Skip to content

Commit a7bb820

Browse files
MindPatchMindPatch
authored
Old scripts
1 parent 75cde67 commit a7bb820

File tree

3 files changed

+215
-0
lines changed

3 files changed

+215
-0
lines changed

‎active/sqli_errs.lua‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
SQLI_ERRORS = read(string.format("%s/txt/sqli_errs.txt",SCRIPT_PATH))
2+
3+
PAYLOADS = {
4+
"'123",
5+
"''123",
6+
"`123",
7+
"\")123",
8+
"\"))123",
9+
"`)123",
10+
"`))123",
11+
"'))123",
12+
"')123\"123",
13+
"[]123",
14+
"\"\"123",
15+
"'\"123",
16+
"\"'123",
17+
"\123",
18+
}
19+
20+
local function send_report(url,parameter,payload,matching_error)
21+
NewReport:setName("SQL Injection")
22+
NewReport:setDescription("https://owasp.org/www-community/attacks/SQL_Injection")
23+
NewReport:setRisk("high")
24+
NewReport:setUrl(url)
25+
NewReport:setParam(parameter)
26+
NewReport:setAttack(payload)
27+
NewReport:setEvidence(matching_error)
28+
end
29+
30+
function main(url)
31+
local resp = http:send("GET",HttpMessage:getUrl())
32+
if resp.errors:GetErrorOrNil() then
33+
local log_msg = string.format("[SQLI_ERRORS] Connection Error: %s",new_url)
34+
log_error(log_msg)
35+
return
36+
end
37+
for param_index, param_name in pairs(HttpMessage:getParams()) do
38+
STOP_PARAM = false
39+
for payload_index, payload in pairs(PAYLOADS) do
40+
local new_url = HttpMessage:setParam(param_name,payload)
41+
local resp = http:send("GET",new_url)
42+
local body = resp.body:GetStrOrNil()
43+
if STOP_PARAM == true then
44+
break
45+
end
46+
for sqlerror_match in SQLI_ERRORS:gmatch("[^\n]+") do
47+
local match = is_match(sqlerror_match,body)
48+
if ( match == false or match == nil) then
49+
-- NOTHING
50+
else
51+
send_report(resp.url:GetStrOrNil(),param_name,payload,sqlerror_match)
52+
Reports:addReport(NewReport)
53+
STOP_PARAM = true
54+
break
55+
end
56+
end
57+
end
58+
end
59+
end

