BSQLBF()

NAME
bsqlbf - blind sql injection brute forcer

SYNOPSIS
bsqlbf [-url STRING] [OPTIONS]

DESCRIPTION
This is a modified version of 'bsqlbfv1.2-th.pl'. This perl script allows extraction of data from Blind SQL Injections. It accepts custom SQL queries as a command line parameter and it works for both integer and string based injections.

  Databases Supported
0: MS-SQL

1: MySQL

2: PostgreSQL

3: Oracle

  Attack Modes
Type 0: Blind SQL Injection based on true and false conditions returned by back-end server

Type 1: Blind SQL Injection based on true and error(e.g syntax error) returned by back-end server.

Type 2: Blind SQL Injection in "order by" and "group by".

Type 3: extracting data with SYS privileges (ORACLE dbms_export_extension exploit)

Type 4: is O.S code execution (ORACLE dbms_export_extension exploit)

Type 5: is reading files (ORACLE dbms_export_extension exploit, based on java)

Type 6: is O.S code execution DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC exploit

Type 7: is O.S code execution SYS.KUPP$PROC.CREATE_MASTER_PROCESS(), DBA Privs

    -cmd=revshell Type 7 supports meterpreter payload execution, run generator.exe first

Type 8: is O.S code execution DBMS_JAVA_TEST.FUNCALL, with JAVA IO Permissions

    -cmd=revshell Type 8 supports meterpreter payload execution, run generator.exe first

  O.S Code Execution Methods (Type 4)
SType 0 (default): is based on java..will NOT work against XE.

SType 1: is against oracle 9 with plsql_native_make_utility.

SType 2: is against oracle 10 with dbms_scheduler.

OPTIONS
-sql: valid SQL syntax to get; version(), database(), (select table_name from inforamtion_schema.tables limit 1 offset 0)

-get: If MySQL user is root, supply word readable file name

-blind: parameter to inject sql. Default is last value of url

-match: RECOMMENDED string to match in valid query (default is auto)

-start: if you know the beginning of the string, use it with this

-length: maximum length of value (default is 32)

-time: timer options:

    0: dont wait (default)
    1: wait 15 seconds
    2: wait 5 minutes

-type: Type of injection:

    0: Type 0 (default) is blind injection based on True and False responses
    1: Type 1 is blind injection based on True and Error responses
    2: Type 2 is injection in order by and group by
    3: Type 3 is extracting data with SYS privileges (ORACLE dbms_export_extension exploit)
    4: Type 4 is O.S code execution (ORACLE dbms_export_extension exploit)
    5: Type 5 is reading files (ORACLE dbms_export_extension exploit, based on java)

-file: File to read (default is C:\boot.ini)

-stype: How you want to execute command: 0: SType 0 (default) is based on java..will NOT work against XE 1: SType 1 is against oracle 9 with plsql_native_make_utility 2: SType 2 is against oracle 10 with dbms_scheduler

-database: Backend database: 0: MS-SQL (default) 1: MYSQL 2: POSTGRES 3: ORACLE

-rtime: wait random seconds, for example: "10-20"

-method: http method to use; get or post (default is GET)

-cmd: command to execute (type 4 only) (default is "ping 127.0.0.1.")

-uagent: http UserAgent header to use (default is bsqlbf 2.3)

-ruagent: file with random http UserAgent header to use

-cookie: http cookie header to use

-rproxy: use random http proxy from file list.

-proxy: use proxy http. Syntax -proxy=http://proxy:port/ -proxy_user: proxy http user

-proxy_pass: proxy http password

EXAMPLES

  Integer based Injection
bsqlbf -url http://www.host.com/path/script.php?foo=1000 [options]

  String Based Injection
bsqlbf -url http://www.host.com/path/script.php?foo=bar' [options]

  Other Examples
bsqlbf -url http://www.somehost.com/blah.php?u=5 -blind u -sql "select table_name from imformation_schema.tables limit 1 offset 0" -database 1 -type 1

bsqlbf -url http://www.buggy.com/bug.php?r=514&p=foo' -method post -get "/etc/passwd" -match "foo"