #114 fix
124
                NLIO ("<div style='overflow:hidden'>",2);
×
125
                NLIO ("<div style='float: left; width: 60%;'>",3);
×
126
                PrintCriteria($caller);
×
127
                NLIO ('</div>',3);
×
128
                NLIO ("<div style='float: right; width: 40%;'>",3);
×
129
                PrintFramedBoxHeader(_QSCSUMM, '#669999', 0, 4);
×
130
                NLIO ('<td>',6);
×
131
                PrintGeneralStats(
×
132
                        $db, 1, $show_summary_stats, "$join_sql ",
×
133
                        "$where_sql $criteria_sql"
×
134
                );
135
                NLIO("<ul class='stats'><li>");
×
136
                NLIO(
×
137
                        "<a href='base_stat_time.php'>" . _QSCTIMEPROF . '</a> '
×
138
                        . _QSCOFALERTS
139
                );
140
                NLIO('</li></ul>');
×
141
                PrintFramedBoxFooter(1,4);
×
142
                NLIO ('</div>',3);
×
143
                NLIO ('</div>',2);
×
144
        }
145
    /* Clear the old checked positions */
146
    for ( $i = 0; $i < $show_rows; $i++)  
×
147
    { 
148
        $action_lst[$i] = "";  
×
149
        $action_chk_lst[$i] = ""; 
×
150
    }
151

152
  /* Print the current view number and # of rows */
153
  $qs->PrintResultCnt();
×
154
  $qro->PrintHeader();
×
155

156
    $i = 0;
×
157
    while ( ($myrow = $result->baseFetchRow()) && ($i < $qs->GetDisplayRowCnt() ) )
×
158
    {
159
      $current_sip32 = $myrow[4];
×
160
      $current_sip = baseLong2IP($current_sip32);
×
161
      $current_dip32 = $myrow[5];
×
162
      $current_dip = baseLong2IP($current_dip32); 
×
163
      $current_proto = $myrow[6];
×
164
      if ($debug_mode > 1)
×
165
      {
166
        SQLTraceLog("\n\n");
×
167
        SQLTraceLog(__FILE__ . ":" . __LINE__ . ":\n############## <calls to BuildSigByID> ##################");
×
168
      }
169
      $current_sig = BuildSigByID($myrow[2], $db);
×
170
      $current_sig_txt = BuildSigByID($myrow[2], $db, 2);
×
171
      if ($debug_mode > 1)
×
172
      {
173
        SQLTraceLog(__FILE__ . ":" . __LINE__ . ":\n################ </calls to BuildSigByID> ###############");
×
174
        SQLTraceLog("\n\n");
×
175
      }
176
      $current_sport = $current_dport = "";
×
177

178
      if ($portscan_payload_in_signature == 1) {
×
179
                /* fetch from payload portscan open port number */
180
                if (stristr($current_sig_txt, "(portscan) Open Port")) {
×
181
                          $sql2 = "SELECT data_payload FROM data WHERE sid='".$myrow[0]."' AND cid='".$myrow[1]."'";
×
182
                          $result2 = $db->baseExecute($sql2);
×
183
                          $myrow_payload = $result2->baseFetchRow();
×
184
                          $result2->baseFreeRows();
×
185
                          $myrow_payload = PrintCleanHexPacketPayload($myrow_payload[0], 2);
×
186
                          $current_sig = $current_sig . str_replace("Open Port", "", $myrow_payload);
×
187
                }
188
                /* fetch from payload portscan port range */
189
                else if ( stristr($current_sig_txt, "(portscan) TCP Portscan") || 
×
190
                          stristr($current_sig_txt, "(portscan) UDP Portscan")) {
×
191
                          $sql2 = "SELECT data_payload FROM data WHERE sid='".$myrow[0]."' AND cid='".$myrow[1]."'";
×
192
                          $result2 = $db->baseExecute($sql2);
×
193
                          $myrow_payload = $result2->baseFetchRow();
×
194
                          $result2->baseFreeRows();
×
195
                          $myrow_payload = PrintCleanHexPacketPayload($myrow_payload[0], 2);
×
196
                          $current_sig = $current_sig . stristr(stristr($myrow_payload, "Port/Proto Range"), ": ");
×
197
                }
198
      }
199

200
      $current_sig = GetTagTriger($current_sig, $db, $myrow[0], $myrow[1]);
×
201

202
      qroPrintEntryHeader( (($colored_alerts == 1) ?
×
203
                GetSignaturePriority($myrow[2], $db) : $i),
×
204
                $colored_alerts);
205

