SQLmc - Perform massive SQL injections by just specifying a domain

Very interesting.
I've never used a tool like this, nor have I explored the world of SQL injection beyond wanting to understand the problem. Still, some questions come up regarding your project.

How does it go beyond the provided URL? For example, would it be possible to find a www .example.es/thispage ? I mean, I understand there are fuzzers, I think they're called, that search for possible routes using dictionaries, and I don't know whether when examining a page, if some route is found, it pulls from it to see if there are more things there.

And on the other hand, the possible injections that are tested, do they come from a database? I want to understand that they do.

These are doubts I've always had regarding SQL injection and now that I have the opportunity, I hope you open my eyes a bit.

Finally, congratulations on your project and on presenting it to the world. As I said, I'm not a user of this type of tools, but all my recognition to the creators who publish their tools and make the network a little safer with it.

Cita de: Tux0 en Mayo 06, 2024, 09:48:34 AMVery interesting.
I've never used a tool like this, nor have I explored the world of SQL injection beyond wanting to understand the problem. Still, some questions come up regarding your project.

How does it go beyond the provided URL? For example, would it be possible to find a www .example.es/thispage ? I mean, I understand there are fuzzers, I think they're called, that search for possible routes using dictionaries, and I don't know whether when examining a page, if some route is found, it pulls from it to see if there are more things there.

And on the other hand, the possible injections that are tested, do they come from a database? I want to understand that they do.

These are doubts I've always had regarding SQL injection and now that I have the opportunity, I hope you open my eyes a bit.

Finally, congratulations on your project and on presenting it to the world. As I said, I'm not a user of this type of tools, but all my recognition to the creators who publish their tools and make the network a little safer with it.

In principle, the operation is simple: the software scans the main URL using a GET method (for example, Los enlaces son solo para miembros. Registrate o iniciá sesión). Then, it performs a crawling process of all the links it finds with the href attribute in the HTML code. Afterwards, and depending on the specified depth, it rescans the URLs crawled at the previous depth, creating a tree.

This tree is processed by making an HTTP GET request for each URL + "'" (thus triggering the SQL failure), and checking in the response for the type of error, if any exists (This is because an unescaped single quote inside a SQL query can break the syntax and allow the attacker to execute their own arbitrary SQL code.).

Therefore, by sending a URL that contains characters like the single quote to the server and observing the type of response, you can determine whether the server is vulnerable to SQL injection attacks. If the application responds unexpectedly or returns errors that suggest manipulation of the SQL query, then it's likely that an SQL injection vulnerability exists on the server.

To detect the server type, the "Server" HTTP header of the response is analyzed.

I'll leave you a diagram so you understand it better ;)

Los enlaces son solo para miembros. Registrate o iniciá sesión

Very interesting, everything is much clearer to me.

Thank you very much for your reply.

Very good and very useful tool. Have you tried it with a domain behind Cloudflare?

Cita de: n0z en Mayo 10, 2024, 10:43:53 AMVery good and very useful tool. Have you tried it with a domain behind Cloudflare?

Not for now, but I suppose its WAF will be able to detect it, mainly because the injection testing method is quite simple.

If I see a lot of support for the tool, I plan to expand it to, among other things, improve the injection method.

For now it's a poc :)

Cita de: malvads en Mayo 11, 2024, 12:30:32 AM

Cita de: n0z en Mayo 10, 2024, 10:43:53 AMVery good and very useful tool. Have you tried it with a domain behind Cloudflare?

Not for now, but I suppose its WAF will be able to detect it, mainly because the injection testing method is quite simple.

If I see a lot of support for the tool, I plan to expand it to, among other things, improve the injection method.

For now it's a poc :)

Thank you very much for your contribution.

hello good sir, I downloaded your application from GitHub but I still can't get it to work, could you help me?

It looks good! I'm going to try it. I'd also like to study the code and be able to contribute. I followed you on GitHub

Thank you very much for sharing it, I'll try it to see if it bypasses Cloudflare, regards

Hello, can you help me, I get this error installing sqlmac

Los enlaces son solo para miembros. Registrate o iniciá sesión