Releases: OWASP/pysap
Releases · OWASP/pysap
pysap v0.1.19
- Using Scapy version 2.4.4.
pysap/SAPSSFS.py
: New module for SAP Secure Store in File System file format.bin/pysaphdbuserstore
: New script for interacting withhdbuserstore
SSFS files.requirements-examples.txt
: Renamed to matchsetup.py
's extra.pysap/SAPHDB.py
: Implementation of GSS-based auth method with Kerberos 5.pysap/SAPHDB.py
: Handling of Session Cookie values when found in theCONNECT
response.pysap/SAPRouter.py
: Add support to route string inSAPRouterNativeProxy
. (#33) Thanks @gloomicious!examples/router_fingerprints.json
: New fingerprints for SAP Router version 7450.34.25.5091. Thanks @jvis!examples/router_portfw.py
: Add support to route string. (#33) Thanks @gloomicious!tests/sapssfs_test.py
: Basic unit tests for the SSFS file format.
pysap v0.1.18
- Using Sphinx 1.8.5 for documentation.
- Replaced AppVeyor and Travis builds with GitHub Actions.
- Added
cryptography
as required library instead of optional requirement. - Replaced the use of deprecated
optparse
module forargparse
across all tools and examples. - Fixed some PEP8 warnings across modules and example scripts.
pysap/SAPCAR.py
: Added signature manifest file type.pysap/SAPHDB.py
: New module for SAP HANA SQL Command Network protocol packets, authentication methods and connection classes.pysap/SAPNI.py
: Disconnect clients in SAPNIServer if socket errors are catched.pysap/utils/crypto
: Added implementation of SCRAM algorithms for use in HDB authentication.examples/hdb_auth.py
: New example script to illustrate the use of the different authentication methods in HDB.examples/hdb_discovery.py
: New example script to perform discovery of HANA database tenants.examples/diag_login_brute_force.py
: Handling valid users (e.g. no dialog users) vs valid passwords. Thanks fabhap!examples/diag_login_brute_force.py
: Fixed discovery with right message match ("Client does not exist").examples/default_sap_credentials
: Added a couple of default credentials from trial versions.tests/crypto_test.py
: Testing output of SCRAM algorithms.tests/saphdb_test.py
: Basic unit tests for the HDB protocol.tests/sapni_test.py
: Arranged and fixed a couple of tests that were failing on macOS and Windows.
pysap v0.1.17
- Using Scapy version 2.4.3.
- Added documentation of projects using
pysap
. - Added documentation of all example scripts.
bin/pysapcar
: Add cli option to determine output directory when extracting archives with pysapcar (#24) Thanks @okuuva!pysap/SAPDiag.py
: Added support bits for SAP GUI 7.50 and SAP NW 7.52 SP01.pysap/SAPCAR.py
: Fixed crafting of archive files by defaulting length fields to zero (#22) Thanks @okuuva!pysap/SAPMS.py
: Added theDPInfo[1-3]
packets for handling specific Message ServerADM
packets relaying Dispatcher/WP info:[1-3]
because of tight SAP kernel version dependency. (#31) Thanks Mathieu (@gelim) and Dmitry (@_chipik)!pysap/SAPRFC.py
: Enhanced with mainlySAPCPIC*
andSAPRFXPG*
new packets. (#31) Thanks Mathieu (@gelim) and Dmitry (@_chipik)!pysap/SAPRouter.py
: Fixed padding on SAPRouter client info packets.examples/rfc_monitor.py
: Renamed the script togw_monitor.py
.examples/router_scanner.py
: Add capability to provide a comma separated list of targets/ports to scan.examples/list_sap_parameters
: Updated recommended values and added new parameters.examples/ms_dump_info.py
: AddedNOTEQUAL
check type.examples/router_fingerprints.json
: Added fingerprints for SAP Router 7.49 and 7.45 kernels.
pysap v0.1.16
- Using Scapy version 2.4.0.
- Using Sphinx 1.7.4 for documentation.
- Added missing
pysap.utils
package in source/binary packages. - Use flake8 to find syntax errors and undefined names in Travis (#20) Thanks @cclauss!
pysap/SAPCAR.py
: Improved SAPCAR files parsing, adding proper structure names based on VSI documentation.
pysap v0.1.15
- Version released at Troopers'18
- Added initial support for handling IGS (Internet Graphic Server) packets along with example scripts to play with them (#19) Thanks @iggy38!
- Added initial support for handling PSE and SSO Credential format files.
bin/pysapgenpse
: New binary tool for working with PSE and SSO credential files.bin/pysapcar
: Added options for creating a new archive and appending files to an existing one.pysap/SAPCredv2.py
: New module for SSO Credential files definitions and decryption logic.pysap/SAPDiagItems.py
,extra/parsesupportbits.py
: Corrected order of support data bit fields (#19). Thanks @hnzlmnn!pysap/SAPIGS.py
: New module for IGS packets layer (#19).pysap/SAPLPS.py
: New module for LPS definitions and INT/DP API decryption logic.pysap/SAPMS.py
: Added Message Server Domain field, MS J2EE Cluster/Header/Service packets. Thanks Albert Zedlitz!pysap/SAPPSE.py
: New module for PSE files definitions and decryption logic.pysap/utils.py
: Moved utils classes into a package.examples/diag_login_brute_force.py
: Detect invalid clients while logins (#17). Thanks @hnzlmnn!examples/dlmanager_decrypt.py
: Replaced use of PyCrypto with Cryptography library.examples/igs_*.py
: New example scripts to interact with IGS services (#19).examples/rfc_monitor.py
: Addednoop
command in the monitor and version command line option.examples/ms_*.py
: Added command line option to specify Message Server Domain.extra/pse2john.py
: New extra script to extract crypto material in John the Ripper format.
pysap v0.1.14
- Added initial support for handling SNC frames and some of their fields.
pysap/SAPNC.py
: Added fields for SNCFrames and helper wrapper/unwrapper functions.pysap/SAPRouter.py
: Fixed route request for more than one SAP Router when using the native proxy.pysap/SAPRouter.py
: Allow route strings to use lowercase separator chars (e.g. "/h/host/s/port").pysap/SAPRouter.py
: Allow aSAPRoutedStreamSocket
to bypass the NI layer if no route was specified but talk mode
was set to raw (#10).pysap/SAPRouter.py
: Enhanced the version retrieve routine by not failing when an error is returned by the server
(#11). Thanks @gelim!.pysap/SAPRouter.py
: Fixed missing eyecatcher in control messages (#10).
Thanks @gelim!.examples/diag_login_screen_info.py
: Script was improved by better printing technical information and
outputting login screen text items (language, input fields, login text) (#14).
Thanks @gelim!.examples/diag_login_brute_force.py
: Script was improved to handle currently logged in users
(#16). Thanks @hnzlmnn!.example/router/admin.py
: Improved client list table display and fixed timestamps (#12).
Thanks @gelim!.examples/ms_dump_param.py
: New example script to list Message Server parameters and check them against a list of
expected values (#15). Thanks @iggy38!examples/ms_dos_exploit.py
: New example script to check for CVE-2017-5997
DoS vulnerability on Message Server and fixed at SAP Note 2358972
(#10). Thanks @vah13 and @gelim!
pysap v0.1.13
- Documentation now includes graphical representation of the main packets of each protocol.
- Example scripts now accept route strings without requiring remote host option.
pysap/SAPRouter.py
: Fixed route request for more than one SAP Router.pysap/SAPEnqueue.py
:SAPEnqueueStreamSocket
now can connect to an Enqueue server through a SAPRouter.examples/router_niping.py
: New example script that implements a very basic
version of theniping
tool. It works on client or server mode.examples/enqueue_monitor.py
: The script now accepts route strings for connecting through a SAPRouter.
pysap v0.1.12.1
- Minor release.
- Source build didn't included header files and thus builds from pip source were failing.
pysap v0.1.12
- Using Scapy version 2.3.3.
- Minor fixes and code arrangements.
- Building and testing in OSX with Travis and Windows with Appveyor.
pysap/SAPDiagItems.py
: Added default support bits from SAP GUI 7.40 version.examples/diag_capturer.py
: Added option to display available capture interfaces.examples/enqueue_dos_exploit.py
: New example script to check for CVE-2016-4015
DoS vulnerability on Standalone Enqueue Server and fixed at SAP Note 2258784
(#6). Thanks @vah13!examples/router_fingerprints.json
: Added fingerprints from SAP Router releases 745.
pysap v0.1.11
- Some documentation improvements. Hosting the documentation in Read the Docs.
- ChangeLog file in Markdown format for better documentation.
- Improvements over the
pysapcar
tool, general fixes and added handling of multi-block SAP CAR archive files. Thanks
Hans-Christian Esperer for the feedback! pysap/SAPDiag.py
: SplittedSBA
/SFE
/SLC
fields.pysap/SAPDiag.py
: Renamed error flag to error number.examples/diag_capturer.py
: Fix imports for running diag capturer example script in Windows.examples/diag_login_brute_force.py
: Added SOLMAN default
credentials and improved reading credentials file.