A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

Last update: Nov 09, 2022

Overview

TraverseFilesBySQLInjection

基于sqlmap的利用sql注入漏洞遍历文件是否存在的脚本
A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

usage

需要注意，在盲注时如果开启多线程会导致不稳定
It should be noted that if multi-threading is enabled during blind injection, it will cause instability

usage: test2.py [-h] [-u URL | -r HEADERS_DATA] [-w FILE] [-t THREADS]

By zongdeiqianxing; Email: [email protected]

optional arguments:
  -h, --help       show this help message and exit
  -u URL
  -r HEADERS_DATA  HTTP request header
  -w FILE          wordlist containing file path
  -t THREADS       threads count

show

$ python3 TraverseFilesBySQLInjection.py -r 1.txt -w linux.txt 
2021-10-23 23:01:51,211 - __main__ - INFO - The program has been started, if found readable files, it will be displayed, please wait..
2021-10-23 23:02:21,234 - __main__ - INFO - /etc/hosts file exists
2021-10-23 23:02:41,058 - __main__ - INFO - /etc/hostname file exists
2021-10-23 23:03:00,863 - __main__ - INFO - /etc/passwd file exists

A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

Related tags

Overview

TraverseFilesBySQLInjection

usage

show

Owner

Infection Monkey - An automated pentest tool

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

NExfil is an OSINT tool written in python for finding profiles by username.

Discord exploit allowing you to be unbannable.

CVE-2021-44228 log4j 2.x rce漏洞检测工具

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

Python script to tamper with pages to test for Log4J Shell vulnerability.

NIVOS is a hacking tool that allows you to scan deeply , crack wifi, see people on your network

Malware Configuration And Payload Extraction

windows电脑查看全部连接过的WiFi密码

Generate malicious files using recently published homoglyphic-attack (CVE-2021-42694)

GDID (Google Dorks for Information Disclosure)

Code to do NF in HDR,HEVC,HPL,MPL

IDA Frida Plugin for tracing something interesting.

CVE-2021-22005 - VMWare vCenter Server File Upload to RCE

Generate your own NFTs and their metadata based on your desired probabilities.

Python directory buster, multiple threads, gobuster-like CLI, web server brute-forcer, URL replace pattern feature.

labsecurity is a framework and its use is for ethical hacking and computer security

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

WpDisect is a wordpress hacking tool that finds vulnerabilities in wordpress.