A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

Last update: Nov 09, 2022

Overview

TraverseFilesBySQLInjection

基于sqlmap的利用sql注入漏洞遍历文件是否存在的脚本
A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

usage

需要注意，在盲注时如果开启多线程会导致不稳定
It should be noted that if multi-threading is enabled during blind injection, it will cause instability

usage: test2.py [-h] [-u URL | -r HEADERS_DATA] [-w FILE] [-t THREADS]

By zongdeiqianxing; Email: [email protected]

optional arguments:
  -h, --help       show this help message and exit
  -u URL
  -r HEADERS_DATA  HTTP request header
  -w FILE          wordlist containing file path
  -t THREADS       threads count

show

$ python3 TraverseFilesBySQLInjection.py -r 1.txt -w linux.txt 
2021-10-23 23:01:51,211 - __main__ - INFO - The program has been started, if found readable files, it will be displayed, please wait..
2021-10-23 23:02:21,234 - __main__ - INFO - /etc/hosts file exists
2021-10-23 23:02:41,058 - __main__ - INFO - /etc/hostname file exists
2021-10-23 23:03:00,863 - __main__ - INFO - /etc/passwd file exists

A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

Related tags

Overview

TraverseFilesBySQLInjection

usage

show

Owner

Omega - From Wordpress admin to pty

Tinyman exploit finder - Tinyman exploit finder for python

Yet another web fuzzer

A Python application to predict what is cooking

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

解密哥斯拉webshell管理工具流量

IDA scripts for hypervisor (Hyper-v) analysis and reverse engineering automation

Local File Inclusion Scanner and Exploiter

Agile Threat Modeling Toolkit

Crowbar - A windows post exploitation tool

Official implementation of the paper "Backdoor Attacks on Self-Supervised Learning".

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

Scans all drives for log4j jar files and gets their version from the manifest

XSS scanner in python

A proof-of-concept exploit for Log4j RCE Unauthenticated (CVE-2021-44228)

Scan all java processes on your host to check weather it's affected by log4j2 remote code execution

CVE-2021-26084 Remote Code Execution on Confluence Servers

Open-source jailbreaking tool for many iOS devices

DoSer.py - Simple DoSer in Python

Um script simples de Port Scan + DNS by Hostname