ghostlulzhacks / waybackSqliScanner

184 stars 63 forks source link

Does nothing? #2

Open devCodeRise opened 5 years ago

devCodeRise commented 5 years ago

After issuing the command highlighted in the Usage section, it just sits there. Nothing is going on.

prosecurity commented 5 years ago

experiencing the same thing

ghostlulzhacks commented 5 years ago

Its probably because it didnt find anything. The script only outputs vulnerable urls.

DEMON1A commented 3 years ago

Hey dude @ghostlulzhacks, Are you still active in 2021? So, before creating a project and pushing it to the public make sure it's working. it took me 10 minutes to debug your code to get where the error is.

The basic idea here is that you're using threading. which disallows you from seeing python error messages on the CLI. So in sqliscanner.py file line 48 you're using this line of code.

html = r.content

But basically, content does return bytes object and regex is using string comparing. so to solve this hall issue you need to replace .content with .text. all of the other stuff is working and I did get results from your script on acunetix test website

[root@demonia-vps]:~/tools/waybackSqliScanner - ls
README.md  __pycache__  main.py  sqliscanner.py  waybackmachine.py
[root@demonia-vps]:~/tools/waybackSqliScanner - python3 main.py testphp.vulnweb.com
Vulnerable  http://testphp.vulnweb.com/artists.php?artist=-1'
Vulnerable  http://testphp.vulnweb.com/artists.php?artist=-1%20union%20select%201,2,group_concat(pass)%20from%20users--'
Vulnerable  http://testphp.vulnweb.com:80/AJAX/infocateg.php?id=1'
Vulnerable  http://testphp.vulnweb.com:80/artists.php?artist=1''
Vulnerable  http://testphp.vulnweb.com/artists.php?artist=1-SLEEP(3)'
Vulnerable  http://testphp.vulnweb.com/artists.php?artist=-1%20UNION%20SELECT%201,version(),current_user()'

So for all people seeing this issue if the author won't do something to fix this issue please go to your sqliscanner.py file then find line 48 and change html = r.content to html = r.text and it should work fine.

DEMON1A commented 3 years ago