网络爬虫+SQL注入检测一

项目目录结构

/w8ay.py //项目启动主文件

/lib/core //核心文件存放目录

/lib/core/config.py //配置文件

/script //插件存放

/exp //exp和poc存放

四、实验步骤

4.1 sql检测脚本编写

用一个字典存储数据库特征：

DBMS_ERRORS = { # regular expressions used for DBMS recognition based on error message response

"MySQL": (r"SQL syntax.*MySQL", r"Warning.*mysql_.*", r"valid MySQL result", r"MySqlClient\."),

"PostgreSQL": (r"PostgreSQL.*ERROR", r"Warning.*\Wpg_.*", r"valid PostgreSQL result", r"Npgsql\."),

"Microsoft SQL Server": (r"Driver.* SQL[\-\_\ ]*Server", r"OLE DB.* SQL Server", r"(\W|\A)SQL Server.*Driver", r"Warning.*mssql_.*", r"(\W|\A)SQL Server.*[0-9a-fA-F]{8}", r"(?s)Exception.*\WSystem\.Data\.SqlClient\.", r"(?s)Exception.*\WRoadhouse\.Cms\."),

"Microsoft Access": (r"Microsoft Access Driver", r"JET Database Engine", r"Access Database Engine"),

"Oracle": (r"\bORA-[0-9][0-9][0-9][0-9]", r"Oracle error", r"Oracle.*Driver", r"Warning.*\Woci_.*", r"Warning.*\Wora_.*"),

"IBM DB2": (r"CLI Driver.*DB2", r"DB2 SQL error", r"\bdb2_\w+\("),

"SQLite": (r"SQLite/JDBCDriver", r"SQLite.Exception", r"System.Data.SQLite.SQLiteException", r"Warning.*sqlite_.*", r"Warning.*SQLite3::", r"\[SQLITE_ERROR\]"),

"Sybase": (r"(?i)Warning.*sybase.*", r"Sybase message", r"Sybase.*Server message.*"),

}

通过正则，如果发现我们的正则语句，就可以判断出是哪个数据库了。

for (dbms, regex) in ((dbms, regex) for dbms in DBMS_ERRORS for regex in DBMS_ERRORS[dbms]):

if(re.search(regex,_content)):

return True

这个是我们的测试语句[payload]。

BOOLEAN_TESTS = (" AND %d=%d", " OR NOT (%d=%d)")

用报错语句返回正确的内容和错误的内容进行对比。

for test_payload in BOOLEAN_TESTS:

#正确的网页

RANDINT = random.randint(1, 255)

_url = url + test_payload%(RANDINT,RANDINT)

content["true"] = Downloader.get(_url)

_url = url + test_payload%(RANDINT,RANDINT+1)

content["false"] = Downloader.get(_url)

if content["origin"]==content["true"]!=content["false"]:

return "sql fonud: %"%url

这一句：

content["origin"]==content["true"]!=content["false"]

意思就是当原始的网页等于正确的网页不等于错误的网页内容时就可以判定这个地址存在注入漏洞。

完整代码：

import re,random

from lib.core import Download

def sqlcheck(url):

if(not url.find("?")):

return False

Downloader = Download.Downloader()

BOOLEAN_TESTS = (" AND %d=%d", " OR NOT (%d=%d)")

DBMS_ERRORS = {# regular expressions used for DBMS recognition based on error message response