Purpose: Combined entry point for inventory as well as a separate PoC mode.

Execution examples:

Important note: The time-based check and the PoC mode may only be used against systems for which explicit testing authorization has been granted. The normal inventory mode uses exclusively regular WFS operations.

Prerequisites

• Python 3.10 or newer
• No additional Python packages; both scripts use only the standard library
• Network access to the WFS endpoint

Optionally make executable:

Quick Start

Search for candidates via regular WFS queries

The default path /geoserver/wfs is appended automatically. The following specifications are therefore equivalent:

For a non-standard installation, the full WFS path must be specified.

Verify candidates with a time-based check

Only for explicitly authorized systems:

During the check, a measurement per candidate appears on stderr:

A passed screen is not yet a positive finding. Only when the second, longer measurement also passes is a parameter block output.

Write diagnostics to a file

--valid-diagnose FILE automatically enables verbose diagnostics and writes them to the specified file.

Auto Mode Flow

The default auto mode processes the WFS information in this order:

1. GetCapabilities is opened once:

   root@kitploit:~

   /geoserver/wfs?service=WFS&acceptVersions=2.0.0&request=GetCapabilities
   

2. The XML response is streamed. As soon as a FeatureType/Name is found, the next typeName is determined.

3. For this layer, DescribeFeatureType is immediately executed with version=2.0.0.

4. The script extracts the XSD elements and selects string/JSON fields with ID- or number-like names.

5. The candidate is checked depending on the invocation:

   • Without --sleep: Sample values must be syntactically valid JSON.
   • With --sleep N: A control request and a time-based test request are measured. The JSON value check is skipped in this case.

6. The result is output immediately and flushed.

7. Only then is the next typeName read from the ongoing GetCapabilities response.

This means a large GetCapabilities response does not need to be fully processed before the first result appears.

Criteria for field candidates

Without --sleep, the automatic mode by default considers string/JSON fields with ID- or number-like names.

With --sleep, --candidate-scope auto instead uses all simple non-geometry fields. XSD type and ID name patterns no longer block the timing check. This prevents false negatives for numeric, date/boolean, or vendor-specific XSD types.

Recognized name patterns include, among others:

For the time-based check, the field name must additionally be a simple identifier in the format [A-Za-z_][A-Za-z0-9_]*.

Difference between JSON and sleep check

Without --sleep, it is checked whether the observed values can be syntactically interpreted as JSON. Therefore, for example, the string "383205" also counts as a candidate because its content represents a valid JSON number. This check is a heuristic and not proof of vulnerability.

With --sleep 1, only the time measurement decides. A candidate is considered positive by default if the test request takes at least 70 percent of the requested sleep time in addition to the control request. --timing-result-type auto first checks resultType=hits and, in the event of a negative result, subsequently resultType=results.

Provisionally positive measurements are mandatorily confirmed with a longer sleep time. Without an explicit --confirm-sleep, the script uses max(3, --sleep * 3), capped at 10 seconds. This means a single latency spike with --sleep 1 no longer leads to vulnerable=true.

Compact Output

The standard output contains one block per valid layer:

parameter_stringN contains the normalized WFS endpoint and the matching values for --typename and --field_name.

--valid-fields N counts layer blocks, not individual fields. If fewer than N valid layers exist, the remaining catalog continues to be examined. --max-layers can be used to limit the maximum runtime.

Verbose Diagnostics

The options --diagnose or --valid-diagnose FILE additionally include:

• normalized WFS endpoint,
• used GetCapabilities URL,
• DescribeFeatureType URL,
• XSD field types,
• ID and usability flags,
• number of samples checked,
• JSON compatibility or timing measurements,
• generated GetFeature URL and
• copyable parameter strings.

Example:

Additional Inventory Modes

List all layers

Restrict to a namespace:

Display XSD fields of a layer

Each field is output as a JSON object with name, XSD type, nillable, id_candidate, and usable_property.

Export values of selected fields

Export all properties:

With --unique, identical combinations of selected field values are output only once.

Parameters of wfs_inventory.py

Combined Entry Point

geoserver_sqli_working.py can call the inventory function directly. As soon as --valid-fields is specified, only the inventory is executed and the program then exits.

Inventory via the combined script

Internally, the following parameters are passed to wfs_inventory.py:

Without an explicit --sleep, the time-based check remains disabled in inventory mode.

Separate PoC mode

Only for explicitly authorized test systems:

In PoC mode, the target path is not automatically normalized. Here, the full WFS endpoint should be specified.

The mode first performs a baseline/sleep test, then tests the available time-based oracle variants, and upon successful confirmation reads server/database metadata by default. With --query, a custom scalar query can be specified instead.

The PoC mode currently disables TLS certificate verification internally. For a pure inventory, wfs_inventory.py should preferably be used, since TLS is verified by default there.

Parameters of geoserver_sqli_working.py

JSONL Report

The auto mode can generate JSON Lines instead of text blocks:

With --diagnose, each record additionally contains URLs, candidate metadata, check values, and field-specific GetFeature URLs.

Proxy and TLS

Use a proxy:

Trust a custom proxy CA:

Disable TLS verification for an authorized test system:

--proxy-ca and --insecure cannot be used together.

Large WFS Catalogs and Performance

For large GetCapabilities responses, the following options help:

Notes:

• GetCapabilities is requested only once and then streamed.
• --valid-fields 4 ends the scan only after four valid layers. If fewer hits exist, the search runs to the end or until --max-layers.
• --sample-size 1 reduces the effort of the JSON heuristic.
• In sleep mode, the JSON sample is skipped. Per query path, one control and one test request are made. With --timing-result-type auto, after a negative hits result, two additional results requests are executed.
• A provisionally positive candidate causes two additional requests for the scaled confirmation. Only then is it considered vulnerable.
• --candidate-scope id reduces the number of timing requests but can miss vulnerable fields with other names.
• --namespace and --start-layer-index can further limit the search space.

Troubleshooting

The read operation timed out

• Increase --timeout if the server responds slowly.
• Set --retries 0 to avoid long retries.
• Use --max-layers and --namespace.
• Use --sample-size 1 for the JSON heuristic.

No output

• Without --sleep, candidates must pass the XSD/name check and the JSON syntax check depending on --candidate-scope.
• With --sleep, only time-confirmed candidates are output as a parameter block; negative measurements appear as [sleep-check] on stderr.
• If fewer than the desired number of hits exist, the scan can continue for a long time. In this case, set --max-layers.

Cannot do natural order without a primary key

For the first GetFeature page, the script does not send startIndex=0, since some GeoServer/JDBC layers without a primary key already force a natural sort order this way. When exporting further pages, such a layer may still require a primary key or a server-side supported sort order.

schema does not define ...Type

The script considers both the usual <LayerName>Type and a deviating complexType referenced in the global XSD layer element or an anonymous one. If the error persists, the relevant DescribeFeatureType response should be examined with --diagnose.

HTTP 400 during sample check

The full OWS error message is output to stderr. Common causes are unsupported properties, server-side paging defaults, or a layer-specific data source configuration.

Help Directly in the Terminal