./others/sqlic.py

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
136.
137.
138.
139.
140.
141.
142.
143.
144.
145.
146.
147.
148.
149.
150.
151.
152.
153.
#!/usr/bin/env python
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
#
# This script was written by houbysoft (visit http://houbysoft.com/ for more info), (c) 2009.
# Thanks to : low1z for the list of SQL injection error messages and their respective databases,
# d3hydr8 for making such a nice forum and all forum.darkc0de.com members and you, the user!
# This script is available under the GPLv3 License.
# USE COMPLETELY ON YOUR OWN RISK.
 
 
import urllib2,sys,random,re,time,string
from threading import Thread
from time import sleep
from os import system
 
 
 
class sqli(Thread):
  def __init__ (self,url,cmd):
    Thread.__init__(self)
    self.url = url
    self.cmd = cmd
  def run(self):
    test_sqli(self.url,self.cmd)
 
 
 
def welcome():
    print "[-] Welcome to SQL injection tester by houbysoft"
    print "    This program is available under the terms of the GPLv3."
    print "    (c) 2009 houbysoft, http://houbysoft.com/"
    print "    http://forum.darkc0de.com"
    print "    USE ALLOWED FOR LEGAL PURPOSES ONLY!"
 
 
 
def usage():
    print "[h] Usage : ./sqlic.py URLFILE [-t=timeout] [-x=cmd]"
    print "[h]   URLFILE : file with URLs to check"
    print "[h]   timeout : the time that this program sleeps until creating each new thread"
    print "[h]             If not set, defaults to 2."
    print "[h]     cmd   : the command to execute on each vulnerable URL found. %url% will be replaced by the vulnerable URL"
 
 
 
def found(cmd,url,type_):
    url = url[:-1] # remove the quote
    file = open("sqliclog.txt","a")
    file.write(url+"\n")
    file.close()
    print "\n[+] Found : "+url+" ("+type_+")"
    if cmd:
      cmd = cmd.replace("%url%","\""+url+"\"")
      print "    -> running command: "+cmd
      system(cmd)
 
 
 
def test_sqli(url,cmd):
  print '*',
  inj = "'"
  variables = url.split("/")
  base_url = url.split("?")
  base_url = base_url[0] + "?"
  if base_url in URLS:
    return
  else:
    URLS.append(base_url)
  variables = variables[-1]
  variables = variables.split("?")
  variables = variables[-1]
  variables = variables.split("&")
  try:
   for x in variables:
    url = base_url
    for y in variables:
      if x != y:
        url = url + y
        url = url + "&"
    url = url + x + inj
    text = urllib2.urlopen(url).read()
    if text.find("error in your SQL syntax") != -1:
        found(cmd,url,"MySQL")
        return
    if text.find("ORA-01756") != -1:
        found(cmd,url,"Oracle")
        return
    if text.find("Error Executing Database Query") != -1:
        found(cmd,url,"JDBC_CFM")
        return
    if text.find("SQLServer JDBC Driver") != -1:
        found(cmd,url,"JDBC_CFM2")
        return
    if text.find("Microsoft OLE DB Provider for SQL Server") != -1:
        found(cmd,url,"MSSQL_OLEdb")
        return
    if text.find("Unclosed quotation mark") != -1:
        found(cmd,url,"MSSQL_Uqm")
        return
    if text.find("ODBC Microsoft Access Driver") != -1:
        found(cmd,url,"MS-Access_ODBC")
        return
    if text.find("Microsoft JET Database") != -1:
        found(cmd,url,"MS-Access_JETdb")
        return
    if text.find("supplied argument is not a valid MySQL result resource") != -1:
        found(cmd,url,"MySQL")
        return
   return
  except:
    return
 
 
 
def main():
    welcome()
    if len(sys.argv) < 2:
      usage()
      quit()
    tts = 2
    cmd = ""
    for x in sys.argv:
      if x.find("-x=") != -1:
        cmd = x[3:]
      if x.find("-t=") != -1:
        tts = int(x[3:])
    print "[+] Starting : \n  URL_FILE = "+sys.argv[1]+"\n  TTS = "+repr(tts)+"\n  CMD = "+cmd
    file = open(sys.argv[1],"r")
    str = file.readline()
    while str:
        if str[-1] == "\n":
            str = str[:-1]
        t = sqli(str,cmd)
        t.start()
	str = file.readline()
	sleep(tts)
    file.close()
 
 
URLS = []
main()
 

Back