A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

Last update: Nov 09, 2022

Overview

TraverseFilesBySQLInjection

基于sqlmap的利用sql注入漏洞遍历文件是否存在的脚本
A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

usage

需要注意，在盲注时如果开启多线程会导致不稳定
It should be noted that if multi-threading is enabled during blind injection, it will cause instability

usage: test2.py [-h] [-u URL | -r HEADERS_DATA] [-w FILE] [-t THREADS]

By zongdeiqianxing; Email: [email protected]

optional arguments:
  -h, --help       show this help message and exit
  -u URL
  -r HEADERS_DATA  HTTP request header
  -w FILE          wordlist containing file path
  -t THREADS       threads count

show

$ python3 TraverseFilesBySQLInjection.py -r 1.txt -w linux.txt 
2021-10-23 23:01:51,211 - __main__ - INFO - The program has been started, if found readable files, it will be displayed, please wait..
2021-10-23 23:02:21,234 - __main__ - INFO - /etc/hosts file exists
2021-10-23 23:02:41,058 - __main__ - INFO - /etc/hostname file exists
2021-10-23 23:03:00,863 - __main__ - INFO - /etc/passwd file exists

A script based on sqlmap that uses sql injection vulnerabilities to traverse the existence of a file

Related tags

Overview

TraverseFilesBySQLInjection

usage

show

Owner

JavaScript Raider is a coverage-guided JavaScript fuzzing framework designed for the v8 JavaScript engine

Bypass's HCaptcha by overloading their api causing it to throwback a generated uuid. (Released due to exposure)

Chrome Post-Exploitation is a client-server Chrome exploit to remotely allow an attacker access to Chrome passwords, downloads, history, and more.

Let's you scan the entire internet in a couple of hours and identify all Minecraft servers on IPV4

Files related to PoC||GTFO 21:21 - NSA’s Backdoor of the PX1000-Cr

A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts

Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10

Get important strings inside [Info.plist] & and Binary file also all output of result it will be saved in [app_binary].json , [app_plist_file].json file

BurpSuite Extension: Log4j RCE Scanner

LinOTP - the open source solution for two factor authentication

An open-source post-exploitation framework for students, researchers and developers.

ssh-audit is a tool for ssh server & client configuration auditing.

Profil3r is an OSINT tool that allows you to find potential profiles of a person on social networks, as well as their email addresses 🕵️

An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device.

A python package with tools to read and postprocess the output of the channel DNS-solver (davecats/channel), as well as its associated postprocessing tools.

Port scanning tool that uses Python3. Created by Noble Wilson

Obfuscate your Python scripts better, faster.

Python exploit code for CVE-2021-4034 (pwnkit)

Safe Policy Optimization with Local Features

Automatic ProxyShell Exploit