PHP+MYSQL网站注入扫描[17]

memo:tmemo);
begin
tmpurl :=url;
tmpnum :=num; // 传递参数
tmplbx :=lbx;
tmpmemo :=memo;
freeonterminate :=true; // 自动删除
initializecriticalsection(cs); //初始化临界区
inherited create(false); // 直接运行
end;

//====================== 判断网址是否存在的函数 =======================
function checkurl(url: string; timeout: integer = 5000): boolean;
var
hsession, hfile, hrequest: hinternet;
dwindex, dwcodelen: dword;
dwcode: array[1..20] of char;
res: pchar;
re: integer;
err1: integer;
j: integer;
begin
if pos('http://', lowercase(url)) = 0 then
  url := 'http://' + url;
result := false;
internetsetoption(hsession, internet_option_connect_timeout, @timeout, 4);
hsession := internetopen('mozilla/4.0', internet_open_type_preconfig, nil, nil, 0);
  //设置超时
if assigned(hsession) then
begin
  j := 1;
  while true do
  begin
    hfile := internetopenurl(hsession, pchar(url), nil, 0, internet_flag_reload, 0);
  if hfile = nil then
    begin
    j := j + 1;
    err1 := getlasterror;
    if j > 5 then break;
    if (err1 <> 12002) or (err1 <> 12152) then break;
    sleep(2);
    end
    else begin
    break;
    end;
  end;
  dwindex := 0;
  dwcodelen := 10;
  httpqueryinfo(hfile, http_query_status_code, @dwcode, dwcodelen, dwindex);
  res := pchar(@dwcode);
  re := strtointdef(res, 404);
  case re of
    400..450: result := false;
  else result := true;
  end;
  if assigned(hfile) then
    internetclosehandle(hfile);
    internetclosehandle(hsession);
  end;
end;

function getbackspacecount(str:string):string;
var i,icount:integer;
begin
  icount :=50-length(str);
  for i:=0 to icount-1 do
  begin
  result :=result+' ';
  end;
end;

procedure scanmanagerthread.scanresult;
begin
tmplbx.items.add(str);
form1.groupbox1.caption :='检测结果：共找到'+inttostr(tmplbx.items.count)+'条路径';
end;

procedure scanmanagerthread.execute;
begin
str :=tmpurl + form1.lsbdict.items[tmpnum];
entercriticalsection(cs);       //进入临界区
tmpmemo.lines.add(str);
if checkurl(str) then
begin
  synchronize(scanresult); // 同步
end;
leavecriticalsection(cs);     //退出临界区
//sleep(20); // 线程挂起;
end;

end.

简介：php+mysql网站注入扫描工具，针对类似夜猫文章下
载系统比较有效，界面是仿教程的hdsi中的php注入模块写
的，实现原理是参考angel的sql injection with mysql
写的，网上有很多，不再细说。

界面截图：http://www.wrsky.com/attachment/3_1891.jpg

源码下载：http://downloads.2ccc.com/general/internet_lan/phpinj.rar

author: hnxyy
qq: 19026695
date: 2005/5/25

firefox技术交流论坛
http://www.wrsky.com
it is all beginnings free
it is all ruin to be privately owned