关于测试SQL注入漏洞的问题 ( 积分: 100 )

function CheckUrl(url: String; TimeOut: integer = 4000): boolean;
var
hSession,hfile,hRequest: hInternet;
dwindex,dwcodelen: dword;
dwcode: array[1..20] of char;
res: PChar;
re: Integer;
Err1: integer;
j: integer;
begin
Result:= false;
hSession:= InternetOpen('Mozilla/4.0',INTERNET_OPEN_TYPE_PRECONFIG,nil,nil,0);
InternetSetOption(hSession,Internet_option_connect_timeout,@TimeOut,4);
if assigned(hSession) then
begin
j := 1;
while true do
begin
hfile:= InternetOpenUrl(hSession,PChar(url),nil,0,INTERNET_FLAG_RELOAD,0);
if hfile = nil then
begin
j := j + 1;
Err1 := GetLastError;
if j > 5 then break;
if (Err1 <> 12002) or (Err1 <> 12152) then break;
sleep(4000);
end
else
break;
end; //end while
dwIndex := 0;
dwCodeLen := 10;
HttpQueryInfo(hfile,HTTP_QUERY_STATUS_CODE,@dwcode,dwcodelen,dwIndex);
res := PChar(@dwcode);
re := StrToIntdef(res,404);
case re of
500: result := true
else
result:= false;
end;
if assigned(hfile) then
InternetCloseHandle(hfile);
InternetCloseHandle(hSession);
end;
end;
我是这么写的判断URL后面加and 1=2返回报头是500
但是没有注入漏洞的连接也出来了，我想实现啊Ｄ注入程序的注入点测试功能．
我的原码和啊Ｄ注入程序一起打包了，请高手帮帮忙，在线等QQ:78292959
请大家复制连接，然后在新窗口中下载
http://free.ys168.com:8000/ys168up/D1/Ys.aspx?f=qiuzhu.rary70z73f8b3f8b3f8b2z95b0f8b0f8f9b4f5f9f9b0b7b0b0f6e14z97e14e24b1b0f2f8b2f9f9f6b3b7z

function CheckUrl(url: String; TimeOut: integer = 4000): boolean;
var
hSession,hfile,hRequest: hInternet;
dwindex,dwcodelen: dword;
dwcode: array[1..20] of char;
res: PChar;
re: Integer;
Err1: integer;
j: integer;
begin
Result:= false;
hSession:= InternetOpen('Mozilla/4.0',INTERNET_OPEN_TYPE_PRECONFIG,nil,nil,0);
InternetSetOption(hSession,Internet_option_connect_timeout,@TimeOut,4);
if assigned(hSession) then
begin
j := 1;
while true do
begin
hfile:= InternetOpenUrl(hSession,PChar(url),nil,0,INTERNET_FLAG_RELOAD,0);
if hfile = nil then
begin
j := j + 1;
Err1 := GetLastError;
if j > 5 then break;
if (Err1 <> 12002) or (Err1 <> 12152) then break;
sleep(4000);
end
else
break;
end; //end while
dwIndex := 0;
dwCodeLen := 10;
HttpQueryInfo(hfile,HTTP_QUERY_STATUS_CODE,@dwcode,dwcodelen,dwIndex);
res := PChar(@dwcode);
re := StrToIntdef(res,404);
case re of
500: result := true
else
result:= false;
end;
if assigned(hfile) then
InternetCloseHandle(hfile);
InternetCloseHandle(hSession);
end;
end;
我是这么写的判断URL后面加and 1=2返回报头是500
但是没有注入漏洞的连接也出来了，我想实现啊Ｄ注入程序的注入点测试功能．
我的原码和啊Ｄ注入程序一起打包了，请高手帮帮忙，在线等QQ:78292959
请大家复制连接，然后在新窗口中下载
http://free.ys168.com:8000/ys168up/D1/Ys.aspx?f=qiuzhu.rary70z73f8b3f8b3f8b2z95b0f8b0f8f9b4f5f9f9b0b7b0b0f6e14z97e14e24b1b0f2f8b2f9f9f6b3b7z