mechanize python XE #19
def sqli(target, sqli_list):
sqli_list = open(sqli_list)
for sqli in sqli_list.readlines():
sqli = sqli.rstrip()
br = mechanize.Browser()
br.set_handle_equiv(False)
br.set_handle_redirect(False)
br.set_handle_referer(False)
br.set_handle_robots(False)
br.open(target)
br.select_form(nr=0)
time.sleep(2)
for field in br.form.controls:
if field.type == "text":
br.form[field.name] = str(sqli)
print br.form#"! injecting {0}, in the form {1}, on the page: {2}".format(str(sqli), str(br.form.name), str(target))
request = br.click(type="submit")
response = br.open(request)
if response.code == 200:
print "No dice... 200 OK response"
if response.code == 500:
print "500 Internal Error, potential SQL with {0}".format(str(field))