1##
2# This file is part of WhatWeb and may be subject to
3# redistribution and commercial restrictions. Please see the WhatWeb
4# web site for more information on licensing and terms of use.
5# http://www.morningstarsecurity.com/research/whatweb
6##
7# Version 0.2 # 2011-03-06 #
8# Updated regex
9##
10Plugin.define "mySQL-Error" do
11author "Brendan Coles <bcoles@gmail.com>" # 2010-09-04
12version "0.2"
13description "This plugin detects mySQL errors and grabs the username, server and database details."
14
15# Google results as at 2010-08-28 #
16# 318 for mySQL "Error: Access denied for user" "using password: YES"|"using password: NO"|"to database"
17# 304 for Warning mysql_connect "function.mysql-connect" "Access denied for user"
18# 162 for "Warning: mysql_connect" "function.mysql-connect" "Lost connection to MySQL server at 'reading initial communication packet'" +ext:php
19
20# Dorks #
21dorks [
22'mySQL "Error: Access denied for user" "using password: YES"|"using password: NO"|"to database"',
23'Warning mysql_connect "function.mysql-connect" "Access denied for user"',
24'"Warning: mysql_connect" "function.mysql-connect" "Lost connection to MySQL server at \'reading initial communication packet\'" ext:php'
25]
26
27
28
29# Matches #
30matches [
31
32# Syntax Error # Match taken from the mySQLSyntaxError plugin by Caleb Anderson
33{ :regexp=>/You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '|You have an error in your SQL syntax near '/, :certainty=>25 },
34
35# mysql_connect[Connection failed] # Plain text # Italian
36{ :text=>"Connessione non riuscita: Can't connect to local MySQL server through socket ", :certainty=>25 },
37
38# mysql_connect[Connection failed] # HTML # English
39{ :text=>"<b>Warning</b>:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Can't connect to local MySQL server through socket" },
40
41# mysql_connect[Lost connection] # Plain text # English
42{ :text=>"Warning: mysql_connect() [function.mysql-connect]: Lost connection to MySQL server at 'reading initial communication packet', ", :certainty=>25 },
43
44# mysql_connect[Lost connection] # HTML # English
45{ :text=>"<b>Warning</b>:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Lost connection to MySQL server at 'reading initial communication packet', " },
46
47# Grab mySQL username, server and database details
48
49# mysql_connect[Access denied] # English # HTML
50{ :account=>/<b>Warning<\/b>:  mysql_connect\(\) \[<a href='function.mysql-connect'>function.mysql-connect<\/a>\]: Access denied for user ([^\ ]+)/ },
51
52# mysql_query[Access denied] # English # HTML
53{ :account=>/<b>Warning<\/b>:  mysql_query\(\) \[<a href='function.mysql-query'>function.mysql-query<\/a>\]: Access denied for user ([^\ ]+)/ },
54
55# mysql_connect[Access denied] # English # Plain text
56{ :account=>/Error: Access denied for user ([^\ ]+) to database ([^\s]+)/ },
57{ :string=>/Error: Access denied for user ([^\ ]+) to database ([^\s]+)/, :offset=>1 },
58
59# mysql_connect[Connection failed] # English # Plain text
60{ :string=>/Error: Connection to mySQL-database at ([^\ ]+) failed!/ },
61
62# mysql_connect[Lost connection] # Italian # Plain text
63{ :string=>/Errore: Non riesco a connettermi al server MySql ([a-z0-9\.\-\_]+)/ },
64
65# mysql_connect[Lost connection] # Italian # Plain text
66{ :string=>/Errore: Non riesco a selezionare il database ([a-z0-9\.\-\_]+)/ },
67
68]
69
70end
71
72