206
        $tmp_rowid = XSSPrintSafe (
×
207
                '#' . (( $qs->GetCurrentView() * $show_rows ) + $i ). '-(' .
×
208
                $myrow[0] . '-' . $myrow[1] . ')'
×
209
        );
210
        $tmp = "_lst[$i]";
×
211
        qroPrintCheckBox($tmp, $tmp_rowid);
×
212
        $tmp = '';
×
213
        /** Fix for bug #1116034 -- Input by Tim Rupp, original solution and code by Alejandro Flores **/
214
        $temp = "<a href='base_qry_alert.php?submit=".rawurlencode($tmp_rowid)."&amp;sort_order=";
×
215
        $temp .= ($qs->isCannedQuery()) ? $qs->getCurrentCannedQuerySort() : $qs->getCurrentSort();
×
216
        $temp .= "'>".$tmp_rowid."</a>";
×
217
        qroPrintEntry($temp);
×
218
        $temp = '';
×
219

220
      qroPrintEntry($current_sig, "left");
×
221
      qroPrintEntry($myrow[3]);
×
222

223
      $tmp_iplookup = 'base_qry_main.php?sig%5B0%5D=%3D'.
×
224
                          '&amp;num_result_rows=-1'.
225
                          '&amp;time%5B0%5D%5B0%5D=+&amp;time%5B0%5D%5B1%5D=+'.
226
                          '&amp;submit='._QUERYDBP.'&amp;current_view=-1&amp;ip_addr_cnt=2';
227

228
      /* TCP or UDP show the associated port # */ 
229
      if ( ($current_proto == TCP) || ($current_proto == UDP) )
×
230
         $result4 = $db->baseExecute("SELECT layer4_sport, layer4_dport FROM acid_event ".
×
231
                                     "WHERE sid='".$myrow[0]."' AND cid='".$myrow[1]."'");
×
232
      
233
      if ( ($current_proto == TCP) || ($current_proto == UDP) )
×
234
      {
235
         $myrow4 = $result4->baseFetchRow();
×
236

237
         if ( $myrow4[0] != "" )  $current_sport = ":".$myrow4[0];
×
238
         if ( $myrow4[1] != "" )  $current_dport = ":".$myrow4[1];
×
239
      }
240
      
241
      if ( $current_sip32 != "" )
×
242
      {
243
         qroPrintEntry('<A HREF="base_stat_ipaddr.php?ip='.$current_sip.'&amp;netmask=32">'.
×
244
                       $current_sip.
245
                       '</A><FONT SIZE="-1">'.$current_sport.'</FONT>');
246
      }
247
      else
×
248
      {
249
        /* if no IP address was found check if this is a spp_portscan message
250
         * and try to extract a source IP
251
         * - contrib: Michael Bell <michael.bell@web.de>
252
         */
253
        if ( stristr($current_sig_txt, "portscan") )
×
254
        {
255
           $line = split (" ", $current_sig_txt);
×
256
           foreach ($line as $ps_element) 
×
257
           {
258
                        if ( preg_match("/[0-9]*\.[0-9]*\.[0-9]*\.[0-9]/", $ps_element) )
×
259
                        {
260
                                $ps_element = preg_replace ("/:/", "", $ps_element);
×
261
                qroPrintEntry("<A HREF=\"base_stat_ipaddr.php?ip=".$ps_element."&amp;netmask=32\">".
×
262
                              $ps_element."</A>");
263
             }
264
           }
265
        }
266
        else
×
267
           qroPrintEntry('<A HREF="'.$BASE_urlpath.'/help/base_app_faq.php#1">'._UNKNOWN.'</A>');
×
268
      }
269

270
      if ( $current_dip32 != "" )
×
271
         qroPrintEntry('<A HREF="base_stat_ipaddr.php?ip='.$current_dip.'&amp;netmask32">'.
×
272
                       $current_dip.
273
                       '</A><FONT SIZE="-1">'.$current_dport.'</FONT>');
274
       else
×
275
         qroPrintEntry('<A HREF="'.$BASE_urlpath.'/help/base_app_faq.php#1">'._UNKNOWN.'</A>');    
×
276

277
      qroPrintEntry('<FONT>'.IPProto2str($current_proto).'</FONT>');
×
278

279
      qroPrintEntryFooter();
×
280

281
      $i++;
×
282
      if ( ($current_proto == 6) || ($current_proto == 17) )
×
283
      {
284
         $result4->baseFreeRows();
×
285
         $myrow4[0] = $myrow4[1] = "";
×
286
      }
287
    }
288
    $result->baseFreeRows();
×
289

290
  $qro->PrintFooter();
×
291

292
  $qs->PrintBrowseButtons();
×
293
  $qs->PrintAlertActionButtons();
×
294
}
295
?>
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc