SQL Injection String Encoder Tool

SQL Injection String Encoder Tool - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Python (https://sinister.li/Forum-Python)
+--- Thread: SQL Injection String Encoder Tool (/Thread-SQL-Injection-String-Encoder-Tool)

SQL Injection String Encoder Tool - Boomslang - 05-02-2014

Hi [username]!

I've been learning Python for a few days and eventually I release my first tool coded in it. I hope you like it Smile

This tool takes a string as an argument and encode it in a way that will fit in a SQL query.

Code:
Test --> concat(CHAR((20 | 64)),CHAR((68 | 33)),CHAR((82 | 33)),CHAR((80 | 36)),0x00)

The encoding algorithm made by me. Anyway, here it is;

Usage:

Code:
SSE.py [string here]

Screenshot:
[Image: bsLozDu.png]

*Drumroll*

Source:
Hastebin

Code:
# -*- coding: cp1254 -*-
import sys

def f(y,z):
    """This function generates a list of numbers.
Those numbers will be equal to 'z' when you 'bitwise or' them with 'y'"""
    my_list = range(256)
    return filter(lambda x: x | y == z, my_list)

def g(z):
    """This function generates a matrix of f(y,z)"""
    my_matrix = list()
    
    for y in range(33,126):
        
        if y != z:
            result = f(y,z)
            
            if len(result) > 0:
                
                result.append(y)
                my_matrix.append(result)
                
    return my_matrix

def enc(t):
    """Encoding"""
    result = "concat("
    my_matrix = list()
    
    for c in t:
        my_list = g(ord(c))

        for i in my_list:
            for item in i:
                if item != ord(c):
                    result += "CHAR((" + str(item) + " | " + str(i[-1]) + ")),"
                    break
            break
    result += "0x00)"

    return result

print '''
Coded by
____ ____ ____ ___ ___ _  _ ____ ____ _   _ ____ ___ ____ _  _ 
|__/ |  | |  |  |   |  |__| |___ [__   \_/  [__   |  |___ |\/| 
|  \ |__| |__|  |   |  |  | |___ ___]   |   ___]  |  |___ |  |

                ||SQL Injection String Encoder||
                
                                                               
'''

print enc(sys.argv[1])

@shp0ngl3 I especially want your opinion on this.
I hope you guys like it, also don't hold back your comments Smile

I'd be glad if you could report me any bugs.

Au Revoir..

RE: SQL Injection String Encoder Tool - TeemuStew - 05-03-2014

Hi, i'm a complete noob at coding. What does this do exactly?

RE: SQL Injection String Encoder Tool - Boomslang - 05-03-2014

@TeemuStew
This program manipulates the given string so it wouldn't be recognized. I'll give you more details when I'm on PC (I'm on mobile currently)

Detailed information about encoding: http://searchnetworking.techtarget.com/definition/encoding-and-decoding

RE: SQL Injection String Encoder Tool - jonagold - 05-23-2014

hi,
when i try this string
\x9d\x81\x91\xfe\xf8,\x99\x84\x87\xfe\xfd\xf8\xfe\xff\xfa\xfd\xfc\xf9\xf0\xfc\xf9\xf8
i get this
is that normal?

upload image

RE: SQL Injection String Encoder Tool - Boomslang - 05-23-2014

@jonagold it doesn't support hex encoded chars. I might add it sometime.

RE: SQL Injection String Encoder Tool - jonagold - 05-23-2014

ok thanks,
for what kind of strings is this used for?

RE: SQL Injection String Encoder Tool - Boomslang - 05-23-2014

@jonagold only plain text