‎active/txt/sqli_errs.txt‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
unsupported nested scalar subselect
2+
ibm_db_dbi\.ProgrammingError
3+
(?s)Exception.*?Roadhouse\.Cms\.
4+
Warning.*?\Wmaxdb_
5+
![0-9]{5}![^]
6+
nl\.cwi\.monetdb\.jdbc
7+
SQLServer JDBC Driver
8+
Pdo[./_\](Oracle|OCI)
9+
SQL Server[^<"]+[0-9a-fA-F]{8}
10+
DB-Error.*
11+
quoted string not properly terminated
12+
check the manual that (corresponds to|fits) your MySQL server version
13+
valid MySQL result
14+
org\.jkiss\.dbeaver\.ext\.vertica
15+
/vertica/Parser/scan
16+
Altibase\.jdbc\.driver
17+
ODBC SQL Server Driver
18+
ORA-\d{5}
19+
is not supported by MemSQL
20+
SQL Server[^<"]+Driver
21+
Warning.*?\Wsybase_
22+
Syntax error \(missing operator\) in query expression
23+
macromedia\.jdbc\.oracle
24+
\[-3008\].*?: Invalid keyword or missing delimiter
25+
org\.sqlite\.JDBC
26+
com\.mckoi\.database\.jdbc
27+
Sybase.*?Server message
28+
Unexpected end of command in statement \[
29+
macromedia\.jdbc\.sqlserver
30+
Oracle.*?Driver
31+
Warning.*?\W(oci|ora)_
32+
OLE DB.*? SQL Server
33+
Virtuoso S0002 Error
34+
Pdo[./_\]Mysql
35+
SybSQLException
36+
Oracle error
37+
Warning.*?\W(sqlite_|SQLite3::)
38+
SQLite/JDBCDriver
39+
Zend_Db_(Adapter|Statement)_Db2_Exception
40+
Pdo[./_\]Pgsql
41+
ERROR:\s\ssyntax error at or near
42+
Warning.*?\Wifx_
43+
SQ074: Line \d+:
44+
Syntax error 1. Missing
45+
<REGEX_LITERAL>
46+
MySQLSyntaxErrorException
47+
\[42000-192\]
48+
org\.h2\.jdbc
49+
Driver.*? SQL[\-\_\ ]*Server
50+
com\.mysql\.jdbc
51+
DriverSapDB
52+
com\.sap\.dbtech\.jdbc
53+
CLI Driver.*?DB2
54+
io\.prestosql\.jdbc
55+
com\.mckoi\.JDBCDriver
56+
org\.firebirdsql\.jdbc
57+
Sybase message
58+
Zend_Db_(Adapter|Statement)_Oracle_Exception
59+
-10048: Syntax error
60+
MemSQL does not support this type of query
61+
Warning.*?\Wibase_
62+
org\.hsqldb\.jdbc
63+
com\.sybase\.jdbc
64+
PSQLException
65+
com\.facebook\.presto\.jdbc
66+
Pdo[./_\]Firebird
67+
SQLCODE[=:\d, -]+SQLSTATE
68+
Dynamic SQL Error
69+
org\.postgresql\.util\.PSQLException
70+
ODBC Informix driver
71+
SQL syntax.*?MySQL
72+
check the manual that (corresponds to|fits) your MariaDB server version
73+
Unclosed quotation mark after the character string
74+
Pdo[./_\]Ibm
75+
-3014.*?Invalid end of SQL statement
76+
Microsoft SQL Native Client error '[0-9a-fA-F]{8}
77+
SQ200: No table
78+
com\.ibm\.db2\.jcc
79+
Microsoft Access (\d+ )?Driver
80+
PostgreSQL query failed
81+
Access Database Engine
82+
Pdo[./_\]Sqlite
83+
ODBC Driver \d+ for SQL Server
84+
SR185: Undefined procedure
85+
sqlite3.OperationalError:
86+
Syntax error,[^
87+
JET Database Engine
88+
Exception.*?Informix
89+
Warning.*?\Wmysqli?_
90+
Zend_Db_(Adapter|Statement)_Mysqli_Exception
91+
valid PostgreSQL result
92+
com\.jnetdirect\.jsql
93+
DB2Exception
94+
Informix ODBC Driver
95+
]+assumed to mean
96+
\[SQL Server\]
97+
oracle\.jdbc
98+
Warning.*?\Wpg_
99+
SQL error.*?POS([0-9]+)
100+
Syntax error: Encountered
101+
Npgsql\.
102+
SQLite error \d+:
103+
SQL(Srv|Server)Exception
104+
Ingres SQLSTATE
105+
com\.vertica\.dsi\.dataengine
106+
org\.apache\.derby
107+
UNION query has different number of fields: \d+, \d+
108+
IfxException
109+
weblogic\.jdbc\.informix
110+
Unknown column '[^ ]+' in 'field list'
111+
]+(failed|unexpected|error|syntax|expected|violation|exception)
112+
SQL command not properly ended
113+
com\.simba\.presto\.jdbc
114+
io\.crate\.client\.jdbc
115+
Sybase\.Data\.AseClient
116+
DB2 SQL error
117+
\[SQLITE_ERROR\]
118+
PostgreSQL.*?ERROR
119+
com\.informix\.jdbc
120+
Unexpected token.*?in statement \[
121+
Exception (condition )?\d+\. Transaction rollback
122+
A comparison operator is required here
123+
db2_\w+\(
124+
com\.ingres\.gcf\.jdbc
125+
ERROR 42X01
126+
OracleException
127+
(Semantic|Syntax) error [1-4]\d{2}\.
128+
Zend_Db_(Adapter|Statement)_Sqlsrv_Exception
129+
System\.Data\.SqlClient\.SqlException\.(SqlException|SqlConnection\.OnError)
130+
com\.mimer\.jdbc
131+
SQLiteException
132+
(Microsoft|System)\.Data\.SQLite\.SQLiteException
133+
check the manual that (corresponds to|fits) your Drizzle server version
134+
\[(Virtuoso Driver|Virtuoso iODBC Driver)\]\[Virtuoso Server\]
135+
Warning.*?\W(mssql|sqlsrv)_
136+
SQLSTATE\[\d+\]: Syntax error or access violation
137+
ODBC Microsoft Access
138+
MySqlException
139+
org\.postgresql\.jdbc
140+
Pdo[./_\]Informix
141+
Warning.*?\Wingres_
142+
com\.vertica\.jdbc
143+
encountered after end of query
144+
PG::SyntaxError:
145+
\[MonetDB\]\[ODBC Driver
146+
com\.microsoft\.sqlserver\.jdbc
147+
Ingres\W.*?Driver
148+
, Sqlstate: (3F|42).{3}, (Routine|Hint|Position):
149+
Pdo[./_\](Mssql|SqlSrv)
150+
ERROR: parser: parse error at or near
151+
MySqlClient\.
152+
com\.frontbase\.jdbc
153+
SQLite3::SQLException
154+
rdmStmtPrepare\(.+?\) returned
155+
SQLite\.Exception

‎active/txt/xss.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
"><img src=x onerror=alert()>

0 commit comments

Comments
 (0)