JavaScript response filter - MSSQL

The JavaScript request filter is the most flexible of all response filters. It can potentially be called for any packet type, and can modify traffic in any way it sees fit.

Parameters

• Query pattern: optional. If specified, this filter will be invoked only if the current SQL matches this. Can be a string or a regular expression.

• Packet types : optional. If specified, a comma-separated list of packet types for which this filter should be called, for instance: Row,NBCRow. Spaces are ignored.

• Client IPs: optional. If specified, a comma-separated (or line break separated) list of IP4 or IP6 addresses or regular expressions for IP addresses.

• Users: optional. If specified, a comma-separated (or line break separated) list of user names or regular expressions for user names.

Example

You can catch response packets of type Error and log them to a file or some other system to keep track of certain problems:

let FileWriter = Java.type("java.io.FileWriter");
let BufferedWriter = Java.type("java.io.BufferedWriter");
let outFile = new FileWriter("/var/log/ErrorTrace.log", true);
let out = new BufferedWriter(outFile);
out.write("" + new Date() + " - Error packet received: " + context.packet + "\n");
out.close();

Note that, if performance is critical, it may be a good idea to store the out object in the connection context to avoid opening and closing it all the time:

let out = context.connectionContext.ErrorLogFilter_out;
if ( ! out) {
let FileWriter = Java.type("java.io.FileWriter");
let outFile = new FileWriter("/var/log/ErrorTrace.log", true);
let BufferedWriter = Java.type("java.io.BufferedWriter");
out = new BufferedWriter(outFile);
context.connectionContext.ErrorLogFilter_out = out;
}
out.write("" + new Date() + " - Error packet received: " + context.packet + "\n");
out.flush();