Created
March 16, 2021 18:55
-
-
Save joswr1ght/9efa1c80af6cdda917954204eda9e4f0 to your computer and use it in GitHub Desktop.
SQL Injection Vulnerable Code Scanning Shell Command
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# This heinous command searches for SQL injection vulnerable code: | |
# 1. Use awk to convert multiline strings into a single line | |
# 2. Fix things up with sed to make line endings normal again | |
# 3. Search for SQL-related statements | |
# 4. Search for lines where there are two or more $ variable indicators | |
# | |
# This is a hack. Please don't let this be my legacy. | |
# | |
awk -F"\"" '!$NF{ print; next }{ printf("%s ", $0) }' *.php | sed 's/;/;\n/g;s/}/}\n/g' | grep -iE "select|insert|update|delete" | grep -E "\\$.*\\$" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment